Upgrade multer from 1.4.5-lts.1 to 2.1.1 to fix security vulnerabilities

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

.github/workflows/build-docker-image.yml

@@ -9,15 +9,13 @@ on:
       - "develop"
     tags:
       - "v*"
-  schedule:
-    - cron: "00 20 * * *"
   workflow_dispatch:
 
 jobs:
   code_gitlab:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - uses: Yikun/hub-mirror-action@master
@@ -32,7 +30,7 @@ jobs:
   code_gitee:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - uses: Yikun/hub-mirror-action@master
@@ -47,12 +45,12 @@ jobs:
   build-static:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v3
+      - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v4
         with:
           version: "8.3.1"
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           cache: "pnpm"
 
@@ -78,12 +76,12 @@ jobs:
           git config --local user.email 'github-actions[bot]@users.noreply.github.com'
           git commit --allow-empty -m "copy static at $(date +'%Y-%m-%d %H:%M:%S')"
           git push --force --quiet "https://${{ secrets.API_TOKEN }}@${GITHUB_REPO}.git" ${GITHUB_BRANCH}:${GITHUB_BRANCH}
-  
+
   static_gitlab:
     needs: build-static
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - uses: Yikun/hub-mirror-action@master
@@ -99,7 +97,7 @@ jobs:
     needs: build-static
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - uses: Yikun/hub-mirror-action@master
@@ -112,6 +110,7 @@ jobs:
           force_update: true
 
   build:
+    if: ${{ !startsWith(github.ref, 'refs/tags/') }}
     needs: build-static
 
     runs-on: ubuntu-22.04
@@ -121,14 +120,21 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v3
+      - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v4
         with:
           version: "8.3.1"
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           cache: "pnpm"
 
+      - name: Read version from version.yaml
+        id: version
+        run: |
+          VERSION=$(grep '^version:' version.yaml | awk '{print $2}')
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Version: $VERSION"
+
       - name: Setup timezone
         uses: szenius/set-timezone@v2.0
         with:
@@ -154,19 +160,13 @@ jobs:
           images: |
             ${{ github.repository }}
             ghcr.io/${{ github.repository }}
-          # generate Docker tags based on the following events/attributes
-          #   nightly, master, pr-2, 1.2.3, 1.2, 1
           flavor: |
             latest=false
           tags: |
-            type=schedule,pattern=nightly
-            type=edge
-            type=ref,event=pr
-            type=ref,event=branch,enable=${{ github.ref != format('refs/heads/{0}', 'master') }}
+            type=ref,event=branch,enable=${{ github.ref == format('refs/heads/{0}', 'develop') }}
             type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'master') }}
+            type=raw,value=${{ steps.version.outputs.version }},enable=${{ github.ref == format('refs/heads/{0}', 'master') }}
             type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -208,14 +208,21 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v3
+      - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v4
         with:
           version: "8.3.1"
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           cache: "pnpm"
 
+      - name: Read version from version.yaml
+        id: version
+        run: |
+          VERSION=$(grep '^version:' version.yaml | awk '{print $2}')
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Version: $VERSION"
+
       - name: Setup timezone
         uses: szenius/set-timezone@v2.0
         with:
@@ -254,7 +261,9 @@ jobs:
           context: .
           file: ./docker/310.Dockerfile
           push: true
-          tags: whyour/qinglong:python3.10
+          tags: |
+            whyour/qinglong:python3.10
+            whyour/qinglong:${{ steps.version.outputs.version }}-python3.10
           cache-from: type=registry,ref=whyour/qinglong:cache-python3.10
           cache-to: type=registry,ref=whyour/qinglong:cache-python3.10,mode=max
 

README-en.md

@@ -41,6 +41,8 @@ Timed task management platform supporting Python3, JavaScript, Shell, Typescript
 
 The `latest` image is built on `alpine` and the `debian` image is built on `debian-slim`. If you need to use a dependency that is not supported by `alpine`, it is recommended that you use the `debian` image.
 
+**⚠️ Important**: If you need to run Docker as a **non-root user**, please use the `debian` image. Alpine's `crond` requires root privileges.
+
 ```bash
 docker pull whyour/qinglong:latest
 docker pull whyour/qinglong:debian

README.md

@@ -43,6 +43,8 @@ Timed task management platform supporting Python3, JavaScript, Shell, Typescript
 
 `latest` 镜像是基于 `alpine` 构建，`debian` 镜像是基于 `debian-slim` 构建。如果需要使用 `alpine` 不支持的依赖，建议使用 `debian` 镜像
 
+**⚠️ 重要提示**: 如果您需要以**非 root 用户**运行 Docker，请使用 `debian` 镜像。Alpine 的 `crond` 需要 root 权限。
+
 ```bash
 docker pull whyour/qinglong:latest
 docker pull whyour/qinglong:debian

back/api/dependence.ts

@@ -16,7 +16,7 @@ export default (app: Router) => {
           searchValue: Joi.string().optional().allow(''),
           type: Joi.string().optional().allow(''),
           status: Joi.string().optional().allow(''),
-        }),
+        }).unknown(true),
     }),
     async (req: Request, res: Response, next: NextFunction) => {
       const logger: Logger = Container.get('logger');

back/api/env.ts

@@ -1,12 +1,12 @@
-import { Router, Request, Response, NextFunction } from 'express';
-import { Container } from 'typedi';
-import EnvService from '../services/env';
-import { Logger } from 'winston';
-import { celebrate, Joi } from 'celebrate';
-import multer from 'multer';
-import config from '../config';
+import { Joi, celebrate } from 'celebrate';
+import { NextFunction, Request, Response, Router } from 'express';
 import fs from 'fs';
+import multer from 'multer';
+import { Container } from 'typedi';
+import { Logger } from 'winston';
+import config from '../config';
 import { safeJSONParse } from '../config/util';
+import EnvService from '../services/env';
 const route = Router();
 
 const storage = multer.diskStorage({
@@ -196,6 +196,40 @@ export default (app: Router) => {
     },
   );
 
+  route.put(
+    '/pin',
+    celebrate({
+      body: Joi.array().items(Joi.number().required()),
+    }),
+    async (req: Request, res: Response, next: NextFunction) => {
+      const logger: Logger = Container.get('logger');
+      try {
+        const envService = Container.get(EnvService);
+        const data = await envService.pin(req.body);
+        return res.send({ code: 200, data });
+      } catch (e) {
+        return next(e);
+      }
+    },
+  );
+
+  route.put(
+    '/unpin',
+    celebrate({
+      body: Joi.array().items(Joi.number().required()),
+    }),
+    async (req: Request, res: Response, next: NextFunction) => {
+      const logger: Logger = Container.get('logger');
+      try {
+        const envService = Container.get(EnvService);
+        const data = await envService.unPin(req.body);
+        return res.send({ code: 200, data });
+      } catch (e) {
+        return next(e);
+      }
+    },
+  );
+
   route.post(
     '/upload',
     upload.single('env'),

back/api/script.ts

@@ -29,7 +29,7 @@ export default (app: Router) => {
     celebrate({
       query: Joi.object({
         path: Joi.string().optional().allow(''),
-      }),
+      }).unknown(true),
     }),
     async (req: Request, res: Response, next: NextFunction) => {
       const logger: Logger = Container.get('logger');
@@ -79,7 +79,7 @@ export default (app: Router) => {
       query: Joi.object({
         path: Joi.string().optional().allow(''),
         file: Joi.string().required(),
-      }),
+      }).unknown(true),
     }),
     async (req: Request, res: Response, next: NextFunction) => {
       try {
@@ -103,7 +103,7 @@ export default (app: Router) => {
       }),
       query: Joi.object({
         path: Joi.string().optional().allow(''),
-      }),
+      }).unknown(true),
     }),
     async (req: Request, res: Response, next: NextFunction) => {
       try {
@@ -129,7 +129,8 @@ export default (app: Router) => {
         content: Joi.string().optional().allow(''),
         originFilename: Joi.string().optional().allow(''),
         directory: Joi.string().optional().allow(''),
-      }),
+        file: Joi.string().optional().allow(''),
+      }).unknown(true),
     }),
     async (req: Request, res: Response, next: NextFunction) => {
       try {
@@ -175,6 +176,7 @@ export default (app: Router) => {
           path,
           `${originFilename.replace(/\//g, '')}`,
         );
+        await fs.mkdir(path, { recursive: true });
         const filePath = join(path, `${filename.replace(/\//g, '')}`);
         const fileExists = await fileExist(filePath);
         if (fileExists) {

back/api/subscription.ts

@@ -3,7 +3,7 @@ import { Container } from 'typedi';
 import { Logger } from 'winston';
 import SubscriptionService from '../services/subscription';
 import { celebrate, Joi } from 'celebrate';
-import cron_parser from 'cron-parser';
+import CronExpressionParser from 'cron-parser';
 const route = Router();
 
 export default (app: Router) => {
@@ -60,7 +60,7 @@ export default (app: Router) => {
       try {
         if (
           !req.body.schedule ||
-          cron_parser.parseExpression(req.body.schedule).hasNext()
+          CronExpressionParser.parse(req.body.schedule).hasNext()
         ) {
           const subscriptionService = Container.get(SubscriptionService);
           const data = await subscriptionService.create(req.body);
@@ -193,7 +193,7 @@ export default (app: Router) => {
         if (
           !req.body.schedule ||
           typeof req.body.schedule === 'object' ||
-          cron_parser.parseExpression(req.body.schedule).hasNext()
+          CronExpressionParser.parse(req.body.schedule).hasNext()
         ) {
           const subscriptionService = Container.get(SubscriptionService);
           const data = await subscriptionService.update(req.body);

back/api/system.ts

@@ -14,6 +14,7 @@ import {
 } from '../config/util';
 import dayjs from 'dayjs';
 import multer from 'multer';
+import { logStreamManager } from '../shared/logStreamManager';
 
 const route = Router();
 const storage = multer.diskStorage({
@@ -276,17 +277,19 @@ export default (app: Router) => {
               res.setHeader('QL-Task-Log', `${logPath}`);
             },
             onEnd: async (cp, endTime, diff) => {
+              // Close the stream after task completion
+              await logStreamManager.closeStream(await handleLogPath(logPath));
               res.end();
             },
             onError: async (message: string) => {
               res.write(message);
               const absolutePath = await handleLogPath(logPath);
-              await fs.appendFile(absolutePath, message);
+              await logStreamManager.write(absolutePath, message);
             },
             onLog: async (message: string) => {
               res.write(message);
               const absolutePath = await handleLogPath(logPath);
-              await fs.appendFile(absolutePath, message);
+              await logStreamManager.write(absolutePath, message);
             },
           },
         );
@@ -423,6 +426,24 @@ export default (app: Router) => {
     },
   );
 
+  route.put(
+    '/config/global-ssh-key',
+    celebrate({
+      body: Joi.object({
+        globalSshKey: Joi.string().allow('').allow(null),
+      }),
+    }),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const systemService = Container.get(SystemService);
+        const result = await systemService.updateGlobalSshKey(req.body);
+        res.send(result);
+      } catch (e) {
+        return next(e);
+      }
+    },
+  );
+
   route.put(
     '/config/dependence-clean',
     celebrate({

back/api/user.ts

@@ -8,7 +8,7 @@ import path from 'path';
 import { v4 as uuidV4 } from 'uuid';
 import rateLimit from 'express-rate-limit';
 import config from '../config';
-import { isDemoEnv } from '../config/util';
+import { isDemoEnv, getToken } from '../config/util';
 const route = Router();
 
 const storage = multer.diskStorage({
@@ -56,7 +56,8 @@ export default (app: Router) => {
       const logger: Logger = Container.get('logger');
       try {
         const userService = Container.get(UserService);
-        await userService.logout(req.platform);
+        const token = getToken(req);
+        await userService.logout(req.platform, token);
         res.send({ code: 200 });
       } catch (e) {
         return next(e);

back/app.ts

@@ -24,6 +24,7 @@ class Application {
   private grpcServerService?: GrpcServerService;
   private isShuttingDown = false;
   private workerMetadataMap = new Map<number, WorkerMetadata>();
+  private httpWorker?: Worker;
 
   constructor() {
     this.app = express();
@@ -53,21 +54,54 @@ class Application {
   }
 
   private startMasterProcess() {
-    this.forkWorker('http');
-    this.forkWorker('grpc');
+    // Fork gRPC worker first and wait for it to be ready
+    const grpcWorker = this.forkWorker('grpc');
+    
+    // Wait for gRPC worker to signal it's ready before starting HTTP worker
+    this.waitForWorkerReady(grpcWorker, 30000)
+      .then(() => {
+        Logger.info('✌️ gRPC worker is ready, starting HTTP worker');
+        this.httpWorker = this.forkWorker('http');
+      })
+      .catch((error) => {
+        Logger.error('✌️ Failed to wait for gRPC worker:', error);
+        process.exit(1);
+      });
 
     cluster.on('exit', (worker, code, signal) => {
       const metadata = this.workerMetadataMap.get(worker.id);
       if (metadata) {
         if (!this.isShuttingDown) {
           Logger.error(
-            `${metadata.serviceType} worker ${worker.process.pid} died (${signal || code
+            `✌️ ${metadata.serviceType} worker ${worker.process.pid} died (${signal || code
             }). Restarting...`,
           );
-          const newWorker = this.forkWorker(metadata.serviceType);
-          Logger.info(
-            `Restarted ${metadata.serviceType} worker (New PID: ${newWorker.process.pid})`,
-          );
+          // If gRPC worker died, restart it and wait for it to be ready
+          if (metadata.serviceType === 'grpc') {
+            const newGrpcWorker = this.forkWorker('grpc');
+            this.waitForWorkerReady(newGrpcWorker, 30000)
+              .then(() => {
+                Logger.info('✌️ gRPC worker restarted and ready');
+                // Re-register cron jobs by notifying the HTTP worker
+                if (this.httpWorker) {
+                  try {
+                    this.httpWorker.send('reregister-crons');
+                    Logger.info('✌️ Sent reregister-crons message to HTTP worker');
+                  } catch (error) {
+                    Logger.error('✌️ Failed to send reregister-crons message:', error);
+                  }
+                }
+              })
+              .catch((error) => {
+                Logger.error('✌️ Failed to restart gRPC worker:', error);
+                process.exit(1);
+              });
+          } else {
+            // For HTTP worker, just restart it
+            const newWorker = this.forkWorker(metadata.serviceType);
+            this.httpWorker = newWorker;
+            Logger.info(`✌️ Restarted ${metadata.serviceType} worker (PID: ${newWorker.process.pid})`);
+          }
         }
 
         this.workerMetadataMap.delete(worker.id);
@@ -77,6 +111,25 @@ class Application {
     this.setupMasterShutdown();
   }
 
+  private waitForWorkerReady(worker: Worker, timeoutMs: number): Promise<void> {
+    return new Promise<void>((resolve, reject) => {
+      const messageHandler = (msg: any) => {
+        if (msg === 'ready') {
+          worker.removeListener('message', messageHandler);
+          clearTimeout(timeoutId);
+          resolve();
+        }
+      };
+      worker.on('message', messageHandler);
+      
+      // Timeout after specified milliseconds
+      const timeoutId = setTimeout(() => {
+        worker.removeListener('message', messageHandler);
+        reject(new Error(`Worker failed to start within ${timeoutMs / 1000} seconds`));
+      }, timeoutMs);
+    });
+  }
+
   private forkWorker(serviceType: string): Worker {
     const worker = cluster.fork({ SERVICE_TYPE: serviceType });
 
@@ -116,7 +169,7 @@ class Application {
         if (worker) {
           const exitPromise = new Promise<void>((resolve) => {
             worker.once('exit', () => {
-              Logger.info(`Worker ${worker.process.pid} exited`);
+              Logger.info(`✌️ Worker ${worker.process.pid} exited`);
               resolve();
             });
 
@@ -124,7 +177,7 @@ class Application {
               worker.send('shutdown');
             } catch (error) {
               Logger.warn(
-                `Failed to send shutdown to worker ${worker.process.pid}:`,
+                `✌️ Failed to send shutdown to worker ${worker.process.pid}:`,
                 error,
               );
             }
@@ -139,14 +192,14 @@ class Application {
           Promise.all(workerPromises),
           new Promise<void>((resolve) => {
             setTimeout(() => {
-              Logger.warn('Worker shutdown timeout reached');
+              Logger.warn('✌️ Worker shutdown timeout reached');
               resolve();
             }, 10000);
           }),
         ]);
         process.exit(0);
       } catch (error) {
-        Logger.error('Error during worker shutdown:', error);
+        Logger.error('✌️ Error during worker shutdown:', error);
         process.exit(1);
       }
     };
@@ -158,7 +211,7 @@ class Application {
   private async startWorkerProcess() {
     const serviceType = process.env.SERVICE_TYPE;
     if (!serviceType || !['http', 'grpc'].includes(serviceType)) {
-      Logger.error('Invalid SERVICE_TYPE:', serviceType);
+      Logger.error('✌️ Invalid SERVICE_TYPE:', serviceType);
       process.exit(1);
     }
 
@@ -173,7 +226,7 @@ class Application {
 
       process.send?.('ready');
     } catch (error) {
-      Logger.error(`${serviceType} worker failed:`, error);
+      Logger.error(`✌️ ${serviceType} worker failed:`, error);
       process.exit(1);
     }
   }
@@ -206,9 +259,20 @@ class Application {
   }
 
   private setupWorkerShutdown(serviceType: string) {
-    process.on('message', (msg) => {
+    process.on('message', async (msg) => {
       if (msg === 'shutdown') {
         this.gracefulShutdown(serviceType);
+      } else if (msg === 'reregister-crons' && serviceType === 'http') {
+        // Re-register cron jobs when gRPC worker restarts
+        try {
+          Logger.info('✌️ Received reregister-crons message, re-registering cron jobs...');
+          const CronService = (await import('./services/cron')).default;
+          const cronService = Container.get(CronService);
+          await cronService.autosave_crontab();
+          Logger.info('✌️ Cron jobs re-registered successfully');
+        } catch (error) {
+          Logger.error('✌️ Failed to re-register cron jobs:', error);
+        }
       }
     });
 
@@ -229,7 +293,7 @@ class Application {
       }
       process.exit(0);
     } catch (error) {
-      Logger.error(`[${serviceType}] Error during shutdown:`, error);
+      Logger.error(`✌️ [${serviceType}] Error during shutdown:`, error);
       process.exit(1);
     }
   }
@@ -237,6 +301,6 @@ class Application {
 
 const app = new Application();
 app.start().catch((error) => {
-  Logger.error('Application failed to start:', error);
+  Logger.error('🙅‍♀️ Application failed to start:', error);
   process.exit(1);
 });

back/config/index.ts

@@ -64,6 +64,19 @@ if (!process.env.QL_DIR) {
 
 const lastVersionFile = `https://qn.whyour.cn/version.yaml`;
 
+// Get and normalize QlBaseUrl
+let baseUrl = process.env.QlBaseUrl || '';
+if (baseUrl) {
+  // Ensure it starts with /
+  if (!baseUrl.startsWith('/')) {
+    baseUrl = `/${baseUrl}`;
+  }
+  // Remove trailing slash for consistency in route definitions
+  if (baseUrl.endsWith('/')) {
+    baseUrl = baseUrl.slice(0, -1);
+  }
+}
+
 const rootPath = process.env.QL_DIR as string;
 const envFound = dotenv.config({ path: path.join(rootPath, '.env') });
 
@@ -116,6 +129,7 @@ if (envFound.error) {
 export default {
   ...config,
   jwt: config.jwt,
+  baseUrl,
   rootPath,
   tmpPath,
   dataPath,
@@ -176,4 +190,5 @@ export default {
   sshdPath,
   systemLogPath,
   dependenceCachePath,
+  maxTokensPerPlatform: 10, // Maximum number of concurrent sessions per platform
 };

back/config/util.ts

@@ -417,6 +417,27 @@ export async function getPid(cmd: string) {
   return pid ? Number(pid) : undefined;
 }
 
