⛄ Sync 2026-09-29 03:13:52

luci-app-open-box/root/usr/bin/open-box

@@ -0,0 +1,208 @@
+#!/bin/sh
+# Open-Box 命令行管理工具
+INSTALL_ROOT="/opt/open-box"
+OPENBOX_PORT_FILE="$INSTALL_ROOT/data/panel-port"
+OPENBOX_PORT_FALLBACK=2026
+OPENBOX_PORT_DEFAULT=3036
+OPENBOX_RESERVED_PORTS="9095 7853 7854 7891 53 22 80 443"
+
+if [ -f "$INSTALL_ROOT/openwrt/bin/open-box" ] && [ "$0" != "$INSTALL_ROOT/openwrt/bin/open-box" ] && [ ! -L "$INSTALL_ROOT/openwrt/bin/open-box" ]; then
+	exec "$INSTALL_ROOT/openwrt/bin/open-box" "$@"
+fi
+
+openbox_port_problem() {
+	_p="$1"
+	case "$_p" in
+		''|*[!0-9]*) echo "端口要填 1024-65535 的数字"; return 0 ;;
+	esac
+	if [ "$_p" -lt 1024 ] || [ "$_p" -gt 65535 ]; then
+		echo "端口要在 1024-65535 之间(1024 以下是系统保留端口)"
+		return 0
+	fi
+	for _r in $OPENBOX_RESERVED_PORTS; do
+		if [ "$_p" = "$_r" ]; then
+			echo "$_p 是 Open-Box 自己或系统服务在用的端口(内核 API / DNS / SSH / HTTP 等),换一个"
+			return 0
+		fi
+	done
+	_busy=""
+	if command -v ss >/dev/null 2>&1; then
+		_busy=$(ss -ltn 2>/dev/null | awk 'NR>1 {print $4}' | sed 's/.*[:.]//' | grep -x "$_p" | head -n 1)
+	elif command -v netstat >/dev/null 2>&1; then
+		_busy=$(netstat -ltn 2>/dev/null | awk '{print $4}' | sed 's/.*[:.]//' | grep -x "$_p" | head -n 1)
+	fi
+	if [ -n "$_busy" ]; then
+		echo "$_p 已经被别的程序占用(已在监听)"
+		return 0
+	fi
+	return 1
+}
+
+openbox_current_port() {
+	_cp=$(cat "$OPENBOX_PORT_FILE" 2>/dev/null | tr -dc '0-9')
+	[ -n "$_cp" ] || _cp="$OPENBOX_PORT_DEFAULT"
+	printf '%s\n' "$_cp"
+}
+
+openbox_get_lan_ip() {
+	LAN_IP=""
+	command -v uci >/dev/null 2>&1 && LAN_IP=$(uci -q get network.lan.ipaddr 2>/dev/null | tr " " "\n" | head -n 1 | cut -d/ -f1)
+	if [ -z "$LAN_IP" ] && command -v ip >/dev/null 2>&1; then
+		LAN_IP=$(ip -4 -o addr show br-lan 2>/dev/null | awk '{ print $4 }' | cut -d/ -f1 | head -n 1)
+	fi
+	[ -n "$LAN_IP" ] || LAN_IP="192.168.1.1"
+	printf '%s\n' "$LAN_IP"
+}
+
+openbox_get_password() {
+	if [ -f "$INSTALL_ROOT/data/openbox.sqlite" ] && [ -x "$INSTALL_ROOT/node/bin/node" ]; then
+		_pw=$(OPENSSL_CONF=/dev/null LD_LIBRARY_PATH="$INSTALL_ROOT/node/lib" "$INSTALL_ROOT/node/bin/node" -e '
+			try {
+				const sqlite3 = require("sqlite3");
+				const db = new sqlite3.Database("'$INSTALL_ROOT'/data/openbox.sqlite", sqlite3.OPEN_READONLY, (err) => {
+					if (err) process.exit(1);
+					db.get("SELECT value FROM settings WHERE key = ?", ["password"], (e, row) => {
+						if (row && row.value) console.log(row.value);
+						db.close();
+					});
+				});
+			} catch (_) {}
+		' 2>/dev/null)
+		if [ -n "$_pw" ]; then
+			printf '%s\n' "$_pw"
+			return 0
+		fi
+	fi
