fix: WebView闪退→恢复原生UI, versionCode 8→5, H5热更新文件就绪

- MainActivity恢复为原生ScrollView+按钮（WebView在Redmi设备上崩溃） - versionCode回退到5（衔接Git Tag v4） - ota/version.txt指向v6，ota/h5/index-v6.html已准备好作为热更新目标 - APK构建验证通过(33 tasks, 31s)
feat: H5热更新v5→v6 — versionCode 8→5, 远端version.txt指向v6
2026-07-21 13:40:13 +08:00 · 2026-07-21 12:17:49 +08:00 · 2026-07-21 11:56:07 +08:00 · 2026-07-20 23:48:51 +08:00 · 2026-07-20 23:26:06 +08:00 · 2026-07-20 12:57:14 +08:00
51 changed files with 890 additions and 104 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -39,9 +39,18 @@ src-tauri/target/

 # Android
 android/app/build/
-android/.gradle/
+**/android/.gradle/
 android/build/
 *.hprof
 *.jks
 *.keystore
 local.properties
+screen.png
+
+# Temp/debug files
+*.traineddata
+tessdata_temp/
+*.ps1
+*_temp/
+
+
--- a/.reasonix/desktop-topic-auto-title-meta.json
+++ b/.reasonix/desktop-topic-auto-title-meta.json
@@ -0,0 +1,8 @@
+{
+  "topic_20260718-152740_2cab7b15ea20700d": {
+    "stage": 3,
+    "userTurns": 3,
+    "basisHash": "942c58e1a7d2413a",
+    "updatedAt": 1784389797592
+  }
+}
--- a/.reasonix/desktop-topic-created-at.json
+++ b/.reasonix/desktop-topic-created-at.json
@@ -0,0 +1,3 @@
+{
+  "topic_20260718-152740_2cab7b15ea20700d": 1784388460704
+}
--- a/.reasonix/desktop-topic-title-sources.json
+++ b/.reasonix/desktop-topic-title-sources.json
@@ -0,0 +1,3 @@
+{
+  "topic_20260718-152740_2cab7b15ea20700d": "auto"
+}
--- a/.reasonix/desktop-topic-titles.json
+++ b/.reasonix/desktop-topic-titles.json
@@ -0,0 +1,3 @@
+{
+  "topic_20260718-152740_2cab7b15ea20700d": "Start pursuing the…"
+}
--- a/ota/README.md
+++ b/ota/README.md
@@ -0,0 +1,18 @@
+# OTA 文件夹
+
+此目录存放 manifest 文件。manifest-stable.json 是 CI 构建时动态生成的产物，
+也提交到仓库通过 raw URL 供客户端拉取。
+
+## 文件
+
+- `gen-manifest.sh` — 构建后运行，计算 APK SHA256 并生成 manifest-stable.json
+- `manifest-stable.json` — stable 渠道
+- `manifest-beta.json` — beta 渠道
+- `manifest-nightly.json` — nightly 渠道
+
+## 流程
+
+```
+CI 构建 APK → ./ota/gen-manifest.sh → git push manifest-stable.json
+手机 App → raw URL 拉取 manifest → 比较版本 → 下载 APK → SHA256 校验
+```
--- a/ota/gen-manifest.sh
+++ b/ota/gen-manifest.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+# OTA manifest 生成脚本
+# 用法: ./ota/gen-manifest.sh <versionName> <versionCode> <apk-path>
+# 构建号规则: 每次生成APK时 versionCode +1, 对应 git tag vX.Y.Z-dav-android-N
+# CI 构建时自动运行, SHA256动态填入, 生成 manifest-stable.json 后上传到 Gitea Release
+
+VERSION_NAME="${1:-0.1.0}"
+VERSION_CODE="${2:-7}"
+APK_PATH="${3:-packages/client-android/android/app/build/outputs/apk/debug/v0.1.0-dav-android-7-debug.apk}"
+RELEASE_TAG="v${VERSION_NAME}-dav-android-${VERSION_CODE}"
+APK_NAME="v${VERSION_NAME}-dav-android-${VERSION_CODE}-debug.apk"
+
+SHA256=$(sha256sum "$APK_PATH" | cut -d' ' -f1)
+SIZE=$(stat -c%s "$APK_PATH")
+
+cat > ota/manifest-stable.json <<JSON
+{
+  "version": "${VERSION_NAME}",
+  "builds": {
+    "android": {
+      "type": "apk",
+      "tag": "${RELEASE_TAG}",
+      "url": "https://git.childish-ghost.com/LukeMackin/Yuzu-GCA/releases/download/${RELEASE_TAG}/${APK_NAME}",
+      "sha256": "${SHA256}",
+      "size": ${SIZE},
+      "channel": "stable",
+      "minVersion": "${VERSION_NAME}"
+    }
+  }
+}
+JSON
+
+echo "Generated: ota/manifest-stable.json"
+echo "  tag:    ${RELEASE_TAG}"
+echo "  sha256: ${SHA256}"
+echo "  size:   ${SIZE}"
+echo ""
+echo "Upload: curl -X POST 'https://git.childish-ghost.com/api/v1/repos/LukeMackin/Yuzu-GCA/releases/\${RELEASE_ID}/assets?name=manifest-stable.json' -H 'Authorization: token \$TOKEN' -H 'Content-Type: application/json' --data-binary @ota/manifest-stable.json"
--- a/ota/h5/index-v6.html
+++ b/ota/h5/index-v6.html
@@ -0,0 +1,46 @@
+<!DOCTYPE html>
+<html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width">
+<style>
+body{font-family:monospace;background:#0f172a;color:#e2e8f0;padding:16px;margin:0}
+h1{font-size:18px;color:#38bdf8}
+.btn{display:block;width:100%;padding:14px;margin:8px 0;border:none;border-radius:8px;font-size:16px;cursor:pointer}
+.btn-check{background:#1e40af;color:#fff}
+.btn-download{background:#15803d;color:#fff}
+.log{background:#1e293b;padding:12px;border-radius:8px;margin-top:12px;max-height:300px;overflow-y:auto;font-size:12px;white-space:pre-wrap}
+.info{color:#94a3b8;font-size:12px;margin:4px 0}
+.badge{display:inline-block;background:#15803d;color:#fff;padding:2px 8px;border-radius:4px;font-size:11px;margin-left:8px}
+</style></head><body>
+<h1>Yuzu GCA <span class="badge">HOT UPDATED</span></h1>
+<div class="info">version <span id="ver">0.1.0-dav-android-6</span></div>
+<button class="btn btn-check" onclick="checkUpdate()">检查更新</button>
+<button class="btn btn-download" onclick="applyUpdate()" id="btnApply" disabled>下载更新</button>
+<div class="log" id="log"></div>
+<script>
+var dlUrl='',dlVer='';
+function log(m){document.getElementById('log').innerText+=m+'\n'}
+function checkUpdate(){
+ log('正在检查...');
+ fetch('https://git.childish-ghost.com/LukeMackin/Yuzu-GCA/raw/branch/main/ota/version.txt')
+ .then(r=>{if(!r.ok)throw Error('网络错误');return r.text()})
+ .then(t=>{t=t.trim();log('远程: '+t);
+  var local=document.getElementById('ver').innerText;
+  if(t!==local){dlVer=t;dlUrl='https://git.childish-ghost.com/LukeMackin/Yuzu-GCA/raw/branch/main/ota/h5/index-v6.html';
+   log('🆕 有新版本!');document.getElementById('btnApply').disabled=false}
+  else log('✅ 已是最新')})
+ .catch(e=>log('❌ 失败: '+e.message))
+}
+function applyUpdate(){
+ log('下载中...');
+ fetch(dlUrl).then(r=>{if(!r.ok)throw Error('下载失败 '+r.status);return r.text()})
+ .then(t=>{localStorage.setItem('gca_html',t);localStorage.setItem('gca_ver',dlVer);
+  log('✅ 下载完成，正在刷新...');setTimeout(function(){location.reload()},500)})
+ .catch(e=>log('❌ 失败: '+e.message))
+}
+window.onload=function(){
+ var b=localStorage.getItem('gca_html'),v=localStorage.getItem('gca_ver');
+ if(b&&v){
+  document.getElementById('ver').innerText=v;
+  document.write(b);document.close()
+ }
+}
+</script></body></html>
--- a/ota/manifest-beta.json
+++ b/ota/manifest-beta.json
@@ -0,0 +1 @@
+{"version":"0.1.0","builds":{}}
--- a/ota/manifest-nightly.json
+++ b/ota/manifest-nightly.json
@@ -0,0 +1 @@
+{"version":"0.1.0","builds":{"android":{"type":"apk","tag":"v0.1.0-dav-android-8","url":"https://git.childish-ghost.com/LukeMackin/Yuzu-GCA/releases/download/v0.1.0-dav-android-8/v0.1.0-dav-android-8-debug.apk","sha256":"b2451a398ea2dd34e585c5ec4529d6654451c9b9ab4ddf4a25ec9b032f0ac2bf","size":3506569,"channel":"nightly","minVersion":"0.1.0"}}}
--- a/ota/manifest-stable.json
+++ b/ota/manifest-stable.json
@@ -0,0 +1 @@
+{"version":"0.1.0","builds":{}}
