feat: 增加认证更新配置与自动检查 (#94)

client/src/settings_ui.py

@@ -16,6 +16,7 @@ from PyQt5.QtWidgets import (
     QFormLayout,
     QHeaderView,
     QHBoxLayout,
+    QLineEdit,
     QSizePolicy,
     QVBoxLayout,
     QWidget,
@@ -210,6 +211,7 @@ class SettingsPage(QWidget):
         admin_gateway=None,
         android_device_service=None,
         update_service=None,
+        update_credential_store=None,
     ):
         super().__init__(parent)
         self.setObjectName("settingsPage")
@@ -224,6 +226,7 @@ class SettingsPage(QWidget):
             admin_gateway=admin_gateway,
             android_device_service=android_device_service,
             update_service=update_service,
+            update_credential_store=update_credential_store,
         )
 
     def _build_ui(self) -> None:
@@ -301,10 +304,20 @@ class SettingsPage(QWidget):
         )
         self.updateManifestUrlInput.setClearButtonEnabled(True)
         self.updateManifestUrlInput.setAccessibleName("在线更新清单地址")
+        self.updateUsernameInput = LineEdit(self)
+        self.updateUsernameInput.setClearButtonEnabled(True)
+        self.updateUsernameInput.setAccessibleName("在线更新账号")
+        self.updatePasswordInput = LineEdit(self)
+        self.updatePasswordInput.setEchoMode(QLineEdit.Password)
+        self.updatePasswordInput.setClearButtonEnabled(True)
+        self.updatePasswordInput.setAccessibleName("在线更新密码")
+        self.updatePasswordInput.setPlaceholderText("请输入密码")
+        self.updateSaveButton = PushButton(FIF.SAVE, "保存", self)
+        self.updateSaveButton.setAccessibleName("安全保存在线更新设置")
         self.updateCheckButton = PushButton(FIF.UPDATE, "检查更新", self)
         self.updateCheckButton.setAccessibleName("检查并下载软件更新")
         self.updateStatusLabel = CaptionLabel(
-            "尚未检查；请填写 HTTPS 更新清单地址", self
+            "尚未保存更新账号和密码", self
         )
         self.updateStatusLabel.setAccessibleName("软件更新状态")
         self.updateStatusLabel.setWordWrap(True)
@@ -424,13 +437,20 @@ class SettingsPage(QWidget):
         form.setVerticalSpacing(12)
         versionLabel = CaptionLabel("当前版本", card)
         manifestLabel = CaptionLabel("清单地址", card)
+        usernameLabel = CaptionLabel("账号", card)
+        passwordLabel = CaptionLabel("密码", card)
         manifestLabel.setBuddy(self.updateManifestUrlInput)
+        usernameLabel.setBuddy(self.updateUsernameInput)
+        passwordLabel.setBuddy(self.updatePasswordInput)
         form.addRow(versionLabel, self.currentVersionLabel)
         form.addRow(manifestLabel, self.updateManifestUrlInput)
+        form.addRow(usernameLabel, self.updateUsernameInput)
+        form.addRow(passwordLabel, self.updatePasswordInput)
         layout.addLayout(form)
 
         commandLayout = QHBoxLayout()
         commandLayout.addStretch(1)
+        commandLayout.addWidget(self.updateSaveButton)
         commandLayout.addWidget(self.updateCheckButton)
         layout.addLayout(commandLayout)
         return card

client/src/settings_ui_event.py

@@ -310,6 +310,7 @@ class SettingsPageEventBinder(QObject):
         admin_gateway: Optional[ClientRegistrationGateway] = None,
         android_device_service: Optional[AndroidDeviceService] = None,
         update_service=None,
+        update_credential_store=None,
     ):
         super().__init__(page)
         self._page = page
@@ -349,6 +350,7 @@ class SettingsPageEventBinder(QObject):
             page,
             repository,
             service=update_service,
+            credential_store=update_credential_store,
             parent=self,
         )
         self._client_service = CurrentClientService(repository)

client/src/update_service.py

@@ -6,6 +6,7 @@
 
 from __future__ import annotations
 
+import base64
 import hashlib
 import json
 import os
@@ -16,7 +17,7 @@ import urllib.error
 import urllib.parse
 import urllib.request
 import zipfile
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from pathlib import Path, PurePosixPath
 from typing import Callable, Optional
 
@@ -28,6 +29,10 @@ MAX_MANIFEST_BYTES = 1024 * 1024
 MAX_UPDATE_BYTES = 500 * 1024 * 1024
 MAX_EXTRACTED_BYTES = 1024 * 1024 * 1024
 UPDATE_MANIFEST_SETTING = "update.manifest_url"
+UPDATE_USERNAME_SETTING = "update.username"
+DEFAULT_UPDATE_MANIFEST_URL = "http://cm.xiapi.com/autobuy——manifest.json"
+DEFAULT_UPDATE_USERNAME = "admin"
+_ALLOWED_HTTP_UPDATE_HOST = "cm.xiapi.com"
 _VERSION_PATTERN = re.compile(r"^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:\.(0|[1-9]\d*))?$")
 _SHA256_PATTERN = re.compile(r"^[0-9a-f]{64}$")
 
@@ -56,6 +61,14 @@ class UpdateCancelled(UpdateError):
     """用户关闭页面后取消继续处理更新。"""
 
 
+@dataclass(frozen=True)
+class UpdateCredentials:
+    """仅在内存中使用的更新服务器 Basic Authentication 凭据。"""
+
+    username: str
+    password: str = field(repr=False)
+
+
 @dataclass(frozen=True)
 class UpdateInfo:
     """清单中一份可下载更新的信息。"""
@@ -93,12 +106,25 @@ def parse_version(version: str) -> tuple[int, int, int, int]:
 
 
 def validate_manifest_url(url: str) -> str:
-    """验证并返回只允许 HTTPS、且不含凭据的清单地址。"""
+    """验证更新地址；HTTP 只对白名单发布主机开放。"""
 
     normalized = url.strip()
     parsed = urllib.parse.urlsplit(normalized)
-    if parsed.scheme.lower() != "https" or not parsed.hostname:
-        raise UpdateConfigurationError("更新清单地址必须是有效的 HTTPS 地址")
+    scheme = parsed.scheme.lower()
+    try:
+        port = parsed.port
+    except ValueError as exc:
+        raise UpdateConfigurationError("更新清单地址端口无效") from exc
+    is_https = scheme == "https" and bool(parsed.hostname)
+    is_allowed_http = (
+        scheme == "http"
+        and (parsed.hostname or "").lower() == _ALLOWED_HTTP_UPDATE_HOST
+        and port in {None, 80}
+    )
+    if not is_https and not is_allowed_http:
+        raise UpdateConfigurationError(
+            "更新清单地址必须使用 HTTPS；HTTP 只允许固定发布服务器"
+        )
     if parsed.username is not None or parsed.password is not None:
         raise UpdateConfigurationError("更新清单地址不能包含账号或密码")
     if parsed.query:
@@ -110,24 +136,54 @@ def validate_manifest_url(url: str) -> str:
 
 def _origin(url: str) -> tuple[str, str, int]:
     parsed = urllib.parse.urlsplit(url)
+    scheme = parsed.scheme.lower()
     return (
-        parsed.scheme.lower(),
+        scheme,
         (parsed.hostname or "").lower(),
-        parsed.port or 443,
+        parsed.port or (443 if scheme == "https" else 80),
     )
 
