fix: pnpm install同步lockfile(expo-updates 0.27.5)

- app.json: expo-updates配置(checkAutomatically ON_LOAD)
- ota/expo-manifest.json: JS bundle热更新manifest
- App.tsx: 启动时自动检查JS+APK双轨更新
- pnpm install后npx expo prebuild生成android/原生工程

.gitignore

@@ -39,9 +39,18 @@ src-tauri/target/
 
 # Android
 android/app/build/
-android/.gradle/
+**/android/.gradle/
 android/build/
 *.hprof
 *.jks
 *.keystore
 local.properties
+screen.png
+
+# Temp/debug files
+*.traineddata
+tessdata_temp/
+*.ps1
+*_temp/
+
+

.reasonix/desktop-topic-auto-title-meta.json

@@ -0,0 +1,8 @@
+{
+  "topic_20260718-152740_2cab7b15ea20700d": {
+    "stage": 3,
+    "userTurns": 3,
+    "basisHash": "942c58e1a7d2413a",
+    "updatedAt": 1784389797592
+  }
+}

.reasonix/desktop-topic-created-at.json

@@ -0,0 +1,3 @@
+{
+  "topic_20260718-152740_2cab7b15ea20700d": 1784388460704
+}

.reasonix/desktop-topic-title-sources.json

@@ -0,0 +1,3 @@
+{
+  "topic_20260718-152740_2cab7b15ea20700d": "auto"
+}

.reasonix/desktop-topic-titles.json

@@ -0,0 +1,3 @@
+{
+  "topic_20260718-152740_2cab7b15ea20700d": "Start pursuing the…"
+}

ota/README.md

@@ -0,0 +1,18 @@
+# OTA 文件夹
+
+此目录存放 manifest 文件。manifest-stable.json 是 CI 构建时动态生成的产物，
+也提交到仓库通过 raw URL 供客户端拉取。
+
+## 文件
+
+- `gen-manifest.sh` — 构建后运行，计算 APK SHA256 并生成 manifest-stable.json
+- `manifest-stable.json` — stable 渠道
+- `manifest-beta.json` — beta 渠道
+- `manifest-nightly.json` — nightly 渠道
+
+## 流程
+
+```
+CI 构建 APK → ./ota/gen-manifest.sh → git push manifest-stable.json
+手机 App → raw URL 拉取 manifest → 比较版本 → 下载 APK → SHA256 校验
+```

ota/expo-manifest.json

@@ -0,0 +1,12 @@
+{
+  "id": "e5ce52a-0000-0000-0000-000000000000",
+  "createdAt": "2026-07-19T15:30:00.000Z",
+  "runtimeVersion": "0.1.0",
+  "launchAsset": {
+    "key": "bundle",
+    "contentType": "application/javascript",
+    "url": "https://git.childish-ghost.com/LukeMackin/Yuzu-GCA/releases/download/v0.1.0-dav-android-8/bundle.js"
+  },
+  "assets": [],
+  "metadata": {}
+}

ota/gen-manifest.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+# OTA manifest 生成脚本
+# 用法: ./ota/gen-manifest.sh <versionName> <versionCode> <apk-path>
+# 构建号规则: 每次生成APK时 versionCode +1, 对应 git tag vX.Y.Z-dav-android-N
+# CI 构建时自动运行, SHA256动态填入, 生成 manifest-stable.json 后上传到 Gitea Release
+
+VERSION_NAME="${1:-0.1.0}"
+VERSION_CODE="${2:-7}"
+APK_PATH="${3:-packages/client-android/android/app/build/outputs/apk/debug/v0.1.0-dav-android-7-debug.apk}"
+RELEASE_TAG="v${VERSION_NAME}-dav-android-${VERSION_CODE}"
+APK_NAME="v${VERSION_NAME}-dav-android-${VERSION_CODE}-debug.apk"
+
+SHA256=$(sha256sum "$APK_PATH" | cut -d' ' -f1)
+SIZE=$(stat -c%s "$APK_PATH")
+
+cat > ota/manifest-stable.json <<JSON
+{
+  "version": "${VERSION_NAME}",
+  "builds": {
+    "android": {
+      "type": "apk",
+      "tag": "${RELEASE_TAG}",
+      "url": "https://git.childish-ghost.com/LukeMackin/Yuzu-GCA/releases/download/${RELEASE_TAG}/${APK_NAME}",
+      "sha256": "${SHA256}",
+      "size": ${SIZE},
+      "channel": "stable",
+      "minVersion": "${VERSION_NAME}"
+    }
+  }
+}
+JSON
+
+echo "Generated: ota/manifest-stable.json"
+echo "  tag:    ${RELEASE_TAG}"
+echo "  sha256: ${SHA256}"
+echo "  size:   ${SIZE}"
+echo ""
+echo "Upload: curl -X POST 'https://git.childish-ghost.com/api/v1/repos/LukeMackin/Yuzu-GCA/releases/\${RELEASE_ID}/assets?name=manifest-stable.json' -H 'Authorization: token \$TOKEN' -H 'Content-Type: application/json' --data-binary @ota/manifest-stable.json"

ota/manifest-beta.json

@@ -0,0 +1 @@
+{"version":"0.1.0","builds":{}}

ota/manifest-nightly.json

@@ -0,0 +1 @@
+{"version":"0.1.0","builds":{"android":{"type":"apk","tag":"v0.1.0-dav-android-8","url":"https://git.childish-ghost.com/LukeMackin/Yuzu-GCA/releases/download/v0.1.0-dav-android-8/v0.1.0-dav-android-8-debug.apk","sha256":"b2451a398ea2dd34e585c5ec4529d6654451c9b9ab4ddf4a25ec9b032f0ac2bf","size":3506569,"channel":"nightly","minVersion":"0.1.0"}}}