+	if [ -f "$INSTALL_ROOT/data/password" ]; then
+		cat "$INSTALL_ROOT/data/password" 2>/dev/null
+		return 0
+	fi
+	echo "尚未设置(首次打开面板设置管理密码)"
+}
+
+openbox_get_version() {
+	_ver=$(sed -n 's/.*"version" *: *"\([^"]*\)".*/\1/p' "$INSTALL_ROOT/meta.json" 2>/dev/null | head -n 1)
+	[ -n "$_ver" ] || _ver="未安装"
+	printf '%s\n' "$_ver"
+}
+
+cmd="${1:-}"
+
+case "$cmd" in
+	password)
+		openbox_get_password
+		exit 0
+		;;
+	port)
+		if [ $# -ge 2 ]; then
+			new_port="$2"
+			_reason=$(openbox_port_problem "$new_port") && {
+				echo "面板端口不能用:$_reason" >&2
+				exit 1
+			}
+			mkdir -p "$INSTALL_ROOT/data"
+			printf '%s\n' "$new_port" > "$OPENBOX_PORT_FILE"
+			if command -v uci >/dev/null 2>&1; then
+				uci -q set openbox.main.port="$new_port"
+				uci -q set firewall.openbox_panel.dest_port="$new_port"
+				uci -q commit openbox 2>/dev/null || true
+				uci -q commit firewall 2>/dev/null || true
+				/etc/init.d/firewall reload >/dev/null 2>&1 || true
+			fi
+			echo "面板端口已修改为: $new_port"
+			/etc/init.d/openbox-panel restart >/dev/null 2>&1 || true
+			exit 0
+		else
+			openbox_current_port
+			exit 0
+		fi
+		;;
+	check)
+		if [ -f "$INSTALL_ROOT/update.sh" ]; then
+			sh "$INSTALL_ROOT/update.sh" --probe direct
+		elif [ -f /usr/share/openbox/update.sh ]; then
+			sh /usr/share/openbox/update.sh --probe direct
+		else
+			echo "未找到更新脚本"
+		fi
+		exit 0
+		;;
+	update)
+		shift
+		if [ -f "$INSTALL_ROOT/update.sh" ]; then
+			sh "$INSTALL_ROOT/update.sh" "$@"
+		elif [ -f /usr/share/openbox/update.sh ]; then
+			sh /usr/share/openbox/update.sh "$@"
+		else
+			echo "未找到更新脚本" >&2
+			exit 1
+		fi
+		exit 0
+		;;
+	restart)
+		/etc/init.d/openbox restart
+		/etc/init.d/openbox-panel restart
+		echo "已重启 Open-Box 服务与面板"
+		exit 0
+		;;
+	uninstall)
+		shift
+		if [ -f "$INSTALL_ROOT/uninstall.sh" ]; then
+			sh "$INSTALL_ROOT/uninstall.sh" "$@"
+		elif [ -f /usr/share/openbox/uninstall.sh ]; then
+			sh /usr/share/openbox/uninstall.sh "$@"
+		else
+			/etc/init.d/openbox stop
+			/etc/init.d/openbox-panel stop
+			rm -rf "$INSTALL_ROOT"
+			echo "已停止并清理"
+		fi
+		exit 0
+		;;
+	install)
+		shift
+		if [ -f /usr/share/openbox/install.sh ]; then
+			sh /usr/share/openbox/install.sh "$@"
+		else
+			curl -fsSL https://raw.githubusercontent.com/liandu2024/Open-Box/main/scripts/install.sh | sh -s -- "$@"
+		fi
+		exit 0
+		;;
+	*)
+		VERSION=$(openbox_get_version)
+		echo ""
+		echo "Open-Box $VERSION"
+		echo "  1) 当前密码"
+		echo "  2) 重新启动"
+		echo "  3) 检查升级"
+		echo "  4) 卸载"
+		echo "  5) 退出"
+		printf '请选择 [1-5]: '
+		read -r choice
+		case "$choice" in
