fix: simplify update metrics

.gitea/workflows/release.yml

@@ -30,6 +30,7 @@ jobs:
           pnpm install --frozen-lockfile
           pnpm check
           pnpm test
+          pnpm test:installer
       - name: Build Linux release
         run: pnpm release:build "${GITHUB_REF_NAME#v}" ./release
       - name: Create and publish Gitea Release

README.md

@@ -23,7 +23,6 @@ TallyNote_报销资料_xxxxxxxx.zip
 
 ```bash
 pnpm install
-pnpm admin:init
 pnpm dev
 ```
 
@@ -43,7 +42,7 @@ pnpm build:next
 
 `build:next` 与 `pnpm build` 一样输出到 `dist/web`，可直接由生产 Fastify 服务提供。
 
-首次初始化会要求交互式输入管理员密码。也可以使用 `pnpm admin:init -- --username admin --display-name 管理员 --generate` 生成一次性临时密码。
+本地开发首次初始化管理员使用 `pnpm admin:init`。生产安装器会在首次安装时提供管理员初始化向导；如果选择稍后创建，执行 `sudo tallynote-admin-init` 即可。也可以使用 `sudo tallynote-admin-init --username admin --display-name 管理员 --generate` 生成一次性临时密码。
 
 默认地址为 `http://127.0.0.1:3000`，开发界面为 `http://127.0.0.1:5173`。配置项见 `.env.example`。
 
@@ -51,7 +50,7 @@ pnpm build:next
 
 安装器正式支持 **Linux x86_64（x64）**，脚本和运行时也支持在对应原生 runner 上发布 **aarch64（arm64）**；当前仓库内置 workflow 只生成 x64，arm64 需要在原生 ARM64 runner 上单独构建并发布。ARMv7/ARM32 仅实验性支持；Linux x86 32 位（`i386`、`i686`、`ia32`）明确不支持，因为 Node.js 24 和项目原生依赖没有可维护的官方构建。不要在 32 位系统上强行安装。
 
-发布包必须包含 `dist/`、生产依赖、匹配架构的 Node runtime、systemd 单元、`uninstall.sh`，以及 `SHA256SUMS`。签名文件 `SHA256SUMS.sig` 是可选增强校验，不需要为普通安装准备公钥。安装器默认直接安装最新版本：
+发布包必须包含 `dist/`（包括 `dist/server/cli/admin-init.js`）、生产依赖、匹配架构的 Node runtime、systemd 单元、`bin/tallynote-admin-init`、`uninstall.sh`，以及 `SHA256SUMS`。签名文件 `SHA256SUMS.sig` 是可选增强校验，不需要为普通安装准备公钥。安装器默认直接安装最新版本：
 
 ```bash
 curl --proto '=https' --tlsv1.2 -fsSL https://git.awaioi.com/awaioi/TallyNote/raw/branch/main/install.sh | sudo bash
@@ -63,6 +62,8 @@ curl --proto '=https' --tlsv1.2 -fsSL https://git.awaioi.com/awaioi/TallyNote/ra
 curl --proto '=https' --tlsv1.2 -fsSL https://git.awaioi.com/awaioi/TallyNote/raw/branch/main/install.sh | sudo bash
 ```
 
+首次安装完成网络配置后，向导会询问是否立即创建管理员。选择创建时，用户名、显示名称和密码都在当前 SSH 终端中输入；选择稍后创建也不会阻塞服务启动，之后执行 `sudo tallynote-admin-init` 即可。升级已有安装时，向导会自动识别现有管理员并跳过创建，不会覆盖账号或账目。
+
 监听方式有两个选项：`127.0.0.1` 仅本机访问（默认、更安全），或 `0.0.0.0` 允许通过局域网/公网 IP 访问。安装时可输入自定义端口（直接回车使用默认端口），安装器会检查 TCP 端口是否已被占用；选择 `0.0.0.0` 时会尝试通过 HTTPS 自动获取公网 IPv4，并将 `http://公网IP:端口` 作为默认访问地址，也可以改填域名。不能填写 `http://0.0.0.0:3000`。直连 HTTP 未加密，安装器会要求明确确认，只适合受控网络。绑定域名后应改为 HTTPS 反向代理，设置真实的 `TALLYNOTE_PUBLIC_ORIGIN`、`TALLYNOTE_COOKIE_SECURE=true`、`TALLYNOTE_ALLOW_INSECURE_HTTP=false`，然后执行 `sudo systemctl restart tallynote.service`。服务启动后，安装器会先请求本机 `/health`；只有健康检查通过才会报告安装完成并输出最终访问链接。监听 `127.0.0.1` 时该链接只对服务器本机有效；需要公网或其他设备访问时请选择 `0.0.0.0`。健康检查失败时会输出 systemd 状态和最近日志并回滚本次切换。
 
 安装器不会在已有安装的升级过程中反复询问网络配置，并会保留现有环境文件。自动化或无终端环境可使用 `--non-interactive`（默认安全配置 `127.0.0.1:3000`），也可以显式传入 `TALLYNOTE_HOST`、`TALLYNOTE_PORT`、`TALLYNOTE_PUBLIC_ORIGIN` 和 `TALLYNOTE_ALLOW_INSECURE_HTTP` 覆盖配置。
@@ -119,7 +120,7 @@ tallynote installer: 查看服务状态：systemctl status tallynote.service
 