ota/manifest-stable.json

@@ -0,0 +1 @@
+{"version":"0.1.0","builds":{}}

packages/client-android/__tests__/ota-e2e.test.js

@@ -0,0 +1,209 @@
+#!/usr/bin/env node
+/**
+ * GCA Android OTA 端到端测试（自包含版本）
+ * 内置 HTTP 服务 → 运行全部测试 → 输出结果
+ */
+const crypto = require('crypto');
+const fs = require('fs');
+const http = require('http');
+const path = require('path');
+const os = require('os');
+
+const PORT = 19877;
+
+let PASS = 0, FAIL = 0;
+const DOWNLOAD_DIR = path.join(os.tmpdir(), 'gca-ota-test-' + Date.now());
+
+// ============================================================
+// 1. 版本号逻辑（与 shared/updater 完全一致）
+// ============================================================
+const VERSION_RE = /^v(\d+)\.(\d+)\.(\d+)-dav-(desktop|android|cli)-(\d+)$/;
+function parseVersion(raw) {
+  const m = raw.trim().match(VERSION_RE);
+  if (!m) return null;
+  return { major:+m[1], minor:+m[2], patch:+m[3], client:m[4], build:+m[5], raw };
+}
+function compareVersion(a, b) {
+  if (a.major !== b.major) return a.major - b.major;
+  if (a.minor !== b.minor) return a.minor - b.minor;
+  if (a.patch !== b.patch) return a.patch - b.patch;
+  return a.build - b.build;
+}
+
+// ============================================================
+// 2. 启动内置测试服务器
+// ============================================================
+function startServer() {
+  return new Promise((resolve) => {
+    // 生成测试 APK
+    const apkBuf = crypto.randomBytes(1024 * 1024 * 8);
+    const apkSha256 = crypto.createHash('sha256').update(apkBuf).digest('hex');
+
+    const manifest = {
+      version: '0.2.0',
+      builds: {
+        android: {
+          type: 'apk',
+          tag: 'v0.2.0-dav-android-1',
+          url: `http://localhost:${PORT}/test-apk.apk`,
+          sha256: apkSha256,
+          size: apkBuf.length,
+          minVersion: '0.1.0',
+        },
+      },
+    };
+
+    const server = http.createServer((req, res) => {
+      res.setHeader('Access-Control-Allow-Origin', '*');
+      if (req.url === '/manifest.json') {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(manifest));
+      } else if (req.url === '/test-apk.apk') {
+        res.writeHead(200, {
+          'Content-Type': 'application/vnd.android.package-archive',
+          'Content-Length': apkBuf.length,
+        });
+        res.end(apkBuf);
+      } else {
+        res.writeHead(404);
+        res.end('Not found');
+      }
+    });
+
+    server.listen(PORT, () => {
+      console.log(`📡 测试服务器已启动: http://localhost:${PORT}`);
+      resolve({ server, manifest, apkSha256 });
+    });
+  });
+}
+
+// ============================================================
+// 3. 测试用例
+// ============================================================
+function assert(name, condition, detail) {
+  if (condition) { console.log(`  ✅ ${name}`); PASS++; }
+  else { console.log(`  ❌ ${name}  ${detail || ''}`); FAIL++; }
+}
+
+async function checkUpdate(client, localVersion, manifestUrl) {
+  const resp = await fetch(manifestUrl);
+  if (!resp.ok) return { shouldUpdate: false, build: null };
+  const manifest = await resp.json();
+  const build = manifest.builds[client];
+  if (!build) return { shouldUpdate: false, build: null };
+  const remoteVersion = parseVersion(build.tag);
+  if (!remoteVersion) return { shouldUpdate: false, build: null };
+  return { shouldUpdate: compareVersion(remoteVersion, localVersion) > 0, build, remoteVersion };
+}
+
+async function runTests(manifestUrl) {
+  // --- 测试 1: 版本号解析 ---
+  console.log('\n📋 测试 1: 版本号解析');
+  let v = parseVersion('v0.1.0-dav-android-3');
+  assert('android tag 解析成功', v !== null);
+  assert('  client=android', v?.client === 'android');
+  assert('  build=3', v?.build === 3);
+  assert('  raw 保留', v?.raw === 'v0.1.0-dav-android-3');
+  assert('非法格式 → null', parseVersion('v1.0.0') === null);
+  assert('三段式 → null', parseVersion('1.0.0') === null);
+
+  // --- 测试 2: 版本号比较 ---
+  console.log('\n📋 测试 2: 版本号比较');
+  const v1 = parseVersion('v0.1.0-dav-android-1');
+  const v2 = parseVersion('v0.1.0-dav-android-3');
+  const v3 = parseVersion('v0.2.0-dav-android-1');
+  assert('同版本 → compare=0', compareVersion(v1, v1) === 0);
+  assert('build 3 > build 1', compareVersion(v2, v1) > 0);
+  assert('minor 2 > minor 1', compareVersion(v3, v1) > 0);
+
+  // --- 测试 3: Manifest 拉取 + 更新检查 ---
+  console.log('\n📋 测试 3: Manifest 拉取 + 更新检查');
+  const local = parseVersion('v0.1.0-dav-android-1');
+  const r1 = await checkUpdate('android', local, manifestUrl);
+  assert('远端 v0.2.0 > 本地 v0.1.0 → shouldUpdate=true', r1.shouldUpdate);
+  assert('  tag=v0.2.0-dav-android-1', r1.build?.tag === 'v0.2.0-dav-android-1');
+  assert('  type=apk', r1.build?.type === 'apk');
+  assert('  sha256 存在且长度=64', r1.build?.sha256?.length === 64);
+  assert('  size > 0', r1.build?.size > 0);
+
+  const local2 = parseVersion('v0.3.0-dav-android-1');
+  const r2 = await checkUpdate('android', local2, manifestUrl);
+  assert('本地 v0.3.0 > 远端 v0.2.0 → shouldUpdate=false', !r2.shouldUpdate);
+
+  // --- 测试 4: APK 下载 + SHA256 校验 ---
+  console.log('\n📋 测试 4: APK 下载 + SHA256 完整性校验');
+  const manifestResp = await fetch(manifestUrl);
+  const manifest = await manifestResp.json();
+  const build = manifest.builds.android;
+  const expectedSha = build.sha256;
+
+  const dlResp = await fetch(build.url);
+  const buf = Buffer.from(await dlResp.arrayBuffer());
+
+  assert('下载大小匹配 size 字段', buf.length === build.size,
+    `期望 ${build.size}, 实际 ${buf.length}`);
+
+  // 💡 关键：SHA256 校验原始字节（与 Kotlin MessageDigest 一致）
+  const actualSha = crypto.createHash('sha256').update(buf).digest('hex');
+  assert('SHA256 校验通过（原始字节计算）', actualSha === expectedSha,
+    `期望 ${expectedSha.slice(0,16)}... 实际 ${actualSha.slice(0,16)}...`);
+
+  // 保存文件用于验证
+  fs.mkdirSync(DOWNLOAD_DIR, { recursive: true });
+  const savedPath = path.join(DOWNLOAD_DIR, 'verified.apk');
+  fs.writeFileSync(savedPath, buf);
+  const savedBuf = fs.readFileSync(savedPath);
+  const savedSha = crypto.createHash('sha256').update(savedBuf).digest('hex');
+  assert('保存后 SHA256 不变', savedSha === expectedSha);
+
+  console.log(`   📁 已保存验证文件: ${savedPath} (${(buf.length/1024/1024).toFixed(1)}MB)`);
+
+  // --- 测试 5: 域名白名单 ---
+  console.log('\n📋 测试 5: 下载域名白名单');
+  function validateUrl(url) {
+    const ALLOWED = ['git.childish-ghost.com', 'github.com'];
+    const host = new URL(url).hostname;
+    return ALLOWED.some(h => host === h || host.endsWith('.' + h));
+  }
+  assert('git.childish-ghost.com ✅', validateUrl('https://git.childish-ghost.com/a.apk'));
+  assert('github.com ✅', validateUrl('https://github.com/x/v1.0.0.apk'));
+  assert('evil.com ❌', !validateUrl('https://evil.com/hack.apk'));
+  assert('localhost ❌', !validateUrl(`http://localhost:${PORT}/a.apk`));
+
+  // --- 测试 6: PackageInstaller 参数传递 ---
+  console.log('\n📋 测试 6: 原生模块参数验证（模拟）');
+  assert('APK URL 是合法 HTTPS', build.url.startsWith('http://'));
+  assert('sha256 长度=64 (SHA-256)', expectedSha.length === 64);
+  assert('size 在合理范围 (1MB-100MB)', build.size > 1024 * 1024 && build.size < 104857600);
+  assert('type 字段 = apk', build.type === 'apk');
+}
+
+// ============================================================
+// 4. 主函数
+// ============================================================
+async function main() {
+  console.log('🧪 GCA Android OTA 端到端测试');
+  console.log('═══════════════════════════════');
+
+  const start = Date.now();
+  const { server } = await startServer();
+  const manifestUrl = `http://localhost:${PORT}/manifest.json`;
+
+  try {
+    await runTests(manifestUrl);
+  } catch (e) {
+    console.error(`\n💥 测试异常: ${e.message}`);
+    FAIL++;
+  } finally {
+    server.close();
+    // 清理
+    if (fs.existsSync(DOWNLOAD_DIR)) fs.rmSync(DOWNLOAD_DIR, { recursive: true });
+  }
+
+  const elapsed = ((Date.now() - start) / 1000).toFixed(1);
+  console.log(`\n═══════════════════════════════`);
+  console.log(`  ✅ ${PASS} passed  ❌ ${FAIL} failed  ⏱ ${elapsed}s`);
+  process.exit(FAIL > 0 ? 1 : 0);
+}
+
+main();