+export async function getAllPids(cmd: string): Promise<number[]> {
+  const taskCommand = `ps -eo pid,command | grep "${cmd}" | grep -v grep | awk '{print $1}'`;
+  const pidsStr = await promiseExec(taskCommand);
+  if (!pidsStr) return [];
+  return pidsStr
+    .split('\n')
+    .map((p) => Number(p.trim()))
+    .filter((p) => !isNaN(p) && p > 0);
+}
+
+export async function killAllTasks(cmd: string): Promise<void> {
+  const pids = await getAllPids(cmd);
+  for (const pid of pids) {
+    try {
+      await killTask(pid);
+    } catch (error) {
+      // Ignore errors if process already terminated
+    }
+  }
+}
+
 interface IVersion {
   version: string;
   changeLogLink: string;

back/data/cron.ts

@@ -21,6 +21,8 @@ export class Crontab {
   extra_schedules?: Array<{ schedule: string }>;
   task_before?: string;
   task_after?: string;
+  log_name?: string;
+  allow_multiple_instances?: 1 | 0;
 
   constructor(options: Crontab) {
     this.name = options.name;
@@ -45,6 +47,8 @@ export class Crontab {
     this.extra_schedules = options.extra_schedules;
     this.task_before = options.task_before;
     this.task_after = options.task_after;
+    this.log_name = options.log_name;
+    this.allow_multiple_instances = options.allow_multiple_instances || 0;
   }
 }
 
@@ -55,7 +59,7 @@ export enum CrontabStatus {
   'disabled',
 }
 
-export interface CronInstance extends Model<Crontab, Crontab>, Crontab { }
+export interface CronInstance extends Model<Crontab, Crontab>, Crontab {}
 export const CrontabModel = sequelize.define<CronInstance>('Crontab', {
   name: {
     unique: 'compositeIndex',
@@ -84,4 +88,6 @@ export const CrontabModel = sequelize.define<CronInstance>('Crontab', {
   extra_schedules: DataTypes.JSON,
   task_before: DataTypes.STRING,
   task_after: DataTypes.STRING,
+  log_name: DataTypes.STRING,
+  allow_multiple_instances: DataTypes.NUMBER,
 });

back/data/env.ts

@@ -1,5 +1,5 @@
+import { DataTypes, Model } from 'sequelize';
 import { sequelize } from '.';
-import { DataTypes, Model, ModelDefined } from 'sequelize';
 
 export class Env {
   value?: string;
@@ -9,6 +9,7 @@ export class Env {
   position?: number;
   name?: string;
   remarks?: string;
+  isPinned?: 1 | 0;
 
   constructor(options: Env) {
     this.value = options.value;
@@ -21,6 +22,7 @@ export class Env {
     this.position = options.position;
     this.name = options.name;
     this.remarks = options.remarks || '';
+    this.isPinned = options.isPinned || 0;
   }
 }
 
@@ -42,4 +44,5 @@ export const EnvModel = sequelize.define<EnvInstance>('Env', {
   position: DataTypes.NUMBER,
   name: { type: DataTypes.STRING, unique: 'compositeIndex' },
   remarks: DataTypes.STRING,
+  isPinned: DataTypes.NUMBER,
 });

back/data/notify.ts

@@ -142,6 +142,7 @@ export class WebhookNotification extends NotificationBaseInfo {
 
 export class LarkNotification extends NotificationBaseInfo {
   public larkKey = '';
+  public larkSecret = '';
 }
 
 export class NtfyNotification extends NotificationBaseInfo {

back/data/system.ts

@@ -38,6 +38,7 @@ export interface SystemConfigInfo {
   pythonMirror?: string;
   linuxMirror?: string;
   timezone?: string;
+  globalSshKey?: string;
 }
 
 export interface LoginLogInfo {
@@ -48,6 +49,19 @@ export interface LoginLogInfo {
   status?: LoginStatus;
 }
 
+export interface TokenInfo {
+  value: string;
+  timestamp: number;
+  ip: string;
+  address: string;
+  platform: string;
+  /**
+   * Token expiration time in seconds since Unix epoch.
+   * If undefined, the token uses JWT's built-in expiration.
+   */
+  expiration?: number;
+}
+
 export interface AuthInfo {
   username: string;
   password: string;
@@ -58,7 +72,7 @@ export interface AuthInfo {
   platform: string;
   isTwoFactorChecking: boolean;
   token: string;
-  tokens: Record<string, string>;
+  tokens: Record<string, string | TokenInfo[]>;
   twoFactorActivated: boolean;
   twoFactorSecret: string;
   avatar: string;

back/loaders/db.ts

@@ -19,43 +19,38 @@ export default async () => {
     await CrontabViewModel.sync();
 
     // 初始化新增字段
-    try {
-      await sequelize.query(
-        'alter table CrontabViews add column filterRelation VARCHAR(255)',
-      );
-    } catch (error) {}
-    try {
-      await sequelize.query(
-        'alter table Subscriptions add column proxy VARCHAR(255)',
-      );
-    } catch (error) {}
-    try {
-      await sequelize.query('alter table CrontabViews add column type NUMBER');
-    } catch (error) {}
-    try {
-      await sequelize.query(
-        'alter table Subscriptions add column autoAddCron NUMBER',
-      );
-    } catch (error) {}
-    try {
-      await sequelize.query(
-        'alter table Subscriptions add column autoDelCron NUMBER',
-      );
-    } catch (error) {}
-    try {
-      await sequelize.query('alter table Crontabs add column sub_id NUMBER');
-    } catch (error) {}
-    try {
-      await sequelize.query(
-        'alter table Crontabs add column extra_schedules JSON',
-      );
-    } catch (error) {}
-    try {
-      await sequelize.query('alter table Crontabs add column task_before TEXT');
-    } catch (error) {}
-    try {
-      await sequelize.query('alter table Crontabs add column task_after TEXT');
-    } catch (error) {}
+    const migrations = [
+      {
+        table: 'CrontabViews',
+        column: 'filterRelation',
+        type: 'VARCHAR(255)',
+      },
+      { table: 'Subscriptions', column: 'proxy', type: 'VARCHAR(255)' },
+      { table: 'CrontabViews', column: 'type', type: 'NUMBER' },
+      { table: 'Subscriptions', column: 'autoAddCron', type: 'NUMBER' },
+      { table: 'Subscriptions', column: 'autoDelCron', type: 'NUMBER' },
+      { table: 'Crontabs', column: 'sub_id', type: 'NUMBER' },
+      { table: 'Crontabs', column: 'extra_schedules', type: 'JSON' },
+      { table: 'Crontabs', column: 'task_before', type: 'TEXT' },
+      { table: 'Crontabs', column: 'task_after', type: 'TEXT' },
+      { table: 'Crontabs', column: 'log_name', type: 'VARCHAR(255)' },
+      {
+        table: 'Crontabs',
+        column: 'allow_multiple_instances',
+        type: 'NUMBER',
+      },
+      { table: 'Envs', column: 'isPinned', type: 'NUMBER' },
+    ];
+
+    for (const migration of migrations) {
+      try {
+        await sequelize.query(
+          `alter table ${migration.table} add column ${migration.column} ${migration.type}`,
+        );
+      } catch (error) {
+        // Column already exists or other error, continue
+      }
+    }
 
     Logger.info('✌️ DB loaded');
   } catch (error) {

back/loaders/deps.ts

@@ -1,8 +1,9 @@
 import path from 'path';
 import fs from 'fs/promises';
+import os from 'os';
 import chokidar from 'chokidar';
 import config from '../config/index';
-import { fileExist, promiseExec, rmPath } from '../config/util';
+import Logger from './logger';
 
 async function linkToNodeModule(src: string, dst?: string) {
   const target = path.join(config.rootPath, 'node_modules', dst || src);
@@ -17,8 +18,18 @@ async function linkToNodeModule(src: string, dst?: string) {
 }
 
 async function linkCommand() {
-  const commandPath = await promiseExec('which node');
-  const commandDir = path.dirname(commandPath);
+  const homeDir = os.homedir();
+  let userBinDir = path.join(homeDir, 'bin');
+
+  try {
+    await fs.mkdir(userBinDir, { recursive: true });
+    await linkCommandToDir(userBinDir);
+  } catch (error) {
+    Logger.error('Linking command failed:', error);
+  }
+}
+
+async function linkCommandToDir(commandDir: string) {
   const linkShell = [
     {
       src: 'update.sh',
@@ -42,6 +53,7 @@ async function linkCommand() {
         await fs.unlink(tmpTarget);
       }
     } catch (error) { }
+
     await fs.symlink(source, tmpTarget);
     await fs.rename(tmpTarget, target);
   }
@@ -58,6 +70,6 @@ export default async (src: string = 'deps') => {
   });
 
   watcher
-    .on('add', (path) => linkToNodeModule(src))
-    .on('change', (path) => linkToNodeModule(src));
+    .on('add', () => linkToNodeModule(src))
+    .on('change', () => linkToNodeModule(src));
 };

back/loaders/express.ts

@@ -9,11 +9,39 @@ import rewrite from 'express-urlrewrite';
 import { errors } from 'celebrate';
 import { serveEnv } from '../config/serverEnv';
 import { IKeyvStore, shareStore } from '../shared/store';
+import { isValidToken } from '../shared/auth';
 import path from 'path';
 
 export default ({ app }: { app: Application }) => {
+  // Security: Enable strict routing to prevent case-insensitive path bypass
+  app.set('case sensitive routing', true);
+  app.set('strict routing', true);
   app.set('trust proxy', 'loopback');
   app.use(cors());
+  
+  // Security: Path normalization middleware to prevent case variation attacks
+  app.use((req, res, next) => {
+    const originalPath = req.path;
+    const normalizedPath = originalPath.toLowerCase();
+    
+    // Block requests with case variations on protected paths
+    if (originalPath !== normalizedPath && 
+        (normalizedPath.startsWith('/api/') || normalizedPath.startsWith('/open/'))) {
+      return res.status(400).json({
+        code: 400,
+        message: 'Invalid path format'
+      });
+    }
+    
+    next();
+  });
+  
+  // Rewrite URLs to strip baseUrl prefix if configured
+  // This allows the rest of the app to work without baseUrl awareness
+  if (config.baseUrl) {
+    app.use(rewrite(`${config.baseUrl}/*`, '/$1'));
+  }
+  
   app.get(`${config.api.prefix}/env.js`, serveEnv);
   app.use(`${config.api.prefix}/static`, express.static(config.uploadPath));
 
@@ -28,7 +56,7 @@ export default ({ app }: { app: Application }) => {
       secret: config.jwt.secret,
       algorithms: ['HS384'],
     }).unless({
-      path: [...config.apiWhiteList, /^\/(?!api\/).*/],
+      path: [...config.apiWhiteList, /^(\/(?!api\/).*)$/i],
     }),
   );
 
@@ -43,19 +71,20 @@ export default ({ app }: { app: Application }) => {
   });
 
   app.use(async (req: Request, res, next) => {
-    if (!['/open/', '/api/'].some((x) => req.path.startsWith(x))) {
+    const pathLower = req.path.toLowerCase();
+    if (!['/open/', '/api/'].some((x) => pathLower.startsWith(x))) {
       return next();
     }
 
     const headerToken = getToken(req);
-    if (req.path.startsWith('/open/')) {
+    if (pathLower.startsWith('/open/')) {
       const apps = await shareStore.getApps();
       const doc = apps?.filter((x) =>
         x.tokens?.find((y) => y.value === headerToken),
       )?.[0];
       if (doc && doc.tokens && doc.tokens.length > 0) {
         const currentToken = doc.tokens.find((x) => x.value === headerToken);
-        const keyMatch = req.path.match(/\/open\/([a-z]+)\/*/);
+        const keyMatch = pathLower.match(/\/open\/([a-z]+)\/*/);
         const key = keyMatch && keyMatch[1];
         if (
           doc.scopes.includes(key as any) &&
@@ -77,11 +106,8 @@ export default ({ app }: { app: Application }) => {
     }
 
     const authInfo = await shareStore.getAuthInfo();
-    if (authInfo && headerToken) {
-      const { token = '', tokens = {} } = authInfo;
-      if (headerToken === token || tokens[req.platform] === headerToken) {
-        return next();
-      }
+    if (isValidToken(authInfo, headerToken, req.platform)) {
+      return next();
     }
 
     const errorCode = headerToken ? 'invalid_token' : 'credentials_required';
@@ -93,7 +119,15 @@ export default ({ app }: { app: Application }) => {
   });
 
   app.use(async (req, res, next) => {
-    if (!['/api/user/init', '/api/user/notification/init'].includes(req.path)) {
+    const pathLower = req.path.toLowerCase();
+    if (
+      ![
+        '/api/user/init',
+        '/api/user/notification/init',
+        '/open/user/init',
+        '/open/user/notification/init',
+      ].includes(req.path)
+    ) {
       return next();
     }
     const authInfo =

back/loaders/initData.ts

@@ -13,7 +13,7 @@ import { AuthDataType, SystemModel } from '../data/system';
 import SystemService from '../services/system';
 import UserService from '../services/user';
 import { writeFile, readFile } from 'fs/promises';
-import { createRandomString, fileExist, safeJSONParse } from '../config/util';
+import { createRandomString, fileExist, isDemoEnv, safeJSONParse } from '../config/util';
 import OpenService from '../services/open';
 import { shareStore } from '../shared/store';
 import Logger from './logger';
@@ -50,7 +50,7 @@ export default async () => {
   const [authConfig] = await SystemModel.findOrCreate({
     where: { type: AuthDataType.authConfig },
   });
-  if (!authConfig?.info) {
+  if (!authConfig?.info || isDemoEnv()) {
     let authInfo = {
       username: 'admin',
       password: 'admin',

back/loaders/initTask.ts

@@ -2,6 +2,7 @@ import { Container } from 'typedi';
 import SystemService from '../services/system';
 import ScheduleService, { ScheduleTaskType } from '../services/schedule';
 import SubscriptionService from '../services/subscription';
+import SshKeyService from '../services/sshKey';
 import config from '../config';
 import { fileExist } from '../config/util';
 import { join } from 'path';
@@ -10,6 +11,7 @@ export default async () => {
   const systemService = Container.get(SystemService);
   const scheduleService = Container.get(ScheduleService);
   const subscriptionService = Container.get(SubscriptionService);
+  const sshKeyService = Container.get(SshKeyService);
 
   // 生成内置token
   let tokenCommand = `ts-node-transpile-only ${join(
@@ -57,6 +59,11 @@ export default async () => {
     }
 
     systemService.updateTimezone(data.info);
+    
+    // Apply global SSH key if configured
+    if (data.info.globalSshKey) {
+      await sshKeyService.addGlobalSSHKey(data.info.globalSshKey, 'global');
+    }
   }
 
   await subscriptionService.setSshConfig();

back/loaders/sock.ts

@@ -4,9 +4,11 @@ import { Container } from 'typedi';
 import SockService from '../services/sock';
 import { getPlatform } from '../config/util';
 import { shareStore } from '../shared/store';
+import { isValidToken } from '../shared/auth';
+import config from '../config';
 
 export default async ({ server }: { server: Server }) => {
-  const echo = sockJs.createServer({ prefix: '/api/ws', log: () => {} });
+  const echo = sockJs.createServer({ prefix: `${config.baseUrl}/api/ws`, log: () => { } });
   const sockService = Container.get(SockService);
 
   echo.on('connection', async (conn) => {
@@ -17,21 +19,19 @@ export default async ({ server }: { server: Server }) => {
     const authInfo = await shareStore.getAuthInfo();
     const platform = getPlatform(conn.headers['user-agent'] || '') || 'desktop';
     const headerToken = conn.url.replace(`${conn.pathname}?token=`, '');
-    if (authInfo) {
-      const { token = '', tokens = {} } = authInfo;
-      if (headerToken === token || tokens[platform] === headerToken) {
-        sockService.addClient(conn);
 
-        conn.on('data', (message) => {
-          conn.write(message);
-        });
+    if (isValidToken(authInfo, headerToken, platform)) {
+      sockService.addClient(conn);
 
-        conn.on('close', function () {
-          sockService.removeClient(conn);
-        });
+      conn.on('data', (message) => {
+        conn.write(message);
+      });
 
-        return;
-      }
+      conn.on('close', function () {
+        sockService.removeClient(conn);
+      });
+
+      return;
     }
 
     conn.close('404');

back/protos/api.proto

@@ -97,6 +97,18 @@ message UpdateCronRequest {
 
 message DeleteCronsRequest { repeated int32 ids = 1; }
 
+message GetCronsRequest {
+  optional string searchValue = 1;
+}
+
+message GetCronByIdRequest { int32 id = 1; }
+
+message EnableCronsRequest { repeated int32 ids = 1; }
+
+message DisableCronsRequest { repeated int32 ids = 1; }
+
+message RunCronsRequest { repeated int32 ids = 1; }
+
 message CronsResponse {
   int32 code = 1;
   repeated CronItem data = 2;
@@ -219,6 +231,7 @@ message NotificationInfo {
   optional string webhookContentType = 57;
 
   optional string larkKey = 58;
+  optional string larkSecret = 69;
 
   optional string ntfyUrl = 59;
   optional string ntfyTopic = 60;
@@ -254,4 +267,9 @@ service Api {
   rpc CreateCron(CreateCronRequest) returns (CronResponse) {}
   rpc UpdateCron(UpdateCronRequest) returns (CronResponse) {}
   rpc DeleteCrons(DeleteCronsRequest) returns (Response) {}
+  rpc GetCrons(GetCronsRequest) returns (CronsResponse) {}
+  rpc GetCronById(GetCronByIdRequest) returns (CronResponse) {}
+  rpc EnableCrons(EnableCronsRequest) returns (Response) {}
+  rpc DisableCrons(DisableCronsRequest) returns (Response) {}
+  rpc RunCrons(RunCronsRequest) returns (Response) {}
 }

back/protos/api.ts

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
 //   protoc-gen-ts_proto  v2.6.1
-//   protoc               v3.17.3
+//   protoc               v3.21.12
 // source: back/protos/api.proto
 
 /* eslint-disable */
@@ -281,6 +281,26 @@ export interface DeleteCronsRequest {
   ids: number[];
 }
 
+export interface GetCronsRequest {
+  searchValue?: string | undefined;
+}
+
+export interface GetCronByIdRequest {
+  id: number;
+}
+
+export interface EnableCronsRequest {
+  ids: number[];
+}
+
+export interface DisableCronsRequest {
+  ids: number[];
+}
+
+export interface RunCronsRequest {
+  ids: number[];
+}
+
 export interface CronsResponse {
   code: number;
   data: CronItem[];
@@ -362,6 +382,7 @@ export interface NotificationInfo {
   webhookMethod?: string | undefined;
   webhookContentType?: string | undefined;
   larkKey?: string | undefined;
+  larkSecret?: string | undefined;
   ntfyUrl?: string | undefined;
   ntfyTopic?: string | undefined;
   ntfyPriority?: string | undefined;
@@ -2207,6 +2228,332 @@ export const DeleteCronsRequest: MessageFns<DeleteCronsRequest> = {
   },
 };
 