 ### 卸载
 
-安装完成后会提供 `/usr/local/sbin/tallynote-uninstall`。普通卸载会停止并禁用 TallyNote 的 systemd 单元，删除当前版本、更新辅助程序和已知配置，但保留 `/var/lib/tallynote` 以及更新备份，方便以后重新安装：
+安装完成后会提供 `/usr/local/sbin/tallynote-admin-init` 和 `/usr/local/sbin/tallynote-uninstall`。普通卸载会停止并禁用 TallyNote 的 systemd 单元，删除当前版本、更新辅助程序、管理员初始化命令和已知配置，但保留 `/var/lib/tallynote` 以及更新备份，方便以后重新安装：
 
 ```bash
 sudo /usr/local/sbin/tallynote-uninstall
@@ -139,7 +140,7 @@ curl --proto '=https' --tlsv1.2 -fsSL https://git.awaioi.com/awaioi/TallyNote/ra
 
 卸载器会逐项输出停止、禁用和删除进度；每次 systemd/dbus 调用默认最多等待 30 秒，避免终端无限无响应。可通过 `TALLYNOTE_UNINSTALL_SYSTEMCTL_TIMEOUT_SECONDS` 调整超时时间。
 
-公网反代必须使用 HTTPS，并在环境文件中设置真实的 `TALLYNOTE_PUBLIC_ORIGIN=https://...`、`TALLYNOTE_COOKIE_SECURE=true` 和明确的 `TALLYNOTE_TRUST_PROXY` 跳数（不要使用生产值 `true`）。
+公网反代推荐使用 HTTPS，并在环境文件中设置真实的 `TALLYNOTE_PUBLIC_ORIGIN=https://...`、`TALLYNOTE_COOKIE_SECURE=true` 和明确的 `TALLYNOTE_TRUST_PROXY` 跳数（不要使用生产值 `true`）。反代只需把域名转发到 TallyNote 端口并保留 `Host`、`X-Forwarded-Proto`；应用不会因为代理缺少或改写浏览器 `Origin` 而拦截登录。已认证写请求仍使用会话 Cookie 与 CSRF 令牌保护。
 
 ### 构建发布包
 

bin/tallynote-admin-init

@@ -0,0 +1,149 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+# Production entry point for first-admin setup. The installer keeps the
+# EnvironmentFile root-readable only, so parse simple KEY=VALUE assignments
+# without sourcing arbitrary shell code.
+PATH=/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/bin
+export PATH
+umask 077
+
+CONFIG_DIR=${TALLYNOTE_CONFIG_DIR:-/etc/tallynote}
+CONFIG_FILE="$CONFIG_DIR/tallynote.env"
+PREFIX=${TALLYNOTE_INSTALL_PREFIX:-/opt/tallynote}
+SERVICE_NAME=${TALLYNOTE_SERVICE_NAME:-tallynote.service}
+
+die() { printf 'tallynote admin-init: %s\n' "$*" >&2; exit 1; }
+
+load_environment_file() {
+  [[ -e "$CONFIG_FILE" ]] || return 0
+  [[ -f "$CONFIG_FILE" && ! -L "$CONFIG_FILE" ]] || die '环境文件不是安全的普通文件'
+  local uid mode_bits line key value
+  uid=$(stat -c '%u' "$CONFIG_FILE" 2>/dev/null || stat -f '%u' "$CONFIG_FILE")
+  [[ "$uid" == 0 ]] || die '环境文件必须由 root 拥有'
+  mode_bits=$(stat -c '%a' "$CONFIG_FILE" 2>/dev/null || stat -f '%Lp' "$CONFIG_FILE")
+  [[ "$mode_bits" =~ ^[0-7]+$ ]] || die '无法读取环境文件权限'
+  (( (8#$mode_bits & 18) == 0 )) || die '环境文件不能被组或其他用户写入'
+
+  while IFS= read -r line || [[ -n "$line" ]]; do
+    [[ -z "$line" || "$line" == \#* ]] && continue
+    [[ "$line" =~ ^([A-Z][A-Z0-9_]*)=(.*)$ ]] || die '环境文件包含无法识别的配置行'
+    key=${BASH_REMATCH[1]}
+    value=${BASH_REMATCH[2]}
+    [[ "$value" != *$'\n'* && "$value" != *$'\r'* ]] || die "环境文件中的 $key 包含控制字符"
+    export "$key=$value"
+  done < "$CONFIG_FILE"
+  PREFIX=${TALLYNOTE_INSTALL_PREFIX:-$PREFIX}
+}
+
+resolve_release_root() {
+  local root prefix_root
+  [[ "$PREFIX" = /* && "$PREFIX" != *$'\n'* && "$PREFIX" != *$'\r'* ]] || die '安装目录无效'
+  [[ -L "$PREFIX/current" ]] || die '当前 release 链接不存在'
+  prefix_root=$(readlink -f -- "$PREFIX" 2>/dev/null || realpath "$PREFIX" 2>/dev/null || true)
+  [[ -n "$prefix_root" && -d "$prefix_root" && ! -L "$prefix_root" ]] || die '安装目录不安全'
+  root=$(readlink -f -- "$PREFIX/current" 2>/dev/null || realpath "$PREFIX/current" 2>/dev/null || true)
+  [[ -n "$root" && "$root" == "$prefix_root/releases/"* && -d "$root" && ! -L "$root" ]] || die '当前 release 链接不安全'
+  printf '%s' "$root"
+}
+
+run_as_service_user() {
+  local root=$1 node=$2 cli=$3
+  if [[ "${EUID:-$(id -u)}" == 0 ]]; then
+    local service_uid
+    service_uid=$(id -u tallynote 2>/dev/null) || die '找不到 tallynote 服务用户，拒绝以 root 身份执行管理员初始化'
+    [[ "$service_uid" =~ ^[1-9][0-9]*$ ]] || die 'tallynote 服务用户 UID 无效，拒绝以 root 身份执行管理员初始化'
+    command -v runuser >/dev/null 2>&1 || die '找不到 runuser，无法以 tallynote 用户初始化'
+    local -a environment=(
+      "NODE_ENV=production"
+      "TALLYNOTE_DATA_DIR=${TALLYNOTE_DATA_DIR:-/var/lib/tallynote}"
+      "TALLYNOTE_INSTALL_PREFIX=${TALLYNOTE_INSTALL_PREFIX:-$PREFIX}"
+      "TALLYNOTE_TRUST_PROXY=${TALLYNOTE_TRUST_PROXY:-false}"
+      "TALLYNOTE_UPDATE_STRATEGY=${TALLYNOTE_UPDATE_STRATEGY:-systemd}"
+      "TALLYNOTE_HOST=${TALLYNOTE_HOST:-127.0.0.1}"
+      "TALLYNOTE_PORT=${TALLYNOTE_PORT:-3000}"
+      "TALLYNOTE_PUBLIC_ORIGIN=${TALLYNOTE_PUBLIC_ORIGIN:-http://127.0.0.1:3000}"
+      "TALLYNOTE_COOKIE_SECURE=${TALLYNOTE_COOKIE_SECURE:-false}"
+      "TALLYNOTE_ALLOW_INSECURE_HTTP=${TALLYNOTE_ALLOW_INSECURE_HTTP:-false}"
+      "TALLYNOTE_TIMEZONE=${TALLYNOTE_TIMEZONE:-Asia/Shanghai}"
+      "TALLYNOTE_UPDATE_METADATA_URL=${TALLYNOTE_UPDATE_METADATA_URL:-https://git.awaioi.com/api/v1/repos/awaioi/TallyNote/releases/latest}"
+      "TALLYNOTE_UPDATE_ALLOWED_HOSTS=${TALLYNOTE_UPDATE_ALLOWED_HOSTS:-git.awaioi.com}"
+      "TALLYNOTE_UPDATE_REQUIRE_SIGNATURE=${TALLYNOTE_UPDATE_REQUIRE_SIGNATURE:-false}"
+      "TALLYNOTE_UPDATE_MAX_MB=${TALLYNOTE_UPDATE_MAX_MB:-512}"
+      "TALLYNOTE_UPDATE_CHECK_COOLDOWN_SECONDS=${TALLYNOTE_UPDATE_CHECK_COOLDOWN_SECONDS:-60}"
+      "TALLYNOTE_UPDATE_DOWNLOAD_COOLDOWN_SECONDS=${TALLYNOTE_UPDATE_DOWNLOAD_COOLDOWN_SECONDS:-15}"
+      "TALLYNOTE_UPDATE_APPLY_COOLDOWN_SECONDS=${TALLYNOTE_UPDATE_APPLY_COOLDOWN_SECONDS:-15}"
+      "TALLYNOTE_MAX_FILE_MB=${TALLYNOTE_MAX_FILE_MB:-20}"
+      "TALLYNOTE_MAX_FILES_PER_REQUEST=${TALLYNOTE_MAX_FILES_PER_REQUEST:-20}"
+      "TALLYNOTE_MAX_RECORD_MB=${TALLYNOTE_MAX_RECORD_MB:-100}"
+      "TALLYNOTE_MAX_TOTAL_MB=${TALLYNOTE_MAX_TOTAL_MB:-2048}"
+      "TALLYNOTE_MAX_CONCURRENT_EXPORTS=${TALLYNOTE_MAX_CONCURRENT_EXPORTS:-2}"
+      "TALLYNOTE_MAX_EXPORT_RECORDS=${TALLYNOTE_MAX_EXPORT_RECORDS:-5000}"
+      "TALLYNOTE_MAX_EXPORT_MB=${TALLYNOTE_MAX_EXPORT_MB:-1024}"
+      "TALLYNOTE_MAX_EXPORT_STORAGE_MB=${TALLYNOTE_MAX_EXPORT_STORAGE_MB:-2048}"
+      "TALLYNOTE_SESSION_IDLE_HOURS=${TALLYNOTE_SESSION_IDLE_HOURS:-24}"
+      "TALLYNOTE_SESSION_ABSOLUTE_HOURS=${TALLYNOTE_SESSION_ABSOLUTE_HOURS:-168}"
+      "TALLYNOTE_EXPORT_TTL_MINUTES=${TALLYNOTE_EXPORT_TTL_MINUTES:-15}"
+    )
+    [[ -n "${TALLYNOTE_UPDATE_PUBLIC_KEY:-}" ]] && environment+=("TALLYNOTE_UPDATE_PUBLIC_KEY=$TALLYNOTE_UPDATE_PUBLIC_KEY")
+    if [[ -n "${TALLYNOTE_UPDATE_PUBLIC_KEY_FILE:-}" ]]; then
+      environment+=("TALLYNOTE_UPDATE_PUBLIC_KEY_FILE=$TALLYNOTE_UPDATE_PUBLIC_KEY_FILE")
+    fi
+    if [[ -n "${TALLYNOTE_UPDATE_HELPER_PATH:-}" ]]; then
+      environment+=("TALLYNOTE_UPDATE_HELPER_PATH=$TALLYNOTE_UPDATE_HELPER_PATH")
+    fi
+    runuser -u tallynote -- env -i "${environment[@]}" PATH="$PATH" "$node" "$cli" "${@:4}"
+  else
+    "$node" "$cli" "${@:4}"
+  fi
+}
+
+main() {
+  load_environment_file
+  local root node cli systemctl service_was_active=0 result check_only=0
+  for argument in "$@"; do
+    [[ "$argument" == "--check" ]] && check_only=1
+  done
+  root=$(resolve_release_root)
+  node="$root/runtime/bin/node"
+  [[ -x "$node" ]] || node=$(command -v node || true)
+  [[ -n "$node" && -x "$node" ]] || die '找不到 Node.js runtime'
+  cli="$root/dist/server/cli/admin-init.js"
+  [[ -f "$cli" && ! -L "$cli" ]] || die '管理员初始化程序不存在'
+
+  # Validate the privilege boundary before stopping an active service. A
+  # damaged installation must fail closed without causing avoidable downtime.
+  if [[ "${EUID:-$(id -u)}" == 0 ]]; then
+    local service_uid
+    service_uid=$(id -u tallynote 2>/dev/null) || die '找不到 tallynote 服务用户，拒绝以 root 身份执行管理员初始化'
+    [[ "$service_uid" =~ ^[1-9][0-9]*$ ]] || die 'tallynote 服务用户 UID 无效，拒绝以 root 身份执行管理员初始化'
+    command -v runuser >/dev/null 2>&1 || die '找不到 runuser，无法以 tallynote 用户初始化'
+  fi
+
+  # admin-init uses the same instance lock as the web process. Pause an active
+  # service for the duration, then restore exactly its previous active state.
+  systemctl=$(command -v systemctl || true)
+  if (( ! check_only )) && [[ "${EUID:-$(id -u)}" == 0 && -n "$systemctl" && -x "$systemctl" ]] && "$systemctl" is-active --quiet "$SERVICE_NAME"; then
+    service_was_active=1
+    printf 'tallynote admin-init: 暂停服务以完成管理员初始化\n' >&2
+    "$systemctl" stop "$SERVICE_NAME" || die '无法暂停 TallyNote 服务'
+  fi
+  restore_service() {
+    local exit_code=$?
+    if (( service_was_active )); then
+      printf 'tallynote admin-init: 恢复 TallyNote 服务\n' >&2
+      "$systemctl" start "$SERVICE_NAME" || printf 'tallynote admin-init: 警告：服务恢复失败，请执行 systemctl start %s\n' "$SERVICE_NAME" >&2
+    fi
+    return "$exit_code"
+  }
+  trap restore_service EXIT
+
+  cd -- "$root"
+  set +e
+  run_as_service_user "$root" "$node" "$cli" "$@"
+  result=$?
+  set -e
+  exit "$result"
+}
+
+main "$@"

docs/release.md

@@ -74,7 +74,7 @@ tallynote installer: 访问地址：http://127.0.0.1:<端口>
 
 已有安装默认拒绝安装不高于当前版本的 release；只有在明确执行 `--allow-downgrade`（或设置 `TALLYNOTE_ALLOW_DOWNGRADE=true`）时才允许回退版本。
 
-安装器拒绝预先存在的符号链接、非 root 拥有或对组/其他用户可写的安装、配置和备份目录。发布包同时携带 `uninstall.sh`，安装后会落到 `/usr/local/sbin/tallynote-uninstall`。`--allow-unsigned` 作为旧版本兼容参数保留。
+安装器拒绝预先存在的符号链接、非 root 拥有或对组/其他用户可写的安装、配置和备份目录。发布包同时携带 `uninstall.sh`，安装后会落到 `/usr/local/sbin/tallynote-uninstall`，并提供 `/usr/local/sbin/tallynote-admin-init` 作为生产环境首次管理员初始化入口。`--allow-unsigned` 作为旧版本兼容参数保留。
 
 安装布局：
 

install.sh

@@ -57,6 +57,7 @@ INSTALL_PREVIOUS_TARGET=''
 INSTALL_NEW_RELEASE=''
 INSTALL_WORK_DIR=''
 INSTALL_BACKUP_DIR=''
+INSTALL_BACKUP_COMPLETE=0
 INSTALL_WAS_ACTIVE=0
 INSTALL_PATH_WAS_ACTIVE=0
 INSTALL_UPDATE_WAS_ACTIVE=0
@@ -64,6 +65,8 @@ INSTALL_WAS_ENABLED=0
 INSTALL_PATH_WAS_ENABLED=0
 INSTALL_UPDATE_WAS_ENABLED=0
 INSTALL_SYSTEMD_TOUCHED=0
+ADMIN_INIT_PATH=/usr/local/sbin/tallynote-admin-init
+INSTALL_FIRST_INSTALL=0
 DATA_DIR_TEMP_ROOT=0
 DATA_DIR_ORIGINAL_OWNER=''
 
@@ -222,6 +225,55 @@ check_requested_port() {
   esac
 }
 
+run_initial_admin_wizard() {
+  if (( ! INSTALL_FIRST_INSTALL )); then
+    return 0
+  fi
+  if (( NON_INTERACTIVE )); then
+    log '非交互模式：跳过管理员初始化；稍后可执行 sudo tallynote-admin-init'
+    return 0
+  fi
+  [[ -r "$PROMPT_INPUT" && -w "$PROMPT_OUTPUT" ]] || {
+    log '未检测到交互式终端：跳过管理员初始化；稍后可执行 sudo tallynote-admin-init'
+    return 0
+  }
+  [[ -x "$ADMIN_INIT_PATH" ]] || die '管理员初始化命令未安装'
+
+  local status choice
+  if ! status=$("$ADMIN_INIT_PATH" --check 2>/dev/null); then
+    log '无法检查管理员初始化状态；基础安装已完成，稍后可执行 sudo tallynote-admin-init'
+    return 0
+  fi
+  [[ "$status" == empty ]] || return 0
+
+  exec 9<"$PROMPT_INPUT" || die '无法打开终端输入；请稍后执行 sudo tallynote-admin-init'
+  {
+    printf '\n首次安装还差一步：请创建管理员账号。\n'
+    printf '管理员账号用于登录 TallyNote，首次登录后需要设置正式密码。\n'
+  } > "$PROMPT_OUTPUT"
+  while :; do
+    prompt_value '现在创建管理员？输入 yes 继续，其他内容稍后创建' 'yes'
+    choice=$PROMPT_REPLY
+    case "$choice" in
+      yes|YES|Yes|y|Y) break ;;
+      no|NO|No|n|N|'')
+        exec 9<&-
+        log '已跳过管理员初始化；稍后可执行 sudo tallynote-admin-init'
+        return 0
+        ;;
+      *) printf '请输入 yes 或 no。\n' > "$PROMPT_OUTPUT" ;;
+    esac
+  done
+  stage '创建首位管理员（密码不会写入安装日志）'
+  if ! "$ADMIN_INIT_PATH" <&9 > "$PROMPT_OUTPUT"; then
+    exec 9<&-
+    log '管理员初始化未完成；基础安装已完成，稍后可执行 sudo tallynote-admin-init'
+    return 0
+  fi
+  exec 9<&-
+  stage_done '首位管理员创建完成'
+}
+
 wait_for_service_health() {
   local host=$1 port=$2 health_host health_url attempt
   health_host=$host
@@ -847,13 +899,16 @@ rollback_install_if_needed() {
     chmod 700 "$DATA_DIR" 2>/dev/null || true
     DATA_DIR_TEMP_ROOT=0
   fi
-  if (( INSTALL_COMMITTED == 0 )) && [[ -n "$INSTALL_BACKUP_DIR" && -d "$INSTALL_BACKUP_DIR" ]]; then
+  if (( INSTALL_COMMITTED == 0 && INSTALL_BACKUP_COMPLETE == 1 )) && [[ -n "$INSTALL_BACKUP_DIR" && -d "$INSTALL_BACKUP_DIR" ]]; then
     local backup_name target
-    for backup_name in tallynote.service tallynote-update.service tallynote-update.path tallynote-uninstall tallynote.env update-signing-key.pub; do
+    for backup_name in tallynote.service tallynote-update.service tallynote-update.path tallynote-update tallynote-update-runner tallynote-uninstall tallynote-admin-init tallynote.env update-signing-key.pub; do
       case "$backup_name" in
         tallynote.env) target="$CONFIG_DIR/tallynote.env" ;;
         update-signing-key.pub) target="$CONFIG_DIR/update-signing-key.pub" ;;
         tallynote-uninstall) target="/usr/local/sbin/tallynote-uninstall" ;;
+        tallynote-admin-init) target="$ADMIN_INIT_PATH" ;;
+        tallynote-update) target="/usr/local/sbin/tallynote-update" ;;
+        tallynote-update-runner) target="/usr/local/libexec/tallynote-update-runner" ;;
         *) target="/etc/systemd/system/$backup_name" ;;
       esac
       [[ ! -L "$target" ]] || continue
@@ -880,28 +935,41 @@ backup_install_files() {
   local directory=$1 target name
   mkdir -p "$directory"
   chmod 700 "$directory"
-  for name in tallynote.service tallynote-update.service tallynote-update.path; do
-    target="/etc/systemd/system/$name"
-    [[ ! -L "$target" ]] || die "现有 systemd 单元不能是符号链接：$target"
+  # Validate every target before copying any of them. If validation fails, the
+  # installer has not changed an existing file and rollback must not infer that
+  # a partial backup is safe to restore from.
+  for name in tallynote.service tallynote-update.service tallynote-update.path tallynote-update tallynote-update-runner tallynote-uninstall tallynote-admin-init tallynote.env update-signing-key.pub; do
+    case "$name" in
+      tallynote.env) target="$CONFIG_DIR/$name" ;;
+      update-signing-key.pub) target="$CONFIG_DIR/$name" ;;
+      tallynote-uninstall) target="/usr/local/sbin/$name" ;;
+      tallynote-admin-init) target="$ADMIN_INIT_PATH" ;;
+      tallynote-update) target="/usr/local/sbin/$name" ;;
+      tallynote-update-runner) target="/usr/local/libexec/$name" ;;
+      *) target="/etc/systemd/system/$name" ;;
+    esac
+    [[ ! -L "$target" ]] || die "现有安装文件不能是符号链接：$target"
     if [[ -e "$target" ]]; then
-      [[ -f "$target" ]] || die "现有 systemd 单元不是普通文件：$target"
-      cp -a -- "$target" "$directory/$name"
+      [[ -f "$target" ]] || die "现有安装文件不是普通文件：$target"
     fi
   done
-  for name in tallynote.env update-signing-key.pub; do
-    target="$CONFIG_DIR/$name"
-    [[ ! -L "$target" ]] || die "现有配置不能是符号链接：$target"
+
+  for name in tallynote.service tallynote-update.service tallynote-update.path tallynote-update tallynote-update-runner tallynote-uninstall tallynote-admin-init tallynote.env update-signing-key.pub; do
+    case "$name" in
+      tallynote.env) target="$CONFIG_DIR/$name" ;;
+      update-signing-key.pub) target="$CONFIG_DIR/$name" ;;
+      tallynote-uninstall) target="/usr/local/sbin/$name" ;;
+      tallynote-admin-init) target="$ADMIN_INIT_PATH" ;;
+      tallynote-update) target="/usr/local/sbin/$name" ;;
+      tallynote-update-runner) target="/usr/local/libexec/$name" ;;
+      *) target="/etc/systemd/system/$name" ;;
+    esac
     if [[ -e "$target" ]]; then
-      [[ -f "$target" ]] || die "现有配置不是普通文件：$target"
-      cp -a -- "$target" "$directory/$name"
+      cp -a -- "$target" "$directory/$name" || die "无法备份现有安装文件：$target"
+      [[ -f "$directory/$name" ]] || die "现有安装文件备份不完整：$target"
     fi
   done
-  target="/usr/local/sbin/tallynote-uninstall"
-  [[ ! -L "$target" ]] || die "现有卸载器不能是符号链接：$target"
-  if [[ -e "$target" ]]; then
-    [[ -f "$target" ]] || die "现有卸载器不是普通文件：$target"
-    cp -a -- "$target" "$directory/tallynote-uninstall"
-  fi
+  INSTALL_BACKUP_COMPLETE=1
 }
 
 read_env_value() {
@@ -944,7 +1012,10 @@ validate_listen_port() {
 }
 
 validate_public_origin() {
-  local value=$1 authority host path_part origin_port suffix
+  # Keep the optional origin port defined under `set -u`. Origins without an
+  # explicit port (for example https://example.test) are valid and should
+  # proceed to the default-port handling below.
+  local value=$1 authority host path_part origin_port='' suffix
   case "$value" in
     http://*|https://*) ;;
     *) die '公开访问地址必须是 http:// 或 https:// 地址' ;;
@@ -1006,7 +1077,7 @@ validate_existing_env() {
   mode_bits=$(stat_mode_bits "$file")
   (( (mode_bits & 18) == 0 )) || die '环境文件不能被组或其他用户写入'
   local key key_count
-  for key in TALLYNOTE_INSTALL_PREFIX TALLYNOTE_DATA_DIR TALLYNOTE_HOST TALLYNOTE_PORT TALLYNOTE_PUBLIC_ORIGIN TALLYNOTE_ALLOW_INSECURE_HTTP TALLYNOTE_COOKIE_SECURE TALLYNOTE_UPDATE_REQUIRE_SIGNATURE TALLYNOTE_UPDATE_METADATA_URL TALLYNOTE_UPDATE_ALLOWED_HOSTS TALLYNOTE_UPDATE_PUBLIC_KEY_FILE; do
+  for key in TALLYNOTE_INSTALL_PREFIX TALLYNOTE_DATA_DIR TALLYNOTE_HOST TALLYNOTE_PORT TALLYNOTE_PUBLIC_ORIGIN TALLYNOTE_ALLOWED_ORIGINS TALLYNOTE_ALLOW_INSECURE_HTTP TALLYNOTE_COOKIE_SECURE TALLYNOTE_UPDATE_REQUIRE_SIGNATURE TALLYNOTE_UPDATE_METADATA_URL TALLYNOTE_UPDATE_ALLOWED_HOSTS TALLYNOTE_UPDATE_PUBLIC_KEY_FILE; do
     key_count=$(env_key_count "$file" "$key")
     [[ "$key_count" =~ ^[0-9]+$ && "$key_count" -le 1 ]] || die "环境文件包含重复配置：$key"
   done
@@ -1091,9 +1162,9 @@ install_release() {
   normalize_release_tree "$tmp/unpacked"
   [[ -d "$tmp/unpacked/dist" ]] || die 'release archive must contain dist/ at its root'
   [[ -x "$tmp/unpacked/bin/tallynote" ]] || die 'release archive must contain executable bin/tallynote'
-  [[ -f "$tmp/unpacked/package.json" && -f "$tmp/unpacked/dist/server/index.js" && -f "$tmp/unpacked/dist/web/index.html" ]] || die 'release archive is incomplete'
+  [[ -f "$tmp/unpacked/package.json" && -f "$tmp/unpacked/dist/server/index.js" && -f "$tmp/unpacked/dist/server/cli/admin-init.js" && -f "$tmp/unpacked/dist/web/index.html" ]] || die 'release archive is incomplete'
   [[ -f "$tmp/unpacked/systemd/tallynote.service" && -f "$tmp/unpacked/systemd/tallynote-update.service" && -f "$tmp/unpacked/systemd/tallynote-update.path" ]] || die 'release archive is missing systemd units'
-  [[ -f "$tmp/unpacked/systemd/tallynote.env.example" && -x "$tmp/unpacked/scripts/tallynote-update.sh" && -x "$tmp/unpacked/scripts/tallynote-update-runner.sh" && -x "$tmp/unpacked/uninstall.sh" ]] || die 'release archive is missing update/uninstall support files'
+  [[ -f "$tmp/unpacked/systemd/tallynote.env.example" && -x "$tmp/unpacked/scripts/tallynote-update.sh" && -x "$tmp/unpacked/scripts/tallynote-update-runner.sh" && -x "$tmp/unpacked/uninstall.sh" && -x "$tmp/unpacked/bin/tallynote-admin-init" ]] || die 'release archive is missing update/uninstall/admin-init support files'
   grep -Eq '"version"[[:space:]]*:[[:space:]]*"'"$version"'"([,}]|[[:space:]])' "$tmp/unpacked/package.json" || die 'release package version does not match requested version'
   ensure_root_directory "$PREFIX" 755
   ensure_root_directory "$PREFIX/releases" 755
@@ -1288,6 +1359,11 @@ main() {
   stage_done '发布包校验通过'
   [[ "$PREFIX" = /* && "$DATA_DIR" = /* && "$CONFIG_DIR" = /* ]] || die '安装、数据和配置目录必须是绝对路径'
   [[ ! -L "$DATA_DIR" && ! -L "$PREFIX" && ! -L "$CONFIG_DIR" ]] || die 'installation/data/config paths must not be symlinks'
+  if [[ -L "$PREFIX/current" || -e "$PREFIX/current" ]]; then
+    INSTALL_FIRST_INSTALL=0
+  else
+    INSTALL_FIRST_INSTALL=1
+  fi
   stage '停止旧服务并准备安装、配置和数据目录'
   id tallynote >/dev/null 2>&1 || useradd --system --user-group --home-dir "$DATA_DIR" --shell /usr/sbin/nologin tallynote
   backup_install_files "$INSTALL_BACKUP_DIR"
@@ -1315,17 +1391,19 @@ main() {
   stage_done "版本 ${VERSION#v} 已切换为当前版本"
   release_dir="$PREFIX/releases/$VERSION"
   [[ -f "$release_dir/systemd/tallynote.service" && -f "$release_dir/systemd/tallynote-update.service" && -f "$release_dir/systemd/tallynote-update.path" ]] || die 'release package is missing systemd unit files'
-  [[ -f "$release_dir/systemd/tallynote.env.example" && -f "$release_dir/scripts/tallynote-update-runner.sh" && -x "$release_dir/uninstall.sh" ]] || die 'release package is missing update/uninstall support files'
+  [[ -f "$release_dir/systemd/tallynote.env.example" && -f "$release_dir/scripts/tallynote-update-runner.sh" && -x "$release_dir/uninstall.sh" && -x "$release_dir/bin/tallynote-admin-init" && -f "$release_dir/dist/server/cli/admin-init.js" ]] || die 'release package is missing update/uninstall/admin-init support files'
   stage '安装 systemd 单元、更新辅助程序和卸载器'
-  install -d -m 755 /usr/local/libexec /etc/systemd/system
+  install -d -m 755 /usr/local/sbin /usr/local/libexec /etc/systemd/system
   local unit_tmp
   unit_tmp=$(mktemp -d)
   sed "s#/opt/tallynote#$PREFIX#g; s#/var/lib/tallynote#$DATA_DIR#g" "$release_dir/systemd/tallynote.service" > "$unit_tmp/tallynote.service"
   sed "s#/opt/tallynote#$PREFIX#g; s#/var/lib/tallynote#$DATA_DIR#g; s#/var/lib/tallynote-backups#$(dirname -- "$DATA_DIR")/tallynote-backups#g" "$release_dir/systemd/tallynote-update.service" > "$unit_tmp/tallynote-update.service"
-  sed "s#/var/lib/tallynote#$DATA_DIR#g" "$release_dir/systemd/tallynote-update.path" > "$unit_tmp/tallynote-update.path"
