fix: show completed download progress

.env.example

@@ -3,6 +3,9 @@ TALLYNOTE_PORT=3000
 TALLYNOTE_DATA_DIR=./data
 TALLYNOTE_TIMEZONE=Asia/Shanghai
 TALLYNOTE_PUBLIC_ORIGIN=http://127.0.0.1:3000
+# Optional additional browser Origins for an explicit reverse-proxy alias.
+# Keep the primary public origin above and list only trusted HTTPS origins.
+# TALLYNOTE_ALLOWED_ORIGINS=https://tally.example.com,https://tally.internal.example
 TALLYNOTE_TRUST_PROXY=false
 TALLYNOTE_COOKIE_SECURE=false
 # Set TALLYNOTE_HOST=0.0.0.0 and the server's real IP Origin for direct

.gitea/workflows/release.yml

@@ -30,6 +30,7 @@ jobs:
           pnpm install --frozen-lockfile
           pnpm check
           pnpm test
+          pnpm test:installer
       - name: Build Linux release
         run: pnpm release:build "${GITHUB_REF_NAME#v}" ./release
       - name: Create and publish Gitea Release

README.md

@@ -140,7 +140,7 @@ curl --proto '=https' --tlsv1.2 -fsSL https://git.awaioi.com/awaioi/TallyNote/ra
 
 卸载器会逐项输出停止、禁用和删除进度；每次 systemd/dbus 调用默认最多等待 30 秒，避免终端无限无响应。可通过 `TALLYNOTE_UNINSTALL_SYSTEMCTL_TIMEOUT_SECONDS` 调整超时时间。
 
-公网反代必须使用 HTTPS，并在环境文件中设置真实的 `TALLYNOTE_PUBLIC_ORIGIN=https://...`、`TALLYNOTE_COOKIE_SECURE=true` 和明确的 `TALLYNOTE_TRUST_PROXY` 跳数（不要使用生产值 `true`）。
+公网反代必须使用 HTTPS，并在环境文件中设置真实的 `TALLYNOTE_PUBLIC_ORIGIN=https://...`、`TALLYNOTE_COOKIE_SECURE=true` 和明确的 `TALLYNOTE_TRUST_PROXY` 跳数（不要使用生产值 `true`）。登录和所有写入请求会校验浏览器 `Origin`；反代必须原样转发 `Origin`，且访问地址必须与 `TALLYNOTE_PUBLIC_ORIGIN` 完全一致。若确实需要多个受信任域名，可用 `TALLYNOTE_ALLOWED_ORIGINS=https://a.example.com,https://b.example.com` 显式列出（只写 Origin，不含路径），不要把它设为任意来源。
 
 ### 构建发布包
 

install.sh

@@ -1012,7 +1012,10 @@ validate_listen_port() {
 }
 
 validate_public_origin() {
-  local value=$1 authority host path_part origin_port suffix
+  # Keep the optional origin port defined under `set -u`. Origins without an
+  # explicit port (for example https://example.test) are valid and should
+  # proceed to the default-port handling below.
+  local value=$1 authority host path_part origin_port='' suffix
   case "$value" in
     http://*|https://*) ;;
     *) die '公开访问地址必须是 http:// 或 https:// 地址' ;;
@@ -1074,7 +1077,7 @@ validate_existing_env() {
   mode_bits=$(stat_mode_bits "$file")
   (( (mode_bits & 18) == 0 )) || die '环境文件不能被组或其他用户写入'
   local key key_count
-  for key in TALLYNOTE_INSTALL_PREFIX TALLYNOTE_DATA_DIR TALLYNOTE_HOST TALLYNOTE_PORT TALLYNOTE_PUBLIC_ORIGIN TALLYNOTE_ALLOW_INSECURE_HTTP TALLYNOTE_COOKIE_SECURE TALLYNOTE_UPDATE_REQUIRE_SIGNATURE TALLYNOTE_UPDATE_METADATA_URL TALLYNOTE_UPDATE_ALLOWED_HOSTS TALLYNOTE_UPDATE_PUBLIC_KEY_FILE; do
+  for key in TALLYNOTE_INSTALL_PREFIX TALLYNOTE_DATA_DIR TALLYNOTE_HOST TALLYNOTE_PORT TALLYNOTE_PUBLIC_ORIGIN TALLYNOTE_ALLOWED_ORIGINS TALLYNOTE_ALLOW_INSECURE_HTTP TALLYNOTE_COOKIE_SECURE TALLYNOTE_UPDATE_REQUIRE_SIGNATURE TALLYNOTE_UPDATE_METADATA_URL TALLYNOTE_UPDATE_ALLOWED_HOSTS TALLYNOTE_UPDATE_PUBLIC_KEY_FILE; do
     key_count=$(env_key_count "$file" "$key")
     [[ "$key_count" =~ ^[0-9]+$ && "$key_count" -le 1 ]] || die "环境文件包含重复配置：$key"
   done
@@ -1457,6 +1460,7 @@ main() {
   elif [[ -n "${TALLYNOTE_PUBLIC_ORIGIN+x}" ]]; then
     set_env_key TALLYNOTE_PUBLIC_ORIGIN "$INSTALL_PUBLIC_ORIGIN"
   fi
+  if [[ -n "${TALLYNOTE_ALLOWED_ORIGINS+x}" ]]; then set_env_key TALLYNOTE_ALLOWED_ORIGINS "$TALLYNOTE_ALLOWED_ORIGINS"; fi
   if [[ -n "${TALLYNOTE_ALLOW_INSECURE_HTTP+x}" ]]; then set_env_key TALLYNOTE_ALLOW_INSECURE_HTTP "$INSTALL_ALLOW_INSECURE_HTTP"; fi
   ensure_env_key TALLYNOTE_INSTALL_PREFIX "$PREFIX"
   ensure_env_key TALLYNOTE_DATA_DIR "$DATA_DIR"

migrations/0005_update_progress.sql

@@ -0,0 +1,3 @@
+ALTER TABLE update_jobs ADD COLUMN downloaded_bytes INTEGER;
+ALTER TABLE update_jobs ADD COLUMN download_started_at INTEGER;
+ALTER TABLE update_jobs ADD COLUMN download_speed_bps INTEGER;

package.json

@@ -1,6 +1,6 @@
 {
   "name": "tallynote",
-  "version": "1.1.14",
+  "version": "1.1.21",
   "private": true,
   "type": "module",
   "packageManager": "pnpm@9.0.6",

scripts/tallynote-update-runner.sh

@@ -32,10 +32,96 @@ if [[ -f "$REQUEST_FILE" && ! -L "$REQUEST_FILE" ]]; then
   [[ "$request_operation" == download || "$request_operation" == apply ]] || request_operation='apply'
 fi
 
+# Capture the request id before any privileged preflight can fail. The
+# request file is an application-owned one-shot marker; removing it on an
+# early runner failure lets the server-side lease reaper release the DB row.
+job_id=''
+if [[ -f "$REQUEST_FILE" && ! -L "$REQUEST_FILE" ]]; then
+  job_id=$(sed -n 's/.*"jobId"[[:space:]]*:[[:space:]]*"\([0-9a-f-]*\)".*/\1/p' "$REQUEST_FILE" | head -n 1)
+fi
+STATE_CREATED=0
+heartbeat_pid=''
+heartbeat_owner=$$
+
+write_recovery_state() {
+  local phase=$1 temporary
+  temporary="$PREFIX/.update-state-$$-${RANDOM}.tmp"
+  [[ ! -e "$temporary" && ! -L "$temporary" ]] || return 1
+  printf 'job_id=%s\nold_target=%s\nphase=%s\n' "$job_id" "$old_target" "$phase" > "$temporary"
+  chmod 600 "$temporary"
+  mv -Tf -- "$temporary" "$STATE_FILE"
+  STATE_CREATED=1
+}
+
+clear_recovery_state() {
+  [[ ! -L "$STATE_FILE" ]] || return 1
+  rm -f -- "$STATE_FILE"
+  STATE_CREATED=0
+}
+
+stop_heartbeat() {
+  if [[ -n "$heartbeat_pid" ]]; then
+    kill "$heartbeat_pid" 2>/dev/null || true
+    wait "$heartbeat_pid" 2>/dev/null || true
+    heartbeat_pid=''
+  fi
+}
+
+heartbeat() {
+  # Keep the lease fresh during long downloads/backups, but stop on a hard
+  # runner kill so an orphaned child cannot keep the recovery marker alive.
+  while kill -0 "$heartbeat_owner" 2>/dev/null; do
+    sleep 10 || exit 0
+    [[ -f "$STATE_FILE" && ! -L "$STATE_FILE" ]] || exit 0
+    touch "$STATE_FILE" 2>/dev/null || exit 0
+  done
+}
+
+start_heartbeat() {
+  stop_heartbeat
+  heartbeat &
+  heartbeat_pid=$!
+}
+
+# This trap covers failures before the normal apply cleanup trap is installed,
+# including a missing runtime, an invalid current link, and a failed service
+# stop. It deliberately does not remove a pre-existing recovery marker.
+preflight_cleanup() {
+  local result=$?
+  stop_heartbeat
+  if (( result != 0 )); then
+    rm -f -- "$REQUEST_FILE" 2>/dev/null || true
+    if (( STATE_CREATED == 1 )); then clear_recovery_state || true; fi
+  fi
+  return "$result"
+}
+trap preflight_cleanup EXIT
+
 # Downloading is intentionally handled while the main service remains up.
 # The CLI persists the validated payload under the root-owned workspace and
 # leaves the job staged for a later apply request.
 if [[ "$request_operation" == download ]]; then
+  # A previous download runner may have been interrupted after creating its
+  # marker. Clear only that download marker and retry the idempotent request.
+  if [[ -f "$STATE_FILE" && ! -L "$STATE_FILE" ]] && grep -q '^phase=download$' "$STATE_FILE"; then
+    clear_recovery_state || die '无法清理上一次下载状态'
+  fi
+  write_recovery_state download || die '无法写入更新恢复状态'
+  cleanup_download() {
+    local result=$?
+    stop_heartbeat
+    if (( result != 0 )); then
+      # The CLI normally records failed itself. If it died before opening the
+      # database, the expired marker/request will be reconciled by the app.
+      rm -f -- "$REQUEST_FILE" 2>/dev/null || true
+    fi
+    clear_recovery_state || true
+    return "$result"
+  }
+  trap cleanup_download EXIT
+  trap 'exit 143' TERM
+  trap 'exit 130' INT
+  start_heartbeat
   node_bin="$CURRENT_LINK/runtime/bin/node"
   [[ -x "$node_bin" ]] || node_bin=$(command -v node || true)
   [[ -n "$node_bin" ]] || die 'node runtime not found'
@@ -69,34 +155,21 @@ if systemctl is-active --quiet "$SERVICE_NAME"; then was_active=1; fi
 # shellcheck disable=SC2329 # invoked indirectly by the EXIT trap below
 restore_initial_service() {
   local result=$?
+  stop_heartbeat
+  if (( result != 0 )); then
+    rm -f -- "$REQUEST_FILE" 2>/dev/null || true
+    if (( STATE_CREATED == 1 )); then clear_recovery_state || true; fi
+  fi
   if (( was_active )); then systemctl start "$SERVICE_NAME" || true; fi
   return "$result"
 }
 trap restore_initial_service EXIT
-systemctl stop "$SERVICE_NAME"
-
-job_id=''
-if [[ -f "$REQUEST_FILE" && ! -L "$REQUEST_FILE" ]]; then
-  job_id=$(sed -n 's/.*"jobId"[[:space:]]*:[[:space:]]*"\([0-9a-f-]*\)".*/\1/p' "$REQUEST_FILE" | head -n 1)
-fi
 old_node="$CURRENT_LINK/runtime/bin/node"
 [[ -x "$old_node" ]] || old_node=$(command -v node || true)
-switched=0
 handled=0
 
