fix: keep release downloads on configured origin

feat: migrate releases to git.awaioi.com
fix: preserve updater across systemd restart
2026-08-05 06:23:39 +08:00 · 2026-08-05 06:08:47 +08:00 · 2026-08-04 22:31:20 +08:00 · 2026-08-04 21:25:43 +08:00 · 2026-08-04 20:05:50 +08:00 · 2026-08-04 17:44:25 +08:00
31 changed files with 2830 additions and 231 deletions
@@ -25,6 +25,12 @@ jobs:
        with:
          fetch-depth: 0

+      - name: Set up Java 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "17"
+
      - name: Build, sign, and publish release
        shell: bash
        run: |
@@ -54,12 +60,34 @@ jobs:

          umask 077
          key_file="${RUNNER_TEMP:-/tmp}/kaidi-erp-release-key.pem"
-          cleanup() { rm -f "$key_file" release.json release-payload.json; }
+          cleanup() { rm -f "$key_file" release.json release-payload.json release-notes.md; }
          trap cleanup EXIT
          printf '%s' "$RELEASE_PRIVATE_KEY_B64" | base64 --decode > "$key_file"
          export ERP_RELEASE_PRIVATE_KEY_FILE="$key_file"
+          bash tests/release-scripts.test.sh
+          (
+            cd oa-backend
+            ./gradlew test installerTest
+          )
          bash scripts/package-release.sh "$version"

+          previous_tag="$(git describe --tags --match 'v[0-9]*' --abbrev=0 "${tag}^" 2>/dev/null || true)"
+          change_range="$tag"
+          [[ -z "$previous_tag" ]] || change_range="$previous_tag..$tag"
+          {
+            printf '## 更新内容\n\n'
+            if ! git log --no-merges --format='- %s (`%h`)' "$change_range"; then
+              printf -- '- Kaidi ERP %s 正式发布\n' "$version"
+            fi
+            printf '\n## 安全校验\n\n'
+            printf -- '- 安装包：`kaidi-erp-%s.tar.gz`\n' "$version"
+            printf -- '- 完整性：SHA-256\n'
+            printf -- '- 发布签名：Ed25519\n'
+            if [[ -n "$previous_tag" ]]; then
+              printf '\n上一个正式版本：`%s`\n' "$previous_tag"
+            fi
+          } > release-notes.md
+
          owner="${repository%%/*}"
          repo="${repository#*/}"
          release_api="${api_base%/}/api/v1/repos/$owner/$repo/releases"
@@ -69,13 +97,15 @@ jobs:
            --header "$auth_header" --header 'Accept: application/json' \
            "$release_api/tags/$tag")"

-          python3 - "$tag" > release-payload.json <<'PY'
+          python3 - "$tag" release-notes.md > release-payload.json <<'PY'
          import json, sys
          tag = sys.argv[1]
+          with open(sys.argv[2], encoding="utf-8") as handle:
+              notes = handle.read().strip()
          print(json.dumps({
              "tag_name": tag,
-              "name": tag,
-              "body": f"Kaidi ERP {tag}",
+              "name": f"Kaidi ERP {tag}",
+              "body": notes,
              "draft": False,
              "prerelease": "-" in tag.split("+", 1)[0],
          }, separators=(",", ":")))
@@ -97,6 +127,9 @@ jobs:
          fi

          release_id="$(python3 -c 'import json; print(json.load(open("release.json"))["id"])')"
+          curl "${curl_protocols[@]}" --fail-with-body --silent --show-error --location --retry 3 \
+            --header "$auth_header" --header 'Accept: application/json' \
+            --output release.json "$release_api/$release_id"
          for asset in "dist/kaidi-erp-$version.tar.gz" "dist/kaidi-erp-installer-$version.jar" dist/SHA256SUMS dist/SHA256SUMS.sig; do
            name="$(basename "$asset")"
            encoded_name="$(python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1], safe=""))' "$name")"
@@ -49,6 +49,7 @@ Administrator -> System Update UI -> erp-update helper
 |- README.md
 |- run.command                       # macOS 本地预览与 ngrok 启动器
 |- install.sh                        # 非 Docker 一键安装器
+|- uninstall.sh                      # Linux 完整卸载与数据库 schema 重置
 |- distribution/
 |  |- bin/erp-run                    # 正式环境应用启动器
 |  `- bin/erp-update                 # 下载、校验、切换和回滚助手
@@ -72,7 +73,7 @@ Administrator -> System Update UI -> erp-update helper
 克隆仓库并进入开发分支：

 ```bash
-git clone git@38.76.196.225:awaioi/ERP.git
+git clone https://git.awaioi.com/awaioi/ERP.git
 cd ERP
 git switch dev
 git config core.hooksPath .githooks
@@ -110,7 +111,7 @@ PostgreSQL-only 正式构建：

 ```bash
 cd oa-backend
-./gradlew clean bootJar -PreleaseVersion=0.2.0 -PproductionBuild=true
+./gradlew clean bootJar -PreleaseVersion=0.3.8 -PproductionBuild=true
 ```

 正式 JAR 必须包含 PostgreSQL 驱动，并且不得包含 `sqlite-jdbc` 或 `hibernate-community-dialects`。
@@ -167,49 +168,72 @@ https://resonant-elated-launder.ngrok-free.dev/

 ### Linux 一键安装

-生产环境应先为 Gitea 配置 HTTPS：
+官方 Gitea 已启用 HTTPS，Linux 可直接执行：

 ```bash
-curl -fsSL https://git.example.com/awaioi/ERP/raw/branch/main/install.sh \
-  | sudo -E bash -s -- \
-      --gitea-url https://git.example.com \
-      --repository awaioi/ERP
+curl -fsSL https://git.awaioi.com/awaioi/ERP/raw/branch/main/install.sh | sudo -E bash
 ```

+安装器默认使用 `https://git.awaioi.com` 和 `awaioi/ERP`；私有镜像或分叉仓库仍可通过 `--gitea-url` 和 `--repository` 覆盖。
+
 命令行只做环境准备：优先使用已有的 Java 17+，缺少时通过当前系统的 `apt-get`、`dnf`、`yum`、`zypper` 或 Homebrew 安装 Java、curl、tar、Python 3 和 OpenSSL 3，然后下载并启动独立安装器。数据库信息不在命令行输入。

-安装器启动后会输出带一次性令牌的局域网地址，例如：
+Linux 生产服务要求主机使用 systemd；没有 systemd 的容器、WSL 或精简系统只能显式使用 `--no-service` 做开发验收，在线更新也会保持关闭。
+
+安装器启动后会输出带一次性令牌的访问地址。优先级依次为：命令行 `--public-url`（或 `ERP_PUBLIC_URL`）、HTTPS 服务探测到的公网 IP、局域网 IP。无论使用哪一种方式，都会同时输出仅服务器本机可用的 `Local URL`；公网探测失败时还会明确提示正在回退局域网地址。公网服务器建议显式传入地址，避免 NAT、多网卡或代理环境识别错误：

 ```text
-Setup URL: http://192.168.1.20:8091/?token=<one-time-token>
+Setup URL: https://erp.example.com/?token=<one-time-token>
+Local URL: http://127.0.0.1:8091/?token=<one-time-token>
 ```

+`--public-url` 支持域名、端口、路径和已有查询参数，安装器会安全追加一次性 `token`。使用公网 IP 直连时需要在防火墙或安全组放行 ERP 端口；通过 HTTPS 反向代理安装时，应将公开域名作为 `--public-url`。
+
 首次打开该地址进入网页向导，依次完成环境检查、PostgreSQL 地址/端口/库名/账号/密码/SSL 测试、管理员账号/姓名/密码设置、数据库迁移和初始化。项目当前没有 Redis 依赖，因此向导不会显示 Redis 配置项。正式服务真实健康检查通过后，启动器才会原子写入安装锁并物理删除 `installer/` 和 `install.pending`。

+PostgreSQL 必须使用专用空数据库，网页中填写的账号必须是该数据库的所有者。该约束保证账号拥有 `public` schema 建表权限，并能持有安装器创建的 `pg_trgm` 扩展；只授予 `CONNECT` 权限不足以完成迁移。
+
 ### macOS

 macOS 需要 Homebrew，并使用已有 PostgreSQL：

 ```bash
-curl -fsSL https://git.example.com/awaioi/ERP/raw/branch/main/install.sh \
-  | bash -s -- \
-      --gitea-url https://git.example.com \
-      --repository awaioi/ERP
+curl -fsSL https://git.awaioi.com/awaioi/ERP/raw/branch/main/install.sh | bash
 ```

-### 当前 HTTP 测试服务器
+### 当前正式版本

-当前 Gitea 地址 `http://38.76.196.225:10099` 只允许用于开发验收：
+需要固定安装 `v0.3.8` 并验证引导脚本 SHA-256 时：

 ```bash
-curl -fsSL http://38.76.196.225:10099/awaioi/ERP/raw/branch/main/install.sh \
-  | sudo -E bash -s -- \
-      --gitea-url http://38.76.196.225:10099 \
-      --repository awaioi/ERP \
-      --allow-insecure
+(
+  set -e
+  tmp="$(mktemp)"
+  trap 'rm -f -- "$tmp"' EXIT
+  curl -fsSL https://git.awaioi.com/awaioi/ERP/raw/tag/v0.3.8/install.sh -o "$tmp"
+  printf '%s  %s\n' 'ae6a6613d4abe37ba24b41e1901eaa3b29cc32939583302c7f62277922fbbe9b' "$tmp" | sha256sum -c -
+  sudo -E bash "$tmp" --version 0.3.8
+)
 ```

-只有首个 Release 发布后这条命令才可下载安装包。HTTP 会暴露请求、Release 元数据和可能使用的访问令牌，不得作为生产方案。
+只有 `v0.3.8` Release 发布后这条命令才可下载安装包。引导脚本通过固定 tag 和 SHA-256 校验，Release 资产继续执行 Ed25519 和 SHA-256 双重校验。
+
+### 完整卸载后重装
+
+以下命令具有破坏性：它会先停止服务，使用现有配置中的 ERP 数据库账号删除并重建目标数据库的 `public` schema，然后删除 systemd unit、程序、配置、状态和日志。脚本只允许数据库所有者执行 schema 清理，并拒绝 `postgres`、`template0`、`template1` 和危险文件路径。
+
+```bash
+(
+  set -e
+  tmp="$(mktemp)"
+  trap 'rm -f -- "$tmp"' EXIT
+  curl -fsSL https://git.awaioi.com/awaioi/ERP/raw/tag/v0.3.8/uninstall.sh -o "$tmp"
+  printf '%s  %s\n' '98c56fed2fd4d01874e4ab5a1a4f3ec42ec3e29b315ffd87385a95488d587546' "$tmp" | sha256sum -c -
+  sudo -E bash "$tmp" --purge-database --yes
+)
+```
+
+卸载器会先核对安装配置、路径和 systemd 停止状态，再清理数据库和文件。卸载成功后，再执行上面的 Linux 一键安装命令。不要对包含其他系统数据的共享数据库运行此命令。

 ### 正式安装目录

@@ -226,15 +250,41 @@ Linux 默认路径：

 使用 `--no-service` 只用于开发验收：启动器会在当前用户下运行，但默认设置 `OA_UPDATE_ENABLED=false`。生产环境应使用 systemd/launchd，让在线更新可以在 Java 进程退出后自动拉起新版本。

+### HTTPS 反向代理
+
+正式安装默认监听 `8091`（可通过 `ERP_SERVER_PORT` 覆盖）。Nginx、宝塔、Caddy 或 CDN 终止 HTTPS 后，必须把公网协议和主机转发给 Spring Boot；否则浏览器的同源 API 请求会被误判为跨域，并收到纯文本 `403 Invalid CORS request`，前端表现为“响应非 JSON (HTTP 403)”。Nginx 的代理位置至少包含：
+
+```nginx
+location / {
+    proxy_pass http://127.0.0.1:8091;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Host $host;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Port $server_port;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+}
+```
+
+如果 Nginx 前面还有 Cloudflare 等上游代理，`X-Forwarded-Proto` 必须保留浏览器实际使用的 `https`，不能被内层 HTTP 链路覆盖。前端与 `/api/oa/*` 推荐使用同一个公网域名；不要在 Nginx 中附加 `Access-Control-Allow-Origin *`。
+
 ## 在线更新与回滚

-管理员登录后进入：
+管理员登录后可从以下任一入口进入：

 ```text
+顶部工具栏 -> 系统更新
+用户菜单 -> 系统更新
+手机导航抽屉 -> 系统更新
 应用定制平台 -> 系统更新
 ```

-对应前端路由为 `/appdev/update`，后端 API 为 `/api/oa/system-update/*`。更新过程如下：
+入口只对 `ADMIN` 角色显示，对应前端路由为 `/appdev/update`，后端 API 为 `/api/oa/system-update/*`。页面只显示当前版本、在线最新版本、检查时间、最新版本更新日志、历史正式版本，以及下载、验签、安装、重启和自动回滚进度。顶部和手机入口发现新版本时会显示版本提示。
+
+更新源由安装器写入服务器的 `/etc/kaidi-erp/erp.env`，后台页面不会要求管理员重复填写 Gitea 地址、仓库、Token、通道或 HTTP 开关。`v0.3.8` 启动时会把旧官方地址 `http://38.76.196.225:10099` 自动迁移到 `https://git.awaioi.com`；其他自定义地址保持不变。需要变更基础设施配置时由服务器运维人员修改 `OA_UPDATE_*` 环境变量并重启服务；公开仓库无需 Token，正式环境应使用 HTTPS。
+
+更新过程如下：

 1. 从 Gitea 读取 stable channel 的最新 Release。
 2. 下载归档、`SHA256SUMS` 和 Ed25519 签名（Release 里的独立安装器资产只用于首次安装）。
@@ -242,13 +292,13 @@ Linux 默认路径：
 4. 校验 `manifest.json` 中的版本、`database=postgresql` 和 `rollbackCompatible=true`。
 5. 可选执行 `pg_dump`，将新版本写入独立目录。
 6. 原子切换 `current` 符号链接，并停止旧 Java 进程。
-7. systemd/launchd 拉起新版本，更新助手等待新的 PID 和 `/api/oa/health`。
+7. systemd/launchd 拉起新版本，更新助手等待新的 PID 和 `/api/oa/health`；Linux unit 使用 `KillMode=process`，确保更新助手不会随旧 Java 进程一起被 systemd 清理。
 8. 新版本不健康时切回上一链接，终止故障进程并再次验证旧版本健康状态。

 同一安装目录使用操作系统文件锁，不能并发执行两个更新任务。也可以手工触发：

 ```bash
-/opt/kaidi-erp/current/bin/erp-update install 0.2.0
+/opt/kaidi-erp/current/bin/erp-update install 0.3.8
 ```

 应用回滚不等于数据库回滚。包含不可逆 Flyway 迁移的版本必须先保证旧应用仍兼容新结构，并建议在安装配置中启用：
@@ -261,7 +311,7 @@ ERP_UPDATE_BACKUP_MODE=pg_dump

 ## Gitea Release 发布

-推送 `v*` tag 会触发 `.gitea/workflows/release.yml`。流水线会构建前端、生成 PostgreSQL-only JAR、打包、签名，并创建或更新对应 Gitea Release。
+推送 `v*` tag 会触发 `.gitea/workflows/release.yml`。流水线会先执行 shell、后端和独立安装器测试，再构建前端、生成 PostgreSQL-only JAR、打包、签名，并创建或更新对应 Gitea Release。

 ### Actions 前置配置

@@ -276,7 +326,7 @@ Gitea 1.27 仓库需要启用 Actions，并配置带 `ubuntu-latest` 标签的
 流水线使用 Gitea 内置短期 `GITEA_TOKEN`，权限限定为代码只读、当前仓库 Release 可写。仓库设置只需添加：

 - Secret `RELEASE_PRIVATE_KEY_B64`
- 当前纯 HTTP 测试服务器额外添加 Variable `ERP_RELEASE_ALLOW_INSECURE_HTTP=1`（Gitea 禁止变量名以保留前缀 `GITEA_` 或 `GITHUB_` 开头）
+- `ERP_RELEASE_ALLOW_INSECURE_HTTP` 保持未设置；正式 Release API 和资产下载固定使用 HTTPS

 签名私钥不得提交到 Git。生成 Secret 值：

@@ -289,8 +339,8 @@ base64 < ~/.config/kaidi-erp/release-signing-key.pem | tr -d '\n'
 ```bash
 git switch main
 git pull --ff-only origin main
-git tag -a v0.2.0 -m 'Kaidi ERP v0.2.0'
-git push origin v0.2.0
+git tag -a v0.3.8 -m 'Kaidi ERP v0.3.8'
+git push origin v0.3.8
 ```

 发布完成后必须确认 Release 页面存在四个资产，并使用仓库中的 `distribution/release-public-key.pem` 验证签名。私钥与该公钥不匹配时打包脚本会直接失败。
@@ -299,7 +349,7 @@ git push origin v0.2.0

 ```bash
 ERP_RELEASE_PRIVATE_KEY_FILE="$HOME/.config/kaidi-erp/release-signing-key.pem" \
-  bash scripts/package-release.sh 0.2.0
+  bash scripts/package-release.sh 0.3.8
 ```

 ## 配置参考
@@ -313,11 +363,12 @@ ERP_RELEASE_PRIVATE_KEY_FILE="$HOME/.config/kaidi-erp/release-signing-key.pem" \
 | `OA_DB_POOL_MAX` | 最大连接池 | `20` |
 | `OA_DB_POOL_MIN` | 最小空闲连接 | `2` |
 | `OA_UPDATE_ENABLED` | 启用管理后台在线更新 | 安装服务时为 `true` |
-| `OA_UPDATE_GITEA_BASE_URL` | Gitea 外部地址 | 正式安装时写入 |
+| `OA_UPDATE_GITEA_BASE_URL` | Gitea 外部地址 | `https://git.awaioi.com` |
 | `OA_UPDATE_REPOSITORY` | Release 仓库 | `awaioi/ERP` |
 | `OA_UPDATE_CHANNEL` | 更新通道 | `stable` |
 | `OA_UPDATE_TOKEN` | 私有仓库下载令牌 | 空；公开仓库不需要 |
 | `OA_UPDATE_ALLOW_INSECURE_HTTP` | 允许 HTTP 更新地址 | `false` |
+| `ERP_PUBLIC_URL` | 首次安装向导的公网 URL，等价于 `--public-url` | 自动探测公网 IP |
 | `OA_SEED_DEMO` | 是否生成演示数据 | 正式安装为 `false` |
 | `ERP_UPDATE_BACKUP_MODE` | 更新前数据库备份 | `none`，可设 `pg_dump` |
 | `ERP_UPDATE_HEALTH_TIMEOUT_SECONDS` | 新旧版本健康检查超时 | `120` |
@@ -389,6 +440,10 @@ Gitea 仓库尚未发布首个可安装版本，或 Release 缺少四个必需

 运行 `ngrok config check` 确认配置有效，并检查固定域名是否属于当前 ngrok 账号。可以通过 `ERP_RUN_NGROK_BIN`、`ERP_RUN_NGROK_CONFIG` 和 `ERP_RUN_NGROK_API_PORT` 覆盖路径与端口。

+### 反向代理后提示“响应非 JSON (HTTP 403)”
+
+应用自身的 401/403 权限错误始终是 JSON。该提示表示 Nginx、WAF 或 Spring CORS 层提前返回了纯文本/HTML。先确认代理目标为正式安装端口（默认 `http://127.0.0.1:8091`），再按“HTTPS 反向代理”一节补齐 `Host` 和 `X-Forwarded-*` 请求头；响应正文为 `Invalid CORS request` 时即可确认是协议/主机转发不完整。
+
 ### 签名验证失败

 不要跳过验证。确认 Release 的四个资产来自同一次构建、`SHA256SUMS` 未被改写、签名私钥与 `distribution/release-public-key.pem` 匹配。
@@ -403,7 +458,7 @@ Gitea 仓库尚未发布首个可安装版本，或 Release 缺少四个必需
 远程仓库：

 ```text
-git@38.76.196.225:awaioi/ERP.git
+https://git.awaioi.com/awaioi/ERP.git
 ```

 ## 延伸文档
@@ -8,6 +8,44 @@ CONFIG_FILE="${ERP_CONFIG_FILE:-$INSTALL_ROOT/config/erp.env}"
 say() { printf '[ERP] %s\n' "$*"; }
 fail() { printf '[ERP] ERROR: %s\n' "$*" >&2; exit 1; }

+migrate_legacy_update_source() {
+  local legacy_url='http://38.76.196.225:10099'
+  local official_url='https://git.awaioi.com'
+  local configured_url="${OA_UPDATE_GITEA_BASE_URL:-}"
+  [[ "${configured_url%/}" == "$legacy_url" ]] || return 0
+
+  local temporary
+  temporary="$(mktemp "${CONFIG_FILE}.migration.XXXXXX")" \
+    || fail 'unable to create the update-source migration file'
+  if awk -v official_url="$official_url" '
+    BEGIN { base_url_written = 0; insecure_written = 0 }
+    /^OA_UPDATE_GITEA_BASE_URL=/ {
+      if (!base_url_written) print "OA_UPDATE_GITEA_BASE_URL=\047" official_url "\047"
+      base_url_written = 1
+      next
+    }
+    /^OA_UPDATE_ALLOW_INSECURE_HTTP=/ {
+      if (!insecure_written) print "OA_UPDATE_ALLOW_INSECURE_HTTP=\047false\047"
+      insecure_written = 1
+      next
+    }
+    { print }
+    END {
+      if (!base_url_written) print "OA_UPDATE_GITEA_BASE_URL=\047" official_url "\047"
+      if (!insecure_written) print "OA_UPDATE_ALLOW_INSECURE_HTTP=\047false\047"
+    }
+  ' "$CONFIG_FILE" > "$temporary" && chmod 600 "$temporary" && mv -f "$temporary" "$CONFIG_FILE"; then
+    say "Update source migrated to $official_url"
+  else
+    rm -f "$temporary"
+    say "WARNING: could not persist the update source migration; using $official_url for this process"
+  fi
+
+  OA_UPDATE_GITEA_BASE_URL="$official_url"
+  OA_UPDATE_ALLOW_INSECURE_HTTP=false
+  export OA_UPDATE_GITEA_BASE_URL OA_UPDATE_ALLOW_INSECURE_HTTP
+}
+
 load_configuration() {
  [[ -r "$CONFIG_FILE" ]] || fail "configuration not readable: $CONFIG_FILE"
  set -a
@@ -15,12 +53,14 @@ load_configuration() {
  # shellcheck disable=SC1090
  source "$CONFIG_FILE"
  set +a
+  migrate_legacy_update_source

  RUN_DIR="${ERP_RUN_DIR:-$INSTALL_ROOT/run}"
  JAR_PATH="${ERP_JAR_PATH:-$INSTALL_ROOT/current/app/kaidi-erp.jar}"
  INSTALLER_JAR="${ERP_INSTALLER_JAR:-$INSTALL_ROOT/installer/kaidi-erp-installer.jar}"
  PENDING_FILE="${ERP_INSTALL_PENDING_FILE:-$INSTALL_ROOT/state/install.pending}"
  INSTALL_LOCK_FILE="${ERP_INSTALL_LOCK_FILE:-$INSTALL_ROOT/state/install.lock}"
+  INSTALL_LOG_FILE="${ERP_INSTALL_LOG_FILE:-$(dirname "$PENDING_FILE")/install-formal.log}"
  HEALTH_URL="${ERP_HEALTH_URL:-http://127.0.0.1:${SERVER_PORT:-8091}/api/oa/health}"
  HEALTH_TIMEOUT_SECONDS="${ERP_INSTALL_HEALTH_TIMEOUT_SECONDS:-240}"
  HEALTH_POLL_SECONDS="${ERP_UPDATE_HEALTH_POLL_SECONDS:-2}"
@@ -98,10 +138,14 @@ run_pending_formal_application() {
  [[ "$HEALTH_POLL_SECONDS" =~ ^[1-9][0-9]*$ ]] || fail 'invalid health poll interval'

  say 'Starting the formal PostgreSQL application'
+  mkdir -p "$(dirname "$INSTALL_LOG_FILE")"
+  : > "$INSTALL_LOG_FILE"
+  chmod 600 "$INSTALL_LOG_FILE"
  "$JAVA_BIN" "${JAVA_OPTS[@]}" \
    -jar "$JAR_PATH" \
    --spring.profiles.active=postgres \
-    --server.port="${SERVER_PORT:-8091}" &
+    --server.port="${SERVER_PORT:-8091}" \
+    > >(tee -a "$INSTALL_LOG_FILE") 2>&1 &
  APP_PID=$!
  write_pid "$APP_PID"

@@ -118,6 +162,7 @@ run_pending_formal_application() {
      local status=$?
      set -e
      clear_pid "$APP_PID"
+      say "Formal application diagnostics: $INSTALL_LOG_FILE"
      fail "formal application exited before becoming healthy (status $status)"
    fi
    if curl -fsS --connect-timeout 2 --max-time 5 "$HEALTH_URL" >/dev/null 2>&1; then
@@ -137,6 +182,7 @@ run_pending_formal_application() {
  wait "$APP_PID"
  set -e
  clear_pid "$APP_PID"
+  say "Formal application diagnostics: $INSTALL_LOG_FILE"
  fail "formal application did not become healthy within ${HEALTH_TIMEOUT_SECONDS} seconds"
 }

@@ -25,6 +25,10 @@ REPOSITORY="${OA_UPDATE_REPOSITORY:-awaioi/ERP}"
 CHANNEL="${OA_UPDATE_CHANNEL:-stable}"
 TOKEN="${OA_UPDATE_TOKEN:-}"
 ALLOW_INSECURE="${OA_UPDATE_ALLOW_INSECURE_HTTP:-false}"
+if [[ "${GITEA_BASE_URL%/}" == "http://38.76.196.225:10099" ]]; then
+  GITEA_BASE_URL="https://git.awaioi.com"
+  ALLOW_INSECURE=false
+fi
 PUBLIC_KEY_FILE="${ERP_UPDATE_PUBLIC_KEY_FILE:-$INSTALL_ROOT/config/release-public-key.pem}"
 REQUIRE_SIGNATURE="${ERP_UPDATE_REQUIRE_SIGNATURE:-true}"
 BACKUP_MODE="${ERP_UPDATE_BACKUP_MODE:-none}"
@@ -44,14 +48,23 @@ import json, os, sys, tempfile
 from datetime import datetime, timezone

 path, phase, progress, message, version, error = sys.argv[1:]
-payload = {
+payload = {}
+try:
+    if os.path.getsize(path) <= 64 * 1024:
+        with open(path, encoding="utf-8") as handle:
+            existing = json.load(handle)
+        if isinstance(existing, dict):
+            payload = existing
+except (OSError, json.JSONDecodeError, TypeError, ValueError):
+    pass
+payload.update({
    "phase": phase,
    "progress": int(progress),
    "message": message,
    "version": version or None,
    "error": error or None,
    "updatedAt": datetime.now(timezone.utc).isoformat().replace("+00:00", "Z"),
-}
+})
 parent = os.path.dirname(path) or "."
 fd, tmp = tempfile.mkstemp(prefix=".update-state-", dir=parent, text=True)
 try:
@@ -207,12 +220,15 @@ if channel.lower() == "stable" and release.get("prerelease"):
    raise SystemExit("prerelease rejected on stable channel")
 if channel.lower() == "stable" and "-" in version.split("+", 1)[0]:
    raise SystemExit("prerelease tag rejected on stable channel")
-assets = {str(item.get("name")): str(item.get("browser_download_url") or "") for item in release.get("assets", [])}
+assets = {
+    str(item.get("name") or "")
+    for item in release.get("assets", [])
+    if isinstance(item, dict)
+}
 names = [f"kaidi-erp-{version}.tar.gz", "SHA256SUMS", "SHA256SUMS.sig"]
-urls = [assets.get(name, "") for name in names]
-if any(not value or any(ch.isspace() for ch in value) for value in urls):
+if any(name not in assets for name in names):
    raise SystemExit("release assets are incomplete")
-print("\t".join([version, *urls]))
+print("\t".join([version, tag]))
 PY
 }

@@ -358,7 +374,8 @@ install_release() {
    || fail "健康检查超时时间配置无效"
  [[ "$HEALTH_POLL_SECONDS" =~ ^[1-9][0-9]*$ ]] \
    || fail "健康检查间隔配置无效"
-  [[ "$REPOSITORY" =~ ^[^/[:space:]]+/[^/[:space:]]+$ ]] || fail "更新仓库配置无效"
+  [[ "$REPOSITORY" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}/[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ ]] \
+    || fail "更新仓库配置无效"
  require_command curl
  require_command python3
  require_command tar
@@ -373,9 +390,13 @@ install_release() {

  local selection="$TMP_DIR/selection"
  select_release "$release_json" "$requested" "$selection" || fail "Release 元数据验证失败" 10
-  local archive_url sums_url signature_url
-  IFS=$'\t' read -r TARGET_VERSION archive_url sums_url signature_url < "$selection"
+  local release_tag release_base archive_url sums_url signature_url
+  IFS=$'\t' read -r TARGET_VERSION release_tag < "$selection"
  local archive_name="kaidi-erp-${TARGET_VERSION}.tar.gz"
+  release_base="${GITEA_BASE_URL%/}/$owner/$repo/releases/download/$release_tag"
+  archive_url="$release_base/$archive_name"
+  sums_url="$release_base/SHA256SUMS"
+  signature_url="$release_base/SHA256SUMS.sig"
  local archive="$TMP_DIR/$archive_name" sums="$TMP_DIR/SHA256SUMS" signature="$TMP_DIR/SHA256SUMS.sig"

  write_state DOWNLOADING 20 "正在下载版本 ${TARGET_VERSION}" "$TARGET_VERSION"
@@ -16,7 +16,7 @@ Gitea Actions runner 需要预装 Java 17 或更高版本、Node.js/npm、Python
 流水线使用 Gitea 1.27 提供的短期 `GITEA_TOKEN`，权限限定为代码只读、当前仓库 Release 可写，不需要创建个人访问令牌。仓库 Actions 设置只需创建：

 - Secret `RELEASE_PRIVATE_KEY_B64`：Ed25519 私钥的单行 Base64 内容。
- Variable `ERP_RELEASE_ALLOW_INSECURE_HTTP`：生产环境不要设置；当前 HTTP 测试服务器必须显式设为 `1`。Gitea 不允许仓库变量名以保留前缀 `GITEA_` 或 `GITHUB_` 开头。
+- Variable `ERP_RELEASE_ALLOW_INSECURE_HTTP`：正式 HTTPS 服务器保持未设置；仅隔离的 HTTP 开发镜像才允许设为 `1`。Gitea 不允许仓库变量名以保留前缀 `GITEA_` 或 `GITHUB_` 开头。

 本机现有签名私钥位于 `~/.config/kaidi-erp/release-signing-key.pem`，不得提交到 Git。macOS 可用以下命令生成 Secret 值：

@@ -24,42 +24,79 @@ Gitea Actions runner 需要预装 Java 17 或更高版本、Node.js/npm、Python
 base64 < ~/.config/kaidi-erp/release-signing-key.pem | tr -d '\n'
 ```

