feat: extract docker-compose config to .env and update commands to docker compose

- Extract menu generation logic into standalone refresh-menu.sh script
- Use inotifywait to watch ~/Desktop/ for .desktop file changes and
  auto-refresh the openbox right-click menu on app install/uninstall
- Add inotify-tools to Dockerfile dependencies
- Add 'Installing Third-Party Applications' section to both READMEs
  documenting how to install apps like Telegram via sidebar panel

.env.example

@@ -0,0 +1,14 @@
+# Ports
+HTTP_PORT=3000
+HTTPS_PORT=3001
+
+# User/Group
+PUID=1000
+PGID=100
+
+# Selkies Web UI
+# CUSTOM_USER=
+# PASSWORD=
+
+# Shared Memory
+SHM_SIZE=1gb

.gitignore

@@ -1 +1,2 @@
-/config/
+/config/
+.env

AGENTS.md

@@ -0,0 +1,94 @@
+# PROJECT KNOWLEDGE BASE
+
+**Generated:** 2026-03-23
+**Commit:** e18821f
+**Branch:** master
+
+## OVERVIEW
+
+Docker 容器化微信/QQ Linux 客户端，基于 LinuxServer Selkies WebRTC 基础镜像，通过浏览器远程访问桌面应用。支持 AMD64/ARM64 双架构。
+
+## STRUCTURE
+
+```
+wechat-selkies/
+├── Dockerfile              # 单阶段构建，基于 selkies:ubuntunoble
+├── docker-compose.yml      # 单服务编排
+├── root/                   # COPY /root / → 容器内脚本和配置
+│   ├── defaults/
+│   │   ├── autostart           # 容器启动入口，仅一行: /scripts/start.sh
+│   │   └── menu.xml            # Openbox 右键菜单模板（静态基础项）
+│   └── scripts/
+│       ├── start.sh            # 主启动脚本：openbox配置 → 菜单刷新 → 监听桌面 → 启动应用
+│       ├── refresh-menu.sh     # 合并 menu.xml + ~/Desktop/*.desktop → 生成最终菜单
+│       ├── window_switcher.py  # ⚠️ 已废弃，仅保留
+│       ├── wechat/             # wechat-start.sh / wechat-restart.sh / wechat-unminimize.sh
+│       └── qq/                 # qq-restart.sh
+├── .github/workflows/      # CI: 多架构构建 + Issue 自动化
+├── docs/images/            # README 截图
+└── config/                 # ⚠️ gitignored 运行时数据挂载点
+```
+
+## WHERE TO LOOK
+
+| 任务 | 位置 | 备注 |
+|------|------|------|
+| 添加新应用 | `Dockerfile` (安装) + `root/defaults/menu.xml` (菜单) | 参考 QQ 安装段落的 case 模式 |
+| 修改启动行为 | `root/scripts/start.sh` | 入口脚本，由 `root/defaults/autostart` 触发 |
+| 修改右键菜单 | `root/defaults/menu.xml` + `root/scripts/refresh-menu.sh` | menu.xml 是模板，refresh-menu.sh 动态合并 ~/Desktop/*.desktop |
+| 修改菜单动态生成逻辑 | `root/scripts/refresh-menu.sh` | 解析 .desktop 文件的 Name/Exec/Icon 字段，处理图标搜索 |
+| 添加新应用启动/重启脚本 | `root/scripts/<app>/` | 遵循 wechat/ 目录模式: start.sh + restart.sh |
+| 修改环境变量 | `Dockerfile` (ENV) + `docker-compose.yml` (environment) | 两处需同步 |
+| CI/CD | `.github/workflows/docker.yml` | tag v* 触发，多架构 buildx，可选推送 Docker Hub |
+| Issue 自动化 | `.github/workflows/issue-validation.yml` + `cleanup-issues.yml` | 标题/描述校验 + 7天自动关闭 |
+
+## CONVENTIONS
+
+- **语言**: 脚本用 Bash (#!/bin/bash)，窗口切换器用 Python3 + Xlib + tkinter
+- **容器路径约定**: `COPY /root /` 将 `root/` 目录内容映射到容器根 `/`，因此 `root/scripts/start.sh` → 容器内 `/scripts/start.sh`
+- **自启动机制**: Selkies 基础镜像读取 `/defaults/autostart` 文件执行启动脚本
+- **菜单刷新**: inotifywait 监听 `~/Desktop/` 变更自动刷新 Openbox 菜单
+- **进程管理**: 应用通过 `nohup ... &` 后台启动，restart 脚本先 `pkill -9` 再启动
+- **restart 脚本模式**: `pkill -9 -f /usr/bin/<app>` → `nohup /usr/bin/<app> >/dev/null 2>&1 &`（QQ 需额外 `--no-sandbox`）
+- **菜单模板 vs 运行时**: `root/defaults/menu.xml` 是源码模板，`/config/.config/openbox/menu.xml` 是运行时生成的，不要混淆
+- **refresh-menu.sh**: 仅在内容变更时才写入 + reconfigure，避免无意义刷新
+- **图标搜索优先级**: proot-apps icons (256→512→128→64→48→scalable) → system icons → fallback xterm icon
+- **多架构**: Dockerfile 使用 `$TARGETPLATFORM` 条件分支安装不同架构 deb 包
+
+## ANTI-PATTERNS (THIS PROJECT)
+
+- **不要直接修改 `config/` 目录下的文件** — 这是运行时挂载数据，gitignored
+- **不要修改 `config/.config/openbox/` 下文件作为"源码"** — 这些由 `root/defaults/` 模板生成
+- **不要在 `root/` 下放非容器必需文件** — `COPY /root /` 会将所有内容复制到容器根目录
+- **不要在 menu.xml 中添加 .desktop 动态条目** — 由 refresh-menu.sh 自动处理
+- **不要在 start.sh 中用 `exec` 替代 `nohup ... &`** — 需要多进程并行运行
+- **升级后功能缺失** → 清空 `./config/.config/openbox/` 目录（已知 gotcha，见 README）
+- **window_switcher.py 已废弃** — `start.sh` 中已注释掉，但文件保留，不要删除
+
+## COMMANDS
+
+```bash
+# 本地构建并启动
+docker-compose up -d --build
+
+# 仅启动（使用已有镜像）
+docker-compose up -d
+
+# 查看日志
+docker-compose logs -f wechat-selkies
+
+# 进入容器调试
+docker exec -it wechat-selkies bash
+
+# 清理升级问题
+rm -rf ./config/.config/openbox
+```
+
+## NOTES
+
+- 端口 3000=HTTP, 3001=HTTPS（推荐 HTTPS）
+- `shm_size: "1gb"` 影响 WebRTC 性能，建议保留
+- `/dev/dri` 映射为可选 GPU 加速
+- `AUTO_START_WECHAT` / `AUTO_START_QQ` 控制容器启动时是否自动拉起应用
+- 第三方应用通过 proot-apps 安装，快捷方式自动出现在右键菜单
+- Docker Hub 推送需在 GitHub 仓库 Environment 中配置 `ENABLE_DOCKERHUB=true`

