miawrouter 1.2.3 → 1.2.4

package/cli.js

@@ -676,12 +676,22 @@ function startServer(updatePromise) {
   }
 
   let server = spawnServer();
+  const bridgeRuntime = require("./hooks/opencodeBridgeRuntime");
+  const bridge = bridgeRuntime.startOpenCodeBridge();
+  if (bridge) Promise.all([waitServerReady(port), waitServerReady(20129)]).then(async ([routerReady, bridgeReady]) => {
+    if (!routerReady || !bridgeReady) return;
+    for (let attempt = 0; attempt < 10 && bridge.exitCode === null && !bridge.killed; attempt++) {
+      if (bridgeRuntime.registerOpenCodeBridge()) return;
+      await new Promise((resolve) => setTimeout(resolve, 1000));
+    }
+  });
 
   // Cleanup function - force kill server process
   let isCleaningUp = false;
   function cleanup() {
     if (isCleaningUp) return;
     isCleaningUp = true;
+    if (bridge && !bridge.killed) bridge.kill();
     try {
       // Kill tray if running
       try {

package/hooks/opencodeBridgeRuntime.js

@@ -0,0 +1,77 @@
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const { spawn, spawnSync } = require("child_process");
+const crypto = require("crypto");
+
+function registerOpenCodeBridge() {
+  const dataDir = process.env.DATA_DIR || (process.platform === "win32"
+    ? path.join(process.env.APPDATA || os.homedir(), "miawrouter")
+    : path.join(os.homedir(), ".miawrouter"));
+  const dbPath = path.join(dataDir, "db", "data.sqlite");
+  if (!fs.existsSync(dbPath)) return false;
+  let db;
+  try {
+    try {
+      const { DatabaseSync } = require("node:sqlite");
+      db = new DatabaseSync(dbPath);
+    } catch {
+      const BetterSqlite = require(path.join(dataDir, "runtime", "node_modules", "better-sqlite3"));
+      db = new BetterSqlite(dbPath);
+    }
+    db.exec("PRAGMA busy_timeout=5000; BEGIN IMMEDIATE");
+    const nodes = db.prepare("SELECT data FROM providerNodes").all();
+    if (nodes.some((row) => { try { return JSON.parse(row.data).prefix === "ocbridge"; } catch { return false; } })) {
+      db.exec("COMMIT");
+      return true;
+    }
+    const now = new Date().toISOString();
+    const id = `openai-compatible-chat-${crypto.randomUUID()}`;
+    const config = { prefix: "ocbridge", apiType: "chat", baseUrl: "http://127.0.0.1:20129/v1" };
+    db.prepare("INSERT INTO providerNodes(id,type,name,data,createdAt,updatedAt) VALUES(?,?,?,?,?,?)")
+      .run(id, "openai-compatible", "OpenCode Free Bridge", JSON.stringify(config), now, now);
+    const data = { apiKey: "public", testStatus: "unknown", providerSpecificData: { ...config, nodeName: "OpenCode Free Bridge", connectionProxyEnabled: false, connectionProxyUrl: "", connectionNoProxy: "" } };
+    db.prepare("INSERT INTO providerConnections(id,provider,authType,name,priority,isActive,data,createdAt,updatedAt) VALUES(?,?,?,?,?,?,?,?,?)")
