cicy-desktop 2.1.366 → 2.1.368

package/workers/render/src/App.jsx

@@ -7,6 +7,7 @@ import "./App.css";
 import { TERMS_VERSION, termsForDisplay } from "./termsText";
 import { mdToHtml } from "./mdLite";
 import { buildCustomTeamEditPatch } from "./custom-team-edit";
+import DEB_CTL_SCRIPT from "../../../src/sidecar/qemu-vm.cjs?raw";  // 和 desktop 的 QEMU 版 Docker 共用同一份
 
 // i18n bridge exposed by homepage-preload (window.cicyI18n.t, locale from
 // app.getLocale()). Returns the localized string, or `fallback` when the key
@@ -1178,7 +1179,7 @@ export default function App() {
   const hubCount = hub.instances ? hub.instances.length : 0;
   // 「全部」只放真能打开的 dsh;DSH tab 里才把未就绪的一并列出来看状态。
   const dshReady = (dshFleet.list || []).filter((m) => m.ready);
-  const showDshAll = tab === "all" || tab === "dsh";
+  const showDshAll = (tab === "all" || tab === "dsh") && !!hub.loggedIn; // 未登录不展示车队机器
   // 首次打开:本地或云端团队任一还没拉到(为 null)→ grid 显示 skeleton 占位卡,直到两边都
   // resolve(出错也 resolve 成 []),再显示真实内容 —— 避免一个先回来另一个还空的露馅。
   const firstLoading = localTeams === null || teams === null;
@@ -1335,6 +1336,7 @@ export default function App() {
           )}
           {/* 首页第二块:DeepSeek Harness(开源 Agent 框架),homepage 自装自启,和 cicy-code 卡并列 */}
           {!firstLoading && showLocal && <DshCard />}
+          {!firstLoading && showLocal && <DebianCard />}
           {!firstLoading && showCustom && customList.map((t) => (
             <LocalTeamCard key={"custom:" + t.id} team={t} cloudCode={cloudCodeFor(t.cloud_team_id)} onOpen={() => openLocalTeam(t.id)} onRename={renameLocalTeam} onRefresh={fetchLocalTeams} />
           ))}
@@ -1511,7 +1513,11 @@ function useFleetSocket() {
       try { out.auto = await capped(window.cicy?.app?.getAutoUpdate?.(), null); } catch {}
       // Only cache a complete identity; a partial one (some step timed out) is
       // re-read on the next connect so the hello self-corrects once main is idle.
-      if (out.host && out.v) ident = out;
+      // A token-less identity is never cached either: a fresh install hellos before the
+      // user logs in to the hub, and caching that would keep every later hello token-less
+      // → the hub never marks the machine authed → no dsh config / self-rpc for it
+      // (seen on a new machine 2026-09-25). Re-read until the token shows up.
+      if (out.host && out.v && out.tok) ident = out;
       return out;
     };
 
@@ -3144,7 +3150,7 @@ function DockerInstallDrawerHost() {
   const phaseIdx = DOCKER_PHASES.findIndex(([k]) => k === st.phase);
   const dlBars = isOpen ? [] : ["install-docker", "image"].filter((k) => st.bars?.[k]);
   const drawerTitle = st.title || (isOpen ? tr("docker.openTitle", "打开 Docker 团队") : tr("docker.setupTitle", "安装 Docker cicy-code"));
-  const drawerSub = st.sub || "127.0.0.1:8008";
+  const drawerSub = st.sub || `127.0.0.1:${dockerAppPort}`;
   // Minimized → a floating restore chip (op keeps running in the background).
   if (st.minimized) {
     const pcts = dlBars.map((k) => st.bars[k]?.progress).filter(Number.isFinite);
@@ -3263,7 +3269,13 @@ function useDshFleet() {
   const refresh = useCallback(async () => {
     setBusy(true);
     try {
-      const r = await fetch(DSH_FLEET_API, { cache: "no-store" });
+      // 车队清单是登录用户名下的资产:必须带本机 hubAuth token,hub 侧按 token 校验。
+      // 没登录(全新安装)就没有 token → 什么都不列,别把车队里别的机器摆到陌生人首页上。
+      let tok = "";
+      try { tok = String(await mainEval(READ_TOKEN)).trim(); } catch {}
+      if (!tok) { setList([]); return; }
+      const r = await fetch(DSH_FLEET_API, { cache: "no-store", headers: { Authorization: "Bearer " + tok } });
+      if (!r.ok) { setList([]); return; }
       const j = await r.json();
       setList(Array.isArray(j && j.machines) ? j.machines : []);
     } catch { setList([]); }
@@ -3446,6 +3458,42 @@ const dbDir = path.join(home, "cicy-ai", "db"), logDir = path.join(home, "cicy-a
 for (const d of [dbDir, logDir]) { try { fs.mkdirSync(d, { recursive: true }); } catch {} }
 const logFile = path.join(logDir, "dsh.log"), errFile = path.join(logDir, "dsh.err.log"), pidFile = path.join(dbDir, "dsh.pid"), rootCache = path.join(dbDir, "dsh-npm-root.txt");
 const lockFile = path.join(dbDir, "dsh-install.lock"), okMarker = path.join(dbDir, "dsh-ok-" + VER + ".txt");
