fix: make online updates recoverable

server/cli/update.ts

@@ -163,7 +163,10 @@ function writeJob(sqlite: Database.Database | undefined, jobId: string, values:
       requested_at=COALESCE(excluded.requested_at, update_jobs.requested_at),
       started_at=COALESCE(excluded.started_at, update_jobs.started_at),
       operation=excluded.operation,
-      status=CASE WHEN update_jobs.status='cancelled' THEN update_jobs.status ELSE excluded.status END,
+      -- Terminal rows are immutable from the runner's ordinary progress
+      -- writes. In particular, a stale/replayed request must not resurrect a
+      -- failed job as queued/downloading/etc.
+      status=CASE WHEN update_jobs.status IN ('cancelled', 'failed', 'completed') THEN update_jobs.status ELSE excluded.status END,
       version=excluded.version, platform=excluded.platform,
       release_url=COALESCE(excluded.release_url, update_jobs.release_url),
       asset_name=COALESCE(excluded.asset_name, update_jobs.asset_name),
@@ -176,6 +179,11 @@ function writeJob(sqlite: Database.Database | undefined, jobId: string, values:
       error_message=COALESCE(excluded.error_message, update_jobs.error_message),
       updated_at=excluded.updated_at,
       completed_at=COALESCE(excluded.completed_at, update_jobs.completed_at)
+    -- Do not let a delayed runner replay overwrite any field on a terminal
+    -- row. The predicate is part of the same SQLite upsert, so a finalizer
+    -- racing this write still wins atomically instead of leaving a partially
+    -- mutated completed/failed/cancelled record.
+    WHERE update_jobs.status NOT IN ('cancelled', 'failed', 'completed')
   `).run(
     jobId,
     values.adminId ?? null,
@@ -230,6 +238,7 @@ async function resolveRelease(options: UpdateRunOptions, platform: ReturnType<ty
       allowedHosts: options.allowedHosts ?? [],
       baseUrl: metadataUrl.toString(),
       maxBytes: options.maxBytes ?? 512 * 1024 * 1024,
+      timeoutMs: options.timeoutMs,
       publicKey: options.publicKey,
       requireSignature: options.requireSignature,
     });
@@ -398,19 +407,28 @@ export function finalizeUpdateJob(
   status: "completed" | "failed",
   message?: string,
 ): void {
-  const row = sqlite.prepare(`
-    SELECT id, status, version, platform, admin_id AS adminId,
-      request_id AS requestId, session_hash AS sessionHash
-    FROM update_jobs WHERE id=?
-  `).get(jobId) as { id: string; status: UpdateJobStatus; version: string; platform: string; adminId: string | null; requestId: string | null; sessionHash: string | null } | undefined;
-  if (!row) throw new Error("更新任务不存在");
-  const canComplete = row.status === "applying" || row.status === "completed";
-  const canFail = ACTIVE_UPDATE_STATUSES.includes(row.status) || row.status === "completed" || row.status === "failed";
-  if (status === "completed" ? !canComplete : !canFail) throw new Error("更新任务状态不允许完成");
-  const now = Date.now();
-  const safeFailureMessage = status === "failed" ? "新版本健康检查失败，已恢复上一版本" : null;
   sqlite.transaction(() => {
-    sqlite.prepare("UPDATE update_jobs SET status=?, error_message=?, completed_at=?, updated_at=? WHERE id=?").run(status, safeFailureMessage, now, now, jobId);
+    const row = sqlite.prepare(`
+      SELECT id, status, version, platform, admin_id AS adminId,
+        request_id AS requestId, session_hash AS sessionHash
+      FROM update_jobs WHERE id=?
+    `).get(jobId) as { id: string; status: UpdateJobStatus; version: string; platform: string; adminId: string | null; requestId: string | null; sessionHash: string | null } | undefined;
+    if (!row) throw new Error("更新任务不存在");
+    // A failed finalization can be retried by the runner. Once it has been
+    // committed, make retries a no-op so the error and audit trail stay stable.
+    if (row.status === status) return;
+    // A completed release is terminal. A delayed recovery process must never
+    // be able to downgrade it to failed after the service was healthy.
+    if (row.status === "completed" && status === "failed") throw new Error("更新任务状态不允许完成");
+    const canComplete = row.status === "applying" || row.status === "completed";
+    const canFail = ACTIVE_UPDATE_STATUSES.includes(row.status) || row.status === "completed" || row.status === "failed";
+    if (status === "completed" ? !canComplete : !canFail) throw new Error("更新任务状态不允许完成");
+    const now = Date.now();
+    const safeFailureMessage = status === "failed"
+      ? (message?.trim() ? safeErrorMessage(new Error(message)) : "新版本健康检查失败，已恢复上一版本")
+      : null;
+    const result = sqlite.prepare("UPDATE update_jobs SET status=?, error_message=?, completed_at=?, updated_at=? WHERE id=? AND status=?").run(status, safeFailureMessage, now, now, jobId, row.status);
+    if (result.changes !== 1) return;
     writeAudit(sqlite, {
       requestId: row.requestId || randomUUID(),
       actorAdminId: row.adminId,
@@ -569,6 +587,7 @@ export async function main(config: AppConfig = loadConfig()): Promise<void> {
       ...(dataBackupArchive ? { dataBackupArchivePath: dataBackupArchive, dataBackupSource: config.dataDir } : {}),
       ...((arg("--backup-dir")) ? { backupDir: arg("--backup-dir") } : {}),
       allowedHosts: allowedHosts.length ? allowedHosts : config.updateAllowedHosts,
+      timeoutMs: config.updateTimeoutMs,
       maxBytes: config.updateMaxBytes,
       dataBackupMaxBytes: config.maxTotalBytes,
       currentVersion: config.appVersion,

