cicy-desktop 2.1.95 → 2.1.97

package/src/sidecar/docker.js

@@ -157,24 +157,38 @@ function headSize(url, hops = 5) {
 // Download `url`→`dest` but: SKIP if the file is already complete, RESUME if it's
 // a partial, retry with progress, fall back to `mirror`. This is the core of the
 // user's "下载了就不重复下载 / 步骤走过的不要再走".
-async function ensureDownloaded(url, dest, mirror, { emit, phase, label } = {}) {
+async function ensureDownloaded(url, dest, mirror, { emit, phase, label, freshOnIncomplete = false } = {}) {
   const expected = (await headSize(url)) || (mirror ? await headSize(mirror) : 0);
   let have = 0; try { have = fs.statSync(dest).size; } catch {}
+  // Complete file already on disk → skip (主人: 完整的 exe/镜像包就别重下了).
   if (expected > 0 && have === expected) {
     emit && emit({ phase, status: "skip", message: `${label}：已下载，跳过`, progress: 100 });
     return dest;
   }
+  // A partial left by a PREVIOUS, interrupted/restarted session can be corrupt;
+  // when freshOnIncomplete, delete it and start clean rather than range-resuming
+  // onto a possibly-bad file (主人: 下载被重启打断的残包要删掉重下). Within THIS
+  // session, retries still resume the part we wrote ourselves.
+  if (freshOnIncomplete && have > 0 && expected > 0 && have !== expected) {
+    try { fs.unlinkSync(dest); } catch {}
+    have = 0;
+    emit && emit({ phase, status: "running", message: `${label}：删除不完整的旧包，重新下载`, progress: 0 });
+  }
   const sources = mirror ? [url, mirror] : [url];
   let lastPct = -1; // throttle: chunks arrive dozens/s — only emit on whole-percent change
   const attempted = withRetry(async (attempt) => {
     const src = sources[Math.min(attempt - 1, sources.length - 1)];
+    // 断点续传 (主人): resume the partial via a Range request instead of
+    // restarting from 0 — efficient on a flaky network. The post-download size
+    // check below + loadImage's load-failure cleanup guard against a bad partial.
     await download(src, dest, {
       resume: true,
       onProgress: ({ received, total }) => {
         const pct = total ? Math.round((received / total) * 100) : 0;
         if (pct === lastPct) return;
         lastPct = pct;
-        emit && emit({ phase, status: "running", message: label, progress: pct, received, total });
+        // `url` lets the drawer show the actual source (incl. mirror fallback).
+        emit && emit({ phase, status: "running", message: label, progress: pct, received, total, url: src });
       },
     });
     if (expected > 0) {
@@ -226,14 +240,40 @@ function probeHealth(port = 8008, timeoutMs = 2500) {
   });
 }
 
