diff --git a/VERSION b/VERSION
index 93f609d..45da1e2 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2026.05.20-private.3
+2026.05.20-private.4
diff --git a/scripts/update.sh b/scripts/update.sh
index 7e09fac..47317e3 100755
--- a/scripts/update.sh
+++ b/scripts/update.sh
@@ -96,6 +96,22 @@ ok "NGINX_BIND=${_NGINX_BIND}"
 
 [ -n "$_CONSOLE_DOMAIN" ] || fail "config/xuqm.env 中 CONSOLE_DOMAIN 未设置，请手动补充后重试"
 
+# CONSOLE_DOMAIN 若为裸 IP（内网/公网）则强制要求更新为域名，否则 SDK URL 无法从外部访问
+_domain_stripped="$(printf '%s' "$_CONSOLE_DOMAIN" | sed 's|https\?://||' | cut -d: -f1)"
+if printf '%s' "$_domain_stripped" | grep -qE \
+     '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$)'; then
+  warn "CONSOLE_DOMAIN 当前为 IP 地址（${_CONSOLE_DOMAIN}），客户端浏览器可能无法访问"
+  printf '  外部访问域名应为公网域名（如 https://console.example.com）\n'
+  read -rp "  请输入正确的外部访问地址（直接回车保持不变）: " _new_domain
+  if [ -n "$_new_domain" ]; then
+    _set_env "$ROOT_DIR/config/xuqm.env" "CONSOLE_DOMAIN" "$_new_domain"
+    _CONSOLE_DOMAIN="$_new_domain"
+    ok "CONSOLE_DOMAIN 已更新 → ${_CONSOLE_DOMAIN}"
+  else
+    warn "保持原值 ${_CONSOLE_DOMAIN}，如外部无法访问请手动修改 config/xuqm.env 后重试"
+  fi
+fi
+
 # ---------------------------------------------------------------------------
 # 1. 修复配置问题
 # ---------------------------------------------------------------------------
@@ -114,9 +130,11 @@ _SDK_FILE_URL="${_CONSOLE_DOMAIN}"
 
 _FIXED=0
 
-# 检查 SDK_IM_WS_URL
+# 检查 SDK_IM_WS_URL（xuqinmin.com 残留 或 内网/裸 IP 均需修复）
 _CURRENT_WS="$(grep '^SDK_IM_WS_URL=' "$ROOT_DIR/config/xuqm.env" 2>/dev/null | cut -d= -f2- || echo '')"
-if [ -z "$_CURRENT_WS" ] || printf '%s' "$_CURRENT_WS" | grep -qi 'xuqinmin\.com'; then
+# ws/wss URL 转为 http/https 格式后复用 _url_needs_fix
+_CURRENT_WS_AS_HTTP="$(printf '%s' "$_CURRENT_WS" | sed 's|^wss://|https://|; s|^ws://|http://|')"
+if _url_needs_fix "$_CURRENT_WS_AS_HTTP"; then
   _set_env "$ROOT_DIR/config/xuqm.env" "SDK_IM_WS_URL" "$_SDK_IM_WS_URL"
   ok "SDK_IM_WS_URL 已更新 → ${_SDK_IM_WS_URL}"
   _FIXED=1
@@ -124,9 +142,21 @@ else
   ok "SDK_IM_WS_URL 正常: ${_CURRENT_WS}"
 fi
 
+# 辅助函数：检查一个 URL 是否需要修复（空、xuqinmin.com 残留、或裸 IP）
+_url_needs_fix() {
+  local val="$1"
+  local host
+  host="$(printf '%s' "$val" | sed 's|https\?://||' | cut -d/ -f1 | cut -d: -f1)"
+  [ -z "$val" ] && return 0
+  printf '%s' "$val" | grep -qi 'xuqinmin\.com' && return 0
+  printf '%s' "$host" | grep -qE \
+    '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$)' && return 0
+  return 1
+}
+
 # 检查 SDK_IM_API_URL
 _CURRENT_IM_API="$(grep '^SDK_IM_API_URL=' "$ROOT_DIR/config/xuqm.env" 2>/dev/null | cut -d= -f2- || echo '')"
-if [ -z "$_CURRENT_IM_API" ] || printf '%s' "$_CURRENT_IM_API" | grep -qi 'xuqinmin\.com'; then
+if _url_needs_fix "$_CURRENT_IM_API"; then
   _set_env "$ROOT_DIR/config/xuqm.env" "SDK_IM_API_URL" "$_SDK_IM_API_URL"
   ok "SDK_IM_API_URL 已更新 → ${_SDK_IM_API_URL}"
   _FIXED=1
@@ -136,7 +166,7 @@ fi
 
 # 检查 SDK_FILE_SERVICE_URL
 _CURRENT_FILE="$(grep '^SDK_FILE_SERVICE_URL=' "$ROOT_DIR/config/xuqm.env" 2>/dev/null | cut -d= -f2- || echo '')"
-if [ -z "$_CURRENT_FILE" ] || printf '%s' "$_CURRENT_FILE" | grep -qi 'xuqinmin\.com'; then
+if _url_needs_fix "$_CURRENT_FILE"; then
   _set_env "$ROOT_DIR/config/xuqm.env" "SDK_FILE_SERVICE_URL" "$_SDK_FILE_URL"
   ok "SDK_FILE_SERVICE_URL 已更新 → ${_SDK_FILE_URL}"
   _FIXED=1