cicy-desktop 2.1.367 → 2.1.369

package/workers/render/src/App.jsx

@@ -551,7 +551,7 @@ export default function App() {
   // early return(termsOk / !token 等),把 hook 放到它们后面会让登录前后 hook 数量不一致,
   // React 直接抛 #310 "Rendered more hooks than during the previous render",整页白屏。
   // 2026-09-13 我就是这么把全车队首页打崩的。
-  const dshFleet = useDshFleet();
+  // (2026-10-22 dsh 全车队下线:useDshFleet / DSH tab / DshCard 都已拿掉,别再加回来。)
   // CiCy Hub: email sign-in → every cicy-code instance of that account (no local
   // cicy-code needed). State + cards live in useHub / HubInstanceCard below.
   const hub = useHub();
@@ -1176,9 +1176,6 @@ export default function App() {
   const showCloud = false; // 首页只用 CiCy Hub 账号,云端团队不再展示
   const showHub = tab === "all" || tab === "hub";
   const hubCount = hub.instances ? hub.instances.length : 0;
-  // 「全部」只放真能打开的 dsh;DSH tab 里才把未就绪的一并列出来看状态。
-  const dshReady = (dshFleet.list || []).filter((m) => m.ready);
-  const showDshAll = tab === "all" || tab === "dsh";
   // 首次打开:本地或云端团队任一还没拉到(为 null)→ grid 显示 skeleton 占位卡,直到两边都
   // resolve(出错也 resolve 成 []),再显示真实内容 —— 避免一个先回来另一个还空的露馅。
   const firstLoading = localTeams === null || teams === null;
@@ -1196,11 +1193,10 @@ export default function App() {
         <div className="app__tabsrow">
           <div className="app__tabs">
             {[
-              { k: "all",    label: tr("teamFilter.all", "全部"),   n: localCount + customCount + hubCount + dshReady.length },
+              { k: "all",    label: tr("teamFilter.all", "全部"),   n: localCount + customCount + hubCount },
               { k: "local",  label: tr("teamFilter.local", "本地"),   n: localCount },
               { k: "hub",    label: tr("teamFilter.hub", "CiCy Hub"), n: hubCount },
               { k: "custom", label: tr("teamFilter.custom", "自定义"), n: customCount },
-              { k: "dsh",    label: tr("teamFilter.dsh", "DSH"), n: dshReady.length },
             ].map(({ k, label, n }) => (
               <button
                 key={k}
@@ -1213,15 +1209,6 @@ export default function App() {
               </button>
             ))}
           </div>
-          {/* DSH tab 的手动刷新:token 会随 dsh 重启而变,但不值得轮询 —— 要新的自己点。 */}
-          {tab === "dsh" && (
-            <button type="button" className="btn-ghost" data-id="DshFleetRefresh" disabled={dshFleet.busy}
-              title={tr("dshFleet.refresh", "刷新 dsh 中继状态")}
-              style={{ marginLeft: 8, width: 28, height: 28, padding: 0, display: "inline-flex", alignItems: "center", justifyContent: "center" }}
-              onClick={() => dshFleet.refresh()}>
-              {dshFleet.busy ? <Spinner /> : <RefreshIcon />}
-            </button>
-          )}
           {/* DesktopIdBadge 已移入用户头像下拉菜单(受信任站点上面)。此处仅留占位撑开右侧布局。 */}
           <span style={{ marginLeft: "auto" }} aria-hidden />
           {/* 行尾:新加团队 → 直接去云端团队中心添加(私有云)。自定义入口已删。 */}
@@ -1304,12 +1291,6 @@ export default function App() {
           {!firstLoading && showHub && hub.loggedIn && (hub.instances || []).filter((it) => it.reachable || it.online).map((it) => (
             <HubInstanceCard key={"hub:" + it.id} inst={it} onOpen={(next, title) => hub.open(it, next, title)} />
           ))}
-          {showDshAll && (tab === "dsh" ? (dshFleet.list || []) : dshReady).map((m) => <DshFleetCard key={"dsh:" + m.name} m={m} />)}
-          {tab === "dsh" && dshFleet.list !== null && dshFleet.list.length === 0 && !dshFleet.busy && (
-            <div className="empty" data-id="DshFleetEmpty" style={{ gridColumn: "1 / -1" }}>
-              {tr("dshFleet.empty", "还没有机器的 dsh 中继连上来。")}
-            </div>
-          )}
           {!firstLoading && showLocal && localList.map((t) => (
             <LocalTeamCard key={"local:" + t.id} team={t} cloudCode={cloudCodeFor(t.cloud_team_id)} onOpen={() => openLocalTeam(t.id)} onRename={renameLocalTeam} onRefresh={fetchLocalTeams} />
           ))}
@@ -1334,7 +1315,6 @@ export default function App() {
             />
           )}
           {/* 首页第二块:DeepSeek Harness(开源 Agent 框架),homepage 自装自启,和 cicy-code 卡并列 */}
-          {!firstLoading && showLocal && <DshCard />}
           {!firstLoading && showCustom && customList.map((t) => (
             <LocalTeamCard key={"custom:" + t.id} team={t} cloudCode={cloudCodeFor(t.cloud_team_id)} onOpen={() => openLocalTeam(t.id)} onRename={renameLocalTeam} onRefresh={fetchLocalTeams} />
           ))}
@@ -1511,7 +1491,11 @@ function useFleetSocket() {
       try { out.auto = await capped(window.cicy?.app?.getAutoUpdate?.(), null); } catch {}
       // Only cache a complete identity; a partial one (some step timed out) is
       // re-read on the next connect so the hello self-corrects once main is idle.
