Merge pull request #211 from qaiu/copilot/update-readme-to-latest-version

docs: update download URL to latest release v0.4.2
docs: fix download URL and zip filename for v0.4.2 linux-amd64
2026-08-30 05:22:01 +00:00 · 2026-08-05 21:42:39 +08:00 · 2026-08-05 13:28:37 +00:00 · 2026-08-05 13:18:11 +00:00 · 2026-07-26 21:10:39 +08:00 · 2026-07-26 12:05:16 +00:00
92 changed files with 8478 additions and 2135 deletions
@@ -1,24 +1,16 @@
-# This workflow will build a Java project with Maven, and cache/restore any dependencies to improve the workflow execution time
-# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-java-with-maven
+name: Java CI（Maven 构建 + Docker 镜像 + 原生环境打包）

-# This workflow uses actions that are not certified by GitHub.
-# They are provided by a third-party and are governed by
-# separate terms of service, privacy policy, and support
-# documentation.
-
-name: Java CI with Maven
-
-# The API requires write permission on the repository to submit dependencies
 permissions:
  contents: write
  packages: write

 on:
+  workflow_dispatch:
  push:
    tags:
-      - '*'  # 只有推送tag时才会触发构建
+      - '*'
    branches-ignore:
-      - '*'  # 排除所有分支的提交
+      - '*'
    paths-ignore:
      - 'bin/**'
      - '.github/**'
@@ -32,71 +24,247 @@ on:
      - "main"

 jobs:
+  # ================================================================
+  # 阶段一：构建前端 + Maven 打包（只执行一次，产物共享）
+  # ================================================================
  build:
-
+    name: 编译构建
    runs-on: ubuntu-latest
-
    steps:
-    - uses: actions/checkout@v3
+    - name: 检出代码
+      uses: actions/checkout@v3

-    - uses: actions/setup-node@v4
+    - name: 设置 Node.js 18
+      uses: actions/setup-node@v4
      with:
        node-version: '18'

-    - name: Set up JDK 17
+    - name: 设置 JDK 17
      uses: actions/setup-java@v3
      with:
        java-version: '17'
        distribution: 'temurin'
        cache: maven

-    - name: Build Frontend
+    - name: 构建前端
      run: cd web-front && yarn install && yarn run build

-    - name: Build with Maven
+    - name: Maven 编译打包
      run: mvn -B package -DskipTests --file pom.xml

-    # Optional: Uploads the full dependency graph to GitHub to improve the quality of Dependabot alerts this repository can receive
-    - name: Update dependency graph
+    - name: 更新依赖图谱
      uses: advanced-security/maven-dependency-submission-action@v3
      if: github.event_name != 'pull_request'
      continue-on-error: true
      with:
        ignore-maven-wrapper: true

-#    - uses: release-drafter/release-drafter@v5
-#      env:
-#        GITHUB_TOKEN: ${{ secrets.ACCESS_TOKEN }}
-
-    - name: Upload Artifact
+    - name: 分享应用打包目录（供原生包和 Docker 复用）
+      if: github.event_name != 'pull_request'
      uses: actions/upload-artifact@v4
      with:
+        name: app-package
+        path: web-service/target/package/
+
+    - name: 分享 bin-zip（供 Docker 复用）
+      if: github.event_name != 'pull_request'
+      uses: actions/upload-artifact@v4
+      with:
+        name: app-bin-zip
        path: web-service/target/netdisk-fast-download-bin.zip

-    - name: Login to GitHub Container Registry
-      if: github.event_name != 'pull_request'
+  # ================================================================
+  # 阶段二-A：Docker 镜像构建（并行）
+  # ================================================================
+  docker:
+    name: Docker 镜像
+    needs: build
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+    - name: 检出代码
+      uses: actions/checkout@v3
+
+    - name: 下载 bin-zip 产物
+      uses: actions/download-artifact@v4
+      with:
+        name: app-bin-zip
+        path: web-service/target/
+
+    - name: 登录 GitHub 容器仓库
      uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

-    - name: Set up Docker Buildx
+    - name: 设置 QEMU（多平台构建支持）
+      uses: docker/setup-qemu-action@v3
+
+    - name: 设置 Docker Buildx
      uses: docker/setup-buildx-action@v3

-    - name: Extract git tag
-      id: tag
+    - name: 生成 Docker 标签
+      id: docker_tag
+      shell: bash
      run: |
-        GIT_TAG=$(git tag --points-at HEAD | head -n 1)
-        echo "tag=$GIT_TAG" >> $GITHUB_OUTPUT
+        tag="$(printf '%s' "${GITHUB_REF_NAME}" | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9_.-]+/-/g; s/^-+//; s/-+$//')"
+        if [ -z "$tag" ]; then
+          tag="snapshot"
+        fi
+        echo "tag=$tag" >> "$GITHUB_OUTPUT"

-    - name: Build and push Docker image
-      if: github.event_name != 'pull_request'
+    - name: 构建并推送 Docker 镜像
      uses: docker/build-push-action@v5
      with:
        context: .
        push: true
        platforms: linux/amd64,linux/arm64,linux/arm/v7
        tags: |
-          ghcr.io/${{ github.repository }}:${{ steps.tag.outputs.tag }}
+          ghcr.io/${{ github.repository }}:${{ steps.docker_tag.outputs.tag }}
          ghcr.io/${{ github.repository }}:latest
+
+
+  # ================================================================
+  # 阶段二-B：原生环境打包 Linux + Windows（并行）
+  # ================================================================
+  native-package:
+    name: 原生环境打包 → ${{ matrix.artifact-name }}
+    needs: build
+    if: github.event_name != 'pull_request'
+    strategy:
+      matrix:
+        include:
+          - os: ubuntu-latest
+            artifact-name: netdisk-fast-download-linux-amd64
+          - os: windows-latest
+            artifact-name: netdisk-fast-download-windows-amd64
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+
+    steps:
+    - name: 设置 JDK 17
+      uses: actions/setup-java@v3
+      with:
+        java-version: '17'
+        distribution: 'temurin'
+
+    - name: 下载 Maven 构建产物
+      uses: actions/download-artifact@v4
+      with:
+        name: app-package
+        path: web-service/target/package
+
+    # ============================================================
+    # 选择 JDK 模块
+    # ============================================================
+    - name: 选择完整 JDK 模块集合
+      run: |
+        # 123 网盘/自定义 JS 解析器会通过 javax.script、Nashorn 和 SPI/反射加载模块，
+        # jdeps 无法稳定识别这些运行时依赖。这里优先保证原生包可运行，使用完整
+        # JDK 模块集合生成运行时，避免 Windows 精简 JRE 缺 java.scripting/jdk.dynalink 等模块。
+        printf 'JDK_MODULES=ALL-MODULE-PATH\n' >> $GITHUB_ENV
+
+    # ============================================================
+    # jlink 生成完整模块 JRE
+    # ============================================================
+    - name: 生成完整模块 JRE（jlink）
+      run: |
+        jlink \
+          --module-path "$JAVA_HOME/jmods" \
+          --add-modules "$JDK_MODULES" \
+          --output "native-package/netdisk-fast-download/jre" \
+          --strip-debug \
+          --compress=2 \
+          --no-header-files \
+          --no-man-pages
+
+        echo "JRE size:"
+        du -sh native-package/netdisk-fast-download/jre || true
+
+        # Windows: 确保 MSVC 运行时 DLL 到位
+        if [[ "$RUNNER_OS" == "Windows" ]]; then
+          JRE_BIN="native-package/netdisk-fast-download/jre/bin"
+          for dll in vcruntime140.dll msvcp140.dll vcruntime140_1.dll; do
+            if [ ! -f "$JRE_BIN/$dll" ] && [ -f "$JAVA_HOME/bin/$dll" ]; then
+              echo "jlink 未包含 $dll，从 JDK 补拷"
+              cp "$JAVA_HOME/bin/$dll" "$JRE_BIN/"
+            fi
+          done
+          echo "=== JRE bin 目录 DLL 清单 ==="
+          ls -la "$JRE_BIN"/*.dll 2>/dev/null || echo "(无 .dll 文件)"
+        fi
+
+        echo "=== 关键 JDK 模块校验 ==="
+        "native-package/netdisk-fast-download/jre/bin/java" --list-modules | grep -q '^java.scripting@'
+        "native-package/netdisk-fast-download/jre/bin/java" --list-modules | grep -q '^jdk.dynalink@'
+        "native-package/netdisk-fast-download/jre/bin/java" --list-modules | grep -q '^jdk.unsupported@'
+
+    # ============================================================
+    # 组装包目录
+    # ============================================================
+    - name: 组装包目录
+      run: |
+        PKG="native-package/netdisk-fast-download"
+        SRC="web-service/target/package"
+
+        cp "$SRC/netdisk-fast-download.jar" "$PKG/"
+        cp -r "$SRC/lib"         "$PKG/"
+        cp -r "$SRC/resources"   "$PKG/"
+        cp -r "$SRC/webroot"     "$PKG/"
+
+        mkdir -p "$PKG/db"
+        mkdir -p "$PKG/logs"
+
+    # ============================================================
+    # 生成启动脚本
+    # ============================================================
+    - name: 生成启动脚本（Linux）
+      run: |
+        PKG="native-package/netdisk-fast-download"
+        echo '#!/bin/bash' > "$PKG/run.sh"
+        echo 'DIR="$(cd "$(dirname "$0")" && pwd)"' >> "$PKG/run.sh"
+        echo 'cd "$DIR" || exit 1' >> "$PKG/run.sh"
+        echo 'exec "$DIR/jre/bin/java" -Xmx512M -Dfile.encoding=utf-8 -jar "$DIR/netdisk-fast-download.jar" "$@"' >> "$PKG/run.sh"
+        chmod +x "$PKG/run.sh"
+
+    - name: 生成启动脚本（Windows）
+      run: |
+        PKG="native-package/netdisk-fast-download"
+        echo '@echo off' > "$PKG/run.bat"
+        echo 'chcp 65001 > nul' >> "$PKG/run.bat"
+        echo 'pushd %~dp0' >> "$PKG/run.bat"
+        echo '"%~dp0jre\bin\java.exe" -Xmx512M -Dfile.encoding=utf-8 -jar "%~dp0netdisk-fast-download.jar" %*' >> "$PKG/run.bat"
+
+    # ============================================================
+    # 打包为 zip
+    # ============================================================
+    - name: 打包 ZIP（Linux）
+      if: runner.os == 'Linux'
+      run: |
+        cd native-package
+        zip -r "../${{ matrix.artifact-name }}.zip" netdisk-fast-download/
+
+    - name: 打包 ZIP（Windows）
+      if: runner.os == 'Windows'
+      shell: pwsh
+      run: |
+        Compress-Archive -Path native-package/netdisk-fast-download -DestinationPath "${{ matrix.artifact-name }}.zip"
+
+    # ============================================================
+    # 上传产物
+    # ============================================================
+    - name: 上传原生安装包
+      uses: actions/upload-artifact@v4
+      with:
+        name: ${{ matrix.artifact-name }}
+        path: ${{ matrix.artifact-name }}.zip
+
+    - name: 上传到 Release
+      uses: softprops/action-gh-release@v2
+      with:
+        files: ${{ matrix.artifact-name }}.zip
+        tag_name: ${{ github.ref_name }}
+        generate_release_notes: true
@@ -92,3 +92,4 @@ yarn-error.log*
 **/${project.build.directory}/
 **/${project.basedir}/target/
 **/${basedir}/target/
+.spec-workflow/
@@ -1,13 +1,15 @@
 # 一款网盘分享链接云解析快速下载服务  
 QQ交流群：1017480890
 <p align="center">
-<a href="https://github.com/qaiu/netdisk-fast-download/actions/workflows/maven.yml"><img src="https://img.shields.io/github/actions/workflow/status/qaiu/netdisk-fast-download/maven.yml?style=flat"></a>
+<a href="https://github.com/qaiu/netdisk-fast-download/actions/workflows/maven.yml"><img src="https://img.shields.io/github/actions/workflow/status/qaiu/netdisk-fast-download/build.yml?branch=main&style=flat"></a>
 <a href="https://www.oracle.com/cn/java/technologies/downloads"><img src="https://img.shields.io/badge/jdk-%3E%3D17-blue"></a>
 <a href="https://vertx-china.github.io"><img src="https://img.shields.io/badge/vert.x-4.5.27-blue?style=flat"></a>
 <a href="https://raw.githubusercontent.com/qaiu/netdisk-fast-download/master/LICENSE"><img src="https://img.shields.io/github/license/qaiu/netdisk-fast-download?style=flat"></a>
 <a href="https://github.com/qaiu/netdisk-fast-download/releases/"><img src="https://img.shields.io/github/v/release/qaiu/netdisk-fast-download?style=flat"></a>
+<a href="https://github.com/QAIU/netdisk-fast-download">
+  <img src="https://img.shields.io/github/stars/QAIU/netdisk-fast-download?style=flat&logo=github" alt="GitHub Stars">
+</a>
 <a href="https://atomgit.com/QAIU/netdisk-fast-download"><img src="https://atomgit.com/QAIU/netdisk-fast-download/star/badge.svg" alt="AtomGit"></a>
-<a href="https://oosmetrics.com/repo/qaiu/netdisk-fast-download"><img src="https://api.oosmetrics.com/api/v1/badge/achievement/826aa27a-6e59-4de5-b7fa-cd189f484035.svg"></a>
 <p align="center">
  <a href="https://trendshift.io/repositories/12101" target="_blank"><img src="https://trendshift.io/api/badge/repositories/12101" alt="qaiu%2Fnetdisk-fast-download | Trendshift" style="width: 250px; height: 55px;" width="250" height="55"/></a>
 </p>
@@ -16,13 +18,9 @@ QQ交流群：1017480890
 ![alt text](web-front/img/image.png)


-## 国内镜像
-
-本项目同步托管于 **AtomGit**，国内访问更流畅：👉 [https://atomgit.com/QAIU/netdisk-fast-download](https://atomgit.com/QAIU/netdisk-fast-download)
-

 ## 介绍
-> netdisk-fast-download网盘直链解析可以把云盘分享链接转为直链，可广泛应用于各类下载站，资源站，个人博客，图床，APP下载更新，视频点播等领域。支持市面各大主流云盘的文件分享以及文件夹分享链接，已支持蓝奏云/蓝奏云优享/移动云云空间/小飞机盘/亿方云/123云盘/Cloudreve等，支持加密分享，以及部分网盘文件夹分享。  
+> netdisk-fast-download网盘直链解析可以把云盘分享链接转为直链，可广泛应用于各类下载站，资源站，个人博客，图床，APP下载更新，视频点播等领域。支持市面各大主流云盘的文件分享以及文件夹分享链接，已支持蓝奏云/蓝奏云优享/移动云云空间/小飞机盘/亿方云/123云盘/永硕E盘/Cloudreve等，支持加密分享，以及部分网盘文件夹分享。  

 [官方文档](https://nfd-parser.github.io/)  
 [API接入](https://nfdparser.apifox.cn/)  
@@ -40,12 +38,12 @@ curl -LOJ "https://lz.qaiu.top/parser?url=https://share.feijipan.com/s/Tk1F2kGQ&
 ```shell
 wget -O bilibili.mp4 "https://lz.qaiu.top/parser?url=https://share.feijipan.com/s/Tk1F2kGQ&pwd=1234"
 ```
-或者使用浏览器[直接访问](https://nfd-parser.github.io/nfd-preview/preview.html?src=https%3A%2F%2Flz.qaiu.top%2Fparser%3Furl%3Dhttps%3A%2F%2Fshare.feijipan.com%2Fs%2FTk1F2kGQ&name=bilibili.mp4&ext=mp4):
+或者使用浏览器[直接访问](https://nfd-parser.github.io/nfd-preview/preview.html?src=https%3A%2F%2Flz.qaiu.top%2Fparser%3Furl%3Dhttps%3A%2F%2Fwww.ilanzou.com%2Fs%2FCDx6xKbT&name=bilibili.mp4&ext=mp4):
 ```
 ### 调用演示站下载：
-https://lz.qaiu.top/parser?url=https://share.feijipan.com/s/Tk1F2kGQ&pwd=1234  
+https://lz.qaiu.top/parser?url=https://www.ilanzou.com/s/CDx6xKbT&pwd=1234  
 ### 调用演示站预览：
-https://nfd-parser.github.io/nfd-preview/preview.html?src=https%3A%2F%2Flz.qaiu.top%2Fparser%3Furl%3Dhttps%3A%2F%2Fshare.feijipan.com%2Fs%2FTk1F2kGQ&name=bilibili.mp4&ext=mp4  
+https://nfd-parser.github.io/nfd-preview/preview.html?src=https%3A%2F%2Flz.qaiu.top%2Fparser%3Furl%3Dhttps%3A%2F%2Fwww.ilanzou.com%2Fs%2FCDx6xKbT&name=bilibili.mp4&ext=mp4  

 ```

@@ -71,13 +69,14 @@ https://nfd-parser.github.io/nfd-preview/preview.html?src=https%3A%2F%2Flz.qaiu.
 - [移动云云空间-ec](https://www.ecpan.cn/web)
 - [小飞机网盘-fj](https://www.feijipan.com/)
 - [亿方云-fc](https://www.fangcloud.com/)
- [123云盘-ye](https://www.123pan.com/)
+- [123云盘-ye](https://www.123pan.com/) ⚠️仅建议本地部署使用，需登录认证，公共/云端服务器风控严格建议自行部署（Windows 可直接用 run.bat 一键运行）
 - ~[115网盘(失效)-p115](https://115.com/)~
 - [文叔叔-ws](https://www.wenshushu.cn/)
 - [联想乐云-le](https://lecloud.lenovo.com/)
 - [QQ邮箱云盘-qqw](https://mail.qq.com/)
 - [QQ闪传-qqsc](https://nutty.qq.com/nutty/ssr/26797.html)
 - [城通网盘-ct](https://www.ctfile.com)
+- [永硕E盘-ys](https://www.ysepan.com/)（空间分享，如 `https://xxx.ysepan.com/`，密码为空间访问密码；多文件请用文件列表接口）
 - [网易云音乐分享链接-mnes](https://music.163.com)
 - [酷狗音乐分享链接-mkgs](https://www.kugou.com)
 - [酷我音乐分享链接-mkws](https://kuwo.cn)
@@ -178,6 +177,7 @@ GET /json/getFileList?url={分享链接}&pwd={密码}
 | UC网盘(UC) | **必须** | 必须配置 Cookie 才能解析 |
 | 小飞机网盘(FJ) | 可选 | 大文件（>100MB）需要认证 |
 | 蓝奏优享(IZ) | 可选 | 大文件需要认证 |
+| 123网盘(YE) | 可选 | 需要下载大文件/需要登录的分享时才需要认证，支持账号密码或 token/authorization |

 **使用示例**：
 ```
@@ -198,6 +198,38 @@ GET /parser?url={分享链接}&pwd={密码}&auth={加密后的认证参数}
  - 目的：防止客户端伪造失败计数请求
  - 建议：使用高强度随机字符串，且不要与 `authEncryptKey` 相同

+#### `auth` 临时认证参数 与 `auths` 静态配置认证 的区别
+
+本项目存在两种互相独立的认证配置方式，作用范围不同，不要混淆：
+
+| 方式 | 配置位置 | 生效范围 | 适用场景 |
+|------|---------|---------|---------|
+| `auth` 临时认证参数 | 请求 URL 上的 `auth` 查询参数 | **仅当次请求**，优先级高于 app-dev.yml 中的静态配置 | 调用方按用户临时提供的账号/Cookie/token 解析，不同请求可携带不同认证信息 |
+| `auths` 静态配置认证 | `app-dev.yml` 的 `auths.<网盘标识>` 节点 | **服务端长期生效**，所有未携带 `auth` 参数的请求都会复用 | 部署方自己长期配置一份账号，供所有请求默认使用 |
+
+以 123网盘（`ye`）为例，`app-dev.yml` 中支持以下几种写法（三选一即可）：
+
+```yaml
+auths:
+  ye:
+    username: 你的123网盘账号
+    password: 你的123网盘密码
+```
+```yaml
+auths:
+  ye:
+    token: 已登录后获取的 Authorization/AccessToken
+```
+```yaml
+auths:
+  ye:
+    authorization: 已登录后获取的 Authorization/AccessToken   # 与 token 等价，二选一
+```
+
+> ⚠️ 注意：YAML 中 key 后面不写值（如 `authorization:` 空着）等同于没配置，不会生效，必须填入真实的账号密码或 token 内容。
+
+如果只是临时调用一次，不想改动服务端配置，也可以用上面提到的 `auth` 参数临时传递（`authType` 可选 `password`/`accesstoken`/`authorization`），无需重启服务，仅本次请求生效。
+
 ### 特殊说明

 - 移动云云空间的 `分享key` 取分享链接中的 `data` 参数值
@@ -278,9 +310,12 @@ json返回数据格式示例:
    "timestamp": 1736489219402
 }
 ```
-#### 3. 文件夹解析(仅支持蓝奏云/蓝奏优享/小飞机网盘)
+#### 3. 文件夹解析(支持蓝奏云/蓝奏优享/小飞机/永硕E盘等)
 /v2/getFileList?url=分享链接&pwd=分享密码

+永硕E盘（`ys`）空间链接先返回目录列表，再带 `dirId` 获取目录内文件：
+`/v2/getFileList?url=https://xxx.ysepan.com/&pwd=空间密码&dirId=目录编号`
+
 ```json
 {
  "code": 200,
@@ -336,6 +371,7 @@ json返回数据格式示例:
 | 360亿方云      | √       | √        | 100G(须实名) | 不限大小            | 
 | 123云盘       | √       | √        | 2T        | 100G（>100M需要登录） | 
 | 文叔叔         | √       | √        | 10G       | 5GB             | 
+| 永硕E盘        | √       | √(空间密码) | 视套餐       | 视套餐            |
 | WPS云文档      | √       | X        | 5G(免费)   | 10M(免费)/2G(会员)  |
 | 夸克网盘        | x       | √        | 10G       | 不限大小            | 
 | UC网盘        | x       | √        | 10G       | 不限大小            | 
@@ -419,8 +455,8 @@ docker run --rm -v /var/run/docker.sock:/var/run/docker.sock containrrr/watchtow
 > 注意: netdisk-fast-download.service中的ExecStart的路径改为实际路径
 ```shell
 cd ~
-wget -O netdisk-fast-download.zip https://github.com/qaiu/netdisk-fast-download/releases/download/v3.0.2/netdisk-fast-download-bin.zip
-unzip netdisk-fast-download-bin.zip
+wget -O netdisk-fast-download.zip https://github.com/qaiu/netdisk-fast-download/releases/download/v0.4.2/netdisk-fast-download-linux-amd64.zip
+unzip netdisk-fast-download.zip
 cd netdisk-fast-download
 bash service-install.sh
 ```
@@ -500,7 +536,13 @@ Core模块集成Vert.x实现类似spring的注解式路由API

 ## Star History

-[![Star History Chart](https://api.star-history.com/svg?repos=qaiu/netdisk-fast-download&type=Date)](https://star-history.com/#qaiu/netdisk-fast-download&Date)
+<a href="https://www.star-history.com/?repos=qaiu%2Fnetdisk-fast-download&type=date&legend=bottom-right">
+ <picture>
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=qaiu/netdisk-fast-download&type=date&theme=dark&legend=bottom-right&sealed_token=dfQO_dJcTqcPkEnM7SfxRyHoFbV5Ah4LxoEhdlheMn4T2YLEV_WETxFZexeAbWN5OmNyYuycWan2d42PAFbw0CuU4oCTKgehfErFJ9eVl2CyVpP_4xrdQw" />
+   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=qaiu/netdisk-fast-download&type=date&legend=bottom-right&sealed_token=dfQO_dJcTqcPkEnM7SfxRyHoFbV5Ah4LxoEhdlheMn4T2YLEV_WETxFZexeAbWN5OmNyYuycWan2d42PAFbw0CuU4oCTKgehfErFJ9eVl2CyVpP_4xrdQw" />
+   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=qaiu/netdisk-fast-download&type=date&legend=bottom-right&sealed_token=dfQO_dJcTqcPkEnM7SfxRyHoFbV5Ah4LxoEhdlheMn4T2YLEV_WETxFZexeAbWN5OmNyYuycWan2d42PAFbw0CuU4oCTKgehfErFJ9eVl2CyVpP_4xrdQw" />
+ </picture>
+</a>

 ## **免责声明**  
   - 用户在使用本项目时，应自行承担风险，并确保其行为符合当地法律法规。开发者不对用户因使用本项目而导致的任何后果负责。
@@ -65,7 +65,7 @@
        <dependency>
            <groupId>org.postgresql</groupId>
            <artifactId>postgresql</artifactId>
-            <version>42.7.11</version>
+            <version>42.7.13</version>
        </dependency>

    </dependencies>
@@ -21,6 +21,8 @@ import java.nio.file.Path;
 import java.util.Calendar;
 import java.util.Date;
 import java.util.UUID;
+import java.util.List;
+import java.util.concurrent.CopyOnWriteArrayList;
 import java.util.concurrent.locks.LockSupport;

 import static cn.qaiu.vx.core.util.ConfigConstant.*;
@@ -45,11 +47,25 @@ public final class Deploy {
    private Handler<JsonObject> handle;

    private Thread mainThread;
+    private final List<Runnable> preShutdownTasks = new CopyOnWriteArrayList<>();
+    private final List<Runnable> postShutdownTasks = new CopyOnWriteArrayList<>();

    public static Deploy instance() {
        return INSTANCE;
    }

+    public void addPreShutdownTask(Runnable task) {
+        if (task != null) {
+            preShutdownTasks.add(task);
+        }
+    }
+
+    public void addPostShutdownTask(Runnable task) {
+        if (task != null) {
+            postShutdownTasks.add(task);
+        }
+    }
+
    /**
     *
     * @param args 启动参数
@@ -133,9 +149,16 @@ public final class Deploy {
        customConfig = globalConfig.getJsonObject(CUSTOM);

        JsonObject vertxConfig = globalConfig.getJsonObject(VERTX);
-        Integer vertxConfigELPS = vertxConfig.getInteger(EVENT_LOOP_POOL_SIZE);
-        var vertxOptions = vertxConfigELPS == 0 ?
-                new VertxOptions() : new VertxOptions(vertxConfig);
+        JsonObject vertxOptionsConfig = vertxConfig.copy();
+        if (vertxOptionsConfig.getInteger(EVENT_LOOP_POOL_SIZE, 0) == 0) {
+            vertxOptionsConfig.remove(EVENT_LOOP_POOL_SIZE);
+        }
+        if (vertxOptionsConfig.getInteger("workerPoolSize", 0) == 0) {
+            vertxOptionsConfig.remove("workerPoolSize");
+        }
+        Integer vertxConfigELPS = vertxConfig.getInteger(EVENT_LOOP_POOL_SIZE, 0);
+        var vertxOptions = vertxOptionsConfig.isEmpty() ?
+                new VertxOptions() : new VertxOptions(vertxOptionsConfig);

 //        vertxOptions.setAddressResolverOptions(
 //                new AddressResolverOptions().
@@ -151,12 +174,16 @@ public final class Deploy {

        // 注册 ShutdownHook，确保进程退出时优雅关闭资源
        Runtime.getRuntime().addShutdownHook(new Thread(() -> {
-            LOGGER.info("JVM shutting down, closing Vert.x...");
+            LOGGER.info("JVM shutting down...");
+            runShutdownTasks("before Vert.x close", preShutdownTasks);
            try {
+                LOGGER.info("Closing Vert.x...");
                vertx.close().toCompletionStage().toCompletableFuture().get(10, java.util.concurrent.TimeUnit.SECONDS);
                LOGGER.info("Vert.x closed successfully");
            } catch (Exception e) {
                LOGGER.warn("Vert.x close error or timeout", e);
+            } finally {
+                runShutdownTasks("after Vert.x close", postShutdownTasks);
            }
        }));
        //配置保存在共享数据中
@@ -165,24 +192,25 @@ public final class Deploy {
        localMap.put(GLOBAL_CONFIG, globalConfig);
        localMap.put(CUSTOM_CONFIG, customConfig);
        localMap.put(SERVER, globalConfig.getJsonObject(SERVER));
-        var future0 = vertx.createSharedWorkerExecutor("other-handle")
-                .executeBlocking(() -> {
+        WorkerExecutor otherHandleExecutor = vertx.createSharedWorkerExecutor("other-handle");
+        var future0 = otherHandleExecutor.executeBlocking(() -> {
                    handle.handle(globalConfig);
                    return "Other handle complete";
                });

        future0.onSuccess(res -> {
+            otherHandleExecutor.close();
            LOGGER.info(res);
            // 部署 路由、异步service、反向代理 服务
            var future1 = vertx.deployVerticle(RouterVerticle.class, getWorkDeploymentOptions("Router"));
            var future2 = vertx.deployVerticle(ServiceVerticle.class, getWorkDeploymentOptions("Service"));
-            var future3 = vertx.deployVerticle(ReverseProxyVerticle.class, getWorkDeploymentOptions("proxy"));
+            var future3 = vertx.deployVerticle(ReverseProxyVerticle.class, getWorkDeploymentOptions("proxy", 1));


            JsonObject jsonObject = ((JsonObject) localMap.get(GLOBAL_CONFIG)).getJsonObject("proxy-server");
            if (jsonObject != null) {
                genPwd(jsonObject);
-                var future4 = vertx.deployVerticle(HttpProxyVerticle.class, getWorkDeploymentOptions("proxy"));
+                var future4 = vertx.deployVerticle(HttpProxyVerticle.class, getWorkDeploymentOptions("proxy", 1));
                future4.onSuccess(LOGGER::info);
                future4.onFailure(e -> LOGGER.error("Other handle error", e));
                Future.all(future1, future2, future3, future4)
@@ -194,7 +222,10 @@ public final class Deploy {
                        .onFailure(this::deployVerticalFailed);
            }

-        }).onFailure(e -> LOGGER.error("Other handle error", e));
+        }).onFailure(e -> {
+            otherHandleExecutor.close();
+            LOGGER.error("Other handle error", e);
+        });
    }

    private static void genPwd(JsonObject jsonObject) {
@@ -211,6 +242,21 @@ public final class Deploy {
                jsonObject.getString("password"));
        LOGGER.info("==============server info================");
    }
+
+    private static void runShutdownTasks(String stage, List<Runnable> tasks) {
+        if (tasks.isEmpty()) {
+            return;
+        }
+        LOGGER.info("Running {} shutdown tasks: {}", stage, tasks.size());
+        for (Runnable task : tasks) {
+            try {
+                task.run();
+            } catch (Exception e) {
+                LOGGER.warn("Shutdown task failed at stage {}", stage, e);
+            }
+        }
+    }
+
    /**
     * 部署失败
     *
@@ -1,14 +1,20 @@
 package cn.qaiu.vx.core.base;

+import cn.qaiu.vx.core.annotaions.HandleSortFilter;
 import cn.qaiu.vx.core.interceptor.AfterInterceptor;
 import cn.qaiu.vx.core.model.JsonResult;
-import cn.qaiu.vx.core.util.CommonUtil;
 import cn.qaiu.vx.core.util.ReflectionUtil;
 import io.vertx.core.json.JsonObject;
 import io.vertx.ext.web.RoutingContext;
 import org.reflections.Reflections;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;

+import java.util.Collections;
+import java.util.LinkedHashSet;
+import java.util.Objects;
 import java.util.Set;
+import java.util.stream.Collectors;

 import static cn.qaiu.vx.core.util.ResponseUtil.*;

@@ -22,9 +28,10 @@ public interface BaseHttpApi {

    // 需要扫描注册的Router路径
    Reflections reflections = ReflectionUtil.getReflections();
+    Logger LOGGER = LoggerFactory.getLogger(BaseHttpApi.class);

    default void doFireJsonObjectResponse(RoutingContext ctx, JsonObject jsonObject) {
-        if (!ctx.response().ended()) {
+        if (!isResponseDone(ctx)) {
            fireJsonObjectResponse(ctx, jsonObject);
        }
        handleAfterInterceptor(ctx, jsonObject);
@@ -32,14 +39,14 @@ public interface BaseHttpApi {


    default <T> void doFireJsonResultResponse(RoutingContext ctx, JsonResult<T> jsonResult) {
-        if (!ctx.response().ended()) {
+        if (!isResponseDone(ctx)) {
            fireJsonResultResponse(ctx, jsonResult);
        }
        handleAfterInterceptor(ctx, jsonResult.toJsonObject());
    }

    default void doFireJsonObjectResponse(RoutingContext ctx, JsonObject jsonObject, int statusCode) {
-        if (!ctx.response().ended()) {
+        if (!isResponseDone(ctx)) {
            fireJsonObjectResponse(ctx, jsonObject, statusCode);
        }
        handleAfterInterceptor(ctx, jsonObject);
@@ -47,30 +54,78 @@ public interface BaseHttpApi {


    default <T> void doFireJsonResultResponse(RoutingContext ctx, JsonResult<T> jsonResult, int statusCode) {
-        if (!ctx.response().ended()) {
+        if (!isResponseDone(ctx)) {
            fireJsonResultResponse(ctx, jsonResult, statusCode);
        }
        handleAfterInterceptor(ctx, jsonResult.toJsonObject());
    }

    default Set<AfterInterceptor> getAfterInterceptor() {
+        return AfterInterceptorHolder.INSTANCES;
+    }

-        Set<Class<? extends AfterInterceptor>> afterInterceptorClassSet =
-                reflections.getSubTypesOf(AfterInterceptor.class);
-        if (afterInterceptorClassSet == null) {
-            return null;
+    class AfterInterceptorHolder {
+        private static final Set<AfterInterceptor> INSTANCES = loadAfterInterceptors();
+
+        private static Set<AfterInterceptor> loadAfterInterceptors() {
+            Set<Class<? extends AfterInterceptor>> afterInterceptorClassSet =
+                    reflections.getSubTypesOf(AfterInterceptor.class);
+            if (afterInterceptorClassSet == null || afterInterceptorClassSet.isEmpty()) {
+                return Collections.emptySet();
+            }
+            return afterInterceptorClassSet.stream()
+                    .filter(AfterInterceptorHolder::isEnabled)
+                    .sorted(AfterInterceptorHolder::compareOrder)
+                    .map(AfterInterceptorHolder::newInterceptor)
+                    .filter(Objects::nonNull)
+                    .collect(Collectors.collectingAndThen(
+                            Collectors.toCollection(LinkedHashSet::new),
+                            Collections::unmodifiableSet));
+        }
+
+        private static boolean isEnabled(Class<? extends AfterInterceptor> clazz) {
+            HandleSortFilter sort = clazz.getAnnotation(HandleSortFilter.class);
+            return sort == null || sort.value() >= 0;
+        }
+
+        private static int compareOrder(Class<? extends AfterInterceptor> left, Class<? extends AfterInterceptor> right) {
+            return Integer.compare(order(left), order(right));
+        }
+
+        private static int order(Class<? extends AfterInterceptor> clazz) {
+            HandleSortFilter sort = clazz.getAnnotation(HandleSortFilter.class);
+            return sort == null ? 0 : sort.value();
+        }
+
+        private static AfterInterceptor newInterceptor(Class<? extends AfterInterceptor> clazz) {
+            try {
+                return ReflectionUtil.newWithNoParam(clazz);
+            } catch (Exception e) {
+                LOGGER.warn("AfterInterceptor 初始化失败，已跳过: {}", clazz.getName(), e);
+                return null;
+            }
        }
-        return CommonUtil.sortClassSet(afterInterceptorClassSet);
    }

    default void handleAfterInterceptor(RoutingContext ctx, JsonObject jsonObject) {
-        Set<AfterInterceptor> afterInterceptor = getAfterInterceptor();
-        if (afterInterceptor != null) {
-            afterInterceptor.forEach(ai -> ai.handle(ctx, jsonObject));
+        if (ctx.response().closed()) {
+            return;
        }
-        if (!ctx.response().ended()) {
+        Set<AfterInterceptor> afterInterceptor = getAfterInterceptor();
+        afterInterceptor.forEach(ai -> {
+            try {
+                ai.handle(ctx, jsonObject);
+            } catch (Exception e) {
+                LOGGER.warn("AfterInterceptor 执行失败: {}", ai.getClass().getName(), e);
+            }
+        });
+        if (!isResponseDone(ctx)) {
            fireTextResponse(ctx, "handleAfterInterceptor: response not end");
        }
    }

+    default boolean isResponseDone(RoutingContext ctx) {
+        return ctx.response().ended() || ctx.response().closed();
+    }
+
 }
@@ -34,6 +34,7 @@ import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 import java.time.LocalDateTime;
 import java.util.*;
+import java.util.concurrent.atomic.AtomicReference;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;

@@ -96,7 +97,9 @@ public class RouterHandlerFactory implements BaseHttpApi {
        mainRouter.route().handler(CorsHandler.create().addRelativeOrigin(".*").allowCredentials(true).allowedMethods(httpMethods));

        // 配置文件上传路径
-        mainRouter.route().handler(BodyHandler.create().setUploadsDirectory("uploads"));
+        mainRouter.route().handler(BodyHandler.create()
+                .setUploadsDirectory("uploads")
+                .setBodyLimit(2L * 1024 * 1024));

        // 拦截器
        Set<Handler<RoutingContext>> interceptorSet = getInterceptorSet();
@@ -175,7 +178,7 @@ public class RouterHandlerFactory implements BaseHttpApi {
                route.handler(TimeoutHandler.create(SharedDataUtil.getCustomConfig().getInteger(ROUTE_TIME_OUT)));
                route.handler(ResponseTimeHandler.create());
                route.handler(ctx -> handlerMethod(instance, method, ctx)).failureHandler(ctx -> {
-                    if (ctx.response().ended()) return;
+                    if (isResponseDone(ctx)) return;
                    // 超时处理器状态码503
                    if (ctx.statusCode() == 503 || ctx.failure() == null) {
                        doFireJsonResultResponse(ctx, JsonResult.error("未知异常, 请联系管理员"), 503);
@@ -394,26 +397,34 @@ public class RouterHandlerFactory implements BaseHttpApi {

                if (data instanceof JsonResult jsonResult) {
                    doFireJsonResultResponse(ctx, (JsonResult<?>) data, jsonResult.getCode());
-                }
-                if (data instanceof JsonObject) {
+                } else if (data instanceof JsonObject) {
                    doFireJsonObjectResponse(ctx, ((JsonObject) data));
                } else if (data instanceof Future) { // 处理异步响应
-                    ((Future<?>) data).onSuccess(res -> {
-                        if (res instanceof JsonResult jsonResult) {
-                            doFireJsonResultResponse(ctx, jsonResult, jsonResult.getCode());
+                    Future<?> responseFuture = (Future<?>) data;
+                    AtomicReference<RoutingContext> ctxRef = new AtomicReference<>(ctx);
+                    ctx.addEndHandler(v -> ctxRef.set(null));
+                    responseFuture.onComplete(ar -> {
+                        RoutingContext responseCtx = ctxRef.getAndSet(null);
+                        if (responseCtx == null || isResponseDone(responseCtx)) {
+                            return;
                        }
-                        if (res instanceof JsonObject) {
-                            doFireJsonObjectResponse(ctx, ((JsonObject) res));
-                        } else if (res != null) {
-                            doFireJsonResultResponse(ctx, JsonResult.data(res));
+                        if (ar.succeeded()) {
+                            Object res = ar.result();
+                            if (res instanceof JsonResult jsonResult) {
+                                doFireJsonResultResponse(responseCtx, jsonResult, jsonResult.getCode());
+                            } else if (res instanceof JsonObject) {
+                                doFireJsonObjectResponse(responseCtx, ((JsonObject) res));
+                            } else if (res != null) {
+                                doFireJsonResultResponse(responseCtx, JsonResult.data(res));
+                            } else {
+                                doFireJsonResultResponse(responseCtx, JsonResult.data(null));
+                            }
                        } else {
-                            doFireJsonResultResponse(ctx, JsonResult.data(null));
+                            Throwable e = ar.cause();
+                            LOGGER.error("请求处理失败", e);
+                            String msg = e != null && e.getMessage() != null ? e.getMessage() : "服务器内部错误";
+                            doFireJsonResultResponse(responseCtx, JsonResult.error(msg), 500);
                        }
-
-                    }).onFailure(e -> {
-                        LOGGER.error("请求处理失败", e);
-                        String msg = e.getMessage() != null ? e.getMessage() : "服务器内部错误";
-                        doFireJsonResultResponse(ctx, JsonResult.error(msg), 500);
                    });
                } else {
                    doFireJsonResultResponse(ctx, JsonResult.data(data));
@@ -17,6 +17,8 @@ import java.util.LinkedHashSet;
 import java.util.Map;
 import java.util.Properties;
 import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.regex.Pattern;
 import java.util.stream.Collectors;

 /**
@@ -29,6 +31,16 @@ public class CommonUtil {

    private static final Logger LOGGER = LoggerFactory.getLogger(CommonUtil.class);

+    /** 正则表达式缓存，避免每次调用重新编译 */
+    private static final ConcurrentHashMap<String, Pattern> PATTERN_CACHE = new ConcurrentHashMap<>();
+
+    /**
+     * 获取预编译的 Pattern（带缓存）
+     */
+    private static Pattern getCachedPattern(String regex) {
+        return PATTERN_CACHE.computeIfAbsent(regex, Pattern::compile);
+    }
+
    /**
     * 匹配正则list
     *
@@ -39,7 +51,7 @@ public class CommonUtil {
    public static boolean matchRegList(List<?> regList, String destStr) {
        // 判断是否忽略
        for (Object ignores : regList) {
-            if (destStr.matches(ignores.toString())) {
+            if (getCachedPattern(ignores.toString()).matcher(destStr).matches()) {
                return true;
            }
        }
@@ -147,10 +159,12 @@ public class CommonUtil {
    public static String getAppVersion() {
        if (null == appVersion) {
            Properties properties = new Properties();
-            try {
-                properties.load(CommonUtil.class.getClassLoader().getResourceAsStream("app.properties"));
-                if (!properties.isEmpty()) {
-                    appVersion = properties.getProperty("app.version") + "build" + properties.getProperty("build");
+            try (var is = CommonUtil.class.getClassLoader().getResourceAsStream("app.properties")) {
+                if (is != null) {
+                    properties.load(is);
+                    if (!properties.isEmpty()) {
+                        appVersion = properties.getProperty("app.version") + "build" + properties.getProperty("build");
+                    }
                }
            } catch (IOException e) {
                LOGGER.error("读取app.properties失败", e);
@@ -4,17 +4,41 @@ import io.vertx.core.Future;
 import io.vertx.core.Promise;

 import java.util.concurrent.ExecutionException;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;

 public class FutureUtils {

-   public static <T> T getResult(Future<T> future) {
-       try {
-           return future.toCompletionStage().toCompletableFuture().get();
-       } catch (InterruptedException | ExecutionException e) {
-           throw new RuntimeException(e);
-       }
-   }
+    /** 默认同步等待超时时间（秒） */
+    private static final long DEFAULT_TIMEOUT_SECONDS = 120;
+
+    public static <T> T getResult(Future<T> future) {
+        try {
+            return future.toCompletionStage().toCompletableFuture()
+                    .get(DEFAULT_TIMEOUT_SECONDS, TimeUnit.SECONDS);
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            throw new RuntimeException("线程被中断", e);
+        } catch (TimeoutException e) {
+            throw new RuntimeException("等待Future超时（" + DEFAULT_TIMEOUT_SECONDS + "秒）", e);
+        } catch (ExecutionException e) {
+            Throwable cause = e.getCause();
+            throw new RuntimeException(cause != null ? cause : e);
+        }
+    }
+
    public static <T> T getResult(Promise<T> promise) {
-       return promise.future().toCompletionStage().toCompletableFuture().join();
+        try {
+            return promise.future().toCompletionStage().toCompletableFuture()
+                    .get(DEFAULT_TIMEOUT_SECONDS, TimeUnit.SECONDS);
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            throw new RuntimeException("线程被中断", e);
+        } catch (TimeoutException e) {
+            throw new RuntimeException("等待Promise超时（" + DEFAULT_TIMEOUT_SECONDS + "秒）", e);
+        } catch (ExecutionException e) {
+            Throwable cause = e.getCause();
+            throw new RuntimeException(cause != null ? cause : e);
+        }
    }
 }
@@ -24,6 +24,7 @@ import java.lang.reflect.Method;
 import java.net.URL;
 import java.text.ParseException;
 import java.util.*;
+import java.util.regex.Pattern;

 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -44,6 +45,12 @@ public final class ReflectionUtil {
    // 缓存Reflections实例，避免重复扫描（每次扫描约35K+值，耗时1-3秒，占用大量内存）
    private static final Map<String, Reflections> REFLECTIONS_CACHE = new java.util.concurrent.ConcurrentHashMap<>();

+    // 预编译的类型匹配正则，避免每次请求重新编译
+    private static final Pattern BASIC_TYPE_PATTERN = Pattern.compile(
+            "^java\\.lang\\.((Boolean)|(Character)|(Byte)|(Short)|(Integer)|(Long)|(Float)|(Double)|(String))$");
+    private static final Pattern BASIC_TYPE_ARRAY_PATTERN = Pattern.compile(
+            "^(boolean|char|byte|short|int|long|float|double|String)\\[]$");
+
    /**
     * 以默认配置的基础包路径获取反射器
     *
@@ -234,8 +241,7 @@ public final class ReflectionUtil {
        if (ctClass.isPrimitive() || "java.util.Date".equals(ctClass.getName())) {
            return true;
        }
-        return ctClass.getName().matches("^java\\.lang\\.((Boolean)|(Character)|(Byte)|(Short)|(Integer)|(Long)|" +
-                "(Float)|(Double)|(String))$");
+        return BASIC_TYPE_PATTERN.matcher(ctClass.getName()).matches();
    }

    /**
@@ -246,7 +252,7 @@ public final class ReflectionUtil {
    public static boolean isBasicTypeArray(CtClass ctClass) {
        if (!ctClass.isArray()) {
            return false;
-        } else return (ctClass.getName().matches("^(boolean|char|byte|short|int|long|float|double|String)\\[]$"));
+        } else return BASIC_TYPE_ARRAY_PATTERN.matcher(ctClass.getName()).matches();
    }

    /**
@@ -12,14 +12,21 @@ import static io.vertx.core.http.HttpHeaders.CONTENT_TYPE;
 public class ResponseUtil {

    public static void redirect(HttpServerResponse response, String url) {
+        if (response.ended() || response.closed()) {
+            return;
+        }
        response.putHeader(CONTENT_TYPE, "text/html; charset=utf-8")
                .putHeader("Referrer-Policy", "no-referrer")
                .putHeader(HttpHeaders.LOCATION, url).setStatusCode(302).end();
    }

    public static void redirect(HttpServerResponse response, String url, Promise<?> promise) {
-        redirect(response, url);
-        promise.complete();
+        try {
+            redirect(response, url);
+            promise.tryComplete();
+        } catch (Throwable t) {
+            promise.tryFail(t);
+        }
    }

    public static void fireJsonObjectResponse(RoutingContext ctx, JsonObject jsonObject) {
@@ -31,12 +38,18 @@ public class ResponseUtil {
    }

    public static void fireJsonObjectResponse(RoutingContext ctx, JsonObject jsonObject, int statusCode) {
+        if (ctx.response().ended() || ctx.response().closed()) {
+            return;
+        }
        ctx.response().putHeader(CONTENT_TYPE, "application/json; charset=utf-8")
                .setStatusCode(statusCode)
                .end(jsonObject.encode());
    }

    public static void fireJsonObjectResponse(HttpServerResponse ctx, JsonObject jsonObject, int statusCode) {
+        if (ctx.ended() || ctx.closed()) {
+            return;
+        }
        ctx.putHeader(CONTENT_TYPE, "application/json; charset=utf-8")
                .setStatusCode(statusCode)
                .end(jsonObject.encode());
@@ -55,10 +68,16 @@ public class ResponseUtil {
    }

    public static void fireTextResponse(RoutingContext ctx, String text) {
+        if (ctx.response().ended() || ctx.response().closed()) {
+            return;
+        }
        ctx.response().putHeader(CONTENT_TYPE, "text/html; charset=utf-8").end(text);
    }

    public static void sendError(RoutingContext ctx, int statusCode) {
+        if (ctx.response().ended() || ctx.response().closed()) {
+            return;
+        }
        ctx.response().setStatusCode(statusCode).end();
    }
 }
@@ -3,7 +3,6 @@ package cn.qaiu.vx.core.util;
 import io.vertx.core.json.JsonArray;
 import io.vertx.core.json.JsonObject;
 import io.vertx.core.shareddata.LocalMap;
-import io.vertx.core.shareddata.SharedData;

 /**
 * vertx 共享数据
@@ -13,10 +12,8 @@ import io.vertx.core.shareddata.SharedData;
 */
 public class SharedDataUtil {

-    private static final SharedData sharedData = VertxHolder.getVertxInstance().sharedData();
-
-    public static SharedData shareData() {
-        return sharedData;
+    public static io.vertx.core.shareddata.SharedData shareData() {
+        return VertxHolder.getVertxInstance().sharedData();
    }

    public static LocalMap<String, Object> getLocalMap(String key) {
@@ -24,7 +21,7 @@ public class SharedDataUtil {
    }

    public static <T> LocalMap<String, T> getLocalMapWithCast(String key) {
-        return  sharedData.getLocalMap(key);
+        return shareData().getLocalMap(key);
    }

    public static JsonObject getJsonConfig(String key) {
@@ -1,10 +1,13 @@
 package cn.qaiu.vx.core.verticle;

 import io.vertx.core.AbstractVerticle;
+import io.vertx.core.Future;
+import io.vertx.core.Promise;
 import io.vertx.core.http.*;
 import io.vertx.core.json.JsonObject;
 import io.vertx.core.net.NetClient;
 import io.vertx.core.net.NetClientOptions;
+import io.vertx.core.net.NetSocket;
 import io.vertx.core.net.ProxyOptions;
 import org.apache.commons.lang3.StringUtils;
 import org.slf4j.Logger;
@@ -24,13 +27,16 @@ public class HttpProxyVerticle extends AbstractVerticle {

    private HttpClient httpClient;
    private NetClient netClient;
+    private HttpServer httpServer;
+    private volatile boolean stopping = false;

    private JsonObject proxyPreConf;
    private JsonObject proxyServerConf;


    @Override
-    public void start() {
+    public void start(io.vertx.core.Promise<Void> startPromise) {
+        stopping = false;
        proxyServerConf = ((JsonObject)vertx.sharedData().getLocalMap(LOCAL).get(GLOBAL_CONFIG)).getJsonObject("proxy-server");
        proxyPreConf = ((JsonObject)vertx.sharedData().getLocalMap(LOCAL).get(GLOBAL_CONFIG)).getJsonObject("proxy-pre");
        Integer serverPort = proxyServerConf.getInteger("port");
@@ -41,7 +47,12 @@ public class HttpProxyVerticle extends AbstractVerticle {
        }

        // 初始化 HTTP 客户端，用于向目标服务器发送 HTTP 请求
-        HttpClientOptions httpClientOptions = new HttpClientOptions();
+        HttpClientOptions httpClientOptions = new HttpClientOptions()
+                .setMaxPoolSize(64)
+                .setMaxWaitQueueSize(256)
+                .setConnectTimeout(15000)
+                .setIdleTimeout(60)
+                .setKeepAlive(true);
        if (proxyOptions != null) {
            httpClientOptions.setProxyOptions(proxyOptions);
        }
@@ -54,14 +65,14 @@ public class HttpProxyVerticle extends AbstractVerticle {
            httpServerOptions.setClientAuth(ClientAuth.REQUIRED);
        }

-        HttpServer server = vertx.createHttpServer();
-        server.requestHandler(this::handleClientRequest);
+        httpServer = vertx.createHttpServer(httpServerOptions);
+        httpServer.requestHandler(this::handleClientRequest);

        // 初始化 NetClient，用于在 CONNECT 请求中建立 TCP 连接隧道
        NetClientOptions netClientOptions = new NetClientOptions();

        if (proxyOptions != null) {
-            httpClientOptions.setProxyOptions(proxyOptions);
+            netClientOptions.setProxyOptions(proxyOptions);
        }

        netClient = vertx.createNetClient(netClientOptions
@@ -69,16 +80,22 @@ public class HttpProxyVerticle extends AbstractVerticle {
                .setTrustAll(true));

        // 启动 HTTP 代理服务器
-        server.listen(serverPort)
-                .onSuccess(res-> LOGGER.info("HTTP Proxy server started on port {}", serverPort))
-                .onFailure(err-> LOGGER.error("Failed to start HTTP Proxy server: " + err.getMessage()));
+        httpServer.listen(serverPort)
+                .onSuccess(res -> {
+                    LOGGER.info("HTTP Proxy server started on port {}", serverPort);
+                    startPromise.complete();
+                })
+                .onFailure(err -> {
+                    LOGGER.error("Failed to start HTTP Proxy server: " + err.getMessage(), err);
+                    closeClients().onComplete(close -> startPromise.fail(err));
+                });
    }

    // 处理 HTTP CONNECT 请求，用于代理 HTTPS 流量
    private void handleConnectRequest(HttpServerRequest clientRequest) {
        String[] uriParts = clientRequest.uri().split(":");
        if (uriParts.length != 2) {
-            clientRequest.response().setStatusCode(400).end("Bad Request: Invalid URI format");
+            failClientResponse(clientRequest.response(), 400, "Bad Request: Invalid URI format");
            return;
        }

@@ -88,45 +105,61 @@ public class HttpProxyVerticle extends AbstractVerticle {
        try {
            targetPort = Integer.parseInt(uriParts[1]);
        } catch (NumberFormatException e) {
-            clientRequest.response().setStatusCode(400).end("Bad Request: Invalid port");
+            failClientResponse(clientRequest.response(), 400, "Bad Request: Invalid port");
            return;
        }
        clientRequest.pause();
        // 通过 NetClient 连接目标服务器并创建隧道
-        netClient.connect(targetPort, targetHost)
-                .onSuccess(targetSocket -> {
-                    // Upgrade client connection to NetSocket and implement bidirectional data flow
-                    clientRequest.toNetSocket()
-                            .onSuccess(clientSocket -> {
-                                // Set up bidirectional data forwarding
-                                clientSocket.handler(targetSocket::write);
-                                targetSocket.handler(clientSocket::write);
+        try {
+            netClient.connect(targetPort, targetHost)
+                    .onSuccess(targetSocket -> {
+                        // Upgrade client connection to NetSocket and implement bidirectional data flow
+                        clientRequest.toNetSocket()
+                                .onSuccess(clientSocket -> {
+                                    clientSocket.pipeTo(targetSocket)
+                                            .onFailure(err -> {
+                                                LOGGER.debug("CONNECT client -> target pipe closed", err);
+                                                closeTunnelSockets(clientSocket, targetSocket);
+                                            });
+                                    targetSocket.pipeTo(clientSocket)
+                                            .onFailure(err -> {
+                                                LOGGER.debug("CONNECT target -> client pipe closed", err);
+                                                closeTunnelSockets(clientSocket, targetSocket);
+                                            });

-                                // Close the other socket when one side closes
-                                clientSocket.closeHandler(v -> targetSocket.close());
-                                targetSocket.closeHandler(v -> clientSocket.close());
-                            })
-                            .onFailure(clientSocketAttempt -> {
-                                System.err.println("Failed to upgrade client connection to socket: " + clientSocketAttempt.getMessage());
-                                targetSocket.close();
-                                clientRequest.response().setStatusCode(500).end("Internal Server Error");
-                            });
-                })
-                .onFailure(connectionAttempt -> {
-                    System.err.println("Failed to connect to target: " + connectionAttempt.getMessage());
-                    clientRequest.response().setStatusCode(502).end("Bad Gateway: Unable to connect to target");
-                });
+                                    // Close the other socket when one side closes
+                                    clientSocket.closeHandler(v -> targetSocket.close());
+                                    targetSocket.closeHandler(v -> clientSocket.close());
+                                })
+                                .onFailure(clientSocketAttempt -> {
+                                    System.err.println("Failed to upgrade client connection to socket: " + clientSocketAttempt.getMessage());
+                                    targetSocket.close();
+                                    failClientRequestAndClose(clientRequest, 500, "Internal Server Error");
+                                });
+                    })
+                    .onFailure(connectionAttempt -> {
+                        LOGGER.warn("Failed to connect to target: {}", connectionAttempt.getMessage());
+                        failClientRequestAndClose(clientRequest, 502, "Bad Gateway: Unable to connect to target");
+                    });
+        } catch (Exception e) {
+            LOGGER.warn("CONNECT 请求创建失败", e);
+            failClientRequestAndClose(clientRequest, 502, "Bad Gateway: Unable to connect to target");
+        }
    }

    // 处理客户端的 HTTP 请求
    private void handleClientRequest(HttpServerRequest clientRequest) {
+        if (stopping) {
+            failClientResponse(clientRequest.response(), 503, "Service Unavailable");
+            return;
+        }
        // 打印来源ip和访问目标URI
        LOGGER.debug("source: {}, target: {}", clientRequest.remoteAddress().toString(), clientRequest.uri());
        if (proxyServerConf.containsKey("username") &&
                StringUtils.isNotBlank(proxyServerConf.getString("username"))) {
            String s = clientRequest.headers().get("Proxy-Authorization");
            if (s == null) {
-                clientRequest.response().setStatusCode(403).end();
+                failClientResponse(clientRequest.response(), 403, null);
                return;
            }
            String[] split;
@@ -134,19 +167,19 @@ public class HttpProxyVerticle extends AbstractVerticle {
                split = new String(Base64.getDecoder().decode(s.replace("Basic ", ""))).split(":");
            } catch (IllegalArgumentException e) {
                LOGGER.warn("Proxy-Authorization header is not valid Base64");
-                clientRequest.response().setStatusCode(403).end();
+                failClientResponse(clientRequest.response(), 403, null);
                return;
            }
            if (split.length <= 1) {
                LOGGER.warn("Proxy-Authorization header format invalid: missing username:password separator");
-                clientRequest.response().setStatusCode(403).end();
+                failClientResponse(clientRequest.response(), 403, null);
                return;
            }
            String username = proxyServerConf.getString("username");
            String password = proxyServerConf.getString("password");
            if (!split[0].equals(username) || !split[1].equals(password)) {
                LOGGER.info("-----auth failed------\nusername: {}", split[0]);
-                clientRequest.response().setStatusCode(403).end();
+                failClientResponse(clientRequest.response(), 403, null);
                return;
            }
        }
@@ -165,40 +198,147 @@ public class HttpProxyVerticle extends AbstractVerticle {
        // 获取目标主机
        String hostHeader = clientRequest.getHeader("Host");
        if (hostHeader == null) {
-            clientRequest.response().setStatusCode(400).end("Host header is missing");
+            failClientResponse(clientRequest.response(), 400, "Host header is missing");
            return;
        }

-        String targetHost = hostHeader.split(":")[0];
-        int targetPort = extractPortFromUrl(clientRequest.uri()); // 默认为 HTTP 的端口
-        clientRequest.pause(); // 暂停客户端请求的读取，避免数据丢失
+        HostAndPort target;
+        try {
+            target = parseHostHeader(hostHeader);
+        } catch (IllegalArgumentException e) {
+            failClientResponse(clientRequest.response(), 400, "Bad Request: Invalid Host header");
+            return;
+        }
+        String targetHost = target.host();
+        int targetPort = extractPortFromUrl(clientRequest.uri(), target.port()); // 默认为 HTTP 的端口
+        if (targetPort <= 0) {
+            failClientResponse(clientRequest.response(), 400, "Bad Request: Invalid target port");
+            return;
+        }
+        clientRequest.pause(); // 暂停客户端请求的读取，等上游请求创建完成

-        httpClient.request(clientRequest.method(), targetPort, targetHost, clientRequest.uri())
-                .onSuccess(request -> {
-                    clientRequest.resume(); // 恢复客户端请求的读取
+        try {
+            httpClient.request(clientRequest.method(), targetPort, targetHost, clientRequest.uri())
+                    .onSuccess(request -> {
+                        // 逐个设置请求头
+                        clientRequest.headers().forEach(header -> request.putHeader(header.getKey(), header.getValue()));

-                    // 逐个设置请求头
-                    clientRequest.headers().forEach(header -> request.putHeader(header.getKey(), header.getValue()));
+                        request.response()
+                                .onSuccess(response -> {
+                                    HttpServerResponse clientResponse = clientRequest.response();
+                                    if (clientResponse.ended() || clientResponse.closed()) {
+                                        response.resume();
+                                        return;
+                                    }
+                                    clientResponse.setStatusCode(response.statusCode());
+                                    clientResponse.headers().setAll(response.headers());
+                                    response.pipeTo(clientResponse)
+                                            .onFailure(err -> {
+                                                LOGGER.error("HTTP代理响应转发失败", err);
+                                                try {
+                                                    response.request().reset();
+                                                } catch (Exception e) {
+                                                    LOGGER.debug("HTTP代理上游响应已关闭", e);
+                                                }
+                                                failClientRequestAndClose(clientRequest, 502, "Bad Gateway: Unable to reach target");
+                                            });
+                                })
+                                .onFailure(err -> {
+                                    LOGGER.error("HTTP代理响应失败", err);
+                                    try {
+                                        request.reset();
+                                    } catch (Exception e) {
+                                        LOGGER.debug("HTTP代理上游请求已关闭", e);
+                                    }
+                                    failClientRequestAndClose(clientRequest, 502, "Bad Gateway: Unable to reach target");
+                                });

-                    // 将客户端请求的 body 转发给目标服务器
-                    clientRequest.bodyHandler(body ->
-                            request.send(body)
-                                    .onSuccess(response -> {
-                                        clientRequest.response().setStatusCode(response.statusCode());
-                                        clientRequest.response().headers().setAll(response.headers());
-                                        response.body()
-                                                .onSuccess(b -> clientRequest.response().end(b))
-                                                .onFailure(err -> clientRequest.response()
-                                                        .setStatusCode(502).end("Bad Gateway: Unable to reach target"));
-                                    })
-                                    .onFailure(err -> clientRequest.response()
-                                            .setStatusCode(502).end("Bad Gateway: Unable to reach target"))
-                    );
-                })
-                .onFailure(err -> {
-                    LOGGER.error("HTTP请求失败", err);
-                    clientRequest.response().setStatusCode(502).end("Bad Gateway: Request failed");
-                });
+                        clientRequest.pipeTo(request)
+                                .onFailure(err -> {
+                                    LOGGER.error("HTTP代理请求转发失败", err);
+                                    try {
+                                        request.reset();
+                                    } catch (Exception e) {
+                                        LOGGER.debug("HTTP代理上游请求已关闭", e);
+                                    }
+                                    failClientRequestAndClose(clientRequest, 502, "Bad Gateway: Unable to reach target");
+                                });
+                        clientRequest.resume();
+                    })
+                    .onFailure(err -> {
+                        LOGGER.error("HTTP请求失败", err);
+                        failClientRequestAndClose(clientRequest, 502, "Bad Gateway: Request failed");
+                    });
+        } catch (Exception e) {
+            LOGGER.error("HTTP请求创建失败", e);
+            failClientRequestAndClose(clientRequest, 502, "Bad Gateway: Request failed");
+        }
+    }
+
+    private void failClientResponse(HttpServerResponse response, String message) {
+        failClientResponse(response, 502, message);
+    }
+
+    private void failClientResponse(HttpServerResponse response, int statusCode, String message) {
+        if (response.ended() || response.closed()) {
+            return;
+        }
+        try {
+            if (!response.headWritten()) {
+                response.setStatusCode(statusCode);
+                if (message == null) {
+                    response.end();
+                } else {
+                    response.end(message);
+                }
+            } else {
+                response.reset();
+            }
+        } catch (Exception e) {
+            LOGGER.debug("客户端响应已关闭，忽略代理错误响应", e);
+        }
+    }
+
+    private void failClientRequestAndClose(HttpServerRequest request, int statusCode, String message) {
+        HttpServerResponse response = request.response();
+        if (response.ended() || response.closed()) {
+            closeClientConnection(request);
+            return;
+        }
+        try {
+            if (!response.headWritten()) {
+                response.setStatusCode(statusCode);
+                Future<Void> endFuture = message == null ? response.end() : response.end(message);
+                endFuture.onComplete(v -> closeClientConnection(request));
+            } else {
+                response.reset();
+                closeClientConnection(request);
+            }
+        } catch (Exception e) {
+            LOGGER.debug("客户端响应已关闭，关闭代理连接", e);
+            closeClientConnection(request);
+        }
+    }
+
+    private void closeClientConnection(HttpServerRequest request) {
+        try {
+            request.connection().close();
+        } catch (Exception e) {
+            LOGGER.debug("关闭客户端代理连接失败", e);
+        }
+    }
+
+    private void closeTunnelSockets(NetSocket clientSocket, NetSocket targetSocket) {
+        try {
+            clientSocket.close();
+        } catch (Exception e) {
+            LOGGER.debug("关闭CONNECT客户端socket失败", e);
+        }
+        try {
+            targetSocket.close();
+        } catch (Exception e) {
+            LOGGER.debug("关闭CONNECT目标socket失败", e);
+        }
    }


@@ -209,6 +349,10 @@ public class HttpProxyVerticle extends AbstractVerticle {
     * @return 提取的端口号，如果没有指定端口，则返回默认端口
     */
    public static int extractPortFromUrl(String urlString) {
+        return extractPortFromUrl(urlString, 80);
+    }
+
+    public static int extractPortFromUrl(String urlString, int defaultPort) {
        try {
            URI uri = new URI(urlString);
            int port = uri.getPort();
@@ -217,7 +361,7 @@ public class HttpProxyVerticle extends AbstractVerticle {
                if ("https".equalsIgnoreCase(uri.getScheme())) {
                    port = 443; // HTTPS 默认端口
                } else {
-                    port = 80; // HTTP 默认端口
+                    port = defaultPort; // HTTP 默认端口
                }
            }
            return port;
@@ -228,16 +372,48 @@ public class HttpProxyVerticle extends AbstractVerticle {
        }
    }

+    private HostAndPort parseHostHeader(String hostHeader) {
+        if (hostHeader.startsWith("[")) {
+            int end = hostHeader.indexOf(']');
+            if (end > 0) {
+                String host = hostHeader.substring(1, end);
+                int port = 80;
+                if (hostHeader.length() > end + 2 && hostHeader.charAt(end + 1) == ':') {
+                    port = Integer.parseInt(hostHeader.substring(end + 2));
+                }
+                return new HostAndPort(host, port);
+            }
+        }
+        int lastColon = hostHeader.lastIndexOf(':');
+        if (lastColon > 0 && hostHeader.indexOf(':') == lastColon) {
+            return new HostAndPort(hostHeader.substring(0, lastColon), Integer.parseInt(hostHeader.substring(lastColon + 1)));
+        }
+        return new HostAndPort(hostHeader, 80);
+    }
+
+    private record HostAndPort(String host, int port) {
+    }
+

    @Override
-    public void stop() {
-        // 停止 HTTP 客户端以释放资源
-        if (httpClient != null) {
-            httpClient.close();
-        }
-        if (netClient != null) {
-            netClient.close();
-        }
+    public void stop(Promise<Void> stopPromise) {
+        stopping = true;
+        Future<Void> serverClose = httpServer == null ? Future.succeededFuture() : httpServer.close();
+        serverClose.onComplete(serverResult -> closeClients().onComplete(clientResult -> {
+                    if (serverResult.failed()) {
+                        stopPromise.fail(serverResult.cause());
+                    } else if (clientResult.failed()) {
+                        stopPromise.fail(clientResult.cause());
+                    } else {
+                        stopPromise.complete();
+                    }
+                }));
+    }
+
+    private Future<Void> closeClients() {
+        Future<Void> httpClientClose = httpClient == null ? Future.succeededFuture() : httpClient.close();
+        Future<Void> netClientClose = netClient == null ? Future.succeededFuture() : netClient.close();
+        return Future.all(httpClientClose, netClientClose).mapEmpty();
    }

 }
@@ -3,17 +3,20 @@ package cn.qaiu.vx.core.verticle;
 import cn.qaiu.vx.core.util.*;
 import io.vertx.core.AbstractVerticle;
 import io.vertx.core.Future;
+import io.vertx.core.Handler;
 import io.vertx.core.Promise;
 import io.vertx.core.http.HttpClient;
 import io.vertx.core.http.HttpClientOptions;
 import io.vertx.core.http.HttpServer;
 import io.vertx.core.http.HttpServerOptions;
 import io.vertx.core.http.HttpServerRequest;
+import io.vertx.core.http.HttpServerResponse;
 import io.vertx.core.json.JsonArray;
 import io.vertx.core.json.JsonObject;
 import io.vertx.core.net.PemKeyCertOptions;
 import io.vertx.ext.web.Route;
 import io.vertx.ext.web.Router;
+import io.vertx.ext.web.RoutingContext;
 import io.vertx.ext.web.handler.StaticHandler;
 import io.vertx.ext.web.proxy.handler.ProxyHandler;
 import io.vertx.httpproxy.HttpProxy;
@@ -27,7 +30,9 @@ import org.slf4j.LoggerFactory;
 import java.io.File;
 import java.net.MalformedURLException;
 import java.net.URL;
+import java.util.ArrayList;
 import java.util.HashSet;
+import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
@@ -45,10 +50,6 @@ public class ReverseProxyVerticle extends AbstractVerticle {

    private static final Logger LOGGER = LoggerFactory.getLogger(ReverseProxyVerticle.class);

-    private static final String PATH_PROXY_CONFIG = SharedDataUtil
-            .getJsonConfig(ConfigConstant.GLOBAL_CONFIG)
-            .getString("proxyConf");
-    private static final Future<JsonObject> CONFIG = ConfigUtil.readYamlConfig(PATH_PROXY_CONFIG);
    private static final String DEFAULT_PATH_404 = "webroot/err/page404.html";

    private static String serverName = "Vert.x-proxy-server"; //Server name in Http response header
@@ -58,26 +59,40 @@ public class ReverseProxyVerticle extends AbstractVerticle {
    /**
     * 【优化】HttpClient连接池，按host:port缓存复用，避免每个请求都创建新连接
     */
-    private final Map<String, HttpClient> httpClientPool = new ConcurrentHashMap<>();
+    private final Map<String, HttpClientEntry> httpClientPool = new ConcurrentHashMap<>();
+    private final List<HttpServer> httpServers = new ArrayList<>();
+    private volatile boolean stopping = false;
+
+    /**
+     * 连接池条目。HttpProxy 会持有这里的 HttpClient 引用，不能在路由仍可用时关闭。
+     */
+    private static class HttpClientEntry {
+        final HttpClient client;
+
+        HttpClientEntry(HttpClient client) {
+            this.client = client;
+        }
+    }

    /**
     * 【优化】高并发场景下的HttpClient配置
     */
-    private static final int MAX_POOL_SIZE = 100;           // 最大连接池大小
-    private static final int MAX_WAIT_QUEUE_SIZE = 500;    // 最大等待队列大小
+    private static final int MAX_POOL_SIZE = 32;           // 最大连接池大小
+    private static final int MAX_WAIT_QUEUE_SIZE = 128;    // 最大等待队列大小
    private static final int CONNECT_TIMEOUT = 30000;      // 连接超时30秒
    private static final int IDLE_TIMEOUT = 60;            // 空闲超时60秒
    private static final boolean KEEP_ALIVE = true;        // 启用Keep-Alive
-    private static final boolean PIPELINING = true;        // 启用HTTP管线化
-
-
+    private static final boolean PIPELINING = false;       // 代理场景关闭管线化，避免慢响应堆积
    @Override
    public void start(Promise<Void> startPromise) {
-        CONFIG.onSuccess(this::handleProxyConfList).onFailure(e -> {
+        stopping = false;
+        String pathProxyConfig = SharedDataUtil
+                .getJsonConfig(ConfigConstant.GLOBAL_CONFIG)
+                .getString("proxyConf");
+        ConfigUtil.readYamlConfig(pathProxyConfig).onSuccess(config -> startProxyServers(config).onComplete(startPromise)).onFailure(e -> {
            LOGGER.info("web代理配置已禁用，当前仅支持API调用");
+            startPromise.complete();
        });
-//        createFileListener
-        startPromise.complete();
    }

    /**
@@ -85,16 +100,49 @@ public class ReverseProxyVerticle extends AbstractVerticle {
     */
    @Override
    public void stop(Promise<Void> stopPromise) {
-        LOGGER.info("Stopping ReverseProxyVerticle, closing {} HttpClient connections...", httpClientPool.size());
-        httpClientPool.values().forEach(client -> {
+        stopping = true;
+        LOGGER.info("Stopping ReverseProxyVerticle, closing {} servers and {} HttpClient connections...",
+                httpServers.size(), httpClientPool.size());
+
+        List<Future<Void>> serverCloseFutures = new ArrayList<>();
+        httpServers.forEach(server -> serverCloseFutures.add(server.close()));
+        Future<Void> serverCloseFuture = serverCloseFutures.isEmpty()
+                ? Future.succeededFuture()
+                : Future.all(serverCloseFutures).mapEmpty();
+
+        serverCloseFuture.onComplete(serverClose -> {
+            List<Future<Void>> clientCloseFutures = new ArrayList<>();
+            closeHttpClients(clientCloseFutures);
+            Future<Void> clientCloseFuture = clientCloseFutures.isEmpty()
+                    ? Future.succeededFuture()
+                    : Future.all(clientCloseFutures).mapEmpty();
+
+            clientCloseFuture.onComplete(clientClose -> {
+                if (serverClose.succeeded()) {
+                    httpServers.clear();
+                }
+                if (clientClose.succeeded()) {
+                    httpClientPool.clear();
+                }
+                if (serverClose.failed()) {
+                    stopPromise.fail(serverClose.cause());
+                } else if (clientClose.failed()) {
+                    stopPromise.fail(clientClose.cause());
+                } else {
+                    stopPromise.complete();
+                }
+            });
+        });
+    }
+
+    private void closeHttpClients(List<Future<Void>> closeFutures) {
+        httpClientPool.values().forEach(entry -> {
            try {
-                client.close();
+                closeFutures.add(entry.client.close());
            } catch (Exception e) {
                LOGGER.warn("Error closing HttpClient: {}", e.getMessage());
            }
        });
-        httpClientPool.clear();
-        stopPromise.complete();
    }

    /**
@@ -105,7 +153,7 @@ public class ReverseProxyVerticle extends AbstractVerticle {
     */
    private HttpClient getOrCreateHttpClient(String host, int port) {
        String key = host + ":" + port;
-        return httpClientPool.computeIfAbsent(key, k -> {
+        HttpClientEntry entry = httpClientPool.computeIfAbsent(key, k -> {
            LOGGER.info("Creating new HttpClient for {}", key);
            HttpClientOptions options = new HttpClientOptions()
                    .setMaxPoolSize(MAX_POOL_SIZE)                    // 连接池大小
@@ -116,15 +164,16 @@ public class ReverseProxyVerticle extends AbstractVerticle {
                    .setKeepAliveTimeout(120)                         // Keep-Alive超时120秒
                    .setPipelining(PIPELINING)                        // HTTP管线化
                    .setPipeliningLimit(10)                           // 管线化限制
-                    .setDecompressionSupported(true)                  // 支持解压响应
+                    .setDecompressionSupported(false)                 // 代理不解压，避免放大内存
                    .setTcpKeepAlive(true)                            // TCP Keep-Alive
                    .setTcpNoDelay(true)                              // 禁用Nagle算法，降低延迟
                    .setTcpFastOpen(true)                             // 启用TCP Fast Open
                    .setTcpQuickAck(true)                             // 启用TCP Quick ACK
                    .setReuseAddress(true)                            // 允许地址重用
                    .setReusePort(true);                              // 允许端口重用
-            return vertx.createHttpClient(options);
+            return new HttpClientEntry(vertx.createHttpClient(options));
        });
+        return entry.client;
    }

    /**
@@ -137,7 +186,7 @@ public class ReverseProxyVerticle extends AbstractVerticle {
     *
     * @param config proxy config
     */
-    private void handleProxyConfList(JsonObject config) {
+    private Future<Void> startProxyServers(JsonObject config) {
        serverName = config.getString("server-name");
        // 解析全局 trusted-proxies
        JsonArray trustedArr = config.getJsonArray("trusted-proxies");
@@ -149,13 +198,15 @@ public class ReverseProxyVerticle extends AbstractVerticle {
            });
        }
        JsonArray proxyConfList = config.getJsonArray("proxy");
+        List<Future<Void>> listenFutures = new ArrayList<>();
        if (proxyConfList != null) {
            proxyConfList.forEach(proxyConf -> {
                if (proxyConf instanceof JsonObject) {
-                    handleProxyConf((JsonObject) proxyConf);
+                    listenFutures.add(handleProxyConf((JsonObject) proxyConf));
                }
            });
        }
+        return listenFutures.isEmpty() ? Future.succeededFuture() : Future.all(listenFutures).mapEmpty();
    }

    /**
@@ -201,7 +252,7 @@ public class ReverseProxyVerticle extends AbstractVerticle {
     *
     * @param proxyConf 代理配置
     */
-    private void handleProxyConf(JsonObject proxyConf) {
+    private Future<Void> handleProxyConf(JsonObject proxyConf) {
        // page404 path
        if (proxyConf.containsKey(

@@ -226,6 +277,10 @@ public class ReverseProxyVerticle extends AbstractVerticle {

        // Add Server name header
        proxyRouter.route().handler(ctx -> {
+            if (stopping) {
+                sendProxyError(ctx, 503, "Service Unavailable");
+                return;
+            }
            String realPath = ctx.request().uri();
            if (realPath.startsWith(REROUTE_PATH_PREFIX)) {
                // vertx web proxy暂不支持rewrite, 所以这里进行手动替换, 请求地址中的请求path前缀替换为originPath
@@ -234,7 +289,9 @@ public class ReverseProxyVerticle extends AbstractVerticle {
                return;
            }

-            ctx.response().putHeader("Server", serverName);
+            if (!ctx.response().ended() && !ctx.response().closed()) {
+                ctx.response().putHeader("Server", serverName);
+            }
            ctx.next();
        });

@@ -250,15 +307,19 @@ public class ReverseProxyVerticle extends AbstractVerticle {

        // Send page404 page
        proxyRouter.errorHandler(404, ctx -> {
-            ctx.response().sendFile(proxyConf.getString("page404"));
+            sendNotFoundPage(ctx, proxyConf.getString("page404"));
        });
+        proxyRouter.errorHandler(500, this::handleProxyFailure);

        HttpServer server = getHttpsServer(proxyConf);
        server.requestHandler(proxyRouter);

        Integer port = proxyConf.getInteger("listen");
        LOGGER.info("proxy server start on {} port", port);
-        server.listen(port);
+        return server.listen(port)
+                .onSuccess(s -> httpServers.add(s))
+                .onFailure(e -> LOGGER.error("proxy server start failed on {} port", port, e))
+                .mapEmpty();
    }

    private HttpServer getHttpsServer(JsonObject proxyConf) {
@@ -267,7 +328,7 @@ public class ReverseProxyVerticle extends AbstractVerticle {
                .setTcpKeepAlive(true)                    // TCP Keep-Alive
                .setTcpNoDelay(true)                      // 禁用Nagle算法
                .setCompressionSupported(true)            // 启用压缩
-                .setAcceptBacklog(50000)                  // 增加积压队列到50000
+                .setAcceptBacklog(1024)                   // 限制积压队列，避免小容器内存膨胀
                .setIdleTimeout(120)                      // 空闲超时120秒
                .setTcpFastOpen(true)                     // 启用TCP Fast Open
                .setTcpQuickAck(true)                     // 启用TCP Quick ACK
@@ -303,6 +364,67 @@ public class ReverseProxyVerticle extends AbstractVerticle {
        return vertx.createHttpServer(httpServerOptions);
    }

+    private void addProxyHandler(Route route, HttpProxy httpProxy) {
+        Handler<RoutingContext> proxyHandler = ProxyHandler.create(httpProxy);
+        route.handler(ctx -> {
+            try {
+                proxyHandler.handle(ctx);
+            } catch (Throwable t) {
+                LOGGER.error("反向代理处理异常", t);
+                ctx.fail(t);
+            }
+        }).failureHandler(this::handleProxyFailure);
+    }
+
+    private void handleProxyFailure(RoutingContext ctx) {
+        Throwable failure = ctx.failure();
+        if (failure != null) {
+            LOGGER.error("反向代理路由失败", failure);
+        }
+        int statusCode = ctx.statusCode() > 0 ? ctx.statusCode() : 502;
+        if (statusCode < 400) {
+            statusCode = 502;
+        }
+        sendProxyError(ctx, statusCode, "Bad Gateway");
+    }
+
+    private void sendNotFoundPage(RoutingContext ctx, String page404) {
+        HttpServerResponse response = ctx.response();
+        if (response.ended() || response.closed()) {
+            return;
+        }
+        try {
+            if (response.headWritten()) {
+                response.reset();
+                return;
+            }
+            response.sendFile(page404)
+                    .onFailure(e -> {
+                        LOGGER.warn("发送代理 404 页面失败: {}", page404, e);
+                        sendProxyError(ctx, 404, "404 not found");
+                    });
+        } catch (Exception e) {
+            LOGGER.warn("发送代理 404 页面异常: {}", page404, e);
+            sendProxyError(ctx, 404, "404 not found");
+        }
+    }
+
+    private void sendProxyError(RoutingContext ctx, int statusCode, String message) {
+        HttpServerResponse response = ctx.response();
+        if (response.ended() || response.closed()) {
+            return;
+        }
+        try {
+            if (!response.headWritten()) {
+                response.setStatusCode(statusCode).end(message);
+            } else {
+                response.reset();
+            }
+        } catch (Exception e) {
+            LOGGER.debug("代理响应已关闭，忽略错误响应", e);
+        }
+    }
+
    /**
     * 处理静态资源配置
     *
@@ -391,15 +513,14 @@ public class ReverseProxyVerticle extends AbstractVerticle {
                if (StringUtils.isEmpty(originPath) || path.equals(originPath)) {
                    Route route = path.startsWith("~") ? proxyRouter.routeWithRegex(path.substring(1))
                            : proxyRouter.route(path);
-                    // 【优化】为代理处理器添加超时
-                    route.handler(ProxyHandler.create(httpProxy));
+                    addProxyHandler(route, httpProxy);
                } else {
                    // 配置 /api/, / => 请求 /api/test 代理后 /test
                    // 配置 /api/, /xxx => 请求 /api/test 代理后 /xxx/test
                     final String path0 = path;
                     final String originPath0 = REROUTE_PATH_PREFIX + originPath;

-                     proxyRouter.route(originPath0 + "*").handler(ProxyHandler.create(httpProxy));
+                     addProxyHandler(proxyRouter.route(originPath0 + "*"), httpProxy);
                     proxyRouter.route(path0 + "*").handler(ctx -> {
                         String realPath = ctx.request().uri();
                         if (realPath.startsWith(path0)) {
@@ -22,21 +22,22 @@ public class RouterVerticle extends AbstractVerticle {

    private static final Logger LOGGER = LoggerFactory.getLogger(RouterVerticle.class);

-    private static final int port = SharedDataUtil.getValueForServerConfig("port");
-
-    private static final JsonObject globalConfig = SharedDataUtil.getJsonConfig("globalConfig");
-
    private HttpServer server;
    private Router router;
+    private int port;
+    private JsonObject globalConfig;

    static {
        LOGGER.info(JacksonConfig.class.getSimpleName() + " >> ");
        JacksonConfig.nothing();
-        LOGGER.info("To start listening to port {} ......", port);
    }

    @Override
    public void start(Promise<Void> startPromise) {
+        port = SharedDataUtil.getValueForServerConfig("port");
+        globalConfig = SharedDataUtil.getJsonConfig("globalConfig");
+        LOGGER.info("To start listening to port {} ......", port);
+
        // 端口是否占用
        if (CommonUtil.isPortUsing(port)) {
            throw new RuntimeException("Start fail: the '" + port + "' port is already in use...");
@@ -64,7 +65,7 @@ public class RouterVerticle extends AbstractVerticle {
                SharedDataUtil.getJsonStringForServerConfig("contextPath")).createRouter();
        server = vertx.createHttpServer(options);

-        server.requestHandler(router).webSocketHandler(s->{}).listen()
+        server.requestHandler(router).listen()
                .onSuccess(s -> startPromise.complete())
                .onFailure(e -> startPromise.fail(e.getCause()));
    }
@@ -6,4 +6,8 @@ chown -R appuser:appgroup /app/db /app/logs /app/resources 2>/dev/null || true

 # Run Java directly - entrypoint is PID 1, exec makes Java PID 1
 # Docker SIGTERM goes directly to Java, triggering ShutdownHook
-exec java -Xmx${JVM_XMX:-512M} ${JVM_OPTS} -Duser.timezone=${TZ:-Asia/Shanghai} -jar /app/netdisk-fast-download.jar
+DEFAULT_JVM_OPTS="-Xmx${JVM_XMX:-512M} -Xss${JVM_XSS:-512k} -XX:MaxDirectMemorySize=${JVM_MAX_DIRECT_MEMORY:-256M} -DNFD_LOG_LEVEL=${NFD_LOG_LEVEL:-info} -DNFD_PLAYGROUND_ENABLED=${NFD_PLAYGROUND_ENABLED:-false}"
+if [ -n "${JVM_MAX_METASPACE:-}" ]; then
+  DEFAULT_JVM_OPTS="$DEFAULT_JVM_OPTS -XX:MaxMetaspaceSize=$JVM_MAX_METASPACE"
+fi
+exec java ${DEFAULT_JVM_OPTS} ${JVM_OPTS} -Duser.timezone=${TZ:-Asia/Shanghai} -jar /app/netdisk-fast-download.jar
@@ -240,13 +240,13 @@ var encoded = JsHttpClient.urlEncode("hello world"); // "hello%20world"
 var decoded = JsHttpClient.urlDecode("hello%20world"); // "hello world"

 // 发送简单表单数据
-var formResponse = http.sendForm({
+var formResponse = http.sendForm("https://api.example.com/login", {
    username: "user",
    password: "pass"
 });

 // 发送JSON数据
-var jsonResponse = http.sendJson({
+var jsonResponse = http.sendJson("https://api.example.com/submit", {
    name: "test",
    value: 123
 });
@@ -637,7 +637,7 @@ A: 使用 `shareLinkInfo.getSharePassword()` 方法。

 ### Q: 如何处理需要登录的网盘？

-A: 使用 `http.putHeader()` 设置认证头，或使用 `http.sendForm()` 发送登录表单。
+A: 使用 `http.putHeader()` 设置认证头，或使用 `http.sendForm(url, data)` 发送登录表单。

 ### Q: 如何解析复杂的HTML？

@@ -68,7 +68,7 @@ List<FileInfo> files = tool.parseFileListSync();
 ```

