docs: remove outdated contents section

- Drop the Windows Scripts listing from README

Linux/install-aws-cli.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+#
+# AWS CLI Installation for Debian/Ubuntu
+# Installs the AWS CLI v2 via the official installer bundle when it is not
+# already available on the system. Required by install-caddy.sh for
+# downloading the Caddy binary from S3-compatible storage.
+#
+
+set -euo pipefail
+
+# Ensure script is executed with root privileges
+if [ "$(id -u)" -ne 0 ]; then
+    echo "Error: This script must be run as root." >&2
+    exit 1
+fi
+
+if command -v aws >/dev/null 2>&1; then
+    echo "==> aws-cli already installed at '$(command -v aws)'. Nothing to do."
+    exit 0
+fi
+
+echo "==> aws-cli not found, installing via official bundle..."
+TMP_DIR=$(mktemp -d)
+trap 'rm -rf "${TMP_DIR}"' EXIT
+
+curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "${TMP_DIR}/awscliv2.zip"
+unzip -q "${TMP_DIR}/awscliv2.zip" -d "${TMP_DIR}"
+"${TMP_DIR}/aws/install"
+
+echo "========================================================="
+echo " aws-cli installed successfully: $(command -v aws)"
+echo "========================================================="

Linux/install-base-deps.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+#
+# Base Dependencies Installation for Debian/Ubuntu
+# Installs the packages required by the other server initialisation scripts.
+#
+
+set -euo pipefail
+
+# Ensure script is executed with root privileges
+if [ "$(id -u)" -ne 0 ]; then
+    echo "Error: This script must be run as root." >&2
+    exit 1
+fi
+
+echo "==> Updating package index..."
+apt-get update -qq
+
+echo "==> Installing base dependencies (acl, libcap2-bin, rsync, curl, unzip)..."
+apt-get install -y acl libcap2-bin rsync curl unzip
+
+echo "========================================================="
+echo " Base dependencies installed successfully!"
+echo "========================================================="