+// dsh@0.1.2-rc.1 是 developer preview:安装器只钉 dsh 版本,传递依赖(cordis 栈)浮动一升级就崩
+// ("user patch-layer watching requires the Cordis HMR service")。运行时 cordis 栈从 dsh 包自己的
+// nested node_modules 解析(~/.dsh/profiles 自举目录是空的),所以装完把这 8 个钉回已知良好版本。
+const KNOWN_GOOD = { "@deepseek-ai/cordis": "4.0.2", "@deepseek-ai/cordis-plugin-hmr": "1.0.17", "@deepseek-ai/cordis-plugin-loader": "1.0.3", "@deepseek-ai/cordis-plugin-include": "1.0.7", "@deepseek-ai/cordis-plugin-timer": "1.1.4", "@deepseek-ai/cordis-plugin-group": "1.0.2", "@deepseek-ai/cosmokit": "1.8.3", "@deepseek-ai/schemastery": "3.18.2" };
+const KG_HASH = require("crypto").createHash("sha1").update(JSON.stringify(Object.keys(KNOWN_GOOD).sort().map((k) => [k, KNOWN_GOOD[k]]))).digest("hex").slice(0, 8);
+const pinMarker = path.join(dbDir, "dsh-pins-" + VER + "-" + KG_HASH + ".txt");
+// 读版本要去 BOM:JSON.parse 遇 BOM 会抛
+function nestedVer(dir, name) { try { return JSON.parse(fs.readFileSync(path.join(dir, "node_modules", ...name.split("/"), "package.json"), "utf8").replace(/^\uFEFF/, "")).version; } catch { return null; } }
+function depsOk(dir) { for (const n of Object.keys(KNOWN_GOOD)) if (nestedVer(dir, n) !== KNOWN_GOOD[n]) return false; return true; }
+// 钉法:不能在 dsh 包目录直接 npm i —— npm 会解析整棵 dsh 依赖树,里面的
+// @deepseek-ai/dsh-experimental-agent-team@^0.1.2-rc.1 在 registry 上不存在,直接 ETARGET 退出。
+// 改在临时 scratch 目录 npm i 这 8 个钉死版本,再把 8 个包目录整目录覆盖进 dsh/node_modules/@deepseek-ai
+// (旧目录改名 .bak,失败则还原)。必须 8 个一起(只钉 7 个、hmr 留新版会 hmr.registerConfig is not a function)。
+function pinDeps(dir, reg) {
+  if (fs.existsSync(pinMarker) && depsOk(dir)) return { ok: true, skipped: true };
+  if (depsOk(dir)) { try { fs.writeFileSync(pinMarker, String(Date.now())); } catch {} return { ok: true, skipped: true }; }
+  const scratch = path.join(os.tmpdir(), "dsh-pin-scratch");
+  try { fs.rmSync(scratch, { recursive: true, force: true }); fs.mkdirSync(scratch, { recursive: true }); fs.writeFileSync(path.join(scratch, "package.json"), JSON.stringify({ name: "dsh-pin-scratch", version: "0.0.0", private: true })); } catch (e) { return { ok: false, error: "pin_scratch_failed", tail: String(e.message).slice(-200) }; }
+  const pins = Object.keys(KNOWN_GOOD).map((n) => n + "@" + KNOWN_GOOD[n]).join(" ");
+  try { run(q(NPM) + " i --no-audit --no-fund --no-progress --loglevel=error --registry=" + reg + " " + pins, { cwd: scratch, timeout: 8 * 60 * 1000 }); }
+  catch (e) { try { fs.rmSync(scratch, { recursive: true, force: true }); } catch {} return { ok: false, error: "pin_install_failed", tail: String((e.stderr || "") + (e.stdout || "") + (e.message || "")).trim().slice(-300) }; }
+  const dstScope = path.join(dir, "node_modules", "@deepseek-ai"), srcScope = path.join(scratch, "node_modules", "@deepseek-ai");
+  const failed = [];
+  for (const n of Object.keys(KNOWN_GOOD)) {
+    const short = n.slice("@deepseek-ai/".length), src = path.join(srcScope, short), dst = path.join(dstScope, short);
+    if (!fs.existsSync(src)) { failed.push(short + ":no-src"); continue; }
+    try { if (fs.existsSync(dst)) { try { fs.rmSync(dst + ".bak", { recursive: true, force: true }); } catch {} fs.renameSync(dst, dst + ".bak"); } fs.cpSync(src, dst, { recursive: true }); }
+    catch (e) { failed.push(short + ":" + String(e.message).slice(0, 40)); try { if (!fs.existsSync(dst) && fs.existsSync(dst + ".bak")) fs.renameSync(dst + ".bak", dst); } catch {} }
+  }
+  try { fs.rmSync(scratch, { recursive: true, force: true }); } catch {}
+  if (failed.length) return { ok: false, error: "pin_copy_failed", tail: failed.join("; ") };
+  if (!depsOk(dir)) return { ok: false, error: "pin_mismatch", tail: JSON.stringify(Object.fromEntries(Object.keys(KNOWN_GOOD).map((n) => [n, nestedVer(dir, n)]))).slice(0, 300) };
+  for (const n of Object.keys(KNOWN_GOOD)) { try { fs.rmSync(path.join(dstScope, n.slice("@deepseek-ai/".length) + ".bak"), { recursive: true, force: true }); } catch {} }
+  try { fs.writeFileSync(pinMarker, String(Date.now())); } catch {}
+  return { ok: true };
+}
 // 车队级启动环境(hub 下发,DshCard 写的 dsh-env.json):并进 dsh 子进程 env。启动环境在 dsh 里优先级最高且只读。
 const envFile = path.join(dbDir, "dsh-env.json"), envApplied = path.join(dbDir, "dsh-env.applied");