 要点：
- 必须先 WebClientVertxInit.init(Vertx)；若未显式初始化，内部将懒加载 Vertx.vertx()，建议显式注入以统一生命周期。
+- 必须先 WebClientVertxInit.init(Vertx)；未初始化时会直接报错，避免解析器偷偷创建第二个 Vert.x 实例。
 - 支持三种同步方法：
  - `parseSync()`: 解析单个文件下载链接
  - `parseFileListSync()`: 解析文件列表
@@ -17,7 +17,7 @@
 this.temporaryExecutor = WebClientVertxInit.get().createSharedWorkerExecutor(
    "playground-temp-" + System.currentTimeMillis(), 
    1, // 每个请求只需要1个线程
-    10000000000L // 设置非常长的超时，避免被vertx强制中断
+    10000000000L // 设置非常长的超时，避免触发Vert.x阻塞线程告警
 );

 // 执行完成或超时后关闭
@@ -106,7 +106,7 @@ executionFuture.toCompletionStage()
 ### 长期方案（需大量工作）
 1. **迁移到GraalVM JavaScript引擎**
   - 支持CPU时间限制
-   - 可以强制中断
+   - 相比Nashorn更容易实现受控取消
   - 更好的性能
   - 但需要额外依赖

@@ -7,12 +7,15 @@ import org.slf4j.LoggerFactory;
 import cn.qaiu.parser.custom.CustomParserRegistry;

 public class WebClientVertxInit {
-    private Vertx vertx = null;
+    private volatile Vertx vertx = null;
    private static final WebClientVertxInit INSTANCE = new WebClientVertxInit();

    private static final Logger log = LoggerFactory.getLogger(WebClientVertxInit.class);

-    public static void init(Vertx vx) {
+    public static synchronized void init(Vertx vx) {
+        if (vx == null) {
+            throw new IllegalArgumentException("Vertx instance must not be null");
+        }
        INSTANCE.vertx = vx;
        
        // 自动加载JavaScript解析器脚本
@@ -23,18 +26,10 @@ public class WebClientVertxInit {
        }
    }

-    public static Vertx get() {
+    public static synchronized Vertx get() {
        if (INSTANCE.vertx == null) {
-            log.info("getVertx: Vertx实例不存在, 创建Vertx实例.");
-            INSTANCE.vertx = Vertx.vertx();
-            
-            // 如果Vertx实例是新创建的，也尝试加载JavaScript脚本
-            try {
-                CustomParserRegistry.autoLoadJsScripts();
-            } catch (Exception e) {
-                log.warn("自动加载JavaScript解析器脚本失败", e);
-            }
+            throw new IllegalStateException("Vertx实例未初始化，请先调用 WebClientVertxInit.init(vertx)");
        }
        return INSTANCE.vertx;
    }
-}
+}
@@ -1,5 +1,6 @@
 package cn.qaiu.parser;//package cn.qaiu.lz.common.parser;

+import cn.qaiu.WebClientVertxInit;
 import cn.qaiu.entity.FileInfo;
 import cn.qaiu.entity.ShareLinkInfo;
 import cn.qaiu.parser.clientlink.ClientLinkGeneratorFactory;
@@ -7,10 +8,26 @@ import cn.qaiu.parser.clientlink.ClientLinkType;
 import io.vertx.core.Future;
 import io.vertx.core.Promise;

+import java.util.function.Supplier;
 import java.util.List;
 import java.util.Map;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.ScheduledFuture;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
+import java.util.concurrent.atomic.AtomicBoolean;

-public interface IPanTool {
+public interface IPanTool extends AutoCloseable {
+
+    /** 同步等待超时时间（秒） */
+    long SYNC_TIMEOUT_SECONDS = 120;
+
+    ScheduledExecutorService CLOSE_AFTER_SCHEDULER = Executors.newSingleThreadScheduledExecutor(r -> {
+        Thread t = new Thread(r, "pan-tool-close-after");
+        t.setDaemon(true);
+        return t;
+    });

    /**
     * 解析文件
@@ -18,8 +35,72 @@ public interface IPanTool {
     */
    Future<String> parse();

+    static <T> Future<T> closeAfter(IPanTool tool, Supplier<Future<T>> action) {
+        Promise<T> promise = Promise.promise();
+        AtomicBoolean cleanupDone = new AtomicBoolean(false);
+        ScheduledFuture<?> cleanupTask = null;
+        try {
+            Future<T> future = action.get();
+            if (future == null) {
+                closeQuietly(tool);
+                return Future.failedFuture("解析器返回空 Future");
+            }
+
+            cleanupTask = CLOSE_AFTER_SCHEDULER.schedule(() -> {
+                if (cleanupDone.compareAndSet(false, true)) {
+                    closeQuietly(tool);
+                    failOnVertxContext(promise, "解析超时（" + SYNC_TIMEOUT_SECONDS + "秒）");
+                }
+            }, SYNC_TIMEOUT_SECONDS, TimeUnit.SECONDS);
+
+            ScheduledFuture<?> scheduledCleanupTask = cleanupTask;
+            future.onComplete(ar -> {
+                scheduledCleanupTask.cancel(false);
+                if (!cleanupDone.compareAndSet(false, true)) {
+                    return;
+                }
+                closeQuietly(tool);
+                if (ar.succeeded()) {
+                    promise.tryComplete(ar.result());
+                } else {
+                    promise.tryFail(ar.cause());
+                }
+            });
+            return promise.future();
+        } catch (Throwable t) {
+            if (cleanupTask != null) {
+                cleanupTask.cancel(false);
+            }
+            closeQuietly(tool);
+            return Future.failedFuture(t);
+        }
+    }
+
+    private static <T> void failOnVertxContext(Promise<T> promise, String message) {
+        try {
+            WebClientVertxInit.get().runOnContext(ignored -> promise.tryFail(message));
+        } catch (Exception ignored) {
+            promise.tryFail(message);
+        }
+    }
+
+    static void closeQuietly(IPanTool tool) {
+        if (tool == null) {
+            return;
+        }
+        try {
+            tool.close();
+        } catch (Exception ignored) {
+            // ignore cleanup failures
+        }
+    }
+
+    static void shutdownCloseAfterScheduler() {
+        CLOSE_AFTER_SCHEDULER.shutdownNow();
+    }
+
    default String parseSync() {
-        return parse().toCompletionStage().toCompletableFuture().join();
+        return timedJoin(parse());
    }

    /**
@@ -33,7 +114,7 @@ public interface IPanTool {
    }

    default List<FileInfo> parseFileListSync() {
-        return parseFileList().toCompletionStage().toCompletableFuture().join();
+        return timedJoin(parseFileList());
    }

    /**
@@ -47,7 +128,7 @@ public interface IPanTool {
    }

    default String parseByIdSync() {
-        return parseById().toCompletionStage().toCompletableFuture().join();
+        return timedJoin(parseById());
    }

    /**
@@ -126,7 +207,7 @@ public interface IPanTool {
     * @return Map<ClientLinkType, String> 客户端下载链接集合
     */
    default Map<ClientLinkType, String> parseWithClientLinksSync() {
-        return parseWithClientLinks().toCompletionStage().toCompletableFuture().join();
+        return timedJoin(parseWithClientLinks());
    }

    /**
@@ -137,4 +218,26 @@ public interface IPanTool {
    default ShareLinkInfo getShareLinkInfo() {
        return null;
    }
+
+    @Override
+    default void close() {
+        // default no-op
+    }
+
+    /**
+     * 带超时的同步等待工具方法，替代无超时的 join()
+     */
+    private static <T> T timedJoin(Future<T> future) {
+        try {
+            return future.toCompletionStage().toCompletableFuture()
+                    .get(SYNC_TIMEOUT_SECONDS, TimeUnit.SECONDS);
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            throw new RuntimeException("线程被中断", e);
+        } catch (TimeoutException e) {
+            throw new RuntimeException("同步等待超时（" + SYNC_TIMEOUT_SECONDS + "秒）", e);
+        } catch (java.util.concurrent.ExecutionException e) {
+            throw new RuntimeException(e.getCause() != null ? e.getCause() : e);
+        }
+    }
 }
@@ -20,6 +20,9 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

 import java.io.*;
+import java.net.InetAddress;
+import java.net.URL;
+import java.net.UnknownHostException;
 import java.nio.charset.StandardCharsets;
 import java.util.Arrays;
 import java.util.HashMap;
@@ -34,25 +37,37 @@ import java.util.zip.GZIPInputStream;
 * <p>{网盘标识}Tool, 网盘标识不超过5个字符, 可以取网盘名称首字母缩写或拼音首字母, <br>
 * 音乐类型的解析以M开头, 例如网易云音乐Mne</p>
 */
-public abstract class PanBase implements IPanTool {
+public abstract class PanBase implements IPanTool, Closeable {
    protected Logger log = LoggerFactory.getLogger(this.getClass());

    protected Promise<String> promise = Promise.promise();

+    private static final int MAX_COMPRESSED_RESPONSE_BYTES = 8 * 1024 * 1024;
+    private static final int MAX_DECOMPRESSED_RESPONSE_CHARS = 16 * 1024 * 1024;
+    private static final int MAX_ERROR_BODY_CHARS = 4096;
+
+    /**
+     * 共享的 WebClient 配置（设置超时避免连接无限期占用）
+     */
+    private static final WebClientOptions SHARED_OPTIONS = new WebClientOptions()
+            .setConnectTimeout(10000)      // 连接超时 10 秒
+            .setIdleTimeout(30)            // 空闲超时 30 秒
+            .setIdleTimeoutUnit(java.util.concurrent.TimeUnit.SECONDS);
+
+    private static final Object SHARED_CLIENT_LOCK = new Object();
+
    /**
     * 共享的 WebClient 实例（线程安全，避免每请求创建导致资源泄漏）
     */
-    private static final WebClient SHARED_CLIENT = WebClient.create(WebClientVertxInit.get(),
-            new WebClientOptions());
-    private static final WebClient SHARED_CLIENT_NO_REDIRECTS = WebClient.create(WebClientVertxInit.get(),
-            new WebClientOptions().setFollowRedirects(false));
-    private static final WebClient SHARED_CLIENT_DISABLE_UA = WebClient.create(WebClientVertxInit.get(),
-            new WebClientOptions().setUserAgentEnabled(false));
+    private static volatile WebClient sharedClient;
+    private static volatile WebClient sharedClientNoRedirects;
+    private static volatile WebClient sharedClientDisableUA;
+    private static volatile boolean sharedClientsShutdown = false;

    /**
     * Http client (默认使用共享实例，代理模式下使用独立实例)
     */
-    protected WebClient client = SHARED_CLIENT;
+    protected WebClient client = sharedClient();

    /**
     * Http client session (会话管理, 带cookie请求, 每实例独立)
@@ -62,14 +77,25 @@ public abstract class PanBase implements IPanTool {
    /**
     * Http client 不自动跳转
     */
-    protected WebClient clientNoRedirects = SHARED_CLIENT_NO_REDIRECTS;
+    protected WebClient clientNoRedirects = sharedClientNoRedirects();

    /**
     * Http client disable UserAgent
     */
-    protected WebClient clientDisableUA = SHARED_CLIENT_DISABLE_UA;
+    protected WebClient clientDisableUA = sharedClientDisableUA();

    protected ShareLinkInfo shareLinkInfo;
+
+    /**
+     * 标记是否为代理模式（代理模式创建的 WebClient 需要手动关闭）
+     */
+    private boolean isProxyMode = false;
+
+    /**
+     * 代理模式下创建的独立 WebClient 实例（需要在 close 时释放）
+     */
+    private WebClient proxyClient = null;
+    private WebClient proxyClientNoRedirects = null;
    

    /**
@@ -86,6 +112,7 @@ public abstract class PanBase implements IPanTool {
    public PanBase(ShareLinkInfo shareLinkInfo) {
        this.shareLinkInfo = shareLinkInfo;
        if (shareLinkInfo.getOtherParam().containsKey("proxy")) {
+            this.isProxyMode = true;
            JsonObject proxy = (JsonObject) shareLinkInfo.getOtherParam().get("proxy");
            ProxyOptions proxyOptions = new ProxyOptions()
                    .setType(ProxyType.valueOf(proxy.getString("type").toUpperCase()))
@@ -97,22 +124,156 @@ public abstract class PanBase implements IPanTool {
            if (StringUtils.isNotEmpty(proxy.getString("password"))) {
                proxyOptions.setPassword(proxy.getString("password"));
            }
-            this.client = WebClient.create(WebClientVertxInit.get(),
-                    new WebClientOptions()
+            // 代理模式下创建独立的 WebClient 实例（应用超时配置）
+            this.proxyClient = WebClient.create(WebClientVertxInit.get(),
+                    new WebClientOptions(SHARED_OPTIONS)
+                            .setUserAgentEnabled(false)
+                            .setProxyOptions(proxyOptions));
+            this.proxyClientNoRedirects = WebClient.create(WebClientVertxInit.get(),
+                    new WebClientOptions(SHARED_OPTIONS).setFollowRedirects(false)
                            .setUserAgentEnabled(false)
                            .setProxyOptions(proxyOptions));

+            this.client = proxyClient;
            this.clientSession = WebClientSession.create(client);
-            this.clientNoRedirects = WebClient.create(WebClientVertxInit.get(),
-                    new WebClientOptions().setFollowRedirects(false)
-                            .setUserAgentEnabled(false)
-                            .setProxyOptions(proxyOptions));
+            this.clientNoRedirects = proxyClientNoRedirects;
        }
    }

    protected PanBase() {
    }

+    private static WebClient sharedClient() {
+        synchronized (SHARED_CLIENT_LOCK) {
+            if (sharedClientsShutdown) {
+                throw new IllegalStateException("共享 WebClient 已关闭");
+            }
+            if (sharedClient == null) {
+                sharedClient = WebClient.create(WebClientVertxInit.get(), new WebClientOptions(SHARED_OPTIONS));
+            }
+            return sharedClient;
+        }
+    }
+
+    private static WebClient sharedClientNoRedirects() {
+        synchronized (SHARED_CLIENT_LOCK) {
+            if (sharedClientsShutdown) {
+                throw new IllegalStateException("共享 WebClient 已关闭");
+            }
+            if (sharedClientNoRedirects == null) {
+                sharedClientNoRedirects = WebClient.create(WebClientVertxInit.get(),
+                        new WebClientOptions(SHARED_OPTIONS).setFollowRedirects(false));
+            }
+            return sharedClientNoRedirects;
+        }
+    }
+
+    private static WebClient sharedClientDisableUA() {
+        synchronized (SHARED_CLIENT_LOCK) {
+            if (sharedClientsShutdown) {
+                throw new IllegalStateException("共享 WebClient 已关闭");
+            }
+            if (sharedClientDisableUA == null) {
+                sharedClientDisableUA = WebClient.create(WebClientVertxInit.get(),
+                        new WebClientOptions(SHARED_OPTIONS).setUserAgentEnabled(false));
+            }
+            return sharedClientDisableUA;
+        }
+    }
+
+    public static void shutdownSharedClients() {
+        synchronized (SHARED_CLIENT_LOCK) {
+            sharedClientsShutdown = true;
+            closeSharedClient(sharedClient, "shared WebClient");
+            closeSharedClient(sharedClientNoRedirects, "shared WebClientNoRedirects");
+            closeSharedClient(sharedClientDisableUA, "shared WebClientDisableUA");
+            sharedClient = null;
+            sharedClientNoRedirects = null;
+            sharedClientDisableUA = null;
+        }
+    }
+
+    private static void closeSharedClient(WebClient client, String name) {
+        if (client == null) {
+            return;
+        }
+        try {
+            client.close();
+        } catch (Exception e) {
+            LoggerFactory.getLogger(PanBase.class).warn("关闭 {} 失败: {}", name, e.getMessage());
+        }
+    }
+
+    /**
+     * SSRF 防护: 校验通用自定义域名解析器 (CE/Ce4/Kd/Other 等) 即将请求的目标主机,
+     * 拒绝解析到回环/内网/链路本地/组播等非公网地址的域名, 阻止攻击者通过可控 DNS
+     * 记录 (或直接填写内网域名) 让服务端向内网/云元数据接口发起请求。
+     * <p>
+     * 必须在子类 parse() 中构造出 baseUrl/发起任何 clientSession 请求之前调用。
+     *
+     * @param url 从 shareLinkInfo.getShareUrl() 解析出的 URL
+     * @throws IOException 当主机无法解析或解析结果落入禁止的地址段时抛出
+     */
+    protected static void assertPublicHost(URL url) throws IOException {
+        String host = url.getHost();
+        InetAddress[] addresses;
+        try {
+            addresses = InetAddress.getAllByName(host);
+        } catch (UnknownHostException e) {
+            throw new IOException("无法解析目标主机: " + host, e);
+        }
+        if (addresses.length == 0) {
+            throw new IOException("无法解析目标主机: " + host);
+        }
+        for (InetAddress addr : addresses) {
+            if (isDisallowedAddress(addr)) {
+                throw new IOException("目标地址不允许访问(内网/回环/链路本地/组播): "
+                        + host + " -> " + addr.getHostAddress());
+            }
+        }
+    }
+
+    /**
+     * 判断地址是否落入禁止访问的范围: 0.0.0.0/8, 10/8, 127/8, 169.254/16(含云元数据
+     * 169.254.169.254), 172.16/12, 192.168/16, 100.64/10(CGNAT), 224/4~255/4(组播/保留),
+     * 以及对应的 IPv6 回环/链路本地/唯一本地地址(fc00::/7)/组播地址; IPv4-映射的 IPv6
+     * 地址(::ffff:a.b.c.d) 会先还原为 IPv4 再判断，避免绕过。
+     */
+    private static boolean isDisallowedAddress(InetAddress addr) {
+        byte[] bytes = addr.getAddress();
+        if (bytes.length == 16 && isIPv4Mapped(bytes)) {
+            byte[] v4 = new byte[4];
+            System.arraycopy(bytes, 12, v4, 0, 4);
+            bytes = v4;
+        }
+        if (bytes.length == 4) {
+            int b0 = bytes[0] & 0xFF;
+            int b1 = bytes[1] & 0xFF;
+            if (b0 == 0) return true;                          // 0.0.0.0/8
+            if (b0 == 10) return true;                         // 10.0.0.0/8
+            if (b0 == 127) return true;                        // 127.0.0.0/8 loopback
+            if (b0 == 169 && b1 == 254) return true;            // 169.254.0.0/16 (含云元数据 169.254.169.254)
+            if (b0 == 172 && b1 >= 16 && b1 <= 31) return true; // 172.16.0.0/12
+            if (b0 == 192 && b1 == 168) return true;            // 192.168.0.0/16
+            if (b0 == 100 && b1 >= 64 && b1 <= 127) return true;// 100.64.0.0/10 CGNAT
+            return b0 >= 224;                                   // 224.0.0.0/4 组播 + 240.0.0.0/4 保留
+        }
+        // IPv6
+        if (addr.isAnyLocalAddress() || addr.isLoopbackAddress()
+                || addr.isLinkLocalAddress() || addr.isSiteLocalAddress()
+                || addr.isMulticastAddress()) {
+            return true;
+        }
+        return bytes.length == 16 && (bytes[0] & 0xFE) == 0xFC; // fc00::/7 unique local
+    }
+
+    private static boolean isIPv4Mapped(byte[] b) {
+        for (int i = 0; i < 10; i++) {
+            if (b[i] != 0) return false;
+        }
+        return (b[10] & 0xFF) == 0xFF && (b[11] & 0xFF) == 0xFF;
+    }
+
    protected String baseMsg() {
        if (shareLinkInfo.getShareUrl() != null) {
            return shareLinkInfo.getPanName() + "-" + shareLinkInfo.getType() + ": url=" + shareLinkInfo.getShareUrl();
@@ -137,16 +298,19 @@ public abstract class PanBase implements IPanTool {
                return;
            }
            String s = String.format(errorMsg.replaceAll("\\{}", "%s"), args);
-            log.error("解析异常: " + s, t.fillInStackTrace());
-            promise.fail(baseMsg() + ": 解析异常: " + s + " -> " + t);
+            // 只记录异常消息和类型，不调用 fillInStackTrace 避免产生巨大栈信息
+            log.error("解析异常: {} - {}: {}", s, t.getClass().getSimpleName(), t.getMessage());
+            // 只传递异常消息，不传递完整异常对象，减少内存占用
+            String failMsg = baseMsg() + ": 解析异常: " + s + " -> " + t.getClass().getSimpleName() + ": " + t.getMessage();
+            promise.fail(failMsg);
        } catch (Exception e) {
            log.error("ErrorMsg format fail. The parameter has been discarded", e);
-            log.error("解析异常: " + errorMsg, t.fillInStackTrace());
+            log.error("解析异常: {} - {}: {}", errorMsg, t.getClass().getSimpleName(), t.getMessage());
            if (promise.future().isComplete()) {
                log.warn("ErrorMsg format. Promise 已经完成, 无法再次失败: {}", errorMsg);
                return;
            }
-            promise.fail(baseMsg() + ": 解析异常: " + errorMsg + " -> " + t);
+            promise.fail(baseMsg() + ": 解析异常: " + errorMsg + " -> " + t.getClass().getSimpleName() + ": " + t.getMessage());
        }
    }

@@ -186,7 +350,7 @@ public abstract class PanBase implements IPanTool {
     * @return Handler
     */
    protected Handler<Throwable> handleFail(String errorMsg) {
-        return t -> fail(baseMsg() + " - 请求异常 {}: -> {}", errorMsg, t.fillInStackTrace());
+        return t -> fail(baseMsg() + " - 请求异常 {}: -> {}", errorMsg, t.getClass().getSimpleName() + ": " + t.getMessage());
    }

    protected Handler<Throwable> handleFail() {
@@ -205,28 +369,23 @@ public abstract class PanBase implements IPanTool {
        String contentEncoding = res.getHeader("Content-Encoding");
        try {
            if ("gzip".equalsIgnoreCase(contentEncoding)) {
-                // 如果是gzip压缩的响应体，解压
-                return new JsonObject(decompressGzip((Buffer) res.body()));
+                // 如果是gzip压缩的响应体，解压（只解压一次，缓存结果）
+                String decompressed = decompressGzip((Buffer) res.body());
+                return new JsonObject(decompressed);
            } else {
                return res.bodyAsJsonObject();
            }

        } catch (Exception e) {
            if ("gzip".equalsIgnoreCase(contentEncoding)) {
-                // 如果是gzip压缩的响应体，解压
-                try {
-                    log.error(decompressGzip((Buffer) res.body()));
-                    fail(decompressGzip((Buffer) res.body()));
-                    //throw new RuntimeException("响应不是JSON格式");
-                } catch (IOException ex) {
-                    log.error("响应gzip解压失败");
-                    fail("响应gzip解压失败: {}", ex.getMessage());
-                    //throw new RuntimeException("响应gzip解压失败", ex);
-                }
+                // gzip解压失败，记录错误
+                log.error("响应gzip解压或JSON解析失败: {}", e.getMessage());
+                fail("响应gzip解压或JSON解析失败: {}", e.getMessage());
            } else {
-                log.error("解析失败: json格式异常: {}", res.bodyAsString());
-                fail("解析失败: json格式异常: {}", res.bodyAsString());
-                //throw new RuntimeException("解析失败: json格式异常");
+                // 上游响应体可能来自内网探测目标，仅写日志，避免经 HTTP 500 回传给调用方
+                String bodyPreview = responseBodyPreview(res);
+                log.error("解析失败: json格式异常: {}", bodyPreview);
+                fail("解析失败: json格式异常");
            }
            return JsonObject.of();
        }
@@ -256,7 +415,18 @@ public abstract class PanBase implements IPanTool {
    protected void completeWithMeta(String url, Map<String, String> headers) {
        shareLinkInfo.getOtherParam().put("downloadUrl", url);
        if (headers != null && !headers.isEmpty()) {
-            shareLinkInfo.getOtherParam().put("downloadHeaders", headers);
+            // 过滤 null/空值，避免 cookie:null 覆盖入口参数或污染 curl 命令
+            Map<String, String> clean = new HashMap<>();
+            headers.forEach((k, v) -> {
+                if (k != null && v != null && !v.isBlank()) {
+                    clean.put(k, v);
+                }
+            });
+            if (!clean.isEmpty()) {
+                shareLinkInfo.getOtherParam().put("downloadHeaders", clean);
+                // UC/夸克等需带 cookie 的直链，标记前端走下载器
+                shareLinkInfo.getOtherParam().put("needDownloader", true);
+            }
        }
        promise.complete(url);
    }
@@ -289,11 +459,15 @@ public abstract class PanBase implements IPanTool {
                if (iterator.hasNext()) {
                    PanDomainTemplate next = iterator.next();
                    log.debug("规则不匹配, 处理解析器转发: {} -> {}", shareLinkInfo.getPanName(), next.getDisplayName());
-                    ParserCreate.fromType(next.name())
-                            .fromAnyShareUrl(shareLinkInfo.getShareUrl())
-                            .createTool()
-                            .parse()
-                            .onComplete(promise);
+                    try {
+                        IPanTool nextTool = ParserCreate.fromType(next.name())
+                                .fromAnyShareUrl(shareLinkInfo.getShareUrl())
+                                .createTool();
+                        IPanTool.closeAfter(nextTool, nextTool::parse)
+                                .onComplete(promise);
+                    } catch (Exception e) {
+                        fail(e, "转发到下一个解析器失败: {}", next.getDisplayName());
+                    }
                } else {
                    fail("error: 没有下一个解析处理器");
                }
@@ -309,6 +483,12 @@ public abstract class PanBase implements IPanTool {
     * @throws IOException IOException
     */
    private String decompressGzip(Buffer compressedData) throws IOException {
+        if (compressedData == null) {
+            return "";
+        }
+        if (compressedData.length() > MAX_COMPRESSED_RESPONSE_BYTES) {
+            throw new IOException("gzip响应体过大: " + compressedData.length() + " bytes");
+        }
        try (ByteArrayInputStream bais = new ByteArrayInputStream(compressedData.getBytes());
             GZIPInputStream gzis = new GZIPInputStream(bais);
             InputStreamReader isr = new InputStreamReader(gzis, StandardCharsets.UTF_8);
@@ -317,18 +497,97 @@ public abstract class PanBase implements IPanTool {
            char[] buffer = new char[4096];
            int n;
            while ((n = isr.read(buffer)) != -1) {
-                writer.write(buffer, 0, n);
+                writeLimited(writer, buffer, n);
            }
            return writer.toString();
        }
    }

+    private void writeLimited(StringWriter writer, char[] buffer, int len) throws IOException {
+        if (writer.getBuffer().length() + len > MAX_DECOMPRESSED_RESPONSE_CHARS) {
+            throw new IOException("gzip解压后响应体过大");
+        }
+        writer.write(buffer, 0, len);
+    }
+
+    private String responseBodyPreview(HttpResponse<?> res) {
+        if (res == null || res.body() == null) {
+            return "";
+        }
+        try {
+            if (res.body() instanceof Buffer body) {
+                int length = Math.min(body.length(), MAX_ERROR_BODY_CHARS);
+                String preview = new String(body.getBytes(0, length), StandardCharsets.UTF_8);
+                return body.length() > length ? preview + "...(truncated " + body.length() + " bytes)" : preview;
+            }
+            String text = res.bodyAsString();
+            if (text == null || text.length() <= MAX_ERROR_BODY_CHARS) {
+                return text;
+            }
+            return text.substring(0, MAX_ERROR_BODY_CHARS) + "...(truncated " + text.length() + " chars)";
+        } catch (Exception e) {
+            return "<body preview failed: " + e.getMessage() + ">";
+        }
+    }
+
    protected String getDomainName(){
        return shareLinkInfo.getOtherParam().getOrDefault("domainName", "").toString();
    }

+    /**
+     * 将入口请求中的加密 auth 透传到子目录/下载链接，避免进入子目录后丢失认证。
+     * otherParam 中的 key 为 {@code _authQuery}（由 web 层写入）。
+     */
+    protected String appendAuthQuery(String url) {
+        if (StringUtils.isBlank(url) || shareLinkInfo == null || shareLinkInfo.getOtherParam() == null) {
+            return url;
+        }
+        Object authObj = shareLinkInfo.getOtherParam().get("_authQuery");
+        if (authObj == null) {
+            return url;
+        }
+        String auth = authObj.toString();
+        if (StringUtils.isBlank(auth)) {
+            return url;
+        }
+        // 已带 auth 则不再追加
+        if (url.contains("auth=")) {
+            return url;
+        }
+        try {
+            String encoded = java.net.URLEncoder.encode(auth, StandardCharsets.UTF_8);
+            return url + (url.contains("?") ? "&" : "?") + "auth=" + encoded;
+        } catch (Exception e) {
+            return url + (url.contains("?") ? "&" : "?") + "auth=" + auth;
+        }
+    }
+
    @Override
    public ShareLinkInfo getShareLinkInfo() {
        return shareLinkInfo;
    }
+
+    /**
+     * 关闭代理模式下创建的 WebClient 资源
+     * 非代理模式使用共享实例，不需要关闭
+     */
+    @Override
+    public void close() {
+        if (isProxyMode) {
+            try {
+                if (proxyClient != null) {
+                    proxyClient.close();
+                }
+            } catch (Exception e) {
+                log.warn("关闭代理 WebClient 失败: {}", e.getMessage());
+            }
+            try {
+                if (proxyClientNoRedirects != null) {
+                    proxyClientNoRedirects.close();
+                }
+            } catch (Exception e) {
+                log.warn("关闭代理 WebClientNoRedirects 失败: {}", e.getMessage());
+            }
+        }
+    }
 }
@@ -208,7 +208,7 @@ public enum PanDomainTemplate {
        123795.com
     */
    YE("123网盘",
-            compile("https://www\\.(" +
+            compile("https://(?:[a-zA-Z\\d-]+\\.)*(" +
                    "123254\\.com|" +
                    "123957\\.com|" +
                    "123295\\.com|" +
@@ -232,7 +232,7 @@ public enum PanDomainTemplate {
                    "123635\\.com|" +
                    "123242\\.com|" +
                    "123795\\.com"  +
-                    ")/s/(?<KEY>[a-zA-Z0-9_-]+)(?:\\.html)?"),
+                    ")/(?:(?:s|123pan)/|(?:[^/?#]+/)+)?(?<KEY>[a-zA-Z0-9]+-[a-zA-Z0-9]+|[a-zA-Z0-9_-]+)(?:\\.html)?(?:\\?.*)?"),
            "https://www.123pan.com/s/{shareKey}",
            Ye2Tool.class),
    // https://www.ecpan.cn/web/#/yunpanProxy?path=%2F%23%2Fdrive%2Foutside&data={code}&isShare=1
@@ -247,9 +247,15 @@ public enum PanDomainTemplate {
            "https://cowtransfer.com/s/{shareKey}",
            CowTool.class),
    CT("城通网盘",
-            compile("https://(?:[a-zA-Z\\d-]+\\.)?(ctfile|545c|u062|ghpym|474b)\\.com/f(ile)?/" +
-                    "(?<KEY>[0-9a-zA-Z_-]+)(\\?p=(?<PWD>\\w+))?"),
-            "https://474b.com/file/{shareKey}",
+            compile("https?://(?:[a-zA-Z\\d-]+\\.)?(ctfile|545c|u062|ghpym|474b)\\.com/f(ile)?/" +
+                    "(?<KEY>[0-9a-zA-Z_-]+)/?(?:\\?(?:(?:[^#&]*&)*p=(?<PWD>\\w+)(?:&[^#]*)?|[^#]*))?"),
+            "https://ctfile.com/file/{shareKey}",
+            CtTool.class),
+    // https://url94.ctfile.com/d/64115194-164803691-48508c?p=7609&d=164803691&fk=decb36
+    CTD("城通网盘-目录",
+            compile("https?://(?:[a-zA-Z\\d-]+\\.)?(ctfile|545c|u062|ghpym|474b)\\.com/d/" +
+                    "(?<KEY>[0-9a-zA-Z_-]+)/?(?:\\?(?:(?:[^#&]*&)*p=(?<PWD>\\w+)(?:&[^#]*)?|[^#]*))?"),
+            "https://ctfile.com/d/{shareKey}",
            CtTool.class),
    // https://www.vyuyun.com/s/QMa6ie?password=I4KG7H
    // https://www.vyuyun.com/s/QMa6ie/file?password=I4KG7H
@@ -371,6 +377,16 @@ public enum PanDomainTemplate {
            MmgTool.class),
    // =====================私有盘解析==========================

+    // 永硕E盘空间分享：https://qaiu.ysepan.com/ （空间名即 shareKey，密码为空间访问密码）
+    // 主域名 ysepan.com / ys168.com；备用 cccpan.com / ysupan.com / uupan.net / ysok.net
+    YS("永硕E盘",
+            compile("https?://(?!(?:www|zy|ht|api|c\\d+|ys-[a-zA-Z0-9]+)\\.)(?<KEY>[a-zA-Z\\d-]+)\\."
+                    + "(?:ysepan\\.com|ys168\\.com|cccpan\\.com|ysupan\\.com|uupan\\.net|ysok\\.net)"
+                    + "/?(?:\\?.*)?"),
+            "https://{shareKey}.ysepan.com/",
+            "https://www.ysepan.com/",
+            YsTool.class),
+
    // Cloudreve自定义域名解析, 解析器CeTool兜底策略, 即任意域名如果匹配不到对应的规则, 则由CeTool统一处理,
    // 如果不属于Cloudreve盘 则调用下一个自定义域名解析器, 若都处理不了则抛出异常, 这种匹配模式类似责任链
    // http(s)://pan.huang1111.cn/s/xxx
@@ -9,6 +9,8 @@ import org.apache.commons.lang3.StringUtils;

 import java.net.URLEncoder;
 import java.nio.charset.StandardCharsets;
+import java.util.EnumSet;
+import java.util.Set;
 import java.util.regex.Matcher;

 import static cn.qaiu.parser.PanDomainTemplate.KEY;
@@ -23,6 +25,9 @@ import static cn.qaiu.parser.PanDomainTemplate.PWD;
 * Create at 2024/9/15 14:10
 */
 public class ParserCreate {
+    private static final Set<PanDomainTemplate> GENERIC_BUILT_IN_PARSERS =
+            EnumSet.of(PanDomainTemplate.CE, PanDomainTemplate.KD, PanDomainTemplate.OTHER);
+
    private final PanDomainTemplate panDomainTemplate;
    private final ShareLinkInfo shareLinkInfo;
    
@@ -132,12 +137,12 @@ public class ParserCreate {
                if (StringUtils.isNotEmpty(pwd)) {
                    shareLinkInfo.setSharePassword(pwd);
                }
-                standardUrl = standardUrl.replace("{pwd}", pwd);
+                standardUrl = standardUrl.replace("{pwd}", StringUtils.defaultString(pwd));
            } catch (IllegalStateException | IllegalArgumentException ignored) {}

            shareLinkInfo.setShareUrl(shareUrl);
            shareLinkInfo.setShareKey(shareKey);
-            if (!(panDomainTemplate.ordinal() >= PanDomainTemplate.CE.ordinal())) {
+            if (!isGenericBuiltInParser(panDomainTemplate)) {
                shareLinkInfo.setStandardUrl(standardUrl);
            }
            return this;
@@ -197,7 +202,7 @@ public class ParserCreate {
        }
        
        // 内置解析器处理
-        if (panDomainTemplate.ordinal() >= PanDomainTemplate.CE.ordinal()) {
+        if (isGenericBuiltInParser(panDomainTemplate)) {
            // 处理Cloudreve(ce)类: pan.huang1111.cn_s_wDz5TK _ -> /
            String[] s = shareKey.split("_");
            String standardUrl = "https://" + String.join("/", s);
@@ -247,9 +252,19 @@ public class ParserCreate {
        return this;
    }

-    // 根据分享链接获取PanDomainTemplate实例（优先匹配自定义解析器）
+    // 根据分享链接获取PanDomainTemplate实例
    public synchronized static ParserCreate fromShareUrl(String shareUrl) {
-        // 优先查找支持正则匹配的自定义解析器
+        if (StringUtils.isBlank(shareUrl)) {
+            throw new IllegalArgumentException("shareUrl不能为空");
+        }
+        shareUrl = shareUrl.trim();
+
+        ParserCreate builtInParser = fromBuiltInShareUrl(shareUrl, false);
+        if (builtInParser != null) {
+            return builtInParser;
+        }
+
+        // 明确内置解析器未命中时，再查找支持正则匹配的自定义解析器
        for (CustomParserConfig customConfig : CustomParserRegistry.getAll().values()) {
            if (customConfig.supportsFromShareUrl()) {
                Matcher matcher = customConfig.getMatchPattern().matcher(shareUrl);
@@ -295,22 +310,35 @@ public class ParserCreate {
                }
            }
        }
-        
-        // 查找内置解析器
+
+        // 最后再走 Cloudreve/可道云/其他网盘这类泛化兜底，避免抢走自定义解析器
+        builtInParser = fromBuiltInShareUrl(shareUrl, true);
+        if (builtInParser != null) {
+            return builtInParser;
+        }
+
+        throw new IllegalArgumentException("Unsupported share URL");
+    }
+
+    private static ParserCreate fromBuiltInShareUrl(String shareUrl, boolean genericOnly) {
        for (PanDomainTemplate panDomainTemplate : PanDomainTemplate.values()) {
+            boolean genericParser = isGenericBuiltInParser(panDomainTemplate);
+            if (genericOnly != genericParser) {
+                continue;
+            }
            if (panDomainTemplate.getPattern().matcher(shareUrl).matches()) {
                ShareLinkInfo shareLinkInfo = ShareLinkInfo.newBuilder()
                        .type(panDomainTemplate.name().toLowerCase())
                        .panName(panDomainTemplate.getDisplayName())
                        .shareUrl(shareUrl).build();
-                if (panDomainTemplate.ordinal() >= PanDomainTemplate.CE.ordinal()) {
+                if (isGenericBuiltInParser(panDomainTemplate)) {
                    shareLinkInfo.setStandardUrl(shareUrl);
                }
                ParserCreate parserCreate = new ParserCreate(panDomainTemplate, shareLinkInfo);
                return parserCreate.normalizeShareLink();
            }
        }
-        throw new IllegalArgumentException("Unsupported share URL");
+        return null;
    }

    // 根据type获取枚举实例（优先查找自定义解析器）
@@ -353,7 +381,7 @@ public class ParserCreate {
        // 自定义解析器处理
        if (isCustomParser) {
            path = this.shareLinkInfo.getType() + "/" + this.shareLinkInfo.getShareKey();
-        } else if (panDomainTemplate.ordinal() >= PanDomainTemplate.CE.ordinal()) {
+        } else if (isGenericBuiltInParser(panDomainTemplate)) {
            // 处理Cloudreve(ce)类: pan.huang1111.cn_s_wDz5TK _ -> /
            path = this.shareLinkInfo.getType() + "/"
                    + this.shareLinkInfo.getShareUrl()
@@ -381,7 +409,11 @@ public class ParserCreate {
    public CustomParserConfig getCustomParserConfig() {
        return customParserConfig;
    }
-    
+
+    private static boolean isGenericBuiltInParser(PanDomainTemplate panDomainTemplate) {
+        return GENERIC_BUILT_IN_PARSERS.contains(panDomainTemplate);
+    }
+
    /**
     * 获取内置解析器模板（仅当isCustomParser为false时有效）
     * @return 内置解析器模板，如果是自定义解析器则返回null
@@ -0,0 +1,149 @@
+package cn.qaiu.parser;
+
+import java.util.concurrent.ConcurrentHashMap;
+
+/**
+ * 解析器 Token/Cookie 缓存 — 支持多账号隔离。
+ * <p>
+ * 以 (diskType + "#" + accountKey) 作为缓存 key，不同账号的 token 互不覆盖。
+ * accountKey 优先使用 _configId，其次使用 username、cookie 前16位等可区分标识。
+ * </p>
+ */
+public final class TokenCache {
+
+    private TokenCache() {}
+
+    /** token 缓存 */
+    private static final ConcurrentHashMap<String, String> tokenMap = new ConcurrentHashMap<>();
+    /** 过期时间缓存（毫秒时间戳） */
+    private static final ConcurrentHashMap<String, Long> expireMap = new ConcurrentHashMap<>();
+    /** 同一 key 下的额外字符串缓存（如 userId） */
+    private static final ConcurrentHashMap<String, String> extraMap = new ConcurrentHashMap<>();
+    /** 布尔标记缓存（如 authFlag） */
+    private static final ConcurrentHashMap<String, Boolean> flagMap = new ConcurrentHashMap<>();
+
+    // ============ key 构造 ============
+
+    public static String key(String diskType, String accountKey) {
+        return diskType + "#" + (accountKey == null ? "_default" : accountKey);
+    }
+
+    // ============ token ============
+
+    public static String getToken(String cacheKey) {
+        return tokenMap.get(cacheKey);
+    }
+
+    public static void putToken(String cacheKey, String token) {
+        if (token == null) {
+            tokenMap.remove(cacheKey);
+        } else {
+            tokenMap.put(cacheKey, token);
+        }
+    }
+
+    // ============ expire ============
+
+    public static long getExpire(String cacheKey) {
+        return expireMap.getOrDefault(cacheKey, 0L);
+    }
+
+    public static void putExpire(String cacheKey, long expireMs) {
+        expireMap.put(cacheKey, expireMs);
+    }
+
+    public static boolean isExpired(String cacheKey) {
+        long exp = getExpire(cacheKey);
+        return exp <= 0 || System.currentTimeMillis() > exp;
+    }
+
+    // ============ extra (userId 等) ============
+
+    public static String getExtra(String cacheKey) {
+        return extraMap.get(cacheKey);
+    }
+
+    public static void putExtra(String cacheKey, String value) {
+        if (value == null) {
+            extraMap.remove(cacheKey);
+        } else {
+            extraMap.put(cacheKey, value);
+        }
+    }
+
+    // ============ flag (authFlag 等) ============
+
+    public static boolean getFlag(String cacheKey, boolean defaultValue) {
+        return flagMap.getOrDefault(cacheKey, defaultValue);
+    }
+
+    public static void putFlag(String cacheKey, boolean value) {
+        flagMap.put(cacheKey, value);
+    }
+
+    // ============ 清除 ============
+
+    public static void remove(String cacheKey) {
+        tokenMap.remove(cacheKey);
+        expireMap.remove(cacheKey);
+        extraMap.remove(cacheKey);
+        flagMap.remove(cacheKey);
+    }
+
+    /**
+     * 清除指定网盘类型的所有缓存（精准清除，不影响其他网盘类型）
+     */
+    public static void removeByDiskType(String diskType) {
+        String prefix = diskType + "#";
+        tokenMap.keySet().removeIf(k -> k.startsWith(prefix));
+        expireMap.keySet().removeIf(k -> k.startsWith(prefix));
+        extraMap.keySet().removeIf(k -> k.startsWith(prefix));
+        flagMap.keySet().removeIf(k -> k.startsWith(prefix));
+    }
+
+    public static void clear() {
+        tokenMap.clear();
+        expireMap.clear();
+        extraMap.clear();
+        flagMap.clear();
+    }
+
+    // ============ Token 持久化队列 ============
+
+    /** 待持久化的 cachedToken 数据 (cacheKey -> [token, expireMs]) */
+    private static final ConcurrentHashMap<String, String[]> persistQueue = new ConcurrentHashMap<>();
+    /** 待回写的凭据更新 (cacheKey -> newCredential)，如 PaliTool refresh_token 轮换 */
+    private static final ConcurrentHashMap<String, String> credentialUpdateQueue = new ConcurrentHashMap<>();
+
+    /**
+     * 解析器登录成功后，将 token 加入持久化队列（下次 recordConfigUsage 回写 DB）
+     */
+    public static void queueCachedTokenPersist(String cacheKey, String token, long expireMs) {
+        if (cacheKey != null && token != null) {
+            persistQueue.put(cacheKey, new String[]{token, String.valueOf(expireMs)});
+        }
+    }
+
+    /**
+     * 凭据本身被替换（如 PaliTool refresh_token 轮换），加入回写队列
+     */
+    public static void queueCredentialUpdate(String cacheKey, String newCredential) {
+        if (cacheKey != null && newCredential != null) {
+            credentialUpdateQueue.put(cacheKey, newCredential);
+        }
+    }
+
+    /**
+     * 消费持久化队列：返回 [token, expireMs] 并移除；无数据返回 null
+     */
+    public static String[] pollCachedTokenPersist(String cacheKey) {
+        return cacheKey == null ? null : persistQueue.remove(cacheKey);
+    }
+
+    /**
+     * 消费凭据更新队列：返回新凭据并移除；无数据返回 null
+     */
+    public static String pollCredentialUpdate(String cacheKey) {
+        return cacheKey == null ? null : credentialUpdateQueue.remove(cacheKey);
+    }
+}
@@ -21,6 +21,7 @@ import java.util.concurrent.ConcurrentHashMap;
 public class CustomParserRegistry {

    private static final Logger log = LoggerFactory.getLogger(CustomParserRegistry.class);
+    private static final int MAX_CUSTOM_PARSERS = Integer.getInteger("parser.custom.maxRegistrySize", 256);

    /**
     * 存储自定义解析器配置的Map，key为类型标识，value为配置对象
@@ -33,7 +34,7 @@ public class CustomParserRegistry {
     * @param config 解析器配置
     * @throws IllegalArgumentException 如果type已存在或与内置解析器冲突
     */
-    public static void register(CustomParserConfig config) {
+    public static synchronized void register(CustomParserConfig config) {
        if (config == null) {
            throw new IllegalArgumentException("config不能为空");
        }
@@ -59,6 +60,11 @@ public class CustomParserRegistry {
                    "类型标识 '" + type + "' 已被注册，请先注销或使用其他标识"
            );
        }
+        if (CUSTOM_PARSERS.size() >= MAX_CUSTOM_PARSERS) {
+            throw new IllegalArgumentException(
+                    "自定义解析器数量已达到上限（" + MAX_CUSTOM_PARSERS + "个），请先注销不需要的解析器"
+            );
+        }

        CUSTOM_PARSERS.put(type, config);
        log.info("注册自定义解析器成功: {} ({})", config.getDisplayName(), type);
@@ -171,7 +177,7 @@ public class CustomParserRegistry {
     * @param type 解析器类型标识
     * @return 是否注销成功
     */
-    public static boolean unregister(String type) {
+    public static synchronized boolean unregister(String type) {
        if (type == null || type.trim().isEmpty()) {
            return false;
        }
@@ -213,7 +219,7 @@ public class CustomParserRegistry {
    /**
     * 清空所有自定义解析器
     */
-    public static void clear() {
+    public static synchronized void clear() {
        CUSTOM_PARSERS.clear();
    }

@@ -2,19 +2,21 @@ package cn.qaiu.parser.customjs;

 import cn.qaiu.WebClientVertxInit;
 import cn.qaiu.util.HttpResponseHelper;
-import io.vertx.core.Future;
 import io.vertx.core.MultiMap;
 import io.vertx.core.Promise;
 import io.vertx.core.buffer.Buffer;
+import io.vertx.core.http.HttpClient;
+import io.vertx.core.http.HttpClientOptions;
+import io.vertx.core.http.HttpClientRequest;
+import io.vertx.core.http.HttpClientResponse;
+import io.vertx.core.http.HttpHeaders;
+import io.vertx.core.http.HttpMethod;
+import io.vertx.core.http.RequestOptions;
+import io.vertx.core.json.Json;
 import io.vertx.core.json.JsonObject;
 import io.vertx.core.net.ProxyOptions;
 import io.vertx.core.net.ProxyType;
-import io.vertx.ext.web.client.HttpRequest;
 import io.vertx.ext.web.client.HttpResponse;
-import io.vertx.ext.web.client.WebClient;
-import io.vertx.ext.web.client.WebClientOptions;
-import io.vertx.ext.web.client.WebClientSession;
-import io.vertx.ext.web.multipart.MultipartForm;
 import org.apache.commons.lang3.StringUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -27,8 +29,13 @@ import java.net.UnknownHostException;
 import java.nio.charset.StandardCharsets;
 import java.util.HashMap;
 import java.util.Map;
+import java.util.Set;
+import java.util.UUID;
+import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.TimeoutException;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.concurrent.atomic.AtomicReference;
 import java.util.regex.Pattern;

 /**
@@ -39,11 +46,60 @@ import java.util.regex.Pattern;
 * Create at 2025/10/17
 */
 public class JsHttpClient {
-    
+
    private static final Logger log = LoggerFactory.getLogger(JsHttpClient.class);
-    
-    private final WebClient client;
-    private final WebClientSession clientSession;
+    private static final int MAX_RESPONSE_BODY_BYTES = 8 * 1024 * 1024;
+    private static final int MAX_REQUEST_BODY_BYTES = 8 * 1024 * 1024;
+    private static final int MAX_HEADER_COUNT = 64;
+    private static final int MAX_HEADER_VALUE_LENGTH = 4096;
+    private static final int MAX_TIMEOUT_SECONDS = 120;
+    private static final int MAX_REDIRECTS = 5;
+    private static final String DEFAULT_ACCEPT_ENCODING = "gzip, deflate, br";
+
+    private static final Object SHARED_CLIENT_LOCK = new Object();
+    // 共享 HttpClient 实例（非代理模式），懒加载避免类初始化阶段抢跑 Vert.x。
+    private static volatile HttpClient sharedClient;
+    private static volatile boolean sharedClientShutdown = false;
+
+    /**
+     * 关闭共享 HttpClient（应用关闭时调用）
+     */
+    public static void shutdownSharedClient() {
+        synchronized (SHARED_CLIENT_LOCK) {
+            sharedClientShutdown = true;
+            if (sharedClient != null) {
+                sharedClient.close();
+                sharedClient = null;
+            }
+        }
+    }
+
+    private static HttpClient sharedClient() {
+        synchronized (SHARED_CLIENT_LOCK) {
+            ensureSharedClientAvailable();
+            if (sharedClient == null) {
+                sharedClient = WebClientVertxInit.get().createHttpClient(
+                        new HttpClientOptions()
+                                .setConnectTimeout(10000)
+                                .setIdleTimeout(30)
+                                .setIdleTimeoutUnit(TimeUnit.SECONDS)
+                                .setMaxPoolSize(64));
+            }
+            return sharedClient;
+        }
+    }
+
+    private static void ensureSharedClientAvailable() {
+        if (sharedClientShutdown) {
+            throw new IllegalStateException("共享 JavaScript HttpClient 已关闭");
+        }
+    }
+
+    private final HttpClient client;
+    private final boolean ownClient; // 标记是否为自建 client（需要 close）
+    private final AtomicBoolean closed = new AtomicBoolean(false);
+    private final Object requestLock = new Object();
+    private final Set<HttpClientRequest> activeRequests = ConcurrentHashMap.newKeySet();
    private MultiMap headers;
    private int timeoutSeconds = 30; // 默认超时时间30秒
    
@@ -61,11 +117,12 @@ public class JsHttpClient {
    };
    
    public JsHttpClient() {
-        this.client = WebClient.create(WebClientVertxInit.get(), new WebClientOptions());
-        this.clientSession = WebClientSession.create(client);
+        ensureSharedClientAvailable();
+        this.client = sharedClient();
+        this.ownClient = false;
        this.headers = MultiMap.caseInsensitiveMultiMap();
        // 设置默认的Accept-Encoding头以支持压缩响应
-        this.headers.set("Accept-Encoding", "gzip, deflate, br, zstd");
+        this.headers.set("Accept-Encoding", DEFAULT_ACCEPT_ENCODING);
        // 设置默认的User-Agent头
        this.headers.set("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/140.0.0.0");
        // 设置默认的Accept-Language头
@@ -77,31 +134,35 @@ public class JsHttpClient {
     * @param proxyConfig 代理配置JsonObject，包含type、host、port、username、password
     */
    public JsHttpClient(JsonObject proxyConfig) {
+        ensureSharedClientAvailable();
        if (proxyConfig != null && proxyConfig.containsKey("type")) {
            ProxyOptions proxyOptions = new ProxyOptions()
                    .setType(ProxyType.valueOf(proxyConfig.getString("type").toUpperCase()))
                    .setHost(proxyConfig.getString("host"))
                    .setPort(proxyConfig.getInteger("port"));
-            
+
            if (StringUtils.isNotEmpty(proxyConfig.getString("username"))) {
                proxyOptions.setUsername(proxyConfig.getString("username"));
            }
            if (StringUtils.isNotEmpty(proxyConfig.getString("password"))) {
                proxyOptions.setPassword(proxyConfig.getString("password"));
            }
-            
-            this.client = WebClient.create(WebClientVertxInit.get(),
-                    new WebClientOptions()
-                            .setUserAgentEnabled(false)
+
+            this.client = WebClientVertxInit.get().createHttpClient(
+                    new HttpClientOptions()
+                            .setConnectTimeout(10000)
+                            .setIdleTimeout(30)
+                            .setIdleTimeoutUnit(TimeUnit.SECONDS)
+                            .setMaxPoolSize(16)
                            .setProxyOptions(proxyOptions));
-            this.clientSession = WebClientSession.create(client);
+            this.ownClient = true;
        } else {
-            this.client = WebClient.create(WebClientVertxInit.get());
-            this.clientSession = WebClientSession.create(client);
+            this.client = sharedClient();
+            this.ownClient = false;
        }
        this.headers = MultiMap.caseInsensitiveMultiMap();
        // 设置默认的Accept-Encoding头以支持压缩响应
-        this.headers.set("Accept-Encoding", "gzip, deflate, br, zstd");
+        this.headers.set("Accept-Encoding", DEFAULT_ACCEPT_ENCODING);
        // 设置默认的User-Agent头
        this.headers.set("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/140.0.0.0");
        // 设置默认的Accept-Language头
@@ -183,13 +244,7 @@ public class JsHttpClient {
     */
    public JsHttpResponse get(String url) {
        validateUrlSecurity(url);
-        return executeRequest(() -> {
-            HttpRequest<Buffer> request = client.getAbs(url);
-            if (!headers.isEmpty()) {
-                request.putHeaders(headers);
-            }
-            return request.send();
-        });
+        return executeRequest(HttpMethod.GET, url, null, false);
    }
    
    /**
@@ -198,16 +253,25 @@ public class JsHttpClient {
     * @return HTTP响应
     */
    public JsHttpResponse getWithRedirect(String url) {
-        validateUrlSecurity(url);
-        return executeRequest(() -> {
-            HttpRequest<Buffer> request = client.getAbs(url);
-            if (!headers.isEmpty()) {
-                request.putHeaders(headers);
+        String currentUrl = url;
+        for (int redirectCount = 0; redirectCount <= MAX_REDIRECTS; redirectCount++) {
+            validateUrlSecurity(currentUrl);
+            JsHttpResponse response = executeRequest(HttpMethod.GET, currentUrl, null, false);
+            if (!isRedirectStatus(response.statusCode())) {
+                return response;
            }
-            // 设置跟随重定向
-            request.followRedirects(true);
-            return request.send();
-        });
+
+            if (redirectCount == MAX_REDIRECTS) {
+                throw new RuntimeException("重定向次数超过限制: " + MAX_REDIRECTS);
+            }
+
+            String location = response.header(HttpHeaders.LOCATION.toString());
+            if (StringUtils.isBlank(location)) {
+                throw new RuntimeException("重定向响应缺少Location头");
+            }
+            currentUrl = resolveRedirectUrl(currentUrl, location);
+        }
+        throw new RuntimeException("重定向处理失败");
    }
    
    /**
@@ -217,15 +281,7 @@ public class JsHttpClient {
     */
    public JsHttpResponse getNoRedirect(String url) {
        validateUrlSecurity(url);
-        return executeRequest(() -> {
-            HttpRequest<Buffer> request = client.getAbs(url);
-            if (!headers.isEmpty()) {
-                request.putHeaders(headers);
-            }
-            // 设置不跟随重定向
-            request.followRedirects(false);
-            return request.send();
-        });
+        return executeRequest(HttpMethod.GET, url, null, false);
    }
    
    /**
@@ -236,26 +292,7 @@ public class JsHttpClient {
     */
    public JsHttpResponse post(String url, Object data) {
        validateUrlSecurity(url);
-        return executeRequest(() -> {
-            HttpRequest<Buffer> request = client.postAbs(url);
-            if (!headers.isEmpty()) {
-                request.putHeaders(headers);
-            }
-            
-            if (data != null) {
-                if (data instanceof String) {
-                    return request.sendBuffer(Buffer.buffer((String) data));
-                } else if (data instanceof Map) {
-                    @SuppressWarnings("unchecked")
-                    Map<String, String> mapData = (Map<String, String>) data;
-                    return request.sendForm(MultiMap.caseInsensitiveMultiMap().addAll(mapData));
-                } else {
-                    return request.sendJson(data);
-                }
-            } else {
-                return request.send();
-            }
-        });
+        return executeRequest(HttpMethod.POST, url, bodyFromData(data), false);
    }
    
    /**
@@ -266,26 +303,7 @@ public class JsHttpClient {
     */
    public JsHttpResponse put(String url, Object data) {
        validateUrlSecurity(url);
-        return executeRequest(() -> {
-            HttpRequest<Buffer> request = client.putAbs(url);
-            if (!headers.isEmpty()) {
-                request.putHeaders(headers);
-            }
-            
-            if (data != null) {
-                if (data instanceof String) {
-                    return request.sendBuffer(Buffer.buffer((String) data));
-                } else if (data instanceof Map) {
-                    @SuppressWarnings("unchecked")
-                    Map<String, String> mapData = (Map<String, String>) data;
-                    return request.sendForm(MultiMap.caseInsensitiveMultiMap().addAll(mapData));
-                } else {
-                    return request.sendJson(data);
-                }
-            } else {
-                return request.send();
-            }
-        });
+        return executeRequest(HttpMethod.PUT, url, bodyFromData(data), false);
    }
    