server/config.ts

@@ -147,6 +147,7 @@ export function loadConfig() {
     // as 0700 root:root; development/test callers may override --staging-dir.
     updateWorkspaceDir: path.join(installPrefix, ".update-work"),
     updateMaxBytes: integerEnv("TALLYNOTE_UPDATE_MAX_MB", 512) * 1024 * 1024,
+    updateTimeoutMs: integerEnv("TALLYNOTE_UPDATE_TIMEOUT_SECONDS", 30) * 1000,
     // Update checks hit an external release endpoint. Keep a short local
     // cooldown so an authenticated account cannot turn the endpoint into an
     // outbound request flood; set to 0 only for controlled test environments.

server/update-service.ts

@@ -154,19 +154,19 @@ function signatureAssetFor(metadata: ReleaseMetadata, sums: ReleaseAsset): Relea
 export async function attachSidecarHash(
   metadata: ReleaseMetadata,
   asset: ReleaseAsset,
-  options: { allowedHosts: readonly string[]; baseUrl: string; maxBytes: number; publicKey?: string | undefined; requireSignature?: boolean | undefined },
+  options: { allowedHosts: readonly string[]; baseUrl: string; maxBytes: number; timeoutMs?: number | undefined; publicKey?: string | undefined; requireSignature?: boolean | undefined },
 ): Promise<{ asset: ReleaseAsset; signatureVerified: boolean }> {
   let signatureVerified = false;
   if (asset.sha256 && (!options.publicKey || !options.requireSignature)) return { asset, signatureVerified };
   const sums = metadata.assets.find((candidate) => /^(?:sha256sums?|checksums?)(?:\.txt)?$/i.test(path.basename(candidate.name)));
   if (!sums) return { asset, signatureVerified };
   try {
-    const content = await fetchReleaseText(sums.url, { allowedHosts: options.allowedHosts, baseUrl: options.baseUrl, maxBytes: Math.min(options.maxBytes, 2 * 1024 * 1024) });
+    const content = await fetchReleaseText(sums.url, { allowedHosts: options.allowedHosts, baseUrl: options.baseUrl, maxBytes: Math.min(options.maxBytes, 2 * 1024 * 1024), timeoutMs: options.timeoutMs });
     const sha256 = sha256FromSums(content, asset.name);
     if (options.publicKey) {
       const signatureAsset = signatureAssetFor(metadata, sums);
       if (signatureAsset) {
-        const signature = await fetchReleaseBytes(signatureAsset.url, { allowedHosts: options.allowedHosts, baseUrl: options.baseUrl, maxBytes: 64 * 1024 });
+        const signature = await fetchReleaseBytes(signatureAsset.url, { allowedHosts: options.allowedHosts, baseUrl: options.baseUrl, maxBytes: 64 * 1024, timeoutMs: options.timeoutMs });
         signatureVerified = verifyReleaseSignature(content, signature, options.publicKey);
       }
     }
@@ -183,6 +183,7 @@ function policy(config: AppConfig) {
     allowedHosts: config.updateAllowedHosts,
     baseUrl: config.updateMetadataUrl,
     maxRedirects: 3,
+    timeoutMs: config.updateTimeoutMs,
   } as const;
 }
 
@@ -222,6 +223,7 @@ export async function checkForUpdate(database: Database.Database, config: AppCon
       allowedHosts: config.updateAllowedHosts,
       baseUrl: metadataUrl,
       maxBytes: config.updateMaxBytes,
+      timeoutMs: config.updateTimeoutMs,
       publicKey: config.updatePublicKey,
       requireSignature: config.updateRequireSignature,
     });
@@ -426,6 +428,17 @@ function requestJobId(filePath: string): string | null {
   }
 }
 
