aaden-cli 1.6.109-rc.0 → 1.6.109

package/AadenDeploy/Utils/enableNgrok.sh

@@ -1,19 +1,21 @@
 #!/bin/bash
+# 和 aaden-cli 其他地方一样用 -S 喂密码：aaden 没有免密 sudo、又没有终端时（被装机脚本或 set-device-id 调用）裸 sudo 会直接失败
+sudoS() { echo "Innerken322." | sudo -S -p '' "$@"; }
 
-sudo npm config set prefix /usr/local
+sudoS npm config set prefix /usr/local
 cd || exit
-sudo rm -rf ngrok
+sudoS rm -rf ngrok
 axel -n 8 "https://aaden-storage.s3.eu-central-1.amazonaws.com/ngrok"
-sudo cp -f ngrok /etc/aaden/ngrok
-sudo chmod +x /etc/aaden/ngrok
+sudoS cp -f ngrok /etc/aaden/ngrok
+sudoS chmod +x /etc/aaden/ngrok
 
 DeviceId=$(cat /var/www/html/Resource/config/config.ini | grep -e DeviceId | cut -d = -f 2 | grep '[1-9]*' | sed 's/"//g')
 aaden-cli update-ngrok-config $DeviceId
 
 ServiceFileName=/etc/systemd/system/aaden-ngrok-v3.service
 
-sudo touch $ServiceFileName
-sudo chmod 777 $ServiceFileName
+sudoS touch $ServiceFileName
+sudoS chmod 777 $ServiceFileName
 echo -e "
 [Unit]
 Description=Ngrok Service v3 For Aaden
@@ -29,24 +31,24 @@ ExecStart=/etc/aaden/ngrok -config=/etc/aaden/ngrok-config.yml start-all --log=/
 [Install]
 WantedBy=multi-user.target
 " >$ServiceFileName
-sudo rm /etc/systemd/system/aaden-ngrok.service
-sudo rm /etc/systemd/system/aaden-ngrok-2.service
+sudoS rm /etc/systemd/system/aaden-ngrok.service
+sudoS rm /etc/systemd/system/aaden-ngrok-2.service
 
-sudo systemctl daemon-reload
-sudo systemctl start aaden-ngrok-v3.service
-sudo systemctl enable aaden-ngrok-v3.service
-sudo systemctl stop aaden-ngrok.service
-sudo systemctl stop aaden-ngrok-2.service
-sudo systemctl disable aaden-ngrok.service
-sudo systemctl disable aaden-ngrok-2.service
+sudoS systemctl daemon-reload
+sudoS systemctl start aaden-ngrok-v3.service
+sudoS systemctl enable aaden-ngrok-v3.service
+sudoS systemctl stop aaden-ngrok.service
+sudoS systemctl stop aaden-ngrok-2.service
+sudoS systemctl disable aaden-ngrok.service
+sudoS systemctl disable aaden-ngrok-2.service
 
-sudo service aaden-ngrok-v3 restart
+sudoS service aaden-ngrok-v3 restart
 
 
 
 ServiceFileName=/etc/avahi/services/aaden.service
-sudo touch $ServiceFileName
-sudo chmod 777 $ServiceFileName
+sudoS touch $ServiceFileName
+sudoS chmod 777 $ServiceFileName
 echo -e "
 <?xml version="1.0" standalone='no'?><!--*-nxml-*-->
 <!DOCTYPE service-group SYSTEM "avahi-service.dtd">
@@ -59,7 +61,7 @@ echo -e "
 </service-group>
 " >$ServiceFileName
 
-sudo service avahi-daemon restart
+sudoS service avahi-daemon restart
 
 echo "ngrok 修复脚本执行完毕。请直接检查ngrok是否正常开启。如果开启，请无视这里的任何报错。"
 

package/AadenDeploy/Utils/fixCronJob.sh

@@ -1,4 +1,6 @@
 #!/bin/bash
+# 和 aaden-cli 其他地方一样用 -S 喂密码：aaden 没有免密 sudo、又没有终端时（被装机脚本或 set-device-id 调用）裸 sudo 会直接失败
+sudoS() { echo "Innerken322." | sudo -S -p '' "$@"; }
 echo 'Cronjob Before Aaden'
 echo "Innerken322." | sudo -S  crontab -l -u aaden
 echo 'Cronjob Before Root'
@@ -15,11 +17,10 @@ echo "* * * * * curl --location --request GET 'http://localhost/PHP/BackendData.
 echo "* * * * * curl --location --request GET 'http://localhost/PHP/BackendData.php?op=autoSendMonthSummary'" >>conf
 echo "* * * * * curl --location --request GET 'http://localhost/PHP/ZBon.php?op=autoAddCombinedRecord'" >>conf
 echo "3 * * * * curl --location --request GET 'http://localhost/PHP/writeDETax2024.php'" >>conf
-echo "59 4 * * * curl --location -X POST 'http://localhost/PHP/UpdateSelf.php?op=doUpdate'" >>conf
-echo "@reboot sleep 60 && curl --location -X POST 'http://localhost/PHP/UpdateSelf.php?op=doUpdate'" >>conf
+# 不再写 git doUpdate（59 4 / @reboot）：git 通道 2026-08 已停用，后端 doUpdate 直接跳过，后端更新改走 root 的 auto-upgrade → light-update
 echo "*/5 * * * * /usr/local/bin/aaden-cli do-log" >>conf
-sudo crontab -u aaden -r
-sudo crontab -u aaden conf
+sudoS crontab -u aaden -r
+sudoS crontab -u aaden conf
 echo "Innerken322." | sudo -S rm -f conf
 crontab -l -u aaden
 echo "END Aaden Deploy CONFIG"

package/AadenDeploy/aadensetup.sh

@@ -1,180 +1,234 @@
-echoWithWait() {
+#!/bin/bash
+# Aaden 收银机装机：全新的 Ubuntu（或 WSL）→ 可以交付的收银机。
+#   aaden-cli install <设备号>        （或在 AadenDeploy 目录下 ./aadensetup.sh <设备号>）
+#
+# - 设备号最先问并查云端（checkDeviceId.sh），撞号在装任何东西之前拦下来
+# - 每一步记下退出码和耗时；关键步骤失败就停下；最后做一遍自检，连同每一步的结果作为「出厂安装」事件上报云端
+# - 全部输出另存一份到 /var/log/aaden-setup.log
+# - 可以重跑：数据库已经初始化过就跳过，配置、主机名、/etc/hosts、定时任务都是覆盖写，不会重复追加
+export PATH="/usr/local/bin:$PATH"
+DIR="$(cd "$(dirname "$0")" && pwd)"
+PW='Innerken322.'
+LOG=/var/log/aaden-setup.log
+WEB=/var/www/html
+BACKEND_SRC=/etc/aaden/updateFiles/backendFiles
+
+# 和 aaden-cli 其他地方一样用 -S 从 stdin 喂密码。不能再往 sudoS 的命令里重定向 stdin（密码会被当成内容），
+# 需要重定向时写成 sudoS sh -c '… < 文件'
+sudoS() { echo "$PW" | sudo -S -p '' "$@"; }
+is_wsl() { grep -qi microsoft /proc/version 2>/dev/null; }
+
+banner() {
+  echo ""
   echo "#######################################################################"
-  echo $1 '....'
+  echo "# $*"
   echo "#######################################################################"
 }
 
