优化： Prefect 启动的日志输出

PostgreSQL 不允许字符串字段包含 NUL (0x00) 字符

.github/workflows/docker-build.yml

@@ -104,6 +104,8 @@ jobs:
           tags: |
             ${{ env.IMAGE_PREFIX }}/${{ matrix.image }}:${{ steps.version.outputs.VERSION }}
             ${{ steps.version.outputs.IS_RELEASE == 'true' && format('{0}/{1}:latest', env.IMAGE_PREFIX, matrix.image) || '' }}
+          build-args: |
+            IMAGE_TAG=${{ steps.version.outputs.VERSION }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
           provenance: false

LICENSE

@@ -1,131 +1,674 @@
-# PolyForm Noncommercial License 1.0.0
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
 
-<https://polyformproject.org/licenses/noncommercial/1.0.0>
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
 
-## Acceptance
+                            Preamble
 
-In order to get any license under these terms, you must agree
-to them as both strict obligations and conditions to all
-your licenses.
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
 
-## Copyright License
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
 
-The licensor grants you a copyright license for the
-software to do everything you might do with the software
-that would otherwise infringe the licensor's copyright
-in it for any permitted purpose.  However, you may
-only distribute the software according to [Distribution
-License](#distribution-license) and make changes or new works
-based on the software according to [Changes and New Works
-License](#changes-and-new-works-license).
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
 
-## Distribution License
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
 
-The licensor grants you an additional copyright license
-to distribute copies of the software.  Your license
-to distribute covers distributing the software with
-changes and new works permitted by [Changes and New Works
-License](#changes-and-new-works-license).
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
 
-## Notices
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
 
-You must ensure that anyone who gets a copy of any part of
-the software from you also gets a copy of these terms or the
-URL for them above, as well as copies of any plain-text lines
-beginning with `Required Notice:` that the licensor provided
-with the software.  For example:
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
 
-> Required Notice: Copyright Yuhang Yang (yyhuni)
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
 
-## Changes and New Works License
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
 
-The licensor grants you an additional copyright license to
-make changes and new works based on the software for any
-permitted purpose.
+  The precise terms and conditions for copying, distribution and
+modification follow.
 
-## Patent License
+                       TERMS AND CONDITIONS
 
-The licensor grants you a patent license for the software that
-covers patent claims the licensor can license, or becomes able
-to license, that you would infringe by using the software.
+  0. Definitions.
 
-## Noncommercial Purposes
+  "This License" refers to version 3 of the GNU General Public License.
 
-Any noncommercial purpose is a permitted purpose.
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
 
-## Personal Uses
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
 
-Personal use for research, experiment, and testing for
-the benefit of public knowledge, personal study, private
-entertainment, hobby projects, amateur pursuits, or religious
-observance, without any anticipated commercial application,
-is use for a permitted purpose.
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
 
-## Noncommercial Organizations
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
 
-Use by any charitable organization, educational institution,
-public research organization, public safety or health
-organization, environmental protection organization,
-or government institution is use for a permitted purpose
-regardless of the source of funding or obligations resulting
-from the funding.
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
 
-## Fair Use
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
 
-You may have "fair use" rights for the software under the
-law. These terms do not limit them.
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
 
-## No Other Rights
+  1. Source Code.
 
-These terms do not allow you to sublicense or transfer any of
-your licenses to anyone else, or prevent the licensor from
-granting licenses to anyone else.  These terms do not imply
-any other licenses.
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
 
-## Patent Defense
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
 
-If you make any written claim that the software infringes or
-contributes to infringement of any patent, your patent license
-for the software granted under these terms ends immediately. If
-your company makes such a claim, your patent license ends
-immediately for work on behalf of your company.
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
 
-## Violations
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
 
-The first time you are notified in writing that you have
-violated any of these terms, or done anything with the software
-not covered by your licenses, your licenses can nonetheless
-continue if you come into full compliance with these terms,
-and take practical steps to correct past violations, within
-32 days of receiving notice.  Otherwise, all your licenses
-end immediately.
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
 
-## No Liability
+  The Corresponding Source for a work in source code form is that
+same work.
 
-***As far as the law allows, the software comes as is, without
-any warranty or condition, and the licensor will not be liable
-to you for any damages arising out of these terms or the use
-or nature of the software, under any kind of legal claim.***
+  2. Basic Permissions.
 
-## Definitions
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
 
-The **licensor** is the individual or entity offering these
-terms, and the **software** is the software the licensor makes
-available under these terms.
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
 
-**You** refers to the individual or entity agreeing to these
-terms.
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
 
-**Your company** is any legal entity, sole proprietorship,
-or other kind of organization that you work for, plus all
-organizations that have control over, are under the control of,
-or are under common control with that organization.  **Control**
-means ownership of substantially all the assets of an entity,
-or the power to direct its management and policies by vote,
-contract, or otherwise.  Control can be direct or indirect.
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
 
-**Your licenses** are all the licenses granted to you for the
-software under these terms.
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
 
-**Use** means anything you do with the software requiring one
-of your licenses.
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.

README.md

@@ -1,10 +1,30 @@
-<h1 align="center">Xingrin - 星环</h1>
+<h1 align="center">XingRin - 星环</h1>
 
 <p align="center">
-  <b>一款现代化的企业级漏洞扫描与资产管理平台</b><br>
-  提供自动化安全检测、资产发现、漏洞管理等功能
+  <b>🛡️ 攻击面管理平台 (ASM) | 自动化资产发现与漏洞扫描系统</b>
 </p>
 
+<p align="center">
+  <a href="https://github.com/yyhuni/xingrin/stargazers"><img src="https://img.shields.io/github/stars/yyhuni/xingrin?style=flat-square&logo=github" alt="GitHub stars"></a>
+  <a href="https://github.com/yyhuni/xingrin/network/members"><img src="https://img.shields.io/github/forks/yyhuni/xingrin?style=flat-square&logo=github" alt="GitHub forks"></a>
+  <a href="https://github.com/yyhuni/xingrin/issues"><img src="https://img.shields.io/github/issues/yyhuni/xingrin?style=flat-square&logo=github" alt="GitHub issues"></a>
+  <a href="https://github.com/yyhuni/xingrin/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-PolyForm%20NC-blue?style=flat-square" alt="License"></a>
+</p>
+
+<p align="center">
+  <a href="#-功能特性">功能特性</a> •
+  <a href="#-快速开始">快速开始</a> •
+  <a href="#-文档">文档</a> •
+  <a href="#-技术栈">技术栈</a> •
+  <a href="#-反馈与贡献">反馈与贡献</a>
+</p>
+
+<p align="center">
+  <sub>🔍 关键词: ASM | 攻击面管理 | 漏洞扫描 | 资产发现 | Bug Bounty | 渗透测试 | Nuclei | 子域名枚举 | EASM</sub>
+</p>
+
+---
+
 <p align="center">
   <b>🌗 明暗模式切换</b>
 </p>
@@ -227,22 +247,30 @@ sudo ./update.sh
 - 遵守所在地区的法律法规
 - 承担因滥用产生的一切后果
 
+## 🌟 Star History
+
+如果这个项目对你有帮助，请给一个 ⭐ Star 支持一下！
+
+[![Star History Chart](https://api.star-history.com/svg?repos=yyhuni/xingrin&type=Date)](https://star-history.com/#yyhuni/xingrin&Date)
+
 ## 📄 许可证
 
-本项目采用 [PolyForm Noncommercial License 1.0.0](LICENSE) 许可证。
+本项目采用 [GNU General Public License v3.0](LICENSE) 许可证。
 
 ### 允许的用途
 
 - ✅ 个人学习和研究
-- ✅ 非商业安全测试
-- ✅ 教育机构使用
-- ✅ 非营利组织使用
+- ✅ 商业和非商业使用
+- ✅ 修改和分发
+- ✅ 专利使用
+- ✅ 私人使用
 
-### 禁止的用途
+### 义务和限制
 
-- ❌ **商业用途**（包括但不限于：出售、商业服务、SaaS 等）
+- 📋 **开源义务**：分发时必须提供源代码
+- 📋 **相同许可**：衍生作品必须使用相同许可证
+- 📋 **版权声明**：必须保留原始版权和许可证声明
+- ❌ **责任免除**：不提供任何担保
 - ❌ 未经授权的渗透测试
 - ❌ 任何违法行为
 
-如需商业授权，请联系作者。
-

VERSION

@@ -1 +1 @@
-v1.0.17
+v1.0.28

backend/apps/common/container_bootstrap.py

@@ -14,6 +14,10 @@ import os
 import sys
 import requests
 import logging
+import urllib3
+
+# 禁用自签名证书的 SSL 警告（远程 Worker 场景）
+urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
 
 logger = logging.getLogger(__name__)
 
