fix: block case-variant secret paths and task runner env overrides

fix(security): protect system app and task file boundaries
fix(security): reject apps scope grants in app API
2026-11-03 16:19:11 +08:00 · 2026-11-03 10:04:10 +08:00 · 2026-11-03 09:32:40 +08:00 · 2026-11-03 01:21:50 +08:00 · 2026-11-03 00:57:47 +08:00 · 2026-11-03 00:18:53 +08:00
60 changed files with 1427 additions and 421 deletions
@@ -247,7 +247,7 @@ jobs:
          version: "8.3.1"
      - uses: actions/setup-node@v6
        with:
-          node-version: "20"
+          node-version: "24"
          cache: "pnpm"
          cache-dependency-path: pnpm-lock.yaml

@@ -336,7 +336,7 @@ jobs:
          version: "8.3.1"
      - uses: actions/setup-node@v6
        with:
-          node-version: "20"
+          node-version: "24"
          cache: "pnpm"
          cache-dependency-path: pnpm-lock.yaml

@@ -394,7 +394,7 @@ jobs:
            SOURCE_COMMIT=${{ github.sha }}
          network: host
          # Keep s390x on Debian: npm can hang under QEMU with Alpine (nodejs/docker-node#1973).
-          platforms: linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x
+          platforms: linux/amd64,linux/arm64,linux/ppc64le,linux/s390x
          context: .
          file: ./docker/Dockerfile.debian
          push: true
@@ -405,151 +405,6 @@ jobs:
          cache-from: type=registry,ref=whyour/qinglong:cache-debian
          cache-to: type=registry,ref=whyour/qinglong:cache-debian,mode=max

-  build-alpine310:
-    if: ${{ github.ref_name == 'master' }}
-    needs: build-static
-    runs-on: ubuntu-22.04
-    permissions:
-      packages: write
-      contents: read
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/download-artifact@v7
-        with:
-          name: qinglong-static-${{ github.sha }}
-          path: static/
-      - uses: pnpm/action-setup@v6
-        with:
-          version: "8.3.1"
-      - uses: actions/setup-node@v6
-        with:
-          node-version: "20"
-          cache: "pnpm"
-          cache-dependency-path: pnpm-lock.yaml
-
-      - name: Read version from version.yaml
-        id: version
-        run: |
-          VERSION=$(grep '^version:' version.yaml | awk '{print $2}')
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-
-      - name: Setup timezone
-        run: sudo timedatectl set-timezone Asia/Shanghai
-
-      - name: Login to DockerHub
-        uses: docker/login-action@v4
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Login to GHCR
-        uses: docker/login-action@v4
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
-        with:
-          cache-image: false
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
-      - name: Build and push (Alpine Python 3.10)
-        uses: docker/build-push-action@v7
-        with:
-          build-args: |
-            QL_MAINTAINER=${{ github.repository_owner }}
-            QL_BRANCH=${{ github.ref_name }}
-            SOURCE_COMMIT=${{ github.sha }}
-          network: host
-          platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x,linux/386
-          context: .
-          file: ./docker/Dockerfile.310
-          push: true
-          provenance: mode=max
-          sbom: true
-          tags: |
-            whyour/qinglong:python3.10
-            whyour/qinglong:${{ steps.version.outputs.version }}-python3.10
-          cache-from: type=registry,ref=whyour/qinglong:cache-alpine-python3.10
-          cache-to: type=registry,ref=whyour/qinglong:cache-alpine-python3.10,mode=max
-
-  build-debian310:
-    if: ${{ github.ref_name == 'master' }}
-    needs: build-static
-    runs-on: ubuntu-22.04
-    permissions:
-      packages: write
-      contents: read
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/download-artifact@v7
-        with:
-          name: qinglong-static-${{ github.sha }}
-          path: static/
-      - uses: pnpm/action-setup@v6
-        with:
-          version: "8.3.1"
-      - uses: actions/setup-node@v6
-        with:
-          node-version: "20"
-          cache: "pnpm"
-          cache-dependency-path: pnpm-lock.yaml
-
-      - name: Read version from version.yaml
-        id: version
-        run: |
-          VERSION=$(grep '^version:' version.yaml | awk '{print $2}')
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-
-      - name: Setup timezone
-        run: sudo timedatectl set-timezone Asia/Shanghai
-
-      - name: Login to DockerHub
-        uses: docker/login-action@v4
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Login to GHCR
-        uses: docker/login-action@v4
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
-        with:
-          cache-image: false
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
-      - name: Build and push (Debian Python 3.10)
-        uses: docker/build-push-action@v7
-        with:
-          build-args: |
-            QL_MAINTAINER=${{ github.repository_owner }}
-            QL_BRANCH=${{ github.ref_name }}
-            SOURCE_COMMIT=${{ github.sha }}
-          network: host
-          # Keep s390x on Debian: npm can hang under QEMU with Alpine (nodejs/docker-node#1973).
-          platforms: linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x
-          context: .
-          file: ./docker/Dockerfile.debian310
-          push: true
-          provenance: mode=max
-          sbom: true
-          tags: |
-            whyour/qinglong:debian-python3.10
-            whyour/qinglong:${{ steps.version.outputs.version }}-debian-python3.10
-          cache-from: type=registry,ref=whyour/qinglong:cache-debian-python3.10
-          cache-to: type=registry,ref=whyour/qinglong:cache-debian-python3.10,mode=max
-
  # One unmodified amd64 package for migration acceptance only. This does not
  # publish bundles or advance development/formal channel indexes.
  build-npm-migration-bundle:
@@ -616,7 +471,7 @@ jobs:

  publish:
    if: ${{ github.repository == 'whyour/qinglong' && github.ref == 'refs/heads/master' }}
-    needs: [build-alpine, build-debian, build-alpine310, build-debian310, verify-npm-package]
+    needs: [build-alpine, build-debian, verify-npm-package]
    runs-on: ubuntu-latest
    permissions:
      contents: read
@@ -652,7 +507,7 @@ jobs:
            jq -e --arg version "$version" '. == $version' "$RUNNER_TEMP/npm-version.json" > /dev/null
            echo "::notice::$name@$version is already published; skipping npm publication for this image rebuild."
          elif jq -e '.error.code == "E404"' "$RUNNER_TEMP/npm-version.json" > /dev/null; then
-            npm publish "$archive" --ignore-scripts --access public --registry=https://registry.npmjs.org
+            npm publish "./$archive" --ignore-scripts --access public --registry=https://registry.npmjs.org
          else
            echo '::error::Could not check the published npm version; refusing to publish.'
            exit 1
@@ -662,7 +517,8 @@ jobs:
    # Both channels publish packages from this run's immutable image digests.
    if: ${{ !inputs.static_sync_only && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/develop') }}
    needs: [build-alpine, build-debian]
-    runs-on: ubuntu-22.04
+    # Node 24 can SIGILL while archiving ARM64 musl under x64 QEMU.
+    runs-on: ${{ matrix.platform == 'linux/arm64' && 'ubuntu-24.04-arm' || 'ubuntu-22.04' }}
    timeout-minutes: 90
    permissions:
      contents: read
@@ -679,13 +535,13 @@ jobs:
          - { platform: linux/s390x, libc: musl, name: s390x-musl }
          - { platform: linux/386, libc: musl, name: ia32-musl }
          - { platform: linux/amd64, libc: glibc, name: x64-glibc }
-          - { platform: linux/arm/v7, libc: glibc, name: armv7-glibc }
          - { platform: linux/arm64, libc: glibc, name: arm64-glibc }
          - { platform: linux/ppc64le, libc: glibc, name: ppc64-glibc }
          - { platform: linux/s390x, libc: glibc, name: s390x-glibc }
    steps:
      - uses: actions/checkout@v6
      - uses: docker/setup-qemu-action@v4
+        if: ${{ matrix.platform != 'linux/arm64' }}
        with:
          cache-image: false
      - uses: docker/setup-buildx-action@v4
@@ -721,7 +577,7 @@ jobs:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
-          node-version: '20'
+          node-version: '24'
      - uses: pnpm/action-setup@v6
        with:
          version: '8.3.1'
@@ -25,7 +25,7 @@ on:
        type: boolean
        default: false
      prerelease_version:
-        description: Develop only, e.g. 0.1.2-beta.0 (alpha/beta/rc)
+        description: Develop only, e.g. 0.1.5-beta.0 (alpha/beta/rc)
        type: string
        default: ''

@@ -93,8 +93,26 @@ jobs:
          if-no-files-found: error
          retention-days: 14

+  platform-smoke:
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, ubuntu-24.04-arm]
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          cache: npm
+          cache-dependency-path: cli/package-lock.json
+      - run: npm ci --prefix cli --no-audit --no-fund
+      - run: npm run build:cli
+      - run: node --test cli/test/remote/platformSmoke.test.cjs
+
  publish:
-    needs: package
+    needs: [package, platform-smoke]
    if: >-
      github.repository == 'whyour/qinglong' &&
      ((github.ref == 'refs/heads/master' &&
@@ -69,15 +69,7 @@ jobs:
          - image: debian
            file: docker/Dockerfile.debian
            cache: debian
-            platforms: linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x
-          - image: alpine-python3.10
-            file: docker/Dockerfile.310
-            cache: alpine-python3.10
-            platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x,linux/386
-          - image: debian-python3.10
-            file: docker/Dockerfile.debian310
-            cache: debian-python3.10
-            platforms: linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x
+            platforms: linux/amd64,linux/arm64,linux/ppc64le,linux/s390x
    steps:
      - uses: actions/checkout@v6
        with:
@@ -27,7 +27,7 @@ export default (app: Router) => {
    celebrate({
      body: Joi.object({
        name: Joi.string().optional().allow('').disallow('system'),
-        scopes: Joi.array().items(Joi.string().required()),
+        scopes: Joi.array().items(Joi.string().required().invalid('apps')),
      }),
    }),
    async (req: Request, res: Response, next: NextFunction) => {
@@ -47,7 +47,7 @@ export default (app: Router) => {
    celebrate({
      body: Joi.object({
        name: Joi.string().optional().allow(''),
-        scopes: Joi.array().items(Joi.string()),
+        scopes: Joi.array().items(Joi.string().invalid('apps')),
        id: Joi.number().required(),
      }),
    }),
@@ -24,7 +24,25 @@ export interface AppToken {
  expiration: number;
 }

-export type AppScope = 'envs' | 'crons' | 'configs' | 'scripts' | 'logs' | 'system' | 'dashboard';
+export type AppScope =
+  | 'crons'
+  | 'crons:read'
+  | 'subscriptions'
+  | 'subscriptions:read'
+  | 'envs'
+  | 'envs:read'
+  | 'configs'
+  | 'configs:read'
+  | 'scripts'
+  | 'scripts:read'
+  | 'logs'
+  | 'logs:read'
+  | 'dependencies'
+  | 'dependencies:read'
+  | 'dashboard'
+  | 'dashboard:read'
+  | 'system'
+  | 'apps';

 export interface AppInstance extends Model<App, App>, App {}
 export const AppModel = sequelize.define<AppInstance>('App', {
@@ -112,7 +112,43 @@ export default ({ app }: { app: Application }) => {
        const keyMatch = pathLower.match(/\/open\/([a-z]+)\/*/);
        const key = keyMatch && keyMatch[1];

-        if (!doc.scopes.includes(key as AppScope)) {
+        const isReadRequest =
+          (['GET', 'HEAD'].includes(req.method) &&
+            !(
+              key === 'crons' && /^\/open\/crons\/import\/?$/.test(pathLower)
+            )) ||
+          (['scripts', 'logs'].includes(key || '') &&
+            req.method === 'POST' &&
+            /^\/open\/(?:scripts|logs)\/download\/?$/.test(pathLower));
+        const hasNamespaceScope =
+          doc.scopes.includes(key as AppScope) ||
+          ([
+            'crons',
+            'subscriptions',
+            'envs',
+            'configs',
+            'scripts',
+            'logs',
+            'dependencies',
+            'dashboard',
+          ].includes(key || '') &&
+            doc.scopes.includes(`${key}:read` as AppScope) &&
+            isReadRequest);
+        if (!hasNamespaceScope) {
+          const err = new UnauthorizedError('credentials_bad_scheme', {
+            message: t('暂无权限'),
+          });
+          return next(err);
+        }
+
+        // The built-in system app still needs its local CLI maintenance API.
+        const appRouteAllowed =
+          key !== 'system' ||
+          doc.name === 'system' ||
+          ((req.method === 'GET' || req.method === 'HEAD') &&
+            (pathLower === '/open/system' || pathLower === '/open/system/')) ||
+          (req.method === 'PUT' && pathLower === '/open/system/notify');
+        if (!appRouteAllowed) {
          const err = new UnauthorizedError('credentials_bad_scheme', {
            message: t('暂无权限'),
          });
@@ -222,6 +222,9 @@ export default async () => {
    }
  } catch { }

+  // Replace legacy task environment files before recovered tasks can run.
+  await envService.set_envs();
+
  // 初始化保存一次ck和定时任务数据
  cronClient.readiness.configure(async () => {
    await cronService.autosave_crontab(true);
@@ -229,8 +232,6 @@ export default async () => {
  });
  await cronClient.readiness.recover();

-  await envService.set_envs();
-
  const authInfo = await userService.getAuthInfo();
  await shareStore.updateAuthInfo(authInfo);
  await openService.refreshApps();
@@ -14,12 +14,17 @@ import {
 } from '../data/env';
 import { writeFileWithLock } from '../shared/utils';
 import { sequelize } from '../data';
+import {
+  assertAllowedTaskEnvName,
+  isAllowedTaskEnvName,
+} from '../shared/taskEnvName';

@Service()
 export default class EnvService {
  constructor(@Inject('logger') private logger: winston.Logger) { }

  public async create(payloads: Env[]): Promise<Env[]> {
+    payloads.forEach((payload) => assertAllowedTaskEnvName(payload.name));
    const envs = await this.envs();
    let position = initPosition;
    if (
@@ -52,6 +57,7 @@ export default class EnvService {
  public async update(payload: Env): Promise<Env> {
    const doc = await this.getDb({ id: payload.id });
    const tab = new Env({ ...doc, ...payload });
+    assertAllowedTaskEnvName(tab.name);
    const newDoc = await this.updateDb(tab);
    await this.set_envs();
    return newDoc;
@@ -151,7 +157,10 @@ export default class EnvService {
        ['position', 'DESC'],
        ['createdAt', 'ASC'],
      ]);
-      return result;
+      return result.map((env) => ({
+        ...env,
+        securityBlocked: !isAllowedTaskEnvName(env.name),
+      }));
    } catch (error) {
      throw error;
    }
@@ -182,11 +191,14 @@ export default class EnvService {
  }

  public async enabled(ids: number[]) {
+    const docs = await EnvModel.findAll({ where: { id: ids } });
+    docs.forEach((doc) => assertAllowedTaskEnvName(doc.name));
    await EnvModel.update({ status: EnvStatus.normal }, { where: { id: ids } });
    await this.set_envs();
  }

  public async updateNames({ ids, name }: { ids: number[]; name: string }) {
+    assertAllowedTaskEnvName(name);
    await EnvModel.update({ name }, { where: { id: ids } });
    await this.set_envs();
  }
@@ -242,6 +254,13 @@ export default class EnvService {
      name: { [Op.not]: null },
      status: EnvStatus.normal,
    });
+    const invalid = envs.filter((env) => !isAllowedTaskEnvName(env.name));
+    if (invalid.length > 0) {
+      this.logger.warn(
+        'Skipped reserved environment variables in task files: %s',
+        JSON.stringify(invalid.map((env) => ({ id: env.id, name: env.name }))),
+      );
+    }
    const groups = groupBy(envs, 'name');
    let env_string = '';
    let js_env_string = '';
@@ -250,8 +269,8 @@ export default class EnvService {
      if (Object.prototype.hasOwnProperty.call(groups, key)) {
        const group = groups[key];

-        // 忽略不符合bash要求的环境变量名称
-        if (/^[a-zA-Z_][0-9a-zA-Z_]*$/.test(key)) {
+        // Ignore invalid and reserved names, including legacy database rows.
+        if (isAllowedTaskEnvName(key)) {
          let value = group
            .map((x) => x.value)
            .join('&')
@@ -8,6 +8,6 @@ export default class LogService {
  constructor(@Inject('logger') private logger: winston.Logger) {}

  public checkFilePath(filePath: string, fileName: string) {
-    return resolveFileAccess(config.logPath, [filePath || '', fileName]);
+    return resolveFileAccess(config.logPath, [filePath || '', fileName], ['.tmp']);
  }
 }
@@ -92,6 +92,10 @@ export default class OpenService {

  private async updateDb(payload: Partial<App>): Promise<App> {
    return this.withAppsLock(async () => {
+      const target = await AppModel.findOne({ where: { id: payload.id } });
+      if (target?.name === 'system' || payload.name === 'system') {
+        throw Object.assign(new Error(t('暂无权限')), { status: 403 });
+      }
      await AppModel.update(payload, { where: { id: payload.id } });
      const apps = await this.find({});
      await shareStore.updateApps(apps);
@@ -109,6 +113,12 @@ export default class OpenService {

  public async remove(ids: number[]) {
    return this.withAppsLock(async () => {
+      const systemApp = await AppModel.findOne({
+        where: { id: ids, name: 'system' },
+      });
+      if (systemApp) {
+        throw Object.assign(new Error(t('暂无权限')), { status: 403 });
+      }
      await AppModel.destroy({ where: { id: ids } });
      const apps = await this.find({});
      await shareStore.updateApps(apps);
@@ -24,8 +24,11 @@ export function resolveFileAccess(
  const resolvedRoot = path.resolve(root);
  const target = path.resolve(resolvedRoot, ...parts);
  if (target === resolvedRoot || !isWithin(resolvedRoot, target)) return '';
+  // File systems such as default APFS can resolve a differently cased spelling
+  // of the same entry. Check every protected name without case sensitivity.
+  const blockedNames = new Set(blacklist.map((part) => part.toLowerCase()));
  const isBlocked = (relative: string) =>
-    relative.split(path.sep).some((part) => blacklist.includes(part));
+    relative.split(path.sep).some((part) => blockedNames.has(part.toLowerCase()));
  if (isBlocked(path.relative(resolvedRoot, target))) return '';
  try {
    const realRoot = fs.realpathSync(resolvedRoot);
@@ -23,6 +23,7 @@ const messages: Record<string, Record<string, string>> = {
    '代理层数不能超过 20': 'Proxy hop count cannot exceed 20',
    '环境变量 QL_TRUST_PROXY 已生效，系统设置不可覆盖':
      'QL_TRUST_PROXY is active and cannot be overridden by system settings',
+    环境变量名称不可使用: 'Environment variable name is reserved or invalid',
    系统配置不存在: 'System configuration does not exist',
    '历史版本仅支持不超过 1 MiB 的 UTF-8 文本脚本':
      'Version history only supports UTF-8 text scripts up to 1 MiB',
@@ -28,7 +28,7 @@ const backend = read(path.resolve(__dirname, '../app.js'));
 const root = process.env.QL_DIR || path.resolve(__dirname, '../../..');
 const version = read(path.join(root, 'version.yaml'))
  ?.toString()
-  .match(/^\uFEFF?version:\s*["']?(\d+\.\d+\.\d+)/m)?.[1];
+  .match(/^\uFEFF?version:\s*["']?(\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?)/m)?.[1];

