fix: leave setup wizard after completion

README.md

@@ -56,7 +56,7 @@ PostgreSQL 18 兼容工作继续冻结。
 先在宝塔面板停止并删除当前错误的 Java 项目，再执行：
 
 ```bash
-curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-preview.29/install.sh | sudo env KAIDI_APP_PORT=18080 bash
+curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-preview.30/install.sh | sudo env KAIDI_APP_PORT=18080 bash
 ```
 
 该命令只安装程序运行所需的 systemd 单元，自动创建 `kaidi` 用户并检测现有 Java 17（包括

deploy/purge.sh

@@ -67,8 +67,61 @@ related_pids() {
   done
 }
 
+managed_service_account() {
+  local entry home shell
+  entry=$(getent passwd "$SERVICE_USER" 2>/dev/null || true)
+  [ -n "$entry" ] || return 1
+  home=$(printf '%s\n' "$entry" | awk -F: '{print $6}')
+  shell=$(printf '%s\n' "$entry" | awk -F: '{print $7}')
+  case "$home:$shell" in
+    "$STATE_ROOT:"*/nologin|"$STATE_ROOT:"*/false) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+service_user_pids() {
+  local uid=$1 proc pid owner_uid
+  for proc in /proc/[0-9]*; do
+    [ -d "$proc" ] || continue
+    pid=${proc##*/}
+    owner_uid=$(stat -c '%u' "$proc" 2>/dev/null || true)
+    [ "$owner_uid" = "$uid" ] && printf '%s\n' "$pid"
+  done
+}
+
+terminate_uid_processes() {
+  local uid=$1 deadline
+  local -a pids=()
+  mapfile -t pids < <(service_user_pids "$uid")
+  if [ "${#pids[@]}" -gt 0 ]; then
+    log "Stopping processes owned by the dedicated $SERVICE_USER account: ${pids[*]}"
+    kill -TERM "${pids[@]}" 2>/dev/null || true
+  fi
+  deadline=$((SECONDS + 5))
+  while [ "$SECONDS" -lt "$deadline" ]; do
+    mapfile -t pids < <(service_user_pids "$uid")
+    [ "${#pids[@]}" -gt 0 ] || return 0
+    sleep 1
+  done
+  kill -KILL "${pids[@]}" 2>/dev/null || true
+  sleep 1
+  mapfile -t pids < <(service_user_pids "$uid")
+  [ "${#pids[@]}" -eq 0 ]
+}
+
+all_pids_owned_by_service_user() {
+  local service_uid pid owner_uid
+  managed_service_account || return 1
+  service_uid=$(id -u "$SERVICE_USER")
+  for pid in "$@"; do
+    [ -d "/proc/$pid" ] || continue
+    owner_uid=$(stat -c '%u' "/proc/$pid" 2>/dev/null || true)
+    [ "$owner_uid" = "$service_uid" ] || return 1
+  done
+}
+
 stop_managed_processes() {
-  local deadline
+  local allow_service_restart=${1:-false} deadline
   local -a pids=()
   mapfile -t pids < <(related_pids)
   if [ "${#pids[@]}" -gt 0 ]; then
@@ -84,8 +137,12 @@ stop_managed_processes() {
   kill -KILL "${pids[@]}" 2>/dev/null || true
   sleep 1
   mapfile -t pids < <(related_pids)
-  [ "${#pids[@]}" -eq 0 ] \
+  [ "${#pids[@]}" -eq 0 ] && return 0
-    || die "A process manager is restarting Kaidi; remove the Kaidi project from Baota and run this command again"
+  if [ "$allow_service_restart" = true ] && all_pids_owned_by_service_user "${pids[@]}"; then
+    log "A process manager restarted the dedicated $SERVICE_USER account; forced account cleanup will stop it"
+    return 0
+  fi
+  die "A process manager is restarting Kaidi; remove the Kaidi project from Baota and run this command again"
 }
 
 create_recovery_backup() {
@@ -120,6 +177,10 @@ create_recovery_backup() {
 
 remove_systemd_units() {
   local unit
+  rm -rf \
+    /etc/systemd/system/kaidi-finance.service.d \
+    /etc/systemd/system/kaidi-update.service.d \
+    /etc/systemd/system/kaidi-update.path.d
   rm -f \
     /etc/systemd/system/kaidi-finance.service \
     /etc/systemd/system/kaidi-update.service \
@@ -149,15 +210,23 @@ remove_download_archives() {
 }
 
 remove_service_identity() {
-  local entry home shell group_entry gid members primary_users
+  local entry home shell service_uid group_entry gid members primary_users
   entry=$(getent passwd "$SERVICE_USER" 2>/dev/null || true)
   if [ -n "$entry" ]; then
     home=$(printf '%s\n' "$entry" | awk -F: '{print $6}')
     shell=$(printf '%s\n' "$entry" | awk -F: '{print $7}')
     case "$home:$shell" in
       "$STATE_ROOT:"*/nologin|"$STATE_ROOT:"*/false)
-        userdel "$SERVICE_USER" \
+        service_uid=$(id -u "$SERVICE_USER")
+        terminate_uid_processes "$service_uid" || true
+        if ! userdel --force "$SERVICE_USER"; then
+          terminate_uid_processes "$service_uid" || true
+          userdel --force "$SERVICE_USER" \
             || die "Failed to remove the dedicated $SERVICE_USER service account"
+        fi
+        terminate_uid_processes "$service_uid" \
+          || die "Processes owned by the removed $SERVICE_USER account are still running"
+        rm -rf "/run/user/$service_uid"
         ;;
       *)
         log "Keeping pre-existing user $SERVICE_USER because its home or shell is not Kaidi-managed"
@@ -182,13 +251,13 @@ main() {
   validate_inputs
   log "External MySQL data and reverse-proxy configuration will not be modified"
   stop_systemd_units
-  stop_managed_processes
+  stop_managed_processes true
   create_recovery_backup
   remove_systemd_units
   remove_managed_paths
   remove_download_archives
   remove_service_identity
-  stop_managed_processes
+  stop_managed_processes false
   log "Local Kaidi installation state has been removed"
   if [ -n "$BACKUP_ARCHIVE" ]; then
     log "Recovery backup: $BACKUP_ARCHIVE"