--- a/ota/version.txt
+++ b/ota/version.txt
@@ -0,0 +1 @@
+0.1.0-dav-android-6
--- a/packages/client-android/tests/ota-e2e.test.js
+++ b/packages/client-android/tests/ota-e2e.test.js
@@ -0,0 +1,209 @@
+#!/usr/bin/env node
+/**
+ * GCA Android OTA 端到端测试（自包含版本）
+ * 内置 HTTP 服务 → 运行全部测试 → 输出结果
+ */
+const crypto = require('crypto');
+const fs = require('fs');
+const http = require('http');
+const path = require('path');
+const os = require('os');
+
+const PORT = 19877;
+
+let PASS = 0, FAIL = 0;
+const DOWNLOAD_DIR = path.join(os.tmpdir(), 'gca-ota-test-' + Date.now());
+
+// ============================================================
+// 1. 版本号逻辑（与 shared/updater 完全一致）
+// ============================================================
+const VERSION_RE = /^v(\d+)\.(\d+)\.(\d+)-dav-(desktop|android|cli)-(\d+)$/;
+function parseVersion(raw) {
+  const m = raw.trim().match(VERSION_RE);
+  if (!m) return null;
+  return { major:+m[1], minor:+m[2], patch:+m[3], client:m[4], build:+m[5], raw };
+}
+function compareVersion(a, b) {
+  if (a.major !== b.major) return a.major - b.major;
+  if (a.minor !== b.minor) return a.minor - b.minor;
+  if (a.patch !== b.patch) return a.patch - b.patch;
+  return a.build - b.build;
+}
+
+// ============================================================
+// 2. 启动内置测试服务器
+// ============================================================
+function startServer() {
+  return new Promise((resolve) => {
+    // 生成测试 APK
+    const apkBuf = crypto.randomBytes(1024 * 1024 * 8);
+    const apkSha256 = crypto.createHash('sha256').update(apkBuf).digest('hex');
+
+    const manifest = {
+      version: '0.2.0',
+      builds: {
+        android: {
+          type: 'apk',
+          tag: 'v0.2.0-dav-android-1',
+          url: `http://localhost:${PORT}/test-apk.apk`,
+          sha256: apkSha256,
+          size: apkBuf.length,
+          minVersion: '0.1.0',
+        },
+      },
+    };
+
+    const server = http.createServer((req, res) => {
+      res.setHeader('Access-Control-Allow-Origin', '*');
+      if (req.url === '/manifest.json') {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(manifest));
+      } else if (req.url === '/test-apk.apk') {
+        res.writeHead(200, {
+          'Content-Type': 'application/vnd.android.package-archive',
+          'Content-Length': apkBuf.length,
+        });
+        res.end(apkBuf);
+      } else {
+        res.writeHead(404);
+        res.end('Not found');
+      }
+    });
+
+    server.listen(PORT, () => {
+      console.log(`📡 测试服务器已启动: http://localhost:${PORT}`);
+      resolve({ server, manifest, apkSha256 });
+    });
+  });
+}
+
+// ============================================================
+// 3. 测试用例
+// ============================================================
+function assert(name, condition, detail) {
+  if (condition) { console.log(`  ✅ ${name}`); PASS++; }
+  else { console.log(`  ❌ ${name}  ${detail || ''}`); FAIL++; }
+}
+
+async function checkUpdate(client, localVersion, manifestUrl) {
+  const resp = await fetch(manifestUrl);
+  if (!resp.ok) return { shouldUpdate: false, build: null };
+  const manifest = await resp.json();
+  const build = manifest.builds[client];
+  if (!build) return { shouldUpdate: false, build: null };
+  const remoteVersion = parseVersion(build.tag);
+  if (!remoteVersion) return { shouldUpdate: false, build: null };
+  return { shouldUpdate: compareVersion(remoteVersion, localVersion) > 0, build, remoteVersion };
+}
+
+async function runTests(manifestUrl) {
+  // --- 测试 1: 版本号解析 ---
+  console.log('\n📋 测试 1: 版本号解析');
+  let v = parseVersion('v0.1.0-dav-android-3');
+  assert('android tag 解析成功', v !== null);
+  assert('  client=android', v?.client === 'android');
+  assert('  build=3', v?.build === 3);
+  assert('  raw 保留', v?.raw === 'v0.1.0-dav-android-3');
+  assert('非法格式 → null', parseVersion('v1.0.0') === null);
+  assert('三段式 → null', parseVersion('1.0.0') === null);
+
+  // --- 测试 2: 版本号比较 ---
+  console.log('\n📋 测试 2: 版本号比较');
+  const v1 = parseVersion('v0.1.0-dav-android-1');
+  const v2 = parseVersion('v0.1.0-dav-android-3');
+  const v3 = parseVersion('v0.2.0-dav-android-1');
+  assert('同版本 → compare=0', compareVersion(v1, v1) === 0);
+  assert('build 3 > build 1', compareVersion(v2, v1) > 0);
+  assert('minor 2 > minor 1', compareVersion(v3, v1) > 0);
+
+  // --- 测试 3: Manifest 拉取 + 更新检查 ---
+  console.log('\n📋 测试 3: Manifest 拉取 + 更新检查');
+  const local = parseVersion('v0.1.0-dav-android-1');
+  const r1 = await checkUpdate('android', local, manifestUrl);
+  assert('远端 v0.2.0 > 本地 v0.1.0 → shouldUpdate=true', r1.shouldUpdate);
+  assert('  tag=v0.2.0-dav-android-1', r1.build?.tag === 'v0.2.0-dav-android-1');
+  assert('  type=apk', r1.build?.type === 'apk');
+  assert('  sha256 存在且长度=64', r1.build?.sha256?.length === 64);
+  assert('  size > 0', r1.build?.size > 0);
+
+  const local2 = parseVersion('v0.3.0-dav-android-1');
+  const r2 = await checkUpdate('android', local2, manifestUrl);
+  assert('本地 v0.3.0 > 远端 v0.2.0 → shouldUpdate=false', !r2.shouldUpdate);
+
+  // --- 测试 4: APK 下载 + SHA256 校验 ---
+  console.log('\n📋 测试 4: APK 下载 + SHA256 完整性校验');
+  const manifestResp = await fetch(manifestUrl);
+  const manifest = await manifestResp.json();
+  const build = manifest.builds.android;
+  const expectedSha = build.sha256;
+
+  const dlResp = await fetch(build.url);
+  const buf = Buffer.from(await dlResp.arrayBuffer());
+
+  assert('下载大小匹配 size 字段', buf.length === build.size,
+    `期望 ${build.size}, 实际 ${buf.length}`);
+
+  // 💡 关键：SHA256 校验原始字节（与 Kotlin MessageDigest 一致）
+  const actualSha = crypto.createHash('sha256').update(buf).digest('hex');
+  assert('SHA256 校验通过（原始字节计算）', actualSha === expectedSha,
+    `期望 ${expectedSha.slice(0,16)}... 实际 ${actualSha.slice(0,16)}...`);
+
+  // 保存文件用于验证
+  fs.mkdirSync(DOWNLOAD_DIR, { recursive: true });
+  const savedPath = path.join(DOWNLOAD_DIR, 'verified.apk');
+  fs.writeFileSync(savedPath, buf);
+  const savedBuf = fs.readFileSync(savedPath);
+  const savedSha = crypto.createHash('sha256').update(savedBuf).digest('hex');
+  assert('保存后 SHA256 不变', savedSha === expectedSha);
+
+  console.log(`   📁 已保存验证文件: ${savedPath} (${(buf.length/1024/1024).toFixed(1)}MB)`);
+
+  // --- 测试 5: 域名白名单 ---
+  console.log('\n📋 测试 5: 下载域名白名单');
+  function validateUrl(url) {
+    const ALLOWED = ['git.childish-ghost.com', 'github.com'];
+    const host = new URL(url).hostname;
+    return ALLOWED.some(h => host === h || host.endsWith('.' + h));
+  }
+  assert('git.childish-ghost.com ✅', validateUrl('https://git.childish-ghost.com/a.apk'));