+function recoveryStateJobId(filePath: string): string | null {
+  try {
+    const info = lstatSync(filePath);
+    if (!info.isFile() || info.isSymbolicLink()) return null;
+    const match = /^job_id=([0-9a-f-]{36})$/m.exec(readFileSync(filePath, "utf8"));
+    return match?.[1] ?? null;
+  } catch {
+    return null;
+  }
+}
+
 function currentReleaseVersion(config: AppConfig): string | null {
   try {
     const target = realpathSync(config.currentLink);
@@ -460,6 +473,12 @@ export function reconcileOrphanedUpdateJobs(database: Database.Database, config:
   const statePresent = stateMtime !== null;
   const requestFresh = requestPresent && now - (requestMtime ?? 0) < ORPHANED_UPDATE_TIMEOUT_MS;
   const stateFresh = statePresent && now - (stateMtime ?? 0) < ORPHANED_UPDATE_TIMEOUT_MS;
+  // The request marker is the hand-off contract between the web process and
+  // the privileged runner. A queued row with a matching, unexpired marker is
+  // still owned by that hand-off even when the runner has not written its
+  // recovery state yet (for example while systemd is starting it).
+  const requestMarkerJobId = requestPresent ? requestJobId(config.updateRequestPath) : null;
+  const stateMarkerJobId = statePresent ? recoveryStateJobId(statePath) : null;
   // A staged download is normally kept for an explicit apply. The one
   // exception is the hand-off window where the API has already changed the
   // operation to `apply` but crashed before writing the request file. That
@@ -472,7 +491,10 @@ export function reconcileOrphanedUpdateJobs(database: Database.Database, config:
     // the UI as an endless "queued" task. Once the short hand-off window has
     // elapsed and no recovery marker exists, release the queue explicitly;
     // a fresh state marker proves that the runner has already claimed it.
-    if (row.status === "queued" && typeof row.updatedAt === "number" && !stateFresh && now - row.updatedAt >= QUEUED_UPDATE_TIMEOUT_MS) {
+    const matchingFreshRequest = requestMarkerJobId === row.id && requestFresh;
+    const matchingFreshState = stateMarkerJobId === row.id && stateFresh;
+    if (row.status === "queued" && typeof row.updatedAt === "number" && !matchingFreshState && now - row.updatedAt >= QUEUED_UPDATE_TIMEOUT_MS) {
+      if (matchingFreshRequest) continue;
       const changed = database.transaction(() => {
         const result = database.prepare(`
           UPDATE update_jobs
@@ -503,7 +525,7 @@ export function reconcileOrphanedUpdateJobs(database: Database.Database, config:
     // A stale request/state marker therefore no longer protects an orphaned
     // row forever, while a fresh marker remains owned by the runner.
     if (row.status === "staged") {
-      if (row.operation !== "apply" || requestFresh || stateFresh) continue;
+      if (row.operation !== "apply" || matchingFreshRequest || matchingFreshState) continue;
       const changed = database.transaction(() => {
         const result = database.prepare(`
           UPDATE update_jobs
@@ -529,7 +551,7 @@ export function reconcileOrphanedUpdateJobs(database: Database.Database, config:
       }
       continue;
     }
-    if (requestFresh || stateFresh) continue;
+    if (matchingFreshRequest || matchingFreshState) continue;
     const status: "completed" | "failed" = row.status === "applying" && releaseVersion === row.version ? "completed" : "failed";
     const errorMessage = status === "failed" ? "更新任务超时，已释放更新队列" : null;
     const changed = database.transaction(() => {
@@ -586,15 +608,15 @@ export function cancelUpdateJob(
   jobId?: string,
 ): { cancelled: boolean; message?: string } {
   const job = jobId
-    ? database.prepare("SELECT id, status, operation, version, admin_id AS adminId, download_path AS downloadPath FROM update_jobs WHERE id=?").get(jobId) as { id: string; status: UpdateJobStatus; operation: string; version: string; adminId: string | null; downloadPath: string | null } | undefined
-    : database.prepare("SELECT id, status, operation, version, admin_id AS adminId, download_path AS downloadPath FROM update_jobs WHERE status IN ('queued', 'downloading') ORDER BY created_at DESC LIMIT 1").get() as { id: string; status: UpdateJobStatus; operation: string; version: string; adminId: string | null; downloadPath: string | null } | undefined;
+    ? database.prepare("SELECT id, status, operation, version, admin_id AS adminId, download_path AS downloadPath FROM update_jobs WHERE id=? AND admin_id=?").get(jobId, adminId) as { id: string; status: UpdateJobStatus; operation: string; version: string; adminId: string | null; downloadPath: string | null } | undefined
+    : database.prepare("SELECT id, status, operation, version, admin_id AS adminId, download_path AS downloadPath FROM update_jobs WHERE admin_id=? AND status IN ('queued', 'downloading') ORDER BY created_at DESC LIMIT 1").get(adminId) as { id: string; status: UpdateJobStatus; operation: string; version: string; adminId: string | null; downloadPath: string | null } | undefined;
 