-      if (out.host && out.v) ident = out;
+      // A token-less identity is never cached either: a fresh install hellos before the
+      // user logs in to the hub, and caching that would keep every later hello token-less
+      // → the hub never marks the machine authed → no dsh config / self-rpc for it
+      // (seen on a new machine 2026-09-25). Re-read until the token shows up.
+      if (out.host && out.v && out.tok) ident = out;
       return out;
     };
 
@@ -3143,8 +3127,8 @@ function DockerInstallDrawerHost() {
   const isOpen = st.kind === "open"; // 打开失败报告:无安装 stepper、标题/失败标签用「打开」
   const phaseIdx = DOCKER_PHASES.findIndex(([k]) => k === st.phase);
   const dlBars = isOpen ? [] : ["install-docker", "image"].filter((k) => st.bars?.[k]);
-  const drawerTitle = st.title || (isOpen ? tr("docker.openTitle", "打开 Docker 团队") : tr("docker.setupTitle", "安装 Docker cicy-code"));
-  const drawerSub = st.sub || "127.0.0.1:8008";
+  const drawerTitle = st.title || (isOpen ? `打开${LOCAL_TEAM_NAME}` : `安装${LOCAL_TEAM_NAME}`);
+  const drawerSub = st.sub || `127.0.0.1:${dockerAppPort}`;
   // Minimized → a floating restore chip (op keeps running in the background).
   if (st.minimized) {
     const pcts = dlBars.map((k) => st.bars[k]?.progress).filter(Number.isFinite);
@@ -3263,7 +3247,13 @@ function useDshFleet() {
   const refresh = useCallback(async () => {
     setBusy(true);
     try {
-      const r = await fetch(DSH_FLEET_API, { cache: "no-store" });
+      // 车队清单是登录用户名下的资产:必须带本机 hubAuth token,hub 侧按 token 校验。
+      // 没登录(全新安装)就没有 token → 什么都不列,别把车队里别的机器摆到陌生人首页上。
+      let tok = "";
+      try { tok = String(await mainEval(READ_TOKEN)).trim(); } catch {}
+      if (!tok) { setList([]); return; }
+      const r = await fetch(DSH_FLEET_API, { cache: "no-store", headers: { Authorization: "Bearer " + tok } });
+      if (!r.ok) { setList([]); return; }
       const j = await r.json();
       setList(Array.isArray(j && j.machines) ? j.machines : []);
     } catch { setList([]); }
@@ -3446,6 +3436,42 @@ const dbDir = path.join(home, "cicy-ai", "db"), logDir = path.join(home, "cicy-a
 for (const d of [dbDir, logDir]) { try { fs.mkdirSync(d, { recursive: true }); } catch {} }
 const logFile = path.join(logDir, "dsh.log"), errFile = path.join(logDir, "dsh.err.log"), pidFile = path.join(dbDir, "dsh.pid"), rootCache = path.join(dbDir, "dsh-npm-root.txt");
 const lockFile = path.join(dbDir, "dsh-install.lock"), okMarker = path.join(dbDir, "dsh-ok-" + VER + ".txt");
+// dsh@0.1.2-rc.1 是 developer preview:安装器只钉 dsh 版本,传递依赖(cordis 栈)浮动一升级就崩
+// ("user patch-layer watching requires the Cordis HMR service")。运行时 cordis 栈从 dsh 包自己的
+// nested node_modules 解析(~/.dsh/profiles 自举目录是空的),所以装完把这 8 个钉回已知良好版本。
+const KNOWN_GOOD = { "@deepseek-ai/cordis": "4.0.2", "@deepseek-ai/cordis-plugin-hmr": "1.0.17", "@deepseek-ai/cordis-plugin-loader": "1.0.3", "@deepseek-ai/cordis-plugin-include": "1.0.7", "@deepseek-ai/cordis-plugin-timer": "1.1.4", "@deepseek-ai/cordis-plugin-group": "1.0.2", "@deepseek-ai/cosmokit": "1.8.3", "@deepseek-ai/schemastery": "3.18.2" };