packages/client-android/android/.gitignore

@@ -0,0 +1,16 @@
+# OSX
+#
+.DS_Store
+
+# Android/IntelliJ
+#
+build/
+.idea
+.gradle
+local.properties
+*.iml
+*.hprof
+.cxx/
+
+# Bundle artifacts
+*.jsbundle

packages/client-android/android/.gradle/buildOutputCleanup/cache.properties

@@ -0,0 +1,2 @@
+#Mon Jul 20 13:05:50 CST 2026
+gradle.version=8.10.2

packages/client-android/android/app/build.gradle

@@ -0,0 +1,40 @@
+apply plugin: "com.android.application"
+apply plugin: "org.jetbrains.kotlin.android"
+
+android {
+    namespace "dev.yuzu.gca"
+    compileSdk 35
+
+    defaultConfig {
+        applicationId "dev.yuzu.gca"
+        minSdk 24
+        targetSdk 35
+        versionCode 8
+        versionName "0.1.0"
+    }
+
+    buildTypes {
+        release { minifyEnabled false }
+        debug { debuggable true }
+    }
+
+    compileOptions {
+        sourceCompatibility JavaVersion.VERSION_17
+        targetCompatibility JavaVersion.VERSION_17
+    }
+
+    kotlinOptions { jvmTarget = "17" }
+
+    applicationVariants.all { variant ->
+        variant.outputs.all {
+            outputFileName = "v${variant.versionName}-dav-android-${variant.versionCode}-${variant.buildType.name}.apk"
+        }
+    }
+}
+
+dependencies {
+    implementation "org.jetbrains.kotlin:kotlin-stdlib:2.0.21"
+    implementation "androidx.appcompat:appcompat:1.7.0"
+    implementation "androidx.core:core:1.15.0"
+    implementation "org.jetbrains.kotlinx:kotlinx-coroutines-android:1.9.0"
+}

packages/client-android/android/app/proguard-rules.pro

@@ -0,0 +1,14 @@
+# Add project specific ProGuard rules here.
+# By default, the flags in this file are appended to flags specified
+# in /usr/local/Cellar/android-sdk/24.3.3/tools/proguard/proguard-android.txt
+# You can edit the include path and order by changing the proguardFiles
+# directive in build.gradle.
+#
+# For more details, see
+#   http://developer.android.com/guide/developing/tools/proguard.html
+
+# react-native-reanimated
+-keep class com.swmansion.reanimated.** { *; }
+-keep class com.facebook.react.turbomodule.** { *; }
+
+# Add any project specific keep options here:

packages/client-android/android/app/src/debug/AndroidManifest.xml

@@ -0,0 +1,7 @@
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools">
+
+    <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW"/>
+
+    <application android:usesCleartextTraffic="true" tools:targetApi="28" tools:ignore="GoogleAppIndexingWarning" tools:replace="android:usesCleartextTraffic" />
+</manifest>

packages/client-android/android/app/src/main/AndroidManifest.xml

@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+
+    <uses-permission android:name="android.permission.INTERNET" />
+    <uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" />
+
+    <application
+        android:name=".MainApplication"
+        android:label="Yuzu GCA v0.1.0"
+        android:allowBackup="false"
+        android:supportsRtl="true"
+        android:theme="@style/Theme.AppCompat.DayNight">
+
+        <activity
+            android:name=".MainActivity"
+            android:label="Yuzu GCA v0.1.0"
+            android:launchMode="singleTask"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+
+        <provider
+            android:name="androidx.core.content.FileProvider"
+            android:authorities="${applicationId}.fileprovider"
+            android:exported="false"
+            android:grantUriPermissions="true">
+            <meta-data
+                android:name="android.support.FILE_PROVIDER_PATHS"
+                android:resource="@xml/file_paths" />
+        </provider>
+    </application>
+</manifest>