Linux/install-caddy.sh

@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+#
+# Caddy Installation for Debian/Ubuntu
+# Downloads the Caddy binary (from a local file or S3-compatible storage),
+# creates the caddy:caddy system user and group, installs the binary with
+# cap_net_bind_service, prepares the config directory and registers the
+# systemd unit. The service itself is started by prepare-caddy-cicd.sh once
+# the site Caddyfile and web root exist.
+#
+
+set -euo pipefail
+
+# S3 and binary environment variables (with fallback defaults)
+S3_ENDPOINT="${S3_ENDPOINT:-}"
+S3_BUCKET="${S3_BUCKET:-}"
+S3_REGION="${S3_REGION:-us-east-1}"
+S3_ACCESS_KEY="${S3_ACCESS_KEY:-}"
+S3_SECRET_KEY="${S3_SECRET_KEY:-}"
+BIN_URI="${BIN_URI:-caddy-custom-linux-amd64}"
+# S3 addressing style: 'virtual' (default), 'path', or 'auto'
+S3_ADDRESSING_STYLE="${S3_ADDRESSING_STYLE:-virtual}"
+
+BIN_SOURCE="./${BIN_URI}"
+BIN_DEST="/usr/local/bin/caddy"
+CADDY_CONF_DIR="/etc/caddy"
+CADDY_DATA_DIR="/var/lib/caddy"
+
+# Ensure script is executed with root privileges
+if [ "$(id -u)" -ne 0 ]; then
+    echo "Error: This script must be run as root." >&2
+    exit 1
+fi
+
+echo "==> [1/5] Resolving Caddy binary..."
+if [ ! -f "${BIN_SOURCE}" ]; then
+    if [ -n "${S3_BUCKET}" ]; then
+        echo "Local binary '${BIN_SOURCE}' not found. Downloading from S3 bucket '${S3_BUCKET}'..."
+
+        # Configure addressing style and region
+        aws configure set default.s3.addressing_style "${S3_ADDRESSING_STYLE}"
+        aws configure set default.region "${S3_REGION}"
+
+        export AWS_ACCESS_KEY_ID="${S3_ACCESS_KEY}"
+        export AWS_SECRET_ACCESS_KEY="${S3_SECRET_KEY}"
+
+        AWS_CMD_ARGS=()
+        if [ -n "${S3_ENDPOINT}" ]; then
+            AWS_CMD_ARGS+=(--endpoint-url "${S3_ENDPOINT}")
+        fi
+
+        aws s3 cp "s3://${S3_BUCKET}/${BIN_URI}" "${BIN_SOURCE}" "${AWS_CMD_ARGS[@]}"
+        echo "Successfully downloaded '${BIN_URI}' from S3."
+    else
+        echo "Error: Local binary '${BIN_SOURCE}' not found, and S3_BUCKET is empty. Cannot continue." >&2
+        exit 1
+    fi
+else
+    echo "Found local binary at '${BIN_SOURCE}', skipping S3 download."
+fi
+
+echo "==> [2/5] Creating caddy system user and group..."
+# Create caddy system user and group (no login shell, dedicated home)
+if ! getent group caddy >/dev/null 2>&1; then
+    groupadd --system caddy
+fi
+
+if ! id -u caddy >/dev/null 2>&1; then
+    useradd --system \
+        --gid caddy \
+        --create-home \
+        --home-dir "${CADDY_DATA_DIR}" \
+        --shell /usr/sbin/nologin \
+        --comment "Caddy web server" \
+        caddy
+fi
+
+echo "==> [3/5] Installing Caddy binary and granting capabilities..."
+install -m 750 -o root -g caddy "${BIN_SOURCE}" "${BIN_DEST}"
+
+# Grant capability to bind to privileged ports (<1024) without running as root
+setcap 'cap_net_bind_service=+ep' "${BIN_DEST}"
+
+echo "==> [4/5] Preparing config directory (${CADDY_CONF_DIR})..."
+mkdir -p "${CADDY_CONF_DIR}"
+chown root:caddy "${CADDY_CONF_DIR}"
+chmod 755 "${CADDY_CONF_DIR}"
+
+echo "==> [5/5] Registering systemd service..."
+# The unit is only registered here; prepare-caddy-cicd.sh starts it once the
+# site Caddyfile and web root are in place.
+cat <<'EOF' > /etc/systemd/system/caddy.service
+[Unit]
+Description=Caddy
+Documentation=https://caddyserver.com/docs/
+After=network.target network-online.target
+Requires=network-online.target
+
+[Service]
+Type=notify
+User=caddy
+Group=caddy
+ExecStart=/usr/local/bin/caddy run --environ --config /etc/caddy/Caddyfile
+ExecReload=/usr/local/bin/caddy reload --config /etc/caddy/Caddyfile --force
+TimeoutStopSec=5s
+LimitNOFILE=1048576
+LimitNPROC=512
+PrivateTmp=true
+ProtectSystem=full
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+systemctl daemon-reload
+
+echo "========================================================="
+echo " Caddy installation finished successfully!"
+echo " - Binary: ${BIN_DEST} (Capabilities: cap_net_bind_service)"
+echo " - User/Group: caddy:caddy"
+echo " - Config dir: ${CADDY_CONF_DIR}"
+echo " - Service registered but not yet started."
+echo " - Next: run prepare-caddy-cicd.sh to create the site config"
+echo "         and web root, then start Caddy."
+echo "========================================================="