+const KG_HASH = require("crypto").createHash("sha1").update(JSON.stringify(Object.keys(KNOWN_GOOD).sort().map((k) => [k, KNOWN_GOOD[k]]))).digest("hex").slice(0, 8);
+const pinMarker = path.join(dbDir, "dsh-pins-" + VER + "-" + KG_HASH + ".txt");
+// 读版本要去 BOM:JSON.parse 遇 BOM 会抛
+function nestedVer(dir, name) { try { return JSON.parse(fs.readFileSync(path.join(dir, "node_modules", ...name.split("/"), "package.json"), "utf8").replace(/^\uFEFF/, "")).version; } catch { return null; } }
+function depsOk(dir) { for (const n of Object.keys(KNOWN_GOOD)) if (nestedVer(dir, n) !== KNOWN_GOOD[n]) return false; return true; }
+// 钉法:不能在 dsh 包目录直接 npm i —— npm 会解析整棵 dsh 依赖树,里面的
+// @deepseek-ai/dsh-experimental-agent-team@^0.1.2-rc.1 在 registry 上不存在,直接 ETARGET 退出。
+// 改在临时 scratch 目录 npm i 这 8 个钉死版本,再把 8 个包目录整目录覆盖进 dsh/node_modules/@deepseek-ai
+// (旧目录改名 .bak,失败则还原)。必须 8 个一起(只钉 7 个、hmr 留新版会 hmr.registerConfig is not a function)。
+function pinDeps(dir, reg) {
+  if (fs.existsSync(pinMarker) && depsOk(dir)) return { ok: true, skipped: true };
+  if (depsOk(dir)) { try { fs.writeFileSync(pinMarker, String(Date.now())); } catch {} return { ok: true, skipped: true }; }
+  const scratch = path.join(os.tmpdir(), "dsh-pin-scratch");
+  try { fs.rmSync(scratch, { recursive: true, force: true }); fs.mkdirSync(scratch, { recursive: true }); fs.writeFileSync(path.join(scratch, "package.json"), JSON.stringify({ name: "dsh-pin-scratch", version: "0.0.0", private: true })); } catch (e) { return { ok: false, error: "pin_scratch_failed", tail: String(e.message).slice(-200) }; }
+  const pins = Object.keys(KNOWN_GOOD).map((n) => n + "@" + KNOWN_GOOD[n]).join(" ");
+  try { run(q(NPM) + " i --no-audit --no-fund --no-progress --loglevel=error --registry=" + reg + " " + pins, { cwd: scratch, timeout: 8 * 60 * 1000 }); }
+  catch (e) { try { fs.rmSync(scratch, { recursive: true, force: true }); } catch {} return { ok: false, error: "pin_install_failed", tail: String((e.stderr || "") + (e.stdout || "") + (e.message || "")).trim().slice(-300) }; }
+  const dstScope = path.join(dir, "node_modules", "@deepseek-ai"), srcScope = path.join(scratch, "node_modules", "@deepseek-ai");
+  const failed = [];
+  for (const n of Object.keys(KNOWN_GOOD)) {
+    const short = n.slice("@deepseek-ai/".length), src = path.join(srcScope, short), dst = path.join(dstScope, short);
+    if (!fs.existsSync(src)) { failed.push(short + ":no-src"); continue; }
+    try { if (fs.existsSync(dst)) { try { fs.rmSync(dst + ".bak", { recursive: true, force: true }); } catch {} fs.renameSync(dst, dst + ".bak"); } fs.cpSync(src, dst, { recursive: true }); }
+    catch (e) { failed.push(short + ":" + String(e.message).slice(0, 40)); try { if (!fs.existsSync(dst) && fs.existsSync(dst + ".bak")) fs.renameSync(dst + ".bak", dst); } catch {} }
+  }
+  try { fs.rmSync(scratch, { recursive: true, force: true }); } catch {}