@@ -36,7 +40,8 @@ def fetch_config_and_setup_django():
     print(f"[CONFIG] 正在从配置中心获取配置: {config_url}")
     print(f"[CONFIG] IS_LOCAL={is_local}")
     try:
-        resp = requests.get(config_url, timeout=10)
+        # verify=False: 远程 Worker 通过 HTTPS 访问时可能使用自签名证书
+        resp = requests.get(config_url, timeout=10, verify=False)
         resp.raise_for_status()
         config = resp.json()
         

backend/apps/engine/models.py

@@ -10,6 +10,8 @@ class WorkerNode(models.Model):
         ('deploying', '部署中'),
         ('online', '在线'),
         ('offline', '离线'),
+        ('updating', '更新中'),
+        ('outdated', '版本过低'),
     ]
     
     name = models.CharField(max_length=100, help_text='节点名称')

backend/apps/engine/services/task_distributor.py

@@ -232,9 +232,9 @@ class TaskDistributor:
             network_arg = f"--network {settings.DOCKER_NETWORK_NAME}"
             server_url = f"http://server:{settings.SERVER_PORT}"
         else:
-            # 远程：无需指定网络，使用公网地址
+            # 远程：通过 Nginx 反向代理访问（HTTPS，不直连 8888 端口）
             network_arg = ""
-            server_url = f"http://{settings.PUBLIC_HOST}:{settings.SERVER_PORT}"
+            server_url = f"https://{settings.PUBLIC_HOST}"
         
         # 挂载路径（所有节点统一使用固定路径）
         host_results_dir = settings.HOST_RESULTS_DIR  # /opt/xingrin/results
@@ -242,13 +242,18 @@ class TaskDistributor:
         
         # 环境变量：SERVER_URL + IS_LOCAL，其他配置容器启动时从配置中心获取
         # IS_LOCAL 用于 Worker 向配置中心声明身份，决定返回的数据库地址
-        # Prefect 本地模式配置：禁用 API server 和事件系统
+        # Prefect 本地模式配置：启用 ephemeral server（本地临时服务器）
         is_local_str = "true" if worker.is_local else "false"
         env_vars = [
             f"-e SERVER_URL={shlex.quote(server_url)}",
             f"-e IS_LOCAL={is_local_str}",
-            "-e PREFECT_API_URL=",  # 禁用 API server
-            "-e PREFECT_LOGGING_EXTRA_LOGGERS=",  # 禁用 Prefect 的额外内部日志器
+            "-e PREFECT_HOME=/tmp/.prefect",  # 设置 Prefect 数据目录到可写位置
+            "-e PREFECT_SERVER_EPHEMERAL_ENABLED=true",  # 启用 ephemeral server（本地临时服务器）
+            "-e PREFECT_SERVER_EPHEMERAL_STARTUP_TIMEOUT_SECONDS=120",  # 增加启动超时时间
+            "-e PREFECT_SERVER_DATABASE_CONNECTION_URL=sqlite+aiosqlite:////tmp/.prefect/prefect.db",  # 使用 /tmp 下的 SQLite
+            "-e PREFECT_LOGGING_LEVEL=DEBUG",  # 启用 DEBUG 级别日志
+            "-e PREFECT_LOGGING_SERVER_LEVEL=DEBUG",  # Server 日志级别
+            "-e PREFECT_DEBUG_MODE=true",  # 启用调试模式
         ]
         
         # 挂载卷

backend/apps/engine/services/worker_service.py

@@ -134,5 +134,57 @@ class WorkerService:
             logger.warning(f"[卸载] Worker {worker_id} 远程卸载异常: {e}")
             return False, f"远程卸载异常: {str(e)}"
 
+    def execute_remote_command(
+        self,
+        ip_address: str,
+        ssh_port: int,
+        username: str,
+        password: str | None,
+        command: str
+    ) -> tuple[bool, str]:
+        """
+        在远程主机上执行命令
+        
+        Args:
+            ip_address: SSH 主机地址
+            ssh_port: SSH 端口
+            username: SSH 用户名
+            password: SSH 密码
+            command: 要执行的命令
+            
+        Returns:
+            (success, message) 元组
+        """
+        if not password:
+            return False, "未配置 SSH 密码"
+        
+        try:
+            import paramiko
+            
+            ssh = paramiko.SSHClient()
+            ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+            
+            ssh.connect(
+                ip_address,
+                port=ssh_port,
+                username=username,
+                password=password,
+                timeout=30
+            )
+            
+            stdin, stdout, stderr = ssh.exec_command(command, timeout=120)
+            exit_status = stdout.channel.recv_exit_status()
+            
+            ssh.close()
+            
+            if exit_status == 0:
+                return True, stdout.read().decode().strip()
+            else:
+                error = stderr.read().decode().strip()
+                return False, error
+                
+        except Exception as e:
+            return False, str(e)
+
 
 __all__ = ["WorkerService"]

backend/apps/engine/views/worker_views.py

@@ -118,8 +118,36 @@ class WorkerNodeViewSet(viewsets.ModelViewSet):
     
     @action(detail=True, methods=['post'])
     def heartbeat(self, request, pk=None):
-        """接收心跳上报（写 Redis，首次心跳更新部署状态）"""
+        """
+        接收心跳上报（写 Redis，首次心跳更新部署状态，检查版本）
+        
+        请求体:
+        {
+            "cpu_percent": 50.0,
+            "memory_percent": 60.0,
+            "version": "v1.0.9"
+        }
+        
+        返回:
+        {
+            "status": "ok",
+            "need_update": true/false,
+            "server_version": "v1.0.19"
+        }
+        
+        状态流转:
+        ┌─────────────────────────────────────────────────────────────────────┐
+        │ 场景                        │ 状态变化                              │
+        ├─────────────────────────────┼───────────────────────────────────────┤
+        │ 首次心跳                    │ pending/deploying → online            │
+        │ 远程 Worker 版本不匹配      │ online → updating → (更新成功) online │
+        │ 远程 Worker 更新失败        │ updating → outdated                   │
+        │ 本地 Worker 版本不匹配      │ online → outdated (需手动 update.sh)  │
+        │ 版本匹配                    │ updating/outdated → online            │
+        └─────────────────────────────┴───────────────────────────────────────┘
+        """
         from apps.engine.services.worker_load_service import worker_load_service
+        from django.conf import settings
         
         worker = self.get_object()
         info = request.data if request.data else {}
@@ -134,7 +162,122 @@ class WorkerNodeViewSet(viewsets.ModelViewSet):
             worker.status = 'online'
             worker.save(update_fields=['status'])
         
-        return Response({'status': 'ok'})
+        # 3. 版本检查：比较 agent 版本与 server 版本
+        agent_version = info.get('version', '')
+        server_version = settings.IMAGE_TAG  # Server 当前版本
+        need_update = False
+        
+        if agent_version and agent_version != 'unknown':
+            # 版本不匹配时通知 agent 更新
+            need_update = agent_version != server_version
+            if need_update:
+                logger.info(
+                    f"Worker {worker.name} 版本不匹配: agent={agent_version}, server={server_version}"
+                )
+                
+                # 远程 Worker：服务端主动通过 SSH 触发更新
+                if not worker.is_local and worker.ip_address:
+                    self._trigger_remote_agent_update(worker, server_version)
+                else:
+                    # 本地 Worker 版本不匹配：标记为 outdated
+                    # 需要用户手动执行 update.sh 更新
+                    if worker.status != 'outdated':
+                        worker.status = 'outdated'
+                        worker.save(update_fields=['status'])
+            else:
+                # 版本匹配，确保状态为 online
+                if worker.status in ('updating', 'outdated'):
+                    worker.status = 'online'
+                    worker.save(update_fields=['status'])
+        
+        return Response({
+            'status': 'ok',
+            'need_update': need_update,
+            'server_version': server_version
+        })
+    
+    def _trigger_remote_agent_update(self, worker, target_version: str):
+        """
+        通过 SSH 触发远程 agent 更新（后台执行，不阻塞心跳响应）
+        
+        使用 Redis 锁防止重复触发（同一 worker 60秒内只触发一次）
+        """
+        import redis
+        from django.conf import settings as django_settings
+        
+        redis_url = f"redis://{django_settings.REDIS_HOST}:{django_settings.REDIS_PORT}/{django_settings.REDIS_DB}"
+        redis_client = redis.from_url(redis_url)
+        lock_key = f"agent_update_lock:{worker.id}"
+        
+        # 尝试获取锁（60秒过期，防止重复触发）
+        if not redis_client.set(lock_key, "1", nx=True, ex=60):
+            logger.debug(f"Worker {worker.name} 更新已在进行中，跳过")
+            return
+        
+        # 获取锁成功，设置状态为 updating
+        self._set_worker_status(worker.id, 'updating')
+        
+        # 提取数据避免后台线程访问 ORM
+        worker_id = worker.id
+        worker_name = worker.name
+        ip_address = worker.ip_address
+        ssh_port = worker.ssh_port
+        username = worker.username
+        password = worker.password
+        
+        def _async_update():
+            try:
+                logger.info(f"开始远程更新 Worker {worker_name} 到 {target_version}")
+                
+                # 构建更新命令：拉取新镜像并重启 agent
+                docker_user = getattr(django_settings, 'DOCKER_USER', 'yyhuni')
+                update_cmd = f'''
+                    docker pull {docker_user}/xingrin-agent:{target_version} && \
+                    docker stop xingrin-agent 2>/dev/null || true && \
+                    docker rm xingrin-agent 2>/dev/null || true && \
+                    docker run -d --pull=always \
+                        --name xingrin-agent \
+                        --restart always \
+                        -e HEARTBEAT_API_URL="https://{django_settings.PUBLIC_HOST}" \
+                        -e WORKER_ID="{worker_id}" \
+                        -e IMAGE_TAG="{target_version}" \
+                        -v /proc:/host/proc:ro \
+                        {docker_user}/xingrin-agent:{target_version}
+                '''
+                
+                success, message = self.worker_service.execute_remote_command(
+                    ip_address=ip_address,
+                    ssh_port=ssh_port,
+                    username=username,
+                    password=password,
+                    command=update_cmd
+                )
+                
+                if success:
+                    logger.info(f"Worker {worker_name} 远程更新成功")
+                    # 更新成功后，新 agent 心跳会自动把状态改回 online
+                else:
+                    logger.warning(f"Worker {worker_name} 远程更新失败: {message}")
+                    # 更新失败，标记为 outdated
+                    self._set_worker_status(worker_id, 'outdated')
+                    
+            except Exception as e:
+                logger.error(f"Worker {worker_name} 远程更新异常: {e}")
+                self._set_worker_status(worker_id, 'outdated')
+            finally:
+                # 释放锁
+                redis_client.delete(lock_key)
+        
+        # 后台执行，不阻塞心跳响应
+        threading.Thread(target=_async_update, daemon=True).start()
+    
+    def _set_worker_status(self, worker_id: int, status: str):
+        """更新 Worker 状态（用于后台线程）"""
+        try:
+            from apps.engine.models import WorkerNode
+            WorkerNode.objects.filter(id=worker_id).update(status=status)
+        except Exception as e:
+            logger.error(f"更新 Worker {worker_id} 状态失败: {e}")
     