 export const runtimeBuild = Object.freeze({
  instanceId: randomUUID(),
@@ -0,0 +1,79 @@
+import { t } from './i18n';
+
+// These names control the task runner or the interpreters it starts. Values
+// managed through the environment API must remain task data, not executable
+// configuration.
+const reservedNames = new Set([
+  'TASK_BEFORE',
+  'TASK_AFTER',
+  'WORK_DIR',
+  'TASK_SHELL_PARAMS',
+  'SCRIPT_PARAMS',
+  'WHICH_PROGRAM',
+  'ISJSORPYTHONFILE',
+  'EXPORTED_VARIABLES',
+  'FOUND_DOUBLE_DASH',
+  'LOG_DIR',
+  'LOG_PATH',
+  'ID',
+  'BEGIN_TIMESTAMP',
+  'TIME_FORMAT',
+  'MTIME_FORMAT',
+  'IS_MACOS',
+  'RANDOMDELAY',
+  'RANDOMDELAYFILEEXTENSIONS',
+  'RANDOMDELAYIGNOREDMINUTES',
+  'COMMAND_TIMEOUT_TIME',
+  'SET_U_ON',
+  '_TASK_EXIT_CODE',
+  'PATH',
+  'HOME',
+  'SHELL',
+  'ENV',
+  'BASH_ENV',
+  'BASHOPTS',
+  'SHELLOPTS',
+  'IFS',
+  'CDPATH',
+  'GLOBIGNORE',
+  'PROMPT_COMMAND',
+  'PS4',
+  'NODE_OPTIONS',
+  'NODE_PATH',
+  'PREV_NODE_OPTIONS',
+  'PREV_NODE_PATH',
+  'PREV_PYTHONPATH',
+  'GIT_SSH',
+  'GIT_SSH_COMMAND',
+  'GIT_ASKPASS',
+  'GIT_EXEC_PATH',
+  'GIT_TEMPLATE_DIR',
+  'SSH_ASKPASS',
+]);
+
+export function isAllowedTaskEnvName(name: unknown): name is string {
+  if (typeof name !== 'string' || !/^[a-zA-Z_][0-9a-zA-Z_]*$/.test(name)) {
+    return false;
+  }
+
+  const upper = name.toUpperCase();
+  return (
+    !reservedNames.has(upper) &&
+    !upper.startsWith('BASH_') &&
+    !upper.startsWith('QL') &&
+    !upper.startsWith('FILE_') &&
+    !upper.startsWith('DIR_') &&
+    !upper.startsWith('LD_') &&
+    !upper.startsWith('DYLD_') &&
+    !upper.startsWith('PYTHON') &&
+    !upper.startsWith('GIT_CONFIG_')
+  );
+}
+
+export function assertAllowedTaskEnvName(name: unknown): asserts name is string {
+  if (!isAllowedTaskEnvName(name)) {
+    throw Object.assign(new Error(t('环境变量名称不可使用')), {
+      status: 400,
+    });
+  }
+}
@@ -48,7 +48,7 @@ The CLI also supports task/subscription CRUD, application and secret management,
 ```sh
 ql task create --name demo --command 'task demo.js' --schedule '0 0 * * *' --json
 ql subscription create --type public-repo --url https://example.com/repo.git --alias demo --schedule-type crontab --schedule '0 0 * * *' --json
-ql app create --name agent --scopes crons,subscriptions --show-secrets --json
+ql app create --name agent --scopes crons,subscriptions,envs --show-secrets --json
 ql env create --data @envs.json --json
 ql api request PUT /open/crons/run --data '[12,13]' --json
 ```
@@ -68,7 +68,7 @@ Protected requests use `Authorization: Bearer <token>`. Two credential sources a

 ### Application login

-Create a dedicated panel application with the required scopes, such as crons, subscriptions or envs. `login` and `auth login` are equivalent. Interactive login hides the Client Secret; secret command-line arguments are not supported.
+Create a dedicated panel application with the required scopes. Existing scopes retain their original permissions. For read-only access, use `crons:read`, `subscriptions:read`, `envs:read`, `configs:read`, `scripts:read`, `dependencies:read`, `logs:read`, or `dashboard:read`. Script and log downloads use POST but are available to their read-only scopes. `GET /crons/import` writes tasks and is excluded from `crons:read`. `login` and `auth login` are equivalent. Interactive login hides the Client Secret; secret command-line arguments are not supported.

 ```sh
 ql login --url https://ql.example.com
@@ -76,7 +76,7 @@ ql auth status --scope crons --json
 # For automation, inject QL_CLIENT_ID and QL_CLIENT_SECRET before the same login command
 ```

-Credentials/token are stored in `~/.config/qinglong/cli.json`, a plaintext file owned by the current user with mode 0600. `QL_CLI_CONFIG` selects another file. Login validates application credentials, not every resource permission.
+Credentials/token are stored in `~/.config/qinglong/cli.json` as plaintext. The CLI requests mode `0600` when creating the file and rejects symlinks and non-regular files when reading it. Windows, WSL mounts, and some network or device filesystems do not reliably report POSIX permissions, so reads do not depend on mode bits or UID. Keep the config in a location accessible only to your user and protect it with the filesystem's actual permissions or ACLs; use the direct-token environment variables below if that cannot be guaranteed. `QL_CLI_CONFIG` selects another file. Login validates application credentials, not every resource permission.

 ### Direct access token

@@ -128,11 +128,11 @@ npm run test:cli
 node cli/scripts/verify-package.cjs
 ```

-Tests cover requests, token refresh, output, errors, no automatic retries, permissions and isolated installation. Package verification installs the archive offline, verifies the sole ql executable and rejects local commands.
+Tests cover requests, token refresh, output, errors, no automatic retries, config file type and isolated installation. Package verification installs the archive offline, verifies the sole ql executable and rejects local commands.

-The CLI package workflow checks, builds and tests Node 22.12/24 on relevant PRs, develop/master pushes and manual runs. Node 24 uploads the archive verified by offline installation as `qinglong-cli-<commit>`. After both matrix jobs succeed, master pushes publish that exact archive to npm as latest, using GitHub Actions OIDC trusted publishing without an NPM_TOKEN secret. Manual runs publish only when run on master with publish enabled; PRs, develop and forks never publish. Configure the npm Trusted Publisher for repository `whyour/qinglong`, workflow `cli-package.yml`, with `npm publish` allowed. The panel package `@whyour/qinglong` separately trusts `build-docker-image.yml`. Publishing uses Node 24 with `id-token: write` granted only to the publish job. New packages need an initial publication before configuring their trusted publisher.
+The CLI package workflow checks, builds and tests Node 22.12/24 on relevant PRs, develop/master pushes and manual runs, and verifies saved login and command reads on real Windows and Linux ARM64 filesystems. Node 24 uploads the archive verified by offline installation as `qinglong-cli-<commit>`. After all validation jobs succeed, master pushes publish that exact archive to npm as `latest`; a manual run on master with `publish` enabled can also publish a stable release. Develop pushes only verify. A manual run on develop with `publish` enabled and `prerelease_version` set (for example `0.1.5-beta.0`) publishes under the matching `alpha`, `beta` or `rc` tag. PRs and forks never publish. CLI-only changes do not trigger the main image build, except for the few internal CLI upgrade files used by the image. Configure the npm Trusted Publisher for repository `whyour/qinglong`, workflow `cli-package.yml`, with `npm publish` allowed. The panel package `@whyour/qinglong` separately trusts `build-docker-image.yml`. The publish job uses Node 24 and GitHub Actions OIDC without an `NPM_TOKEN` secret, with `id-token: write` granted only to that job. New packages need an initial publication before configuring their trusted publisher.

-The CLI has an independent stable version in cli/package.json and cli/package-lock.json. Before releasing changes, run `npm version patch --prefix cli --no-git-tag-version` (or minor/major) and commit both files. Existing versions are skipped with a notice; registry failures stop publication. Only stable X.Y.Z versions are published by this workflow. Publication does not rebuild the verified archive or run package lifecycle scripts.
+The CLI stable version is maintained independently in cli/package.json and cli/package-lock.json. Before releasing changes, run `npm version patch --prefix cli --no-git-tag-version` (or minor/major) and commit both files. A develop prerelease version is set only in the workflow run and is not written back to the repository. An existing stable version is skipped with a notice; a duplicate prerelease version fails, as does a registry lookup error. The publish job does not rebuild the verified archive or run package lifecycle scripts.

 ## Panel-internal tools

@@ -48,7 +48,7 @@ ql auth logout --json
 ```sh
 ql task create --name demo --command 'task demo.js' --schedule '0 0 * * *' --json
 ql subscription create --type public-repo --url https://example.com/repo.git --alias demo --schedule-type crontab --schedule '0 0 * * *' --json
-ql app create --name agent --scopes crons,subscriptions --show-secrets --json
+ql app create --name agent --scopes crons,subscriptions,envs --show-secrets --json
 ql env create --data @envs.json --json
 ql api request PUT /open/crons/run --data '[12,13]' --json
 ```
@@ -68,7 +68,7 @@ ql api request PUT /open/crons/run --data '[12,13]' --json

 ### 应用凭据登录

-在面板创建专用应用，按需授予 crons、subscriptions、envs 等权限。`login` 与 `auth login` 等价；交互输入 Client ID 和不回显的 Client Secret，密钥不支持命令行参数。
+在面板创建专用应用，按需授予 crons、subscriptions 等权限。旧 scope 保留原有权限；仅读取时可选用 `crons:read`、`subscriptions:read`、`envs:read`、`configs:read`、`scripts:read`、`dependencies:read`、`logs:read`、`dashboard:read`。脚本和日志下载虽使用 POST，也允许对应只读权限；`GET /crons/import` 会写入任务，不属于只读操作。`login` 与 `auth login` 等价；交互输入 Client ID 和不回显的 Client Secret，密钥不支持命令行参数。

 ```sh
 ql login --url https://ql.example.com
@@ -76,7 +76,7 @@ ql auth status --scope crons --json
 # 自动化环境事先注入 QL_CLIENT_ID 和 QL_CLIENT_SECRET，再运行同一 login 命令
 ```

-凭据和 token 保存到 `~/.config/qinglong/cli.json`，为当前用户所有的 0600 明文文件。`QL_CLI_CONFIG` 可选择其他配置文件。登录只验证应用凭据，不意味着具备所有资源权限。
+凭据和 token 保存到 `~/.config/qinglong/cli.json` 明文文件。CLI 创建文件时会请求 `0600` 权限，并在读取时拒绝符号链接和非普通文件；由于 Windows、WSL 挂载盘及部分网络或设备文件系统不能可靠提供 POSIX 权限位，读取时不以权限位或 UID 为准。请将配置保存在仅当前用户可访问的位置，并按实际文件系统的权限或 ACL 保护它；无法保证时可使用下述环境令牌方式。`QL_CLI_CONFIG` 可选择其他配置文件。登录只验证应用凭据，不意味着具备所有资源权限。

 ### 直接使用访问令牌

@@ -128,11 +128,11 @@ npm run test:cli
 node cli/scripts/verify-package.cjs
 ```

-测试覆盖请求格式、认证刷新、输出、错误、禁止自动重试、权限和独立安装。打包验证会离线安装 tgz，并确认唯一入口是 `ql`，本机命令不可调用。
+测试覆盖请求格式、认证刷新、输出、错误、禁止自动重试、配置文件类型和独立安装。打包验证会离线安装 tgz，并确认唯一入口是 `ql`，本机命令不可调用。

-CLI package 工作流在相关 PR、develop/master 推送和手动触发时执行 Node 22.12/24 类型检查、构建及测试。Node 24 上传通过离线安装验证的 `qinglong-cli-<commit>` artifact。两个矩阵任务成功后，master 推送会将这份已验证的 tgz 发布到 npm 的 latest 标签，通过 GitHub Actions OIDC 可信发布，无需 `NPM_TOKEN` Secret。手动运行需选择 master 并勾选 publish；PR、develop 和 fork 不发布。npm 的 Trusted Publisher 需绑定仓库 `whyour/qinglong` 和工作流 `cli-package.yml`，允许 `npm publish`；面板包 `@whyour/qinglong` 单独绑定 `build-docker-image.yml`。发布 job 使用 Node 24，并仅在该 job 授予 `id-token: write`。新包需先完成首次发布，再配置对应包的可信发布关系。
+CLI package 工作流在相关 PR、develop/master 推送和手动触发时执行 Node 22.12/24 类型检查、构建及测试，并在 Windows 与 Linux ARM64 上用真实文件系统验证登录和命令读取。Node 24 上传通过离线安装验证的 `qinglong-cli-<commit>` artifact。全部验证成功后，master 推送会将这份 tgz 发布到 npm 的 `latest` 标签；手动在 master 勾选 `publish` 也可发布稳定版。develop 推送只验证；手动在 develop 勾选 `publish` 并填写 `prerelease_version`（例如 `0.1.5-beta.0`）可发布到对应的 `alpha`、`beta` 或 `rc` 标签。PR 和 fork 不发布。CLI 专属改动不会触发主镜像构建，少数被镜像使用的 CLI 内部升级文件除外。npm 的 Trusted Publisher 需绑定仓库 `whyour/qinglong` 和工作流 `cli-package.yml`，允许 `npm publish`；面板包 `@whyour/qinglong` 单独绑定 `build-docker-image.yml`。发布 job 使用 Node 24 和 GitHub Actions OIDC，无需 `NPM_TOKEN` Secret，仅该 job 授予 `id-token: write`。新包需先完成首次发布，再配置对应包的可信发布关系。

-CLI 版本独立维护在 cli/package.json 和 cli/package-lock.json。发布改动前执行 `npm version patch --prefix cli --no-git-tag-version`（也可用 minor/major），提交这两个文件。已发布的版本会提示并跳过；registry 查询失败则停止发布。该流程仅发布 X.Y.Z 稳定版本，不重新构建产物或执行包生命周期脚本。
+CLI 稳定版版本号独立维护在 cli/package.json 和 cli/package-lock.json。发布改动前执行 `npm version patch --prefix cli --no-git-tag-version`（也可用 minor/major），提交这两个文件。develop 预发布版版本号仅在工作流运行时设置，不写回仓库。已发布的稳定版版本号会提示并跳过；重复的预发布版版本号会报错，registry 查询失败也会停止发布。发布 job 不重新构建产物或执行包生命周期脚本。

 ## 面板内部工具

@@ -1,12 +1,12 @@
 {
  "name": "@whyour/qinglong-cli",
-  "version": "0.1.3",
+  "version": "0.1.4",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@whyour/qinglong-cli",
-      "version": "0.1.3",
+      "version": "0.1.4",
      "license": "Apache-2.0",
      "bin": {
        "ql": "dist/npm/ql.js"
@@ -1,6 +1,6 @@
 {
  "name": "@whyour/qinglong-cli",
-  "version": "0.1.3",
+  "version": "0.1.4",
  "description": "Authenticated remote management CLI for QingLong 2.x",
  "type": "commonjs",
  "bin": {
@@ -6,11 +6,13 @@ The catalogue covers 146 active routes in the current backend. `ql api routes --

 ## 认证与权限 / Authentication and permissions

-常规使用 `ql login` 的应用凭据。scope 是 /open 后首个路径段：crons、subscriptions、envs、configs、scripts、logs、dependencies、system、dashboard 等。应用管理需要 apps；user、health、update 等路由同样接受服务端权限校验。面板 UI 当前没有列出全部这些 scope，不能把路由存在理解成现有应用已获授权。
+常规使用 `ql login` 的应用凭据。scope 通常对应 /open 后首个路径段：crons、subscriptions、envs、configs、scripts、logs、dependencies、system、dashboard 等。旧 scope 保留原有权限；上述资源除 system 外可选用对应的 `:read` scope。`crons:read` 不包含会写入任务的 `GET /crons/import`；`scripts:read`、`logs:read` 包含使用 POST 的下载，不包含写入、删除或执行。`dashboard:read` 不允许 POST 统计上报。外部应用的 `system` scope 仅允许读取系统状态和发送通知。应用管理需要 apps；`GET /apps` 会返回 Client Secret，因此不提供 `apps:read`。user、health、update 等路由同样接受服务端权限校验。路由存在不代表现有应用已获授权。

-认证步骤、环境变量优先级、应用登录、面板会话与双因素验证、退出行为，统一见 [认证参考](panel.md#authentication)。应用管理可用 apps 权限的应用或授权面板会话；QL_URL/QL_ACCESS_TOKEN 不保存、不刷新，不自动退回应用配置。
+认证步骤、环境变量优先级、应用登录、面板会话与双因素验证、退出行为，统一见 [认证参考](panel.md#authentication)。应用管理可用已有 apps 权限的应用或授权面板会话；后端创建和更新应用时拒绝授予 apps 权限。QL_URL/QL_ACCESS_TOKEN 不保存、不刷新，不自动退回应用配置。

-See the [authentication reference](panel.md#authentication) for application login, direct-token precedence, owner sessions/2FA and logout. App management accepts apps-scoped credentials or an authorized owner session. Direct tokens are not saved/refreshed and never fall back to application configuration.
+See the [authentication reference](panel.md#authentication) for application login, direct-token precedence, owner sessions/2FA and logout. App management accepts existing apps-scoped credentials or an authorized owner session; the backend rejects granting apps scope when creating or updating an application. Direct tokens are not saved/refreshed and never fall back to application configuration.
+
+Existing scopes retain their original access. Use the resource's `:read` scope for read-only access to crons, subscriptions, envs, configs, scripts, dependencies, logs, or dashboard. `crons:read` excludes the mutating `GET /crons/import`; `scripts:read` and `logs:read` include downloads (POST), but exclude writes, deletion, and execution. `dashboard:read` excludes statistics reporting (POST). External `system` applications may only read system status and send notifications. `GET /apps` returns Client Secrets, so there is no `apps:read` scope.