Dockerfile

@@ -27,7 +27,8 @@ RUN apt-get update && \
     libgtk-3-0 libnspr4 libnss3 libpango-1.0-0 libpangocairo-1.0-0 libstdc++6 libx11-6 \
     libxcomposite1 libxdamage1 libxext6 libxfixes3 libxi6 libxrandr2 libxrender1 \
     libxss1 libxtst6 libatomic1 libxcomposite1 libxrender1 libxrandr2 libxkbcommon-x11-0 \
-    libfontconfig1 libdbus-1-3 libnss3 libx11-xcb1 python3-tk stalonetray
+    libfontconfig1 libdbus-1-3 libnss3 libx11-xcb1 python3-tk stalonetray inotify-tools \
+    pcmanfm
 
 RUN pip install --no-cache-dir python-xlib
 

README.md

@@ -34,6 +34,8 @@
 - 🔧 **硬件加速**：可选的 GPU 硬件加速支持
 - 🪟 **窗口切换器**：左上角增加切换悬浮窗，方便切换到后台窗口，为后续添加其它功能做基础
 - 🤖 **自动启动**：可配置自动启动微信和QQ客户端（可选）
+- 📋 **桌面快捷方式集成**：自动扫描 `~/Desktop/` 下的 `.desktop` 文件并添加到右键菜单，方便启动第三方应用（如通过 proot-apps 安装的应用）
+- 📂 **文件管理器**：内置 PCManFM 轻量文件管理器，右键菜单即可启动，方便管理容器内文件
 