-echo ""
-echo "#######################################################################"
-echo "#                    Start to configurate aaden!                      #"
-echo "#                                 V 1.0.0                             #"
-echo "#######################################################################"
-echo ""
-sudo add-apt-repository ppa:ondrej/php -y
+banner "Aaden 收银机装机"
 
-
-echoWithWait "updating System...."
-sudo apt-get update -y
-sudo apt-get -o Dpkg::Options::='--force-confdef' --force-yes -fuy dist-upgrade
-
-
-echoWithWait "Installing Lamp...."
-sudo snap install axel
-
-sudo apt install apache2 -y
-sudo apt install net-tools -y
-sudo apt install software-properties-common apt-transport-https -y
-echoWithWait "Install PHP7.4"
-
-sudo apt install mysql-server -y
-sudo apt install aptitude -y
-sudo apt install curl -y
-sudo aptitude -y install expect
-sudo apt install default-jdk -y
-sudo apt install php7.4 php7.4-common libapache2-mod-php7.4 php7.4-cli -y
-sudo apt install php7.4-xml -y
-sudo apt install php7.4-curl php7.4-mysql php7.4-gd php7.4-zip php7.4-intl php7.4-common php7.4-mbstring -y
-sudo update-alternatives --set php /usr/bin/php7.4
-sudo update-alternatives --set phar /usr/bin/phar7.4
-sudo update-alternatives --set phar.phar /usr/bin/phar.phar7.4
-
-sudo systemctl restart apache2
-
-echoWithWait "Install Complate"
-
-
-sudo apt -y install vim apt-transport-https wget software-properties-common
-
-
-echoWithWait "Install Docker Requirment"
-sudo apt-get install -y \
-  apt-transport-https \
-  ca-certificates \
-  curl \
-  gnupg-agent \
-  software-properties-common
-
-sudo apt update -y
-sudo apt-get install ttyload -y
-
-echoWithWait "Deploying ssh"
-
-sudo apt-get install openssh-server -y
-
-echoWithWait "Installing Pip for python3"
-sudo apt-get install python3-pip -y
-
-echoWithWait "Get Requests library for python3"
-python3 -m pip install requests
-
-sudo apt-get install unzip -y
-curl -sS https://getcomposer.org/installer -o composer-setup.php
-sudo php composer-setup.php --install-dir=/usr/local/bin --filename=composer
-sudo composer self-update
-composer -v
-
-sudo chmod +x files/getFile.sh
-sudo chmod 777 -R .
-
-cd files/ || exit
-./getFile.sh
-cd ..
-
-echoWithWait "Configing MYSQL SECURE, only for remote root disable no, else follow it and set to yes, please set the root password as defaultPassword"
-
-sudo chmod +x scureSql.sh
-sudo /bin/bash scureSql.sh 'Innerken322.'
-
-echoWithWait "Configing Mysql"
-cd /etc/aaden/updateFiles || exit
-
-sudo mysql -uroot < backendFiles/new.sql
-
-echoWithWait "Uploading PHP Files"
-sudo mv backendFiles/* /var/www/html/
-sudo service apache2 restart
-sudo chown -hR www-data:www-data /var/www/html
-
-sudo chmod -R 777 /var/www/html/Resource
-sudo chmod +x /var/www/html/crontab.sh
-
-# give excute permission to migrations
-sudo chmod +x /var/www/html/PHP/vendor/bin/phinx
-sudo chmod +x /var/www/html/PHP/vendor/robmorgan/phinx/bin/phinx
-
-
-echoWithWait "Skip App Install"
-
-
-
-
-echoWithWait "Add Cronjob"
-sudo touch conf
-sudo chmod 777 conf
-echo "* * * * *  wget -O /dev/null http://localhost/PHP/AccessLog.php?op=reportStatus" >>conf
-echo "* * * * *  /var/www/html/crontab.sh > /dev/null" >>conf
-crontab conf && sudo rm -f conf
-crontab -l
-
-echoWithWait "Finishing Install"
-
-if [ -z "$1" ]; then
-  read -p 'DeviceId: ' DeviceId
-else
-  DeviceId=$1
+# ---------------------------------------------------------------- 设备号（最先问，先查撞号）
+DEVICE_ID="$1"
+if [ -z "$DEVICE_ID" ]; then
+  read -r -p '设备号: ' DEVICE_ID
 fi
+bash "$DIR/checkDeviceId.sh" "$DEVICE_ID" || exit 1
+DEVICE_ID=$((10#$DEVICE_ID))
+export AADEN_SKIP_DEVICE_CHECK=1 # 后面 set-device-id 不再问第二遍
+
+# sudo 凭据先缓存上并一直续着：装机要十几分钟，中途调的 aaden-cli 子命令里还有裸 sudo
+sudoS -v 2>/dev/null || sudo -v || exit 1
+(while kill -0 $$ 2>/dev/null; do sudoS -v 2>/dev/null; sleep 50; done) &
+KEEPALIVE=$!
+trap 'kill $KEEPALIVE 2>/dev/null' EXIT
+
+sudoS touch "$LOG" && sudoS chmod 666 "$LOG"
+exec > >(tee -a "$LOG") 2>&1
+echo "$(date '+%F %T') 开始装机，设备号 $DEVICE_ID"
+
+# ---------------------------------------------------------------- 步骤记录与上报
+STEPS=""
+step() { # step <名字> <命令…>：输出照常打到屏幕，记下退出码和耗时
+  local name=$1 start=$SECONDS code
+  shift
+  banner "$name"
+  "$@"
+  code=$?
+  STEPS="$STEPS $name=$code/$((SECONDS - start))s"
+  [ "$code" = 0 ] || echo "✗ $name 失败（退出码 $code），详细输出见 $LOG"
+  return "$code"
+}
 