 `auth status --scope <scope>` tests a representative read; update has no read endpoint and is not offered by status. This does not prove permission for every write. `app list/create/update/reset-secret` 默认隐藏 client_secret/tokens；只有明确需要凭据时才加 --show-secrets，并避免把输出记录到共享日志。其他资源/通用请求可能含环境值、配置、脚本、订阅凭据和会话，按敏感数据处理。

@@ -49,6 +51,7 @@ ql script get --query '{"file":"demo.js","path":""}' --json
 ql script history-list --query '{"filename":"demo.js","path":""}' --json
 ql script history-detail --query '{"filename":"demo.js","path":"","id":"VERSION_UUID"}' --json
 ql script history-restore --data '{"filename":"demo.js","path":"","id":"VERSION_UUID","expectedHash":"CURRENT_SHA256"}' --json
+# Requires the full configs scope or a panel session token.
 ql config save --data '{"name":"example.sh","content":"# example"}' --json
 ql config get --query '{"path":"example.sh"}' --json
 ql log download --data '{"filename":"example.log","path":"example"}' --output ./example.log --json
@@ -61,7 +61,9 @@ async function withPanelLifecycle(root, tmp, env, operation, signal) {

 async function targetVersion(source) {
  const text = await fs.readFile(path.join(source, 'version.yaml'), 'utf8');
-  const version = text.match(/^\uFEFF?version:\s*["']?(\d+\.\d+\.\d+)/m)?.[1];
+  const version = text.match(
+    /^\uFEFF?version:\s*["']?(\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?)/m,
+  )?.[1];
  if (!version) throw new Error('Invalid update version');
  return version;
 }
@@ -92,7 +92,9 @@ async function prestartBackend(
      .digest('hex');
    const version = (
      await fs.readFile(path.join(selected.source, 'version.yaml'), 'utf8')
-    ).match(/^\uFEFF?version:\s*["']?(\d+\.\d+\.\d+)/m)?.[1];
+    ).match(
+      /^\uFEFF?version:\s*["']?(\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?)/m,
+    )?.[1];
    // An allowlist prevents NODE_OPTIONS, startup hooks, real data paths and
    // package-manager settings from escaping into the disposable backend.
    const env = {
@@ -17,20 +17,28 @@ export function configPath(): string {
 export function readConfig(): StoredConfig {
  let fd: number | undefined;
  try {
-    fd = fs.openSync(
-      configPath(),
-      fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW,
-    );
+    const file = configPath();
+    const pathStat = fs.lstatSync(file);
+    if (!pathStat.isFile())
+      fail(
+        translate(
+          process.env,
+          'CLI 配置必须是普通文件，且不能是符号链接。',
+        ),
+      );
+    // Not every platform or filesystem implements POSIX mode bits or O_NOFOLLOW.
+    const noFollow = fs.constants.O_NOFOLLOW ?? 0;
+    fd = fs.openSync(file, fs.constants.O_RDONLY | noFollow);
    const stat = fs.fstatSync(fd);
    if (
      !stat.isFile() ||
-      stat.mode & 0o077 ||
-      (process.getuid && stat.uid !== process.getuid())
+      pathStat.dev !== stat.dev ||
+      pathStat.ino !== stat.ino
    ) {
      fail(
        translate(
          process.env,
-          'CLI 配置必须是当前用户拥有的私有普通文件（0600）。',
+          'CLI 配置必须是普通文件，且不能是符号链接。',
        ),
      );
    }
@@ -107,6 +107,14 @@ export async function auth(
      {
        crons: 'crons?page=1&size=1',
        configs: 'configs/files',
+        'envs:read': 'envs',
+        'configs:read': 'configs/files',
+        'scripts:read': 'scripts',
+        'crons:read': 'crons?page=1&size=1',
+        'subscriptions:read': 'subscriptions',
+        'dependencies:read': 'dependencies',
+        'logs:read': 'logs',
+        'dashboard:read': 'dashboard/overview',
        dashboard: 'dashboard/overview',
      } as Record<string, string>
    )[scope] ?? scope,
@@ -26,6 +26,14 @@ export const commands: readonly CommandSpec[] = [
        default: 'crons',
        choices: [
          ...new Set(openOperations.map((op) => op.path.split('/')[0]!)),
+          'envs:read',
+          'configs:read',
+          'scripts:read',
+          'crons:read',
+          'subscriptions:read',
+          'dependencies:read',
+          'logs:read',
+          'dashboard:read',
        ].filter((scope) => !['auth', 'update'].includes(scope)),
      },
    },
@@ -175,8 +175,8 @@ export const english: Record<string, string> = {
    'Request failed or returned invalid JSON. Check the instance URL, network and TLS certificate.',
  'API 请求被拒绝（code %s），请检查%s。':
    'API request rejected (code %s). Check %s.',
-  'CLI 配置必须是当前用户拥有的私有普通文件（0600）。':
-    'CLI config must be an owned private regular file (0600).',
+  'CLI 配置必须是普通文件，且不能是符号链接。':
+    'CLI config must be a regular file, not a symbolic link.',
  'CLI 配置无效，请运行 ql login。': 'Invalid CLI config. Run ql login.',
  '尚未登录，请运行 ql login。': 'Not logged in. Run ql login.',
  '无法读取 CLI 配置，请检查文件权限并运行 ql login。':
@@ -28,12 +28,12 @@ const fs = require('node:fs/promises');
    assert.equal(result.status, 0, args.slice(0, 2).join(' ') + ': ' + result.stderr);
    return JSON.parse(result.stdout).data;
  };
-  const app = cli(['app', 'create', '--name', 'cli-fixture', '--scopes', 'crons,subscriptions,envs,configs,scripts,logs,dependencies,system,dashboard,apps', '--show-secrets'], true);
+  const app = cli(['app', 'create', '--name', 'cli-fixture', '--scopes', 'crons,subscriptions,envs,configs,scripts,logs,dependencies,system,dashboard', '--show-secrets'], true);
  assert.ok(app.client_id && app.client_secret);
  cli(['login', '--url', url], false, { QL_CLIENT_ID: app.client_id, QL_CLIENT_SECRET: app.client_secret });
-  cli(['auth', 'status', '--scope', 'apps']);
-  cli(['app', 'update', String(app.id), '--name', 'cli-updated', '--scopes', 'crons,subscriptions,envs,configs,scripts,logs,dependencies,system,dashboard,apps']);
-  assert.ok(cli(['app', 'list']).every(item => !('client_secret' in item) && !('tokens' in item)));
+  cli(['auth', 'status', '--scope', 'crons']);
+  cli(['app', 'update', String(app.id), '--name', 'cli-updated', '--scopes', 'crons,subscriptions,envs,configs,scripts,logs,dependencies,system,dashboard'], true);
+  assert.ok(cli(['app', 'list'], true).every(item => !('client_secret' in item) && !('tokens' in item)));
  const task = cli(['task', 'create', '--name', 'cli-task', '--command', 'echo OPENAPI_FIXTURE', '--schedule', '0 0 * * *']);
  cli(['task', 'update', String(task.id), '--name', 'cli-task-updated', '--command', 'echo OPENAPI_UPDATED', '--schedule', '0 1 * * *']);
  cli(['task', 'disable', String(task.id)]); cli(['task', 'enable', String(task.id)]);
@@ -81,6 +81,13 @@ async function fixture(t) {
          code: 200,
          data: { data: [{ id: 12, name: 'example' }], total: 1 },
        });
+      else if (
+        ['/panel/open/envs', '/panel/open/configs/files', '/panel/open/scripts',
+          '/panel/open/subscriptions', '/panel/open/dependencies',
+          '/panel/open/logs', '/panel/open/dashboard/overview']
+          .includes(url.pathname)
+      )
+        json({ code: 200, data: [] });
      else if (
        ['/panel/open/crons/run', '/panel/open/crons/stop'].includes(
          url.pathname,
@@ -155,6 +162,21 @@ test('compiled entry: login aliases, private storage, status, refresh and local
  assert.equal(JSON.parse(status.out).data.scopeChecked, 'crons');
  assert.doesNotMatch(status.out, /test-secret|test-token/);
  assert.equal(f.requests.at(-1).url.pathname, '/panel/open/crons');
+  for (const [scope, pathname] of [
+    ['envs:read', '/panel/open/envs'],
+    ['configs:read', '/panel/open/configs/files'],
+    ['scripts:read', '/panel/open/scripts'],
+    ['crons:read', '/panel/open/crons'],
+    ['subscriptions:read', '/panel/open/subscriptions'],
+    ['dependencies:read', '/panel/open/dependencies'],
+    ['logs:read', '/panel/open/logs'],
+    ['dashboard:read', '/panel/open/dashboard/overview'],
+  ]) {
+    const checked = await f.invoke(['auth', 'status', '--scope', scope, '--json']);
+    assert.equal(checked.code, 0, checked.err);
+    assert.equal(JSON.parse(checked.out).data.scopeChecked, scope);
+    assert.equal(f.requests.at(-1).url.pathname, pathname);
+  }
  const config = JSON.parse(fs.readFileSync(f.file));
  config.expiration = 1;
  fs.writeFileSync(f.file, JSON.stringify(config));
@@ -296,11 +318,13 @@ test('malformed successful responses are rejected, including expired authenticat
  failure(await f.invoke(['login', '--url', f.url, '--json']), 1);
 });

-test('config permissions, malformed content and symlinks fail closed', async (t) => {
+test('config content and symlinks are checked independently of permission bits', async (t) => {
  const f = await fixture(t);
  await f.login();
  fs.chmodSync(f.file, 0o644);
-  failure(await f.invoke(['task', 'list', '--json']), 1);
+  const sharedMode = await f.invoke(['task', 'list', '--json']);
+  assert.equal(sharedMode.code, 0, sharedMode.err);
+  assert.equal(JSON.parse(sharedMode.out).data.total, 1);
  fs.chmodSync(f.file, 0o600);
  fs.writeFileSync(f.file, '{broken');
  failure(await f.invoke(['task', 'list', '--json']), 1);
@@ -312,12 +336,73 @@ test('config permissions, malformed content and symlinks fail closed', async (t)
  const target = path.join(f.dir, 'target');
  fs.renameSync(f.file, target);
  fs.symlinkSync(target, f.file);
-  failure(await f.invoke(['task', 'list', '--json']), 1);
+  const linked = await f.invoke(['task', 'list', '--json'], { QL_LANG: 'en' });
+  failure(linked, 1);
+  assert.match(JSON.parse(linked.err).message, /regular file, not a symbolic link/);
  await f.login();
  assert.equal(fs.lstatSync(f.file).isSymbolicLink(), false);
  assert.equal(JSON.parse(fs.readFileSync(target)).clientId, 123);
 });

+test('Windows accepts a saved config despite synthetic 0666 mode bits', async (t) => {
+  const f = await fixture(t);
+  await f.login();
+  const preload = path.join(f.dir, 'windows-mode.cjs');
+  fs.writeFileSync(
+    preload,
+    `Object.defineProperty(process, 'platform', { value: 'win32' });
+const fs = require('node:fs');
+const originalFstatSync = fs.fstatSync;
+const originalOpenSync = fs.openSync;
+fs.openSync = function (file, flags, ...args) {
+  return originalOpenSync(file, typeof flags === 'number'
+    ? flags & ~fs.constants.O_NOFOLLOW : flags, ...args);
+};
+fs.fstatSync = function (...args) {
+  const stat = originalFstatSync(...args);
+  stat.mode = (stat.mode & ~0o777) | 0o666;
+  return stat;
+};\n`,
+  );
+  const env = { NODE_OPTIONS: `--require=${preload}` };
+  const status = await f.invoke(['auth', 'status', '--json'], env);
+  assert.equal(status.code, 0, status.err);
+  assert.equal(JSON.parse(status.out).data.scopeChecked, 'crons');
+  const list = await f.invoke(['task', 'list', '--json'], env);
+  assert.equal(list.code, 0, list.err);
+  assert.equal(JSON.parse(list.out).data.total, 1);
+  const target = path.join(f.dir, 'target');
+  fs.renameSync(f.file, target);
+  fs.symlinkSync(target, f.file);
+  failure(await f.invoke(['task', 'list', '--json'], env), 1);
+});
+
+test('Linux ARM accepts a saved config with synthetic mode and owner', async (t) => {
+  const f = await fixture(t);
+  await f.login();
+  const preload = path.join(f.dir, 'arm-mode.cjs');
+  fs.writeFileSync(
+    preload,
+    `Object.defineProperty(process, 'platform', { value: 'linux' });
+Object.defineProperty(process, 'arch', { value: 'arm' });
+const fs = require('node:fs');
+const originalFstatSync = fs.fstatSync;
+fs.fstatSync = function (...args) {
+  const stat = originalFstatSync(...args);
+  stat.mode = (stat.mode & ~0o777) | 0o666;
+  stat.uid = 999999;
+  return stat;
+};\n`,
+  );
+  const env = { NODE_OPTIONS: `--require=${preload}` };
+  const status = await f.invoke(['auth', 'status', '--json'], env);
+  assert.equal(status.code, 0, status.err);
+  assert.equal(JSON.parse(status.out).data.scopeChecked, 'crons');
+  const list = await f.invoke(['task', 'list', '--json'], env);
+  assert.equal(list.code, 0, list.err);
+  assert.equal(JSON.parse(list.out).data.total, 1);
+});
+
 test('standalone compiled artifact and symlink run without repo runtime dependencies', async (t) => {
  const f = await fixture(t);
  const dist = path.join(f.dir, 'standalone');
@@ -0,0 +1,74 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const http = require('node:http');
+const { spawn } = require('node:child_process');
+
+const entry = path.resolve(__dirname, '../../dist/npm/ql.js');
+
+test('saved login works on the host filesystem', async (t) => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ql-platform-smoke-'));
+  const config = path.join(dir, 'cli.json');
+  const server = http.createServer((req, res) => {
+    const url = new URL(req.url, 'http://127.0.0.1');
+    res.setHeader('content-type', 'application/json');
+    if (url.pathname === '/panel/open/auth/token') {
+      assert.equal(url.searchParams.get('client_id'), 'smoke-id');
+      assert.equal(url.searchParams.get('client_secret'), 'smoke-secret');
+      res.end(JSON.stringify({
+        code: 200,
+        data: {
+          token: 'smoke-token',
+          expiration: Math.floor(Date.now() / 1000) + 3600,
+        },
+      }));
+      return;
+    }
+    assert.equal(req.headers.authorization, 'Bearer smoke-token');
+    assert.equal(url.pathname, '/panel/open/crons');
+    res.end(JSON.stringify({ code: 200, data: { data: [], total: 0 } }));
+  });
+  await new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', resolve);
+  });
+  t.after(async () => {
+    server.closeAllConnections();
+    await new Promise((resolve) => server.close(resolve));
+    fs.rmSync(dir, { recursive: true, force: true });
+  });
+
+  const env = {
+    ...process.env,
+    QL_CLI_CONFIG: config,
+    QL_CLIENT_ID: 'smoke-id',
+    QL_CLIENT_SECRET: 'smoke-secret',
+    QL_URL: '',
+    QL_ACCESS_TOKEN: '',
+  };
+  const invoke = (args) => new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [entry, ...args], {
+      env,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let out = '';
+    let err = '';
+    child.stdout.on('data', (data) => (out += data));
+    child.stderr.on('data', (data) => (err += data));
+    child.once('error', reject);
+    child.once('close', (code) => resolve({ code, out, err }));
+  });
+  const url = `http://127.0.0.1:${server.address().port}/panel`;
+  const login = await invoke(['login', '--url', url, '--json']);
+  assert.equal(login.code, 0, login.err);
+  assert.equal(JSON.parse(login.out).data.authenticated, true);
+  assert.equal(fs.lstatSync(config).isFile(), true);
+  const status = await invoke(['auth', 'status', '--json']);
+  assert.equal(status.code, 0, status.err);
+  assert.equal(JSON.parse(status.out).data.authenticated, true);
+  const list = await invoke(['task', 'list', '--json']);
+  assert.equal(list.code, 0, list.err);
+  assert.equal(JSON.parse(list.out).data.total, 0);
+});
@@ -1,6 +1,6 @@
 # Run Node package installation natively on the builder. Node/npm can spin at
 # 100% CPU when Alpine s390x is emulated through QEMU.
-FROM --platform=$BUILDPLATFORM node:18-alpine3.18 AS builder
+FROM --platform=$BUILDPLATFORM node:24.18.1-alpine3.24 AS builder

 ARG TARGETARCH
 ARG TARGETVARIANT
@@ -32,7 +32,7 @@ RUN set -x \
 # Pin amd64 to upstream's musl runtime after native URL parser crashes with APK Node.
 FROM --platform=linux/amd64 node:24.18.1-alpine3.24@sha256:f70403e87646dc51b45295f4b8b70cdad0b63d2297c4c9899119b03f7af7a6b3 AS node-runtime-amd64

-FROM python:3.11-alpine
+FROM python:3.11-alpine3.24

 ARG TARGETARCH
 ARG TARGETVARIANT
@@ -80,6 +80,7 @@ RUN --mount=type=bind,from=node-runtime-amd64,source=/usr/local/bin/node,target=
       cp /tmp/node-runtime-amd64 /usr/local/bin/node; \
       ln -sf /usr/local/bin/node /usr/bin/node; \
     fi \
+  && node --version | grep -E '^v24\.' \
  && rm -rf /var/cache/apk/* \
  && apk update \
  && ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime \
@@ -1,6 +1,6 @@
 # Run Node package installation natively on the builder. Node/npm can spin at
 # 100% CPU when Alpine s390x is emulated through QEMU.
-FROM --platform=$BUILDPLATFORM node:18-alpine3.18 AS builder
+FROM --platform=$BUILDPLATFORM node:24.18.1-alpine3.24 AS builder

 ARG TARGETARCH
 ARG TARGETVARIANT
@@ -32,7 +32,7 @@ RUN set -x \
 # Pin amd64 to upstream's musl runtime after native URL parser crashes with APK Node.
 FROM --platform=linux/amd64 node:24.18.1-alpine3.24@sha256:f70403e87646dc51b45295f4b8b70cdad0b63d2297c4c9899119b03f7af7a6b3 AS node-runtime-amd64

-FROM python:3.10-alpine
+FROM python:3.10-alpine3.24

 ARG TARGETARCH
 ARG TARGETVARIANT
@@ -80,6 +80,7 @@ RUN --mount=type=bind,from=node-runtime-amd64,source=/usr/local/bin/node,target=
       cp /tmp/node-runtime-amd64 /usr/local/bin/node; \
       ln -sf /usr/local/bin/node /usr/bin/node; \
     fi \
+  && node --version | grep -E '^v24\.' \
  && rm -rf /var/cache/apk/* \
  && apk update \
  && ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime \
@@ -1,6 +1,10 @@
-# Node 20 Bookworm is the latest official Node image variant that covers the
-# full Debian build matrix, including arm/v7, ppc64le, and s390x.
-FROM node:20-bookworm-slim AS nodebuilder
+# Download and verify the target Node archive without running under QEMU.
+FROM --platform=$BUILDPLATFORM debian:bookworm-slim AS nodebuilder
+ARG TARGETARCH
+COPY docker/install-node-debian.sh /tmp/install-node-debian.sh
+RUN apt-get update && \
+  apt-get install --no-install-recommends -y ca-certificates curl xz-utils && \
+  sh /tmp/install-node-debian.sh "${TARGETARCH}"

 FROM python:3.11.14-slim-bookworm AS builder
 COPY package.json .npmrc pnpm-lock.yaml /tmp/build/
@@ -11,6 +15,7 @@ RUN set -x && \
  apt-get update && \
  apt-get install --no-install-recommends -y libatomic1 && \
  npm i -g pnpm@8.3.1 && \
+  test "$(node --version)" = "v24.18.1" && \
  test "$(pnpm --version)" = "8.3.1" && \
  cd /tmp/build && \
  pnpm install --prod --frozen-lockfile
@@ -71,6 +76,7 @@ RUN set -x && \
  git config --global user.name "qinglong" && \
  git config --global http.postBuffer 524288000 && \
  npm install -g pnpm@8.3.1 pm2 ts-node typescript@5 && \
+  test "$(node --version)" = "v24.18.1" && \
  test "$(pnpm --version)" = "8.3.1" && \
  npm cache clean --force && \
  rm -rf /root/.cache && \
@@ -1,8 +1,12 @@
-# Node 20 Bookworm is the latest official Node image variant that covers the
-# full Debian build matrix, including arm/v7, ppc64le, and s390x.
-FROM node:20-bookworm-slim AS nodebuilder
+# Download and verify the target Node archive without running under QEMU.
+FROM --platform=$BUILDPLATFORM debian:bookworm-slim AS nodebuilder
+ARG TARGETARCH
+COPY docker/install-node-debian.sh /tmp/install-node-debian.sh
+RUN apt-get update && \
+  apt-get install --no-install-recommends -y ca-certificates curl xz-utils && \
+  sh /tmp/install-node-debian.sh "${TARGETARCH}"