+      .run(crypto.randomUUID(), id, "apikey", "OpenCode Free Bridge", 1, 1, JSON.stringify(data), now, now);
+    db.exec("COMMIT");
+    return true;
+  } catch (error) {
+    try { db?.exec("ROLLBACK"); } catch {}
+    console.warn(`OpenCode Free Bridge setup failed: ${error.message}`);
+    return false;
+  } finally {
+    db?.close();
+  }
+}
+
+function startOpenCodeBridge({ log = console } = {}) {
+  if (process.env.MIAW_OPENCODE_BRIDGE === "0") return null;
+  const sourceDir = path.join(__dirname, "..", "vendor", "opencode-free-bridge");
+  const script = path.join(sourceDir, "server.js");
+  if (!fs.existsSync(script)) {
+    log.warn("OpenCode Free Bridge is missing from this installation.");
+    return null;
+  }
+  const homeBun = path.join(os.homedir(), ".bun", "bin", process.platform === "win32" ? "bun.exe" : "bun");
+  const bun = fs.existsSync(homeBun) ? homeBun : "bun";
+  const check = spawnSync(bun, ["--version"], { stdio: "ignore", windowsHide: true, timeout: 5000 });
+  if (check.status !== 0) {
+    log.warn("OpenCode Free Bridge needs Bun. Install Bun and restart Miawrouter.");
+    return null;
+  }
+
+  // Pass only runtime environment; the third-party process does not need router secrets.
+  const env = {};
+  for (const key of ["PATH", "Path", "HOME", "USERPROFILE", "APPDATA", "LOCALAPPDATA", "SYSTEMROOT", "SystemRoot", "TEMP", "TMP", "TMPDIR"]) {
+    if (process.env[key] !== undefined) env[key] = process.env[key];
+  }
+  Object.assign(env, { HOST: "127.0.0.1", PORT: "20129", AUTO_UPDATE: "0" });
+  const child = spawn(bun, [script], { cwd: sourceDir, env, stdio: ["ignore", "ignore", "pipe"], windowsHide: true });
+  child.on("error", (error) => log.warn(`OpenCode Free Bridge failed to start: ${error.message}`));
+  child.stderr.on("data", (data) => {
+    if (String(data).includes("EADDRINUSE")) log.warn("OpenCode Free Bridge port 20129 is already in use.");
+  });
+  return child;
+}
+
+module.exports = { startOpenCodeBridge, registerOpenCodeBridge };

package/hooks/sqliteRuntime.js

@@ -1,156 +1,156 @@
-// Ensure better-sqlite3 is installed in USER_DATA_DIR/runtime/node_modules
-// (user-writable, avoids Windows EBUSY locks during npm i -g updates).
-// sql.js is bundled in bin/app already; node:sqlite / bun:sqlite are built-in.
-const { execSync, spawnSync } = require("child_process");
-const fs = require("fs");
-const os = require("os");
-const path = require("path");
-
-const BETTER_SQLITE3_VERSION = "12.6.2";
-const SQL_JS_VERSION = "1.14.1";
-
-function getDataDir() {
-  if (process.env.DATA_DIR) return process.env.DATA_DIR;
-  return process.platform === "win32"
-    ? path.join(process.env.APPDATA || os.homedir(), "miawrouter")
-    : path.join(os.homedir(), ".miawrouter");
-}
-
-function getRuntimeDir() {
-  return path.join(getDataDir(), "runtime");
-}
-
-function getRuntimeNodeModules() {
-  return path.join(getRuntimeDir(), "node_modules");
-}
-
-function ensureRuntimeDir() {
-  const dir = getRuntimeDir();
-  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
-
-  // Minimal package.json so npm treats it as a project root
-  const pkgPath = path.join(dir, "package.json");
-  if (!fs.existsSync(pkgPath)) {
-    fs.writeFileSync(pkgPath, JSON.stringify({
-      name: "miawrouter-runtime",
-      version: "1.2.3",
-      private: true,
-      description: "User-writable runtime deps for miawrouter (better-sqlite3 native binary)",
-    }, null, 2));
-  }
-  return dir;
-}
-
-function hasModule(name) {
-  return fs.existsSync(path.join(getRuntimeNodeModules(), name, "package.json"));
-}
-
-function isBetterSqliteBinaryValid() {
-  const binary = path.join(getRuntimeNodeModules(), "better-sqlite3", "build", "Release", "better_sqlite3.node");
-  if (!fs.existsSync(binary)) return false;
-  try {
-    const fd = fs.openSync(binary, "r");
-    const buf = Buffer.alloc(4);
-    fs.readSync(fd, buf, 0, 4, 0);
-    fs.closeSync(fd);
-    const magic = buf.toString("hex");
-    if (process.platform === "linux") return magic.startsWith("7f454c46");
-    if (process.platform === "darwin") return magic.startsWith("cffaedfe") || magic.startsWith("cefaedfe");
-    if (process.platform === "win32") return magic.startsWith("4d5a");
-    return true;
-  } catch { return false; }
-}
-
-// Extract a short, user-friendly reason from npm stderr.