-async function loadImage({ emit } = {}) {
-  // STABLE temp name (no pid) so a re-run reuses an existing partial/complete
-  // tarball instead of starting over.
-  const tmp = path.join(os.tmpdir(), "cicy-code-latest.tar.gz");
-  await ensureDownloaded(R2_TARBALL, tmp, null, { emit, phase: "image", label: "下载镜像" });
+// The R2 image tarball downloads to ~/Downloads (主人: docker image 下到
+// ~/Downloads — visible, like the Docker installer on the Desktop). STABLE name
+// (no pid) so a re-run reuses an existing partial/complete file (resume-friendly
+// on a flaky network).
+function imageTarballPath() {
+  const dir = path.join(process.env["USERPROFILE"] || os.homedir(), "Downloads");
+  try { fs.mkdirSync(dir, { recursive: true }); } catch {}
+  return path.join(dir, "cicy-code-latest.tar.gz");
+}
+
+// Download the R2 base-env image tarball (no docker needed yet). Split out of
+// loadImage so bootstrap can run this IN PARALLEL with the Docker Desktop
+// install (主人: 装 Docker 的同时下载 R2 镜像). Returns the tarball path.
+async function downloadImageTarball({ emit } = {}) {
+  const dest = imageTarballPath();
+  await ensureDownloaded(R2_TARBALL, dest, null, { emit, phase: "image", label: "下载镜像" });
+  return dest;
+}
+
+// `docker load` an already-downloaded tarball + re-tag to IMAGE. Needs the
+// daemon up, so this runs AFTER Docker is ready (主人: 再导入 docker).
+async function loadImageFromTarball(tmp, { emit } = {}) {
   emit && emit({ phase: "image", status: "running", message: "docker load…", progress: 100 });
   console.log(`[docker-sidecar] docker load…`);
-  const { stdout } = await run(["load", "-i", tmp], { timeout: 300000 });
+  let stdout;
+  try {
+    ({ stdout } = await run(["load", "-i", tmp], { timeout: 300000 }));
+  } catch (e) {
+    // A resumed download can leave a byte-correct-size but corrupt tarball that
+    // `docker load` rejects. Delete it so the next attempt re-downloads fresh
+    // (断点续传 normally, fresh only when proven bad).
+    try { fs.unlinkSync(tmp); } catch {}
+    throw e;
+  }
   // The tarball's embedded tag may be a pinned version (e.g. :2.1.6) while we
   // run IMAGE (:latest). Re-tag whatever was loaded so imagePresent()/start()
   // match — otherwise every start() re-downloads the tarball forever.
@@ -242,9 +282,23 @@ async function loadImage({ emit } = {}) {
     try { await run(["tag", m[1], IMAGE]); console.log(`[docker-sidecar] tagged ${m[1]} -> ${IMAGE}`); }
     catch (e) { console.warn(`[docker-sidecar] re-tag failed: ${e.message}`); }
   }
-  // Only delete AFTER a successful load — a failed load keeps the tarball so the
-  // next attempt skips the re-download. (imagePresent() gates re-entry anyway.)
-  try { fs.unlinkSync(tmp); } catch {}
+  // Keep the tarball in ~/Downloads (主人: 下到 Downloads) — it's a visible,
+  // resume-friendly cache; imagePresent() gates re-entry so we don't re-load it.
+}
+
+// Download-then-import in one shot (sequential). Used when Docker is already up.
+async function loadImage({ emit } = {}) {
+  const tmp = await downloadImageTarball({ emit });
+  await loadImageFromTarball(tmp, { emit });
+}
+
+// `docker restart` / graceful `docker stop` for a given container — the Docker-版
+// card's ⋯ menu (重启 / 停止), mirroring the 8008 local card's lifecycle menu.
+async function restart({ container = CONTAINER } = {}) {
+  await run(["restart", container], { timeout: 60000 });
+}
+async function stopContainer({ container = CONTAINER } = {}) {
+  try { await run(["stop", container], { timeout: 30000 }); } catch {}
 }
 
 async function checkStatus() {
@@ -264,7 +318,7 @@ function desktopDir() {
 // Docker Desktop). `container`/`volume` are parameterized so a SECOND instance
 // (the Docker-版 cicy-code on :8009) can run alongside the native local one
 // without a name/volume collision.
-async function start({ port = 8008, container = CONTAINER, volume = VOLUME } = {}) {
+async function start({ port = 8008, container = CONTAINER, volume = VOLUME, mountTarget = "/home/cicy/cicy-ai", env = {} } = {}) {
   // Something already serves a healthy cicy-code on :port (a legacy-named
   // container auto-revived by `--restart unless-stopped`, a manual run…).
   // Adopt it — `docker run` would just lose the port-bind fight.
@@ -283,14 +337,23 @@ async function start({ port = 8008, container = CONTAINER, volume = VOLUME } = {
   // Replace any stale container of the same name.
   try { await run(["rm", "-f", container]); } catch {}
 
+  // mountTarget defaults to /home/cicy/cicy-ai (legacy local-team layout); the
+  // Docker-版 instance passes /home/cicy to persist the WHOLE cicy home (主人:
+  // "把整个 docker 挂出来" — everything mutable lives under /home/cicy: global.json,
+  // db, agents, files, the npm-installed cicy-code itself).
   const args = [
     "run", "-d", "--name", container, "--restart", "unless-stopped",
     "-p", `${port}:8008`,
-    "-v", `${volume}:/home/cicy/cicy-ai`,
+    "-v", `${volume}:${mountTarget}`,
   ];
   for (const k of PASS_ENV) {
     if (process.env[k]) args.push("-e", `${k}=${process.env[k]}`);
   }
+  // Caller-supplied env (e.g. the LLM gateway endpoint + key for the Docker-版
+  // instance, which bills through the 8008 local team's token).
+  for (const [k, v] of Object.entries(env || {})) {
+    if (v != null && v !== "") args.push("-e", `${k}=${v}`);
+  }
   args.push(IMAGE);
 
   const { stdout } = await run(args, { timeout: 60000 });
@@ -333,16 +396,22 @@ async function installDocker({ emit, dest } = {}) {
 // start the container → wait for :8008. Every step CHECKS first and SKIPS if
 // already done, emits coarse phase events + byte progress, and the downloads
 // resume. Safe to call again after a failure — it picks up where it left off.
-async function bootstrap({ onProgress, port = 8008, container = CONTAINER, volume = VOLUME, installDest } = {}) {
+async function bootstrap({ onProgress, port = 8008, container = CONTAINER, volume = VOLUME, mountTarget, env, installDest } = {}) {
   const emit = (ev) => { try { onProgress && onProgress(ev); } catch {} };
 