    /**
@@ -294,13 +312,8 @@ public class JsHttpClient {
     * @return HTTP响应
     */
    public JsHttpResponse delete(String url) {
-        return executeRequest(() -> {
-            HttpRequest<Buffer> request = client.deleteAbs(url);
-            if (!headers.isEmpty()) {
-                request.putHeaders(headers);
-            }
-            return request.send();
-        });
+        validateUrlSecurity(url);
+        return executeRequest(HttpMethod.DELETE, url, null, false);
    }
    
    /**
@@ -310,26 +323,8 @@ public class JsHttpClient {
     * @return HTTP响应
     */
    public JsHttpResponse patch(String url, Object data) {
-        return executeRequest(() -> {
-            HttpRequest<Buffer> request = client.patchAbs(url);
-            if (!headers.isEmpty()) {
-                request.putHeaders(headers);
-            }
-            
-            if (data != null) {
-                if (data instanceof String) {
-                    return request.sendBuffer(Buffer.buffer((String) data));
-                } else if (data instanceof Map) {
-                    @SuppressWarnings("unchecked")
-                    Map<String, String> mapData = (Map<String, String>) data;
-                    return request.sendForm(MultiMap.caseInsensitiveMultiMap().addAll(mapData));
-                } else {
-                    return request.sendJson(data);
-                }
-            } else {
-                return request.send();
-            }
-        });
+        validateUrlSecurity(url);
+        return executeRequest(HttpMethod.PATCH, url, bodyFromData(data), false);
    }
    
    /**
@@ -340,6 +335,12 @@ public class JsHttpClient {
     */
    public JsHttpClient putHeader(String name, String value) {
        if (name != null && value != null) {
+            if (headers.size() >= MAX_HEADER_COUNT && !headers.contains(name)) {
+                throw new IllegalArgumentException("请求头数量超过限制");
+            }
+            if (value.length() > MAX_HEADER_VALUE_LENGTH) {
+                throw new IllegalArgumentException("请求头过长: " + name);
+            }
            headers.set(name, value);
        }
        return this;
@@ -353,9 +354,7 @@ public class JsHttpClient {
    public JsHttpClient putHeaders(Map<String, String> headersMap) {
        if (headersMap != null) {
            for (Map.Entry<String, String> entry : headersMap.entrySet()) {
-                if (entry.getKey() != null && entry.getValue() != null) {
-                    headers.set(entry.getKey(), entry.getValue());
-                }
+                putHeader(entry.getKey(), entry.getValue());
            }
        }
        return this;
@@ -380,7 +379,7 @@ public class JsHttpClient {
    public JsHttpClient clearHeaders() {
        headers.clear();
        // 重新设置默认头
-        headers.set("Accept-Encoding", "gzip, deflate, br, zstd");
+        headers.set("Accept-Encoding", DEFAULT_ACCEPT_ENCODING);
        headers.set("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/140.0.0.0");
        headers.set("Accept-Language", "zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6");
        return this;
@@ -405,7 +404,7 @@ public class JsHttpClient {
     */
    public JsHttpClient setTimeout(int seconds) {
        if (seconds > 0) {
-            this.timeoutSeconds = seconds;
+            this.timeoutSeconds = Math.min(seconds, MAX_TIMEOUT_SECONDS);
        }
        return this;
    }
@@ -450,19 +449,12 @@ public class JsHttpClient {
     * @return HTTP响应
     */
    public JsHttpResponse sendForm(Map<String, String> data) {
-        return executeRequest(() -> {
-            HttpRequest<Buffer> request = client.postAbs("");
-            if (!headers.isEmpty()) {
-                request.putHeaders(headers);
-            }
-            
-            MultiMap formData = MultiMap.caseInsensitiveMultiMap();
-            if (data != null) {
-                formData.addAll(data);
-            }
-            
-            return request.sendForm(formData);
-        });
+        throw new IllegalArgumentException("sendForm(data) 缺少请求URL，请使用 post(url, data)");
+    }
+
+    public JsHttpResponse sendForm(String url, Map<String, String> data) {
+        validateUrlSecurity(url);
+        return executeRequest(HttpMethod.POST, url, formBody(data), false);
    }
    
    /**
@@ -474,34 +466,8 @@ public class JsHttpClient {
     * @return HTTP响应
     */
    public JsHttpResponse sendMultipartForm(String url, Map<String, Object> data) {
-        return executeRequest(() -> {
-            HttpRequest<Buffer> request = client.postAbs(url);
-            if (!headers.isEmpty()) {
-                request.putHeaders(headers);
-            }
-            
-            MultipartForm form = MultipartForm.create();
-            
-            if (data != null) {
-                for (Map.Entry<String, Object> entry : data.entrySet()) {
-                    String key = entry.getKey();
-                    Object value = entry.getValue();
-                    
-                    if (value instanceof String) {
-                        form.attribute(key, (String) value);
-                    } else if (value instanceof byte[]) {
-                        form.binaryFileUpload(key, key, Buffer.buffer((byte[]) value), "application/octet-stream");
-                    } else if (value instanceof Buffer) {
-                        form.binaryFileUpload(key, key, (Buffer) value, "application/octet-stream");
-                    } else if (value != null) {
-                        // 其他类型转换为字符串
-                        form.attribute(key, value.toString());
-                    }
-                }
-            }
-            
-            return request.sendMultipartForm(form);
-        });
+        validateUrlSecurity(url);
+        return executeRequest(HttpMethod.POST, url, multipartBody(data), false);
    }
    
    /**
@@ -510,44 +476,103 @@ public class JsHttpClient {
     * @return HTTP响应
     */
    public JsHttpResponse sendJson(Object data) {
-        return executeRequest(() -> {
-            HttpRequest<Buffer> request = client.postAbs("");
-            if (!headers.isEmpty()) {
-                request.putHeaders(headers);
-            }
-            
-            return request.sendJson(data);
-        });
+        throw new IllegalArgumentException("sendJson(data) 缺少请求URL，请使用 post(url, data)");
+    }
+
+    public JsHttpResponse sendJson(String url, Object data) {
+        validateUrlSecurity(url);
+        return executeRequest(HttpMethod.POST, url, jsonBody(data), false);
    }
    
    /**
     * 执行HTTP请求（同步）
     */
-    private JsHttpResponse executeRequest(RequestExecutor executor) {
+    private JsHttpResponse executeRequest(HttpMethod method, String url, RequestBody requestBody, boolean followRedirects) {
+        if (closed.get()) {
+            throw new IllegalStateException("HTTP客户端已关闭");
+        }
+        AtomicReference<HttpClientRequest> requestRef = new AtomicReference<>();
+        AtomicBoolean abandoned = new AtomicBoolean(false);
        try {
-            Promise<HttpResponse<Buffer>> promise = Promise.promise();
-            Future<HttpResponse<Buffer>> future = executor.execute();
-            
-            future.onComplete(result -> {
-                if (result.succeeded()) {
-                    promise.complete(result.result());
-                } else {
-                    promise.fail(result.cause());
-                }
-            }).onFailure(e -> log.error("HTTP请求失败", e));
+            Promise<JsHttpResponse> promise = Promise.promise();

-            // 等待响应完成（使用配置的超时时间）
-            HttpResponse<Buffer> response = promise.future().toCompletionStage()
+            RequestOptions options = new RequestOptions()
+                    .setMethod(method)
+                    .setAbsoluteURI(url)
+                    .setFollowRedirects(followRedirects)
+                    .setTimeout(TimeUnit.SECONDS.toMillis(timeoutSeconds))
+                    .setHeaders(MultiMap.caseInsensitiveMultiMap().setAll(headers));
+
+            client.request(options).onComplete(ar -> {
+                if (ar.failed()) {
+                    promise.tryFail(ar.cause());
+                    return;
+                }
+
+                HttpClientRequest request = ar.result();
+                synchronized (requestLock) {
+                    if (closed.get() || abandoned.get()) {
+                        request.reset();
+                        promise.tryFail("HTTP客户端已关闭");
+                        return;
+                    }
+                    activeRequests.add(request);
+                    requestRef.set(request);
+                    request.exceptionHandler(e -> {
+                        finishRequest(request);
+                        promise.tryFail(e);
+                    });
+                    request.response().onComplete(responseAr -> {
+                        if (responseAr.succeeded()) {
+                            collectResponse(request, responseAr.result(), promise);
+                        } else {
+                            finishRequest(request);
+                            promise.tryFail(responseAr.cause());
+                        }
+                    });
+
+                    if (closed.get() || abandoned.get()) {
+                        request.reset();
+                        finishRequest(request);
+                        promise.tryFail("HTTP客户端已关闭");
+                        return;
+                    }
+                    if (requestBody == null || requestBody.body() == null) {
+                        request.end().onFailure(e -> {
+                            finishRequest(request);
+                            promise.tryFail(e);
+                        });
+                    } else {
+                        request.headers().set(HttpHeaders.CONTENT_LENGTH, String.valueOf(requestBody.body().length()));
+                        if (StringUtils.isNotEmpty(requestBody.contentType())) {
+                            request.headers().set(HttpHeaders.CONTENT_TYPE, requestBody.contentType());
+                        }
+                        request.end(requestBody.body()).onFailure(e -> {
+                            finishRequest(request);
+                            promise.tryFail(e);
+                        });
+                    }
+                }
+            });
+
+            return promise.future().toCompletionStage()
                    .toCompletableFuture()
                    .get(timeoutSeconds, TimeUnit.SECONDS);
-            
-            return new JsHttpResponse(response);
-            
+
        } catch (TimeoutException e) {
+            // RequestOptions timeout 通常会先触发；这里再兜底，避免等待线程返回后请求还在后台下载。
            String errorMsg = "HTTP请求超时（" + timeoutSeconds + "秒）";
+            abandoned.set(true);
+            synchronized (requestLock) {
+                abortRequest(requestRef);
+            }
            log.error(errorMsg, e);
            throw new RuntimeException(errorMsg, e);
        } catch (Exception e) {
+            abandoned.set(true);
+            synchronized (requestLock) {
+                abortRequest(requestRef);
+            }
            String errorMsg = e.getMessage();
            if (errorMsg == null || errorMsg.trim().isEmpty()) {
                errorMsg = e.getClass().getSimpleName();
@@ -559,13 +584,196 @@ public class JsHttpClient {
            throw new RuntimeException("HTTP请求执行失败: " + errorMsg, e);
        }
    }
-    
-    /**
-     * 请求执行器接口
-     */
-    @FunctionalInterface
-    private interface RequestExecutor {
-        Future<HttpResponse<Buffer>> execute();
+
+    private static boolean isRedirectStatus(int statusCode) {
+        return statusCode == 301 || statusCode == 302 || statusCode == 303
+                || statusCode == 307 || statusCode == 308;
+    }
+
+    private String resolveRedirectUrl(String currentUrl, String location) {
+        try {
+            URI redirectUri = new URI(currentUrl).resolve(location.trim());
+            String scheme = redirectUri.getScheme();
+            if (!"http".equalsIgnoreCase(scheme) && !"https".equalsIgnoreCase(scheme)) {
+                throw new SecurityException("🔒 安全拦截: 重定向协议不被允许");
+            }
+            String redirectUrl = redirectUri.toString();
+            validateUrlSecurity(redirectUrl);
+            return redirectUrl;
+        } catch (SecurityException e) {
+            throw e;
+        } catch (Exception e) {
+            throw new RuntimeException("解析重定向地址失败: " + e.getMessage(), e);
+        }
+    }
+
+    private void collectResponse(HttpClientRequest request, HttpClientResponse response, Promise<JsHttpResponse> promise) {
+        Buffer body = Buffer.buffer();
+        AtomicBoolean done = new AtomicBoolean(false);
+
+        String contentLengthHeader = response.getHeader(HttpHeaders.CONTENT_LENGTH.toString());
+        if (StringUtils.isNumeric(contentLengthHeader)) {
+            long contentLength = Long.parseLong(contentLengthHeader);
+            if (contentLength > MAX_RESPONSE_BODY_BYTES) {
+                done.set(true);
+                request.reset();
+                finishRequest(request);
+                promise.tryFail("响应体过大: " + contentLength + " bytes");
+                return;
+            }
+        }
+
+        response.exceptionHandler(e -> {
+            if (done.compareAndSet(false, true)) {
+                finishRequest(request);
+                promise.tryFail(e);
+            }
+        });
+        response.handler(chunk -> {
+            if (done.get()) {
+                return;
+            }
+            if (body.length() + chunk.length() > MAX_RESPONSE_BODY_BYTES) {
+                if (done.compareAndSet(false, true)) {
+                    request.reset();
+                    finishRequest(request);
+                    promise.tryFail("响应体过大: " + (body.length() + chunk.length()) + " bytes");
+                }
+                return;
+            }
+            body.appendBuffer(chunk);
+        });
+        response.endHandler(v -> {
+            if (done.compareAndSet(false, true)) {
+                finishRequest(request);
+                promise.tryComplete(new JsHttpResponse(
+                        response.statusCode(),
+                        MultiMap.caseInsensitiveMultiMap().setAll(response.headers()),
+                        body,
+                        response.statusMessage(),
+                        null
+                ));
+            }
+        });
+        response.resume();
+    }
+
+    private void finishRequest(HttpClientRequest request) {
+        if (request != null) {
+            activeRequests.remove(request);
+        }
+    }
+
+    private void abortRequest(AtomicReference<HttpClientRequest> requestRef) {
+        HttpClientRequest request = requestRef.get();
+        if (request != null) {
+            try {
+                request.reset();
+            } finally {
+                finishRequest(request);
+            }
+        }
+    }
+
+    private RequestBody bodyFromData(Object data) {
+        if (data == null) {
+            return null;
+        }
+        if (data instanceof String str) {
+            return plainTextBody(str);
+        }
+        if (data instanceof Buffer buffer) {
+            return limitedBody(buffer, null);
+        }
+        if (data instanceof byte[] bytes) {
+            return limitedBody(Buffer.buffer(bytes), null);
+        }
+        if (data instanceof Map<?, ?> map) {
+            Map<String, String> formMap = new HashMap<>();
+            map.forEach((key, value) -> {
+                if (key != null && value != null) {
+                    formMap.put(String.valueOf(key), String.valueOf(value));
+                }
+            });
+            return formBody(formMap);
+        }
+        return jsonBody(data);
+    }
+
+    private RequestBody plainTextBody(String data) {
+        return limitedBody(Buffer.buffer(data, StandardCharsets.UTF_8.name()), null);
+    }
+
+    private RequestBody jsonBody(Object data) {
+        Buffer body = data == null ? Buffer.buffer() : Buffer.buffer(Json.encode(data), StandardCharsets.UTF_8.name());
+        return limitedBody(body, "application/json; charset=utf-8");
+    }
+
+    private RequestBody formBody(Map<String, String> data) {
+        StringBuilder encoded = new StringBuilder();
+        if (data != null) {
+            for (Map.Entry<String, String> entry : data.entrySet()) {
+                if (encoded.length() > 0) {
+                    encoded.append('&');
+                }
+                encoded.append(urlEncode(entry.getKey()));
+                encoded.append('=');
+                encoded.append(urlEncode(entry.getValue()));
+            }
+        }
+        return limitedBody(Buffer.buffer(encoded.toString(), StandardCharsets.UTF_8.name()),
+                "application/x-www-form-urlencoded; charset=utf-8");
+    }
+
+    private RequestBody multipartBody(Map<String, Object> data) {
+        String boundary = "----NetdiskJsHttpClientBoundary" + UUID.randomUUID().toString().replace("-", "");
+        Buffer body = Buffer.buffer();
+        if (data != null) {
+            for (Map.Entry<String, Object> entry : data.entrySet()) {
+                String key = entry.getKey();
+                Object value = entry.getValue();
+                if (key == null || value == null) {
+                    continue;
+                }
+                appendAscii(body, "--" + boundary + "\r\n");
+                if (value instanceof byte[] bytes) {
+                    appendAscii(body, "Content-Disposition: form-data; name=\"" + escapeMultipart(key)
+                            + "\"; filename=\"" + escapeMultipart(key) + "\"\r\n");
+                    appendAscii(body, "Content-Type: application/octet-stream\r\n\r\n");
+                    body.appendBytes(bytes);
+                    appendAscii(body, "\r\n");
+                } else if (value instanceof Buffer buffer) {
+                    appendAscii(body, "Content-Disposition: form-data; name=\"" + escapeMultipart(key)
+                            + "\"; filename=\"" + escapeMultipart(key) + "\"\r\n");
+                    appendAscii(body, "Content-Type: application/octet-stream\r\n\r\n");
+                    body.appendBuffer(buffer);
+                    appendAscii(body, "\r\n");
+                } else {
+                    appendAscii(body, "Content-Disposition: form-data; name=\"" + escapeMultipart(key) + "\"\r\n\r\n");
+                    body.appendString(String.valueOf(value), StandardCharsets.UTF_8.name());
+                    appendAscii(body, "\r\n");
+                }
+                ensureRequestBodyLimit(body);
+            }
+        }
+        appendAscii(body, "--" + boundary + "--\r\n");
+        return limitedBody(body, "multipart/form-data; boundary=" + boundary);
+    }
+
+    private static void appendAscii(Buffer body, String value) {
+        body.appendString(value, StandardCharsets.US_ASCII.name());
+    }
+
+    private static String escapeMultipart(String value) {
+        return value.replace("\\", "\\\\").replace("\"", "\\\"");
+    }
+
+    private static RequestBody limitedBody(Buffer body, String contentType) {
+        ensureRequestBodyLimit(body);
+        return new RequestBody(body, contentType);
+    }
+
+    private record RequestBody(Buffer body, String contentType) {
    }
    
    /**
@@ -573,10 +781,29 @@ public class JsHttpClient {
     */
    public static class JsHttpResponse {
        
-        private final HttpResponse<Buffer> response;
+        private final int statusCode;
+        private final MultiMap headers;
+        private final Buffer body;
+        private final String statusMessage;
+        private final HttpResponse<Buffer> originalResponse;
        
        public JsHttpResponse(HttpResponse<Buffer> response) {
-            this.response = response;
+            this(
+                    response.statusCode(),
+                    MultiMap.caseInsensitiveMultiMap().setAll(response.headers()),
+                    response.body(),
+                    response.statusMessage(),
+                    response
+            );
+        }
+
+        public JsHttpResponse(int statusCode, MultiMap headers, Buffer body, String statusMessage,
+                              HttpResponse<Buffer> originalResponse) {
+            this.statusCode = statusCode;
+            this.headers = headers == null ? MultiMap.caseInsensitiveMultiMap() : headers;
+            this.body = body == null ? Buffer.buffer() : body;
+            this.statusMessage = statusMessage;
+            this.originalResponse = originalResponse;
        }
        
        /**
@@ -584,7 +811,7 @@ public class JsHttpClient {
         * @return 响应体字符串
         */
        public String body() {
-            return HttpResponseHelper.asText(response);
+            return HttpResponseHelper.asText(body, header(HttpHeaders.CONTENT_ENCODING.toString()));
        }
        
        /**
@@ -593,7 +820,7 @@ public class JsHttpClient {
         */
        public Object json() {
            try {
-                JsonObject jsonObject = HttpResponseHelper.asJson(response);
+                JsonObject jsonObject = HttpResponseHelper.asJson(body, header(HttpHeaders.CONTENT_ENCODING.toString()));
                if (jsonObject == null || jsonObject.isEmpty()) {
                    return null;
                }
@@ -611,7 +838,7 @@ public class JsHttpClient {
         * @return 状态码
         */
        public int statusCode() {
-            return response.statusCode();
+            return statusCode;
        }
        
        /**
@@ -620,7 +847,7 @@ public class JsHttpClient {
         * @return 头值
         */
        public String header(String name) {
-            return response.getHeader(name);
+            return headers.get(name);
        }
        
        /**
@@ -628,10 +855,9 @@ public class JsHttpClient {
         * @return 响应头Map
         */
        public Map<String, String> headers() {
-            MultiMap responseHeaders = response.headers();
            Map<String, String> result = new HashMap<>();
-            for (String name : responseHeaders.names()) {
-                result.put(name, responseHeaders.get(name));
+            for (String name : headers.names()) {
+                result.put(name, headers.get(name));
            }
            return result;
        }
@@ -649,8 +875,14 @@ public class JsHttpClient {
         * 获取原始响应对象
         * @return HttpResponse对象
         */
+        @Deprecated
        public HttpResponse<Buffer> getOriginalResponse() {
-            return response;
+            if (originalResponse == null) {
+                throw new UnsupportedOperationException(
+                        "流式HTTP客户端不再保留原始Vert.x HttpResponse，请使用statusCode/header/headers/body/bodyBytes方法"
+                );
+            }
+            return originalResponse;
        }
        
        /**
@@ -658,11 +890,8 @@ public class JsHttpClient {
         * @return 响应体字节数组
         */
        public byte[] bodyBytes() {
-            Buffer buffer = response.body();
-            if (buffer == null) {
-                return new byte[0];
-            }
-            return buffer.getBytes();
+            ensureResponseBodyLimit(body);
+            return body.getBytes();
        }
        
        /**
@@ -670,20 +899,46 @@ public class JsHttpClient {
         * @return 响应体大小（字节）
         */
        public long bodySize() {
-            Buffer buffer = response.body();
-            if (buffer == null) {
-                return 0;
-            }
-            return buffer.length();
+            return body.length();
+        }
+
+        public String statusMessage() {
+            return statusMessage;
        }
    }

    /**
-     * 关闭 WebClient 释放连接池资源
+     * 关闭 HttpClient 释放连接池资源
+     * 仅关闭自建的 client（代理模式），共享实例不关闭
     */
    public void close() {
-        if (client != null) {
+        if (!closed.compareAndSet(false, true)) {
+            return;
+        }
+        synchronized (requestLock) {
+            for (HttpClientRequest request : activeRequests) {
+                try {
+                    request.reset();
+                } catch (Exception e) {
+                    log.debug("重置 JavaScript HTTP 请求失败: {}", e.getMessage());
+                }
+            }
+            activeRequests.clear();
+        }
+        if (ownClient && client != null) {
            client.close();
        }
    }
+
+    private static void ensureResponseBodyLimit(Buffer buffer) {
+        if (buffer != null && buffer.length() > MAX_RESPONSE_BODY_BYTES) {
+            throw new IllegalArgumentException("响应体过大: " + buffer.length() + " bytes");
+        }
+    }
+
+    private static void ensureRequestBodyLimit(Buffer buffer) {
+        if (buffer != null && buffer.length() > MAX_REQUEST_BODY_BYTES) {
+            throw new IllegalArgumentException("请求体过大: " + buffer.length() + " bytes");
+        }
+    }
 }
@@ -6,6 +6,7 @@ import cn.qaiu.entity.ShareLinkInfo;
 import cn.qaiu.parser.IPanTool;
 import cn.qaiu.parser.custom.CustomParserConfig;
 import io.vertx.core.Future;
+import io.vertx.core.Promise;
 import io.vertx.core.WorkerExecutor;
 import io.vertx.core.json.JsonObject;
 import org.openjdk.nashorn.api.scripting.NashornScriptEngineFactory;
@@ -20,6 +21,13 @@ import java.io.InputStreamReader;
 import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.concurrent.Callable;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.ScheduledFuture;
+import java.util.concurrent.Semaphore;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.stream.Collectors;

 /**
@@ -35,16 +43,40 @@ public class JsParserExecutor implements IPanTool, AutoCloseable {

    private static volatile WorkerExecutor EXECUTOR;
    private static final Object EXECUTOR_LOCK = new Object();
+    private static volatile boolean executorShutdown = false;

-    private static String FETCH_RUNTIME_JS = null;
+    /** 安全网调度器：当 onComplete 未触发时，延迟强制释放资源 */
+    private static final ScheduledExecutorService CLEANUP_SCHEDULER =
+            Executors.newSingleThreadScheduledExecutor(r -> {
+                Thread t = new Thread(r, "js-parser-cleanup-safety");
+                t.setDaemon(true);
+                return t;
+            });
+    private static final long EXECUTION_TIMEOUT_SECONDS = 30;
+    private static final int MAX_RESULT_STRING_LENGTH = 1024 * 1024;
+    private static final int MAX_FILE_LIST_SIZE = 1000;
+    private static final int MAX_FILE_FIELD_LENGTH = 4096;
+    private static final int MAX_CONCURRENT_EXECUTIONS =
+            Math.max(1, Integer.getInteger("parser.custom.js.maxConcurrentExecutions", 32));
+    private static final Semaphore EXECUTION_PERMITS = new Semaphore(MAX_CONCURRENT_EXECUTIONS);
+
+    private static volatile String FETCH_RUNTIME_JS = null;
    
    private final CustomParserConfig config;
    private final ShareLinkInfo shareLinkInfo;
-    private final ScriptEngine engine;
+    private volatile ScriptEngine engine;
+    private final Object engineLock = new Object();
    private final JsHttpClient httpClient;
    private final JsLogger jsLogger;
    private final JsShareLinkInfoWrapper shareLinkInfoWrapper;
    private final JsFetchBridge fetchBridge;
+    /** 标记是否已释放，防止重复关闭 */
+    private final AtomicBoolean closed = new AtomicBoolean(false);
+    private final Object lifecycleLock = new Object();
+    private volatile boolean running = false;
+    private volatile boolean closeRequested = false;
+    /** 安全网定时任务句柄，正常完成时取消 */
+    private volatile ScheduledFuture<?> safetyCleanupFuture = null;
    
    public JsParserExecutor(ShareLinkInfo shareLinkInfo, CustomParserConfig config) {
        this.config = config;
@@ -60,7 +92,6 @@ public class JsParserExecutor implements IPanTool, AutoCloseable {
        this.jsLogger = new JsLogger("JsParser-" + config.getType());
        this.shareLinkInfoWrapper = new JsShareLinkInfoWrapper(shareLinkInfo);
        this.fetchBridge = new JsFetchBridge(httpClient);
-        this.engine = initEngine();
    }
    
    /**
@@ -112,6 +143,7 @@ public class JsParserExecutor implements IPanTool, AutoCloseable {
            if (engine == null) {
                throw new RuntimeException("无法创建JavaScript引擎，请确保Nashorn可用");
            }
+            this.engine = engine;
            
            // 注入Java对象到JavaScript环境
            engine.put("http", httpClient);
@@ -146,45 +178,124 @@ public class JsParserExecutor implements IPanTool, AutoCloseable {
            throw new RuntimeException("JavaScript引擎初始化失败: " + e.getMessage(), e);
        }
    }
+
+    private ScriptEngine engine() {
+        ScriptEngine current = engine;
+        if (current != null) {
+            return current;
+        }
+        synchronized (engineLock) {
+            if (closed.get()) {
+                throw new IllegalStateException("JavaScript解析器已关闭");
+            }
+            if (engine == null) {
+                engine = initEngine();
+            }
+            return engine;
+        }
+    }
+
+    private void beginExecution() {
+        synchronized (lifecycleLock) {
+            if (closed.get() || closeRequested) {
+                throw new IllegalStateException("JavaScript解析器已关闭");
+            }
+            if (running) {
+                throw new IllegalStateException("JavaScript解析器已在运行");
+            }
+            running = true;
+        }
+    }
+
+    private void finishExecution() {
+        synchronized (lifecycleLock) {
+            running = false;
+            if (closeRequested) {
+                doClose();
+            }
+        }
+    }
    
    /**
     * 释放资源（ScriptEngine 和 HttpClient），避免内存泄漏
+     * 幂等：可安全多次调用
     */
    @Override
    public void close() {
+        synchronized (lifecycleLock) {
+            closeRequested = true;
+            cancelSafetyCleanup();
+            if (running || closed.get()) {
+                closeExternalResources();
+                return;
+            }
+            doClose();
+        }
+    }
+
+    private void doClose() {
+        if (!closed.compareAndSet(false, true)) return;
+        closeRequested = false;
+        closeExternalResources();
+        cleanupEngine();
+    }
+
+    private void closeExternalResources() {
        if (httpClient != null) {
            httpClient.close();
        }
-        // 清除 ScriptEngine 持有的 Java 对象引用，帮助 GC 回收
+    }
+
+    private void cleanupEngine() {
+        // 清除 ScriptEngine 持有的所有引用和内部状态，帮助 GC 回收
        if (engine != null) {
-            engine.put("http", null);
-            engine.put("logger", null);
-            engine.put("shareLinkInfo", null);
-            engine.put("JavaFetch", null);
+            try {
+                engine.put("http", null);
+                engine.put("logger", null);
+                engine.put("shareLinkInfo", null);
+                engine.put("JavaFetch", null);
+                // 彻底清除 ENGINE_SCOPE bindings，释放 JS AST、编译函数、闭包等运行时状态
+                var bindings = engine.getBindings(javax.script.ScriptContext.ENGINE_SCOPE);
+                if (bindings != null) {
+                    bindings.clear();
+                }
+            } catch (Exception e) {
+                log.warn("清理 ScriptEngine bindings 失败: {}", e.getMessage());
+            }
+        }
+    }
+
+    private void cancelSafetyCleanup() {
+        // 取消安全网定时任务（如果正常完成则无需再触发）
+        if (safetyCleanupFuture != null) {
+            safetyCleanupFuture.cancel(false);
+            safetyCleanupFuture = null;
        }
    }

    /**
-     * 关闭全局 WorkerExecutor（应在应用关闭时调用）
+     * 关闭全局 WorkerExecutor 和清理调度器（应在应用关闭时调用）
     */
    public static void shutdownExecutor() {
        synchronized (EXECUTOR_LOCK) {
+            executorShutdown = true;
            if (EXECUTOR != null) {
                EXECUTOR.close();
                EXECUTOR = null;
                log.info("JsParserExecutor WorkerExecutor 已关闭");
            }
        }
+        CLEANUP_SCHEDULER.shutdown();
    }

    /**
     * 获取或创建 WorkerExecutor（懒加载）
     */
    private static WorkerExecutor getExecutor() {
-        if (EXECUTOR != null) {
-            return EXECUTOR;
-        }
        synchronized (EXECUTOR_LOCK) {
+            if (executorShutdown) {
+                throw new IllegalStateException("JavaScript解析器 WorkerExecutor 已关闭");
+            }
            if (EXECUTOR == null) {
                EXECUTOR = WebClientVertxInit.get().createSharedWorkerExecutor("parser-executor", 32);
            }
@@ -192,98 +303,159 @@ public class JsParserExecutor implements IPanTool, AutoCloseable {
        }
    }

+    private <T> Future<T> executeBlockingWithPermit(String operation, Callable<T> blockingCode) {
+        if (!EXECUTION_PERMITS.tryAcquire()) {
+            String message = "JavaScript " + operation + " 执行并发已满，请稍后重试";
+            jsLogger.error(message);
+            close();
+            return Future.failedFuture(message);
+        }
+
+        try {
+            return getExecutor().executeBlocking(() -> {
+                boolean executionStarted = false;
+                try {
+                    beginExecution();
+                    executionStarted = true;
+                    return blockingCode.call();
+                } finally {
+                    if (executionStarted) {
+                        finishExecution();
+                    }
+                    EXECUTION_PERMITS.release();
+                }
+            });
+        } catch (Throwable e) {
+            EXECUTION_PERMITS.release();
+            close();
+            return Future.failedFuture(e);
+        }
+    }
+
+    private <T> Future<T> withTimeout(Future<T> executionFuture, String operation) {
+        Promise<T> promise = Promise.promise();
+        try {
+            safetyCleanupFuture = CLEANUP_SCHEDULER.schedule(() -> {
+                if (promise.tryFail("JavaScript " + operation + " 执行超时（" + EXECUTION_TIMEOUT_SECONDS + "秒）")) {
+                    jsLogger.error("{} 执行超时，已停止外部HTTP资源；ScriptEngine将在执行线程退出后清理", operation);
+                    close();
+                }
+            }, EXECUTION_TIMEOUT_SECONDS, TimeUnit.SECONDS);
+        } catch (Exception e) {
+            log.warn("安全网调度失败: {}", e.getMessage());
+        }
+        executionFuture.onComplete(ar -> {
+            cancelSafetyCleanup();
+            if (ar.succeeded()) {
+                promise.tryComplete(ar.result());
+            } else {
+                promise.tryFail(ar.cause());
+            }
+            close();
+        });
+        return promise.future();
+    }
+
    @Override
    public Future<String> parse() {
        jsLogger.info("开始执行JavaScript解析器: {}", config.getType());
-        
+
        // 使用executeBlocking在工作线程上执行，避免阻塞EventLoop线程
-        return getExecutor().executeBlocking(() -> {
+        Future<String> executionFuture = executeBlockingWithPermit("parse", () -> {
+            ScriptEngine engine = engine();
            // 直接调用全局parse函数
            Object parseFunction = engine.get("parse");
            if (parseFunction == null) {
                throw new RuntimeException("JavaScript代码中未找到parse函数");
            }
-            
+
            if (parseFunction instanceof ScriptObjectMirror parseMirror) {

                Object result = parseMirror.call(null, shareLinkInfoWrapper, httpClient, jsLogger);
-                
+
                if (result instanceof String) {
-                    jsLogger.info("解析成功: {}", result);
-                    return (String) result;
+                    String resultText = limitResultString((String) result, "parse");
+                    jsLogger.info("解析成功，结果长度: {}", resultText.length());
+                    return resultText;
                } else {
-                    jsLogger.error("parse方法返回值类型错误，期望String，实际: {}", 
+                    jsLogger.error("parse方法返回值类型错误，期望String，实际: {}",
                            result != null ? result.getClass().getSimpleName() : "null");
                    throw new RuntimeException("parse方法返回值类型错误");
                }
            } else {
                throw new RuntimeException("parse函数类型错误");
            }
-        }).onComplete(ar -> close());
+        });
+        return withTimeout(executionFuture, "parse");
    }
    
    @Override
    public Future<List<FileInfo>> parseFileList() {
        jsLogger.info("开始执行JavaScript文件列表解析: {}", config.getType());
-        
+
        // 使用executeBlocking在工作线程上执行，避免阻塞EventLoop线程
-        return getExecutor().executeBlocking(() -> {
+        Future<List<FileInfo>> executionFuture = executeBlockingWithPermit("parseFileList", () -> {
+            ScriptEngine engine = engine();
            // 直接调用全局parseFileList函数
            Object parseFileListFunction = engine.get("parseFileList");
            if (parseFileListFunction == null) {
                throw new RuntimeException("JavaScript代码中未找到parseFileList函数");
            }
-            
+
            // 调用parseFileList方法
            if (parseFileListFunction instanceof ScriptObjectMirror parseFileListMirror) {

                Object result = parseFileListMirror.call(null, shareLinkInfoWrapper, httpClient, jsLogger);
-                
+
                if (result instanceof ScriptObjectMirror resultMirror) {
                    List<FileInfo> fileList = convertToFileInfoList(resultMirror);
-                    
+
                    jsLogger.info("文件列表解析成功，共 {} 个文件", fileList.size());
                    return fileList;
                } else {
-                    jsLogger.error("parseFileList方法返回值类型错误，期望数组，实际: {}", 
+                    jsLogger.error("parseFileList方法返回值类型错误，期望数组，实际: {}",
                            result != null ? result.getClass().getSimpleName() : "null");
                    throw new RuntimeException("parseFileList方法返回值类型错误");
                }
            } else {
                throw new RuntimeException("parseFileList函数类型错误");
            }
-        }).onComplete(ar -> close());
+        });
+        return withTimeout(executionFuture, "parseFileList");
    }
    
    @Override
    public Future<String> parseById() {
        jsLogger.info("开始执行JavaScript按ID解析: {}", config.getType());
-        
+
        // 使用executeBlocking在工作线程上执行，避免阻塞EventLoop线程
-        return getExecutor().executeBlocking(() -> {
+        Future<String> executionFuture = executeBlockingWithPermit("parseById", () -> {
+            ScriptEngine engine = engine();
            // 直接调用全局parseById函数
            Object parseByIdFunction = engine.get("parseById");
            if (parseByIdFunction == null) {
                throw new RuntimeException("JavaScript代码中未找到parseById函数");
            }
-            
+
            // 调用parseById方法
            if (parseByIdFunction instanceof ScriptObjectMirror parseByIdMirror) {

                Object result = parseByIdMirror.call(null, shareLinkInfoWrapper, httpClient, jsLogger);
-                
+
                if (result instanceof String) {
-                    jsLogger.info("按ID解析成功: {}", result);
-                    return (String) result;
+                    String resultText = limitResultString((String) result, "parseById");
+                    jsLogger.info("按ID解析成功，结果长度: {}", resultText.length());
+                    return resultText;
                } else {
-                    jsLogger.error("parseById方法返回值类型错误，期望String，实际: {}", 
+                    jsLogger.error("parseById方法返回值类型错误，期望String，实际: {}",
                            result != null ? result.getClass().getSimpleName() : "null");
                    throw new RuntimeException("parseById方法返回值类型错误");
                }
            } else {
                throw new RuntimeException("parseById函数类型错误");
            }
-        }).onComplete(ar -> close());
+        });
+        return withTimeout(executionFuture, "parseById");
    }
    
    /**
@@ -293,6 +465,9 @@ public class JsParserExecutor implements IPanTool, AutoCloseable {
        List<FileInfo> fileList = new ArrayList<>();
        
        if (resultMirror.isArray()) {
+            if (resultMirror.size() > MAX_FILE_LIST_SIZE) {
+                throw new RuntimeException("文件列表数量超过限制: " + resultMirror.size());
+            }
            for (int i = 0; i < resultMirror.size(); i++) {
                Object item = resultMirror.get(String.valueOf(i));
                if (item instanceof ScriptObjectMirror) {
@@ -316,13 +491,13 @@ public class JsParserExecutor implements IPanTool, AutoCloseable {
            
            // 设置基本字段
            if (itemMirror.hasMember("fileName")) {
-                fileInfo.setFileName(itemMirror.getMember("fileName").toString());
+                fileInfo.setFileName(limitField(itemMirror.getMember("fileName")));
            }
            if (itemMirror.hasMember("fileId")) {
-                fileInfo.setFileId(itemMirror.getMember("fileId").toString());
+                fileInfo.setFileId(limitField(itemMirror.getMember("fileId")));
            }
            if (itemMirror.hasMember("fileType")) {
-                fileInfo.setFileType(itemMirror.getMember("fileType").toString());
+                fileInfo.setFileType(limitField(itemMirror.getMember("fileType")));
            }
            if (itemMirror.hasMember("size")) {
                Object size = itemMirror.getMember("size");
@@ -331,16 +506,16 @@ public class JsParserExecutor implements IPanTool, AutoCloseable {
                }
            }
            if (itemMirror.hasMember("sizeStr")) {
-                fileInfo.setSizeStr(itemMirror.getMember("sizeStr").toString());
+                fileInfo.setSizeStr(limitField(itemMirror.getMember("sizeStr")));
            }
            if (itemMirror.hasMember("createTime")) {
-                fileInfo.setCreateTime(itemMirror.getMember("createTime").toString());
+                fileInfo.setCreateTime(limitField(itemMirror.getMember("createTime")));
            }
            if (itemMirror.hasMember("updateTime")) {
-                fileInfo.setUpdateTime(itemMirror.getMember("updateTime").toString());
+                fileInfo.setUpdateTime(limitField(itemMirror.getMember("updateTime")));
            }
            if (itemMirror.hasMember("createBy")) {
-                fileInfo.setCreateBy(itemMirror.getMember("createBy").toString());
+                fileInfo.setCreateBy(limitField(itemMirror.getMember("createBy")));
            }
            if (itemMirror.hasMember("downloadCount")) {
                Object downloadCount = itemMirror.getMember("downloadCount");
@@ -349,16 +524,16 @@ public class JsParserExecutor implements IPanTool, AutoCloseable {
                }
            }
            if (itemMirror.hasMember("fileIcon")) {
-                fileInfo.setFileIcon(itemMirror.getMember("fileIcon").toString());
+                fileInfo.setFileIcon(limitField(itemMirror.getMember("fileIcon")));
            }
            if (itemMirror.hasMember("panType")) {
-                fileInfo.setPanType(itemMirror.getMember("panType").toString());
+                fileInfo.setPanType(limitField(itemMirror.getMember("panType")));
            }
            if (itemMirror.hasMember("parserUrl")) {
-                fileInfo.setParserUrl(itemMirror.getMember("parserUrl").toString());
+                fileInfo.setParserUrl(limitField(itemMirror.getMember("parserUrl")));
            }
            if (itemMirror.hasMember("previewUrl")) {
-                fileInfo.setPreviewUrl(itemMirror.getMember("previewUrl").toString());
+                fileInfo.setPreviewUrl(limitField(itemMirror.getMember("previewUrl")));
            }
            
            return fileInfo;
@@ -368,4 +543,22 @@ public class JsParserExecutor implements IPanTool, AutoCloseable {
            return null;
        }
    }
+
+    private static String limitResultString(String value, String operation) {
+        if (value.length() > MAX_RESULT_STRING_LENGTH) {
+            throw new RuntimeException(operation + " 返回结果过大: " + value.length() + " 字符");
+        }
+        return value;
+    }
+
+    private static String limitField(Object value) {
+        if (value == null) {
+            return null;
+        }
+        String text = value.toString();
+        if (text.length() > MAX_FILE_FIELD_LENGTH) {
+            throw new RuntimeException("文件字段过长: " + text.length() + " 字符");
+        }
+        return text;
+    }
 }
@@ -21,20 +21,37 @@ import java.util.concurrent.*;
 *
 * @author <a href="https://qaiu.top">QAIU</a>
 */
-public class JsPlaygroundExecutor {
+public class JsPlaygroundExecutor implements AutoCloseable {
    
    private static final Logger log = LoggerFactory.getLogger(JsPlaygroundExecutor.class);
    
    // JavaScript执行超时时间（秒）
    private static final long EXECUTION_TIMEOUT_SECONDS = 30;
+    private static final int MAX_RESULT_STRING_LENGTH = 1024 * 1024;
+    private static final int MAX_FILE_LIST_SIZE = 1000;
+    private static final int MAX_FILE_FIELD_LENGTH = 4096;
+    private static final int TIMEOUT_LOG_RETAIN = 50;
    
-    // 使用独立的线程池，不受Vert.x的BlockedThreadChecker监控
-    private static final ExecutorService INDEPENDENT_EXECUTOR = Executors.newCachedThreadPool(r -> {
-        Thread thread = new Thread(r);
-        thread.setName("playground-independent-" + System.currentTimeMillis());
-        thread.setDaemon(true); // 设置为守护线程，服务关闭时自动清理
-        return thread;
-    });
+    // 使用有界线程池，防止线程无限增长导致内存溢出
+    private static final int POOL_MAX_THREADS = 16;
+    private static final int POOL_QUEUE_CAPACITY = 256;
+    private static final ExecutorService INDEPENDENT_EXECUTOR = new ThreadPoolExecutor(
+            4, POOL_MAX_THREADS, 60L, TimeUnit.SECONDS,
+            new ArrayBlockingQueue<>(POOL_QUEUE_CAPACITY),
+            r -> {
+                Thread thread = new Thread(r);
+                thread.setName("playground-independent-" + thread.getId());
+                thread.setDaemon(true);
+                return thread;
+            },
+            (r, executor) -> {
+                // 拒绝策略：记录日志并抛出异常，避免阻塞 Vert.x EventLoop
+                log.warn("演练场线程池已满，拒绝任务。活跃线程: {}, 队列大小: {}",
+                        ((ThreadPoolExecutor) executor).getActiveCount(),
+                        ((ThreadPoolExecutor) executor).getQueue().size());
+                throw new java.util.concurrent.RejectedExecutionException("演练场线程池已满，请稍后重试");
+            }
+    );
    
    // 超时调度线程池，用于处理超时中断
    private static final ScheduledExecutorService TIMEOUT_SCHEDULER = Executors.newScheduledThreadPool(2, r -> {
@@ -43,14 +60,29 @@ public class JsPlaygroundExecutor {
        thread.setDaemon(true);
        return thread;
    });
+
+    /**
+     * 关闭静态线程池（应在应用关闭时调用）
+     */
+    public static void shutdownPools() {
+        INDEPENDENT_EXECUTOR.shutdown();
+        TIMEOUT_SCHEDULER.shutdown();
+        log.info("JsPlaygroundExecutor 线程池已关闭");
+    }
    
    private final ShareLinkInfo shareLinkInfo;
    private final String jsCode;
-    private final ScriptEngine engine;
+    private volatile ScriptEngine engine;
+    private final Object engineLock = new Object();
    private final JsHttpClient httpClient;
    private final JsPlaygroundLogger playgroundLogger;
    private final JsShareLinkInfoWrapper shareLinkInfoWrapper;
    private final JsFetchBridge fetchBridge;
+    /** 标记是否已释放，防止重复关闭 */
+    private volatile boolean closed = false;
+    private final Object lifecycleLock = new Object();
+    private volatile boolean running = false;
+    private volatile boolean closeRequested = false;
    
    /**
     * 创建演练场执行器
@@ -72,7 +104,6 @@ public class JsPlaygroundExecutor {
        this.playgroundLogger = new JsPlaygroundLogger();
        this.shareLinkInfoWrapper = new JsShareLinkInfoWrapper(shareLinkInfo);
        this.fetchBridge = new JsFetchBridge(httpClient);
-        this.engine = initEngine();
    }
    
    /**
@@ -89,6 +120,7 @@ public class JsPlaygroundExecutor {
            if (engine == null) {
                throw new RuntimeException("无法创建JavaScript引擎，请确保Nashorn可用");
            }
+            this.engine = engine;
            
            // 注入Java对象到JavaScript环境
            engine.put("http", httpClient);
@@ -133,9 +165,14 @@ public class JsPlaygroundExecutor {
     */
    public Future<String> executeParseAsync() {
        Promise<String> promise = Promise.promise();
-        
-        // 使用独立的ExecutorService执行，避免Vert.x的BlockedThreadChecker输出警告
-        CompletableFuture<String> executionFuture = CompletableFuture.supplyAsync(() -> {
+
+        final CompletableFuture<String> executionFuture;
+        try {
+            // 使用独立的ExecutorService执行，避免Vert.x的BlockedThreadChecker输出警告
+            executionFuture = CompletableFuture.supplyAsync(() -> {
+            beginExecution();
+            try {
+            ScriptEngine engine = engine();
            playgroundLogger.infoJava("开始执行parse方法");
            try {
                Object parseFunction = engine.get("parse");
@@ -151,8 +188,9 @@ public class JsPlaygroundExecutor {
                    log.debug("[JsPlaygroundExecutor] parse函数执行完成，当前日志数量: {}", playgroundLogger.size());
                    
                    if (result instanceof String) {
-                        playgroundLogger.infoJava("解析成功，返回结果: " + result);
-                        return (String) result;
+                        String resultText = limitResultString((String) result, "parse");
+                        playgroundLogger.infoJava("解析成功，返回结果长度: " + resultText.length());
+                        return resultText;
                    } else {
                        String errorMsg = "parse方法返回值类型错误，期望String，实际: " + 
                                (result != null ? result.getClass().getSimpleName() : "null");
@@ -167,25 +205,27 @@ public class JsPlaygroundExecutor {
                playgroundLogger.errorJava("执行parse方法失败: " + e.getMessage(), e);
                throw new RuntimeException(e);
            }
-        }, INDEPENDENT_EXECUTOR);
-        
-        // 创建超时任务，强制取消执行
-        ScheduledFuture<?> timeoutTask = TIMEOUT_SCHEDULER.schedule(() -> {
-            if (!executionFuture.isDone()) {
-                executionFuture.cancel(true);  // 强制中断执行线程
-                playgroundLogger.errorJava("执行超时，已强制中断");
-                log.warn("JavaScript执行超时，已强制取消");
+            } finally {
+                finishExecution();
            }
-        }, EXECUTION_TIMEOUT_SECONDS, TimeUnit.SECONDS);
-        
+        }, INDEPENDENT_EXECUTOR);
+        } catch (java.util.concurrent.RejectedExecutionException e) {
+            log.warn("演练场线程池已满，任务被拒绝");
+            close(); // 释放已创建的 ScriptEngine 和 HttpClient 资源
+            promise.fail(new RuntimeException("演练场线程池已满，请稍后重试", e));
+            return promise.future();
+        }
+
+        ScheduledFuture<?> timeoutTask = scheduleTimeout(executionFuture, "parse");
+
        // 处理执行结果
        executionFuture.whenComplete((result, error) -> {
            // 取消超时任务
            timeoutTask.cancel(false);
-            
+
                if (error != null) {
                if (error instanceof CancellationException) {
-                    String timeoutMsg = "JavaScript执行超时（超过" + EXECUTION_TIMEOUT_SECONDS + "秒），已强制中断";
+                    String timeoutMsg = "JavaScript执行超时（超过" + EXECUTION_TIMEOUT_SECONDS + "秒），已返回超时并停止外部HTTP资源；ScriptEngine将在执行线程退出后清理";
                        playgroundLogger.errorJava(timeoutMsg);
                        log.error(timeoutMsg);
                        promise.fail(new RuntimeException(timeoutMsg));
@@ -197,10 +237,10 @@ public class JsPlaygroundExecutor {
                    promise.complete(result);
                }
            });
-        
+
        return promise.future();
    }
-    
+
    /**
     * 执行parseFileList方法（异步，带超时控制）
     * 使用独立线程池，不受Vert.x BlockedThreadChecker监控
@@ -209,9 +249,14 @@ public class JsPlaygroundExecutor {
     */
    public Future<List<FileInfo>> executeParseFileListAsync() {
        Promise<List<FileInfo>> promise = Promise.promise();
-        
-        // 使用独立的ExecutorService执行，避免Vert.x的BlockedThreadChecker输出警告
-        CompletableFuture<List<FileInfo>> executionFuture = CompletableFuture.supplyAsync(() -> {
+
+        final CompletableFuture<List<FileInfo>> executionFuture;
+        try {
+            // 使用独立的ExecutorService执行，避免Vert.x的BlockedThreadChecker输出警告
+            executionFuture = CompletableFuture.supplyAsync(() -> {
+            beginExecution();
+            try {
+            ScriptEngine engine = engine();
            playgroundLogger.infoJava("开始执行parseFileList方法");
            try {
                Object parseFileListFunction = engine.get("parseFileList");
@@ -242,25 +287,27 @@ public class JsPlaygroundExecutor {
                playgroundLogger.errorJava("执行parseFileList方法失败: " + e.getMessage(), e);
                throw new RuntimeException(e);
            }
-        }, INDEPENDENT_EXECUTOR);
-        
-        // 创建超时任务，强制取消执行
-        ScheduledFuture<?> timeoutTask = TIMEOUT_SCHEDULER.schedule(() -> {
-            if (!executionFuture.isDone()) {
-                executionFuture.cancel(true);  // 强制中断执行线程
-                playgroundLogger.errorJava("执行超时，已强制中断");
-                log.warn("JavaScript执行超时，已强制取消");
+            } finally {
+                finishExecution();
            }
-        }, EXECUTION_TIMEOUT_SECONDS, TimeUnit.SECONDS);
-        
+        }, INDEPENDENT_EXECUTOR);
+        } catch (java.util.concurrent.RejectedExecutionException e) {
+            log.warn("演练场线程池已满，任务被拒绝");
+            close(); // 释放已创建的 ScriptEngine 和 HttpClient 资源
+            promise.fail(new RuntimeException("演练场线程池已满，请稍后重试", e));
+            return promise.future();
+        }
+
+        ScheduledFuture<?> timeoutTask = scheduleTimeout(executionFuture, "parseFileList");
+
        // 处理执行结果
        executionFuture.whenComplete((result, error) -> {
            // 取消超时任务
            timeoutTask.cancel(false);
-            
+
                if (error != null) {
                if (error instanceof CancellationException) {
-                    String timeoutMsg = "JavaScript执行超时（超过" + EXECUTION_TIMEOUT_SECONDS + "秒），已强制中断";
+                    String timeoutMsg = "JavaScript执行超时（超过" + EXECUTION_TIMEOUT_SECONDS + "秒），已返回超时并停止外部HTTP资源；ScriptEngine将在执行线程退出后清理";
                        playgroundLogger.errorJava(timeoutMsg);
                        log.error(timeoutMsg);
                        promise.fail(new RuntimeException(timeoutMsg));
@@ -272,10 +319,10 @@ public class JsPlaygroundExecutor {
                    promise.complete(result);
                }
            });
-        
+
        return promise.future();
    }
-    
+
    /**
     * 执行parseById方法（异步，带超时控制）
     * 使用独立线程池，不受Vert.x BlockedThreadChecker监控
@@ -284,9 +331,14 @@ public class JsPlaygroundExecutor {
     */
    public Future<String> executeParseByIdAsync() {
        Promise<String> promise = Promise.promise();
-        
-        // 使用独立的ExecutorService执行，避免Vert.x的BlockedThreadChecker输出警告
-        CompletableFuture<String> executionFuture = CompletableFuture.supplyAsync(() -> {
+
+        final CompletableFuture<String> executionFuture;
+        try {
+            // 使用独立的ExecutorService执行，避免Vert.x的BlockedThreadChecker输出警告
+            executionFuture = CompletableFuture.supplyAsync(() -> {
+            beginExecution();
+            try {
+            ScriptEngine engine = engine();
            playgroundLogger.infoJava("开始执行parseById方法");
            try {
                Object parseByIdFunction = engine.get("parseById");
@@ -300,8 +352,9 @@ public class JsPlaygroundExecutor {
                    Object result = parseByIdMirror.call(null, shareLinkInfoWrapper, httpClient, playgroundLogger);
                    
                    if (result instanceof String) {
-                        playgroundLogger.infoJava("按ID解析成功: " + result);
-                        return (String) result;
+                        String resultText = limitResultString((String) result, "parseById");
+                        playgroundLogger.infoJava("按ID解析成功，返回结果长度: " + resultText.length());
+                        return resultText;
                    } else {
                        String errorMsg = "parseById方法返回值类型错误，期望String，实际: " + 
                                (result != null ? result.getClass().getSimpleName() : "null");
@@ -316,25 +369,27 @@ public class JsPlaygroundExecutor {
                playgroundLogger.errorJava("执行parseById方法失败: " + e.getMessage(), e);
                throw new RuntimeException(e);
            }
-        }, INDEPENDENT_EXECUTOR);
-        
-        // 创建超时任务，强制取消执行
-        ScheduledFuture<?> timeoutTask = TIMEOUT_SCHEDULER.schedule(() -> {
-            if (!executionFuture.isDone()) {
-                executionFuture.cancel(true);  // 强制中断执行线程
-                playgroundLogger.errorJava("执行超时，已强制中断");
-                log.warn("JavaScript执行超时，已强制取消");
+            } finally {
+                finishExecution();
            }
-        }, EXECUTION_TIMEOUT_SECONDS, TimeUnit.SECONDS);
-        
+        }, INDEPENDENT_EXECUTOR);
+        } catch (java.util.concurrent.RejectedExecutionException e) {
+            log.warn("演练场线程池已满，任务被拒绝");
+            close(); // 释放已创建的 ScriptEngine 和 HttpClient 资源
+            promise.fail(new RuntimeException("演练场线程池已满，请稍后重试", e));
+            return promise.future();
+        }
+
+        ScheduledFuture<?> timeoutTask = scheduleTimeout(executionFuture, "parseById");
+
        // 处理执行结果
        executionFuture.whenComplete((result, error) -> {
            // 取消超时任务
            timeoutTask.cancel(false);
-            
+
                if (error != null) {
                if (error instanceof CancellationException) {
-                    String timeoutMsg = "JavaScript执行超时（超过" + EXECUTION_TIMEOUT_SECONDS + "秒），已强制中断";
+                    String timeoutMsg = "JavaScript执行超时（超过" + EXECUTION_TIMEOUT_SECONDS + "秒），已返回超时并停止外部HTTP资源；ScriptEngine将在执行线程退出后清理";
                        playgroundLogger.errorJava(timeoutMsg);
                        log.error(timeoutMsg);
                        promise.fail(new RuntimeException(timeoutMsg));
@@ -346,7 +401,7 @@ public class JsPlaygroundExecutor {
                    promise.complete(result);
                }
            });
-        
+
        return promise.future();
    }
    
@@ -373,6 +428,9 @@ public class JsPlaygroundExecutor {
        List<FileInfo> fileList = new ArrayList<>();
        
        if (resultMirror.isArray()) {
+            if (resultMirror.size() > MAX_FILE_LIST_SIZE) {
+                throw new RuntimeException("文件列表数量超过限制: " + resultMirror.size());
+            }
            for (int i = 0; i < resultMirror.size(); i++) {
                Object item = resultMirror.get(String.valueOf(i));
                if (item instanceof ScriptObjectMirror) {
@@ -396,13 +454,13 @@ public class JsPlaygroundExecutor {
            
            // 设置基本字段
            if (itemMirror.hasMember("fileName")) {
-                fileInfo.setFileName(itemMirror.getMember("fileName").toString());
+                fileInfo.setFileName(limitField(itemMirror.getMember("fileName")));
            }
            if (itemMirror.hasMember("fileId")) {
-                fileInfo.setFileId(itemMirror.getMember("fileId").toString());
+                fileInfo.setFileId(limitField(itemMirror.getMember("fileId")));
            }
            if (itemMirror.hasMember("fileType")) {
-                fileInfo.setFileType(itemMirror.getMember("fileType").toString());
+                fileInfo.setFileType(limitField(itemMirror.getMember("fileType")));
            }
            if (itemMirror.hasMember("size")) {
                Object size = itemMirror.getMember("size");
@@ -411,16 +469,16 @@ public class JsPlaygroundExecutor {
                }
            }
            if (itemMirror.hasMember("sizeStr")) {
-                fileInfo.setSizeStr(itemMirror.getMember("sizeStr").toString());
+                fileInfo.setSizeStr(limitField(itemMirror.getMember("sizeStr")));
            }
            if (itemMirror.hasMember("createTime")) {
-                fileInfo.setCreateTime(itemMirror.getMember("createTime").toString());
+                fileInfo.setCreateTime(limitField(itemMirror.getMember("createTime")));
            }
            if (itemMirror.hasMember("updateTime")) {
-                fileInfo.setUpdateTime(itemMirror.getMember("updateTime").toString());
+                fileInfo.setUpdateTime(limitField(itemMirror.getMember("updateTime")));
            }
            if (itemMirror.hasMember("createBy")) {
-                fileInfo.setCreateBy(itemMirror.getMember("createBy").toString());
+                fileInfo.setCreateBy(limitField(itemMirror.getMember("createBy")));
            }
            if (itemMirror.hasMember("downloadCount")) {
                Object downloadCount = itemMirror.getMember("downloadCount");
@@ -429,24 +487,154 @@ public class JsPlaygroundExecutor {
                }
            }
            if (itemMirror.hasMember("fileIcon")) {
-                fileInfo.setFileIcon(itemMirror.getMember("fileIcon").toString());
+                fileInfo.setFileIcon(limitField(itemMirror.getMember("fileIcon")));
            }
            if (itemMirror.hasMember("panType")) {
-                fileInfo.setPanType(itemMirror.getMember("panType").toString());
+                fileInfo.setPanType(limitField(itemMirror.getMember("panType")));
            }
            if (itemMirror.hasMember("parserUrl")) {
-                fileInfo.setParserUrl(itemMirror.getMember("parserUrl").toString());
+                fileInfo.setParserUrl(limitField(itemMirror.getMember("parserUrl")));
            }
            if (itemMirror.hasMember("previewUrl")) {
-                fileInfo.setPreviewUrl(itemMirror.getMember("previewUrl").toString());
+                fileInfo.setPreviewUrl(limitField(itemMirror.getMember("previewUrl")));
            }
            
            return fileInfo;
-            
+
        } catch (Exception e) {
            playgroundLogger.errorJava("转换FileInfo对象失败", e);
            return null;
        }
    }
+
+    private static String limitResultString(String value, String operation) {
+        if (value.length() > MAX_RESULT_STRING_LENGTH) {
+            throw new RuntimeException(operation + " 返回结果过大: " + value.length() + " 字符");
+        }
+        return value;
+    }
+
+    private static String limitField(Object value) {
+        if (value == null) {
+            return null;
+        }
+        String text = value.toString();
+        if (text.length() > MAX_FILE_FIELD_LENGTH) {
+            throw new RuntimeException("文件字段过长: " + text.length() + " 字符");
+        }
+        return text;
+    }
+
+    private void beginExecution() {
+        synchronized (lifecycleLock) {
+            if (closed) {
+                throw new CancellationException("演练场执行器已关闭");
+            }
+            if (running) {
+                throw new IllegalStateException("演练场执行器已在运行");
+            }
+            running = true;
+        }
+    }
+
+    private ScriptEngine engine() {
+        ScriptEngine current = engine;
+        if (current != null) {
+            return current;
+        }
+        synchronized (engineLock) {
+            if (closed) {
+                throw new CancellationException("演练场执行器已关闭");
+            }
+            if (engine == null) {
+                engine = initEngine();
+            }
+            return engine;
+        }
+    }
+
+    private void finishExecution() {
+        synchronized (lifecycleLock) {
+            running = false;
+            if (closeRequested) {
+                doClose();
+            }
+        }
+    }
+
+    private ScheduledFuture<?> scheduleTimeout(CompletableFuture<?> executionFuture, String operation) {
+        // cancel(true) 只能请求中断，Nashorn 死循环不保证立即停止。
+        return TIMEOUT_SCHEDULER.schedule(() -> {
+            if (!executionFuture.isDone()) {
+                executionFuture.cancel(true);
+                playgroundLogger.errorJava(operation + " 执行超时，已请求取消并停止外部HTTP资源");
+                forceCloseAfterTimeout();
+                log.warn("JavaScript {} 执行超时，已请求取消；Nashorn长循环可能继续占用线程，ScriptEngine将在执行线程退出后清理", operation);
+            }
+        }, EXECUTION_TIMEOUT_SECONDS, TimeUnit.SECONDS);
+    }
+
+    private void forceCloseAfterTimeout() {
+        synchronized (lifecycleLock) {
+            closeRequested = true;
+            if (running || closed) {
+                closeExternalResources();
+            } else {
+                doClose();
+            }
+        }
+        playgroundLogger.trimToLast(TIMEOUT_LOG_RETAIN);
+    }
+
+    /**
+     * 释放资源（HttpClient 和 ScriptEngine），避免内存泄漏
+     * 幂等：可安全多次调用
+     */
+    @Override
+    public void close() {
+        synchronized (lifecycleLock) {
+            closeRequested = true;
+            if (running || closed) {
+                closeExternalResources();
+                return;
+            }
+            doClose();
+        }
+    }
+
+    private void doClose() {
+        if (closed) return;
+        closed = true;
+        closeRequested = false;
+        closeExternalResources();
+        cleanupEngine();
+        log.debug("JsPlaygroundExecutor 资源已释放");
+    }
+
+    private void closeExternalResources() {
+        if (httpClient != null) {
+            httpClient.close();
+        }
+    }
+
+    private void cleanupEngine() {
+        // 清除 ScriptEngine 的所有 bindings，释放 JS 运行时引用
+        if (engine != null) {
+            try {
+                // 清除注入的 Java 对象引用
+                engine.put("http", null);
+                engine.put("logger", null);
+                engine.put("shareLinkInfo", null);
+                engine.put("JavaFetch", null);
+                // 清除所有 ENGINE_SCOPE bindings，包括 eval 加载的 JS 函数
+                var bindings = engine.getBindings(javax.script.ScriptContext.ENGINE_SCOPE);
+                if (bindings != null) {
+                    bindings.clear();
+                }
+            } catch (Exception e) {
+                log.warn("清理 ScriptEngine bindings 失败: {}", e.getMessage());
+            }
+        }
+    }
 }

@@ -20,6 +20,7 @@ public class JsPlaygroundLogger {

    // 使用线程安全的列表
    private static final int MAX_LOG_SIZE = 1000;
+    private static final int MAX_LOG_MESSAGE_LENGTH = 4096;
    private final List<LogEntry> logs = Collections.synchronizedList(new ArrayList<>());
    
    /**
@@ -62,7 +63,11 @@ public class JsPlaygroundLogger {
        if (obj == null) {
            return "null";
        }
-        return obj.toString();
+        String msg = obj.toString();
+        if (msg.length() <= MAX_LOG_MESSAGE_LENGTH) {
+            return msg;
+        }
+        return msg.substring(0, MAX_LOG_MESSAGE_LENGTH) + "...[truncated]";
    }
    
    /**
@@ -127,7 +132,7 @@ public class JsPlaygroundLogger {
    public void error(Object message, Throwable throwable) {
        String msg = toString(message);
        if (throwable != null) {
-            msg = msg + ": " + throwable.getMessage();
+            msg = toString(msg + ": " + throwable.getMessage());
        }
        addLog(new LogEntry("ERROR", msg, "JS"));
        log.debug("[JSPlaygroundLogger] ERROR: {}", msg);
@@ -167,9 +172,9 @@ public class JsPlaygroundLogger {
     * 错误日志（带异常，供Java层调用）
     */
    public void errorJava(String message, Throwable throwable) {
-        String msg = message;
+        String msg = toString(message);
        if (throwable != null) {
-            msg = msg + ": " + throwable.getMessage();
+            msg = toString(msg + ": " + throwable.getMessage());
        }
        addLog(new LogEntry("ERROR", msg, "JAVA"));
        log.debug("[JAVAPlaygroundLogger] ERROR: {}", msg);
@@ -197,4 +202,17 @@ public class JsPlaygroundLogger {
    public void clear() {
        logs.clear();
    }
+
+    public void trimToLast(int maxEntries) {
+        if (maxEntries < 0) {
+            throw new IllegalArgumentException("maxEntries不能小于0");
+        }
+        synchronized (logs) {
+            int removeCount = logs.size() - maxEntries;
+            if (removeCount <= 0) {
+                return;
+            }
+            logs.subList(0, removeCount).clear();
+        }
+    }
 }
@@ -31,6 +31,8 @@ public class JsScriptLoader {
    
    private static final String RESOURCE_PATH = "custom-parsers";
    private static final String EXTERNAL_PATH = "./custom-parsers";
+    private static final long MAX_SCRIPT_SIZE_BYTES = 128 * 1024;
+    private static final int MAX_EXTERNAL_SCRIPT_COUNT = 100;
    
    // 系统属性配置的外部目录路径
    private static final String EXTERNAL_PATH_PROPERTY = "parser.custom-parsers.path";
@@ -81,14 +83,16 @@ public class JsScriptLoader {
                try {
                    InputStream inputStream = JsScriptLoader.class.getClassLoader()
                            .getResourceAsStream(resourceFile);
-                    
+
                    if (inputStream != null) {
-                        String jsCode = new String(inputStream.readAllBytes(), StandardCharsets.UTF_8);
-                        CustomParserConfig config = JsScriptMetadataParser.parseScript(jsCode);
-                        configs.add(config);
-                        
-                        String fileName = resourceFile.substring(resourceFile.lastIndexOf('/') + 1);
-                        log.debug("从资源目录加载脚本: {}", fileName);
+                        try (inputStream) {
+                            String jsCode = readResourceScript(inputStream, resourceFile);
+                            CustomParserConfig config = JsScriptMetadataParser.parseScript(jsCode);
+                            configs.add(config);
+
+                            String fileName = resourceFile.substring(resourceFile.lastIndexOf('/') + 1);
+                            log.debug("从资源目录加载脚本: {}", fileName);
+                        }
                    }
                } catch (Exception e) {
                    log.warn("加载资源脚本失败: {}", resourceFile, e);
@@ -207,8 +211,10 @@ public class JsScriptLoader {
                paths.filter(Files::isRegularFile)
                        .filter(path -> path.toString().endsWith(".js"))
                        .filter(path -> !isExcludedFile(path.getFileName().toString()))
+                        .limit(MAX_EXTERNAL_SCRIPT_COUNT)
                        .forEach(path -> {
                            try {
+                                ensureScriptSize(path);
                                String jsCode = Files.readString(path, StandardCharsets.UTF_8);
                                CustomParserConfig config = JsScriptMetadataParser.parseScript(jsCode);
                                configs.add(config);
@@ -262,6 +268,7 @@ public class JsScriptLoader {
                throw new IllegalArgumentException("文件不存在: " + filePath);
            }
            
+            ensureScriptSize(path);
            String jsCode = Files.readString(path, StandardCharsets.UTF_8);
            return JsScriptMetadataParser.parseScript(jsCode);
            
@@ -279,14 +286,16 @@ public class JsScriptLoader {
        try {
            InputStream inputStream = JsScriptLoader.class.getClassLoader()
                    .getResourceAsStream(resourcePath);
-            
+
            if (inputStream == null) {
                throw new IllegalArgumentException("资源文件不存在: " + resourcePath);
            }
-            
-            String jsCode = new String(inputStream.readAllBytes(), StandardCharsets.UTF_8);
-            return JsScriptMetadataParser.parseScript(jsCode);
-            
+
+            try (inputStream) {
+                String jsCode = readResourceScript(inputStream, resourcePath);
+                return JsScriptMetadataParser.parseScript(jsCode);
+            }
+
        } catch (IOException e) {
            throw new RuntimeException("读取资源文件失败: " + resourcePath, e);
        }
@@ -346,4 +355,19 @@ public class JsScriptLoader {
               fileName.contains(".test.") ||
               fileName.contains(".spec.");
    }
+
+    private static void ensureScriptSize(Path path) throws IOException {
+        long size = Files.size(path);
+        if (size > MAX_SCRIPT_SIZE_BYTES) {
+            throw new IllegalArgumentException("JavaScript脚本超过128KB限制: " + path.getFileName());
+        }
+    }
+
+    private static String readResourceScript(InputStream inputStream, String name) throws IOException {
+        byte[] bytes = inputStream.readNBytes((int) MAX_SCRIPT_SIZE_BYTES + 1);
+        if (bytes.length > MAX_SCRIPT_SIZE_BYTES) {
+            throw new IllegalArgumentException("JavaScript资源脚本超过128KB限制: " + name);
+        }
+        return new String(bytes, StandardCharsets.UTF_8);
+    }
 }
@@ -37,6 +37,7 @@ public class Ce4Tool extends PanBase {
        
        try {
            URL url = new URL(shareLinkInfo.getShareUrl());
+            assertPublicHost(url);
            String baseUrl = url.getProtocol() + "://" + url.getHost();
            // 如果有端口，拼接上端口
            if (url.getPort() != -1) {
@@ -110,7 +111,8 @@ public class Ce4Tool extends PanBase {
    private void requestShareDetail(String baseUrl, String key, String pwd, String path) {
        String shareApiUrl = baseUrl + SHARE_API_PATH + key;
        
-        HttpRequest<Buffer> httpRequest = clientSession.getAbs(shareApiUrl);
+        // 禁止跟随重定向：防止公网 host 302 到内网/元数据绕过 assertPublicHost
+        HttpRequest<Buffer> httpRequest = clientNoRedirects.getAbs(shareApiUrl);
        if (pwd != null && !pwd.isEmpty()) {
            httpRequest.addQueryParam("password", pwd);
        }
@@ -231,7 +233,7 @@ public class Ce4Tool extends PanBase {
                .put("uris", new JsonArray().add(filePath))
                .put("download", true);
        
-        clientSession.postAbs(fileUrlApi)
+        clientNoRedirects.postAbs(fileUrlApi)
                .putHeader("Content-Type", "application/json")
                .sendJsonObject(requestBody)
                .onSuccess(res -> {
@@ -2,6 +2,7 @@ package cn.qaiu.parser.impl;

 import cn.qaiu.entity.FileInfo;
 import cn.qaiu.entity.ShareLinkInfo;
+import cn.qaiu.parser.IPanTool;
 import cn.qaiu.parser.PanBase;
 import io.vertx.core.Future;
 import io.vertx.core.buffer.Buffer;
@@ -42,6 +43,7 @@ public class CeTool extends PanBase {
        String pwd = shareLinkInfo.getSharePassword();
        try {
            URL url = new URL(shareLinkInfo.getShareUrl());
+            assertPublicHost(url);
            String baseUrl = url.getProtocol() + "://" + url.getHost();
            // 如果有端口，拼接上端口
            if (url.getPort() != -1) {
@@ -76,7 +78,8 @@ public class CeTool extends PanBase {
    private void tryV4Ping(String baseUrl, String key, String pwd) {
        String pingUrlV4 = baseUrl + PING_API_V4_PATH;
        