     @action(detail=False, methods=['post'])
     def register(self, request):

backend/apps/scan/configs/engine_config_example.yaml

@@ -1,28 +1,14 @@
 # 引擎配置
 #
-# ==================== 参数命名规范 ====================
-# 所有参数统一用中划线，如 rate-limit, request-timeout, wordlist-name
-# - 贴近 CLI 参数风格，用户更直观
-# - 系统会自动转换为下划线供代码使用
-#
-# ==================== 必需参数 ====================
-# - enabled: 是否启用工具（true/false）
-# - timeout: 超时时间（秒），工具执行超过此时间会被强制终止
-#
-# 使用方式：
-# - 在前端创建扫描引擎时，将此配置保存到数据库
-# - 执行扫描时，从数据库读取配置并传递给 Flow
-# - 取消注释可选参数即可启用
+# 参数命名：统一用中划线（如 rate-limit），系统自动转换为下划线
+# 必需参数：enabled（是否启用）、timeout（超时秒数，auto 表示自动计算）
 
 # ==================== 子域名发现 ====================
 # 
-# 流程说明：
-#   Stage 1: 被动收集（并行） - 必选，至少启用一个工具
-#   Stage 2: 字典爆破（可选） - 使用字典暴力枚举子域名
-#   Stage 3: 变异生成 + 验证（可选） - 基于已发现域名生成变异，流式验证存活
-#   Stage 4: DNS 存活验证（可选） - 验证所有候选域名是否能解析
-#
-# 灵活组合：可以关闭 2/3/4 中的任意阶段，最终结果会根据实际执行的阶段动态决定
+# Stage 1: 被动收集（并行） - 必选，至少启用一个工具
+# Stage 2: 字典爆破（可选） - 使用字典暴力枚举子域名
+# Stage 3: 变异生成 + 验证（可选） - 基于已发现域名生成变异，流式验证存活
+# Stage 4: DNS 存活验证（可选） - 验证所有候选域名是否能解析
 #
 subdomain_discovery:
   # === Stage 1: 被动收集工具（并行执行）===
@@ -30,11 +16,11 @@ subdomain_discovery:
     subfinder:
       enabled: true
       timeout: 7200      # 2小时
-      # threads: 10     # 可选，并发 goroutine 数
+      # threads: 10      # 并发 goroutine 数
       
     amass_passive:
       enabled: true
-      timeout: 7200      # 2小时
+      timeout: 7200
       
     amass_active:
       enabled: true      # 主动枚举 + 爆破
@@ -43,7 +29,7 @@ subdomain_discovery:
     sublist3r:
       enabled: true
       timeout: 7200
-      # threads: 50     # 可选，线程数
+      # threads: 50      # 线程数
     
     assetfinder:
       enabled: true
@@ -51,174 +37,123 @@ subdomain_discovery:
 
   # === Stage 2: 主动字典爆破（可选）===
   bruteforce:
-    enabled: false                       # 是否启用字典爆破
+    enabled: false
     subdomain_bruteforce:
-      timeout: auto                      # 自动根据字典行数计算（后续代码中按行数 * 3 秒实现）
-      wordlist-name: subdomains-top1million-110000.txt    # 字典名称，对应「字典管理」中的 Wordlist.name
+      timeout: auto                      # 自动根据字典行数计算
+      wordlist-name: subdomains-top1million-110000.txt    # 对应「字典管理」中的 Wordlist.name
 
-  # === Stage 3: 变异生成 + 存活验证（可选，流式管道避免 OOM）===
+  # === Stage 3: 变异生成 + 存活验证（可选）===
   permutation:
-    enabled: true                        # 是否启用变异生成
+    enabled: true
     subdomain_permutation_resolve:
-      timeout: 7200                      # 2小时（变异量大时需要更长时间）
+      timeout: 7200
 
   # === Stage 4: DNS 存活验证（可选）===
   resolve:
-    enabled: true                        # 是否启用存活验证
+    enabled: true
     subdomain_resolve:
-      timeout: auto                      # 自动根据候选子域数量计算（在 Flow 中按行数 * 3 秒实现）
-      
+      timeout: auto      # 自动根据候选子域数量计算
 
 # ==================== 端口扫描 ====================
 port_scan:
   tools:
     naabu_active:
       enabled: true
-      timeout: auto     # 自动计算（根据：目标数 × 端口数 × 0.5秒）
-                        # 例如：100个域名 × 100个端口 × 0.5 = 5000秒
-                        #       10个域名 × 1000个端口 × 0.5 = 5000秒
-                        # 超时范围：60秒 ~ 2天（172800秒）
-                        # 或者手动指定：timeout: 3600
-      threads: 200        # 可选，并发连接数（默认 5）
-      # ports: 1-65535    # 可选，扫描端口范围（默认 1-65535）
-      top-ports: 100    # 可选，Scan for nmap top 100 ports（影响 timeout 计算）
-      rate: 10          # 可选，扫描速率（默认 10）
+      timeout: auto      # 自动计算（目标数 × 端口数 × 0.5秒），范围 60秒 ~ 2天
+      threads: 200       # 并发连接数（默认 5）
+      # ports: 1-65535   # 扫描端口范围（默认 1-65535）
+      top-ports: 100     # 扫描 nmap top 100 端口
+      rate: 10           # 扫描速率（默认 10）
       
     naabu_passive:
       enabled: true
-      timeout: auto     # 自动计算（被动扫描通常较快，端口数默认为 100）
-      # 被动扫描，使用被动数据源，无需额外配置
+      timeout: auto      # 被动扫描通常较快
 
 # ==================== 站点扫描 ====================
 site_scan:
   tools:
     httpx:
       enabled: true
-      timeout: auto         # 自动计算（根据URL数量，每个URL 1秒）
-                            # 或者手动指定：timeout: 3600
-      # threads: 50         # 可选，并发线程数（httpx 默认 50）
-      # rate-limit: 150     # 可选，每秒发送的请求数量（httpx 默认 150）
-      # request-timeout: 10  # 可选，单个请求的超时时间（httpx 默认 10）秒
-      # retries: 2          # 可选，请求失败重试次数
+      timeout: auto          # 自动计算（每个 URL 约 1 秒）
+      # threads: 50          # 并发线程数（默认 50）
+      # rate-limit: 150      # 每秒请求数（默认 150）
+      # request-timeout: 10  # 单个请求超时秒数（默认 10）
+      # retries: 2           # 请求失败重试次数
 
