fix: keep temporary Node binaries out of image layers

fix: isolate Alpine Node runtime and bound URL probes
fix: batch notification audits and bump CLI to 0.1.3
2026-11-04 00:42:01 +08:00 · 2026-10-23 22:02:07 +08:00 · 2026-10-23 21:03:44 +08:00 · 2026-10-22 01:25:29 +08:00 · 2026-10-21 01:43:44 +08:00 · 2026-10-19 18:06:06 +08:00
610 changed files with 79376 additions and 7977 deletions
@@ -0,0 +1,13 @@
+.git
+.gitnexus
+.claude
+.codex
+.env*
+node_modules
+data
+audit
+docs
+test
+src/.umi*
+**/__pycache__
+**/*.log
@@ -1,14 +1,26 @@
-UPDATE_PORT=5300
-PUBLIC_PORT=5400
-CRON_PORT=5500
-BACK_PORT=5600
-PORT=5700
+GRPC_PORT=5500
+BACK_PORT=5700

-LOG_LEVEL='debug'
+# 服务绑定地址，默认 ::（IPv6 通配，双栈系统同时支持 IPv4/IPv6）
+# 纯 IPv4 环境自动 fallback 到 0.0.0.0，也可手动指定
+# BIND_HOST=0.0.0.0
+# BIND_HOST_GRPC=0.0.0.0

-SECRET='whyour'
+# 可信反向代理。未设置时可在「系统设置 → 客户端 IP」中配置和诊断。
+# 环境变量优先级高于系统设置。支持固定层数、IP、CIDR 或逗号分隔列表：
+# QL_TRUST_PROXY=1
+# QL_TRUST_PROXY=loopback,172.18.0.0/16,10.20.0.8/32
+# 仅在面板端口绝对无法绕过代理直接访问时使用 true。
+# QL_TRUST_PROXY=loopback

-QINIU_AK=''
-QINIU_SK=''
-QINIU_SCOPE=''
-TEMP=''
+LOG_LEVEL='info'
+
+JWT_SECRET=
+JWT_EXPIRES_IN=
+
+QINIU_AK=
+QINIU_SK=
+QINIU_SCOPE=
+
+# Python 虚拟环境路径，留空则使用系统 Python
+# PYTHON_VENV_DIR=./.venv
@@ -0,0 +1,4 @@
+---
+name: Bug Fixer
+description: Fix this issue following our error handling pattern.
+---
@@ -0,0 +1,739 @@
+name: Build And Push Docker Image
+
+on:
+  push:
+    paths:
+      - "**"
+      - "!*.md"
+      # CLI is verified separately; its shared Bash upgrade engine ships in images.
+      - "!cli/**"
+      - "cli/src/internal/maintenance/upgradeArtifacts.cjs"
+      - "cli/src/internal/maintenance/platformBundle.cjs"
+      - "cli/src/internal/maintenance/upgradePrestart.cjs"
+      - "cli/src/internal/maintenance/panelUpgrade.cjs"
+      - "cli/src/internal/maintenance/nodeRuntime.cjs"
+      - "!.github/workflows/cli-package.yml"
+    branches:
+      - "master"
+      - "develop"
+    tags:
+      - "v*"
+  workflow_dispatch:
+    inputs:
+      static_sync_only:
+        description: Synchronize an existing static snapshot to GitLab and verify Gitee
+        type: boolean
+        default: false
+      static_ref:
+        description: Static branch or version name, for example v2.22.0
+        type: string
+        default: ''
+      static_ref_type:
+        description: Synchronize a branch, or a version branch and Git tag
+        type: choice
+        options: [branch, tag]
+        default: branch
+
+permissions:
+  contents: read
+
+# Keep master image tags and their bundle indexes in one serialized release.
+# A rerun may intentionally replace a version, including from the same commit.
+# Develop image builds and their shared bundle index serialize separately.
+# Git-tag builds and static synchronization remain independent.
+concurrency:
+  group: version-images-${{ github.ref == 'refs/heads/master' && 'master' || (github.ref == 'refs/heads/develop' && !inputs.static_sync_only && 'develop') || format('{0}-{1}', github.run_id, github.run_attempt) }}
+  cancel-in-progress: false
+
+jobs:
+  validate:
+    if: ${{ !inputs.static_sync_only }}
+    uses: ./.github/workflows/validate.yml
+
+  code_gitlab:
+    if: ${{ !inputs.static_sync_only }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - name: Push to GitLab
+        run: |
+          set +e
+          mkdir -p ~/.ssh
+          printf '%s\n' "${{ secrets.GITLAB_SSH_PK }}" > ~/.ssh/id_rsa
+          chmod 600 ~/.ssh/id_rsa
+          ssh-keyscan -T 10 gitlab.com >> ~/.ssh/known_hosts 2>/dev/null
+          git remote add gitlab git@gitlab.com:whyour/qinglong.git 2>/dev/null
+          git push --force --all gitlab 2>&1 || echo "::warning::GitLab push failed"
+          git push --force --tags gitlab 2>&1 || echo "::warning::GitLab tags push failed"
+
+  build-static:
+    if: ${{ !inputs.static_sync_only }}
+    needs: validate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v6
+        with:
+          version: "8.3.1"
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: ".nvmrc"
+          cache: "pnpm"
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: build front and back
+        run: |
+          pnpm install --frozen-lockfile
+          pnpm build:front
+          pnpm build:back
+          pnpm build:info
+
+      - name: Pack the npm panel archive from the verified build
+        run: node scripts/verify-panel-package.cjs pack "$RUNNER_TEMP/npm-panel"
+
+      - uses: actions/upload-artifact@v6
+        with:
+          name: qinglong-static-${{ github.sha }}
+          path: static/
+          if-no-files-found: error
+          include-hidden-files: true
+
+      - uses: actions/upload-artifact@v6
+        with:
+          name: qinglong-npm-${{ github.sha }}
+          path: ${{ runner.temp }}/npm-panel/
+          if-no-files-found: error
+          retention-days: 14
+
+      - name: copy to static repo
+        env:
+          GITHUB_REPO: github.com/${{ github.repository_owner }}/qinglong-static
+          GITHUB_BRANCH: ${{ github.ref_name }}
+          GITHUB_REF_TYPE: ${{ github.ref_type }}
+          STATIC_TOKEN: ${{ secrets.API_TOKEN }}
+        run: |
+          : "${STATIC_TOKEN:?Missing static repository token}"
+          bash scripts/publish-static.sh "https://x-access-token:${STATIC_TOKEN}@${GITHUB_REPO}.git" "$GITHUB_BRANCH" "$GITHUB_REF_TYPE"
+
+      - name: publish verified upgrade download sizes
+        env:
+          GITHUB_REPO: github.com/${{ github.repository_owner }}/qinglong-static
+          GITHUB_BRANCH: ${{ github.ref_name }}
+          STATIC_TOKEN: ${{ secrets.API_TOKEN }}
+        run: |
+          : "${STATIC_TOKEN:?Missing static repository token}"
+          node scripts/publish-upgrade-info.cjs "https://x-access-token:${STATIC_TOKEN}@${GITHUB_REPO}.git" "$GITHUB_BRANCH" "$GITHUB_SHA"
+
+  static_gitlab:
+    needs: build-static
+    runs-on: ubuntu-latest
+    concurrency:
+      group: static-gitlab-${{ github.ref_name }}
+      cancel-in-progress: false
+    steps:
+      - uses: actions/checkout@v6
+      - name: Push qinglong-static to GitLab
+        env:
+          STATIC_BRANCH: ${{ github.ref_name }}
+          STATIC_REF_TYPE: ${{ github.ref_type }}
+          MIRROR_SSH_KEY: ${{ secrets.GITLAB_SSH_PK }}
+        run: |
+          set -euo pipefail
+          mkdir -p ~/.ssh
+          printf '%s\n' "$MIRROR_SSH_KEY" > ~/.ssh/id_rsa
+          chmod 600 ~/.ssh/id_rsa
+          ssh-keyscan -T 10 gitlab.com >> ~/.ssh/known_hosts 2>/dev/null
+          bash scripts/sync-static.sh git@gitlab.com:whyour/qinglong-static.git "$STATIC_BRANCH" "$STATIC_REF_TYPE"
+
+  verify-gitee-mirrors:
+    needs: build-static
+    runs-on: ubuntu-latest
+    timeout-minutes: 14
+    permissions:
+      contents: write
+    strategy:
+      fail-fast: false
+      matrix:
+        repository: [qinglong, qinglong-static]
+    steps:
+      - uses: actions/checkout@v6
+      # Gitee Pull mirrors and GitHub push webhooks own synchronization.
+      # Verification runs alongside Docker builds and needs no Gitee credentials.
+      - name: Wait for Gitee Pull mirror
+        if: ${{ matrix.repository == 'qinglong' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          QL_MIRROR_NOTIFY_REPO: whyour/qinglong
+          MIRROR_REPOSITORY: ${{ matrix.repository }}
+          MIRROR_REF: ${{ github.ref_name }}
+          MIRROR_REF_TYPE: ${{ github.ref_type }}
+          QL_MIRROR_INCLUDE_VERSION_BRANCH: ${{ matrix.repository == 'qinglong-static' }}
+          QL_MIRROR_NOTIFY_ON_START: 'false'
+        run: |
+          bash scripts/wait-for-mirror.sh "https://github.com/whyour/$MIRROR_REPOSITORY.git" "https://gitee.com/whyour/$MIRROR_REPOSITORY.git" "$MIRROR_REF" "$MIRROR_REF_TYPE"
+      - name: Notify and wait for Gitee static mirror
+        if: ${{ matrix.repository == 'qinglong-static' }}
+        env:
+          GH_TOKEN: ${{ secrets.API_TOKEN }}
+          QL_MIRROR_NOTIFY_REPO: whyour/qinglong-static
+          MIRROR_REF: ${{ github.ref_name }}
+          MIRROR_REF_TYPE: ${{ github.ref_type }}
+          QL_MIRROR_INCLUDE_VERSION_BRANCH: 'true'
+        run: |
+          bash scripts/wait-for-mirror.sh https://github.com/whyour/qinglong-static.git https://gitee.com/whyour/qinglong-static.git "$MIRROR_REF" "$MIRROR_REF_TYPE"
+
+  sync-existing-static:
+    if: ${{ github.event_name == 'workflow_dispatch' && inputs.static_sync_only }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        mirror: [gitlab]
+    concurrency:
+      group: static-${{ matrix.mirror }}-${{ inputs.static_ref }}
+      cancel-in-progress: false
+    steps:
+      - uses: actions/checkout@v6
+      - name: Synchronize existing static snapshot
+        env:
+          STATIC_REF: ${{ inputs.static_ref }}
+          STATIC_REF_TYPE: ${{ inputs.static_ref_type }}
+          MIRROR_HOST: ${{ matrix.mirror }}.com
+          MIRROR_SSH_KEY: ${{ secrets.GITLAB_SSH_PK }}
+        run: |
+          set -euo pipefail
+          mkdir -p ~/.ssh
+          printf '%s\n' "$MIRROR_SSH_KEY" > ~/.ssh/id_rsa
+          chmod 600 ~/.ssh/id_rsa
+          ssh-keyscan -T 10 "$MIRROR_HOST" >> ~/.ssh/known_hosts 2>/dev/null
+          bash scripts/sync-static.sh "git@$MIRROR_HOST:whyour/qinglong-static.git" "$STATIC_REF" "$STATIC_REF_TYPE"
+
+  verify-existing-static-gitee:
+    if: ${{ github.event_name == 'workflow_dispatch' && inputs.static_sync_only }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 14
+    steps:
+      - uses: actions/checkout@v6
+      - name: Wait for existing Gitee static snapshot
+        env:
+          GH_TOKEN: ${{ secrets.API_TOKEN }}
+          QL_MIRROR_NOTIFY_REPO: whyour/qinglong-static
+          MIRROR_REF: ${{ inputs.static_ref }}
+          MIRROR_REF_TYPE: ${{ inputs.static_ref_type }}
+          QL_MIRROR_INCLUDE_VERSION_BRANCH: 'true'
+        run: |
+          bash scripts/wait-for-mirror.sh https://github.com/whyour/qinglong-static.git https://gitee.com/whyour/qinglong-static.git "$MIRROR_REF" "$MIRROR_REF_TYPE"
+
+  build-alpine:
+    if: ${{ !startsWith(github.ref, 'refs/tags/') }}
+    needs: build-static
+    outputs:
+      image-digest: ${{ steps.image.outputs.digest }}
+    runs-on: ubuntu-22.04
+    permissions:
+      packages: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/download-artifact@v7
+        with:
+          name: qinglong-static-${{ github.sha }}
+          path: static/
+      - uses: pnpm/action-setup@v6
+        with:
+          version: "8.3.1"
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "20"
+          cache: "pnpm"
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Read version from version.yaml
+        id: version
+        run: |
+          VERSION=$(grep '^version:' version.yaml | awk '{print $2}')
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Setup timezone
+        run: sudo timedatectl set-timezone Asia/Shanghai
+
+      - name: Login to DockerHub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Login to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: |
+            ${{ github.repository }}
+            ghcr.io/${{ github.repository }}
+          flavor: |
+            latest=false
+          tags: |
+            type=ref,event=branch,enable=${{ github.ref == format('refs/heads/{0}', 'develop') }}
+            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'master') }}
+            type=raw,value=${{ steps.version.outputs.version }},enable=${{ github.ref == format('refs/heads/{0}', 'master') }}
+            type=semver,pattern={{version}}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+        with:
+          cache-image: false
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build and push (Alpine)
+        id: image
+        uses: docker/build-push-action@v7
+        with:
+          build-args: |
+            QL_MAINTAINER=${{ github.repository_owner }}
+            QL_BRANCH=${{ github.ref_name }}
+            SOURCE_COMMIT=${{ github.sha }}
+          network: host
+          platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x,linux/386
+          context: .
+          file: ./docker/Dockerfile
+          push: true
+          provenance: mode=max
+          sbom: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=registry,ref=whyour/qinglong:cache-alpine
+          cache-to: type=registry,ref=whyour/qinglong:cache-alpine,mode=max
+
+  build-debian:
+    if: ${{ !startsWith(github.ref, 'refs/tags/') }}
+    needs: build-static
+    outputs:
+      image-digest: ${{ steps.image.outputs.digest }}
+    runs-on: ubuntu-22.04
+    permissions:
+      packages: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/download-artifact@v7
+        with:
+          name: qinglong-static-${{ github.sha }}
+          path: static/
+      - uses: pnpm/action-setup@v6
+        with:
+          version: "8.3.1"
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "20"
+          cache: "pnpm"
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Read version from version.yaml
+        id: version
+        run: |
+          VERSION=$(grep '^version:' version.yaml | awk '{print $2}')
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Setup timezone
+        run: sudo timedatectl set-timezone Asia/Shanghai
+
+      - name: Login to DockerHub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Login to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: |
+            ${{ github.repository }}
+            ghcr.io/${{ github.repository }}
+          flavor: |
+            latest=false
+          tags: |
+            type=raw,value=debian-dev,enable=${{ github.ref == format('refs/heads/{0}', 'develop') }}
+            type=raw,value=debian,enable=${{ github.ref == format('refs/heads/{0}', 'master') }}
+            type=raw,value=${{ steps.version.outputs.version }}-debian,enable=${{ github.ref == format('refs/heads/{0}', 'master') }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+        with:
+          cache-image: false
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build and push (Debian)
+        id: image
+        uses: docker/build-push-action@v7
+        with:
+          build-args: |
+            QL_MAINTAINER=${{ github.repository_owner }}
+            QL_BRANCH=${{ github.ref_name }}
+            SOURCE_COMMIT=${{ github.sha }}
+          network: host
+          # Keep s390x on Debian: npm can hang under QEMU with Alpine (nodejs/docker-node#1973).
+          platforms: linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x
+          context: .
+          file: ./docker/Dockerfile.debian
+          push: true
+          provenance: mode=max
+          sbom: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=registry,ref=whyour/qinglong:cache-debian
+          cache-to: type=registry,ref=whyour/qinglong:cache-debian,mode=max
+
+  build-alpine310:
+    if: ${{ github.ref_name == 'master' }}
+    needs: build-static
+    runs-on: ubuntu-22.04
+    permissions:
+      packages: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/download-artifact@v7
+        with:
+          name: qinglong-static-${{ github.sha }}
+          path: static/
+      - uses: pnpm/action-setup@v6
+        with:
+          version: "8.3.1"
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "20"
+          cache: "pnpm"
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Read version from version.yaml
+        id: version
+        run: |
+          VERSION=$(grep '^version:' version.yaml | awk '{print $2}')
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Setup timezone
+        run: sudo timedatectl set-timezone Asia/Shanghai
+
+      - name: Login to DockerHub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Login to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+        with:
+          cache-image: false
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build and push (Alpine Python 3.10)
+        uses: docker/build-push-action@v7
+        with:
+          build-args: |
+            QL_MAINTAINER=${{ github.repository_owner }}
+            QL_BRANCH=${{ github.ref_name }}
+            SOURCE_COMMIT=${{ github.sha }}
+          network: host
+          platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x,linux/386
+          context: .
+          file: ./docker/Dockerfile.310
+          push: true
+          provenance: mode=max
+          sbom: true
+          tags: |
+            whyour/qinglong:python3.10
+            whyour/qinglong:${{ steps.version.outputs.version }}-python3.10
+          cache-from: type=registry,ref=whyour/qinglong:cache-alpine-python3.10
+          cache-to: type=registry,ref=whyour/qinglong:cache-alpine-python3.10,mode=max
+
+  build-debian310:
+    if: ${{ github.ref_name == 'master' }}
+    needs: build-static
+    runs-on: ubuntu-22.04
+    permissions:
+      packages: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/download-artifact@v7
+        with:
+          name: qinglong-static-${{ github.sha }}
+          path: static/
+      - uses: pnpm/action-setup@v6
+        with:
+          version: "8.3.1"
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "20"
+          cache: "pnpm"
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Read version from version.yaml
+        id: version
+        run: |
+          VERSION=$(grep '^version:' version.yaml | awk '{print $2}')
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Setup timezone
+        run: sudo timedatectl set-timezone Asia/Shanghai
+
+      - name: Login to DockerHub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Login to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+        with:
+          cache-image: false
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build and push (Debian Python 3.10)
+        uses: docker/build-push-action@v7
+        with:
+          build-args: |
+            QL_MAINTAINER=${{ github.repository_owner }}
+            QL_BRANCH=${{ github.ref_name }}
+            SOURCE_COMMIT=${{ github.sha }}
+          network: host
+          # Keep s390x on Debian: npm can hang under QEMU with Alpine (nodejs/docker-node#1973).
+          platforms: linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x
+          context: .
+          file: ./docker/Dockerfile.debian310
+          push: true
+          provenance: mode=max
+          sbom: true
+          tags: |
+            whyour/qinglong:debian-python3.10
+            whyour/qinglong:${{ steps.version.outputs.version }}-debian-python3.10
+          cache-from: type=registry,ref=whyour/qinglong:cache-debian-python3.10
+          cache-to: type=registry,ref=whyour/qinglong:cache-debian-python3.10,mode=max
+
+  # One unmodified amd64 package for migration acceptance only. This does not
+  # publish bundles or advance development/formal channel indexes.
+  build-npm-migration-bundle:
+    needs: build-debian
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v6
+      - uses: docker/setup-buildx-action@v4
+      - name: Export the official platform package from this run's image digest
+        env:
+          IMAGE_DIGEST: ${{ needs.build-debian.outputs.image-digest }}
+        run: |
+          set -euo pipefail
+          [[ "$IMAGE_DIGEST" =~ ^sha256:[a-f0-9]{64}$ ]]
+          image="ghcr.io/${GITHUB_REPOSITORY}@${IMAGE_DIGEST}"
+          docker buildx build --platform linux/amd64 --build-arg "BASE_IMAGE=$image" --file docker/Dockerfile.upgrade-bundle --output "type=local,dest=$RUNNER_TEMP/npm-migration-bundle" .
+      - uses: actions/upload-artifact@v6
+        with:
+          name: npm-migration-bundle-${{ github.sha }}
+          path: ${{ runner.temp }}/npm-migration-bundle/*
+          if-no-files-found: error
+          retention-days: 3
+
+  verify-npm-package:
+    needs: [build-static, build-npm-migration-bundle]
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        node: ['20.18.1', '24']
+    container: node:${{ matrix.node }}-bookworm
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/download-artifact@v6
+        with:
+          name: qinglong-npm-${{ github.sha }}
+          path: ${{ runner.temp }}/npm-panel/
+      - uses: actions/download-artifact@v6
+        with:
+          name: npm-migration-bundle-${{ github.sha }}
+          path: ${{ runner.temp }}/npm-migration-bundle/
+      - name: Install isolated service test tools
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends python3 openssl curl jq nginx procps
+          # The published legacy launcher resets PATH to standard directories.
+          # /usr/local is confined to this disposable job container; PM2_HOME
+          # remains private to each verification run.
+          npm install --global --prefix /usr/local --no-audit --no-fund pm2@6.0.14
+      - name: Install and upgrade the exact npm archive
+        env:
+          QL_PANEL_PACKAGE_TEST_ISOLATED: '1'
+          QL_PANEL_TEST_PM2: /usr/local/bin/pm2
+          QL_PANEL_TEST_BUNDLE_DIR: ${{ runner.temp }}/npm-migration-bundle
+        run: node scripts/verify-panel-package.cjs verify "$RUNNER_TEMP/npm-panel" "$RUNNER_TEMP/npm-panel-results"
+      - uses: actions/upload-artifact@v6
+        with:
+          name: qinglong-npm-verification-${{ matrix.node }}-${{ github.sha }}
+          path: ${{ runner.temp }}/npm-panel-results/
+          if-no-files-found: error
+          retention-days: 14
+
+  publish:
+    if: ${{ github.repository == 'whyour/qinglong' && github.ref == 'refs/heads/master' }}
+    needs: [build-alpine, build-debian, build-alpine310, build-debian310, verify-npm-package]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Set up Node for trusted publishing
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          registry-url: https://registry.npmjs.org
+          package-manager-cache: false
+
+      - uses: actions/download-artifact@v6
+        with:
+          name: qinglong-npm-${{ github.sha }}
+          path: npm-panel/
+
+      - name: Publish npm package with OIDC
+        shell: bash
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          archives=(npm-panel/*.tgz)
+          if [ "${#archives[@]}" -ne 1 ]; then
+            echo '::error::Expected exactly one verified panel npm archive.'
+            exit 1
+          fi
+          archive="${archives[0]}"
+          metadata=$(tar -xOf "$archive" package/package.json)
+          name=$(jq -er '.name | select(. == "@whyour/qinglong")' <<< "$metadata")
+          version=$(jq -er '.version | select(type == "string")' <<< "$metadata")
+          if npm view "$name@$version" version --json --registry=https://registry.npmjs.org > "$RUNNER_TEMP/npm-version.json" 2> "$RUNNER_TEMP/npm-version-error.log"; then
+            jq -e --arg version "$version" '. == $version' "$RUNNER_TEMP/npm-version.json" > /dev/null
+            echo "::notice::$name@$version is already published; skipping npm publication for this image rebuild."
+          elif jq -e '.error.code == "E404"' "$RUNNER_TEMP/npm-version.json" > /dev/null; then
+            npm publish "$archive" --ignore-scripts --access public --registry=https://registry.npmjs.org
+          else
+            echo '::error::Could not check the published npm version; refusing to publish.'
+            exit 1
+          fi
+
+  build-upgrade-bundles:
+    # Both channels publish packages from this run's immutable image digests.
+    if: ${{ !inputs.static_sync_only && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/develop') }}
+    needs: [build-alpine, build-debian]
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { platform: linux/amd64, libc: musl, name: x64-musl }
+          - { platform: linux/arm/v6, libc: musl, name: armv6-musl }
+          - { platform: linux/arm/v7, libc: musl, name: armv7-musl }
+          - { platform: linux/arm64, libc: musl, name: arm64-musl }
+          - { platform: linux/ppc64le, libc: musl, name: ppc64-musl }
+          - { platform: linux/s390x, libc: musl, name: s390x-musl }
+          - { platform: linux/386, libc: musl, name: ia32-musl }
+          - { platform: linux/amd64, libc: glibc, name: x64-glibc }
+          - { platform: linux/arm/v7, libc: glibc, name: armv7-glibc }
+          - { platform: linux/arm64, libc: glibc, name: arm64-glibc }
+          - { platform: linux/ppc64le, libc: glibc, name: ppc64-glibc }
+          - { platform: linux/s390x, libc: glibc, name: s390x-glibc }
+    steps:
+      - uses: actions/checkout@v6
+      - uses: docker/setup-qemu-action@v4
+        with:
+          cache-image: false
+      - uses: docker/setup-buildx-action@v4
+      - name: Build and probe the immutable platform package
+        env:
+          ALPINE_DIGEST: ${{ needs.build-alpine.outputs.image-digest }}
+          DEBIAN_DIGEST: ${{ needs.build-debian.outputs.image-digest }}
+          BUNDLE_LIBC: ${{ matrix.libc }}
+          BUNDLE_PLATFORM: ${{ matrix.platform }}
+        run: |
+          set -euo pipefail
+          digest="$ALPINE_DIGEST"
+          if [ "$BUNDLE_LIBC" = glibc ]; then digest="$DEBIAN_DIGEST"; fi
+          test -n "$digest"
+          image="ghcr.io/${GITHUB_REPOSITORY}@${digest}"
+          docker buildx build --platform "$BUNDLE_PLATFORM" --build-arg "BASE_IMAGE=$image" --file docker/Dockerfile.upgrade-bundle --output type=local,dest=output/upgrade .
+      - uses: actions/upload-artifact@v6
+        with:
+          name: upgrade-${{ matrix.name }}-${{ github.sha }}
+          path: output/upgrade/*
+          if-no-files-found: error
+
+  publish-upgrade-bundles:
+    if: ${{ !inputs.static_sync_only && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/develop') }}
+    needs: build-upgrade-bundles
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    concurrency:
+      group: upgrade-channel-${{ github.ref_name }}
+      cancel-in-progress: false
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '20'
+      - uses: pnpm/action-setup@v6
+        with:
+          version: '8.3.1'
+      - run: pnpm install --prod --frozen-lockfile
+      - run: npm --prefix cli ci
+      - uses: actions/download-artifact@v7
+        with:
+          pattern: upgrade-*-${{ github.sha }}
+          path: output/upgrade
+          merge-multiple: true
+      - run: node scripts/build-bundle-installer.cjs output/upgrade/install-bundle.cjs
+      - name: Publish complete packages before advancing the channel
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node scripts/publish-upgrade-bundles.cjs output/upgrade "$GITHUB_SHA" "$GITHUB_REPOSITORY" "$GITHUB_REF_NAME"
@@ -1,239 +0,0 @@
-name: Build And Push Docker Image
-
-on:
-  push:
-    paths-ignore:
-      - "*.md"
-    branches:
-      - "master"
-      - "develop"
-    tags:
-      - "v*"
-  schedule:
-    - cron: "00 20 * * *"
-  workflow_dispatch:
-
-jobs:
-  to_gitlab:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - uses: wearerequired/git-mirror-action@v1
-        env:
-          SSH_PRIVATE_KEY: ${{ secrets.GITLAB_SSH_PK }}
-        with:
-          source-repo: https://github.com/whyour/qinglong.git
-          destination-repo: git@gitlab.com:whyour/qinglong.git
-
-  to_gitee:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - uses: wearerequired/git-mirror-action@v1
-        env:
-          SSH_PRIVATE_KEY: ${{ secrets.GITLAB_SSH_PK }}
-        with:
-          source-repo: https://github.com/whyour/qinglong.git
-          destination-repo: git@gitee.com:whyour/qinglong.git
-
-  build-static:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v3
-        with:
-          version: "8.3.1"
-
-      - uses: actions/setup-node@v4
-        with:
-          cache: "pnpm"
-
-      - name: build front and back
-        run: |
-          pnpm install --frozen-lockfile
-          pnpm build:front
-          pnpm build:back
-
-      - name: copy to static repo
-        env:
-          GITHUB_REPO: github.com/${{ github.repository_owner }}/qinglong-static
-          GITHUB_BRANCH: ${{ github.ref_name }}
-          REPO_GITEE: git@gitee.com:whyour/qinglong-static.git
-          REPO_GITLAB: git@gitlab.com:whyour/qinglong-static.git
-          PRIVATE_KEY: ${{ secrets.GITLAB_SSH_PK }}
-        run: |
-          mkdir -p tmp
-          cd ./tmp
-          cp -rf ../static/* ./
-          git init -b ${GITHUB_BRANCH} && git add .
-          git config --local user.name 'github-actions[bot]'
-          git config --local user.email 'github-actions[bot]@users.noreply.github.com'
-          git commit --allow-empty -m "copy static at $(date +'%Y-%m-%d %H:%M:%S')"
-          git push --force --quiet "https://${{ secrets.API_TOKEN }}@${GITHUB_REPO}.git" ${GITHUB_BRANCH}:${GITHUB_BRANCH}
-
-          mkdir -p ~/.ssh
-          echo "${PRIVATE_KEY}" > ~/.ssh/id_rsa
-          chmod 600 ~/.ssh/id_rsa
-
-          export GIT_SSH_COMMAND="ssh -v -i ~/.ssh/id_rsa -o StrictHostKeyChecking=no -l git"
-          git remote add gitee "${REPO_GITEE}"
-          git remote add gitlab "${REPO_GITLAB}"
-          git gc
-          git push --force --quiet gitee ${GITHUB_BRANCH}:${GITHUB_BRANCH}
-          git push --force --quiet gitlab ${GITHUB_BRANCH}:${GITHUB_BRANCH}
-
-  build:
-    needs: build-static
-
-    # 由于 ubuntu-latest 中使用 linux6.x 内核 linux/s390x npm 无法使用
-    runs-on: ubuntu-20.04
-    # runs-on: self-hosted
-
-    permissions:
-      packages: write
-      contents: read
-
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v3
-        with:
-          version: "8.3.1"
-      - uses: actions/setup-node@v4
-        with:
-          cache: "pnpm"
-
-      - name: Setup timezone
-        uses: szenius/set-timezone@v2.0
-        with:
-          timezoneLinux: Asia/Shanghai
-
-      - name: Login to DockerHub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Login to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: |
-            ${{ github.repository }}
-            ghcr.io/${{ github.repository }}
-          # generate Docker tags based on the following events/attributes
-          #   nightly, master, pr-2, 1.2.3, 1.2, 1
-          flavor: |
-            latest=false
-          tags: |
-            type=schedule,pattern=nightly
-            type=edge
-            type=ref,event=pr
-            type=ref,event=branch,enable=${{ github.ref != format('refs/heads/{0}', 'master') }}
-            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'master') }}
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build and push
-        id: docker_build
-        uses: docker/build-push-action@v6
-        with:
-          build-args: |
-            MAINTAINER=${{ github.repository_owner }}
-            QL_BRANCH=${{ github.ref_name }}
-            SOURCE_COMMIT=${{ github.sha }}
-          network: host
-          platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x,linux/386
-          # platforms: linux/amd64,linux/arm64,linux/ppc64le,linux/s390x,linux/386
-          context: .
-          file: ./docker/Dockerfile
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=registry,ref=whyour/qinglong:cache
-          cache-to: type=registry,ref=whyour/qinglong:cache,mode=max
-
-      - name: Image digest
-        run: |
-          echo ${{ steps.docker_build.outputs.digest }}
-  
-  build310:
-    if: ${{ github.ref_name == 'master' }}
-    needs: build-static
-
-    runs-on: ubuntu-20.04
-
-    permissions:
-      packages: write
-      contents: read
-
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v3
-        with:
-          version: "8.3.1"
-      - uses: actions/setup-node@v4
-        with:
-          cache: "pnpm"
-
-      - name: Setup timezone
-        uses: szenius/set-timezone@v2.0
-        with:
-          timezoneLinux: Asia/Shanghai
-
-      - name: Login to DockerHub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Login to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build and push python3.10
-        id: docker_build_310
-        uses: docker/build-push-action@v6
-        with:
-          build-args: |
-            MAINTAINER=${{ github.repository_owner }}
-            QL_BRANCH=${{ github.ref_name }}
-            SOURCE_COMMIT=${{ github.sha }}
-          network: host
-          platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x,linux/386
-          context: .
-          file: ./docker/310.Dockerfile
-          push: true
-          tags: whyour/qinglong:python3.10
-          cache-from: type=registry,ref=whyour/qinglong:cache-python3.10
-          cache-to: type=registry,ref=whyour/qinglong:cache-python3.10,mode=max
-
-      - name: Image digest
-        run: |
-          echo ${{ steps.docker_build_310.outputs.digest }}
@@ -0,0 +1,161 @@
+name: CLI package
+
+on:
+  pull_request:
+    paths:
+      - 'cli/**'
+      - 'shell/**'
+      - 'back/api/**'
+      - 'back/loaders/deps.ts'
+      - 'package.json'
+      - '.github/workflows/cli-package.yml'
+  push:
+    branches: [develop, master]
+    paths:
+      - 'cli/**'
+      - 'shell/**'
+      - 'back/api/**'
+      - 'back/loaders/deps.ts'
+      - 'package.json'
+      - '.github/workflows/cli-package.yml'
+  workflow_dispatch:
+    inputs:
+      publish:
+        description: Publish the verified CLI package (master stable / develop prerelease)
+        type: boolean
+        default: false
+      prerelease_version:
+        description: Develop only, e.g. 0.1.2-beta.0 (alpha/beta/rc)
+        type: string
+        default: ''
+
+permissions:
+  contents: read
+
+concurrency:
+  # Keep validation runs separate from releases; never interrupt a running release.
+  # Master push releases share the same group as manually requested releases.
+  group: >-
+    cli-package-${{ github.workflow }}-${{ github.ref }}-${{
+      ((github.event_name == 'workflow_dispatch' && inputs.publish) ||
+       (github.event_name == 'push' && github.ref == 'refs/heads/master')) && 'publish' || 'check' }}
+  cancel-in-progress: >-
+    ${{ github.ref != 'refs/heads/master' &&
+        !(github.event_name == 'workflow_dispatch' && inputs.publish) }}
+
+jobs:
+  package:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        node: ['22.12.0', '24']
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+          cache-dependency-path: cli/package-lock.json
+      - name: Install test interpreters and tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends bash ca-certificates curl git jq perl procps python3 unzip zip
+          npm install --global --ignore-scripts --no-audit --no-fund ts-node@10.9.2 typescript@5.2.2
+      - name: Set requested prerelease version before verification
+        if: github.event_name == 'workflow_dispatch' && inputs.prerelease_version != ''
+        working-directory: cli
+        env:
+          PRERELEASE_VERSION: ${{ inputs.prerelease_version }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ "$GITHUB_REF" != refs/heads/develop ||
+                ! "$PRERELEASE_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+-(alpha|beta|rc)\.[0-9]+$ ]]; then
+            echo '::error::Prereleases require develop and an explicit alpha/beta/rc version.'
+            exit 1
+          fi
+          npm version "$PRERELEASE_VERSION" --no-git-tag-version --ignore-scripts
+      - run: npm ci --prefix cli --no-audit --no-fund
+      - run: npm run check:cli
+      - run: npm run test:cli
+      - name: Verify offline package installation
+        env:
+          QL_CLI_PACKAGE_OUTPUT: ${{ runner.temp }}/cli-package
+        run: node cli/scripts/verify-package.cjs
+      - name: Upload verified npm archive
+        if: matrix.node == '24'
+        uses: actions/upload-artifact@v6
+        with:
+          name: qinglong-cli-${{ github.sha }}
+          path: ${{ runner.temp }}/cli-package/*.tgz
+          if-no-files-found: error
+          retention-days: 14
+
+  publish:
+    needs: package
+    if: >-
+      github.repository == 'whyour/qinglong' &&
+      ((github.ref == 'refs/heads/master' &&
+        (github.event_name == 'push' ||
+         (github.event_name == 'workflow_dispatch' && inputs.publish))) ||
+       (github.ref == 'refs/heads/develop' && github.event_name == 'workflow_dispatch' &&
+        inputs.publish && inputs.prerelease_version != ''))
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          package-manager-cache: false
+          registry-url: https://registry.npmjs.org
+      - uses: actions/download-artifact@v7
+        with:
+          name: qinglong-cli-${{ github.sha }}
+          path: cli-package
+      - name: Publish verified npm archive
+        env:
+          PRERELEASE_VERSION: ${{ inputs.prerelease_version }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          archives=(cli-package/*.tgz)
+          if [ "${#archives[@]}" -ne 1 ]; then
+            echo '::error::Expected exactly one verified CLI archive.'
+            exit 1
+          fi
+          archive="${archives[0]}"
+          metadata=$(tar -xOf "$archive" package/package.json)
+          name=$(jq -er '.name | select(. == "@whyour/qinglong-cli")' <<< "$metadata")
+          version=$(jq -er '.version | select(type == "string")' <<< "$metadata")
+          if [[ "$GITHUB_REF" == refs/heads/develop ]]; then
+            if [[ "$version" != "$PRERELEASE_VERSION" ||
+                  ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+-(alpha|beta|rc)\.[0-9]+$ ]]; then
+              echo '::error::Archive version does not match the requested prerelease.'
+              exit 1
+            fi
+            tag="${BASH_REMATCH[1]}"
+          elif [[ "$GITHUB_REF" == refs/heads/master && "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            tag=latest
+          else
+            echo '::error::Refusing to publish this branch/version combination.'
+            exit 1
+          fi
+          if npm view "$name@$version" version --json --registry=https://registry.npmjs.org > version.json 2> version-error.log; then
+            jq -e --arg version "$version" '. == $version' version.json > /dev/null
+            if [[ "$tag" != latest ]]; then
+              echo '::error::Prerelease version already exists; choose a new version to test this build.'
+              exit 1
+            fi
+            echo "::notice::$name@$version is already published; bump cli/package.json and its lockfile to release changes."
+            exit 0
+          elif ! jq -e '.error.code == "E404"' version.json > /dev/null; then
+            echo '::error::Could not check the published CLI version; refusing to publish.'
+            exit 1
+          fi
+          npm publish "./$archive" --access public --tag "$tag" --ignore-scripts --registry=https://registry.npmjs.org
@@ -0,0 +1,170 @@
+name: Release readiness
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/release-readiness.yml'
+      - 'package.json'
+      - 'pnpm-lock.yaml'
+      - 'docker/Dockerfile*'
+      - 'shell/node-runtime-probe.cjs'
+      - 'scripts/verify-panel-package.cjs'
+      - 'scripts/verify-image-node-layers.py'
+      - 'test/back/node-runtime-probe.test.cjs'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-readiness-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  regression:
+    uses: ./.github/workflows/validate.yml
+
+  static:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      - uses: pnpm/action-setup@v6
+        with:
+          version: '8.3.1'
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '20'
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm build:front && pnpm build:back && pnpm build:info
+      - uses: actions/upload-artifact@v6
+        with:
+          name: release-readiness-static
+          path: static/
+          include-hidden-files: true
+          if-no-files-found: error
+      - name: Pack the verified npm archive for isolated runtime validation
+        run: node scripts/verify-panel-package.cjs pack "$RUNNER_TEMP/npm-panel"
+      - uses: actions/upload-artifact@v6
+        with:
+          name: release-readiness-npm-panel
+          path: ${{ runner.temp }}/npm-panel/
+          if-no-files-found: error
+
+  images:
+    needs: [regression, static]
+    runs-on: ubuntu-22.04
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - image: alpine
+            file: docker/Dockerfile
+            cache: alpine
+            platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x,linux/386
+          - image: debian
+            file: docker/Dockerfile.debian
+            cache: debian
+            platforms: linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x
+          - image: alpine-python3.10
+            file: docker/Dockerfile.310
+            cache: alpine-python3.10
+            platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x,linux/386
+          - image: debian-python3.10
+            file: docker/Dockerfile.debian310
+            cache: debian-python3.10
+            platforms: linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      - name: Record source
+        id: source
+        env:
+          SOURCE_URL: ${{ github.event.pull_request.head.repo.clone_url || format('https://github.com/{0}.git', github.repository) }}
+          SOURCE_BRANCH: ${{ github.head_ref || github.ref_name }}
+        run: |
+          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+          echo "url=$SOURCE_URL" >> "$GITHUB_OUTPUT"
+          echo "branch=$SOURCE_BRANCH" >> "$GITHUB_OUTPUT"
+      - uses: actions/download-artifact@v7
+        with:
+          name: release-readiness-static
+          path: static/
+      - uses: docker/setup-qemu-action@v4
+        with:
+          cache-image: false
+      - uses: docker/setup-buildx-action@v4
+      - name: Build every release architecture
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: ${{ matrix.file }}
+          platforms: ${{ matrix.platforms }}
+          build-args: |
+            QL_URL=${{ steps.source.outputs.url }}
+            QL_BRANCH=${{ steps.source.outputs.branch }}
+            SOURCE_COMMIT=${{ steps.source.outputs.sha }}
+          push: false
+          provenance: false
+          sbom: false
+          cache-from: type=registry,ref=whyour/qinglong:cache-${{ matrix.cache }}
+      - name: Load native image for runtime verification
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: ${{ matrix.file }}
+          platforms: linux/amd64
+          build-args: |
+            QL_URL=${{ steps.source.outputs.url }}
+            QL_BRANCH=${{ steps.source.outputs.branch }}
+            SOURCE_COMMIT=${{ steps.source.outputs.sha }}
+          tags: qinglong-readiness:${{ matrix.image }}
+          load: true
+          push: false
+          provenance: false
+          sbom: false
+      - name: Verify native production runtime without external networking
+        run: |
+          docker run --rm --network none --entrypoint node \
+            qinglong-readiness:${{ matrix.image }} \
+            -e 'const assert=require("node:assert/strict"); const {createRequire}=require("node:module"); for(const [name,want] of Object.entries({"@grpc/grpc-js":"1.14.5",compression:"1.8.2",multer:"2.4.0",sequelize:"6.37.8"}))assert.equal(require(name+"/package.json").version,want); const expressRequire=createRequire(require.resolve("express")); assert.equal(expressRequire("proxy-addr/package.json").version,"2.0.8"); const sockRequire=createRequire(require.resolve("sockjs")); assert.equal(sockRequire("websocket-driver/package.json").version,"0.7.5"); require("sqlite3"); require("nodemailer"); require("undici"); console.log("Minimal production patches and runtime imports verified")'
+      - name: Export ARMv6 image layers for Node regression checks
+        if: startsWith(matrix.image, 'alpine')
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: ${{ matrix.file }}
+          platforms: linux/arm/v6
+          build-args: |
+            QL_URL=${{ steps.source.outputs.url }}
+            QL_BRANCH=${{ steps.source.outputs.branch }}
+            SOURCE_COMMIT=${{ steps.source.outputs.sha }}
+          outputs: type=docker,dest=${{ runner.temp }}/node-layers-arm.tar
+          push: false
+          provenance: false
+          sbom: false
+      - name: Check Node binaries in every serialized image layer
+        if: startsWith(matrix.image, 'alpine')
+        run: |
+          docker save qinglong-readiness:${{ matrix.image }} -o "$RUNNER_TEMP/node-layers-amd64.tar"
+          python3 scripts/verify-image-node-layers.py "$RUNNER_TEMP/node-layers-amd64.tar" amd64
+          python3 scripts/verify-image-node-layers.py "$RUNNER_TEMP/node-layers-arm.tar" arm
+          rm "$RUNNER_TEMP/node-layers-amd64.tar" "$RUNNER_TEMP/node-layers-arm.tar"
+      - name: Export native image for isolated dev validation
+        if: matrix.image == 'debian' || matrix.image == 'alpine'
+        run: |
+          docker save qinglong-readiness:${{ matrix.image }} | gzip -1 > release-readiness-${{ matrix.image }}-image.tar.gz
+          sha256sum release-readiness-${{ matrix.image }}-image.tar.gz > release-readiness-${{ matrix.image }}-image.sha256
+          docker image inspect qinglong-readiness:${{ matrix.image }} > release-readiness-${{ matrix.image }}-image.json
+      - uses: actions/upload-artifact@v6
+        if: matrix.image == 'debian' || matrix.image == 'alpine'
+        with:
+          name: release-readiness-${{ matrix.image }}-image
+          path: release-readiness-${{ matrix.image }}-image.*
+          compression-level: 0
+          if-no-files-found: error
@@ -0,0 +1,31 @@
+name: Validate
+
+on:
+  pull_request:
+  workflow_dispatch:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  regression:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v6
+        with:
+          version: '8.3.1'
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '20'
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: cp .env.example .env
+      - run: pnpm test
+      - run: pnpm build:back
+      - run: pnpm benchmark:execution -- --runs=10 --output=execution-baseline.json
+      - uses: actions/upload-artifact@v6
+        with:
+          name: execution-baseline
+          path: execution-baseline.json
@@ -28,3 +28,23 @@ __pycache__
 /shell/preload/notify.*
 /shell/preload/*-notify.json
 /shell/preload/__ql_notify__.*
+/shell/preload/lang_env.sh
+/shell/upgrade-lock.yaml
+
+.deepseek/
+.claude/
+
+# local Kubernetes overlays
+/deploy/kubernetes/overlays/local/
+
+# Local security audit artifacts
+/audit/
+
+# Local browser tests, screenshots, reports, and temporary test output
+/.playwright-cli/
+/output/
+/playwright-report/
+/test-results/
+/blob-report/
+/coverage/
+/.nyc_output/
@@ -0,0 +1 @@
+22
@@ -16,18 +16,8 @@ export default defineConfig({
  favicons: [`https://qn.whyour.cn/favicon.svg`],
  publicPath: process.env.NODE_ENV === 'production' ? './' : '/',
  proxy: {
-    [`${baseUrl}api/update`]: {
-      target: 'http://127.0.0.1:5300/',
-      changeOrigin: true,
-      pathRewrite: { [`^${baseUrl}api/update`]: '/api' },
-    },
-    [`${baseUrl}api/public`]: {
-      target: 'http://127.0.0.1:5400/',
-      changeOrigin: true,
-      pathRewrite: { [`^${baseUrl}api/public`]: '/api' },
-    },
    [`${baseUrl}api`]: {
-      target: 'http://127.0.0.1:5600/',
+      target: 'http://127.0.0.1:5700/',
      changeOrigin: true,
      ws: true,
      pathRewrite: { [`^${baseUrl}api`]: '/api' },
@@ -0,0 +1,43 @@
+<!-- gitnexus:start -->
+# GitNexus — Code Intelligence
+
+This project is indexed by GitNexus as **qinglong** (2778 symbols, 6698 relationships, 233 execution flows). Use the GitNexus MCP tools to understand code, assess impact, and navigate safely.
+
+> Index stale? Run `node .gitnexus/run.cjs analyze` from the project root — it auto-selects an available runner. No `.gitnexus/run.cjs` yet? `npx gitnexus analyze` (npm 11 crash → `npm i -g gitnexus`; #1939).
+
+## Always Do
+
+- **MUST run impact analysis before editing any symbol.** Before modifying a function, class, or method, run `impact({target: "symbolName", direction: "upstream"})` and report the blast radius (direct callers, affected processes, risk level) to the user.
+- **MUST run `detect_changes()` before committing** to verify your changes only affect expected symbols and execution flows. For regression review, compare against the default branch: `detect_changes({scope: "compare", base_ref: "develop"})`.
+- **MUST warn the user** if impact analysis returns HIGH or CRITICAL risk before proceeding with edits.
+- When exploring unfamiliar code, use `query({query: "concept"})` to find execution flows instead of grepping. It returns process-grouped results ranked by relevance.
+- When you need full context on a specific symbol — callers, callees, which execution flows it participates in — use `context({name: "symbolName"})`.
+
+## Never Do
+
+- NEVER edit a function, class, or method without first running `impact` on it.
+- NEVER ignore HIGH or CRITICAL risk warnings from impact analysis.
+- NEVER rename symbols with find-and-replace — use `rename` which understands the call graph.
+- NEVER commit changes without running `detect_changes()` to check affected scope.
+
+## Resources
+
+| Resource | Use for |
+|----------|---------|
+| `gitnexus://repo/qinglong/context` | Codebase overview, check index freshness |
+| `gitnexus://repo/qinglong/clusters` | All functional areas |
+| `gitnexus://repo/qinglong/processes` | All execution flows |
+| `gitnexus://repo/qinglong/process/{name}` | Step-by-step execution trace |
+
+## CLI
+
+| Task | Read this skill file |
+|------|---------------------|
+| Understand architecture / "How does X work?" | `.claude/skills/gitnexus/gitnexus-exploring/SKILL.md` |
+| Blast radius / "What breaks if I change X?" | `.claude/skills/gitnexus/gitnexus-impact-analysis/SKILL.md` |
+| Trace bugs / "Why is X failing?" | `.claude/skills/gitnexus/gitnexus-debugging/SKILL.md` |
+| Rename / extract / split / refactor | `.claude/skills/gitnexus/gitnexus-refactoring/SKILL.md` |
+| Tools, resources, schema reference | `.claude/skills/gitnexus/gitnexus-guide/SKILL.md` |
+| Index, status, clean, wiki CLI commands | `.claude/skills/gitnexus/gitnexus-cli/SKILL.md` |
+
+<!-- gitnexus:end -->
@@ -0,0 +1,10 @@
+# Node.js 原生部署与 Python venv
+
+设置 `QL_DIR` 为安装目录，`QL_DATA_DIR` 为以 `/data` 结尾的绝对持久化数据路径。
+如需隔离 Python，请在启动进程的环境中显式设置 `PYTHON_VENV_DIR`（绝对路径或相对 `QL_DIR` 的路径），例如 `export PYTHON_VENV_DIR=/srv/qinglong/.venv`。未设置时保留现有 Python prefix 行为。
+
+- `qinglong`（`shell/start.sh`）安装系统依赖和 Node 工具，并安装 Python requests，然后调用公共启动脚本。
+- `npm run start:simple`（`shell/start-simplify.sh`）使用已准备的 Node、pm2、nginx、jq 等依赖，不安装系统包、全局 npm 包或 requests；显式指定的 venv 不存在时仍会创建。请先在 venv 中安装 requests 和任务所需依赖。
+- 两种启动方式均保留已有 `.env`；使用 venv 时清除继承的 `PYTHONPATH`/`PYTHONUSERBASE`，依赖查询、安装和卸载使用该 venv 的 Python。
+
+该模式需具备现有启动流程所要求的 nginx 配置和 pm2 服务权限。生产环境设置变量应通过 systemd 的 `Environment` 或相应进程配置完成。已有系统 Python 依赖不自动迁移至 venv，需在 venv 中重新安装。
@@ -18,9 +18,9 @@ Timed task management platform supporting Python3, JavaScript, Shell, Typescript
 [docker-image-size-image]: https://img.shields.io/docker/image-size/whyour/qinglong?style=flat
 [docker-image-size-url]: https://hub.docker.com/r/whyour/qinglong

-[Demo](http://demo.ninesix.cc:4433/) / [Issues](https://github.com/whyour/qinglong/issues) / [Telegram Channel](https://t.me/jiao_long) / [Buy Me a Coffee](https://www.buymeacoffee.com/qinglong)
+[Demo](http://demo.qinglong.online:4433/) / [Issues](https://github.com/whyour/qinglong/issues) / [Telegram Channel](https://t.me/jiao_long) / [Buy Me a Coffee](https://www.buymeacoffee.com/qinglong)

-[演示](http://demo.ninesix.cc:4433/) / [反馈](https://github.com/whyour/qinglong/issues) / [Telegram 频道](https://t.me/jiao_long) / [打赏开发者](https://user-images.githubusercontent.com/22700758/244744295-29cd0cd1-c8bb-4ea1-adf6-29bd390ad4dd.jpg)
+[演示](http://demo.qinglong.online:4433/) / [反馈](https://github.com/whyour/qinglong/issues) / [Telegram 频道](https://t.me/jiao_long) / [打赏开发者](https://user-images.githubusercontent.com/22700758/244744295-29cd0cd1-c8bb-4ea1-adf6-29bd390ad4dd.jpg)
 </div>

 ![cover](https://user-images.githubusercontent.com/22700758/244847235-8dc1ca21-e03f-4606-9458-0541fab60413.png)
@@ -34,6 +34,7 @@ Timed task management platform supporting Python3, JavaScript, Shell, Typescript
 - Support system level notification
 - Support dark mode
 - Support cell phone operation
+- Manage panels through the [remote CLI and Agent Skill](#remote-cli-and-agent-skill)

 ## Version

@@ -41,11 +42,24 @@ Timed task management platform supporting Python3, JavaScript, Shell, Typescript

 The `latest` image is built on `alpine` and the `debian` image is built on `debian-slim`. If you need to use a dependency that is not supported by `alpine`, it is recommended that you use the `debian` image.