-        clientSession.getAbs(pingUrlV4).send().onSuccess(res -> {
+        // 禁止跟随重定向：assertPublicHost 只校验初始 host，自动 30x 会绕过 SSRF 防护
+        clientNoRedirects.getAbs(pingUrlV4).send().onSuccess(res -> {
            if (res.statusCode() == 200) {
                try {
                    JsonObject json = asJson(res);
@@ -106,7 +109,7 @@ public class CeTool extends PanBase {
    private void tryV3Ping(String baseUrl, String key, String pwd) {
        String pingUrlV3 = baseUrl + PING_API_V3_PATH;
        
-        clientSession.getAbs(pingUrlV3).send().onSuccess(res -> {
+        clientNoRedirects.getAbs(pingUrlV3).send().onSuccess(res -> {
            if (res.statusCode() == 200) {
                try {
                    JsonObject json = asJson(res);
@@ -137,7 +140,7 @@ public class CeTool extends PanBase {
     */
    private void verifyV3AndParse(String baseUrl, String key, String pwd) {
        String shareApiUrl = baseUrl + SHARE_API_PATH + key;
-        HttpRequest<Buffer> httpRequest = clientSession.getAbs(shareApiUrl);
+        HttpRequest<Buffer> httpRequest = clientNoRedirects.getAbs(shareApiUrl);
        if (pwd != null && !pwd.isEmpty()) {
            httpRequest.addQueryParam("password", pwd);
        }
@@ -160,6 +163,7 @@ public class CeTool extends PanBase {
            } catch (Exception e) {
                log.debug("v3 share API解析失败: {}", e.getMessage());
            }
+            tryV4ShareApi(baseUrl, key, pwd);
        }).onFailure(t -> {
            log.debug("v3 share API请求失败: {}", t.getMessage());
            // 请求失败，尝试 v4 或下一个解析器
@@ -172,7 +176,7 @@ public class CeTool extends PanBase {
     */
    private void tryV4ShareApi(String baseUrl, String key, String pwd) {
        String shareApiUrl = baseUrl + "/api/v4/share/info/" + key;
-        HttpRequest<Buffer> httpRequest = clientSession.getAbs(shareApiUrl);
+        HttpRequest<Buffer> httpRequest = clientNoRedirects.getAbs(shareApiUrl);
        if (pwd != null && !pwd.isEmpty()) {
            httpRequest.addQueryParam("password", pwd);
        }
@@ -206,7 +210,8 @@ public class CeTool extends PanBase {
     */
    private void delegateToCe4Tool() {
        log.debug("检测到Cloudreve 4.x，转发到Ce4Tool处理");
-        new Ce4Tool(shareLinkInfo).parse().onComplete(promise);
+        Ce4Tool ce4Tool = new Ce4Tool(shareLinkInfo);
+        IPanTool.closeAfter(ce4Tool, ce4Tool::parse).onComplete(promise);
    }


@@ -287,7 +292,8 @@ public class CeTool extends PanBase {
    }

    private void getDownURL(String shareApiUrl) {
-        clientSession.putAbs(shareApiUrl)
+        // PUT 默认不跟随重定向，但仍统一使用 no-redirect 客户端避免配置漂移
+        clientNoRedirects.putAbs(shareApiUrl)
                .putHeader("Referer", shareLinkInfo.getShareUrl())
                .send().onSuccess(res -> {
            JsonObject jsonObject = asJson(res);
@@ -1,36 +1,73 @@
 package cn.qaiu.parser.impl;

+import cn.qaiu.entity.FileInfo;
 import cn.qaiu.entity.ShareLinkInfo;
 import cn.qaiu.parser.PanBase;
-import cn.qaiu.util.RandomStringGenerator;
+import cn.qaiu.util.CommonUtils;
+import cn.qaiu.util.FileSizeConverter;
 import io.vertx.core.Future;
+import io.vertx.core.Promise;
 import io.vertx.core.buffer.Buffer;
+import io.vertx.core.json.JsonArray;
 import io.vertx.core.json.JsonObject;
 import io.vertx.ext.web.client.HttpRequest;
 import io.vertx.uritemplate.UriTemplate;

+import java.net.URI;
+import java.net.URLDecoder;
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
 import java.util.HashMap;
+import java.util.List;
 import java.util.Map;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;

 /**
 * <a href="https://www.ctfile.com">诚通网盘</a>
 */
 public class CtTool extends PanBase {
    private static final String API_URL_PREFIX = "https://webapi.ctfile.com";
+    private static final String SHARE_FILE_URL_PREFIX = "https://ctfile.com/file/";
+    private static final String AJAX_ACCEPT = "application/json, text/javascript, */*; q=0.01";
+    private static final String BROWSER_UA = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36";
+    private static final int FILE_LIST_PAGE_SIZE = 200;
+    private static final int MAX_FILE_LIST_PAGES = 50;

-    // https://webapi.ctfile.com/getfile.php?path=f&f=55050874-1246660795-6464f6&
-    // passcode=7548&token=30wiijxs1fzhb6brw0p9m6&r=0.5885881231735761&
-    // ref=&url=https%3A%2F%2F474b.com%2Ff%2F55050874-1246660795-6464f6%3Fp%3D7548
+    // https://webapi.ctfile.com/getfile.php?path=f&f=64115194-17569800420720-06c697&
+    // passcode=7609&r=0.6611183001986635&ref=&url=https%3A%2F%2Furl94.ctfile.com%2Ff%2F64115194-17569800420720-06c697%3Fp%3D7609
    private static final String API1 = API_URL_PREFIX + "/getfile.php?path={path}" +
-            "&f={shareKey}&passcode={pwd}&token={token}&r={rand}&ref=";
+            "&f={shareKey}&passcode={pwd}&r={rand}&ref=&url={url}";

-    //https://webapi.ctfile.com/get_file_url.php?uid=55050874&fid=1246660795&folder_id=0&
-    // file_chk=054bc20461f5c63ff82015b9e69fb7fc&mb=1&token=30wiijxs1fzhb6brw0p9m6&app=0&
-    // acheck=1&verifycode=&rd=0.965929071503574
-    private static final String API2 = API_URL_PREFIX + "/get_file_url.php?" +
-            "uid={uid}&fid={fid}&folder_id=0&file_chk={file_chk}&mb=0&token={token}&app=0&acheck=0&verifycode=" +
-            "&rd={rand}";
+    // https://webapi.ctfile.com/get_down_url.php?uid=64115194&fid=17569800420720&
+    // file_chk=af5c8757a49cbc69a557eb3da59b246c&start_time=1780471868&wait_seconds=0&rd=0.36...
+    private static final String API2 = API_URL_PREFIX + "/get_down_url.php?" +
+            "uid={uid}&fid={fid}&file_chk={file_chk}" +
+            "&start_time={start_time}&wait_seconds={wait_seconds}&rd={rand}";

+    // https://webapi.ctfile.com/getdir.php?path=d&d=64115194-164803691-48508c&
+    // folder_id=164803691&fk=decb36&passcode=7609&r=0.23...&ref=&url=https://url94.ctfile.com/d/...
+    private static final String API_GETDIR = API_URL_PREFIX + "/getdir.php?path={path}" +
+            "&d={shareKey}&folder_id={folder_id}&fk={fk}&passcode={pwd}&r={rand}&ref=&url={url}";
+
+    // DataTables参数，用于获取目录文件列表
+    private static final String FILE_LIST_PARAMS_TEMPLATE = "&sEcho=1&iColumns=4&sColumns=%2C%2C%2C" +
+            "&iDisplayStart={start}&iDisplayLength={length}" +
+            "&mDataProp_0=0&sSearch_0=&bRegex_0=false&bSearchable_0=true&bSortable_0=false" +
+            "&mDataProp_1=1&sSearch_1=&bRegex_1=false&bSearchable_1=true&bSortable_1=true" +
+            "&mDataProp_2=2&sSearch_2=&bRegex_2=false&bSearchable_2=true&bSortable_2=true" +
+            "&mDataProp_3=3&sSearch_3=&bRegex_3=false&bSearchable_3=true&bSortable_3=true" +
+            "&sSearch=&bRegex=false" +
+            "&iSortCol_0=3&sSortDir_0=desc&iSortingCols=1";
+
+    // 文件列表HTML解析正则
+    private static final Pattern FILE_ID_PATTERN = Pattern.compile("value=[\"']f(\\d+)[\"']");
+    private static final Pattern FOLDER_ID_PATTERN = Pattern.compile("value=[\"']d(\\d+)[\"']");
+    private static final Pattern FILE_HREF_PATTERN = Pattern.compile("href=[\"']#/f/([^\"']+)[\"']");
+    private static final Pattern FILE_NAME_PATTERN = Pattern.compile("<a\\b[^>]*>([^<]+)</a>", Pattern.CASE_INSENSITIVE);
+    private static final Pattern FILE_ICON_PATTERN = Pattern.compile("alt=[\"']([^\"']+)[\"']");
+    private static final Pattern SUBDIR_PATTERN = Pattern.compile("load_subdir\\s*\\((\\d+)\\s*,\\s*['\"]([^'\"]+)['\"]\\)");

    /**
     * 子类重写此构造方法不需要添加额外逻辑
@@ -51,62 +88,586 @@ public class CtTool extends PanBase {
    @Override
    public Future<String> parse() {
        final String shareKey = shareLinkInfo.getShareKey();
-        if (shareKey.indexOf('-') == -1) {
+        if (shareKey == null || shareKey.indexOf('-') == -1) {
            fail("shareKey格式不正确找不到'-': {}", shareKey);
            return promise.future();
        }
        String[] split = shareKey.split("-");
-        String uid = split[0], fid = split[1];
-        String token = RandomStringGenerator.generateRandomString();
-        // 获取url path
-        int i1 = shareLinkInfo.getShareUrl().indexOf("com/");
-        int i2 = shareLinkInfo.getShareUrl().lastIndexOf("/");
-        String path = shareLinkInfo.getShareUrl().substring(i1 + 4, i2);
+        if (split.length < 2 || split[0].isBlank() || split[1].isBlank()) {
+            fail("shareKey格式不正确: {}", shareKey);
+            return promise.future();
+        }
+        String fallbackUid = split[0], fallbackFid = split[1];
+        String path = extractPath(shareLinkInfo.getShareUrl());

-        HttpRequest<Buffer> bufferHttpRequest1 = clientSession.getAbs(UriTemplate.of(API1))
+        HttpRequest<Buffer> bufferHttpRequest1 = withCtAjaxHeaders(clientSession.getAbs(UriTemplate.of(API1))
                .setTemplateParam("path", path)
                .setTemplateParam("shareKey", shareKey)
                .setTemplateParam("pwd", shareLinkInfo.getSharePassword())
-                .setTemplateParam("token", token)
-                .setTemplateParam("r", Math.random() + "");
+                .setTemplateParam("rand", String.valueOf(Math.random()))
+                .setTemplateParam("url", shareLinkInfo.getShareUrl()), shareLinkInfo.getShareUrl());

        bufferHttpRequest1
                .send().onSuccess(res -> {
-                    var resJson = asJson(res);
-                    if (resJson.containsKey("file")) {
-                        var fileJson = resJson.getJsonObject("file");
-                        if (fileJson.containsKey("file_chk")) {
-                            var file_chk = fileJson.getString("file_chk");
-                            HttpRequest<Buffer> bufferHttpRequest2 = clientSession.getAbs(UriTemplate.of(API2))
-                                    .setTemplateParam("uid", uid)
-                                    .setTemplateParam("fid", fid)
-                                    .setTemplateParam("file_chk", file_chk)
-                                    .setTemplateParam("token", token)
-                                    .setTemplateParam("rd", Math.random() + "");
-                            bufferHttpRequest2
-                                    .send().onSuccess(res2 -> {
-                                        JsonObject resJson2 = asJson(res2);
-                                        if (resJson2.containsKey("downurl")) {
-                                            String downloadUrl = resJson2.getString("downurl");
-                                            
-                                            // 存储下载元数据，包括必要的请求头
-                                            Map<String, String> headers = new HashMap<>();
-                                            headers.put("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36");
-                                            headers.put("Referer", shareLinkInfo.getShareUrl());
-                                            
-                                            // 使用新的 completeWithMeta 方法
-                                            completeWithMeta(downloadUrl, headers);
-                                        } else {
-                                            fail("解析失败, 可能分享已失效: json: {} 字段 {} 不存在", resJson2, "downurl");
-                                        }
-                                    }).onFailure(handleFail(bufferHttpRequest1.queryParams().toString()));
-                        } else {
-                            fail("解析失败, file_chk找不到, 可能分享已失效或者分享密码不对: {}", fileJson);
+                    try {
+                        var resJson = asJson(res);
+                        if (resJson == null || resJson.isEmpty()) {
+                            fail("解析失败, 上游返回空响应或非JSON响应");
+                            return;
                        }
-                    } else {
-                        fail("解析失败, 文件信息为空, 可能分享已失效");
+                        Object fileValue = resJson.getValue("file");
+                        if (!(fileValue instanceof JsonObject)) {
+                            fail("解析失败, 文件信息为空或格式错误, 可能分享已失效: {}", resJson);
+                            return;
+                        }
+                        var fileJson = (JsonObject) fileValue;
+                        String uid = resolveDownloadUid(fileJson, fallbackUid);
+                        String fid = resolveDownloadFid(fileJson, fallbackFid);
+                        String fileChk = fileJson.getString("file_chk");
+                        String startTime = valueToString(fileJson.getValue("start_time"));
+                        String waitSeconds = valueToString(fileJson.getValue("wait_seconds"));
+                        if (uid.isBlank() || fid.isBlank() || fileChk == null || fileChk.isBlank()
+                                || startTime.isBlank() || waitSeconds.isBlank()) {
+                            fail("解析失败, 下载参数不完整, 可能分享已失效或者分享密码不对: {}", fileJson);
+                            return;
+                        }
+
+                        // 提取文件信息并存储
+                        FileInfo fileInfo = new FileInfo()
+                                .setFileName(fileJson.getString("file_name"))
+                                .setFileId(fid)
+                                .setSizeStr(fileJson.getString("file_size"))
+                                .setCreateTime(fileJson.getString("file_time"))
+                                .setCreateBy(fileJson.getString("username"))
+                                .setFileType("file")
+                                .setPanType(shareLinkInfo.getType());
+                        shareLinkInfo.getOtherParam().put("fileInfo", fileInfo);
+
+                        HttpRequest<Buffer> bufferHttpRequest2 = withCtAjaxHeaders(clientSession.getAbs(UriTemplate.of(API2))
+                                .setTemplateParam("uid", uid)
+                                .setTemplateParam("fid", fid)
+                                .setTemplateParam("file_chk", fileChk)
+                                .setTemplateParam("start_time", startTime)
+                                .setTemplateParam("wait_seconds", waitSeconds)
+                                .setTemplateParam("rand", String.valueOf(Math.random())), shareLinkInfo.getShareUrl());
+                        bufferHttpRequest2
+                                .send().onSuccess(res2 -> handleDownloadUrlResponse(res2))
+                                .onFailure(t -> fail("下载链接请求失败: {}", t.getMessage()));
+                    } catch (Exception e) {
+                        fail("解析失败: {}", e.getMessage());
                    }
-                }).onFailure(handleFail(bufferHttpRequest1.queryParams().toString()));
+                }).onFailure(t -> fail("文件信息请求失败: {}", t.getMessage()));
        return promise.future();
    }
+
+    private void handleDownloadUrlResponse(io.vertx.ext.web.client.HttpResponse<Buffer> res) {
+        try {
+            JsonObject resJson = asJson(res);
+            if (resJson == null || resJson.isEmpty()) {
+                fail("解析失败, 下载接口返回空响应或非JSON响应");
+                return;
+            }
+            String downloadUrl = resJson.getString("downurl");
+            if (downloadUrl == null || downloadUrl.isBlank()) {
+                fail("解析失败, 可能分享已失效: json: {} 字段 {} 不存在", resJson, "downurl");
+                return;
+            }
+
+            // 存储下载元数据，包括必要的请求头
+            Map<String, String> headers = new HashMap<>();
+            headers.put("User-Agent", BROWSER_UA);
+            if (shareLinkInfo.getShareUrl() != null && !shareLinkInfo.getShareUrl().isBlank()) {
+                headers.put("Referer", shareLinkInfo.getShareUrl());
+            }
+
+            // 使用新的 completeWithMeta 方法
+            completeWithMeta(downloadUrl, headers);
+        } catch (Exception e) {
+            fail("解析失败, 下载接口响应处理异常: {}", e.getMessage());
+        }
+    }
+
+    @Override
+    public Future<List<FileInfo>> parseFileList() {
+        Promise<List<FileInfo>> listPromise = Promise.promise();
+
+        final String shareKey = shareLinkInfo.getShareKey();
+        final String shareUrl = shareLinkInfo.getShareUrl();
+        final String pwd = shareLinkInfo.getSharePassword();
+
+        // shareKey格式: uid-folder_id-hash (例如 64115194-164803691-48508c)
+        if (shareKey == null) {
+            listPromise.fail(baseMsg() + " shareKey为空");
+            return listPromise.future();
+        }
+        String[] split = shareKey.split("-");
+        if (split.length < 2) {
+            listPromise.fail(baseMsg() + " shareKey格式不正确: " + shareKey);
+            return listPromise.future();
+        }
+        String path = extractPath(shareUrl);
+        Object dirId = shareLinkInfo.getOtherParam() == null ? null : shareLinkInfo.getOtherParam().get("dirId");
+        DirectoryContext directoryContext = resolveDirectoryContext(shareUrl, dirId);
+
+        HttpRequest<Buffer> getDirRequest = withCtAjaxHeaders(clientSession.getAbs(UriTemplate.of(API_GETDIR))
+                .setTemplateParam("path", path)
+                .setTemplateParam("shareKey", shareKey)
+                .setTemplateParam("folder_id", directoryContext.folderId)
+                .setTemplateParam("fk", directoryContext.folderKey)
+                .setTemplateParam("pwd", pwd != null ? pwd : "")
+                .setTemplateParam("rand", String.valueOf(Math.random()))
+                .setTemplateParam("url", shareUrl), shareUrl);
+
+        getDirRequest.send().onSuccess(res -> {
+            try {
+                var resJson = asJson(res);
+                if (resJson == null || resJson.isEmpty()) {
+                    failListPromise(listPromise, baseMsg() + " 目录解析失败: 上游返回空响应或非JSON响应");
+                    return;
+                }
+                if (!resJson.containsKey("file")) {
+                    failListPromise(listPromise, baseMsg() + " 目录解析失败: " + resJson.encode());
+                    return;
+                }
+                Object dirInfoValue = resJson.getValue("file");
+                if (!(dirInfoValue instanceof JsonObject)) {
+                    failListPromise(listPromise, baseMsg() + " 目录解析失败: file字段格式错误: " + resJson.encode());
+                    return;
+                }
+                JsonObject dirInfo = (JsonObject) dirInfoValue;
+                Object fileListUrlValue = dirInfo.getValue("url");
+                String fileListRelUrl = fileListUrlValue instanceof String ? ((String) fileListUrlValue).trim() : "";
+                if (fileListRelUrl.isBlank()) {
+                    failListPromise(listPromise, baseMsg() + " " + buildDirectoryFailureMessage(resJson, dirInfo));
+                    return;
+                }
+
+                fetchFileListPage(toCtApiUrl(fileListRelUrl), 0, 0, new ArrayList<>(), listPromise,
+                        shareLinkInfo.getType(), getDomainName(), shareUrl, pwd);
+            } catch (Exception e) {
+                failListPromise(listPromise, baseMsg() + " 目录解析失败: " + e.getMessage());
+            }
+        }).onFailure(t -> failListPromise(listPromise, t));
+
+        return listPromise.future();
+    }
+
+    private void fetchFileListPage(String fileListBaseUrl, int start, int pageIndex, List<FileInfo> fileList,
+                                   Promise<List<FileInfo>> listPromise, String panType, String domainName,
+                                   String shareUrl, String pwd) {
+        try {
+            if (pageIndex >= MAX_FILE_LIST_PAGES) {
+                failListPromise(listPromise, baseMsg() + " 文件列表解析失败: 分页超过最大限制 " + MAX_FILE_LIST_PAGES
+                        + " (start=" + start + ", length=" + FILE_LIST_PAGE_SIZE + ")");
+                return;
+            }
+
+            String fileListUrl = appendQueryParams(fileListBaseUrl,
+                    buildFileListParams(start, FILE_LIST_PAGE_SIZE) + "&_=" + System.currentTimeMillis());
+            withCtAjaxHeaders(clientSession.getAbs(fileListUrl), shareUrl)
+                    .send()
+                    .onSuccess(res -> handleFileListPageResponse(fileListBaseUrl, start, pageIndex, fileList,
+                            listPromise, panType, domainName, shareUrl, pwd, res))
+                    .onFailure(t -> failListPromise(listPromise, t));
+        } catch (Exception e) {
+            failListPromise(listPromise, baseMsg() + " 文件列表解析失败: " + e.getMessage()
+                    + " (start=" + start + ", length=" + FILE_LIST_PAGE_SIZE + ")");
+        }
+    }
+
+    private void handleFileListPageResponse(String fileListBaseUrl, int start, int pageIndex, List<FileInfo> fileList,
+                                            Promise<List<FileInfo>> listPromise, String panType, String domainName,
+                                            String shareUrl, String pwd, io.vertx.ext.web.client.HttpResponse<Buffer> res) {
+        try {
+            var listJson = asJson(res);
+            if (listJson == null || listJson.isEmpty()) {
+                failListPromise(listPromise, baseMsg() + " 文件列表解析失败: 上游返回空响应或非JSON响应"
+                        + " (start=" + start + ", length=" + FILE_LIST_PAGE_SIZE + ")");
+                return;
+            }
+            Object aaDataValue = listJson.getValue("aaData");
+            if (!(aaDataValue instanceof JsonArray)) {
+                failListPromise(listPromise, baseMsg() + " 文件列表解析失败: aaData为空: " + listJson.encode());
+                return;
+            }
+            JsonArray aaData = (JsonArray) aaDataValue;
+            for (int i = 0; i < aaData.size(); i++) {
+                try {
+                    Object rowValue = aaData.getValue(i);
+                    if (!(rowValue instanceof JsonArray)) {
+                        log.warn("城通文件列表行格式错误: {}", rowValue);
+                        continue;
+                    }
+                    FileInfo fileInfo = parseFileListRow((JsonArray) rowValue, panType,
+                            domainName, shareUrl, pwd);
+                    if (fileInfo != null) {
+                        fileList.add(fileInfo);
+                    }
+                } catch (Exception e) {
+                    log.warn("解析文件行失败: {}", e.getMessage());
+                }
+            }
+
+            int nextStart = start + aaData.size();
+            int total = parseFileListTotal(listJson);
+            if (isUnexpectedEmptyFileListPage(start, aaData.size(), total)) {
+                failListPromise(listPromise, baseMsg() + " 文件列表解析失败: 上游返回空分页"
+                        + " (start=" + start + ", total=" + total + ")");
+                return;
+            }
+            if (shouldFetchNextFileListPage(start, aaData.size(), total)) {
+                fetchFileListPage(fileListBaseUrl, nextStart, pageIndex + 1, fileList,
+                        listPromise, panType, domainName, shareUrl, pwd);
+            } else {
+                completeListPromise(listPromise, fileList);
+            }
+        } catch (Exception e) {
+            failListPromise(listPromise, baseMsg() + " 文件列表解析失败: " + e.getMessage()
+                    + " (start=" + start + ", length=" + FILE_LIST_PAGE_SIZE + ")");
+        }
+    }
+
+    @Override
+    public Future<String> parseById() {
+        Object paramValue = shareLinkInfo.getOtherParam().get("paramJson");
+        if (!(paramValue instanceof JsonObject)) {
+            Promise<String> parsePromise = Promise.promise();
+            parsePromise.fail(baseMsg() + " 缺少下载参数paramJson");
+            return parsePromise.future();
+        }
+        JsonObject paramJson = (JsonObject) paramValue;
+        if (!applyFileParam(shareLinkInfo, paramJson)) {
+            Promise<String> parsePromise = Promise.promise();
+            parsePromise.fail(baseMsg() + " 下载参数id为空");
+            return parsePromise.future();
+        }
+        return parse();
+    }
+
+    static boolean applyFileParam(ShareLinkInfo shareLinkInfo, JsonObject paramJson) {
+        String fileShareKey = paramJson.getString("id");
+        if (fileShareKey == null || fileShareKey.isBlank()) {
+            return false;
+        }
+        shareLinkInfo.setSharePassword(paramJson.getString("pwd", ""));
+        shareLinkInfo.setShareKey(fileShareKey);
+        shareLinkInfo.setShareUrl(SHARE_FILE_URL_PREFIX + fileShareKey);
+        shareLinkInfo.setStandardUrl(SHARE_FILE_URL_PREFIX + fileShareKey);
+        return true;
+    }
+
+    static String resolveDownloadUid(JsonObject fileJson, String fallbackUid) {
+        return firstNonBlank(valueToString(fileJson.getValue("userid")), fallbackUid);
+    }
+
+    static String resolveDownloadFid(JsonObject fileJson, String fallbackFid) {
+        return firstNonBlank(valueToString(fileJson.getValue("file_id")), fallbackFid);
+    }
+
+    private HttpRequest<Buffer> withCtAjaxHeaders(HttpRequest<Buffer> request, String shareUrl) {
+        request.putHeader("User-Agent", BROWSER_UA)
+                .putHeader("Accept", AJAX_ACCEPT)
+                .putHeader("X-Requested-With", "XMLHttpRequest");
+        if (shareUrl != null && !shareUrl.isBlank()) {
+            request.putHeader("Referer", shareUrl);
+        }
+        String origin = extractOrigin(shareUrl);
+        if (!origin.isBlank()) {
+            request.putHeader("Origin", origin);
+        }
+        return request;
+    }
+
+    static FileInfo parseFileListRow(JsonArray row, String panType, String domainName, String shareUrl, String pwd) {
+        if (row == null || row.size() < 2) {
+            return null;
+        }
+        String checkboxHtml = rowString(row, 0);
+        String nameCellHtml = rowString(row, 1);
+        String sizeStr = rowString(row, 2).trim();
+        String dateStr = rowString(row, 3).trim();
+        if (nameCellHtml.isBlank()) {
+            return null;
+        }
+
+        String fileName = matchFirst(FILE_NAME_PATTERN, nameCellHtml);
+        String fileIcon = matchFirst(FILE_ICON_PATTERN, nameCellHtml);
+        if (fileName == null || fileName.isBlank()) {
+            return null;
+        }
+
+        Matcher subdirMatcher = SUBDIR_PATTERN.matcher(nameCellHtml);
+        boolean hasSubdirCall = subdirMatcher.find();
+        if (hasSubdirCall || "folder".equalsIgnoreCase(fileIcon)) {
+            String folderId = hasSubdirCall ? subdirMatcher.group(1) : null;
+            String folderKey = hasSubdirCall ? subdirMatcher.group(2) : "";
+            if (folderId == null) {
+                folderId = matchFirst(FOLDER_ID_PATTERN, checkboxHtml);
+            }
+            if (folderId == null || folderId.isBlank()) {
+                return null;
+            }
+            String dirId = folderId + ":" + folderKey;
+            FileInfo fileInfo = new FileInfo()
+                    .setFileName(fileName.trim())
+                    .setFileId(folderId)
+                    .setSize(0L)
+                    .setSizeStr(sizeStr.isBlank() ? "0B" : sizeStr)
+                    .setFileType("folder")
+                    .setFileIcon(fileIcon)
+                    .setPanType(panType)
+                    .setParserUrl(buildFolderParserUrl(domainName, shareUrl, dirId, pwd));
+            if (!dateStr.isBlank()) {
+                fileInfo.setCreateTime(dateStr).setUpdateTime(dateStr);
+            }
+            return fileInfo;
+        }
+
+        String fileShareKey = matchFirst(FILE_HREF_PATTERN, nameCellHtml);
+        if (fileShareKey == null || fileShareKey.isBlank()) {
+            return null;
+        }
+        String fileId = matchFirst(FILE_ID_PATTERN, checkboxHtml);
+        JsonObject paramJson = new JsonObject()
+                .put("id", fileShareKey)
+                .put("fileName", fileName.trim())
+                .put("pwd", pwd == null ? "" : pwd);
+        String param = CommonUtils.urlBase64Encode(paramJson.encode());
+        long sizeBytes = 0;
+        try {
+            sizeBytes = sizeStr.isBlank() ? 0 : FileSizeConverter.convertToBytes(sizeStr);
+        } catch (Exception ignored) {
+        }
+
+        FileInfo fileInfo = new FileInfo()
+                .setFileName(fileName.trim())
+                .setFileId(fileId)
+                .setSizeStr(sizeStr)
+                .setSize(sizeBytes)
+                .setFileType(fileIcon != null ? fileIcon : "file")
+                .setFileIcon(fileIcon)
+                .setPanType(panType)
+                .setParserUrl(String.format("%s/v2/redirectUrl/%s/%s",
+                        domainName, panType, param));
+        if (!dateStr.isBlank()) {
+            fileInfo.setCreateTime(dateStr).setUpdateTime(dateStr);
+        }
+        return fileInfo;
+    }
+
+    private static String buildFolderParserUrl(String domainName, String shareUrl, String dirId, String pwd) {
+        String url = String.format("%s/v2/getFileList?url=%s&dirId=%s",
+                domainName, urlEncode(shareUrl), urlEncode(dirId));
+        if (pwd != null && !pwd.isBlank()) {
+            url += "&pwd=" + urlEncode(pwd);
+        }
+        return url;
+    }
+
+    static String extractQueryParam(String url, String paramName) {
+        if (url == null || paramName == null) return null;
+        int qIdx = url.indexOf('?');
+        if (qIdx < 0) return null;
+        String query = url.substring(qIdx + 1);
+        int fragmentIdx = query.indexOf('#');
+        if (fragmentIdx >= 0) {
+            query = query.substring(0, fragmentIdx);
+        }
+        for (String param : query.split("&")) {
+            int eqIdx = param.indexOf('=');
+            if (eqIdx > 0 && urlDecode(param.substring(0, eqIdx)).equals(paramName)) {
+                return urlDecode(param.substring(eqIdx + 1));
+            }
+        }
+        return null;
+    }
+
+    static String extractPath(String shareUrl) {
+        if (shareUrl == null) {
+            return "";
+        }
+        int comIdx = shareUrl.indexOf("com/");
+        if (comIdx < 0) {
+            return "";
+        }
+
+        int pathStart = comIdx + 4;
+        int pathEnd = shareUrl.indexOf('/', pathStart);
+        if (pathEnd < 0) {
+            pathEnd = shareUrl.indexOf('?', pathStart);
+        }
+        if (pathEnd < 0) {
+            pathEnd = shareUrl.length();
+        }
+        return shareUrl.substring(pathStart, pathEnd);
+    }
+
+    static String extractFolderKey(String shareUrl) {
+        return trimToEmpty(extractQueryParam(shareUrl, "fk"));
+    }
+
+    static DirectoryContext resolveDirectoryContext(String shareUrl, Object dirIdObj) {
+        String dirId = dirIdObj == null ? "" : urlDecode(String.valueOf(dirIdObj).trim());
+        if (!dirId.isBlank()) {
+            String[] split = dirId.split(":", 2);
+            return new DirectoryContext(trimToDefault(split[0], "undefined"),
+                    split.length > 1 ? trimToEmpty(split[1]) : "");
+        }
+
+        String queryFolderId = firstNonBlank(extractQueryParam(shareUrl, "folder_id"), extractQueryParam(shareUrl, "d"));
+        String queryFk = extractFolderKey(shareUrl);
+        if (!queryFolderId.isBlank() || !queryFk.isBlank()) {
+            return new DirectoryContext(trimToDefault(queryFolderId, "undefined"), queryFk);
+        }
+        return new DirectoryContext("undefined", "");
+    }
+
+    static String buildDirectoryFailureMessage(JsonObject resJson, JsonObject dirInfo) {
+        String code = valueToString(resJson.getValue("code"));
+        String message = valueToString(dirInfo.getValue("message"));
+        if (message != null && !message.isBlank()) {
+            return "目录解析失败: " + message + " (code=" + code + ")";
+        }
+        if ("423".equals(code)) {
+            return "目录解析失败: 需要访问密码或该分享受限 (code=423)";
+        }
+        return "目录解析失败: 文件列表URL为空, 上游响应: " + resJson.encode();
+    }
+
+    static String buildFileListParams(int start, int length) {
+        return FILE_LIST_PARAMS_TEMPLATE
+                .replace("{start}", String.valueOf(Math.max(0, start)))
+                .replace("{length}", String.valueOf(Math.max(1, length)));
+    }
+
+    static int parseFileListTotal(JsonObject listJson) {
+        int displayTotal = parseInteger(listJson.getValue("iTotalDisplayRecords"), -1);
+        return displayTotal >= 0 ? displayTotal : parseInteger(listJson.getValue("iTotalRecords"), -1);
+    }
+
+    static boolean shouldFetchNextFileListPage(int start, int rowCount, int total) {
+        if (rowCount <= 0) {
+            return false;
+        }
+        int fetchedThrough = start + rowCount;
+        return total < 0 ? rowCount >= FILE_LIST_PAGE_SIZE : fetchedThrough < total;
+    }
+
+    static boolean isUnexpectedEmptyFileListPage(int start, int rowCount, int total) {
+        return total >= 0 && start < total && rowCount <= 0;
+    }
+
+    private static int parseInteger(Object value, int defaultValue) {
+        if (value instanceof Number) {
+            return ((Number) value).intValue();
+        }
+        if (value == null) {
+            return defaultValue;
+        }
+        try {
+            return Integer.parseInt(value.toString());
+        } catch (NumberFormatException e) {
+            return defaultValue;
+        }
+    }
+
+    private static void failListPromise(Promise<List<FileInfo>> listPromise, String message) {
+        if (!listPromise.future().isComplete()) {
+            listPromise.fail(message);
+        }
+    }
+
+    private static void failListPromise(Promise<List<FileInfo>> listPromise, Throwable throwable) {
+        if (!listPromise.future().isComplete()) {
+            listPromise.fail(throwable);
+        }
+    }
+
+    private static void completeListPromise(Promise<List<FileInfo>> listPromise, List<FileInfo> fileList) {
+        if (!listPromise.future().isComplete()) {
+            listPromise.complete(fileList);
+        }
+    }
+
+    private static String toCtApiUrl(String url) {
+        if (url.startsWith("http://") || url.startsWith("https://")) {
+            return url;
+        }
+        return API_URL_PREFIX + url;
+    }
+
+    private static String appendQueryParams(String url, String params) {
+        String normalizedParams = params != null && params.startsWith("&") ? params.substring(1) : params;
+        return url + (url.contains("?") ? "&" : "?") + normalizedParams;
+    }
+
+    private static String rowString(JsonArray row, int index) {
+        if (row == null || index >= row.size()) {
+            return "";
+        }
+        return valueToString(row.getValue(index));
+    }
+
+    private static String valueToString(Object value) {
+        return value == null ? "" : value.toString();
+    }
+
+    private static String matchFirst(Pattern pattern, String text) {
+        if (text == null) {
+            return null;
+        }
+        Matcher matcher = pattern.matcher(text);
+        return matcher.find() ? matcher.group(1) : null;
+    }
+
+    private static String firstNonBlank(String first, String second) {
+        return !trimToEmpty(first).isBlank() ? trimToEmpty(first) : trimToEmpty(second);
+    }
+
+    private static String trimToDefault(String value, String defaultValue) {
+        String result = trimToEmpty(value);
+        return result.isBlank() ? defaultValue : result;
+    }
+
+    private static String trimToEmpty(String value) {
+        return value == null ? "" : value.trim();
+    }
+
+    private static String urlEncode(String value) {
+        return URLEncoder.encode(value == null ? "" : value, StandardCharsets.UTF_8);
+    }
+
+    private static String urlDecode(String value) {
+        if (value == null) {
+            return "";
+        }
+        try {
+            return URLDecoder.decode(value, StandardCharsets.UTF_8);
+        } catch (Exception e) {
+            return value;
+        }
+    }
+
+    private static String extractOrigin(String shareUrl) {
+        try {
+            URI uri = URI.create(shareUrl);
+            if (uri.getScheme() == null || uri.getHost() == null) {
+                return "";
+            }
+            String origin = uri.getScheme() + "://" + uri.getHost();
+            return uri.getPort() > 0 ? origin + ":" + uri.getPort() : origin;
+        } catch (Exception e) {
+            return "";
+        }
+    }
+
+    static final class DirectoryContext {
+        final String folderId;
+        final String folderKey;
+
+        DirectoryContext(String folderId, String folderKey) {
+            this.folderId = folderId;
+            this.folderKey = folderKey;
+        }
+    }
 }
@@ -25,6 +25,10 @@ public class FcTool extends PanBase {
    private static final String DOWN_REQUEST_URL = "https://v2.fangcloud.cn/apps/files/download?file_id={fid}" +
            "&scenario=share&unique_name={uname}";

+    // 静态编译的正则表达式，避免每次调用都重新编译
+    private static final Pattern REQUEST_TOKEN_PATTERN = Pattern.compile("name=\"requesttoken\"\\s+value=\"([a-zA-Z0-9_+=]+)\"");
+    private static final Pattern TYPED_ID_PATTERN = Pattern.compile("id=\"typed_id\"\\s+value=\"file_(\\d+)\"");
+
    public FcTool(ShareLinkInfo shareLinkInfo) {
        super(shareLinkInfo);
    }
@@ -41,8 +45,7 @@ public class FcTool extends PanBase {
            if (StringUtils.isNotEmpty(pwd)) {
                // 获取requesttoken
                String html = res.bodyAsString();
-                Pattern compile = Pattern.compile("name=\"requesttoken\"\\s+value=\"([a-zA-Z0-9_+=]+)\"");
-                Matcher matcher = compile.matcher(html);
+                Matcher matcher = REQUEST_TOKEN_PATTERN.matcher(html);
                if (!matcher.find()) {
                    fail(SHARE_URL_PREFIX + " 未匹配到加密分享的密码输入页面的requesttoken");
                    return;
@@ -71,8 +74,7 @@ public class FcTool extends PanBase {
                                   WebClientSession sClient) {
        // 从HTML中找到文件id
        String html = res.bodyAsString();
-        Pattern compile = Pattern.compile("id=\"typed_id\"\\s+value=\"file_(\\d+)\"");
-        Matcher matcher = compile.matcher(html);
+        Matcher matcher = TYPED_ID_PATTERN.matcher(html);
        if (!matcher.find()) {
            fail(SHARE_URL_PREFIX + " 未匹配到文件id(typed_id)");
            return;
@@ -169,8 +169,13 @@ public class FjTool extends PanBase {

                                // 文件Id
                                JsonObject fileInfo = resJson.getJsonArray("list").getJsonObject(0);
+                                JsonArray fileListArray = fileInfo.getJsonArray("fileList");
+                                if (fileListArray == null || fileListArray.isEmpty()) {
+                                    fail(FIRST_REQUEST_URL + " 文件列表为空: " + fileInfo);
+                                    return;
+                                }
                                // 如果是目录返回目录ID
-                                JsonObject fileList = fileInfo.getJsonArray("fileList").getJsonObject(0);
+                                JsonObject fileList = fileListArray.getJsonObject(0);
                                if (fileList.getInteger("fileType") == 2) {
                                    promise.complete(fileList.getInteger("folderId").toString());
                                    return;
@@ -31,10 +31,12 @@ public class GenShortUrl extends PanBase {
    private static final String WRAPPER_URL = "https://www.so.com/link?m=ewgUSYiFWXIoTybC3fJH8YoJy8y10iRquo6cazgINwWjTn3HvVJ92TrCJu0PmMUR0RMDfOAucP3wa4G8j64SrhNH9Z0Cr0PEyn9ASuvpkUGmAjjUEGJkO5%2BIDGWVrEkPHsL7UsoKO6%2BlT%2BD6r&ccc=";
    private static final String MID = "5095144728824883";  // 微博的mid

+    private static final Pattern SHORT_URL_PATTERN = Pattern.compile("(https?)://t.cn/\\w+");
+    private static final Pattern COMMENT_ID_PATTERN = Pattern.compile("comment_id=\"(\\d+)\"");
+
    private static final MultiMap HEADER = HeadersMultiMap.headers()
            .add("Content-Type", "application/x-www-form-urlencoded")
            .add("Referer", "https://www.weibo.com")
-            .add("Content-Type", "application/x-www-form-urlencoded")
            .add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36");

    Cookie cookie = new DefaultCookie("SUB", "_2A25KJE5vDeRhGeRJ6lsR9SjJzDuIHXVpWM-nrDV8PUJbkNAbLVPlkW1NUmJm3GjYtRHBsHdMUKafkdTL_YheMEmu");
@@ -64,11 +66,12 @@ public class GenShortUrl extends PanBase {
                    String shortUrl = extractShortUrl(comment);
                    if (shortUrl != null) {
                        log.info("生成的短链：{}", shortUrl);
+                        // 先完成 promise，返回短链
+                        promise.complete(shortUrl);
+                        // 异步清理评论（best-effort，不影响结果）
                        String commentId = extractCommentId(comment);
                        if (commentId != null) {
                            deleteComment(commentId);
-                        } else {
-                            promise.fail("未能提取评论ID");
                        }
                    } else {
                        promise.fail("未能生成短链");
@@ -103,8 +106,7 @@ public class GenShortUrl extends PanBase {
    }

    private String extractShortUrl(String comment) {
-        Pattern pattern = Pattern.compile("(https?)://t.cn/\\w+");
-        Matcher matcher = pattern.matcher(comment);
+        Matcher matcher = SHORT_URL_PATTERN.matcher(comment);
        if (matcher.find()) {
            return matcher.group(0);
        }
@@ -112,8 +114,7 @@ public class GenShortUrl extends PanBase {
    }

    private String extractCommentId(String comment) {
-        Pattern pattern = Pattern.compile("comment_id=\"(\\d+)\"");
-        Matcher matcher = pattern.matcher(comment);
+        Matcher matcher = COMMENT_ID_PATTERN.matcher(comment);
        if (matcher.find()) {
            return matcher.group(1);
        }
@@ -52,4 +52,14 @@ public class IzSelectorTool implements IPanTool {
    public Future<String> parseById() {
        return selectedTool.parseById();
    }
+
+    @Override
+    public ShareLinkInfo getShareLinkInfo() {
+        return selectedTool.getShareLinkInfo();
+    }
+
+    @Override
+    public void close() {
+        IPanTool.closeQuietly(selectedTool);
+    }
 }
@@ -443,16 +443,75 @@ public class IzTool extends PanBase {
        }
    }

-    private void down(HttpResponse<Buffer> res2) {
-        MultiMap headers = res2.headers();
-        if (!headers.contains("Location") || StringUtils.isBlank(headers.get("Location"))) {
-            fail("找不到下载链接可能服务器已被禁止或者配置的认证信息有误");
-            return;
-        }
-        promise.complete(headers.get("Location"));
-    }
-
-    // 目录解析
+    private void down(HttpResponse<Buffer> res2) {
+        MultiMap headers = res2.headers();
+        String location = headers.get("Location");
+        if (StringUtils.isBlank(location)) {
+            fail("{}", buildMissingLocationMessage(res2));
+            return;
+        }
+        promise.complete(location);
+    }
+
+    private String buildMissingLocationMessage(HttpResponse<Buffer> response) {
+        StringBuilder message = new StringBuilder("未获取到下载重定向地址");
+        message.append(", HTTP ").append(response.statusCode());
+
+        String body = null;
+        try {
+            body = asText(response);
+        } catch (Exception e) {
+            body = "<响应体读取失败: " + e.getMessage() + ">";
+        }
+
+        if (StringUtils.isNotBlank(body)) {
+            try {
+                JsonObject json = new JsonObject(body);
+                String upstreamMsg = json.getString("msg");
+                Object code = json.getValue("code");
+                if (StringUtils.isNotBlank(upstreamMsg)) {
+                    message.append(", 上游返回: ").append(upstreamMsg);
+                    if (code != null) {
+                        message.append(" (code=").append(code).append(")");
+                    }
+                } else {
+                    message.append(", 响应体: ").append(previewBody(body));
+                }
+            } catch (Exception ignored) {
+                message.append(", 响应体: ").append(previewBody(body));
+            }
+        } else {
+            message.append(", 响应体为空");
+        }
+
+        Object fileName = shareLinkInfo.getOtherParam().get("fileName");
+        Object fileSize = shareLinkInfo.getOtherParam().get("fileSizeFormat");
+        if (fileName != null) {
+            message.append(", 文件: ").append(fileName);
+        }
+        if (fileSize != null) {
+            message.append(", 大小: ").append(fileSize);
+        }
+        if (!hasConfiguredAuth()) {
+            message.append(", 当前为免登录解析，上游可能要求登录、会员或人工处理");
+        }
+        return message.toString();
+    }
+
+    private boolean hasConfiguredAuth() {
+        Object authObj = shareLinkInfo.getOtherParam().get("auths");
+        if (!(authObj instanceof MultiMap auths)) {
+            return false;
+        }
+        return StringUtils.isNotBlank(auths.get("username")) && StringUtils.isNotBlank(auths.get("password"));
+    }
+
+    private String previewBody(String body) {
+        int maxLength = 500;
+        return body.length() <= maxLength ? body : body.substring(0, maxLength) + "...";
+    }
+
+    // 目录解析
    @Override
    public Future<List<FileInfo>> parseFileList() {
        Promise<List<FileInfo>> promise = Promise.promise();
@@ -414,11 +414,70 @@ public class IzToolWithAuth extends PanBase {

    private void down(HttpResponse<Buffer> res2) {
        MultiMap headers = res2.headers();
-        if (!headers.contains("Location") || StringUtils.isBlank(headers.get("Location"))) {
-            fail("找不到下载链接可能服务器已被禁止或者配置的认证信息有误");
+        String location = headers.get("Location");
+        if (StringUtils.isBlank(location)) {
+            fail("{}", buildMissingLocationMessage(res2));
            return;
        }
-        promise.complete(headers.get("Location"));
+        promise.complete(location);
+    }
+
+    private String buildMissingLocationMessage(HttpResponse<Buffer> response) {
+        StringBuilder message = new StringBuilder("未获取到下载重定向地址");
+        message.append(", HTTP ").append(response.statusCode());
+
+        String body = null;
+        try {
+            body = asText(response);
+        } catch (Exception e) {
+            body = "<响应体读取失败: " + e.getMessage() + ">";
+        }
+
+        if (StringUtils.isNotBlank(body)) {
+            try {
+                JsonObject json = new JsonObject(body);
+                String upstreamMsg = json.getString("msg");
+                Object code = json.getValue("code");
+                if (StringUtils.isNotBlank(upstreamMsg)) {
+                    message.append(", 上游返回: ").append(upstreamMsg);
+                    if (code != null) {
+                        message.append(" (code=").append(code).append(")");
+                    }
+                } else {
+                    message.append(", 响应体: ").append(previewBody(body));
+                }
+            } catch (Exception ignored) {
+                message.append(", 响应体: ").append(previewBody(body));
+            }
+        } else {
+            message.append(", 响应体为空");
+        }
+
+        Object fileName = shareLinkInfo.getOtherParam().get("fileName");
+        Object fileSize = shareLinkInfo.getOtherParam().get("fileSizeFormat");
+        if (fileName != null) {
+            message.append(", 文件: ").append(fileName);
+        }
+        if (fileSize != null) {
+            message.append(", 大小: ").append(fileSize);
+        }
+        if (!hasConfiguredAuth()) {
+            message.append(", 当前为免登录解析，上游可能要求登录、会员或人工处理");
+        }
+        return message.toString();
+    }
+
+    private boolean hasConfiguredAuth() {
+        Object authObj = shareLinkInfo.getOtherParam().get("auths");
+        if (!(authObj instanceof MultiMap auths)) {
+            return false;
+        }
+        return StringUtils.isNotBlank(auths.get("username")) && StringUtils.isNotBlank(auths.get("password"));
+    }
+
+    private String previewBody(String body) {
+        int maxLength = 500;
+        return body.length() <= maxLength ? body : body.substring(0, maxLength) + "...";
    }

    // 目录解析
@@ -15,6 +15,7 @@ import java.net.URLEncoder;
 import java.util.ArrayList;
 import java.util.Base64;
 import java.util.List;
+import java.util.Random;
 import java.util.UUID;

 /**
@@ -24,6 +25,7 @@ public class LeTool extends PanBase {
    private static final String API_URL_PREFIX = "https://lecloud.lenovo.com/mshare/api/clouddiskapi/share/public/v1/";
    private static final String DEFAULT_FILE_TYPE = "file";
    private static final int FILE_TYPE_DIRECTORY = 0; // 目录类型
+    private static final Random RANDOM = new Random();

    private static final MultiMap HEADERS;

@@ -100,8 +102,8 @@ public class LeTool extends PanBase {
                                }
                                
                                String fileId = fileInfoJson.getString("fileId");
-                                // 根据文件ID获取跳转链接
-                                getDownURL(dataKey, fileId);
+                                // 根据文件ID获取跳转链接（随机选择方式，失败自动fallback）
+                                getDownURLWithFallback(dataKey, fileId);
                            }
                        } else {
                            fail("{}: {}", resJson.getString("errcode"), resJson.getString("errmsg"));
@@ -260,8 +262,8 @@ public class LeTool extends PanBase {
            String shareId = paramJson.getString("shareId");
            String fileId = paramJson.getString("fileId");
            
-            // 调用获取下载链接
-            getDownURLForById(shareId, fileId, parsePromise);
+            // 调用获取下载链接（随机选择方式，失败自动fallback）
+            getDownURLWithFallbackForById(shareId, fileId, parsePromise);
            
        } catch (Exception e) {
            parsePromise.fail("解析参数失败: " + e.getMessage());
@@ -304,14 +306,22 @@ public class LeTool extends PanBase {
                }).onFailure(err -> promise.fail(err));
    }

-    private void getDownURL(String key, String fileId) {
+    /**
+     * 通过 packageDownloadWithFileIds 接口获取下载链接
+     * 需要两步：先获取 downloadUrl，再请求 302 跳转
+     *
+     * @param shareId 分享ID
+     * @param fileId 文件ID
+     * @param promise 完成时会写入此 promise
+     */
+    private void getDownURL(String shareId, String fileId, Promise<String> promise) {
        String uuid = UUID.randomUUID().toString();
        JsonArray fileIds = JsonArray.of(fileId);
-        String apiUrl2 = API_URL_PREFIX + "packageDownloadWithFileIds";
+        String apiUrl = API_URL_PREFIX + "packageDownloadWithFileIds";
        // {"fileIds":[123],"shareId":"xxx","browserId":"uuid"}
-        client.postAbs(apiUrl2)
+        client.postAbs(apiUrl)
            .putHeaders(HEADERS)
-            .sendJsonObject(JsonObject.of("fileIds", fileIds, "shareId", key, "browserId", uuid))
+            .sendJsonObject(JsonObject.of("fileIds", fileIds, "shareId", shareId, "browserId", uuid))
                .onSuccess(res -> {
                    JsonObject resJson = asJson(res);
                    if (resJson.containsKey("result")) {
@@ -320,20 +330,107 @@ public class LeTool extends PanBase {
                            // 获取重定向链接跳转链接
                            String downloadUrl = dataJson.getString("downloadUrl");
                            if (downloadUrl == null) {
-                                fail("Result JSON数据异常: downloadUrl不存在");
+                                promise.fail("Result JSON数据异常: downloadUrl不存在");
                                return;
                            }
                            // 获取重定向链接跳转链接
                            clientNoRedirects.getAbs(downloadUrl).send()
                                    .onSuccess(res2 -> promise.complete(res2.headers().get("Location")))
-                                    .onFailure(handleFail(downloadUrl));
+                                    .onFailure(err -> promise.fail(err));
                        } else {
-                            fail("{}: {}", resJson.getString("errcode"), resJson.getString("errmsg"));
+                            promise.fail(resJson.getString("errcode") + ": " + resJson.getString("errmsg"));
                        }
                    } else {
-                        fail("Result JSON数据异常: result字段不存在");
+                        promise.fail("Result JSON数据异常: result字段不存在");
                    }
-                }).onFailure(handleFail(apiUrl2));
+                }).onFailure(err -> promise.fail(err));
+    }
+
+    /**
+     * 通过 directDownload 接口获取下载链接
+     * 相比 packageDownloadWithFileIds 少一次请求，直接返回302
+     *
+     * @param shareId 分享ID
+     * @param fileId 文件ID
+     * @param promise 完成时会写入此 promise
+     */
+    private void getDownURLDirect(String shareId, String fileId, Promise<String> promise) {
+        String uuid = UUID.randomUUID().toString();
+        String apiUrl = API_URL_PREFIX + "directDownload"
+                + "?shareId=" + shareId
+                + "&fileId=" + fileId
+                + "&browserId=" + uuid;
+
+        clientNoRedirects.getAbs(apiUrl)
+            .putHeaders(HEADERS)
+            .send()
+            .onSuccess(res -> {
+                String location = res.headers().get("Location");
+                if (location != null && !location.isEmpty()) {
+                    promise.complete(location);
+                } else {
+                    log.warn("directDownload 返回非302响应: shareId={}, fileId={}, statusCode={}", shareId, fileId, res.statusCode());
+                    promise.fail("directDownload 未返回有效的 Location, statusCode=" + res.statusCode());
+                }
+            })
+            .onFailure(err -> {
+                log.warn("directDownload 请求失败: shareId={}, fileId={}, error={}", shareId, fileId, err.getMessage());
+                promise.fail(err);
+            });
+    }
+
+    /**
+     * 随机选择下载方式并带 fallback（用于 parse）
+     * 先随机选择 directDownload 或 packageDownloadWithFileIds，失败则尝试另一个
+     */
+    private void getDownURLWithFallback(String shareId, String fileId) {
+        boolean useDirect = RANDOM.nextBoolean();
+        log.info("乐云下载方式选择: shareId={}, fileId={}, method={}", shareId, fileId, useDirect ? "directDownload" : "packageDownloadWithFileIds");
+
+        Promise<String> fallbackPromise = Promise.promise();
+        fallbackPromise.future().onSuccess(url -> {
+            promise.complete(url);
+        }).onFailure(err -> {
+            log.warn("乐云第一种下载方式失败，尝试另一种: {}", err.getMessage());
+            if (useDirect) {
+                getDownURL(shareId, fileId, promise);
+            } else {
+                getDownURLDirect(shareId, fileId, promise);
+            }
+        });
+
+        if (useDirect) {
+            getDownURLDirect(shareId, fileId, fallbackPromise);
+        } else {
+            getDownURL(shareId, fileId, fallbackPromise);
+        }
+    }
+
+    /**
+     * 随机选择下载方式并带 fallback（用于 parseById）
+     * 先随机选择 directDownload 或 packageDownloadWithFileIds，失败则尝试另一个
+     */
+    private void getDownURLWithFallbackForById(String shareId, String fileId, Promise<String> promise) {
+        boolean useDirect = RANDOM.nextBoolean();
+        log.info("乐云下载方式选择(parseById): shareId={}, fileId={}, method={}", shareId, fileId, useDirect ? "directDownload" : "packageDownloadWithFileIds");
+
+        Promise<String> fallbackPromise = Promise.promise();
+        fallbackPromise.future().onSuccess(url -> {
+            promise.complete(url);
+        }).onFailure(err -> {
+            log.warn("乐云第一种下载方式失败，尝试另一种: {}", err.getMessage());
+            if (useDirect) {
+                getDownURLForById(shareId, fileId, promise);
+            } else {
+                getDownURLDirect(shareId, fileId, promise);
+            }
+        });
+
+        if (useDirect) {
+            getDownURLDirect(shareId, fileId, fallbackPromise);
+        } else {
+            getDownURLForById(shareId, fileId, fallbackPromise);
+        }
    }

    /**
@@ -15,6 +15,8 @@ import org.openjdk.nashorn.api.scripting.ScriptObjectMirror;

 import javax.script.ScriptException;
 import java.net.MalformedURLException;
+import java.time.LocalDate;
+import java.time.LocalDateTime;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
@@ -31,6 +33,20 @@ public class LzTool extends PanBase {
    WebClientSession webClientSession = WebClientSession.create(clientNoRedirects);

    public static final String SHARE_URL_PREFIX = "https://w1.lanzn.com/";
+
+    // 静态编译的正则表达式，避免每次调用都重新编译
+    private static final Pattern FILE_NAME_PATTERN = Pattern.compile("padding: 56px 0px 20px 0px;\">(.*?)<|filenajax\">(.*?)<");
+    private static final Pattern FILE_SIZE_PATTERN = Pattern.compile(">文件大小：</span>(.*?)<br>|\"n_filesize\">大小：(.*?)</div>");
+    private static final Pattern SHARE_USER_PATTERN = Pattern.compile(">分享用户：</span><font>(.*?)</font>|获取<span>(.*?)</span>的文件|\"user-name\">(.*?)</");
+    private static final Pattern DESCRIPTION_PATTERN = Pattern.compile("(?s)文件描述：</span><br>(.*?)</td>|class=\"n_box_des\">(.*?)</div>");
+    private static final Pattern FILE_ID_PATTERN = Pattern.compile("\\?f=(.*?)&|fid = (.*?);");
+    private static final Pattern CREATE_TIME_PATTERN = Pattern.compile(">上传时间：</span>(.*?)<");
+    private static final Pattern URL_DATE_PATTERN = Pattern.compile("(\\d{4}/\\d{1,2}/\\d{1,2})");
+    private static final Pattern ARG1_PATTERN = Pattern.compile("var arg1='([^']+)'");
+    private static final Pattern IFRAME_SRC_PATTERN = Pattern.compile("src=\"(/fn\\?[a-zA-Z\\d_+/=]{16,})\"");
+    private static final Pattern RELATIVE_TIME_PATTERN = Pattern.compile("^(\\d+|几)\\s*(分钟|小时)前$");
+    private static final Pattern DATE_PATTERN = Pattern.compile("^(\\d{4})\\s*[-/年]\\s*(\\d{1,2})\\s*[-/月]\\s*(\\d{1,2})\\s*日?$");
+    private static final Pattern MONTH_DAY_PATTERN = Pattern.compile("^(\\d{1,2})\\s*月\\s*(\\d{1,2})\\s*日?$");
    MultiMap headers0 = HeaderUtils.parseHeaders("""
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
        Accept-Encoding: gzip, deflate
@@ -62,19 +78,30 @@ public class LzTool extends PanBase {
        client.getAbs(sUrl)
                .putHeaders(headers0)
                .send().onSuccess(res -> {
-                    String html = asText(res);
-                    if (html.contains("var arg1='")) {
-                        webClientSession = WebClientSession.create(clientNoRedirects);
-                        setCookie(html, sUrl);
-                        webClientSession.getAbs(sUrl)
-                                .putHeaders(headers0)
-                                .send().onSuccess(res2 -> {
-                                    String html2 = asText(res2);
-                                    doParser(html2, pwd, sUrl);
-                                });
+                    try {
+                        String html = asText(res);
+                        if (hasAcwArg1(html)) {
+                            webClientSession = WebClientSession.create(clientNoRedirects);
+                            if (!setCookie(html, sUrl)) {
+                                fail("蓝奏云反爬 arg1 Cookie 解析失败，页面内容异常");
+                                return;
+                            }
+                            webClientSession.getAbs(sUrl)
+                                    .putHeaders(headers0)
+                                    .send().onSuccess(res2 -> {
+                                        try {
+                                            String html2 = asText(res2);
+                                            doParser(html2, pwd, sUrl);
+                                        } catch (Exception e) {
+                                            fail("蓝奏云页面响应处理异常: {}", e.getMessage());
+                                        }
+                                    }).onFailure(handleFail(sUrl));

-                    } else {
-                        doParser(html, pwd, sUrl);
+                        } else {
+                            doParser(html, pwd, sUrl);
+                        }
+                    } catch (Exception e) {
+                        fail("蓝奏云页面响应处理异常: {}", e.getMessage());
                    }

                }).onFailure(handleFail(sUrl));
@@ -82,22 +109,41 @@ public class LzTool extends PanBase {
    }

    private void doParser(String html, String pwd, String sUrl) {
+        if (html == null || html.isBlank()) {
+            fail("蓝奏云页面响应为空");
+            return;
+        }
+        if (isShareCancelledPage(html)) {
+            fail("分享已失效或文件已取消分享");
+            return;
+        }
        // 检测是否为目录分享链接 (含 /s/、/b/ 路径段或 b 开头的路径段)
        if (sUrl.matches(".*/(s|b)/[^/]+.*") || sUrl.matches(".*/b[^/]+.*")) {
            fail("该链接为蓝奏云目录分享，请使用目录解析接口");
            return;
        }
        // 若仍是校验页 (parse()中cookie域名与实际URL不匹配时会出现), 重试一次
-        if (html.contains("var arg1='")) {
+        if (hasAcwArg1(html)) {
            webClientSession = WebClientSession.create(clientNoRedirects);
-            setCookie(html, sUrl);
+            if (!setCookie(html, sUrl)) {
+                fail("蓝奏云反爬 arg1 Cookie 解析失败，页面内容异常");
+                return;
+            }
            webClientSession.getAbs(sUrl).putHeaders(headers0).send().onSuccess(res -> {
-                String html2 = asText(res);
-                if (html2.contains("var arg1='")) {
-                    fail("蓝奏云反爬校验失败，请稍后重试");
-                    return;
+                try {
+                    String html2 = asText(res);
+                    if (isShareCancelledPage(html2)) {
+                        fail("分享已失效或文件已取消分享");
+                        return;
+                    }
+                    if (hasAcwArg1(html2)) {
+                        fail("蓝奏云反爬校验失败，请稍后重试");
+                        return;
+                    }
+                    doParserInternal(html2, pwd, sUrl);
+                } catch (Exception e) {
+                    fail("蓝奏云页面响应处理异常: {}", e.getMessage());
                }
-                doParserInternal(html2, pwd, sUrl);
            }).onFailure(handleFail(sUrl));
            return;
        }
@@ -105,14 +151,21 @@ public class LzTool extends PanBase {
    }

    private void doParserInternal(String html, String pwd, String sUrl) {
+        if (html == null || html.isBlank()) {
+            fail("蓝奏云页面响应为空");
+            return;
+        }
+        if (isShareCancelledPage(html)) {
+            fail("分享已失效或文件已取消分享");
+            return;
+        }
        try {
            setFileInfo(html, shareLinkInfo);
        } catch (Exception e) {
            log.error("文件信息解析异常", e);
        }
        // 匹配iframe
-        Pattern compile = Pattern.compile("src=\"(/fn\\?[a-zA-Z\\d_+/=]{16,})\"");
-        Matcher matcher = compile.matcher(html);
+        Matcher matcher = IFRAME_SRC_PATTERN.matcher(html);
        // 没有Iframe说明是加密分享, 匹配sign通过密码请求下载页面
        if (!matcher.find()) {
            try {
@@ -126,46 +179,64 @@ public class LzTool extends PanBase {
            // 没有密码
            String iframePath = matcher.group(1);
            String absoluteURI = SHARE_URL_PREFIX + iframePath;
-            webClientSession.getAbs(absoluteURI).putHeaders(headers0).send().onSuccess(res2 -> {
-                String html2 = asText(res2);
-                String jsText = getJsText(html2);
-                if (jsText == null) {
-                    headers0.add("Referer", absoluteURI);
-                    setCookie(html2, absoluteURI);
-                    webClientSession.getAbs(absoluteURI).send().onSuccess(res3 -> {
-                        String html3 = asText(res3);
-                        String jsText3 = getJsText(html3);
-                        if (jsText3 != null) {
-                            try {
-                                ScriptObjectMirror scriptObjectMirror = JsExecUtils.executeDynamicJs(jsText3, null);
-                                getDownURL(sUrl, scriptObjectMirror);
-                            } catch (ScriptException | NoSuchMethodException e) {
-                                fail(e, "引擎执行失败");
-                            }
-                        } else {
-                            fail(SHARE_URL_PREFIX + iframePath + " -> " + sUrl + ": 获取失败0, 可能分享已失效");
-                        }
-                    });
-                } else {
-                    try {
-                        ScriptObjectMirror scriptObjectMirror = JsExecUtils.executeDynamicJs(jsText, null);
-                        getDownURL(sUrl, scriptObjectMirror);
-                    } catch (ScriptException | NoSuchMethodException e) {
-                        fail(e, "js引擎执行失败");
+            // 创建局部副本，避免修改实例字段导致累积
+            MultiMap headersCopy = MultiMap.caseInsensitiveMultiMap().addAll(headers0);
+            headersCopy.add("Referer", absoluteURI);
+            webClientSession.getAbs(absoluteURI).putHeaders(headersCopy).send().onSuccess(res2 -> {
+                try {
+                    String html2 = asText(res2);
+                    if (isShareCancelledPage(html2)) {
+                        fail("分享已失效或文件已取消分享");
+                        return;
                    }
+                    String jsText = getJsText(html2);
+                    if (jsText == null) {
+                        if (!setCookie(html2, absoluteURI)) {
+                            fail("蓝奏云反爬 arg1 Cookie 解析失败，页面内容异常");
+                            return;
+                        }
+                        webClientSession.getAbs(absoluteURI).send().onSuccess(res3 -> {
+                            try {
+                                String html3 = asText(res3);
+                                if (isShareCancelledPage(html3)) {
+                                    fail("分享已失效或文件已取消分享");
+                                    return;
+                                }
+                                String jsText3 = getJsText(html3);
+                                if (jsText3 != null) {
+                                    try {
+                                        ScriptObjectMirror scriptObjectMirror = JsExecUtils.executeDynamicJs(jsText3, null);
+                                        getDownURL(sUrl, scriptObjectMirror);
+                                    } catch (ScriptException | NoSuchMethodException e) {
+                                        fail(e, "引擎执行失败");
+                                    }
+                                } else {
+                                    fail(SHARE_URL_PREFIX + iframePath + " -> " + sUrl + ": 获取失败0, 可能分享已失效");
+                                }
+                            } catch (Exception e) {
+                                fail("蓝奏云 iframe 响应处理异常: {}", e.getMessage());
+                            }
+                        }).onFailure(handleFail(absoluteURI));
+                    } else {
+                        try {
+                            ScriptObjectMirror scriptObjectMirror = JsExecUtils.executeDynamicJs(jsText, null);
+                            getDownURL(sUrl, scriptObjectMirror);
+                        } catch (ScriptException | NoSuchMethodException e) {
+                            fail(e, "js引擎执行失败");
+                        }
+                    }
+                } catch (Exception e) {
+                    fail("蓝奏云 iframe 响应处理异常: {}", e.getMessage());
                }
            }).onFailure(handleFail(SHARE_URL_PREFIX));
        }
    }

-    private void setCookie(String html, String url) {
-        int beginIndex = html.indexOf("arg1='") + 6;
-        int endIndex = html.indexOf("';", beginIndex);
-        if (beginIndex < 6 || endIndex == -1 || endIndex <= beginIndex) {
-            fail("蓝奏云反爬 arg1 Cookie 解析失败，页面内容异常");
-            return;
+    private boolean setCookie(String html, String url) {
+        String arg1 = extractAcwArg1(html);
+        if (arg1 == null) {
+            return false;
        }
-        String arg1 = html.substring(beginIndex, endIndex);
        String acw_sc__v2 = AcwScV2Generator.acwScV2Simple(arg1);
        // 从 URL 中动态提取域名（如 lanzoum.com, lanzoux.com 等）
        String domain = ".lanzn.com"; // 默认兜底
@@ -184,6 +255,7 @@ public class LzTool extends PanBase {
        nettyCookie.setSecure(false);
        nettyCookie.setHttpOnly(false);
        webClientSession.cookieStore().put(nettyCookie);
+        return true;
    }

    private String getJsByPwd(String pwd, String html, String subText) {
@@ -201,6 +273,9 @@ public class LzTool extends PanBase {
    }

    private String getJsText(String html) {
+        if (html == null) {
+            return null;
+        }
        String jsTagStart = "<script type=\"text/javascript\">";
        String jsTagEnd = "</script>";
        int index = html.lastIndexOf(jsTagStart);
@@ -209,9 +284,38 @@ public class LzTool extends PanBase {
        }
        int startPos = index + jsTagStart.length();
        int endPos = html.indexOf(jsTagEnd, startPos);
+        if (endPos <= startPos) {
+            return null;
+        }
        return html.substring(startPos, endPos).replaceAll("<!--.*-->", "");
    }