 # ==================== 目录扫描 ====================
 directory_scan:
   tools:
     ffuf:
       enabled: true
-      timeout: auto                            # 自动计算超时时间（根据字典行数）
-                                               # 计算公式：字典行数 × 0.02秒/词
-                                               # 超时范围：60秒 ~ 7200秒（2小时）
-                                               # 也可以手动指定固定超时（如 300）
-      wordlist-name: dir_default.txt          # 字典名称（必需），对应「字典管理」中唯一的 Wordlist.name
-                                               # 安装时会自动初始化名为 dir_default.txt 的默认目录字典
-                                               # ffuf 会逐行读取字典文件，将每行作为 FUZZ 关键字的替换值
-      delay: 0.1-2.0                         # Seconds of delay between requests, or a range of random delay
-                                               # For example "0.1" or "0.1-2.0"
-      threads: 10                            # Number of concurrent threads (default: 40)
-      request-timeout: 10                    # HTTP request timeout in seconds (default: 10)
-      match-codes: 200,201,301,302,401,403   # Match HTTP status codes, comma separated
-      # rate: 0                                # Rate of requests per second (default: 0)
+      timeout: auto                       # 自动计算（字典行数 × 0.02秒），范围 60秒 ~ 2小时
+      wordlist-name: dir_default.txt      # 对应「字典管理」中的 Wordlist.name
+      delay: 0.1-2.0                      # 请求间隔，支持范围随机（如 "0.1-2.0"）
+      threads: 10                         # 并发线程数（默认 40）
+      request-timeout: 10                 # HTTP 请求超时秒数（默认 10）
+      match-codes: 200,201,301,302,401,403  # 匹配的 HTTP 状态码
+      # rate: 0                           # 每秒请求数（默认 0 不限制）
 
 # ==================== URL 获取 ====================
 url_fetch:
   tools:
     waymore:
       enabled: true
-      timeout: 3600     # 工具级别总超时：固定 3600 秒（按域名 target_name 输入）
-                        # 如果目标较大或希望更快/更慢，可根据需要手动调整秒数
-                        # 输入类型：domain_name（域名级别，自动去重同域名站点）
+      timeout: 3600      # 固定 1 小时（按域名输入）
     
     katana:
       enabled: true
-      timeout: auto         # 工具级别总超时：自动计算（根据站点数量）
-                            # 或手动指定：timeout: 300
-      
-      # ========== 核心功能参数（已在命令中固定开启） ==========
-      # -jc: JavaScript 爬取 + 自动解析 .js 文件里的所有端点（最重要）
-      # -xhr: 从 JS 中提取 XHR/Fetch 请求的 API 路径（再多挖 10-20% 隐藏接口）
-      # -kf all: 自动 fuzz 所有已知敏感文件（.env、.git、backup、config 等 5000+ 条）
-      # -fs rdn: 智能过滤重复+噪声路径（分页、?id=1/2/3 全干掉，输出极干净）
-      
-      # ========== 可选参数（推荐配置） ==========
-      depth: 5              # 爬取最大深度（平衡深度与时间，默认 3，推荐 5）
-      threads: 10           # 全局并发数（极低并发最像真人，推荐 10）
-      rate-limit: 30        # 全局硬限速：每秒最多 30 个请求（WAF 几乎不报警）
-      random-delay: 1       # 每次请求之间随机延迟 0.5~1.5 秒（再加一层人性化）
-      retry: 2              # 失败请求自动重试 2 次（网络抖动不丢包）
-      request-timeout: 12   # 单请求超时 12 秒（防卡死，katana 参数名是 -timeout）
-      
-      # 输入类型：url（站点级别，每个站点单独爬取）
+      timeout: auto      # 自动计算（根据站点数量）
+      depth: 5           # 爬取最大深度（默认 3）
+      threads: 10        # 全局并发数
+      rate-limit: 30     # 每秒最多请求数
+      random-delay: 1    # 请求间随机延迟秒数
+      retry: 2           # 失败重试次数
+      request-timeout: 12  # 单请求超时秒数
     
     uro:
       enabled: true
-      timeout: auto         # 自动计算（根据 URL 数量，每 100 个约 1 秒）
-                            # 范围：30 秒 ~ 300 秒
-                            # 或手动指定：timeout: 60
-      
-      # ========== 可选参数 ==========
-      # whitelist:          # 只保留指定扩展名的 URL（如：php,asp,jsp）
+      timeout: auto      # 自动计算（每 100 个 URL 约 1 秒），范围 30 ~ 300 秒
+      # whitelist:       # 只保留指定扩展名
       #   - php
       #   - asp
-      # blacklist:            # 排除指定扩展名的 URL（静态资源）
+      # blacklist:       # 排除指定扩展名（静态资源）
       #   - jpg
-      #   - jpeg
       #   - png
-      #   - gif
-      #   - svg
-      #   - ico
       #   - css
-      #   - woff
-      #   - woff2
-      #   - ttf
-      #   - eot
-      #   - mp4
-      #   - mp3
-      #   - pdf
-      # filters:             # 额外的过滤规则，参考 uro 文档
-      #   - hasparams        # 只保留有参数的 URL
-      #   - hasext           # 只保留有扩展名的 URL
-      #   - vuln             # 只保留可能有漏洞的 URL
-      
-      # 用途：清理合并后的 URL 列表，去除冗余和无效 URL
-      # 输入类型：merged_file（合并后的 URL 文件）
-      # 输出：清理后的 URL 列表
+      # filters:         # 额外过滤规则
+      #   - hasparams    # 只保留有参数的 URL
+      #   - vuln         # 只保留可能有漏洞的 URL
     
     httpx:
       enabled: true
-      timeout: auto         # 自动计算（根据 URL 数量，每个 URL 1 秒）
-                            # 或手动指定：timeout: 600
-      # threads: 50         # 可选，并发线程数（httpx 默认 50）
-      # rate-limit: 150     # 可选，每秒发送的请求数量（httpx 默认 150）
-      # request-timeout: 10  # 可选，单个请求的超时时间（httpx 默认 10）秒
-      # retries: 2          # 可选，请求失败重试次数
-      
-      # 用途：判断 URL 存活，过滤无效 URL
-      # 输入类型：url_file（URL 列表文件）
-      # 输出：存活的 URL 及其响应信息（status, title, server, tech 等）
+      timeout: auto          # 自动计算（每个 URL 约 1 秒）
+      # threads: 50          # 并发线程数（默认 50）
+      # rate-limit: 150      # 每秒请求数（默认 150）
+      # request-timeout: 10  # 单个请求超时秒数（默认 10）
+      # retries: 2           # 请求失败重试次数
 
 # ==================== 漏洞扫描 ====================
 vuln_scan:
   tools:
     dalfox_xss:
       enabled: true
-      timeout: auto          # 自动计算（根据 endpoints 行数 × 100 秒），或手动指定秒数如 timeout: 600
-      request-timeout: 10    # Dalfox 单个请求的超时时间，对应命令行 --timeout
+      timeout: auto          # 自动计算（endpoints 行数 × 100 秒）
+      request-timeout: 10    # 单个请求超时秒数
       only-poc: r            # 只输出 POC 结果（r: 反射型）
-      ignore-return: "302,404,403"  # 忽略这些返回码
-      # blind-xss-server: xxx  # 可选：盲打 XSS 回连服务地址，需要时再开启
-      delay: 100             # Dalfox 扫描内部延迟参数
-      worker: 10             # Dalfox worker 数量
-      user-agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"  # 默认 UA，可根据需要修改
+      ignore-return: "302,404,403"  # 忽略的返回码
+      delay: 100             # 扫描内部延迟
+      worker: 10             # worker 数量
+      user-agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
+      # blind-xss-server: xxx  # 盲打 XSS 回连服务地址
 
     nuclei:
       enabled: true
-      timeout: auto                        # 自动计算（根据 endpoints 行数），或手动指定秒数
-      template-repo-names:                 # 模板仓库列表（必填，数组写法），对应「Nuclei 模板」中的仓库名
-        - nuclei-templates                 # Worker 会自动同步到与 Server 一致的 commit 版本
-        # - nuclei-custom                  # 可追加自定义仓库，按顺序依次 -t 传入
-      concurrency: 25                      # 并发数（默认 25）
-      rate-limit: 150                      # 每秒请求数限制（默认 150）
-      request-timeout: 5                   # 单个请求超时秒数（默认 5）
-      severity: medium,high,critical       # 只扫描中高危，降低噪音（逗号分隔）
-      # tags: cve,rce                      # 可选：只使用指定标签的模板
+      timeout: auto          # 自动计算（根据 endpoints 行数）
+      template-repo-names:   # 模板仓库列表，对应「Nuclei 模板」中的仓库名
+        - nuclei-templates
+        # - nuclei-custom    # 可追加自定义仓库
+      concurrency: 25        # 并发数（默认 25）
+      rate-limit: 150        # 每秒请求数限制（默认 150）
+      request-timeout: 5     # 单个请求超时秒数（默认 5）
+      severity: medium,high,critical  # 只扫描中高危
+      # tags: cve,rce        # 只使用指定标签的模板

backend/apps/scan/notifications/services.py

@@ -3,10 +3,14 @@
 import logging
 import time
 import requests
+import urllib3
 from .models import Notification, NotificationSettings
 from .types import NotificationLevel, NotificationCategory
 from .repositories import DjangoNotificationRepository, NotificationSettingsRepository
 