+**⚠️ Important**: If you need to run Docker as a **non-root user**, please use the `debian` image. Alpine's `crond` requires root privileges.
+
 ```bash
 docker pull whyour/qinglong:latest
 docker pull whyour/qinglong:debian
 ```

+When running the `debian` image as a non-root user, specify `--user qinglong`:
+
+```bash
+docker run -d \
+  -v /path/to/ql/data:/ql/data \
+  -p 5700:5700 \
+  --user qinglong \
+  --name qinglong \
+  whyour/qinglong:debian
+```
+
 ### npm

 The npm version supports `debian/ubuntu/alpine` systems and requires `node/npm/python3/pip3/pnpm` to be installed.
@@ -66,6 +80,29 @@ npm i @whyour/qinglong

 [View Documentation](https://qinglong.online/guide/user-guide/basic-explanation)

+## Remote CLI and Agent Skill
+
+Use the standalone npm package [@whyour/qinglong-cli](https://www.npmjs.com/package/@whyour/qinglong-cli) to manage a remote QingLong panel from your terminal or automation workflows. Create, update and run tasks and subscriptions, inspect logs, and manage applications, environment variables, scripts, configuration, dependencies and other OpenAPI resources. JSON output supports scripts and AI agents.
+
+Requires Node.js >=22.12; Node.js 24 is recommended. Install the package to use `ql`:
+
+```bash
+npm install -g @whyour/qinglong-cli
+ql login --url https://ql.example.com
+ql auth status --json
+ql task list --json
+ql subscription list --json
+ql --help
+```
+
+Create an application in the panel's System Settings → Application Settings and grant the required permissions. Enter its Client ID/Secret when prompted during login. Existing tokens are also supported through `QL_URL` and `QL_ACCESS_TOKEN`. Each command supports `--help`; set `QL_LANG=en` for English help.
+
+The npm CLI manages remote panels. The panel's built-in executable is also named `ql`; use a separate installation directory on panel hosts to avoid replacing it. For local script execution and maintenance, see [panel-internal tools](cli/LOCAL.en.md).
+
+[CLI guide](cli/README.en.md) · [简体中文](cli/README.md) · [Full command reference](cli/skills/qinglong-cli/references/openapi.md)
+
+The package includes a [remote management skill](cli/skills/qinglong-cli/SKILL.md) covering authentication, command selection and result verification for AI agents. Local execution and maintenance have a separate [internal skill](cli/skills/qinglong-local/SKILL.md).
+
 ## Development

 ```bash
@@ -20,9 +20,9 @@ Timed task management platform supporting Python3, JavaScript, Shell, Typescript
 [docker-image-size-image]: https://img.shields.io/docker/image-size/whyour/qinglong?style=flat
 [docker-image-size-url]: https://hub.docker.com/r/whyour/qinglong

-[Demo](http://demo.ninesix.cc:4433/) / [Issues](https://github.com/whyour/qinglong/issues) / [Telegram Channel](https://t.me/jiao_long) / [Buy Me a Coffee](https://www.buymeacoffee.com/qinglong)
+[Demo](http://demo.qinglong.online:4433/) / [Issues](https://github.com/whyour/qinglong/issues) / [Telegram Channel](https://t.me/jiao_long) / [Buy Me a Coffee](https://www.buymeacoffee.com/qinglong)

-[演示](http://demo.ninesix.cc:4433/) / [反馈](https://github.com/whyour/qinglong/issues) / [Telegram 频道](https://t.me/jiao_long) / [打赏开发者](https://user-images.githubusercontent.com/22700758/244744295-29cd0cd1-c8bb-4ea1-adf6-29bd390ad4dd.jpg)
+[演示](http://demo.qinglong.online:4433/) / [反馈](https://github.com/whyour/qinglong/issues) / [Telegram 频道](https://t.me/jiao_long) / [打赏开发者](https://user-images.githubusercontent.com/22700758/244744295-29cd0cd1-c8bb-4ea1-adf6-29bd390ad4dd.jpg)
 </div>

 ![cover](https://user-images.githubusercontent.com/22700758/244847235-8dc1ca21-e03f-4606-9458-0541fab60413.png)
@@ -36,6 +36,7 @@ Timed task management platform supporting Python3, JavaScript, Shell, Typescript
 - 支持系统级通知
 - 支持暗黑模式
 - 支持手机端操作
+- 支持通过 [远程 CLI 与 Agent Skill](#远程-cli-与-agent-skill) 管理面板

 ## 版本

@@ -43,11 +44,24 @@ Timed task management platform supporting Python3, JavaScript, Shell, Typescript

 `latest` 镜像是基于 `alpine` 构建，`debian` 镜像是基于 `debian-slim` 构建。如果需要使用 `alpine` 不支持的依赖，建议使用 `debian` 镜像

+**⚠️ 重要提示**: 如果您需要以**非 root 用户**运行 Docker，请使用 `debian` 镜像。Alpine 的 `crond` 需要 root 权限。
+
 ```bash
 docker pull whyour/qinglong:latest
 docker pull whyour/qinglong:debian
 ```

+使用 `debian` 镜像以非 root 用户运行时，需指定 `--user qinglong`：
+
+```bash
+docker run -d \
+  -v /path/to/ql/data:/ql/data \
+  -p 5700:5700 \
+  --user qinglong \
+  --name qinglong \
+  whyour/qinglong:debian
+```
+
 ### npm

 npm 版本支持 `debian/ubuntu/alpine` 系统，需要自行安装 `node/npm/python3/pip3/pnpm`
@@ -68,6 +82,29 @@ npm i @whyour/qinglong

 [查看文档](https://qinglong.online/guide/user-guide/basic-explanation)

+## 远程 CLI 与 Agent Skill
+
+使用独立 npm 包 [@whyour/qinglong-cli](https://www.npmjs.com/package/@whyour/qinglong-cli)，可以从本机终端或自动化流程管理远程青龙面板。支持任务与订阅的创建、修改、运行和日志查看，以及应用、环境变量、脚本、配置、依赖等 OpenAPI 资源；JSON 输出便于脚本和 AI Agent 使用。
+
+需要 Node.js >=22.12，推荐 Node.js 24。安装后使用 `ql` 命令：
+
+```bash
+npm install -g @whyour/qinglong-cli
+ql login --url https://ql.example.com
+ql auth status --json
+ql task list --json
+ql subscription list --json
+ql --help
+```
+
+在面板「系统设置 → 应用设置」创建应用并授予所需权限，登录时按提示输入 Client ID/Secret；也支持通过 `QL_URL` 和 `QL_ACCESS_TOKEN` 使用已有令牌。各命令支持 `--help`，`QL_LANG=en` 可切换英文帮助。
+
+npm CLI 用于远程管理。面板内置 `ql` 同样使用这个命令名，已有面板的机器请使用独立安装目录，避免覆盖内置命令。本机脚本执行和运维见 [面板内部工具](cli/LOCAL.md)。
+
+[CLI 中文说明](cli/README.md) · [English guide](cli/README.en.md) · [完整命令参考](cli/skills/qinglong-cli/references/openapi.md)
+
+包内附带 [远程管理 Skill](cli/skills/qinglong-cli/SKILL.md)，涵盖认证、命令选择和操作结果检查，可供 AI Agent 使用。本机执行与运维另见 [内部 Skill](cli/skills/qinglong-local/SKILL.md)。
+
 ## 开发

 ```bash
@@ -1,9 +0,0 @@
-import 'express';
-
-declare global {
-  namespace Express {
-    interface Request {
-      platform: string;
-    }
-  }
-}
@@ -0,0 +1,56 @@
+import { NextFunction, Request, Response, Router } from 'express';
+import { celebrate, Joi } from 'celebrate';
+import { t } from '../shared/i18n';
+import {
+  diagnoseClientIp,
+  getTrustProxyConfig,
+  updateTrustProxy,
+} from '../shared/trustProxy';
+
+const route = Router();
+
+export default (app: Router) => {
+  app.use('/system/client-ip', route);
+
+  route.get(
+    '/config',
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        res.send({ code: 200, data: await getTrustProxyConfig() });
+      } catch (error) {
+        next(error);
+      }
+    },
+  );
+
+  route.put(
+    '/config',
+    celebrate({
+      body: Joi.object({
+        trustProxy: Joi.string().max(500).required(),
+      }),
+    }),
+    async (req: Request, res: Response) => {
+      try {
+        const data = await updateTrustProxy(req.body.trustProxy);
+        res.send({ code: 200, data });
+      } catch (error) {
+        res.send({
+          code: 400,
+          message: error instanceof Error ? error.message : t('配置更新失败'),
+        });
+      }
+    },
+  );
+
+  route.get(
+    '/diagnose',
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        res.send({ code: 200, data: await diagnoseClientIp(req) });
+      } catch (error) {
+        next(error);
+      }
+    },
+  );
+};
@@ -4,17 +4,18 @@ import { Logger } from 'winston';
 import config from '../config';
 import * as fs from 'fs/promises';
 import { celebrate, Joi } from 'celebrate';
-import { join } from 'path';
 import { SAMPLE_FILES } from '../config/const';
+import { t } from '../shared/i18n';
 import ConfigService from '../services/config';
 import { writeFileWithLock } from '../shared/utils';
+import { resolveFileAccess } from '../shared/fileAccess';
 const route = Router();

 export default (app: Router) => {
  app.use('/configs', route);

  route.get(
-    '/sample',
+    '/samples',
    async (req: Request, res: Response, next: NextFunction) => {
      try {
        res.send({
@@ -71,30 +72,29 @@ export default (app: Router) => {
      const logger: Logger = Container.get('logger');
      try {
        const { name, content } = req.body;
-        if (config.blackFileList.includes(name)) {
-          res.send({ code: 403, message: '文件无法访问' });
-        }
-        let path = join(config.configPath, name);
        if (name.startsWith('data/scripts/')) {
-          path = join(config.rootPath, name);
+          return res.send({ code: 403, message: t('文件无法访问') });
        }
-        await writeFileWithLock(path, content);
-        res.send({ code: 200, message: '保存成功' });
+        const normalized = resolveFileAccess(
+          config.configPath,
+          [name],
+          config.blackFileList,
+        );
+        if (!normalized) {
+          return res.send({ code: 403, message: t('文件无法访问') });
+        }
+        await writeFileWithLock(normalized, content);
+        res.send({ code: 200, message: t('保存成功') });
      } catch (e) {
        return next(e);
      }
    },
  );

-  route.get(
-    '/:file',
-    async (req: Request, res: Response, next: NextFunction) => {
-      try {
-        const configService = Container.get(ConfigService);
-        await configService.getFile(req.params.file, res);
-      } catch (e) {
-        return next(e);
-      }
-    },
-  );
+  route.get('/:file', (req: Request, res: Response) => {
+    return res.send({
+      code: 410,
+      message: t('接口已下线，请使用 /configs/detail 接口'),
+    });
+  });
 };
@@ -5,12 +5,31 @@ import CronService from '../services/cron';
 import CronViewService from '../services/cronView';
 import { celebrate, Joi } from 'celebrate';
 import { commonCronSchema } from '../validation/schedule';
+import {
+  RunningInstanceModel,
+  InstanceStatus,
+} from '../data/runningInstance';
+import { t } from '../shared/i18n';
+import cronClient from '../schedule/client';

 const route = Router();

 export default (app: Router) => {
  app.use('/crons', route);

+  route.use(async (req, res, next) => {
+    // Keep stop/status callbacks available even when the scheduler is down.
+    if (['POST', 'PUT', 'DELETE'].includes(req.method) &&
+      ['/', '/run', '/enable', '/disable', '/views/enable', '/views/disable'].includes(req.path)) {
+      try {
+        await cronClient.readiness.ensureReady();
+      } catch (error) {
+        return next(error);
+      }
+    }
+    return next();
+  });
+
  route.get(
    '/views',
    async (req: Request, res: Response, next: NextFunction) => {
@@ -60,7 +79,7 @@ export default (app: Router) => {
      try {
        const cronViewService = Container.get(CronViewService);
        if (req.body.type === 1) {
-          return res.send({ code: 400, message: '参数错误' });
+          return res.send({ code: 400, message: t('参数错误') });
        } else {
          const data = await cronViewService.update(req.body);
          return res.send({ code: 200, data });
@@ -302,13 +321,35 @@ export default (app: Router) => {
      params: Joi.object({
        id: Joi.number().required(),
      }),
+      query: Joi.object({
+        offset: Joi.number().integer().min(0).optional(),
+        limit: Joi.number()
+          .integer()
+          .min(1)
+          .max(1024 * 1024)
+          .optional(),
+        tail: Joi.boolean().optional(),
+        t: Joi.string().optional(),
+      }).unknown(true),
    }),
    async (req: Request<{ id: number }>, res: Response, next: NextFunction) => {
      const logger: Logger = Container.get('logger');
      try {
        const cronService = Container.get(CronService);
-        const data = await cronService.log(req.params.id);
-        return res.send({ code: 200, data });
+        const result = await cronService.log(req.params.id, {
+          offset: req.query.offset as unknown as number,
+          limit: req.query.limit as unknown as number,
+          tail: req.query.tail as unknown as boolean,
+        });
+        return res.send({
+          code: 200,
+          data: result.content,
+          logStatus: result.status,
+          offset: result.offset,
+          nextOffset: result.nextOffset,
+          total: result.total,
+          truncated: result.truncated,
+        });
      } catch (e) {
        return next(e);
      }
@@ -429,6 +470,7 @@ export default (app: Router) => {
        log_path: Joi.string().optional().allow(null),
        last_running_time: Joi.number().optional().allow(null),
        last_execution_time: Joi.number().optional().allow(null),
+        exit_code: Joi.number().optional().allow(null),
      }),
    }),
    async (req: Request, res: Response, next: NextFunction) => {
@@ -446,6 +488,48 @@ export default (app: Router) => {
    },
  );

+  route.get(
+    '/:id/instances',
+    celebrate({
+      params: Joi.object({
+        id: Joi.number().required(),
+      }),
+    }),
+    async (req: Request<{ id: number }>, res: Response, next: NextFunction) => {
+      try {
+        const instances = await RunningInstanceModel.findAll({
+          where: {
+            cron_id: req.params.id,
+          },
+          order: [['started_at', 'DESC']],
+          raw: true,
+        });
+        return res.send({ code: 200, data: instances });
+      } catch (e) {
+        return next(e);
+      }
+    },
+  );
+
+  route.post(
+    '/:id/instances/:instanceId/stop',
+    celebrate({
+      params: Joi.object({
+        id: Joi.number().required(),
+        instanceId: Joi.number().required(),
+      }),
+    }),
+    async (req: Request<{ id: number; instanceId: number }>, res: Response, next: NextFunction) => {
+      try {
+        const cronService = Container.get(CronService);
+        const data = await cronService.stopInstance(req.params.instanceId);
+        return res.send(data);
+      } catch (e) {
+        return next(e);
+      }
+    },
+  );
+
  route.get(
    '/:id/logs',
    celebrate({
@@ -0,0 +1,437 @@
+import { Router, Request, Response, NextFunction } from 'express';
+import { Container } from 'typedi';
+import { fn, col, where, Op } from 'sequelize';
+import { CrontabModel } from '../data/cron';
+import { CrontabStatModel } from '../data/cronStats';
+import {
+  RunningInstanceModel,
+  InstanceStatus,
+} from '../data/runningInstance';
+import dayjs from 'dayjs';
+import os from 'os';
+import { isEmpty } from 'lodash';
+import { t, tf } from '../shared/i18n';
+
+const route = Router();
+
+export default (app: Router) => {
+  app.use('/dashboard', route);
+
+  route.post('/record', async (req: Request, res: Response) => {
+    try {
+      const { ref_id, code, elapsed } = req.body;
+      if (!ref_id) return res.send({ code: 400, message: 'ref_id required' });
+
+      const today = dayjs().format('YYYY-MM-DD');
+      const isSuccess = code === 0 ? 1 : 0;
+      const isFail = code !== 0 ? 1 : 0;
+      const elapsedMs = (Number(elapsed) || 0) * 1000;
+
+      const existing = await CrontabStatModel.findOne({
+        where: { ref_id: Number(ref_id), date: today },
+      });
+
+      if (existing) {
+        await CrontabStatModel.update(
+          {
+            run_count: (existing.run_count || 0) + 1,
+            success_count: (existing.success_count || 0) + isSuccess,
+            fail_count: (existing.fail_count || 0) + isFail,
+            total_time: (existing.total_time || 0) + elapsedMs,
+            max_time: Math.max(existing.max_time || 0, elapsedMs),
+          },
+          { where: { id: existing.id } },
+        );
+      } else {
+        await CrontabStatModel.create({
+          ref_id: Number(ref_id),
+          date: today,
+          run_count: 1,
+          success_count: isSuccess,
+          fail_count: isFail,
+          total_time: elapsedMs,
+          max_time: elapsedMs,
+        });
+      }
+
+      res.send({ code: 200 });
+    } catch (e) {
+      res.send({ code: 500 });
+    }
+  });
+
+  route.get(
+    '/overview',
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const today = dayjs().format('YYYY-MM-DD');
+
+        const [total, enabled, disabled, stats] = await Promise.all([
+          CrontabModel.count(),
+          CrontabModel.count({ where: { isDisabled: 0 } }),
+          CrontabModel.count({ where: { isDisabled: 1 } }),
+          CrontabStatModel.findOne({
+            attributes: [
+              [fn('SUM', col('run_count')), 'total_runs'],
+              [fn('SUM', col('success_count')), 'total_success'],
+              [fn('SUM', col('fail_count')), 'total_fail'],
+              [fn('SUM', col('total_time')), 'total_time'],
+            ],
+            where: { date: today },
+            raw: true,
+          }),
+        ]);
+
+        const row = stats as any;
+        const totalRuns = Number(row?.total_runs) || 0;
+        const totalSuccess = Number(row?.total_success) || 0;
+        const totalFail = Number(row?.total_fail) || 0;
+        const totalTime = Number(row?.total_time) || 0;
+
+        res.send({
+          code: 200,
+          data: {
+            total,
+            enabled,
+            disabled,
+            todayRuns: totalRuns,
+            todaySuccess: totalSuccess,
+            todayFail: totalFail,
+            successRate: totalRuns > 0 ? ((totalSuccess / totalRuns) * 100).toFixed(1) : '0',
+            avgTime: totalRuns > 0 ? Math.round(totalTime / totalRuns) : 0,
+          },
+        });
+      } catch (e) {
+        next(e);
+      }
+    },
+  );
+
+  for (const isSuccess of [false, true]) {
+    route.get(
+      isSuccess ? '/successes' : '/failures',
+      async (req: Request, res: Response, next: NextFunction) => {
+        try {
+          const countColumn = isSuccess ? 'success_count' : 'fail_count';
+          const rows = (await CrontabStatModel.findAll({
+            attributes: ['ref_id', [fn('SUM', col(countColumn)), 'result_count']],
+            where: { date: dayjs().format('YYYY-MM-DD'), [countColumn]: { [Op.gt]: 0 } },
+            group: ['ref_id'],
+            order: [[fn('SUM', col(countColumn)), 'DESC'], ['ref_id', 'ASC']],
+            raw: true,
+          })) as any[];
+          const crons = rows.length > 0 ? await CrontabModel.findAll({
+            attributes: ['id', 'name', 'command'],
+            where: { id: { [Op.in]: rows.map((row) => Number(row.ref_id)) } },
+            raw: true,
+          }) : [];
+          const cronMap = new Map(crons.map((cron) => [cron.id, cron]));
+          res.send({
+            code: 200,
+            data: rows.map((row) => {
+              const id = Number(row.ref_id);
+              const cron = cronMap.get(id);
+              return {
+                id,
+                name: cron?.name || cron?.command || tf('任务#%s', id),
+                command: cron?.command || '',
+                [isSuccess ? 'successCount' : 'failCount']: Number(row.result_count),
+                deleted: !cron,
+              };
+            }),
+          });
+        } catch (e) {
+          next(e);
+        }
+      },
+    );
+  }
+
+  route.get(
+    '/trend',
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const days = parseInt(req.query.days as string) || 7;
+        const dates: string[] = [];
+        for (let i = days - 1; i >= 0; i--) {
+          dates.push(dayjs().subtract(i, 'day').format('YYYY-MM-DD'));
+        }
+
+        const rows = (await CrontabStatModel.findAll({
+          attributes: [
+            'date',
+            [fn('SUM', col('run_count')), 'total_runs'],
+            [fn('SUM', col('success_count')), 'total_success'],
+            [fn('SUM', col('fail_count')), 'total_fail'],
+          ],
+          where: {
+            date: { [Op.in]: dates },
+          },
+          group: ['date'],
+          order: [['date', 'ASC']],
+          raw: true,
+        })) as any[];
+
+        const dataMap: Record<string, any> = {};
+        rows.forEach((r: any) => {
+          dataMap[r.date] = {
+            total: Number(r.total_runs) || 0,
+            success: Number(r.total_success) || 0,
+            fail: Number(r.total_fail) || 0,
+          };
+        });
+
+        const data = dates.map((d) => ({
+          date: dayjs(d).format('MM-DD'),
+          ...(dataMap[d] || { total: 0, success: 0, fail: 0 }),
+        }));
+
+        res.send({ code: 200, data });
+      } catch (e) {
+        next(e);
+      }
+    },
+  );
+
+  route.get(
+    '/top-time',
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const today = dayjs().format('YYYY-MM-DD');
+
+        const rows = (await CrontabStatModel.findAll({
+          attributes: [
+            'ref_id',
+            [fn('SUM', col('total_time')), 'total_time'],
+            [fn('SUM', col('run_count')), 'run_count'],
+            [fn('MAX', col('max_time')), 'max_time'],
+          ],
+          where: { date: today, run_count: { [Op.gt]: 0 } },
+          group: ['ref_id'],
+          order: [[fn('SUM', col('total_time')), 'DESC']],
+          limit: 5,
+          raw: true,
+        })) as any[];
+
+        const ids = rows.map((r) => Number(r.ref_id));
+        const crons = await CrontabModel.findAll({
+          where: { id: { [Op.in]: ids } },
+          raw: true,
+        });
+        const nameMap: Record<number, string> = {};
+        crons.forEach((c: any) => { nameMap[c.id] = c.name || c.command; });
+
+        const data = rows.map((r: any, i) => ({
+          rank: i + 1,
+          name: nameMap[Number(r.ref_id)] || tf('任务#%s', r.ref_id),
+          avgTime: Math.round(Number(r.total_time) / Number(r.run_count)),
+          maxTime: Number(r.max_time),
+        }));
+
+        res.send({ code: 200, data });
+      } catch (e) {
+        next(e);
+      }
+    },
+  );
+
+  route.get(
+    '/top-count',
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const today = dayjs().format('YYYY-MM-DD');
+
+        const rows = (await CrontabStatModel.findAll({
+          attributes: [
+            'ref_id',
+            [fn('SUM', col('run_count')), 'run_count'],
+            [fn('SUM', col('total_time')), 'total_time'],
+            [fn('SUM', col('success_count')), 'success_count'],
+          ],
+          where: { date: today, run_count: { [Op.gt]: 0 } },
+          group: ['ref_id'],
+          order: [[fn('SUM', col('run_count')), 'DESC']],
+          limit: 5,
+          raw: true,
+        })) as any[];
+
+        const ids = rows.map((r) => Number(r.ref_id));
+        const crons = await CrontabModel.findAll({
+          where: { id: { [Op.in]: ids } },
+          raw: true,
+        });
+        const nameMap: Record<number, string> = {};
+        crons.forEach((c: any) => { nameMap[c.id] = c.name || c.command; });
+
+        const data = rows.map((r: any, i) => ({
+          rank: i + 1,
+          name: nameMap[Number(r.ref_id)] || tf('任务#%s', r.ref_id),
+          runCount: Number(r.run_count),
+          avgTime: Math.round(Number(r.total_time) / Number(r.run_count)),
+          successRate:
+            Number(r.run_count) > 0
+              ? ((Number(r.success_count) / Number(r.run_count)) * 100).toFixed(1)
+              : '0',
+        }));
+
+        res.send({ code: 200, data });
+      } catch (e) {
+        next(e);
+      }
+    },
+  );
+
+  route.get(
+    '/runtime',
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const runningInstances = await RunningInstanceModel.findAll({
+          where: {
+            status: InstanceStatus.running,
+          },
+          raw: true,
+        });
+
+        const queuedCrons = await CrontabModel.findAll({
+          where: {
+            status: 3, // queued
+          },
+          raw: true,
+        });
+
+        // Fetch cron names for running instances
+        const cronIds = [
+          ...new Set(runningInstances.map((i: any) => i.cron_id)),
+        ];
+        const crons =
+          cronIds.length > 0
+            ? await CrontabModel.findAll({
+              where: { id: cronIds },
+              raw: true,
+            })
+            : [];
+        const cronMap = new Map(crons.map((c: any) => [c.id, c]));
+
+        const now = dayjs().unix();
+        const running = runningInstances.map((inst: any) => {
+          const cron = cronMap.get(inst.cron_id);
+          return {
+            instanceId: inst.id,
+            id: inst.cron_id,
+            name: cron?.name || cron?.command || tf('任务#%s', inst.cron_id),
+            pid: inst.pid,
+            elapsed: inst.started_at ? now - inst.started_at : 0,
+            logPath: inst.log_path,
+          };
+        });
+
+        const dayAgo = dayjs().subtract(24, 'hour').unix();
+        const idleTasks = await CrontabModel.findAll({
+          where: {
+            isDisabled: 0,
+            status: 1,
+            last_execution_time: { [Op.lt]: dayAgo },
+          },
+          order: [['last_execution_time', 'ASC']],
+          limit: 5,
+          raw: true,
+        });
+
+        res.send({
+          code: 200,
+          data: {
+            runningCount: running.length,
+            queuedCount: queuedCrons.length,
+            running,
+            idleTasks: idleTasks.map((c: any) => ({
+              id: c.id,
+              name: c.name || c.command || tf('任务#%s', c.id),
+              lastRun: c.last_execution_time
+                ? dayjs.unix(c.last_execution_time).format('MM-DD HH:mm')
+                : '-',
+            })),
+          },
+        });
+      } catch (e) {
+        next(e);
+      }
+    },
+  );
+
+  route.get(
+    '/labels',
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const today = dayjs().format('YYYY-MM-DD');
+        const [crons, stats] = (await Promise.all([
+          CrontabModel.findAll({ where: { isDisabled: 0 }, raw: true }),
+          CrontabStatModel.findAll({ where: { date: today }, raw: true }),
+        ]));
+
+        const statMap: Record<number, any> = {};
+        stats.forEach((s: any) => { statMap[s.ref_id] = s; });
+
+        const labelMap: Record<string, { count: number; runs: number; success: number; totalTime: number }> = {};
+        crons.forEach((c) => {
+          let rawLabels = c.labels;
+          if (typeof rawLabels === 'string') rawLabels = JSON.parse(rawLabels);
+          const labels: string[] = Array.isArray(rawLabels)
+            ? [...new Set((rawLabels as string[]).filter((l: string) => !isEmpty(l)))]
+            : [];
+          if (labels.length === 0) {
+            labels.push(t('未分类'));
+          }
+          const st = statMap[c.id!];
+          labels.forEach((label: string) => {
+            if (!labelMap[label]) labelMap[label] = { count: 0, runs: 0, success: 0, totalTime: 0 };
+            labelMap[label].count += 1;
+            if (st) {
+              labelMap[label].runs += Number(st.run_count) || 0;
+              labelMap[label].success += Number(st.success_count) || 0;
+              labelMap[label].totalTime += Number(st.total_time) || 0;
+            }
+          });
+        });
+
+        const data = Object.entries(labelMap)
+          .map(([label, v]) => ({
+            label,
+            count: v.count,
+            todayRuns: v.runs,
+            successRate: v.runs > 0 ? ((v.success / v.runs) * 100).toFixed(1) : '0',
+            avgTime: v.runs > 0 ? Math.round(v.totalTime / v.runs) : 0,
+          }))
+          .sort((a, b) => b.todayRuns - a.todayRuns);
+
+        res.send({ code: 200, data });
+      } catch (e) {
+        next(e);
+      }
+    },
+  );
+
+  route.get(
+    '/system',
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const memUsage = process.memoryUsage();
+        res.send({
+          code: 200,
+          data: {
+            platform: os.platform(),
+            uptime: Math.floor(process.uptime()),
+            memTotal: os.totalmem(),
+            memFree: os.freemem(),
+            memUsagePercent: ((1 - os.freemem() / os.totalmem()) * 100).toFixed(1),
+            heapUsed: Math.round(memUsage.heapUsed / 1024 / 1024),
+            heapTotal: Math.round(memUsage.heapTotal / 1024 / 1024),
+            loadAvg: os.loadavg().map((v) => Number(v.toFixed(2))),
+            cpus: os.cpus().length,
+          },
+        });
+      } catch (e) {
+        next(e);
+      }
+    },
+  );
+};
@@ -8,17 +8,28 @@ const route = Router();
 export default (app: Router) => {
  app.use('/dependencies', route);

-  route.get('/', async (req: Request, res: Response, next: NextFunction) => {
-    const logger: Logger = Container.get('logger');
-    try {
-      const dependenceService = Container.get(DependenceService);
-      const data = await dependenceService.dependencies(req.query as any);
-      return res.send({ code: 200, data });
-    } catch (e) {
-      logger.error('🔥 error: %o', e);
-      return next(e);
-    }
-  });
+  route.get(
+    '/',
+    celebrate({
+      query: 
+        Joi.object({
+          searchValue: Joi.string().optional().allow(''),
+          type: Joi.string().optional().allow(''),
+          status: Joi.string().optional().allow(''),
+        }).unknown(true),
+    }),
+    async (req: Request, res: Response, next: NextFunction) => {
+      const logger: Logger = Container.get('logger');
+      try {
+        const dependenceService = Container.get(DependenceService);
+        const data = await dependenceService.dependencies(req.query as any);
+        return res.send({ code: 200, data });
+      } catch (e) {
+        logger.error('🔥 error: %o', e);
+        return next(e);
+      }
+    },
+  );

  route.post(
    '/',
@@ -32,7 +43,6 @@ export default (app: Router) => {
      ),
    }),
    async (req: Request, res: Response, next: NextFunction) => {
-      const logger: Logger = Container.get('logger');
      try {
        const dependenceService = Container.get(DependenceService);
        const data = await dependenceService.create(req.body);
@@ -54,7 +64,6 @@ export default (app: Router) => {
      }),
    }),
    async (req: Request, res: Response, next: NextFunction) => {
-      const logger: Logger = Container.get('logger');
      try {
        const dependenceService = Container.get(DependenceService);
        const data = await dependenceService.update(req.body);
@@ -71,7 +80,6 @@ export default (app: Router) => {
      body: Joi.array().items(Joi.number().required()),
    }),
    async (req: Request, res: Response, next: NextFunction) => {
-      const logger: Logger = Container.get('logger');
      try {
        const dependenceService = Container.get(DependenceService);
        const data = await dependenceService.remove(req.body);
@@ -88,7 +96,6 @@ export default (app: Router) => {
      body: Joi.array().items(Joi.number().required()),
    }),
    async (req: Request, res: Response, next: NextFunction) => {
-      const logger: Logger = Container.get('logger');
      try {
        const dependenceService = Container.get(DependenceService);
        const data = await dependenceService.remove(req.body, true);
@@ -107,7 +114,6 @@ export default (app: Router) => {
      }),
    }),
    async (req: Request<{ id: number }>, res: Response, next: NextFunction) => {
-      const logger: Logger = Container.get('logger');
      try {
        const dependenceService = Container.get(DependenceService);
        const data = await dependenceService.getDb({ id: req.params.id });
@@ -124,7 +130,6 @@ export default (app: Router) => {
      body: Joi.array().items(Joi.number().required()),
    }),
    async (req: Request, res: Response, next: NextFunction) => {
-      const logger: Logger = Container.get('logger');
      try {
        const dependenceService = Container.get(DependenceService);
        const data = await dependenceService.reInstall(req.body);
@@ -1,23 +1,20 @@
-import { Router, Request, Response, NextFunction } from 'express';
-import { Container } from 'typedi';
-import EnvService from '../services/env';
-import { Logger } from 'winston';
-import { celebrate, Joi } from 'celebrate';
+import { Joi, celebrate } from 'celebrate';
+import { NextFunction, Request, Response, Router } from 'express';
 import multer from 'multer';
-import config from '../config';
-import fs from 'fs';
-import { safeJSONParse } from '../config/util';
+import { Container } from 'typedi';
+import { Logger } from 'winston';
+import { t } from '../shared/i18n';
+import EnvService from '../services/env';
 const route = Router();

-const storage = multer.diskStorage({
-  destination: function (req, file, cb) {
-    cb(null, config.scriptPath);
-  },
-  filename: function (req, file, cb) {
-    cb(null, file.originalname);
-  },
+const upload = multer({
+  storage: multer.memoryStorage(),
+  limits: { fileSize: 5 * 1024 * 1024, files: 1 },
 });
-const upload = multer({ storage: storage });
+const labelSchema = Joi.array()
+  .items(Joi.string().trim().required())
+  .min(1)
+  .required();

 export default (app: Router) => {
  app.use('/envs', route);
@@ -44,6 +41,7 @@ export default (app: Router) => {
            .required()
            .pattern(/^[a-zA-Z_][0-9a-zA-Z_]*$/),
          remarks: Joi.string().optional().allow(''),
+          labels: Joi.array().items(Joi.string().trim()).optional().allow(null),
        }),
      ),
    }),
@@ -52,7 +50,7 @@ export default (app: Router) => {
      try {
        const envService = Container.get(EnvService);
        if (!req.body?.length) {
-          return res.send({ code: 400, message: '参数不正确' });
+          return res.send({ code: 400, message: t('参数不正确') });
        }
        const data = await envService.create(req.body);
        return res.send({ code: 200, data });
@@ -70,6 +68,7 @@ export default (app: Router) => {
        name: Joi.string().required(),
        remarks: Joi.string().optional().allow('').allow(null),
        id: Joi.number().required(),
+        labels: Joi.array().items(Joi.string().trim()).optional().allow(null),
      }),
    }),
    async (req: Request, res: Response, next: NextFunction) => {
@@ -196,6 +195,78 @@ export default (app: Router) => {
    },
  );

+  route.put(
+    '/pin',
+    celebrate({
+      body: Joi.array().items(Joi.number().required()),
+    }),
+    async (req: Request, res: Response, next: NextFunction) => {
+      const logger: Logger = Container.get('logger');
+      try {
+        const envService = Container.get(EnvService);
+        const data = await envService.pin(req.body);
+        return res.send({ code: 200, data });
+      } catch (e) {
+        return next(e);
+      }
+    },
+  );
+
+  route.put(
+    '/unpin',
+    celebrate({
+      body: Joi.array().items(Joi.number().required()),
+    }),
+    async (req: Request, res: Response, next: NextFunction) => {
+      const logger: Logger = Container.get('logger');
+      try {
+        const envService = Container.get(EnvService);
+        const data = await envService.unPin(req.body);
+        return res.send({ code: 200, data });
+      } catch (e) {
+        return next(e);
+      }
+    },
+  );
+
+  route.post(
+    '/labels',
+    celebrate({
+      body: Joi.object({
+        ids: Joi.array().items(Joi.number().required()).min(1).required(),
+        labels: labelSchema,
+      }),
+    }),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const envService = Container.get(EnvService);
+        const data = await envService.addLabels(req.body.ids, req.body.labels);
+        return res.send({ code: 200, data });
+      } catch (e) {
+        return next(e);
+      }
+    },
+  );
+
+  route.delete(
+    '/labels',
+    celebrate({
+      body: Joi.object({
+        ids: Joi.array().items(Joi.number().required()).min(1).required(),
+        labels: labelSchema,
+      }),
+    }),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const envService = Container.get(EnvService);
+        const data = await envService.removeLabels(req.body.ids, req.body.labels);
+        return res.send({ code: 200, data });
+      } catch (e) {
+        return next(e);
+      }
+    },
+  );
+
  route.post(
    '/upload',
    upload.single('env'),
@@ -203,24 +274,36 @@ export default (app: Router) => {
      const logger: Logger = Container.get('logger');
      try {
        const envService = Container.get(EnvService);
-        const fileContent = await fs.promises.readFile(req!.file!.path, 'utf8');
-        const parseContent = safeJSONParse(fileContent);
+        let parseContent: unknown;
+        try {
+          parseContent = JSON.parse(req.file?.buffer.toString('utf8') || '');
+        } catch {
+          return res.status(400).send({ code: 400, message: t('参数错误') });
+        }
        const data = Array.isArray(parseContent)
          ? parseContent
          : [parseContent];
-        if (data.every((x) => x.name && x.value)) {
+        if (
+          data.length > 0 &&
+          data.every((x) =>
+            x && typeof x.name === 'string' &&
+            /^[a-zA-Z_][0-9a-zA-Z_]*$/.test(x.name) &&
+            typeof x.value === 'string' && x.value.length > 0,
+          )
+        ) {
          const result = await envService.create(
            data.map((x) => ({
              name: x.name,
              value: x.value,
              remarks: x.remarks,
+              labels: x.labels,
            })),
          );
          return res.send({ code: 200, data: result });
        } else {
          return res.send({
            code: 400,
-            message: '每条数据 name 或者 value 字段不能为空，参考导出文件格式',
+            message: t('每条数据 name 或者 value 字段不能为空，参考导出文件格式'),
          });
        }
      } catch (e) {
@@ -0,0 +1,27 @@
+import { Router } from 'express';
+import Logger from '../loaders/logger';
+import { HealthService } from '../services/health';
+import Container from 'typedi';
+const route = Router();
+
+export default (app: Router) => {
+  app.use('/', route);
+
+  route.get('/health', async (req, res) => {
+    try {
+      const healthService = Container.get(HealthService);
+      const health = await healthService.check();
+      res.status(health.status === 'ok' ? 200 : 503).send({
+        code: health.status === 'ok' ? 200 : 503,
+        data: health,
+      });
+    } catch (err: any) {
+      Logger.error('Health check failed:', err);
+      res.status(500).send({
+        code: 500,
+        message: 'Health check failed',
+        error: err.message,
+      });
+    }
+  });
+};
@@ -9,6 +9,11 @@ import open from './open';
 import dependence from './dependence';
 import system from './system';
 import subscription from './subscription';
+import update from './update';
+import dashboard from './dashboard';
+import health from './health';
+import clientIp from './clientIp';
+import retention from './retention';

 export default () => {
  const app = Router();
@@ -22,6 +27,11 @@ export default () => {
  dependence(app);
  system(app);
  subscription(app);
+  update(app);
+  dashboard(app);
+  health(app);
+  clientIp(app);
+  retention(app);

  return app;
 };
@@ -3,13 +3,15 @@ import { NextFunction, Request, Response, Router } from 'express';
 import { Container } from 'typedi';
 import { Logger } from 'winston';
 import config from '../config';
+import { t } from '../shared/i18n';
 import {
-  getFileContentByName,
  readDirs,
  removeAnsi,
  rmPath,
 } from '../config/util';
 import LogService from '../services/log';
+import { InstanceStatus, RunningInstanceModel } from '../data/runningInstance';
+import { MAX_LOG_CHUNK_BYTES, readLogChunk } from '../shared/logReader';
 const route = Router();
 const blacklist = ['.tmp'];

@@ -32,6 +34,20 @@ export default (app: Router) => {

  route.get(
    '/detail',
+    celebrate({
+      query: Joi.object({
+        path: Joi.string().allow('').optional(),
+        file: Joi.string().required(),
+        offset: Joi.number().integer().min(0).optional(),
+        limit: Joi.number()
+          .integer()
+          .min(1)
+          .max(MAX_LOG_CHUNK_BYTES)
+          .optional(),
+        tail: Joi.boolean().optional(),
+        t: Joi.string().optional(),
+      }).unknown(true),
+    }),
    async (req: Request, res: Response, next: NextFunction) => {
      try {
        const logService = Container.get(LogService);
@@ -42,11 +58,28 @@ export default (app: Router) => {
        if (!finalPath || blacklist.includes(req.query.path as string)) {
          return res.send({
            code: 403,
-            message: '暂无权限',
+            message: t('暂无权限'),
          });
        }
-        const content = await getFileContentByName(finalPath);
-        res.send({ code: 200, data: removeAnsi(content) });
+        const logPath = `${req.query.path as string}/${req.query.file as string}`;
+        const runningInstance = await RunningInstanceModel.findOne({
+          where: { log_path: logPath, status: InstanceStatus.running },
+        });
+
+        const chunk = await readLogChunk(finalPath, {
+          offset: req.query.offset as unknown as number,
+          limit: req.query.limit as unknown as number,
+          tail: req.query.tail as unknown as boolean,
+        });
+        res.send({
+          code: 200,
+          data: removeAnsi(chunk.content),
+          logStatus: runningInstance ? 'running' : undefined,
+          offset: chunk.offset,
+          nextOffset: chunk.nextOffset,
+          total: chunk.total,
+          truncated: chunk.truncated,
+        });
      } catch (e) {
        return next(e);
      }
@@ -55,24 +88,11 @@ export default (app: Router) => {

  route.get(
    '/:file',
-    async (req: Request, res: Response, next: NextFunction) => {
-      try {
-        const logService = Container.get(LogService);
-        const finalPath = logService.checkFilePath(
-          (req.query.path as string) || '',
-          (req.query.file as string) || '',
-        );
-        if (!finalPath || blacklist.includes(req.query.path as string)) {
-          return res.send({
-            code: 403,
-            message: '暂无权限',
-          });
-        }
-        const content = await getFileContentByName(finalPath);
-        res.send({ code: 200, data: content });
-      } catch (e) {
-        return next(e);
-      }
+    (req: Request, res: Response) => {
+      return res.send({
+        code: 410,
+        message: t('接口已下线，请使用 /logs/detail 接口'),
+      });
    },
  );

@@ -92,11 +112,11 @@ export default (app: Router) => {
          path: string;
        };
        const logService = Container.get(LogService);
-        const finalPath = logService.checkFilePath(filename, path);
+        const finalPath = logService.checkFilePath(path, filename);
        if (!finalPath || blacklist.includes(path)) {
          return res.send({
            code: 403,
-            message: '暂无权限',
+            message: t('暂无权限'),
          });
        }
        await rmPath(finalPath);
@@ -126,7 +146,7 @@ export default (app: Router) => {
        if (!filePath) {
          return res.send({
            code: 403,
-            message: '暂无权限',
+            message: t('暂无权限'),
          });
        }
        return res.download(filePath, filename, (err) => {
@@ -3,6 +3,7 @@ import { Container } from 'typedi';
 import OpenService from '../services/open';
 import { Logger } from 'winston';
 import { celebrate, Joi } from 'celebrate';
+import { rateLimit } from 'express-rate-limit';
 const route = Router();

 export default (app: Router) => {
@@ -100,6 +101,7 @@ export default (app: Router) => {

  route.get(
    '/auth/token',
+    rateLimit({ windowMs: 15 * 60 * 1000, limit: 100 }),
    celebrate({
      query: {
        client_id: Joi.string().required(),
@@ -0,0 +1,78 @@
+import { NextFunction, Request, Response, Router } from 'express';
+import { celebrate, Joi } from 'celebrate';
+import { Container } from 'typedi';
+import RetentionService from '../services/retention';
+import { MAX_RETENTION_DAYS } from '../shared/retention';
+
+const route = Router();
+const policySchema = {
+  runningInstanceRetentionDays: Joi.number()
+    .integer()
+    .min(0)
+    .max(MAX_RETENTION_DAYS)
+    .required(),
+  cronStatRetentionDays: Joi.number()
+    .integer()
+    .min(0)
+    .max(MAX_RETENTION_DAYS)
+    .required(),
+};
+const cleanupSchema = {
+  ...policySchema,
+  dependenceCacheTypes: Joi.array()
+    .items(Joi.string().valid('node', 'python3'))
+    .unique()
+    .default([]),
+  compactDatabase: Joi.boolean().default(false),
+};
+
+export default (app: Router) => {
+  app.use('/system/storage-retention', route);
+
+  route.put(
+    '/config',
+    celebrate({ body: Joi.object(policySchema) }),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const service = Container.get(RetentionService);
+        const data = await service.updatePolicy(req.body);
+        res.send({ code: 200, data });
+      } catch (error) {
+        next(error);
+      }
+    },
+  );
+
+  route.post(
+    '/preview',
+    celebrate({ body: Joi.object(cleanupSchema) }),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const service = Container.get(RetentionService);
+        const data = await service.preview(req.body);
+        res.send({ code: 200, data });
+      } catch (error) {
+        next(error);
+      }
+    },
+  );
+
+  route.post(
+    '/cleanup',
+    celebrate({
+      body: Joi.object({
+        ...cleanupSchema,
+        confirmation: Joi.string().valid('CLEAN').required(),
+      }),
+    }),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const service = Container.get(RetentionService);
+        const data = await service.cleanup(req.body);
+        res.send({ code: 200, data });
+      } catch (error) {
+        next(error);
+      }
+    },
+  );
+};
@@ -1,3 +1,5 @@
+import { randomUUID } from 'crypto';
+import { resolveFileAccess } from '../shared/fileAccess';
 import { fileExist, readDirs, readDir, rmPath, IFile } from '../config/util';
 import { Router, Request, Response, NextFunction } from 'express';
 import { Container } from 'typedi';
@@ -5,18 +7,68 @@ import { Logger } from 'winston';
 import config from '../config';
 import * as fs from 'fs/promises';
 import { celebrate, Joi } from 'celebrate';
-import path, { join, parse } from 'path';
+import path, { dirname, join, parse, resolve, sep } from 'path';
 import ScriptService from '../services/script';
+import ScriptHistoryService from '../services/scriptHistory';
+import { t } from '../shared/i18n';
 import multer from 'multer';
 import { writeFileWithLock } from '../shared/utils';
+import {
+  ScriptHistoryError,
+  HistoryUnavailableError,
+} from '../shared/scriptHistory';
 const route = Router();