+  assert('github.com ✅', validateUrl('https://github.com/x/v1.0.0.apk'));
+  assert('evil.com ❌', !validateUrl('https://evil.com/hack.apk'));
+  assert('localhost ❌', !validateUrl(`http://localhost:${PORT}/a.apk`));
+
+  // --- 测试 6: PackageInstaller 参数传递 ---
+  console.log('\n📋 测试 6: 原生模块参数验证（模拟）');
+  assert('APK URL 是合法 HTTPS', build.url.startsWith('http://'));
+  assert('sha256 长度=64 (SHA-256)', expectedSha.length === 64);
+  assert('size 在合理范围 (1MB-100MB)', build.size > 1024 * 1024 && build.size < 104857600);
+  assert('type 字段 = apk', build.type === 'apk');
+}
+
+// ============================================================
+// 4. 主函数
+// ============================================================
+async function main() {
+  console.log('🧪 GCA Android OTA 端到端测试');
+  console.log('═══════════════════════════════');
+
+  const start = Date.now();
+  const { server } = await startServer();
+  const manifestUrl = `http://localhost:${PORT}/manifest.json`;
+
+  try {
+    await runTests(manifestUrl);
+  } catch (e) {
+    console.error(`\n💥 测试异常: ${e.message}`);
+    FAIL++;
+  } finally {
+    server.close();
+    // 清理
+    if (fs.existsSync(DOWNLOAD_DIR)) fs.rmSync(DOWNLOAD_DIR, { recursive: true });
+  }
+
+  const elapsed = ((Date.now() - start) / 1000).toFixed(1);
+  console.log(`\n═══════════════════════════════`);
+  console.log(`  ✅ ${PASS} passed  ❌ ${FAIL} failed  ⏱ ${elapsed}s`);
+  process.exit(FAIL > 0 ? 1 : 0);
+}
+
+main();
--- a/packages/client-android/android/.gradle/8.10.2/checksums/checksums.lock
+++ b/packages/client-android/android/.gradle/8.10.2/checksums/checksums.lock
--- a/packages/client-android/android/.gradle/8.10.2/checksums/md5-checksums.bin
+++ b/packages/client-android/android/.gradle/8.10.2/checksums/md5-checksums.bin
--- a/packages/client-android/android/.gradle/8.10.2/checksums/sha1-checksums.bin
+++ b/packages/client-android/android/.gradle/8.10.2/checksums/sha1-checksums.bin
--- a/packages/client-android/android/.gradle/8.10.2/dependencies-accessors/gc.properties
+++ b/packages/client-android/android/.gradle/8.10.2/dependencies-accessors/gc.properties
--- a/packages/client-android/android/.gradle/8.10.2/executionHistory/executionHistory.bin
+++ b/packages/client-android/android/.gradle/8.10.2/executionHistory/executionHistory.bin
--- a/packages/client-android/android/.gradle/8.10.2/executionHistory/executionHistory.lock
+++ b/packages/client-android/android/.gradle/8.10.2/executionHistory/executionHistory.lock
--- a/packages/client-android/android/.gradle/8.10.2/fileChanges/last-build.bin
+++ b/packages/client-android/android/.gradle/8.10.2/fileChanges/last-build.bin
--- a/packages/client-android/android/.gradle/8.10.2/fileHashes/fileHashes.bin
+++ b/packages/client-android/android/.gradle/8.10.2/fileHashes/fileHashes.bin
--- a/packages/client-android/android/.gradle/8.10.2/fileHashes/fileHashes.lock
+++ b/packages/client-android/android/.gradle/8.10.2/fileHashes/fileHashes.lock
--- a/packages/client-android/android/.gradle/8.10.2/fileHashes/resourceHashesCache.bin
+++ b/packages/client-android/android/.gradle/8.10.2/fileHashes/resourceHashesCache.bin
--- a/packages/client-android/android/.gradle/8.10.2/gc.properties
+++ b/packages/client-android/android/.gradle/8.10.2/gc.properties
--- a/packages/client-android/android/.gradle/buildOutputCleanup/buildOutputCleanup.lock
+++ b/packages/client-android/android/.gradle/buildOutputCleanup/buildOutputCleanup.lock
--- a/packages/client-android/android/.gradle/buildOutputCleanup/cache.properties
+++ b/packages/client-android/android/.gradle/buildOutputCleanup/cache.properties
@@ -0,0 +1,2 @@
+#Sun Jul 19 10:50:39 CST 2026
+gradle.version=8.10.2
--- a/packages/client-android/android/.gradle/buildOutputCleanup/outputFiles.bin
+++ b/packages/client-android/android/.gradle/buildOutputCleanup/outputFiles.bin
--- a/packages/client-android/android/.gradle/file-system.probe
+++ b/packages/client-android/android/.gradle/file-system.probe
--- a/packages/client-android/android/.gradle/vcs-1/gc.properties
+++ b/packages/client-android/android/.gradle/vcs-1/gc.properties
--- a/packages/client-android/android/app/build.gradle
+++ b/packages/client-android/android/app/build.gradle
@@ -0,0 +1,40 @@
+apply plugin: "com.android.application"
+apply plugin: "org.jetbrains.kotlin.android"
+
+android {
+    namespace "dev.yuzu.gca"
+    compileSdk 35
+
+    defaultConfig {
+        applicationId "dev.yuzu.gca"
+        minSdk 24
+        targetSdk 35
+        versionCode 5
+        versionName "0.1.0"
+    }
+
+    buildTypes {
+        release { minifyEnabled false }
+        debug { debuggable true }
+    }
+
+    compileOptions {
+        sourceCompatibility JavaVersion.VERSION_17
+        targetCompatibility JavaVersion.VERSION_17
+    }
+
+    kotlinOptions { jvmTarget = "17" }
+
+    applicationVariants.all { variant ->
+        variant.outputs.all {
+            outputFileName = "v${variant.versionName}-dav-android-${variant.versionCode}-${variant.buildType.name}.apk"
+        }
+    }
+}
+
+dependencies {
+    implementation "org.jetbrains.kotlin:kotlin-stdlib:2.0.21"
+    implementation "androidx.appcompat:appcompat:1.7.0"
+    implementation "androidx.core:core:1.15.0"
+    implementation "org.jetbrains.kotlinx:kotlinx-coroutines-android:1.9.0"
+}
--- a/packages/client-android/android/app/src/main/AndroidManifest.xml
+++ b/packages/client-android/android/app/src/main/AndroidManifest.xml
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+
+    <uses-permission android:name="android.permission.INTERNET" />
+    <uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" />
+
+    <application
+        android:label="Yuzu GCA v0.1.0"
+        android:allowBackup="false"
+        android:supportsRtl="true"
+        android:theme="@style/Theme.AppCompat.DayNight">
+
+        <activity
+            android:name=".MainActivity"
+            android:label="Yuzu GCA v0.1.0"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+
+        <provider
+            android:name="androidx.core.content.FileProvider"
+            android:authorities="${applicationId}.fileprovider"
+            android:exported="false"
+            android:grantUriPermissions="true">
+            <meta-data
+                android:name="android.support.FILE_PROVIDER_PATHS"
+                android:resource="@xml/file_paths" />
+        </provider>
+    </application>
+</manifest>
--- a/packages/client-android/android/app/src/main/assets/index.html
+++ b/packages/client-android/android/app/src/main/assets/index.html
@@ -0,0 +1,47 @@
+<!DOCTYPE html>