+# 禁用自签名证书的 SSL 警告（远程 Worker 回调场景）
+urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
+
 logger = logging.getLogger(__name__)
 
 
@@ -314,7 +318,8 @@ def _push_via_api_callback(notification: Notification, server_url: str) -> None:
             'created_at': notification.created_at.isoformat()
         }
         
-        resp = requests.post(callback_url, json=data, timeout=5)
+        # verify=False: 远程 Worker 回调 Server 时可能使用自签名证书
+        resp = requests.post(callback_url, json=data, timeout=5, verify=False)
         resp.raise_for_status()
         
         logger.debug(f"通知回调推送成功 - ID: {notification.id}")

backend/apps/scan/tasks/url_fetch/run_and_stream_save_urls_task.py

@@ -51,6 +51,18 @@ class ServiceSet:
         )
 
 
+def _sanitize_string(value: str) -> str:
+    """
+    清理字符串中的 NUL 字符和其他不可打印字符
+    
+    PostgreSQL 不允许字符串字段包含 NUL (0x00) 字符
+    """
+    if not value:
+        return value
+    # 移除 NUL 字符
+    return value.replace('\x00', '')
+
+
 def _parse_and_validate_line(line: str) -> Optional[dict]:
     """
     解析并验证单行 httpx JSON 输出
@@ -64,6 +76,9 @@ def _parse_and_validate_line(line: str) -> Optional[dict]:
     只返回存活的 URL（2xx/3xx 状态码）
     """
     try:
+        # 清理 NUL 字符后再解析 JSON
+        line = _sanitize_string(line)
+        
         # 解析 JSON
         try:
             line_data = json.loads(line)
@@ -87,16 +102,16 @@ def _parse_and_validate_line(line: str) -> Optional[dict]:
         # 只保存存活的 URL（2xx 或 3xx）
         if status_code and (200 <= status_code < 400):
             return {
-                'url': url,
-                'host': line_data.get('host', ''),  # 从 httpx 输出中提取 host
+                'url': _sanitize_string(url),
+                'host': _sanitize_string(line_data.get('host', '')),
                 'status_code': status_code,
-                'title': line_data.get('title', ''),
+                'title': _sanitize_string(line_data.get('title', '')),
                 'content_length': line_data.get('content_length', 0),
-                'content_type': line_data.get('content_type', ''),
-                'webserver': line_data.get('webserver', ''),
-                'location': line_data.get('location', ''),
+                'content_type': _sanitize_string(line_data.get('content_type', '')),
+                'webserver': _sanitize_string(line_data.get('webserver', '')),
+                'location': _sanitize_string(line_data.get('location', '')),
                 'tech': line_data.get('tech', []),
-                'body_preview': line_data.get('body_preview', ''),
+                'body_preview': _sanitize_string(line_data.get('body_preview', '')),
                 'vhost': line_data.get('vhost', False),
             }
         else:
@@ -104,7 +119,7 @@ def _parse_and_validate_line(line: str) -> Optional[dict]:
             return None
     
     except Exception as e:
-        logger.error("解析行数据异常: %s - 数据: %s", e, line[:100])
+        logger.error("解析行数据异常: %s - 数据: %s", e, line[:100] if line else 'empty')
         return None
 
 

backend/apps/scan/utils/wordlist_helpers.py

@@ -7,6 +7,7 @@
 
 import logging
 import os
+import ssl
 from pathlib import Path
 from urllib import request as urllib_request
 from urllib import parse as urllib_parse
@@ -89,7 +90,12 @@ def ensure_wordlist_local(wordlist_name: str) -> str:
     logger.info("从后端下载字典: %s -> %s", download_url, local_path)
 
     try:
-        with urllib_request.urlopen(download_url) as resp:
+        # 创建不验证 SSL 的上下文（远程 Worker 可能使用自签名证书）
+        ssl_context = ssl.create_default_context()
+        ssl_context.check_hostname = False
+        ssl_context.verify_mode = ssl.CERT_NONE
+        
+        with urllib_request.urlopen(download_url, context=ssl_context) as resp:
             if resp.status != 200:
                 raise RuntimeError(f"下载字典失败，HTTP {resp.status}")
             data = resp.read()

backend/scripts/worker-deploy/agent.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 # ============================================
 # XingRin Agent
-# 用途：心跳上报 + 负载监控
+# 用途：心跳上报 + 负载监控 + 版本检查
 # 适用：远程 VPS 或 Docker 容器内
 # ============================================
 
@@ -17,6 +17,9 @@ SRC_DIR="${MARKER_DIR}/src"
 ENV_FILE="${SRC_DIR}/backend/.env"
 INTERVAL=${AGENT_INTERVAL:-3}
 
+# Agent 版本（从环境变量获取，由 Docker 镜像构建时注入）
+AGENT_VERSION="${IMAGE_TAG:-unknown}"
+
 # 颜色定义
 GREEN='\033[0;32m'
 RED='\033[0;31m'
@@ -90,7 +93,7 @@ register_worker() {
 EOF
 )
     
-    RESPONSE=$(curl -s -X POST \
+    RESPONSE=$(curl -k -s -X POST \
         -H "Content-Type: application/json" \
         -d "$REGISTER_DATA" \
         "${API_URL}/api/workers/register/" 2>/dev/null)
@@ -172,22 +175,72 @@ while true; do
     fi
 
     # 构建 JSON 数据（使用数值而非字符串，便于比较和排序）
+    # 包含版本号，供 Server 端检查版本一致性
     JSON_DATA=$(cat <<EOF
 {
     "cpu_percent": $CPU_PERCENT,
-    "memory_percent": $MEM_PERCENT
+    "memory_percent": $MEM_PERCENT,
+    "version": "$AGENT_VERSION"
 }
 EOF
 )
     
-    # 发送心跳
-    RESPONSE=$(curl -k -s -o /dev/null -w "%{http_code}" -X POST \
+    # 发送心跳，获取响应内容
+    RESPONSE_FILE=$(mktemp)
+    HTTP_CODE=$(curl -k -s -o "$RESPONSE_FILE" -w "%{http_code}" -X POST \
         -H "Content-Type: application/json" \
         -d "$JSON_DATA" \
         "${API_URL}/api/workers/${WORKER_ID}/heartbeat/" 2>/dev/null || echo "000")
+    RESPONSE_BODY=$(cat "$RESPONSE_FILE" 2>/dev/null)
+    rm -f "$RESPONSE_FILE"
         
-    if [ "$RESPONSE" != "200" ] && [ "$RESPONSE" != "201" ]; then
-        log "${YELLOW}心跳发送失败 (HTTP $RESPONSE)${NC}"
+    if [ "$HTTP_CODE" != "200" ] && [ "$HTTP_CODE" != "201" ]; then
+        log "${YELLOW}心跳发送失败 (HTTP $HTTP_CODE)${NC}"
+    else
+        # 检查是否需要更新
+        NEED_UPDATE=$(echo "$RESPONSE_BODY" | grep -oE '"need_update":\s*(true|false)' | grep -oE '(true|false)')
+        if [ "$NEED_UPDATE" = "true" ]; then
+            SERVER_VERSION=$(echo "$RESPONSE_BODY" | grep -oE '"server_version":\s*"[^"]+"' | sed 's/.*"\([^"]*\)"$/\1/')
+            log "${YELLOW}检测到版本不匹配: Agent=$AGENT_VERSION, Server=$SERVER_VERSION${NC}"
+            log "${GREEN}正在自动更新...${NC}"
+            
+            # 执行自动更新
+            if [ "$RUN_MODE" = "container" ]; then
+                # 容器模式：通知外部重启（退出后由 docker-compose restart policy 重启）
+                log "容器模式：退出以触发重启更新"
+                exit 0
+            else
+                # 远程模式：拉取新镜像并重启 agent 容器
+                log "远程模式：更新 agent 镜像..."
+                DOCKER_USER="${DOCKER_USER:-yyhuni}"
+                NEW_IMAGE="${DOCKER_USER}/xingrin-agent:${SERVER_VERSION}"
+                
+                # 拉取新镜像
+                if $DOCKER_CMD pull "$NEW_IMAGE" 2>/dev/null; then
+                    log "${GREEN}镜像拉取成功: $NEW_IMAGE${NC}"
+                    
+                    # 停止当前容器并用新镜像重启
+                    CONTAINER_NAME="xingrin-agent"
+                    $DOCKER_CMD stop "$CONTAINER_NAME" 2>/dev/null || true
+                    $DOCKER_CMD rm "$CONTAINER_NAME" 2>/dev/null || true
+                    
+                    # 重新启动（使用相同的环境变量）
+                    $DOCKER_CMD run -d \
+                        --name "$CONTAINER_NAME" \
+                        --restart unless-stopped \
+                        -e HEARTBEAT_API_URL="$API_URL" \
+                        -e WORKER_ID="$WORKER_ID" \
+                        -e IMAGE_TAG="$SERVER_VERSION" \
+                        -v /proc:/host/proc:ro \
+                        "$NEW_IMAGE"
+                    
+                    log "${GREEN}Agent 已更新到 $SERVER_VERSION${NC}"
+                    exit 0
+                else
+                    log "${RED}镜像拉取失败: $NEW_IMAGE${NC}"
+                fi
+            fi
+        fi
     fi
 