   if (!job) return { cancelled: false, message: "当前没有处于等待调度或下载中的更新任务" };
   if (job.status !== "queued" && job.status !== "downloading") return { cancelled: false, message: "任务已进入就绪或切换阶段，无法取消" };
 
   const now = Date.now();
   const changed = database.transaction(() => {
-    const result = database.prepare("UPDATE update_jobs SET status='cancelled', error_message='已手动取消更新', completed_at=?, updated_at=? WHERE id=? AND status IN ('queued', 'downloading')").run(now, now, job.id);
+    const result = database.prepare("UPDATE update_jobs SET status='cancelled', error_message='已手动取消更新', completed_at=?, updated_at=? WHERE id=? AND admin_id=? AND status IN ('queued', 'downloading')").run(now, now, job.id, adminId);
     if (result.changes !== 1) return false;
     writeAudit(database, {
       requestId,
@@ -610,7 +632,9 @@ export function cancelUpdateJob(
   })();
 
   if (changed) {
-    forceRemoveRequest(config.updateRequestPath);
+    // The request marker is shared by the privileged runner. Never remove a
+    // newer/different administrator's request while cancelling this row.
+    if (requestJobId(config.updateRequestPath) === job.id) forceRemoveRequest(config.updateRequestPath);
     if (job.downloadPath) {
       const target = path.isAbsolute(job.downloadPath) ? job.downloadPath : path.join(config.stagingDir, job.downloadPath);
       import("node:fs/promises").then(({ rm }) => rm(target, { recursive: true, force: true })).catch(() => {});

server/update.ts

@@ -59,8 +59,22 @@ export type UrlPolicy = {
   /** When allowedHosts is omitted, requests are constrained to this URL's host. */
   baseUrl?: string | URL | undefined;
   maxRedirects?: number | undefined;
+  /** Maximum time allowed for one metadata/sidecar/archive request. */
+  timeoutMs?: number | undefined;
 };
 
+/** Release an unread response body before following a redirect or returning
+ * an error. Undici keeps the underlying connection associated with a body
+ * until it is consumed or cancelled; leaving it open can exhaust sockets when
+ * an update feed repeatedly returns errors or oversized responses. */
+async function cancelResponseBody(response: Response): Promise<void> {
+  try {
+    await response.body?.cancel();
+  } catch {
+    // The body may already be consumed/closed. Cancellation is best effort.
+  }
+}
+
 function invalidVersion(): never {
   throw new Error("更新版本号无效");
 }
@@ -157,8 +171,37 @@ function metadataError(): Error {
 }
 
 const DEFAULT_METADATA_MAX_BYTES = 2 * 1024 * 1024;
+/** Maximum time allowed for one update HTTP request, including its body. */
+export const DEFAULT_UPDATE_TIMEOUT_MS = 30_000;
 export const RELEASE_NOTES_MAX_BYTES = 64 * 1024;
 
+type UpdateFetchOptions = {
+  fetchImpl?: typeof fetch | undefined;
+  maxBytes?: number | undefined;
+  timeoutMs?: number | undefined;
+};
+
+function updateTimeoutMs(options: UpdateFetchOptions): number {
+  if (options.timeoutMs !== undefined) {
+    if (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs <= 0) throw new Error("更新请求超时配置无效");
+    return options.timeoutMs;
+  }
+  const configuredSeconds = process.env.TALLYNOTE_UPDATE_TIMEOUT_SECONDS;
+  if (configuredSeconds !== undefined && configuredSeconds.trim() !== "") {
+    const seconds = Number(configuredSeconds);
+    if (!Number.isSafeInteger(seconds) || seconds <= 0) throw new Error("TALLYNOTE_UPDATE_TIMEOUT_SECONDS 必须是大于 0 的整数");
+    return seconds * 1000;
+  }
+  return DEFAULT_UPDATE_TIMEOUT_MS;
+}
+
+function beginUpdateRequest(options: UpdateFetchOptions): { signal: AbortSignal; clear: () => void } {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), updateTimeoutMs(options));
+  timer.unref?.();
+  return { signal: controller.signal, clear: () => clearTimeout(timer) };
+}
+
 function releaseNotesText(value: unknown): string | undefined {
   if (typeof value !== "string" || value.length === 0) return undefined;
   // Gitea exposes both Markdown (body/body_html) and releaseNotes depending on
@@ -210,20 +253,29 @@ function releaseResourceUrl(value: string, current: URL, options: UrlPolicy): st
 }
 
