sintbot 1.0.13 → 1.0.14

package/CHANGELOG.en.json

@@ -1,4 +1,23 @@
 [
+  {
+    "version": "1.0.14",
+    "date": "2026-10-30",
+    "name": "Steadier service installs and better console controls",
+    "items": [
+      {
+        "t": "More reliable service reinstalls",
+        "d": "A reinstall now waits for the old background service to fully unload before starting the new one, reducing cases where the service is left unloaded."
+      },
+      {
+        "t": "Software updates from the console",
+        "d": "Stable releases are checked at startup and daily, with a manual check available too. An administrator confirms an upgrade, which waits for every group task and queue to clear before installing the exact version."
+      },
+      {
+        "t": "Manage console access in Settings",
+        "d": "Set a password for LAN access and toggle LAN binding or public Feishu sign-in. Turning off public sign-in revokes existing Feishu sessions; a failed binding change restores the previous settings."
+      }
+    ]
+  },
   {
     "version": "1.0.13",
     "name": "An even shorter install: almost nothing to answer",

package/CHANGELOG.json

@@ -1,4 +1,23 @@
 [
+  {
+    "version": "1.0.14",
+    "date": "2026-10-30",
+    "name": "服务重装与控制台管理更完善",
+    "items": [
+      {
+        "t": "服务重装更稳定",
+        "d": "重装时会等旧后台服务彻底退出后再启动，减少服务卡在未加载状态的情况。"
+      },
+      {
+        "t": "控制台可管理软件更新",
+        "d": "启动时及每天自动检查稳定版，也可手动检查。发现新版后由管理员确认，等所有群任务和队列空闲后再安装指定版本。"
+      },
+      {
+        "t": "访问地址可在控制台管理",
+        "d": "可以设置局域网访问密码、切换局域网监听和公网飞书登录。关闭公网登录会让现有飞书登录失效；切换监听失败时会恢复原设置。"
+      }
+    ]
+  },
   {
     "version": "1.0.13",
     "date": "2026-10-28",

package/bin/sbot.js

@@ -61,6 +61,7 @@ const feishulogin = require('../src/ui/feishulogin') // 公网地址归一(ui.pu
 const { buildTakeoverCard } = require('../src/platform/takeovercard') // 「接管浏览器」的群内卡片(四态:等人来 / 接管中 / 已结束 / 已过期)
 const cdp = require('../src/cdp') // 接管卡片上的页面截图:CLI 直接连常驻浏览器截一张
 const { hashPassword } = require('../src/ui/auth')
+const updateFeature = require('../src/updater')
 
 const dim = (s) => `\x1b[2m${s}\x1b[0m`
 const cyan = (s) => `\x1b[36m${s}\x1b[0m`
@@ -487,7 +488,7 @@ async function cmdStart(rest) {
   const plat = platformsConfigured(cfg)
   if (!plat.feishu && !plat.wecom && !plat.slack) {
     // 带 --ui(后台服务就是这么起的):只开控制台,等人在「设置」里接平台 —— 1.0.12 起没平台也装服务,装完就有地方可去
-    if (wantUi) return serveSetupConsole(cfg, { port: Number(values['ui-port']) || 4600, host: values['ui-host'] || '127.0.0.1', noOpen })
+    if (wantUi) return serveSetupConsole(cfg, { port: Number(values['ui-port']) || 4600, host: (cfg.ui && cfg.ui.host) || values['ui-host'] || '127.0.0.1', noOpen })
     if (cfg.wecom && (cfg.wecom.botId || cfg.wecom.secret)) return die('sbot.config.json 的 wecom 块缺 ' + (cfg.wecom.botId ? 'secret' : 'botId') + '(机器人 API 配置页「使用长连接」处)')
     return die('没有配置任何聊天平台 — 在 sbot.config.json 里加 "feishu" 块(appId/appSecret)、"wecom" 块(botId/secret)或 "slack" 块(botToken/appToken),配几个接几个')
   }
@@ -524,6 +525,7 @@ async function cmdStart(rest) {
   const log = (m) => process.stderr.write(gray(`[${logStamp()}] · ` + m) + '\n')
   if (tightened.length) log(`状态目录权限已收紧(目录 700、文件 600):${tightened.length} 项`)
   let ui = null
+  let updaterManager = null
   let platform = null // set below; the UI (created first) reads WS health through this ref(多平台路由器,src/platform/multi.js)
   // 把一条消息交给引擎:**合成消息**(控制台插话 / 定时任务 / 续做 / 画布确认)没有真实适配器,按 chatId 查出它所属平台的
   // 适配器再喂 —— 引擎读的 skillCmd / features / chatLabel 是适配器上的,喂路由器会让企微群的清单按飞书口径写。
@@ -709,7 +711,7 @@ async function cmdStart(rest) {
   const reloadCfg = () => {
     try {
       const c = loadConfig(values.config); applyProxyEnv(c); engine.reload(c)
-      if (ui) engine.publicUrl = feishulogin.normalizePublicUrl((c.ui || {}).publicUrl) // 公网地址跟着配置热更(控制台设置页改了即生效)
+      if (ui) engine.publicUrl = (c.ui || {}).publicEnabled === false ? null : feishulogin.normalizePublicUrl((c.ui || {}).publicUrl) // 公网入口关闭时不再向群内清单宣传
       log('config reloaded (hot)')
     } catch (e) { log('reload failed: ' + (e && e.message)) }
   }
@@ -720,7 +722,8 @@ async function cmdStart(rest) {
   if (wantUi) {
     const configPath = cfg._path || path.join(process.cwd(), 'sbot.config.json')
     const uiPort = Number(values['ui-port']) || 4600
-    const uiHost = values['ui-host'] || '127.0.0.1'
+    // 控制台设置页可持久切换绑定地址;保存的 host 优先于服务单元里的旧参数。
+    const uiHost = (cfg.ui && cfg.ui.host) || values['ui-host'] || '127.0.0.1'
     const uiLoopback = isLoopbackHost(uiHost)
     // Advertise the console address in the agent's self-knowledge manifest (群项目基础能力).
     // For LAN binding, use the first LAN IP so group members get a reachable URL, not 127.0.0.1.
@@ -729,9 +732,20 @@ async function cmdStart(rest) {
     engine.uiLocalUrl = `http://127.0.0.1:${uiPort}`
     // 公网地址(v0.11.72 起的入口):群里 /help 与清单给人的是它,不是局域网 IP —— 出了局域网 LAN 地址
     // 打不开、还要密码,而公网入口只认飞书登录。归一判据与控制台「飞书登录」就绪判据同源(feishulogin)。
-    engine.publicUrl = feishulogin.normalizePublicUrl((cfg.ui || {}).publicUrl)
+    engine.publicUrl = (cfg.ui || {}).publicEnabled === false ? null : feishulogin.normalizePublicUrl((cfg.ui || {}).publicUrl)
     // Fail-closed: LAN exposure requires a console password (set via `sbot ui --set-password`).
     if (!uiLoopback && !((cfg.ui || {}).auth)) die(`控制台对外(--ui-host ${uiHost})需先设密码:sintbot ui --set-password`)
+    const service = require('../src/service')
+    updaterManager = updateFeature.createUpdater({
+      currentVersion: require('../package.json').version,
+      stateFile: path.join(os.homedir(), '.sbot', 'update.json'),
+      getLiveState: () => engine.liveState(),
+      fetchImpl: require('../src/core/proxy').getProxyFetch() || globalThis.fetch,
+      getManagedService: () => { const st = service.status(); return !!st.running && st.pid === process.pid },
+      restartManagedService: () => service.restartAsync(),
+      setAnnouncementBaseline: (version) => store.setLastVersion(version),
+      log,
+    })
     // 接管卡片翻状态:有人兑换 ⇒「正在接管中」;点「结束」/ 到时 ⇒「接管已结束」;票过期没人来 ⇒「已过期」。boardClient 在下面才定义,hook 只在运行时才调,不踩 TDZ。
     const flipTakeoverCard = (state) => (meta) => {
       if (!meta || !meta.cardId || !boardClient) return
@@ -748,6 +762,13 @@ async function cmdStart(rest) {
       getLiveState: () => engine.liveState(),
       getConnHealth: () => (platform && platform.connHealth ? platform.connHealth() : null), // 各平台连接健康度({ feishu, wecom } 字典,路由器出)
       onConfigChange: reloadCfg,
+      onHostChange: (boundHost, address) => {
+        const port = address && typeof address === 'object' ? address.port : uiPort
+        const loopback = isLoopbackHost(boundHost)
+        engine.uiUrl = `http://${loopback ? '127.0.0.1' : (lanIPv4()[0] || '127.0.0.1')}:${port}`
+        engine.uiLocalUrl = `http://127.0.0.1:${port}`
+      },
+      updater: updaterManager,
       control: {
         setProvider: (chatId, name) => store.setProvider(chatId, name),   // 实时切模型(下一轮生效)
         // 某群**实际在用**的模型(临时切换到备用时是备用,与 /status · 账本同口径)—— 控制台改 provider 型号时判「受影响群」
@@ -803,6 +824,7 @@ async function cmdStart(rest) {
       }
       process.stderr.write('\n')
       if (!noOpen) tryOpen(url)
+      if (updaterManager) void updaterManager.start().catch((e) => log('update check: ' + (e && e.message)))
     })
   }
   // 配了哪个平台就建哪个适配器;路由器按群分发(连接状态事件带 platform 名,控制台一行一个平台)。
@@ -1267,9 +1289,9 @@ async function cmdService(rest) {
     const configPath = findConfigPath(values.config)
     if (!configPath) return die('没找到配置文件 —— 先跑 sintbot setup(或 --config 指定)')
     // 控制台对外又没设密码:daemon 一启动就会拒绝退出,装成服务就是每 15 秒拉起一次的死循环 ⇒ 装之前就拦
-    const uiHost = values['ui-host']
     let raw
     try { raw = JSON.parse(fs.readFileSync(configPath, 'utf8')) } catch (e) { return die(`读不了配置 ${configPath}:${e.message}`) }
+    const uiHost = values['ui-host'] || ((raw.ui || {}).host)
     if (uiHost && !isLoopbackHost(uiHost) && !((raw.ui || {}).auth)) return die(`控制台对外(--ui-host ${uiHost})要先设密码:sintbot ui --set-password${values.config ? ' --config ' + values.config : ''} —— 否则服务一启动就退出、被反复拉起`)
     // 一个聊天平台都没接也照装(1.0.12 起):服务先只开控制台,在「设置」里接好平台后自己重启连上(cmdStart 的配置模式)。
     // 1.0.10–1.0.11 在这里拦下(退出码 3),结果装完没有任何地方可去 —— 控制台也打不开
@@ -1974,7 +1996,7 @@ async function cmdUi(rest) {
 