+			1)
+				port=$(openbox_current_port)
+				lan_ip=$(openbox_get_lan_ip)
+				pw=$(openbox_get_password)
+				echo ""
+				echo "  面板地址: http://$lan_ip:$port"
+				echo "  当前密码: $pw"
+				echo ""
+				;;
+			2)
+				/etc/init.d/openbox restart
+				/etc/init.d/openbox-panel restart
+				echo "服务已重启。"
+				;;
+			3)
+				sh "$0" update
+				;;
+			4)
+				sh "$0" uninstall
+				;;
+			5|*)
+				exit 0
+				;;
+		esac
+		;;
+esac

luci-app-open-box/root/usr/share/luci/menu.d/luci-app-openbox.json

@@ -0,0 +1,12 @@
+{
+	"admin/services/openbox": {
+		"title": "Open-Box",
+		"action": {
+			"type": "view",
+			"path": "openbox/main"
+		},
+		"depends": {
+			"acl": [ "luci-app-openbox" ]
+		}
+	}
+}

luci-app-open-box/root/usr/share/openbox/install.sh

@@ -0,0 +1,136 @@
+#!/bin/sh
+# Open-Box 一键安装脚本
+set -eu
+umask 022
+
+REPO="liandu2024/Open-Box"
+INSTALL_ROOT="/opt/open-box"
+CHANNEL="mirror"
+MIRROR_PREFIX="https://ghfast.top"
+PANEL_PORT="3036"
+
+info() { echo "[open-box] $*"; }
+warn() { echo "[open-box] 警告:$*" >&2; }
+die() { echo "[open-box] 错误:$*" >&2; exit 1; }
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --mirror)
+      CHANNEL="mirror"
+      shift
+      if [ $# -ge 1 ]; then
+        case "$1" in
+          --*) ;;
+          *) MIRROR_PREFIX="$1"; shift ;;
+        esac
+      fi
+      ;;
+    --direct)
+      CHANNEL="direct"
+      MIRROR_PREFIX=""
+      shift
+      ;;
+    --port)
+      shift
+      [ $# -ge 1 ] || die "--port 后面要跟端口号"
+      PANEL_PORT="$1"
+      shift
+      ;;
+    *) shift ;;
+  esac
+done
+
+detect_arch() {
+  RAW_ARCH=$(uname -m 2>/dev/null || true)
+  case "$RAW_ARCH" in
+    x86_64) ARCH="x64" ;;
+    aarch64) ARCH="arm64" ;;
+    *) die "不支持的 CPU 架构:${RAW_ARCH:-未知}。Open-Box 目前仅支持 x86_64 与 aarch64(arm64)。" ;;
+  esac
+}
+
+detect_arch
+
+if [ -f "/etc/config/openbox" ]; then
+  p=$(uci -q get openbox.main.port 2>/dev/null || true)
+  [ -n "$p" ] && PANEL_PORT="$p"
+fi
+
+TMP_DL=$(mktemp -d /tmp/openbox-inst.XXXXXX 2>/dev/null || echo "/tmp/openbox-inst.$$")
+mkdir -p "$TMP_DL"
+trap 'rm -rf "$TMP_DL"' EXIT INT TERM
+
+ASSET="open-box-linux-${ARCH}.tar.gz"
+ASSET_URL="https://github.com/$REPO/releases/latest/download/$ASSET"
+SHA_URL="$ASSET_URL.sha256"
+
+build_url() {
+  url="$1"
+  if [ "$CHANNEL" = "mirror" ] && [ -n "$MIRROR_PREFIX" ]; then
+    case "$MIRROR_PREFIX" in
+      http://*|https://*) printf '%s/%s
+' "${MIRROR_PREFIX%/}" "$url" ;;
+      *) printf 'https://%s/%s
+' "${MIRROR_PREFIX%/}" "$url" ;;
+    esac
+  else
+    printf '%s
+' "$url"
+  fi
+}
+
+info "下载校验和与发布包: $ASSET ..."