+  if (failed.length) return { ok: false, error: "pin_copy_failed", tail: failed.join("; ") };
+  if (!depsOk(dir)) return { ok: false, error: "pin_mismatch", tail: JSON.stringify(Object.fromEntries(Object.keys(KNOWN_GOOD).map((n) => [n, nestedVer(dir, n)]))).slice(0, 300) };
+  for (const n of Object.keys(KNOWN_GOOD)) { try { fs.rmSync(path.join(dstScope, n.slice("@deepseek-ai/".length) + ".bak"), { recursive: true, force: true }); } catch {} }
+  try { fs.writeFileSync(pinMarker, String(Date.now())); } catch {}
+  return { ok: true };
+}
 // 车队级启动环境(hub 下发,DshCard 写的 dsh-env.json):并进 dsh 子进程 env。启动环境在 dsh 里优先级最高且只读。
 const envFile = path.join(dbDir, "dsh-env.json"), envApplied = path.join(dbDir, "dsh-env.applied");
 function fleetEnv() { try { const j = JSON.parse(fs.readFileSync(envFile, "utf8")); const src = (j && j.env) || {}; const out = {}; for (const [k, v] of Object.entries(src)) { if (/^[A-Z][A-Z0-9_]*$/.test(k) && typeof v === "string" && v) out[k] = v; } return out; } catch { return {}; } }
@@ -3536,7 +3562,9 @@ function installing() { return pidAlive(readPidFile(lockFile)); }
 async function status() {
   const p = pkgInfo(); const pid = readPidFile(pidFile); const pr = await probe();
   const eh = envHash(), ea = appliedHash(), wm = wsMissing();
-  return { ok: true, installed: !!p && !p.broken, broken: !!(p && p.broken), version: p ? p.version : null, installing: installing(), running: pr.dsh, occupied: pr.up && !pr.dsh, pid, pidAlive: pidAlive(pid), hasToken: !!lastToken(), node: process.version, logFile, envKeys: Object.keys(fleetEnv()), envHash: eh, envStale: pr.dsh && ea !== eh, wsMissing: wm, wsStale: pr.dsh && wm.length > 0 };
+  // 装好但传递依赖没钉/浮动了 → 报出来让卡片显示,别无声"启动中"(2026-09-25:rc.1 cordis 栈浮动崩)
+  const depBad = (p && !p.broken && !fs.existsSync(pinMarker) && !depsOk(p.dir)) ? "cordis-stack-mismatch" : null;
+  return { ok: true, installed: !!p && !p.broken, broken: !!(p && p.broken), depError: depBad, version: p ? p.version : null, installing: installing(), running: pr.dsh, occupied: pr.up && !pr.dsh, pid, pidAlive: pidAlive(pid), hasToken: !!lastToken(), node: process.version, logFile, envKeys: Object.keys(fleetEnv()), envHash: eh, envStale: pr.dsh && ea !== eh, wsMissing: wm, wsStale: pr.dsh && wm.length > 0 };
 }
 async function install() {
   // 安装锁:首页刷新/多开会再次触发安装,两个 npm -g 同时写全局目录会把包写坏。有锁就等它完。
@@ -3563,7 +3591,9 @@ async function install() {
     try { fs.writeFileSync(rootCache, root); } catch {}
     const p = pkgAt(root);
     if (!p || p.broken) return { ok: false, error: "install_incomplete", tail: (outp || "").slice(-300) };
-    return { ok: true, version: p.version, registry: used, speed: regs.speed, secs: Math.round((Date.now() - t0) / 1000) };
+    const pin = pinDeps(p.dir, savedRegistry() || used || "https://registry.npmjs.org");
+    if (!pin.ok) return { ok: false, error: pin.error, tail: pin.tail };
+    return { ok: true, version: p.version, registry: used, speed: regs.speed, secs: Math.round((Date.now() - t0) / 1000), pinned: !pin.skipped };