   applyProxyEnv(cfg)
   const port = Number(values.port) || 4600
-  const host = values.host || '127.0.0.1'
+  const host = values.host || (cfg.ui && cfg.ui.host) || '127.0.0.1'
   const loopback = isLoopbackHost(host)
   // Fail-closed: never expose the operator console to the LAN without a password.
   if (!loopback) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sintbot",
-  "version": "1.0.13",
+  "version": "1.0.14",
   "description": "Drive headless Claude Code (or Codex) from Slack / Feishu / WeCom group chats — one group, one project, swappable model brain. A standalone daemon, not a Claude Code plugin.",
   "bin": {
     "sbot": "bin/sbot.js",

package/src/service.js

@@ -20,7 +20,7 @@
 const fs = require('node:fs')
 const os = require('node:os')
 const path = require('node:path')
-const { execFileSync } = require('node:child_process')
+const { execFileSync, execFile } = require('node:child_process')
 
 const LABEL = 'com.sbot.daemon'      // launchd 标签(与早期手写 plist 同名 ⇒ 装新版直接替换旧的)
 const UNIT = 'sbot.service'          // systemd --user 单元名
@@ -176,6 +176,35 @@ function run(bin, args, opts = {}) {
 
 const uid = () => (typeof process.getuid === 'function' ? process.getuid() : 0)
 
+// launchctl bootout may return before the old job has fully left the GUI domain.
+// Keep the wait synchronous and strictly bounded: service install is a CLI action,
+// and a failed unload must never race straight into bootstrap.
+function sleepSync(ms) {
+  if (ms > 0) Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms)
+}
+
+function launchdServiceMissing(message) {
+  return /could not find service|service[^\n]*not found|no such service|not found in domain/i.test(String(message || ''))
+}
+
+function launchdBootstrapRace(result) {
+  return result && (result.code === 5 || /bootstrap failed:\s*5|input\/output error/i.test(String(result.err || '')))
+}
+
+// { ok:true, waitedMs } when unloaded; otherwise a bounded, actionable failure.
+function waitForLaunchdUnload(target, { runCommand = run, wait = sleepSync, timeoutMs = 2000, intervalMs = 100 } = {}) {
+  const tries = Math.floor(Math.max(0, timeoutMs) / Math.max(1, intervalMs)) + 1
+  for (let i = 0; i < tries; i++) {
+    const r = runCommand('launchctl', ['print', target])
+    if (!r.ok) {
+      if (launchdServiceMissing(r.err)) return { ok: true, waitedMs: i * intervalMs }
+      return { ok: false, waitedMs: i * intervalMs, err: r.err || 'launchctl print 失败,无法确认服务状态' }
+    }
+    if (i < tries - 1) wait(intervalMs)
+  }
+  return { ok: false, waitedMs: (tries - 1) * intervalMs, err: `等待 launchd 卸载超时(${timeoutMs}ms),未尝试重新加载` }
+}
+
 // 状态(只读):{ installed, running, pid, detail }
 function status({ platform = process.platform, home = os.homedir() } = {}) {
   const file = unitPath(platform, home)
@@ -197,7 +226,7 @@ function status({ platform = process.platform, home = os.homedir() } = {}) {
 }
 
 // 写单元文件(已有且内容不同 ⇒ 先备份)并加载。返回 { file, backup, steps: [{cmd, ok, err}] }
-function install(spec, { platform = process.platform, home = os.homedir() } = {}) {
+function install(spec, { platform = process.platform, home = os.homedir(), runCommand = run, wait = sleepSync, launchdTimeoutMs = 2000, launchdPollMs = 100 } = {}) {
   const file = unitPath(platform, home)
   if (!file) throw new Error('这个平台不支持自动安装服务')
   const text = render(platform, spec)
@@ -212,10 +241,38 @@ function install(spec, { platform = process.platform, home = os.homedir() } = {}
   // 单元文件里写了环境变量的值(多半是 key)⇒ 只给自己读写;没写就是普通权限
   if (Object.keys(spec.env || {}).length) fs.chmodSync(file, 0o600)
   const steps = []
-  const step = (bin, args, tolerate) => { const r = run(bin, args); steps.push({ cmd: [bin, ...args].join(' '), ok: r.ok || !!tolerate, err: r.ok ? '' : r.err }); return r }
+  const step = (bin, args, tolerate) => { const r = runCommand(bin, args); steps.push({ cmd: [bin, ...args].join(' '), ok: r.ok || !!tolerate, err: r.ok ? '' : r.err }); return r }
   if (platform === 'darwin') {
-    step('launchctl', ['bootout', `gui/${uid()}/${LABEL}`], true) // 没加载过会报错,忽略
-    step('launchctl', ['bootstrap', `gui/${uid()}`, file])
+    const target = `gui/${uid()}/${LABEL}`
+    const bootoutArgs = ['bootout', target]
+    const out = runCommand('launchctl', bootoutArgs)
+    const absentBefore = !out.ok && launchdServiceMissing(out.err)
+    steps.push({ cmd: ['launchctl', ...bootoutArgs].join(' '), ok: out.ok || absentBefore, err: out.ok || absentBefore ? '' : out.err })
+    // A missing job is normal on first install; any other bootout failure is not.
+    if (!out.ok && !absentBefore) return { file, backup, steps }
+    const unloaded = waitForLaunchdUnload(target, { runCommand, wait, timeoutMs: launchdTimeoutMs, intervalMs: launchdPollMs })
+    steps.push({ cmd: 'launchctl wait for bootout', ok: unloaded.ok, err: unloaded.ok ? '' : unloaded.err })
+    if (!unloaded.ok) return { file, backup, steps }
+
+    const bootstrapArgs = ['bootstrap', `gui/${uid()}`, file]
+    const first = runCommand('launchctl', bootstrapArgs)
+    if (first.ok) steps.push({ cmd: ['launchctl', ...bootstrapArgs].join(' '), ok: true, err: '' })
+    else if (launchdBootstrapRace(first)) {
+      // A race may report EIO even though launchd accepted the job. Since the
+      // previous job was confirmed absent, a now-loaded job is the new one.
+      const after = runCommand('launchctl', ['print', target])
+      if (after.ok) steps.push({ cmd: ['launchctl', ...bootstrapArgs].join(' '), ok: true, err: '' })
+      else if (launchdServiceMissing(after.err)) {
+        wait(100)
+        const retry = runCommand('launchctl', bootstrapArgs)
+        if (retry.ok) steps.push({ cmd: ['launchctl', ...bootstrapArgs].join(' '), ok: true, err: '' })
+        else {
+          const afterRetry = runCommand('launchctl', ['print', target])
+          const loaded = afterRetry.ok
+          steps.push({ cmd: ['launchctl', ...bootstrapArgs].join(' '), ok: loaded, err: loaded ? '' : retry.err })
+        }
+      } else steps.push({ cmd: ['launchctl', ...bootstrapArgs].join(' '), ok: false, err: after.err || first.err })
+    } else steps.push({ cmd: ['launchctl', ...bootstrapArgs].join(' '), ok: false, err: first.err })
   } else {
     step('systemctl', ['--user', 'daemon-reload'])
     step('systemctl', ['--user', 'enable', UNIT])
@@ -230,6 +287,19 @@ function restart({ platform = process.platform } = {}) {
   return { ok: false, err: '这个平台不支持' }
 }
 