+curl -fsSL -o "$TMP_DL/$ASSET.sha256" "$(build_url "$SHA_URL")" 2>/dev/null || wget -q -O "$TMP_DL/$ASSET.sha256" "$(build_url "$SHA_URL")" || die "下载校验文件失败"
+curl -fsSL -o "$TMP_DL/$ASSET" "$(build_url "$ASSET_URL")" 2>/dev/null || wget -q -O "$TMP_DL/$ASSET" "$(build_url "$ASSET_URL")" || die "下载发布包失败"
+
+info "校验 SHA256 ..."
+( cd "$TMP_DL" && sha256sum -c "$ASSET.sha256" >/dev/null 2>&1 ) || die "安装包校验失败 (SHA256 不匹配)"
+
+info "解包到 $INSTALL_ROOT ..."
+mkdir -p "$INSTALL_ROOT"
+tar -xzf "$TMP_DL/$ASSET" -C "$INSTALL_ROOT" || die "解包失败"
+chown -R 0:0 "$INSTALL_ROOT" 2>/dev/null || true
+
+mkdir -p "$INSTALL_ROOT/data"
+printf '%s
+' "$PANEL_PORT" > "$INSTALL_ROOT/data/panel-port"
+if [ "$CHANNEL" = "mirror" ]; then
+  printf 'mirror
+%s
+' "$MIRROR_PREFIX" > "$INSTALL_ROOT/data/channel"
+else
+  printf 'direct
+' > "$INSTALL_ROOT/data/channel"
+fi
+
+cp -f "$INSTALL_ROOT/openwrt/initd/openbox" /etc/init.d/openbox 2>/dev/null || true
+cp -f "$INSTALL_ROOT/openwrt/initd/openbox-panel" /etc/init.d/openbox-panel 2>/dev/null || true
+chmod +x /etc/init.d/openbox /etc/init.d/openbox-panel 2>/dev/null || true
+
+if [ -f "$INSTALL_ROOT/openwrt/bin/open-box" ]; then
+  chmod +x "$INSTALL_ROOT/openwrt/bin/open-box" 2>/dev/null || true
+  ln -sf "$INSTALL_ROOT/openwrt/bin/open-box" /usr/bin/open-box 2>/dev/null || true
+fi
+
+if [ -d "$INSTALL_ROOT/openwrt/luci/htdocs/luci-static/resources/view/openbox" ]; then
+  mkdir -p /www/luci-static/resources/view/openbox
+  cp -f "$INSTALL_ROOT/openwrt/luci/htdocs/luci-static/resources/view/openbox/"*.js /www/luci-static/resources/view/openbox/ 2>/dev/null || true
+fi
+
+if [ -f "$INSTALL_ROOT/openwrt/luci/root/usr/share/luci/menu.d/luci-app-openbox.json" ]; then
+  mkdir -p /usr/share/luci/menu.d
+  cp -f "$INSTALL_ROOT/openwrt/luci/root/usr/share/luci/menu.d/luci-app-openbox.json" /usr/share/luci/menu.d/ 2>/dev/null || true
+fi
+
+if [ -f "$INSTALL_ROOT/openwrt/luci/root/usr/share/rpcd/acl.d/luci-app-openbox.json" ]; then
+  mkdir -p /usr/share/rpcd/acl.d
+  cp -f "$INSTALL_ROOT/openwrt/luci/root/usr/share/rpcd/acl.d/luci-app-openbox.json" /usr/share/rpcd/acl.d/ 2>/dev/null || true
+fi
+
+rm -rf /tmp/luci-*cache* 2>/dev/null || true
+/etc/init.d/rpcd restart >/dev/null 2>&1 || true
+
+/etc/init.d/openbox-panel enable >/dev/null 2>&1 || true
+/etc/init.d/openbox-panel restart >/dev/null 2>&1 || true
+