 ## 截图展示
 ![微信截图](./docs/images/wechat-selkies-1.jpg)
@@ -66,7 +68,7 @@ docker run -it -p 3001:3001 -v ./config:/config --device /dev/dri:/dev/dri nickr
    在浏览器中访问：`https://localhost:3001` 或 `https://<服务器IP>:3001`
    > **注意：** 映射3000端口用于HTTP访问，3001端口用于HTTPS访问，建议使用HTTPS。
 
-### docker-compose 部署
+### Docker Compose 部署
 1. **创建项目目录并进入**
    ```bash
    mkdir wechat-selkies
@@ -79,27 +81,43 @@ docker run -it -p 3001:3001 -v ./config:/config --device /dev/dri:/dev/dri nickr
         image: nickrunning/wechat-selkies:latest    # or ghcr.io/nickrunning/wechat-selkies:latest
         container_name: wechat-selkies
         ports:
-          - "3000:3000"       # http port
-          - "3001:3001"       # https port
+          - "${HTTP_PORT:-3000}:3000"
+          - "${HTTPS_PORT:-3001}:3001"
         restart: unless-stopped
         volumes:
           - ./config:/config
         devices:
-          - /dev/dri:/dev/dri # optional, for hardware acceleration
+          - /dev/dri:/dev/dri
         environment:
-          - PUID=1000                    # user ID, set according to your system
-          - PGID=100                     # group ID, set according to your system
-          - TZ=Asia/Shanghai             # timezone, set according to your timezone
-          - LC_ALL=zh_CN.UTF-8           # locale, set according to your needs
-          - AUTO_START_WECHAT=true       # default is true
-          - AUTO_START_QQ=false          # default is false
-          # - CUSTOM_USER=<Your Name>      # recommended to set a custom user name
-          # - PASSWORD=<Your Password>     # recommended to set a password for selkies web ui
-        shm_size: "1gb"                  # recommended, will improve performance
+          - PUID=${PUID:-1000}
+          - PGID=${PGID:-100}
+          - TZ=Asia/Shanghai
+          - LC_ALL=zh_CN.UTF-8
+          - AUTO_START_WECHAT=true
+          - AUTO_START_QQ=false
+          - CUSTOM_USER=${CUSTOM_USER:-}
+          - PASSWORD=${PASSWORD:-}
+        shm_size: "${SHM_SIZE:-1gb}"
     ```
-3. **启动服务**
+3. **创建 `.env` 文件（可选）**
+
+   复制 `.env.example` 并按需修改，未设置的变量将使用默认值：
    ```bash
-   docker-compose up -d
+   cp .env.example .env
+   ```
+   `.env` 文件示例：
+   ```env
+   HTTP_PORT=3000
+   HTTPS_PORT=3001
+   PUID=1000
+   PGID=100
+   # CUSTOM_USER=
+   # PASSWORD=
+   SHM_SIZE=1gb
+   ```
+4. **启动服务**
+   ```bash
+   docker compose up -d
    ```
 
 ### 源码部署
@@ -112,7 +130,7 @@ docker run -it -p 3001:3001 -v ./config:/config --device /dev/dri:/dev/dri nickr
 
 2. **启动服务**
    ```bash
-   docker-compose up -d
+   docker compose up -d
    ```
 
 3. **访问微信**
@@ -135,7 +153,7 @@ docker run -it -p 3001:3001 -v ./config:/config --device /dev/dri:/dev/dri nickr
 
 #### 环境变量配置
 
-在 `docker-compose.yml` 中可以配置以下环境变量：
+在 `docker-compose.yml` 中可以配置以下环境变量，支持通过 `.env` 文件覆盖带有 `${VAR:-default}` 的配置项：
 
 | 变量名 | 默认值 | 说明 |
 |--------|--------|------|
@@ -159,6 +177,19 @@ docker run -it -p 3001:3001 -v ./config:/config --device /dev/dri:/dev/dri nickr
 
 > **注意：** 如果升级后右键菜单缺少 `WeChat` 相关选项，请先清空本地挂载目录下的openbox目录(如`./config/.config/openbox`)。
 