 
+def _ascii_request_url(url: str) -> str:
+    """只编码 URL 路径中的非 ASCII 字符，避免重复编码已有百分号。"""
+
+    parsed = urllib.parse.urlsplit(url)
+    encoded_path = urllib.parse.quote(parsed.path, safe="/%")
+    return urllib.parse.urlunsplit(
+        (parsed.scheme, parsed.netloc, encoded_path, parsed.query, parsed.fragment)
+    )
+
+
+class _SameOriginRedirectHandler(urllib.request.HTTPRedirectHandler):
+    """在发送认证头之前拒绝跨源重定向。"""
+
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        validated_url = validate_manifest_url(newurl)
+        if _origin(req.full_url) != _origin(validated_url):
+            raise UpdateConfigurationError("更新请求不允许跨服务器重定向")
+        return super().redirect_request(
+            req,
+            fp,
+            code,
+            msg,
+            headers,
+            _ascii_request_url(validated_url),
+        )
+
+
 class UpdateService:
     """检查并把更新安全暂存到 ``data/update``。"""
 
     def __init__(
         self,
         update_directory: Optional[Path] = None,
-        urlopen: Callable = urllib.request.urlopen,
+        urlopen: Optional[Callable] = None,
         timeout_seconds: float = 10.0,
     ):
         self._update_directory = update_directory or (data_dir() / "update")
-        self._urlopen = urlopen
+        self._urlopen = urlopen or urllib.request.build_opener(
+            _SameOriginRedirectHandler()
+        ).open
         self._timeout_seconds = timeout_seconds
 
     @property
@@ -139,6 +195,7 @@ class UpdateService:
         manifest_url: str,
         current_version: str = __version__,
         is_cancelled: Optional[Callable[[], bool]] = None,
+        credentials: Optional[UpdateCredentials] = None,
     ) -> UpdateCheckResult:
         """下载并解析清单，返回是否存在新版本。"""
 
@@ -148,6 +205,7 @@ class UpdateService:
             configured_url,
             MAX_MANIFEST_BYTES,
             is_cancelled,
+            credentials,
         )
         try:
             manifest = json.loads(content.decode("utf-8-sig"))
@@ -168,6 +226,7 @@ class UpdateService:
         info: UpdateInfo,
         is_cancelled: Optional[Callable[[], bool]] = None,
         on_progress: Optional[Callable[[int], None]] = None,
+        credentials: Optional[UpdateCredentials] = None,
     ) -> Path:
         """下载、校验并安全解压更新，返回暂存的 ``app.new``。"""
 
@@ -184,10 +243,7 @@ class UpdateService:
         bytes_written = 0
 
         try:
-            request = urllib.request.Request(
-                info.update_url,
-                headers={"User-Agent": f"CMAutoBuy/{__version__}"},
-            )
+            request = self._make_request(info.update_url, credentials)
             with self._open(request) as response:
                 final_url = validate_manifest_url(response.geturl())
                 if _origin(final_url) != _origin(info.manifest_url):
@@ -294,11 +350,9 @@ class UpdateService:
         url: str,
         maximum_bytes: int,
         is_cancelled: Optional[Callable[[], bool]],
+        credentials: Optional[UpdateCredentials],
     ) -> tuple[bytes, str]:
-        request = urllib.request.Request(
-            url,
-            headers={"User-Agent": f"CMAutoBuy/{__version__}"},
-        )
+        request = self._make_request(url, credentials)
         with self._open(request) as response:
             final_url = validate_manifest_url(response.geturl())
             declared_size = self._content_length(response)
@@ -317,6 +371,22 @@ class UpdateService:
                 chunks.append(block)
             return b"".join(chunks), final_url
 
+    @staticmethod
+    def _make_request(
+        url: str,
+        credentials: Optional[UpdateCredentials],
+    ) -> urllib.request.Request:
+        headers = {"User-Agent": f"CMAutoBuy/{__version__}"}
+        if credentials is not None:
+            username = credentials.username.strip()
+            if not username or not credentials.password:
+                raise UpdateConfigurationError("更新账号和密码不能为空")
+            raw = f"{username}:{credentials.password}".encode("utf-8")
+            headers["Authorization"] = "Basic " + base64.b64encode(raw).decode(
+                "ascii"
+            )
+        return urllib.request.Request(_ascii_request_url(url), headers=headers)
+
     def _open(self, request):
         try:
             return self._urlopen(request, timeout=self._timeout_seconds)

client/src/update_ui_event.py

@@ -1,25 +1,34 @@
-"""设置页在线更新事件和 Qt 后台 Worker。"""
+"""设置页在线更新配置、事件和 Qt 后台 Worker。"""
 
 from __future__ import annotations
 
+import sqlite3
 from typing import Optional
 
-from PyQt5.QtCore import QObject, QThread, pyqtSignal, pyqtSlot
+from PyQt5.QtCore import QObject, QThread, QTimer, pyqtSignal, pyqtSlot
 from qfluentwidgets import MessageBox
 
 from .settings_repository import SettingsRepository
 from .update_service import (
+    DEFAULT_UPDATE_MANIFEST_URL,
+    DEFAULT_UPDATE_USERNAME,
     UPDATE_MANIFEST_SETTING,
+    UPDATE_USERNAME_SETTING,
     UpdateCancelled,
     UpdateCheckResult,
+    UpdateCredentials,
     UpdateInfo,
     UpdateService,
     validate_manifest_url,
 )
+from .windows_credential_store import (
+    CredentialStoreError,
+    WindowsCredentialStore,
+)
 
 
 class UpdateCheckWorker(QObject):
-    """在线程中保存清单地址并检查新版本。"""
+    """在线程中使用内存凭据检查新版本。"""
 
     succeeded = pyqtSignal(object)
     failed = pyqtSignal(str)
@@ -28,13 +37,13 @@ class UpdateCheckWorker(QObject):
     def __init__(
         self,
         service: UpdateService,
-        repository: SettingsRepository,
         manifest_url: str,
+        credentials: UpdateCredentials,
     ):
         super().__init__()
         self._service = service
-        self._repository = repository
         self._manifest_url = manifest_url
+        self._credentials = credentials
         self._cancelled = False
 
     def cancel(self) -> None:
@@ -43,13 +52,10 @@ class UpdateCheckWorker(QObject):
     @pyqtSlot()
     def run(self) -> None:
         try:
-            normalized_url = validate_manifest_url(self._manifest_url)
-            if self._cancelled:
-                return
-            self._repository.set(UPDATE_MANIFEST_SETTING, normalized_url)
             result = self._service.check(
-                normalized_url,
+                self._manifest_url,
                 is_cancelled=lambda: self._cancelled,
+                credentials=self._credentials,
             )
             if not self._cancelled:
                 self.succeeded.emit(result)
@@ -59,21 +65,28 @@ class UpdateCheckWorker(QObject):
             if not self._cancelled:
                 self.failed.emit(str(exc) or "检查更新失败")
         finally:
+            self._credentials = None
             self.completed.emit()
 
 
 class UpdateDownloadWorker(QObject):
-    """在线程中下载、校验并安全暂存更新。"""
+    """在线程中认证下载、校验并安全暂存更新。"""
 
     progressChanged = pyqtSignal(int)
     succeeded = pyqtSignal(str)
     failed = pyqtSignal(str)
     completed = pyqtSignal()
 