+info "Open-Box 核心组件安装完成！"

luci-app-open-box/root/usr/share/openbox/uninstall.sh

@@ -0,0 +1,85 @@
+#!/bin/sh
+# Open-Box 卸载清理脚本
+set -eu
+
+INSTALL_ROOT="/opt/open-box"
+STATUS_PATH="/tmp/openbox-uninstall.status"
+PURGE=0
+DETACH=0
+
+while [ $# -gt 0 ]; do
+	case "$1" in
+		--purge) PURGE=1; shift ;;
+		--detach) DETACH=1; shift ;;
+		*) shift ;;
+	esac
+done
+
+if [ "$DETACH" = "1" ]; then
+	_args=""
+	[ "$PURGE" = "1" ] && _args="--purge"
+	nohup sh "$0" $_args >/dev/null 2>&1 &
+	echo "卸载已在后台启动"
+	exit 0
+fi
+
+{
+	echo "pid=$$"
+	echo "stage=stopping"
+} > "$STATUS_PATH" 2>/dev/null || true
+
+/etc/init.d/openbox stop >/dev/null 2>&1 || true
+/etc/init.d/openbox-panel stop >/dev/null 2>&1 || true
+/etc/init.d/openbox disable >/dev/null 2>&1 || true
+/etc/init.d/openbox-panel disable >/dev/null 2>&1 || true
+
+{
+	echo "pid=$$"
+	echo "stage=firewall"
+} > "$STATUS_PATH" 2>/dev/null || true
+
+if command -v uci >/dev/null 2>&1; then
+	uci -q delete firewall.openbox_panel || true
+	uci -q delete firewall.openbox_dns || true
+	uci -q delete firewall.openbox_tun_forward || true
+	uci -q delete firewall.openbox_tun_input || true
+	uci -q delete firewall.openbox_v6block || true
+	for _ob_rule in $(uci -q show firewall 2>/dev/null | sed -n 's/^firewall\.\(openbox_srv_[A-Za-z0-9_]*\)=rule$/\1/p'); do
+		uci -q delete "firewall.$_ob_rule" || true
+	done
+	if [ -n "$(uci -q changes firewall)" ]; then
+		uci -q commit firewall
+		/etc/init.d/firewall reload >/dev/null 2>&1 || true
+	fi
+fi
+
+{
+	echo "pid=$$"
+	echo "stage=files"
+} > "$STATUS_PATH" 2>/dev/null || true
+
+rm -f /etc/init.d/openbox /etc/init.d/openbox-panel
+rm -f /www/luci-static/resources/view/openbox/main.js /www/luci-static/resources/view/openbox/status.js
+rmdir /www/luci-static/resources/view/openbox 2>/dev/null || true
+rm -f /usr/share/luci/menu.d/luci-app-openbox.json
+rm -f /usr/share/rpcd/acl.d/luci-app-openbox.json
+[ -L /usr/bin/open-box ] && rm -f /usr/bin/open-box
+rm -rf /tmp/luci-*cache* 2>/dev/null || true
+
+if [ "$PURGE" = "1" ]; then
+	rm -rf "$INSTALL_ROOT"
+else
+	for entry in "$INSTALL_ROOT"/*; do
+		[ -e "$entry" ] || continue
+		base=$(basename -- "$entry")
+		[ "$base" = "data" ] && continue
+		rm -rf "$entry"
+	done
+fi
+
+{
+	echo "pid=$$"
+	echo "stage=done"
+} > "$STATUS_PATH" 2>/dev/null || true
+
+echo "Open-Box 卸载完成"

luci-app-open-box/root/usr/share/openbox/update.sh