+function createBaseGetCronsRequest(): GetCronsRequest {
+  return { searchValue: undefined };
+}
+
+export const GetCronsRequest: MessageFns<GetCronsRequest> = {
+  encode(message: GetCronsRequest, writer: BinaryWriter = new BinaryWriter()): BinaryWriter {
+    if (message.searchValue !== undefined) {
+      writer.uint32(10).string(message.searchValue);
+    }
+    return writer;
+  },
+
+  decode(input: BinaryReader | Uint8Array, length?: number): GetCronsRequest {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === undefined ? reader.len : reader.pos + length;
+    const message = createBaseGetCronsRequest();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 10) {
+            break;
+          }
+
+          message.searchValue = reader.string();
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+
+  fromJSON(object: any): GetCronsRequest {
+    return { searchValue: isSet(object.searchValue) ? globalThis.String(object.searchValue) : undefined };
+  },
+
+  toJSON(message: GetCronsRequest): unknown {
+    const obj: any = {};
+    if (message.searchValue !== undefined) {
+      obj.searchValue = message.searchValue;
+    }
+    return obj;
+  },
+
+  create<I extends Exact<DeepPartial<GetCronsRequest>, I>>(base?: I): GetCronsRequest {
+    return GetCronsRequest.fromPartial(base ?? ({} as any));
+  },
+  fromPartial<I extends Exact<DeepPartial<GetCronsRequest>, I>>(object: I): GetCronsRequest {
+    const message = createBaseGetCronsRequest();
+    message.searchValue = object.searchValue ?? undefined;
+    return message;
+  },
+};
+
+function createBaseGetCronByIdRequest(): GetCronByIdRequest {
+  return { id: 0 };
+}
+
+export const GetCronByIdRequest: MessageFns<GetCronByIdRequest> = {
+  encode(message: GetCronByIdRequest, writer: BinaryWriter = new BinaryWriter()): BinaryWriter {
+    if (message.id !== 0) {
+      writer.uint32(8).int32(message.id);
+    }
+    return writer;
+  },
+
+  decode(input: BinaryReader | Uint8Array, length?: number): GetCronByIdRequest {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === undefined ? reader.len : reader.pos + length;
+    const message = createBaseGetCronByIdRequest();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 8) {
+            break;
+          }
+
+          message.id = reader.int32();
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+
+  fromJSON(object: any): GetCronByIdRequest {
+    return { id: isSet(object.id) ? globalThis.Number(object.id) : 0 };
+  },
+
+  toJSON(message: GetCronByIdRequest): unknown {
+    const obj: any = {};
+    if (message.id !== 0) {
+      obj.id = Math.round(message.id);
+    }
+    return obj;
+  },
+
+  create<I extends Exact<DeepPartial<GetCronByIdRequest>, I>>(base?: I): GetCronByIdRequest {
+    return GetCronByIdRequest.fromPartial(base ?? ({} as any));
+  },
+  fromPartial<I extends Exact<DeepPartial<GetCronByIdRequest>, I>>(object: I): GetCronByIdRequest {
+    const message = createBaseGetCronByIdRequest();
+    message.id = object.id ?? 0;
+    return message;
+  },
+};
+
+function createBaseEnableCronsRequest(): EnableCronsRequest {
+  return { ids: [] };
+}
+
+export const EnableCronsRequest: MessageFns<EnableCronsRequest> = {
+  encode(message: EnableCronsRequest, writer: BinaryWriter = new BinaryWriter()): BinaryWriter {
+    writer.uint32(10).fork();
+    for (const v of message.ids) {
+      writer.int32(v);
+    }
+    writer.join();
+    return writer;
+  },
+
+  decode(input: BinaryReader | Uint8Array, length?: number): EnableCronsRequest {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === undefined ? reader.len : reader.pos + length;
+    const message = createBaseEnableCronsRequest();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag === 8) {
+            message.ids.push(reader.int32());
+
+            continue;
+          }
+
+          if (tag === 10) {
+            const end2 = reader.uint32() + reader.pos;
+            while (reader.pos < end2) {
+              message.ids.push(reader.int32());
+            }
+
+            continue;
+          }
+
+          break;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+
+  fromJSON(object: any): EnableCronsRequest {
+    return { ids: globalThis.Array.isArray(object?.ids) ? object.ids.map((e: any) => globalThis.Number(e)) : [] };
+  },
+
+  toJSON(message: EnableCronsRequest): unknown {
+    const obj: any = {};
+    if (message.ids?.length) {
+      obj.ids = message.ids.map((e) => Math.round(e));
+    }
+    return obj;
+  },
+
+  create<I extends Exact<DeepPartial<EnableCronsRequest>, I>>(base?: I): EnableCronsRequest {
+    return EnableCronsRequest.fromPartial(base ?? ({} as any));
+  },
+  fromPartial<I extends Exact<DeepPartial<EnableCronsRequest>, I>>(object: I): EnableCronsRequest {
+    const message = createBaseEnableCronsRequest();
+    message.ids = object.ids?.map((e) => e) || [];
+    return message;
+  },
+};
+
+function createBaseDisableCronsRequest(): DisableCronsRequest {
+  return { ids: [] };
+}
+
+export const DisableCronsRequest: MessageFns<DisableCronsRequest> = {
+  encode(message: DisableCronsRequest, writer: BinaryWriter = new BinaryWriter()): BinaryWriter {
+    writer.uint32(10).fork();
+    for (const v of message.ids) {
+      writer.int32(v);
+    }
+    writer.join();
+    return writer;
+  },
+
+  decode(input: BinaryReader | Uint8Array, length?: number): DisableCronsRequest {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === undefined ? reader.len : reader.pos + length;
+    const message = createBaseDisableCronsRequest();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag === 8) {
+            message.ids.push(reader.int32());
+
+            continue;
+          }
+
+          if (tag === 10) {
+            const end2 = reader.uint32() + reader.pos;
+            while (reader.pos < end2) {
+              message.ids.push(reader.int32());
+            }
+
+            continue;
+          }
+
+          break;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+
+  fromJSON(object: any): DisableCronsRequest {
+    return { ids: globalThis.Array.isArray(object?.ids) ? object.ids.map((e: any) => globalThis.Number(e)) : [] };
+  },
+
+  toJSON(message: DisableCronsRequest): unknown {
+    const obj: any = {};
+    if (message.ids?.length) {
+      obj.ids = message.ids.map((e) => Math.round(e));
+    }
+    return obj;
+  },
+
+  create<I extends Exact<DeepPartial<DisableCronsRequest>, I>>(base?: I): DisableCronsRequest {
+    return DisableCronsRequest.fromPartial(base ?? ({} as any));
+  },
+  fromPartial<I extends Exact<DeepPartial<DisableCronsRequest>, I>>(object: I): DisableCronsRequest {
+    const message = createBaseDisableCronsRequest();
+    message.ids = object.ids?.map((e) => e) || [];
+    return message;
+  },
+};
+
+function createBaseRunCronsRequest(): RunCronsRequest {
+  return { ids: [] };
+}
+
+export const RunCronsRequest: MessageFns<RunCronsRequest> = {
+  encode(message: RunCronsRequest, writer: BinaryWriter = new BinaryWriter()): BinaryWriter {
+    writer.uint32(10).fork();
+    for (const v of message.ids) {
+      writer.int32(v);
+    }
+    writer.join();
+    return writer;
+  },
+
+  decode(input: BinaryReader | Uint8Array, length?: number): RunCronsRequest {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === undefined ? reader.len : reader.pos + length;
+    const message = createBaseRunCronsRequest();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag === 8) {
+            message.ids.push(reader.int32());
+
+            continue;
+          }
+
+          if (tag === 10) {
+            const end2 = reader.uint32() + reader.pos;
+            while (reader.pos < end2) {
+              message.ids.push(reader.int32());
+            }
+
+            continue;
+          }
+
+          break;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+
+  fromJSON(object: any): RunCronsRequest {
+    return { ids: globalThis.Array.isArray(object?.ids) ? object.ids.map((e: any) => globalThis.Number(e)) : [] };
+  },
+
+  toJSON(message: RunCronsRequest): unknown {
+    const obj: any = {};
+    if (message.ids?.length) {
+      obj.ids = message.ids.map((e) => Math.round(e));
+    }
+    return obj;
+  },
+
+  create<I extends Exact<DeepPartial<RunCronsRequest>, I>>(base?: I): RunCronsRequest {
+    return RunCronsRequest.fromPartial(base ?? ({} as any));
+  },
+  fromPartial<I extends Exact<DeepPartial<RunCronsRequest>, I>>(object: I): RunCronsRequest {
+    const message = createBaseRunCronsRequest();
+    message.ids = object.ids?.map((e) => e) || [];
+    return message;
+  },
+};
+
 function createBaseCronsResponse(): CronsResponse {
   return { code: 0, data: [], message: undefined };
 }
@@ -2601,6 +2948,7 @@ function createBaseNotificationInfo(): NotificationInfo {
     webhookMethod: undefined,
     webhookContentType: undefined,
     larkKey: undefined,
+    larkSecret: undefined,
     ntfyUrl: undefined,
     ntfyTopic: undefined,
     ntfyPriority: undefined,
@@ -2790,6 +3138,9 @@ export const NotificationInfo: MessageFns<NotificationInfo> = {
     if (message.larkKey !== undefined) {
       writer.uint32(466).string(message.larkKey);
     }
+    if (message.larkSecret !== undefined) {
+      writer.uint32(554).string(message.larkSecret);
+    }
     if (message.ntfyUrl !== undefined) {
       writer.uint32(474).string(message.ntfyUrl);
     }
@@ -3294,6 +3645,14 @@ export const NotificationInfo: MessageFns<NotificationInfo> = {
           message.larkKey = reader.string();
           continue;
         }
+        case 69: {
+          if (tag !== 554) {
+            break;
+          }
+
+          message.larkSecret = reader.string();
+          continue;
+        }
         case 59: {
           if (tag !== 474) {
             break;
@@ -3451,6 +3810,7 @@ export const NotificationInfo: MessageFns<NotificationInfo> = {
       webhookMethod: isSet(object.webhookMethod) ? globalThis.String(object.webhookMethod) : undefined,
       webhookContentType: isSet(object.webhookContentType) ? globalThis.String(object.webhookContentType) : undefined,
       larkKey: isSet(object.larkKey) ? globalThis.String(object.larkKey) : undefined,
+      larkSecret: isSet(object.larkSecret) ? globalThis.String(object.larkSecret) : undefined,
       ntfyUrl: isSet(object.ntfyUrl) ? globalThis.String(object.ntfyUrl) : undefined,
       ntfyTopic: isSet(object.ntfyTopic) ? globalThis.String(object.ntfyTopic) : undefined,
       ntfyPriority: isSet(object.ntfyPriority) ? globalThis.String(object.ntfyPriority) : undefined,
@@ -3644,6 +4004,9 @@ export const NotificationInfo: MessageFns<NotificationInfo> = {
     if (message.larkKey !== undefined) {
       obj.larkKey = message.larkKey;
     }
+    if (message.larkSecret !== undefined) {
+      obj.larkSecret = message.larkSecret;
+    }
     if (message.ntfyUrl !== undefined) {
       obj.ntfyUrl = message.ntfyUrl;
     }
@@ -3740,6 +4103,7 @@ export const NotificationInfo: MessageFns<NotificationInfo> = {
     message.webhookMethod = object.webhookMethod ?? undefined;
     message.webhookContentType = object.webhookContentType ?? undefined;
     message.larkKey = object.larkKey ?? undefined;
+    message.larkSecret = object.larkSecret ?? undefined;
     message.ntfyUrl = object.ntfyUrl ?? undefined;
     message.ntfyTopic = object.ntfyTopic ?? undefined;
     message.ntfyPriority = object.ntfyPriority ?? undefined;
@@ -3976,6 +4340,51 @@ export const ApiService = {
     responseSerialize: (value: Response) => Buffer.from(Response.encode(value).finish()),
     responseDeserialize: (value: Buffer) => Response.decode(value),
   },
+  getCrons: {
+    path: "/com.ql.api.Api/GetCrons",
+    requestStream: false,
+    responseStream: false,
+    requestSerialize: (value: GetCronsRequest) => Buffer.from(GetCronsRequest.encode(value).finish()),
+    requestDeserialize: (value: Buffer) => GetCronsRequest.decode(value),
+    responseSerialize: (value: CronsResponse) => Buffer.from(CronsResponse.encode(value).finish()),
+    responseDeserialize: (value: Buffer) => CronsResponse.decode(value),
+  },
+  getCronById: {
+    path: "/com.ql.api.Api/GetCronById",
+    requestStream: false,
+    responseStream: false,
+    requestSerialize: (value: GetCronByIdRequest) => Buffer.from(GetCronByIdRequest.encode(value).finish()),
+    requestDeserialize: (value: Buffer) => GetCronByIdRequest.decode(value),
+    responseSerialize: (value: CronResponse) => Buffer.from(CronResponse.encode(value).finish()),
+    responseDeserialize: (value: Buffer) => CronResponse.decode(value),
+  },
+  enableCrons: {
+    path: "/com.ql.api.Api/EnableCrons",
+    requestStream: false,
+    responseStream: false,
+    requestSerialize: (value: EnableCronsRequest) => Buffer.from(EnableCronsRequest.encode(value).finish()),
+    requestDeserialize: (value: Buffer) => EnableCronsRequest.decode(value),
+    responseSerialize: (value: Response) => Buffer.from(Response.encode(value).finish()),
+    responseDeserialize: (value: Buffer) => Response.decode(value),
+  },
+  disableCrons: {
+    path: "/com.ql.api.Api/DisableCrons",
+    requestStream: false,
+    responseStream: false,
+    requestSerialize: (value: DisableCronsRequest) => Buffer.from(DisableCronsRequest.encode(value).finish()),
+    requestDeserialize: (value: Buffer) => DisableCronsRequest.decode(value),
+    responseSerialize: (value: Response) => Buffer.from(Response.encode(value).finish()),
+    responseDeserialize: (value: Buffer) => Response.decode(value),
+  },
+  runCrons: {
+    path: "/com.ql.api.Api/RunCrons",
+    requestStream: false,
+    responseStream: false,
+    requestSerialize: (value: RunCronsRequest) => Buffer.from(RunCronsRequest.encode(value).finish()),
+    requestDeserialize: (value: Buffer) => RunCronsRequest.decode(value),
+    responseSerialize: (value: Response) => Buffer.from(Response.encode(value).finish()),
+    responseDeserialize: (value: Buffer) => Response.decode(value),
+  },
 } as const;
 
 export interface ApiServer extends UntypedServiceImplementation {
@@ -3993,6 +4402,11 @@ export interface ApiServer extends UntypedServiceImplementation {
   createCron: handleUnaryCall<CreateCronRequest, CronResponse>;
   updateCron: handleUnaryCall<UpdateCronRequest, CronResponse>;
   deleteCrons: handleUnaryCall<DeleteCronsRequest, Response>;
+  getCrons: handleUnaryCall<GetCronsRequest, CronsResponse>;
+  getCronById: handleUnaryCall<GetCronByIdRequest, CronResponse>;
+  enableCrons: handleUnaryCall<EnableCronsRequest, Response>;
+  disableCrons: handleUnaryCall<DisableCronsRequest, Response>;
+  runCrons: handleUnaryCall<RunCronsRequest, Response>;
 }
 
 export interface ApiClient extends Client {
@@ -4206,6 +4620,81 @@ export interface ApiClient extends Client {
     options: Partial<CallOptions>,
     callback: (error: ServiceError | null, response: Response) => void,
   ): ClientUnaryCall;
+  getCrons(
+    request: GetCronsRequest,
+    callback: (error: ServiceError | null, response: CronsResponse) => void,
+  ): ClientUnaryCall;
+  getCrons(
+    request: GetCronsRequest,
+    metadata: Metadata,
+    callback: (error: ServiceError | null, response: CronsResponse) => void,
+  ): ClientUnaryCall;
+  getCrons(
+    request: GetCronsRequest,
+    metadata: Metadata,
+    options: Partial<CallOptions>,
+    callback: (error: ServiceError | null, response: CronsResponse) => void,
+  ): ClientUnaryCall;
+  getCronById(
+    request: GetCronByIdRequest,
+    callback: (error: ServiceError | null, response: CronResponse) => void,
+  ): ClientUnaryCall;
+  getCronById(
+    request: GetCronByIdRequest,
+    metadata: Metadata,
+    callback: (error: ServiceError | null, response: CronResponse) => void,
+  ): ClientUnaryCall;
+  getCronById(
+    request: GetCronByIdRequest,
+    metadata: Metadata,
+    options: Partial<CallOptions>,
+    callback: (error: ServiceError | null, response: CronResponse) => void,
+  ): ClientUnaryCall;
+  enableCrons(
+    request: EnableCronsRequest,
+    callback: (error: ServiceError | null, response: Response) => void,
+  ): ClientUnaryCall;
+  enableCrons(
+    request: EnableCronsRequest,
+    metadata: Metadata,
+    callback: (error: ServiceError | null, response: Response) => void,
+  ): ClientUnaryCall;
+  enableCrons(
+    request: EnableCronsRequest,
+    metadata: Metadata,
+    options: Partial<CallOptions>,
+    callback: (error: ServiceError | null, response: Response) => void,
+  ): ClientUnaryCall;
+  disableCrons(
+    request: DisableCronsRequest,
+    callback: (error: ServiceError | null, response: Response) => void,
+  ): ClientUnaryCall;
+  disableCrons(
+    request: DisableCronsRequest,
+    metadata: Metadata,
+    callback: (error: ServiceError | null, response: Response) => void,
+  ): ClientUnaryCall;
+  disableCrons(
+    request: DisableCronsRequest,
+    metadata: Metadata,
+    options: Partial<CallOptions>,
+    callback: (error: ServiceError | null, response: Response) => void,
+  ): ClientUnaryCall;
+  runCrons(
+    request: RunCronsRequest,
+    callback: (error: ServiceError | null, response: Response) => void,
+  ): ClientUnaryCall;
+  runCrons(
+    request: RunCronsRequest,
+    metadata: Metadata,
+    callback: (error: ServiceError | null, response: Response) => void,
+  ): ClientUnaryCall;
+  runCrons(
+    request: RunCronsRequest,
+    metadata: Metadata,
+    options: Partial<CallOptions>,
+    callback: (error: ServiceError | null, response: Response) => void,
+  ): ClientUnaryCall;
 }
 
 export const ApiClient = makeGenericClientConstructor(ApiService, "com.ql.api.Api") as unknown as {

back/protos/cron.ts

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
 //   protoc-gen-ts_proto  v2.6.1
-//   protoc               v3.17.3
+//   protoc               v3.21.12
 // source: back/protos/cron.proto
 
 /* eslint-disable */

back/protos/health.ts

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
 //   protoc-gen-ts_proto  v2.6.1
-//   protoc               v3.17.3
+//   protoc               v3.21.12
 // source: back/protos/health.proto
 
 /* eslint-disable */

back/schedule/api.ts

@@ -30,6 +30,12 @@ import {
   UpdateCronRequest,
   DeleteCronsRequest,
   CronResponse,
+  GetCronsRequest,
+  CronsResponse,
+  GetCronByIdRequest,
+  EnableCronsRequest,
+  DisableCronsRequest,
+  RunCronsRequest,
 } from '../protos/api';
 import { NotificationInfo } from '../data/notify';
 