+  // Decide up-front whether the base image needs fetching, so we can download
+  // the R2 tarball IN PARALLEL with the Docker Desktop install below.
+  const needImage = !(await imagePresent());
+  let imgDl = null; // Promise<tarballPath|null> when downloading in parallel
+
   // 1) Docker present?
   if (await dockerOk()) {
     emit({ phase: "install-docker", status: "skip", message: "Docker 已安装，跳过" });
   } else if (dockerDesktopExe()) {
     // Installed but the daemon is down — just launch Docker Desktop, never
-    // re-download/re-run the installer ("步骤走过的不要再走").
+    // re-download/re-run the installer (主人: 装了就别再下 Docker Desktop 了).
     emit({ phase: "install-docker", status: "running", message: "Docker 已安装，正在启动 Docker Desktop…" });
+    if (needImage) imgDl = downloadImageTarball({ emit }).catch((e) => { emit({ phase: "image", status: "error", message: `镜像下载失败：${e.message}` }); return null; });
     startDockerDesktop();
     const up = await waitUntil(dockerOk, { totalMs: 300000, everyMs: 5000 });
     if (!up) {
@@ -351,6 +420,9 @@ async function bootstrap({ onProgress, port = 8008, container = CONTAINER, volum
     }
     emit({ phase: "install-docker", status: "done", message: "Docker 就绪" });
   } else {
+    // Docker missing → download the R2 image IN PARALLEL with the installer
+    // running + the daemon coming up (主人: 装 Docker 的同时下载 R2 镜像).
+    if (needImage) imgDl = downloadImageTarball({ emit }).catch((e) => { emit({ phase: "image", status: "error", message: `镜像下载失败：${e.message}` }); return null; });
     await installDocker({ emit, dest: installDest });
     emit({ phase: "install-docker", status: "running", message: "等待 Docker 启动（如需授权/重启，完成后会自动继续）…" });
     const up = await waitUntil(dockerOk, { totalMs: 900000, everyMs: 6000 });
@@ -361,12 +433,16 @@ async function bootstrap({ onProgress, port = 8008, container = CONTAINER, volum
     emit({ phase: "install-docker", status: "done", message: "Docker 就绪" });
   }
 
-  // 2) Base image present?
-  if (await imagePresent()) {
+  // 2) Base image — import it (docker load). If pre-downloaded in parallel, just
+  // load; otherwise (re)download now. Downloads resume/skip + delete bad partials.
+  if (!needImage) {
     emit({ phase: "image", status: "skip", message: "镜像已就绪，跳过" });
   } else {
     try {
-      await loadImage({ emit });
+      let tmp = imgDl ? await imgDl : null;
+      if (!tmp) tmp = await downloadImageTarball({ emit }); // not pre-dl'd / parallel dl failed → fetch now
+      emit({ phase: "image", status: "running", message: "导入 Docker 镜像…", progress: 100 });
+      await loadImageFromTarball(tmp, { emit });
       emit({ phase: "image", status: "done", message: "镜像就绪" });
     } catch (e) {
       emit({ phase: "image", status: "error", message: `镜像加载失败：${e.message}（点重试,下载会续传）` });
@@ -381,7 +457,7 @@ async function bootstrap({ onProgress, port = 8008, container = CONTAINER, volum
   } else {
     emit({ phase: "container", status: "running", message: "启动 cicy-code 容器…" });
     let child = null;
-    try { child = await start({ port, container, volume }); }
+    try { child = await start({ port, container, volume, mountTarget, env }); }
     catch (e) { emit({ phase: "container", status: "error", message: `容器启动失败：${e.message}` }); return { ok: false, reason: "container_start_failed" }; }
     if (!child) {
       emit({ phase: "container", status: "error", message: "容器启动失败" });
@@ -397,7 +473,8 @@ async function bootstrap({ onProgress, port = 8008, container = CONTAINER, volum
 }
 
 module.exports = {
-  start, stop, checkStatus, loadImage, imagePresent, dockerOk, installDocker,
+  start, stop, stopContainer, restart, checkStatus, loadImage, loadImageFromTarball,
+  downloadImageTarball, imagePresent, dockerOk, installDocker,
   bootstrap, probeHealth, readContainerToken, dockerDesktopExe, desktopDir,
   // platform-agnostic download/retry primitives, reused by native.js
   ensureDownloaded, withRetry, waitUntil, run,