+  sed "s#/opt/tallynote#$PREFIX#g; s#/var/lib/tallynote#$DATA_DIR#g" "$release_dir/systemd/tallynote-update.path" > "$unit_tmp/tallynote-update.path"
+  sed "s#/opt/tallynote#$PREFIX#g; s#/etc/tallynote#$CONFIG_DIR#g" "$release_dir/bin/tallynote-admin-init" > "$unit_tmp/tallynote-admin-init"
   install -o root -g root -m 644 "$unit_tmp/tallynote.service" /etc/systemd/system/tallynote.service
   install -o root -g root -m 644 "$unit_tmp/tallynote-update.service" /etc/systemd/system/tallynote-update.service
   install -o root -g root -m 644 "$unit_tmp/tallynote-update.path" /etc/systemd/system/tallynote-update.path
+  install -o root -g root -m 755 "$unit_tmp/tallynote-admin-init" "$ADMIN_INIT_PATH"
   rm -rf "$unit_tmp"
   install -o root -g root -m 755 "$release_dir/scripts/tallynote-update.sh" /usr/local/sbin/tallynote-update
   install -o root -g root -m 755 "$release_dir/scripts/tallynote-update-runner.sh" /usr/local/libexec/tallynote-update-runner
@@ -1407,10 +1485,10 @@ main() {
       printf 'TALLYNOTE_UPDATE_PUBLIC_KEY_FILE=%s\n' "$CONFIG_DIR/update-signing-key.pub" >> "$CONFIG_DIR/tallynote.env"
     fi
   fi
-  stage_done 'systemd 单元、更新辅助程序和卸载器已安装'
-  stage '重新加载 systemd 并启动 TallyNote'
   chown root:root "$CONFIG_DIR/tallynote.env"
   chmod 640 "$CONFIG_DIR/tallynote.env"
+  stage_done 'systemd 单元、更新辅助程序和卸载器已安装'
+  stage '重新加载 systemd 并启动 TallyNote'
   systemctl daemon-reload
   INSTALL_SYSTEMD_TOUCHED=1
   systemctl enable --now tallynote.service tallynote-update.path
@@ -1443,6 +1521,7 @@ main() {
   rm -rf -- "$INSTALL_WORK_DIR" 2>/dev/null || true
   INSTALL_WORK_DIR=''
   stage_done "安装完成：TallyNote ${VERSION#v}"
+  run_initial_admin_wizard
   local access_url access_host access_port configured_host configured_port
   access_url=$(read_env_value "$CONFIG_DIR/tallynote.env" TALLYNOTE_PUBLIC_ORIGIN 2>/dev/null || true)
   if [[ -z "$access_url" ]]; then

migrations/0005_update_progress.sql

@@ -0,0 +1,3 @@
+ALTER TABLE update_jobs ADD COLUMN downloaded_bytes INTEGER;
+ALTER TABLE update_jobs ADD COLUMN download_started_at INTEGER;
+ALTER TABLE update_jobs ADD COLUMN download_speed_bps INTEGER;

package.json

@@ -1,6 +1,6 @@
 {
   "name": "tallynote",
-  "version": "1.1.10",
+  "version": "1.1.24",
   "private": true,
   "type": "module",
   "packageManager": "pnpm@9.0.6",

scripts/build-release.sh

@@ -36,7 +36,7 @@ cp uninstall.sh "$stage/uninstall.sh"
 cp -a systemd/tallynote.service systemd/tallynote-update.service systemd/tallynote-update.path systemd/tallynote.env.example "$stage/systemd/"
 node_path=$(command -v node)
 cp -L "$node_path" "$stage/runtime/bin/node"
-chmod 755 "$stage/bin/tallynote" "$stage/scripts"/*.sh "$stage/runtime/bin/node" "$stage/uninstall.sh"
+chmod 755 "$stage/bin/tallynote" "$stage/bin/tallynote-admin-init" "$stage/scripts"/*.sh "$stage/runtime/bin/node" "$stage/uninstall.sh"
 
 # pnpm's default linker creates symlinks. A release archive is deliberately
 # symlink-free so the installer can reject traversal links deterministically.

scripts/tallynote-update-runner.sh

@@ -32,16 +32,120 @@ if [[ -f "$REQUEST_FILE" && ! -L "$REQUEST_FILE" ]]; then
   [[ "$request_operation" == download || "$request_operation" == apply ]] || request_operation='apply'
 fi
 
+# Capture the request id before any privileged preflight can fail. The
+# request file is an application-owned one-shot marker; removing it on an
+# early runner failure lets the server-side lease reaper release the DB row.
+job_id=''
+if [[ -f "$REQUEST_FILE" && ! -L "$REQUEST_FILE" ]]; then
+  job_id=$(sed -n 's/.*"jobId"[[:space:]]*:[[:space:]]*"\([0-9a-f-]*\)".*/\1/p' "$REQUEST_FILE" | head -n 1)
+fi
+STATE_CREATED=0
+heartbeat_pid=''
+heartbeat_owner=$$
+
+write_recovery_state() {
+  local phase=$1 temporary
+  temporary="$PREFIX/.update-state-$$-${RANDOM}.tmp"
+  [[ ! -e "$temporary" && ! -L "$temporary" ]] || return 1
+  printf 'job_id=%s\nold_target=%s\nphase=%s\n' "$job_id" "$old_target" "$phase" > "$temporary"
+  chmod 600 "$temporary"
+  mv -Tf -- "$temporary" "$STATE_FILE"
+  STATE_CREATED=1
+}
+
+clear_recovery_state() {
+  [[ ! -L "$STATE_FILE" ]] || return 1
+  rm -f -- "$STATE_FILE"
+  STATE_CREATED=0
+}
+
+stop_heartbeat() {
+  if [[ -n "$heartbeat_pid" ]]; then
+    kill "$heartbeat_pid" 2>/dev/null || true
+    wait "$heartbeat_pid" 2>/dev/null || true
+    heartbeat_pid=''
+  fi
+}
+
+heartbeat() {
+  # Keep the lease fresh during long downloads/backups, but stop on a hard
+  # runner kill so an orphaned child cannot keep the recovery marker alive.
+  while kill -0 "$heartbeat_owner" 2>/dev/null; do
+    sleep 10 || exit 0
+    [[ -f "$STATE_FILE" && ! -L "$STATE_FILE" ]] || exit 0
+    touch "$STATE_FILE" 2>/dev/null || exit 0
+  done
+}
+
+start_heartbeat() {
+  stop_heartbeat
+  heartbeat &
+  heartbeat_pid=$!
+}
+
+# This trap covers failures before the normal apply cleanup trap is installed,
+# including a missing runtime, an invalid current link, and a failed service
+# stop. It deliberately does not remove a pre-existing recovery marker.
+preflight_cleanup() {
+  local result=$?
+  stop_heartbeat
+  if (( result != 0 )); then
+    rm -f -- "$REQUEST_FILE" 2>/dev/null || true
+    if (( STATE_CREATED == 1 )); then clear_recovery_state || true; fi
+  fi
+  return "$result"
+}
+trap preflight_cleanup EXIT
+
 # Downloading is intentionally handled while the main service remains up.
 # The CLI persists the validated payload under the root-owned workspace and
 # leaves the job staged for a later apply request.
 if [[ "$request_operation" == download ]]; then
+  # A previous download runner may have been interrupted after creating its
+  # marker. Clear only that download marker and retry the idempotent request.
+  if [[ -f "$STATE_FILE" && ! -L "$STATE_FILE" ]] && grep -q '^phase=download$' "$STATE_FILE"; then
+    clear_recovery_state || die '无法清理上一次下载状态'
+  fi
+  write_recovery_state download || die '无法写入更新恢复状态'
+  cleanup_download() {
+    local result=$?
+    stop_heartbeat
+    if (( result != 0 )); then
+      # The CLI normally records failed itself. If it died before opening the
+      # database, the expired marker/request will be reconciled by the app.
+      rm -f -- "$REQUEST_FILE" 2>/dev/null || true
+    fi
+    clear_recovery_state || true
+    return "$result"
+  }
+  trap cleanup_download EXIT
+  trap 'exit 143' TERM
+  trap 'exit 130' INT
+  start_heartbeat
   node_bin="$CURRENT_LINK/runtime/bin/node"
   [[ -x "$node_bin" ]] || node_bin=$(command -v node || true)
   [[ -n "$node_bin" ]] || die 'node runtime not found'
   cli="$CURRENT_LINK/dist/server/cli/update.js"
   [[ -f "$cli" ]] || die 'update CLI not found in current release'
-  "$node_bin" "$cli" --request-file "$REQUEST_FILE" || exit $?
+  set +e
+  "$node_bin" "$cli" --request-file "$REQUEST_FILE"
+  download_result=$?
+  set -e
+  if (( download_result != 0 )); then
+    # The CLI normally records failed itself. Retry the explicit finalization
+    # for failures that happen before its catch handler can persist the row,
+    # then remove the one-shot request so a failed download cannot keep the
+    # path unit in a permanently triggered state.
+    download_job_id=$(sed -n 's/.*"jobId"[[:space:]]*:[[:space:]]*"\([0-9a-f-]*\)".*/\1/p' "$REQUEST_FILE" | head -n 1)
+    if [[ "$download_job_id" =~ ^[0-9a-f-]{36}$ ]]; then
+      for _ in 1 2 3; do
+        if "$node_bin" "$cli" --finalize-job "$download_job_id" --finalize-status failed --message '更新下载失败' >/dev/null 2>&1; then break; fi
+        sleep 1
+      done
+    fi
+    rm -f -- "$REQUEST_FILE"
+    exit "$download_result"
+  fi
   rm -f -- "$REQUEST_FILE"
   exit 0
 fi
@@ -51,34 +155,21 @@ if systemctl is-active --quiet "$SERVICE_NAME"; then was_active=1; fi
 # shellcheck disable=SC2329 # invoked indirectly by the EXIT trap below
 restore_initial_service() {
   local result=$?
+  stop_heartbeat
+  if (( result != 0 )); then
+    rm -f -- "$REQUEST_FILE" 2>/dev/null || true
+    if (( STATE_CREATED == 1 )); then clear_recovery_state || true; fi
+  fi
   if (( was_active )); then systemctl start "$SERVICE_NAME" || true; fi
   return "$result"
 }
 trap restore_initial_service EXIT
-systemctl stop "$SERVICE_NAME"
-
-job_id=''
-if [[ -f "$REQUEST_FILE" && ! -L "$REQUEST_FILE" ]]; then
-  job_id=$(sed -n 's/.*"jobId"[[:space:]]*:[[:space:]]*"\([0-9a-f-]*\)".*/\1/p' "$REQUEST_FILE" | head -n 1)
-fi
 old_node="$CURRENT_LINK/runtime/bin/node"
 [[ -x "$old_node" ]] || old_node=$(command -v node || true)
-switched=0
 handled=0
 
-write_update_state() {
-  local phase=$1 temporary
-  temporary="$PREFIX/.update-state-$$-${RANDOM}.tmp"
-  [[ ! -e "$temporary" && ! -L "$temporary" ]] || return 1
-  printf 'job_id=%s\nold_target=%s\nphase=%s\n' "$job_id" "$old_target" "$phase" > "$temporary"
-  chmod 600 "$temporary"
-  mv -Tf -- "$temporary" "$STATE_FILE"
-}
-
-clear_update_state() {
-  [[ ! -L "$STATE_FILE" ]] || return 1
-  rm -f -- "$STATE_FILE"
-}
+write_update_state() { write_recovery_state "$1"; }
+clear_update_state() { clear_recovery_state; }
 
 finalize_state_job() {
   local node=$1 status=$2 state_job=$3
@@ -99,6 +190,15 @@ recover_stale_state() {
   [[ "$state_job" =~ ^[0-9a-f-]{36}$ ]] || die 'update state job id is invalid'
   [[ "$state_old" == "$PREFIX/releases/"* && -d "$state_old" && ! -L "$state_old" ]] || die 'update state target is invalid'
   current_target=$(readlink -f -- "$CURRENT_LINK" 2>/dev/null || true)
+  if [[ "$state_phase" == download && "$current_target" == "$state_old" ]]; then
+    # Downloading never changes the active release. If the runner was killed
+    # after the CLI staged its payload but before it removed the recovery
+    # marker, keep the request available for an idempotent retry. Treating
+    # every stale download marker as a failed apply would discard a usable
+    # staged payload and leave the browser showing a misleading failure.
+    clear_update_state || true
+    return 0
+  fi
   if [[ "$state_phase" == finalizing && "$current_target" != "$state_old" ]]; then
     recovery_node="$CURRENT_LINK/runtime/bin/node"
     [[ -x "$recovery_node" ]] || recovery_node=$(command -v node || true)
@@ -112,6 +212,27 @@ recover_stale_state() {
     done
     return 1
   fi
+  if [[ "$current_target" == "$state_old" ]]; then
+    # The process may have restored the old release before it was killed. In
+    # that case the old link is already safe to serve, but the database row
+    # can still be `applying`; finish it as failed before clearing recovery
+    # markers so the UI does not poll forever.
+    recovery_node="$CURRENT_LINK/runtime/bin/node"
+    [[ -x "$recovery_node" ]] || recovery_node=$(command -v node || true)
+    if finalize_state_job "$recovery_node" failed "$state_job"; then
+      rm -f -- "$REQUEST_FILE" 2>/dev/null || true
+      clear_update_state || true
+      return 11
+    fi
+    # A crash before the CLI created its job row is safe to retry. Preserve
+    # the request while dropping only the stale state marker.
+    if [[ -f "$REQUEST_FILE" && ! -L "$REQUEST_FILE" ]]; then
+      clear_update_state || true
+      return 0
+    fi
+    clear_update_state || true
+    return 0
+  fi
   if [[ "$current_target" != "$state_old" ]]; then
     rollback_link="$PREFIX/.current-recovery-$$-${RANDOM}.tmp"
     [[ ! -e "$rollback_link" && ! -L "$rollback_link" ]] || return 1
@@ -156,10 +277,26 @@ fi
 
 [[ -f "$REQUEST_FILE" && ! -L "$REQUEST_FILE" ]] || exit 0
 
+# Only create the marker for this invocation after any marker from a previous
+# interrupted run has been reconciled. Otherwise the freshly-created `running`
+# marker is indistinguishable from stale recovery state and the runner can
+# finalize its own queued job as failed before the update CLI starts.
+if [[ ! -e "$STATE_FILE" ]]; then
+  write_recovery_state running || die '无法写入更新恢复状态'
+fi
+start_heartbeat
+if ! systemctl stop "$SERVICE_NAME"; then
+  die '无法停止 TallyNote 服务'
+fi
+
 rollback_current() {
   local current_target rollback_link
   current_target=$(readlink -f -- "$CURRENT_LINK" 2>/dev/null || true)
-  [[ "$current_target" == "$old_target" ]] && return 0
+  if [[ "$current_target" == "$old_target" ]]; then
+    # An earlier failure branch may already have restored the link. Keep the
+    # marker truthful so the EXIT trap can still finalize the job.
+    return 0
+  fi
   rollback_link="$PREFIX/.current-rollback-$$-${RANDOM}.tmp"
   [[ ! -e "$rollback_link" && ! -L "$rollback_link" ]] || return 1
   ln -s -- "$old_target" "$rollback_link" || return 1
@@ -167,13 +304,20 @@ rollback_current() {
     rm -f -- "$rollback_link" 2>/dev/null || true
     return 1
   fi
-  switched=0
 }
 
 finalize_failed_job() {
   [[ "$job_id" =~ ^[0-9a-f-]{36}$ ]] || return 0
-  [[ -n "$old_node" && -f "$CURRENT_LINK/dist/server/cli/update.js" ]] || return 0
-  "$old_node" "$CURRENT_LINK/dist/server/cli/update.js" --finalize-job "$job_id" --finalize-status failed --message '新版本健康检查失败，已恢复上一版本' >/dev/null 2>&1
+  [[ -n "$old_node" && -f "$CURRENT_LINK/dist/server/cli/update.js" ]] || return 1
+  # Give SQLite a moment to release a transient lock before declaring the
+  # recovery itself failed.
+  for _ in 1 2 3; do
+    if "$old_node" "$CURRENT_LINK/dist/server/cli/update.js" --finalize-job "$job_id" --finalize-status failed --message '新版本健康检查失败，已恢复上一版本' >/dev/null 2>&1; then
+      return 0
+    fi
+    sleep 1
+  done
+  return 1
 }
 
 finalize_completed_job() {
@@ -185,9 +329,13 @@ finalize_completed_job() {
 # shellcheck disable=SC2329 # invoked indirectly by the EXIT trap below
 cleanup_after_update() {
   local result=$? rollback_ok=1
+  stop_heartbeat
   if (( result != 0 && handled == 0 )); then
     if ! rollback_current; then rollback_ok=0; fi
-    if (( rollback_ok == 1 && switched == 0 )); then
+    # Once the old release is active again, always try to close the job. The
+    # previous marker could remain set when an earlier branch had already
+    # rolled back before entering this EXIT trap, leaving `applying` forever.
+    if (( rollback_ok == 1 )); then
       if finalize_failed_job; then
         rm -f -- "$REQUEST_FILE"
         clear_update_state || true
@@ -203,7 +351,6 @@ cleanup_after_update() {
 }
 trap cleanup_after_update EXIT
 
-write_update_state running || exit 1
 node_bin="$CURRENT_LINK/runtime/bin/node"
 [[ -x "$node_bin" ]] || node_bin=$(command -v node || true)
 [[ -n "$node_bin" ]] || die 'node runtime not found'
@@ -218,9 +365,6 @@ if (( update_result != 0 )); then
   exit "$update_result"
 fi
 
-if [[ "$(readlink -f -- "$CURRENT_LINK" 2>/dev/null || true)" != "$old_target" ]]; then
-  switched=1
-fi
 write_update_state health-check || exit 1
 
 systemctl start "$SERVICE_NAME"

scripts/test-installer.sh

@@ -4,6 +4,13 @@ root=$(cd "$(dirname "$0")/.." && pwd)
 bash -n "$root/install.sh" "$root/scripts/tallynote-update.sh"
 grep -Eq '^RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK$' "$root/systemd/tallynote.service"
 grep -Eq '^RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK$' "$root/systemd/tallynote-update.service"
+grep -Eq '^PathExists=/opt/tallynote/\.update-state$' "$root/systemd/tallynote-update.path"
+grep -Eq '^PathChanged=/opt/tallynote/\.update-state$' "$root/systemd/tallynote-update.path"
+grep -Eq '^PathChanged=/opt/tallynote$' "$root/systemd/tallynote-update.path"
+if grep -Eq '^ConditionPathExists=' "$root/systemd/tallynote-update.service"; then
+  echo 'update service must not require only the request file' >&2
+  exit 1
+fi
 output=$(bash "$root/install.sh" --dry-run --release-base-url https://releases.example.test/releases)
 grep -q 'dry-run' <<<"$output"
 grep -q '\[阶段\] 检查运行环境' <<<"$output"
@@ -81,6 +88,12 @@ bash -c '
   chmod 700 "$mode_dir"
   [[ "$(stat_mode_bits "$mode_dir")" == 448 ]]
   mkdir -p "$owner_parent"
+  # CI runs this shell suite as root. Make the parent genuinely non-root in
+  # that environment so the assertion exercises the ownership guard instead
+  # of accidentally passing because root-owned parents are allowed.
+  if [[ "${EUID:-$(id -u)}" == 0 ]]; then
+    chown 65534:65534 "$owner_parent"
+  fi
   if (assert_path_chain "$owner_parent/child") >/dev/null 2>&1; then
     echo "expected non-root path parent to fail" >&2
     exit 1
@@ -153,15 +166,80 @@ bash -c '
   wait_for_service_health 0.0.0.0 3011
 ' _ "$installer_lib"
 
+# Exercise the privileged runner's normal apply hand-off with portable command
+# shims. In particular, the freshly-created running marker must not be treated
+# as stale state before the update CLI gets a chance to process the request.
+runner_root="$tmp/runner"
+runner_prefix="$runner_root/prefix"
+runner_data="$runner_root/data"
+runner_tools="$runner_root/tools"
+mkdir -p "$runner_prefix/releases/1.0.0/runtime/bin" "$runner_prefix/releases/1.0.0/dist/server/cli" "$runner_data" "$runner_tools"
+ln -s "$runner_prefix/releases/1.0.0" "$runner_prefix/current"
+printf '%s\n' '{"jobId":"00000000-0000-4000-8000-000000000001","operation":"apply"}' > "$runner_data/update-request.json"
+printf '%s\n' '#!/usr/bin/env bash' 'printf "%s\\n" "$*" >> "$TALLYNOTE_NODE_TRACE"' 'exit 0' > "$runner_prefix/releases/1.0.0/runtime/bin/node"
+printf '%s\n' cli > "$runner_prefix/releases/1.0.0/dist/server/cli/update.js"
+printf '%s\n' '#!/usr/bin/env bash' 'case "${1:-}" in is-active) exit 0;; *) exit 0;; esac' > "$runner_tools/systemctl"
+printf '%s\n' '#!/usr/bin/env bash' 'if [[ "${1:-}" == "-f" ]]; then shift; [[ "${1:-}" == "--" ]] && shift; /bin/realpath "$1"; else /usr/bin/readlink "$@"; fi' > "$runner_tools/readlink"
+printf '%s\n' '#!/usr/bin/env bash' 'if [[ "${1:-}" == "-Tf" ]]; then shift; /bin/mv -f "$@"; else /bin/mv "$@"; fi' > "$runner_tools/mv"
+printf '%s\n' '#!/usr/bin/env bash' 'exit 0' > "$runner_tools/curl"
+chmod 755 "$runner_prefix/releases/1.0.0/runtime/bin/node" "$runner_tools/systemctl" "$runner_tools/readlink" "$runner_tools/mv" "$runner_tools/curl"
+runner_script="$runner_root/runner.sh"
+runner_path="$runner_tools:/usr/sbin:/usr/bin:/sbin:/bin"
+sed "s#PATH=/usr/sbin:/usr/bin:/sbin:/bin#PATH=$runner_path#" "$root/scripts/tallynote-update-runner.sh" > "$runner_script"
+chmod 755 "$runner_script"
+runner_prefix_physical=$(cd "$runner_prefix" && pwd -P)
+runner_data_physical=$(cd "$runner_data" && pwd -P)
+env EUID=0 TALLYNOTE_INSTALL_PREFIX="$runner_prefix_physical" TALLYNOTE_DATA_DIR="$runner_data_physical" TALLYNOTE_NODE_TRACE="$runner_root/node.log" bash "$runner_script"
+grep -q -- '--request-file' "$runner_root/node.log"
+grep -q -- '--finalize-job' "$runner_root/node.log"
+[[ ! -e "$runner_data/update-request.json" ]]
+[[ ! -e "$runner_prefix/.update-state" ]]
+
+# A stale download marker must be recoverable without finalizing the staged
+# download as a failed apply. The next runner invocation should retry the
+# request and let the CLI preserve/refresh its staged workspace.
+download_runner_root="$tmp/download-runner"
+download_runner_prefix="$download_runner_root/prefix"
+download_runner_data="$download_runner_root/data"
+download_runner_tools="$download_runner_root/tools"
+mkdir -p "$download_runner_prefix/releases/1.0.0/runtime/bin" "$download_runner_prefix/releases/1.0.0/dist/server/cli" "$download_runner_data" "$download_runner_tools"
+ln -s "$download_runner_prefix/releases/1.0.0" "$download_runner_prefix/current"
+# The request has already been consumed; only the stale download marker is
+# left, which is the narrow recovery window covered by this fixture.
+download_runner_prefix_physical=$(cd "$download_runner_prefix" && pwd -P)
+download_runner_data_physical=$(cd "$download_runner_data" && pwd -P)
+printf '%s\n' 'job_id=00000000-0000-4000-8000-000000000002' "old_target=$download_runner_prefix_physical/releases/1.0.0" 'phase=download' > "$download_runner_prefix/.update-state"
+printf '%s\n' '#!/usr/bin/env bash' 'printf "%s\n" "$*" >> "$TALLYNOTE_DOWNLOAD_NODE_TRACE"' 'exit 0' > "$download_runner_prefix/releases/1.0.0/runtime/bin/node"
+printf '%s\n' cli > "$download_runner_prefix/releases/1.0.0/dist/server/cli/update.js"
+printf '%s\n' '#!/usr/bin/env bash' 'case "${1:-}" in is-active) exit 0;; *) exit 0;; esac' > "$download_runner_tools/systemctl"
+printf '%s\n' '#!/usr/bin/env bash' 'if [[ "${1:-}" == "-f" ]]; then shift; [[ "${1:-}" == "--" ]] && shift; /bin/realpath "$1"; else /usr/bin/readlink "$@"; fi' > "$download_runner_tools/readlink"
+cat >"$download_runner_tools/stat" <<'EOF'
+#!/usr/bin/env bash
+case "$*" in
+  *"-c %u"*|*"-f %u"*) printf '0\n' ;;
+  *"-c %a"*|*"-f %Lp"*) printf '600\n' ;;
+  *) /usr/bin/stat "$@" ;;
+esac
+EOF