+function isPathAllowed(targetPath: string): boolean {
+  const resolved = path.resolve(targetPath);
+  return config.writePathList.some((x) =>
+    Boolean(
+      resolveFileAccess(
+        x,
+        [resolved],
+        // Panel configuration secrets must not restrict user script filenames.
+        path.resolve(x) === path.resolve(config.configPath)
+          ? config.blackFileList
+          : [],
+      ),
+    ),
+  );
+}
+
+async function existingWritableRealPath(targetPath: string): Promise<string> {
+  if (!isPathAllowed(targetPath)) {
+    throw new ScriptHistoryError(403, '暂无权限');
+  }
+  const resolved = resolve(targetPath);
+  for (const writableRoot of config.writePathList) {
+    const root = resolve(writableRoot);
+    const rootPrefix = root.endsWith(sep) ? root : root + sep;
+    // Keep an explicit normalized boundary check at the filesystem operation.
+    if (!resolved.startsWith(rootPrefix)) continue;
+    const realPath = await fs.realpath(resolved);
+    const realRoot = await fs.realpath(root);
+    const realRootPrefix = realRoot.endsWith(sep) ? realRoot : realRoot + sep;
+    if (
+      !realPath.startsWith(realRootPrefix) ||
+      !resolveFileAccess(
+        realRoot,
+        [realPath],
+        root === resolve(config.configPath) ? config.blackFileList : [],
+      )
+    ) {
+      throw new ScriptHistoryError(403, '暂无权限');
+    }
+    return realPath;
+  }
+  throw new ScriptHistoryError(403, '暂无权限');
+}
+
 const storage = multer.diskStorage({
  destination: function (req, file, cb) {
-    cb(null, config.scriptPath);
+    cb(null, config.tmpPath);
  },
  filename: function (req, file, cb) {
-    cb(null, file.originalname);
+    cb(null, randomUUID());
  },
 });
 const upload = multer({ storage: storage });
@@ -24,55 +76,74 @@ const upload = multer({ storage: storage });
 export default (app: Router) => {
  app.use('/scripts', route);

-  route.get('/', async (req: Request, res: Response, next: NextFunction) => {
-    const logger: Logger = Container.get('logger');
-    try {
-      let result: IFile[] = [];
-      const blacklist = [
-        'node_modules',
-        '.git',
-        '.pnpm',
-        'pnpm-lock.yaml',
-        'yarn.lock',
-        'package-lock.json',
-      ];
-      if (req.query.path) {
-        const targetPath = path.join(
-          config.scriptPath,
-          req.query.path as string,
-        );
-        result = await readDir(targetPath, config.scriptPath, blacklist);
-      } else {
-        result = await readDirs(
-          config.scriptPath,
-          config.scriptPath,
-          blacklist,
-          (a, b) => {
-            if (a.type === b.type) {
-              return a.title.localeCompare(b.title);
-            } else {
-              return a.type === 'directory' ? -1 : 1;
-            }
-          },
-        );
+  route.get(
+    '/',
+    celebrate({
+      query: Joi.object({
+        path: Joi.string().optional().allow(''),
+      }).unknown(true),
+    }),
+    async (req: Request, res: Response, next: NextFunction) => {
+      const logger: Logger = Container.get('logger');
+      try {
+        let result: IFile[] = [];
+        const blacklist = [
+          'node_modules',
+          '.git',
+          '.pnpm',
+          'pnpm-lock.yaml',
+          'yarn.lock',
+          'package-lock.json',
+        ];
+        if (req.query.path) {
+          if (
+            !resolveFileAccess(config.scriptPath, [req.query.path as string])
+          ) {
+            return res.send({ code: 403, message: t('暂无权限') });
+          }
+          result = await readDir(
+            req.query.path as string,
+            config.scriptPath,
+            blacklist,
+          );
+        } else {
+          result = await readDirs(
+            config.scriptPath,
+            config.scriptPath,
+            blacklist,
+            (a, b) => {
+              if (a.type === b.type) {
+                return a.title.localeCompare(b.title);
+              } else {
+                return a.type === 'directory' ? -1 : 1;
+              }
+            },
+          );
+        }
+        res.send({
+          code: 200,
+          data: result,
+        });
+      } catch (e) {
+        logger.error('🔥 error: %o', e);
+        return next(e);
      }
-      res.send({
-        code: 200,
-        data: result,
-      });
-    } catch (e) {
-      logger.error('🔥 error: %o', e);
-      return next(e);
-    }
-  });
+    },
+  );

  route.get(
    '/detail',
+    celebrate({
+      query: Joi.object({
+        path: Joi.string().optional().allow(''),
+        file: Joi.string().required(),
+      }).unknown(true),
+    }),
    async (req: Request, res: Response, next: NextFunction) => {
      try {
        const scriptService = Container.get(ScriptService);
        const content = await scriptService.getFile(
-          req.query.path as string,
+          (req.query?.path as string) || '',
          req.query.file as string,
        );
        res.send({ code: 200, data: content });
@@ -82,25 +153,113 @@ export default (app: Router) => {
    },
  );

+  const historyError = (error: unknown, res: Response, next: NextFunction) => {
+    if (error instanceof ScriptHistoryError) {
+      return res.status(error.status).send({
+        code: error.status,
+        message: t(error.message),
+        ...(error instanceof HistoryUnavailableError
+          ? { historyUnavailable: true, currentHash: error.currentHash }
+          : {}),
+      });
+    }
+    return next(error);
+  };
+  const historyQuery = {
+    filename: Joi.string().required(),
+    path: Joi.string().optional().allow(''),
+  };
+
  route.get(
-    '/:file',
+    '/history',
+    celebrate({ query: Joi.object(historyQuery).unknown(true) }),
    async (req: Request, res: Response, next: NextFunction) => {
      try {
-        const scriptService = Container.get(ScriptService);
-        const content = await scriptService.getFile(
-          req.query.path as string,
-          req.params.file,
+        const service = Container.get(ScriptHistoryService);
+        const data = await service.list(
+          (req.query.path as string) || '',
+          req.query.filename as string,
        );
-        res.send({ code: 200, data: content });
-      } catch (e) {
-        return next(e);
+        res.send({ code: 200, data });
+      } catch (error) {
+        historyError(error, res, next);
+      }
+    },
+  );
+  route.get(
+    '/history/detail',
+    celebrate({
+      query: Joi.object({
+        ...historyQuery,
+        id: Joi.string().uuid().required(),
+      }).unknown(true),
+    }),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const service = Container.get(ScriptHistoryService);
+        const data = await service.detail(
+          (req.query.path as string) || '',
+          req.query.filename as string,
+          req.query.id as string,
+        );
+        res.send({ code: 200, data });
+      } catch (error) {
+        historyError(error, res, next);
+      }
+    },
+  );
+  route.put(
+    '/history/restore',
+    celebrate({
+      body: Joi.object({
+        ...historyQuery,
+        id: Joi.string().uuid().required(),
+        expectedHash: Joi.string().hex().length(64).required(),
+      }),
+    }),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const { path = '', filename, id, expectedHash } = req.body;
+        const service = Container.get(ScriptHistoryService);
+        const data = await service.restore(path, filename, id, expectedHash);
+        res.send({ code: 200, data });
+      } catch (error) {
+        historyError(error, res, next);
      }
    },
  );

+  route.get('/:file', (req: Request, res: Response) => {
+    return res.send({
+      code: 410,
+      message: t('接口已下线，请使用 /scripts/detail 接口'),
+    });
+  });
+
  route.post(
    '/',
+    (req: Request, res: Response, next: NextFunction) => {
+      res.on('finish', () => {
+        if (req.file?.path) fs.unlink(req.file.path).catch(() => undefined);
+      });
+      next();
+    },
    upload.single('file'),
+    celebrate({
+      body: Joi.object({
+        filename: Joi.string().required(),
+        path: Joi.string().optional().allow(''),
+        content: Joi.string().optional().allow(''),
+        skipHistory: Joi.boolean().optional(),
+        expectedHash: Joi.string()
+          .hex()
+          .length(64)
+          .when('skipHistory', { is: true, then: Joi.required() }),
+        originFilename: Joi.string().optional().allow(''),
+        directory: Joi.string().optional().allow(''),
+        file: Joi.string().optional().allow(''),
+      }).unknown(true),
+    }),
    async (req: Request, res: Response, next: NextFunction) => {
      try {
        let { filename, path, content, originFilename, directory } =
@@ -124,29 +283,87 @@ export default (app: Router) => {
        if (config.writePathList.every((x) => !path.startsWith(x))) {
          return res.send({
            code: 403,
-            message: '暂无权限',
+            message: t('暂无权限'),
          });
        }

        if (req.file) {
-          await fs.rename(req.file.path, join(path, filename));
+          const uploadPath = join(path, filename);
+          if (!isPathAllowed(uploadPath)) {
+            return res.send({ code: 403, message: t('暂无权限') });
+          }
+          await fs.copyFile(req.file.path, uploadPath);
+          await fs.unlink(req.file.path);
          return res.send({ code: 200 });
        }

        if (directory) {
-          await fs.mkdir(join(path, directory), { recursive: true });
+          const dirPath = join(path, directory);
+          if (!isPathAllowed(dirPath)) {
+            return res.send({ code: 403, message: t('暂无权限') });
+          }
+          await fs.mkdir(dirPath, { recursive: true });
          return res.send({ code: 200 });
        }

        if (!originFilename) {
          originFilename = filename;
        }
-        const originFilePath = join(
-          path,
-          `${originFilename.replace(/\//g, '')}`,
-        );
-        const filePath = join(path, `${filename.replace(/\//g, '')}`);
+        const originFilePath = join(path, originFilename);
+        const filePath = join(path, filename);
+        if (!isPathAllowed(filePath) || !isPathAllowed(originFilePath)) {
+          return res.send({ code: 403, message: t('暂无权限') });
+        }
+        // Check the canonical parent directly at the directory creation boundary.
+        const parentPath = resolve(dirname(filePath));
+        let parentCreated = false;
+        for (const writableRoot of config.writePathList) {
+          const root = resolve(writableRoot);
+          const rootPrefix = root.endsWith(sep) ? root : root + sep;
+          if (parentPath === root) {
+            await fs.mkdir(root, { recursive: true });
+          } else if (parentPath.startsWith(rootPrefix)) {
+            await fs.mkdir(parentPath, { recursive: true });
+          } else {
+            continue;
+          }
+          parentCreated = true;
+          break;
+        }
+        if (!parentCreated) {
+          return res.send({ code: 403, message: t('暂无权限') });
+        }
        const fileExists = await fileExist(filePath);
+        if (fileExists && resolveFileAccess(config.scriptPath, [filePath])) {
+          let removeSource = filename !== originFilename;
+          let backupSource = '';
+          if (removeSource) {
+            const [originRealPath, targetRealPath] = await Promise.all([
+              existingWritableRealPath(originFilePath),
+              existingWritableRealPath(filePath),
+            ]);
+            // Aliases of one script are an in-place save. Removing the source
+            // would also remove the destination behind a target symlink.
+            removeSource = originRealPath !== targetRealPath;
+            backupSource = originRealPath;
+          }
+          // Save-as removes the source after committing the destination. Keep
+          // its original content too: destination history only protects the
+          // file being overwritten, not the source being deleted.
+          if (removeSource) {
+            await fs.copyFile(
+              backupSource,
+              join(config.bakPath, originFilename.replace(/\//g, '')),
+            );
+          }
+          const service = Container.get(ScriptHistoryService);
+          const data = await service.save(path, filename, content, {
+            skipHistory: req.body.skipHistory,
+            expectedHash: req.body.expectedHash,
+          });
+          if (removeSource) await rmPath(originFilePath);
+          return res.send({ code: 200, data });
+        }
        if (fileExists) {
          await fs.copyFile(
            originFilePath,
@@ -159,7 +376,7 @@ export default (app: Router) => {
        await writeFileWithLock(filePath, content);
        return res.send({ code: 200 });
      } catch (e) {
-        return next(e);
+        return historyError(e, res, next);
      }
    },
  );
@@ -171,6 +388,11 @@ export default (app: Router) => {
        filename: Joi.string().required(),
        path: Joi.string().optional().allow(''),
        content: Joi.string().required().allow(''),
+        skipHistory: Joi.boolean().optional(),
+        expectedHash: Joi.string()
+          .hex()
+          .length(64)
+          .when('skipHistory', { is: true, then: Joi.required() }),
      }),
    }),
    async (req: Request, res: Response, next: NextFunction) => {
@@ -185,13 +407,17 @@ export default (app: Router) => {
        if (!filePath) {
          return res.send({
            code: 403,
-            message: '暂无权限',
+            message: t('暂无权限'),
          });
        }
-        await writeFileWithLock(filePath, content);
-        return res.send({ code: 200 });
+        const service = Container.get(ScriptHistoryService);
+        const data = await service.save(path || '', filename, content, {
+          skipHistory: req.body.skipHistory,
+          expectedHash: req.body.expectedHash,
+        });
+        return res.send({ code: 200, data });
      } catch (e) {
-        return next(e);
+        return historyError(e, res, next);
      }
    },
  );
@@ -201,7 +427,7 @@ export default (app: Router) => {
    celebrate({
      body: Joi.object({
        filename: Joi.string().required(),
-        path: Joi.string().allow(''),
+        path: Joi.string().optional().allow(''),
        type: Joi.string().optional(),
      }),
    }),
@@ -211,12 +437,15 @@ export default (app: Router) => {
          filename: string;
          path: string;
        };
+        if (!path) {
+          path = '';
+        }
        const scriptService = Container.get(ScriptService);
        const filePath = scriptService.checkFilePath(path, filename);
        if (!filePath) {
          return res.send({
            code: 403,
-            message: '暂无权限',
+            message: t('暂无权限'),
          });
        }
        await rmPath(filePath);
@@ -232,7 +461,7 @@ export default (app: Router) => {
    celebrate({
      body: Joi.object({
        filename: Joi.string().required(),
-        path: Joi.string().allow(''),
+        path: Joi.string().optional().allow(''),
      }),
    }),
    async (req: Request, res: Response, next: NextFunction) => {
@@ -241,12 +470,15 @@ export default (app: Router) => {
          filename: string;
          path: string;
        };
+        if (!path) {
+          path = '';
+        }
        const scriptService = Container.get(ScriptService);
        const filePath = scriptService.checkFilePath(path, filename);
        if (!filePath) {
          return res.send({
            code: 403,
-            message: '暂无权限',
+            message: t('暂无权限'),
          });
        }
        return res.download(filePath, filename, (err) => {
@@ -273,8 +505,14 @@ export default (app: Router) => {
      const logger: Logger = Container.get('logger');
      try {
        let { filename, content, path } = req.body;
+        if (!path) {
+          path = '';
+        }
        const { name, ext } = parse(filename);
        const filePath = join(config.scriptPath, path, `${name}.swap${ext}`);
+        if (!isPathAllowed(filePath)) {
+          return res.send({ code: 403, message: t('暂无权限') });
+        }
        await writeFileWithLock(filePath, content || '');

        const scriptService = Container.get(ScriptService);
@@ -298,14 +536,29 @@ export default (app: Router) => {
    async (req: Request, res: Response, next: NextFunction) => {
      try {
        let { filename, path, pid } = req.body;
+        if (!path) {
+          path = '';
+        }
        const { name, ext } = parse(filename);
        const filePath = join(config.scriptPath, path, `${name}.swap${ext}`);
-        const logPath = join(config.logPath, path, `${name}.swap`);
+        if (!isPathAllowed(filePath)) {
+          return res.send({ code: 403, message: t('暂无权限') });
+        }
+        const logPath = resolveFileAccess(config.logPath, [
+          path,
+          `${name}.swap`,
+        ]);
+        if (!logPath) {
+          return res.send({ code: 403, message: t('暂无权限') });
+        }

        const scriptService = Container.get(ScriptService);
        const result = await scriptService.stopScript(filePath, pid);
        setTimeout(() => {
-          rmPath(logPath);
+          const cleanupPath = resolveFileAccess(config.logPath, [logPath]);
+          if (cleanupPath) {
+            void rmPath(cleanupPath);
+          }
        }, 3000);
        res.send(result);
      } catch (e) {
@@ -325,14 +578,19 @@ export default (app: Router) => {
    }),
    async (req: Request, res: Response, next: NextFunction) => {
      try {
-        let { filename, path, type, newFilename } = req.body as {
+        let { filename, path, newFilename } = req.body as {
          filename: string;
          path: string;
-          type: string;
          newFilename: string;
        };
+        if (!path) {
+          path = '';
+        }
        const filePath = join(config.scriptPath, path, filename);
        const newPath = join(config.scriptPath, path, newFilename);
+        if (!isPathAllowed(filePath) || !isPathAllowed(newPath)) {
+          return res.send({ code: 403, message: t('暂无权限') });
+        }
        await fs.rename(filePath, newPath);
        res.send({ code: 200 });
      } catch (e) {
@@ -3,7 +3,7 @@ import { Container } from 'typedi';
 import { Logger } from 'winston';
 import SubscriptionService from '../services/subscription';
 import { celebrate, Joi } from 'celebrate';
-import cron_parser from 'cron-parser';
+import { isValidCronSchedule } from '../shared/cronSchedule';
 const route = Router();

 export default (app: Router) => {
@@ -58,10 +58,7 @@ export default (app: Router) => {
    async (req: Request, res: Response, next: NextFunction) => {
      const logger: Logger = Container.get('logger');
      try {
-        if (
-          !req.body.schedule ||
-          cron_parser.parseExpression(req.body.schedule).hasNext()
-        ) {
+        if (!req.body.schedule || isValidCronSchedule(req.body.schedule)) {
          const subscriptionService = Container.get(SubscriptionService);
          const data = await subscriptionService.create(req.body);
          return res.send({ code: 200, data });
@@ -148,13 +145,27 @@ export default (app: Router) => {
      params: Joi.object({
        id: Joi.number().required(),
      }),
+      query: Joi.object({
+        offset: Joi.number().integer().min(0).optional(),
+        limit: Joi.number()
+          .integer()
+          .min(1)
+          .max(1024 * 1024)
+          .optional(),
+        tail: Joi.boolean().optional(),
+        t: Joi.string().optional(),
+      }).unknown(true),
    }),
    async (req: Request<{ id: number }>, res: Response, next: NextFunction) => {
      const logger: Logger = Container.get('logger');
      try {
        const subscriptionService = Container.get(SubscriptionService);
-        const data = await subscriptionService.log(req.params.id);
-        return res.send({ code: 200, data });
+        const result = await subscriptionService.log(req.params.id, {
+          offset: req.query.offset as unknown as number,
+          limit: req.query.limit as unknown as number,
+          tail: req.query.tail as unknown as boolean,
+        });
+        return res.send({ code: 200, data: result.content, ...result });
      } catch (e) {
        return next(e);
      }
@@ -190,11 +201,7 @@ export default (app: Router) => {
    async (req: Request, res: Response, next: NextFunction) => {
      const logger: Logger = Container.get('logger');
      try {
-        if (
-          !req.body.schedule ||
-          typeof req.body.schedule === 'object' ||
-          cron_parser.parseExpression(req.body.schedule).hasNext()
-        ) {
+        if (!req.body.schedule || isValidCronSchedule(req.body.schedule)) {
          const subscriptionService = Container.get(SubscriptionService);
          const data = await subscriptionService.update(req.body);
          return res.send({ code: 200, data });
@@ -6,14 +6,14 @@ import config from '../config';
 import SystemService from '../services/system';
 import { celebrate, Joi } from 'celebrate';
 import UserService from '../services/user';
-import {
-  getUniqPath,
-  handleLogPath,
-  parseVersion,
-  promiseExec,
-} from '../config/util';
+import { t } from '../shared/i18n';
+import { isDefaultAuthInfo } from '../shared/auth';
+import { getUniqPath, handleLogPath, parseVersion } from '../config/util';
+import { findCronId } from '../shared/cronCommand';
 import dayjs from 'dayjs';
 import multer from 'multer';
+import { logStreamManager } from '../shared/logStreamManager';
+import { rateLimit } from 'express-rate-limit';

 const route = Router();
 const storage = multer.diskStorage({
@@ -37,14 +37,7 @@ export default (app: Router) => {
      const { version, changeLog, changeLogLink, publishTime } =
        await parseVersion(config.versionFile);

-      let isInitialized = true;
-      if (
-        Object.keys(authInfo).length === 2 &&
-        authInfo.username === 'admin' &&
-        authInfo.password === 'admin'
-      ) {
-        isInitialized = false;
-      }
+      const isInitialized = !isDefaultAuthInfo(authInfo);
      res.send({
        code: 200,
        data: {
@@ -212,6 +205,17 @@ export default (app: Router) => {
    },
  );

+  route.get(
+    '/update-status',
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        res.send(await Container.get(SystemService).getUpgradeStatus());
+      } catch (e) {
+        return next(e);
+      }
+    },
+  );
+
  route.put(
    '/reload',
    celebrate({
@@ -253,6 +257,7 @@ export default (app: Router) => {

  route.put(
    '/command-run',
+    rateLimit({ windowMs: 60 * 1000, limit: 60 }),
    celebrate({
      body: Joi.object({
        command: Joi.string().required(),
@@ -262,8 +267,13 @@ export default (app: Router) => {
      try {
        const systemService = Container.get(SystemService);
        const command = req.body.command;
-        const idStr = `cat ${config.crontabFile} | grep -E "${command}" | perl -pe "s|.*ID=(.*) ${command}.*|\\1|" | head -1 | awk -F " " '{print $1}' | xargs echo -n`;
-        let id = await promiseExec(idStr);
+        const crontab = await fs
+          .readFile(config.crontabFile, 'utf8')
+          .catch((e) => {
+            if (e.code === 'ENOENT') return '';
+            throw e;
+          });
+        const id = findCronId(crontab, command);
        const uniqPath = await getUniqPath(command, id);
        const logTime = dayjs().format('YYYY-MM-DD-HH-mm-ss-SSS');
        const logPath = `${uniqPath}/${logTime}.log`;
@@ -273,19 +283,27 @@ export default (app: Router) => {
          {
            onStart: async (cp, startTime) => {
              res.setHeader('QL-Task-Pid', `${cp.pid}`);
+              res.setHeader('QL-Task-Log', `${logPath}`);
            },
            onEnd: async (cp, endTime, diff) => {
-              res.end();
+              // Close the stream after task completion
+              try {
+                await logStreamManager.closeStream(
+                  await handleLogPath(logPath),
+                );
+              } finally {
+                res.end();
+              }
            },
            onError: async (message: string) => {
-              res.write(`\n${message}`);
+              res.write(message);
              const absolutePath = await handleLogPath(logPath);
-              await fs.appendFile(absolutePath, `\n${message}`);
+              await logStreamManager.write(absolutePath, message);
            },
            onLog: async (message: string) => {
-              res.write(`\n${message}`);
+              res.write(message);
              const absolutePath = await handleLogPath(logPath);
-              await fs.appendFile(absolutePath, `\n${message}`);
+              await logStreamManager.write(absolutePath, message);
            },
          },
        );
@@ -316,10 +334,15 @@ export default (app: Router) => {

  route.put(
    '/data/export',
+    celebrate({
+      body: Joi.object({
+        type: Joi.array().items(Joi.string()).optional(),
+      }),
+    }),
    async (req: Request, res: Response, next: NextFunction) => {
      try {
        const systemService = Container.get(SystemService);
-        await systemService.exportData(res);
+        await systemService.exportData(res, req.body.type);
      } catch (e) {
        return next(e);
      }
@@ -346,6 +369,11 @@ export default (app: Router) => {
      query: {
        startTime: Joi.string().allow('').optional(),
        endTime: Joi.string().allow('').optional(),
+        limit: Joi.number()
+          .integer()
+          .min(1)
+          .max(1024 * 1024)
+          .optional(),
        t: Joi.string().optional(),
      },
    }),
@@ -357,6 +385,7 @@ export default (app: Router) => {
          req.query as {
            startTime?: string;
            endTime?: string;
+            limit?: number;
          },
        );
      } catch (e) {
@@ -365,6 +394,19 @@ export default (app: Router) => {
    },
  );

+  route.get(
+    '/notify-log',
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const systemService = Container.get(SystemService);
+        const data = await systemService.getNotifyLog();
+        res.send({ code: 200, data });
+      } catch (e) {
+        return next(e);
+      }
+    },
+  );
+
  route.delete(
    '/log',
    async (req: Request, res: Response, next: NextFunction) => {
@@ -385,13 +427,17 @@ export default (app: Router) => {
        retries: Joi.number().optional(),
        twoFactorActivated: Joi.boolean().optional(),
        password: Joi.string().optional(),
+        username: Joi.string().optional(),
      }),
    }),
    async (req: Request, res: Response, next: NextFunction) => {
      try {
        const userService = Container.get(UserService);
-        await userService.resetAuthInfo(req.body);
-        res.send({ code: 200, message: '更新成功' });
+        const result = await userService.resetAuthInfo(req.body);
+        if (result) {
+          return res.send(result);
+        }
+        res.send({ code: 200, message: t('更新成功') });
      } catch (e) {
        return next(e);
      }
@@ -415,4 +461,76 @@ export default (app: Router) => {
      }
    },
  );
+
+  route.put(
+    '/config/lang',
+    celebrate({
+      body: Joi.object({
+        lang: Joi.string().allow('').allow(null),
+      }),
+    }),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const systemService = Container.get(SystemService);
+        const result = await systemService.updateLanguage(req.body);
+        res.send(result);
+      } catch (e) {
+        return next(e);
+      }
+    },
+  );
+
+  route.put(
+    '/config/panel-title',
+    celebrate({
+      body: Joi.object({
+        panelTitle: Joi.string().max(100).allow('').allow(null),
+      }),
+    }),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const systemService = Container.get(SystemService);
+        const result = await systemService.updatePanelTitle(req.body);
+        res.send(result);
+      } catch (e) {
+        return next(e);
+      }
+    },
+  );
+
+  route.put(
+    '/config/global-ssh-key',
+    celebrate({
+      body: Joi.object({
+        globalSshKey: Joi.string().allow('').allow(null),
+      }),
+    }),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const systemService = Container.get(SystemService);
+        const result = await systemService.updateGlobalSshKey(req.body);
+        res.send(result);
+      } catch (e) {
+        return next(e);
+      }
+    },
+  );
+
+  route.put(
+    '/config/dependence-clean',
+    celebrate({
+      body: Joi.object({
+        type: Joi.string().allow(''),
+      }),
+    }),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const systemService = Container.get(SystemService);
+        const result = await systemService.cleanDependence(req.body.type);
+        res.send(result);
+      } catch (e) {
+        return next(e);
+      }
+    },
+  );
 };
@@ -0,0 +1,51 @@
+import { NextFunction, Request, Response, Router } from 'express';
+import Container from 'typedi';
+import Logger from '../loaders/logger';
+import SystemService from '../services/system';
+const route = Router();
+
+export default (app: Router) => {
+  app.use('/update', route);
+
+  route.put(
+    '/reload',
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const systemService = Container.get(SystemService);
+        const result = await systemService.reloadSystem();
+        res.send(result);
+      } catch (e) {
+        Logger.error('🔥 error: %o', e);
+        return next(e);
+      }
+    },
+  );
+
+  route.put(
+    '/system',
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const systemService = Container.get(SystemService);
+        const result = await systemService.reloadSystem('system');
+        res.send(result);
+      } catch (e) {
+        Logger.error('🔥 error: %o', e);
+        return next(e);
+      }
+    },
+  );
+
+  route.put(
+    '/data',
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const systemService = Container.get(SystemService);
+        const result = await systemService.reloadSystem('data');
+        res.send(result);
+      } catch (e) {
+        Logger.error('🔥 error: %o', e);
+        return next(e);
+      }
+    },
+  );
+};
@@ -8,6 +8,8 @@ import path from 'path';
 import { v4 as uuidV4 } from 'uuid';
 import rateLimit from 'express-rate-limit';
 import config from '../config';
+import { t } from '../shared/i18n';
+import { isDemoEnv, getToken } from '../config/util';
 const route = Router();

 const storage = multer.diskStorage({
@@ -20,7 +22,25 @@ const storage = multer.diskStorage({
    cb(null, key + ext);
  },
 });
-const upload = multer({ storage: storage });
+const upload = multer({
+  storage,
+  limits: { fileSize: 5 * 1024 * 1024, files: 1 },
+  fileFilter: (_req, file, cb) => {
+    const ext = path.extname(file.originalname).toLowerCase();
+    const imageTypes: Record<string, string> = {
+      '.png': 'image/png',
+      '.jpg': 'image/jpeg',
+      '.jpeg': 'image/jpeg',
+      '.gif': 'image/gif',
+      '.webp': 'image/webp',
+      '.avif': 'image/avif',
+    };
+    if (imageTypes[ext] !== file.mimetype) {
+      return cb(new Error(t('仅支持 PNG、JPEG、GIF、WebP、AVIF 图片')));
+    }
+    cb(null, true);
+  },
+});

 export default (app: Router) => {
  app.use('/user', route);
@@ -33,8 +53,8 @@ export default (app: Router) => {
    }),
    celebrate({
      body: Joi.object({
-        username: Joi.string().required(),
-        password: Joi.string().required(),
+        username: Joi.string().max(1024).required(),
+        password: Joi.string().max(1024).required(),
      }),
    }),
    async (req: Request, res: Response, next: NextFunction) => {
@@ -55,7 +75,8 @@ export default (app: Router) => {
      const logger: Logger = Container.get('logger');
      try {
        const userService = Container.get(UserService);
-        await userService.logout(req.platform);
+        const token = getToken(req);
+        await userService.logout(req.platform, token);
        res.send({ code: 200 });
      } catch (e) {
        return next(e);
@@ -67,19 +88,18 @@ export default (app: Router) => {
    '/',
    celebrate({
      body: Joi.object({
-        username: Joi.string().required(),
-        password: Joi.string().required(),
+        username: Joi.string().max(1024).required(),
+        password: Joi.string().max(1024).required(),
      }),
    }),
    async (req: Request, res: Response, next: NextFunction) => {
-      const logger: Logger = Container.get('logger');
      try {
-        if (process.env.DeployEnv === 'demo') {
-          return res.send({ code: 450, message: '未知错误' });
+        if (isDemoEnv()) {
+          return res.send({ code: 450, message: t('未知错误') });
        }
        const userService = Container.get(UserService);
-        await userService.updateUsernameAndPassword(req.body);
-        res.send({ code: 200, message: '更新成功' });
+        const result = await userService.updateUsernameAndPassword(req.body);
+        res.send(result);
      } catch (e) {
        return next(e);
      }
@@ -139,12 +159,12 @@ export default (app: Router) => {
  );

  route.put(
-    '/two-factor/deactive',
+    '/two-factor/deactivate',
    async (req: Request, res: Response, next: NextFunction) => {
      const logger: Logger = Container.get('logger');
      try {
        const userService = Container.get(UserService);
-        const data = await userService.deactiveTwoFactor();
+        const data = await userService.deactivateTwoFactor();
        res.send({ code: 200, data });
      } catch (e) {
        return next(e);
@@ -154,11 +174,12 @@ export default (app: Router) => {

  route.put(
    '/two-factor/login',
+    rateLimit({ windowMs: 15 * 60 * 1000, max: 20 }),
    celebrate({
      body: Joi.object({
        code: Joi.string().required(),
-        username: Joi.string().required(),
-        password: Joi.string().required(),
+        username: Joi.string().max(1024).required(),
+        password: Joi.string().max(1024).required(),
      }),
    }),
    async (req: Request, res: Response, next: NextFunction) => {
@@ -187,6 +208,59 @@ export default (app: Router) => {
    },
  );

+  route.get(
+    '/ip-blacklist',
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const userService = Container.get(UserService);
+        const data = await userService.getIpBlacklist();
+        res.send({ code: 200, data });
+      } catch (e) {
+        return next(e);
+      }
+    },
+  );
+
+  route.put(
+    '/ip-blacklist',
+    celebrate({
+      body: Joi.object({
+        ip: Joi.string()
+          .ip({ version: ['ipv4', 'ipv6'], cidr: 'forbidden' })
+          .required(),
+      }),
+    }),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const userService = Container.get(UserService);
+        const data = await userService.blockIp(req.body.ip);
+        res.send({ code: 200, data, message: t('已加入 IP 黑名单') });
+      } catch (e) {
+        return next(e);
+      }
+    },
+  );
+
+  route.delete(
+    '/ip-blacklist',
+    celebrate({
+      body: Joi.object({
+        ip: Joi.string()
+          .ip({ version: ['ipv4', 'ipv6'], cidr: 'forbidden' })
+          .required(),
+      }),
+    }),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const userService = Container.get(UserService);
+        const data = await userService.unblockIp(req.body.ip);
+        res.send({ code: 200, data, message: t('已移出 IP 黑名单') });
+      } catch (e) {
+        return next(e);
+      }
+    },
+  );
+
  route.get(
    '/notification',
    async (req: Request, res: Response, next: NextFunction) => {
@@ -217,18 +291,19 @@ export default (app: Router) => {

  route.put(
    '/init',
+    rateLimit({ windowMs: 15 * 60 * 1000, max: 20 }),
    celebrate({
      body: Joi.object({
-        username: Joi.string().required(),
-        password: Joi.string().required(),
+        username: Joi.string().max(1024).required(),
+        password: Joi.string().max(1024).required(),
      }),
    }),
    async (req: Request, res: Response, next: NextFunction) => {
      const logger: Logger = Container.get('logger');
      try {
        const userService = Container.get(UserService);
-        await userService.updateUsernameAndPassword(req.body);
-        res.send({ code: 200, message: '更新成功' });
+        const result = await userService.initializeUser(req.body);
+        res.send(result);
      } catch (e) {
        return next(e);
      }
@@ -1,31 +1,302 @@
-import 'reflect-metadata'; // We need this in order to use @Decorators
+import 'reflect-metadata';
+import cluster, { type Worker } from 'cluster';
+import type express from 'express';
+import { Container } from 'typedi';
 import config from './config';
-import express from 'express';
 import Logger from './loaders/logger';
+import { errStack } from './shared/errors';
+import { initializeLanguageSync } from './shared/languageSync';
+import { type GrpcServerService } from './services/grpc';
+import { type HttpServerService } from './services/http';

-async function startServer() {
-  const app = express();
-
-  await require('./loaders/db').default();
-
-  await require('./loaders/initFile').default();
-
-  await require('./loaders/app').default({ expressApp: app });
-
-  const server = app
-    .listen(config.port, '0.0.0.0', () => {
-      Logger.debug(`✌️ 后端服务启动成功！`);
-      console.debug(`✌️ 后端服务启动成功！`);
-      process.send?.('ready');
-      require('./loaders/bootAfter').default();
-    })
-    .on('error', (err) => {
-      Logger.error(err);
-      console.error(err);
-      process.exit(1);
-    });
-
-  await require('./loaders/server').default({ server });
+interface WorkerMetadata {
+  id: number;
+  pid: number;
+  serviceType: string;
+  startTime: Date;
 }

-startServer();
+class Application {
+  private httpServerService?: HttpServerService;
+  private grpcServerService?: GrpcServerService;
+  private isShuttingDown = false;
+  private workerMetadataMap = new Map<number, WorkerMetadata>();
+  private httpWorker?: Worker;
+
+  async start() {
+    try {
+      if (cluster.isPrimary) {
+        await this.initializeDatabase();
+      }
+      await initializeLanguageSync();
+      if (cluster.isPrimary) {
+        this.startMasterProcess();
+      } else {
+        await this.startWorkerProcess();
+      }
+    } catch (error) {
+      Logger.error(`Failed to start application:\n${errStack(error)}`);
+      process.exit(1);
+    }
+  }
+
+  private startMasterProcess() {
+    const readyTimeout =
+      process.arch === 'arm' &&
+      Number(
+        (process.config.variables as { arm_version?: string | number }).arm_version,
+      ) === 6
+        ? 120000
+        : 30000;
+    // Fork gRPC worker first and wait for it to be ready
+    const grpcWorker = this.forkWorker('grpc');
+    
+    // Wait for gRPC worker to signal it's ready before starting HTTP worker
+    this.waitForWorkerReady(grpcWorker, readyTimeout)
+      .then(() => {
+        Logger.info('[boot] gRPC worker is ready, starting HTTP worker');
+        this.httpWorker = this.forkWorker('http');
+      })
+      .catch((error) => {
+        Logger.error(`[boot] Failed to wait for gRPC worker:\n${errStack(error)}`);
+        process.exit(1);
+      });
+
+    cluster.on('exit', (worker, code, signal) => {
+      const metadata = this.workerMetadataMap.get(worker.id);
+      if (metadata) {
+        if (!this.isShuttingDown) {
+          Logger.error(
+            `${metadata.serviceType} worker ${worker.process.pid} died (${signal || code
+            }). Restarting...`,
+          );
+          // If gRPC worker died, restart it and wait for it to be ready
+          if (metadata.serviceType === 'grpc') {
+            try {
+              this.httpWorker?.send('scheduler-unavailable');
+            } catch (error) {
+              Logger.warn('Unable to notify HTTP worker of scheduler exit');
+            }
+            const newGrpcWorker = this.forkWorker('grpc');
+            this.waitForWorkerReady(newGrpcWorker, readyTimeout)
+              .then(() => {
+                Logger.info('gRPC worker restarted and ready');
+                // Re-register cron jobs by notifying the HTTP worker
+                if (this.httpWorker) {
+                  try {
+                    this.httpWorker.send('reregister-crons');
+                    Logger.info('Sent reregister-crons message to HTTP worker');
+                  } catch (error) {
+                    Logger.error(`Failed to send reregister-crons message:\n${errStack(error)}`);
+                  }
+                }
+              })
+              .catch((error) => {
+                Logger.error(`Failed to restart gRPC worker:\n${errStack(error)}`);
+                process.exit(1);
+              });
+          } else {
+            // For HTTP worker, just restart it
+            const newWorker = this.forkWorker(metadata.serviceType);
+            this.httpWorker = newWorker;
+            Logger.info(`Restarted ${metadata.serviceType} worker (PID: ${newWorker.process.pid})`);
+          }
+        }
+
+        this.workerMetadataMap.delete(worker.id);
+      }
+    });
+
+    this.setupMasterShutdown();
+  }
+
+  private waitForWorkerReady(worker: Worker, timeoutMs: number): Promise<void> {
+    return new Promise<void>((resolve, reject) => {
+      const messageHandler = (msg: any) => {
+        if (msg === 'ready') {
+          worker.removeListener('message', messageHandler);
+          clearTimeout(timeoutId);
+          resolve();
+        }
+      };
+      worker.on('message', messageHandler);
+      
+      // Timeout after specified milliseconds
+      const timeoutId = setTimeout(() => {
+        worker.removeListener('message', messageHandler);
+        reject(new Error(`Worker failed to start within ${timeoutMs / 1000} seconds`));
+      }, timeoutMs);
+    });
+  }
+
+  private forkWorker(serviceType: string): Worker {
+    const workerEnv: NodeJS.ProcessEnv = { SERVICE_TYPE: serviceType };
+    // PM2's fork launcher is inherited by our own cluster workers. Their APM
+    // messages go to this primary, not PM2, and duplicate its sampling work.
+    // Keep primary monitoring and allow restoring the inherited worker APM.
+    if (process.env.pm_id !== undefined && process.env.QL_WORKER_APM !== 'true') {
+      workerEnv.pmx = 'false';
+    }
+    const worker = cluster.fork(workerEnv);
+
+    this.workerMetadataMap.set(worker.id, {
+      id: worker.id,
+      pid: worker.process.pid!,
+      serviceType,
+      startTime: new Date(),
+    });
+
+    return worker;
+  }
+
+  private async initializeDatabase() {
+    const { runStartupProcess } = await import('./shared/startupProcess');
+    await runStartupProcess(require.resolve('./bootstrap/database'));
+  }
+
+  private async setupMiddlewares(): Promise<express.Application> {
+    const { createHttpApplication } = await import('./loaders/httpApplication');
+    return createHttpApplication();
+  }
+
+  private setupMasterShutdown() {
+    const shutdown = async () => {
+      if (this.isShuttingDown) return;
+      this.isShuttingDown = true;
+
+      const workers = Object.values(cluster.workers || {});
+      const workerPromises: Promise<void>[] = [];
+
+      workers.forEach((worker) => {
+        if (worker) {
+          const exitPromise = new Promise<void>((resolve) => {
+            worker.once('exit', () => {
+              Logger.info(`Worker ${worker.process.pid} exited`);
+              resolve();
+            });
+
+            try {
+              worker.send('shutdown');
+            } catch (error) {
+              Logger.warn(`Failed to send shutdown to worker ${worker.process.pid}:\n${errStack(error)}`);
+            }
+          });
+
+          workerPromises.push(exitPromise);
+        }
+      });
+
+      try {
+        await Promise.race([
+          Promise.all(workerPromises),
+          new Promise<void>((resolve) => {
+            setTimeout(() => {
+              Logger.warn('Worker shutdown timeout reached');
+              resolve();
+            }, 10000);
+          }),
+        ]);
+        process.exit(0);
+      } catch (error) {
+        Logger.error(`Error during worker shutdown:\n${errStack(error)}`);
+        process.exit(1);
+      }
+    };
+
+    process.on('SIGTERM', shutdown);
+    process.on('SIGINT', shutdown);
+  }
+
+  private async startWorkerProcess() {
+    const serviceType = process.env.SERVICE_TYPE;
+    if (!serviceType || !['http', 'grpc'].includes(serviceType)) {
+      Logger.error('[boot] Invalid SERVICE_TYPE:', serviceType);
+      process.exit(1);
+    }
+
+    Logger.info(`[boot] ${serviceType} worker started (PID: ${process.pid})`);
+
+    try {
+      if (serviceType === 'http') {
+        await this.startHttpService();
+      } else {
+        await this.startGrpcService();
+      }
+
+      process.send?.('ready');
+    } catch (error) {
+      Logger.error(`[boot] ${serviceType} worker failed:\n${errStack(error)}`);
+      process.exit(1);
+    }
+  }
+
+  private async startHttpService() {
+    // 在导入任何 gRPC 客户端模块之前初始化 mTLS 证书
+    const { initGrpcCerts } = await import('./config/grpcCerts');
+    await initGrpcCerts();
+
+    const app = await this.setupMiddlewares();
+
+    const { HttpServerService } = await import('./services/http');
+    this.httpServerService = Container.get(HttpServerService);
+
+    const appLoader = await import('./loaders/app');
+    await appLoader.default({ app });
+
+    const server = await this.httpServerService.initialize(
+      app,
+      config.port,
+    );
+
+    const serverLoader = await import('./loaders/server');
+    await (serverLoader.default as any)({ server });
+    this.setupWorkerShutdown('http');
+  }
+
+  private async startGrpcService() {
+    const { GrpcServerService } = await import('./services/grpc');
+    this.grpcServerService = Container.get(GrpcServerService);
+
+    await this.grpcServerService.initialize();
+    this.setupWorkerShutdown('grpc');
+  }
+
+  private setupWorkerShutdown(serviceType: string) {
+    process.on('message', async (msg) => {
+      if (msg === 'shutdown') {
+        this.gracefulShutdown(serviceType);
+      } else if (serviceType === 'http' &&
+        (msg === 'reregister-crons' || msg === 'scheduler-unavailable')) {
+        const { default: cronClient } = await import('./schedule/client');
+        cronClient.readiness.invalidate();
+      }
+    });
+
+    const shutdown = () => this.gracefulShutdown(serviceType);
+    process.on('SIGTERM', shutdown);
+    process.on('SIGINT', shutdown);
+  }
+
+  private async gracefulShutdown(serviceType: string) {
+    if (this.isShuttingDown) return;
+    this.isShuttingDown = true;
+
+    try {
+      if (serviceType === 'http') {
+        await this.httpServerService?.shutdown();
+      } else {
+        await this.grpcServerService?.shutdown();
+      }
+      process.exit(0);
+    } catch (error) {
+      Logger.error(`[${serviceType}] Error during shutdown:\n${errStack(error)}`);
+      process.exit(1);
+    }
+  }
+}
+
+const app = new Application();
+app.start().catch((error) => {
+  Logger.error(`🙅‍♀️ Application failed to start:\n${errStack(error)}`);
+  process.exit(1);
+});
@@ -0,0 +1,26 @@
+import { errStack } from '../shared/errors';
+
+// Also terminate if the primary disappears without forwarding a signal.
+const onParentDisconnect = () => process.exit(1);
+process.once('disconnect', onParentDisconnect);
+
+async function initializeDatabase() {
+  const { sequelize } = await import('../data');
+  try {
+    const { default: loadDatabase } = await import('../loaders/db');
+    await loadDatabase();
+  } finally {
+    await sequelize.close();
+  }
+}
+
+initializeDatabase()
+  .catch((error) => {
+    console.error(`[boot] Database initialization failed:\n${errStack(error)}`);
+    process.exitCode = 1;
+  })
+  .finally(() => {
+    process.removeListener('disconnect', onParentDisconnect);
+    // Let pending log writes drain and exit naturally after closing SQLite.
+    if (process.connected) process.disconnect();
+  });
@@ -0,0 +1,139 @@
+// A single, disposable backend process. Resolve startup dependencies, but never
+// run appLoader: its initData/initTask hooks install dependencies and start user work.
+import 'reflect-metadata';
+import dns from 'dns';
+import http from 'http';
+
+// The first scheduler connection can outlive its short RPC deadline. Let the
+// normal single-flight recovery finish within the supervised startup budget.
+async function waitForUpgradeScheduler(
+  readiness: { recover(): Promise<boolean> },
+  timeoutMs: number,
+  retryMs = 250,
+) {
+  const deadline = Date.now() + timeoutMs;
+  do {
+    if (await readiness.recover()) return;
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) break;
+    await new Promise((resolve) =>
+      setTimeout(resolve, Math.min(retryMs, remaining)),
+    );
+  } while (Date.now() < deadline);
+  throw new Error('Upgrade scheduler readiness failed');
+}
+
+async function probeUpgrade() {
+  if (!process.send || process.env.QL_UPGRADE_PROBE !== '1')
+    throw new Error('Upgrade probe requires its isolated supervisor');
+  dns.setDefaultResultOrder('ipv4first');
+  const { default: config } = await import('../config');
+  const { sequelize } = await import('../data');
+  const { default: loadDatabase } = await import('../loaders/db');
+  const { Container } = await import('typedi');
+  const { GrpcServerService } = await import('../services/grpc');
+  const { HttpServerService } = await import('../services/http');
+  const { createHttpApplication } = await import('../loaders/httpApplication');
+  const { default: loadServer } = await import('../loaders/server');
+  const { default: loadExpress } = await import('../loaders/express');
+  await import('../loaders/app'); // Resolve normal startup hooks without running them.
+  const { default: inject } = await import('../loaders/depInjector');
+  const grpc = Container.get(GrpcServerService);
+  const server = Container.get(HttpServerService);
+  try {
+    await loadDatabase();
+    // Exercise an actual on-disk transaction as well as schema initialization.
+    await sequelize.transaction(async (transaction) => {
+      await sequelize.query('CREATE TABLE upgrade_probe (value INTEGER)', {
+        transaction,
+      });
+      await sequelize.query('INSERT INTO upgrade_probe VALUES (42)', {
+        transaction,
+      });
+      const [rows] = await sequelize.query('SELECT value FROM upgrade_probe', {
+        transaction,
+      });
+      if ((rows[0] as { value: number })?.value !== 42)
+        throw new Error('Upgrade database readback failed');
+    });
+    inject();
+    config.grpcPort = await grpc.initialize();
+    const { default: cronClient } = await import('../schedule/client');
+    cronClient.readiness.configure(async () => {});
+    await waitForUpgradeScheduler(
+      cronClient.readiness,
+      process.arch === 'arm' &&
+        Number(
+          (process.config.variables as { arm_version?: string | number })
+            .arm_version,
+        ) === 6
+        ? 60000
+        : 10000,
+    );
+    const app = await createHttpApplication();
+    loadExpress({ app });
+    const listener = await server.initialize(app, 0);
+    await loadServer({ server: listener });
+    const address = listener.address();
+    if (!address || typeof address === 'string')
+      throw new Error('No probe HTTP port');
+    const health = await new Promise<any>((resolve, reject) => {
+      const request = http.get(
+        `http://127.0.0.1:${address.port}/api/health`,
+        (response) => {
+          let body = '';
+          response.on('data', (chunk) => {
+            body += chunk;
+          });
+          response.on('error', reject);
+          response.on('end', () => {
+            try {
+              const result = JSON.parse(body);
+              if (
+                response.statusCode !== 200 ||
+                result.code !== 200 ||
+                result.data?.status !== 'ok' ||
+                !result.data.services?.grpc ||
+                !result.data.services?.http
+              )
+                throw new Error('Upgrade HTTP/gRPC health check failed');
+              resolve(result.data);
+            } catch (error) {
+              reject(error);
+            }
+          });
+        },
+      );
+      request.setTimeout(10000, () =>
+        request.destroy(new Error('Upgrade health request timed out')),
+      );
+      request.on('error', reject);
+    });
+    process.send!({
+      type: 'upgrade-probe',
+      ok: true,
+      build: health.build,
+      memory: process.memoryUsage(),
+      pid: process.pid,
+    });
+  } finally {
+    await server.shutdown();
+    grpc.getServer().forceShutdown();
+    await sequelize.close();
+  }
+}
+
+process.once('disconnect', () => process.exit(1));
+probeUpgrade()
+  .then(() => process.exit(0))
+  .catch((error) => {
+    process.send?.({
+      type: 'upgrade-probe',
+      ok: false,
+      code: error.code,
+      message: error.message,
+      stack: error.stack,
+    });
+    console.error(error);
+    process.exit(1);
+  });
@@ -1,3 +1,5 @@
+import { maybeSudo } from './container';
+
 export const LOG_END_SYMBOL = '　　　　　';