-function summarizeNpmError(stderr = "") {
-  const text = String(stderr);
-  if (/ENOTFOUND|ETIMEDOUT|EAI_AGAIN|network|getaddrinfo/i.test(text)) return "No internet connection or registry unreachable";
-  if (/EACCES|EPERM|permission denied/i.test(text)) return "Permission denied (check folder permissions)";
-  if (/ENOSPC|no space/i.test(text)) return "Not enough disk space";
-  if (/node-gyp|gyp ERR|python|MSBuild|Visual Studio|Xcode/i.test(text)) return "Missing build tools (Xcode CLT / Python / VS Build Tools)";
-  if (/ETARGET|version.*not found/i.test(text)) return "Package version not found on registry";
-  const m = text.match(/npm ERR! (.+)/);
-  if (m) return m[1].slice(0, 200);
-  const lastLine = text.trim().split(/\r?\n/).filter(Boolean).pop();
-  return lastLine ? lastLine.slice(0, 200) : "Unknown error";
-}
-
-function runNpmInstall({ cwd, pkgs, extraArgs = [], timeout = 180000 }) {
-  const args = ["install", ...pkgs, "--no-audit", "--no-fund", "--prefer-online", ...extraArgs];
-  const npmCmd = process.platform === "win32" ? "npm.cmd" : "npm";
-  const res = spawnSync(npmCmd, args, {
-    cwd,
-    stdio: ["ignore", "pipe", "pipe"],
-    timeout,
-    shell: process.platform === "win32",
-    encoding: "utf8",
-  });
-  return { ok: res.status === 0, code: res.status, stderr: res.stderr || "", stdout: res.stdout || "" };
-}
-
-function npmInstall(pkgs, opts = {}) {
-  const cwd = ensureRuntimeDir();
-  const extra = opts.optional ? ["--no-save"] : [];
-  if (!opts.silent) console.log("⏳ Installing SQLite engine (first run)...");
-  const res = runNpmInstall({ cwd, pkgs, extraArgs: extra, timeout: opts.timeout || 180000 });
-  if (!res.ok && !opts.silent) {
-    const reason = summarizeNpmError(res.stderr);
-    console.warn("⚠️  SQLite engine install failed — using fallback");
-    console.warn(`   Reason: ${reason}`);
-    console.warn(`   Retry:  cd "${cwd}" && npm install ${pkgs.join(" ")}`);
-  }
-  return res.ok;
-}
-
-// Public: ensure better-sqlite3 native module is installed in user-writable
-// runtime dir. sql.js may be bundled in bin/app, but npm publish strips .wasm
-// from nested node_modules — verify and reinstall if missing. node:sqlite is
-// built-in. This is purely a *speed optimization* — app works without
-// better-sqlite3 via fallbacks.