@@ -323,3 +329,116 @@ export const deleteCrons = async (
     callback(e);
   }
 };
+
+export const getCrons = async (
+  call: ServerUnaryCall<GetCronsRequest, CronsResponse>,
+  callback: sendUnaryData<CronsResponse>,
+) => {
+  try {
+    const cronService = Container.get(CronService);
+    const result = await cronService.crontabs({
+      searchValue: call.request.searchValue || '',
+      page: '0',
+      size: '0',
+      sorter: '',
+      filters: '',
+      queryString: '',
+    });
+    const data = result.data.map((x) => normalizeCronData(x as CronItem));
+    callback(null, {
+      code: 200,
+      data: data.filter((x): x is CronItem => x !== undefined),
+    });
+  } catch (e: any) {
+    callback(null, {
+      code: 500,
+      data: [],
+      message: e.message,
+    });
+  }
+};
+
+export const getCronById = async (
+  call: ServerUnaryCall<GetCronByIdRequest, CronResponse>,
+  callback: sendUnaryData<CronResponse>,
+) => {
+  try {
+    if (!call.request.id) {
+      return callback(null, {
+        code: 400,
+        data: undefined,
+        message: 'id parameter is required',
+      });
+    }
+
+    const cronService = Container.get(CronService);
+    const data = (await cronService.getDb({ id: call.request.id })) as CronItem;
+    callback(null, { code: 200, data: normalizeCronData(data) });
+  } catch (e: any) {
+    callback(null, {
+      code: 404,
+      data: undefined,
+      message: e.message,
+    });
+  }
+};
+
+export const enableCrons = async (
+  call: ServerUnaryCall<EnableCronsRequest, Response>,
+  callback: sendUnaryData<Response>,
+) => {
+  try {
+    if (!call.request.ids || call.request.ids.length === 0) {
+      return callback(null, {
+        code: 400,
+        message: 'ids parameter is required',
+      });
+    }
+
+    const cronService = Container.get(CronService);
+    await cronService.enabled(call.request.ids);
+    callback(null, { code: 200 });
+  } catch (e: any) {
+    callback(e);
+  }
+};
+
+export const disableCrons = async (
+  call: ServerUnaryCall<DisableCronsRequest, Response>,
+  callback: sendUnaryData<Response>,
+) => {
+  try {
+    if (!call.request.ids || call.request.ids.length === 0) {
+      return callback(null, {
+        code: 400,
+        message: 'ids parameter is required',
+      });
+    }
+
+    const cronService = Container.get(CronService);
+    await cronService.disabled(call.request.ids);
+    callback(null, { code: 200 });
+  } catch (e: any) {
+    callback(e);
+  }
+};
+
+export const runCrons = async (
+  call: ServerUnaryCall<RunCronsRequest, Response>,
+  callback: sendUnaryData<Response>,
+) => {
+  try {
+    if (!call.request.ids || call.request.ids.length === 0) {
+      return callback(null, {
+        code: 400,
+        message: 'ids parameter is required',
+      });
+    }
+
+    const cronService = Container.get(CronService);
+    await cronService.run(call.request.ids);
+    callback(null, { code: 200 });
+  } catch (e: any) {
+    callback(e);
+  }
+};

back/schedule/health.ts

@@ -17,14 +17,11 @@ const check = async (
         return callback(null, { status: 1 });
       }
 
-      const panelErrLog = await promiseExec(
-        `tail -n 300 ~/.pm2/logs/panel-error.log`,
-      );
-      const scheduleErrLog = await promiseExec(
-        `tail -n 300 ~/.pm2/logs/schedule-error.log`,
+      const qinglongErrLog = await promiseExec(
+        `tail -n 300 ~/.pm2/logs/qinglong-error.log`,
       );
       return callback(
-        new Error(`${scheduleErrLog || ''}\n${panelErrLog || ''}\n${res}`.trim()),
+        new Error(`${qinglongErrLog || ''}\n${res}`.trim()),
       );
 
     default:

back/services/cron.ts

@@ -4,11 +4,12 @@ import config from '../config';
 import { Crontab, CrontabModel, CrontabStatus } from '../data/cron';
 import { exec, execSync } from 'child_process';
 import fs from 'fs/promises';
-import cron_parser from 'cron-parser';
+import CronExpressionParser from 'cron-parser';
 import {
   getFileContentByName,
   fileExist,
   killTask,
+  killAllTasks,
   getUniqPath,
   safeJSONParse,
   isDemoEnv,
@@ -24,10 +25,11 @@ import pickBy from 'lodash/pickBy';
 import omit from 'lodash/omit';
 import { writeFileWithLock } from '../shared/utils';
 import { ScheduleType } from '../interface/schedule';
+import { logStreamManager } from '../shared/logStreamManager';
 
 @Service()
 export default class CronService {
-  constructor(@Inject('logger') private logger: winston.Logger) {}
+  constructor(@Inject('logger') private logger: winston.Logger) { }
 
   private isNodeCron(cron: Crontab) {
     const { schedule, extra_schedules } = cron;
@@ -49,9 +51,29 @@ export default class CronService {
     return this.isOnceSchedule(schedule) || this.isBootSchedule(schedule);
   }
 
+  private async getLogName(cron: Crontab) {
+    const { log_name, command, id } = cron;
+    if (log_name === '/dev/null') {
+      return log_name;
+    }
+    let uniqPath = await getUniqPath(command, `${id}`);
+    if (log_name) {
+      const normalizedLogName = log_name.startsWith('/')
+        ? log_name
+        : path.join(config.logPath, log_name);
+      if (normalizedLogName.startsWith(config.logPath)) {
+        uniqPath = log_name;
+      }
+    }
+    const logDirPath = path.resolve(config.logPath, `${uniqPath}`);
+    await fs.mkdir(logDirPath, { recursive: true });
+    return uniqPath;
+  }
+
   public async create(payload: Crontab): Promise<Crontab> {
     const tab = new Crontab(payload);
     tab.saved = false;
+    tab.log_name = await this.getLogName(tab);
     const doc = await this.insert(tab);
 
     if (isDemoEnv()) {
@@ -82,6 +104,7 @@ export default class CronService {
     const doc = await this.getDb({ id: payload.id });
     const tab = new Crontab({ ...doc, ...payload });
     tab.saved = false;
+    tab.log_name = await this.getLogName(tab);
     const newDoc = await this.updateDb(tab);
 
     if (doc.isDisabled === 1 || isDemoEnv()) {
@@ -142,7 +165,7 @@ export default class CronService {
       let cron;
       try {
         cron = await this.getDb({ id });
-      } catch (err) {}
+      } catch (err) { }
       if (!cron) {
         continue;
       }
@@ -442,12 +465,20 @@ export default class CronService {
   public async stop(ids: number[]) {
     const docs = await CrontabModel.findAll({ where: { id: ids } });
     for (const doc of docs) {
-      if (doc.pid) {
-        try {
+      // Kill all running instances of this task
+      try {
+        if (doc.pid) {
           await killTask(doc.pid);
-        } catch (error) {
-          this.logger.error(error);
         }
+        const command = doc.command.replace(/\s+/g, ' ').trim();
+        await killAllTasks(command);
+        this.logger.info(
+          `[panel][停止所有运行中的任务实例] 任务ID: ${doc.id}, 命令: ${command}`,
+        );
+      } catch (error) {
+        this.logger.error(
+          `[panel][停止任务失败] 任务ID: ${doc.id}, 错误: ${error}`,
+        );
       }
     }
 
@@ -476,13 +507,15 @@ export default class CronService {
           `[panel][开始执行任务] 参数: ${JSON.stringify(params)}`,
         );
 
-        let { id, command, log_path } = cron;
-        const uniqPath = await getUniqPath(command, `${id}`);
+        let { id, command, log_name } = cron;
+
+        const uniqPath =
+          log_name === '/dev/null' || !log_name
+            ? await getUniqPath(command, `${id}`)
+            : log_name;
         const logTime = dayjs().format('YYYY-MM-DD-HH-mm-ss-SSS');
         const logDirPath = path.resolve(config.logPath, `${uniqPath}`);
-        if (log_path?.split('/')?.every((x) => x !== uniqPath)) {
-          await fs.mkdir(logDirPath, { recursive: true });
-        }
+        await fs.mkdir(logDirPath, { recursive: true });
         const logPath = `${uniqPath}/${logTime}.log`;
         const absolutePath = path.resolve(config.logPath, `${logPath}`);
         const cp = spawn(
@@ -498,7 +531,7 @@ export default class CronService {
           { where: { id } },
         );
         cp.stdout.on('data', async (data) => {
-          await fs.appendFile(absolutePath, data.toString());
+          await logStreamManager.write(absolutePath, data.toString());
         });
         cp.stderr.on('data', async (data) => {
           this.logger.info(
@@ -506,7 +539,7 @@ export default class CronService {
             command,
             data.toString(),
           );
-          await fs.appendFile(absolutePath, data.toString());
+          await logStreamManager.write(absolutePath, data.toString());
         });
         cp.on('error', async (err) => {
           this.logger.error(
@@ -514,7 +547,7 @@ export default class CronService {
             command,
             err,
           );
-          await fs.appendFile(absolutePath, JSON.stringify(err));
+          await logStreamManager.write(absolutePath, JSON.stringify(err));
         });
 
         cp.on('exit', async (code) => {
@@ -523,6 +556,8 @@ export default class CronService {
             JSON.stringify(params),
             code,
           );
+          // Close the stream after task completion
+          await logStreamManager.closeStream(absolutePath);
           await CrontabModel.update(
             { status: CrontabStatus.idle, pid: undefined },
             { where: { id } },
@@ -564,7 +599,9 @@ export default class CronService {
     if (!doc) {
       return '';
     }
-
+    if (doc.log_name === '/dev/null') {
+      return '日志设置为忽略';
+    }
     const absolutePath = path.resolve(config.logPath, `${doc.log_path}`);
     const logFileExist = doc.log_path && (await fileExist(absolutePath));
     if (logFileExist) {
@@ -607,9 +644,11 @@ export default class CronService {
     if (!command.startsWith(TASK_PREFIX) && !command.startsWith(QL_PREFIX)) {
       command = `${TASK_PREFIX}${tab.command}`;
     }
-    let commandVariable = `real_time=${Boolean(realTime)} no_tee=true ID=${
-      tab.id
-    } `;
+    let commandVariable = `real_time=${Boolean(realTime)} no_tee=true ID=${tab.id} `;
+    // Only include log_name if it has a truthy value to avoid passing null/undefined to shell
+    if (tab.log_name) {
+      commandVariable += `log_name=${tab.log_name} `;
+    }
     if (tab.task_before) {
       commandVariable += `task_before='${tab.task_before
         .replace(/'/g, "'\\''")
@@ -651,12 +690,23 @@ export default class CronService {
 
     await writeFileWithLock(config.crontabFile, crontab_string);
 
-    execSync(`crontab ${config.crontabFile}`);
+    try {
+      execSync(`crontab ${config.crontabFile}`);
+    } catch (error: any) {
+      const errorMsg = error.message || String(error);
+      this.logger.error('[crontab] Failed to update system crontab:', errorMsg);
+    }
+
     await CrontabModel.update({ saved: true }, { where: {} });
   }
 
   public importCrontab() {
-    exec('crontab -l', (error, stdout, stderr) => {
+    exec('crontab -l', (error, stdout) => {
+      if (error) {
+        const errorMsg = error.message || String(error);
+        this.logger.error('[crontab] Failed to read system crontab:', errorMsg);
+      }
+
       const lines = stdout.split('\n');
       const namePrefix = new Date().getTime();
 
@@ -670,7 +720,7 @@ export default class CronService {
         if (
           command &&
           schedule &&
-          cron_parser.parseExpression(schedule).hasNext()
+          CronExpressionParser.parse(schedule).hasNext()
         ) {
           const name = namePrefix + '_' + index;
 

back/services/dependence.ts

@@ -107,7 +107,7 @@ export default class DependenceService {
     query: any = {},
   ): Promise<Dependence[]> {
     let condition = query;
-    if (DependenceTypes[type]) {
+    if (type && DependenceTypes[type] !== undefined) {
       condition.type = DependenceTypes[type];
     }
     if (status) {

back/services/env.ts

@@ -1,7 +1,8 @@
-import { Service, Inject } from 'typedi';
+import groupBy from 'lodash/groupBy';
+import { FindOptions, Op } from 'sequelize';
+import { Inject, Service } from 'typedi';
 import winston from 'winston';
 import config from '../config';
-import * as fs from 'fs/promises';
 import {
   Env,
   EnvModel,
@@ -11,13 +12,12 @@ import {
   minPosition,
   stepPosition,
 } from '../data/env';
-import groupBy from 'lodash/groupBy';
-import { FindOptions, Op } from 'sequelize';
 import { writeFileWithLock } from '../shared/utils';
+import { sequelize } from '../data';
 
 @Service()
 export default class EnvService {
-  constructor(@Inject('logger') private logger: winston.Logger) {}
+  constructor(@Inject('logger') private logger: winston.Logger) { }
 
   public async create(payloads: Env[]): Promise<Env[]> {
     const envs = await this.envs();
@@ -147,6 +147,7 @@ export default class EnvService {
     }
     try {
       const result = await this.find(condition, [
+        [sequelize.literal('COALESCE(`isPinned`, 0)'), 'DESC'],
         ['position', 'DESC'],
         ['createdAt', 'ASC'],
       ]);
@@ -190,6 +191,14 @@ export default class EnvService {
     await this.set_envs();
   }
 
+  public async pin(ids: number[]) {
+    await EnvModel.update({ isPinned: 1 }, { where: { id: ids } });
+  }
+
+  public async unPin(ids: number[]) {
+    await EnvModel.update({ isPinned: 0 }, { where: { id: ids } });
+  }
+
   public async set_envs() {
     const envs = await this.envs('', {
       name: { [Op.not]: null },

back/services/notify.ts

@@ -550,19 +550,33 @@ export default class NotificationService {
   }
 
   private async lark() {
-    let { larkKey } = this.params;
+    let { larkKey, larkSecret } = this.params;
 
     if (!larkKey.startsWith('http')) {
       larkKey = `https://open.feishu.cn/open-apis/bot/v2/hook/${larkKey}`;
     }
 
+    const body: Record<string, any> = {
+      msg_type: 'text',
+      content: { text: `${this.title}\n\n${this.content}` },
+    };
+
+    // Add signature if secret is provided
+    // Note: Feishu's signature algorithm uses timestamp+"\n"+secret as the HMAC key
+    // and signs an empty message, which differs from typical HMAC usage
+    if (larkSecret) {
+      const timestamp = Math.floor(Date.now() / 1000).toString();
+      const stringToSign = `${timestamp}\n${larkSecret}`;
+      const hmac = crypto.createHmac('sha256', stringToSign);
+      const sign = hmac.digest('base64');
+      body.timestamp = timestamp;
+      body.sign = sign;
+    }
+
     try {
       const res = await httpClient.post(larkKey, {
         ...this.gotOption,
-        json: {
-          msg_type: 'text',
-          content: { text: `${this.title}\n\n${this.content}` },
-        },
+        json: body,
         headers: { 'Content-Type': 'application/json' },
       });
       if (res.StatusCode === 0 || res.code === 0) {

back/services/sshKey.ts

@@ -131,4 +131,32 @@ export default class SshKeyService {
       }
     }
   }
+
+  public async addGlobalSSHKey(key: string, alias: string): Promise<void> {
+    await this.generatePrivateKeyFile(`~global_${alias}`, key);
+    // Create a global SSH config entry that matches all hosts
+    // This allows the key to be used for any Git repository
+    await this.generateGlobalSshConfig(`~global_${alias}`);
+  }
+
+  public async removeGlobalSSHKey(alias: string): Promise<void> {
+    await this.removePrivateKeyFile(`~global_${alias}`);
+    await this.removeSshConfig(`~global_${alias}`);
+  }
+
+  private async generateGlobalSshConfig(alias: string) {
+    // Create a config that matches all hosts, making this key globally available
+    const config = `Host *\n    IdentityFile ${path.join(
+      this.sshPath,
+      alias,
+    )}\n    StrictHostKeyChecking no\n`;
+    await writeFileWithLock(
+      `${path.join(this.sshPath, `${alias}.config`)}`,
+      config,
+      {
+        encoding: 'utf8',
+        mode: '600',
+      },
+    );
+  }
 }

back/services/subscription.ts

@@ -31,6 +31,7 @@ import { formatCommand, formatUrl } from '../config/subscription';
 import { CrontabModel } from '../data/cron';
 import CrontabService from './cron';
 import taskLimit from '../shared/pLimit';
+import { logStreamManager } from '../shared/logStreamManager';
 
 @Service()
 export default class SubscriptionService {
@@ -136,7 +137,7 @@ export default class SubscriptionService {
         let beforeStr = '';
         try {
           if (doc.sub_before) {
-            await fs.appendFile(absolutePath, `\n## 执行before命令...\n\n`);
+            await logStreamManager.write(absolutePath, `\n## 执行before命令...\n\n`);
             beforeStr = await promiseExec(doc.sub_before);
           }
         } catch (error: any) {
@@ -144,7 +145,7 @@ export default class SubscriptionService {
             (error.stderr && error.stderr.toString()) || JSON.stringify(error);
         }
         if (beforeStr) {
-          await fs.appendFile(absolutePath, `${beforeStr}\n`);
+          await logStreamManager.write(absolutePath, `${beforeStr}\n`);
         }
       },
       onStart: async (cp: ChildProcessWithoutNullStreams, startTime) => {
@@ -163,7 +164,7 @@ export default class SubscriptionService {
         let afterStr = '';
         try {
           if (sub.sub_after) {
-            await fs.appendFile(absolutePath, `\n\n## 执行after命令...\n\n`);
+            await logStreamManager.write(absolutePath, `\n\n## 执行after命令...\n\n`);
             afterStr = await promiseExec(sub.sub_after);
           }
         } catch (error: any) {
@@ -171,16 +172,19 @@ export default class SubscriptionService {
             (error.stderr && error.stderr.toString()) || JSON.stringify(error);
         }
         if (afterStr) {
-          await fs.appendFile(absolutePath, `${afterStr}\n`);
+          await logStreamManager.write(absolutePath, `${afterStr}\n`);
         }
 
-        await fs.appendFile(
+        await logStreamManager.write(
           absolutePath,
           `\n## 执行结束... ${endTime.format(
             'YYYY-MM-DD HH:mm:ss',
           )}  耗时 ${diff} 秒${LOG_END_SYMBOL}`,
         );
 
+        // Close the stream after task completion
+        await logStreamManager.closeStream(absolutePath);
+
         await SubscriptionModel.update(
           { status: SubscriptionStatus.idle, pid: undefined },
           { where: { id: sub.id } },
@@ -195,12 +199,12 @@ export default class SubscriptionService {
       onError: async (message: string) => {
         const sub = await this.getDb({ id: doc.id });
         const absolutePath = await handleLogPath(sub.log_path as string);
-        await fs.appendFile(absolutePath, `\n${message}`);
+        await logStreamManager.write(absolutePath, `\n${message}`);
       },
       onLog: async (message: string) => {
         const sub = await this.getDb({ id: doc.id });
         const absolutePath = await handleLogPath(sub.log_path as string);
-        await fs.appendFile(absolutePath, `\n${message}`);
+        await logStreamManager.write(absolutePath, `\n${message}`);
       },
     };
   }

back/services/system.ts

@@ -530,6 +530,27 @@ export default class SystemService {
     }
   }
 
+  public async updateGlobalSshKey(info: SystemModelInfo) {
+    const oDoc = await this.getSystemConfig();
+    const result = await this.updateAuthDb({
+      ...oDoc,
+      info: { ...oDoc.info, ...info },
+    });
+    
+    // Apply the global SSH key
+    const SshKeyService = require('./sshKey').default;
+    const Container = require('typedi').Container;
+    const sshKeyService = Container.get(SshKeyService);
+    
+    if (info.globalSshKey) {
+      await sshKeyService.addGlobalSSHKey(info.globalSshKey, 'global');
+    } else {
+      await sshKeyService.removeGlobalSSHKey('global');
+    }
+    
+    return { code: 200, data: result };
+  }
+
   public async cleanDependence(type: 'node' | 'python3') {
     if (!type || !['node', 'python3'].includes(type)) {
       return { code: 400, message: '参数错误' };

back/services/user.ts

@@ -11,6 +11,7 @@ import {
   SystemModelInfo,
   LoginStatus,
   AuthInfo,
+  TokenInfo,
 } from '../data/system';
 import { NotificationInfo } from '../data/notify';
 import NotificationService from './notify';
@@ -101,12 +102,23 @@ export default class UserService {
         algorithm: 'HS384',
       });
 
+      const tokenInfo: TokenInfo = {
+        value: token,
+        timestamp,
+        ip,
+        address,
+        platform: req.platform,
+      };
+
+      const updatedTokens = this.addTokenToList(
+        tokens,
+        req.platform,
+        tokenInfo,
+      );
+
       await this.updateAuthInfo(content, {
         token,
-        tokens: {
-          ...tokens,
-          [req.platform]: token,
-        },
+        tokens: updatedTokens,
         lastlogon: timestamp,
         retries: 0,
         lastip: ip,
@@ -180,11 +192,37 @@ export default class UserService {
     }
   }
 