-echoWithWait "useDeviceId:$DeviceId"
-
-wget "http://innerken.com/iplogger/index.php?op=register&deviceId=$DeviceId"
-wget http://localhost/PHP/AutoSetup.php?DeviceId=$DeviceId
-wget http://localhost/PHP/AccessLog.php?op=reportStatus
-sudo hostnamectl set-hostname aaden$DeviceId
-echo $(hostname -I | cut -d\  -f1) $(hostname) | sudo tee -a /etc/hosts
-
-echoWithWait "SetUpOfflineUsbDriver"
-
-sudo usermod -a -G lp aaden
-sudo usermod -a -G lp www-data
-sudo usermod -a -G root aaden
-sudo usermod -a -G root www-data
-sudo usermod -a -G adm aaden
-sudo usermod -a -G sudo aaden
-
-echoWithWait "RUN MIGRATION"
-# run migrations
-cd /var/www/html/PHP || exit
-vendor/bin/phinx migrate
+report() { # report <result> <附加内容>：「出厂安装」事件，在云端设备事件里能看到每一步和自检结果
+  local content="出厂安装 [${STEPS# }]$2 result:$1"
+  python3 - "$DEVICE_ID" "$content" "$(aaden-cli --version 2>/dev/null | tail -n 1)" <<'PY' || echo "（上报云端失败）"
+import json, sys, urllib.request
+device_id, content, version = sys.argv[1:4]
+body = json.dumps({"deviceId": device_id, "content": content, "type": "系统生成", "operator": "aaden-cli v" + version}).encode()
+urllib.request.urlopen(urllib.request.Request("https://cloud-v2.aaden.io/deviceLog/createEvent", body, {"Content-Type": "application/json"}), timeout=10)
+PY
+}
 
-aaden-cli patch
-# 日结物化守护进程：每日数据库备份和 DSFinV-K 日结物化都靠它（以前漏在装机脚本外，靠手动补）
-aaden-cli auto-write-gdpdu
-aaden-cli fix-cronjob
-aaden-cli upgrade
-aaden-cli update-ngrok-config $DeviceId
-aaden-cli fix-ngrok
+must() { # 关键步骤：失败就上报并停下，后面的步骤都依赖它
+  step "$@" && return 0
+  report 1 " 中止于 $1"
+  banner "装机中止：$1 失败。修好之后重新运行同一条命令即可，已经完成的部分会跳过或覆盖。日志：$LOG"
+  exit 1
+}
 
+# ---------------------------------------------------------------- 1. 系统软件
+install_packages() {
+  local apt="env DEBIAN_FRONTEND=noninteractive apt-get -y -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold"
+  # 上次装到一半断掉（断电、断网、包脚本失败）留下的半配置状态先收拾掉，否则后面的 apt 全部报错
+  sudoS env DEBIAN_FRONTEND=noninteractive dpkg --configure -a
+  command -v add-apt-repository >/dev/null || sudoS $apt install software-properties-common || return 1
+  # Ubuntu 22.04 起官方源没有 PHP 7.4
+  sudoS add-apt-repository -y ppa:ondrej/php || return 1
+  sudoS apt-get update || return 1
+  sudoS $apt install \
+    apache2 mysql-server \
+    php7.4 php7.4-common php7.4-cli libapache2-mod-php7.4 \
+    php7.4-xml php7.4-curl php7.4-mysql php7.4-gd php7.4-zip php7.4-intl php7.4-mbstring \
+    default-jdk openssh-server \
+    curl wget unzip axel expect vim net-tools ttyload ca-certificates apt-transport-https \
+    python3-requests || return 1
+  # 装了别的 PHP 版本时，命令行默认的 php 也指向 7.4
+  sudoS update-alternatives --set php /usr/bin/php7.4
+  sudoS update-alternatives --set phar /usr/bin/phar7.4 2>/dev/null
+  sudoS update-alternatives --set phar.phar /usr/bin/phar.phar7.4 2>/dev/null
+  sudoS systemctl restart apache2 2>/dev/null || sudoS service apache2 restart
+}
+must apt install_packages
 
-echo ""
-echo "#######################################################################"
-echo "#                          Auto Config Complete!                      #"
-echo "#                                 V 1.0.0                             #"
-echo "#######################################################################"
-echo ""
+# ---------------------------------------------------------------- 2. 后端代码
+download_backend() {
+  bash "$DIR/files/getFile.sh" && [ -f "$BACKEND_SRC/package.json" ]
+}
+must download download_backend
+
+# ---------------------------------------------------------------- 3. 数据库
+setup_database() {
+  # 先确保 MySQL 在跑（没有 systemd 的 WSL 不会自动起），否则下面的判断会把已有的库当成没有
+  sudoS service mysql start 2>/dev/null
+  # 没有 systemd 时 socket 目录可能是 700，aaden 跑数据库迁移会连不上（SQLSTATE 2002 Permission denied）
+  sudoS chmod 755 /var/run/mysqld 2>/dev/null
+  if sudoS mysql -uroot -e 'USE aaden' 2>/dev/null || sudoS test -d /var/lib/mysql/aaden; then
+    echo "数据库 aaden 已存在，跳过初始化（重跑装机不会覆盖门店数据）"
+    return 0
+  fi
+  sudoS bash "$DIR/scureSql.sh" "$PW"
+  sudoS sh -c "mysql -uroot < '$BACKEND_SRC/new.sql'" && sudoS mysql -uroot -e 'USE aaden'
+}
+must db setup_database
+
+# ---------------------------------------------------------------- 4. 部署后端
+deploy_backend() {
+  # cp 而不是 mv：重跑时目标目录已存在，mv 会失败
+  sudoS cp -a "$BACKEND_SRC/." "$WEB/" || return 1
+  sudoS rm -rf "$BACKEND_SRC"
+  sudoS chown -hR www-data:www-data "$WEB"
+  sudoS chmod -R 777 "$WEB/Resource"
+  sudoS chmod +x "$WEB/crontab.sh" "$WEB/PHP/vendor/bin/phinx" "$WEB/PHP/vendor/robmorgan/phinx/bin/phinx"
+  sudoS systemctl restart apache2 2>/dev/null || sudoS service apache2 restart
+  sleep 2
+  curl -fsS -m 10 http://localhost/package.json | grep '"version"'
+}
+must deploy deploy_backend
 
-echo ""
-echo "#######################################################################"
-echo "#                          Install TeamViewer                         #"
-echo "#                                 V 1.0.0                             #"
-echo "#######################################################################"
-echo ""
+# ---------------------------------------------------------------- 5. 设备号：配置、主机名、ngrok、上报
+must device aaden-cli set-device-id "$DEVICE_ID"
 
-cd || exit
-wget https://download.teamviewer.com/download/linux/teamviewer_amd64.deb
-sudo apt -y install ./teamviewer_amd64.deb
+# ---------------------------------------------------------------- 6. 数据库迁移
+must migrate sh -c "cd '$WEB/PHP' && vendor/bin/phinx migrate"
 