-    def __init__(self, service: UpdateService, update: UpdateInfo):
+    def __init__(
+        self,
+        service: UpdateService,
+        update: UpdateInfo,
+        credentials: UpdateCredentials,
+    ):
         super().__init__()
         self._service = service
         self._update = update
+        self._credentials = credentials
         self._cancelled = False
 
     def cancel(self) -> None:
@@ -86,6 +99,7 @@ class UpdateDownloadWorker(QObject):
                 self._update,
                 is_cancelled=lambda: self._cancelled,
                 on_progress=self.progressChanged.emit,
+                credentials=self._credentials,
             )
             if not self._cancelled:
                 self.succeeded.emit(self._update.version)
@@ -95,56 +109,159 @@ class UpdateDownloadWorker(QObject):
             if not self._cancelled:
                 self.failed.emit(str(exc) or "下载更新失败")
         finally:
+            self._credentials = None
             self.completed.emit()
 
 
 class UpdateUiEventBinder(QObject):
-    """管理设置页更新按钮、反馈和两个后台线程。"""
+    """管理更新配置、保存反馈和两个后台线程。"""
 
     def __init__(
         self,
         page,
         repository: SettingsRepository,
         service: Optional[UpdateService] = None,
+        credential_store=None,
         parent=None,
     ):
         super().__init__(parent or page)
         self._page = page
         self._repository = repository
         self._service = service or UpdateService()
+        self._credential_store_override = credential_store
         self._closing = False
         self._check_thread: Optional[QThread] = None
         self._check_worker: Optional[UpdateCheckWorker] = None
         self._download_thread: Optional[QThread] = None
         self._download_worker: Optional[UpdateDownloadWorker] = None
 
-        saved_url = repository.get(UPDATE_MANIFEST_SETTING, "")
-        page.updateManifestUrlInput.setText(
-            saved_url if isinstance(saved_url, str) else ""
+        saved_url_record = repository.get_record(UPDATE_MANIFEST_SETTING)
+        saved_username_record = repository.get_record(UPDATE_USERNAME_SETTING)
+        saved_url = (
+            saved_url_record.value
+            if saved_url_record is not None and isinstance(saved_url_record.value, str)
+            else DEFAULT_UPDATE_MANIFEST_URL
         )
+        saved_username = (
+            saved_username_record.value
+            if saved_username_record is not None
+            and isinstance(saved_username_record.value, str)
+            else DEFAULT_UPDATE_USERNAME
+        )
+        page.updateManifestUrlInput.setText(saved_url)
+        page.updateUsernameInput.setText(saved_username)
+        page.updatePasswordInput.clear()
+        self._saved_url = saved_url if saved_url_record is not None else ""
+        self._saved_username = (
+            saved_username if saved_username_record is not None else ""
+        )
+
+        credential_ready = self._set_password_placeholder(saved_url)
+        page.updateSaveButton.clicked.connect(self.request_save)
         page.updateCheckButton.clicked.connect(self.request_check)
-        self._sync_button()
+        self._sync_controls()
+
+        if self._saved_url and self._saved_username and credential_ready:
+            QTimer.singleShot(0, self.request_check)
+
+    def _credential_store_for(self, manifest_url: str):
+        if self._credential_store_override is not None:
+            return self._credential_store_override
+        return WindowsCredentialStore.for_url(manifest_url)
+
+    def _set_password_placeholder(self, manifest_url: str) -> bool:
+        try:
+            saved = self._credential_store_for(manifest_url).read()
+        except CredentialStoreError as exc:
+            self._page.updatePasswordInput.setPlaceholderText("凭据管理器不可用")
+            self._page.set_update_status(str(exc))
+            return False
+        if saved is None:
+            self._page.updatePasswordInput.setPlaceholderText("请输入密码")
+            return False
+        self._page.updatePasswordInput.setPlaceholderText(
+            "密码已安全保存；留空表示不修改"
+        )
+        return True
+
+    @pyqtSlot()
+    def request_save(self) -> None:
+        """显式保存非敏感设置和 Windows 系统凭据。"""
+
+        if self._closing or self._is_busy():
+            return
+        manifest_url = self._page.updateManifestUrlInput.text().strip()
+        username = self._page.updateUsernameInput.text().strip()
+        password = self._page.updatePasswordInput.text()
+        self._page.updateManifestUrlInput.setText(manifest_url)
+        self._page.updateUsernameInput.setText(username)
+
+        try:
+            normalized_url = validate_manifest_url(manifest_url)
+        except Exception as exc:
+            self._page.set_update_status(f"保存失败：{exc}")
+            self._page.updateManifestUrlInput.setFocus()
+            return
+        if not username:
+            self._page.set_update_status("保存失败：更新账号不能为空")
+            self._page.updateUsernameInput.setFocus()
+            return
+
+        try:
+            credential_store = self._credential_store_for(normalized_url)
+            existing = credential_store.read()
+            if password:
+                credential_store.save(username, password)
+            elif existing is None:
+                self._page.set_update_status("保存失败：请填写更新密码")
+                self._page.updatePasswordInput.setFocus()
+                return
+            elif existing[0] != username:
+                self._page.set_update_status("账号已修改，请重新填写密码后保存")
+                self._page.updatePasswordInput.setFocus()
+                return
+            self._repository.set_many(
+                {
+                    UPDATE_MANIFEST_SETTING: normalized_url,
+                    UPDATE_USERNAME_SETTING: username,
+                }
+            )
+        except (CredentialStoreError, OSError, sqlite3.Error, ValueError) as exc:
+            self._page.set_update_status(f"保存失败：{exc}")
+            return
+
+        self._saved_url = normalized_url
+        self._saved_username = username
+        self._page.updatePasswordInput.clear()
+        self._set_password_placeholder(normalized_url)
+        self._page.set_update_status("更新设置已安全保存")
 
     @pyqtSlot()
     def request_check(self) -> None:
-        if self._closing or self._check_thread is not None or self._download_thread is not None:
+        if self._closing or self._is_busy():
             return
         manifest_url = self._page.updateManifestUrlInput.text().strip()
-        self._page.updateManifestUrlInput.setText(manifest_url)
-        try:
-            validate_manifest_url(manifest_url)
-        except Exception as exc:
-            self._page.set_update_status(f"无法检查：{exc}")
-            self._page.updateManifestUrlInput.setFocus()
+        username = self._page.updateUsernameInput.text().strip()
+        if not self._saved_url or not self._saved_username:
+            self._page.set_update_status("尚未保存更新账号和密码，请填写后保存")
+            self._page.updatePasswordInput.setFocus()
+            return
+        if (
+            manifest_url != self._saved_url
+            or username != self._saved_username
+            or self._page.updatePasswordInput.text()
+        ):
+            self._page.set_update_status("更新设置有修改，请先保存后再检查")
+            self._page.updateSaveButton.setFocus()
+            return
+
+        credentials = self._read_credentials(username)
+        if credentials is None:
             return
 
         self._page.set_update_status("正在检查新版本…")
         thread = QThread(self)
-        worker = UpdateCheckWorker(
-            self._service,
-            self._repository,
-            manifest_url,
-        )
+        worker = UpdateCheckWorker(self._service, manifest_url, credentials)
         worker.moveToThread(thread)
         thread.started.connect(worker.run)
         worker.succeeded.connect(self._on_check_succeeded)
@@ -155,9 +272,26 @@ class UpdateUiEventBinder(QObject):
         thread.finished.connect(thread.deleteLater)
         self._check_thread = thread
         self._check_worker = worker
-        self._sync_button()
+        self._sync_controls()
         thread.start()
 