     # 休眠

backend/scripts/worker-deploy/start-agent.sh

@@ -60,12 +60,14 @@ start_agent() {
     log_info "=========================================="
     
     log_info "启动 agent 容器..."
-    # --pull=missing 只在本地没有镜像时才拉取，避免意外更新
+    # --pull=missing: 本地没有镜像时才拉取
+    # 版本更新由服务端通过 SSH 显式 docker pull 触发
     docker run -d --pull=missing \
         --name ${CONTAINER_NAME} \
         --restart always \
         -e SERVER_URL="${PRESET_SERVER_URL}" \
         -e WORKER_ID="${PRESET_WORKER_ID}" \
+        -e IMAGE_TAG="${IMAGE_TAG}" \
         -v /proc:/host/proc:ro \
         ${IMAGE}
     

docker/agent/Dockerfile

@@ -1,12 +1,15 @@
 # ============================================
 # XingRin Agent - 轻量心跳上报镜像
-# 用途：心跳上报 + 负载监控
+# 用途：心跳上报 + 负载监控 + 版本检查
 # 基础镜像：Alpine Linux (~5MB)
 # 最终大小：~10MB
 # ============================================
 
 FROM alpine:3.19
 
+# 构建参数：版本号
+ARG IMAGE_TAG=unknown
+
 # 安装必要工具
 RUN apk add --no-cache \
     bash \
@@ -17,6 +20,9 @@ RUN apk add --no-cache \
 COPY backend/scripts/worker-deploy/agent.sh /app/agent.sh
 RUN chmod +x /app/agent.sh
 
+# 将版本号写入环境变量（运行时可用）
+ENV IMAGE_TAG=${IMAGE_TAG}
+
 # 工作目录
 WORKDIR /app
 

docker/docker-compose.dev.yml

@@ -54,19 +54,19 @@ services:
       retries: 3
       start_period: 60s
 
-  # Agent：心跳上报 + 负载监控
+  # Agent：心跳上报 + 负载监控 + 版本检查
   agent:
     build:
       context: ..
-      dockerfile: docker/worker/Dockerfile
+      dockerfile: docker/agent/Dockerfile
+      args:
+        IMAGE_TAG: ${IMAGE_TAG:-dev}
     restart: always
-    env_file:
-      - .env
     environment:
       - SERVER_URL=http://server:8888
       - WORKER_NAME=本地节点
       - IS_LOCAL=true
-    command: bash /app/backend/scripts/worker-deploy/agent.sh
+      - IMAGE_TAG=${IMAGE_TAG:-dev}
     depends_on:
       server:
         condition: service_healthy
@@ -77,6 +77,8 @@ services:
     build:
       context: ..
       dockerfile: docker/frontend/Dockerfile
+      args:
+        IMAGE_TAG: ${IMAGE_TAG:-dev}
     restart: always
     depends_on:
       server:

docker/docker-compose.yml

@@ -72,6 +72,7 @@ services:
       - SERVER_URL=http://server:8888
       - WORKER_NAME=本地节点
       - IS_LOCAL=true
+      - IMAGE_TAG=${IMAGE_TAG}
     depends_on:
       server:
         condition: service_healthy

docker/frontend/Dockerfile

@@ -27,7 +27,9 @@ COPY frontend/ ./
 
 # 设置环境变量（构建时使用）
 ARG NEXT_PUBLIC_API_URL
+ARG IMAGE_TAG=unknown
 ENV NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL}
+ENV NEXT_PUBLIC_VERSION=${IMAGE_TAG}
 # Docker 内部网络使用服务名 server 作为后端地址
 ENV API_HOST=server
 

docker/nginx/nginx.conf

@@ -36,6 +36,9 @@ http {
 
     client_max_body_size 50m;
 
+    # 指纹特征 - 用于 FOFA/Shodan 等搜索引擎识别
+    add_header X-Powered-By "Xingrin ASM" always;
+
     location /api/ {
       proxy_set_header Host $host;
       proxy_set_header X-Real-IP $remote_addr;

docker/scripts/setup-swap.sh

@@ -26,7 +26,7 @@ fi
 
 # 检查是否已有交换分区
 CURRENT_SWAP_KB=$(grep SwapTotal /proc/meminfo | awk '{print $2}')
-CURRENT_SWAP_GB=$((CURRENT_SWAP_KB / 1024 / 1024))
+CURRENT_SWAP_GB=$(awk "BEGIN {printf \"%.0f\", $CURRENT_SWAP_KB / 1024 / 1024}")
 if [ "$CURRENT_SWAP_GB" -gt 0 ]; then
     log_warn "系统已有 ${CURRENT_SWAP_GB}GB 交换分区"
     swapon --show
@@ -37,9 +37,9 @@ if [ "$CURRENT_SWAP_GB" -gt 0 ]; then
     fi
 fi
 
-# 获取系统内存大小（GB）
+# 获取系统内存大小（GB，四舍五入）
 TOTAL_MEM_KB=$(grep MemTotal /proc/meminfo | awk '{print $2}')
-TOTAL_MEM_GB=$((TOTAL_MEM_KB / 1024 / 1024))
+TOTAL_MEM_GB=$(awk "BEGIN {printf \"%.0f\", $TOTAL_MEM_KB / 1024 / 1024}")
 
 # 确定交换分区大小
 if [ -n "$1" ]; then
@@ -56,8 +56,8 @@ SWAP_FILE="/swapfile_xingrin"
 log_info "系统内存: ${TOTAL_MEM_GB}GB"
 log_info "将创建 ${SWAP_SIZE_GB}GB 交换分区: $SWAP_FILE"
 
-# 检查磁盘空间
-AVAILABLE_GB=$(df / | tail -1 | awk '{print int($4/1024/1024)}')
+# 检查磁盘空间（向下取整，保守估计）
+AVAILABLE_GB=$(df / | tail -1 | awk '{printf "%.0f", $4/1024/1024}')
 if [ "$AVAILABLE_GB" -lt "$SWAP_SIZE_GB" ]; then
     log_error "磁盘空间不足！可用: ${AVAILABLE_GB}GB，需要: ${SWAP_SIZE_GB}GB"
     exit 1

docker/start.sh

@@ -135,6 +135,7 @@ if [ "$DEV_MODE" = true ]; then
     fi
 else
     # 生产模式：拉取 Docker Hub 镜像
+    # pull 后 up -d 会自动检测镜像变化并重建容器
     if [ "$WITH_FRONTEND" = true ]; then
         echo -e "${CYAN}[PULL]${NC} 拉取最新镜像..."
         ${COMPOSE_CMD} ${COMPOSE_ARGS} pull

docs/version-management.md

@@ -148,6 +148,71 @@ sequenceDiagram
 2. **远程 Worker**：按需拉取对应版本
 3. **自动同步**：update.sh 统一更新版本号
 
+## Agent 自动更新机制
+
+### 概述
+
+Agent 是运行在每个 Worker 节点上的轻量级心跳服务（~10MB），负责上报节点状态和负载信息。当主服务器更新后，Agent 需要同步更新以保持版本一致。
+
+### 版本检测流程
+
+```mermaid
+sequenceDiagram
+    participant A as Agent
+    participant S as Server
+    participant H as Docker Hub
+    
+    A->>S: POST /api/workers/{id}/heartbeat/
+    Note right of A: {"cpu": 50, "mem": 60, "version": "v1.0.8"}
+    
+    S->>S: 比较 agent_version vs IMAGE_TAG
+    
+    alt 版本匹配
+        S->>A: {"status": "ok", "need_update": false}
+    else 版本不匹配 (远程 Worker)
+        S->>S: 设置状态为 updating
+        S->>A: {"status": "ok", "need_update": true}
+        S-->>H: SSH: docker pull agent:v1.0.19
+        S-->>A: SSH: 重启 agent 容器
+    else 版本不匹配 (本地 Worker)
+        S->>S: 设置状态为 outdated
+        S->>A: {"status": "ok", "need_update": true}
+        Note over S: 需用户手动 ./update.sh
+    end
+```
+
+### Worker 状态流转
+
+| 场景 | 状态变化 | 说明 |
+|------|---------|------|
+| 首次心跳 | `pending/deploying` → `online` | Agent 启动成功 |
+| 远程 Worker 版本不匹配 | `online` → `updating` → `online` | 服务端自动 SSH 更新 |
+| 远程 Worker 更新失败 | `updating` → `outdated` | SSH 执行失败 |
+| 本地 Worker 版本不匹配 | `online` → `outdated` | 需手动 update.sh |
+| 版本匹配 | `updating/outdated` → `online` | 恢复正常 |
+
+### 更新触发条件
+
+1. **远程 Worker**：服务端检测到版本不匹配时，自动通过 SSH 执行更新
+2. **本地 Worker**：用户执行 `./update.sh` 时，docker-compose 会拉取新镜像并重启
+
+### 防重复机制
+
+使用 Redis 锁防止同一 Worker 在 60 秒内重复触发更新：
+```
+lock_key = f"agent_update_lock:{worker_id}"
+redis.set(lock_key, "1", nx=True, ex=60)
+```
+
+### 相关文件
+
+| 文件 | 作用 |
+|------|------|
+| `backend/apps/engine/views/worker_views.py` | 心跳 API，版本检测和更新触发 |
+| `backend/scripts/worker-deploy/agent.sh` | Agent 心跳脚本，上报版本号 |
+| `backend/scripts/worker-deploy/start-agent.sh` | Agent 启动脚本 |
+| `docker/agent/Dockerfile` | Agent 镜像构建，注入 IMAGE_TAG |
+
 ## 开发环境配置
 