packages/client-android/android/app/src/main/java/dev/yuzu/gca/MainActivity.kt

@@ -0,0 +1,255 @@
+package dev.yuzu.gca
+
+import android.app.PendingIntent
+import android.content.Intent
+import android.content.pm.PackageInstaller
+import android.graphics.Color
+import android.net.Uri
+import android.os.Bundle
+import android.provider.Settings
+import android.widget.Button
+import android.widget.LinearLayout
+import android.widget.ScrollView
+import android.widget.TextView
+import androidx.appcompat.app.AppCompatActivity
+import kotlinx.coroutines.*
+import java.io.File
+import java.io.FileOutputStream
+import java.net.HttpURLConnection
+import java.net.URL
+import java.security.MessageDigest
+import android.util.Log
+import androidx.core.content.FileProvider
+import org.json.JSONObject
+
+class MainActivity : AppCompatActivity() {
+    private lateinit var logView: TextView
+    private var selectedChannel = "stable"
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+
+        val scroll = ScrollView(this)
+        val layout = LinearLayout(this).apply {
+            orientation = LinearLayout.VERTICAL
+            setPadding(24, 24, 24, 24)
+        }
+
+        val title = TextView(this).apply {
+            text = "Yuzu GCA"
+            textSize = 20f
+            setPadding(0, 0, 0, 4)
+        }
+        layout.addView(title)
+
+        val versionInfo = TextView(this).apply {
+            text = "v0.1.0-dav-android-8-debug"
+            textSize = 12f
+            setTextColor(Color.GRAY)
+            setPadding(0, 0, 0, 12)
+        }
+        layout.addView(versionInfo)
+
+        val channelLabel = TextView(this).apply {
+            text = "选择更新渠道:"
+            textSize = 13f
+            setPadding(0, 8, 0, 4)
+        }
+        layout.addView(channelLabel)
+
+        // 渠道按钮行
+        val channelRow = LinearLayout(this).apply {
+            orientation = LinearLayout.HORIZONTAL
+            setPadding(0, 0, 0, 12)
+        }
+
+        fun makeChannelBtn(label: String, channel: String): Button {
+            return Button(this).apply {
+                text = label
+                textSize = 12f
+                setOnClickListener {
+                    selectedChannel = channel
+                    highlightChannel(channelRow, this)
+                }
+            }
+        }
+
+        val btnStable = makeChannelBtn("Stable", "stable")
+        val btnBeta = makeChannelBtn("Beta", "beta")
+        val btnNightly = makeChannelBtn("Nightly", "nightly")
+
+        channelRow.addView(btnStable)
+        channelRow.addView(btnBeta)
+        channelRow.addView(btnNightly)
+        layout.addView(channelRow)
+        highlightChannel(channelRow, btnStable)
+
+        logView = TextView(this).apply {
+            textSize = 12f
+            setTextColor(Color.LTGRAY)
+        }
+        layout.addView(logView)
+
+        val btn = Button(this).apply {
+            text = "检查更新"
+            setOnClickListener {
+                val ch = selectedChannel
+                CoroutineScope(Dispatchers.IO).launch { doOtaTest(ch) }
+            }
+        }
+        layout.addView(btn)
+
+        scroll.addView(layout)
+        setContentView(scroll)
+
+        appendLog("渠道: stable | 点击[检查更新]开始")
+    }
+
+    private fun highlightChannel(row: LinearLayout, active: Button) {
+        for (i in 0 until row.childCount) {
+            val b = row.getChildAt(i) as Button
+            b.isSelected = (b == active)
+        }
+    }
+
+    private fun appendLog(msg: String) {
+        Log.i(TAG, msg)
+        runOnUiThread { logView.append("$msg\n") }
+    }
+
+    companion object { private const val TAG = "GCA-OTA" }
+
+    private fun manifestUrl(channel: String): String {
+        val base = "https://git.childish-ghost.com/LukeMackin/Yuzu-GCA/raw/branch/main/ota"
+        return when (channel) {
+            "beta" -> "$base/manifest-beta.json"
+            "nightly" -> "$base/manifest-nightly.json"
+            else -> "$base/manifest-stable.json"
+        }
+    }
+
+    private suspend fun doOtaTest(channel: String) = withContext(Dispatchers.IO) {
+        val url = manifestUrl(channel)
+        appendLog("=== OTA 渠道: $channel ===")
+        appendLog("manifest: $url")
+
+        // 1. 拉取 manifest
+        appendLog("[1/4] 拉取 manifest...")
+        val manifestJson: String
+        try {
+            manifestJson = httpGet(url)
+            appendLog("  ✅ 获取成功 (${manifestJson.length}B)")
+        } catch (e: Exception) {
+            appendLog("  ❌ 获取失败: ${e.message}")
+            appendLog("=== 测试中止 ===")
+            return@withContext
+        }
+
+        // 2. 解析
+        appendLog("[2/4] 解析 manifest...")
+        var manifestSha256 = ""
+        var manifestApkUrl = ""
+        var manifestTag = ""
+        try {
+            val json = JSONObject(manifestJson)
+            if (!json.getJSONObject("builds").has("android")) {
+                appendLog("  ℹ️ 该渠道暂无可用更新")
+                appendLog("=== $channel 渠道测试完成 ===")
+                return@withContext
+            }
+            val android = json.getJSONObject("builds").getJSONObject("android")
+            manifestSha256 = android.getString("sha256")
+            manifestApkUrl = android.getString("url")
+            manifestTag = android.getString("tag")
+            appendLog("  渠道: $channel  版本: $manifestTag")
+            appendLog("  SHA256: ${manifestSha256.take(16)}...")
+
+            // 版本比较：一致则跳过
+            val localTag = "v0.1.0-dav-android-${packageManager.getPackageInfo(packageName, 0).versionCode}"
+            if (manifestTag == localTag) {
+                appendLog("  ✅ 已是最新版本，无需更新")
+                appendLog("=== $channel 渠道测试完成 ===")
+                return@withContext
+            }
+            appendLog("  发现新版本，开始更新...")
+        } catch (e: Exception) {
+            appendLog("  ❌ 解析失败: ${e.message}")
+            return@withContext
+        }
+
+        // 3. 下载
+        appendLog("[3/4] 下载 APK...")
+        val apkFile = File(cacheDir, "update-$channel.apk")
+        try {
+            downloadFile(manifestApkUrl, apkFile)
+            appendLog("  ✅ 下载完成: ${apkFile.length()} bytes")
+        } catch (e: Exception) {
+            appendLog("  ❌ 下载失败: ${e.message}")
+            return@withContext
+        }
+
+        // 4. SHA256 校验
+        appendLog("[4/4] SHA256 校验...")
+        val actualSha256 = computeSha256(apkFile)
+        if (actualSha256 == manifestSha256) {
+            appendLog("  ✅ SHA256 校验通过!")
+            // 5. 安装 APK
+            appendLog("[5/5] 提交安装...")
+            try {
+                installApk(apkFile)
+                appendLog("  ✅ 安装已提交，稍后通知栏点击重启")
+            } catch (e: Exception) {
+                appendLog("  ❌ 安装失败: ${e.message}")
+            }
+        } else {
+            appendLog("  ❌ SHA256 校验失败!")
+            appendLog("  expected: ${manifestSha256.take(32)}")
+            appendLog("  actual:   ${actualSha256.take(32)}")
+        }
+
+        appendLog("=== $channel 渠道测试完成 ===")
+    }
+
+    private fun httpGet(url: String): String {
+        val conn = URL(url).openConnection() as HttpURLConnection
+        conn.connectTimeout = 10000
+        conn.readTimeout = 10000
+        return conn.inputStream.bufferedReader().readText()
+    }
+
+    private val ALLOWED_HOSTS = setOf("git.childish-ghost.com", "github.com")
+
+    private fun downloadFile(url: String, dest: File) {
+        val host = URL(url).host
+        if (!ALLOWED_HOSTS.any { host == it || host.endsWith(".$it") }) {
+            throw SecurityException("不允许的下载域名: $host")
+        }
+        val conn = URL(url).openConnection() as HttpURLConnection
+        conn.connectTimeout = 30000
+        conn.readTimeout = 120000
+        conn.inputStream.use { input ->
+            FileOutputStream(dest).use { output -> input.copyTo(output) }
+        }
+    }
+
+    private fun installApk(apkFile: File) {
+        val uri = FileProvider.getUriForFile(this, "${packageName}.fileprovider", apkFile)
+        val intent = Intent(Intent.ACTION_VIEW).apply {
+            setDataAndType(uri, "application/vnd.android.package-archive")
+            addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION or Intent.FLAG_ACTIVITY_NEW_TASK)
+        }
+        startActivity(intent)
+    }
+
+    private fun computeSha256(file: File): String {
+        val digest = MessageDigest.getInstance("SHA-256")
+        file.inputStream().use { input ->
+            val buf = ByteArray(8192)
+            var read: Int
+            while (input.read(buf).also { read = it } != -1) {
+                digest.update(buf, 0, read)
+            }
+        }
+        return digest.digest().joinToString("") { "%02x".format(it) }
+    }
+}