 function fleetEnv() { try { const j = JSON.parse(fs.readFileSync(envFile, "utf8")); const src = (j && j.env) || {}; const out = {}; for (const [k, v] of Object.entries(src)) { if (/^[A-Z][A-Z0-9_]*$/.test(k) && typeof v === "string" && v) out[k] = v; } return out; } catch { return {}; } }
@@ -3536,7 +3584,9 @@ function installing() { return pidAlive(readPidFile(lockFile)); }
 async function status() {
   const p = pkgInfo(); const pid = readPidFile(pidFile); const pr = await probe();
   const eh = envHash(), ea = appliedHash(), wm = wsMissing();
-  return { ok: true, installed: !!p && !p.broken, broken: !!(p && p.broken), version: p ? p.version : null, installing: installing(), running: pr.dsh, occupied: pr.up && !pr.dsh, pid, pidAlive: pidAlive(pid), hasToken: !!lastToken(), node: process.version, logFile, envKeys: Object.keys(fleetEnv()), envHash: eh, envStale: pr.dsh && ea !== eh, wsMissing: wm, wsStale: pr.dsh && wm.length > 0 };
+  // 装好但传递依赖没钉/浮动了 → 报出来让卡片显示,别无声"启动中"(2026-09-25:rc.1 cordis 栈浮动崩)
+  const depBad = (p && !p.broken && !fs.existsSync(pinMarker) && !depsOk(p.dir)) ? "cordis-stack-mismatch" : null;
+  return { ok: true, installed: !!p && !p.broken, broken: !!(p && p.broken), depError: depBad, version: p ? p.version : null, installing: installing(), running: pr.dsh, occupied: pr.up && !pr.dsh, pid, pidAlive: pidAlive(pid), hasToken: !!lastToken(), node: process.version, logFile, envKeys: Object.keys(fleetEnv()), envHash: eh, envStale: pr.dsh && ea !== eh, wsMissing: wm, wsStale: pr.dsh && wm.length > 0 };
 }
 async function install() {
   // 安装锁:首页刷新/多开会再次触发安装,两个 npm -g 同时写全局目录会把包写坏。有锁就等它完。
@@ -3563,7 +3613,9 @@ async function install() {
     try { fs.writeFileSync(rootCache, root); } catch {}
     const p = pkgAt(root);
     if (!p || p.broken) return { ok: false, error: "install_incomplete", tail: (outp || "").slice(-300) };
-    return { ok: true, version: p.version, registry: used, speed: regs.speed, secs: Math.round((Date.now() - t0) / 1000) };
+    const pin = pinDeps(p.dir, savedRegistry() || used || "https://registry.npmjs.org");
+    if (!pin.ok) return { ok: false, error: pin.error, tail: pin.tail };
+    return { ok: true, version: p.version, registry: used, speed: regs.speed, secs: Math.round((Date.now() - t0) / 1000), pinned: !pin.skipped };
   } finally { try { fs.unlinkSync(lockFile); } catch {} }
 }
 async function start() {
@@ -3585,11 +3637,17 @@ async function start() {
     const cmd = "$p = Start-Process -FilePath " + q(process.execPath)
       + " -ArgumentList @(" + [p.bin, "web", "--no-open", "--port", String(PORT)].map(q).join(",") + ")"
       + " -WindowStyle Hidden -RedirectStandardOutput " + q(logFile) + " -RedirectStandardError " + q(errFile)
-      + " -WorkingDirectory " + q(home) + " -PassThru; $p.Id";
+      + " -WorkingDirectory " + q(home) + " -PassThru";
+    // PID / 报错走文件,powershell 的 stdio 全给 ignore:Start-Process 带重定向时用继承句柄的
+    // CreateProcess,dsh 会顺手继承 powershell 的 stdout —— 若那是管道,spawnSync 要等 dsh
+    // 退出才 EOF,于是每次「启动」都卡满 60s 超时才返回(实测假进程:管道 25.3s vs 文件 0.25s)。
+    const spawnPid = path.join(dbDir, "dsh-spawn.pid"), spawnErr = path.join(dbDir, "dsh-spawn.err");
+    for (const f of [spawnPid, spawnErr]) { try { fs.unlinkSync(f); } catch {} }
+    const ps = "try { " + cmd + "; Set-Content -Path " + q(spawnPid) + " -Value $p.Id } catch { Set-Content -Path " + q(spawnErr) + " -Value ($_ | Out-String) }";
     try { fs.writeFileSync(logFile, ""); fs.writeFileSync(errFile, ""); } catch {}
-    const r = cp.spawnSync("powershell", ["-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden", "-Command", cmd], { encoding: "utf8", timeout: 60000, windowsHide: true, env });
-    pid = Number(String((r && r.stdout) || "").match(/\d+/) || 0);
-    if (!pid) return { ok: false, error: "start_failed", tail: String((r && r.stderr) || "").slice(-800) };
+    cp.spawnSync("powershell", ["-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden", "-Command", ps], { stdio: "ignore", timeout: 60000, windowsHide: true, env });
+    pid = readPidFile(spawnPid);
+    if (!pid) { let err = ""; try { err = fs.readFileSync(spawnErr, "utf8"); } catch {} return { ok: false, error: "start_failed", tail: err.slice(-800) }; }
   } else {
     const fd = fs.openSync(logFile, "w");
     const child = cp.spawn(process.execPath, [p.bin, "web", "--no-open", "--port", String(PORT)], { detached: true, windowsHide: true, stdio: ["ignore", fd, fd], cwd: home, env });
