diff --git a/Bookworm-Setup.exe b/Bookworm-Setup.exe
index c8dac6d..71f1757 100644
Binary files a/Bookworm-Setup.exe and b/Bookworm-Setup.exe differ
diff --git a/auto-setup.ps1 b/auto-setup.ps1
index 5d977a8..375cc22 100644
--- a/auto-setup.ps1
+++ b/auto-setup.ps1
@@ -1660,9 +1660,8 @@ elseif (Test-Path $ClaudeDir) {
         Log-Warn "匿名克隆失败, 弹凭证对话框重试..."
         $cred = Show-GiteaCredentialDialog
         if ($cred) {
-            $cloneUrl = $GitUrl -replace '://', "://$([System.Uri]::EscapeDataString($cred.User)):$([System.Uri]::EscapeDataString($cred.Pass))@"
-            $r = Run-CmdWithUI "git" @("clone", "--depth", "1", $cloneUrl, $ClaudeDir) "克隆配置仓库 (认证)" 180000
-            if (Test-CloneComplete) { Cache-GitCredentials $cred }
+            Cache-GitCredentials $cred
+            $r = Run-CmdWithUI "git" @("clone", "--depth", "1", $GitUrl, $ClaudeDir) "克隆配置仓库 (认证)" 180000
         }
     }
     if (Test-CloneComplete) {
@@ -1676,15 +1675,13 @@ elseif (Test-Path $ClaudeDir) {
 }
 else {
     Log-Info "首次安装, 匿名克隆配置仓库..."
-    # v3.0.1 先匿名, 失败才弹凭证
     $r = Run-CmdWithUI "git" @("clone", "--depth", "1", $GitUrl, $ClaudeDir) "克隆配置仓库 (匿名)" 180000
     if (-not (Test-CloneComplete)) {
         Log-Warn "匿名克隆失败, 弹凭证对话框重试..."
         $cred = Show-GiteaCredentialDialog
         if ($cred) {
-            $cloneUrl = $GitUrl -replace '://', "://$([System.Uri]::EscapeDataString($cred.User)):$([System.Uri]::EscapeDataString($cred.Pass))@"
-            $r = Run-CmdWithUI "git" @("clone", "--depth", "1", $cloneUrl, $ClaudeDir) "克隆配置仓库 (认证)" 180000
-            if (Test-CloneComplete) { Cache-GitCredentials $cred }
+            Cache-GitCredentials $cred
+            $r = Run-CmdWithUI "git" @("clone", "--depth", "1", $GitUrl, $ClaudeDir) "克隆配置仓库 (认证)" 180000
         }
     }
     if (Test-CloneComplete) {
@@ -1718,9 +1715,8 @@ if (Test-Path (Join-Path $BootDir ".git")) {
         Log-Warn "匿名克隆失败, 弹凭证对话框重试..."
         $cred = Show-GiteaCredentialDialog
         if ($cred) {
-            $bootCloneUrl = $BootUrl -replace '://', "://$([System.Uri]::EscapeDataString($cred.User)):$([System.Uri]::EscapeDataString($cred.Pass))@"
-            $r = Run-CmdWithUI "git" @("clone", "--depth", "1", $bootCloneUrl, $BootDir) "克隆 boot 仓库 (认证)" 180000
-            if (Test-Path (Join-Path $BootDir "crypto-helper.js")) { Cache-GitCredentials $cred }
+            Cache-GitCredentials $cred
+            $r = Run-CmdWithUI "git" @("clone", "--depth", "1", $BootUrl, $BootDir) "克隆 boot 仓库 (认证)" 180000
         }
     }
     if (-not (Test-Path (Join-Path $BootDir "crypto-helper.js"))) {
diff --git a/bw-ota.ps1 b/bw-ota.ps1
index 5e508bc..2ff09dc 100644
--- a/bw-ota.ps1
+++ b/bw-ota.ps1
@@ -167,12 +167,12 @@ function Invoke-OtaSync ($cred, $cfg, $remoteVersion) {
 
     $stageDir = Join-Path $env:TEMP "bw-ota-$([Guid]::NewGuid().ToString().Substring(0,8))"
 
-    # 1. Clone (basic auth user:pass)
+    # 1. Clone (凭证通过 credential manager 传递, 不嵌入 URL)
     Write-Ota "下载 $ref ..."
-    $escapedUser = [Uri]::EscapeDataString($cred.user)
-    $escapedPass = [Uri]::EscapeDataString($cred.pass)
-    $cloneUrl = "https://${escapedUser}:${escapedPass}@${host_}/${repoPath}.git"
-    $cloneArgs = @('-c', 'core.longpaths=true', 'clone', '--depth', '1', '--branch', $ref, '--single-branch', $cloneUrl, $stageDir)
+    $plainUrl = "https://${host_}/${repoPath}.git"
+    $credInput = "protocol=https`nhost=${host_}`nusername=$($cred.user)`npassword=$($cred.pass)`n`n"
+    $credInput | & git credential approve 2>$null
+    $cloneArgs = @('-c', 'core.longpaths=true', 'clone', '--depth', '1', '--branch', $ref, '--single-branch', $plainUrl, $stageDir)
     & git @cloneArgs 2>&1 | Out-Null
     if ($LASTEXITCODE -ne 0) { throw "clone 失败 (exit $LASTEXITCODE)" }
     $gitDir = Join-Path $stageDir '.git'
@@ -276,9 +276,11 @@ process.exit(crypto.verify(null,d,k,s)?0:1);
         }
     }
     try {
-        Move-Item -Path $stageDir -Destination $ClaudeRoot -ErrorAction Stop
+        Copy-Item -Path $stageDir -Destination $ClaudeRoot -Recurse -Force -ErrorAction Stop
+        Remove-Item -Path $stageDir -Recurse -Force -ErrorAction SilentlyContinue
     } catch {
         if ($bakFull -and (Test-Path $bakFull)) {
+            Remove-Item -Path $ClaudeRoot -Recurse -Force -ErrorAction SilentlyContinue
             Rename-Item -Path $bakFull -NewName (Split-Path -Leaf $ClaudeRoot)
             Write-OtaWarn "替换失败, 已回滚到原版本"
         }