package/workers/render/src/App.css

@@ -213,6 +213,13 @@ body {
 .user-chip__menu-item.is-danger { color: #f7a3a3; }
 .user-chip__menu-item.is-danger:hover { background: rgba(239,68,68,.16); color: #fff; }
 .user-chip__menu-sep { height: 1px; margin: 4px 2px; background: rgba(255,255,255,.08); }
+/* cicy-desktop version — bottom of the avatar dropdown (主人) */
+.user-chip__menu-version {
+  margin-top: 4px; padding: 8px 11px 4px;
+  font-size: 11px; color: #6b7280; text-align: center;
+  font-variant-numeric: tabular-nums; user-select: text;
+  border-top: 1px solid rgba(255,255,255,.06);
+}
 /* HTTPS audit tip, rendered as a flat menu row with an on/off switch */
 .user-chip__mitm-row {
   display: flex; align-items: center; justify-content: space-between; gap: 10px;
@@ -969,6 +976,34 @@ body {
   background: rgba(10, 12, 16, 0.7); border: 1px solid rgba(125, 135, 150, 0.12); border-radius: 10px;
   font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; font-size: 11.5px; line-height: 1.7;
 }
+/* Custom thin scrollbar for the install log (主人: scroll 用自定义 style) */
+.drawer__log--scroll { max-height: 168px; scrollbar-width: thin; scrollbar-color: rgba(125,135,150,.4) transparent; }
+.drawer__log--scroll::-webkit-scrollbar { width: 7px; }
+.drawer__log--scroll::-webkit-scrollbar-track { background: transparent; margin: 4px 0; }
+.drawer__log--scroll::-webkit-scrollbar-thumb { background: rgba(125,135,150,.32); border-radius: 6px; border: 1.5px solid transparent; background-clip: padding-box; }
+.drawer__log--scroll::-webkit-scrollbar-thumb:hover { background: rgba(125,135,150,.55); background-clip: padding-box; }
+
+/* Fixed download progress bars (Docker Desktop / 基础镜像) — no scroll spam */
+.drawer__dlbars { display: flex; flex-direction: column; gap: 10px; margin: 12px 14px 2px; }
+.dlbar {
+  padding: 10px 12px; border-radius: 10px;
+  background: rgba(10, 12, 16, 0.55); border: 1px solid rgba(125, 135, 150, 0.14);
+}
+.dlbar__head { display: flex; align-items: baseline; justify-content: space-between; gap: 10px; margin-bottom: 7px; }
+.dlbar__name { font-size: 12.5px; font-weight: 600; color: var(--text, #e6eaf0); }
+.dlbar__pct { font-size: 11px; color: var(--text-dim, #9da7b3); font-variant-numeric: tabular-nums; }
+.dlbar__track { height: 6px; border-radius: 4px; background: rgba(125, 135, 150, 0.16); overflow: hidden; }
+.dlbar__fill {
+  height: 100%; border-radius: 4px;
+  background: linear-gradient(90deg, #5b8df7, #2496ed);
+  transition: width .2s ease;
+}
+.dlbar__fill.is-done { background: #4ade80; }
+.dlbar__url {
+  margin-top: 7px; font-size: 10.5px; color: #6b7686;
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  white-space: nowrap; overflow: hidden; text-overflow: ellipsis;
+}
 .drawer__log-empty { color: var(--text-dim, #9da7b3); }
 .drawer__line { display: flex; align-items: baseline; gap: 8px; padding: 1px 0; }
 .drawer__t { color: #6b7686; flex: none; font-variant-numeric: tabular-nums; }