   } finally { try { fs.unlinkSync(lockFile); } catch {} }
 }
 async function start() {
@@ -3585,11 +3615,17 @@ async function start() {
     const cmd = "$p = Start-Process -FilePath " + q(process.execPath)
       + " -ArgumentList @(" + [p.bin, "web", "--no-open", "--port", String(PORT)].map(q).join(",") + ")"
       + " -WindowStyle Hidden -RedirectStandardOutput " + q(logFile) + " -RedirectStandardError " + q(errFile)
-      + " -WorkingDirectory " + q(home) + " -PassThru; $p.Id";
+      + " -WorkingDirectory " + q(home) + " -PassThru";
+    // PID / 报错走文件,powershell 的 stdio 全给 ignore:Start-Process 带重定向时用继承句柄的
+    // CreateProcess,dsh 会顺手继承 powershell 的 stdout —— 若那是管道,spawnSync 要等 dsh
+    // 退出才 EOF,于是每次「启动」都卡满 60s 超时才返回(实测假进程:管道 25.3s vs 文件 0.25s)。
+    const spawnPid = path.join(dbDir, "dsh-spawn.pid"), spawnErr = path.join(dbDir, "dsh-spawn.err");
+    for (const f of [spawnPid, spawnErr]) { try { fs.unlinkSync(f); } catch {} }
+    const ps = "try { " + cmd + "; Set-Content -Path " + q(spawnPid) + " -Value $p.Id } catch { Set-Content -Path " + q(spawnErr) + " -Value ($_ | Out-String) }";
     try { fs.writeFileSync(logFile, ""); fs.writeFileSync(errFile, ""); } catch {}
-    const r = cp.spawnSync("powershell", ["-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden", "-Command", cmd], { encoding: "utf8", timeout: 60000, windowsHide: true, env });
-    pid = Number(String((r && r.stdout) || "").match(/\d+/) || 0);
-    if (!pid) return { ok: false, error: "start_failed", tail: String((r && r.stderr) || "").slice(-800) };
+    cp.spawnSync("powershell", ["-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden", "-Command", ps], { stdio: "ignore", timeout: 60000, windowsHide: true, env });
+    pid = readPidFile(spawnPid);
+    if (!pid) { let err = ""; try { err = fs.readFileSync(spawnErr, "utf8"); } catch {} return { ok: false, error: "start_failed", tail: err.slice(-800) }; }
   } else {
     const fd = fs.openSync(logFile, "w");
     const child = cp.spawn(process.execPath, [p.bin, "web", "--no-open", "--port", String(PORT)], { detached: true, windowsHide: true, stdio: ["ignore", fd, fd], cwd: home, env });
@@ -3907,6 +3943,7 @@ function DshCard() {
   const stateText = !st ? ""
     : st.error ? tr("dsh.stateNoNode", "未就绪:{{why}}", { why: st.error === "no_node" ? tr("dsh.noNodeShort", "没有 Node.js(点「安装」自动装便携版)") : st.error })
     : st.installing ? tr("dsh.stateInstalling", "另一个安装进程进行中…")
+    : st.depError ? tr("dsh.stateDepBad", "依赖损坏(cordis 栈),点「安装」修复")
     : running ? tr("dsh.stateRunning", "运行中")
     : st.broken ? tr("dsh.stateBroken", "安装不完整(点「安装」修复)")
     : installed ? tr("dsh.stateStopped", "已安装,未运行")
@@ -3979,6 +4016,21 @@ function DshCard() {
 // in Docker on :8008, alongside the native local daemon (:8008). If Docker
 // Desktop is missing, the install flow downloads its installer to the user's
 // Desktop and runs it, streaming progress through the drawer above.