+chmod 755 "$download_runner_prefix/releases/1.0.0/runtime/bin/node" "$download_runner_tools/systemctl" "$download_runner_tools/readlink" "$download_runner_tools/stat"
+download_runner_script="$download_runner_root/runner.sh"
+sed "s#PATH=/usr/sbin:/usr/bin:/sbin:/bin#PATH=$download_runner_tools:/usr/sbin:/usr/bin:/sbin:/bin#" "$root/scripts/tallynote-update-runner.sh" > "$download_runner_script"
+chmod 755 "$download_runner_script"
+env EUID=0 TALLYNOTE_INSTALL_PREFIX="$download_runner_prefix_physical" TALLYNOTE_DATA_DIR="$download_runner_data_physical" TALLYNOTE_DOWNLOAD_NODE_TRACE="$download_runner_root/node.log" bash "$download_runner_script"
+[[ ! -e "$download_runner_root/node.log" ]]
+[[ ! -e "$download_runner_prefix/.update-state" ]]
+
 # A RETURN trap installed by install_release must be cleared while its local
 # temporary variables still exist; otherwise set -u fails at the end of main.
 release_fixture="$tmp/release-fixture"
-mkdir -p "$release_fixture/dist/server" "$release_fixture/dist/web" "$release_fixture/bin" \
+mkdir -p "$release_fixture/dist/server/cli" "$release_fixture/dist/web" "$release_fixture/bin" \
   "$release_fixture/scripts" "$release_fixture/runtime/bin" "$release_fixture/systemd"
 printf '%s\n' '{"version":"1.0.0"}' > "$release_fixture/package.json"
 printf '%s\n' server > "$release_fixture/dist/server/index.js"
+printf '%s\n' cli > "$release_fixture/dist/server/cli/admin-init.js"
 printf '%s\n' web > "$release_fixture/dist/web/index.html"
 printf '%s\n' '#!/bin/sh' > "$release_fixture/bin/tallynote"
+cp "$root/bin/tallynote-admin-init" "$release_fixture/bin/tallynote-admin-init"
 printf '%s\n' '#!/bin/sh' > "$release_fixture/scripts/tallynote-update.sh"
 printf '%s\n' '#!/bin/sh' > "$release_fixture/scripts/tallynote-update-runner.sh"
 printf '%s\n' '#!/bin/sh' > "$release_fixture/uninstall.sh"
@@ -169,7 +247,7 @@ printf '%s\n' '[Unit]' > "$release_fixture/systemd/tallynote.service"
 printf '%s\n' '[Unit]' > "$release_fixture/systemd/tallynote-update.service"
 printf '%s\n' '[Unit]' > "$release_fixture/systemd/tallynote-update.path"
 printf '%s\n' 'TALLYNOTE_HOST=127.0.0.1' > "$release_fixture/systemd/tallynote.env.example"
-chmod 755 "$release_fixture/bin/tallynote" "$release_fixture/scripts"/*.sh "$release_fixture/uninstall.sh"
+chmod 755 "$release_fixture/bin/tallynote" "$release_fixture/bin/tallynote-admin-init" "$release_fixture/scripts"/*.sh "$release_fixture/uninstall.sh"
 release_archive="$tmp/release-fixture.tar.gz"
 tar -C "$release_fixture" -czf "$release_archive" .
 bash -c '
@@ -185,10 +263,120 @@ bash -c '
     if [[ "${1:-}" == -Tf ]]; then shift; /bin/mv -f "$@"; else /bin/mv "$@"; fi
   }
   install_release "$archive" 1.0.0
+  [[ -x "$PREFIX/releases/1.0.0/bin/tallynote-admin-init" ]]
   set_env_key() { local key=$1 value=$2 escaped; :; }
   set_env_key test value
 ' _ "$installer_lib" "$release_archive" "$tmp/install-release"
 
+# The installed path unit must watch both the data-directory request and the
+# release-prefix recovery marker after custom paths are substituted.
+rendered_path="$tmp/rendered-update.path"
+sed "s#/opt/tallynote#$tmp/custom-prefix#g; s#/var/lib/tallynote#$tmp/custom-data#g" \
+  "$root/systemd/tallynote-update.path" > "$rendered_path"
+grep -Fxq "PathExists=$tmp/custom-data/update-request.json" "$rendered_path"
+grep -Fxq "PathChanged=$tmp/custom-data/update-request.json" "$rendered_path"
+grep -Fxq "PathExists=$tmp/custom-prefix/.update-state" "$rendered_path"
+grep -Fxq "PathChanged=$tmp/custom-prefix/.update-state" "$rendered_path"
+grep -Fxq "PathChanged=$tmp/custom-prefix" "$rendered_path"
+
+# The production admin wrapper must load a release-relative runtime, change to
+# the release root, and forward CLI arguments without requiring pnpm.
+wrapper_prefix="$tmp/wrapper-prefix"
+mkdir -p "$wrapper_prefix/releases/1.0.0/runtime/bin" "$wrapper_prefix/releases/1.0.0/dist/server/cli"
+ln -s "$wrapper_prefix/releases/1.0.0" "$wrapper_prefix/current"
+printf '%s\n' '#!/usr/bin/env bash' 'pwd -P > "$TALLYNOTE_WRAPPER_LOG"' 'printf "%s\n" "$@" >> "$TALLYNOTE_WRAPPER_LOG"' > "$wrapper_prefix/releases/1.0.0/runtime/bin/node"
+chmod 755 "$wrapper_prefix/releases/1.0.0/runtime/bin/node"
+printf '%s\n' cli > "$wrapper_prefix/releases/1.0.0/dist/server/cli/admin-init.js"
+# This fixture verifies release-relative execution and argument forwarding.
+# Force the wrapper's non-root branch so the root CI runner does not need a
+# real `tallynote` service account or a privileged runuser hand-off; that
+# privilege boundary is validated by the production checks themselves.
+env EUID=1000 TALLYNOTE_INSTALL_PREFIX="$wrapper_prefix" TALLYNOTE_CONFIG_DIR="$tmp/no-config" TALLYNOTE_WRAPPER_LOG="$tmp/wrapper.log" \
+  bash "$root/bin/tallynote-admin-init" --generate
+wrapper_expected_root=$(cd "$wrapper_prefix/releases/1.0.0" && pwd -P)
+grep -Fxq "$wrapper_expected_root" "$tmp/wrapper.log"
+grep -Fxq -- '--generate' "$tmp/wrapper.log"
+
+# The first-install prompt is optional and must support an explicit later
+# initialization path without blocking the rest of the install.
+admin_wizard_dir="$tmp/admin-wizard"
+mkdir -p "$admin_wizard_dir"
+printf '%s\n' yes remaining-input > "$admin_wizard_dir/input"
+: > "$admin_wizard_dir/output"
+cat > "$admin_wizard_dir/admin-init" <<'EOF'
+#!/usr/bin/env bash
+if [[ "${1:-}" == --check ]]; then
+  printf '%s\n' empty
+else
+  printf '%s\n' initialized > "$TALLYNOTE_ADMIN_WIZARD_RESULT"
+fi
+EOF
+chmod 755 "$admin_wizard_dir/admin-init"
+bash -c '
+  script=$1
+  dir=$2
+  set --
+  source "$script"
+  INSTALL_FIRST_INSTALL=1
+  NON_INTERACTIVE=0
+  PROMPT_INPUT="$dir/input"
+  PROMPT_OUTPUT="$dir/output"
+  ADMIN_INIT_PATH="$dir/admin-init"
+  TALLYNOTE_ADMIN_WIZARD_RESULT="$dir/result"
+  export TALLYNOTE_ADMIN_WIZARD_RESULT
+  run_initial_admin_wizard
+  [[ -f "$dir/result" ]]
+' _ "$installer_lib" "$admin_wizard_dir"
+
+# An upgrade must never reopen the first-admin wizard, even if a damaged or
+# deliberately empty database would otherwise report an uninitialized state.
+printf '%s\n' yes > "$admin_wizard_dir/upgrade-input"
+rm -f "$admin_wizard_dir/upgrade-result"
+bash -c '
+  script=$1
+  dir=$2
+  set --
+  source "$script"
+  INSTALL_FIRST_INSTALL=0
+  NON_INTERACTIVE=0
+  PROMPT_INPUT="$dir/upgrade-input"
+  PROMPT_OUTPUT="$dir/upgrade-output"
+  ADMIN_INIT_PATH="$dir/admin-init"
+  TALLYNOTE_ADMIN_WIZARD_RESULT="$dir/upgrade-result"
+  export TALLYNOTE_ADMIN_WIZARD_RESULT
+  run_initial_admin_wizard
+  [[ ! -e "$dir/upgrade-result" ]]
+' _ "$installer_lib" "$admin_wizard_dir"
+
+# Validation or password errors after the base service is committed must leave
+# the installation usable and point the operator at the standalone command.
+failed_wizard_dir="$tmp/failed-admin-wizard"
+mkdir -p "$failed_wizard_dir"
+printf '%s\n' yes > "$failed_wizard_dir/input"
+: > "$failed_wizard_dir/output"
+cat >"$failed_wizard_dir/admin-init" <<'EOF'
+#!/usr/bin/env bash
+if [[ "${1:-}" == --check ]]; then
+  printf '%s\n' empty
+  exit 0
+fi
+exit 1
+EOF
+chmod 755 "$failed_wizard_dir/admin-init"
+bash -c '
+  script=$1
+  dir=$2
+  set --
+  source "$script"
+  INSTALL_FIRST_INSTALL=1
+  NON_INTERACTIVE=0
+  PROMPT_INPUT="$dir/input"
+  PROMPT_OUTPUT="$dir/output"
+  ADMIN_INIT_PATH="$dir/admin-init"
+  run_initial_admin_wizard
+  [[ -x "$dir/admin-init" ]]
+' _ "$installer_lib" "$failed_wizard_dir"
+
 # Duplicate security-sensitive EnvironmentFile assignments are rejected even
 # when the first value looks valid (systemd uses the later value).
 duplicate_env="$tmp/duplicate.env"
@@ -270,6 +458,9 @@ bash -c '
   stat_uid() { printf "0"; }
   stat_mode_bits() { printf "384"; }
   validate_public_origin "http://[2001:db8::10]:3000"
+  # A standard HTTPS origin may omit its default port; this must remain valid
+  # under the installer strict unset-variable mode.
+  validate_public_origin "https://example.test"
 ' _ "$installer_lib"
 printf '%s\n' \
   'TALLYNOTE_HOST=0.0.0.0' \

scripts/test-uninstaller.sh

@@ -34,8 +34,9 @@ make_fixture() {
   done
   printf '%s\n' '#!/usr/bin/env bash' 'PREFIX=${TALLYNOTE_INSTALL_PREFIX:-/opt/tallynote}' 'echo TallyNote' > "$fixture/usr/local/sbin/tallynote-update"
   printf '%s\n' '#!/usr/bin/env bash' 'PREFIX=${TALLYNOTE_INSTALL_PREFIX:-/opt/tallynote}' 'echo TallyNote' > "$fixture/usr/local/libexec/tallynote-update-runner"
+  printf '%s\n' '#!/usr/bin/env bash' 'exec /opt/tallynote/current/runtime/bin/node /opt/tallynote/current/dist/server/cli/admin-init.js' > "$fixture/usr/local/sbin/tallynote-admin-init"
   cp "$root/uninstall.sh" "$fixture/usr/local/sbin/tallynote-uninstall"
-  chmod 755 "$fixture/usr/local/sbin/tallynote-update" "$fixture/usr/local/libexec/tallynote-update-runner" "$fixture/usr/local/sbin/tallynote-uninstall"
+  chmod 755 "$fixture/usr/local/sbin/tallynote-update" "$fixture/usr/local/libexec/tallynote-update-runner" "$fixture/usr/local/sbin/tallynote-admin-init" "$fixture/usr/local/sbin/tallynote-uninstall"
   printf '%s\n' 'sqlite' > "$fixture/var/lib/tallynote/tallynote.db"
   printf '%s\n' 'backup' > "$fixture/var/lib/tallynote-backups/backup.db"
 }
@@ -73,6 +74,7 @@ run_uninstall "$fixture"
 [[ ! -e "$fixture/opt/tallynote" || -z "$(find "$fixture/opt/tallynote" -mindepth 1 -print -quit 2>/dev/null)" ]]
 [[ ! -e "$fixture/etc/systemd/system/tallynote.service" ]]
 [[ ! -e "$fixture/usr/local/sbin/tallynote-update" ]]
+[[ ! -e "$fixture/usr/local/sbin/tallynote-admin-init" ]]
 grep -n '^is-active.*tallynote-update.path' "$fixture/systemctl.log" >/dev/null
 grep -n '^stop tallynote-update.path' "$fixture/systemctl.log" >/dev/null
 path_stop=$(grep -n '^stop tallynote-update.path' "$fixture/systemctl.log" | head -n1 | cut -d: -f1)

server/app.ts

@@ -59,6 +59,7 @@ import {
   checkForUpdate,
   publicCheckFromCache,
   publicUpdateJob,
+  reconcileOrphanedUpdateJobs,
   readCachedRelease,
   writeUpdateRequest,
   type UpdateRequest,
@@ -118,7 +119,7 @@ function enforceUpdateCooldown(
   adminId: string,
   operation: "check" | "download" | "apply",
   reply: FastifyReply,
-): void {
+): number {
   const state = updateRateState(database, adminId);
   const now = Date.now();
   const previous = operation === "check" ? state.checkedAt : operation === "download" ? state.downloadedAt : state.appliedAt;
@@ -133,6 +134,7 @@ function enforceUpdateCooldown(
   if (operation === "check") state.checkedAt = now;
   else if (operation === "download") state.downloadedAt = now;
   else state.appliedAt = now;
+  return now;
 }
 
 function adminSelect(alias = ""): string {
@@ -590,6 +592,13 @@ function conflict(database: DatabaseContext, id: string): never {
 }
 
 export async function buildApp(database: DatabaseContext, config: AppConfig) {
+  // Helmet's defaults include `upgrade-insecure-requests`, HSTS, COOP and
+  // Origin-Agent-Cluster. Those headers are appropriate for HTTPS, but an
+  // explicitly opted-in HTTP deployment must remain HTTP all the way through
+  // the asset graph; otherwise browsers upgrade `/assets/*` to HTTPS and the
+  // plain HTTP listener appears as a blank page. Keep the transport-sensitive
+  // headers protocol-aware while retaining the other hardening headers.
+  const secureOrigin = config.publicOrigin.startsWith("https:");
   const app = Fastify({
     logger: config.isProduction ? { level: "info", redact: ["req.headers.cookie", "req.headers.x-csrf-token", "password", "temporaryPassword"] } : false,
     // Fastify's runtime accepts a numeric hop count, while its v5 typings do
@@ -604,10 +613,10 @@ export async function buildApp(database: DatabaseContext, config: AppConfig) {
 
   await app.register(cookie);
   await app.register(helmet, {
-    ...(config.isLocalOrigin ? { hsts: false } : {}),
+    ...(!secureOrigin || config.isLocalOrigin ? { hsts: false } : {}),
     frameguard: { action: "deny" },
     referrerPolicy: { policy: "no-referrer" },
-    crossOriginOpenerPolicy: { policy: "same-origin" },
+    ...(secureOrigin ? { crossOriginOpenerPolicy: { policy: "same-origin" }, originAgentCluster: true } : { crossOriginOpenerPolicy: false, originAgentCluster: false }),
     crossOriginResourcePolicy: { policy: "same-origin" },
     contentSecurityPolicy: {
       directives: {
@@ -618,7 +627,7 @@ export async function buildApp(database: DatabaseContext, config: AppConfig) {
         "frame-ancestors": ["'none'"],
         "base-uri": ["'none'"],
         "form-action": ["'self'"],
-        ...(config.isLocalOrigin ? { "upgrade-insecure-requests": null } : {}),
+        ...(!secureOrigin ? { "upgrade-insecure-requests": null } : {}),
       },
     },
   });
@@ -639,19 +648,6 @@ export async function buildApp(database: DatabaseContext, config: AppConfig) {
     return payload;
   });
 
-  app.addHook("onRequest", async (request) => {
-    if (!unsafeMethods.has(request.method) || !request.url.startsWith("/api/")) return;
-    const origin = request.headers.origin;
-    const allowed = new Set([config.publicOrigin]);
-    if (!config.isProduction) {
-      allowed.add("http://127.0.0.1:5173");
-      allowed.add("http://localhost:5173");
-    }
-    if (typeof origin !== "string" || !allowed.has(origin)) {
-      throw new AppError(403, "ORIGIN_FORBIDDEN", "请求来源不受信任");
-    }
-  });
-
   app.setErrorHandler((error, request, reply) => {
     if (error instanceof AppError) return reply.code(error.statusCode).send(errorPayload(request, error));
     if (error instanceof ZodError) {
@@ -932,11 +928,14 @@ export async function buildApp(database: DatabaseContext, config: AppConfig) {
     // Release metadata and task state should never be stored by an upstream
     // proxy or a shared browser cache.
     reply.header("Cache-Control", "no-store");
+    reconcileOrphanedUpdateJobs(database.sqlite, config);
     const cached = publicCheckFromCache(database.sqlite, config);
     const row = database.sqlite.prepare(`
       SELECT id, operation, status, version, platform, asset_name AS assetName,
         size_bytes AS sizeBytes, error_message AS errorMessage,
         created_at AS createdAt, updated_at AS updatedAt, completed_at AS completedAt,
+        downloaded_bytes AS downloadedBytes, download_started_at AS downloadStartedAt,
+        download_speed_bps AS downloadSpeedBps,
         requested_at AS applyQueuedAt
       FROM update_jobs WHERE admin_id=? ORDER BY created_at DESC LIMIT 1
     `).get(request.auth!.admin.id) as Record<string, unknown> | undefined;
@@ -948,11 +947,15 @@ export async function buildApp(database: DatabaseContext, config: AppConfig) {
   });
 
   app.post("/api/update/check", { preHandler: guard(database, config), bodyLimit: 32 * 1024 }, async (request, reply) => {
+    const rateState = updateRateState(database.sqlite, request.auth!.admin.id);
+    const previousCheckedAt = rateState.checkedAt;
+    let reservedCheckedAt: number | null = null;
     try {
+      reconcileOrphanedUpdateJobs(database.sqlite, config);
       // Disabled/dev installs do not contact a release endpoint, so repeated
       // checks are local status reads and should remain immediately usable.
       if (config.updateStrategy !== "disabled") {
-        enforceUpdateCooldown(database.sqlite, config, request.auth!.admin.id, "check", reply);
+        reservedCheckedAt = enforceUpdateCooldown(database.sqlite, config, request.auth!.admin.id, "check", reply);
       }
       const result = await checkForUpdate(database.sqlite, config);
       writeAudit(database.sqlite, {
@@ -971,6 +974,10 @@ export async function buildApp(database: DatabaseContext, config: AppConfig) {
       reply.header("Cache-Control", "no-store");
       return { ...result, strategy: config.updateStrategy };
     } catch (error) {
+      // A failed upstream request is not a successful check. Release the
+      // reservation only when this request still owns it, so a concurrent
+      // successful check cannot have its cooldown overwritten.
+      if (reservedCheckedAt !== null && rateState.checkedAt === reservedCheckedAt) rateState.checkedAt = previousCheckedAt;
       writeAudit(database.sqlite, {
         requestId: request.id,
         actorAdminId: request.auth!.admin.id,
@@ -988,6 +995,7 @@ export async function buildApp(database: DatabaseContext, config: AppConfig) {
     let applyAuditRecorded = false;
     let applyAuditTarget: string | undefined;
     try {
+    reconcileOrphanedUpdateJobs(database.sqlite, config);
     if (config.updateStrategy !== "systemd") {
       throw new AppError(503, "UPDATE_NOT_AVAILABLE", "当前安装方式未启用一键更新，请使用命令行更新");
     }
@@ -1138,6 +1146,7 @@ export async function buildApp(database: DatabaseContext, config: AppConfig) {
 
   app.post("/api/update/download", { preHandler: guard(database, config), bodyLimit: 32 * 1024 }, async (request, reply) => {
     const input = updateDownloadSchema.parse(request.body);
+    reconcileOrphanedUpdateJobs(database.sqlite, config);
     if (config.updateStrategy !== "systemd") throw new AppError(503, "UPDATE_NOT_AVAILABLE", "当前安装方式未启用一键更新，请使用命令行更新");
     const active = database.sqlite.prepare(`SELECT id FROM update_jobs WHERE status IN (${ACTIVE_UPDATE_STATUSES.map(() => "?").join(",")}) LIMIT 1`).get(...ACTIVE_UPDATE_STATUSES) as { id: string } | undefined;
     if (active) throw new AppError(409, "UPDATE_IN_PROGRESS", "已有更新任务正在进行，请等待完成");
@@ -1168,10 +1177,13 @@ export async function buildApp(database: DatabaseContext, config: AppConfig) {
 
   app.get("/api/update/jobs/:id", { preHandler: guard(database, config) }, async (request, reply) => {
     const id = z.string().uuid().parse((request.params as { id: string }).id);
+    reconcileOrphanedUpdateJobs(database.sqlite, config);
     const row = database.sqlite.prepare(`
       SELECT id, operation, status, version, platform, asset_name AS assetName,
         size_bytes AS sizeBytes, error_message AS errorMessage,
         created_at AS createdAt, updated_at AS updatedAt, completed_at AS completedAt,
+        downloaded_bytes AS downloadedBytes, download_started_at AS downloadStartedAt,
+        download_speed_bps AS downloadSpeedBps,
         requested_at AS applyQueuedAt
       FROM update_jobs WHERE id=? AND admin_id=?
     `).get(id, request.auth!.admin.id) as Record<string, unknown> | undefined;

server/cli/admin-init.ts

@@ -1,7 +1,7 @@
 import { stdin as input, stdout as output } from "node:process";
-import { mkdirSync } from "node:fs";
 import { randomUUID } from "node:crypto";
-import { openDatabase } from "../db/index.js";
+import { StringDecoder } from "node:string_decoder";
+import { openDatabase, openDatabaseReadOnly } from "../db/index.js";
 import { acquireInstanceLock, loadConfig, prepareDataDirectories } from "../config.js";
 import { hashPassword, normalizeUsername, validateNewPassword, temporaryPassword } from "../security.js";
 import { writeAudit } from "../audit.js";
@@ -11,42 +11,120 @@ function arg(name: string): string | undefined {
   return index >= 0 ? process.argv[index + 1] : undefined;
 }
 
+// A terminal paste can contain more than one line. Keep the unread tail for
+// the next prompt instead of silently discarding credentials after the first
+// newline.
+let pendingInput = "";
+let pendingSkipLf = false;
+
 async function readSecret(prompt: string): Promise<string> {
   if (!input.isTTY) throw new Error("admin:init 需要交互式 TTY，不能通过管道传入密码");
   output.write(prompt);
   return await new Promise<string>((resolve, reject) => {
     let value = "";
+    let escapeSequence = false;
+    let cleaned = false;
+    const decoder = new StringDecoder("utf8");
     const wasRaw = Boolean(input.isRaw);
-    const onData = (chunk: Buffer) => {
-      const text = chunk.toString("utf8");
-      if (text === "\u0003") {
-        cleanup();
-        reject(new Error("已取消"));
-      } else if (text === "\r" || text === "\n") {
-        cleanup();
-        output.write("\n");
-        resolve(value);
-      } else if (text === "\u007f") {
-        value = value.slice(0, -1);
-      } else if (!text.includes("\u001b")) {
-        value += text;
-      }
-    };
+    const initialInput = pendingInput;
+    pendingInput = "";
+    let onData: (chunk: Buffer | string) => void;
+    let onSignal: () => void;
     const cleanup = () => {
+      if (cleaned) return;
+      cleaned = true;
       input.off("data", onData);
+      input.off("error", onInputError);
+      process.off("SIGINT", onSignal);
+      process.off("SIGTERM", onSignal);
       input.setRawMode?.(wasRaw);
       input.pause();
     };
+    const finish = (error?: Error) => {
+      cleanup();
