cicy-desktop 2.1.342 → 2.1.358

package/src/backends/hub-client.js

@@ -12,6 +12,10 @@
 //   hub:open         {id}     → one-time grant URL → opened as a team tab; the
 //                               grant sets the domain-wide hub session cookie so
 //                               later opens need no login at all
+//   hub:projects     {id}     → that node's projects, each with its agents —
+//                               read straight off the node's own API through its
+//                               hub hostname (the gateway accepts the owner's hub
+//                               token as bearer and swaps in the node's api token)
 //
 // The desktop registers itself as a hub instance (id `code-desktop-…`) because
 // hub tokens are bound to (owner, instance). It never heartbeats, so it is
@@ -333,7 +337,8 @@ async function instances() {
   const out = list
     // direct: `self` is this desktop's hidden pseudo-instance; via sidecar: `self` is the
     // local node itself, which IS a real instance the user may want to open.
-    .filter((i) => (viaSidecar || !i.self) && !String(i.platform || "").startsWith("desktop"))
+    // Viewer logins (this desktop, other desktops, phones) are not machines.
+    .filter((i) => (viaSidecar || !i.self) && !/^(desktop|mobile)/.test(String(i.platform || "")))
     .map((i) => ({
       id: i.instanceId,
       name: i.name || (i.proxyHost ? String(i.proxyHost).split(".")[0] : i.instanceId),
@@ -350,6 +355,8 @@ async function instances() {
       resources: i.resources || null,
       ports: Array.isArray(i.ports) ? i.ports : [],
       agents: Array.isArray(i.agents) ? i.agents.length : undefined,
+      // The node's last agent snapshot (agentId/title/status/model/working…).
+      agentList: Array.isArray(i.agents) ? i.agents : [],
     }))
     .sort((x, y) => Number(y.online) - Number(x.online) || x.name.localeCompare(y.name));
   // Every host in this list was fetched with the owner's own token, so each one
@@ -358,9 +365,98 @@ async function instances() {
   try {
     hubTrust.recordOwnerHubHosts(out.map((i) => i.host));
   } catch {}
+  _lastInstances = out;
   return { ok: true, owner: res.json.owner || a.owner, viaSidecar, instances: out };
 }
 
+// ── node drill-down: projects → agents ──────────────────────────────────────
+// Every instance host is the node's own cicy-code API; the hub gateway lets the
+// owner's hub token through (swapping in the node's api token), so the desktop
+// can read /api/groups (projects), /api/panes and /api/poll directly — no
+// cookie session, no per-node credential.
+let _lastInstances = [];
+const NODE_TIMEOUT_MS = 15_000;
+
+async function nodeFetch(host, route, token) {
+  const ctrl = new AbortController();
+  const t = setTimeout(() => ctrl.abort(), NODE_TIMEOUT_MS);
+  try {
+    const r = await pickFetch()("https://" + host + route, {
+      headers: { accept: "application/json", authorization: "Bearer " + token },
+      signal: ctrl.signal,
+      cache: "no-store",
+    });
+    const text = await r.text();
+    let json = null;
+    try {
+      json = text ? JSON.parse(text) : null;
+    } catch {}
+    if (!r.ok) throw new Error(`${route}: HTTP ${r.status}`);
+    return json;
+  } finally {
+    clearTimeout(t);
+  }
+}
+
+const shortWid = (paneId) => String(paneId || "").split(":")[0];
+
+async function projects({ id } = {}) {
+  const a = readAuth();
+  if (!a) return { ok: false, error: "not_logged_in", projects: [] };
+  let inst = _lastInstances.find((i) => i.id === id);
+  if (!inst) {
+    const r = await instances();
+    inst = (r.instances || []).find((i) => i.id === id);
+  }
+  if (!inst || !inst.host) return { ok: false, error: "instance_not_found", projects: [] };
+  const [groupsRes, panesRes, pollRes] = await Promise.all([
+    nodeFetch(inst.host, "/api/groups", a.token).catch(() => null),
+    nodeFetch(inst.host, "/api/panes", a.token),
+    nodeFetch(inst.host, "/api/poll", a.token).catch(() => null),
+  ]);
+  const groups = Array.isArray(groupsRes) ? groupsRes : (groupsRes && groupsRes.groups) || [];
+  const panes = (Array.isArray(panesRes) ? panesRes : (panesRes && panesRes.panes) || []).filter(
+    (p) => p && typeof p.pane_id === "string" && p.pane_id
+  );
+  const statuses = (pollRes && pollRes.statuses) || {};
+  const pollRows = new Map();
+  for (const row of (pollRes && pollRes.agents) || [])
+    if (row && row.name) pollRows.set(String(row.name), row);
+  // Every pane on the node is an agent (masters included).
+  const agents = new Map();
+  for (const p of panes) {
+    const wid = shortWid(p.pane_id);
+    if (!wid || agents.has(wid)) continue;
+    const row = pollRows.get(wid) || {};
+    agents.set(wid, {
+      wid,
+      title: p.title || row.title || wid,
+      agentType: p.agent_type || row.agent_type || "",
+      role: p.role || "",
+      status: String(statuses[p.pane_id] || statuses[wid] || row.status || ""),
+      model: p.default_model || "",
+      workspace: p.workspace || "",
+    });
+  }
+  const placed = new Set();
+  const out = [];
+  for (const g of groups) {
+    const ids = new Set((g.pane_ids || []).map(shortWid));
+    const members = [...agents.values()].filter((x) => ids.has(x.wid) && !placed.has(x.wid));
+    for (const m of members) placed.add(m.wid);
+    if (!members.length && !g.is_default) continue;
+    out.push({
+      id: String(g.id),
+      name: g.name || String(g.project_template || g.id),
+      slug: g.project_template || "",
+      agents: members,
+    });
+  }
+  const rest = [...agents.values()].filter((x) => !placed.has(x.wid));
+  if (rest.length) out.push({ id: "ungrouped", name: "", slug: "", agents: rest });
+  return { ok: true, host: inst.host, projects: out };
+}
+
 // One-time hand-off URL for an instance (optionally one of its local ports).
 async function grantUrl({ id, port = 0, next = "/" } = {}) {
   const a = readAuth();
@@ -410,4 +506,14 @@ async function logout() {
   return { ok: true };
 }
 
