fix(deps): update module github.com/protonmail/gopenpgp/v2 to v3

fix(drivers/189pc): align login with the official PC client (#3105 )
QR code scans were authorized on the phone but the storage stayed stuck on the QR page, and token-only setups failed with "params is null". The driver used appId 8025431004 while the official PC client uses 9317140619. Tokens, sessions and QR sessions are all scoped to an appId, so the mismatch meant the QR poll never saw status:0 and an accessToken could not be exchanged for a sessionSecret. - Use appId 9317140619 and version 7.2.4.0. QR state polling uses clientType=1; password login keeps 10020. - Send the QR poll parameters the official client sends (cb_SaveName, isOauth2, state, user-finger header, logbox Referer) and poll locally instead of only checking once per save. - Parse lt/reqId from the logbox redirect and paramId from appConf.do. The new login page no longer embeds them as inline variables; the old inline format is still supported. - Implement the -133 second device verification via sendSmsCodeForSecondAuth/submitForSecondAuth. That endpoint has no dedicated SMS field: the code goes into epd, encrypted with the same public key used for the password. Persist the DEVICEID cookie so the verification only happens once. - Detect refreshToken.do failures. It reports them as HTTP 200 with a result field, so SetError never fired and a failed refresh was treated as success, surfacing later as a misleading "params is null". - username/password are no longer required, so token-only storages save without placeholders. clientSn/jgOpenId are optional and only sent when configured; user-finger is generated once per storage. - Return named errors instead of panicking when the login page changes shape. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-10-10 21:13:10 +08:00 · 2026-10-05 18:40:29 +00:00 · 2026-10-03 15:45:29 +08:00 · 2026-10-03 14:50:51 +08:00 · 2026-09-29 19:05:50 +08:00 · 2026-09-24 19:25:29 +08:00
364 changed files with 28357 additions and 6908 deletions
@@ -82,3 +82,17 @@ body:
      label: 复现链接（可选）
      description: |
        请提供能复现此问题的链接。
+  - type: checkboxes
+    id: aigenerated
+    attributes:
+      label: AI生成内容
+      description: 必须且只能勾选一项，请勿删除或修改声明文字。
+      options:
+        - label: 我使用了AI工具生成此内容
+        - label: 我没有使用AI工具生成此内容
+  - type: input
+    id: ai-model
+    attributes:
+      label: AI模型是
+      description: 如果使用了AI工具，请填写模型名称；未使用则留空。
+      placeholder: xxx
@@ -82,3 +82,17 @@ body:
      label: Reproduction Link (optional)
      description: |
        Please provide a link to a repo or page that can reproduce this issue.
+  - type: checkboxes
+    id: aigenerated
+    attributes:
+      label: AI Generated Content
+      description: Select exactly one option. Do not delete or modify the disclosure text.
+      options:
+        - label: I used AI tools to generate this content
+        - label: I did not use AI tools to generate this content
+  - type: input
+    id: ai-model
+    attributes:
+      label: AI model used
+      description: If you used AI tools, enter the model name; otherwise leave this blank.
+      placeholder: xxx
@@ -48,3 +48,17 @@ body:
      label: 附加信息
      description: |
        相关的任何其他上下文或截图，或者你觉得有帮助的信息
+  - type: checkboxes
+    id: aigenerated
+    attributes:
+      label: AI生成内容
+      description: 必须且只能勾选一项，请勿删除或修改声明文字。
+      options:
+        - label: 我使用了AI工具生成此内容
+        - label: 我没有使用AI工具生成此内容
+  - type: input
+    id: ai-model
+    attributes:
+      label: AI模型是
+      description: 如果使用了AI工具，请填写模型名称；未使用则留空。
+      placeholder: xxx
@@ -48,3 +48,17 @@ body:
      label: Additional Information
      description: |
        Any other context or screenshots related to this feature request, or information you find helpful.
+  - type: checkboxes
+    id: aigenerated
+    attributes:
+      label: AI Generated Content
+      description: Select exactly one option. Do not delete or modify the disclosure text.
+      options:
+        - label: I used AI tools to generate this content
+        - label: I did not use AI tools to generate this content
+  - type: input
+    id: ai-model
+    attributes:
+      label: AI model used
+      description: If you used AI tools, enter the model name; otherwise leave this blank.
+      placeholder: xxx
@@ -1,58 +1,114 @@
 <!--
-  Provide a general summary of your changes in the Title above.
-  The PR title must start with `feat(): `, `docs(): `, `fix(): `, `style(): `, or `refactor(): `, `chore(): `. For example: `feat(component): add new feature`.
-  If it spans multiple components, use the main component as the prefix and enumerate in the title, describe in the body.
-  For breaking changes, add `!` after the type, e.g., `feat(component)!: breaking change`.
-->
-<!--
-  在上方标题中提供您更改的总体摘要。
-  PR 标题需以 `feat(): `, `docs(): `, `fix(): `, `style(): `, `refactor(): `, `chore(): ` 其中之一开头，例如：`feat(component): 新增功能`。
-  如果跨多个组件，请使用主要组件作为前缀，并在标题中枚举、描述中说明。
-  如果是破坏性变更，请在类型后添加 `!`，例如 `feat(component)!: 破坏性变更`。
+PR title / PR 标题:
+- Use Conventional Commits: `type(scope): summary`
+- Allowed types: `feat`, `docs`, `fix`, `style`, `refactor`, `chore`
+- Scope is required by the current PR title check.
+- For breaking changes, add `!`: `feat(driver)!: change auth flow`
 -->

-## Description / 描述
+## Summary / 摘要

-<!-- Describe your changes in detail -->
-<!-- 详细描述您的更改 -->
+<!--
+Briefly describe what changed and why.
+简要说明改了什么，以及为什么需要改。
+-->

-## Motivation and Context / 背景
+<!--
+- List user-visible behavior changes.
+- List important implementation changes.
+- Mention config, storage, API, or compatibility changes if any.

-<!-- Why is this change required? What problem does it solve? -->
-<!-- 为什么需要此更改？它解决了什么问题？ -->
+- 列出用户可感知的行为变化。
+- 列出重要实现变化。
+- 如涉及配置、存储、API 或兼容性变化，请明确说明。
+-->

-<!-- If it fixes an open issue, please link to the issue here. -->
-<!-- 如果修复了一个打开的issue，请在此处链接到该issue -->
+- [ ] This PR has breaking changes.
+      / 此 PR 包含破坏性变更。
+- [ ] This PR changes public API, config, storage format, or migration behavior.
+      / 此 PR 修改了公开 API、配置、存储格式或迁移行为。
+- [ ] This PR requires corresponding changes in related repositories.
+      / 此 PR 需要关联仓库同步修改。

-Closes #XXXX
+Related repository PRs / 关联仓库 PR:

-<!-- or -->
-<!-- 或者 -->
+- OpenList-Frontend:
+- OpenList-Docs:

-Relates to #XXXX
+## Related Issues / 关联 Issue

-## How Has This Been Tested? / 测试
+<!--
+Use `Closes #123`, `Fixes #123`, or `Relates to #123`.
+Remove this section if not applicable.
+使用 `Closes #123`、`Fixes #123` 或 `Relates to #123`。
+不适用时请删除本节。
+-->

-<!-- Please describe in detail how you tested your changes. -->
-<!-- 请详细描述您如何测试更改 -->
+## Testing / 测试
+
+<!--
+Describe commands, platforms, and manual checks.
+If not tested, explain why.
+
+说明执行过的命令、测试平台和手动验证。
+如果未测试，请说明原因。
+-->
+
+- [ ] `go test ./...`
+- [ ] Manual test / 手动测试:

 ## Checklist / 检查清单

-<!-- Go over all the following points, and put an `x` in all the boxes that apply. -->
-<!-- 检查以下所有要点，并在所有适用的框中打`x` -->
+- [ ] I have read [CONTRIBUTING](https://github.com/OpenListTeam/OpenList/blob/main/CONTRIBUTING.md).
+      / 我已阅读 [CONTRIBUTING](https://github.com/OpenListTeam/OpenList/blob/main/CONTRIBUTING.md)。
+- [ ] I confirm this contribution follows the repository license, contribution policy, and code of conduct.
+      / 我确认此贡献符合仓库许可证、贡献规范和行为准则。
+- [ ] I have formatted the changed code with `gofmt`, `go fmt`, or `prettier` where applicable.
+      / 我已按适用情况使用 `gofmt`、`go fmt` 或 `prettier` 格式化变更代码。
+- [ ] I have requested review from relevant maintainers or code owners where applicable.
+      / 我已在适用情况下请求相关维护者或代码所有者审查。

-<!-- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->
-<!-- 如果您对其中任何一项不确定，请不要犹豫提问。我们会帮助您！ -->
+## AI Disclosure / AI 使用声明

- [ ] I have read the [CONTRIBUTING](https://github.com/OpenListTeam/OpenList/blob/main/CONTRIBUTING.md) document.
-      我已阅读 [CONTRIBUTING](https://github.com/OpenListTeam/OpenList/blob/main/CONTRIBUTING.md) 文档。
- [ ] I have formatted my code with `go fmt` or [prettier](https://prettier.io/).
-      我已使用 `go fmt` 或 [prettier](https://prettier.io/) 格式化提交的代码。
- [ ] I have added appropriate labels to this PR (or mentioned needed labels in the description if lacking permissions).
-      我已为此 PR 添加了适当的标签（如无权限或需要的标签不存在，请在描述中说明，管理员将后续处理）。
- [ ] I have requested review from relevant code authors using the "Request review" feature when applicable.
-      我已在适当情况下使用"Request review"功能请求相关代码作者进行审查。
- [ ] I have updated the repository accordingly (If it’s needed).
-      我已相应更新了相关仓库（若适用）。
-  - [ ] [OpenList-Frontend](https://github.com/OpenListTeam/OpenList-Frontend) #XXXX
-  - [ ] [OpenList-Docs](https://github.com/OpenListTeam/OpenList-Docs) #XXXX
+<!--
+Please disclose any substantial AI assistance used in this PR.
+Minor AI assistance, such as typo fixes, autocomplete, formatting suggestions,
+or wording polish, does not need to be disclosed.
+Remove this section if not applicable.
+
+请披露此 PR 中使用的重要 AI 辅助内容。
+轻微 AI 辅助，例如拼写修正、自动补全、格式建议或文字润色，无需披露。
+如不适用，请删除本节。
+
+Deliberate non-disclosure may be treated as a trust and compliance issue.
+
+故意隐瞒 AI 使用情况可能被视为信任与合规问题。
+-->
+
+- [ ] This PR includes AI-assisted content.
+      / 此 PR 包含 AI 辅助内容。
+
+Tools used / 使用工具:
+
+- [ ] ChatGPT
+- [ ] Codex
+- [ ] GitHub Copilot
+- [ ] Claude
+- [ ] Gemini
+- [ ] Other (please specify) / 其他（请注明）:
+
+Usage scope / 使用范围:
+
+- [ ] Code generation / 代码生成
+- [ ] Refactoring / 重构
+- [ ] Documentation / 文档
+- [ ] Tests / 测试
+- [ ] Translation / 翻译
+- [ ] Review assistance / 审查辅助
+
+- [ ] I have reviewed and validated all AI-assisted content included in this PR.
+      / 我已审核并验证此 PR 中的所有 AI 辅助内容。
+- [ ] I have ensured that all AI-assisted commits include `Co-Authored-By` attribution.
+      / 我已确保所有 AI 辅助提交都包含 `Co-Authored-By` 归属信息。
+- [ ] I can reproduce all AI-assisted content included in this PR without any AI tools.
+      / 我可以在没有任何 AI 工具的情况下重现此 PR 中包含的所有 AI 辅助内容。
@@ -18,13 +18,13 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0

