magpie-gemini-web 0.5.3 → 0.5.4

package/README.en.md

@@ -17,7 +17,7 @@ The plugin provides two independent providers that can be used individually or t
 | **Thinking levels** | `minimal` / `low` / `medium` / `high` (`minimal` is fastest & cheapest) | `low` (base) / `high` (`-thinking` extended thinking) |
 | **Sign-in method** | Sign in directly in an isolated popup browser window | Copy `cookie` from a private/incognito window |
 | **Usage cards** | Shows models currently on cooldown and recovery times | Syncs **5-hour** & **weekly** usage and reset times from the web |
-| **Local backend** | AIStudio2API (`v0.2.13`) | gemini-web2api-go (`4.22.0-magpie.1` optimized build) |
+| **Local backend** | AIStudio2API (`v0.2.14`) | gemini-web2api-go (`4.22.0-magpie.1` optimized build) |
 
 ---
 
@@ -135,8 +135,8 @@ When a plugin error asks you to run a command, it includes the full ready-to-cop
 - Concurrency is capped at 1, but Google account rate-limiting or flagging cannot be completely ruled out—use at your own risk.
 
 **AI Studio upgrades and model selection:**
-- The plugin pins SHA-256-verified `v0.2.13-magpie.1`, based on upstream `v0.2.13`. Upgrade the plugin to update the backend. Official managed releases at or below that upstream version are upgraded on the next managed startup, preserving accounts, port and sign-in credentials.
-- **Online updates are disabled in the managed backend on macOS, Linux, and Windows.** The admin page directs users to upgrade through the Magpie plugin; the update endpoint returns HTTP 403 and update checks do not contact GitHub. Independently managed external servers are unaffected. See [docs/studio-release.md](docs/studio-release.md) for the patch and reproducible build process.
+- The plugin pins SHA-256-verified `v0.2.14-magpie.1`, based on upstream `v0.2.14`. Upgrade the plugin to update the backend. Official releases at or below that upstream version, and managed backends an older plugin installed, are upgraded on the next managed startup, preserving accounts, port and sign-in credentials.
+- **Online updates are disabled in the managed backend on macOS, Linux, and Windows.** The admin page says updates are managed by magpie-gemini-web; the update endpoint returns HTTP 409 and update checks do not contact GitHub. Independently managed external servers are unaffected. See [docs/studio-release.md](docs/studio-release.md) for how the managed build is made and reproduced.
 - Managed Unix installs still attempt to set `package/` to `0555` as additional file protection. Permission failures do not block service, and disabling online updates does not depend on permissions. To reset by manually deleting the data directory, stop the service first, then run `chmod -R u+w "<data-dir>/package"` before deleting it; replace `<data-dir>` with the actual path.
 - If a newer or custom version is installed, the plugin reports a conflict with `stop`, `install`, and `start` commands carrying the correct `--data-dir`. Stop can recover a changed listener PID and verifies its executable path before signaling it. If HTTP is down but the process is still alive, the plugin refuses to reinstall or launch a second process.
 - When stopped, a replaced executable is restored from the verified pinned archive; failed verification never launches the replacement. Existing account and runtime data files are kept, but **an older backend may not read data migrated by a newer version**. Before manually downgrading, stop the service and back up the entire data directory, including `auth/` and `runtime/requests.db`. If data migration is known to have occurred, update the plugin to match the newer backend.

package/README.md

@@ -17,7 +17,7 @@
 | **思考档位** | `minimal` / `low` / `medium` / `high` 四档（`minimal` 最快最省） | `low`（普通）/ `high`（`-thinking` 扩展思考）两档 |
 | **登录方式** | 弹出独立浏览器窗口直接登录 Google | 用无痕窗口登录并复制 `cookie` |
 | **额度卡片** | 显示冷却中的模型与恢复时间 | 同步网页版 **5 小时** 与 **每周** 用量及重置时间 |
-| **本地后端** | AIStudio2API (`v0.2.13`) | gemini-web2api-go (`4.22.0-magpie.1` 优化版) |
+| **本地后端** | AIStudio2API (`v0.2.14`) | gemini-web2api-go (`4.22.0-magpie.1` 优化版) |
 
 ---
 
@@ -135,8 +135,8 @@ magpie plugin options magpie-gemini-web '{"studio":{"proxy":"http://127.0.0.1:78
 - 插件将请求并发限制为 1，但仍无法完全排除 Google 账号风控风险，请自行评估使用。
 
 **AI Studio 升级与模型范围：**
-- 插件固定使用经过 SHA-256 校验的 `v0.2.13-magpie.1`（基于上游 `v0.2.13`），通过升级插件更新后端。同基线或更旧的官方托管后端在下次管理启动时自动升级，保留账号、端口与登录凭据。
-- **托管后端已在 macOS、Linux、Windows 统一禁用在线更新**：管理页提示“请通过 Magpie 插件升级”，更新接口返回 HTTP 403，检查更新也不会访问 GitHub。用户自行连接的外部服务不受影响。补丁和可复现构建流程见 [docs/studio-release.md](docs/studio-release.md)。
+- 插件固定使用经过 SHA-256 校验的 `v0.2.14-magpie.1`（基于上游 `v0.2.14`），通过升级插件更新后端。同基线或更旧的官方版、以及旧版插件装的托管后端，在下次管理启动时自动升级，保留账号、端口与登录凭据。
+- **托管后端已在 macOS、Linux、Windows 统一禁用在线更新**：管理页提示“更新由 magpie-gemini-web 管理”，更新接口返回 HTTP 409，检查更新也不会访问 GitHub。用户自行连接的外部服务不受影响。托管构建方式和可复现构建流程见 [docs/studio-release.md](docs/studio-release.md)。
 - Unix 的 `package/` 仍尽力设置为 `0555`，作为额外的文件保护；权限设置失败不阻断服务，在线更新的禁用也不依赖该权限。若要手动删除数据目录来重置，请先停止服务，再运行 `chmod -R u+w "<数据目录>/package"` 恢复可写权限，然后删除；将 `<数据目录>` 替换为实际路径。
 - 若自行更新到更新版或定制版，插件会提示版本冲突，并提供带正确 `--data-dir` 的 `stop`、`install`、`start` 命令。停止时会找回更新后的监听进程 PID，并核对可执行文件路径；无法核实身份就不会发送终止信号。HTTP 端口关闭但进程尚未退出时，插件不会重装或启动第二个进程。
 - 已停止但文件被替换的后端会从校验通过的固定版本安装包恢复；校验失败不会启动替换文件。安装会保留账号和运行数据文件，但**不保证旧版本能读取新版迁移过的数据**。手动降级前先停止服务并备份整个数据目录（包括 `auth/`、`runtime/requests.db` 等）；已知发生数据迁移时应升级插件以匹配新版后端。

