feat(community): add cross-platform full-package updates

[haizhi03]

Related issue

N/A — maintainer-requested completion of this desktop update PR.

Summary

Enable packaged Community desktops to discover and install full updates from GitHub Releases on macOS, Windows, and Linux. Add a product-configured update module, standalone helper, signed manifests, package verification, and trial/normal startup health checks while retaining the existing desktop update API and execution behavior.

The release workflow prepares all nine platform/package targets, signs Windows MSI and EXE layers through the configured remote signer, and publishes the GitHub index only with the completed Release. Existing runtime problems are outside this migration.

Affected surfaces

• Frontend / Web
• Backend / API / Storage
• Database plugin / Driver
• JCEF / Desktop packaging
• CI / Build / Release
• Documentation only

Verification

• Commands and results:
  • mvn -B -f chat2db-community-server/pom.xml -pl :chat2db-community-jcef -am -Dmaven.test.skip=false -DskipTests=false '-Dtest=FullPackage*Test,Update*Test,NativePackageInstallerTest,SemanticVersionTest,InstalledAppVersionReaderTest,TrustedUpdateKeysTest,GitHubReleaseDesktopUpdaterTest,DesktopUpdaterRegistryTest,RestartAppHandlerTest' -Dsurefire.failIfNoSpecifiedTests=false -Dmaven.test.failure.ignore=false install — 75 tests, zero failures/errors, one Windows-only test skipped on macOS. An isolated Maven repository was used.
  • mvn -B -f chat2db-community-server/pom.xml -pl :chat2db-community-start -am -Dmaven.test.skip=true -Dchat2db.finalName=chat2db-community install — backend packaging passed; tests explicitly skipped in this build.
  • yarn test:hot-update, yarn test:application-exit, yarn lint, yarn run build:web:community --app_version=0.0.0 — passed.
  • actionlint .github/workflows/ci.yml .github/workflows/jcef_release.yml — passed.
  • ShellCheck and Bash syntax checks on the added packaging scripts — passed.
  • SKIP_BACKEND=true SKIP_FRONTEND=true COMMUNITY_RELEASE_EPOCH=1 bash script/package/package-community-jcef.sh 0.0.0 prepare — passed; all platform input directories contained version metadata and the standalone helper.
• Manual verification: Playwright CLI with an isolated backend and simulated desktop bridge verified the update notification, About navigation, failed-download retry, hidden Community Beta option, and zero console errors. Standalone helper entrypoints and dependency isolation were inspected.
• UI evidence: N/A — task screenshots and browser sessions were cleaned. This was bridge simulation, not native application replacement.
• Native Windows signing and installed-app A-to-B updates across the platform matrix remain unrun. The added CI matrix runs the updater tests on Linux, Windows, and macOS.

Risk and compatibility

• Public API or stored data: existing desktop command signatures and stored business data remain unchanged. Packaged apps gain version metadata and an update helper.
• Database or driver compatibility: N/A — no database plugin or driver behavior changes.
• Network, privacy, or security: Community requests only the official GitHub update source and permitted HTTPS asset redirects; manifests use a separate Community trust root. Release signing requires environment configuration documented in script/package/README-updates.md.
• Community / Local / Pro boundary: the update engine accepts explicit product configuration; registered product updaters retain precedence and Community keys use separate resource/property names.
• Backward compatibility: already-installed Community clients require one manual installation of a version containing the new updater. No automatic rollback is introduced. Release tags must carry a positive release_epoch annotation.

Reviewer map

• Start here: chat2db-community-updater, FullPackageDesktopUpdater, GitHubReleaseDesktopUpdater, and .github/workflows/jcef_release.yml.
• Failure condition: download/signature/package/installation/health-check failures stop the corresponding update stage and remain logged; existing failure and exit behavior is preserved.
• Rollback or disable path: disable the Community update capability/registration or revert the PR. Installed-app rollback is not implemented.