-# Keep the full release matrix, including s390x, on the same immutable base.
+# Keep s390x on the same immutable Python base as the other Debian targets.
 # The floating 3.10-slim-bookworm tag no longer includes s390x.
 FROM python:3.10.19-slim-bookworm@sha256:23f63358922e79a794f71be8f3723c84e5ccca9638af3f74456dc73d6184499e AS builder
 COPY package.json .npmrc pnpm-lock.yaml /tmp/build/
@@ -13,6 +17,7 @@ RUN set -x && \
  apt-get update && \
  apt-get install --no-install-recommends -y libatomic1 && \
  npm i -g pnpm@8.3.1 && \
+  test "$(node --version)" = "v24.18.1" && \
  cd /tmp/build && \
  pnpm install --prod --frozen-lockfile

@@ -71,6 +76,7 @@ RUN set -x && \
  git config --global user.name "qinglong" && \
  git config --global http.postBuffer 524288000 && \
  npm install -g pnpm@8.3.1 pm2 ts-node typescript@5 && \
+  test "$(node --version)" = "v24.18.1" && \
  npm cache clean --force && \
  rm -rf /root/.cache && \
  rm -rf /root/.npm && \
@@ -0,0 +1,22 @@
+#!/bin/sh
+set -eu
+
+# The official Node 24 Bookworm image does not cover s390x. Use the same
+# verified upstream release archive on every supported Debian architecture.
+version=24.18.1
+case "${1:?Missing Docker TARGETARCH}" in
+  amd64) arch=x64; checksum=d6c664df3f3f61458e8c277585571328522d705166723a7c7823a9253a4d15a0 ;;
+  arm64) arch=arm64; checksum=7201e3a09dc825bac57867c81913e2b8f0ef87d04cb9082af4cda82f6ff3d88c ;;
+  ppc64le) arch=ppc64le; checksum=c47812c13862be7f6e71194c434c4d78a99096e72efb9c31a2627437e056d669 ;;
+  s390x) arch=s390x; checksum=acf57bd726f35afc2ba8475194e5a8bd532c00e1a3b2436295b2fbdde199d0e9 ;;
+  *) echo "Node ${version} has no supported Debian binary for TARGETARCH=$1" >&2; exit 1 ;;
+esac
+
+archive="node-v${version}-linux-${arch}.tar.xz"
+curl --fail --location --silent --show-error --retry 3 \
+  "https://nodejs.org/dist/v${version}/${archive}" -o "/tmp/${archive}"
+printf '%s  %s\n' "${checksum}" "/tmp/${archive}" | sha256sum --check --status
+tar -xJf "/tmp/${archive}" -C /usr/local --strip-components=1 --no-same-owner
+rm "/tmp/${archive}"
+# The target binary is executed and version-checked in the target builder/runtime stages.
+test -x /usr/local/bin/node
@@ -14,35 +14,35 @@ CI 从同次构建的不可变镜像摘要导出完整 tar.gz，包含源码中
 gh workflow run build-docker-image.yml --ref develop
 ```

-开发包更新共用的 `upgrade-develop/latest.json`。`develop` 和 `debian-dev` 镜像都使用该索引，按实际 Node 架构和 musl/glibc 选择包，无需设置测试专用下载源。开发批次位于 `upgrade-build-develop-v<version>-<run-id>-<run-attempt>`，不会改写正式版本或 `upgrade-master`。同一开发渠道的镜像构建和包发布串行执行，与 master 独立。
+开发包只使用 `upgrade-develop` 这一个 prerelease。`develop` 和 `debian-dev` 镜像读取其中的 `latest.json`，按实际 Node 架构和 musl/glibc 选择包，无需设置测试专用下载源。新批次先以带构建 ID 的文件名上传并校验，再切换 `latest.json`；索引仍保留开发版本供客户端判断更新。开发渠道不会改写正式版本或 `upgrade-master`。同一开发渠道的镜像构建和包发布串行执行，与 master 独立。

-开发包只保留最新一个已验证批次：所有平台资产和渠道索引的大小、SHA256 校验成功后，删除其他名称匹配的开发构建 prerelease；不删除正式包、渠道索引或无法分类的旧 release。构建或上传失败不会删除上一套可用包。旧批次被删除后，已选中旧索引但尚未下载完的客户端可能需要重新发起下载；准备失败仍保留旧服务和数据。
+开发包只保留最新一个已验证批次：所有平台资产和渠道索引的大小、SHA256 校验成功后，清理 `upgrade-develop` 中旧批次资产及旧命名的开发构建 prerelease；不删除正式包或无法分类的 release。构建或上传失败不会删除上一套可用包。旧资产被删除后，已选中旧索引但尚未下载完的客户端可能需要重新发起下载；准备失败仍保留旧服务和数据。

-开发和正式包都必须在 12 个平台完成归档、解包后复验及依赖试运行，并且全部上传资产的大小和 SHA256 复验通过后，才更新各自索引。平台范围与现有 Alpine/Debian 镜像一致：ARMv6 仅提供 musl 包，不提供 ARMv6 glibc 包。
+开发和正式包都必须在 11 个平台完成归档、解包后复验及依赖试运行，并且全部上传资产的大小和 SHA256 复验通过后，才更新各自索引。平台范围与现有 Alpine/Debian 镜像一致：ARMv6 和 ARMv7 仅提供 musl 包，Debian 不再发布 ARMv7 镜像或 glibc 平台包。

-版本入口为 GitHub prerelease `upgrade-v<version>` 下的 `latest.json`；在线正式渠道保留 `upgrade-master/latest.json`，兼容现有客户端。二者指向同一套完整包，指定版本与 latest 不重复生成产物。索引记录渠道、版本、源码提交、构建批次、准确字节数、SHA256，以及 `upgrade-build-v<version>-<run-id>-<run-attempt>` 下的固定下载 URL。相同版本的镜像 tag 重新发布时，完整包也重新生成，版本和正式渠道索引同步覆盖到新批次；同一提交重跑也允许产生新内容。已选中旧索引的下载继续使用旧批次资产，避免覆盖文件导致哈希不匹配。master 的镜像构建和完整包发布整条流水线串行执行，避免镜像 tag 与完整包被并发重发交错覆盖；旧工作流明确重跑时也允许同版本、同提交重新发布。过期源码提交不能推进对应渠道或版本索引；平台包上传失败时不切换索引。
+每个正式版本只使用一个 GitHub prerelease `upgrade-v<version>`，其中存放完整平台包、校验文件、安装器和 `latest.json`；在线正式渠道 `upgrade-master` 只保留指向最新版本的 `latest.json`，兼容现有客户端。不再创建 `upgrade-build-v<version>-<run-id>-<run-attempt>` 构建批次 release。索引记录渠道、版本、源码提交、构建批次、准确字节数、SHA256，以及该版本 release 中带构建 ID 的固定资产 URL。相同版本的镜像 tag 重新发布时，先上传并校验新资产，再更新版本索引和正式渠道索引；同一提交重跑也允许产生新内容。旧批次资产保留在同一版本 release，已选中旧索引的下载可继续完成，避免覆盖文件导致哈希不匹配。master 的镜像构建和完整包发布整条流水线串行执行，避免镜像 tag 与完整包被并发重发交错覆盖；旧工作流明确重跑时也允许同版本、同提交重新发布。过期源码提交不能推进对应渠道或版本索引；平台包上传失败时不切换索引。

 ## 手动离线安装和升级

-从 `upgrade-v<version>` 的说明或 `latest.json` 中取得当前批次的下载链接，下载匹配设备的 `.tar.gz` 和独立 `install-bundle.cjs`；两者都来自同一个 `upgrade-build-v<version>-<run-id>-<run-attempt>` release。独立安装器已内置解析依赖，在目标设备正常情况无需 npm、pnpm 或重新安装 SQLite。离线准备和预启动默认不联网；依赖不符合要求时直接报错。可对照同批次 release 的 `latest.json` 核对归档 SHA256。
+从 `upgrade-v<version>` 的说明或 `latest.json` 中取得当前批次的下载链接，下载匹配设备的 `.tar.gz` 和带构建 ID 的独立安装器；两者都来自该版本 release。独立安装器已内置解析依赖，在目标设备正常情况无需 npm、pnpm 或重新安装 SQLite。离线准备和预启动默认不联网；依赖不符合要求时直接报错。可对照同一 release 的 `latest.json` 核对归档 SHA256。

 已有安装（默认应用并重启）：

 ```sh
-node install-bundle.cjs --root /ql --file /absolute/path/qinglong-<commit>-linux-arm64-musl.tar.gz
+node install-bundle-<build-id>.cjs --root /ql --file /absolute/path/qinglong-<commit>-linux-arm64-musl-<build-id>.tar.gz
 ```

 只准备，稍后手动重启：

 ```sh
-node install-bundle.cjs --root /ql --file /absolute/path/package.tar.gz --download-only
+node install-bundle-<build-id>.cjs --root /ql --file /absolute/path/package.tar.gz --download-only
 ql reload system
 ```

 仅在明确允许联网修复时添加 `--repair-deps`（安装和升级均支持），例如：

 ```sh
-node install-bundle.cjs --root /ql --file /absolute/path/package.tar.gz --download-only --repair-deps
+node install-bundle-<build-id>.cjs --root /ql --file /absolute/path/package.tar.gz --download-only --repair-deps
 ```

 修复需要已有 pnpm 8.3.1 及必要编译工具。依赖在私有目录按 `--prod --frozen-lockfile` 重装，仅重建 SQLite；ARMv6 强制源码编译和 ARMv6 硬浮点指令，禁止下载 generic ARM 的 ARMv7 二进制。修复仅执行一次；不安装或替换 Node、不改锁文件、不改已校验源码和静态产物。应用前以原包校验清单和独立记录的修复依赖摘要复验。
@@ -58,13 +58,13 @@ node install-bundle.cjs --root /ql --file /absolute/path/package.tar.gz --downlo
 安装到空目录：