-write_update_state() {
-  local phase=$1 temporary
-  temporary="$PREFIX/.update-state-$$-${RANDOM}.tmp"
-  [[ ! -e "$temporary" && ! -L "$temporary" ]] || return 1
-  printf 'job_id=%s\nold_target=%s\nphase=%s\n' "$job_id" "$old_target" "$phase" > "$temporary"
-  chmod 600 "$temporary"
-  mv -Tf -- "$temporary" "$STATE_FILE"
-}
-
-clear_update_state() {
-  [[ ! -L "$STATE_FILE" ]] || return 1
-  rm -f -- "$STATE_FILE"
-}
+write_update_state() { write_recovery_state "$1"; }
+clear_update_state() { clear_recovery_state; }
 
 finalize_state_job() {
   local node=$1 status=$2 state_job=$3
@@ -117,6 +190,15 @@ recover_stale_state() {
   [[ "$state_job" =~ ^[0-9a-f-]{36}$ ]] || die 'update state job id is invalid'
   [[ "$state_old" == "$PREFIX/releases/"* && -d "$state_old" && ! -L "$state_old" ]] || die 'update state target is invalid'
   current_target=$(readlink -f -- "$CURRENT_LINK" 2>/dev/null || true)
+  if [[ "$state_phase" == download && "$current_target" == "$state_old" ]]; then
+    # Downloading never changes the active release. If the runner was killed
+    # after the CLI staged its payload but before it removed the recovery
+    # marker, keep the request available for an idempotent retry. Treating
+    # every stale download marker as a failed apply would discard a usable
+    # staged payload and leave the browser showing a misleading failure.
+    clear_update_state || true
+    return 0
+  fi
   if [[ "$state_phase" == finalizing && "$current_target" != "$state_old" ]]; then
     recovery_node="$CURRENT_LINK/runtime/bin/node"
     [[ -x "$recovery_node" ]] || recovery_node=$(command -v node || true)
@@ -195,13 +277,24 @@ fi
 
 [[ -f "$REQUEST_FILE" && ! -L "$REQUEST_FILE" ]] || exit 0
 
+# Only create the marker for this invocation after any marker from a previous
+# interrupted run has been reconciled. Otherwise the freshly-created `running`
+# marker is indistinguishable from stale recovery state and the runner can
+# finalize its own queued job as failed before the update CLI starts.
+if [[ ! -e "$STATE_FILE" ]]; then
+  write_recovery_state running || die '无法写入更新恢复状态'
+fi
+start_heartbeat
+if ! systemctl stop "$SERVICE_NAME"; then
+  die '无法停止 TallyNote 服务'
+fi
+
 rollback_current() {
   local current_target rollback_link
   current_target=$(readlink -f -- "$CURRENT_LINK" 2>/dev/null || true)
   if [[ "$current_target" == "$old_target" ]]; then
     # An earlier failure branch may already have restored the link. Keep the
     # marker truthful so the EXIT trap can still finalize the job.
-    switched=0
     return 0
   fi
   rollback_link="$PREFIX/.current-rollback-$$-${RANDOM}.tmp"
@@ -211,7 +304,6 @@ rollback_current() {
     rm -f -- "$rollback_link" 2>/dev/null || true
     return 1
   fi
-  switched=0
 }
 
 finalize_failed_job() {
@@ -237,6 +329,7 @@ finalize_completed_job() {
 # shellcheck disable=SC2329 # invoked indirectly by the EXIT trap below
 cleanup_after_update() {
   local result=$? rollback_ok=1
+  stop_heartbeat
   if (( result != 0 && handled == 0 )); then
     if ! rollback_current; then rollback_ok=0; fi
     # Once the old release is active again, always try to close the job. The
@@ -258,7 +351,6 @@ cleanup_after_update() {
 }
 trap cleanup_after_update EXIT
 
-write_update_state running || exit 1
 node_bin="$CURRENT_LINK/runtime/bin/node"
 [[ -x "$node_bin" ]] || node_bin=$(command -v node || true)
 [[ -n "$node_bin" ]] || die 'node runtime not found'
@@ -273,9 +365,6 @@ if (( update_result != 0 )); then
   exit "$update_result"
 fi
 
-if [[ "$(readlink -f -- "$CURRENT_LINK" 2>/dev/null || true)" != "$old_target" ]]; then
-  switched=1
-fi
 write_update_state health-check || exit 1
 
 systemctl start "$SERVICE_NAME"

scripts/test-installer.sh

@@ -88,6 +88,12 @@ bash -c '
   chmod 700 "$mode_dir"
   [[ "$(stat_mode_bits "$mode_dir")" == 448 ]]
   mkdir -p "$owner_parent"
+  # CI runs this shell suite as root. Make the parent genuinely non-root in
+  # that environment so the assertion exercises the ownership guard instead
+  # of accidentally passing because root-owned parents are allowed.
+  if [[ "${EUID:-$(id -u)}" == 0 ]]; then
+    chown 65534:65534 "$owner_parent"
+  fi
   if (assert_path_chain "$owner_parent/child") >/dev/null 2>&1; then
     echo "expected non-root path parent to fail" >&2
     exit 1
@@ -160,6 +166,69 @@ bash -c '
   wait_for_service_health 0.0.0.0 3011
 ' _ "$installer_lib"
 