-发布稳定版本：
+发布稳定版本（先确认发布提交已经同步到 `main` 和 `dev`）：

 ```bash
-git tag v0.2.0
-git push origin v0.2.0
+git switch main
+git pull --ff-only origin main
+git tag -a v0.3.8 -m 'Kaidi ERP v0.3.8'
+git push origin v0.3.8
 ```

 ## 首次安装

-推荐给 Gitea 配置 HTTPS 域名，然后执行：
+官方 Gitea 已启用 HTTPS，Linux 可直接执行：

 ```bash
-curl -fsSL https://git.example.com/awaioi/ERP/raw/branch/main/install.sh \
-  | sudo -E bash -s -- \
-      --gitea-url https://git.example.com \
-      --repository awaioi/ERP
+curl -fsSL https://git.awaioi.com/awaioi/ERP/raw/branch/main/install.sh | sudo -E bash
 ```

-命令行只检查并安装 Java 17+、curl、tar、Python 3 和 OpenSSL 3，然后启动独立安装器并输出带一次性 token 的网页地址。数据库、管理员和密码全部在首次网页向导填写；安装器会真实测试 PostgreSQL 15+ 和 `pg_trgm`，迁移完成并确认正式服务健康后才写 `install.lock`，随后物理删除安装器目录。
+命令行只检查并安装 Java 17+、curl、tar、Python 3 和 OpenSSL 3，然后启动独立安装器并输出带一次性 token 的网页地址。数据库、管理员和密码全部在首次网页向导填写；安装器会真实测试 PostgreSQL 15+、数据库所有权、`public` schema 建表权限和 `pg_trgm` 所有权，迁移完成并确认正式服务健康后才写 `install.lock`，随后物理删除安装器目录。

-当前 `http://38.76.196.225:10099` 仅用于开发测试，必须同时传入 `--allow-insecure`。HTTP 会暴露安装脚本、Release 元数据和 Gitea token，不应作为生产部署方式。
+安装器默认从 `https://git.awaioi.com/awaioi/ERP` 获取签名 Release。安装地址优先使用 `--public-url`（或 `ERP_PUBLIC_URL`）；未指定时依次尝试探测公网 IP、回退局域网 IP，并始终额外输出 `Local URL`。ERP 已绑定独立业务域名时可显式传入例如 `--public-url https://erp.example.com`。参数支持 HTTPS 域名、端口、路径和已有查询参数，安装器会安全追加 token，不会用局域网 IP 覆盖显式公网地址。
+
+目标 PostgreSQL 必须是专用空数据库，网页中填写的账号必须是该数据库的所有者。只拥有连接权限的账号会在网页连接测试阶段被拒绝，不再等到 Flyway 迁移后才显示笼统错误。
+
+Linux 生产服务要求主机使用 systemd；没有 systemd 的容器、WSL 或精简系统只能显式使用 `--no-service` 做开发验收，在线更新也会保持关闭。
+
+正式安装和更新不得启用 `--allow-insecure`。需要锁定版本时，应从固定 tag 下载引导脚本并验证本版本记录的 SHA-256。
+
+当前 `v0.3.8` 安装命令：
+
+```bash
+(
+  set -e
+  tmp="$(mktemp)"
+  trap 'rm -f -- "$tmp"' EXIT
+  curl -fsSL https://git.awaioi.com/awaioi/ERP/raw/tag/v0.3.8/install.sh -o "$tmp"
+  printf '%s  %s\n' 'ae6a6613d4abe37ba24b41e1901eaa3b29cc32939583302c7f62277922fbbe9b' "$tmp" | sha256sum -c -
+  sudo -E bash "$tmp" --version 0.3.8
+)
+```
+
+完整卸载并清空本项目数据库 schema 后重装：
+
+```bash
+(
+  set -e
+  tmp="$(mktemp)"
+  trap 'rm -f -- "$tmp"' EXIT
+  curl -fsSL https://git.awaioi.com/awaioi/ERP/raw/tag/v0.3.8/uninstall.sh -o "$tmp"
+  printf '%s  %s\n' '98c56fed2fd4d01874e4ab5a1a4f3ec42ec3e29b315ffd87385a95488d587546' "$tmp" | sha256sum -c -
+  sudo -E bash "$tmp" --purge-database --yes
+)
+```
+
+该命令会先确认安装路径与 `erp.env` 一致、systemd 服务已经停止，再删除目标数据库 `public` schema 中的全部对象以及 `/opt/kaidi-erp`、`/etc/kaidi-erp`、`/var/lib/kaidi-erp`、`/var/log/kaidi-erp`。只允许对 Kaidi ERP 专用数据库执行。

 ## 在线更新

-管理员进入“应用定制平台 -> 系统更新”，点击“检查更新”，确认版本和 Release notes 后执行更新。后端启动独立更新助手，更新助手会：
+管理员可从顶部工具栏、用户菜单、手机导航抽屉或“应用定制平台 -> 系统更新”进入 `/appdev/update`。入口只对 `ADMIN` 角色显示；发现新版本时顶部和手机入口会显示版本提示。
+
+更新源由首次安装器写入 `ERP_CONFIG_FILE` 指向的 `erp.env`。更新页面不会要求管理员重复填写 Gitea 地址、仓库、Token、通道或 HTTP 开关。`v0.3.8` 会把旧官方 HTTP 地址自动迁移到 `https://git.awaioi.com`，但不会覆盖其他自定义源；需要变更基础设施参数时，由服务器运维人员修改 `OA_UPDATE_*` 环境变量并重启服务。
+
+点击“检查更新”后，页面会展示当前版本、在线最新版本、发布日期、最新版本更新日志和历史正式版本记录。点击“安装并重启”后持续显示下载、验签、安装、重启和回滚进度；服务重启短暂断开期间页面会自动重连。后端启动独立更新助手，更新助手会：

 1. 下载正式归档、`SHA256SUMS` 和签名并验证 Ed25519/SHA-256；独立安装器资产只在首次安装使用。
 2. 拒绝路径穿越、符号链接和结构不完整的安装包。
 3. 可选执行 `pg_dump`，再写入独立版本目录。
-4. 原子切换 `current` 链接并终止旧进程，由 systemd 或 launchd 拉起新版本。
+4. 原子切换 `current` 链接并终止旧进程，由 systemd 或 launchd 拉起新版本；Linux unit 使用 `KillMode=process`，让更新助手继续执行健康检查和必要的回滚。
 5. 等待健康检查；失败时切回上一版本并再次验证健康状态。

 更新过程使用操作系统文件锁，同一安装目录同时只允许一个更新任务。手动触发可执行：

 ```bash
-/opt/kaidi-erp/current/bin/erp-update install 0.2.0
+/opt/kaidi-erp/current/bin/erp-update install 0.3.8
 ```

 在线更新依赖安装器注册的 systemd 或 launchd 服务来拉起新旧版本。使用 `--no-service` 时后台更新默认关闭；如由其他进程管理器接管，须先确认它会在 ERP 进程退出后自动重启，再手工启用 `OA_UPDATE_ENABLED=true`。健康检查默认最多等待 120 秒、每 2 秒轮询一次，可分别通过 `ERP_UPDATE_HEALTH_TIMEOUT_SECONDS` 和 `ERP_UPDATE_HEALTH_POLL_SECONDS` 调整。
@@ -1,13 +1,14 @@
 #!/usr/bin/env bash
 set -euo pipefail

-GITEA_BASE_URL="${ERP_GITEA_BASE_URL:-}"
+GITEA_BASE_URL="${ERP_GITEA_BASE_URL:-https://git.awaioi.com}"
 REPOSITORY="${ERP_UPDATE_REPOSITORY:-awaioi/ERP}"
 REQUESTED_VERSION="${ERP_INSTALL_VERSION:-}"
 INSTALL_ROOT="${ERP_INSTALL_ROOT:-}"
 ALLOW_INSECURE="${ERP_UPDATE_ALLOW_INSECURE_HTTP:-0}"
 NO_SERVICE="${ERP_INSTALL_NO_SERVICE:-0}"
 TOKEN="${ERP_GITEA_TOKEN:-${OA_UPDATE_TOKEN:-}}"
+PUBLIC_URL="${ERP_PUBLIC_URL:-}"
 PUBLIC_KEY='-----BEGIN PUBLIC KEY-----
 MCowBQYDK2VwAyEAaErhcY8WZIZvPILmYnfjndVBAdOuWkvhaoHIWqNNdxI=
 -----END PUBLIC KEY-----'
@@ -19,10 +20,11 @@ fail() { printf '[ERP Install] ERROR: %s\n' "$*" >&2; exit 1; }
 usage() {
  cat <<'EOF'
 Usage: install.sh [options]
-  --gitea-url URL       Gitea public base URL
+  --gitea-url URL       Gitea public base URL (default: https://git.awaioi.com)
  --repository O/R      Release repository (default: awaioi/ERP)
  --version VERSION     Install one exact stable release
  --install-root PATH   Override installation directory
+  --public-url URL      Public URL used for the one-time web setup link
  --allow-insecure      Development only: allow plain HTTP release URLs
  --no-service          Start without systemd/launchd; online update stays disabled
 EOF
@@ -34,6 +36,7 @@ while [[ $# -gt 0 ]]; do
    --repository) [[ $# -ge 2 ]] || fail '--repository requires a value'; REPOSITORY="$2"; shift 2 ;;
    --version) [[ $# -ge 2 ]] || fail '--version requires a value'; REQUESTED_VERSION="$2"; shift 2 ;;
    --install-root) [[ $# -ge 2 ]] || fail '--install-root requires a value'; INSTALL_ROOT="$2"; shift 2 ;;
+    --public-url) [[ $# -ge 2 ]] || fail '--public-url requires a value'; PUBLIC_URL="$2"; shift 2 ;;
    --allow-insecure) ALLOW_INSECURE=1; shift ;;
    --no-service) NO_SERVICE=1; shift ;;
    -h|--help) usage; exit 0 ;;
@@ -64,6 +67,14 @@ detect_platform() {
  fi
 }

+validate_service_manager() {
+  [[ "$PLATFORM" != "linux" || "$NO_SERVICE" == "1" ]] && return 0
+  command -v systemctl >/dev/null 2>&1 \
+    || fail 'systemd is required for a production Linux install; use --no-service only for development'
+  [[ -d /run/systemd/system ]] \
+    || fail 'systemd is not running on this Linux host; use --no-service only for development'
+}
+
 java_major() {
  local java_bin="${1:-java}"
  "$java_bin" -version 2>&1 | awk -F'[".]' '/version/ {print $2; exit}'
@@ -189,7 +200,8 @@ download() {
 }

 download_release() {
-  [[ "$REPOSITORY" =~ ^[^/[:space:]]+/[^/[:space:]]+$ ]] || fail 'invalid Gitea repository'
+  [[ "$REPOSITORY" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}/[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ ]] \
+    || fail 'invalid Gitea repository'
  local owner="${REPOSITORY%%/*}" repo="${REPOSITORY#*/}"
  local release_json="$TMP_DIR/release.json"
  download "${GITEA_BASE_URL%/}/api/v1/repos/$owner/$repo/releases/latest" "$release_json" \
@@ -212,17 +224,20 @@ if "-" in version.split("+", 1)[0]:
 requested = sys.argv[2].removeprefix("v")
 if requested and requested != version:
    raise SystemExit("requested version does not match latest release")
-assets = {str(a.get("name")): str(a.get("browser_download_url") or "") for a in release.get("assets", [])}
+assets = {
+    str(a.get("name") or "")
+    for a in release.get("assets", [])
+    if isinstance(a, dict)
+}
 names = [
    f"kaidi-erp-{version}.tar.gz",
    f"kaidi-erp-installer-{version}.jar",
    "SHA256SUMS",
    "SHA256SUMS.sig",
 ]
-urls = [assets.get(name, "") for name in names]
-if any(not url or any(ch.isspace() for ch in url) for url in urls):
+if any(name not in assets for name in names):
    raise SystemExit("release assets missing")
-print("\t".join([version, *urls]))
+print("\t".join([version, tag]))
 PY
  then
    local reason="invalid Release metadata"
@@ -230,10 +245,15 @@ PY
    fail "$reason"
  fi

-  local archive_url installer_url sums_url signature_url
-  IFS=$'\t' read -r VERSION archive_url installer_url sums_url signature_url < "$selection"
+  local release_tag release_base archive_url installer_url sums_url signature_url
+  IFS=$'\t' read -r VERSION release_tag < "$selection"
  ARCHIVE_NAME="kaidi-erp-${VERSION}.tar.gz"
  INSTALLER_NAME="kaidi-erp-installer-${VERSION}.jar"
+  release_base="${GITEA_BASE_URL%/}/$owner/$repo/releases/download/$release_tag"
+  archive_url="$release_base/$ARCHIVE_NAME"
+  installer_url="$release_base/$INSTALLER_NAME"
+  sums_url="$release_base/SHA256SUMS"
+  signature_url="$release_base/SHA256SUMS.sig"
  ARCHIVE_PATH="$TMP_DIR/$ARCHIVE_NAME"
  INSTALLER_PATH="$TMP_DIR/$INSTALLER_NAME"
  download "$archive_url" "$ARCHIVE_PATH"
@@ -294,10 +314,11 @@ shell_setting() {
 prepare_layout() {
  if [[ "$PLATFORM" == "linux" ]]; then
    ERP_USER="${ERP_SERVICE_USER:-kaidi-erp}"
-    ERP_GROUP="$ERP_USER"
    [[ "$ERP_USER" =~ ^[a-z_][a-z0-9_-]*[$]?$ ]] || fail 'invalid Linux service user name'
    id "$ERP_USER" >/dev/null 2>&1 \
      || useradd --system --home-dir "$INSTALL_ROOT" --shell /usr/sbin/nologin "$ERP_USER"
+    ERP_GROUP="$(id -gn "$ERP_USER" 2>/dev/null)" \
+      || fail "unable to resolve the primary group for Linux service user: $ERP_USER"
    CONFIG_ROOT="${ERP_CONFIG_ROOT:-/etc/kaidi-erp}"
    STATE_ROOT="${ERP_STATE_ROOT:-/var/lib/kaidi-erp}"
    LOG_ROOT="${ERP_LOG_ROOT:-/var/log/kaidi-erp}"
@@ -385,6 +406,8 @@ write_bootstrap_configuration() {
    shell_setting ERP_INSTALL_PENDING_FILE "$PENDING_FILE"
    shell_setting ERP_INSTALL_LOCK_FILE "$INSTALL_LOCK_FILE"
    shell_setting ERP_INSTALL_OPERATION_LOCK_FILE "$OPERATION_LOCK_FILE"
+    shell_setting ERP_INSTALL_LOG_FILE "$STATE_ROOT/install-formal.log"
+    shell_setting ERP_INSTALL_HEALTH_TIMEOUT_SECONDS "${ERP_INSTALL_HEALTH_TIMEOUT_SECONDS:-240}"
    shell_setting ERP_SETUP_TOKEN "$SETUP_TOKEN"
    shell_setting ERP_INSTALLER_JAR "$INSTALL_ROOT/installer/kaidi-erp-installer.jar"
    shell_setting ERP_JAR_PATH "$INSTALL_ROOT/current/app/kaidi-erp.jar"
@@ -421,6 +444,8 @@ start_service() {
  fi

  if [[ "$PLATFORM" == "linux" ]]; then
+    # The updater shares this service cgroup and must outlive the Java process
+    # to verify the restarted release and roll back a failed health check.
    cat > /etc/systemd/system/kaidi-erp.service <<EOF
 [Unit]
 Description=Kaidi ERP
@@ -429,12 +454,13 @@ Wants=network-online.target

 [Service]
 Type=simple
+KillMode=process
 User=$ERP_USER
 Group=$ERP_GROUP
 Environment="ERP_INSTALL_ROOT=$INSTALL_ROOT"
 Environment="ERP_CONFIG_FILE=$CONFIG_FILE"
-WorkingDirectory="$INSTALL_ROOT"
-ExecStart="$INSTALL_ROOT/current/bin/erp-run"
+WorkingDirectory=$INSTALL_ROOT
+ExecStart=$INSTALL_ROOT/current/bin/erp-run
 Restart=always
 RestartSec=3
 TimeoutStopSec=90
@@ -442,14 +468,18 @@ SuccessExitStatus=143
 UMask=0077
 NoNewPrivileges=true
 PrivateTmp=true
-ProtectSystem=strict
+ProtectSystem=full
 ProtectHome=true
-ReadWritePaths="$INSTALL_ROOT" "$CONFIG_ROOT" "$STATE_ROOT" "$LOG_ROOT"
+ReadWritePaths=$INSTALL_ROOT $CONFIG_ROOT $STATE_ROOT $LOG_ROOT

 [Install]
 WantedBy=multi-user.target
 EOF
    systemctl daemon-reload
+    if command -v systemd-analyze >/dev/null 2>&1; then
+      systemd-analyze verify /etc/systemd/system/kaidi-erp.service \
+        || fail 'generated systemd unit is invalid; run systemd-analyze verify /etc/systemd/system/kaidi-erp.service'
+    fi
    systemctl enable kaidi-erp.service
    systemctl restart kaidi-erp.service
  else
@@ -504,8 +534,77 @@ detect_lan_address() {
  printf '%s' "${address:-127.0.0.1}"
 }

+is_ip_address() {
+  python3 - "$1" <<'PY' >/dev/null 2>&1
+import ipaddress, sys
+ipaddress.ip_address(sys.argv[1])
+PY
+}
+
+detect_public_address() {
+  local endpoint address
+  for endpoint in \
+    https://api.ipify.org \
+    https://ifconfig.me/ip \
+    https://icanhazip.com; do
+    address="$(curl --silent --show-error --fail --location \
+      --proto '=https' --proto-redir '=https' \
+      --connect-timeout 3 --max-time 5 "$endpoint" 2>/dev/null \
+      | tr -d '[:space:]' | head -c 128 || true)"
+    if [[ -n "$address" ]] && is_ip_address "$address"; then
+      printf '%s' "$address"
+      return 0
+    fi
+  done
+  return 1
+}
+
+normalize_public_url() {
+  python3 - "$1" <<'PY'
+import sys
+from urllib.parse import urlsplit, urlunsplit
+
+value = sys.argv[1].strip()
+try:
+    parsed = urlsplit(value)
+    port = parsed.port
+except ValueError:
+    raise SystemExit("invalid public URL")
+if parsed.scheme.lower() not in {"http", "https"} or not parsed.hostname:
+    raise SystemExit("public URL must use http or https")
+if parsed.username is not None or parsed.password is not None:
+    raise SystemExit("public URL must not contain credentials")
+if port is not None and not 1 <= port <= 65535:
+    raise SystemExit("invalid public URL port")
+path = parsed.path or "/"
+print(urlunsplit((parsed.scheme.lower(), parsed.netloc, path, parsed.query, parsed.fragment)))
+PY
+}
+
+ip_setup_base_url() {
+  python3 - "$1" "$2" <<'PY'
+import ipaddress, sys
+address = ipaddress.ip_address(sys.argv[1])
+host = f"[{address}]" if address.version == 6 else str(address)
+print(f"http://{host}:{int(sys.argv[2])}/")
+PY
+}
+
+append_setup_token() {
+  python3 - "$1" "$2" <<'PY'
+import sys
+from urllib.parse import parse_qsl, urlencode, urlsplit, urlunsplit
+
+parsed = urlsplit(sys.argv[1])
+query = [(key, value) for key, value in parse_qsl(parsed.query, keep_blank_values=True) if key != "token"]
+query.append(("token", sys.argv[2]))
+print(urlunsplit((parsed.scheme, parsed.netloc, parsed.path or "/", urlencode(query), parsed.fragment)))
+PY
+}
+
 main() {
  detect_platform
+  validate_service_manager
  if [[ -z "$INSTALL_ROOT" ]]; then
    if [[ "$PLATFORM" == "linux" ]]; then
      INSTALL_ROOT=/opt/kaidi-erp
@@ -515,9 +614,18 @@ main() {
  fi
  [[ -n "$GITEA_BASE_URL" ]] || fail 'Gitea URL is required; use --gitea-url or ERP_GITEA_BASE_URL'
  validate_download_url "$GITEA_BASE_URL"
+  if [[ -n "$PUBLIC_URL" ]]; then
+    case "$PUBLIC_URL" in
+      http://*|https://*) ;;
+      *) fail 'public URL must start with http:// or https://' ;;
+    esac
+  fi

  say "Detected $PLATFORM/$ARCH"
  check_and_install_dependencies
+  if [[ -n "$PUBLIC_URL" ]]; then
+    PUBLIC_URL="$(normalize_public_url "$PUBLIC_URL")" || fail 'invalid public URL'
+  fi
  TMP_DIR="$(mktemp -d "${TMPDIR:-/tmp}/kaidi-erp-install.XXXXXX")"
  create_curl_config
  say 'Downloading and verifying the signed release...'
@@ -529,11 +637,24 @@ main() {
  start_service
  wait_for_installer

-  local port="${ERP_SERVER_PORT:-8091}" address
-  address="$(detect_lan_address)"
+  local port="${ERP_SERVER_PORT:-8091}" lan_address public_address setup_base local_base lan_base
+  lan_address="$(detect_lan_address)"
+  local_base="http://127.0.0.1:${port}/"
+  lan_base="$(ip_setup_base_url "$lan_address" "$port")"
+  if [[ -n "$PUBLIC_URL" ]]; then
+    setup_base="$PUBLIC_URL"
+  elif public_address="$(detect_public_address)"; then
+    setup_base="$(ip_setup_base_url "$public_address" "$port")"
+  else
+    setup_base="$lan_base"
+    say 'Public IP detection was unavailable; using the LAN address'
+  fi
  say "Kaidi ERP $VERSION installer is running"
-  say "Setup URL: http://${address}:${port}/?token=${SETUP_TOKEN}"
-  say "Local URL: http://127.0.0.1:${port}/?token=${SETUP_TOKEN}"
+  say "Setup URL: $(append_setup_token "$setup_base" "$SETUP_TOKEN")"
+  say "Local URL: $(append_setup_token "$local_base" "$SETUP_TOKEN")"
+  if [[ "$lan_address" != "127.0.0.1" && "$lan_base" != "$setup_base" ]]; then
+    say "LAN URL: $(append_setup_token "$lan_base" "$SETUP_TOKEN")"
+  fi
  say 'Complete PostgreSQL and administrator setup in the browser. The installer will remove itself after the formal service is healthy.'
 }