package/workers/render/src/App.jsx

@@ -189,7 +189,6 @@ function UpdateDrawerHost() {
           {running ? (
             <>
               <span className="drawer__foot-status">更新进行中…</span>
-              <button type="button" className="drawer__btn" data-id="UpdateDrawer-background" onClick={() => updateDrawer.close()}>在后台继续</button>
             </>
           ) : st.status === "error" ? (
             <>
@@ -1022,7 +1021,14 @@ function Header({ me, welcome, onLogout, mitmTeam }) {
   const [trustOpen, setTrustOpen] = useState(false);
   const [auditOpen, setAuditOpen] = useState(false);
   const [termsOpen, setTermsOpen] = useState(false);
+  const [appVer, setAppVer] = useState("");
   const wrap = useRef(null);
+  // cicy-desktop's own version, shown at the very bottom of this menu (主人).
+  useEffect(() => {
+    let alive = true;
+    window.cicy?.app?.getVersion?.().then((v) => { if (alive) setAppVer(String(v || "")); }).catch(() => {});
+    return () => { alive = false; };
+  }, []);
   // Click-outside closes the dropdown (mirrors LocalTeamCard's ⋯ menu).
   useEffect(() => {
     if (!open) return;
@@ -1077,6 +1083,9 @@ function Header({ me, welcome, onLogout, mitmTeam }) {
             <button type="button" data-id="UserChip-logout" className="user-chip__menu-item is-danger" onClick={() => { setOpen(false); onLogout(); }}>
               退出
             </button>
+            <div className="user-chip__menu-version" data-id="UserChip-version">
+              CiCy Desktop {appVer ? `v${appVer}` : "…"}
+            </div>
           </div>
         )}
       </div>
@@ -1435,14 +1444,30 @@ let dockerDrawerState = null; // null = closed
 function emitDockerDrawer() { dockerDrawerListeners.forEach((l) => l(dockerDrawerState)); }
 const dockerDrawer = {
   open({ onRetry } = {}) {
-    dockerDrawerState = { status: "running", phase: "install-docker", logs: [], onRetry: onRetry || null, lastAt: Date.now() };
+    dockerDrawerState = { status: "running", phase: "install-docker", logs: [], bars: {}, onRetry: onRetry || null, lastAt: Date.now() };
     emitDockerDrawer();
   },
   push(ev = {}) {
     if (!dockerDrawerState) return;
     const phase = ev.phase === "health" ? "container" : (ev.phase || dockerDrawerState.phase);
-    const line = { id: ++dockerDrawerLogSeq, t: clockHHMMSS(), phase, status: ev.status || "running", message: ev.message || "", progress: ev.progress };
-    dockerDrawerState = { ...dockerDrawerState, phase, logs: [...dockerDrawerState.logs, line], lastAt: Date.now() };
+    const next = { ...dockerDrawerState, phase, lastAt: Date.now() };
+    const hasPct = Number.isFinite(ev.progress);
+    // Per-byte download ticks (status running + a %) drive a PROGRESS BAR, not a
+    // log line — so the log doesn't scroll-spam (主人: 下载不要输出滚动/日志太多).
+    const isDownloadTick = ev.status === "running" && hasPct && (phase === "install-docker" || phase === "image");
+    if (isDownloadTick) {
+      const prev = dockerDrawerState.bars?.[phase] || {};
+      next.bars = { ...dockerDrawerState.bars, [phase]: { progress: ev.progress, received: ev.received, total: ev.total, url: ev.url || prev.url, message: ev.message || prev.message } };
+    } else {
+      // Meaningful event → one log line (phase change / skip / done / error / retry).
+      const line = { id: ++dockerDrawerLogSeq, t: clockHHMMSS(), phase, status: ev.status || "running", message: ev.message || "" };
+      next.logs = [...dockerDrawerState.logs, line];
+      if (ev.url) {
+        const prev = dockerDrawerState.bars?.[phase] || {};
+        next.bars = { ...dockerDrawerState.bars, [phase]: { ...prev, url: ev.url } };
+      }
+    }
+    dockerDrawerState = next;
     emitDockerDrawer();
   },
   finish({ ok, message } = {}) {
@@ -1456,6 +1481,30 @@ const dockerDrawer = {
 };
 const DOCKER_PHASES = [["install-docker", "装 Docker"], ["image", "加载镜像"], ["container", "启动容器"], ["done", "完成"]];
 const DOCKER_BADGE = { "install-docker": "Docker", image: "镜像", container: "容器", health: "容器", done: "完成" };
+const DOCKER_DL_LABEL = { "install-docker": "Docker Desktop", image: "基础镜像" };
+function fmtBytes(n) {
+  if (!Number.isFinite(n)) return "?";
+  if (n < 1024) return n + " B";
+  if (n < 1048576) return (n / 1024).toFixed(0) + " KB";
+  if (n < 1073741824) return (n / 1048576).toFixed(1) + " MB";
+  return (n / 1073741824).toFixed(2) + " GB";
+}
+// One fixed (non-scrolling) progress bar per download (Docker Desktop / image),
+// showing the source URL + % + bytes (主人: 下载做进度条、显示地址、不要滚动).
+function DownloadBar({ phaseKey, bar }) {
+  const pct = Number.isFinite(bar?.progress) ? Math.max(0, Math.min(100, bar.progress)) : 0;
+  const done = pct >= 100;
+  return (
+    <div className="dlbar" data-id={`DockerDrawer-dlbar-${phaseKey}`}>
+      <div className="dlbar__head">
+        <span className="dlbar__name">{DOCKER_DL_LABEL[phaseKey] || phaseKey}</span>
+        <span className="dlbar__pct">{pct}%{bar?.total ? ` · ${fmtBytes(bar.received)} / ${fmtBytes(bar.total)}` : ""}</span>
+      </div>
+      <div className="dlbar__track"><div className={`dlbar__fill${done ? " is-done" : ""}`} style={{ width: `${pct}%` }} /></div>
+      {bar?.url && <div className="dlbar__url" title={bar.url}>{bar.url}</div>}
+    </div>
+  );
+}
 function DockerInstallDrawerHost() {
   const [st, setSt] = useState(dockerDrawerState);
   useEffect(() => { dockerDrawerListeners.add(setSt); return () => { dockerDrawerListeners.delete(setSt); }; }, []);
@@ -1464,6 +1513,7 @@ function DockerInstallDrawerHost() {
   if (!st) return null;
   const running = st.status === "running";
   const phaseIdx = DOCKER_PHASES.findIndex(([k]) => k === st.phase);
+  const dlBars = ["install-docker", "image"].filter((k) => st.bars?.[k]);
   return (
     <div className="drawer-scrim" data-id="DockerDrawer-scrim" onClick={() => { if (!running) dockerDrawer.close(); }}>
       <div className="drawer" data-id="DockerDrawer" data-status={st.status} onClick={(e) => e.stopPropagation()}>
@@ -1495,14 +1545,20 @@ function DockerInstallDrawerHost() {
           })}
         </div>
 