+# Exercise the privileged runner's normal apply hand-off with portable command
+# shims. In particular, the freshly-created running marker must not be treated
+# as stale state before the update CLI gets a chance to process the request.
+runner_root="$tmp/runner"
+runner_prefix="$runner_root/prefix"
+runner_data="$runner_root/data"
+runner_tools="$runner_root/tools"
+mkdir -p "$runner_prefix/releases/1.0.0/runtime/bin" "$runner_prefix/releases/1.0.0/dist/server/cli" "$runner_data" "$runner_tools"
+ln -s "$runner_prefix/releases/1.0.0" "$runner_prefix/current"
+printf '%s\n' '{"jobId":"00000000-0000-4000-8000-000000000001","operation":"apply"}' > "$runner_data/update-request.json"
+printf '%s\n' '#!/usr/bin/env bash' 'printf "%s\\n" "$*" >> "$TALLYNOTE_NODE_TRACE"' 'exit 0' > "$runner_prefix/releases/1.0.0/runtime/bin/node"
+printf '%s\n' cli > "$runner_prefix/releases/1.0.0/dist/server/cli/update.js"
+printf '%s\n' '#!/usr/bin/env bash' 'case "${1:-}" in is-active) exit 0;; *) exit 0;; esac' > "$runner_tools/systemctl"
+printf '%s\n' '#!/usr/bin/env bash' 'if [[ "${1:-}" == "-f" ]]; then shift; [[ "${1:-}" == "--" ]] && shift; /bin/realpath "$1"; else /usr/bin/readlink "$@"; fi' > "$runner_tools/readlink"
+printf '%s\n' '#!/usr/bin/env bash' 'if [[ "${1:-}" == "-Tf" ]]; then shift; /bin/mv -f "$@"; else /bin/mv "$@"; fi' > "$runner_tools/mv"
+printf '%s\n' '#!/usr/bin/env bash' 'exit 0' > "$runner_tools/curl"
+chmod 755 "$runner_prefix/releases/1.0.0/runtime/bin/node" "$runner_tools/systemctl" "$runner_tools/readlink" "$runner_tools/mv" "$runner_tools/curl"
+runner_script="$runner_root/runner.sh"
+runner_path="$runner_tools:/usr/sbin:/usr/bin:/sbin:/bin"
+sed "s#PATH=/usr/sbin:/usr/bin:/sbin:/bin#PATH=$runner_path#" "$root/scripts/tallynote-update-runner.sh" > "$runner_script"
+chmod 755 "$runner_script"
+runner_prefix_physical=$(cd "$runner_prefix" && pwd -P)
+runner_data_physical=$(cd "$runner_data" && pwd -P)
+env EUID=0 TALLYNOTE_INSTALL_PREFIX="$runner_prefix_physical" TALLYNOTE_DATA_DIR="$runner_data_physical" TALLYNOTE_NODE_TRACE="$runner_root/node.log" bash "$runner_script"
+grep -q -- '--request-file' "$runner_root/node.log"
+grep -q -- '--finalize-job' "$runner_root/node.log"
+[[ ! -e "$runner_data/update-request.json" ]]
+[[ ! -e "$runner_prefix/.update-state" ]]
+
+# A stale download marker must be recoverable without finalizing the staged
+# download as a failed apply. The next runner invocation should retry the
+# request and let the CLI preserve/refresh its staged workspace.
+download_runner_root="$tmp/download-runner"
+download_runner_prefix="$download_runner_root/prefix"
+download_runner_data="$download_runner_root/data"
+download_runner_tools="$download_runner_root/tools"
+mkdir -p "$download_runner_prefix/releases/1.0.0/runtime/bin" "$download_runner_prefix/releases/1.0.0/dist/server/cli" "$download_runner_data" "$download_runner_tools"
+ln -s "$download_runner_prefix/releases/1.0.0" "$download_runner_prefix/current"
+# The request has already been consumed; only the stale download marker is
+# left, which is the narrow recovery window covered by this fixture.
+download_runner_prefix_physical=$(cd "$download_runner_prefix" && pwd -P)
+download_runner_data_physical=$(cd "$download_runner_data" && pwd -P)
+printf '%s\n' 'job_id=00000000-0000-4000-8000-000000000002' "old_target=$download_runner_prefix_physical/releases/1.0.0" 'phase=download' > "$download_runner_prefix/.update-state"
+printf '%s\n' '#!/usr/bin/env bash' 'printf "%s\n" "$*" >> "$TALLYNOTE_DOWNLOAD_NODE_TRACE"' 'exit 0' > "$download_runner_prefix/releases/1.0.0/runtime/bin/node"
+printf '%s\n' cli > "$download_runner_prefix/releases/1.0.0/dist/server/cli/update.js"
+printf '%s\n' '#!/usr/bin/env bash' 'case "${1:-}" in is-active) exit 0;; *) exit 0;; esac' > "$download_runner_tools/systemctl"
+printf '%s\n' '#!/usr/bin/env bash' 'if [[ "${1:-}" == "-f" ]]; then shift; [[ "${1:-}" == "--" ]] && shift; /bin/realpath "$1"; else /usr/bin/readlink "$@"; fi' > "$download_runner_tools/readlink"
+cat >"$download_runner_tools/stat" <<'EOF'
+#!/usr/bin/env bash
+case "$*" in
+  *"-c %u"*|*"-f %u"*) printf '0\n' ;;
+  *"-c %a"*|*"-f %Lp"*) printf '600\n' ;;
+  *) /usr/bin/stat "$@" ;;
+esac
+EOF
+chmod 755 "$download_runner_prefix/releases/1.0.0/runtime/bin/node" "$download_runner_tools/systemctl" "$download_runner_tools/readlink" "$download_runner_tools/stat"
+download_runner_script="$download_runner_root/runner.sh"
+sed "s#PATH=/usr/sbin:/usr/bin:/sbin:/bin#PATH=$download_runner_tools:/usr/sbin:/usr/bin:/sbin:/bin#" "$root/scripts/tallynote-update-runner.sh" > "$download_runner_script"
+chmod 755 "$download_runner_script"
+env EUID=0 TALLYNOTE_INSTALL_PREFIX="$download_runner_prefix_physical" TALLYNOTE_DATA_DIR="$download_runner_data_physical" TALLYNOTE_DOWNLOAD_NODE_TRACE="$download_runner_root/node.log" bash "$download_runner_script"
+[[ ! -e "$download_runner_root/node.log" ]]
+[[ ! -e "$download_runner_prefix/.update-state" ]]
+
 # A RETURN trap installed by install_release must be cleared while its local
 # temporary variables still exist; otherwise set -u fails at the end of main.
 release_fixture="$tmp/release-fixture"
@@ -218,7 +287,11 @@ ln -s "$wrapper_prefix/releases/1.0.0" "$wrapper_prefix/current"
 printf '%s\n' '#!/usr/bin/env bash' 'pwd -P > "$TALLYNOTE_WRAPPER_LOG"' 'printf "%s\n" "$@" >> "$TALLYNOTE_WRAPPER_LOG"' > "$wrapper_prefix/releases/1.0.0/runtime/bin/node"
 chmod 755 "$wrapper_prefix/releases/1.0.0/runtime/bin/node"
 printf '%s\n' cli > "$wrapper_prefix/releases/1.0.0/dist/server/cli/admin-init.js"
-TALLYNOTE_INSTALL_PREFIX="$wrapper_prefix" TALLYNOTE_CONFIG_DIR="$tmp/no-config" TALLYNOTE_WRAPPER_LOG="$tmp/wrapper.log" \
+# This fixture verifies release-relative execution and argument forwarding.
+# Force the wrapper's non-root branch so the root CI runner does not need a
+# real `tallynote` service account or a privileged runuser hand-off; that
+# privilege boundary is validated by the production checks themselves.
+env EUID=1000 TALLYNOTE_INSTALL_PREFIX="$wrapper_prefix" TALLYNOTE_CONFIG_DIR="$tmp/no-config" TALLYNOTE_WRAPPER_LOG="$tmp/wrapper.log" \
   bash "$root/bin/tallynote-admin-init" --generate
 wrapper_expected_root=$(cd "$wrapper_prefix/releases/1.0.0" && pwd -P)
 grep -Fxq "$wrapper_expected_root" "$tmp/wrapper.log"
@@ -385,6 +458,9 @@ bash -c '
   stat_uid() { printf "0"; }
   stat_mode_bits() { printf "384"; }
   validate_public_origin "http://[2001:db8::10]:3000"
+  # A standard HTTPS origin may omit its default port; this must remain valid
+  # under the installer strict unset-variable mode.
+  validate_public_origin "https://example.test"
 ' _ "$installer_lib"
 printf '%s\n' \
   'TALLYNOTE_HOST=0.0.0.0' \

server/app.ts

@@ -119,7 +119,7 @@ function enforceUpdateCooldown(
   adminId: string,
   operation: "check" | "download" | "apply",
   reply: FastifyReply,
-): void {
+): number {
   const state = updateRateState(database, adminId);
   const now = Date.now();
   const previous = operation === "check" ? state.checkedAt : operation === "download" ? state.downloadedAt : state.appliedAt;
@@ -134,6 +134,7 @@ function enforceUpdateCooldown(
   if (operation === "check") state.checkedAt = now;
   else if (operation === "download") state.downloadedAt = now;
   else state.appliedAt = now;
+  return now;
 }
 
 function adminSelect(alias = ""): string {
@@ -650,7 +651,7 @@ export async function buildApp(database: DatabaseContext, config: AppConfig) {
   app.addHook("onRequest", async (request) => {
     if (!unsafeMethods.has(request.method) || !request.url.startsWith("/api/")) return;
     const origin = request.headers.origin;
-    const allowed = new Set([config.publicOrigin]);
+    const allowed = new Set(config.allowedOrigins);
     if (!config.isProduction) {
       allowed.add("http://127.0.0.1:5173");
       allowed.add("http://localhost:5173");
@@ -946,6 +947,8 @@ export async function buildApp(database: DatabaseContext, config: AppConfig) {
       SELECT id, operation, status, version, platform, asset_name AS assetName,
         size_bytes AS sizeBytes, error_message AS errorMessage,
         created_at AS createdAt, updated_at AS updatedAt, completed_at AS completedAt,
+        downloaded_bytes AS downloadedBytes, download_started_at AS downloadStartedAt,
+        download_speed_bps AS downloadSpeedBps,
         requested_at AS applyQueuedAt
       FROM update_jobs WHERE admin_id=? ORDER BY created_at DESC LIMIT 1
     `).get(request.auth!.admin.id) as Record<string, unknown> | undefined;
@@ -957,12 +960,15 @@ export async function buildApp(database: DatabaseContext, config: AppConfig) {
   });
 
