fix(python): integrate venv startup with source dependency support

fix(python): keep source dependency installs and removals in selected venv
fix(python): integrate latest develop and support older venv pip
2026-11-03 16:19:11 +08:00 · 2026-10-13 02:24:12 +08:00 · 2026-10-13 02:21:10 +08:00 · 2026-10-13 02:20:59 +08:00 · 2026-10-13 01:11:35 +08:00 · 2026-10-13 01:07:50 +08:00
54 changed files with 1396 additions and 1926 deletions
@@ -21,3 +21,6 @@ JWT_EXPIRES_IN=
 QINIU_AK=
 QINIU_SK=
 QINIU_SCOPE=
+
+# Python 虚拟环境路径，留空则使用系统 Python
+# PYTHON_VENV_DIR=./.venv
@@ -120,7 +120,7 @@ jobs:
        run: |
          docker run --rm --network none --entrypoint node \
            qinglong-readiness:${{ matrix.image }} \
-            -e 'const assert=require("node:assert/strict"); const {createRequire}=require("node:module"); for(const [name,want] of Object.entries({"@grpc/grpc-js":"1.14.5",compression:"1.8.2",multer:"2.3.0",sequelize:"6.37.8"}))assert.equal(require(name+"/package.json").version,want); const expressRequire=createRequire(require.resolve("express")); assert.equal(expressRequire("proxy-addr/package.json").version,"2.0.8"); const sockRequire=createRequire(require.resolve("sockjs")); assert.equal(sockRequire("websocket-driver/package.json").version,"0.7.5"); require("sqlite3"); require("nodemailer"); require("undici"); console.log("Minimal production patches and runtime imports verified")'
+            -e 'const assert=require("node:assert/strict"); const {createRequire}=require("node:module"); for(const [name,want] of Object.entries({"@grpc/grpc-js":"1.14.5",compression:"1.8.2",multer:"2.4.0",sequelize:"6.37.8"}))assert.equal(require(name+"/package.json").version,want); const expressRequire=createRequire(require.resolve("express")); assert.equal(expressRequire("proxy-addr/package.json").version,"2.0.8"); const sockRequire=createRequire(require.resolve("sockjs")); assert.equal(sockRequire("websocket-driver/package.json").version,"0.7.5"); require("sqlite3"); require("nodemailer"); require("undici"); console.log("Minimal production patches and runtime imports verified")'
      - name: Export native Debian image for isolated dev validation
        if: matrix.image == 'debian'
        run: |
@@ -1,17 +0,0 @@
-# Assign existing resources to accounts
-
-The panel adds ownership columns automatically while preserving existing data. Unassigned historical data is visible only to administrators. Ordinary users can read their assigned environment variables, task metadata and subscription metadata; dependencies and execution remain administrative operations.
-
-Prefer the authenticated administrator endpoint `PUT /api/user-management/:id/resources` with a body such as `{"resource":"envs","ids":[1,2]}`. Supported resources are `envs`, `crons` and `subscriptions`. Assignment does not run tasks or move files.
-
-The optional local migration helper assigns every unassigned row to one existing account. Stop the panel and back up `data/db/database.sqlite` before using it; set `QL_DIR` or `QL_DATA_DIR` when the data directory differs from the repository default. The helper refuses to create a new empty database.
-
-```bash
-node migrate-to-multiuser.js --list-users
-node migrate-to-multiuser.js --username=alice --dry-run
-node migrate-to-multiuser.js --username=alice
-```
-
-Already assigned rows are preserved and writes run in a transaction. Dependencies may receive an owner for bookkeeping, but remain inaccessible to ordinary users. To allocate only selected rows, use the administrator resource endpoint instead of the bulk helper.
-
-See [the permission contract](docs/development/multiuser-permissions.md).
@@ -1,7 +0,0 @@
-# Multi-user accounts
-
-Administrators can create, disable and delete accounts in Settings → User Management. New administrator accounts have full access to the shared instance. Ordinary accounts can only read their assigned environment variables, task metadata and subscription metadata. They cannot execute tasks, read shared files or logs, install dependencies, or modify system settings.
-
-Existing data with no owner remains visible only to administrators. The original administrator and its password migration, MFA and sessions are preserved. Accounts from older drafts that used bcrypt require an administrator password reset.
-
-See [the permission contract](docs/development/multiuser-permissions.md) and [resource migration](MIGRATION_GUIDE.md). This draft does not provide isolated execution for untrusted users.
@@ -0,0 +1,10 @@
+# Node.js 原生部署与 Python venv
+
+设置 `QL_DIR` 为安装目录，`QL_DATA_DIR` 为以 `/data` 结尾的绝对持久化数据路径。
+如需隔离 Python，请在启动进程的环境中显式设置 `PYTHON_VENV_DIR`（绝对路径或相对 `QL_DIR` 的路径），例如 `export PYTHON_VENV_DIR=/srv/qinglong/.venv`。未设置时保留现有 Python prefix 行为。
+
+- `qinglong`（`shell/start.sh`）安装系统依赖和 Node 工具，并安装 Python requests，然后调用公共启动脚本。
+- `npm run start:simple`（`shell/start-simplify.sh`）使用已准备的 Node、pm2、nginx、jq 等依赖，不安装系统包、全局 npm 包或 requests；显式指定的 venv 不存在时仍会创建。请先在 venv 中安装 requests 和任务所需依赖。
+- 两种启动方式均保留已有 `.env`；使用 venv 时清除继承的 `PYTHONPATH`/`PYTHONUSERBASE`，依赖查询、安装和卸载使用该 venv 的 Python。
+
+该模式需具备现有启动流程所要求的 nginx 配置和 pm2 服务权限。生产环境设置变量应通过 systemd 的 `Environment` 或相应进程配置完成。已有系统 Python 依赖不自动迁移至 venv，需在 venv 中重新安装。
@@ -12,7 +12,6 @@ import subscription from './subscription';
 import update from './update';
 import dashboard from './dashboard';
 import health from './health';
-import userManagement from './userManagement';
 import clientIp from './clientIp';
 import retention from './retention';

@@ -31,7 +30,6 @@ export default () => {
  update(app);
  dashboard(app);
  health(app);
-  userManagement(app);
  clientIp(app);
  retention(app);

@@ -76,17 +76,7 @@ export default (app: Router) => {
      try {
        const userService = Container.get(UserService);
        const token = getToken(req);
-        if (req.user?.userId) {
-          const { default: UserManagementService } = await import(
-            '../services/userManagement'
-          );
-          await Container.get(UserManagementService).revokeToken(
-            req.user.userId,
-            token,
-          );
-        } else {
-          await userService.logout(req.platform, token);
-        }
+        await userService.logout(req.platform, token);
        res.send({ code: 200 });
      } catch (e) {
        return next(e);
@@ -108,16 +98,6 @@ export default (app: Router) => {
          return res.send({ code: 450, message: t('未知错误') });
        }
        const userService = Container.get(UserService);
-        if (req.user?.userId) {
-          const { default: UserManagementService } = await import(
-            '../services/userManagement'
-          );
-          await Container.get(UserManagementService).update({
-            id: req.user.userId,
-            ...req.body,
-          });
-          return res.send({ code: 200 });
-        }
        const result = await userService.updateUsernameAndPassword(req.body);
        res.send(result);
      } catch (e) {
@@ -130,28 +110,10 @@ export default (app: Router) => {
    const logger: Logger = Container.get('logger');
    try {
      const userService = Container.get(UserService);
-      if (req.user?.userId) {
-        const { default: UserManagementService } = await import(
-          '../services/userManagement'
-        );
-        const account = await Container.get(UserManagementService).get(
-          req.user.userId,
-        );
-        return res.send({
-          code: 200,
-          data: {
-            username: account.username,
-            role: account.role,
-            id: account.id,
-            readOnly: account.role === 1,
-          },
-        });
-      }
      const authInfo = await userService.getAuthInfo();
      res.send({
        code: 200,
        data: {
-          role: 0,
          username: authInfo.username,
          avatar: authInfo.avatar,
          twoFactorActivated: authInfo.twoFactorActivated,
@@ -1,168 +0,0 @@
-import { Router, Request, Response, NextFunction } from 'express';
-import { Container } from 'typedi';
-import { celebrate, Joi } from 'celebrate';
-import UserManagementService from '../services/userManagement';
-import { UserRole, UserStatus } from '../data/user';
-import { EnvModel } from '../data/env';
-import { CrontabModel } from '../data/cron';
-import { SubscriptionModel } from '../data/subscription';
-
-const route = Router();
-
-// Middleware to check if user is admin
-const requireAdmin = (req: Request, res: Response, next: NextFunction) => {
-  if (req.user && req.user.role === UserRole.admin) {
-    return next();
-  }
-  return res.status(403).send({ code: 403, message: '需要管理员权限' });
-};
-
-export default (app: Router) => {
-  app.use('/user-management', route);
-
-  // List all users (admin only)
-  route.get(
-    '/',
-    requireAdmin,
-    async (req: Request, res: Response, next: NextFunction) => {
-      try {
-        const userManagementService = Container.get(UserManagementService);
-        const data = await userManagementService.list(
-          req.query.searchValue as string,
-        );
-        res.send({ code: 200, data });
-      } catch (e) {
-        return next(e);
-      }
-    },
-  );
-
-  route.put(
-    '/:id/resources',
-    requireAdmin,
-    celebrate({
-      params: Joi.object({ id: Joi.number().integer().positive().required() }),
-      body: Joi.object({
-        resource: Joi.string()
-          .valid('envs', 'crons', 'subscriptions')
-          .required(),
-        ids: Joi.array()
-          .min(1)
-          .max(200)
-          .unique()
-          .items(Joi.number().integer().positive())
-          .required(),
-      }),
-    }),
-    async (req, res, next) => {
-      try {
-        const id = Number(req.params.id);
-        await Container.get(UserManagementService).get(id);
-        const models: Record<string, any> = {
-          envs: EnvModel,
-          crons: CrontabModel,
-          subscriptions: SubscriptionModel,
-        };
-        const [count] = await models[req.body.resource].update(
-          { userId: id },
-          { where: { id: req.body.ids } },
-        );
-        return res.json({ code: 200, data: { assigned: count } });
-      } catch (error) {
-        return next(error);
-      }
-    },
-  );
-
-  // Get a specific user (admin only)
-  route.get(
-    '/:id',
-    requireAdmin,
-    celebrate({ params: Joi.object({ id: Joi.number().integer().positive().required() }) }),
-    async (req: Request, res: Response, next: NextFunction) => {
-      try {
-        const userManagementService = Container.get(UserManagementService);
-        const data = await userManagementService.get(Number(req.params.id));
-        res.send({ code: 200, data });
-      } catch (e) {
-        return next(e);
-      }
-    },
-  );
-
-  // Create a new user (admin only)
-  route.post(
-    '/',
-    requireAdmin,
-    celebrate({
-      body: Joi.object({
-        username: Joi.string().trim().max(255).required(),
-        password: Joi.string().min(6).max(1024).required(),
-        role: Joi.number()
-          .valid(UserRole.admin, UserRole.user)
-          .default(UserRole.user),
-        status: Joi.number()
-          .valid(UserStatus.active, UserStatus.disabled)
-          .optional(),
-      }),
-    }),
-    async (req: Request, res: Response, next: NextFunction) => {
-      try {
-        const userManagementService = Container.get(UserManagementService);
-        const data = await userManagementService.create(req.body);
-        res.send({ code: 200, data, message: '创建用户成功' });
-      } catch (e: any) {
-        return res.send({ code: 400, message: e.message });
-      }
-    },
-  );
-
-  // Update a user (admin only)
-  route.put(
-    '/',
-    requireAdmin,
-    celebrate({
-      body: Joi.object({
-        id: Joi.number().integer().positive().required(),
-        username: Joi.string().trim().max(255).required(),
-        password: Joi.string().min(6).max(1024).optional().allow(''),
-        role: Joi.number().valid(UserRole.admin, UserRole.user),
-        status: Joi.number()
-          .valid(UserStatus.active, UserStatus.disabled)
-          .optional(),
-      }),
-    }),
-    async (req: Request, res: Response, next: NextFunction) => {
-      try {
-        const userManagementService = Container.get(UserManagementService);
-        const data = await userManagementService.update(req.body);
-        res.send({ code: 200, data, message: '更新用户成功' });
-      } catch (e: any) {
-        return res.send({ code: 400, message: e.message });
-      }
-    },
-  );
-
-  // Delete users (admin only)
-  route.delete(
-    '/',
-    requireAdmin,
-    celebrate({
-      body: Joi.array()
-        .min(1)
-        .max(200)
-        .unique()
-        .items(Joi.number().integer().positive())
-        .required(),
-    }),
-    async (req: Request, res: Response, next: NextFunction) => {
-      try {
-        const userManagementService = Container.get(UserManagementService);
-        const count = await userManagementService.delete(req.body);
-        res.send({ code: 200, data: count, message: '删除用户成功' });
-      } catch (e) {
-        return next(e);
-      }
-    },
-  );
-};
@@ -27,6 +27,7 @@ export const SAMPLE_FILES = [
 ];

 export const PYTHON_INSTALL_DIR = process.env.PYTHON_HOME;
+export const PYTHON_VENV_DIR = process.env.PYTHON_VENV_DIR;

 export const NotificationModeStringMap = {
  0: 'gotify',
@@ -1,18 +1,25 @@
 import * as fs from 'fs/promises';
+import { statSync } from 'fs';
 import * as path from 'path';
 import { exec, execSync } from 'child_process';
 import psTreeFun from 'ps-tree';
 import { promisify } from 'util';
 import { load } from 'js-yaml';
 import config from './index';
-import { PYTHON_INSTALL_DIR, TASK_COMMAND } from './const';
+import { PYTHON_INSTALL_DIR, PYTHON_VENV_DIR, TASK_COMMAND } from './const';
 import Logger from '../loaders/logger';
 import { writeFileWithLock } from '../shared/utils';
 import { DependenceTypes } from '../data/dependence';
 import { FormData } from 'undici';
 import os from 'os';
 import { maybeSudo, isInContainer } from './container';
+import { shellQuote } from '../shared/shellQuote';
 import { resolveFileAccess } from '../shared/fileAccess';
+import {
+  mirrorWriteCommand,
+  normalizeMirror,
+  rewriteMirrorSources,
+} from '../shared/linuxMirror';

 export * from './share';

@@ -670,7 +677,9 @@ export async function setSystemTimezone(timezone: string): Promise<boolean> {
      throw new Error('Invalid timezone');
    }

-    await promiseExec(maybeSudo(`ln -sf /usr/share/zoneinfo/${timezone} /etc/localtime`));
+    await promiseExec(
+      maybeSudo(`ln -sf /usr/share/zoneinfo/${timezone} /etc/localtime`),
+    );
    await promiseExec(`echo "${timezone}" | ${maybeSudo('tee /etc/timezone')}`);

    return true;
@@ -680,61 +689,150 @@ export async function setSystemTimezone(timezone: string): Promise<boolean> {
  }
 }

+// Helper function to check if a name is a GitHub URL
+function getPythonExecutable(): string {
+  return PYTHON_VENV_DIR
+    ? shellQuote(path.resolve(config.rootPath, PYTHON_VENV_DIR, 'bin/python3'))
+    : 'python3';
+}
+
+function getPythonPip(): string {
+  return PYTHON_VENV_DIR ? `${getPythonExecutable()} -m pip` : 'pip3';
+}
+
+function isGitHubUrl(name: string): boolean {
+  // Support git+https://, git+http://, https://, and http:// URLs
+  // This covers GitHub URLs and other git-compatible repositories
+  return !!name.match(/^(git\+https?:\/\/|https?:\/\/)/i);
+}
+
+// Helper function to check if a name is a requirements file
+function isRequirementsFile(name: string): boolean {
+  return !!name.match(/requirements.*\.(txt|in)$/i);
+}
+
+// Helper function to check if a name is a pyproject.toml file
+function isPyprojectToml(name: string): boolean {
+  return name.endsWith('pyproject.toml');
+}
+
 export function getGetCommand(type: DependenceTypes, name: string): string {
+  const trimmedName = name.trim();
+
+  // For Python dependencies installed from GitHub or requirements files,
+  // we can't reliably check if they're installed, so skip the check
+  if (type === DependenceTypes.python3) {
+    if (
+      isGitHubUrl(trimmedName) ||
+      isRequirementsFile(trimmedName) ||
+      isPyprojectToml(trimmedName)
+    ) {
+      // Return a command that will always indicate not installed
+      // This ensures GitHub URLs and requirements files are always installed
+      return 'echo ""';
+    }
+  }
+
  const baseCommands = {
-    [DependenceTypes.nodejs]: `pnpm ls -g  | grep "${name}" | head -1`,
-    [DependenceTypes.python3]: `
-    python3 -c "exec('''
-name='${name}'
-try:
-    from importlib.metadata import version
-    print(version(name))
-except:
-    import importlib.util as u
-    import importlib.metadata as m
-    spec=u.find_spec(name)
-    print(name if spec else '')
-''')"`,
-    [DependenceTypes.linux]: getOsTypeSync() === 'Alpine'
-      ? `apk info -es ${name}`
-      : maybeSudo(`dpkg-query -s ${name}`),
+    [DependenceTypes.nodejs]: `pnpm ls -g  | grep "${trimmedName}" | head -1`,
+    [DependenceTypes.python3]: `${getPythonExecutable()} -c ${shellQuote(
+      `from importlib.metadata import version\nimport importlib.util as u\nname=${JSON.stringify(
+        trimmedName,
+      )}\ntry:\n print(version(name))\nexcept Exception:\n print(name if u.find_spec(name) else '')`,
+    )}`,
+    [DependenceTypes.linux]:
+      getOsTypeSync() === 'Alpine'
+        ? `apk info -es ${trimmedName}`
+        : maybeSudo(`dpkg-query -s ${trimmedName}`),
  };

  return baseCommands[type];
 }

 export function getInstallCommand(type: DependenceTypes, name: string): string {
+  if (type === DependenceTypes.python3) {
+    const prefix =
+      PYTHON_INSTALL_DIR && !PYTHON_VENV_DIR
+        ? ` --prefix=${shellQuote(PYTHON_INSTALL_DIR)}`
+        : '';
+    const pip = `${getPythonPip()} install --disable-pip-version-check${
+      PYTHON_VENV_DIR ? '' : ' --root-user-action=ignore'
+    }${prefix}`;
+    name = name.trim();
+    if (isRequirementsFile(name) || isPyprojectToml(name)) {
+      const file = [config.scriptPath, config.repoPath]
+        .filter(Boolean)
+        .map((root) => resolveFileAccess(root, [name]))
+        .find((file) => {
+          if (!file) return false;
+          try {
+            return statSync(file).isFile();
+          } catch {
+            return false;
+          }
+        });
+      if (!file)
+        throw new Error(
+          'Python dependency file must be inside scripts or repo',
+        );
+      return isRequirementsFile(name)
+        ? `${pip} -r ${shellQuote(file)}`
+        : `${pip} ${shellQuote(path.dirname(file))}`;
+    }
+    return `${pip} -- ${shellQuote(name)}`;
+  }
  const baseCommands = {
    [DependenceTypes.nodejs]: 'pnpm add -g',
-    [DependenceTypes.python3]:
-      'pip3 install --disable-pip-version-check --root-user-action=ignore',
-    [DependenceTypes.linux]: getOsTypeSync() === 'Alpine'
-      ? 'apk add --no-check-certificate'
-      : maybeSudo('apt-get install -y'),
+    [DependenceTypes.linux]:
+      getOsTypeSync() === 'Alpine'
+        ? 'apk add --no-check-certificate'
+        : maybeSudo('apt-get install -y'),
  };
-
-  let command = baseCommands[type];
-
-  if (type === DependenceTypes.python3 && PYTHON_INSTALL_DIR) {
-    command = `${command} --prefix=${PYTHON_INSTALL_DIR}`;
-  }
-
-  return `${command} ${name.trim()}`;
+  return `${baseCommands[type]} ${name.trim()}`;
 }

 export function getUninstallCommand(
  type: DependenceTypes,
  name: string,
 ): string {
+  if (type === DependenceTypes.python3) {
+    name = name.trim();
+    if (isRequirementsFile(name)) {
+      const file = [config.scriptPath, config.repoPath]
+        .filter(Boolean)
+        .map((root) => resolveFileAccess(root, [name]))
+        .find((file) => {
+          if (!file) return false;
+          try {
+            return statSync(file).isFile();
+          } catch {
+            return false;
+          }
+        });
+      if (!file)
+        throw new Error(
+          'Python dependency file must be inside scripts or repo',
+        );
+      return `${getPythonPip()} uninstall --disable-pip-version-check${
+        PYTHON_VENV_DIR ? '' : ' --root-user-action=ignore'
+      } -y -r ${shellQuote(file)}`;
+    }
+    if (isPyprojectToml(name) || isGitHubUrl(name)) {
+      // A source URL/project can install several distributions and has no safe
+      // inverse. Removing its panel entry leaves installed packages intact.
+      return `printf '%s\\n' ${shellQuote(
+        'Remove installed Python distributions separately by package name.',
+      )}`;
+    }
+    return `${getPythonPip()} uninstall --disable-pip-version-check${
+      PYTHON_VENV_DIR ? '' : ' --root-user-action=ignore'
+    } -y -- ${shellQuote(name)}`;
+  }
  const baseCommands = {
    [DependenceTypes.nodejs]: 'pnpm remove -g',
-    [DependenceTypes.python3]:
-      'pip3 uninstall --disable-pip-version-check --root-user-action=ignore -y',
-    [DependenceTypes.linux]: getOsTypeSync() === 'Alpine'
-      ? 'apk del'
-      : maybeSudo('apt-get remove -y'),
+    [DependenceTypes.linux]:
+      getOsTypeSync() === 'Alpine' ? 'apk del' : maybeSudo('apt-get remove -y'),
  };
-
  return `${baseCommands[type]} ${name.trim()}`;
 }