+    static String extractAcwArg1(String html) {
+        if (html == null) {
+            return null;
+        }
+        int beginIndex = html.indexOf("arg1='");
+        if (beginIndex < 0) {
+            return null;
+        }
+        beginIndex += 6;
+        int endIndex = html.indexOf("';", beginIndex);
+        if (endIndex <= beginIndex) {
+            return null;
+        }
+        return html.substring(beginIndex, endIndex);
+    }
+
+    static boolean isShareCancelledPage(String html) {
+        return html != null
+                && ((html.contains("来晚啦") && html.contains("取消分享"))
+                || (html.contains("class=\"off\"") && html.contains("取消分享")));
+    }
+
+    private static boolean hasAcwArg1(String html) {
+        return html != null && html.contains("var arg1='");
+    }
+
    private void getDownURL(String key, Map<String, ?> obj) {
        if (obj == null) {
            fail("需要访问密码");
@@ -225,7 +329,7 @@ public class LzTool extends PanBase {
        });
        MultiMap headers = HeaderUtils.parseHeaders("""
                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
-                Accept-Encoding: gzip, deflate, br, zstd
+                Accept-Encoding: gzip, deflate, br
                Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
                Cache-Control: no-cache
                Connection: keep-alive
@@ -261,42 +365,57 @@ public class LzTool extends PanBase {
                headers.remove("Referer");
                webClientSession.getAbs(downUrl).putHeaders(headers).send()
                        .onSuccess(res3 -> {
-                            String location = res3.headers().get("Location");
-                            if (location == null) {
-                                String text = asText(res3);
-                                // 使用cookie 再请求一次
-                                headers.add("Referer", downUrl);
-                                int beginIndex = text.indexOf("arg1='") + 6;
-                                String arg1 = text.substring(beginIndex, text.indexOf("';", beginIndex));
-                                String acw_sc__v2 = AcwScV2Generator.acwScV2Simple(arg1);
-                                // 从 downUrl 中动态提取域名
-                                String downDomain = ".lanrar.com";
-                                try {
-                                    java.net.URL du = new java.net.URL(downUrl);
-                                    String h = du.getHost();
-                                    int dot = h.indexOf('.');
-                                    if (dot >= 0) downDomain = h.substring(dot);
-                                } catch (MalformedURLException ignored) {}
-                                // 创建一个 Cookie 并放入 CookieStore
-                                DefaultCookie nettyCookie = new DefaultCookie("acw_sc__v2", acw_sc__v2);
-                                nettyCookie.setDomain(downDomain);
-                                nettyCookie.setPath("/");
-                                nettyCookie.setSecure(false);
-                                nettyCookie.setHttpOnly(false);
-                                WebClientSession webClientSession2 = WebClientSession.create(clientNoRedirects);
-                                webClientSession2.cookieStore().put(nettyCookie);
-                                webClientSession2.getAbs(downUrl).putHeaders(headers).send()
-                                        .onSuccess(res4 -> {
-                                            String location0 = res4.headers().get("Location");
-                                            if (location0 == null) {
-                                                fail(downUrl + " -> 直链获取失败2, 可能分享已失效");
-                                            } else {
-                                                setDateAndComplete(location0);
-                                            }
-                                        }).onFailure(handleFail(downUrl));
-                                return;
+                            try {
+                                String location = res3.headers().get("Location");
+                                if (location == null) {
+                                    String text = asText(res3);
+                                    if (isShareCancelledPage(text)) {
+                                        fail(downUrl + " -> 分享已失效或文件已取消分享");
+                                        return;
+                                    }
+                                    // 使用cookie 再请求一次
+                                    headers.add("Referer", downUrl);
+                                    String arg1 = extractAcwArg1(text);
+                                    if (arg1 == null) {
+                                        fail(downUrl + " -> 蓝奏云反爬 arg1 Cookie 解析失败，可能分享已失效");
+                                        return;
+                                    }
+                                    String acw_sc__v2 = AcwScV2Generator.acwScV2Simple(arg1);
+                                    // 从 downUrl 中动态提取域名
+                                    String downDomain = ".lanrar.com";
+                                    try {
+                                        java.net.URL du = new java.net.URL(downUrl);
+                                        String h = du.getHost();
+                                        int dot = h.indexOf('.');
+                                        if (dot >= 0) downDomain = h.substring(dot);
+                                    } catch (MalformedURLException ignored) {}
+                                    // 创建一个 Cookie 并放入 CookieStore
+                                    DefaultCookie nettyCookie = new DefaultCookie("acw_sc__v2", acw_sc__v2);
+                                    nettyCookie.setDomain(downDomain);
+                                    nettyCookie.setPath("/");
+                                    nettyCookie.setSecure(false);
+                                    nettyCookie.setHttpOnly(false);
+                                    WebClientSession webClientSession2 = WebClientSession.create(clientNoRedirects);
+                                    webClientSession2.cookieStore().put(nettyCookie);
+                                    webClientSession2.getAbs(downUrl).putHeaders(headers).send()
+                                            .onSuccess(res4 -> {
+                                                try {
+                                                    String location0 = res4.headers().get("Location");
+                                                    if (location0 == null) {
+                                                        fail(downUrl + " -> 直链获取失败2, 可能分享已失效");
+                                                    } else {
+                                                        setDateAndComplete(location0);
+                                                    }
+                                                } catch (Exception e) {
+                                                    fail("蓝奏云直链二次响应处理异常: {}", e.getMessage());
+                                                }
+                                            }).onFailure(handleFail(downUrl));
+                                    return;
+                                }
+                                setDateAndComplete(location);
+                            } catch (Exception e) {
+                                fail("蓝奏云直链响应处理异常: {}", e.getMessage());
                            }
-                            setDateAndComplete(location);
                        })
                        .onFailure(handleFail(downUrl));
            } catch (Exception e) {
@@ -307,10 +426,9 @@ public class LzTool extends PanBase {

    private void setDateAndComplete(String location0) {
        // 分享时间 提取url中的时间戳格式：lanzoui.com/abc/abc/yyyy/mm/dd/
-        String regex = "(\\d{4}/\\d{1,2}/\\d{1,2})";
-        Matcher matcher = Pattern.compile(regex).matcher(location0);
+        Matcher matcher = URL_DATE_PATTERN.matcher(location0);
        if (matcher.find()) {
-            String dateStr = matcher.group().replace("/", "-");
+            String dateStr = parseLanzouFileTime(matcher.group());
            ((FileInfo)shareLinkInfo.getOtherParam().get("fileInfo")).setCreateTime(dateStr);
        }
        promise.complete(location0);
@@ -338,26 +456,45 @@ public class LzTool extends PanBase {
        String pwd = shareLinkInfo.getSharePassword();

        webClientSession.getAbs(sUrl).send().onSuccess(res -> {
-            String html = asText(res);
-            // 检查是否需要 cookie 验证
-            if (html.contains("var arg1='")) {
-                webClientSession = WebClientSession.create(clientNoRedirects);
-                setCookie(html, sUrl);
-                // 重新请求
-                webClientSession.getAbs(sUrl).send().onSuccess(res2 -> {
-                    handleFileListParse(asText(res2), pwd, sUrl, promise);
-                }).onFailure(err -> promise.fail(err));
-                return;
+            try {
+                String html = asText(res);
+                // 检查是否需要 cookie 验证
+                if (hasAcwArg1(html)) {
+                    webClientSession = WebClientSession.create(clientNoRedirects);
+                    if (!setCookie(html, sUrl)) {
+                        promise.tryFail(baseMsg() + "蓝奏云反爬 arg1 Cookie 解析失败，页面内容异常");
+                        return;
+                    }
+                    // 重新请求
+                    webClientSession.getAbs(sUrl).send().onSuccess(res2 -> {
+                        try {
+                            handleFileListParse(asText(res2), pwd, sUrl, promise);
+                        } catch (Exception e) {
+                            promise.tryFail(e);
+                        }
+                    }).onFailure(promise::tryFail);
+                    return;
+                }
+                handleFileListParse(html, pwd, sUrl, promise);
+            } catch (Exception e) {
+                promise.tryFail(e);
            }
-            handleFileListParse(html, pwd, sUrl, promise);
-        }).onFailure(err -> promise.fail(err));
+        }).onFailure(promise::tryFail);
        return promise.future();
    }

    private void handleFileListParse(String html, String pwd, String sUrl, Promise<List<FileInfo>> promise) {
+        if (html == null || html.isBlank()) {
+            promise.tryFail(baseMsg() + "蓝奏云页面响应为空");
+            return;
+        }
+        if (isShareCancelledPage(html)) {
+            promise.tryFail(baseMsg() + "分享已失效或文件已取消分享");
+            return;
+        }
        // 检测是否为文件分享链接 (不含 /s/、/b/ 路径段且不含 b 开头的路径段)
        if (!sUrl.matches(".*/(s|b)/[^/]+.*") && !sUrl.matches(".*/b[^/]+.*")) {
-            promise.fail(baseMsg() + "该链接为蓝奏云文件分享，请使用文件解析接口");
+            promise.tryFail(baseMsg() + "该链接为蓝奏云文件分享，请使用文件解析接口");
            return;
        }
        try {
@@ -371,28 +508,43 @@ public class LzTool extends PanBase {

            String url = SHARE_URL_PREFIX + "filemoreajax.php?file=" + data.get("fid");
            webClientSession.postAbs(url).putHeaders(headers).sendForm(map).onSuccess(res2 -> {
-                String resBody = asText(res2);
-                // 再次检查是否需要 cookie 验证
-                if (resBody.contains("var arg1='")) {
-                    setCookie(resBody, url);
-                    // 重新请求
-                    webClientSession.postAbs(url).putHeaders(headers).sendForm(map).onSuccess(res3 -> {
-                        handleFileListResponse(asText(res3), promise);
-                    }).onFailure(err -> promise.fail(err));
-                    return;
+                try {
+                    String resBody = asText(res2);
+                    // 再次检查是否需要 cookie 验证
+                    if (hasAcwArg1(resBody)) {
+                        if (!setCookie(resBody, url)) {
+                            promise.tryFail(baseMsg() + "蓝奏云反爬 arg1 Cookie 解析失败，页面内容异常");
+                            return;
+                        }
+                        // 重新请求
+                        webClientSession.postAbs(url).putHeaders(headers).sendForm(map).onSuccess(res3 -> {
+                            try {
+                                handleFileListResponse(asText(res3), promise);
+                            } catch (Exception e) {
+                                promise.tryFail(e);
+                            }
+                        }).onFailure(promise::tryFail);
+                        return;
+                    }
+                    handleFileListResponse(resBody, promise);
+                } catch (Exception e) {
+                    promise.tryFail(e);
                }
-                handleFileListResponse(resBody, promise);
-            }).onFailure(err -> promise.fail(err));
+            }).onFailure(promise::tryFail);
        } catch (ScriptException | NoSuchMethodException | RuntimeException e) {
-            promise.fail(e);
+            promise.tryFail(e);
        }
    }

    private void handleFileListResponse(String responseBody, Promise<List<FileInfo>> promise) {
        try {
+            if (responseBody == null || responseBody.isBlank()) {
+                promise.tryFail(baseMsg() + "蓝奏云文件列表响应为空");
+                return;
+            }
            JsonObject fileListJson = new JsonObject(responseBody);
            if (fileListJson.getInteger("zt") != 1) {
-                promise.fail(baseMsg() + fileListJson.getString("info"));
+                promise.tryFail(baseMsg() + fileListJson.getString("info"));
                return;
            }
            List<FileInfo> list = new ArrayList<>();
@@ -423,7 +575,7 @@ public class LzTool extends PanBase {
                String param = CommonUtils.urlBase64Encode(paramJson.encode());
                fileInfo.setFileName(fileName)
                        .setFileId(id)
-                        .setCreateTime(fileJson.getString("time"))
+                        .setCreateTime(parseLanzouFileTime(fileJson.getString("time")))
                        .setFileType(fileJson.getString("icon"))
                        .setSizeStr(fileJson.getString("size"))
                        .setSize(sizeNum)
@@ -436,10 +588,46 @@ public class LzTool extends PanBase {
            });
            promise.complete(list);
        } catch (Exception e) {
-            promise.fail(e);
+            promise.tryFail(e);
        }
    }

+    private static String parseLanzouFileTime(String timeText) {
+        if (timeText == null || timeText.isBlank()) {
+            return timeText;
+        }
+        String normalized = timeText.trim().replaceAll("\\s+", " ");
+        Matcher matcher = RELATIVE_TIME_PATTERN.matcher(normalized);
+        if (matcher.matches()) {
+            int amount = "几".equals(matcher.group(1)) ? 1 : Integer.parseInt(matcher.group(1));
+            String unit = matcher.group(2);
+            LocalDateTime time = LocalDateTime.now();
+            if ("小时".equals(unit)) {
+                time = time.minusHours(amount);
+            } else {
+                time = time.minusMinutes(amount);
+            }
+            return time.toLocalDate().toString();
+        }
+        matcher = DATE_PATTERN.matcher(normalized);
+        if (matcher.matches()) {
+            return LocalDate.of(
+                    Integer.parseInt(matcher.group(1)),
+                    Integer.parseInt(matcher.group(2)),
+                    Integer.parseInt(matcher.group(3))
+            ).toString();
+        }
+        matcher = MONTH_DAY_PATTERN.matcher(normalized);
+        if (matcher.matches()) {
+            return LocalDate.of(
+                    LocalDate.now().getYear(),
+                    Integer.parseInt(matcher.group(1)),
+                    Integer.parseInt(matcher.group(2))
+            ).toString();
+        }
+        return normalized;
+    }
+
    @Override
    public Future<String> parseById() {
        JsonObject paramJson = (JsonObject) shareLinkInfo.getOtherParam().get("paramJson");
@@ -455,13 +643,13 @@ public class LzTool extends PanBase {
        shareLinkInfo.getOtherParam().put("fileInfo", fileInfo);
        try {
            // 提取文件名
-            String fileName = CommonUtils.extract(html, Pattern.compile("padding: 56px 0px 20px 0px;\">(.*?)<|filenajax\">(.*?)<"));
-            String sizeStr  = CommonUtils.extract(html, Pattern.compile(">文件大小：</span>(.*?)<br>|\"n_filesize\">大小：(.*?)</div>"));
-            String createBy = CommonUtils.extract(html, Pattern.compile(">分享用户：</span><font>(.*?)</font>|获取<span>(.*?)</span>的文件|\"user-name\">(.*?)</"));
-            String description = CommonUtils.extract(html, Pattern.compile("(?s)文件描述：</span><br>(.*?)</td>|class=\"n_box_des\">(.*?)</div>"));
+            String fileName = CommonUtils.extract(html, FILE_NAME_PATTERN);
+            String sizeStr  = CommonUtils.extract(html, FILE_SIZE_PATTERN);
+            String createBy = CommonUtils.extract(html, SHARE_USER_PATTERN);
+            String description = CommonUtils.extract(html, DESCRIPTION_PATTERN);
            // String icon = CommonUtils.extract(html, Pattern.compile("class=\"n_file_icon\" src=\"(.*?)\""));
-            String fileId = CommonUtils.extract(html, Pattern.compile("\\?f=(.*?)&|fid = (.*?);"));
-            String createTime = CommonUtils.extract(html, Pattern.compile(">上传时间：</span>(.*?)<"));
+            String fileId = CommonUtils.extract(html, FILE_ID_PATTERN);
+            String createTime = CommonUtils.extract(html, CREATE_TIME_PATTERN);
            try {
                fileInfo.setFileName(fileName)
                        .setCreateBy(createBy)
@@ -469,7 +657,7 @@ public class LzTool extends PanBase {
                        .setDescription(description)
                        .setFileType("file")
                        .setFileId(fileId)
-                        .setCreateTime(createTime);
+                        .setCreateTime(parseLanzouFileTime(createTime));
                if (sizeStr != null && !sizeStr.isBlank()) {
                    long bytes = FileSizeConverter.convertToBytes(sizeStr);
                    fileInfo.setSize(bytes).setSizeStr(FileSizeConverter.convertToReadableSize(bytes));
@@ -21,6 +21,8 @@ public class MkgsTool extends PanBase {

    public static final String API_URL = "https://m.kugou.com/app/i/getSongInfo.php?cmd=playInfo&hash={hash}";

+    private static final Pattern HASH_PATTERN = Pattern.compile("\"hash\"\\s*:\\s*\"([A-F0-9]+)\"");
+
    private static final MultiMap headers = MultiMap.caseInsensitiveMultiMap();
    static {
        // 设置 User-Agent
@@ -78,10 +80,7 @@ public class MkgsTool extends PanBase {
    protected void downUrl(String locationURL) {
        client.getAbs(locationURL).putHeaders(headers).send().onSuccess(res2->{
            String body = res2.bodyAsString();
-            // 正则表达式匹配 hash 字段
-            String regex = "\"hash\"\s*:\s*\"([A-F0-9]+)\"";
-            Pattern pattern = Pattern.compile(regex);
-            Matcher matcher = pattern.matcher(body);
+            Matcher matcher = HASH_PATTERN.matcher(body);

            // 查找并输出 hash 字段的值
            if (matcher.find()) {
@@ -19,6 +19,8 @@ public class MkwTool extends PanBase {

    public static final String API_URL = "https://www.kuwo.cn/api/v1/www/music/playUrl?mid={mid}&type=music&httpsStatus=1&reqId=&plat=web_www&from=";

+    private static final Pattern COOKIE_PATTERN = Pattern.compile("([A-Za-z0-9_]+)=([A-Za-z0-9]+)");
+

    public MkwTool(ShareLinkInfo shareLinkInfo) {
        super(shareLinkInfo);
@@ -29,39 +31,41 @@ public class MkwTool extends PanBase {
        clientSession.getAbs(shareUrl).send().onSuccess(result -> {
            String cookie = result.headers().get("set-cookie");

-            if (cookie != null && !cookie.isEmpty()) {
-
-                String regex = "([A-Za-z0-9_]+)=([A-Za-z0-9]+)";
-                Pattern pattern = Pattern.compile(regex);
-                Matcher matcher = pattern.matcher(cookie);
-                if (matcher.find()) {
-                    log.debug("cookie key: {}", matcher.group(1));
-                    log.debug("cookie value: {}", matcher.group(2));
-
-                    var key = matcher.group(1);
-                    var token = matcher.group(2);
-                    String sign = JsExecUtils.getKwSign(token, key);
-                    log.debug("sign: {}", sign);
-                    clientSession.getAbs(UriTemplate.of(API_URL)).setTemplateParam("mid", shareLinkInfo.getShareKey())
-                            .putHeader("Secret", sign).send().onSuccess(res -> {
-                                JsonObject json = asJson(res);
-                                log.debug(json.encodePrettily());
-                                try {
-                                    if (json.getInteger("code") == 200) {
-                                        complete(json.getJsonObject("data").getString("url"));
-                                    } else {
-                                        fail("链接已失效/需要VIP");
-                                    }
-
-                                } catch (Exception e) {
-                                    log.error("解析失败", e);
-                                    fail("解析失败");
-                                }
-                            });
-                }
+            if (cookie == null || cookie.isEmpty()) {
+                fail("未获取到 cookie，无法继续解析");
+                return;
            }

-        });
+            Matcher matcher = COOKIE_PATTERN.matcher(cookie);
+            if (!matcher.find()) {
+                fail("cookie 格式不匹配");
+                return;
+            }
+
+            log.debug("cookie key: {}", matcher.group(1));
+            log.debug("cookie value: {}", matcher.group(2));
+
+            var key = matcher.group(1);
+            var token = matcher.group(2);
+            String sign = JsExecUtils.getKwSign(token, key);
+            log.debug("sign: {}", sign);
+            clientSession.getAbs(UriTemplate.of(API_URL)).setTemplateParam("mid", shareLinkInfo.getShareKey())
+                    .putHeader("Secret", sign).send().onSuccess(res -> {
+                        JsonObject json = asJson(res);
+                        log.debug(json.encodePrettily());
+                        try {
+                            if (json.getInteger("code") == 200) {
+                                complete(json.getJsonObject("data").getString("url"));
+                            } else {
+                                fail("链接已失效/需要VIP");
+                            }
+
+                        } catch (Exception e) {
+                            log.error("解析失败", e);
+                            fail("解析失败");
+                        }
+                    }).onFailure(handleFail("获取下载链接失败"));
+        }).onFailure(handleFail("请求分享页面失败"));

        return promise.future();
    }
@@ -16,6 +16,9 @@ import java.util.regex.Pattern;
 * 下载链接需要Referer: https://link.yunpan.com/
 */
 public class P360Tool extends PanBase {
+
+    private static final Pattern NID_PATTERN = Pattern.compile("\"nid\": \"([^\"]+)\"");
+
    public P360Tool(ShareLinkInfo shareLinkInfo) {
        super(shareLinkInfo);
    }
@@ -43,9 +46,7 @@ public class P360Tool extends PanBase {
        clientSession.getAbs(url)
                .send()
                .onSuccess(res -> {
-                    // find  "nid": "17402043311959599"
-                    Pattern compile = Pattern.compile("\"nid\": \"([^\"]+)\"");
-                    Matcher matcher = compile.matcher(res.bodyAsString());
+                    Matcher matcher = NID_PATTERN.matcher(res.bodyAsString());
                    AtomicReference<String> nid = new AtomicReference<>();
                    if (matcher.find()) {
                        nid.set(matcher.group(1));
@@ -69,7 +70,7 @@ public class P360Tool extends PanBase {
                                        clientSession.getAbs(url)
                                                .send()
                                                .onSuccess(res3 -> {
-                                                    Matcher matcher1 = compile.matcher(res3.bodyAsString());
+                                                    Matcher matcher1 = NID_PATTERN.matcher(res3.bodyAsString());
                                                    if (matcher1.find()) {
                                                        nid.set(matcher1.group(1));
                                                    } else {
@@ -14,6 +14,25 @@ import java.util.regex.Pattern;
 */
 public class PcxTool extends PanBase {

+    private static final Pattern TITLE_PATTERN =
+            Pattern.compile("<title>([^<]+)</title>");
+    private static final Pattern FILENAME_INPUT_PATTERN =
+            Pattern.compile("<input id=\"filename\" type=\"hidden\" value=\"([^\"]+)\"");
+    private static final Pattern FILESIZE_PATTERN =
+            Pattern.compile("['\"]filesize['\"]\\s*:\\s*['\"]([^'\"]+)['\"]");
+    private static final Pattern SUFFIX_PATTERN =
+            Pattern.compile("['\"]suffix['\"]\\s*:\\s*['\"]([^'\"]+)['\"]");
+    private static final Pattern OBJECT_ID_PATTERN =
+            Pattern.compile("['\"]objectId['\"]\\s*:\\s*['\"]([^'\"]+)['\"]");
+    private static final Pattern CREATOR_PATTERN =
+            Pattern.compile("['\"]creator['\"]\\s*:\\s*['\"]([^'\"]+)['\"]");
+    private static final Pattern UPLOAD_DATE_PATTERN =
+            Pattern.compile("['\"]uploadDate['\"]\\s*:\\s*(\\d+)");
+    private static final Pattern THUMBNAIL_PATTERN =
+            Pattern.compile("['\"]thumbnail['\"]\\s*:\\s*['\"]([^'\"]+)['\"]");
+    private static final Pattern DOWNLOAD_PATTERN =
+            Pattern.compile("['\"]download['\"]\\s*:\\s*['\"]([^'\"]+)['\"]");
+
    public PcxTool(ShareLinkInfo shareLinkInfo) {
        super(shareLinkInfo);
    }
@@ -44,9 +63,7 @@ public class PcxTool extends PanBase {
     * 从HTML中提取download链接
     */
    private String extractDownloadUrl(String html) {
-        // 匹配 'download': 'https://xxx' 或 "download": "https://xxx"
-        Pattern pattern = Pattern.compile("['\"]download['\"]\\s*:\\s*['\"]([^'\"]+)['\"]");
-        Matcher matcher = pattern.matcher(html);
+        Matcher matcher = DOWNLOAD_PATTERN.matcher(html);
        if (matcher.find()) {
            return matcher.group(1);
        }
@@ -61,13 +78,13 @@ public class PcxTool extends PanBase {
            FileInfo fileInfo = new FileInfo();
            
            // 提取文件名：从<title>标签或文件名input
-            String fileName = extractByRegex(html, "<title>([^<]+)</title>");
+            String fileName = extractByRegex(html, TITLE_PATTERN);
            if (fileName == null) {
-                fileName = extractByRegex(html, "<input id=\"filename\" type=\"hidden\" value=\"([^\"]+)\"");
+                fileName = extractByRegex(html, FILENAME_INPUT_PATTERN);
            }
            
            // 提取文件大小：'filesize': 'xxx' 或 "filesize": "xxx"
-            String fileSizeStr = extractByRegex(html, "['\"]filesize['\"]\\s*:\\s*['\"]([^'\"]+)['\"]");
+            String fileSizeStr = extractByRegex(html, FILESIZE_PATTERN);
            Long fileSize = null;
            if (fileSizeStr != null) {
                try {
@@ -76,19 +93,19 @@ public class PcxTool extends PanBase {
            }
            
            // 提取文件类型/后缀：'suffix': 'xxx' 或 "suffix": "xxx"
-            String suffix = extractByRegex(html, "['\"]suffix['\"]\\s*:\\s*['\"]([^'\"]+)['\"]");
+            String suffix = extractByRegex(html, SUFFIX_PATTERN);
            
            // 提取objectId（文件ID）：'objectId': 'xxx' 或 "objectId": "xxx"
-            String objectId = extractByRegex(html, "['\"]objectId['\"]\\s*:\\s*['\"]([^'\"]+)['\"]");
+            String objectId = extractByRegex(html, OBJECT_ID_PATTERN);
            
            // 提取创建者：'creator': 'xxx' 或 "creator": "xxx"
-            String creator = extractByRegex(html, "['\"]creator['\"]\\s*:\\s*['\"]([^'\"]+)['\"]");
+            String creator = extractByRegex(html, CREATOR_PATTERN);
            
            // 提取上传时间：'uploadDate': timestamp
-            String uploadDate = extractByRegex(html, "['\"]uploadDate['\"]\\s*:\\s*(\\d+)");
+            String uploadDate = extractByRegex(html, UPLOAD_DATE_PATTERN);
            
            // 提取缩略图：'thumbnail': 'xxx' 或 "thumbnail": "xxx"
-            String thumbnail = extractByRegex(html, "['\"]thumbnail['\"]\\s*:\\s*['\"]([^'\"]+)['\"]");
+            String thumbnail = extractByRegex(html, THUMBNAIL_PATTERN);
            
            // 设置文件信息
            if (fileName != null) {
@@ -141,8 +158,7 @@ public class PcxTool extends PanBase {
    /**
     * 使用正则表达式提取内容
     */
-    private String extractByRegex(String text, String regex) {
-        Pattern pattern = Pattern.compile(regex);
+    private String extractByRegex(String text, Pattern pattern) {
        Matcher matcher = pattern.matcher(text);
        if (matcher.find()) {
            return matcher.group(1);
@@ -28,6 +28,7 @@ public class PdbTool extends PanBase implements IPanTool {
    private static final String API_URL =
            "https://www.dropbox.com/sharing/fetch_user_content_link";
    static final String COOKIE_KEY = "__Host-js_csrf=";
+    private static final Pattern CSRF_TOKEN_PATTERN = Pattern.compile(COOKIE_KEY + "([\\w-]+);");

    public PdbTool(ShareLinkInfo shareLinkInfo) {
        super(shareLinkInfo);
@@ -47,7 +48,7 @@ public class PdbTool extends PanBase implements IPanTool {
                        fail("cookie未找到");
                        return;
                    }
-                    Matcher matcher = Pattern.compile(COOKIE_KEY + "([\\w-]+);").matcher(collect.get(0));
+                    Matcher matcher = CSRF_TOKEN_PATTERN.matcher(collect.get(0));
                    String _t;
                    if (matcher.find()) {
                        _t = matcher.group(1);
@@ -23,6 +23,16 @@ import java.util.regex.Pattern;
 */
 public class PodTool extends PanBase {

+    private static final int MAX_RESPONSE_BODY_BYTES = 8 * 1024 * 1024;
+    private static final java.time.Duration REQUEST_TIMEOUT = java.time.Duration.ofSeconds(30);
+
+    // 静态共享的 JDK HttpClient 实例，避免每次调用创建新实例
+    private static final HttpClient SHARED_HTTP_CLIENT = HttpClient.newBuilder()
+            .connectTimeout(java.time.Duration.ofSeconds(10))
+            .build();
+    private static volatile WorkerExecutor SHARED_WORKER_EXECUTOR;
+    private static volatile boolean workerExecutorShutdown = false;
+
    /*
     * https://1drv.ms/w/s!Alg0feQmCv2rnRFd60DQOmMa-Oh_?e=buaRtp --302->
     * https://api.onedrive.com/v1.0/drives/abfd0a26e47d3458/items/ABFD0A26E47D3458!3729?authkey=!AF3rQNA6Yxr46H8
@@ -45,6 +55,13 @@ public class PodTool extends PanBase {
    private static final Pattern redirectUrlRegex =
            Pattern.compile("resid=(?<cid1>[^!]+)!(?<cid2>[^&]+).+&redeem=(?<redeem>.+).*");

+    private static final Pattern DOWNLOAD_URL_IN_RESPONSE_PATTERN =
+            Pattern.compile("\"downloadUrl\":\"(?<url>https?://[^\\s\"]+)");
+    private static final Pattern ACTION_URL_PATTERN =
+            Pattern.compile("'action'.+(?<url>https://.+)'\\)");
+    private static final Pattern TOKEN_PATTERN =
+            Pattern.compile("inputElem\\.value\\s*=\\s*'([^']+)'");
+
    public PodTool(ShareLinkInfo shareLinkInfo) {
        super(shareLinkInfo);
    }
@@ -97,7 +114,7 @@ public class PodTool extends PanBase {

                            sendHttpRequest(url, token).onSuccess(body -> {
                                Matcher matcher1 =
-                                        Pattern.compile("\"downloadUrl\":\"(?<url>https?://[^\s\"]+)").matcher(body);
+                                        DOWNLOAD_URL_IN_RESPONSE_PATTERN.matcher(body);
                                if (matcher1.find()) {
                                    // 响应体是 JSON 文本，URL 中的 '&' 被转义为 \u0026，需要反转义
                                    complete(unescapeJsonUnicode(matcher1.group("url")));
@@ -121,11 +138,7 @@ public class PodTool extends PanBase {
    }

    private String matcherUrl(String html) {
-
-        // 正则表达式来匹配 URL
-        String urlRegex = "'action'.+(?<url>https://.+)'\\)";
-        Pattern urlPattern = Pattern.compile(urlRegex);
-        Matcher urlMatcher = urlPattern.matcher(html);
+        Matcher urlMatcher = ACTION_URL_PATTERN.matcher(html);

        if (urlMatcher.find()) {
            String url = urlMatcher.group("url");
@@ -165,10 +178,7 @@ public class PodTool extends PanBase {


    private String matcherToken(String html) {
-        // 正则表达式来匹配 inputElem.value 中的 Token
-        String tokenRegex = "inputElem\\.value\\s*=\\s*'([^']+)'";
-        Pattern tokenPattern = Pattern.compile(tokenRegex);
-        Matcher tokenMatcher = tokenPattern.matcher(html);
+        Matcher tokenMatcher = TOKEN_PATTERN.matcher(html);

        if (tokenMatcher.find()) {
            String token = tokenMatcher.group(1);
@@ -180,11 +190,8 @@ public class PodTool extends PanBase {

    public Future<String> sendHttpRequest2(String token, String redeem) {
        Promise<String> promise = Promise.promise();
-        // 构造 HttpClient
-        HttpClient client = HttpClient.newHttpClient();

        // 构造请求的 URI 和头部信息
-        // https://onedrive.live.com/redir?cid=abfd0a26e47d3458&resid=ABFD0A26E47D3458!4465&ithint=file%2cxlsx&e=Ao2uSU&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL3gvYy9hYmZkMGEyNmU0N2QzNDU4L0VWZzBmZVFtQ3YwZ2dLdHhFUUFBQUFBQlRQRWVDMTZfZk1EYk5FTjhEdTRta1E_ZT1BbzJ1U1U
        String url = ("https://my.microsoftpersonalcontent.com/_api/v2.0/shares/u!%s/driveItem?$select=content" +
                ".downloadUrl").formatted(redeem);
        String authorizationHeader = "Badger " + token;
@@ -192,15 +199,20 @@ public class PodTool extends PanBase {
        // 构建请求
        HttpRequest request = HttpRequest.newBuilder()
                .uri(URI.create(url))
+                .timeout(REQUEST_TIMEOUT)
                .header("Authorization", authorizationHeader)
                .build();

-        // 发送请求并处理响应
-        client.sendAsync(request, HttpResponse.BodyHandlers.ofString())
+        // 发送请求并处理响应（使用共享的 HttpClient）
+        SHARED_HTTP_CLIENT.sendAsync(request, HttpResponse.BodyHandlers.ofByteArray())
                .thenApply(response -> {
                    log.debug("Response Status Code: {}", response.statusCode());
-                    log.debug("Response Body: {}", response.body());
-                    promise.complete(response.body());
+                    promise.complete(toLimitedString(response.body()));
+                    return null;
+                })
+                .exceptionally(e -> {
+                    log.error("sendHttpRequest2 请求失败: {}", e.getMessage());
+                    promise.fail(e);
                    return null;
                });

@@ -208,18 +220,13 @@ public class PodTool extends PanBase {
    }

    public Future<String> sendHttpRequest(String url, String token) {
-        // 创建一个 WorkerExecutor 用于异步执行阻塞的 HTTP 请求
-        WorkerExecutor executor = WebClientVertxInit.get().createSharedWorkerExecutor("http-client-worker");
-
        Promise<String> promise = Promise.promise();
-        executor.executeBlocking(() -> {
-            HttpClient client = HttpClient.newHttpClient();
-            HttpRequest request = null;
-
+        getWorkerExecutor().executeBlocking(() -> {
            try {
                // 构造请求
-                request = HttpRequest.newBuilder()
+                HttpRequest request = HttpRequest.newBuilder()
                        .uri(new URI(url))
+                        .timeout(REQUEST_TIMEOUT)
                        .header("accept", "text/html,application/xhtml+xml,application/xml;q=0.9," +
                                "image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;" +
                                "v=b3;q=0.7")
@@ -244,17 +251,49 @@ public class PodTool extends PanBase {
                        .POST(HttpRequest.BodyPublishers.ofString("badger_token=" + token))
                        .build();

-                // 发起请求并获取响应
-                HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
+                // 发起请求并获取响应（使用共享的 HttpClient）
+                HttpResponse<byte[]> response = SHARED_HTTP_CLIENT.send(request, HttpResponse.BodyHandlers.ofByteArray());

                // 返回响应体
-                promise.complete(response.body());
+                promise.complete(toLimitedString(response.body()));
                return null;
            } catch (URISyntaxException | IOException | InterruptedException e) {
+                if (e instanceof InterruptedException) {
+                    Thread.currentThread().interrupt();
+                }
                throw new RuntimeException(e);
            }
-        });
+        }).onFailure(promise::fail);

        return promise.future();
    }
-}
+
+    private static String toLimitedString(byte[] body) {
+        if (body.length > MAX_RESPONSE_BODY_BYTES) {
+            throw new IllegalArgumentException("OneDrive响应体过大: " + body.length + " bytes");
+        }
+        return new String(body, java.nio.charset.StandardCharsets.UTF_8);
+    }
+
+    private static WorkerExecutor getWorkerExecutor() {
+        synchronized (PodTool.class) {
+            if (workerExecutorShutdown) {
+                throw new IllegalStateException("OneDrive WorkerExecutor 已关闭");
+            }
+            if (SHARED_WORKER_EXECUTOR == null) {
+                SHARED_WORKER_EXECUTOR = WebClientVertxInit.get().createSharedWorkerExecutor("http-client-worker", 8);
+            }
+            return SHARED_WORKER_EXECUTOR;
+        }
+    }
+
+    public static void shutdownWorkerExecutor() {
+        synchronized (PodTool.class) {
+            workerExecutorShutdown = true;
+            if (SHARED_WORKER_EXECUTOR != null) {
+                SHARED_WORKER_EXECUTOR.close();
+                SHARED_WORKER_EXECUTOR = null;
+            }
+        }
+    }
+}
@@ -1,6 +1,5 @@
 package cn.qaiu.parser.impl;

-import cn.qaiu.WebClientVertxInit;
 import cn.qaiu.entity.FileInfo;
 import cn.qaiu.entity.ShareLinkInfo;
 import cn.qaiu.parser.PanBase;
@@ -11,7 +10,6 @@ import io.vertx.core.MultiMap;
 import io.vertx.core.Promise;
 import io.vertx.core.json.JsonObject;
 import io.vertx.core.json.pointer.JsonPointer;
-import io.vertx.ext.web.client.WebClient;
 import io.vertx.uritemplate.UriTemplate;

 import java.util.List;
@@ -53,9 +51,8 @@ public class PvyyTool extends PanBase {

    @Override
    public Future<String> parse() {
-        // 请求downcode
-        WebClient.create(WebClientVertxInit.get())
-                .getAbs(api + shareLinkInfo.getShareKey())
+        // 请求downcode - 使用父类的共享 WebClient 而非创建新实例
+        client.getAbs(api + shareLinkInfo.getShareKey())
                .send()
                .onSuccess(res -> {
                    if (res.statusCode() == 200) {
@@ -63,6 +63,11 @@ public class QQscTool extends PanBase {
            x-oidb: {"uint32_command":"0x93d4", "uint32_service_type":"1"}
            """);

+    private static final Pattern FILESET_ID_PATTERN = Pattern.compile(
+            "fileset_id[^a-f0-9]*([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})");
+
+    private static final Pattern TITLE_PATTERN = Pattern.compile("<title>(.*?)</title>");
+
    public QQscTool(ShareLinkInfo shareLinkInfo) {
        super(shareLinkInfo);
    }
@@ -247,7 +252,9 @@ public class QQscTool extends PanBase {
                                                .put("sort_order", 0)))))
                .put("support_folder_status", true);

-        MultiMap headers = GET_FILE_LIST_HEADERS.set("Referer", shareLinkInfo.getShareUrl());
+        // 创建局部副本，避免修改静态 MultiMap 导致并发污染
+        MultiMap headers = MultiMap.caseInsensitiveMultiMap().addAll(GET_FILE_LIST_HEADERS)
+                .set("Referer", shareLinkInfo.getShareUrl());

        client.postAbs(GET_FILE_LIST_API)
                .putHeaders(headers)
@@ -283,9 +290,7 @@ public class QQscTool extends PanBase {
    String extractFilesetId(String html) {
        // Nuxt __NUXT_DATA__ 中 fileset_id 出现在缓存 key 的嵌套 JSON 中
        // 直接匹配 fileset_id 后面最近的 UUID（跳过转义引号、冒号等非hex字符）
-        Pattern pattern = Pattern.compile(
-                "fileset_id[^a-f0-9]*([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})");
-        Matcher matcher = pattern.matcher(html);
+        Matcher matcher = FILESET_ID_PATTERN.matcher(html);
        if (matcher.find()) {
            return matcher.group(1);
        }
@@ -326,8 +331,7 @@ public class QQscTool extends PanBase {
    }

    public static String extractFileNameFromTitle(String content) {
-        Pattern pattern = Pattern.compile("<title>(.*?)</title>");
-        Matcher matcher = pattern.matcher(content);
+        Matcher matcher = TITLE_PATTERN.matcher(content);
        if (matcher.find()) {
            String fullTitle = matcher.group(1);
            int sepIndex = fullTitle.indexOf("｜");
@@ -265,13 +265,8 @@ public class UcTool extends PanBase {
                                                        return;
                                                    }
                                                    String downloadUrl = dataList.getJsonObject(0).getString("download_url");
-                                                    // UC网盘需要配合aria2下载，保存下载请求头
-                                                    Map<String, String> downloadHeaders = new HashMap<>();
-                                                    // 将header转换为Map 只需要包含cookie,user-agent,referer
-                                                    downloadHeaders.put(HttpHeaders.COOKIE.toString(), header.get(HttpHeaders.COOKIE));
-                                                    downloadHeaders.put(HttpHeaders.USER_AGENT.toString(), header.get(HttpHeaders.USER_AGENT));
-                                                    downloadHeaders.put(HttpHeaders.REFERER.toString(), "https://fast.uc.cn/");
-                                                    completeWithMeta(downloadUrl, downloadHeaders);
+                                                    // UC 需配合下载器（带 cookie），保存下载请求头
+                                                    completeWithMeta(downloadUrl, buildDownloadHeaders(null));
                                                } catch (Exception e) {
                                                    fail("解析 UC 下载链接失败: " + e.getMessage());
                                                }
@@ -466,29 +461,40 @@ public class UcTool extends PanBase {
                            if (shareFidToken != null) {
                                extParams.put("share_fid_token", shareFidToken);
                            }
+                            extParams.put("needDownloader", true);
+                            Map<String, String> dlHeaders = new HashMap<>();
+                            String listCookie = header.get(HttpHeaders.COOKIE);
+                            if (listCookie != null && !listCookie.isEmpty()) {
+                                dlHeaders.put(HttpHeaders.COOKIE.toString(), listCookie);
+                            }
+                            dlHeaders.put(HttpHeaders.USER_AGENT.toString(), header.get(HttpHeaders.USER_AGENT));
+                            dlHeaders.put(HttpHeaders.REFERER.toString(), "https://fast.uc.cn/");
+                            extParams.put("downloadHeaders", dlHeaders);
                            fileInfo.setExtParameters(extParams);
                            // 设置解析URL（用于下载）
                            JsonObject paramJson = new JsonObject(extParams);
+                            paramJson.put("fileName", fileName);
                            String param = CommonUtils.urlBase64Encode(paramJson.encode());
-                            fileInfo.setParserUrl(String.format("%s/v2/redirectUrl/%s/%s", 
-                                    getDomainName(), shareLinkInfo.getType(), param));
+                            // 透传 auth，避免下载/转存时变成 guest
+                            fileInfo.setParserUrl(appendAuthQuery(String.format("%s/v2/redirectUrl/%s/%s",
+                                    getDomainName(), shareLinkInfo.getType(), param)));
                        } else {
                            // 文件夹
                            fileInfo.setFileType("folder");
                            fileInfo.setSize(0L);
                            fileInfo.setSizeStr("0B");
-                            // 设置目录解析URL（用于递归解析子目录）
-                            // 对 URL 参数进行编码，确保特殊字符正确传递
+                            // 递归子目录须透传 auth，否则会丢失认证
                            try {
                                String encodedUrl = URLEncoder.encode(shareLinkInfo.getShareUrl(), StandardCharsets.UTF_8.toString());
                                String encodedDirId = URLEncoder.encode(fid, StandardCharsets.UTF_8.toString());
                                String encodedStoken = URLEncoder.encode(stoken, StandardCharsets.UTF_8.toString());
-                                fileInfo.setParserUrl(String.format("%s/v2/getFileList?url=%s&dirId=%s&stoken=%s", 
-                                        getDomainName(), encodedUrl, encodedDirId, encodedStoken));
+                                fileInfo.setParserUrl(appendAuthQuery(String.format(
+                                        "%s/v2/getFileList?url=%s&dirId=%s&stoken=%s",
+                                        getDomainName(), encodedUrl, encodedDirId, encodedStoken)));
                            } catch (Exception e) {
-                                // 如果编码失败，使用原始值
-                                fileInfo.setParserUrl(String.format("%s/v2/getFileList?url=%s&dirId=%s&stoken=%s", 
-                                        getDomainName(), shareLinkInfo.getShareUrl(), fid, stoken));
+                                fileInfo.setParserUrl(appendAuthQuery(String.format(
+                                        "%s/v2/getFileList?url=%s&dirId=%s&stoken=%s",
+                                        getDomainName(), shareLinkInfo.getShareUrl(), fid, stoken)));
                            }
                        }
                        
@@ -510,6 +516,9 @@ public class UcTool extends PanBase {
            promise.fail("缺少必要的参数");
            return promise.future();
        }
+
+        // 会话无 cookie 时，回退使用入口参数中已带的 cookie
+        ensureCookieFromParam(paramJson);
        
        String fid = paramJson.getString("fid");
        String pwdId = paramJson.getString("pwd_id");
@@ -554,6 +563,11 @@ public class UcTool extends PanBase {
                            promise.fail("未找到下载链接");
                            return;
                        }
+                        // 存储下载请求头，供目录解析 getFileDownInfo 接口使用
+                        // 优先用当前会话 cookie；缺失时回退入口参数中已带的 cookie
+                        Map<String, String> downloadHeaders = buildDownloadHeaders(paramJson);
+                        shareLinkInfo.getOtherParam().put("downloadHeaders", downloadHeaders);
+                        shareLinkInfo.getOtherParam().put("fileName", paramJson.getString("fileName", ""));
                        promise.complete(downloadUrl);
                    } catch (Exception e) {
                        promise.fail("解析 UC 下载链接失败: " + e.getMessage());
@@ -564,6 +578,53 @@ public class UcTool extends PanBase {
        return promise.future();
    }

+    /**
+     * 会话无 cookie 时，从入口参数 downloadHeaders 回填到请求头。
+     */
+    private void ensureCookieFromParam(JsonObject paramJson) {
+        String cookie = header.get(HttpHeaders.COOKIE);
+        if (cookie != null && !cookie.isEmpty()) {
+            return;
+        }
+        String paramCookie = extractCookieFromParam(paramJson);
+        if (paramCookie != null && !paramCookie.isEmpty()) {
+            header.set(HttpHeaders.COOKIE, CookieUtils.filterUcQuarkCookie(paramCookie));
+        }
+    }
+
+    private static String extractCookieFromParam(JsonObject paramJson) {
+        if (paramJson == null) {
+            return null;
+        }
+        JsonObject paramHeaders = paramJson.getJsonObject("downloadHeaders");
+        if (paramHeaders == null) {
+            return null;
+        }
+        String cookie = paramHeaders.getString("cookie");
+        return cookie != null ? cookie : paramHeaders.getString("Cookie");
+    }
+
+    /**
+     * 构建下载请求头：会话 cookie 优先，缺失时回退入口参数中的 downloadHeaders。
+     */
+    private Map<String, String> buildDownloadHeaders(JsonObject paramJson) {
+        Map<String, String> downloadHeaders = new HashMap<>();
+        String cookie = header.get(HttpHeaders.COOKIE);
+        if (cookie == null || cookie.isEmpty()) {
+            cookie = extractCookieFromParam(paramJson);
+        }
+        if (cookie != null && !cookie.isEmpty()) {
+            downloadHeaders.put(HttpHeaders.COOKIE.toString(), cookie);
+        }
+        String ua = header.get(HttpHeaders.USER_AGENT);
+        if (ua == null || ua.isEmpty()) {
+            ua = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36";
+        }
+        downloadHeaders.put(HttpHeaders.USER_AGENT.toString(), ua);
+        downloadHeaders.put(HttpHeaders.REFERER.toString(), "https://fast.uc.cn/");
+        return downloadHeaders;
+    }
+
 //    public static void main(String[] args) {
 //        // https://drive.uc.cn/s/12450d1694844?public=1
 //        new UcTool(ShareLinkInfo.newBuilder().shareKey("12450d1694844").build()).parse().onSuccess(
@@ -0,0 +1,694 @@
+package cn.qaiu.parser.impl;
+
+import cn.qaiu.entity.FileInfo;
+import cn.qaiu.entity.ShareLinkInfo;
+import cn.qaiu.parser.PanBase;
+import cn.qaiu.util.CommonUtils;
+import cn.qaiu.util.FileSizeConverter;
+import io.vertx.core.Future;
+import io.vertx.core.Promise;
+import io.vertx.core.buffer.Buffer;
+import io.vertx.core.json.JsonArray;
+import io.vertx.core.json.JsonObject;
+import io.vertx.ext.web.client.HttpRequest;
+import io.vertx.ext.web.client.HttpResponse;
+import org.apache.commons.lang3.StringUtils;
+
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+/**
+ * 永硕E盘（主 ysepan.com / ys168.com，备 cccpan.com / ysupan.com / uupan.net / ysok.net）
+ * <p>
+ * 空间分享形如 https://{space}.ysepan.com/ ，需空间访问密码时通过 sharePassword 传入。
+ */
+public class YsTool extends PanBase {
+
+    private static final String BROWSER_UA =
+            "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 "
+                    + "(KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36";
+
+    private static final Pattern ANTIFORGERY_PATTERN =
+            Pattern.compile("RequestVerificationToken'\\s*:\\s*'([^']+)'");
+    private static final Pattern HTXX_PATTERN =
+            Pattern.compile("window\\.htxx\\s*=\\s*(\\{.*?});", Pattern.DOTALL);
+    private static final Pattern JWT_COOKIE_PATTERN =
+            Pattern.compile("jwttk_[^=]+=([^;\\s]+)");
+
+    private static final String PARAM_DIR_ID = "dirId";
+    /** 永硕目录内的子目录名（API 字段 zml），用于二级层级 */
+    private static final String PARAM_ZML = "zml";
+
+    public YsTool(ShareLinkInfo shareLinkInfo) {
+        super(shareLinkInfo);
+    }
+
+    @Override
+    public Future<String> parse() {
+        ensureSession().onSuccess(session -> {
+            Object dirIdObj = shareLinkInfo.getOtherParam().get(PARAM_DIR_ID);
+            if (dirIdObj != null && StringUtils.isNotBlank(dirIdObj.toString())) {
+                int dirId = Integer.parseInt(dirIdObj.toString());
+                fetchFiles(session, dirId).onSuccess(filesResp -> {
+                    List<JsonObject> files = downloadableFiles(filesResp);
+                    if (files.isEmpty()) {
+                        fail("目录内没有可下载文件");
+                        return;
+                    }
+                    completeDownload(session, filesResp, files.get(0));
+                }).onFailure(err -> fail(err, err.getMessage()));
+                return;
+            }
+
+            fetchDirectories(session).compose(dirs -> collectDownloadableFiles(session, dirs))
+                    .onSuccess(collected -> {
+                        if (collected.isEmpty()) {
+                            fail("空间内没有可下载文件，请检查密码或目录权限");
+                            return;
+                        }
+                        if (collected.size() > 1) {
+                            fail("空间包含多个文件(共{}个)，请使用文件列表接口后再按文件解析", collected.size());
+                            return;
+                        }
+                        CollectedFile only = collected.get(0);
+                        completeDownload(session, only.filesResp, only.file);
+                    }).onFailure(err -> fail(err, err.getMessage()));
+        }).onFailure(err -> fail(err, err.getMessage()));
+        return promise.future();
+    }
+
+    @Override
+    public Future<List<FileInfo>> parseFileList() {
+        Promise<List<FileInfo>> listPromise = Promise.promise();
+        ensureSession().onSuccess(session -> {
+            Object dirIdObj = shareLinkInfo.getOtherParam().get(PARAM_DIR_ID);
+            if (dirIdObj != null && StringUtils.isNotBlank(dirIdObj.toString())) {
+                int dirId = Integer.parseInt(dirIdObj.toString());
+                String zmlFilter = currentZmlFilter();
+                fetchFiles(session, dirId).onSuccess(filesResp -> {
+                    try {
+                        listPromise.complete(mapFiles(session, dirId, filesResp, zmlFilter));
+                    } catch (Exception e) {
+                        listPromise.fail(baseMsg() + " - 解析文件列表失败: " + e.getMessage());
+                    }
+                }).onFailure(listPromise::fail);
+                return;
+            }
+
+            fetchDirectories(session).onSuccess(dirs -> {
+                try {
+                    listPromise.complete(mapDirectories(session, dirs));
+                } catch (Exception e) {
+                    listPromise.fail(baseMsg() + " - 解析目录列表失败: " + e.getMessage());
+                }
+            }).onFailure(listPromise::fail);
+        }).onFailure(listPromise::fail);
+        return listPromise.future();
+    }
+
+    @Override
+    public Future<String> parseById() {
+        JsonObject paramJson = (JsonObject) shareLinkInfo.getOtherParam().get("paramJson");
+        if (paramJson == null) {
+            fail("缺少 paramJson 参数");
+            return promise.future();
+        }
+
+        String downloadUrl = paramJson.getString("downloadUrl");
+        if (StringUtils.isNotBlank(downloadUrl)) {
+            completeWithMeta(downloadUrl, downloadHeaders(paramJson.getString("referer")));
+            return promise.future();
+        }
+
+        String space = paramJson.getString("space", spaceName());
+        String xzpz = paramJson.getString("xzpz");
+        String pz = paramJson.getString("pz");
+        String fwq = paramJson.getString("fwq");
+        String fileName = paramJson.getString("fileName");
+        if (StringUtils.isAnyBlank(space, xzpz, pz, fwq, fileName)) {
+            fail("下载参数不完整: {}", paramJson);
+            return promise.future();
+        }
+        String url = buildDownloadUrl(space, xzpz, pz, fwq, fileName);
+        completeWithMeta(url, downloadHeaders(paramJson.getString("referer", spaceOrigin())));
+        return promise.future();
+    }
+
+    private Future<Session> ensureSession() {
+        Promise<Session> p = Promise.promise();
+        String space = spaceName();
+        if (StringUtils.isBlank(space)) {
+            p.fail(baseMsg() + " - 空间名为空");
+            return p.future();
+        }
+
+        String origin = spaceOrigin();
+        clientSession.getAbs(origin + "/")
+                .putHeader("User-Agent", BROWSER_UA)
+                .putHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8")
+                .send()
+                .compose(res -> handleSpaceHome(origin, space, res))
+                .onSuccess(p::complete)
+                .onFailure(p::fail);
+        return p.future();
+    }
+
+    private Future<Session> handleSpaceHome(String origin, String space, HttpResponse<Buffer> res) {
+        String html = res.bodyAsString() != null ? res.bodyAsString() : "";
+        String jwt = extractJwt(res);
+        JsonObject htxx = extractHtxx(html);
+
+        // 已进入空间
+        if (htxx != null && StringUtils.isNotBlank(htxx.getString("qqdz"))) {
+            if (StringUtils.isBlank(jwt)) {
+                return Future.failedFuture(baseMsg() + " - 无法获取会话令牌");
+            }
+            return Future.succeededFuture(toSession(origin, space, jwt, htxx));
+        }
+
+        // 需要空间密码
+        if (html.contains("VerifyPassword") || html.contains("loginPopup")) {
+            String pwd = shareLinkInfo.getSharePassword();
+            if (StringUtils.isBlank(pwd)) {
+                return Future.failedFuture(baseMsg() + " - 空间需要访问密码");
+            }
+            String antiforgery = extractAntiforgery(html);
+            if (StringUtils.isBlank(antiforgery)) {
+                return Future.failedFuture(baseMsg() + " - 无法获取防伪令牌");
+            }
+            return verifyPassword(origin, space, pwd, antiforgery)
+                    .compose(verifiedJwt -> reloadSpace(origin, space, verifiedJwt));
+        }
+
+        return Future.failedFuture(baseMsg() + " - 无法解析空间信息");
+    }
+
+    private Future<String> verifyPassword(String origin, String space, String pwd, String antiforgery) {
+        Promise<String> p = Promise.promise();
+        JsonObject body = new JsonObject()
+                .put("password", pwd)
+                .put("dlmc", space)
+                .put("remember", false);
+
+        clientSession.postAbs(origin + "/?handler=VerifyPassword")
+                .putHeader("User-Agent", BROWSER_UA)
+                .putHeader("Content-Type", "application/json")
+                .putHeader("Origin", origin)
+                .putHeader("Referer", origin + "/")
+                .putHeader("RequestVerificationToken", antiforgery)
+                .sendJsonObject(body)
+                .onSuccess(res -> {
+                    try {
+                        JsonObject json = res.bodyAsJsonObject();
+                        if (json == null || !Boolean.TRUE.equals(json.getBoolean("success"))) {
+                            String msg = json != null ? json.getString("message", "密码错误") : "密码验证失败";
+                            p.fail(baseMsg() + " - " + msg);
+                            return;
+                        }
+                        String jwt = extractJwt(res);
+                        if (StringUtils.isBlank(jwt)) {
+                            p.fail(baseMsg() + " - 密码验证成功但未返回会话令牌");
+                            return;
+                        }
+                        p.complete(jwt);
+                    } catch (Exception e) {
+                        p.fail(baseMsg() + " - 密码验证响应异常: " + e.getMessage());
+                    }
+                })
+                .onFailure(t -> p.fail(baseMsg() + " - 密码验证请求失败: " + t.getMessage()));
+        return p.future();
+    }
+
+    private Future<Session> reloadSpace(String origin, String space, String verifiedJwt) {
+        Promise<Session> p = Promise.promise();
+        clientSession.getAbs(origin + "/")
+                .putHeader("User-Agent", BROWSER_UA)
+                .putHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8")
+                .send()
+                .onSuccess(res -> {
+                    String html = res.bodyAsString() != null ? res.bodyAsString() : "";
+                    JsonObject htxx = extractHtxx(html);
+                    String jwt = StringUtils.defaultIfBlank(extractJwt(res), verifiedJwt);
+                    if (htxx == null || StringUtils.isBlank(htxx.getString("qqdz"))) {
+                        p.fail(baseMsg() + " - 密码验证后仍无法进入空间");
+                        return;
+                    }
+                    if (StringUtils.isBlank(jwt)) {
+                        p.fail(baseMsg() + " - 密码验证后无法获取会话令牌");
+                        return;
+                    }
+                    p.complete(toSession(origin, space, jwt, htxx));
+                })
+                .onFailure(t -> p.fail(baseMsg() + " - 重新加载空间失败: " + t.getMessage()));
+        return p.future();
+    }
+
+    private Session toSession(String origin, String space, String jwt, JsonObject htxx) {
+        String apiBase = htxx.getString("qqdz");
+        if (apiBase != null && !apiBase.endsWith("/")) {
+            apiBase = apiBase + "/";
+        }
+        String dlmc = htxx.getString("dlmc", space);
+        return new Session(origin, dlmc, jwt, apiBase);
+    }
+
+    private Future<JsonArray> fetchDirectories(Session session) {
+        Promise<JsonArray> p = Promise.promise();
+        apiPost(session, "ml/mldq", new JsonObject())
+                .onSuccess(json -> {
+                    JsonArray lb = json.getJsonArray("lb");
+                    p.complete(lb != null ? lb : new JsonArray());
+                })
+                .onFailure(p::fail);
+        return p.future();
+    }
+
+    private Future<JsonObject> fetchFiles(Session session, int dirId) {
+        Promise<JsonObject> p = Promise.promise();
+        JsonObject body = new JsonObject()
+                .put("mlbh", dirId)
+                .put("kqmm", "")
+                .put("wjbh", 0)
+                .put("ip1", "");
+        apiPost(session, "wj/wjdq", body)
+                .onSuccess(p::complete)
+                .onFailure(p::fail);
+        return p.future();
+    }
+
+    private Future<JsonObject> apiPost(Session session, String path, JsonObject body) {
+        Promise<JsonObject> p = Promise.promise();
+        String url = session.apiBase + path;
+        HttpRequest<Buffer> req = clientSession.postAbs(url)
+                .putHeader("User-Agent", BROWSER_UA)
+                .putHeader("Accept", "application/json, text/plain, */*")
+                .putHeader("Content-Type", "application/json")
+                .putHeader("Origin", session.origin)
+                .putHeader("Referer", session.origin + "/")
+                .putHeader("Authorization", "Bearer " + session.jwt);
+        req.sendJsonObject(body)
+                .onSuccess(res -> {
+                    try {
+                        if (res.statusCode() >= 400) {
+                            p.fail(baseMsg() + " - API " + path + " HTTP " + res.statusCode());
+                            return;
+                        }
+                        JsonObject json = asJson(res);
+                        if (json == null || json.isEmpty()) {
+                            p.fail(baseMsg() + " - API " + path + " 返回空响应");
+                            return;
+                        }
+                        p.complete(json);
+                    } catch (Exception e) {
+                        p.fail(baseMsg() + " - API " + path + " 响应异常: " + e.getMessage());
+                    }
+                })
+                .onFailure(t -> p.fail(baseMsg() + " - API " + path + " 请求失败: " + t.getMessage()));
+        return p.future();
+    }
+
+    private Future<List<CollectedFile>> collectDownloadableFiles(Session session, JsonArray dirs) {
+        Promise<List<CollectedFile>> p = Promise.promise();
+        List<CollectedFile> collected = new ArrayList<>();
+        List<Integer> dirIds = new ArrayList<>();
+        for (int i = 0; i < dirs.size(); i++) {
+            JsonObject dir = dirs.getJsonObject(i);
+            if (isAccessibleDirectory(dir)) {
+                dirIds.add(dir.getInteger("bh"));
+            }
+        }
+        if (dirIds.isEmpty()) {
+            p.complete(collected);
+            return p.future();
+        }
+
+        fetchNextDirFiles(session, dirIds, 0, collected, p);
+        return p.future();
+    }
+
+    private void fetchNextDirFiles(Session session, List<Integer> dirIds, int index,
+                                   List<CollectedFile> collected, Promise<List<CollectedFile>> promise) {
+        if (index >= dirIds.size()) {
+            promise.complete(collected);
+            return;
+        }
+        int dirId = dirIds.get(index);
+        fetchFiles(session, dirId).onSuccess(filesResp -> {
+            for (JsonObject file : downloadableFiles(filesResp)) {
+                collected.add(new CollectedFile(filesResp, file));
+            }
+            fetchNextDirFiles(session, dirIds, index + 1, collected, promise);
+        }).onFailure(promise::fail);
+    }
+
+    private List<FileInfo> mapDirectories(Session session, JsonArray dirs) {
+        List<FileInfo> result = new ArrayList<>();
+        for (int i = 0; i < dirs.size(); i++) {
+            JsonObject dir = dirs.getJsonObject(i);
+            if (!isAccessibleDirectory(dir)) {
+                continue;
+            }
+            Integer bh = dir.getInteger("bh");
+            if (bh == null) {
+                continue;
+            }
+            String title = StringUtils.defaultIfBlank(dir.getString("bt"), "目录" + bh);
+            FileInfo info = new FileInfo()
+                    .setFileName(title)
+                    .setFileId(bh.toString())
+                    .setFileType("folder")
+                    .setSize(0L)
+                    .setSizeStr("0B")
+                    .setDescription(dir.getString("sm", ""))
+                    .setCreateTime(normalizeTime(dir.getString("sj")))
+                    .setPanType(shareLinkInfo.getType())
+                    .setParserUrl(String.format("%s/v2/getFileList?url=%s&dirId=%s&pwd=%s",
+                            getDomainName(),
+                            urlEncode(shareLinkInfo.getShareUrl()),
+                            bh,
+                            urlEncode(StringUtils.defaultString(shareLinkInfo.getSharePassword()))));
+            result.add(info);
+        }
+        return result;
+    }
+
+    /**
+     * 将目录内文件按 zml（子目录）分层。
+     * <ul>
+     *   <li>zmlFilter 为空：返回子目录（folder）+ 根级文件</li>
+     *   <li>zmlFilter 非空：仅返回该子目录下的文件/链接</li>
+     * </ul>
+     */
+    private List<FileInfo> mapFiles(Session session, int dirId, JsonObject filesResp, String zmlFilter) {
+        List<FileInfo> result = new ArrayList<>();
+        String xzpz = filesResp.getJsonObject("ml", new JsonObject()).getString("xzpz", "");
+        JsonArray lb = filesResp.getJsonArray("lb", new JsonArray());
+        boolean listingSubdir = StringUtils.isNotBlank(zmlFilter);
+
+        // 未进入子目录时，先按出现顺序收集 zml 作为二级文件夹
+        if (!listingSubdir) {
+            java.util.LinkedHashSet<String> subdirs = new java.util.LinkedHashSet<>();
+            for (int i = 0; i < lb.size(); i++) {
+                JsonObject item = lb.getJsonObject(i);
+                if (item == null) {
+                    continue;
+                }
+                String zml = StringUtils.defaultString(item.getString("zml")).trim();
+                if (StringUtils.isNotBlank(zml)) {
+                    subdirs.add(zml);
+                }
+            }
+            for (String zml : subdirs) {
+                result.add(new FileInfo()
+                        .setFileName(zml)
+                        .setFileId(dirId + ":" + zml)
+                        .setFileType("folder")
+                        .setSize(0L)
+                        .setSizeStr("0B")
+                        .setFilePath(zml)
+                        .setPanType(shareLinkInfo.getType())
+                        .setParserUrl(String.format("%s/v2/getFileList?url=%s&dirId=%s&zml=%s&pwd=%s",
+                                getDomainName(),
+                                urlEncode(shareLinkInfo.getShareUrl()),
+                                dirId,
+                                urlEncode(zml),
+                                urlEncode(StringUtils.defaultString(shareLinkInfo.getSharePassword())))));
+            }
+        }
+
+        for (int i = 0; i < lb.size(); i++) {
+            JsonObject item = lb.getJsonObject(i);
+            if (item == null) {
+                continue;
+            }
+            String itemZml = StringUtils.defaultString(item.getString("zml")).trim();
+            if (listingSubdir) {
+                if (!zmlFilter.equals(itemZml)) {
+                    continue;
+                }
+            } else if (StringUtils.isNotBlank(itemZml)) {
+                // 根级列表只展示无 zml 的条目，有 zml 的归入子目录
+                continue;
+            }
+
+            Integer bh = item.getInteger("bh");
+            if (bh == null) {
+                continue;
+            }
+            String wjlx = item.getString("wjlx", "");
+
+            // URL / 公告条目
+            if ("url".equalsIgnoreCase(wjlx)) {
+                String link = StringUtils.defaultString(item.getString("wjm")).trim();
+                String title = StringUtils.defaultString(item.getString("bt")).trim();
+                // 空占位（标题和链接都空）跳过，与官网展示一致
+                if (StringUtils.isAllBlank(title, link)) {
+                    continue;
+                }
+                if (StringUtils.isBlank(title)) {
+                    title = StringUtils.defaultIfBlank(link, "链接");
+                }
+                FileInfo urlInfo = new FileInfo()
+                        .setFileName(title)
+                        .setFileId(bh.toString())
+                        .setFileType("url")
+                        .setSize(0L)
+                        .setSizeStr("0B")
+                        .setFilePath(itemZml)
+                        .setCreateTime(normalizeTime(item.getString("sj")))
+                        .setPanType(shareLinkInfo.getType())
+                        .setPreviewUrl(link)
+                        .setDescription(link);
+                // parserUrl 置空，避免前端误走下载；打开走 previewUrl
+                result.add(urlInfo);
+                continue;
+            }
+
+            String fileName = item.getString("wjm");
+            String fwq = item.getString("fwq");
+            String pz = item.getString("pz");
+            if (StringUtils.isAnyBlank(fileName, fwq, pz, xzpz)) {
+                continue;
+            }
+
+            long size = item.getLong("dx", 0L);
+            String downloadUrl = buildDownloadUrl(session.space, xzpz, pz, fwq, fileName);
+            JsonObject param = new JsonObject()
+                    .put("space", session.space)
+                    .put("xzpz", xzpz)
+                    .put("pz", pz)
+                    .put("fwq", fwq)
+                    .put("fileName", fileName)
+                    .put("mlbh", dirId)
+                    .put("fileId", bh)
+                    .put("downloadUrl", downloadUrl)
+                    .put("referer", session.origin + "/");
+            String paramEncoded = CommonUtils.urlBase64Encode(param.encode());
+
+            FileInfo fileInfo = new FileInfo()
+                    .setFileName(fileName)
+                    .setFileId(bh.toString())
+                    .setFileType("file")
+                    .setSize(size)
+                    .setSizeStr(FileSizeConverter.convertToReadableSize(size))
+                    .setFilePath(itemZml)
+                    .setCreateTime(normalizeTime(item.getString("sj")))
+                    .setPanType(shareLinkInfo.getType())
+                    .setParserUrl(String.format("%s/v2/redirectUrl/%s/%s",
+                            getDomainName(), shareLinkInfo.getType(), paramEncoded))
+                    .setPreviewUrl(String.format("%s/v2/viewUrl/%s/%s",
+                            getDomainName(), shareLinkInfo.getType(), paramEncoded));
+            result.add(fileInfo);
+        }
+        return result;
+    }
+
+    private String currentZmlFilter() {
+        Object zml = shareLinkInfo.getOtherParam().get(PARAM_ZML);
+        if (zml == null) {
+            return "";
+        }
+        try {
+            return java.net.URLDecoder.decode(zml.toString(), StandardCharsets.UTF_8).trim();
+        } catch (Exception e) {
+            return zml.toString().trim();
+        }
+    }
+
+    private List<JsonObject> downloadableFiles(JsonObject filesResp) {
+        List<JsonObject> files = new ArrayList<>();
+        String xzpz = filesResp.getJsonObject("ml", new JsonObject()).getString("xzpz", "");
+        if (StringUtils.isBlank(xzpz)) {
+            return files;
+        }
+        JsonArray lb = filesResp.getJsonArray("lb", new JsonArray());
+        for (int i = 0; i < lb.size(); i++) {
+            JsonObject item = lb.getJsonObject(i);
+            if (item == null) {
+                continue;
+            }
+            if ("url".equalsIgnoreCase(item.getString("wjlx", ""))) {
+                continue;
+            }
+            if (StringUtils.isAnyBlank(item.getString("wjm"), item.getString("fwq"), item.getString("pz"))) {
+                continue;
+            }
+            files.add(item);
+        }
+        return files;
+    }
+
+    private void completeDownload(Session session, JsonObject filesResp, JsonObject file) {
+        String xzpz = filesResp.getJsonObject("ml", new JsonObject()).getString("xzpz");
+        String url = buildDownloadUrl(session.space, xzpz, file.getString("pz"),
+                file.getString("fwq"), file.getString("wjm"));
+
+        FileInfo fileInfo = new FileInfo()
+                .setFileName(file.getString("wjm"))
+                .setFileId(String.valueOf(file.getInteger("bh")))
+                .setSize(file.getLong("dx", 0L))
+                .setSizeStr(FileSizeConverter.convertToReadableSize(file.getLong("dx", 0L)))
+                .setFileType("file")
+                .setFilePath(file.getString("zml", ""))
+                .setCreateTime(normalizeTime(file.getString("sj")))
+                .setPanType(shareLinkInfo.getType());
+        shareLinkInfo.getOtherParam().put("fileInfo", fileInfo);
+        completeWithMeta(url, downloadHeaders(session.origin + "/"));
+    }
+
+    /**
+     * 拼装直链。注意：不要在 xzpz 前加 "_"，官方页面直链无此前缀，加了会 404。
+     */
+    static String buildDownloadUrl(String space, String xzpz, String pz, String fwq, String fileName) {
+        String host = "X".equalsIgnoreCase(fwq)
+                ? "y.ys168.com:8000"
+                : "ys-" + fwq.toLowerCase() + ".ysepan.com";
+        return "https://" + host + "/wap/"
+                + encodePathSegment(space) + "/"
+                + encodePathSegment(xzpz) + "/"
+                + encodePathSegment(pz) + "/"
+                + encodePathSegment(fileName);
+    }
+
+    private static String encodePathSegment(String value) {
+        // 保留永硕 token 中常见的 . , _ - 等字符，仅编码必须转义的部分
+        return URLEncoder.encode(value, StandardCharsets.UTF_8)
+                .replace("+", "%20")
+                .replace("%2E", ".")
+                .replace("%2C", ",")
+                .replace("%5F", "_")
+                .replace("%2D", "-");
+    }
+
+    private Map<String, String> downloadHeaders(String referer) {
+        Map<String, String> headers = new HashMap<>();
+        headers.put("User-Agent", BROWSER_UA);
+        if (StringUtils.isNotBlank(referer)) {
+            headers.put("Referer", referer);
+        }
+        return headers;
+    }
+
+    private boolean isAccessibleDirectory(JsonObject dir) {
+        if (dir == null) {
+            return false;
+        }
+        // 无可下载权限或需特殊打开方式的目录忽略
+        if (!Boolean.TRUE.equals(dir.getBoolean("qxz", true))) {
+            return false;
+        }
+        Integer kqfs = dir.getInteger("kqfs", 0);
+        return kqfs == null || kqfs == 0;
+    }
+
+    private String spaceName() {
+        String key = shareLinkInfo.getShareKey();
+        if (StringUtils.isBlank(key)) {
+            return null;
+        }
+        try {
+            return java.net.URLDecoder.decode(key, StandardCharsets.UTF_8);
+        } catch (Exception e) {
+            return key;
+        }
+    }
+
+    private String spaceOrigin() {
+        String shareUrl = shareLinkInfo.getShareUrl();
+        if (StringUtils.isNotBlank(shareUrl)) {
+            try {
+                java.net.URI uri = java.net.URI.create(shareUrl);
+                String scheme = uri.getScheme() != null ? uri.getScheme() : "https";
+                return scheme + "://" + uri.getHost();
+            } catch (Exception ignored) {
+            }
+        }
+        return "https://" + spaceName() + ".ysepan.com";
+    }
+
+    private static String extractAntiforgery(String html) {
+        Matcher m = ANTIFORGERY_PATTERN.matcher(html);
+        return m.find() ? m.group(1) : null;
+    }
+
+    private static JsonObject extractHtxx(String html) {
+        Matcher m = HTXX_PATTERN.matcher(html);
+        if (!m.find()) {
+            return null;
+        }
+        try {
+            return new JsonObject(m.group(1));
+        } catch (Exception e) {
+            return null;
+        }
+    }
+
+    private static String extractJwt(HttpResponse<Buffer> res) {
+        List<String> setCookies = res.cookies();
+        if (setCookies != null) {
+            for (String c : setCookies) {
+                Matcher m = JWT_COOKIE_PATTERN.matcher(c);
+                if (m.find()) {
+                    return m.group(1);
+                }
+            }
+        }
+        String raw = res.getHeader("Set-Cookie");
+        if (raw != null) {
+            Matcher m = JWT_COOKIE_PATTERN.matcher(raw);
+            if (m.find()) {
+                return m.group(1);
+            }
+        }
+        return null;
+    }
+
+    private static String normalizeTime(String sj) {
+        if (StringUtils.isBlank(sj)) {
+            return sj;
+        }
+        // 2024-10-26T10:12:54.98 -> 2024-10-26 10:12:54
+        String t = sj.replace('T', ' ');
+        int dot = t.indexOf('.');
+        if (dot > 0) {
+            t = t.substring(0, dot);
+        }
+        return t;
+    }
+
+    private static String urlEncode(String value) {
+        return URLEncoder.encode(StringUtils.defaultString(value), StandardCharsets.UTF_8);
+    }
+
+    private record Session(String origin, String space, String jwt, String apiBase) {
+    }
+
+    private record CollectedFile(JsonObject filesResp, JsonObject file) {
+    }
+}
@@ -77,32 +77,57 @@ public class CommonUtils {
    }