-module.exports = { status, loginStart, loginCode, cancel, instances, grantUrl, logout, hubOrigin };
+module.exports = {
+  status,
+  loginStart,
+  loginCode,
+  cancel,
+  instances,
+  projects,
+  grantUrl,
+  logout,
+  hubOrigin,
+};

package/src/backends/sidecar-ipc.js

@@ -149,6 +149,16 @@ function register({ sidecarLogPath } = {}) {
   // 退避:子进程被拦(安全软件开机后一段时间会自己放行)2 分钟一试;其余 15 分钟一试。
   const AUTO_RETRY_MS = { spawn_blocked: 2 * 60 * 1000, windows_component_store_broken: 6 * 60 * 60 * 1000, virtualization_disabled: 60 * 60 * 1000, default: 15 * 60 * 1000 };
   const HARD_BOOTSTRAP_REASONS = new Set(["spawn_blocked", "virtualization_disabled", "wsl_enable_failed", "windows_component_store_broken", "wsl_kernel_missing", "wsl_reboot_required"]);
+  // cicy-desktop 本质是 client,cicy-code/WSL「能装就装、不能装也能用」:仍会自动尝试安装,
+  // 但硬失败(这台机根本装不了,如不支持嵌套虚拟化)后不再每 15 分钟强装弹 UAC,也不自动
+  // 重启整机——改为永久挂起,app 照常当 client;用户在 UI 点「安装/重试」可解除挂起。
+  // 要恢复旧的「强制自动重试 + 自动重启」行为:设 env CICY_WSL_AUTOINSTALL=1 或建标记文件
+  // ~/cicy-ai/db/wsl-autoinstall.flag。
+  const WSL_AUTOINSTALL_FLAG = path.join(os.homedir(), "cicy-ai", "db", "wsl-autoinstall.flag");
+  function wslAutoInstallAllowed() {
+    if (process.env.CICY_WSL_AUTOINSTALL === "1") return true;
+    try { return fs.existsSync(WSL_AUTOINSTALL_FLAG); } catch { return false; }
+  }
   function recordBootstrapResult(result, err) {
     if (err) {
       const code = err && err.code;
@@ -160,10 +170,19 @@ function register({ sidecarLogPath } = {}) {
       _lastBootstrapError = { reason: result.reason || result.error || "bootstrap_failed", message: result.message || "", ts: Date.now() };
     } else return;
     _softRetryAt = Date.now() + 2 * 60 * 1000;
-    if (_lastBootstrapError.reason === "wsl_reboot_required") scheduleReboot(90);
+    // 需要重启才能继续装 WSL 时,默认不自动重启整机(这些机器在跑账号矩阵,强制重启代价大),
+    // 只挂起等用户手动重启/重试;CICY_WSL_AUTOINSTALL=1 时才恢复自动重启。
+    if (_lastBootstrapError.reason === "wsl_reboot_required") scheduleReboot(90, "", { auto: true });
     if (HARD_BOOTSTRAP_REASONS.has(_lastBootstrapError.reason)) {
       _autoBootstrapPaused = _lastBootstrapError.reason;
-      _autoBootstrapRetryAt = Date.now() + (AUTO_RETRY_MS[_lastBootstrapError.reason] || AUTO_RETRY_MS.default);
+      // 硬失败(如 vmPlatform=false,这台根本装不了)→ 永久挂起,不再每 15 分钟强装;
+      // app 照常当 client。用户点「安装/重试」(docker:app-bootstrap)会清挂起再试一次。
+      // 例外:spawn_blocked 是安全软件开机临时拦子进程、会自愈 → 保留短重试(符合「能装就装」),
+      // 不永久挂起。
+      const transient = _lastBootstrapError.reason === "spawn_blocked";
+      _autoBootstrapRetryAt = (wslAutoInstallAllowed() || transient)
+        ? Date.now() + (AUTO_RETRY_MS[_lastBootstrapError.reason] || AUTO_RETRY_MS.default)
+        : Number.MAX_SAFE_INTEGER;
     }
     log.error(`[docker] bootstrap failed reason=${_lastBootstrapError.reason}${_lastBootstrapError.message ? ` — ${_lastBootstrapError.message}` : ""}${_autoBootstrapPaused ? " (auto-bootstrap paused until user retries)" : ""}`);
   }
@@ -191,7 +210,10 @@ function register({ sidecarLogPath } = {}) {
     if (delta) { c = Math.max(0, c + delta); try { fs.mkdirSync(path.dirname(REBOOT_COUNT_FILE), { recursive: true }); fs.writeFileSync(REBOOT_COUNT_FILE, JSON.stringify({ count: c, ts: Date.now() })); } catch {} }