@@ -0,0 +1,204 @@
+#!/bin/sh
+# Open-Box 更新/回退脚本
+set -eu
+umask 022
+
+REPO="liandu2024/Open-Box"
+INSTALL_ROOT="/opt/open-box"
+STATUS_PATH="/tmp/openbox-update.status"
+CANCEL_FLAG="/tmp/openbox-update.cancel"
+UPDATE_LOG="/tmp/openbox-update.log"
+STATUS_PID="$$"
+
+DETACH=0
+ROLLBACK_MODE=0
+CHANNEL="direct"
+MIRROR_PREFIX=""
+PROBE_CHANNEL=""
+CANCEL_MODE=0
+
+info() { echo "[open-box] $*"; }
+warn() { echo "[open-box] 警告:$*" >&2; }
+die() {
+	echo "[open-box] 错误:$*" >&2
+	write_status failed "" "" "$*"
+	exit 1
+}
+
+write_status() {
+	[ -n "$STATUS_PID" ] || return 0
+	_ws_tmp="$STATUS_PATH.$$.tmp"
+	{
+		echo "pid=$STATUS_PID"
+		echo "stage=$1"
+		echo "bytes=${2:-}"
+		echo "total=${3:-}"
+		echo "message=${4:-}"
+	} > "$_ws_tmp" 2>/dev/null && mv -f "$_ws_tmp" "$STATUS_PATH" 2>/dev/null || true
+}
+
+check_cancel() {
+	if [ -e "$CANCEL_FLAG" ]; then
+		write_status cancelled "" "" "已取消更新"
+		exit 0
+	fi
+}
+
+while [ $# -gt 0 ]; do
+	case "$1" in
+		--detach) DETACH=1; shift ;;
+		--rollback) ROLLBACK_MODE=1; shift ;;
+		--cancel) CANCEL_MODE=1; shift ;;
+		--direct) CHANNEL="direct"; MIRROR_PREFIX=""; shift ;;
+		--mirror)
+			CHANNEL="mirror"
+			shift
+			if [ $# -ge 1 ]; then
+				case "$1" in
+					--*) ;;
+					*) MIRROR_PREFIX="$1"; shift ;;
+				esac
+			fi
+			;;
+		--probe)
+			shift
+			PROBE_CHANNEL="$1"
+			shift
+			;;
+		*) shift ;;
+	esac
+done
+
+if [ "$CANCEL_MODE" = "1" ]; then
+	touch "$CANCEL_FLAG" 2>/dev/null || true
+	echo "requested"
+	exit 0
+fi
+
+if [ -n "$PROBE_CHANNEL" ]; then
+	start_time=$(date +%s%N 2>/dev/null || date +%s)
+	target="https://github.com/$REPO/releases/latest/download/open-box-linux-x64.tar.gz.sha256"
+	if [ "$PROBE_CHANNEL" != "direct" ]; then
+		case "$PROBE_CHANNEL" in
+			http://*|https://*) target="${PROBE_CHANNEL%/}/$target" ;;
+			*) target="https://${PROBE_CHANNEL%/}/$target" ;;
+		esac
+	fi
+	if curl -fsSL --connect-timeout 8 --max-time 15 -o /dev/null "$target" 2>/dev/null || 	   wget -q --timeout=15 -O /dev/null "$target" 2>/dev/null; then
+		end_time=$(date +%s%N 2>/dev/null || date +%s)
+		ms=$(( (end_time - start_time) / 1000000 2>/dev/null || 100 ))
+		[ "$ms" -le 0 ] && ms=80
+		echo "ok $ms ms"
+	else
+		echo "fail 连接超时或无法访问"
+	fi
+	exit 0
+fi
+
+if [ "$DETACH" = "1" ]; then
+	: > "$UPDATE_LOG" 2>/dev/null || true
+	write_status starting "" "" ""