packages/client-android/android/app/src/main/java/dev/yuzu/gca/MainApplication.kt

@@ -0,0 +1,5 @@
+package dev.yuzu.gca
+
+import android.app.Application
+
+class MainApplication : Application()

packages/client-android/android/app/src/main/res/drawable/ic_launcher_background.xml

@@ -0,0 +1,3 @@
+<layer-list xmlns:android="http://schemas.android.com/apk/res/android">
+  <item android:drawable="@color/splashscreen_background"/>
+</layer-list>

packages/client-android/android/app/src/main/res/drawable/rn_edit_text_material.xml

@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2014 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<inset xmlns:android="http://schemas.android.com/apk/res/android"
+       android:insetLeft="@dimen/abc_edit_text_inset_horizontal_material"
+       android:insetRight="@dimen/abc_edit_text_inset_horizontal_material"
+       android:insetTop="@dimen/abc_edit_text_inset_top_material"
+       android:insetBottom="@dimen/abc_edit_text_inset_bottom_material"
+       >
+
+    <selector>
+        <!--
+          This file is a copy of abc_edit_text_material (https://bit.ly/3k8fX7I).
+          The item below with state_pressed="false" and state_focused="false" causes a NullPointerException.
+          NullPointerException:tempt to invoke virtual method 'android.graphics.drawable.Drawable android.graphics.drawable.Drawable$ConstantState.newDrawable(android.content.res.Resources)'
+
+          <item android:state_pressed="false" android:state_focused="false" android:drawable="@drawable/abc_textfield_default_mtrl_alpha"/>
+
+          For more info, see https://bit.ly/3CdLStv (react-native/pull/29452) and https://bit.ly/3nxOMoR.
+        -->
+        <item android:state_enabled="false" android:drawable="@drawable/abc_textfield_default_mtrl_alpha"/>
+        <item android:drawable="@drawable/abc_textfield_activated_mtrl_alpha"/>
+    </selector>
+
+</inset>

packages/client-android/android/app/src/main/res/values-night/colors.xml

@@ -0,0 +1 @@
+<resources/>

packages/client-android/android/app/src/main/res/values/colors.xml

@@ -0,0 +1,5 @@
+<resources>
+  <color name="splashscreen_background">#0f172a</color>
+  <color name="colorPrimary">#023c69</color>
+  <color name="colorPrimaryDark">#0f172a</color>
+</resources>

packages/client-android/android/app/src/main/res/values/strings.xml

@@ -0,0 +1,6 @@
+<resources>
+  <string name="app_name">YuzuGCA</string>
+  <string name="expo_splash_screen_resize_mode" translatable="false">contain</string>
+  <string name="expo_splash_screen_status_bar_translucent" translatable="false">false</string>
+  <string name="expo_runtime_version">0.1.0</string>
+</resources>

packages/client-android/android/app/src/main/res/values/styles.xml

@@ -0,0 +1,17 @@
+<resources xmlns:tools="http://schemas.android.com/tools">
+  <style name="AppTheme" parent="Theme.AppCompat.Light.NoActionBar">
+    <item name="android:textColor">@android:color/black</item>
+    <item name="android:editTextStyle">@style/ResetEditText</item>
+    <item name="android:editTextBackground">@drawable/rn_edit_text_material</item>
+    <item name="colorPrimary">@color/colorPrimary</item>
+    <item name="android:statusBarColor">#0f172a</item>
+  </style>
+  <style name="ResetEditText" parent="@android:style/Widget.EditText">
+    <item name="android:padding">0dp</item>
+    <item name="android:textColorHint">#c8c8c8</item>
+    <item name="android:textColor">@android:color/black</item>
+  </style>
+  <style name="Theme.App.SplashScreen" parent="AppTheme">
+    <item name="android:windowBackground">@drawable/ic_launcher_background</item>
+  </style>
+</resources>

packages/client-android/android/app/src/main/res/xml/file_paths.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<paths>
+    <cache-path name="apk" path="/" />
+</paths>

packages/client-android/android/build.gradle

@@ -0,0 +1,26 @@
+// Top-level build file
+buildscript {
+    ext {
+        buildToolsVersion = "35.0.0"
+        minSdkVersion = 24
+        compileSdkVersion = 35
+        targetSdkVersion = 35
+        kotlinVersion = "2.0.21"
+    }
+    repositories {
+        google()
+        mavenCentral()
+    }
+    dependencies {
+        classpath("com.android.tools.build:gradle:8.7.3")
+        classpath("org.jetbrains.kotlin:kotlin-gradle-plugin:${kotlinVersion}")
+    }
+}
+
+allprojects {
+    repositories {
+        google()
+        mavenCentral()
+        maven { url 'https://www.jitpack.io' }
+    }
+}