 /** Read a fetch body without ever buffering more than the caller's bound. */
-async function readBoundedResponse(response: Response, maxBytes: number, tooLargeMessage: string): Promise<Buffer> {
+async function readBoundedResponse(response: Response, maxBytes: number, tooLargeMessage: string, signal?: AbortSignal): Promise<Buffer> {
   if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new Error("响应大小限制无效");
   const contentLength = response.headers.get("content-length");
   if (contentLength !== null) {
     const declared = Number(contentLength);
-    if (Number.isFinite(declared) && declared > maxBytes) throw new Error(tooLargeMessage);
+    if (Number.isFinite(declared) && declared > maxBytes) {
+      await cancelResponseBody(response);
+      throw new Error(tooLargeMessage);
+    }
   }
   if (!response.body) return Buffer.alloc(0);
   const reader = response.body.getReader();
   const chunks: Buffer[] = [];
   let total = 0;
+  let onAbort: (() => void) | undefined;
+  const abort = signal ? new Promise<never>((_, reject) => {
+    onAbort = () => reject(new Error("更新请求超时"));
+    if (signal.aborted) onAbort();
+    else signal.addEventListener("abort", onAbort, { once: true });
+  }) : undefined;
   try {
     for (;;) {
-      const result = await reader.read();
+      const result = await (abort ? Promise.race([reader.read(), abort]) : reader.read());
       if (result.done) break;
       const chunk = Buffer.from(result.value);
       if (chunk.length > maxBytes - total) {
@@ -233,7 +285,11 @@ async function readBoundedResponse(response: Response, maxBytes: number, tooLarg
       total += chunk.length;
       chunks.push(chunk);
     }
+  } catch (error) {
+    await reader.cancel().catch(() => undefined);
+    throw error;
   } finally {
+    if (signal && onAbort) signal.removeEventListener("abort", onAbort);
     reader.releaseLock();
   }
   return Buffer.concat(chunks, total);
@@ -241,84 +297,78 @@ async function readBoundedResponse(response: Response, maxBytes: number, tooLarg
 