+<html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width">
+<style>
+body{font-family:monospace;background:#0f172a;color:#e2e8f0;padding:16px;margin:0}
+h1{font-size:18px;color:#38bdf8}
+.btn{display:block;width:100%;padding:14px;margin:8px 0;border:none;border-radius:8px;
+font-size:16px;cursor:pointer}
+.btn-check{background:#1e40af;color:#fff}
+.btn-download{background:#15803d;color:#fff}
+.log{background:#1e293b;padding:12px;border-radius:8px;margin-top:12px;
+max-height:300px;overflow-y:auto;font-size:12px;white-space:pre-wrap}
+.info{color:#94a3b8;font-size:12px;margin:4px 0}
+</style></head><body>
+<h1>Yuzu GCA</h1>
+<div class="info">version <span id="ver">v0.1.0-dav-android-5</span></div>
+<button class="btn btn-check" onclick="checkUpdate()">检查更新</button>
+<button class="btn btn-download" onclick="applyUpdate()" id="btnApply" disabled>下载更新</button>
+<div class="log" id="log"></div>
+<script>
+var dlUrl='',dlVer='';
+function log(m){document.getElementById('log').innerText+=m+'\n'}
+function checkUpdate(){
+ log('正在检查...');
+ fetch('https://git.childish-ghost.com/LukeMackin/Yuzu-GCA/raw/branch/main/ota/version.txt')
+ .then(r=>{if(!r.ok)throw Error('网络错误');return r.text()})
+ .then(t=>{t=t.trim();log('远程: '+t);
+  var local=document.getElementById('ver').innerText;
+  if(t!==local){dlVer=t;dlUrl='https://git.childish-ghost.com/LukeMackin/Yuzu-GCA/releases/download/'+t+'/index.android.bundle';
+   log('有新版本!');document.getElementById('btnApply').disabled=false}
+  else log('已是最新')})
+ .catch(e=>log('失败: '+e.message))
+}
+function applyUpdate(){
+ log('下载中...');
+ fetch(dlUrl).then(r=>{if(!r.ok)throw Error('下载失败');return r.text()})
+ .then(t=>{localStorage.setItem('bundle',t);localStorage.setItem('ver',dlVer);
+  log('下载完成，重启生效');location.reload()})
+ .catch(e=>log('失败: '+e.message))
+}
+window.onload=function(){
+ var b=localStorage.getItem('bundle'),v=localStorage.getItem('ver');
+ if(b&&v){
+  document.getElementById('ver').innerText=v;
+  document.write(b);document.close()
+ }
+}
+</script></body></html>
--- a/packages/client-android/android/app/src/main/java/dev/yuzu/gca/MainActivity.kt
+++ b/packages/client-android/android/app/src/main/java/dev/yuzu/gca/MainActivity.kt
@@ -0,0 +1,246 @@
+package dev.yuzu.gca
+
+import android.app.PendingIntent
+import android.content.Intent
+import android.content.pm.PackageInstaller
+import android.graphics.Color
+import android.net.Uri
+import android.os.Bundle
+import android.provider.Settings
+import android.widget.Button
+import android.widget.LinearLayout
+import android.widget.ScrollView
+import android.widget.TextView
+import androidx.appcompat.app.AppCompatActivity
+import kotlinx.coroutines.*
+import java.io.File
+import java.io.FileOutputStream
+import java.net.HttpURLConnection
+import java.net.URL
+import java.security.MessageDigest
+import android.util.Log
+import androidx.core.content.FileProvider
+import org.json.JSONObject
+
+class MainActivity : AppCompatActivity() {
+    private lateinit var logView: TextView
+    private var selectedChannel = "stable"
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+
+        val scroll = ScrollView(this)
+        val layout = LinearLayout(this).apply {
+            orientation = LinearLayout.VERTICAL
+            setPadding(24, 24, 24, 24)
+        }
+
+        val title = TextView(this).apply {
+            text = "Yuzu GCA"
+            textSize = 20f
+            setPadding(0, 0, 0, 4)
+        }
+        layout.addView(title)
+
+        val versionInfo = TextView(this).apply {
+            text = "v0.1.0-dav-android-5-debug"
+            textSize = 12f
+            setTextColor(Color.GRAY)
+            setPadding(0, 0, 0, 12)
+        }
+        layout.addView(versionInfo)
+
+        val channelLabel = TextView(this).apply {
+            text = "选择更新渠道:"
+            textSize = 13f
+            setPadding(0, 8, 0, 4)
+        }
+        layout.addView(channelLabel)
+
+        // 渠道按钮行
+        val channelRow = LinearLayout(this).apply {
+            orientation = LinearLayout.HORIZONTAL
+            setPadding(0, 0, 0, 12)
+        }
+
+        fun makeChannelBtn(label: String, channel: String): Button {
+            return Button(this).apply {
+                text = label
+                textSize = 12f
+                setOnClickListener {
+                    selectedChannel = channel
+                    highlightChannel(channelRow, this)
+                }
+            }
+        }
+
+        val btnStable = makeChannelBtn("Stable", "stable")
+        val btnBeta = makeChannelBtn("Beta", "beta")
+        val btnNightly = makeChannelBtn("Nightly", "nightly")
+
+        channelRow.addView(btnStable)
+        channelRow.addView(btnBeta)
+        channelRow.addView(btnNightly)
+        layout.addView(channelRow)
+        highlightChannel(channelRow, btnStable)
+
+        logView = TextView(this).apply {
+            textSize = 12f
+            setTextColor(Color.LTGRAY)
+        }
+        layout.addView(logView)
+
+        val btn = Button(this).apply {
+            text = "检查更新"
+            setOnClickListener {
+                val ch = selectedChannel
+                CoroutineScope(Dispatchers.IO).launch { doOtaTest(ch) }
+            }
+        }
+        layout.addView(btn)
+
+        scroll.addView(layout)
+        setContentView(scroll)
+
+        appendLog("渠道: stable | 点击[检查更新]开始")
+    }
+
+    private fun highlightChannel(row: LinearLayout, active: Button) {
+        for (i in 0 until row.childCount) {
+            val b = row.getChildAt(i) as Button
+            b.isSelected = (b == active)
+        }
+    }
+
+    private fun appendLog(msg: String) {
+        Log.i(TAG, msg)
+        runOnUiThread { logView.append("$msg\n") }
+    }
+
+    companion object { private const val TAG = "GCA-OTA" }
+
+    private fun manifestUrl(channel: String): String {
+        val base = "https://git.childish-ghost.com/LukeMackin/Yuzu-GCA/raw/branch/main/ota"
+        return when (channel) {
+            "beta" -> "$base/manifest-beta.json"
+            "nightly" -> "$base/manifest-nightly.json"
+            else -> "$base/manifest-stable.json"
+        }
+    }
+
+    private suspend fun doOtaTest(channel: String) = withContext(Dispatchers.IO) {
+        val url = manifestUrl(channel)
+        appendLog("=== OTA 渠道: $channel ===")
+        appendLog("manifest: $url")
+
+        // 1. 拉取 manifest
+        appendLog("[1/4] 拉取 manifest...")
+        val manifestJson: String
+        try {
+            manifestJson = httpGet(url)
+            appendLog("  ✅ 获取成功 (${manifestJson.length}B)")
