fix: make installer health checks quiet and diagnostic

README.md

@@ -59,14 +59,14 @@ PostgreSQL 18。PostgreSQL 兼容开发已冻结，不属于本次 Preview.12
 ### 直接 curl 安装
 
 ```bash
-curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-preview.13/install.sh | sudo bash
+curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-preview.15/install.sh | sudo bash
 ```
 
 这条命令会提示填写 Java 应用端口，直接回车使用 `18080`；随后安装最新签名 Release，并默认进入 `/setup`
 安装向导。Java 默认只监听 `127.0.0.1:所选端口`，前端页面、API 和健康检查均由同一端口提供。无人值守安装可直接指定：
 
 ```bash
-curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-preview.13/install.sh \
+curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-preview.15/install.sh \
   | sudo env KAIDI_APP_PORT=19090 bash
 ```
 
@@ -74,8 +74,8 @@ curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-previe
 时才设置 `KAIDI_SERVER_ADDRESS=0.0.0.0`，通常应保持默认回环绑定并由本机反向代理访问。需要在执行前独立校验安装脚本时使用：
 
 ```bash
-curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-preview.13/install.sh -o /tmp/kaidi-install.sh
+curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-preview.15/install.sh -o /tmp/kaidi-install.sh
-printf '%s  %s\n' 95a5887809edaf1e4ed6201224c4d2d122388c0289a83e2c960a0641d9671664 /tmp/kaidi-install.sh | sha256sum -c -
+printf '%s  %s\n' 8a75ee99a1c2f426c11ea18c8ef65f4f4ac3f8d52321c358f3ff645baa6ad99c /tmp/kaidi-install.sh | sha256sum -c -
 sudo bash /tmp/kaidi-install.sh
 rm -f /tmp/kaidi-install.sh
 ```
@@ -86,7 +86,7 @@ rm -f /tmp/kaidi-install.sh
 包装器会在 `sudo` 前校验 `deploy/install.sh` 的固定 SHA-256，再按同一公钥信任链安装最新签名 Release。
 
 ```bash
-git clone --branch v1.0.0-preview.13 --depth 1 https://git.awaioi.com/ERP-Team/kaidi.git kaidi-preview
+git clone --branch v1.0.0-preview.15 --depth 1 https://git.awaioi.com/ERP-Team/kaidi.git kaidi-preview
 cd kaidi-preview
 ./deploy/install-from-git.sh
 ```
@@ -141,7 +141,7 @@ sudo cat /root/kaidi-first-login.txt
 32 位服务端镜像，因此 32 位主机需要预先连接一台 MySQL 8.4 数据库，之后仍然只执行一个安装命令：
 
 ```bash
-curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-preview.13/install.sh | sudo bash
+curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-preview.15/install.sh | sudo bash
 ```
 
 无论主机架构如何，安装器都不会安装 MySQL、数据库客户端或创建数据库容器。在打开向导前，需要预先创建 `kaidi_finance`，并授予安装账号该库的
@@ -161,7 +161,7 @@ GRANT ALL PRIVILEGES ON kaidi_finance.* TO 'kaidi'@'KAIDI_SERVER_IP';
 管理员数据和运维人员新增的环境变量：
 
 ```bash
-curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-preview.13/install.sh \
+curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-preview.15/install.sh \
   | sudo env KAIDI_REINSTALL=true KAIDI_SETUP_WIZARD=false bash
 ```
 
@@ -171,7 +171,7 @@ curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-previe
 如果安装器已完成但向导尚未提交，可执行下面的命令重新生成一次性安装码；该恢复路径只接受仍处于向导模式且未锁定的安装，正式模式不会被覆盖。
 
 ```bash
-curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-preview.13/install.sh \
+curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-preview.15/install.sh \
   | sudo env KAIDI_REINSTALL=true bash
 ```
 
@@ -207,8 +207,8 @@ act_runner 提供 `ubuntu-24.04` 标签，并在 tag 发布时执行后端、前
 Preview 属性由 SemVer 版本名表达。之后推送 tag 即会构建、测试、签名并发布：
 
 ```bash
-git tag v1.0.0-preview.13
+git tag v1.0.0-preview.15
-git push origin v1.0.0-preview.13
+git push origin v1.0.0-preview.15
 ```
 