     return c;
   }
-  function scheduleReboot(delaySec = 90, why = "") {
+  function scheduleReboot(delaySec = 90, why = "", { auto = false } = {}) {
+    // client 优先:自动触发的整机重启默认抑制(只有用户手动「立即重启」或开启
+    // CICY_WSL_AUTOINSTALL 才真的重启),避免为可选的 cicy-code sidecar 重启正在跑账号的机器。
+    if (auto && !wslAutoInstallAllowed()) { log.info("[docker] auto-reboot 已抑制(client 模式;设 CICY_WSL_AUTOINSTALL=1 或 wsl-autoinstall.flag 可恢复)"); return false; }
     if (_rebootScheduled || process.platform !== "win32") return false;
     if (delaySec > 10 && rebootCount() >= 2) { log.warn("[docker] auto-reboot skipped: already rebooted 2× for WSL without success"); return false; }
     _rebootScheduled = true;
@@ -234,6 +256,11 @@ function register({ sidecarLogPath } = {}) {
     _dockerDaemonBusy = true;
     try {
       const s = await refreshDockerStatus();
+      // client 优先:host mihomo(Chrome/TG 代理)必须在 docker/WSL 起不来时也能自启。
+      // 它原本只在下方 `else if (s.running)` 分支里被拉起 —— 于是 docker 装不上的机器
+      // 重启后 mihomo 永不启动 → 面板全白板。这里每轮无条件确保一次:standalone 分支
+      // 不依赖 docker;幂等(已在跑则只做配置同步/直接返回)。
+      try { await maybeStartChromeProxy(); } catch (e) { log.warn(`[chrome-proxy] ensure-running failed: ${e.message}`); }
       // 打开 cicy-desktop 就保证 Windows/WSL 的 :8008 可用:
       //   - 已安装但停止 → 启动 WSL、dockerd 和容器;
       //   - 从未安装 → bootstrap 自动启用 WSL2、导入专用 distro、安装 Docker
@@ -262,12 +289,12 @@ function register({ sidecarLogPath } = {}) {
                 if (dk.modernWslInstalled()) { try { rebootCount(-99); } catch {} }
               }
               _lastBootstrapError = { reason: "wsl_wedged", message: dk.modernWslInstalled && dk.modernWslInstalled() ? "已安装新版 WSL,将自动重启 Windows 生效" : "WSL 卡死且服务重启无效,将自动重启 Windows 修复", ts: Date.now() };
-              scheduleReboot(90);
+              scheduleReboot(90, "", { auto: true });
             }
           } catch (e) { log.warn(`[docker-daemon] auto repairWsl failed: ${e.message}`); }
           await refreshDockerStatus(); return;
         }
-        if (_unknownStreak >= 6 && !_rebootScheduled) { _lastBootstrapError = { reason: "wsl_wedged", message: "WSL 持续无响应,将自动重启 Windows 修复", ts: Date.now() }; scheduleReboot(90); }
+        if (_unknownStreak >= 6 && !_rebootScheduled) { _lastBootstrapError = { reason: "wsl_wedged", message: "WSL 持续无响应,将自动重启 Windows 修复", ts: Date.now() }; scheduleReboot(90, "", { auto: true }); }
         return;
       } else if (!s.unknown) { _unknownStreak = 0; }
       // 容器在里面健康、Windows 侧却连不通 = WSL localhost 转发坏了(实测 wsl --shutdown 后恢复)。
@@ -310,7 +337,7 @@ function register({ sidecarLogPath } = {}) {
             if (_relayMissesAfterRepair >= 3 && !_rebootScheduled && rebootCount() < 2) {
               _lastBootstrapError = { reason: "relay_unreachable", message: "容器正常但 Windows 连不上 :8008,端口修复无效 → 90 秒后自动重启 Windows 修复", ts: Date.now() };
               log.warn("[docker-daemon] relay still unreachable after tcp repair → auto reboot");
-              scheduleReboot(90, "Windows 无法连接本机 :8008(端口异常),自动重启修复");
+              scheduleReboot(90, "Windows 无法连接本机 :8008(端口异常),自动重启修复", { auto: true });
               await refreshDockerStatus();
               return;
             }