    /**
-     * urlEncode -> deBase64 -> string
-     * @param encoded 编码后的字符串
-     * @return 解码后的字符串
+     * 解码路径参数中的 Base64。
+     * <p>优先按 URL-Safe Base64 解；兼容历史「标准 Base64 + URLEncode」以及重复 encode。</p>
     */
    public static String urlBase64Decode(String encoded) {
-        try {
-            String urlDecoded = java.net.URLDecoder.decode(encoded, StandardCharsets.UTF_8);
-            byte[] base64DecodedBytes = java.util.Base64.getDecoder().decode(urlDecoded);
-            return new String(base64DecodedBytes, java.nio.charset.StandardCharsets.UTF_8);
-        } catch (Exception e) {
-            throw new RuntimeException("URL Base64 解码失败", e);
+        if (encoded == null || encoded.isEmpty()) {
+            throw new RuntimeException("URL Base64 解码失败: empty");
        }
+        String s = encoded.trim().replace(' ', '+');
+        // 兼容历史 URLEncode / 误二次 encode：有 % 则解到不再变化
+        for (int i = 0; i < 3 && s.contains("%"); i++) {
+            try {
+                String next = java.net.URLDecoder.decode(s, StandardCharsets.UTF_8);
+                if (next.equals(s)) {
+                    break;
+                }
+                s = next;
+            } catch (Exception e) {
+                break;
+            }
+        }
+        Exception last = null;
+        for (String candidate : new String[]{s, padBase64(s)}) {
+            try {
+                return new String(java.util.Base64.getUrlDecoder().decode(candidate), StandardCharsets.UTF_8);
+            } catch (Exception e) {
+                last = e;
+            }
+            try {
+                return new String(java.util.Base64.getDecoder().decode(candidate), StandardCharsets.UTF_8);
+            } catch (Exception e) {
+                last = e;
+            }
+        }
+        throw new RuntimeException("URL Base64 解码失败", last);
    }
-    
+
    /**
-     *  string -> base64Encode -> urlEncode
-     * @param str 原始字符串
-     * @return 编码后的字符串
+     * 编码为可直接放进 URL path 的 Base64（URL-Safe，无 padding）。
+     * <p>不再做 URLEncoder，避免前端/代理再 encode 时变成 %253D。</p>
     */
    public static String urlBase64Encode(String str) {
-        try {
-            byte[] base64EncodedBytes = java.util.Base64.getEncoder().encode(str.getBytes(java.nio.charset.StandardCharsets.UTF_8));
-            String base64Encoded = new String(base64EncodedBytes, java.nio.charset.StandardCharsets.UTF_8);
-            return java.net.URLEncoder.encode(base64Encoded, StandardCharsets.UTF_8);
-        } catch (Exception e) {
-            throw new RuntimeException("URL Base64 编码失败", e);
+        return java.util.Base64.getUrlEncoder()
+                .withoutPadding()
+                .encodeToString(str.getBytes(StandardCharsets.UTF_8));
+    }
+
+    private static String padBase64(String s) {
+        int mod = s.length() % 4;
+        if (mod == 0) {
+            return s;
        }
+        return s + "====".substring(mod);
    }
 }
@@ -17,16 +17,35 @@ import java.util.zip.InflaterInputStream;

 public class HttpResponseHelper {
    static Logger LOGGER = LoggerFactory.getLogger(HttpResponseHelper.class);
+    private static final int MAX_RESPONSE_BODY_BYTES = 8 * 1024 * 1024;
+    private static final int MAX_DECOMPRESSED_CHARS = 16 * 1024 * 1024;

    // -------------------- 公共方法 --------------------
    public static String asText(HttpResponse<?> res) {
        String encoding = res.getHeader(HttpHeaders.CONTENT_ENCODING.toString());
        try {
            Buffer body = toBuffer(res);
+            return asText(body, encoding);
+        } catch (IllegalArgumentException | UnsupportedOperationException e) {
+            throw e;
+        } catch (Exception e) {
+            LOGGER.error("asText: {}", e.getMessage(), e);
+            return null;
+        }
+    }
+
+    public static String asText(Buffer body, String encoding) {
+        try {
+            if (body == null) {
+                return "";
+            }
+            ensureBodyLimit(body);
            if (encoding == null || "identity".equalsIgnoreCase(encoding)) {
                return body.toString(StandardCharsets.UTF_8);
            }
            return decompress(body, encoding);
+        } catch (IllegalArgumentException | UnsupportedOperationException e) {
+            throw e;
        } catch (Exception e) {
            LOGGER.error("asText: {}", e.getMessage(), e);
            return null;
@@ -36,6 +55,29 @@ public class HttpResponseHelper {
    public static JsonObject asJson(HttpResponse<?> res) {
        try {
            String text = asText(res);
+            return parseJsonText(text);
+        } catch (IllegalArgumentException | UnsupportedOperationException e) {
+            throw e;
+        } catch (Exception e) {
+            LOGGER.error("asJson: {}", e.getMessage(), e);
+            return JsonObject.of();
+        }
+    }
+
+    public static JsonObject asJson(Buffer body, String encoding) {
+        try {
+            String text = asText(body, encoding);
+            return parseJsonText(text);
+        } catch (IllegalArgumentException | UnsupportedOperationException e) {
+            throw e;
+        } catch (Exception e) {
+            LOGGER.error("asJson: {}", e.getMessage(), e);
+            return JsonObject.of();
+        }
+    }
+
+    private static JsonObject parseJsonText(String text) {
+        try {
            if (text != null) {
                return new JsonObject(text);
            } else  {
@@ -53,13 +95,26 @@ public class HttpResponseHelper {
        return res.body() instanceof Buffer ? (Buffer) res.body() : Buffer.buffer(res.bodyAsString());
    }

+    private static void ensureBodyLimit(Buffer body) {
+        if (body != null && body.length() > MAX_RESPONSE_BODY_BYTES) {
+            throw new IllegalArgumentException("响应体过大: " + body.length() + " bytes");
+        }
+    }
+
+    private static void writeLimited(StringWriter writer, char[] buffer, int len) throws IOException {
+        if (writer.getBuffer().length() + len > MAX_DECOMPRESSED_CHARS) {
+            throw new IOException("解压后响应体过大");
+        }
+        writer.write(buffer, 0, len);
+    }
+
    // -------------------- 通用解压分发 --------------------
    private static String decompress(Buffer compressed, String encoding) throws IOException {
        return switch (encoding.toLowerCase()) {
            case "gzip" -> decompressGzip(compressed);
            case "deflate" -> decompressDeflate(compressed);
            case "br" -> decompressBrotli(compressed);
-            case "zstd" -> compressed.toString(StandardCharsets.UTF_8); // 暂时返回原始内容
+            case "zstd" -> throw new UnsupportedOperationException("不支持的 Content-Encoding: zstd");
            default -> throw new UnsupportedOperationException("不支持的 Content-Encoding: " + encoding);
        };
    }
@@ -74,7 +129,7 @@ public class HttpResponseHelper {
            char[] buffer = new char[4096];
            int n;
            while ((n = isr.read(buffer)) != -1) {
-                writer.write(buffer, 0, n);
+                writeLimited(writer, buffer, n);
            }
            return writer.toString();
        }
@@ -99,7 +154,7 @@ public class HttpResponseHelper {
            char[] buffer = new char[4096];
            int n;
            while ((n = isr.read(buffer)) != -1) {
-                writer.write(buffer, 0, n);
+                writeLimited(writer, buffer, n);
            }
            return writer.toString();
        }
@@ -115,7 +170,7 @@ public class HttpResponseHelper {
            char[] buffer = new char[4096];
            int n;
            while ((n = isr.read(buffer)) != -1) {
-                writer.write(buffer, 0, n);
+                writeLimited(writer, buffer, n);
            }
            return writer.toString();
        }
@@ -1,7 +1,7 @@
 package cn.qaiu.util;

+import cn.qaiu.WebClientVertxInit;
 import io.vertx.core.MultiMap;
-import io.vertx.core.Vertx;
 import io.vertx.core.http.impl.headers.HeadersMultiMap;
 import io.vertx.ext.web.client.WebClient;
 import io.vertx.ext.web.client.WebClientSession;
@@ -19,6 +19,10 @@ import java.util.List;
 public class IpExtractor {
    private static final Logger log = LoggerFactory.getLogger(IpExtractor.class);

+    // 使用共享的 Vertx 实例，避免每次调用创建新实例导致资源泄漏
+    private static final WebClient SHARED_CLIENT = WebClient.create(WebClientVertxInit.get());
+    private static final WebClientSession SHARED_SESSION = WebClientSession.create(SHARED_CLIENT);
+
    public static void main(String[] args) throws InterruptedException {


@@ -43,11 +47,9 @@ public class IpExtractor {
        headers.add("user-agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36");
        headers.add("Content-Type", "application/x-www-form-urlencoded");

-        WebClient client = WebClient.create(Vertx.vertx());
-        WebClientSession webClientSession = WebClientSession.create(client);
-        webClientSession.getAbs("https://ip.ihuan.me").putHeaders(headers).send().onSuccess(res->{
+        SHARED_SESSION.getAbs("https://ip.ihuan.me").putHeaders(headers).send().onSuccess(res->{
            log.debug("response: {}", res.toString());
-            webClientSession.getAbs("https://ip.ihuan.me").putHeaders(headers).send().onSuccess(res2->{
+            SHARED_SESSION.getAbs("https://ip.ihuan.me").putHeaders(headers).send().onSuccess(res2->{
                log.debug("response2: {}", res2.toString());

            });
@@ -46,34 +46,62 @@ public class JsExecUtils {

    /**
     * 调用执行蓝奏云js文件（每次动态JS代码，无法复用引擎）
+     * 注意：使用后清理引擎引用，帮助 GC 回收 Nashorn 引擎内部资源
     */
    public static ScriptObjectMirror executeDynamicJs(String jsText, String funName) throws ScriptException,
            NoSuchMethodException {
        ScriptEngine engine = ENGINE_MANAGER.getEngineByName("JavaScript"); // 得到脚本引擎
-        engine.eval(JsContent.lz + "\n" + jsText);
-        Invocable inv = (Invocable) engine;
-        //调用js中的函数
-        if (StringUtils.isNotEmpty(funName)) {
-            inv.invokeFunction(funName);
+        try {
+            engine.eval(JsContent.lz + "\n" + jsText);
+            Invocable inv = (Invocable) engine;
+            //调用js中的函数
+            if (StringUtils.isNotEmpty(funName)) {
+                inv.invokeFunction(funName);
+            }
+            return (ScriptObjectMirror) engine.get("signObj");
+        } finally {
+            // 清理引擎持有的引用，帮助 GC 回收
+            clearEngineBindings(engine);
        }
-
-        return (ScriptObjectMirror) engine.get("signObj");
    }


    /**
     * 调用执行js文件（使用缓存的 ScriptEngineManager 创建新引擎实例）
+     * 注意：使用后清理引擎引用，帮助 GC 回收 Nashorn 引擎内部资源
     */
    public static Object executeOtherJs(String jsText, String funName, Object ... args) throws ScriptException,
            NoSuchMethodException {
        ScriptEngine engine = ENGINE_MANAGER.getEngineByName("JavaScript"); // 得到脚本引擎
-        engine.eval(jsText);
-        Invocable inv = (Invocable) engine;
-        //调用js中的函数
-        if (StringUtils.isNotEmpty(funName)) {
-            return inv.invokeFunction(funName, args);
+        try {
+            engine.eval(jsText);
+            Invocable inv = (Invocable) engine;
+            //调用js中的函数
+            if (StringUtils.isNotEmpty(funName)) {
+                return inv.invokeFunction(funName, args);
+            }
+            throw new ScriptException("funName is null");
+        } finally {
+            // 清理引擎持有的引用，帮助 GC 回收
+            clearEngineBindings(engine);
+        }
+    }
+
+    /**
+     * 清理 ScriptEngine 的 bindings，帮助 GC 回收 Nashorn 引擎资源
+     */
+    private static void clearEngineBindings(ScriptEngine engine) {
+        try {
+            if (engine != null) {
+                // 清理全局 bindings
+                var bindings = engine.getBindings(javax.script.ScriptContext.ENGINE_SCOPE);
+                if (bindings != null) {
+                    bindings.clear();
+                }
+            }
+        } catch (Exception ignored) {
+            // 清理失败不影响主流程
        }
-        throw new ScriptException("funName is null");
    }

    public static String getKwSign(String s, String pwd) {
@@ -1,8 +1,8 @@
 package cn.qaiu.util;

+import cn.qaiu.WebClientVertxInit;
 import io.vertx.core.AsyncResult;
 import io.vertx.core.MultiMap;
-import io.vertx.core.Vertx;
 import io.vertx.core.buffer.Buffer;
 import io.vertx.core.http.impl.headers.HeadersMultiMap;
 import io.vertx.ext.web.client.HttpResponse;
@@ -47,15 +47,13 @@ public class ReqIpUtil {

    }

-
-    Vertx vertx = Vertx.vertx();
-    WebClient webClient = WebClient.create(vertx);
-    // 发送GET请求
-    WebClientSession webClientSession = WebClientSession.create(webClient);
+    // 使用共享的 Vertx 实例和 WebClient，避免每次创建新实例导致资源泄漏
+    private static final WebClient WEB_CLIENT = WebClient.create(WebClientVertxInit.get());
+    private static final WebClientSession WEB_CLIENT_SESSION = WebClientSession.create(WEB_CLIENT);