+// Async form for a daemon restarting itself after an in-place package upgrade.
+// systemctl restart waits for the old process to exit, so the daemon must keep
+// its event loop free to handle SIGTERM while this command is in flight.
+function restartAsync({ platform = process.platform } = {}) {
+  let bin, args
+  if (platform === 'darwin') { bin = 'launchctl'; args = ['kickstart', '-k', `gui/${uid()}/${LABEL}`] }
+  else if (platform === 'linux') { bin = 'systemctl'; args = ['--user', 'restart', UNIT] }
+  else return Promise.resolve({ ok: false, err: '这个平台不支持' })
+  return new Promise((resolve) => execFile(bin, args, { encoding: 'utf8', windowsHide: true }, (e, stdout, stderr) => {
+    resolve(e ? { ok: false, out: String(stdout || ''), err: String(stderr || e.message || e).trim(), code: e.code ?? e.status } : { ok: true, out: String(stdout || '') })
+  }))
+}
+
 function uninstall({ platform = process.platform, home = os.homedir() } = {}) {
   const file = unitPath(platform, home)
   const steps = []
@@ -244,4 +314,4 @@ function uninstall({ platform = process.platform, home = os.homedir() } = {}) {
   return { file, removed, steps }
 }
 
-module.exports = { LABEL, UNIT, SUPERVISED_ENV, xmlEsc, sdQuote, buildPath, versionedPath, stableNodeBin, envRefs, serviceSpec, launchdPlist, systemdUnit, unitPath, render, windowsHint, status, install, restart, uninstall }
+module.exports = { LABEL, UNIT, SUPERVISED_ENV, xmlEsc, sdQuote, buildPath, versionedPath, stableNodeBin, envRefs, serviceSpec, launchdPlist, systemdUnit, unitPath, render, windowsHint, status, install, restart, restartAsync, uninstall, launchdServiceMissing, launchdBootstrapRace, waitForLaunchdUnload }