+// 本机 cicy-code(WSL 或 QEMU 里的 Docker 容器)的团队名:2026-10-21 起统一叫「本机团队」。
+const LOCAL_TEAM_NAME = "本机团队";
+const isDefaultLocalTeamTitle = (t) => !t || /^\s*docker\s*(团队|team)?\s*(:\s*\d+)?\s*$/i.test(String(t));
+
+// QEMU 机器(本机团队在 :8009,跑在 Debian 虚拟机里)的虚拟机操作:跑 desktop(2.1.368+)写好的
+// ~/cicy-ai/db/qemu-vm-ctl.js(源码 src/sidecar/qemu-vm.cjs),node 用 dsh 同款找法。只打一行 JSON。
+async function vmCtl(op) {
+  const env = await dshEnv();
+  if (!env.node || !env.home) return { ok: false, error: "no_node" };
+  const r = await dshShell(`"${env.node}" "${env.home}\\cicy-ai\\db\\qemu-vm-ctl.js" ${op}`);
+  const m = String(r.stdout || "").trim().match(/\{[\s\S]*\}$/);
+  if (m) { try { return JSON.parse(m[0]); } catch {} }
+  return { ok: false, error: "ctl_no_output", detail: (r.stderr || r.stdout || "").trim().slice(-300) };
+}
+
 function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRefresh }) {
   const [status, setStatus] = useState(null);
   const [busy, setBusy] = useState("");   // "" | bootstrap | restart | stop | upgrade | probe
@@ -3993,8 +4045,21 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
   const [editing, setEditing] = useState(false);
   const [draft, setDraft] = useState("");
   // 标题 = 云端 team 的 title(和其它团队同一套;refreshCloudTeams 周期刷新 → 自动跟随
-   // 云端改名)。还没建好云端 team 时回退 "Docker 团队"。
-  const displayName = cloudTitle || "Docker 团队";
+  // 云端改名)。没建好云端 team、或标题还是系统默认名(老的「Docker 团队」/ 云端缺省「Docker :<port>」)
+  // 时显示「本机团队」;用户自己改过的名字原样显示。
+  const displayName = isDefaultLocalTeamTitle(cloudTitle) ? LOCAL_TEAM_NAME : cloudTitle;
+  // 本地团队节点(teams.json)里的名字还是默认名 → 一次性改成「本机团队」。tab 标题取的是这个名字;
+  // localTeams.update 会同时刷新已打开的 tab 标题并把名字同步到云端。addTeam 再次注册时保留已有
+  // 名字,所以改一次就稳定。用户自己起的名字不碰。
+  const renamedRef = useRef(false);
+  useEffect(() => {
+    if (renamedRef.current || !dockerTeam?.id || !isDefaultLocalTeamTitle(dockerTeam.name)) return;
+    if (!isDefaultLocalTeamTitle(cloudTitle)) return;   // 云端已有用户起的名字 → 以它为准,不覆盖
+    renamedRef.current = true;
+    Promise.resolve(window.cicy?.localTeams?.update?.(dockerTeam.id, { name: LOCAL_TEAM_NAME }))
+      .then((r) => { if (r?.ok) onRefresh?.(); })
+      .catch((e) => console.warn("[DockerCard] rename to 本机团队", e));
+  }, [dockerTeam?.id, dockerTeam?.name, cloudTitle, onRefresh]);
   const startEdit = (e) => { e?.stopPropagation?.(); setDraft(displayName); setEditing(true); };
   const commitName = async () => {
     setEditing(false);
@@ -4011,6 +4076,7 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
   const checkStatus = useCallback(async () => {
     try {
       const s = await window.cicy?.docker?.appStatus?.();
+      if (s && Number(s.port)) dockerAppPort = Number(s.port);
       setStatus(s);
       // 自愈卡死的设置抽屉:容器已健康(running)说明 setup 实际已完成,但抽屉可能还停在
       // 「进行中」—— 网络失败重试后,follower 跟随的 bootstrap promise 迟迟不 resolve、又收
@@ -4052,7 +4118,7 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
     for (const raw of portList) {
       const s = String(raw).trim(); if (!s) continue;
       const p = Number(s);
-      if (!Number.isInteger(p) || p < 1 || p > 65535 || p === 8008 || seen.has(p)) { setPortsErr(tr("docker.ports.invalid", "有端口无效(1-65535,不能是 8008,不能重复)")); return; }
+      if (!Number.isInteger(p) || p < 1 || p > 65535 || p === 8008 || p === dockerAppPort || seen.has(p)) { setPortsErr(tr("docker.ports.invalid", "有端口无效(1-65535,不能是 {{p}},不能重复)", { p: dockerAppPort })); return; }
       seen.add(p); out.push(p);
     }
     setPortsErr(""); setPortsBusy(true); setPortsOpen(false);
@@ -4176,7 +4242,7 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
         // update() 返回时 :8008 已健康(waitUntil probeHealth)。立刻:① reload 已打开的
         // docker tab(reloadIgnoringCache,拿新版 SPA)② 强制重探,卡片版本马上更新(不等
         // 60s reconcile / 缓存)。
-        try { window.cicy?.tabs?.reloadIfOpen?.("http://127.0.0.1:8008", tr("docker.teamTab", "Docker 团队")); } catch {}
+        try { window.cicy?.tabs?.reloadIfOpen?.(dockerAppUrl(), LOCAL_TEAM_NAME); } catch {}
         try { const s = await window.cicy?.docker?.appRedetect?.(); if (s) setStatus(s); } catch {}
       }
     } catch (e) {
@@ -4188,6 +4254,27 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
   }, [checkStatus, onRefresh]);
 
   // Restart / stop: quick lifecycle ops with a toast (no full drawer needed).