package/docs/studio-release.md

@@ -1,29 +1,29 @@
 # AI Studio 托管后端构建
 
-插件使用 `0.2.13-magpie.1`，基于 AIStudio2API `v0.2.13` 的固定 commit。上游版本、commit、Go 工具链、安装包及二进制 SHA-256 均记录在 `lib/studio-release.json`。MIT 许可见 `LICENSE-AISTUDIO`。
+插件使用 `0.2.14-magpie.1`，基于 AIStudio2API `v0.2.14` 的固定 commit。上游版本、commit、Go 工具链、安装包及二进制 SHA-256 均记录在 `lib/studio-release.json`。MIT 许可见 `LICENSE-AISTUDIO`。
 
 ## 在线更新策略
 
-`patches/studio-managed.patch` 包含后端与管理页面修改：
+上游从 v0.2.14 起支持由分发方管理更新，不再需要补丁。构建时通过 `-ldflags` 写入两个值：
 
-- 后端移除在线更新的下载、文件替换逻辑；`GET /api/update`（包括 `?refresh=1`）仅返回本地版本及 `mode: managed`，不访问 GitHub。
-- `POST /api/update` 返回 HTTP 403，提示通过 Magpie 插件升级；不替换文件、不重启。此策略无环境变量或管理页开关，在所有构建平台相同。
-- 管理页版本面板显示当前版本及中英文升级提示，不提供检查更新或安装更新按钮。
-- 设置明确的 `v0.2.13-magpie.1` 版本标识。插件将同基线或更旧的官方版视为需要升级；更新的官方版或不认识的定制版仍提示冲突。
-- 普通插件升级、账户登录、模型调用及管理功能继续保留。用户自行连接的外部 AIStudio2API 服务不受此补丁控制。
+- `internal/app.version=v0.2.14-magpie.1`：明确的版本标识。插件把同基线或更旧的官方版、以及更旧的托管版（`-magpie.N` 的基线更低，或同基线但 N 更小）视为需要升级；更新的官方版、更新的托管版或不认识的定制版仍提示冲突。
+- `internal/app.managedBy=magpie-gemini-web`：更新模式为 `managed`。`GET /api/update`（包括 `?refresh=1`）只返回本地版本、`mode: managed` 和 `managed_by`，不访问 GitHub；`POST /api/update` 返回 HTTP 409，说明更新由 magpie-gemini-web 管理，不下载、不替换文件、不重启。这两个值在链接时写死，没有环境变量或管理页开关，在所有构建平台相同。
+- 管理页版本面板显示当前版本和"更新由 magpie-gemini-web 管理"，不显示检查更新或安装按钮。上游的在线更新代码仍然编译在内，但托管模式下走不到；`studio:managed:smoke` 用真实二进制验证这一点。
+- 构建不带 `desktop` 标签，即上游的命令行版，不包含桌面窗口。
+- 普通插件升级、账户登录、模型调用及管理功能继续保留。用户自行连接的外部 AIStudio2API 服务不受影响。
 
 ## 复现构建
 
 维护者需要 Git、tar、Node.js 26.8.2（构建页面用）、Go 1.27.1。Windows 使用 Git Bash 执行以下命令，安装包运行和解压使用 Windows 自带 PowerShell。最终用户不需要这些构建工具。
 
 ```bash
-# 按固定源代码和补丁构建所有五个平台，并核对现有 pin。
+# 按固定源代码构建所有五个平台，并核对现有 pin。
 npm run studio:release:build
 
 # 仅构建当前平台。
 node scripts/studio-release.mjs --target=host --verify
 
-# 制作新版本：审查源码/补丁后重新生成所有平台 pin。
+# 制作新版本：审查上游源码后重新生成所有平台 pin。
 node scripts/studio-release.mjs --write-pins
 
 # 可复用本地上游 git 仓库，但始终导出固定 commit，不使用工作区修改。
@@ -42,8 +42,8 @@ npm run studio:managed:smoke
 AI_STUDIO_TEST_ARCHIVE=/absolute/path/to/archive.tar.gz npm test
 ```
 
-真实安装验证检查启动、版本、GET 更新状态、POST 更新返回 403、二进制及 PID 不变、管理页面无更新入口、停止与状态。`.github/workflows/studio.yml` 在五种系统/架构上重新构建、对比 SHA-256 并运行该验证；本机交叉编译不代替 Windows 真机验证。
+真实安装验证检查启动、版本、GET 更新状态、POST 更新返回 409、二进制及 PID 不变、管理页面显示托管提示、停止与状态。`.github/workflows/studio.yml` 在五种系统/架构上重新构建、对比 SHA-256 并运行该验证；本机交叉编译不代替 Windows 真机验证。
 
-发布时先审查构建记录和各平台 CI 结果，再将安装包及许可证上传到本仓库 `studio-v0.2.13-magpie.1` release。该 release 可公开下载后，才能发布引用它的插件版本，否则新安装会遇到 404。构建脚本及 CI 不自动发布 release，也不发布 npm 包。
+发布时先审查构建记录和各平台 CI 结果，再将安装包及许可证上传到本仓库 `studio-v0.2.14-magpie.1` release。该 release 可公开下载后，才能发布引用它的插件版本，否则新安装会遇到 404。构建脚本及 CI 不自动发布 release，也不发布 npm 包。
 