package/src/ui/console.html

@@ -1164,6 +1164,7 @@ function inboxHtml(){
       `<a class="iconbtn sm" href="/browser" target="_blank" rel="noopener" title="打开接管页" style="flex:none">${IC.ext}</a>`,
       (it.pageTitle||it.pageUrl)?full(esc(it.pageTitle||it.pageUrl)):'');
     if(it.kind==='issues')return line('反馈','--warn',`${it.count} 条反馈待处理`,go('ovIssues','滚到反馈本'));
+    if(it.kind==='update')return line('更新','--ember',`发现新版 v${esc(it.to)}`,go('updateCard','打开版本更新'));
     if(it.kind==='leftovers')return line('进程','--warn',`${it.count} 个后台进程还在跑`,go('ovLeftovers','滚到后台进程'));
     if(it.kind==='preview')return line('预览','--fail','预览在服务整个项目目录',go('ovPreviews','滚到预览服务'));
     // 每个检查项单独一个节点:英文界面按整段文字逐个翻译
@@ -1175,7 +1176,7 @@ function inboxHtml(){
     <div class="card ovgroups" style="margin-bottom:22px">${items.map(row).join('')}</div>`;
 }
 function bindInbox(){
-  $$('#overview [data-ibgo]').forEach(b=>b.onclick=()=>{const el=$('#'+b.dataset.ibgo);if(el)el.scrollIntoView({behavior:'smooth',block:'start'});});
+  $$('#overview [data-ibgo]').forEach(b=>b.onclick=()=>{if(b.dataset.ibgo==='updateCard'){$$('nav button').forEach(x=>x.classList.toggle('active',x.dataset.tab==='settings'));$$('.tab').forEach(t=>t.classList.toggle('on',t.id==='settings'));}const el=$('#'+b.dataset.ibgo);if(el)requestAnimationFrame(()=>el.scrollIntoView({behavior:'smooth',block:'start'}));});
   $$('#overview [data-ibdis]').forEach(b=>b.onclick=async()=>{
     try{const r=await api('/api/inbox/dismiss','POST',{key:b.dataset.ibdis});S.inbox=r.inbox||[];paintInbox();toast('已忽略','ok');}catch(e){toast(e.message,'err');}});
 }
@@ -3215,6 +3216,7 @@ async function pgSend(){
 /* ── settings ── */
 function renderSettings(){
   const a=S.agent,fe=S.feishu,px=S.proxy,net=S.net||{};
+  const upd=S.update||null;
   // 项目根目录:控制台**只读**(产品决定 —— 它是围栏的策略,登上控制台就能改等于围栏只剩一次点击)。
   // 这里只把现状说清:每条根在不在、配置里被忽略的值、哪些群在根外;改要走安装向导或机器上的配置文件。
   const pri=S.projectsRootsInfo||{roots:[],dropped:[],outside:[],configured:null,fromConfig:false};
@@ -3235,6 +3237,14 @@ function renderSettings(){
     <div class="hint" style="margin-top:9px">${net.lan
       ?`<b style="color:var(--risk)">已对局域网开放</b> · ${net.authOn?'需密码':'<b style="color:var(--fail)">未设密码(异常)</b>'} · HTTP 明文,仅可信网络用(最稳走 SSH 隧道)。`
       :'仅本机可访问 · 要对外开放:先设访问密码,再把绑定地址改为 0.0.0.0。'}</div>
+    <div class="inline" style="gap:14px;margin-top:13px;flex-wrap:wrap">
+      <label class="inline" style="gap:6px;cursor:pointer"><input type="checkbox" id="netLan" ${net.lan?'checked':''} style="width:auto"/> <span class="dim">局域网访问</span></label>
+      <label class="inline" style="gap:6px;cursor:pointer"><input type="checkbox" id="netPublic" ${net.publicEnabled?'checked':''} style="width:auto"/> <span class="dim">公网飞书登录</span></label>
+    </div>
+    ${!net.authOn?`<div class="field" style="margin:10px 0 0;max-width:320px"><label class="f">访问密码</label><input id="netPass" type="password" autocomplete="new-password" placeholder="局域网开启时设置,至少 6 位"/><div class="hint" style="margin-top:4px">只保存 scrypt 哈希;开启局域网前必填</div></div>`:''}
+    <div class="hint" style="margin-top:7px">${net.publicEnabled?(net.publicReady?'公网登录已启用':'公网登录待配置'): '公网登录已关闭'}${!net.publicReady&&net.feishuLogin&&net.feishuLogin.why?` · ${esc(net.feishuLogin.why)}`:''} · 开关只控制本程序入口,不会改动反向代理或隧道。</div>
+    <button class="btn primary" id="netSave" style="margin-top:12px">保存访问设置</button>
+    <div class="hint" style="margin-top:7px">局域网监听按当前端口即时切换;关闭后只允许本机访问。系统防火墙可能仍会拦截。</div>
     ${INJECTED_TOKEN?'':'<div style="margin-top:10px;display:flex;gap:8px;flex-wrap:wrap"><button class="btn" id="logoutBtn" title="作废这次登录;其它设备上的登录不受影响">退出登录</button><button class="btn" id="logoutAllBtn" title="作废这台机器签发过的全部登录(所有设备都要重新登录),手机丢了用这个">退出所有设备</button></div>'}
     ${prSection}
   </div>`;
@@ -3262,6 +3272,23 @@ function renderSettings(){
   </div>`;
   const verhistCard=`<div class="card" style="grid-column:1/-1" id="verhistCard"><div class="lbl">版本历史</div>
     <div id="verhistBox"><div class="empty">加载中…</div></div></div>`;
+  const updateJob=upd&&upd.job;
+  const updateBusy=!!(updateJob&&['queued','installing','restarting','restart-needed'].includes(updateJob.state));
+  const updateText=!upd?'后台版本检查不可用':updateJob?esc(updateJob.message||updateJob.state):upd.available?`检测到新版本 v${esc(upd.latestVersion)} · 当前 v${esc(upd.currentVersion)}`:upd.checkedAt?`当前为最新版本 v${esc(upd.currentVersion)}`:'尚未检查新版';
+  const updateCard=`<div class="card" style="grid-column:1/-1" id="updateCard"><div class="lbl">软件更新</div>
+    <div id="updateStatus" class="hint" style="margin:0 0 12px;color:var(--ink)">${updateText}</div>
+    ${upd&&upd.available?`<div class="hint" style="margin:-4px 0 12px">版本差异与发布说明：<a href="https://github.com/sintlab/sintbot/releases/tag/v${encodeURIComponent(upd.latestVersion)}" target="_blank" rel="noopener" style="color:var(--ember-soft)">查看 v${esc(upd.latestVersion)} 发布说明</a></div>`:''}
+    <div class="inline" style="gap:14px;flex-wrap:wrap;margin-bottom:12px">
+      <span class="dim">自动检查稳定版(启动时及每天)</span>
+      <label class="inline" style="gap:6px;cursor:pointer"><input type="checkbox" id="updAnnounce" ${upd&&upd.announce!==false?'checked':''} style="width:auto"/> <span class="dim">升级后向群里播报(记住选择)</span></label>
+    </div>
+    <div class="inline" style="gap:8px;flex-wrap:wrap">
+      <button class="btn" id="updCheck" ${!upd?'disabled':''}>检查新版</button>
+      <button class="btn primary" id="updInstall" ${!upd||!upd.available||updateBusy?'disabled':''}>现在升级</button>
+      <button class="btn" id="updIgnore" ${!upd||!upd.available?'disabled':''}>忽略此版本</button>
+    </div>
+    <div class="hint" style="margin-top:10px">只安装检测到的稳定版本;所有群任务与队列清空后才会安装。需要可写的全局安装目录,不会提权;后台服务会自动重启,前台运行需手动重启。</div>
+  </div>`;
   $('#settings').innerHTML=`<div class="grid cols2 stagger">
     ${netCard}
     <div class="card"><div class="lbl">运行限制</div>
@@ -3284,6 +3311,7 @@ function renderSettings(){
     ${fxFeishuCard(fe)}
     ${fxSlackCard(S.slack||null)}
     ${fxWecomCard(S.wecom||null)}
+    ${updateCard}
     ${aboutCard}
     ${verhistCard}
   </div>`;
@@ -3291,6 +3319,33 @@ function renderSettings(){
   $('#bSave').onclick=async()=>{const brand=$('#bBrand').value.trim(),http=$('#pxHttp').value.trim();
     if(http&&!/^https?:\/\/\S+$/i.test(http)){toast('代理地址要像 http://127.0.0.1:7890','err');return;}
     try{await api('/api/agent','POST',{brand});S=await api('/api/proxy','POST',{enabled:!!http,http});toast('已保存','ok');renderSettings();}catch(e){toast(e.message,'err');}};
+  $('#netSave').onclick=async()=>{
+    const lanEnabled=$('#netLan').checked,publicEnabled=$('#netPublic').checked;
+    const patch={lanEnabled,publicEnabled};
+    const pw=$('#netPass');if(pw&&pw.value)patch.password=pw.value;
+    if(lanEnabled&&!net.lan&&!net.authOn&&(!patch.password||patch.password.length<6)){toast('开启局域网访问前要设置至少 6 位访问密码','err');return;}
+    if(lanEnabled!==!!net.lan&&!confirm(lanEnabled?'开启后,同一可信局域网内可访问登录页;继续?':'关闭后,远程设备将无法访问控制台;继续?'))return;
+    if(publicEnabled!==!!net.publicEnabled&&!confirm(publicEnabled?'启用公网飞书登录入口?这不会修改反向代理或隧道。':'关闭公网入口并让现有飞书登录退出?'))return;
+    const b=$('#netSave');b.disabled=true;
+    try{const r=await api('/api/ui/network','POST',patch);
+      if(r.rebinding){toast('访问地址正在切换;页面即将重载','ok');setTimeout(()=>location.reload(),1200);return;}
+      S=r;toast('访问设置已保存','ok');renderSettings();
+    }catch(e){toast(e.message,'err');b.disabled=false;}
+  };
+  const saveUpdatePrefs=async(patch)=>{try{S=await api('/api/ui/update-settings','POST',patch);renderSettings();}catch(e){toast(e.message,'err');}};
+  $('#updAnnounce').onchange=()=>saveUpdatePrefs({announce:$('#updAnnounce').checked});
+  $('#updCheck').onclick=async()=>{const b=$('#updCheck');b.disabled=true;b.textContent='检查中…';
+    try{await api('/api/update/check','POST',{});S=await api('/api/state');await refreshInbox();renderSettings();renderOverview();toast('版本检查完成','ok');}
+    catch(e){toast(e.message,'err');b.disabled=false;b.textContent='检查新版';}};
+  $('#updInstall').onclick=async()=>{const u=S.update||{},version=u.latestVersion;if(!version)return;
+    const announce=$('#updAnnounce').checked;
+    if(!confirm(`将从 v${u.currentVersion} 升级到 v${version}。${announce?'安装完成后会向未暂停的群播报；':'本次不向群播报。'}所有群任务结束后才开始安装，后台服务会重启。继续?`))return;
+    const b=$('#updInstall');b.disabled=true;
+    try{const r=await api('/api/update/start','POST',{version,announce});S.update={...r,announce};await refreshInbox();renderSettings();renderOverview();toast('更新已排队，群任务空闲后开始','ok');}
+    catch(e){toast(e.message,'err');b.disabled=false;}};
+  $('#updIgnore').onclick=async()=>{const version=(S.update||{}).latestVersion;if(!version)return;
+    try{const r=await api('/api/update/ignore','POST',{version});S.update={...r,announce:$('#updAnnounce').checked};await refreshInbox();renderSettings();renderOverview();toast('已忽略此版本','ok');}
+    catch(e){toast(e.message,'err');}};
   // 只开着控制台的守护进程(还没接平台):第一次接上平台时说一句接下来会发生什么(服务托管的会自己重启连上)
   {const pl=S.platforms||{};if(S.setupMode&&(pl.feishu||pl.slack||pl.wecom)&&!window._sbRestartToast){window._sbRestartToast=1;toast(S.setupMode.supervised?'已接上聊天平台 —— 后台服务几秒后自动重启并连上':'已接上聊天平台 —— 在终端里重启 sintbot start --ui 连上','ok');}}
   bindWecomCard();
@@ -4440,6 +4495,38 @@ const I18N_EN=[
   [";改后即时生效,不用重启。","; changes apply immediately, no restart needed."],
   ["公网","Public"],
   ["局域网","LAN"],
+  ["局域网访问","LAN access"],
+  ["公网飞书登录","Public Feishu sign-in"],
+  ["访问密码","Access password"],
+  ["局域网开启时设置,至少 6 位","Set when enabling LAN access; at least 6 characters"],
+  ["只保存 scrypt 哈希;开启局域网前必填","Only a scrypt hash is stored; required before enabling LAN access"],
+  ["公网登录已启用","Public sign-in is enabled"],
+  ["公网登录待配置","Public sign-in needs configuration"],
+  ["公网登录已关闭","Public sign-in is off"],
+  ["保存访问设置","Save access settings"],
+  ["开关只控制本程序入口,不会改动反向代理或隧道。","These switches control this app only; they do not change the reverse proxy or tunnel."],
+  ["局域网监听按当前端口即时切换;关闭后只允许本机访问。系统防火墙可能仍会拦截。","LAN binding changes immediately on the current port; when off, only this machine can connect. The system firewall may still block access."],
+  ["软件更新","Software updates"],
+  ["后台版本检查不可用","Version checks are unavailable in this console"],
+  ["自动检查稳定版(启动时及每天)","Automatically checks for stable releases at startup and daily"],
+  ["升级后向群里播报(记住选择)","Announce upgrades in groups (remember this choice)"],
+  ["检查新版","Check for updates"],
+  ["现在升级","Upgrade now"],
+  ["忽略此版本","Ignore this version"],
+  ["版本差异与发布说明：","Changes and release notes: "],
+  ["尚未检查新版","No version check has run yet"],
+  ["当前为最新版本","This is the latest version"],
+  ["检测到新版本","A new version is available"],
+  ["更新已排队，群任务空闲后开始","Update queued; installation will start when all group tasks are idle"],
+  ["已忽略此版本","This version was ignored"],
+  ["版本检查完成","Version check complete"],
+  ["访问地址正在切换;页面即将重载","Changing the access address; this page will reload"],
+  ["访问设置已保存","Access settings saved"],
+  ["开启局域网访问前要设置至少 6 位访问密码","Set an access password of at least 6 characters before enabling LAN access"],
+  ["开启后,同一可信局域网内可访问登录页;继续?","Enabling lets devices on the trusted LAN reach the sign-in page. Continue?"],
+  ["关闭后,远程设备将无法访问控制台;继续?","Remote devices will lose console access. Continue?"],
+  ["启用公网飞书登录入口?这不会修改反向代理或隧道。","Enable public Feishu sign-in? This will not change the reverse proxy or tunnel."],
+  ["关闭公网入口并让现有飞书登录退出?","Disable public access and sign out existing Feishu sessions?"],
   ["访问地址","Access URLs"],
   ["已对外,未检测到局域网 IPv4","Open to the network, but no LAN IPv4 was detected"],
   ["已对局域网开放","Open on the LAN"],
@@ -5046,6 +5133,18 @@ const I18N_EN_RX=[
   [/^✕ 加载失败:([\s\S]+)$/,"✕ Failed to load: $1"],
   [/^加载失败:([\s\S]+)$/,"Failed to load: $1"],
   [/^登录失败 \(HTTP (\d+)\)$/,"Sign-in failed (HTTP $1)"],
+  [/^检测到新版本 v([\d.]+) · 当前 v([\d.]+)$/,"New version v$1 · current v$2"],
+  [/^当前为最新版本 v([\d.]+)$/,"v$1 is the latest version"],
+  [/^等待所有群任务结束后更新$/,"Waiting for all group tasks to finish"],
+  [/^正在检查安装位置并安装指定版本$/,"Checking the install location and installing the selected version"],
+  [/^已安装，正在重启后台服务$/,"Installed; restarting the background service"],
+  [/^已安装新版；后台服务未能自动重启，请手动重启$/,"The new version is installed, but the background service did not restart; restart it manually"],
+  [/^已安装新版；当前不是受托管服务，请手动重启 SintBot$/,"The new version is installed; restart SintBot manually"],
+  [/^更新完成并已重启$/,"Update completed and restarted"],
+  [/^更新后未能自动重启，请手动重启服务$/,"The update could not restart automatically; restart the service manually"],
+  [/^等待群任务结束超时；可在任务空闲后重新发起$/,"Timed out waiting for group tasks; retry when they are idle"],
+  [/^当前运行的是开发目录或非全局副本；请在终端手动更新$/,"This is a development or non-global install; update it from a terminal"],
+  [/^将从 v([\d.]+) 升级到 v([\d.]+)。([\s\S]*)$/,(a,from,to,what)=>`Upgrade from v${from} to v${to}. ${what.replace('所有群任务结束后才开始安装，后台服务会重启。','Installation waits until all group tasks finish, then restarts the background service.').replace('本次不向群播报。','This update will not be announced in groups.').replace('安装完成后会向未暂停的群播报；','After installation, it will be announced in active groups;')}`],
 ];
 /* I18N_DICT_END */
 