@@ -8,6 +8,8 @@ group = 'com.kaidi'
 version = providers.gradleProperty('releaseVersion')
        .orElse(System.getenv('ERP_RELEASE_VERSION') ?: '0.1.0')
        .get()
+def flywayVersion = '11.20.3'
+def postgresqlDriverVersion = '42.7.13'
 def productionBuild = providers.gradleProperty('productionBuild')
        .map { it.toBoolean() }
        .orElse(false)
@@ -47,9 +49,9 @@ dependencies {
    implementation 'org.springframework.boot:spring-boot-starter-websocket'

    // Production database and versioned schema migrations.
-    implementation 'org.flywaydb:flyway-core:10.22.0'
-    runtimeOnly 'org.flywaydb:flyway-database-postgresql:10.22.0'
-    runtimeOnly 'org.postgresql:postgresql'
+    implementation "org.flywaydb:flyway-core:$flywayVersion"
+    runtimeOnly "org.flywaydb:flyway-database-postgresql:$flywayVersion"
+    runtimeOnly "org.postgresql:postgresql:$postgresqlDriverVersion"

    // SQLite remains available to source-tree development and tests, but is
    // deliberately absent from PostgreSQL-only production release artifacts.
@@ -69,9 +71,9 @@ dependencies {

    installerImplementation 'org.springframework.boot:spring-boot-starter-web'
    installerImplementation 'org.springframework.boot:spring-boot-starter-validation'
-    installerImplementation 'org.flywaydb:flyway-core:10.22.0'
-    installerRuntimeOnly 'org.flywaydb:flyway-database-postgresql:10.22.0'
-    installerRuntimeOnly 'org.postgresql:postgresql'
+    installerImplementation "org.flywaydb:flyway-core:$flywayVersion"
+    installerRuntimeOnly "org.flywaydb:flyway-database-postgresql:$flywayVersion"
+    installerRuntimeOnly "org.postgresql:postgresql:$postgresqlDriverVersion"
 }

 tasks.named('test') {
@@ -3,6 +3,8 @@ package com.kaidi.oa.install;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.flywaydb.core.Flyway;
 import org.flywaydb.core.api.output.MigrateResult;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.boot.SpringApplication;
 import org.springframework.context.ConfigurableApplicationContext;
 import org.springframework.http.HttpStatus;
@@ -36,6 +38,8 @@ import java.util.Set;
@Service
 public class InstallerService {

+    private static final Logger log = LoggerFactory.getLogger(InstallerService.class);
+
    private static final Set<PosixFilePermission> OWNER_ONLY = EnumSet.of(
            PosixFilePermission.OWNER_READ,
            PosixFilePermission.OWNER_WRITE);
@@ -117,6 +121,11 @@ public class InstallerService {
                    .load()
                    .migrate();
        } catch (RuntimeException exception) {
+            log.error(
+                    "PostgreSQL migration failed for database {} as user {}",
+                    request.database().database().strip(),
+                    request.database().username().strip(),
+                    exception);
            throw new InstallApiException(
                    HttpStatus.UNPROCESSABLE_ENTITY,
                    42203,
@@ -170,6 +179,7 @@ public class InstallerService {
                        42201,
                        "PostgreSQL 版本过低，需要 15 或更高版本");
            }
+            requireDatabaseOwnership(connection);
            try (Statement statement = connection.createStatement()) {
                statement.execute("SELECT 1");
                statement.execute("CREATE EXTENSION IF NOT EXISTS pg_trgm");
@@ -181,10 +191,16 @@ public class InstallerService {
                    throw new SQLException("pg_trgm is unavailable");
                }
            }
+            requirePgTrgmOwnership(connection);
            return new DatabaseCheck(major, connection.getMetaData().getDatabaseProductVersion());
        } catch (InstallApiException exception) {
            throw exception;
        } catch (SQLException | NumberFormatException exception) {
+            log.warn(
+                    "PostgreSQL verification failed for database {} as user {}: {}",
+                    database.database().strip(),
+                    database.username().strip(),
+                    exception.getMessage());
            throw new InstallApiException(
                    HttpStatus.UNPROCESSABLE_ENTITY,
                    42202,
@@ -192,6 +208,40 @@ public class InstallerService {
        }
    }

+    private void requireDatabaseOwnership(Connection connection) throws SQLException {
+        try (Statement statement = connection.createStatement();
+                ResultSet result = statement.executeQuery(
+                        "SELECT "
+                                + "pg_get_userbyid(datdba) = current_user AS owns_database, "
+                                + "has_schema_privilege(current_user, 'public', 'USAGE') AS can_use_schema, "
+                                + "has_schema_privilege(current_user, 'public', 'CREATE') AS can_create_in_schema "
+                                + "FROM pg_database WHERE datname = current_database()")) {
+            if (!result.next()
+                    || !result.getBoolean("owns_database")
+                    || !result.getBoolean("can_use_schema")
+                    || !result.getBoolean("can_create_in_schema")) {
+                throw new InstallApiException(
+                        HttpStatus.UNPROCESSABLE_ENTITY,
+                        42206,
+                        "数据库账号必须是该空数据库的所有者，并拥有 public schema 建表权限");
+            }
+        }
+    }
+
+    private void requirePgTrgmOwnership(Connection connection) throws SQLException {
+        try (Statement statement = connection.createStatement();
+                ResultSet result = statement.executeQuery(
+                        "SELECT pg_get_userbyid(extowner) = current_user "
+                                + "FROM pg_extension WHERE extname = 'pg_trgm'")) {
+            if (!result.next() || !result.getBoolean(1)) {
+                throw new InstallApiException(
+                        HttpStatus.UNPROCESSABLE_ENTITY,
+                        42207,
+                        "数据库账号必须拥有 pg_trgm 扩展；请由管理员删除预建扩展后重新测试");
+            }
+        }
+    }
+
    private void rejectExistingInstallation(InstallRequest.Database database) {
        try (Connection connection = openConnection(database);
                PreparedStatement tableQuery = connection.prepareStatement(
@@ -272,6 +322,11 @@ public class InstallerService {
        } catch (InstallApiException exception) {
            throw exception;
        } catch (Exception exception) {
+            log.error(
+                    "Administrator initialization failed for database {} as user {}",
+                    database.database().strip(),
+                    database.username().strip(),
+                    exception);
            throw new InstallApiException(HttpStatus.UNPROCESSABLE_ENTITY, 42205, "管理员账号初始化失败");
        }
    }
@@ -326,6 +381,8 @@ public class InstallerService {
        values.put("ERP_INSTALL_PENDING_FILE", properties.pendingFile().toAbsolutePath().normalize().toString());
        values.put("ERP_INSTALL_LOCK_FILE", properties.lockFile().toAbsolutePath().normalize().toString());
        values.put("ERP_INSTALL_OPERATION_LOCK_FILE", properties.operationLockFile().toAbsolutePath().normalize().toString());
+        values.put("ERP_INSTALL_LOG_FILE", stateRoot.resolve("install-formal.log").toString());
+        values.put("ERP_INSTALL_HEALTH_TIMEOUT_SECONDS", environment("ERP_INSTALL_HEALTH_TIMEOUT_SECONDS", "240"));
        values.put("ERP_SETUP_TOKEN", properties.token());
        values.put("ERP_INSTALLER_JAR", installRoot.resolve("installer/kaidi-erp-installer.jar").toString());
        values.put("ERP_JAR_PATH", installRoot.resolve("current/app/kaidi-erp.jar").toString());
@@ -352,7 +409,7 @@ public class InstallerService {
        values.put("OA_DB_POOL_MIN", environment("OA_DB_POOL_MIN", "2"));
        values.put("OA_SEED_DEMO", "false");
        values.put("OA_UPDATE_ENABLED", environment("OA_UPDATE_ENABLED", "true"));
-        values.put("OA_UPDATE_GITEA_BASE_URL", environment("OA_UPDATE_GITEA_BASE_URL", ""));
+        values.put("OA_UPDATE_GITEA_BASE_URL", environment("OA_UPDATE_GITEA_BASE_URL", "https://git.awaioi.com"));
        values.put("OA_UPDATE_REPOSITORY", environment("OA_UPDATE_REPOSITORY", "awaioi/ERP"));
        values.put("OA_UPDATE_CHANNEL", environment("OA_UPDATE_CHANNEL", "stable"));
        values.put("OA_UPDATE_TOKEN", environment("OA_UPDATE_TOKEN", ""));
@@ -1,6 +1,7 @@
 server:
  port: ${SERVER_PORT:8091}
  shutdown: graceful
+  forward-headers-strategy: framework

 spring:
  application:
@@ -190,6 +190,44 @@
    .progress-item.running .progress-dot { border-color: #2f6fed; background: #2f6fed; box-shadow: 0 0 0 4px #eaf1fd; }
    .progress-item.done { color: #187149; }
    .progress-item.done .progress-dot { border-color: #25805a; background: #25805a; }
+    .install-progress { margin-top: 22px; padding-top: 18px; border-top: 1px solid #e8ebf0; }
+    .install-progress-head, .install-progress-meta, .install-console-head {
+      display: flex;
+      align-items: center;
+      justify-content: space-between;
+      gap: 12px;
+    }
+    .install-progress-label { color: #334057; font-size: 13px; font-weight: 650; }
+    .install-progress-value { color: #1d3557; font-size: 14px; font-variant-numeric: tabular-nums; }
+    .install-progress-track {
+      height: 10px;
+      margin-top: 10px;
+      overflow: hidden;
+      border-radius: 4px;
+      background: #e5eaf1;
+    }
+    .install-progress-bar {
+      width: 0;
+      height: 100%;
+      background: #2f6fed;
+      transition: width .35s ease;
+    }
+    .install-progress-meta { margin-top: 8px; color: #707c90; font-size: 12px; }
+    .install-console { margin-top: 14px; overflow: hidden; border: 1px solid #28364a; border-radius: 6px; background: #182233; }
+    .install-console-head { min-height: 36px; padding: 0 12px; border-bottom: 1px solid #314158; background: #111a28; }
+    .install-console-title { color: #dce5f2; font-size: 12px; font-weight: 650; }
+    .install-console-state { color: #7dd3a8; font-size: 12px; }
+    .install-log {
+      height: 148px;
+      margin: 0;
+      overflow: auto;
+      padding: 10px 12px;
+      color: #c9d5e5;
+      font: 12px/1.65 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+      letter-spacing: 0;
+      overflow-wrap: anywhere;
+      white-space: pre-wrap;
+    }
    .complete-mark {
      width: 58px;
      height: 58px;
@@ -220,6 +258,8 @@
      .summary-row { grid-template-columns: 1fr; gap: 5px; }
      .actions { flex-wrap: wrap-reverse; }
      .btn { flex: 1 1 120px; }
+      .install-progress-meta { align-items: flex-start; flex-direction: column; gap: 4px; }
+      .install-log { height: 172px; }
    }
  </style>
 </head>
@@ -299,6 +339,23 @@
            <div class="progress-item" data-progress="3"><span class="progress-dot"></span><span>创建管理员账号</span></div>
            <div class="progress-item" data-progress="4"><span class="progress-dot"></span><span>启动正式服务并写入安装锁</span></div>
          </div>
+          <div class="install-progress">
+            <div class="install-progress-head">
+              <span class="install-progress-label" id="install-phase">准备安装</span>
+              <strong class="install-progress-value" id="install-percent">0%</strong>
+            </div>
+            <div class="install-progress-track" id="install-progress-track" role="progressbar" aria-label="安装进度" aria-valuemin="0" aria-valuemax="100" aria-valuenow="0">
+              <div class="install-progress-bar" id="install-progress-bar"></div>
+            </div>
+            <div class="install-progress-meta">
+              <span id="install-elapsed">本页已等待 0 秒</span>
+              <span id="install-check">等待安装任务</span>
+            </div>
+          </div>
+          <div class="install-console">
+            <div class="install-console-head"><span class="install-console-title">安装状态</span><span class="install-console-state" id="install-console-state">运行中</span></div>
+            <pre class="install-log" id="install-log" aria-live="polite"></pre>
+          </div>
          <div id="install-message" class="notice info">正在初始化，数据库规模较大时可能需要几分钟。</div>
        </div>
        <div id="complete-view" class="hidden">
@@ -323,7 +380,18 @@
        history.replaceState(null, '', clean);
      }

-      const state = { step: 1, database: null, databaseFingerprint: '', administrator: null, installing: false };
+      const state = {
+        step: 1,
+        database: null,
+        databaseFingerprint: '',
+        administrator: null,
+        installing: false,
+        installStartedAt: 0,
+        installPercent: 0,
+        installLogEntries: [],
+        healthPolling: false,
+      };
+      const FORMAL_SERVICE_TIMEOUT_MS = 240000;
      const $ = (selector) => document.querySelector(selector);
      const $$ = (selector) => Array.from(document.querySelectorAll(selector));

@@ -421,26 +489,97 @@
        });
      }

+      function formatElapsed(milliseconds) {
+        const seconds = Math.max(0, Math.floor(milliseconds / 1000));
+        if (seconds < 60) return `${seconds} 秒`;
+        return `${Math.floor(seconds / 60)} 分 ${seconds % 60} 秒`;
+      }
+
+      function setInstallMeter(percent, phase, detail) {
+        const value = Math.max(state.installPercent, Math.max(0, Math.min(100, Math.round(percent))));
+        state.installPercent = value;
+        $('#install-progress-bar').style.width = `${value}%`;
+        $('#install-percent').textContent = `${value}%`;
+        $('#install-phase').textContent = phase;
+        $('#install-check').textContent = detail;
+        $('#install-elapsed').textContent = `本页已等待 ${formatElapsed(Date.now() - state.installStartedAt)}`;
+        const track = $('#install-progress-track');
+        track.setAttribute('aria-valuenow', String(value));
+        track.setAttribute('aria-valuetext', `${phase}，${value}%`);
+      }
+
+      function appendInstallLog(message) {
+        const timestamp = new Date().toLocaleTimeString('zh-CN', { hour12: false });
+        state.installLogEntries.push(`[${timestamp}] ${message}`);
+        state.installLogEntries = state.installLogEntries.slice(-16);
+        const output = $('#install-log');
+        output.textContent = state.installLogEntries.join('\n');
+        output.scrollTop = output.scrollHeight;
+      }
+
+      function beginInstallTracking(resumed) {
+        state.installStartedAt = Date.now();
+        state.installLogEntries = [];
+        $('#install-message').className = 'notice info';
+        $('#install-console-state').textContent = '运行中';
+        if (resumed) {
+          setInstallMeter(70, '恢复安装任务', '准备检查正式服务');
+          appendInstallLog('检测到尚未完成的安装任务，继续等待正式服务。');
+        } else {
+          setInstallMeter(5, '提交安装任务', '准备验证数据库');
+          appendInstallLog('安装请求已提交，正在验证 PostgreSQL 连接和权限。');
+        }
+      }
+
      async function pollFormalService() {
+        if (state.healthPolling) return;
+        state.healthPolling = true;
+        if (!state.installStartedAt) beginInstallTracking(true);
        setProgress(4);
-        $('#install-message').textContent = '初始化完成，正在等待正式服务通过健康检查。';
-        const deadline = Date.now() + 240000;
+        setInstallMeter(Math.max(state.installPercent, 72), '启动正式服务', '等待第 1 次健康检查');
+        appendInstallLog('数据库初始化完成，安装器正在切换到正式服务。');
+        $('#install-message').textContent = '初始化完成，正在等待正式服务通过健康检查。页面会持续显示检查进度。';
+        const healthStartedAt = Date.now();
+        const deadline = healthStartedAt + FORMAL_SERVICE_TIMEOUT_MS;
+        let attempt = 0;
        while (Date.now() < deadline) {
          await new Promise((resolve) => setTimeout(resolve, 2000));
+          attempt += 1;
+          const healthElapsed = Date.now() - healthStartedAt;
+          const estimated = 72 + Math.floor((healthElapsed / FORMAL_SERVICE_TIMEOUT_MS) * 23);
+          setInstallMeter(Math.min(95, estimated), '等待正式服务健康检查', `第 ${attempt} 次检查`);
          try {
            const response = await fetch('/api/oa/health', { cache: 'no-store' });
            const body = await response.json();
-            if (response.ok && (body?.data?.status === 'UP' || body?.status === 'UP')) {
+            const serviceStatus = body?.data?.status || body?.status || `HTTP ${response.status}`;
+            const installLocked = body?.data?.installLocked ?? body?.installLocked;
+            if (response.ok && serviceStatus === 'UP' && (installLocked === true || installLocked === 'true')) {
+              setInstallMeter(100, '安装完成', '正式服务已就绪');
+              appendInstallLog(`健康检查第 ${attempt} 次通过，安装锁已确认。`);
+              $('#install-console-state').textContent = '已完成';
              $$('[data-progress]').forEach((item) => { item.classList.remove('running'); item.classList.add('done'); });
              $('#installing-view').classList.add('hidden');
              $('#complete-view').classList.remove('hidden');
              sessionStorage.removeItem('kaidi.setup.token');
+              state.healthPolling = false;
              return;
            }
-          } catch { /* Service is changing from installer to the formal application. */ }
+            if (response.ok && serviceStatus === 'UP') {
+              setInstallMeter(98, '正式服务已通过健康检查', '等待写入安装锁');
+              appendInstallLog(`健康检查第 ${attempt} 次通过，正在等待后台写入安装锁。`);
+              continue;
            }
+            appendInstallLog(`健康检查第 ${attempt} 次：服务状态 ${serviceStatus}。`);
+          } catch {
+            appendInstallLog(`健康检查第 ${attempt} 次：服务端口正在切换，继续等待。`);
+          }
+        }
+        state.healthPolling = false;
+        setInstallMeter(95, '正式服务尚未就绪', `${Math.round(FORMAL_SERVICE_TIMEOUT_MS / 1000)} 秒检查超时`);
+        appendInstallLog('健康检查超时，安装状态已保留，未写入完成锁。');
+        $('#install-console-state').textContent = '需要检查';
        $('#install-message').className = 'notice error';
-        $('#install-message').textContent = '正式服务尚未就绪。请在服务器查看 kaidi-erp 服务日志，安装文件和安装锁不会被误删。';
+        $('#install-message').textContent = '正式服务尚未就绪。请查看 systemctl 日志或 /var/lib/kaidi-erp/install-formal.log；安装文件和待确认状态均已保留。';
      }

      $('#start-button').addEventListener('click', () => go(2));
@@ -506,10 +645,16 @@
        state.installing = true;
        $('#confirm-view').classList.add('hidden');
        $('#installing-view').classList.remove('hidden');
+        beginInstallTracking(false);
        setProgress(1);
+        let migrationTimer;
        try {
          const request = { database: state.database, administrator: state.administrator };
-          setTimeout(() => setProgress(2), 700);
+          migrationTimer = setTimeout(() => {
+            setProgress(2);
+            setInstallMeter(28, '执行数据库初始化', '迁移结构和基础数据');
+            appendInstallLog('数据库连接验证通过，正在执行结构迁移和基础数据初始化。');
+          }, 700);
          try {
            await api('/api/install/complete', { method: 'POST', body: JSON.stringify(request) });
          } catch (error) {
@@ -518,12 +663,20 @@
            // is flushed; the formal health probe is the authoritative result.
            if (!(error instanceof TypeError) && error.message !== '安装服务响应无效') throw error;
          }
+          clearTimeout(migrationTimer);
          setProgress(3);
+          setInstallMeter(68, '创建管理员并切换服务', '数据库初始化已完成');
+          appendInstallLog('数据库迁移和管理员初始化已提交，准备启动正式服务。');
          state.administrator.password = '';
          state.database.password = '';
          await pollFormalService();
        } catch (error) {
+          clearTimeout(migrationTimer);
          state.installing = false;
+          state.healthPolling = false;
+          setInstallMeter(state.installPercent, '安装已中断', '请处理错误后重试');
+          appendInstallLog(`安装中断：${error.message}`);
+          $('#install-console-state').textContent = '已中断';
          $('#install-message').className = 'notice error';
          $('#install-message').textContent = error.message;
          const actions = document.createElement('div');
@@ -548,6 +701,7 @@
            go(4);
            $('#confirm-view').classList.add('hidden');
            $('#installing-view').classList.remove('hidden');
+            beginInstallTracking(true);
            return pollFormalService();
          }
          $('#java-detail').textContent = `Java ${status.javaVersion}，最低要求 Java ${status.minimumJava}`;
@@ -9,12 +9,13 @@ import org.springframework.stereotype.Component;
 public class UpdateProperties {

    private boolean enabled;
-    private String giteaBaseUrl = "";
+    private String giteaBaseUrl = "https://git.awaioi.com";
    private String repository = "awaioi/ERP";
    private String channel = "stable";
    private String token = "";
    private String helperCommand = "";
    private String stateFile = "./runtime/update-state.json";
+    private String configFile = "";
    private boolean allowInsecureHttp;
    private int requestTimeoutSeconds = 15;

@@ -74,6 +75,14 @@ public class UpdateProperties {
        this.stateFile = stateFile;
    }

+    public String getConfigFile() {
+        return configFile;
+    }
+
+    public void setConfigFile(String configFile) {
+        this.configFile = configFile;
+    }
+
    public boolean isAllowInsecureHttp() {
        return allowInsecureHttp;
    }
@@ -0,0 +1,256 @@
+package com.kaidi.oa.service;
+
+import com.kaidi.oa.common.ApiException;
+import com.kaidi.oa.config.UpdateProperties;
+import org.springframework.stereotype.Service;
+
+import java.io.IOException;
+import java.net.URI;
+import java.nio.ByteBuffer;
+import java.nio.channels.FileChannel;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.AtomicMoveNotSupportedException;
+import java.nio.file.Files;
+import java.nio.file.LinkOption;
+import java.nio.file.Path;
+import java.nio.file.StandardCopyOption;
+import java.nio.file.StandardOpenOption;
+import java.nio.file.attribute.BasicFileAttributes;
+import java.nio.file.attribute.PosixFilePermission;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Set;
+import java.util.regex.Pattern;
+
+/** Persists the administrator-managed updater source without exposing credentials. */
+@Service
+public class SystemUpdateConfigService {
+
+    private static final long MAX_CONFIG_BYTES = 1024 * 1024;
+    private static final Pattern REPOSITORY_PATTERN = Pattern.compile(
+            "^[A-Za-z0-9][A-Za-z0-9._-]{0,99}/[A-Za-z0-9][A-Za-z0-9._-]{0,99}$");
+    private static final Pattern TOKEN_PATTERN = Pattern.compile("^[A-Za-z0-9._-]{1,512}$");
+    private static final Set<String> CHANNELS = Set.of("stable", "preview");
+
+    private final UpdateProperties properties;
+
+    public SystemUpdateConfigService(UpdateProperties properties) {
+        this.properties = properties;
+    }
+
+    public synchronized UpdateConfig get() {
+        return new UpdateConfig(
+                properties.isEnabled(),
+                value(properties.getGiteaBaseUrl()),
+                value(properties.getRepository()),
+                normalizedChannel(properties.getChannel()),
+                properties.getToken() != null && !properties.getToken().isBlank(),
+                properties.isAllowInsecureHttp()
+        );
+    }
+
+    public synchronized UpdateConfig save(UpdateConfigRequest request) {
+        if (request == null) {
+            throw new ApiException(400, "更新配置不能为空");
+        }
+
+        String baseUrl = normalizeBaseUrl(request.giteaBaseUrl(), request.allowInsecureHttp(), request.enabled());
+        String repository = normalizeRepository(request.repository());
+        String channel = normalizedChannel(request.channel());
+        String token = value(properties.getToken());
+        String suppliedToken = value(request.token());
+        if (request.clearToken() && !suppliedToken.isBlank()) {
+            throw new ApiException(400, "不能同时清除并设置 Gitea Token");
+        }
+        if (request.clearToken()) {
+            token = "";
+        } else if (!suppliedToken.isBlank()) {
+            if (!TOKEN_PATTERN.matcher(suppliedToken).matches()) {
+                throw new ApiException(400, "Gitea Token 格式无效");
+            }
+            token = suppliedToken;
+        }
+
+        LinkedHashMap<String, String> changes = new LinkedHashMap<>();
+        changes.put("OA_UPDATE_ENABLED", Boolean.toString(request.enabled()));
+        changes.put("OA_UPDATE_GITEA_BASE_URL", baseUrl);
+        changes.put("OA_UPDATE_REPOSITORY", repository);
+        changes.put("OA_UPDATE_CHANNEL", channel);
+        changes.put("OA_UPDATE_TOKEN", token);
+        changes.put("OA_UPDATE_ALLOW_INSECURE_HTTP", Boolean.toString(request.allowInsecureHttp()));
+        persist(changes);
+
+        properties.setEnabled(request.enabled());
+        properties.setGiteaBaseUrl(baseUrl);
+        properties.setRepository(repository);
+        properties.setChannel(channel);
+        properties.setToken(token);
+        properties.setAllowInsecureHttp(request.allowInsecureHttp());
+        return get();
+    }
+
+    private void persist(Map<String, String> changes) {
+        String configuredPath = value(properties.getConfigFile());
+        if (configuredPath.isBlank()) {
+            throw new ApiException(503, "当前运行方式未提供可写的 ERP_CONFIG_FILE");
+        }
+        Path target = Path.of(configuredPath).toAbsolutePath().normalize();
+        try {
+            if (!Files.isRegularFile(target, LinkOption.NOFOLLOW_LINKS) || !Files.isWritable(target)) {
+                throw new ApiException(503, "ERP 配置文件不存在或不可写");
+            }
+            if (Files.size(target) > MAX_CONFIG_BYTES) {
+                throw new ApiException(503, "ERP 配置文件异常过大");
+            }
+            BasicFileAttributes before = Files.readAttributes(
+                    target, BasicFileAttributes.class, LinkOption.NOFOLLOW_LINKS);
+            List<String> original = Files.readAllLines(target, StandardCharsets.UTF_8);
+            List<String> updated = replaceWhitelistedSettings(original, changes);
+            byte[] content = (String.join("\n", updated) + "\n").getBytes(StandardCharsets.UTF_8);
+            atomicWrite(target, content, before);
+        } catch (ApiException exception) {
+            throw exception;
+        } catch (IOException | RuntimeException exception) {
+            throw new ApiException(503, "无法保存更新配置，请检查 ERP 配置文件权限");
+        }
+    }
+
+    private List<String> replaceWhitelistedSettings(List<String> original, Map<String, String> changes) {
+        List<String> result = new ArrayList<>(original.size() + changes.size());
+        Set<String> written = new java.util.HashSet<>();
+        for (String line : original) {
+            String matched = null;
+            for (String key : changes.keySet()) {
+                if (line.startsWith(key + "=")) {
+                    matched = key;
+                    break;
+                }
+            }
+            if (matched == null) {
+                result.add(line);
+            } else if (written.add(matched)) {
+                result.add(setting(matched, changes.get(matched)));
+            }
+        }
+        for (Map.Entry<String, String> entry : changes.entrySet()) {
+            if (written.add(entry.getKey())) {
+                result.add(setting(entry.getKey(), entry.getValue()));
+            }
+        }
+        return result;
+    }
+
+    private void atomicWrite(Path target, byte[] content, BasicFileAttributes before) throws IOException {
+        Path parent = target.getParent();
+        if (parent == null || !Files.isDirectory(parent, LinkOption.NOFOLLOW_LINKS)) {
+            throw new IOException("configuration parent is unavailable");
+        }
+        Path temporary = Files.createTempFile(parent, ".erp.env-", ".tmp");
+        try {
+            try {
+                Set<PosixFilePermission> permissions = Files.getPosixFilePermissions(
+                        target, LinkOption.NOFOLLOW_LINKS);
+                Files.setPosixFilePermissions(temporary, permissions);
+            } catch (UnsupportedOperationException ignored) {
+                // Production targets POSIX systems; keep local non-POSIX tests portable.
+            }
+            try (FileChannel channel = FileChannel.open(
+                    temporary, StandardOpenOption.WRITE, StandardOpenOption.TRUNCATE_EXISTING)) {
+                channel.write(ByteBuffer.wrap(content));
+                channel.force(true);
+            }
+            BasicFileAttributes current = Files.readAttributes(
+                    target, BasicFileAttributes.class, LinkOption.NOFOLLOW_LINKS);
+            if (current.size() != before.size() || !current.lastModifiedTime().equals(before.lastModifiedTime())) {
+                throw new IOException("configuration changed concurrently");
+            }
+            try {
+                Files.move(temporary, target,
+                        StandardCopyOption.ATOMIC_MOVE, StandardCopyOption.REPLACE_EXISTING);
+            } catch (AtomicMoveNotSupportedException exception) {
+                throw new IOException("atomic configuration replacement is unavailable", exception);
+            }
+        } finally {
+            Files.deleteIfExists(temporary);
+        }
+    }
+
+    private static String normalizeBaseUrl(String input, boolean allowInsecureHttp, boolean required) {
+        String value = value(input).replaceAll("/+$", "");
+        if (value.isBlank()) {
+            if (required) {
+                throw new ApiException(400, "启用在线更新时必须填写 Gitea 地址");
+            }
+            return "";
+        }
+        URI uri;
+        try {
+            uri = URI.create(value);
+        } catch (IllegalArgumentException exception) {
+            throw new ApiException(400, "Gitea 地址格式无效");
+        }
+        String scheme = value(uri.getScheme()).toLowerCase(Locale.ROOT);
+        if (!("https".equals(scheme) || (allowInsecureHttp && "http".equals(scheme)))) {
+            throw new ApiException(400, "Gitea 地址必须使用 HTTPS");
+        }
+        if (uri.getHost() == null || uri.getUserInfo() != null || uri.getRawQuery() != null
+                || uri.getRawFragment() != null || uri.getPort() > 65535) {
+            throw new ApiException(400, "Gitea 地址格式无效");
+        }
+        return value;
+    }
+
+    private static String normalizeRepository(String input) {
+        String repository = value(input);
+        if (!REPOSITORY_PATTERN.matcher(repository).matches()) {
+            throw new ApiException(400, "仓库格式必须为 owner/repository");
+        }
+        return repository;
+    }
+
+    private static String normalizedChannel(String input) {
+        String channel = value(input).toLowerCase(Locale.ROOT);
+        if (channel.isBlank()) {
+            return "stable";
+        }
+        if (!CHANNELS.contains(channel)) {
+            throw new ApiException(400, "更新通道只支持 stable 或 preview");
+        }
+        return channel;
+    }
+
+    private static String setting(String key, String value) {
+        if (value.indexOf('\0') >= 0 || value.indexOf('\n') >= 0 || value.indexOf('\r') >= 0) {
+            throw new ApiException(400, "更新配置不能包含换行符");
+        }
+        return key + "='" + value.replace("'", "'\\''") + "'";
+    }
+
+    private static String value(String value) {
+        return value == null ? "" : value.trim();
+    }
+
+    public record UpdateConfig(
+            boolean enabled,
+            String giteaBaseUrl,
+            String repository,
+            String channel,
+            boolean tokenConfigured,
+            boolean allowInsecureHttp
+    ) {
+    }
+
+    public record UpdateConfigRequest(
+            boolean enabled,
+            String giteaBaseUrl,
+            String repository,
+            String channel,
+            String token,
+            boolean clearToken,
+            boolean allowInsecureHttp
+    ) {
+    }
+}
@@ -21,13 +21,16 @@ import java.net.http.HttpResponse;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.nio.file.StandardCopyOption;
 import java.nio.file.StandardOpenOption;
+import java.nio.file.attribute.PosixFilePermission;
 import java.time.Duration;
 import java.time.Instant;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Locale;
 import java.util.Objects;
+import java.util.Set;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.regex.Matcher;
@@ -43,6 +46,10 @@ public class SystemUpdateService {
                    + "(?:-([0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*))?"
                    + "(?:\\+([0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*))?$");
    private static final long MAX_STATE_BYTES = 64 * 1024;
+    private static final int MAX_RELEASE_NOTES_CHARS = 32_000;
+    private static final int MAX_RELEASE_HISTORY = 20;
+    private static final int MAX_RELEASE_ASSETS = 32;
+    private static final int MAX_ASSET_NAME_CHARS = 255;