@@ -806,77 +904,73 @@ export async function detectOS(): Promise<
  return osType;
 }

-async function getCurrentMirrorDomain(
-  filePath: string,
-): Promise<string | null> {
-  const fileContent = await fs.readFile(filePath, 'utf8');
-  const lines = fileContent.split('\n');
-  for (const line of lines) {
-    if (line.trim().startsWith('#')) {
-      continue;
-    }
-    const match = line.match(/https?:\/\/[^\/]+/);
-    if (match) {
-      return match[0];
-    }
-  }
-  return null;
-}
-
-async function replaceDomainInFile(
-  filePath: string,
-  oldDomainWithScheme: string,
-  newDomainWithScheme: string,
-): Promise<void> {
-  let fileContent = await fs.readFile(filePath, 'utf8');
-  let updatedContent = fileContent.replace(
-    new RegExp(oldDomainWithScheme, 'g'),
-    newDomainWithScheme,
-  );
-
-  if (!newDomainWithScheme.endsWith('/')) {
-    newDomainWithScheme += '/';
-  }
-
-  await writeFileWithLock(filePath, updatedContent);
-}
-
 async function _updateLinuxMirror(
  osType: string,
-  mirrorDomainWithScheme: string,
+  mirror: string,
 ): Promise<string> {
+  const defaults: Record<string, string> = {
+    Debian: 'http://deb.debian.org/debian',
+    Ubuntu: 'http://archive.ubuntu.com/ubuntu',
+    Alpine: 'http://dl-cdn.alpinelinux.org/alpine',
+  };
+  if (!defaults[osType])
+    throw new Error('Unsupported OS type for updating mirrors.');
+  const target = mirror || defaults[osType];
+  normalizeMirror(target);
  const S = isInContainer() ? 'sudo ' : '';
-  // APT otherwise returns zero when index downloads fail with transient errors.
-  const aptUpdate = `${S}apt-get update --error-on=any`;
-  let filePath: string, currentDomainWithScheme: string | null;
-  switch (osType) {
-    case 'Debian':
-      filePath = '/etc/apt/sources.list.d/debian.sources';
-      currentDomainWithScheme = await getCurrentMirrorDomain(filePath);
-      if (currentDomainWithScheme) {
-        return `${S}sed -i 's|${currentDomainWithScheme}|${mirrorDomainWithScheme || 'http://deb.debian.org'}|g' ${filePath} || (${S}mkdir -p /etc/apt/sources.list.d && echo -e "Types: deb\\nURIs: ${mirrorDomainWithScheme || 'http://deb.debian.org'}\\nSuites: \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2) \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2)-updates\\nComponents: main\\nSigned-By: /usr/share/keyrings/debian-archive-keyring.gpg" | ${S}tee ${filePath}) && ${aptUpdate}`;
-      } else {
-        return `${S}mkdir -p /etc/apt/sources.list.d && echo -e "Types: deb\\nURIs: ${mirrorDomainWithScheme || 'http://deb.debian.org'}\\nSuites: \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2) \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2)-updates\\nComponents: main\\nSigned-By: /usr/share/keyrings/debian-archive-keyring.gpg" | ${S}tee ${filePath} && ${aptUpdate}`;
+  const update =
+    osType === 'Alpine' ? 'apk update' : `${S}apt-get update --error-on=any`;
+  let file =
+    osType === 'Alpine'
+      ? '/etc/apk/repositories'
+      : `/etc/apt/sources.list.d/${osType.toLowerCase()}.sources`;
+  let content = '';
+  try {
+    content = await fs.readFile(file, 'utf8');
+  } catch (error: any) {
+    if (error.code !== 'ENOENT') throw error;
+    if (osType !== 'Alpine') {
+      try {
+        file = '/etc/apt/sources.list';
+        content = await fs.readFile(file, 'utf8');
+      } catch (legacyError: any) {
+        if (legacyError.code !== 'ENOENT') throw legacyError;
+        file = `/etc/apt/sources.list.d/${osType.toLowerCase()}.sources`;
      }
-    case 'Ubuntu':
-      filePath = '/etc/apt/sources.list.d/ubuntu.sources';
-      currentDomainWithScheme = await getCurrentMirrorDomain(filePath);
-      if (currentDomainWithScheme) {
-        return `${S}sed -i 's|${currentDomainWithScheme}|${mirrorDomainWithScheme || 'http://archive.ubuntu.com'}|g' ${filePath} || (${S}mkdir -p /etc/apt/sources.list.d && echo -e "Types: deb\\nURIs: ${mirrorDomainWithScheme || 'http://archive.ubuntu.com'}\\nSuites: \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2) \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2)-updates \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2)-backports\\nComponents: main restricted universe multiverse\\nSigned-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg" | ${S}tee ${filePath}) && ${aptUpdate}`;
-      } else {
-        return `${S}mkdir -p /etc/apt/sources.list.d && echo -e "Types: deb\\nURIs: ${mirrorDomainWithScheme || 'http://archive.ubuntu.com'}\\nSuites: \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2) \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2)-updates \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2)-backports\\nComponents: main restricted universe multiverse\\nSigned-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg" | ${S}tee ${filePath} && ${aptUpdate}`;
-      }
-    case 'Alpine':
-      filePath = '/etc/apk/repositories';
-      currentDomainWithScheme = await getCurrentMirrorDomain(filePath);
-      if (currentDomainWithScheme) {
-        return `sed -i 's|${currentDomainWithScheme}|${mirrorDomainWithScheme || 'http://dl-cdn.alpinelinux.org'}|g' ${filePath} || (mkdir -p /etc/apk && echo -e "\\$(grep VERSION_ID /etc/os-release | cut -d= -f2 | cut -d. -f1,2)/main\\n\\$(grep VERSION_ID /etc/os-release | cut -d= -f2 | cut -d. -f1,2)/community" | sed "s|^|${mirrorDomainWithScheme || 'http://dl-cdn.alpinelinux.org'}/alpine/v|" | tee ${filePath}) && apk update`;
-      } else {
-        return `mkdir -p /etc/apk && echo -e "\\$(grep VERSION_ID /etc/os-release | cut -d= -f2 | cut -d. -f1,2)/main\\n\\$(grep VERSION_ID /etc/os-release | cut -d= -f2 | cut -d. -f1,2)/community" | sed "s|^|${mirrorDomainWithScheme || 'http://dl-cdn.alpinelinux.org'}/alpine/v|" | tee ${filePath} && apk update`;
-      }
-    default:
-      throw Error('Unsupported OS type for updating mirrors.');
+    }
  }
+  if (!content.trim()) {
+    const release = await fs.readFile('/etc/os-release', 'utf8');
+    if (osType === 'Alpine') {
+      const version = release.match(/^VERSION_ID=["']?(\d+\.\d+)/m)?.[1];
+      if (!version)
+        throw new Error('Cannot determine Alpine repository version');
+      content = `${defaults.Alpine}/v${version}/main\n${defaults.Alpine}/v${version}/community\n`;
+    } else {
+      // The fallback may have read an empty legacy .list. Deb822 stanzas must
+      // be written to a .sources file, leaving the legacy file untouched.
+      file = `/etc/apt/sources.list.d/${osType.toLowerCase()}.sources`;
+      const codename = release.match(/^VERSION_CODENAME=["']?([\w-]+)/m)?.[1];
+      if (!codename)
+        throw new Error('Cannot determine APT repository codename');
+      const ubuntu = osType === 'Ubuntu';
+      content = `Types: deb\nURIs: ${
+        defaults[osType]
+      }\nSuites: ${codename} ${codename}-updates${
+        ubuntu ? ` ${codename}-backports` : ''
+      }\nComponents: ${
+        ubuntu ? 'main restricted universe multiverse' : 'main'
+      }\nSigned-By: /usr/share/keyrings/${osType.toLowerCase()}-archive-keyring.gpg\n`;
+      if (!ubuntu)
+        content += `\nTypes: deb\nURIs: http://security.debian.org/debian-security\nSuites: ${codename}-security\nComponents: main\nSigned-By: /usr/share/keyrings/debian-archive-keyring.gpg\n`;
+    }
+  }
+  return mirrorWriteCommand(
+    file,
+    rewriteMirrorSources(content, target),
+    S,
+    update,
+  );
 }

 export async function updateLinuxMirrorFile(mirror: string): Promise<string> {
@@ -25,7 +25,6 @@ export class Crontab {
  log_name?: string;
  allow_multiple_instances?: 1 | 0;
  work_dir?: string;
-  userId?: number;

  constructor(options: Crontab) {
    this.name = options.name;
@@ -53,7 +52,6 @@ export class Crontab {
    this.log_name = options.log_name;
    this.allow_multiple_instances = options.allow_multiple_instances || 0;
    this.work_dir = options.work_dir;
-    this.userId = options.userId;
  }
 }

@@ -97,5 +95,4 @@ export const CrontabModel = sequelize.define<CronInstance>('Crontab', {
  log_name: DataTypes.STRING,
  allow_multiple_instances: DataTypes.NUMBER,
  work_dir: DataTypes.STRING,
-  userId: { type: DataTypes.INTEGER, allowNull: true },
 });
@@ -9,7 +9,6 @@ export class Dependence {
  name: string;
  log?: string[];
  remark?: string;
-  userId?: number;

  constructor(options: Dependence) {
    this.id = options.id;
@@ -22,7 +21,6 @@ export class Dependence {
    this.name = options.name.trim();
    this.log = options.log || [];
    this.remark = options.remark || '';
-    this.userId = options.userId;
  }
 }

@@ -61,6 +59,5 @@ export const DependenceModel = sequelize.define<DependenceInstance>(
    status: DataTypes.NUMBER,
    log: DataTypes.JSON,
    remark: DataTypes.STRING,
-    userId: { type: DataTypes.NUMBER, allowNull: true },
  },
 );
@@ -9,7 +9,6 @@ export class Env {
  position?: number;
  name?: string;
  remarks?: string;
-  userId?: number;
  isPinned?: 1 | 0;
  labels?: string[];

@@ -24,7 +23,6 @@ export class Env {
    this.position = options.position;
    this.name = options.name;
    this.remarks = options.remarks || '';
-    this.userId = options.userId;
    this.isPinned = options.isPinned || 0;
    this.labels = options.labels || [];
  }
@@ -48,7 +46,6 @@ export const EnvModel = sequelize.define<EnvInstance>('Env', {
  position: DataTypes.NUMBER,
  name: { type: DataTypes.STRING, unique: 'compositeIndex' },
  remarks: DataTypes.STRING,
-  userId: { type: DataTypes.NUMBER, allowNull: true },
  isPinned: DataTypes.NUMBER,
  labels: DataTypes.JSON,
 });
@@ -31,7 +31,6 @@ export class Subscription {
  proxy?: string;
  autoAddCron?: 1 | 0;
  autoDelCron?: 1 | 0;
-  userId?: number;

  constructor(options: Subscription) {
    this.id = options.id;
@@ -61,7 +60,6 @@ export class Subscription {
    this.proxy = options.proxy;
    this.autoAddCron = options.autoAddCron ? 1 : 0;
    this.autoDelCron = options.autoDelCron ? 1 : 0;
-    this.userId = options.userId;
  }
 }

@@ -113,6 +111,5 @@ export const SubscriptionModel = sequelize.define<SubscriptionInstance>(
    proxy: { type: DataTypes.STRING, allowNull: true },
    autoAddCron: { type: DataTypes.NUMBER, allowNull: true },
    autoDelCron: { type: DataTypes.NUMBER, allowNull: true },
-    userId: { type: DataTypes.NUMBER, allowNull: true },
  },
 );
@@ -1,59 +0,0 @@
-import { sequelize } from '.';
-import { DataTypes, Model } from 'sequelize';
-
-export class User {
-  id?: number;
-  username: string;
-  password: string;
-  role: UserRole;
-  status: UserStatus;
-  createdAt?: Date;
-  updatedAt?: Date;
-  sessions?: { digest: string; platform: string }[];
-
-  constructor(options: User) {
-    this.id = options.id;
-    this.username = options.username;
-    this.password = options.password;
-    this.role = options.role ?? UserRole.user;
-    this.status =
-      typeof options.status === 'number' && UserStatus[options.status]
-        ? options.status
-        : UserStatus.active;
-    this.createdAt = options.createdAt;
-    this.updatedAt = options.updatedAt;
-    this.sessions = options.sessions || [];
-  }
-}
-
-export enum UserRole {
-  'admin' = 0,
-  'user' = 1,
-}
-
-export enum UserStatus {
-  'active' = 0,
-  'disabled' = 1,
-}
-
-export interface UserInstance extends Model<User, User>, User {}
-export const UserModel = sequelize.define<UserInstance>('User', {
-  sessions: { type: DataTypes.JSON, allowNull: false, defaultValue: [] },
-  username: {
-    type: DataTypes.STRING,
-    unique: true,
-    allowNull: false,
-  },
-  password: {
-    type: DataTypes.STRING,
-    allowNull: false,
-  },
-  role: {
-    type: DataTypes.INTEGER,
-    defaultValue: UserRole.user,
-  },
-  status: {
-    type: DataTypes.INTEGER,
-    defaultValue: UserStatus.active,
-  },
-});
@@ -9,8 +9,6 @@ import { CrontabViewModel } from '../data/cronView';
 import { CrontabStatModel } from '../data/cronStats';
 import { RunningInstanceModel } from '../data/runningInstance';
 import { sequelize } from '../data';
-import { UserModel } from '../data/user';
-import { migrateUserSchema } from '../shared/userSchemaMigrations';
 import { migrateSchema } from '../shared/schemaMigrations';

 export default async () => {
@@ -25,9 +23,7 @@ export default async () => {
    await CrontabStatModel.sync();
    await RunningInstanceModel.sync();

-    await UserModel.sync();
    await migrateSchema(sequelize);
-    await migrateUserSchema(sequelize);

    Logger.info('[boot] DB loaded');
  } catch (error) {
@@ -13,8 +13,6 @@ import { isValidToken, isDefaultAuthInfo } from '../shared/auth';
 import { AuthInfo } from '../data/system';
 import path from 'path';
 import { t } from '../shared/i18n';
-import { Container } from 'typedi';
-import jwt from 'jsonwebtoken';
 import { AppScope } from '../data/open';
 import uniqueConstraintError from '../middlewares/uniqueConstraintError';
 import protectedPathCase from '../middlewares/protectedPathCase';
@@ -146,26 +144,6 @@ export default ({ app }: { app: Application }) => {

    const authInfo = await shareStore.getAuthInfo();
    if (isValidToken(authInfo, headerToken, req.platform, config.jwt.secret)) {
-      req.user = { role: 0 };
-      return next();
-    }
-    const claims = jwt.decode(headerToken);
-    let account = null;
-    if (
-      typeof claims === 'object' &&
-      Number.isSafeInteger(claims?.userId) &&
-      claims!.userId > 0
-    ) {
-      const { default: UserManagementService } = await import(
-        '../services/userManagement'
-      );
-      account = await Container.get(UserManagementService).validateToken(
-        headerToken,
-        req.platform,
-      );
-    }
-    if (account) {
-      req.user = { userId: account.id, role: account.role };
      return next();
    }

@@ -199,17 +177,16 @@ export default ({ app }: { app: Application }) => {
  });

  app.use(rewrite('/open/*', '/api/$1'));
-  app.use(
-    config.api.prefix,
-    async (req, res, next) => {
-      if (!req.user || req.user.role === 0) return next();
-      const { userAccess } = await import('../middlewares/userAccess');
-      return userAccess(req, res, next);
-    },
-    routes(),
-  );
+  app.use(config.api.prefix, routes());

-  app.get('*', (_, res, next) => {
+  app.get('*', (req, res, next) => {
+    // Don't serve index.html for API routes
+    if (
+      req.path === config.api.prefix ||
+      req.path.startsWith(`${config.api.prefix}/`)
+    ) {
+      return res.status(404).json({ code: 404, message: 'Not Found' });
+    }
    const indexPath = path.join(frontendPath, 'index.html');
    res.sendFile(indexPath, (err) => {
      if (err) {
@@ -6,7 +6,6 @@ import { getPlatform } from '../config/util';
 import { shareStore } from '../shared/store';
 import { isValidToken } from '../shared/auth';
 import config from '../config';
-import jwt from 'jsonwebtoken';

 export default async ({ server }: { server: Server }) => {
  const echo = sockJs.createServer({
@@ -18,30 +17,6 @@ export default async ({ server }: { server: Server }) => {
  let sessionTimer: ReturnType<typeof setInterval> | undefined;
  let checking = false;

-  const validateSession = async (
-    authInfo: any,
-    token: string,
-    platform: string,
-  ) => {
-    if (isValidToken(authInfo, token, platform, config.jwt.secret)) return true;
-    const claims = jwt.decode(token);
-    if (
-      !claims ||
-      typeof claims === 'string' ||
-      !Number.isSafeInteger(claims.userId) ||
-      claims.userId <= 0
-    )
-      return false;
-    const { default: UserManagementService } = await import(
-      '../services/userManagement'
-    );
-    const account = await Container.get(UserManagementService).validateToken(
-      token,
-      platform,
-    );
-    return account?.role === 0;
-  };
-
  const checkSessions = async () => {
    if (checking || sessions.size === 0) return;
    checking = true;
@@ -60,7 +35,7 @@ export default async ({ server }: { server: Server }) => {
        }
        let valid = platforms.get(platform);
        if (valid === undefined) {
-          valid = await validateSession(current, token, platform);
+          valid = isValidToken(current, token, platform, config.jwt.secret);
          platforms.set(platform, valid);
        }
        if (!valid) conn.close('401');
@@ -102,8 +77,7 @@ export default async ({ server }: { server: Server }) => {
    const platform = getPlatform(conn.headers['user-agent'] || '') || 'desktop';
    const headerToken = conn.url.replace(`${conn.pathname}?token=`, '');