 export async function fetchReleaseMetadata(
   metadataUrl: string | URL,
-  options: UrlPolicy & { fetchImpl?: typeof fetch | undefined; maxBytes?: number | undefined } = {},
+  options: UrlPolicy & UpdateFetchOptions = {},
 ): Promise<ReleaseMetadata> {
   const fetchImpl = options.fetchImpl ?? fetch;
   let current = validateHttpsUrl(metadataUrl, options);
   const maxRedirects = options.maxRedirects ?? 3;
   let response: Response;
   for (let redirects = 0; ; redirects += 1) {
+    const request = beginUpdateRequest(options);
     try {
-      response = await fetchImpl(current, { method: "GET", redirect: "manual", headers: { accept: "application/json" } });
+      response = await fetchImpl(current, { method: "GET", redirect: "manual", headers: { accept: "application/json" }, signal: request.signal });
     } catch {
+      request.clear();
       throw metadataError();
     }
-    if (response.status < 300 || response.status >= 400) break;
+    if (response.status < 300 || response.status >= 400) {
+      try {
+        if (response.status < 200 || response.status >= 300) {
+          await cancelResponseBody(response);
+          throw metadataError();
+        }
+        const maxBytes = Math.min(options.maxBytes ?? DEFAULT_METADATA_MAX_BYTES, DEFAULT_METADATA_MAX_BYTES);
+        const body = await readBoundedResponse(response, maxBytes, "更新发布信息过大", request.signal);
+        const payload: unknown = JSON.parse(body.toString("utf8"));
+        if (!payload || typeof payload !== "object") throw metadataError();
+        const item = payload as Record<string, unknown>;
+        const rawVersion = typeof item.version === "string" ? item.version : typeof item.tag_name === "string" ? item.tag_name : typeof item.tagName === "string" ? item.tagName : undefined;
+        if (!rawVersion) throw metadataError();
+        const version = parseSemver(rawVersion);
+        if (typeof item.tag_name === "string" && compareSemver(version, item.tag_name) !== 0) throw metadataError();
+        const assetsRaw = Array.isArray(item.assets) ? item.assets : [];
+        const assets: ReleaseAsset[] = [];
+        for (const raw of assetsRaw) {
+          if (!raw || typeof raw !== "object") continue;
+          const asset = raw as Record<string, unknown>;
+          const name = typeof asset.name === "string" ? asset.name : undefined;
+          const url = typeof asset.url === "string" ? asset.url : typeof asset.browser_download_url === "string" ? asset.browser_download_url : undefined;
+          if (!name || !url) continue;
+          let sha256: string | undefined;
+          const digest = typeof asset.sha256 === "string" ? asset.sha256 : typeof asset.digest === "string" ? asset.digest : undefined;
+          if (digest) {
+            const candidate = digest.replace(/^sha256:/i, "").toLowerCase();
+            if (/^[a-f0-9]{64}$/.test(candidate)) sha256 = candidate;
+          }
+          assets.push({ name, url: releaseResourceUrl(url, current, options), ...(sha256 ? { sha256 } : {}), ...(typeof asset.size === "number" && Number.isSafeInteger(asset.size) && asset.size >= 0 ? { size: asset.size } : {}) });
+        }
+        const notes = releaseNotesText(item.body ?? item.releaseNotes ?? item.release_notes ?? item.body_html);
+        const releaseName = releaseNameText(item.name ?? item.releaseName);
+        let releaseUrl: string | undefined;
+        if (typeof item.html_url === "string" || typeof item.url === "string") {
+          try { releaseUrl = releaseResourceUrl(typeof item.html_url === "string" ? item.html_url : item.url as string, current, options); } catch { /* optional */ }
+        }
+        return {
+          version: `${version.major}.${version.minor}.${version.patch}${version.prerelease.length ? `-${version.prerelease.join(".")}` : ""}${version.build.length ? `+${version.build.join(".")}` : ""}`,
+          ...(typeof item.tag_name === "string" ? { tagName: item.tag_name } : {}), ...(releaseName ? { releaseName } : {}), ...(typeof item.published_at === "string" ? { publishedAt: item.published_at } : {}), ...(notes ? { notes } : {}), ...(releaseUrl ? { releaseUrl } : {}), assets,
+        };
+      } catch { throw metadataError(); }
+      finally { request.clear(); }
+    }
+    await cancelResponseBody(response);
+    request.clear();
     if (redirects >= maxRedirects) throw metadataError();
     const location = response.headers.get("location");
     if (!location) throw metadataError();
     current = validateHttpsUrl(new URL(location, current), options.baseUrl ? options : { ...options, baseUrl: current });
   }
-  if (response.status < 200 || response.status >= 300) throw metadataError();
-  let payload: unknown;
-  try {
-    const maxBytes = Math.min(options.maxBytes ?? DEFAULT_METADATA_MAX_BYTES, DEFAULT_METADATA_MAX_BYTES);
-    const body = await readBoundedResponse(response, maxBytes, "更新发布信息过大");
-    payload = JSON.parse(body.toString("utf8"));
-  } catch { throw metadataError(); }
-  if (!payload || typeof payload !== "object") throw metadataError();
-  const item = payload as Record<string, unknown>;
-  const rawVersion = typeof item.version === "string" ? item.version : typeof item.tag_name === "string" ? item.tag_name : typeof item.tagName === "string" ? item.tagName : undefined;
-  if (!rawVersion) throw metadataError();
-  const version = parseSemver(rawVersion);
-  if (typeof item.tag_name === "string") {
-    try {
-      if (compareSemver(version, item.tag_name) !== 0) throw metadataError();
-    } catch {
-      throw metadataError();
-    }
-  }
-  const assetsRaw = Array.isArray(item.assets) ? item.assets : [];
-  const assets: ReleaseAsset[] = [];
-  for (const raw of assetsRaw) {
-    if (!raw || typeof raw !== "object") continue;
-    const asset = raw as Record<string, unknown>;
-    const name = typeof asset.name === "string" ? asset.name : undefined;
-    const url = typeof asset.url === "string" ? asset.url : typeof asset.browser_download_url === "string" ? asset.browser_download_url : undefined;
-    if (!name || !url) continue;
-    let sha256: string | undefined;
-    const digest = typeof asset.sha256 === "string" ? asset.sha256 : typeof asset.digest === "string" ? asset.digest : undefined;
-    if (digest) {
-      const candidate = digest.replace(/^sha256:/i, "").toLowerCase();
-      if (/^[a-f0-9]{64}$/.test(candidate)) sha256 = candidate;
-    }
-    assets.push({ name, url: releaseResourceUrl(url, current, options), ...(sha256 ? { sha256 } : {}), ...(typeof asset.size === "number" && Number.isSafeInteger(asset.size) && asset.size >= 0 ? { size: asset.size } : {}) });
-  }
-  const notes = releaseNotesText(item.body ?? item.releaseNotes ?? item.release_notes ?? item.body_html);
-  const releaseName = releaseNameText(item.name ?? item.releaseName);
-  let releaseUrl: string | undefined;
-  if (typeof item.html_url === "string" || typeof item.url === "string") {
-    try {
-      const candidate = typeof item.html_url === "string" ? item.html_url : item.url as string;
-      releaseUrl = releaseResourceUrl(candidate, current, options);
-    } catch { /* omit invalid optional release page URL */ }
-  }
-  return {
-    version: `${version.major}.${version.minor}.${version.patch}${version.prerelease.length ? `-${version.prerelease.join(".")}` : ""}${version.build.length ? `+${version.build.join(".")}` : ""}`,
-    ...(typeof item.tag_name === "string" ? { tagName: item.tag_name } : {}),
-    ...(releaseName ? { releaseName } : {}),
-    ...(typeof item.published_at === "string" ? { publishedAt: item.published_at } : {}),
-    ...(notes ? { notes } : {}),
-    ...(releaseUrl ? { releaseUrl } : {}),
-    assets,
-  };
 }
 