      - name: Create or update ref
        id: create-or-update-ref
-        uses: ovsds/create-or-update-ref-action@v1
+        uses: ovsds/create-or-update-ref-action@1157b2991820188d5a8e6f22656775d1d171f762 # v1
        with:
          ref: tags/beta
          sha: ${{ github.sha }}
@@ -40,15 +40,18 @@ jobs:
          npx changelogithub --output CHANGELOG.md

      - name: Upload assets to beta release
-        uses: softprops/action-gh-release@v2
-        with:
-          body_path: CHANGELOG.md
-          files: CHANGELOG.md
-          prerelease: true
-          tag_name: beta
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if ! gh release view beta; then
+            gh release create beta --prerelease --notes-file CHANGELOG.md
+          else
+            gh release edit beta --prerelease --notes-file CHANGELOG.md
+          fi
+          gh release upload beta "CHANGELOG.md" --clobber

      - name: Upload assets to github artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: beta changelog
          path: ${{ github.workspace }}/CHANGELOG.md
@@ -105,14 +108,14 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0

      - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
-          go-version: "1.25.0"
+          go-version: "1.27.1"

      - name: Setup web
        run: bash build.sh dev web
@@ -121,7 +124,7 @@ jobs:
          FRONTEND_REPO: ${{ vars.FRONTEND_REPO }}

      - name: Build
-        uses: OpenListTeam/cgo-actions@v1.2.2
+        uses: OpenListTeam/cgo-actions@d760a8ec1a6be1f8ec181229e11cb2671797f9e0 # v1.3.0
        with:
          targets: ${{ matrix.target }}
          flags: ${{ matrix.flags || '-ldflags=' }}
@@ -133,7 +136,7 @@ jobs:
          musl-base-url: "https://github.com/OpenListTeam/musl-compilers/releases/latest/download/"
          x-flags: |
            github.com/OpenListTeam/OpenList/v4/internal/conf.BuiltAt=$built_at
-            github.com/OpenListTeam/OpenList/v4/internal/conf.GitAuthor=The OpenList Projects Contributors <noreply@openlist.team>
+            github.com/OpenListTeam/OpenList/v4/internal/conf.GitAuthor=The OpenList Projects Contributors <noreply@oplist.org>
            github.com/OpenListTeam/OpenList/v4/internal/conf.GitCommit=$git_commit
            github.com/OpenListTeam/OpenList/v4/internal/conf.Version=$tag
            github.com/OpenListTeam/OpenList/v4/internal/conf.WebVersion=rolling
@@ -164,13 +167,13 @@ jobs:
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

-      # See above
      - name: Upload assets to beta release
-        uses: softprops/action-gh-release@v2
-        with:
-          files: build/compress/*
-          prerelease: true
-          tag_name: beta
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          for file in build/compress/*; do
+            gh release upload beta "$file" --clobber
+          done

      - name: Clean illegal characters from matrix.target
        id: clean_target_name
@@ -182,7 +185,7 @@ jobs:
          echo "cleaned_target=$CLEANED_TARGET" >> $GITHUB_ENV

      - name: Upload assets to github artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: beta builds for ${{ env.cleaned_target }}
          path: ${{ github.workspace }}/build/compress/*
@@ -25,15 +25,15 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

-      - uses: benjlevesque/short-sha@v3.0
+      - uses: benjlevesque/short-sha@dbe07338b37c456ce06d23409b35a56a7815eef4 # v4.0
        id: short-sha

      - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
-          go-version: "1.25.0"
+          go-version: "1.27.1"

      - name: Setup web
        run: bash build.sh dev web
@@ -42,7 +42,7 @@ jobs:
          FRONTEND_REPO: ${{ vars.FRONTEND_REPO }}

      - name: Build
-        uses: OpenListTeam/cgo-actions@v1.2.2
+        uses: OpenListTeam/cgo-actions@d760a8ec1a6be1f8ec181229e11cb2671797f9e0 # v1.3.0
        with:
          targets: ${{ matrix.target }}
          flags: ${{ contains(matrix.target, '-musl') && '-ldflags=-linkmode external -extldflags ''-static -fpic''' || '-ldflags=' }}
@@ -52,7 +52,7 @@ jobs:
          out-dir: build
          x-flags: |
            github.com/OpenListTeam/OpenList/v4/internal/conf.BuiltAt=$built_at
-            github.com/OpenListTeam/OpenList/v4/internal/conf.GitAuthor=The OpenList Projects Contributors <noreply@openlist.team>
+            github.com/OpenListTeam/OpenList/v4/internal/conf.GitAuthor=The OpenList Projects Contributors <noreply@oplist.org>
            github.com/OpenListTeam/OpenList/v4/internal/conf.GitCommit=$git_commit
            github.com/OpenListTeam/OpenList/v4/internal/conf.Version=$tag
            github.com/OpenListTeam/OpenList/v4/internal/conf.WebVersion=rolling
@@ -69,7 +69,7 @@ jobs:
          fi

      - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: openlist_${{ steps.short-sha.outputs.sha }}_${{ matrix.target }}
          path: build/*
@@ -14,7 +14,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0