package/src/ui/dashboard.js

@@ -101,8 +101,11 @@ function failedTurns(rows, now) {
 //   leftovers  残留的后台进程(同上)
 //   preview    服务整个项目目录的预览(全部代码都在局域网上可读)
 //   health     健康检查没通过的项(一行汇总,排最前:它是「现在就坏着」,没有发生时刻可排)
-function buildInbox({ ledgerRows = [], issues = null, previews = [], leftovers = null, health = null, takeovers = [], groups = {}, dismissed = new Set(), now = Date.now() } = {}) {
+function buildInbox({ ledgerRows = [], issues = null, previews = [], leftovers = null, health = null, update = null, takeovers = [], groups = {}, dismissed = new Set(), now = Date.now() } = {}) {
   const items = []
+  if (update && update.available && update.latestVersion) {
+    items.push({ key: `update:${update.latestVersion}`, kind: 'update', from: update.currentVersion || '', to: update.latestVersion, ts: update.checkedAt || now, dismissable: true })
+  }
   for (const f of failedTurns(ledgerRows, now)) {
     items.push({ key: `failed:${f.chatId}:${f.ts}`, kind: 'failed', chatId: f.chatId, group: groupLabel(groups, f.chatId), ts: f.ts,
       sender: f.sender || '', text: f.text || '', err: f.err ? String(f.err) : '', dismissable: true })

package/src/ui/server.js

@@ -32,7 +32,7 @@ const { createIssues, summarize, fingerprint } = require('../core/issues') //
 const leftover = require('../leftover') // 遗留进程:对话轮次结束后仍在跑的后台 shell —— 同一条道理,那条每 5 秒打线上接口的循环跑了 35 天就是因为没处看见(v0.11.108)
 const { withFileLock } = require('../core/store') // 反馈本改状态要与 CLI/群命令共用同一把跨进程锁
 const { redact } = require('../core/redact') // 出站脱敏:预览停止通知里含 agent 提供的 label
-const { verifyPassword } = require('./auth')
+const { hashPassword, verifyPassword } = require('./auth')
 const feishulogin = require('./feishulogin') // 控制台「用飞书登录」:OAuth 授权码流程的纯逻辑(公网入口;只放行管理员名单)
 const { createSessionStore } = require('./sessions') // 登录会话落盘 + 30 天过期(守护进程重启不再把人登出)
 const { listWecomSessions, wecomAuthShow } = require('../platform/wecom')
@@ -208,7 +208,7 @@ function bindNoticeText(workdir, platform = 'feishu', cmd = '/help') {
   return `✅ 本群已绑定项目「${path.basename(String(workdir || '')) || '(未命名)'}」\n${platform === 'wecom' ? '@我 派单(只有 @ 我的消息我才收得到)' : '直接发消息或 @我 派单'};${cmd} 查看命令`
 }
 