 export const TASK_COMMAND = 'task';
@@ -23,3 +25,67 @@ export const SAMPLE_FILES = [
    target: 'data/scripts/notify.py',
  },
 ];
+
+export const PYTHON_INSTALL_DIR = process.env.PYTHON_HOME;
+export const PYTHON_VENV_DIR = process.env.PYTHON_VENV_DIR;
+
+export const NotificationModeStringMap = {
+  0: 'gotify',
+  1: 'goCqHttpBot',
+  2: 'serverChan',
+  3: 'pushDeer',
+  4: 'bark',
+  5: 'chat',
+  6: 'telegramBot',
+  7: 'dingtalkBot',
+  8: 'weWorkBot',
+  9: 'weWorkApp',
+  10: 'aibotk',
+  11: 'iGot',
+  12: 'pushPlus',
+  13: 'wePlusBot',
+  14: 'email',
+  15: 'pushMe',
+  16: 'feishu',
+  17: 'webhook',
+  18: 'chronocat',
+  19: 'ntfy',
+  20: 'wxPusherBot',
+  21: 'wxPusherSpt',
+  22: 'wpush',
+} as const;
+
+export const LINUX_DEPENDENCE_COMMAND: Record<
+  'Debian' | 'Ubuntu' | 'Alpine',
+  {
+    install: string;
+    uninstall: string;
+    info: string;
+    check(info: string): boolean;
+  }
+> = {
+  Debian: {
+    install: maybeSudo('apt-get install -y'),
+    uninstall: maybeSudo('apt-get remove -y'),
+    info: maybeSudo('dpkg-query -s'),
+    check(info: string) {
+      return info.includes('install ok installed');
+    },
+  },
+  Ubuntu: {
+    install: maybeSudo('apt-get install -y'),
+    uninstall: maybeSudo('apt-get remove -y'),
+    info: maybeSudo('dpkg-query -s'),
+    check(info: string) {
+      return info.includes('install ok installed');
+    },
+  },
+  Alpine: {
+    install: 'apk add --no-check-certificate',
+    uninstall: 'apk del',
+    info: 'apk info -es',
+    check(info: string) {
+      return info.includes('installed');
+    },
+  },
+};
@@ -0,0 +1,7 @@
+export function isInContainer(): boolean {
+  return process.env.QL_CONTAINER === 'true';
+}
+
+export function maybeSudo(cmd: string): string {
+  return isInContainer() ? `sudo ${cmd}` : cmd;
+}
@@ -0,0 +1,198 @@
+import { execFileSync } from 'child_process';
+import * as fs from 'fs/promises';
+import path from 'path';
+import config from './index';
+import { fileExist } from './util';
+import Logger from '../loaders/logger';
+
+export interface GrpcTlsConfig {
+  caCert: string;
+  serverCert: string;
+  serverKey: string;
+  clientCert: string;
+  clientKey: string;
+}
+
+const certDir = path.join(config.configPath, 'grpc');
+const caKeyPath = path.join(certDir, 'ca.key');
+const caCertPath = path.join(certDir, 'ca.crt');
+const serverKeyPath = path.join(certDir, 'server.key');
+const serverCertPath = path.join(certDir, 'server.crt');
+const clientKeyPath = path.join(certDir, 'client.key');
+const clientCertPath = path.join(certDir, 'client.crt');
+
+let cachedConfig: GrpcTlsConfig | null = null;
+
+function run(args: string[]): string {
+  return execFileSync('openssl', args, {
+    stdio: 'pipe',
+    timeout: 30000,
+    encoding: 'utf-8',
+  }).trim();
+}
+
+async function generateAllCerts(): Promise<GrpcTlsConfig> {
+  Logger.info('[boot] Generating gRPC mTLS certificates...');
+  await fs.mkdir(certDir, { recursive: true, mode: 0o700 });
+  // Atomically reserve a private workspace for keys, CSRs and OpenSSL side files.
+  const workspace = await fs.mkdtemp(path.join(certDir, '.generate-'));
+  const caKeyTmp = path.join(workspace, 'ca.key');
+  const caCertTmp = path.join(workspace, 'ca.crt');
+  const serverKeyTmp = path.join(workspace, 'server.key');
+  const serverCsrTmp = path.join(workspace, 'server.csr');
+  const serverExtTmp = path.join(workspace, 'server.ext');
+  const clientKeyTmp = path.join(workspace, 'client.key');
+  const clientCsrTmp = path.join(workspace, 'client.csr');
+  const clientExtTmp = path.join(workspace, 'client.ext');
+
+  const cleanup = async () => {
+    await fs.rm(workspace, { recursive: true, force: true });
+  };
+
+  try {
+    run(['genrsa', '-out', caKeyTmp, '2048']);
+    run([
+      'req',
+      '-new',
+      '-x509',
+      '-days',
+      '3650',
+      '-key',
+      caKeyTmp,
+      '-out',
+      caCertTmp,
+      '-subj',
+      '/CN=qinglong-ca/O=qinglong/C=CN',
+    ]);
+    const caKey = await fs.readFile(caKeyTmp, 'utf-8');
+    const caCert = await fs.readFile(caCertTmp, 'utf-8');
+    await fs.writeFile(caKeyPath, caKey, { mode: 0o600 });
+
+    run(['genrsa', '-out', serverKeyTmp, '2048']);
+    run([
+      'req',
+      '-new',
+      '-key',
+      serverKeyTmp,
+      '-out',
+      serverCsrTmp,
+      '-subj',
+      '/CN=grpc-server',
+    ]);
+    await fs.writeFile(
+      serverExtTmp,
+      'subjectAltName=DNS:localhost,IP:127.0.0.1,IP:::1\n',
+    );
+    const serverCert = run([
+      'x509',
+      '-req',
+      '-days',
+      '3650',
+      '-in',
+      serverCsrTmp,
+      '-CA',
+      caCertTmp,
+      '-CAkey',
+      caKeyTmp,
+      '-CAserial',
+      path.join(workspace, 'ca.srl'),
+      '-CAcreateserial',
+      '-extfile',
+      serverExtTmp,
+    ]);
+    const serverKey = await fs.readFile(serverKeyTmp, 'utf-8');
+
+    run(['genrsa', '-out', clientKeyTmp, '2048']);
+    run([
+      'req',
+      '-new',
+      '-key',
+      clientKeyTmp,
+      '-out',
+      clientCsrTmp,
+      '-subj',
+      '/CN=grpc-client',
+    ]);
+    await fs.writeFile(clientExtTmp, 'extendedKeyUsage=clientAuth\n');
+    const clientCert = run([
+      'x509',
+      '-req',
+      '-days',
+      '3650',
+      '-in',
+      clientCsrTmp,
+      '-CA',
+      caCertTmp,
+      '-CAkey',
+      caKeyTmp,
+      '-CAserial',
+      path.join(workspace, 'ca.srl'),
+      '-CAcreateserial',
+      '-extfile',
+      clientExtTmp,
+    ]);
+    const clientKey = await fs.readFile(clientKeyTmp, 'utf-8');
+
+    Logger.info('[boot] gRPC mTLS certificates generated successfully');
+    return { caCert, serverCert, serverKey, clientCert, clientKey };
+  } finally {
+    await cleanup();
+  }
+}
+
+async function saveCerts(tlsConfig: GrpcTlsConfig): Promise<void> {
+  await fs.mkdir(certDir, { recursive: true });
+
+  await fs.writeFile(caCertPath, tlsConfig.caCert, { mode: 0o644 });
+  await fs.writeFile(serverCertPath, tlsConfig.serverCert, { mode: 0o644 });
+  await fs.writeFile(serverKeyPath, tlsConfig.serverKey, { mode: 0o600 });
+  await fs.writeFile(clientCertPath, tlsConfig.clientCert, { mode: 0o644 });
+  await fs.writeFile(clientKeyPath, tlsConfig.clientKey, { mode: 0o600 });
+
+  Logger.info(`[boot] gRPC mTLS certificates saved to ${certDir}`);
+}
+
+async function loadExistingCerts(): Promise<GrpcTlsConfig | null> {
+  const exists = await Promise.all([
+    fileExist(caCertPath),
+    fileExist(serverCertPath),
+    fileExist(serverKeyPath),
+    fileExist(clientCertPath),
+    fileExist(clientKeyPath),
+  ]);
+
+  if (exists.some((e) => !e)) {
+    return null;
+  }
+
+  const [caCert, serverCert, serverKey, clientCert, clientKey] = await Promise.all([
+    fs.readFile(caCertPath, 'utf-8'),
+    fs.readFile(serverCertPath, 'utf-8'),
+    fs.readFile(serverKeyPath, 'utf-8'),
+    fs.readFile(clientCertPath, 'utf-8'),
+    fs.readFile(clientKeyPath, 'utf-8'),
+  ]);
+
+  Logger.info('[boot] Loaded existing gRPC mTLS certificates from disk');
+  return { caCert, serverCert, serverKey, clientCert, clientKey };
+}
+
+export async function initGrpcCerts(): Promise<GrpcTlsConfig> {
+  if (cachedConfig) {
+    return cachedConfig;
+  }
+
+  let tlsConfig = await loadExistingCerts();
+
+  if (!tlsConfig) {
+    tlsConfig = await generateAllCerts();
+    await saveCerts(tlsConfig);
+  }
+
+  cachedConfig = tlsConfig;
+  return tlsConfig;
+}
+
+export function getGrpcCerts(): GrpcTlsConfig | null {
+  return cachedConfig;
+}
@@ -0,0 +1,68 @@
+import { request as undiciRequest, Dispatcher } from 'undici';
+
+type RequestBaseOptions = {
+  dispatcher?: Dispatcher;
+  json?: Record<string, any>;
+  form?: string;
+  headers?: Record<string, string>;
+} & Omit<Dispatcher.RequestOptions<null>, 'origin' | 'path' | 'method'>;
+
+type RequestOptionsWithOptions = RequestBaseOptions &
+  Partial<Pick<Dispatcher.RequestOptions, 'method'>>;
+
+type ResponseTypeMap = {
+  json: Record<string, any>;
+  text: string;
+};
+
+type ResponseTypeKey = keyof ResponseTypeMap;
+
+async function request(
+  url: string,
+  options?: RequestOptionsWithOptions,
+): Promise<Dispatcher.ResponseData<null>> {
+  const { json, form, body, headers = {}, ...rest } = options || {};
+  const finalHeaders = { ...headers } as Record<string, string>;
+  let finalBody = body;
+
+  if (json) {
+    finalHeaders['content-type'] = 'application/json';
+    finalBody = JSON.stringify(json);
+  } else if (form) {
+    finalBody = form;
+    delete finalHeaders['content-type'];
+  }
+
+  const res = await undiciRequest(url, {
+    method: 'POST',
+    headers: finalHeaders,
+    body: finalBody,
+    ...rest,
+  });
+
+  return res;
+}
+
+async function post<T extends ResponseTypeKey = 'json'>(
+  url: string,
+  options?: RequestBaseOptions & { responseType?: T },
+): Promise<ResponseTypeMap[T]> {
+  const resp = await request(url, { ...options, method: 'POST' });
+
+  const rawText = await resp.body.text();
+
+  if (options?.responseType === 'text') {
+    return rawText as ResponseTypeMap[T];
+  }
+
+  try {
+    return JSON.parse(rawText) as ResponseTypeMap[T];
+  } catch {
+    return rawText as ResponseTypeMap[T];
+  }
+}
+
+export const httpClient = {
+  post,
+  request,
+};
@@ -1,13 +1,64 @@
 import dotenv from 'dotenv';
 import path from 'path';
-import { createRandomString } from './share';
+
+dotenv.config({
+  path: path.join(__dirname, '../../.env'),
+});
+
+interface Config {
+  port: number;
+  grpcPort: number;
+  bindHost: string;
+  bindHostGrpc: string;
+  nodeEnv: string;
+  isDevelopment: boolean;
+  isProduction: boolean;
+  jwt: {
+    secret: string;
+    expiresIn?: string;
+  };
+  cors: {
+    origin: string[];
+    methods: string[];
+  };
+  logs: {
+    level: string;
+  };
+  api: {
+    prefix: string;
+  };
+}
+
+const config: Config = {
+  port: parseInt(process.env.BACK_PORT || '5700', 10),
+  grpcPort: parseInt(process.env.GRPC_PORT || '5500', 10),
+  bindHost: process.env.BIND_HOST || '::',
+  bindHostGrpc: process.env.BIND_HOST_GRPC || '::',
+  nodeEnv: process.env.NODE_ENV || 'development',
+  isDevelopment: process.env.NODE_ENV === 'development',
+  isProduction: process.env.NODE_ENV === 'production',
+  logs: {
+    level: process.env.LOG_LEVEL || 'silly',
+  },
+  api: {
+    prefix: '/api',
+  },
+  jwt: {
+    secret: process.env.JWT_SECRET || 'whyour-secret',
+    expiresIn: process.env.JWT_EXPIRES_IN,
+  },
+  cors: {
+    origin: process.env.CORS_ORIGIN
+      ? process.env.CORS_ORIGIN.split(',')
+      : ['*'],
+    methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
+  },
+};

 process.env.NODE_ENV = process.env.NODE_ENV || 'development';

 if (!process.env.QL_DIR) {
-  // 声明QL_DIR环境变量
  let qlHomePath = path.join(__dirname, '../../');
-  // 生产环境
  if (qlHomePath.endsWith('/static/')) {
    qlHomePath = path.join(qlHomePath, '../');
  }
@@ -16,6 +67,19 @@ if (!process.env.QL_DIR) {

 const lastVersionFile = `https://qn.whyour.cn/version.yaml`;

+// Get and normalize QlBaseUrl
+let baseUrl = process.env.QlBaseUrl || '';
+if (baseUrl) {
+  // Ensure it starts with /
+  if (!baseUrl.startsWith('/')) {
+    baseUrl = `/${baseUrl}`;
+  }
+  // Remove trailing slash for consistency in route definitions
+  if (baseUrl.endsWith('/')) {
+    baseUrl = baseUrl.slice(0, -1);
+  }
+}
+
 const rootPath = process.env.QL_DIR as string;
 const envFound = dotenv.config({ path: path.join(rootPath, '.env') });

@@ -38,12 +102,14 @@ const dbPath = path.join(dataPath, 'db/');
 const uploadPath = path.join(dataPath, 'upload/');
 const sshdPath = path.join(dataPath, 'ssh.d/');
 const systemLogPath = path.join(dataPath, 'syslog/');
+const dependenceCachePath = path.join(dataPath, 'dep_cache/');

 const envFile = path.join(preloadPath, 'env.sh');
 const jsEnvFile = path.join(preloadPath, 'env.js');
 const pyEnvFile = path.join(preloadPath, 'env.py');
 const jsNotifyFile = path.join(preloadPath, '__ql_notify__.js');
 const pyNotifyFile = path.join(preloadPath, '__ql_notify__.py');
+const langEnvFile = path.join(preloadPath, 'lang_env.sh');
 const confFile = path.join(configPath, 'config.sh');
 const crontabFile = path.join(configPath, 'crontab.list');
 const authConfigFile = path.join(configPath, 'auth.json');
@@ -52,8 +118,6 @@ const confBakDir = path.join(dataPath, 'config/bak/');
 const sampleFile = path.join(samplePath, 'config.sample.sh');
 const sqliteFile = path.join(samplePath, 'database.sqlite');

-const authError = '错误的用户名密码，请重试';
-const loginFaild = '请先登录!';
 const configString = 'config sample crontab shareCode diy';
 const versionFile = path.join(rootPath, 'version.yaml');
 const dataTgzFile = path.join(tmpPath, 'data.tgz');
@@ -65,17 +129,9 @@ if (envFound.error) {
 }

 export default {
-  port: parseInt(process.env.BACK_PORT as string, 10),
-  cronPort: parseInt(process.env.CRON_PORT as string, 10),
-  publicPort: parseInt(process.env.PUBLIC_PORT as string, 10),
-  updatePort: parseInt(process.env.UPDATE_PORT as string, 10),
-  secret: process.env.SECRET || createRandomString(16, 32),
-  logs: {
-    level: process.env.LOG_LEVEL || 'silly',
-  },
-  api: {
-    prefix: '/api',
-  },
+  ...config,
+  jwt: config.jwt,
+  baseUrl,
  rootPath,
  tmpPath,
  dataPath,
@@ -83,8 +139,6 @@ export default {
  shareShellFile,
  dependenceProxyFile,
  configString,
-  loginFaild,
-  authError,
  logPath,
  extraFile,
  authConfigFile,
@@ -97,6 +151,7 @@ export default {
  pyEnvFile,
  jsNotifyFile,
  pyNotifyFile,
+  langEnvFile,
  dbPath,
  uploadPath,
  configPath,
@@ -113,11 +168,14 @@ export default {
    'env.js',
    'env.py',
    'token.json',
+    'grpc',
+    '__pycache__',
  ],
  writePathList: [configPath, scriptPath],
  bakPath,
  apiWhiteList: [
    '/api/user/login',
+    '/api/health',
    '/open/auth/token',
    '/api/user/two-factor/login',
    '/api/system',
@@ -134,4 +192,6 @@ export default {
  sqliteFile,
  sshdPath,
  systemLogPath,
+  dependenceCachePath,
+  maxTokensPerPlatform: 10, // Maximum number of concurrent sessions per platform
 };
@@ -1,3 +1,5 @@
+import { randomInt } from 'crypto';
+
 export function createRandomString(min: number, max: number): string {
  const num = ['0', '1', '2', '3', '4', '5', '6', '7', '8', '9'];
  const english = [
@@ -65,20 +67,20 @@ export function createRandomString(min: number, max: number): string {
  arr.push(getOne(ENGLISH));
  arr.push(getOne(special));

-  const len = min + Math.floor(Math.random() * (max - min + 1));
+  const len = min + randomInt(max - min + 1);

  for (let i = 4; i < len; i++) {
-    arr.push(config[Math.floor(Math.random() * config.length)]);
+    arr.push(config[randomInt(config.length)]);
  }

  const newArr = [];
  for (let j = 0; j < len; j++) {
-    newArr.push(arr.splice(Math.random() * arr.length, 1)[0]);
+    newArr.push(arr.splice(randomInt(arr.length), 1)[0]);
  }

  function getOne(arr: any[]) {
-    return arr[Math.floor(Math.random() * arr.length)];
+    return arr[randomInt(arr.length)];
  }

  return newArr.join('');
-}
+}
@@ -1,5 +1,7 @@
 import { Subscription } from '../data/subscription';
 import isNil from 'lodash/isNil';
+import { shellQuote } from '../shared/shellQuote';
+import { getSubscriptionSshAlias } from '../shared/subscriptionPath';

 export function formatUrl(doc: Subscription) {
  let url = doc.url;
@@ -7,7 +9,7 @@ export function formatUrl(doc: Subscription) {
  if (doc.type === 'private-repo') {
    if (doc.pull_type === 'ssh-key') {
      host = doc.url!.replace(/.*\@([^\:]+)\:.*/, '$1');
-      url = doc.url!.replace(host, doc.alias);
+      url = doc.url!.replace(host, getSubscriptionSshAlias(doc.alias));
    } else {
      host = doc.url!.replace(/.*\:\/\/([^\/]+)\/.*/, '$1');
      const { username, password } = doc.pull_option as any;
@@ -18,29 +20,24 @@ export function formatUrl(doc: Subscription) {
 }

 export function formatCommand(doc: Subscription, url?: string) {
-  let command = `SUB_ID=${doc.id} ql `;
-  let _url = url || formatUrl(doc).url;
-  const {
-    type,
-    whitelist,
-    blacklist,
-    dependences,
-    branch,
-    extensions,
-    proxy,
-    autoAddCron,
-    autoDelCron,
-  } = doc;
-  if (type === 'file') {
-    command += `raw "${_url}" "${proxy || ''}" "${
-      isNil(autoAddCron) ? true : Boolean(autoAddCron)
-    }" "${isNil(autoDelCron) ? true : Boolean(autoDelCron)}"`;
-  } else {
-    command += `repo "${_url}" "${whitelist || ''}" "${blacklist || ''}" "${
-      dependences || ''
-    }" "${branch || ''}" "${extensions || ''}" "${proxy || ''}" "${
-      isNil(autoAddCron) ? true : Boolean(autoAddCron)
-    }" "${isNil(autoDelCron) ? true : Boolean(autoDelCron)}"`;
-  }
-  return command;
+  const args =
+    doc.type === 'file'
+      ? ['raw', url || formatUrl(doc).url, doc.proxy || '']
+      : [
+          'repo',
+          url || formatUrl(doc).url,
+          doc.whitelist || '',
+          doc.blacklist || '',
+          doc.dependences || '',
+          doc.branch || '',
+          doc.extensions || '',
+          doc.proxy || '',
+        ];
+  args.push(
+    String(isNil(doc.autoAddCron) ? true : Boolean(doc.autoAddCron)),
+    String(isNil(doc.autoDelCron) ? true : Boolean(doc.autoDelCron)),
+  );
+  return `SUB_ID=${shellQuote(String(doc.id))} ql ${args
+    .map((arg) => shellQuote(arg!))
+    .join(' ')}`;
 }
@@ -1,19 +1,56 @@
 import * as fs from 'fs/promises';
+import { statSync } from 'fs';
 import * as path from 'path';
-import got from 'got';
-import iconv from 'iconv-lite';
-import { exec } from 'child_process';
-import FormData from 'form-data';
-import psTreeFun from 'pstree.remy';
+import { exec, execSync } from 'child_process';
+import psTreeFun from 'ps-tree';
 import { promisify } from 'util';
 import { load } from 'js-yaml';
 import config from './index';
-import { TASK_COMMAND } from './const';
+import { PYTHON_INSTALL_DIR, PYTHON_VENV_DIR, TASK_COMMAND } from './const';
 import Logger from '../loaders/logger';
 import { writeFileWithLock } from '../shared/utils';
+import { DependenceTypes } from '../data/dependence';
+import { FormData } from 'undici';
+import os from 'os';
+import { maybeSudo, isInContainer } from './container';
+import { shellQuote } from '../shared/shellQuote';
+import { resolveFileAccess } from '../shared/fileAccess';
+import {
+  mirrorWriteCommand,
+  normalizeMirror,
+  rewriteMirrorSources,
+} from '../shared/linuxMirror';

 export * from './share';

+let osType: 'Debian' | 'Ubuntu' | 'Alpine' | undefined;
+
+function getOsTypeSync(): 'Debian' | 'Ubuntu' | 'Alpine' | undefined {
+  // 1. 环境变量覆盖
+  const envOs = process.env.QL_OS_TYPE?.toLowerCase();
+  if (envOs === 'alpine') return 'Alpine';
+  if (envOs === 'debian') return 'Debian';
+  if (envOs === 'ubuntu') return 'Ubuntu';
+
+  // 2. 模块缓存（由 detectOS 设置）
+  if (osType) return osType;
+
+  // 3. 能力检测：检查包管理器二进制
+  try {
+    execSync('which apt-get', { stdio: 'ignore' });
+    return 'Debian';
+  } catch {
+    try {
+      execSync('which apk', { stdio: 'ignore' });
+      return 'Alpine';
+    } catch {
+      // macOS / 未知系统
+    }
+  }
+
+  return undefined;
+}
+
 export async function getFileContentByName(fileName: string) {
  const _exsit = await fileExist(fileName);
  if (_exsit) {
@@ -57,78 +94,6 @@ export function getToken(req: any) {
  return '';
 }

-export async function getNetIp(req: any) {
-  const ipArray = [
-    ...new Set([
-      ...(req.headers['x-real-ip'] || '').split(','),
-      ...(req.headers['x-forwarded-for'] || '').split(','),
-      req.ip,
-      ...req.ips,
-      req.socket.remoteAddress,
-    ]),
-  ].filter(Boolean);
-
-  let ip = ipArray[0];
-
-  if (ipArray.length > 1) {
-    for (let i = 0; i < ipArray.length; i++) {
-      const ipNumArray = ipArray[i].split('.');
-      const tmp = ipNumArray[0] + '.' + ipNumArray[1];
-      if (
-        tmp === '192.168' ||
-        (ipNumArray[0] === '172' &&
-          ipNumArray[1] >= 16 &&
-          ipNumArray[1] <= 32) ||
-        tmp === '10.7' ||
-        tmp === '127.0'
-      ) {
-        continue;
-      }
-      ip = ipArray[i];
-      break;
-    }
-  }
-
-  ip = ip.substr(ip.lastIndexOf(':') + 1, ip.length);
-  if (ip.includes('127.0') || ip.includes('192.168') || ip.includes('10.7')) {
-    ip = '';
-  }
-
-  if (!ip) {
-    return { address: `获取失败`, ip };
-  }
-
-  try {
-    const csdnApi = got
-      .get(`https://searchplugin.csdn.net/api/v1/ip/get?ip=${ip}`, {
-        timeout: 10000,
-        retry: 0,
-      })
-      .text();
-    const pconlineApi = got
-      .get(`https://whois.pconline.com.cn/ipJson.jsp?ip=${ip}&json=true`, {
-        timeout: 10000,
-        retry: 0,
-      })
-      .buffer();
-    const [csdnBody, pconlineBody] = await await Promise.all<any>([
-      csdnApi,
-      pconlineApi,
-    ]);
-    const csdnRes = JSON.parse(csdnBody);
-    const pconlineRes = JSON.parse(iconv.decode(pconlineBody, 'GBK'));
-    let address = '';
-    if (csdnBody && csdnRes.code == 200) {
-      address = csdnRes.data.address;
-    } else if (pconlineRes && pconlineRes.addr) {
-      address = pconlineRes.addr;
-    }
-    return { address, ip };
-  } catch (error) {
-    return { address: `获取失败`, ip };
-  }
-}
-
 export function getPlatform(userAgent: string): 'mobile' | 'desktop' {
  const ua = userAgent.toLowerCase();
  const testUa = (regexp: RegExp) => regexp.test(ua);
@@ -187,7 +152,8 @@ export async function handleLogPath(
  logPath: string,
  data: string = '',
 ): Promise<string> {
-  const absolutePath = path.resolve(config.logPath, logPath);
+  const absolutePath = resolveFileAccess(config.logPath, [logPath]);
+  if (!absolutePath) throw new Error('Log path is outside the log directory');
  const logFileExist = await fileExist(absolutePath);
  if (!logFileExist) {
    await createFile(absolutePath, data);
@@ -257,71 +223,159 @@ export function dirSort(a: IFile, b: IFile): number {
  }
 }

+const FILE_SYSTEM_READ_CONCURRENCY = 32;
+
+type FileSystemTaskRunner = <T>(task: () => Promise<T>) => Promise<T>;
+
+function createFileSystemTaskRunner(concurrency: number): FileSystemTaskRunner {
+  let activeCount = 0;
+  const queue: Array<() => void> = [];
+
+  const runNext = () => {
+    while (activeCount < concurrency && queue.length > 0) {
+      activeCount += 1;
+      queue.shift()?.();
+    }
+  };
+
+  return <T>(task: () => Promise<T>) =>
+    new Promise<T>((resolve, reject) => {
+      queue.push(() => {
+        task()
+          .then(resolve, reject)
+          .finally(() => {
+            activeCount -= 1;
+            runNext();
+          });
+      });
+      runNext();
+    });
+}
+
+async function readDirsWithRunner(
+  dir: string,
+  baseDir: string,
+  blacklist: string[],
+  sort: (a: IFile, b: IFile) => number,
+  runFileSystemTask: FileSystemTaskRunner,
+): Promise<IFile[]> {
+  const relativePath = path.relative(baseDir, dir);
+  const entries = await runFileSystemTask(() =>
+    fs.readdir(dir, { withFileTypes: true }),
+  );
+
+  const items = await Promise.all(
+    entries.map(async (entry): Promise<IFile | undefined> => {
+      if (blacklist.includes(entry.name) || entry.isSymbolicLink()) {
+        return undefined;
+      }
+
+      const subPath = path.join(dir, entry.name);
+      const stats = await runFileSystemTask(() => fs.lstat(subPath));
+      if (stats.isSymbolicLink()) {
+        return undefined;
+      }
+      const key = path.join(relativePath, entry.name);
+
+      if (stats.isDirectory()) {
+        const children = await readDirsWithRunner(
+          subPath,
+          baseDir,
+          blacklist,
+          sort,
+          runFileSystemTask,
+        );
+        return {
+          title: entry.name,
+          key,
+          type: 'directory',
+          parent: relativePath,
+          createTime: stats.birthtime.getTime(),
+          children,
+        };
+      }
+
+      return {
+        title: entry.name,
+        type: 'file',
+        key,
+        parent: relativePath,
+        size: stats.size,
+        createTime: stats.birthtime.getTime(),
+      };
+    }),
+  );
+
+  return items.filter((item): item is IFile => Boolean(item)).sort(sort);
+}
+
 export async function readDirs(
  dir: string,
  baseDir: string = '',
  blacklist: string[] = [],
  sort: (a: IFile, b: IFile) => number = dirSort,
 ): Promise<IFile[]> {
-  const relativePath = path.relative(baseDir, dir);
-  const files = await fs.readdir(dir);
-  const result: IFile[] = [];
-
-  for (const file of files) {
-    const subPath = path.join(dir, file);
-    const stats = await fs.lstat(subPath);
-    const key = path.join(relativePath, file);
-
-    if (blacklist.includes(file) || stats.isSymbolicLink()) {
-      continue;
-    }
-
-    if (stats.isDirectory()) {
-      const children = await readDirs(subPath, baseDir, blacklist, sort);
-      result.push({
-        title: file,
-        key,
-        type: 'directory',
-        parent: relativePath,
-        createTime: stats.birthtime.getTime(),
-        children: children.sort(sort),
-      });
-    } else {
-      result.push({
-        title: file,
-        type: 'file',
-        key,
-        parent: relativePath,
-        size: stats.size,
-        createTime: stats.birthtime.getTime(),
-      });
-    }
-  }
-
-  return result.sort(sort);
+  return readDirsWithRunner(
+    dir,
+    baseDir,
+    blacklist,
+    sort,
+    createFileSystemTaskRunner(FILE_SYSTEM_READ_CONCURRENCY),
+  );
 }

 export async function readDir(
  dir: string,
  baseDir: string = '',
  blacklist: string[] = [],
-) {
-  const relativePath = path.relative(baseDir, dir);
-  const files = await fs.readdir(dir);
-  const result: any = files
-    .filter((x) => !blacklist.includes(x))
-    .map(async (file: string) => {
-      const subPath = path.join(dir, file);
+): Promise<IFile[]> {
+  const absoluteDir = path.resolve(baseDir, dir);
+  if (!absoluteDir.startsWith(path.resolve(baseDir))) {
+    return [];
+  }
+  const relativePath = path.relative(baseDir, absoluteDir);
+
+  try {
+    const files = await fs.readdir(absoluteDir);
+    const result: IFile[] = [];
+
+    for (const file of files) {
+      const subPath = path.join(absoluteDir, file);
      const stats = await fs.lstat(subPath);
      const key = path.join(relativePath, file);
-      return {
-        title: file,
-        type: stats.isDirectory() ? 'directory' : 'file',
-        key,
-        parent: relativePath,
-      };
-    });
-  return result;
+
+      if (blacklist.includes(file) || stats.isSymbolicLink()) {
+        continue;
+      }
+
+      if (stats.isDirectory()) {
+        result.push({
+          title: file,
+          type: 'directory',
+          key,
+          parent: relativePath,
+          createTime: stats.birthtime.getTime(),
+          children: [],
+        });
+      } else {
+        result.push({
+          title: file,
+          type: 'file',
+          key,
+          parent: relativePath,
+          size: stats.size,
+          createTime: stats.birthtime.getTime(),
+        });
+      }
+    }
+
+    return result;
+  } catch (error: any) {
+    if (error.code === 'ENOENT') {
+      return [];
+    }
+    throw error;
+  }
 }

 export async function promiseExec(command: string): Promise<string> {
@@ -352,9 +406,9 @@ export function parseHeaders(headers: string) {
  if (!headers) return {};

  const parsed: any = {};
-  let key;
-  let val;
-  let i;
+  let key: string;
+  let val: string;
+  let i: number;

  headers &&
    headers.split('\n').forEach(function parser(line) {
@@ -433,27 +487,78 @@ export function parseBody(

 export function psTree(pid: number): Promise<number[]> {
  return new Promise((resolve, reject) => {
-    psTreeFun(pid, (err: any, pids: number[]) => {
+    psTreeFun(pid, (err: any, children) => {
      if (err) {
        reject(err);
      }
-      resolve(pids.filter((x) => !isNaN(x)));
+      resolve(children.map((x) => Number(x.PID)).filter((x) => !isNaN(x)));
    });
  });
 }

-export async function killTask(pid: number) {
-  const pids = await psTree(pid);
-
-  if (pids.length) {
+export async function killTask(pid: number, waitForExit = false) {
+  const descendants = await psTree(pid);
+  const signal = (target: number, sig: NodeJS.Signals) => {
    try {
-      [pid, ...pids].reverse().forEach((x) => {
-        process.kill(x, 15);
-      });
-    } catch (error) {}
-  } else {
-    process.kill(pid, 2);
+      process.kill(target, sig);
+    } catch (error: any) {
+      if (error.code !== 'ESRCH') throw error;
+    }
+  };
+  if (!waitForExit) {
+    if (descendants.length) {
+      // A child may exit after psTree; keep signalling the remaining tree.
+      for (const target of [pid, ...descendants].reverse()) {
+        signal(target, 'SIGTERM');
+      }
+    } else signal(pid, 'SIGINT');
+    return;
  }
+  const pids = [...descendants.reverse(), pid];
+  for (const target of pids) signal(target, 'SIGTERM');
+  const alive = async (target: number) => {
+    try {
+      process.kill(target, 0);
+    } catch (error: any) {
+      if (error.code === 'ESRCH') return false;
+      throw error;
+    }
+    if (process.platform === 'linux') {
+      try {
+        const stat = await fs.readFile(`/proc/${target}/stat`, 'utf8');
+        // The command field may contain spaces and parentheses. Zombies have
+        // exited even while their parent has not reaped the PID yet.
+        const state = stat.slice(stat.lastIndexOf(')') + 2).split(' ')[0];
+        if (['Z', 'X', 'x'].includes(state)) return false;
+      } catch {
+        // /proc may be unavailable, or the process may have just exited.
+        // Retain the portable signal probe rather than assuming it is dead.
+        try {
+          process.kill(target, 0);
+        } catch (error: any) {
+          if (error.code === 'ESRCH') return false;
+          throw error;
+        }
+      }
+    }
+    return true;
+  };
+  const wait = async () => {
+    const deadline = Date.now() + 1000;
+    let remaining = pids;
+    while (true) {
+      const states = await Promise.all(remaining.map(alive));
+      remaining = remaining.filter((_, index) => states[index]);
+      if (!remaining.length || Date.now() >= deadline) return remaining;
+      await new Promise((resolve) => setTimeout(resolve, 20));
+    }
+  };
+  let remaining = await wait();
+  if (!remaining.length) return;
+  for (const target of remaining) signal(target, 'SIGKILL');
+  remaining = await wait();
+  if (remaining.length)
+    throw new Error(`Task processes did not exit: ${remaining.join(', ')}`);
 }

 export async function getPid(cmd: string) {
@@ -462,6 +567,27 @@ export async function getPid(cmd: string) {
  return pid ? Number(pid) : undefined;
 }

+export async function getAllPids(cmd: string): Promise<number[]> {
+  const taskCommand = `ps -eo pid,command | grep "${cmd}" | grep -v grep | awk '{print $1}'`;
+  const pidsStr = await promiseExec(taskCommand);
+  if (!pidsStr) return [];
+  return pidsStr
+    .split('\n')
+    .map((p) => Number(p.trim()))
+    .filter((p) => !isNaN(p) && p > 0);
+}
+
+export async function killAllTasks(cmd: string): Promise<void> {
+  const pids = await getAllPids(cmd);
+  for (const pid of pids) {
+    try {
+      await killTask(pid);
+    } catch (error) {
+      // Ignore errors if process already terminated
+    }
+  }
+}
+
 interface IVersion {
  version: string;
  changeLogLink: string;
@@ -527,11 +653,13 @@ export function safeJSONParse(value?: string) {
  try {
    return JSON.parse(value);
  } catch (error) {
-    Logger.error('[safeJSONParse失败]', error);
+    Logger.error('[safeJSONParse error]', error);
    return {};
  }
 }

+export { errStack } from '../shared/errors';
+
 export async function rmPath(path: string) {
  try {
    const _exsit = await fileExist(path);
@@ -539,7 +667,7 @@ export async function rmPath(path: string) {
      await fs.rm(path, { force: true, recursive: true, maxRetries: 5 });
    }
  } catch (error) {
-    Logger.error('[rmPath失败]', error);
+    Logger.error('[rmPath error]', error);
  }
 }

@@ -549,12 +677,333 @@ export async function setSystemTimezone(timezone: string): Promise<boolean> {
      throw new Error('Invalid timezone');
    }

-    await promiseExec(`ln -sf /usr/share/zoneinfo/${timezone} /etc/localtime`);
-    await promiseExec(`echo "${timezone}" > /etc/timezone`);
+    await promiseExec(
+      maybeSudo(`ln -sf /usr/share/zoneinfo/${timezone} /etc/localtime`),
+    );
+    await promiseExec(`echo "${timezone}" | ${maybeSudo('tee /etc/timezone')}`);

    return true;
  } catch (error) {
-    Logger.error('[setSystemTimezone失败]', error);
+    Logger.error('[setSystemTimezone error]', error);
    return false;
  }
 }
+
+// Helper function to check if a name is a GitHub URL
+function getPythonExecutable(): string {
+  return PYTHON_VENV_DIR
+    ? shellQuote(path.resolve(config.rootPath, PYTHON_VENV_DIR, 'bin/python3'))
+    : 'python3';
+}
+
+function getPythonPip(): string {
+  return PYTHON_VENV_DIR ? `${getPythonExecutable()} -m pip` : 'pip3';
+}
+
+function isGitHubUrl(name: string): boolean {
+  // Support git+https://, git+http://, https://, and http:// URLs
+  // This covers GitHub URLs and other git-compatible repositories
+  return !!name.match(/^(git\+https?:\/\/|https?:\/\/)/i);
+}
+
+// Helper function to check if a name is a requirements file
+function isRequirementsFile(name: string): boolean {
+  return !!name.match(/requirements.*\.(txt|in)$/i);
+}
+
+// Helper function to check if a name is a pyproject.toml file
+function isPyprojectToml(name: string): boolean {
+  return name.endsWith('pyproject.toml');
+}
+
+export function isPythonSourceDependency(name: string): boolean {
+  const source = name.trim();
+  return (
+    isGitHubUrl(source) || isRequirementsFile(source) || isPyprojectToml(source)
+  );
+}
+
+export function getGetCommand(type: DependenceTypes, name: string): string {
+  const trimmedName = name.trim();
+
+  // For Python dependencies installed from GitHub or requirements files,
+  // we can't reliably check if they're installed, so skip the check
+  if (type === DependenceTypes.python3) {
+    if (isPythonSourceDependency(trimmedName)) {
+      // Return a command that will always indicate not installed
+      // This ensures GitHub URLs and requirements files are always installed
+      return 'echo ""';
+    }
+  }
+
+  const baseCommands = {
+    [DependenceTypes.nodejs]: `pnpm ls -g  | grep "${trimmedName}" | head -1`,
+    [DependenceTypes.python3]: `${getPythonExecutable()} -c ${shellQuote(
+      `from importlib.metadata import version, PackageNotFoundError
+import importlib.util
+import sys
+try:
+ try:
+  from packaging.requirements import Requirement
+ except ImportError:
+  from pip._vendor.packaging.requirements import Requirement
+ requirement = Requirement(sys.argv[1])
+ if requirement.marker and not requirement.marker.evaluate():
+  print('not applicable')
+ else:
+  try:
+   installed = version(requirement.name)
+  except PackageNotFoundError:
+   if not requirement.specifier and not requirement.extras and not requirement.url:
+    if importlib.util.find_spec(requirement.name):
+     print(requirement.name)
+  else:
+   if requirement.specifier.contains(installed, prereleases=True):
+    print(installed)
+except Exception:
+ pass`,
+    )} ${shellQuote(trimmedName)}`,
+    [DependenceTypes.linux]:
+      getOsTypeSync() === 'Alpine'
+        ? `apk info -es ${trimmedName}`
+        : maybeSudo(`dpkg-query -s ${trimmedName}`),
+  };
+
+  return baseCommands[type];
+}
+
+export function getInstallCommand(type: DependenceTypes, name: string): string {
+  if (type === DependenceTypes.python3) {
+    const prefix =
+      PYTHON_INSTALL_DIR && !PYTHON_VENV_DIR
+        ? ` --prefix=${shellQuote(PYTHON_INSTALL_DIR)}`
+        : '';
+    const pip = `${getPythonPip()} install --disable-pip-version-check${
+      PYTHON_VENV_DIR ? '' : ' --root-user-action=ignore'
+    }${prefix}`;
+    name = name.trim();
+    if (isRequirementsFile(name) || isPyprojectToml(name)) {
+      const file = [config.scriptPath, config.repoPath]
+        .filter(Boolean)
+        .map((root) => resolveFileAccess(root, [name]))
+        .find((file) => {
+          if (!file) return false;
+          try {
+            return statSync(file).isFile();
+          } catch {
+            return false;
+          }
+        });
+      if (!file)
+        throw new Error(
+          'Python dependency file must be inside scripts or repo',
+        );
+      return isRequirementsFile(name)
+        ? `${pip} -r ${shellQuote(file)}`
+        : `${pip} ${shellQuote(path.dirname(file))}`;
+    }
+    return `${pip} -- ${shellQuote(name)}`;
+  }
+  const baseCommands = {
+    [DependenceTypes.nodejs]: 'pnpm add -g',
+    [DependenceTypes.linux]:
+      getOsTypeSync() === 'Alpine'
+        ? 'apk add --no-check-certificate'
+        : maybeSudo('apt-get install -y'),
+  };
+  return `${baseCommands[type]} ${name.trim()}`;
+}
+
+export function getUninstallCommand(
+  type: DependenceTypes,
+  name: string,
+): string {
+  if (type === DependenceTypes.python3) {
+    name = name.trim();
+    if (isRequirementsFile(name)) {
+      const file = [config.scriptPath, config.repoPath]
+        .filter(Boolean)
+        .map((root) => resolveFileAccess(root, [name]))
+        .find((file) => {
+          if (!file) return false;
+          try {
+            return statSync(file).isFile();
+          } catch {
+            return false;
+          }
+        });
+      if (!file)
+        throw new Error(
+          'Python dependency file must be inside scripts or repo',
+        );
+      return `${getPythonPip()} uninstall --disable-pip-version-check${
+        PYTHON_VENV_DIR ? '' : ' --root-user-action=ignore'
+      } -y -r ${shellQuote(file)}`;
+    }
+    if (isPyprojectToml(name) || isGitHubUrl(name)) {
+      // A source URL/project can install several distributions and has no safe
+      // inverse. Removing its panel entry leaves installed packages intact.
+      return `printf '%s\\n' ${shellQuote(
+        'Remove installed Python distributions separately by package name.',
+      )}`;
+    }
+    const packageName =
+      name.match(
+        /^([A-Za-z0-9][A-Za-z0-9._-]*)(?:\[[^\]]+\])?(?=\s*(?:[<>=!~;@]|$))/,
+      )?.[1] || name;
+    return `${getPythonPip()} uninstall --disable-pip-version-check${
+      PYTHON_VENV_DIR ? '' : ' --root-user-action=ignore'
+    } -y -- ${shellQuote(packageName)}`;
+  }
+  const baseCommands = {
+    [DependenceTypes.nodejs]: 'pnpm remove -g',
+    [DependenceTypes.linux]:
+      getOsTypeSync() === 'Alpine' ? 'apk del' : maybeSudo('apt-get remove -y'),
+  };
+  return `${baseCommands[type]} ${name.trim()}`;
+}
+
+export function isDemoEnv() {
+  return process.env.DeployEnv === 'demo';
+}
+
+async function getOSReleaseInfo(): Promise<string> {
+  const osRelease = await fs.readFile('/etc/os-release', 'utf8');
+  return osRelease;
+}
+
+function isDebian(osReleaseInfo: string): boolean {
+  return osReleaseInfo.includes('Debian');
+}
+
+function isUbuntu(osReleaseInfo: string): boolean {
+  return osReleaseInfo.includes('Ubuntu');
+}
+
+function isCentOS(osReleaseInfo: string): boolean {
+  return osReleaseInfo.includes('CentOS') || osReleaseInfo.includes('Red Hat');
+}
+
+function isAlpine(osReleaseInfo: string): boolean {
+  return osReleaseInfo.includes('Alpine');
+}
+
+export async function detectOS(): Promise<
+  'Debian' | 'Ubuntu' | 'Alpine' | undefined
+> {
+  if (osType) return osType;
+
+  const envOs = process.env.QL_OS_TYPE?.toLowerCase();
+  if (envOs === 'alpine') {
+    osType = 'Alpine';
+    return osType;
+  }
+  if (envOs === 'debian') {
+    osType = 'Debian';
+    return osType;
+  }
+  if (envOs === 'ubuntu') {
+    osType = 'Ubuntu';
+    return osType;
+  }
+
+  const platform = os.platform();
+
+  if (platform === 'linux') {
+    const osReleaseInfo = await getOSReleaseInfo();
+    if (isDebian(osReleaseInfo)) {
+      osType = 'Debian';
+    } else if (isUbuntu(osReleaseInfo)) {
+      osType = 'Ubuntu';
+    } else if (isAlpine(osReleaseInfo)) {
+      osType = 'Alpine';
+    } else {
+      Logger.error(`Unknown Linux Distribution: ${osReleaseInfo}`);
+      console.error(`Unknown Linux Distribution: ${osReleaseInfo}`);
+    }
+  } else if (platform === 'darwin') {
+    osType = undefined;
+  } else {
+    Logger.error(`Unsupported platform: ${platform}`);
+    console.error(`Unsupported platform: ${platform}`);
+  }
+
+  return osType;
+}
+
+async function _updateLinuxMirror(
+  osType: string,
+  mirror: string,
+): Promise<string> {
+  const defaults: Record<string, string> = {
+    Debian: 'http://deb.debian.org/debian',
+    Ubuntu: 'http://archive.ubuntu.com/ubuntu',
+    Alpine: 'http://dl-cdn.alpinelinux.org/alpine',
+  };
+  if (!defaults[osType])
+    throw new Error('Unsupported OS type for updating mirrors.');
+  const target = mirror || defaults[osType];
+  normalizeMirror(target);
+  const S = osType !== 'Alpine' && isInContainer() ? 'sudo ' : '';
+  const update =
+    osType === 'Alpine' ? 'apk update' : `${S}apt-get update --error-on=any`;
+  let file =
+    osType === 'Alpine'
+      ? '/etc/apk/repositories'
+      : `/etc/apt/sources.list.d/${osType.toLowerCase()}.sources`;
+  let content = '';
+  try {
+    content = await fs.readFile(file, 'utf8');
+  } catch (error: any) {
+    if (error.code !== 'ENOENT') throw error;
+    if (osType !== 'Alpine') {
+      try {
+        file = '/etc/apt/sources.list';
+        content = await fs.readFile(file, 'utf8');
+      } catch (legacyError: any) {
+        if (legacyError.code !== 'ENOENT') throw legacyError;
+        file = `/etc/apt/sources.list.d/${osType.toLowerCase()}.sources`;
+      }
+    }
+  }
+  if (!content.trim()) {
+    const release = await fs.readFile('/etc/os-release', 'utf8');
+    if (osType === 'Alpine') {
+      const version = release.match(/^VERSION_ID=["']?(\d+\.\d+)/m)?.[1];
+      if (!version)
+        throw new Error('Cannot determine Alpine repository version');
+      content = `${defaults.Alpine}/v${version}/main\n${defaults.Alpine}/v${version}/community\n`;
+    } else {
+      // The fallback may have read an empty legacy .list. Deb822 stanzas must
+      // be written to a .sources file, leaving the legacy file untouched.
+      file = `/etc/apt/sources.list.d/${osType.toLowerCase()}.sources`;
+      const codename = release.match(/^VERSION_CODENAME=["']?([\w-]+)/m)?.[1];
+      if (!codename)
+        throw new Error('Cannot determine APT repository codename');
+      const ubuntu = osType === 'Ubuntu';
+      content = `Types: deb\nURIs: ${
+        defaults[osType]
+      }\nSuites: ${codename} ${codename}-updates${
+        ubuntu ? ` ${codename}-backports` : ''
+      }\nComponents: ${
+        ubuntu ? 'main restricted universe multiverse' : 'main'
+      }\nSigned-By: /usr/share/keyrings/${osType.toLowerCase()}-archive-keyring.gpg\n`;
+      if (!ubuntu)
+        content += `\nTypes: deb\nURIs: http://security.debian.org/debian-security\nSuites: ${codename}-security\nComponents: main\nSigned-By: /usr/share/keyrings/debian-archive-keyring.gpg\n`;
+    }
+  }
+  return mirrorWriteCommand(
+    file,
+    rewriteMirrorSources(content, target),
+    S,
+    update,
+  );
+}
+
+export async function updateLinuxMirrorFile(mirror: string): Promise<string> {
+  const detectedOS = await detectOS();
+  if (!detectedOS) {
+    throw Error(`Unknown Linux Distribution`);
+  }
+  return await _updateLinuxMirror(detectedOS, mirror);
+}
@@ -13,6 +13,7 @@ export class Crontab {
  pid?: number;
  isDisabled?: 1 | 0;
  log_path?: string;
+  queued_token?: string | null;
  isPinned?: 1 | 0;
  labels?: string[];
  last_running_time?: number;
@@ -21,6 +22,9 @@ export class Crontab {
  extra_schedules?: Array<{ schedule: string }>;
  task_before?: string;
  task_after?: string;
+  log_name?: string;
+  allow_multiple_instances?: 1 | 0;
+  work_dir?: string;

  constructor(options: Crontab) {
    this.name = options.name;
@@ -45,17 +49,20 @@ export class Crontab {
    this.extra_schedules = options.extra_schedules;
    this.task_before = options.task_before;
    this.task_after = options.task_after;
+    this.log_name = options.log_name;
+    this.allow_multiple_instances = options.allow_multiple_instances || 0;
+    this.work_dir = options.work_dir;
  }
 }

 export enum CrontabStatus {
  'running' = 0,
-  'queued' = 0.5,
  'idle' = 1,
-  'disabled',
+  'disabled' = 2,
+  'queued' = 3,
 }