+      if (error) reject(error);
+      else {
+        output.write("\n");
+        resolve(value);
+      }
+    };
+    const onInputError = (error: Error) => finish(error);
+    onSignal = () => finish(new Error("已取消"));
+    const consume = (text: string) => {
+      let offset = 0;
+      for (const character of text) {
+        offset += character.length;
+        if (pendingSkipLf) {
+          if (character === "\n") {
+            pendingSkipLf = false;
+            continue;
+          }
+          pendingSkipLf = false;
+        }
+        if (character === "\u0003") {
+          finish(new Error("已取消"));
+          return;
+        }
+        if (escapeSequence) {
+          if (/[A-Za-z~]/.test(character)) escapeSequence = false;
+          continue;
+        }
+        if (character === "\u001b") {
+          escapeSequence = true;
+        } else if (character === "\r" || character === "\n") {
+          const tail = text.slice(offset);
+          pendingInput = tail.startsWith("\n") && character === "\r" ? tail.slice(1) : tail;
+          pendingSkipLf = character === "\r" && !tail.startsWith("\n");
+          finish();
+          return;
+        } else if (character === "\u007f" || character === "\b") {
+          value = value.slice(0, -1);
+        } else {
+          value += character;
+        }
+      }
+    };
+    onData = (chunk) => {
+      consume(typeof chunk === "string" ? chunk : decoder.write(chunk));
+    };
     input.resume();
     input.setRawMode?.(true);
+    process.once("SIGINT", onSignal);
+    process.once("SIGTERM", onSignal);
+    input.once("error", onInputError);
     input.on("data", onData);
+    if (initialInput) consume(initialInput);
   });
 }
 
 async function main() {
   const config = loadConfig();
+  const checkOnly = process.argv.includes("--check");
+  if (checkOnly) {
+    let database;
+    try {
+      database = openDatabaseReadOnly(config);
+    } catch (error) {
+      if (error && typeof error === "object" && "code" in error && (error as NodeJS.ErrnoException).code === "ENOENT") {
+        console.log("empty");
+        return;
+      }
+      throw error;
+    }
+    try {
+      const hasAdminsTable = database.sqlite
+        .prepare("SELECT 1 AS present FROM sqlite_master WHERE type = 'table' AND name = 'admins'")
+        .get();
+      const existing = hasAdminsTable
+        ? database.sqlite.prepare("SELECT COUNT(*) AS count FROM admins").get() as { count: number }
+        : { count: 0 };
+      console.log(existing.count > 0 ? "initialized" : "empty");
+    } finally {
+      database.sqlite.close();
+    }
+    return;
+  }
   prepareDataDirectories(config);
-  mkdirSync(config.dataDir, { recursive: true, mode: 0o700 });
   const release = acquireInstanceLock(config);
   const database = openDatabase(config);
   try {
@@ -64,6 +142,9 @@ async function main() {
     if (policyError) throw new Error(policyError);
     const normalized = normalizeUsername(username);
     if ([...normalized].length < 3) throw new Error("用户名至少需要 3 个字符");
+    if ([...normalized].length > 64) throw new Error("用户名最多 64 个字符");
+    const normalizedDisplayName = displayName.normalize("NFKC").trim();
+    if ([...normalizedDisplayName].length < 1 || [...normalizedDisplayName].length > 80) throw new Error("显示名称必须为 1-80 个字符");
     const passwordHash = await hashPassword(password);
     const id = randomUUID();
     const now = Date.now();
@@ -74,14 +155,14 @@ async function main() {
         INSERT INTO admins(id, username, username_norm, display_name, password_hash, status,
           must_change_password, auth_version, version, created_at)
         VALUES (?, ?, ?, ?, ?, 'active', 1, 1, 1, ?)
-      `).run(id, username.normalize("NFKC").trim(), normalized, displayName.trim(), passwordHash, now);
+      `).run(id, username.normalize("NFKC").trim(), normalized, normalizedDisplayName, passwordHash, now);
       writeAudit(database.sqlite, {
         requestId: `cli:${randomUUID()}`,
         actorUsername: "cli",
         action: "admin.initialized",
         targetType: "admin",
         targetId: id,
-        after: { username: normalized, displayName: displayName.trim(), status: "active" },
+        after: { username: normalized, displayName: normalizedDisplayName, status: "active" },
       });
     })();
     console.log(generate ? `已创建首位管理员。一次性密码：${password}` : "已创建首位管理员。");

server/cli/update.ts

@@ -26,7 +26,7 @@ import {
   type ReleaseMetadata,
   type UrlPolicy,
 } from "../update.js";
-import { attachSidecarHash } from "../update-service.js";
+import { ACTIVE_UPDATE_STATUSES, attachSidecarHash } from "../update-service.js";
 import type { UpdateJobStatus } from "../../shared/contracts.js";
 
 const updateRequestFileSchema = z.object({
@@ -153,7 +153,7 @@ function writeJob(sqlite: Database.Database | undefined, jobId: string, values:
       operation, status, version, platform, release_url, asset_name, asset_url,
       expected_sha256, actual_sha256, download_path, backup_path, size_bytes, error_message,
       created_at, updated_at, completed_at)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     ON CONFLICT(id) DO UPDATE SET
       admin_id=COALESCE(excluded.admin_id, update_jobs.admin_id),
       session_hash=COALESCE(excluded.session_hash, update_jobs.session_hash),
@@ -291,7 +291,24 @@ export async function runUpdate(options: UpdateRunOptions): Promise<UpdateRunRes
     const archivePath = path.join(workspace, resolved.asset.name.endsWith(".gz") || resolved.asset.name.endsWith(".zip") ? resolved.asset.name : `${resolved.asset.name}.tar.gz`);
     try {
       updateJob(options.sqlite, jobId, { operation, status: "downloading", version: resolved.version, platform: platform.target, releaseUrl: resolved.releaseUrl, assetName: resolved.asset.name, assetUrl: resolved.asset.url, expectedSha256, downloadPath: path.basename(archivePath), startedAt: Date.now() });
-      const downloaded = await downloadReleaseAsset(resolved.asset.url, archivePath, options);
+      const progressStartedAt = Date.now();
+      let lastProgressWrite = 0;
+      const downloaded = await downloadReleaseAsset(resolved.asset.url, archivePath, {
+        ...options,
+        onProgress: (downloadedBytes, totalBytes) => {
+          const now = Date.now();
+          if (!options.sqlite || now - lastProgressWrite < 250) return;
+          lastProgressWrite = now;
+          const elapsed = Math.max(1, now - progressStartedAt);
+          const speedBps = Math.round(downloadedBytes * 1000 / elapsed);
+          options.sqlite.prepare("UPDATE update_jobs SET downloaded_bytes=?, size_bytes=COALESCE(?, size_bytes), download_started_at=?, download_speed_bps=?, updated_at=? WHERE id=? AND status='downloading'").run(downloadedBytes, totalBytes, progressStartedAt, speedBps, now, jobId);
+        },
+      });
+      if (options.sqlite) {
+        const finishedAt = Date.now();
+        const elapsed = Math.max(1, finishedAt - progressStartedAt);
+        options.sqlite.prepare("UPDATE update_jobs SET downloaded_bytes=?, size_bytes=?, download_started_at=?, download_speed_bps=?, updated_at=? WHERE id=? AND status='downloading'").run(downloaded.size, downloaded.size, progressStartedAt, Math.round(downloaded.size * 1000 / elapsed), finishedAt, jobId);
+      }
       if (expectedSha256 && downloaded.sha256 !== expectedSha256) throw new Error("更新文件 SHA-256 校验失败");
       updateJob(options.sqlite, jobId, { operation, status: "verifying", version: resolved.version, platform: platform.target, releaseUrl: resolved.releaseUrl, assetName: resolved.asset.name, assetUrl: resolved.asset.url, expectedSha256, actualSha256: downloaded.sha256, sizeBytes: downloaded.size, downloadPath: path.basename(archivePath) });
       if (!archivePath.endsWith(".tar.gz") && !archivePath.endsWith(".tgz") && !archivePath.endsWith(".tar") && !archivePath.endsWith(".zip")) throw new Error("更新文件格式仅支持 tar.gz、tar 或 zip");
@@ -355,7 +372,9 @@ export function finalizeUpdateJob(
     FROM update_jobs WHERE id=?
   `).get(jobId) as { id: string; status: UpdateJobStatus; version: string; platform: string; adminId: string | null; requestId: string | null; sessionHash: string | null } | undefined;
   if (!row) throw new Error("更新任务不存在");
-  if (row.status !== "applying" && row.status !== "completed" && row.status !== "failed") throw new Error("更新任务状态不允许完成");
+  const canComplete = row.status === "applying" || row.status === "completed";
+  const canFail = ACTIVE_UPDATE_STATUSES.includes(row.status) || row.status === "completed" || row.status === "failed";
+  if (status === "completed" ? !canComplete : !canFail) throw new Error("更新任务状态不允许完成");
   const now = Date.now();
   const safeFailureMessage = status === "failed" ? "新版本健康检查失败，已恢复上一版本" : null;
   sqlite.transaction(() => {
@@ -477,27 +496,34 @@ export async function main(config: AppConfig = loadConfig()): Promise<void> {
   const database = openDatabase(config);
   try {
     if (request?.operation === "apply") {
-      const staged = database.sqlite.prepare("SELECT download_path AS downloadPath, version FROM update_jobs WHERE id=? AND status='staged' AND operation='apply'").get(request.jobId) as { downloadPath: string | null; version: string } | undefined;
-      if (!staged?.downloadPath || staged.version !== request.version) throw new Error("更新暂存任务无效");
-      const root = path.resolve(config.updateWorkspaceDir);
-      const candidate = await validateStagedWorkspacePath(staged.downloadPath, root);
-      await applyStagedUpdate({
-        sqlite: database.sqlite,
-        jobId: request.jobId,
-        version: request.version,
-        stagedPath: candidate,
-        currentDir,
-        currentLink: request.currentLink,
-        releasesDir: request.releasesDir,
-        workspaceRoot: root,
-        ...(backupArchive ? { backupArchivePath: backupArchive } : {}),
-        ...(dataBackupArchive ? { dataBackupArchivePath: dataBackupArchive } : {}),
-        dataBackupSource: config.dataDir,
-        maxBytes: config.updateMaxBytes,
-        dataBackupMaxBytes: config.maxTotalBytes,
-      });
-      console.log(`更新已切换：${request.version}`);
-      return;
+      const staged = database.sqlite.prepare("SELECT status, operation, download_path AS downloadPath, version FROM update_jobs WHERE id=?").get(request.jobId) as { status: UpdateJobStatus; operation: "download" | "apply"; downloadPath: string | null; version: string } | undefined;
+      if (staged?.status === "staged" && staged.operation === "apply") {
+        if (!staged.downloadPath || staged.version !== request.version) throw new Error("更新暂存任务无效");
+        const root = path.resolve(config.updateWorkspaceDir);
+        const candidate = await validateStagedWorkspacePath(staged.downloadPath, root);
+        await applyStagedUpdate({
+          sqlite: database.sqlite,
+          jobId: request.jobId,
+          version: request.version,
+          stagedPath: candidate,
+          currentDir,
+          currentLink: request.currentLink,
+          releasesDir: request.releasesDir,
+          workspaceRoot: root,
+          ...(backupArchive ? { backupArchivePath: backupArchive } : {}),
+          ...(dataBackupArchive ? { dataBackupArchivePath: dataBackupArchive } : {}),
+          dataBackupSource: config.dataDir,
+          maxBytes: config.updateMaxBytes,
+          dataBackupMaxBytes: config.maxTotalBytes,
+        });
+        console.log(`更新已切换：${request.version}`);
+        return;
+      }
+      if (staged && !(staged.status === "queued" && staged.operation === "apply")) throw new Error("更新任务状态无效");
+      // A direct one-click request starts in queued/apply. Older clients do
+      // not have a separate download step, so fall through to runUpdate,
+      // which downloads, verifies, backs up, and switches the release in one
+      // transaction. A staged request still takes the branch above.
     }
     const result = await runUpdate({
       ...(effectiveMetadataUrl ? { metadataUrl: effectiveMetadataUrl } : {}),

server/db/index.ts

@@ -1,6 +1,6 @@
 import Database from "better-sqlite3";
 import { drizzle, type BetterSQLite3Database } from "drizzle-orm/better-sqlite3";
-import { readdirSync, readFileSync } from "node:fs";
+import { lstatSync, readdirSync, readFileSync } from "node:fs";
 import { chmodSync, existsSync } from "node:fs";
 import path from "node:path";
 import type { AppConfig } from "../config.js";
@@ -44,3 +44,24 @@ export function openDatabase(config: AppConfig): DatabaseContext {
   if (foreignKeys !== 1) throw new Error("SQLite 外键未启用");
   return { sqlite, db: drizzle(sqlite, { schema }) };
 }
+
+/**
+ * Open an existing database without creating directories, changing journal
+ * mode, running migrations, or changing file permissions. This is used by
+ * administrative status checks that must be side-effect free.
+ */
+export function openDatabaseReadOnly(config: AppConfig): DatabaseContext {
+  const info = lstatSync(config.dbPath);
+  if (!info.isFile() || info.isSymbolicLink()) throw new Error(`数据库文件不是安全的普通文件：${config.dbPath}`);
+  const sqlite = new Database(config.dbPath, { readonly: true, fileMustExist: true });
+  sqlite.pragma("foreign_keys = ON");
+  sqlite.pragma("busy_timeout = 5000");
+  sqlite.pragma("temp_store = MEMORY");
+  sqlite.pragma("query_only = ON");
+  const foreignKeys = sqlite.pragma("foreign_keys", { simple: true });
+  if (foreignKeys !== 1) {
+    sqlite.close();
+    throw new Error("SQLite 外键未启用");
+  }
+  return { sqlite, db: drizzle(sqlite, { schema }) };
+}

server/db/schema.ts

@@ -148,6 +148,9 @@ export const updateJobs = sqliteTable("update_jobs", {
   downloadPath: text("download_path"),
   backupPath: text("backup_path"),
   sizeBytes: integer("size_bytes"),
+  downloadedBytes: integer("downloaded_bytes"),
+  downloadStartedAt: integer("download_started_at"),
+  downloadSpeedBps: integer("download_speed_bps"),
   errorMessage: text("error_message"),
   createdAt: integer("created_at").notNull(),
   requestedAt: integer("requested_at"),

server/index.ts

@@ -3,6 +3,7 @@ import { loadConfig, prepareDataDirectories, acquireInstanceLock } from "./confi
 import { openDatabase } from "./db/index.js";
 import { buildApp } from "./app.js";
 import { cleanupOrphanedExports, expireExports, resumeExports } from "./exporter.js";
+import { reconcileOrphanedUpdateJobs } from "./update-service.js";
 
 const config = loadConfig();
 prepareDataDirectories(config);
@@ -18,6 +19,7 @@ async function start() {
   await expireExports(database.sqlite, config);
   await cleanupOrphanedExports(database.sqlite, config);
   await resumeExports(database.sqlite, config);
+  reconcileOrphanedUpdateJobs(database.sqlite, config);
   const app = await buildApp(database, config);
   const janitor = setInterval(() => {
     void cleanupStaging(config);
@@ -27,6 +29,7 @@ async function start() {
     void processFileDeletions(database.sqlite, config);
     void expireExports(database.sqlite, config);
     void cleanupOrphanedExports(database.sqlite, config);
+    reconcileOrphanedUpdateJobs(database.sqlite, config);
   }, 60_000);
   const shutdown = async () => {
     clearInterval(janitor);

server/update-service.ts

@@ -1,7 +1,9 @@
+import { lstatSync, realpathSync, readFileSync, unlinkSync } from "node:fs";
 import { chmod, mkdir, rename, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { createPublicKey, randomUUID, verify as verifySignature } from "node:crypto";
 import type Database from "better-sqlite3";
+import { writeAudit } from "./audit.js";
 import { AppError } from "./errors.js";
 import type { AppConfig } from "./config.js";
 import {
@@ -30,6 +32,12 @@ export const ACTIVE_UPDATE_STATUSES: readonly UpdateJobStatus[] = [
   "applying",
 ];
 
+// A queued job normally starts within seconds and an applying job completes
+// after the service health check. The runner refreshes its recovery marker as
+// a lease while doing long downloads/backups; only an expired lease permits
+// the server to reclaim an active row.
+export const ORPHANED_UPDATE_TIMEOUT_MS = 5 * 60 * 1000;
+
 export type CachedRelease = {
   checkedAt: number;
   metadataUrl: string;
@@ -343,6 +351,9 @@ export function publicUpdateJob(row: Record<string, unknown> | undefined): Recor
     platform: row.platform,
     assetName: row.assetName ?? null,
     sizeBytes: row.sizeBytes ?? null,
+    downloadedBytes: row.downloadedBytes ?? null,
+    downloadStartedAt: row.downloadStartedAt ?? null,
+    downloadSpeedBps: row.downloadSpeedBps ?? null,
     // Do not expose filesystem paths, command output, or upstream response
     // text through the authenticated status endpoint. Detailed diagnostics
     // remain in the server journal for operators.
@@ -355,3 +366,157 @@ export function publicUpdateJob(row: Record<string, unknown> | undefined): Recor
     ...(row.status === "applying" ? { restartWindowSeconds: 30 } : {}),
   };
 }
+
+function markerMtime(filePath: string): number | null {
+  try {
+    const info = lstatSync(filePath);
+    return info.isFile() ? info.mtimeMs : null;
+  } catch {
+    return null;
+  }
+}
+
+function removeExpiredRequest(filePath: string, now: number): void {
+  try {
+    const info = lstatSync(filePath);
+    if (!info.isFile() && !info.isSymbolicLink()) return;
+    if (now - info.mtimeMs < ORPHANED_UPDATE_TIMEOUT_MS) return;
+    unlinkSync(filePath);
+  } catch {
+    // The root runner may own the marker during a recovery race. The DB
+    // transition below is still enough to release the browser queue.
+  }
+}
+
+function requestJobId(filePath: string): string | null {
+  try {
+    const info = lstatSync(filePath);
+    if (!info.isFile() || info.isSymbolicLink()) return null;
+    const value = JSON.parse(readFileSync(filePath, "utf8")) as { jobId?: unknown };
+    return typeof value.jobId === "string" && /^[0-9a-f-]{36}$/.test(value.jobId) ? value.jobId : null;
+  } catch {
+    return null;
+  }
+}
+
+function currentReleaseVersion(config: AppConfig): string | null {
+  try {
+    const target = realpathSync(config.currentLink);
+    const releases = realpathSync(config.releasesDir);
+    if (!target.startsWith(`${releases}${path.sep}`)) return null;
+    return path.basename(target);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Release an update row left behind after its privileged runner lease expired.
+ * This is deliberately conservative: staged downloads remain available for an
+ * explicit apply, and a fresh request/state marker means the runner still owns
+ * recovery.
+ */
+export function reconcileOrphanedUpdateJobs(database: Database.Database, config: AppConfig, now = Date.now()): number {
+  const placeholders = ACTIVE_UPDATE_STATUSES.map(() => "?").join(",");
+  const rows = database.prepare(`
+    SELECT id, status, operation, version, admin_id AS adminId, request_id AS requestId,
+      updated_at AS updatedAt
+    FROM update_jobs
+    WHERE status IN (${placeholders})
+    ORDER BY updated_at ASC
+  `).all(...ACTIVE_UPDATE_STATUSES) as Array<{ id: string; status: UpdateJobStatus; operation: "download" | "apply"; version: string; adminId: string | null; requestId: string | null; updatedAt: number | null }>;
+  if (rows.length === 0) return 0;
+  const statePath = path.join(config.installPrefix, ".update-state");
+  const requestMtime = markerMtime(config.updateRequestPath);
+  const stateMtime = markerMtime(statePath);
+  const requestPresent = requestMtime !== null;
+  const statePresent = stateMtime !== null;
+  const requestFresh = requestPresent && now - (requestMtime ?? 0) < ORPHANED_UPDATE_TIMEOUT_MS;
+  const stateFresh = statePresent && now - (stateMtime ?? 0) < ORPHANED_UPDATE_TIMEOUT_MS;
+  // A staged download is normally kept for an explicit apply. The one
+  // exception is the hand-off window where the API has already changed the
+  // operation to `apply` but crashed before writing the request file. That
+  // row is still safe to retry and must not block the queue forever.
+  const releaseVersion = currentReleaseVersion(config);
+  let reconciled = 0;
+  const reconciledIds = new Set<string>();
+  for (const row of rows) {
+    if (typeof row.updatedAt !== "number" || now - row.updatedAt < ORPHANED_UPDATE_TIMEOUT_MS) continue;
+    // The runner refreshes the state marker while a download is in flight.
+    // A stale request/state marker therefore no longer protects an orphaned
+    // row forever, while a fresh marker remains owned by the runner.
+    if (row.status === "staged") {