Contributor declaration

• I linked the Issue that defines this change. N/A — direct maintainer request.
• I tested the affected behavior and reported the actual results above.
• I did not include credentials, private data, or generated build output.
• I disclosed substantial AI assistance below, or this PR contains no substantial AI-generated code.

AI assistance: Codex implemented and reviewed the migration, packaging integration, and tests under maintainer direction.

[openai0229]

当前 PR 还不能合并，阻塞点如下：

1. 与最新 main 冲突

   • PR 当前状态：CONFLICTING
   • 需要先将最新 main 合并到 feat/version-update，解决冲突后重新推送。

2. 前端 CI 失败：i18n 校验
   yarn test:i18n 报错：

   • chat2db-community-client/src/i18n/es-ES/setting.ts: English source changed; update the translation and its source hash
   • chat2db-community-client/src/i18n/ko-KR/setting.ts: English source changed; update the translation and its source hash

3. Dependency Review 失败：jackson-databind
   主项目确实已经通过 Community BOM 管理 jackson-databind（当前版本为 2.15.3）。但本 PR 新增的 jpackage/updater/pom.xml 又独立直接引入了 com.fasterxml.jackson.core:jackson-databind:2.17.2，因此不会自动使用主项目 BOM 的版本。

   CI 在这个独立 updater 模块上检测到：

   • GHSA-j3rv-43j4-c7qm：PolymorphicTypeValidator bypass（high）
   • GHSA-rmj7-2vxq-3g9f：array subtype allowlist bypass（high）
   • 以及 3 个 moderate 级别问题

   请在 updater 模块中统一依赖版本并处理 Dependency Review。仅因为主项目已有这个依赖，并不能消除 updater pom.xml 的独立依赖审查结果。

处理完成后请重新推送，届时再重新检查冲突和 CI。

[haizhi03]

Thanks for the feedback. All reported blocking issues have been addressed:

• Synced with the latest main branch and resolved the conflicts.
• Fixed the i18n validation issues.
• Upgraded Jackson in the standalone updater module to 2.18.9.
• Rebuilt and updated the Windows updater.jar using Java 17.
• Fixed the Java CodeQL build configuration.

The PR is now mergeable, and all frontend/backend CI checks, Dependency Review, and Java/JavaScript CodeQL checks are passing.

Could you please review it again when you have time? Thank you!

[openai0229]

Maintainer adaptation is complete on a02270979.

• Synced current main and resolved all conflicts without force-pushing.
• Migrated the frontend to clientRuntime and retained the IDesktopUpdater / DesktopUpdaterRegistry backend boundary.
• Restored canonical updater assets to the GitHub Release workflow.
• Removed the obsolete CDN bridge path and committed updater binary; Windows packaging rebuilds the helper from source.
• Preserved the Chat2DB vX.Y.Z Release-title contract.
• Clarified the supported product behavior: packaged Windows supports in-app installation; macOS/Linux use manual GitHub Release installer download; development JCEF is check-only; Web is disabled.

Verification passed locally: full 48-module Community reactor, 223 JCEF/tools tests, 17 standalone updater tests, frontend lint/i18n/prebuild/production build, release fixtures, Actionlint/YAML/Shell/Python/whitespace checks. GitHub now reports the PR as mergeable with all five required checks passing. Native installed Windows update acceptance remains pending; Java CodeQL is still running and is not a required check.

[openai0229]

已按当前讨论收敛方案：原文件级 updater、Windows 提权 helper、canonical payload、Release workflow 改动、CDN/OSS bridge 均已从最终树移除。当前 PR 只保留 GitHub releases/latest 版本检查、稳定 Release URL 校验、About 页面打开 Release，以及对应测试和多语言文案。用户下载现有完整安装包，不在应用内替换 jar/lib/dist。最终提交：bd0ff5f3072d1d38ae3615890ef6294fbbeb6016。

[openai0229]