-本地试用无需发布：先停止当前托管后端，再执行 `node scripts/studio.mjs install --archive /absolute/path/to/archive` 和 `node scripts/studio.mjs start`。可用 `--data-dir` 指定目录。修改前备份账号和配置；该定制版本与上游 v0.2.13 使用相同的数据格式。
+本地试用无需发布：先停止当前托管后端，再执行 `node scripts/studio.mjs install --archive /absolute/path/to/archive` 和 `node scripts/studio.mjs start`。可用 `--data-dir` 指定目录。修改前备份账号和配置；该版本与上游 v0.2.14 使用相同的数据格式。v0.2.14 对数据的改动都是新增的（账号记录的可选字段、新的 `runtime/prompts.db`、`.env` 的新设置），用真实账号验证过：`v0.2.13-magpie.1` 的数据可以直接被它读取，用它运行过之后退回 `v0.2.13-magpie.1` 也能正常使用。

package/lib/studio-native.mjs

@@ -178,7 +178,7 @@ const ENV_KEYS = [
   'WARM_WORKER_LIMIT', 'MAX_ACTIVE_WORKERS', 'WARM_STARTUP_CONCURRENCY', 'PER_ACCOUNT_CONCURRENCY',
   'ROUTING_STRATEGY', 'UPSTREAM_CHANNELS', 'MODEL_MAPPING', 'TEMPORARY_CHAT', 'WAA_BACKEND', 'AUTO_START',
   'REQUEST_BODY_LOG', 'LOG_FILE', 'LOG_MAX_TOTAL_MB', 'ADMIN_AUTH_ENABLED', 'ADMIN_USERNAME', 'ADMIN_PASSWORD',
-  'BUILD_NATIVE_NONSTREAM'
+  'BUILD_NATIVE_NONSTREAM', 'MODEL_CHANNELS', 'MEDIA_OUTPUT', 'MEDIA_BASE_URL'
 ];
 
 // SETTING_DEFAULTS are the settings the admin page owns, as a new setup has them. They are written
@@ -668,6 +668,20 @@ export function isConnectRefused(err) {
   return false;
 }
 
+// olderStudioVersion says whether a version (without its v) is one this plugin may replace: an
+// official X.Y.Z at or below the upstream base, or a managed X.Y.Z-magpie.N on an older base, or
+// on the same base with a lower N.
+function olderStudioVersion(version) {
+  const running = /^(\d+)\.(\d+)\.(\d+)(?:-magpie\.(\d+))?$/.exec(version);
+  if (!running) return false;
+  const ours = /-magpie\.(\d+)$/.exec(release.version);
+  const base = running.slice(1, 4).map(Number);
+  const expected = release.upstream.version.split('.').map(Number);
+  const different = base.findIndex((n, i) => n !== expected[i]);
+  if (different !== -1) return base[different] < expected[different];
+  return running[4] === undefined || Number(running[4]) < Number(ours[1]);
+}
+
 // checkStudioHealth says what answers on the setup's port: 'down' (nothing), 'up' (this setup's
 // service, at the pinned version), 'outdated' (an older official version),
 // 'version_conflict' (a newer or custom version installed outside this plugin),
@@ -713,14 +727,11 @@ export async function checkStudioHealth(local, fetchFn) {
     }
   }
 
-  // Official releases at or below our upstream base can move to the managed
-  // build. Newer/custom installations require an explicit recovery decision.
+  // Official releases at or below our upstream base, and managed builds older than this one, can
+  // move to this managed build. Newer/custom installations require an explicit recovery decision.
   const runningVersion = String(status.version).replace(/^v/, '');
   if (runningVersion !== release.version) {
-    const parts = /^\d+\.\d+\.\d+$/.test(runningVersion) ? runningVersion.split('.').map(Number) : null;
-    const expected = release.upstream.version.split('.').map(Number);
-    const different = parts?.findIndex((n, i) => n !== expected[i]);
-    const older = parts && (different === -1 || parts[different] < expected[different]);
+    const older = olderStudioVersion(runningVersion);
     return { state: older ? 'outdated' : 'version_conflict', status, reason: `Running version ${status.version}, expected ${STUDIO_VERSION}` };
   }
 

package/lib/studio-release.json

@@ -1,38 +1,38 @@
 {
-  "version": "0.2.13-magpie.1",
+  "version": "0.2.14-magpie.1",
   "repository": "BUKOWSKIREAL/magpie-gemini-web",
-  "tag": "studio-v0.2.13-magpie.1",
+  "tag": "studio-v0.2.14-magpie.1",
   "goVersion": "1.27.1",
   "upstream": {
-    "version": "0.2.13",
+    "version": "0.2.14",
     "repository": "https://github.com/Mag1cFall/AIStudio2API.git",
-    "commit": "a784c5193b3ba5c4894d536b2f4cd73e87f99475"
+    "commit": "370a313814099b508881807effa2a9d72f2d7e66"
   },
   "binaries": {
     "darwin-arm64": {
-      "asset": "aistudio2api-v0.2.13-magpie.1-darwin-arm64.tar.gz",
-      "sha256": "3145f1fc3e88dafc1c43ecfa4ed7c6f82d1126a2d8add02605d05f1c5c404144",
-      "binarySha256": "7d727bf1cc5a86d9c1a2a99d73d645f38a0597489ef62e2bf20b0d33dd87369d"
+      "asset": "aistudio2api-v0.2.14-magpie.1-darwin-arm64.tar.gz",
+      "sha256": "f649c21837741bdb448407f79a3bc998429b446408ef3117a897103b9a47ee72",
+      "binarySha256": "999e49572dede3a63f538e3f62ceed5f03349459bdf391fd49fd57784985e13b"
     },
     "darwin-x64": {
-      "asset": "aistudio2api-v0.2.13-magpie.1-darwin-amd64.tar.gz",
-      "sha256": "96994351570105a6de4e1c95800231ad20d762ee010cfa238bfef11101124c27",
-      "binarySha256": "428963b5bd3c9c35b88c7a7f29923c5a5a6bef5d0fcd511274daa8a8ebc9f686"
+      "asset": "aistudio2api-v0.2.14-magpie.1-darwin-amd64.tar.gz",
+      "sha256": "ece680b5dfef57b0b0e96d639b618b74570e6e194f58808d762da85fd41d9b4a",
+      "binarySha256": "970df3ac51719721d908162d0233d80711f6c3ee007e193d0a73b6e4e596ca9a"
     },
     "linux-x64": {
-      "asset": "aistudio2api-v0.2.13-magpie.1-linux-amd64.tar.gz",
-      "sha256": "9e24fb139abb0bcd8f6cbab23ac1875136f3ecacd30919fbcc25fe342feb369c",
-      "binarySha256": "de8c25f07870d83dd2ebc03b9be1f6e15b4f93f454dfe8f5c4182c72261bcbfa"
+      "asset": "aistudio2api-v0.2.14-magpie.1-linux-amd64.tar.gz",
+      "sha256": "f6c7b52a739e4534236f055280fcddd48e64b56fdb954a7844eb453226d5b67f",
+      "binarySha256": "316306225bcc343188d6d81635d4bd79e7e82bd5c51b1009cd25361deb3b5e61"
     },
     "linux-arm64": {
-      "asset": "aistudio2api-v0.2.13-magpie.1-linux-arm64.tar.gz",
-      "sha256": "7b7057abd8e298685f4ca835e014a48c9b1904a253ebfbc053e4b1d7712c532c",
-      "binarySha256": "151fd830cf0da8801d49e448021d73cde0adb51e982b3a8604cdcbc5babd21c4"
+      "asset": "aistudio2api-v0.2.14-magpie.1-linux-arm64.tar.gz",
+      "sha256": "a5b838b9b64e78d402372cae6b88e1f3faba406747e598e976728c71da3a75ef",
+      "binarySha256": "a5e9573b9edad7fb246178fb4c3d21a0d4905789fd59abf96656d57f26b7526e"
     },
     "win32-x64": {
-      "asset": "aistudio2api-v0.2.13-magpie.1-windows-amd64.zip",
-      "sha256": "aa337556362ce9c16cae71117a9c12e20b623b12665dd5f36cf01bf152d72fbb",
-      "binarySha256": "4a0c32be722dcc27c9046fe410d6af7efd576c4192cb1158c84468cada4fbd30"
+      "asset": "aistudio2api-v0.2.14-magpie.1-windows-amd64.zip",
+      "sha256": "ccd5b96dabebbc0f1d510959c698beb9d9af09bb65d8b0e021327970b3173384",
+      "binarySha256": "ce784c98f1558395a670421ef6cc7d36dde5313f74788f7df5772851c241ae06"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "magpie-gemini-web",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "description": "Gemini Web and Google AI Studio provider for Magpie, backed by gemini-web2api-go and AIStudio2API",
   "type": "module",
   "main": "./index.mjs",