@@ -3907,6 +3965,7 @@ function DshCard() {
   const stateText = !st ? ""
     : st.error ? tr("dsh.stateNoNode", "未就绪:{{why}}", { why: st.error === "no_node" ? tr("dsh.noNodeShort", "没有 Node.js(点「安装」自动装便携版)") : st.error })
     : st.installing ? tr("dsh.stateInstalling", "另一个安装进程进行中…")
+    : st.depError ? tr("dsh.stateDepBad", "依赖损坏(cordis 栈),点「安装」修复")
     : running ? tr("dsh.stateRunning", "运行中")
     : st.broken ? tr("dsh.stateBroken", "安装不完整(点「安装」修复)")
     : installed ? tr("dsh.stateStopped", "已安装,未运行")
@@ -3975,6 +4034,290 @@ function DshCard() {
   );
 }
 
+// ---------------------------------------------------------------------------
+// Debian card —— 不靠 WSL 的开箱 Linux:QEMU 便携版 + Debian 13 官方云镜像,网页终端(ttyd)开成 tab。
+// 和 DshCard 同构:全部只靠 homepage(exec_shell 跑 debian-ctl.js,脚本见 ./debian-ctl.cjs),
+// 不改 desktop。有 WHPX 就硬件加速,没有退回软件模拟(慢但免管理员);「开启硬件加速」弹 UAC + 重启。
+// 不自动安装(首次要下 ~390MB);装过之后开机自动启动(可在菜单关)。
+const DEB_RED = "#d70a53";
+const DEB_AUTO_KEY = "debian.auto";       // localStorage:"off" = 关闭开机自启
+const DEB_PHASE = { qemu: "install-docker", extract: "install-docker", image: "image", verify: "image", disk: "image" };
+const DEB_PHASE_MSG = {
+  qemu: "下载 QEMU 便携版(约 47MB)…", extract: "解压 QEMU…",
+  image: "下载 Debian 13 云镜像(约 343MB)…", verify: "校验镜像 SHA512…", disk: "创建虚拟磁盘(40G,按需增长)…",
+};
+const DEB_ERR = {
+  qemu_download: "QEMU 下载失败(网络)", qemu_checksum: "QEMU 包校验失败", qemu_extract: "QEMU 解压失败",
+  image_download: "Debian 镜像下载失败(网络)", image_checksum: "Debian 镜像校验失败", disk_create: "创建虚拟磁盘失败",
+  port_in_use: "端口被占用", not_installed: "还没安装", qemu_not_started: "QEMU 没能启动", spawn_failed: "后台进程起不来",
+};
+const debErr = (r) => [DEB_ERR[r?.error] || r?.error || "failed", r?.detail].filter(Boolean).join(":");
+const debSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+let _debWritten = false;
+async function debCtl(op, opts = {}) {
+  const env = await dshEnv(opts);
+  if (!env.node) return { ok: false, error: "no_node", detail: env.error || "" };
+  const ctl = `${env.home}\\cicy-ai\\db\\debian-ctl.js`;
+  if (!_debWritten) {
+    const w = parseRpcText(await window.electronRPC?.("file_write", { path: ctl, content: DEB_CTL_SCRIPT }));
+    if (!w.ok) return { ok: false, error: "ctl_write_failed", detail: w.stderr || w.stdout };
+    _debWritten = true;
+  }
+  const r = await dshShell(`"${env.node}" "${ctl}" ${op}`);
+  const m = String(r.stdout || "").trim().match(/\{[\s\S]*\}$/);
+  if (m) { try { return JSON.parse(m[0]); } catch {} }
+  return { ok: false, error: "ctl_no_output", detail: (r.stderr || r.stdout || "").trim().slice(-400) };
+}
+function DebianIcon() {
+  return (
+    <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" aria-hidden>
+      <path d="M14.5 19.5c-4.4 0-8-3.4-8-7.6 0-4 3.2-7.4 7.3-7.4 3.6 0 6.2 2.6 6.2 5.8 0 2.7-2 4.7-4.5 4.7-2 0-3.5-1.4-3.5-3.2 0-1.5 1.1-2.6 2.5-2.6" />
+    </svg>
+  );
+}
+
+function DebianCard() {
+  const [st, setSt] = useState(null);
+  const [busy, setBusy] = useState("");     // "" | install | start | stop | open | accel
+  const [menuOpen, setMenuOpen] = useState(false);
+  const [menuPos, setMenuPos] = useState({ top: 0, left: 0 });
+  const [auto, setAuto] = useState(() => { try { return localStorage.getItem(DEB_AUTO_KEY) !== "off"; } catch { return true; } });
+  const kebabRef = useRef(null);
+  const menuRef = useRef(null);
+  const autoRan = useRef(false);
+  const busyRef = useRef("");
+  useEffect(() => { busyRef.current = busy; }, [busy]);
+  const MENU_W = 196;
+
+  const refresh = useCallback(async () => {
+    try { const s = await debCtl("status"); setSt(s); return s; }
+    catch (e) { console.warn("[DebianCard] status", e); return null; }
+  }, []);
+  // 开机中(running 但终端还没起来)轮询快一点,好让「启动中」及时变「打开终端」
+  const booting = !!(st?.running && !st?.ready);
+  useEffect(() => {
+    if (!dshIsWin()) return;
+    refresh();
+    const id = setInterval(() => { if (!busyRef.current) refresh(); }, booting ? 5000 : 20000);
+    return () => clearInterval(id);
+  }, [refresh, booting]);
+
+  // 等虚拟机里的网页终端起来:首次开机 cloud-init 要建用户/装 ttyd;软件模拟下要几分钟。
+  const waitReady = async (push) => {
+    let lastBoot = "";
+    for (let i = 0; i < 180; i++) {          // 180 × 5s = 15 分钟
+      const s = await debCtl("status");
+      setSt(s);