-function isSqlJsWasmValid() {
-  const bundledWasm = path.join(__dirname, "..", "app", "node_modules", "sql.js", "dist", "sql-wasm.wasm");
-  if (fs.existsSync(bundledWasm)) return true;
-  const runtimeWasm = path.join(getRuntimeNodeModules(), "sql.js", "dist", "sql-wasm.wasm");
-  return fs.existsSync(runtimeWasm);
-}
-
-function ensureSqliteRuntime({ silent = false } = {}) {
-  ensureRuntimeDir();
-
-  let sqlJsOk = isSqlJsWasmValid();
-  if (!sqlJsOk) {
-    sqlJsOk = npmInstall([`sql.js@${SQL_JS_VERSION}`], { silent });
-    if (sqlJsOk) sqlJsOk = isSqlJsWasmValid();
-  }
-
-  const needBetterSqlite = !hasModule("better-sqlite3") || !isBetterSqliteBinaryValid();
-  if (!needBetterSqlite) {
-    if (!silent) console.log("✅ SQLite engine ready");
-    return { betterSqlite: true, sqlJs: sqlJsOk };
-  }
-
-  const ok = npmInstall([`better-sqlite3@${BETTER_SQLITE3_VERSION}`], { optional: true, silent });
-  return {
-    betterSqlite: ok && hasModule("better-sqlite3") && isBetterSqliteBinaryValid(),
-    sqlJs: sqlJsOk,
-  };
-}
-
-// Inject runtime + bundled node_modules into NODE_PATH so child Node processes
-// resolve sql.js (bundled in bin/app/node_modules) and better-sqlite3 (runtime).
-function buildEnvWithRuntime(baseEnv = process.env) {
-  const runtimeNm = getRuntimeNodeModules();
-  const bundledNm = path.join(__dirname, "..", "app", "node_modules");
-  const existing = baseEnv.NODE_PATH || "";
-  const NODE_PATH = [runtimeNm, bundledNm, existing].filter(Boolean).join(path.delimiter);
-  return { ...baseEnv, NODE_PATH };
-}
-
-module.exports = {
-  ensureSqliteRuntime,
-  buildEnvWithRuntime,
-  getRuntimeDir,
-  getRuntimeNodeModules,
-  runNpmInstall,
-  summarizeNpmError,
-};
+// Ensure better-sqlite3 is installed in USER_DATA_DIR/runtime/node_modules
+// (user-writable, avoids Windows EBUSY locks during npm i -g updates).
+// sql.js is bundled in bin/app already; node:sqlite / bun:sqlite are built-in.
+const { execSync, spawnSync } = require("child_process");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const BETTER_SQLITE3_VERSION = "12.6.2";
+const SQL_JS_VERSION = "1.14.1";
+
+function getDataDir() {
+  if (process.env.DATA_DIR) return process.env.DATA_DIR;
+  return process.platform === "win32"
+    ? path.join(process.env.APPDATA || os.homedir(), "miawrouter")
+    : path.join(os.homedir(), ".miawrouter");
+}
+
+function getRuntimeDir() {
+  return path.join(getDataDir(), "runtime");
+}
+
+function getRuntimeNodeModules() {
+  return path.join(getRuntimeDir(), "node_modules");
+}
+
+function ensureRuntimeDir() {
+  const dir = getRuntimeDir();
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+
+  // Minimal package.json so npm treats it as a project root
+  const pkgPath = path.join(dir, "package.json");
+  if (!fs.existsSync(pkgPath)) {
+    fs.writeFileSync(pkgPath, JSON.stringify({
+      name: "miawrouter-runtime",
+      version: "1.2.4",
+      private: true,
+      description: "User-writable runtime deps for miawrouter (better-sqlite3 native binary)",
+    }, null, 2));
+  }
+  return dir;
+}
+
+function hasModule(name) {
+  return fs.existsSync(path.join(getRuntimeNodeModules(), name, "package.json"));
+}
+
+function isBetterSqliteBinaryValid() {
+  const binary = path.join(getRuntimeNodeModules(), "better-sqlite3", "build", "Release", "better_sqlite3.node");
+  if (!fs.existsSync(binary)) return false;
+  try {
+    const fd = fs.openSync(binary, "r");
+    const buf = Buffer.alloc(4);
+    fs.readSync(fd, buf, 0, 4, 0);
+    fs.closeSync(fd);
+    const magic = buf.toString("hex");
+    if (process.platform === "linux") return magic.startsWith("7f454c46");
+    if (process.platform === "darwin") return magic.startsWith("cffaedfe") || magic.startsWith("cefaedfe");
+    if (process.platform === "win32") return magic.startsWith("4d5a");
+    return true;
+  } catch { return false; }
+}
+
+// Extract a short, user-friendly reason from npm stderr.