    public void exec() {
-        webClientSession.getAbs(BASE_URL)
+        WEB_CLIENT_SESSION.getAbs(BASE_URL)
            .putHeaders(headers) // 将请求头Map添加到请求中
            .send(this::next);
    }
@@ -67,7 +65,7 @@ public class ReqIpUtil {
            HttpResponse<Buffer> res = response.result();
            log.debug("Received response with status code {}", res.statusCode());
            log.debug("Body: {}", res.body());
-            webClientSession.getAbs(BASE_URL_TEMPLATE).setTemplateParam("path", PATH1)
+            WEB_CLIENT_SESSION.getAbs(BASE_URL_TEMPLATE).setTemplateParam("path", PATH1)
                    .putHeaders(headers) // 将请求头Map添加到请求中
                    .send(response2 -> {
                        log.debug("response2: {}", response2.result().bodyAsString());
@@ -0,0 +1,84 @@
+package cn.qaiu.util;
+
+import org.apache.commons.lang3.StringUtils;
+
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * 123分享链接子域工具：将分享 key 的前半段解码为数字 uid。
+ */
+public final class YeShareHostUtil {
+
+    private static final String CODE62 = "Tvd3hHA9QEkom14xpfaBJIMwgFYGPXn2sWCNORDr80KuUSl7bZcetizL5q6yVj";
+    private static final long MAX_SAFE_INTEGER = 9007199254740991L;
+    private static final Map<Character, Integer> DECODE_MAP = new HashMap<>();
+
+    static {
+        for (int i = 0; i < CODE62.length(); i++) {
+            DECODE_MAP.put(CODE62.charAt(i), i);
+        }
+    }
+
+    private YeShareHostUtil() {
+    }
+
+    public static String getNumericSubdomainIdByShareKey(String shareKey) {
+        String normalized = normalizeShareKey(shareKey);
+        if (StringUtils.isBlank(normalized)) {
+            return "";
+        }
+        int split = normalized.indexOf('-');
+        if (split <= 0) {
+            return "";
+        }
+        String encodedUid = normalized.substring(0, split);
+        Long uid = decodeBase62LittleEndian(encodedUid);
+        return uid == null ? "" : String.valueOf(uid);
+    }
+
+    public static String normalizeShareKey(String shareKey) {
+        if (StringUtils.isBlank(shareKey)) {
+            return "";
+        }
+        String key = shareKey.trim();
+        int queryIndex = key.indexOf('?');
+        if (queryIndex >= 0) {
+            key = key.substring(0, queryIndex);
+        }
+        int slashIndex = key.lastIndexOf('/');
+        if (slashIndex >= 0 && slashIndex < key.length() - 1) {
+            key = key.substring(slashIndex + 1);
+        }
+        if (key.endsWith(".html")) {
+            key = key.substring(0, key.length() - 5);
+        }
+        return key;
+    }
+
+    private static Long decodeBase62LittleEndian(String value) {
+        if (StringUtils.isBlank(value)) {
+            return null;
+        }
+        long result = 0L;
+        for (int i = 0; i < value.length(); i++) {
+            Integer digit = DECODE_MAP.get(value.charAt(i));
+            if (digit == null) {
+                return null;
+            }
+            double weighted = digit * Math.pow(62, i);
+            if (!Double.isFinite(weighted)) {
+                return null;
+            }
+            long next = result + (long) weighted;
+            if (next <= 0 || next > MAX_SAFE_INTEGER) {
+                return null;
+            }
+            result = next;
+        }
+        if (result <= 0) {
+            return null;
+        }
+        return result;
+    }
+}
@@ -134,8 +134,8 @@ HTTP客户端对象：
 http.get(url)                           // GET请求
 http.post(url, data)                     // POST请求
 http.putHeader(name, value)              // 设置请求头
-http.sendForm(data)                      // 发送表单数据
-http.sendJson(data)                      // 发送JSON数据
+http.sendForm(url, data)                 // 发送表单数据
+http.sendJson(url, data)                 // 发送JSON数据
 ```

 ### JsHttpResponse
@@ -89,9 +89,9 @@ var java;
 * @property {function(): JsHttpClient} clearHeaders - 清空所有请求头（保留默认头）
 * @property {function(): Object} getHeaders - 获取所有请求头
 * @property {function(number): JsHttpClient} setTimeout - 设置请求超时时间（秒）
- * @property {function(Object): JsHttpResponse} sendForm - 发送简单表单数据
+ * @property {function(string, Object): JsHttpResponse} sendForm - 发送简单表单数据
 * @property {function(string, Object): JsHttpResponse} sendMultipartForm - 发送multipart表单数据（仅支持文本字段）
- * @property {function(any): JsHttpResponse} sendJson - 发送JSON数据
+ * @property {function(string, any): JsHttpResponse} sendJson - 发送JSON数据
 * @property {function(string): string} urlEncode - URL编码（静态方法）
 * @property {function(string): string} urlDecode - URL解码（静态方法）
 */
@@ -37,10 +37,10 @@

    <!-- 将文件输出设置成异步输出 -->
    <appender name="ASYNC-FILE" class="ch.qos.logback.classic.AsyncAppender">
-        <!-- 不丢失日志.默认的,如果队列的80%已满,则会丢弃TRACT、DEBUG、INFO级别的日志 -->
-        <discardingThreshold>0</discardingThreshold>
+        <!-- 队列剩余 20% 时开始丢弃 TRACE/DEBUG/INFO 级别日志，避免阻塞调用线程 -->
+        <discardingThreshold>20</discardingThreshold>
        <!-- 更改默认的队列的深度,该值会影响性能.默认值为256 -->
-        <queueSize>256</queueSize>
+        <queueSize>512</queueSize>
        <!-- 添加附加的appender,最多只能添加一个 -->
        <appender-ref ref="FILE"/>
    </appender>
@@ -0,0 +1,44 @@
+package cn.qaiu.parser;
+
+import org.junit.Test;
+
+import java.io.IOException;
+import java.net.URL;
+
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+
+/**
+ * GHSA-997r-7xx2-p9x6 regression: Cloudreve generic parser must reject
+ * hosts that resolve to loopback / private / link-local / metadata ranges
+ * before any outbound request.
+ */
+public class AssertPublicHostTest {
+
+    @Test
+    public void rejectsLoopbackAndPrivateHosts() throws Exception {
+        String[] blocked = {
+                "http://127.0.0.1.nip.io/s/poc",
+                "http://localhost/s/poc",
+                "http://10.0.0.1/s/poc",
+                "http://192.168.1.1/s/poc",
+                "http://172.16.0.1/s/poc",
+                "http://169.254.169.254/s/poc",
+                "http://[::1]/s/poc"
+        };
+        for (String raw : blocked) {
+            try {
+                PanBase.assertPublicHost(new URL(raw));
+                fail("expected block for " + raw);
+            } catch (IOException expected) {
+                assertTrue(expected.getMessage().contains("不允许访问")
+                        || expected.getMessage().contains("无法解析"));
+            }
+        }
+    }
+
+    @Test
+    public void allowsPublicHost() throws Exception {
+        PanBase.assertPublicHost(new URL("https://example.com/s/demo"));
+    }
+}
@@ -1,6 +1,7 @@
 package cn.qaiu.parser;

 import cn.qaiu.entity.ShareLinkInfo;
+import cn.qaiu.util.YeShareHostUtil;
 import org.junit.Test;

 import java.util.Arrays;
@@ -157,6 +158,26 @@ public class PanDomainTemplateTest {
        assertEquals("somekey", m5.group("KEY"));
    }

+        @Test
+        public void testYeRedirectPatternAndUidDecode() {
+                Pattern yePattern = PanDomainTemplate.YE.getPattern();
+
+                Matcher oldUrl = yePattern.matcher("https://www.123pan.com/s/lN7UVv-pbYJ");
+                assertTrue("YE should match old 123pan share URL", oldUrl.find());
+                assertEquals("lN7UVv-pbYJ", oldUrl.group("KEY"));
+
+                Matcher redirectedUrl = yePattern.matcher("https://1813382308.mshare.123pan.cn/123pan/lN7UVv-pbYJ");
+                assertTrue("YE should match redirected mshare URL", redirectedUrl.find());
+                assertEquals("lN7UVv-pbYJ", redirectedUrl.group("KEY"));
+
+                Matcher htmlUrl = yePattern.matcher("https://www.123278.com/s/lN7UVv-pbYJ.html?pwd=abcd");
+                assertTrue("YE should match html URL with query", htmlUrl.find());
+                assertEquals("lN7UVv-pbYJ", htmlUrl.group("KEY"));
+
+                assertEquals("1813382308", YeShareHostUtil.getNumericSubdomainIdByShareKey("lN7UVv-pbYJ"));
+                assertEquals("lN7UVv-pbYJ", YeShareHostUtil.normalizeShareKey("https://1813382308.mshare.123pan.cn/123pan/lN7UVv-pbYJ?pwd=abcd"));
+        }
+
    @Test
    public void testLePatternFix() {
        Pattern lePattern = PanDomainTemplate.LE.getPattern();
@@ -302,6 +323,63 @@ public class PanDomainTemplateTest {
                fsPattern.matcher("https://xxx.feishu.cn/docs/abc123").matches());
    }

+    @Test
+    public void testYsPatternMatching() {
+        Pattern ysPattern = PanDomainTemplate.YS.getPattern();
+
+        // 主域名
+        Matcher m1 = ysPattern.matcher("https://qaiu.ysepan.com/");
+        assertTrue("YS should match ysepan.com", m1.matches());
+        assertEquals("qaiu", m1.group("KEY"));
+
+        Matcher m2 = ysPattern.matcher("http://sohehe4.ys168.com");
+        assertTrue("YS should match ys168.com", m2.matches());
+        assertEquals("sohehe4", m2.group("KEY"));
+
+        // 备用域名
+        Matcher m3 = ysPattern.matcher("https://demo.cccpan.com/");
+        assertTrue("YS should match cccpan.com", m3.matches());
+        assertEquals("demo", m3.group("KEY"));
+
+        Matcher m4 = ysPattern.matcher("https://space.ysupan.com");
+        assertTrue("YS should match ysupan.com", m4.matches());
+        assertEquals("space", m4.group("KEY"));
+
+        Matcher m5 = ysPattern.matcher("https://user.uupan.net/");
+        assertTrue("YS should match uupan.net", m5.matches());
+        assertEquals("user", m5.group("KEY"));
+
+        Matcher m6 = ysPattern.matcher("https://ok.ysok.net");
+        assertTrue("YS should match ysok.net", m6.matches());
+        assertEquals("ok", m6.group("KEY"));
+
+        // 非空间子域 / 非白名单域名
+        assertFalse("YS should NOT match www.ysepan.com",
+                ysPattern.matcher("https://www.ysepan.com/").matches());
+        assertFalse("YS should NOT match api host c6.ysepan.com",
+                ysPattern.matcher("https://c6.ysepan.com/api/ml/mldq").matches());
+        assertFalse("YS should NOT match CDN ys-c.ysepan.com",
+                ysPattern.matcher("https://ys-c.ysepan.com/wap/qaiu/x").matches());
+        assertFalse("YS should NOT match unrelated domain",
+                ysPattern.matcher("https://qaiu.evil.com/").matches());
+        assertFalse("YS should NOT match ysepan.com without space subdomain",
+                ysPattern.matcher("https://ysepan.com/").matches());
+    }
+
+    @Test
+    public void testYsFromShareUrl() {
+        ParserCreate parserCreate = ParserCreate.fromShareUrl("https://qaiu.ysepan.com/");
+        ShareLinkInfo info = parserCreate.getShareLinkInfo();
+        assertNotNull(info);
+        assertEquals("ys", info.getType());
+        assertEquals("永硕E盘", info.getPanName());
+        assertEquals("qaiu", info.getShareKey());
+
+        ParserCreate backup = ParserCreate.fromShareUrl("https://demo.cccpan.com/");
+        assertEquals("ys", backup.getShareLinkInfo().getType());
+        assertEquals("demo", backup.getShareLinkInfo().getShareKey());
+    }
+
    @Test
    public void testFsFromShareUrl() {
        // 测试文件链接解析
@@ -0,0 +1,312 @@
+package cn.qaiu.parser.impl;
+
+import cn.qaiu.WebClientVertxInit;
+import cn.qaiu.entity.FileInfo;
+import cn.qaiu.parser.PanDomainTemplate;
+import cn.qaiu.parser.ParserCreate;
+import cn.qaiu.util.CommonUtils;
+import io.vertx.core.Vertx;
+import io.vertx.core.buffer.Buffer;
+import io.vertx.core.json.JsonObject;
+import io.vertx.ext.web.client.WebClient;
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
+import org.junit.Test;
+
+import java.util.List;
+import java.util.concurrent.TimeUnit;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import static org.junit.Assert.*;
+
+/**
+ * 永硕E盘解析测试（含示例空间联调 + 真实下载校验）
+ */
+public class YsToolTest {
+
+    private static Vertx vertx;
+    private static WebClient webClient;
+
+    @BeforeClass
+    public static void setUpClass() {
+        vertx = Vertx.vertx();
+        WebClientVertxInit.init(vertx);
+        webClient = WebClient.create(vertx);
+    }
+
+    @AfterClass
+    public static void tearDownClass() {
+        if (webClient != null) {
+            webClient.close();
+        }
+        if (vertx != null) {
+            vertx.close();
+        }
+    }
+
+    @Test
+    public void testPatternMatching() {
+        Pattern pattern = PanDomainTemplate.YS.getPattern();
+
+        Matcher m1 = pattern.matcher("https://qaiu.ysepan.com/");
+        assertTrue(m1.matches());
+        assertEquals("qaiu", m1.group("KEY"));
+
+        Matcher m2 = pattern.matcher("http://sohehe4.ysepan.com");
+        assertTrue(m2.matches());
+        assertEquals("sohehe4", m2.group("KEY"));
+
+        Matcher m3 = pattern.matcher("https://demo.ys168.com/");
+        assertTrue(m3.matches());
+        assertEquals("demo", m3.group("KEY"));
+
+        assertTrue(pattern.matcher("https://a.cccpan.com/").matches());
+        assertTrue(pattern.matcher("https://a.ysupan.com").matches());
+        assertTrue(pattern.matcher("https://a.uupan.net/").matches());
+        assertTrue(pattern.matcher("https://a.ysok.net").matches());
+
+        assertFalse(pattern.matcher("https://www.ysepan.com/").matches());
+        assertFalse(pattern.matcher("https://c6.ysepan.com/api/ml/mldq").matches());
+        assertFalse(pattern.matcher("https://ys-c.ysepan.com/wap/qaiu/x/y/z").matches());
+        assertFalse(pattern.matcher("https://zy.ysepan.com/assets/index.js").matches());
+        assertFalse(pattern.matcher("https://qaiu.evil.com/").matches());
+    }
+
+    @Test
+    public void testIdentifyShareUrl() {
+        ParserCreate create = ParserCreate.fromShareUrl("https://qaiu.ysepan.com/");
+        assertEquals("ys", create.getShareLinkInfo().getType());
+        assertEquals("永硕E盘", create.getShareLinkInfo().getPanName());
+        assertEquals("qaiu", create.getShareLinkInfo().getShareKey());
+    }
+
+    @Test
+    public void testBuildDownloadUrl() {
+        String url = YsTool.buildDownloadUrl(
+                "yssl",
+                "A95UIe495EkSKE",
+                "Bc8hF8Nsbl2I4Ec6vAm5EGe9HU36iC",
+                "L",
+                "lu20.jpg");
+        // 与官方一致：xzpz 前不加 "_"
+        assertEquals(
+                "https://ys-l.ysepan.com/wap/yssl/A95UIe495EkSKE/Bc8hF8Nsbl2I4Ec6vAm5EGe9HU36iC/lu20.jpg",
+                url);
+        assertFalse("force-download 前缀会导致 404", url.contains("/_"));
+    }
+
+    @Test
+    public void testOfficialSampleUrlRealDownload() throws Exception {
+        String official = "https://ys-l.ysepan.com/wap/yssl/A95UIe495EkSKE/Bc8hF8Nsbl2I4Ec6vAm5EGe9HU36iC/lu20.jpg";
+        String withForcePrefix = "https://ys-l.ysepan.com/wap/yssl/_A95UIe495EkSKE/Bc8hF8Nsbl2I4Ec6vAm5EGe9HU36iC/lu20.jpg";
+
+        Buffer ok = download(official, "https://yssl.ysepan.com/");
+        assertTrue("官方直链应能下载到 JPEG", ok.length() > 1000);
+        assertEquals((byte) 0xFF, ok.getByte(0));
+        assertEquals((byte) 0xD8, ok.getByte(1));
+
+        int forceStatus = webClient.getAbs(withForcePrefix)
+                .putHeader("User-Agent", "Mozilla/5.0")
+                .putHeader("Referer", "https://yssl.ysepan.com/")
+                .send()
+                .toCompletionStage().toCompletableFuture()
+                .get(30, TimeUnit.SECONDS)
+                .statusCode();
+        assertNotEquals("带 _ 前缀的直链应失败(文件不存在)", 200, forceStatus);
+    }
+
+    @Test
+    public void testQaiuSpaceFileListAndRealDownload() throws Exception {
+        ParserCreate create = ParserCreate.fromShareUrl("https://qaiu.ysepan.com/");
+        create.getShareLinkInfo().setSharePassword("qaiuys168");
+        create.getShareLinkInfo().getOtherParam().put("domainName", "http://localhost");
+
+        List<FileInfo> dirs = create.createTool().parseFileList()
+                .toCompletionStage().toCompletableFuture()
+                .get(60, TimeUnit.SECONDS);
+
+        assertNotNull(dirs);
+        assertFalse("目录列表不应为空", dirs.isEmpty());
+        assertEquals("folder", dirs.get(0).getFileType());
+        String dirId = dirs.get(0).getFileId();
+        assertNotNull(dirId);
+
+        ParserCreate filesCreate = ParserCreate.fromShareUrl("https://qaiu.ysepan.com/");
+        filesCreate.getShareLinkInfo().setSharePassword("qaiuys168");
+        filesCreate.getShareLinkInfo().getOtherParam().put("domainName", "http://localhost");
+        filesCreate.getShareLinkInfo().getOtherParam().put("dirId", dirId);
+
+        List<FileInfo> files = filesCreate.createTool().parseFileList()
+                .toCompletionStage().toCompletableFuture()
+                .get(60, TimeUnit.SECONDS);
+
+        assertNotNull(files);
+        FileInfo zip = files.stream()
+                .filter(f -> "file".equals(f.getFileType()))
+                .filter(f -> f.getFileName() != null && f.getFileName().contains("Pycharm"))
+                .findFirst()
+                .orElse(null);
+        assertNotNull("应能列出 Pycharm 压缩包", zip);
+        assertTrue(zip.getSize() > 0);
+        assertNotNull(zip.getParserUrl());
+
+        String param = zip.getParserUrl().substring(zip.getParserUrl().lastIndexOf('/') + 1);
+        JsonObject paramJson = new JsonObject(CommonUtils.urlBase64Decode(param));
+        assertFalse("downloadUrl 不应含 force 前缀",
+                paramJson.getString("downloadUrl", "").contains("/_"));
+
+        ParserCreate byId = ParserCreate.fromType("ys").shareKey("qaiu");
+        byId.getShareLinkInfo().setSharePassword("qaiuys168");
+        byId.getShareLinkInfo().getOtherParam().put("paramJson", paramJson);
+
+        String downloadUrl = byId.createTool().parseById()
+                .toCompletionStage().toCompletableFuture()
+                .get(60, TimeUnit.SECONDS);
+
+        assertNotNull(downloadUrl);
+        assertFalse("解析直链不应含 _xzpz 前缀", downloadUrl.matches(".*/_[^/]+/.*"));
+        assertTrue(downloadUrl.contains("ysepan.com"));
+
+        Buffer body = download(downloadUrl, "https://qaiu.ysepan.com/");
+        assertEquals("真实下载大小应与列表一致", zip.getSize().longValue(), body.length());
+        // ZIP magic: PK
+        assertEquals('P', (char) body.getByte(0));
+        assertEquals('K', (char) body.getByte(1));
+        System.out.println("qaiu real download ok, url=" + downloadUrl + ", size=" + body.length());
+    }
+
+    @Test
+    public void testFufu1ZmlHierarchyAndUrlItems() throws Exception {
+        // https://fufu1.ysepan.com/ 无密码；游戏3 下应按 zml 展示子目录，再进子目录才是夸克/百度链接
+        ParserCreate create = ParserCreate.fromShareUrl("https://fufu1.ysepan.com/");
+        create.getShareLinkInfo().getOtherParam().put("domainName", "http://localhost");
+
+        List<FileInfo> roots = create.createTool().parseFileList()
+                .toCompletionStage().toCompletableFuture()
+                .get(60, TimeUnit.SECONDS);
+        assertNotNull(roots);
+        FileInfo game3 = roots.stream()
+                .filter(f -> "folder".equals(f.getFileType()))
+                .filter(f -> "游戏3".equals(f.getFileName()))
+                .findFirst()
+                .orElse(null);
+        assertNotNull("应有目录 游戏3", game3);
+
+        ParserCreate level2 = ParserCreate.fromShareUrl("https://fufu1.ysepan.com/");
+        level2.getShareLinkInfo().getOtherParam().put("domainName", "http://localhost");
+        level2.getShareLinkInfo().getOtherParam().put("dirId", game3.getFileId());
+
+        List<FileInfo> subdirs = level2.createTool().parseFileList()
+                .toCompletionStage().toCompletableFuture()
+                .get(60, TimeUnit.SECONDS);
+        assertNotNull(subdirs);
+        assertTrue("游戏3 下应是子目录列表", subdirs.size() > 10);
+        assertTrue("游戏3 下列表应全是 folder（zml 子目录）",
+                subdirs.stream().allMatch(f -> "folder".equals(f.getFileType())));
+
+        FileInfo sample = subdirs.stream()
+                .filter(f -> f.getFileName() != null && f.getFileName().contains("我是未来"))
+                .findFirst()
+                .orElse(subdirs.get(0));
+
+        // 从 parserUrl 提取 zml，或直接用 fileName
+        ParserCreate level3 = ParserCreate.fromShareUrl("https://fufu1.ysepan.com/");
+        level3.getShareLinkInfo().getOtherParam().put("domainName", "http://localhost");
+        level3.getShareLinkInfo().getOtherParam().put("dirId", game3.getFileId());
+        level3.getShareLinkInfo().getOtherParam().put("zml", sample.getFileName());
+
+        List<FileInfo> links = level3.createTool().parseFileList()
+                .toCompletionStage().toCompletableFuture()
+                .get(60, TimeUnit.SECONDS);
+        assertNotNull(links);
+        assertFalse(links.isEmpty());
+        assertTrue("子目录内应有 url 类型",
+                links.stream().anyMatch(f -> "url".equals(f.getFileType())));
+        assertTrue("应包含夸克/百度链接名",
+                links.stream().anyMatch(f -> "夸克".equals(f.getFileName()) || "百度".equals(f.getFileName())));
+        assertFalse("空占位 URL 不应出现",
+                links.stream().anyMatch(f -> f.getFileName() == null || f.getFileName().isBlank()));
+        assertTrue("URL 条目应带 previewUrl",
+                links.stream().filter(f -> "url".equals(f.getFileType()))
+                        .allMatch(f -> f.getPreviewUrl() != null && f.getPreviewUrl().startsWith("http")));
+
+        System.out.println("fufu1 hierarchy ok: 游戏3 -> " + sample.getFileName()
+                + " -> " + links.stream().map(FileInfo::getFileName).toList());
+    }
+
+    @Test
+    public void testSohehe4SpaceDirectories() throws Exception {
+        ParserCreate create = ParserCreate.fromShareUrl("https://sohehe4.ysepan.com/");
+        create.getShareLinkInfo().setSharePassword("1234");
+        create.getShareLinkInfo().getOtherParam().put("domainName", "http://localhost");
+
+        List<FileInfo> dirs = create.createTool().parseFileList()
+                .toCompletionStage().toCompletableFuture()
+                .get(60, TimeUnit.SECONDS);
+
+        assertNotNull(dirs);
+        assertTrue("sohehe4 应有多个目录", dirs.size() >= 3);
+        assertTrue(dirs.stream().allMatch(d -> "folder".equals(d.getFileType())));
+
+        String dirId = dirs.stream()
+                .filter(d -> d.getFileName() != null && d.getFileName().contains("留言"))
+                .map(FileInfo::getFileId)
+                .findFirst()
+                .orElse(dirs.get(0).getFileId());
+
+        ParserCreate filesCreate = ParserCreate.fromShareUrl("https://sohehe4.ysepan.com/");
+        filesCreate.getShareLinkInfo().setSharePassword("1234");
+        filesCreate.getShareLinkInfo().getOtherParam().put("domainName", "http://localhost");
+        filesCreate.getShareLinkInfo().getOtherParam().put("dirId", dirId);
+
+        List<FileInfo> files = filesCreate.createTool().parseFileList()
+                .toCompletionStage().toCompletableFuture()
+                .get(60, TimeUnit.SECONDS);
+
+        assertNotNull(files);
+        assertFalse(files.isEmpty());
+
+        FileInfo file = files.stream()
+                .filter(f -> "file".equals(f.getFileType()))
+                .filter(f -> f.getSize() != null && f.getSize() > 0 && f.getSize() < 5_000_000)
+                .findFirst()
+                .orElse(null);
+        if (file != null) {
+            String param = file.getParserUrl().substring(file.getParserUrl().lastIndexOf('/') + 1);
+            JsonObject paramJson = new JsonObject(CommonUtils.urlBase64Decode(param));
+            String downloadUrl = paramJson.getString("downloadUrl");
+            assertNotNull(downloadUrl);
+            assertFalse(downloadUrl.contains("/_"));
+
+            Buffer body = download(downloadUrl, "https://sohehe4.ysepan.com/");
+            assertEquals(file.getSize().longValue(), body.length());
+            System.out.println("sohehe4 real download ok, file=" + file.getFileName()
+                    + ", size=" + body.length());
+        } else {
+            System.out.println("sohehe4 dir=" + dirId + " entries=" + files.size()
+                    + " (no small file for real download sample)");
+        }
+    }
+
+    private static Buffer download(String url, String referer) throws Exception {
+        return webClient.getAbs(url)
+                .putHeader("User-Agent",
+                        "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 "
+                                + "(KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36")
+                .putHeader("Referer", referer)
+                .send()
+                .toCompletionStage().toCompletableFuture()
+                .thenApply(res -> {
+                    assertEquals("下载 HTTP 状态码应为 200: " + url, 200, res.statusCode());
+                    Buffer body = res.body();
+                    assertNotNull(body);
+                    assertTrue("下载内容为空: " + url, body.length() > 0);
+                    String ct = res.getHeader("Content-Type");
+                    assertFalse("不应返回 HTML 错误页: " + url,
+                            ct != null && ct.toLowerCase().contains("text/html"));
+                    return body;
+                })
+                .get(60, TimeUnit.SECONDS);
+    }
+}
@@ -17,7 +17,7 @@
    </modules>

    <properties>
-        <revision>0.3.4</revision>
+        <revision>0.4.2</revision>
        <java.version>17</java.version>
        <maven.compiler.source>17</maven.compiler.source>
        <maven.compiler.target>17</maven.compiler.target>
@@ -33,9 +33,9 @@
        <commons-lang3.version>3.18.0</commons-lang3.version>
        <commons-beanutils2.version>2.0.0</commons-beanutils2.version>
        <parserVersion>10.2.5</parserVersion>
-        <jackson.version>2.18.6</jackson.version>
+        <jackson.version>2.18.9</jackson.version>
        <!-- Logback 最新稳定版 -->
-        <logback.version>1.5.32</logback.version>
+        <logback.version>1.5.34</logback.version>
        <junit.version>4.13.2</junit.version>
    </properties>

@@ -1,6 +1,6 @@
 {
  "name": "nfd-web",
-  "version": "0.2.1",
+  "version": "0.4.2",
  "private": true,
  "scripts": {
    "serve": "vue-cli-service serve",
@@ -13,7 +13,7 @@
    "@element-plus/icons-vue": "^2.3.1",
    "@monaco-editor/loader": "^1.4.0",
    "@vueuse/core": "^11.2.0",
-    "axios": "1.16.1",
+    "axios": "1.18.0",
    "clipboard": "^2.0.11",
    "core-js": "^3.8.3",
    "crypto-js": "^4.2.0",
@@ -511,6 +511,7 @@
            
            files.forEach(file => {
                const item = document.createElement('div');
+                const metaText = fileMetaText(file);
                
                if (file.fileType === 'folder') {
                    // 文件夹
@@ -520,9 +521,7 @@
                            <i class="fas fa-folder"></i>
                        </div>
                        <div class="item-name">${file.fileName || '未命名文件夹'}</div>
-                        <div class="item-meta">
-                            ${file.sizeStr || '0B'} · ${formatDate(file.createTime)}
-                        </div>
+                        ${metaText ? `<div class="item-meta">${metaText}</div>` : ''}
                    `;
                    folderCount++;
                    
@@ -541,9 +540,7 @@
                            <i class="fas ${fileTypeInfo.icon}"></i>
                        </div>
                        <div class="item-name">${file.fileName}</div>
-                        <div class="item-meta">
-                            ${file.sizeStr || '0B'} · ${formatDate(file.createTime)}
-                        </div>
+                        ${metaText ? `<div class="item-meta">${metaText}</div>` : ''}
                    `;
                    fileCount++;
                    
@@ -675,19 +672,65 @@
            renderBreadcrumb();
        }

+        // 文件元信息
+        function fileMetaText(file) {
+            const parts = [];
+            if (file.fileType !== 'folder') {
+                parts.push(file.sizeStr || '0B');
+            }
+            const dateText = formatDate(file.createTime);
+            if (dateText) {
+                parts.push(dateText);
+            }
+            return parts.join(' · ');
+        }
+
+        function hasValidTime(value) {
+            if (value === null || value === undefined) return false;
+            if (typeof value !== 'string') return true;
+            const trimmedValue = value.trim();
+            return trimmedValue !== '' && trimmedValue !== 'null' && trimmedValue !== 'undefined';
+        }
+
+        function formatDateOnly(yearValue, monthValue, dayValue) {
+            const year = Number(yearValue);
+            const month = Number(monthValue);
+            const day = Number(dayValue);
+            const date = new Date(year, month - 1, day);
+            if (
+                date.getFullYear() !== year ||
+                date.getMonth() !== month - 1 ||
+                date.getDate() !== day
+            ) {
+                return '';
+            }
+            return `${yearValue}-${String(month).padStart(2, '0')}-${String(day).padStart(2, '0')}`;
+        }
+
        // 格式化日期
        function formatDate(dateString) {
-            if (!dateString) return '未知日期';
+            if (!hasValidTime(dateString)) return '';
            
            try {
-                const date = new Date(dateString);
+                const value = typeof dateString === 'string' ? dateString.trim() : dateString;
+                if (typeof value === 'string') {
+                    const dateOnly = value.match(/^(\d{4})[-/](\d{1,2})[-/](\d{1,2})$/);
+                    if (dateOnly) {
+                        return formatDateOnly(dateOnly[1], dateOnly[2], dateOnly[3]);
+                    }
+                    const cnDateOnly = value.match(/^(\d{4})年\s*(\d{1,2})月\s*(\d{1,2})日$/);
+                    if (cnDateOnly) {
+                        return formatDateOnly(cnDateOnly[1], cnDateOnly[2], cnDateOnly[3]);
+                    }
+                }
+                const date = new Date(value);
                return isNaN(date.getTime()) 
-                    ? '未知日期' 
+                    ? ''
                    : `${date.getFullYear()}-${(date.getMonth() + 1).toString().padStart(2, '0')}-${date.getDate().toString().padStart(2, '0')}`;
            } catch {
-                return '未知日期';
+                return '';
            }
        }
    </script>
 </body>
-</html>
+</html>
@@ -24,7 +24,7 @@
            :class="[getFileTypeClass(file), { 'selected': batchMode && isFileSelected(file) }]"
            @click="batchMode ? onBatchClick(file) : handleFileClick(file)"
          >
-            <div v-if="batchMode && file.fileType !== 'folder'" class="batch-checkbox" @click.stop="toggleFileSelect(file)">
+            <div v-if="batchMode && isDownloadableFile(file)" class="batch-checkbox" @click.stop="toggleFileSelect(file)">
              <i :class="isFileSelected(file) ? 'fas fa-check-square' : 'far fa-square'" 
                 :style="{ color: isFileSelected(file) ? '#409eff' : '#c0c4cc' }"></i>
            </div>
@@ -32,8 +32,8 @@
              <i :class="getFileIcon(file)"></i>
            </div>
            <div class="file-name">{{ file.fileName }}</div>
-            <div class="file-meta">
-              <template v-if="file.fileType !== 'folder'">{{ file.sizeStr || '0B' }} · </template>{{ formatDate(file.createTime) }}
+            <div v-if="fileMetaText(file)" class="file-meta">
+              {{ fileMetaText(file) }}
            </div>
          </div>
          <div v-if="!loading && (!currentFileList || currentFileList.length === 0)" class="empty-state">
@@ -52,9 +52,10 @@
          <div class="batch-right">
            <el-button 
              type="primary" size="small"
-              :disabled="selectedFiles.length === 0"
+              :disabled="selectedFiles.length === 0 || batchBrowserDownloadDisabled"
              :loading="batchDownloading"
              @click="batchBrowserDownload"
+              :title="batchBrowserDownloadDisabled ? '所选文件需使用下载器下载' : ''"
            >
              <i class="fas fa-download"></i> 浏览器下载
            </el-button>
@@ -127,9 +128,10 @@
                    <el-button
                      type="primary"
                      size="small"
-                      :disabled="selectedFiles.length === 0 || batchDownloading"
+                      :disabled="selectedFiles.length === 0 || batchDownloading || batchBrowserDownloadDisabled"
                      :loading="batchDownloading"
                      @click="batchBrowserDownload"
+                      :title="batchBrowserDownloadDisabled ? '所选文件需使用下载器下载' : ''"
                    >
                      浏览器下载
                    </el-button>
@@ -166,24 +168,41 @@
                  </div>
                  <h4 class="file-detail-name">{{ selectedNode.fileName }}</h4>
                  <div v-if="selectedNode.fileType !== 'folder'" class="file-detail-meta">
-                    <p>类型: {{ getFileTypeClass(selectedNode) }}</p>
-                    <p>大小: {{ selectedNode.sizeStr || '0B' }}</p>
-                    <p v-if="selectedNode.createTime">创建时间: {{ formatDate(selectedNode.createTime) }}</p>
+                    <p>类型: {{ selectedNode.fileType === 'url' ? '超链接' : getFileTypeClass(selectedNode) }}</p>
+                    <p v-if="selectedNode.fileType !== 'url'">大小: {{ selectedNode.sizeStr || '0B' }}</p>
+                    <p v-if="selectedNode.fileType === 'url' && selectedNode.previewUrl" class="file-detail-link">
+                      链接: {{ selectedNode.previewUrl }}
+                    </p>
+                    <p v-if="formatDate(selectedNode.createTime)">创建时间: {{ formatDate(selectedNode.createTime) }}</p>
+                    <p v-if="formatDate(selectedNode.updateTime)">更新时间: {{ formatDate(selectedNode.updateTime) }}</p>
                  </div>
                  <div class="file-detail-actions">
-                    <el-button v-if="selectedNode.parserUrl" size="small" @click="previewFile(selectedNode)">
+                    <el-button
+                      v-if="selectedNode.fileType === 'url' && selectedNode.previewUrl"
+                      type="primary" size="small"
+                      @click="openExternalLink(selectedNode)"
+                    >
+                      <i class="fas fa-external-link-alt"></i> 打开链接
+                    </el-button>
+                    <el-button
+                      v-else-if="selectedNode.parserUrl || selectedNode.previewUrl"
+                      size="small"
+                      @click="previewFile(selectedNode)"
+                    >
                      <i class="fas fa-external-link-alt"></i> 打开
                    </el-button>
                    <el-button
-                      v-if="selectedNode.parserUrl && selectedNode.fileType !== 'folder'"
+                      v-if="isDownloadableFile(selectedNode)"
                      type="success" size="small"
                      @click="handleDownload(selectedNode)"
                      :loading="downloadLoading"
+                      :disabled="needsDownloader(selectedNode)"
+                      :title="needsDownloader(selectedNode) ? '该网盘需使用下载器下载' : ''"
                    >
                      <i class="fas fa-download"></i> 下载
                    </el-button>
                    <el-button
-                      v-if="selectedNode.parserUrl && selectedNode.fileType !== 'folder'"
+                      v-if="isDownloadableFile(selectedNode)"
                      type="primary" size="small"
                      @click="sendSingleToDownloader(selectedNode)"
                      :loading="singleSendLoading"
@@ -191,10 +210,12 @@
                      <i class="fas fa-paper-plane"></i> 发送到下载器
                    </el-button>
                    <el-button
-                      v-if="selectedNode.parserUrl"
+                      v-if="isDownloadableFile(selectedNode)"
                      size="small"
                      @click="copyDirectLink(selectedNode)"
                      :loading="copyLinkLoading"
+                      :disabled="needsDownloader(selectedNode)"
+                      :title="needsDownloader(selectedNode) ? '该网盘需使用下载器，无法直接复制直链' : ''"
                    >
                      <i class="fas fa-link"></i> 复制直链
                    </el-button>
@@ -242,24 +263,41 @@
                </div>
                <h4 class="file-detail-name">{{ selectedNode.fileName }}</h4>
                <div v-if="selectedNode.fileType !== 'folder'" class="file-detail-meta">
-                  <p>类型: {{ getFileTypeClass(selectedNode) }}</p>
-                  <p>大小: {{ selectedNode.sizeStr || '0B' }}</p>
-                  <p v-if="selectedNode.createTime">创建时间: {{ formatDate(selectedNode.createTime) }}</p>
+                  <p>类型: {{ selectedNode.fileType === 'url' ? '超链接' : getFileTypeClass(selectedNode) }}</p>
+                  <p v-if="selectedNode.fileType !== 'url'">大小: {{ selectedNode.sizeStr || '0B' }}</p>
+                  <p v-if="selectedNode.fileType === 'url' && selectedNode.previewUrl" class="file-detail-link">
+                    链接: {{ selectedNode.previewUrl }}
+                  </p>
+                  <p v-if="formatDate(selectedNode.createTime)">创建时间: {{ formatDate(selectedNode.createTime) }}</p>
+                  <p v-if="formatDate(selectedNode.updateTime)">更新时间: {{ formatDate(selectedNode.updateTime) }}</p>
                </div>
                <div class="file-detail-actions">
-                  <el-button v-if="selectedNode.parserUrl" size="small" @click="previewFile(selectedNode)">
+                  <el-button
+                    v-if="selectedNode.fileType === 'url' && selectedNode.previewUrl"
+                    type="primary" size="small"
+                    @click="openExternalLink(selectedNode)"
+                  >
+                    <i class="fas fa-external-link-alt"></i> 打开链接
+                  </el-button>
+                  <el-button
+                    v-else-if="selectedNode.parserUrl || selectedNode.previewUrl"
+                    size="small"
+                    @click="previewFile(selectedNode)"
+                  >
                    <i class="fas fa-external-link-alt"></i> 打开
                  </el-button>
                  <el-button
-                    v-if="selectedNode.parserUrl && selectedNode.fileType !== 'folder'"
+                    v-if="isDownloadableFile(selectedNode)"
                    type="success" size="small"
                    @click="handleDownload(selectedNode)"
                    :loading="downloadLoading"
+                    :disabled="needsDownloader(selectedNode)"
+                    :title="needsDownloader(selectedNode) ? '该网盘需使用下载器下载' : ''"
                  >
                    <i class="fas fa-download"></i> 下载
                  </el-button>
                  <el-button
-                    v-if="selectedNode.parserUrl && selectedNode.fileType !== 'folder'"
+                    v-if="isDownloadableFile(selectedNode)"
                    type="primary" size="small"
                    @click="sendSingleToDownloader(selectedNode)"
                    :loading="singleSendLoading"
@@ -267,10 +305,12 @@
                    <i class="fas fa-paper-plane"></i> 发送到下载器
                  </el-button>
                  <el-button
-                    v-if="selectedNode.parserUrl"
+                    v-if="isDownloadableFile(selectedNode)"
                    size="small"
                    @click="copyDirectLink(selectedNode)"
                    :loading="copyLinkLoading"
+                    :disabled="needsDownloader(selectedNode)"
+                    :title="needsDownloader(selectedNode) ? '该网盘需使用下载器，无法直接复制直链' : ''"
                  >
                    <i class="fas fa-link"></i> 复制直链
                  </el-button>
@@ -288,7 +328,7 @@
              <div v-if="batchMode" class="mobile-batch-footer">
                <span class="tree-sidebar-count">已勾选 {{ selectedFiles.length }} 个文件</span>
                <div class="tree-sidebar-actions">
-                  <el-button type="primary" size="small" :disabled="selectedFiles.length === 0 || batchDownloading" :loading="batchDownloading" @click="batchBrowserDownload">浏览器下载</el-button>
+                  <el-button type="primary" size="small" :disabled="selectedFiles.length === 0 || batchDownloading || batchBrowserDownloadDisabled" :loading="batchDownloading" @click="batchBrowserDownload" :title="batchBrowserDownloadDisabled ? '所选文件需使用下载器下载' : ''">浏览器下载</el-button>
                  <el-button type="success" size="small" :disabled="selectedFiles.length === 0 || batchDownloading" :loading="batchDownloading" @click="batchSendToDownloader">发送到下载器</el-button>
                  <el-button size="small" @click="toggleBatchMode">取消</el-button>
                </div>
@@ -314,25 +354,29 @@
        <div class="file-dialog-content">
          <p><strong>{{ selectedFile?.fileName || '未命名文件' }}</strong></p>
          <p class="file-info">
-            大小: {{ selectedFile?.sizeStr || '0B' }}<br>
-            创建时间: {{ formatDate(selectedFile?.createTime) }}
+            <template v-for="(line, index) in selectedFileInfoLines" :key="index">
+              {{ line }}<br v-if="index < selectedFileInfoLines.length - 1">
+            </template>
          </p>
        </div>
        
        <span slot="footer" class="dialog-footer">
-          <el-button type="primary" @click="previewFile(selectedFile)">打开</el-button>
-          <!-- 弹窗下载按钮 -->
+          <el-button type="primary" @click="previewFile(selectedFile)">
+            {{ selectedFile?.fileType === 'url' ? '打开链接' : '打开' }}
+          </el-button>
          <el-button
-            v-if="selectedFile && selectedFile.parserUrl"
+            v-if="isDownloadableFile(selectedFile)"
            type="success"
            @click="handleDownload(selectedFile)"
            style="margin-left: 8px;"
            :loading="downloadLoading"
+            :disabled="needsDownloader(selectedFile)"
+            :title="needsDownloader(selectedFile) ? '该网盘需使用下载器下载' : ''"
          >
            下载
          </el-button>
          <el-button
-            v-if="selectedFile && selectedFile.parserUrl"
+            v-if="isDownloadableFile(selectedFile)"
            type="primary"
            @click="sendSingleToDownloader(selectedFile)"
            style="margin-left: 8px;"
@@ -341,10 +385,12 @@
            发送到下载器
          </el-button>
          <el-button
-            v-if="selectedFile && selectedFile.parserUrl"
+            v-if="isDownloadableFile(selectedFile)"
            @click="copyDirectLink(selectedFile)"
            style="margin-left: 8px;"
            :loading="copyLinkLoading"
+            :disabled="needsDownloader(selectedFile)"
+            :title="needsDownloader(selectedFile) ? '该网盘需使用下载器，无法直接复制直链' : ''"
          >
            复制直链
          </el-button>
@@ -391,6 +437,11 @@ export default {
      type: String,
      default: ''
    },
+    // 加密 auth，用于子目录/下载请求透传（后端未带上时前端补齐）
+    auth: {
+      type: String,
+      default: ''
+    },
    viewMode: {
      type: String,
      default: 'pane' // 'pane' or 'tree'
@@ -444,6 +495,24 @@ export default {
      if (this.batchProgress.failed > 0) return 'exception'
      if (this.batchProgress.current >= this.batchProgress.total && this.batchProgress.total > 0) return 'success'
      return ''
+    },
+    selectedFileInfoLines() {
+      if (!this.selectedFile) return []
+      const lines = [`大小: ${this.selectedFile.sizeStr || '0B'}`]
+      const createTime = this.formatDate(this.selectedFile.createTime)
+      const updateTime = this.formatDate(this.selectedFile.updateTime)
+      if (createTime) {
+        lines.push(`创建时间: ${createTime}`)
+      }
+      if (updateTime) {
+        lines.push(`更新时间: ${updateTime}`)
+      }
+      return lines
+    },
+    // 所选文件全部需要下载器时，禁用浏览器批量下载
+    batchBrowserDownloadDisabled() {
+      return this.selectedFiles.length > 0
+        && this.selectedFiles.every(f => this.needsDownloader(f))
    }
  },
  watch: {
@@ -477,6 +546,13 @@ export default {
      }
      return headers
    },
+    // 子目录/下载链接透传 auth，避免进入子目录变成 guest
+    // 注意：auth 可能已 encodeURIComponent，直接拼接，避免 searchParams 再编一层
+    withAuth(url) {
+      if (!url || !this.auth) return url
+      if (/[?&]auth=/.test(url)) return url
+      return url + (url.includes('?') ? '&' : '?') + 'auth=' + this.auth
+    },
    buildApiUrl() {
      const baseUrl = `${window.location.origin}/v2/getFileList`
      const params = new URLSearchParams({
@@ -485,14 +561,14 @@ export default {
      if (this.password) {
        params.append('pwd', this.password)
      }
-      return `${baseUrl}?${params.toString()}`
+      return this.withAuth(`${baseUrl}?${params.toString()}`)
    },
    // 懒加载子节点
    loadNode(node, resolve) {
      if (node.level === 0) {
        resolve(this.treeData[0].children)
      } else if (node.data.fileType === 'folder' && node.data.parserUrl) {
-        axios.get(node.data.parserUrl, { headers: this.apiKeyHeaders() }).then(res => {
+        axios.get(this.withAuth(node.data.parserUrl), { headers: this.apiKeyHeaders() }).then(res => {
          if (res.data.code === 200) {
            const children = (res.data.data || []).map(item => ({
              ...item,
@@ -519,6 +595,8 @@ export default {
    handleFileClick(file) {
      if (file.fileType === 'folder') {
        this.enterFolder(file)
+      } else if (file.fileType === 'url') {
+        this.openExternalLink(file)
      } else if (this.viewMode === 'pane') {
        this.selectedFile = file
        this.fileDialogVisible = true
@@ -532,10 +610,11 @@ export default {
      }
      try {
        this.loading = true
-        const response = await axios.get(folder.parserUrl, { headers: this.apiKeyHeaders() })
+        const folderUrl = this.withAuth(folder.parserUrl)
+        const response = await axios.get(folderUrl, { headers: this.apiKeyHeaders() })
        if (response.data.code === 200) {
          const newDir = {
-            url: folder.parserUrl,
+            url: folderUrl,
            name: folder.fileName || '未命名文件夹'
          }
          this.pathStack.push(newDir)
@@ -569,7 +648,7 @@ export default {
      }
      try {
        this.loading = true
-        const response = await axios.get(currentDir.url, { headers: this.apiKeyHeaders() })
+        const response = await axios.get(this.withAuth(currentDir.url), { headers: this.apiKeyHeaders() })
        if (response.data.code === 200) {
          this.currentFileList = response.data.data || []
        } else {
@@ -583,8 +662,32 @@ export default {
        this.loading = false
      }
    },
+    isDownloadableFile(file) {
+      return !!(file && file.parserUrl && file.fileType !== 'folder' && file.fileType !== 'url')
+    },
+    // 需要下载器（带 cookie 等特殊头）时，浏览器直连/复制直链不可用
+    // UC/夸克目录文件始终走下载器
+    needsDownloader(file) {
+      if (!file) return false
+      if (file.extParameters && file.extParameters.needDownloader) return true
+      const pan = (file.panType || '').toLowerCase()
+      return pan === 'uc' || pan === 'qk'
+    },
+    openExternalLink(file) {
+      const link = file?.previewUrl || file?.description
+      if (!link) {
+        this.$message.warning('该条目暂无外链')
+        return
+      }
+      window.open(link, '_blank', 'noopener,noreferrer')
+      this.closeFileDialog()
+    },
    // 预览文件
    previewFile(file) {
+      if (file?.fileType === 'url') {
+        this.openExternalLink(file)
+        return
+      }
      if (file?.previewUrl || file?.parserUrl) {
        this.previewUrl = this.appendToken(file.previewUrl || file.parserUrl)
        this.isPreviewing = true
@@ -634,25 +737,18 @@ export default {
      // 需要下载器，调用 getFileDownInfo 接口获取下载信息
      this.downloadLoading = true
      try {
-        // 从 parserUrl 提取 type 和 param
-        // parserUrl 格式: /v2/redirectUrl/{type}/{param} 或 完整URL
-        const url = new URL(file.parserUrl, window.location.origin)
-        const pathParts = url.pathname.split('/')
-        // 找到 redirectUrl 后面的部分
-        const redirectIdx = pathParts.indexOf('redirectUrl')
-        if (redirectIdx === -1 || redirectIdx + 2 >= pathParts.length) {
+        const tp = this.extractTypeParam(file)
+        if (!tp) {
          this.$message.error('无法解析下载参数')
          return
        }
-        const type = pathParts[redirectIdx + 1]
-        const param = pathParts[redirectIdx + 2]
        
        const headers = {}
        const apiKey = localStorage.getItem('nfd_user_api_key')
        if (apiKey) {
          headers['X-API-Key'] = apiKey
        }
-        const response = await axios.get(`${window.location.origin}/v2/getFileDownInfo/${type}/${param}`, { headers })
+        const response = await axios.get(this.buildFileDownInfoUrl(tp.type, tp.param), { headers })
        if (response.data.code === 200 && response.data.data) {
          const info = response.data.data
          if (info.needDownloader) {
@@ -743,10 +839,7 @@ export default {
        const tp = this.extractTypeParam(file)
        if (tp && file.extParameters && file.extParameters.needDownloader) {
          const headers = this.apiKeyHeaders()
-          const resp = await axios.get(
-            `${window.location.origin}/v2/getFileDownInfo/${tp.type}/${tp.param}`,
-            { headers }
-          )
+          const resp = await axios.get(this.buildFileDownInfoUrl(tp.type, tp.param), { headers })
          const info = resp.data.data || resp.data
          if (info && info.downloadUrl) {
            await addDownload(info.downloadUrl, info.downloadHeaders || {}, file.fileName)
@@ -815,11 +908,56 @@ export default {
        document.body.removeChild(a)
      }
    },
+    hasValidTime(value) {
+      if (value === null || value === undefined) return false
+      if (typeof value !== 'string') return true
+      const trimmedValue = value.trim()
+      return trimmedValue !== '' && trimmedValue !== 'null' && trimmedValue !== 'undefined'
+    },
+    formatDateOnly(yearValue, monthValue, dayValue) {
+      const year = Number(yearValue)
+      const month = Number(monthValue)
+      const day = Number(dayValue)
+      const date = new Date(year, month - 1, day)
+      if (
+        date.getFullYear() !== year ||
+        date.getMonth() !== month - 1 ||
+        date.getDate() !== day
+      ) {
+        return ''
+      }
+      return `${yearValue}-${String(month).padStart(2, '0')}-${String(day).padStart(2, '0')}`
+    },
    formatDate(timestamp) {
-      if (!timestamp) return '未知时间'
-      const date = new Date(timestamp)
+      if (!this.hasValidTime(timestamp)) return ''
+      const value = typeof timestamp === 'string' ? timestamp.trim() : timestamp
+      if (typeof value === 'string') {
+        const dateOnly = value.match(/^(\d{4})[-/](\d{1,2})[-/](\d{1,2})$/)
+        if (dateOnly) {
+          return this.formatDateOnly(dateOnly[1], dateOnly[2], dateOnly[3])
+        }
+        const cnDateOnly = value.match(/^(\d{4})年\s*(\d{1,2})月\s*(\d{1,2})日$/)
+        if (cnDateOnly) {
+          return this.formatDateOnly(cnDateOnly[1], cnDateOnly[2], cnDateOnly[3])
+        }
+      }
+      const date = new Date(value)
+      if (Number.isNaN(date.getTime())) return ''
      return date.toLocaleString('zh-CN')
    },
+    fileMetaText(file) {
+      const parts = []
+      if (file.fileType === 'url') {
+        parts.push('超链接')
+      } else if (file.fileType !== 'folder') {
+        parts.push(file.sizeStr || '0B')
+      }
+      const timeText = this.formatDate(file.createTime)
+      if (timeText) {
+        parts.push(timeText)
+      }
+      return parts.join(' · ')
+    },
    checkTheme() {
      this.isDarkTheme = document.documentElement.classList.contains('dark')
    },
@@ -857,7 +995,7 @@ export default {
      this.toggleFileSelect(file)
    },
    selectAll() {
-      this.selectedFiles = this.currentFileList.filter(f => f.fileType !== 'folder' && f.parserUrl)
+      this.selectedFiles = this.currentFileList.filter(f => this.isDownloadableFile(f))
    },
    deselectAll() {
      this.selectedFiles = []
@@ -865,25 +1003,41 @@ export default {
    onTreeCheckChange() {
      if (!this.$refs.fileTree) return
      const checked = this.$refs.fileTree.getCheckedNodes()
-      this.selectedFiles = checked.filter(n => n.fileType !== 'folder' && n.parserUrl)
+      this.selectedFiles = checked.filter(n => this.isDownloadableFile(n))
    },
    extractTypeParam(file) {
      if (!file.parserUrl) return null
      try {
+        // pathname 已是解码后的 path；后端现用 URL-Safe Base64（无 %），可直接使用
        const url = new URL(file.parserUrl, window.location.origin)
-        const parts = url.pathname.split('/')
-        const idx = parts.indexOf('redirectUrl')
-        if (idx === -1 || idx + 2 >= parts.length) return null
-        return { type: parts[idx + 1], param: parts[idx + 2] }
+        const m = url.pathname.match(/\/redirectUrl\/([^/]+)\/(.+)$/)
+        if (!m) return null
+        let param = m[2]
+        // 兼容历史「标准 Base64 + URLEncode」旧链接
+        if (/%[0-9A-Fa-f]{2}/.test(param)) {
+          try { param = decodeURIComponent(param) } catch { /* ignore */ }
+        }
+        return { type: m[1], param }
      } catch {
        return null
      }
    },
+    // URL-Safe Base64 本身可进 path；encodeURIComponent 对 - _ 无影响，只 encode 一次
+    buildFileDownInfoUrl(type, param) {
+      return this.withAuth(
+        `${window.location.origin}/v2/getFileDownInfo/${type}/${encodeURIComponent(param)}`
+      )
+    },
    async batchBrowserDownload() {
      if (this.selectedFiles.length === 0) return
+      const files = this.selectedFiles.filter(f => !this.needsDownloader(f))
+      if (files.length === 0) {
+        this.$message.warning('所选文件需使用「发送到下载器」下载')
+        return
+      }
      this.batchDownloading = true
-      this.batchProgress = { current: 0, total: this.selectedFiles.length, failed: 0 }
-      for (const file of this.selectedFiles) {
+      this.batchProgress = { current: 0, total: files.length, failed: 0 }
+      for (const file of files) {
        try {
          const a = document.createElement('a')
          const rawUrl = file.parserUrl.startsWith('http') ? file.parserUrl : (window.location.origin + file.parserUrl)
@@ -916,13 +1070,32 @@ export default {
      const total = this.selectedFiles.length
      this.batchProgress = { current: 0, total, failed: 0 }

-      // 所有文件统一发 parserUrl(302) + downloadHeaders 给下载器
+      // needDownloader 文件走 getFileDownInfo 拿直链+cookie；其余发 parserUrl + headers
      const downloadTasks = []
+      const apiHeaders = this.apiKeyHeaders()
      for (const file of this.selectedFiles) {
-        const rawUrl = file.parserUrl.startsWith('http') ? file.parserUrl : (window.location.origin + file.parserUrl)
-        const url = this.appendToken(rawUrl)
-        const headers = (file.extParameters && file.extParameters.downloadHeaders) || {}
-        downloadTasks.push({ url, headers, fileName: file.fileName })
+        try {
+          if (this.needsDownloader(file)) {
+            const tp = this.extractTypeParam(file)
+            if (!tp) throw new Error('无法解析下载参数')
+            const resp = await axios.get(this.buildFileDownInfoUrl(tp.type, tp.param), { headers: apiHeaders })
+            const info = resp.data.data || resp.data
+            if (!info?.downloadUrl) throw new Error('获取下载信息失败')
+            downloadTasks.push({
+              url: info.downloadUrl,
+              headers: info.downloadHeaders || {},
+              fileName: file.fileName
+            })
+          } else {
+            const rawUrl = file.parserUrl.startsWith('http') ? file.parserUrl : (window.location.origin + file.parserUrl)
+            const url = this.appendToken(rawUrl)
+            const headers = (file.extParameters && file.extParameters.downloadHeaders) || {}
+            downloadTasks.push({ url, headers, fileName: file.fileName })
+          }
+        } catch (e) {
+          console.error('准备下载任务失败:', file.fileName, e)
+          this.batchProgress.failed++
+        }
        this.batchProgress.current++
      }

@@ -946,14 +1119,18 @@ export default {
    },
    renderContent(h, { node, data, store }) {
      const isFolder = data.fileType === 'folder'
+      const isUrl = data.fileType === 'url'
      return h('div', {
        class: 'custom-tree-node'
      }, [
        h('i', {
-          class: [this.getFileIcon(data), { 'folder-icon': isFolder, 'file-icon': !isFolder }]
+          class: [
+            this.getFileIcon(data),
+            { 'folder-icon': isFolder, 'url-icon': isUrl, 'file-icon': !isFolder && !isUrl }
+          ]
        }),
        h('span', {
-          class: ['node-label', { 'folder-text': isFolder, 'file-text': !isFolder }]
+          class: ['node-label', { 'folder-text': isFolder, 'url-text': isUrl, 'file-text': !isFolder && !isUrl }]
        }, node.label)
      ])
    }
@@ -1134,6 +1311,10 @@ html, body, #app, .main-container, .directory-tree, .content-card {
  color: #27ae60;
 }

+.url .file-icon {
+  color: #1a73e8;
+}
+
 .file-name {
  font-weight: 500;
  font-size: 0.85rem;
@@ -1379,6 +1560,22 @@ html, body, #app, .main-container, .directory-tree, .content-card {
  color: #4a9eff !important;
 }

+.custom-tree-node .url-icon {
+  color: #1a73e8 !important;
+}
+
+.dark-theme .custom-tree-node .url-icon {
+  color: #8ab4f8 !important;
+}
+
+.custom-tree-node .url-text {
+  color: #1a73e8 !important;
+}
+
+.dark-theme .custom-tree-node .url-text {
+  color: #8ab4f8 !important;
+}
+
 .custom-tree-node .folder-text {
  color: #409eff !important;
  font-weight: 500;
@@ -238,8 +238,8 @@
            storage: 'hash'
        },
        'ctfile': {
-            reg: /((?:https?:\/\/)?(?:[a-zA-Z\d-.]+)?(?:ctfile|545c|u062|ghpym|474b)\.com\/\w+\/[a-zA-Z\d-]+)/,
-            host: /(?:[a-zA-Z\d-.]+)?(?:ctfile|545c|u062|474b)\.com/,
+            reg: /((?:https?:\/\/)?(?:[a-zA-Z\d-.]+)?(?:ctfile|545c|u062|ghpym|474b)\.com\/(?:f(?:ile)?|d)\/[a-zA-Z\d_-]+\/?(?:\?[^#\s]*)?)/,
+            host: /(?:[a-zA-Z\d-.]+)?(?:ctfile|545c|u062|ghpym|474b)\.com/,
            input: ['#passcode'],
            button: ['.card-body button'],
            name: '城通网盘',
@@ -356,6 +356,13 @@
            host: /(fast|drive)\.uc\.cn/,
            name: 'UC网盘'
        },
+        // 永硕E盘：主 ysepan.com/ys168.com，备 cccpan.com/ysupan.com/uupan.net/ysok.net
+        ysepan: {
+            reg: /https?:\/\/(?!(?:www|zy|ht|api|c\d+|ys-[a-zA-Z0-9]+)\.)[a-zA-Z\d-]+\.(?:ysepan\.com|ys168\.com|cccpan\.com|ysupan\.com|uupan\.net|ysok\.net)\/?/,
+            host: /[a-zA-Z\d-]+\.(?:ysepan\.com|ys168\.com|cccpan\.com|ysupan\.com|uupan\.net|ysok\.net)/,
+            name: '永硕E盘',
+            storage: 'hash'
+        },

        other: {
            reg: /https:\/\/([a-zA-Z0-9]+(-[a-zA-Z0-9]+)*\.)+[a-zA-Z]{2,}\/s\/.+/,
@@ -5,6 +5,7 @@ const fileTypeUtils = {
  },
  getFileTypeClass(file) {
    if (file.fileType === 'folder') return 'folder'
+    if (file.fileType === 'url') return 'url'
    const ext = this.getFileExtension(file.fileName)
    const fileTypes = {
      'image': ['jpg', 'jpeg', 'png', 'gif', 'bmp', 'svg', 'webp'],
@@ -23,6 +24,8 @@ const fileTypeUtils = {
  },
  getFileIcon(file) {
    if (file.fileType === 'folder') return 'fas fa-folder'
+    // 永硕等网盘的外链/公告条目
+    if (file.fileType === 'url') return 'fas fa-link'
    const ext = this.getFileExtension(file.fileName)
    const iconMap = {
      'jpg': 'fas fa-file-image', 'jpeg': 'fas fa-file-image', 'png': 'fas fa-file-image',
@@ -83,9 +83,9 @@ function registerTypeDefinitions(monaco) {
      clearHeaders(): JsHttpClient;
      getHeaders(): Record<string, string>;
      setTimeout(seconds: number): JsHttpClient;
-      sendForm(data: Record<string, any>): JsHttpResponse;
+      sendForm(url: string, data: Record<string, any>): JsHttpResponse;
      sendMultipartForm(url: string, data: Record<string, any>): JsHttpResponse;
-      sendJson(data: any): JsHttpResponse;
+      sendJson(url: string, data: any): JsHttpResponse;
      urlEncode(str: string): string;
      urlDecode(str: string): string;
    }
@@ -244,17 +244,17 @@ function registerCompletionProvider(monaco) {
          range
        },
        {
-          label: 'http.sendForm(data)',
+          label: 'http.sendForm(url, data)',
          kind: monaco.languages.CompletionItemKind.Method,
-          insertText: 'http.sendForm(${1:data})',
+          insertText: 'http.sendForm(${1:url}, ${2:data})',
          insertTextRules: monaco.languages.CompletionItemInsertTextRule.InsertAsSnippet,
          documentation: '发送表单数据',
          range
        },
        {
-          label: 'http.sendJson(data)',
+          label: 'http.sendJson(url, data)',
          kind: monaco.languages.CompletionItemKind.Method,
-          insertText: 'http.sendJson(${1:data})',
+          insertText: 'http.sendJson(${1:url}, ${2:data})',
          insertTextRules: monaco.languages.CompletionItemInsertTextRule.InsertAsSnippet,
          documentation: '发送JSON数据',
          range
@@ -131,10 +131,15 @@
                  <div style="display: flex; align-items: center; justify-content: space-between;">
                    <span>下载链接</span>
                    <div style="display: flex; gap: 8px;">
-                      <el-button @click="openUrl(downloadUrl)" type="primary" size="small">
-                        <el-icon style="margin-right: 4px;"><Download /></el-icon> 下载
-                      </el-button>
-                      <el-button @click="openUrl(getPreviewLink())" type="default" size="small">
+                      <el-tooltip :disabled="!needsDownloader"
+                        content="该网盘需使用下载器下载" placement="top">
+                        <el-button @click="openUrl(downloadUrl)" type="primary" size="small"
+                          :disabled="needsDownloader">
+                          <el-icon style="margin-right: 4px;"><Download /></el-icon> 下载
+                        </el-button>
+                      </el-tooltip>
+                      <el-button @click="openUrl(getPreviewLink())" type="default" size="small"
+                        :disabled="needsDownloader">
                        <el-icon style="margin-right: 4px;"><View /></el-icon> 预览
                      </el-button>
                      <el-tooltip :disabled="aria2Connected"
@@ -150,10 +155,14 @@
                </template>
                <el-input :value="downloadUrl" readonly>
                  <template #append>
-                    <el-button v-clipboard:copy="downloadUrl" v-clipboard:success="onCopy"
-                      v-clipboard:error="onError" style="padding: 0 14px;">
-                      <el-icon><CopyDocument/></el-icon>
-                    </el-button>
+                    <el-tooltip :disabled="!needsDownloader"
+                      content="该网盘需使用下载器，无法直接复制直链" placement="top">
+                      <el-button v-clipboard:copy="downloadUrl" v-clipboard:success="onCopy"
+                        v-clipboard:error="onError" style="padding: 0 14px;"
+                        :disabled="needsDownloader">
+                        <el-icon><CopyDocument/></el-icon>
+                      </el-button>
+                    </el-tooltip>
                  </template>
                </el-input>
                <!-- 文件元信息 -->
@@ -326,6 +335,10 @@
                      <span>蓝奏优享 (IZ)</span>
                      <el-tag size="small" type="warning" style="margin-left: 8px">大文件</el-tag>
                    </el-option>
+                    <el-option label="123云盘 (YE)" value="YE">
+                      <span>123云盘 (YE)</span>
+                      <el-tag size="small" type="warning" style="margin-left: 8px">部分分享需登录</el-tag>
+                    </el-option>
                  </el-option-group>
                </el-select>
              </el-form-item>
@@ -413,6 +426,7 @@
              :file-list="directoryData" 
              :share-url="link"
              :password="password"
+              :auth="directoryAuth"
              :view-mode="directoryViewMode"
              @file-click="handleFileClick"
            />
@@ -645,6 +659,7 @@ export default {
      // 目录树
      showDirectoryTree: false,
      directoryData: [],
+      directoryAuth: '', // 目录解析时的加密 auth，透传给子目录/下载
      
      // 统计信息
      node1Info: {},
@@ -756,6 +771,16 @@ export default {
        thunder: '迅雷'
      }
      return map[this.aria2ConfigForm.downloaderType] || 'Aria2'
+    },
+    // 需要下载器（带 cookie 等特殊头）时禁用浏览器下载/复制直链；UC/夸克始终需要
+    needsDownloader() {
+      const pan = (this.getCurrentPanType() || '').toLowerCase()
+      if (pan === 'uc' || pan === 'qk') return true
+      const data = this.parseResult?.data
+      if (!data) return false
+      if (data.needDownloader || data.otherParam?.needDownloader) return true
+      const headers = data.downloadHeaders || data.otherParam?.downloadHeaders
+      return !!(headers && (headers.cookie || headers.Cookie))
    }
  },
  methods: {
@@ -767,7 +792,8 @@ export default {
      if (url.includes('drive.uc.cn') || url.includes('fast.uc.cn')) return 'UC'
      if (url.includes('feijipan.com') || url.includes('feijihe.com') || url.includes('xiaofeiyang.com')) return 'FJ'
      if (url.includes('ilanzou.com') || url.includes('lanzouv.com')) return 'IZ'
-      if (url.includes('123pan.com') || url.includes('123684.com') || url.includes('123865.com')) return 'YE'
+      // 123网盘域名较多（如 123pan.com/123pan.cn/share.123pan.cn/123684.com/123865.com 等数字域名），使用规则匹配代替枚举
+      if (/123\d{3}\.com|123panpay\.com|123pan\.(?:com|cn)/.test(url)) return 'YE'
      return ''
    },
    
@@ -789,7 +815,8 @@ export default {
        'QK': '夸克网盘必须配置 Cookie 才能解析和下载（登录后从浏览器开发者工具获取）',
        'UC': 'UC网盘必须配置 Cookie 才能解析和下载（登录后从浏览器开发者工具获取）',
        'FJ': '小飞机网盘大文件（>100MB）需要配置认证信息',
-        'IZ': '蓝奏优享大文件需要配置认证信息'
+        'IZ': '蓝奏优享大文件需要配置认证信息',
+        'YE': '123云盘部分分享（需要登录才能查看/下载）需要配置账号密码或 Authorization Token'
      }
      return hints[this.authConfig.panType] || '请选择网盘类型后配置认证信息'
    },
@@ -1162,6 +1189,7 @@ export default {
      this.statisticsData = {}
      this.showDirectoryTree = false
      this.directoryData = []
+      this.directoryAuth = ''
    },

    // 统一API调用（自动添加认证参数）
@@ -1170,10 +1198,12 @@ export default {
      this.errorBadgeVisible = false
      try {
        this.isLoading = true
-        // 添加认证参数（异步获取）
-        const authParam = await this.generateAuthParam()
-        if (authParam) {
-          params.auth = authParam
+        // 添加认证参数（已有则不覆盖，便于目录树透传同一份 auth）
+        if (!params.auth) {
+          const authParam = await this.generateAuthParam()
+          if (authParam) {
+            params.auth = authParam
+          }
        }
        const response = await axios.get(`${this.baseAPI}${endpoint}`, { params })

@@ -1230,10 +1260,11 @@ export default {
            duration: 5000,
            showClose: true
          })
-        } else if (panType === 'fj' || panType === 'lz' || panType === 'iz' || panType === 'le') {
-          // 小飞机、蓝奏、优享、联想乐云：提示大文件需要认证
+        } else if (panType === 'fj' || panType === 'lz' || panType === 'iz' || panType === 'le' || panType === 'ye') {
+          // 小飞机、蓝奏、优享、联想乐云、123云盘：提示大文件/需登录分享需要认证
          const hasAuth = this.allAuthConfigs[panType]?.cookie || 
                          this.allAuthConfigs[panType]?.username ||
+                          this.allAuthConfigs[panType]?.token ||
                          (this.donateAccountCounts.active[panType.toUpperCase()] || 0) > 0
          if (!hasAuth) {
            this.$message.info({
@@ -1260,11 +1291,13 @@ export default {
        // 更新智能直链（包含认证参数）
        this.updateDirectLink()
        // 如果需要下载器（含特殊头），弹出下载器对话框
-        if (result.data?.needDownloader) {
+        const needDownloader = !!(result.data?.needDownloader || otherParam.needDownloader
+          || otherParam.downloadHeaders?.cookie || otherParam.downloadHeaders?.Cookie)
+        if (needDownloader) {
          this.downloadDialogInfo = {
            downloadUrl: result.data.directLink,
-            fileName: result.data.fileName || '',
-            downloadHeaders: result.data.downloadHeaders || {},
+            fileName: result.data.fileInfo?.fileName || result.data.fileName || '',
+            downloadHeaders: result.data.downloadHeaders || otherParam.downloadHeaders || {},
            aria2Command: this.aria2Command,
            curlCommand: this.curlCommand,
            aria2JsonRpc: this.aria2JsonRpc,
@@ -1284,6 +1317,11 @@ export default {
        this.validateInput()
        const params = { url: this.link }
        if (this.password) params.pwd = this.password
+        // 预先生成 auth，既给本次请求用，也透传给 DirectoryTree 子目录/下载
+        this.directoryAuth = await this.generateAuthParam()
+        if (this.directoryAuth) {
+          params.auth = this.directoryAuth
+        }
        
        // 直接调用 getFileList，让后端返回错误（不做客户端类型检查）
        const directoryResult = await this.callAPI('/v2/getFileList', params)
@@ -1612,12 +1650,14 @@ export default {
      
      this.donateSubmitting = true
      try {
+        // 只提交当前认证方式实际用到的字段，避免切换认证类型后遗留的用户名/密码脏数据被一起提交
+        const isPasswordAuth = this.donateConfig.authType === 'password'
        const payload = {
          panType: this.donateConfig.panType,
          authType: this.donateConfig.authType,
-          username: this.donateConfig.username || '',
-          password: this.donateConfig.password || '',
-          token: this.donateConfig.token || '',
+          username: isPasswordAuth ? (this.donateConfig.username || '') : '',
+          password: isPasswordAuth ? (this.donateConfig.password || '') : '',
+          token: isPasswordAuth ? '' : (this.donateConfig.token || ''),
          remark: this.donateConfig.remark || ''
        }
        await axios.post(`${this.baseAPI}/v2/donateAccount`, payload)
@@ -386,6 +386,16 @@
              "type": "string",
              "example": "uuid123"
            }
+          },
+          {
+            "name": "stoken",
+            "in": "query",
+            "required": false,
+            "description": "分享 token，用于子目录解析时复用认证状态",
+            "schema": {
+              "type": "string",
+              "example": "OASBe5qM0pg2VvvyLM..."
+            }
          }
        ],
        "responses": {
@@ -3,9 +3,11 @@ package cn.qaiu.lz;
 import cn.qaiu.WebClientVertxInit;
 import cn.qaiu.db.pool.JDBCPoolInit;
 import cn.qaiu.lz.common.cache.CacheConfigLoader;
+import cn.qaiu.lz.common.cache.CacheManager;
 import cn.qaiu.lz.common.interceptorImpl.RateLimiter;
 import cn.qaiu.lz.web.config.PlaygroundConfig;
 import cn.qaiu.lz.web.service.DbService;
+import cn.qaiu.lz.web.service.impl.ShoutServiceImpl;
 import cn.qaiu.parser.custom.CustomParserConfig;
 import cn.qaiu.parser.custom.CustomParserRegistry;
 import cn.qaiu.parser.customjs.JsScriptMetadataParser;
@@ -20,7 +22,10 @@ import io.vertx.core.json.jackson.DatabindCodec;
 import io.vertx.core.shareddata.LocalMap;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.lang3.time.DateFormatUtils;
+import org.slf4j.LoggerFactory;

+import java.nio.file.Files;
+import java.nio.file.Path;
 import java.util.Date;

 import static cn.qaiu.vx.core.util.ConfigConstant.LOCAL;
@@ -36,22 +41,45 @@ import static cn.qaiu.vx.core.util.ConfigConstant.LOCAL;
 public class AppMain {

    public static void main(String[] args) {
-        // 先注册 ShutdownHook（JVM 逆序执行，先注册的后执行）
-        // 确保关闭顺序：Vert.x -> JDBCPoolInit -> JsParserExecutor
-        Runtime.getRuntime().addShutdownHook(new Thread(() -> {
-            try {
-                JDBCPoolInit.instance().close();
-            } catch (Exception e) {
-                // ignore
-            }
-            try {
-                cn.qaiu.parser.customjs.JsParserExecutor.shutdownExecutor();
-            } catch (Exception e) {
-                // ignore
-            }
-        }));
+        applyRuntimeLogLevelOverride();
+        Deploy deploy = Deploy.instance();
+        // 先阻断应用级定时任务，再让 Vert.x 停入口和 verticle。
+        deploy.addPreShutdownTask(CacheManager::cancelPeriodicCleanup);
+        deploy.addPreShutdownTask(ShoutServiceImpl::cancelCleanup);
+        // Vert.x 停完后再关数据库和解析器共享资源，避免请求还在路上就先关底层 client。
+        deploy.addPostShutdownTask(() -> JDBCPoolInit.instance().close());
+        deploy.addPostShutdownTask(cn.qaiu.parser.customjs.JsParserExecutor::shutdownExecutor);
+        deploy.addPostShutdownTask(cn.qaiu.parser.customjs.JsPlaygroundExecutor::shutdownPools);
+        deploy.addPostShutdownTask(cn.qaiu.parser.customjs.JsHttpClient::shutdownSharedClient);
+        deploy.addPostShutdownTask(cn.qaiu.parser.PanBase::shutdownSharedClients);
+        deploy.addPostShutdownTask(cn.qaiu.parser.IPanTool::shutdownCloseAfterScheduler);
+        deploy.addPostShutdownTask(cn.qaiu.parser.impl.PodTool::shutdownWorkerExecutor);
        // start
-        Deploy.instance().start(args, AppMain::exec);
+        deploy.start(args, AppMain::exec);
+    }
+
+    private static void applyRuntimeLogLevelOverride() {
+        String levelName = System.getProperty("NFD_LOG_LEVEL");
+        if (levelName == null || levelName.isBlank()) {
+            levelName = System.getenv("NFD_LOG_LEVEL");
+        }
+        if (levelName == null || levelName.isBlank()) {
+            return;
+        }
+        try {
+            var level = ch.qos.logback.classic.Level.toLevel(levelName, null);
+            if (level == null) {
+                log.warn("忽略无效的 NFD_LOG_LEVEL: {}", levelName);
+                return;
+            }
+            var logger = LoggerFactory.getLogger("cn.qaiu");
+            if (logger instanceof ch.qos.logback.classic.Logger logbackLogger) {
+                logbackLogger.setLevel(level);
+                log.info("cn.qaiu 日志级别已覆盖为 {}", level);
+            }
+        } catch (Exception e) {
+            log.warn("覆盖 cn.qaiu 日志级别失败: {}", e.getMessage());
+        }
    }

    /**
@@ -63,6 +91,8 @@ public class AppMain {
    private static void exec(JsonObject jsonObject) {
        WebClientVertxInit.init(VertxHolder.getVertxInstance());
        DatabindCodec.mapper().registerModule(new JavaTimeModule());
+        // 演练场配置要先加载，后续启动流程才能按开关决定是否注册动态解析器。
+        PlaygroundConfig.loadFromJson(jsonObject);
        // 限流
        if (jsonObject.containsKey("rateLimit")) {
            JsonObject rateLimit = jsonObject.getJsonObject("rateLimit");
@@ -78,12 +108,40 @@ public class AppMain {
                            System.out.println("数据库连接成功");
                            
                            // 加载演练场解析器
-                            loadPlaygroundParsers();
-                            
                            String addr = jsonObject.getJsonObject(ConfigConstant.SERVER).getString("domainName");
                            if (addr == null || addr.isBlank()) {
                                addr = "http://127.0.0.1:" + jsonObject.getJsonObject(ConfigConstant.SERVER).getInteger("port", 6400);
                            }
+                            // 读取代理配置获取前端页面端口（同步读取小文件，仅启动时执行一次）
+                            String proxyConfName = jsonObject.getString("proxyConf", "server-proxy");
+                            String pageAddr = addr;
+                            try {
+                                String configFile = proxyConfName + ".yml";
+                                // 与 Deploy 保持一致：优先当前目录，其次 resources/
+                                Path configPath = Path.of(configFile);
+                                if (!Files.exists(configPath)) {
+                                    configPath = Path.of("resources", configFile);
+                                }
+                                if (Files.exists(configPath)) {
+                                    String yamlContent = Files.readString(configPath);
+                                    // 匹配项目约定的 YAML 格式: "- listen: 8080"
+                                    java.util.regex.Matcher m = java.util.regex.Pattern
+                                            .compile("^\\s*-\\s+listen:\\s*(\\d+)", java.util.regex.Pattern.MULTILINE)
+                                            .matcher(yamlContent);
+                                    if (m.find()) {
+                                        int pagePort = Integer.parseInt(m.group(1));
+                                        pageAddr = "http://127.0.0.1:" + pagePort;
+                                    }
+                                }
+                            } catch (Exception e) {
+                                log.warn("读取代理配置失败，使用默认页面地址: {}", e.getMessage());
+                            }
+                            if (PlaygroundConfig.getInstance().isEnabled()) {
+                                loadPlaygroundParsers(pageAddr);
+                            } else {
+                                log.info("演练场功能已禁用，跳过加载演练场解析器");
+                                log.info("服务已启动，可通过 {} 访问页面", pageAddr);
+                            }
                            System.out.println("启动成功: \n本地服务地址: " + addr);
                        });
                    });
@@ -117,45 +175,39 @@ public class AppMain {
            JsonObject auths = jsonObject.getJsonObject(ConfigConstant.AUTHS);
            localMap.put(ConfigConstant.AUTHS, auths);
        }
-        
-        // 演练场配置
-        PlaygroundConfig.loadFromJson(jsonObject);
    }
    
    /**
     * 在启动时加载所有已发布的演练场解析器
     */
-    private static void loadPlaygroundParsers() {
+    private static void loadPlaygroundParsers(String accessAddr) {
        DbService dbService = AsyncServiceUtil.getAsyncServiceInstance(DbService.class);
        
-        dbService.getPlaygroundParserList().onSuccess(result -> {
+        dbService.getEnabledPlaygroundParsersForLoad().onSuccess(result -> {
            JsonArray parsers = result.getJsonArray("data");
            if (parsers != null) {
                int loadedCount = 0;
                for (int i = 0; i < parsers.size(); i++) {
                    JsonObject parser = parsers.getJsonObject(i);
                    
-                    // 只注册已启用的解析器
-                    if (parser.getBoolean("enabled", false)) {
-                        try {
-                            String jsCode = parser.getString("jsCode");
-                            if (jsCode == null || jsCode.trim().isEmpty()) {
-                                log.error("加载演练场解析器失败: {} - JavaScript代码为空", parser.getString("name"));
-                                continue;
-                            }
-                            CustomParserConfig config = JsScriptMetadataParser.parseScript(jsCode);
-                            CustomParserRegistry.register(config);
-                            loadedCount++;
-                            log.info("已加载演练场解析器: {} ({})", 
-                                    config.getDisplayName(), config.getType());
-                        } catch (Exception e) {
-                            String parserName = parser.getString("name");
-                            String errorMsg = e.getMessage();
-                            log.error("加载演练场解析器失败: {} - {}", parserName, errorMsg, e);
-                            // 如果是require相关错误，提供更详细的提示
-                            if (errorMsg != null && errorMsg.contains("require")) {
-                                log.error("提示：演练场解析器不支持CommonJS模块系统（require），请确保代码使用ES5.1语法");
-                            }
+                    try {
+                        String jsCode = parser.getString("jsCode");
+                        if (jsCode == null || jsCode.trim().isEmpty()) {
+                            log.error("加载演练场解析器失败: {} - JavaScript代码为空", parser.getString("name"));
+                            continue;
+                        }
+                        CustomParserConfig config = JsScriptMetadataParser.parseScript(jsCode);
+                        CustomParserRegistry.register(config);
+                        loadedCount++;
+                        log.info("已加载演练场解析器: {} ({})",
+                                config.getDisplayName(), config.getType());
+                    } catch (Exception e) {
+                        String parserName = parser.getString("name");
+                        String errorMsg = e.getMessage();
+                        log.error("加载演练场解析器失败: {} - {}", parserName, errorMsg, e);
+                        // 如果是require相关错误，提供更详细的提示
+                        if (errorMsg != null && errorMsg.contains("require")) {
+                            log.error("提示：演练场解析器不支持CommonJS模块系统（require），请确保代码使用ES5.1语法");
                        }
                    }
                }
@@ -165,6 +217,8 @@ public class AppMain {
            }
        }).onFailure(e -> {
            log.error("加载演练场解析器列表失败", e);
+        }).onComplete(ar -> {
+            log.info("服务已启动，可通过 {} 访问页面", accessAddr);
        });
    }
 }
@@ -5,8 +5,10 @@ import cn.qaiu.db.pool.JDBCType;
 import cn.qaiu.lz.web.model.CacheLinkInfo;
 import cn.qaiu.lz.web.model.PanFileInfo;
 import cn.qaiu.lz.web.model.PanFileInfoRowMapper;
+import cn.qaiu.vx.core.util.VertxHolder;
 import io.vertx.core.Future;
 import io.vertx.core.Promise;
+import io.vertx.core.Vertx;
 import io.vertx.core.json.JsonObject;
 import io.vertx.sqlclient.Pool;
 import io.vertx.sqlclient.Row;
@@ -18,14 +20,24 @@ import org.slf4j.LoggerFactory;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.Map;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.concurrent.atomic.AtomicInteger;

 public class CacheManager {
+    private static final int MAX_SHARE_KEY_LENGTH = 1024;
+
    private final Pool jdbcPool = JDBCPoolInit.instance().getPool();
    private final JDBCType jdbcType = JDBCPoolInit.instance().getType();

    private static final Logger LOGGER = LoggerFactory.getLogger(CacheManager.class);

    public Future<CacheLinkInfo> get(String cacheKey) {
+        if (isOversizedShareKey(cacheKey)) {
+            LOGGER.warn("缓存key过长，跳过缓存读取: length={}, prefix={}",
+                    cacheKey.length(), previewShareKey(cacheKey));
+            return Future.succeededFuture(new CacheLinkInfo(JsonObject.of("cacheHit", false, "shareKey", cacheKey)));
+        }
+
        String sql = "SELECT share_key as shareKey, direct_link as directLink, expiration FROM cache_link_info WHERE share_key = #{share_key}";
        String sql2 = "SELECT * FROM pan_file_info WHERE share_key = #{share_key}";
        Map<String, Object> params = new HashMap<>();
@@ -65,6 +77,17 @@ public class CacheManager {

    // 插入或更新缓存数据
    public void cacheShareLink(CacheLinkInfo cacheLinkInfo) {
+        if (cacheLinkInfo == null) {
+            LOGGER.warn("缓存信息为空，跳过缓存写入");
+            return;
+        }
+        if (isOversizedShareKey(cacheLinkInfo.getShareKey())) {
+            String shareKey = cacheLinkInfo.getShareKey();
+            LOGGER.warn("缓存key过长，跳过缓存写入: length={}, prefix={}",
+                    shareKey.length(), previewShareKey(shareKey));
+            return;
+        }
+
        String sql;
        if (jdbcType == JDBCType.MySQL) {
            sql = """
@@ -125,12 +148,19 @@ public class CacheManager {
                                        }
                                    }).onFailure(e -> LOGGER.error("文件信息插入失败", e));
                        }
-                    });
+                    })
+                    .onFailure(e -> LOGGER.error("查询文件信息缓存失败: shareKey={}", cacheLinkInfo.getShareKey(), e));
        }
    }

    // 写入网盘厂商API解析次数
    public Future<Integer> updateTotalByField(String shareKey, CacheTotalField field) {
+        if (isOversizedShareKey(shareKey)) {
+            LOGGER.warn("缓存key过长，跳过统计写入: length={}, prefix={}",
+                    shareKey.length(), previewShareKey(shareKey));
+            return Future.succeededFuture(0);
+        }
+
        Promise<Integer> promise = Promise.promise();
        String fieldLower = field.name().toLowerCase();
        String sql;
@@ -179,6 +209,12 @@ public class CacheManager {
    }

    public Future<Integer> getShareKeyTotal(String shareKey, String name) {
+        if (isOversizedShareKey(shareKey)) {
+            LOGGER.warn("缓存key过长，跳过统计读取: length={}, prefix={}",
+                    shareKey.length(), previewShareKey(shareKey));
+            return Future.succeededFuture(null);
+        }
+
        String sql = """
                SELECT `share_key`, SUM({total_name}) AS sum_num
                FROM `api_statistics_info`
@@ -205,21 +241,56 @@ public class CacheManager {

    /**
     * 清理过期缓存记录，防止数据库无限增长
-     * @return 删除的行数
+     * 包括：
+     * 1. 清理 cache_link_info 中过期的记录
+     * 2. 清理 pan_file_info 中孤立的记录（对应的 cache_link_info 已被删除）
+     * @return 删除的总行数
     */
    public Future<Integer> cleanupExpiredCache() {
-        String sql = "DELETE FROM cache_link_info WHERE expiration > 0 AND expiration < #{now}";
-        Map<String, Object> params = new HashMap<>();
-        params.put("now", System.currentTimeMillis());
        Promise<Integer> promise = Promise.promise();
-        SqlTemplate.forUpdate(jdbcPool, sql)
+        long now = System.currentTimeMillis();
+
+        // 第一步：清理 cache_link_info 中过期的记录
+        String sqlDeleteExpired = "DELETE FROM cache_link_info WHERE expiration > 0 AND expiration < #{now}";
+        Map<String, Object> params = new HashMap<>();
+        params.put("now", now);
+
+        SqlTemplate.forUpdate(jdbcPool, sqlDeleteExpired)
                .execute(params)
                .onSuccess(res -> {
-                    int deleted = res.rowCount();
-                    if (deleted > 0) {
-                        LOGGER.info("清理过期缓存记录 {} 条", deleted);
+                    int deletedCache = res.rowCount();
+                    if (deletedCache > 0) {
+                        LOGGER.info("清理过期缓存记录 {} 条", deletedCache);
                    }
-                    promise.complete(deleted);
+
+                    // 第二步：清理 pan_file_info 中孤立的记录
+                    // 使用 share_key 关联，create_time 使用字符串格式比较（yyyy-MM-dd HH:mm:ss）
+                    String sqlDeleteOrphans = """
+                            DELETE FROM pan_file_info
+                            WHERE share_key NOT IN (
+                                SELECT DISTINCT share_key FROM cache_link_info WHERE share_key IS NOT NULL
+                            )
+                            AND (create_time IS NULL OR create_time < #{thresholdTime})
+                            """;
+                    Map<String, Object> orphanParams = new HashMap<>();
+                    // 计算1天前的时间，转换为 yyyy-MM-dd HH:mm:ss 格式
+                    java.time.LocalDateTime thresholdTime = java.time.LocalDateTime.now().minusDays(1);
+                    orphanParams.put("thresholdTime", thresholdTime.format(java.time.format.DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss")));
+
+                    SqlTemplate.forUpdate(jdbcPool, sqlDeleteOrphans)
+                            .execute(orphanParams)
+                            .onSuccess(res2 -> {
+                                int deletedOrphans = res2.rowCount();
+                                if (deletedOrphans > 0) {
+                                    LOGGER.info("清理孤立文件信息记录 {} 条", deletedOrphans);
+                                }
+                                promise.complete(deletedCache + deletedOrphans);
+                            })
+                            .onFailure(e -> {
+                                LOGGER.warn("清理孤立文件信息记录失败（不影响主流程）", e);
+                                // 即使孤立记录清理失败，也返回已删除的缓存记录数
+                                promise.complete(deletedCache);
+                            });
                })
                .onFailure(e -> {
                    LOGGER.error("清理过期缓存失败", e);
@@ -232,31 +303,121 @@ public class CacheManager {
     * 注册定时清理过期缓存任务（每小时执行一次）
     * 应在应用启动后调用
     */
-    private static volatile boolean cleanupRegistered = false;
+    private static final long CLEANUP_INTERVAL_MILLIS = 3600_000L;
+    private static final long CLEANUP_SHUTDOWN_WAIT_MILLIS = 5_000L;
+    private static final AtomicBoolean CLEANUP_REGISTERED = new AtomicBoolean(false);
+    private static final AtomicInteger CLEANUP_IN_FLIGHT = new AtomicInteger(0);
+    private static final Object CLEANUP_MONITOR = new Object();
+    private static volatile Long cleanupTimerId;
+    private static volatile Vertx cleanupVertx;

    public static void registerPeriodicCleanup() {
-        if (cleanupRegistered) return;
+        if (!CLEANUP_REGISTERED.compareAndSet(false, true)) {
+            return;
+        }
        try {
-            io.vertx.core.Vertx vertx = cn.qaiu.vx.core.util.VertxHolder.getVertxInstance();
-            if (vertx == null) {
-                LOGGER.warn("Vertx 未就绪，缓存定时清理任务延迟注册");
-                return;
-            }
-            cleanupRegistered = true;
-            vertx.setPeriodic(3600_000, 3600_000, id -> {
-                try {
-                    new CacheManager().cleanupExpiredCache();
-                } catch (Exception e) {
-                    LOGGER.warn("定时清理缓存任务跳过（数据库可能未就绪）", e);
-                }
-            });
+            Vertx vertx = VertxHolder.getVertxInstance();
+            cleanupVertx = vertx;
+            cleanupTimerId = vertx.setPeriodic(CLEANUP_INTERVAL_MILLIS, CLEANUP_INTERVAL_MILLIS,
+                    id -> cleanupExpiredCacheSafely());
            LOGGER.info("缓存定时清理任务已注册（每小时执行）");
        } catch (Exception e) {
+            cleanupTimerId = null;
+            cleanupVertx = null;
+            CLEANUP_REGISTERED.set(false);
            LOGGER.warn("注册缓存定时清理任务失败", e);
        }
    }

+    public static void cancelPeriodicCleanup() {
+        Long timerId = cleanupTimerId;
+        Vertx vertx = cleanupVertx;
+        cleanupTimerId = null;
+        cleanupVertx = null;
+        CLEANUP_REGISTERED.set(false);
+
+        if (timerId == null || vertx == null) {
+            waitForCleanupToFinish();
+            return;
+        }
+        try {
+            if (vertx.cancelTimer(timerId)) {
+                LOGGER.info("缓存定时清理任务已取消");
+            }
+        } catch (Exception e) {
+            LOGGER.warn("取消缓存定时清理任务失败", e);
+        }
+        waitForCleanupToFinish();
+    }
+
+    private static void cleanupExpiredCacheSafely() {
+        cleanupStarted();
+        boolean asyncCleanupStarted = false;
+        try {
+            if (!CLEANUP_REGISTERED.get()) {
+                return;
+            }
+            JDBCPoolInit poolInit = JDBCPoolInit.instance();
+            if (poolInit == null || poolInit.getPool() == null) {
+                LOGGER.debug("数据库连接池未就绪，跳过缓存定时清理");
+                return;
+            }
+            Future<Integer> cleanupFuture = new CacheManager().cleanupExpiredCache();
+            asyncCleanupStarted = true;
+            cleanupFuture.onComplete(ar -> {
+                if (ar.failed()) {
+                    LOGGER.warn("定时清理缓存失败", ar.cause());
+                }
+                cleanupFinished();
+            });
+        } catch (Exception e) {
+            LOGGER.warn("定时清理缓存任务跳过（数据库可能正在关闭）", e);
+        } finally {
+            if (!asyncCleanupStarted) {
+                cleanupFinished();
+            }
+        }
+    }
+
+    private static void cleanupStarted() {
+        CLEANUP_IN_FLIGHT.incrementAndGet();
+    }
+
+    private static void cleanupFinished() {
+        if (CLEANUP_IN_FLIGHT.decrementAndGet() <= 0) {
+            synchronized (CLEANUP_MONITOR) {
+                CLEANUP_MONITOR.notifyAll();
+            }
+        }
+    }
+
+    private static void waitForCleanupToFinish() {
+        long deadline = System.currentTimeMillis() + CLEANUP_SHUTDOWN_WAIT_MILLIS;
+        synchronized (CLEANUP_MONITOR) {
+            while (CLEANUP_IN_FLIGHT.get() > 0) {
+                long waitMillis = deadline - System.currentTimeMillis();
+                if (waitMillis <= 0) {
+                    LOGGER.warn("等待缓存定时清理结束超时，剩余任务数: {}", CLEANUP_IN_FLIGHT.get());
+                    return;
+                }
+                try {
+                    CLEANUP_MONITOR.wait(waitMillis);
+                } catch (InterruptedException e) {
+                    Thread.currentThread().interrupt();
+                    LOGGER.warn("等待缓存定时清理结束被中断");
+                    return;
+                }
+            }
+        }
+    }
+
    public Future<Map<String, Integer>> getShareKeyTotal(String shareKey) {
+        if (isOversizedShareKey(shareKey)) {
+            LOGGER.warn("缓存key过长，跳过统计读取: length={}, prefix={}",
+                    shareKey.length(), previewShareKey(shareKey));
+            return Future.succeededFuture(null);
+        }
+
        String sql = """
                SELECT `share_key`, SUM(cache_hit_total) AS hit_total, SUM(api_parser_total) AS parser_total
                FROM `api_statistics_info`
@@ -287,4 +448,16 @@ public class CacheManager {
        return promise.future();
    }

+    private static boolean isOversizedShareKey(String shareKey) {
+        return shareKey != null && shareKey.length() > MAX_SHARE_KEY_LENGTH;
+    }
+
+    private static String previewShareKey(String shareKey) {
+        if (shareKey == null) {
+            return "";
+        }
+        int maxLength = 120;
+        return shareKey.length() <= maxLength ? shareKey : shareKey.substring(0, maxLength) + "...";
+    }
+
 }
@@ -9,6 +9,10 @@ import io.vertx.core.json.JsonObject;
 import io.vertx.ext.web.RoutingContext;
 import lombok.extern.slf4j.Slf4j;

+import java.util.List;
+import java.util.regex.Pattern;
+import java.util.stream.Collectors;
+
 import static cn.qaiu.vx.core.util.ConfigConstant.IGNORES_REG;
 import static io.vertx.core.http.HttpHeaders.CONTENT_TYPE;

@@ -19,7 +23,15 @@ import static io.vertx.core.http.HttpHeaders.CONTENT_TYPE;
@HandleSortFilter(1)
 public class DefaultInterceptor implements BeforeInterceptor {

-    protected final JsonArray ignores = SharedDataUtil.getJsonArrayForCustomConfig(IGNORES_REG);
+    /** 预编译的忽略路径正则列表，避免每次请求重新编译 */
+    protected final List<Pattern> ignorePatterns;
+
+    public DefaultInterceptor() {
+        JsonArray ignores = SharedDataUtil.getJsonArrayForCustomConfig(IGNORES_REG);
+        this.ignorePatterns = ignores.stream()
+                .map(obj -> Pattern.compile(obj.toString()))
+                .collect(Collectors.toList());
+    }

    @Override
    public void handle(RoutingContext ctx) {
@@ -38,28 +50,30 @@ public class DefaultInterceptor implements BeforeInterceptor {
        //  limit: 1000
        //  # 限流的时间窗口(单位秒)
        //  timeWindow: 60
-        if (rateLimit.getBoolean("enable")) {
-            // 获取当前请求的路径
-            String path = ctx.request().path();
-            // 正则匹配路径
-            if (ignores.stream().anyMatch(ignore -> path.matches(ignore.toString()))) {
-                // 如果匹配到忽略的路径，则不进行限流
-                doNext(ctx);
-                return;
-            }
-            RateLimiter.checkRateLimit(ctx.request())
-                    .onSuccess(v -> {
-                        // 继续执行下一个拦截器
-                        doNext(ctx);
-                    })
-                    .onFailure(t -> {
-                        // 限流失败，返回错误响应
-                        log.warn("Rate limit exceeded for path: {}", path);
-                        ctx.response().putHeader(CONTENT_TYPE, "text/html; charset=utf-8")
-                                .setStatusCode(429)
-                                .end(t.getMessage());
-                    });
+        if (!rateLimit.getBoolean("enable", false)) {
+            doNext(ctx);
+            return;
        }
+        // 获取当前请求的路径
+        String path = ctx.request().path();
+        // 正则匹配路径
+        if (ignorePatterns.stream().anyMatch(pattern -> pattern.matcher(path).matches())) {
+            // 如果匹配到忽略的路径，则不进行限流
+            doNext(ctx);
+            return;
+        }
+        RateLimiter.checkRateLimit(ctx.request())
+                .onSuccess(v -> {
+                    // 继续执行下一个拦截器
+                    doNext(ctx);
+                })
+                .onFailure(t -> {
+                    // 限流失败，返回错误响应
+                    log.warn("Rate limit exceeded for path: {}", path);
+                    ctx.response().putHeader(CONTENT_TYPE, "text/html; charset=utf-8")
+                            .setStatusCode(429)
+                            .end(t.getMessage());
+                });
    }

 }
@@ -17,12 +17,19 @@ public class RateLimiter {

    private static final Map<String, RequestInfo> ipRequestMap = new ConcurrentHashMap<>();
    private static int MAX_REQUESTS = 10; // 最大请求次数
+    private static int MAX_ENTRIES = 10_000;
    private static long TIME_WINDOW = 60 * 1000; // 时间窗口（毫秒）

-    private static String PATH_REG; // 限流路径正则
+    private static String PATH_REG = "/.*"; // 限流路径正则（默认匹配所有路径）
+
+    // 上次清理时间
+    private static volatile long lastCleanupTime = System.currentTimeMillis();
+    // 清理间隔（30秒）
+    private static final long CLEANUP_INTERVAL = 30 * 1000;

    public static void init(JsonObject rateLimitConfig) {
        MAX_REQUESTS = rateLimitConfig.getInteger("limit", 10);
+        MAX_ENTRIES = rateLimitConfig.getInteger("maxEntries", 10_000);
        TIME_WINDOW = rateLimitConfig.getInteger("timeWindow", 60) * 1000L; // 转换为毫秒
        PATH_REG = rateLimitConfig.getString("pathReg", "/.*");
        log.info("RateLimiter initialized with max requests: {}, time window: {} ms, path regex: {}",
@@ -39,28 +46,37 @@ public class RateLimiter {

        String ip = request.remoteAddress().host();

-        // 定期清理过期条目，防止 Map 无限增长
-        if (ipRequestMap.size() > 1000) {
-            long now = System.currentTimeMillis();
-            ipRequestMap.entrySet().removeIf(entry -> now - entry.getValue().timestamp > TIME_WINDOW);
+        // 基于时间间隔的清理策略，避免 Map 无限增长
+        long now = System.currentTimeMillis();
+        if (now - lastCleanupTime > CLEANUP_INTERVAL) {
+            cleanupExpiredEntries(now, false);
        }
-
-        RequestInfo info = ipRequestMap.compute(ip, (key, requestInfo) -> {
-            long currentTime = System.currentTimeMillis();
-            if (requestInfo == null || currentTime - requestInfo.timestamp > TIME_WINDOW) {
-                // 初始化或重置计数器
-                return new RequestInfo(1, currentTime);
-            } else {
-                // 增加计数器
-                requestInfo.count.incrementAndGet();
-                return requestInfo;
+        RequestInfo info;
+        synchronized (RateLimiter.class) {
+            if (!ipRequestMap.containsKey(ip) && ipRequestMap.size() >= MAX_ENTRIES) {
+                cleanupExpiredEntries(now, true);
+                if (ipRequestMap.size() >= MAX_ENTRIES) {
+                    promise.fail("限流记录过多，请稍后再试。");
+                    return promise.future();
+                }
            }
-        });
+
+            info = ipRequestMap.compute(ip, (key, requestInfo) -> {
+                if (requestInfo == null || now - requestInfo.timestamp > TIME_WINDOW) {
+                    // 初始化或重置计数器
+                    return new RequestInfo(1, now);
+                } else {
+                    // 增加计数器
+                    requestInfo.count.incrementAndGet();
+                    return requestInfo;
+                }
+            });
+        }

        if (info.count.get() > MAX_REQUESTS) {
            // 超过限制
            // 计算剩余时间
-            long remainingTime = TIME_WINDOW - (System.currentTimeMillis() - info.timestamp);
+            long remainingTime = TIME_WINDOW - (now - info.timestamp);
            BigDecimal bigDecimal = BigDecimal.valueOf(remainingTime / 1000.0)
                    .setScale(2, RoundingMode.HALF_UP);
            promise.fail("请求次数太多了，请" + bigDecimal + "秒后再试。");
@@ -71,6 +87,27 @@ public class RateLimiter {
        return promise.future();
    }

+    /**
+     * 清理过期的限流条目
+     * 使用 synchronized 避免并发清理
+     */
+    private static synchronized void cleanupExpiredEntries(long now, boolean force) {
+        // 双重检查，避免重复清理
+        if (!force && now - lastCleanupTime <= CLEANUP_INTERVAL) {
+            return;
+        }
+        lastCleanupTime = now;
+
+        int sizeBefore = ipRequestMap.size();
+        if (sizeBefore > 0) {
+            ipRequestMap.entrySet().removeIf(entry -> now - entry.getValue().timestamp > TIME_WINDOW);
+            int sizeAfter = ipRequestMap.size();
+            if (sizeBefore > 100 || sizeAfter != sizeBefore) {
+                log.debug("RateLimiter 清理过期条目: {} -> {}", sizeBefore, sizeAfter);
+            }
+        }
+    }
+
    private static class RequestInfo {
        final AtomicInteger count;
        volatile long timestamp;
@@ -0,0 +1,207 @@