-export interface CronInstance extends Model<Crontab, Crontab>, Crontab { }
+export interface CronInstance extends Model<Crontab, Crontab>, Crontab {}
 export const CrontabModel = sequelize.define<CronInstance>('Crontab', {
  name: {
    unique: 'compositeIndex',
@@ -77,6 +84,7 @@ export const CrontabModel = sequelize.define<CronInstance>('Crontab', {
  isDisabled: DataTypes.NUMBER,
  isPinned: DataTypes.NUMBER,
  log_path: DataTypes.STRING,
+  queued_token: DataTypes.STRING,
  labels: DataTypes.JSON,
  last_running_time: DataTypes.NUMBER,
  last_execution_time: DataTypes.NUMBER,
@@ -84,4 +92,7 @@ export const CrontabModel = sequelize.define<CronInstance>('Crontab', {
  extra_schedules: DataTypes.JSON,
  task_before: DataTypes.STRING,
  task_after: DataTypes.STRING,
+  log_name: DataTypes.STRING,
+  allow_multiple_instances: DataTypes.NUMBER,
+  work_dir: DataTypes.STRING,
 });
@@ -0,0 +1,71 @@
+import { DataTypes, Model } from 'sequelize';
+import { sequelize } from '.';
+
+export class CrontabStat {
+  id?: number;
+  ref_id!: number;
+  date!: string;
+  run_count?: number;
+  success_count?: number;
+  fail_count?: number;
+  total_time?: number;
+  max_time?: number;
+
+  constructor(options: CrontabStat) {
+    this.id = options.id;
+    this.ref_id = options.ref_id;
+    this.date = options.date;
+    this.run_count = options.run_count || 0;
+    this.success_count = options.success_count || 0;
+    this.fail_count = options.fail_count || 0;
+    this.total_time = options.total_time || 0;
+    this.max_time = options.max_time || 0;
+  }
+}
+
+export interface CrontabStatInstance extends Model<CrontabStat, CrontabStat>, CrontabStat {}
+
+export const CrontabStatModel = sequelize.define<CrontabStatInstance>(
+  'CrontabStat',
+  {
+    id: {
+      type: DataTypes.INTEGER,
+      primaryKey: true,
+      autoIncrement: true,
+    },
+    ref_id: {
+      type: DataTypes.NUMBER,
+      allowNull: false,
+    },
+    date: {
+      type: DataTypes.STRING,
+      allowNull: false,
+    },
+    run_count: {
+      type: DataTypes.NUMBER,
+      defaultValue: 0,
+    },
+    success_count: {
+      type: DataTypes.NUMBER,
+      defaultValue: 0,
+    },
+    fail_count: {
+      type: DataTypes.NUMBER,
+      defaultValue: 0,
+    },
+    total_time: {
+      type: DataTypes.NUMBER,
+      defaultValue: 0,
+    },
+    max_time: {
+      type: DataTypes.NUMBER,
+      defaultValue: 0,
+    },
+  },
+  {
+    indexes: [
+      { unique: true, fields: ['ref_id', 'date'] },
+      { fields: ['date'] },
+    ],
+  },
+);
@@ -41,30 +41,12 @@ export enum DependenceTypes {
  'linux',
 }

-export enum InstallDependenceCommandTypes {
-  'pnpm add -g',
-  'pip3 install --disable-pip-version-check --root-user-action=ignore',
-  'apk add --no-check-certificate',
-}
-
-export enum GetDependenceCommandTypes {
-  'pnpm ls -g ',
-  'pip3 show --disable-pip-version-check',
-  'apk info -es',
-}
-
 export enum versionDependenceCommandTypes {
  '@',
  '==',
  '=',
 }

-export enum unInstallDependenceCommandTypes {
-  'pnpm remove -g',
-  'pip3 uninstall --disable-pip-version-check --root-user-action=ignore -y',
-  'apk del',
-}
-
 export interface DependenceInstance
  extends Model<Dependence, Dependence>,
    Dependence {}
@@ -1,5 +1,5 @@
+import { DataTypes, Model } from 'sequelize';
 import { sequelize } from '.';
-import { DataTypes, Model, ModelDefined } from 'sequelize';

 export class Env {
  value?: string;
@@ -9,6 +9,8 @@ export class Env {
  position?: number;
  name?: string;
  remarks?: string;
+  isPinned?: 1 | 0;
+  labels?: string[];

  constructor(options: Env) {
    this.value = options.value;
@@ -21,6 +23,8 @@ export class Env {
    this.position = options.position;
    this.name = options.name;
    this.remarks = options.remarks || '';
+    this.isPinned = options.isPinned || 0;
+    this.labels = options.labels || [];
  }
 }

@@ -42,4 +46,6 @@ export const EnvModel = sequelize.define<EnvInstance>('Env', {
  position: DataTypes.NUMBER,
  name: { type: DataTypes.STRING, unique: 'compositeIndex' },
  remarks: DataTypes.STRING,
+  isPinned: DataTypes.NUMBER,
+  labels: DataTypes.JSON,
 });
@@ -1,5 +1,3 @@
-import { IncomingHttpHeaders } from 'http';
-
 export enum NotificationMode {
  'gotify' = 'gotify',
  'goCqHttpBot' = 'goCqHttpBot',
@@ -22,6 +20,8 @@ export enum NotificationMode {
  'chronocat' = 'Chronocat',
  'ntfy' = 'ntfy',
  'wxPusherBot' = 'wxPusherBot',
+  'openiLink' = 'openiLink',
+  'wpush' = 'wpush',
 }

 abstract class NotificationBaseInfo {
@@ -117,6 +117,7 @@ export class EmailNotification extends NotificationBaseInfo {
  public emailService: string = '';
  public emailUser: string = '';
  public emailPass: string = '';
+  public emailTo: string = '';
 }

 export class PushMeNotification extends NotificationBaseInfo {
@@ -143,12 +144,17 @@ export class WebhookNotification extends NotificationBaseInfo {

 export class LarkNotification extends NotificationBaseInfo {
  public larkKey = '';
+  public larkSecret = '';
 }

 export class NtfyNotification extends NotificationBaseInfo {
  public ntfyUrl = '';
  public ntfyTopic = '';
  public ntfyPriority = '';
+  public ntfyToken = '';
+  public ntfyUsername = '';
+  public ntfyPassword = '';
+  public ntfyActions = '';
 }

 export class WxPusherBotNotification extends NotificationBaseInfo {
@@ -157,6 +163,22 @@ export class WxPusherBotNotification extends NotificationBaseInfo {
  public wxPusherBotUids = '';
 }

+export class WxPusherSptNotification extends NotificationBaseInfo {
+  public wxPusherSptList = '';
+}
+
+export class OpeniLinkNotification extends NotificationBaseInfo {
+  public openiLinkAppToken = '';
+  public openiLinkHubUrl = '';
+  public openiLinkContextToken = '';
+}
+
+export class WpushNotification extends NotificationBaseInfo {
+  public wpushApiKey = '';
+  public wpushChannel = '';
+  public wpushTopicCode = '';
+}
+
 export interface NotificationInfo
  extends GoCqHttpBotNotification,
    GotifyNotification,
@@ -178,4 +200,7 @@ export interface NotificationInfo
    ChronocatNotification,
    LarkNotification,
    NtfyNotification,
-    WxPusherBotNotification {}
+    WxPusherBotNotification,
+    WxPusherSptNotification,
+    OpeniLinkNotification,
+    WpushNotification {}
@@ -24,7 +24,7 @@ export interface AppToken {
  expiration: number;
 }

-export type AppScope = 'envs' | 'crons' | 'configs' | 'scripts' | 'logs' | 'system';
+export type AppScope = 'envs' | 'crons' | 'configs' | 'scripts' | 'logs' | 'system' | 'dashboard';

 export interface AppInstance extends Model<App, App>, App {}
 export const AppModel = sequelize.define<AppInstance>('App', {
@@ -0,0 +1,81 @@
+import { sequelize } from '.';
+import { DataTypes, Model } from 'sequelize';
+
+export enum InstanceStatus {
+  'running' = 0,
+  'finished' = 1,
+  'stopped' = 2,
+  'error' = 3,
+}
+
+export interface RunningInstanceAttributes {
+  id?: number;
+  cron_id: number;
+  pid?: number;
+  log_path?: string;
+  started_at: number;
+  finished_at?: number;
+  status: InstanceStatus;
+  exit_code?: number;
+}
+
+export class RunningInstance {
+  id?: number;
+  cron_id!: number;
+  pid?: number;
+  log_path?: string;
+  started_at!: number;
+  finished_at?: number;
+  status!: InstanceStatus;
+  exit_code?: number;
+
+  constructor(options: RunningInstanceAttributes) {
+    this.id = options.id;
+    this.cron_id = options.cron_id;
+    this.pid = options.pid;
+    this.log_path = options.log_path;
+    this.started_at = options.started_at;
+    this.finished_at = options.finished_at;
+    this.status = options.status;
+    this.exit_code = options.exit_code;
+  }
+}
+
+export interface RunningInstanceModel
+  extends Model<RunningInstanceAttributes, RunningInstanceAttributes>,
+    RunningInstanceAttributes {}
+
+export const RunningInstanceModel = sequelize.define<RunningInstanceModel>(
+  'RunningInstance',
+  {
+    cron_id: {
+      type: DataTypes.NUMBER,
+      allowNull: false,
+    },
+    pid: {
+      type: DataTypes.NUMBER,
+      allowNull: true,
+    },
+    log_path: {
+      type: DataTypes.STRING,
+      allowNull: true,
+    },
+    started_at: {
+      type: DataTypes.NUMBER,
+      allowNull: false,
+    },
+    finished_at: {
+      type: DataTypes.NUMBER,
+      allowNull: true,
+    },
+    status: {
+      type: DataTypes.NUMBER,
+      allowNull: false,
+      defaultValue: InstanceStatus.running,
+    },
+    exit_code: {
+      type: DataTypes.NUMBER,
+      allowNull: true,
+    },
+  },
+);
@@ -2,11 +2,13 @@ export class SockMessage {
  message?: string;
  type?: SockMessageType;
  references?: number[];
+  status?: number | string;

  constructor(options: SockMessage) {
    this.type = options.type;
    this.message = options.message;
    this.references = options.references;
+    this.status = options.status;
  }
 }

@@ -20,7 +20,7 @@ export class Subscription {
  pull_option?:
    | { private_key: string }
    | { username: string; password: string };
-  pid?: number;
+  pid?: number | null;
  is_disabled?: 1 | 0;
  log_path?: string;
  alias: string;
@@ -28,9 +28,15 @@ export enum AuthDataType {
  'removeLogFrequency' = 'removeLogFrequency',
  'systemConfig' = 'systemConfig',
  'authConfig' = 'authConfig',
+  'notifyLog' = 'notifyLog',
 }

+export const NotifyStatus = LoginStatus;
+export type NotifyStatus = LoginStatus;
+
 export interface SystemConfigInfo {
+  lang?: string;
+  panelTitle?: string;
  logRemoveFrequency?: number;
  cronConcurrency?: number;
  dependenceProxy?: string;
@@ -38,6 +44,9 @@ export interface SystemConfigInfo {
  pythonMirror?: string;
  linuxMirror?: string;
  timezone?: string;
+  globalSshKey?: string;
+  runningInstanceRetentionDays?: number;
+  cronStatRetentionDays?: number;
 }

 export interface LoginLogInfo {
@@ -48,6 +57,30 @@ export interface LoginLogInfo {
  status?: LoginStatus;
 }

+export interface NotifyLogInfo {
+  timestamp?: number;
+  title?: string;
+  content?: string;
+  status?: NotifyStatus;
+  notifyType?: string;
+  source?: 'system' | 'script';
+  scriptName?: string;
+  taskId?: string;
+}
+
+export interface TokenInfo {
+  value: string;
+  timestamp: number;
+  ip: string;
+  address: string;
+  platform: string;
+  /**
+   * Token expiration time in seconds since Unix epoch.
+   * If undefined, the token uses JWT's built-in expiration.
+   */
+  expiration?: number;
+}
+
 export interface AuthInfo {
  username: string;
  password: string;
@@ -57,16 +90,20 @@ export interface AuthInfo {
  lastaddr: string;
  platform: string;
  isTwoFactorChecking: boolean;
+  twoFactorExpiresAt?: number;
+  lastTwoFactorStep?: number;
  token: string;
-  tokens: Record<string, string>;
+  tokens: Record<string, string | TokenInfo[]>;
  twoFactorActivated: boolean;
  twoFactorSecret: string;
  avatar: string;
+  blockedIps?: string[];
 }

 export type SystemModelInfo = SystemConfigInfo &
  Partial<NotificationInfo> &
  LoginLogInfo &
+  Partial<NotifyLogInfo> &
  Partial<AuthInfo>;

 export interface SystemInstance
@@ -1,7 +0,0 @@
-declare namespace Express {
-  interface Request {
-    platform: 'desktop' | 'mobile';
-  }
-}
-
-declare module 'pstree.remy';
@@ -5,25 +5,26 @@ import initData from './initData';
 import { Application } from 'express';
 import linkDeps from './deps';
 import initTask from './initTask';
+import initFile from './initFile';
+import { initializeTrustProxy } from '../shared/trustProxy';

-export default async ({ expressApp }: { expressApp: Application }) => {
+export default async ({ app }: { app: Application }) => {
  depInjectorLoader();
-  Logger.info('✌️ Dependency loaded');
-  console.log('✌️ Dependency loaded');
-
-  await initData();
-  Logger.info('✌️ Init data loaded');
-  console.log('✌️ Init data loaded');
+  Logger.info('[boot] Dependency loaded');

  await linkDeps();
-  Logger.info('✌️ Link deps loaded');
-  console.log('✌️ Link deps loaded');
+  Logger.info('[boot] Link deps loaded');
+
+  await initFile();
+  Logger.info('[boot] Init file loaded');
+
+  await initData();
+  Logger.info('[boot] Init data loaded');

  initTask();
-  Logger.info('✌️ Init task loaded');
-  console.log('✌️ Init task loaded');
+  Logger.info('[boot] Init task loaded');

-  expressLoader({ app: expressApp });
-  Logger.info('✌️ Express loaded');
-  console.log('✌️ Express loaded');
+  expressLoader({ app });
+  await initializeTrustProxy(app);
+  Logger.info('[boot] Express loaded');
 };
@@ -6,7 +6,10 @@ import { AppModel } from '../data/open';
 import { SystemModel } from '../data/system';
 import { SubscriptionModel } from '../data/subscription';
 import { CrontabViewModel } from '../data/cronView';
+import { CrontabStatModel } from '../data/cronStats';
+import { RunningInstanceModel } from '../data/runningInstance';
 import { sequelize } from '../data';
+import { migrateSchema } from '../shared/schemaMigrations';

 export default async () => {
  try {
@@ -17,50 +20,14 @@ export default async () => {
    await EnvModel.sync();
    await SubscriptionModel.sync();
    await CrontabViewModel.sync();
+    await CrontabStatModel.sync();
+    await RunningInstanceModel.sync();

-    // 初始化新增字段
-    try {
-      await sequelize.query(
-        'alter table CrontabViews add column filterRelation VARCHAR(255)',
-      );
-    } catch (error) {}
-    try {
-      await sequelize.query(
-        'alter table Subscriptions add column proxy VARCHAR(255)',
-      );
-    } catch (error) {}
-    try {
-      await sequelize.query('alter table CrontabViews add column type NUMBER');
-    } catch (error) {}
-    try {
-      await sequelize.query(
-        'alter table Subscriptions add column autoAddCron NUMBER',
-      );
-    } catch (error) {}
-    try {
-      await sequelize.query(
-        'alter table Subscriptions add column autoDelCron NUMBER',
-      );
-    } catch (error) {}
-    try {
-      await sequelize.query('alter table Crontabs add column sub_id NUMBER');
-    } catch (error) {}
-    try {
-      await sequelize.query(
-        'alter table Crontabs add column extra_schedules JSON',
-      );
-    } catch (error) {}
-    try {
-      await sequelize.query('alter table Crontabs add column task_before TEXT');
-    } catch (error) {}
-    try {
-      await sequelize.query('alter table Crontabs add column task_after TEXT');
-    } catch (error) {}
+    await migrateSchema(sequelize);

-    console.log('✌️ DB loaded');
-    Logger.info('✌️ DB loaded');
+    Logger.info('[boot] DB loaded');
  } catch (error) {
-    console.error('✌️ DB load failed');
-    Logger.error(error);
+    Logger.error('[boot] DB load failed', error);
+    throw error;
  }
 };
@@ -1,24 +1,66 @@
 import path from 'path';
 import fs from 'fs/promises';
-import chokidar from 'chokidar';
+import os from 'os';
 import config from '../config/index';
-import { fileExist, promiseExec, rmPath } from '../config/util';
-
-async function linkToNodeModule(src: string, dst?: string) {
-  const target = path.join(config.rootPath, 'node_modules', dst || src);
-  const source = path.join(config.rootPath, src);
-
-  try {
-    const stats = await fs.lstat(target);
-    if (!stats) {
-      await fs.symlink(source, target, 'dir');
-    }
-  } catch (error) {}
-}
+import Logger from './logger';

 async function linkCommand() {
-  const commandPath = await promiseExec('which node');
-  const commandDir = path.dirname(commandPath);
+  const homeDir = os.homedir();
+  let userBinDir = path.join(homeDir, 'bin');
+
+  try {
+    await fs.mkdir(userBinDir, { recursive: true });
+    await linkCommandToDir(userBinDir);
+  } catch (error) {
+    Logger.error('Linking command failed:', error);
+  }
+}
+
+async function linkCommandToDir(commandDir: string) {
+  const cliRoot = process.env.QL_CLI_ROOT;
+  if (cliRoot) {
+    if (!path.isAbsolute(cliRoot)) {
+      throw new Error('QL_CLI_ROOT must be an absolute CLI installation path');
+    }
+    const { installCliEntrypoints } = require(path.join(
+      cliRoot,
+      'dist/local/entrypoints.js',
+    ));
+    await installCliEntrypoints(commandDir, cliRoot);
+    const { installCronEntrypoint } = require(path.join(
+      cliRoot,
+      'dist/local/cronEntrypoint.js',
+    ));
+    await installCronEntrypoint(commandDir, cliRoot, config.crontabFile, {
+      ...process.env,
+      QL_DIR: config.rootPath,
+      QL_DATA_DIR: config.dataPath,
+    });
+    // Container-wide legacy links may precede ~/bin. Ensure panel children use
+    // the explicitly selected entries without changing system-wide links.
+    process.env.PATH = [
+      commandDir,
+      ...(process.env.PATH?.split(path.delimiter) ?? []).filter(
+        (entry) => entry !== commandDir,
+      ),
+    ].join(path.delimiter);
+    return;
+  }
+
+  const cronBridge = path.join(commandDir, 'crontab');
+  try {
+    if (
+      (await fs.lstat(cronBridge)).isFile() &&
+      (await fs.readFile(cronBridge, 'utf8')).includes(
+        '// QingLong CLI crontab bridge',
+      )
+    ) {
+      await fs.unlink(cronBridge);
+    }
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+  }
+
  const linkShell = [
    {
      src: 'update.sh',
@@ -36,22 +78,18 @@ async function linkCommand() {
    const source = path.join(config.rootPath, 'shell', link.src);
    const target = path.join(commandDir, link.dest);
    const tmpTarget = path.join(commandDir, link.tmp);
+    try {
+      const stats = await fs.lstat(tmpTarget);
+      if (stats) {
+        await fs.unlink(tmpTarget);
+      }
+    } catch (error) {}
+
    await fs.symlink(source, tmpTarget);
    await fs.rename(tmpTarget, target);
  }
 }

-export default async (src: string = 'deps') => {
+export default async () => {
  await linkCommand();
-  await linkToNodeModule(src);
-
-  const source = path.join(config.rootPath, src);
-  const watcher = chokidar.watch(source, {
-    ignored: /(^|[\/\\])\../, // ignore dotfiles
-    persistent: true,
-  });
-
-  watcher
-    .on('add', (path) => linkToNodeModule(src))
-    .on('change', (path) => linkToNodeModule(src));
 };
@@ -6,37 +6,82 @@ import config from '../config';
 import { UnauthorizedError, expressjwt } from 'express-jwt';
 import { getPlatform, getToken } from '../config/util';
 import rewrite from 'express-urlrewrite';
-import { errors } from 'celebrate';
-import { createProxyMiddleware } from 'http-proxy-middleware';
+import validationErrors from '../middlewares/validationErrors';
 import { serveEnv } from '../config/serverEnv';
-import Logger from './logger';
-import { IKeyvStore, shareStore } from '../shared/store';
+import { shareStore } from '../shared/store';
+import { isValidToken, isDefaultAuthInfo } from '../shared/auth';
+import { AuthInfo } from '../data/system';
+import path from 'path';
+import { t } from '../shared/i18n';
+import { AppScope } from '../data/open';
+import uniqueConstraintError from '../middlewares/uniqueConstraintError';
+import protectedPathCase from '../middlewares/protectedPathCase';
+
+function resolveTrustProxy(value = process.env.QL_TRUST_PROXY) {
+  const setting = value?.trim();
+  if (!setting) {
+    return 'loopback';
+  }
+  if (setting === 'true' || setting === 'false') {
+    return setting === 'true';
+  }
+  if (/^\d+$/.test(setting)) {
+    return Number(setting);
+  }
+  return setting;
+}

 export default ({ app }: { app: Application }) => {
-  app.set('trust proxy', 'loopback');
+  // Security: Enable strict routing to prevent case-insensitive path bypass
+  app.set('case sensitive routing', true);
+  app.set('strict routing', true);
+  app.set('trust proxy', resolveTrustProxy());
  app.use(cors());
-  app.get(`${config.api.prefix}/env.js`, serveEnv);
-  app.use(`${config.api.prefix}/static`, express.static(config.uploadPath));

+  // Security: Reject case variations under protected API namespaces before
+  // authentication checks can interpret the request differently from routing.
+  app.use(protectedPathCase);
+
+  // Rewrite URLs to strip baseUrl prefix if configured
+  // This allows the rest of the app to work without baseUrl awareness
+  if (config.baseUrl) {
+    app.use(rewrite(`${config.baseUrl}/*`, '/$1'));
+  }
+
+  app.get(`${config.api.prefix}/env.js`, serveEnv);
  app.use(
-    '/api/public',
-    createProxyMiddleware({
-      target: `http://0.0.0.0:${config.publicPort}/api`,
-      changeOrigin: true,
-      pathRewrite: { '/api/public': '' },
-      logger: Logger,
+    `${config.api.prefix}/static`,
+    express.static(config.uploadPath, {
+      setHeaders: (res) => {
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+        res.setHeader('Content-Security-Policy', "sandbox; default-src 'none'");
+      },
    }),
  );

+  const credentialPaths = ['/api', '/open'].flatMap((prefix) =>
+    ['/user/login', '/user/init', '/user/two-factor/login'].map(
+      (route) => `${prefix}${route}`,
+    ),
+  );
+  app.use(
+    credentialPaths,
+    bodyParser.json({ limit: '16kb' }),
+    bodyParser.urlencoded({ limit: '16kb', extended: false }),
+  );
+
  app.use(bodyParser.json({ limit: '50mb' }));
  app.use(bodyParser.urlencoded({ limit: '50mb', extended: true }));

+  const frontendPath = path.join(config.rootPath, 'static/dist');
+  app.use(express.static(frontendPath));
+
  app.use(
    expressjwt({
-      secret: config.secret,
+      secret: config.jwt.secret,
      algorithms: ['HS384'],
    }).unless({
-      path: [...config.apiWhiteList, /^\/open\//],
+      path: [...config.apiWhiteList, /^(\/(?!api\/).*)$/i],
    }),
  );

@@ -50,28 +95,45 @@ export default ({ app }: { app: Application }) => {
    return next();
  });

-  app.use(async (req, res, next) => {
+  app.use(async (req: Request, res, next) => {
+    const pathLower = req.path.toLowerCase();
+    if (!['/open/', '/api/'].some((x) => pathLower.startsWith(x))) {
+      return next();
+    }
+
    const headerToken = getToken(req);
-    if (req.path.startsWith('/open/')) {
+    if (pathLower.startsWith('/open/')) {
      const apps = await shareStore.getApps();
      const doc = apps?.filter((x) =>
        x.tokens?.find((y) => y.value === headerToken),
      )?.[0];
      if (doc && doc.tokens && doc.tokens.length > 0) {
        const currentToken = doc.tokens.find((x) => x.value === headerToken);
-        const keyMatch = req.path.match(/\/open\/([a-z]+)\/*/);
+        const keyMatch = pathLower.match(/\/open\/([a-z]+)\/*/);
        const key = keyMatch && keyMatch[1];
-        if (
-          doc.scopes.includes(key as any) &&
-          currentToken &&
-          currentToken.expiration >= Math.round(Date.now() / 1000)
-        ) {
-          return next();
+
+        if (!doc.scopes.includes(key as AppScope)) {
+          const err = new UnauthorizedError('credentials_bad_scheme', {
+            message: t('暂无权限'),
+          });
+          return next(err);
        }
+
+        if (
+          !currentToken ||
+          currentToken.expiration < Math.round(Date.now() / 1000)
+        ) {
+          const err = new UnauthorizedError('invalid_token', {
+            message: t('Token 已失效'),
+          });
+          return next(err);
+        }
+
+        return next();
      }
    }

-    const originPath = `${req.baseUrl}${req.path === '/' ? '' : req.path}`;
+    const originPath = `${req.baseUrl}${pathLower === '/' ? '' : pathLower}`;
    if (
      !headerToken &&
      originPath &&
@@ -81,39 +143,34 @@ export default ({ app }: { app: Application }) => {
    }

    const authInfo = await shareStore.getAuthInfo();
-    if (authInfo && headerToken) {
-      const { token = '', tokens = {} } = authInfo;
-      if (headerToken === token || tokens[req.platform] === headerToken) {
-        return next();
-      }
+    if (isValidToken(authInfo, headerToken, req.platform, config.jwt.secret)) {
+      return next();
    }

    const errorCode = headerToken ? 'invalid_token' : 'credentials_required';
-    const errorMessage = headerToken
-      ? 'jwt malformed'
-      : 'No authorization token was found';
+    const errorMessage = headerToken ? t('Token 已失效') : t('请先登录');
    const err = new UnauthorizedError(errorCode, { message: errorMessage });
    next(err);
  });

  app.use(async (req, res, next) => {
-    if (!['/api/user/init', '/api/user/notification/init'].includes(req.path)) {
+    const pathLower = req.path.toLowerCase();
+    if (
+      ![
+        '/api/user/init',
+        '/api/user/notification/init',
+        '/open/user/init',
+        '/open/user/notification/init',
+      ].includes(pathLower)
+    ) {
      return next();
    }
-    const authInfo =
-      (await shareStore.getAuthInfo()) || ({} as IKeyvStore['authInfo']);
+    const authInfo = (await shareStore.getAuthInfo()) || ({} as AuthInfo);

-    let isInitialized = true;
-    if (
-      Object.keys(authInfo).length === 2 &&
-      authInfo.username === 'admin' &&
-      authInfo.password === 'admin'
-    ) {
-      isInitialized = false;
-    }
+    let isInitialized = !isDefaultAuthInfo(authInfo);

    if (isInitialized) {
-      return res.send({ code: 450, message: '未知错误' });
+      return res.send({ code: 450, message: t('未知错误') });
    } else {
      return next();
    }
@@ -122,13 +179,26 @@ export default ({ app }: { app: Application }) => {
  app.use(rewrite('/open/*', '/api/$1'));
  app.use(config.api.prefix, routes());

-  app.use((req, res, next) => {
-    const err: any = new Error('Not Found');
-    err['status'] = 404;
-    next(err);
+  app.get('*', (req, res, next) => {
+    // Don't serve index.html for API routes
+    if (
+      req.path === config.api.prefix ||
+      req.path.startsWith(`${config.api.prefix}/`)
+    ) {
+      return res.status(404).json({ code: 404, message: 'Not Found' });
+    }
+    const indexPath = path.join(frontendPath, 'index.html');
+    res.sendFile(indexPath, (err) => {
+      if (err) {
+        const err: any = new Error('Not Found');
+        err['status'] = 404;
+        next(err);
+      }
+    });
  });

-  app.use(errors());
+  app.use(validationErrors);
+  app.use(uniqueConstraintError);

  app.use(
    (
@@ -0,0 +1,33 @@
+import type express from 'express';
+import config from '../config';
+
+export async function createHttpApplication(): Promise<express.Application> {
+  // Only the HTTP worker needs an Express application and its middleware.
+  const [
+    { default: createExpress },
+    { default: helmet },
+    { default: cors },
+    { default: compression },
+    { monitoringMiddleware },
+  ] = await Promise.all([
+    import('express'),
+    import('helmet'),
+    import('cors'),
+    import('compression'),
+    import('../middlewares/monitoring'),
+  ]);
+  const app = createExpress();
+  app.use((req, res, next) => {
+    if (req.query.t) delete req.query.t;
+    next();
+  });
+  app.use(
+    helmet({
+      contentSecurityPolicy: false,
+    }),
+  );
+  app.use(cors(config.cors));
+  app.use(compression());
+  app.use(monitoringMiddleware);
+  return app;
+}
@@ -13,11 +13,13 @@ import { AuthDataType, SystemModel } from '../data/system';
 import SystemService from '../services/system';
 import UserService from '../services/user';
 import { writeFile, readFile } from 'fs/promises';
-import { createRandomString, safeJSONParse } from '../config/util';
+import { fileExist, isDemoEnv, safeJSONParse } from '../config/util';
 import OpenService from '../services/open';
 import { shareStore } from '../shared/store';
 import Logger from './logger';
-import { AppModel } from '../data/open';
+import cronClient from '../schedule/client';
+import { InstanceStatus, RunningInstanceModel } from '../data/runningInstance';
+import { setLang, systemLang } from '../shared/i18n';

 export default async () => {
  const cronService = Container.get(CronService);
@@ -28,19 +30,7 @@ export default async () => {
  const openService = Container.get(OpenService);

  // 初始化增加系统配置
-  let systemApp = (
-    await AppModel.findOne({
-      where: { name: 'system' },
-    })
-  )?.get({ plain: true });
-  if (!systemApp) {
-    systemApp = await AppModel.create({
-      name: 'system',
-      scopes: ['crons', 'system'],
-      client_id: createRandomString(12, 12),
-      client_secret: createRandomString(24, 24),
-    });
-  }
+  await openService.initializeSystemApp();
  const [systemConfig] = await SystemModel.findOrCreate({
    where: { type: AuthDataType.systemConfig },
  });
@@ -50,14 +40,17 @@ export default async () => {
  const [authConfig] = await SystemModel.findOrCreate({
    where: { type: AuthDataType.authConfig },
  });
-  if (!authConfig?.info) {
+  if (!authConfig?.info || isDemoEnv()) {
    let authInfo = {
      username: 'admin',
      password: 'admin',
    };
    try {
-      const content = await readFile(config.authConfigFile, 'utf8');
-      authInfo = safeJSONParse(content);
+      const authFileExist = await fileExist(config.authConfigFile);
+      if (authFileExist) {
+        const content = await readFile(config.authConfigFile, 'utf8');
+        authInfo = safeJSONParse(content);
+      }
    } catch (error) {
      Logger.warn('Failed to read auth config file, using default credentials');
    }
@@ -68,24 +61,27 @@ export default async () => {
    });
  }

-  const installDependencies = () => {
-    // 初始化时安装所有处于安装中，安装成功，安装失败的依赖
-    DependenceModel.findAll({
+  const installDependencies = async () => {
+    const docs = await DependenceModel.findAll({
      where: {},
      order: [
        ['type', 'DESC'],
        ['createdAt', 'DESC'],
      ],
      raw: true,
-    }).then(async (docs) => {
-      await DependenceModel.update(
-        { status: DependenceStatus.queued, log: [] },
-        { where: { id: docs.map((x) => x.id!) } },
-      );
-      setTimeout(() => {
-        dependenceService.installDependenceOneByOne(docs);
-      }, 5000);
    });
+
+    await DependenceModel.update(
+      { status: DependenceStatus.queued, log: [] },
+      { where: { id: docs.map((x) => x.id!) } },
+    );
+
+    setTimeout(async () => {
+      await dependenceService.installDependenceOneByOne(docs);
+
+      const bootAfterLoader = await import('./bootAfter');
+      bootAfterLoader.default();
+    }, 5000);
  };

  // 初始化更新 linux/python/nodejs 镜像源配置
@@ -128,6 +124,16 @@ export default async () => {
  // 初始化更新所有任务状态为空闲
  await CrontabModel.update({ status: CrontabStatus.idle }, { where: {} });

+  // 清空所有运行中的实例记录（服务重启后进程已不存在）
+  await RunningInstanceModel.update(
+    {
+      status: InstanceStatus.stopped,
+      finished_at: Math.floor(Date.now() / 1000),
+      // The previous process's exit code cannot be recovered after a restart.
+    },
+    { where: { status: InstanceStatus.running } },
+  );
+
  // 初始化时执行一次所有的 ql repo 任务
  CrontabModel.findAll({
    where: {
@@ -204,14 +210,28 @@ export default async () => {
    }
  });

+  // 初始化语言（必须在 autosave_crontab 之前）
+  const lang = systemConfig.info?.lang || systemLang();
+  setLang(lang);
+
+  // 确保 lang_env.sh 存在
+  try {
+    const langEnvExist = await fileExist(config.langEnvFile);
+    if (!langEnvExist) {
+      await writeFile(config.langEnvFile, `export QL_LANG='${lang}'\n`);
+    }
+  } catch { }
+
  // 初始化保存一次ck和定时任务数据
-  await cronService.autosave_crontab();
+  cronClient.readiness.configure(async () => {
+    await cronService.autosave_crontab(true);
+    await systemService.restoreCronConcurrency();
+  });
+  await cronClient.readiness.recover();
+
  await envService.set_envs();

  const authInfo = await userService.getAuthInfo();
-  const apps = await openService.findApps();
  await shareStore.updateAuthInfo(authInfo);
-  if (apps?.length) {
-    await shareStore.updateApps(apps);
-  }
+  await openService.refreshApps();
 };
@@ -20,6 +20,7 @@ const uploadPath = path.join(dataPath, 'upload/');
 const bakPath = path.join(dataPath, 'bak/');
 const samplePath = path.join(rootPath, 'sample/');
 const tmpPath = path.join(logPath, '.tmp/');
+const rootTmpPath = path.join(rootPath, '.tmp/');
 const confFile = path.join(configPath, 'config.sh');
 const sampleConfigFile = path.join(samplePath, 'config.sample.sh');
 const sampleTaskShellFile = path.join(samplePath, 'task.sample.sh');
@@ -44,6 +45,7 @@ const directories = [
  preloadPath,
  logPath,
  tmpPath,
+  rootTmpPath,
  uploadPath,
  sshPath,
  bakPath,
@@ -116,11 +118,12 @@ export default async () => {
          `Neither content nor source specified for ${item.target}`,
        );
      }
-      const content = item.content || (await fs.readFile(item.source!));
+      const content =
+        item.content ||
+        (await fs.readFile(item.source!, { encoding: 'utf-8' }));
      await writeFileWithLock(item.target, content);
    }
  }

-  Logger.info('✌️ Init file down');
-  console.log('✌️ Init file down');
+  Logger.info('[boot] Init file down');
 };
@@ -2,14 +2,19 @@ import { Container } from 'typedi';
 import SystemService from '../services/system';
 import ScheduleService, { ScheduleTaskType } from '../services/schedule';
 import SubscriptionService from '../services/subscription';
+import SshKeyService from '../services/sshKey';
 import config from '../config';
 import { fileExist } from '../config/util';
 import { join } from 'path';
+import { t } from '../shared/i18n';
+import Logger from './logger';
+import { assertSubscriptionAlias } from '../shared/subscriptionPath';

 export default async () => {
  const systemService = Container.get(SystemService);
  const scheduleService = Container.get(ScheduleService);
  const subscriptionService = Container.get(SubscriptionService);
+  const sshKeyService = Container.get(SshKeyService);

  // 生成内置token
  let tokenCommand = `ts-node-transpile-only ${join(
@@ -21,9 +26,10 @@ export default async () => {
  if (await fileExist(tokenFile)) {
    tokenCommand = `node ${tokenFile}`;
  }
+  tokenCommand += ' --renew';
  const cron = {
    id: NaN,
-    name: '生成token',
+    name: t('生成token'),
    command: tokenCommand,
    runOrigin: 'system',
  } as ScheduleTaskType;
@@ -42,7 +48,7 @@ export default async () => {
    if (data.info.logRemoveFrequency) {
      const rmlogCron = {
        id: data.id as number,
-        name: '删除日志',
+        name: t('删除日志'),
        command: `ql rmlog ${data.info.logRemoveFrequency}`,
        runOrigin: 'system' as const,
      };
@@ -57,11 +63,22 @@ export default async () => {
    }

    systemService.updateTimezone(data.info);
+
+    // Apply global SSH key if configured
+    if (data.info.globalSshKey) {
+      await sshKeyService.addGlobalSSHKey(data.info.globalSshKey, 'global');
+    }
  }

  await subscriptionService.setSshConfig();
  const subs = await subscriptionService.list();
  for (const sub of subs) {
-    subscriptionService.handleTask(sub.get({ plain: true }), !sub.is_disabled);
+    try {
+      const doc = sub.get({ plain: true });
+      assertSubscriptionAlias(doc.alias);
+      await subscriptionService.handleTask(doc, !sub.is_disabled);
+    } catch (error) {
+      Logger.warn(t('跳过订阅 %s 的无效定时配置: %s'), sub.id, error);
+    }
  }
 };
@@ -4,35 +4,60 @@ import config from '../config';
 import path from 'path';

 const levelMap: Record<string, string> = {
-  info: '\ue6f5',
-  warn: '\ue880',
-  error: '\ue602',
-  debug: '\ue67f'
-}
-
-const customFormat = winston.format.combine(
-  winston.format.splat(),
-  winston.format.timestamp({ format: "YYYY-MM-DD HH:mm:ss" }),
-  winston.format.align(),
-  winston.format.printf((i) => `[${levelMap[i.level]}${i.level}] [${[i.timestamp]}]: ${i.message}`),
-);
-
-const defaultOptions = {
-  format: customFormat,
-  datePattern: "YYYY-MM-DD",
-  maxSize: "20m",
-  maxFiles: "7d",
+  info: 'ℹ️', // info图标
+  warn: '⚠️', // 警告图标
+  error: '❌', // 错误图标
+  debug: '🐛', // debug调试图标
 };

+const baseFormat = [
+  winston.format.splat(),
+  winston.format.timestamp({ format: 'YYYY-MM-DD HH:mm:ss' }),
+  winston.format.align(),
+];
+
+const consoleFormat = winston.format.combine(
+  winston.format.colorize({ level: true }),
+  ...baseFormat,
+  winston.format.printf((info) => {
+    return `[${info.level} ${info.timestamp}]:${info.message}`;
+  }),
+);
+
+const plainFormat = winston.format.combine(
+  winston.format.uncolorize(),
+  ...baseFormat,
+  winston.format.printf((info) => {
+    return `[${levelMap[info.level] || ''}${info.level} ${info.timestamp}]:${
+      info.message
+    }`;
+  }),
+);
+
+const consoleTransport = new winston.transports.Console({
+  format: consoleFormat,
+  level: 'debug',
+});
+
+const fileTransport = new winston.transports.DailyRotateFile({
+  filename: path.join(config.systemLogPath, '%DATE%.log'),
+  datePattern: 'YYYY-MM-DD',
+  maxSize: '20m',
+  maxFiles: '7d',
+  format: plainFormat,
+  level: config.logs.level || 'info',
+});
+
 const LoggerInstance = winston.createLogger({
-  level: config.logs.level,
+  level: 'debug',
  levels: winston.config.npm.levels,
-  transports: [
-    new winston.transports.DailyRotateFile({
-      filename: path.join(config.systemLogPath, '%DATE%.log'),
-      ...defaultOptions,
-    })
-  ],
+  transports: [consoleTransport, fileTransport],
+  exceptionHandlers: [consoleTransport, fileTransport],
+  rejectionHandlers: [consoleTransport, fileTransport],
+});
+
+LoggerInstance.on('error', (error) => {
+  console.error('Logger error:', error);
 });

 export default LoggerInstance;
@@ -4,7 +4,7 @@ import Sock from './sock';

 export default async ({ server }: { server: Server }) => {
  await Sock({ server });
-  Logger.info('✌️ Sock loaded');
+  Logger.info('[boot] Sock loaded');

  process.on('uncaughtException', (error) => {
    Logger.error('Uncaught exception:', error);
@@ -1,37 +1,95 @@
-import sockJs from 'sockjs';
+import sockJs, { Connection } from 'sockjs';
 import { Server } from 'http';
 import { Container } from 'typedi';
 import SockService from '../services/sock';
 import { getPlatform } from '../config/util';
 import { shareStore } from '../shared/store';
+import { isValidToken } from '../shared/auth';
+import config from '../config';

 export default async ({ server }: { server: Server }) => {
-  const echo = sockJs.createServer({ prefix: '/api/ws', log: () => {} });
+  const echo = sockJs.createServer({
+    prefix: `${config.baseUrl}/api/ws`,
+    log: () => {},
+  });
  const sockService = Container.get(SockService);
+  const sessions = new Map<Connection, { token: string; platform: string }>();
+  let sessionTimer: ReturnType<typeof setInterval> | undefined;
+  let checking = false;
+
+  const checkSessions = async () => {
+    if (checking || sessions.size === 0) return;
+    checking = true;
+    // Connections accepted during this read must not use an older snapshot.
+    const batch = [...sessions];
+    try {
+      const current = await shareStore.getAuthInfo();
+      // Reuse validation only within this synchronous check of one auth snapshot.
+      const validated = new Map<string, Map<string, boolean>>();
+      for (const [conn, { token, platform }] of batch) {
+        if (!sessions.has(conn)) continue;
+        let platforms = validated.get(token);
+        if (!platforms) {
+          platforms = new Map();
+          validated.set(token, platforms);
+        }
+        let valid = platforms.get(platform);
+        if (valid === undefined) {
+          valid = isValidToken(current, token, platform, config.jwt.secret);
+          platforms.set(platform, valid);
+        }
+        if (!valid) conn.close('401');
+      }
+    } catch {
+      for (const [conn] of batch) {
+        if (sessions.has(conn)) conn.close('401');
+      }
+    } finally {
+      checking = false;
+    }
+  };

  echo.on('connection', async (conn) => {
    if (!conn.headers || !conn.url || !conn.pathname) {
      conn.close('404');
+      return;
    }

-    const authInfo = await shareStore.getAuthInfo();
+    let closed = false;
+    conn.on('close', () => {
+      closed = true;
+      sessions.delete(conn);
+      sockService.removeClient(conn);
+      if (sessions.size === 0 && sessionTimer) {
+        clearInterval(sessionTimer);
+        sessionTimer = undefined;
+      }
+    });
+
+    let authInfo;
+    try {
+      authInfo = await shareStore.getAuthInfo();
+    } catch {
+      if (!closed) conn.close('401');
+      return;
+    }
+    if (closed) return;
    const platform = getPlatform(conn.headers['user-agent'] || '') || 'desktop';
    const headerToken = conn.url.replace(`${conn.pathname}?token=`, '');
-    if (authInfo) {
-      const { token = '', tokens = {} } = authInfo;
-      if (headerToken === token || tokens[platform] === headerToken) {
-        sockService.addClient(conn);

-        conn.on('data', (message) => {
-          conn.write(message);
-        });
-
-        conn.on('close', function () {
-          sockService.removeClient(conn);
-        });
-
-        return;
+    if (isValidToken(authInfo, headerToken, platform, config.jwt.secret)) {
+      sockService.addClient(conn);
+      sessions.set(conn, { token: headerToken, platform });
+      if (!sessionTimer) {
+        sessionTimer = setInterval(checkSessions, 1000);
+        sessionTimer.unref();
      }
+
+      conn.on('data', (message) => {
+        conn.write(message);
+      });
+
+      return;
    }

    conn.close('404');
@@ -1,106 +0,0 @@
-import bodyParser from 'body-parser';
-import { errors } from 'celebrate';
-import cors from 'cors';
-import { Application, NextFunction, Request, Response } from 'express';
-import { expressjwt } from 'express-jwt';
-import Container from 'typedi';
-import config from '../config';
-import SystemService from '../services/system';
-import Logger from './logger';
-
-export default ({ app }: { app: Application }) => {
-  app.set('trust proxy', 'loopback');
-  app.use(cors());
-
-  app.use(bodyParser.json({ limit: '50mb' }));
-  app.use(bodyParser.urlencoded({ limit: '50mb', extended: true }));
-
-  app.use(
-    expressjwt({
-      secret: config.secret,
-      algorithms: ['HS384'],
-    }),
-  );
-
-  app.put(
-    '/api/reload',
-    async (req: Request, res: Response, next: NextFunction) => {
-      try {
-        const systemService = Container.get(SystemService);
-        const result = await systemService.reloadSystem();
-        res.send(result);
-      } catch (e) {
-        Logger.error('🔥 error: %o', e);
-        return next(e);
-      }
-    },
-  );
-
-  app.put(
-    '/api/system',
-    async (req: Request, res: Response, next: NextFunction) => {
-      try {
-        const systemService = Container.get(SystemService);
-        const result = await systemService.reloadSystem('system');
-        res.send(result);
-      } catch (e) {
-        Logger.error('🔥 error: %o', e);
-        return next(e);
-      }
-    },
-  );
-
-  app.put(
-    '/api/data',
-    async (req: Request, res: Response, next: NextFunction) => {
-      try {
-        const systemService = Container.get(SystemService);
-        const result = await systemService.reloadSystem('data');
-        res.send(result);
-      } catch (e) {
-        Logger.error('🔥 error: %o', e);
-        return next(e);
-      }
-    },
-  );
-
-  app.use((req, res, next) => {
-    const err: any = new Error('Not Found');
-    err['status'] = 404;
-    next(err);
-  });
-
-  app.use(errors());
-
-  app.use(
-    (
-      err: Error & { status: number },
-      req: Request,
-      res: Response,
-      next: NextFunction,
-    ) => {
-      if (err.name === 'UnauthorizedError') {
-        return res
-          .status(err.status)
-          .send({ code: 401, message: err.message })
-          .end();
-      }
-      return next(err);
-    },
-  );
-
-  app.use(
-    (
-      err: Error & { status: number },
-      req: Request,
-      res: Response,
-      next: NextFunction,
-    ) => {
-      res.status(err.status || 500);
-      res.json({
-        code: err.status || 500,
-        message: err.message,
-      });
-    },
-  );
-};
@@ -0,0 +1,48 @@
+import { Request, Response, NextFunction } from 'express';
+import Logger from '../loaders/logger';
+import { performance } from 'perf_hooks';
+import { metricsService } from '../services/metrics';
+
+const UNMONITORED_PATH_SUFFIXES = ['/api/health', '/open/health'];
+const HTTP_METRIC_SAMPLE_INTERVAL = 10;
+let requestSampleOffset = 0;
+
+export const monitoringMiddleware = (
+  req: Request,
+  res: Response,
+  next: NextFunction,
+) => {
+  if (UNMONITORED_PATH_SUFFIXES.some((path) => req.path.endsWith(path))) {
+    return next();
+  }
+
+  const start = performance.now();
+  const originalEnd = res.end;
+
+  res.end = function (chunk?: any, encoding?: any, cb?: any) {
+    const duration = performance.now() - start;
+    const shouldSample = requestSampleOffset === 0;
+    requestSampleOffset =
+      (requestSampleOffset + 1) % HTTP_METRIC_SAMPLE_INTERVAL;
+    if (shouldSample) {
+      metricsService.record('http_request', duration, {
+        method: req.method,
+        path: req.path,
+        statusCode: res.statusCode.toString(),
+        ...(req.platform && { platform: req.platform }),
+      });
+    }
+
+    if (duration > 1000) {
+      Logger.warn(
+        `Slow request detected: ${req.method} ${
+          req.path
+        } took ${duration.toFixed(2)}ms`,
+      );
+    }
+
+    return originalEnd.call(this, chunk, encoding, cb);
+  };
+
+  next();
+};
@@ -0,0 +1,23 @@
+import type { NextFunction, Request, Response } from 'express';
+
+export default function protectedPathCase(
+  req: Request,
+  res: Response,
+  next: NextFunction,
+) {
+  const originalPath = req.path;
+  const normalizedPath = originalPath.toLowerCase();
+
+  if (
+    originalPath !== normalizedPath &&
+    (normalizedPath.startsWith('/api/') ||
+      normalizedPath.startsWith('/open/'))
+  ) {
+    return res.status(400).json({
+      code: 400,
+      message: 'Invalid path format',
+    });
+  }
+
+  return next();
+}
@@ -0,0 +1,14 @@
+import { ErrorRequestHandler } from 'express';
+import { UniqueConstraintError } from 'sequelize';
+import { t } from '../shared/i18n';
+
+// Handle the database constraint itself so concurrent writes are covered too.
+const uniqueConstraintError: ErrorRequestHandler = (err, req, res, next) => {
+  if (!(err instanceof UniqueConstraintError)) return next(err);
+  // Constraint details can contain environment values or application credentials.
+  res
+    .status(409)
+    .json({ code: 409, message: t('资源已存在，请检查重复的名称或值') });
+};
+
+export default uniqueConstraintError;
@@ -0,0 +1,18 @@
+import { errors, isCelebrateError } from 'celebrate';
+import { ErrorRequestHandler } from 'express';
+import { t } from '../shared/i18n';
+
+const respond = errors();
+
+// Schemas are compiled once at startup; resolve their messages per request so
+// changing the system language also changes errors from those existing schemas.
+const validationErrors: ErrorRequestHandler = (error, req, res, next) => {
+  if (isCelebrateError(error)) {
+    for (const detail of error.details.values()) {
+      detail.message = detail.details.map((item) => t(item.message)).join('. ');
+    }
+  }
+  return respond(error, req, res, next);
+};
+
+export default validationErrors;
@@ -53,14 +53,7 @@ message Response {
  optional string message = 2;
 }

