feat(ota): 新增 OTA-only 热更通道; 修底部导航椭圆 FAB/点击高亮, 顶部内缩减半

.gitea/workflows/docker-build.yml

@@ -3,8 +3,11 @@ name: Docker Build and Push
 # 仅 main 分支 push 触发 (每次提交 → 自动部署)
 # 每次主分支提交: 构建前端 + 生成 OTA 升级包 (minisign 签名) → 打进 Docker 镜像 → 部署到 :3002
 # OTA 随镜像发布: 容器内 OTA_PACKAGE_DIR=/app/ota-package 指向打包的 ota-package/
+# 容器挂载具名卷 wardrobe-ota:/app/ota-package, 部署时 docker cp 把镜像内置 OTA 灌进卷;
+# 之后可运行 ota-only.yml 只更新 OTA 包 (热更前端), 无需重建镜像/APK/重启进程
 # 依赖配置注册中心 (bh.vps.honor3.com:8008):
 #   - service-wardrobe / ota : MINISIGN_PRIVATE_KEY (整段 .key 内容, 多行)
+#   - service-wardrobe / ota : OTA_ADMIN_TOKEN (单行, OTA-only 上传接口鉴权)
 on:
   push:
     branches:
@@ -42,7 +45,7 @@ jobs:
       - name: Install minisign
         run: sudo apt-get update && sudo apt-get install -y minisign
 
-      - name: Fetch config center (minisign key)
+      - name: Fetch config center (minisign key + ota admin token)
         # 私钥直接写文件 (build-ota.mjs 默认 KEY_PATH 即 ota-package/hotswap.key),
         # 绕开 GITHUB_ENV 多行值在 Gitea Actions 下不可靠的问题
         run: |
@@ -58,14 +61,20 @@ jobs:
           with urllib.request.urlopen(req, timeout=20) as r:
               data = json.load(r).get("data", [])
           key_val = next((c.get("value", "") for c in data if c.get("key") == "MINISIGN_PRIVATE_KEY"), None)
+          ota_admin = next((c.get("value", "") for c in data if c.get("key") == "OTA_ADMIN_TOKEN"), None)
           if not key_val:
               raise SystemExit("配置中心缺少 MINISIGN_PRIVATE_KEY (service-wardrobe/ota)")
+          if not ota_admin:
+              raise SystemExit("配置中心缺少 OTA_ADMIN_TOKEN (service-wardrobe/ota, 单行)")
           os.makedirs("ota-package", exist_ok=True)
           with open("ota-package/hotswap.key", "w", encoding="utf-8") as f:
               f.write(key_val if key_val.endswith("\n") else key_val + "\n")
           os.chmod("ota-package/hotswap.key", 0o600)
+          with open(os.environ["GITHUB_ENV"], "a", encoding="utf-8") as f:
+              f.write(f"OTA_ADMIN_TOKEN={ota_admin}\n")
           PYEOF
           echo "hotswap.key lines=$(wc -l < ota-package/hotswap.key)" 
+          echo "OTA_ADMIN_TOKEN set: $([ -n "${OTA_ADMIN_TOKEN}" ] && echo yes || echo no)"
 
       - name: Build & sign OTA package
         # 每次主分支提交生成 OTA 升级包, sequence 默认时间戳 (单调递增)
@@ -93,7 +102,17 @@ jobs:
       - name: Run container
         # 一键镜像: 前端 + OTA + 首页, 端口 3002 (与 iboard 的 3001 同机共存)
         # 业务数据放具名卷 wardrobe-data, 部署不丢数据
+        # OTA 放具名卷 wardrobe-ota 并 docker cp 灌入本包内容:
+        #   卷独立于镜像存在 → 之后 ota-only.yml 可直接覆盖, 设备立即热更, 无需重建镜像
         run: |
+          set -euo pipefail
           docker run -d --name wardrobe -p 3002:3002 \
             -v wardrobe-data:/app/data \
+            -v wardrobe-ota:/app/ota-package \
+            -e OTA_ADMIN_TOKEN="${OTA_ADMIN_TOKEN}" \
             wardrobe:latest
+          echo "===== 灌入内置 OTA 包 (容器仍在运行, 下次发布热更即可覆盖) ====="
+          docker cp ota-package/. wardrobe:/app/ota-package/
+          echo "===== 验证 ====="
+          docker exec wardrobe ls -la /app/ota-package/
+          docker exec wardrobe bash -c 'test -s /app/ota-package/latest.json && echo "latest.json OK"'