package/src/main.js

@@ -1043,6 +1043,11 @@ function ensureWindowsWatchdog(want) {
       "For Each p In procs",
       "  n = n + 1",
       "Next",
+      // 更新安装期间让位:updating.flag 新鲜(<180s)就不拉起 app,免得和安装器
+      // 抢 exe 文件锁 → 装不上 → 版本停滞 → 反复重启的循环。mtime 过期即自动恢复。
+      'Set fso = CreateObject("Scripting.FileSystemObject")',
+      'flag = sh.ExpandEnvironmentStrings("%LOCALAPPDATA%") & "\\cicy-desktop\\updating.flag"',
+      'If fso.FileExists(flag) Then If DateDiff("s", fso.GetFile(flag).DateLastModified, Now) < 180 Then WScript.Quit',
       `If n = 0 Then sh.Run """${exe}"" --hidden", 0, False`,
       "",
     ];
@@ -1564,6 +1569,14 @@ electronApp.whenReady().then(async () => {
         }
       });
       __ipcMainAuth.handle("hub:logout", () => hub.logout());
+      // Drill-down: one node's projects, each with its agents.
+      __ipcMainAuth.handle("hub:projects", async (_e, arg) => {
+        try {
+          return await hub.projects(arg || {});
+        } catch (e) {
+          return { ok: false, error: String((e && e.message) || e), projects: [] };
+        }
+      });
       // "+ 面板" dropdown config, edited from the homepage: which panels show, in
       // what order, under what name. panel-menu-store validates every id against
       // the built-in set, so the homepage can reorder/rename/disable but can never
@@ -2024,6 +2037,19 @@ electronApp.whenReady().then(async () => {
   };
   installApplicationMenu();
 
+  // 实时读:profile 列表(chrome.json / electron account-*.json)变化时重建原生菜单,
+  // 修复"只在启动时读一次"导致外部改动不反映的 bug。
+  try {
+    let menuWatchTimer = null;
+    const rebuildMenu = () => { clearTimeout(menuWatchTimer); menuWatchTimer = setTimeout(() => { try { installApplicationMenu(); } catch (e) {} }, 300); };
+    for (const dir of [path.join(os.homedir(), "cicy-ai", "db"), path.join(os.homedir(), "cicy-ai", "electron")]) {
+      try {
+        fs.mkdirSync(dir, { recursive: true });
+        fs.watch(dir, { persistent: false }, (evt, name) => { if (!name || /^chrome\.json$/.test(name) || /^account-\d+\.json$/.test(name)) rebuildMenu(); });
+      } catch (e) {}
+    }
+  } catch (e) {}
+
   // Always open the homepage unless launched at login with --hidden.
   const hidden = process.argv.includes("--hidden");
   if (!hidden) {
@@ -2035,6 +2061,16 @@ electronApp.whenReady().then(async () => {
   const hw = require("./backends/homepage-window");
   appUpdater.init(hw.getHomepageWindow && hw.getHomepageWindow());
 