-message SystemNotifyRequest {
-  string title = 1;
-  string content = 2;
-}
-
-message ExtraScheduleItem {
-  string schedule = 1;
-}
+message ExtraScheduleItem { string schedule = 1; }

 message CronItem {
  optional int32 id = 1;
@@ -104,6 +97,18 @@ message UpdateCronRequest {

 message DeleteCronsRequest { repeated int32 ids = 1; }

+message GetCronsRequest {
+  optional string searchValue = 1;
+}
+
+message GetCronByIdRequest { int32 id = 1; }
+
+message EnableCronsRequest { repeated int32 ids = 1; }
+
+message DisableCronsRequest { repeated int32 ids = 1; }
+
+message RunCronsRequest { repeated int32 ids = 1; }
+
 message CronsResponse {
  int32 code = 1;
  repeated CronItem data = 2;
@@ -124,6 +129,146 @@ message CronDetailResponse {
  optional string message = 3;
 }

+enum NotificationMode {
+  gotify = 0;
+  goCqHttpBot = 1;
+  serverChan = 2;
+  pushDeer = 3;
+  bark = 4;
+  chat = 5;
+  telegramBot = 6;
+  dingtalkBot = 7;
+  weWorkBot = 8;
+  weWorkApp = 9;
+  aibotk = 10;
+  iGot = 11;
+  pushPlus = 12;
+  wePlusBot = 13;
+  email = 14;
+  pushMe = 15;
+  feishu = 16;
+  webhook = 17;
+  chronocat = 18;
+  ntfy = 19;
+  wxPusherBot = 20;
+  wxPusherSpt = 21;
+  wpush = 22;
+}
+
+message NotificationInfo {
+  NotificationMode type = 1;
+
+  optional string gotifyUrl = 2;
+  optional string gotifyToken = 3;
+  optional int32 gotifyPriority = 4;
+
+  optional string goCqHttpBotUrl = 5;
+  optional string goCqHttpBotToken = 6;
+  optional string goCqHttpBotQq = 7;
+
+  optional string serverChanKey = 8;
+
+  optional string pushDeerKey = 9;
+  optional string pushDeerUrl = 10;
+
+  optional string synologyChatUrl = 11;
+
+  optional string barkPush = 12;
+  optional string barkIcon = 13;
+  optional string barkSound = 14;
+  optional string barkGroup = 15;
+  optional string barkLevel = 16;
+  optional string barkUrl = 17;
+  optional string barkArchive = 18;
+
+  optional string telegramBotToken = 19;
+  optional string telegramBotUserId = 20;
+  optional string telegramBotProxyHost = 21;
+  optional string telegramBotProxyPort = 22;
+  optional string telegramBotProxyAuth = 23;
+  optional string telegramBotApiHost = 24;
+
+  optional string dingtalkBotToken = 25;
+  optional string dingtalkBotSecret = 26;
+
+  optional string weWorkBotKey = 27;
+  optional string weWorkOrigin = 28;
+
+  optional string weWorkAppKey = 29;
+
+  optional string aibotkKey = 30;
+  optional string aibotkType = 31;
+  optional string aibotkName = 32;
+
+  optional string iGotPushKey = 33;
+
+  optional string pushPlusToken = 34;
+  optional string pushPlusUser = 35;
+  optional string pushPlusTemplate = 36;
+  optional string pushplusChannel = 37;
+  optional string pushplusWebhook = 38;
+  optional string pushplusCallbackUrl = 39;
+  optional string pushplusTo = 40;
+
+  optional string wePlusBotToken = 41;
+  optional string wePlusBotReceiver = 42;
+  optional string wePlusBotVersion = 43;
+
+  optional string emailService = 44;
+  optional string emailUser = 45;
+  optional string emailPass = 46;
+  optional string emailTo = 47;
+
+  optional string pushMeKey = 48;
+  optional string pushMeUrl = 49;
+
+  optional string chronocatURL = 50;
+  optional string chronocatQQ = 51;
+  optional string chronocatToken = 52;
+
+  optional string webhookHeaders = 53;
+  optional string webhookBody = 54;
+  optional string webhookUrl = 55;
+  optional string webhookMethod = 56;
+  optional string webhookContentType = 57;
+
+  optional string larkKey = 58;
+  optional string larkSecret = 69;
+
+  optional string ntfyUrl = 59;
+  optional string ntfyTopic = 60;
+  optional string ntfyPriority = 61;
+  optional string ntfyToken = 62;
+  optional string ntfyUsername = 63;
+  optional string ntfyPassword = 64;
+  optional string ntfyActions = 65;
+
+  optional string wxPusherBotAppToken = 66;
+  optional string wxPusherBotTopicIds = 67;
+  optional string wxPusherBotUids = 68;
+
+  optional string wxPusherSptList = 70;
+
+  optional string wpushApiKey = 71;
+  optional string wpushChannel = 72;
+  optional string wpushTopicCode = 73;
+}
+
+message SystemNotifyRequest {
+  string title = 1;
+  string content = 2;
+  optional NotificationInfo notificationInfo = 3;
+}
+
+message RecordNotifyLogRequest {
+  string title = 1;
+  string content = 2;
+  bool success = 3;
+  string notifyType = 4;
+  string scriptName = 5;
+  string taskId = 6;
+}
+
 service Api {
  rpc GetEnvs(GetEnvsRequest) returns (EnvsResponse) {}
  rpc CreateEnv(CreateEnvRequest) returns (EnvsResponse) {}
@@ -135,8 +280,14 @@ service Api {
  rpc UpdateEnvNames(UpdateEnvNamesRequest) returns (Response) {}
  rpc GetEnvById(GetEnvByIdRequest) returns (EnvResponse) {}
  rpc SystemNotify(SystemNotifyRequest) returns (Response) {}
+  rpc RecordNotifyLog(RecordNotifyLogRequest) returns (Response) {}
  rpc GetCronDetail(CronDetailRequest) returns (CronDetailResponse) {}
  rpc CreateCron(CreateCronRequest) returns (CronResponse) {}
  rpc UpdateCron(UpdateCronRequest) returns (CronResponse) {}
  rpc DeleteCrons(DeleteCronsRequest) returns (Response) {}
-}
+  rpc GetCrons(GetCronsRequest) returns (CronsResponse) {}
+  rpc GetCronById(GetCronByIdRequest) returns (CronResponse) {}
+  rpc EnableCrons(EnableCronsRequest) returns (Response) {}
+  rpc DisableCrons(DisableCronsRequest) returns (Response) {}
+  rpc RunCrons(RunCronsRequest) returns (Response) {}
+}
@@ -5,6 +5,7 @@ package com.ql.cron;
 service Cron {
  rpc addCron(AddCronRequest) returns (AddCronResponse);
  rpc delCron(DeleteCronRequest) returns (DeleteCronResponse);
+  rpc setConcurrency(SetConcurrencyRequest) returns (AddCronResponse);
 }

 message ISchedule { string schedule = 1; }
@@ -17,10 +18,16 @@ message ICron {
  string name = 5;
 }

-message AddCronRequest { repeated ICron crons = 1; }
+message AddCronRequest {
+  repeated ICron crons = 1;
+  bool replace = 2;
+}

 message AddCronResponse {}

 message DeleteCronRequest { repeated string ids = 1; }

 message DeleteCronResponse {}
+
+// Zero restores the default limit.
+message SetConcurrencyRequest { int32 concurrency = 1; }
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
 //   protoc-gen-ts_proto  v2.6.1
-//   protoc               v3.17.3
+//   protoc               v5.28.3
 // source: back/protos/cron.proto

 /* eslint-disable */
@@ -35,6 +35,7 @@ export interface ICron {

 export interface AddCronRequest {
  crons: ICron[];
+  replace: boolean;
 }

 export interface AddCronResponse {
@@ -47,6 +48,11 @@ export interface DeleteCronRequest {
 export interface DeleteCronResponse {
 }

+/** Zero restores the default limit. */
+export interface SetConcurrencyRequest {
+  concurrency: number;
+}
+
 function createBaseISchedule(): ISchedule {
  return { schedule: "" };
 }
@@ -232,7 +238,7 @@ export const ICron: MessageFns<ICron> = {
 };

 function createBaseAddCronRequest(): AddCronRequest {
-  return { crons: [] };
+  return { crons: [], replace: false };
 }

 export const AddCronRequest: MessageFns<AddCronRequest> = {
@@ -240,6 +246,9 @@ export const AddCronRequest: MessageFns<AddCronRequest> = {
    for (const v of message.crons) {
      ICron.encode(v!, writer.uint32(10).fork()).join();
    }
+    if (message.replace !== false) {
+      writer.uint32(16).bool(message.replace);
+    }
    return writer;
  },

@@ -258,6 +267,14 @@ export const AddCronRequest: MessageFns<AddCronRequest> = {
          message.crons.push(ICron.decode(reader, reader.uint32()));
          continue;
        }
+        case 2: {
+          if (tag !== 16) {
+            break;
+          }
+
+          message.replace = reader.bool();
+          continue;
+        }
      }
      if ((tag & 7) === 4 || tag === 0) {
        break;
@@ -268,7 +285,10 @@ export const AddCronRequest: MessageFns<AddCronRequest> = {
  },

  fromJSON(object: any): AddCronRequest {
-    return { crons: globalThis.Array.isArray(object?.crons) ? object.crons.map((e: any) => ICron.fromJSON(e)) : [] };
+    return {
+      crons: globalThis.Array.isArray(object?.crons) ? object.crons.map((e: any) => ICron.fromJSON(e)) : [],
+      replace: isSet(object.replace) ? globalThis.Boolean(object.replace) : false,
+    };
  },

  toJSON(message: AddCronRequest): unknown {
@@ -276,6 +296,9 @@ export const AddCronRequest: MessageFns<AddCronRequest> = {
    if (message.crons?.length) {
      obj.crons = message.crons.map((e) => ICron.toJSON(e));
    }
+    if (message.replace !== false) {
+      obj.replace = message.replace;
+    }
    return obj;
  },

@@ -285,6 +308,7 @@ export const AddCronRequest: MessageFns<AddCronRequest> = {
  fromPartial<I extends Exact<DeepPartial<AddCronRequest>, I>>(object: I): AddCronRequest {
    const message = createBaseAddCronRequest();
    message.crons = object.crons?.map((e) => ICron.fromPartial(e)) || [];
+    message.replace = object.replace ?? false;
    return message;
  },
 };
@@ -433,6 +457,64 @@ export const DeleteCronResponse: MessageFns<DeleteCronResponse> = {
  },
 };

+function createBaseSetConcurrencyRequest(): SetConcurrencyRequest {
+  return { concurrency: 0 };
+}
+
+export const SetConcurrencyRequest: MessageFns<SetConcurrencyRequest> = {
+  encode(message: SetConcurrencyRequest, writer: BinaryWriter = new BinaryWriter()): BinaryWriter {
+    if (message.concurrency !== 0) {
+      writer.uint32(8).int32(message.concurrency);
+    }
+    return writer;
+  },
+
+  decode(input: BinaryReader | Uint8Array, length?: number): SetConcurrencyRequest {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === undefined ? reader.len : reader.pos + length;
+    const message = createBaseSetConcurrencyRequest();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 8) {
+            break;
+          }
+
+          message.concurrency = reader.int32();
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+
+  fromJSON(object: any): SetConcurrencyRequest {
+    return { concurrency: isSet(object.concurrency) ? globalThis.Number(object.concurrency) : 0 };
+  },
+
+  toJSON(message: SetConcurrencyRequest): unknown {
+    const obj: any = {};
+    if (message.concurrency !== 0) {
+      obj.concurrency = Math.round(message.concurrency);
+    }
+    return obj;
+  },
+
+  create<I extends Exact<DeepPartial<SetConcurrencyRequest>, I>>(base?: I): SetConcurrencyRequest {
+    return SetConcurrencyRequest.fromPartial(base ?? ({} as any));
+  },
+  fromPartial<I extends Exact<DeepPartial<SetConcurrencyRequest>, I>>(object: I): SetConcurrencyRequest {
+    const message = createBaseSetConcurrencyRequest();
+    message.concurrency = object.concurrency ?? 0;
+    return message;
+  },
+};
+
 export type CronService = typeof CronService;
 export const CronService = {
  addCron: {
@@ -453,11 +535,21 @@ export const CronService = {
    responseSerialize: (value: DeleteCronResponse) => Buffer.from(DeleteCronResponse.encode(value).finish()),
    responseDeserialize: (value: Buffer) => DeleteCronResponse.decode(value),
  },
+  setConcurrency: {
+    path: "/com.ql.cron.Cron/setConcurrency",
+    requestStream: false,
+    responseStream: false,
+    requestSerialize: (value: SetConcurrencyRequest) => Buffer.from(SetConcurrencyRequest.encode(value).finish()),
+    requestDeserialize: (value: Buffer) => SetConcurrencyRequest.decode(value),
+    responseSerialize: (value: AddCronResponse) => Buffer.from(AddCronResponse.encode(value).finish()),
+    responseDeserialize: (value: Buffer) => AddCronResponse.decode(value),
+  },
 } as const;

 export interface CronServer extends UntypedServiceImplementation {
  addCron: handleUnaryCall<AddCronRequest, AddCronResponse>;
  delCron: handleUnaryCall<DeleteCronRequest, DeleteCronResponse>;
+  setConcurrency: handleUnaryCall<SetConcurrencyRequest, AddCronResponse>;
 }

 export interface CronClient extends Client {
@@ -491,6 +583,21 @@ export interface CronClient extends Client {
    options: Partial<CallOptions>,
    callback: (error: ServiceError | null, response: DeleteCronResponse) => void,
  ): ClientUnaryCall;
+  setConcurrency(
+    request: SetConcurrencyRequest,
+    callback: (error: ServiceError | null, response: AddCronResponse) => void,
+  ): ClientUnaryCall;
+  setConcurrency(
+    request: SetConcurrencyRequest,
+    metadata: Metadata,
+    callback: (error: ServiceError | null, response: AddCronResponse) => void,
+  ): ClientUnaryCall;
+  setConcurrency(
+    request: SetConcurrencyRequest,
+    metadata: Metadata,
+    options: Partial<CallOptions>,
+    callback: (error: ServiceError | null, response: AddCronResponse) => void,
+  ): ClientUnaryCall;
 }

 export const CronClient = makeGenericClientConstructor(CronService, "com.ql.cron.Cron") as unknown as {
@@ -1,35 +0,0 @@
-import express from 'express';
-import Logger from './loaders/logger';
-import config from './config';
-import { HealthClient } from './protos/health';
-import { credentials } from '@grpc/grpc-js';
-
-const app = express();
-const client = new HealthClient(
-  `0.0.0.0:${config.cronPort}`,
-  credentials.createInsecure(),
-  { 'grpc.enable_http_proxy': 0 },
-);
-
-app.get('/api/health', (req, res) => {
-  client.check({ service: 'cron' }, (err, response) => {
-    if (err) {
-      return res.status(200).send({ code: 500, error: err });
-    }
-    return res.status(200).send({ code: 200, data: response });
-  });
-});
-
-app
-  .listen(config.publicPort, '0.0.0.0', async () => {
-    await require('./loaders/db').default();
-
-    Logger.debug(`✌️ 公共服务启动成功！`);
-    console.debug(`✌️ 公共服务启动成功！`);
-    process.send?.('ready');
-  })
-  .on('error', (err) => {
-    Logger.error(err);
-    console.error(err);
-    process.exit(1);
-  });
@@ -1,54 +1,113 @@
-import { ServerUnaryCall, sendUnaryData } from '@grpc/grpc-js';
+import { ServerUnaryCall, sendUnaryData, status } from '@grpc/grpc-js';
 import { AddCronRequest, AddCronResponse } from '../protos/cron';
-import nodeSchedule from 'node-schedule';
+import { createCronJob, CronJob } from '../shared/cronScheduler';
+import { isValidCronSchedule } from '../shared/cronSchedule';
 import { scheduleStacks } from './data';
 import { runCron } from '../shared/runCron';
 import Logger from '../loaders/logger';
+import { t, tf } from '../shared/i18n';
+
+// Validate the entire batch before replacing any existing jobs.
+const isValidCronField = (cron: string): boolean => {
+  return isValidCronSchedule(cron);
+};

 const addCron = (
  call: ServerUnaryCall<AddCronRequest, AddCronResponse>,
  callback: sendUnaryData<AddCronResponse>,
 ) => {
-  for (const item of call.request.crons) {
-    const { id, schedule, command, extra_schedules, name } = item;
-    if (scheduleStacks.has(id)) {
-      scheduleStacks.get(id)?.forEach((x) => x.cancel());
-    }
+  // ===== 第一遍：预校验所有 cron 表达式 =====
+  const validationErrors: string[] = [];

-    Logger.info(
-      '[schedule][创建定时任务], 任务ID: %s, 名称: %s, cron: %s, 执行命令: %s',
-      id,
-      name,
-      schedule,
-      command,
-    );
+  for (const item of call.request.crons) {
+    const { id, schedule, extra_schedules } = item;
+
+    if (!isValidCronField(schedule)) {
+      validationErrors.push(
+        tf('任务ID %s: 无效的 cron 表达式 "%s"', String(id), schedule),
+      );
+    }

    if (extra_schedules?.length) {
      extra_schedules.forEach((x) => {
-        Logger.info(
-          '[schedule][创建定时任务], 任务ID: %s, 名称: %s, cron: %s, 执行命令: %s',
-          id,
-          name,
-          x.schedule,
-          command,
-        );
+        if (!isValidCronField(x.schedule)) {
+          validationErrors.push(
+            tf(
+              '任务ID %s (extra_schedule): 无效的 cron 表达式 "%s"',
+              String(id),
+              x.schedule,
+            ),
+          );
+        }
      });
    }
+  }

-    scheduleStacks.set(id, [
-      nodeSchedule.scheduleJob(id, schedule, async () => {
-        Logger.info(`[schedule][准备运行任务] 命令: ${command}`);
-        runCron(command, item);
-      }),
-      ...(extra_schedules?.length
-        ? extra_schedules.map((x) =>
-            nodeSchedule.scheduleJob(id, x.schedule, async () => {
-              Logger.info(`[schedule][准备运行任务] 命令: ${command}`);
-              runCron(command, item);
-            }),
-          )
-        : []),
-    ]);
+  if (validationErrors.length > 0) {
+    const details = validationErrors.join('\n');
+    const err: any = new Error(details);
+    err.code = status.INVALID_ARGUMENT;
+    err.details = details;
+    callback(err, null);
+    return;
+  }
+
+  // Prepare stopped jobs first: construction errors must preserve the old snapshot.
+  const prepared = new Map<string, CronJob[]>();
+  try {
+    for (const item of call.request.crons) {
+      const jobs: CronJob[] = [];
+      prepared.get(item.id)?.forEach((job) => job.cancel());
+      prepared.set(item.id, jobs);
+      for (const schedule of [
+        item.schedule,
+        ...(item.extra_schedules || []).map((x) => x.schedule),
+      ]) {
+        jobs.push(
+          createCronJob(
+            schedule,
+            async () => {
+              Logger.info(t('[schedule][准备运行任务] 命令: %s'), item.command);
+              await runCron(
+                item.command,
+                item,
+                () => scheduleStacks.get(item.id) === jobs,
+              );
+            },
+            {
+              name: `${item.id}: ${item.name || ''}`,
+              logger: Logger,
+              start: false,
+            },
+          ),
+        );
+      }
+    }
+  } catch (error) {
+    for (const jobs of prepared.values()) jobs.forEach((job) => job.cancel());
+    const err: any = new Error(
+      error instanceof Error ? error.message : String(error),
+    );
+    err.code = status.INVALID_ARGUMENT;
+    err.details = err.message;
+    callback(err, null);
+    return;
+  }
+
+  if (call.request.replace) {
+    for (const jobs of scheduleStacks.values())
+      jobs.forEach((job) => job?.cancel());
+    scheduleStacks.clear();
+  }
+  for (const [id, jobs] of prepared) {
+    scheduleStacks.get(id)?.forEach((job) => job.cancel());
+    scheduleStacks.set(id, jobs);
+    jobs.forEach((job) => job.start());
+    Logger.info(
+      t('[schedule][创建定时任务] 任务ID: %s, 规则数: %s'),
+      id,
+      jobs.length,
+    );
  }

  callback(null, null);
@@ -16,6 +16,7 @@ import {
  MoveEnvRequest,
  Response,
  SystemNotifyRequest,
+  RecordNotifyLogRequest,
  UpdateEnvNamesRequest,
  UpdateEnvRequest,
 } from '../protos/api';
@@ -30,7 +31,15 @@ import {
  UpdateCronRequest,
  DeleteCronsRequest,
  CronResponse,
+  GetCronsRequest,
+  CronsResponse,
+  GetCronByIdRequest,
+  EnableCronsRequest,
+  DisableCronsRequest,
+  RunCronsRequest,
 } from '../protos/api';
+import { NotificationInfo } from '../data/notify';
+import { Model } from 'sequelize';

 Container.set('logger', LoggerInstance);

@@ -39,13 +48,6 @@ export const getEnvs = async (
  callback: sendUnaryData<EnvsResponse>,
 ) => {
  try {
-    if (!call.request.searchValue) {
-      return callback(null, {
-        code: 400,
-        data: [],
-        message: 'searchValue is required',
-      });
-    }
    const envService = Container.get(EnvService);
    const data = await envService.envs(call.request.searchValue);
    callback(null, {
@@ -79,9 +81,17 @@ export const updateEnv = async (
  callback: sendUnaryData<EnvResponse>,
 ) => {
  try {
+    if (!call.request.env?.id) {
+      return callback(null, {
+        code: 400,
+        data: undefined,
+        message: 'id parameter is required',
+      });
+    }
+
    const envService = Container.get(EnvService);
    const data = await envService.update(
-      pick(call.request.env, ['id', 'name', 'value', 'remark']) as EnvItem,
+      pick(call.request.env, ['id', 'name', 'value', 'remarks']) as EnvItem,
    );
    callback(null, { code: 200, data });
  } catch (e: any) {
@@ -94,6 +104,13 @@ export const deleteEnvs = async (
  callback: sendUnaryData<Response>,
 ) => {
  try {
+    if (!call.request.ids || call.request.ids.length === 0) {
+      return callback(null, {
+        code: 400,
+        message: 'ids parameter is required',
+      });
+    }
+
    const envService = Container.get(EnvService);
    await envService.remove(call.request.ids);
    callback(null, { code: 200 });
@@ -107,6 +124,14 @@ export const moveEnv = async (
  callback: sendUnaryData<EnvResponse>,
 ) => {
  try {
+    if (!call.request.id) {
+      return callback(null, {
+        code: 400,
+        data: undefined,
+        message: 'id parameter is required',
+      });
+    }
+
    const envService = Container.get(EnvService);
    const data = await envService.move(call.request.id, {
      fromIndex: call.request.fromIndex,
@@ -123,6 +148,13 @@ export const disableEnvs = async (
  callback: sendUnaryData<Response>,
 ) => {
  try {
+    if (!call.request.ids || call.request.ids.length === 0) {
+      return callback(null, {
+        code: 400,
+        message: 'ids parameter is required',
+      });
+    }
+
    const envService = Container.get(EnvService);
    await envService.disabled(call.request.ids);
    callback(null, { code: 200 });
@@ -136,6 +168,13 @@ export const enableEnvs = async (
  callback: sendUnaryData<Response>,
 ) => {
  try {
+    if (!call.request.ids || call.request.ids.length === 0) {
+      return callback(null, {
+        code: 400,
+        message: 'ids parameter is required',
+      });
+    }
+
    const envService = Container.get(EnvService);
    await envService.enabled(call.request.ids);
    callback(null, { code: 200 });
@@ -149,6 +188,13 @@ export const updateEnvNames = async (
  callback: sendUnaryData<Response>,
 ) => {
  try {
+    if (!call.request.ids || call.request.ids.length === 0) {
+      return callback(null, {
+        code: 400,
+        message: 'ids parameter is required',
+      });
+    }
+
    const envService = Container.get(EnvService);
    await envService.updateNames({
      ids: call.request.ids,
@@ -165,6 +211,14 @@ export const getEnvById = async (
  callback: sendUnaryData<EnvResponse>,
 ) => {
  try {
+    if (!call.request.id) {
+      return callback(null, {
+        code: 400,
+        data: undefined,
+        message: 'id parameter is required',
+      });
+    }
+
    const envService = Container.get(EnvService);
    const data = await envService.getDb({ id: call.request.id });
    callback(null, {
@@ -182,22 +236,51 @@ export const systemNotify = async (
 ) => {
  try {
    const systemService = Container.get(SystemService);
-    const data = await systemService.notify(call.request);
+    const data = await systemService.notify({
+      title: call.request.title,
+      content: call.request.content,
+      notificationInfo: call.request
+        .notificationInfo as unknown as NotificationInfo,
+    });
    callback(null, data);
  } catch (e: any) {
    callback(e);
  }
 };

+export const recordNotifyLog = async (
+  call: ServerUnaryCall<RecordNotifyLogRequest, Response>,
+  callback: sendUnaryData<Response>,
+) => {
+  try {
+    await Container.get(SystemService).recordNotifyLog({
+      title: call.request.title,
+      content: call.request.content,
+      status: call.request.success ? 0 : 1,
+      notifyType: call.request.notifyType,
+      source: 'script',
+      scriptName: call.request.scriptName,
+      taskId: call.request.taskId,
+    });
+    callback(null, { code: 200 });
+  } catch (error: any) {
+    callback(error);
+  }
+};
+
 const normalizeCronData = (data: CronItem | null): CronItem | undefined => {
  if (!data) return undefined;
+  // create() returns a Sequelize instance; spreading it omits attribute getters.
+  const cron =
+    data instanceof Model ? (data.get({ plain: true }) as CronItem) : data;
  return {
-    ...data,
-    sub_id: data.sub_id ?? undefined,
-    extra_schedules: data.extra_schedules ?? undefined,
-    pid: data.pid ?? undefined,
-    task_before: data.task_before ?? undefined,
-    task_after: data.task_after ?? undefined,
+    ...cron,
+    labels: cron.labels ?? [],
+    sub_id: cron.sub_id ?? undefined,
+    extra_schedules: cron.extra_schedules ?? [],
+    pid: cron.pid ?? undefined,
+    task_before: cron.task_before ?? undefined,
+    task_after: cron.task_after ?? undefined,
  };
 };

@@ -273,3 +356,116 @@ export const deleteCrons = async (
    callback(e);
  }
 };
+
+export const getCrons = async (
+  call: ServerUnaryCall<GetCronsRequest, CronsResponse>,
+  callback: sendUnaryData<CronsResponse>,
+) => {
+  try {
+    const cronService = Container.get(CronService);
+    const result = await cronService.crontabs({
+      searchValue: call.request.searchValue || '',
+      page: '0',
+      size: '0',
+      sorter: '',
+      filters: '',
+      queryString: '',
+    });
+    const data = result.data.map((x) => normalizeCronData(x as CronItem));
+    callback(null, {
+      code: 200,
+      data: data.filter((x): x is CronItem => x !== undefined),
+    });
+  } catch (e: any) {
+    callback(null, {
+      code: 500,
+      data: [],
+      message: e.message,
+    });
+  }
+};
+
+export const getCronById = async (
+  call: ServerUnaryCall<GetCronByIdRequest, CronResponse>,
+  callback: sendUnaryData<CronResponse>,
+) => {
+  try {
+    if (!call.request.id) {
+      return callback(null, {
+        code: 400,
+        data: undefined,
+        message: 'id parameter is required',
+      });
+    }
+
+    const cronService = Container.get(CronService);
+    const data = (await cronService.getDb({ id: call.request.id })) as CronItem;
+    callback(null, { code: 200, data: normalizeCronData(data) });
+  } catch (e: any) {
+    callback(null, {
+      code: 404,
+      data: undefined,
+      message: e.message,
+    });
+  }
+};
+
+export const enableCrons = async (
+  call: ServerUnaryCall<EnableCronsRequest, Response>,
+  callback: sendUnaryData<Response>,
+) => {
+  try {
+    if (!call.request.ids || call.request.ids.length === 0) {
+      return callback(null, {
+        code: 400,
+        message: 'ids parameter is required',
+      });
+    }
+
+    const cronService = Container.get(CronService);
+    await cronService.enabled(call.request.ids);
+    callback(null, { code: 200 });
+  } catch (e: any) {
+    callback(e);
+  }
+};
+
+export const disableCrons = async (
+  call: ServerUnaryCall<DisableCronsRequest, Response>,
+  callback: sendUnaryData<Response>,
+) => {
+  try {
+    if (!call.request.ids || call.request.ids.length === 0) {
+      return callback(null, {
+        code: 400,
+        message: 'ids parameter is required',
+      });
+    }
+
+    const cronService = Container.get(CronService);
+    await cronService.disabled(call.request.ids);
+    callback(null, { code: 200 });
+  } catch (e: any) {
+    callback(e);
+  }
+};
+
+export const runCrons = async (
+  call: ServerUnaryCall<RunCronsRequest, Response>,
+  callback: sendUnaryData<Response>,
+) => {
+  try {
+    if (!call.request.ids || call.request.ids.length === 0) {
+      return callback(null, {
+        code: 400,
+        message: 'ids parameter is required',
+      });
+    }
+
+    const cronService = Container.get(CronService);
+    await cronService.run(call.request.ids);
+    callback(null, { code: 200 });
+  } catch (e: any) {
+    callback(e);
+  }
+};
@@ -1,4 +1,4 @@
-import { credentials } from '@grpc/grpc-js';
+import { credentials, status, Metadata } from '@grpc/grpc-js';
 import {
  AddCronRequest,
  AddCronResponse,
@@ -7,30 +7,122 @@ import {
  DeleteCronResponse,
 } from '../protos/cron';
 import config from '../config';
+import { getGrpcCerts } from '../config/grpcCerts';
+
+import { HealthService } from '../protos/health';
+import { SchedulerReadiness } from '../shared/schedulerReadiness';

 class Client {
-  private client = new CronClient(
-    `0.0.0.0:${config.cronPort}`,
-    credentials.createInsecure(),
-    { 'grpc.enable_http_proxy': 0 },
-  );
+  readonly readiness = new SchedulerReadiness(() => this.probe());

-  addCron(request: AddCronRequest['crons']): Promise<AddCronResponse> {
-    return new Promise((resolve, reject) => {
-      this.client.addCron({ crons: request }, (err, res) => {
-        if (err) {
-          reject(err);
-        }
-        resolve(res);
+  private async waitForReady(timeoutMs: number) {
+    try {
+      await new Promise<void>((resolve, reject) => {
+        this.client.waitForReady(Date.now() + timeoutMs, (err) =>
+          err ? reject(err) : resolve()
+        );
      });
+    } catch (error) {
+      this.readiness.invalidate();
+      throw Object.assign(
+        error instanceof Error ? error : new Error(String(error)),
+        { status: 503 }
+      );
+    }
+  }
+
+  private async probe(): Promise<void> {
+    await this.waitForReady(1000);
+    await new Promise<void>((resolve, reject) => {
+      this.client.makeUnaryRequest(
+        HealthService.check.path,
+        HealthService.check.requestSerialize,
+        HealthService.check.responseDeserialize,
+        { service: 'scheduler' },
+        { deadline: Date.now() + 1000 },
+        (err, res) => err ? reject(err) : res?.status === 1 ? resolve() : reject(new Error('Scheduler unavailable')),
+      );
+    });
+  }
+  private _client: CronClient | null = null;
+
+  private get client(): CronClient {
+    if (!this._client) {
+      const tlsConfig = getGrpcCerts()!;
+      this._client = new CronClient(
+        `localhost:${config.grpcPort}`,
+        credentials.createSsl(
+          Buffer.from(tlsConfig.caCert),
+          Buffer.from(tlsConfig.clientKey),
+          Buffer.from(tlsConfig.clientCert),
+        ),
+        { 'grpc.enable_http_proxy': 0 },
+      );
+    }
+    return this._client;
+  }
+
+  async setConcurrency(concurrency: number): Promise<void> {
+    await this.waitForReady(2000);
+    return new Promise((resolve, reject) => {
+      this.client.setConcurrency(
+        { concurrency }, new Metadata(), { deadline: Date.now() + 5000 },
+        (err) => {
+          if (err) {
+            if (err.code === status.UNAVAILABLE || err.code === status.DEADLINE_EXCEEDED) {
+              this.readiness.invalidate();
+              Object.assign(err, { status: 503 });
+            }
+            return reject(err);
+          }
+          resolve();
+        },
+      );
    });
  }

-  delCron(request: DeleteCronRequest['ids']): Promise<DeleteCronResponse> {
+  async addCron(
+    request: AddCronRequest['crons'],
+    replace = false
+  ): Promise<AddCronResponse> {
+    await this.waitForReady(2000);
+    // Include every rule in a recovery snapshot, but bound a stuck worker.
+    const ruleCount = request.reduce(
+      (count, item) => count + 1 + (item.extra_schedules?.length || 0),
+      0,
+    );
+    const registrationTimeoutMs = Math.min(120000, 5000 + ruleCount * 5);
    return new Promise((resolve, reject) => {
-      this.client.delCron({ ids: request }, (err, res) => {
+      this.client.addCron(
+        { crons: request, replace },
+        new Metadata(),
+        { deadline: Date.now() + registrationTimeoutMs },
+        (err, res) => {
+          if (err) {
+            if (err.code === status.UNAVAILABLE || err.code === status.DEADLINE_EXCEEDED) {
+              // A timed-out write may already have reached the scheduler.
+              // Reconcile its state from the DB instead of replaying the RPC.
+              this.readiness.invalidate();
+              Object.assign(err, { status: 503 });
+            }
+            return reject(err);
+          }
+          resolve(res);
+        }
+      );
+    });
+  }
+
+  async delCron(request: DeleteCronRequest['ids']): Promise<DeleteCronResponse> {
+    await this.waitForReady(2000);
+    return new Promise((resolve, reject) => {
+      this.client.delCron({ ids: request }, new Metadata(), { deadline: Date.now() + 5000 }, (err, res) => {
        if (err) {
-          reject(err);
+          if (err.code === status.UNAVAILABLE || err.code === status.DEADLINE_EXCEEDED) {
+            this.readiness.invalidate();
+            Object.assign(err, { status: 503 });
+          }
+          return reject(err);
        }
        resolve(res);
      });
@@ -1,6 +1,6 @@
-import nodeSchedule from 'node-schedule';
+import { CronJob } from '../shared/cronScheduler';
 import { ToadScheduler } from 'toad-scheduler';

-export const scheduleStacks = new Map<string, nodeSchedule.Job[]>();
+export const scheduleStacks = new Map<string, CronJob[]>();

 export const intervalSchedule = new ToadScheduler();
@@ -1,3 +1,4 @@
+import { t } from '../shared/i18n';
 import { ServerUnaryCall, sendUnaryData } from '@grpc/grpc-js';
 import { DeleteCronRequest, DeleteCronResponse } from '../protos/cron';
 import { scheduleStacks } from './data';
@@ -9,11 +10,24 @@ const delCron = (
 ) => {
  for (const id of call.request.ids) {
    if (scheduleStacks.has(id)) {
-      Logger.info(
-        '[schedule][取消定时任务], 任务ID: %s',
-        id,
-      );
-      scheduleStacks.get(id)?.forEach(x => x.cancel());
+      Logger.info(t('[schedule][取消定时任务] 任务ID: %s'), id);
+      // 防御性过滤历史调度栈中的空任务，
+      // 否则对 null 调 cancel() 会让整个取消流程抛出 UNKNOWN 错误，
+      // 进而导致 HTTP 端的 remove() 跳过 setCrontab()，造成 crontab.list 残留。
+      scheduleStacks
+        .get(id)
+        ?.filter((x) => x != null)
+        .forEach((x) => {
+          try {
+            x.cancel();
+          } catch (error: any) {
+            Logger.warn(
+              t('[schedule][取消任务失败] 任务ID: %s, 错误: %s'),
+              id,
+              error?.message || error,
+            );
+          }
+        });
      scheduleStacks.delete(id);
    }
  }
@@ -1,31 +1,107 @@
 import { ServerUnaryCall, sendUnaryData } from '@grpc/grpc-js';
+import fs from 'fs/promises';
+import path from 'path';
+import { request } from 'undici';
 import { HealthCheckRequest, HealthCheckResponse } from '../protos/health';
 import config from '../config';
-import { promiseExec } from '../config/util';
+
+function formatError(error: unknown): string {
+  if (!(error instanceof Error)) {
+    return String(error);
+  }
+
+  const detailedError = error as Error & {
+    cause?: unknown;
+    code?: string;
+    errors?: unknown[];
+  };
+  const details = [error.message, detailedError.code];
+  if (Array.isArray(detailedError.errors)) {
+    details.push(...detailedError.errors.map(formatError));
+  } else if (detailedError.cause) {
+    details.push(formatError(detailedError.cause));
+  }
+
+  return [...new Set(details.filter(Boolean))].join(': ') || error.name;
+}
+
+async function getRecentSystemLog(lineLimit = 300): Promise<string> {
+  try {
+    const entries = await fs.readdir(config.systemLogPath);
+    const latestLog = entries
+      .filter((entry) => entry.endsWith('.log'))
+      .sort()
+      .at(-1);
+    if (!latestLog) {
+      return `No system log found in ${config.systemLogPath}`;
+    }
+    const content = await fs.readFile(
+      path.join(config.systemLogPath, latestLog),
+      'utf8',
+    );
+    return content.split('\n').slice(-lineLimit).join('\n').trim();
+  } catch (error) {
+    return `Unable to read system log from ${config.systemLogPath}: ${
+      error instanceof Error ? error.message : String(error)
+    }`;
+  }
+}

 const check = async (
  call: ServerUnaryCall<HealthCheckRequest, HealthCheckResponse>,
  callback: sendUnaryData<HealthCheckResponse>,
 ) => {
  switch (call.request.service) {
-    case 'cron':
-      const res = await promiseExec(
-        `curl -s --noproxy '*' http://0.0.0.0:${config.port}/api/system`,
-      );
-
-      if (res.includes('200')) {
-        return callback(null, { status: 1 });
+    // Local scheduler liveness only: never call HTTP from this probe.
+    case 'scheduler':
+      return callback(null, { status: 1 });
+    case 'cron': {
+      const healthUrl = `http://localhost:${config.port}${
+        config.baseUrl || ''
+      }/api/health`;
+      let failure = '';
+      try {
+        const response = await request(healthUrl, {
+          method: 'GET',
+          headersTimeout: 5000,
+          bodyTimeout: 5000,
+        });
+        const body = (await response.body.json()) as {
+          code?: number;
+          data?: { status?: string };
+        };
+        if (
+          response.statusCode >= 200 &&
+          response.statusCode < 300 &&
+          body.code === 200 &&
+          body.data?.status === 'ok'
+        ) {
+          return callback(null, { status: 1 });
+        }
+        failure = `HTTP ${response.statusCode}: ${JSON.stringify(body)}`;
+      } catch (error) {
+        failure = formatError(error);
      }

-      const panelErrLog = await promiseExec(
-        `tail -n 300 ~/.pm2/logs/panel-error.log`,
-      );
-      const scheduleErrLog = await promiseExec(
-        `tail -n 300 ~/.pm2/logs/schedule-error.log`,
-      );
+      const systemLog = await getRecentSystemLog();
+      const containerHint =
+        process.env.QL_CONTAINER === 'true'
+          ? 'PM2 file logging is disabled in containers. Check `docker logs <container>` for early startup errors.'
+          : 'Check `pm2 logs qinglong --lines 300` for early startup errors.';
      return callback(
-        new Error(`${scheduleErrLog || ''}\n${panelErrLog || ''}\n${res}`.trim()),
+        new Error(
+          [
+            `HTTP health check failed: ${healthUrl}`,
+            failure,
+            containerHint,
+            `Recent system log (${config.systemLogPath}):`,
+            systemLog,
+          ]
+            .filter(Boolean)
+            .join('\n'),
+        ),
      );
+    }

    default:
      return callback(null, { status: 1 });
@@ -1,27 +0,0 @@
-import { Server, ServerCredentials } from '@grpc/grpc-js';
-import { CronService } from '../protos/cron';
-import { addCron } from './addCron';
-import { delCron } from './delCron';
-import { HealthService } from '../protos/health';
-import { check } from './health';
-import config from '../config';
-import Logger from '../loaders/logger';
-import { ApiService } from '../protos/api';
-import * as Api from './api';
-
-const server = new Server({ 'grpc.enable_http_proxy': 0 });
-server.addService(HealthService, { check });
-server.addService(CronService, { addCron, delCron });
-server.addService(ApiService, Api);
-server.bindAsync(
-  `0.0.0.0:${config.cronPort}`,
-  ServerCredentials.createInsecure(),
-  (err, port) => {
-    if (err) {
-      throw err;
-    }
-    Logger.debug(`✌️ 定时服务启动成功！`);
-    console.debug(`✌️ 定时服务启动成功！`);
-    process.send?.('ready');
-  },
-);
@@ -0,0 +1,26 @@
+import { ServerUnaryCall, sendUnaryData, status } from '@grpc/grpc-js';
+import os from 'os';
+import { AddCronResponse, SetConcurrencyRequest } from '../protos/cron';
+import taskLimit from '../shared/pLimit';
+
+export async function setConcurrency(
+  call: ServerUnaryCall<SetConcurrencyRequest, AddCronResponse>,
+  callback: sendUnaryData<AddCronResponse>,
+) {
+  const limit = call.request.concurrency;
+  if (!Number.isInteger(limit) || limit < 0 || limit > 2147483647) {
+    callback(
+      Object.assign(new Error('Invalid concurrency'), {
+        code: status.INVALID_ARGUMENT,
+      }),
+      null,
+    );
+    return;
+  }
+  try {
+    await taskLimit.setCustomLimit(limit || Math.max(os.cpus().length, 4));
+    callback(null, {});
+  } catch (error) {
+    callback(error as Error, null);
+  }
+}
@@ -1,9 +1,10 @@
-import { Service, Inject } from 'typedi';
-import path, { join } from 'path';
+import { Service } from 'typedi';
 import config from '../config';
 import { getFileContentByName } from '../config/util';
+import { t } from '../shared/i18n';
 import { Response } from 'express';
-import got from 'got';
+import { request } from 'undici';
+import { resolveFileAccess } from '../shared/fileAccess';

@Service()
 export default class ConfigService {
@@ -11,30 +12,25 @@ export default class ConfigService {

  public async getFile(filePath: string, res: Response) {
    let content = '';
-    const avaliablePath = [config.rootPath, config.configPath].map((x) =>
-      path.resolve(x, filePath),
+    if (!filePath || filePath.startsWith('data/scripts/')) {
+      return res.send({ code: 403, message: t('文件无法访问') });
+    }
+    const resolved = resolveFileAccess(
+      config.configPath,
+      [filePath],
+      config.blackFileList,
    );
-
-    if (
-      config.blackFileList.includes(filePath) ||
-      avaliablePath.every(
-        (x) =>
-          !x.startsWith(config.scriptPath) && !x.startsWith(config.configPath),
-      ) ||
-      !filePath
-    ) {
-      return res.send({ code: 403, message: '文件无法访问' });
+    if (!resolved) {
+      return res.send({ code: 403, message: t('文件无法访问') });
    }

    if (filePath.startsWith('sample/')) {
-      const res = await got.get(
+      const res = await request(
        `https://gitlab.com/whyour/qinglong/-/raw/master/${filePath}`,
      );
-      content = res.body;
-    } else if (filePath.startsWith('data/scripts/')) {
-      content = await getFileContentByName(join(config.rootPath, filePath));
+      content = await res.body.text();
    } else {
-      content = await getFileContentByName(join(config.configPath, filePath));
+      content = await getFileContentByName(resolved);
    }

    res.send({ code: 200, data: content });
@@ -3,12 +3,9 @@ import winston from 'winston';
 import config from '../config';
 import {
  Dependence,
-  InstallDependenceCommandTypes,
  DependenceStatus,
  DependenceTypes,
-  unInstallDependenceCommandTypes,
  DependenceModel,
-  GetDependenceCommandTypes,
  versionDependenceCommandTypes,
 } from '../data/dependence';
 import { spawn } from 'cross-spawn';
@@ -19,9 +16,17 @@ import {
  getPid,
  killTask,
  promiseExecSuccess,
+  concurrentRun,
+  getInstallCommand,
+  getUninstallCommand,
+  getGetCommand,
+  isPythonSourceDependency,
 } from '../config/util';
 import dayjs from 'dayjs';
 import taskLimit from '../shared/pLimit';
+import { detectOS } from '../config/util';
+import { LINUX_DEPENDENCE_COMMAND } from '../config/const';
+import { t, tf } from '../shared/i18n';

@Service()
 export default class DependenceService {
@@ -32,6 +37,7 @@ export default class DependenceService {

  public async create(payloads: Dependence[]): Promise<Dependence[]> {
    const tabs = payloads.map((x) => {
+      getInstallCommand(x.type, x.name);
      const tab = new Dependence({ ...x, status: DependenceStatus.queued });
      return tab;
    });
@@ -55,6 +61,7 @@ export default class DependenceService {
      ...other,
      status: DependenceStatus.queued,
    });
+    getInstallCommand(tab.type, tab.name);
    const newDoc = await this.updateDb(tab);
    this.installDependenceOneByOne([newDoc]);
    return newDoc;
@@ -67,21 +74,28 @@ export default class DependenceService {

  public async remove(ids: number[], force = false): Promise<Dependence[]> {
    const docs = await DependenceModel.findAll({ where: { id: ids } });
-    const unInstalledDeps = docs.filter(
-      (x) => x.status !== DependenceStatus.installed,
-    );
+    for (const doc of docs) {
+      taskLimit.removeQueuedDependency(doc);
+    }
    const installedDeps = docs.filter(
-      (x) => x.status === DependenceStatus.installed,
+      (x) =>
+        x.status === DependenceStatus.installed ||
+        // Older list refreshes marked unprobeable sources as failed. They may
+        // still have installed distributions (including partial pip installs).
+        (x.status === DependenceStatus.installFailed &&
+          x.type === DependenceTypes.python3 &&
+          isPythonSourceDependency(x.name)),
    );
+    const unInstalledDeps = docs.filter((x) => !installedDeps.includes(x));
    await this.removeDb(unInstalledDeps.map((x) => x.id!));

    if (installedDeps.length) {
      await DependenceModel.update(
        { status: DependenceStatus.queued, log: [] },
-        { where: { id: ids } },
+        { where: { id: installedDeps.map((x) => x.id!) } },
      );

-      this.installDependenceOneByOne(docs, false, force);
+      this.installDependenceOneByOne(installedDeps, false, force);
    }
    return docs;
  }
@@ -95,47 +109,124 @@ export default class DependenceService {
      searchValue,
      type,
      status,
-    }: { searchValue: string; type: string; status: string },
+    }: {
+      searchValue: string;
+      type: keyof typeof DependenceTypes;
+      status: string;
+    },
    sort: any = [],
    query: any = {},
  ): Promise<Dependence[]> {
-    let condition = {
-      ...query,
-      type: DependenceTypes[type as any],
-    };
+    let condition = query;
+    const dependenceType =
+      type && DependenceTypes[type] !== undefined
+        ? DependenceTypes[type]
+        : undefined;
+    await this.refreshInstalledStatuses(dependenceType);
+    if (type && DependenceTypes[type] !== undefined) {
+      condition.type = DependenceTypes[type];
+    }
    if (status) {
      condition.status = status.split(',').map(Number);
    }
    if (searchValue) {
      const encodeText = encodeURI(searchValue);
-      const reg = {
+      condition.name = {
        [Op.or]: [
          { [Op.like]: `%${searchValue}%` },
          { [Op.like]: `%${encodeText}%` },
        ],
      };
-
-      condition = {
-        ...condition,
-        name: reg,
-      };
    }
    try {
-      const result = await this.find(condition, sort);
-      return result as any;
+      return await this.find(condition, sort);
    } catch (error) {
      throw error;
    }
  }