 在线更新使用独立的 TDesign 页面：隔离的系统管理员进入“系统治理 → 系统更新”。权限与配置页只管理用户、角色、数据范围、表单模板和参数版本，不配置系统名称或域名。
@@ -260,7 +260,7 @@ cat /var/lib/kaidi-update/status.json
 ```bash
 KAIDI_RELEASE_SIGNING_KEY=/secure/release-signing-private.pem \
 KAIDI_TRUSTED_RELEASE_PUBLIC_KEY_SHA256=807c6aec1dc3f7ce494db16aa9d763c66f292033c38f328afd0390d2715a8cd9 \
-  ./scripts/package-release.sh 1.0.0-preview.13
+  ./scripts/package-release.sh 1.0.0-preview.15
 KAIDI_TRUSTED_RELEASE_PUBLIC_KEY_SHA256=807c6aec1dc3f7ce494db16aa9d763c66f292033c38f328afd0390d2715a8cd9 \
   ./scripts/verify-release.sh dist/release
 ```

deploy/install-from-git.sh

@@ -5,7 +5,7 @@ umask 077
 
 ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 INSTALLER="$ROOT/deploy/install.sh"
-INSTALLER_SHA256=${KAIDI_INSTALLER_SHA256:-95a5887809edaf1e4ed6201224c4d2d122388c0289a83e2c960a0641d9671664}
+INSTALLER_SHA256=${KAIDI_INSTALLER_SHA256:-8a75ee99a1c2f426c11ea18c8ef65f4f4ac3f8d52321c358f3ff645baa6ad99c}
 RELEASE_API_URL=${KAIDI_RELEASE_API_URL:-https://git.awaioi.com/api/v1/repos/ERP-Team/kaidi/releases/latest}
 PUBLIC_KEY_SHA256=${KAIDI_RELEASE_PUBLIC_KEY_SHA256:-807c6aec1dc3f7ce494db16aa9d763c66f292033c38f328afd0390d2715a8cd9}
 TOKEN_FILE=${KAIDI_RELEASE_TOKEN_FILE:-}

deploy/install.sh

@@ -210,7 +210,7 @@ prepare_java() {
     ln -s "$system_home" "$JAVA_STAGED_DIR"
     log "Using existing Java 17 runtime at $system_home"
     "$JAVA_STAGED_DIR/bin/java" -version
-    return
+    return 0
   fi
   log "No local Java 17 runtime found; downloading the official Azul Java 17 runtime"
   api="https://api.azul.com/metadata/v1/zulu/packages/?java_version=17&os=linux&arch=$(azul_arch)&archive_type=tar.gz&java_package_type=jre&release_status=ga&availability_types=CA&latest=true"
@@ -388,7 +388,7 @@ configure_database() {
     DB_URL='jdbc:mysql://setup.invalid:3306/kaidi_finance'
     DB_USERNAME=setup_pending
     DB_PASSWORD=setup_pending
-    return
+    return 0
   fi
   if [ "$REINSTALL" = true ]; then
     [ -s "$CONFIG_ROOT/kaidi.env" ] || die "KAIDI_REINSTALL needs the existing $CONFIG_ROOT/kaidi.env"
@@ -403,7 +403,7 @@ configure_database() {
   if [ -n "$DB_URL" ]; then
     [ -n "$DB_USERNAME" ] && [ -n "$DB_PASSWORD" ] \
       || die "KAIDI_DB_USERNAME and KAIDI_DB_PASSWORD are required with KAIDI_DB_URL"
-    return
+    return 0
   fi
   [ "$REINSTALL" != true ] \
     || die "KAIDI_REINSTALL needs database credentials in the existing installation or command environment"
@@ -436,7 +436,7 @@ database_name() {
 
 preflight_database() {
   local client host port name version table
-  [ "$SETUP_WIZARD" != true ] || return
+  [ "$SETUP_WIZARD" != true ] || return 0
   case "$DB_URL" in
     jdbc:mysql://*) ;;
     *) die "KAIDI_DB_URL must start with jdbc:mysql://" ;;
@@ -538,12 +538,25 @@ write_env_file_preserving_unknown() {
 }
 