    private final UpdateProperties properties;
    private final ObjectMapper objectMapper;
@@ -76,12 +83,33 @@ public class SystemUpdateService {

    public UpdateStatus status() {
        UpdateStatus persisted = readHelperState();
-        return persisted == null ? state.get() : persisted;
+        if (persisted != null) {
+            state.set(persisted);
+            return persisted;
+        }
+        return state.get();
+    }
+
+    public void ensureConfigurationMutable() {
+        if (isActivePhase(status().phase())) {
+            throw new ApiException(409, "更新进行中，暂时不能修改更新源");
+        }
+    }
+
+    public synchronized void configurationChanged() {
+        UpdateStatus idle = UpdateStatus.idle(isConfigured(), currentVersion);
+        state.set(idle);
+        persistState(idle);
    }

    public synchronized UpdateStatus check() {
        requireConfigured();
-        state.set(state.get().withPhase(UpdatePhase.CHECKING, 5, "正在检查 Gitea Release"));
+        if (isActivePhase(status().phase())) {
+            throw new ApiException(409, "更新任务正在执行");
+        }
+        UpdateStatus checking = state.get().withPhase(UpdatePhase.CHECKING, 5, "正在检查 Gitea Release");
+        state.set(checking);
+        persistState(checking);
        try {
            ReleaseInfo release = fetchLatestRelease();
            boolean available = compareVersions(release.version(), currentVersion) > 0;
@@ -100,13 +128,34 @@ public class SystemUpdateService {
                    null
            );
            state.set(checked);
+            persistState(checked);
            return checked;
        } catch (RuntimeException e) {
-            state.set(state.get().failed(safeMessage(e)));
+            UpdateStatus failed = state.get().failed(safeMessage(e));
+            state.set(failed);
+            persistState(failed);
            throw e;
        }
    }

+    public List<ReleaseHistoryItem> releases() {
+        requireConfigured();
+        List<ReleaseInfo> releases = new ArrayList<>(fetchReleaseHistory());
+        releases.sort((left, right) -> compareVersions(right.version(), left.version()));
+        String latestVersion = releases.isEmpty() ? null : releases.get(0).version();
+        List<ReleaseHistoryItem> history = new ArrayList<>(releases.size());
+        for (ReleaseInfo release : releases) {
+            history.add(new ReleaseHistoryItem(
+                    release.version(),
+                    release.publishedAt(),
+                    release.notes(),
+                    sameVersion(release.version(), currentVersion),
+                    latestVersion != null && sameVersion(release.version(), latestVersion)
+            ));
+        }
+        return List.copyOf(history);
+    }
+
    public UpdateStatus install(String requestedVersion) {
        requireConfigured();
        if (!isVersion(requestedVersion)) {
@@ -150,6 +199,7 @@ public class SystemUpdateService {

            UpdateStatus starting = checked.withPhase(UpdatePhase.STARTING, 1, "更新助手已启动");
            state.set(starting);
+            persistState(starting);
            process.onExit().thenAccept(completed -> {
                installRunning.set(false);
                if (completed.exitValue() != 0) {
@@ -165,13 +215,67 @@ public class SystemUpdateService {
    }

    private ReleaseInfo fetchLatestRelease() {
+        JsonNode latest = fetchReleaseJson(releaseApiUri("/latest"));
+        if (!isStableChannel() || !isPrerelease(latest)) {
+            return parseRelease(latest);
+        }
+
+        ReleaseInfo selected = null;
+        JsonNode selectedNode = null;
+        for (JsonNode node : fetchReleaseList()) {
+            ReleaseInfo candidate = parseReleaseHistoryItem(node);
+            if (candidate != null && (selected == null
+                    || compareVersions(candidate.version(), selected.version()) > 0)) {
+                selected = candidate;
+                selectedNode = node;
+            }
+        }
+        if (selectedNode == null) {
+            throw new ApiException(404, "Gitea 尚未发布正式版本");
+        }
+        return parseRelease(selectedNode);
+    }
+
+    private List<ReleaseInfo> fetchReleaseHistory() {
+        List<ReleaseInfo> releases = new ArrayList<>();
+        for (JsonNode node : fetchReleaseList()) {
+            ReleaseInfo release = parseReleaseHistoryItem(node);
+            if (release != null) {
+                releases.add(release);
+            }
+        }
+        return List.copyOf(releases);
+    }
+
+    private JsonNode fetchReleaseList() {
+        JsonNode root = fetchReleaseJson(releaseApiUri("?limit=" + MAX_RELEASE_HISTORY + "&page=1"));
+        if (!root.isArray() || root.size() > MAX_RELEASE_HISTORY) {
+            throw new ApiException(502, "Gitea Release 历史数据无效");
+        }
+        return root;
+    }
+
+    private URI releaseApiUri(String suffix) {
        String[] repository = properties.getRepository().split("/", 2);
        if (repository.length != 2 || repository[0].isBlank() || repository[1].isBlank()) {
            throw new ApiException(500, "更新仓库配置无效");
        }
        String base = properties.getGiteaBaseUrl().replaceAll("/+$", "");
-        URI uri = URI.create(base + "/api/v1/repos/" + encode(repository[0]) + "/"
-                + encode(repository[1]) + "/releases/latest");
+        return URI.create(base + "/api/v1/repos/" + encode(repository[0]) + "/"
+                + encode(repository[1]) + "/releases" + suffix);
+    }
+
+    private URI releaseAssetUri(String tag, String name) {
+        String[] repository = properties.getRepository().split("/", 2);
+        if (repository.length != 2 || repository[0].isBlank() || repository[1].isBlank()) {
+            throw new ApiException(500, "更新仓库配置无效");
+        }
+        String base = properties.getGiteaBaseUrl().replaceAll("/+$", "");
+        return URI.create(base + "/" + encode(repository[0]) + "/" + encode(repository[1])
+                + "/releases/download/" + encode(tag) + "/" + encode(name));
+    }
+
+    private JsonNode fetchReleaseJson(URI uri) {
        HttpRequest.Builder builder = HttpRequest.newBuilder(uri)
                .timeout(Duration.ofSeconds(Math.max(1, properties.getRequestTimeoutSeconds())))
                .header("Accept", "application/json")
@@ -182,13 +286,14 @@ public class SystemUpdateService {
        try {
            HttpResponse<String> response = httpClient.send(builder.build(),
                    HttpResponse.BodyHandlers.ofString(StandardCharsets.UTF_8));
+            requireSameOrigin(response.uri(), configuredBaseUri(), "Gitea Release API");
            if (response.statusCode() == 404) {
                throw new ApiException(404, "Gitea 尚未发布 Release");
            }
            if (response.statusCode() < 200 || response.statusCode() >= 300) {
                throw new ApiException(502, "Gitea Release API 返回 HTTP " + response.statusCode());
            }
-            return parseRelease(objectMapper.readTree(response.body()));
+            return objectMapper.readTree(response.body());
        } catch (InterruptedException e) {
            Thread.currentThread().interrupt();
            throw new ApiException(503, "检查更新被中断");
@@ -198,6 +303,22 @@ public class SystemUpdateService {
        }
    }

+    private ReleaseInfo parseReleaseHistoryItem(JsonNode root) {
+        String tag = text(root, "tag_name");
+        if (!isVersion(tag) || root.path("draft").asBoolean(false)) {
+            return null;
+        }
+        if (isPrerelease(root) && isStableChannel()) {
+            return null;
+        }
+        return new ReleaseInfo(
+                normalizeVersion(tag),
+                releaseNotes(root),
+                releasePublishedAt(root),
+                List.of()
+        );
+    }
+
    private ReleaseInfo parseRelease(JsonNode root) {
        String tag = text(root, "tag_name");
        if (!isVersion(tag)) {
@@ -206,18 +327,21 @@ public class SystemUpdateService {
        if (root.path("draft").asBoolean(false)) {
            throw new ApiException(502, "最新 Release 仍是草稿");
        }
-        Matcher versionMatcher = VERSION_PATTERN.matcher(tag);
-        versionMatcher.matches();
-        boolean taggedPrerelease = versionMatcher.group(4) != null;
-        if ((root.path("prerelease").asBoolean(false) || taggedPrerelease)
-                && "stable".equalsIgnoreCase(properties.getChannel())) {
+        if (isPrerelease(root) && isStableChannel()) {
            throw new ApiException(502, "稳定频道拒绝预发布版本");
        }
+        if (!root.path("assets").isArray() || root.path("assets").size() > MAX_RELEASE_ASSETS) {
+            throw new ApiException(502, "Release 文件列表无效");
+        }
        List<ReleaseAsset> assets = new ArrayList<>();
        for (JsonNode node : root.path("assets")) {
+            String name = text(node, "name");
+            if (name.isBlank() || name.length() > MAX_ASSET_NAME_CHARS) {
+                throw new ApiException(502, "Release 文件信息无效");
+            }
            assets.add(new ReleaseAsset(
-                    text(node, "name"),
-                    text(node, "browser_download_url"),
+                    name,
+                    releaseAssetUri(tag, name).toString(),
                    node.path("size").asLong(0)
            ));
        }
@@ -225,16 +349,36 @@ public class SystemUpdateService {
        requireAsset(assets, "kaidi-erp-" + version + ".tar.gz");
        requireAsset(assets, "SHA256SUMS");
        requireAsset(assets, "SHA256SUMS.sig");
-        Instant publishedAt = null;
+        return new ReleaseInfo(version, releaseNotes(root), releasePublishedAt(root), List.copyOf(assets));
+    }
+
+    private boolean isStableChannel() {
+        return "stable".equalsIgnoreCase(properties.getChannel());
+    }
+
+    private static boolean isPrerelease(JsonNode root) {
+        Matcher matcher = VERSION_PATTERN.matcher(text(root, "tag_name"));
+        return root.path("prerelease").asBoolean(false) || (matcher.matches() && matcher.group(4) != null);
+    }
+
+    private static Instant releasePublishedAt(JsonNode root) {
        String published = text(root, "published_at");
-        if (!published.isBlank()) {
+        if (published.isBlank()) {
+            return null;
+        }
        try {
-                publishedAt = Instant.parse(published);
+            return Instant.parse(published);
        } catch (RuntimeException ignore) {
-                // An invalid optional timestamp must not hide an otherwise valid release.
+            return null;
        }
    }
-        return new ReleaseInfo(version, text(root, "body"), publishedAt, List.copyOf(assets));
+
+    private static String releaseNotes(JsonNode root) {
+        String notes = text(root, "body");
+        if (notes.length() > MAX_RELEASE_NOTES_CHARS) {
+            return notes.substring(0, MAX_RELEASE_NOTES_CHARS) + "\n\n[发布说明过长，已截断]";
+        }
+        return notes;
    }

    private void requireConfigured() {
@@ -244,16 +388,15 @@ public class SystemUpdateService {
        if (properties.getGiteaBaseUrl() == null || properties.getGiteaBaseUrl().isBlank()) {
            throw new ApiException(503, "尚未配置 Gitea 地址");
        }
-        URI uri;
-        try {
-            uri = URI.create(properties.getGiteaBaseUrl().trim());
-        } catch (IllegalArgumentException e) {
-            throw new ApiException(500, "Gitea 地址格式无效");
-        }
+        URI uri = configuredBaseUri();
        String scheme = uri.getScheme() == null ? "" : uri.getScheme().toLowerCase(Locale.ROOT);
        if (!"https".equals(scheme) && !(properties.isAllowInsecureHttp() && "http".equals(scheme))) {
            throw new ApiException(503, "更新服务器必须使用 HTTPS");
        }
+        String repository = properties.getRepository() == null ? "" : properties.getRepository().trim();
+        if (!repository.matches("^[A-Za-z0-9][A-Za-z0-9._-]{0,99}/[A-Za-z0-9][A-Za-z0-9._-]{0,99}$")) {
+            throw new ApiException(500, "更新仓库配置无效");
+        }
    }

    private UpdateStatus readHelperState() {
@@ -272,10 +415,15 @@ public class SystemUpdateService {
            String helperVersion = blankToNull(text(root, "version"));
            boolean updateAvailable = helperVersion != null
                    && phase != UpdatePhase.SUCCEEDED
+                    && phase != UpdatePhase.UP_TO_DATE
                    && compareVersions(helperVersion, currentVersion) > 0;
            Instant helperUpdatedAt = parseInstant(text(root, "updatedAt"));
+            Instant publishedAt = parseInstant(text(root, "publishedAt"));
+            String releaseNotes = root.path("releaseNotes").isTextual()
+                    ? root.path("releaseNotes").asText() : memory.releaseNotes();
+            List<ReleaseAsset> assets = readAssets(root.path("assets"), memory.assets());
            return new UpdateStatus(
-                    properties.isEnabled(),
+                    isConfigured(),
                    currentVersion,
                    helperVersion,
                    updateAvailable,
@@ -283,9 +431,9 @@ public class SystemUpdateService {
                    Math.max(0, Math.min(100, root.path("progress").asInt(0))),
                    text(root, "message"),
                    helperUpdatedAt == null ? memory.checkedAt() : helperUpdatedAt,
-                    memory.publishedAt(),
-                    memory.releaseNotes(),
-                    memory.assets(),
+                    publishedAt == null ? memory.publishedAt() : publishedAt,
+                    releaseNotes,
+                    assets,
                    blankToNull(text(root, "error"))
            );
        } catch (Exception e) {
@@ -300,6 +448,137 @@ public class SystemUpdateService {
                .toAbsolutePath().normalize();
    }

+    private void persistState(UpdateStatus status) {
+        Path target = statePath();
+        Path parent = target.getParent();
+        Path temporary = null;
+        try {
+            if (parent != null) {
+                Files.createDirectories(parent);
+            }
+            byte[] content = objectMapper.writeValueAsBytes(java.util.Map.ofEntries(
+                    java.util.Map.entry("phase", status.phase().name()),
+                    java.util.Map.entry("progress", status.progress()),
+                    java.util.Map.entry("message", Objects.requireNonNullElse(status.message(), "")),
+                    java.util.Map.entry("version", Objects.requireNonNullElse(status.latestVersion(), "")),
+                    java.util.Map.entry("error", Objects.requireNonNullElse(status.error(), "")),
+                    java.util.Map.entry("updatedAt", Instant.now().toString()),
+                    java.util.Map.entry("publishedAt", status.publishedAt() == null ? "" : status.publishedAt().toString()),
+                    java.util.Map.entry("releaseNotes", Objects.requireNonNullElse(status.releaseNotes(), "")),
+                    java.util.Map.entry("assets", Objects.requireNonNullElse(status.assets(), List.of()))
+            ));
+            if (content.length > MAX_STATE_BYTES) {
+                throw new IOException("update state is too large");
+            }
+            Path directory = parent == null ? Path.of(".").toAbsolutePath().normalize() : parent;
+            temporary = Files.createTempFile(directory, ".update-state-", ".tmp");
+            Files.write(temporary, content, StandardOpenOption.TRUNCATE_EXISTING);
+            try {
+                Files.setPosixFilePermissions(temporary, Set.of(
+                        PosixFilePermission.OWNER_READ,
+                        PosixFilePermission.OWNER_WRITE,
+                        PosixFilePermission.GROUP_READ));
+            } catch (UnsupportedOperationException ignored) {
+                // Keep local non-POSIX tests portable.
+            }
+            Files.move(temporary, target,
+                    StandardCopyOption.ATOMIC_MOVE, StandardCopyOption.REPLACE_EXISTING);
+            temporary = null;
+        } catch (Exception exception) {
+            log.warn("Unable to persist update state {}: {}", target, exception.getMessage());
+        } finally {
+            if (temporary != null) {
+                try {
+                    Files.deleteIfExists(temporary);
+                } catch (IOException ignored) {
+                    // Best effort cleanup only.
+                }
+            }
+        }
+    }
+
+    private List<ReleaseAsset> readAssets(JsonNode node, List<ReleaseAsset> fallback) {
+        if (!node.isArray()) {
+            return fallback == null ? List.of() : fallback;
+        }
+        if (node.size() > MAX_RELEASE_ASSETS) {
+            return List.of();
+        }
+        List<ReleaseAsset> assets = new ArrayList<>();
+        for (JsonNode asset : node) {
+            String name = text(asset, "name");
+            String downloadUrl = text(asset, "downloadUrl");
+            if (name.isBlank() || downloadUrl.isBlank()) {
+                continue;
+            }
+            validateAssetUrl(downloadUrl);
+            assets.add(new ReleaseAsset(name, downloadUrl, asset.path("size").asLong(0)));
+        }
+        return List.copyOf(assets);
+    }
+
+    private URI configuredBaseUri() {
+        URI uri;
+        try {
+            uri = URI.create(Objects.requireNonNullElse(properties.getGiteaBaseUrl(), "").trim());
+        } catch (IllegalArgumentException exception) {
+            throw new ApiException(500, "Gitea 地址格式无效");
+        }
+        if (uri.getHost() == null || uri.getUserInfo() != null || uri.getRawQuery() != null
+                || uri.getRawFragment() != null || uri.getPort() > 65535) {
+            throw new ApiException(500, "Gitea 地址格式无效");
+        }
+        return uri;
+    }
+
+    private void validateAssetUrl(String value) {
+        URI asset;
+        try {
+            asset = URI.create(value);
+        } catch (IllegalArgumentException exception) {
+            throw new ApiException(502, "Release 文件地址无效");
+        }
+        if (asset.getUserInfo() != null || asset.getRawFragment() != null) {
+            throw new ApiException(502, "Release 文件地址无效");
+        }
+        requireSameOrigin(asset, configuredBaseUri(), "Release 文件");
+    }
+
+    private static void requireSameOrigin(URI actual, URI expected, String label) {
+        String actualScheme = Objects.requireNonNullElse(actual.getScheme(), "").toLowerCase(Locale.ROOT);
+        String expectedScheme = Objects.requireNonNullElse(expected.getScheme(), "").toLowerCase(Locale.ROOT);
+        String actualHost = Objects.requireNonNullElse(actual.getHost(), "").toLowerCase(Locale.ROOT);
+        String expectedHost = Objects.requireNonNullElse(expected.getHost(), "").toLowerCase(Locale.ROOT);
+        if (!actualScheme.equals(expectedScheme) || !actualHost.equals(expectedHost)
+                || effectivePort(actual) != effectivePort(expected)) {
+            throw new ApiException(502, label + "跳转到了未受信任的服务器");
+        }
+    }
+
+    private static int effectivePort(URI uri) {
+        if (uri.getPort() >= 0) {
+            return uri.getPort();
+        }
+        return "https".equalsIgnoreCase(uri.getScheme()) ? 443 : 80;
+    }
+
+    private boolean isConfigured() {
+        return properties.isEnabled()
+                && properties.getGiteaBaseUrl() != null
+                && !properties.getGiteaBaseUrl().isBlank()
+                && properties.getRepository() != null
+                && !properties.getRepository().isBlank();
+    }
+
+    private static boolean isActivePhase(UpdatePhase phase) {
+        return phase == UpdatePhase.STARTING
+                || phase == UpdatePhase.DOWNLOADING
+                || phase == UpdatePhase.VERIFYING
+                || phase == UpdatePhase.INSTALLING
+                || phase == UpdatePhase.RESTARTING
+                || phase == UpdatePhase.ROLLING_BACK;
+    }
+
    private static String text(JsonNode node, String field) {
        JsonNode value = node.path(field);
        return value.isTextual() ? value.asText().trim() : "";
@@ -422,6 +701,15 @@ public class SystemUpdateService {
    public record ReleaseAsset(String name, String downloadUrl, long size) {
    }

+    public record ReleaseHistoryItem(
+            String version,
+            Instant publishedAt,
+            String releaseNotes,
+            boolean current,
+            boolean latest
+    ) {
+    }
+
    public enum UpdatePhase {
        IDLE,
        CHECKING,
@@ -4,6 +4,7 @@ import com.kaidi.oa.common.ApiException;
 import com.kaidi.oa.common.ApiResp;
 import com.kaidi.oa.domain.SysUser;
 import com.kaidi.oa.service.AuthService;
+import com.kaidi.oa.service.AuthorizationService;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.validation.constraints.NotBlank;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -14,6 +15,7 @@ import org.springframework.web.bind.annotation.RestController;

 import java.util.LinkedHashMap;
 import java.util.Map;
+import java.util.TreeSet;

 /**
 * Authentication endpoints. Issues an opaque token on login; the frontend sends
@@ -25,10 +27,13 @@ public class AuthController {

    private final AuthService authService;
    private final CurrentUserResolver currentUser;
+    private final AuthorizationService authorizationService;

-    public AuthController(AuthService authService, CurrentUserResolver currentUser) {
+    public AuthController(AuthService authService, CurrentUserResolver currentUser,
+                          AuthorizationService authorizationService) {
        this.authService = authService;
        this.currentUser = currentUser;
+        this.authorizationService = authorizationService;
    }

    public record LoginRequest(@NotBlank String loginName, @NotBlank String password) {
@@ -65,6 +70,7 @@ public class AuthController {
        map.put("deptId", user.getDeptId());
        map.put("title", user.getTitle());
        map.put("email", user.getEmail());
+        map.put("roles", new TreeSet<>(authorizationService.roleCodesOf(user.getId())));
        return map;
    }
 }
@@ -1,6 +1,7 @@
 package com.kaidi.oa.web;

 import com.kaidi.oa.common.ApiResp;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -8,6 +9,9 @@ import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;

 import javax.sql.DataSource;
+import java.nio.file.Files;
+import java.nio.file.InvalidPathException;
+import java.nio.file.Path;
 import java.sql.Connection;
 import java.sql.ResultSet;
 import java.sql.Statement;
@@ -19,9 +23,12 @@ import java.util.Map;
 public class HealthController {

    private final DataSource dataSource;
+    private final Path installLockFile;