@@ -0,0 +1,215 @@
+name: Container Registry Cleanup
+
+permissions:
+  contents: read
+  packages: write
+
+on:
+  workflow_dispatch:
+    inputs:
+      package:
+        description: 'The name of the package to clean up'
+        required: true
+        default: 'openlist-git'
+      owner:
+        description: 'The owner of the package (user or organization)'
+        required: false
+        default: 'openlistteam'
+      older_than:
+        description: 'Delete untagged images older than this many days'
+        required: false
+        default: '-1'
+      untagged_timestamp_tolerance:
+        description: 'Tolerance in milliseconds for untagged images close to tagged ones'
+        required: false
+        # We do this because multi-arch docker containers will be pushed as separate untagged images 
+        # to the container registry and GitHub cannot recognize them as part of a tagged image. 
+        # Setting this option large enough prevents accidental deletion of one of these images.
+        # Here we set it to 10 seconds
+        default: '10000'
+      token:
+        description: 'GitHub token with permissions to delete packages (leave empty to use default GITHUB_TOKEN)'
+        required: false
+        default: ''
+
+jobs:
+  cleanup:
+    runs-on: ubuntu-slim 
+    
+    steps:
+      - name: Check inputs and tools
+        id: setup
+        shell: bash
+        run: |
+          PACKAGE="${{ github.event.inputs.package || 'openlist-git' }}"
+          OLDER="${{ github.event.inputs.older_than || '-1' }}"
+          TOLERANCE_VAL="${{ github.event.inputs.untagged_timestamp_tolerance || '10000' }}"
+          TOKEN_INPUT="${{ github.event.inputs.token || '' }}"
+          OWNER="${{ github.event.inputs.owner || 'openlistteam' }}"
+
+          echo "package_name=$PACKAGE" >> "$GITHUB_OUTPUT"
+          echo "older_than=$OLDER" >> "$GITHUB_OUTPUT"
+          echo "tolerance=$TOLERANCE_VAL" >> "$GITHUB_OUTPUT"
+          echo "owner=$OWNER" >> "$GITHUB_OUTPUT"
+
+          if [[ -z "$TOKEN_INPUT" ]]; then
+            echo "::notice:: No token provided, using GITHUB_TOKEN instead."
+            echo "token=${{ secrets.GITHUB_TOKEN }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "::add-mask::$TOKEN_INPUT"
+            echo "token=$TOKEN_INPUT" >> "$GITHUB_OUTPUT"
+          fi
+
+          if [[ -z "$PACKAGE" || -z "$OWNER" || ( -z "$TOKEN_INPUT" && -z "${{ secrets.GITHUB_TOKEN }}" ) ]]; then
+            echo "::error:: Missing required inputs (package, token, or owner context)."
+            exit 1
+          fi
+
+          command -v curl >/dev/null 2>&1 || { echo "::error::curl is required but not installed."; exit 1; }
+          command -v jq >/dev/null 2>&1 || { echo "::error::jq is required but not installed."; exit 1; }
+
+      - name: Determine owner type (user or organization)
+        id: owner_type
+        shell: bash
+        run: |
+          OWNER="${{ steps.setup.outputs.owner }}"
+          TOKEN="${{ steps.setup.outputs.token }}"
+
+          TYPE=$(curl -s -H "Authorization: token $TOKEN" \
+            -H "Accept: application/vnd.github.v3+json" \
+            "https://api.github.com/users/${OWNER}" | jq -r '.type')
+
+          if [[ "$TYPE" == "Organization" ]]; then
+            OWNER_PATH="orgs"
+          else
+            OWNER_PATH="users"
+          fi
+
+          echo "owner_path=$OWNER_PATH" >> "$GITHUB_OUTPUT"
+          echo "Detected owner type: $TYPE (using /${OWNER_PATH}/)"
+
+      - name: Access all versions from GitHub
+        id: fetch
+        shell: bash
+        run: |
+          PACKAGE_NAME="${{ steps.setup.outputs.package_name }}"
+          OWNER="${{ steps.setup.outputs.owner }}"
+          TOKEN="${{ steps.setup.outputs.token }}"
+          OWNER_PATH="${{ steps.owner_type.outputs.owner_path }}"
+
+          BASE_URL="https://api.github.com/${OWNER_PATH}/${OWNER}/packages/container/${PACKAGE_NAME}/versions"
+          URL="${BASE_URL}?per_page=100"
+          TEMP_FILE="/tmp/all_versions.ndjson"
+
+          > "$TEMP_FILE"
+          PAGE=1
+          while [[ -n "$URL" && $PAGE -le 10 ]]; do
+            echo "Fetching: $URL"
+            
+            curl -s -H "Authorization: token $TOKEN" \
+                -H "Accept: application/vnd.github.v3+json" \
+                -D headers.txt \
+                "$URL" > page.json
+            
+            jq -c '.[]' page.json >> "$TEMP_FILE"
+            
+            URL=$(grep -i '^link:' headers.txt | grep -o '<[^>]*>;\s*rel="next"' | sed 's/<\(.*\)>.*/\1/' || true)
+            PAGE=$((PAGE + 1))
+          done
+          rm -f headers.txt page.json
+
+          echo "temp_file=$TEMP_FILE" >> "$GITHUB_OUTPUT"
+
+      - name: Filter untagged versions
+        id: filter
+        shell: bash
+        run: |
+          OLDER_THAN="${{ steps.setup.outputs.older_than }}"
+          TOLERANCE="${{ steps.setup.outputs.tolerance }}"
+          TEMP_FILE="${{ steps.fetch.outputs.temp_file }}"
+
+          TO_DELETE=$(jq -c -s \
+            --arg older_than "$OLDER_THAN" \
+            --arg tolerance "$TOLERANCE" \
+            '
+              def abs: if . < 0 then -. else . end;
+              def to_ms: sub("\\.[0-9]+Z$"; "Z") | strptime("%Y-%m-%dT%H:%M:%SZ") | mktime * 1000;
+
+              . as $all |
+              ($older_than | tonumber) as $older_than_val |
+              ($tolerance | tonumber) as $tolerance_val |
+              now as $now |
+              (if $older_than_val > 0 then ($now - ($older_than_val * 86400)) * 1000 else 0 end) as $cutoff_ms |
+
+              [ $all[] | select((.metadata.container.tags // []) | length > 0) | .created_at | to_ms ] as $tagged_times |
+
+              $all[] |
+              select((.metadata.container.tags // []) | length == 0) |
+              . as $item |
+              (.created_at | to_ms) as $created_ms |
+
+              (if $older_than_val > 0 then $created_ms < $cutoff_ms else true end) as $pass_age |
+              
+              (if $tolerance_val <= 0 then true 
+              else [ $tagged_times[] | select(($created_ms - .) | abs < $tolerance_val) ] | length == 0 
+              end) as $pass_tolerance |
+
+              select($pass_age and $pass_tolerance) |
+              {id, name}
+            ' "$TEMP_FILE")
+          
+          rm -f "$TEMP_FILE"
+
+          if [[ -z "$TO_DELETE" ]]; then
+            DELETE_COUNT=0
+          else
+            DELETE_COUNT=$(echo "$TO_DELETE" | wc -l | tr -d ' ')
+          fi
+          
+          echo "Found $DELETE_COUNT untagged images no longer necessary"
+
+          {
+            echo 'to_delete<<EOF'
+            echo "$TO_DELETE"
+            echo 'EOF'
+          } >> "$GITHUB_OUTPUT"
+          
+          echo "delete_count=$DELETE_COUNT" >> "$GITHUB_OUTPUT"
+
+      - name: Delete untagged versions
+        id: delete
+        shell: bash
+        run: |
+          PACKAGE_NAME="${{ steps.setup.outputs.package_name }}"
+          OWNER="${{ steps.setup.outputs.owner }}"
+          TOKEN="${{ steps.setup.outputs.token }}"
+          OWNER_PATH="${{ steps.owner_type.outputs.owner_path }}"
+          DELETE_COUNT="${{ steps.filter.outputs.delete_count }}"
+          TO_DELETE='${{ steps.filter.outputs.to_delete }}'
+
+          if [[ "$DELETE_COUNT" -gt 0 && -n "$TO_DELETE" ]]; then
+            while IFS= read -r item; do
+              [[ -z "$item" ]] && continue
+
+              # $item 是完整的单行 JSON，如 {"id":123,"name":"sha256:..."}
+              ID=$(echo "$item" | jq -r '.id')
+              NAME=$(echo "$item" | jq -r '.name')
+
+              DELETE_URL="https://api.github.com/${OWNER_PATH}/${OWNER}/packages/container/${PACKAGE_NAME}/versions/${ID}"
+              
+              HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" -X DELETE \
+                -H "Authorization: token $TOKEN" \
+                -H "Accept: application/vnd.github.v3+json" \
+                "$DELETE_URL")
+              
+              if [[ "$HTTP_CODE" == "204" ]]; then
+                echo "Deleted untagged container image '${NAME}'"
+              else
+                echo "::warning:: Failed to delete ${NAME} (ID: ${ID}). HTTP Status: ${HTTP_CODE}"
+              fi
+            done <<< "$TO_DELETE"
+          else
+            echo "No images to delete."
+          fi
+
+          echo "Cleanup completed."
@@ -0,0 +1,75 @@
+name: Issue Auto Reply
+
+on:
+  issues:
+    types: [opened]
+
+permissions:
+  issues: write
+
+jobs:
+  auto-reply:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check issue for unchecked tasks and reply
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        with:
+          script: |
+            if (context.payload.issue.title.startsWith('[Announcements]')) return;
+            const titleNotEdited = /(请修改标题|Please modify the title)/i.test(context.payload.issue.title);
+            const issueBody = context.payload.issue.body || "";
+            const aiSection = issueBody.match(/^### (AI生成内容|AI Generated Content)\r?\n([\s\S]*?)(?=^### |$(?![\s\S]))/m);
+            const aiOptionsPattern = aiSection?.[1] === 'AI生成内容'
+              ? /^\s*- \[([ xX])\] 我使用了AI工具生成此内容\r?\n- \[([ xX])\] 我没有使用AI工具生成此内容\s*$/
+              : /^\s*- \[([ xX])\] I used AI tools to generate this content\r?\n- \[([ xX])\] I did not use AI tools to generate this content\s*$/;
+            const aiOptions = (aiSection?.[2] || '').match(aiOptionsPattern);
+            const validAiDisclosure = aiOptions !== null && (aiOptions[1] !== ' ') !== (aiOptions[2] !== ' ');
+            const aiModelSection = issueBody.match(/^### (AI模型是|AI model used)\r?\n([\s\S]*?)(?=^### |$(?![\s\S]))/m);
+            const aiModel = (aiModelSection?.[2] || '').trim();
+            const missingAiModel = validAiDisclosure && aiOptions[1] !== ' ' && (aiModel === '' || aiModel === '_No response_');
+            const confirmNotRead = /- \[[xX]\] (?:我没有阅读这个清单|I have not read these checkboxes)/.test(issueBody);
+            const closeIssue = titleNotEdited || confirmNotRead || !validAiDisclosure || missingAiModel;
+            let comment;
+            if (titleNotEdited) {
+              comment = `⚠️ 请修改标题以更好地描述您的问题或需求，并删除示例提示。当前 Issue 将被自动关闭并锁定。如需继续提交，请创建新的 Issue。
+            ⚠️ Please modify the title to better describe your issue or request, and remove the example prompt. This issue will be automatically closed and locked. If you wish to proceed, please create a new issue.
+            `;
+            } else if (confirmNotRead || !validAiDisclosure || missingAiModel) {
+              comment = `⚠️ 你的 Issue 不符合提交规则。请先阅读相关规范后再重新提交。当前 Issue 将被自动关闭并锁定。如需继续提交，请确认已了解规则后创建新的 Issue。
+            ⚠️ Your issue does not comply with the submission rules. Please read the guidelines before submitting again. This issue will be automatically closed and locked. If you wish to proceed, please confirm that you have reviewed the rules before creating a new issue.
+            `;
+            } else if (/- \[ \] (?!我没有阅读这个清单|I have not read these checkboxes)/.test(issueBody.replace(aiSection[0], ''))) {
+              comment = `感谢您联系OpenList。我们会尽快回复您。
+            Thanks for contacting OpenList. We will reply to you as soon as possible.
+
+            由于您提出的 Issue 中包含部分未确认的项目，为了更好地管理项目，在人工审核后可能会直接关闭此问题。
+            如果您能确认并补充相关未确认项目的信息，欢迎随时重新提交。我们会及时关注并处理。感谢您的理解与支持！
+            Since your issue contains some unchecked tasks, it may be closed after manual review.
+            If you can confirm and provide information for the unchecked tasks, feel free to resubmit.
+            We will pay attention and handle it in a timely manner.
+
+            感谢您的理解与支持！
+            Thank you for your understanding and support!
+            `;
+            } else {
+              return;
+            }
+
+            await github.rest.issues.createComment({
+              ...context.repo,
+              issue_number: context.issue.number,
+              body: comment
+            });
+            if (closeIssue) {
+              await github.rest.issues.update({
+                ...context.repo,
+                issue_number: context.issue.number,
+                state: 'closed',
+                state_reason: 'not_planned',
+                labels: ['invalid']
+              });
+              await github.rest.issues.lock({
+                ...context.repo,
+                issue_number: context.issue.number
+              });
+            }
@@ -1,101 +0,0 @@
-name: Issue or PR Auto Reply
-
-on:
-  issues:
-    types: [opened]
-  pull_request:
-    types: [opened]
-
-permissions:
-  issues: write
-  pull-requests: write
-
-jobs:
-  auto-reply:
-    runs-on: ubuntu-latest
-    if: github.event_name == 'issues'
-    steps:
-      - name: Check issue for unchecked tasks and reply
-        uses: actions/github-script@v7
-        with:
-          script: |
-            let comment = "";
-            const issueTitle = context.payload.issue.title || "";
-            const titleNotEdited = /(请修改标题|Please modify the title)/i.test(issueTitle);
-            if (titleNotEdited) {
-              comment = "⚠️ 请修改标题以更好地描述您的问题或需求，并删除示例提示。当前 Issue 将被自动关闭。如需继续提交，请创建新的 Issue。\n";
-              comment += "⚠️ Please modify the title to better describe your issue or request, and remove the example prompt. This issue will be automatically closed. If you wish to proceed, please create a new issue.\n";
-              await github.rest.issues.createComment({
-                ...context.repo,
-                issue_number: context.issue.number,
-                body: comment
-              });
-              await github.rest.issues.update({
-                ...context.repo,
-                issue_number: context.issue.number,
-                state: 'closed',
-                state_reason: 'not_planned',
-                labels: ['invalid']
-              });
-              return;
-            }
-            const issueBody = context.payload.issue.body || "";
-            const confirmHasRead = /- \[ \] (?!我没有阅读这个清单|I have not read these checkboxes)/.test(issueBody);
-            const confirmNotRead = /- \[[xX]\] (?:我没有阅读这个清单|I have not read these checkboxes)/.test(issueBody);
-            if (confirmNotRead) {
-              comment = "⚠️ 你的 Issue 不符合提交规则。请先阅读相关规范后再重新提交。当前 Issue 将被自动关闭。如需继续提交，请确认已了解规则后重新打开或创建新的 Issue。\n";
-              comment += "⚠️ Your issue does not comply with the submission rules. Please read the guidelines before submitting again. This issue will be automatically closed. If you wish to proceed, please confirm that you have reviewed the rules before reopening or creating a new issue.\n";
-              await github.rest.issues.createComment({
-                ...context.repo,
-                issue_number: context.issue.number,
-                body: comment
-              });
-              await github.rest.issues.update({
-                ...context.repo,
-                issue_number: context.issue.number,
-                state: 'closed',
-                state_reason: 'not_planned',
-                labels: ['invalid']
-              });
-              return;
-            }
-            if (confirmHasRead) {
-              comment = "感谢您联系OpenList。我们会尽快回复您。\n";
-              comment += "Thanks for contacting OpenList. We will reply to you as soon as possible.\n\n";
-              comment += "由于您提出的 Issue 中包含部分未确认的项目，为了更好地管理项目，在人工审核后可能会直接关闭此问题。\n";
-              comment += "如果您能确认并补充相关未确认项目的信息，欢迎随时重新提交。我们会及时关注并处理。感谢您的理解与支持！\n";
-              comment += "Since your issue contains some unchecked tasks, it may be closed after manual review.\n";
-              comment += "If you can confirm and provide information for the unchecked tasks, feel free to resubmit.\n";
-              comment += "We will pay attention and handle it in a timely manner.\n\n";
-              comment += "感谢您的理解与支持！\n";
-              comment += "Thank you for your understanding and support!\n";
-              await github.rest.issues.createComment({
-                ...context.repo,
-                issue_number: context.issue.number,
-                body: comment
-              });
-            }
-
-  pr-title-check:
-    runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request'
-    steps:
-      - name: Check PR title for required prefix and comment
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const title = context.payload.pull_request.title || "";
-            const ok = /^(feat|docs|fix|style|refactor|chore)\(.+?\)!?: /i.test(title);
-            if (!ok) {
-              let comment = "⚠️ PR 标题需以 `feat(): `, `docs(): `, `fix(): `, `style(): `, `refactor(): `, `chore(): ` 其中之一开头，例如：`feat(component): 新增功能`。\n";
-              comment += "⚠️ The PR title must start with `feat(): `, `docs(): `, `fix(): `, `style(): `, or `refactor(): `, `chore(): `. For example: `feat(component): add new feature`.\n\n";
-              comment += "如果跨多个组件，请使用主要组件作为前缀，并在标题中枚举、描述中说明。\n";
-              comment += "If it spans multiple components, use the main component as the prefix and enumerate in the title, describe in the body.\n\n";
-              comment += "如果是破坏性变更，请在类型后添加 `!`，例如 `feat(component)!: 破坏性变更`。\n";
-              comment += "For breaking changes, add `!` after the type, e.g., `feat(component)!: breaking change`.\n\n";
-              await github.rest.issues.createComment({
-                ...context.repo,
-                issue_number: context.issue.number,
-                body: comment
-              });
-            }
@@ -0,0 +1,34 @@
+name: PR Title Check
+
+on:
+  pull_request_target:
+    types: [opened]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  pr-title-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check PR title for required prefix and comment
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        with:
+          script: |
+            const title = context.payload.pull_request.title;
+            if (/^(feat|docs|fix|style|refactor|chore)\(.+?\)!?: /i.test(title)) return;
+            const comment = `⚠️ PR 标题需以 \`feat(): \`, \`docs(): \`, \`fix(): \`, \`style(): \`, \`refactor(): \`, \`chore(): \` 其中之一开头，例如：\`feat(component): 新增功能\`。
+            ⚠️ The PR title must start with \`feat(): \`, \`docs(): \`, \`fix(): \`, \`style(): \`, or \`refactor(): \`, \`chore(): \`. For example: \`feat(component): add new feature\`.
+
+            如果跨多个组件，请使用主要组件作为前缀，并在标题中枚举、描述中说明。
+            If it spans multiple components, use the main component as the prefix and enumerate in the title, describe in the body.
+
+            如果是破坏性变更，请在类型后添加 \`!\`，例如 \`feat(component)!: 破坏性变更\`。
+            For breaking changes, add \`!\` after the type, e.g., \`feat(component)!: breaking change\`.
+
+            `;
+            await github.rest.issues.createComment({
+              ...context.repo,
+              issue_number: context.issue.number,
+              body: comment
+            });
@@ -14,7 +14,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Prerelease
-        uses: irongut/EditRelease@v1.2.0
+        uses: irongut/EditRelease@ccf529ad26dddf9996e7dd0f24ca5da4ea507cc2 # v1.2.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          id: ${{ github.event.release.id }}
@@ -33,7 +33,7 @@ jobs:

