In `@internal/cmd/upgrade.go`:
- Around line 14-21: The -y/yesFlag currently sets Options.Force (used as
skipConfirm), enabling downgrades/reinstalls and bypassing the "already latest"
check; add an explicit "--force" flag wired to Options.Force (e.g., add {name:
"force", usage: "Force reinstall/downgrade", isBool: true} to upgradeFlags) and
change yesFlag to map to a separate "assume yes" behavior (e.g.,
Options.AssumeYes or skipConfirm) so that skipConfirm/assume-yes no longer
bypasses the early-exit "already latest" check; update usages of skipConfirm,
Options.Force, and the early-exit logic in the upgrade flow so only
Options.Force allows reinstall/downgrade and bypasses the latest-version check.

In `@internal/upgrade/cache.go`:
- Around line 108-154: The comment in CheckAndUpdateCache says "Log but don't
fail" but the LoadCache error is discarded; update CheckAndUpdateCache to
actually log the LoadCache error instead of silently setting cache=nil (or
remove the misleading comment). Specifically, inside CheckAndUpdateCache where
it calls LoadCache(), capture the returned err and call the project logger (or
the standard log package) to emit a descriptive message including the error
(e.g., "failed to load upgrade cache: %v") before continuing; reference the
LoadCache, CheckAndUpdateCache, and SaveCache symbols when making the change.

In `@internal/upgrade/download.go`:
- Around line 46-56: Replace the disabled timeout on the Resty HTTP client in
the download logic: instead of SetTimeout(0) on the client created with
resty.New() (the variable named client in internal/upgrade/download.go), set a
reasonable timeout (e.g. 30 minutes) so long-running binary downloads can
complete but the client won’t hang indefinitely; update the call to
SetTimeout(...) accordingly and add the time package import if missing, keeping
the existing SetRetryCount and AddRetryCondition and still using request context
(SetContext(ctx)).

In `@internal/upgrade/install.go`:
- Around line 224-256: The replaceWindowsBinary function fails when the running
binary cannot be renamed on Windows; modify the upgrade flow to perform the
replacement from a separate helper process (or schedule a deferred swap) instead
of attempting an in-process os.Rename. Concretely, change replaceWindowsBinary
(or call sites invoking it) to: write the new binary to a temp target, spawn a
short-lived helper (e.g., "dagu-replacer" or re-invoke the same executable with
a special --replace-mode flag) that waits for the parent PID to exit, then
renames target -> target.old, moves temp -> target, sets perms, and removes
.old; ensure the helper reports errors back (exit code/log) and that the main
process exits after launching the helper when performing an upgrade. Update any
logic that currently assumes immediate in-process replacement to use this
helper/deferred-replace mechanism.
- Around line 78-140: The path-traversal check in extractArchive (using
filepath.Clean + strings.HasPrefix("..") on f.NameInArchive) misses absolute and
Windows drive paths which can escape destDir; update the validation for
f.NameInArchive so you (1) reject absolute paths (use filepath.IsAbs(name)
and/or check filepath.VolumeName(name) != ""), (2) after computing targetPath :=
filepath.Join(destDir, name) verify the final path stays inside destDir by using
filepath.Rel(destDir, targetPath) and ensuring the returned rel path does not
start with ".." or equal ".." (and that no error occurred), and (3) return a
clear error referencing f.NameInArchive on violation; apply these checks before
creating directories or opening files in extractArchive.

In `@internal/upgrade/platform.go`:
- Around line 21-32: The switch on runtime.GOARCH unconditionally sets
p.Arch="armv7" for GOARCH=="arm", causing armv6 devices to get an incompatible
binary; update the branch handling "arm" to inspect runtime.GOARM and set p.Arch
to "armv6" when runtime.GOARM == "6" and "armv7" otherwise (e.g., runtime.GOARM
== "7"), ensuring this logic sits where p.Arch is assigned (in the same switch
that references runtime.GOARCH) and remains consistent with IsSupported() which
lists "armv6" and "armv7".

In `@internal/upgrade/upgrade.go`:
- Around line 103-117: The final "return true, \"\"" after the switch in
CanSelfUpgrade is unreachable; fix by moving the fallback into the switch as a
default case that returns true, "" (or remove the trailing return and add a
default: return true, "" inside the switch), so that
DetectInstallMethod/InstallMethod handling remains exhaustive and there is no
unreachable statement; update the switch in CanSelfUpgrade accordingly
(reference: function CanSelfUpgrade, DetectInstallMethod, InstallMethod* cases).
- Around line 246-252: The UpgradeCheckCache instance saved by SaveCache omits
LastCheck, leaving it as the zero time so IsCacheValid will always fail; set
LastCheck: time.Now() when constructing the UpgradeCheckCache (where
CurrentVersion/LatestVersion/UpdateAvailable are set) and ensure the package
imports time if not already present so the timestamp compiles.

In `@ui/src/layouts/Layout.tsx`:
- Around line 177-180: The page scroll is caused by the outer <main
className="flex-1 overflow-auto"> plus the inner div using h-full; change the
layout to a column flex container and move scrolling into the content pane: make
the <main> a flex column with className including "flex flex-col flex-1 min-h-0"
(so it respects children' min heights), render <UpdateBanner /> first, then
change the inner content div (the one with children) to be the scrollable area
by replacing "p-4 md:p-6 w-full h-full" with "p-4 md:p-6 w-full flex-1 min-h-0
overflow-auto" so the banner remains fixed and only the content pane scrolls.