-    public HealthController(DataSource dataSource) {
+    public HealthController(DataSource dataSource,
+                            @Value("${ERP_INSTALL_LOCK_FILE:}") String installLockFile) {
        this.dataSource = dataSource;
+        this.installLockFile = resolveInstallLockFile(installLockFile);
    }

    @GetMapping("/health")
@@ -30,12 +37,31 @@ public class HealthController {
                Statement statement = connection.createStatement();
                ResultSet result = statement.executeQuery("SELECT 1")) {
            if (connection.isValid(2) && result.next() && result.getInt(1) == 1) {
-                return ResponseEntity.ok(ApiResp.ok(Map.of("status", "UP", "database", "UP")));
+                return ResponseEntity.ok(ApiResp.ok(readiness("UP", "UP")));
            }
        } catch (Exception ignored) {
            // Health responses deliberately avoid exposing connection details.
        }
        return ResponseEntity.status(HttpStatus.SERVICE_UNAVAILABLE)
-                .body(new ApiResp<>(50301, "database unavailable", Map.of("status", "DOWN", "database", "DOWN")));
+                .body(new ApiResp<>(50301, "database unavailable", readiness("DOWN", "DOWN")));
+    }
+
+    private Map<String, String> readiness(String status, String database) {
+        return Map.of(
+                "status", status,
+                "database", database,
+                "installLocked", Boolean.toString(installLockFile != null && Files.isRegularFile(installLockFile))
+        );
+    }
+
+    private static Path resolveInstallLockFile(String value) {
+        if (value == null || value.isBlank()) {
+            return null;
+        }
+        try {
+            return Path.of(value).toAbsolutePath().normalize();
+        } catch (InvalidPathException ignored) {
+            return null;
+        }
    }
 }
@@ -1,25 +1,47 @@
 package com.kaidi.oa.web;

 import com.kaidi.oa.common.ApiResp;
+import com.kaidi.oa.service.SystemUpdateConfigService;
+import com.kaidi.oa.service.SystemUpdateConfigService.UpdateConfig;
+import com.kaidi.oa.service.SystemUpdateConfigService.UpdateConfigRequest;
 import com.kaidi.oa.service.SystemUpdateService;
+import com.kaidi.oa.service.SystemUpdateService.ReleaseHistoryItem;
 import com.kaidi.oa.service.SystemUpdateService.UpdateStatus;
 import jakarta.validation.Valid;
 import jakarta.validation.constraints.NotBlank;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.PutMapping;
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;

+import java.util.List;
+
 /** Administrator-only API for checking and installing signed Gitea releases. */
@RestController
@RequestMapping("/api/oa/system-update")
 public class SystemUpdateController {

    private final SystemUpdateService updateService;
+    private final SystemUpdateConfigService configService;

-    public SystemUpdateController(SystemUpdateService updateService) {
+    public SystemUpdateController(SystemUpdateService updateService, SystemUpdateConfigService configService) {
        this.updateService = updateService;
+        this.configService = configService;
+    }
+
+    @GetMapping("/config")
+    public ApiResp<UpdateConfig> config() {
+        return ApiResp.ok(configService.get());
+    }
+
+    @PutMapping("/config")
+    public ApiResp<UpdateConfig> saveConfig(@Valid @RequestBody UpdateConfigRequest request) {
+        updateService.ensureConfigurationMutable();
+        UpdateConfig saved = configService.save(request);
+        updateService.configurationChanged();
+        return ApiResp.ok(saved);
    }

    @GetMapping("/status")
@@ -27,6 +49,11 @@ public class SystemUpdateController {
        return ApiResp.ok(updateService.status());
    }

+    @GetMapping("/releases")
+    public ApiResp<List<ReleaseHistoryItem>> releases() {
+        return ApiResp.ok(updateService.releases());
+    }
+
    @PostMapping("/check")
    public ApiResp<UpdateStatus> check() {
        return ApiResp.ok(updateService.check());
@@ -1,5 +1,8 @@
 server:
  port: 8090
+  # Reconstruct the public scheme/host when running behind Nginx, Caddy or a
+  # tunnel so same-origin HTTPS requests are not rejected as cross-origin.
+  forward-headers-strategy: framework

 spring:
  application:
@@ -61,10 +64,11 @@ oa:
    model: claude-haiku-4-5-20251001
  update:
    enabled: ${OA_UPDATE_ENABLED:false}
-    gitea-base-url: ${OA_UPDATE_GITEA_BASE_URL:}
+    gitea-base-url: ${OA_UPDATE_GITEA_BASE_URL:https://git.awaioi.com}
    repository: ${OA_UPDATE_REPOSITORY:awaioi/ERP}
    channel: ${OA_UPDATE_CHANNEL:stable}
    token: ${OA_UPDATE_TOKEN:}
    helper-command: ${OA_UPDATE_HELPER_COMMAND:}
    state-file: ${OA_UPDATE_STATE_FILE:./runtime/update-state.json}
+    config-file: ${ERP_CONFIG_FILE:}
    allow-insecure-http: ${OA_UPDATE_ALLOW_INSECURE_HTTP:false}
@@ -0,0 +1,98 @@
+package com.kaidi.oa.service;
+
+import com.kaidi.oa.common.ApiException;
+import com.kaidi.oa.config.UpdateProperties;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+class SystemUpdateConfigServiceTest {
+
+    @TempDir
+    Path tempDir;
+
+    @Test
+    void atomicallyUpdatesOnlyUpdaterSettingsAndNeverReturnsToken() throws Exception {
+        Path configFile = tempDir.resolve("erp.env");
+        Files.writeString(configFile, """
+                OA_DB_PASSWORD='keep-this-secret'
+                OA_UPDATE_ENABLED='true'
+                OA_UPDATE_GITEA_BASE_URL='https://old.example'
+                OA_UPDATE_REPOSITORY='old/ERP'
+                OA_UPDATE_CHANNEL='stable'
+                OA_UPDATE_TOKEN='old-token'
+                OA_UPDATE_ALLOW_INSECURE_HTTP='false'
+                """);
+        UpdateProperties properties = properties(configFile);
+        properties.setToken("old-token");
+        SystemUpdateConfigService service = new SystemUpdateConfigService(properties);
+
+        SystemUpdateConfigService.UpdateConfig saved = service.save(
+                new SystemUpdateConfigService.UpdateConfigRequest(
+                        true,
+                        "http://gitea.internal.test:10099/",
+                        "awaioi/ERP",
+                        "stable",
+                        "new-token_123",
+                        false,
+                        true));
+
+        String persisted = Files.readString(configFile);
+        assertThat(persisted).contains("OA_DB_PASSWORD='keep-this-secret'");
+        assertThat(persisted).contains("OA_UPDATE_GITEA_BASE_URL='http://gitea.internal.test:10099'");
+        assertThat(persisted).contains("OA_UPDATE_TOKEN='new-token_123'");
+        assertThat(saved.tokenConfigured()).isTrue();
+        assertThat(saved.toString()).doesNotContain("new-token_123");
+        assertThat(properties.getToken()).isEqualTo("new-token_123");
+    }
+
+    @Test
+    void blankTokenKeepsExistingTokenAndExplicitClearRemovesIt() throws Exception {
+        Path configFile = tempDir.resolve("erp.env");
+        Files.writeString(configFile, "OA_DB_PASSWORD='database-secret'\n");
+        UpdateProperties properties = properties(configFile);
+        properties.setToken("existing-token");
+        SystemUpdateConfigService service = new SystemUpdateConfigService(properties);
+
+        service.save(request("" , false));
+        assertThat(properties.getToken()).isEqualTo("existing-token");
+        assertThat(Files.readString(configFile)).contains("OA_UPDATE_TOKEN='existing-token'");
+
+        SystemUpdateConfigService.UpdateConfig cleared = service.save(request("", true));
+        assertThat(cleared.tokenConfigured()).isFalse();
+        assertThat(properties.getToken()).isEmpty();
+        assertThat(Files.readString(configFile)).contains("OA_UPDATE_TOKEN=''");
+    }
+
+    @Test
+    void rejectsPlainHttpWithoutExplicitOptIn() throws Exception {
+        Path configFile = tempDir.resolve("erp.env");
+        Files.writeString(configFile, "OA_UPDATE_ENABLED='false'\n");
+        SystemUpdateConfigService service = new SystemUpdateConfigService(properties(configFile));
+
+        assertThatThrownBy(() -> service.save(new SystemUpdateConfigService.UpdateConfigRequest(
+                true, "http://gitea.example", "awaioi/ERP", "stable", "", false, false)))
+                .isInstanceOf(ApiException.class)
+                .hasMessageContaining("HTTPS");
+    }
+
+    private UpdateProperties properties(Path configFile) {
+        UpdateProperties properties = new UpdateProperties();
+        properties.setEnabled(true);
+        properties.setGiteaBaseUrl("https://old.example");
+        properties.setRepository("awaioi/ERP");
+        properties.setChannel("stable");
+        properties.setConfigFile(configFile.toString());
+        return properties;
+    }
+
+    private SystemUpdateConfigService.UpdateConfigRequest request(String token, boolean clearToken) {
+        return new SystemUpdateConfigService.UpdateConfigRequest(
+                true, "https://gitea.example", "awaioi/ERP", "stable", token, clearToken, false);
+    }
+}
@@ -5,6 +5,7 @@ import com.kaidi.oa.common.ApiException;
 import com.kaidi.oa.config.UpdateProperties;
 import com.sun.net.httpserver.HttpServer;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.springframework.beans.factory.ObjectProvider;
 import org.springframework.boot.info.BuildProperties;

@@ -13,6 +14,7 @@ import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.time.Instant;
+import java.util.List;
 import java.util.Properties;

 import static org.assertj.core.api.Assertions.assertThat;
@@ -22,6 +24,9 @@ import static org.mockito.Mockito.when;

 class SystemUpdateServiceTest {

+    @TempDir
+    Path tempDir;
+
    @Test
    void comparesReleaseVersionsWithoutLexicographicMistakes() {
        assertThat(SystemUpdateService.compareVersions("v0.10.0", "0.9.9")).isPositive();
@@ -46,9 +51,9 @@ class SystemUpdateServiceTest {
                      "prerelease": false,
                      "published_at": "2026-08-03T10:00:00Z",
                      "assets": [
-                        {"name":"kaidi-erp-0.2.0.tar.gz","browser_download_url":"https://example.test/app","size":123},
-                        {"name":"SHA256SUMS","browser_download_url":"https://example.test/sums","size":64},
-                        {"name":"SHA256SUMS.sig","browser_download_url":"https://example.test/sig","size":64}
+                        {"name":"kaidi-erp-0.2.0.tar.gz","browser_download_url":"http://legacy.invalid/app","size":123},
+                        {"name":"SHA256SUMS","browser_download_url":"http://legacy.invalid/sums","size":64},
+                        {"name":"SHA256SUMS.sig","browser_download_url":"http://legacy.invalid/sig","size":64}
                      ]
                    }
                    """.getBytes(StandardCharsets.UTF_8);
@@ -69,6 +74,153 @@ class SystemUpdateServiceTest {
            assertThat(status.latestVersion()).isEqualTo("0.2.0");
            assertThat(status.assets()).extracting(SystemUpdateService.ReleaseAsset::name)
                    .containsExactly("kaidi-erp-0.2.0.tar.gz", "SHA256SUMS", "SHA256SUMS.sig");
+            assertThat(status.assets()).extracting(SystemUpdateService.ReleaseAsset::downloadUrl)
+                    .allMatch(url -> url.startsWith("http://127.0.0.1:" + server.getAddress().getPort()
+                            + "/awaioi/ERP/releases/download/v0.2.0/"));
+        } finally {
+            server.stop(0);
+        }
+    }
+
+    @Test
+    void stableChannelFallsBackToNewestStableReleaseWhenLatestIsPrerelease() throws Exception {
+        HttpServer server = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0);
+        server.createContext("/api/v1/repos/awaioi/ERP/releases/latest", exchange -> {
+            byte[] body = """
+                    {"tag_name":"v0.3.7-rc.1","draft":false,"prerelease":true,"assets":[]}
+                    """.getBytes(StandardCharsets.UTF_8);
+            exchange.sendResponseHeaders(200, body.length);
+            exchange.getResponseBody().write(body);
+            exchange.close();
+        });
+        server.createContext("/api/v1/repos/awaioi/ERP/releases", exchange -> {
+            String origin = "http://127.0.0.1:" + exchange.getLocalAddress().getPort();
+            byte[] body = ("""
+                    [
+                      {"tag_name":"v0.3.7-rc.1","draft":false,"prerelease":true,"assets":[]},
+                      {"tag_name":"v0.3.5","draft":false,"prerelease":false,"assets":[]},
+                      {"tag_name":"v0.3.6","body":"Latest stable","draft":false,"prerelease":false,
+                       "published_at":"2026-08-04T10:00:00Z","assets":[
+                         {"name":"kaidi-erp-0.3.6.tar.gz","browser_download_url":"%s/app","size":123},
+                         {"name":"SHA256SUMS","browser_download_url":"%s/sums","size":64},
+                         {"name":"SHA256SUMS.sig","browser_download_url":"%s/sig","size":64}
+                       ]}
+                    ]
+                    """).formatted(origin, origin, origin).getBytes(StandardCharsets.UTF_8);
+            exchange.sendResponseHeaders(200, body.length);
+            exchange.getResponseBody().write(body);
+            exchange.close();
+        });
+        server.start();
+        try {
+            SystemUpdateService service = service(configuredProperties(server.getAddress().getPort()), "0.3.5");
+
+            SystemUpdateService.UpdateStatus status = service.check();
+
+            assertThat(status.latestVersion()).isEqualTo("0.3.6");
+            assertThat(status.updateAvailable()).isTrue();
+            assertThat(status.releaseNotes()).isEqualTo("Latest stable");
+        } finally {
+            server.stop(0);
+        }
+    }
+
+    @Test
+    void listsStableReleaseHistoryNewestFirstAndMarksCurrentVersion() throws Exception {
+        HttpServer server = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0);
+        server.createContext("/api/v1/repos/awaioi/ERP/releases", exchange -> {
+            byte[] body = """
+                    [
+                      {"tag_name":"v0.3.4","body":"Older fixes","draft":false,"prerelease":false,
+                       "published_at":"2026-08-03T10:00:00Z"},
+                      {"tag_name":"v0.3.6","body":"Simplified updater","draft":false,"prerelease":false,
+                       "published_at":"2026-08-04T10:00:00Z"},
+                      {"tag_name":"v0.3.7-rc.1","body":"Preview","draft":false,"prerelease":true},
+                      {"tag_name":"v0.3.8","body":"Draft","draft":true,"prerelease":false},
+                      {"tag_name":"not-a-version","body":"Invalid","draft":false,"prerelease":false}
+                    ]
+                    """.getBytes(StandardCharsets.UTF_8);
+            exchange.getResponseHeaders().add("Content-Type", "application/json");
+            exchange.sendResponseHeaders(200, body.length);
+            exchange.getResponseBody().write(body);
+            exchange.close();
+        });
+        server.start();
+        try {
+            SystemUpdateService service = service(configuredProperties(server.getAddress().getPort()), "0.3.4");
+
+            List<SystemUpdateService.ReleaseHistoryItem> releases = service.releases();
+
+            assertThat(releases).extracting(SystemUpdateService.ReleaseHistoryItem::version)
+                    .containsExactly("0.3.6", "0.3.4");
+            assertThat(releases.get(0).latest()).isTrue();
+            assertThat(releases.get(0).current()).isFalse();
+            assertThat(releases.get(1).current()).isTrue();
+            assertThat(releases.get(1).releaseNotes()).isEqualTo("Older fixes");
+        } finally {
+            server.stop(0);
+        }
+    }
+
+    @Test
+    void persistsReleaseMetadataAcrossServiceRestart() throws Exception {
+        Path stateFile = Files.createTempFile("system-update-metadata-", ".json");
+        HttpServer server = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0);
+        server.createContext("/api/v1/repos/awaioi/ERP/releases/latest", exchange -> {
+            String origin = "http://127.0.0.1:" + exchange.getLocalAddress().getPort();
+            byte[] body = ("""
+                    {"tag_name":"v0.4.0","body":"Fix updater UI","draft":false,"prerelease":false,
+                     "published_at":"2026-08-04T09:30:00Z","assets":[
+                     {"name":"kaidi-erp-0.4.0.tar.gz","browser_download_url":"%s/app","size":123},
+                     {"name":"SHA256SUMS","browser_download_url":"%s/sums","size":64},
+                     {"name":"SHA256SUMS.sig","browser_download_url":"%s/sig","size":64}]}
+                    """).formatted(origin, origin, origin).getBytes(StandardCharsets.UTF_8);
+            exchange.sendResponseHeaders(200, body.length);
+            exchange.getResponseBody().write(body);
+            exchange.close();
+        });
+        server.start();
+        try {
+            UpdateProperties properties = configuredProperties(server.getAddress().getPort());
+            properties.setStateFile(stateFile.toString());
+            SystemUpdateService first = service(properties, "0.3.0");
+            first.check();
+
+            SystemUpdateService restarted = service(properties, "0.3.0");
+            SystemUpdateService.UpdateStatus restored = restarted.status();
+
+            assertThat(restored.releaseNotes()).isEqualTo("Fix updater UI");
+            assertThat(restored.publishedAt()).isEqualTo(Instant.parse("2026-08-04T09:30:00Z"));
+            assertThat(restored.assets()).hasSize(3);
+            assertThat(restored.updateAvailable()).isTrue();
+        } finally {
+            server.stop(0);
+            Files.deleteIfExists(stateFile);
+        }
+    }
+
+    @Test
+    void ignoresReleaseAssetOriginsAndBuildsTrustedDownloadUrls() throws Exception {
+        HttpServer server = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0);
+        server.createContext("/api/v1/repos/awaioi/ERP/releases/latest", exchange -> {
+            byte[] body = """
+                    {"tag_name":"v0.4.0","draft":false,"prerelease":false,"assets":[
+                     {"name":"kaidi-erp-0.4.0.tar.gz","browser_download_url":"https://evil.example/app","size":123},
+                     {"name":"SHA256SUMS","browser_download_url":"https://evil.example/sums","size":64},
+                     {"name":"SHA256SUMS.sig","browser_download_url":"https://evil.example/sig","size":64}]}
+                    """.getBytes(StandardCharsets.UTF_8);
+            exchange.sendResponseHeaders(200, body.length);
+            exchange.getResponseBody().write(body);
+            exchange.close();
+        });
+        server.start();
+        try {
+            SystemUpdateService service = service(configuredProperties(server.getAddress().getPort()), "0.3.0");
+            SystemUpdateService.UpdateStatus status = service.check();
+
+            assertThat(status.assets()).extracting(SystemUpdateService.ReleaseAsset::downloadUrl)
+                    .allMatch(url -> url.startsWith("http://127.0.0.1:" + server.getAddress().getPort()
+                            + "/awaioi/ERP/releases/download/v0.4.0/"));
        } finally {
            server.stop(0);
        }
@@ -112,12 +264,13 @@ class SystemUpdateServiceTest {
        }
    }

-    private static UpdateProperties configuredProperties(int port) {
+    private UpdateProperties configuredProperties(int port) {
        UpdateProperties properties = new UpdateProperties();
        properties.setEnabled(true);
        properties.setAllowInsecureHttp(true);
        properties.setGiteaBaseUrl("http://127.0.0.1:" + port);
        properties.setRepository("awaioi/ERP");
+        properties.setStateFile(tempDir.resolve("update-state-" + System.nanoTime() + ".json").toString());
        return properties;
    }

@@ -0,0 +1,56 @@
+package com.kaidi.oa.web;
+
+import com.kaidi.oa.common.ApiResp;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.springframework.http.ResponseEntity;
+
+import javax.sql.DataSource;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.sql.Connection;
+import java.sql.ResultSet;
+import java.sql.Statement;
+import java.util.Map;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+class HealthControllerTest {
+
+    @TempDir
+    Path tempDir;
+
+    @Test
+    void reportsTheActualInstallationLockState() throws Exception {
+        DataSource dataSource = mock(DataSource.class);
+        Connection connection = mock(Connection.class);
+        Statement statement = mock(Statement.class);
+        ResultSet resultSet = mock(ResultSet.class);
+        when(dataSource.getConnection()).thenReturn(connection);
+        when(connection.createStatement()).thenReturn(statement);
+        when(connection.isValid(2)).thenReturn(true);
+        when(statement.executeQuery("SELECT 1")).thenReturn(resultSet);
+        when(resultSet.next()).thenReturn(true);
+        when(resultSet.getInt(1)).thenReturn(1);
+
+        Path lockFile = tempDir.resolve("install.lock");
+        HealthController controller = new HealthController(dataSource, lockFile.toString());
+
+        assertThat(healthData(controller.health())).containsEntry("installLocked", "false");
+
+        Files.writeString(lockFile, "locked\n");
+
+        assertThat(healthData(controller.health()))
+                .containsEntry("status", "UP")
+                .containsEntry("database", "UP")
+                .containsEntry("installLocked", "true");
+    }
+
+    private static Map<String, String> healthData(
+            ResponseEntity<ApiResp<Map<String, String>>> response) {
+        assertThat(response.getBody()).isNotNull();
+        return response.getBody().data();
+    }
+}
@@ -49,6 +49,7 @@ export type OaMenuItem = {
  /** page archetype the builder implements: list | form | detail | portal | tree | calendar | board | settings | report */
  kind: 'list' | 'form' | 'detail' | 'portal' | 'tree' | 'calendar' | 'board' | 'settings' | 'report'
  path: string
+  adminOnly?: boolean
 }

 export type OaModule = {
@@ -98,7 +99,7 @@ export const oaModules: OaModule[] = [
      { key: 'workbench', label: '工作台', kind: 'portal', path: '/appdev/workbench' },
      { key: 'appmgr', label: '应用管理中心', kind: 'list', path: '/appdev/appmgr' },
      { key: 'ops', label: '运维中心', kind: 'settings', path: '/appdev/ops' },
-      { key: 'update', label: '系统更新', kind: 'settings', path: '/appdev/update' },
+      { key: 'update', label: '系统更新', kind: 'settings', path: '/appdev/update', adminOnly: true },
      { key: 'monitor', label: '监测中心', kind: 'report', path: '/appdev/monitor' },
      { key: 'aiassist', label: 'AI 助手', kind: 'portal', path: '/appdev/aiassist' },
      { key: 'ruleconfig', label: '联动规则配置', kind: 'list', path: '/appdev/ruleconfig' }
@@ -26,13 +26,20 @@ import {
  userShortcuts
 } from './shortcuts'
 import { useSession, currentUserName, currentDeptName } from './session'
-import { oaApi, type OaMessage } from './api'
+import { oaApi, type OaMessage, type SystemUpdateStatus } from './api'

 const route = useRoute()
 const router = useRouter()

 const session = useSession()
 const userInitial = computed(() => currentUserName.value.slice(0, 1) || '我')
+const isAdmin = computed(() => session.user.value?.roles?.includes('ADMIN') === true)
+const visibleModules = computed<OaModule[]>(() => oaModules
+  .map((module) => ({
+    ...module,
+    children: module.children.filter((child) => !child.adminOnly || isAdmin.value)
+  }))
+  .filter((module) => module.children.length > 0))
 async function handleLogout() {
  await session.logout()
  ElMessage.success('已退出登录')
@@ -42,6 +49,10 @@ async function handleLogout() {
 const unreadCount = ref(0)
 const messages = ref<OaMessage[]>([])
 let unreadTimer: ReturnType<typeof setInterval> | undefined
+let updateTimer: ReturnType<typeof setInterval> | undefined
+const updateStatus = ref<SystemUpdateStatus | null>(null)
+const updateAvailable = computed(() => updateStatus.value?.updateAvailable === true)
+const updateVersion = computed(() => updateStatus.value?.latestVersion || '')

 async function loadUnread() {
  try {
@@ -58,6 +69,14 @@ async function loadMessages() {
    messages.value = []
  }
 }
+async function loadUpdateStatus() {
+  if (!isAdmin.value) return
+  try {
+    updateStatus.value = await oaApi.getSystemUpdateStatus()
+  } catch {
+    // The updater must never block the application shell.
+  }
+}
 async function readAllMessages() {
  try {
    await oaApi.markAllMessagesRead()
@@ -108,11 +127,14 @@ function msgTagType(type: string): 'warning' | 'danger' | 'success' | 'info' {

 onMounted(() => {
  void loadUnread()
+  void loadUpdateStatus()
  // 轻量轮询未读数（30s），让铃铛徽标随新待办/退回/办结即时更新。
  unreadTimer = setInterval(() => void loadUnread(), 30000)
+  updateTimer = setInterval(() => void loadUpdateStatus(), 10 * 60 * 1000)
 })
 onBeforeUnmount(() => {
  if (unreadTimer) clearInterval(unreadTimer)
+  if (updateTimer) clearInterval(updateTimer)
 })

 const globalQuery = ref('')
@@ -157,14 +179,14 @@ const currentSpaceLabel = computed(

 // The active top module is whichever module owns the current route path.
 const activeModuleId = computed(() => {
-  const match = oaModules.find((module) => route.path.startsWith(module.path))
+  const match = visibleModules.value.find((module) => route.path.startsWith(module.path))
  return match?.id || ''
 })

 // ----- 侧边导航（el-menu）-----
 // 当前高亮项：优先精确命中某子页路径，否则取最长前缀匹配（兼容 /collab/handle?id= 等子路由）。
 const activeMenu = computed(() => {
-  const paths = oaModules.flatMap((module) => module.children.map((child) => child.path))
+  const paths = visibleModules.value.flatMap((module) => module.children.map((child) => child.path))
  if (paths.includes(route.path)) return route.path
  const prefixHit = paths
    .filter((p) => route.path.startsWith(p))
@@ -253,7 +275,7 @@ function runGlobalSearch() {
              <div class="oa-appcenter__head">应用中心</div>
              <div class="oa-appcenter__grid">
                <button
-                  v-for="module in oaModules"
+                  v-for="module in visibleModules"
                  :key="module.id"
                  type="button"
                  class="oa-appcenter__item"
@@ -315,9 +337,18 @@ function runGlobalSearch() {
              </el-scrollbar>
            </div>
          </el-popover>
-          <el-tooltip content="设置" placement="bottom">
-            <el-button class="oa-tools__btn" :icon="Setting" text circle @click="navigate('/hr/worktime')" />
+          <el-badge
+            v-if="isAdmin"
+            :is-dot="updateAvailable"
+            :hidden="!updateAvailable"
+            class="oa-tools__update-badge"
+          >
+            <el-tooltip :content="updateAvailable ? `发现新版本 ${updateVersion}` : '系统更新'" placement="bottom">
+              <el-button class="oa-tools__btn oa-update-entry" :icon="Setting" text @click="navigate('/appdev/update')">
+                系统更新
+              </el-button>
            </el-tooltip>
+          </el-badge>
          <el-dropdown trigger="click">
            <span class="oa-avatar">
              <el-avatar :size="30" class="oa-avatar__img">{{ userInitial }}</el-avatar>
@@ -327,6 +358,9 @@ function runGlobalSearch() {
                <el-dropdown-item disabled>{{ currentUserName }}{{ currentDeptName ? ' · ' + currentDeptName : '' }}</el-dropdown-item>
                <el-dropdown-item divided @click="navigate('/')">个人空间</el-dropdown-item>
                <el-dropdown-item @click="navigate('/contacts')">通讯录</el-dropdown-item>
+                <el-dropdown-item v-if="isAdmin" @click="navigate('/appdev/update')">
+                  {{ updateAvailable ? `系统更新 · ${updateVersion}` : '系统更新' }}
+                </el-dropdown-item>
                <el-dropdown-item divided @click="handleLogout">退出登录</el-dropdown-item>
              </el-dropdown-menu>
            </template>
@@ -346,7 +380,7 @@ function runGlobalSearch() {
            unique-opened
            @select="onMenuSelect"
          >
-            <el-sub-menu v-for="module in oaModules" :key="module.id" :index="module.id">
+            <el-sub-menu v-for="module in visibleModules" :key="module.id" :index="module.id">
              <template #title>
                <el-icon class="oa-menu__icon"><component :is="module.icon" /></el-icon>
                <span class="oa-menu__label">{{ module.label }}</span>
@@ -457,8 +491,19 @@ function runGlobalSearch() {
        </button>
      </div>