 ```sh
-node install-bundle.cjs --root /opt/qinglong --file /absolute/path/package.tar.gz --install
+node install-bundle-<build-id>.cjs --root /opt/qinglong --file /absolute/path/package.tar.gz --install
 QL_DIR=/opt/qinglong QL_DATA_DIR=/opt/qinglong/data bash /opt/qinglong/shell/start-simplify.sh
 ```

 `--install` 拒绝非空目录，不覆盖既有配置。该包安装青龙及其 Node 生产依赖；首次启动仍需已有 Python、Bash、OpenSSL、PM2、nginx 等相应运行环境，不会在线安装或替换它们。手动启动脚本会在启动工作进程前完成首次 gRPC 证书准备，避免慢设备生成密钥耗尽工作进程的就绪期限；已有证书继续复用。服务启动和系统自启按原手动安装流程配置。

-ARMv6 小设备使用 `linux-armv6-musl.tar.gz`，要求已有兼容的 musl 系统及硬浮点 Node。ARMv6 glibc（例如 Raspbian/Raspberry Pi OS 32 位系统）不在平台包支持范围内，不能使用 ARMv7 或 musl 包替代；安装器仍会检查实际架构和 libc，拒绝不匹配的包。
+ARMv6 小设备使用 `linux-armv6-musl.tar.gz`，要求已有兼容的 musl 系统及硬浮点 Node。ARMv6 glibc（例如 Raspbian/Raspberry Pi OS 32 位系统）不在平台包支持范围内，不能使用其他架构或 musl 包替代；安装器仍会检查实际架构和 libc，拒绝不匹配的包。

 ## npm 面板包

@@ -89,7 +89,7 @@ master 发布任务等待上述测试通过，直接发布已验证的 `.tgz`，
 - 最低 Node 为 20.18.1，Node-API 至少 6；安装器只检查，不替换 Node。
 - 以 Node 实际运行架构、ARM 指令集和 libc 类型/版本选择包；不依据 Docker 架构别名猜测。
 - glibc、musl 分包，并记录构建系统 libc 下限。系统库仍以目标设备加载测试作为最后检查。
- ARMv6 与 ARMv7 使用不同包名。ARMv6 在目标镜像中从源码编译 SQLite，禁止复用 generic `arm` 的 ARMv7 预编译件；构建需通过加载和内存库读写，失败则不发布渠道。
+- ARMv6 保留独立包名。ARMv6 在目标镜像中从源码编译 SQLite，禁止复用 generic `arm` 的 ARMv7 预编译件；构建需通过加载和内存库读写，失败则不发布渠道。
 - ARMv6 的归档构建、在线更新工作进程及独立离线安装器使用 `--jitless`，避开 ARM1176 上 V8 的优化编译崩溃；保留现有 Node 二进制，Node 24 及以上的 ARMv6 面板进程通过共享 `nodeRuntime` 使用 `--no-opt --no-sparkplug --no-maglev`，其他架构和较低 Node 版本保持原启动参数。ARMv6 的 gRPC 工作进程首次启动及重建最多等待 2 分钟；升级后的整体健康检查最多等待 5 分钟，覆盖慢设备按顺序启动数据库、调度与 HTTP 工作进程的耗时；其他平台仍为 60 秒，超时或版本校验失败仍执行回退。依赖加载与后端预启动使用现有 Node 的正常模式，使 Node 20.18.1 的内置 HTTP/WebAssembly 组件保持可用。预启动只有一个后端进程，按顺序初始化数据库、gRPC、HTTP，不启动 PM2/cluster；ARMv6 V8 堆上限 128 MiB、期限 5 分钟，其他平台为 192 MiB/60 秒。堆上限不是 RSS 总内存上限，系统仍需为现有服务和 OpenSSL 留出内存。依赖修复的包管理器及编译使用单并发、低网络并发和有界时长；ARMv6 包管理器采用 `--jitless`、256 MiB 堆上限，并优先复用版本匹配的现有 Node 头文件与实际运行时编译配置；超时、中断会终止整个进程组并清理临时目录。
 - tar 中允许 pnpm 的包内符号链接；拒绝绝对路径、越界路径、包外链接、硬链接、设备条目和经符号链接写入的条目。重启前再次校验依赖，暂存失败保留上一次可用的就绪包。

@@ -0,0 +1,11 @@
+# 青龙 2.24.0-dev.0 开发候选
+
+这是 `develop` 渠道的开发构建，上一正式版本为 2.23.0。此版本尚未正式发布。
+
+## 本轮变化
+
+- Alpine 与 Debian 镜像统一使用 Node.js 24；SQLite 依赖升级至 1.1.4。
+- Alpine 镜像保留 arm/v6 和 arm/v7，Debian 镜像暂不提供 arm/v7。
+- ARM64 升级包改用原生 runner 构建，避免在 x64 QEMU 下归档时发生异常。
+
+升级前请备份完整持久化数据，并在目标设备验证脚本、依赖和通知。正式发布说明将在候选验收后整理。
@@ -0,0 +1,23 @@
+# 青龙 2.24.0
+
+## 新增功能
+
+- Node.js 原生部署支持 Python venv 隔离环境。Python 依赖可使用包名、Git URL，以及位于脚本或订阅仓库中的 requirements 文件和 pyproject.toml；拉取订阅不会自动安装仓库声明的依赖。
+- 新增通知审计日志，便于查看通知发送结果和失败原因。
+- 提供经过平台校验的升级包，支持在线暂存、离线安装及失败回退。升级过程保留账号、配置、环境变量、任务和脚本等数据。
+
+## 修复与优化
+
+- 默认 Alpine 与 Debian 镜像统一使用 Node.js 24；SQLite 依赖升级至 1.1.4。ARM64 升级包使用原生构建环境。
+- 修复额外调度规则校验、单实例任务运行期间的新触发排队、订阅同步、Python 依赖安装与脚本发现等问题。
+- 修复系统日志清理时活跃日志文件被移除、页面加载时序和升级流程中的异常情况，并补齐相关中英文提示。
+- 独立远程 CLI 更新至 0.1.3，最低 Node.js 版本为 22.12.0。
+
+## 镜像与升级提醒
+
+- `2.24.0` 的 Alpine 镜像支持 amd64、arm/v6、arm/v7、arm64、ppc64le、s390x 和 386；`2.24.0-debian` 支持 amd64、arm64、ppc64le 和 s390x。Debian 暂不提供 arm/v7。
+- 2.23.0 是 Python 3.10 兼容镜像的最后一个版本；2.24.0 不再更新该变体。需要 Python 3.10 的用户请先评估迁移方案。
+- 升级前停止任务并备份完整持久化数据目录，记录原镜像摘要和启动配置。升级后检查脚本、依赖、订阅与通知；如需回退，请同时恢复与旧版本匹配的数据备份。
+- 主 npm 包 `@whyour/qinglong` 与独立远程 CLI 包 `@whyour/qinglong-cli` 均提供 `ql` 命令。在已有面板的主机上安装远程 CLI 时，使用独立 npm prefix 或 `npm exec --package=@whyour/qinglong-cli -- ql ...`，避免覆盖面板内置入口。
+
+本版本以 2.23.0 为上一正式版本。开发候选的源码、npm 包与 11 个发布镜像架构已完成隔离验收；正式产物发布后仍以各目标渠道的实际构建结果为准。
@@ -1,7 +1,7 @@
 {
  "name": "@whyour/qinglong",
  "packageManager": "pnpm@8.3.1",
-  "version": "2.23.0",
+  "version": "2.24.0",
  "description": "Timed task management platform supporting Python3, JavaScript, Shell, Typescript",
  "repository": {
    "type": "git",
@@ -13,17 +13,17 @@ const platforms = [
  'linux-s390x-musl',
  'linux-ia32-musl',
  'linux-x64-glibc',
-  'linux-armv7-glibc',
  'linux-arm64-glibc',
  'linux-ppc64-glibc',
  'linux-s390x-glibc',
 ];
 function releaseIndex(directory, commit, repository, options = {}) {
-  const { version, releaseTag = `upgrade-${commit}` } = options;
+  const { version, releaseTag = `upgrade-${commit}`, assetBuildId } = options;
  if (
    !/^[a-f0-9]{40}$/.test(commit) ||
    !/^[\w.-]+\/[\w.-]+$/.test(repository) ||
-    !/^[\w.+-]+$/.test(releaseTag)
+    !/^[\w.+-]+$/.test(releaseTag) ||
+    (assetBuildId && !/^\d+-\d+$/.test(assetBuildId))
  )
    throw new Error('Invalid release source');
  const packages = {};
@@ -48,11 +48,48 @@ function releaseIndex(directory, commit, repository, options = {}) {
      sha256: record.sha256,
      url: `https://github.com/${repository}/releases/download/${encodeURIComponent(
        releaseTag,
-      )}/${filename}`,
+      )}/${
+        assetBuildId
+          ? filename.replace(/\.tar\.gz$/, `-${assetBuildId}.tar.gz`)
+          : filename
+      }`,
    };
  }
  return { format: 2, sourceCommit: commit, packages };
 }
+function stageReleaseAssets(directory, commit, buildId, channel) {
+  const staged = fs.mkdtempSync(path.join(directory, `.upgrade-${channel}-`));
+  const assets = [];
+  try {
+    for (const target of platforms) {
+      const filename = `qinglong-${commit}-${target}.tar.gz`;
+      const archiveName = filename.replace(/\.tar\.gz$/, `-${buildId}.tar.gz`);
+      const archive = path.join(staged, archiveName);
+      fs.linkSync(path.join(directory, filename), archive);
+      const record = JSON.parse(
+        fs.readFileSync(path.join(directory, filename + '.json')),
+      );
+      fs.writeFileSync(
+        archive + '.json',
+        JSON.stringify({
+          ...record,
+          filename: archiveName,
+        }) + '\n',
+      );
+      assets.push(archive, archive + '.json');
+    }
+    const installer = path.join(staged, `install-bundle-${buildId}.cjs`);
+    fs.linkSync(path.join(directory, 'install-bundle.cjs'), installer);
+    assets.push(installer);
+    return { staged, assets };
+  } catch (error) {
+    fs.rmSync(staged, { recursive: true, force: true });
+    throw error;
+  }
+}
+function stageDevelopmentAssets(directory, commit, buildId) {
+  return stageReleaseAssets(directory, commit, buildId, 'develop');
+}
 function publishBundles({
  directory,
  commit,
@@ -76,13 +113,12 @@ function publishBundles({
  // unchanged. Only the version/channel pointer is overwritten, never bytes
  // that an in-flight download has already selected by hash.
  const development = branch === 'develop';
-  const tag = `upgrade-build-${
-    development ? 'develop-' : ''
-  }v${version}-${buildId}`;
+  const tag = development ? 'upgrade-develop' : `upgrade-v${version}`;
  const index = {
    ...releaseIndex(directory, commit, repository, {
      version,
      releaseTag: tag,
+      assetBuildId: buildId,
    }),
    version,
    buildId,
@@ -94,7 +130,7 @@ function publishBundles({
    sha256: sha256(installer),
    url: `https://github.com/${repository}/releases/download/${encodeURIComponent(
      tag,
-    )}/install-bundle.cjs`,
+    )}/install-bundle-${buildId}.cjs`,
  };
  fs.writeFileSync(
    path.join(directory, 'latest.json'),
@@ -114,7 +150,9 @@ function publishBundles({
    }
  };
  const notes =
-    `Verified platform bundles for v${version}, source ${commit}, build ${buildId}. Existing Node runtime is retained.\n\n` +
+    `${
+      development ? 'Development' : 'Verified'
+    } platform bundles for v${version}, source ${commit}, build ${buildId}. Existing Node runtime is retained.\n\n` +
    Object.entries(index.packages)
      .map(([target, entry]) => `- [${target}](${entry.url})`)
      .join('\n') +
@@ -148,118 +186,136 @@ function publishBundles({
    console.log('Newer source exists; leaving version and channel unchanged');
    return false;
  }
-  ensureRelease(tag, `Platform upgrade v${version} (${buildId})`);
-  const assets = platforms
-    .flatMap((target) => {
-      const archive = path.join(
-        directory,
-        `qinglong-${commit}-${target}.tar.gz`,
-      );
-      return [archive, archive + '.json'];
-    })
-    .concat(
-      path.join(directory, 'install-bundle.cjs'),
-      path.join(directory, 'latest.json'),
-    );
-  const published = lookup(tag);
-  const missing = [];
-  const matches = (asset, file) => {
-    const bytes = fs.readFileSync(file);
-    return (
-      asset?.size === bytes.length && asset.digest === `sha256:${sha256(bytes)}`
-    );
-  };
-  for (const file of assets) {
-    const previous = published.assets.find(
-      (a) => a.name === path.basename(file),
-    );
-    if (!previous) missing.push(file);
-    else if (!matches(previous, file))
-      throw new Error(
-        `Immutable release asset differs: ${path.basename(file)}`,
-      );
-  }
-  if (missing.length)
-    gh('release', 'upload', tag, ...missing, '--repo', repository);
-  const uploaded = lookup(tag);
-  if (
-    !assets.every((file) =>
-      matches(
-        uploaded.assets.find((a) => a.name === path.basename(file)),
-        file,
-      ),
-    )
-  )
-    throw new Error('Published platform bundle verification failed');
-
-  // Each channel serializes its image builds and pointer writes as one release.
-  // A rerun of an earlier workflow is allowed to replace the same
-  // version/commit; an obsolete source commit must never advance either alias.
-  const aliases = development
-    ? ['upgrade-develop']
-    : [`upgrade-v${version}`, 'upgrade-master'];
-  for (const ref of aliases) {
-    if (!currentSource()) {
-      console.log('Newer source exists; leaving version and channel unchanged');
-      return false;
-    }
+  const staged = development
+    ? stageDevelopmentAssets(directory, commit, buildId)
+    : stageReleaseAssets(directory, commit, buildId, `v${version}`);
+  try {
    ensureRelease(
-      ref,
-      ref === `upgrade-${branch}`
-        ? `Upgrade channel ${branch}`
-        : `Platform upgrade v${version}`,
+      tag,
+      development ? 'Upgrade channel develop' : `Platform upgrade v${version}`,
    );
-    gh(
-      'release',
-      'upload',
-      ref,
-      path.join(directory, 'latest.json'),
-      '--repo',
-      repository,
-      '--clobber',
-    );
-    gh('release', 'edit', ref, '--repo', repository, '--notes', notes);
+    const assets = staged.assets;
+    const published = lookup(tag);
+    const missing = [];
+    const matches = (asset, file) => {
+      const bytes = fs.readFileSync(file);
+      return (
+        asset?.size === bytes.length &&
+        asset.digest === `sha256:${sha256(bytes)}`
+      );
+    };
+    for (const file of assets) {
+      const previous = published.assets.find(
+        (a) => a.name === path.basename(file),
+      );
+      if (!previous) missing.push(file);
+      else if (!matches(previous, file))
+        throw new Error(
+          `Immutable release asset differs: ${path.basename(file)}`,
+        );
+    }
+    if (missing.length)
+      gh('release', 'upload', tag, ...missing, '--repo', repository);
+    const uploaded = lookup(tag);
    if (
-      !matches(
-        lookup(ref)?.assets.find((a) => a.name === 'latest.json'),
-        path.join(directory, 'latest.json'),
+      !assets.every((file) =>
+        matches(
+          uploaded.assets.find((a) => a.name === path.basename(file)),
+          file,
+        ),
      )
    )
-      throw new Error('Published channel index verification failed');
-  }
-  // Only prune development releases after the complete new batch and its
-  // channel pointer are verified. Production versions and aliases are retained.
-  if (development && currentSource()) {
-    const pages = JSON.parse(
-      gh(
-        'api',
-        `repos/${repository}/releases?per_page=100`,
-        '--paginate',
-        '--slurp',
-      ),
-    );
-    for (const release of pages.flat()) {
-      if (
-        release.tag_name !== tag &&
-        /^upgrade-build-develop-v\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?-\d+-\d+$/.test(
-          release.tag_name,
-        ) &&
-        release.prerelease === true &&
-        release.draft === false
-      ) {
-        if (!currentSource()) break;
-        gh(
-          'release',
-          'delete',
-          release.tag_name,
-          '--repo',
-          repository,
-          '--yes',
+      throw new Error('Published platform bundle verification failed');
+
+    // Each channel serializes its image builds and pointer writes as one release.
+    // A rerun of an earlier workflow is allowed to replace the same
+    // version/commit; an obsolete source commit must never advance either alias.
+    const aliases = development ? ['upgrade-develop'] : [tag, 'upgrade-master'];
+    for (const ref of aliases) {
+      if (!currentSource()) {
+        console.log(
+          'Newer source exists; leaving version and channel unchanged',
        );
+        return false;
+      }
+      ensureRelease(
+        ref,
+        ref === `upgrade-${branch}`
+          ? `Upgrade channel ${branch}`
+          : `Platform upgrade v${version}`,
+      );
+      gh(
+        'release',
+        'upload',
+        ref,
+        path.join(directory, 'latest.json'),
+        '--repo',
+        repository,
+        '--clobber',
+      );
+      gh('release', 'edit', ref, '--repo', repository, '--notes', notes);
+      if (
+        !matches(
+          lookup(ref)?.assets.find((a) => a.name === 'latest.json'),
+          path.join(directory, 'latest.json'),
+        )
+      )
+        throw new Error('Published channel index verification failed');
+    }
+    // Only prune development releases after the complete new batch and its
+    // channel pointer are verified. Production versions and aliases are retained.
+    if (development && currentSource()) {
+      const currentAssets = new Set(assets.map((file) => path.basename(file)));
+      for (const asset of lookup(tag).assets) {
+        if (
+          !currentAssets.has(asset.name) &&
+          (/^qinglong-[a-f0-9]{40}-linux-[\w-]+-\d+-\d+\.tar\.gz(?:\.json)?$/.test(
+            asset.name,
+          ) ||
+            /^install-bundle-\d+-\d+\.cjs$/.test(asset.name))
+        ) {
+          if (!currentSource()) break;
+          gh(
+            'api',
+            '-X',
+            'DELETE',
+            `repos/${repository}/releases/assets/${asset.id}`,
+          );
+        }
+      }
+      const pages = JSON.parse(
+        gh(
+          'api',
+          `repos/${repository}/releases?per_page=100`,
+          '--paginate',
+          '--slurp',
+        ),
+      );
+      for (const release of pages.flat()) {
+        if (
+          release.tag_name !== tag &&
+          /^upgrade-build-develop-(?:v\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?-)?\d+-\d+$/.test(
+            release.tag_name,
+          ) &&
+          release.prerelease === true &&
+          release.draft === false
+        ) {
+          if (!currentSource()) break;
+          gh(
+            'release',
+            'delete',
+            release.tag_name,
+            '--repo',
+            repository,
+            '--yes',
+          );
+        }
      }
    }
+    return true;
+  } finally {
+    fs.rmSync(staged.staged, { recursive: true, force: true });
  }
-  return true;
 }
 module.exports = { releaseIndex, platforms, publishBundles };
 if (require.main === module) {
@@ -112,6 +112,7 @@
  "代理端口": "Proxy Port",
  "以后再说": "Later",
  "仪表盘": "Dashboard",
+  "仪表盘（只读）": "Dashboard (read only)",
  "任务": "Task",
  "任务数": "Tasks",
  "任务未运行": "Task not running",
@@ -122,6 +123,7 @@
  "使用手机应用扫描二维码，或者输入秘钥": "Scan the QR code with the mobile app or enter the key",
  "依赖文件": "Dependency Files",
  "依赖管理": "Dependency Management",
+  "依赖管理（只读）": "Dependencies (read only)",
  "依赖类型": "Dependency Type",
  "依赖缓存": "Dependency cache",
  "依赖设置": "Dependence Settings",
@@ -188,6 +190,8 @@
  "可用，你使用的版本为": "available, the version you are using is",
  "同时删除关联任务和脚本": "Delete associated tasks and scripts as well",
  "名称": "Name",
+  "名称受限": "Restricted name",
+  "名称受限，未注入任务": "Restricted name; not injected into tasks",
  "名称不能为保留关键字": "The name cannot be a reserved keyword",
  "吗": "?",
  "否": "No",
@@ -228,6 +232,7 @@
  "完成设置": "Finish Setup",
  "定时": "Schedule",
  "定时任务": "Scheduled Tasks",
+  "定时任务（只读）": "Scheduled Tasks (read only)",
  "定时任务并发数": "Concurrent Scheduled Tasks",
  "定时类型": "Schedule Type",
  "定时规则": "Schedule Rule",
@@ -331,6 +336,7 @@
  "日志名称只能包含中文、字母、数字、下划线、连字符、点和路径分隔符": "Log name can only contain Chinese characters, letters, numbers, underscores, hyphens, dots, and path separators",
  "日志文件": "Log files",
  "日志管理": "Log Management",
+  "日志管理（只读）": "Logs (read only)",
  "时": "hour(s)",
  "时区": "Timezone",
  "是": "Yes",
@@ -411,6 +417,7 @@
  "版本": "Version",
  "状态": "Status",
  "环境变量": "Environment variable",
+  "环境变量（只读）": "Environment variables (read only)",
  "生成数据中...": "Generating data...",
  "用于访问所有私有仓库的全局SSH私钥": "Global SSH private key for accessing all private repositories",
  "用户令牌，扫描登录后 我的—>设置->令牌 中获取，参考 https://www.weplusbot.com/": "Token, which can be obtained after scanning and logging in, is available under 'My Account' -> 'Settings' -> 'Tokens'. Please refer to the instructions for detailed steps: https://www.weplusbot.com/",
@@ -494,6 +501,7 @@
  "脚本执行时的工作目录，留空则自动检测。相对路径基于 scripts 目录，也支持绝对路径": "Working directory for script execution. Leave blank for auto-detection. Relative paths are based on the scripts directory. Absolute paths are also supported.",
  "脚本文件": "Script files",
  "脚本管理": "Script Management",
+  "脚本（只读）": "Scripts (read only)",
  "自动删除任务": "Automatically Delete Tasks",
  "自动拆分": "Auto Split",
  "自动添加任务": "Automatically Add Tasks",
@@ -508,11 +516,13 @@
  "视图管理": "View Management",
  "订阅": "Subscription",
  "订阅管理": "Subscription Management",
+  "订阅管理（只读）": "Subscriptions (read only)",
  "设置": "Settings",
  "访问密钥": "Access Key",
  "语言": "Language",
  "请": "Please",
  "请先按如下方式修复：": "Please fix it as follows:",
+  "请先修改环境变量名称": "Rename the environment variable first",