-  public async logout(platform: string): Promise<any> {
+  public async logout(platform: string, tokenValue: string): Promise<any> {
+    if (!platform || !tokenValue) {
+      this.logger.warn('Invalid logout parameters - empty platform or token');
+      return;
+    }
+
     const authInfo = await this.getAuthInfo();
+
+    // Verify the token exists before attempting to remove it
+    const tokenExists = this.findTokenInList(
+      authInfo.tokens,
+      platform,
+      tokenValue,
+    );
+    if (!tokenExists && authInfo.token !== tokenValue) {
+      // Token not found, but don't throw error - user may have already logged out
+      this.logger.info(
+        `Logout attempted for non-existent token on platform: ${platform}`,
+      );
+      return;
+    }
+
+    const updatedTokens = this.removeTokenFromList(
+      authInfo.tokens,
+      platform,
+      tokenValue,
+    );
+
     await this.updateAuthInfo(authInfo, {
-      token: '',
-      tokens: { ...authInfo.tokens, [platform]: '' },
+      token: authInfo.token === tokenValue ? '' : authInfo.token,
+      tokens: updatedTokens,
     });
   }
 
@@ -364,6 +402,100 @@ export default class UserService {
     }
   }
 
+  private normalizeTokens(
+    tokens: Record<string, string | TokenInfo[]>,
+  ): Record<string, TokenInfo[]> {
+    const normalized: Record<string, TokenInfo[]> = {};
+
+    for (const [platform, value] of Object.entries(tokens)) {
+      if (typeof value === 'string') {
+        // Legacy format: convert string token to TokenInfo array
+        if (value) {
+          normalized[platform] = [
+            {
+              value,
+              timestamp: Date.now(),
+              ip: '',
+              address: '',
+              platform,
+            },
+          ];
+        } else {
+          normalized[platform] = [];
+        }
+      } else {
+        // Already in new format
+        normalized[platform] = value || [];
+      }
+    }
+
+    return normalized;
+  }
+
+  private addTokenToList(
+    tokens: Record<string, string | TokenInfo[]>,
+    platform: string,
+    tokenInfo: TokenInfo,
+    maxTokensPerPlatform: number = config.maxTokensPerPlatform,
+  ): Record<string, TokenInfo[]> {
+    // Validate maxTokensPerPlatform parameter
+    if (!Number.isInteger(maxTokensPerPlatform) || maxTokensPerPlatform < 1) {
+      this.logger.warn(
+        `Invalid maxTokensPerPlatform value: ${maxTokensPerPlatform}, using default`,
+      );
+      maxTokensPerPlatform = config.maxTokensPerPlatform;
+    }
+
+    const normalized = this.normalizeTokens(tokens);
+
+    if (!normalized[platform]) {
+      normalized[platform] = [];
+    }
+
+    // Add new token
+    normalized[platform].unshift(tokenInfo);
+
+    // Limit the number of active tokens per platform
+    if (normalized[platform].length > maxTokensPerPlatform) {
+      normalized[platform] = normalized[platform].slice(
+        0,
+        maxTokensPerPlatform,
+      );
+    }
+
+    return normalized;
+  }
+
+  private removeTokenFromList(
+    tokens: Record<string, string | TokenInfo[]>,
+    platform: string,
+    tokenValue: string,
+  ): Record<string, TokenInfo[]> {
+    const normalized = this.normalizeTokens(tokens);
+
+    if (normalized[platform]) {
+      normalized[platform] = normalized[platform].filter(
+        (t) => t.value !== tokenValue,
+      );
+    }
+
+    return normalized;
+  }
+
+  private findTokenInList(
+    tokens: Record<string, string | TokenInfo[]>,
+    platform: string,
+    tokenValue: string,
+  ): TokenInfo | undefined {
+    const normalized = this.normalizeTokens(tokens);
+
+    if (normalized[platform]) {
+      return normalized[platform].find((t) => t.value === tokenValue);
+    }
+
+    return undefined;
+  }
+
   public async resetAuthInfo(info: Partial<AuthInfo>) {
     const { retries, twoFactorActivated, password, username } = info;
     const authInfo = await this.getAuthInfo();

back/shared/auth.ts

@@ -0,0 +1,46 @@
+import { AuthInfo, TokenInfo } from '../data/system';
+
+/**
+ * Validates if a token exists in the authentication info.
+ * Supports both legacy string tokens and new TokenInfo array format.
+ *
+ * @param authInfo - The authentication information
+ * @param headerToken - The token to validate
+ * @param platform - The platform (desktop, mobile)
+ * @returns true if the token is valid, false otherwise
+ */
+export function isValidToken(
+  authInfo: AuthInfo | null | undefined,
+  headerToken: string,
+  platform: string,
+): boolean {
+  if (!authInfo || !headerToken) {
+    return false;
+  }
+
+  const { token = '', tokens = {} } = authInfo;
+
+  // Check legacy token field
+  if (headerToken === token) {
+    return true;
+  }
+
+  // Check platform-specific tokens (support both legacy string and new TokenInfo[] format)
+  const platformTokens = tokens[platform];
+
+  // Handle null/undefined platformTokens
+  if (platformTokens === null || platformTokens === undefined) {
+    return false;
+  }
+
+  if (typeof platformTokens === 'string') {
+    // Legacy format: single string token
+    return headerToken === platformTokens;
+  } else if (Array.isArray(platformTokens)) {
+    // New format: array of TokenInfo objects
+    return platformTokens.some((t: TokenInfo) => t && t.value === headerToken);
+  }
+
+  // Unexpected type - log warning and reject
+  return false;
+}

back/shared/logStreamManager.ts

@@ -0,0 +1,110 @@
+import { createWriteStream, WriteStream } from 'fs';
+import { EventEmitter } from 'events';
+
+/**
+ * Manages write streams for log files to improve performance by avoiding repeated file opens
+ */
+export class LogStreamManager extends EventEmitter {
+  private streams: Map<string, WriteStream> = new Map();
+  private pendingWrites: Map<string, Promise<void>> = new Map();
+
+  /**
+   * Write data to a log file using a managed stream
+   * @param filePath - Absolute path to the log file
+   * @param data - Data to write to the log file
+   */
+  async write(filePath: string, data: string): Promise<void> {
+    // Wait for any pending writes to this file to complete
+    const pending = this.pendingWrites.get(filePath);
+    if (pending) {
+      await pending;
+    }
+
+    // Create a new promise for this write operation
+    const writePromise = new Promise<void>((resolve, reject) => {
+      let stream = this.streams.get(filePath);
+
+      if (!stream) {
+        // Create a new write stream if one doesn't exist
+        stream = createWriteStream(filePath, { flags: 'a' });
+        this.streams.set(filePath, stream);
+
+        // Handle stream errors
+        stream.on('error', (error) => {
+          this.emit('error', { filePath, error });
+          // Remove the stream from the map on error
+          this.streams.delete(filePath);
+          reject(error);
+        });
+      }
+
+      // Write the data
+      const canContinue = stream.write(data, 'utf8', (error) => {
+        if (error) {
+          reject(error);
+        } else {
+          resolve();
+        }
+      });
+
+      // Handle backpressure
+      if (!canContinue) {
+        stream.once('drain', () => {
+          // Stream is ready for more data
+        });
+      }
+    });
+
+    this.pendingWrites.set(filePath, writePromise);
+
+    try {
+      await writePromise;
+    } finally {
+      this.pendingWrites.delete(filePath);
+    }
+  }
+
+  /**
+   * Close the stream for a specific file path
+   * @param filePath - Absolute path to the log file
+   */
+  async closeStream(filePath: string): Promise<void> {
+    // Wait for any pending writes to complete
+    const pending = this.pendingWrites.get(filePath);
+    if (pending) {
+      await pending.catch(() => {
+        // Ignore errors on pending writes during close
+      });
+    }
+
+    const stream = this.streams.get(filePath);
+    if (stream) {
+      return new Promise<void>((resolve) => {
+        stream.end(() => {
+          this.streams.delete(filePath);
+          resolve();
+        });
+      });
+    }
+  }
+
+  /**
+   * Close all open streams
+   */
+  async closeAll(): Promise<void> {
+    const closePromises = Array.from(this.streams.keys()).map((filePath) =>
+      this.closeStream(filePath),
+    );
+    await Promise.all(closePromises);
+  }
+
+  /**
+   * Get the number of open streams
+   */
+  getOpenStreamCount(): number {
+    return this.streams.size;
+  }
+}
+
+// Export a singleton instance for shared use
+export const logStreamManager = new LogStreamManager();

back/shared/runCron.ts

@@ -2,10 +2,45 @@ import { spawn } from 'cross-spawn';
 import taskLimit from './pLimit';
 import Logger from '../loaders/logger';
 import { ICron } from '../protos/cron';
+import { CrontabModel, CrontabStatus } from '../data/cron';
+import { killTask } from '../config/util';
 
 export function runCron(cmd: string, cron: ICron): Promise<number | void> {
   return taskLimit.runWithCronLimit(cron, () => {
     return new Promise(async (resolve: any) => {
+      // Check if the cron is already running and stop it (only if multiple instances are not allowed)
+      try {
+        const existingCron = await CrontabModel.findOne({
+          where: { id: Number(cron.id) },
+        });
+
+        // Default to single instance mode (0) for backward compatibility
+        const allowSingleInstances =
+          existingCron?.allow_multiple_instances === 0;
+
+        if (
+          allowSingleInstances &&
+          existingCron &&
+          existingCron.pid &&
+          (existingCron.status === CrontabStatus.running ||
+            existingCron.status === CrontabStatus.queued)
+        ) {
+          Logger.info(
+            `[schedule][停止已运行任务] 任务ID: ${cron.id}, PID: ${existingCron.pid}`,
+          );
+          await killTask(existingCron.pid);
+          // Update the status to idle after killing
+          await CrontabModel.update(
+            { status: CrontabStatus.idle, pid: undefined },
+            { where: { id: Number(cron.id) } },
+          );
+        }
+      } catch (error) {
+        Logger.error(
+          `[schedule][检查已运行任务失败] 任务ID: ${cron.id}, 错误: ${error}`,
+        );
+      }
+
       Logger.info(
         `[schedule][开始执行任务] 参数 ${JSON.stringify({
           ...cron,

back/validation/schedule.ts

@@ -1,6 +1,8 @@
 import { Joi } from 'celebrate';
-import cron_parser from 'cron-parser';
+import CronExpressionParser from 'cron-parser';
 import { ScheduleType } from '../interface/schedule';
+import path from 'path';
+import config from '../config';
 
 const validateSchedule = (value: string, helpers: any) => {
   if (
@@ -11,7 +13,7 @@ const validateSchedule = (value: string, helpers: any) => {
   }
 
   try {
-    if (cron_parser.parseExpression(value).hasNext()) {
+    if (CronExpressionParser.parse(value).hasNext()) {
       return value;
     }
   } catch (e) {
@@ -37,4 +39,47 @@ export const commonCronSchema = {
   extra_schedules: Joi.array().optional().allow(null),
   task_before: Joi.string().optional().allow('').allow(null),
   task_after: Joi.string().optional().allow('').allow(null),
+  log_name: Joi.string()
+    .optional()
+    .allow('')
+    .allow(null)
+    .custom((value, helpers) => {
+      if (!value) return value;
+
+      // Check if it's an absolute path
+      if (value.startsWith('/')) {
+        // Allow /dev/null as special case
+        if (value === '/dev/null') {
+          return value;
+        }
+
+        // For other absolute paths, ensure they are within the safe log directory
+        const normalizedValue = path.normalize(value);
+        const normalizedLogPath = path.normalize(config.logPath);
+
+        if (!normalizedValue.startsWith(normalizedLogPath)) {
+          return helpers.error('string.unsafePath');
+        }
+
+        return value;
+      }
+
+      if (
+        !/^(?!.*(?:^|\/)\.{1,2}(?:\/|$))(?:\/)?(?:[\w.-]+\/)*[\w.-]+\/?$/.test(
+          value,
+        )
+      ) {
+        return helpers.error('string.pattern.base');
+      }
+      if (value.length > 100) {
+        return helpers.error('string.max');
+      }
+      return value;
+    })
+    .messages({
+      'string.pattern.base': '日志名称只能包含字母、数字、下划线和连字符',
+      'string.max': '日志名称不能超过100个字符',
+      'string.unsafePath': '绝对路径必须在日志目录内或使用 /dev/null',
+    }),
+  allow_multiple_instances: Joi.number().optional().valid(0, 1).allow(null),
 };

docker/310.Dockerfile

@@ -69,9 +69,10 @@ RUN git clone --depth=1 -b ${QL_BRANCH} ${QL_URL} ${QL_DIR} \
 
 ENV PNPM_HOME=${QL_DIR}/data/dep_cache/node \
   PYTHON_HOME=${QL_DIR}/data/dep_cache/python3 \
-  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3
+  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3 \
+  HOME=/root
 
-ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin \
+ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin:${HOME}/bin \
   NODE_PATH=/usr/local/bin:/usr/local/lib/node_modules:${PNPM_HOME}/global/5/node_modules \
   PIP_CACHE_DIR=${PYTHON_HOME}/pip \
   PYTHONPATH=${PYTHON_HOME}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}/site-packages

docker/Dockerfile

@@ -69,9 +69,10 @@ RUN git clone --depth=1 -b ${QL_BRANCH} ${QL_URL} ${QL_DIR} \
 
 ENV PNPM_HOME=${QL_DIR}/data/dep_cache/node \
   PYTHON_HOME=${QL_DIR}/data/dep_cache/python3 \
-  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3
+  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3 \
+  HOME=/root
 
-ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin \
+ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin:${HOME}/bin \
   NODE_PATH=/usr/local/bin:/usr/local/lib/node_modules:${PNPM_HOME}/global/5/node_modules \
   PIP_CACHE_DIR=${PYTHON_HOME}/pip \
   PYTHONPATH=${PYTHON_HOME}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}/site-packages

docker/docker-entrypoint.sh

@@ -2,36 +2,53 @@
 
 dir_shell=/ql/shell
 . $dir_shell/share.sh
-. $dir_shell/env.sh
+
+export_ql_envs() {
+  export BACK_PORT="${ql_port}"
+  export GRPC_PORT="${ql_grpc_port}"
+}
 
 log_with_style() {
   local level="$1"
   local message="$2"
   local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
-
   printf "\n[%s] [%7s]  %s\n" "${timestamp}" "${level}" "${message}"
 }
 
-log_with_style "INFO" "🚀 1. 检测配置文件..."
+# Fix DNS resolution issues in Alpine Linux
+# Alpine uses musl libc which has known DNS resolver issues with certain domains
+# Adding ndots:0 prevents unnecessary search domain appending
+if [ -f /etc/alpine-release ]; then
+  if ! grep -q "^options ndots:0" /etc/resolv.conf 2>/dev/null; then
+    echo "options ndots:0" >> /etc/resolv.conf
+    log_with_style "INFO" "🔧  0. 已配置 DNS 解析优化 (ndots:0)"
+  fi
+fi
+
+log_with_style "INFO" "🚀  1. 检测配置文件..."
+load_ql_envs
+export_ql_envs
+. $dir_shell/env.sh
 import_config "$@"
 fix_config
 
-pm2 l &>/dev/null
+# Try to initialize PM2, but don't fail if it doesn't work
+pm2 l &>/dev/null || log_with_style "WARN" "PM2 初始化可能失败，将在启动时尝试使用备用方案"
 
 log_with_style "INFO" "⚙️  2. 启动 pm2 服务..."
 reload_pm2
 
 if [[ $AutoStartBot == true ]]; then
-  log_with_style "INFO" "🤖 3. 启动 bot..."
+  log_with_style "INFO" "🤖  3. 启动 bot..."
   nohup ql bot >$dir_log/bot.log 2>&1 &
 fi
 
 if [[ $EnableExtraShell == true ]]; then
-  log_with_style "INFO" "🛠️ 4. 执行自定义脚本..."
+  log_with_style "INFO" "🛠️  4. 执行自定义脚本..."
   nohup ql extra >$dir_log/extra.log 2>&1 &
 fi
 
-log_with_style "SUCCESS" "🎉 容器启动成功!"
+log_with_style "SUCCESS" "🎉  容器启动成功!"
 
 crond -f >/dev/null
 

package.json

@@ -1,5 +1,6 @@
 {
   "private": true,
+  "packageManager": "pnpm@8.3.1",
   "scripts": {
     "start": "concurrently -n w: npm:start:*",
     "start:back": "nodemon ./back/app.ts",
@@ -61,7 +62,7 @@
     "celebrate": "^15.0.3",
     "chokidar": "^4.0.1",
     "cors": "^2.8.5",
-    "cron-parser": "^4.9.0",
+    "cron-parser": "^5.4.0",
     "cross-spawn": "^7.0.6",
     "dayjs": "^1.11.13",
     "dotenv": "^16.4.6",
@@ -76,7 +77,7 @@
     "js-yaml": "^4.1.0",
     "jsonwebtoken": "^9.0.2",
     "lodash": "^4.17.21",
-    "multer": "1.4.5-lts.1",
+    "multer": "2.1.1",
     "node-schedule": "^2.1.0",
     "nodemailer": "^6.9.16",
     "p-queue-cjs": "7.3.4",
@@ -117,7 +118,7 @@
     "@types/js-yaml": "^4.0.5",
     "@types/jsonwebtoken": "^8.5.8",
     "@types/lodash": "^4.14.185",
-    "@types/multer": "^1.4.7",
+    "@types/multer": "^2.0.0",
     "@types/node": "^17.0.21",
     "@types/node-schedule": "^1.3.2",
     "@types/nodemailer": "^6.4.4",

pnpm-lock.yaml

@@ -1,9 +1,5 @@
 lockfileVersion: '6.0'
 
-settings:
-  autoInstallPeers: true
-  excludeLinksFromLockfile: false
-
 overrides:
   sqlite3: git+https://github.com/whyour/node-sqlite3.git#v1.0.3
 
@@ -39,8 +35,8 @@ dependencies:
     specifier: ^2.8.5
     version: 2.8.5
   cron-parser:
-    specifier: ^4.9.0
-    version: 4.9.0
+    specifier: ^5.4.0
+    version: 5.4.0
   cross-spawn:
     specifier: ^7.0.6
     version: 7.0.6
@@ -90,8 +86,8 @@ dependencies:
     specifier: ^4.17.21
     version: 4.17.21
   multer:
-    specifier: 1.4.5-lts.1
-    version: 1.4.5-lts.1
+    specifier: 2.1.1
+    version: 2.1.1
   node-schedule:
     specifier: ^2.1.0
     version: 2.1.1
@@ -194,8 +190,8 @@ devDependencies:
     specifier: ^4.14.185
     version: 4.17.13
   '@types/multer':
-    specifier: ^1.4.7
-    version: 1.4.12
+    specifier: ^2.0.0
+    version: 2.0.0
   '@types/node':
     specifier: ^17.0.21
     version: 17.0.45
@@ -3960,8 +3956,8 @@ packages:
     resolution: {integrity: sha512-nG96G3Wp6acyAgJqGasjODb+acrI7KltPiRxzHPXnP3NgI28bpQDRv53olbqGXbfcgF5aiiHmO3xpwEpS5Ld9g==}
     dev: false
 
-  /@types/multer@1.4.12:
-    resolution: {integrity: sha512-pQ2hoqvXiJt2FP9WQVLPRO+AmiIm/ZYkavPlIQnx282u4ZrVdztx0pkh3jjpQt0Kz+YI0YhSG264y08UJKoUQg==}
+  /@types/multer@2.0.0:
+    resolution: {integrity: sha512-C3Z9v9Evij2yST3RSBktxP9STm6OdMc5uR1xF1SGr98uv8dUlAL2hqwrZ3GVB3uyMyiegnscEK6PGtYvNrjTjw==}
     dependencies:
       '@types/express': 4.17.21
     dev: true
@@ -6333,13 +6329,13 @@ packages:
   /concat-map@0.0.1:
     resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==}
 