+  // 保险:默认会话(profile 0)可能在 session-created 监听器挂上之前就已创建,
+  // 启动时再显式直连一次。幂等,失败只记日志。
+  try {
+    const { session } = require("electron");
+    session.defaultSession
+      .setProxy({ mode: "direct" })
+      .then(() => log.info("[Proxy] 启动时确认:默认会话(profile 0)直连"))
+      .catch((err) => log.error("[Proxy] 启动时默认会话直连失败:", err));
+  } catch (err) { log.error("[Proxy] 启动时默认会话直连异常:", err); }
+
   // 为 webview partition 设置代理
   if (config.proxy) {
     const { session } = require("electron");
@@ -2042,6 +2078,8 @@ electronApp.whenReady().then(async () => {
     mainSession
       .setProxy({
         proxyRules: config.proxy,
+        // localhost bypass:到本机 cicy-code / 终端 ws 的连接不能被代理拦
+        proxyBypassRules: "127.0.0.1,localhost,[::1]",
       })
       .then(() => {
         log.info(`[Proxy] persist:main partition 已设置代理: ${config.proxy}`);
@@ -2200,18 +2238,36 @@ process.on("SIGINT", () => {
   electronApp.quit();
 });
 
-// 为所有 session（包括 webview partition）设置代理
+// 给 session 设代理 —— 但**默认会话(profile 0)永远直连**。
+//
+// 以前这里对「所有 session」一视同仁地套 --proxy,默认会话也被代理了。而首页、
+// CiCy Hub 登录、自动更新全都跑在默认会话上,于是代理一挂,整台机器对外彻底断联:
+// 登录报 net::ERR_PROXY_CONNECTION_FAILED、机器掉出车队、连新版本都拉不到 ——
+// 变成「只能有人到机器跟前才能救」(实测 xs-master:mihomo 没起来就这样)。
+// window-utils 里本来就写明 profile 0 强制直连,但那段只在建窗口时对特定会话生效,
+// 盖不住这个全局钩子。
+//
+// 注意:Electron 的 Session 读不到 .partition(恒为 undefined,见 window-utils 的说明),
+// 所以只能拿对象和 defaultSession 比,不能靠 partition 字符串判断。
 electronApp.on("session-created", (session) => {
-  if (config.proxy) {
+  const { session: sessions } = require("electron");
+  // 默认会话**无条件**直连 —— 不只是「不套 --proxy」,还要挡住 Electron 默认的
+  // 「跟随系统代理」。首页窗口根本不走 window-utils 那段 profile 0 直连逻辑
+  // (homepage-window.js 里没有任何 session 处理),所以以前 config.proxy 为空时
+  // 默认会话就静默跟随 Windows 系统代理:系统代理指着挂掉的 mihomo,
+  // 首页/Hub 登录/车队通道/自动更新全断,机器还拉不到修复版本。
+  if (session === sessions.defaultSession) {
     session
-      .setProxy({
-        proxyRules: config.proxy,
-      })
-      .then(() => {
-        log.info(`[Proxy] Session ${session.partition || "default"} 已设置代理: ${config.proxy}`);
-      })
-      .catch((err) => {
-        log.error(`[Proxy] Session ${session.partition || "default"} 设置代理失败:`, err);
-      });
+      .setProxy({ mode: "direct" })
+      .then(() => log.info("[Proxy] 默认会话(profile 0)强制直连(不跟随系统代理)"))
+      .catch((err) => log.error("[Proxy] 默认会话直连设置失败:", err));
+    return;
   }
+  if (!config.proxy) return;
+  // 其余会话走代理,但 localhost 一律 bypass —— 到本机 cicy-code / gotty 终端的连接
+  // 不能被代理拦(以前漏了 bypass,终端白板就是这么来的)。
+  session
+    .setProxy({ proxyRules: config.proxy, proxyBypassRules: "127.0.0.1,localhost,[::1]" })
+    .then(() => log.info(`[Proxy] 会话已设置代理: ${config.proxy}(bypass localhost)`))
+    .catch((err) => log.error("[Proxy] 会话设置代理失败:", err));
 });