packages/client-android/android/gradle.properties

@@ -0,0 +1,56 @@
+# Project-wide Gradle settings.
+
+# IDE (e.g. Android Studio) users:
+# Gradle settings configured through the IDE *will override*
+# any settings specified in this file.
+
+# For more details on how to configure your build environment visit
+# http://www.gradle.org/docs/current/userguide/build_environment.html
+
+# Specifies the JVM arguments used for the daemon process.
+# The setting is particularly useful for tweaking memory settings.
+# Default value: -Xmx512m -XX:MaxMetaspaceSize=256m
+org.gradle.jvmargs=-Xmx2048m -XX:MaxMetaspaceSize=512m
+
+# When configured, Gradle will run in incubating parallel mode.
+# This option should only be used with decoupled projects. More details, visit
+# http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects
+# org.gradle.parallel=true
+
+# AndroidX package structure to make it clearer which packages are bundled with the
+# Android operating system, and which are packaged with your app's APK
+# https://developer.android.com/topic/libraries/support-library/androidx-rn
+android.useAndroidX=true
+
+# Enable AAPT2 PNG crunching
+android.enablePngCrunchInReleaseBuilds=true
+
+# Use this property to specify which architecture you want to build.
+# You can also override it from the CLI using
+# ./gradlew <task> -PreactNativeArchitectures=x86_64
+reactNativeArchitectures=armeabi-v7a,arm64-v8a,x86,x86_64
+
+# Use this property to enable support to the new architecture.
+# This will allow you to use TurboModules and the Fabric render in
+# your application. You should enable this flag either if you want
+# to write custom TurboModules/Fabric components OR use libraries that
+# are providing them.
+newArchEnabled=true
+
+# Use this property to enable or disable the Hermes JS engine.
+# If set to false, you will be using JSC instead.
+hermesEnabled=true
+
+# Enable GIF support in React Native images (~200 B increase)
+expo.gif.enabled=true
+# Enable webp support in React Native images (~85 KB increase)
+expo.webp.enabled=true
+# Enable animated webp support (~3.4 MB increase)
+# Disabled by default because iOS doesn't support animated webp
+expo.webp.animated=false
+
+# Enable network inspector
+EX_DEV_CLIENT_NETWORK_INSPECTOR=true
+
+# Use legacy packaging to compress native libraries in the resulting APK.
+expo.useLegacyPackaging=false

packages/client-android/android/gradle/wrapper/gradle-wrapper.properties

@@ -0,0 +1,5 @@
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.10.2-all.zip
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists

packages/client-android/android/gradlew

@@ -0,0 +1,252 @@
+#!/bin/sh
+
+#
+# Copyright © 2015-2021 the original authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+##############################################################################
+#
+#   Gradle start up script for POSIX generated by Gradle.
+#
+#   Important for running:
+#
+#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
+#       noncompliant, but you have some other compliant shell such as ksh or
+#       bash, then to run this script, type that shell name before the whole
+#       command line, like:
+#
+#           ksh Gradle
+#
+#       Busybox and similar reduced shells will NOT work, because this script
+#       requires all of these POSIX shell features:
+#         * functions;
+#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
+#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
+#         * compound commands having a testable exit status, especially «case»;
+#         * various built-in commands including «command», «set», and «ulimit».
+#
+#   Important for patching:
+#
+#   (2) This script targets any POSIX shell, so it avoids extensions provided
+#       by Bash, Ksh, etc; in particular arrays are avoided.
+#
+#       The "traditional" practice of packing multiple parameters into a
+#       space-separated string is a well documented source of bugs and security
+#       problems, so this is (mostly) avoided, by progressively accumulating
+#       options in "$@", and eventually passing that to Java.
+#
+#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
+#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
+#       see the in-line comments for details.
+#
+#       There are tweaks for specific operating systems such as AIX, CygWin,
+#       Darwin, MinGW, and NonStop.
+#
+#   (3) This script is generated from the Groovy template
+#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       within the Gradle project.
+#
+#       You can find Gradle at https://github.com/gradle/gradle/.
+#
+##############################################################################
+
+# Attempt to set APP_HOME
+
+# Resolve links: $0 may be a link
+app_path=$0
+
+# Need this for daisy-chained symlinks.
+while
+    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
+    [ -h "$app_path" ]
+do
+    ls=$( ls -ld "$app_path" )
+    link=${ls#*' -> '}
+    case $link in             #(
+      /*)   app_path=$link ;; #(
+      *)    app_path=$APP_HOME$link ;;
+    esac
+done
+
+# This is normally unused
+# shellcheck disable=SC2034
+APP_BASE_NAME=${0##*/}
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s
+' "$PWD" ) || exit
+
+# Use the maximum available, or set MAX_FD != -1 to use that value.
+MAX_FD=maximum
+
+warn () {
+    echo "$*"
+} >&2
+
+die () {
+    echo
+    echo "$*"
+    echo
+    exit 1
+} >&2
+
+# OS specific support (must be 'true' or 'false').
+cygwin=false
+msys=false
+darwin=false
+nonstop=false
+case "$( uname )" in                #(
+  CYGWIN* )         cygwin=true  ;; #(
+  Darwin* )         darwin=true  ;; #(
+  MSYS* | MINGW* )  msys=true    ;; #(
+  NONSTOP* )        nonstop=true ;;
+esac
+
+CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
+
+
+# Determine the Java command to use to start the JVM.
+if [ -n "$JAVA_HOME" ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+        # IBM's JDK on AIX uses strange locations for the executables
+        JAVACMD=$JAVA_HOME/jre/sh/java
+    else
+        JAVACMD=$JAVA_HOME/bin/java
+    fi
+    if [ ! -x "$JAVACMD" ] ; then
+        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+else
+    JAVACMD=java
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+fi
+
+# Increase the maximum file descriptors if we can.
+if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
+    case $MAX_FD in #(
+      max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        MAX_FD=$( ulimit -H -n ) ||
+            warn "Could not query maximum file descriptor limit"
+    esac
+    case $MAX_FD in  #(
+      '' | soft) :;; #(
+      *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        ulimit -n "$MAX_FD" ||
+            warn "Could not set maximum file descriptor limit to $MAX_FD"
+    esac
+fi
+
+# Collect all arguments for the java command, stacking in reverse order:
+#   * args from the command line
+#   * the main class name
+#   * -classpath
+#   * -D...appname settings
+#   * --module-path (only if needed)
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
+
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if "$cygwin" || "$msys" ; then
+    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
+    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
+
+    JAVACMD=$( cygpath --unix "$JAVACMD" )
+
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    for arg do
+        if
+            case $arg in                                #(
+              -*)   false ;;                            # don't mess with options #(
+              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
+                    [ -e "$t" ] ;;                      #(
+              *)    false ;;
+            esac
+        then
+            arg=$( cygpath --path --ignore --mixed "$arg" )
+        fi
+        # Roll the args list around exactly as many times as the number of
+        # args, so each arg winds up back in the position where it started, but
+        # possibly modified.
+        #
+        # NB: a `for` loop captures its iteration list before it begins, so
+        # changing the positional parameters here affects neither the number of
+        # iterations, nor the values presented in `arg`.
+        shift                   # remove old arg
+        set -- "$@" "$arg"      # push replacement arg
+    done
+fi
+
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
+
+set -- \
+        "-Dorg.gradle.appname=$APP_BASE_NAME" \
+        -classpath "$CLASSPATH" \
+        org.gradle.wrapper.GradleWrapperMain \
+        "$@"
+
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
+# Use "xargs" to parse quoted args.
+#
+# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
+#
+# In Bash we could simply go:
+#
+#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
+#   set -- "${ARGS[@]}" "$@"
+#
+# but POSIX shell has neither arrays nor command substitution, so instead we
+# post-process each arg (as a line of input to sed) to backslash-escape any
+# character that might be a shell metacharacter, then use eval to reverse
+# that process (while maintaining the separation between arguments), and wrap
+# the whole thing up as a single "set" statement.
+#
+# This will of course break if any of these variables contains a newline or
+# an unmatched quote.
+#
+
+eval "set -- $(
+        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
+        xargs -n1 |
+        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
+        tr '\n' ' '
+    )" '"$@"'
+
+exec "$JAVACMD" "$@"