-function createUiServer({ configPath, getLiveState = null, getConnHealth = null, onConfigChange = null, control = null, host = '127.0.0.1', log = () => {}, issuesPath = null, sessionsPath = null, auditPath = null, ledgerPath = null, inboxDismissPath = null, fetchImpl = null, cdpImpl = null, onTakeoverClaim = null, onTakeoverExpire = null, onTakeoverEnd = null, takeoverNow = null, wecomExec = null, verifyFile = null, setupMode = null } = {}) {
+function createUiServer({ configPath, getLiveState = null, getConnHealth = null, onConfigChange = null, onHostChange = null, control = null, updater = null, host = '127.0.0.1', log = () => {}, issuesPath = null, sessionsPath = null, auditPath = null, ledgerPath = null, inboxDismissPath = null, fetchImpl = null, cdpImpl = null, onTakeoverClaim = null, onTakeoverExpire = null, onTakeoverEnd = null, takeoverNow = null, wecomExec = null, verifyFile = null, setupMode = null } = {}) {
   // wecomExec:企业微信命令行工具的执行器注入(只为可测;生产走默认 execFile)
   // verifyFile:凭据验证记录的落点注入(只为可测;生产 = ~/.sbot/verify.json)
   const vopts = verifyFile ? { file: verifyFile } : undefined
@@ -257,14 +257,18 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
     const publicUrl = feishulogin.normalizePublicUrl(ui.publicUrl)
     const appId = resolveRef(fe.appId), appSecret = resolveRef(fe.appSecret), admins = adminList(fe)
     const r = feishulogin.feishuLoginReadiness({ publicUrl, appId, appSecret, admins })
-    return { ready: r.ready, why: r.why, publicUrl: publicUrl || '', redirectUri: publicUrl ? feishulogin.redirectUri(publicUrl) : '', appId, appSecret, admins }
+    const enabled = ui.publicEnabled !== false // 未出现这个字段的旧配置保持原行为
+    return { ready: enabled && r.ready, configured: r.ready, enabled, why: !enabled ? '公网登录已关闭' : r.why,
+      publicUrl: publicUrl || '', redirectUri: publicUrl ? feishulogin.redirectUri(publicUrl) : '', appId, appSecret, admins }
   }
   // Host 白名单:环回时只认 loopback(防 DNS-rebinding);对外(--host 非环回)额外放行私网段
   // IPv4(10./192.168./172.16-31./169.254.)。攻击者域名不匹配私网 IP 模式 → rebinding 仍挡住。
-  const loopbackBind = /^(127\.0\.0\.1|localhost|::1)$/i.test(String(host))
-  const HOST_OK = loopbackBind
+  let activeHost = String(host)
+  let loopbackBind = /^(127\.0\.0\.1|localhost|::1)$/i.test(activeHost)
+  const hostPattern = () => loopbackBind
     ? /^(127\.0\.0\.1|localhost|\[::1\])(:\d+)?$/i
     : /^(127\.0\.0\.1|localhost|\[::1\]|10(\.\d{1,3}){3}|192\.168(\.\d{1,3}){2}|172\.(1[6-9]|2\d|3[01])(\.\d{1,3}){2}|169\.254(\.\d{1,3}){2})(:\d+)?$/i
+  let HOST_OK = hostPattern()
   const authed = (req, url) => { const t = req.headers['x-sbot-token'] || url.searchParams.get('token'); return (!!t && t === token) || sessions.has(t) }
   // 是否已配访问密码(配了 ⇒ 页面不发 token,走登录)。config 读坏时的裁决见 authConfiguredFrom。
   const authConfigured = () => authConfiguredFrom(() => (readRaw().ui || {}).auth, loopbackBind)
@@ -329,9 +333,11 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
   // 「需要你处理」:从 state 各区取数(反馈本 / 预览 / 残留进程 / 健康)+ 账本 + 接管票,不再各算一遍
   const buildInboxFor = ({ issues, previews, leftovers, health }, raw) => {
     try {
+      const update = updater ? { ...updater.status(), announce: !raw || !raw.ui || raw.ui.announceUpdates !== false } : null
       return dashboard.buildInbox({
         ledgerRows: ledgerTail.rows(),
         issues, previews, leftovers, health,
+        update,
         takeovers: takeoverStore.pending(),
         groups: (raw && raw.groups) || {},
         dismissed: inboxDismiss.set(),
@@ -606,14 +612,18 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
         const port = addr && typeof addr === 'object' ? addr.port : null
         return {
           lan: !loopbackBind,
+          host: activeHost,
           port,
           local: port ? `http://127.0.0.1:${port}` : null,
           lanUrls: (!loopbackBind && port) ? lanIPv4().map((ip) => `http://${ip}:${port}`) : [],
           authOn: authConfigured(),
           publicUrl: fli.publicUrl, // 公网地址(飞书登录回调的根;设置页可填)
+          publicEnabled: fli.enabled,
+          publicReady: fli.configured,
           feishuLogin: { ready: fli.ready, why: fli.why, redirectUri: fli.redirectUri },
         }
       })(),
+      update: updater ? { ...updater.status(), announce: !raw.ui || raw.ui.announceUpdates !== false } : null,
     }
     state.inbox = buildInboxFor(state, raw)
     return state
@@ -806,6 +816,31 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
       if (p === '/api/changelog' && req.method === 'GET') return sendJSON(res, 200, { changelog: readChangelog() })
       // 同一份版本历史的英文本(界面切英文时才拉;缺的版本前端按 version 回退中文)
       if (p === '/api/changelog-en' && req.method === 'GET') return sendJSON(res, 200, { changelog: readChangelogEn() })
+      if (p === '/api/update/check' && req.method === 'POST') {
+        if (!updater) return sendJSON(res, 503, { error: '版本检查暂不可用' })
+        return sendJSON(res, 200, await updater.check())
+      }
+      if (p === '/api/update/start' && req.method === 'POST') {
+        if (!updater) return sendJSON(res, 503, { error: '版本升级暂不可用' })
+        const { version, announce } = await body(req)
+        try { return sendJSON(res, 202, updater.startUpgrade({ version, announce })) }
+        catch (e) { return sendJSON(res, 409, { error: e.message, update: updater.status() }) }
+      }
+      if (p === '/api/update/ignore' && req.method === 'POST') {
+        if (!updater) return sendJSON(res, 503, { error: '版本升级暂不可用' })
+        const { version } = await body(req)
+        try { return sendJSON(res, 200, updater.ignore(version)) }
+        catch (e) { return sendJSON(res, 400, { error: e.message }) }
+      }
+      if (p === '/api/ui/update-settings' && req.method === 'POST') {
+        const patch = await body(req)
+        if (typeof patch.announce !== 'boolean') return sendJSON(res, 400, { error: '请提供升级播报偏好' })
+        const raw = readRaw(); raw.ui = raw.ui || {}
+        raw.ui.announceUpdates = patch.announce
+        delete raw.ui.autoUpdateCheck
+        writeRaw(raw)
+        return sendJSON(res, 200, await buildState())
+      }
       // codex 可用模型(codex 面板「模型」下拉):app-server model/list 实时探测(当前
       // 账号真实可用集,含各模型支持的推理强度),失败回退内置预设;探测要 spawn 进程
       // +触网 → 10 分钟缓存。
@@ -1058,6 +1093,67 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
         if (t) { const n = feishulogin.normalizePublicUrl(t); if (!n) return sendJSON(res, 400, { error: '公网地址要写成 https://域名(可带端口),不带路径' }); raw.ui.publicUrl = n } else delete raw.ui.publicUrl
         writeRaw(raw); return sendJSON(res, 200, await buildState())
       }
+      if (p === '/api/ui/network' && req.method === 'POST') {
+        const patch = await body(req); const raw = readRaw(); raw.ui = raw.ui || {}
+        const previousHost = activeHost
+        let nextHost = activeHost
+        if (typeof patch.lanEnabled === 'boolean') {
+          if (patch.lanEnabled && patch.password) {
+            const password = String(patch.password)
+            if (password.length < 6) return sendJSON(res, 400, { error: '访问密码至少 6 位' })
+            raw.ui.auth = hashPassword(password)
+          }
+          if (patch.lanEnabled && !raw.ui.auth) return sendJSON(res, 400, { error: '开启局域网访问前要先设置访问密码' })
+          if (patch.lanEnabled !== !loopbackBind) {
+            nextHost = patch.lanEnabled ? '0.0.0.0' : '127.0.0.1'
+            raw.ui.host = nextHost
+          }
+        }
+        if (typeof patch.publicEnabled === 'boolean') {
+          const wasEnabled = raw.ui.publicEnabled !== false
+          if (patch.publicEnabled) {
+            const fe = raw.feishu || {}; const publicUrl = feishulogin.normalizePublicUrl(raw.ui.publicUrl)
+            const ready = feishulogin.feishuLoginReadiness({ publicUrl, appId: resolveRef(fe.appId), appSecret: resolveRef(fe.appSecret), admins: adminList(fe) })
+            if (!ready.ready) return sendJSON(res, 400, { error: `公网登录尚未就绪：${ready.why}` })
+          }
+          raw.ui.publicEnabled = patch.publicEnabled
+          if (wasEnabled && !patch.publicEnabled) {
+            const n = sessions.revokeWhere((session) => session && session.via === 'feishu')
+            if (n) audit.append({ kind: 'ui-public-access-revoked', sessions: n, ts: Date.now() })
+          }
+        }
+        writeRaw(raw)
+        audit.append({ kind: 'ui-network-settings', lan: nextHost !== '127.0.0.1', publicEnabled: raw.ui.publicEnabled !== false,
+          hostChanged: nextHost !== previousHost, ts: Date.now() })
+        if (nextHost !== previousHost) {
+          const responseSocket = res.socket
+          let rebindStarted = false
+          const startRebind = () => {
+            if (rebindStarted) return
+            rebindStarted = true
+            clearTimeout(rebindFallback)
+            setImmediate(() => rebindHost(nextHost).catch((e) => {
+              try {
+                const latest = readRaw(); latest.ui = latest.ui || {}; latest.ui.host = previousHost
+                writeRaw(latest)
+              } catch (rollbackErr) { log('ui host rollback failed: ' + (rollbackErr && rollbackErr.message)) }
+              audit.append({ kind: 'ui-network-rebind', ok: false, from: nextHost, to: previousHost, ts: Date.now() })
+              log('ui host change failed: ' + (e && e.message))
+            }))
+          }
+          // Wait for the switching response's connection to close before closing
+          // the listener; a fixed delay can still reset the response under load.
+          const rebindFallback = setTimeout(startRebind, 1000)
+          if (rebindFallback.unref) rebindFallback.unref()
+          if (responseSocket && !responseSocket.destroyed) responseSocket.once('close', startRebind)
+          res.writeHead(202, { 'Content-Type': 'application/json; charset=utf-8', Connection: 'close' })
+          res.end(JSON.stringify({ ok: true, rebinding: true, lan: nextHost !== '127.0.0.1' }), () => {
+            if (!responseSocket || responseSocket.destroyed) startRebind()
+          })
+          return
+        }
+        return sendJSON(res, 200, await buildState())
+      }
       if (p === '/api/feishu' && req.method === 'POST') {
         const { appId, appSecret, botOpenId, adminOpenId, adminName, onlyWhenMentioned } = await body(req); const raw = readRaw()
         raw.feishu = raw.feishu || { onlyWhenMentioned: false }
@@ -2152,6 +2248,40 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
     }
   })
 