+      <button
+        v-if="isAdmin"
+        type="button"
+        class="oa-mobilenav__update"
+        @click="goMobile('/appdev/update')"
+      >
+        <el-icon><Setting /></el-icon>
+        <span>系统更新</span>
+        <el-tag v-if="updateAvailable" type="warning" effect="plain" size="small">{{ updateVersion }}</el-tag>
+      </button>
+
      <el-collapse class="oa-mobilenav__modules" accordion>
-        <el-collapse-item v-for="module in oaModules" :key="module.id" :name="module.id">
+        <el-collapse-item v-for="module in visibleModules" :key="module.id" :name="module.id">
          <template #title>
            <el-icon class="oa-mobilenav__mod-icon"><component :is="module.icon" /></el-icon>
            <span class="oa-mobilenav__mod-label">{{ module.label }}</span>
@@ -569,6 +614,16 @@ function runGlobalSearch() {
  right: 10px;
 }

+.oa-tools__update-badge :deep(.el-badge__content.is-dot) {
+  top: 6px;
+  right: 8px;
+}
+
+.oa-update-entry {
+  padding-inline: var(--erp-space-2);
+  font-size: var(--erp-font-size-sm);
+}
+
 .oa-search__hint {
  margin: var(--erp-space-2) 0 0;
  color: var(--erp-color-text-subtle);
@@ -977,6 +1032,27 @@ function runGlobalSearch() {
  border-top: 0;
 }

+.oa-mobilenav__update {
+  display: flex;
+  align-items: center;
+  gap: var(--erp-space-2);
+  width: 100%;
+  min-height: 44px;
+  padding: var(--erp-space-2) var(--erp-space-3);
+  margin: var(--erp-space-3) 0;
+  color: var(--erp-color-text);
+  font-size: var(--erp-font-size-sm);
+  font-weight: 650;
+  text-align: left;
+  background: var(--erp-color-surface-muted);
+  border: 1px solid var(--erp-color-border-soft);
+  border-radius: var(--erp-radius-sm);
+}
+
+.oa-mobilenav__update span {
+  flex: 1;
+}
+
 .oa-mobilenav__mod-icon {
  margin-right: var(--erp-space-2);
  color: var(--erp-color-primary);
@@ -1036,6 +1112,14 @@ function runGlobalSearch() {
  .oa-tools {
    gap: 0;
  }
+  .oa-update-entry {
+    width: 36px;
+    padding: 0;
+    font-size: 0;
+  }
+  .oa-update-entry :deep(.el-icon) {
+    font-size: var(--erp-font-size-lg);
+  }
  .oa-avatar {
    margin-left: var(--erp-space-1);
  }
@@ -11,6 +11,7 @@ export interface OaSession {
  deptId: number | null
  title: string | null
  email: string | null
+  roles: string[]
 }

 /** POST /auth/login -> stores the token and returns the session. */
@@ -190,6 +190,7 @@ export const oaApi = {
  listAlerts: alertsApi.listAlerts,
  // 系统更新
  getSystemUpdateStatus: updateApi.getSystemUpdateStatus,
+  getSystemUpdateReleases: updateApi.getSystemUpdateReleases,
  checkSystemUpdate: updateApi.checkSystemUpdate,
  installSystemUpdate: updateApi.installSystemUpdate
 }
@@ -216,7 +217,9 @@ export type {
  ReportRunRow, ReportRunResult
 } from './reportdefs'
 export type { Alert } from './alerts'
-export type { SystemUpdateStatus, UpdatePhase, ReleaseAsset } from './update'
+export type {
+  SystemUpdateStatus, ReleaseHistoryItem, UpdatePhase, ReleaseAsset
+} from './update'
 export type {
  CompanySubject, Contract, Supplier, Customer, BankAccount, Seal, Invoice, ContractMilestone
 } from './masterdata'
@@ -36,10 +36,22 @@ export interface SystemUpdateStatus {
  error: string | null
 }

+export interface ReleaseHistoryItem {
+  version: string
+  publishedAt: string | null
+  releaseNotes: string
+  current: boolean
+  latest: boolean
+}
+
 export function getSystemUpdateStatus() {
  return http.get<SystemUpdateStatus>('/system-update/status')
 }

+export function getSystemUpdateReleases() {
+  return http.get<ReleaseHistoryItem[]>('/system-update/releases', undefined, { timeoutMs: 30000 })
+}
+
 export function checkSystemUpdate() {
  return http.post<SystemUpdateStatus>('/system-update/check', undefined, { timeoutMs: 30000 })
 }
@@ -1,15 +1,32 @@
 <script setup lang="ts">
 import { computed, onBeforeUnmount, onMounted, ref } from 'vue'
+import { useRouter } from 'vue-router'
 import { ElMessage, ElMessageBox } from 'element-plus'
-import { Download, Refresh, Warning } from '@element-plus/icons-vue'
+import { Check, Download, Refresh, Warning } from '@element-plus/icons-vue'
 import ErpPageHeader from '../../../components/erp/ErpPageHeader.vue'
-import { oaApi, OaApiError, type SystemUpdateStatus, type UpdatePhase } from '../../api'
+import {
+  oaApi,
+  OaApiError,
+  type ReleaseHistoryItem,
+  type SystemUpdateStatus,
+  type UpdatePhase
+} from '../../api'
+import { useSession } from '../../session'
+
+const router = useRouter()
+const session = useSession()
+const isAdmin = computed(() => session.user.value?.roles?.includes('ADMIN') === true)

 const status = ref<SystemUpdateStatus | null>(null)
+const releases = ref<ReleaseHistoryItem[]>([])
 const loading = ref(false)
+const historyLoading = ref(false)
 const checking = ref(false)
 const installing = ref(false)
+const reconnecting = ref(false)
+const pollFailures = ref(0)
 let pollTimer: number | undefined
+let pollRequestRunning = false

 const activePhases = new Set<UpdatePhase>([
  'STARTING', 'DOWNLOADING', 'VERIFYING', 'INSTALLING', 'RESTARTING', 'ROLLING_BACK'
@@ -27,55 +44,111 @@ const phaseLabels: Record<UpdatePhase, string> = {
  RESTARTING: '正在重启',
  SUCCEEDED: '更新完成',
  ROLLING_BACK: '正在回滚',
-  ROLLED_BACK: '已回滚',
+  ROLLED_BACK: '已自动回滚',
  FAILED: '更新失败'
 }

 const busy = computed(() => !!status.value && activePhases.has(status.value.phase))
-const canInstall = computed(() => Boolean(
-  status.value?.configured && status.value.updateAvailable && status.value.latestVersion && !busy.value
+const canCheck = computed(() => Boolean(
+  status.value?.configured
+    && !busy.value
+    && !reconnecting.value
+    && !checking.value
+    && !installing.value
 ))
-const phaseTone = computed(() => {
+const canInstall = computed(() => Boolean(
+  status.value?.configured
+    && status.value.updateAvailable
+    && status.value.latestVersion
+    && !busy.value
+    && !reconnecting.value
+    && !checking.value
+    && !installing.value
+))
+const remoteLatest = computed(() => releases.value.find(release => release.latest) || releases.value[0] || null)
+const latestVersion = computed(() => status.value?.latestVersion || remoteLatest.value?.version || null)
+const latestRelease = computed(() => {
+  const checkedVersion = status.value?.latestVersion
+  if (checkedVersion) {
+    return releases.value.find(release => release.version === checkedVersion) || remoteLatest.value
+  }
+  return remoteLatest.value
+})
+const latestPublishedAt = computed(() => status.value?.publishedAt || latestRelease.value?.publishedAt || null)
+const latestReleaseNotes = computed(() => status.value?.releaseNotes || latestRelease.value?.releaseNotes || '')
+const phaseTone = computed<'success' | 'warning' | 'danger' | 'info'>(() => {
  const phase = status.value?.phase
  if (phase === 'FAILED' || phase === 'ROLLED_BACK') return 'danger'
  if (phase === 'AVAILABLE') return 'warning'
  if (phase === 'SUCCEEDED' || phase === 'UP_TO_DATE') return 'success'
  return 'info'
 })
+const progressStatus = computed<'success' | 'exception' | undefined>(() => {
+  if (status.value?.phase === 'SUCCEEDED') return 'success'
+  if (status.value?.phase === 'FAILED' || status.value?.phase === 'ROLLED_BACK') return 'exception'
+  return undefined
+})

 function apiMessage(error: unknown, fallback: string) {
  return error instanceof OaApiError ? error.message : fallback
 }

-function formatDate(value: string | null) {
+function formatDate(value: string | null | undefined) {
  if (!value) return '-'
  const date = new Date(value)
  return Number.isNaN(date.getTime()) ? value : date.toLocaleString('zh-CN', { hour12: false })
 }

-function formatBytes(size: number) {
-  if (size <= 0) return '-'
-  if (size < 1024 * 1024) return `${Math.ceil(size / 1024)} KB`
-  return `${(size / 1024 / 1024).toFixed(1)} MB`
+function formatVersion(value: string | null | undefined) {
+  if (!value) return '-'
+  return /^v/i.test(value) ? value : `v${value}`
 }

 async function loadStatus(silent = false) {
-  if (!silent) loading.value = true
  try {
    status.value = await oaApi.getSystemUpdateStatus()
+    reconnecting.value = false
+    pollFailures.value = 0
    if (busy.value) startPolling()
    else stopPolling()
  } catch (error) {
+    if (busy.value || status.value?.phase === 'RESTARTING' || reconnecting.value) {
+      reconnecting.value = true
+      pollFailures.value += 1
+      startPolling()
+      return
+    }
    if (!silent) ElMessage.error(apiMessage(error, '更新状态加载失败'))
+  }
+}
+
+async function loadReleases(silent = false) {
+  historyLoading.value = true
+  try {
+    releases.value = await oaApi.getSystemUpdateReleases()
+  } catch (error) {
+    if (!silent) ElMessage.error(apiMessage(error, '历史版本加载失败'))
  } finally {
-    if (!silent) loading.value = false
+    historyLoading.value = false
+  }
+}
+
+async function loadPage() {
+  loading.value = true
+  try {
+    await loadStatus()
+    if (status.value?.configured) await loadReleases()
+  } finally {
+    loading.value = false
  }
 }

 async function checkUpdate() {
+  if (!canCheck.value) return
  checking.value = true
  try {
    status.value = await oaApi.checkSystemUpdate()
+    await loadReleases(true)
    ElMessage.success(status.value.updateAvailable ? '发现新版本' : '当前已是最新版本')
  } catch (error) {
    ElMessage.error(apiMessage(error, '检查更新失败'))
@@ -86,20 +159,24 @@ async function checkUpdate() {
 }

 async function installUpdate() {
+  if (!canInstall.value) return
  const version = status.value?.latestVersion
  if (!version) return
+  installing.value = true
  try {
    await ElMessageBox.confirm(
-      `确认安装 ${version} 并重启服务？`,
-      '安装更新',
+      `确认安装 ${formatVersion(version)}？服务将自动重启，健康检查失败会切回上一版本。`,
+      '安装正式更新',
      { type: 'warning', confirmButtonText: '安装并重启', cancelButtonText: '取消' }
    )
  } catch {
+    installing.value = false
    return
  }
-  installing.value = true
  try {
    status.value = await oaApi.installSystemUpdate(version)
+    reconnecting.value = false
+    pollFailures.value = 0
    ElMessage.success('更新任务已启动')
    startPolling()
  } catch (error) {
@@ -111,7 +188,15 @@ async function installUpdate() {

 function startPolling() {
  if (pollTimer !== undefined) return
-  pollTimer = window.setInterval(() => loadStatus(true), 3000)
+  pollTimer = window.setInterval(async () => {
+    if (pollRequestRunning) return
+    pollRequestRunning = true
+    try {
+      await loadStatus(true)
+    } finally {
+      pollRequestRunning = false
+    }
+  }, 2500)
 }

 function stopPolling() {
@@ -120,19 +205,35 @@ function stopPolling() {
  pollTimer = undefined
 }

-onMounted(() => loadStatus())
+async function initializePage() {
+  if (!isAdmin.value) {
+    ElMessage.error('系统更新仅限管理员访问')
+    await router.replace('/')
+    return
+  }
+  await loadPage()
+}
+
+onMounted(initializePage)
 onBeforeUnmount(stopPolling)
 </script>

 <template>
-  <div class="update-page" v-loading="loading">
+  <div v-if="isAdmin" class="update-page" v-loading="loading">
    <ErpPageHeader
      title="系统更新"
      :crumbs="['应用定制平台', '系统更新']"
-      description="正式版本"
+      :description="`当前版本 ${formatVersion(status?.currentVersion)}`"
    >
      <template #actions>
-        <el-button :icon="Refresh" :loading="checking" @click="checkUpdate">检查更新</el-button>
+        <el-button
+          :icon="Refresh"
+          :loading="checking"
+          :disabled="!canCheck"
+          @click="checkUpdate"
+        >
+          检查更新
+        </el-button>
        <el-button
          type="primary"
          :icon="Download"
@@ -150,17 +251,45 @@ onBeforeUnmount(stopPolling)
      type="warning"
      :closable="false"
      show-icon
-      title="在线更新尚未配置"
+      title="服务器尚未启用在线更新"
+      description="请通过安装器完成正式服务配置。"
+      class="update-alert"
+    />
+    <el-alert
+      v-else-if="reconnecting"
+      type="info"
+      :closable="false"
+      show-icon
+      title="正式服务正在重启，页面会自动重新连接"
+      :description="`已重试 ${pollFailures} 次`"
+      class="update-alert"
+    />
+    <el-alert
+      v-else-if="status?.phase === 'SUCCEEDED'"
+      type="success"
+      :closable="false"
+      show-icon
+      title="新版本已启动并通过健康检查"
+      class="update-alert"
+    />
+    <el-alert
+      v-else-if="status?.phase === 'ROLLED_BACK'"
+      type="error"
+      :closable="false"
+      show-icon
+      title="新版本健康检查失败，系统已自动切回上一版本"
+      :description="status.error || undefined"
+      class="update-alert"
    />

-    <section class="update-summary">
+    <section class="update-summary" aria-label="版本状态">
      <div class="version-block">
        <span class="field-label">当前版本</span>
-        <strong>{{ status?.currentVersion || '-' }}</strong>
+        <strong>{{ formatVersion(status?.currentVersion) }}</strong>
      </div>
      <div class="version-block">
-        <span class="field-label">最新版本</span>
-        <strong>{{ status?.latestVersion || '-' }}</strong>
+        <span class="field-label">在线最新版本</span>
+        <strong>{{ formatVersion(latestVersion) }}</strong>
      </div>
      <div class="version-block">
        <span class="field-label">更新状态</span>
@@ -169,47 +298,62 @@ onBeforeUnmount(stopPolling)
        </el-tag>
      </div>
      <div class="version-block">
-        <span class="field-label">检查时间</span>
-        <span>{{ formatDate(status?.checkedAt || null) }}</span>
+        <span class="field-label">最后检查时间</span>
+        <span>{{ formatDate(status?.checkedAt) }}</span>
      </div>
    </section>

-    <section v-if="status && (busy || status.phase === 'FAILED' || status.phase === 'ROLLED_BACK')" class="update-progress">
+    <section
+      v-if="status && (busy || status.phase === 'FAILED' || status.phase === 'ROLLED_BACK' || status.phase === 'SUCCEEDED')"
+      class="update-section"
+    >
      <div class="section-heading">
-        <h3>{{ status.message }}</h3>
+        <div class="heading-title">
+          <el-icon v-if="status.phase === 'FAILED' || status.phase === 'ROLLED_BACK'"><Warning /></el-icon>
+          <el-icon v-else><Check /></el-icon>
+          <h2>更新进度</h2>
+        </div>
        <span>{{ status.progress }}%</span>
      </div>
      <el-progress
        :percentage="status.progress"
-        :status="status.phase === 'FAILED' || status.phase === 'ROLLED_BACK' ? 'exception' : undefined"
+        :status="progressStatus"
        :stroke-width="10"
      />
+      <p class="progress-message">{{ status.message }}</p>
      <p v-if="status.error" class="error-line"><el-icon><Warning /></el-icon>{{ status.error }}</p>
    </section>

-    <section class="release-section">
+    <section class="update-section">
      <div class="section-heading">
-        <h3>版本信息</h3>
-        <span>{{ formatDate(status?.publishedAt || null) }}</span>
+        <div class="heading-title"><h2>最新版本更新日志</h2></div>
+        <span>发布日期 {{ formatDate(latestPublishedAt) }}</span>
      </div>
-      <div class="release-notes">{{ status?.releaseNotes || '暂无发布说明' }}</div>
+      <div class="release-notes">{{ latestReleaseNotes || '暂无发布说明' }}</div>
    </section>

-    <section class="release-section">
-      <div class="section-heading"><h3>发布文件</h3></div>
-      <el-table :data="status?.assets || []" size="small" border empty-text="暂无发布文件">
-        <el-table-column prop="name" label="文件" min-width="280" />
-        <el-table-column label="大小" width="120">
-          <template #default="{ row }">{{ formatBytes(row.size) }}</template>
-        </el-table-column>
-        <el-table-column label="校验" width="140">
-          <template #default="{ row }">
-            <el-tag v-if="row.name === 'SHA256SUMS.sig'" type="success" effect="plain" size="small">Ed25519</el-tag>
-            <el-tag v-else-if="row.name === 'SHA256SUMS'" type="info" effect="plain" size="small">SHA-256</el-tag>
-            <span v-else>-</span>
-          </template>
-        </el-table-column>
-      </el-table>
+    <section class="update-section history-section">
+      <div class="section-heading">
+        <div class="heading-title"><h2>历史版本</h2></div>
+        <span>{{ releases.length ? `共 ${releases.length} 个正式版本` : '暂无记录' }}</span>
+      </div>
+      <el-skeleton v-if="historyLoading" :rows="4" animated />
+      <div v-else-if="releases.length" class="release-history">
+        <article v-for="release in releases" :key="release.version" class="release-entry">
+          <div class="release-version">
+            <strong>{{ formatVersion(release.version) }}</strong>
+            <div class="release-tags">
+              <el-tag v-if="release.current" type="primary" effect="plain" size="small">当前版本</el-tag>
+              <el-tag v-if="release.latest" type="success" effect="plain" size="small">最新版本</el-tag>
+            </div>
+            <time>{{ formatDate(release.publishedAt) }}</time>
+          </div>
+          <div class="release-notes release-notes--history">
+            {{ release.releaseNotes || '暂无发布说明' }}
+          </div>
+        </article>
+      </div>
+      <el-empty v-else description="暂无历史版本" :image-size="72" />
    </section>
  </div>
 </template>
@@ -220,6 +364,10 @@ onBeforeUnmount(stopPolling)
  margin: 0 auto;
 }

+.update-alert {
+  margin-bottom: var(--erp-space-4);
+}
+
 .update-summary {
  display: grid;
  grid-template-columns: repeat(4, minmax(0, 1fr));
@@ -238,8 +386,11 @@ onBeforeUnmount(stopPolling)
 }

 .version-block strong,
-.version-block > span:last-child {
+.version-block > span:last-child,
+.version-block > .el-tag {
  display: block;
+  width: fit-content;
+  max-width: 100%;
  margin-top: var(--erp-space-2);
  overflow-wrap: anywhere;
  color: var(--erp-color-text);
@@ -251,40 +402,55 @@ onBeforeUnmount(stopPolling)
  font-size: var(--erp-font-size-xs);
 }

-.update-progress,
-.release-section {
+.update-section {
  padding: var(--erp-space-5) 0;
  border-bottom: 1px solid var(--erp-color-border-soft);
 }

-.section-heading {
+.section-heading,
+.heading-title,
+.release-tags {
  display: flex;
  align-items: center;
-  justify-content: space-between;
-  gap: var(--erp-space-3);
-  margin-bottom: var(--erp-space-3);
 }

-.section-heading h3 {
-  margin: 0;
+.section-heading {
+  justify-content: space-between;
+  gap: var(--erp-space-3);
+  margin-bottom: var(--erp-space-4);
+}
+
+.heading-title {
+  gap: var(--erp-space-2);
+  min-width: 0;
  color: var(--erp-color-text);
+}
+
+.heading-title h2 {
+  margin: 0;
  font-size: var(--erp-font-size-base);
 }

-.section-heading span {
+.section-heading > span {
  color: var(--erp-color-text-subtle);
  font-size: var(--erp-font-size-xs);
 }

 .release-notes {
-  min-height: 80px;
+  min-height: 72px;
  color: var(--erp-color-text-muted);
  font-size: var(--erp-font-size-sm);
-  line-height: 1.7;
+  line-height: 1.75;
  white-space: pre-wrap;
  overflow-wrap: anywhere;
 }

+.progress-message {
+  margin: var(--erp-space-2) 0 0;
+  color: var(--erp-color-text-muted);
+  font-size: var(--erp-font-size-sm);
+}
+
 .error-line {
  display: flex;
  align-items: center;
@@ -294,6 +460,49 @@ onBeforeUnmount(stopPolling)
  font-size: var(--erp-font-size-sm);
 }