      - name: Free Disk Space (Ubuntu)
        if: matrix.target-platform == ''
-        uses: jlumbroso/free-disk-space@main
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # main
        with:
          tool-cache: false
          android: true
@@ -44,14 +44,15 @@ jobs:
          swap-storage: true

      - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
-          go-version: '1.25.0'
+          go-version: '1.27.1'

      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
-          fetch-depth: 0
+          fetch-depth: 1
+          fetch-tags: true

      - name: Install dependencies
        if: matrix.target-platform == ''
@@ -69,9 +70,9 @@ jobs:
          FRONTEND_REPO: ${{ vars.FRONTEND_REPO }}

      - name: Upload assets
-        uses: softprops/action-gh-release@v2
-        with:
-          files: build/compress/*
-          prerelease: false
-          tag_name: ${{ github.event.release.tag_name }}
-
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          for file in build/compress/*; do
+            gh release upload "${{ github.event.release.tag_name }}" "$file" --clobber
+          done
@@ -43,15 +43,15 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
-          go-version: '1.25.0'
+          go-version: '1.27'

      - name: Cache Musl
        id: cache-musl
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: build/musl-libs
          key: docker-musl-libs-v2
@@ -69,7 +69,7 @@ jobs:
          FRONTEND_REPO: ${{ vars.FRONTEND_REPO }}

      - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: ${{ env.ARTIFACT_NAME }}
          overwrite: true
@@ -83,15 +83,15 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
-          go-version: '1.25.0'
+          go-version: '1.27.1'

      - name: Cache Musl
        id: cache-musl
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: build/musl-libs
          key: docker-musl-libs-v2
@@ -109,7 +109,7 @@ jobs:
          FRONTEND_REPO: ${{ vars.FRONTEND_REPO }}

      - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: ${{ env.ARTIFACT_NAME_LITE }}
          overwrite: true
@@ -146,21 +146,21 @@ jobs:
            tag_favor: "suffix=-aio,onlatest=true"
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
-      - uses: actions/download-artifact@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: ${{ env.ARTIFACT_NAME }}
          path: 'build/'

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4

      - name: Login to GitHub Container Registry
        if: env.IMAGE_PUSH == 'true'
-        uses: docker/login-action@v3
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -168,14 +168,14 @@ jobs:

      - name: Login to DockerHub Container Registry
        if: env.IMAGE_PUSH == 'true'
-        uses: docker/login-action@v3
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          username: ${{ vars.DOCKERHUB_ORG_NAME_BACKUP || env.DOCKERHUB_ORG_NAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Docker meta
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.GHCR_ORG_NAME }}/${{ env.IMAGE_NAME }}
@@ -190,7 +190,7 @@ jobs:

      - name: Build and push
        id: docker_build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          context: .
          file: Dockerfile.ci
@@ -230,21 +230,21 @@ jobs:
            tag_favor: "suffix=-lite-aio,onlatest=true"
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
-      - uses: actions/download-artifact@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: ${{ env.ARTIFACT_NAME_LITE }}
          path: 'build/'

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4

      - name: Login to GitHub Container Registry
        if: env.IMAGE_PUSH == 'true'
-        uses: docker/login-action@v3
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -252,14 +252,14 @@ jobs:

      - name: Login to DockerHub Container Registry
        if: env.IMAGE_PUSH == 'true'
-        uses: docker/login-action@v3
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          username: ${{ vars.DOCKERHUB_ORG_NAME_BACKUP || env.DOCKERHUB_ORG_NAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Docker meta
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.GHCR_ORG_NAME }}/${{ env.IMAGE_NAME }}
@@ -274,7 +274,7 @@ jobs:

      - name: Build and push
        id: docker_build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          context: .
          file: Dockerfile.ci
@@ -12,7 +12,7 @@ jobs:
    name: Sync GitHub to Gitee
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0

@@ -32,15 +32,15 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
-          go-version: '1.25.0'
+          go-version: '1.27.1'

      - name: Cache Musl
        id: cache-musl
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: build/musl-libs
          key: docker-musl-libs-v2
@@ -58,7 +58,7 @@ jobs:
          FRONTEND_REPO: ${{ vars.FRONTEND_REPO }}

      - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: ${{ env.ARTIFACT_NAME }}
          overwrite: true
@@ -97,21 +97,21 @@ jobs:
            tag_favor: "suffix=-aio,onlatest=true"
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
-      - uses: actions/download-artifact@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: ${{ env.ARTIFACT_NAME }}
          path: 'build/'

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4

      - name: Login to GitHub Container Registry
        if: env.IMAGE_PUSH == 'true'
-        uses: docker/login-action@v3
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -119,14 +119,14 @@ jobs:

      - name: Login to DockerHub Container Registry
        if: env.IMAGE_PUSH == 'true'
-        uses: docker/login-action@v3
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          username: ${{ vars.DOCKERHUB_ORG_NAME_BACKUP || env.DOCKERHUB_ORG_NAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Docker meta
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.GHCR_ORG_NAME }}/${{ env.IMAGE_NAME }}
@@ -137,7 +137,7 @@ jobs:

      - name: Build and push
        id: docker_build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          context: .
          file: Dockerfile.ci
@@ -16,20 +16,33 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Trigger Makefile hash update
-        uses: peter-evans/repository-dispatch@v3
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
        with:
-          token: ${{ secrets.EXTERNAL_REPO_TOKEN_LUCI_APP_OPENLIST }}
-          repository: ${{ vars.HOOK_REPO || 'OpenListTeam/OpenList-OpenWRT' }}
-          event-type: update-hashes
-          client-payload: |
-            {
-              "source_repository": "${{ github.repository }}",
-              "release_tag": "${{ inputs.tag || github.ref_name }}",
-              "release_name": "${{ inputs.tag || github.ref_name }}",
-              "release_url": "${{ github.server_url }}/${{ github.repository }}/releases/tag/${{ inputs.tag || github.ref_name }}",
-              "triggered_by": "${{ github.actor }}",
-              "trigger_reason": "${{ github.event_name }}"
-            }
+          github-token: ${{ secrets.EXTERNAL_REPO_TOKEN_LUCI_APP_OPENLIST }}
+          script: |
+            const repository = process.env.REPOSITORY;
+            const [owner, repo] = repository.split('/');
+            
+            await github.rest.repos.createDispatchEvent({
+              owner: owner,
+              repo: repo,
+              event_type: 'update-hashes',
+              client_payload: {
+                source_repository: process.env.SOURCE_REPOSITORY,
+                release_tag: process.env.RELEASE_TAG,
+                release_name: process.env.RELEASE_TAG,
+                release_url: process.env.RELEASE_URL,
+                triggered_by: process.env.ACTOR,
+                trigger_reason: process.env.EVENT_NAME
+              }
+            });
+        env:
+          REPOSITORY: ${{ vars.HOOK_REPO || 'OpenListTeam/OpenList-OpenWRT' }}
+          SOURCE_REPOSITORY: ${{ github.repository }}
+          RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
+          RELEASE_URL: ${{ github.server_url }}/${{ github.repository }}/releases/tag/${{ inputs.tag || github.ref_name }}
+          ACTOR: ${{ github.actor }}
+          EVENT_NAME: ${{ github.event_name }}

      - name: Log trigger information
        run: |
@@ -22,6 +22,7 @@ output/
 # vendor/
 /bin/*
 *.json
+!renovate.json
 /build
 /data/
 /tmp/
@@ -29,6 +30,7 @@ output/
 /lang/
 /daemon/
 /public/dist/*
-/!public/dist/README.md
+!/public/dist/README.md