.gitea/workflows/ota-only.yml

@@ -0,0 +1,102 @@
+name: OTA Package Only
+
+# 手动触发: 前端已改但不想等全量 Android 构建 / 不想整镜像重部署时,
+# 只重建 dist + minisign 签名, 通过服务端 admin 接口直推运行中的容器
+# (容器挂载卷 wardrobe-ota:/app/ota-package, 设备下次轮询立即热更新, 后端/APK 均不动)
+#
+# 前置 (一次性, 配置中心 service-wardrobe/ota):
+#   - MINISIGN_PRIVATE_KEY : 私钥 (整段 .key 内容, 多行)
+#   - OTA_ADMIN_TOKEN      : 上传鉴权 token (单行, 与容器环境变量一致)
+on:
+  workflow_dispatch:
+
+jobs:
+  build-ota-only:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      CONFIG_CENTER_URL: '${{ secrets.CONFIG_CENTER_URL }}'
+      CONFIG_CENTER_TOKEN: '${{ secrets.CONFIG_CENTER_TOKEN }}'
+      REGISTRY_URL_FALLBACK: 'http://bh.vps.honor3.com:8008'
+      CFG_PROJECT_SIGNING: 'proj-mtwjnvir-k52zvp'
+      OTA_BASE: 'http://bh.vps.honor3.com:3002'
+
+    steps:
+      - uses: https://gitea.com/actions/checkout@v4
+
+      - name: Setup Node
+        uses: https://gitea.com/actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install deps
+        run: npm ci --no-audit --no-fund
+
+      - name: Build frontend
+        run: npm run build
+
+      - name: Install minisign
+        run: sudo apt-get update && sudo apt-get install -y minisign
+
+      - name: Fetch config center (minisign key + ota admin token)
+        run: |
+          set -euo pipefail
+          export CONFIG_CENTER_URL="${CONFIG_CENTER_URL:-$REGISTRY_URL_FALLBACK}"
+          python3 - <<'PYEOF'
+          import json, os, urllib.request
+          url = os.environ["CONFIG_CENTER_URL"]
+          token = os.environ.get("CONFIG_CENTER_TOKEN", "") or ""
+          req = urllib.request.Request(f"{url}/api/projects/{os.environ['CFG_PROJECT_SIGNING']}/configs")
+          if token:
+              req.add_header("Authorization", "Bearer " + token)
+          with urllib.request.urlopen(req, timeout=20) as r:
+              data = json.load(r).get("data", [])
+          key_val = next((c.get("value", "") for c in data if c.get("key") == "MINISIGN_PRIVATE_KEY"), None)
+          ota_admin = next((c.get("value", "") for c in data if c.get("key") == "OTA_ADMIN_TOKEN"), None)
+          if not key_val:
+              raise SystemExit("配置中心缺少 MINISIGN_PRIVATE_KEY (service-wardrobe/ota)")
+          if not ota_admin:
+              raise SystemExit("配置中心缺少 OTA_ADMIN_TOKEN (service-wardrobe/ota, 单行)")
+          os.makedirs("ota-package", exist_ok=True)
+          with open("ota-package/hotswap.key", "w", encoding="utf-8") as f:
+              f.write(key_val if key_val.endswith("\n") else key_val + "\n")
+          os.chmod("ota-package/hotswap.key", 0o600)
+          with open(os.environ["GITHUB_ENV"], "a", encoding="utf-8") as f:
+              f.write(f"OTA_ADMIN_TOKEN={ota_admin}\n")
+          PYEOF
+          echo "hotswap.key lines=$(wc -l < ota-package/hotswap.key)"
+          echo "OTA_ADMIN_TOKEN set: $([ -n "${OTA_ADMIN_TOKEN}" ] && echo yes || echo no)"
+
+      - name: Build & sign OTA package
+        env:
+          OTA_NOTES: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          node scripts/build-ota.mjs --out ota-package --key ota-package/hotswap.key --notes ${OTA_NOTES}
+          echo "===== latest.json ====="
+          cat ota-package/latest.json
+
+      - name: Publish to running server (OTA-only upload)
+        # 服务端 POST /api/ota/admin/bundle 覆盖卷内最新包, 不重建镜像/重启进程
+        env:
+          OTA_NOTES: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          cd ota-package
+          SEQ=$(python3 -c "import json;print(json.load(open('latest.json'))['sequence'])")
+          SHA=$(python3 -c "import json;print(json.load(open('latest.json'))['bundle_sha256'])")
+          SIG=$(python3 -c "import json;print(json.load(open('latest.json'))['signature'])")
+          VER=$(python3 -c "import json;print(json.load(open('latest.json'))['version'])")
+          MIN=$(python3 -c "import json;print(json.load(open('latest.json'))['min_binary_version'])")
+          echo "seq=${SEQ} sha=${SHA} version=${VER} min_binary=${MIN}"
+          curl -fsS -X POST "${OTA_BASE}/api/ota/admin/bundle" \
+            -H "Content-Type: application/gzip" \
+            -H "x-ota-token: ${OTA_ADMIN_TOKEN}" \
+            -H "x-ota-seq: ${SEQ}" \
+            -H "x-ota-sha256: ${SHA}" \
+            -H "x-ota-signature: ${SIG}" \
+            -H "x-ota-version: ${VER}" \
+            -H "x-ota-min-bin: ${MIN}" \
+            -H "x-ota-notes: ${OTA_NOTES}" \
+            --data-binary @wardrobe-ota.tar.gz