  "请求体格式key1: value1，多个换行分割。url或者body中必须包含$title，$content可选，对应api内容的位置": "Request body format: key1: value1 (separate multiple keys with line breaks). URL or body must contain $title, $content is optional and corresponds to the API content position.",
  "请求头Content-Type": "Request Header Content-Type",
  "请求头格式Custom-Header1: Header1，多个换行分割": "Request header format: Custom-Header1: Header1 (separate multiple headers with line breaks)",
@@ -606,6 +616,7 @@
  "邮箱服务名称，比如126、163、Gmail、QQ等，支持列表https://github.com/nodemailer/nodemailer/blob/master/lib/well-known/services.json": "Email service name, e.g., 126, 163, Gmail, QQ, etc. Supported list: https://github.com/nodemailer/nodemailer/blob/master/lib/well-known/services.json",
  "邮箱认证地址": "Email address for SMTP authentication",
  "配置文件": "Configuration Files",
+  "配置文件（只读）": "Configuration files (read only)",
  "重启": "Restart",
  "重命名": "Rename",
  "重新下载": "Redownload",
@@ -111,6 +111,7 @@
  "代理端口": "代理端口",
  "以后再说": "以后再说",
  "仪表盘": "仪表盘",
+  "仪表盘（只读）": "仪表盘（只读）",
  "任务": "任务",
  "任务数": "任务数",
  "任务未运行": "任务未运行",
@@ -121,6 +122,7 @@
  "使用手机应用扫描二维码，或者输入秘钥": "使用手机应用扫描二维码，或者输入秘钥",
  "依赖文件": "依赖文件",
  "依赖管理": "依赖管理",
+  "依赖管理（只读）": "依赖管理（只读）",
  "依赖类型": "依赖类型",
  "依赖缓存": "依赖缓存",
  "依赖设置": "依赖设置",
@@ -187,6 +189,8 @@
  "可用，你使用的版本为": "可用，你使用的版本为",
  "同时删除关联任务和脚本": "同时删除关联任务和脚本",
  "名称": "名称",
+  "名称受限": "名称受限",
+  "名称受限，未注入任务": "名称受限，未注入任务",
  "名称不能为保留关键字": "名称不能为保留关键字",
  "吗": "吗",
  "否": "否",
@@ -227,6 +231,7 @@
  "完成设置": "完成设置",
  "定时": "定时",
  "定时任务": "定时任务",
+  "定时任务（只读）": "定时任务（只读）",
  "定时任务并发数": "定时任务并发数",
  "定时类型": "定时类型",
  "定时规则": "定时规则",
@@ -330,6 +335,7 @@
  "日志名称只能包含中文、字母、数字、下划线、连字符、点和路径分隔符": "日志名称只能包含中文、字母、数字、下划线、连字符、点和路径分隔符",
  "日志文件": "日志文件",
  "日志管理": "日志管理",
+  "日志管理（只读）": "日志管理（只读）",
  "时": "时",
  "时区": "时区",
  "是": "是",
@@ -411,6 +417,7 @@
  "版本": "版本",
  "状态": "状态",
  "环境变量": "环境变量",
+  "环境变量（只读）": "环境变量（只读）",
  "生成数据中...": "生成数据中...",
  "用于访问所有私有仓库的全局SSH私钥": "用于访问所有私有仓库的全局SSH私钥",
  "用户令牌，扫描登录后 我的—>设置->令牌 中获取，参考 https://www.weplusbot.com/": "用户令牌，扫描登录后 我的—>设置->令牌 中获取，参考 https://www.weplusbot.com/",
@@ -494,6 +501,7 @@
  "脚本执行时的工作目录，留空则自动检测。相对路径基于 scripts 目录，也支持绝对路径": "脚本执行时的工作目录，留空则自动检测。相对路径基于 scripts 目录，也支持绝对路径",
  "脚本文件": "脚本文件",
  "脚本管理": "脚本管理",
+  "脚本（只读）": "脚本（只读）",
  "自动删除任务": "自动删除任务",
  "自动拆分": "自动拆分",
  "自动添加任务": "自动添加任务",
@@ -508,11 +516,13 @@
  "视图管理": "视图管理",
  "订阅": "订阅",
  "订阅管理": "订阅管理",
+  "订阅管理（只读）": "订阅管理（只读）",
  "设置": "设置",
  "访问密钥": "访问密钥",
  "语言": "语言",
  "请": "请",
  "请先按如下方式修复：": "请先按如下方式修复：",
+  "请先修改环境变量名称": "请先修改环境变量名称",
  "请求体格式key1: value1，多个换行分割。url或者body中必须包含$title，$content可选，对应api内容的位置": "请求体格式key1: value1，多个换行分割。url或者body中必须包含$title，$content可选，对应api内容的位置",
  "请求头Content-Type": "请求头Content-Type",
  "请求头格式Custom-Header1: Header1，多个换行分割": "请求头格式Custom-Header1: Header1，多个换行分割",
@@ -606,6 +616,7 @@
  "邮箱服务名称，比如126、163、Gmail、QQ等，支持列表https://github.com/nodemailer/nodemailer/blob/master/lib/well-known/services.json": "邮箱服务名称，比如126、163、Gmail、QQ等，支持列表https://github.com/nodemailer/nodemailer/blob/master/lib/well-known/services.json",
  "邮箱认证地址": "邮箱认证地址",
  "配置文件": "配置文件",
+  "配置文件（只读）": "配置文件（只读）",
  "重启": "重启",
  "重命名": "重命名",
  "重新下载": "重新下载",
@@ -174,7 +174,7 @@ const Env = () => {
      title: intl.get('状态'),
      key: 'status',
      dataIndex: 'status',
-      width: 100,
+      width: 170,
      filters: [
        {
          text: intl.get('已启用'),
@@ -192,6 +192,13 @@ const Env = () => {
            <Tag color={StatusColor[record.status]} style={{ marginRight: 0 }}>
              {intl.get(Status[record.status])}
            </Tag>
+            {record.securityBlocked && (
+              <Tooltip title={intl.get('名称受限，未注入任务')}>
+                <Tag color="warning" style={{ marginRight: 0 }}>
+                  {intl.get('名称受限')}
+                </Tag>
+              </Tooltip>
+            )}
          </Space>
        );
      },
@@ -202,6 +209,8 @@ const Env = () => {
      width: 160,
      render: (text: string, record: any, index: number) => {
        const isPc = !isPhone;
+        const isBlockedEnable =
+          record.status === Status.已禁用 && record.securityBlocked;
        return (
          <Space size="middle">
            <Tooltip title={isPc ? intl.get('编辑') : ''}>
@@ -212,7 +221,9 @@ const Env = () => {
            <Tooltip
              title={
                isPc
-                  ? record.status === Status.已禁用
+                  ? isBlockedEnable
+                    ? intl.get('请先修改环境变量名称')
+                    : record.status === Status.已禁用
                    ? intl.get('启用')
                    : intl.get('禁用')
                  : ''
@@ -278,6 +289,10 @@ const Env = () => {
  };

  const enabledOrDisabledEnv = (record: any, index: number) => {
+    if (record.status === Status.已禁用 && record.securityBlocked) {
+      message.error(intl.get('请先修改环境变量名称'));
+      return;
+    }
    Modal.confirm({
      title: intl.get('确认操作', {
        operation:
@@ -538,6 +553,13 @@ const Env = () => {
  };

  const operateEnvs = (operationStatus: number) => {
+    if (
+      operationStatus === 0 &&
+      value.some((env) => selectedRowIds.includes(env.id) && env.securityBlocked)
+    ) {
+      message.error(intl.get('请先修改环境变量名称'));
+      return;
+    }
    Modal.confirm({
      title: intl.get('确认操作', {
        operation: intl.get(OperationName[operationStatus]),
@@ -20,30 +20,58 @@ export default {
      name: intl.get('定时任务'),
      value: 'crons',
    },
+    {
+      name: intl.get('定时任务（只读）'),
+      value: 'crons:read',
+    },
    {
      name: intl.get('环境变量'),
      value: 'envs',
    },
+    {
+      name: intl.get('环境变量（只读）'),
+      value: 'envs:read',
+    },
    {
      name: intl.get('订阅管理'),
      value: 'subscriptions',
    },
+    {
+      name: intl.get('订阅管理（只读）'),
+      value: 'subscriptions:read',
+    },
    {
      name: intl.get('配置文件'),
      value: 'configs',
    },
+    {
+      name: intl.get('配置文件（只读）'),
+      value: 'configs:read',
+    },
    {
      name: intl.get('脚本管理'),
      value: 'scripts',
    },
+    {
+      name: intl.get('脚本（只读）'),
+      value: 'scripts:read',
+    },
    {
      name: intl.get('日志管理'),
      value: 'logs',
    },
+    {
+      name: intl.get('日志管理（只读）'),
+      value: 'logs:read',
+    },
    {
      name: intl.get('依赖管理'),
      value: 'dependencies',
    },
+    {
+      name: intl.get('依赖管理（只读）'),
+      value: 'dependencies:read',
+    },
    {
      name: intl.get('系统信息'),
      value: 'system',
@@ -52,17 +80,29 @@ export default {
      name: intl.get('仪表盘'),
      value: 'dashboard',
    },
+    {
+      name: intl.get('仪表盘（只读）'),
+      value: 'dashboard:read',
+    },
  ],
  scopesMap: {
    crons: intl.get('定时任务'),
+    'crons:read': intl.get('定时任务（只读）'),
    envs: intl.get('环境变量'),
+    'envs:read': intl.get('环境变量（只读）'),
    subscriptions: intl.get('订阅管理'),
+    'subscriptions:read': intl.get('订阅管理（只读）'),
    configs: intl.get('配置文件'),
+    'configs:read': intl.get('配置文件（只读）'),
    scripts: intl.get('脚本管理'),
+    'scripts:read': intl.get('脚本（只读）'),
    logs: intl.get('日志管理'),
+    'logs:read': intl.get('日志管理（只读）'),
    dependencies: intl.get('依赖管理'),
+    'dependencies:read': intl.get('依赖管理（只读）'),
    system: intl.get('系统信息'),
    dashboard: intl.get('仪表盘'),
+    'dashboard:read': intl.get('仪表盘（只读）'),
  },
  notificationModes: [
    { value: 'gotify', label: 'Gotify' },
@@ -43,6 +43,104 @@ test('environment values remain literal when the generated JavaScript loads', as
  );
 });

+test('environment API rejects execution controls and legacy rows stay out of task files', async () => {
+  const output = {};
+  let writes = 0;
+  const warnings = [];
+  const legacy = [
+    { id: 1, name: 'task_before', value: 'touch /tmp/untrusted' },
+    { id: 2, name: 'NODE_OPTIONS', value: '--require /tmp/untrusted.js' },
+    { id: 3, name: 'PREV_NODE_OPTIONS', value: '--import=data:text/javascript,bad' },
+    { id: 4, name: 'GIT_SSH_COMMAND', value: 'sh -c bad' },
+    { id: 5, name: 'PATH', value: '/tmp/untrusted' },
+    { id: 6, name: 'file_task_before', value: '/tmp/untrusted.sh' },
+    { id: 7, name: 'SAFE_VALUE', value: 'kept' },
+    { id: 8, name: 'bad\nname', value: 'untrusted' },
+    { id: 9, name: 'work_dir', value: '/tmp/untrusted' },
+    { id: 10, name: 'task_shell_params', value: 'other.sh' },
+    { id: 11, name: 'which_program', value: 'bash' },
+    { id: 12, name: 'script_params', value: 'other.sh' },
+    { id: 13, name: 'LOG_DIR', value: '../../config' },
+    { id: 14, name: 'EXPORTED_VARIABLES', value: 'PATH' },
+    { id: 15, name: 'begin_timestamp', value: 'a[$(printf BAD)]' },
+    { id: 16, name: 'is_macos', value: 'a[$(printf BAD)]' },
+    { id: 17, name: 'RandomDelayIgnoredMinutes', value: 'a[$(printf BAD)]' },
+    { id: 18, name: 'ID', value: '999' },
+    { id: 19, name: 'BASH_XTRACEFD', value: '2' },
+  ];
+  const Env = load(path.resolve('back/services/env.ts'), {
+    typedi: decorators,
+    '../config': { envFile: 'sh', jsEnvFile: 'js', pyEnvFile: 'py' },
+    '../data/env': {
+      Env: class { constructor(value) { Object.assign(this, value); } },
+      EnvModel: {
+        update: async (value, query) => {
+          writes++;
+        },
+        findAll: async () => [legacy[0]],
+      },
+      EnvStatus: { normal: 0, disabled: 1 },
+    },
+    '../data': { sequelize: { literal: (value) => value } },
+    '../shared/utils': {
+      writeFileWithLock: async (file, value) => { output[file] = value; },
+    },
+  }).default;
+  const service = new Env({
+    ...logger,
+    warn: (...args) => warnings.push(args),
+  });
+  service.envs = async () => legacy;
+  service.insert = async () => { writes++; return []; };
+  service.getDb = async () => ({ id: 1, name: 'SAFE_VALUE', value: 'kept' });
+  service.updateDb = async () => { writes++; return {}; };
+
+  for (const name of [
+    'task_before', 'PREV_NODE_OPTIONS', 'GIT_SSH_COMMAND', 'work_dir',
+    'task_shell_params', 'which_program', 'script_params', 'LOG_DIR',
+    'EXPORTED_VARIABLES',
+    'begin_timestamp', 'is_macos', 'RandomDelayIgnoredMinutes', 'ID',
+    'BASH_XTRACEFD',
+  ]) {
+    await assert.rejects(
+      service.create([
+        { name: 'SAFE_VALUE', value: 'ok' },
+        { name, value: 'untrusted' },
+      ]),
+      /环境变量名称不可使用/,
+    );
+  }
+  await assert.rejects(
+    service.update({ id: 1, name: 'BASH_ENV', value: '/tmp/untrusted.sh' }),
+    /环境变量名称不可使用/,
+  );
+  await assert.rejects(
+    service.updateNames({ ids: [1], name: 'PYTHONPATH' }),
+    /环境变量名称不可使用/,
+  );
+  assert.equal(writes, 0);
+
+  await service.set_envs();
+  assert.equal(writes, 0);
+  assert.equal(warnings.length, 1);
+  assert.match(warnings[0][1], /GIT_SSH_COMMAND/);
+  assert.equal(warnings[0][1].includes('\n'), false);
+  await assert.rejects(service.enabled([1]), /环境变量名称不可使用/);
+  assert.equal(writes, 0);
+  delete service.envs;
+  service.find = async () => legacy;
+  const listed = await service.envs();
+  assert.equal(listed[0].securityBlocked, true);
+  assert.equal(listed[6].securityBlocked, false);
+  for (const contents of Object.values(output)) {
+    assert.doesNotMatch(
+      contents,
+      /task_before|NODE_OPTIONS|GIT_SSH_COMMAND|PATH|work_dir|task_shell_params|which_program|script_params|LOG_DIR|EXPORTED_VARIABLES|begin_timestamp|is_macos|RandomDelayIgnoredMinutes|ID|BASH_XTRACEFD/,
+    );
+    assert.match(contents, /SAFE_VALUE/);
+  }
+});
+
 test('subscription shell parameters round trip without expansion or command substitution', () => {
  const { formatCommand } = load(path.resolve('back/config/subscription.ts'));
  const payload =
@@ -0,0 +1,69 @@
+const assert = require('node:assert/strict');
+const test = require('node:test');
+const express = require('express');
+const { errors } = require('celebrate');
+const path = require('node:path');
+const load = require('../helpers/load-security-module.cjs');
+
+test('application API rejects granting apps scope on create and update', async (t) => {
+  const calls = [];
+  class OpenService {}
+  const service = {
+    create: async (body) => {
+      calls.push(['create', body]);
+      return body;
+    },
+    update: async (body) => {
+      calls.push(['update', body]);
+      return body;
+    },
+  };
+  const route = load(path.join(__dirname, '../../back/api/open.ts'), {
+    '../services/open': OpenService,
+    typedi: { Container: { get: () => service } },
+  }).default;
+  const app = express();
+  app.use(express.json());
+  for (const prefix of ['/api', '/open']) {
+    const router = express.Router();
+    route(router);
+    app.use(prefix, router);
+  }
+  app.use(errors());
+  const server = app.listen(0, '127.0.0.1');
+  t.after(() => new Promise((resolve) => server.close(resolve)));
+  await new Promise((resolve, reject) => {
+    server.once('listening', resolve);
+    server.once('error', reject);
+  });
+  const request = async (prefix, method, body) => {
+    const response = await fetch(
+      `http://127.0.0.1:${server.address().port}${prefix}/apps`,
+      {
+        method,
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(body),
+      },
+    );
+    return response.status;
+  };
+  for (const prefix of ['/api', '/open']) {
+    assert.equal(
+      await request(prefix, 'POST', { name: 'new', scopes: ['crons', 'apps'] }),
+      400,
+    );
+    assert.equal(
+      await request(prefix, 'PUT', { id: 1, scopes: ['apps'] }),
+      400,
+    );
+    assert.equal(
+      await request(prefix, 'POST', { name: 'new', scopes: ['crons:read'] }),
+      200,
+    );
+    assert.equal(
+      await request(prefix, 'PUT', { id: 1, scopes: ['crons'] }),
+      200,
+    );
+  }
+  assert.equal(calls.length, 4);
+});
@@ -51,8 +51,6 @@ test('release images receive the same-run artifact and verify it before use', ()
  for (const name of [
    'build-alpine',
    'build-debian',
-    'build-alpine310',
-    'build-debian310',
  ]) {
    const job = workflow.jobs[name];
    assert.equal(job.needs, 'build-static');
@@ -115,7 +115,9 @@ for (const customData of [false, true]) {
      );
    for (const name of [
      'token.json',
+      'TOKEN.JSON',
      'grpc/client.key',
+      'Grpc/client.key',
      'secret-link',
      'data/scripts/secret-link',
      'data/scripts/../config/token.json',
@@ -176,5 +178,23 @@ test('log APIs allow configuration-like names while retaining directory boundari
    ])
      assert.equal((await invoke(method, route, values)).code, 403, filename);
  }
+  const hidden = path.join(config.logPath, '.tmp', 'own_user.list');
+  fs.mkdirSync(path.dirname(hidden), { recursive: true });
+  fs.writeFileSync(hidden, 'hidden task command');
+  for (const values of [
+    { path: '.tmp', file: 'own_user.list', filename: 'own_user.list' },
+    { path: '.TMP', file: 'own_user.list', filename: 'own_user.list' },
+    { path: '', file: '.tmp/own_user.list', filename: '.tmp/own_user.list' },
+    { path: '', file: '.Tmp/own_user.list', filename: '.Tmp/own_user.list' },
+  ]) {
+    for (const [method, route] of [
+      ['get', '/detail'],
+      ['post', '/download'],
+      ['delete', '/'],
+    ]) {
+      assert.equal((await invoke(method, route, values)).code, 403);
+    }
+  }
+  assert.equal(fs.readFileSync(hidden, 'utf8'), 'hidden task command');
  assert.equal(fs.readFileSync(secret, 'utf8'), 'PANEL-SECRET');
 });
@@ -24,11 +24,14 @@ test('file access enforces directory boundaries, blacklist descendants and symli
    '../config-other/secret',
    '/etc/passwd',
    'grpc/client.key',
+    'GRPC/client.key',
    'alias/client.key',
    'outside/new.txt',
    'dangling',
    'auth.json',
+    'AUTH.JSON',
    'nested/auth.json',
+    'nested/Auth.Json',
    '',
  ]) {
    assert.equal(
@@ -13,6 +13,7 @@ test('HTTP authentication protects init, scopes, expired sessions and config sec
    fs.mkdirSync(path.join(tmp, dir), { recursive: true });
  fs.writeFileSync(path.join(tmp, 'config/grpc/client.key'), 'SENTINEL');
  fs.writeFileSync(path.join(tmp, 'config/normal.txt'), 'normal');
+  fs.writeFileSync(path.join(tmp, 'config/config.sh'), 'original');
  const secret = 'http-security-test';
  const valid = jwt.sign({}, secret, { algorithm: 'HS384', expiresIn: '1h' });
  const expired = jwt.sign({}, secret, { algorithm: 'HS384', expiresIn: -1 });
@@ -51,6 +52,10 @@ test('HTTP authentication protects init, scopes, expired sessions and config sec
      scopes: ['configs'],
      tokens: [{ value: 'config-app', expiration: Date.now() / 1000 + 3600 }],
    },
+    {
+      scopes: ['configs:read'],
+      tokens: [{ value: 'config-read-app', expiration: Date.now() / 1000 + 3600 }],
+    },
    {
      scopes: ['configs', 'scripts'],
      tokens: [
@@ -61,13 +66,55 @@ test('HTTP authentication protects init, scopes, expired sessions and config sec
      scopes: ['scripts'],
      tokens: [{ value: 'script-app', expiration: Date.now() / 1000 + 3600 }],
    },
+    {
+      scopes: ['scripts:read'],
+      tokens: [{ value: 'script-read-app', expiration: Date.now() / 1000 + 3600 }],
+    },
    {
      scopes: ['envs'],
      tokens: [{ value: 'env-app', expiration: Date.now() / 1000 + 3600 }],
    },
+    {
+      scopes: ['envs:read'],
+      tokens: [{ value: 'env-read-app', expiration: Date.now() / 1000 + 3600 }],
+    },
+    {
+      name: 'external-system',
+      scopes: ['system'],
+      tokens: [{ value: 'system-app', expiration: Date.now() / 1000 + 3600 }],
+    },
+    {
+      name: 'system',
+      scopes: ['system'],
+      tokens: [{ value: 'internal-system', expiration: Date.now() / 1000 + 3600 }],
+    },
  ];
+  for (const scope of ['crons', 'subscriptions', 'dependencies', 'logs', 'dashboard']) {
+    for (const suffix of ['', ':read']) {
+      apps.push({
+        scopes: [`${scope}${suffix}`],
+        tokens: [{
+          value: `${scope}${suffix}-app`,
+          expiration: Date.now() / 1000 + 3600,
+        }],
+      });
+    }
+  }
+  let resetCalls = 0;
+  let commandCalls = 0;
+  let envWriteCalls = 0;
+  let scopedMutationCalls = 0;