-    if (await validateSession(authInfo, headerToken, platform)) {
-      if (closed) return;
+    if (isValidToken(authInfo, headerToken, platform, config.jwt.secret)) {
      sockService.addClient(conn);
      sessions.set(conn, { token: headerToken, platform });
      if (!sessionTimer) {
@@ -1,68 +0,0 @@
-import { Request, Response, NextFunction } from 'express';
-import { Op } from 'sequelize';
-import { EnvModel } from '../data/env';
-import { CrontabModel } from '../data/cron';
-import { SubscriptionModel } from '../data/subscription';
-
-// Ordinary users are read-only until task workers and shared files are isolated.
-export async function userAccess(
-  req: Request,
-  res: Response,
-  next: NextFunction,
-) {
-  if (!req.user || req.user.role === 0) return next();
-  const userId = req.user.userId;
-  if (!Number.isSafeInteger(userId) || userId! <= 0)
-    return res.status(403).json({ code: 403, message: '需要有效用户会话' });
-  const pathname = req.path.replace(/\/$/, '') || '/';
-  if (
-    (req.method === 'GET' &&
-      ['/user', '/system', '/health'].includes(pathname)) ||
-    (req.method === 'POST' && pathname === '/user/logout')
-  )
-    return next();
-  if (req.method === 'GET' && pathname === '/crons/views')
-    return res.json({ code: 200, data: [] });
-  const match = pathname.match(
-    /^\/(envs|crons|subscriptions)(?:\/([1-9][0-9]*))?$/,
-  );
-  if (req.method !== 'GET' || !match)
-    return res
-      .status(403)
-      .json({
-        code: 403,
-        message: '普通用户只读自己的数据，执行和系统修改由管理员负责',
-      });
-  try {
-    const models: Record<string, any> = {
-      envs: EnvModel,
-      crons: CrontabModel,
-      subscriptions: SubscriptionModel,
-    };
-    const model = models[match[1]];
-    const where: any = { userId };
-    if (match[2]) {
-      const id = Number(match[2]);
-      if (!Number.isSafeInteger(id))
-        return res.status(400).json({ code: 400, message: '无效 ID' });
-      where.id = id;
-      const doc = await model.findOne({ where });
-      return doc
-        ? res.json({ code: 200, data: doc.get({ plain: true }) })
-        : res.status(404).json({ code: 404, message: '数据不存在' });
-    }
-    const search =
-      typeof req.query.searchValue === 'string'
-        ? req.query.searchValue.slice(0, 1024)
-        : '';
-    if (search) where.name = { [Op.like]: `%${search}%` };
-    const docs = await model.findAll({ where, order: [['createdAt', 'DESC']] });
-    const data = docs.map((doc: any) => doc.get({ plain: true }));
-    return res.json({
-      code: 200,
-      data: match[1] === 'crons' ? { data, total: data.length } : data,
-    });
-  } catch (error) {
-    return next(error);
-  }
-}
@@ -32,10 +32,11 @@ export default class DependenceService {
  constructor(
    @Inject('logger') private logger: winston.Logger,
    private sockService: SockService,
-  ) { }
+  ) {}

  public async create(payloads: Dependence[]): Promise<Dependence[]> {
    const tabs = payloads.map((x) => {
+      getInstallCommand(x.type, x.name);
      const tab = new Dependence({ ...x, status: DependenceStatus.queued });
      return tab;
    });
@@ -59,6 +60,7 @@ export default class DependenceService {
      ...other,
      status: DependenceStatus.queued,
    });
+    getInstallCommand(tab.type, tab.name);
    const newDoc = await this.updateDb(tab);
    this.installDependenceOneByOne([newDoc]);
    return newDoc;
@@ -296,6 +298,23 @@ export default class DependenceService {
    force: boolean = false,
  ) {
    return taskLimit.runDependeny(dependency, () => {
+      let validatedCommand: string;
+      try {
+        validatedCommand = isInstall
+          ? getInstallCommand(dependency.type, dependency.name.trim())
+          : getUninstallCommand(dependency.type, dependency.name.trim());
+      } catch (error) {
+        taskLimit.removeQueuedDependency(dependency);
+        return DependenceModel.update(
+          {
+            status: isInstall
+              ? DependenceStatus.installFailed
+              : DependenceStatus.removeFailed,
+            log: [String(error)],
+          },
+          { where: { id: dependency.id } },
+        ).then(() => null);
+      }
      return new Promise(async (resolve) => {
        if (taskLimit.firstDependencyId !== dependency.id) {
          return resolve(null);
@@ -345,9 +364,7 @@ export default class DependenceService {
          : DependenceStatus.removing;
        await DependenceModel.update({ status }, { where: { id: depIds } });

-        let command = isInstall
-          ? getInstallCommand(dependency.type, depName)
-          : getUninstallCommand(dependency.type, depName);
+        let command = validatedCommand;
        if (isLinuxDependence) {
          command = isInstall
            ? `${linuxCommand.install} ${depName.trim()}`
@@ -470,15 +487,20 @@ export default class DependenceService {

          const message =
            '\n' +
-            tf('依赖%s%s，结束时间 %s，耗时 %s 秒',
-            actionText,
-            resultText,
-            endTime.format('YYYY-MM-DD HH:mm:ss'),
-            String(endTime.diff(startTime, 'second')),
-          );
+            tf(
+              '依赖%s%s，结束时间 %s，耗时 %s 秒',
+              actionText,
+              resultText,
+              endTime.format('YYYY-MM-DD HH:mm:ss'),
+              String(endTime.diff(startTime, 'second')),
+            );
          const exitStatus = isSucceed
-            ? (isInstall ? DependenceStatus.installed : DependenceStatus.removed)
-            : (isInstall ? DependenceStatus.installFailed : DependenceStatus.removeFailed);
+            ? isInstall
+              ? DependenceStatus.installed
+              : DependenceStatus.removed
+            : isInstall
+            ? DependenceStatus.installFailed
+            : DependenceStatus.removeFailed;
          this.sockService.sendMessage({
            type: socketMessageType,
            message,
@@ -34,13 +34,10 @@ import {
 } from '../shared/password';
 import { serializeAuthMutation } from '../shared/authMutation';
 import { LoginThrottle } from '../shared/loginThrottle';
-import UserManagementService from './userManagement';

@Service()
 export default class UserService {
  private loginThrottle = new LoginThrottle();
-  @Inject((type) => UserManagementService)
-  private userManagementService!: UserManagementService;
  @Inject((type) => NotificationService)
  private notificationService!: NotificationService;

@@ -120,24 +117,6 @@ export default class UserService {
      };
    }

-    if (username !== cUsername) {
-      const account = await this.userManagementService.authenticate(
-        username,
-        password,
-      );
-      if (account) {
-        this.loginThrottle.reset(ip);
-        const token = await this.userManagementService.issueToken(
-          account,
-          req.platform,
-        );
-        return {
-          code: 200,
-          data: { token, username: account.username, role: account.role },
-        };
-      }
-    }
-
    const passwordMatches =
      username === cUsername && (await verifyPassword(password, cPassword));