Linux/install-tosutil.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# Helper function to print and execute commands
+run_cmd() {
+    echo ">> Running: $*"
+    "$@"
+}
+
+# Determine sudo requirement
+SUDO=""
+if [ "$(id -u)" -ne 0 ]; then
+    SUDO="sudo"
+fi
+
+echo "=== Starting tosutil installation for Linux ==="
+
+# Architecture Detection
+ARCH=$(uname -m)
+case "$ARCH" in
+    x86_64|amd64)
+        BIN_URL="https://m645b3e1bb36e-mrap.mrap.accesspoint.tos-global.volces.com/linux/amd64/tosutil"
+        SHA_URL="https://m645b3e1bb36e-mrap.mrap.accesspoint.tos-global.volces.com/linux/amd64/tosutil.sha256sum"
+        echo "Detected architecture: amd64 (${ARCH})"
+        ;;
+    aarch64|arm64)
+        BIN_URL="https://m645b3e1bb36e-mrap.mrap.accesspoint.tos-global.volces.com/linux/arm64/tosutil"
+        SHA_URL="https://m645b3e1bb36e-mrap.mrap.accesspoint.tos-global.volces.com/linux/arm64/tosutil.sha256sum"
+        echo "Detected architecture: arm64 (${ARCH})"
+        ;;
+    *)
+        echo "Error: Unsupported architecture: ${ARCH}" >&2
+        exit 1
+        ;;
+esac
+
+TARGET_PATH="/usr/local/bin/tosutil"
+
+# Create isolated temporary directory
+TMP_DIR=$(mktemp -d /tmp/tosutil-install.XXXXXX)
+trap 'rm -rf "$TMP_DIR"' EXIT
+cd "$TMP_DIR"
+
+# Download binary and checksum
+echo -e "\n[1/5] Downloading tosutil binary and SHA256 checksum..."
+run_cmd wget -q --show-progress -O tosutil "$BIN_URL"
+run_cmd wget -q --show-progress -O tosutil.sha256sum "$SHA_URL"
+
+# Verify SHA256
+echo -e "\n[2/5] Verifying SHA256 checksum..."
+if grep -q "tosutil" tosutil.sha256sum; then
+    run_cmd sha256sum -c tosutil.sha256sum
+else
+    EXPECTED_HASH=$(awk '{print $1}' tosutil.sha256sum)
+    echo ">> Running: echo \"$EXPECTED_HASH  tosutil\" | sha256sum -c -"
+    echo "$EXPECTED_HASH  tosutil" | sha256sum -c -
+fi
+
+# Move binary to /usr/local/bin
+echo -e "\n[3/5] Moving binary to ${TARGET_PATH}..."
+run_cmd $SUDO mv tosutil "$TARGET_PATH"
+
+# Set ownership and permissions
+echo -e "\n[4/5] Setting owner and permissions..."
+run_cmd $SUDO chown root:root "$TARGET_PATH"
+run_cmd $SUDO chmod 755 "$TARGET_PATH"
+
+# Completion check
+echo -e "\n[5/5] Checking installation..."
+run_cmd tosutil version || true
+
+echo -e "\n========================================================"
+echo -e "✅ tosutil installed successfully to ${TARGET_PATH}."
+echo -e "========================================================"
+echo -e "\nNext Steps:"
+echo -e "1. Initialise and configure your credentials:"
+echo -e '   tosutil config -i "${TOS_ACCESS_KEY}" -k "${TOS_SECRET_KEY}" -e "${TOS_ENDPOINT}" -re "${TOS_REGION}"'
+echo -e "\n2. For more detailed documentation, visit:"
+echo -e "   https://docs.volcengine.com/docs/6349/148775?lang=zh\n"