package/scripts/studio-managed-smoke.mjs

@@ -25,6 +25,7 @@ try {
   for (const query of ['', '?refresh=1']) {
     const update = await studioAdmin(local, 'GET', `/api/update${query}`);
     assert.equal(update.mode, 'managed');
+    assert.equal(update.managed_by, 'magpie-gemini-web');
     assert.equal(update.available, false);
     assert.equal(update.updating, false);
     assert.equal(update.current, STUDIO_VERSION);
@@ -36,8 +37,8 @@ try {
       if (String(args[0]).endsWith('/api/update')) updateHTTP = response.status;
       return response;
     }
-  }), /Magpie/);
-  assert.equal(updateHTTP, 403);
+  }), /magpie-gemini-web/);
+  assert.equal(updateHTTP, 409);
   assert.equal(computeFileHash(bin), pin.binarySha256, 'update must not replace the binary');
   assert.equal(fs.readFileSync(path.join(dataDir, 'backend.pid'), 'utf8'), pidBefore, 'update must not restart');
   const html = await (await fetch(local.origin)).text();
@@ -47,11 +48,12 @@ try {
   const versionPanel = /(?:\.\/|\/assets\/)?(VersionPanel-[\w-]+\.js)/.exec(js)?.[1];
   assert.ok(versionPanel, 'built admin version panel must exist');
   const panel = await (await fetch(`${local.origin}/assets/${versionPanel}`)).text();
-  assert.match(panel, /Online updates are disabled/);
-  assert.ok(!panel.includes('applyUpdate'), 'version panel must not offer online installation');
+  // Upstream's panel keeps its install button for other builds and shows a managed build's note
+  // in its place; the refusal above is what keeps the binary
+  assert.match(panel, /version\.managed/);
   assert.deepEqual(await stopStudio({ dataDir }), { stopped: true });
   assert.equal((await studioStatus({ dataDir })).status, 'stopped');
-  console.log(`PASS ${key}: ${STUDIO_VERSION}, managed status, update HTTP 403, unchanged executable/PID, managed UI, clean stop`);
+  console.log(`PASS ${key}: ${STUDIO_VERSION}, managed status, update HTTP 409, unchanged executable/PID, managed UI, clean stop`);
 } finally {
   let stopped = !local;
   if (local) stopped = (await stopStudio({ dataDir }).catch(() => ({ stopped: false }))).stopped;

package/scripts/studio-release.mjs

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
-// Clean upstream commit + reviewed patch -> managed archives, never a developer's dirty tree.
+// Clean upstream commit -> managed archives, never a developer's dirty tree. Upstream's own
+// distributor settings make the build managed: it reports this version, and its online updater
+// neither checks GitHub nor installs, saying the plugin manages updates.
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -34,9 +36,9 @@ const hash = file => crypto.createHash('sha256').update(fs.readFileSync(file)).d
 const go = (argv, extra = {}) => execFileSync('go', argv, { cwd: source, env: { ...env, ...extra }, stdio: 'inherit' });
 const npm = argv => execFileSync(process.platform === 'win32' ? 'npm.cmd' : 'npm', argv,
   { cwd: path.join(source, 'web'), stdio: 'inherit', shell: process.platform === 'win32' });
-const patch = path.join(root, 'patches/studio-managed.patch');
+const MANAGED_BY = 'magpie-gemini-web';
 const flags = ['-mod=readonly', '-trimpath', '-buildvcs=false',
-  `-ldflags=-s -w -X github.com/Mag1cFall/AIStudio2API/internal/app.managedVersion=v${release.version}`];
+  `-ldflags=-s -w -X github.com/Mag1cFall/AIStudio2API/internal/app.version=v${release.version} -X github.com/Mag1cFall/AIStudio2API/internal/app.managedBy=${MANAGED_BY}`];
 
 try {
   let upstream = args.find(arg => arg.startsWith('--source='))?.slice(9);
@@ -50,8 +52,6 @@ try {
   }
   execFileSync('git', ['-C', upstream, 'archive', '--format=tar', `--output=${path.join(scratch, 'upstream.tar')}`, release.upstream.commit]);
   execFileSync('tar', ['-xf', 'upstream.tar', '-C', 'source'], { cwd: scratch });
-  execFileSync('git', ['apply', '--check', patch], { cwd: source, stdio: 'inherit' });
-  execFileSync('git', ['apply', patch], { cwd: source, stdio: 'inherit' });
   npm(['ci', '--no-audit', '--no-fund']);
   npm(['run', 'lint']);
   npm(['run', 'build']);
@@ -74,7 +74,7 @@ try {
   fs.copyFileSync(path.join(source, 'LICENSE'), path.join(output, 'LICENSE-AISTUDIO'));
   fs.writeFileSync(path.join(output, target ? `build-${target}.json` : 'build.json'), JSON.stringify({
     version: release.version, upstream: release.upstream, goVersion: release.goVersion,
-    nodeVersion: process.version, patchSha256: hash(patch), flags, binaries
+    nodeVersion: process.version, managedBy: MANAGED_BY, flags, binaries
   }, null, 2) + '\n');
   fs.writeFileSync(path.join(output, target ? `SHA256SUMS-${target}.txt` : 'SHA256SUMS.txt'),
     Object.values(binaries).map(pin => `${pin.sha256}  ${pin.asset}\n`).join(''));