+    def _read_credentials(self, expected_username: str) -> Optional[UpdateCredentials]:
+        try:
+            saved = self._credential_store_for(self._saved_url).read()
+        except CredentialStoreError as exc:
+            self._page.set_update_status(f"无法读取更新密码：{exc}")
+            return None
+        if saved is None:
+            self._page.set_update_status("尚未保存更新密码，请填写后保存")
+            self._page.updatePasswordInput.setFocus()
+            return None
+        username, password = saved
+        if username != expected_username:
+            self._page.set_update_status("保存的账号不一致，请重新填写密码并保存")
+            self._page.updatePasswordInput.setFocus()
+            return None
+        return UpdateCredentials(username, password)
+
     @pyqtSlot(object)
     def _on_check_succeeded(self, result: UpdateCheckResult) -> None:
         if self._closing:
@@ -181,9 +315,7 @@ class UpdateUiEventBinder(QObject):
         dialog.cancelButton.setText("暂不下载")
         dialog.cancelButton.setFocus()
         if not dialog.exec():
-            self._page.set_update_status(
-                f"发现新版本 {update.version}，尚未下载"
-            )
+            self._page.set_update_status(f"发现新版本 {update.version}，尚未下载")
             return
         self._start_download(update)
 
@@ -191,7 +323,7 @@ class UpdateUiEventBinder(QObject):
     def _on_check_failed(self, message: str) -> None:
         if not self._closing:
             self._page.set_update_status(
-                f"检查失败：{message}；地址已保留，可以重试"
+                f"检查失败：{message}；设置已保留，可以重试"
             )
 
     @pyqtSlot()
@@ -199,14 +331,17 @@ class UpdateUiEventBinder(QObject):
         self._check_worker = None
         self._check_thread = None
         if not self._closing:
-            self._sync_button()
+            self._sync_controls()
 
     def _start_download(self, update: UpdateInfo) -> None:
         if self._closing or self._download_thread is not None:
             return
+        credentials = self._read_credentials(self._saved_username)
+        if credentials is None:
+            return
         self._page.set_update_status(f"正在下载版本 {update.version}（0%）…")
         thread = QThread(self)
-        worker = UpdateDownloadWorker(self._service, update)
+        worker = UpdateDownloadWorker(self._service, update, credentials)
         worker.moveToThread(thread)
         thread.started.connect(worker.run)
         worker.progressChanged.connect(self._on_download_progress)
@@ -218,7 +353,7 @@ class UpdateUiEventBinder(QObject):
         thread.finished.connect(thread.deleteLater)
         self._download_thread = thread
         self._download_worker = worker
-        self._sync_button()
+        self._sync_controls()
         thread.start()
 
     @pyqtSlot(int)
@@ -245,16 +380,22 @@ class UpdateUiEventBinder(QObject):
         self._download_worker = None
         self._download_thread = None
         if not self._closing:
-            self._sync_button()
+            self._sync_controls()
 
-    def _sync_button(self) -> None:
-        busy = self._check_thread is not None or self._download_thread is not None
-        self._page.updateCheckButton.setEnabled(not self._closing and not busy)
-        self._page.updateManifestUrlInput.setEnabled(not self._closing and not busy)
+    def _is_busy(self) -> bool:
+        return self._check_thread is not None or self._download_thread is not None
+
+    def _sync_controls(self) -> None:
+        enabled = not self._closing and not self._is_busy()
+        self._page.updateSaveButton.setEnabled(enabled)
+        self._page.updateCheckButton.setEnabled(enabled)
+        self._page.updateManifestUrlInput.setEnabled(enabled)
+        self._page.updateUsernameInput.setEnabled(enabled)
+        self._page.updatePasswordInput.setEnabled(enabled)
 
     @pyqtSlot()
     def shutdown(self) -> None:
-        """取消后续处理，断开业务结果并短暂等待线程退出。"""
+        """取消后续处理，断开业务结果并等待线程安全退出。"""
 
         if self._closing:
             return
@@ -290,6 +431,5 @@ class UpdateUiEventBinder(QObject):
                     pass
             if thread is not None and thread.isRunning():
                 thread.quit()
-                # 网络读超时是 10 秒；多等 1 秒，避免关闭窗口时销毁仍在运行的 QThread。
                 thread.wait(11000)
-        self._sync_button()
+        self._sync_controls()

client/src/version.py

@@ -3,4 +3,4 @@
 发布脚本和程序界面需要版本号时都从这里读取，避免多个文件各写一份。
 """
 
-__version__ = "0.2.0"
+__version__ = "0.2.1"