 /** Fetch a small text sidecar (for example SHA256SUMS) with the same
  * redirect, HTTPS and host policy used for release metadata. */
 export async function fetchReleaseText(
   textUrl: string | URL,
-  options: UrlPolicy & { fetchImpl?: typeof fetch | undefined; maxBytes?: number | undefined } = {},
+  options: UrlPolicy & UpdateFetchOptions = {},
 ): Promise<string> {
   const fetchImpl = options.fetchImpl ?? fetch;
   let current = validateHttpsUrl(textUrl, options);
@@ -328,27 +378,32 @@ export async function fetchReleaseText(
   const maxRedirects = options.maxRedirects ?? 3;
   let response: Response;
   for (let redirects = 0; ; redirects += 1) {
+    const request = beginUpdateRequest(options);
     try {
-      response = await fetchImpl(current, { method: "GET", redirect: "manual" });
+      response = await fetchImpl(current, { method: "GET", redirect: "manual", signal: request.signal });
     } catch {
+      request.clear();
       throw new Error("更新校验文件下载失败");
     }
-    if (response.status < 300 || response.status >= 400) break;
+    if (response.status < 300 || response.status >= 400) {
+      if (response.status < 200 || response.status >= 300) { await cancelResponseBody(response); request.clear(); throw new Error("更新校验文件下载失败"); }
+      const declared = Number(response.headers.get("content-length") ?? 0);
+      const maxBytes = options.maxBytes ?? 1024 * 1024;
+      if (declared > maxBytes) { await cancelResponseBody(response); request.clear(); throw new Error("更新校验文件过大"); }
+      try {
+        return (await readBoundedResponse(response, maxBytes, "更新校验文件过大", request.signal)).toString("utf8");
+      } catch (error) {
+        if (error instanceof Error && error.message === "更新校验文件过大") throw error;
+        throw new Error("更新校验文件下载失败");
+      } finally { request.clear(); }
+    }
+    await cancelResponseBody(response);
+    request.clear();
     if (redirects >= maxRedirects) throw new Error("更新校验文件下载失败");
     const location = response.headers.get("location");
     if (!location) throw new Error("更新校验文件下载失败");
     current = validateHttpsUrl(new URL(location, current), redirectPolicy);
   }
-  if (response.status < 200 || response.status >= 300) throw new Error("更新校验文件下载失败");
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  const maxBytes = options.maxBytes ?? 1024 * 1024;
-  if (declared > maxBytes) throw new Error("更新校验文件过大");
-  try {
-    return (await readBoundedResponse(response, maxBytes, "更新校验文件过大")).toString("utf8");
-  } catch (error) {
-    if (error instanceof Error && error.message === "更新校验文件过大") throw error;
-    throw new Error("更新校验文件下载失败");
-  }
 }
 
 /** Fetch a bounded binary sidecar (for example an Ed25519 detached
@@ -356,7 +411,7 @@ export async function fetchReleaseText(
  * this separate from fetchReleaseText. */
 export async function fetchReleaseBytes(
   bytesUrl: string | URL,
-  options: UrlPolicy & { fetchImpl?: typeof fetch | undefined; maxBytes?: number | undefined } = {},
+  options: UrlPolicy & UpdateFetchOptions = {},
 ): Promise<Buffer> {
   const fetchImpl = options.fetchImpl ?? fetch;
   let current = validateHttpsUrl(bytesUrl, options);
@@ -366,27 +421,32 @@ export async function fetchReleaseBytes(
   const maxRedirects = options.maxRedirects ?? 3;
   let response: Response;
   for (let redirects = 0; ; redirects += 1) {
+    const request = beginUpdateRequest(options);
     try {
-      response = await fetchImpl(current, { method: "GET", redirect: "manual" });
+      response = await fetchImpl(current, { method: "GET", redirect: "manual", signal: request.signal });
     } catch {
+      request.clear();
       throw new Error("更新签名下载失败");
     }
-    if (response.status < 300 || response.status >= 400) break;
+    if (response.status < 300 || response.status >= 400) {
+      if (response.status < 200 || response.status >= 300) { await cancelResponseBody(response); request.clear(); throw new Error("更新签名下载失败"); }
+      const declared = Number(response.headers.get("content-length") ?? 0);
+      const maxBytes = options.maxBytes ?? 64 * 1024;
+      if (declared > maxBytes) { await cancelResponseBody(response); request.clear(); throw new Error("更新签名文件过大"); }
+      try {
+        return await readBoundedResponse(response, maxBytes, "更新签名文件过大", request.signal);
+      } catch (error) {
+        if (error instanceof Error && error.message === "更新签名文件过大") throw error;
+        throw new Error("更新签名下载失败");
+      } finally { request.clear(); }
+    }
+    await cancelResponseBody(response);
+    request.clear();
     if (redirects >= maxRedirects) throw new Error("更新签名下载失败");
     const location = response.headers.get("location");
     if (!location) throw new Error("更新签名下载失败");
     current = validateHttpsUrl(new URL(location, current), redirectPolicy);
   }
-  if (response.status < 200 || response.status >= 300) throw new Error("更新签名下载失败");
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  const maxBytes = options.maxBytes ?? 64 * 1024;
-  if (declared > maxBytes) throw new Error("更新签名文件过大");
-  try {
-    return await readBoundedResponse(response, maxBytes, "更新签名文件过大");
-  } catch (error) {
-    if (error instanceof Error && error.message === "更新签名文件过大") throw error;
-    throw new Error("更新签名下载失败");
-  }
 }
 