-.VSCodeCounter
+.VSCodeCounter
+*.syso
@@ -0,0 +1,60 @@
+# Agent Instructions
+
+## Issues
+
+Before creating an issue, review the available issue templates in the `.github` directory.
+
+When drafting the issue:
+
+- Use the most appropriate template.
+- Follow the template structure.
+- Fill in all required sections.
+- Remove sections that the template explicitly marks as optional or not applicable.
+- Do not invent reproduction steps, logs, screenshots, or expected behavior.
+
+## Pull Requests
+
+Before creating a pull request, read `.github/PULL_REQUEST_TEMPLATE.md`.
+
+When drafting the pull request:
+
+- Follow the template structure.
+- Use the title format required by the template.
+- Fill in or remove each section according to the template guidance.
+- Include testing details, or explain why testing was not run.
+- Do not invent testing results.
+- Do not claim validation, verification, or review steps that were not actually performed.
+
+## Automated Contributions
+
+Fully automated contributions are not considered equivalent to normal community participation.
+
+A contribution may be considered fully automated if it is submitted through an automated agent, or if the submitting account participates in project discussions through an automated agent, without meaningful human review or intervention.
+
+When making this determination, maintainers may consider the overall behavior of the account, including but not limited to disclosed agent usage, interaction patterns, response characteristics, and other available evidence. No single factor is determinative.
+
+Maintainers reserve the right to accept, reject, modify, or reimplement any contribution independently of any action taken against the submitting account. Acceptance of a contribution does not imply acceptance of the submitting account or its contribution method. If an account is determined to be primarily operated through automated processes, we may need to restrict its future participation in contributions until that determination is rescinded.
+
+## Git Commits
+
+When creating commits, follow the repository `git-commit` skill rules:
+
+- Use Conventional Commits title format: `type(scope): subject`.
+- Allowed types: `feat`, `fix`, `refactor`, `perf`, `docs`, `style`, `test`, `build`, `ci`, `chore`, `revert`.
+- Use a meaningful scope based on the main module, package, or feature.
+- Write the subject in imperative mood and describe the actual change.
+- Use a concise Markdown list in the commit body, with each item describing one key change.
+- Do not invent changes that are not present in the diff.
+- Do not describe behavior, refactors, fixes, or tests that are not reflected in the commit.
+
+Include at most one `Co-authored-by` trailer that matches the AI assistant actually used to produce the change.
+
+Examples:
+
+- `Co-authored-by: Codex <267193182+codex@users.noreply.github.com>`
+- `Co-authored-by: GitHub Copilot <copilot@github.com>`
+- `Co-authored-by: Claude <81847+claude@users.noreply.github.com>`
+
+If you are not one of the listed assistants, do not add a `Co-authored-by` trailer.
+
+Instead, ask the human collaborator to provide the exact `Co-authored-by` trailer to use. Do not invent, infer, or generate one yourself.
@@ -106,7 +106,7 @@ Violating these terms may lead to a permanent ban.
 ### 4. Permanent Ban

 **Community Impact**: Demonstrating a pattern of violation of community
-standards, including sustained inappropriate behavior,  harassment of an
+standards, including sustained inappropriate behavior, harassment of an
 individual, or aggression toward or disparagement of classes of individuals.

 **Consequence**: A permanent ban from any sort of public interaction within
@@ -116,7 +116,7 @@ the community.

 This Code of Conduct is adapted from the [Contributor Covenant][homepage],
 version 2.0, available at
-https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
+<https://www.contributor-covenant.org/version/2/0/code_of_conduct.html>.

 Community Impact Guidelines were inspired by [Mozilla's code of conduct
 enforcement ladder](https://github.com/mozilla/diversity).
@@ -124,5 +124,5 @@ enforcement ladder](https://github.com/mozilla/diversity).
 [homepage]: https://www.contributor-covenant.org

 For answers to common questions about this code of conduct, see the FAQ at
-https://www.contributor-covenant.org/faq. Translations are available at
-https://www.contributor-covenant.org/translations.
+<https://www.contributor-covenant.org/faq>. Translations are available at
+<https://www.contributor-covenant.org/translations>.
@@ -7,7 +7,7 @@
 Prerequisites:

 - [git](https://git-scm.com)
- [Go 1.24+](https://golang.org/doc/install)
+- [Go](https://golang.org/doc/install) version declared in [`go.mod`](./go.mod)
 - [gcc](https://gcc.gnu.org/)
 - [nodejs](https://nodejs.org/)

@@ -16,8 +16,8 @@ Prerequisites:
 Fork and clone `OpenList` and `OpenList-Frontend` anywhere:

 ```shell
-$ git clone https://github.com/<your-username>/OpenList.git
-$ git clone --recurse-submodules https://github.com/<your-username>/OpenList-Frontend.git
+git clone https://github.com/<your-username>/OpenList.git
+git clone --recurse-submodules https://github.com/<your-username>/OpenList-Frontend.git
 ```

 ## Creating a branch
@@ -25,7 +25,7 @@ $ git clone --recurse-submodules https://github.com/<your-username>/OpenList-Fro
 Create a new branch from the `main` branch, with an appropriate name.

 ```shell
-$ git checkout -b <branch-name>
+git checkout -b <branch-name>
 ```

 ## Preview your change
@@ -33,26 +33,36 @@ $ git checkout -b <branch-name>
 ### backend

 ```shell
-$ go run main.go
+go run main.go
 ```

 ### frontend

 ```shell
-$ pnpm dev
+pnpm dev
 ```

 ## Add a new driver

 Copy `drivers/template` folder and rename it, and follow the comments in it.

+## Community and policies
+
+By contributing, you agree to follow the repository's code of conduct and license terms.
+
+- Code of conduct: [CODE_OF_CONDUCT.md](./CODE_OF_CONDUCT.md)
+- License: [LICENSE](./LICENSE)
+- Security issues: please report privately according to [SECURITY.md](./SECURITY.md)
+
+If your contribution includes substantial AI-assisted content, disclose the tools used and the scope of assistance in the pull request.
+
 ## Create a commit

 Commit messages should be well formatted, and to make that "standardized".

 Submit your pull request. For PR titles, follow [Conventional Commits](https://www.conventionalcommits.org).

-https://github.com/OpenListTeam/OpenList/issues/376
+<https://github.com/OpenListTeam/OpenList/issues/376>

 It's suggested to sign your commits. See: [How to sign commits](https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits)

@@ -72,6 +82,29 @@ At least 1 approving review is required by reviewers with write access. You can

 (Optional) After your pull request is merged, you can delete your branch.

+## AI Disclosure
+
+If your pull request includes substantial AI-assisted content, disclose it in the PR description.
+
+The pull request description must follow the repository's pull request template.
+
+Fully automated contributions are not considered equivalent to normal community participation.
+
+A contribution may be considered fully automated if it is submitted through an automated agent, or if the submitting account participates in project discussions through an automated agent, without meaningful human review or intervention.
+
+When making this determination, maintainers may consider the overall behavior of the account, including but not limited to disclosed agent usage, interaction patterns, response characteristics, and other available evidence. No single factor is determinative.
+
+Maintainers reserve the right to accept, reject, modify, or reimplement any contribution independently of any action taken against the submitting account. Acceptance of a contribution does not imply acceptance of the submitting account or its contribution method. If an account is determined to be primarily operated through automated processes, we may need to restrict its future participation in contributions until that determination is rescinded.
+
+Please include:
+
+- Tools used, such as ChatGPT, GitHub Copilot, Claude, Cursor, or other AI tools.
+- Usage scope, such as code generation, refactoring, documentation, tests, translation, or review assistance.
+- Confirmation that you have reviewed and validated all AI-assisted content before submission.
+- Confirmation that the submitted content complies with this repository's license and contribution policies.
+
+Minor AI assistance, such as typo fixes, autocomplete, formatting suggestions, or wording polish, does not need to be disclosed.
+
 ---

 Thank you for your contribution! Let's make OpenList better together!
@@ -14,7 +14,7 @@

 ---

- English | [中文](./README_cn.md) | [日本語](./README_ja.md) | [Dutch](./README_nl.md)
+- English | [中文](./README/README_cn.md) | [日本語](./README/README_ja.md) | [Dutch](./README/README_nl.md) | [한국어](./README/README_ko.md) | [Deutsch](./README/README_de.md) | [Русский](./README/README_ru.md) | [Français](./README/README_fr.md) | [Español](./README/README_es.md) | [العربية](./README/README_ar.md)

 - [Contributing](./CONTRIBUTING.md)
 - [CODE OF CONDUCT](./CODE_OF_CONDUCT.md)
@@ -67,7 +67,7 @@ Thank you for your support and understanding of the OpenList project.
  - [x] [MediaFire](https://www.mediafire.com)
  - [x] [Mediatrack](https://www.mediatrack.cn)
  - [x] [ProtonDrive](https://proton.me/drive)
-  - [x] [139yun](https://yun.139.com) (Personal, Family, Group)
+  - [x] [139yun](https://yun.139.com) (Personal, Family, Group, Share)
  - [x] [YandexDisk](https://disk.yandex.com)
  - [x] [BaiduNetdisk](http://pan.baidu.com)
  - [x] [Terabox](https://www.terabox.com/main)
@@ -95,6 +95,7 @@ Thank you for your support and understanding of the OpenList project.
  - [x] [OpenList](https://github.com/OpenListTeam/OpenList)
  - [x] [Teldrive](https://github.com/tgdrive/teldrive)
  - [x] [Weiyun](https://www.weiyun.com)
+  - [x] [DingTalk Docs](https://alidocs.dingtalk.com/)
 - [x] Easy to deploy and out-of-the-box
 - [x] File preview (PDF, markdown, code, plain text, ...)
 - [x] Image preview in gallery mode
@@ -116,9 +117,10 @@ Thank you for your support and understanding of the OpenList project.

 ## Document

- 📘 [Global Site](https://doc.oplist.org)
- 📚 [Backup Site](https://doc.openlist.team)
- 🌏 [CN Site](https://doc.oplist.org.cn)
+- 📘 [Docs](https://doc.oplist.org)
+- 🌏 [CN Mirror](https://doc.oplist.org.cn)
+- ⚖️ [Terms of Use](https://doc.oplist.org/terms)
+- 🔒 [Privacy Policy](https://doc.oplist.org/privacy)

 ## Demo

@@ -133,6 +135,14 @@ Please refer to [*Discussions*](https://github.com/OpenListTeam/OpenList/discuss

 [![VPS.Town](https://vps.town/static/images/sponsor.png)](https://vps.town "VPS.Town - Trust, Effortlessly. Your Cloud, Reimagined.")

+## Donors
+
+Thanks to the following donors for their generous support:
+
+- [HisAtri](https://github.com/HisAtri)
+- 爱发电用户_7jTh
+- suka
+
 ## License

 The `OpenList` is open-source software licensed under the [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.txt) license.
@@ -162,3 +172,4 @@ We sincerely thank the author [Xhofe](https://github.com/Xhofe) of the original
 Thanks goes to these wonderful people:

