fix(cloudcli): 内置 CloudCLI 升级 1.37.1→1.37.3(UI 与服务同步最新版) - #32
Open
Dylan5237 wants to merge 1 commit into
Open
Conversation
原因: 需要将内置 CloudCLI UI 更新为最新版; 上游 1.37.2/1.37.3 重建了前端资产并更新 agent/auth/browser-use 服务模块, codex-sdk 0.146.1→0.153.4 改动: T1: package.json @cloudcli-ai/cloudcli ^1.37.1→^1.37.3; T2: package-lock 同步(上游新增 react-scan/mermaid/@openai/codex 直接依赖, 全部顶层提升, asarUnpack 路径不受影响) 验证: npm test 160/160; 冒烟 /health 返回 version=1.37.3 且 UI 正常服务; npm run build 通过, 包内 cloudcli=1.37.3; npm audit 与 baseline 完全一致(prismjs 链未变, 无新增 finding) Co-Authored-By: Kimicode <noreply@kimicode.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
Bugbot Autofix prepared a fix for the issue found in the latest run.
- ✅ Fixed: Unpack list misses native runtime deps
- Seeded the CloudCLI tracer from optionalDependencies and added the nut-js/screenshot-desktop native closure (including libnut-win32) to asarUnpack so system Node can load the browser-use runtime from the packaged app.
Or push these changes by commenting:
@cursor push a69abdfb47
Preview (a69abdfb47)
diff --git a/package.json b/package.json
--- a/package.json
+++ b/package.json
@@ -34,8 +34,48 @@
"asarUnpack": [
"node_modules/@anthropic-ai/claude-agent-sdk/**",
"node_modules/@anthropic-ai/claude-agent-sdk-win32-x64/**",
+ "node_modules/@borewit/text-codec/**",
"node_modules/@cloudcli-ai/cloudcli/**",
"node_modules/@iarna/toml/**",
+ "node_modules/@jimp/bmp/**",
+ "node_modules/@jimp/core/**",
+ "node_modules/@jimp/custom/**",
+ "node_modules/@jimp/gif/**",
+ "node_modules/@jimp/jpeg/**",
+ "node_modules/@jimp/plugin-blit/**",
+ "node_modules/@jimp/plugin-blur/**",
+ "node_modules/@jimp/plugin-circle/**",
+ "node_modules/@jimp/plugin-color/**",
+ "node_modules/@jimp/plugin-contain/**",
+ "node_modules/@jimp/plugin-cover/**",
+ "node_modules/@jimp/plugin-crop/**",
+ "node_modules/@jimp/plugin-displace/**",
+ "node_modules/@jimp/plugin-dither/**",
+ "node_modules/@jimp/plugin-fisheye/**",
+ "node_modules/@jimp/plugin-flip/**",
+ "node_modules/@jimp/plugin-gaussian/**",
+ "node_modules/@jimp/plugin-invert/**",
+ "node_modules/@jimp/plugin-mask/**",
+ "node_modules/@jimp/plugin-normalize/**",
+ "node_modules/@jimp/plugin-print/**",
+ "node_modules/@jimp/plugin-resize/**",
+ "node_modules/@jimp/plugin-rotate/**",
+ "node_modules/@jimp/plugin-scale/**",
+ "node_modules/@jimp/plugin-shadow/**",
+ "node_modules/@jimp/plugin-threshold/**",
+ "node_modules/@jimp/plugins/**",
+ "node_modules/@jimp/png/**",
+ "node_modules/@jimp/tiff/**",
+ "node_modules/@jimp/types/**",
+ "node_modules/@jimp/utils/**",
+ "node_modules/@nut-tree-fork/default-clipboard-provider/**",
+ "node_modules/@nut-tree-fork/libnut/**",
+ "node_modules/@nut-tree-fork/libnut-darwin/**",
+ "node_modules/@nut-tree-fork/libnut-linux/**",
+ "node_modules/@nut-tree-fork/libnut-win32/**",
+ "node_modules/@nut-tree-fork/nut-js/**",
+ "node_modules/@nut-tree-fork/provider-interfaces/**",
+ "node_modules/@nut-tree-fork/shared/**",
"node_modules/@octokit/auth-token/**",
"node_modules/@octokit/core/**",
"node_modules/@octokit/endpoint/**",
@@ -51,11 +91,16 @@
"node_modules/@openai/codex/**",
"node_modules/@openai/codex-sdk/**",
"node_modules/@openai/codex-win32-x64/**",
+ "node_modules/@tokenizer/inflate/**",
+ "node_modules/@tokenizer/token/**",
+ "node_modules/@types/node/**",
"node_modules/@vscode/ripgrep/**",
"node_modules/@vscode/ripgrep-win32-x64/**",
"node_modules/accepts/**",
"node_modules/agent-base/**",
+ "node_modules/any-base/**",
"node_modules/append-field/**",
