@xcanwin/manyoyo 8.6.3 → 8.6.4

package/lib/app-update.js

@@ -11,7 +11,7 @@ const { spawnSync } = require('child_process');
 const { downloadVerified, sha256File } = require('./download-verified');
 
 const REPO = 'xcanwin/manyoyo';
-const API_BASE = 'https://api.github.com';
+const WEB_BASE = 'https://github.com';
 // 不依赖 PATH 查找 tar（macOS 与常见 Linux 都在 /usr/bin）
 const TAR_COMMAND = fs.existsSync('/usr/bin/tar') ? '/usr/bin/tar' : 'tar';
 const VERSION_PATTERN = /^\d+\.\d+\.\d+$/;
@@ -103,35 +103,32 @@ async function request(fetchImpl, url, options = {}) {
 }
 
 /**
- * 查询最新 Release（匿名 API）。返回 { version, tag, assets: { name: url } }。
+ * 查询最新 Release。返回 { version, tag, assets: { name: url } }。
+ * 不调 GitHub API：匿名 API 按 IP 每小时 60 次，共享出口（公司网络、代理、CI runner）经常被限流。
+ * 改为跟随 github.com 的 releases/latest 跳转取版本（与 scripts/install.sh 一致），
+ * 升级包与 SHA256SUMS 的命名是固定的，下载地址直接拼在本仓库的 Release 下载路径下。
  */
-async function fetchLatestRelease({ fetchImpl = fetch, apiBase = API_BASE, now = Date.now } = {}) {
-    const response = await request(fetchImpl, `${apiBase}/repos/${REPO}/releases/latest`);
-    if (response.status === 403 || response.status === 429) {
-        const remaining = response.headers.get('x-ratelimit-remaining');
-        if (response.status === 429 || remaining === '0') {
-            const reset = Number(response.headers.get('x-ratelimit-reset'));
-            const when = reset > 0 ? new Date(reset * 1000).toLocaleTimeString('zh-CN', { hour12: false }) : '';
-            throw new UpdateError('RATE_LIMIT', `GitHub 对匿名请求做了频率限制，${when ? `请在 ${when} 之后重试` : '请稍后重试'}。`);
-        }
-    }
-    if (response.status === 404) throw new UpdateError('NO_RELEASE', '仓库还没有发布的 Release，暂时无法升级。');
-    if (!response.ok) throw new UpdateError('HTTP', `查询最新版本失败（HTTP ${response.status}）。`);
-    let release;
-    try {
-        release = await response.json();
-    } catch (error) {
-        throw new UpdateError('HTTP', '查询最新版本失败（返回内容不是有效的 JSON）。');
-    }
-    const version = String(release.tag_name || '').replace(/^v/, '');
-    if (!VERSION_PATTERN.test(version)) throw new UpdateError('HTTP', `最新 Release 的版本号无法识别: ${release.tag_name}`);
-    // 默认 API 下，下载地址必须在本仓库的 Release 下载路径内（测试注入自定义 apiBase 时不限制）
-    const allowedPrefix = apiBase === API_BASE ? `https://github.com/${REPO}/releases/download/` : '';
+async function fetchLatestRelease({ fetchImpl = fetch, webBase = WEB_BASE } = {}) {
+    const response = await request(fetchImpl, `${webBase}/${REPO}/releases/latest`, { redirect: 'manual', headers: { Accept: 'text/html' } });
+    if (response.status === 429) throw new UpdateError('RATE_LIMIT', 'GitHub 对访问做了频率限制，请稍后重试。');
+    const location = response.status >= 300 && response.status < 400 ? String(response.headers.get('location') || '') : '';
+    if (!location && !response.ok && response.status !== 404) throw new UpdateError('HTTP', `查询最新版本失败（HTTP ${response.status}）。`);
+    // 没有任何 Release 时 latest 跳到 Release 列表页（或 404）
+    const match = /\/releases\/tag\/([^/?#]+)$/.exec(location);
+    if (!match) throw new UpdateError('NO_RELEASE', '仓库还没有发布的 Release，暂时无法升级。');
+    const tag = decodeURIComponent(match[1]);
+    const version = tag.replace(/^v/, '');
+    if (!VERSION_PATTERN.test(version)) throw new UpdateError('HTTP', `最新 Release 的版本号无法识别: ${tag}`);
+    const download = `${webBase}/${REPO}/releases/download/${encodeURIComponent(tag)}/`;
     const assets = {};
-    for (const asset of Array.isArray(release.assets) ? release.assets : []) {
-        if (asset && typeof asset.name === 'string' && typeof asset.browser_download_url === 'string' && asset.browser_download_url.startsWith(allowedPrefix)) assets[asset.name] = asset.browser_download_url;
+    for (const targetOs of ['macos', 'linux']) {
+        for (const targetArch of ['arm64', 'x64']) {
+            const names = releaseAssetNames(version, targetArch, targetOs);
+            assets[names.app] = `${download}${names.app}`;
+            assets[names.sums] = `${download}${names.sums}`;
+        }
     }
-    return { version, tag: release.tag_name, assets };
+    return { version, tag, assets };
 }
 
 function parseSha256Sums(text) {
@@ -250,6 +247,11 @@ async function installAppUpdate({ appRoot, release, fetchImpl = fetch, targetArc
         throw new UpdateError('NO_ASSET', `Release ${release.version} 里没有适合这台机器（${targetOs}-${targetArch}）的升级包（需要 ${names.app} 与 ${names.sums}）。`);
     }
 
+    // 下载地址是按固定命名拼出来的：先确认这个 Release 里确实有本机的升级包（404 就是没有）
+    const probe = await request(fetchImpl, appUrl, { method: 'HEAD' });
+    if (probe.status === 404) {
+        throw new UpdateError('NO_ASSET', `Release ${release.version} 里没有适合这台机器（${targetOs}-${targetArch}）的升级包（需要 ${names.app} 与 ${names.sums}）。`);
+    }
     log(`校验清单: ${sumsUrl}`);
     const sums = parseSha256Sums(await fetchText(fetchImpl, sumsUrl));
     const expected = sums[names.app];