package/patches/studio-managed.patch

@@ -1,625 +0,0 @@
-diff --git a/internal/app/admin.go b/internal/app/admin.go
-index 2f3de19..7f84cd5 100644
---- a/internal/app/admin.go
-+++ b/internal/app/admin.go
-@@ -8,7 +8,6 @@ import (
- 	"net/http"
- 	"os"
- 	"path/filepath"
--	"runtime/debug"
- 	"sort"
- 	"strings"
- 	"sync"
-@@ -1390,13 +1389,10 @@ func (registry *requestRegistry) publish(event api.AdminEvent) {
- 	registry.mu.Unlock()
- }
- 
--func buildVersion() string {
--	info, ok := debug.ReadBuildInfo()
--	if !ok || info.Main.Version == "" {
--		return "(devel)"
--	}
--	return info.Main.Version
--}
-+// Set by the reproducible Magpie release build.
-+var managedVersion = "(devel)"
-+
-+func buildVersion() string { return managedVersion }
- 
- func runtimeConfigDTO(cfg config.Config) api.RuntimeConfig {
- 	return api.RuntimeConfig{
-diff --git a/internal/app/update.go b/internal/app/update.go
-index 2b22ebe..f5dd6c3 100644
---- a/internal/app/update.go
-+++ b/internal/app/update.go
-@@ -1,300 +1,45 @@
- package app
- 
- import (
--	"archive/tar"
--	"archive/zip"
--	"bytes"
--	"compress/gzip"
- 	"context"
--	"crypto/sha256"
--	"encoding/hex"
--	"encoding/json"
--	"errors"
--	"fmt"
--	"io"
- 	"net/http"
--	"net/url"
- 	"os"
- 	"os/exec"
--	"path"
- 	"runtime"
- 	"slices"
--	"strings"
--	"sync"
- 	"syscall"
--	"time"
--
--	"github.com/minio/selfupdate"
--	"golang.org/x/mod/semver"
- 
- 	"github.com/Mag1cFall/AIStudio2API/internal/api"
- )
- 
--// releaseAPI 为 GitHub 最新发行版本接口
--const releaseAPI = "https://api.github.com/repos/Mag1cFall/AIStudio2API/releases/latest"
--
--// releaseCheckInterval 为最新发行版本的缓存时长
--const releaseCheckInterval = time.Hour
--
--// githubRelease 为 GitHub 发行版本接口中用到的字段
--type githubRelease struct {
--	TagName     string        `json:"tag_name"`
--	Body        string        `json:"body"`
--	HTMLURL     string        `json:"html_url"`
--	PublishedAt time.Time     `json:"published_at"`
--	Assets      []githubAsset `json:"assets"`
--}
--
--// githubAsset 为发行版本中的一个文件
--type githubAsset struct {
--	Name   string `json:"name"`
--	URL    string `json:"browser_download_url"`
--	Digest string `json:"digest"`
--}
--
--// updateConflictError 表示当前状态不能安装更新
--type updateConflictError string
--
--func (err updateConflictError) Error() string { return string(err) }
--
--// HTTPStatus 返回更新冲突的 HTTP 状态码
--func (updateConflictError) HTTPStatus() int { return http.StatusConflict }
--
--// selfUpdater 读取最新发行版本并替换当前可执行文件
-+// Magpie owns backend upgrades. This build has no release downloader or
-+// executable replacement path, regardless of platform or environment.
- type selfUpdater struct {
--	version    string
--	mode       string
--	releaseURL string
--	executable string
--	proxy      func() string
--	log        func(level, message string)
--	restart    func()
--	mu         sync.Mutex
--	release    *githubRelease
--	checked    time.Time
--	checkErr   error
--	updating   bool
-+	version string
- }
- 
--// newSelfUpdater 按构建版本与运行环境创建替换 executable 的更新器
--func newSelfUpdater(version, executable string, proxy func() string, log func(level, message string), restart func()) *selfUpdater {
--	return &selfUpdater{
--		version: version, mode: updateMode(version), releaseURL: releaseAPI, executable: executable,
--		proxy: proxy, log: log, restart: restart,
--	}
-+func newSelfUpdater(version, _ string, _ func() string, _ func(string, string), _ func()) *selfUpdater {
-+	return &selfUpdater{version: version}
- }
- 
--// updateMode 返回更新方式：binary 可原地替换，container 随镜像更新，development 为源码构建
--func updateMode(version string) string {
--	if !semver.IsValid(version) || semver.Prerelease(version) != "" || semver.Build(version) != "" {
--		return "development"
--	}
--	for _, marker := range []string{"/.dockerenv", "/run/.containerenv"} {
--		if _, err := os.Stat(marker); err == nil {
--			return "container"
--		}
--	}
--	return "binary"
-+func (u *selfUpdater) UpdateStatus(_ context.Context, _ bool) (api.UpdateStatus, error) {
-+	return api.UpdateStatus{Current: u.version, Mode: "managed"}, nil
- }
- 
--// UpdateStatus 返回当前版本与最新发行版本，refresh 为 true 或缓存过期时重新读取
--func (u *selfUpdater) UpdateStatus(ctx context.Context, refresh bool) (api.UpdateStatus, error) {
--	u.mu.Lock()
--	stale := refresh || time.Since(u.checked) >= releaseCheckInterval
--	u.mu.Unlock()
--	if stale {
--		release, err := u.fetchRelease(ctx)
--		if ctx.Err() != nil {
--			return api.UpdateStatus{}, ctx.Err()
--		}
--		u.mu.Lock()
--		u.checked, u.checkErr = time.Now(), err
--		if err == nil {
--			u.release = release
--		}
--		u.mu.Unlock()
--	}
--	u.mu.Lock()
--	defer u.mu.Unlock()
--	return u.statusLocked(), nil
--}
-+type managedUpdateDisabledError struct{}
- 
--// ApplyUpdate 下载最新发行包，校验摘要后替换当前可执行文件并重启管理进程
--func (u *selfUpdater) ApplyUpdate(ctx context.Context) (api.UpdateStatus, error) {
--	u.mu.Lock()
--	if u.mode != "binary" {
--		u.mu.Unlock()
--		return api.UpdateStatus{}, updateConflictError("当前运行方式不支持在线更新")
--	}
--	if u.updating {
--		u.mu.Unlock()
--		return api.UpdateStatus{}, updateConflictError("更新正在进行")
--	}
--	u.updating = true
--	u.mu.Unlock()
--	release, err := u.fetchRelease(ctx)
--	if err == nil && semver.Compare(release.TagName, u.version) <= 0 {
--		err = updateConflictError("当前已是最新版本 " + u.version)
--	}
--	if err == nil {
--		u.log("INFO", "在线更新 | 1/2 | 下载发行包 | 版本="+release.TagName)
--		err = u.install(ctx, release)
--	}
--	u.mu.Lock()
--	defer u.mu.Unlock()
--	if err != nil {
--		u.updating = false
--		u.log("ERROR", "在线更新失败 | 错误="+err.Error())