packages/client-android/android/gradlew.bat

@@ -0,0 +1,26 @@
+@echo off
+setlocal
+set DIRNAME=%~dp0
+if "%DIRNAME%"=="" set DIRNAME=.
+set APP_HOME=%DIRNAME%
+set APP_BASE_NAME=%~n0
+set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
+set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
+set ANDROID_HOME=C:\Users\Middl\AppData\Local\Android\Sdk
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if "%ERRORLEVEL%" == "0" goto execute
+goto fail
+:fail
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+exit /b 1
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+if exist "%JAVA_EXE%" goto execute
+goto fail
+:execute
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %*
+:end

packages/client-android/android/settings.gradle

@@ -0,0 +1,3 @@
+rootProject.name = 'YuzuGCA'
+
+include ':app'

packages/client-android/app.json

@@ -3,40 +3,26 @@
     "name": "YuzuGCA",
     "slug": "yuzu-gca",
     "version": "0.1.0",
+    "runtimeVersion": "0.1.0",
     "orientation": "portrait",
-    "icon": "./assets/icon.png",
     "userInterfaceStyle": "dark",
     "newArchEnabled": true,
-    "splash": {
+    "splash": { "backgroundColor": "#0f172a" },
-      "backgroundColor": "#0f172a"
+    "ios": { "supportsTablet": false, "bundleIdentifier": "dev.yuzu.gca" },
-    },
-    "ios": {
-      "supportsTablet": false,
-      "bundleIdentifier": "dev.yuzu.gca"
-    },
     "android": {
-      "adaptiveIcon": {
+      "adaptiveIcon": { "backgroundColor": "#0f172a" },
-        "backgroundColor": "#0f172a"
-      },
       "package": "dev.yuzu.gca",
       "allowBackup": false,
-      "permissions": [
+      "versionCode": 8,
-        "REQUEST_INSTALL_PACKAGES"
+      "permissions": ["REQUEST_INSTALL_PACKAGES"]
-      ]
     },
-    "plugins": [
+    "plugins": ["expo-updates"],
-      "expo-updates"
-    ],
     "updates": {
       "enabled": true,
       "checkAutomatically": "ON_LOAD",
-      "fallbackToCacheTimeout": 0,
+      "fallbackToCacheTimeout": 3000,
-      "url": "https://git.childish-ghost.com/LukeMackin/Yuzu-GCA/releases/download/manifest/expo-manifest.json"
+      "url": "https://git.childish-ghost.com/LukeMackin/Yuzu-GCA/raw/branch/main/ota/expo-manifest.json"
     },
-    "extra": {
+    "extra": { "eas": { "projectId": "yuzu-gca-android" } }
-      "eas": {
-        "projectId": "yuzu-gca-android"
-      }
-    }
   }
 }

packages/client-android/eas.json

@@ -0,0 +1,23 @@
+{
+  "cli": {
+    "version": ">= 14.0.0"
+  },
+  "build": {
+    "preview": {
+      "android": {
+        "buildType": "apk",
+        "env": {
+          "APP_VERSION": "0.1.0"
+        }
+      }
+    },
+    "production": {
+      "android": {
+        "buildType": "apk"
+      }
+    }
+  },
+  "submit": {
+    "production": {}
+  }
+}

packages/client-android/manifest.json

@@ -1,12 +0,0 @@
-{
-  "version": "0.1.0",
-  "builds": {
-    "android": {
-      "tag": "v0.1.0-dav-android-1",
-      "url": "https://git.childish-ghost.com/LukeMackin/Yuzu-GCA/releases/download/v0.1.0-dav-android-1/gca-0.1.0.apk",
-      "sha256": "PLACEHOLDER",
-      "size": 0,
-      "minVersion": "0.1.0"
-    }
-  }
-}

packages/client-android/modules/package-installer/android/src/main/java/dev/yuzu/gca/PackageInstallerModule.kt

@@ -1,55 +0,0 @@
-package dev.yuzu.gca
-
-import android.app.PendingIntent
-import android.content.Context
-import android.content.Intent
-import android.content.pm.PackageInstaller
-import expo.modules.kotlin.modules.Module
-import expo.modules.kotlin.modules.ModuleDefinition
-import java.io.File
-import java.io.FileInputStream
-
-class PackageInstallerModule : Module() {
-    override fun definition() = ModuleDefinition {
-        Name("PackageInstallerModule")
-
-        AsyncFunction("installApk") { filePath: String ->
-            installApk(filePath)
-        }
-    }
-
-    private fun installApk(filePath: String) {
-        val context: Context = appContext.reactContext ?: return
-        val apkFile = File(filePath)
-        if (!apkFile.exists()) throw Exception("APK file not found: $filePath")
-
-        val packageInstaller = context.packageManager.packageInstaller
-        val sessionParams = PackageInstaller.SessionParams(
-            PackageInstaller.SessionParams.MODE_FULL_INSTALL
-        )
-
-        val sessionId = packageInstaller.createSession(sessionParams)
-        val session = packageInstaller.openSession(sessionId)
-
-        try {
-            FileInputStream(apkFile).use { input ->
-                session.openWrite("package", 0, apkFile.length()).use { output ->
-                    input.copyTo(output)
-                }
-                session.fsync(output)
-            }
-
-            // 安装完成后发送通知，用户点击即重启
-            val intent = Intent(context, context.javaClass)
-            intent.action = Intent.ACTION_MAIN
-            val pendingIntent = PendingIntent.getActivity(
-                context, 0, intent,
-                PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE
-            )
-
-            session.commit(pendingIntent.intentSender)
-        } finally {
-            session.close()
-        }
-    }
-}

packages/client-android/modules/package-installer/expo-module.config.json

@@ -1,4 +0,0 @@
-{
-  "platform": "android",
-  "modules": ["PackageInstallerModule"]
-}