-        <div className="drawer__log" data-id="DockerDrawer-log" ref={logRef}>
+        {dlBars.length > 0 && (
+          <div className="drawer__dlbars" data-id="DockerDrawer-dlbars">
+            {dlBars.map((k) => <DownloadBar key={k} phaseKey={k} bar={st.bars[k]} />)}
+          </div>
+        )}
+
+        <div className="drawer__log drawer__log--scroll" data-id="DockerDrawer-log" ref={logRef}>
           {st.logs.length === 0
             ? <div className="drawer__log-empty">{tr("docker.preparing", "准备中…")}</div>
             : st.logs.map((l) => (
               <div key={l.id} className="drawer__line" data-status={l.status}>
                 <span className="drawer__t">{l.t}</span>
                 <span className={`drawer__badge drawer__badge--${l.phase}`}>{DOCKER_BADGE[l.phase] || l.phase}</span>
-                <span className="drawer__linemsg">{l.message}{Number.isFinite(l.progress) ? ` ${l.progress}%` : ""}</span>
+                <span className="drawer__linemsg">{l.message}</span>
               </div>
             ))}
         </div>
@@ -1511,7 +1567,6 @@ function DockerInstallDrawerHost() {
           {running ? (
             <>
               <span className="drawer__foot-status">{tr("docker.installing2", "安装进行中…")}</span>
-              <button type="button" className="drawer__btn" data-id="DockerDrawer-background" onClick={() => dockerDrawer.close()}>{tr("docker.background", "在后台继续")}</button>
             </>
           ) : st.status === "error" ? (
             <>
@@ -1537,7 +1592,12 @@ function DockerInstallDrawerHost() {
 // Desktop and runs it (主人指令), streaming progress through the drawer above.
 function DockerCard({ dockerTeam, onOpen, onRefresh }) {
   const [status, setStatus] = useState(null);
-  const [busy, setBusy] = useState(false);
+  const [busy, setBusy] = useState("");   // "" | bootstrap | restart | stop | upgrade
+  const [menuOpen, setMenuOpen] = useState(false);
+  const [menuPos, setMenuPos] = useState({ top: 0, left: 0 });
+  const kebabRef = useRef(null);
+  const menuRef = useRef(null);
+  const MENU_W = 184;
   const DOCKER_BLUE = "#2496ed";
 
   const checkStatus = useCallback(async () => {
@@ -1547,8 +1607,31 @@ function DockerCard({ dockerTeam, onOpen, onRefresh }) {
 
   useEffect(() => { checkStatus(); }, [checkStatus]);
 
+  // Close the ⋯ menu on outside-click / Esc (mirrors LocalTeamCard).
+  useEffect(() => {
+    if (!menuOpen) return;
+    const onDoc = (e) => {
+      if (kebabRef.current?.contains(e.target) || menuRef.current?.contains(e.target)) return;
+      setMenuOpen(false);
+    };
+    const onKey = (e) => { if (e.key === "Escape") setMenuOpen(false); };
+    document.addEventListener("mousedown", onDoc);
+    document.addEventListener("keydown", onKey);
+    return () => { document.removeEventListener("mousedown", onDoc); document.removeEventListener("keydown", onKey); };
+  }, [menuOpen]);
+
+  const toggleMenu = () => {
+    if (!menuOpen && kebabRef.current) {
+      const r = kebabRef.current.getBoundingClientRect();
+      const left = Math.max(8, Math.min(r.right - MENU_W, window.innerWidth - MENU_W - 8));
+      setMenuPos({ top: Math.round(r.bottom + 4), left: Math.round(left) });
+    }
+    setMenuOpen((v) => !v);
+  };
+
+  // Install / start: streams through the drawer modal (logs + progress + retry).
   const runBootstrap = useCallback(async () => {
-    setBusy(true);
+    setBusy("bootstrap");
     dockerDrawer.open({ onRetry: runBootstrap });
     const unsub = window.cicy?.docker?.onAppProgress?.((ev) => dockerDrawer.push(ev));
     try {
@@ -1559,11 +1642,41 @@ function DockerCard({ dockerTeam, onOpen, onRefresh }) {
       dockerDrawer.finish({ ok: false, message: e.message });
     } finally {
       try { unsub && unsub(); } catch {}
-      setBusy(false);
-      checkStatus();
+      setBusy(""); checkStatus();
     }
   }, [checkStatus, onRefresh]);
 