--		return api.UpdateStatus{}, err
--	}
--	u.release, u.checked, u.checkErr = release, time.Now(), nil
--	u.log("INFO", "在线更新完成 | 版本="+release.TagName)
--	status := u.statusLocked()
--	u.restart()
--	return status, nil
-+func (managedUpdateDisabledError) Error() string {
-+	return "在线更新已禁用，请通过 Magpie 插件升级 / Online updates are disabled; upgrade through the Magpie plugin."
- }
- 
--// statusLocked 在持有锁时生成更新状态
--func (u *selfUpdater) statusLocked() api.UpdateStatus {
--	status := api.UpdateStatus{Current: u.version, Mode: u.mode, CheckedAt: u.checked, Updating: u.updating}
--	if u.checkErr != nil {
--		status.Error = u.checkErr.Error()
--	}
--	if release := u.release; release != nil {
--		status.Latest, status.Notes, status.URL, status.PublishedAt = release.TagName, release.Body, release.HTMLURL, release.PublishedAt
--		status.Available = semver.Compare(release.TagName, u.version) > 0
--	}
--	return status
--}
-+func (managedUpdateDisabledError) HTTPStatus() int { return http.StatusForbidden }
- 
--// fetchRelease 读取 GitHub 最新发行版本
--func (u *selfUpdater) fetchRelease(ctx context.Context) (*githubRelease, error) {
--	response, err := u.get(ctx, u.releaseURL, "application/vnd.github+json")
--	if err != nil {
--		return nil, fmt.Errorf("读取最新发行版本: %w", err)
--	}
--	defer response.Body.Close()
--	var release githubRelease
--	if err := json.NewDecoder(response.Body).Decode(&release); err != nil {
--		return nil, fmt.Errorf("解析最新发行版本: %w", err)
--	}
--	return &release, nil
--}
--
--// install 下载当前系统与架构的发行包，校验 SHA-256 后替换可执行文件
--func (u *selfUpdater) install(ctx context.Context, release *githubRelease) error {
--	name, binary := releasePackage(release.TagName)
--	index := slices.IndexFunc(release.Assets, func(asset githubAsset) bool { return asset.Name == name })
--	if index < 0 {
--		return fmt.Errorf("发行版本 %s 没有 %s", release.TagName, name)
--	}
--	asset := release.Assets[index]
--	expected, ok := strings.CutPrefix(asset.Digest, "sha256:")
--	if !ok {
--		return fmt.Errorf("发行包 %s 缺少 SHA-256 摘要", name)
--	}
--	response, err := u.get(ctx, asset.URL, "application/octet-stream")
--	if err != nil {
--		return fmt.Errorf("下载 %s: %w", name, err)
--	}
--	archive, err := io.ReadAll(response.Body)
--	response.Body.Close()
--	if err != nil {
--		return fmt.Errorf("下载 %s: %w", name, err)
--	}
--	if sum := sha256.Sum256(archive); hex.EncodeToString(sum[:]) != expected {
--		return fmt.Errorf("发行包 %s 的 SHA-256 与发行版本记录不一致", name)
--	}
--	executable, err := extractExecutable(archive, name, binary)
--	if err != nil {
--		return err
--	}
--	u.log("INFO", "在线更新 | 2/2 | 替换可执行文件 | 版本="+release.TagName)
--	if err := selfupdate.Apply(bytes.NewReader(executable), selfupdate.Options{TargetPath: u.executable}); err != nil {
--		if rollback := selfupdate.RollbackError(err); rollback != nil {
--			return fmt.Errorf("替换可执行文件: %w；恢复原文件失败: %v", err, rollback)
--		}
--		return fmt.Errorf("替换可执行文件: %w", err)
--	}
--	return nil
--}
--
--// get 经管理进程出口发出 GET，非 200 响应返回错误
--func (u *selfUpdater) get(ctx context.Context, address, accept string) (*http.Response, error) {
--	transport := http.DefaultTransport.(*http.Transport).Clone()
--	if proxy := u.proxy(); proxy != "" {
--		proxyURL, err := url.Parse(proxy)
--		if err != nil {
--			return nil, fmt.Errorf("解析代理: %w", err)
--		}
--		transport.Proxy = http.ProxyURL(proxyURL)
--	}
--	request, err := http.NewRequestWithContext(ctx, http.MethodGet, address, nil)
--	if err != nil {
--		return nil, err
--	}
--	request.Header.Set("Accept", accept)
--	response, err := (&http.Client{Transport: transport}).Do(request)
--	if err != nil {
--		return nil, err
--	}
--	if response.StatusCode != http.StatusOK {
--		body, _ := io.ReadAll(io.LimitReader(response.Body, 512))
--		response.Body.Close()
--		return nil, fmt.Errorf("HTTP %d %s", response.StatusCode, strings.TrimSpace(string(body)))
--	}
--	return response, nil
--}
--
--// releasePackage 返回当前系统与架构的发行包文件名与其中的可执行文件名
--func releasePackage(tag string) (string, string) {
--	base := fmt.Sprintf("aistudio2api-%s-%s-%s", tag, runtime.GOOS, runtime.GOARCH)
--	if runtime.GOOS == "windows" {
--		return base + ".zip", "aistudio2api.exe"
--	}
--	return base + ".tar.gz", "aistudio2api"
--}
--
--// extractExecutable 从 zip 或 tar.gz 发行包中取出可执行文件
--func extractExecutable(archive []byte, name, binary string) ([]byte, error) {
--	if strings.HasSuffix(name, ".zip") {
--		reader, err := zip.NewReader(bytes.NewReader(archive), int64(len(archive)))
--		if err != nil {
--			return nil, fmt.Errorf("读取发行包: %w", err)
--		}
--		for _, file := range reader.File {
--			if path.Base(file.Name) != binary {
--				continue
--			}
--			opened, err := file.Open()
--			if err != nil {
--				return nil, fmt.Errorf("读取发行包: %w", err)
--			}
--			defer opened.Close()
--			return io.ReadAll(opened)
--		}
--		return nil, fmt.Errorf("发行包中没有 %s", binary)
--	}
--	compressed, err := gzip.NewReader(bytes.NewReader(archive))
--	if err != nil {
--		return nil, fmt.Errorf("读取发行包: %w", err)
--	}
--	reader := tar.NewReader(compressed)
--	for {
--		header, err := reader.Next()
--		if errors.Is(err, io.EOF) {
--			return nil, fmt.Errorf("发行包中没有 %s", binary)
--		}
--		if err != nil {
--			return nil, fmt.Errorf("读取发行包: %w", err)
--		}
--		if header.Typeflag == tar.TypeReg && path.Base(header.Name) == binary {
--			return io.ReadAll(reader)
--		}
--	}
-+func (u *selfUpdater) ApplyUpdate(_ context.Context) (api.UpdateStatus, error) {
-+	return api.UpdateStatus{}, managedUpdateDisabledError{}
- }
- 
--// relaunch 以原参数启动替换后的可执行文件：Windows 上新进程沿用当前控制台，其他系统原地替换进程