+      if (s.ready) return s;
+      if (!s.running) return { ...s, error: "vm_exited" };
+      if (push && s.boot && s.boot !== lastBoot) { lastBoot = s.boot; push("container", s.boot); }
+      await debSleep(5000);
+    }
+    return { error: "boot_timeout" };
+  };
+
+  const openTerm = async () => {
+    const r = await debCtl("open");
+    if (!r.ok) { toast.show({ id: "deb-open", status: "error", ttl: 6000, message: tr("debian.notReady", "Debian 还没启动好") }); return false; }
+    await window.cicy?.tabs?.open?.(r.url, "Debian", "", true);
+    return true;
+  };
+
+  // 安装 + 启动 + 打开终端,全程走 Docker 同款抽屉。
+  const runSetup = useCallback(async () => {
+    if (busyRef.current) return;
+    setBusy("install");
+    dockerDrawer.open({ kind: "debian", title: tr("debian.setupTitle", "安装 Debian 13"), sub: tr("debian.setupSub", "QEMU 虚拟机 · 不需要 WSL"), onRetry: () => runSetup() });
+    const push = (phase, message, status) => dockerDrawer.push({ phase, message, status: status || "running" });
+    try {
+      push("install-docker", tr("debian.checkNode", "检查 Node.js…"));
+      let env = await dshEnv();
+      if (!env.node) {
+        push("install-docker", tr("dsh.installingNode", "这台机器没有 Node.js,下载便携版 {{v}}(约 37MB,免管理员)…", { v: DSH_NODE_VERSION }));
+        env = await dshEnv({ installNode: true });
+        if (!env.node) { dockerDrawer.finish({ ok: false, message: tr("dsh.nodeFailed", "Node.js 便携版安装失败:{{why}}", { why: env.error || "download" }) }); return; }
+      }
+      let s = await debCtl("status");
+      if (!s.ok) { dockerDrawer.finish({ ok: false, message: tr("dsh.ctlFailed", "控制脚本无法运行:{{why}}", { why: debErr(s) }) }); return; }
+      if (!s.installed) {
+        const r = await debCtl("install");
+        if (!r.ok) { dockerDrawer.finish({ ok: false, message: debErr(r) }); return; }
+        let lastPhase = "";
+        for (;;) {
+          await debSleep(2000);
+          s = await debCtl("status");
+          if (s.installed && !s.installing) break;
+          if (!s.installing) { dockerDrawer.finish({ ok: false, message: tr("debian.installFailed", "安装失败:{{why}}", { why: s.installError || "stopped" }) }); return; }
+          const ph = DEB_PHASE[s.phase] || "install-docker";
+          if (s.phase !== lastPhase) { lastPhase = s.phase; push(ph, tr(`debian.phase.${s.phase}`, DEB_PHASE_MSG[s.phase] || s.phase)); }
+          if ((s.phase === "qemu" || s.phase === "image") && s.total) {
+            dockerDrawer.push({ phase: ph, status: "running", progress: Math.min(99, Math.round(s.bytes * 100 / s.total)), received: s.bytes, total: s.total, url: s.src, label: s.phase === "qemu" ? "QEMU" : "Debian 13" });
+          }
+        }
+        push("image", tr("debian.installed", "QEMU + Debian 13 就绪"), "done");
+      }
+      push("container", s.whpxFeature ? tr("debian.startingWhpx", "启动虚拟机(尝试 WHPX 硬件加速)…") : tr("debian.startingTcg", "启动虚拟机(软件模拟,首次开机要几分钟)…"));
+      const r2 = await debCtl("start");
+      if (!r2.ok) { dockerDrawer.finish({ ok: false, message: tr("debian.startFailed", "启动失败:{{why}}", { why: debErr(r2) + (r2.tail ? " · " + String(r2.tail).trim().split(/\r?\n/).slice(-2).join(" · ") : "") }) }); return; }
+      const s2 = await waitReady(push);
+      if (!s2.ready) { dockerDrawer.finish({ ok: false, message: s2.error === "boot_timeout" ? tr("debian.bootTimeout", "15 分钟内终端没起来,看 ~/cicy-ai/logs/debian-console.log") : tr("debian.vmExited", "虚拟机退出了,看 ~/cicy-ai/logs/debian-qemu.log") }); return; }
+      push("container", s2.accel === "whpx" ? tr("debian.accelWhpx", "硬件加速:WHPX") : tr("debian.accelTcg", "软件模拟(较慢)—— 菜单里可「开启硬件加速」"), "done");
+      dockerDrawer.finish({ ok: true, message: tr("debian.ready", "Debian 已就绪,正在打开终端") });
+      await openTerm();
+    } catch (e) { dockerDrawer.finish({ ok: false, message: e.message }); }
+    finally { setBusy(""); refresh(); }
+  }, [refresh]);
+
+  const runOp = async (kind, fn, okMsg) => {
+    if (busyRef.current) return;
+    setMenuOpen(false); setBusy(kind);
+    try {
+      const r = await fn();
+      if (r && r.ok === false) toast.show({ id: "deb-op", status: "error", ttl: 6000, message: debErr(r) });
+      else if (okMsg) toast.show({ id: "deb-op", status: "ok", ttl: 3000, message: okMsg });
+    } catch (e) { toast.show({ id: "deb-op", status: "error", ttl: 6000, message: e.message }); }