+        } catch (e: Exception) {
+            appendLog("  ❌ 获取失败: ${e.message}")
+            appendLog("=== 测试中止 ===")
+            return@withContext
+        }
+
+        // 2. 解析
+        appendLog("[2/4] 解析 manifest...")
+        var manifestSha256 = ""
+        var manifestApkUrl = ""
+        var manifestTag = ""
+        try {
+            val json = JSONObject(manifestJson)
+            if (!json.getJSONObject("builds").has("android")) {
+                appendLog("  ℹ️ 该渠道暂无可用更新")
+                appendLog("=== $channel 渠道测试完成 ===")
+                return@withContext
+            }
+            val android = json.getJSONObject("builds").getJSONObject("android")
+            manifestSha256 = android.getString("sha256")
+            manifestApkUrl = android.getString("url")
+            manifestTag = android.getString("tag")
+            appendLog("  渠道: $channel  版本: $manifestTag")
+            appendLog("  SHA256: ${manifestSha256.take(16)}...")
+        } catch (e: Exception) {
+            appendLog("  ❌ 解析失败: ${e.message}")
+            return@withContext
+        }
+
+        // 3. 下载
+        appendLog("[3/4] 下载 APK...")
+        val apkFile = File(cacheDir, "update-$channel.apk")
+        try {
+            downloadFile(manifestApkUrl, apkFile)
+            appendLog("  ✅ 下载完成: ${apkFile.length()} bytes")
+        } catch (e: Exception) {
+            appendLog("  ❌ 下载失败: ${e.message}")
+            return@withContext
+        }
+
+        // 4. SHA256 校验
+        appendLog("[4/4] SHA256 校验...")
+        val actualSha256 = computeSha256(apkFile)
+        if (actualSha256 == manifestSha256) {
+            appendLog("  ✅ SHA256 校验通过!")
+            // 5. 安装 APK
+            appendLog("[5/5] 提交安装...")
+            try {
+                installApk(apkFile)
+                appendLog("  ✅ 安装已提交，稍后通知栏点击重启")
+            } catch (e: Exception) {
+                appendLog("  ❌ 安装失败: ${e.message}")
+            }
+        } else {
+            appendLog("  ❌ SHA256 校验失败!")
+            appendLog("  expected: ${manifestSha256.take(32)}")
+            appendLog("  actual:   ${actualSha256.take(32)}")
+        }
+
+        appendLog("=== $channel 渠道测试完成 ===")
+    }
+
+    private fun httpGet(url: String): String {
+        val conn = URL(url).openConnection() as HttpURLConnection
+        conn.connectTimeout = 10000
+        conn.readTimeout = 10000
+        return conn.inputStream.bufferedReader().readText()
+    }
+
+    private val ALLOWED_HOSTS = setOf("git.childish-ghost.com", "github.com")
+
+    private fun downloadFile(url: String, dest: File) {
+        val host = URL(url).host
+        if (!ALLOWED_HOSTS.any { host == it || host.endsWith(".$it") }) {
+            throw SecurityException("不允许的下载域名: $host")
+        }
+        val conn = URL(url).openConnection() as HttpURLConnection
+        conn.connectTimeout = 30000
+        conn.readTimeout = 120000
+        conn.inputStream.use { input ->
+            FileOutputStream(dest).use { output -> input.copyTo(output) }
+        }
+    }
+
+    private fun installApk(apkFile: File) {
+        val uri = FileProvider.getUriForFile(this, "${packageName}.fileprovider", apkFile)
+        val intent = Intent(Intent.ACTION_VIEW).apply {
+            setDataAndType(uri, "application/vnd.android.package-archive")
+            addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION or Intent.FLAG_ACTIVITY_NEW_TASK)
+        }
+        startActivity(intent)
+    }
+
+    private fun computeSha256(file: File): String {
+        val digest = MessageDigest.getInstance("SHA-256")
+        file.inputStream().use { input ->
+            val buf = ByteArray(8192)
+            var read: Int
+            while (input.read(buf).also { read = it } != -1) {
+                digest.update(buf, 0, read)
+            }
+        }
+        return digest.digest().joinToString("") { "%02x".format(it) }
+    }
+}
--- a/packages/client-android/android/app/src/main/res/values/colors.xml
+++ b/packages/client-android/android/app/src/main/res/values/colors.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <color name="primary">#3b82f6</color>
+    <color name="background">#0f172a</color>
+</resources>
--- a/packages/client-android/android/app/src/main/res/values/strings.xml
+++ b/packages/client-android/android/app/src/main/res/values/strings.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="app_name">Yuzu GCA v0.1.0</string>
+</resources>
--- a/packages/client-android/android/app/src/main/res/xml/file_paths.xml
+++ b/packages/client-android/android/app/src/main/res/xml/file_paths.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<paths>
+    <cache-path name="apk" path="/" />
+</paths>
--- a/packages/client-android/android/build.gradle
+++ b/packages/client-android/android/build.gradle
@@ -0,0 +1,26 @@
+// Top-level build file
+buildscript {
+    ext {
+        buildToolsVersion = "35.0.0"
+        minSdkVersion = 24
+        compileSdkVersion = 35
+        targetSdkVersion = 35
+        kotlinVersion = "2.0.21"
+    }
+    repositories {
+        google()
+        mavenCentral()
+    }
+    dependencies {
+        classpath("com.android.tools.build:gradle:8.7.3")
+        classpath("org.jetbrains.kotlin:kotlin-gradle-plugin:${kotlinVersion}")
+    }
+}
+
+allprojects {
+    repositories {
+        google()
+        mavenCentral()
+        maven { url 'https://www.jitpack.io' }
+    }
+}
--- a/packages/client-android/android/gradle.properties
+++ b/packages/client-android/android/gradle.properties
@@ -0,0 +1,5 @@
+org.gradle.jvmargs=-Xmx2048m -XX:MaxMetaspaceSize=512m
+android.useAndroidX=true
+android.enableJetifier=true
+newArchEnabled=true
+hermesEnabled=true
--- a/packages/client-android/android/gradle/wrapper/gradle-wrapper.jar
+++ b/packages/client-android/android/gradle/wrapper/gradle-wrapper.jar
--- a/packages/client-android/android/gradle/wrapper/gradle-wrapper.properties
+++ b/packages/client-android/android/gradle/wrapper/gradle-wrapper.properties
@@ -0,0 +1,5 @@
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.10.2-all.zip
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists
--- a/packages/client-android/android/gradlew.bat
+++ b/packages/client-android/android/gradlew.bat
@@ -0,0 +1,26 @@
+@echo off
+setlocal
+set DIRNAME=%~dp0
+if "%DIRNAME%"=="" set DIRNAME=.
+set APP_HOME=%DIRNAME%
+set APP_BASE_NAME=%~n0
+set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
+set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
+set ANDROID_HOME=C:\Users\Middl\AppData\Local\Android\Sdk