   app.post("/api/update/check", { preHandler: guard(database, config), bodyLimit: 32 * 1024 }, async (request, reply) => {
+    const rateState = updateRateState(database.sqlite, request.auth!.admin.id);
+    const previousCheckedAt = rateState.checkedAt;
+    let reservedCheckedAt: number | null = null;
     try {
       reconcileOrphanedUpdateJobs(database.sqlite, config);
       // Disabled/dev installs do not contact a release endpoint, so repeated
       // checks are local status reads and should remain immediately usable.
       if (config.updateStrategy !== "disabled") {
-        enforceUpdateCooldown(database.sqlite, config, request.auth!.admin.id, "check", reply);
+        reservedCheckedAt = enforceUpdateCooldown(database.sqlite, config, request.auth!.admin.id, "check", reply);
       }
       const result = await checkForUpdate(database.sqlite, config);
       writeAudit(database.sqlite, {
@@ -981,6 +987,10 @@ export async function buildApp(database: DatabaseContext, config: AppConfig) {
       reply.header("Cache-Control", "no-store");
       return { ...result, strategy: config.updateStrategy };
     } catch (error) {
+      // A failed upstream request is not a successful check. Release the
+      // reservation only when this request still owns it, so a concurrent
+      // successful check cannot have its cooldown overwritten.
+      if (reservedCheckedAt !== null && rateState.checkedAt === reservedCheckedAt) rateState.checkedAt = previousCheckedAt;
       writeAudit(database.sqlite, {
         requestId: request.id,
         actorAdminId: request.auth!.admin.id,
@@ -1185,6 +1195,8 @@ export async function buildApp(database: DatabaseContext, config: AppConfig) {
       SELECT id, operation, status, version, platform, asset_name AS assetName,
         size_bytes AS sizeBytes, error_message AS errorMessage,
         created_at AS createdAt, updated_at AS updatedAt, completed_at AS completedAt,
+        downloaded_bytes AS downloadedBytes, download_started_at AS downloadStartedAt,
+        download_speed_bps AS downloadSpeedBps,
         requested_at AS applyQueuedAt
       FROM update_jobs WHERE id=? AND admin_id=?
     `).get(id, request.auth!.admin.id) as Record<string, unknown> | undefined;

server/cli/update.ts

@@ -291,7 +291,24 @@ export async function runUpdate(options: UpdateRunOptions): Promise<UpdateRunRes
     const archivePath = path.join(workspace, resolved.asset.name.endsWith(".gz") || resolved.asset.name.endsWith(".zip") ? resolved.asset.name : `${resolved.asset.name}.tar.gz`);
     try {
       updateJob(options.sqlite, jobId, { operation, status: "downloading", version: resolved.version, platform: platform.target, releaseUrl: resolved.releaseUrl, assetName: resolved.asset.name, assetUrl: resolved.asset.url, expectedSha256, downloadPath: path.basename(archivePath), startedAt: Date.now() });
-      const downloaded = await downloadReleaseAsset(resolved.asset.url, archivePath, options);
+      const progressStartedAt = Date.now();
+      let lastProgressWrite = 0;
+      const downloaded = await downloadReleaseAsset(resolved.asset.url, archivePath, {
+        ...options,
+        onProgress: (downloadedBytes, totalBytes) => {
+          const now = Date.now();
+          if (!options.sqlite || now - lastProgressWrite < 250) return;
+          lastProgressWrite = now;
+          const elapsed = Math.max(1, now - progressStartedAt);
+          const speedBps = Math.round(downloadedBytes * 1000 / elapsed);
+          options.sqlite.prepare("UPDATE update_jobs SET downloaded_bytes=?, size_bytes=COALESCE(?, size_bytes), download_started_at=?, download_speed_bps=?, updated_at=? WHERE id=? AND status='downloading'").run(downloadedBytes, totalBytes, progressStartedAt, speedBps, now, jobId);
+        },
+      });
+      if (options.sqlite) {
+        const finishedAt = Date.now();
+        const elapsed = Math.max(1, finishedAt - progressStartedAt);
+        options.sqlite.prepare("UPDATE update_jobs SET downloaded_bytes=?, size_bytes=?, download_started_at=?, download_speed_bps=?, updated_at=? WHERE id=? AND status='downloading'").run(downloaded.size, downloaded.size, progressStartedAt, Math.round(downloaded.size * 1000 / elapsed), finishedAt, jobId);
+      }
       if (expectedSha256 && downloaded.sha256 !== expectedSha256) throw new Error("更新文件 SHA-256 校验失败");
       updateJob(options.sqlite, jobId, { operation, status: "verifying", version: resolved.version, platform: platform.target, releaseUrl: resolved.releaseUrl, assetName: resolved.asset.name, assetUrl: resolved.asset.url, expectedSha256, actualSha256: downloaded.sha256, sizeBytes: downloaded.size, downloadPath: path.basename(archivePath) });
       if (!archivePath.endsWith(".tar.gz") && !archivePath.endsWith(".tgz") && !archivePath.endsWith(".tar") && !archivePath.endsWith(".zip")) throw new Error("更新文件格式仅支持 tar.gz、tar 或 zip");

server/config.ts

@@ -43,6 +43,21 @@ function csvEnv(name: string): string[] {
     .filter(Boolean);
 }
 
+function originListEnv(name: string, primary: string): string[] {
+  const values = [primary, ...csvEnv(name)];
+  const origins = new Set<string>();
+  for (const value of values) {
+    try {
+      const parsed = new URL(value);
+      if (!["http:", "https:"].includes(parsed.protocol) || parsed.username || parsed.password || parsed.pathname !== "/" && parsed.pathname !== "" || parsed.search || parsed.hash) throw new Error();
+      origins.add(parsed.origin);
+    } catch {
+      throw new Error(`${name} 必须是逗号分隔的 HTTP(S) Origin（不含路径）`);
+    }
+  }
+  return [...origins];
+}
+
 function updatePublicKeyEnv(): string | undefined {
   const inline = process.env.TALLYNOTE_UPDATE_PUBLIC_KEY?.trim();
   const file = process.env.TALLYNOTE_UPDATE_PUBLIC_KEY_FILE?.trim();
@@ -98,6 +113,7 @@ export function loadConfig() {
     throw new Error("TALLYNOTE_PUBLIC_ORIGIN 不能使用通配监听地址，请填写服务器 IP 或域名");
   }
   const localOrigin = ["127.0.0.1", "localhost", "::1"].includes(publicHost);
+  const allowedOrigins = originListEnv("TALLYNOTE_ALLOWED_ORIGINS", parsedOrigin.origin);
   const appVersion = (() => {
     try {
       const packageJson = JSON.parse(readFileSync(path.join(projectRoot, "package.json"), "utf8")) as { version?: unknown };
@@ -127,6 +143,7 @@ export function loadConfig() {
     host,
     port,
     publicOrigin: parsedOrigin.origin,
+    allowedOrigins,
     timezone,
     trustProxy: trustProxyEnv(),
     cookieSecure,

server/db/schema.ts

@@ -148,6 +148,9 @@ export const updateJobs = sqliteTable("update_jobs", {
   downloadPath: text("download_path"),
   backupPath: text("backup_path"),
   sizeBytes: integer("size_bytes"),
+  downloadedBytes: integer("downloaded_bytes"),
+  downloadStartedAt: integer("download_started_at"),
+  downloadSpeedBps: integer("download_speed_bps"),
   errorMessage: text("error_message"),
   createdAt: integer("created_at").notNull(),
   requestedAt: integer("requested_at"),

server/index.ts

@@ -3,6 +3,7 @@ import { loadConfig, prepareDataDirectories, acquireInstanceLock } from "./confi
 import { openDatabase } from "./db/index.js";
 import { buildApp } from "./app.js";
 import { cleanupOrphanedExports, expireExports, resumeExports } from "./exporter.js";
+import { reconcileOrphanedUpdateJobs } from "./update-service.js";
 
 const config = loadConfig();
 prepareDataDirectories(config);
@@ -18,6 +19,7 @@ async function start() {
   await expireExports(database.sqlite, config);
   await cleanupOrphanedExports(database.sqlite, config);
   await resumeExports(database.sqlite, config);
+  reconcileOrphanedUpdateJobs(database.sqlite, config);
   const app = await buildApp(database, config);
   const janitor = setInterval(() => {
     void cleanupStaging(config);
@@ -27,6 +29,7 @@ async function start() {
     void processFileDeletions(database.sqlite, config);
     void expireExports(database.sqlite, config);
     void cleanupOrphanedExports(database.sqlite, config);
+    reconcileOrphanedUpdateJobs(database.sqlite, config);
   }, 60_000);
   const shutdown = async () => {
     clearInterval(janitor);

server/update-service.ts

@@ -1,4 +1,4 @@
-import { lstatSync, realpathSync } from "node:fs";
+import { lstatSync, realpathSync, readFileSync, unlinkSync } from "node:fs";
 import { chmod, mkdir, rename, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { createPublicKey, randomUUID, verify as verifySignature } from "node:crypto";
@@ -33,9 +33,9 @@ export const ACTIVE_UPDATE_STATUSES: readonly UpdateJobStatus[] = [
 ];
 