+ "node_modules/arch/**",
"node_modules/argparse/**",
"node_modules/array-flatten/**",
"node_modules/asn1.js/**",
@@ -66,17 +111,21 @@
"node_modules/better-sqlite3/**",
"node_modules/bindings/**",
"node_modules/bl/**",
+ "node_modules/bmp-js/**",
"node_modules/bn.js/**",
"node_modules/body-parser/**",
"node_modules/brace-expansion/**",
+ "node_modules/buffer-equal/**",
"node_modules/buffer-equal-constant-time/**",
"node_modules/buffer-from/**",
"node_modules/busboy/**",
"node_modules/bytes/**",
"node_modules/call-bind-apply-helpers/**",
"node_modules/call-bound/**",
+ "node_modules/centra/**",
"node_modules/chokidar/**",
"node_modules/chownr/**",
+ "node_modules/clipboardy/**",
"node_modules/concat-stream/**",
"node_modules/content-disposition/**",
"node_modules/content-type/**",
@@ -91,6 +140,7 @@
"node_modules/depd/**",
"node_modules/destroy/**",
"node_modules/detect-libc/**",
+ "node_modules/dom-walk/**",
"node_modules/dunder-proto/**",
"node_modules/ecdsa-sig-formatter/**",
"node_modules/ee-first/**",
@@ -103,41 +153,61 @@
"node_modules/escape-html/**",
"node_modules/esprima/**",
"node_modules/etag/**",
+ "node_modules/execa/**",
+ "node_modules/exif-parser/**",
"node_modules/expand-template/**",
"node_modules/express/**",
"node_modules/extend-shallow/**",
+ "node_modules/file-type/**",
"node_modules/file-uri-to-path/**",
"node_modules/filelist/**",
"node_modules/finalhandler/**",
+ "node_modules/follow-redirects/**",
"node_modules/forwarded/**",
"node_modules/fresh/**",
"node_modules/fs-constants/**",
+ "node_modules/fs.realpath/**",
"node_modules/function-bind/**",
"node_modules/get-intrinsic/**",
"node_modules/get-proto/**",
+ "node_modules/get-stream/**",
+ "node_modules/gifwrap/**",
"node_modules/github-from-package/**",
+ "node_modules/glob/**",
+ "node_modules/global/**",
"node_modules/gopd/**",
"node_modules/gray-matter/**",
"node_modules/has-symbols/**",
"node_modules/hasown/**",
+ "node_modules/http_ece/**",
"node_modules/http-errors/**",
- "node_modules/http_ece/**",
"node_modules/https-proxy-agent/**",
"node_modules/iconv-lite/**",
+ "node_modules/ieee754/**",
"node_modules/ignore/**",
+ "node_modules/image-q/**",
+ "node_modules/inflight/**",
"node_modules/inherits/**",
"node_modules/ini/**",
"node_modules/ipaddr.js/**",
+ "node_modules/is-docker/**",
"node_modules/is-extendable/**",
+ "node_modules/is-function/**",
+ "node_modules/is-stream/**",
+ "node_modules/is-wsl/**",
"node_modules/isarray/**",
"node_modules/isexe/**",
+ "node_modules/isomorphic-fetch/**",
"node_modules/jake/**",
+ "node_modules/jimp/**",
+ "node_modules/jpeg-js/**",
"node_modules/js-yaml/**",
"node_modules/json-with-bigint/**",
"node_modules/jsonwebtoken/**",
"node_modules/jwa/**",
"node_modules/jws/**",
"node_modules/kind-of/**",
+ "node_modules/load-bmfont/**",
"node_modules/lodash.includes/**",
"node_modules/lodash.isboolean/**",
"node_modules/lodash.isinteger/**",
@@ -153,25 +223,41 @@
"node_modules/mime-db/**",
"node_modules/mime-types/**",
"node_modules/mimic-response/**",
+ "node_modules/min-document/**",
"node_modules/minimalistic-assert/**",
"node_modules/minimatch/**",
"node_modules/minimist/**",
+ "node_modules/mkdirp/**",
"node_modules/mkdirp-classic/**",
"node_modules/ms/**",
"node_modules/multer/**",
"node_modules/napi-build-utils/**",
"node_modules/negotiator/**",
"node_modules/node-abi/**",
+ "node_modules/node-abort-controller/**",
+ "node_modules/node-fetch/**",
"node_modules/node-gyp-build/**",
"node_modules/node-pty/**",