+    finally { setBusy(""); refresh(); }
+  };
+  const startSilent = () => runOp("start", () => debCtl("start"));
+  const openUi = () => runOp("open", async () => { await openTerm(); });
+  // 新机器(QEMU 后端)上 Docker 版 cicy-code 也跑在这台虚拟机里:关机/重启会把它一起停,先问一句。
+  const confirmVmDown = async () => {
+    let s = null; try { s = await window.cicy?.docker?.appStatus?.(); } catch {}
+    if (!(s && s.running && Number(s.port) === 8009)) return true;
+    return window.confirm(tr("debian.vmDownConfirm", "Docker 版 cicy-code(:8009)也跑在这台 Debian 虚拟机里,关机/重启会让它一起停(重启后自动恢复)。继续?"));
+  };
+  const enableAccel = () => {
+    if (!window.confirm(tr("debian.accelConfirm", "开启「Windows 虚拟机监控程序平台」(WHPX)需要管理员权限,开启后要重启电脑才生效。继续?"))) return;
+    runOp("accel", async () => {
+      const r = await debCtl("accel");
+      if (r.ok) toast.show({ id: "deb-op", status: "ok", ttl: 10000, message: tr("debian.accelDone", "已开启,重启电脑后 Debian 自动用硬件加速") });
+      return r.ok ? null : r;
+    });
+  };
+
+  // 开机自启:装过的才自启;首页每次加载只跑一次。
+  useEffect(() => {
+    if (autoRan.current || !st) return;
+    autoRan.current = true;
+    if (auto && st.ok && st.installed && !st.running && !st.installing) startSilent();
+  }, [st, auto]); // eslint-disable-line react-hooks/exhaustive-deps
+
+  const toggleAuto = () => {
+    const next = !auto; setAuto(next); setMenuOpen(false);
+    try { if (next) localStorage.removeItem(DEB_AUTO_KEY); else localStorage.setItem(DEB_AUTO_KEY, "off"); } catch {}
+  };
+  const toggleMenu = (e) => {
+    e.stopPropagation();
+    if (!menuOpen && kebabRef.current) {
+      const r = kebabRef.current.getBoundingClientRect();
+      const left = Math.max(8, Math.min(r.right - MENU_W, window.innerWidth - MENU_W - 8));
+      setMenuPos({ top: Math.round(r.bottom + 4), left: Math.round(left) });
+    }
+    setMenuOpen((v) => !v);
+  };
+  useEffect(() => {
+    if (!menuOpen) return;
+    const onDoc = (e) => { if (kebabRef.current?.contains(e.target) || menuRef.current?.contains(e.target)) return; setMenuOpen(false); };
+    const onKey = (e) => { if (e.key === "Escape") setMenuOpen(false); };
+    document.addEventListener("mousedown", onDoc); document.addEventListener("keydown", onKey);
+    return () => { document.removeEventListener("mousedown", onDoc); document.removeEventListener("keydown", onKey); };
+  }, [menuOpen]);
+
+  if (typeof window !== "undefined" && !window.electronRPC) return null;
+  if (!dshIsWin()) return null;              // QEMU 便携包目前只打了 Windows x64
+
+  const running = !!st?.running, ready = !!st?.ready, installed = !!st?.installed;
+  const isBusy = !!busy;
+  const tone = ready ? "ok" : installed || st?.installing ? "warn" : "off";
+  const pct = st?.installing && st?.total ? Math.min(99, Math.round(st.bytes * 100 / st.total)) : null;
+  const ctaLabel = busy === "open" ? tr("docker.opening", "打开中…")
+    : busy === "install" || st?.installing ? tr("dsh.installingShort", "安装中…")
+    : busy === "start" || booting ? tr("dsh.startingShort", "启动中…")
+    : isBusy ? tr("docker.working", "处理中…")
+    : !st ? tr("docker.probing", "检测中…")
+    : ready ? tr("debian.openTerm", "打开终端")
+    : installed ? tr("docker.start", "启动")
+    : tr("dsh.install", "安装");
+  const onCta = () => {
+    if (isBusy || !st || booting) return;
+    if (ready) return openUi();
+    return runSetup();                       // 未装 → 装;已装未跑 → 抽屉里启动 + 等终端
+  };
+  const accelText = st?.accel === "whpx" ? tr("debian.accelWhpxShort", "硬件加速") : st?.accel === "tcg" ? tr("debian.accelTcgShort", "软件模拟") : "";
+  const stateText = !st ? ""
+    : st.error === "no_node" ? tr("debian.stateNoNode", "未安装 · 约 390MB")
+    : st.error ? tr("dsh.stateNoNode", "未就绪:{{why}}", { why: debErr(st) })
+    : st.installing ? tr("debian.stateInstalling", "安装中 {{p}}", { p: pct != null ? pct + "%" : "…" })
+    : ready ? tr("debian.stateReady", "运行中 · {{a}} · {{m}}G 内存", { a: accelText, m: Math.round(st.mem / 1024) })
+    : running ? (st.boot || tr("debian.stateBooting", "开机中…"))
+    : st.installError && !installed ? tr("debian.stateFailed", "上次安装失败:{{why}}", { why: st.installError })
+    : installed ? tr("dsh.stateStopped", "已安装,未运行")
+    : tr("debian.stateMissing", "未安装 · 约 390MB");
+
+  return (