-wget https://aaden.online/AadenOS/background.png
+# ---------------------------------------------------------------- 7. 系统配置（失败不中止，最后的自检会标出来）
+add_groups() {
+  # 打印机（lp）、读日志（adm）、aaden 能 sudo；www-data 要能访问 USB 打印机
+  sudoS usermod -a -G lp,root,adm,sudo aaden && sudoS usermod -a -G lp,root www-data
+}
+step groups add_groups
+step patch aaden-cli patch
+# 日结物化守护进程：每日数据库备份和 DSFinV-K 日结物化都靠它
+step gdpdu aaden-cli auto-write-gdpdu
+# aaden 和 root 的定时任务整份覆盖写（do-log 上报、每日自动更新等）
+step cron aaden-cli fix-cronjob
+# 升级 aaden-cli、跑补丁、后端 light-update、同步 AppCenter 前端
+step upgrade aaden-cli upgrade
+
+if ! is_wsl; then
+  install_teamviewer() {
+    local deb
+    deb=$(mktemp --suffix=.deb)
+    wget -q -O "$deb" https://download.teamviewer.com/download/linux/teamviewer_amd64.deb \
+      && sudoS env DEBIAN_FRONTEND=noninteractive apt-get -y install "$deb"
+    local code=$?
+    rm -f "$deb"
+    wget -q -O "$HOME/background.png" https://aaden.online/AadenOS/background.png
+    return $code
+  }
+  step teamviewer install_teamviewer
+fi
 
+# ---------------------------------------------------------------- 8. 自检
+banner "自检"
+CHECKS=""
+BAD=""
+check() { # check <key> <说明> <命令…>
+  local key=$1 label=$2
+  shift 2
+  if "$@" >/dev/null 2>&1; then
+    CHECKS="$CHECKS $key=ok"
+    echo "  ✓ $label"
+  else
+    CHECKS="$CHECKS $key=FAIL"
+    BAD="$BAD $label"
+    echo "  ✗ $label"
+  fi
+}
+NGROK_HOST="ik$(printf '%04d' "$DEVICE_ID").ngrok.aaden.io"
 
+check_cloud() {
+  aaden-cli do-log >/dev/null 2>&1
+  curl -fsS -m 15 "https://cloud-v2.aaden.io/deviceLog/install-check/$DEVICE_ID" \
+    | python3 -c 'import json,sys; m = json.load(sys.stdin).get("lastReportMinutesAgo"); sys.exit(0 if m is not None and m <= 10 else 1)'
+}
+check_ngrok() { # 隧道刚起来时要等几秒
+  local i
+  for i in 1 2 3 4 5 6; do
+    curl -fsS -m 10 "https://$NGROK_HOST/package.json" | grep -q '"version"' && return 0
+    sleep 10
+  done
+  return 1
+}
+check_gdpdu() {
+  systemctl is-active --quiet aaden-gdpdu.service 2>/dev/null \
+    || pgrep -f 'autoWriteGdpdu\.php' >/dev/null \
+    || [ -f /etc/cron.d/aaden-gdpdu ]
+}
+check_cron() {
+  crontab -l 2>/dev/null | grep -q 'do-log' && sudoS crontab -l -u root 2>/dev/null | grep -q 'auto-upgrade'
+}
 
+check_id() {
+  [ "$(awk -F= '/^\[/ { s = $0 } s ~ /^\[Device\]/ && $1 ~ /^[ \t]*DeviceId[ \t]*$/ { gsub(/[ \t"\r]/, "", $2); print $2; exit }' "$WEB/Resource/config/config.ini")" = "$DEVICE_ID" ]
+}
 
+check backend "后端在跑（http://localhost/package.json）" sh -c 'curl -fsS -m 10 http://localhost/package.json | grep -q version'
+check id "设备号写入配置（$DEVICE_ID）" check_id
+check cloud "云端收到本机上报（ERP 门店列表「机器」列显示就绪）" check_cloud
+check ngrok "远程访问 https://$NGROK_HOST" check_ngrok
+check gdpdu "日结守护进程 aaden-gdpdu（没有它就没有每日备份）" check_gdpdu
+check cron "定时任务（上报、每日自动更新）" check_cron
+
+FAILED_STEPS=$(echo "$STEPS" | tr ' ' '\n' | grep -v '=0/' | cut -d= -f1 | tr '\n' ' ')
+if [ -z "$BAD" ] && [ -z "${FAILED_STEPS// /}" ]; then
+  report 0 " [自检${CHECKS}]"
+  banner "装机完成，设备号 $DEVICE_ID，可以交付"
+  exit 0
+fi
+report 1 " [自检${CHECKS}]"
+banner "装机跑完了，但有问题要处理"
+[ -n "${FAILED_STEPS// /}" ] && echo "失败的步骤：$FAILED_STEPS"
+[ -n "$BAD" ] && echo "没通过的自检：$BAD"
+echo "处理完可以重新运行同一条命令。日志：$LOG"
+exit 1