package/src/sidecar/host-mihomo.js

@@ -77,14 +77,50 @@ const HOST_CTRL = Number(process.env.CICY_HOST_MIHOMO_CTRL || 19011);
 
 function binPresent() { return valid(NEW_BIN) || valid(LEGACY_BIN); }
 
-function download(url, dest, redirects = 0) {
+// Node's own TLS stack gets ECONNRESET on the R2 host from some CN networks
+// (TLS-fingerprint reset) while Chromium's stack on the very same machine gets
+// 200 — so prefer Electron `net` (Chromium) and keep Node https as the fallback
+// for non-Electron callers (tests / scripts).
+function downloadViaNet(url, dest) {
+  let net;
+  try { net = require("electron").net; } catch { net = null; }
+  if (!net || typeof net.fetch !== "function") return null;
+  return (async () => {
+    const stg = dest + ".part";
+    try { fs.rmSync(stg, { force: true }); } catch {}
+    const res = await net.fetch(url, { signal: AbortSignal.timeout(10 * 60 * 1000) });
+    if (res.status !== 200) throw new Error(`HTTP ${res.status} for ${url}`);
+    const total = Number(res.headers.get("content-length") || 0);
+    const f = fs.createWriteStream(stg);
+    const reader = res.body.getReader();
+    let got = 0;
+    try {
+      for (;;) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        const b = Buffer.from(value);
+        got += b.length;
+        await new Promise((ok, no) => f.write(b, (e) => (e ? no(e) : ok())));
+      }
+      await new Promise((ok) => f.end(ok));
+      if (total && got !== total) throw new Error(`short download ${got}/${total}`);
+      fs.renameSync(stg, dest);
+    } catch (e) {
+      try { f.destroy(); } catch {}
+      try { fs.rmSync(stg, { force: true }); } catch {}
+      throw e;
+    }
+  })();
+}
+
+function downloadViaNode(url, dest, redirects = 0) {
   return new Promise((resolve, reject) => {
     if (redirects > 5) return reject(new Error("too many redirects"));
     const f = fs.createWriteStream(dest);
     const req = https.get(url, (res) => {
       if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
         f.close(); try { fs.unlinkSync(dest); } catch {}
-        return download(res.headers.location, dest, redirects + 1).then(resolve, reject);
+        return downloadViaNode(res.headers.location, dest, redirects + 1).then(resolve, reject);
       }
       if (res.statusCode !== 200) { f.close(); try { fs.unlinkSync(dest); } catch {} return reject(new Error(`HTTP ${res.statusCode} for ${url}`)); }
       res.pipe(f);
@@ -95,6 +131,15 @@ function download(url, dest, redirects = 0) {
   });
 }
 
+async function download(url, dest) {
+  const viaNet = downloadViaNet(url, dest);
+  if (viaNet) {
+    try { await viaNet; return; }
+    catch (e) { console.warn(`[host-mihomo] net.fetch download failed (${e.message}), falling back to https`); }
+  }
+  await downloadViaNode(url, dest);
+}
+
 // Ensure the mihomo binary is in ~/.local/bin/mihomo-<ver> (idempotent).
 // Already there → done. Only a legacy runtime copy → migrate it (no network).
 // Nothing → pull from OSS.

package/src/tabbrowser/facebook-identity.js

@@ -49,7 +49,18 @@ function facebookIdentityFromProfile(profile) {
   const logins = profile && Array.isArray(profile.logins) ? profile.logins : [];
   const l = logins.find((x) => String((x && x.name) || "").toLowerCase() === "facebook");
   if (!l) return null;
-  return { id: String(l.username || ""), username: "", displayName: String(l.note || ""), phone: "" };
+  // email / twofa / secondEmail 原来在这里被丢掉了,面板的 ⚙ 里那几行只能显示「—」。
+  // 它们在 logins[] 里一直存着(实测 2026-09-11,xs-1001 #1 三项都有值)。
+  // password 这个字段 logins[] 里没有,FB 密码仍只能从备注串 `FB密码:xxx` 解析。
+  return {
+    id: String(l.username || ""),
+    username: "",
+    displayName: String(l.note || ""),
+    phone: "",
+    email: String(l.email || ""),
+    twofa: String(l.twofa || ""),
+    secondEmail: String(l.secondEmail || ""),
+  };
 }
 
 module.exports = { isFacebookUrl, FACEBOOK_IDENTITY_SCRIPT, normalizeFacebookIdentity, facebookLoginRecord, facebookIdentityFromProfile };