Release 1.7.1: download-only updates and remove netsh/startup network probes for AV FPs.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/update/update_darwin.go

@@ -8,43 +8,88 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"strconv"
-	"strings"
+	"runtime"
 )
 
-// Apply downloads the new binary and schedules replacement after exit (macOS).
+// Apply downloads the new binary into ~/Downloads (no silent self-replace).
 func Apply(ctx context.Context, manifestURL string) (string, error) {
-	latest, _, _, exe, tmp, err := prepareDownload(ctx, manifestURL)
+	st, err := Check(ctx, manifestURL)
 	if err != nil {
 		return "", err
 	}
-	_ = os.Chmod(tmp, 0o755)
-	dir := filepath.Dir(exe)
-	scriptPath := filepath.Join(dir, "navis-update.sh")
-	pid := os.Getpid()
+	if !st.Available {
+		if st.Error != "" {
+			return "", fmt.Errorf("%s", st.Error)
+		}
+		return "", fmt.Errorf("обновление не найдено")
+	}
+	if !allowedDownloadURL(st.URL) {
+		return "", fmt.Errorf("URL обновления должен быть на git.evilfox.cc или files.de4ima.uk")
+	}
 
-	script := "#!/bin/bash\n" +
-		"set -e\n" +
-		"EXE=" + shellQuote(exe) + "\n" +
-		"NEW=" + shellQuote(tmp) + "\n" +
-		"PID=" + strconv.Itoa(pid) + "\n" +
-		"while kill -0 \"$PID\" 2>/dev/null; do sleep 0.4; done\n" +
-		"sleep 0.5\n" +
-		"mv -f \"$NEW\" \"$EXE\"\n" +
-		"chmod +x \"$EXE\"\n" +
-		"rm -f " + shellQuote(scriptPath) + "\n"
-
-	if err := os.WriteFile(scriptPath, []byte(script), 0o755); err != nil {
+	home, err := os.UserHomeDir()
+	if err != nil {
 		return "", err
 	}
-	cmd := exec.Command("/bin/bash", scriptPath)
-	cmd.Dir = dir
-	if err := cmd.Start(); err != nil {
-		return "", fmt.Errorf("start updater: %w", err)
+	dir := filepath.Join(home, "Downloads")
+	_ = os.MkdirAll(dir, 0o755)
+	dest := filepath.Join(dir, fmt.Sprintf("Navis-%s-darwin-%s", sanitizeDarwinVer(st.Latest), runtime.GOARCH))
+	tmp := dest + ".part"
+	_ = os.Remove(tmp)
+	_ = os.Remove(dest)
+
+	if err := downloadFile(ctx, st.URL, tmp); err != nil {
+		return "", err
 	}
-	return latest, nil
+	if st.SHA256 != "" {
+		sum, err := fileSHA256(tmp)
+		if err != nil {
+			_ = os.Remove(tmp)
+			return "", err
+		}
+		if sum != "" && !eqFold(sum, st.SHA256) {
+			_ = os.Remove(tmp)
+			return "", fmt.Errorf("checksum mismatch")
+		}
+	}
+	if err := os.Rename(tmp, dest); err != nil {
+		_ = os.Remove(tmp)
+		return "", err
+	}
+	_ = os.Chmod(dest, 0o755)
+	_ = exec.Command("open", "-R", dest).Start()
+	return fmt.Sprintf("Скачано v%s:\n%s\nЗакройте Navis и запустите новый файл.", st.Latest, dest), nil
 }
 
-func shellQuote(s string) string {
-	return "'" + strings.ReplaceAll(s, "'", `'\''`) + "'"
+func sanitizeDarwinVer(v string) string {
+	out := make([]rune, 0, len(v))
+	for _, r := range v {
+		switch {
+		case r >= '0' && r <= '9', r >= 'a' && r <= 'z', r >= 'A' && r <= 'Z', r == '.', r == '-':
+			out = append(out, r)
+		}
+	}
+	if len(out) == 0 {
+		return "update"
+	}
+	return string(out)
+}
+
+func eqFold(a, b string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := 0; i < len(a); i++ {
+		ca, cb := a[i], b[i]
+		if ca >= 'A' && ca <= 'F' {
+			ca += 'a' - 'A'
+		}
+		if cb >= 'A' && cb <= 'F' {
+			cb += 'a' - 'A'
+		}
+		if ca != cb {
+			return false
+		}
+	}
+	return true
 }