 wait_for_health() {
-  local attempts=0
+  local attempts=0 active_state restart_count
+  log "Waiting for application startup at $HEALTH_URL"
   while [ "$attempts" -lt 60 ]; do
-    if curl -fsS "$HEALTH_URL" | jq -e '.status == "UP"' >/dev/null 2>&1; then
+    if curl --fail --silent --connect-timeout 1 --max-time 2 "$HEALTH_URL" 2>/dev/null \
-      return
+      | jq -e '.status == "UP"' >/dev/null 2>&1; then
+      log "Application health check is UP"
+      return 0
+    fi
+    active_state=$(systemctl show kaidi-finance.service --property=ActiveState --value 2>/dev/null || printf unknown)
+    restart_count=$(systemctl show kaidi-finance.service --property=NRestarts --value 2>/dev/null || printf 0)
+    [[ "$restart_count" =~ ^[0-9]+$ ]] || restart_count=0
+    if [ "$active_state" = failed ] || [ "$restart_count" -ge 3 ]; then
+      journalctl -u kaidi-finance.service -n 80 --no-pager >&2 || true
+      die "Application service failed during startup (state=$active_state, restarts=$restart_count)"
     fi
     attempts=$((attempts + 1))
+    if [ $((attempts % 5)) -eq 0 ]; then
+      log "Application is still starting (state=$active_state, elapsed=$((attempts * 2))s)"
+    fi
     sleep 2
   done
   journalctl -u kaidi-finance.service -n 80 --no-pager >&2 || true
@@ -573,10 +586,14 @@ backup_managed_state() {
     fi
     index=$((index + 1))
   done
-  systemctl is-active --quiet kaidi-finance.service && PREVIOUS_APP_ACTIVE=true || PREVIOUS_APP_ACTIVE=false
+  systemctl is-active --quiet kaidi-finance.service >/dev/null 2>&1 \
-  systemctl is-enabled --quiet kaidi-finance.service && PREVIOUS_APP_ENABLED=true || PREVIOUS_APP_ENABLED=false
+    && PREVIOUS_APP_ACTIVE=true || PREVIOUS_APP_ACTIVE=false
-  systemctl is-active --quiet kaidi-update.path && PREVIOUS_UPDATE_ACTIVE=true || PREVIOUS_UPDATE_ACTIVE=false
+  systemctl is-enabled --quiet kaidi-finance.service >/dev/null 2>&1 \
-  systemctl is-enabled --quiet kaidi-update.path && PREVIOUS_UPDATE_ENABLED=true || PREVIOUS_UPDATE_ENABLED=false
+    && PREVIOUS_APP_ENABLED=true || PREVIOUS_APP_ENABLED=false
+  systemctl is-active --quiet kaidi-update.path >/dev/null 2>&1 \
+    && PREVIOUS_UPDATE_ACTIVE=true || PREVIOUS_UPDATE_ACTIVE=false
+  systemctl is-enabled --quiet kaidi-update.path >/dev/null 2>&1 \
+    && PREVIOUS_UPDATE_ENABLED=true || PREVIOUS_UPDATE_ENABLED=false
   INSTALL_TRANSACTION_ARMED=true
 }
 

scripts/publish-gitea-release.sh

@@ -48,6 +48,7 @@ request() {
   local method=$1 url=$2 output=$3 input=${4:-} status
   local args=(
     --silent --show-error --proto '=https' --tlsv1.2
+    --connect-timeout 15 --max-time 600 --retry 5 --retry-all-errors --retry-delay 2
     --request "$method" --header "@$AUTH_HEADER"
     --output "$output" --write-out '%{http_code}'
   )
@@ -99,6 +100,7 @@ for name in "${ASSETS[@]}"; do
     >> "$WORK/expected-assets.jsonl"
   encoded_name=$(jq -rn --arg value "$name" '$value | @uri')
   upload_status=$(curl --silent --show-error --proto '=https' --tlsv1.2 \
+    --connect-timeout 15 --max-time 1800 --retry 6 --retry-all-errors --retry-delay 2 \
     --header "@$AUTH_HEADER" \
     --form "attachment=@$path;type=application/octet-stream" \
     --output "$WORK/upload.json" --write-out '%{http_code}' \

scripts/test-install-fixture.sh

@@ -30,10 +30,14 @@ fail() {
   sed -n '/^release_asset_url()/,/^}/p' "$ROOT/deploy/install.sh"
   sed -n '/^download_release_asset()/,/^}/p' "$ROOT/deploy/install.sh"
   sed -n '/^install_packages()/,/^}/p' "$ROOT/deploy/install.sh"
+  sed -n '/^preflight_database()/,/^}/p' "$ROOT/deploy/install.sh"
 } > "$WORK/helpers.sh"
 # shellcheck disable=SC1090,SC1091
 source "$WORK/helpers.sh"
 
+export SETUP_WIZARD=true
+preflight_database || fail 'setup wizard database preflight returned a failure status'
+
 # shellcheck disable=SC2034 # Referenced by the extracted installer helper.
 REINSTALL=true
 # shellcheck disable=SC2034 # Referenced by the extracted installer helper.
@@ -235,6 +239,11 @@ grep -Fq 'java_sha256=$(jq -er' "$ROOT/deploy/install.sh" \
   || fail 'installer no longer obtains the Java runtime SHA-256'
 grep -Fq 'Using existing Java 17 runtime' "$ROOT/deploy/install.sh" \
   || fail 'installer no longer reuses a local Java 17 runtime'
+# shellcheck disable=SC2016 # Match the literal installer command.
+grep -Fq -- '--connect-timeout 1 --max-time 2 "$HEALTH_URL" 2>/dev/null' "$ROOT/deploy/install.sh" \
+  || fail 'installer no longer performs a quiet bounded health check'
+grep -Fq 'restart_count" -ge 3' "$ROOT/deploy/install.sh" \
+  || fail 'installer no longer stops early after repeated service restarts'
 # shellcheck disable=SC2016 # Match literal installer source.
 grep -Fq '[ "$actual_sha256" = "$java_sha256" ]' "$ROOT/deploy/install.sh" \
   || fail 'installer no longer verifies the Java runtime SHA-256'