-  /concat-stream@1.6.2:
-    resolution: {integrity: sha512-27HBghJxjiZtIk3Ycvn/4kbJk/1uZuJFfuPEns6LaEvpvG1f0hTea8lilrouyo9mVc2GWdcEZ8OLoGmSADlrCw==}
-    engines: {'0': node >= 0.8}
+  /concat-stream@2.0.0:
+    resolution: {integrity: sha512-MWufYdFw53ccGjCA+Ol7XJYpAlW6/prSMzuPOTRnJGcGzuhLn4Scrz7qf6o8bROZ514ltazcIFJZevcfbo0x7A==}
+    engines: {'0': node >= 6.0}
     dependencies:
       buffer-from: 1.1.2
       inherits: 2.0.4
-      readable-stream: 2.3.8
+      readable-stream: 3.6.2
       typedarray: 0.0.6
     dev: false
 
@@ -6436,6 +6432,7 @@ packages:
 
   /core-util-is@1.0.3:
     resolution: {integrity: sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==}
+    dev: true
 
   /cors@2.8.5:
     resolution: {integrity: sha512-KIHbLJqu73RGr/hnbrO9uBeixNGuvSQjul/jdFvS/KFSIH1hWVd1ng7zOHx+YrEfInLG7q4n6GHQ9cDtxv/P6g==}
@@ -6524,6 +6521,13 @@ packages:
       luxon: 3.5.0
     dev: false
 
+  /cron-parser@5.4.0:
+    resolution: {integrity: sha512-HxYB8vTvnQFx4dLsZpGRa0uHp6X3qIzS3ZJgJ9v6l/5TJMgeWQbLkR5yiJ5hOxGbc9+jCADDnydIe15ReLZnJA==}
+    engines: {node: '>=18'}
+    dependencies:
+      luxon: 3.7.2
+    dev: false
+
   /croner@7.0.8:
     resolution: {integrity: sha512-4E27J9ZQV9prM9ggU18QGPYPMSblbA9JuGv4Ff3Gk6supX4RszNGQxBgiFBL6wb/L9HuSMpFbQpduMiDRo+z5Q==}
     engines: {node: '>=6.0'}
@@ -8281,6 +8285,7 @@ packages:
 
   /glob@10.4.5:
     resolution: {integrity: sha512-7Bv8RF0k6xjo7d4A/PxYLbUCfb6c+Vpd2/mB2yRDlew7Jb5hEXiCD9ibfO7wpk8i4sevK6DFny9h7EYbM3/sHg==}
+    deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
     hasBin: true
     dependencies:
       foreground-child: 3.3.0
@@ -8293,7 +8298,7 @@ packages:
 
   /glob@7.2.3:
     resolution: {integrity: sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==}
-    deprecated: Glob versions prior to v9 are no longer supported
+    deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
     dependencies:
       fs.realpath: 1.0.0
       inflight: 1.0.6
@@ -9164,6 +9169,7 @@ packages:
 
   /isarray@1.0.0:
     resolution: {integrity: sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==}
+    dev: true
 
   /isarray@2.0.5:
     resolution: {integrity: sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw==}
@@ -9792,6 +9798,11 @@ packages:
     engines: {node: '>=12'}
     dev: false
 
+  /luxon@3.7.2:
+    resolution: {integrity: sha512-vtEhXh/gNjI9Yg1u4jX/0YVPMvxzHuGgCm6tC5kZyb08yjGWGnqAjGJvcXbqQR2P3MyMEFnRbpcdFS6PBcLqew==}
+    engines: {node: '>=12'}
+    dev: false
+
   /make-dir@2.1.0:
     resolution: {integrity: sha512-LS9X+dc8KLxXCb8dni79fLIIUA5VyZoyjSMCwTluaXA0o27cCK0bhXkpgw+sTXVpPy/lSO57ilRixqk0vDmtRA==}
     engines: {node: '>=6'}
@@ -10025,6 +10036,7 @@ packages:
 
   /minimist@1.2.8:
     resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==}
+    dev: true
 
   /minipass-collect@1.0.2:
     resolution: {integrity: sha512-6T6lH0H8OG9kITm/Jm6tdooIbogG9e0tLgpY6mphXSm/A9u8Nq1ryBG+Qspiub9LjWlBPsPS3tWQ/Botq4FdxA==}
@@ -10105,6 +10117,7 @@ packages:
     hasBin: true
     dependencies:
       minimist: 1.2.8
+    dev: true
 
   /mkdirp@1.0.4:
     resolution: {integrity: sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==}
@@ -10139,17 +10152,14 @@ packages:
   /ms@2.1.3:
     resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
 
-  /multer@1.4.5-lts.1:
-    resolution: {integrity: sha512-ywPWvcDMeH+z9gQq5qYHCCy+ethsk4goepZ45GLD63fOu0YcNecQxi64nDs3qluZB+murG3/D4dJ7+dGctcCQQ==}
-    engines: {node: '>= 6.0.0'}
+  /multer@2.1.1:
+    resolution: {integrity: sha512-mo+QTzKlx8R7E5ylSXxWzGoXoZbOsRMpyitcht8By2KHvMbf3tjwosZ/Mu/XYU6UuJ3VZnODIrak5ZrPiPyB6A==}
+    engines: {node: '>= 10.16.0'}
     dependencies:
       append-field: 1.0.0
       busboy: 1.6.0
-      concat-stream: 1.6.2
-      mkdirp: 0.5.6
-      object-assign: 4.1.1
+      concat-stream: 2.0.0
       type-is: 1.6.18
-      xtend: 4.0.2
     dev: false
 
   /mz@2.7.0:
@@ -11518,6 +11528,7 @@ packages:
 
   /process-nextick-args@2.0.1:
     resolution: {integrity: sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==}
+    dev: true
 
   /process-okam@0.11.10:
     resolution: {integrity: sha512-p8e5nl6/OCeMalVb9dSojND5B9m/nq64WsyUfRmrTdLMKcNYcDN++/2I8WV1mTQDqrh2PQ6tIIb2A7/A38eSvw==}
@@ -12939,6 +12950,7 @@ packages:
       safe-buffer: 5.1.2
       string_decoder: 1.1.1
       util-deprecate: 1.0.2
+    dev: true
 
   /readable-stream@3.6.2:
     resolution: {integrity: sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==}
@@ -13209,6 +13221,7 @@ packages:
 
   /safe-buffer@5.1.2:
     resolution: {integrity: sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==}
+    dev: true
 
   /safe-buffer@5.2.1:
     resolution: {integrity: sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==}
@@ -13856,6 +13869,7 @@ packages:
     resolution: {integrity: sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==}
     dependencies:
       safe-buffer: 5.1.2
+    dev: true
 
   /string_decoder@1.3.0:
     resolution: {integrity: sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==}
@@ -14140,6 +14154,7 @@ packages:
   /tar@6.2.1:
     resolution: {integrity: sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==}
     engines: {node: '>=10'}
+    deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
     dependencies:
       chownr: 2.0.0
       fs-minipass: 2.1.0
@@ -15128,6 +15143,7 @@ packages:
   /xtend@4.0.2:
     resolution: {integrity: sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==}
     engines: {node: '>=0.4'}
+    dev: true
 
   /y18n@5.0.8:
     resolution: {integrity: sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==}
@@ -15213,3 +15229,7 @@ packages:
       - encoding
       - supports-color
     dev: false
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false

sample/notify.js

@@ -52,6 +52,7 @@ const push_config = {
   DD_BOT_TOKEN: '', // 钉钉机器人的 DD_BOT_TOKEN
 
   FSKEY: '', // 飞书机器人的 FSKEY
+  FSSECRET: '', // 飞书机器人的 FSSECRET，对应安全设置里的签名校验密钥
 
   // 推送到个人QQ：http://127.0.0.1/send_private_msg
   // 群：http://127.0.0.1/send_group_msg
@@ -481,9 +482,13 @@ function tgBotNotify(text, desp) {
         timeout,
       };
       if (TG_PROXY_HOST && TG_PROXY_PORT) {
+        let proxyHost = TG_PROXY_HOST;
+        if (TG_PROXY_AUTH && !TG_PROXY_HOST.includes('@')) {
+          proxyHost = `${TG_PROXY_AUTH}@${TG_PROXY_HOST}`;
+        }
         let agent;
         agent = new ProxyAgent({
-          uri: `http://${TG_PROXY_AUTH}${TG_PROXY_HOST}:${TG_PROXY_PORT}`,
+          uri: `http://${proxyHost}:${TG_PROXY_PORT}`,
         });
         options.dispatcher = agent;
       }
@@ -989,11 +994,29 @@ function aibotkNotify(text, desp) {
 
 function fsBotNotify(text, desp) {
   return new Promise((resolve) => {
-    const { FSKEY } = push_config;
+    const { FSKEY, FSSECRET } = push_config;
     if (FSKEY) {
+      const body = {
+        msg_type: 'text',
+        content: { text: `${text}\n\n${desp}` },
+      };
+
+      // Add signature if secret is provided
+      // Note: Feishu's signature algorithm uses timestamp+"\n"+secret as the HMAC key
+      // and signs an empty message, which differs from typical HMAC usage
+      if (FSSECRET) {
+        const crypto = require('crypto');
+        const timestamp = Math.floor(Date.now() / 1000).toString();
+        const stringToSign = `${timestamp}\n${FSSECRET}`;
+        const hmac = crypto.createHmac('sha256', stringToSign);
+        const sign = hmac.digest('base64');
+        body.timestamp = timestamp;
+        body.sign = sign;
+      }
+
       const options = {
         url: `https://open.feishu.cn/open-apis/bot/v2/hook/${FSKEY}`,
-        json: { msg_type: 'text', content: { text: `${text}\n\n${desp}` } },
+        json: body,
         headers: {
           'Content-Type': 'application/json',
         },
@@ -1262,7 +1285,15 @@ function ntfyNotify(text, desp) {
   }
 
   return new Promise((resolve) => {
-    const { NTFY_URL, NTFY_TOPIC, NTFY_PRIORITY, NTFY_TOKEN, NTFY_USERNAME, NTFY_PASSWORD, NTFY_ACTIONS } = push_config;
+    const {
+      NTFY_URL,
+      NTFY_TOPIC,
+      NTFY_PRIORITY,
+      NTFY_TOKEN,
+      NTFY_USERNAME,
+      NTFY_PASSWORD,
+      NTFY_ACTIONS,
+    } = push_config;
     if (NTFY_TOPIC) {
       const options = {
         url: `${NTFY_URL || 'https://ntfy.sh'}/${NTFY_TOPIC}`,
@@ -1277,7 +1308,8 @@ function ntfyNotify(text, desp) {
       if (NTFY_TOKEN) {
         options.headers['Authorization'] = `Bearer ${NTFY_TOKEN}`;
       } else if (NTFY_USERNAME && NTFY_PASSWORD) {
-        options.headers['Authorization'] = `Basic ${Buffer.from(`${NTFY_USERNAME}:${NTFY_PASSWORD}`).toString('base64')}`;
+        options.headers['Authorization'] =
+          `Basic ${Buffer.from(`${NTFY_USERNAME}:${NTFY_PASSWORD}`).toString('base64')}`;
       }
       if (NTFY_ACTIONS) {
         options.headers['Actions'] = encodeRFC2047(NTFY_ACTIONS);

sample/notify.py

@@ -49,6 +49,7 @@ push_config = {
     'DD_BOT_TOKEN': '',                 # 钉钉机器人的 DD_BOT_TOKEN
 
     'FSKEY': '',                        # 飞书机器人的 FSKEY
+    'FSSECRET': '',                     # 飞书机器人的 FSSECRET，对应安全设置里的签名校验密钥
 
     'GOBOT_URL': '',                    # go-cqhttp
                                         # 推送到个人QQ：http://127.0.0.1/send_private_msg
@@ -233,6 +234,20 @@ def feishu_bot(title: str, content: str) -> None:
 
     url = f'https://open.feishu.cn/open-apis/bot/v2/hook/{push_config.get("FSKEY")}'
     data = {"msg_type": "text", "content": {"text": f"{title}\n\n{content}"}}
+
+    # Add signature if secret is provided
+    # Note: Feishu's signature algorithm uses timestamp+"\n"+secret as the HMAC key
+    # and signs an empty message, which differs from typical HMAC usage
+    if push_config.get("FSSECRET"):
+        timestamp = str(int(time.time()))
+        string_to_sign = f'{timestamp}\n{push_config.get("FSSECRET")}'
+        hmac_code = hmac.new(
+            string_to_sign.encode("utf-8"), digestmod=hashlib.sha256
+        ).digest()
+        sign = base64.b64encode(hmac_code).decode("utf-8")
+        data["timestamp"] = timestamp
+        data["sign"] = sign
+
     response = requests.post(url, data=json.dumps(data)).json()
 
     if response.get("StatusCode") == 0 or response.get("code") == 0:

sample/ql_sample.js

@@ -12,4 +12,32 @@ QLAPI.getEnvs({ searchValue: 'dddd' }).then((x) => {
 QLAPI.systemNotify({ title: '123', content: '231' }).then((x) => {
   console.log('systemNotify', x);
 });
+
+// 查询定时任务 (Query cron tasks)
+QLAPI.getCrons({ searchValue: 'test' }).then((x) => {
+  console.log('getCrons', x);
+});
+
+// 通过ID查询定时任务 (Get cron by ID)
+QLAPI.getCronById({ id: 1 }).then((x) => {
+  console.log('getCronById', x);
+}).catch((err) => {
+  console.log('getCronById error', err);
+});
+
+// 启用定时任务 (Enable cron tasks)
+QLAPI.enableCrons({ ids: [1, 2] }).then((x) => {
+  console.log('enableCrons', x);
+});
+
+// 禁用定时任务 (Disable cron tasks)
+QLAPI.disableCrons({ ids: [1, 2] }).then((x) => {
+  console.log('disableCrons', x);
+});
+
+// 手动执行定时任务 (Run cron tasks manually)
+QLAPI.runCrons({ ids: [1] }).then((x) => {
+  console.log('runCrons', x);
+});
+
 console.log('test desc');

shell/api.sh

@@ -41,7 +41,7 @@ add_cron_api() {
   fi
 
   local api=$(
-    curl -s --noproxy "*" "http://0.0.0.0:5700/open/crons?t=$currentTimeStamp" \
+    curl -s --noproxy "*" "http://0.0.0.0:${ql_port}/open/crons?t=$currentTimeStamp" \
       -H "Authorization: Bearer ${__ql_token__}" \
       -H "Content-Type: application/json;charset=UTF-8" \
       --data-raw "{\"name\":\"${name//\"/\\\"}\",\"command\":\"${command//\"/\\\"}\",\"schedule\":\"$schedule\",\"sub_id\":$sub_id}" \
@@ -71,7 +71,7 @@ update_cron_api() {
   fi
 
   local api=$(
-    curl -s --noproxy "*" "http://0.0.0.0:5700/open/crons?t=$currentTimeStamp" \
+    curl -s --noproxy "*" "http://0.0.0.0:${ql_port}/open/crons?t=$currentTimeStamp" \
       -X 'PUT' \
       -H "Authorization: Bearer ${__ql_token__}" \
       -H "Content-Type: application/json;charset=UTF-8" \
@@ -98,7 +98,7 @@ update_cron_command_api() {
   fi
 
   local api=$(
-    curl -s --noproxy "*" "http://0.0.0.0:5700/open/crons?t=$currentTimeStamp" \
+    curl -s --noproxy "*" "http://0.0.0.0:${ql_port}/open/crons?t=$currentTimeStamp" \
       -X 'PUT' \
       -H "Authorization: Bearer ${__ql_token__}" \
       -H "Content-Type: application/json;charset=UTF-8" \
@@ -118,7 +118,7 @@ del_cron_api() {
   local ids="$1"
   local currentTimeStamp=$(date +%s)
   local api=$(
-    curl -s --noproxy "*" "http://0.0.0.0:5700/open/crons?t=$currentTimeStamp" \
+    curl -s --noproxy "*" "http://0.0.0.0:${ql_port}/open/crons?t=$currentTimeStamp" \
       -X 'DELETE' \
       -H "Authorization: Bearer ${__ql_token__}" \
       -H "Content-Type: application/json;charset=UTF-8" \
@@ -143,7 +143,7 @@ update_cron() {
   local runningTime="${6:-0}"
   local currentTimeStamp=$(date +%s)
   local api=$(
-    curl -s --noproxy "*" "http://0.0.0.0:5700/open/crons/status?t=$currentTimeStamp" \
+    curl -s --noproxy "*" "http://0.0.0.0:${ql_port}/open/crons/status?t=$currentTimeStamp" \
       -X 'PUT' \
       -H "Authorization: Bearer ${__ql_token__}" \
       -H "Content-Type: application/json;charset=UTF-8" \
@@ -165,7 +165,7 @@ notify_api() {
   local content="$2"
   local currentTimeStamp=$(date +%s)
   local api=$(
-    curl -s --noproxy "*" "http://0.0.0.0:5700/open/system/notify?t=$currentTimeStamp" \
+    curl -s --noproxy "*" "http://0.0.0.0:${ql_port}/open/system/notify?t=$currentTimeStamp" \
       -X 'PUT' \
       -H "Authorization: Bearer ${__ql_token__}" \
       -H "Content-Type: application/json;charset=UTF-8" \
@@ -185,7 +185,7 @@ find_cron_api() {
   local params="$1"
   local currentTimeStamp=$(date +%s)
   local api=$(
-    curl -s --noproxy "*" "http://0.0.0.0:5700/open/crons/detail?$params&t=$currentTimeStamp" \
+    curl -s --noproxy "*" "http://0.0.0.0:${ql_port}/open/crons/detail?$params&t=$currentTimeStamp" \
       -H "Authorization: Bearer ${__ql_token__}" \
       -H "Content-Type: application/json;charset=UTF-8" \
       --compressed
@@ -204,7 +204,7 @@ update_auth_config() {
   local tip="$2"
   local currentTimeStamp=$(date +%s)
   local api=$(
-    curl -s --noproxy "*" "http://0.0.0.0:5700/open/system/auth/reset?t=$currentTimeStamp" \
+    curl -s --noproxy "*" "http://0.0.0.0:${ql_port}/open/system/auth/reset?t=$currentTimeStamp" \
       -X 'PUT' \
       -H "Authorization: Bearer ${__ql_token__}" \
       -H "Content-Type: application/json;charset=UTF-8" \

shell/check.sh

@@ -24,14 +24,14 @@ copy_dep() {
 
 pm2_log() {
   echo -e "---> pm2日志"
-  local panelOut="/root/.pm2/logs/panel-out.log"
-  local panelError="/root/.pm2/logs/panel-error.log"
+  local panelOut="/root/.pm2/logs/qinglong-out.log"
+  local panelError="/root/.pm2/logs/qinglong-error.log"
   tail -n 300 "$panelOut"
   tail -n 300 "$panelError"
 }
 
 check_ql() {
-  local api=$(curl -s --noproxy "*" "http://0.0.0.0:5700")
+  local api=$(curl -s --noproxy "*" "http://0.0.0.0:${ql_port}")
   echo -e "\n=====> 检测面板\n\n$api\n"
   if [[ $api =~ "<div id=\"root\"></div>" ]]; then
     echo -e "=====> 面板服务启动正常\n"
@@ -42,10 +42,10 @@ check_pm2() {
   pm2_log
   local currentTimeStamp=$(date +%s)
   local api=$(
-    curl -s --noproxy "*" "http://0.0.0.0:5700/api/system?t=$currentTimeStamp" \
+    curl -s --noproxy "*" "http://0.0.0.0:${ql_port}/api/system?t=$currentTimeStamp" \
       -H 'Accept: */*' \
       -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36' \
-      -H 'Referer: http://0.0.0.0:5700/crontab' \
+      -H "Referer: http://0.0.0.0:${ql_port}/crontab" \
       -H 'Accept-Language: en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7' \
       --compressed
   )

shell/otask.sh

@@ -92,7 +92,7 @@ run_normal() {
 
   cd $dir_scripts
   local relative_path="${file_param%/*}"
-  if [[ ${file_param} != /* ]] && [[ ! -z ${relative_path} ]] && [[ ${file_param} =~ "/" ]]; then
+  if [[ ! -z ${relative_path} ]] && [[ ${file_param} =~ "/" ]]; then
     cd ${relative_path}
     file_param=${file_param/$relative_path\//}
   fi

shell/preload/client.js

@@ -5,7 +5,7 @@ const { join } = require('path');
 class GrpcClient {
   static #config = {
     protoPath: join(process.env.QL_DIR, 'back/protos/api.proto'),
-    serverAddress: '0.0.0.0:5500',
+    serverAddress: `0.0.0.0:${process.env.GRPC_PORT || '5500'}`,
     protoOptions: {
       keepCase: true,
       longs: String,
@@ -33,6 +33,11 @@ class GrpcClient {
     'createCron',
     'updateCron',
     'deleteCrons',
+    'getCrons',
+    'getCronById',
+    'enableCrons',
+    'disableCrons',
+    'runCrons',
   ];
 