@@ -1,160 +0,0 @@
-import { Service, Inject } from 'typedi';
-import winston from 'winston';
-import { User, UserModel, UserStatus } from '../data/user';
-import { Op } from 'sequelize';
-import { createHash, randomBytes } from 'crypto';
-import jwt from 'jsonwebtoken';
-import config from '../config';
-import {
-  hashPassword,
-  verifyPassword,
-  isPasswordHash,
-} from '../shared/password';
-import { serializeAuthMutation } from '../shared/authMutation';
-import { shareStore } from '../shared/store';
-
-type PublicUser = Omit<User, 'password' | 'sessions'>;
-function publicUser(user: User): PublicUser {
-  const { password, sessions, ...result } = user;
-  return result;
-}
-function digest(token: string) {
-  return createHash('sha256').update(token).digest('hex');
-}
-
-@Service()
-export default class UserManagementService {
-  constructor(@Inject('logger') private logger: winston.Logger) {}
-
-  public async list(searchText?: string): Promise<PublicUser[]> {
-    const where = searchText
-      ? { username: { [Op.like]: `%${searchText}%` } }
-      : {};
-    return (await UserModel.findAll({ where })).map((x) =>
-      publicUser(x.get({ plain: true })),
-    );
-  }
-  public async get(id: number): Promise<PublicUser> {
-    const doc = await UserModel.findByPk(id);
-    if (!doc) throw Object.assign(new Error('用户不存在'), { status: 404 });
-    return publicUser(doc.get({ plain: true }));
-  }
-  public async getByUsername(username: string): Promise<User | null> {
-    return (
-      (await UserModel.findOne({ where: { username } }))?.get({
-        plain: true,
-      }) || null
-    );
-  }
-  @serializeAuthMutation
-  public async create(payload: User): Promise<PublicUser> {
-    const auth = await shareStore.getAuthInfo();
-    if (
-      auth?.username === payload.username ||
-      (await this.getByUsername(payload.username))
-    )
-      throw Object.assign(new Error('用户名已存在'), { status: 400 });
-    if (!payload.password || payload.password.length < 6)
-      throw Object.assign(new Error('密码长度至少为6位'), { status: 400 });
-    const user = new User({
-      ...payload,
-      password: await hashPassword(payload.password),
-      sessions: [],
-    });
-    return publicUser((await UserModel.create(user)).get({ plain: true }));
-  }
-  @serializeAuthMutation
-  public async update(
-    payload: Partial<User> & { id: number },
-  ): Promise<PublicUser> {
-    const existing = await this.get(payload.id);
-    if (payload.username && payload.username !== existing.username) {
-      const auth = await shareStore.getAuthInfo();
-      if (
-        auth?.username === payload.username ||
-        (await this.getByUsername(payload.username))
-      )
-        throw Object.assign(new Error('用户名已存在'), { status: 400 });
-    }
-    const changes: Partial<User> = {};
-    for (const key of ['username', 'role', 'status'] as const)
-      if (payload[key] !== undefined) (changes as any)[key] = payload[key];
-    if (payload.password) {
-      if (payload.password.length < 6)
-        throw Object.assign(new Error('密码长度至少为6位'), { status: 400 });
-      changes.password = await hashPassword(payload.password);
-    }
-    if (Object.keys(changes).length) changes.sessions = [];
-    await UserModel.update(changes, { where: { id: payload.id } });
-    return this.get(payload.id);
-  }
-  @serializeAuthMutation
-  public async delete(ids: number[]): Promise<number> {
-    return UserModel.destroy({ where: { id: ids } });
-  }
-  public async authenticate(
-    username: string,
-    password: string,
-  ): Promise<User | null> {
-    const user = await this.getByUsername(username);
-    if (
-      !user ||
-      user.status !== UserStatus.active ||
-      !isPasswordHash(user.password)
-    )
-      return null;
-    return (await verifyPassword(password, user.password)) ? user : null;
-  }
-  // Caller holds the shared account mutation queue during authentication and issuance.
-  public async issueToken(user: User, platform: string): Promise<string> {
-    const token = jwt.sign(
-      { userId: user.id, nonce: randomBytes(32).toString('hex') },
-      config.jwt.secret,
-      { expiresIn: config.jwt.expiresIn || '20d', algorithm: 'HS384' },
-    );
-    const sessions = [
-      ...(user.sessions || []).filter((x) => x.platform !== platform),
-      { digest: digest(token), platform },
-    ].slice(-10);
-    await UserModel.update({ sessions }, { where: { id: user.id } });
-    return token;
-  }
-  public async validateToken(
-    token: string,
-    platform: string,
-  ): Promise<PublicUser | null> {
-    try {
-      const payload = jwt.verify(token, config.jwt.secret, {
-        algorithms: ['HS384'],
-      });
-      if (
-        typeof payload === 'string' ||
-        !Number.isSafeInteger(payload.userId) ||
-        payload.userId <= 0
-      )
-        return null;
-      const user = (await UserModel.findByPk(payload.userId))?.get({
-        plain: true,
-      });
-      if (
-        !user ||
-        user.status !== UserStatus.active ||
-        !user.sessions?.some(
-          (x) => x.digest === digest(token) && x.platform === platform,
-        )
-      )
-        return null;
-      return publicUser(user);
-    } catch {
-      return null;
-    }
-  }
-  @serializeAuthMutation
-  public async revokeToken(id: number, token: string): Promise<void> {
-    const user = await UserModel.findByPk(id);
-    if (!user) return;
-    await user.update({
-      sessions: (user.sessions || []).filter((x) => x.digest !== digest(token)),
-    });
-  }
-}
@@ -0,0 +1,121 @@
+import { shellQuote } from './shellQuote';
+
+const repositoryNames =
+  /^(debian(?:-security)?|ubuntu(?:-ports)?|alpine|armbian)$/;
+
+export function normalizeMirror(mirror: string): URL {
+  if (/\s/.test(mirror)) throw new Error('Invalid Linux mirror URL');
+  const url = new URL(mirror);
+  if (
+    !['http:', 'https:'].includes(url.protocol) ||
+    url.username ||
+    url.password ||
+    url.search ||
+    url.hash
+  ) {
+    throw new Error(
+      'Linux mirror must be an HTTP(S) URL without credentials, query or fragment',
+    );
+  }
+  return url;
+}
+
+export function replaceMirrorUrl(current: string, mirror: string): string {
+  const target = normalizeMirror(mirror);
+  const previous = new URL(current);
+  const oldSegments = previous.pathname.split('/').filter(Boolean);
+  const newSegments = target.pathname.split('/').filter(Boolean);
+  const repositoryIndex = oldSegments.findIndex((part) =>
+    repositoryNames.test(part),
+  );
+  const targetIndex = newSegments.findIndex((part) =>
+    repositoryNames.test(part),
+  );
+  const prefix =
+    targetIndex >= 0 ? newSegments.slice(0, targetIndex) : newSegments;
+  if (repositoryIndex >= 0) {
+    const repository = oldSegments[repositoryIndex];
+    let suffix = oldSegments.slice(repositoryIndex + 1);
+    // Repair paths already corrupted by repeated authority-only replacement.
+    while (suffix[0] === repository) suffix.shift();
+    return `${target.origin}/${[...prefix, repository, ...suffix].join('/')}`;
+  }
+  // Unknown repository paths: a full URL replaces the old root, a hostname
+  // preserves it. Never append the newly entered root to the existing root.
+  return `${target.origin}/${(newSegments.length
+    ? newSegments
+    : oldSegments
+  ).join('/')}`;
+}
+
+export function rewriteMirrorSources(content: string, mirror: string): string {
+  normalizeMirror(mirror);
+  return content
+    .split(/(\r?\n[ \t]*\r?\n)/)
+    .map((stanza) => {
+      const signedBy = stanza.match(/^Signed-By:\s*([^\r\n]*)/im)?.[1];
+      return stanza
+        .split('\n')
+        .map((line) => {
+          if (!/^\s*(?:URIs:|deb(?:-src)?\s|https?:\/\/)/.test(line))
+            return line;
+          const legacy = /^\s*deb(?:-src)?\s/.test(line);
+          const key = legacy
+            ? line.match(/\bsigned-by=([^\]\s]+)/i)?.[1]
+            : signedBy;
+          // In .list files a # starts an inline comment; its URLs are metadata.
+          const comment = legacy ? line.indexOf('#') : -1;
+          const source = comment < 0 ? line : line.slice(0, comment);
+          const rewritten = source.replace(/https?:\/\/[^\s#]+/g, (url) =>
+            isSystemRepository(url, key) ? replaceMirrorUrl(url, mirror) : url,
+          );
+          return rewritten + (comment < 0 ? '' : line.slice(comment));
+        })
+        .join('\n');
+    })
+    .join('');
+}
+
+function isSystemRepository(url: string, signedBy?: string): boolean {
+  const keys =
+    signedBy
+      ?.trim()
+      .split(/[\s,]+/)
+      .filter(Boolean) || [];
+  const archiveKeyring =
+    keys.length > 0 &&
+    keys.every((key) =>
+      /\/(?:debian|ubuntu|armbian)-archive-keyring\.(?:gpg|asc)$/.test(key),
+    );
+  // A separate signing key identifies a third-party archive, even if its
+  // repository happens to be called /debian or /ubuntu.
+  if (keys.length > 0 && !archiveKeyring) return false;
+  const segments = new URL(url).pathname.split('/').filter(Boolean);
+  const repositoryIndex = segments.findIndex((part) =>
+    repositoryNames.test(part),
+  );
+  if (repositoryIndex < 0) return false;
+  // Without archive metadata, accept only conventional archive roots. A
+  // vendor path such as Docker's /linux/debian is not the Debian archive.
+  return (
+    archiveKeyring ||
+    repositoryIndex === 0 ||
+    segments
+      .slice(0, repositoryIndex)
+      .every((part) => /^mirrors?$/.test(part)) ||
+    segments[repositoryIndex] === 'alpine'
+  );
+}
+
+export function mirrorWriteCommand(
+  file: string,
+  content: string,
+  prefix: string,
+  update: string,
+): string {
+  return `${prefix}mkdir -p ${shellQuote(
+    file.slice(0, file.lastIndexOf('/')),
+  )} && printf '%s' ${shellQuote(content)} | ${prefix}tee ${shellQuote(
+    file,
+  )} >/dev/null && ${update}`;
+}
@@ -1,26 +0,0 @@
-import { QueryTypes, Sequelize } from 'sequelize';
-export async function migrateUserSchema(database: Sequelize): Promise<void> {
-  const columns = [
-    { table: 'Users', column: 'sessions', type: "JSON NOT NULL DEFAULT '[]'" },
-    ...['Envs', 'Crontabs', 'Subscriptions', 'Dependences'].map((table) => ({
-      table,
-      column: 'userId',
-      type: 'INTEGER',
-    })),
-  ];
-  await database.transaction(async (transaction) => {
-    for (const { table, column, type } of columns) {
-      const fields = await database.query<{ name: string }>(
-        `PRAGMA table_info("${table}")`,
-        { type: QueryTypes.SELECT, transaction },
-      );
-      if (!fields.length)
-        throw new Error(`User migration table is missing: ${table}`);
-      if (!fields.some((field) => field.name === column))
-        await database.query(
-          `ALTER TABLE "${table}" ADD COLUMN "${column}" ${type}`,
-          { transaction },
-        );
-    }
-  });
-}
@@ -6,11 +6,6 @@ declare global {
  namespace Express {
    interface Request {
      platform: 'desktop' | 'mobile';
-      user?: {
-        userId?: number;
-        role?: number;
-      };
-      auth?: any;
    }
  }
 } 
@@ -12,39 +12,6 @@ export interface OpenOperation {
  anonymous?: boolean;
 }
 export const openOperations: readonly OpenOperation[] = [
-  { name: 'account list', method: 'GET', path: 'user-management' },
-  {
-    name: 'account get',
-    method: 'GET',
-    path: 'user-management/:id',
-    params: ['id'],
-  },
-  {
-    name: 'account create',
-    method: 'POST',
-    path: 'user-management',
-    body: 'json',
-  },
-  {
-    name: 'account update',
-    method: 'PUT',
-    path: 'user-management',
-    body: 'json',
-  },
-  {
-    name: 'account delete',
-    method: 'DELETE',
-    path: 'user-management',
-    body: 'ids',
-  },
-  {
-    name: 'account assign',
-    method: 'PUT',
-    path: 'user-management/:id/resources',
-    params: ['id'],
-    body: 'json',
-  },
-
  { name: 'task view-list', method: 'GET', path: 'crons/views' },
  {
    name: 'task view-create',
@@ -511,12 +478,7 @@ export const openOperations: readonly OpenOperation[] = [
    path: 'system/config/dependence-clean',
    body: 'json',
  },
-  {
-    name: 'dashboard record',
-    method: 'POST',
-    path: 'dashboard/record',
-    body: 'json',
-  },
+  { name: 'dashboard record', method: 'POST', path: 'dashboard/record', body: 'json' },
  { name: 'dashboard overview', method: 'GET', path: 'dashboard/overview' },
  { name: 'dashboard trend', method: 'GET', path: 'dashboard/trend' },
  { name: 'dashboard top-time', method: 'GET', path: 'dashboard/top-time' },
@@ -409,7 +409,7 @@ test('cron metadata precedence agrees with unchanged legacy add_cron', (t) => {
        '--noprofile',
        '--norc',
        '-c',
-        `${definition}\nt() { :; }\nnotify_api() { :; }\nadd_cron_api() { printf '%s' "$1"; }\nadd_cron "$dir_scripts/list" repo`,
+        `${definition}\nt() { :; }\nnotify_api() { :; }\nadd_cron_api() { printf '%s:%s:%s:%s' "$1" "$2" "$3" "$4"; }\nadd_cron "$dir_scripts/list" repo`,
      ],
      {
        encoding: 'utf8',
@@ -1,13 +0,0 @@
-# 多用户权限范围
-
-系统原有管理员仍使用现有初始化、密码迁移、双重验证与会话校验。新增账号使用 scrypt 密码哈希；用户接口不返回密码哈希和会话记录。密码、角色、状态或用户名修改会撤销该账号的已有会话；退出、禁用和删除账号也会使令牌失效。仅签名有效而未登记的 JWT 不能作为用户会话。
-
-普通用户只读自己名下的环境变量、任务元数据和订阅元数据，可查看自己的账号信息并退出。无归属的历史数据属于管理员，普通用户不能访问。共享脚本、配置、日志、依赖安装、任务执行、终端命令、系统设置及账号管理均需管理员权限。前端显示只读提示，并仅显示任务、环境变量和订阅菜单。
-
-管理员可在系统设置中创建、修改、禁用、删除账号。新增管理员角色属于完全可信的系统管理员，具有全局操作权限。原有管理员账号保留在原有认证配置中，不复制到新用户表。
-
-管理员可通过 `PUT /api/user-management/:id/resources` 分配资源，请求体例如 `{"resource":"envs","ids":[1,2]}`。`resource` 支持 `envs`、`crons`、`subscriptions`；用户 ID 和资源 ID 必须为正整数。分配接口不会移动文件或执行任务。
-
-脚本目录、环境变量导出文件和系统执行身份仍为实例共用。当前草稿不向普通用户开放执行；若要向不可信用户开放执行，必须增加独立执行环境、独立凭据和工作目录，以及相应的越权测试。
-
-旧草稿曾使用 bcrypt 的账号需要由管理员重置密码后登录；bcrypt 哈希不会按明文密码比较。正式合并前应在 Linux 容器中验收账号管理与资源分配界面。
@@ -0,0 +1,7 @@
+# Python 依赖来源
+
+依赖管理中可手动添加 Python 包名、`git+https://` 等 pip 支持的源 URL，或脚本/订阅仓库目录内的 requirements 文件、pyproject.toml 路径。文件路径支持目录空格，必须位于持久化 scripts 或 repo 根目录内；越界与指向根目录外的符号链接会被拒绝。
+
+requirements 使用 `pip install -r`，pyproject 使用完整项目目录安装，保留相对依赖文件和项目源码。拉取订阅不会自动安装仓库声明的依赖。
+
+删除 requirements 条目会调用 `pip uninstall -r`。源 URL 或 pyproject 条目无法可靠逆向推断其安装的所有分发包，因此删除该条目只移除面板记录；需另外按包名卸载已安装的包，日志会明确提示。
@@ -1,331 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Multi-User Data Migration Script
- *
- * This script migrates existing data (Cron, Env, Subscription, Dependence)
- * to be associated with specific users.
- *
- * Usage:
- *   node migrate-to-multiuser.js --userId=1
- *   node migrate-to-multiuser.js --username=admin
- *   node migrate-to-multiuser.js --list-users
- *
- * Options:
- *   --userId=<id>        Assign all legacy data to user with this ID
- *   --username=<name>    Assign all legacy data to user with this username
- *   --list-users         List all users in the system
- *   --dry-run            Show what would be changed without making changes
- *   --help               Show this help message
- */
-
-const path = require('path');
-const fs = require('fs');
-const Sequelize = require('sequelize');
-
-// Load environment variables
-require('dotenv').config();
-
-// Configuration
-const config = {
-  dbPath: path.join(
-    process.env.QL_DATA_DIR ||
-      path.join(process.env.QL_DIR || __dirname, 'data'),
-    'db',
-  ),
-  rootPath: __dirname,
-};
-
-if (!fs.existsSync(path.join(config.dbPath, 'database.sqlite'))) {
-  throw new Error(
-    'Existing database not found; start the panel and verify QL_DATA_DIR before migration.',
-  );
-}
-
-// Initialize Sequelize
-const sequelize = new Sequelize({
-  dialect: 'sqlite',
-  storage: path.join(config.dbPath, 'database.sqlite'),
-  logging: false,
-});
-
-// Define models
-const UserModel = sequelize.define('User', {
-  username: Sequelize.STRING,
-  password: Sequelize.STRING,
-  role: Sequelize.INTEGER,
-  status: Sequelize.INTEGER,
-});
-
-const CrontabModel = sequelize.define('Crontab', {
-  name: Sequelize.STRING,
-  command: Sequelize.STRING,
-  schedule: Sequelize.STRING,
-  userId: Sequelize.INTEGER,
-});
-
-const EnvModel = sequelize.define('Env', {
-  name: Sequelize.STRING,
-  value: Sequelize.STRING,
-  userId: Sequelize.INTEGER,
-});
-
-const SubscriptionModel = sequelize.define('Subscription', {
-  name: Sequelize.STRING,
-  url: Sequelize.STRING,
-  userId: Sequelize.INTEGER,
-});
-
-const DependenceModel = sequelize.define('Dependence', {
-  name: Sequelize.STRING,
-  type: Sequelize.INTEGER,
-  userId: Sequelize.INTEGER,
-});
-
-// Parse command line arguments
-function parseArgs() {
-  const args = {
-    userId: null,
-    username: null,
-    listUsers: false,
-    dryRun: false,
-    help: false,
-  };
-
-  process.argv.slice(2).forEach((arg) => {
-    if (arg.startsWith('--userId=')) {
-      args.userId = parseInt(arg.split('=')[1]);
-    } else if (arg.startsWith('--username=')) {
-      args.username = arg.split('=')[1];
-    } else if (arg === '--list-users') {
-      args.listUsers = true;
-    } else if (arg === '--dry-run') {
-      args.dryRun = true;
-    } else if (arg === '--help' || arg === '-h') {
-      args.help = true;
-    }
-  });
-
-  return args;
-}
-
-// Show help
-function showHelp() {
-  console.log(`
-Multi-User Data Migration Script
-
-This script migrates existing data (Cron, Env, Subscription, Dependence) 
-to be associated with specific users.
-
-Usage:
-  node migrate-to-multiuser.js --userId=1
-  node migrate-to-multiuser.js --username=admin
-  node migrate-to-multiuser.js --list-users
-
-Options:
-  --userId=<id>        Assign all legacy data to user with this ID
-  --username=<name>    Assign all legacy data to user with this username
-  --list-users         List all users in the system
-  --dry-run            Show what would be changed without making changes
-  --help               Show this help message
-
-Examples:
-  # List all users
-  node migrate-to-multiuser.js --list-users
-
-  # Migrate all data to user ID 1 (dry run)
-  node migrate-to-multiuser.js --userId=1 --dry-run
-
-  # Migrate all data to user 'admin'
-  node migrate-to-multiuser.js --username=admin
-
-Note: This script will only migrate data where userId is NULL or undefined.
-Data already assigned to users will not be changed.
-  `);
-}
-
-// List all users
-async function listUsers() {
-  const users = await UserModel.findAll();
-
-  if (users.length === 0) {
-    console.log('\nNo users found in the database.');
-    console.log(
-      'Please create users first using the User Management interface.',
-    );
-    return;
-  }
-
-  console.log('\nUsers in the system:');
-  console.log('ID\tUsername\tRole\t\tStatus');
-  console.log('--\t--------\t----\t\t------');
-
-  users.forEach((user) => {
-    const role = user.role === 0 ? 'Admin' : 'User';
-    const status = user.status === 0 ? 'Enabled' : 'Disabled';
-    console.log(`${user.id}\t${user.username}\t\t${role}\t\t${status}`);
-  });
-  console.log('');
-}
-
-// Get statistics of legacy data
-async function getStatistics() {
-  const stats = {
-    crons: await CrontabModel.count({ where: { userId: null } }),
-    envs: await EnvModel.count({ where: { userId: null } }),
-    subscriptions: await SubscriptionModel.count({ where: { userId: null } }),
-    dependences: await DependenceModel.count({ where: { userId: null } }),
-  };
-
-  return stats;
-}
-
-// Migrate data to a specific user
-async function migrateData(userId, dryRun = false) {
-  const stats = await getStatistics();
-
-  console.log('\nLegacy Data Statistics:');
-  console.log(`  Cron tasks: ${stats.crons}`);
-  console.log(`  Environment variables: ${stats.envs}`);
-  console.log(`  Subscriptions: ${stats.subscriptions}`);
-  console.log(`  Dependencies: ${stats.dependences}`);
-  console.log('');
-
-  if (
-    stats.crons + stats.envs + stats.subscriptions + stats.dependences ===
-    0
-  ) {
-    console.log('No legacy data found. All data is already assigned to users.');
-    return;
-  }
-
-  if (dryRun) {
-    console.log('DRY RUN: No changes will be made.\n');
-    console.log(`Would assign all legacy data to user ID ${userId}`);
-    return;
-  }
-
-  console.log(`Migrating data to user ID ${userId}...`);
-
-  const transaction = await sequelize.transaction();
-
-  try {
-    // Migrate crons
-    if (stats.crons > 0) {
-      await CrontabModel.update(
-        { userId },
-        { where: { userId: null }, transaction },
-      );
-      console.log(`✓ Migrated ${stats.crons} cron tasks`);
-    }
-
-    // Migrate envs
-    if (stats.envs > 0) {
-      await EnvModel.update(
-        { userId },
-        { where: { userId: null }, transaction },
-      );
-      console.log(`✓ Migrated ${stats.envs} environment variables`);
-    }
-
-    // Migrate subscriptions
-    if (stats.subscriptions > 0) {
-      await SubscriptionModel.update(
-        { userId },
-        { where: { userId: null }, transaction },
-      );
-      console.log(`✓ Migrated ${stats.subscriptions} subscriptions`);
-    }
-
-    // Migrate dependences
-    if (stats.dependences > 0) {
-      await DependenceModel.update(
-        { userId },
-        { where: { userId: null }, transaction },
-      );
-      console.log(`✓ Migrated ${stats.dependences} dependencies`);
-    }
-
-    await transaction.commit();
-    console.log('\n✓ Migration completed successfully!');
-  } catch (error) {
-    await transaction.rollback();
-    console.error('\n✗ Migration failed:', error.message);
-    throw error;
-  }
-}
-
-// Main function
-async function main() {
-  const args = parseArgs();
-
-  if (args.help) {
-    showHelp();
-    return;
-  }
-
-  try {
-    // Test database connection
-    await sequelize.authenticate();
-    console.log('Database connection established.');
-
-    if (args.listUsers) {
-      await listUsers();
-      return;
-    }
-
-    // Validate arguments
-    if (!args.userId && !args.username) {
-      console.error('\nError: You must specify either --userId or --username');
-      console.log('Use --help for usage information.');
-      process.exit(1);
-    }
-
-    // Get user ID
-    let userId = args.userId;
-
-    if (args.username) {
-      const user = await UserModel.findOne({
-        where: { username: args.username },
-      });
-
-      if (!user) {
-        console.error(`\nError: User '${args.username}' not found.`);
-        console.log('Use --list-users to see available users.');
-        process.exit(1);
-      }
-
-      userId = user.id;
-      console.log(`Found user '${args.username}' with ID ${userId}`);
-    } else {
-      // Verify user exists
-      const user = await UserModel.findByPk(userId);
-
-      if (!user) {
-        console.error(`\nError: User with ID ${userId} not found.`);
-        console.log('Use --list-users to see available users.');
-        process.exit(1);
-      }
-
-      console.log(`Found user '${user.username}' with ID ${userId}`);
-    }
-
-    // Perform migration
-    await migrateData(userId, args.dryRun);
-  } catch (error) {
-    console.error('\nError:', error.message);
-    process.exit(1);
-  } finally {
-    await sequelize.close();
-  }
-}
-
-// Run the script
-if (require.main === module) {
-  main().catch((error) => {
-    console.error('Fatal error:', error);
-    process.exit(1);
-  });
-}
-
-module.exports = { main, listUsers, migrateData, getStatistics };
@@ -28,7 +28,8 @@
    "panel": "npm run build:back && node static/build/app.js",
    "gen:proto": "protoc --experimental_allow_proto3_optional --plugin=./node_modules/.bin/protoc-gen-ts_proto ./back/protos/*.proto --ts_proto_out=./ --ts_proto_opt=outputServices=grpc-js,env=node,esModuleInterop=true,snakeToCamel=false",
    "prettier": "prettier --write '**/*.{js,jsx,tsx,ts,less,md,json}'",
-    "postinstall": "max setup 2>/dev/null || true"
+    "postinstall": "max setup 2>/dev/null || true",
+    "start:simple": "bash shell/start-simplify.sh"
  },
  "gitHooks": {
    "pre-commit": "lint-staged"
@@ -108,9 +109,9 @@
    "jsonwebtoken": "^9.0.2",
    "keyv": "^5.2.3",
    "lodash": "^4.17.21",
-    "multer": "2.3.0",
+    "multer": "2.4.0",
    "node-cron": "4.6.0",
-    "nodemailer": "^8.0.1",
+    "nodemailer": "^10.0.9",
    "p-queue-cjs": "7.3.4",
    "proper-lockfile": "^4.1.2",
    "ps-tree": "^1.2.0",
@@ -28,7 +28,7 @@ dependencies:
    version: 12.0.1
  body-parser:
    specifier: ^1.20.3
-    version: 1.20.3
+    version: 1.20.6
  celebrate:
    specifier: ^15.0.3
    version: 15.0.3
@@ -73,7 +73,7 @@ dependencies:
    version: 1.2.0
  http-proxy-middleware:
    specifier: ^3.0.3
-    version: 3.0.3
+    version: 3.0.7
  iconv-lite:
    specifier: ^0.6.3
    version: 0.6.3
@@ -82,7 +82,7 @@ dependencies:
    version: 2.3.0(@types/node@17.0.45)
  js-yaml:
    specifier: ^4.1.0
-    version: 4.1.0
+    version: 4.3.2
  jsonwebtoken:
    specifier: ^9.0.2
    version: 9.0.2
@@ -93,14 +93,14 @@ dependencies:
    specifier: ^4.17.21
    version: 4.17.21
  multer:
-    specifier: 2.3.0
-    version: 2.3.0
+    specifier: 2.4.0
+    version: 2.4.0
  node-cron:
    specifier: 4.6.0
    version: 4.6.0
  nodemailer:
-    specifier: ^8.0.1
-    version: 8.0.1
+    specifier: ^10.0.9
+    version: 10.0.9
  p-queue-cjs:
    specifier: 7.3.4
    version: 7.3.4
@@ -133,7 +133,7 @@ dependencies:
    version: 0.10.0
  undici:
    specifier: ^7.9.0
-    version: 7.9.0
+    version: 7.29.1
  uuid:
    specifier: ^11.0.3
    version: 11.0.3
@@ -264,7 +264,7 @@ devDependencies:
    version: 4.23.0(antd@4.24.16)(react-dom@18.3.1)(react@18.3.1)
  axios:
    specifier: ^1.4.0
-    version: 1.7.8
+    version: 1.20.0
  compression-webpack-plugin:
    specifier: 9.2.0
    version: 9.2.0
@@ -2879,7 +2879,7 @@ packages:
      globals: 13.24.0
      ignore: 5.3.2
      import-fresh: 3.3.0
-      js-yaml: 4.1.0
+      js-yaml: 4.3.2
      minimatch: 3.1.5
      strip-json-comments: 3.1.1
    transitivePeerDependencies:
@@ -3060,7 +3060,7 @@ packages:
      camelcase: 5.3.1
      find-up: 4.1.0
      get-package-type: 0.1.0
-      js-yaml: 3.14.1
+      js-yaml: 3.15.2
      resolve-from: 5.0.0
    dev: true

@@ -5677,7 +5677,6 @@ packages:
      debug: 4.4.3
    transitivePeerDependencies:
      - supports-color
-    dev: false

  /agentkeepalive@4.5.0:
    resolution: {integrity: sha512-5GG/5IbQQpC9FpkRGsSvZI5QYeSCzlJHdpBQntCsuTOxhKD8lqKhrleg2Yi7yvMIf82Ycmmqln9U8V9qwEiJew==}
@@ -8302,7 +8301,7 @@ packages:
      is-glob: 4.0.3
      is-path-inside: 3.0.3
      js-sdsl: 4.4.2
-      js-yaml: 4.1.0
+      js-yaml: 4.3.2
      json-stable-stringify-without-jsonify: 1.0.1
      levn: 0.4.1
      lodash.merge: 4.6.2
@@ -8513,7 +8512,7 @@ packages:
    dependencies:
      accepts: 1.3.8
      array-flatten: 1.1.1
-      body-parser: 1.20.3
+      body-parser: 1.20.6
      content-disposition: 0.5.4
      content-type: 1.0.5
      cookie: 0.7.1
@@ -9334,7 +9333,6 @@ packages:
      debug: 4.4.3
    transitivePeerDependencies:
      - supports-color
-    dev: false

  /human-signals@2.1.0:
    resolution: {integrity: sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==}
@@ -10587,7 +10585,7 @@ packages:
    engines: {node: '>=8.6'}
    dependencies:
      braces: 3.0.3
-      picomatch: 2.3.1
+      picomatch: 2.3.2

  /miller-rabin@4.0.1:
    resolution: {integrity: sha512-115fLhvZVqWwHPbClyntxEVfVDfl9DLLTuJvq3g2O/Oxi8AiNouAHvDSzHS0viUJc+V5vm3eq91Xwqn9dp4jRA==}
@@ -10654,19 +10652,19 @@ packages:
  /minimatch@3.1.2:
    resolution: {integrity: sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==}
    dependencies:
-      brace-expansion: 1.1.12
+      brace-expansion: 1.1.21
    dev: true

  /minimatch@3.1.5:
    resolution: {integrity: sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==}
    dependencies:
-      brace-expansion: 1.1.12
+      brace-expansion: 1.1.21

  /minimatch@9.0.9:
    resolution: {integrity: sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==}
    engines: {node: '>=16 || 14 >=14.17'}
    dependencies:
-      brace-expansion: 2.0.2
+      brace-expansion: 2.1.7
    dev: true

  /minimist-options@4.1.0:
@@ -10870,7 +10868,7 @@ packages:
      semver: 7.7.4
      tar: 7.5.20
      tinyglobby: 0.2.17
-      undici: 6.27.0
+      undici: 6.29.0
      which: 6.0.1
    dev: false
    optional: true
@@ -15794,6 +15792,342 @@ packages:
    resolution: {integrity: sha512-XBx9AXhXktjUqnepgTiE5flcKIYWi/rme0Eaj+5Y0lftuGBq+jyRu/md4WnuxqgP1ubdpNCsYEYPxrzVHD8d6g==}
    dev: true