+      if (row.operation !== "apply" || requestFresh || stateFresh) continue;
+      const changed = database.transaction(() => {
+        const result = database.prepare(`
+          UPDATE update_jobs
+          SET operation='download', error_message=NULL, updated_at=?
+          WHERE id=? AND status='staged' AND operation='apply' AND updated_at=?
+        `).run(now, row.id, row.updatedAt);
+        if (result.changes !== 1) return false;
+        writeAudit(database, {
+          requestId: row.requestId || randomUUID(),
+          actorAdminId: row.adminId,
+          action: "update.reconciled",
+          targetType: "update",
+          targetId: row.id,
+          outcome: "success",
+          before: { status: row.status, operation: row.operation, version: row.version },
+          after: { status: "staged", operation: "download", version: row.version, reason: "apply_request_missing" },
+        });
+        return true;
+      })();
+      if (changed) {
+        reconciled += 1;
+        reconciledIds.add(row.id);
+      }
+      continue;
+    }
+    if (requestFresh || stateFresh) continue;
+    const status: "completed" | "failed" = row.status === "applying" && releaseVersion === row.version ? "completed" : "failed";
+    const errorMessage = status === "failed" ? "更新任务超时，已释放更新队列" : null;
+    const changed = database.transaction(() => {
+      const result = database.prepare(`
+        UPDATE update_jobs
+        SET status=?, error_message=?, completed_at=?, updated_at=?
+        WHERE id=? AND status=? AND updated_at=?
+      `).run(status, errorMessage, now, now, row.id, row.status, row.updatedAt);
+      if (result.changes !== 1) return false;
+      writeAudit(database, {
+        requestId: row.requestId || randomUUID(),
+        actorAdminId: row.adminId,
+        action: "update.reconciled",
+        targetType: "update",
+        targetId: row.id,
+        outcome: status === "completed" ? "success" : "failure",
+        before: { status: row.status, version: row.version },
+        after: { status, version: row.version, reason: "orphaned_timeout" },
+      });
+      return true;
+    })();
+    if (changed) {
+      reconciled += 1;
+      reconciledIds.add(row.id);
+    }
+  }
+  // Prevent a stale request from being replayed after its DB row has been
+  // marked failed. The path is fixed by the server configuration and the
+  // operation is safe even when a root runner is racing with this call.
+  // A download runner refreshes the state marker while it is still using the
+  // request. Keep the request until that lease also expires; otherwise a
+  // long download can lose its job id and fail to finalize its row.
+  const queuedRequestId = requestPresent ? requestJobId(config.updateRequestPath) : null;
+  const queuedRequest = queuedRequestId ? rows.find((row) => row.id === queuedRequestId) : undefined;
+  const requestStillNeeded = Boolean(
+    queuedRequest
+      && ACTIVE_UPDATE_STATUSES.includes(queuedRequest.status)
+      && !reconciledIds.has(queuedRequest.id)
+      && !(queuedRequest.status === "staged" && queuedRequest.operation === "download"),
+  );
+  if (!stateFresh
+    && (!requestPresent || (requestMtime !== null && now - requestMtime >= ORPHANED_UPDATE_TIMEOUT_MS))
+    && !requestStillNeeded) {
+    removeExpiredRequest(config.updateRequestPath, now);
+  }
+  return reconciled;
+}

server/update.ts

@@ -423,7 +423,7 @@ export async function verifySha256(filePath: string, expected: string): Promise<
 export async function downloadReleaseAsset(
   url: string | URL,
   destination: string,
-  options: UrlPolicy & { fetchImpl?: typeof fetch | undefined; maxBytes?: number | undefined } = {},
+  options: UrlPolicy & { fetchImpl?: typeof fetch | undefined; maxBytes?: number | undefined; onProgress?: ((downloadedBytes: number, totalBytes: number | null) => void) | undefined } = {},
 ): Promise<{ size: number; sha256: string }> {
   const fetchImpl = options.fetchImpl ?? fetch;
   let current = validateHttpsUrl(url, options);
@@ -446,6 +446,7 @@ export async function downloadReleaseAsset(
   }
   if (response.status < 200 || response.status >= 300 || !response.body) throw new Error("更新文件下载失败");
   const declared = Number(response.headers.get("content-length") ?? 0);
+  const totalBytes = Number.isSafeInteger(declared) && declared > 0 ? declared : null;
   const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
   if (declared > maxBytes) throw new Error("更新文件超过大小限制");
   await mkdir(path.dirname(destination), { recursive: true, mode: 0o700 });
@@ -454,6 +455,7 @@ export async function downloadReleaseAsset(
   const hash = createHash("sha256");
   const meter = new Transform({ transform(chunk: Buffer, _encoding, callback) {
     size += chunk.length;
+    options.onProgress?.(size, totalBytes);
     if (size > maxBytes) return callback(new Error("更新文件超过大小限制"));
     hash.update(chunk);
     callback(null, chunk);

systemd/tallynote-update.path

@@ -4,6 +4,15 @@ Description=Watch for TallyNote release update requests
 [Path]
 PathExists=/var/lib/tallynote/update-request.json
 PathChanged=/var/lib/tallynote/update-request.json
+# The recovery marker lives beside the release link. Watching it as well
+# allows systemd to resume reconciliation when the runner is interrupted
+# after consuming the request but before clearing its state file.
+PathExists=/opt/tallynote/.update-state
+PathChanged=/opt/tallynote/.update-state
+# Keep a directory-level fallback because some systemd/inotify versions skip
+# dotfiles when watching an individual path. State writes are atomic renames,
+# so the containing directory changes even when the marker itself is hidden.
+PathChanged=/opt/tallynote
 Unit=tallynote-update.service
 
 [Install]

systemd/tallynote-update.service

@@ -2,7 +2,6 @@
 Description=TallyNote privileged release updater
 After=network-online.target
 Wants=network-online.target
-ConditionPathExists=/var/lib/tallynote/update-request.json
 
 [Service]
 Type=oneshot
@@ -12,6 +11,10 @@ WorkingDirectory=/opt/tallynote/current
 EnvironmentFile=-/etc/tallynote/tallynote.env
 ExecStart=/usr/local/libexec/tallynote-update-runner
 Environment=PATH=/usr/sbin:/usr/bin:/sbin:/bin
+# Downloads, archive validation and data backups can exceed systemd's 90s
+# default start timeout on a slower server. Keep one update job alive long
+# enough to finish or reach its own health-check/recovery path.
+TimeoutStartSec=30min
 NoNewPrivileges=true
 CapabilityBoundingSet=
 AmbientCapabilities=

systemd/tallynote.service

@@ -14,6 +14,8 @@ Environment=PATH=/opt/tallynote/current/runtime/bin:/usr/sbin:/usr/bin:/sbin:/bi
 ExecStart=/opt/tallynote/current/bin/tallynote
 Restart=on-failure
 RestartSec=5s
+# Do not let a wedged Node process hold an update stop forever.
+TimeoutStopSec=30s
 NoNewPrivileges=true
 PrivateTmp=true
 ProtectSystem=strict

tests/admin-init.test.ts

@@ -0,0 +1,111 @@
+import { describe, expect, it } from "vitest";
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import Database from "better-sqlite3";
+
+const root = path.resolve(process.cwd());
+const cli = path.join(root, "server", "cli", "admin-init.ts");
+const tsx = path.join(root, "node_modules", "tsx", "dist", "cli.mjs");
+
+function runAdmin(dataDir: string, args: string[]) {
+  return spawnSync(process.execPath, [tsx, cli, ...args], {
+    cwd: root,
+    env: {
+      ...process.env,
+      NODE_ENV: "test",
+      TALLYNOTE_DATA_DIR: dataDir,
+      TALLYNOTE_PUBLIC_ORIGIN: "http://127.0.0.1:3999",
+      TALLYNOTE_COOKIE_SECURE: "false",
+      TALLYNOTE_UPDATE_STRATEGY: "disabled",
+    },
+    encoding: "utf8",
+  });
+}
+
+describe("生产管理员初始化 CLI", () => {
+  it("--check 是只读的，空数据目录不会被创建", () => {
+    const parent = mkdtempSync(path.join(tmpdir(), "tallynote-admin-check-"));
+    const dataDir = path.join(parent, "data");
+    try {
+      const result = runAdmin(dataDir, ["--check"]);
+      expect(result.status).toBe(0);
+      expect(result.stdout.trim()).toBe("empty");
+      expect(existsSync(dataDir)).toBe(false);
+      expect(existsSync(path.join(dataDir, "tallynote.db"))).toBe(false);
+    } finally {
+      rmSync(parent, { recursive: true, force: true });
+    }
+  });
+
+  it("--check 不会执行迁移或创建 schema_migrations", () => {
+    const dataDir = mkdtempSync(path.join(tmpdir(), "tallynote-admin-check-"));
+    const database = new Database(path.join(dataDir, "tallynote.db"));
+    database.exec("CREATE TABLE admins (id TEXT PRIMARY KEY)");
+    database.close();
+    try {
+      const result = runAdmin(dataDir, ["--check"]);
+      expect(result.status).toBe(0);
+      expect(result.stdout.trim()).toBe("empty");
+      const verify = new Database(path.join(dataDir, "tallynote.db"), { readonly: true });
+      const schemaMigrations = verify
+        .prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'schema_migrations'")
+        .get();
+      expect(schemaMigrations).toBeUndefined();
+      verify.close();
+    } finally {
+      rmSync(dataDir, { recursive: true, force: true });
+    }
+  });
+
+  it("只允许初始化首位管理员，并写入一次性密码和审计记录", () => {
+    const dataDir = mkdtempSync(path.join(tmpdir(), "tallynote-admin-init-"));
+    try {
+      const first = runAdmin(dataDir, ["--username", "admin", "--display-name", "管理员", "--generate"]);
+      expect(first.status).toBe(0);
+      expect(first.stdout).toMatch(/已创建首位管理员。一次性密码：\S+/);
+
+      const database = new Database(path.join(dataDir, "tallynote.db"));
+      const admin = database.prepare("SELECT username, display_name, must_change_password FROM admins").get() as { username: string; display_name: string; must_change_password: number };
+      const audit = database.prepare("SELECT action, actor_username FROM audit_events ORDER BY occurred_at DESC LIMIT 1").get() as { action: string; actor_username: string };
+      expect(admin).toEqual({ username: "admin", display_name: "管理员", must_change_password: 1 });
+      expect(audit).toEqual({ action: "admin.initialized", actor_username: "cli" });
+      database.close();
+
+      const check = runAdmin(dataDir, ["--check"]);
+      expect(check.status).toBe(0);
+      expect(check.stdout.trim()).toBe("initialized");
+
+      const second = runAdmin(dataDir, ["--username", "other", "--display-name", "其他", "--generate"]);
+      expect(second.status).not.toBe(0);
+      expect(`${second.stdout}${second.stderr}`).toContain("INITIAL_ADMIN_EXISTS");
+    } finally {
+      rmSync(dataDir, { recursive: true, force: true });
+    }
+  }, 15_000);
+
+  it("密码输入不是 TTY 时明确拒绝通过管道传入", () => {
+    const dataDir = mkdtempSync(path.join(tmpdir(), "tallynote-admin-init-"));
+    try {
+      const result = spawnSync(process.execPath, [tsx, cli], {
+        cwd: root,
+        input: "admin\n管理员\npassword-password\npassword-password\n",
+        env: {
+          ...process.env,
+          NODE_ENV: "test",
+          TALLYNOTE_DATA_DIR: dataDir,
+          TALLYNOTE_PUBLIC_ORIGIN: "http://127.0.0.1:3999",
+          TALLYNOTE_COOKIE_SECURE: "false",
+          TALLYNOTE_UPDATE_STRATEGY: "disabled",
+        },
+        encoding: "utf8",
+      });
+      expect(result.status).not.toBe(0);
+      expect(`${result.stdout}${result.stderr}`).toContain("交互式 TTY");
+      expect(readFileSync(path.join(dataDir, "tallynote.db"))).toBeTruthy();
+    } finally {
+      rmSync(dataDir, { recursive: true, force: true });
+    }
+  });
+});

tests/api.test.ts

@@ -87,10 +87,52 @@ describe("TallyNote API", () => {
     expect(missing.json().error.requestId).toBeTruthy();
   });
 
-  it("拒绝没有 Origin 的写请求", async () => {
+  it("显式允许的公网 HTTP 不会把静态资源升级到 HTTPS", async () => {
+    const publicHttpConfig = {
+      ...config,
+      publicOrigin: "http://192.0.2.10:3999",
+      isLocalOrigin: false,
+      allowInsecureHttp: true,
+      cookieSecure: false,
+    };
+    const publicHttpApp = await buildApp(database, publicHttpConfig);
+    try {
+      const response = await publicHttpApp.inject({ method: "GET", url: "/health" });
+      expect(response.statusCode).toBe(200);
+      expect(response.headers["content-security-policy"]).not.toContain("upgrade-insecure-requests");
+      expect(response.headers["strict-transport-security"]).toBeUndefined();
+      expect(response.headers["cross-origin-opener-policy"]).toBeUndefined();
+      expect(response.headers["origin-agent-cluster"]).toBeUndefined();
+    } finally {
+      await publicHttpApp.close();
+    }
+  });
+
+  it("HTTPS 仍保留传输安全响应头", async () => {
+    const secureConfig = {
+      ...config,
+      publicOrigin: "https://example.test:3999",
+      isLocalOrigin: false,
+      allowInsecureHttp: false,
+      cookieSecure: true,
+    };
+    const secureApp = await buildApp(database, secureConfig);
+    try {
+      const response = await secureApp.inject({ method: "GET", url: "/health" });
+      expect(response.statusCode).toBe(200);
+      expect(response.headers["content-security-policy"]).toContain("upgrade-insecure-requests");
+      expect(response.headers["strict-transport-security"]).toContain("max-age=");
+      expect(response.headers["cross-origin-opener-policy"]).toBe("same-origin");
+      expect(response.headers["origin-agent-cluster"]).toBe("?1");
+    } finally {
+      await secureApp.close();
+    }
+  });
+
+  it("反向代理缺少 Origin 时仍允许登录请求进入认证流程", async () => {
     const response = await app.inject({ method: "POST", url: "/api/auth/login", payload: { username: "x", password: "x" } });
-    expect(response.statusCode).toBe(403);
-    expect(response.json().error.code).toBe("ORIGIN_FORBIDDEN");
+    expect(response.statusCode).toBe(401);
+    expect(response.json().error.code).toBe("INVALID_CREDENTIALS");
   });
 
   it("将非法 JSON、伪造请求 ID 处理为结构化 400", async () => {

tests/migration.test.ts

@@ -42,9 +42,10 @@ describe("数据库迁移", () => {
         { name: "0002_update_jobs.sql" },
         { name: "0003_update_job_ownership.sql" },
         { name: "0004_update_download_apply.sql" },
+        { name: "0005_update_progress.sql" },
       ]);
       const updateColumns = migrated.sqlite.prepare("PRAGMA table_info(update_jobs)").all() as Array<{ name: string }>;
-      expect(updateColumns.map((column) => column.name)).toEqual(expect.arrayContaining(["admin_id", "session_hash", "request_id", "requested_at", "started_at", "operation"]));
+      expect(updateColumns.map((column) => column.name)).toEqual(expect.arrayContaining(["admin_id", "session_hash", "request_id", "requested_at", "started_at", "operation", "downloaded_bytes", "download_started_at", "download_speed_bps"]));
       expect(migrated.sqlite.prepare("SELECT note, invoice_missing_reason AS reason FROM expenses WHERE id='00000000-0000-4000-8000-000000000099'").get()).toEqual({ note: "旧账目", reason: null });
       migrated.sqlite.close();
       migrated = openDatabase(config);

tests/security.test.ts

@@ -48,6 +48,7 @@ describe("部署安全配置", () => {
     expect(loadConfig().trustProxy).toBe(1);
   });
 
+
   it("systemd 更新必须绑定主机白名单，签名校验默认关闭", () => {
     process.env.TALLYNOTE_UPDATE_STRATEGY = "systemd";
     process.env.TALLYNOTE_PUBLIC_ORIGIN = "https://example.test";

tests/update-api.test.ts

@@ -76,6 +76,12 @@ describe("更新 API", () => {
     expect(tooSoon.statusCode).toBe(429);
     expect(tooSoon.headers["retry-after"]).toBeDefined();
 
+    // Cooldown is scoped to the authenticated administrator, not the whole
+    // database or release endpoint.
+    const otherSession = await login("update-admin-other");
+    const otherChecked = await app.inject({ method: "POST", url: "/api/update/check", headers: { origin: config.publicOrigin, cookie: otherSession.cookies, "x-csrf-token": otherSession.csrf }, payload: {} });
+    expect(otherChecked.statusCode).toBe(200);
+
     const applied = await app.inject({ method: "POST", url: "/api/update/apply", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: { version: "1.2.0", confirm: true } });
     expect(applied.statusCode).toBe(202);
     const jobId = applied.json().job.id as string;
@@ -157,6 +163,12 @@ describe("更新 API", () => {
     globalThis.fetch = (async () => new Response("upstream unavailable", { status: 503 })) as typeof fetch;
     const response = await app.inject({ method: "POST", url: "/api/update/apply", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: { version: "1.2.0", confirm: true } });
     expect(response.statusCode).toBe(502);
+    // A failed upstream check must not reserve the per-admin cooldown; an
+    // operator can retry immediately after fixing the release endpoint.
+    const check = await app.inject({ method: "POST", url: "/api/update/check", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: {} });
+    expect(check.statusCode).toBe(502);
+    const retry = await app.inject({ method: "POST", url: "/api/update/check", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: {} });
+    expect(retry.statusCode).toBe(502);
     const audit = database.sqlite.prepare("SELECT outcome FROM audit_events WHERE action='update.apply_requested' ORDER BY id DESC LIMIT 1").get() as { outcome: string } | undefined;
     expect(audit?.outcome).toBe("failure");
   });

tests/update.test.ts

@@ -1,9 +1,9 @@
 import { afterEach, describe, expect, it } from "vitest";
-import { mkdir, readlink, symlink, writeFile, readFile, stat, readdir } from "node:fs/promises";
+import { mkdir, readlink, symlink, writeFile, readFile, stat, readdir, utimes } from "node:fs/promises";
 import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
-import { createHash, generateKeyPairSync, sign } from "node:crypto";
+import { createHash, generateKeyPairSync, randomUUID, sign } from "node:crypto";
 import {
   atomicSwitchRelease,
   createSafeArchive,
@@ -18,13 +18,13 @@ import {
   selectReleaseAsset,
   validateHttpsUrl,
 } from "../server/update.js";
-import { runUpdate } from "../server/cli/update.js";
+import { finalizeUpdateJob, runUpdate } from "../server/cli/update.js";
 import { validateUpdateRequest } from "../server/cli/update.js";
-import { checkForUpdate, verifyReleaseSignature } from "../server/update-service.js";
+import { checkForUpdate, ORPHANED_UPDATE_TIMEOUT_MS, reconcileOrphanedUpdateJobs, verifyReleaseSignature } from "../server/update-service.js";
 import { loadConfig, prepareDataDirectories } from "../server/config.js";
 import { openDatabase } from "../server/db/index.js";
 
-const envKeys = ["TALLYNOTE_DATA_DIR", "TALLYNOTE_PUBLIC_ORIGIN", "TALLYNOTE_COOKIE_SECURE", "TALLYNOTE_UPDATE_STRATEGY", "TALLYNOTE_UPDATE_METADATA_URL", "TALLYNOTE_UPDATE_ALLOWED_HOSTS", "TALLYNOTE_UPDATE_REQUIRE_SIGNATURE", "TALLYNOTE_UPDATE_PUBLIC_KEY"];
+const envKeys = ["TALLYNOTE_DATA_DIR", "TALLYNOTE_INSTALL_PREFIX", "TALLYNOTE_PUBLIC_ORIGIN", "TALLYNOTE_COOKIE_SECURE", "TALLYNOTE_UPDATE_STRATEGY", "TALLYNOTE_UPDATE_METADATA_URL", "TALLYNOTE_UPDATE_ALLOWED_HOSTS", "TALLYNOTE_UPDATE_REQUIRE_SIGNATURE", "TALLYNOTE_UPDATE_PUBLIC_KEY"];
 const originalFetch = globalThis.fetch;
 
 afterEach(() => {
@@ -207,6 +207,212 @@ describe("更新安全工具", () => {
     }
   });
 
+  it("更新器支持旧客户端创建的 queued/apply 直接更新请求", async () => {
+    const root = await mkdtemp(path.join(tmpdir(), "tallynote-update-direct-"));
+    const previousFetch = globalThis.fetch;
+    let database: ReturnType<typeof openDatabase> | undefined;
+    try {
+      const dataDir = path.join(root, "data");
+      const installPrefix = path.join(root, "install");
+      process.env.TALLYNOTE_DATA_DIR = dataDir;
+      process.env.TALLYNOTE_INSTALL_PREFIX = installPrefix;
+      process.env.TALLYNOTE_PUBLIC_ORIGIN = "http://127.0.0.1:3998";
+      process.env.TALLYNOTE_COOKIE_SECURE = "false";
+      process.env.TALLYNOTE_UPDATE_STRATEGY = "systemd";
+      process.env.TALLYNOTE_UPDATE_METADATA_URL = "https://updates.example/latest";
+      process.env.TALLYNOTE_UPDATE_ALLOWED_HOSTS = "updates.example";
+      process.env.TALLYNOTE_UPDATE_REQUIRE_SIGNATURE = "false";
+      const config = loadConfig();
+      prepareDataDirectories(config);
+      await mkdir(config.releasesDir, { recursive: true, mode: 0o755 });
+      const oldRelease = path.join(config.releasesDir, config.appVersion);
+      await mkdir(path.join(oldRelease, "dist"), { recursive: true, mode: 0o755 });
+      await writeFile(path.join(oldRelease, "dist", "marker"), "old");
+      await symlink(oldRelease, config.currentLink);
+
+      const source = path.join(root, "source");
+      await mkdir(path.join(source, "dist"), { recursive: true, mode: 0o755 });
+      await writeFile(path.join(source, "dist", "marker"), "new");