client/src/windows_credential_store.py

@@ -0,0 +1,168 @@
+"""使用 Windows 凭据管理器保存在线更新密码。
+
+密码只在调用期间存在于内存，不进入 SQLite、日志或普通错误信息。本模块只使用
+Windows 自带 Credential API，不增加第三方依赖。
+"""
+
+from __future__ import annotations
+
+import ctypes
+import sys
+from ctypes import wintypes
+from typing import Optional
+from urllib.parse import urlsplit
+
+
+UPDATE_CREDENTIAL_TARGET_PREFIX = "CMAutoBuy/update"
+_CRED_TYPE_GENERIC = 1
+_CRED_PERSIST_LOCAL_MACHINE = 2
+_ERROR_NOT_FOUND = 1168
+
+
+class CredentialStoreError(RuntimeError):
+    """Windows 凭据管理器操作失败。"""
+
+
+class _CredentialW(ctypes.Structure):
+    _fields_ = [
+        ("Flags", wintypes.DWORD),
+        ("Type", wintypes.DWORD),
+        ("TargetName", wintypes.LPWSTR),
+        ("Comment", wintypes.LPWSTR),
+        ("LastWritten", wintypes.FILETIME),
+        ("CredentialBlobSize", wintypes.DWORD),
+        ("CredentialBlob", ctypes.POINTER(ctypes.c_ubyte)),
+        ("Persist", wintypes.DWORD),
+        ("AttributeCount", wintypes.DWORD),
+        ("Attributes", wintypes.LPVOID),
+        ("TargetAlias", wintypes.LPWSTR),
+        ("UserName", wintypes.LPWSTR),
+    ]
+
+
+class WindowsCredentialStore:
+    """读写当前 Windows 用户的通用凭据。"""
+
+    def __init__(self, target: str):
+        self._target = target
+        if sys.platform != "win32":
+            self._api = None
+            return
+        api = ctypes.WinDLL("Advapi32.dll", use_last_error=True)
+        api.CredWriteW.argtypes = [ctypes.POINTER(_CredentialW), wintypes.DWORD]
+        api.CredWriteW.restype = wintypes.BOOL
+        api.CredReadW.argtypes = [
+            wintypes.LPCWSTR,
+            wintypes.DWORD,
+            wintypes.DWORD,
+            ctypes.POINTER(ctypes.POINTER(_CredentialW)),
+        ]
+        api.CredReadW.restype = wintypes.BOOL
+        api.CredDeleteW.argtypes = [
+            wintypes.LPCWSTR,
+            wintypes.DWORD,
+            wintypes.DWORD,
+        ]
+        api.CredDeleteW.restype = wintypes.BOOL
+        api.CredFree.argtypes = [wintypes.LPVOID]
+        api.CredFree.restype = None
+        self._api = api
+
+    @property
+    def target(self) -> str:
+        """返回不含密码的系统凭据目标名。"""
+
+        return self._target
+
+    @classmethod
+    def for_url(cls, url: str) -> "WindowsCredentialStore":
+        """按 URL 源创建独立凭据，避免把一个服务器密码发送给另一个服务器。"""
+
+        parsed = urlsplit(url)
+        scheme = parsed.scheme.lower()
+        host = (parsed.hostname or "").lower()
+        if not scheme or not host:
+            raise CredentialStoreError("无法为无效更新地址保存密码")
+        port = parsed.port or (443 if scheme == "https" else 80)
+        return cls(f"{UPDATE_CREDENTIAL_TARGET_PREFIX}/{scheme}/{host}/{port}")
+
+    def save(self, username: str, password: str) -> None:
+        """保存账号和密码；密码为空时拒绝覆盖已有凭据。"""
+
+        api = self._require_windows()
+        normalized_username = username.strip()
+        if not normalized_username:
+            raise CredentialStoreError("更新账号不能为空")
+        if not password:
+            raise CredentialStoreError("更新密码不能为空")
+
+        password_bytes = password.encode("utf-16-le")
+        if len(password_bytes) > 2560:
+            raise CredentialStoreError("更新密码过长")
+        blob = ctypes.create_string_buffer(password_bytes)
+        credential = _CredentialW()
+        credential.Type = _CRED_TYPE_GENERIC
+        credential.TargetName = self._target
+        credential.CredentialBlobSize = len(password_bytes)
+        credential.CredentialBlob = ctypes.cast(
+            blob,
+            ctypes.POINTER(ctypes.c_ubyte),
+        )
+        credential.Persist = _CRED_PERSIST_LOCAL_MACHINE
+        credential.UserName = normalized_username
+        if not api.CredWriteW(ctypes.byref(credential), 0):
+            raise self._system_error("保存更新凭据失败")
+
+    def read(self) -> Optional[tuple[str, str]]:
+        """返回保存的 ``(账号, 密码)``；不存在时返回 ``None``。"""
+
+        api = self._require_windows()
+        pointer = ctypes.POINTER(_CredentialW)()
+        if not api.CredReadW(
+            self._target,
+            _CRED_TYPE_GENERIC,
+            0,
+            ctypes.byref(pointer),
+        ):
+            error_code = ctypes.get_last_error()
+            if error_code == _ERROR_NOT_FOUND:
+                return None
+            raise self._system_error("读取更新凭据失败", error_code)
+        try:
+            credential = pointer.contents
+            password_bytes = ctypes.string_at(
+                credential.CredentialBlob,
+                credential.CredentialBlobSize,
+            )
+            password = password_bytes.decode("utf-16-le")
+            return credential.UserName or "", password
+        except (UnicodeDecodeError, ValueError) as exc:
+            raise CredentialStoreError("保存的更新凭据无法读取，请重新保存") from exc
+        finally:
+            api.CredFree(pointer)
+
+    def exists(self) -> bool:
+        """返回是否已经保存更新凭据。"""
+
+        return self.read() is not None
+
+    def delete(self) -> bool:
+        """删除更新凭据；原本不存在时返回 ``False``。"""
+
+        api = self._require_windows()
+        if api.CredDeleteW(self._target, _CRED_TYPE_GENERIC, 0):
+            return True
+        error_code = ctypes.get_last_error()
+        if error_code == _ERROR_NOT_FOUND:
+            return False
+        raise self._system_error("删除更新凭据失败", error_code)
+
+    def _require_windows(self):
+        if self._api is None:
+            raise CredentialStoreError("更新密码只能保存到 Windows 凭据管理器")
+        return self._api
+
+    @staticmethod
+    def _system_error(message: str, error_code: Optional[int] = None):
+        code = ctypes.get_last_error() if error_code is None else error_code
+        return CredentialStoreError(f"{message}（Windows 错误 {code}）")

client/test/test_update_service.py

@@ -1,18 +1,23 @@
 """在线更新清单、下载校验和安全解压测试。"""
 
+import base64
 import hashlib
 import io
 import json
 import tempfile
 import unittest
+import urllib.request
 import zipfile
 from pathlib import Path
 
 from src.update_service import (
+    DEFAULT_UPDATE_MANIFEST_URL,
     UnsafeUpdateArchiveError,
     UpdateConfigurationError,
     UpdateIntegrityError,
+    UpdateCredentials,
     UpdateService,
+    _SameOriginRedirectHandler,
     mark_current_version_healthy,
     parse_version,
     validate_manifest_url,
@@ -41,9 +46,11 @@ class FakeUrlOpen:
     def __init__(self, responses):
         self.responses = responses
         self.requested_urls = []
+        self.requested_headers = []
 
     def __call__(self, request, timeout):
         self.requested_urls.append((request.full_url, timeout))
+        self.requested_headers.append(dict(request.header_items()))
         content, final_url = self.responses[request.full_url]
         return FakeResponse(content, final_url, len(content))
 
@@ -107,6 +114,10 @@ class UpdateServiceTest(unittest.TestCase):
             validate_manifest_url(self.manifest_url),
             self.manifest_url,
         )
+        self.assertEqual(
+            validate_manifest_url(DEFAULT_UPDATE_MANIFEST_URL),
+            DEFAULT_UPDATE_MANIFEST_URL,
+        )
         for invalid in (
             "http://updates.example.test/manifest.json",
             "https://user:pass@updates.example.test/manifest.json",
@@ -118,6 +129,56 @@ class UpdateServiceTest(unittest.TestCase):
             ):
                 validate_manifest_url(invalid)
 
+    def test_basic_auth_is_used_for_manifest_and_update_without_repr_leak(self):
+        update_content = make_update_zip()
+        service, opener = self.service_with(update_content)
+        credentials = UpdateCredentials("release-reader", "unit-test-password")
+
+        result = service.check(
+            self.manifest_url,
+            "0.1.0",
+            credentials=credentials,
+        )
+        service.download_and_stage(result.update, credentials=credentials)
+
+        expected = "Basic " + base64.b64encode(
+            b"release-reader:unit-test-password"
+        ).decode("ascii")
+        self.assertEqual(len(opener.requested_headers), 2)
+        self.assertTrue(
+            all(
+                headers.get("Authorization") == expected
+                for headers in opener.requested_headers
+            )
+        )
+        self.assertNotIn("unit-test-password", repr(credentials))
+
+    def test_default_unicode_manifest_path_is_encoded_for_http_request(self):
+        request = UpdateService._make_request(
+            DEFAULT_UPDATE_MANIFEST_URL,
+            UpdateCredentials("release-reader", "unit-test-password"),
+        )
+
+        self.assertNotIn("——", request.full_url)
+        self.assertIn("%E2%80%94%E2%80%94", request.full_url)
+
+    def test_authenticated_redirect_cannot_change_origin(self):
+        handler = _SameOriginRedirectHandler()
+        request = urllib.request.Request(
+            "https://updates.example.test/manifest.json",
+            headers={"Authorization": "Basic test"},
+        )
+
+        with self.assertRaises(UpdateConfigurationError):
+            handler.redirect_request(
+                request,
+                None,
+                302,
+                "Found",
+                {},
+                "https://other.example.test/manifest.json",
+            )
+
     def test_check_reports_newer_and_current_versions(self):
         update_content = make_update_zip()
         service, _opener = self.service_with(update_content)
@@ -196,7 +257,7 @@ class UpdateServiceTest(unittest.TestCase):
         health = json.loads(
             (self.update_directory / "healthy.json").read_text(encoding="utf-8")
         )
-        self.assertEqual(health["version"], "0.2.0")
+        self.assertEqual(health["version"], "0.2.1")
 