+function summarizeNpmError(stderr = "") {
+  const text = String(stderr);
+  if (/ENOTFOUND|ETIMEDOUT|EAI_AGAIN|network|getaddrinfo/i.test(text)) return "No internet connection or registry unreachable";
+  if (/EACCES|EPERM|permission denied/i.test(text)) return "Permission denied (check folder permissions)";
+  if (/ENOSPC|no space/i.test(text)) return "Not enough disk space";
+  if (/node-gyp|gyp ERR|python|MSBuild|Visual Studio|Xcode/i.test(text)) return "Missing build tools (Xcode CLT / Python / VS Build Tools)";
+  if (/ETARGET|version.*not found/i.test(text)) return "Package version not found on registry";
+  const m = text.match(/npm ERR! (.+)/);
+  if (m) return m[1].slice(0, 200);
+  const lastLine = text.trim().split(/\r?\n/).filter(Boolean).pop();
+  return lastLine ? lastLine.slice(0, 200) : "Unknown error";
+}
+
+function runNpmInstall({ cwd, pkgs, extraArgs = [], timeout = 180000 }) {
+  const args = ["install", ...pkgs, "--no-audit", "--no-fund", "--prefer-online", ...extraArgs];
+  const npmCmd = process.platform === "win32" ? "npm.cmd" : "npm";
+  const res = spawnSync(npmCmd, args, {
+    cwd,
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout,
+    shell: process.platform === "win32",
+    encoding: "utf8",
+  });
+  return { ok: res.status === 0, code: res.status, stderr: res.stderr || "", stdout: res.stdout || "" };
+}
+
+function npmInstall(pkgs, opts = {}) {
+  const cwd = ensureRuntimeDir();
+  const extra = opts.optional ? ["--no-save"] : [];
+  if (!opts.silent) console.log("⏳ Installing SQLite engine (first run)...");
+  const res = runNpmInstall({ cwd, pkgs, extraArgs: extra, timeout: opts.timeout || 180000 });
+  if (!res.ok && !opts.silent) {
+    const reason = summarizeNpmError(res.stderr);
+    console.warn("⚠️  SQLite engine install failed — using fallback");
+    console.warn(`   Reason: ${reason}`);
+    console.warn(`   Retry:  cd "${cwd}" && npm install ${pkgs.join(" ")}`);
+  }
+  return res.ok;
+}
+
+// Public: ensure better-sqlite3 native module is installed in user-writable
+// runtime dir. sql.js may be bundled in bin/app, but npm publish strips .wasm
+// from nested node_modules — verify and reinstall if missing. node:sqlite is
+// built-in. This is purely a *speed optimization* — app works without
+// better-sqlite3 via fallbacks.
+function isSqlJsWasmValid() {
+  const bundledWasm = path.join(__dirname, "..", "app", "node_modules", "sql.js", "dist", "sql-wasm.wasm");
+  if (fs.existsSync(bundledWasm)) return true;
+  const runtimeWasm = path.join(getRuntimeNodeModules(), "sql.js", "dist", "sql-wasm.wasm");
+  return fs.existsSync(runtimeWasm);
+}
+
+function ensureSqliteRuntime({ silent = false } = {}) {
+  ensureRuntimeDir();
+
+  let sqlJsOk = isSqlJsWasmValid();
+  if (!sqlJsOk) {
+    sqlJsOk = npmInstall([`sql.js@${SQL_JS_VERSION}`], { silent });
+    if (sqlJsOk) sqlJsOk = isSqlJsWasmValid();
+  }
+
+  const needBetterSqlite = !hasModule("better-sqlite3") || !isBetterSqliteBinaryValid();
+  if (!needBetterSqlite) {
+    if (!silent) console.log("✅ SQLite engine ready");
+    return { betterSqlite: true, sqlJs: sqlJsOk };
+  }
+
+  const ok = npmInstall([`better-sqlite3@${BETTER_SQLITE3_VERSION}`], { optional: true, silent });
+  return {
+    betterSqlite: ok && hasModule("better-sqlite3") && isBetterSqliteBinaryValid(),
+    sqlJs: sqlJsOk,
+  };
+}
+
+// Inject runtime + bundled node_modules into NODE_PATH so child Node processes
+// resolve sql.js (bundled in bin/app/node_modules) and better-sqlite3 (runtime).