+  function setActiveHost(value) {
+    const changed = activeHost !== String(value)
+    activeHost = String(value)
+    loopbackBind = /^(127\.0\.0\.1|localhost|::1)$/i.test(activeHost)
+    HOST_OK = hostPattern()
+    if (changed && onHostChange) { try { onHostChange(activeHost, server.address()) } catch (e) { log('ui host callback: ' + (e && e.message)) } }
+  }
+  function listenAgain(bindHost, port) {
+    return new Promise((resolve, reject) => {
+      const onError = (e) => { server.removeListener('listening', onListening); reject(e) }
+      const onListening = () => { server.removeListener('error', onError); setActiveHost(bindHost); resolve() }
+      server.once('error', onError)
+      server.once('listening', onListening)
+      server.listen(port, bindHost)
+    })
+  }
+  async function rebindHost(nextHost) {
+    if (!['127.0.0.1', '0.0.0.0'].includes(nextHost)) throw new Error('只支持本机或全部局域网接口')
+    const address = server.address()
+    if (!address || typeof address !== 'object') throw new Error('控制台尚未监听端口')
+    const oldHost = activeHost
+    if (nextHost === oldHost) return
+    for (const client of sseClients) { try { client.end() } catch {} }
+    sseClients.clear()
+    const stopped = new Promise((resolve, reject) => server.close((e) => e ? reject(e) : resolve()))
+    if (typeof server.closeAllConnections === 'function') server.closeAllConnections()
+    await stopped
+    try { await listenAgain(nextHost, address.port) }
+    catch (e) {
+      try { await listenAgain(oldHost, address.port) } catch (restoreErr) { log('ui host restore listen failed: ' + (restoreErr && restoreErr.message)) }
+      throw e
+    }
+  }
+
   // Broadcast live state + heartbeat over SSE (cheap; no health probe here).
   const tick = setInterval(() => {
     if (!sseClients.size) return
@@ -2164,6 +2294,7 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
   return {
     server,
     listen(port, host, cb) { server.listen(port, host, cb) },
+    rebind: rebindHost,
     // let a daemon push turn events into the console's activity feed
     pushEvent(type, data) {
       if (type === 'turn') recordActivity(data) // also buffer it for replay (下一步 ②)
@@ -2175,7 +2306,7 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
       }
       for (const c of sseClients) { try { c.write(msg) } catch { sseClients.delete(c) } }
     },
-    close() { clearInterval(tick); for (const c of sseClients) { try { c.end() } catch {} } try { browserRoutes.close() } catch {} server.close() },
+    close() { clearInterval(tick); for (const c of sseClients) { try { c.end() } catch {} } try { browserRoutes.close() } catch {} server.close(); if (typeof server.closeAllConnections === 'function') server.closeAllConnections(); if (updater) updater.close() },
     _browserRoutes: browserRoutes, // 测试探 CDP 会话注册表用
   }
 }