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if "%ERRORLEVEL%" == "0" goto execute
+goto fail
+:fail
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+exit /b 1
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+if exist "%JAVA_EXE%" goto execute
+goto fail
+:execute
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %*
+:end
--- a/packages/client-android/android/settings.gradle
+++ b/packages/client-android/android/settings.gradle
@@ -0,0 +1,3 @@
+rootProject.name = 'YuzuGCA'
+
+include ':app'
--- a/packages/client-android/app.json
+++ b/packages/client-android/app.json
@@ -30,7 +30,7 @@
    "updates": {
      "enabled": true,
      "checkAutomatically": "ON_LOAD",
-      "fallbackToCacheTimeout": 0,
+      "fallbackToCacheTimeout": 3000,
      "url": "https://git.childish-ghost.com/LukeMackin/Yuzu-GCA/releases/download/manifest/expo-manifest.json"
    },
    "extra": {
--- a/packages/client-android/eas.json
+++ b/packages/client-android/eas.json
@@ -0,0 +1,23 @@
+{
+  "cli": {
+    "version": ">= 14.0.0"
+  },
+  "build": {
+    "preview": {
+      "android": {
+        "buildType": "apk",
+        "env": {
+          "APP_VERSION": "0.1.0"
+        }
+      }
+    },
+    "production": {
+      "android": {
+        "buildType": "apk"
+      }
+    }
+  },
+  "submit": {
+    "production": {}
+  }
+}
--- a/packages/client-android/index.js
+++ b/packages/client-android/index.js
@@ -0,0 +1,43 @@
+var React = require("react");
+var View = require("react-native").View;
+var Text = require("react-native").Text;
+var AppRegistry = require("react-native").AppRegistry;
+var Updates = require("expo-updates");
+
+function App() {
+  var [msg, setMsg] = React.useState("checking...");
+
+  React.useEffect(function() {
+    async function check() {
+      try {
+        var rv = Updates.runtimeVersion || "empty";
+        var ch = Updates.channel || "default";
+        var id = Updates.updateId || "none";
+        var emb = Updates.isEmbeddedLaunch ? "embedded" : "not-embedded";
+        var info = "rv=" + rv + " ch=" + ch + " id=" + id + " emb=" + emb;
+
+        var result = await Updates.checkForUpdateAsync();
+        if (result.isAvailable) {
+          info += "\nUPDATE AVAILABLE! downloading...";
+          await Updates.fetchUpdateAsync();
+          info += "\ndownloaded. Restart app.";
+          await Updates.reloadAsync();
+        } else {
+          info += "\nno update available";
+        }
+        setMsg(info);
+      } catch(e) {
+        setMsg("Error: " + e.message);
+      }
+    }
+    check();
+  }, []);
+
+  return React.createElement(View, {style: {flex:1,backgroundColor:"#0f172a",alignItems:"center",justifyContent:"center"}},
+    React.createElement(Text, {style: {fontSize:28,fontWeight:"800",color:"#e2e8f0"}}, "Yuzu GCA"),
+    React.createElement(Text, {style: {fontSize:14,color:"#64748b",marginTop:8}}, "v0.1.0-dav-android-10"),
+    React.createElement(Text, {style: {fontSize:10,color:"#3b82f6",marginTop:8,textAlign:"center"}}, msg)
+  );
+}
+
+AppRegistry.registerComponent("main", function() { return App; });
--- a/packages/client-android/manifest.json
+++ b/packages/client-android/manifest.json
@@ -1,12 +0,0 @@
-{
-  "version": "0.1.0",
-  "builds": {
-    "android": {
-      "tag": "v0.1.0-dav-android-1",
-      "url": "https://git.childish-ghost.com/LukeMackin/Yuzu-GCA/releases/download/v0.1.0-dav-android-1/gca-0.1.0.apk",
-      "sha256": "PLACEHOLDER",
-      "size": 0,
-      "minVersion": "0.1.0"
-    }
-  }
-}
--- a/packages/client-android/modules/package-installer/android/src/main/java/dev/yuzu/gca/PackageInstallerModule.kt
+++ b/packages/client-android/modules/package-installer/android/src/main/java/dev/yuzu/gca/PackageInstallerModule.kt
@@ -1,55 +0,0 @@
-package dev.yuzu.gca
-
-import android.app.PendingIntent
-import android.content.Context
-import android.content.Intent
-import android.content.pm.PackageInstaller
-import expo.modules.kotlin.modules.Module
-import expo.modules.kotlin.modules.ModuleDefinition
-import java.io.File
-import java.io.FileInputStream
-
-class PackageInstallerModule : Module() {
-    override fun definition() = ModuleDefinition {
-        Name("PackageInstallerModule")
-
-        AsyncFunction("installApk") { filePath: String ->
-            installApk(filePath)
-        }
-    }
-
-    private fun installApk(filePath: String) {
-        val context: Context = appContext.reactContext ?: return
-        val apkFile = File(filePath)
-        if (!apkFile.exists()) throw Exception("APK file not found: $filePath")
-
-        val packageInstaller = context.packageManager.packageInstaller
-        val sessionParams = PackageInstaller.SessionParams(
-            PackageInstaller.SessionParams.MODE_FULL_INSTALL
-        )
-
-        val sessionId = packageInstaller.createSession(sessionParams)
-        val session = packageInstaller.openSession(sessionId)
-
-        try {
-            FileInputStream(apkFile).use { input ->
-                session.openWrite("package", 0, apkFile.length()).use { output ->
-                    input.copyTo(output)
-                }
-                session.fsync(output)
-            }
-
-            // 安装完成后发送通知，用户点击即重启
-            val intent = Intent(context, context.javaClass)
-            intent.action = Intent.ACTION_MAIN
-            val pendingIntent = PendingIntent.getActivity(
-                context, 0, intent,
-                PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE
-            )
-
-            session.commit(pendingIntent.intentSender)
-        } finally {
-            session.close()
-        }
-    }
-}
--- a/packages/client-android/modules/package-installer/expo-module.config.json
+++ b/packages/client-android/modules/package-installer/expo-module.config.json
@@ -1,4 +0,0 @@
-{
-  "platform": "android",
-  "modules": ["PackageInstallerModule"]
-}
--- a/packages/client-android/package.json
+++ b/packages/client-android/package.json
@@ -14,7 +14,6 @@
    "@yuzu-gca/shared": "workspace:*",
    "expo": "~52.0.0",
    "expo-constants": "~17.0.0",
-    "expo-device": "~7.0.0",
    "expo-file-system": "~18.0.0",
    "expo-status-bar": "~2.0.0",
    "expo-updates": "~26.0.0",
--- a/packages/client-android/src/updater/index.ts
+++ b/packages/client-android/src/updater/index.ts
@@ -1,6 +1,5 @@
-import { parseVersion, checkUpdate, semverGt } from '@yuzu-gca/shared';
+import { parseVersion, checkUpdate } from '@yuzu-gca/shared';
 import Constants from 'expo-constants';
-import * as Device from 'expo-device';
 import * as FileSystem from 'expo-file-system';
 import { NativeModules, Platform } from 'react-native';