 // A queued job normally starts within seconds and an applying job completes
-// after the service health check. This grace period only applies when both
-// hand-off markers are gone, so an active runner is never reclaimed midway
-// through a download, backup, or switch.
+// after the service health check. The runner refreshes its recovery marker as
+// a lease while doing long downloads/backups; only an expired lease permits
+// the server to reclaim an active row.
 export const ORPHANED_UPDATE_TIMEOUT_MS = 5 * 60 * 1000;
 
 export type CachedRelease = {
@@ -351,6 +351,9 @@ export function publicUpdateJob(row: Record<string, unknown> | undefined): Recor
     platform: row.platform,
     assetName: row.assetName ?? null,
     sizeBytes: row.sizeBytes ?? null,
+    downloadedBytes: row.downloadedBytes ?? null,
+    downloadStartedAt: row.downloadStartedAt ?? null,
+    downloadSpeedBps: row.downloadSpeedBps ?? null,
     // Do not expose filesystem paths, command output, or upstream response
     // text through the authenticated status endpoint. Detailed diagnostics
     // remain in the server journal for operators.
@@ -364,12 +367,35 @@ export function publicUpdateJob(row: Record<string, unknown> | undefined): Recor
   };
 }
 
-function markerExists(filePath: string): boolean {
+function markerMtime(filePath: string): number | null {
   try {
     const info = lstatSync(filePath);
-    return info.isFile() || info.isSymbolicLink();
+    return info.isFile() ? info.mtimeMs : null;
   } catch {
-    return false;
+    return null;
+  }
+}
+
+function removeExpiredRequest(filePath: string, now: number): void {
+  try {
+    const info = lstatSync(filePath);
+    if (!info.isFile() && !info.isSymbolicLink()) return;
+    if (now - info.mtimeMs < ORPHANED_UPDATE_TIMEOUT_MS) return;
+    unlinkSync(filePath);
+  } catch {
+    // The root runner may own the marker during a recovery race. The DB
+    // transition below is still enough to release the browser queue.
+  }
+}
+
+function requestJobId(filePath: string): string | null {
+  try {
+    const info = lstatSync(filePath);
+    if (!info.isFile() || info.isSymbolicLink()) return null;
+    const value = JSON.parse(readFileSync(filePath, "utf8")) as { jobId?: unknown };
+    return typeof value.jobId === "string" && /^[0-9a-f-]{36}$/.test(value.jobId) ? value.jobId : null;
+  } catch {
+    return null;
   }
 }
 
@@ -385,28 +411,68 @@ function currentReleaseVersion(config: AppConfig): string | null {
 }
 
 /**
- * Release an update row left behind after both privileged hand-off markers
- * disappeared. This is deliberately conservative: staged downloads remain
- * available for an explicit apply, and any visible marker means the runner
- * still owns recovery.
+ * Release an update row left behind after its privileged runner lease expired.
+ * This is deliberately conservative: staged downloads remain available for an
+ * explicit apply, and a fresh request/state marker means the runner still owns
+ * recovery.
  */
 export function reconcileOrphanedUpdateJobs(database: Database.Database, config: AppConfig, now = Date.now()): number {
   const placeholders = ACTIVE_UPDATE_STATUSES.map(() => "?").join(",");
   const rows = database.prepare(`
-    SELECT id, status, version, admin_id AS adminId, request_id AS requestId,
+    SELECT id, status, operation, version, admin_id AS adminId, request_id AS requestId,
       updated_at AS updatedAt
     FROM update_jobs
     WHERE status IN (${placeholders})
     ORDER BY updated_at ASC
-  `).all(...ACTIVE_UPDATE_STATUSES) as Array<{ id: string; status: UpdateJobStatus; version: string; adminId: string | null; requestId: string | null; updatedAt: number | null }>;
+  `).all(...ACTIVE_UPDATE_STATUSES) as Array<{ id: string; status: UpdateJobStatus; operation: "download" | "apply"; version: string; adminId: string | null; requestId: string | null; updatedAt: number | null }>;
   if (rows.length === 0) return 0;
-  const requestPresent = markerExists(config.updateRequestPath);
-  const statePresent = markerExists(path.join(config.installPrefix, ".update-state"));
-  if (requestPresent || statePresent) return 0;
+  const statePath = path.join(config.installPrefix, ".update-state");
+  const requestMtime = markerMtime(config.updateRequestPath);
+  const stateMtime = markerMtime(statePath);
+  const requestPresent = requestMtime !== null;
+  const statePresent = stateMtime !== null;
+  const requestFresh = requestPresent && now - (requestMtime ?? 0) < ORPHANED_UPDATE_TIMEOUT_MS;
+  const stateFresh = statePresent && now - (stateMtime ?? 0) < ORPHANED_UPDATE_TIMEOUT_MS;
+  // A staged download is normally kept for an explicit apply. The one
+  // exception is the hand-off window where the API has already changed the
+  // operation to `apply` but crashed before writing the request file. That
+  // row is still safe to retry and must not block the queue forever.
   const releaseVersion = currentReleaseVersion(config);
   let reconciled = 0;
+  const reconciledIds = new Set<string>();
   for (const row of rows) {
-    if (row.status === "staged" || typeof row.updatedAt !== "number" || now - row.updatedAt < ORPHANED_UPDATE_TIMEOUT_MS) continue;
+    if (typeof row.updatedAt !== "number" || now - row.updatedAt < ORPHANED_UPDATE_TIMEOUT_MS) continue;
+    // The runner refreshes the state marker while a download is in flight.
+    // A stale request/state marker therefore no longer protects an orphaned
+    // row forever, while a fresh marker remains owned by the runner.
+    if (row.status === "staged") {
+      if (row.operation !== "apply" || requestFresh || stateFresh) continue;
+      const changed = database.transaction(() => {
+        const result = database.prepare(`
+          UPDATE update_jobs
+          SET operation='download', error_message=NULL, updated_at=?
+          WHERE id=? AND status='staged' AND operation='apply' AND updated_at=?
+        `).run(now, row.id, row.updatedAt);
+        if (result.changes !== 1) return false;
+        writeAudit(database, {
+          requestId: row.requestId || randomUUID(),
+          actorAdminId: row.adminId,
+          action: "update.reconciled",
+          targetType: "update",
+          targetId: row.id,
+          outcome: "success",
+          before: { status: row.status, operation: row.operation, version: row.version },
+          after: { status: "staged", operation: "download", version: row.version, reason: "apply_request_missing" },
+        });
+        return true;
+      })();
+      if (changed) {
+        reconciled += 1;
+        reconciledIds.add(row.id);
+      }
+      continue;
+    }
+    if (requestFresh || stateFresh) continue;
     const status: "completed" | "failed" = row.status === "applying" && releaseVersion === row.version ? "completed" : "failed";
     const errorMessage = status === "failed" ? "更新任务超时，已释放更新队列" : null;
     const changed = database.transaction(() => {
@@ -428,7 +494,29 @@ export function reconcileOrphanedUpdateJobs(database: Database.Database, config:
       });
       return true;
     })();
-    if (changed) reconciled += 1;
+    if (changed) {
+      reconciled += 1;
+      reconciledIds.add(row.id);
+    }
+  }
+  // Prevent a stale request from being replayed after its DB row has been
+  // marked failed. The path is fixed by the server configuration and the
+  // operation is safe even when a root runner is racing with this call.
+  // A download runner refreshes the state marker while it is still using the
+  // request. Keep the request until that lease also expires; otherwise a
+  // long download can lose its job id and fail to finalize its row.
+  const queuedRequestId = requestPresent ? requestJobId(config.updateRequestPath) : null;
+  const queuedRequest = queuedRequestId ? rows.find((row) => row.id === queuedRequestId) : undefined;
+  const requestStillNeeded = Boolean(
+    queuedRequest
+      && ACTIVE_UPDATE_STATUSES.includes(queuedRequest.status)
+      && !reconciledIds.has(queuedRequest.id)
+      && !(queuedRequest.status === "staged" && queuedRequest.operation === "download"),
+  );
+  if (!stateFresh
+    && (!requestPresent || (requestMtime !== null && now - requestMtime >= ORPHANED_UPDATE_TIMEOUT_MS))
+    && !requestStillNeeded) {
+    removeExpiredRequest(config.updateRequestPath, now);
   }
   return reconciled;
 }

server/update.ts

@@ -423,7 +423,7 @@ export async function verifySha256(filePath: string, expected: string): Promise<
 export async function downloadReleaseAsset(
   url: string | URL,
   destination: string,
-  options: UrlPolicy & { fetchImpl?: typeof fetch | undefined; maxBytes?: number | undefined } = {},
+  options: UrlPolicy & { fetchImpl?: typeof fetch | undefined; maxBytes?: number | undefined; onProgress?: ((downloadedBytes: number, totalBytes: number | null) => void) | undefined } = {},
 ): Promise<{ size: number; sha256: string }> {
   const fetchImpl = options.fetchImpl ?? fetch;
   let current = validateHttpsUrl(url, options);
@@ -446,6 +446,7 @@ export async function downloadReleaseAsset(
   }
   if (response.status < 200 || response.status >= 300 || !response.body) throw new Error("更新文件下载失败");
   const declared = Number(response.headers.get("content-length") ?? 0);
+  const totalBytes = Number.isSafeInteger(declared) && declared > 0 ? declared : null;
   const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
   if (declared > maxBytes) throw new Error("更新文件超过大小限制");
   await mkdir(path.dirname(destination), { recursive: true, mode: 0o700 });
@@ -454,6 +455,7 @@ export async function downloadReleaseAsset(
   const hash = createHash("sha256");
   const meter = new Transform({ transform(chunk: Buffer, _encoding, callback) {
     size += chunk.length;
+    options.onProgress?.(size, totalBytes);
     if (size > maxBytes) return callback(new Error("更新文件超过大小限制"));
     hash.update(chunk);
     callback(null, chunk);