+  private async refreshInstalledStatuses(type?: DependenceTypes) {
+    const cacheDependenceTypes = [
+      DependenceTypes.nodejs,
+      DependenceTypes.python3,
+    ];
+    if (type !== undefined && !cacheDependenceTypes.includes(type)) {
+      return;
+    }
+
+    const docs = await DependenceModel.findAll({
+      where: {
+        status: DependenceStatus.installed,
+        type: type === undefined ? { [Op.in]: cacheDependenceTypes } : type,
+      },
+    });
+    const checks = await concurrentRun(
+      docs
+        .filter(
+          (doc) =>
+            doc.type !== DependenceTypes.python3 ||
+            !isPythonSourceDependency(doc.name),
+        )
+        .map((doc) => async () => {
+          return (await this.isDependenceInstalled(doc)) ? undefined : doc.id;
+        }),
+      5,
+    );
+    const missingIds = (checks || []).filter(
+      (id): id is number => id !== undefined,
+    );
+
+    if (missingIds.length) {
+      await DependenceModel.update(
+        { status: DependenceStatus.installFailed },
+        { where: { id: missingIds } },
+      );
+    }
+  }
+
+  private async isDependenceInstalled(dependency: Dependence) {
+    let depName = dependency.name.trim();
+    const depVersionStr = versionDependenceCommandTypes[dependency.type];
+    let depVersion = '';
+    if (
+      dependency.type !== DependenceTypes.python3 &&
+      depName.includes(depVersionStr)
+    ) {
+      const symbolRegx = new RegExp(
+        `(.*)${depVersionStr}([0-9\\.\\-\\+a-zA-Z]*)`,
+      );
+      const [, parsedName, parsedVersion] = depName.match(symbolRegx) || [];
+      if (parsedVersion && parsedName) {
+        depName = parsedName;
+        depVersion = parsedVersion;
+      }
+    }
+
+    const depInfo = (
+      await promiseExecSuccess(getGetCommand(dependency.type, depName))
+    )
+      .replace(/\s{2,}/, ' ')
+      .replace(/\s+$/, '');
+    const nameMatches =
+      (dependency.type === DependenceTypes.nodejs &&
+        depInfo.split(' ')?.[0] === depName) ||
+      dependency.type === DependenceTypes.python3;
+
+    return Boolean(
+      depInfo && nameMatches && (!depVersion || depInfo.includes(depVersion)),
+    );
+  }
+
  public installDependenceOneByOne(
    docs: Dependence[],
    isInstall: boolean = true,
    force: boolean = false,
-  ) {
+  ): Promise<void> {
    docs.forEach((dep) => {
      this.installOrUninstallDependency(dep, isInstall, force);
    });
+
+    return taskLimit.waitDependencyQueueDone();
  }

  public async reInstall(ids: number[]): Promise<Dependence[]> {
@@ -145,6 +236,9 @@ export default class DependenceService {
    );

    const docs = await DependenceModel.findAll({ where: { id: ids } });
+    for (const doc of docs) {
+      taskLimit.removeQueuedDependency(doc);
+    }
    this.installDependenceOneByOne(docs, true, true);
    return docs;
  }
@@ -153,13 +247,22 @@ export default class DependenceService {
    const docs = await DependenceModel.findAll({ where: { id: ids } });
    for (const doc of docs) {
      taskLimit.removeQueuedDependency(doc);
-      const depInstallCommand = InstallDependenceCommandTypes[doc.type];
-      const depUnInstallCommand = unInstallDependenceCommandTypes[doc.type];
-      const installCmd = `${depInstallCommand} ${doc.name.trim()}`;
-      const unInstallCmd = `${depUnInstallCommand} ${doc.name.trim()}`;
+      let depInstallCommand = getInstallCommand(doc.type, doc.name);
+      let depUnInstallCommand = getUninstallCommand(doc.type, doc.name);
+      const isLinuxDependence = doc.type === DependenceTypes.linux;
+
+      if (isLinuxDependence) {
+        const osType = await detectOS();
+        if (!osType) {
+          continue;
+        }
+        const linuxCommand = LINUX_DEPENDENCE_COMMAND[osType];
+        depInstallCommand = `${linuxCommand.install} ${doc.name.trim()}`;
+        depUnInstallCommand = `${linuxCommand.uninstall} ${doc.name.trim()}`;
+      }
      const pids = await Promise.all([
-        getPid(installCmd),
-        getPid(unInstallCmd),
+        getPid(depInstallCommand),
+        getPid(depUnInstallCommand),
      ]);
      for (const pid of pids) {
        pid && (await killTask(pid));
@@ -209,47 +312,113 @@ export default class DependenceService {
    force: boolean = false,
  ) {
    return taskLimit.runDependeny(dependency, () => {
+      let validatedCommand: string;
+      try {
+        validatedCommand = isInstall
+          ? getInstallCommand(dependency.type, dependency.name.trim())
+          : getUninstallCommand(dependency.type, dependency.name.trim());
+      } catch (error) {
+        taskLimit.removeQueuedDependency(dependency);
+        if (!isInstall && force) {
+          return this.removeDb([dependency.id!]).then(() => null);
+        }
+        return DependenceModel.update(
+          {
+            status: isInstall
+              ? DependenceStatus.installFailed
+              : DependenceStatus.removeFailed,
+            log: [String(error)],
+          },
+          { where: { id: dependency.id } },
+        ).then(() => null);
+      }
      return new Promise(async (resolve) => {
        if (taskLimit.firstDependencyId !== dependency.id) {
          return resolve(null);
        }
-
-        taskLimit.removeQueuedDependency(dependency);
-
        const depIds = [dependency.id!];
+        let depName = dependency.name.trim();
+        const actionText = isInstall ? t('安装') : t('删除');
+        const socketMessageType = isInstall
+          ? 'installDependence'
+          : 'uninstallDependence';
+        const isNodeDependence = dependency.type === DependenceTypes.nodejs;
+        const isLinuxDependence = dependency.type === DependenceTypes.linux;
+        const isPythonDependence = dependency.type === DependenceTypes.python3;
+        const osType = await detectOS();
+        let linuxCommand = {} as typeof LINUX_DEPENDENCE_COMMAND.Alpine;
+        taskLimit.removeQueuedDependency(dependency);
+        if (isLinuxDependence) {
+          if (!osType) {
+            await DependenceModel.update(
+              { status: DependenceStatus.installFailed },
+              { where: { id: depIds } },
+            );
+            const startTime = dayjs();
+            const message = tf(
+              '开始%s依赖 %s，开始时间 %s\n\n当前系统不支持\n\n依赖%s失败，结束时间 %s，耗时 %s 秒',
+              actionText,
+              depName,
+              startTime.format('YYYY-MM-DD HH:mm:ss'),
+              actionText,
+              startTime.format('YYYY-MM-DD HH:mm:ss'),
+              String(startTime.diff(startTime, 'second')),
+            );
+            this.sockService.sendMessage({
+              type: socketMessageType,
+              message,
+              references: depIds,
+              status: DependenceStatus.installFailed,
+            });
+            this.updateLog(depIds, message);
+            return resolve(null);
+          }
+          linuxCommand = LINUX_DEPENDENCE_COMMAND[osType];
+        }
+
        const status = isInstall
          ? DependenceStatus.installing
          : DependenceStatus.removing;
        await DependenceModel.update({ status }, { where: { id: depIds } });

-        const socketMessageType = isInstall
-          ? 'installDependence'
-          : 'uninstallDependence';
-        let depName = dependency.name.trim();
-        const depRunCommand = (
-          isInstall
-            ? InstallDependenceCommandTypes
-            : unInstallDependenceCommandTypes
-        )[dependency.type];
-        const actionText = isInstall ? '安装' : '删除';
+        let command = validatedCommand;
+        if (isLinuxDependence) {
+          command = isInstall
+            ? `${linuxCommand.install} ${depName.trim()}`
+            : `${linuxCommand.uninstall} ${depName.trim()}`;
+        }
        const startTime = dayjs();

-        const message = `开始${actionText}依赖 ${depName}，开始时间 ${startTime.format(
-          'YYYY-MM-DD HH:mm:ss',
-        )}\n\n`;
+        const message = tf(
+          '开始%s依赖 %s，开始时间 %s\n\n',
+          actionText,
+          depName,
+          startTime.format('YYYY-MM-DD HH:mm:ss'),
+        );
        this.sockService.sendMessage({
          type: socketMessageType,
          message,
          references: depIds,
+          status,
        });
        this.updateLog(depIds, message);

        // 判断是否已经安装过依赖
-        if (isInstall && !force) {
-          const getCommandPrefix = GetDependenceCommandTypes[dependency.type];
+        // pip must resolve optional dependencies even if the base distribution
+        // is already present; its version alone cannot prove extras are ready.
+        if (
+          isInstall &&
+          !force &&
+          !(isPythonDependence && depName.includes('['))
+        ) {
+          let getCommand = getGetCommand(dependency.type, depName);
          const depVersionStr = versionDependenceCommandTypes[dependency.type];
+          if (isLinuxDependence) {
+            getCommand = `${linuxCommand.info} ${depName}`;
+          }
+
          let depVersion = '';
-          if (depName.includes(depVersionStr)) {
+          if (!isPythonDependence && depName.includes(depVersionStr)) {
            const symbolRegx = new RegExp(
              `(.*)${depVersionStr}([0-9\\.\\-\\+a-zA-Z]*)`,
            );
@@ -259,17 +428,7 @@ export default class DependenceService {
              depVersion = _depVersion;
            }
          }
-          const isNodeDependence = dependency.type === DependenceTypes.nodejs;
-          const isLinuxDependence = dependency.type === DependenceTypes.linux;
-          const isPythonDependence =
-            dependency.type === DependenceTypes.python3;
-          const depInfo = (
-            await promiseExecSuccess(
-              isNodeDependence
-                ? `${getCommandPrefix} | grep "${depName}" | head -1`
-                : `${getCommandPrefix} ${depName}`,
-            )
-          )
+          const depInfo = (await promiseExecSuccess(getCommand))
            .replace(/\s{2,}/, ' ')
            .replace(/\s+$/, '');

@@ -277,18 +436,24 @@ export default class DependenceService {
            depInfo &&
            ((isNodeDependence && depInfo.split(' ')?.[0] === depName) ||
              (isLinuxDependence &&
-                depInfo.toLocaleLowerCase().includes('installed')) ||
+                linuxCommand.check(depInfo.toLocaleLowerCase())) ||
              isPythonDependence) &&
            (!depVersion || depInfo.includes(depVersion))
          ) {
            const endTime = dayjs();
-            const _message = `检测到已经安装 ${depName}\n\n${depInfo}\n\n跳过安装\n\n依赖${actionText}成功，结束时间 ${endTime.format(
-              'YYYY-MM-DD HH:mm:ss',
-            )}，耗时 ${endTime.diff(startTime, 'second')} 秒`;
+            const _message = tf(
+              '检测到已经安装 %s\n\n%s\n\n跳过安装\n\n依赖%s成功，结束时间 %s，耗时 %s 秒',
+              depName,
+              depInfo,
+              actionText,
+              endTime.format('YYYY-MM-DD HH:mm:ss'),
+              String(endTime.diff(startTime, 'second')),
+            );
            this.sockService.sendMessage({
              type: socketMessageType,
              message: _message,
              references: depIds,
+              status: DependenceStatus.installed,
            });
            this.updateLog(depIds, _message);
            await DependenceModel.update(
@@ -304,18 +469,16 @@ export default class DependenceService {
        const proxyStr = dependenceProxyFileExist
          ? `source ${config.dependenceProxyFile} &&`
          : '';
-        const cp = spawn(
-          `${proxyStr} ${depRunCommand} ${dependency.name.trim()}`,
-          {
-            shell: '/bin/bash',
-          },
-        );
+        const cp = spawn(`${proxyStr} ${command}`, {
+          shell: '/bin/bash',
+        });

        cp.stdout.on('data', async (data) => {
          this.sockService.sendMessage({
            type: socketMessageType,
            message: data.toString(),
            references: depIds,
+            status,
          });
          this.updateLog(depIds, data.toString());
        });
@@ -325,6 +488,7 @@ export default class DependenceService {
            type: socketMessageType,
            message: data.toString(),
            references: depIds,
+            status,
          });
          this.updateLog(depIds, data.toString());
        });
@@ -334,6 +498,7 @@ export default class DependenceService {
            type: socketMessageType,
            message: JSON.stringify(err),
            references: depIds,
+            status,
          });
          this.updateLog(depIds, JSON.stringify(err));
        });
@@ -341,28 +506,32 @@ export default class DependenceService {
        cp.on('exit', async (code) => {
          const endTime = dayjs();
          const isSucceed = code === 0;
-          const resultText = isSucceed ? '成功' : '失败';
+          const resultText = isSucceed ? t('成功') : t('失败');

-          const message = `\n依赖${actionText}${resultText}，结束时间 ${endTime.format(
-            'YYYY-MM-DD HH:mm:ss',
-          )}，耗时 ${endTime.diff(startTime, 'second')} 秒`;
+          const message =
+            '\n' +
+            tf(
+              '依赖%s%s，结束时间 %s，耗时 %s 秒',
+              actionText,
+              resultText,
+              endTime.format('YYYY-MM-DD HH:mm:ss'),
+              String(endTime.diff(startTime, 'second')),
+            );
+          const exitStatus = isSucceed
+            ? isInstall
+              ? DependenceStatus.installed
+              : DependenceStatus.removed
+            : isInstall
+            ? DependenceStatus.installFailed
+            : DependenceStatus.removeFailed;
          this.sockService.sendMessage({
            type: socketMessageType,
            message,
            references: depIds,
+            status: exitStatus,
          });
          this.updateLog(depIds, message);

-          let status: number;
-          if (isSucceed) {
-            status = isInstall
-              ? DependenceStatus.installed
-              : DependenceStatus.removed;
-          } else {
-            status = isInstall
-              ? DependenceStatus.installFailed
-              : DependenceStatus.removeFailed;
-          }
          const docs = await DependenceModel.findAll({ where: { id: depIds } });
          const _docIds = docs
            .filter((x) => x.status !== DependenceStatus.cancelled)
@@ -370,7 +539,7 @@ export default class DependenceService {

          if (_docIds.length > 0) {
            await DependenceModel.update(
-              { status },
+              { status: exitStatus },
              { where: { id: _docIds } },
            );
          }
@@ -1,7 +1,8 @@
-import { Service, Inject } from 'typedi';
+import groupBy from 'lodash/groupBy';
+import { FindOptions, Op } from 'sequelize';
+import { Inject, Service } from 'typedi';
 import winston from 'winston';
 import config from '../config';
-import * as fs from 'fs/promises';
 import {
  Env,
  EnvModel,
@@ -11,13 +12,12 @@ import {
  minPosition,
  stepPosition,
 } from '../data/env';
-import groupBy from 'lodash/groupBy';
-import { FindOptions, Op } from 'sequelize';
 import { writeFileWithLock } from '../shared/utils';
+import { sequelize } from '../data';

@Service()
 export default class EnvService {
-  constructor(@Inject('logger') private logger: winston.Logger) {}
+  constructor(@Inject('logger') private logger: winston.Logger) { }

  public async create(payloads: Env[]): Promise<Env[]> {
    const envs = await this.envs();
@@ -27,7 +27,7 @@ export default class EnvService {
      envs.length > 0 &&
      typeof envs[envs.length - 1].position === 'number'
    ) {
-      position = envs[envs.length - 1].position!;
+      position = this.getPrecisionPosition(envs[envs.length - 1].position!);
    }
    const tabs = payloads.map((x) => {
      position = position - stepPosition;
@@ -100,7 +100,7 @@ export default class EnvService {
  }

  private async checkPosition(position: number, edge: number = 0) {
-    const precisionPosition = parseFloat(position.toPrecision(16));
+    const precisionPosition = this.getPrecisionPosition(position);
    if (
      precisionPosition < minPosition ||
      precisionPosition > maxPosition ||
@@ -116,7 +116,7 @@ export default class EnvService {
  }

  private getPrecisionPosition(position: number): number {
-    return parseFloat(position.toPrecision(16));
+    return Math.trunc(parseFloat(position.toPrecision(16)));
  }

  public async envs(searchText: string = '', query: any = {}): Promise<Env[]> {
@@ -147,6 +147,7 @@ export default class EnvService {
    }
    try {
      const result = await this.find(condition, [
+        [sequelize.literal('COALESCE(`isPinned`, 0)'), 'DESC'],
        ['position', 'DESC'],
        ['createdAt', 'ASC'],
      ]);
@@ -190,6 +191,52 @@ export default class EnvService {
    await this.set_envs();
  }

+  public async pin(ids: number[]) {
+    await EnvModel.update({ isPinned: 1 }, { where: { id: ids } });
+  }
+
+  public async unPin(ids: number[]) {
+    await EnvModel.update({ isPinned: 0 }, { where: { id: ids } });
+  }
+
+  public async addLabels(ids: number[], labels: string[]) {
+    await sequelize.transaction(async (transaction) => {
+      const docs = await EnvModel.findAll({
+        where: { id: ids },
+        transaction,
+      });
+      for (const doc of docs) {
+        const env = doc.get({ plain: true });
+        await EnvModel.update(
+          { labels: Array.from(new Set([...(env.labels || []), ...labels])) },
+          { where: { id: env.id }, transaction },
+        );
+      }
+    });
+    return await this.find({ id: ids });
+  }
+
+  public async removeLabels(ids: number[], labels: string[]) {
+    await sequelize.transaction(async (transaction) => {
+      const docs = await EnvModel.findAll({
+        where: { id: ids },
+        transaction,
+      });
+      for (const doc of docs) {
+        const env = doc.get({ plain: true });
+        await EnvModel.update(
+          {
+            labels: (env.labels || []).filter(
+              (label: string) => !labels.includes(label),
+            ),
+          },
+          { where: { id: env.id }, transaction },
+        );
+      }
+    });
+    return await this.find({ id: ids });
+  }
+
  public async set_envs() {
    const envs = await this.envs('', {
      name: { [Op.not]: null },
@@ -215,10 +262,9 @@ export default class EnvService {
            .map((x) => x.value)
            .join('&')
            .replace(/\\/g, '\\\\')}`;
-          js_env_string += `process.env.${key}=\`${_env_value.replace(
-            /\`/g,
-            '\\`',
-          )}\`;\n`;
+          js_env_string += `process.env[${JSON.stringify(key)}]=${JSON.stringify(
+            group.map((x) => x.value).join('&'),
+          )};\n`;
          py_env_string += `os.environ['${key}']='''${_env_value.replace(
            /\'/g,
            "\\'",
@@ -0,0 +1,94 @@
+import { Server, ServerCredentials } from '@grpc/grpc-js';
+import { CronService } from '../protos/cron';
+import { HealthService } from '../protos/health';
+import { ApiService } from '../protos/api';
+import { addCron } from '../schedule/addCron';
+import { delCron } from '../schedule/delCron';
+import { setConcurrency } from '../schedule/setConcurrency';
+import { check } from '../schedule/health';
+import * as Api from '../schedule/api';
+import Logger from '../loaders/logger';
+import { promisify } from 'util';
+import config from '../config';
+import { metricsService } from './metrics';
+import { Service } from 'typedi';
+import { initGrpcCerts } from '../config/grpcCerts';
+
+@Service()
+export class GrpcServerService {
+  private server: Server = new Server({ 'grpc.enable_http_proxy': 0 });
+
+  private formatGrpcAddress(host: string, port: number): string {
+    if (host === '::') {
+      return `[::]:${port}`;
+    }
+    return `${host}:${port}`;
+  }
+
+  async initialize() {
+    try {
+      this.server.addService(HealthService, { check });
+      this.server.addService(CronService, { addCron, delCron, setConcurrency });
+      this.server.addService(ApiService, Api);
+
+      const tlsConfig = await initGrpcCerts();
+      const credentials = ServerCredentials.createSsl(
+        Buffer.from(tlsConfig.caCert),
+        [{ cert_chain: Buffer.from(tlsConfig.serverCert), private_key: Buffer.from(tlsConfig.serverKey) }],
+        true,
+      );
+
+      const grpcPort = config.grpcPort;
+      const hostsToTry = [
+        config.bindHostGrpc,
+        ...(config.bindHostGrpc === '::' ? ['0.0.0.0'] : [])
+      ];
+      const bindAsync = promisify(this.server.bindAsync).bind(this.server);
+
+      let lastError: Error | null = null;
+
+      for (const host of hostsToTry) {
+        try {
+          const address = this.formatGrpcAddress(host, grpcPort);
+          const boundPort = await bindAsync(address, credentials);
+          Logger.debug(`[boot] gRPC service started successfully on ${address}`);
+          metricsService.record('grpc_service_start', 1, {
+            port: grpcPort.toString(),
+            host
+          });
+          return boundPort;
+        } catch (err) {
+          lastError = err as Error;
+          Logger.warn(`Failed to bind gRPC on ${host}:${grpcPort}, trying next...`, err);
+        }
+      }
+
+      Logger.error('Failed to start gRPC service on all hosts');
+      throw lastError || new Error('Failed to start gRPC service');
+    } catch (err) {
+      Logger.error('Failed to start gRPC service:', err);
+      throw err;
+    }
+  }
+
+  async shutdown() {
+    try {
+      if (this.server) {
+        await new Promise((resolve) => {
+          this.server.tryShutdown(() => {
+            Logger.debug('gRPC service stopped');
+            metricsService.record('grpc_service_stop', 1);
+            resolve(null);
+          });
+        });
+      }
+    } catch (err) {
+      Logger.error('Error while shutting down gRPC service:', err);
+      throw err;
+    }
+  }
+
+  getServer() {
+    return this.server;
+  }
+}
@@ -0,0 +1,71 @@
+import { Service } from 'typedi';
+import Logger from '../loaders/logger';
+import cronClient from '../schedule/client';
+import { HttpServerService } from './http';
+import { runtimeBuild } from '../shared/runtimeBuild';
+
+interface HealthStatus {
+  build: typeof runtimeBuild;
+  status: 'ok' | 'error';
+  services: {
+    http: boolean;
+    grpc: boolean;
+  };
+  metrics: {
+    uptime: number;
+    memory: {
+      used: number;
+      total: number;
+    };
+  };
+}
+
+@Service()
+export class HealthService {
+  private startTime = Date.now();
+
+  constructor(private httpServerService: HttpServerService) {}
+
+  async check(): Promise<HealthStatus> {
+    const status: HealthStatus = {
+      build: runtimeBuild,
+      status: 'ok',
+      services: {
+        http: true,
+        grpc: true,
+      },
+      metrics: {
+        uptime: Math.floor((Date.now() - this.startTime) / 1000),
+        memory: {
+          used: process.memoryUsage().heapUsed,
+          total: process.memoryUsage().heapTotal,
+        },
+      },
+    };
+
+    try {
+      const httpServer = this.httpServerService.getServer();
+      if (!httpServer) {
+        status.services.http = false;
+        status.status = 'error';
+      }
+    } catch (err) {
+      status.services.http = false;
+      status.status = 'error';
+      Logger.error('HTTP server check failed:', err);
+    }
+
+    try {
+      if (!(await cronClient.readiness.check())) {
+        status.services.grpc = false;
+        status.status = 'error';
+      }
+    } catch (err) {
+      status.services.grpc = false;
+      status.status = 'error';
+      Logger.error('gRPC server check failed:', err);
+    }
+
+    return status;
+  }
+}
@@ -0,0 +1,79 @@
+import express from 'express';
+import Logger from '../loaders/logger';
+import { metricsService } from './metrics';
+import { Service } from 'typedi';
+import { Server } from 'http';
+import config from '../config';
+
+@Service()
+export class HttpServerService {
+  private server?: Server = undefined;
+
+  async initialize(expressApp: express.Application, port: number) {
+    const hostsToTry = [
+      config.bindHost,
+      ...(config.bindHost === '::' ? ['0.0.0.0'] : [])
+    ];
+
+    let lastError: Error | null = null;
+
+    for (const host of hostsToTry) {
+      try {
+        const server = await this.tryListen(expressApp, port, host);
+        Logger.debug(`[boot] HTTP service started successfully on ${host}:${port}`);
+        metricsService.record('http_service_start', 1, {
+          port: port.toString(),
+          host
+        });
+        this.server = server;
+        return server;
+      } catch (err) {
+        lastError = err as Error;
+        Logger.warn(`Failed to bind HTTP on ${host}:${port}, trying next...`, err);
+      }
+    }
+
+    Logger.error('Failed to start HTTP service on all hosts');
+    throw lastError || new Error('Failed to start HTTP service');
+  }
+
+  private async tryListen(expressApp: express.Application, port: number, host: string): Promise<Server> {
+    return new Promise((resolve, reject) => {
+      // There is one HTTP worker; accepting here avoids primary IPC handoff
+      // for every connection. Restore shared listening for custom clusters.
+      const server = expressApp.listen({
+        port,
+        host,
+        exclusive: process.env.QL_HTTP_SHARED_LISTEN !== 'true',
+      }, () => {
+        resolve(server);
+      });
+
+      server.on('error', (err: Error) => {
+        server.close();
+        reject(err);
+      });
+    });
+  }
+
+  async shutdown() {
+    try {
+      if (this.server) {
+        await new Promise((resolve) => {
+          this.server?.close(() => {
+            Logger.debug('HTTP service stopped');
+            metricsService.record('http_service_stop', 1);
+            resolve(null);
+          });
+        });
+      }
+    } catch (err) {
+      Logger.error('Error while shutting down HTTP service:', err);
+      throw err;
+    }
+  }
+
+  getServer() {
+    return this.server;
+  }
+}
@@ -1,4 +1,4 @@
-import path from 'path';
+import { resolveFileAccess } from '../shared/fileAccess';
 import { Inject, Service } from 'typedi';
 import winston from 'winston';
 import config from '../config';
@@ -8,7 +8,6 @@ export default class LogService {
  constructor(@Inject('logger') private logger: winston.Logger) {}

  public checkFilePath(filePath: string, fileName: string) {
-    const finalPath = path.resolve(config.logPath, filePath, fileName);
-    return finalPath.startsWith(config.logPath) ? finalPath : '';
+    return resolveFileAccess(config.logPath, [filePath || '', fileName]);
  }
 }
@@ -0,0 +1,135 @@
+import { t } from '../shared/i18n';
+import { performance } from 'perf_hooks';
+import Logger from '../loaders/logger';
+
+interface Metric {
+  name: string;
+  value: number;
+  timestamp: number;
+  tags?: Record<string, string>;
+}
+
+export const MAX_METRIC_SAMPLES = 1000;
+const METRIC_RETENTION_MS = 60 * 60 * 1000;
+
+export class MetricsService {
+  private metrics: Array<Metric | undefined> = new Array(MAX_METRIC_SAMPLES);
+  private metricCount = 0;
+  private nextMetricIndex = 0;
+  private static instance: MetricsService;
+
+  private constructor() {
+    // 定期清理旧数据
+    const cleanupTimer = setInterval(() => this.removeExpiredMetrics(), 60000);
+    cleanupTimer.unref();
+  }
+
+  static getInstance(): MetricsService {
+    if (!MetricsService.instance) {
+      MetricsService.instance = new MetricsService();
+    }
+    return MetricsService.instance;
+  }
+
+  record(name: string, value: number, tags?: Record<string, string>) {
+    this.metrics[this.nextMetricIndex] = {
+      name,
+      value,
+      timestamp: Date.now(),
+      tags,
+    };
+    this.nextMetricIndex = (this.nextMetricIndex + 1) % MAX_METRIC_SAMPLES;
+    this.metricCount = Math.min(this.metricCount + 1, MAX_METRIC_SAMPLES);
+  }
+
+  measure(name: string, fn: () => void, tags?: Record<string, string>) {
+    const start = performance.now();
+    try {
+      fn();
+    } finally {
+      const duration = performance.now() - start;
+      this.record(name, duration, tags);
+    }
+  }
+
+  async measureAsync(
+    name: string,
+    fn: () => Promise<void>,
+    tags?: Record<string, string>,
+  ) {
+    const start = performance.now();
+    try {
+      await fn();
+    } finally {
+      const duration = performance.now() - start;
+      this.record(name, duration, tags);
+    }
+  }
+
+  getMetrics(name?: string, tags?: Record<string, string>) {
+    this.removeExpiredMetrics();
+    let filtered = this.getMetricSnapshot();
+
+    if (name) {
+      filtered = filtered.filter((m) => m.name === name);
+    }
+
+    if (tags) {
+      filtered = filtered.filter((m) => {
+        if (!m.tags) return false;
+        return Object.entries(tags).every(
+          ([key, value]) => m.tags![key] === value,
+        );
+      });
+    }
+
+    const values = filtered.map((metric) => metric.value);
+    return {
+      count: filtered.length,
+      average: values.length
+        ? values.reduce((acc, value) => acc + value, 0) / values.length
+        : 0,
+      min: values.length ? Math.min(...values) : 0,
+      max: values.length ? Math.max(...values) : 0,
+      metrics: filtered,
+    };
+  }
+
+  private getMetricSnapshot(): Metric[] {
+    if (this.metricCount < MAX_METRIC_SAMPLES) {
+      return this.metrics.slice(0, this.metricCount) as Metric[];
+    }
+    return [
+      ...this.metrics.slice(this.nextMetricIndex),
+      ...this.metrics.slice(0, this.nextMetricIndex),
+    ] as Metric[];
+  }
+
+  private removeExpiredMetrics() {
+    const oldestTimestamp = Date.now() - METRIC_RETENTION_MS;
+    const retained = this.getMetricSnapshot().filter(
+      (metric) => metric.timestamp > oldestTimestamp,
+    );
+    if (retained.length === this.metricCount) return;
+
+    this.metrics = new Array(MAX_METRIC_SAMPLES);
+    this.metricCount = 0;
+    this.nextMetricIndex = 0;
+    for (const metric of retained) {
+      this.metrics[this.nextMetricIndex] = metric;
+      this.nextMetricIndex = (this.nextMetricIndex + 1) % MAX_METRIC_SAMPLES;
+      this.metricCount++;
+    }
+  }
+
+  report() {
+    const report = {
+      timestamp: Date.now(),
+      metrics: this.getMetrics(),
+    };
+    Logger.info(t('性能指标报告:'), report);
+    return report;
+  }
+}
+
+export const metricsService = MetricsService.getInstance();
@@ -1,11 +1,13 @@
+import { persistNotificationAudit } from '../shared/notificationAudit';
 import crypto from 'crypto';
-import got from 'got';
-import { HttpProxyAgent, HttpsProxyAgent } from 'hpagent';
 import nodemailer from 'nodemailer';
 import { Inject, Service } from 'typedi';
 import { parseBody, parseHeaders } from '../config/util';
 import { NotificationInfo } from '../data/notify';
+import { t } from '../shared/i18n';
 import UserService from './user';
+import { httpClient } from '../config/http';
+import { ProxyAgent } from 'undici';

@Service()
 export default class NotificationService {
@@ -34,6 +36,9 @@ export default class NotificationService {
    ['chronocat', this.chronocat],
    ['ntfy', this.ntfy],
    ['wxPusherBot', this.wxPusherBot],
+    ['wxPusherSpt', this.wxPusherSpt],
+    ['openiLink', this.openiLink],
+    ['wpush', this.wpush],
  ]);

  private title = '';
@@ -49,20 +54,35 @@ export default class NotificationService {
  public async notify(
    title: string,
    content: string,
+    notificationInfo?: NotificationInfo,
  ): Promise<boolean | undefined> {
-    const { type, ...rest } = await this.userService.getNotificationMode();
-    if (type) {
-      this.title = title;
-      this.content = content;
-      this.params = rest;
-      const notificationModeAction = this.modeMap.get(type);
-      try {
-        return await notificationModeAction?.call(this);
-      } catch (error: any) {
-        throw error;
+    let type: string | undefined;
+    let success = false;
+    try {
+      const saved = await this.userService.getNotificationMode();
+      type = notificationInfo?.type || saved.type;
+      if (type) {
+        this.title = title;
+        this.content = content;
+        const { type: _, ...overrides } = notificationInfo || {};
+        const { type: _saved, ...rest } = saved;
+        this.params = { ...rest, ...overrides };
+        try {
+          success = !!(await this.modeMap.get(type)?.call(this));
+        } catch (error) {
+          console.error(error);
+        }
      }
+      return success;
+    } finally {
+      await persistNotificationAudit({
+        title,
+        content,
+        notifyType: type,
+        source: 'system',
+        status: success ? 0 : 1,
+      });
    }
-    return false;
  }

  public async testNotify(
@@ -71,21 +91,39 @@ export default class NotificationService {
    content: string,
  ) {
    const { type, ...rest } = info;
-    if (type) {
+    if (!type) return true;
+    let success = false;
+    try {
      this.title = title;
      this.content = content;
      this.params = rest;
-      const notificationModeAction = this.modeMap.get(type);
-      return await notificationModeAction?.call(this);
+      success = !!(await this.modeMap.get(type)?.call(this));
+      return success;
+    } finally {
+      await persistNotificationAudit({
+        title,
+        content,
+        notifyType: type,
+        source: 'system',
+        status: success ? 0 : 1,
+      });
    }
-    return true;
+  }
+
+  private parseMailRecipients(value?: string) {
+    const recipients = (value || '')
+      .split(/[;；]/)
+      .map((item) => item.trim())
+      .filter(Boolean);
+    return recipients.length > 0 ? recipients : undefined;
  }

  private async gotify() {
    const { gotifyUrl, gotifyToken, gotifyPriority = 1 } = this.params;
    try {
-      const res: any = await got
-        .post(`${gotifyUrl}/message?token=${gotifyToken}`, {
+      const res = await httpClient.post(
+        `${gotifyUrl}/message?token=${gotifyToken}`,
+        {
          ...this.gotOption,
          body: `title=${encodeURIComponent(
            this.title,
@@ -95,8 +133,8 @@ export default class NotificationService {
          headers: {
            'Content-Type': 'application/x-www-form-urlencoded',
          },
-        })
-        .json();
+        },
+      );
      if (typeof res.id === 'number') {
        return true;
      } else {
@@ -110,13 +148,11 @@ export default class NotificationService {
  private async goCqHttpBot() {
    const { goCqHttpBotQq, goCqHttpBotToken, goCqHttpBotUrl } = this.params;
    try {
-      const res: any = await got
-        .post(`${goCqHttpBotUrl}?${goCqHttpBotQq}`, {
-          ...this.gotOption,
-          json: { message: `${this.title}\n${this.content}` },
-          headers: { Authorization: 'Bearer ' + goCqHttpBotToken },
-        })
-        .json();
+      const res = await httpClient.post(`${goCqHttpBotUrl}?${goCqHttpBotQq}`, {
+        ...this.gotOption,
+        json: { message: `${this.title}\n${this.content}` },
+        headers: { Authorization: 'Bearer ' + goCqHttpBotToken },
+      });
      if (res.retcode === 0) {
        return true;
      } else {
@@ -136,15 +172,13 @@ export default class NotificationService {
        : `https://sctapi.ftqq.com/${serverChanKey}.send`;

    try {
-      const res: any = await got
-        .post(url, {
-          ...this.gotOption,
-          body: `title=${encodeURIComponent(
-            this.title,
-          )}&desp=${encodeURIComponent(this.content)}`,
-          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-        })
-        .json();
+      const res = await httpClient.post(url, {
+        ...this.gotOption,
+        body: `title=${encodeURIComponent(
+          this.title,
+        )}&desp=${encodeURIComponent(this.content)}`,
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      });
      if (res.errno === 0 || res.data.errno === 0) {
        return true;
      } else {
@@ -159,15 +193,13 @@ export default class NotificationService {
    const { pushDeerKey, pushDeerUrl } = this.params;
    const url = pushDeerUrl || `https://api2.pushdeer.com/message/push`;
    try {
-      const res: any = await got
-        .post(url, {
-          ...this.gotOption,
-          body: `pushkey=${pushDeerKey}&text=${encodeURIComponent(
-            this.title,
-          )}&desp=${encodeURIComponent(this.content)}&type=markdown`,
-          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-        })
-        .json();
+      const res = await httpClient.post(url, {
+        ...this.gotOption,
+        body: `pushkey=${pushDeerKey}&text=${encodeURIComponent(
+          this.title,
+        )}&desp=${encodeURIComponent(this.content)}&type=markdown`,
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      });
      if (
        res.content.result.length !== undefined &&
        res.content.result.length > 0
@@ -184,13 +216,11 @@ export default class NotificationService {
  private async chat() {
    const { synologyChatUrl } = this.params;
    try {
-      const res: any = await got
-        .post(synologyChatUrl, {
-          ...this.gotOption,
-          body: `payload={"text":"${this.title}\n${this.content}"}`,
-          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-        })
-        .json();
+      const res = await httpClient.post(synologyChatUrl, {
+        ...this.gotOption,
+        body: `payload={"text":"${this.title}\n${this.content}"}`,
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      });
      if (res.success) {
        return true;
      } else {
@@ -226,13 +256,11 @@ export default class NotificationService {
      url: barkUrl,
    };
    try {
-      const res: any = await got
-        .post(url, {
-          ...this.gotOption,
-          json: body,
-          headers: { 'Content-Type': 'application/json' },
-        })
-        .json();
+      const res = await httpClient.post(url, {
+        ...this.gotOption,
+        json: body,
+        headers: { 'Content-Type': 'application/json' },
+      });
      if (res.code === 200) {
        return true;
      } else {
@@ -258,29 +286,17 @@ export default class NotificationService {
    }/bot${telegramBotToken}/sendMessage`;
    let agent;
    if (telegramBotProxyHost && telegramBotProxyPort) {
-      const options: any = {
-        keepAlive: true,
-        keepAliveMsecs: 1000,
-        maxSockets: 256,
-        maxFreeSockets: 256,
-        proxy: `http://${authStr}${telegramBotProxyHost}:${telegramBotProxyPort}`,
-      };
-      const httpAgent = new HttpProxyAgent(options);
-      const httpsAgent = new HttpsProxyAgent(options);
-      agent = {
-        http: httpAgent,
-        https: httpsAgent,
-      };
+      agent = new ProxyAgent({
+        uri: `http://${authStr}${telegramBotProxyHost}:${telegramBotProxyPort}`,
+      });
    }
    try {
-      const res: any = await got
-        .post(url, {
-          ...this.gotOption,
-          body: `chat_id=${telegramBotUserId}&text=${this.title}\n\n${this.content}&disable_web_page_preview=true`,
-          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-          agent,
-        })
-        .json();
+      const res = await httpClient.post(url, {
+        ...this.gotOption,
+        body: `chat_id=${telegramBotUserId}&text=${this.title}\n\n${this.content}&disable_web_page_preview=true`,
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        dispatcher: agent,
+      });
      if (res.ok) {
        return true;
      } else {
@@ -303,17 +319,15 @@ export default class NotificationService {
    }
    const url = `https://oapi.dingtalk.com/robot/send?access_token=${dingtalkBotToken}${secretParam}`;
    try {
-      const res: any = await got
-        .post(url, {
-          ...this.gotOption,
-          json: {
-            msgtype: 'text',
-            text: {
-              content: ` ${this.title}\n\n${this.content}`,
-            },
+      const res = await httpClient.post(url, {
+        ...this.gotOption,
+        json: {
+          msgtype: 'text',
+          text: {
+            content: ` ${this.title}\n\n${this.content}`,
          },
-        })
-        .json();
+        },
+      });
      if (res.errcode === 0) {
        return true;
      } else {
@@ -329,17 +343,15 @@ export default class NotificationService {
      this.params;
    const url = `${weWorkOrigin}/cgi-bin/webhook/send?key=${weWorkBotKey}`;
    try {
-      const res: any = await got
-        .post(url, {
-          ...this.gotOption,
-          json: {
-            msgtype: 'text',
-            text: {
-              content: ` ${this.title}\n\n${this.content}`,
-            },
+      const res = await httpClient.post(url, {
+        ...this.gotOption,
+        json: {
+          msgtype: 'text',
+          text: {
+            content: ` ${this.title}\n\n${this.content}`,
          },
-        })
-        .json();
+        },
+      });
      if (res.errcode === 0) {
        return true;
      } else {
@@ -356,15 +368,13 @@ export default class NotificationService {
    const [corpid, corpsecret, touser, agentid, thumb_media_id = '1'] =
      weWorkAppKey.split(',');
    const url = `${weWorkOrigin}/cgi-bin/gettoken`;
-    const tokenRes: any = await got
-      .post(url, {
-        ...this.gotOption,
-        json: {
-          corpid,
-          corpsecret,
-        },
-      })
-      .json();
+    const tokenRes = await httpClient.post(url, {
+      ...this.gotOption,
+      json: {
+        corpid,
+        corpsecret,
+      },
+    });

    let options: any = {
      msgtype: 'mpnews',
@@ -373,7 +383,7 @@ export default class NotificationService {
          {
            title: `${this.title}`,
            thumb_media_id,
-            author: `智能助手`,
+            author: t('智能助手'),
            content_source_url: ``,
            content: `${this.content.replace(/\n/g, '<br/>')}`,
            digest: `${this.content}`,
@@ -389,7 +399,7 @@ export default class NotificationService {
            title: `${this.title}`,
            description: `${this.content}`,
            url: 'https://github.com/whyour/qinglong',
-            btntxt: '更多',
+            btntxt: t('更多'),
          },
        };
        break;
@@ -405,20 +415,18 @@ export default class NotificationService {
    }

    try {
-      const res: any = await got
-        .post(
-          `${weWorkOrigin}/cgi-bin/message/send?access_token=${tokenRes.access_token}`,
-          {
-            ...this.gotOption,
-            json: {
-              touser,
-              agentid,
-              safe: '0',
-              ...options,
-            },
+      const res = await httpClient.post(
+        `${weWorkOrigin}/cgi-bin/message/send?access_token=${tokenRes.access_token}`,
+        {
+          ...this.gotOption,
+          json: {
+            touser,
+            agentid,
+            safe: '0',
+            ...options,
          },
-        )
-        .json();
+        },
+      );

      if (res.errcode === 0) {
        return true;
@@ -442,7 +450,7 @@ export default class NotificationService {
          roomName: `${aibotkName}`,
          message: {
            type: 1,
-            content: `【青龙快讯】\n\n${this.title}\n${this.content}`,
+            content: `【${t('青龙快讯')}】\n\n${this.title}\n${this.content}`,
          },
        };
        break;
@@ -453,21 +461,19 @@ export default class NotificationService {
          name: `${aibotkName}`,
          message: {
            type: 1,
-            content: `【青龙快讯】\n\n${this.title}\n${this.content}`,
+            content: `【${t('青龙快讯')}】\n\n${this.title}\n${this.content}`,
          },
        };
        break;
    }

    try {
-      const res: any = await got
-        .post(url, {
-          ...this.gotOption,
-          json: {
-            ...json,
-          },
-        })
-        .json();
+      const res = await httpClient.post(url, {
+        ...this.gotOption,
+        json: {
+          ...json,
+        },
+      });
      if (res.code === 0) {
        return true;
      } else {
@@ -482,13 +488,11 @@ export default class NotificationService {
    const { iGotPushKey } = this.params;
    const url = `https://push.hellyw.com/${iGotPushKey.toLowerCase()}`;
    try {
-      const res: any = await got
-        .post(url, {
-          ...this.gotOption,
-          body: `title=${this.title}&content=${this.content}`,
-          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-        })
-        .json();
+      const res = await httpClient.post(url, {
+        ...this.gotOption,
+        body: `title=${this.title}&content=${this.content}`,
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      });

      if (res.ret === 0) {
        return true;
@@ -527,7 +531,7 @@ export default class NotificationService {
        },
      };

-      const res: any = await got.post(url, body).json();
+      const res = await httpClient.post(url, body);

      if (res.code === 200) {
        return true;
@@ -551,19 +555,17 @@ export default class NotificationService {

    const url = `https://www.weplusbot.com/send`;
    try {
-      const res: any = await got
-        .post(url, {
-          ...this.gotOption,
-          json: {
-            token: `${wePlusBotToken}`,
-            title: `${this.title}`,
-            template: `${template}`,
-            content: `${content}`,
-            receiver: `${wePlusBotReceiver || ''}`,
-            version: `${wePlusBotVersion || 'pro'}`,
-          },
-        })
-        .json();
+      const res = await httpClient.post(url, {
+        ...this.gotOption,
+        json: {
+          token: `${wePlusBotToken}`,
+          title: `${this.title}`,
+          template: `${template}`,
+          content: `${content}`,
+          receiver: `${wePlusBotReceiver || ''}`,
+          version: `${wePlusBotVersion || 'pro'}`,
+        },
+      });

      if (res.code === 200) {
        return true;
@@ -576,23 +578,35 @@ export default class NotificationService {
  }

  private async lark() {
-    let { larkKey } = this.params;
+    let { larkKey, larkSecret } = this.params;

    if (!larkKey.startsWith('http')) {
      larkKey = `https://open.feishu.cn/open-apis/bot/v2/hook/${larkKey}`;
    }

+    const body: Record<string, any> = {
+      msg_type: 'text',
+      content: { text: `${this.title}\n\n${this.content}` },
+    };
+
+    // Add signature if secret is provided
+    // Note: Feishu's signature algorithm uses timestamp+"\n"+secret as the HMAC key
+    // and signs an empty message, which differs from typical HMAC usage
+    if (larkSecret) {
+      const timestamp = Math.floor(Date.now() / 1000).toString();
+      const stringToSign = `${timestamp}\n${larkSecret}`;
+      const hmac = crypto.createHmac('sha256', stringToSign);
+      const sign = hmac.digest('base64');
+      body.timestamp = timestamp;
+      body.sign = sign;
+    }
+
    try {
-      const res: any = await got
-        .post(larkKey, {
-          ...this.gotOption,
-          json: {
-            msg_type: 'text',
-            content: { text: `${this.title}\n\n${this.content}` },
-          },
-          headers: { 'Content-Type': 'application/json' },
-        })
-        .json();
+      const res = await httpClient.post(larkKey, {
+        ...this.gotOption,
+        json: body,
+        headers: { 'Content-Type': 'application/json' },
+      });
      if (res.StatusCode === 0 || res.code === 0) {
        return true;
      } else {
@@ -604,7 +618,8 @@ export default class NotificationService {
  }

  private async email() {
-    const { emailPass, emailService, emailUser } = this.params;
+    const { emailPass, emailService, emailUser, emailTo } = this.params;
+    const recipients = this.parseMailRecipients(emailTo) || emailUser;

    try {
      const transporter = nodemailer.createTransport({
@@ -616,8 +631,8 @@ export default class NotificationService {
      });

      const info = await transporter.sendMail({
-        from: `"青龙快讯" <${emailUser}>`,
-        to: `${emailUser}`,
+        from: `"${t('青龙快讯')}" <${emailUser}>`,
+        to: recipients,
        subject: `${this.title}`,
        html: `${this.content.replace(/\n/g, '<br/>')}`,
      });
@@ -637,19 +652,22 @@ export default class NotificationService {
  private async pushMe() {
    const { pushMeKey, pushMeUrl } = this.params;
    try {
-      const res: any = await got.post(pushMeUrl || 'https://push.i-i.me/', {
-        ...this.gotOption,
-        json: {
-          push_key: pushMeKey,
-          title: this.title,
-          content: this.content,
+      const res = await httpClient.post<'text'>(
+        pushMeUrl || 'https://push.i-i.me/',
+        {
+          ...this.gotOption,
+          json: {
+            push_key: pushMeKey,
+            title: this.title,
+            content: this.content,
+          },
+          headers: { 'Content-Type': 'application/json' },
        },
-        headers: { 'Content-Type': 'application/json' },
-      });
-      if (res.body === 'success') {
+      );
+      if (res === 'success') {
        return true;
      } else {
-        throw new Error(res.body);
+        throw new Error(res);
      }
    } catch (error: any) {
      throw new Error(error.response ? error.response.body : error);
@@ -657,26 +675,49 @@ export default class NotificationService {
  }

  private async ntfy() {
-    const { ntfyUrl, ntfyTopic, ntfyPriority } = this.params;
+    const {
+      ntfyUrl,
+      ntfyTopic,
+      ntfyPriority,
+      ntfyToken,
+      ntfyUsername,
+      ntfyPassword,
+      ntfyActions,
+    } = this.params;
    // 编码函数
    const encodeRfc2047 = (text: string, charset: string = 'UTF-8'): string => {
      const encodedText = Buffer.from(text).toString('base64');
      return `=?${charset}?B?${encodedText}?=`;
    };
    try {
-      const encodedTitle = encodeRfc2047(this.title);
-      const res: any = await got.post(
+      const headers: Record<string, string> = {
+        Title: encodeRfc2047(this.title),
+        Priority: `${ntfyPriority || '3'}`,
+        Icon: 'https://qn.whyour.cn/logo.png',
+      };
+      if (ntfyToken) {
+        headers['Authorization'] = `Bearer ${ntfyToken}`;
+      } else if (ntfyUsername && ntfyPassword) {
+        headers['Authorization'] = `Basic ${Buffer.from(
+          `${ntfyUsername}:${ntfyPassword}`,
+        ).toString('base64')}`;
+      }
+      if (ntfyActions) {
+        headers['Actions'] = encodeRfc2047(ntfyActions);
+      }
+      const res = await httpClient.request(
        `${ntfyUrl || 'https://ntfy.sh'}/${ntfyTopic}`,
        {
          ...this.gotOption,
          body: `${this.content}`,
-          headers: { Title: encodedTitle, Priority: `${ntfyPriority || '3'}` },
+          headers: headers,
+          method: 'POST',
        },
      );
      if (res.statusCode === 200) {
        return true;
      } else {
-        throw new Error(JSON.stringify(res));
+        throw new Error(await res.body.text());
      }
    } catch (error: any) {
      throw new Error(error.response ? error.response.body : error);
@@ -705,25 +746,69 @@ export default class NotificationService {