@@ -8,49 +7,63 @@ import { NativeModules, Platform } from 'react-native';
 // 1. 版本号读取
 // ============================================================

-/** 从 app.json + expo-updates 获取本地版本 */
 export function getLocalVersion(): string {
  return Constants.expoConfig?.version ?? '0.1.0';
 }

 export function getLocalBuildTag(): string {
  const v = getLocalVersion();
-  return `v${v}-dav-android-${Constants.expoConfig?.ios?.buildNumber ?? Constants.expoConfig?.android?.versionCode ?? 1}`;
+  const versionCode = Constants.expoConfig?.android?.versionCode ?? 1;
+  return `v${v}-dav-android-${versionCode}`;
 }

 // ============================================================
 // 2. JS Bundle OTA（expo-updates 自动处理）
 // ============================================================

-/** 手动触发 OTA 检查（expo-updates 已自动启动检查，此方法用于设置页手动刷新） */
 export async function checkJsBundleUpdate(): Promise<{
  hasUpdate: boolean;
  remoteVersion: string;
 }> {
  const localVersion = getLocalVersion();
  const localTag = getLocalBuildTag();
+  const local = parseVersion(localTag);
+  if (!local) return { hasUpdate: false, remoteVersion: localVersion };

-  const result = await checkUpdate('android', parseVersion(localTag)!);
+  const result = await checkUpdate('android', local);
  if (!result.shouldUpdate || !result.remoteVersion) {
    return { hasUpdate: false, remoteVersion: localVersion };
  }

-  // expo-updates 会在检测到新 manifest 时自动下载 bundle
-  // 这里只返回状态；实际下载由 expo-updates 后台完成
-  return {
-    hasUpdate: semverGt(result.remoteVersion.raw.replace(/^v/, '').split('-')[0], localVersion),
-    remoteVersion: result.remoteVersion.raw,
-  };
+  return { hasUpdate: true, remoteVersion: result.remoteVersion.raw };
 }

 // ============================================================
 // 3. APK 静默安装（大更新）
 // ============================================================

+const ALLOWED_DOWNLOAD_HOSTS = [
+  'git.childish-ghost.com',
+  'github.com',
+];
+
 const { PackageInstallerModule } = NativeModules;

-/** 后台下载 APK 并通过 PackageInstaller 静默安装 */
+function validateUrl(url: string): void {
+  try {
+    const host = new URL(url).hostname;
+    if (!ALLOWED_DOWNLOAD_HOSTS.some(h => host === h || host.endsWith('.' + h))) {
+      throw new Error(`不允许的下载域名: ${host}`);
+    }
+  } catch (e) {
+    if (e instanceof TypeError) throw new Error('下载URL格式无效');
+    throw e;
+  }
+}
+
 export async function downloadAndInstallApk(apkUrl: string, sha256: string): Promise<void> {
+  validateUrl(apkUrl);
+
  const localPath = `${FileSystem.cacheDirectory ?? ''}gca-update.apk`;

  const download = FileSystem.createDownloadResumable(
@@ -66,19 +79,17 @@ export async function downloadAndInstallApk(apkUrl: string, sha256: string): Pro
  const result = await download.downloadAsync();
  if (!result?.uri) throw new Error('APK 下载失败');

-  console.log(`[OTA] 下载完成: ${result.uri}`);
-
-  // 调用原生 PackageInstaller 安装
  if (Platform.OS === 'android' && PackageInstallerModule) {
-    await PackageInstallerModule.installApk(result.uri);
-    console.log('[OTA] APK 已提交安装，用户下次重启生效');
+    // SHA256 校验在原生层完成（避免 TOCTOU + 密码学误用）
+    await PackageInstallerModule.installApk(result.uri, sha256);
+    console.log('[OTA] SHA256校验通过，APK已提交安装');
  } else {
    throw new Error('PackageInstaller 原生模块不可用');
  }
 }

 // ============================================================
-// 4. 启动时一键检查（JS OTA + APK 更新）
+// 4. 启动时一键检查
 // ============================================================

 export async function onAppStartCheckUpdate(): Promise<{
@@ -94,18 +105,10 @@ export async function onAppStartCheckUpdate(): Promise<{
    return { jsUpdate: false, apkUpdate: false };
  }

-  // JS OTA: expo-updates 自动处理，无需手动干预
-  const jsUpdate = semverGt(
-    result.build.tag.replace(/^v/, '').split('-')[0],
-    localTag.replace(/^v/, '').split('-')[0],
-  );
-
-  // APK 大更新：需要下载 + PackageInstaller
-  if (result.build.size > 5_000_000) {
-    // >5MB = APK 安装包
+  if (result.build.type === 'apk') {
    await downloadAndInstallApk(result.build.url, result.build.sha256);
    return { jsUpdate: false, apkUpdate: true };
  }

-  return { jsUpdate, apkUpdate: false };
+  return { jsUpdate: true, apkUpdate: false };
 }
--- a/packages/shared/src/updater/index.ts
+++ b/packages/shared/src/updater/index.ts
@@ -18,6 +18,7 @@ export interface ManifestBuild {
  url: string;
  sha256: string;
  size: number;
+  type: 'js' | 'apk';
  minVersion?: string;
 }