systemd/tallynote.env.example

@@ -3,6 +3,7 @@ TALLYNOTE_PORT=3000
 TALLYNOTE_DATA_DIR=/var/lib/tallynote
 TALLYNOTE_INSTALL_PREFIX=/opt/tallynote
 TALLYNOTE_PUBLIC_ORIGIN=http://127.0.0.1:3000
+TALLYNOTE_ALLOWED_ORIGINS=http://127.0.0.1:3000
 TALLYNOTE_COOKIE_SECURE=false
 TALLYNOTE_ALLOW_INSECURE_HTTP=false
 TALLYNOTE_TIMEZONE=Asia/Shanghai

tests/migration.test.ts

@@ -42,9 +42,10 @@ describe("数据库迁移", () => {
         { name: "0002_update_jobs.sql" },
         { name: "0003_update_job_ownership.sql" },
         { name: "0004_update_download_apply.sql" },
+        { name: "0005_update_progress.sql" },
       ]);
       const updateColumns = migrated.sqlite.prepare("PRAGMA table_info(update_jobs)").all() as Array<{ name: string }>;
-      expect(updateColumns.map((column) => column.name)).toEqual(expect.arrayContaining(["admin_id", "session_hash", "request_id", "requested_at", "started_at", "operation"]));
+      expect(updateColumns.map((column) => column.name)).toEqual(expect.arrayContaining(["admin_id", "session_hash", "request_id", "requested_at", "started_at", "operation", "downloaded_bytes", "download_started_at", "download_speed_bps"]));
       expect(migrated.sqlite.prepare("SELECT note, invoice_missing_reason AS reason FROM expenses WHERE id='00000000-0000-4000-8000-000000000099'").get()).toEqual({ note: "旧账目", reason: null });
       migrated.sqlite.close();
       migrated = openDatabase(config);

tests/security.test.ts

@@ -5,7 +5,7 @@ import { tmpdir } from "node:os";
 import path from "node:path";
 import { loadConfig, prepareDataDirectories } from "../server/config.js";
 
-const keys = ["TALLYNOTE_DATA_DIR", "TALLYNOTE_HOST", "TALLYNOTE_PORT", "TALLYNOTE_PUBLIC_ORIGIN", "TALLYNOTE_COOKIE_SECURE", "TALLYNOTE_ALLOW_INSECURE_HTTP", "TALLYNOTE_TRUST_PROXY", "NODE_ENV", "TALLYNOTE_ENV", "TALLYNOTE_UPDATE_STRATEGY", "TALLYNOTE_UPDATE_ALLOWED_HOSTS", "TALLYNOTE_UPDATE_REQUIRE_SIGNATURE", "TALLYNOTE_UPDATE_PUBLIC_KEY", "TALLYNOTE_UPDATE_PUBLIC_KEY_FILE"];
+const keys = ["TALLYNOTE_DATA_DIR", "TALLYNOTE_HOST", "TALLYNOTE_PORT", "TALLYNOTE_PUBLIC_ORIGIN", "TALLYNOTE_ALLOWED_ORIGINS", "TALLYNOTE_COOKIE_SECURE", "TALLYNOTE_ALLOW_INSECURE_HTTP", "TALLYNOTE_TRUST_PROXY", "NODE_ENV", "TALLYNOTE_ENV", "TALLYNOTE_UPDATE_STRATEGY", "TALLYNOTE_UPDATE_ALLOWED_HOSTS", "TALLYNOTE_UPDATE_REQUIRE_SIGNATURE", "TALLYNOTE_UPDATE_PUBLIC_KEY", "TALLYNOTE_UPDATE_PUBLIC_KEY_FILE"];
 
 afterEach(() => { for (const key of keys) delete process.env[key]; });
 
@@ -48,6 +48,15 @@ describe("部署安全配置", () => {
     expect(loadConfig().trustProxy).toBe(1);
   });
 
+  it("允许显式列出反向代理的多个可信 Origin", () => {
+    process.env.TALLYNOTE_PUBLIC_ORIGIN = "https://tally.example.test";
+    process.env.TALLYNOTE_COOKIE_SECURE = "true";
+    process.env.TALLYNOTE_ALLOWED_ORIGINS = "https://tally.example.test, https://tally.internal.test:8443";
+    expect(loadConfig().allowedOrigins).toEqual(["https://tally.example.test", "https://tally.internal.test:8443"]);
+    process.env.TALLYNOTE_ALLOWED_ORIGINS = "https://tally.example.test/app";
+    expect(() => loadConfig()).toThrow(/Origin/);
+  });
+
   it("systemd 更新必须绑定主机白名单，签名校验默认关闭", () => {
     process.env.TALLYNOTE_UPDATE_STRATEGY = "systemd";
     process.env.TALLYNOTE_PUBLIC_ORIGIN = "https://example.test";

tests/update-api.test.ts

@@ -76,6 +76,12 @@ describe("更新 API", () => {
     expect(tooSoon.statusCode).toBe(429);
     expect(tooSoon.headers["retry-after"]).toBeDefined();
 
+    // Cooldown is scoped to the authenticated administrator, not the whole
+    // database or release endpoint.
+    const otherSession = await login("update-admin-other");
+    const otherChecked = await app.inject({ method: "POST", url: "/api/update/check", headers: { origin: config.publicOrigin, cookie: otherSession.cookies, "x-csrf-token": otherSession.csrf }, payload: {} });
+    expect(otherChecked.statusCode).toBe(200);
+
     const applied = await app.inject({ method: "POST", url: "/api/update/apply", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: { version: "1.2.0", confirm: true } });
     expect(applied.statusCode).toBe(202);
     const jobId = applied.json().job.id as string;
@@ -157,6 +163,12 @@ describe("更新 API", () => {
     globalThis.fetch = (async () => new Response("upstream unavailable", { status: 503 })) as typeof fetch;
     const response = await app.inject({ method: "POST", url: "/api/update/apply", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: { version: "1.2.0", confirm: true } });
     expect(response.statusCode).toBe(502);
+    // A failed upstream check must not reserve the per-admin cooldown; an
+    // operator can retry immediately after fixing the release endpoint.
+    const check = await app.inject({ method: "POST", url: "/api/update/check", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: {} });
+    expect(check.statusCode).toBe(502);
+    const retry = await app.inject({ method: "POST", url: "/api/update/check", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: {} });
+    expect(retry.statusCode).toBe(502);
     const audit = database.sqlite.prepare("SELECT outcome FROM audit_events WHERE action='update.apply_requested' ORDER BY id DESC LIMIT 1").get() as { outcome: string } | undefined;
     expect(audit?.outcome).toBe("failure");
   });