更正上一条说明：轻量版最终方案的提交不是 bd0ff5f3，当前 PR 头提交为 ce7c11f53e7b3f355c85c54bddc4e9511fac9c26。最终树已移除文件级 updater、Windows 提权 helper、canonical payload、Release workflow 改动以及 CDN/OSS bridge；仅保留 GitHub releases/latest 版本检查、稳定 Release URL 校验、About 页面打开 Release、测试和多语言文案。

[openai0229]

Requirement correction: the manual Release-link-only flow has been replaced. Current head 960b02309 restores automatic Community Desktop checking, download progress, native installer launch, application exit, and relaunch using the existing GitHub Release MSI/DMG/DEB/RPM/AppImage assets. It does not modify the Release workflow, add CDN/OSS, publish canonical jar/lib/dist payloads, or add an updater binary. Local frontend production build and the full 48-module Maven test/package reactor pass; native installed-package acceptance remains pending.

[openai0229]

按最新要求再次收敛：已移除 Windows/macOS/Linux 安装失败或取消后的旧版本回拉起逻辑，也移除 macOS 备份回滚。现在只有安装成功才启动新版本；安装取消或失败直接结束，不额外恢复旧应用。最新提交：94d704317。

[openai0229]

已按代码审查修复并推送 36665258e：macOS 安装脚本现在 fail-fast，避免挂载/签名/复制失败后继续破坏当前 App；Windows 提权固定使用 %WINDIR%\\System32\\msiexec.exe；安装包下载重定向改为逐跳校验 HTTPS 和允许 host；启动检查失败会显示错误提示。DEB/RPM 的 root 维护脚本属于原生包固有信任边界，已在 PR 描述中明确保留。

[openai0229]

补齐端到端更新审计日志，提交 b6cac7cee。同一 operation ID 现在贯穿 Release 检查、资产选择、逐跳重定向、下载进度、大小/SHA-256 双重校验、安装交接，以及应用退出后的 macOS/Windows/Linux 原生安装。日志位于 ~/.chat2db/chat2db-community/logs/update/<operation-id>/update.log，Windows 另有 MSI /L*v 的 native-installer.log。失败结果原子记录 stage、exitCode、reason、版本和日志路径；当前失败和下次启动检测到的 FAILED/PENDING handoff 都可直接打开对应日志。

[openai0229]

Pushed macOS review fixes in 117ca11bf6e50fedfa2e2fda4beb507cf9b1741a.

• Require the official Community Bundle ID, Developer ID Team, exact target versions, expected architecture, strict code signature, and Gatekeeper acceptance.
• Verify both the mounted App and the complete staging copy before removing the installed App.
• Split the protected-directory path into privileged staging, unprivileged verification, and privileged activation.
• Refuse the native handoff when the audit log is unhealthy, and force the final HANDOFF log plus atomic PENDING result to disk.
• Keep the agreed failure behavior: no rollback and no failed-update relaunch.

Local verification passed 31 focused updater/audit tests, 86 JCEF tests, 68 tools tests, the full 48-module Maven test/package reactor, and git diff --check. The new macOS tests execute non-destructive success, wrong-identity rejection, and administrator staging paths with temporary tool shims. No installed App replacement was executed.

[openai0229]

CI follow-up for 117ca11bf6e50fedfa2e2fda4beb507cf9b1741a: all 5 required checks passed. The remaining Java CodeQL job also completed successfully, so the full security and supply-chain workflow is green. This PR has not been merged.

[openai0229]

Scope reduction pushed in 8d5422026da7bb44af8b2b5a478fdf1a2146434e.

This PR now supports automatic updates on macOS Community Desktop only. Windows MSI and Linux AppImage/DEB/RPM implementation, detection, artifacts, and tests were removed. Windows and Linux disable the frontend capability and resolve the Community backend default to NoOpDesktopUpdater; product-registered IDesktopUpdater implementations still override the default.

The change removes 755 lines and adds 132 focused lines. Local verification passed 26 focused updater/audit tests, 81 JCEF tests, 68 tools tests, the full 48-module Maven reactor, full Community frontend prebuild/production build, lint, i18n, and bundle verification. No installed App was replaced.