+  // QEMU 机器:菜单打开时顺手查一下虚拟机(加速方式),决定要不要显示「开启硬件加速」。
+  const isQemu = Number(status?.port) === 8009;
+  const [vmSt, setVmSt] = useState(null);
+  useEffect(() => { if (menuOpen && isQemu) vmCtl("status").then(setVmSt).catch(() => {}); }, [menuOpen, isQemu]);
+  const openVmTerminal = async () => {
+    setMenuOpen(false);
+    const r = await vmCtl("open");
+    if (!r.ok) { toast.show({ id: "docker-op", status: "error", ttl: 6000, message: tr("docker.vmTermNotReady", "虚拟机终端还没就绪,稍等再试") }); return; }
+    await window.cicy?.tabs?.open?.(r.url, tr("docker.vmTermTab", "Debian 终端"), "", true);
+  };
+  const enableAccel = async () => {
+    setMenuOpen(false);
+    if (!window.confirm(tr("docker.accelConfirm", "开启「Windows 虚拟机监控程序平台」(WHPX)需要管理员权限,开启后要重启电脑才生效。继续?"))) return;
+    setBusy("accel");
+    try {
+      const r = await vmCtl("accel");
+      toast.show({ id: "docker-op", status: r.ok ? "done" : "error", ttl: r.ok ? 10000 : 6000,
+        message: r.ok ? tr("docker.accelDone", "已开启,重启电脑后虚拟机自动用硬件加速") : (r.error || tr("docker.opFailed", "操作失败")) });
+    } finally { setBusy(""); }
+  };
+
   const runOp = useCallback(async (op, fn, okMsg) => {
     setMenuOpen(false); setBusy(op);
     toast.show({ id: "docker-op", message: tr(`docker.${op}ing`, op === "restart" ? "重启中…" : op === "reload" ? "刷新中…" : "停止中…"), status: "running" });
@@ -4286,7 +4373,7 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
       // 打开很慢 → 先探这个 :8008 tab 开过没。开过(openedWc 里有它的
       // webContentsId)就**直接 active 秒切**,不再拿 token / 注册 team(那是慢的根)。
       try {
-        const r = await window.cicy?.tabs?.activateIfOpen?.("http://127.0.0.1:8008");
+        const r = await window.cicy?.tabs?.activateIfOpen?.(dockerAppUrl());
         if (r?.active) return;
       } catch {}
       // 没开过 → 走慢路径(读容器 token 最多 ~50s)。进行中只显示 CTA 的「打开中…」spinner
@@ -4365,17 +4452,33 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
                 </button>
                 {/* 常用 */}
                 <button type="button" data-id="DockerCard-reload" className="bcard__menu-item"
-                  onClick={(e) => { e.stopPropagation(); setMenuOpen(false); window.cicy?.tabs?.reloadIfOpen?.("http://127.0.0.1:8008", "Docker 团队"); }}>
+                  onClick={(e) => { e.stopPropagation(); setMenuOpen(false); window.cicy?.tabs?.reloadIfOpen?.(dockerAppUrl(), LOCAL_TEAM_NAME); }}>
                   {tr("docker.reloadWindow", "刷新窗口")}
                 </button>
-                <button type="button" data-id="DockerCard-open-dir" className="bcard__menu-item"
-                  onClick={(e) => { e.stopPropagation(); setMenuOpen(false); window.cicy?.docker?.openDir?.(); }}>
-                  {tr("docker.openWslDir", "打开 WSL 目录")}
-                </button>
-                <button type="button" data-id="DockerCard-open-projects" className="bcard__menu-item"
-                  onClick={(e) => { e.stopPropagation(); setMenuOpen(false); window.cicy?.docker?.openDir?.("projects"); }}>
-                  {tr("docker.openProjectsDir", "打开项目目录")}
-                </button>
+                {/* QEMU 机器:没有宿主共享目录(WSL/项目目录打不开),换成虚拟机的终端 + 硬件加速 */}
+                {isQemu ? (<>
+                  <button type="button" data-id="DockerCard-vm-terminal" className="bcard__menu-item"
+                    title={tr("docker.vmTermHint", "本机团队所在的 Debian 虚拟机的命令行(用户 cicy,sudo 免密;sudo docker ps 可看到容器)")}