 [![Contributors](https://contrib.rocks/image?repo=OpenListTeam/OpenList)](https://github.com/OpenListTeam/OpenList/graphs/contributors)
+
@@ -0,0 +1,136 @@
+<div align="center">
+  <img src="https://raw.githubusercontent.com/OpenListTeam/Logo/main/logo.svg" width="128" height="128" alt="logo" />
+
+  <p><em>OpenList هو تفرّع من AList يتميز بالمرونة والحوكمة طويلة الأمد ويقوده المجتمع، وقد بُني للدفاع عن البرمجيات مفتوحة المصدر ضد الهجمات القائمة على الثقة.</em></p>
+
+  <img src="https://goreportcard.com/badge/github.com/OpenListTeam/OpenList/v3" alt="latest version" />
+  <a href="https://github.com/OpenListTeam/OpenList/blob/main/LICENSE"><img src="https://img.shields.io/github/license/OpenListTeam/OpenList" alt="License" /></a>
+  <a href="https://github.com/OpenListTeam/OpenList/actions?query=workflow%3ABuild"><img src="https://img.shields.io/github/actions/workflow/status/OpenListTeam/OpenList/build.yml?branch=main" alt="Build status" /></a>
+  <a href="https://github.com/OpenListTeam/OpenList/releases"><img src="https://img.shields.io/github/release/OpenListTeam/OpenList" alt="latest version" /></a>
+
+  <a href="https://github.com/OpenListTeam/OpenList/discussions"><img src="https://img.shields.io/github/discussions/OpenListTeam/OpenList?color=%23ED8936" alt="discussions" /></a>
+  <a href="https://github.com/OpenListTeam/OpenList/releases"><img src="https://img.shields.io/github/downloads/OpenListTeam/OpenList/total?color=%239F7AEA&logo=github" alt="Downloads" /></a>
+</div>
+
+---
+
+- [English](../README.md) | [中文](./README_cn.md) | [日本語](./README_ja.md) | [Dutch](./README_nl.md) | [한국어](./README_ko.md) | [Deutsch](./README_de.md) | [Русский](./README_ru.md) | [Français](./README_fr.md) | [Español](./README_es.md) | العربية
+
+- [Contributing](../CONTRIBUTING.md)
+- [CODE OF CONDUCT](../CODE_OF_CONDUCT.md)
+- [LICENSE](../LICENSE)
+
+## إخلاء المسؤولية
+
+OpenList is an open-source project independently maintained by the OpenList Team under the AGPL-3.0 license, with a commitment to code openness and modification transparency.
+
+OpenList has no official association with third-party derivative projects that use similar names, including OpenListApp/OpenListApp or paid proprietary software using the same or similar names.
+
+- All software, code, and services of this project are maintained by the OpenList Team and are freely available on GitHub.
+- Project documentation and API services primarily rely on charitable resources provided by Cloudflare. There are currently no paid plans or commercial deployments.
+- Downstream projects should not use the "OpenList" name for impersonation or commercial confusion, and must not distribute OpenList-based code as closed source in violation of the AGPL license.
+- This software is provided "as is" without warranties. Please comply with applicable laws and regulations when using it.
+
+## الميزات
+
+- [x] Multiple storages
+  - [x] Local storage
+  - [x] [Aliyundrive](https://www.alipan.com)
+  - [x] OneDrive / Sharepoint ([Global](https://www.microsoft.com/en-us/microsoft-365/onedrive/online-cloud-storage), [CN](https://portal.partner.microsoftonline.cn), DE, US)
+  - [x] [189cloud](https://cloud.189.cn) (Personal, Family)
+  - [x] [GoogleDrive](https://drive.google.com)
+  - [x] [123pan](https://www.123pan.com)
+  - [x] [FTP / SFTP](https://en.wikipedia.org/wiki/File_Transfer_Protocol)
+  - [x] [PikPak](https://www.mypikpak.com)
+  - [x] [S3](https://aws.amazon.com/s3)
+  - [x] [Seafile](https://seafile.com)
+  - [x] [UPYUN Storage Service](https://www.upyun.com/products/file-storage)
+  - [x] [WebDAV](https://en.wikipedia.org/wiki/WebDAV)
+  - [x] Teambition([China](https://www.teambition.com), [International](https://us.teambition.com))
+  - [x] [MediaFire](https://www.mediafire.com)
+  - [x] [Mediatrack](https://www.mediatrack.cn)
+  - [x] [ProtonDrive](https://proton.me/drive)
+  - [x] [139yun](https://yun.139.com) (Personal, Family, Group, Share)
+  - [x] [YandexDisk](https://disk.yandex.com)
+  - [x] [BaiduNetdisk](http://pan.baidu.com)
+  - [x] [Terabox](https://www.terabox.com/main)
+  - [x] [UC](https://drive.uc.cn)
+  - [x] [Quark](https://pan.quark.cn)
+  - [x] [Thunder](https://pan.xunlei.com)
+  - [x] [Lanzou](https://www.lanzou.com)
+  - [x] [ILanzou](https://www.ilanzou.com)
+  - [x] [Google photo](https://photos.google.com)
+  - [x] [Mega.nz](https://mega.nz)
+  - [x] [Baidu photo](https://photo.baidu.com)
+  - [x] [SMB](https://en.wikipedia.org/wiki/Server_Message_Block)
+  - [x] [115](https://115.com)
+  - [x] [Cloudreve](https://cloudreve.org)
+  - [x] [Dropbox](https://www.dropbox.com)
+  - [x] [FeijiPan](https://www.feijipan.com)
+  - [x] [dogecloud](https://www.dogecloud.com/product/oss)
+  - [x] [Azure Blob Storage](https://azure.microsoft.com/products/storage/blobs)
+  - [x] [Chaoxing](https://www.chaoxing.com)
+  - [x] [CNB](https://cnb.cool/)
+  - [x] [Degoo](https://degoo.com)
+  - [x] [Doubao](https://www.doubao.com)
+  - [x] [Febbox](https://www.febbox.com)
+  - [x] [GitHub](https://github.com)
+  - [x] [OpenList](https://github.com/OpenListTeam/OpenList)
+  - [x] [Teldrive](https://github.com/tgdrive/teldrive)
+  - [x] [Weiyun](https://www.weiyun.com)
+  - [x] [DingTalk Docs](https://alidocs.dingtalk.com/)
+- [x] Easy to deploy and out-of-the-box
+- [x] File preview (PDF, markdown, code, plain text, ...)
+- [x] Image preview in gallery mode
+- [x] Video and audio preview, with lyrics and subtitles support
+- [x] Office document preview (docx, pptx, xlsx, ...)
+- [x] `README.md` preview rendering
+- [x] File permalink copy and direct file download
+- [x] Dark mode and i18n
+- [x] Protected routes, WebDAV, Docker deploy, and Cloudflare Workers proxy
+- [x] File/folder package download and web upload operations
+- [x] Offline download, cross-storage copy, and multi-thread download acceleration
+
+## الوثائق
+
+- 📘 [Docs](https://doc.oplist.org)
+- 🌏 [CN Mirror](https://doc.oplist.org.cn)
+- ⚖️ [Terms of Use](https://doc.oplist.org/terms)
+- 🔒 [Privacy Policy](https://doc.oplist.org/privacy)
+
+## العرض التجريبي
+
+- 🌎 [Global Demo](https://demo.oplist.org)
+- 🇨🇳 [CN Demo](https://demo.oplist.org.cn)
+
+## النقاش
+
+Please refer to [Discussions](https://github.com/OpenListTeam/OpenList/discussions) for general questions; Issues are for bug reports and feature requests only.
+
+## الراعي
+
+[![VPS.Town](https://vps.town/static/images/sponsor.png)](https://vps.town "VPS.Town - Trust, Effortlessly. Your Cloud, Reimagined.")
+
+## المتبرعون
+
+Thanks to the following donors for their generous support:
+
+- [HisAtri](https://github.com/HisAtri)
+- 爱发电用户_7jTh
+- suka
+
+## الترخيص
+
+OpenList is open-source software licensed under the [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.txt) license.
+
+## تواصل معنا
+
+- [@GitHub](https://github.com/OpenListTeam)
+- [Telegram Group](https://t.me/OpenListTeam)
+- [Telegram Channel](https://t.me/OpenListOfficial)
+
+## المساهمون
+
+We sincerely thank [Xhofe](https://github.com/Xhofe), author of the original project [AlistGo/alist](https://github.com/AlistGo/alist), and all other contributors.
+
+[![Contributors](https://contrib.rocks/image?repo=OpenListTeam/OpenList)](https://github.com/OpenListTeam/OpenList/graphs/contributors)
@@ -14,11 +14,11 @@

 ---

- [English](./README.md) | 中文 | [日本語](./README_ja.md) | [Dutch](./README_nl.md)
+- [English](../README.md) | 中文 | [日本語](./README_ja.md) | [Dutch](./README_nl.md) | [한국어](./README_ko.md) | [Deutsch](./README_de.md) | [Русский](./README_ru.md) | [Français](./README_fr.md) | [Español](./README_es.md) | [العربية](./README_ar.md)

- [贡献指南](./CONTRIBUTING.md)
- [行为准则](./CODE_OF_CONDUCT.md)
- [许可证](./LICENSE)
+- [贡献指南](../CONTRIBUTING.md)
+- [行为准则](../CODE_OF_CONDUCT.md)
+- [许可证](../LICENSE)

 ## 免责声明

@@ -67,7 +67,7 @@ OpenList 是一个由 OpenList 团队独立维护的开源项目，遵循 AGPL-3
  - [x] [MediaFire](https://www.mediafire.com)
  - [x] [分秒帧](https://www.mediatrack.cn)
  - [x] [ProtonDrive](https://proton.me/drive)
-  - [x] [和彩云](https://yun.139.com)（个人、家庭、群组）
+  - [x] [和彩云](https://yun.139.com)（个人、家庭、群组、分享）
  - [x] [YandexDisk](https://disk.yandex.com)
  - [x] [百度网盘](http://pan.baidu.com)
  - [x] [Terabox](https://www.terabox.com/main)
@@ -95,6 +95,7 @@ OpenList 是一个由 OpenList 团队独立维护的开源项目，遵循 AGPL-3
  - [x] [OpenList](https://github.com/OpenListTeam/OpenList)
  - [x] [Teldrive](https://github.com/tgdrive/teldrive)
  - [x] [微云](https://www.weiyun.com)
+  - [x] [钉钉文档](https://alidocs.dingtalk.com/)
 - [x] 部署方便，开箱即用
 - [x] 文件预览（PDF、markdown、代码、纯文本等）
 - [x] 画廊模式下的图片预览
@@ -116,14 +117,15 @@ OpenList 是一个由 OpenList 团队独立维护的开源项目，遵循 AGPL-3

 ## 文档

- 🌏 [国内站点](https://doc.oplist.org.cn)
- 📘 [海外站点](https://doc.oplist.org)
- 📚 [备用站点](https://doc.openlist.team)
+- 📘 [文档](https://doc.oplist.org)
+- 🌏 [中国镜像](https://doc.oplist.org.cn)
+- ⚖️ [使用条款](https://doc.oplist.org/terms)
+- 🔒 [隐私政策](https://doc.oplist.org/privacy)

-## 演示
+## Demo

- 🇨🇳 [国内演示站](https://demo.oplist.org.cn)
- 🌎 [海外演示站](https://demo.oplist.org)
+- 🌎 [全球 Demo](https://demo.oplist.org)
+- 🇨🇳 [中国 Demo](https://demo.oplist.org.cn)

 ## 讨论

@@ -133,6 +135,14 @@ OpenList 是一个由 OpenList 团队独立维护的开源项目，遵循 AGPL-3

 [![VPS.Town](https://vps.town/static/images/sponsor.png)](https://vps.town "VPS.Town - Trust, Effortlessly. Your Cloud, Reimagined.")