+      const archive = path.join(root, "release.tar.gz");
+      await createSafeArchive(source, archive);
+      const bytes = await readFile(archive);
+      const digest = createHash("sha256").update(bytes).digest("hex");
+      const jobId = randomUUID();
+      database = openDatabase(config);
+      const now = Date.now();
+      const assetName = `tallynote-1.2.0-${detectPlatform().target}.tar.gz`;
+      database.sqlite.prepare(`
+        INSERT INTO update_jobs(id, operation, status, version, platform, asset_url,
+          expected_sha256, created_at, updated_at, requested_at)
+        VALUES (?, 'apply', 'queued', '1.2.0', ?, ?, ?, ?, ?, ?)
+      `).run(jobId, detectPlatform().target, "https://updates.example/" + assetName, digest, now, now, now);
+      globalThis.fetch = (async (input: string | URL) => {
+        const url = input.toString();
+        if (url.endsWith("/latest")) return new Response(JSON.stringify({ tag_name: "v1.2.0", assets: [{ name: assetName, browser_download_url: `https://updates.example/${assetName}` }, { name: "SHA256SUMS", browser_download_url: "https://updates.example/SHA256SUMS" }] }));
+        if (url.endsWith("SHA256SUMS")) return new Response(`${digest}  ${assetName}\n`);
+        return new Response(bytes, { headers: { "content-length": String(bytes.length) } });
+      }) as typeof fetch;
+
+      await runUpdate({
+        metadataUrl: config.updateMetadataUrl,
+        version: "1.2.0",
+        currentVersion: config.appVersion,
+        currentDir: config.currentLink,
+        stagingDir: path.join(root, "staging"),
+        currentLink: config.currentLink,
+        releasesDir: config.releasesDir,
+        allowedHosts: config.updateAllowedHosts,
+        maxBytes: config.updateMaxBytes,
+        dataBackupMaxBytes: config.maxTotalBytes,
+        deferCompletion: true,
+        operation: "apply",
+        jobId,
+        sqlite: database.sqlite,
+        fetchImpl: globalThis.fetch,
+      });
+      expect(await readFile(path.join(config.currentLink, "dist", "marker"), "utf8")).toBe("new");
+      const row = database.sqlite.prepare("SELECT operation, status FROM update_jobs WHERE id=?").get(jobId);
+      expect(row).toEqual({ operation: "apply", status: "applying" });
+      finalizeUpdateJob(database.sqlite, jobId, "failed");
+      expect(database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(jobId)).toEqual({ status: "failed" });
+    } finally {
+      globalThis.fetch = previousFetch;
+      if (database) database.sqlite.close();
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it("在请求和恢复标记丢失后收敛孤儿任务，但保留 staged 下载", async () => {
+    const root = await mkdtemp(path.join(tmpdir(), "tallynote-update-reconcile-"));
+    let database: ReturnType<typeof openDatabase> | undefined;
+    try {
+      const dataDir = path.join(root, "data");
+      const installPrefix = path.join(root, "install");
+      process.env.TALLYNOTE_DATA_DIR = dataDir;
+      process.env.TALLYNOTE_INSTALL_PREFIX = installPrefix;
+      process.env.TALLYNOTE_PUBLIC_ORIGIN = "http://127.0.0.1:3998";
+      process.env.TALLYNOTE_COOKIE_SECURE = "false";
+      process.env.TALLYNOTE_UPDATE_STRATEGY = "systemd";
+      process.env.TALLYNOTE_UPDATE_METADATA_URL = "https://updates.example/latest";
+      process.env.TALLYNOTE_UPDATE_ALLOWED_HOSTS = "updates.example";
+      process.env.TALLYNOTE_UPDATE_REQUIRE_SIGNATURE = "false";
+      const config = loadConfig();
+      prepareDataDirectories(config);
+      await mkdir(path.join(config.releasesDir, config.appVersion, "dist"), { recursive: true });
+      await symlink(path.join(config.releasesDir, config.appVersion), config.currentLink);
+      database = openDatabase(config);
+      const staleAt = Date.now() - ORPHANED_UPDATE_TIMEOUT_MS - 1;
+      const insert = database.sqlite.prepare(`
+        INSERT INTO update_jobs(id, operation, status, version, platform, asset_url, created_at, updated_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+      `);
+      const queuedId = randomUUID();
+      const applyingId = randomUUID();
+      const stagedId = randomUUID();
+      const stagedApplyId = randomUUID();
+      insert.run(queuedId, "apply", "queued", "1.2.0", "linux-x64", "https://updates.example/queued.tar.gz", staleAt, staleAt);
+      insert.run(applyingId, "apply", "applying", config.appVersion, "linux-x64", "https://updates.example/applying.tar.gz", staleAt, staleAt);
+      insert.run(stagedId, "download", "staged", "1.2.0", "linux-x64", "https://updates.example/staged.tar.gz", staleAt, staleAt);
+      insert.run(stagedApplyId, "apply", "staged", "1.2.0", "linux-x64", "https://updates.example/staged-apply.tar.gz", staleAt, staleAt);
+      const now = Date.now();
+      expect(reconcileOrphanedUpdateJobs(database.sqlite, config, now)).toBe(3);
+      expect(database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(queuedId)).toEqual({ status: "failed" });
+      expect(database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(applyingId)).toEqual({ status: "completed" });
+      expect(database.sqlite.prepare("SELECT status, operation FROM update_jobs WHERE id=?").get(stagedId)).toEqual({ status: "staged", operation: "download" });
+      expect(database.sqlite.prepare("SELECT status, operation FROM update_jobs WHERE id=?").get(stagedApplyId)).toEqual({ status: "staged", operation: "download" });
+    } finally {
+      if (database) database.sqlite.close();
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it("下载心跳有效时不回收任务或删除仍在使用的请求文件", async () => {
+    const root = await mkdtemp(path.join(tmpdir(), "tallynote-update-heartbeat-"));
+    let database: ReturnType<typeof openDatabase> | undefined;
+    try {
+      const dataDir = path.join(root, "data");
+      const installPrefix = path.join(root, "install");
+      process.env.TALLYNOTE_DATA_DIR = dataDir;
+      process.env.TALLYNOTE_INSTALL_PREFIX = installPrefix;
+      process.env.TALLYNOTE_PUBLIC_ORIGIN = "http://127.0.0.1:3998";
+      process.env.TALLYNOTE_COOKIE_SECURE = "false";
+      process.env.TALLYNOTE_UPDATE_STRATEGY = "systemd";
+      process.env.TALLYNOTE_UPDATE_METADATA_URL = "https://updates.example/latest";
+      process.env.TALLYNOTE_UPDATE_ALLOWED_HOSTS = "updates.example";
+      process.env.TALLYNOTE_UPDATE_REQUIRE_SIGNATURE = "false";
+      const config = loadConfig();
+      prepareDataDirectories(config);
+      await mkdir(path.join(config.releasesDir, config.appVersion, "dist"), { recursive: true });
+      await symlink(path.join(config.releasesDir, config.appVersion), config.currentLink);
+      database = openDatabase(config);
+      const staleAt = Date.now() - ORPHANED_UPDATE_TIMEOUT_MS - 1;
+      const jobId = randomUUID();
+      database.sqlite.prepare(`
+        INSERT INTO update_jobs(id, operation, status, version, platform, asset_url, created_at, updated_at)
+        VALUES (?, 'download', 'downloading', '1.2.0', 'linux-x64', ?, ?, ?)
+      `).run(jobId, "https://updates.example/download.tar.gz", staleAt, staleAt);
+      await writeFile(config.updateRequestPath, JSON.stringify({ jobId, operation: "download" }));
+      const statePath = path.join(config.installPrefix, ".update-state");
+      await writeFile(statePath, `job_id=${jobId}\nold_target=${path.join(config.releasesDir, config.appVersion)}\nphase=download\n`);
+      const now = Date.now();
+      await utimes(config.updateRequestPath, new Date(staleAt), new Date(staleAt));
+      await utimes(statePath, new Date(now), new Date(now));
+      expect(reconcileOrphanedUpdateJobs(database.sqlite, config, now)).toBe(0);
+      expect(database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(jobId)).toEqual({ status: "downloading" });
+      expect(await stat(config.updateRequestPath)).toBeTruthy();
+
+      const expiredNow = now + ORPHANED_UPDATE_TIMEOUT_MS + 1;
+      await utimes(statePath, new Date(staleAt), new Date(staleAt));
+      expect(reconcileOrphanedUpdateJobs(database.sqlite, config, expiredNow)).toBe(1);
+      expect(database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(jobId)).toEqual({ status: "failed" });
+      await expect(stat(config.updateRequestPath)).rejects.toThrow();
+    } finally {
+      if (database) database.sqlite.close();
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it("队列任务有新请求标记时可被重新检查，标记过期后才回收", async () => {
+    const root = await mkdtemp(path.join(tmpdir(), "tallynote-update-queued-marker-"));
+    let database: ReturnType<typeof openDatabase> | undefined;
+    try {
+      const dataDir = path.join(root, "data");
+      const installPrefix = path.join(root, "install");
+      process.env.TALLYNOTE_DATA_DIR = dataDir;
+      process.env.TALLYNOTE_INSTALL_PREFIX = installPrefix;
+      process.env.TALLYNOTE_PUBLIC_ORIGIN = "http://127.0.0.1:3998";
+      process.env.TALLYNOTE_COOKIE_SECURE = "false";
+      process.env.TALLYNOTE_UPDATE_STRATEGY = "systemd";
+      process.env.TALLYNOTE_UPDATE_METADATA_URL = "https://updates.example/latest";
+      process.env.TALLYNOTE_UPDATE_ALLOWED_HOSTS = "updates.example";
+      process.env.TALLYNOTE_UPDATE_REQUIRE_SIGNATURE = "false";
+      const config = loadConfig();
+      prepareDataDirectories(config);
+      database = openDatabase(config);
+      const staleAt = Date.now() - ORPHANED_UPDATE_TIMEOUT_MS - 1;
+      const jobId = randomUUID();
+      database.sqlite.prepare(`
+        INSERT INTO update_jobs(id, operation, status, version, platform, asset_url, created_at, updated_at)
+        VALUES (?, 'apply', 'queued', '1.2.0', 'linux-x64', ?, ?, ?)
+      `).run(jobId, "https://updates.example/queued.tar.gz", staleAt, staleAt);
+      await writeFile(config.updateRequestPath, JSON.stringify({ jobId, operation: "apply" }));
+      const now = Date.now();
+      await utimes(config.updateRequestPath, new Date(now), new Date(now));
+
+      expect(reconcileOrphanedUpdateJobs(database.sqlite, config, now)).toBe(0);
+      expect(database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(jobId)).toEqual({ status: "queued" });
+      expect(await stat(config.updateRequestPath)).toBeTruthy();
+
+      const expiredNow = now + ORPHANED_UPDATE_TIMEOUT_MS + 1;
+      expect(reconcileOrphanedUpdateJobs(database.sqlite, config, expiredNow)).toBe(1);
+      expect(database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(jobId)).toEqual({ status: "failed" });
+      await expect(stat(config.updateRequestPath)).rejects.toThrow();
+    } finally {
+      if (database) database.sqlite.close();
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
   it("流式解包在展开大小上限前拒绝高压缩比归档，并修正发布树权限", async () => {
     const root = await mkdtemp(path.join(tmpdir(), "tallynote-update-stream-"));
     try {

uninstall.sh

@@ -245,14 +245,14 @@ assert_test_scope() {
 managed_file() {
   local target=$1 label=$2
   case "$label" in
-    service\ unit|updater\ unit|path\ unit|update\ helper|update\ runner|uninstaller)
+    service\ unit|updater\ unit|path\ unit|update\ helper|update\ runner|admin\ initializer|uninstaller)
       grep -Eiq 'tallynote|TallyNote' "$target" || return 1
       if [[ "$label" == 'path unit' ]]; then
         grep -Fq "$DATA_DIR" "$target" || return 1
       elif [[ "$label" == *unit ]]; then
         grep -Fq "$PREFIX" "$target" || return 1
       else
-        grep -Eq 'TALLYNOTE_INSTALL_PREFIX|/opt/tallynote' "$target" || return 1
+        grep -Eq 'TALLYNOTE_INSTALL_PREFIX|/opt/tallynote|admin-init.js' "$target" || return 1
       fi
       ;;
     environment\ file)
@@ -487,6 +487,7 @@ main() {
   remove_file_if_owned "$UNIT_DIR/tallynote-update.path" 'path unit'
   remove_file_if_owned "$SBIN_DIR/tallynote-update" 'update helper'
   remove_file_if_owned "$LIBEXEC_DIR/tallynote-update-runner" 'update runner'
+  remove_file_if_owned "$SBIN_DIR/tallynote-admin-init" 'admin initializer'
   remove_file_if_owned "$SBIN_DIR/tallynote-uninstall" 'uninstaller'
   remove_config
   remove_data

web-next/src/main.tsx

@@ -90,7 +90,7 @@ function App() {
   if (isSessionBootstrapping(session)) return <main className="tn-auth-shell" role="status" aria-live="polite"><Loading text="正在连接本地账本…" /></main>;
   if (session.status === "error") return <main className="tn-auth-shell"><div className="tn-auth-panel"><h1 className="tn-page-title">无法连接 TallyNote</h1><p className="tn-page-subtitle">{session.error || "请确认本地服务正在运行。"}</p><Button theme="primary" onClick={() => void dispatch(bootstrapSession())}>重新连接</Button></div></main>;
   if (!session.admin) return <LoginPage
-    notice={session.initialized ? undefined : "尚未初始化管理员，请先在服务器执行 pnpm admin:init。"}
+    notice={session.initialized ? undefined : "首次安装还差一步：请在服务器执行 sudo tallynote-admin-init 创建管理员账号。"}
     onSuccess={() => setPasswordOpen(false)}
   />;
   if (session.admin.mustChangePassword) return <ChangePasswordPage admin={session.admin} firstLogin onSuccess={() => notify("密码已更新", "success")} />;

web-next/src/pages/expenses/ExpenseDetail.tsx

@@ -66,7 +66,7 @@ export default function ExpenseDetail({ expense, timezone = "Asia/Shanghai", onC
     </Drawer>
     <Dialog visible={action === "status"} header={detail.status === "reimbursed" ? "改回未报销？" : "标记为已报销？"} confirmBtn={{ content: "确认变更", loading: busy, disabled: busy }} cancelBtn="取消" onClose={() => { if (!busy) setAction(null); }} onConfirm={() => void updateStatus()} onCancel={() => { if (!busy) setAction(null); }}>{detail.status === "reimbursed" ? "这笔账目会重新出现在未报销列表。" : "确认这笔账目已完成报销，并从未报销列表移出？"}</Dialog>
     <Dialog visible={action === "trash"} header="移入回收站？" confirmBtn={{ content: "移入回收站", theme: "danger", loading: busy, disabled: busy }} cancelBtn="取消" onClose={() => { if (!busy) setAction(null); }} onConfirm={() => void trash()} onCancel={() => { if (!busy) setAction(null); }}>账目会从普通列表和导出结果中隐藏，附件会保留，可在回收站恢复。</Dialog>
-    <Dialog visible={Boolean(removeTarget)} header="删除附件？" confirmBtn={{ content: "删除附件", theme: "danger", loading: busy, disabled: busy }} cancelBtn="取消" onClose={() => { if (!busy) setRemoveTarget(null); }} onConfirm={() => void remove()} onCancel={() => { if (!busy) setRemoveTarget(null); }}>{removeTarget && <><p>{removeTarget.kind === "payment_proof" ? "账目至少需要保留一张付款凭证。" : detail.invoiceCount <= 1 && !detail.invoiceMissingReason?.trim() ? "这是最后一张发票。删除后必须填写无发票原因。" : "将删除这张发票。"}</p>{removeTarget.kind === "invoice" && detail.invoiceCount <= 1 && !detail.invoiceMissingReason?.trim() && <Textarea disabled={busy} aria-label="无发票原因" aria-invalid={Boolean(removeError)} aria-describedby={removeError ? "remove-attachment-error" : undefined} value={removeReason} onChange={value => { setRemoveReason(value); setRemoveError(""); }} placeholder="例如：商家无法开具发票" maxlength={500} />}{removeError && <div id="remove-attachment-error" className="expense-error" role="alert"><AlertCircle size={16} />{removeError}</div>}</>}</Dialog>
+    <Dialog visible={Boolean(removeTarget)} header="删除附件？" confirmBtn={{ content: "删除附件", theme: "danger", loading: busy, disabled: busy }} cancelBtn="取消" onClose={() => { if (!busy) setRemoveTarget(null); }} onConfirm={() => void remove()} onCancel={() => { if (!busy) setRemoveTarget(null); }}>{removeTarget && <><p>{removeTarget.kind === "payment_proof" ? "账目至少需要保留一张付款凭证。" : detail.invoiceCount <= 1 && !detail.invoiceMissingReason?.trim() ? "这是最后一张发票。删除后必须填写无发票原因。" : "将删除这张发票。"}</p>{removeTarget.kind === "invoice" && detail.invoiceCount <= 1 && !detail.invoiceMissingReason?.trim() && <Textarea disabled={busy} aria-label="无发票原因" aria-invalid={Boolean(removeError)} aria-describedby={removeError ? "remove-attachment-error" : undefined} value={removeReason} onChange={value => { setRemoveReason(value); setRemoveError(""); }} placeholder="例如：商家无法开具发票" maxlength={500} />}{removeError && <div id="remove-attachment-error" className="expense-error" role="alert">{removeError}</div>}</>}</Dialog>
     <Dialog visible={Boolean(preview)} header={preview?.originalName} onClose={() => setPreview(null)} cancelBtn="关闭" footer={null}>{preview && <div className="tn-preview">{preview.mimeType.startsWith("image/") ? <img src={`/api/attachments/${preview.id}/content`} alt={preview.originalName} /> : <iframe src={`/api/attachments/${preview.id}/content`} title={preview.originalName} />}</div>}</Dialog>
   </>;
 }

web-next/src/pages/update/mockData.ts

@@ -0,0 +1,283 @@
+export type MockScenario =
+  | "latest"          // 已是最新
+  | "available"       // 发现新版本（待下载）
+  | "downloading_30"  // 下载中 30%
+  | "downloading_85"  // 下载中 85% + 高速
+  | "staged"          // 下载完成已校验，待立即更新
+  | "backing_up"      // 正在备份数据
+  | "applying"        // 正在原子切换并重启中（倒计时）
+  | "completed"       // 更新完成
+  | "failed_verify"   // 完整性校验失败
+  | "disabled";       // 手动模式未配置源
+
+export interface MockUpdateState {
+  info: any;
+  title: string;
+  description: string;
+}
+
+export const MOCK_SCENARIOS: Record<MockScenario, MockUpdateState> = {
+  latest: {
+    title: "版本健康（已是最新）",
+    description: "展示当前运行版本已是最新，各项指标正常，无待处理任务",
+    info: {
+      configured: true,
+      strategy: "systemd",
+      currentVersion: "1.1.22",
+      platform: { target: "x64/glibc", os: "linux", arch: "x64" },
+      checkedAt: Date.now() - 600_000,
+      latest: {
+        version: "1.1.22",
+        tagName: "v1.1.22",
+        releaseName: "v1.1.22 稳定版",
+        publishedAt: new Date(Date.now() - 3600_000 * 24).toISOString(),
+        compatible: true,
+        integrityReady: true,
+        signatureReady: true,
+        isNewer: false,
+        assetName: "tallynote-1.1.22-linux-x64-glibc.tar.gz",
+        assetSize: 120540160,
+        notes: "### TallyNote 1.1.22\n\n- 优化反向代理下登录兼容性\n- 增强安全审计与防重放机制\n- 前端组件性能深度优化",
+      },
+      job: null,
+    },
+  },
+  available: {
+    title: "发现新版本（待下载）",
+    description: "检查到官方发布了更高版本，显示更新日志与文件校验信息，可点击下载",
+    info: {
+      configured: true,
+      strategy: "systemd",
+      currentVersion: "1.1.22",
+      platform: { target: "x64/glibc", os: "linux", arch: "x64" },
+      checkedAt: Date.now() - 60_000,
+      latest: {
+        version: "1.1.23",
+        tagName: "v1.1.23",
+        releaseName: "v1.1.23 重大更新",
+        publishedAt: new Date(Date.now() - 1800_000).toISOString(),
+        compatible: true,
+        integrityReady: true,
+        signatureReady: true,
+        isNewer: true,
+        assetName: "tallynote-1.1.23-linux-x64-glibc.tar.gz",
+        assetSize: 121000000,
+        notes: "### TallyNote 1.1.23\n\n- 【新功能】系统更新中心全面重构，支持动态速率流光进度条与平滑重启倒计时\n- 【交互】优化抽屉展开动效与手机端自适应导航\n- 【安全】发布包支持双重 Ed25519 签名与 SHA-256 清单交叉校验",
+      },
+      job: null,
+    },
+  },
+  downloading_30: {
+    title: "下载更新中（进度 38%）",
+    description: "展示真实下载速率、已下载字节数与动态流光进度条",
+    info: {
+      configured: true,
+      strategy: "systemd",
+      currentVersion: "1.1.22",
+      platform: { target: "x64/glibc", os: "linux", arch: "x64" },
+      checkedAt: Date.now() - 120_000,
+      latest: {
+        version: "1.1.23",
+        tagName: "v1.1.23",
+        compatible: true,
+        integrityReady: true,
+        signatureReady: true,
+        isNewer: true,
+        assetName: "tallynote-1.1.23-linux-x64-glibc.tar.gz",
+        assetSize: 121000000,
+      },
+      job: {
+        id: "mock-job-001",
+        operation: "download",
+        status: "downloading",
+        version: "1.1.23",
+        platform: "x64/glibc",
+        assetName: "tallynote-1.1.23-linux-x64-glibc.tar.gz",
+        sizeBytes: 121000000,
+        downloadedBytes: 46200000,
+        downloadStartedAt: Date.now() - 10000,
+        downloadSpeedBps: 8800000, // 8.4 MB/s
+        createdAt: Date.now() - 10000,
+        updatedAt: Date.now(),
+      },
+    },
+  },
+  downloading_85: {
+    title: "下载冲刺中（进度 88%）",
+    description: "高速冲刺状态，即将触发 SHA-256 校验",
+    info: {
+      configured: true,
+      strategy: "systemd",
+      currentVersion: "1.1.22",
+      platform: { target: "x64/glibc", os: "linux", arch: "x64" },
+      checkedAt: Date.now() - 120_000,
+      latest: {
+        version: "1.1.23",
+        tagName: "v1.1.23",
+        compatible: true,
+        integrityReady: true,
+        signatureReady: true,
+        isNewer: true,
+        assetName: "tallynote-1.1.23-linux-x64-glibc.tar.gz",
+        assetSize: 121000000,
+      },
+      job: {
+        id: "mock-job-002",
+        operation: "download",
+        status: "downloading",
+        version: "1.1.23",
+        platform: "x64/glibc",
+        assetName: "tallynote-1.1.23-linux-x64-glibc.tar.gz",
+        sizeBytes: 121000000,
+        downloadedBytes: 106480000,
+        downloadStartedAt: Date.now() - 15000,