tests/update.test.ts

@@ -1,5 +1,5 @@
 import { afterEach, describe, expect, it } from "vitest";
-import { mkdir, readlink, symlink, writeFile, readFile, stat, readdir } from "node:fs/promises";
+import { mkdir, readlink, symlink, writeFile, readFile, stat, readdir, utimes } from "node:fs/promises";
 import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
@@ -309,14 +309,104 @@ describe("更新安全工具", () => {
       const queuedId = randomUUID();
       const applyingId = randomUUID();
       const stagedId = randomUUID();
+      const stagedApplyId = randomUUID();
       insert.run(queuedId, "apply", "queued", "1.2.0", "linux-x64", "https://updates.example/queued.tar.gz", staleAt, staleAt);
       insert.run(applyingId, "apply", "applying", config.appVersion, "linux-x64", "https://updates.example/applying.tar.gz", staleAt, staleAt);
       insert.run(stagedId, "download", "staged", "1.2.0", "linux-x64", "https://updates.example/staged.tar.gz", staleAt, staleAt);
+      insert.run(stagedApplyId, "apply", "staged", "1.2.0", "linux-x64", "https://updates.example/staged-apply.tar.gz", staleAt, staleAt);
       const now = Date.now();
-      expect(reconcileOrphanedUpdateJobs(database.sqlite, config, now)).toBe(2);
+      expect(reconcileOrphanedUpdateJobs(database.sqlite, config, now)).toBe(3);
       expect(database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(queuedId)).toEqual({ status: "failed" });
       expect(database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(applyingId)).toEqual({ status: "completed" });
-      expect(database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(stagedId)).toEqual({ status: "staged" });
+      expect(database.sqlite.prepare("SELECT status, operation FROM update_jobs WHERE id=?").get(stagedId)).toEqual({ status: "staged", operation: "download" });
+      expect(database.sqlite.prepare("SELECT status, operation FROM update_jobs WHERE id=?").get(stagedApplyId)).toEqual({ status: "staged", operation: "download" });
+    } finally {
+      if (database) database.sqlite.close();
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it("下载心跳有效时不回收任务或删除仍在使用的请求文件", async () => {
+    const root = await mkdtemp(path.join(tmpdir(), "tallynote-update-heartbeat-"));
+    let database: ReturnType<typeof openDatabase> | undefined;
+    try {
+      const dataDir = path.join(root, "data");
+      const installPrefix = path.join(root, "install");
+      process.env.TALLYNOTE_DATA_DIR = dataDir;
+      process.env.TALLYNOTE_INSTALL_PREFIX = installPrefix;
+      process.env.TALLYNOTE_PUBLIC_ORIGIN = "http://127.0.0.1:3998";
+      process.env.TALLYNOTE_COOKIE_SECURE = "false";
+      process.env.TALLYNOTE_UPDATE_STRATEGY = "systemd";
+      process.env.TALLYNOTE_UPDATE_METADATA_URL = "https://updates.example/latest";
+      process.env.TALLYNOTE_UPDATE_ALLOWED_HOSTS = "updates.example";
+      process.env.TALLYNOTE_UPDATE_REQUIRE_SIGNATURE = "false";
+      const config = loadConfig();
+      prepareDataDirectories(config);
+      await mkdir(path.join(config.releasesDir, config.appVersion, "dist"), { recursive: true });
+      await symlink(path.join(config.releasesDir, config.appVersion), config.currentLink);
+      database = openDatabase(config);
+      const staleAt = Date.now() - ORPHANED_UPDATE_TIMEOUT_MS - 1;
+      const jobId = randomUUID();
+      database.sqlite.prepare(`
+        INSERT INTO update_jobs(id, operation, status, version, platform, asset_url, created_at, updated_at)
+        VALUES (?, 'download', 'downloading', '1.2.0', 'linux-x64', ?, ?, ?)
+      `).run(jobId, "https://updates.example/download.tar.gz", staleAt, staleAt);
+      await writeFile(config.updateRequestPath, JSON.stringify({ jobId, operation: "download" }));
+      const statePath = path.join(config.installPrefix, ".update-state");
+      await writeFile(statePath, `job_id=${jobId}\nold_target=${path.join(config.releasesDir, config.appVersion)}\nphase=download\n`);
+      const now = Date.now();
+      await utimes(config.updateRequestPath, new Date(staleAt), new Date(staleAt));
+      await utimes(statePath, new Date(now), new Date(now));
+      expect(reconcileOrphanedUpdateJobs(database.sqlite, config, now)).toBe(0);
+      expect(database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(jobId)).toEqual({ status: "downloading" });
+      expect(await stat(config.updateRequestPath)).toBeTruthy();
+
+      const expiredNow = now + ORPHANED_UPDATE_TIMEOUT_MS + 1;
+      await utimes(statePath, new Date(staleAt), new Date(staleAt));
+      expect(reconcileOrphanedUpdateJobs(database.sqlite, config, expiredNow)).toBe(1);
+      expect(database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(jobId)).toEqual({ status: "failed" });
+      await expect(stat(config.updateRequestPath)).rejects.toThrow();
+    } finally {
+      if (database) database.sqlite.close();
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it("队列任务有新请求标记时可被重新检查，标记过期后才回收", async () => {
+    const root = await mkdtemp(path.join(tmpdir(), "tallynote-update-queued-marker-"));
+    let database: ReturnType<typeof openDatabase> | undefined;
+    try {
+      const dataDir = path.join(root, "data");
+      const installPrefix = path.join(root, "install");
+      process.env.TALLYNOTE_DATA_DIR = dataDir;
+      process.env.TALLYNOTE_INSTALL_PREFIX = installPrefix;
+      process.env.TALLYNOTE_PUBLIC_ORIGIN = "http://127.0.0.1:3998";
+      process.env.TALLYNOTE_COOKIE_SECURE = "false";
+      process.env.TALLYNOTE_UPDATE_STRATEGY = "systemd";
+      process.env.TALLYNOTE_UPDATE_METADATA_URL = "https://updates.example/latest";
+      process.env.TALLYNOTE_UPDATE_ALLOWED_HOSTS = "updates.example";
+      process.env.TALLYNOTE_UPDATE_REQUIRE_SIGNATURE = "false";
+      const config = loadConfig();
+      prepareDataDirectories(config);
+      database = openDatabase(config);
+      const staleAt = Date.now() - ORPHANED_UPDATE_TIMEOUT_MS - 1;
+      const jobId = randomUUID();
+      database.sqlite.prepare(`
+        INSERT INTO update_jobs(id, operation, status, version, platform, asset_url, created_at, updated_at)
+        VALUES (?, 'apply', 'queued', '1.2.0', 'linux-x64', ?, ?, ?)
+      `).run(jobId, "https://updates.example/queued.tar.gz", staleAt, staleAt);
+      await writeFile(config.updateRequestPath, JSON.stringify({ jobId, operation: "apply" }));
+      const now = Date.now();
+      await utimes(config.updateRequestPath, new Date(now), new Date(now));
+
+      expect(reconcileOrphanedUpdateJobs(database.sqlite, config, now)).toBe(0);
+      expect(database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(jobId)).toEqual({ status: "queued" });
+      expect(await stat(config.updateRequestPath)).toBeTruthy();
+
+      const expiredNow = now + ORPHANED_UPDATE_TIMEOUT_MS + 1;
+      expect(reconcileOrphanedUpdateJobs(database.sqlite, config, expiredNow)).toBe(1);
+      expect(database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(jobId)).toEqual({ status: "failed" });
+      await expect(stat(config.updateRequestPath)).rejects.toThrow();
     } finally {
       if (database) database.sqlite.close();
       await rm(root, { recursive: true, force: true });

web-next/src/pages/update/UpdatePage.tsx

@@ -7,7 +7,7 @@ import { ErrorBanner, Page, Surface } from "../common";
 import type { Notify } from "../expenses/types";
 
 type JobStatus = "queued" | "downloading" | "verifying" | "staged" | "backing_up" | "applying" | "completed" | "failed" | "cancelled";
-type UpdateJob = { id: string; operation?: "download" | "apply"; status: JobStatus; version: string; platform: string; assetName?: string | null; sizeBytes?: number | null; errorMessage?: string | null; createdAt?: number; updatedAt?: number; completedAt?: number | null; applyQueuedAt?: number | string | null; restartWindowSeconds?: number | null; restartDeadline?: number | string | null; restartAt?: number | string | null; expectedRecoveryAt?: number | string | null };
+type UpdateJob = { id: string; operation?: "download" | "apply"; status: JobStatus; version: string; platform: string; assetName?: string | null; sizeBytes?: number | null; downloadedBytes?: number | null; downloadStartedAt?: number | null; downloadSpeedBps?: number | null; errorMessage?: string | null; createdAt?: number; updatedAt?: number; completedAt?: number | null; applyQueuedAt?: number | string | null; restartWindowSeconds?: number | null; restartDeadline?: number | string | null; restartAt?: number | string | null; expectedRecoveryAt?: number | string | null };
 type LatestRelease = { version: string; tagName?: string; releaseName?: string; publishedAt?: string; compatible: boolean; integrityReady: boolean; signatureReady: boolean; isNewer: boolean; assetName?: string; assetSize?: number; notes?: string | null; releaseNotes?: string | null; body?: string | null; htmlUrl?: string | null };
 type UpdateInfo = { configured: boolean; strategy: "disabled" | "systemd"; currentVersion: string; platform: { target: string; os: string; arch: string }; checkedAt: number; latest: LatestRelease | null; job: UpdateJob | null };
 const active = new Set<JobStatus>(["queued", "downloading", "verifying", "staged", "backing_up", "applying"]);
@@ -24,6 +24,16 @@ function notesFor(latest: LatestRelease): string | null {
   const value = latest.notes ?? latest.releaseNotes ?? latest.body;
   return typeof value === "string" && value.trim() ? value.trim() : null;
 }
+function bytesText(value: number | null | undefined): string {
+  if (!Number.isFinite(value) || !value || value < 0) return "0 B";
+  if (value >= 1024 * 1024 * 1024) return `${(value / 1024 / 1024 / 1024).toFixed(1)} GB`;
+  if (value >= 1024 * 1024) return `${(value / 1024 / 1024).toFixed(1)} MB`;
+  if (value >= 1024) return `${(value / 1024).toFixed(1)} KB`;
+  return `${Math.round(value)} B`;
+}
+function speedText(value: number | null | undefined): string {
+  return value && value > 0 ? `${bytesText(value)}/s` : "计算中";
+}
 
 export default function UpdatePage({ timezone = "Asia/Shanghai", notify }: { timezone?: string; notify?: Notify }) {
   const [info, setInfo] = useState<UpdateInfo | null>(null);
@@ -106,16 +116,20 @@ export default function UpdatePage({ timezone = "Asia/Shanghai", notify }: { tim
   const sameCompleted = Boolean(job?.status === "completed" && latest && job.version === latest.version);
   const canDownload = Boolean(info?.strategy === "systemd" && latest?.isNewer && latest.compatible && latest.integrityReady && !hasActiveJob && !sameCompleted && (!job || job.version !== latest.version || job.status === "failed" || job.status === "cancelled"));
   const canApply = Boolean(info?.strategy === "systemd" && latest?.isNewer && latest.compatible && latest.integrityReady && job?.operation === "download" && job.status === "staged" && job.version === latest.version);
-  const progress = job ? ({ queued: 8, downloading: 28, verifying: 48, staged: 65, backing_up: 80, applying: 92 } as Partial<Record<JobStatus, number>>)[job.status] ?? 100 : 0;
+  const progress = job?.status === "staged" && job.operation === "download"
+    ? 100
+    : job?.status === "downloading" && job.sizeBytes && job.downloadedBytes !== null && job.downloadedBytes !== undefined
+    ? Math.min(99, Math.max(8, Math.round(job.downloadedBytes / job.sizeBytes * 100)))
+    : job ? ({ queued: 8, downloading: 28, verifying: 48, staged: 65, backing_up: 80, applying: 92 } as Partial<Record<JobStatus, number>>)[job.status] ?? 100 : 0;
   const notes = latest ? notesFor(latest) : null;
 