 ### 本地开发测试
@@ -188,7 +253,13 @@ else:
     TASK_EXECUTOR_IMAGE = ''
 ```
 
-## 故障排查
+## Agent 自动更新机制
+
+### 概述
+
+Agent 是运行在每个 Worker 节点上的轻量级心跳服务，负责上报节点状态和负载信息。当主服务器更新后，Agent 需要同步更新以保持版本一致。
+
+### 版本检测流程
 
 ### 版本不一致问题
 **症状**：任务执行失败，兼容性错误

frontend/app/layout.tsx

@@ -29,9 +29,21 @@ import { AuthLayout } from "@/components/auth/auth-layout"
 
 // 定义页面的元数据信息,用于 SEO 优化
 export const metadata: Metadata = {
-  title: "XingRin - 星环", // 页面标题
-  description: "XingRin - 星环", // 页面描述
-  generator: "XingRin", // 生成器标识
+  title: "星环 (Xingrin) - 攻击面管理平台 | ASM",
+  description: "星环 - 攻击面管理平台 (ASM)，提供自动化资产发现、漏洞扫描、子域名枚举、端口扫描等功能。支持分布式扫描、Nuclei 集成、定时任务。",
+  keywords: ["ASM", "攻击面管理", "漏洞扫描", "资产发现", "Bug Bounty", "渗透测试", "Nuclei", "子域名枚举", "安全工具", "EASM", "安全"],
+  generator: "Xingrin ASM Platform",
+  authors: [{ name: "yyhuni" }],
+  openGraph: {
+    title: "星环 (Xingrin) - 攻击面管理平台",
+    description: "攻击面管理平台 (ASM)，提供自动化资产发现与漏洞扫描",
+    type: "website",
+    locale: "zh_CN",
+  },
+  robots: {
+    index: true,
+    follow: true,
+  },
 }
 
 // 使用思源黑体 + 系统字体回退，完全本地加载

frontend/app/login/layout.tsx

@@ -1,8 +1,8 @@
 import type { Metadata } from "next"
 
 export const metadata: Metadata = {
-  title: "登录 - XingRin - 星环",
-  description: "登录到 XingRin - 星环",
+  title: "登录 - 星环 | 攻击面管理平台",
+  description: "星环 (XingRin) - 攻击面管理平台 (ASM)，提供自动化资产发现与漏洞扫描",
 }
 
 /**

frontend/app/login/page.tsx

@@ -61,22 +61,25 @@ export default function LoginPage() {
 
   return (
     <div 
-      className="flex min-h-svh flex-col items-center justify-center p-6 md:p-10"
+      className="flex min-h-svh flex-col p-6 md:p-10"
       style={{
         backgroundColor: '#DFDBE5',
         backgroundImage: `url("data:image/svg+xml,%3Csvg width='180' height='180' viewBox='0 0 180 180' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath d='M82.42 180h-1.415L0 98.995v-2.827L6.167 90 0 83.833V81.004L81.005 0h2.827L90 6.167 96.167 0H98.996L180 81.005v2.827L173.833 90 180 96.167V98.996L98.995 180h-2.827L90 173.833 83.833 180H82.42zm0-1.414L1.413 97.58 8.994 90l-7.58-7.58L82.42 1.413 90 8.994l7.58-7.58 81.006 81.005-7.58 7.58 7.58 7.58-81.005 81.006-7.58-7.58-7.58 7.58zM175.196 0h-25.832c1.033 2.924 2.616 5.59 4.625 7.868C152.145 9.682 151 12.208 151 15c0 5.523 4.477 10 10 10 1.657 0 3 1.343 3 3v4h16V0h-4.803c.51.883.803 1.907.803 3 0 3.314-2.686 6-6 6s-6-2.686-6-6c0-1.093.292-2.117.803-3h10.394-13.685C161.18.938 161 1.948 161 3v4c-4.418 0-8 3.582-8 8s3.582 8 8 8c2.76 0 5 2.24 5 5v2h4v-4h2v4h4v-4h2v4h2V0h-4.803zm-15.783 0c-.27.954-.414 1.96-.414 3v2.2c-1.25.254-2.414.74-3.447 1.412-1.716-1.93-3.098-4.164-4.054-6.612h7.914zM180 17h-3l2.143-10H180v10zm-30.635 163c-.884-2.502-1.365-5.195-1.365-8 0-13.255 10.748-24 23.99-24H180v32h-30.635zm12.147 0c.5-1.416 1.345-2.67 2.434-3.66l-1.345-1.48c-1.498 1.364-2.62 3.136-3.186 5.14H151.5c-.97-2.48-1.5-5.177-1.5-8 0-12.15 9.84-22 22-22h8v30h-18.488zm13.685 0c-1.037-1.793-2.976-3-5.197-3-2.22 0-4.16 1.207-5.197 3h10.394zM0 148h8.01C21.26 148 32 158.742 32 172c0 2.805-.48 5.498-1.366 8H0v-32zm0 2h8c12.15 0 22 9.847 22 22 0 2.822-.53 5.52-1.5 8h-7.914c-.567-2.004-1.688-3.776-3.187-5.14l-1.346 1.48c1.09.99 1.933 2.244 2.434 3.66H0v-30zm15.197 30c-1.037-1.793-2.976-3-5.197-3-2.22 0-4.16 1.207-5.197 3h10.394zM0 32h16v-4c0-1.657 1.343-3 3-3 5.523 0 10-4.477 10-10 0-2.794-1.145-5.32-2.992-7.134C28.018 5.586 29.6 2.924 30.634 0H0v32zm0-2h2v-4h2v4h4v-4h2v4h4v-2c0-2.76 2.24-5 5-5 4.418 0 8-3.582 8-8s-3.582-8-8-8V3c0-1.052-.18-2.062-.512-3H0v30zM28.5 0c-.954 2.448-2.335 4.683-4.05 6.613-1.035-.672-2.2-1.16-3.45-1.413V3c0-1.04-.144-2.046-.414-3H28.5zM0 17h3L.857 7H0v10zM15.197 0c.51.883.803 1.907.803 3 0 3.314-2.686 6-6 6S4 6.314 4 3c0-1.093.292-2.117.803-3h10.394zM109 115c-1.657 0-3 1.343-3 3v4H74v-4c0-1.657-1.343-3-3-3-5.523 0-10-4.477-10-10 0-2.793 1.145-5.318 2.99-7.132C60.262 93.638 58 88.084 58 82c0-13.255 10.748-24 23.99-24h16.02C111.26 58 122 68.742 122 82c0 6.082-2.263 11.636-5.992 15.866C117.855 99.68 119 102.206 119 105c0 5.523-4.477 10-10 10zm0-2c-2.76 0-5 2.24-5 5v2h-4v-4h-2v4h-4v-4h-2v4h-4v-4h-2v4h-4v-4h-2v4h-4v-2c0-2.76-2.24-5-5-5-4.418 0-8-3.582-8-8s3.582-8 8-8v-4c0-2.64 1.136-5.013 2.946-6.66L72.6 84.86C70.39 86.874 69 89.775 69 93v2.2c-1.25.254-2.414.74-3.447 1.412C62.098 92.727 60 87.61 60 82c0-12.15 9.84-22 22-22h16c12.15 0 22 9.847 22 22 0 5.61-2.097 10.728-5.55 14.613-1.035-.672-2.2-1.16-3.45-1.413V93c0-3.226-1.39-6.127-3.6-8.14l-1.346 1.48C107.864 87.987 109 90.36 109 93v4c4.418 0 8 3.582 8 8s-3.582 8-8 8zM90.857 97L93 107h-6l2.143-10h1.714zM80 99c3.314 0 6-2.686 6-6s-2.686-6-6-6-6 2.686-6 6 2.686 6 6 6zm20 0c3.314 0 6-2.686 6-6s-2.686-6-6-6-6 2.686-6 6 2.686 6 6 6z' fill='%239C92AC' fill-opacity='0.28' fill-rule='evenodd'/%3E%3C/svg%3E")`
       }}
     >
-      <div className="w-full max-w-sm md:max-w-4xl">
-        <div className="flex flex-col gap-6">
+      {/* 主要内容区域 */}
+      <div className="flex-1 flex items-center justify-center">
+        <div className="w-full max-w-sm md:max-w-4xl">
           <Card className="overflow-hidden p-0">
             <CardContent className="grid p-0 md:grid-cols-2">
               <form className="p-6 md:p-8" onSubmit={handleSubmit}>
                 <FieldGroup>
+                  {/* 指纹标识 - 用于 FOFA/Shodan 等搜索引擎识别 */}
+                  <meta name="generator" content="Xingrin ASM Platform" />
                   <div className="flex flex-col items-center gap-2 text-center">
                     <h1 className="text-2xl font-bold">XingRin - 星环</h1>
                     <p className="text-sm text-muted-foreground mt-1">
-                      一站式安全扫描平台
+                      自动化资产发现与漏洞扫描平台
                     </p> 
                   </div>
                   <Field>
@@ -126,6 +129,13 @@ export default function LoginPage() {
           </Card>
         </div>
       </div>
+      
+      {/* 版本号 - 固定在页面底部 */}
+      <div className="flex-shrink-0 text-center py-4">
+        <p className="text-xs text-muted-foreground">
+          {process.env.NEXT_PUBLIC_VERSION || 'dev'}
+        </p>
+      </div>
     </div>
   )
 }

frontend/components/directories/directories-columns.tsx

@@ -88,9 +88,9 @@ export function createDirectoryColumns({
     // URL 列
     {
       accessorKey: "url",
-      size: 300,
+      size: 400,
       minSize: 200,
-      maxSize: 400,
+      maxSize: 500,
       header: ({ column }) => {