+.release-history {
+  border-top: 1px solid var(--erp-color-border-soft);
+}
+
+.release-entry {
+  display: grid;
+  grid-template-columns: 190px minmax(0, 1fr);
+  gap: var(--erp-space-5);
+  padding: var(--erp-space-4) 0;
+  border-bottom: 1px solid var(--erp-color-border-soft);
+}
+
+.release-entry:last-child {
+  border-bottom: 0;
+}
+
+.release-version {
+  min-width: 0;
+}
+
+.release-version > strong {
+  display: block;
+  color: var(--erp-color-text);
+  font-size: var(--erp-font-size-base);
+}
+
+.release-tags {
+  flex-wrap: wrap;
+  gap: var(--erp-space-1);
+  margin-top: var(--erp-space-2);
+}
+
+.release-version time {
+  display: block;
+  margin-top: var(--erp-space-2);
+  color: var(--erp-color-text-subtle);
+  font-size: var(--erp-font-size-xs);
+}
+
+.release-notes--history {
+  min-height: 0;
+}
+
@media (max-width: 900px) {
  .update-summary {
    grid-template-columns: repeat(2, minmax(0, 1fr));
@@ -322,5 +531,15 @@ onBeforeUnmount(stopPolling)
  .version-block:last-child {
    border-bottom: 0;
  }
+
+  .section-heading {
+    align-items: flex-start;
+    flex-wrap: wrap;
+  }
+
+  .release-entry {
+    grid-template-columns: 1fr;
+    gap: var(--erp-space-3);
+  }
 }
 </style>
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+TARGET=/root/kaidi-erp-reinstall-v038.sh
+URL=https://git.awaioi.com/awaioi/ERP/raw/tag/v0.3.8/reinstall-centos9.sh
+SHA256=a8496345fa5aaf6fb55180805098fb0e05bdc68b21c455b1c0b1901bba57fedd
+
+curl -fsSL --connect-timeout 15 --max-time 300 "$URL" -o "$TARGET"
+printf '%s  %s\n' "$SHA256" "$TARGET" | sha256sum -c -
+exec bash "$TARGET"
@@ -0,0 +1,104 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+GITEA_BASE_URL="https://git.awaioi.com"
+REPOSITORY="awaioi/ERP"
+VERSION="0.3.8"
+TAG="v${VERSION}"
+INSTALL_SHA256="ae6a6613d4abe37ba24b41e1901eaa3b29cc32939583302c7f62277922fbbe9b"
+UNINSTALL_SHA256="98c56fed2fd4d01874e4ab5a1a4f3ec42ec3e29b315ffd87385a95488d587546"
+PG_ROOT="${ERP_RECOVERY_PG_ROOT:-/www/server/pgsql}"
+PG_DATA="${ERP_RECOVERY_PG_DATA:-/www/server/pgsql/data}"
+PG_INIT_SCRIPT="${ERP_RECOVERY_PG_INIT_SCRIPT:-/etc/init.d/pgsql}"
+TMP_DIR=""
+
+say() { printf '[ERP Recovery] %s\n' "$*"; }
+fail() { printf '[ERP Recovery] ERROR: %s\n' "$*" >&2; exit 1; }
+
+cleanup() {
+  [[ -z "$TMP_DIR" || ! -d "$TMP_DIR" ]] || rm -rf -- "$TMP_DIR"
+}
+trap cleanup EXIT
+
+postgres_port_open() {
+  timeout 2 bash -c 'exec 3<>/dev/tcp/127.0.0.1/5432' >/dev/null 2>&1
+}
+
+wait_for_postgres() {
+  local _
+  for _ in {1..60}; do
+    postgres_port_open && return 0
+    sleep 1
+  done
+  return 1
+}
+
+start_erp_postgres() {
+  if postgres_port_open; then
+    say 'PostgreSQL is already listening on 127.0.0.1:5432'
+    return 0
+  fi
+
+  [[ -f "$PG_DATA/PG_VERSION" ]] \
+    || fail "PostgreSQL data directory is missing: $PG_DATA"
+
+  if [[ -x "$PG_INIT_SCRIPT" ]]; then
+    say "Starting PostgreSQL with $PG_INIT_SCRIPT"
+    if ! "$PG_INIT_SCRIPT" start; then
+      say 'The init script returned an error; checking whether PostgreSQL still started'
+    fi
+  else
+    local pg_ctl pg_user
+    pg_ctl="$(find "$PG_ROOT" -type f -name pg_ctl -print -quit 2>/dev/null || true)"
+    [[ -n "$pg_ctl" && -x "$pg_ctl" ]] || fail "pg_ctl was not found below $PG_ROOT"
+    pg_user="$(stat -c '%U' "$PG_DATA")" || fail 'Unable to determine the PostgreSQL owner'
+    id "$pg_user" >/dev/null 2>&1 || fail "PostgreSQL owner does not exist: $pg_user"
+    say "Starting PostgreSQL as $pg_user"
+    runuser -u "$pg_user" -- "$pg_ctl" \
+      -D "$PG_DATA" \
+      -l "$PG_DATA/startup.log" \
+      -w -t 60 start
+  fi
+
+  if ! wait_for_postgres; then
+    [[ ! -r "$PG_DATA/startup.log" ]] || tail -n 100 "$PG_DATA/startup.log" >&2
+    fail 'PostgreSQL did not listen on 127.0.0.1:5432 within 60 seconds'
+  fi
+  say 'PostgreSQL is ready on 127.0.0.1:5432'
+}
+
+download_verified_script() {
+  local name="$1" expected="$2" destination
+  destination="$TMP_DIR/$name"
+  curl -fsSL --connect-timeout 15 --max-time 300 \
+    "$GITEA_BASE_URL/$REPOSITORY/raw/tag/$TAG/$name" \
+    -o "$destination"
+  printf '%s  %s\n' "$expected" "$destination" | sha256sum -c - >&2
+  printf '%s' "$destination"
+}
+
+main() {
+  [[ "$(id -u)" == "0" ]] || fail 'Run this recovery command as root'
+  for command in bash curl find runuser sha256sum stat timeout; do
+    command -v "$command" >/dev/null 2>&1 || fail "Missing command: $command"
+  done
+
+  start_erp_postgres
+  TMP_DIR="$(mktemp -d "${TMPDIR:-/tmp}/kaidi-erp-recovery.XXXXXX")"
+
+  local uninstaller installer
+  uninstaller="$(download_verified_script uninstall.sh "$UNINSTALL_SHA256")"
+  say 'Removing the pending installation and its PostgreSQL schema safely'
+  bash "$uninstaller" --purge-database --yes
+
+  installer="$(download_verified_script install.sh "$INSTALL_SHA256")"
+  say "Installing Kaidi ERP $VERSION"
+  bash "$installer" \
+    --gitea-url "$GITEA_BASE_URL" \
+    --repository "$REPOSITORY" \
+    --version "$VERSION"
+}
+
+if [[ "${BASH_SOURCE[0]:-$0}" == "$0" ]]; then
+  main "$@"
+fi
@@ -0,0 +1,164 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+GITEA_URL="${GITEA_URL:-https://git.awaioi.com/}"
+GITEA_REPOSITORY="${GITEA_REPOSITORY:-awaioi/ERP}"
+RUNNER_IMAGE="${RUNNER_IMAGE:-}"
+RUNNER_CONTAINER="${RUNNER_CONTAINER:-gitea-runner}"
+RUNNER_VOLUME="${RUNNER_VOLUME:-gitea-runner-data}"
+RUNNER_LABELS="${RUNNER_LABELS:-ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest}"
+
+log() {
+  printf '[Gitea Runner] %s\n' "$*"
+}
+
+fail() {
+  printf '[Gitea Runner] ERROR: %s\n' "$*" >&2
+  exit 1
+}
+
+command -v docker >/dev/null 2>&1 || fail "docker is not installed"
+docker info >/dev/null 2>&1 || fail "docker is not running or the current user cannot access it"
+
+find_gitea_container() {
+  local container_id image name
+
+  while read -r container_id image name; do
+    case "$image" in
+      gitea/gitea:* | gitea/gitea@* | */gitea/gitea:* | */gitea/gitea@* | docker.gitea.com/gitea:* | docker.gitea.com/gitea@*)
+        printf '%s\n' "$container_id"
+        return 0
+        ;;
+    esac
+  done < <(docker ps --format '{{.ID}} {{.Image}} {{.Names}}')
+
+  while read -r container_id name; do
+    case "$name" in
+      *runner*) ;;
+      *gitea*)
+        printf '%s\n' "$container_id"
+        return 0
+        ;;
+    esac
+  done < <(docker ps --format '{{.ID}} {{.Names}}')
+
+  return 1
+}
+
+pull_runner_image() {
+  local candidate
+  local -a candidates
+
+  if [[ -n "$RUNNER_IMAGE" ]]; then
+    candidates=("$RUNNER_IMAGE")
+  else
+    candidates=(
+      "docker.gitea.com/runner:3.0.2"
+      "docker.gitea.com/act_runner:3.0.2"
+      "gitea/runner:3.0.2"
+    )
+  fi
+
+  for candidate in "${candidates[@]}"; do
+    log "Pulling $candidate"
+    if docker pull "$candidate"; then
+      RUNNER_IMAGE="$candidate"
+      return 0
+    fi
+    log "Image source failed; trying the next source"
+  done
+
+  fail "all official Gitea Runner image sources failed"
+}
+
+GITEA_CONTAINER="$(find_gitea_container || true)"
+[[ -n "$GITEA_CONTAINER" ]] || fail "no running Gitea container was found"
+
+TMP_DIR="$(mktemp -d)"
+TOKEN_FILE="$TMP_DIR/runner-token"
+BOOTSTRAP_RUNNING=0
+
+cleanup() {
+  if [[ "$BOOTSTRAP_RUNNING" == "1" ]]; then
+    docker rm -f "$RUNNER_CONTAINER" >/dev/null 2>&1 || true
+  fi
+  if [[ -f "$TOKEN_FILE" ]]; then
+    : >"$TOKEN_FILE"
+  fi
+  rm -rf -- "$TMP_DIR"
+}
+trap cleanup EXIT
+
+log "Generating a repository-scoped registration token"
+if ! docker exec -u git "$GITEA_CONTAINER" gitea actions generate-runner-token \
+  --scope "$GITEA_REPOSITORY" | tr -d '\r' | tail -n 1 >"$TOKEN_FILE"; then
+  fail "Gitea could not generate a runner token"
+fi
+[[ -s "$TOKEN_FILE" ]] || fail "Gitea returned an empty runner token"
+chmod 600 "$TOKEN_FILE"
+
+pull_runner_image
+docker rm -f "$RUNNER_CONTAINER" >/dev/null 2>&1 || true
+docker volume create "$RUNNER_VOLUME" >/dev/null
+docker run --rm --entrypoint /bin/rm \
+  -v "$RUNNER_VOLUME:/data" \
+  "$RUNNER_IMAGE" -f /data/.runner
+
+log "Registering the runner"
+docker run -d \
+  --name "$RUNNER_CONTAINER" \
+  -v "$RUNNER_VOLUME:/data" \
+  -v "$TOKEN_FILE:/run/secrets/gitea_runner_token:ro,Z" \
+  -v /var/run/docker.sock:/var/run/docker.sock \
+  -e "GITEA_INSTANCE_URL=$GITEA_URL" \
+  -e GITEA_RUNNER_REGISTRATION_TOKEN_FILE=/run/secrets/gitea_runner_token \
+  -e "GITEA_RUNNER_NAME=erp-release-$(hostname -s)" \
+  -e "GITEA_RUNNER_LABELS=$RUNNER_LABELS" \
+  -e GITEA_MAX_REG_ATTEMPTS=24 \
+  "$RUNNER_IMAGE" >/dev/null
+BOOTSTRAP_RUNNING=1
+
+READY=0
+for ((attempt = 1; attempt <= 60; attempt++)); do
+  if docker exec "$RUNNER_CONTAINER" test -s /data/.runner 2>/dev/null; then
+    READY=1
+    break
+  fi
+  if [[ "$(docker inspect -f '{{.State.Running}}' "$RUNNER_CONTAINER" 2>/dev/null || true)" != "true" ]]; then
+    break
+  fi
+  sleep 2
+done
+
+if [[ "$READY" != "1" ]]; then
+  docker logs --tail 100 "$RUNNER_CONTAINER" >&2 || true
+  fail "runner registration failed"
+fi
+
+docker logs --tail 30 "$RUNNER_CONTAINER" || true
+docker rm -f "$RUNNER_CONTAINER" >/dev/null
+BOOTSTRAP_RUNNING=0
+: >"$TOKEN_FILE"
+
+log "Starting the persistent runner without the registration token"
+docker run -d \
+  --name "$RUNNER_CONTAINER" \
+  --restart unless-stopped \
+  -v "$RUNNER_VOLUME:/data" \
+  -v /var/run/docker.sock:/var/run/docker.sock \
+  -e "GITEA_INSTANCE_URL=$GITEA_URL" \
+  -e "GITEA_RUNNER_NAME=erp-release-$(hostname -s)" \
+  -e "GITEA_RUNNER_LABELS=$RUNNER_LABELS" \
+  "$RUNNER_IMAGE" >/dev/null
+
+sleep 5
+[[ "$(docker inspect -f '{{.State.Running}}' "$RUNNER_CONTAINER")" == "true" ]] || {
+  docker logs --tail 100 "$RUNNER_CONTAINER" >&2 || true
+  fail "runner container stopped after registration"
+}
+
+log "Runner is online; queued release jobs can now continue"
+docker ps --filter "name=^/${RUNNER_CONTAINER}$" \
+  --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}'
+docker logs --tail 80 "$RUNNER_CONTAINER" || true
@@ -56,6 +56,111 @@ test_erp_run_preserves_java_option_arguments() (
  grep -Fqx -- "$tmp/current/app/kaidi-erp.jar" <<< "$output"
 )

+test_erp_run_migrates_legacy_update_source() (
+  local tmp
+  tmp="$(mktemp -d "${TMPDIR:-/tmp}/erp-source-migration.XXXXXX")" || return 1
+  trap 'rm -rf "$tmp"' EXIT
+  mkdir -p "$tmp/current/app" "$tmp/run" "$tmp/state"
+  : > "$tmp/current/app/kaidi-erp.jar"
+  : > "$tmp/state/install.lock"
+  printf '%s\n' \
+    '#!/usr/bin/env bash' \
+    'if [[ "${1:-}" == "-version" ]]; then printf '\''openjdk version "17.0.12"\n'\'' >&2; fi' \
+    'exit 0' > "$tmp/java"
+  chmod +x "$tmp/java"
+  {
+    printf 'ERP_JAVA_BIN=%q\n' "$tmp/java"
+    printf 'ERP_RUN_DIR=%q\n' "$tmp/run"
+    printf "OA_UPDATE_GITEA_BASE_URL='http://38.76.196.225:10099/'\n"
+    printf "OA_UPDATE_ALLOW_INSECURE_HTTP='true'\n"
+  } > "$tmp/erp.env"
+  chmod 600 "$tmp/erp.env"
+
+  ERP_INSTALL_ROOT="$tmp" ERP_CONFIG_FILE="$tmp/erp.env" \
+    "$PROJECT_ROOT/distribution/bin/erp-run" >/dev/null 2>&1 || return 1
+
+  grep -Fqx "OA_UPDATE_GITEA_BASE_URL='https://git.awaioi.com'" "$tmp/erp.env" || return 1
+  grep -Fqx "OA_UPDATE_ALLOW_INSECURE_HTTP='false'" "$tmp/erp.env" || return 1
+  ! grep -Fq '38.76.196.225' "$tmp/erp.env"
+)
+
+test_erp_run_finalizes_healthy_pending_install() (
+  local tmp
+  tmp="$(mktemp -d "${TMPDIR:-/tmp}/erp-handoff-success.XXXXXX")" || return 1
+  trap 'rm -rf "$tmp"' EXIT
+  mkdir -p "$tmp/current/app" "$tmp/run" "$tmp/state" "$tmp/installer" "$tmp/bin"
+  : > "$tmp/current/app/kaidi-erp.jar"
+  : > "$tmp/installer/kaidi-erp-installer.jar"
+  printf 'pending\n' > "$tmp/state/install.pending"
+  printf '%s\n' \
+    '#!/usr/bin/env bash' \
+    'if [[ "${1:-}" == "-version" ]]; then printf '\''openjdk version "17.0.12"\n'\'' >&2; exit 0; fi' \
+    'printf '\''formal application output\n'\''' \
+    'sleep 0.1' \
+    'exit 0' > "$tmp/java"
+  printf '%s\n' '#!/usr/bin/env bash' 'exit 0' > "$tmp/bin/curl"
+  chmod +x "$tmp/java" "$tmp/bin/curl"
+  {
+    printf 'ERP_JAVA_BIN=%q\n' "$tmp/java"
+    printf 'ERP_RUN_DIR=%q\n' "$tmp/run"
+    printf 'ERP_JAR_PATH=%q\n' "$tmp/current/app/kaidi-erp.jar"
+    printf 'ERP_INSTALLER_JAR=%q\n' "$tmp/installer/kaidi-erp-installer.jar"
+    printf 'ERP_INSTALL_PENDING_FILE=%q\n' "$tmp/state/install.pending"
+    printf 'ERP_INSTALL_LOCK_FILE=%q\n' "$tmp/state/install.lock"
+    printf 'ERP_INSTALL_LOG_FILE=%q\n' "$tmp/state/install-formal.log"
+    printf 'ERP_INSTALL_HEALTH_TIMEOUT_SECONDS=3\n'
+    printf 'ERP_UPDATE_HEALTH_POLL_SECONDS=1\n'
+  } > "$tmp/erp.env"
+
+  PATH="$tmp/bin:$PATH" ERP_INSTALL_ROOT="$tmp" ERP_CONFIG_FILE="$tmp/erp.env" \
+    "$PROJECT_ROOT/distribution/bin/erp-run" > "$tmp/run.log" 2>&1 || return 1
+
+  [[ -f "$tmp/state/install.lock" ]] || return 1
+  [[ ! -e "$tmp/state/install.pending" ]] || return 1
+  [[ ! -d "$tmp/installer" ]] || return 1
+  [[ ! -e "$tmp/run/app.pid" ]] || return 1
+  grep -Fq 'formal application output' "$tmp/state/install-formal.log"
+)
+
+test_erp_run_preserves_failed_pending_install() (
+  local tmp output status=0
+  tmp="$(mktemp -d "${TMPDIR:-/tmp}/erp-handoff-failure.XXXXXX")" || return 1
+  trap 'rm -rf "$tmp"' EXIT
+  mkdir -p "$tmp/current/app" "$tmp/run" "$tmp/state" "$tmp/installer" "$tmp/bin"
+  : > "$tmp/current/app/kaidi-erp.jar"
+  : > "$tmp/installer/kaidi-erp-installer.jar"
+  printf 'pending\n' > "$tmp/state/install.pending"
+  printf '%s\n' \
+    '#!/usr/bin/env bash' \
+    'if [[ "${1:-}" == "-version" ]]; then printf '\''openjdk version "17.0.12"\n'\'' >&2; exit 0; fi' \
+    'printf '\''formal application exploded\n'\'' >&2' \
+    'sleep 0.1' \
+    'exit 23' > "$tmp/java"
+  printf '%s\n' '#!/usr/bin/env bash' 'exit 1' > "$tmp/bin/curl"
+  chmod +x "$tmp/java" "$tmp/bin/curl"
+  {
+    printf 'ERP_JAVA_BIN=%q\n' "$tmp/java"
+    printf 'ERP_RUN_DIR=%q\n' "$tmp/run"
+    printf 'ERP_JAR_PATH=%q\n' "$tmp/current/app/kaidi-erp.jar"
+    printf 'ERP_INSTALLER_JAR=%q\n' "$tmp/installer/kaidi-erp-installer.jar"
+    printf 'ERP_INSTALL_PENDING_FILE=%q\n' "$tmp/state/install.pending"
+    printf 'ERP_INSTALL_LOCK_FILE=%q\n' "$tmp/state/install.lock"
+    printf 'ERP_INSTALL_LOG_FILE=%q\n' "$tmp/state/install-formal.log"
+    printf 'ERP_INSTALL_HEALTH_TIMEOUT_SECONDS=3\n'
+    printf 'ERP_UPDATE_HEALTH_POLL_SECONDS=1\n'
+  } > "$tmp/erp.env"
+
+  output="$(PATH="$tmp/bin:$PATH" ERP_INSTALL_ROOT="$tmp" ERP_CONFIG_FILE="$tmp/erp.env" \
+    "$PROJECT_ROOT/distribution/bin/erp-run" 2>&1)" || status=$?
+
+  [[ "$status" -ne 0 ]] || return 1
+  [[ -f "$tmp/state/install.pending" ]] || return 1
+  [[ ! -e "$tmp/state/install.lock" ]] || return 1
+  [[ -d "$tmp/installer" ]] || return 1
+  grep -Fq 'formal application exploded' "$tmp/state/install-formal.log" || return 1
+  [[ "$output" == *"Formal application diagnostics: $tmp/state/install-formal.log"* ]]
+)
+
 prepare_signed_archive() {
  local tmp="$1" unsafe="${2:-0}"
  mkdir -p "$tmp/package/kaidi-erp-1.2.3/app"
@@ -125,6 +230,44 @@ test_stable_channel_rejects_prerelease_tag() (
  ! select_release "$tmp/release.json" '' "$tmp/selection" >/dev/null 2>&1
 )

+test_update_helper_preserves_release_metadata() (
+  local tmp
+  tmp="$(mktemp -d "${TMPDIR:-/tmp}/erp-update-metadata.XXXXXX")" || return 1
+  trap 'rm -rf "$tmp"' EXIT
+  mkdir -p "$tmp/state"
+  printf 'OA_UPDATE_GITEA_BASE_URL=https://example.test\nOA_UPDATE_STATE_FILE=%q\n' \
+    "$tmp/state/update.json" > "$tmp/erp.env"
+  printf '%s\n' \
+    '{"phase":"AVAILABLE","releaseNotes":"Important fixes","publishedAt":"2026-08-04T10:00:00Z",' \
+    '"assets":[{"name":"SHA256SUMS","downloadUrl":"https://example.test/sums","size":64}]}' \
+    > "$tmp/state/update.json"
+
+  ERP_INSTALL_ROOT="$tmp" ERP_CONFIG_FILE="$tmp/erp.env" source "$PROJECT_ROOT/distribution/bin/erp-update"
+  trap 'rm -rf "$tmp"' EXIT
+  write_state DOWNLOADING 25 'downloading' 1.2.3
+
+  python3 - "$tmp/state/update.json" <<'PY'
+import json, sys
+with open(sys.argv[1], encoding="utf-8") as handle:
+    state = json.load(handle)
+assert state["phase"] == "DOWNLOADING"
+assert state["releaseNotes"] == "Important fixes"
+assert state["publishedAt"] == "2026-08-04T10:00:00Z"
+assert state["assets"][0]["name"] == "SHA256SUMS"
+PY
+)
+
+test_installer_builds_public_setup_urls() (
+  source "$PROJECT_ROOT/install.sh"
+  local normalized setup ipv6
+  normalized="$(normalize_public_url 'https://erp.example.com:8443/setup?tenant=kaidi#start')" || return 1
+  setup="$(append_setup_token "$normalized" 'one-time-token')" || return 1
+  ipv6="$(ip_setup_base_url '2001:db8::8' 8091)" || return 1
+
+  [[ "$setup" == 'https://erp.example.com:8443/setup?tenant=kaidi&token=one-time-token#start' ]] || return 1
+  [[ "$ipv6" == 'http://[2001:db8::8]:8091/' ]]
+)
+
 prepare_update_release_archive() {
  local tmp="$1" version="$2"
  local root="$tmp/package/kaidi-erp-$version"
@@ -180,22 +323,23 @@ class Handler(BaseHTTPRequestHandler):

    def do_GET(self):
        if self.path == "/api/v1/repos/awaioi/ERP/releases/latest":
-            base = f"http://127.0.0.1:{self.server.server_port}/assets"
+            legacy = "http://legacy.invalid/assets"
            payload = {
                "tag_name": "v" + version,
                "draft": False,
                "prerelease": False,
                "assets": [
-                    {"name": archive, "browser_download_url": base + "/" + archive},
-                    {"name": f"kaidi-erp-installer-{version}.jar", "browser_download_url": base + f"/assets/kaidi-erp-installer-{version}.jar"},
-                    {"name": "SHA256SUMS", "browser_download_url": base + "/SHA256SUMS"},
-                    {"name": "SHA256SUMS.sig", "browser_download_url": base + "/SHA256SUMS.sig"},
+                    {"name": archive, "browser_download_url": legacy + "/" + archive},
+                    {"name": f"kaidi-erp-installer-{version}.jar", "browser_download_url": legacy + f"/kaidi-erp-installer-{version}.jar"},
+                    {"name": "SHA256SUMS", "browser_download_url": legacy + "/SHA256SUMS"},
+                    {"name": "SHA256SUMS.sig", "browser_download_url": legacy + "/SHA256SUMS.sig"},
                ],
            }
            self.send_bytes(200, json.dumps(payload).encode(), "application/json")
            return
-        if self.path.startswith("/assets/"):
-            name = self.path.removeprefix("/assets/")
+        release_prefix = f"/awaioi/ERP/releases/download/v{version}/"
+        if self.path.startswith(release_prefix):
+            name = self.path.removeprefix(release_prefix)
            if name not in {archive, f"kaidi-erp-installer-{version}.jar", "SHA256SUMS", "SHA256SUMS.sig"}:
                self.send_bytes(404, b"not found", "text/plain")
                return
@@ -235,10 +379,11 @@ PY
  NO_SERVICE=0
  PUBLIC_KEY="$(<"$tmp/public.pem")"

-  detect_platform() { PLATFORM=darwin; }
+  detect_platform() { PLATFORM=darwin; ARCH=amd64; }
  check_and_install_dependencies() { JAVA_BIN="$(command -v java)"; return 0; }
  start_service() { return 0; }
  wait_for_installer() { return 0; }
+  detect_public_address() { printf '203.0.113.10'; }

  main > "$tmp/install.log" 2>&1 || return 1

@@ -246,12 +391,14 @@ PY
  [[ -r "$INSTALL_ROOT/current/app/kaidi-erp.jar" ]] || return 1
  (
    source "$ERP_CONFIG_ROOT/erp.env"
-    [[ "$SPRING_PROFILES_ACTIVE" == "postgres" ]]
+    [[ -z "${SPRING_PROFILES_ACTIVE:-}" ]]
    [[ "$OA_UPDATE_ENABLED" == "true" ]]
    [[ "$OA_UPDATE_GITEA_BASE_URL" == "http://127.0.0.1:$port" ]]
    [[ "$ERP_SETUP_TOKEN" =~ ^[0-9a-f]{64}$ ]]
    [[ -z "${OA_DB_URL:-}" ]]
-  )
+  ) || return 1
+  grep -Eq '^\[ERP Install\] Setup URL: http://203\.0\.113\.10:8091/\?token=[0-9a-f]{64}$' \
+    "$tmp/install.log"
 )

 run_update_scenario() (
@@ -291,15 +438,15 @@ class Handler(BaseHTTPRequestHandler):

    def do_GET(self):
        if self.path == "/api/v1/repos/awaioi/ERP/releases/latest":
-            base = f"http://127.0.0.1:{self.server.server_port}"
+            legacy = "http://legacy.invalid"
            payload = {
                "tag_name": "v2.0.0",
                "draft": False,
                "prerelease": False,
                "assets": [
-                    {"name": "kaidi-erp-2.0.0.tar.gz", "browser_download_url": base + "/assets/kaidi-erp-2.0.0.tar.gz"},
-                    {"name": "SHA256SUMS", "browser_download_url": base + "/assets/SHA256SUMS"},
-                    {"name": "SHA256SUMS.sig", "browser_download_url": base + "/assets/SHA256SUMS.sig"},
+                    {"name": "kaidi-erp-2.0.0.tar.gz", "browser_download_url": legacy + "/assets/kaidi-erp-2.0.0.tar.gz"},
+                    {"name": "SHA256SUMS", "browser_download_url": legacy + "/assets/SHA256SUMS"},
+                    {"name": "SHA256SUMS.sig", "browser_download_url": legacy + "/assets/SHA256SUMS.sig"},
                ],
            }
            self.send_bytes(200, json.dumps(payload).encode(), "application/json")
@@ -309,8 +456,9 @@ class Handler(BaseHTTPRequestHandler):
            healthy = current == "2.0.0" if mode == "success" else current == "1.0.0"
            self.send_bytes(200 if healthy else 503, b'{"status":"UP"}' if healthy else b'{"status":"DOWN"}', "application/json")
            return
-        if self.path.startswith("/assets/"):
-            name = self.path.removeprefix("/assets/")
+        release_prefix = "/awaioi/ERP/releases/download/v2.0.0/"
+        if self.path.startswith(release_prefix):
+            name = self.path.removeprefix(release_prefix)
            if name not in {"kaidi-erp-2.0.0.tar.gz", "SHA256SUMS", "SHA256SUMS.sig"}:
                self.send_bytes(404, b"not found", "text/plain")
                return
@@ -444,16 +592,141 @@ test_installer_moves_database_setup_to_web_wizard() (
  [[ "$status" -ne 0 && "$output" == *'unknown option: --db-mode'* ]]
 )

