updater fixed

src/main/gitea-service.cjs

@@ -325,13 +325,15 @@ class GiteaService {
     const token = this.store.getToken();
     let target = new URL(url, `${baseUrl}/`);
     for (let redirects = 0; redirects <= 5; redirects += 1) {
-      if (target.origin !== base.origin)
+      const sameOrigin = target.origin === base.origin;
+      if (!sameOrigin && target.protocol !== "https:") {
         throw new Error(
-          "Refusing to send the Gitea token to a different origin.",
+          "Refusing an insecure cross-origin update download redirect.",
         );
+      }
       const response = await fetch(target, {
         headers: {
-          Authorization: `token ${token}`,
+          ...(sameOrigin && token ? { Authorization: `token ${token}` } : {}),
           Accept: "application/octet-stream",
         },
         signal: AbortSignal.timeout(timeout),
@@ -360,8 +362,20 @@ class GiteaService {
       throw new Error("Gitea returned an invalid release ID.");
     if (!Number.isSafeInteger(numericId) || numericId <= 0)
       throw new Error("Gitea returned an invalid release asset ID.");
-    const assetPath = `/api/v1/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/releases/${numericReleaseId}/assets/${numericId}`;
-    return this.downloadAuthenticated(assetPath, options);
+
+    let downloadUrl = String(options.downloadUrl || "").trim();
+    if (!downloadUrl) {
+      const metadataPath = `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/releases/${numericReleaseId}/assets/${numericId}`;
+      const metadata = (await this.request(metadataPath)).data;
+      if (Number(metadata?.id) !== numericId) {
+        throw new Error("Gitea returned metadata for a different release asset.");
+      }
+      downloadUrl = String(metadata?.browser_download_url || "").trim();
+    }
+    if (!downloadUrl) {
+      throw new Error("Gitea did not provide a release asset download URL.");
+    }
+    return this.downloadAuthenticated(downloadUrl, options);
   }
 
   async dispatchWorkflow({ owner, repo, workflowFile, ref, inputs = {} }) {

src/main/update-service.cjs

@@ -279,7 +279,7 @@ class UpdateService {
       ));
     if (!release || release.draft || release.prerelease) {
       const error = new Error(
-        `ForgeFlow ${update.remoteVersion} has no published binary release yet.`,
+        `ForgeFlow ${update.remoteVersion} has no published binary release yet. The source branch was updated, but the matching Windows installer/portable assets were not published. Run Publish-Missing-Binary-Release.ps1 from the release source or publish the four required assets in Gitea.`,
       );
       error.code = "BINARY_RELEASE_NOT_FOUND";
       throw error;
@@ -305,18 +305,29 @@ class UpdateService {
         update.repo,
         release.id,
         asset.id,
+        { downloadUrl: asset.browser_download_url },
       ),
       this.gitea.downloadReleaseAsset(
         update.owner,
         update.repo,
         release.id,
         checksumAsset.id,
+        { downloadUrl: checksumAsset.browser_download_url },
       ),
     ]);
     if (binary.length < 1_000_000 || binary[0] !== 0x4d || binary[1] !== 0x5a) {
-      throw new Error(
-        "The downloaded Windows update is not a valid executable.",
+      const preview = binary.subarray(0, 200).toString("utf8").trim();
+      const looksLikeMetadata =
+        /^\s*[{[]/.test(preview) || /browser_download_url/i.test(preview);
+      const error = new Error(
+        looksLikeMetadata
+          ? "Gitea returned release-asset metadata instead of the Windows executable. Upgrade ForgeFlow with the 0.9.1 installer once; later in-app updates use the actual browser download URL."
+          : "The downloaded Windows update is not a valid executable.",
       );
+      error.code = looksLikeMetadata
+        ? "RELEASE_ASSET_METADATA_RECEIVED"
+        : "INVALID_WINDOWS_UPDATE";
+      throw error;
     }
     const expectedSha256 = checksumBytes
       .toString("utf8")