package/AadenDeploy/checkDeviceId.sh

@@ -0,0 +1,104 @@
+#!/bin/bash
+# 装机前检查设备号：这个号在 ERP 是哪家店、是不是已经有收银机在用。拦住输错号、用了别家号的「撞号」——
+# 同一个号装两台机器，云端的上报、备份、报表、远程连接（ngrok ik 号）会互相覆盖。
+#
+# 退出码 0 = 继续装；1 = 号不对或装机同事取消。
+# 连不上云端只警告、不挡安装（现场网络常常不好）。确实要跳过检查：AADEN_SKIP_DEVICE_CHECK=1
+DeviceId="$1"
+CLOUD="${AADEN_CLOUD_URL:-https://cloud-v2.aaden.io}"
+
+[ -n "$AADEN_SKIP_DEVICE_CHECK" ] && { echo "跳过设备号检查（AADEN_SKIP_DEVICE_CHECK）"; exit 0; }
+if ! [[ "$DeviceId" =~ ^[0-9]+$ ]]; then
+  echo "设备号必须是数字：'$DeviceId'"
+  exit 1
+fi
+
+# 提问走 /dev/tty：脚本的标准输入可能被管道占着。没有终端（自动化装机）时 ask 返回空串
+HAVE_TTY=""
+{ exec 3</dev/tty; } 2>/dev/null && HAVE_TTY=1
+ask() {
+  local answer=""
+  [ -n "$HAVE_TTY" ] && read -r -p "$1" answer <&3 2>/dev/tty
+  echo "$answer"
+}
+
+URL="$CLOUD/deviceLog/install-check/$DeviceId"
+JSON=$(curl -fsS -m 15 "$URL" 2>/dev/null || wget -qO- -T 15 "$URL" 2>/dev/null)
+
+# 第一行是结论（OK / IN_USE / NO_STORE / ERROR），后面是给装机同事看的说明
+REPORT=$(python3 - "$JSON" <<'PY'
+import json, sys
+try:
+    d = json.loads(sys.argv[1])
+    store, machine = d.get("store"), d.get("machine")
+except Exception:
+    print("ERROR")
+    sys.exit()
+
+status = {"AwaitingInstallation": "等待安装", "Installed": "已安装", "Closed": "已关停", "StopService": "停止服务"}
+
+def when(v):
+    return v[:16].replace("T", " ") if v else "—"
+
+def ago(minutes):
+    if minutes is None:
+        return "—"
+    if minutes < 60:
+        return f"{max(minutes, 1)} 分钟前"
+    if minutes < 24 * 60:
+        return f"{round(minutes / 60)} 小时前"
+    return f"{round(minutes / 60 / 24)} 天前"
+
+if not store:
+    print("NO_STORE")
+    sys.exit()
+
+parts = [p for p in (store.get("displayCode"), store.get("city"), status.get(store.get("status"), store.get("status"))) if p]
+store_line = f"ERP 门店「{store.get('name') or '—'}」（{'，'.join(parts)}）"
+
+if machine:
+    print("IN_USE")
+    print(f"  收银机里的餐厅名：{machine.get('posName') or '—'}")
+    print(f"  第一次上报 {when(machine.get('firstReportAt'))}，最近上报 {ago(d.get('lastReportMinutesAgo'))}")
+    print(f"  {store_line}")
+else:
+    print("OK")
+    print(f"  {store_line}")
+    print("  云端还没收到过这个号的收银机上报")
+PY
+)
+VERDICT=$(echo "$REPORT" | head -n 1)
+DETAIL=$(echo "$REPORT" | tail -n +2)
+
+echo ""
+echo "#######################################################################"
+echo "检查设备号 $DeviceId"
+case "$VERDICT" in
+  OK)
+    echo "$DETAIL"
+    # 没有终端可问（自动化装机）时号也没人用，直接继续
+    if [ -n "$HAVE_TTY" ]; then
+      answer=$(ask "是这家店吗？[y/N] ")
+      [[ "$answer" =~ ^[yY] ]] || { echo "已取消。"; exit 1; }
+    fi
+    ;;
+  IN_USE)
+    echo "⚠ 这个号已经有收银机在用："
+    echo "$DETAIL"
+    echo "同一个号装两台机器，云端的上报、备份、报表、远程连接会互相覆盖。"
+    echo "只有给这家店换机或重装才应该继续，而且旧机器要先关掉。"
+    answer=$(ask "确认继续请再输入一遍设备号（直接回车取消）：")
+    [ "$answer" = "$DeviceId" ] || { echo "已取消。"; exit 1; }
+    ;;
+  NO_STORE)
+    echo "✗ ERP 里没有编号 $DeviceId 的门店：先在 ERP 建档，或者检查设备号有没有输错。"
+    echo "  确实要装：AADEN_SKIP_DEVICE_CHECK=1 再跑一次"
+    exit 1
+    ;;
+  *)
+    echo "⚠ 连不上云端（$CLOUD），没法检查设备号有没有撞号，继续安装。"
+    sleep 3
+    ;;
+esac
+echo "#######################################################################"
+exit 0