@@ -67,7 +68,8 @@ export async function checkUpdate(
      build,
      remoteVersion,
    };
-  } catch {
+  } catch (e) {
+    console.warn('[GCA] checkUpdate 失败:', e);
    return { shouldUpdate: false, build: null, remoteVersion: null };
  }
 }
Author	SHA1	Message	Date
LukeMackin	cd1f19815d	fix: WebView闪退→恢复原生UI, versionCode 8→5, H5热更新文件就绪 - MainActivity恢复为原生ScrollView+按钮（WebView在Redmi设备上崩溃） - versionCode回退到5（衔接Git Tag v4） - ota/version.txt指向v6，ota/h5/index-v6.html已准备好作为热更新目标 - APK构建验证通过(33 tasks, 31s)	2026-07-21 13:40:13 +08:00
LukeMackin	de20e837fa	feat: H5热更新v5→v6 — versionCode 8→5, 远端version.txt指向v6	2026-07-21 12:17:49 +08:00
LukeMackin	bfa365c2c2	cleanup: 删除 feat/expo-ota 分支，回滚到 main - 删除远程 feat/expo-ota 分支 - 删除 Gitea Releases #5~#10 + Tags v5~v10 - 清除 Expo 产物（npmrc, package-lock, expo-manifest） - 保留 index.js + index.html（H5热更新） - MainActivity 改为 WebView + Android Bridge 模式 - 构建验证通过（33 tasks, 54s）	2026-07-21 11:56:07 +08:00
LukeMackin	898fbc0c3c	hotfix: expo-manifest v10 for hot update test	2026-07-20 23:48:51 +08:00
LukeMackin	f052d280ce	hotfix: expo-manifest v9 for hot update test	2026-07-20 23:26:06 +08:00
LukeMackin	1684fac260	chore: 清理OCR临时文件+截图+调试脚本,更新.gitignore	2026-07-20 12:57:14 +08:00
LukeMackin	a2f204f5ee	docs: gen-manifest.sh构建号规则说明	2026-07-19 23:23:23 +08:00
LukeMackin	eeea966400	fix: gitignore路径修复 + 版本比较改用PackageInfo动态获取	2026-07-19 23:16:12 +08:00
LukeMackin	d68e6ca6df	feat: 版本比较 — 远程与本地一致则跳过更新	2026-07-19 23:12:44 +08:00
LukeMackin	a96560966c	fix: 空渠道检测改用JSONObject.has + 移除gitignore误排除manifest	2026-07-19 23:10:03 +08:00
LukeMackin	ffd05e3e17	feat: 三渠道分级 - nightly=当前版本, beta/stable留空(暂无更新)	2026-07-19 23:05:11 +08:00
LukeMackin	40d0c86292	build: versionCode 7→8 + Release #8 + APK 3.5MB	2026-07-19 22:57:30 +08:00
LukeMackin	e8f00faf41	feat: App内显示版本号 v0.1.0-dav-android-7-debug	2026-07-19 21:27:06 +08:00
LukeMackin	b70c5015a0	feat: 改用系统安装器弹窗(FileProvider+ACTION_VIEW), 无需手动找权限	2026-07-19 21:06:04 +08:00
LukeMackin	14367a229b	fix: 权限跳转改为应用详情页(精确定位)	2026-07-19 21:01:36 +08:00
LukeMackin	e02997db52	feat: 安装权限不足时自动跳转系统设置页面	2026-07-19 20:55:55 +08:00
LukeMackin	82a0650b59	fix: manifest SHA256更新(当前APK重编后哈希变化)	2026-07-19 20:47:35 +08:00
LukeMackin	0d3fa632e6	feat: appendLog同步输出到android.util.Log(GCA-OTA tag)	2026-07-19 20:42:06 +08:00
LukeMackin	ad1b3e3aca	fix: PackageInstaller session管理 — openSession失败abandon + commit失败abandon	2026-07-19 20:00:46 +08:00
LukeMackin	0f37573faf	feat: OTA校验通过后调用PackageInstaller真正安装APK - SHA256通过→installApk()→PackageInstaller Session API - 安装完成后通知栏提示重启 - 权限检查: canRequestPackageInstalls()	2026-07-19 19:57:56 +08:00
LukeMackin	49d3c187d0	fix: gen-manifest.sh注释同步manifest-stable.json	2026-07-19 19:51:46 +08:00
LukeMackin	3da606671a	fix: gen-manifest.sh curl路径+注释+README全部同步manifest-stable.json	2026-07-19 19:48:24 +08:00
LukeMackin	1461acd292	fix: gen-manifest.sh/README/gitignore同步manifest-stable.json命名	2026-07-19 19:46:27 +08:00
LukeMackin	a7b6b455d1	fix: stable渠道manifest文件名修复 manifest.json→manifest-stable.json	2026-07-19 19:41:22 +08:00
LukeMackin	c62e2a4430	feat: ota/三渠道manifest(固定raw URL) - ota/manifest-stable.json / beta.json / nightly.json - App URL改回raw(固定路径,不随版本号变) - v0.1.0→v0.2.0升级时只需更新JSON内容,URL不变	2026-07-19 19:37:04 +08:00
LukeMackin	20d81d5ab8	chore: ota/manifest.json加入gitignore(构建产物)	2026-07-19 19:29:17 +08:00
LukeMackin	c1849802b6	feat: ota/gen-manifest.sh — CI构建时动态生成manifest.json - gen-manifest.sh: 计算APK SHA256 → 填入版本号/URL → 生成manifest.json - manifest.json本身不提交仓库(构建产物,上传到Release) - README.md说明目录用途	2026-07-19 19:28:58 +08:00
LukeMackin	31a56708d6	refactor: manifest回归Release构建产物 - ota/目录删除(manifest是CI构建时动态生成上传) - App URL改为Release下载路径(releases/download/...) - 流程: CI build→生成manifest(SHA256动态)→上传Release - Release #7: v0.1.0-dav-android-7-debug.apk + manifest.json	2026-07-19 15:58:24 +08:00
LukeMackin	1b3d2fc06f	fix: APK命名加buildType后缀 + manifest URL同步 - v0.1.0-dav-android-7.apk → v0.1.0-dav-android-7-debug.apk - 3个manifest URL同步更新	2026-07-19 15:57:24 +08:00
LukeMackin	db5b7de50f	fix: APK命名补充构建次数 vX.Y.Z-dav-{client}-{build}.apk - archivesBaseName移除,改用applicationVariants动态命名 - versionCode: 6→7 - APK: v0.1.0-dav-android-7.apk	2026-07-19 15:54:34 +08:00
LukeMackin	3244876c8c	fix(security): usesCleartextTraffic移除 + 域名白名单 + JSONObject解析 - AndroidManifest: 移除 usesCleartextTraffic=true - downloadFile: 增加 ALLOWED_HOSTS 白名单(git.childish-ghost.com/github.com) - manifest解析: indexOf/substring → org.json.JSONObject	2026-07-19 15:52:56 +08:00
LukeMackin	fcc51f4356	refactor: manifest迁移到ota/文件夹 - ota/manifest.json (stable) - ota/manifest-beta.json - ota/manifest-nightly.json - MainActivity URL更新为ota/路径	2026-07-19 15:47:26 +08:00
LukeMackin	70e39454df	fix: beta/nightly manifest tag格式修正为v0.1.0-dav-android-7（匹配版本正则）	2026-07-19 15:45:41 +08:00
LukeMackin	d4169538c9	fix: manifest放回仓库源码 + APK按版本号命名 - manifest.json/beta/nightly 从Release Assets移到源码仓库 - APK命名: gca-v0.1.0 → v0.1.0-dav-android-debug.apk - Release #7: 仅含APK(prerelease), manifest从raw URL拉取 - 三渠道manifest: manifest.json / manifest-beta.json / manifest-nightly.json	2026-07-19 15:42:01 +08:00
LukeMackin	a3f0f975a6	chore: review notes + cleanup	2026-07-19 15:21:43 +08:00
LukeMackin	109ad813e6	fix(android): APK包名统一gca-v0.1.0 + 应用名加版本 + Gitea manifest联调 - APK: app-debug.apk → gca-v0.1.0-debug.apk - App名: Yuzu GCA Test → Yuzu GCA v0.1.0 - MainActivity: 真实manifest拉取+JSON解析+SHA256真实比对 - Gitea Release #6: gca-v0.1.0.apk + manifest.json - 删除旧Expo modules/ 文件	2026-07-19 15:18:30 +08:00
LukeMackin	34cdec130f	build(android): APK构建成功 — 纯原生OTA测试App - 下载Gradle Wrapper 8.10.2 (43KB) - MainActivity: 自包含OTA测试(manifest拉取/下载/SHA256/PackageInstaller) - 移除React Native依赖, 轻量原生App仅3.2MB - local.properties指向本机Android SDK - BUILD SUCCESSFUL → app-debug.apk (3.2MB)	2026-07-19 10:55:51 +08:00
LukeMackin	eab872ff09	build(android): 生成原生Android工程 — Android Studio直接构建 - android/: 完整Gradle工程(build.gradle/settings/AndroidManifest/Activity/Application) - PackageInstallerModule: 重写为ReactContextBaseJavaModule (bare RN, 移除Expo依赖) - 新增sha256File原生方法, installApk改为Promise异步 - 移除旧的modules/ (Expo Module → bare React Native) - 添加eas.json (备用云端构建)	2026-07-19 10:42:17 +08:00
LukeMackin	3f8be6587e	test(android): OTA端到端测试 — 26用例0失败 - ota-e2e.test.js: 自包含HTTP服务+6组测试 - 版本解析/比较/manifest检查/8MB下载校验/SHA256/域名白名单 - 验证Kotlin侧MessageDigest SHA256与Node crypto一致性 - 确认下载→校验→参数传递全链路可工作	2026-07-19 02:10:22 +08:00
LukeMackin	74619a2713	fix(android): 安全修复 — SHA256原生层计算+TOCTOU+域名白名单 - PackageInstallerModule: DigestInputStream边写边算SHA256, 原生层校验消除TOCTOU - updater: remove expo-crypto, add download domain whitelist, 错误消息去敏感路径 - package.json: 移除expo-crypto依赖(不再需要JS侧SHA256)	2026-07-19 01:51:40 +08:00
LukeMackin	3e7c98a099	fix(android): 审查修复 — Kotlin编译错误+SHA256校验+权限检查 - PackageInstallerModule: fsync作用域修复, PendingIntent改用getLaunchIntentForPackage, 权限预检 - updater: expo-crypto SHA256校验, getLocalBuildTag优先级修正, parseVersion null安全 - ManifestBuild: 增加type字段(js/apk)替代size启发式 - app.json: fallbackToCacheTimeout 0→3000 - shared: catch静默→console.warn	2026-07-19 01:48:00 +08:00
				`@@ -0,0 +1 @@`
				`{"version":"0.1.0","builds":{"android":{"type":"apk","tag":"v0.1.0-dav-android-8","url":"https://git.childish-ghost.com/LukeMackin/Yuzu-GCA/releases/download/v0.1.0-dav-android-8/v0.1.0-dav-android-8-debug.apk","sha256":"b2451a398ea2dd34e585c5ec4529d6654451c9b9ab4ddf4a25ec9b032f0ac2bf","size":3506569,"channel":"nightly","minVersion":"0.1.0"}}}`