 
 if __name__ == "__main__":

client/test/test_update_ui_event.py

@@ -1,4 +1,4 @@
-"""设置页在线更新 UI 和后台线程测试。"""
+"""设置页认证更新配置、自动检查和后台线程测试。"""
 
 import os
 import tempfile
@@ -11,38 +11,72 @@ os.environ.setdefault("QT_QPA_PLATFORM", "offscreen")
 
 from PyQt5.QtCore import QTimer
 from PyQt5.QtTest import QTest
-from PyQt5.QtWidgets import QApplication
+from PyQt5.QtWidgets import QApplication, QLineEdit
 
 from src.mock_admin_gateway import MockAdminGateway
 from src.settings_repository import SettingsRepository
 from src.settings_ui import SettingsPage
 from src.update_service import (
+    DEFAULT_UPDATE_MANIFEST_URL,
+    DEFAULT_UPDATE_USERNAME,
     UPDATE_MANIFEST_SETTING,
+    UPDATE_USERNAME_SETTING,
     UpdateCheckResult,
     UpdateInfo,
 )
 
 
 MANIFEST_URL = "https://updates.example.test/autobuy%E2%80%94%E2%80%94manifest.json"
+TEST_USERNAME = "release-reader"
+TEST_PASSWORD = "unit-test-password"
+
+
+class FakeCredentialStore:
+    def __init__(self, saved=None):
+        self.saved = saved
+        self.save_count = 0
+
+    def read(self):
+        return self.saved
+
+    def save(self, username, password):
+        self.saved = (username, password)
+        self.save_count += 1
 
 
 class FakeUpdateService:
     def __init__(self, result=None, delay=0.0, download_error=None):
-        self.result = result or UpdateCheckResult("0.2.0", "0.2.0", False)
+        self.result = result or UpdateCheckResult("0.2.1", "0.2.1", False)
         self.delay = delay
         self.download_error = download_error
         self.check_count = 0
         self.download_count = 0
+        self.check_credentials = None
+        self.download_credentials = None
 
-    def check(self, manifest_url, current_version="0.1.0", is_cancelled=None):
+    def check(
+        self,
+        manifest_url,
+        current_version="0.2.1",
+        is_cancelled=None,
+        credentials=None,
+    ):
         self.check_count += 1
         self.manifest_url = manifest_url
+        self.check_credentials = credentials
         if self.delay:
             time.sleep(self.delay)
         return self.result
 
-    def download_and_stage(self, update, is_cancelled=None, on_progress=None):
+    def download_and_stage(
+        self,
+        update,
+        is_cancelled=None,
+        on_progress=None,
+        credentials=None,
+    ):
         self.download_count += 1
+        self.download_credentials = credentials
         if on_progress is not None:
             on_progress(50)
         if self.download_error is not None:
@@ -76,18 +110,19 @@ class UpdateUiEventTest(unittest.TestCase):
 
     def setUp(self):
         self.temporary_directory = tempfile.TemporaryDirectory()
-        self.repository = SettingsRepository(
-            Path(self.temporary_directory.name) / "client.db"
-        )
+        self.db_path = Path(self.temporary_directory.name) / "client.db"
+        self.repository = SettingsRepository(self.db_path)
+        self.credential_store = FakeCredentialStore()
 
     def tearDown(self):
         self.temporary_directory.cleanup()
 
-    def _page(self, service):
+    def _page(self, service, credential_store=None):
         return SettingsPage(
             settings_repository=self.repository,
             admin_gateway=MockAdminGateway(),
             update_service=service,
+            update_credential_store=credential_store or self.credential_store,
         )
 
     def _wait_until(self, predicate, timeout_ms=2000):
@@ -97,24 +132,86 @@ class UpdateUiEventTest(unittest.TestCase):
             elapsed += 10
         self.assertTrue(predicate(), "等待在线更新线程超时")
 
-    def test_update_card_loads_saved_url_and_current_version(self):
-        self.repository.set(UPDATE_MANIFEST_SETTING, MANIFEST_URL)
+    def _save_configuration(self, page):
+        page.updateManifestUrlInput.setText(MANIFEST_URL)
+        page.updateUsernameInput.setText(TEST_USERNAME)
+        page.updatePasswordInput.setText(TEST_PASSWORD)
+        page.updateSaveButton.click()
+
+    def test_update_card_uses_safe_defaults_and_password_input(self):
         page = self._page(FakeUpdateService())
 
-        self.assertEqual(page.currentVersionLabel.text(), "0.2.0")
-        self.assertEqual(page.updateManifestUrlInput.text(), MANIFEST_URL)
-        self.assertTrue(page.updateCheckButton.isEnabled())
+        self.assertEqual(page.currentVersionLabel.text(), "0.2.1")
+        self.assertEqual(
+            page.updateManifestUrlInput.text(), DEFAULT_UPDATE_MANIFEST_URL
+        )
+        self.assertEqual(page.updateUsernameInput.text(), DEFAULT_UPDATE_USERNAME)
+        self.assertEqual(page.updatePasswordInput.text(), "")
+        self.assertEqual(page.updatePasswordInput.echoMode(), QLineEdit.Password)
+        self.assertTrue(page.updateSaveButton.isEnabled())
         page.eventBinder.shutdown()
         page.deleteLater()
 
-    def test_http_url_is_rejected_before_starting_worker(self):
+    def test_save_uses_sqlite_for_non_secret_and_credential_store_for_password(self):
+        page = self._page(FakeUpdateService())
+
+        self._save_configuration(page)
+
+        self.assertEqual(
+            self.repository.get(UPDATE_MANIFEST_SETTING), MANIFEST_URL
+        )
+        self.assertEqual(self.repository.get(UPDATE_USERNAME_SETTING), TEST_USERNAME)
+        self.assertEqual(
+            self.credential_store.saved,
+            (TEST_USERNAME, TEST_PASSWORD),
+        )
+        self.assertNotIn(TEST_PASSWORD.encode(), self.db_path.read_bytes())
+        self.assertEqual(page.updatePasswordInput.text(), "")
+        self.assertIn("已安全保存", page.updatePasswordInput.placeholderText())
+        page.eventBinder.shutdown()
+        page.deleteLater()
+
+    def test_blank_password_preserves_existing_credential(self):
+        self.repository.set_many(
+            {
+                UPDATE_MANIFEST_SETTING: MANIFEST_URL,
+                UPDATE_USERNAME_SETTING: TEST_USERNAME,
+            }
+        )
+        store = FakeCredentialStore((TEST_USERNAME, TEST_PASSWORD))
+        page = self._page(FakeUpdateService(), store)
+
+        page.updateSaveButton.click()
+
+        self.assertEqual(store.save_count, 0)
+        self.assertEqual(store.saved, (TEST_USERNAME, TEST_PASSWORD))
+        self.assertIn("安全保存", page.updateStatusLabel.text())
+        page.eventBinder.shutdown()
+        page.deleteLater()
+
+    def test_missing_password_stops_save_and_check(self):
         service = FakeUpdateService()
         page = self._page(service)
-        page.updateManifestUrlInput.setText("http://updates.example.test/manifest.json")
 