  let initialized = 0;
  const User = class {};
+  const Script = class {
+    getFile(folder, filename) {
+      return fs.promises.readFile(path.join(config.scriptPath, folder, filename), 'utf8');
+    }
+    checkFilePath(folder, filename) {
+      return path.join(config.scriptPath, folder || '', filename);
+    }
+  };
+  const script = new Script();
  const user = {
    initializeUser: async () => {
      initialized++;
@@ -90,7 +137,7 @@ test('HTTP authentication protects init, scopes, expired sessions and config sec
    },
    '../config/serverEnv': { serveEnv: (_req, res) => res.end() },
    '../services/user': User,
-    '../services/script': class {},
+    '../services/script': Script,
    '../data/open': {},
    '../data/system': {},
    typedi: { Service: () => (x) => x },
@@ -111,7 +158,8 @@ test('HTTP authentication protects init, scopes, expired sessions and config sec
  mocks.typedi = {
    ...mocks.typedi,
    Container: {
-      get: (x) => (x === User ? user : x === History ? history : configService),
+      get: (x) =>
+        x === User ? user : x === History ? history : x === Script ? script : configService,
    },
  };
  mocks['../api'] = () => {
@@ -126,6 +174,41 @@ test('HTTP authentication protects init, scopes, expired sessions and config sec
      historyCache,
    ).default(router);
    router.get('/envs', (_req, res) => res.json({ code: 200 }));
+    router.post('/envs', (_req, res) => {
+      envWriteCalls++;
+      res.json({ code: 200 });
+    });
+    for (const route of [
+      '/crons', '/subscriptions', '/dependencies', '/logs', '/dashboard/overview',
+    ]) {
+      router.get(route, (_req, res) => res.json({ code: 200 }));
+    }
+    for (const [method, route] of [
+      ['put', '/crons/run'],
+      ['put', '/subscriptions/run'],
+      ['post', '/dependencies'],
+      ['delete', '/logs'],
+      ['post', '/dashboard/record'],
+      ['get', '/crons/import'],
+    ]) {
+      router[method](route, (_req, res) => {
+        scopedMutationCalls++;
+        res.json({ code: 200 });
+      });
+    }
+    router.post('/logs/download', (_req, res) =>
+      res.json({ code: 200, data: 'downloaded' }),
+    );
+    router.get('/system', (_req, res) => res.json({ code: 200 }));
+    router.put('/system/notify', (_req, res) => res.json({ code: 200 }));
+    router.put('/system/auth/reset', (_req, res) => {
+      resetCalls++;
+      res.json({ code: 200 });
+    });
+    router.put('/system/command-run', (_req, res) => {
+      commandCalls++;
+      res.json({ code: 200 });
+    });
    return router;
  };
  const app = express();
@@ -203,6 +286,68 @@ test('HTTP authentication protects init, scopes, expired sessions and config sec
    assert.equal((await request(`${prefix}/envs`)).status, 401, prefix);
  }
  assert.equal((await request('/open/envs', 'env-app')).body.code, 200);
+  assert.equal((await request('/open/envs', 'env-read-app')).body.code, 200);
+  for (const prefix of ['/open', '/panel/open']) {
+    assert.equal(
+      (await request(`${prefix}/envs`, 'env-read-app', 'POST', [
+        { name: 'SAFE_VALUE', value: 'kept' },
+      ])).status,
+      401,
+    );
+  }
+  assert.equal(envWriteCalls, 0);
+  assert.equal(
+    (await request('/open/envs', 'env-app', 'POST', [
+      { name: 'SAFE_VALUE', value: 'kept' },
+    ])).body.code,
+    200,
+  );
+  assert.equal(envWriteCalls, 1);
+  for (const [scope, readPath, method, writePath] of [
+    ['crons', '/crons', 'PUT', '/crons/run'],
+    ['subscriptions', '/subscriptions', 'PUT', '/subscriptions/run'],
+    ['dependencies', '/dependencies', 'POST', '/dependencies'],
+    ['logs', '/logs', 'DELETE', '/logs'],
+    ['dashboard', '/dashboard/overview', 'POST', '/dashboard/record'],
+  ]) {
+    for (const prefix of ['/open', '/panel/open']) {
+      assert.equal(
+        (await request(`${prefix}${readPath}`, `${scope}:read-app`)).body.code,
+        200,
+      );
+      assert.equal(
+        (await request(`${prefix}${writePath}`, `${scope}:read-app`, method))
+          .status,
+        401,
+      );
+    }
+    assert.equal(
+      (await request(`/open${writePath}`, `${scope}-app`, method)).body.code,
+      200,
+    );
+  }
+  assert.equal(scopedMutationCalls, 5);
+  for (const prefix of ['/open', '/panel/open']) {
+    assert.equal(
+      (await request(`${prefix}/crons/import`, 'crons:read-app')).status,
+      401,
+    );
+    assert.equal(
+      (await request(`${prefix}/logs/download`, 'logs:read-app', 'POST'))
+        .body.data,
+      'downloaded',
+    );
+  }
+  const importedWithHead = await fetch(
+    `http://127.0.0.1:${server.address().port}/open/crons/import`,
+    { method: 'HEAD', headers: { Authorization: 'Bearer crons:read-app' } },
+  );
+  assert.equal(importedWithHead.status, 401);
+  assert.equal(
+    (await request('/open/crons/import', 'crons-app')).body.code,
+    200,
+  );
+  assert.equal(scopedMutationCalls, 6);
  assert.equal(
    (await request('/open/configs/detail?path=normal.txt', 'env-app')).status,
    401,
@@ -212,6 +357,58 @@ test('HTTP authentication protects init, scopes, expired sessions and config sec
      .data,
    'normal',
  );
+  assert.equal(
+    (await request('/open/configs/detail?path=normal.txt', 'config-read-app'))
+      .body.data,
+    'normal',
+  );
+  for (const prefix of ['/open', '/panel/open']) {
+    for (const name of ['normal.txt', 'config.sh', 'task_before.sh']) {
+      assert.equal(
+        (await request(`${prefix}/configs/save`, 'config-read-app', 'POST', {
+          name,
+          content: 'untrusted',
+        })).status,
+        401,
+      );
+    }
+  }
+  assert.equal(fs.readFileSync(path.join(tmp, 'config/config.sh'), 'utf8'), 'original');
+  assert.equal((await request('/open/system', 'system-app')).body.code, 200);
+  assert.equal(
+    (await request('/open/system/notify', 'system-app', 'PUT', {
+      title: 'title',
+      content: 'content',
+    })).body.code,
+    200,
+  );
+  for (const prefix of ['/open', '/panel/open']) {
+    assert.equal(
+      (await request(`${prefix}/system/auth/reset`, 'system-app', 'PUT', {
+        password: 'changed',
+      })).status,
+      401,
+    );
+    assert.equal(
+      (await request(`${prefix}/system/command-run`, 'system-app', 'PUT', {
+        command: 'id',
+      })).status,
+      401,
+    );
+  }
+  assert.equal(resetCalls, 0);
+  assert.equal(commandCalls, 0);
+  assert.equal(
+    (await request('/open/system/auth/reset', 'internal-system', 'PUT', {
+      retries: 0,
+    })).body.code,
+    200,
+  );
+  assert.equal(
+    (await request('/api/system/auth/reset', valid, 'PUT', { retries: 0 })).body.code,
+    200,
+  );
+  assert.equal(resetCalls, 2);
  assert.equal(
    (await request('/open/configs/detail?path=grpc/client.key', 'config-app'))
      .body.code,
@@ -277,6 +474,14 @@ test('HTTP authentication protects init, scopes, expired sessions and config sec
    ).body.code,
    200,
  );
+  assert.equal(
+    (await request('/api/configs/save', valid, 'POST', {
+      name: 'config.sh',
+      content: 'owner config',
+    })).body.code,
+    200,
+  );
+  assert.equal(fs.readFileSync(path.join(tmp, 'config/config.sh'), 'utf8'), 'owner config');
  assert.equal(
    (
      await request('/api/configs/save', valid, 'POST', {
@@ -296,6 +501,15 @@ test('HTTP authentication protects init, scopes, expired sessions and config sec
      ).status,
      401,
    );
+    assert.equal(
+      (
+        await request(`${prefix}/scripts`, 'script-read-app', 'POST', {
+          filename: 'test.js',
+          content: 'unauthorized',
+        })
+      ).status,
+      401,
+    );
    assert.equal(
      (
        await request(`${prefix}/scripts`, 'script-app', 'POST', {
@@ -310,4 +524,38 @@ test('HTTP authentication protects init, scopes, expired sessions and config sec
      'authorized script',
    );
  }
+  assert.equal(
+    (await request('/open/scripts/detail?file=test.js', 'script-read-app')).body
+      .data,
+    'authorized script',
+  );
+  const downloaded = await fetch(
+    `http://127.0.0.1:${server.address().port}/open/scripts/download`,
+    {
+      method: 'POST',
+      headers: {
+        Authorization: 'Bearer script-read-app',
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ filename: 'test.js' }),
+    },
+  );
+  assert.equal(downloaded.status, 200);
+  assert.equal(await downloaded.text(), 'authorized script');
+  for (const method of ['PUT', 'DELETE']) {
+    assert.equal(
+      (await request('/open/scripts', 'script-read-app', method, {
+        filename: 'test.js', content: 'unauthorized',
+      })).status,
+      401,
+    );
+  }
+  for (const path of ['run', 'stop', 'rename', 'history/restore']) {
+    assert.equal(
+      (await request(`/open/scripts/${path}`, 'script-read-app', 'PUT', {
+        filename: 'test.js', content: 'unauthorized',
+      })).status,
+      401,
+    );
+  }
 });
@@ -273,8 +273,6 @@ test('Gitee workflows verify both mirrors and do not gate image publication', ()
  for (const name of [
    'build-alpine',
    'build-debian',
-    'build-alpine310',
-    'build-debian310',
  ]) {
    assert.equal(workflow.jobs[name].needs, 'build-static');
  }
@@ -220,7 +220,7 @@ test('npm publication consumes the exact archive whose isolated installation pas
  const download = workflow.jobs.publish.steps.find((step) => step.uses?.startsWith('actions/download-artifact@'));
  assert.equal(download.with.name, 'qinglong-npm-${{ github.sha }}');
  const publication = workflow.jobs.publish.steps.find((step) => step.name === 'Publish npm package with OIDC');
-  assert.match(publication.run, /npm publish "\$archive" --ignore-scripts/);
+  assert.match(publication.run, /npm publish "\.\/\$archive" --ignore-scripts/);
  assert.ok(!workflow.jobs.publish.steps.some((step) => /pnpm build/.test(step.run || '')));
 });

@@ -12,12 +12,10 @@ const publication = workflow.jobs.publish.steps.find(
  (step) => step.name === 'Publish npm package with OIDC',
 ).run;

-test('npm publication waits for every release image, including Python 3.10', () => {
+test('npm publication waits for every supported release image', () => {
  for (const name of [
    'build-alpine',
    'build-debian',
-    'build-alpine310',
-    'build-debian310',
  ])
    assert.ok(workflow.jobs.publish.needs.includes(name), name);
 });
@@ -77,7 +75,7 @@ case 'network': console.log('upstream unavailable'); process.exit(1);
    assert.equal(fs.existsSync(path.join(root, 'published')), published);
    if (published)
      assert.deepEqual(JSON.parse(fs.readFileSync(path.join(root, 'published'), 'utf8')), [
-        'npm-panel/verified.tgz', '--ignore-scripts', '--access', 'public', '--registry=https://registry.npmjs.org',
+        './npm-panel/verified.tgz', '--ignore-scripts', '--access', 'public', '--registry=https://registry.npmjs.org',
      ]);
  });
 }
@@ -19,7 +19,7 @@ const {
  sourceCommit,
 } = require('../helpers/upgrade-fixture.cjs');

-async function fixture(t) {
+async function fixture(t, targetVersion = '2.24.0') {
  const base = await fs.mkdtemp(path.join(os.tmpdir(), 'ql-panel-job-'));
  const root = path.join(base, 'panel'),
    tmp = path.join(root, '.tmp');
@@ -30,7 +30,10 @@ async function fixture(t) {
    await fs.writeFile(name, contents);
  };
  for (const dir of [root, source]) {
-    await write(path.join(dir, 'package.json'), '{"version":"2.24.0"}');
+    await write(
+      path.join(dir, 'package.json'),
+      JSON.stringify({ version: targetVersion }),
+    );
    await write(path.join(dir, 'pnpm-lock.yaml'), 'lock');
    await write(path.join(dir, 'sample/config.sample.sh'), '# config');
  }
@@ -39,7 +42,7 @@ async function fixture(t) {
    'installed dependency',
  );
  await write(path.join(root, 'version.yaml'), 'version: 2.23.0');
-  await write(path.join(source, 'version.yaml'), 'version: 2.24.0');
+  await write(path.join(source, 'version.yaml'), `version: ${targetVersion}`);
  await write(path.join(staticRoot, 'build/app.js'), 'new backend');
  writeManifest(source, staticRoot);
  for (const repo of ['qinglong', 'qinglong-static'])
@@ -81,7 +84,7 @@ fs.writeFileSync(args[args.indexOf('--output') + 1], buffer);
  );
  await fs.chmod(path.join(base, 'bin/curl'), 0o700);
  const runtime = {
-    version: '2.24.0',
+    version: targetVersion,
    sourceCommit,
    instanceId: 'after-restart',
    parentPid: 100002,
@@ -186,6 +189,21 @@ test('detached download survives its initiating request and is idempotent; apply
  );
 });

+test('prerelease version is retained through download and restart verification', async (t) => {
+  const f = await fixture(t, '2.24.0-dev.0');
+  await startJob(f, 'download');
+  const ready = await finished(f.tmp);
+  assert.equal(ready.status, 'ready', ready.log);
+  assert.equal(ready.version, '2.24.0-dev.0');
+  await startJob(f, 'apply');
+  const complete = await finished(f.tmp);
+  assert.equal(complete.status, 'completed', complete.log);
+  assert.equal(
+    await fs.readFile(path.join(f.root, 'version.yaml'), 'utf8'),
+    'version: 2.24.0-dev.0',
+  );
+});
+
 test('invalid staged payload fails asynchronously before stopping the panel', async (t) => {
  const f = await fixture(t);
  await startJob(f, 'download');
@@ -591,7 +591,9 @@ test('publishing requires every platform and validates all immutable archive has
    );
  }
  const index = releaseIndex(f.directory, sourceCommit, repository);
-  assert.equal(Object.keys(index.packages).length, 12);
+  assert.equal(Object.keys(index.packages).length, 11);
+  assert.ok(index.packages['linux-armv7-musl']);
+  assert.equal(index.packages['linux-armv7-glibc'], undefined);
  const armv6 = path.join(
    f.directory,
    `qinglong-${sourceCommit}-linux-armv6-musl.tar.gz`,
@@ -66,6 +66,17 @@ function fixture(t) {
  const gh = (...args) => {
    state.calls.push(args);
    if (args[0] === 'api') {
+      if (args[1] === '-X' && args[2] === 'DELETE') {
+        if (state.failDelete) throw new Error('Delete unavailable');
+        const id = Number(args[3].split('/').at(-1));
+        for (const release of state.releases.values())
+          for (const asset of release.values())
+            if (asset.id === id) {
+              release.delete(asset.name);
+              return '';
+            }
+        return notFound();
+      }
      const route = args[1];
      if (route.endsWith('/git/ref/heads/master')) return state.head;
      if (route.endsWith('/git/ref/heads/develop')) return state.developHead;
@@ -127,7 +138,11 @@ function fixture(t) {
          digest: `sha256:${sha256(bytes)}`,
        });
      }
-      if (tag === 'upgrade-develop' && state.corruptChannel)
+      if (
+        files.some((file) => path.basename(file) === 'latest.json') &&
+        ((tag === 'upgrade-develop' && state.corruptChannel) ||
+          tag === state.corruptIndexTag)
+      )
        release.get('latest.json').digest = 'sha256:wrong';
      if (files.length > 1) {
        if (state.corruptUploadedBatch)
@@ -162,14 +177,19 @@ test('publishes every platform and installer before advancing version and legacy
  assert.equal(index.version, '2.24.0');
  assert.equal(index.buildId, '100-1');
  assert.equal(index.sourceCommit, f.options.commit);
-  assert.equal(Object.keys(index.packages).length, 12);
+  assert.equal(Object.keys(index.packages).length, 11);
+  assert.ok(index.packages['linux-armv7-musl']);
+  assert.equal(index.packages['linux-armv7-glibc'], undefined);
  assert.deepEqual(index, f.index('upgrade-v2.24.0'));
-  const tag = 'upgrade-build-v2.24.0-100-1';
-  assert.equal(f.state.releases.get(tag).size, 26);
+  const tag = 'upgrade-v2.24.0';
+  assert.equal(f.state.releases.get(tag).size, 24);
+  assert.equal(f.state.releases.get('upgrade-master').size, 1);
+  assert.ok(!f.state.releases.has('upgrade-build-v2.24.0-100-1'));
  for (const entry of [...Object.values(index.packages), index.installer]) {
    const url = new URL(entry.url),
      filename = path.basename(url.pathname);
    assert.ok(url.pathname.includes(`/releases/download/${tag}/`));
+    assert.ok(filename.includes('-100-1.'));
    const bytes = f.state.releases.get(tag).get(filename).bytes;
    assert.equal(bytes.length, entry.size);
    assert.equal(sha256(bytes), entry.sha256);
@@ -179,7 +199,7 @@ test('publishes every platform and installer before advancing version and legacy
  );
  assert.deepEqual(
    writes.map((a) => a[2]),
-    [tag, 'upgrade-v2.24.0', 'upgrade-master'],
+    [tag, tag, 'upgrade-master'],
  );
  assert.ok(writes.slice(1).every((a) => a.includes('--clobber')));
 });
@@ -192,10 +212,10 @@ for (const sameCommit of [false, true])
    f.publish();
    const before = f.index();
    const oldAssets = new Map(
-      Array.from(
-        f.state.releases.get('upgrade-build-v2.24.0-100-1'),
-        ([name, a]) => [name, a.bytes.toString('base64')],
-      ),
+      Array.from(f.state.releases.get('upgrade-v2.24.0'), ([name, a]) => [
+        name,
+        a.bytes.toString('base64'),
+      ]).filter(([name]) => name !== 'latest.json'),
    );
    const commit = sameCommit ? f.options.commit : 'b'.repeat(40);
    f.state.head = commit;
@@ -217,13 +237,14 @@ for (const sameCommit of [false, true])
    assert.notEqual(after.installer.sha256, before.installer.sha256);
    assert.deepEqual(
      new Map(
-        Array.from(
-          f.state.releases.get('upgrade-build-v2.24.0-100-1'),
-          ([name, a]) => [name, a.bytes.toString('base64')],
-        ),
+        Array.from(f.state.releases.get('upgrade-v2.24.0'), ([name, a]) => [
+          name,
+          a.bytes.toString('base64'),
+        ]).filter(([name]) => oldAssets.has(name)),
      ),
      oldAssets,
    );
+    assert.equal(f.state.releases.get('upgrade-v2.24.0').size, 47);
  });

 test('retrying a publication is idempotent, but changed bytes require a new build ID', (t) => {
@@ -234,7 +255,8 @@ test('retrying a publication is idempotent, but changed bytes require a new buil