    // topic_ids 和 uids 至少要有一个
    if (!topicIds.length && !uids.length) {
-      throw new Error('wxPusher 服务的 TopicIds 和 Uids 至少配置一个才行');
+      throw new Error(t('wxPusher 服务的 TopicIds 和 Uids 至少配置一个才行'));
    }

    const url = `https://wxpusher.zjiecode.com/api/send/message`;
    try {
-      const res: any = await got
-        .post(url, {
-          ...this.gotOption,
-          json: {
-            appToken: wxPusherBotAppToken,
-            content: `<h1>${this.title}</h1><br/><div style='white-space: pre-wrap;'>${this.content}</div>`,
-            summary: this.title,
-            contentType: 2,
-            topicIds: topicIds,
-            uids: uids,
-            verifyPayType: 0,
-          },
-        })
-        .json();
+      const res = await httpClient.post(url, {
+        ...this.gotOption,
+        json: {
+          appToken: wxPusherBotAppToken,
+          content: `<h1>${this.title}</h1><br/><div style='white-space: pre-wrap;'>${this.content}</div>`,
+          summary: this.title,
+          contentType: 2,
+          topicIds: topicIds,
+          uids: uids,
+          verifyPayType: 0,
+        },
+      });
+
+      if (res.code === 1000) {
+        return true;
+      } else {
+        throw new Error(JSON.stringify(res));
+      }
+    } catch (error: any) {
+      throw new Error(error.response ? error.response.body : error);
+    }
+  }
+
+  private async wxPusherSpt() {
+    const { wxPusherSptList } = this.params;
+    // 处理 SPT，将逗号分隔的字符串转为数组
+    const spts = wxPusherSptList
+      ? wxPusherSptList
+          .split(',')
+          .map((spt) => spt.trim())
+          .filter((spt) => spt)
+      : [];
+
+    if (!spts.length) {
+      throw new Error(t('wxPusher SPT 不能为空'));
+    }
+    if (spts.length > 10) {
+      throw new Error(t('wxPusher SPT 最多支持 10 个'));
+    }
+
+    const url = `https://wxpusher.zjiecode.com/api/send/message/simple-push`;
+    const json: any = {
+      content: `<h1>${this.title}</h1><br/><div style='white-space: pre-wrap;'>${this.content}</div>`,
+      summary: this.title,
+      contentType: 2,
+    };
+    // 单个 SPT 用 spt，多个用 sptList
+    if (spts.length === 1) {
+      json.spt = spts[0];
+    } else {
+      json.sptList = spts;
+    }
+
+    try {
+      const res = await httpClient.post(url, {
+        ...this.gotOption,
+        json,
+      });

      if (res.code === 1000) {
        return true;
@@ -774,15 +859,16 @@ export default class NotificationService {
              },
            ],
          };
-          const res: any = await got.post(url, {
+          const res = await httpClient.request(url, {
            ...this.gotOption,
            json: data,
            headers,
+            method: 'POST',
          });
          if (res.statusCode === 200) {
            return true;
          } else {
-            throw new Error(res.body);
+            throw new Error(await res.body.text());
          }
        }
      }
@@ -802,7 +888,7 @@ export default class NotificationService {
    } = this.params;

    if (!webhookUrl?.includes('$title') && !webhookBody?.includes('$title')) {
-      throw new Error('Url 或者 Body 中必须包含 $title');
+      throw new Error(t('Url 或者 Body 中必须包含 $title'));
    }

    const headers = parseHeaders(webhookHeaders);
@@ -817,15 +903,17 @@ export default class NotificationService {
      allowGetBody: true,
      ...bodyParam,
    };
+
    try {
      const formatUrl = webhookUrl
        ?.replaceAll('$title', encodeURIComponent(this.title))
        ?.replaceAll('$content', encodeURIComponent(this.content));
-      const res = await got(formatUrl, options);
+      const res = await httpClient.request(formatUrl, options);
+      const text = await res.body.text();
      if (String(res.statusCode).startsWith('20')) {
        return true;
      } else {
-        throw new Error(JSON.stringify(res));
+        throw new Error(await res.body.text());
      }
    } catch (error: any) {
      throw new Error(error.response ? error.response.body : error);
@@ -845,4 +933,62 @@ export default class NotificationService {
    }
    return {};
  }
+
+  private async openiLink() {
+    const { openiLinkAppToken, openiLinkHubUrl, openiLinkContextToken } =
+      this.params;
+    const baseUrl =
+      openiLinkHubUrl?.replace(/\/$/, '') || 'https://hub.openilink.com';
+    const url = `${baseUrl}/bot/v1/message/send`;
+    const body: Record<string, string> = {
+      type: 'text',
+      content: `${this.title}\n\n${this.content}`,
+    };
+    if (openiLinkContextToken) {
+      body.context_token = openiLinkContextToken;
+    }
+    try {
+      const res = await httpClient.post(url, {
+        ...this.gotOption,
+        json: body,
+        headers: {
+          'Content-Type': 'application/json',
+          Authorization: `Bearer ${openiLinkAppToken}`,
+        },
+      });
+      if (res.ok) {
+        return true;
+      } else {
+        throw new Error(JSON.stringify(res));
+      }
+    } catch (error: any) {
+      throw new Error(error.response ? error.response.body : error);
+    }
+  }
+  private async wpush() {
+    const { wpushApiKey, wpushChannel, wpushTopicCode } = this.params;
+    const url = 'https://api.wpush.cn/api/v1/send';
+    const json: Record<string, string> = {
+      apikey: `${wpushApiKey}`,
+      title: `${this.title}`,
+      content: `${this.content}`,
+      channel: `${wpushChannel || 'wechat'}`,
+    };
+    if (wpushTopicCode) {
+      json.topic_code = `${wpushTopicCode}`;
+    }
+    try {
+      const res = await httpClient.post(url, {
+        ...this.gotOption,
+        json,
+      });
+      if (res.code === 0) {
+        return true;
+      } else {
+        throw new Error(JSON.stringify(res));
+      }
+    } catch (error: any) {
+      throw new Error(error.response ? error.response.body : error);
+    }
+  }
 }
@@ -5,27 +5,78 @@ import { App, AppModel } from '../data/open';
 import { v4 as uuidV4 } from 'uuid';
 import sequelize, { Op } from 'sequelize';
 import { shareStore } from '../shared/store';
+import { t } from '../shared/i18n';
+import { lock } from 'proper-lockfile';
+import path from 'path';
+import os from 'os';
+import { writeFile, rename, rm, stat, chmod } from 'fs/promises';
+import config from '../config';

@Service()
 export default class OpenService {
  constructor(@Inject('logger') private logger: winston.Logger) {}

+  // Every database mutation and full authentication-cache publication shares
+  // this cross-process lock. Lock a separate marker, not token.json itself.
+  private async withAppsLock<T>(operation: () => Promise<T>): Promise<T> {
+    const target = path.join(config.configPath, '.apps-state');
+    const release = await lock(target, {
+      realpath: false,
+      stale: 10_000,
+      retries: { retries: 10, factor: 2, minTimeout: 100, maxTimeout: 3000 },
+    });
+    try {
+      return await operation();
+    } finally {
+      await release();
+    }
+  }
+
+  public async initializeSystemApp(): Promise<void> {
+    await this.withAppsLock(async () => {
+      const doc = await AppModel.findOne({ where: { name: 'system' } });
+      const app = doc?.get({ plain: true });
+      if (!app) {
+        await this.insert({
+          name: 'system',
+          scopes: ['crons', 'system', 'dashboard'],
+          client_id: createRandomString(12, 12),
+          client_secret: createRandomString(24, 24),
+        });
+      } else if (!app.scopes.includes('dashboard')) {
+        await AppModel.update(
+          { scopes: [...app.scopes, 'dashboard'] },
+          { where: { id: app.id } },
+        );
+      }
+      await shareStore.updateApps(await this.find({}));
+    });
+  }
+
+  public async refreshApps(): Promise<void> {
+    await this.withAppsLock(async () => {
+      await shareStore.updateApps(await this.find({}));
+    });
+  }
+
  public async findApps(): Promise<App[] | null> {
    const docs = await this.find({});
    return docs;
  }

  public async create(payload: App): Promise<App> {
-    const tab = { ...payload };
-    tab.client_id = createRandomString(12, 12);
-    tab.client_secret = createRandomString(24, 24);
-    const doc = await this.insert(tab);
-    const apps = await this.find({});
-    await shareStore.updateApps(apps);
-    return { ...doc, tokens: [] };
+    return this.withAppsLock(async () => {
+      const tab = { ...payload };
+      tab.client_id = createRandomString(12, 12);
+      tab.client_secret = createRandomString(24, 24);
+      const doc = await this.insert(tab);
+      const apps = await this.find({});
+      await shareStore.updateApps(apps);
+      return { ...doc, tokens: [] };
+    });
  }

-  public async insert(payload: App): Promise<App> {
+  private async insert(payload: App): Promise<App> {
    const doc = await AppModel.create(payload, { returning: true });
    return doc.get({ plain: true });
  }
@@ -40,10 +91,12 @@ export default class OpenService {
  }

  private async updateDb(payload: Partial<App>): Promise<App> {
-    await AppModel.update(payload, { where: { id: payload.id } });
-    const apps = await this.find({});
-    await shareStore.updateApps(apps);
-    return apps?.find((x) => x.id === payload.id) as App;
+    return this.withAppsLock(async () => {
+      await AppModel.update(payload, { where: { id: payload.id } });
+      const apps = await this.find({});
+      await shareStore.updateApps(apps);
+      return apps?.find((x) => x.id === payload.id) as App;
+    });
  }

  public async getDb(query: Record<string, any>): Promise<App> {
@@ -55,9 +108,11 @@ export default class OpenService {
  }

  public async remove(ids: number[]) {
-    await AppModel.destroy({ where: { id: ids } });
-    const apps = await this.find({});
-    await shareStore.updateApps(apps);
+    return this.withAppsLock(async () => {
+      await AppModel.destroy({ where: { id: ids } });
+      const apps = await this.find({});
+      await shareStore.updateApps(apps);
+    });
  }

  public async resetSecret(id: number): Promise<App> {
@@ -111,7 +166,15 @@ export default class OpenService {
    return docs.map((x) => x.get({ plain: true }));
  }

-  public async authToken({
+  public async authToken(credentials: {
+    client_id: string;
+    client_secret: string;
+  }): Promise<any> {
+    return this.withAppsLock(() => this.issueToken(credentials));
+  }
+
+  // Caller holds withAppsLock through database update and cache publication.
+  private async issueToken({
    client_id,
    client_secret,
  }: {
@@ -151,31 +214,51 @@ export default class OpenService {
        },
      };
    } else {
-      return { code: 400, message: 'client_id 或 client_seret 有误' };
+      return { code: 400, message: t('client_id 或 client_seret 有误') };
    }
  }

-  public async generateSystemToken(): Promise<{
+  public async generateSystemToken(renew = false): Promise<{
    value: string;
    expiration: number;
  }> {
-    const apps = await shareStore.getApps();
-    const systemApp = apps?.find((x) => x.name === 'system');
-    if (!systemApp) {
-      throw new Error('system app not found');
-    }
-    const now = Math.round(Date.now() / 1000);
-    const currentToken = systemApp.tokens?.find((x) => x.expiration > now);
-    if (currentToken) {
-      return currentToken;
-    }
-    const { data } = await this.authToken({
-      client_id: systemApp.client_id,
-      client_secret: systemApp.client_secret,
+    return this.withAppsLock(async () => {
+      // Read after acquiring the lock; a concurrent issuer may have renewed.
+      const systemApp = await this.getDb({ name: 'system' });
+      const now = Math.round(Date.now() / 1000);
+      let appToken = systemApp.tokens
+        ?.filter((token) => token.expiration > now)
+        .sort((left, right) => right.expiration - left.expiration)[0];
+      if (renew || !appToken) {
+        const { data } = await this.issueToken({
+          client_id: systemApp.client_id,
+          client_secret: systemApp.client_secret,
+        });
+        appToken = { value: data.token, expiration: data.expiration };
+      } else {
+        // Recover a prior database commit whose cache publication failed.
+        await shareStore.updateApps(await this.find({}));
+      }
+      const tokenFile = path.join(config.configPath, 'token.json');
+      const temporaryFile = `${tokenFile}.${process.pid}.tmp`;
+      const mode = await stat(tokenFile).then(
+        (file) => file.mode & 0o777,
+        (error: NodeJS.ErrnoException) => {
+          if (error.code === 'ENOENT') return 0o600;
+          throw error;
+        },
+      );
+      try {
+        await writeFile(temporaryFile, `${JSON.stringify(appToken)}${os.EOL}`, {
+          mode,
+        });
+        await chmod(temporaryFile, mode);
+        // Shell readers see a complete old or new document, never a partial one.
+        await rename(temporaryFile, tokenFile);
+      } finally {
+        await rm(temporaryFile, { force: true });
+      }
+      return appToken;
    });
-    return {
-      ...data,
-      value: data.token,
-    };
  }
 }
@@ -0,0 +1,155 @@
+import fs from 'fs/promises';
+import path from 'path';
+import dayjs from 'dayjs';
+import { Op } from 'sequelize';
+import { Service } from 'typedi';
+import config from '../config';
+import { CrontabStatModel } from '../data/cronStats';
+import { sequelize } from '../data';
+import { InstanceStatus, RunningInstanceModel } from '../data/runningInstance';
+import { AuthDataType, SystemModel } from '../data/system';
+import {
+  DependenceCacheType,
+  getDirectorySize,
+  isDependenceCacheType,
+  normalizeRetentionPolicy,
+  RetentionPolicy,
+} from '../shared/retention';
+
+export interface StorageCleanupRequest extends RetentionPolicy {
+  dependenceCacheTypes?: DependenceCacheType[];
+  compactDatabase?: boolean;
+}
+
+function runningInstanceWhere(days: number) {
+  const cutoff = dayjs().subtract(days, 'day').unix();
+  return {
+    status: { [Op.ne]: InstanceStatus.running },
+    [Op.or]: [
+      { finished_at: { [Op.lt]: cutoff } },
+      {
+        finished_at: { [Op.is]: null },
+        started_at: { [Op.lt]: cutoff },
+      },
+    ],
+  };
+}
+
+function cronStatWhere(days: number) {
+  return {
+    date: { [Op.lt]: dayjs().subtract(days, 'day').format('YYYY-MM-DD') },
+  };
+}
+
+@Service()
+export default class RetentionService {
+  public async updatePolicy(policy: Partial<RetentionPolicy>) {
+    const normalized = normalizeRetentionPolicy(policy);
+    const systemConfig = await SystemModel.findOne({
+      where: { type: AuthDataType.systemConfig },
+    });
+    if (!systemConfig) {
+      throw new Error('System config not found');
+    }
+    await SystemModel.update(
+      {
+        info: {
+          ...systemConfig.info,
+          ...normalized,
+        },
+      },
+      { where: { id: systemConfig.id } },
+    );
+    return normalized;
+  }
+
+  public async preview(request: StorageCleanupRequest) {
+    const policy = normalizeRetentionPolicy(request);
+    const dependenceCacheTypes = (request.dependenceCacheTypes || []).filter(
+      isDependenceCacheType,
+    );
+    const [runningInstances, cronStats, dependenceCaches] = await Promise.all([
+      policy.runningInstanceRetentionDays > 0
+        ? RunningInstanceModel.count({
+            where: runningInstanceWhere(policy.runningInstanceRetentionDays),
+          })
+        : 0,
+      policy.cronStatRetentionDays > 0
+        ? CrontabStatModel.count({
+            where: cronStatWhere(policy.cronStatRetentionDays),
+          })
+        : 0,
+      Promise.all(
+        dependenceCacheTypes.map(async (type) => ({
+          type,
+          bytes: await getDirectorySize(
+            path.join(config.dependenceCachePath, type),
+          ),
+        })),
+      ),
+    ]);
+
+    return {
+      policy,
+      runningInstances,
+      cronStats,
+      dependenceCaches,
+      dependenceCacheBytes: dependenceCaches.reduce(
+        (total, cache) => total + cache.bytes,
+        0,
+      ),
+      compactDatabase: Boolean(request.compactDatabase),
+    };
+  }
+
+  public async cleanup(request: StorageCleanupRequest) {
+    const preview = await this.preview(request);
+    const deleted = await sequelize.transaction(async (transaction) => {
+      const runningInstances =
+        preview.policy.runningInstanceRetentionDays > 0
+          ? await RunningInstanceModel.destroy({
+              where: runningInstanceWhere(
+                preview.policy.runningInstanceRetentionDays,
+              ),
+              transaction,
+            })
+          : 0;
+      const cronStats =
+        preview.policy.cronStatRetentionDays > 0
+          ? await CrontabStatModel.destroy({
+              where: cronStatWhere(preview.policy.cronStatRetentionDays),
+              transaction,
+            })
+          : 0;
+      return { runningInstances, cronStats };
+    });
+
+    const dependenceCaches = [];
+    for (const cache of preview.dependenceCaches) {
+      await fs.rm(path.join(config.dependenceCachePath, cache.type), {
+        recursive: true,
+        force: true,
+      });
+      dependenceCaches.push(cache);
+    }
+
+    if (
+      request.compactDatabase &&
+      (deleted.runningInstances || deleted.cronStats)
+    ) {
+      await sequelize.query('VACUUM');
+    }
+
+    return {
+      deleted: {
+        ...deleted,
+        dependenceCaches,
+        dependenceCacheBytes: preview.dependenceCacheBytes,
+      },
+      compactedDatabase: Boolean(
+        request.compactDatabase &&
+          (deleted.runningInstances || deleted.cronStats),
+      ),
+    };
+  }
+}
@@ -1,6 +1,7 @@
+import { t } from '../shared/i18n';
 import { Service, Inject } from 'typedi';
 import winston from 'winston';
-import nodeSchedule from 'node-schedule';
+import { createCronJob, CronJob } from '../shared/cronScheduler';
 import { ChildProcessWithoutNullStreams } from 'child_process';
 import {
  ToadScheduler,
@@ -11,6 +12,11 @@ import {
 import dayjs from 'dayjs';
 import taskLimit from '../shared/pLimit';
 import { spawn } from 'cross-spawn';
+import {
+  observeChildProcess,
+  asError,
+  ProcessResult,
+} from '../shared/childProcess';

 export interface ScheduleTaskType {
  id?: number;
@@ -27,7 +33,7 @@ export interface TaskCallbacks {
    startTime: dayjs.Dayjs,
  ) => Promise<void>;
  onEnd?: (
-    cp: ChildProcessWithoutNullStreams,
+    cp: ChildProcessWithoutNullStreams | undefined,
    endTime: dayjs.Dayjs,
    diff: number,
  ) => Promise<void>;
@@ -37,7 +43,7 @@ export interface TaskCallbacks {

@Service()
 export default class ScheduleService {
-  private scheduleStacks = new Map<string, nodeSchedule.Job>();
+  private scheduleStacks = new Map<string, CronJob>();

  private intervalSchedule = new ToadScheduler();

@@ -63,73 +69,85 @@ export default class ScheduleService {
  ) {
    const { runOrigin, ...others } = params;

-    return taskLimit[this.taskLimitMap[runOrigin]](others, () => {
-      return new Promise(async (resolve, reject) => {
-        this.logger.info(
-          `[panel][开始执行任务] 参数: ${JSON.stringify({
-            ...others,
-            command,
-          })}`,
-        );
-
-        try {
-          const startTime = dayjs();
-          await callbacks.onBefore?.(startTime);
-
-          const cp = spawn(command, { shell: '/bin/bash' });
-
-          callbacks.onStart?.(cp, startTime);
-          completionTime === 'start' && resolve(cp.pid);
-
-          cp.stdout.on('data', async (data) => {
-            await callbacks.onLog?.(data.toString());
-          });
-
-          cp.stderr.on('data', async (data) => {
-            this.logger.info(
-              '[panel][执行任务失败] 命令: %s, 错误信息: %j',
-              command,
-              data.toString(),
-            );
-            await callbacks.onError?.(data.toString());
-          });
-
-          cp.on('error', async (err) => {
-            this.logger.error(
-              '[panel][创建任务失败] 命令: %s, 错误信息: %j',
-              command,
-              err,
-            );
-            await callbacks.onError?.(JSON.stringify(err));
-          });
-
-          cp.on('exit', async (code) => {
-            this.logger.info(
-              '[panel][执行任务结束] 参数: %s, 退出码: %j',
-              JSON.stringify({
-                ...others,
-                command,
-              }),
-              code,
-            );
-            const endTime = dayjs();
-            await callbacks.onEnd?.(
-              cp,
-              endTime,
-              endTime.diff(startTime, 'seconds'),
-            );
-            resolve({ ...others, pid: cp.pid, code });
-          });
-        } catch (error) {
-          this.logger.error(
-            '[panel][执行任务失败] 命令: %s, 错误信息: %j',
-            command,
-            error,
-          );
-          await callbacks.onError?.(JSON.stringify(error));
-        }
-      });
+    let resolveStart!: (pid: number | undefined) => void;
+    let rejectStart!: (error: Error) => void;
+    const startResult = new Promise<number | undefined>((resolve, reject) => {
+      resolveStart = resolve;
+      rejectStart = reject;
    });
+    // Most scheduled callers only observe completion (or intentionally detach).
+    void startResult.catch(() => {});
+    const completion = taskLimit[this.taskLimitMap[runOrigin]](
+      others,
+      async () => {
+        const startTime = dayjs();
+        let cp: ChildProcessWithoutNullStreams | undefined;
+        let result: ProcessResult = { code: null, signal: null };
+        try {
+          this.logger.info(t('[panel][开始执行任务] 任务ID: %s'), others.id);
+          await callbacks.onBefore?.(startTime);
+          cp = spawn(command, { shell: '/bin/bash' });
+          const child = cp;
+          const observed = observeChildProcess(child, {
+            onStart: async () => {
+              await callbacks.onStart?.(child, startTime);
+            },
+            onStdout: callbacks.onLog,
+            onStderr: callbacks.onError,
+          });
+          observed.started.then(resolveStart, rejectStart);
+          result = await observed.completed;
+        } catch (error) {
+          result.error = asError(error);
+          rejectStart(result.error);
+        }
+
+        if (result.error) {
+          this.logger.error(
+            t('[panel][执行任务失败] 任务ID: %s, 错误: %s'),
+            others.id,
+            result.error.message,
+          );
+          try {
+            await callbacks.onError?.(result.error.message);
+          } catch (error) {
+            this.logger.error(
+              t('[panel][任务错误回调失败] %s'),
+              asError(error).message,
+            );
+          }
+        }
+        // Cleanup also runs after setup/spawn failure, and only after both pipes drain.
+        const endTime = dayjs();
+        try {
+          await callbacks.onEnd?.(
+            cp,
+            endTime,
+            endTime.diff(startTime, 'seconds'),
+          );
+        } catch (error) {
+          result.error ??= asError(error);
+          this.logger.error(
+            t('[panel][任务结束回调失败] %s'),
+            asError(error).message,
+          );
+        }
+        this.logger.info(
+          t('[panel][执行任务结束] 任务ID: %s, 退出码: %j'),
+          others.id,
+          result.code,
+        );
+        return { ...others, pid: cp?.pid, ...result };
+      },
+    ).catch((error) => {
+      // Queue/setup failures must not become unhandled rejections in detached callers.
+      rejectStart(asError(error));
+      this.logger.error(t('[panel][任务队列失败] %s'), asError(error).message);
+      return { ...others, code: null, signal: null, error: asError(error) };
+    });
+
+    // Returning a PID must not release the execution slot while the process runs.
+    return completionTime === 'start' ? startResult : completion;
  }

  async createCronTask(
@@ -139,25 +157,40 @@ export default class ScheduleService {
  ) {
    const _id = this.formatId(id);
    this.logger.info(
-      '[panel][创建cron任务], 任务ID: %s, cron: %s, 任务名: %s, 执行命令: %s',
+      t('[panel][创建cron任务] 任务ID: %s, cron: %s, 任务名: %s, 执行命令: %s'),
      _id,
      schedule,
      name,
      command,
    );

-    this.scheduleStacks.set(
-      _id,
-      nodeSchedule.scheduleJob(_id, schedule, async () => {
-        this.runTask(command, callbacks, {
-          name,
+    if (schedule) {
+      try {
+        const job = createCronJob(
          schedule,
-          command,
-          id: _id,
-          runOrigin,
-        });
-      }),
-    );
+          () =>
+            this.runTask(command, callbacks, {
+              name,
+              schedule,
+              command,
+              id: _id,
+              runOrigin,
+            }),
+          { name: `${_id}: ${name || ''}`, logger: this.logger, start: false },
+        );
+        this.scheduleStacks.get(_id)?.cancel();
+        this.scheduleStacks.set(_id, job);
+        job.start();
+      } catch (error) {
+        // A persisted invalid subscription must not become an unhandled startup rejection.
+        this.logger.warn(
+          t('[panel][跳过无效定时任务] 任务ID: %s, cron: %s, 错误: %s'),
+          _id,
+          schedule,
+          asError(error).message,
+        );
+      }
+    }

    if (runImmediately) {
      this.runTask(command, callbacks, {
@@ -172,7 +205,7 @@ export default class ScheduleService {

  async cancelCronTask({ id = 0, name }: ScheduleTaskType) {
    const _id = this.formatId(id);
-    this.logger.info('[panel][取消定时任务], 任务名: %s', name);
+    this.logger.info(t('[panel][取消定时任务] 任务名: %s'), name);
    if (this.scheduleStacks.has(_id)) {
      this.scheduleStacks.get(_id)?.cancel();
      this.scheduleStacks.delete(_id);
@@ -187,7 +220,7 @@ export default class ScheduleService {
  ) {
    const _id = this.formatId(id);
    this.logger.info(
-      '[panel][创建interval任务], 任务ID: %s, 任务名: %s, 执行命令: %s',
+      t('[panel][创建interval任务] 任务ID: %s, 任务名: %s, 执行命令: %s'),
      _id,
      name,
      command,
@@ -204,7 +237,7 @@ export default class ScheduleService {
      },
      (err) => {
        this.logger.error(
-          '[panel][执行任务失败] 命令: %s, 错误信息: %j',
+          t('[panel][执行任务失败] 命令: %s, 错误信息: %j'),
          command,
          err,
        );
@@ -232,7 +265,7 @@ export default class ScheduleService {
  async cancelIntervalTask({ id = 0, name }: ScheduleTaskType) {
    const _id = this.formatId(id);
    this.logger.info(
-      '[panel][取消interval任务], 任务ID: %s, 任务名: %s',
+      t('[panel][取消interval任务] 任务ID: %s, 任务名: %s'),
      _id,
      name,
    );
@@ -1,3 +1,4 @@
+import { resolveFileAccess } from '../shared/fileAccess';
 import { Service, Inject } from 'typedi';
 import winston from 'winston';
 import path, { join } from 'path';
@@ -57,16 +58,15 @@ export default class ScriptService {
      taskLimit.removeQueuedCron(relativePath.replace(/ /g, '-'));
      pid = (await getPid(`${TASK_COMMAND} ${relativePath} now`)) as number;
    }
-    try {
-      await killTask(pid);
-    } catch (error) {}
+    if (pid) {
+      await killTask(pid, true);
+    }

    return { code: 200 };
  }

  public checkFilePath(filePath: string, fileName: string) {
-    const finalPath = path.resolve(config.scriptPath, filePath, fileName);
-    return finalPath.startsWith(config.scriptPath) ? finalPath : '';
+    return resolveFileAccess(config.scriptPath, [filePath || '', fileName]);
  }

  public async getFile(filePath: string, fileName: string) {
@@ -0,0 +1,12 @@
+import path from 'path';
+import { Service } from 'typedi';
+import config from '../config';
+import { ScriptHistory } from '../shared/scriptHistory';
+
+/** Panel configuration and lifecycle; the storage core stays independently testable. */
+@Service()
+export default class ScriptHistoryService extends ScriptHistory {
+  constructor() {
+    super(config.scriptPath, path.join(config.dataPath, 'script-history'));
+  }
+}
@@ -1,3 +1,4 @@
+import { t } from '../shared/i18n';
 import { Service, Inject } from 'typedi';
 import winston from 'winston';
 import fs from 'fs/promises';
@@ -8,10 +9,22 @@ import { formatUrl } from '../config/subscription';
 import config from '../config';
 import { fileExist, rmPath } from '../config/util';
 import { writeFileWithLock } from '../shared/utils';
+import {
+  getSubscriptionSshAlias,
+  resolveSubscriptionPath,
+} from '../shared/subscriptionPath';

@Service()
 export default class SshKeyService {
-  private homedir = os.homedir();
+  // OpenSSH uses the effective user's passwd entry, not the HOME override.
+  private get homedir(): string {
+    try {
+      return os.userInfo().homedir;
+    } catch {
+      // Custom container UIDs may have no passwd entry. Keep startup working.
+      return os.homedir();
+    }
+  }
  private sshPath = config.sshdPath;
  private sshConfigFilePath = path.resolve(this.homedir, '.ssh', 'config');
  private sshConfigHeader = `Include ${path.join(this.sshPath, '*.config')}`;
@@ -21,17 +34,22 @@ export default class SshKeyService {
  }

  private async initSshConfigFile() {
+    await fs.mkdir(path.dirname(this.sshConfigFilePath), {
+      recursive: true,
+      mode: 0o700,
+    });
    let config = '';
    const _exist = await fileExist(this.sshConfigFilePath);
    if (_exist) {
      config = await fs.readFile(this.sshConfigFilePath, { encoding: 'utf-8' });
    } else {
-      await writeFileWithLock(this.sshConfigFilePath, '');
+      await writeFileWithLock(this.sshConfigFilePath, '', { mode: '600' });
    }
    if (!config.includes(this.sshConfigHeader)) {
      await writeFileWithLock(
        this.sshConfigFilePath,
        `${this.sshConfigHeader}\n\n${config}`,
+        { mode: '600' },
      );
    }
  }
@@ -41,25 +59,22 @@ export default class SshKeyService {
    key: string,
  ): Promise<void> {
    try {
-      await writeFileWithLock(
-        path.join(this.sshPath, alias),
-        `${key}${os.EOL}`,
-        {
-          encoding: 'utf8',
-          mode: '400',
-        },
-      );
+      const filePath = resolveSubscriptionPath(this.sshPath, alias);
+      try {
+        await rmPath(filePath);
+      } catch {}
+      await writeFileWithLock(filePath, `${key}${os.EOL}`, { mode: '400' });
    } catch (error) {
-      this.logger.error('生成私钥文件失败', error);
+      this.logger.error(t('生成私钥文件失败'), error);
    }
  }

  private async removePrivateKeyFile(alias: string): Promise<void> {
    try {
-      const filePath = path.join(this.sshPath, alias);
+      const filePath = resolveSubscriptionPath(this.sshPath, alias);
      await rmPath(filePath);
    } catch (error) {
-      this.logger.error('删除私钥文件失败', error);
+      this.logger.error(t('删除私钥文件失败'), error);
    }
  }

@@ -68,28 +83,40 @@ export default class SshKeyService {
    host: string,
    proxy?: string,
  ) {
+    if (
+      !/^[a-zA-Z0-9.-]+$/.test(host) ||
+      (proxy && !/^[a-zA-Z0-9.:[\]-]+$/.test(proxy))
+    ) {
+      throw Object.assign(new Error('Invalid SSH host or proxy'), {
+        status: 400,
+      });
+    }
    if (host === 'github.com') {
      host = `ssh.github.com\n    Port 443\n    HostkeyAlgorithms +ssh-rsa`;
    }
    const proxyStr = proxy
      ? `    ProxyCommand nc -v -x ${proxy} %h %p 2>/dev/null\n`
      : '';
-    const config = `Host ${alias}\n    Hostname ${host}\n    IdentityFile ${path.join(
+    const config = `Host ${alias}\n    Hostname ${host}\n    IdentityFile ${resolveSubscriptionPath(
      this.sshPath,
      alias,
    )}\n    StrictHostKeyChecking no\n${proxyStr}`;
    await writeFileWithLock(
-      `${path.join(this.sshPath, `${alias}.config`)}`,
+      `${resolveSubscriptionPath(this.sshPath, alias, '.config')}`,
      config,
+      {
+        encoding: 'utf8',
+        mode: '600',
+      },
    );
  }

  private async removeSshConfig(alias: string) {
    try {
-      const filePath = path.join(this.sshPath, `${alias}.config`);
+      const filePath = resolveSubscriptionPath(this.sshPath, alias, '.config');
      await rmPath(filePath);
    } catch (error) {
-      this.logger.error(`删除ssh配置文件${alias}失败`, error);
+      this.logger.error(t('删除ssh配置文件%s失败'), alias, error);
    }
  }

@@ -99,6 +126,7 @@ export default class SshKeyService {
    host: string,
    proxy?: string,
  ): Promise<void> {
+    alias = getSubscriptionSshAlias(alias);
    await this.generatePrivateKeyFile(alias, key);
    await this.generateSingleSshConfig(alias, host, proxy);
  }
@@ -108,6 +136,7 @@ export default class SshKeyService {
    host: string,
    proxy?: string,
  ): Promise<void> {
+    alias = getSubscriptionSshAlias(alias);
    await this.removePrivateKeyFile(alias);
    await this.removeSshConfig(alias);
  }
@@ -115,16 +144,48 @@ export default class SshKeyService {
  public async setSshConfig(docs: Subscription[]) {
    for (const doc of docs) {
      if (doc.type === 'private-repo' && doc.pull_type === 'ssh-key') {
-        const { alias, proxy } = doc;
-        const { host } = formatUrl(doc);
-        await this.removePrivateKeyFile(alias);
-        await this.removeSshConfig(alias);
-        await this.generatePrivateKeyFile(
-          alias,
-          (doc.pull_option as any).private_key,
-        );
-        await this.generateSingleSshConfig(alias, host, proxy);
+        try {
+          const alias = getSubscriptionSshAlias(doc.alias);
+          const { host } = formatUrl(doc);
+          await this.removePrivateKeyFile(alias);
+          await this.removeSshConfig(alias);
+          await this.generatePrivateKeyFile(
+            alias,
+            (doc.pull_option as any).private_key,
+          );
+          await this.generateSingleSshConfig(alias, host, doc.proxy);
+        } catch (error) {
+          this.logger.warn(t('跳过订阅 %s 的无效 SSH 配置: %s'), doc.id, error);
+        }
      }
    }
  }
+
+  public async addGlobalSSHKey(key: string, alias: string): Promise<void> {
+    await this.generatePrivateKeyFile(`~global_${alias}`, key);
+    // Create a global SSH config entry that matches all hosts
+    // This allows the key to be used for any Git repository
+    await this.generateGlobalSshConfig(`~global_${alias}`);
+  }
+
+  public async removeGlobalSSHKey(alias: string): Promise<void> {
+    await this.removePrivateKeyFile(`~global_${alias}`);
+    await this.removeSshConfig(`~global_${alias}`);
+  }
+
+  private async generateGlobalSshConfig(alias: string) {
+    // Create a config that matches all hosts, making this key globally available
+    const config = `Host *\n    IdentityFile ${resolveSubscriptionPath(
+      this.sshPath,
+      alias,
+    )}\n    StrictHostKeyChecking no\n`;
+    await writeFileWithLock(
+      `${resolveSubscriptionPath(this.sshPath, alias, '.config')}`,
+      config,
+      {
+        encoding: 'utf8',
+        mode: '600',
+      },
+    );
+  }
 }
@@ -20,17 +20,28 @@ import {
 } from '../config/util';
 import fs from 'fs/promises';
 import { FindOptions, Op } from 'sequelize';
-import path, { join } from 'path';
+import path from 'path';
 import ScheduleService, { TaskCallbacks } from './schedule';
 import { SimpleIntervalSchedule } from 'toad-scheduler';
 import SockService from './sock';
+import { t, tf } from '../shared/i18n';
 import SshKeyService from './sshKey';
 import dayjs from 'dayjs';
 import { LOG_END_SYMBOL } from '../config/const';
 import { formatCommand, formatUrl } from '../config/subscription';
 import { CrontabModel } from '../data/cron';
+import { assertSubscriptionAlias } from '../shared/subscriptionPath';
+import { resolveLogPath } from '../shared/logPath';
+import {
+  getSubscriptionStorageCandidates,
+  isSubscriptionStorageName,
+  resolveSubscriptionStoragePath,
+} from '../shared/subscriptionStorage';
+import { withSubscriptionMutation } from '../shared/subscriptionMutationLock';
 import CrontabService from './cron';
 import taskLimit from '../shared/pLimit';
+import { logStreamManager } from '../shared/logStreamManager';
+import { LogReadOptions, readLogChunk } from '../shared/logReader';

@Service()
 export default class SubscriptionService {
@@ -85,9 +96,11 @@ export default class SubscriptionService {
    needCreate = true,
    runImmediately = false,
  ) {
-    const { url } = formatUrl(doc);
-
-    doc.command = formatCommand(doc, url as string);
+    // Cancelling by ID must also work for invalid historical subscriptions.
+    if (needCreate) {
+      const { url } = formatUrl(doc);
+      doc.command = formatCommand(doc, url as string);
+    }

    if (doc.schedule_type === 'crontab') {
      this.scheduleService.cancelCronTask(doc as any);
@@ -129,14 +142,14 @@ export default class SubscriptionService {
        );
        const absolutePath = await handleLogPath(
          logPath as string,
-          `## 开始执行... ${startTime.format('YYYY-MM-DD HH:mm:ss')}\n`,
+          tf('## 开始执行... %s\n', startTime.format('YYYY-MM-DD HH:mm:ss')),
        );

        // 执行sub_before
        let beforeStr = '';
        try {
          if (doc.sub_before) {
-            await fs.appendFile(absolutePath, `\n## 执行before命令...\n\n`);
+            await logStreamManager.write(absolutePath, `\n## ${t('执行before命令...')}\n\n`);
            beforeStr = await promiseExec(doc.sub_before);
          }
        } catch (error: any) {
@@ -144,7 +157,7 @@ export default class SubscriptionService {
            (error.stderr && error.stderr.toString()) || JSON.stringify(error);
        }
        if (beforeStr) {
-          await fs.appendFile(absolutePath, `${beforeStr}\n`);
+          await logStreamManager.write(absolutePath, `${beforeStr}\n`);
        }
      },
      onStart: async (cp: ChildProcessWithoutNullStreams, startTime) => {
@@ -156,61 +169,77 @@ export default class SubscriptionService {
        );
      },
      onEnd: async (cp, endTime, diff) => {
-        const sub = await this.getDb({ id: doc.id });
-        const absolutePath = await handleLogPath(sub.log_path as string);
-
-        // 执行 sub_after
-        let afterStr = '';
+        let absolutePath: string | undefined;
        try {
-          if (sub.sub_after) {
-            await fs.appendFile(absolutePath, `\n\n## 执行after命令...\n\n`);
-            afterStr = await promiseExec(sub.sub_after);
+          const sub = await this.getDb({ id: doc.id });
+          absolutePath = await handleLogPath(sub.log_path as string);
+
+          // 执行 sub_after
+          let afterStr = '';
+          try {
+            if (sub.sub_after) {
+              await logStreamManager.write(
+                absolutePath,
+                `\n\n## ${t('执行after命令...')}\n\n`,
+              );
+              afterStr = await promiseExec(sub.sub_after);
+            }
+          } catch (error: any) {
+            afterStr =
+              (error.stderr && error.stderr.toString()) || JSON.stringify(error);
+          }
+          if (afterStr) {
+            await logStreamManager.write(absolutePath, `${afterStr}\n`);
+          }
+
+          await logStreamManager.write(
+            absolutePath,
+            '\n' +
+              tf(
+                '## 执行结束... %s  耗时 %s 秒',
+                endTime.format('YYYY-MM-DD HH:mm:ss'),
+                String(diff),
+              ) +
+              LOG_END_SYMBOL,
+          );
+        } finally {
+          try {
+            if (absolutePath) await logStreamManager.closeStream(absolutePath);
+          } finally {
+            await SubscriptionModel.update(
+              { status: SubscriptionStatus.idle, pid: null } as any,
+              { where: { id: doc.id } },
+            );
+            this.sockService.sendMessage({
+              type: 'runSubscriptionEnd',
+              message: t('订阅执行完成'),
+              references: [doc.id as number],
+            });
          }
-        } catch (error: any) {
-          afterStr =
-            (error.stderr && error.stderr.toString()) || JSON.stringify(error);
        }
-        if (afterStr) {
-          await fs.appendFile(absolutePath, `${afterStr}\n`);
-        }
-
-        await fs.appendFile(
-          absolutePath,
-          `\n## 执行结束... ${endTime.format(
-            'YYYY-MM-DD HH:mm:ss',
-          )}  耗时 ${diff} 秒${LOG_END_SYMBOL}`,
-        );
-
-        await SubscriptionModel.update(
-          { status: SubscriptionStatus.idle, pid: undefined },
-          { where: { id: sub.id } },
-        );
-
-        this.sockService.sendMessage({
-          type: 'runSubscriptionEnd',
-          message: '订阅执行完成',
-          references: [doc.id as number],
-        });
      },
      onError: async (message: string) => {
        const sub = await this.getDb({ id: doc.id });
        const absolutePath = await handleLogPath(sub.log_path as string);
-        await fs.appendFile(absolutePath, `\n${message}`);
+        await logStreamManager.write(absolutePath, `\n${message}`);
      },
      onLog: async (message: string) => {
        const sub = await this.getDb({ id: doc.id });
        const absolutePath = await handleLogPath(sub.log_path as string);
-        await fs.appendFile(absolutePath, `\n${message}`);
+        await logStreamManager.write(absolutePath, `\n${message}`);
      },
    };
  }

  public async create(payload: Subscription): Promise<Subscription> {
-    const tab = new Subscription(payload);
-    const doc = await this.insert(tab);
-    await this.handleTask(doc.get({ plain: true }));
-    await this.setSshConfig();
-    return doc;
+    assertSubscriptionAlias(payload.alias);
+    return withSubscriptionMutation(async () => {
+      const tab = new Subscription(payload);
+      const doc = await this.insert(tab);
+      await this.handleTask(doc.get({ plain: true }));
+      await this.setSshConfig();
+      return doc;
+    });
  }

  public async insert(payload: Subscription): Promise<SubscriptionInstance> {
@@ -218,12 +247,27 @@ export default class SubscriptionService {
  }

  public async update(payload: Subscription): Promise<Subscription> {
-    const doc = await this.getDb({ id: payload.id });
-    const tab = new Subscription({ ...doc, ...payload });
-    const newDoc = await this.updateDb(tab);
-    await this.handleTask(newDoc, !newDoc.is_disabled);
-    await this.setSshConfig();
-    return newDoc;
+    assertSubscriptionAlias(payload.alias);
+    return withSubscriptionMutation(async () => {
+      const doc = await this.getDb({ id: payload.id });
+      const tab = new Subscription({ ...doc, ...payload });
+      const newDoc = await this.updateDb(tab);
+      await this.handleTask(newDoc, !newDoc.is_disabled);
+      await this.removeSshConfigForSubscription(doc);
+      await this.setSshConfig();
+      return newDoc;
+    });
+  }
+
+  private async removeSshConfigForSubscription(doc: Subscription) {
+    if (doc.type !== 'private-repo' || doc.pull_type !== 'ssh-key') return;
+    // Invalid historical rows must remain deletable without deriving unsafe paths.
+    try {
+      assertSubscriptionAlias(doc.alias);
+    } catch {
+      return;
+    }
+    await this.sshKeyService.removeSSHKey(doc.alias, '');
  }

  public async updateDb(payload: Subscription): Promise<Subscription> {
@@ -246,6 +290,7 @@ export default class SubscriptionService {
    last_running_time: number;
    last_execution_time: number;
  }) {
+    if (log_path) resolveLogPath(config.logPath, log_path);
    const options: any = {
      status,
      pid,
@@ -263,25 +308,71 @@ export default class SubscriptionService {
  }

  public async remove(ids: number[], query: { force?: boolean }) {
-    const docs = await SubscriptionModel.findAll({ where: { id: ids } });
-    for (const doc of docs) {
-      await this.handleTask(doc.get({ plain: true }), false);
-    }
-    await SubscriptionModel.destroy({ where: { id: ids } });
-    await this.setSshConfig();
-
-    if (query?.force === true) {
-      const crons = await CrontabModel.findAll({ where: { sub_id: ids } });
-      if (crons?.length) {
-        await this.crontabService.remove(crons.map((x) => x.id!));
+    return withSubscriptionMutation(async () => {
+      const docs = await SubscriptionModel.findAll({ where: { id: ids } });
+      const storagePaths: string[] = [];
+      const retainedPaths: string[] = [];
+      const collectPaths = (
+        doc: Subscription,
+        targets: string[],
+        deleting = false,
+      ) => {
+        for (const names of getSubscriptionStorageCandidates(doc)) {
+          // A URL accepted by one engine can produce an invalid name in another.
+          // Validate each candidate independently, retaining the safe candidate.
+          if (!Object.values(names).every(isSubscriptionStorageName)) continue;
+          const resolve = deleting ? resolveSubscriptionStoragePath : path.resolve;
+          const scriptPath = resolve(config.scriptPath, names.script);
+          if (scriptPath) targets.push(scriptPath);
+          if (names.repo) {
+            const repoPath = resolve(config.repoPath, names.repo);
+            if (repoPath) targets.push(repoPath);
+          }
+          if (names.raw) {
+            const rawPath = resolve(path.join(config.dataPath, 'raw'), names.raw);
+            if (rawPath) targets.push(rawPath);
+          }
+        }
+      };
+      // Validate all deletion targets before changing rows or removing any files.
+      if (query?.force === true) {
+        for (const doc of docs) {
+          assertSubscriptionAlias(doc.alias);
+          resolveSubscriptionStoragePath(config.scriptPath, doc.alias);
+          resolveSubscriptionStoragePath(config.repoPath, doc.alias);
+          collectPaths(doc, storagePaths, true);
+        }
+        const remaining = await SubscriptionModel.findAll({ where: {} });
+        for (const doc of remaining) {
+          if (!ids.includes(doc.id!)) collectPaths(doc, retainedPaths);
+        }
      }
      for (const doc of docs) {
-        const filePath = join(config.scriptPath, doc.alias);
-        const repoPath = join(config.repoPath, doc.alias);
-        await rmPath(filePath);
-        await rmPath(repoPath);
+        await this.handleTask(doc.get({ plain: true }), false);
      }
-    }
+      await SubscriptionModel.destroy({ where: { id: ids } });
+      for (const doc of docs) {
+        await this.removeSshConfigForSubscription(doc);
+      }
+      await this.setSshConfig();
+
+      if (query?.force === true) {
+        const crons = await CrontabModel.findAll({ where: { sub_id: ids } });
+        if (crons?.length) {
+          await this.crontabService.remove(crons.map((x) => x.id!));
+        }
+        for (const storagePath of new Set(storagePaths)) {
+          // rm is recursive: an ancestor must also be retained if a surviving
+          // subscription uses a nested branch, and vice versa.
+          const shared = retainedPaths.some((retained) =>
+            retained === storagePath ||
+            retained.startsWith(`${storagePath}${path.sep}`) ||
+            storagePath.startsWith(`${retained}${path.sep}`),
+          );
+          if (!shared) await rmPath(storagePath);
+        }
+      }
+    });
  }

  public async getDb(
@@ -306,20 +397,22 @@ export default class SubscriptionService {

  public async stop(ids: number[]) {
    const docs = await SubscriptionModel.findAll({ where: { id: ids } });
+    let failure: unknown;
    for (const doc of docs) {
-      if (doc.pid) {
-        try {
-          await killTask(doc.pid);
-        } catch (error) {
-          this.logger.error(error);
+      try {
+        if (doc.pid) {
+          await killTask(doc.pid, true);
        }
+        await SubscriptionModel.update(
+          { status: SubscriptionStatus.idle, pid: null } as any,
+          { where: { id: doc.id, pid: doc.pid ?? null } },
+        );
+      } catch (error) {
+        this.logger.error(error);
+        failure ??= error;
      }
    }
-
-    await SubscriptionModel.update(
-      { status: SubscriptionStatus.idle, pid: undefined },
-      { where: { id: ids } },
-    );
+    if (failure) throw failure;
  }

  private async runSingle(subscriptionId: number) {
@@ -357,14 +450,20 @@ export default class SubscriptionService {
    }
  }

-  public async log(id: number) {
+  public async log(id: number, options: LogReadOptions = {}) {
    const doc = await this.getDb({ id });
    if (!doc || !doc.log_path) {
-      return '';
+      return {
+        content: '',
+        offset: 0,
+        nextOffset: 0,
+        total: 0,
+        truncated: false,
+      };
    }

    const absolutePath = await handleLogPath(doc.log_path as string);
-    return await getFileContentByName(absolutePath);
+    return await readLogChunk(absolutePath, options);
  }

  public async logs(id: number) {
@@ -375,7 +474,7 @@ export default class SubscriptionService {

    if (doc.log_path) {
      const relativeDir = path.dirname(`${doc.log_path}`);
-      const dir = path.resolve(config.logPath, relativeDir);
+      const dir = path.dirname(resolveLogPath(config.logPath, doc.log_path));
      const _exist = await fileExist(dir);
      if (_exist) {
        let files = await fs.readdir(dir);
@@ -384,7 +483,7 @@ export default class SubscriptionService {
            files.map(async (x) => ({
              filename: x,
              directory: relativeDir.replace(config.logPath, ''),
-              time: (await fs.lstat(`${dir}/${x}`)).mtime.getTime(),
+              time: (await fs.lstat(`${dir}/${x}`)).birthtimeMs,
            })),
          )
        ).sort((a, b) => b.time - a.time);
--- a/Show More
+++ b/Show More