+	rm -f "$CANCEL_FLAG" 2>/dev/null || true
+	_args=""
+	[ "$ROLLBACK_MODE" = "1" ] && _args="$_args --rollback"
+	if [ "$CHANNEL" = "mirror" ]; then
+		_args="$_args --mirror $MIRROR_PREFIX"
+	else
+		_args="$_args --direct"
+	fi
+	nohup sh "$0" $_args >"$UPDATE_LOG" 2>&1 </dev/null &
+	echo "升级已在后台启动，进度见 $STATUS_PATH"
+	exit 0
+fi
+
+write_status probing "" "" ""
+check_cancel
+
+RAW_ARCH=$(uname -m 2>/dev/null || true)
+case "$RAW_ARCH" in
+	x86_64) ARCH="x64" ;;
+	aarch64) ARCH="arm64" ;;
+	*) die "不支持的 CPU 架构: $RAW_ARCH" ;;
+esac
+
+ASSET="open-box-linux-${ARCH}.tar.gz"
+ASSET_URL="https://github.com/$REPO/releases/latest/download/$ASSET"
+SHA_URL="$ASSET_URL.sha256"
+
+build_url() {
+	url="$1"
+	if [ "$CHANNEL" = "mirror" ] && [ -n "$MIRROR_PREFIX" ]; then
+		case "$MIRROR_PREFIX" in
+			http://*|https://*) printf '%s/%s
+' "${MIRROR_PREFIX%/}" "$url" ;;
+			*) printf 'https://%s/%s
+' "${MIRROR_PREFIX%/}" "$url" ;;
+		esac
+	else
+		printf '%s
+' "$url"
+	fi
+}
+
+TMP_DL=$(mktemp -d /tmp/openbox-upd.XXXXXX 2>/dev/null || echo "/tmp/openbox-upd.$$")
+mkdir -p "$TMP_DL"
+trap 'rm -rf "$TMP_DL"' EXIT INT TERM
+
+write_status downloading 0 100000000 "开始下载"
+check_cancel
+
+curl -fsSL -o "$TMP_DL/$ASSET.sha256" "$(build_url "$SHA_URL")" 2>/dev/null || wget -q -O "$TMP_DL/$ASSET.sha256" "$(build_url "$SHA_URL")" || die "下载校验和失败"
+check_cancel
+
+curl -fsSL -o "$TMP_DL/$ASSET" "$(build_url "$ASSET_URL")" 2>/dev/null || wget -q -O "$TMP_DL/$ASSET" "$(build_url "$ASSET_URL")" || die "下载升级包失败"
+check_cancel
+
+write_status verifying "" "" ""
+( cd "$TMP_DL" && sha256sum -c "$ASSET.sha256" >/dev/null 2>&1 ) || die "校验失败 (SHA256 不匹配)"
+
+write_status extracting "" "" ""
+check_cancel
+
+STAGE_DIR="$INSTALL_ROOT/.update-stage.$$"
+rm -rf "$STAGE_DIR"
+mkdir -p "$STAGE_DIR"
+tar -xzf "$TMP_DL/$ASSET" -C "$STAGE_DIR" || die "解包失败"
+
+write_status committing "" "" ""
+/etc/init.d/openbox-panel stop >/dev/null 2>&1 || true
+/etc/init.d/openbox stop >/dev/null 2>&1 || true
+
+for comp in node panel bin openwrt; do
+	if [ -e "$STAGE_DIR/$comp" ]; then
+		rm -rf "$INSTALL_ROOT/$comp"
+		mv "$STAGE_DIR/$comp" "$INSTALL_ROOT/$comp"
+	fi
+done
+[ -e "$STAGE_DIR/meta.json" ] && mv "$STAGE_DIR/meta.json" "$INSTALL_ROOT/meta.json"
+rm -rf "$STAGE_DIR"
+
+cp -f "$INSTALL_ROOT/openwrt/initd/openbox" /etc/init.d/openbox 2>/dev/null || true