+  // Upgrade: re-pull the R2 image + recreate the container — also through the
+  // drawer so the user sees the pull/import/restart log (主人: 升级要能看日志).
+  const runUpgrade = useCallback(async () => {
+    setMenuOpen(false); setBusy("upgrade");
+    dockerDrawer.open({ onRetry: runUpgrade });
+    const unsub = window.cicy?.docker?.onAppProgress?.((ev) => dockerDrawer.push(ev));
+    try {
+      const r = await window.cicy?.docker?.appUpgrade?.();
+      dockerDrawer.finish({ ok: !!r?.ok, message: r?.ok ? tr("docker.upgraded", "已升级到最新") : (r?.error || tr("docker.upgradeFailed", "升级失败")) });
+      if (r?.ok) onRefresh?.();
+    } catch (e) {
+      dockerDrawer.finish({ ok: false, message: e.message });
+    } finally {
+      try { unsub && unsub(); } catch {}
+      setBusy(""); checkStatus();
+    }
+  }, [checkStatus, onRefresh]);
+
+  // Restart / stop: quick lifecycle ops with a toast (no full drawer needed).
+  const runOp = useCallback(async (op, fn, okMsg) => {
+    setMenuOpen(false); setBusy(op);
+    toast.show({ id: "docker-op", message: tr(`docker.${op}ing`, op === "restart" ? "重启中…" : "停止中…"), status: "running" });
+    try {
+      const r = await fn();
+      if (r?.ok) toast.show({ id: "docker-op", message: okMsg, status: "done", ttl: 2500 });
+      else toast.show({ id: "docker-op", message: (r?.error || tr("docker.opFailed", "操作失败")), status: "error", ttl: 6000 });
+    } catch (e) {
+      toast.show({ id: "docker-op", message: e.message, status: "error", ttl: 6000 });
+    } finally { setBusy(""); checkStatus(); }
+  }, [checkStatus]);
+
   // Render only on Windows. window.cicy.platform is sync, so we can decide
   // immediately without waiting on the async appStatus probe.
   const platform = window.cicy?.platform || status?.platform;
@@ -1572,13 +1685,14 @@ function DockerCard({ dockerTeam, onOpen, onRefresh }) {
   const running = !!status?.running || dockerTeam?.status === "running";
   const installed = !!status?.installed;
   const tone = running ? "ok" : installed ? "warn" : "off";
+  const isBusy = !!busy;
   const stateText = running
     ? tr("docker.running", "运行中 · :8009")
     : installed
       ? tr("docker.notRunning", "未启动 · 点「启动」")
       : tr("docker.notInstalled", "Docker Desktop 未安装");
 
-  const ctaLabel = busy
+  const ctaLabel = isBusy
     ? tr("docker.working", "处理中…")
     : running
       ? tr("localTeams.open", "打开")
@@ -1587,11 +1701,14 @@ function DockerCard({ dockerTeam, onOpen, onRefresh }) {
         : tr("docker.install", "下载安装");
 
   const onCta = () => {
-    if (busy) return;
+    if (isBusy) return;
     if (running) { onOpen?.(dockerTeam?.id); return; }
     runBootstrap();
   };
 