+## 捐赠者
+
+感谢以下捐赠者的慷慨支持：
+
+- [HisAtri](https://github.com/HisAtri)
+- 爱发电用户_7jTh
+- suka
+
 ## 许可证

 `OpenList` 是基于 [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.txt) 许可证的开源软件。
@@ -147,7 +157,7 @@ OpenList 是一个由 OpenList 团队独立维护的开源项目，遵循 AGPL-3
 - 本软件按“原样”提供，不附带任何明示或暗示的担保，包括但不限于适销性或特定用途的适用性。
 - 维护者不对因使用或无法使用本软件而导致的任何直接或间接损失负责。
 - 您需自行承担使用本软件的所有风险，包括但不限于账号被封、下载限速等。
- 本项目遵循 [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.txt) 许可证，详情请参见 [LICENSE](./LICENSE) 文件。
+- 本项目遵循 [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.txt) 许可证，详情请参见 [LICENSE](../LICENSE) 文件。

 ## 联系我们

@@ -0,0 +1,136 @@
+<div align="center">
+  <img src="https://raw.githubusercontent.com/OpenListTeam/Logo/main/logo.svg" width="128" height="128" alt="logo" />
+
+  <p><em>OpenList ist ein widerstandsfähiger, langfristig verwalteter und Community-getriebener Fork von AList, entwickelt zum Schutz von Open Source vor vertrauensbasierten Angriffen.</em></p>
+
+  <img src="https://goreportcard.com/badge/github.com/OpenListTeam/OpenList/v3" alt="latest version" />
+  <a href="https://github.com/OpenListTeam/OpenList/blob/main/LICENSE"><img src="https://img.shields.io/github/license/OpenListTeam/OpenList" alt="License" /></a>
+  <a href="https://github.com/OpenListTeam/OpenList/actions?query=workflow%3ABuild"><img src="https://img.shields.io/github/actions/workflow/status/OpenListTeam/OpenList/build.yml?branch=main" alt="Build status" /></a>
+  <a href="https://github.com/OpenListTeam/OpenList/releases"><img src="https://img.shields.io/github/release/OpenListTeam/OpenList" alt="latest version" /></a>
+
+  <a href="https://github.com/OpenListTeam/OpenList/discussions"><img src="https://img.shields.io/github/discussions/OpenListTeam/OpenList?color=%23ED8936" alt="discussions" /></a>
+  <a href="https://github.com/OpenListTeam/OpenList/releases"><img src="https://img.shields.io/github/downloads/OpenListTeam/OpenList/total?color=%239F7AEA&logo=github" alt="Downloads" /></a>
+</div>
+
+---
+
+- [English](../README.md) | [中文](./README_cn.md) | [日本語](./README_ja.md) | [Dutch](./README_nl.md) | [한국어](./README_ko.md) | Deutsch | [Русский](./README_ru.md) | [Français](./README_fr.md) | [Español](./README_es.md) | [العربية](./README_ar.md)
+
+- [Contributing](../CONTRIBUTING.md)
+- [CODE OF CONDUCT](../CODE_OF_CONDUCT.md)
+- [LICENSE](../LICENSE)
+
+## Haftungsausschluss
+
+OpenList is an open-source project independently maintained by the OpenList Team under the AGPL-3.0 license, with a commitment to code openness and modification transparency.
+
+OpenList has no official association with third-party derivative projects that use similar names, including OpenListApp/OpenListApp or paid proprietary software using the same or similar names.
+
+- All software, code, and services of this project are maintained by the OpenList Team and are freely available on GitHub.
+- Project documentation and API services primarily rely on charitable resources provided by Cloudflare. There are currently no paid plans or commercial deployments.
+- Downstream projects should not use the "OpenList" name for impersonation or commercial confusion, and must not distribute OpenList-based code as closed source in violation of the AGPL license.
+- This software is provided "as is" without warranties. Please comply with applicable laws and regulations when using it.
+
+## Funktionen
+
+- [x] Multiple storages
+  - [x] Local storage
+  - [x] [Aliyundrive](https://www.alipan.com)
+  - [x] OneDrive / Sharepoint ([Global](https://www.microsoft.com/en-us/microsoft-365/onedrive/online-cloud-storage), [CN](https://portal.partner.microsoftonline.cn), DE, US)
+  - [x] [189cloud](https://cloud.189.cn) (Personal, Family)
+  - [x] [GoogleDrive](https://drive.google.com)
+  - [x] [123pan](https://www.123pan.com)
+  - [x] [FTP / SFTP](https://en.wikipedia.org/wiki/File_Transfer_Protocol)
+  - [x] [PikPak](https://www.mypikpak.com)
+  - [x] [S3](https://aws.amazon.com/s3)
+  - [x] [Seafile](https://seafile.com)
+  - [x] [UPYUN Storage Service](https://www.upyun.com/products/file-storage)
+  - [x] [WebDAV](https://en.wikipedia.org/wiki/WebDAV)
+  - [x] Teambition([China](https://www.teambition.com), [International](https://us.teambition.com))
+  - [x] [MediaFire](https://www.mediafire.com)
+  - [x] [Mediatrack](https://www.mediatrack.cn)
+  - [x] [ProtonDrive](https://proton.me/drive)
+  - [x] [139yun](https://yun.139.com) (Personal, Family, Group, Share)
+  - [x] [YandexDisk](https://disk.yandex.com)
+  - [x] [BaiduNetdisk](http://pan.baidu.com)
+  - [x] [Terabox](https://www.terabox.com/main)
+  - [x] [UC](https://drive.uc.cn)
+  - [x] [Quark](https://pan.quark.cn)
+  - [x] [Thunder](https://pan.xunlei.com)
+  - [x] [Lanzou](https://www.lanzou.com)
+  - [x] [ILanzou](https://www.ilanzou.com)
+  - [x] [Google photo](https://photos.google.com)
+  - [x] [Mega.nz](https://mega.nz)
+  - [x] [Baidu photo](https://photo.baidu.com)
+  - [x] [SMB](https://en.wikipedia.org/wiki/Server_Message_Block)
+  - [x] [115](https://115.com)
+  - [x] [Cloudreve](https://cloudreve.org)
+  - [x] [Dropbox](https://www.dropbox.com)
+  - [x] [FeijiPan](https://www.feijipan.com)
+  - [x] [dogecloud](https://www.dogecloud.com/product/oss)
+  - [x] [Azure Blob Storage](https://azure.microsoft.com/products/storage/blobs)
+  - [x] [Chaoxing](https://www.chaoxing.com)
+  - [x] [CNB](https://cnb.cool/)
+  - [x] [Degoo](https://degoo.com)
+  - [x] [Doubao](https://www.doubao.com)
+  - [x] [Febbox](https://www.febbox.com)
+  - [x] [GitHub](https://github.com)
+  - [x] [OpenList](https://github.com/OpenListTeam/OpenList)
+  - [x] [Teldrive](https://github.com/tgdrive/teldrive)
+  - [x] [Weiyun](https://www.weiyun.com)
+  - [x] [DingTalk Docs](https://alidocs.dingtalk.com/)
+- [x] Easy to deploy and out-of-the-box
+- [x] File preview (PDF, markdown, code, plain text, ...)
+- [x] Image preview in gallery mode
+- [x] Video and audio preview, with lyrics and subtitles support
+- [x] Office document preview (docx, pptx, xlsx, ...)
+- [x] `README.md` preview rendering
+- [x] File permalink copy and direct file download
+- [x] Dark mode and i18n
+- [x] Protected routes, WebDAV, Docker deploy, and Cloudflare Workers proxy
+- [x] File/folder package download and web upload operations
+- [x] Offline download, cross-storage copy, and multi-thread download acceleration
+
+## Dokumentation
+
+- 📘 [Docs](https://doc.oplist.org)
+- 🌏 [CN Mirror](https://doc.oplist.org.cn)
+- ⚖️ [Terms of Use](https://doc.oplist.org/terms)
+- 🔒 [Privacy Policy](https://doc.oplist.org/privacy)
+
+## Demo
+
+- 🌎 [Global Demo](https://demo.oplist.org)
+- 🇨🇳 [CN Demo](https://demo.oplist.org.cn)
+
+## Diskussion
+
+Please refer to [Discussions](https://github.com/OpenListTeam/OpenList/discussions) for general questions; Issues are for bug reports and feature requests only.
+
+## Sponsor
+
+[![VPS.Town](https://vps.town/static/images/sponsor.png)](https://vps.town "VPS.Town - Trust, Effortlessly. Your Cloud, Reimagined.")
+
+## Spender
+
+Thanks to the following donors for their generous support:
+
+- [HisAtri](https://github.com/HisAtri)
+- 爱发电用户_7jTh
+- suka
+
+## Lizenz
+
+OpenList is open-source software licensed under the [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.txt) license.
+
+## Kontakt
+
+- [@GitHub](https://github.com/OpenListTeam)
+- [Telegram Group](https://t.me/OpenListTeam)
+- [Telegram Channel](https://t.me/OpenListOfficial)
+
+## Mitwirkende
+
+We sincerely thank [Xhofe](https://github.com/Xhofe), author of the original project [AlistGo/alist](https://github.com/AlistGo/alist), and all other contributors.
+
+[![Contributors](https://contrib.rocks/image?repo=OpenListTeam/OpenList)](https://github.com/OpenListTeam/OpenList/graphs/contributors)
@@ -0,0 +1,136 @@
+<div align="center">
+  <img src="https://raw.githubusercontent.com/OpenListTeam/Logo/main/logo.svg" width="128" height="128" alt="logo" />
+
+  <p><em>OpenList es un fork de AList resiliente, con gobernanza a largo plazo e impulsado por la comunidad, creado para defender el código abierto frente a ataques basados en la confianza.</em></p>
+
+  <img src="https://goreportcard.com/badge/github.com/OpenListTeam/OpenList/v3" alt="latest version" />
+  <a href="https://github.com/OpenListTeam/OpenList/blob/main/LICENSE"><img src="https://img.shields.io/github/license/OpenListTeam/OpenList" alt="License" /></a>
+  <a href="https://github.com/OpenListTeam/OpenList/actions?query=workflow%3ABuild"><img src="https://img.shields.io/github/actions/workflow/status/OpenListTeam/OpenList/build.yml?branch=main" alt="Build status" /></a>
+  <a href="https://github.com/OpenListTeam/OpenList/releases"><img src="https://img.shields.io/github/release/OpenListTeam/OpenList" alt="latest version" /></a>
+
+  <a href="https://github.com/OpenListTeam/OpenList/discussions"><img src="https://img.shields.io/github/discussions/OpenListTeam/OpenList?color=%23ED8936" alt="discussions" /></a>
+  <a href="https://github.com/OpenListTeam/OpenList/releases"><img src="https://img.shields.io/github/downloads/OpenListTeam/OpenList/total?color=%239F7AEA&logo=github" alt="Downloads" /></a>
+</div>
+
+---
+
+- [English](../README.md) | [中文](./README_cn.md) | [日本語](./README_ja.md) | [Dutch](./README_nl.md) | [한국어](./README_ko.md) | [Deutsch](./README_de.md) | [Русский](./README_ru.md) | [Français](./README_fr.md) | Español | [العربية](./README_ar.md)
+
+- [Contributing](../CONTRIBUTING.md)
+- [CODE OF CONDUCT](../CODE_OF_CONDUCT.md)
+- [LICENSE](../LICENSE)
+
+## Aviso legal
+
+OpenList is an open-source project independently maintained by the OpenList Team under the AGPL-3.0 license, with a commitment to code openness and modification transparency.
+
+OpenList has no official association with third-party derivative projects that use similar names, including OpenListApp/OpenListApp or paid proprietary software using the same or similar names.
+
+- All software, code, and services of this project are maintained by the OpenList Team and are freely available on GitHub.
+- Project documentation and API services primarily rely on charitable resources provided by Cloudflare. There are currently no paid plans or commercial deployments.
+- Downstream projects should not use the "OpenList" name for impersonation or commercial confusion, and must not distribute OpenList-based code as closed source in violation of the AGPL license.