+    <div data-id="DebianCard" className={`bcard bcard--debian${ready ? " bcard--online" : ""}`}>
+      <div className="bcard__accent" />
+      <div className="bcard__top">
+        <div className="bcard__pill" style={{ color: DEB_RED }}>
+          <span className="bcard__dot" data-tone={tone} />
+          <DebianIcon />
+        </div>
+        {installed && (
+          <div className="bcard__menuwrap" onClick={(e) => e.stopPropagation()}>
+            <button type="button" ref={kebabRef} data-id="DebianCard-menu-btn" className="bcard__kebab" title={tr("debian.manage", "管理 Debian")} disabled={isBusy} onClick={toggleMenu}>
+              {isBusy ? <Spinner /> : <KebabIcon />}
+            </button>
+            {menuOpen && createPortal(
+              <div className="bcard__menu bcard__menu--portal" data-id="DebianCard-menu" role="menu" ref={menuRef}
+                style={{ position: "fixed", top: menuPos.top, left: menuPos.left, width: MENU_W }}
+                onClick={(e) => e.stopPropagation()}>
+                {running && (
+                  <button type="button" data-id="DebianCard-restart" className="bcard__menu-item is-accent"
+                    onClick={async () => { if (await confirmVmDown()) runOp("start", async () => { await debCtl("stop"); return debCtl("start"); }, tr("debian.restarted", "已重启,稍等终端起来")); }}>
+                    {tr("debian.restart", "重启虚拟机")}
+                  </button>
+                )}
+                {running && (
+                  <button type="button" data-id="DebianCard-stop" className="bcard__menu-item is-danger"
+                    onClick={async () => { if (await confirmVmDown()) runOp("stop", () => debCtl("stop"), tr("debian.stopped", "已关机")); }}>
+                    {tr("debian.stop", "关机")}
+                  </button>
+                )}
+                {(st?.accel === "tcg" || !st?.whpxFeature) && (
+                  <button type="button" data-id="DebianCard-accel" className="bcard__menu-item"
+                    title={tr("debian.accelHint", "开启 Windows 虚拟机监控程序平台(要管理员 + 重启)")} onClick={enableAccel}>
+                    {tr("debian.accel", "开启硬件加速")}
+                  </button>
+                )}
+                <div className="bcard__menu-sep" role="separator" aria-hidden />
+                <button type="button" data-id="DebianCard-auto" className="bcard__menu-item" onClick={toggleAuto}>
+                  {auto ? tr("dsh.autoOn", "✓ 开机自动启动") : tr("dsh.autoOff", "开机自动启动:关")}
+                </button>
+              </div>,
+              document.body
+            )}
+          </div>
+        )}
+      </div>
+      <div className="bcard__body">
+        <div style={{ height: 28, display: "flex", alignItems: "center", gap: 8 }}>
+          <h3 className="bcard__name" title="Debian 13" style={{ margin: 0, flex: 1, minWidth: 0, overflow: "hidden", textOverflow: "ellipsis", whiteSpace: "nowrap" }}>Debian 13</h3>
+        </div>
+        <div className="bcard__meta">
+          <span className="bcard__chip">Linux</span>
+          <span className="bcard__ver" style={{ marginLeft: 8, fontSize: 11, opacity: 0.6 }}>QEMU</span>
+        </div>
+        {stateText && <div data-id="DebianCard-state" title={stateText} style={{ marginTop: 6, fontSize: 12, color: "#9aa4b2", whiteSpace: "nowrap", overflow: "hidden", textOverflow: "ellipsis" }}>{stateText}</div>}
+      </div>
+      <button type="button" className="bcard__cta" data-id="DebianCard-cta" disabled={isBusy || !st || booting || !!st?.installing} onClick={onCta}
+        style={!ready ? { background: DEB_RED, color: "white" } : undefined}>
+        {isBusy || booting ? <Spinner /> : <ArrowIcon />}
+        <span>{ctaLabel}</span>
+      </button>
+    </div>
+  );
+}
+
 // Docker-版 cicy-code card (Windows only): a SECOND cicy-code instance running
 // in Docker on :8008, alongside the native local daemon (:8008). If Docker
 // Desktop is missing, the install flow downloads its installer to the user's
@@ -4011,6 +4354,7 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
   const checkStatus = useCallback(async () => {
     try {
       const s = await window.cicy?.docker?.appStatus?.();
+      if (s && Number(s.port)) dockerAppPort = Number(s.port);
       setStatus(s);
       // 自愈卡死的设置抽屉:容器已健康(running)说明 setup 实际已完成,但抽屉可能还停在