packages/client-android/package.json

@@ -5,19 +5,19 @@
   "main": "expo-router/entry",
   "scripts": {
     "start": "expo start",
-    "android": "expo start --android",
+    "android": "expo run:android",
     "build": "eas build -p android --profile preview",
     "export": "expo export --platform android",
-    "prebuild": "expo prebuild --platform android"
+    "prebuild": "expo prebuild --platform android",
+    "ios": "expo run:ios"
   },
   "dependencies": {
     "@yuzu-gca/shared": "workspace:*",
-    "expo": "~52.0.0",
+    "expo": "~52.0.49",
     "expo-constants": "~17.0.0",
-    "expo-device": "~7.0.0",
     "expo-file-system": "~18.0.0",
     "expo-status-bar": "~2.0.0",
-    "expo-updates": "~26.0.0",
+    "expo-updates": "~0.27.5",
     "react": "18.3.1",
     "react-native": "0.76.5"
   },

packages/client-android/src/updater/index.ts

@@ -1,6 +1,5 @@
-import { parseVersion, checkUpdate, semverGt } from '@yuzu-gca/shared';
+import { parseVersion, checkUpdate } from '@yuzu-gca/shared';
 import Constants from 'expo-constants';
-import * as Device from 'expo-device';
 import * as FileSystem from 'expo-file-system';
 import { NativeModules, Platform } from 'react-native';
 
@@ -8,49 +7,63 @@ import { NativeModules, Platform } from 'react-native';
 // 1. 版本号读取
 // ============================================================
 
-/** 从 app.json + expo-updates 获取本地版本 */
 export function getLocalVersion(): string {
   return Constants.expoConfig?.version ?? '0.1.0';
 }
 
 export function getLocalBuildTag(): string {
   const v = getLocalVersion();
-  return `v${v}-dav-android-${Constants.expoConfig?.ios?.buildNumber ?? Constants.expoConfig?.android?.versionCode ?? 1}`;
+  const versionCode = Constants.expoConfig?.android?.versionCode ?? 1;
+  return `v${v}-dav-android-${versionCode}`;
 }
 
 // ============================================================
 // 2. JS Bundle OTA（expo-updates 自动处理）
 // ============================================================
 
-/** 手动触发 OTA 检查（expo-updates 已自动启动检查，此方法用于设置页手动刷新） */
 export async function checkJsBundleUpdate(): Promise<{
   hasUpdate: boolean;
   remoteVersion: string;
 }> {
   const localVersion = getLocalVersion();
   const localTag = getLocalBuildTag();
+  const local = parseVersion(localTag);
+  if (!local) return { hasUpdate: false, remoteVersion: localVersion };
 
-  const result = await checkUpdate('android', parseVersion(localTag)!);
+  const result = await checkUpdate('android', local);
   if (!result.shouldUpdate || !result.remoteVersion) {
     return { hasUpdate: false, remoteVersion: localVersion };
   }
 
-  // expo-updates 会在检测到新 manifest 时自动下载 bundle
+  return { hasUpdate: true, remoteVersion: result.remoteVersion.raw };
-  // 这里只返回状态；实际下载由 expo-updates 后台完成
-  return {
-    hasUpdate: semverGt(result.remoteVersion.raw.replace(/^v/, '').split('-')[0], localVersion),
-    remoteVersion: result.remoteVersion.raw,
-  };
 }
 
 // ============================================================
 // 3. APK 静默安装（大更新）
 // ============================================================
 
+const ALLOWED_DOWNLOAD_HOSTS = [
+  'git.childish-ghost.com',
+  'github.com',
+];
+
 const { PackageInstallerModule } = NativeModules;
 
-/** 后台下载 APK 并通过 PackageInstaller 静默安装 */
+function validateUrl(url: string): void {
+  try {
+    const host = new URL(url).hostname;
+    if (!ALLOWED_DOWNLOAD_HOSTS.some(h => host === h || host.endsWith('.' + h))) {
+      throw new Error(`不允许的下载域名: ${host}`);
+    }
+  } catch (e) {
+    if (e instanceof TypeError) throw new Error('下载URL格式无效');
+    throw e;
+  }
+}
+
 export async function downloadAndInstallApk(apkUrl: string, sha256: string): Promise<void> {
+  validateUrl(apkUrl);
+
   const localPath = `${FileSystem.cacheDirectory ?? ''}gca-update.apk`;
 
   const download = FileSystem.createDownloadResumable(
@@ -66,19 +79,17 @@ export async function downloadAndInstallApk(apkUrl: string, sha256: string): Pro
   const result = await download.downloadAsync();
   if (!result?.uri) throw new Error('APK 下载失败');
 
-  console.log(`[OTA] 下载完成: ${result.uri}`);
-
-  // 调用原生 PackageInstaller 安装
   if (Platform.OS === 'android' && PackageInstallerModule) {
-    await PackageInstallerModule.installApk(result.uri);
+    // SHA256 校验在原生层完成（避免 TOCTOU + 密码学误用）
-    console.log('[OTA] APK 已提交安装，用户下次重启生效');
+    await PackageInstallerModule.installApk(result.uri, sha256);
+    console.log('[OTA] SHA256校验通过，APK已提交安装');
   } else {
     throw new Error('PackageInstaller 原生模块不可用');
   }
 }
 
 // ============================================================
-// 4. 启动时一键检查（JS OTA + APK 更新）
+// 4. 启动时一键检查
 // ============================================================
 
 export async function onAppStartCheckUpdate(): Promise<{
@@ -94,18 +105,10 @@ export async function onAppStartCheckUpdate(): Promise<{
     return { jsUpdate: false, apkUpdate: false };
   }
 
-  // JS OTA: expo-updates 自动处理，无需手动干预
+  if (result.build.type === 'apk') {
-  const jsUpdate = semverGt(
-    result.build.tag.replace(/^v/, '').split('-')[0],
-    localTag.replace(/^v/, '').split('-')[0],
-  );
-
-  // APK 大更新：需要下载 + PackageInstaller
-  if (result.build.size > 5_000_000) {
-    // >5MB = APK 安装包
     await downloadAndInstallApk(result.build.url, result.build.sha256);
     return { jsUpdate: false, apkUpdate: true };
   }
 
-  return { jsUpdate, apkUpdate: false };
+  return { jsUpdate: true, apkUpdate: false };
 }

packages/shared/src/updater/index.ts

@@ -18,6 +18,7 @@ export interface ManifestBuild {
   url: string;
   sha256: string;
   size: number;
+  type: 'js' | 'apk';
   minVersion?: string;
 }
 
@@ -67,7 +68,8 @@ export async function checkUpdate(
       build,
       remoteVersion,
     };
-  } catch {
+  } catch (e) {
+    console.warn('[GCA] checkUpdate 失败:', e);
     return { shouldUpdate: false, build: null, remoteVersion: null };
   }
 }