+ "node_modules/npm-run-path/**",
"node_modules/object-assign/**",
"node_modules/object-inspect/**",
+ "node_modules/omggif/**",
"node_modules/on-finished/**",
"node_modules/once/**",
+ "node_modules/p-finally/**",
+ "node_modules/pako/**",
+ "node_modules/parse-bmfont-ascii/**",
+ "node_modules/parse-bmfont-binary/**",
+ "node_modules/parse-bmfont-xml/**",
+ "node_modules/parse-headers/**",
"node_modules/parseurl/**",
+ "node_modules/path-is-absolute/**",
"node_modules/path-key/**",
"node_modules/path-to-regexp/**",
+ "node_modules/phin/**",
"node_modules/picocolors/**",
+ "node_modules/pixelmatch/**",
+ "node_modules/pngjs/**",
"node_modules/prebuild-install/**",
"node_modules/process-nextick-args/**",
"node_modules/proxy-addr/**",
@@ -182,8 +268,12 @@
"node_modules/rc/**",
"node_modules/readable-stream/**",
"node_modules/readdirp/**",
+ "node_modules/regenerator-runtime/**",
+ "node_modules/rimraf/**",
"node_modules/safe-buffer/**",
"node_modules/safer-buffer/**",
+ "node_modules/sax/**",
+ "node_modules/screenshot-desktop/**",
"node_modules/section-matter/**",
"node_modules/semver/**",
"node_modules/send/**",
@@ -195,27 +285,46 @@
"node_modules/side-channel-list/**",
"node_modules/side-channel-map/**",
"node_modules/side-channel-weakmap/**",
+ "node_modules/signal-exit/**",
"node_modules/simple-concat/**",
"node_modules/simple-get/**",
"node_modules/statuses/**",
"node_modules/streamsearch/**",
"node_modules/strip-bom-string/**",
+ "node_modules/strip-eof/**",
"node_modules/strip-json-comments/**",
+ "node_modules/strtok3/**",
"node_modules/tar-fs/**",
"node_modules/tar-stream/**",
+ "node_modules/temp/**",
+ "node_modules/timm/**",
+ "node_modules/tinycolor2/**",
"node_modules/toidentifier/**",
+ "node_modules/token-types/**",
+ "node_modules/tr46/**",
"node_modules/tunnel-agent/**",
"node_modules/type-is/**",
"node_modules/typedarray/**",
+ "node_modules/uint8array-extras/**",
+ "node_modules/undici-types/**",
"node_modules/universal-user-agent/**",
"node_modules/unpipe/**",
+ "node_modules/utif2/**",
"node_modules/util-deprecate/**",
"node_modules/utils-merge/**",
"node_modules/vary/**",
"node_modules/web-push/**",
+ "node_modules/webidl-conversions/**",
+ "node_modules/whatwg-fetch/**",
+ "node_modules/whatwg-url/**",
"node_modules/which/**",
"node_modules/wrappy/**",
- "node_modules/ws/**"
+ "node_modules/ws/**",
+ "node_modules/xhr/**",
+ "node_modules/xml-parse-from-string/**",
+ "node_modules/xml2js/**",
+ "node_modules/xmlbuilder/**",
+ "node_modules/xtend/**"
],
"directories": {
"output": "dist"
diff --git a/scripts/trace-cloudcli-deps.mjs b/scripts/trace-cloudcli-deps.mjs
--- a/scripts/trace-cloudcli-deps.mjs
+++ b/scripts/trace-cloudcli-deps.mjs
@@ -12,6 +12,12 @@
// the test asserts that every package reported here is present in the whitelist,
// so a missing runtime dependency fails the build instead of breaking CloudCLI
// at launch.
+//
+// CloudCLI optionalDependencies (e.g. @nut-tree-fork/nut-js, screenshot-desktop
+// for the lazily loaded browser-use runtime) are seeded even when they are not
+// reachable from static imports in cli.js. Regular CloudCLI dependencies are
+// not seeded, because that graph includes Electron UI packages that must stay
+// inside asar.
import fs from 'node:fs';
import path from 'node:path';
import { builtinModules } from 'node:module';
@@ -106,6 +112,23 @@
}
}
+// Lazily loaded optional runtimes (browser-use) are not imported from cli.js.
+// Seed only CloudCLI optionalDependencies so Electron UI packages stay packed.