       // 「进行中」—— 网络失败重试后,follower 跟随的 bootstrap promise 迟迟不 resolve、又收
@@ -4052,7 +4396,7 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
     for (const raw of portList) {
       const s = String(raw).trim(); if (!s) continue;
       const p = Number(s);
-      if (!Number.isInteger(p) || p < 1 || p > 65535 || p === 8008 || seen.has(p)) { setPortsErr(tr("docker.ports.invalid", "有端口无效(1-65535,不能是 8008,不能重复)")); return; }
+      if (!Number.isInteger(p) || p < 1 || p > 65535 || p === 8008 || p === dockerAppPort || seen.has(p)) { setPortsErr(tr("docker.ports.invalid", "有端口无效(1-65535,不能是 {{p}},不能重复)", { p: dockerAppPort })); return; }
       seen.add(p); out.push(p);
     }
     setPortsErr(""); setPortsBusy(true); setPortsOpen(false);
@@ -4176,7 +4520,7 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
         // update() 返回时 :8008 已健康(waitUntil probeHealth)。立刻:① reload 已打开的
         // docker tab(reloadIgnoringCache,拿新版 SPA)② 强制重探,卡片版本马上更新(不等
         // 60s reconcile / 缓存)。
-        try { window.cicy?.tabs?.reloadIfOpen?.("http://127.0.0.1:8008", tr("docker.teamTab", "Docker 团队")); } catch {}
+        try { window.cicy?.tabs?.reloadIfOpen?.(dockerAppUrl(), tr("docker.teamTab", "Docker 团队")); } catch {}
         try { const s = await window.cicy?.docker?.appRedetect?.(); if (s) setStatus(s); } catch {}
       }
     } catch (e) {
@@ -4286,7 +4630,7 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
       // 打开很慢 → 先探这个 :8008 tab 开过没。开过(openedWc 里有它的
       // webContentsId)就**直接 active 秒切**,不再拿 token / 注册 team(那是慢的根)。
       try {
-        const r = await window.cicy?.tabs?.activateIfOpen?.("http://127.0.0.1:8008");
+        const r = await window.cicy?.tabs?.activateIfOpen?.(dockerAppUrl());
         if (r?.active) return;
       } catch {}
       // 没开过 → 走慢路径(读容器 token 最多 ~50s)。进行中只显示 CTA 的「打开中…」spinner
@@ -4365,7 +4709,7 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
                 </button>
                 {/* 常用 */}
                 <button type="button" data-id="DockerCard-reload" className="bcard__menu-item"
-                  onClick={(e) => { e.stopPropagation(); setMenuOpen(false); window.cicy?.tabs?.reloadIfOpen?.("http://127.0.0.1:8008", "Docker 团队"); }}>
+                  onClick={(e) => { e.stopPropagation(); setMenuOpen(false); window.cicy?.tabs?.reloadIfOpen?.(dockerAppUrl(), "Docker 团队"); }}>
                   {tr("docker.reloadWindow", "刷新窗口")}
                 </button>
                 <button type="button" data-id="DockerCard-open-dir" className="bcard__menu-item"
@@ -4488,7 +4832,7 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
             <h3 style={{ margin: "0 0 6px", fontSize: 16, color: "#e6edf3" }}>{tr("docker.ports.title", "端口设置")}</h3>
             <p style={{ margin: "0 0 14px", fontSize: 12.5, lineHeight: 1.6, color: "#9aa4b2" }}>{tr("docker.ports.sub", "除 :8008 外,额外发布、可从 Windows 直达容器内服务的端口")}</p>
             <div style={{ display: "flex", alignItems: "center", gap: 8, padding: "8px 10px", marginBottom: 10, borderRadius: 8, background: "#0d1117", border: "1px solid #21262d", color: "#7d8590", fontSize: 13 }}>
-              🔒 {tr("docker.ports.mainFixed", ":8008 · cicy-code(固定)")}
+              🔒 {tr("docker.ports.mainFixed", ":{{p}} · cicy-code(固定)", { p: dockerAppPort })}
             </div>
             <div style={{ display: "flex", flexDirection: "column", gap: 8, maxHeight: 220, overflowY: "auto" }}>
               {portList.length === 0 && (
@@ -5036,12 +5380,16 @@ function isLocalSidecar(baseUrl) {
 
 // The Docker-版 cicy-code instance — localhost:8008, **只在 Windows**。Owned by
 // <DockerCard>, so it's filtered out of the generic node lists.
+// Docker-版 cicy-code 的本机端口:老机器(WSL)8008,新机器(QEMU,不靠 WSL)8009。一台机器只会有其一;
+// 真实值以 desktop 报上来的 docker:app-status.port 为准(DockerCard 拿到后写进 dockerAppPort)。
+let dockerAppPort = 8008;
+const dockerAppUrl = () => `http://127.0.0.1:${dockerAppPort}`;
 function isDockerApp(baseUrl) {
   try {
     if (window.cicy?.platform !== "win32") return false; // docker-版只在 Windows
     const p = new URL(baseUrl);
     const local = p.hostname === "127.0.0.1" || p.hostname === "localhost" || p.hostname === "::1";
-    return local && p.port === "8008";
+    return local && (p.port === "8008" || p.port === "8009");
   } catch { return false; }
 }