Linux/prepare-caddy-cicd.sh

@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+#
+# Caddy CI/CD Serving Preparation for Debian/Ubuntu
+# Prepares the server so a CI/CD pipeline can publish content that Caddy
+# serves: creates the deployment user 'bot' with its SSH access, creates and
+# hands over the web root to bot:caddy with ACLs that keep it readable by the
+# Caddy server, writes the default site Caddyfile and sample page, then starts
+# the Caddy service. The web root defaults to /var/www and can be overridden
+# by exporting the WEB_ROOT environment variable before running.
+#
+
+set -euo pipefail
+
+# Web root served by Caddy; override by exporting WEB_ROOT before running
+WEB_ROOT="${WEB_ROOT:-/var/www}"
+CADDY_CONF_DIR="/etc/caddy"
+
+# Ensure script is executed with root privileges
+if [ "$(id -u)" -ne 0 ]; then
+    echo "Error: This script must be run as root." >&2
+    exit 1
+fi
+
+if [ ! -f /etc/systemd/system/caddy.service ]; then
+    echo "Error: caddy.service not found. Run install-caddy.sh first." >&2
+    exit 1
+fi
+
+if ! getent group caddy >/dev/null 2>&1; then
+    echo "Error: group 'caddy' does not exist. Run install-caddy.sh first." >&2
+    exit 1
+fi
+
+echo "==> [1/5] Creating deployment user 'bot'..."
+# Create deployment user 'bot'
+if ! id -u bot >/dev/null 2>&1; then
+    useradd -m -s /bin/bash bot
+fi
+
+echo "==> [2/5] Configuring SSH directory for bot..."
+# Configure SSH directory for bot
+install -d -m 700 -o bot -g bot /home/bot/.ssh
+touch /home/bot/.ssh/authorized_keys
+chown bot:bot /home/bot/.ssh/authorized_keys
+chmod 600 /home/bot/.ssh/authorized_keys
+
+echo "==> [3/5] Creating web root and handing it to bot (${WEB_ROOT})..."
+if [ ! -d "${WEB_ROOT}" ]; then
+    mkdir -p "${WEB_ROOT}"
+
+    cat <<EOF > "${WEB_ROOT}/index.html"
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <title>Caddy Ready</title>
+</head>
+<body>
+    <h1>Caddy server is running</h1>
+    <p>Static files root: <code>${WEB_ROOT}</code></p>
+</body>
+</html>
+EOF
+else
+    echo "    '${WEB_ROOT}' already exists - leaving existing content untouched."
+fi
+
+# Set base ownership: bot (deployment) and caddy (web server group)
+chown -R bot:caddy "${WEB_ROOT}"
+
+# Directory base permissions (SGID ensures newly created items inherit group 'caddy')
+find "${WEB_ROOT}" -type d -exec chmod 2755 {} +
+find "${WEB_ROOT}" -type f -exec chmod 644 {} +
+
+# Apply POSIX ACLs: bot has rwx, caddy has read/execute, with default inheritance
+setfacl -R -m u:bot:rwx,u:caddy:rX "${WEB_ROOT}"
+setfacl -R -d -m u:bot:rwx,u:caddy:rX "${WEB_ROOT}"
+
+echo "==> [4/5] Writing site Caddyfile (${CADDY_CONF_DIR}/Caddyfile)..."
+mkdir -p "${CADDY_CONF_DIR}"
+chown root:caddy "${CADDY_CONF_DIR}"
+chmod 755 "${CADDY_CONF_DIR}"
+
+if [ ! -f "${CADDY_CONF_DIR}/Caddyfile" ]; then
+    cat <<EOF > "${CADDY_CONF_DIR}/Caddyfile"
+:80 {
+    root * ${WEB_ROOT}
+    file_server
+}
+EOF
+    chown root:caddy "${CADDY_CONF_DIR}/Caddyfile"
+    chmod 644 "${CADDY_CONF_DIR}/Caddyfile"
+else
+    echo "    '${CADDY_CONF_DIR}/Caddyfile' already exists - leaving it untouched."
+fi
+
+echo "==> [5/5] Starting Caddy service..."
+systemctl enable --now caddy
+
+echo "========================================================="
+echo " Caddy CI/CD preparation finished successfully!"
+echo " - Deployment user: bot (SSH keys accepted in authorized_keys)"
+echo " - Web Root: ${WEB_ROOT} (owned by bot:caddy, readable by caddy)"
+echo " - Config: ${CADDY_CONF_DIR}/Caddyfile"
+echo " - Status: $(systemctl is-active caddy)"
+echo "========================================================="

README.md

@@ -2,15 +2,6 @@
 
 A collection of utility scripts for system and development task automation across Windows platforms. These scripts streamline common administrative tasks and enhance productivity.
 
-## Contents
-
-### Windows Scripts
-
-- **RouteManager.ps1** - PowerShell utility for managing network route configurations
-- **switch-right-click-menu-to-win10.cmd** - Switches Windows Explorer context menu to Windows 10 style
-- **switch-right-click-menu-to-win11.cmd** - Switches Windows Explorer context menu to Windows 11 style
-- **xiaoheshuangpin.reg** - Registry configuration for Xiaohe Shuangpin (小鹤双拼) Chinese input method
-
 ## Usage
 