-+// Retained for the application's restart plumbing; the managed updater never
-+// invokes its restart callback.
- func relaunch(executable string, args []string) error {
- 	args = append(slices.Clone(args), "-open-ui=false")
- 	if runtime.GOOS == "windows" {
-diff --git a/internal/app/update_managed_test.go b/internal/app/update_managed_test.go
-new file mode 100644
-index 0000000..ce86d14
---- /dev/null
-+++ b/internal/app/update_managed_test.go
-@@ -0,0 +1,41 @@
-+package app
-+
-+import (
-+	"context"
-+	"errors"
-+	"net/http"
-+	"os"
-+	"path/filepath"
-+	"testing"
-+)
-+
-+func TestManagedUpdaterCannotUpdateOrRestart(t *testing.T) {
-+	executable := filepath.Join(t.TempDir(), "aistudio2api.exe")
-+	original := []byte("existing executable")
-+	if err := os.WriteFile(executable, original, 0600); err != nil {
-+		t.Fatal(err)
-+	}
-+	for _, version := range []string{"v0.2.13", "v0.2.13-magpie.1", "(devel)"} {
-+		t.Run(version, func(t *testing.T) {
-+			u := newSelfUpdater(version, executable,
-+				func() string { t.Fatal("must not query network proxy"); return "" },
-+				func(string, string) { t.Fatal("must not enter the updater") },
-+				func() { t.Fatal("must not restart") })
-+			for _, refresh := range []bool{false, true} {
-+				status, err := u.UpdateStatus(context.Background(), refresh)
-+				if err != nil || status.Mode != "managed" || status.Available || status.Updating || status.Latest != "" || status.Current != version {
-+					t.Fatalf("unexpected status: %+v, %v", status, err)
-+				}
-+			}
-+			_, err := u.ApplyUpdate(context.Background())
-+			var httpError interface{ HTTPStatus() int }
-+			if !errors.As(err, &httpError) || httpError.HTTPStatus() != http.StatusForbidden {
-+				t.Fatalf("expected forbidden: %v", err)
-+			}
-+			data, err := os.ReadFile(executable)
-+			if err != nil || string(data) != string(original) {
-+				t.Fatalf("executable changed: %v", err)
-+			}
-+		})
-+	}
-+}
-diff --git a/web/src/components/VersionPanel.vue b/web/src/components/VersionPanel.vue
-index 98d7968..a4ed70a 100644
---- a/web/src/components/VersionPanel.vue
-+++ b/web/src/components/VersionPanel.vue
-@@ -1,193 +1,30 @@
- <script setup lang="ts">
--import { computed, onActivated, ref } from 'vue'
--import { api } from '@/api'
-+import { computed } from 'vue'
- import { useI18n } from '@/i18n'
--import { markdown } from '@/markdown'
- import type { UpdateStatus } from '@/types'
--import UiIcon from '@/components/UiIcon.vue'
- 
--const props = defineProps<{ status: UpdateStatus | null; activeRequests: number }>()
--const emit = defineEmits<{ status: [UpdateStatus]; restarting: [] }>()
--const { t, locale, errorText } = useI18n()
--const checking = ref(false)
--const confirming = ref(false)
--const phase = ref<'idle' | 'installing' | 'restarting'>('idle')
--const error = ref('')
--
--const latest = computed(() => props.status?.latest ?? '')
--const notes = computed(() => markdown.render(props.status?.notes ?? ''))
--const publishedAt = computed(() =>
--  props.status?.published_at
--    ? new Date(props.status.published_at).toLocaleString(locale.value)
--    : '',
--)
--const installable = computed(
--  () => props.status?.mode === 'binary' && props.status.available && !props.status.updating,
-+defineProps<{ status: UpdateStatus | null; activeRequests: number }>()
-+defineEmits<{ status: [UpdateStatus]; restarting: [] }>()
-+const { t, locale } = useI18n()
-+const message = computed(() =>
-+  locale.value.startsWith('zh')
-+    ? '在线更新已禁用，请通过 Magpie 插件升级。'
-+    : 'Online updates are disabled. Upgrade through the Magpie plugin.',
- )
--const summary = computed(() => {
--  if (phase.value === 'installing') return t('version.installing')
--  if (phase.value === 'restarting') return t('version.restarting')
--  if (props.status?.available) return t('version.available').replace('{version}', latest.value)
--  if (latest.value) return t('version.upToDate')
--  return ''
--})
--const confirmText = computed(() =>
--  t('version.confirmText')
--    .replace('{version}', latest.value)
--    .replace('{count}', String(props.activeRequests)),
--)
--
--// check 读取 GitHub 最新发行版本，refresh 为 true 时跳过服务端缓存
--async function check(refresh: boolean): Promise<void> {
--  checking.value = true
--  error.value = ''
--  try {
--    emit('status', await api.updateStatus(refresh))
--  } catch (reason) {
--    error.value = errorText(reason)
--  } finally {
--    checking.value = false
--  }
--}
--
--// install 下载并替换为最新版本，成功后通知上层等待重启
--async function install(): Promise<void> {
--  confirming.value = false
--  phase.value = 'installing'
--  error.value = ''
--  try {
--    emit('status', await api.applyUpdate())
--  } catch (reason) {
--    phase.value = 'idle'
--    error.value = errorText(reason)
--    return
--  }
--  phase.value = 'restarting'
--  emit('restarting')
--}
--
--onActivated(() => void check(false))
- </script>
- 
- <template>
--  <section class="flex min-h-0 flex-1 flex-col overflow-auto md:overflow-hidden">
--    <header class="flex flex-wrap items-center gap-3 border-b border-line px-4 py-4 md:px-8">
--      <div class="min-w-0 flex-1">
--        <h2 class="text-xl font-semibold text-white">{{ t('section.version.title') }}</h2>
--        <p class="mt-1 text-sm text-gray-500">{{ t('section.version.description') }}</p>
--      </div>
-+  <section class="flex min-h-0 flex-1 flex-col overflow-auto">
-+    <header class="border-b border-line px-4 py-4 md:px-8">