package/AadenDeploy/setDeviceId.sh

@@ -0,0 +1,130 @@
+#!/bin/bash
+# 设定本机设备号（= ERP 门店编号）。全新装机（aadensetup.sh）和镜像克隆来的机器改号都走这一个入口：
+#   aaden-cli set-device-id <号>
+#
+# 1. 先查云端：这个号是 ERP 里哪家店、是不是已经有收银机在用（checkDeviceId.sh），拦住撞号
+# 2. 写配置：没有 config.ini 时让后端 AutoSetup.php 按默认配置生成；已有时只改 [Device] 段和 config.json，其余配置原样保留
+# 3. 主机名 aadenXXXX，/etc/hosts 里只留一行（以前每次装机都往里追加一行）
+# 4. ngrok 隧道 ikXXXX / SSH 端口 10000+号，重启隧道；第一次装时下载 ngrok 并装成服务
+# 5. 马上上报一次，云端 ERP 门店列表的「机器」列随即显示就绪
+#
+# 退出码：0 成功；1 号不对或取消；2 写配置失败
+export PATH="/usr/local/bin:$PATH"
+DIR="$(cd "$(dirname "$0")" && pwd)"
+CONFIG_DIR=/var/www/html/Resource/config
+CONFIG_INI=$CONFIG_DIR/config.ini
+CONFIG_JSON=$CONFIG_DIR/config.json
+
+# 和 aaden-cli 其他地方一样用 -S 从 stdin 喂密码（aaden 不一定有免密 sudo）。
+# 注意：不能再往 sudoS 的命令里用管道喂内容——stdin 已经被密码占了，内容一律先写临时文件再 sudoS cp。
+sudoS() { echo "Innerken322." | sudo -S -p '' "$@"; }
+# 先把 sudo 凭据缓存上：后面调的 aaden-cli 子命令（fix-ngrok 等）里还有裸 sudo
+sudoS -v 2>/dev/null
+
+NEW_ID="$1"
+if [ -z "$NEW_ID" ]; then
+  read -r -p '设备号: ' NEW_ID
+fi
+NEW_ID=$(printf '%s' "$NEW_ID" | tr -d '[:space:]')
+if ! [[ "$NEW_ID" =~ ^[0-9]+$ ]]; then
+  echo "设备号必须是数字：'$NEW_ID'"
+  exit 1
+fi
+NEW_ID=$((10#$NEW_ID)) # 去掉前导零，和云端、ERP 编号一致
+NAME="IK$(printf '%04d' "$NEW_ID")"
+HOST="aaden$(printf '%04d' "$NEW_ID")" # 和 ngrok 的 ik 号一样补到 4 位：aaden0001、aaden1958
+
+ini_device_id() {
+  [ -f "$CONFIG_INI" ] || return
+  awk -F= '/^\[/ { s = $0 } s ~ /^\[Device\]/ && $1 ~ /^[ \t]*DeviceId[ \t]*$/ { gsub(/[ \t"\r]/, "", $2); print $2; exit }' "$CONFIG_INI"
+}
+OLD_ID=$(ini_device_id)
+
+if [ "$OLD_ID" = "$NEW_ID" ]; then
+  echo "本机已经是设备号 $NEW_ID，只重新应用主机名、ngrok 并上报"
+else
+  [ -n "$OLD_ID" ] && echo "本机原设备号：$OLD_ID → 改成 $NEW_ID"
+  bash "$DIR/checkDeviceId.sh" "$NEW_ID" || exit 1
+
+  # 已经启用 TSE 的机器改号：TSE 记录会挂到新号上。正常流程是先改号，再「清空数据、启用 TSE」
+  if [ -n "$OLD_ID" ] && grep -qiE '^[ \t]*TseEnabled[ \t]*=[ \t]*"?(true|1)"?[ \t]*$' "$CONFIG_INI"; then
+    echo "⚠ 本机已经启用 TSE（原设备号 $OLD_ID）。正常应该先改号，再清空数据、启用 TSE。"
+    answer=""
+    { exec 3</dev/tty; } 2>/dev/null && read -r -p "确定要改号请输入 yes：" answer <&3 2>/dev/tty
+    [ "$answer" = "yes" ] || { echo "已取消。"; exit 1; }
+  fi
+fi
+
+# ---------------------------------------------------------------- 配置
+if [ ! -f "$CONFIG_INI" ]; then
+  # 全新装机：后端按默认配置生成 config.ini / config.json（以 www-data 写，权限和以前一样）
+  curl -fsS -m 30 "http://localhost/PHP/AutoSetup.php?DeviceId=$NEW_ID" >/dev/null \
+    || { echo "调用 AutoSetup.php 失败（Apache/PHP 还没起来？）"; exit 2; }
+elif [ "$OLD_ID" != "$NEW_ID" ]; then
+  TMP=$(mktemp)
+  awk -v id="$NEW_ID" -v name="$NAME" '
+    function fill() {
+      if (!doneId) print "DeviceId = \"" id "\""
+      if (!doneName) print "DeviceName = \"" name "\""
+    }
+    /^\[/ {
+      if (inDev) fill()
+      inDev = ($0 ~ /^\[Device\][ \t\r]*$/)
+      if (inDev) seen = 1
+      print; next
+    }
+    inDev && /^[ \t]*DeviceId[ \t]*=/ { print "DeviceId = \"" id "\""; doneId = 1; next }
+    inDev && /^[ \t]*DeviceName[ \t]*=/ { print "DeviceName = \"" name "\""; doneName = 1; next }
+    { print }
+    END {
+      if (inDev) fill()
+      if (!seen) { print "[Device]"; print "DeviceId = \"" id "\""; print "DeviceName = \"" name "\"" }
+    }' "$CONFIG_INI" >"$TMP"
+  # cp 覆盖内容、保留原文件的属主和权限
+  sudoS cp "$TMP" "$CONFIG_INI" || { rm -f "$TMP"; echo "写 $CONFIG_INI 失败"; exit 2; }
+  printf '{"DeviceId":"%s","DeviceName":"%s"}' "$NEW_ID" "$NAME" >"$TMP"
+  sudoS cp "$TMP" "$CONFIG_JSON"
+  rm -f "$TMP"
+fi
+if [ "$(ini_device_id)" != "$NEW_ID" ]; then
+  echo "写完配置后读到的设备号是「$(ini_device_id)」，不是 $NEW_ID"
+  exit 2
+fi
+echo "配置已写入：$CONFIG_INI → DeviceId = $NEW_ID"
+
+# ---------------------------------------------------------------- 主机名
+# 先写 /etc/hosts 再改主机名，否则改完的那一刻 sudo 会报 unable to resolve host
+TMP=$(mktemp)
+grep -vE '[[:space:]]aaden[0-9]+[[:space:]]*$' /etc/hosts >"$TMP"
+echo "127.0.1.1 $HOST" >>"$TMP"
+sudoS cp "$TMP" /etc/hosts
+rm -f "$TMP"
+# WSL 没有 systemd 时 hostnamectl 不可用，退回直接写 /etc/hostname
+if ! sudoS hostnamectl set-hostname "$HOST" 2>/dev/null; then
+  TMP=$(mktemp)
+  echo "$HOST" >"$TMP"
+  sudoS cp "$TMP" /etc/hostname && sudoS hostname "$HOST"
+  rm -f "$TMP"
+fi
+echo "主机名：$HOST"
+
+# ---------------------------------------------------------------- ngrok
+aaden-cli update-ngrok-config "$NEW_ID" >/dev/null
+if [ -f /etc/systemd/system/aaden-ngrok-v3.service ] && [ -x /etc/aaden/ngrok ]; then
+  sudoS systemctl restart aaden-ngrok-v3 2>/dev/null || sudoS service aaden-ngrok-v3 restart
+else
+  aaden-cli fix-ngrok # 第一次：下载 ngrok、装 systemd 服务
+fi
+echo "ngrok：ik$(printf '%04d' "$NEW_ID").ngrok.aaden.io，SSH 端口 $((10000 + NEW_ID))"
+
+# ---------------------------------------------------------------- 上报
+# do-log 连不上云端时退出码也是 0，所以回头问云端确认收到了没有
+aaden-cli do-log >/dev/null 2>&1
+MINUTES=$(curl -fsS -m 15 "${AADEN_CLOUD_URL:-https://cloud-v2.aaden.io}/deviceLog/install-check/$NEW_ID" 2>/dev/null \
+  | python3 -c 'import json, sys; m = json.load(sys.stdin).get("lastReportMinutesAgo"); print("" if m is None else m)' 2>/dev/null)
+if [ -n "$MINUTES" ] && [ "$MINUTES" -le 5 ]; then
+  echo "云端已收到本机上报，ERP 门店列表的「机器」列显示就绪"
+else
+  echo "⚠ 云端还没收到本机上报（网络不通？）。联网后每 5 分钟会自动上报一次"
+fi
+exit 0

package/README.md

@@ -28,7 +28,8 @@ Options:
 
 Commands:
   update [channel]
-  install [options] <deviceId> [channel]
+  install [options] <deviceId> [channel]   装机（= AadenDeploy/aadensetup.sh）：撞号检查、装软件、部署后端、设备号、自检并上报
+  set-device-id [deviceId]                 设定本机设备号：撞号检查、config.ini、主机名、ngrok、立即上报（镜像克隆的机器改号也用它）
   setup-wifi
   upgrade
   where

package/dist/index.js

@@ -18729,7 +18729,7 @@ module.exports = JSON.parse('{"name":"axios","version":"0.19.2","description":"P
 /***/ ((module) => {
 
 "use strict";
-module.exports = JSON.parse('{"i8":"1.6.109-rc.0"}');
+module.exports = {"i8":"1.6.109"};
 
 /***/ })
 
@@ -18843,6 +18843,8 @@ program.command('rollback').action(rollback)
 program
     .command('install <deviceId>')
     .action(install)
+// 设定本机设备号（= ERP 门店编号）：撞号检查 + config.ini + 主机名 + ngrok + 立即上报。装机和镜像克隆来的机器改号都用它
+program.command('set-device-id [deviceId]').action(setDeviceId)
 program.command('remove-all-data').action(removeAllData)
 program.command('mount-tse').action(remountTSE)
 program.command('upgrade').action(upgrade) // auto execute.
@@ -19110,12 +19112,13 @@ async function updateNgrokConfig(deviceId) {
     console.log('Start to config Ngrok service')
     console.log('开始配置' + deviceId + '设备的Ngrok服务')
 