+  /brace-expansion@2.1.7:
+    resolution: {integrity: sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==}
+    dependencies:
+      balanced-match: 1.0.2
+    dev: true
+
+
+  /brace-expansion@1.1.21:
+    resolution: {integrity: sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==}
+    dependencies:
+      balanced-match: 1.0.2
+      concat-map: 0.0.1
+
+
+  /axios@1.20.0:
+    resolution: {integrity: sha512-r8aOh8j9cGKpgQAqpzrUHnSIc6a59Y3Xf/cv8sy1DrHCkZHzQGEuoq1tARk6qSyDdtQGSDgpb9kFlruzPvrgwg==}
+    dependencies:
+      follow-redirects: 1.16.1(debug@4.4.3)
+      form-data: 4.0.6
+      https-proxy-agent: 5.0.1
+      proxy-from-env: 2.1.0
+    transitivePeerDependencies:
+      - debug
+      - supports-color
+    dev: true
+
+
+  /proxy-from-env@2.1.0:
+    resolution: {integrity: sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==}
+    engines: {node: '>=10'}
+    dev: true
+
+
+  /form-data@4.0.6:
+    resolution: {integrity: sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==}
+    engines: {node: '>= 6'}
+    dependencies:
+      asynckit: 0.4.0
+      combined-stream: 1.0.8
+      es-set-tostringtag: 2.1.0
+      hasown: 2.0.4
+      mime-types: 2.1.35
+    dev: true
+
+
+  /hasown@2.0.4:
+    resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
+    engines: {node: '>= 0.4'}
+    dependencies:
+      function-bind: 1.1.2
+
+
+  /es-set-tostringtag@2.1.0:
+    resolution: {integrity: sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==}
+    engines: {node: '>= 0.4'}
+    dependencies:
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      has-tostringtag: 1.0.2
+      hasown: 2.0.4
+    dev: true
+
+
+  /get-intrinsic@1.3.0:
+    resolution: {integrity: sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==}
+    engines: {node: '>= 0.4'}
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      es-define-property: 1.0.1
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
+      function-bind: 1.1.2
+      get-proto: 1.0.1
+      gopd: 1.2.0
+      has-symbols: 1.1.0
+      hasown: 2.0.4
+      math-intrinsics: 1.1.0
+
+
+  /math-intrinsics@1.1.0:
+    resolution: {integrity: sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==}
+    engines: {node: '>= 0.4'}
+
+
+  /gopd@1.2.0:
+    resolution: {integrity: sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==}
+    engines: {node: '>= 0.4'}
+
+
+  /get-proto@1.0.1:
+    resolution: {integrity: sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==}
+    engines: {node: '>= 0.4'}
+    dependencies:
+      dunder-proto: 1.0.1
+      es-object-atoms: 1.1.2
+
+
+  /es-object-atoms@1.1.2:
+    resolution: {integrity: sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==}
+    engines: {node: '>= 0.4'}
+    dependencies:
+      es-errors: 1.3.0
+
+
+  /dunder-proto@1.0.1:
+    resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==}
+    engines: {node: '>= 0.4'}
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      es-errors: 1.3.0
+      gopd: 1.2.0
+
+
+  /call-bind-apply-helpers@1.0.2:
+    resolution: {integrity: sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==}
+    engines: {node: '>= 0.4'}
+    dependencies:
+      es-errors: 1.3.0
+      function-bind: 1.1.2
+
+
+  /es-define-property@1.0.1:
+    resolution: {integrity: sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==}
+    engines: {node: '>= 0.4'}
+
+
+  /follow-redirects@1.16.1(debug@4.4.3):
+    resolution: {integrity: sha512-FNvFGzoMLWmE6Yj9spb/zjd7yiNCHiAW9/Tg9CXrQ8wuu32HtlJOwWO11OJafl5FfY3DxTdQ0vj42zU1kvv5jg==}
+    engines: {node: '>=4.0'}
+    peerDependencies:
+      debug: '*'
+    peerDependenciesMeta:
+      debug:
+        optional: true
+    dependencies:
+      debug: 4.4.3
+
+
+  /undici@7.29.1:
+    resolution: {integrity: sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==}
+    engines: {node: '>=20.18.1'}
+    dev: false
+
+
+  /undici@6.29.0:
+    resolution: {integrity: sha512-R+RODBqp6i2pPflGdq+xIOUkl+RNfGgHwoinecKu/JCuf2uO06cOKoDbI2P7Dn6KcswdKwrczbU6IYJ6K8X+wg==}
+    engines: {node: '>=18.17'}
+    dev: false
+    optional: true
+
+
+  /nodemailer@10.0.9:
+    resolution: {integrity: sha512-BF0qcyplCwp+jMk6HCjFykBz/YhhZSsxrARhOldLwFWH+8kGjQsd2WIMIZhqEuyXRoGFi0ONbDeWDMDoL8MhLw==}
+    engines: {node: '>=20.0.0'}
+    dev: false
+
+
+  /multer@2.4.0:
+    resolution: {integrity: sha512-7dqa0ZcFfzbefdTuIkzOSMvZWC0J7FLqBOjJUZvDCXShIURWKxAyTT1wHhnE5q19c7jOJf43IYYKjBmZVZmvhg==}
+    engines: {node: '>= 10.16.0'}
+    dependencies:
+      append-field: 1.0.0
+      busboy: 1.6.0
+      type-is: 1.6.18
+    dev: false
+
+
+  /js-yaml@4.3.2:
+    resolution: {integrity: sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==}
+    hasBin: true
+    dependencies:
+      argparse: 2.0.1
+
+
+  /js-yaml@3.15.2:
+    resolution: {integrity: sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==}
+    hasBin: true
+    dependencies:
+      argparse: 1.0.10
+      esprima: 4.0.1
+    dev: true
+
+
+  /http-proxy-middleware@3.0.7:
+    resolution: {integrity: sha512-iwbQltVlx8bCrqePUM8C+hllHvdawVhQJaLrj1X7qllkvFQdXFsr16pW/mo9+JDVjN+QO2XUx9jd8SmoFkE5qw==}
+    engines: {node: ^14.18.0 || ^16.10.0 || >=18.0.0}
+    dependencies:
+      '@types/http-proxy': 1.17.17
+      debug: 4.4.3
+      http-proxy: 1.18.1(debug@4.4.3)
+      is-glob: 4.0.3
+      is-plain-object: 5.1.0
+      micromatch: 4.0.8
+    transitivePeerDependencies:
+      - supports-color
+    dev: false
+
+
+  /picomatch@2.3.2:
+    resolution: {integrity: sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==}
+    engines: {node: '>=8.6'}
+
+
+  /is-plain-object@5.1.0:
+    resolution: {integrity: sha512-bUi/yjmtKYcRVUtWRGr0UA6xEFh2I6zWUwMrUXB3s7bmYCaZ8a+0ZsTRkrawh/mzlSD1Y0Ph8bp/U+TvBpWDNw==}
+    engines: {node: '>=0.10.0'}
+
+
+  /http-proxy@1.18.1(debug@4.4.3):
+    resolution: {integrity: sha512-7mz/721AbnJwIVbnaSv1Cz3Am0ZLT/UBwkC92VlxhXv/k/BBQfM2fXElQNC27BVGr0uwUpplYPQM9LnaBMR5NQ==}
+    engines: {node: '>=8.0.0'}
+    dependencies:
+      eventemitter3: 4.0.7
+      follow-redirects: 1.16.1(debug@4.4.3)
+      requires-port: 1.0.0
+    transitivePeerDependencies:
+      - debug
+    dev: false
+
+
+  /@types/http-proxy@1.17.17:
+    resolution: {integrity: sha512-ED6LB+Z1AVylNTu7hdzuBqOgMnvG/ld6wGCG8wFnAzKX5uyW2K3WD52v0gnLCTK/VLpXtKckgWuyScYK6cSPaw==}
+    dependencies:
+      '@types/node': 17.0.45
+    dev: false
+
+
+  /body-parser@1.20.6:
+    resolution: {integrity: sha512-p5tAzS57i5MV9fZFDj9LeIiTZEufbSe2eDozP+ElheSUq1m74CRq1jI4mYNDdVs9vQztXFLuk/Gd6BWTdwRJ5g==}
+    engines: {node: '>= 0.8', npm: 1.2.8000 || >= 1.4.16}
+    dependencies:
+      bytes: 3.1.2
+      content-type: 1.0.5
+      debug: 2.6.9
+      depd: 2.0.0
+      destroy: 1.2.0
+      http-errors: 2.0.1
+      iconv-lite: 0.4.24
+      on-finished: 2.4.1
+      qs: 6.15.3
+      raw-body: 2.5.3
+      type-is: 1.6.18
+      unpipe: 1.0.0
+    transitivePeerDependencies:
+      - supports-color
+    dev: false
+
+
+  /raw-body@2.5.3:
+    resolution: {integrity: sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA==}
+    engines: {node: '>= 0.8'}
+    dependencies:
+      bytes: 3.1.2
+      http-errors: 2.0.1
+      iconv-lite: 0.4.24
+      unpipe: 1.0.0
+
+
+  /http-errors@2.0.1:
+    resolution: {integrity: sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==}
+    engines: {node: '>= 0.8'}
+    dependencies:
+      depd: 2.0.0
+      inherits: 2.0.4
+      setprototypeof: 1.2.0
+      statuses: 2.0.2
+      toidentifier: 1.0.1
+
+
+  /statuses@2.0.2:
+    resolution: {integrity: sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==}
+    engines: {node: '>= 0.8'}
+
+
+  /qs@6.15.3:
+    resolution: {integrity: sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==}
+    engines: {node: '>=0.6'}
+    dependencies:
+      es-define-property: 1.0.1
+      side-channel: 1.1.1
+    dev: false
+
+
+  /side-channel@1.1.1:
+    resolution: {integrity: sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==}
+    engines: {node: '>= 0.4'}
+    dependencies:
+      es-errors: 1.3.0
+      object-inspect: 1.13.4
+      side-channel-list: 1.0.1
+      side-channel-map: 1.0.1
+      side-channel-weakmap: 1.0.2
+
+
+  /side-channel-weakmap@1.0.2:
+    resolution: {integrity: sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==}
+    engines: {node: '>= 0.4'}
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      object-inspect: 1.13.4
+      side-channel-map: 1.0.1
+
+
+  /side-channel-map@1.0.1:
+    resolution: {integrity: sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==}
+    engines: {node: '>= 0.4'}
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      object-inspect: 1.13.4
+
+
+  /object-inspect@1.13.4:
+    resolution: {integrity: sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==}
+    engines: {node: '>= 0.4'}
+
+
+  /call-bound@1.0.4:
+    resolution: {integrity: sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==}
+    engines: {node: '>= 0.4'}
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      get-intrinsic: 1.3.0
+
+
+  /side-channel-list@1.0.1:
+    resolution: {integrity: sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==}
+    engines: {node: '>= 0.4'}
+    dependencies:
+      es-errors: 1.3.0
+      object-inspect: 1.13.4
+
+
 settings:
  autoInstallPeers: true
  excludeLinksFromLockfile: false
@@ -85,9 +85,13 @@ add_cron_api() {
    sub_id="null"
  fi

+  local payload
+  payload=$(jq -cn --arg name "$name" --arg command "$command" \
+    --arg schedule "$schedule" --argjson sub_id "$sub_id" \
+    '{name: $name, command: $command, schedule: $schedule, sub_id: $sub_id}') || return $?
  local api=$(ql_api_request \
    "http://localhost:${ql_port}/open/crons?t=$currentTimeStamp" \
-    --data-raw "{\"name\":\"${name//\"/\\\"}\",\"command\":\"${command//\"/\\\"}\",\"schedule\":\"$schedule\",\"sub_id\":$sub_id}" \
+    --data-raw "$payload" \
    -X POST)
  code=$(echo "$api" | jq -r .code)
  message=$(echo "$api" | jq -r .message)
@@ -112,10 +116,14 @@ update_cron_api() {
    local id="$4"
  fi

+  local payload
+  payload=$(jq -cn --arg name "$name" --arg command "$command" \
+    --arg schedule "$schedule" --arg id "$id" \
+    '{name: $name, command: $command, schedule: $schedule, id: $id}') || return $?
  local api=$(ql_api_request \
    "http://localhost:${ql_port}/open/crons?t=$currentTimeStamp" \
    -X PUT \
-    --data-raw "{\"name\":\"${name//\"/\\\"}\",\"command\":\"${command//\"/\\\"}\",\"schedule\":\"$schedule\",\"id\":\"$id\"}")
+    --data-raw "$payload")
  code=$(echo "$api" | jq -r .code)
  message=$(echo "$api" | jq -r .message)
  if [[ $code == 200 ]]; then
@@ -135,10 +143,13 @@ update_cron_command_api() {
    local id="$2"
  fi

+  local payload
+  payload=$(jq -cn --arg command "$command" --arg id "$id" \
+    '{command: $command, id: $id}') || return $?
  local api=$(ql_api_request \
    "http://localhost:${ql_port}/open/crons?t=$currentTimeStamp" \
    -X PUT \
-    --data-raw "{\"command\":\"${command//\"/\\\"}\",\"id\":\"$id\"}")
+    --data-raw "$payload")
  code=$(echo "$api" | jq -r .code)
  message=$(echo "$api" | jq -r .message)
  if [[ $code == 200 ]]; then
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+set -e
+
+: "${QL_DIR:?Please set QL_DIR}"
+: "${QL_DATA_DIR:?Please set QL_DATA_DIR}"
+[[ "$QL_DIR" = /* && "$QL_DATA_DIR" = /*/data ]] || { echo "QL_DIR and QL_DATA_DIR must be absolute paths (data directory ends in /data)" >&2; exit 1; }
+command="$1"
+
+export PNPM_HOME="${PNPM_HOME:-${QL_DATA_DIR}/dep_cache/node}"
+if [[ -n "${PYTHON_VENV_DIR:-}" ]]; then
+  [[ "$PYTHON_VENV_DIR" = /* ]] || PYTHON_VENV_DIR="${QL_DIR}/${PYTHON_VENV_DIR}"
+  export PYTHON_VENV_DIR
+  if [[ ! -x "$PYTHON_VENV_DIR/bin/python3" ]]; then
+    python3 -m venv "$PYTHON_VENV_DIR"
+  fi
+  [[ -x "$PYTHON_VENV_DIR/bin/python3" ]] || { echo "Invalid Python venv" >&2; exit 1; }
+  unset PYTHON_HOME PYTHONUSERBASE PYTHONPATH
+  export PATH="${PYTHON_VENV_DIR}/bin:${PATH}:${PNPM_HOME}"
+  export PIP_CACHE_DIR="${PYTHON_VENV_DIR}/pip"
+else
+  export PYTHON_SHORT_VERSION=$(python3 -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")')
+  export PYTHON_HOME="${PYTHON_HOME:-${QL_DATA_DIR}/dep_cache/python3}"
+  export PYTHONUSERBASE="$PYTHON_HOME"
+  export PATH="${PATH}:${PNPM_HOME}:${PYTHON_HOME}/bin"
+  export PIP_CACHE_DIR="${PYTHON_HOME}/pip"
+  export PYTHONPATH="${PYTHON_HOME}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}/site-packages"
+fi
+export NODE_PATH="${NODE_PATH:-/usr/local/bin:/usr/local/lib/node_modules:${PNPM_HOME}/global/5/node_modules}"
+mkdir -p "$PIP_CACHE_DIR"
+
+cd "${QL_DIR}"
+if [[ ! -e .env ]]; then
+  # Preserve user configuration, including a file created concurrently.
+  (umask 077; set -C; cat .env.example > .env)
+fi
+chmod u+x "${QL_DIR}"/shell/*.sh
+
+. "${QL_DIR}/shell/share.sh"
+. "${QL_DIR}/shell/env.sh"
+
+log_with_style() {
+  local level="$1"
+  local message="$2"
+  local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
+
+  printf "\n[%s] [%7s]  %s\n" "${timestamp}" "${level}" "${message}"
+}
+
+log_with_style "INFO" "🚀  1. 检测配置文件..."
+import_config "$@"
+make_dir /etc/nginx/conf.d
+make_dir /run/nginx
+fix_config
+
+pm2 l &>/dev/null
+
+log_with_style "INFO" "🔄  2. 启动 nginx..."
+nginx -s reload 2>/dev/null || nginx -c /etc/nginx/nginx.conf
+
+log_with_style "INFO" "⚙️  3. 启动 pm2 服务..."
+reload_pm2
+
+if [[ $command != "reload" ]]; then
+  if [[ $AutoStartBot == true ]]; then
+    log_with_style "INFO" "🤖 4. 启动 bot..."
+    nohup ql bot >$dir_log/bot.log 2>&1 &
+  fi
+
+  if [[ $EnableExtraShell == true ]]; then
+    log_with_style "INFO" "🛠️ 5. 执行自定义脚本..."
+    nohup ql extra >$dir_log/extra.log 2>&1 &
+  fi
+
+  pm2 startup
+  pm2 save
+fi
+
+log_with_style "SUCCESS" "🎉 启动成功!"
@@ -77,65 +77,13 @@ if [[ $command != "reload" ]]; then
  npm install -g pnpm@8.3.1 pm2 ts-node typescript@5
 fi

-export PYTHON_SHORT_VERSION=$(python3 -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")')
-export PNPM_HOME=${QL_DIR}/data/dep_cache/node
-export PYTHON_HOME=${QL_DIR}/data/dep_cache/python3
-export PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3
-
-export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin
-export NODE_PATH=/usr/local/bin:/usr/local/lib/node_modules:${PNPM_HOME}/global/5/node_modules
-export PIP_CACHE_DIR=${PYTHON_HOME}/pip
-export PYTHONPATH=${PYTHON_HOME}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}/site-packages
-
-if [[ $command != "reload" ]]; then
-  pip3 install --prefix ${PYTHON_HOME} requests
-fi
-
-cd "${QL_DIR}"
-if [[ ! -e .env ]]; then
-  # Preserve user configuration, including a file created concurrently.
-  (umask 077; set -C; cat .env.example > .env)
-fi
-chmod 777 ${QL_DIR}/shell/*.sh
-
-. ${QL_DIR}/shell/share.sh
-. ${QL_DIR}/shell/env.sh
-
-log_with_style() {
-  local level="$1"
-  local message="$2"
-  local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
-
-  printf "\n[%s] [%7s]  %s\n" "${timestamp}" "${level}" "${message}"
-}
-
-log_with_style "INFO" "🚀  1. 检测配置文件..."
-import_config "$@"
-make_dir /etc/nginx/conf.d
-make_dir /run/nginx
-fix_config
-
-pm2 l &>/dev/null
-
-log_with_style "INFO" "🔄  2. 启动 nginx..."
-nginx -s reload 2>/dev/null || nginx -c /etc/nginx/nginx.conf
-
-log_with_style "INFO" "⚙️  3. 启动 pm2 服务..."
-reload_pm2
-
-if [[ $command != "reload" ]]; then
-  if [[ $AutoStartBot == true ]]; then
-    log_with_style "INFO" "🤖 4. 启动 bot..."
-    nohup ql bot >$dir_log/bot.log 2>&1 &
+if [[ "$command" != "reload" ]]; then
+  if [[ -n "${PYTHON_VENV_DIR:-}" ]]; then
+    [[ "$PYTHON_VENV_DIR" = /* ]] || export PYTHON_VENV_DIR="${QL_DIR}/${PYTHON_VENV_DIR}"
+    [[ -x "$PYTHON_VENV_DIR/bin/python3" ]] || python3 -m venv "$PYTHON_VENV_DIR"
+    "$PYTHON_VENV_DIR/bin/python3" -m pip install requests
+  else
+    pip3 install --prefix "${PYTHON_HOME:-${QL_DATA_DIR}/dep_cache/python3}" requests
  fi
-
-  if [[ $EnableExtraShell == true ]]; then
-    log_with_style "INFO" "🛠️ 5. 执行自定义脚本..."
-    nohup ql extra >$dir_log/extra.log 2>&1 &
-  fi
-
-  pm2 startup
-  pm2 save
 fi
-
-log_with_style "SUCCESS" "🎉 启动成功!"
+exec /bin/bash "${QL_DIR}/shell/start-simplify.sh" "$@"
@@ -99,7 +99,9 @@ add_cron() {
      cron_name=$(grep "new Env" $file | awk -F "\(" '{print $2}' | awk -F "\)" '{print $1}' | sed 's:.*\('\''\|"\)\([^"'\'']*\)\('\''\|"\).*:\2:' | sed 's:"::g' | sed "s:'::g" | head -1)
      [[ -z $cron_name ]] && cron_name=$(grep "name:" $file | awk -F ":" '{print $2}' | head -1 | xargs)
      [[ -z $cron_name ]] && cron_name=$(basename "$file_name")
-      result=$(add_cron_api "${cron_line}:${cmd_task} ${file}:${cron_name}:${SUB_ID}")
+      cron_name=${cron_name//$'\r'/}
+      cron_line=${cron_line//$'\r'/}
+      result=$(add_cron_api "$cron_line" "${cmd_task} ${file}" "$cron_name" "$SUB_ID")
      echo -e "$result"
      if [[ $detail ]]; then
        detail="${detail}${result}\n"
@@ -190,7 +192,9 @@ update_raw() {
      [[ -z $cron_line ]] && cron_line=$(grep "cron:" $raw_file_name | awk -F ":" '{print $2}' | head -1 | xargs)
      [[ -z $cron_line ]] && cron_line=$(grep "cron " $raw_file_name | awk -F "cron \"" '{print $2}' | awk -F "\" " '{print $1}' | head -1 | xargs)
      [[ -z $cron_line ]] && cron_line="$default_cron"
-      result=$(add_cron_api "${cron_line}:${cmd_task} ${filename}:${cron_name}:${SUB_ID}")
+      cron_name=${cron_name//$'\r'/}
+      cron_line=${cron_line//$'\r'/}
+      result=$(add_cron_api "$cron_line" "${cmd_task} ${filename}" "$cron_name" "$SUB_ID")
      echo -e "$result\n"
      notify_api "新增任务通知" "\n$result"
      # update_cron_api "$cron_line:$cmd_task $filename:$cron_name:$cron_id"
@@ -10,15 +10,7 @@ import {
 import ProLayout, { PageLoading } from '@ant-design/pro-layout';
 import { history, Link, Outlet, useLocation } from '@umijs/max';
 import * as DarkReader from '@umijs/ssr-darkreader';
-import {
-  Alert,
-  Avatar,
-  Badge,
-  Dropdown,
-  Image,
-  MenuProps,
-  Tooltip,
-} from 'antd';
+import { Avatar, Badge, Dropdown, Image, MenuProps, Tooltip } from 'antd';
 import React, { useEffect, useState } from 'react';
 import intl from 'react-intl-universal';
 import vhCheck from 'vh-check';
@@ -56,8 +48,7 @@ export default function () {
  const [loading, setLoading] = useState<boolean>(true);
  const [systemInfo, setSystemInfo] = useState<TSystemInfo>();
  const [siteTitle, setSiteTitle] = useState(
-    () =>
-      localStorage.getItem('qinglong_panel_title')?.trim() || intl.get('青龙'),
+    () => localStorage.getItem('qinglong_panel_title')?.trim() || intl.get('青龙'),
  );
  const [collapsed, setCollapsed] = useState(false);
  const [initLoading, setInitLoading] = useState<boolean>(true);
@@ -103,7 +94,7 @@ export default function () {
        if (code === 200 && data.username) {
          setUser(data);
          if (location.pathname === '/') {
-            history.push(data.role === 1 ? '/env' : '/dashboard');
+            history.push('/dashboard');
          }
        }
        needLoading && setLoading(false);
@@ -215,7 +206,7 @@ export default function () {
  }, []);