+## 安装第三方应用（如 Telegram）
+
+本项目支持通过 [proot-apps](https://github.com/linuxserver/proot-apps) 安装第三方 Linux 应用。以 Telegram 为例：
+
+1. 在浏览器中打开容器桌面
+2. 点击左侧 **侧边栏** → **应用程序**（Applications）
+3. 在应用列表中找到 **Telegram**
+4. 点击 **安装**（Install）按钮，等待安装完成
+
+安装完成后，应用快捷方式会自动出现在 `~/Desktop/` 目录下，**右键菜单会自动刷新**，无需重启容器即可从菜单中启动该应用。
+
+> **提示：** 如需卸载应用，同样通过侧边栏 → 应用程序，选中对应应用后点击 **卸载**（Uninstall）即可，右键菜单会自动更新。
+
 ## 高级配置
 
 ### 硬件加速
@@ -175,6 +206,7 @@ devices:
 ```
 wechat-selkies/
 ├── docker-compose.yml          # Docker Compose 配置文件
+├── .env.example                # 环境变量示例文件
 ├── Dockerfile                  # Docker 镜像构建文件
 ├── LICENSE                     # License
 ├── README.md                   # 项目说明文档
@@ -187,6 +219,20 @@ wechat-selkies/
 
 ## 故障排除
 
+### 更新微信/QQ版本
+
+当微信或QQ提示"版本过期"时，只需重新拉取最新镜像并重建容器即可，聊天记录和配置不受影响：
+
+```bash
+# 使用预构建镜像
+docker compose pull && docker compose up -d
+
+# 使用源码构建
+git pull && docker compose up -d --build
+```
+
+> **注意：** 微信和QQ的安装包 URL 指向官方最新版本，重新构建镜像时会自动下载最新版。
+
 ### 常见问题
 
 1. **无法访问 Web UI**
@@ -197,7 +243,7 @@ wechat-selkies/
 
 查看容器运行日志：
 ```bash
-docker-compose logs -f wechat-selkies
+docker compose logs -f wechat-selkies
 ```
 
 ## 技术架构

README_en.md

@@ -33,6 +33,9 @@ This project packages the official WeChat/QQ Linux client in a Docker container,
 - 🖥️ **AMD64 and ARM64 Architecture Support**: Compatible with mainstream CPU architectures
 - 🔧 **Hardware Acceleration**: Optional GPU hardware acceleration support
 - 🪟 **Window Switcher**: Added a floating window switcher in the top left corner for easy switching to background windows, laying the foundation for adding other features in the future
+- 🤖 **Auto Start**: Configurable auto-start for WeChat and QQ clients (optional)
+- 📋 **Desktop Shortcut Integration**: Automatically scans `.desktop` files in `~/Desktop/` and adds them to the right-click menu, making it easy to launch third-party applications (e.g., apps installed via proot-apps)
+- 📂 **File Manager**: Built-in PCManFM lightweight file manager, accessible from the right-click menu for easy file management inside the container
 
 ## Screenshots
 ![WeChat Screenshot](./docs/images/wechat-selkies-1.jpg)
@@ -63,7 +66,7 @@ docker run -it -p 3001:3001 -v ./config:/config --device /dev/dri:/dev/dri nickr
    Open in browser: `https://localhost:3001` or `https://<server-ip>:3001`
    > **Note**: 3001 port is for HTTPS access. If you need HTTP access, please map port 3000 as well.
 
-### docker-compose Deployment
+### Docker Compose Deployment
 1. **Create project directory and navigate into it**
    ```bash
    mkdir wechat-selkies
@@ -76,27 +79,43 @@ docker run -it -p 3001:3001 -v ./config:/config --device /dev/dri:/dev/dri nickr
         image: nickrunning/wechat-selkies:latest    # or ghcr.io/nickrunning/wechat-selkies:latest
         container_name: wechat-selkies
         ports:
-          - "3000:3000"       # http port
-          - "3001:3001"       # https port
+          - "${HTTP_PORT:-3000}:3000"
+          - "${HTTPS_PORT:-3001}:3001"
         restart: unless-stopped
         volumes:
           - ./config:/config
         devices:
-          - /dev/dri:/dev/dri # optional, for hardware acceleration
+          - /dev/dri:/dev/dri
         environment:
-          - PUID=1000                    # user ID, set according to your system
-          - PGID=100                     # group ID, set according to your system
-          - TZ=Asia/Shanghai             # timezone, set according to your timezone
-          - LC_ALL=zh_CN.UTF-8           # locale, set according to your needs
-          - AUTO_START_WECHAT=true       # default is true
-          - AUTO_START_QQ=false          # default is false
-          # - CUSTOM_USER=<Your Name>      # recommended to set a custom user name