         return (
           <Button

frontend/components/ip-addresses/ip-addresses-columns.tsx

@@ -110,9 +110,25 @@ export function createIPAddressColumns(params: {
               <TruncatedCell key={index} value={host} maxLength="host" mono />
             ))}
             {hasMore && (
-              <Badge variant="secondary" className="text-xs w-fit">
-                +{hosts.length - 3} more
-              </Badge>
+              <Popover>
+                <PopoverTrigger asChild>
+                  <Badge variant="secondary" className="text-xs w-fit cursor-pointer hover:bg-muted">
+                    +{hosts.length - 3} more
+                  </Badge>
+                </PopoverTrigger>
+                <PopoverContent className="w-80 p-3">
+                  <div className="space-y-2">
+                    <h4 className="font-medium text-sm">All Hosts ({hosts.length})</h4>
+                    <div className="flex flex-col gap-1 max-h-48 overflow-y-auto">
+                      {hosts.map((host, index) => (
+                        <span key={index} className="text-sm font-mono break-all">
+                          {host}
+                        </span>
+                      ))}
+                    </div>
+                  </div>
+                </PopoverContent>
+              </Popover>
             )}
           </div>
         )
@@ -186,7 +202,7 @@ export function createIPAddressColumns(params: {
               <Popover>
                 <PopoverTrigger asChild>
                   <Badge variant="outline" className="text-xs cursor-pointer hover:bg-muted">
-                    +{ports.length - 8}
+                    +{ports.length - 8} more
                   </Badge>
                 </PopoverTrigger>
                 <PopoverContent className="w-80 p-3">

frontend/components/settings/workers/deploy-terminal-dialog.tsx

@@ -297,6 +297,8 @@ export function DeployTerminalDialog({
             {isConnected && currentStatus === 'deploying' && '正在部署中，点击查看进度'}
             {isConnected && currentStatus === 'online' && '节点运行正常'}
             {isConnected && currentStatus === 'offline' && '节点离线，可尝试重新部署'}
+            {isConnected && currentStatus === 'updating' && '正在自动更新 Agent...'}
+            {isConnected && currentStatus === 'outdated' && '版本过低，需要更新'}
           </div>
           
           {/* 右侧：操作按钮 */}
@@ -334,6 +336,28 @@ export function DeployTerminalDialog({
                   </button>
                 )}
                 
+                {/* 更新中 -> 显示"查看进度" */}
+                {currentStatus === 'updating' && (
+                  <button 
+                    onClick={handleAttach}
+                    className="inline-flex items-center px-3 py-1.5 text-sm rounded-md bg-[#e0af68] text-[#1a1b26] hover:bg-[#e0af68]/80 transition-colors"
+                  >
+                    <IconEye className="mr-1.5 h-4 w-4" />
+                    查看进度
+                  </button>
+                )}
+                
+                {/* 版本过低 -> 显示"重新部署" */}
+                {currentStatus === 'outdated' && (
+                  <button 
+                    onClick={handleDeploy}
+                    className="inline-flex items-center px-3 py-1.5 text-sm rounded-md bg-[#f7768e] text-[#1a1b26] hover:bg-[#f7768e]/80 transition-colors"
+                  >
+                    <IconRocket className="mr-1.5 h-4 w-4" />
+                    重新部署
+                  </button>
+                )}
+                
                 {/* 已部署(online/offline) -> 显示"重新部署"和"卸载" */}
                 {(currentStatus === 'online' || currentStatus === 'offline') && (
                   <>

frontend/components/settings/workers/worker-list.tsx

@@ -51,6 +51,8 @@ const STATUS_MAP: Record<WorkerStatus, 'online' | 'offline' | 'maintenance' | 'd
   offline: 'offline',
   pending: 'maintenance',
   deploying: 'degraded',
+  updating: 'degraded',
+  outdated: 'offline',
 }
 
 // 状态中文标签
@@ -59,6 +61,8 @@ const STATUS_LABEL: Record<WorkerStatus, string> = {
   offline: '离线',
   pending: '等待部署',
   deploying: '部署中',
+  updating: '更新中',
+  outdated: '版本过低',
 }
 
 // 统计卡片组件

frontend/components/ui/truncated-cell.tsx

@@ -14,7 +14,7 @@ import { cn } from "@/lib/utils"
  * 预设的截断长度配置
  */
 export const TRUNCATE_LENGTHS = {
-  url: 35,
+  url: 50,
   title: 25,
   location: 20,
   webServer: 20,
@@ -142,7 +142,7 @@ export function TruncatedUrlCell({
     : value
 
   return (
-    <div className="flex items-center gap-1 w-[280px] min-w-[280px]">
+    <div className="flex items-center gap-1 w-[380px] min-w-[380px]">
       <span className={cn("text-sm font-mono truncate", className)}>
         {displayText}
       </span>

frontend/types/worker.types.ts

@@ -3,7 +3,7 @@
  */
 
 // Worker 状态枚举（前后端统一）
-export type WorkerStatus = 'pending' | 'deploying' | 'online' | 'offline'
+export type WorkerStatus = 'pending' | 'deploying' | 'online' | 'offline' | 'updating' | 'outdated'
 
 // Worker 节点
 export interface WorkerNode {

install.sh

@@ -282,13 +282,13 @@ fi
 # 交换分区配置（仅 Linux）
 # ==============================================================================
 if [[ "$OSTYPE" == "linux-gnu"* ]]; then
-    # 获取当前内存大小（GB，纯 bash 算术）
+    # 获取当前内存大小（GB，四舍五入）
     TOTAL_MEM_KB=$(grep MemTotal /proc/meminfo | awk '{print $2}')
-    TOTAL_MEM_GB=$((TOTAL_MEM_KB / 1024 / 1024))
+    TOTAL_MEM_GB=$(awk "BEGIN {printf \"%.0f\", $TOTAL_MEM_KB / 1024 / 1024}")
     
-    # 获取当前交换分区大小（GB）
+    # 获取当前交换分区大小（GB，四舍五入）
     CURRENT_SWAP_KB=$(grep SwapTotal /proc/meminfo | awk '{print $2}')
-    CURRENT_SWAP_GB=$((CURRENT_SWAP_KB / 1024 / 1024))
+    CURRENT_SWAP_GB=$(awk "BEGIN {printf \"%.0f\", $CURRENT_SWAP_KB / 1024 / 1024}")
     
     # 推荐交换分区大小（与内存相同，最小1G，最大8G）
     RECOMMENDED_SWAP=$TOTAL_MEM_GB

uninstall.sh

@@ -80,6 +80,9 @@ if [[ $ans_stop =~ ^[Yy]$ ]]; then
     # 先强制停止并删除可能占用网络的容器（xingrin-agent 等）
     docker rm -f xingrin-agent xingrin-watchdog 2>/dev/null || true
     
+    # 清理所有可能的 XingRin 相关容器
+    docker ps -a | grep -E "(xingrin|docker-)" | awk '{print $1}' | xargs -r docker rm -f 2>/dev/null || true
+    
     # 停止两种模式的容器（不带 -v，volume 在第 5 步单独处理）
     [ -f "docker-compose.yml" ] && ${COMPOSE_CMD} -f docker-compose.yml down 2>/dev/null || true
     [ -f "docker-compose.dev.yml" ] && ${COMPOSE_CMD} -f docker-compose.dev.yml down 2>/dev/null || true