  useEffect(() => {
-    if (!user || !user.username || user.role === 1) return;
+    if (!user || !user.username) return;
    const ws = WebSocketManager.getInstance(
      `${window.location.origin}${
        config.apiPrefix
@@ -399,27 +390,7 @@ export default function () {
        </span>
      )}
      {...defaultProps}
-      {...(user.role === 1
-        ? {
-            route: {
-              routes: defaultProps.route!.routes!.filter((route) =>
-                ['/crontab', '/env', '/subscription'].includes(
-                  route.path || '',
-                ),
-              ),
-            },
-          }
-        : {})}
    >
-      {user.role === 1 && (
-        <Alert
-          type="info"
-          showIcon
-          message={intl.get(
-            '普通用户只读自己的数据，执行和系统修改由管理员负责',
-          )}
-        />
-      )}
      <Outlet
        context={{
          ...ctx,
@@ -699,15 +699,6 @@
  "已保存，本次未记录历史版本": "Saved without a history snapshot",
  "已保存，但旧历史清理失败，请检查存储权限和空间": "Saved, but old history could not be removed. Check storage permissions and free space.",
  "保存失败": "Unable to save",
-  "用户管理": "User Management",
-  "角色": "Role",
-  "管理员": "Admin",
-  "普通用户": "User",
-  "确认删除选中的用户吗": "Are you sure to delete selected users?",
-  "请输入用户名": "Please enter username",
-  "请输入密码": "Please enter password",
-  "密码长度至少为6位": "Password must be at least 6 characters",
-  "新增用户": "Add User",
-  "编辑用户": "Edit User",
-  "普通用户只读自己的数据，执行和系统修改由管理员负责": "You can view your own data. Administrators run tasks and change system settings."
+  "Python支持多种安装方式：\n1. 包名（如：requests）\n2. GitHub链接（如：git+https://github.com/user/repo.git）\n3. requirements文件路径（如：path/to/requirements.txt）\n4. pyproject.toml文件路径": "Python supports package names, Git URLs, and existing requirements.txt or pyproject.toml files under the scripts or repository directory.",
+  "支持包名、GitHub链接、requirements.txt或pyproject.toml路径": "Package name, Git URL, requirements.txt or pyproject.toml path"
 }
@@ -699,15 +699,6 @@
  "已保存，本次未记录历史版本": "已保存，本次未记录历史版本",
  "已保存，但旧历史清理失败，请检查存储权限和空间": "已保存，但旧历史清理失败，请检查存储权限和空间",
  "保存失败": "保存失败",
-  "用户管理": "用户管理",
-  "角色": "角色",
-  "管理员": "管理员",
-  "普通用户": "普通用户",
-  "确认删除选中的用户吗": "确认删除选中的用户吗",
-  "请输入用户名": "请输入用户名",
-  "请输入密码": "请输入密码",
-  "密码长度至少为6位": "密码长度至少为6位",
-  "新增用户": "新增用户",
-  "编辑用户": "编辑用户",
-  "普通用户只读自己的数据，执行和系统修改由管理员负责": "普通用户只读自己的数据，执行和系统修改由管理员负责"
+  "Python支持多种安装方式：\n1. 包名（如：requests）\n2. GitHub链接（如：git+https://github.com/user/repo.git）\n3. requirements文件路径（如：path/to/requirements.txt）\n4. pyproject.toml文件路径": "Python支持多种安装方式：\n1. 包名（如：requests）\n2. GitHub链接（如：git+https://github.com/user/repo.git）\n3. requirements文件路径（如：path/to/requirements.txt）\n4. pyproject.toml文件路径",
+  "支持包名、GitHub链接、requirements.txt或pyproject.toml路径": "支持包名、GitHub链接、requirements.txt或pyproject.toml路径"
 }
@@ -22,6 +22,9 @@ const DependenceModal = ({
 }) => {
  const [form] = Form.useForm();
  const [loading, setLoading] = useState(false);
+  const [selectedType, setSelectedType] = useState(
+    DependenceTypes[defaultType as any],
+  );

  const handleOk = async (values: any) => {
    setLoading(true);
@@ -90,7 +93,7 @@ const DependenceModal = ({
          label={intl.get('依赖类型')}
          initialValue={DependenceTypes[defaultType as any]}
        >
-          <Select>
+          <Select onChange={(value) => setSelectedType(value)}>
            {config.dependenceTypes.map((x, i) => (
              <Option key={i} value={i}>
                {x}
@@ -121,11 +124,24 @@ const DependenceModal = ({
              whitespace: true,
            },
          ]}
+          tooltip={
+            selectedType === DependenceTypes.python3
+              ? intl.get(
+                  'Python支持多种安装方式：\n1. 包名（如：requests）\n2. GitHub链接（如：git+https://github.com/user/repo.git）\n3. requirements文件路径（如：path/to/requirements.txt）\n4. pyproject.toml文件路径',
+                )
+              : undefined
+          }
        >
          <Input.TextArea
            rows={4}
            autoSize={{ minRows: 1, maxRows: 5 }}
-            placeholder={intl.get('请输入依赖名称')}
+            placeholder={
+              selectedType === DependenceTypes.python3
+                ? intl.get(
+                    '支持包名、GitHub链接、requirements.txt或pyproject.toml路径',
+                  )
+                : intl.get('请输入依赖名称')
+            }
          />
        </Form.Item>
        <Form.Item name="remark" label={intl.get('备注')}>
@@ -36,7 +36,6 @@ import useResizeObserver from '@react-hook/resize-observer';
 import SystemLog from './systemLog';
 import Dependence from './dependence';
 import ClientIp from './clientIp';
-import UserManagement from './userManagement';