package/src/updater.js

@@ -0,0 +1,243 @@
+// Stable-version checks and guarded in-place upgrades for the global package.
+// Checking is read-only. Installation is explicit, exact-version only, waits for
+// every group queue to drain, and never escalates privileges.
+
+const fs = require('node:fs')
+const path = require('node:path')
+const { execFile } = require('node:child_process')
+const { promisify } = require('node:util')
+const { atomicWriteJSON } = require('./core/store')
+
+const execFileAsync = promisify(execFile)
+const PACKAGE = 'sintbot'
+const REGISTRIES = [
+  { url: 'https://registry.npmjs.org/sintbot/latest', source: 'npm' },
+  { url: 'https://registry.npmmirror.com/sintbot/latest', source: 'mirror' },
+]
+const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000
+const CHECK_TIMEOUT_MS = 10_000
+const QUEUE_TIMEOUT_MS = 24 * 60 * 60 * 1000
+
+function stableVersion(value) {
+  const s = String(value || '').trim().replace(/^v/, '')
+  return /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(s) ? s : null
+}
+
+function compareVersion(a, b) {
+  const av = stableVersion(a); const bv = stableVersion(b)
+  if (!av || !bv) return 0
+  const aa = av.split('.').map(BigInt); const bb = bv.split('.').map(BigInt)
+  for (let i = 0; i < 3; i++) if (aa[i] !== bb[i]) return aa[i] > bb[i] ? 1 : -1
+  return 0
+}
+
+function hasPendingWork(live) {
+  // Updating while the engine is missing or its snapshot is incomplete is unsafe:
+  // a busy group could be hidden by a failed state read. Treat unknown as busy.
+  if (!live || live.running !== true || !Number.isFinite(Number(live.queue)) || !live.groups || typeof live.groups !== 'object') return true
+  if (Number(live.queue) > 0) return true
+  return Object.values(live.groups).some((g) => !g || g.busy || !Number.isFinite(Number(g.queue)) || Number(g.queue) > 0)
+}
+
+async function fetchVersion({ fetchImpl = globalThis.fetch, url, timeoutMs = CHECK_TIMEOUT_MS } = {}) {
+  const ac = new AbortController()
+  const timer = setTimeout(() => ac.abort(), timeoutMs)
+  try {
+    const res = await fetchImpl(url, { headers: { accept: 'application/json' }, signal: ac.signal, redirect: 'error' })
+    if (!res || !res.ok) throw new Error(`HTTP ${res && res.status || 'error'}`)
+    const data = await res.json()
+    const version = stableVersion(data && (data.version || (data['dist-tags'] && data['dist-tags'].latest)))
+    if (!version) throw new Error('registry returned no stable version')
+    return version
+  } finally { clearTimeout(timer) }
+}
+
+function readState(file) {
+  try {
+    const v = JSON.parse(fs.readFileSync(file, 'utf8'))
+    return v && typeof v === 'object' ? v : {}
+  } catch { return {} }
+}
+
+function createUpdater({
+  currentVersion,
+  stateFile,
+  getLiveState = () => null,
+  fetchImpl = globalThis.fetch,
+  registries = REGISTRIES,
+  now = Date.now,
+  waitMs = 5000,
+  queueTimeoutMs = QUEUE_TIMEOUT_MS,
+  checkIntervalMs = CHECK_INTERVAL_MS,
+  isGlobalInstall = defaultGlobalInstall,
+  installExact = defaultInstallExact,
+  readInstalledVersion = defaultReadInstalledVersion,
+  getManagedService = () => false,
+  restartManagedService = async () => ({ ok: false }),
+  setAnnouncementBaseline = () => {},
+  log = () => {},
+} = {}) {
+  const file = stateFile || path.join(require('node:os').homedir(), '.sbot', 'update.json')
+  const current = stableVersion(currentVersion) || '0.0.0'
+  let data = readState(file)
+  let queueTimer = null
+  let checking = null
+  let closed = false
+
+  // If a previous daemon was replaced during the restart step, the new package
+  // version is the evidence that installation and restart both completed.
+  if (data.job && data.job.state === 'restarting') {
+    data.job = data.job.to === current
+      ? { ...data.job, state: 'done', message: '更新完成并已重启', updatedAt: now() }
+      : { ...data.job, state: 'failed', message: '更新后未能自动重启，请手动重启服务', updatedAt: now() }
+    persist()
+  }
+
+  function persist() { try { atomicWriteJSON(file, data, { mode: 0o600 }) } catch (e) { log('update state: ' + (e && e.message)) } }
+  function status() {
+    const latest = stableVersion(data.latestVersion)
+    return {
+      currentVersion: current,
+      latestVersion: latest,
+      checkedAt: Number(data.checkedAt) || null,
+      source: data.source || '',
+      ignoredVersion: data.ignoredVersion || '',
+      available: !!latest && compareVersion(latest, current) > 0 && data.ignoredVersion !== latest,
+      job: data.job ? { ...data.job } : null,
+    }
+  }
+
+  async function check() {
+    if (closed) return status()
+    if (checking) return checking
+    checking = (async () => {
+      let lastError = null
+      for (const r of registries) {
+        try {
+          const version = await fetchVersion({ fetchImpl, url: r.url })
+          data.latestVersion = version
+          data.checkedAt = now()
+          data.source = r.source || ''
+          if (data.ignoredVersion && data.ignoredVersion !== version) data.ignoredVersion = ''
+          persist()
+          return status()
+        } catch (e) { lastError = e }
+      }
+      // Network errors are deliberately quiet and never erase the last success.
+      if (lastError) log('update check unavailable: ' + (lastError && lastError.message || 'network error'))
+      return status()
+    })().finally(() => { checking = null })
+    return checking
+  }
+
+  function ignore(version) {
+    const v = stableVersion(version)
+    if (!v || v !== stableVersion(data.latestVersion)) throw new Error('只能忽略当前检测到的版本')
+    data.ignoredVersion = v
+    persist()
+    return status()
+  }
+
+  function startUpgrade({ version, announce = true } = {}) {
+    const v = stableVersion(version)
+    if (!v || v !== stableVersion(data.latestVersion) || compareVersion(v, current) <= 0) throw new Error('版本信息已变化，请先重新检查')
+    if (data.job && ['queued', 'installing', 'restarting', 'restart-needed'].includes(data.job.state)) throw new Error('已有更新需要完成或重启后再试')
+    data.job = { id: `${now()}-${Math.random().toString(36).slice(2, 8)}`, state: 'queued', from: current, to: v,
+      announce: announce !== false, createdAt: now(), updatedAt: now(), message: '等待所有群任务结束后更新' }
+    persist()
+    void processQueue()
+    return status()
+  }
+
+  function scheduleQueueCheck() {
+    if (closed || queueTimer || !data.job || data.job.state !== 'queued') return
+    queueTimer = setTimeout(() => { queueTimer = null; void processQueue() }, waitMs)
+    if (queueTimer.unref) queueTimer.unref()
+  }
+
+  async function processQueue() {
+    const job = data.job
+    if (closed || !job || job.state !== 'queued') return
+    if (now() - job.createdAt > queueTimeoutMs) {
+      data.job = { ...job, state: 'failed', message: '等待群任务结束超时；可在任务空闲后重新发起', updatedAt: now() }
+      persist(); return
+    }
+    let live
+    try { live = getLiveState() }
+    catch (e) { log('update queue: live state unavailable: ' + (e && e.message)); return scheduleQueueCheck() }
+    if (hasPendingWork(live)) return scheduleQueueCheck()
+    if (queueTimer) { clearInterval(queueTimer); queueTimer = null }
+    data.job = { ...job, state: 'installing', message: '正在检查安装位置并安装指定版本', updatedAt: now() }
+    persist()
+    try {
+      const checkResult = await isGlobalInstall()
+      if (!checkResult || !checkResult.ok) throw new Error((checkResult && checkResult.reason) || '当前运行位置不是可写的全局安装')
+      const result = await installExact(PACKAGE, job.to, checkResult)
+      if (!result || result.ok === false) throw new Error((result && result.reason) || '安装失败；检查包管理器日志后可手动重试')
+      const installed = await readInstalledVersion(checkResult)
+      if (stableVersion(installed) !== job.to) throw new Error('安装完成后的版本核对不符；请手动检查后重启')
+      if (!job.announce) { try { setAnnouncementBaseline(job.to) } catch (e) { log('update announcement baseline: ' + (e && e.message)) } }
+      const managed = await getManagedService()
+      if (managed) {
+        data.job = { ...job, state: 'restarting', message: '已安装，正在重启后台服务', updatedAt: now() }
+        persist()
+        const restarted = await restartManagedService()
+        if (restarted && restarted.ok) return status()
+        data.job = { ...job, state: 'restart-needed', message: '已安装新版；后台服务未能自动重启，请手动重启', updatedAt: now() }
+      } else {
+        data.job = { ...job, state: 'restart-needed', message: '已安装新版；当前不是受托管服务，请手动重启 SintBot', updatedAt: now() }
+      }
+      persist()
+    } catch (e) {
+      data.job = { ...job, state: 'failed', message: String(e && e.message || e).slice(0, 300), updatedAt: now() }
+      persist()
+    }
+    return status()
+  }
+
+  if (data.job && data.job.state === 'queued') void processQueue()
+  const checkTimer = setInterval(() => { void check() }, checkIntervalMs)
+  if (checkTimer.unref) checkTimer.unref()
+
+  return {
+    status,
+    check,
+    ignore,
+    startUpgrade,
+    start() { return check() },
+    close() { closed = true; clearInterval(checkTimer); if (queueTimer) clearTimeout(queueTimer); queueTimer = null },
+  }
+}
+
+function defaultGlobalInstall() {
+  const { execFileSync } = require('node:child_process')
+  const rootOut = execFileSync('npm', ['root', '-g'], { encoding: 'utf8', timeout: 5000, stdio: ['ignore', 'pipe', 'pipe'] }).trim()
+  const globalRoot = fs.realpathSync(rootOut)
+  const globalPackage = path.join(globalRoot, PACKAGE)
+  const runningPackage = fs.realpathSync(path.resolve(__dirname, '..'))
+  if (runningPackage !== fs.realpathSync(globalPackage)) return { ok: false, reason: '当前运行的是开发目录或非全局副本；请在终端手动更新' }
+  fs.accessSync(globalRoot, fs.constants.W_OK | fs.constants.X_OK)
+  fs.accessSync(path.dirname(globalPackage), fs.constants.W_OK | fs.constants.X_OK)
+  return { ok: true, globalRoot, globalPackage }
+}
+
+async function defaultInstallExact(name, version) {
+  const env = {}
+  const allowed = ['PATH', 'HOME', 'USERPROFILE', 'APPDATA', 'LOCALAPPDATA', 'TEMP', 'TMP', 'SystemRoot', 'PATHEXT',
+    'HTTP_PROXY', 'HTTPS_PROXY', 'NO_PROXY', 'http_proxy', 'https_proxy', 'no_proxy', 'LANG', 'LC_ALL']
+  for (const k of allowed) if (process.env[k] !== undefined) env[k] = process.env[k]
+  const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm'
+  try {
+    await execFileAsync(npm, ['install', '--global', `${name}@${version}`, '--omit=dev', '--no-audit', '--no-fund'],
+      { timeout: 10 * 60 * 1000, maxBuffer: 2 * 1024 * 1024, windowsHide: true, env })
+    return { ok: true }
+  } catch (e) {
+    return { ok: false, reason: `安装失败(退出码 ${e && e.code != null ? e.code : '未知'})；未提权，也未改用其他版本` }
+  }
+}
+
+function defaultReadInstalledVersion(info) {
+  try { return JSON.parse(fs.readFileSync(path.join(info.globalPackage, 'package.json'), 'utf8')).version || null } catch { return null }
+}
+
+module.exports = { PACKAGE, REGISTRIES, CHECK_INTERVAL_MS, stableVersion, compareVersion, hasPendingWork, fetchVersion, createUpdater, defaultGlobalInstall, defaultInstallExact, defaultReadInstalledVersion }