-+      <h2 class="text-xl font-semibold text-white">{{ t('section.version.title') }}</h2>
-     </header>
--    <div class="mx-auto flex min-h-0 w-full max-w-4xl flex-1 flex-col p-4 md:p-8">
--      <article class="shrink-0 rounded-lg border border-line bg-panel p-4 md:p-6">
--        <dl class="grid gap-4 sm:grid-cols-2">
--          <div>
--            <dt class="text-xs text-gray-500">{{ t('version.current') }}</dt>
--            <dd class="mt-1 font-mono text-lg break-all text-white">
--              {{ status?.current ?? '—' }}
--            </dd>
--          </div>
--          <div>
--            <dt class="text-xs text-gray-500">{{ t('version.latest') }}</dt>
--            <dd class="mt-1 font-mono text-lg text-white">{{ latest || '—' }}</dd>
--            <dd v-if="publishedAt" class="mt-0.5 text-xs text-gray-500">{{ publishedAt }}</dd>
--          </div>
-+    <div class="mx-auto w-full max-w-4xl p-4 md:p-8">
-+      <article class="rounded-lg border border-line bg-panel p-4 md:p-6">
-+        <dl>
-+          <dt class="text-xs text-gray-500">{{ t('version.current') }}</dt>
-+          <dd class="mt-1 font-mono text-lg break-all text-white">{{ status?.current ?? '—' }}</dd>
-         </dl>
--
--        <p
--          v-if="summary"
--          class="mt-4 text-sm"
--          :class="status?.available || phase !== 'idle' ? 'text-blue-300' : 'text-gray-400'"
--          role="status"
--        >
--          {{ summary }}
--        </p>
--
--        <div class="mt-4 flex flex-wrap items-center gap-2">
--          <button
--            type="button"
--            class="flex items-center gap-2 rounded border border-line bg-raised px-4 py-2 text-sm font-medium text-gray-200 transition hover:bg-line disabled:opacity-50"
--            :disabled="checking || phase !== 'idle'"
--            @click="check(true)"
--          >
--            <UiIcon :name="checking ? 'spinner' : 'refresh'" :size="15" />
--            {{ t('version.check') }}
--          </button>
--          <button
--            v-if="installable && !confirming"
--            type="button"
--            class="flex items-center gap-2 rounded bg-blue-600 px-4 py-2 text-sm font-medium text-white transition hover:bg-blue-500 disabled:opacity-50"
--            :disabled="phase !== 'idle'"
--            @click="confirming = true"
--          >
--            <UiIcon :name="phase === 'idle' ? 'download' : 'spinner'" :size="15" />
--            {{ t('version.install').replace('{version}', latest) }}
--          </button>
--          <a
--            v-if="status?.url"
--            :href="status.url"
--            target="_blank"
--            rel="noreferrer"
--            class="px-2 py-2 text-sm text-blue-400 hover:underline"
--          >
--            {{ t('version.release') }}
--          </a>
--        </div>
--
--        <div
--          v-if="confirming"
--          role="alert"
--          class="mt-4 rounded-md border border-amber-500/40 bg-amber-500/10 p-4 text-sm text-amber-200"
--        >
--          <p>{{ confirmText }}</p>
--          <div class="mt-3 flex flex-wrap gap-2">
--            <button
--              type="button"
--              class="rounded bg-blue-600 px-4 py-2 text-sm font-medium text-white transition hover:bg-blue-500"
--              @click="install"
--            >
--              {{ t('version.confirm') }}
--            </button>
--            <button
--              type="button"
--              class="rounded border border-line bg-raised px-4 py-2 text-sm font-medium text-gray-200 transition hover:bg-line"
--              @click="confirming = false"
--            >
--              {{ t('common.cancel') }}
--            </button>
--          </div>
--        </div>
--
--        <div v-if="status?.mode === 'container'" class="mt-4 text-sm text-gray-400">
--          <p>{{ t('version.container') }}</p>
--          <code
--            class="mt-2 block overflow-x-auto rounded border border-line bg-canvas px-3 py-2 font-mono text-xs text-gray-200"
--            >docker compose pull &amp;&amp; docker compose up -d</code
--          >
--        </div>
--        <p v-else-if="status?.mode === 'development'" class="mt-4 text-sm text-gray-400">
--          {{ t('version.development') }}
--        </p>
--
--        <p
--          v-if="error || status?.error"
--          role="alert"
--          class="mt-4 rounded border border-red-500/40 bg-red-500/10 p-3 text-sm break-words text-red-300"
--        >
--          {{ error || status?.error }}
--        </p>
--      </article>
--
--      <article
--        v-if="status?.notes"
--        class="mt-6 flex min-h-0 flex-1 flex-col rounded-lg border border-line bg-panel p-4 md:p-6"
--      >
--        <h3 class="font-bold text-gray-300">
--          {{ t('version.notes').replace('{version}', latest) }}
--        </h3>
--        <div
--          class="markdown mt-3 min-h-0 flex-1 text-sm leading-6 [overflow-wrap:anywhere] text-gray-300 md:overflow-y-auto"
--          v-html="notes"
--        />
-+        <p class="mt-4 text-sm text-gray-400" role="status">{{ message }}</p>
-       </article>
-     </div>
-   </section>
-diff --git a/web/src/types.ts b/web/src/types.ts
-index e5c07cc..98a027b 100644
---- a/web/src/types.ts
-+++ b/web/src/types.ts
-@@ -88,7 +88,7 @@ export interface UpdateStatus {
-   current: string
-   latest?: string
-   available: boolean
--  mode: 'binary' | 'container' | 'development'
-+  mode: 'binary' | 'container' | 'development' | 'managed'
-   notes?: string
-   url?: string
-   published_at?: string