+        page.updateSaveButton.click()
         page.updateCheckButton.click()
 
-        self.assertIn("必须是有效的 HTTPS", page.updateStatusLabel.text())
+        self.assertIn("密码", page.updateStatusLabel.text())
+        self.assertEqual(service.check_count, 0)
+        page.eventBinder.shutdown()
+        page.deleteLater()
+
+    def test_unapproved_http_url_is_rejected_when_saving(self):
+        service = FakeUpdateService()
+        page = self._page(service)
+        page.updateManifestUrlInput.setText(
+            "http://updates.example.test/manifest.json"
+        )
+        page.updatePasswordInput.setText(TEST_PASSWORD)
+
+        page.updateSaveButton.click()
+
+        self.assertIn("HTTP 只允许固定发布服务器", page.updateStatusLabel.text())
         self.assertEqual(service.check_count, 0)
         page.eventBinder.shutdown()
         page.deleteLater()
@@ -122,7 +219,7 @@ class UpdateUiEventTest(unittest.TestCase):
     def test_slow_check_does_not_block_or_start_twice(self):
         service = FakeUpdateService(delay=0.08)
         page = self._page(service)
-        page.updateManifestUrlInput.setText(MANIFEST_URL)
+        self._save_configuration(page)
         timer_fired = []
         QTimer.singleShot(10, lambda: timer_fired.append(True))
 
@@ -134,27 +231,46 @@ class UpdateUiEventTest(unittest.TestCase):
         )
 
         self.assertEqual(service.check_count, 1)
-        self.assertEqual(
-            self.repository.get(UPDATE_MANIFEST_SETTING), MANIFEST_URL
-        )
+        self.assertEqual(service.check_credentials.username, TEST_USERNAME)
+        self.assertEqual(service.check_credentials.password, TEST_PASSWORD)
         self.assertIn("当前已是最新版本", page.updateStatusLabel.text())
         page.eventBinder.shutdown()
         page.deleteLater()
 
-    def test_confirmed_new_version_downloads_and_stages(self):
+    def test_saved_configuration_checks_automatically_after_startup(self):
+        self.repository.set_many(
+            {
+                UPDATE_MANIFEST_SETTING: MANIFEST_URL,
+                UPDATE_USERNAME_SETTING: TEST_USERNAME,
+            }
+        )
+        store = FakeCredentialStore((TEST_USERNAME, TEST_PASSWORD))
+        service = FakeUpdateService()
+
+        page = self._page(service, store)
+        self._wait_until(lambda: service.check_count == 1)
+        self._wait_until(
+            lambda: page.eventBinder.updateEventBinder._check_thread is None
+        )
+
+        self.assertIn("当前已是最新版本", page.updateStatusLabel.text())
+        page.eventBinder.shutdown()
+        page.deleteLater()
+
+    def test_confirmed_new_version_downloads_with_saved_credentials(self):
         update = UpdateInfo(
-            version="0.2.0",
+            version="0.3.0",
             manifest_url=MANIFEST_URL,
-            update_url="https://updates.example.test/CMAutoBuy-0.2.0-update.zip",
-            file_name="CMAutoBuy-0.2.0-update.zip",
+            update_url="https://updates.example.test/CMAutoBuy-0.3.0-update.zip",
+            file_name="CMAutoBuy-0.3.0-update.zip",
             size=1024,
             sha256="0" * 64,
         )
         service = FakeUpdateService(
-            UpdateCheckResult("0.1.0", "0.2.0", True, update)
+            UpdateCheckResult("0.2.1", "0.3.0", True, update)
         )
         page = self._page(service)
-        page.updateManifestUrlInput.setText(MANIFEST_URL)
+        self._save_configuration(page)
 
         with patch("src.update_ui_event.MessageBox", AcceptDownloadMessageBox):
             page.updateCheckButton.click()
@@ -164,8 +280,9 @@ class UpdateUiEventTest(unittest.TestCase):
             )
 
         self.assertEqual(service.download_count, 1)
+        self.assertEqual(service.download_credentials.username, TEST_USERNAME)
+        self.assertEqual(service.download_credentials.password, TEST_PASSWORD)
         self.assertIn("已准备好", page.updateStatusLabel.text())
-        self.assertIn("重新启动", page.updateStatusLabel.text())
         page.eventBinder.shutdown()
         page.deleteLater()
 

client/test/test_windows_credential_store.py

@@ -0,0 +1,26 @@
+"""Windows 更新凭据按服务器隔离的测试。"""
+
+import unittest
+
+from src.windows_credential_store import WindowsCredentialStore
+
+
+class WindowsCredentialStoreTest(unittest.TestCase):
+    def test_different_origins_use_different_credential_targets(self):
+        http_store = WindowsCredentialStore.for_url(
+            "http://cm.xiapi.com/autobuy——manifest.json"
+        )
+        https_store = WindowsCredentialStore.for_url(
+            "https://cm.xiapi.com/autobuy——manifest.json"
+        )
+        other_store = WindowsCredentialStore.for_url(
+            "https://updates.example.test/manifest.json"
+        )
+
+        self.assertNotEqual(http_store.target, https_store.target)
+        self.assertNotEqual(https_store.target, other_store.target)
+        self.assertNotIn("@", http_store.target)
+
+
+if __name__ == "__main__":
+    unittest.main()

docs/client/00-glossary.md

@@ -84,6 +84,7 @@ Admin 想知道某台 Client 是不是卡死了，用"领取后超时重派"就
 | 模态对话框 | 弹出来必须先处理它、否则动不了主窗口的窗口。**很打断人，只在必须做决定时用** | 高危确认 |
 | DPI / 显示缩放 | Windows 里"文字和应用的大小"那个百分比设置 | 需验证 100%~200% |
 | 高对比度 | Windows 的一种无障碍主题，颜色极简 | 需验证界面不能只靠颜色区分状态 |
+| Windows 凭据管理器 | Windows 专门保存密码等秘密的系统存储，普通 SQLite 和日志不应代替它 | 保存在线更新密码，界面不回填明文 |
 
 ## 4. 自动化和安全
 

docs/client/01-requirements.md

@@ -134,7 +134,7 @@ Client 应执行：
 2. **Android 设备：**ADB 地址、拼多多包名、设备测试连接。
 3. **自动化：**轮询周期、任务超时、最大重试次数和演练模式。
 4. **安全与诊断：**价格允许偏差、最大购买数量、日志目录、截图/XML 保留周期。
-5. **软件更新：**当前版本、HTTPS 更新清单地址、检查按钮和稳定状态文字。
+5. **软件更新：**当前版本、清单地址、账号、密码、保存/检查按钮和稳定状态文字。
 