      (a) =>
        a[0] === 'release' &&
        a[1] === 'upload' &&
-        a[2] === 'upgrade-build-v2.24.0-100-1',
+        a[2] === 'upgrade-v2.24.0' &&
+        !a.includes('--clobber'),
    ).length;
  assert.equal(count(), 1);
  f.publish();
@@ -244,6 +266,41 @@ test('retrying a publication is idempotent, but changed bytes require a new buil
  assert.equal(f.index().buildId, '100-1');
 });

+test('a new version keeps the previous version release while master advances', (t) => {
+  const f = fixture(t);
+  f.publish();
+  const previous = f.index('upgrade-v2.24.0');
+  const commit = 'b'.repeat(40);
+  f.state.head = commit;
+  f.write(commit, 'next version', '2.25.0');
+  assert.equal(
+    f.publish({ commit, version: '2.25.0', buildId: '101-1' }),
+    true,
+  );
+  assert.deepEqual(f.index('upgrade-v2.24.0'), previous);
+  assert.equal(f.state.releases.get('upgrade-v2.24.0').size, 24);
+  assert.equal(f.state.releases.get('upgrade-v2.25.0').size, 24);
+  assert.equal(f.state.releases.get('upgrade-master').size, 1);
+  assert.equal(f.index().version, '2.25.0');
+  assert.ok(!f.state.releases.has('upgrade-build-v2.25.0-101-1'));
+});
+
+test('a failed version index verification leaves master on the previous version', (t) => {
+  const f = fixture(t);
+  f.publish();
+  const previous = f.index();
+  const commit = 'b'.repeat(40);
+  f.state.head = commit;
+  f.write(commit, 'next version', '2.25.0');
+  f.state.corruptIndexTag = 'upgrade-v2.25.0';
+  assert.throws(
+    () => f.publish({ commit, version: '2.25.0', buildId: '101-1' }),
+    /Published channel index verification failed/,
+  );
+  assert.deepEqual(f.index(), previous);
+  assert.deepEqual(f.index('upgrade-v2.24.0'), previous);
+});
+
 for (const fault of ['missing', 'corrupt', 'wrong-version'])
  test(`incomplete, corrupt or wrong-version packages never publish (${fault})`, (t) => {
    const f = fixture(t);
@@ -283,7 +340,7 @@ test('stale commits do not publish; a source change during upload cannot advance
  const before = f.index();
  f.state.head = 'b'.repeat(40);
  assert.equal(f.publish({ buildId: '101-1' }), false);
-  assert.ok(!f.state.releases.has('upgrade-build-v2.24.0-101-1'));
+  assert.equal(f.state.releases.get('upgrade-v2.24.0').size, 24);
  f.state.head = f.options.commit;
  f.state.changeHeadAfterUpload = true;
  assert.equal(f.publish({ buildId: '102-1' }), false);
@@ -335,38 +392,58 @@ test('existing master clients can migrate from indexes without version/build met
  assert.equal(f.index().buildId, '100-2');
 });

-test('automatic development publication shares musl/glibc packages without changing version or latest production assets', (t) => {
+test('automatic development publication keeps its prerelease version separate from production assets', (t) => {
  const f = fixture(t);
  f.publish();
  const production = f.index();
-  f.write(f.state.developHead, 'development');
+  const developmentVersion = '2.24.0-dev.0';
+  f.write(f.state.developHead, 'development', developmentVersion);
  assert.equal(
    f.publish({
      branch: 'develop',
      commit: f.state.developHead,
+      version: developmentVersion,
    }),
    true,
  );
  const development = f.index('upgrade-develop');
  assert.equal(development.channel, 'develop');
+  assert.equal(development.version, developmentVersion);
  assert.equal(development.sourceCommit, f.state.developHead);
-  assert.equal(Object.keys(development.packages).length, 12);
+  assert.equal(Object.keys(development.packages).length, 11);
  assert.ok(development.packages['linux-x64-musl']);
  assert.ok(development.packages['linux-x64-glibc']);
  assert.ok(development.packages['linux-armv6-musl']);
  assert.equal(development.packages['linux-armv6-glibc'], undefined);
+  assert.ok(development.packages['linux-armv7-musl']);
+  assert.equal(development.packages['linux-armv7-glibc'], undefined);
  for (const entry of [
    ...Object.values(development.packages),
    development.installer,
  ])
-    assert.ok(entry.url.includes('/upgrade-build-develop-v2.24.0-100-1/'));
+    assert.ok(entry.url.includes('/upgrade-develop/'));
+  for (const entry of Object.values(development.packages))
+    assert.ok(entry.url.endsWith('-100-1.tar.gz'));
+  assert.ok(development.installer.url.endsWith('/install-bundle-100-1.cjs'));
+  assert.ok(
+    f.state.calls.some(
+      (args) =>
+        args[0] === 'release' &&
+        args[1] === 'create' &&
+        args[2] === 'upgrade-develop' &&
+        args[args.indexOf('--title') + 1] === 'Upgrade channel develop',
+    ),
+  );
  assert.deepEqual(f.index(), production);
  assert.deepEqual(f.index('upgrade-v2.24.0'), production);
-  assert.equal(f.state.releases.get('upgrade-build-v2.24.0-100-1').size, 26);
-  assert.equal(
-    f.state.releases.get('upgrade-build-develop-v2.24.0-100-1').size,
-    26,
+  assert.equal(f.state.releases.get('upgrade-v2.24.0').size, 24);
+  assert.equal(f.state.releases.get('upgrade-develop').size, 24);
+  assert.ok(!f.state.releases.has('upgrade-build-develop-100-1'));
+  const archiveName = path.basename(development.packages['linux-x64-musl'].url);
+  const sidecar = JSON.parse(
+    f.state.releases.get('upgrade-develop').get(`${archiveName}.json`).bytes,
  );
+  assert.equal(sidecar.filename, archiveName);
 });

 test('development builds cannot publish obsolete development source', (t) => {
@@ -416,14 +493,21 @@ for (const fault of [
    const options = { branch: 'develop', commit: f.state.developHead };
    f.write(options.commit, 'development');
    f.publish(options);
-    const oldTag = 'upgrade-build-develop-v2.24.0-100-1';
+    const oldTag = 'upgrade-build-develop-100-1';
+    const legacyTag = 'upgrade-build-develop-v2.24.0-99-1';
+    f.state.releases.set(oldTag, new Map());
+    f.state.releases.set(legacyTag, new Map());
+    const oldAsset = Array.from(
+      f.state.releases.get('upgrade-develop').keys(),
+    ).find((name) => name.endsWith('-100-1.tar.gz'));
+    assert.ok(oldAsset);
    // Never prune production, channel aliases, legacy/unclassified releases,
    // drafts or a non-prerelease even when its name resembles a dev build.
    const protectedTags = [
      'upgrade-86c37f426a5ba9945d6af1910a7885a26f77e4bc',
      'v2.24.0',
-      'upgrade-build-develop-v2.24.0-10-1',
-      'upgrade-build-develop-v2.24.0-11-1',
+      'upgrade-build-develop-10-1',
+      'upgrade-build-develop-11-1',
    ];
    for (const tag of protectedTags) f.state.releases.set(tag, new Map());
    f.state.releaseMetadata = {
@@ -441,7 +525,7 @@ for (const fault of [
      assert.equal(f.publish({ ...options, buildId: '101-1' }), true);
      assert.equal(f.index('upgrade-develop').buildId, '101-1');
      const deletion = f.state.calls.findIndex(
-        (a) => a[0] === 'release' && a[1] === 'delete',
+        (a) => a[0] === 'api' && a[1] === '-X' && a[2] === 'DELETE',
      );
      const aliasEdit = f.state.calls.findLastIndex(
        (a) => a[0] === 'release' && a[1] === 'edit',
@@ -455,9 +539,15 @@ for (const fault of [
              a[0] === 'api' && a[1].includes('/releases/tags/upgrade-develop'),
          ),
      );
-      assert.ok(f.state.releases.has('upgrade-build-develop-v2.24.0-101-1'));
+      assert.ok(f.state.releases.has('upgrade-develop'));
+      assert.ok(!f.state.releases.has('upgrade-build-develop-101-1'));
    }
    assert.equal(f.state.releases.has(oldTag), Boolean(fault));
+    assert.equal(f.state.releases.has(legacyTag), Boolean(fault));
+    assert.equal(
+      f.state.releases.get('upgrade-develop').has(oldAsset),
+      Boolean(fault),
+    );
    for (const tag of protectedTags) assert.ok(f.state.releases.has(tag));
    assert.deepEqual(f.index(), production);
    assert.deepEqual(f.index('upgrade-v2.24.0'), production);
@@ -468,17 +558,21 @@ test('failed development cleanup is retryable without overwriting immutable asse
  const options = { branch: 'develop', commit: f.state.developHead };
  f.write(options.commit, 'development');
  f.publish(options);
+  const oldAsset = Array.from(
+    f.state.releases.get('upgrade-develop').keys(),
+  ).find((name) => name.endsWith('-100-1.tar.gz'));
+  assert.ok(oldAsset);
  f.state.failDelete = true;
  assert.throws(
    () => f.publish({ ...options, buildId: '101-1' }),
    /Delete unavailable/,
  );
  assert.equal(f.index('upgrade-develop').buildId, '101-1');
-  assert.ok(f.state.releases.has('upgrade-build-develop-v2.24.0-100-1'));
+  assert.ok(f.state.releases.get('upgrade-develop').has(oldAsset));
  f.state.failDelete = false;
  f.publish({ ...options, buildId: '101-1' });
-  assert.ok(!f.state.releases.has('upgrade-build-develop-v2.24.0-100-1'));
-  assert.ok(f.state.releases.has('upgrade-build-develop-v2.24.0-101-1'));
+  assert.ok(!f.state.releases.get('upgrade-develop').has(oldAsset));
+  assert.equal(f.state.releases.get('upgrade-develop').size, 24);
 });

 test('a newer development commit during upload preserves the published channel and its old package', (t) => {
@@ -487,10 +581,14 @@ test('a newer development commit during upload preserves the published channel a
  f.write(options.commit, 'development');
  f.publish(options);
  const before = f.index('upgrade-develop');
+  const oldAsset = Array.from(
+    f.state.releases.get('upgrade-develop').keys(),
+  ).find((name) => name.endsWith('-100-1.tar.gz'));
+  assert.ok(oldAsset);
  f.state.changeDevelopHeadAfterUpload = true;
  assert.equal(f.publish({ ...options, buildId: '101-1' }), false);
  assert.deepEqual(f.index('upgrade-develop'), before);
-  assert.ok(f.state.releases.has('upgrade-build-develop-v2.24.0-100-1'));
+  assert.ok(f.state.releases.get('upgrade-develop').has(oldAsset));
  assert.ok(
    !f.state.calls.some((a) => a[0] === 'release' && a[1] === 'delete'),
  );
@@ -24,8 +24,9 @@ test('startup closes interrupted instances without inventing exit codes or rewri
    { id: 4, status: 3, started_at: 100, finished_at: 130, exit_code: 7 },
  ]);
  const systemConfig = { info: { lang: 'en-US' } };
+  const startupEvents = [];
  const service = {
-    set_envs: async () => {},
+    set_envs: async () => { startupEvents.push('environment'); },
    getAuthInfo: async () => ({}),
    initializeSystemApp: async () => {},
    refreshApps: async () => {},
@@ -70,7 +71,10 @@ test('startup closes interrupted instances without inventing exit codes or rewri
    '../shared/i18n': { setLang() {} },
    './logger': {},
    '../schedule/client': {
-      readiness: { configure() {}, recover: async () => {} },
+      readiness: {
+        configure() {},
+        recover: async () => { startupEvents.push('scheduler'); },
+      },
    },
  }).default;
  // Dependency installation is unrelated to startup reconciliation.
@@ -82,6 +86,7 @@ test('startup closes interrupted instances without inventing exit codes or rewri
  } finally {
    global.setTimeout = originalTimeout;
  }
+  assert.deepEqual(startupEvents, ['environment', 'scheduler']);
  const rows = await instances.findAll({ order: [['id', 'ASC']], raw: true });
  assert.equal(rows[0].status, 2);
  assert.ok(
@@ -109,6 +114,9 @@ test('startup closes interrupted instances without inventing exit codes or rewri
  } finally {
    global.setTimeout = originalTimeout;
  }
+  assert.deepEqual(startupEvents, [
+    'environment', 'scheduler', 'environment', 'scheduler',
+  ]);
  assert.deepEqual(
    await instances.findAll({ order: [['id', 'ASC']], raw: true }),
    rows,
@@ -32,7 +32,7 @@ test('a running process retains its own build identity when installed files chan
  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ql-runtime-build-'));
  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
  fs.mkdirSync(path.join(root, 'static/build'), { recursive: true });
-  fs.writeFileSync(path.join(root, 'version.yaml'), 'version: 2.24.0');
+  fs.writeFileSync(path.join(root, 'version.yaml'), 'version: 2.24.0-dev.0');
  fs.writeFileSync(path.join(root, 'static/build/app.js'), 'old backend');
  fs.writeFileSync(
    path.join(root, 'static/build-info.json'),
@@ -45,7 +45,7 @@ test('a running process retains its own build identity when installed files chan
    JSON.stringify({ sourceCommit: 'b'.repeat(40) }),
  );
  fs.writeFileSync(path.join(root, 'version.yaml'), 'version: 2.25.0');
-  assert.equal(running.version, '2.24.0');
+  assert.equal(running.version, '2.24.0-dev.0');
  assert.equal(running.sourceCommit, 'a'.repeat(40));
  assert.equal(
    running.backendSha256,
@@ -225,8 +225,6 @@ test('static backfill uses existing snapshots and skips all source, build and im
    'verify-gitee-mirrors',
    'build-alpine',
    'build-debian',
-    'build-alpine310',
-    'build-debian310',
  ]) {
    assert.equal(workflow.jobs[name].needs, 'build-static');
    assert.doesNotMatch(workflow.jobs[name].if || '', /always\(/);
@@ -397,6 +397,22 @@ for (const mutation of ['resetSecret', 'remove', 'update', 'create']) {
  });
 }

+test('application mutations cannot change or expose the built-in system app', async (t) => {
+  const state = appsFixture(t);
+  for (const change of [
+    () => state.service.resetSecret(1),
+    () => state.service.update({ id: 1, name: 'system', scopes: ['crons'] }),
+    () => state.service.update({ id: 2, name: 'system', scopes: ['crons'] }),
+    () => state.service.remove([1, 2]),
+  ]) {
+    await assert.rejects(change(), (error) => error.status === 403);
+  }
+  assert.equal(state.apps().length, 2);
+  assert.equal(state.apps()[0].client_secret, 'system-secret');
+  assert.equal(state.apps()[0].tokens[0].value, 'system-token');
+  assert.deepEqual(state.cached(), state.apps());
+});
+
 test('system initialization preserves active tokens while migrating dashboard scope', async (t) => {
  const state = appsFixture(t);
  await AppModel.update({ scopes: ['crons', 'system'] }, { where: { id: 1 } });
@@ -10,8 +10,12 @@ const {
  repairDependencies,
 } = require('../../cli/src/internal/maintenance/upgradePrestart.cjs');

-for (const exitCode of [0, 1])
-  test(`prestart exit ${exitCode} reaps children retaining output pipes before removing its workspace`, async (t) => {
+for (const [version, exitCode] of [
+  ['2.23.0', 0],
+  ['2.23.0', 1],
+  ['2.24.0-dev.0', 0],
+])
+  test(`prestart ${version} exit ${exitCode} reaps children retaining output pipes before removing its workspace`, async (t) => {
    const root = await fs.mkdtemp(path.join(os.tmpdir(), 'ql-probe-exit-'));
    t.after(() => fs.rm(root, { recursive: true, force: true }));
    const source = path.join(root, 'source'),
@@ -19,7 +23,7 @@ for (const exitCode of [0, 1])
      survivor = path.join(root, 'survivor');
    await fs.mkdir(path.join(source, 'node_modules'), { recursive: true });
    await fs.mkdir(path.join(statics, 'build/bootstrap'), { recursive: true });
-    await fs.writeFile(path.join(source, 'version.yaml'), 'version: 2.23.0');
+    await fs.writeFile(path.join(source, 'version.yaml'), `version: ${version}`);
    await fs.writeFile(path.join(statics, 'build/app.js'), 'backend');
    await fs.writeFile(
      path.join(statics, 'build-info.json'),
@@ -36,7 +40,7 @@ for (const exitCode of [0, 1])
      )}],{stdio:'inherit'});
      process.send({type:'upgrade-probe',ok:${
        exitCode === 0
-      },message:'simulated prestart failure',build:{sourceCommit:'a'.repeat(40),version:'2.23.0',backendSha256:crypto.createHash('sha256').update('backend').digest('hex')}},()=>process.exit(${exitCode}));
+      },message:'simulated prestart failure',build:{sourceCommit:'a'.repeat(40),version:${JSON.stringify(version)},backendSha256:crypto.createHash('sha256').update('backend').digest('hex')}},()=>process.exit(${exitCode}));
    `,
    );
    const operation = prestartBackend(
@@ -1,15 +1,12 @@
-version: 2.23.0
-changeLogLink: https://github.com/whyour/qinglong/blob/master/docs/releases/2.23.0.md
-publishTime: "2026-10-11 12:27:02"
+version: 2.24.0
+changeLogLink: https://github.com/whyour/qinglong/blob/v2.24.0/docs/releases/2.24.0.md
+publishTime: "2026-10-29 02:14:58"
 changeLog: |
-  1. 新增脚本历史版本查看、对比与恢复，支持 CLI 和 OpenAPI；恢复前检查当前内容哈希，避免覆盖并发修改
-  2. 普通任务与订阅调度迁移到 node-cron，保留旧规则兼容及日期/星期 OR 语义，补充宏和夏令时说明
-  3. 修复已失效排队任务仍被执行的问题，完善任务进程超时、停止和 Shell 环境传递
-  4. 修复系统令牌主动续期与认证缓存并发更新；Shell API 遇到 401 时刷新令牌并重试一次
-  5. 降低任务启动开销，JS/Python 通知依赖改为首次调用时加载
-  6. 加固环境变量、订阅参数、文件访问和 SSH 配置输入，改善资源冲突与 CLI 错误反馈
-  7. 修复页面升级、ql update 与静态资源版本同步，完善离线备份和升级产物校验
-  8. 修复 Debian 依赖安装、通知与调度回归，补齐前端中英文翻译
-  9. 最小修补 HTTP 压缩、上传、gRPC、代理 IP、WebSocket 和 JSON 查询相关依赖漏洞
-  10. 远程 CLI 更新至 0.1.2，新增脚本历史命令，最低 Node.js 版本仍为 22.12
-  11. 本次为 Python 3.10 兼容镜像的最后一个版本，发布后停止维护；升级前备份完整数据并验证脚本、依赖和通知
+  1. Alpine 与 Debian 默认镜像统一使用 Node.js 24，SQLite 依赖升级至 1.1.4
+  2. 新增 Node.js 原生部署的 Python venv 隔离支持，以及 Python Git URL、requirements、pyproject 依赖源
+  3. 新增通知审计日志，完善通知失败记录与配置提示
+  4. 升级包按平台构建并校验；支持在线暂存、离线安装、失败回退及保留数据迁移
+  5. 修复任务调度、额外规则、依赖安装、脚本发现和订阅同步等问题
+  6. 独立远程 CLI 更新至 0.1.3，最低 Node.js 版本为 22.12.0
+  7. Alpine 保留 arm/v6 和 arm/v7；Debian 暂不提供 arm/v7，Python 3.10 兼容镜像停止更新
+  8. 升级前备份完整数据，并在目标设备验证脚本、依赖、订阅和通知
Author	SHA1	Message	Date
whyour	a23c5195ec	fix: block case-variant secret paths and task runner env overrides	2026-11-03 10:04:10 +08:00
whyour	b49b0b63e6	fix(security): protect system app and task file boundaries	2026-11-03 09:32:40 +08:00
whyour	487b213dd8	fix(security): reject apps scope grants in app API	2026-11-03 01:21:50 +08:00
whyour	866c7f4b98	feat(security): add read-only scopes for remaining resources	2026-11-03 00:57:47 +08:00
whyour	be8721204b	fix(security): preserve legacy scopes and add read-only access	2026-11-03 00:18:53 +08:00
whyour	b0f15241d2	fix(security): restrict task environment controls and app scopes	2026-11-02 23:10:58 +08:00
whyour	a5f22f8d44	fix(cli): support cross-platform config and prepare 0.1.4 (#3119 )	2026-10-31 02:14:44 +08:00
whyour	f2c2f5e4f8	release: Qinglong 2.24.0	2026-10-29 09:58:40 +08:00
whyour	2efc5e4503	build: unify Node 24 and upgrade release flow	2026-10-26 23:26:40 +08:00