 const { Text } = Typography;
 const isDemoEnv = window.__ENV__DeployEnv === 'demo';
@@ -346,11 +345,6 @@ const Setting = () => {
              label: intl.get('登录日志'),
              children: <LoginLog height={height} data={loginLogData} />,
            },
-            {
-              key: 'user-management',
-              label: intl.get('用户管理'),
-              children: <UserManagement height={height} />,
-            },
            {
              key: 'client-ip',
              label: intl.get('客户端 IP'),
@@ -1,257 +0,0 @@
-import intl from 'react-intl-universal';
-import React, { useState, useEffect } from 'react';
-import {
-  Button,
-  Table,
-  Space,
-  Modal,
-  Form,
-  Input,
-  Select,
-  message,
-  Tag,
-} from 'antd';
-import { EditOutlined, DeleteOutlined, PlusOutlined } from '@ant-design/icons';
-import { request } from '@/utils/http';
-import config from '@/utils/config';
-
-const { Option } = Select;
-
-interface User {
-  id: number;
-  username: string;
-  password?: string;
-  role: number;
-  status: number;
-  createdAt: string;
-  updatedAt: string;
-}
-
-const UserManagement: React.FC<{ height: number }> = ({ height }) => {
-  const [users, setUsers] = useState<User[]>([]);
-  const [loading, setLoading] = useState(false);
-  const [isModalVisible, setIsModalVisible] = useState(false);
-  const [editingUser, setEditingUser] = useState<User | null>(null);
-  const [form] = Form.useForm();
-
-  const columns = [
-    {
-      title: intl.get('用户名'),
-      dataIndex: 'username',
-      key: 'username',
-    },
-    {
-      title: intl.get('角色'),
-      dataIndex: 'role',
-      key: 'role',
-      render: (role: number) => (
-        <Tag color={role === 0 ? 'red' : 'blue'}>
-          {role === 0 ? intl.get('管理员') : intl.get('普通用户')}
-        </Tag>
-      ),
-    },
-    {
-      title: intl.get('状态'),
-      dataIndex: 'status',
-      key: 'status',
-      render: (status: number) => (
-        <Tag color={status === 0 ? 'green' : 'default'}>
-          {status === 0 ? intl.get('启用') : intl.get('禁用')}
-        </Tag>
-      ),
-    },
-    {
-      title: intl.get('创建时间'),
-      dataIndex: 'createdAt',
-      key: 'createdAt',
-      render: (text: string) => (text ? new Date(text).toLocaleString() : '-'),
-    },
-    {
-      title: intl.get('操作'),
-      key: 'action',
-      render: (_: any, record: User) => (
-        <Space size="middle">
-          <Button
-            type="link"
-            icon={<EditOutlined />}
-            onClick={() => handleEdit(record)}
-          >
-            {intl.get('编辑')}
-          </Button>
-          <Button
-            type="link"
-            danger
-            icon={<DeleteOutlined />}
-            onClick={() => handleDelete([record.id])}
-          >
-            {intl.get('删除')}
-          </Button>
-        </Space>
-      ),
-    },
-  ];
-
-  const fetchUsers = async () => {
-    setLoading(true);
-    try {
-      const { code, data } = await request.get(
-        `${config.apiPrefix}user-management`,
-      );
-      if (code === 200) {
-        setUsers(data);
-      }
-    } catch (error) {
-      message.error('Failed to fetch users');
-    } finally {
-      setLoading(false);
-    }
-  };
-
-  useEffect(() => {
-    fetchUsers();
-  }, []);
-
-  const handleAdd = () => {
-    setEditingUser(null);
-    form.resetFields();
-    setIsModalVisible(true);
-  };
-
-  const handleEdit = (record: User) => {
-    setEditingUser(record);
-    form.resetFields();
-    form.setFieldsValue({
-      username: record.username,
-      role: record.role,
-      status: record.status,
-    });
-    setIsModalVisible(true);
-  };
-
-  const handleDelete = (ids: number[]) => {
-    Modal.confirm({
-      title: intl.get('确认删除'),
-      content: intl.get('确认删除选中的用户吗'),
-      onOk: async () => {
-        try {
-          const { code, message: msg } = await request.delete(
-            `${config.apiPrefix}user-management`,
-            { data: ids },
-          );
-          if (code === 200) {
-            message.success(msg || intl.get('删除成功'));
-            fetchUsers();
-          } else {
-            message.error(msg || intl.get('删除失败'));
-          }
-        } catch (error: any) {
-          message.error(error.message || intl.get('删除失败'));
-        }
-      },
-    });
-  };
-
-  const handleSubmit = async () => {
-    try {
-      const values = await form.validateFields();
-
-      if (editingUser) {
-        // Update user
-        const { code, message: msg } = await request.put(
-          `${config.apiPrefix}user-management`,
-          { ...values, id: editingUser.id },
-        );
-        if (code === 200) {
-          message.success(msg || intl.get('更新成功'));
-          setIsModalVisible(false);
-          fetchUsers();
-        } else {
-          message.error(msg || intl.get('更新失败'));
-        }
-      } else {
-        // Create user
-        const { code, message: msg } = await request.post(
-          `${config.apiPrefix}user-management`,
-          values,
-        );
-        if (code === 200) {
-          message.success(msg || intl.get('创建成功'));
-          setIsModalVisible(false);
-          fetchUsers();
-        } else {
-          message.error(msg || intl.get('创建失败'));
-        }
-      }
-    } catch (error: any) {
-      message.error(error.message || intl.get('操作失败'));
-    }
-  };
-
-  return (
-    <>
-      <div style={{ marginBottom: 16 }}>
-        <Button type="primary" icon={<PlusOutlined />} onClick={handleAdd}>
-          {intl.get('新增用户')}
-        </Button>
-      </div>
-      <Table
-        columns={columns}
-        dataSource={users}
-        rowKey="id"
-        loading={loading}
-        scroll={{ y: height - 120 }}
-        pagination={false}
-      />
-      <Modal
-        title={editingUser ? intl.get('编辑用户') : intl.get('新增用户')}
-        open={isModalVisible}
-        onOk={handleSubmit}
-        onCancel={() => setIsModalVisible(false)}
-      >
-        <Form form={form} layout="vertical">
-          <Form.Item
-            name="username"
-            label={intl.get('用户名')}
-            rules={[{ required: true, message: intl.get('请输入用户名') }]}
-          >
-            <Input placeholder={intl.get('请输入用户名')} />
-          </Form.Item>
-          <Form.Item
-            name="password"
-            label={intl.get('密码')}
-            rules={[
-              { required: !editingUser, message: intl.get('请输入密码') },
-              { min: 6, message: intl.get('密码长度至少为6位') },
-            ]}
-          >
-            <Input.Password placeholder={intl.get('请输入密码')} />
-          </Form.Item>
-          <Form.Item
-            name="role"
-            label={intl.get('角色')}
-            rules={[{ required: true, message: intl.get('请选择角色') }]}
-            initialValue={1}
-          >
-            <Select>
-              <Option value={0}>{intl.get('管理员')}</Option>
-              <Option value={1}>{intl.get('普通用户')}</Option>
-            </Select>
-          </Form.Item>
-          <Form.Item
-            name="status"
-            label={intl.get('状态')}
-            rules={[{ required: true, message: intl.get('请选择状态') }]}
-            initialValue={0}
-          >
-            <Select>
-              <Option value={0}>{intl.get('启用')}</Option>
-              <Option value={1}>{intl.get('禁用')}</Option>
-            </Select>
-          </Form.Item>
-        </Form>
-      </Modal>
-    </>
-  );
-};
-
-export default UserManagement;
@@ -0,0 +1,61 @@
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  os = require('node:os'),
+  path = require('node:path'),
+  express = require('express');
+const load = require('../helpers/load-security-module.cjs');
+test('unknown API requests return JSON 404 while env.js and SPA deep links work', async (t) => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ql-fallback-'));
+  t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
+  fs.mkdirSync(path.join(dir, 'static/dist'), { recursive: true });
+  fs.writeFileSync(path.join(dir, 'static/dist/index.html'), 'SPA');
+  const app = express();
+  load('back/loaders/express.ts', {
+    '../api': () => express.Router(),
+    '../config': {
+      rootPath: dir,
+      uploadPath: dir,
+      api: { prefix: '/api' },
+      apiWhiteList: ['/api/env.js'],
+      jwt: { secret: 'test' },
+    },
+    'express-jwt': {
+      expressjwt: () => ({ unless: () => (_q, _r, next) => next() }),
+      UnauthorizedError: class extends Error {},
+    },
+    '../config/util': {
+      getPlatform: () => 'desktop',
+      getToken: () => 'stored',
+    },
+    '../config/serverEnv': {
+      serveEnv: (_q, r) => r.type('js').send('window.QL_CONFIG={};'),
+    },
+    '../shared/store': {
+      shareStore: { getAuthInfo: async () => ({}), getApps: async () => [] },
+    },
+    '../shared/auth': {
+      isValidToken: () => true,
+      isDefaultAuthInfo: () => false,
+    },
+    '../shared/i18n': { t: (s) => s },
+    '../middlewares/uniqueConstraintError': (_q, _r, next) => next(),
+    '../middlewares/protectedPathCase': (_q, _r, next) => next(),
+    '../data/system': {},
+    '../data/open': {},
+  }).default({ app });
+  const server = await new Promise((r) => {
+    const s = app.listen(0, '127.0.0.1', () => r(s));
+  });
+  t.after(() => new Promise((r) => server.close(r)));
+  const url = `http://127.0.0.1:${server.address().port}`;
+  for (const p of ['/api', '/api/missing', '/open/missing']) {
+    const res = await fetch(url + p);
+    assert.equal(res.status, 404, p);
+    assert.match(res.headers.get('content-type'), /json/);
+    assert.equal((await res.json()).code, 404);
+  }
+  const env = await fetch(url + '/api/env.js');
+  assert.match(await env.text(), /QL_CONFIG/);
+  assert.equal(await (await fetch(url + '/script')).text(), 'SPA');
+});
@@ -0,0 +1,253 @@
+const assert = require('node:assert/strict');
+const test = require('node:test');
+const fs = require('node:fs/promises');
+const path = require('node:path');
+const os = require('node:os');
+const { spawnSync } = require('node:child_process');
+const load = require('../helpers/load-security-module.cjs');
+const hasApt = spawnSync('apt-get', ['--version']).status === 0;
+const {
+  rewriteMirrorSources,
+  replaceMirrorUrl,
+  normalizeMirror,
+  mirrorWriteCommand,
+} = require('../../back/shared/linuxMirror');
+
+async function fixture(t) {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'ql-issue-fixes-'));
+  t.after(() => fs.rm(root, { force: true, recursive: true }));
+  return root;
+}
+
+test('#2902/#2871 mirror writes are idempotent, preserve suites, security/ports/version paths and quote URLs', async (t) => {
+  const original = `# http://leave.example/debian\nTypes: deb\nURIs: http://deb.debian.org/debian\nSuites: bookworm bookworm-updates\nComponents: main\nSigned-By: /usr/share/keyrings/debian-archive-keyring.gpg\n\nTypes: deb\nURIs: http://security.debian.org/debian-security\nSuites: bookworm-security\n`;
+  const url = 'https://mirror.example/mirrors/debian/';
+  const changed = rewriteMirrorSources(original, url);
+  assert.equal(rewriteMirrorSources(changed, url), changed);
+  assert.match(
+    changed,
+    /URIs: https:\/\/mirror.example\/mirrors\/debian-security/,
+  );
+  assert.match(changed, /Suites: bookworm-security/);
+  assert.match(changed, /# http:\/\/leave.example\/debian/);
+  assert.equal(
+    replaceMirrorUrl('http://old/debian/debian/debian', url),
+    'https://mirror.example/mirrors/debian',
+  );
+  assert.equal(
+    replaceMirrorUrl('http://old/armbian/armbian', 'https://new/armbian'),
+    'https://new/armbian',
+  );
+  assert.equal(
+    replaceMirrorUrl('http://old/ubuntu-ports', 'https://new/ubuntu'),
+    'https://new/ubuntu-ports',
+  );
+  assert.equal(
+    replaceMirrorUrl('http://old/alpine/v3.22/main', 'https://new/alpine'),
+    'https://new/alpine/v3.22/main',
+  );
+  assert.equal(
+    replaceMirrorUrl('http://old/debian', 'https://new'),
+    'https://new/debian',
+  );
+  for (const bad of [
+    'file:///tmp/a',
+    'http://u:p@host',
+    'https://host?x=1',
+    'https://host/\nanything',
+  ])
+    assert.throws(() => normalizeMirror(bad));
+  const root = await fixture(t);
+  const file = path.join(root, "quote's", 'sources');
+  const command = mirrorWriteCommand(file, changed, '', 'true');
+  const result = spawnSync('bash', ['-c', command], { encoding: 'utf8' });
+  assert.equal(result.status, 0, result.stderr);
+  assert.equal(await fs.readFile(file, 'utf8'), changed);
+});
+
+test('#2701 shell API serializes CR/LF, quotes, backslashes and colons without corrupting JSON', async () => {
+  const result = spawnSync(
+    'bash',
+    [
+      '-c',
+      `source shell/api.sh
+ql_api_request() { while [[ $# -gt 0 ]]; do if [[ "$1" == --data-raw ]]; then printf '%s\\n' "$2" >&3; break; fi; shift; done; printf '{"code":200}'; }
+t() { :; }
+add_cron_api '0 0 1 1 *' 'task a:b.js' $'quote"slash\\\\colon:\\r\\n\\t中文' 23
+update_cron_api '0 0 1 1 *' 'task a:b.js' $'quote"slash\\\\colon:\\r\\n\\t中文' 27
+update_cron_command_api $'task path\\\\with"quotes.js' 27
+`,
+    ],
+    { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe', 'pipe'] },
+  );
+  assert.equal(result.status, 0, result.stderr);
+  const payloads = result.output[3].trim().split('\n').map(JSON.parse);
+  assert.equal(payloads[0].name, 'quote"slash\\colon:\r\n\t中文');
+  assert.equal(payloads[0].sub_id, 23);
+  assert.equal(payloads[1].id, '27');
+  assert.equal(payloads[2].command, 'task path\\with"quotes.js');
+});
+
+for (const distribution of ['Debian', 'Ubuntu']) {
+  for (const legacyContent of ['', ' \t\r\n']) {
+    test(`${distribution}: empty legacy sources.list falls back to deb822 .sources`, async (t) => {
+      const root = await fixture(t);
+      const legacy = path.join(root, 'sources.list');
+      const sources = path.join(
+        root,
+        'sources.list.d',
+        `${distribution.toLowerCase()}.sources`,
+      );
+      await fs.writeFile(legacy, legacyContent);
+      const util = load('back/config/util.ts', {
+        'fs/promises': {
+          readFile: async (file) => {
+            if (file === '/etc/os-release')
+              return `ID=${distribution.toLowerCase()}\nVERSION_CODENAME=${
+                distribution === 'Debian' ? 'bookworm' : 'noble'
+              }\n`;
+            if (file === '/etc/apt/sources.list')
+              return fs.readFile(legacy, 'utf8');
+            throw Object.assign(new Error('missing fixture source'), {
+              code: 'ENOENT',
+            });
+          },
+        },
+        os: { platform: () => 'linux' },
+        './index': {},
+        './const': {},
+        './share': {},
+        './container': { isInContainer: () => false },
+        '../loaders/logger': {},
+        '../shared/utils': {},
+        '../shared/fileAccess': {},
+        '../data/dependence': {},
+      });
+      const previousOS = process.env.QL_OS_TYPE;
+      let command;
+      try {
+        process.env.QL_OS_TYPE = distribution.toLowerCase();
+        command = await util.updateLinuxMirrorFile('https://mirror.example');
+      } finally {
+        if (previousOS === undefined) delete process.env.QL_OS_TYPE;
+        else process.env.QL_OS_TYPE = previousOS;
+      }
+      // Execute the entire generated writer, redirecting its APT paths into
+      // the fixture and replacing only the package-index refresh.
+      const isolated = command
+        .replaceAll('/etc/apt', root)
+        .replace('apt-get update --error-on=any', 'true');
+      const result = spawnSync('bash', ['-c', isolated], { encoding: 'utf8' });
+      assert.equal(result.status, 0, result.stderr);
+      assert.equal(await fs.readFile(legacy, 'utf8'), legacyContent);
+      const generated = await fs.readFile(sources, 'utf8');
+      assert.match(generated, /^Types: deb\nURIs: https:\/\/mirror\.example\//);
+      assert.match(generated, /Signed-By: \/usr\/share\/keyrings\//);
+      assert.match(
+        generated,
+        distribution === 'Debian' ? /bookworm-security/ : /noble-backports/,
+      );
+      if (hasApt) {
+        // Parse both source locations with real APT, without refreshing indexes
+        // or touching the host's configuration/cache.
+        const parsed = spawnSync(
+          'apt-get',
+          [
+            'indextargets',
+            '-o',
+            `Dir::Etc::sourcelist=${legacy}`,
+            '-o',
+            `Dir::Etc::sourceparts=${path.dirname(sources)}`,
+            '-o',
+            `Dir::State::lists=${path.join(root, 'lists')}`,
+          ],
+          { encoding: 'utf8' },
+        );
+        assert.equal(parsed.status, 0, parsed.stderr);
+      }
+    });
+  }
+}
+
+test('deb822 mirror changes preserve vendor archives, signing keys and comments across repeated saves', () => {
+  const system =
+    'Types: deb\nURIs: https://deb.debian.org/debian\nSuites: bookworm\nComponents: main\nSigned-By: /usr/share/keyrings/debian-archive-keyring.gpg\n';
+  const vendors = [
+    'Types: deb\nURIs: https://download.docker.com/linux/debian\nSuites: bookworm\nComponents: stable\nSigned-By: /etc/apt/keyrings/docker.asc\n',
+    'Types: deb\nURIs: https://download.docker.com/linux/debian\nSuites: bookworm\nComponents: stable\n',
+    'Types: deb\nURIs: https://packages.microsoft.com/repos/code\nSuites: stable\nComponents: main\n',
+    'Types: deb\nURIs: https://vendor.example/debian\nSuites: bookworm\nComponents: main\nSigned-By: /etc/apt/keyrings/vendor.gpg\n',
+  ];
+  const comment = '# Keep https://vendor.example/debian unchanged\n';
+  const original = [system, ...vendors, comment].join('\n');
+  const first = rewriteMirrorSources(
+    original,
+    'https://mirror.example/mirrors/debian',
+  );
+  assert.ok(first.includes('URIs: https://mirror.example/mirrors/debian\n'));
+  for (const unchanged of [...vendors, comment])
+    assert.ok(first.includes(unchanged));
+  assert.equal(
+    rewriteMirrorSources(first, 'https://mirror.example/mirrors/debian'),
+    first,
+  );
+  const second = rewriteMirrorSources(first, 'https://second.example/debian');
+  assert.ok(second.includes('URIs: https://second.example/debian\n'));
+  for (const unchanged of [...vendors, comment])
+    assert.ok(second.includes(unchanged));
+});
+
+test('legacy mirror changes preserve third-party lines, inline comments and source options', () => {
+  const system =
+    'deb [arch=amd64 signed-by=/usr/share/keyrings/debian-archive-keyring.gpg] https://deb.debian.org/debian bookworm main # https://leave.example/debian\n';
+  const security =
+    'deb-src https://security.debian.org/debian-security bookworm-security main\n';
+  const vendors = [
+    'deb [signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian bookworm stable\n',
+    'deb https://download.docker.com/linux/debian bookworm stable\n',
+    'deb [signed-by=/etc/apt/keyrings/vendor.gpg] https://vendor.example/debian bookworm main\n',
+    'deb https://packages.microsoft.com/repos/code stable main\n',
+    '# deb https://deb.debian.org/debian bookworm main\n',
+  ];
+  const original = system + security + vendors.join('');
+  const changed = rewriteMirrorSources(
+    original,
+    'https://mirror.example/debian',
+  );
+  assert.ok(
+    changed.includes(
+      system.replace(
+        'https://deb.debian.org/debian',
+        'https://mirror.example/debian',
+      ),
+    ),
+  );
+  assert.ok(
+    changed.includes(
+      security.replace(
+        'https://security.debian.org/debian-security',
+        'https://mirror.example/debian-security',
+      ),
+    ),
+  );
+  for (const unchanged of vendors) assert.ok(changed.includes(unchanged));
+  assert.equal(
+    rewriteMirrorSources(changed, 'https://mirror.example/debian'),
+    changed,
+  );
+});
+
+test('Ubuntu ports, Armbian and Alpine roots still switch mirrors without altering repository metadata', () => {
+  for (const url of [
+    'https://ports.ubuntu.com/ubuntu-ports',
+    'https://apt.armbian.com/armbian',
+    'https://old.example/alpine/v3.22/main',
+    'https://old.example/alpine/v3.22/community',
+  ]) {
+    const original = `URIs: ${url}\nSuites: noble\nComponents: main\n`;
+    assert.equal(
+      rewriteMirrorSources(original, 'https://mirror.example'),
+      original.replace(url, replaceMirrorUrl(url, 'https://mirror.example')),
+    );
+  }
+});
@@ -129,7 +129,7 @@ Acquire::http::Timeout "1";
          'fs/promises': {
            readFile: async (file) =>
              file === '/etc/os-release'
-                ? distribution
+                ? `${distribution}\nVERSION_CODENAME=bookworm\n`
                : existingMirror
                ? 'URIs: http://old.example/debian\n'
                : '',
@@ -1,292 +0,0 @@
-const test = require('node:test'),
-  assert = require('node:assert/strict');
-const { Sequelize } = require('sequelize');
-const jwt = require('jsonwebtoken'),
-  express = require('express');
-const fs = require('node:fs'),
-  os = require('node:os'),
-  path = require('node:path');
-const load = require('../helpers/load-security-module.cjs');
-
-test('user accounts keep credentials private, update on SQLite and revoke changed sessions', async (t) => {
-  const database = new Sequelize({
-    dialect: 'sqlite',
-    storage: ':memory:',
-    logging: false,
-  });
-  t.after(() => database.close());
-  const cache = new Map();
-  const config = {
-    jwt: { secret: 'synthetic-multiuser-test' },
-    api: { prefix: '/api' },
-  };
-  const mocks = {
-    '.': { sequelize: database },
-    '../config': config,
-    '../shared/store': {
-      shareStore: { getAuthInfo: async () => ({ username: 'owner' }) },
-    },
-    typedi: { Service: () => (x) => x, Inject: () => () => {} },
-  };
-  const { UserModel } = load('back/data/user.ts', mocks, cache);
-  await UserModel.sync();
-  const Account = load('back/services/userManagement.ts', mocks, cache).default;
-  const account = new Account({});
-  const alice = await account.create({
-    username: 'alice',
-    password: 'password1',
-    role: 1,
-    status: 0,
-  });
-  assert.ok(!Object.hasOwn(alice, 'password'));
-  assert.ok(!Object.hasOwn(alice, 'sessions'));
-  const admin = await account.create({
-    username: 'manager',
-    password: 'password2',
-    role: 0,
-    status: 0,
-  });
-  assert.equal(admin.role, 0);
-  const raw = await UserModel.findByPk(alice.id);
-  assert.match(raw.password, /^scrypt\$/);
-  assert.notEqual(raw.password, 'password1');
-  assert.equal(await account.authenticate('alice', 'wrong'), null);
-  let token = await account.issueToken(
-    await account.authenticate('alice', 'password1'),
-    'desktop',
-  );
-  assert.equal((await account.validateToken(token, 'desktop')).id, alice.id);
-  assert.equal(await account.validateToken(token, 'mobile'), null);
-  const forged = jwt.sign({ userId: alice.id, role: 0 }, config.jwt.secret, {
-    algorithm: 'HS384',
-    expiresIn: '1h',
-  });
-  assert.equal(await account.validateToken(forged, 'desktop'), null);
-  const updated = await account.update({
-    id: alice.id,
-    username: 'alice',
-    password: '',
-  });
-  assert.equal(updated.username, 'alice');
-  assert.ok(!Object.hasOwn(updated, 'password'));
-  assert.equal(await account.validateToken(token, 'desktop'), null);
-  token = await account.issueToken(
-    await account.authenticate('alice', 'password1'),
-    'desktop',
-  );
-  await account.revokeToken(alice.id, token);
-  assert.equal(await account.validateToken(token, 'desktop'), null);
-  token = await account.issueToken(
-    await account.authenticate('alice', 'password1'),
-    'desktop',
-  );
-  await account.update({ id: alice.id, status: 1 });
-  assert.equal(await account.validateToken(token, 'desktop'), null);
-  assert.equal(await account.authenticate('alice', 'password1'), null);
-  assert.ok(
-    (await account.list()).every(
-      (x) => !Object.hasOwn(x, 'password') && !Object.hasOwn(x, 'sessions'),
-    ),
-  );
-  await assert.rejects(
-    account.create({
-      username: 'owner',
-      password: 'password3',
-      role: 1,
-      status: 0,
-    }),
-  );
-  await account.update({ id: alice.id, status: 0, password: 'changed123' });
-  assert.equal(await account.authenticate('alice', 'password1'), null);
-  await account.delete([alice.id]);
-  assert.equal(await account.validateToken(token, 'desktop'), null);
-});
-
-test('HTTP ordinary users see only their own data and cannot invoke global or executable APIs', async (t) => {
-  const database = new Sequelize({
-    dialect: 'sqlite',
-    storage: ':memory:',
-    logging: false,
-  });
-  t.after(() => database.close());
-  const cache = new Map();
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ql-user-http-'));
-  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
-  const secret = 'synthetic-http-multiuser',
-    adminToken = jwt.sign({}, secret, { algorithm: 'HS384', expiresIn: '1h' });
-  const config = {
-    jwt: { secret },
-    api: { prefix: '/api' },
-    apiWhiteList: ['/api/user/login', '/api/health', '/api/system'],
-    baseUrl: '',
-    rootPath: root,
-    uploadPath: root,
-  };
-  const mocks = {
-    '.': { sequelize: database },
-    '../config': config,
-    typedi: { Service: () => (x) => x, Inject: () => () => {} },
-    '../shared/i18n': { t: (x) => x },
-    '../data/open': {},
-    '../config/serverEnv': { serveEnv: (req, res) => res.end() },
-    '../config/util': {
-      getToken: (req) =>
-        (req.headers.authorization || '').replace(/^Bearer /, ''),
-      getPlatform: () => 'desktop',
-    },
-    '../shared/store': {
-      shareStore: {
-        getAuthInfo: async () => ({
-          username: 'owner',
-          password: 'configured',
-          token: adminToken,
-        }),
-        getApps: async () => [],
-      },
-    },
-  };
-  const userData = load('back/data/user.ts', mocks, cache),
-    envData = load('back/data/env.ts', mocks, cache),
-    cronData = load('back/data/cron.ts', mocks, cache),
-    subData = load('back/data/subscription.ts', mocks, cache);
-  for (const model of [
-    userData.UserModel,
-    envData.EnvModel,
-    cronData.CrontabModel,
-    subData.SubscriptionModel,
-  ])
-    await model.sync();
-  mocks['../data/env'] = envData;
-  mocks['../data/cron'] = cronData;
-  mocks['../data/subscription'] = subData;
-  const Account = load('back/services/userManagement.ts', mocks, cache).default;
-  const account = new Account({});
-  mocks['../services/userManagement'] = { default: Account };
-  mocks.typedi.Container = { get: () => account };
-  const alice = await account.create({
-      username: 'alice',
-      password: 'password1',
-      role: 1,
-      status: 0,
-    }),
-    bob = await account.create({
-      username: 'bob',
-      password: 'password2',
-      role: 1,
-      status: 0,
-    });
-  await envData.EnvModel.bulkCreate([
-    { name: 'mine', value: 'alice-only', userId: alice.id },
-    { name: 'other', value: 'bob-secret', userId: bob.id },
-    { name: 'legacy', value: 'owner-secret', userId: null },
-  ]);
-  let commands = 0;
-  mocks['../api'] = () => {
-    const router = express.Router();
-    router.get('/system', (req, res) => res.json({ code: 200 }));
-    router.get('/user', async (req, res) =>
-      res.json({ code: 200, data: await account.get(req.user.userId) }),
-    );
-    router.post('/user/logout', async (req, res) => {
-      await account.revokeToken(
-        req.user.userId,
-        mocks['../config/util'].getToken(req),
-      );
-      res.json({ code: 200 });
-    });
-    router.post('/system/command', (req, res) => {
-      commands++;
-      res.json({ code: 200 });
-    });
-    router.get('/envs', (req, res) =>
-      res.json({ code: 200, data: 'admin-all' }),
-    );
-    return router;
-  };
-  const app = express();
-  load('back/loaders/express.ts', mocks, cache).default({ app });
-  const server = app.listen(0, '127.0.0.1');
-  await new Promise((r) => server.once('listening', r));
-  t.after(() => new Promise((r) => server.close(r)));
-  let token = await account.issueToken(
-    await account.authenticate('alice', 'password1'),
-    'desktop',
-  );
-  async function request(url, method = 'GET', current = token) {
-    const response = await fetch(
-      `http://127.0.0.1:${server.address().port}${url}`,
-      { method, headers: { Authorization: 'Bearer ' + current } },
-    );
-    return { status: response.status, body: await response.json() };
-  }
-  assert.equal((await request('/api/system')).status, 200);
-  assert.equal((await request('/api/user')).body.data.username, 'alice');
-  const mine = await request(`/api/envs?userId=${bob.id}`);
-  assert.deepEqual(
-    mine.body.data.map((x) => x.value),
-    ['alice-only'],
-  );
-  assert.equal((await request('/api/envs/2')).status, 404);
-  assert.equal((await request('/api/envs/3')).status, 404);
-  for (const [url, method] of [
-    ['/api/system/command', 'POST'],
-    ['/api/crons/run', 'PUT'],
-    ['/api/envs', 'PUT'],
-    ['/api/configs', 'GET'],
-    ['/api/logs', 'GET'],
-    ['/api/scripts', 'GET'],
-    ['/api/dependencies', 'POST'],
-    ['/api/user-management', 'GET'],
-    ['/api/system/config', 'GET'],
-    ['/api/user/two-factor/init', 'GET'],
-  ])
-    assert.equal((await request(url, method)).status, 403, url);
-  assert.equal(commands, 0);
-  assert.equal(
-    (await request('/api/envs', 'GET', adminToken)).body.data,
-    'admin-all',
-  );
-  const forged = jwt.sign({ userId: alice.id, role: 0 }, secret, {
-    algorithm: 'HS384',
-    expiresIn: '1h',
-  });
-  assert.equal((await request('/api/envs', 'GET', forged)).status, 401);
-  await request('/api/user/logout', 'POST');
-  assert.equal((await request('/api/envs')).status, 401);
-  token = await account.issueToken(
-    await account.authenticate('alice', 'password1'),
-    'desktop',
-  );
-  await account.update({ id: alice.id, status: 1 });
-  assert.equal((await request('/api/envs')).status, 401);
-});
-
-test('user ownership migration preserves existing records and is idempotent', async (t) => {
-  const database = new Sequelize({
-    dialect: 'sqlite',
-    storage: ':memory:',
-    logging: false,
-  });
-  t.after(() => database.close());
-  for (const table of [
-    'Users',
-    'Envs',
-    'Crontabs',
-    'Subscriptions',
-    'Dependences',
-  ])
-    await database.query(
-      `CREATE TABLE "${table}" (id INTEGER PRIMARY KEY, name TEXT)`,
-    );
-  await database.query(`INSERT INTO Envs (id,name) VALUES (1,'preserved')`);
-  const {
-    migrateUserSchema,
-  } = require('../../back/shared/userSchemaMigrations');
-  await migrateUserSchema(database);
-  await migrateUserSchema(database);
-  const [rows] = await database.query('SELECT * FROM Envs');
-  assert.equal(rows[0].name, 'preserved');
-  assert.equal(rows[0].userId, null);
-  const columns = await database.getQueryInterface().describeTable('Users');
-  assert.ok(columns.sessions);
-});
@@ -0,0 +1,63 @@
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  os = require('node:os'),
+  path = require('node:path'),
+  { execFileSync } = require('node:child_process');
+const load = require('../helpers/load-security-module.cjs');
+test('Python source arguments round-trip literally and local files stay inside maintained roots', (t) => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ql-pip-source-'));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  const scripts = path.join(root, 'scripts'),
+    repo = path.join(root, 'repo');
+  fs.mkdirSync(scripts);
+  fs.mkdirSync(repo);
+  fs.mkdirSync(path.join(scripts, 'project space'));
+  const requirement = path.join(scripts, 'project space', 'requirements.txt');
+  fs.writeFileSync(requirement, 'requests');
+  fs.writeFileSync(
+    path.join(scripts, 'project space', 'pyproject.toml'),
+    '[project]\nname="sample"',
+  );
+  const outside = path.join(root, 'requirements.txt');
+  fs.writeFileSync(outside, 'outside');
+  fs.symlinkSync(outside, path.join(scripts, 'requirements-link.txt'));
+  const api = load('back/config/util.ts', {
+    './index': { scriptPath: scripts, repoPath: repo },
+    './const': { PYTHON_INSTALL_DIR: '/prefix with spaces' },
+    '../loaders/logger': {},
+    '../shared/utils': {},
+    '../data/dependence': {
+      DependenceTypes: { nodejs: 0, python3: 1, linux: 2 },
+    },
+  });
+  function args(cmd) {
+    return execFileSync('/bin/bash', [
+      '-c',
+      'pip3(){ printf "%s\\0" "$@"; }; ' + cmd,
+    ])
+      .toString()
+      .split('\0')
+      .slice(0, -1);
+  }
+  const req = args(api.getInstallCommand(1, 'project space/requirements.txt'));
+  assert.equal(req.at(-1), requirement);
+  assert.equal(req.at(-2), '-r');
+  assert.ok(req.includes('--prefix=/prefix with spaces'));
+  assert.equal(
+    args(api.getInstallCommand(1, 'project space/pyproject.toml')).at(-1),
+    path.dirname(requirement),
+  );
+  const url = 'git+https://example.invalid/repo.git#egg=pkg;$(echo INJECTED)';
+  assert.equal(args(api.getInstallCommand(1, url)).at(-1), url);
+  assert.throws(() => api.getInstallCommand(1, '../requirements.txt'));
+  assert.throws(() => api.getInstallCommand(1, 'requirements-link.txt'));
+  assert.equal(
+    args(api.getUninstallCommand(1, 'project space/requirements.txt')).at(-1),
+    requirement,
+  );
+  assert.match(
+    api.getUninstallCommand(1, url),
+    /Remove installed Python distributions separately/,
+  );
+});
@@ -0,0 +1,70 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+const load = require('../helpers/load-security-module.cjs');
+
+test('requirements install, probe and removal stay in the selected venv', (t) => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ql-source-venv-'));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  const venv = path.join(root, 'virtual env');
+  const scripts = path.join(root, 'scripts');
+  fs.mkdirSync(scripts);
+  execFileSync('python3', ['-m', 'venv', venv]);
+  const wheel = path.join(scripts, 'ql_venv_fixture-1.0-py3-none-any.whl');
+  execFileSync('python3', [
+    '-c',
+    `import zipfile,sys
+with zipfile.ZipFile(sys.argv[1],'w') as z:
+ z.writestr('ql_venv_fixture.py','value = 42')
+ z.writestr('ql_venv_fixture-1.0.dist-info/METADATA','Metadata-Version: 2.1\\nName: ql-venv-fixture\\nVersion: 1.0\\n')
+ z.writestr('ql_venv_fixture-1.0.dist-info/WHEEL','Wheel-Version: 1.0\\nGenerator: fixture\\nRoot-Is-Purelib: true\\nTag: py3-none-any\\n')
+ z.writestr('ql_venv_fixture-1.0.dist-info/RECORD','')`,
+    wheel,
+  ]);
+  fs.writeFileSync(path.join(scripts, 'requirements.txt'), wheel + '\n');
+  const api = load('back/config/util.ts', {
+    './index': {
+      rootPath: root,
+      scriptPath: scripts,
+      repoPath: path.join(root, 'repo'),
+    },
+    './const': {
+      PYTHON_VENV_DIR: 'virtual env',
+      PYTHON_INSTALL_DIR: '/unused-global-prefix',
+    },
+    '../loaders/logger': {},
+    '../shared/utils': {},
+    '../data/dependence': {
+      DependenceTypes: { nodejs: 0, python3: 1, linux: 2 },
+    },
+  });
+  const run = (command) =>
+    execFileSync('/bin/bash', ['-c', command], {
+      encoding: 'utf8',
+      env: {
+        ...process.env,
+        PIP_NO_INDEX: '1',
+        PIP_DISABLE_PIP_VERSION_CHECK: '1',
+      },
+    });
+  const install = api.getInstallCommand(1, 'requirements.txt');
+  assert.doesNotMatch(install, /--prefix=/);
+  run(install);
+  assert.match(run(api.getGetCommand(1, 'ql-venv-fixture')), /1\.0/);
+  assert.equal(
+    run(
+      `'${path.join(
+        venv,
+        'bin/python3',
+      )}' -c 'import ql_venv_fixture; print(ql_venv_fixture.value)'`,
+    ).trim(),
+    '42',
+  );
+  run(api.getUninstallCommand(1, 'requirements.txt'));
+  assert.throws(() =>
+    run(`'${path.join(venv, 'bin/python3')}' -c 'import ql_venv_fixture'`),
+  );
+});
@@ -0,0 +1,69 @@
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  os = require('node:os'),
+  path = require('node:path'),
+  { execFileSync } = require('node:child_process');
+const load = require('../helpers/load-security-module.cjs');
+test('venv installs, uninstalls and probes use the selected Python, including spaces', () => {
+  const methods = load('back/config/util.ts', {
+    './index': { rootPath: '/application' },
+    './const': {
+      PYTHON_VENV_DIR: 'virtual env',
+      PYTHON_INSTALL_DIR: '/legacy',
+    },
+    '../loaders/logger': {},
+    '../shared/utils': {},
+    '../data/dependence': {
+      DependenceTypes: { nodejs: 0, python3: 1, linux: 2 },
+    },
+  });
+  for (const name of [
+    'getInstallCommand',
+    'getUninstallCommand',
+    'getGetCommand',
+  ]) {
+    const cmd = methods[name](1, 'requests');
+    assert.match(cmd, /'\/application\/virtual env\/bin\/python3'/);
+    assert.doesNotMatch(cmd, /--prefix=/);
+  }
+});
+test('venv setup keeps Python packages isolated and retains existing startup configuration', (t) => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ql-venv-'));
+  t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
+  const ql = path.join(dir, 'application with spaces');
+  fs.mkdirSync(ql);
+  const venv = path.join(dir, 'venv with spaces');
+  execFileSync('python3', ['-m', 'venv', venv]);
+  const source = fs.readFileSync('shell/start-simplify.sh', 'utf8');
+  const snippet = source.slice(
+    source.indexOf('export PNPM_HOME='),
+    source.indexOf('\ncd "${QL_DIR}"'),
+  );
+  const result = execFileSync(
+    '/bin/bash',
+    [
+      '-c',
+      snippet +
+        '\npython3 -c "import sys; print(sys.prefix); print(sys.base_prefix)"',
+    ],
+    {
+      env: {
+        ...process.env,
+        QL_DIR: ql,
+        QL_DATA_DIR: path.join(dir, 'data'),
+        PYTHON_VENV_DIR: venv,
+        PYTHONPATH: '/legacy/modules',
+        PYTHONUSERBASE: '/legacy',
+        PATH: process.env.PATH,
+      },
+      encoding: 'utf8',
+    },
+  )
+    .trim()
+    .split('\n');
+  assert.equal(fs.realpathSync(result[0]), fs.realpathSync(venv));
+  assert.notEqual(result[1], venv);
+  assert.match(source, /set -C; cat .env.example > .env/);
+  assert.doesNotMatch(source, /npm install|pip3 install|chmod 777/);
+});
@@ -106,7 +106,6 @@ test('database loader rejects initialization failure rather than allowing worker
  const mocks = { './logger': { error() {}, info() {} } };
  for (const [file, model] of [
    ['env', 'EnvModel'],
-    ['user', 'UserModel'],
    ['cron', 'CrontabModel'],
    ['dependence', 'DependenceModel'],
    ['open', 'AppModel'],
@@ -18,7 +18,6 @@ async function setup() {
  const clients = new Set();
  const timers = new Set();
  const mocks = {
-    jsonwebtoken: jwt,
    sockjs: {
      createServer: () => ({
        on: (_, fn) => {
@@ -70,75 +70,3 @@ test('WebSocket connections reject expired tokens and close when sessions are re
  });
  assert.equal(clients.size, 0);
 });
-
-test('database administrators receive live updates while read-only users are refused and revoked admins disconnect', async () => {
-  const secret = 'account-sock-test';
-  const adminToken = jwt.sign({ userId: 2 }, secret, { algorithm: 'HS384' });
-  const userToken = jwt.sign({ userId: 3 }, secret, { algorithm: 'HS384' });
-  let revoked = false,
-    onConnection;
-  const clients = new Set();
-  const Sock = class {},
-    Account = class {};
-  const loader = load(path.join(__dirname, '../../back/loaders/sock.ts'), {
-    sockjs: {
-      createServer: () => ({
-        on: (_event, fn) => {
-          onConnection = fn;
-        },
-        installHandlers() {},
-      }),
-    },
-    typedi: {
-      Container: {
-        get: (kind) =>
-          kind === Account
-            ? {
-                validateToken: async (token) =>
-                  revoked ? null : { role: token === adminToken ? 0 : 1 },
-              }
-            : {
-                addClient: (c) => clients.add(c),
-                removeClient: (c) => clients.delete(c),
-              },
-      },
-    },
-    '../services/sock': Sock,
-    '../services/userManagement': Account,
-    '../config': { jwt: { secret }, baseUrl: '' },
-    '../config/util': { getPlatform: () => 'desktop' },
-    '../shared/store': {
-      shareStore: { getAuthInfo: async () => ({ token: '', tokens: {} }) },
-    },
-  }).default;
-  await loader({ server: {} });
-  const connection = (token) =>
-    Object.assign(new EventEmitter(), {
-      headers: {},
-      pathname: '/api/ws/a/b/websocket',
-      url: `/api/ws/a/b/websocket?token=${token}`,
-      close() {
-        this.closed = true;
-        this.emit('close');
-      },
-      write() {},
-    });
-  const ordinary = connection(userToken);
-  await onConnection(ordinary);
-  assert.equal(ordinary.closed, true);
-  const admin = connection(adminToken);
-  await onConnection(admin);
-  assert.equal(clients.has(admin), true);
-  revoked = true;
-  await new Promise((resolve, reject) => {
-    const timeout = setTimeout(() => {
-      admin.close();
-      reject(new Error('revoked administrator remained connected'));
-    }, 3000);
-    admin.once('close', () => {
-      clearTimeout(timeout);
-      resolve();
-    });
-  });
-  assert.equal(clients.size, 0);
-});
@@ -7,8 +7,8 @@ const { spawnSync } = require('node:child_process');