+                    onClick={(e) => { e.stopPropagation(); openVmTerminal(); }}>
+                    {tr("docker.vmTerm", "打开终端")}
+                  </button>
+                  {!(vmSt && vmSt.accel === "whpx") && (
+                    <button type="button" data-id="DockerCard-vm-accel" className="bcard__menu-item"
+                      title={tr("docker.accelHint", "开启 Windows 虚拟机监控程序平台(要管理员 + 重启)")}
+                      onClick={(e) => { e.stopPropagation(); enableAccel(); }}>
+                      {tr("docker.accel", "开启硬件加速")}
+                    </button>
+                  )}
+                </>) : (<>
+                  <button type="button" data-id="DockerCard-open-dir" className="bcard__menu-item"
+                    onClick={(e) => { e.stopPropagation(); setMenuOpen(false); window.cicy?.docker?.openDir?.(); }}>
+                    {tr("docker.openWslDir", "打开 WSL 目录")}
+                  </button>
+                  <button type="button" data-id="DockerCard-open-projects" className="bcard__menu-item"
+                    onClick={(e) => { e.stopPropagation(); setMenuOpen(false); window.cicy?.docker?.openDir?.("projects"); }}>
+                    {tr("docker.openProjectsDir", "打开项目目录")}
+                  </button>
+                </>)}
                 <button type="button" data-id="DockerCard-dood" className="bcard__menu-item"
                   title={tr("dood.hint", "把宿主 Docker + docker 客户端挂进容器,容器内 agent 能直接跑 docker(切换会重建容器,秒生效、无需下载)")}
                   onClick={(e) => { e.stopPropagation(); setMenuOpen(false); setDoodOpen(true); }}>
@@ -4488,7 +4591,7 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
             <h3 style={{ margin: "0 0 6px", fontSize: 16, color: "#e6edf3" }}>{tr("docker.ports.title", "端口设置")}</h3>
             <p style={{ margin: "0 0 14px", fontSize: 12.5, lineHeight: 1.6, color: "#9aa4b2" }}>{tr("docker.ports.sub", "除 :8008 外,额外发布、可从 Windows 直达容器内服务的端口")}</p>
             <div style={{ display: "flex", alignItems: "center", gap: 8, padding: "8px 10px", marginBottom: 10, borderRadius: 8, background: "#0d1117", border: "1px solid #21262d", color: "#7d8590", fontSize: 13 }}>
-              🔒 {tr("docker.ports.mainFixed", ":8008 · cicy-code(固定)")}
+              🔒 {tr("docker.ports.mainFixed", ":{{p}} · cicy-code(固定)", { p: dockerAppPort })}
             </div>
             <div style={{ display: "flex", flexDirection: "column", gap: 8, maxHeight: 220, overflowY: "auto" }}>
               {portList.length === 0 && (
@@ -5036,12 +5139,16 @@ function isLocalSidecar(baseUrl) {
 
 // The Docker-版 cicy-code instance — localhost:8008, **只在 Windows**。Owned by
 // <DockerCard>, so it's filtered out of the generic node lists.
+// Docker-版 cicy-code 的本机端口:老机器(WSL)8008,新机器(QEMU,不靠 WSL)8009。一台机器只会有其一;
+// 真实值以 desktop 报上来的 docker:app-status.port 为准(DockerCard 拿到后写进 dockerAppPort)。
+let dockerAppPort = 8008;
+const dockerAppUrl = () => `http://127.0.0.1:${dockerAppPort}`;
 function isDockerApp(baseUrl) {
   try {
     if (window.cicy?.platform !== "win32") return false; // docker-版只在 Windows
     const p = new URL(baseUrl);
     const local = p.hostname === "127.0.0.1" || p.hostname === "localhost" || p.hostname === "::1";
-    return local && p.port === "8008";
+    return local && (p.port === "8008" || p.port === "8009");
   } catch { return false; }
 }