   #client;

shell/preload/sitecustomize.py

@@ -42,7 +42,7 @@ def run():
         os.environ["PYTHONPATH"] = prev_pythonpath
 
         split_str = "__sitecustomize__"
-        file_name = sys.argv[0].replace(f"{os.getenv('dir_scripts')}/", "")
+        file_name = os.path.abspath(sys.argv[0]).replace(f"{os.getenv('dir_scripts')}/", "")
         
         # 创建临时文件路径
         temp_file = f"/tmp/env_{os.getpid()}.json"

shell/share.sh

@@ -59,15 +59,10 @@ list_own_user=$dir_list_tmp/own_user.list
 list_own_add=$dir_list_tmp/own_add.list
 list_own_drop=$dir_list_tmp/own_drop.list
 
-## 软连接及其原始文件对应关系
 link_name=(
   task
   ql
 )
-original_name=(
-  task.sh
-  update.sh
-)
 
 init_env() {
   local pnpm_global_path=$(pnpm root -g 2>/dev/null)
@@ -84,15 +79,20 @@ init_env() {
   export PYTHONUNBUFFERED=1
 }
 
+load_ql_envs() {
+  ql_base_url=${QlBaseUrl:-"/"}
+  ql_port=${QlPort:-"5700"}
+  ql_grpc_port=${QlGrpcPort:-"5500"}
+  current_branch=${QL_BRANCH:-""}
+}
+
 import_config() {
   [[ -f $file_config_user ]] && . $file_config_user
 
-  ql_base_url=${QlBaseUrl:-"/"}
-  ql_port=${QlPort:-"5700"}
+  load_ql_envs
   command_timeout_time=${CommandTimeoutTime:-""}
   file_extensions=${RepoFileExtensions:-"js py"}
   proxy_url=${ProxyUrl:-""}
-  current_branch=${QL_BRANCH:-""}
 
   if [[ -n "${DefaultCronRule}" ]]; then
     default_cron="${DefaultCronRule}"
@@ -272,14 +272,35 @@ random_range() {
 
 delete_pm2() {
   cd $dir_root
-  pm2 delete ecosystem.config.js
+  # Try to delete PM2 processes, but don't fail if PM2 is not available
+  pm2 delete ecosystem.config.js 2>/dev/null || true
+  # Also try to kill any directly spawned node processes
+  pkill -f "node.*static/build/app.js" 2>/dev/null || true
 }
 
 reload_pm2() {
   cd $dir_root
   restore_env_vars
-  pm2 flush &>/dev/null
-  pm2 startOrGracefulReload ecosystem.config.js --update-env
+  
+  # Try to start PM2, but handle failures gracefully
+  if pm2 flush &>/dev/null && pm2 startOrGracefulReload ecosystem.config.js --update-env; then
+    return 0
+  else
+    local exit_code=$?
+    echo "警告: PM2 启动失败 (退出码: $exit_code)，可能是由于硬件不兼容"
+    echo "正在尝试直接使用 Node.js 启动服务..."
+    
+    # Kill any existing node processes for qinglong
+    pkill -f "node.*static/build/app.js" 2>/dev/null || true
+    
+    # Start node directly in the background
+    nohup node static/build/app.js > $dir_log/qinglong.log 2>&1 &
+    local node_pid=$!
+    
+    echo "已使用 Node.js 直接启动服务 (PID: $node_pid)"
+    echo "注意: 使用此模式时，部分 PM2 管理功能将不可用"
+    return 0
+  fi
 }
 
 diff_time() {

shell/task.sh

@@ -46,18 +46,22 @@ handle_log_path() {
 
   time=$(date "+$mtime_format")
   log_time=$(format_log_time "$mtime_format" "$time")
-  log_dir_tmp="${file_param##*/}"
-  if [[ $file_param =~ "/" ]]; then
-    if [[ $file_param == /* ]]; then
-      log_dir_tmp_path="${file_param:1}"
-    else
-      log_dir_tmp_path="${file_param}"
+  if [[ -z $log_name ]]; then
+    log_dir_tmp="${file_param##*/}"
+    if [[ $file_param =~ "/" ]]; then
+      if [[ $file_param == /* ]]; then
+        log_dir_tmp_path="${file_param:1}"
+      else
+        log_dir_tmp_path="${file_param}"
+      fi
     fi
+    log_dir_tmp_path="${log_dir_tmp_path%/*}"
+    log_dir_tmp_path="${log_dir_tmp_path##*/}"
+    [[ $log_dir_tmp_path ]] && log_dir_tmp="${log_dir_tmp_path}_${log_dir_tmp}"
+    log_dir="${log_dir_tmp%.*}${suffix}"
+  else
+    log_dir="$log_name"
   fi
-  log_dir_tmp_path="${log_dir_tmp_path%/*}"
-  log_dir_tmp_path="${log_dir_tmp_path##*/}"
-  [[ $log_dir_tmp_path ]] && log_dir_tmp="${log_dir_tmp_path}_${log_dir_tmp}"
-  log_dir="${log_dir_tmp%.*}${suffix}"
   log_path="$log_dir/$log_time.log"
 
   if [[ ${real_log_path:=} ]]; then
@@ -73,6 +77,11 @@ handle_log_path() {
   if [[ "${real_time:=}" == "true" ]]; then
     cmd=""
   fi
+
+  if [[ "${log_dir:=}" == "/dev/null" ]]; then
+    cmd=">> /dev/null"
+    log_path="/dev/null"
+  fi
 }
 
 format_params() {

shell/update.sh

@@ -3,6 +3,7 @@
 dir_shell=$QL_DIR/shell
 . $dir_shell/share.sh
 . $dir_shell/api.sh
+load_ql_envs
 . $dir_shell/env.sh
 
 send_mark=$dir_shell/send_mark

src/app.ts

@@ -7,11 +7,18 @@ export function rootContainer(container: any) {
     'en': require('./locales/en-US.json'),
     'zh': require('./locales/zh-CN.json'),
   };
-  let currentLocale = intl.determineLocale({
-    urlLocaleKey: 'lang',
-    cookieLocaleKey: 'lang',
-    localStorageLocaleKey: 'lang',
-  }).slice(0, 2);
+  let currentLocale: string;
+  try {
+    currentLocale = intl.determineLocale({
+      urlLocaleKey: 'lang',
+      cookieLocaleKey: 'lang',
+      localStorageLocaleKey: 'lang',
+    }).slice(0, 2);
+  } catch (e: unknown) {
+    // Handle decodeURIComponent errors from malformed cookies
+    console.warn('Failed to determine locale from cookies:', e);
+    currentLocale = '';
+  }
 
   if (!currentLocale || !Object.keys(locales).includes(currentLocale)) {
     currentLocale = 'zh';

src/components/copy.tsx

@@ -1,6 +1,6 @@
 import intl from 'react-intl-universal';
 import React, { useRef, useState, useEffect } from 'react';
-import { Tooltip, Typography } from 'antd';
+import { Tooltip, Typography, message } from 'antd';
 import { CopyOutlined, CheckOutlined } from '@ant-design/icons';
 import { CopyToClipboard } from 'react-copy-to-clipboard';
 
@@ -10,16 +10,21 @@ const Copy = ({ text }: { text: string }) => {
   const [copied, setCopied] = useState(false);
   const copyIdRef = useRef<number>();
 
-  const copyText = (e?: React.MouseEvent) => {
+  const handleCopy = (text: string, result: boolean) => {
+    if (result) {
+      setCopied(true);
+      message.success(intl.get('复制成功'));
+
+      cleanCopyId();
+      copyIdRef.current = window.setTimeout(() => {
+        setCopied(false);
+      }, 3000);
+    }
+  };
+
+  const handleClick = (e?: React.MouseEvent) => {
     e?.preventDefault();
     e?.stopPropagation();
-
-    setCopied(true);
-
-    cleanCopyId();
-    copyIdRef.current = window.setTimeout(() => {
-      setCopied(false);
-    }, 3000);
   };
 
   const cleanCopyId = () => {
@@ -27,8 +32,8 @@ const Copy = ({ text }: { text: string }) => {
   };
 
   return (
-    <Link onClick={copyText} style={{ marginLeft: 1 }}>
-      <CopyToClipboard text={text}>
+    <Link onClick={handleClick} style={{ marginLeft: 4 }}>
+      <CopyToClipboard text={text} onCopy={handleCopy}>
         <Tooltip
           key="copy"
           title={copied ? intl.get('复制成功') : intl.get('复制')}

src/locales/en-US.json

@@ -104,7 +104,7 @@
   "序号": "Number",
   "备注": "Remarks",
   "更新时间": "Update Time",
-  "创建时间": "Creation Time",
+  "创建时间": "Created Time",
   "确认删除依赖": "Confirm to delete the dependency",
   "确认重新安装": "Confirm to reinstall",
   "确认取消安装": "Confirm to cancel install",
@@ -252,7 +252,7 @@
   "登录日志": "Login Logs",
   "其他设置": "Other Settings",
   "关于": "About",
-  "成功": "Success",
+  "成功": "Successfully",
   "失败": "Failure",
   "登录时间": "Login Time",
   "登录地址": "Login Address",
@@ -389,6 +389,7 @@
   "消息接收人": "message recipient",
   "调用版本；专业版填写pro，个人版填写personal，为空默认使用专业版": "Version, you can specify 'pro' for the Professional version and 'personal' for the Personal version. If left blank, it will default to the Professional version.",
   "飞书群组机器人：https://www.feishu.cn/hc/zh-CN/articles/360024984973": "Feishu group bot: https://www.feishu.cn/hc/zh-CN/articles/360024984973",
+  "飞书群组机器人加签密钥，安全设置中开启签名校验后获得": "Feishu group bot signature secret, obtained after enabling signature verification in security settings",
   "邮箱服务名称，比如126、163、Gmail、QQ等，支持列表https://github.com/nodemailer/nodemailer/blob/master/lib/well-known/services.json": "Email service name, e.g., 126, 163, Gmail, QQ, etc. Supported list: https://github.com/nodemailer/nodemailer/blob/master/lib/well-known/services.json",
   "邮箱地址": "Email Address",
   "SMTP 登录密码，也可能为特殊口令，视具体邮件服务商说明而定": "The SMTP login password may also be a special passphrase, depending on the specific email service provider's instructions",
@@ -521,5 +522,36 @@
   "远程仓库缓存": "Remote repository cache",
   "SSH 文件缓存": "SSH file cache",
   "清除依赖缓存": "Clean dependency cache",
-  "清除成功": "Clean successful"
+  "清除成功": "Clean successful",
+  "日志名称": "Log Name",
+  "自定义日志文件夹名称，用于区分不同任务的日志，留空则自动生成": "Custom log folder name to distinguish logs from different tasks. Leave blank to auto-generate",
+  "自定义日志文件夹名称，用于区分不同任务的日志，留空则自动生成。支持绝对路径如 /dev/null": "Custom log folder name to distinguish logs from different tasks. Leave blank to auto-generate. Supports absolute paths like /dev/null",
+  "自定义日志文件夹名称，用于区分不同任务的日志，留空则自动生成。支持 /dev/null 丢弃日志，其他绝对路径必须在日志目录内": "Custom log folder name to distinguish logs from different tasks. Leave blank to auto-generate. Supports /dev/null to discard logs, other absolute paths must be within log directory",
+  "请输入自定义日志文件夹名称": "Please enter a custom log folder name",
+  "请输入自定义日志文件夹名称或绝对路径": "Please enter a custom log folder name or absolute path",
+  "请输入自定义日志文件夹名称或 /dev/null": "Please enter a custom log folder name or /dev/null",
+  "日志名称只能包含字母、数字、下划线和连字符": "Log name can only contain letters, numbers, underscores and hyphens",
+  "日志名称不能超过100个字符": "Log name cannot exceed 100 characters",
+  "未启用": "Not enabled",
+  "默认为 CPU 个数": "Default is the number of CPUs",
+  "Minimum is 4": "Minimum is 4",
+  "实例模式": "Instance Mode",
+  "单实例模式：定时启动新任务前会自动停止旧任务；多实例模式：允许同时运行多个任务实例": "Single instance mode: automatically stop old task before starting new scheduled task; Multi-instance mode: allow multiple task instances to run simultaneously",
+  "请选择实例模式": "Please select instance mode",
+  "单实例": "Single Instance",
+  "多实例": "Multi-Instance",
+  "SSH密钥": "SSH Keys",
+  "别名": "Alias",
+  "编辑SSH密钥": "Edit SSH Key",
+  "创建SSH密钥": "Create SSH Key",
+  "更新SSH密钥成功": "SSH key updated successfully",
+  "创建SSH密钥成功": "SSH key created successfully",
+  "请输入SSH密钥别名": "Please enter SSH key alias",
+  "请输入SSH私钥": "Please enter SSH private key",
+  "请输入SSH私钥内容（以 -----BEGIN 开头）": "Please enter SSH private key content (starts with -----BEGIN)",
+  "确认删除SSH密钥": "Confirm to delete SSH key",
+  "批量": "Batch",
+  "全局SSH私钥": "Global SSH Private Key",
+  "用于访问所有私有仓库的全局SSH私钥": "Global SSH private key for accessing all private repositories",
+  "请输入完整的SSH私钥内容": "Please enter the complete SSH private key content"
 }

src/locales/zh-CN.json

@@ -389,6 +389,7 @@
   "消息接收人": "消息接收人",
   "调用版本；专业版填写pro，个人版填写personal，为空默认使用专业版": "调用版本；专业版填写pro，个人版填写personal，为空默认使用专业版",
   "飞书群组机器人：https://www.feishu.cn/hc/zh-CN/articles/360024984973": "飞书群组机器人：https://www.feishu.cn/hc/zh-CN/articles/360024984973",
+  "飞书群组机器人加签密钥，安全设置中开启签名校验后获得": "飞书群组机器人加签密钥，安全设置中开启签名校验后获得",
   "邮箱服务名称，比如126、163、Gmail、QQ等，支持列表https://github.com/nodemailer/nodemailer/blob/master/lib/well-known/services.json": "邮箱服务名称，比如126、163、Gmail、QQ等，支持列表https://github.com/nodemailer/nodemailer/blob/master/lib/well-known/services.json",
   "邮箱地址": "邮箱地址",
   "SMTP 登录密码，也可能为特殊口令，视具体邮件服务商说明而定": "SMTP 登录密码，也可能为特殊口令，视具体邮件服务商说明而定",
@@ -521,5 +522,36 @@
   "远程仓库缓存": "远程仓库缓存",
   "SSH 文件缓存": "SSH 文件缓存",
   "清除依赖缓存": "清除依赖缓存",
-  "清除成功": "清除成功"
+  "清除成功": "清除成功",
+  "日志名称": "日志名称",
+  "自定义日志文件夹名称，用于区分不同任务的日志，留空则自动生成": "自定义日志文件夹名称，用于区分不同任务的日志，留空则自动生成",
+  "自定义日志文件夹名称，用于区分不同任务的日志，留空则自动生成。支持绝对路径如 /dev/null": "自定义日志文件夹名称，用于区分不同任务的日志，留空则自动生成。支持绝对路径如 /dev/null",
+  "自定义日志文件夹名称，用于区分不同任务的日志，留空则自动生成。支持 /dev/null 丢弃日志，其他绝对路径必须在日志目录内": "自定义日志文件夹名称，用于区分不同任务的日志，留空则自动生成。支持 /dev/null 丢弃日志，其他绝对路径必须在日志目录内",
+  "请输入自定义日志文件夹名称": "请输入自定义日志文件夹名称",
+  "请输入自定义日志文件夹名称或绝对路径": "请输入自定义日志文件夹名称或绝对路径",
+  "请输入自定义日志文件夹名称或 /dev/null": "请输入自定义日志文件夹名称或 /dev/null",
+  "日志名称只能包含字母、数字、下划线和连字符": "日志名称只能包含字母、数字、下划线和连字符",
+  "日志名称不能超过100个字符": "日志名称不能超过100个字符",
+  "未启用": "未启用",
+  "默认为 CPU 个数": "默认为 CPU 个数",
+  "最小是 4": "最小是 4",
+  "实例模式": "实例模式",
+  "单实例模式：定时启动新任务前会自动停止旧任务；多实例模式：允许同时运行多个任务实例": "单实例模式：定时启动新任务前会自动停止旧任务；多实例模式：允许同时运行多个任务实例",
+  "请选择实例模式": "请选择实例模式",
+  "单实例": "单实例",
+  "多实例": "多实例",
+  "SSH密钥": "SSH密钥",
+  "别名": "别名",
+  "编辑SSH密钥": "编辑SSH密钥",
+  "创建SSH密钥": "创建SSH密钥",
+  "更新SSH密钥成功": "更新SSH密钥成功",
+  "创建SSH密钥成功": "创建SSH密钥成功",
+  "请输入SSH密钥别名": "请输入SSH密钥别名",
+  "请输入SSH私钥": "请输入SSH私钥",
+  "请输入SSH私钥内容（以 -----BEGIN 开头）": "请输入SSH私钥内容（以 -----BEGIN 开头）",
+  "确认删除SSH密钥": "确认删除SSH密钥",
+  "批量": "批量",
+  "全局SSH私钥": "全局SSH私钥",
+  "用于访问所有私有仓库的全局SSH私钥": "用于访问所有私有仓库的全局SSH私钥",
+  "请输入完整的SSH私钥内容": "请输入完整的SSH私钥内容"
 }

src/pages/crontab/index.tsx

@@ -66,6 +66,7 @@ const SHOW_TAB_COUNT = 10;
 
 const Crontab = () => {
   const { headerStyle, isPhone, theme } = useOutletContext<SharedContext>();
+  const [allSubscriptions, setAllSubscriptions] = useState<any[]>([]);
   const columns: ColumnProps<ICrontab>[] = [
     {
       title: intl.get('名称'),
@@ -247,8 +248,8 @@ const Crontab = () => {
           >
             {record.last_execution_time
               ? dayjs(record.last_execution_time * 1000).format(
-                  'YYYY-MM-DD HH:mm:ss',
-                )
+                'YYYY-MM-DD HH:mm:ss',
+              )
               : '-'}
           </span>
         );
@@ -272,6 +273,12 @@ const Crontab = () => {
       title: intl.get('关联订阅'),
       width: 185,
       render: (text, record: any) => record?.subscription?.name || '-',
+      key: 'sub_id',
+      dataIndex: 'sub_id',
+      filters: allSubscriptions.map((sub) => ({
+        text: sub.name || sub.alias,
+        value: sub.id,
+      })),
     },
     {
       title: intl.get('操作'),
@@ -361,11 +368,10 @@ const Crontab = () => {
   const getCrons = () => {
     setLoading(true);
     const { page, size, sorter, filters } = pageConf;
-    let url = `${
-      config.apiPrefix
-    }crons?searchValue=${searchText}&page=${page}&size=${size}&filters=${JSON.stringify(
-      filters,
-    )}`;
+    let url = `${config.apiPrefix
+      }crons?searchValue=${searchText}&page=${page}&size=${size}&filters=${JSON.stringify(
+        filters,
+      )}`;
     if (sorter && sorter.column && sorter.order) {
       url += `&sorter=${JSON.stringify({
         field: sorter.column.key,
@@ -523,9 +529,8 @@ const Crontab = () => {
 
   const enabledOrDisabledCron = (record: any, index: number) => {
     Modal.confirm({
-      title: `确认${
-        record.isDisabled === 1 ? intl.get('启用') : intl.get('禁用')
-      }`,
+      title: `确认${record.isDisabled === 1 ? intl.get('启用') : intl.get('禁用')
+        }`,
       content: (
         <>
           {intl.get('确认')}
@@ -540,8 +545,7 @@ const Crontab = () => {
       onOk() {
         request
           .put(
-            `${config.apiPrefix}crons/${
-              record.isDisabled === 1 ? 'enable' : 'disable'
+            `${config.apiPrefix}crons/${record.isDisabled === 1 ? 'enable' : 'disable'
             }`,
             [record.id],
           )
@@ -565,9 +569,8 @@ const Crontab = () => {
 
   const pinOrUnPinCron = (record: any, index: number) => {
     Modal.confirm({
-      title: `确认${
-        record.isPinned === 1 ? intl.get('取消置顶') : intl.get('置顶')
-      }`,
+      title: `确认${record.isPinned === 1 ? intl.get('取消置顶') : intl.get('置顶')
+        }`,
       content: (
         <>
           {intl.get('确认')}
@@ -582,8 +585,7 @@ const Crontab = () => {
       onOk() {
         request
           .put(
-            `${config.apiPrefix}crons/${
-              record.isPinned === 1 ? 'unpin' : 'pin'
+            `${config.apiPrefix}crons/${record.isPinned === 1 ? 'unpin' : 'pin'
             }`,
             [record.id],
           )
@@ -799,8 +801,20 @@ const Crontab = () => {
     }
   }, [viewConf, enabledCronViews]);
 