-test_installer_requires_explicit_gitea_url() (
-  local output status=0
+test_installer_defaults_to_official_gitea_url() (
+  local output
  output="$(ERP_GITEA_BASE_URL= bash -c '
    root="$1"
    set --
    source "$root/install.sh"
-    GITEA_BASE_URL=
-    main
-  ' _ "$PROJECT_ROOT" 2>&1)" || status=$?
-  [[ "$status" -ne 0 && "$output" == *'Gitea URL is required'* ]]
+    printf "%s\n" "$GITEA_BASE_URL"
+  ' _ "$PROJECT_ROOT")" || return 1
+  [[ "$output" == 'https://git.awaioi.com' ]]
+)
+
+test_linux_service_preflight_requires_systemd() (
+  local tmp output status=0
+  tmp="$(mktemp -d "${TMPDIR:-/tmp}/erp-systemd-test.XXXXXX")" || return 1
+  trap 'rm -rf "$tmp"' EXIT
+  mkdir -p "$tmp/bin"
+  source "$PROJECT_ROOT/install.sh"
+  PLATFORM=linux
+  NO_SERVICE=0
+  output="$(PATH="$tmp/bin" validate_service_manager 2>&1)" || status=$?
+  [[ "$status" -ne 0 && "$output" == *'systemd'* ]] || return 1
+  NO_SERVICE=1 PATH="$tmp/bin" validate_service_manager
+)
+
+test_systemd_unit_uses_compatible_protection() (
+  grep -Fqx 'ProtectSystem=full' <(sed -n '/^    cat > \/etc\/systemd\/system\/kaidi-erp.service/,/^    systemctl daemon-reload/p' "$PROJECT_ROOT/install.sh")
+  ! grep -Fq 'ProtectSystem=strict' "$PROJECT_ROOT/install.sh"
+)
+
+test_systemd_unit_preserves_update_helper_during_restart() (
+  local unit
+  unit="$(sed -n '/^    cat > \/etc\/systemd\/system\/kaidi-erp.service/,/^    systemctl daemon-reload/p' "$PROJECT_ROOT/install.sh")"
+  grep -Fqx 'KillMode=process' <<< "$unit"
+  ! grep -Fq 'KillMode=control-group' <<< "$unit"
+)
+
+test_systemd_unit_uses_unquoted_legacy_paths() (
+  local unit
+  unit="$(sed -n '/^    cat > \/etc\/systemd\/system\/kaidi-erp.service/,/^    systemctl daemon-reload/p' "$PROJECT_ROOT/install.sh")"
+  grep -Fqx 'WorkingDirectory=$INSTALL_ROOT' <<< "$unit"
+  grep -Fqx 'ExecStart=$INSTALL_ROOT/current/bin/erp-run' <<< "$unit"
+  grep -Fqx 'ReadWritePaths=$INSTALL_ROOT $CONFIG_ROOT $STATE_ROOT $LOG_ROOT' <<< "$unit"
+  ! grep -Fq 'WorkingDirectory="$INSTALL_ROOT"' <<< "$unit"
+)
+
+test_uninstaller_purges_database_before_removing_files() (
+  local tmp
+  tmp="$(mktemp -d "${TMPDIR:-/tmp}/erp-uninstall-test.XXXXXX")" || return 1
+  trap 'rm -rf "$tmp"' EXIT
+  mkdir -p "$tmp/bin" "$tmp/install" "$tmp/config" "$tmp/state" "$tmp/logs"
+  : > "$tmp/unit.service"
+  {
+    printf 'ERP_PGHOST=127.0.0.1\n'
+    printf 'ERP_PGPORT=5432\n'
+    printf 'ERP_PGDATABASE=kaidi_test\n'
+    printf 'ERP_PGSSLMODE=disable\n'
+    printf 'OA_DB_USERNAME=kaidi_test\n'
+    printf 'OA_DB_PASSWORD='\''test-password'\''\n'
+    printf 'ERP_INSTALL_ROOT=%q\n' "$tmp/install"
+    printf 'ERP_INSTALL_LOCK_FILE=%q\n' "$tmp/state/install.lock"
+  } > "$tmp/config/erp.env"
+  printf '%s\n' \
+    '#!/usr/bin/env bash' \
+    'printf '\''%s\n'\'' "$*" >> "$MOCK_SYSTEMCTL_LOG"' \
+    'if [[ "${1:-}" == "is-active" ]]; then exit 3; fi' \
+    'exit 0' > "$tmp/bin/systemctl"
+  printf '%s\n' \
+    '#!/usr/bin/env bash' \
+    'printf '\''ARGS %s\n'\'' "$*" >> "$MOCK_PSQL_LOG"' \
+    'if [[ " $* " == *" -c "* ]]; then printf '\''t\n'\''; exit 0; fi' \
+    'cat >> "$MOCK_PSQL_LOG"' \
+    'exit 0' > "$tmp/bin/psql"
+  chmod +x "$tmp/bin/systemctl" "$tmp/bin/psql"
+
+  PATH="$tmp/bin:$PATH" \
+    MOCK_SYSTEMCTL_LOG="$tmp/systemctl.log" \
+    MOCK_PSQL_LOG="$tmp/psql.log" \
+    ERP_UNINSTALL_TEST_MODE=1 \
+    ERP_UNINSTALL_SYSTEMD_UNIT_FILE="$tmp/unit.service" \
+    "$PROJECT_ROOT/uninstall.sh" --purge-database --yes \
+      --config-file "$tmp/config/erp.env" \
+      --install-root "$tmp/install" \
+      --config-root "$tmp/config" \
+      --state-root "$tmp/state" \
+      --log-root "$tmp/logs" > "$tmp/uninstall.log" 2>&1 || return 1
+
+  [[ ! -e "$tmp/install" && ! -e "$tmp/config" && ! -e "$tmp/state" && ! -e "$tmp/logs" ]] || return 1
+  [[ ! -e "$tmp/unit.service" ]] || return 1
+  grep -Fq 'DROP SCHEMA IF EXISTS public CASCADE;' "$tmp/psql.log" || return 1
+  grep -Fq 'stop kaidi-erp.service' "$tmp/systemctl.log" || return 1
+  grep -Fq 'disable kaidi-erp.service' "$tmp/systemctl.log"
+)
+
+test_uninstaller_rejects_unsafe_paths() (
+  ! (source "$PROJECT_ROOT/uninstall.sh"; validate_remove_path /etc) >/dev/null 2>&1 || return 1
+  ! (source "$PROJECT_ROOT/uninstall.sh"; validate_remove_path /etc/ssh) >/dev/null 2>&1 || return 1
+  ! (source "$PROJECT_ROOT/uninstall.sh"; validate_remove_path /opt/kaidi-erp/../../etc) >/dev/null 2>&1
+)
+
+test_uninstaller_aborts_when_service_remains_active() (
+  local tmp output status=0
+  tmp="$(mktemp -d "${TMPDIR:-/tmp}/erp-uninstall-active.XXXXXX")" || return 1
+  trap 'rm -rf "$tmp"' EXIT
+  mkdir -p "$tmp/bin" "$tmp/install" "$tmp/config" "$tmp/state" "$tmp/logs"
+  {
+    printf 'ERP_PGHOST=127.0.0.1\n'
+    printf 'ERP_PGPORT=5432\n'
+    printf 'ERP_PGDATABASE=kaidi_test\n'
+    printf 'ERP_PGSSLMODE=disable\n'
+    printf 'OA_DB_USERNAME=kaidi_test\n'
+    printf 'OA_DB_PASSWORD=test-password\n'
+    printf 'ERP_INSTALL_ROOT=%q\n' "$tmp/install"
+    printf 'ERP_INSTALL_LOCK_FILE=%q\n' "$tmp/state/install.lock"
+  } > "$tmp/config/erp.env"
+  printf '%s\n' \
+    '#!/usr/bin/env bash' \
+    'if [[ "${1:-}" == "stop" ]]; then exit 1; fi' \
+    'if [[ "${1:-}" == "show" ]]; then printf '\''loaded\n'\''; exit 0; fi' \
+    'if [[ "${1:-}" == "is-active" ]]; then exit 0; fi' \
+    'exit 0' > "$tmp/bin/systemctl"
+  printf '%s\n' '#!/usr/bin/env bash' 'touch "$MOCK_PSQL_CALLED"' 'exit 0' > "$tmp/bin/psql"
+  chmod +x "$tmp/bin/systemctl" "$tmp/bin/psql"
+
+  output="$(PATH="$tmp/bin:$PATH" MOCK_PSQL_CALLED="$tmp/psql.called" \
+    ERP_UNINSTALL_TEST_MODE=1 ERP_UNINSTALL_SYSTEMD_UNIT_FILE="$tmp/unit.service" \
+    "$PROJECT_ROOT/uninstall.sh" --purge-database --yes \
+      --config-file "$tmp/config/erp.env" \
+      --install-root "$tmp/install" \
+      --config-root "$tmp/config" \
+      --state-root "$tmp/state" \
+      --log-root "$tmp/logs" 2>&1)" || status=$?
+
+  [[ "$status" -ne 0 && "$output" == *'unable to stop kaidi-erp.service'* ]] || return 1
+  [[ ! -e "$tmp/psql.called" ]] || return 1
+  [[ -d "$tmp/install" && -d "$tmp/config" && -d "$tmp/state" && -d "$tmp/logs" ]]
 )

 test_no_service_install_disables_online_update() (
@@ -484,31 +757,67 @@ test_release_workflow_uses_scoped_job_token() (
  grep -Fqx '  releases: write' "$workflow"
  grep -Fq 'GITEA_BASE_URL: ${{ github.server_url }}' "$workflow"
  grep -Fq 'GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}' "$workflow"
+  grep -Fq 'uses: actions/setup-java@v4' "$workflow"
+  grep -Fq 'java-version: "17"' "$workflow"
+  grep -Fq "git log --no-merges --format='- %s (\`%h\`)'" "$workflow"
+  grep -Fq 'release-notes.md' "$workflow"
  ! grep -Fq 'RELEASE_GITEA_TOKEN' "$workflow"
  ! grep -Fq 'vars.GITEA_BASE_URL' "$workflow"
 )

 test_installer_runs_when_piped_to_bash() (
  local output status=0
-  output="$(ERP_GITEA_BASE_URL= bash -s -- --no-service < "$PROJECT_ROOT/install.sh" 2>&1)" || status=$?
+  output="$(bash -s -- --no-service --gitea-url invalid://example.test \
+    < "$PROJECT_ROOT/install.sh" 2>&1)" || status=$?
  [[ "$status" -ne 0 ]]
  [[ "$output" == *'[ERP Install] ERROR:'* ]]
  [[ "$output" != *'BASH_SOURCE'* ]]
 )

+test_installer_shows_live_health_progress() (
+  local page="$PROJECT_ROOT/oa-backend/src/installer/resources/static/index.html"
+  grep -Fq 'role="progressbar"' "$page"
+  grep -Fq 'id="install-log"' "$page"
+  grep -Fq 'Math.min(95, estimated)' "$page"
+  grep -Fq '健康检查第 ${attempt} 次' "$page"
+  grep -Fq '本页已等待 ${formatElapsed' "$page"
+  grep -Fq 'installLocked' "$page"
+)
+
+test_app_honors_reverse_proxy_headers() (
+  grep -Fqx '  forward-headers-strategy: framework' \
+    "$PROJECT_ROOT/oa-backend/src/main/resources/application.yml"
+  grep -Fqx '  forward-headers-strategy: framework' \
+    "$PROJECT_ROOT/oa-backend/src/installer/resources/application.yml"
+)
+
 run_test 'erp-run preserves Java option arguments' test_erp_run_preserves_java_option_arguments
+run_test 'erp-run migrates the legacy Gitea update source' test_erp_run_migrates_legacy_update_source
+run_test 'erp-run finalizes a healthy pending installation' test_erp_run_finalizes_healthy_pending_install
+run_test 'erp-run preserves a failed pending installation' test_erp_run_preserves_failed_pending_install
 run_test 'installer accepts a correctly signed archive' test_installer_verifies_signed_safe_archive
 run_test 'installer rejects symlinks in release archives' test_installer_rejects_archive_symlinks
 run_test 'stable update channel rejects prerelease tags' test_stable_channel_rejects_prerelease_tag
+run_test 'update helper preserves release metadata' test_update_helper_preserves_release_metadata
+run_test 'installer builds public setup URLs safely' test_installer_builds_public_setup_urls
 run_test 'installer downloads and installs a signed release end to end' test_installer_downloads_and_installs_signed_release
 run_test 'update helper installs a healthy release end to end' test_update_helper_installs_healthy_release
 run_test 'update helper rolls back an unhealthy release end to end' test_update_helper_rolls_back_unhealthy_release
 run_test 'update helper rejects a concurrent process' test_update_lock_rejects_concurrent_process
 run_test 'installer moves database setup to the web wizard' test_installer_moves_database_setup_to_web_wizard
-run_test 'installer requires an explicit Gitea URL' test_installer_requires_explicit_gitea_url
+run_test 'installer defaults to the official Gitea URL' test_installer_defaults_to_official_gitea_url
+run_test 'Linux production install requires systemd' test_linux_service_preflight_requires_systemd
+run_test 'systemd unit uses compatible protection' test_systemd_unit_uses_compatible_protection
+run_test 'systemd unit preserves update helper during restart' test_systemd_unit_preserves_update_helper_during_restart
+run_test 'systemd unit uses unquoted legacy paths' test_systemd_unit_uses_unquoted_legacy_paths
+run_test 'uninstaller purges database before removing files' test_uninstaller_purges_database_before_removing_files
+run_test 'uninstaller rejects unsafe paths' test_uninstaller_rejects_unsafe_paths
+run_test 'uninstaller aborts while the service remains active' test_uninstaller_aborts_when_service_remains_active
 run_test 'no-service install disables online update' test_no_service_install_disables_online_update
 run_test 'release workflow uses the scoped Gitea job token' test_release_workflow_uses_scoped_job_token
 run_test 'installer starts correctly when piped to bash' test_installer_runs_when_piped_to_bash
+run_test 'installer shows live formal-service health progress' test_installer_shows_live_health_progress
+run_test 'application honors standard reverse-proxy headers' test_app_honors_reverse_proxy_headers

 printf 'RESULT pass=%s fail=%s\n' "$PASS" "$FAIL"
 [[ "$FAIL" -eq 0 ]]
@@ -0,0 +1,242 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+CONFIG_FILE="${ERP_CONFIG_FILE:-/etc/kaidi-erp/erp.env}"
+INSTALL_ROOT="${ERP_INSTALL_ROOT:-/opt/kaidi-erp}"
+CONFIG_ROOT="${ERP_CONFIG_ROOT:-/etc/kaidi-erp}"
+STATE_ROOT="${ERP_STATE_ROOT:-/var/lib/kaidi-erp}"
+LOG_ROOT="${ERP_LOG_ROOT:-/var/log/kaidi-erp}"
+PURGE_DATABASE=0
+ASSUME_YES=0
+
+say() { printf '[ERP Uninstall] %s\n' "$*"; }
+fail() { printf '[ERP Uninstall] ERROR: %s\n' "$*" >&2; exit 1; }
+
+usage() {
+  cat <<'EOF'
+Usage: uninstall.sh [options]
+  --purge-database     Drop and recreate the public schema using the configured ERP account
+  --yes                Confirm destructive removal without an interactive prompt
+  --config-file PATH   Installer-generated erp.env file
+  --install-root PATH  Installation root (default: /opt/kaidi-erp)
+  --config-root PATH   Configuration root (default: /etc/kaidi-erp)
+  --state-root PATH    State root (default: /var/lib/kaidi-erp)
+  --log-root PATH      Log root (default: /var/log/kaidi-erp)
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --purge-database) PURGE_DATABASE=1; shift ;;
+    --yes) ASSUME_YES=1; shift ;;
+    --config-file) [[ $# -ge 2 ]] || fail '--config-file requires a value'; CONFIG_FILE="$2"; shift 2 ;;
+    --install-root) [[ $# -ge 2 ]] || fail '--install-root requires a value'; INSTALL_ROOT="$2"; shift 2 ;;
+    --config-root) [[ $# -ge 2 ]] || fail '--config-root requires a value'; CONFIG_ROOT="$2"; shift 2 ;;
+    --state-root) [[ $# -ge 2 ]] || fail '--state-root requires a value'; STATE_ROOT="$2"; shift 2 ;;
+    --log-root) [[ $# -ge 2 ]] || fail '--log-root requires a value'; LOG_ROOT="$2"; shift 2 ;;
+    -h|--help) usage; exit 0 ;;
+    *) fail "unknown option: $1" ;;
+  esac
+done
+
+require_root() {
+  if [[ "${ERP_UNINSTALL_TEST_MODE:-0}" != "1" && "$(id -u)" != "0" ]]; then
+    fail 'Linux uninstall requires root'
+  fi
+}
+
+require_confirmation() {
+  [[ "$PURGE_DATABASE" == "1" ]] || fail '--purge-database is required for a clean reinstall'
+  [[ "$ASSUME_YES" == "1" ]] || fail '--yes is required to confirm database and file removal'
+}
+
+validate_remove_path() {
+  local path="$1"
+  [[ "$path" == /* && "$path" != "/" && ${#path} -ge 8 ]] \
+    || fail "refusing unsafe removal path: $path"
+  [[ "$path" =~ ^/[A-Za-z0-9._/@:+-]+$ ]] \
+    || fail "refusing removal path with unsafe characters: $path"
+
+  local resolved
+  resolved="$(python3 - "$path" <<'PY'
+import os
+import sys
+print(os.path.realpath(sys.argv[1]), end="")
+PY
+)" || fail "unable to resolve removal path: $path"
+  if [[ "${ERP_UNINSTALL_TEST_MODE:-0}" != "1" && "$resolved" != "$path" ]]; then
+    fail "removal path must be canonical and cannot traverse links: $path"
+  fi
+
+  case "$resolved" in
+    /bin|/boot|/dev|/etc|/home|/lib|/lib64|/opt|/proc|/root|/run|/sbin|/srv|/sys|/tmp|/usr|/var)
+      fail "refusing unsafe removal path: $path"
+      ;;
+  esac
+
+  if [[ "${ERP_UNINSTALL_TEST_MODE:-0}" != "1" ]]; then
+    case "$resolved" in
+      /etc/kaidi-erp|/var/lib/kaidi-erp|/var/log/kaidi-erp) ;;
+      /bin/*|/boot/*|/dev/*|/etc/*|/lib/*|/lib64/*|/proc/*|/root/*|/run/*|/sbin/*|/sys/*|/tmp/*|/usr/*|/var/*)
+        fail "refusing removal below a protected system directory: $path"
+        ;;
+    esac
+  fi
+
+  printf '%s' "$resolved"
+}
+
+prepare_paths() {
+  command -v python3 >/dev/null 2>&1 || fail 'python3 is required'
+  INSTALL_ROOT="$(validate_remove_path "$INSTALL_ROOT")"
+  CONFIG_ROOT="$(validate_remove_path "$CONFIG_ROOT")"
+  STATE_ROOT="$(validate_remove_path "$STATE_ROOT")"
+  LOG_ROOT="$(validate_remove_path "$LOG_ROOT")"
+
+  local config_resolved
+  config_resolved="$(python3 - "$CONFIG_FILE" <<'PY'
+import os
+import sys
+print(os.path.realpath(sys.argv[1]), end="")
+PY
+)" || fail "unable to resolve configuration path: $CONFIG_FILE"
+  [[ "$config_resolved" == "$CONFIG_ROOT/erp.env" ]] \
+    || fail "configuration file must be $CONFIG_ROOT/erp.env"
+  CONFIG_FILE="$config_resolved"
+}
+
+read_config_value() {
+  local key="$1"
+  python3 - "$CONFIG_FILE" "$key" <<'PY'
+import re
+import shlex
+import sys
+
+path, wanted = sys.argv[1:]
+pattern = re.compile(r"[A-Z][A-Z0-9_]*")
+seen = set()
+matches = []
+with open(path, encoding="utf-8") as handle:
+    for raw in handle:
+        line = raw.rstrip("\r\n")
+        if not line or line.startswith("#") or "=" not in line:
+            continue
+        key, encoded = line.split("=", 1)
+        if not pattern.fullmatch(key):
+            raise SystemExit("invalid configuration key")
+        if key in seen:
+            raise SystemExit(f"duplicate configuration key: {key}")
+        seen.add(key)
+        if key != wanted:
+            continue
+        values = shlex.split(encoded, posix=True)
+        if len(values) != 1:
+            raise SystemExit(f"invalid value for {wanted}")
+        matches.append(values[0])
+if len(matches) != 1:
+    raise SystemExit(f"missing configuration value: {wanted}")
+print(matches[0], end="")
+PY
+}
+
+verify_installation_identity() {
+  [[ -f "$CONFIG_FILE" && ! -L "$CONFIG_FILE" ]] \
+    || fail "configuration file is missing or unsafe: $CONFIG_FILE"
+
+  local configured_root configured_lock configured_state
+  configured_root="$(read_config_value ERP_INSTALL_ROOT)" \
+    || fail 'unable to verify the configured installation root'
+  configured_lock="$(read_config_value ERP_INSTALL_LOCK_FILE)" \
+    || fail 'unable to verify the configured installation state'
+  configured_root="$(validate_remove_path "$configured_root")"
+  configured_state="$(validate_remove_path "$(dirname "$configured_lock")")"
+  [[ "$configured_root" == "$INSTALL_ROOT" ]] \
+    || fail 'requested installation root does not match erp.env'
+  [[ "$configured_state" == "$STATE_ROOT" ]] \
+    || fail 'requested state root does not match erp.env'
+}
+
+purge_database() {
+  command -v psql >/dev/null 2>&1 || fail 'PostgreSQL client psql is required'
+
+  local host port database sslmode username password owner_check
+  host="$(read_config_value ERP_PGHOST)"
+  port="$(read_config_value ERP_PGPORT)"
+  database="$(read_config_value ERP_PGDATABASE)"
+  sslmode="$(read_config_value ERP_PGSSLMODE)"
+  username="$(read_config_value OA_DB_USERNAME)"
+  password="$(read_config_value OA_DB_PASSWORD)"
+
+  [[ "$host" != *[[:space:]]* && "$port" =~ ^[0-9]+$ && "$port" -ge 1 && "$port" -le 65535 ]] \
+    || fail 'invalid database endpoint in configuration'
+  [[ "$database" =~ ^[A-Za-z_][A-Za-z0-9_-]{0,62}$ ]] || fail 'invalid database name in configuration'
+  [[ "$username" =~ ^[A-Za-z_][A-Za-z0-9_.-]{0,127}$ ]] || fail 'invalid database user in configuration'
+  case "$database" in postgres|template0|template1) fail "refusing to purge protected database: $database" ;; esac
+  case "$sslmode" in disable|allow|prefer|require|verify-ca|verify-full) ;; *) fail 'invalid database SSL mode' ;; esac
+
+  owner_check="$(PGPASSWORD="$password" PGSSLMODE="$sslmode" psql -XAt \
+    -h "$host" -p "$port" -U "$username" -d "$database" -v ON_ERROR_STOP=1 \
+    -c "SELECT pg_get_userbyid(datdba) = current_user FROM pg_database WHERE datname = current_database()")" \
+    || fail 'unable to verify database ownership'
+  [[ "$owner_check" == "t" ]] \
+    || fail 'configured ERP account is not the database owner; database was not changed'
+
+  say "Purging PostgreSQL schema $database/public"
+  PGPASSWORD="$password" PGSSLMODE="$sslmode" psql -X \
+    -h "$host" -p "$port" -U "$username" -d "$database" -v ON_ERROR_STOP=1 <<'SQL'
+DROP SCHEMA IF EXISTS public CASCADE;
+SELECT format('CREATE SCHEMA public AUTHORIZATION %I', current_user) \gexec
+SQL
+}
+
+stop_service() {
+  if command -v systemctl >/dev/null 2>&1; then
+    local load_state
+    if ! systemctl stop kaidi-erp.service >/dev/null 2>&1; then
+      load_state="$(systemctl show kaidi-erp.service --property=LoadState --value 2>/dev/null || true)"
+      [[ "$load_state" == "not-found" ]] \
+        || fail 'unable to stop kaidi-erp.service; database and files were not changed'
+    fi
+    if systemctl is-active --quiet kaidi-erp.service; then
+      fail 'kaidi-erp.service is still active; database and files were not changed'
+    fi
+  fi
+}
+
+remove_service() {
+  if command -v systemctl >/dev/null 2>&1; then
+    systemctl disable kaidi-erp.service >/dev/null 2>&1 || true
+  fi
+  local unit_file="${ERP_UNINSTALL_SYSTEMD_UNIT_FILE:-/etc/systemd/system/kaidi-erp.service}"
+  if [[ "${ERP_UNINSTALL_TEST_MODE:-0}" != "1" && "$unit_file" != "/etc/systemd/system/kaidi-erp.service" ]]; then
+    fail 'custom systemd unit path is only available in test mode'
+  fi
+  rm -f -- "$unit_file"
+  if command -v systemctl >/dev/null 2>&1; then
+    systemctl daemon-reload >/dev/null 2>&1 || true
+    systemctl reset-failed kaidi-erp.service >/dev/null 2>&1 || true
+  fi
+}
+
+remove_files() {
+  local path
+  for path in "$INSTALL_ROOT" "$CONFIG_ROOT" "$STATE_ROOT" "$LOG_ROOT"; do
+    [[ ! -e "$path" && ! -L "$path" ]] || rm -rf -- "$path"
+  done
+}
+
+main() {
+  require_root
+  require_confirmation
+  prepare_paths
+  verify_installation_identity
+  stop_service
+  purge_database
+  remove_service
+  remove_files
+  say 'Kaidi ERP service, files, state, logs, and public database schema were removed'
+}
+
+if [[ "${BASH_SOURCE[0]:-$0}" == "$0" ]]; then
+  main "$@"
+fi
Author	SHA1	Message	Date
Qiufeng	c172350200	fix: keep release downloads on configured origin Signed Release / release (push) Successful in 7m18s Details	2026-08-05 06:23:39 +08:00
Qiufeng	5d7112ce31	feat: migrate releases to git.awaioi.com	2026-08-05 06:08:47 +08:00
Qiufeng	670dfb0c7a	fix: preserve updater across systemd restart Signed Release / release (push) Successful in 10m18s Details	2026-08-04 22:31:20 +08:00
Qiufeng	abba079dde	feat: simplify online update center Signed Release / release (push) Successful in 9m41s Details	2026-08-04 21:25:43 +08:00
Qiufeng	d3892320dd	feat: add managed online updates Signed Release / release (push) Successful in 9m24s Details	2026-08-04 20:05:50 +08:00
Qiufeng	4f2ea26e8e	ops: point CentOS recovery at v0.3.4	2026-08-04 17:44:25 +08:00
Qiufeng	e295ad8b96	ci: provision Java for signed releases Signed Release / release (push) Successful in 17m17s Details	2026-08-04 17:18:25 +08:00
Qiufeng	99b8126b59	test: isolate release checks across platforms Signed Release / release (push) Failing after 35s Details	2026-08-04 17:11:45 +08:00
Qiufeng	b472581622	fix: pull runner from Gitea registry	2026-08-04 16:14:59 +08:00
Qiufeng	8fe558f6c1	ops: add one-command Gitea runner setup	2026-08-04 15:59:52 +08:00
Qiufeng	5e6df4b323	fix: surface install progress behind reverse proxies Signed Release / release (push) Failing after 32s Details	2026-08-04 15:07:39 +08:00
Qiufeng	c9d5d678dc	fix: add short CentOS recovery bootstrap	2026-08-04 14:27:38 +08:00
Qiufeng	e21978c25c	fix: add CentOS 9 reinstall recovery	2026-08-04 14:15:43 +08:00
Qiufeng	f9545a9d0f	fix: harden first-run install and clean reinstall Signed Release / release (push) Failing after 33s Details	2026-08-04 12:59:24 +08:00
Qiufeng	4d6a9307e5	fix: support legacy systemd path parsing	2026-08-04 10:03:18 +08:00
Qiufeng	b792f3f21b	fix: support older systemd hardening settings	2026-08-04 09:43:34 +08:00
Qiufeng	76a0f1ffbd	docs: document Linux service requirement Signed Release / release (push) Failing after 23s Details	2026-08-04 08:42:48 +08:00
Qiufeng	70dd8e1d6b	test: cover installer asset download Signed Release / release (push) Failing after 20s Details	2026-08-04 08:37:52 +08:00
Qiufeng	6e22b24996	fix: preflight Linux service manager Signed Release / release (push) Failing after 23s Details	2026-08-04 08:28:15 +08:00