 1. Review the specific script documentation before use

Windows/InstallTosutil.ps1

@@ -0,0 +1,102 @@
+# Requires -RunAsAdministrator
+[CmdletBinding()]
+param()
+
+$ErrorActionPreference = "Stop"
+
+# Architecture Check (Only AMD64 / 64-bit Intel/AMD is supported)
+$arch = $env:PROCESSOR_ARCHITECTURE
+if ($arch -ne "AMD64") {
+    Write-Error "Error: tosutil for Windows only supports AMD64 architecture. Detected architecture: $arch"
+    exit 1
+}
+
+# Configuration & URLs
+$binUrl = "https://m645b3e1bb36e-mrap.mrap.accesspoint.tos-global.volces.com/windows/tosutil"
+$shaUrl = "https://m645b3e1bb36e-mrap.mrap.accesspoint.tos-global.volces.com/windows/tosutil.sha256sum"
+
+$installDir = "$env:ProgramFiles\tosutil"
+$targetExe = Join-Path $installDir "tosutil.exe"
+
+# Helper function to print and run commands
+function Invoke-LoggedCommand {
+    param([string]$CommandText, [scriptblock]$Action)
+    Write-Host ">> Running: $CommandText" -ForegroundColor Cyan
+    & $Action
+}
+
+# Create Temporary Workspace
+$tempDir = Join-Path $env:TEMP ([System.IO.Path]::GetRandomFileName())
+New-Item -ItemType Directory -Path $tempDir | Out-Null
+
+try {
+    Write-Host "=== Starting tosutil installation for Windows (AMD64) ===" -ForegroundColor Green
+
+    $tempBin = Join-Path $tempDir "tosutil.exe"
+    $tempSha = Join-Path $tempDir "tosutil.sha256sum"
+
+    # Download binary & checksum
+    Write-Host "`n[1/5] Downloading tosutil binary and SHA256 checksum..." -ForegroundColor Yellow
+    Invoke-LoggedCommand "Invoke-WebRequest -Uri '$binUrl' -OutFile '$tempBin'" {
+        Invoke-WebRequest -Uri $binUrl -OutFile $tempBin -UseBasicParsing
+    }
+    Invoke-LoggedCommand "Invoke-WebRequest -Uri '$shaUrl' -OutFile '$tempSha'" {
+        Invoke-WebRequest -Uri $shaUrl -OutFile $tempSha -UseBasicParsing
+    }
+
+    # Verify SHA256
+    Write-Host "`n[2/5] Verifying SHA256 checksum..." -ForegroundColor Yellow
+    $rawExpected = (Get-Content -Path $tempSha -Raw).Trim()
+    $expectedHash = ($rawExpected -split '\s+')[0].ToLowerInvariant()
+
+    $computedHash = (Get-FileHash -Path $tempBin -Algorithm SHA256).Hash.ToLowerInvariant()
+    Write-Host ">> Expected: $expectedHash"
+    Write-Host ">> Actual:   $computedHash"
+
+    if ($computedHash -ne $expectedHash) {
+        Write-Error "SHA256 checksum verification failed!"
+        exit 1
+    }
+    Write-Host "SHA256 verification passed." -ForegroundColor Green
+
+    # Install binary
+    Write-Host "`n[3/5] Installing binary to $targetExe..." -ForegroundColor Yellow
+    if (-not (Test-Path $installDir)) {
+        Invoke-LoggedCommand "New-Item -ItemType Directory -Path '$installDir'" {
+            New-Item -ItemType Directory -Path $installDir | Out-Null
+        }
+    }
+    Invoke-LoggedCommand "Move-Item -Force -Path '$tempBin' -Destination '$targetExe'" {
+        Move-Item -Force -Path $tempBin -Destination $targetExe
+    }
+
+    # Add to System PATH
+    Write-Host "`n[4/5] Updating system PATH environment variable..." -ForegroundColor Yellow
+    $machinePath = [Environment]::GetEnvironmentVariable("Path", [EnvironmentVariableTarget]::Machine)
+    if ($machinePath -split ';' -notcontains $installDir) {
+        Invoke-LoggedCommand "Add '$installDir' to Machine PATH" {
+            [Environment]::SetEnvironmentVariable("Path", "$machinePath;$installDir", [EnvironmentVariableTarget]::Machine)
+            $env:Path = "$env:Path;$installDir"
+        }
+    } else {
+        Write-Host "Target directory already present in PATH."
+    }
+
+    # Verify installation
+    Write-Host "`n[5/5] Checking installation..." -ForegroundColor Yellow
+    Invoke-LoggedCommand "& '$targetExe' version" {
+        & "$targetExe" version
+    }
+
+    Write-Host "`n========================================================" -ForegroundColor Green
+    Write-Host "✅ tosutil installed successfully to $targetExe." -ForegroundColor Green
+    Write-Host "========================================================" -ForegroundColor Green
+    Write-Host "`nNext Steps:"
+    Write-Host "1. Initialise and configure your credentials (in PowerShell or CMD):"
+    Write-Host '   tosutil config -i "$env:TOS_ACCESS_KEY" -k "$env:TOS_SECRET_KEY" -e "$env:TOS_ENDPOINT" -re "$env:TOS_REGION"' -ForegroundColor Cyan
+    Write-Host "`n2. For more detailed documentation, visit:"
+    Write-Host "   https://docs.volcengine.com/docs/6349/148775?lang=zh`n"
+
+} finally {
+    Remove-Item -Recurse -Force -Path $tempDir -ErrorAction SilentlyContinue
+}