+        downloadSpeedBps: 12500000, // 11.9 MB/s
+        createdAt: Date.now() - 15000,
+        updatedAt: Date.now(),
+      },
+    },
+  },
+  staged: {
+    title: "下载完成（待立即应用）",
+    description: "更新包与签名均已校验就绪，随时可以安全点击【立即更新】",
+    info: {
+      configured: true,
+      strategy: "systemd",
+      currentVersion: "1.1.22",
+      platform: { target: "x64/glibc", os: "linux", arch: "x64" },
+      checkedAt: Date.now() - 120_000,
+      latest: {
+        version: "1.1.23",
+        tagName: "v1.1.23",
+        compatible: true,
+        integrityReady: true,
+        signatureReady: true,
+        isNewer: true,
+        assetName: "tallynote-1.1.23-linux-x64-glibc.tar.gz",
+        assetSize: 121000000,
+        notes: "### TallyNote 1.1.23\n\n- 更新包已完整解压检验通过，具备升级条件。",
+      },
+      job: {
+        id: "mock-job-003",
+        operation: "download",
+        status: "staged",
+        version: "1.1.23",
+        platform: "x64/glibc",
+        assetName: "tallynote-1.1.23-linux-x64-glibc.tar.gz",
+        sizeBytes: 121000000,
+        downloadedBytes: 121000000,
+        createdAt: Date.now() - 60000,
+        updatedAt: Date.now() - 5000,
+      },
+    },
+  },
+  backing_up: {
+    title: "数据备份中（更新保护）",
+    description: "正在为 /var/lib/tallynote 生成自动还原快照",
+    info: {
+      configured: true,
+      strategy: "systemd",
+      currentVersion: "1.1.22",
+      platform: { target: "x64/glibc", os: "linux", arch: "x64" },
+      checkedAt: Date.now() - 120_000,
+      latest: { version: "1.1.23", tagName: "v1.1.23", compatible: true, integrityReady: true, signatureReady: true, isNewer: true },
+      job: {
+        id: "mock-job-004",
+        operation: "apply",
+        status: "backing_up",
+        version: "1.1.23",
+        platform: "x64/glibc",
+        createdAt: Date.now() - 20000,
+        updatedAt: Date.now() - 2000,
+      },
+    },
+  },
+  applying: {
+    title: "服务平滑重启中（倒计时中）",
+    description: "已原子切换版本，systemd 正在热重启，前端实时探活",
+    info: {
+      configured: true,
+      strategy: "systemd",
+      currentVersion: "1.1.22",
+      platform: { target: "x64/glibc", os: "linux", arch: "x64" },
+      checkedAt: Date.now() - 120_000,
+      latest: { version: "1.1.23", tagName: "v1.1.23", compatible: true, integrityReady: true, signatureReady: true, isNewer: true },
+      job: {
+        id: "mock-job-005",
+        operation: "apply",
+        status: "applying",
+        version: "1.1.23",
+        platform: "x64/glibc",
+        applyQueuedAt: Date.now() - 12000,
+        restartWindowSeconds: 30,
+        restartDeadline: Date.now() + 18000,
+        createdAt: Date.now() - 25000,
+        updatedAt: Date.now() - 2000,
+      },
+    },
+  },
+  completed: {
+    title: "更新成功完成",
+    description: "新版本健康检查通过，已平滑无感升级至最新",
+    info: {
+      configured: true,
+      strategy: "systemd",
+      currentVersion: "1.1.23",
+      platform: { target: "x64/glibc", os: "linux", arch: "x64" },
+      checkedAt: Date.now() - 30_000,
+      latest: { version: "1.1.23", tagName: "v1.1.23", compatible: true, integrityReady: true, signatureReady: true, isNewer: false },
+      job: {
+        id: "mock-job-006",
+        operation: "apply",
+        status: "completed",
+        version: "1.1.23",
+        platform: "x64/glibc",
+        completedAt: Date.now() - 10000,
+        createdAt: Date.now() - 45000,
+        updatedAt: Date.now() - 10000,
+      },
+    },
+  },
+  failed_verify: {
+    title: "更新失败状态（安全拦截）",
+    description: "模拟签名不匹配或发布包篡改时的安全拦截展示与错误提示",
+    info: {
+      configured: true,
+      strategy: "systemd",
+      currentVersion: "1.1.22",
+      platform: { target: "x64/glibc", os: "linux", arch: "x64" },
+      checkedAt: Date.now() - 120_000,
+      latest: {
+        version: "1.1.23",
+        tagName: "v1.1.23",
+        compatible: true,
+        integrityReady: false,
+        signatureReady: false,
+        isNewer: true,
+      },
+      job: {
+        id: "mock-job-007",
+        operation: "download",
+        status: "failed",
+        version: "1.1.23",
+        platform: "x64/glibc",
+        errorMessage: "发布包 SHA-256 校验与清单不一致，系统已自动阻断并保护原有数据。",
+        createdAt: Date.now() - 30000,
+        updatedAt: Date.now() - 5000,
+      },
+    },
+  },
+  disabled: {
+    title: "手动源码模式",
+    description: "未接入 systemd 时的只读说明与命令引导展示",
+    info: {
+      configured: false,
+      strategy: "disabled",
+      currentVersion: "1.1.22",
+      platform: { target: "macOS/darwin", os: "darwin", arch: "arm64" },
+      checkedAt: Date.now() - 3600_000,
+      latest: null,
+      job: null,
+    },
+  },
+};

web-next/src/styles/theme.css

@@ -134,7 +134,18 @@ input:focus-visible, textarea:focus-visible, select:focus-visible {
 .tn-user-dropdown-identity { display: grid; gap: 3px; margin: 2px 4px 6px; padding: 8px 9px 10px; border-bottom: 1px solid var(--tn-border-subtle); }
 .tn-user-dropdown-identity strong { color: var(--tn-text); font-size: 13px; }
 .tn-user-dropdown-identity span { overflow: hidden; color: var(--tn-text-secondary); font-size: 12px; text-overflow: ellipsis; white-space: nowrap; }
-.tn-menu-logo { display: flex; width: 100%; height: 64px; align-items: center; justify-content: center; color: var(--tn-navy-900); }
+.tn-menu-logo {
+  /* TDesign adds a left margin to every direct logo child. The logo owns
+     its full-width centering, so that default inset makes the wordmark look
+     visibly shifted to the right in both expanded and collapsed menus. */
+  display: flex;
+  width: 100%;
+  height: 64px;
+  margin-left: 0 !important;
+  align-items: center;
+  justify-content: center;
+  color: var(--tn-navy-900);
+}
 .tn-logo-full { font-size: 18px; font-weight: 750; letter-spacing: .01em; }
 .tn-logo-short { color: var(--tn-blue-700); font-size: 16px; font-weight: 800; letter-spacing: .04em; }
 .tn-menu-icon { flex: 0 0 20px; width: 20px; height: 20px; margin-right: 10px; }
@@ -399,6 +410,34 @@ input:focus-visible, textarea:focus-visible, select:focus-visible {
 @keyframes tn-app-enter { from { opacity: 0; } to { opacity: 1; } }
 @keyframes tn-auth-page-in { from { opacity: 0; transform: translateY(4px); } to { opacity: 1; transform: translateY(0); } }
 .t-dialog { border: 1px solid var(--tn-border); border-radius: 4px; box-shadow: 0 18px 42px rgba(8, 47, 118, .18); }
+/* TDesign Dialog global no-icon & pure baseline typography normalization */
+.t-dialog__header .t-icon:not(.t-icon-close),
+.t-dialog__body .t-icon,
+.t-dialog .t-icon.t-is-info,
+.t-dialog .t-icon.t-is-success,
+.t-dialog .t-icon.t-is-warning,
+.t-dialog .t-icon.t-is-error {
+  display: none !important;
+}
+.t-dialog__header {
+  font-size: 16px;
+  font-weight: 600;
+  color: var(--tn-navy-900);
+  line-height: 1.4;
+  margin-bottom: 8px;
+  gap: 0 !important;
+}
+.t-dialog__header-content {
+  display: block !important;
+  width: 100%;
+}
+.t-dialog__body {
+  font-size: 13.5px;
+  line-height: 1.65;
+  color: var(--tn-text);
+  padding: 8px 0 20px 0;
+}
+
 .t-dialog__mask { background: var(--td-mask-active) !important; }
 .t-dialog__footer .t-button { min-width: 76px; }
 @media (max-width: 900px) {
@@ -526,3 +565,527 @@ input:focus-visible, textarea:focus-visible, select:focus-visible {
 @media (prefers-reduced-motion: reduce) {
   *, *::before, *::after { animation-duration: .01ms !important; animation-iteration-count: 1 !important; transition-duration: .01ms !important; scroll-behavior: auto !important; }
 }
+
+/* ==========================================================================
+   TallyNote Update Center (Redesigned UI & Interactive Styles)
+   ========================================================================== */
+
+/* Mock Console Controller */
+.tn-mock-console {
+  margin-bottom: 16px;
+  padding: 14px 18px;
+  background: #f8fbff;
+  border: 1px dashed var(--td-brand-color-3);
+  border-radius: 4px;
+}
+.tn-mock-console-header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  flex-wrap: wrap;
+  gap: 8px;
+  margin-bottom: 12px;
+}
+.tn-mock-console-title {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  font-size: 13px;
+  color: var(--tn-navy-900);
+}
+.tn-mock-console-tip {
+  font-size: 12px;
+  color: var(--tn-text-secondary);
+}
+.tn-mock-scenario-chips {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px;
+}
+.tn-scenario-chip {
+  padding: 5px 11px;
+  font-size: 12px;
+  border: 1px solid var(--tn-border);
+  border-radius: 3px;
+  background: #ffffff;
+  color: var(--tn-text-secondary);
+  cursor: pointer;
+  transition: all 0.16s ease;
+}
+.tn-scenario-chip:hover {
+  border-color: var(--td-brand-color-4);
+  color: var(--td-brand-color);
+  background: var(--td-brand-color-1);
+}
+.tn-scenario-chip.active {
+  background: var(--td-brand-color);
+  border-color: var(--td-brand-color);
+  color: #ffffff;
+  font-weight: 600;
+  box-shadow: 0 2px 6px rgba(23, 92, 211, 0.2);
+}
+
+/* Update Page Actions */
+.tn-update-page-actions {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+}
+
+/* 4 Metrics Grid */
+.tn-update-metrics-grid {
+  display: grid;
+  grid-template-columns: repeat(4, minmax(0, 1fr));
+  gap: 14px;
+  margin-bottom: 16px;
+}
+.tn-metric-card .t-card__body {
+  display: flex;
+  flex-direction: column;
+  justify-content: space-between;
+  padding: 16px 18px;
+  min-height: 104px;
+}
+.tn-metric-content {
+  width: 100%;
+}
+.tn-metric-label {
+  display: block;
+  font-size: 12px;
+  color: var(--tn-text-secondary);
+  margin-bottom: 4px;
+}
+.tn-metric-value {
+  font-size: 20px;
+  font-weight: 700;
+  color: var(--tn-navy-900);
+  font-family: "Plus Jakarta Sans Variable", sans-serif;
+  font-variant-numeric: tabular-nums;
+  line-height: 1.2;
+}
+.tn-metric-foot {
+  margin-top: 6px;
+  font-size: 12px;
+  color: var(--tn-text-muted);
+}
+
+/* Stepper Surface */
+.tn-stepper-surface {
+  margin-bottom: 16px;
+  padding: 20px;
+}
+.tn-stepper-head {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 16px;
+  margin-bottom: 20px;
+}
+.tn-section-heading {
+  margin: 0 0 4px;
+  font-size: 15px;
+  font-weight: 700;
+  color: var(--tn-text);
+}
+.tn-section-subheading {
+  font-size: 12px;
+  color: var(--tn-text-secondary);
+}
+.tn-stepper-wrap {
+  padding: 10px 0 20px;
+}
+.tn-stepper-wrap .t-steps {
+  max-width: 860px;
+  margin: 0 auto;
+}
+.tn-stepper-wrap {
+  min-width: 0;
+  overflow-x: auto;
+  scrollbar-width: thin;
+  scrollbar-color: var(--td-brand-color-3) transparent;
+}
+.tn-stepper-wrap .t-steps {
+  min-width: 680px;
+}
+
+/* Job Runtime Panel (Active download & progress) */
+.tn-job-runtime-panel {
+  margin-top: 14px;
+  padding: 16px;
+  background: #f8fbff;
+  border: 1px solid var(--td-brand-color-2);
+  border-radius: 4px;
+}
+.tn-job-runtime-header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  flex-wrap: wrap;
+  gap: 10px;
+  margin-bottom: 12px;
+}
+.tn-job-status-badge {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  font-size: 13px;
+  color: var(--tn-navy-900);
+  min-width: 0;
+  overflow-wrap: anywhere;
+}
+.tn-pulse-dot {
+  width: 8px;
+  height: 8px;
+  border-radius: 50%;
+  background: var(--td-brand-color);
+  box-shadow: 0 0 0 0 rgba(23, 92, 211, 0.7);
+  animation: tn-pulse 1.8s infinite;
+}
+@keyframes tn-pulse {
+  0% { transform: scale(0.95); box-shadow: 0 0 0 0 rgba(23, 92, 211, 0.7); }
+  70% { transform: scale(1); box-shadow: 0 0 0 6px rgba(23, 92, 211, 0); }
+  100% { transform: scale(0.95); box-shadow: 0 0 0 0 rgba(23, 92, 211, 0); }
+}
+.tn-job-subtext {
+  color: var(--tn-text-secondary);
+  font-size: 12px;
+  font-family: "Plus Jakarta Sans Variable", sans-serif;
+  font-variant-numeric: tabular-nums;
+}
+.tn-speed-indicator {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  min-width: 0;
+  flex-wrap: wrap;
+}
+.tn-speed-badge {
+  display: inline-flex;
+  align-items: center;
+  gap: 4px;
+  padding: 2px 8px;
+  border-radius: 3px;
+  background: #ffffff;
+  border: 1px solid var(--td-brand-color-3);
+  color: var(--td-brand-color);
+  font-size: 12px;
+  font-weight: 600;
+  font-family: "Plus Jakarta Sans Variable", sans-serif;
+  font-variant-numeric: tabular-nums;
+}
+.tn-eta-badge {
+  display: inline-block;
+  padding: 2px 8px;
+  border-radius: 3px;
+  background: #f2f5f9;
+  color: var(--tn-text-secondary);
+  font-size: 12px;
+  font-variant-numeric: tabular-nums;
+}
+
+/* Progress Bar with modern stream light effect */
+.tn-progress-stream {
+  position: relative;
+  height: 8px;
+  background: #e1e9f4;
+  border-radius: 999px;
+  overflow: hidden;
+  margin-bottom: 12px;
+}
+.tn-progress-stream-bar {
+  height: 100%;
+  background: linear-gradient(90deg, #175cd3 0%, #3d7be5 100%);
+  border-radius: inherit;
+  transition: width 0.35s ease;
+  position: relative;
+}
+.tn-progress-stream-bar::after {
+  content: "";
+  position: absolute;
+  top: 0; left: 0; bottom: 0; right: 0;
+  background-image: linear-gradient(
+    -45deg,
+    rgba(255, 255, 255, 0.25) 25%,
+    transparent 25%,
+    transparent 50%,
+    rgba(255, 255, 255, 0.25) 50%,
+    rgba(255, 255, 255, 0.25) 75%,
+    transparent 75%,
+    transparent
+  );
+  background-size: 30px 30px;
+  animation: tn-stream-flow 1.5s linear infinite;
+}
+@keyframes tn-stream-flow {
+  0% { background-position: 0 0; }
+  100% { background-position: 30px 30px; }
+}
+
+.tn-job-runtime-desc {
+  font-size: 12px;
+  color: var(--tn-text-secondary);
+  line-height: 1.6;
+}
+
+/* Restarting State Banner */
+.tn-restarting-banner {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  padding: 8px 12px;
+  background: #fff8e6;
+  border: 1px solid #ffd666;
+  border-radius: 3px;
+  color: #8c5b00;
+}
+.tn-restarting-spinner {
+  color: #faad14;
+}
+
+/* Release Surface */
+.tn-release-surface {
+  margin-bottom: 16px;
+  padding: 20px;
+}
+.tn-release-header {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 16px;
+}
+.tn-release-tag-row {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  margin-bottom: 6px;
+}
+.tn-release-title {
+  margin: 0 0 6px;
+  font-size: 22px;
+  font-weight: 700;
+  color: var(--tn-navy-900);
+}
+.tn-release-time {
+  font-size: 12px;
+  color: var(--tn-text-secondary);
+}
+.tn-release-notes-box {
+  margin: 16px 0;
+  padding: 12px 16px;
+  background: #f8fafc;
+  border: 1px solid var(--tn-border);
+  border-left: 3px solid var(--td-brand-color);
+  border-radius: 3px;
+}
+.tn-release-notes-heading {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  font-size: 12px;
+  font-weight: 600;
+  color: var(--tn-navy-900);
+  margin-bottom: 6px;
+}
+.tn-release-notes-content {
+  font-size: 13px;
+  color: var(--tn-text-secondary);
+  line-height: 1.6;
+  max-height: 140px;
+  overflow-y: auto;
+}
+
+.tn-markdown-notes {
+  color: inherit;
+  line-height: 1.7;
+  overflow-wrap: anywhere;
+}
+.tn-markdown-notes p,
+.tn-markdown-notes h3,
+.tn-markdown-notes h4,
+.tn-markdown-notes h5 {
+  margin: 0 0 8px;
+}
+.tn-markdown-notes p:last-child,
+.tn-markdown-notes ul:last-child,
+.tn-markdown-notes pre:last-child,
+.tn-markdown-notes h3:last-child,
+.tn-markdown-notes h4:last-child,
+.tn-markdown-notes h5:last-child {
+  margin-bottom: 0;
+}
+.tn-markdown-notes h3,
+.tn-markdown-notes h4,
+.tn-markdown-notes h5 {
+  color: var(--tn-navy-900);
+  font-weight: 700;
+}
+.tn-markdown-notes h3 { font-size: 15px; }
+.tn-markdown-notes h4 { font-size: 14px; }
+.tn-markdown-notes h5 { font-size: 13px; }
+.tn-markdown-notes ul {
+  margin: 0 0 8px;
+  padding-left: 20px;
+}
+.tn-markdown-notes li { margin: 3px 0; }
+.tn-markdown-notes strong { color: var(--tn-navy-900); font-weight: 700; }
+.tn-markdown-notes code {
+  padding: 1px 4px;
+  border: 1px solid var(--tn-border-subtle);
+  border-radius: 3px;
+  background: #f2f5f9;
+  color: var(--tn-navy-900);
+  font-family: "Plus Jakarta Sans Variable", ui-monospace, monospace;
+  font-size: .92em;
+}
+.tn-markdown-notes pre {
+  margin: 0 0 8px;
+  padding: 10px 12px;
+  overflow-x: auto;
+  border: 1px solid var(--tn-border-subtle);
+  border-radius: 3px;
+  background: #f8fafc;
+  white-space: pre-wrap;
+}
+.tn-markdown-notes pre code { padding: 0; border: 0; background: transparent; }
+.tn-markdown-notes a { color: var(--td-brand-color); text-decoration: underline; text-underline-offset: 2px; }
+.tn-markdown-notes-compact { font-size: 13px; }
+
+/* Facts Grid */
+.tn-facts-grid {
+  display: grid;
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+  gap: 14px;
+  margin: 18px 0;
+  padding: 14px 0;
+  border-top: 1px solid var(--tn-border-subtle);
+  border-bottom: 1px solid var(--tn-border-subtle);
+}
+.tn-fact-item {
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+}
+.tn-fact-label {
+  font-size: 12px;
+  color: var(--tn-text-secondary);
+}
+.tn-fact-value {
+  font-size: 14px;
+  color: var(--tn-text);
+  font-weight: 600;
+  overflow-wrap: anywhere;
+}
+.tn-fact-hint {
+  font-size: 11px;
+  color: var(--tn-text-muted);
+}
+
+.tn-release-card-actions {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  margin-top: 16px;
+}
+
+/* Dialog content styles */
+.tn-confirm-dialog-content {
+  font-size: 13px;
+  line-height: 1.6;
+  color: var(--tn-text);
+}
+.tn-update-safety-tips {
+  margin-top: 10px;
+  padding: 10px 14px;
+  background: #f6f8fb;
+  border-radius: 3px;
+  border: 1px solid var(--tn-border-subtle);
+  font-size: 12px;
+  color: var(--tn-text-secondary);
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+}
+
+.tn-full-notes-modal {
+  margin: 0;
+  padding: 12px;
+  background: #f8fafc;
+  border-radius: 3px;
+  font-size: 13px;
+  line-height: 1.6;
+  color: var(--tn-text);
+  max-height: 50vh;
+  overflow-y: auto;
+}
+
+.tn-empty-surface {
+  padding: 36px 20px;
+  text-align: center;
+}
+.tn-empty-content {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 8px;
+  color: var(--tn-text-secondary);
+  font-size: 13px;
+}
+
+.tn-inline-warning {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 10px 14px;
+  margin-bottom: 14px;
+  background: #fffbe6;
+  border: 1px solid #ffe58f;
+  border-radius: 3px;
+  color: #d48806;
+  font-size: 13px;
+}
+
+/* Responsive adjustments */
+@media (max-width: 992px) {
+  .tn-update-metrics-grid {
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+  }
+  .tn-facts-grid {
+    grid-template-columns: 1fr;
+  }
+}
+@media (max-width: 640px) {
+  .tn-update-metrics-grid {
+    grid-template-columns: 1fr;
+  }
+  .tn-mock-console-header {
+    flex-direction: column;
+    align-items: flex-start;
+  }
+  .tn-release-header {
+    flex-direction: column;
+  }
+  .tn-release-card-actions {
+    flex-direction: column;
+    width: 100%;
+  }
+  .tn-release-card-actions .t-button {
+    width: 100%;
+  }
+  .tn-stepper-wrap {
+    margin-inline: -4px;
+    padding-inline: 4px;
+  }
+  .tn-stepper-wrap .t-steps {
+    min-width: 620px;
+  }
+  .tn-job-runtime-header {
+    align-items: stretch;
+  }
+  .tn-job-status-badge,
+  .tn-speed-indicator {
+    width: 100%;
+  }
+  .tn-speed-indicator {
+    justify-content: flex-start;
+  }
+}

web/src/main.tsx

@@ -771,7 +771,7 @@ function Update({ notify }: { notify: (message: string, kind?: Notice["kind"]) =
   const canApply = Boolean(info?.strategy === "systemd" && latest?.isNewer && latest.compatible && latest.integrityReady && !hasActiveJob && (!job || job.status === "failed" || job.version !== latest.version));
 
   return <div className="page update-page">
-    <div className="page-head"><div><div className="eyebrow">系统</div><h1>系统更新</h1></div><div className="head-actions"><Button onClick={() => void load()} disabled={loading || checking}><RotateCcw size={15} />刷新</Button><Button kind="primary" onClick={() => void check()} disabled={loading || checking || hasActiveJob}><RefreshCw size={15} className={checking ? "spin" : undefined} />检查更新</Button></div></div>
+    <div className="page-head"><div><div className="eyebrow">系统</div><h1>系统更新</h1></div><div className="head-actions"><Button onClick={() => void load()} disabled={loading || checking}><RotateCcw size={15} />刷新</Button><Button kind="primary" onClick={() => void check()} disabled={loading || checking}><RefreshCw size={15} className={checking ? "spin" : undefined} />检查更新</Button></div></div>
     {error && <div className="error banner" role="alert"><AlertCircle size={16} />{error}<button className="text-button" onClick={() => void load()}>重试</button></div>}
     {loading ? <div className="update-loading"><Loader2 className="spin" size={22} />正在读取版本信息</div> : info && <>
       <div className="update-overview">