server/routes/ota.js

@@ -12,9 +12,19 @@
 //   - latest.json   (由 scripts/build-ota.mjs 生成)
 //     { sequence, version, min_binary_version, signature, notes, bundle, mandatory, pub_date, bundle_size }
 //   - <filename>    (tar.gz 升级包)
-import { Router } from 'express'
+//
+// 只更新 OTA 升级包 (不重建镜像/APK) 的通道:
+//   POST /api/ota/admin/bundle   (mounted at /api)
+//     - Header x-ota-token 必须等于环境变量 OTA_ADMIN_TOKEN (CI 从配置中心注入)
+//     - body  = tar.gz 原始字节 (Content-Type: application/gzip)
+//     - 元数据走 header: x-ota-seq(>当前), x-ota-sha256, x-ota-signature(非空),
+//       x-ota-version, x-ota-min-bin, x-ota-notes
+//     - 校验通过后覆盖写 OTA_PACKAGE_DIR/latest.json + wardrobe-ota.tar.gz
+//     - 进程内每次请求现读文件, 无需重启; 配合 -v wardrobe-ota:/app/ota-package 卷可持久化
+import { Router, raw } from 'express'
 import fs from 'node:fs'
 import path from 'node:path'
+import crypto from 'node:crypto'
 
 const router = Router()
 