+package cn.qaiu.lz.common.util;
+
+import cn.qaiu.entity.ShareLinkInfo;
+import cn.qaiu.lz.web.model.AuthParam;
+import cn.qaiu.lz.web.service.DbService;
+import cn.qaiu.parser.ParserCreate;
+import cn.qaiu.vx.core.util.ConfigConstant;
+import cn.qaiu.vx.core.util.VertxHolder;
+import io.vertx.core.Future;
+import io.vertx.core.MultiMap;
+import io.vertx.core.http.HttpServerRequest;
+import io.vertx.core.json.JsonObject;
+import io.vertx.core.shareddata.LocalMap;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.lang3.StringUtils;
+
+import java.util.Map;
+
+@Slf4j
+public class ParserAuthUtil {
+
+    public static final String SKIP_CLIENT_LINKS = "_skipClientLinks";
+    public static final String TEMP_AUTH_ADDED = "__TEMP_AUTH_ADDED";
+    public static final String DONATED_ACCOUNT_TOKEN = "__AUTO_DONATED_ACCOUNT_TOKEN";
+    /** 原始加密 auth 查询串，供目录子链透传（避免进入子目录丢失认证） */
+    public static final String AUTH_QUERY = "_authQuery";
+
+    private ParserAuthUtil() {
+    }
+
+    public static JsonObject buildOtherParam(HttpServerRequest request, String auth, String requestOrigin) {
+        return buildOtherParam(request, auth, requestOrigin, false);
+    }
+
+    public static JsonObject buildOtherParam(HttpServerRequest request, String auth, String requestOrigin,
+                                             boolean skipClientLinks) {
+        JsonObject otherParam = JsonObject.of(
+                "UA", request.headers().get("user-agent"),
+                "_requestOrigin", requestOrigin
+        );
+        if (skipClientLinks) {
+            otherParam.put(SKIP_CLIENT_LINKS, true);
+        }
+
+        if (StringUtils.isNotBlank(auth)) {
+            // 保留原始 auth，供 getFileList 子目录 parserUrl 透传
+            otherParam.put(AUTH_QUERY, auth);
+            AuthParam authParam = AuthParamCodec.decode(auth);
+            if (authParam != null && authParam.hasValidAuth()) {
+                otherParam.put("authType", authParam.getAuthType());
+                otherParam.put("authToken", authParam.getPrimaryCredential());
+                otherParam.put("authPassword", authParam.getPassword());
+                otherParam.put("authInfo1", authParam.getExt1());
+                otherParam.put("authInfo2", authParam.getExt2());
+                otherParam.put("authInfo3", authParam.getExt3());
+                otherParam.put("authInfo4", authParam.getExt4());
+                otherParam.put("authInfo5", authParam.getExt5());
+                if (StringUtils.isNotBlank(authParam.getDonatedAccountToken())) {
+                    otherParam.put("donatedAccountToken", authParam.getDonatedAccountToken());
+                }
+                log.debug("已解码认证参数: authType={}", authParam.getAuthType());
+            }
+        }
+
+        return otherParam;
+    }
+
+    public static Future<Void> applyAuthParamsAndDonatedFallback(ParserCreate parserCreate, JsonObject otherParam,
+                                                                 DbService dbService) {
+        JsonObject params = otherParam == null ? new JsonObject() : otherParam;
+        parserCreate.getShareLinkInfo().getOtherParam().putAll(params.getMap());
+
+        if (params.containsKey("authType") || params.containsKey("authToken")) {
+            log.debug("从otherParam中检测到临时认证参数");
+            URLParamUtil.addTempAuthParam(parserCreate,
+                    params.getString("authType"),
+                    params.getString("authToken"),
+                    params.getString("authPassword"),
+                    params.getString("authInfo1"),
+                    params.getString("authInfo2"),
+                    params.getString("authInfo3"),
+                    params.getString("authInfo4"),
+                    params.getString("authInfo5"));
+        }
+
+        return applyDonatedAccountFallback(parserCreate, dbService);
+    }
+
+    public static void recordDonatedAccountFailureIfNeeded(DbService dbService, JsonObject otherParam,
+                                                           Throwable cause) {
+        if (!isLikelyAuthFailure(cause) || otherParam == null) {
+            return;
+        }
+        String donatedAccountToken = otherParam.getString("donatedAccountToken");
+        if (StringUtils.isBlank(donatedAccountToken)) {
+            return;
+        }
+        dbService.recordDonatedAccountFailureByToken(donatedAccountToken)
+                .onFailure(e -> log.warn("记录捐赠账号失败次数失败", e));
+    }
+
+    public static void recordAutoDonatedFailureIfNeeded(DbService dbService, ShareLinkInfo shareLinkInfo,
+                                                        Throwable cause) {
+        if (shareLinkInfo == null || !isLikelyAuthFailure(cause)) {
+            return;
+        }
+        Object tokenObj = shareLinkInfo.getOtherParam().get(DONATED_ACCOUNT_TOKEN);
+        if (!(tokenObj instanceof String) || StringUtils.isBlank((String) tokenObj)) {
+            return;
+        }
+        dbService.recordDonatedAccountFailureByToken((String) tokenObj)
+                .onFailure(e -> log.warn("记录自动捐赠账号失败次数失败", e));
+    }
+
+    private static Future<Void> applyDonatedAccountFallback(ParserCreate parserCreate, DbService dbService) {
+        ShareLinkInfo shareLinkInfo = parserCreate.getShareLinkInfo();
+        Map<String, Object> otherParam = shareLinkInfo.getOtherParam();
+        if (Boolean.TRUE.equals(otherParam.get(TEMP_AUTH_ADDED))) {
+            return Future.succeededFuture();
+        }
+        String type = shareLinkInfo.getType();
+        if (StringUtils.isBlank(type) || hasUsableStaticAuthConfig(type)) {
+            return Future.succeededFuture();
+        }
+        return dbService.getRandomDonatedAccount(type.toUpperCase())
+                .compose(res -> {
+                    if (!Integer.valueOf(200).equals(res.getInteger("code"))) {
+                        return Future.succeededFuture();
+                    }
+                    JsonObject data = res.getJsonObject("data");
+                    if (data == null || data.isEmpty()) {
+                        return Future.succeededFuture();
+                    }
+                    String username = data.getString("username");
+                    String password = data.getString("password");
+                    String token = data.getString("token");
+                    if (StringUtils.isBlank(username) && StringUtils.isBlank(password) && StringUtils.isBlank(token)) {
+                        return Future.succeededFuture();
+                    }
+                    MultiMap tempAuth = MultiMap.caseInsensitiveMultiMap();
+                    if (StringUtils.isNotBlank(username)) {
+                        tempAuth.set("username", username);
+                    }
+                    if (StringUtils.isNotBlank(password)) {
+                        tempAuth.set("password", password);
+                    }
+                    if (StringUtils.isNotBlank(token)) {
+                        tempAuth.set("token", token);
+                    }
+                    otherParam.put(ConfigConstant.AUTHS, tempAuth);
+                    otherParam.put(TEMP_AUTH_ADDED, true);
+                    String donatedAccountToken = data.getString("donatedAccountToken");
+                    if (StringUtils.isNotBlank(donatedAccountToken)) {
+                        otherParam.put(DONATED_ACCOUNT_TOKEN, donatedAccountToken);
+                    }
+                    log.debug("已自动应用捐赠账号: type={}", type);
+                    return Future.<Void>succeededFuture();
+                })
+                .recover(err -> {
+                    log.warn("自动获取捐赠账号失败: type={}", type, err);
+                    return Future.succeededFuture();
+                });
+    }
+
+    private static boolean hasUsableStaticAuthConfig(String type) {
+        LocalMap<Object, Object> localMap = VertxHolder.getVertxInstance().sharedData()
+                .getLocalMap(ConfigConstant.LOCAL);
+        if (!localMap.containsKey(ConfigConstant.AUTHS)) {
+            return false;
+        }
+        JsonObject auths = (JsonObject) localMap.get(ConfigConstant.AUTHS);
+        JsonObject cfg = auths.getJsonObject(type);
+        if (cfg == null) {
+            return false;
+        }
+        for (String key : cfg.fieldNames()) {
+            Object value = cfg.getValue(key);
+            if (value != null && StringUtils.isNotBlank(value.toString())) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private static boolean isLikelyAuthFailure(Throwable cause) {
+        if (cause == null) {
+            return false;
+        }
+        String msg = cause.getMessage();
+        if (StringUtils.isBlank(msg)) {
+            return false;
+        }
+        String lower = msg.toLowerCase();
+        return lower.contains("auth")
+                || lower.contains("token")
+                || lower.contains("cookie")
+                || lower.contains("password")
+                || lower.contains("credential")
+                || lower.contains("401")
+                || lower.contains("403")
+                || lower.contains("unauthorized")
+                || lower.contains("forbidden")
+                || lower.contains("expired")
+                || lower.contains("登录")
+                || lower.contains("认证");
+    }
+}
@@ -68,9 +68,10 @@ public class URLParamUtil {
        boolean firstParam = !decodedUrl.contains("?");

        for (String paramName : params.names()) {
-            // 忽略 "url", "pwd", "dirId", "uuid", "auth" 参数（这些参数单独处理，不应拼接到分享URL中）
-            if (!paramName.equals("url") && !paramName.equals("pwd") && !paramName.equals("dirId") 
-                    && !paramName.equals("uuid") && !paramName.equals("auth")) {
+            // 忽略单独处理的参数，不应拼接到分享URL中
+            if (!paramName.equals("url") && !paramName.equals("pwd") && !paramName.equals("dirId")
+                    && !paramName.equals("uuid") && !paramName.equals("auth")
+                    && !paramName.equals("stoken") && !paramName.equals("zml")) {
                if (firstParam) {
                    urlBuilder.append("?");
                    firstParam = false;
@@ -100,21 +101,27 @@ public class URLParamUtil {
            }
        }
        if (localMap.containsKey(ConfigConstant.AUTHS)) {
-            JsonObject auths = (JsonObject) localMap.get(ConfigConstant.AUTHS);
-            if (auths.containsKey(type)) {
-                // 需要处理引号
-                MultiMap entries = MultiMap.caseInsensitiveMultiMap();
-                JsonObject jsonObject = auths.getJsonObject(type);
-                if (jsonObject != null) {
-                    jsonObject.forEach(entity -> {
-                        if (entity == null || entity.getValue() == null) {
-                            return;
-                        }
-                        entries.set(entity.getKey(), entity.getValue().toString());
-                    });
-                }
+            // 如果本次请求已经通过 auth 临时参数（个人配置/捐赠账号）设置过认证信息，
+            // 则不要再用后台 app-dev.yml 的静态配置覆盖，否则临时认证会被静默清空/替换为空配置。
+            boolean tempAuthAdded = Boolean.TRUE.equals(
+                    parserCreate.getShareLinkInfo().getOtherParam().get("__TEMP_AUTH_ADDED"));
+            if (!tempAuthAdded) {
+                JsonObject auths = (JsonObject) localMap.get(ConfigConstant.AUTHS);
+                if (auths.containsKey(type)) {
+                    // 需要处理引号
+                    MultiMap entries = MultiMap.caseInsensitiveMultiMap();
+                    JsonObject jsonObject = auths.getJsonObject(type);
+                    if (jsonObject != null) {
+                        jsonObject.forEach(entity -> {
+                            if (entity == null || entity.getValue() == null) {
+                                return;
+                            }
+                            entries.set(entity.getKey(), entity.getValue().toString());
+                        });
+                    }

-                parserCreate.getShareLinkInfo().getOtherParam().put(ConfigConstant.AUTHS, entries);
+                    parserCreate.getShareLinkInfo().getOtherParam().put(ConfigConstant.AUTHS, entries);
+                }
            }
        }

@@ -19,6 +19,7 @@ public class PlaygroundConfig {

    /** Token有效期：24小时 */
    private static final long TOKEN_EXPIRY_MS = 24 * 60 * 60 * 1000L;
+    private static final int MAX_TOKEN_COUNT = 1024;

    private static final SecureRandom SECURE_RANDOM = new SecureRandom();

@@ -59,10 +60,10 @@ public class PlaygroundConfig {
    /**
     * 生成并存储一个新的认证Token，同时清理过期Token
     */
-    public String generateToken() {
-        // 清理过期Token，防止Map无限增长
+    public synchronized String generateToken() {
        long now = System.currentTimeMillis();
-        validTokens.entrySet().removeIf(e -> now - e.getValue() > TOKEN_EXPIRY_MS);
+        cleanupExpiredTokens(now);
+        evictOldestTokensIfNeeded();
        // 使用SecureRandom生成32字节的密码学安全Token
        byte[] bytes = new byte[32];
        SECURE_RANDOM.nextBytes(bytes);
@@ -78,16 +79,39 @@ public class PlaygroundConfig {
    /**
     * 校验Token是否合法且未过期
     */
-    public boolean validateToken(String token) {
+    public synchronized boolean validateToken(String token) {
        if (token == null || token.isEmpty()) return false;
+        long now = System.currentTimeMillis();
+        cleanupExpiredTokens(now);
        Long createdAt = validTokens.get(token);
        if (createdAt == null) return false;
-        if (System.currentTimeMillis() - createdAt > TOKEN_EXPIRY_MS) {
+        if (now - createdAt > TOKEN_EXPIRY_MS) {
            validTokens.remove(token);
            return false;
        }
        return true;
    }
+
+    private void cleanupExpiredTokens(long now) {
+        validTokens.entrySet().removeIf(e -> now - e.getValue() > TOKEN_EXPIRY_MS);
+    }
+
+    private void evictOldestTokensIfNeeded() {
+        while (validTokens.size() >= MAX_TOKEN_COUNT) {
+            String oldestToken = null;
+            long oldestTime = Long.MAX_VALUE;
+            for (Map.Entry<String, Long> entry : validTokens.entrySet()) {
+                if (entry.getValue() < oldestTime) {
+                    oldestTime = entry.getValue();
+                    oldestToken = entry.getKey();
+                }
+            }
+            if (oldestToken == null) {
+                return;
+            }
+            validTokens.remove(oldestToken);
+        }
+    }
    
    /**
     * 获取单例实例
@@ -125,5 +149,13 @@ public class PlaygroundConfig {
        } else {
            log.info("未找到playground配置，使用默认值: enabled=false, public=false");
        }
+        String enabledOverride = System.getProperty("NFD_PLAYGROUND_ENABLED");
+        if (enabledOverride == null || enabledOverride.isBlank()) {
+            enabledOverride = System.getenv("NFD_PLAYGROUND_ENABLED");
+        }
+        if (enabledOverride != null && !enabledOverride.isBlank()) {
+            cfg.enabled = Boolean.parseBoolean(enabledOverride);
+            log.info("Playground enabled 已被 NFD_PLAYGROUND_ENABLED 覆盖为 {}", cfg.enabled);
+        }
    }
 }
@@ -5,6 +5,7 @@ import cn.qaiu.entity.FileInfo;
 import cn.qaiu.entity.ShareLinkInfo;
 import cn.qaiu.lz.common.cache.CacheManager;
 import cn.qaiu.lz.common.util.AuthParamCodec;
+import cn.qaiu.lz.common.util.ParserAuthUtil;
 import cn.qaiu.lz.common.util.URLParamUtil;
 import cn.qaiu.lz.web.model.AuthParam;
 import cn.qaiu.lz.web.model.CacheLinkInfo;
@@ -13,8 +14,11 @@ import cn.qaiu.lz.web.model.LinkInfoResp;
 import cn.qaiu.lz.web.model.StatisticsInfo;
 import cn.qaiu.lz.web.service.DbService;
 import cn.qaiu.parser.PanDomainTemplate;
+import cn.qaiu.parser.IPanTool;
 import cn.qaiu.parser.ParserCreate;
+import cn.qaiu.parser.clientlink.ClientLinkGeneratorFactory;
 import cn.qaiu.parser.clientlink.ClientLinkType;
+import cn.qaiu.util.CommonUtils;
 import cn.qaiu.vx.core.annotaions.RouteHandler;
 import cn.qaiu.vx.core.annotaions.RouteMapping;
 import cn.qaiu.vx.core.enums.RouteMethod;
@@ -76,11 +80,30 @@ public class ParserApi {
    private static final CacheManager cacheManager = new CacheManager();
    private static final ServerApi serverApi = new ServerApi();

+    @RouteMapping(value = "/check/:type/:key", method = RouteMethod.GET)
+    public void check(HttpServerResponse response, String type, String key) {
+        response.putHeader("Content-Type", "text/plain; charset=utf-8")
+                .setStatusCode(200)
+                .end("ok");
+    }
+
+    @RouteMapping(value = "/check/:type/:key", method = RouteMethod.HEAD)
+    public void checkHead(HttpServerResponse response, String type, String key) {
+        response.putHeader("Content-Type", "text/plain; charset=utf-8")
+                .setStatusCode(200)
+                .end();
+    }
+
    @RouteMapping(value = "/linkInfo", method = RouteMethod.GET)
    public Future<LinkInfoResp> parse(HttpServerRequest request, String pwd, String auth) {
        Promise<LinkInfoResp> promise = Promise.promise();
        String url = URLParamUtil.parserParams(request);
-        ParserCreate parserCreate = ParserCreate.fromShareUrl(url).setShareLinkInfoPwd(pwd);
+        ParserCreate parserCreate;
+        try {
+            parserCreate = ParserCreate.fromShareUrl(url).setShareLinkInfoPwd(pwd);
+        } catch (Exception e) {
+            return Future.failedFuture(e);
+        }
        ShareLinkInfo shareLinkInfo = parserCreate.getShareLinkInfo();
        
        // 构建链接信息响应，如果有 auth 参数则附加到链接中
@@ -139,24 +162,47 @@ public class ParserApi {
    }

    @RouteMapping("/getFileList")
-    public Future<List<FileInfo>> getFileList(HttpServerRequest request, String pwd, String dirId, String uuid) {
+    public Future<List<FileInfo>> getFileList(HttpServerRequest request, String pwd, String dirId, String uuid,
+                                             String stoken, String zml, String auth) {
        String url = URLParamUtil.parserParams(request);
-        ParserCreate parserCreate = ParserCreate.fromShareUrl(url).setShareLinkInfoPwd(pwd);
+        ParserCreate parserCreate;
+        try {
+            parserCreate = ParserCreate.fromShareUrl(url).setShareLinkInfoPwd(pwd);
+        } catch (Exception e) {
+            return Future.failedFuture(e);
+        }
        String linkPrefix = getLinkPrefix(request);
+        JsonObject otherParam = ParserAuthUtil.buildOtherParam(request, auth, linkPrefix);
        parserCreate.getShareLinkInfo().getOtherParam().put("domainName", linkPrefix);
        parserCreate.getShareLinkInfo().getOtherParam().put("_requestOrigin", linkPrefix);
        if (StringUtils.isNotBlank(dirId)) {
            parserCreate.getShareLinkInfo().getOtherParam().put("dirId", dirId);
        }
+        if (StringUtils.isNotBlank(stoken)) {
+            parserCreate.getShareLinkInfo().getOtherParam().put("stoken", stoken);
+        }
        if (StringUtils.isNotBlank(uuid)) {
            parserCreate.getShareLinkInfo().getOtherParam().put("uuid", uuid);
        }
-        return parserCreate.createTool().parseFileList();
+        if (StringUtils.isNotBlank(zml)) {
+            parserCreate.getShareLinkInfo().getOtherParam().put("zml", zml);
+        }
+        return ParserAuthUtil.applyAuthParamsAndDonatedFallback(parserCreate, otherParam, dbService)
+                .compose(v -> {
+                    URLParamUtil.addParam(parserCreate);
+                    IPanTool tool = parserCreate.createTool();
+                    return IPanTool.closeAfter(tool, tool::parseFileList)
+                            .onFailure(t -> {
+                                ParserAuthUtil.recordDonatedAccountFailureIfNeeded(dbService, otherParam, t);
+                                ParserAuthUtil.recordAutoDonatedFailureIfNeeded(dbService,
+                                        parserCreate.getShareLinkInfo(), t);
+                            });
+                });
    }

    // 目录解析下载文件
    // @RouteMapping("/getFileDownUrl/:type/:param")
-    public Future<String> getFileDownUrl(HttpServerRequest request, String type, String param) {
+    public Future<String> getFileDownUrl(HttpServerRequest request, String type, String param, String auth) {
        ParserCreate parserCreate = ParserCreate.fromType(type).shareKey("-") // shareKey not null
                .setShareLinkInfoPwd("-");

@@ -166,30 +212,173 @@ public class ParserApi {
            return promise.future();
        }

-        String paramStr = new String(Base64.getDecoder().decode(param));
+        final String paramStr;
+        try {
+            paramStr = CommonUtils.urlBase64Decode(param);
+        } catch (Exception e) {
+            Promise<String> promise = Promise.promise();
+            promise.fail("下载参数解码失败: " + e.getMessage());
+            return promise.future();
+        }
        ShareLinkInfo shareLinkInfo = parserCreate.getShareLinkInfo();
        shareLinkInfo.getOtherParam().put("paramJson", new JsonObject(paramStr));

        // domainName
        String linkPrefix = getLinkPrefix(request);
+        JsonObject otherParam = ParserAuthUtil.buildOtherParam(request, auth, linkPrefix, true);
        shareLinkInfo.getOtherParam().put("domainName", linkPrefix);
        shareLinkInfo.getOtherParam().put("_requestOrigin", linkPrefix);
-        return parserCreate.createTool().parseById();
+        return ParserAuthUtil.applyAuthParamsAndDonatedFallback(parserCreate, otherParam, dbService)
+                .compose(v -> {
+                    URLParamUtil.addParam(parserCreate);
+                    IPanTool tool = parserCreate.createTool();
+                    return IPanTool.closeAfter(tool, tool::parseById)
+                            .onFailure(t -> {
+                                ParserAuthUtil.recordDonatedAccountFailureIfNeeded(dbService, otherParam, t);
+                                ParserAuthUtil.recordAutoDonatedFailureIfNeeded(dbService,
+                                        parserCreate.getShareLinkInfo(), t);
+                            });
+                });
    }

    @RouteMapping("/redirectUrl/:type/:param")
-    public Future<Void> redirectUrl(HttpServerRequest request, HttpServerResponse response, String type, String param) {
+    public Future<Void> redirectUrl(HttpServerRequest request, HttpServerResponse response, String type, String param,
+                                    String auth) {
        Promise<Void> promise = Promise.promise();

-        getFileDownUrl(request, type, param)
+        getFileDownUrl(request, type, param, auth)
                .onSuccess(res -> {
-                    ResponseUtil.redirect(response, res);
-                    promise.complete();
+                    ResponseUtil.redirect(response, res, promise);
                })
-                .onFailure(t -> promise.fail(t.fillInStackTrace()));
+                .onFailure(promise::tryFail);
        return promise.future();
    }

+    /**
+     * 目录文件下载信息（供前端下载器使用）：返回直链、请求头及命令行
+     */
+    @RouteMapping("/getFileDownInfo/:type/:param")
+    public Future<JsonObject> getFileDownInfo(HttpServerRequest request, String type, String param, String auth) {
+        ParserCreate parserCreate;
+        try {
+            parserCreate = ParserCreate.fromType(type).shareKey("-").setShareLinkInfoPwd("-");
+        } catch (Exception e) {
+            return Future.failedFuture(e);
+        }
+
+        if (param == null || param.isEmpty()) {
+            return Future.failedFuture("下载参数为空");
+        }
+
+        final JsonObject paramJson;
+        try {
+            paramJson = new JsonObject(CommonUtils.urlBase64Decode(param));
+        } catch (Exception e) {
+            return Future.failedFuture("下载参数解码失败: " + e.getMessage());
+        }
+
+        ShareLinkInfo shareLinkInfo = parserCreate.getShareLinkInfo();
+        shareLinkInfo.getOtherParam().put("paramJson", paramJson);
+
+        String linkPrefix = getLinkPrefix(request);
+        JsonObject otherParam = ParserAuthUtil.buildOtherParam(request, auth, linkPrefix);
+        shareLinkInfo.getOtherParam().put("domainName", linkPrefix);
+        shareLinkInfo.getOtherParam().put("_requestOrigin", linkPrefix);
+
+        return ParserAuthUtil.applyAuthParamsAndDonatedFallback(parserCreate, otherParam, dbService)
+                .compose(v -> {
+                    URLParamUtil.addParam(parserCreate);
+                    IPanTool tool = parserCreate.createTool();
+                    return IPanTool.closeAfter(tool, tool::parseById)
+                            .onFailure(t -> {
+                                ParserAuthUtil.recordDonatedAccountFailureIfNeeded(dbService, otherParam, t);
+                                ParserAuthUtil.recordAutoDonatedFailureIfNeeded(dbService,
+                                        parserCreate.getShareLinkInfo(), t);
+                            })
+                            .map(downloadUrl -> buildFileDownInfo(shareLinkInfo, paramJson, downloadUrl));
+                });
+    }
+
+    @SuppressWarnings("unchecked")
+    private static JsonObject buildFileDownInfo(ShareLinkInfo shareLinkInfo, JsonObject paramJson, String downloadUrl) {
+        Map<String, String> downloadHeaders = new HashMap<>();
+        // 入口参数里可能已带 cookie（目录解析时写入），先作为底稿
+        mergeDownloadHeaders(downloadHeaders, paramJson.getJsonObject("downloadHeaders"));
+        // 解析器运行时生成的请求头优先覆盖（如刷新后的 cookie），但跳过 null
+        Object headersObj = shareLinkInfo.getOtherParam().get("downloadHeaders");
+        if (headersObj instanceof Map) {
+            mergeDownloadHeaders(downloadHeaders, (Map<?, ?>) headersObj);
+        }
+
+        String fileName = paramJson.getString("fileName", "");
+        if (StringUtils.isBlank(fileName)) {
+            Object fn = shareLinkInfo.getOtherParam().get("fileName");
+            if (fn != null) {
+                fileName = fn.toString();
+            }
+        }
+
+        boolean needDownloader = Boolean.TRUE.equals(paramJson.getBoolean("needDownloader"))
+                || !downloadHeaders.isEmpty();
+
+        shareLinkInfo.getOtherParam().put("downloadUrl", downloadUrl);
+        if (!downloadHeaders.isEmpty()) {
+            shareLinkInfo.getOtherParam().put("downloadHeaders", downloadHeaders);
+        }
+
+        JsonObject result = new JsonObject()
+                .put("downloadUrl", downloadUrl)
+                .put("fileName", fileName)
+                .put("needDownloader", needDownloader)
+                .put("downloadHeaders", downloadHeaders);
+
+        try {
+            Map<ClientLinkType, String> clientLinks = ClientLinkGeneratorFactory.generateAll(shareLinkInfo);
+            if (clientLinks.containsKey(ClientLinkType.CURL)) {
+                result.put("curlCommand", clientLinks.get(ClientLinkType.CURL));
+            }
+            if (clientLinks.containsKey(ClientLinkType.ARIA2)) {
+                result.put("aria2Command", clientLinks.get(ClientLinkType.ARIA2));
+            }
+            if (clientLinks.containsKey(ClientLinkType.THUNDER)) {
+                result.put("thunderLink", clientLinks.get(ClientLinkType.THUNDER));
+            }
+        } catch (Exception e) {
+            log.warn("生成下载命令失败: {}", e.getMessage());
+        }
+        return result;
+    }
+
+    /**
+     * 合并下载请求头，忽略 null/空值，避免运行时 null 覆盖入口参数中的 cookie。
+     */
+    private static void mergeDownloadHeaders(Map<String, String> target, JsonObject source) {
+        if (source == null || source.isEmpty()) {
+            return;
+        }
+        for (String key : source.fieldNames()) {
+            Object val = source.getValue(key);
+            if (val != null && StringUtils.isNotBlank(val.toString())) {
+                target.put(key, val.toString());
+            }
+        }
+    }
+
+    private static void mergeDownloadHeaders(Map<String, String> target, Map<?, ?> source) {
+        if (source == null || source.isEmpty()) {
+            return;
+        }
+        for (Map.Entry<?, ?> e : source.entrySet()) {
+            if (e.getKey() == null || e.getValue() == null) {
+                continue;
+            }
+            String val = e.getValue().toString();
+            if (StringUtils.isNotBlank(val)) {
+                target.put(e.getKey().toString(), val);
+            }
+        }
+    }
+

    /**
     * 预览媒体文件
@@ -212,7 +401,7 @@ public class ParserApi {
        }
        
        String previewURL = SharedDataUtil.getJsonStringForServerConfig("previewURL");
-        serverApi.parseKeyJson(request, type, key).onSuccess(res -> {
+        serverApi.parseKeyJsonForRedirect(request, type, key).onSuccess(res -> {
            redirect(response, previewURL, res);
        }).onFailure(e -> {
            ResponseUtil.fireJsonResultResponse(response, JsonResult.error(e.toString()));
@@ -248,7 +437,7 @@ public class ParserApi {
        }
        
        String previewURL = SharedDataUtil.getJsonStringForServerConfig("previewURL");
-        serverApi.parseJson(request, pwd, null).onSuccess(res -> {
+        serverApi.parseJsonForRedirect(request, pwd, null).onSuccess(res -> {
            redirect(response, previewURL, res);
        }).onFailure(e -> {
            ResponseUtil.fireJsonResultResponse(response, JsonResult.error(e.toString()));
@@ -257,17 +446,17 @@ public class ParserApi {


    @RouteMapping("/viewUrl/:type/:param")
-    public Future<Void> viewUrl(HttpServerRequest request, HttpServerResponse response, String type, String param) {
+    public Future<Void> viewUrl(HttpServerRequest request, HttpServerResponse response, String type, String param,
+                                String auth) {
        Promise<Void> promise = Promise.promise();

        String viewPrefix = SharedDataUtil.getJsonConfig("server").getString("previewURL");
-        getFileDownUrl(request, type, param)
+        getFileDownUrl(request, type, param, auth)
                .onSuccess(res -> {
                    String url = viewPrefix + URLEncoder.encode(res, StandardCharsets.UTF_8);
-                    ResponseUtil.redirect(response, url);
-                    promise.complete();
+                    ResponseUtil.redirect(response, url, promise);
                })
-                .onFailure(t -> promise.fail(t.fillInStackTrace()));
+                .onFailure(promise::tryFail);
        return promise.future();
    }

@@ -320,7 +509,8 @@ public class ParserApi {
            }
            
            // 使用默认方法解析并生成客户端链接
-            parserCreate.createTool().parseWithClientLinks()
+            IPanTool tool = parserCreate.createTool();
+            IPanTool.closeAfter(tool, tool::parseWithClientLinks)
                .onSuccess(clientLinks -> {
                    try {
                        ClientLinkResp response = buildClientLinkResponse(shareLinkInfo, clientLinks);
@@ -362,7 +552,8 @@ public class ParserApi {
            URLParamUtil.addParam(parserCreate);

            // 使用默认方法解析并生成客户端链接
-            parserCreate.createTool().parseWithClientLinks()
+            IPanTool tool = parserCreate.createTool();
+            IPanTool.closeAfter(tool, tool::parseWithClientLinks)
                .onSuccess(clientLinks -> {
                    try {
                        String clientLink = extractClientLinkByType(clientLinks, clientType);
@@ -123,6 +123,10 @@ public class PlaygroundApi {
            
            // 获取密码
            JsonObject body = ctx.body().asJsonObject();
+            if (body == null) {
+                promise.complete(JsonResult.error("请求体不能为空").toJsonObject());
+                return promise.future();
+            }
            String password = body.getString("password");
            
            if (StringUtils.isBlank(password)) {
@@ -249,82 +253,84 @@ public class PlaygroundApi {
                ShareLinkInfo shareLinkInfo = parserCreate.getShareLinkInfo();

                // 创建演练场执行器
-                JsPlaygroundExecutor executor = new JsPlaygroundExecutor(shareLinkInfo, jsCode);
+                final JsPlaygroundExecutor executor = new JsPlaygroundExecutor(shareLinkInfo, jsCode);

                // 根据方法类型选择执行，并异步处理结果
                Future<Object> executionFuture;
-                switch (method) {
-                    case "parse":
-                        executionFuture = executor.executeParseAsync().map(r -> (Object) r);
-                        break;
-                    case "parseFileList":
-                        executionFuture = executor.executeParseFileListAsync().map(r -> (Object) r);
-                        break;
-                    case "parseById":
-                        executionFuture = executor.executeParseByIdAsync().map(r -> (Object) r);
-                        break;
-                    default:
-                        promise.fail(new IllegalArgumentException("未知的方法类型: " + method));
-                        return promise.future();
+                try {
+                    switch (method) {
+                        case "parse":
+                            executionFuture = executor.executeParseAsync().map(r -> (Object) r);
+                            break;
+                        case "parseFileList":
+                            executionFuture = executor.executeParseFileListAsync().map(r -> (Object) r);
+                            break;
+                        case "parseById":
+                            executionFuture = executor.executeParseByIdAsync().map(r -> (Object) r);
+                            break;
+                        default:
+                            executor.close();
+                            promise.fail(new IllegalArgumentException("未知的方法类型: " + method));
+                            return promise.future();
+                    }
+                } catch (Exception ex) {
+                    // 同步异常路径：executor 已创建但 Future 未注册，需要手动关闭
+                    executor.close();
+                    throw ex;
                }

-                // 异步处理执行结果
-                executionFuture.onSuccess(result -> {
-                    log.debug("执行成功，结果类型: {}, 结果值: {}", 
-                            result != null ? result.getClass().getSimpleName() : "null", 
-                            result);
-                    
-                    // 获取日志
-                    List<JsPlaygroundLogger.LogEntry> logEntries = executor.getLogs();
-                    log.debug("获取到 {} 条日志记录", logEntries.size());
-                    
-                    List<PlaygroundTestResp.LogEntry> respLogs = logEntries.stream()
-                            .map(entry -> PlaygroundTestResp.LogEntry.builder()
-                                    .level(entry.getLevel())
-                                    .message(entry.getMessage())
-                                    .timestamp(entry.getTimestamp())
-                                    .source(entry.getSource())  // 使用日志条目的来源标识
-                                    .build())
-                            .collect(Collectors.toList());
+                // 异步处理执行结果，finally 中统一释放 executor，避免响应构建异常导致资源泄漏
+                executionFuture.onComplete(ar -> {
+                    try {
+                        long executionTime = System.currentTimeMillis() - startTime;
+                        List<JsPlaygroundLogger.LogEntry> logEntries = executor.getLogs();
+                        List<PlaygroundTestResp.LogEntry> respLogs = logEntries.stream()
+                                .map(entry -> PlaygroundTestResp.LogEntry.builder()
+                                        .level(entry.getLevel())
+                                        .message(entry.getMessage())
+                                        .timestamp(entry.getTimestamp())
+                                        .source(entry.getSource())
+                                        .build())
+                                .collect(Collectors.toList());

-                    long executionTime = System.currentTimeMillis() - startTime;
+                        if (ar.succeeded()) {
+                            Object result = ar.result();
+                            log.debug("执行成功，结果类型: {}, 结果摘要: {}",
+                                    result != null ? result.getClass().getSimpleName() : "null",
+                                    summarizeResult(result));

-                    // 构建响应
-                    PlaygroundTestResp response = PlaygroundTestResp.builder()
-                            .success(true)
-                            .result(result)
-                            .logs(respLogs)
-                            .executionTime(executionTime)
-                            .build();
+                            PlaygroundTestResp response = PlaygroundTestResp.builder()
+                                    .success(true)
+                                    .result(result)
+                                    .logs(respLogs)
+                                    .executionTime(executionTime)
+                                    .build();

-                    JsonObject jsonResponse = JsonObject.mapFrom(response);
-                    log.debug("测试成功响应: {}", jsonResponse.encodePrettily());
-                    promise.complete(jsonResponse);
-                }).onFailure(e -> {
-                    long executionTime = System.currentTimeMillis() - startTime;
-                    String errorMessage = e.getMessage();
+                            log.debug("测试成功响应: success=true, logCount={}", respLogs.size());
+                            promise.complete(JsonObject.mapFrom(response));
+                        } else {
+                            Throwable e = ar.cause();
+                            String errorMessage = e == null ? "执行失败" : e.getMessage();
+                            log.error("演练场执行失败", e);

-                    log.error("演练场执行失败", e);
+                            PlaygroundTestResp response = PlaygroundTestResp.builder()
+                                    .success(false)
+                                    .error(errorMessage)
+                                    .executionTime(executionTime)
+                                    .logs(respLogs)
+                                    .build();

-                    // 尝试获取已有的日志
-                    List<JsPlaygroundLogger.LogEntry> logEntries = executor.getLogs();
-                    List<PlaygroundTestResp.LogEntry> respLogs = logEntries.stream()
-                            .map(entry -> PlaygroundTestResp.LogEntry.builder()
-                                    .level(entry.getLevel())
-                                    .message(entry.getMessage())
-                                    .timestamp(entry.getTimestamp())
-                                    .source(entry.getSource())  // 使用日志条目的来源标识
-                                    .build())
-                            .collect(Collectors.toList());
-
-                    PlaygroundTestResp response = PlaygroundTestResp.builder()
-                            .success(false)
-                            .error(errorMessage)
-                            .executionTime(executionTime)
-                            .logs(respLogs)
-                            .build();
-
-                    promise.complete(JsonObject.mapFrom(response));
+                            promise.complete(JsonObject.mapFrom(response));
+                        }
+                    } catch (Exception e) {
+                        log.error("构建演练场响应失败", e);
+                        promise.tryComplete(JsonObject.mapFrom(PlaygroundTestResp.builder()
+                                .success(false)
+                                .error("构建响应失败: " + e.getMessage())
+                                .build()));
+                    } finally {
+                        executor.close();
+                    }
                });

            } catch (Exception e) {
@@ -462,19 +468,7 @@ public class PlaygroundApi {
                    }

                    // 检查type是否已存在
-                    dbService.getPlaygroundParserList().onSuccess(listResult -> {
-                        var list = listResult.getJsonArray("data");
-                        boolean exists = false;
-                        if (list != null) {
-                            for (int i = 0; i < list.size(); i++) {
-                                var item = list.getJsonObject(i);
-                                if (type.equals(item.getString("type"))) {
-                                    exists = true;
-                                    break;
-                                }
-                            }
-                        }
-
+                    dbService.playgroundParserTypeExists(type, null).onSuccess(exists -> {
                        if (exists) {
                            promise.complete(JsonResult.error("解析器类型 " + type + " 已存在，请使用其他类型标识").toJsonObject());
                            return;
@@ -493,25 +487,29 @@ public class PlaygroundApi {
                        parser.put("ip", getClientIp(ctx.request()));
                        parser.put("enabled", true);

+                        try {
+                            CustomParserRegistry.register(config);
+                        } catch (Exception e) {
+                            log.error("注册解析器失败", e);
+                            promise.complete(JsonResult.error("保存失败，注册解析器失败: " + e.getMessage()).toJsonObject());
+                            return;
+                        }
+
                        dbService.savePlaygroundParser(parser).onSuccess(result -> {
-                            // 保存成功后，立即注册到解析器系统
-                            try {
-                                CustomParserRegistry.register(config);
-                                log.info("已注册演练场解析器: {} ({})", displayName, type);
-                                promise.complete(JsonResult.success("保存并注册成功").toJsonObject());
-                            } catch (Exception e) {
-                                log.error("注册解析器失败", e);
-                                // 虽然注册失败，但保存成功了，返回警告
-                                promise.complete(JsonResult.success(
-                                    "保存成功，但注册失败（重启服务后会自动加载）: " + e.getMessage()
-                                ).toJsonObject());
+                            if (!result.getBoolean("success", false)) {
+                                CustomParserRegistry.unregister(type);
+                                promise.complete(JsonResult.error(result.getString("msg", "保存失败")).toJsonObject());
+                                return;
                            }
+                            log.info("已注册演练场解析器: {} ({})", displayName, type);
+                            promise.complete(JsonResult.success("保存并注册成功").toJsonObject());
                        }).onFailure(e -> {
+                            CustomParserRegistry.unregister(type);
                            log.error("保存解析器失败", e);
                            promise.complete(JsonResult.error("保存失败: " + e.getMessage()).toJsonObject());
                        });
                    }).onFailure(e -> {
-                        log.error("获取解析器列表失败", e);
+                        log.error("检查解析器类型失败", e);
                        promise.complete(JsonResult.error("检查解析器失败: " + e.getMessage()).toJsonObject());
                    });
                }).onFailure(e -> {
@@ -557,6 +555,11 @@ public class PlaygroundApi {
                return promise.future();
            }

+            if (jsCode.length() > MAX_CODE_LENGTH) {
+                promise.complete(JsonResult.error("代码长度超过限制（最大128KB），当前长度: " + jsCode.length() + " 字节").toJsonObject());
+                return promise.future();
+            }
+
            // 解析元数据
            try {
                var config = JsScriptMetadataParser.parseScript(jsCode);
@@ -570,6 +573,7 @@ public class PlaygroundApi {
                boolean enabled = body.getBoolean("enabled", true);

                JsonObject parser = new JsonObject();
+                parser.put("type", type);
                parser.put("name", name);
                parser.put("displayName", displayName);
                parser.put("description", description);
@@ -579,29 +583,73 @@ public class PlaygroundApi {
                parser.put("jsCode", jsCode);
                parser.put("enabled", enabled);

-                dbService.updatePlaygroundParser(id, parser).onSuccess(result -> {
-                    // 更新成功后，重新注册解析器
-                    try {
-                        if (enabled) {
-                            // 先注销旧的（如果存在）
-                            CustomParserRegistry.unregister(type);
-                            // 重新注册新的
-                            CustomParserRegistry.register(config);
-                            log.info("已重新注册演练场解析器: {} ({})", displayName, type);
-                        } else {
-                            // 禁用时注销
-                            CustomParserRegistry.unregister(type);
-                            log.info("已注销演练场解析器: {}", type);
-                        }
-                        promise.complete(JsonResult.success("更新并重新注册成功").toJsonObject());
-                    } catch (Exception e) {
-                        log.error("重新注册解析器失败", e);
-                        promise.complete(JsonResult.success(
-                            "更新成功，但注册失败（重启服务后会自动加载）: " + e.getMessage()
-                        ).toJsonObject());
+                dbService.getPlaygroundParserById(id).onSuccess(oldResult -> {
+                    String oldType = null;
+                    if (oldResult.getBoolean("success", false) && oldResult.getJsonObject("data") != null) {
+                        oldType = oldResult.getJsonObject("data").getString("type");
+                    } else {
+                        promise.complete(JsonResult.error("解析器不存在").toJsonObject());
+                        return;
                    }
+                    final String oldRegisteredType = oldType;
+                    dbService.playgroundParserTypeExists(type, id).onSuccess(exists -> {
+                        if (exists) {
+                            promise.complete(JsonResult.error("解析器类型 " + type + " 已被其他解析器使用").toJsonObject());
+                            return;
+                        }
+
+                        var oldConfig = CustomParserRegistry.get(oldRegisteredType);
+                        boolean removedOldType = false;
+                        boolean registeredNewType = false;
+                        try {
+                            if (StringUtils.isNotBlank(oldRegisteredType)) {
+                                removedOldType = CustomParserRegistry.unregister(oldRegisteredType);
+                            }
+                            if (enabled) {
+                                CustomParserRegistry.register(config);
+                                registeredNewType = true;
+                            }
+                        } catch (Exception e) {
+                            if (removedOldType && oldConfig != null) {
+                                try {
+                                    CustomParserRegistry.register(oldConfig);
+                                } catch (Exception restoreError) {
+                                    log.warn("恢复旧解析器注册失败: {}", oldRegisteredType, restoreError);
+                                }
+                            }
+                            log.error("预注册解析器失败", e);
+                            promise.complete(JsonResult.error("更新失败，注册解析器失败: " + e.getMessage()).toJsonObject());
+                            return;
+                        }
+                        final boolean shouldRollbackNewType = registeredNewType;
+                        final boolean shouldRestoreOldType = removedOldType;
+                        final var oldParserConfig = oldConfig;
+
+                        dbService.updatePlaygroundParser(id, parser).onSuccess(result -> {
+                            if (!result.getBoolean("success", false)) {
+                                rollbackParserRegistration(type, oldRegisteredType, shouldRollbackNewType,
+                                        shouldRestoreOldType, oldParserConfig);
+                                promise.complete(JsonResult.error(result.getString("msg", "更新失败")).toJsonObject());
+                                return;
+                            }
+                            if (!enabled) {
+                                log.info("已注销演练场解析器: {}", oldRegisteredType);
+                            } else {
+                                log.info("已重新注册演练场解析器: {} ({})", displayName, type);
+                            }
+                            promise.complete(JsonResult.success("更新并重新注册成功").toJsonObject());
+                        }).onFailure(e -> {
+                            rollbackParserRegistration(type, oldRegisteredType, shouldRollbackNewType,
+                                    shouldRestoreOldType, oldParserConfig);
+                            log.error("更新解析器失败", e);
+                            promise.complete(JsonResult.error("更新失败: " + e.getMessage()).toJsonObject());
+                        });
+                    }).onFailure(e -> {
+                        log.error("检查解析器类型失败", e);
+                        promise.complete(JsonResult.error("更新失败: " + e.getMessage()).toJsonObject());
+                    });
                }).onFailure(e -> {
-                    log.error("更新解析器失败", e);
+                    log.error("获取旧解析器信息失败", e);
                    promise.complete(JsonResult.error("更新失败: " + e.getMessage()).toJsonObject());
                });

@@ -617,6 +665,24 @@ public class PlaygroundApi {
        return promise.future();
    }

+    private void rollbackParserRegistration(String newType, String oldType, boolean rollbackNewType,
+                                            boolean restoreOldType, cn.qaiu.parser.custom.CustomParserConfig oldConfig) {
+        if (rollbackNewType) {
+            try {
+                CustomParserRegistry.unregister(newType);
+            } catch (Exception rollbackError) {
+                log.warn("回滚新解析器注册失败: {}", newType, rollbackError);
+            }
+        }
+        if (restoreOldType && oldConfig != null) {
+            try {
+                CustomParserRegistry.register(oldConfig);
+            } catch (Exception restoreError) {
+                log.warn("恢复旧解析器注册失败: {}", oldType, restoreError);
+            }
+        }
+    }
+
    /**
     * 删除解析器
     */
@@ -695,5 +761,18 @@ public class PlaygroundApi {
        }
        return ip;
    }
+
+    private String summarizeResult(Object result) {
+        if (result == null) {
+            return "null";
+        }
+        if (result instanceof String str) {
+            return "String(length=" + str.length() + ")";
+        }
+        if (result instanceof List<?> list) {
+            return "List(size=" + list.size() + ")";
+        }
+        return result.getClass().getSimpleName();
+    }
 }

@@ -1,8 +1,7 @@
 package cn.qaiu.lz.web.controller;

-import cn.qaiu.lz.common.util.AuthParamCodec;
+import cn.qaiu.lz.common.util.ParserAuthUtil;
 import cn.qaiu.lz.common.util.URLParamUtil;
-import cn.qaiu.lz.web.model.AuthParam;
 import cn.qaiu.lz.web.model.CacheLinkInfo;
 import cn.qaiu.lz.web.service.CacheService;
 import cn.qaiu.lz.web.service.DbService;
@@ -29,6 +28,8 @@ import lombok.extern.slf4j.Slf4j;
@RouteHandler("/")
 public class ServerApi {

+    private static final String SKIP_CLIENT_LINKS = ParserAuthUtil.SKIP_CLIENT_LINKS;
+
    private final CacheService cacheService = AsyncServiceUtil.getAsyncServiceInstance(CacheService.class);
    private final DbService dbService = AsyncServiceUtil.getAsyncServiceInstance(DbService.class);

@@ -38,16 +39,15 @@ public class ServerApi {
        String url = URLParamUtil.parserParams(request);

        // 构建 otherParam，包含 UA 和解码后的认证参数
-        JsonObject otherParam = buildOtherParam(request, auth);
+        JsonObject otherParam = buildOtherParam(request, auth, true);

        cacheService.getCachedByShareUrlAndPwd(url, pwd, otherParam)
                .onSuccess(res -> ResponseUtil.redirect(
-                        response.putHeader("nfd-cache-hit", res.getCacheHit().toString())
-                                .putHeader("nfd-cache-expires", res.getExpires()),
+                        addCacheHeaders(response, res),
                                res.getDirectLink(), promise))
                .onFailure(t -> {
-                    recordDonatedAccountFailureIfNeeded(otherParam, t);
-                    promise.fail(t.fillInStackTrace());
+                    ParserAuthUtil.recordDonatedAccountFailureIfNeeded(dbService, otherParam, t);
+                    promise.tryFail(t);
                });
        return promise.future();
    }
@@ -57,7 +57,14 @@ public class ServerApi {
        String url = URLParamUtil.parserParams(request);
        JsonObject otherParam = buildOtherParam(request, auth);
        return cacheService.getCachedByShareUrlAndPwd(url, pwd, otherParam)
-                .onFailure(t -> recordDonatedAccountFailureIfNeeded(otherParam, t));
+            .onFailure(t -> ParserAuthUtil.recordDonatedAccountFailureIfNeeded(dbService, otherParam, t));
+    }
+
+    public Future<CacheLinkInfo> parseJsonForRedirect(HttpServerRequest request, String pwd, String auth) {
+        String url = URLParamUtil.parserParams(request);
+        JsonObject otherParam = buildOtherParam(request, auth, true);
+        return cacheService.getCachedByShareUrlAndPwd(url, pwd, otherParam)
+            .onFailure(t -> ParserAuthUtil.recordDonatedAccountFailureIfNeeded(dbService, otherParam, t));
    }

    @RouteMapping(value = "/json/:type/:key", method = RouteMethod.GET)
@@ -72,6 +79,18 @@ public class ServerApi {
        return cacheService.getCachedByShareKeyAndPwd(type, key, pwd, JsonObject.of("UA",request.headers().get("user-agent"), "_requestOrigin", origin));
    }

+    public Future<CacheLinkInfo> parseKeyJsonForRedirect(HttpServerRequest request, String type, String key) {
+        String pwd = "";
+        if (key.contains("@")) {
+            String[] keys = key.split("@");
+            key = keys[0];
+            pwd = keys[1];
+        }
+        String origin = resolveOrigin(request);
+        return cacheService.getCachedByShareKeyAndPwd(type, key, pwd,
+                JsonObject.of("UA", request.headers().get("user-agent"), "_requestOrigin", origin, SKIP_CLIENT_LINKS, true));
+    }
+
    @RouteMapping(value = "/:type/:key", method = RouteMethod.GET)
    public Future<Void> parseKey(HttpServerResponse response, HttpServerRequest request, String type, String key) {
        Promise<Void> promise = Promise.promise();
@@ -82,15 +101,23 @@ public class ServerApi {
            pwd = keys[1];
        }
        String origin = resolveOrigin(request);
-        cacheService.getCachedByShareKeyAndPwd(type, key, pwd, JsonObject.of("UA",request.headers().get("user-agent"), "_requestOrigin", origin))
+        cacheService.getCachedByShareKeyAndPwd(type, key, pwd,
+                        JsonObject.of("UA", request.headers().get("user-agent"), "_requestOrigin", origin, SKIP_CLIENT_LINKS, true))
                .onSuccess(res -> ResponseUtil.redirect(
-                        response.putHeader("nfd-cache-hit", res.getCacheHit().toString())
-                                .putHeader("nfd-cache-expires", res.getExpires()),
+                        addCacheHeaders(response, res),
                        res.getDirectLink(), promise))
-                .onFailure(t -> promise.fail(t.fillInStackTrace()));
+                .onFailure(promise::tryFail);
        return promise.future();
    }

+    private static HttpServerResponse addCacheHeaders(HttpServerResponse response, CacheLinkInfo cacheLinkInfo) {
+        if (response.ended() || response.closed()) {
+            return response;
+        }
+        return response.putHeader("nfd-cache-hit", cacheLinkInfo.getCacheHit().toString())
+                .putHeader("nfd-cache-expires", cacheLinkInfo.getExpires());
+    }
+
    /**
     * 解析请求来源地址，支持反向代理
     */
@@ -114,63 +141,10 @@ public class ServerApi {
     * @return JsonObject
     */
    private JsonObject buildOtherParam(HttpServerRequest request, String auth) {
-        JsonObject otherParam = JsonObject.of("UA", request.headers().get("user-agent"), "_requestOrigin", resolveOrigin(request));
-
-        // 解码认证参数
-        if (auth != null && !auth.isEmpty()) {
-            AuthParam authParam = AuthParamCodec.decode(auth);
-            if (authParam != null && authParam.hasValidAuth()) {
-                // 将认证参数放入 otherParam
-                otherParam.put("authType", authParam.getAuthType());
-                otherParam.put("authToken", authParam.getPrimaryCredential());
-                otherParam.put("authPassword", authParam.getPassword());
-                otherParam.put("authInfo1", authParam.getExt1());
-                otherParam.put("authInfo2", authParam.getExt2());
-                otherParam.put("authInfo3", authParam.getExt3());
-                otherParam.put("authInfo4", authParam.getExt4());
-                otherParam.put("authInfo5", authParam.getExt5());
-                if (authParam.getDonatedAccountToken() != null && !authParam.getDonatedAccountToken().isBlank()) {
-                    otherParam.put("donatedAccountToken", authParam.getDonatedAccountToken());
-                }
-                log.debug("已解码认证参数: authType={}", authParam.getAuthType());
-            }
-        }
-
-        return otherParam;
+        return buildOtherParam(request, auth, false);
    }

-    private void recordDonatedAccountFailureIfNeeded(JsonObject otherParam, Throwable cause) {
-        if (!isLikelyAuthFailure(cause)) {
-            return;
-        }
-        String donatedAccountToken = otherParam.getString("donatedAccountToken");
-        if (donatedAccountToken == null || donatedAccountToken.isBlank()) {
-            return;
-        }
-        dbService.recordDonatedAccountFailureByToken(donatedAccountToken)
-                .onFailure(e -> log.warn("记录捐赠账号失败次数失败", e));
-    }
-
-    private boolean isLikelyAuthFailure(Throwable cause) {
-        if (cause == null) {
-            return false;
-        }
-        String msg = cause.getMessage();
-        if (msg == null || msg.isBlank()) {
-            return false;
-        }
-        String lower = msg.toLowerCase();
-        return lower.contains("auth")
-                || lower.contains("token")
-                || lower.contains("cookie")
-                || lower.contains("password")
-                || lower.contains("credential")
-                || lower.contains("401")
-                || lower.contains("403")
-                || lower.contains("unauthorized")
-                || lower.contains("forbidden")
-                || lower.contains("expired")
-                || lower.contains("登录")
-                || lower.contains("认证");
+    private JsonObject buildOtherParam(HttpServerRequest request, String auth, boolean skipClientLinks) {
+        return ParserAuthUtil.buildOtherParam(request, auth, resolveOrigin(request), skipClientLinks);
    }
 }
@@ -25,6 +25,11 @@ public interface DbService extends BaseAsyncService {
     */
    Future<JsonObject> getPlaygroundParserList();

+    /**
+     * 获取启动时需要注册的已启用演练场解析器
+     */
+    Future<JsonObject> getEnabledPlaygroundParsersForLoad();
+
    /**
     * 保存演练场解析器
     */
@@ -45,6 +50,11 @@ public interface DbService extends BaseAsyncService {
     */
    Future<Integer> getPlaygroundParserCount();

+    /**
+     * 检查演练场解析器类型是否已存在
+     */
+    Future<Boolean> playgroundParserTypeExists(String type, Long excludeId);
+
    /**
     * 根据ID获取演练场解析器
     */
@@ -5,14 +5,17 @@ import cn.qaiu.entity.ShareLinkInfo;
 import cn.qaiu.lz.common.cache.CacheConfigLoader;
 import cn.qaiu.lz.common.cache.CacheManager;
 import cn.qaiu.lz.common.cache.CacheTotalField;
+import cn.qaiu.lz.common.util.ParserAuthUtil;
 import cn.qaiu.lz.common.util.URLParamUtil;
 import cn.qaiu.lz.web.model.CacheLinkInfo;
 import cn.qaiu.lz.web.service.CacheService;
+import cn.qaiu.lz.web.service.DbService;
 import cn.qaiu.parser.IPanTool;
 import cn.qaiu.parser.ParserCreate;
 import cn.qaiu.parser.clientlink.ClientLinkGeneratorFactory;
 import cn.qaiu.parser.clientlink.ClientLinkType;
 import cn.qaiu.vx.core.annotaions.Service;
+import cn.qaiu.vx.core.util.AsyncServiceUtil;
 import io.vertx.core.Future;
 import io.vertx.core.Promise;
 import io.vertx.core.json.JsonObject;
@@ -27,7 +30,10 @@ import java.util.Map;
@Slf4j
 public class CacheServiceImpl implements CacheService {

+    private static final String SKIP_CLIENT_LINKS = ParserAuthUtil.SKIP_CLIENT_LINKS;
+
    private final CacheManager cacheManager = new CacheManager();
+    private final DbService dbService = AsyncServiceUtil.getAsyncServiceInstance(DbService.class);

    static {
        // 服务类加载时注册缓存定时清理任务
@@ -62,10 +68,16 @@ public class CacheServiceImpl implements CacheService {
                try {
                    tool = parserCreate.createTool();
                } catch (Exception e) {
-                    promise.fail(e.getCause().getCause());
+                    Throwable cause = e;
+                    while (cause.getCause() != null) {
+                        cause = cause.getCause();
+                    }
+                    promise.fail(cause);
                    return;
                }
-                tool.parse().onSuccess(redirectUrl -> {
+                IPanTool.closeAfter(tool, tool::parse).onFailure(err -> {
+                    ParserAuthUtil.recordAutoDonatedFailureIfNeeded(dbService, shareLinkInfo, err);
+                }).onSuccess(redirectUrl -> {
                    // 使用 effectiveCacheDuration
                    long expires = System.currentTimeMillis() + effectiveCacheDuration * 60 * 1000L;
                    result.setDirectLink(redirectUrl);
@@ -74,7 +86,7 @@ public class CacheServiceImpl implements CacheService {
                    result.setExpires(generateDate(expires));
                    
                    // 调试日志：检查解析器返回的otherParam
-                    log.info("[解析完成] shareKey={}, otherParam.keys={}, hasFileInfo={}", 
+                    log.debug("[解析完成] shareKey={}, otherParam.keys={}, hasFileInfo={}",
                            cacheKey, 
                            shareLinkInfo.getOtherParam().keySet(),
                            shareLinkInfo.getOtherParam().containsKey("fileInfo"));
@@ -90,17 +102,19 @@ public class CacheServiceImpl implements CacheService {
                            FileInfo fileInfo = (FileInfo) shareLinkInfo.getOtherParam().get("fileInfo");
                            result.setFileInfo(fileInfo);
                            cacheLinkInfo.setFileInfo(fileInfo);
-                            log.info("[设置文件信息] shareKey={}, fileName={}, size={}", 
+                            log.debug("[设置文件信息] shareKey={}, fileName={}, size={}",
                                    cacheKey, fileInfo.getFileName(), fileInfo.getSize());
                        } catch (Exception e) {
                            log.error("文件对象转换异常: shareKey={}", cacheKey, e);
                        }
                    } else {
-                        log.warn("[文件信息缺失] 解析器未返回fileInfo: shareKey={}, otherParam.keys={}", 
+                        log.debug("[文件信息缺失] 解析器未返回fileInfo: shareKey={}, otherParam.keys={}",
                                cacheKey, shareLinkInfo.getOtherParam().keySet());
                    }
-                    // 传递 downloadHeaders 并生成下载命令
-                    processDownloadHeaders(shareLinkInfo, cacheLinkInfo, result);
+                    if (shouldGenerateClientLinks(shareLinkInfo)) {
+                        // 传递 downloadHeaders 并生成下载命令
+                        processDownloadHeaders(shareLinkInfo, cacheLinkInfo, result);
+                    }
                    promise.complete(result);
                    // 更新缓存
                    cacheManager.cacheShareLink(cacheLinkInfo);
@@ -110,19 +124,21 @@ public class CacheServiceImpl implements CacheService {
                // 缓存命中，生成过期时间并生成下载命令
                result.setExpires(generateDate(result.getExpiration()));
                
-                // 初始化 otherParam（如果为空）
-                if (result.getOtherParam() == null) {
-                    result.setOtherParam(new HashMap<>());
+                if (shouldGenerateClientLinks(shareLinkInfo)) {
+                    // 初始化 otherParam（如果为空）
+                    if (result.getOtherParam() == null) {
+                        result.setOtherParam(new HashMap<>());
+                    }
+
+                    // 生成下载命令（aria2、curl）
+                    generateDownloadCommands(result);
                }
                
-                // 生成下载命令（aria2、curl）
-                generateDownloadCommands(result);
-                
                promise.complete(result);
                cacheManager.updateTotalByField(cacheKey, CacheTotalField.CACHE_HIT_TOTAL)
                        .onFailure(e -> log.error("更新缓存命中计数失败: cacheKey={}", cacheKey, e));
            }
-        }).onFailure(t -> promise.fail(t.fillInStackTrace()));
+        }).onFailure(promise::tryFail);

        return promise.future();
    }
@@ -131,6 +147,13 @@ public class CacheServiceImpl implements CacheService {
        return DateFormatUtils.format(new Date(ts), "yyyy-MM-dd HH:mm:ss");
    }

+    private boolean shouldGenerateClientLinks(ShareLinkInfo shareLinkInfo) {
+        if (shareLinkInfo == null || shareLinkInfo.getOtherParam() == null) {
+            return true;
+        }
+        return !Boolean.TRUE.equals(shareLinkInfo.getOtherParam().get(SKIP_CLIENT_LINKS));
+    }
+
    /**
     * 处理下载请求头并生成下载命令
     * 从 shareLinkInfo 中提取 downloadHeaders，传递到 cacheLinkInfo 和 result
@@ -147,7 +170,7 @@ public class CacheServiceImpl implements CacheService {
                Map<String, String> headers = (Map<String, String>) shareLinkInfo.getOtherParam().get("downloadHeaders");
                if (headers != null) {
                    downloadHeaders = headers;
-                    log.info("从shareLinkInfo提取downloadHeaders: shareKey={}, 请求头数量={}", 
+                    log.debug("从shareLinkInfo提取downloadHeaders: shareKey={}, 请求头数量={}",
                            cacheLinkInfo.getShareKey(), downloadHeaders.size());
                }
            }
@@ -163,6 +186,11 @@ public class CacheServiceImpl implements CacheService {
            // 传递 downloadHeaders 到两个对象
            cacheLinkInfo.getOtherParam().put("downloadHeaders", downloadHeaders);
            result.getOtherParam().put("downloadHeaders", downloadHeaders);
+            // 有特殊下载头时标记需要下载器（浏览器无法带 cookie 直连）
+            if (!downloadHeaders.isEmpty()) {
+                cacheLinkInfo.getOtherParam().put("needDownloader", true);
+                result.getOtherParam().put("needDownloader", true);
+            }
            
            // 使用已有的工具类生成下载命令
            generateCommandsFromShareLinkInfo(shareLinkInfo, cacheLinkInfo, result);
@@ -255,30 +283,27 @@ public class CacheServiceImpl implements CacheService {

    @Override
    public Future<CacheLinkInfo> getCachedByShareKeyAndPwd(String type, String shareKey, String pwd, JsonObject otherParam) {
-        ParserCreate parserCreate = ParserCreate.fromType(type).shareKey(shareKey).setShareLinkInfoPwd(pwd);
-        parserCreate.getShareLinkInfo().getOtherParam().putAll(otherParam.getMap());
-        return getAndSaveCachedShareLink(parserCreate);
+        ParserCreate parserCreate;
+        try {
+            parserCreate = ParserCreate.fromType(type).shareKey(shareKey).setShareLinkInfoPwd(pwd);
+        } catch (Exception e) {
+            return Future.failedFuture(e);
+        }
+        ParserCreate finalParserCreate = parserCreate;
+        return ParserAuthUtil.applyAuthParamsAndDonatedFallback(finalParserCreate, otherParam, dbService)
+                .compose(v -> getAndSaveCachedShareLink(finalParserCreate));
    }

    @Override
    public Future<CacheLinkInfo> getCachedByShareUrlAndPwd(String shareUrl, String pwd, JsonObject otherParam) {
-        ParserCreate parserCreate = ParserCreate.fromShareUrl(shareUrl).setShareLinkInfoPwd(pwd);
-        parserCreate.getShareLinkInfo().getOtherParam().putAll(otherParam.getMap());
-        
-        // 检查是否有临时认证参数
-        if (otherParam.containsKey("authType") || otherParam.containsKey("authToken")) {
-            log.debug("从otherParam中检测到临时认证参数");
-            URLParamUtil.addTempAuthParam(parserCreate, 
-                otherParam.getString("authType"),
-                otherParam.getString("authToken"),
-                otherParam.getString("authPassword"),
-                otherParam.getString("authInfo1"),
-                otherParam.getString("authInfo2"),
-                otherParam.getString("authInfo3"),
-                otherParam.getString("authInfo4"),
-                otherParam.getString("authInfo5"));
+        ParserCreate parserCreate;
+        try {
+            parserCreate = ParserCreate.fromShareUrl(shareUrl).setShareLinkInfoPwd(pwd);
+        } catch (Exception e) {
+            return Future.failedFuture(e);
        }
-        
-        return getAndSaveCachedShareLink(parserCreate);
+        ParserCreate finalParserCreate = parserCreate;
+        return ParserAuthUtil.applyAuthParamsAndDonatedFallback(finalParserCreate, otherParam, dbService)
+                .compose(v -> getAndSaveCachedShareLink(finalParserCreate));
    }
 }
@@ -85,33 +85,18 @@ public class DbServiceImpl implements DbService {
    public Future<JsonObject> getPlaygroundParserList() {
        JDBCPool client = JDBCPoolInit.instance().getPool();
        Promise<JsonObject> promise = Promise.promise();
-        String sql = "SELECT * FROM playground_parser ORDER BY create_time DESC";
+        String sql = """
+                SELECT id, name, type, display_name, description, author, version,
+                       match_pattern, ip, create_time, update_time, enabled
+                FROM playground_parser
+                ORDER BY create_time DESC
+                LIMIT 100
+                """;

        client.query(sql).execute().onSuccess(rows -> {
            List<JsonObject> list = new ArrayList<>();
            for (Row row : rows) {
-                JsonObject parser = new JsonObject();
-                parser.put("id", row.getLong("id"));
-                parser.put("name", row.getString("name"));
-                parser.put("type", row.getString("type"));
-                parser.put("displayName", row.getString("display_name"));
-                parser.put("description", row.getString("description"));
-                parser.put("author", row.getString("author"));
-                parser.put("version", row.getString("version"));
-                parser.put("matchPattern", row.getString("match_pattern"));
-                parser.put("jsCode", row.getString("js_code"));
-                parser.put("ip", row.getString("ip"));
-                // 将LocalDateTime转换为字符串格式，避免序列化为数组
-                var createTime = row.getLocalDateTime("create_time");
-                if (createTime != null) {
-                    parser.put("createTime", createTime.toString().replace("T", " "));
-                }
-                var updateTime = row.getLocalDateTime("update_time");
-                if (updateTime != null) {
-                    parser.put("updateTime", updateTime.toString().replace("T", " "));
-                }
-                parser.put("enabled", row.getBoolean("enabled"));
-                list.add(parser);
+                list.add(toPlaygroundParserJson(row, false));
            }
            promise.complete(JsonResult.data(list).toJsonObject());
        }).onFailure(e -> {
@@ -122,6 +107,33 @@ public class DbServiceImpl implements DbService {
        return promise.future();
    }

+    @Override
+    public Future<JsonObject> getEnabledPlaygroundParsersForLoad() {
+        JDBCPool client = JDBCPoolInit.instance().getPool();
+        Promise<JsonObject> promise = Promise.promise();
+        String sql = """
+                SELECT id, name, type, display_name, description, author, version,
+                       match_pattern, js_code, ip, create_time, update_time, enabled
+                FROM playground_parser
+                WHERE enabled = TRUE
+                ORDER BY update_time DESC, create_time DESC
+                LIMIT 100
+                """;
+
+        client.query(sql).execute().onSuccess(rows -> {
+            List<JsonObject> list = new ArrayList<>();
+            for (Row row : rows) {
+                list.add(toPlaygroundParserJson(row, true));
+            }
+            promise.complete(JsonResult.data(list).toJsonObject());
+        }).onFailure(e -> {
+            log.error("getEnabledPlaygroundParsersForLoad failed", e);
+            promise.fail(e);
+        });
+
+        return promise.future();
+    }
+
    @Override
    public Future<JsonObject> savePlaygroundParser(JsonObject parser) {
        JDBCPool client = JDBCPoolInit.instance().getPool();
@@ -164,13 +176,14 @@ public class DbServiceImpl implements DbService {
        
        String sql = """
            UPDATE playground_parser 
-            SET name = ?, display_name = ?, description = ?, author = ?, 
+            SET type = ?, name = ?, display_name = ?, description = ?, author = ?,
                version = ?, match_pattern = ?, js_code = ?, update_time = NOW(), enabled = ?
            WHERE id = ?
            """;

        client.preparedQuery(sql)
            .execute(Tuple.of(
+                parser.getString("type"),
                parser.getString("name"),
                parser.getString("displayName"),
                parser.getString("description"),
@@ -182,6 +195,10 @@ public class DbServiceImpl implements DbService {
                id
            ))
            .onSuccess(res -> {
+                if (res.rowCount() == 0) {
+                    promise.complete(JsonResult.error("解析器不存在").toJsonObject());
+                    return;
+                }
                promise.complete(JsonResult.success("更新成功").toJsonObject());
            })
            .onFailure(e -> {
@@ -230,6 +247,27 @@ public class DbServiceImpl implements DbService {
        return promise.future();
    }

+    @Override
+    public Future<Boolean> playgroundParserTypeExists(String type, Long excludeId) {
+        JDBCPool client = JDBCPoolInit.instance().getPool();
+        Promise<Boolean> promise = Promise.promise();
+
+        String sql = excludeId == null
+                ? "SELECT COUNT(*) as count FROM playground_parser WHERE type = ?"
+                : "SELECT COUNT(*) as count FROM playground_parser WHERE type = ? AND id <> ?";
+        Tuple params = excludeId == null ? Tuple.of(type) : Tuple.of(type, excludeId);
+
+        client.preparedQuery(sql).execute(params).onSuccess(rows -> {
+            Integer count = rows.iterator().next().getInteger("count");
+            promise.complete(count != null && count > 0);
+        }).onFailure(e -> {
+            log.error("playgroundParserTypeExists failed", e);
+            promise.fail(e);
+        });
+
+        return promise.future();
+    }
+
    @Override
    public Future<JsonObject> getPlaygroundParserById(Long id) {
        JDBCPool client = JDBCPoolInit.instance().getPool();
@@ -242,28 +280,7 @@ public class DbServiceImpl implements DbService {
            .onSuccess(rows -> {
                if (rows.size() > 0) {
                    Row row = rows.iterator().next();
-                    JsonObject parser = new JsonObject();
-                    parser.put("id", row.getLong("id"));
-                    parser.put("name", row.getString("name"));
-                    parser.put("type", row.getString("type"));
-                    parser.put("displayName", row.getString("display_name"));
-                    parser.put("description", row.getString("description"));
-                    parser.put("author", row.getString("author"));
-                    parser.put("version", row.getString("version"));
-                    parser.put("matchPattern", row.getString("match_pattern"));
-                    parser.put("jsCode", row.getString("js_code"));
-                    parser.put("ip", row.getString("ip"));
-                    // 将LocalDateTime转换为字符串格式，避免序列化为数组
-                    var createTime = row.getLocalDateTime("create_time");
-                    if (createTime != null) {
-                        parser.put("createTime", createTime.toString().replace("T", " "));
-                    }
-                    var updateTime = row.getLocalDateTime("update_time");
-                    if (updateTime != null) {
-                        parser.put("updateTime", updateTime.toString().replace("T", " "));
-                    }
-                    parser.put("enabled", row.getBoolean("enabled"));
-                    promise.complete(JsonResult.data(parser).toJsonObject());
+                    promise.complete(JsonResult.data(toPlaygroundParserJson(row, true)).toJsonObject());
                } else {
                    promise.fail("解析器不存在");
                }
@@ -276,15 +293,48 @@ public class DbServiceImpl implements DbService {
        return promise.future();
    }

+    private JsonObject toPlaygroundParserJson(Row row, boolean includeJsCode) {
+        JsonObject parser = new JsonObject();
+        parser.put("id", row.getLong("id"));
+        parser.put("name", row.getString("name"));
+        parser.put("type", row.getString("type"));
+        parser.put("displayName", row.getString("display_name"));
+        parser.put("description", row.getString("description"));
+        parser.put("author", row.getString("author"));
+        parser.put("version", row.getString("version"));
+        parser.put("matchPattern", row.getString("match_pattern"));
+        if (includeJsCode) {
+            parser.put("jsCode", row.getString("js_code"));
+        }
+        parser.put("ip", row.getString("ip"));
+        var createTime = row.getLocalDateTime("create_time");
+        if (createTime != null) {
+            parser.put("createTime", createTime.toString().replace("T", " "));
+        }
+        var updateTime = row.getLocalDateTime("update_time");
+        if (updateTime != null) {
+            parser.put("updateTime", updateTime.toString().replace("T", " "));
+        }
+        parser.put("enabled", row.getBoolean("enabled"));
+        return parser;
+    }
+
    // ========== 捐赠账号相关 ==========

    @Override
    public Future<JsonObject> saveDonatedAccount(JsonObject account) {
        JDBCPool client = JDBCPoolInit.instance().getPool();

-        Future<String> encryptedUsername = CryptoUtil.encrypt(account.getString("username"));
-        Future<String> encryptedPassword = CryptoUtil.encrypt(account.getString("password"));
-        Future<String> encryptedToken = CryptoUtil.encrypt(account.getString("token"));
+        // 只保留当前认证方式实际用到的字段，避免调用方切换认证类型后遗留的用户名/密码脏数据
+        // 被一并存入库中，导致后续解析时被误当作真实凭证使用（例如把废弃的用户名当手机号登录）。
+        boolean isPasswordAuth = "password".equalsIgnoreCase(account.getString("authType"));
+        String usernameToStore = isPasswordAuth ? account.getString("username") : null;
+        String passwordToStore = isPasswordAuth ? account.getString("password") : null;
+        String tokenToStore = isPasswordAuth ? null : account.getString("token");
+
+        Future<String> encryptedUsername = CryptoUtil.encrypt(usernameToStore);
+        Future<String> encryptedPassword = CryptoUtil.encrypt(passwordToStore);
+        Future<String> encryptedToken = CryptoUtil.encrypt(tokenToStore);

        return ensureFailCountColumn(client).compose(v ->
                Future.all(encryptedUsername, encryptedPassword, encryptedToken).compose(compositeFuture -> {
@@ -369,6 +419,14 @@ public class DbServiceImpl implements DbService {
                                    String password = passwordFuture.result();
                                    String token = tokenFuture.result();

+                                    // 历史脏数据兜底：非 password 认证类型的账号不应该带用户名/密码
+                                    // （例如切换认证类型前遗留的表单数据），否则会被解析器误当作真实账号密码去登录。
+                                    boolean isPasswordAuth = "password".equalsIgnoreCase(row.getString("auth_type"));
+                                    if (!isPasswordAuth) {
+                                        username = null;
+                                        password = null;
+                                    }
+
                                    // 如果解密后没有任何可用凭证，返回空对象，避免把密文当作明文认证参数下发给前端
                                    if (StringUtils.isBlank(username) && StringUtils.isBlank(password) && StringUtils.isBlank(token)) {
                                        log.warn("random donated account has no usable credential after decrypt, accountId={}", row.getLong("id"));
@@ -3,9 +3,11 @@ package cn.qaiu.lz.web.service.impl;
 import cn.qaiu.db.pool.JDBCPoolInit;
 import cn.qaiu.lz.web.service.ShoutService;
 import cn.qaiu.vx.core.annotaions.Service;
+import cn.qaiu.vx.core.util.VertxHolder;
 import cn.qaiu.vx.core.model.JsonResult;
 import io.vertx.core.Future;
 import io.vertx.core.Promise;
+import io.vertx.core.Vertx;
 import io.vertx.core.json.JsonObject;
 import io.vertx.jdbcclient.JDBCPool;
 import io.vertx.sqlclient.Tuple;
@@ -14,6 +16,8 @@ import lombok.extern.slf4j.Slf4j;
 import java.time.LocalDateTime;
 import java.time.ZoneId;
 import java.util.Random;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.concurrent.atomic.AtomicInteger;

@Slf4j
@Service
@@ -21,10 +25,18 @@ import java.util.Random;
 public class ShoutServiceImpl implements ShoutService {
    private static final int CODE_LENGTH = 6;
    private static final int EXPIRE_HOURS = 24;
+    private static final long CLEANUP_INTERVAL_MILLIS = 3600_000L;
+    private static final long CLEANUP_SHUTDOWN_WAIT_MILLIS = 5_000L;
+    private static final AtomicBoolean CLEANUP_REGISTERED = new AtomicBoolean(false);
+    private static final AtomicInteger CLEANUP_IN_FLIGHT = new AtomicInteger(0);
+    private static final Object CLEANUP_MONITOR = new Object();
+    private static volatile Long cleanupTimerId;
+    private static volatile Vertx cleanupVertx;
    private final JDBCPool jdbcPool = JDBCPoolInit.instance().getPool();

    @Override
    public Future<String> submitMessage(String content, String host) {
+        registerCleanup();
        Promise<String> promise = Promise.promise();
        String code = generateRandomCode();
        // 判断一下当前code是否存在消息
@@ -50,6 +62,7 @@ public class ShoutServiceImpl implements ShoutService {

    @Override
    public Future<JsonObject> retrieveMessage(String code) {
+        registerCleanup();
        Promise<JsonObject> promise = Promise.promise();

        String sql = "SELECT content FROM t_messages WHERE code = ? AND expire_time > NOW()";
@@ -79,6 +92,109 @@ public class ShoutServiceImpl implements ShoutService {
        jdbcPool.preparedQuery(sql).execute(Tuple.of(code));
    }

+    private static void registerCleanup() {
+        if (!CLEANUP_REGISTERED.compareAndSet(false, true)) {
+            return;
+        }
+        try {
+            Vertx vertx = VertxHolder.getVertxInstance();
+            cleanupVertx = vertx;
+            cleanupTimerId = vertx.setPeriodic(CLEANUP_INTERVAL_MILLIS, CLEANUP_INTERVAL_MILLIS,
+                    id -> cleanupExpiredMessages());
+            cleanupExpiredMessages();
+        } catch (Exception e) {
+            cleanupTimerId = null;
+            cleanupVertx = null;
+            CLEANUP_REGISTERED.set(false);
+            log.warn("注册消息清理任务失败", e);
+        }
+    }
+
+    public static void cancelCleanup() {
+        Long timerId = cleanupTimerId;
+        Vertx vertx = cleanupVertx;
+        cleanupTimerId = null;
+        cleanupVertx = null;
+        CLEANUP_REGISTERED.set(false);
+
+        if (timerId == null || vertx == null) {
+            waitForCleanupToFinish();
+            return;
+        }
+        try {
+            if (vertx.cancelTimer(timerId)) {
+                log.info("消息定时清理任务已取消");
+            }
+        } catch (Exception e) {
+            log.warn("取消消息定时清理任务失败", e);
+        }
+        waitForCleanupToFinish();
+    }
+
+    private static void cleanupExpiredMessages() {
+        cleanupStarted();
+        boolean asyncCleanupStarted = false;
+        try {
+            if (!CLEANUP_REGISTERED.get()) {
+                return;
+            }
+            JDBCPoolInit poolInit = JDBCPoolInit.instance();
+            if (poolInit == null || poolInit.getPool() == null) {
+                log.debug("数据库连接池未就绪，跳过消息定时清理");
+                return;
+            }
+            JDBCPool pool = poolInit.getPool();
+            String sql = "DELETE FROM t_messages WHERE expire_time < NOW()";
+            Future<io.vertx.sqlclient.RowSet<io.vertx.sqlclient.Row>> cleanupFuture = pool.query(sql).execute();
+            asyncCleanupStarted = true;
+            cleanupFuture.onSuccess(res -> {
+                    if (res.rowCount() > 0) {
+                        log.info("清理过期消息 {} 条", res.rowCount());
+                    }
+                })
+                .onFailure(e -> log.warn("清理过期消息失败", e))
+                .onComplete(ar -> cleanupFinished());
+        } catch (Exception e) {
+            log.warn("清理过期消息任务启动失败", e);
+        } finally {
+            if (!asyncCleanupStarted) {
+                cleanupFinished();
+            }
+        }
+    }
+
+    private static void cleanupStarted() {
+        CLEANUP_IN_FLIGHT.incrementAndGet();
+    }
+
+    private static void cleanupFinished() {
+        if (CLEANUP_IN_FLIGHT.decrementAndGet() <= 0) {
+            synchronized (CLEANUP_MONITOR) {
+                CLEANUP_MONITOR.notifyAll();
+            }
+        }
+    }
+
+    private static void waitForCleanupToFinish() {
+        long deadline = System.currentTimeMillis() + CLEANUP_SHUTDOWN_WAIT_MILLIS;
+        synchronized (CLEANUP_MONITOR) {
+            while (CLEANUP_IN_FLIGHT.get() > 0) {
+                long waitMillis = deadline - System.currentTimeMillis();
+                if (waitMillis <= 0) {
+                    log.warn("等待消息定时清理结束超时，剩余任务数: {}", CLEANUP_IN_FLIGHT.get());
+                    return;
+                }
+                try {
+                    CLEANUP_MONITOR.wait(waitMillis);
+                } catch (InterruptedException e) {
+                    Thread.currentThread().interrupt();
+                    log.warn("等待消息定时清理结束被中断");
+                    return;
+                }
+            }
+        }
+    }
+
    private String generateRandomCode() {
        Random random = new Random();
        StringBuilder sb = new StringBuilder();
@@ -17,7 +17,7 @@ proxyConf: server-proxy
 # JS演练场配置
 playground:
  # 是否启用演练场，默认false不启用
-  enabled: true
+  enabled: false
  # 公开模式，默认false需要密码访问，设为true则无需密码
  public: false
  # 访问密码，建议修改默认密码！
@@ -74,28 +74,54 @@ cache:
  type: h2db
  # 默认时长: 单位分钟，大部分网盘未严格验证，建议不要太大
  defaultDuration: 5
-  # 具体网盘的缓存配置，如果不加配置则不缓存，每次请求都会请求网盘API，格式：网盘标识: 时长
+  # 具体网盘的缓存配置（单位：分钟）
+  # - 配置 key 且有值（如 le: 2879）：使用指定时长
+  # - 配置 key 但无值（如 fc:）：使用上面的 defaultDuration
+  # - 未配置的 key：不缓存，每次都请求网盘API
+  # 格式：网盘标识: 时长
  duration:
-    ce: 5
-    cow: 5
-    ec: 5
-    fc:
-    fj: 20
-    iz: 20
-    le: 2879
-    lz: 20
-    qq: 9999999
-    qqw: 30
-    ws: 10
-    ye: -1
-    mne: 30
-    mqq: 30
-    mkg: 30
-    p115: 30
-    ct: 30
-    qishui_music: 5
-    baidu_photo: 5
-    migu: 5
+    # ---- 网盘类 ----
+    ce: 5                # Cloudreve
+    cow: 5               # 奶牛快传
+    ct: 30               # 城通网盘
+    ec: 5                # 移动云空间
+    fc:                  # 亿方云
+    fj: 20               # 小飞机网盘 链接有效期约30分钟
+    fs:                  # 飞书云盘
+    iz: 20               # 蓝奏云优享 链接有效期约30分钟
+    kd:                  # 可道云
+    le: 2879             # 联想乐云
+    lz: 30               # 蓝奏云 链接有效期约45分钟
+    other:               # 其他网盘
+    p115: 30             # 115网盘
+    pdb:                 # Dropbox
+    pcx:                 # 超星云盘（需要 referer 头）
+    pgd:                 # Google Drive
+    pic:                 # iCloud
+    pod:                 # OneDrive
+    pvyy:                # 微雨云存储
+    pwps:                # WPS云文档
+    qk:                  # 夸克网盘
+    qq: 9999999          # QQ邮箱中转站 (iwx.mail.qq.com/ftn/download)
+    qqsc:                # QQ闪传 (qfile.qq.com)
+    qqw: 30              # QQ邮箱云盘 (wx.mail.qq.com/s)
+    uc:                  # UC网盘
+    ws: 10               # 文叔叔
+    ye: -1               # 123网盘
+
+    # ---- 音乐类 ----
+    baidu_photo: 5       # 百度网盘相册
+    migu: 5              # 咪咕音乐
+    mkg: 30              # 酷狗音乐
+    mkgs:                # 酷狗音乐分享短链
+    mkgs2:               # 酷狗音乐分享2（share/*.html）
+    mkws:                # 酷我音乐分享
+    mmgs:                # 咪咕音乐分享短链
+    mne: 30              # 网易云音乐
+    mnes:                # 网易云音乐分享短链
+    mqq: 30              # QQ音乐
+    mqqs:                # QQ音乐分享短链
+    qishui_music: 5      # 汽水音乐

 # httpClient静态代理服务器配置(外网代理)
 proxy:
@@ -37,10 +37,10 @@

    <!-- 将文件输出设置成异步输出 -->
    <appender name="ASYNC-FILE" class="ch.qos.logback.classic.AsyncAppender">
-        <!-- 不丢失日志.默认的,如果队列的80%已满,则会丢弃TRACT、DEBUG、INFO级别的日志 -->
-        <discardingThreshold>0</discardingThreshold>
+        <!-- 队列剩余 20% 时开始丢弃 TRACE/DEBUG/INFO 级别日志，避免阻塞调用线程 -->
+        <discardingThreshold>20</discardingThreshold>
        <!-- 更改默认的队列的深度,该值会影响性能.默认值为256 -->
-        <queueSize>256</queueSize>
+        <queueSize>512</queueSize>
        <!-- 添加附加的appender,最多只能添加一个 -->
        <appender-ref ref="FILE"/>
    </appender>
@@ -55,7 +55,7 @@
    <logger name="io.netty" level="warn"/>
    <logger name="io.vertx" level="info"/>
    <logger name="com.zaxxer.hikari" level="info"/>
-    <logger name="cn.qaiu" level="debug"/>
+    <logger name="cn.qaiu" level="${NFD_LOG_LEVEL:-info}"/>
    <root level="info">
        <appender-ref ref="STDOUT"/>
 <!--        <appender-ref ref="FILE"/>-->
Author	SHA1	Message	Date
qaiu	06ba0aff52	Merge pull request #211 from qaiu/copilot/update-readme-to-latest-version docs: update download URL to latest release v0.4.2	2026-08-05 21:42:39 +08:00
copilot-swe-agent[bot]andqaiu	74e401d99c	docs: fix download URL and zip filename for v0.4.2 linux-amd64 Co-authored-by: qaiu <[email protected]>	2026-08-05 13:28:37 +00:00
copilot-swe-agent[bot]andqaiu	4995bca901	docs: update download URL to latest release v0.4.2 Co-authored-by: qaiu <[email protected]>	2026-08-05 13:18:11 +00:00
qaiu	7299fd8762	Merge pull request #207 from qaiu/cursor/ghsa-997r-ssrf-verify-2b8b fix(security): GHSA-997r SSRF verification + residual hardening	2026-07-26 21:10:39 +08:00
Cursor Agentandqaiu	efbadde4ed	fix(security): harden GHSA-997r Cloudreve SSRF residual paths Disable redirect following on CE/Ce4 attacker-controlled requests and stop echoing upstream response bodies in client-facing JSON errors. Add assertPublicHost regression coverage for the advisory PoC hosts. Co-authored-by: qaiu <[email protected]>	2026-07-26 12:05:16 +00:00
qandCursor	d1fa787bef	fix(uc/qk): improve directory download with cookie, transfer fallback and URL-safe param encoding - Preserve download cookie for UC/Quark needDownloader flows and disable browser/copy when required - Quark: share-link first, transfer only on size limit (23018), reuse savedFileCache/search_exit - Propagate auth to subdirectory parser URLs; switch path params to URL-safe Base64 (no double encode) - Bump version to 0.4.2 Fixes #205 Co-authored-by: Cursor <[email protected]>	2026-07-26 16:16:51 +08:00
q	c282fcb109	Merge branch 'main' into feature/ysepan-parser	2026-07-26 13:20:16 +08:00
qandCursor	4995173de2	feat: add Yongshuo E-pan (ysepan) share parser Support space shares like https://xxx.ysepan.com/ with password auth, directory/file listing, and direct download URL construction. Co-authored-by: Cursor <[email protected]>	2026-07-26 12:37:38 +08:00
qaiu	1c1068beba	Merge pull request #206 from qaiu/dependabot/maven/maven-858658338e chore(deps): bump the maven group across 1 directory with 2 updates	2026-07-26 09:04:56 +08:00
qaiu	4a5240fcbc	Merge pull request #203 from qaiu/dependabot/npm_and_yarn/web-front/npm_and_yarn-c42958dede build(deps): bump axios from 1.16.1 to 1.18.0 in /web-front in the npm_and_yarn group across 1 directory	2026-07-26 08:47:25 +08:00
dependabot[bot]	0f34672e33	chore(deps): bump the maven group across 1 directory with 2 updates Bumps the maven group with 2 updates in the / directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback) and [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson). Updates `ch.qos.logback:logback-core` from 1.5.33 to 1.5.34 - [Release notes](https://github.com/qos-ch/logback/releases) - [Commits](https://github.com/qos-ch/logback/compare/v_1.5.33...v_1.5.34) Updates `com.fasterxml.jackson.core:jackson-databind` from 2.18.6 to 2.18.9 - [Commits](https://github.com/FasterXML/jackson/commits) --- updated-dependencies: - dependency-name: ch.qos.logback:logback-core dependency-version: 1.5.34 dependency-type: direct:production dependency-group: maven - dependency-name: com.fasterxml.jackson.core:jackson-databind dependency-version: 2.18.9 dependency-type: direct:production dependency-group: maven ... Signed-off-by: dependabot[bot] <[email protected]>	2026-07-26 00:46:44 +00:00
qaiu	ecd365767a	Merge pull request #199 from qaiu/dependabot/maven/maven-6421fd6730 chore(deps): bump ch.qos.logback:logback-core from 1.5.32 to 1.5.33 in the maven group across 1 directory	2026-07-26 08:46:01 +08:00
qaiu	f358140974	Update README.md	2026-07-25 11:14:19 +08:00
qaiu	541c21f963	Merge pull request #204 from newbie000652/fix/uc-subdirectory-stoken fix: UC subdirectory listing fails due to missing stoken parameter	2026-07-25 07:58:14 +08:00
Tra	bdd253383d	docs: add stoken parameter to /v2/getFileList OpenAPI spec	2026-07-24 20:43:04 +08:00
RuneandCopilot Autofix powered by AI	0fb53d5159	Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <[email protected]>	2026-07-24 19:54:22 +08:00
Tra	b9ff408bdd	fix: UC subdirectory listing fails due to missing stoken parameter When the frontend requests subdirectory contents for UC drive shares, the stoken query parameter is mishandled in two places, breaking directory browsing: 1. URLParamUtil.handleTruncatedUrl() does not exclude stoken from the URL construction loop. As a result, the stoken value gets appended to the share URL (e.g. https://drive.uc.cn/s/xxx?stoken=yyy). The extra query string breaks the UC URL regex match in PanDomainTemplate, causing the parser to fall back to the default IPanTool.parseFileList() which returns "Not implemented yet". 2. ParserApi.getFileList() does not accept stoken as a method parameter and does not forward it to ShareLinkInfo.otherParam. Even when the stoken is present in the request URL, UcTool.parseFileList() cannot find it and must re-authenticate against the UC API — which fails without proper auth cookies. The fix: - URLParamUtil: add stoken to the param exclusion list - ParserApi: add String stoken parameter and put it into otherParam Both first-level and nested directory listing work correctly after this fix.	2026-07-24 18:04:52 +08:00
qaiu	aeb4394cf8	fix GHSA-997r-7xx2-p9x6	2026-07-22 10:25:10 +08:00
dependabot[bot]	8d419d3265	build(deps): bump axios Bumps the npm_and_yarn group with 1 update in the /web-front directory: [axios](https://github.com/axios/axios). Updates `axios` from 1.16.1 to 1.18.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](https://github.com/axios/axios/compare/v1.16.1...v1.18.0) --- updated-dependencies: - dependency-name: axios dependency-version: 1.18.0 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>	2026-07-21 07:29:38 +00:00
q	b70e30796f	ci: package fuller jre for native builds	2026-07-19 09:57:31 +08:00
q	d3ef521773	fix: support donated auth for 123 directory downloads	2026-07-19 09:39:55 +08:00
q	2969c92d3d	build jre	2026-07-19 02:06:33 +08:00
q	2fde421169	chore: bump version to 0.3.9	2026-07-19 01:11:57 +08:00
q	3494271150	chore: bump version to 0.3.8	2026-07-19 00:55:54 +08:00
q	675d930f86	fix: 123网盘捐赠账号无需临时auth参数即可自动生效，修复token前缀与脏数据问题 - 前端: getCurrentPanType() 补全123网盘域名匹配正则(share.123pan.cn等子域名) - 前端: 临时认证弹窗补充123云盘(YE)选项及提示文案 - 前端: submitDonateAccount() 按当前authType只提交相关字段，避免切换认证方式后残留的用户名/密码脏数据被一并提交 - 后端: URLParamUtil.addParam() 不再无条件用静态yml配置覆盖已生效的临时认证/ 自动捐赠账号回退(增加 __TEMP_AUTH_ADDED 判断) - 后端: CacheServiceImpl 新增 applyDonatedAccountFallback()，请求未带auth参数且无静态配置时自动从捐赠账号池随机取一个可用账号使用，并在解析失败时记录/ 自动禁用失败账号 - 后端: DbServiceImpl.getRandomDonatedAccount() 对非password类型账号强制丢弃历史遗留的username/password字段，避免被误当账号密码登录 - 解析器: Ye2Tool 清理token/authorization前缀中的"Bearer "，避免拼接成 'Bearer Bearer xxx' 导致123接口返回 tokenstring should not contain bearer 已通过本地实测验证: 捐赠123账号后，不带auth参数直接请求 /json/parser?url=https://1815268665.share.123pan.cn/123pan/iaKtVv-r4aCd 可正常返回200及直链	2026-07-18 23:21:56 +08:00
q	5e20ed5050	fix: 123网盘(YE)支持authorization别名配置并修复auth临时参数登录被覆盖问题, 更新README认证说明, bump version to 0.3.7 引用 #201 #198 #116 说明: 123解析仅限于本地部署（可Windows一键运行 run.bat），公共/云端服务因风控限制不保证可用	2026-07-18 12:28:00 +08:00
qaiu	91f4fcaa76	更新 README.md oosmetrics不可用	2026-07-11 06:28:53 +08:00
qaiu	0754fe20f1	更新 README.md	2026-07-10 16:41:58 +08:00
qaiu	034fd20d3b	更新 README.md	2026-07-10 16:41:06 +08:00
dependabot[bot]	363c603bbb	chore(deps): bump ch.qos.logback:logback-core Bumps the maven group with 1 update in the / directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback). Updates `ch.qos.logback:logback-core` from 1.5.32 to 1.5.33 - [Release notes](https://github.com/qos-ch/logback/releases) - [Commits](https://github.com/qos-ch/logback/compare/v_1.5.32...v_1.5.33) --- updated-dependencies: - dependency-name: ch.qos.logback:logback-core dependency-version: 1.5.33 dependency-type: direct:production dependency-group: maven ... Signed-off-by: dependabot[bot] <[email protected]>	2026-07-06 02:09:01 +00:00
q	24bf98bca9	fix: support 123pan redirected share links	2026-07-06 08:50:18 +08:00
qaiu	275f6b9e6d	更新 README.md	2026-06-23 17:10:09 +08:00
qaiu	5db9e422f4	更新 README.md	2026-06-11 12:03:44 +08:00
qaiu	705b6ba4b7	Merge pull request #195 from yukaidi1220/codex/full-main-clean Clean up fork changes for upstream review	2026-06-10 21:32:21 +08:00
yukaidi	0edc057347	docs: update parser and custom script docs	2026-06-10 21:23:05 +08:00
yukaidi	6ae5d998e6	fix(frontend): improve directory and timestamp display	2026-06-10 21:22:29 +08:00
yukaidi	cbb442ceb6	fix(web): harden cache and API services	2026-06-10 21:21:52 +08:00
yukaidi	0103841fb5	fix(parser): harden built-in pan parsers	2026-06-10 21:20:40 +08:00
yukaidi	b6b7f0d8b7	fix(parser): harden runtime resource handling	2026-06-10 21:19:56 +08:00
yukaidi	46c6827eda	fix(core): harden proxy and routing lifecycle	2026-06-10 21:19:18 +08:00
yukaidi	1ef6e120a8	ci: improve build and packaging workflow	2026-06-10 21:18:44 +08:00
qaiu	65d518373d	Merge pull request #191 from yukaidi1220/lecloud-direct-download feat: 乐云 directDownload 接口支持 & 缓存配置补充完善	2026-06-05 23:02:18 +08:00
yukaidi	bca4da4b6c	feat: 乐云 directDownload 接口支持 & 缓存配置补充完善 - 新增 directDownload (GET) 接口，比 packageDownloadWithFileIds 少一次请求 - 每次随机选择下载方式，失败自动 fallback 到另一种 - 统一所有下载方法的 Promise 参数传递 - 添加 HTTP 状态码日志便于调试 - 优化 app-dev.yml 缓存配置注释，补充所有缺失的网盘类型	2026-06-05 22:48:01 +08:00
qaiu	0fd78defcb	feat(ct): 升级城通网盘接口并实现目录分享解析 - 移除token参数，新增url参数至API1请求 - API2新增start_time/wait_seconds/verifycode/share_id/acheck=1参数 - parse()中从API1响应提取FileInfo(file_name/file_id/file_size/file_time/username) - 新增parseFileList()实现目录分享解析，通过getdir.php+file_list API获取文件列表 - 新增CTD枚举项匹配城通网盘目录分享链接(/d/路径)	2026-06-03 09:46:16 +00:00
qaiu	452fd0ea2c	Merge pull request #190 from yukaidi1220/pr/native-package CI: 新增原生环境打包 & 启动日志改进	2026-05-31 17:02:50 +08:00
yukaidi	dd8f2efb37	ci: Release 自动生成更新说明（generate_release_notes）	2026-05-31 16:39:23 +08:00
yukaidi	0feb8e798a	fix: PR#190 review 修复 — 配置查找顺序/页面日志/ZIP结构/注释 - 配置文件查找顺序与 Deploy 保持一致（先当前目录，再 resources/） - 页面地址日志改用 onComplete，无论演练场加载成功失败均输出 - Windows ZIP 移除 /* 通配符，与 Linux 保持一致的顶层目录结构 - 修正注释：同步读文件会阻塞 event loop，不再声称'避免阻塞' - YAML 正则和 jdeps 回退列表补充适用范围说明	2026-05-31 16:34:19 +08:00
yukaidi	d55d8edd2f	AppMain: 启动日志增加前端页面访问地址提示	2026-05-31 14:00:45 +08:00
yukaidi	451496f102	CI: 新增 Linux/Windows 原生环境打包 (jlink + 精简 JRE) 及 Docker 多平台构建	2026-05-31 14:00:45 +08:00
qaiu	6d6351bd58	更新 README.md	2026-05-31 07:02:09 +08:00