+  const getAllSubscriptions = () => {
+    request
+      .get(`${config.apiPrefix}subscriptions`)
+      .then(({ code, data }) => {
+        if (code === 200) {
+          setAllSubscriptions(data || []);
+        }
+      })
+      .catch(() => {});
+  };
+
   useEffect(() => {
     getCronViews();
+    getAllSubscriptions();
   }, []);
 
   const viewAction = (key: string) => {
@@ -1014,6 +1028,7 @@ const Crontab = () => {
         )}
         <Table
           columns={columns}
+          sortDirections={['descend', 'ascend']}
           pagination={{
             current: pageConf.page,
             pageSize: pageConf.size,

src/pages/crontab/logModal.tsx

@@ -55,7 +55,7 @@ const CronLogModal = ({
           const log = data as string;
           setValue(log || intl.get("暂无日志"));
           const hasNext = Boolean(
-            log && !logEnded(log) && !log.includes("日志不存在"),
+            log && !logEnded(log) && !log.includes("日志不存在") && !log.includes("日志设置为忽略"),
           );
           if (!hasNext && !logEnded(value) && value !== intl.get("启动中...")) {
             setTimeout(() => {

src/pages/crontab/modal.tsx

@@ -3,7 +3,7 @@ import config from '@/utils/config';
 import { request } from '@/utils/http';
 import { MinusCircleOutlined, PlusOutlined } from '@ant-design/icons';
 import { Button, Form, Input, Modal, Select, Space, message } from 'antd';
-import cronParse from 'cron-parser';
+import CronExpressionParser from 'cron-parser';
 import { useEffect, useState } from 'react';
 import intl from 'react-intl-universal';
 import { getScheduleType, scheduleTypeMap } from './const';
@@ -91,10 +91,14 @@ const CronModal = ({
             { required: true },
             {
               validator: (_, value) => {
-                if (!value || cronParse.parseExpression(value).hasNext()) {
-                  return Promise.resolve();
+                try {
+                  if (!value || CronExpressionParser.parse(value).hasNext()) {
+                    return Promise.resolve();
+                  }
+                  return Promise.reject(intl.get('Cron表达式格式有误'));
+                } catch (e) {
+                  return Promise.reject(intl.get('Cron表达式格式有误'));
                 }
-                return Promise.reject(intl.get('Cron表达式格式有误'));
               },
             },
           ]}
@@ -180,6 +184,51 @@ const CronModal = ({
         <Form.Item name="labels" label={intl.get('标签')}>
           <EditableTagGroup />
         </Form.Item>
+        <Form.Item
+          name="allow_multiple_instances"
+          label={intl.get('实例模式')}
+          tooltip={intl.get(
+            '单实例模式：定时启动新任务前会自动停止旧任务；多实例模式：允许同时运行多个任务实例',
+          )}
+        >
+          <Select placeholder={intl.get('请选择实例模式')}>
+            <Select.Option value={0}>{intl.get('单实例')}</Select.Option>
+            <Select.Option value={1}>{intl.get('多实例')}</Select.Option>
+          </Select>
+        </Form.Item>
+        <Form.Item
+          name="log_name"
+          label={intl.get('日志名称')}
+          tooltip={intl.get(
+            '自定义日志文件夹名称，用于区分不同任务的日志，留空则自动生成。支持 /dev/null 丢弃日志，其他绝对路径必须在日志目录内',
+          )}
+          rules={[
+            {
+              validator: (_, value) => {
+                if (!value) return Promise.resolve();
+                if (value === '/dev/null') return Promise.resolve();
+                if (value.length > 100) {
+                  return Promise.reject(intl.get('日志名称不能超过100个字符'));
+                }
+                if (
+                  !/^(?!.*(?:^|\/)\.{1,2}(?:\/|$))(?:\/)?(?:[\w.-]+\/)*[\w.-]+\/?$/.test(
+                    value,
+                  )
+                ) {
+                  return Promise.reject(
+                    intl.get('日志名称只能包含字母、数字、下划线和连字符'),
+                  );
+                }
+                return Promise.resolve();
+              },
+            },
+          ]}
+        >
+          <Input
+            placeholder={intl.get('请输入自定义日志文件夹名称或 /dev/null')}
+            maxLength={200}
+          />
+        </Form.Item>
         <Form.Item
           name="task_before"
           label={intl.get('执行前')}
@@ -312,4 +361,3 @@ const CronLabelModal = ({
 };
 
 export { CronLabelModal, CronModal as default };
-

src/pages/crontab/type.ts

@@ -37,6 +37,7 @@ export interface ICrontab {
   nextRunTime: Date;
   sub_id: number;
   extra_schedules?: Array<{ schedule: string }>;
+  allow_multiple_instances?: 1 | 0;
 }
 
 export enum ScheduleType {

src/pages/env/index.tsx

@@ -1,47 +1,42 @@
-import intl from 'react-intl-universal';
-import React, {
-  useCallback,
-  useRef,
-  useState,
-  useEffect,
-  useMemo,
-} from 'react';
+import useTableScrollHeight from '@/hooks/useTableScrollHeight';
+import { SharedContext } from '@/layouts';
+import config from '@/utils/config';
+import { request } from '@/utils/http';
+import { exportJson } from '@/utils/index';
 import {
-  Button,
-  message,
-  Modal,
-  Table,
-  Tag,
-  Space,
-  Typography,
-  Tooltip,
-  Input,
-  UploadProps,
-  Upload,
-} from 'antd';
-import {
-  EditOutlined,
-  DeleteOutlined,
-  SyncOutlined,
   CheckCircleOutlined,
+  DeleteOutlined,
+  EditOutlined,
+  PushpinFilled,
+  PushpinOutlined,
   StopOutlined,
   UploadOutlined,
 } from '@ant-design/icons';
-import config from '@/utils/config';
 import { PageContainer } from '@ant-design/pro-layout';
-import { request } from '@/utils/http';
-import EnvModal from './modal';
-import EditNameModal from './editNameModal';
+import { useOutletContext } from '@umijs/max';
+import {
+  Button,
+  Input,
+  Modal,
+  Space,
+  Table,
+  Tag,
+  Tooltip,
+  Typography,
+  Upload,
+  UploadProps,
+  message,
+} from 'antd';
+import dayjs from 'dayjs';
+import React, { useCallback, useEffect, useRef, useState } from 'react';
 import { DndProvider, useDrag, useDrop } from 'react-dnd';
 import { HTML5Backend } from 'react-dnd-html5-backend';
-import './index.less';
-import { exportJson } from '@/utils/index';
-import { useOutletContext } from '@umijs/max';
-import { SharedContext } from '@/layouts';
-import useTableScrollHeight from '@/hooks/useTableScrollHeight';
-import Copy from '../../components/copy';
+import intl from 'react-intl-universal';
 import { useVT } from 'virtualizedtableforantd4';
-import dayjs from 'dayjs';
+import Copy from '../../components/copy';
+import EditNameModal from './editNameModal';
+import './index.less';
+import EnvModal from './modal';
 
 const { Paragraph } = Typography;
 const { Search } = Input;
@@ -59,11 +54,15 @@ enum StatusColor {
 enum OperationName {
   '启用',
   '禁用',
+  '置顶',
+  '取消置顶',
 }
 
 enum OperationPath {
   'enable',
   'disable',
+  'pin',
+  'unpin',
 }
 
 const type = 'DragableBodyRow';
@@ -181,7 +180,7 @@ const Env = () => {
     {
       title: intl.get('操作'),
       key: 'action',
-      width: 120,
+      width: 160,
       render: (text: string, record: any, index: number) => {
         const isPc = !isPhone;
         return (
@@ -208,6 +207,23 @@ const Env = () => {
                 )}
               </a>
             </Tooltip>
+            <Tooltip
+              title={
+                isPc
+                  ? record.isPinned === 1
+                    ? intl.get('取消置顶')
+                    : intl.get('置顶')
+                  : ''
+              }
+            >
+              <a onClick={() => pinOrUnpinEnv(record, index)}>
+                {record.isPinned === 1 ? (
+                  <PushpinFilled />
+                ) : (
+                  <PushpinOutlined />
+                )}
+              </a>
+            </Tooltip>
             <Tooltip title={isPc ? intl.get('删除') : ''}>
               <a onClick={() => deleteEnv(record, index)}>
                 <DeleteOutlined />
@@ -305,6 +321,51 @@ const Env = () => {
     setIsModalVisible(true);
   };
 
+  const pinOrUnpinEnv = (record: any, index: number) => {
+    Modal.confirm({
+      title: `确认${
+        record.isPinned === 1 ? intl.get('取消置顶') : intl.get('置顶')
+      }`,
+      content: (
+        <>
+          {intl.get('确认')}
+          {record.isPinned === 1 ? intl.get('取消置顶') : intl.get('置顶')}
+          Env{' '}
+          <Paragraph
+            style={{ wordBreak: 'break-all', display: 'inline' }}
+            ellipsis={{ rows: 6, expandable: true }}
+            type="warning"
+            copyable
+          >
+            {record.name}: {record.value}
+          </Paragraph>{' '}
+          {intl.get('吗')}
+        </>
+      ),
+      onOk() {
+        request
+          .put(
+            `${config.apiPrefix}envs/${
+              record.isPinned === 1 ? 'unpin' : 'pin'
+            }`,
+            [record.id],
+          )
+          .then(({ code, data }) => {
+            if (code === 200) {
+              message.success(
+                `${
+                  record.isPinned === 1
+                    ? intl.get('取消置顶')
+                    : intl.get('置顶')
+                }${intl.get('成功')}`,
+              );
+              getEnvs();
+            }
+          });
+      },
+    });
+  };
+
   const deleteEnv = (record: any, index: number) => {
     Modal.confirm({
       title: intl.get('确认删除'),
@@ -589,6 +650,20 @@ const Env = () => {
             >
               {intl.get('批量禁用')}
             </Button>
+            <Button
+              type="primary"
+              onClick={() => operateEnvs(2)}
+              style={{ marginLeft: 8, marginBottom: 5 }}
+            >
+              {intl.get('批量置顶')}
+            </Button>
+            <Button
+              type="primary"
+              onClick={() => operateEnvs(3)}
+              style={{ marginLeft: 8, marginRight: 8 }}
+            >
+              {intl.get('批量取消置顶')}
+            </Button>
             <span style={{ marginLeft: 8 }}>
               {intl.get('已选择')}
               <a>{selectedRowIds?.length}</a>

src/pages/script/saveModal.tsx

@@ -16,7 +16,7 @@ const SaveModal = ({
 
   const handleOk = async (values: any) => {
     setLoading(true);
-    const payload = { ...file, ...values, originFilename: file.title };
+    const payload = { ...values, originFilename: file.title, content: file.content };
     request
       .post(`${config.apiPrefix}scripts`, payload)
       .then(({ code, data }) => {

src/pages/setting/index.tsx

@@ -49,6 +49,7 @@ const Setting = () => {
     reloadTheme,
     systemInfo,
   } = useOutletContext<SharedContext>();
+  console.log('user',user)
   const columns = [
     {
       title: intl.get('名称'),

src/pages/setting/other.tsx

@@ -30,6 +30,7 @@ const dataMap = {
   'log-remove-frequency': 'logRemoveFrequency',
   'cron-concurrency': 'cronConcurrency',
   timezone: 'timezone',
+  'global-ssh-key': 'globalSshKey',
 };
 
 const exportModules = [
@@ -54,6 +55,7 @@ const Other = ({
     logRemoveFrequency?: number | null;
     cronConcurrency?: number | null;
     timezone?: string | null;
+    globalSshKey?: string | null;
   }>();
   const [form] = Form.useForm();
   const [exportLoading, setExportLoading] = useState(false);
@@ -240,6 +242,7 @@ const Other = ({
               addonBefore={intl.get('每')}
               addonAfter={intl.get('天')}
               style={{ width: 180 }}
+              placeholder={intl.get('未启用')}
               min={0}
               value={systemConfig?.logRemoveFrequency}
               onChange={(value) => {
@@ -261,8 +264,9 @@ const Other = ({
           <Input.Group compact>
             <InputNumber
               style={{ width: 180 }}
-              min={1}
+              min={4}
               value={systemConfig?.cronConcurrency}
+              placeholder={intl.get('默认为 CPU 个数')}
               onChange={(value) => {
                 setSystemConfig({ ...systemConfig, cronConcurrency: value });
               }}
@@ -306,6 +310,32 @@ const Other = ({
             </Button>
           </Input.Group>
         </Form.Item>
+        <Form.Item 
+          label={intl.get('全局SSH私钥')} 
+          name="globalSshKey"
+          tooltip={intl.get('用于访问所有私有仓库的全局SSH私钥')}
+        >
+          <Input.Group compact>
+            <Input.TextArea
+              value={systemConfig?.globalSshKey || ''}
+              style={{ width: 264 }}
+              autoSize={{ minRows: 3, maxRows: 8 }}
+              placeholder={intl.get('请输入完整的SSH私钥内容')}
+              onChange={(e) => {
+                setSystemConfig({ ...systemConfig, globalSshKey: e.target.value });
+              }}
+            />
+          </Input.Group>
+          <Button
+            type="primary"
+            onClick={() => {
+              updateSystemConfig('global-ssh-key');
+            }}
+            style={{ width: 264, marginTop: 8 }}
+          >
+            {intl.get('确认')}
+          </Button>
+        </Form.Item>
         <Form.Item label={intl.get('语言')} name="lang">
           <Select
             defaultValue={localStorage.getItem('lang') || ''}

src/pages/subscription/modal.tsx

@@ -12,7 +12,7 @@ import {
 } from 'antd';
 import { request } from '@/utils/http';
 import config from '@/utils/config';
-import cron_parser from 'cron-parser';
+import CronExpressionParser from 'cron-parser';
 import isNil from 'lodash/isNil';
 
 const { Option } = Select;
@@ -224,8 +224,8 @@ const SubscriptionModal = ({
         type === 'raw'
           ? 'file'
           : url.startsWith('http')
-          ? 'public-repo'
-          : 'private-repo';
+            ? 'public-repo'
+            : 'private-repo';
 
       form.setFieldsValue({
         type: _type,
@@ -378,13 +378,17 @@ const SubscriptionModal = ({
             { required: true },
             {
               validator: (rule, value) => {
-                if (
-                  scheduleType === 'interval' ||
-                  !value ||
-                  cron_parser.parseExpression(value).hasNext()
-                ) {
-                  return Promise.resolve();
-                } else {
+                try {
+                  if (
+                    scheduleType === 'interval' ||
+                    !value ||
+                    CronExpressionParser.parse(value).hasNext()
+                  ) {
+                    return Promise.resolve();
+                  } else {
+                    return Promise.reject(intl.get('Subscription表达式格式有误'));
+                  }
+                } catch (e) {
                   return Promise.reject(intl.get('Subscription表达式格式有误'));
                 }
               },

src/utils/config.ts

@@ -395,6 +395,12 @@ export default {
         ),
         required: true,
       },
+      {
+        label: 'larkSecret',
+        tip: intl.get(
+          '飞书群组机器人加签密钥，安全设置中开启签名校验后获得',
+        ),
+      },
     ],
     email: [
       {

src/utils/http.tsx

@@ -84,12 +84,12 @@ let _request = axios.create({
 });
 
 const apiWhiteList = [
-  '/api/user/login',
-  '/open/auth/token',
-  '/api/user/two-factor/login',
-  '/api/system',
-  '/api/user/init',
-  '/api/user/notification/init',
+  `${config.baseUrl}api/user/login`,
+  `${config.baseUrl}open/auth/token`,
+  `${config.baseUrl}api/user/two-factor/login`,
+  `${config.baseUrl}api/system`,
+  `${config.baseUrl}api/user/init`,
+  `${config.baseUrl}api/user/notification/init`,
 ];
 
 _request.interceptors.request.use((_config) => {

src/utils/index.ts

@@ -1,6 +1,6 @@
 import intl from 'react-intl-universal';
 import { LANG_MAP, LOG_END_SYMBOL } from './const';
-import cron_parser from 'cron-parser';
+import CronExpressionParser from 'cron-parser';
 import { ICrontab } from '@/pages/crontab/type';
 
 export default function browserType() {
@@ -155,9 +155,9 @@ export default function browserType() {
     shell === 'none'
       ? {}
       : {
-          shell, // wechat qq uc 360 2345 sougou liebao maxthon
-          shellVs,
-        },
+        shell, // wechat qq uc 360 2345 sougou liebao maxthon
+        shellVs,
+      },
   );
 
   console.log(
@@ -333,11 +333,11 @@ export function getCommandScript(
 
 export function parseCrontab(schedule: string): Date | null {
   try {
-    const time = cron_parser.parseExpression(schedule);
+    const time = CronExpressionParser.parse(schedule);
     if (time) {
       return time.next().toDate();
     }
-  } catch (error) {}
+  } catch (error) { }
 
   return null;
 }

version.yaml

@@ -1,10 +1,6 @@
-version: 2.19.2
-changeLogLink: https://t.me/jiao_long/431
-publishTime: 2025-06-27 23:59
+version: 2.20.2
+changeLogLink: https://t.me/jiao_long/434
+publishTime: 2026-03-01 1800
 changeLog: |
-  1. 备份数据支持选择模块，支持清除依赖缓存
-  2. QLAPI 和 openapi 的 systemNotify 支持自定义通知类型和参数
-  3. ntfy 增加可选的认证与用户动作，感谢 https://github.com/liheji
-  4. 修复取消安装依赖
-  5. 修复环境变量过大解析报错
-  6. 修改服务启动方式
+  1. 修复 path 安全漏洞（重要）
+