-          # - PASSWORD=<Your Password>     # recommended to set a password for selkies web ui
-        shm_size: "1gb"                  # recommended, will improve performance
+          - PUID=${PUID:-1000}
+          - PGID=${PGID:-100}
+          - TZ=Asia/Shanghai
+          - LC_ALL=zh_CN.UTF-8
+          - AUTO_START_WECHAT=true
+          - AUTO_START_QQ=false
+          - CUSTOM_USER=${CUSTOM_USER:-}
+          - PASSWORD=${PASSWORD:-}
+        shm_size: "${SHM_SIZE:-1gb}"
     ```
-3. **Start the service**
+3. **Create `.env` file (optional)**
+
+   Copy `.env.example` and modify as needed. Variables not set will use default values:
    ```bash
-   docker-compose up -d
+   cp .env.example .env
+   ```
+   `.env` file example:
+   ```env
+   HTTP_PORT=3000
+   HTTPS_PORT=3001
+   PUID=1000
+   PGID=100
+   # CUSTOM_USER=
+   # PASSWORD=
+   SHM_SIZE=1gb
+   ```
+4. **Start the service**
+   ```bash
+   docker compose up -d
    ```
 
 ### Source Code Deployment
@@ -109,7 +128,7 @@ docker run -it -p 3001:3001 -v ./config:/config --device /dev/dri:/dev/dri nickr
 
 2. **Start the service**
    ```bash
-   docker-compose up -d
+   docker compose up -d
    ```
 
 3. **Access WeChat**
@@ -132,7 +151,7 @@ This project supports pushing to both GitHub Container Registry and Docker Hub.
 
 #### Environment Variables
 
-Configure the following environment variables in `docker-compose.yml`:
+Configure the following environment variables in `docker-compose.yml`. Variables with `${VAR:-default}` syntax can be overridden via a `.env` file:
 
 | Variable | Default | Description |
 |----------|---------|-------------|
@@ -156,6 +175,19 @@ Configure the following environment variables in `docker-compose.yml`:
 
 > **Note:** If the right-click menu lacks `WeChat` related options after an upgrade, please clear the `openbox` directory in the local mounted directory (e.g., `./config/.config/openbox`).
 
+## Installing Third-Party Applications (e.g., Telegram)
+
+This project supports installing third-party Linux applications via [proot-apps](https://github.com/linuxserver/proot-apps). Here's how to install Telegram as an example:
+
+1. Open the container desktop in your browser
+2. Click the **Sidebar** on the left → **Applications**
+3. Find **Telegram** in the application list
+4. Click the **Install** button and wait for the installation to complete
+
+Once installed, the application shortcut will automatically appear in the `~/Desktop/` directory, and the **right-click menu will auto-refresh** — no container restart needed to launch the app from the menu.
+
+> **Tip:** To uninstall an application, go to Sidebar → Applications, select the app, and click **Uninstall**. The right-click menu will update automatically.
+
 ## Advanced Configuration
 
 ### Hardware Acceleration
@@ -172,6 +204,7 @@ devices:
 ```
 wechat-selkies/
 ├── docker-compose.yml          # Docker Compose configuration file
+├── .env.example                # Environment variables example file
 ├── Dockerfile                  # Docker image build file
 ├── LICENSE                     # License
 ├── README.md                   # Project documentation (Chinese)
@@ -185,6 +218,20 @@ wechat-selkies/
 
 ## Troubleshooting
 
+### Updating WeChat/QQ Version
+
+When WeChat or QQ displays a "version outdated" message, simply pull the latest image and recreate the container. Your chat history and configurations will be preserved:
+
+```bash
+# Using pre-built images
+docker compose pull && docker compose up -d
+
+# Using source code build
+git pull && docker compose up -d --build
+```
+
+> **Note:** The WeChat and QQ download URLs point to the latest official versions. Rebuilding the image will automatically download the newest version.
+
 ### Common Issues
 