frontend/e2e/setup-wizard.e2e.ts

@@ -137,3 +137,69 @@ test('confirms completion after the setup response is interrupted by a service r
   await expect(page.getByText('网络请求失败')).toHaveCount(0);
   await expect(page).toHaveURL(/\/login$/, { timeout: 15_000 });
 });
+
+test('leaves the completed wizard when post-completion status polling is unavailable', async ({ page }) => {
+  let completionStarted = false;
+  await page.route('**/api/v1/setup/**', async (route) => {
+    const request = route.request();
+    const pathname = new URL(request.url()).pathname;
+    if (pathname === '/api/v1/setup/status') {
+      if (completionStarted) {
+        await route.abort('connectionreset');
+        return;
+      }
+      await route.fulfill({
+        json: {
+          data: {
+            required: true,
+            locked: false,
+            ready: false,
+            supportedDatabaseTypes: ['MYSQL'],
+            message: '请完成安装',
+          },
+        },
+      });
+      return;
+    }
+    const body = request.postDataJSON() as Record<string, unknown>;
+    if (pathname.endsWith('/test-connection')) {
+      await route.fulfill({
+        json: {
+          data: {
+            successful: true,
+            databaseType: 'MYSQL',
+            serverVersion: '8.4.6',
+            schemaReady: true,
+            message: 'MySQL 8.4 连接、排序规则和完整迁移权限验证通过',
+          },
+        },
+      });
+      return;
+    }
+    expect(body.adminUsername).toBe('admin');
+    completionStarted = true;
+    await route.fulfill({
+      json: {
+        data: {
+          completed: true,
+          username: 'admin',
+          message: '安装完成，系统正在切换到正式模式',
+          restartAfterSeconds: 1,
+        },
+      },
+    });
+  });
+
+  await page.goto('/setup');
+  await page.getByLabel('数据库密码').fill('fixture-db-password');
+  await page.getByLabel('安装码').fill('fixture-setup-code');
+  await page.getByRole('button', { name: '测试连接' }).click();
+  await page.getByRole('button', { name: '下一步' }).click();
+  await page.getByLabel('管理员密码').fill('SetupAdmin@2026Strong');
+  await page.getByLabel('确认密码').fill('SetupAdmin@2026Strong');
+  await page.getByRole('button', { name: '完成安装' }).click();
+  await page.getByRole('button', { name: '确定', exact: true }).click();
+
+  await expect(page.getByText('安装完成', { exact: true })).toBeVisible();
+  await expect(page).toHaveURL(/\/login$/, { timeout: 5_000 });
+});

frontend/src/pages/setup/index.vue

@@ -378,19 +378,18 @@ function confirmSetup() {
 function startCountdown() {
   window.clearInterval(countdownTimer);
   countdownTimer = window.setInterval(() => {
-    countdown.value -= 1;
+    countdown.value = Math.max(0, countdown.value - 1);
-    if (countdown.value <= 0) void openLogin();
+    if (countdown.value === 0) openLogin();
   }, 1000);
 }
 
-async function openLogin() {
+function openLogin() {
   window.clearInterval(countdownTimer);
-  completionMessage.value = '系统正在启动，请稍候。';
+  countdown.value = 0;
-  if (await waitForSetupCompletion()) {
+  completionMessage.value = '正在进入登录页。';
-    await router.replace('/login');
+  // A full navigation clears the setup-mode SPA state retained across the
-    return;
+  // service restart. The login route guard performs the final setup check.
-  }
+  window.location.replace('/login');
-  completionMessage.value = '系统启动时间较长，请稍后刷新页面。';
 }
 
 onMounted(async () => {

scripts/test-purge-fixture.sh

@@ -83,5 +83,13 @@ grep -Fq 'KAIDI_PURGE_CONFIRM=$REQUIRED_CONFIRMATION' "$ROOT/deploy/purge.sh" \
   || fail 'destructive removal no longer requires explicit confirmation'
 grep -Fq 'External MySQL data and reverse-proxy configuration will not be modified' "$ROOT/deploy/purge.sh" \
   || fail 'purge boundary is no longer explicit'
+# shellcheck disable=SC2016 # Match literal service-account cleanup calls.
+grep -Fq 'terminate_uid_processes "$service_uid"' "$ROOT/deploy/purge.sh" \
+  || fail 'dedicated service-account processes are not terminated before account removal'
+# shellcheck disable=SC2016 # Match literal forced account removal.
+grep -Fq 'userdel --force "$SERVICE_USER"' "$ROOT/deploy/purge.sh" \
+  || fail 'dedicated service-account removal is not resilient to a restarting panel process'
+grep -Fq '/etc/systemd/system/kaidi-update.service.d' "$ROOT/deploy/purge.sh" \
+  || fail 'updater systemd drop-ins are not removed'
 
 printf 'Local purge and recovery fixture passed\n'