cicy-desktop 2.1.360 → 2.1.361

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cicy-desktop",
-  "version": "2.1.360",
+  "version": "2.1.361",
   "description": "CiCy - AI-powered operating system browser",
   "main": "src/main.js",
   "bin": {

package/src/tabbrowser/panel-cells.js

@@ -385,9 +385,23 @@ class PanelCells {
   }
 }
 
+// 面板页里的 <webview partition="persist:sandbox-N"> 用的是同一批 partition,但它不走
+// PanelCells,没人给它设代理 —— 不设就是直连,账号的真实出口 IP 直接暴露。
+// 面板一打开就把所有 electron profile 的 partition 代理都绑上,webview 和 BrowserView
+// 两种格子都覆盖到。ensureCellSessionProxy 自带去重,重复调用无副作用。
+function ensureAllProfileProxies() {
+  try {
+    const profileStore = require("../profiles/profile-store");
+    for (const p of profileStore.listProfiles("electron") || []) {
+      const idx = Number(p && p.accountIdx);
+      if (Number.isInteger(idx) && idx > 0) ensureCellSessionProxy(idx);
+    }
+  } catch (e) {}
+}
+
 function cellsForTab(manager, tab) {
   let pc = registry.get(tab.id);
-  if (!pc) { pc = new PanelCells(manager, tab); registry.set(tab.id, pc); }
+  if (!pc) { pc = new PanelCells(manager, tab); registry.set(tab.id, pc); ensureAllProfileProxies(); }
   return pc;
 }
 
@@ -414,6 +428,10 @@ function installIpc(findTab) {
   ipcMain.handle("panelcells:states", (e) => { const pc = ctx(e); return pc ? pc.states() : []; });
   ipcMain.handle("panelcells:profiles", (e) => {
     if (!ctx(e)) return [];
+    // 面板页开局必调这个接口。借它把所有 profile 的 partition 代理绑一遍 ——
+    // 页面里的 <webview partition="persist:sandbox-N"> 不走 PanelCells,没人给它设代理,
+    // 不设就是直连,账号真实出口 IP 直接暴露。ensureCellSessionProxy 自带去重。
+    ensureAllProfileProxies();
     try {
       return require("../profiles/profile-store").listProfiles("electron")
         .filter((p) => Number.isInteger(Number(p.accountIdx)) && Number(p.accountIdx) > 0 && Number(p.accountIdx) !== 9)

package/src/tools/tab-browser-tools.js

@@ -160,10 +160,18 @@ function buildTabWebPreferences(accountIdx, partition, target, opts = {}) {
   // home is system-driven (openHomeWindow), never caller-URL-reachable, so it
   // keeps its privileges without a URL check.
   if (opts.home) { wp.preload = HOMEPAGE_PRELOAD; wp.webviewTag = true; wp.allowRunningInsecureContent = true; wp.sandbox = false; }
-  // split panel page: its cells are main-managed BrowserViews (panel-cells.js),
-  // driven over panelAPI IPC. No webviewTag needed (that path is the file://-dev
-  // fallback below). Sandbox stays ON — the preload only uses contextBridge/ipc.
-  else if (typeof target === "string" && (target.startsWith(PANEL_URL_BASE) || target.startsWith("cicyui://panel"))) { wp.preload = PANEL_PRELOAD; }
+  // split panel page: cells may be main-managed BrowserViews (panel-cells.js, over
+  // panelAPI IPC) OR in-page <webview>. BrowserViews are painted by the main process
+  // at viewport coordinates, so they do not scroll with the page and are not clipped
+  // by the grid's overflow — with more than a screenful of cells that is unusable.
+  // <webview> lives in the DOM and scrolls/clips for free, so the panel needs
+  // webviewTag on. sandbox must go off for the tag to be usable; the preload still
+  // only exposes contextBridge/ipcRenderer, and the panel page is our own origin.
+  else if (typeof target === "string" && (target.startsWith(PANEL_URL_BASE) || target.startsWith("cicyui://panel"))) {
+    wp.preload = PANEL_PRELOAD;
+    wp.webviewTag = true;
+    wp.sandbox = false;
+  }
   // Every other profile-0 tab carries the electronRPC bridge (WEBVIEW_PRELOAD),
   // but the bridge is INERT until the page's origin is authorized: the first
   // rpc:guarded call from a non-allowlisted origin pops a consent modal