 export function selectReleaseAsset(release: ReleaseMetadata, platform = detectPlatform(), runtimeHash?: string): ReleaseAsset | undefined {
@@ -438,7 +498,7 @@ export async function verifySha256(filePath: string, expected: string): Promise<
 export async function downloadReleaseAsset(
   url: string | URL,
   destination: string,
-  options: UrlPolicy & { fetchImpl?: typeof fetch | undefined; maxBytes?: number | undefined; onProgress?: ((downloadedBytes: number, totalBytes: number | null) => void) | undefined } = {},
+  options: UrlPolicy & UpdateFetchOptions & { onProgress?: ((downloadedBytes: number, totalBytes: number | null) => void) | undefined } = {},
 ): Promise<{ size: number; sha256: string }> {
   const fetchImpl = options.fetchImpl ?? fetch;
   let current = validateHttpsUrl(url, options);
@@ -448,22 +508,32 @@ export async function downloadReleaseAsset(
   const maxRedirects = options.maxRedirects ?? 3;
   let response: Response;
   for (let redirects = 0; ; redirects += 1) {
+    const request = beginUpdateRequest(options);
     try {
-      response = await fetchImpl(current, { method: "GET", redirect: "manual" });
+      response = await fetchImpl(current, { method: "GET", redirect: "manual", signal: request.signal });
     } catch {
+      request.clear();
       throw new Error("更新文件下载失败");
     }
-    if (response.status < 300 || response.status >= 400) break;
+    if (response.status < 300 || response.status >= 400) { request.clear(); break; }
+    await cancelResponseBody(response);
+    request.clear();
     if (redirects >= maxRedirects) throw new Error("更新文件下载失败");
     const location = response.headers.get("location");
     if (!location) throw new Error("更新文件下载失败");
     current = validateHttpsUrl(new URL(location, current), redirectPolicy);
   }
-  if (response.status < 200 || response.status >= 300 || !response.body) throw new Error("更新文件下载失败");
+  if (response.status < 200 || response.status >= 300 || !response.body) {
+    await cancelResponseBody(response);
+    throw new Error("更新文件下载失败");
+  }
   const declared = Number(response.headers.get("content-length") ?? 0);
   const totalBytes = Number.isSafeInteger(declared) && declared > 0 ? declared : null;
   const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
-  if (declared > maxBytes) throw new Error("更新文件超过大小限制");
+  if (declared > maxBytes) {
+    await cancelResponseBody(response);
+    throw new Error("更新文件超过大小限制");
+  }
   await mkdir(path.dirname(destination), { recursive: true, mode: 0o700 });
   const temporary = `${destination}.part-${randomUUID()}`;
   let size = 0;
@@ -475,8 +545,10 @@ export async function downloadReleaseAsset(
     hash.update(chunk);
     callback(null, chunk);
   } });
+  const request = beginUpdateRequest(options);
   try {
-    await pipeline(Readable.fromWeb(response.body as import("node:stream/web").ReadableStream), meter, createWriteStream(temporary, { flags: "wx", mode: 0o600 }));
+    const source = Readable.fromWeb(response.body as import("node:stream/web").ReadableStream, { signal: request.signal });
+    await pipeline(source, meter, createWriteStream(temporary, { flags: "wx", mode: 0o600 }));
     const fd = await open(temporary, "r");
     await fd.sync();
     await fd.close();
@@ -484,6 +556,8 @@ export async function downloadReleaseAsset(
   } catch (error) {
     await import("node:fs/promises").then(({ rm }) => rm(temporary, { force: true })).catch(() => undefined);
     throw error instanceof Error && error.message.startsWith("更新文件") ? error : new Error("更新文件下载失败");
+  } finally {
+    request.clear();
   }
   return { size, sha256: hash.digest("hex") };
 }