+function buildEnvWithRuntime(baseEnv = process.env) {
+  const runtimeNm = getRuntimeNodeModules();
+  const bundledNm = path.join(__dirname, "..", "app", "node_modules");
+  const existing = baseEnv.NODE_PATH || "";
+  const NODE_PATH = [runtimeNm, bundledNm, existing].filter(Boolean).join(path.delimiter);
+  return { ...baseEnv, NODE_PATH };
+}
+
+module.exports = {
+  ensureSqliteRuntime,
+  buildEnvWithRuntime,
+  getRuntimeDir,
+  getRuntimeNodeModules,
+  runNpmInstall,
+  summarizeNpmError,
+};

package/hooks/trayRuntime.js

@@ -1,107 +1,107 @@
-// Lazy install systray2 for macOS/Linux into USER_DATA_DIR/runtime/node_modules.
-// Windows uses PowerShell NotifyIcon (no binary) → no systray needed.
-// This keeps the published npm tarball free of unsigned Go binaries that
-// trigger antivirus false positives (e.g. Kaspersky flagging tray_windows.exe).
-//
-// We use the maintained `systray2` fork. The original `systray@1.0.5` package
-// bundles a 2017 x86_64 Go binary whose Mach-O headers are rejected by modern
-// dyld (macOS 14+), so the tray silently fails to register on Apple Silicon.
-const { spawnSync } = require("child_process");
-const fs = require("fs");
-const path = require("path");
-const { getRuntimeDir, getRuntimeNodeModules, runNpmInstall, summarizeNpmError } = require("./sqliteRuntime");
-
-const SYSTRAY_PKG = "systray2";
-const SYSTRAY_VERSION = "2.1.4";
-const LEGACY_SYSTRAY_PKG = "systray";
-
-function hasSystray() {
-  return fs.existsSync(path.join(getRuntimeNodeModules(), SYSTRAY_PKG, "package.json"));
-}
-
-// Remove the legacy `systray` package from all known locations.
-// On Windows it was an AV false-positive risk; on macOS/Linux its bundled
-// binary is broken on modern OS versions.
-function cleanupLegacySystray({ silent = false } = {}) {
-  // 1) Runtime dir: ~/.miawrouter/runtime/node_modules/systray (or %APPDATA% on Win)
-  // 2) npm global nested: <npm_prefix>/node_modules/miawrouter/node_modules/systray
-  //    __dirname here = <pkg root>/hooks → up 1 = pkg root
-  const targets = [
-    path.join(getRuntimeNodeModules(), LEGACY_SYSTRAY_PKG),
-    path.join(__dirname, "..", "node_modules", LEGACY_SYSTRAY_PKG)
-  ];
-  for (const dir of targets) {
-    if (fs.existsSync(dir)) {
-      try {
-        fs.rmSync(dir, { recursive: true, force: true });
-        if (!silent) console.log(`[miawrouter][runtime] removed legacy systray: ${dir}`);
-      } catch (e) {
-        if (!silent) console.warn(`[miawrouter][runtime] failed to remove ${dir}: ${e.message}`);
-      }
-    }
-  }
-}
-
-// systray2's npm tarball sometimes ships the bundled Go binary without the
-// executable bit set on macOS, causing spawn() to fail with EACCES. Set +x
-// best-effort so the tray actually starts.