-  return <Page title="系统更新" subtitle="检查受信任的 Release；更新前会校验文件并保护现有数据。" actions={<Button variant="outline" onClick={() => void check()} disabled={checking || loading || hasActiveJob} icon={<RefreshCw size={15} />}>{checking ? "检查中…" : "检查更新"}</Button>}>
+  return <Page title="系统更新" subtitle="检查受信任的 Release；更新前会校验文件并保护现有数据。" actions={<Button variant="outline" onClick={() => void check()} disabled={checking || loading} icon={<RefreshCw size={15} />}>{checking ? "检查中…" : "检查更新"}</Button>}>
     {error && <ErrorBanner message={error} onRetry={() => void load()} />}{pollError && <ErrorBanner message={pollError} />}
     {loading ? <div className="tn-empty" role="status" aria-live="polite">正在读取版本信息…</div> : info && <>
       <div className="tn-update-grid"><Surface className="tn-update-block"><Server size={20} /><span className="tn-eyebrow">当前版本</span><strong className="tn-update-value">v{info.currentVersion}</strong><small>运行平台：{info.platform.target}</small></Surface><Surface className="tn-update-block"><ShieldCheck size={20} /><span className="tn-eyebrow">更新方式</span><strong>{info.strategy === "systemd" ? "后台一键更新" : "手动命令行更新"}</strong><small>{info.strategy === "systemd" ? (info.configured ? "由 systemd 更新服务执行" : "尚未配置发布源") : "当前安装未启用后台更新"}</small></Surface></div>
       {latest ? <Surface className="tn-update-release"><div className="tn-update-release-head"><div><span className="tn-eyebrow">最新 Release</span><h2>{latest.releaseName || latest.tagName || `v${latest.version}`}</h2>{latest.publishedAt && <small>发布时间：{dateText(Date.parse(latest.publishedAt), timezone)}</small>}</div><Tag theme={latest.isNewer ? "primary" : "success"}>{latest.isNewer ? "有新版本" : "已是最新"}</Tag></div>{notes && <div className="tn-release-notes"><span className="tn-eyebrow">Release notes</span><div>{notes}</div></div>}<div className="tn-facts"><div><span>平台文件</span><strong>{latest.compatible ? latest.assetName : "无匹配文件"}</strong></div><div><span>完整性</span><strong className={latest.integrityReady ? "text-success" : "text-danger"}>{latest.integrityReady ? "SHA-256 + 签名可验证" : "不可验证"}</strong></div><div><span>文件大小</span><strong>{latest.assetSize ? `${(latest.assetSize / 1024 / 1024).toFixed(1)} MB` : "-"}</strong></div></div>{latest.isNewer && !latest.compatible && <div className="tn-inline-error"><AlertCircle size={16} />当前平台没有可安装的 Release 文件。</div>}{latest.isNewer && latest.compatible && !latest.integrityReady && <div className="tn-inline-error"><AlertCircle size={16} />发布文件缺少完整校验，已禁用更新。</div>}<div className="tn-page-actions">{canDownload && <Button theme="primary" onClick={() => { setConfirmAction("download"); setConfirmVersion(latest.version); }} disabled={actionBusy} loading={actionBusy && confirmAction === "download"} icon={<Download size={16} />}>下载更新包</Button>}{canApply && <Button theme="primary" onClick={() => { setConfirmAction("apply"); setConfirmVersion(latest.version); }} disabled={actionBusy} loading={actionBusy && confirmAction === "apply"} icon={<Zap size={16} />}>立即更新</Button>}{reloadReady && <Button theme="primary" onClick={() => window.location.reload()}>重新加载</Button>}</div></Surface> : <div className="tn-empty">点击“检查更新”获取最新 Release。</div>}
       {!info.configured && <div className="tn-update-explainer"><Terminal size={17} /><div><strong>当前为手动更新模式</strong><p>源码安装默认不启用后台更新。需要更新时，在服务器拉取对应 Release 后重新构建并重启服务；安装器部署并配置 systemd 后，才会显示后台一键更新。</p></div></div>}
-      {job && <Surface className="tn-update-release"><span className="tn-sr-only" aria-live="polite">更新任务状态：{labels[job.status]}</span><div className="tn-update-release-head"><div><span className="tn-eyebrow">最近任务</span><h2>v{job.version}</h2></div><Tag theme={job.status === "completed" ? "success" : job.status === "failed" ? "danger" : "primary"}>{labels[job.status]}</Tag></div>{active.has(job.status) && <><div className="tn-progress" role="progressbar" aria-label="系统更新进度" aria-valuemin={0} aria-valuemax={100} aria-valuenow={progress}><span style={{ width: `${progress}%` }} /></div><small>{job.status === "staged" && job.operation === "download" ? "更新包已下载并校验，可以立即应用。" : job.status === "staged" && job.operation === "apply" ? "立即更新请求已提交，服务即将重启。" : "更新服务正在后台运行，页面会自动刷新状态。"}</small>{restartSeconds !== null && (job.status === "applying" || disconnected.current) && <div className="tn-restart-countdown" role="status">服务正在重启，预计 {restartSeconds} 秒后恢复</div>}</>}{job.status === "failed" && job.errorMessage && <div className="tn-inline-error" role="alert">{job.errorMessage}</div>}{job.status === "completed" && <div className="tn-inline-info"><CheckCircle2 size={16} />新版本已通过健康检查，数据和附件保持不变。</div>}</Surface>}
+      {job && <Surface className="tn-update-release"><span className="tn-sr-only" aria-live="polite">更新任务状态：{labels[job.status]}{job.status === "downloading" ? `，已下载 ${progress}%` : ""}</span><div className="tn-update-release-head"><div><span className="tn-eyebrow">最近任务</span><h2>v{job.version}</h2></div><Tag theme={job.status === "completed" ? "success" : job.status === "failed" ? "danger" : "primary"}>{labels[job.status]}</Tag></div>{active.has(job.status) && <><div className="tn-progress" role="progressbar" aria-label="系统更新进度" aria-valuemin={0} aria-valuemax={100} aria-valuenow={progress}><span style={{ width: `${progress}%` }} /></div>{job.status === "downloading" ? <small>已下载 {bytesText(job.downloadedBytes)} / {bytesText(job.sizeBytes)}（{progress}%） · {speedText(job.downloadSpeedBps)}</small> : <small>{job.status === "staged" && job.operation === "download" ? "更新包已下载并校验，可以立即应用。" : job.status === "staged" && job.operation === "apply" ? "立即更新请求已提交，服务即将重启。" : "更新服务正在后台运行，页面会自动刷新状态。"}</small>}{restartSeconds !== null && (job.status === "applying" || disconnected.current) && <div className="tn-restart-countdown" role="status">服务正在重启，预计 {restartSeconds} 秒后恢复</div>}</>}{job.status === "failed" && job.errorMessage && <div className="tn-inline-error" role="alert">{job.errorMessage}</div>}{job.status === "completed" && <div className="tn-inline-info"><CheckCircle2 size={16} />新版本已通过健康检查，数据和附件保持不变。</div>}</Surface>}
     </>}
     <Dialog visible={Boolean(confirmVersion)} header={confirmAction === "download" ? "下载更新包" : "确认立即更新"} confirmBtn={{ content: confirmAction === "download" ? "开始下载" : "立即更新", theme: "primary", loading: actionBusy, disabled: actionBusy }} cancelBtn="取消" onClose={() => { if (!actionBusy) setConfirmVersion(null); }} onConfirm={() => void submitAction()} onCancel={() => { if (!actionBusy) setConfirmVersion(null); }}>{confirmAction === "download" ? `将下载并校验 v${confirmVersion}，完成后可选择立即更新。` : `将应用已下载的 v${confirmVersion}。服务会短暂重启，更新前会备份数据目录。`}</Dialog>
   </Page>;

web/src/main.tsx

@@ -771,7 +771,7 @@ function Update({ notify }: { notify: (message: string, kind?: Notice["kind"]) =
   const canApply = Boolean(info?.strategy === "systemd" && latest?.isNewer && latest.compatible && latest.integrityReady && !hasActiveJob && (!job || job.status === "failed" || job.version !== latest.version));
 
   return <div className="page update-page">
-    <div className="page-head"><div><div className="eyebrow">系统</div><h1>系统更新</h1></div><div className="head-actions"><Button onClick={() => void load()} disabled={loading || checking}><RotateCcw size={15} />刷新</Button><Button kind="primary" onClick={() => void check()} disabled={loading || checking || hasActiveJob}><RefreshCw size={15} className={checking ? "spin" : undefined} />检查更新</Button></div></div>
+    <div className="page-head"><div><div className="eyebrow">系统</div><h1>系统更新</h1></div><div className="head-actions"><Button onClick={() => void load()} disabled={loading || checking}><RotateCcw size={15} />刷新</Button><Button kind="primary" onClick={() => void check()} disabled={loading || checking}><RefreshCw size={15} className={checking ? "spin" : undefined} />检查更新</Button></div></div>
     {error && <div className="error banner" role="alert"><AlertCircle size={16} />{error}<button className="text-button" onClick={() => void load()}>重试</button></div>}
     {loading ? <div className="update-loading"><Loader2 className="spin" size={22} />正在读取版本信息</div> : info && <>
       <div className="update-overview">