[MistEO]

缓存的增量包只记录目标版本，外部升级后仍可能在下一次启动被安装。例如 v1→v3 的包没有修改引擎，安装目录已被外部更新到 v2 时，该包会把版本号写成 v3，却保留 v2 的引擎。

现在随检查结果保存项目 RID 和原始基线版本，启动恢复时同时核对这两项。自动下载、更新面板和设置页共用完成处理，先记录来源与下载返回的实际路径，再发布 completed，补齐设置页原本缺失的待安装记录。

旧记录缺少来源时会清除记录并重新检查更新，已下载文件保留。此行为也适用于历史全量包。版本比较沿用现有实现。

独立 review 发现的设置页漏存和状态发布顺序均已修复。pnpm test 125 项通过、1 项 macOS 专属测试跳过，TypeScript、Prettier 与 pnpm build 通过。新增回归执行实际服务、Zustand store 和三个生产下载回调，覆盖两个下载来源、来源匹配、外部升级、历史记录及保存顺序。原生下载和文件存在检查使用 mocks。

基于 main c321532。本次保护启动恢复，#394 的包内可选 base 哈希校验和 #416 的安装时机调整仍可分别推进。

Sourcery 总结

通过将已下载的软件包绑定到其来源项目和安装基线，保护启动时的更新恢复机制；同时统一所有下载流程中的完成处理逻辑。

Bug 修复：

• 将待处理的更新软件包绑定到项目资源和来源基线版本，以便启动恢复时拒绝来自无关项目或过时安装状态的软件包。
• 恢复设置页面下载的待处理更新跟踪，并保留实际下载的软件包路径。
• 清除旧版或不匹配的待处理记录，并在保留已下载文件的同时重新检查更新。

增强功能：

• 集中处理下载完成逻辑，确保在发布下载完成状态之前，先持久化待处理元数据；此逻辑适用于自动下载、更新面板下载和设置页面下载。

测试：

• 添加回归测试，覆盖两种下载来源、来源匹配、外部升级、旧版记录、软件包是否存在、实际路径，以及先持久化再标记完成的顺序。

Original summary in English

Summary by Sourcery

Protect startup update recovery by binding downloaded packages to their originating project and installation baseline, while unifying completion handling across all download flows.

Bug Fixes:

• Bind pending update packages to the project resource and source baseline version so startup recovery rejects packages from unrelated projects or outdated installation states.
• Restore pending-update tracking for settings-page downloads and preserve the actual downloaded package path.
• Clear legacy or mismatched pending records and recheck for updates while retaining downloaded files.

Enhancements:

• Centralize download completion handling so pending metadata is persisted before the completed download state is published across automatic, update-panel, and settings-page downloads.

Tests:

• Add regression coverage for both download sources, origin matching, external upgrades, legacy records, package existence, actual paths, and persistence-before-completion ordering.

AI 使用信息：

• 实现、内部审查：Agent 为 Codex；模型为 gpt-6-astra；思考强度为 ultra。内部子代理继承父任务配置。
• 审计交叉审查：Agent 为 Codex；模型为 gpt-6.1-sol；思考强度为 max（协调调用选定）。

[sourcery-ai]

Sorry @MistEO, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 7 hours and 39 minutes by commenting @sourcery-ai review. Upgrade to get a review now.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-11T02:47:51.634768Z	fd6b5ca	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.