 1. **Unable to access Web UI**
@@ -195,7 +242,7 @@ wechat-selkies/
 
 View container runtime logs:
 ```bash
-docker-compose logs -f wechat-selkies
+docker compose logs -f wechat-selkies
 ```
 
 ## Technical Architecture

docker-compose.yml

@@ -10,12 +10,12 @@ services:
     devices:
       - /dev/dri:/dev/dri # optional, for hardware acceleration
     ports:
-      - "3000:3000"       # http port
-      - "3001:3001"       # https port
+      - "${HTTP_PORT:-3000}:3000"       # http port
+      - "${HTTPS_PORT:-3001}:3001"      # https port
     restart: unless-stopped
     environment:
-      - PUID=1000         # set user id according to your system
-      - PGID=100          # set group id according to your system
-      # - CUSTOM_USER=<Your Name>   # recommended to set a custom user name
-      # - PASSWORD=<Your Password>  # recommended to set a password for selkies web ui
-    shm_size: "1gb"       # recommended, will improve performance
+      - PUID=${PUID:-1000}              # set user id according to your system
+      - PGID=${PGID:-100}               # set group id according to your system
+      - CUSTOM_USER=${CUSTOM_USER:-}    # recommended to set a custom user name
+      - PASSWORD=${PASSWORD:-}          # recommended to set a password for selkies web ui
+    shm_size: "${SHM_SIZE:-1gb}"        # recommended, will improve performance

root/defaults/menu.xml

@@ -1,8 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
 <openbox_menu xmlns="http://openbox.org/3.4/menu">
 <menu id="root-menu" label="MENU">
+<item label="WeChat" icon="/usr/share/icons/hicolor/128x128/apps/wechat.png"><action name="Execute"><command>/scripts/wechat/wechat-start.sh</command></action></item>
+<item label="QQ" icon="/usr/share/icons/hicolor/512x512/apps/qq.png"><action name="Execute"><command>/scripts/qq/qq-start.sh</command></action></item>
+<separator />
+<item label="File Manager" icon="/usr/share/pixmaps/xterm-color_48x48.xpm"><action name="Execute"><command>pcmanfm</command></action></item>
 <item label="xterm" icon="/usr/share/pixmaps/xterm-color_48x48.xpm"><action name="Execute"><command>/usr/bin/xterm</command></action></item>
-<item label="WeChat" icon="/usr/share/icons/hicolor/128x128/apps/wechat.png"><action name="Execute"><command>/scripts/wechat/wechat-restart.sh</command></action></item>
-<item label="QQ" icon="/usr/share/icons/hicolor/512x512/apps/qq.png"><action name="Execute"><command>/scripts/qq/qq-restart.sh</command></action></item>
 </menu>
 </openbox_menu>

root/scripts/qq/qq-start.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+/usr/bin/qq --no-sandbox

