Proxy update checks through the panel to avoid CORS failures.

Co-authored-by: Cursor <cursoragent@cursor.com>

app.py

@@ -102,6 +102,8 @@ else:
 
 DATA_FILE = os.path.join(application_path, 'data.json')  # legacy JSON; used only for one-shot import / export
 CURRENT_VERSION = "v1.6.0"
+RELEASES_REPO_URL = "https://git.evilfox.cc/test2/Amnezia-Web-Panel-main"
+RELEASES_API_LATEST = "https://git.evilfox.cc/api/v1/repos/test2/Amnezia-Web-Panel-main/releases/latest"
 BIN_DIR = os.environ.get('TUNNEL_BIN_DIR', os.path.join(application_path, 'bin'))
 TUNNEL_STATE_FILE = os.environ.get('TUNNEL_STATE_FILE', os.path.join(application_path, 'tunnels_state.json'))
 
@@ -5253,6 +5255,39 @@ async def api_get_settings(request: Request):
     return data.get('settings', {})
 
 
+@app.get('/api/settings/check_updates', tags=["Settings"])
+async def api_check_updates(request: Request):
+    """Proxy latest release lookup to avoid browser CORS blocks on git.evilfox.cc."""
+    if not _check_admin(request):
+        return JSONResponse({'error': 'Forbidden'}, status_code=403)
+    try:
+        async with httpx.AsyncClient(timeout=15.0, follow_redirects=True) as client:
+            resp = await client.get(
+                RELEASES_API_LATEST,
+                headers={'Accept': 'application/json'},
+            )
+        if resp.status_code >= 400:
+            return JSONResponse(
+                {'error': f'Release API returned HTTP {resp.status_code}'},
+                status_code=502,
+            )
+        data = resp.json() if resp.content else {}
+        latest = (data.get('tag_name') or data.get('name') or '').strip()
+        html_url = (data.get('html_url') or f'{RELEASES_REPO_URL}/releases').strip()
+        current = CURRENT_VERSION
+        update_available = bool(latest) and latest != current
+        return {
+            'current_version': current,
+            'latest_version': latest,
+            'update_available': update_available,
+            'html_url': html_url,
+            'releases_url': f'{RELEASES_REPO_URL}/releases',
+        }
+    except Exception as e:
+        logger.exception('Error checking for updates')
+        return JSONResponse({'error': str(e)}, status_code=502)
+
+
 @app.get('/api/settings/tunnels/status', tags=["Settings"])
 async def api_tunnels_status(request: Request):
     if not _check_admin(request):