+  // The ⋯ menu (重启 / 停止 / 升级) is only meaningful once Docker is installed.
+  const showMenu = installed;
+
   return (
     <div data-id="DockerCard" className={`bcard bcard--docker${running ? " bcard--online" : ""}`}>
       <div className="bcard__accent" style={{ background: DOCKER_BLUE }} />
@@ -1602,6 +1719,44 @@ function DockerCard({ dockerTeam, onOpen, onRefresh }) {
             <path d="M21.81 10.25c-.06-.05-.67-.51-1.95-.51-.34 0-.68.03-1.01.09-.25-1.69-1.64-2.51-1.7-2.55l-.34-.2-.22.32a4.5 4.5 0 0 0-.59 1.4c-.23.94-.09 1.83.39 2.59-.58.32-1.51.4-1.7.41H2.62a.61.61 0 0 0-.61.61 9.32 9.32 0 0 0 .57 3.35 4.9 4.9 0 0 0 1.95 2.53c.92.52 2.42.82 4.12.82.77 0 1.54-.07 2.3-.21a9.6 9.6 0 0 0 3-1.09 8.3 8.3 0 0 0 2.05-1.68c.98-1.11 1.56-2.35 1.99-3.45h.17c1.36 0 2.2-.55 2.66-1l.13-.16zM4.7 11.33h1.78a.16.16 0 0 0 .16-.16V9.58a.16.16 0 0 0-.16-.16H4.7a.16.16 0 0 0-.16.16v1.59c0 .09.07.16.16.16m2.46 0h1.78a.16.16 0 0 0 .16-.16V9.58a.16.16 0 0 0-.16-.16H7.16a.16.16 0 0 0-.16.16v1.59c0 .09.07.16.16.16m2.5 0h1.78a.16.16 0 0 0 .16-.16V9.58a.16.16 0 0 0-.16-.16H9.66a.16.16 0 0 0-.16.16v1.59c0 .09.07.16.16.16m2.47 0h1.78a.16.16 0 0 0 .16-.16V9.58a.16.16 0 0 0-.16-.16h-1.78a.16.16 0 0 0-.16.16v1.59c0 .09.07.16.16.16M7.16 9.06h1.78a.16.16 0 0 0 .16-.16V7.31a.16.16 0 0 0-.16-.16H7.16a.16.16 0 0 0-.16.16v1.59c0 .09.07.16.16.16m2.5 0h1.78a.16.16 0 0 0 .16-.16V7.31a.16.16 0 0 0-.16-.16H9.66a.16.16 0 0 0-.16.16v1.59c0 .09.07.16.16.16m2.47 0h1.78a.16.16 0 0 0 .16-.16V7.31a.16.16 0 0 0-.16-.16h-1.78a.16.16 0 0 0-.16.16v1.59c0 .09.07.16.16.16" />
           </svg>
         </div>
+        {showMenu && (
+          <div className="bcard__menuwrap" onClick={(e) => e.stopPropagation()}>
+            <button
+              type="button"
+              ref={kebabRef}
+              data-id="DockerCard-menu-btn"
+              className="bcard__kebab"
+              title={tr("docker.manage", "管理 Docker cicy-code")}
+              disabled={isBusy}
+              onClick={toggleMenu}
+            >
+              {isBusy ? <Spinner /> : <KebabIcon />}
+            </button>
+            {menuOpen && createPortal(
+              <div className="bcard__menu bcard__menu--portal" data-id="DockerCard-menu" role="menu"
+                ref={menuRef}
+                style={{ position: "fixed", top: menuPos.top, left: menuPos.left, width: MENU_W }}
+                onClick={(e) => e.stopPropagation()}>
+                {running && (
+                  <button type="button" data-id="DockerCard-restart" className="bcard__menu-item"
+                    onClick={() => runOp("restart", () => window.cicy.docker.appRestart(), tr("docker.restarted", "已重启"))}>
+                    {tr("docker.restart", "重启")}
+                  </button>
+                )}
+                <button type="button" data-id="DockerCard-upgrade" className="bcard__menu-item is-accent" onClick={runUpgrade}>
+                  {tr("docker.upgrade", "升级（拉取最新镜像）")}
+                </button>
+                {running && (
+                  <button type="button" data-id="DockerCard-stop" className="bcard__menu-item is-danger"
+                    onClick={() => runOp("stop", () => window.cicy.docker.appStop(), tr("docker.stopped", "已停止"))}>
+                    {tr("docker.stop", "停止")}
+                  </button>
+                )}
+              </div>,
+              document.body
+            )}
+          </div>
+        )}
       </div>
       <div className="bcard__body">
         <h3 className="bcard__name">{tr("docker.title", "Docker cicy-code")}</h3>
@@ -1612,11 +1767,11 @@ function DockerCard({ dockerTeam, onOpen, onRefresh }) {
         type="button"
         className="bcard__cta"
         data-id="DockerCard-cta"
-        disabled={busy}
+        disabled={isBusy}
         onClick={onCta}
         style={!running ? { background: DOCKER_BLUE, color: "white" } : undefined}
       >
-        {busy ? <Spinner /> : <ArrowIcon />}
+        {isBusy ? <Spinner /> : <ArrowIcon />}
         <span>{ctaLabel}</span>
       </button>
     </div>