@@ -106,4 +116,58 @@ router.get('/ota/manifest-web', (_req, res) => {
 
 // GET /api/ota/info 已删除: 诊断接口会暴露服务器路径与签名, 且无调用方
 
+// POST /api/ota/admin/bundle - 只更新 OTA 升级包, 不重建镜像/APK
+//   .gitea/workflows/ota-only.yml 在构建+签名后调用此接口, 直推运行中的容器
+router.post(
+  '/ota/admin/bundle',
+  raw({ type: 'application/gzip', limit: '32mb' }),
+  (req, res) => {
+    const expected = process.env.OTA_ADMIN_TOKEN || ''
+    const token = String(req.headers['x-ota-token'] || '')
+    if (!expected || token !== expected) {
+      return res.status(401).json({ error: 'unauthorized' })
+    }
+    const seq = Number(req.headers['x-ota-seq'])
+    if (!Number.isFinite(seq) || seq <= 0) {
+      return res.status(400).json({ error: '无效 sequence' })
+    }
+    const body = req.body
+    if (!Buffer.isBuffer(body) || body.length === 0) {
+      return res.status(400).json({ error: '空 bundle' })
+    }
+    const sha = String(req.headers['x-ota-sha256'] || '').trim().toLowerCase()
+    const h = crypto.createHash('sha256').update(body).digest('hex')
+    if (!sha || sha !== h) {
+      return res.status(400).json({ error: sha ? 'sha256 不匹配' : '缺少 sha256' })
+    }
+    const signature = String(req.headers['x-ota-signature'] || '').trim()
+    if (!signature) {
+      return res.status(400).json({ error: '缺少签名' })
+    }
+    const dir = resolveOtaDir()
+    fs.mkdirSync(dir, { recursive: true })
+    const latest = readLatest()
+    if (latest && typeof latest.sequence === 'number' && seq <= latest.sequence) {
+      return res.status(409).json({ error: `sequence 不高于当前`, current: latest.sequence })
+    }
+    const manifest = {
+      version: String(req.headers['x-ota-version'] || '').trim() || '0.1.0-ota',
+      sequence: seq,
+      min_binary_version: String(req.headers['x-ota-min-bin'] || '').trim() || '0.0.0',
+      bundle: 'wardrobe-ota.tar.gz',
+      bundle_size: body.length,
+      bundle_sha256: h,
+      signature,
+      notes: String(req.headers['x-ota-notes'] || '').trim(),
+      pub_date: new Date().toISOString(),
+      mandatory: false,
+      build_id: 'seq-' + seq,
+    }
+    fs.writeFileSync(path.join(dir, 'wardrobe-ota.tar.gz'), body)
+    fs.writeFileSync(path.join(dir, 'latest.json'), JSON.stringify(manifest, null, 2))
+    console.log(`[ota] admin 上传 bundle: seq=${seq} size=${body.length} sha256=${h}`)
+    res.json({ ok: true, sequence: seq, size: body.length })
+  }
+)
+
 export default router

src/styles/global.css

@@ -21,6 +21,8 @@
   margin: 0;
   padding: 0;
   box-sizing: border-box;
+  /* 去掉点击/触摸的高亮底色 (Android WebView 默认蓝色块) */
+  -webkit-tap-highlight-color: transparent;
 }
 
 html,
@@ -42,6 +44,7 @@ button {
   font-family: inherit;
   cursor: pointer;
   border: none;
+  outline: none;
 }
 
 input,
@@ -61,8 +64,8 @@ textarea {
   height: 100%;
   max-width: 500px;
   margin: 0 auto;
-  /* 顶部避开状态栏/刘海, 再多让出一个行高 (edge-to-edge 时 env() 才生效) */
-  padding-top: calc(env(safe-area-inset-top) + 20px);
+  /* 顶部避开状态栏/刘海, 再多让出半个行高 (edge-to-edge 时 env() 才生效) */
+  padding-top: calc(env(safe-area-inset-top) + 10px);
 }
 
 .app-content {
@@ -116,6 +119,14 @@ textarea {
   font-weight: 600;
 }
 
+/* 点击反馈: 用缩放/透明度替代系统默认蓝色高亮 */
+.nav-item:active {
+  opacity: 0.7;
+}
+.nav-item:active .nav-icon {
+  transform: scale(1.15);
+}
+
 .nav-item .nav-icon {
   font-size: 20px;
 }
@@ -128,6 +139,8 @@ textarea {
 .center-nav-btn .fab-circle {
   width: 52px;
   height: 52px;
+  /* 防止容器高度不足时被 flex 压缩成椭圆 */
+  flex-shrink: 0;
   border-radius: 50%;
   background: var(--text-primary);
   display: flex;