+    // 和其他地方一样用 -S 喂密码：aaden 没有免密 sudo、又没有终端时（set-device-id 被脚本调用）裸 sudo 会直接失败
     const command = [
         'cd /etc',
-        'sudo mkdir -p aaden',
+        'echo "Innerken322." | sudo -S -p \'\' mkdir -p aaden',
         'cd aaden',
-        'sudo touch ngrok-config.yml',
-        'sudo chmod 777 ngrok-config.yml',
+        'echo "Innerken322." | sudo -S -p \'\' touch ngrok-config.yml',
+        'echo "Innerken322." | sudo -S -p \'\' chmod 777 ngrok-config.yml',
         `echo "
 server_addr: ngrok.aaden.io:4443
 trust_host_root_certs: true
@@ -19527,11 +19530,29 @@ async function install(deviceId) {
             'cd AadenDeploy',
             `./aadensetup.sh ${deviceId} ${channel}` + (installApp ? ' b' : '')
         ]
-        await cli.executeInShell(command, program.debug)
+        // 「出厂安装」事件由 aadensetup.sh 自己在最后上报（带每一步的结果和自检），这里不再重复记
+        const {code} = await cli.executeInShell(command, program.debug)
+        process.exitCode = code
     } else {
         console.log('Device Id is invalid.')
     }
-    logAction("出厂安装")
+}
+
+async function setDeviceId(deviceId) {
+    const oldId = getMyDeviceId()
+    const command = [
+        ...getPrivilegeCMD('AadenDeploy/setDeviceId.sh'),
+        'cd AadenDeploy',
+        `./setDeviceId.sh ${deviceId && deviceId !== 'notset' ? deviceId : ''}`
+    ]
+    const {code} = await cli.executeInShell(command, program.debug)
+    // aadensetup.sh 按退出码判断这一步成没成
+    process.exitCode = code
+    if (code !== 0) {
+        return
+    }
+    const newId = getMyDeviceId()
+    await logAction(String(oldId) === String(newId) ? `重新应用设备号 ${newId}` : `设定设备号 ${oldId === -1 ? '（无）' : oldId} → ${newId}`)
 }
 
 function getMyDeviceId() {
@@ -19709,7 +19730,7 @@ function getPrivilegeCMD(path, pri = '+x', relativePath = true) {
     if (relativePath) {
         command.push(goIntoRootDir())
     }
-    command.push(`echo "Innerken322." | sudo -S chmod ${pri} ${path}`)
+    command.push(`echo "Innerken322." | sudo -S -p "" chmod ${pri} ${path}`)
     return command
 }
 

package/dist/patch/202608190700removeGitDoUpdateCron.sh

@@ -0,0 +1,39 @@
+#!/bin/bash
+# 一次性修复：摘掉老 git 通道的 doUpdate cron。
+#
+# 病症：设备 crontab 里有
+#     59 4 * * *  curl -X POST 'http://localhost/PHP/UpdateSelf.php?op=doUpdate'
+#     @reboot ... curl -X POST '.../UpdateSelf.php?op=doUpdate'
+# 它每天 04:59（和 @reboot）从**设备本地陈旧 gitCache** 部署后端；而 git fetch 因 deploy key
+# 未分发到全网而失败（FETCH_HEAD 0 字节），缓存卡在旧版本；git 通道又没有"绝不降级"保护 →
+# 于是把 light-update 刚更好的新版本降级回退（实测 1.9.63 → 1.9.62/1.9.61，每天来回打架）。
+#
+# 结论：light-update(S3/code.zip 通道)已是后端唯一活着的更新通道，且自带"只升不降"版本门。
+# 摘掉 doUpdate cron，终结两条通道打架。crontab 不走 git/S3 部署 → 改了就稳。
+#
+# 幂等：没有该行就不动；grep -vF 精确匹配整串，不误伤 crontab.sh / light-update 那几行。
+set -u
+
+MARK='UpdateSelf.php?op=doUpdate'
+
+strip_for() {  # $1 = 目标用户（空=当前用户）
+    local u="$1" cur new
+    local args=()
+    [ -n "$u" ] && args=(-u "$u")
+    cur=$(crontab "${args[@]}" -l 2>/dev/null) || return 0
+    printf '%s\n' "$cur" | grep -qF "$MARK" || return 0     # 没有该 cron → 不动
+    new=$(printf '%s\n' "$cur" | grep -vF "$MARK")
+    printf '%s\n' "$new" | crontab "${args[@]}" - \
+        && echo "  已从 ${u:-当前用户} 的 crontab 摘除 doUpdate cron"
+}
+
+# doUpdate cron 在 aaden 用户的 crontab。patch 正常由 root 的 auto-upgrade 触发 → 用 -u aaden；
+# 兜底再扫一遍当前用户（万一某些设备以 aaden 直接跑 patch），谁有就摘谁。
+if [ "$(id -u)" = "0" ]; then
+    strip_for aaden
+    strip_for ""
+else
+    strip_for ""
+fi
+
+echo "  removeGitDoUpdateCron 完成（light-update 成为后端唯一更新通道）"

package/index.js

@@ -40,6 +40,8 @@ program.command('rollback').action(rollback)
 program
     .command('install <deviceId>')
     .action(install)
+// 设定本机设备号（= ERP 门店编号）：撞号检查 + config.ini + 主机名 + ngrok + 立即上报。装机和镜像克隆来的机器改号都用它
+program.command('set-device-id [deviceId]').action(setDeviceId)
 program.command('remove-all-data').action(removeAllData)
 program.command('mount-tse').action(remountTSE)
 program.command('upgrade').action(upgrade) // auto execute.
@@ -307,12 +309,13 @@ async function updateNgrokConfig(deviceId) {
     console.log('Start to config Ngrok service')
     console.log('开始配置' + deviceId + '设备的Ngrok服务')
 
+    // 和其他地方一样用 -S 喂密码：aaden 没有免密 sudo、又没有终端时（set-device-id 被脚本调用）裸 sudo 会直接失败
     const command = [
         'cd /etc',
-        'sudo mkdir -p aaden',
+        'echo "Innerken322." | sudo -S -p \'\' mkdir -p aaden',
         'cd aaden',
-        'sudo touch ngrok-config.yml',
-        'sudo chmod 777 ngrok-config.yml',
+        'echo "Innerken322." | sudo -S -p \'\' touch ngrok-config.yml',
+        'echo "Innerken322." | sudo -S -p \'\' chmod 777 ngrok-config.yml',
         `echo "
 server_addr: ngrok.aaden.io:4443
 trust_host_root_certs: true
@@ -724,11 +727,29 @@ async function install(deviceId) {
             'cd AadenDeploy',
             `./aadensetup.sh ${deviceId} ${channel}` + (installApp ? ' b' : '')
         ]
-        await cli.executeInShell(command, program.debug)
+        // 「出厂安装」事件由 aadensetup.sh 自己在最后上报（带每一步的结果和自检），这里不再重复记
+        const {code} = await cli.executeInShell(command, program.debug)
+        process.exitCode = code
     } else {
         console.log('Device Id is invalid.')
     }
-    logAction("出厂安装")
+}
+
+async function setDeviceId(deviceId) {
+    const oldId = getMyDeviceId()
+    const command = [
+        ...getPrivilegeCMD('AadenDeploy/setDeviceId.sh'),
+        'cd AadenDeploy',
+        `./setDeviceId.sh ${deviceId && deviceId !== 'notset' ? deviceId : ''}`
+    ]
+    const {code} = await cli.executeInShell(command, program.debug)
+    // aadensetup.sh 按退出码判断这一步成没成
+    process.exitCode = code
+    if (code !== 0) {
+        return
+    }
+    const newId = getMyDeviceId()
+    await logAction(String(oldId) === String(newId) ? `重新应用设备号 ${newId}` : `设定设备号 ${oldId === -1 ? '（无）' : oldId} → ${newId}`)
 }
 