macOS/install-tosutil.command

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# Helper function to print and execute commands
+run_cmd() {
+    echo ">> Running: $*"
+    "$@"
+}
+
+# Determine sudo requirement
+SUDO=""
+if [ "$(id -u)" -ne 0 ]; then
+    SUDO="sudo"
+fi
+
+echo "=== Starting tosutil installation for macOS ==="
+
+# 1. Architecture Detection
+ARCH=$(uname -m)
+case "$ARCH" in
+    x86_64)
+        BIN_URL="https://m645b3e1bb36e-mrap.mrap.accesspoint.tos-global.volces.com/darwin/amd64/tosutil"
+        SHA_URL="https://m645b3e1bb36e-mrap.mrap.accesspoint.tos-global.volces.com/darwin/amd64/tosutil.sha256sum"
+        echo "Detected architecture: Intel (amd64)"
+        ;;
+    arm64)
+        BIN_URL="https://m645b3e1bb36e-mrap.mrap.accesspoint.tos-global.volces.com/darwin/arm64/tosutil"
+        SHA_URL="https://m645b3e1bb36e-mrap.mrap.accesspoint.tos-global.volces.com/darwin/arm64/tosutil.sha256sum"
+        echo "Detected architecture: Apple Silicon (arm64)"
+        ;;
+    *)
+        echo "Error: Unsupported architecture: $ARCH" >&2
+        exit 1
+        ;;
+esac
+
+TARGET_DIR="/usr/local/bin"
+TARGET_PATH="${TARGET_DIR}/tosutil"
+
+# 2. Create isolated temporary directory
+TMP_DIR=$(mktemp -d /tmp/tosutil-install.XXXXXX)
+trap 'rm -rf "$TMP_DIR"' EXIT
+cd "$TMP_DIR"
+
+# Step 1: Download binary and checksum via curl
+echo -e "\n[1/5] Downloading tosutil binary and SHA256 checksum..."
+run_cmd curl -fsSL -o tosutil "$BIN_URL"
+run_cmd curl -fsSL -o tosutil.sha256sum "$SHA_URL"
+
+# Step 2: Verify SHA256
+echo -e "\n[2/5] Verifying SHA256 checksum..."
+EXPECTED_HASH=$(awk '{print $1}' tosutil.sha256sum)
+echo ">> Running: echo \"$EXPECTED_HASH  tosutil\" | shasum -a 256 -c -"
+echo "$EXPECTED_HASH  tosutil" | shasum -a 256 -c -
+
+# Step 3: Ensure /usr/local/bin exists and move binary
+echo -e "\n[3/5] Moving binary to ${TARGET_PATH}..."
+if [ ! -d "$TARGET_DIR" ]; then
+    run_cmd $SUDO mkdir -p "$TARGET_DIR"
+fi
+run_cmd $SUDO mv tosutil "$TARGET_PATH"
+
+# Step 4: Set permissions and bypass macOS Gatekeeper quarantine
+echo -e "\n[4/5] Setting permissions and removing quarantine flag..."
+run_cmd $SUDO chown root:wheel "$TARGET_PATH"
+run_cmd $SUDO chmod 755 "$TARGET_PATH"
+# Remove quarantine attribute if present
+if run_cmd $SUDO xattr -d com.apple.quarantine "$TARGET_PATH" 2>/dev/null; then
+    echo "Removed quarantine attribute."
+fi
+
+# Step 5: Verify installation
+echo -e "\n[5/5] Checking installation..."
+run_cmd tosutil version || run_cmd tosutil --version || true
+
+echo -e "\n========================================================"
+echo -e "✅ tosutil installed successfully to ${TARGET_PATH}."
+echo -e "========================================================"
+echo -e "\nNext Steps:"
+echo -e "1. Initialise and configure your credentials:"
+echo -e '   tosutil config -i "${TOS_ACCESS_KEY}" -k "${TOS_SECRET_KEY}" -e "${TOS_ENDPOINT}" -re "${TOS_REGION}"'
+echo -e "\n2. For more detailed documentation, visit:"
+echo -e "   https://docs.volcengine.com/docs/6349/148775?lang=zh\n"