 // Run the actual startup prefix, stopping before service initialization.
 const source = fs
-  .readFileSync('shell/start.sh', 'utf8')
-  .split('. ${QL_DIR}/shell/share.sh')[0];
+  .readFileSync('shell/start-simplify.sh', 'utf8')
+  .split('. "${QL_DIR}/shell/share.sh"')[0];
 for (const command of ['start', 'reload']) {
  for (const existing of [false, true]) {
    test(`${command} ${
@@ -36,7 +36,6 @@ function fixture(initial) {
        require('node:crypto').randomBytes(32).toString('hex'),
    },
    './notify': class {},
-    './userManagement': class {},
    './schedule': class {},
    './sock': class {},
    '../shared/store': {
@@ -68,7 +67,6 @@ function fixture(initial) {
    { getClients: () => [{ close: () => closed++ }] },
  );
  user.notificationService = { notify() {} };
-  user.userManagementService = { authenticate: async () => null };
  return {
    user,
    get auth() {
Author	SHA1	Message	Date
whyour	0aa521a288	fix(python): integrate venv startup with source dependency support	2026-10-13 02:24:12 +08:00
whyour	1ac04a8062	fix(python): keep source dependency installs and removals in selected venv	2026-10-13 02:21:10 +08:00
whyour	db88d037db	fix(python): integrate latest develop and support older venv pip	2026-10-13 02:20:59 +08:00
whyour	be877cfddc	fix: 修复完整镜像源地址及 CRLF 任务导入 (#3093 ) * fix: address six verified legacy issue regressions * fix: limit issue patch to mirror URLs and CRLF imports * fix: preserve APT formats and third-party repositories	2026-10-13 01:11:35 +08:00
Copilot whyourcopilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>whyour	fdeffebba8	Fix catch-all route serving HTML for API requests (#2885 ) * Initial plan * Fix env.js loading error by preventing catch-all from matching API routes Co-authored-by: whyour <22700758+whyour@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: whyour <22700758+whyour@users.noreply.github.com> Co-authored-by: whyour <imwhyour@gmail.com>	2026-10-13 01:07:50 +08:00
dependabot[bot]dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>whyour	3c61e933a1	chore(deps): bump the npm_and_yarn group across 1 directory with 8 updates (#3075 ) * chore(deps): bump the npm_and_yarn group across 1 directory with 8 updates Bumps the npm_and_yarn group with 8 updates in the / directory: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [body-parser](https://github.com/expressjs/body-parser) \| `1.20.3` \| `1.20.6` \| \| [http-proxy-middleware](https://github.com/chimurai/http-proxy-middleware) \| `3.0.3` \| `3.0.7` \| \| [js-yaml](https://github.com/nodeca/js-yaml) \| `4.1.0` \| `4.3.2` \| \| [multer](https://github.com/expressjs/multer) \| `2.3.0` \| `2.4.0` \| \| [nodemailer](https://github.com/nodemailer/nodemailer) \| `8.0.1` \| `10.0.9` \| \| [undici](https://github.com/nodejs/undici) \| `7.9.0` \| `7.29.1` \| \| [axios](https://github.com/axios/axios) \| `1.7.8` \| `1.20.0` \| \| [brace-expansion](https://github.com/juliangruber/brace-expansion) \| `1.1.12` \| `1.1.21` \| Updates `body-parser` from 1.20.3 to 1.20.6 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](https://github.com/expressjs/body-parser/compare/1.20.3...1.20.6) Updates `http-proxy-middleware` from 3.0.3 to 3.0.7 - [Release notes](https://github.com/chimurai/http-proxy-middleware/releases) - [Changelog](https://github.com/chimurai/http-proxy-middleware/blob/v3.0.7/CHANGELOG.md) - [Commits](https://github.com/chimurai/http-proxy-middleware/compare/v3.0.3...v3.0.7) Updates `js-yaml` from 4.1.0 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/4.1.0...4.3.2) Updates `multer` from 2.3.0 to 2.4.0 - [Release notes](https://github.com/expressjs/multer/releases) - [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md) - [Commits](https://github.com/expressjs/multer/compare/v2.3.0...v2.4.0) Updates `nodemailer` from 8.0.1 to 10.0.9 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodemailer/nodemailer/compare/v8.0.1...v10.0.9) Updates `undici` from 7.9.0 to 7.29.1 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](https://github.com/nodejs/undici/compare/v7.9.0...v7.29.1) Updates `axios` from 1.7.8 to 1.20.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](https://github.com/axios/axios/compare/v1.7.8...v1.20.0) Updates `brace-expansion` from 1.1.12 to 1.1.21 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.12...v1.1.21) --- updated-dependencies: - dependency-name: axios dependency-version: 1.18.0 dependency-type: direct:development - dependency-name: body-parser dependency-version: 1.20.6 dependency-type: direct:production - dependency-name: brace-expansion dependency-version: 1.1.21 dependency-type: indirect - dependency-name: http-proxy-middleware dependency-version: 3.0.7 dependency-type: direct:production - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: direct:production - dependency-name: multer dependency-version: 2.3.0 dependency-type: direct:production - dependency-name: nodemailer dependency-version: 9.1.1 dependency-type: direct:production - dependency-name: undici dependency-version: 7.29.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * fix(ci): verify the updated multer runtime version --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: whyour <imwhyour@gmail.com>	2026-10-13 01:06:29 +08:00
whyour	cf236f8324	fix(dependencies): require existing sources and translate install hints	2026-10-12 01:13:53 +08:00
whyour	4cd6c6ad2e	fix(dependencies): quote and validate Python source installs	2026-10-12 00:23:48 +08:00
whyour	81a60254a2	fix(python): share safe startup and honor explicit virtual environments	2026-10-12 00:23:20 +08:00
jiandanc	0af546cd1d	feat: 支持 Python venv 隔离环境，适配 Node.js 原生部署 ## 背景原方案使用系统 Python + pip --prefix 安装依赖到 data/dep_cache/python3，系统 Python 环境被污染，且无法隔离不同项目的依赖。 ## 改动内容 ### 核心：Python venv 支持 - shell/start.sh: 使用 python3 -m venv 创建虚拟环境，替代 --prefix 模式 - 从 .env 文件读取 PYTHON_VENV_DIR 配置 - 首次启动自动创建 .venv，已存在则跳过 - 仅将 .venv/bin 加入 PATH 优先级，不设置 PYTHONHOME/PYTHONPATH（避免破坏 venv 机制） - .env 不再强制覆盖，仅首次从 .env.example 复制 - 启动时自动修复 task/ql 软链接指向当前部署目录 ### 后端适配 - back/config/const.ts: 新增 PYTHON_VENV_DIR 常量 - back/config/util.ts: venv 模式下跳过 pip --prefix，直接使用 venv 的 pip3 ### 开发模式支持 - shell/dev-env.sh: pnpm start 时自动 source，将 .venv/bin 加入 PATH - package.json: start:back 加入 source dev-env.sh ### 新增文件 - shell/start-simplify.sh: 精简版启动脚本（跳过系统依赖安装，适用于已预装环境的服务器） - README-NODE.md: Node.js 原生部署完整文档 ### 配置 - .env.example: 新增 PYTHON_VENV_DIR=./.venv 配置项（默认注释状态） ## 兼容性 - Docker 模式不受影响（使用独立的 docker-entrypoint.sh，走原有 --prefix 逻辑） - 未配置 PYTHON_VENV_DIR 时默认使用系统 Python（向后兼容）	2026-06-07 21:03:51 +08:00
copilot-swe-agent[bot]andwhyour	fcf0ee619b	Improve URL pattern matching and remove redundant checks Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>	2025-12-27 08:51:12 +00:00
copilot-swe-agent[bot]andwhyour	f3ec352066	Address code review feedback: improve pattern matching and error handling Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>	2025-12-27 08:49:41 +00:00
copilot-swe-agent[bot]andwhyour	023d0f1cc4	Fix pyproject.toml path handling and add error handling Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>	2025-12-27 08:46:12 +00:00
copilot-swe-agent[bot]andwhyour	f526d3f972	Add support for GitHub URLs and requirements files in Python dependencies Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>	2025-12-27 08:41:43 +00:00
copilot-swe-agent[bot]	e28f746294	Initial plan	2025-12-27 08:35:03 +00:00