-function chmodSystrayBin({ silent = false } = {}) {
-  if (process.platform === "win32") return;
-  const binName = process.platform === "darwin" ? "tray_darwin_release" : "tray_linux_release";
-  const binPath = path.join(getRuntimeNodeModules(), SYSTRAY_PKG, "traybin", binName);
-  if (!fs.existsSync(binPath)) return;
-  try {
-    fs.chmodSync(binPath, 0o755);
-  } catch (e) {
-    if (!silent) console.warn(`[miawrouter][runtime] chmod tray bin failed: ${e.message}`);
-  }
-}
-
-function ensureRuntimeDir() {
-  const dir = getRuntimeDir();
-  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
-  const pkgPath = path.join(dir, "package.json");
-  if (!fs.existsSync(pkgPath)) {
-    fs.writeFileSync(pkgPath, JSON.stringify({
-      name: "miawrouter-runtime",
-      version: "1.2.3",
-      private: true
-    }, null, 2));
-  }
-  return dir;
-}
-
-function npmInstall(pkgs, { silent = false } = {}) {
-  const cwd = ensureRuntimeDir();
-  if (!silent) console.log("⏳ Installing system tray (first run)...");
-  const res = runNpmInstall({ cwd, pkgs, extraArgs: ["--no-save"], timeout: 120000 });
-  if (!res.ok && !silent) {
-    const reason = summarizeNpmError(res.stderr);
-    console.warn("⚠️  System tray install failed — tray disabled");
-    console.warn(`   Reason: ${reason}`);
-    console.warn(`   Retry:  cd "${cwd}" && npm install ${pkgs.join(" ")}`);
-  }
-  return res.ok;
-}
-
-// Public: ensure systray2 is installed on macOS/Linux only.
-// Windows skips entirely (uses PowerShell tray).
-function ensureTrayRuntime({ silent = false } = {}) {
-  // Always evict the legacy `systray` package — its binary is broken on
-  // modern macOS and an AV false-positive on Windows.
-  cleanupLegacySystray({ silent });
-
-  if (process.platform === "win32") {
-    return { systray: false, skipped: true };
-  }
-  if (hasSystray()) {
-    chmodSystrayBin({ silent });
-    if (!silent) console.log("✅ System tray ready");
-    return { systray: true };
-  }
-  const ok = npmInstall([`${SYSTRAY_PKG}@${SYSTRAY_VERSION}`], { silent });
-  if (ok) chmodSystrayBin({ silent });
-  return { systray: ok && hasSystray() };
-}
-
-module.exports = { ensureTrayRuntime };
+// Lazy install systray2 for macOS/Linux into USER_DATA_DIR/runtime/node_modules.
+// Windows uses PowerShell NotifyIcon (no binary) → no systray needed.
+// This keeps the published npm tarball free of unsigned Go binaries that
+// trigger antivirus false positives (e.g. Kaspersky flagging tray_windows.exe).
+//
+// We use the maintained `systray2` fork. The original `systray@1.0.5` package
+// bundles a 2017 x86_64 Go binary whose Mach-O headers are rejected by modern
+// dyld (macOS 14+), so the tray silently fails to register on Apple Silicon.
+const { spawnSync } = require("child_process");
+const fs = require("fs");
+const path = require("path");
+const { getRuntimeDir, getRuntimeNodeModules, runNpmInstall, summarizeNpmError } = require("./sqliteRuntime");
+
+const SYSTRAY_PKG = "systray2";
+const SYSTRAY_VERSION = "2.1.4";
+const LEGACY_SYSTRAY_PKG = "systray";
+
+function hasSystray() {
+  return fs.existsSync(path.join(getRuntimeNodeModules(), SYSTRAY_PKG, "package.json"));
+}
+
+// Remove the legacy `systray` package from all known locations.