 function getMyDeviceId() {
@@ -906,7 +927,7 @@ function getPrivilegeCMD(path, pri = '+x', relativePath = true) {
     if (relativePath) {
         command.push(goIntoRootDir())
     }
-    command.push(`echo "Innerken322." | sudo -S chmod ${pri} ${path}`)
+    command.push(`echo "Innerken322." | sudo -S -p "" chmod ${pri} ${path}`)
     return command
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aaden-cli",
-  "version": "1.6.109-rc.0",
+  "version": "1.6.109",
   "description": "",
   "main": "dist/index.js",
   "scripts": {
@@ -19,7 +19,7 @@
   "license": "ISC",
   "release-it": {
     "hooks": {
-      "after:bump": "ncc build index.js -o dist -C"
+      "after:bump": "rm -rf dist && ncc build index.js -o dist -C"
     },
     "npm": {
       "publish": false

package/patch/202608190700removeGitDoUpdateCron.sh

@@ -0,0 +1,39 @@
+#!/bin/bash
+# 一次性修复：摘掉老 git 通道的 doUpdate cron。
+#
+# 病症：设备 crontab 里有
+#     59 4 * * *  curl -X POST 'http://localhost/PHP/UpdateSelf.php?op=doUpdate'
+#     @reboot ... curl -X POST '.../UpdateSelf.php?op=doUpdate'
+# 它每天 04:59（和 @reboot）从**设备本地陈旧 gitCache** 部署后端；而 git fetch 因 deploy key
+# 未分发到全网而失败（FETCH_HEAD 0 字节），缓存卡在旧版本；git 通道又没有"绝不降级"保护 →
+# 于是把 light-update 刚更好的新版本降级回退（实测 1.9.63 → 1.9.62/1.9.61，每天来回打架）。
+#
+# 结论：light-update(S3/code.zip 通道)已是后端唯一活着的更新通道，且自带"只升不降"版本门。
+# 摘掉 doUpdate cron，终结两条通道打架。crontab 不走 git/S3 部署 → 改了就稳。
+#
+# 幂等：没有该行就不动；grep -vF 精确匹配整串，不误伤 crontab.sh / light-update 那几行。
+set -u
+
+MARK='UpdateSelf.php?op=doUpdate'
+
+strip_for() {  # $1 = 目标用户（空=当前用户）
+    local u="$1" cur new
+    local args=()
+    [ -n "$u" ] && args=(-u "$u")
+    cur=$(crontab "${args[@]}" -l 2>/dev/null) || return 0
+    printf '%s\n' "$cur" | grep -qF "$MARK" || return 0     # 没有该 cron → 不动
+    new=$(printf '%s\n' "$cur" | grep -vF "$MARK")
+    printf '%s\n' "$new" | crontab "${args[@]}" - \
+        && echo "  已从 ${u:-当前用户} 的 crontab 摘除 doUpdate cron"
+}
+
+# doUpdate cron 在 aaden 用户的 crontab。patch 正常由 root 的 auto-upgrade 触发 → 用 -u aaden；
+# 兜底再扫一遍当前用户（万一某些设备以 aaden 直接跑 patch），谁有就摘谁。
+if [ "$(id -u)" = "0" ]; then
+    strip_for aaden
+    strip_for ""
+else
+    strip_for ""
+fi
+
+echo "  removeGitDoUpdateCron 完成（light-update 成为后端唯一更新通道）"

package/dist/patch/202304051415FixDatevMemory.sh

@@ -1,19 +0,0 @@
-echo "Innerken322." | sudo -S su
-sudo touch /etc/aaden/AbstractDatevCsvFile.php
-sudo chmod 777 /etc/aaden/AbstractDatevCsvFile.php
-php -r $'print preg_replace(\'/ {4}public function toCsvArray\(\$items\)\r?\n(?:.*\r?\n)+? {4}}/\', <<<\'PHP\'
-    public function toCsvArray($items)
-    {
-        yield $this->getHeader()->toArray($items[\'header\']);
-
-        $fields = $this->getFields();
-
-        yield array_map(Utils::itAccessMethod(\'getName\'), $fields);
-
-        foreach ($items[\'body\'] as $item) {
-            yield array_map(Utils::itAccessMethod(\'transform\', $item), $fields);
-        }
-    }
-PHP
-    , file_get_contents("/var/www/html/PHP/Datev/FileStructures/AbstractDatevCsvFile.php"));' > /etc/aaden/AbstractDatevCsvFile.php
-sudo cp /etc/aaden/AbstractDatevCsvFile.php /var/www/html/PHP/Datev/FileStructures/AbstractDatevCsvFile.php

package/patch/202304051415FixDatevMemory.sh

@@ -1,19 +0,0 @@
-echo "Innerken322." | sudo -S su
-sudo touch /etc/aaden/AbstractDatevCsvFile.php
-sudo chmod 777 /etc/aaden/AbstractDatevCsvFile.php
-php -r $'print preg_replace(\'/ {4}public function toCsvArray\(\$items\)\r?\n(?:.*\r?\n)+? {4}}/\', <<<\'PHP\'
-    public function toCsvArray($items)
-    {
-        yield $this->getHeader()->toArray($items[\'header\']);
-
-        $fields = $this->getFields();
-
-        yield array_map(Utils::itAccessMethod(\'getName\'), $fields);
-
-        foreach ($items[\'body\'] as $item) {
-            yield array_map(Utils::itAccessMethod(\'transform\', $item), $fields);
-        }
-    }
-PHP
-    , file_get_contents("/var/www/html/PHP/Datev/FileStructures/AbstractDatevCsvFile.php"));' > /etc/aaden/AbstractDatevCsvFile.php
-sudo cp /etc/aaden/AbstractDatevCsvFile.php /var/www/html/PHP/Datev/FileStructures/AbstractDatevCsvFile.php