+function seedCloudCliOptionalRuntime() {
+ const pj = path.join(pkgDir('@cloudcli-ai/cloudcli'), 'package.json');
+ if (!fs.existsSync(pj)) return;
+ let j;
+ try { j = JSON.parse(fs.readFileSync(pj, 'utf8')); } catch { return; }
+ for (const dep of Object.keys(j.optionalDependencies || {})) {
+ const depPkg = pkgName(dep);
+ if (!depPkg || !pkgJsonExists(depPkg)) continue;
+ if (!externalPkgs.has(depPkg)) {
+ externalPkgs.add(depPkg);
+ followPackageJsonDeps(depPkg);
+ }
+ }
+}
+
function trace(file) {
const key = path.resolve(file);
if (visited.has(key)) return;
@@ -135,6 +158,7 @@
}
trace(entry);
+seedCloudCliOptionalRuntime();
const pkgs = [...externalPkgs].sort();
diff --git a/test/cloud-cli-failure.test.js b/test/cloud-cli-failure.test.js
--- a/test/cloud-cli-failure.test.js
+++ b/test/cloud-cli-failure.test.js
@@ -57,9 +57,12 @@
// Native modules that cannot live inside asar (system Node ABI mismatch)
const nativeRequired = [
+ 'node_modules/@nut-tree-fork/libnut-win32/**',
+ 'node_modules/@nut-tree-fork/nut-js/**',
'node_modules/better-sqlite3/**',
'node_modules/bcrypt/**',
- 'node_modules/node-pty/**'
+ 'node_modules/node-pty/**',
+ 'node_modules/screenshot-desktop/**'
]
for (const glob of nativeRequired) {
assert.ok(whitelist.includes(glob), `native runtime dep must be unpacked: ${glob}`)You can send follow-ups to the cloud agent here.
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 7a0cdb1. Configure here.
| }, | ||
| "dependencies": { | ||
| "@cloudcli-ai/cloudcli": "^1.37.1", | ||
| "@cloudcli-ai/cloudcli": "^1.37.3", |
There was a problem hiding this comment.
Unpack list misses native runtime deps
Medium Severity
The 1.37.3 bump adds optional native modules @nut-tree-fork/nut-js and screenshot-desktop for the new browser-use runtime, but asarUnpack does not list them. Packaged CloudCLI is spawned with system Node, which cannot load native addons from asar, so that runtime can fail after build even though the static tracer and whitelist tests still pass.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 7a0cdb1. Configure here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fix(cloudcli): 内置 CloudCLI 升级 1.37.1 → 1.37.3
将内置
@cloudcli-ai/cloudcli（CloudCLI UI + 服务）更新到当前最新版 1.37.3（上游 2026-09-08 发布）。Baseline:
ad71c0f(develop/kcc-1.0)。HEAD:7a0cdb1。与 #31（Arckeep identity）相互独立。改动
package.json:@cloudcli-ai/cloudcli^1.37.1→^1.37.3package-lock.json: 同步上游依赖变化（1.37.3 新增直接依赖react-scan/mermaid/@openai/codex，@openai/codex-sdk0.146.1 → 0.153.4；全部顶层提升，asarUnpack路径不受影响，已逐一验证）上游变化范围（1.37.1 → 1.37.3 包对比）
dist/资产重建（UI 新构建，mermaid/diagram chunk 重组）agentroutes、authmiddleware、browser-use（新增 runtime）等模块更新验证
npm test— 160/160 通过/health返回{"status":"ok","version":"1.37.3"}，UI HTML 正常服务npm run build通过；打包产物内 cloudcli = 1.37.3（app.asar.unpacked顶层路径正常）npm audit --omit=dev（npmjs registry）：与 baseline(1.37.1) 完全一致（11 项：fast-uri/hono/js-yaml/multer/prismjs/qs），无新增 finding；prismjs DOM clobbering 链上游仍未修复，维持 AGENTS.md 既有结论，未做任何 override注意
Note
Low Risk
Dependency-only upgrade with tests, build, and smoke checks reported passing; npm audit findings unchanged from baseline.
Overview
Bumps the bundled CloudCLI UI and service dependency from 1.37.1 to 1.37.3 by updating
@cloudcli-ai/cloudcliinpackage.jsonand refreshingpackage-lock.jsonto match the upstream release (including new direct deps such asreact-scan,mermaid, and@openai/codex, plus@openai/codex-sdk0.146.1 → 0.153.4).No KCC application code or Electron
asarUnpackwiring changes—only the vendored CloudCLI package version and its lockfile tree.Reviewed by Cursor Bugbot for commit 7a0cdb1. Configure here.