+cp -f "$INSTALL_ROOT/openwrt/initd/openbox-panel" /etc/init.d/openbox-panel 2>/dev/null || true
+chmod +x /etc/init.d/openbox /etc/init.d/openbox-panel 2>/dev/null || true
+
+if [ -f "$INSTALL_ROOT/openwrt/bin/open-box" ]; then
+	ln -sf "$INSTALL_ROOT/openwrt/bin/open-box" /usr/bin/open-box 2>/dev/null || true
+fi
+if [ -d "$INSTALL_ROOT/openwrt/luci/htdocs/luci-static/resources/view/openbox" ]; then
+	cp -f "$INSTALL_ROOT/openwrt/luci/htdocs/luci-static/resources/view/openbox/"*.js /www/luci-static/resources/view/openbox/ 2>/dev/null || true
+fi
+if [ -f "$INSTALL_ROOT/openwrt/luci/root/usr/share/luci/menu.d/luci-app-openbox.json" ]; then
+	cp -f "$INSTALL_ROOT/openwrt/luci/root/usr/share/luci/menu.d/luci-app-openbox.json" /usr/share/luci/menu.d/ 2>/dev/null || true
+fi
+if [ -f "$INSTALL_ROOT/openwrt/luci/root/usr/share/rpcd/acl.d/luci-app-openbox.json" ]; then
+	cp -f "$INSTALL_ROOT/openwrt/luci/root/usr/share/rpcd/acl.d/luci-app-openbox.json" /usr/share/rpcd/acl.d/ 2>/dev/null || true
+fi
+
+rm -rf /tmp/luci-*cache* 2>/dev/null || true
+/etc/init.d/rpcd restart >/dev/null 2>&1 || true
+
+/etc/init.d/openbox-panel start >/dev/null 2>&1 || true
+/etc/init.d/openbox start >/dev/null 2>&1 || true
+
+write_status done "" "" "升级完成"
+info "升级完成！"

luci-app-open-box/root/usr/share/rpcd/acl.d/luci-app-openbox.json

@@ -0,0 +1,34 @@
+{
+	"luci-app-openbox": {
+		"description": "Grant UCI and system execution access for luci-app-openbox",
+		"read": {
+			"cgi-io": [ "backup" ],
+			"file": {
+				"/opt/open-box/meta.json": [ "read" ],
+				"/opt/open-box/data/panel-port": [ "read" ],
+				"/tmp/openbox-update.status": [ "read" ],
+				"/tmp/openbox-update.log": [ "read" ],
+				"/tmp/openbox-uninstall.status": [ "read" ],
+				"/tmp/openbox-uninstall.log": [ "read" ]
+			},
+			"uci": [ "network", "firewall", "openbox" ],
+			"ubus": {
+				"service": [ "list" ]
+			}
+		},
+		"write": {
+			"file": {
+				"/etc/init.d/openbox": [ "exec" ],
+				"/etc/init.d/openbox-panel": [ "exec" ],
+				"/usr/bin/open-box": [ "exec" ],
+				"/opt/open-box/openwrt/bin/open-box": [ "exec" ],
+				"/opt/open-box/update.sh": [ "exec" ],
+				"/opt/open-box/uninstall.sh": [ "exec" ],
+				"/usr/share/openbox/install.sh": [ "exec" ],
+				"/usr/share/openbox/update.sh": [ "exec" ],
+				"/usr/share/openbox/uninstall.sh": [ "exec" ]
+			},
+			"uci": [ "firewall", "openbox" ]
+		}
+	}
+}