cicy-desktop 2.1.57 → 2.1.58

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cicy-desktop",
-  "version": "2.1.57",
+  "version": "2.1.58",
   "description": "CiCy - AI-powered operating system browser",
   "main": "src/main.js",
   "bin": {

package/src/backends/webview-preload.js

@@ -32,11 +32,9 @@ const relay = (type, payload) =>
 // install cicy-code on the user's machine, so we mirror the same bridge
 // here. Same channel as homepage-preload's "rpc" → the existing tool
 // registry dispatches without any further wiring.
-contextBridge.exposeInMainWorld("electronRPC", (tool, args) =>
-  ipcRenderer.invoke("rpc", tool, args || {}),
-);
+const electronRPC = (tool, args) => ipcRenderer.invoke("rpc", tool, args || {});
 
-contextBridge.exposeInMainWorld("cicy", {
+const cicyApi = {
   platform: process.platform,
   arch: process.arch,
   localTeams: {
@@ -48,6 +46,19 @@ contextBridge.exposeInMainWorld("cicy", {
   },
   // (sidecar install/checkLatest removed — cicy-code is installed via
   // `npx cicy-code` by the sidecar, no in-app downloader.)
-});
+};
 
-console.log("[webview-preload] electronRPC + cicy.localTeams ready");
+// contextBridge.exposeInMainWorld ONLY works with contextIsolation:true. createWindow
+// runs TRUSTED urls with contextIsolation:false (+ nodeIntegration:true), where
+// exposeInMainWorld throws — there the preload already shares the page's main-world
+// `window`, so attach the bridge to it directly. Untrusted urls are isolated and
+// must go through contextBridge. (process.contextIsolated tells us which world we're in.)
+if (process.contextIsolated) {
+  contextBridge.exposeInMainWorld("electronRPC", electronRPC);
+  contextBridge.exposeInMainWorld("cicy", cicyApi);
+} else {
+  window.electronRPC = electronRPC;
+  window.cicy = Object.assign(window.cicy || {}, cicyApi);
+}
+
+console.log(`[webview-preload] electronRPC + cicy.localTeams ready (isolated=${process.contextIsolated})`);

package/src/utils/window-utils.js

@@ -293,6 +293,12 @@ function createWindow(options = {}, accountIdx = 0, forceNew = false) {
       offscreen: false, // 确保不是离屏渲染
       nodeIntegration: isTrustedUrl(url),
       contextIsolation: !isTrustedUrl(url),
+      // electronRPC + window.cicy for EVERY window open_window creates — without
+      // this, untrusted (contextIsolation:true) pages had no electronRPC and the
+      // agent-desktop/agent-electron skills' `desktop_event rpc_call` failed with
+      // 'electronRPC not available'. webview-preload self-adapts to the isolation
+      // mode (contextBridge when isolated, direct window assign when not).
+      preload: path.join(__dirname, "../backends/webview-preload.js"),
       partition: `persist:sandbox-${accountIdx}`,
       // 启用剪贴板权限
       enableClipboard: true,