 密码和访问令牌不得以明文写入普通 SQLite 设置或日志。
 
@@ -214,13 +214,15 @@ CMAutoBuy/                    整个文件夹拷到任何机器都能用
 `autobuy——manifest.json`。清单至少记录版本、文件名、字节大小和 SHA256；SHA256
 用于发现下载损坏，不等同于发布者身份认证。
 
-**在线更新：**操作人员在设置页填写完整 HTTPS 清单地址并主动检查。发现新版本后
-必须由用户确认下载；下载、校验和安全解压在后台线程完成，只写入
+**在线更新：**设置页默认显示已确认的发布清单地址和账号，密码由操作人员首次
+填写并保存到 Windows 凭据管理器；URL 和账号作为非敏感设置保存在 SQLite，密码
+不回填明文。保存完整配置后，Client 启动时在后台检查一次，也可手动检查。发现
+新版本后必须由用户确认下载；下载、校验和安全解压在后台线程完成，只写入
 `data/update/`。程序不会强制退出，用户下次通过 `Launcher.exe` 启动时才替换
 `app/`。Launcher 保留一份 `app.old/`，目录移动失败或新版本没有写入健康标记时
-恢复旧版本。更新包必须与清单同源；重定向后仍必须是 HTTPS；不允许忽略 TLS
-证书错误，也不在更新地址中保存账号密码。
-更新地址还不得包含查询参数或片段，避免 token 一类凭据被持久化。
+恢复旧版本。更新包必须与清单同源且重定向不得跨源。一般地址只允许 HTTPS；当前
+固定发布主机按已确认方案临时允许默认端口 HTTP 和 Basic Authentication。URL
+不得包含账号密码、查询参数或片段，认证密码不得写入源码、Git、SQLite 或日志。
 
 `0.1.0` 的 Launcher 没有应用在线更新的能力，因此第一次升级到带在线更新的
 `0.2.0` 仍需人工替换一次完整程序；从 `0.2.0` 开始才可使用上述流程。当前没有

docs/client/02-architecture.md

@@ -145,8 +145,9 @@ client/
 - Repository 封装 SQLite，界面和自动化代码不得直接拼接业务 SQL。
 - PDD Adapter 封装设备连接、页面识别、采集和采购。
 - ArtifactStore 保存失败截图、无障碍 XML 和结构化诊断文件。
-- `UpdateService` 只负责 HTTPS 清单、下载校验和安全暂存；正在运行的主程序不替换
-  自身，目录替换与回退只由下一次启动的 `Launcher.exe` 执行。
+- `UpdateService` 负责认证清单、下载校验和安全暂存；URL/账号由 Repository 保存，
+  密码只从 Windows 凭据管理器短暂读入内存。正在运行的主程序不替换自身，目录
+  替换与回退只由下一次启动的 `Launcher.exe` 执行。
 
 ## 5. 线程模型
 
@@ -165,7 +166,7 @@ Qt 主线程
 └── Outbox 重试，不重复执行 PDD 操作
 
 更新工作线程
-├── 检查 HTTPS 清单
+├── 读取系统凭据并检查认证清单
 └── 下载、SHA256 校验和安全解压到 data/update/
 ```
 
@@ -293,14 +294,15 @@ def _on_finished(self, remote_task_id: str, result) -> None:
 ### 5.3 在线更新启动顺序
 
 ```text
-主程序：HTTPS 清单 → 用户确认 → 下载并校验 → data/update/app.new + pending.json
+主程序：系统凭据 → 认证清单 → 用户确认 → 下载并校验 → app.new + pending.json
 Launcher：确认主程序未运行 → app 改名 app.old → app.new 改名 app → 启动主程序
 主程序：窗口成功创建 → 写 healthy.json
 Launcher：健康标记正确则完成；提前退出则恢复 app.old
 ```
 
 更新 ZIP 只允许 `app/` 内容，拒绝绝对路径、`..`、反斜杠路径和符号链接。Launcher
-不联网、不处理凭据，也不自更新。
+不联网、不处理凭据，也不自更新。启动自动检查只在 URL、账号和系统密码都已保存时
+执行，网络失败只更新设置页状态，不阻止主窗口使用。
 
 ## 6. 任务引擎状态
 

docs/client/05-ui-specification.md

@@ -299,8 +299,12 @@ class TaskTableModel(QAbstractTableModel):
 ### 软件更新
 
 - 显示只读的当前版本；
-- 清单地址使用带可见标签的单行输入框，只允许完整 HTTPS URL；
-- “检查更新”同时保存已验证的非敏感清单地址；检查和下载期间按钮防重复；
+- 清单地址、账号和密码分别使用带可见标签的单行输入框，密码框默认隐藏且不回填；
+- “保存”把 URL/账号写入 SQLite，把密码写入 Windows 凭据管理器；已有密码时留空
+  表示不修改，修改账号时必须重新输入密码；
+- “检查更新”只使用已经保存的配置；存在未保存修改时先提示保存；检查和下载期间
+  输入框及按钮禁用，防止并行任务和配置竞态；
+- 已保存完整配置时启动后自动检查一次；没有新版或网络失败不弹模态框；
 - 状态文字稳定显示未配置、检查中、已是最新、发现新版、下载进度、已准备、失败和
   恢复建议；
 - 发现新版本时使用有明确“下载更新 / 暂不下载”的确认框；下载完成不强制重启，
@@ -322,6 +326,7 @@ class TaskTableModel(QAbstractTableModel):
 | 多个订单候选 | 状态改为“需要人工处理”，打开详情决策 |
 | 普通任务成功 | 更新行和状态区，不弹“成功”对话框 |
 | 更新检查或下载失败 | 软件更新卡片保留地址并显示原因和重试方式，当前程序不变 |
+| 更新设置保存成功 | 状态区提示已安全保存，密码输入框清空并显示已保存占位文字 |
 | 更新下载完成 | 软件更新卡片持续提示“下次启动生效”，不强制关闭程序 |
 
 ### 9.1 错误提示模板（照抄即可）

docs/client/06-quality-security.md

@@ -187,8 +187,14 @@ Artifact 写入前应脱敏，数据库只保存引用。保留周期由设置
 
 ### 8.1 在线更新安全
 
-- 清单和更新包只允许 HTTPS，不提供忽略证书错误的开关；URL 不得包含账号密码、
-  查询参数或片段，避免凭据随地址写入 SQLite 或错误提示。
+- 一般清单和更新包只允许 HTTPS；按已确认部署方案，只有固定发布主机的默认端口
+  临时允许 HTTP Basic Authentication，任何其他 HTTP 地址仍拒绝。
+- URL 不得包含账号密码、查询参数或片段。URL 和账号可写 SQLite；密码只能写入
+  Windows 凭据管理器，不得进入源码、Git、SQLite、日志、异常文本、工单或文档。
+- 不同协议、主机或端口使用不同的系统凭据目标；修改服务器地址后必须为新服务器
+  重新输入密码，不能把旧服务器密码自动发送到新地址。
+- HTTP Basic Authentication 不能防止同网段监听或中间人攻击；主机白名单只限制
+  Client 误连范围，不能替代 TLS，发布服务器具备条件后应迁移到 HTTPS。
 - 更新包必须与最终清单 URL 同源，并同时校验清单声明的字节大小和 SHA256。
 - 清单、压缩包和解压后总大小均有限制；ZIP 只能包含安全的 `app/` 内容，拒绝路径
   穿越、绝对路径、反斜杠路径和符号链接。