+// On Windows it was an AV false-positive risk; on macOS/Linux its bundled
+// binary is broken on modern OS versions.
+function cleanupLegacySystray({ silent = false } = {}) {
+  // 1) Runtime dir: ~/.miawrouter/runtime/node_modules/systray (or %APPDATA% on Win)
+  // 2) npm global nested: <npm_prefix>/node_modules/miawrouter/node_modules/systray
+  //    __dirname here = <pkg root>/hooks → up 1 = pkg root
+  const targets = [
+    path.join(getRuntimeNodeModules(), LEGACY_SYSTRAY_PKG),
+    path.join(__dirname, "..", "node_modules", LEGACY_SYSTRAY_PKG)
+  ];
+  for (const dir of targets) {
+    if (fs.existsSync(dir)) {
+      try {
+        fs.rmSync(dir, { recursive: true, force: true });
+        if (!silent) console.log(`[miawrouter][runtime] removed legacy systray: ${dir}`);
+      } catch (e) {
+        if (!silent) console.warn(`[miawrouter][runtime] failed to remove ${dir}: ${e.message}`);
+      }
+    }
+  }
+}
+
+// systray2's npm tarball sometimes ships the bundled Go binary without the
+// executable bit set on macOS, causing spawn() to fail with EACCES. Set +x
+// best-effort so the tray actually starts.
+function chmodSystrayBin({ silent = false } = {}) {
+  if (process.platform === "win32") return;
+  const binName = process.platform === "darwin" ? "tray_darwin_release" : "tray_linux_release";
+  const binPath = path.join(getRuntimeNodeModules(), SYSTRAY_PKG, "traybin", binName);
+  if (!fs.existsSync(binPath)) return;
+  try {
+    fs.chmodSync(binPath, 0o755);
+  } catch (e) {
+    if (!silent) console.warn(`[miawrouter][runtime] chmod tray bin failed: ${e.message}`);
+  }
+}
+
+function ensureRuntimeDir() {
+  const dir = getRuntimeDir();
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+  const pkgPath = path.join(dir, "package.json");
+  if (!fs.existsSync(pkgPath)) {
+    fs.writeFileSync(pkgPath, JSON.stringify({
+      name: "miawrouter-runtime",
+      version: "1.2.4",
+      private: true
+    }, null, 2));
+  }
+  return dir;
+}
+
+function npmInstall(pkgs, { silent = false } = {}) {
+  const cwd = ensureRuntimeDir();
+  if (!silent) console.log("⏳ Installing system tray (first run)...");
+  const res = runNpmInstall({ cwd, pkgs, extraArgs: ["--no-save"], timeout: 120000 });
+  if (!res.ok && !silent) {
+    const reason = summarizeNpmError(res.stderr);
+    console.warn("⚠️  System tray install failed — tray disabled");
+    console.warn(`   Reason: ${reason}`);
+    console.warn(`   Retry:  cd "${cwd}" && npm install ${pkgs.join(" ")}`);
+  }
+  return res.ok;
+}
+
+// Public: ensure systray2 is installed on macOS/Linux only.
+// Windows skips entirely (uses PowerShell tray).
+function ensureTrayRuntime({ silent = false } = {}) {
+  // Always evict the legacy `systray` package — its binary is broken on
+  // modern macOS and an AV false-positive on Windows.
+  cleanupLegacySystray({ silent });
+
+  if (process.platform === "win32") {
+    return { systray: false, skipped: true };
+  }
+  if (hasSystray()) {
+    chmodSystrayBin({ silent });
+    if (!silent) console.log("✅ System tray ready");
+    return { systray: true };
+  }
+  const ok = npmInstall([`${SYSTRAY_PKG}@${SYSTRAY_VERSION}`], { silent });
+  if (ok) chmodSystrayBin({ silent });
+  return { systray: ok && hasSystray() };
+}
+
+module.exports = { ensureTrayRuntime };