root/scripts/refresh-menu.sh

@@ -0,0 +1,57 @@
+#!/bin/bash
+# Regenerate openbox right-click menu from defaults + ~/Desktop/*.desktop files
+
+MENU_DEFAULT="/defaults/menu.xml"
+MENU_TARGET="/config/.config/openbox/menu.xml"
+MENU_TMP="/tmp/menu.xml"
+
+mkdir -p /config/.config/openbox
+cp "$MENU_DEFAULT" "$MENU_TMP"
+
+if ls "$HOME/Desktop/"*.desktop >/dev/null 2>&1; then
+    for desktop_file in "$HOME/Desktop/"*.desktop; do
+        name=$(grep -E "^Name=" "$desktop_file" | head -n 1 | cut -d "=" -f 2-)
+        exec_cmd=$(grep -E "^Exec=" "$desktop_file" | head -n 1 | cut -d "=" -f 2-)
+        icon=$(grep -E "^Icon=" "$desktop_file" | head -n 1 | cut -d "=" -f 2-)
+
+        # skip entries without a name or exec command
+        [ -z "$name" ] || [ -z "$exec_cmd" ] && continue
+
+        # strip %U, %u, %F, %f field codes
+        exec_cmd=$(echo "$exec_cmd" | sed 's/ %[fFuU]//g')
+
+        # resolve icon path if it's just a name (not an absolute path)
+        if [ -n "$icon" ] && [ "${icon#/}" = "$icon" ]; then
+            icon_resolved=""
+            # search in proot-apps icons (prefer 256x256)
+            for size in 256x256 512x512 128x128 64x64 48x48 scalable; do
+                found=$(find /config/proot-apps/*/usr/share/icons/hicolor/"$size"/apps/"$icon".* 2>/dev/null | head -n 1)
+                if [ -n "$found" ]; then
+                    icon_resolved="$found"
+                    break
+                fi
+            done
+            # fallback: search system icons
+            if [ -z "$icon_resolved" ]; then
+                found=$(find /usr/share/icons/hicolor/*/apps/"$icon".* 2>/dev/null | head -n 1)
+                [ -n "$found" ] && icon_resolved="$found"
+            fi
+            [ -n "$icon_resolved" ] && icon="$icon_resolved"
+        fi
+
+        # handle missing icon
+        [ -z "$icon" ] && icon="/usr/share/pixmaps/xterm-color_48x48.xpm"
+
+        # escape XML entities
+        exec_cmd=$(echo "$exec_cmd" | sed 's/&/\&amp;/g; s/</\&lt;/g; s/>/\&gt;/g')
+        name=$(echo "$name" | sed 's/&/\&amp;/g; s/</\&lt;/g; s/>/\&gt;/g; s/"/\&quot;/g')
+        icon=$(echo "$icon" | sed 's/&/\&amp;/g; s/</\&lt;/g; s/>/\&gt;/g; s/"/\&quot;/g')
+
+        sed -i "/<menu id=\"root-menu\" label=\"MENU\">/a \\<item label=\"${name}\" icon=\"${icon}\"><action name=\"Execute\"><command>${exec_cmd}</command></action></item>" "$MENU_TMP"
+    done
+fi
+
+if [ ! -f "$MENU_TARGET" ] || ! cmp -s "$MENU_TMP" "$MENU_TARGET"; then
+    cp "$MENU_TMP" "$MENU_TARGET"
+    openbox --reconfigure 2>/dev/null || true
+fi

root/scripts/start.sh

@@ -1,5 +1,8 @@
 #!/bin/bash
 
+# clean up stale dbus pid file to prevent startup failures after container restart
+rm -f /run/dbus/pid
+
 # configure openbox dock mode for stalonetray
 if [ ! -f /config/.config/openbox/rc.xml ] || grep -A20 "<dock>" /config/.config/openbox/rc.xml | grep -q "<noStrut>no</noStrut>"; then
     mkdir -p /config/.config/openbox
@@ -8,11 +11,31 @@ if [ ! -f /config/.config/openbox/rc.xml ] || grep -A20 "<dock>" /config/.config
     openbox --reconfigure
 fi
 
-# update openbox menu if differs from default
-if [ ! -f /config/.config/openbox/menu.xml ] || ! cmp /defaults/menu.xml /config/.config/openbox/menu.xml; then
-    mkdir -p /config/.config/openbox
-    cp /defaults/menu.xml /config/.config/openbox/menu.xml
-    openbox --reconfigure
+# configure default window behavior: open WeChat/QQ as normal windows instead of maximized
+OB_RC="/config/.config/openbox/rc.xml"
+if [ -f "$OB_RC" ] && ! grep -q '<application class="wechat"' "$OB_RC"; then
+    sed -i '/<\/openbox_config>/i \
+  <applications>\
+    <application class="wechat">\
+      <maximized>no</maximized>\
+    </application>\
+    <application class="QQ">\
+      <maximized>no</maximized>\
+    </application>\
+  </applications>' "$OB_RC"
+    openbox --reconfigure 2>/dev/null || true
+fi
+
+# generate openbox menu from defaults + ~/Desktop/*.desktop files
+/scripts/refresh-menu.sh
+
+# watch ~/Desktop/ for .desktop file changes and auto-refresh menu
+mkdir -p "$HOME/Desktop"
+if command -v inotifywait >/dev/null 2>&1; then
+    (while inotifywait -q -e create -e delete -e modify "$HOME/Desktop/" --include '\.desktop$'; do
+        sleep 1
+        /scripts/refresh-menu.sh
+    done) >/dev/null 2>&1 &
 fi
 
 nohup stalonetray --dockapp-mode simple > /dev/null 2>&1 &