+- This software is provided "as is" without warranties. Please comply with applicable laws and regulations when using it.
+
+## Características
+
+- [x] Multiple storages
+  - [x] Local storage
+  - [x] [Aliyundrive](https://www.alipan.com)
+  - [x] OneDrive / Sharepoint ([Global](https://www.microsoft.com/en-us/microsoft-365/onedrive/online-cloud-storage), [CN](https://portal.partner.microsoftonline.cn), DE, US)
+  - [x] [189cloud](https://cloud.189.cn) (Personal, Family)
+  - [x] [GoogleDrive](https://drive.google.com)
+  - [x] [123pan](https://www.123pan.com)
+  - [x] [FTP / SFTP](https://en.wikipedia.org/wiki/File_Transfer_Protocol)
+  - [x] [PikPak](https://www.mypikpak.com)
+  - [x] [S3](https://aws.amazon.com/s3)
+  - [x] [Seafile](https://seafile.com)
+  - [x] [UPYUN Storage Service](https://www.upyun.com/products/file-storage)
+  - [x] [WebDAV](https://en.wikipedia.org/wiki/WebDAV)
+  - [x] Teambition([China](https://www.teambition.com), [International](https://us.teambition.com))
+  - [x] [MediaFire](https://www.mediafire.com)
+  - [x] [Mediatrack](https://www.mediatrack.cn)
+  - [x] [ProtonDrive](https://proton.me/drive)
+  - [x] [139yun](https://yun.139.com) (Personal, Family, Group, Share)
+  - [x] [YandexDisk](https://disk.yandex.com)
+  - [x] [BaiduNetdisk](http://pan.baidu.com)
+  - [x] [Terabox](https://www.terabox.com/main)
+  - [x] [UC](https://drive.uc.cn)
+  - [x] [Quark](https://pan.quark.cn)
+  - [x] [Thunder](https://pan.xunlei.com)
+  - [x] [Lanzou](https://www.lanzou.com)
+  - [x] [ILanzou](https://www.ilanzou.com)
+  - [x] [Google photo](https://photos.google.com)
+  - [x] [Mega.nz](https://mega.nz)
+  - [x] [Baidu photo](https://photo.baidu.com)
+  - [x] [SMB](https://en.wikipedia.org/wiki/Server_Message_Block)
+  - [x] [115](https://115.com)
+  - [x] [Cloudreve](https://cloudreve.org)
+  - [x] [Dropbox](https://www.dropbox.com)
+  - [x] [FeijiPan](https://www.feijipan.com)
+  - [x] [dogecloud](https://www.dogecloud.com/product/oss)
+  - [x] [Azure Blob Storage](https://azure.microsoft.com/products/storage/blobs)
+  - [x] [Chaoxing](https://www.chaoxing.com)
+  - [x] [CNB](https://cnb.cool/)
+  - [x] [Degoo](https://degoo.com)
+  - [x] [Doubao](https://www.doubao.com)
+  - [x] [Febbox](https://www.febbox.com)
+  - [x] [GitHub](https://github.com)
+  - [x] [OpenList](https://github.com/OpenListTeam/OpenList)
+  - [x] [Teldrive](https://github.com/tgdrive/teldrive)
+  - [x] [Weiyun](https://www.weiyun.com)
+  - [x] [DingTalk Docs](https://alidocs.dingtalk.com/)
+- [x] Easy to deploy and out-of-the-box
+- [x] File preview (PDF, markdown, code, plain text, ...)
+- [x] Image preview in gallery mode
+- [x] Video and audio preview, with lyrics and subtitles support
+- [x] Office document preview (docx, pptx, xlsx, ...)
+- [x] `README.md` preview rendering
+- [x] File permalink copy and direct file download
+- [x] Dark mode and i18n
+- [x] Protected routes, WebDAV, Docker deploy, and Cloudflare Workers proxy
+- [x] File/folder package download and web upload operations
+- [x] Offline download, cross-storage copy, and multi-thread download acceleration
+
+## Documentación
+
+- 📘 [Docs](https://doc.oplist.org)
+- 🌏 [CN Mirror](https://doc.oplist.org.cn)
+- ⚖️ [Terms of Use](https://doc.oplist.org/terms)
+- 🔒 [Privacy Policy](https://doc.oplist.org/privacy)
+
+## Demo
+
+- 🌎 [Global Demo](https://demo.oplist.org)
+- 🇨🇳 [CN Demo](https://demo.oplist.org.cn)
+
+## Discusión
+
+Please refer to [Discussions](https://github.com/OpenListTeam/OpenList/discussions) for general questions; Issues are for bug reports and feature requests only.
+
+## Patrocinador
+
+[![VPS.Town](https://vps.town/static/images/sponsor.png)](https://vps.town "VPS.Town - Trust, Effortlessly. Your Cloud, Reimagined.")
+
+## Donantes
+
+Thanks to the following donors for their generous support:
+
+- [HisAtri](https://github.com/HisAtri)
+- 爱发电用户_7jTh
+- suka
+
+## Licencia
+
+OpenList is open-source software licensed under the [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.txt) license.
+
+## Contacto
+
+- [@GitHub](https://github.com/OpenListTeam)
+- [Telegram Group](https://t.me/OpenListTeam)
+- [Telegram Channel](https://t.me/OpenListOfficial)
+
+## Colaboradores
+
+We sincerely thank [Xhofe](https://github.com/Xhofe), author of the original project [AlistGo/alist](https://github.com/AlistGo/alist), and all other contributors.
+
+[![Contributors](https://contrib.rocks/image?repo=OpenListTeam/OpenList)](https://github.com/OpenListTeam/OpenList/graphs/contributors)
@@ -0,0 +1,136 @@
+<div align="center">
+  <img src="https://raw.githubusercontent.com/OpenListTeam/Logo/main/logo.svg" width="128" height="128" alt="logo" />
+
+  <p><em>OpenList est un fork d’AList résilient, gouverné sur le long terme et porté par la communauté, conçu pour protéger l’open source contre les attaques fondées sur la confiance.</em></p>
+
+  <img src="https://goreportcard.com/badge/github.com/OpenListTeam/OpenList/v3" alt="latest version" />
+  <a href="https://github.com/OpenListTeam/OpenList/blob/main/LICENSE"><img src="https://img.shields.io/github/license/OpenListTeam/OpenList" alt="License" /></a>
+  <a href="https://github.com/OpenListTeam/OpenList/actions?query=workflow%3ABuild"><img src="https://img.shields.io/github/actions/workflow/status/OpenListTeam/OpenList/build.yml?branch=main" alt="Build status" /></a>
+  <a href="https://github.com/OpenListTeam/OpenList/releases"><img src="https://img.shields.io/github/release/OpenListTeam/OpenList" alt="latest version" /></a>
+
+  <a href="https://github.com/OpenListTeam/OpenList/discussions"><img src="https://img.shields.io/github/discussions/OpenListTeam/OpenList?color=%23ED8936" alt="discussions" /></a>
+  <a href="https://github.com/OpenListTeam/OpenList/releases"><img src="https://img.shields.io/github/downloads/OpenListTeam/OpenList/total?color=%239F7AEA&logo=github" alt="Downloads" /></a>
+</div>
+
+---
+
+- [English](../README.md) | [中文](./README_cn.md) | [日本語](./README_ja.md) | [Dutch](./README_nl.md) | [한국어](./README_ko.md) | [Deutsch](./README_de.md) | [Русский](./README_ru.md) | Français | [Español](./README_es.md) | [العربية](./README_ar.md)
+
+- [Contributing](../CONTRIBUTING.md)
+- [CODE OF CONDUCT](../CODE_OF_CONDUCT.md)
+- [LICENSE](../LICENSE)
+
+## Avertissement
+
+OpenList is an open-source project independently maintained by the OpenList Team under the AGPL-3.0 license, with a commitment to code openness and modification transparency.
+
+OpenList has no official association with third-party derivative projects that use similar names, including OpenListApp/OpenListApp or paid proprietary software using the same or similar names.
+
+- All software, code, and services of this project are maintained by the OpenList Team and are freely available on GitHub.
+- Project documentation and API services primarily rely on charitable resources provided by Cloudflare. There are currently no paid plans or commercial deployments.
+- Downstream projects should not use the "OpenList" name for impersonation or commercial confusion, and must not distribute OpenList-based code as closed source in violation of the AGPL license.
+- This software is provided "as is" without warranties. Please comply with applicable laws and regulations when using it.
+
+## Fonctionnalités
+
+- [x] Multiple storages
+  - [x] Local storage
+  - [x] [Aliyundrive](https://www.alipan.com)
+  - [x] OneDrive / Sharepoint ([Global](https://www.microsoft.com/en-us/microsoft-365/onedrive/online-cloud-storage), [CN](https://portal.partner.microsoftonline.cn), DE, US)
+  - [x] [189cloud](https://cloud.189.cn) (Personal, Family)
+  - [x] [GoogleDrive](https://drive.google.com)
+  - [x] [123pan](https://www.123pan.com)
+  - [x] [FTP / SFTP](https://en.wikipedia.org/wiki/File_Transfer_Protocol)
+  - [x] [PikPak](https://www.mypikpak.com)
+  - [x] [S3](https://aws.amazon.com/s3)
+  - [x] [Seafile](https://seafile.com)
+  - [x] [UPYUN Storage Service](https://www.upyun.com/products/file-storage)
+  - [x] [WebDAV](https://en.wikipedia.org/wiki/WebDAV)
+  - [x] Teambition([China](https://www.teambition.com), [International](https://us.teambition.com))
+  - [x] [MediaFire](https://www.mediafire.com)
+  - [x] [Mediatrack](https://www.mediatrack.cn)
+  - [x] [ProtonDrive](https://proton.me/drive)
+  - [x] [139yun](https://yun.139.com) (Personal, Family, Group, Share)
+  - [x] [YandexDisk](https://disk.yandex.com)
+  - [x] [BaiduNetdisk](http://pan.baidu.com)
+  - [x] [Terabox](https://www.terabox.com/main)
+  - [x] [UC](https://drive.uc.cn)
+  - [x] [Quark](https://pan.quark.cn)
+  - [x] [Thunder](https://pan.xunlei.com)
+  - [x] [Lanzou](https://www.lanzou.com)
+  - [x] [ILanzou](https://www.ilanzou.com)
+  - [x] [Google photo](https://photos.google.com)
+  - [x] [Mega.nz](https://mega.nz)
+  - [x] [Baidu photo](https://photo.baidu.com)
+  - [x] [SMB](https://en.wikipedia.org/wiki/Server_Message_Block)
+  - [x] [115](https://115.com)
+  - [x] [Cloudreve](https://cloudreve.org)
+  - [x] [Dropbox](https://www.dropbox.com)
+  - [x] [FeijiPan](https://www.feijipan.com)
+  - [x] [dogecloud](https://www.dogecloud.com/product/oss)
+  - [x] [Azure Blob Storage](https://azure.microsoft.com/products/storage/blobs)
+  - [x] [Chaoxing](https://www.chaoxing.com)
+  - [x] [CNB](https://cnb.cool/)
+  - [x] [Degoo](https://degoo.com)
+  - [x] [Doubao](https://www.doubao.com)
+  - [x] [Febbox](https://www.febbox.com)
+  - [x] [GitHub](https://github.com)
+  - [x] [OpenList](https://github.com/OpenListTeam/OpenList)
+  - [x] [Teldrive](https://github.com/tgdrive/teldrive)
+  - [x] [Weiyun](https://www.weiyun.com)
+  - [x] [DingTalk Docs](https://alidocs.dingtalk.com/)
+- [x] Easy to deploy and out-of-the-box
+- [x] File preview (PDF, markdown, code, plain text, ...)
+- [x] Image preview in gallery mode
+- [x] Video and audio preview, with lyrics and subtitles support
+- [x] Office document preview (docx, pptx, xlsx, ...)
+- [x] `README.md` preview rendering
+- [x] File permalink copy and direct file download
+- [x] Dark mode and i18n
+- [x] Protected routes, WebDAV, Docker deploy, and Cloudflare Workers proxy
+- [x] File/folder package download and web upload operations
+- [x] Offline download, cross-storage copy, and multi-thread download acceleration
+
+## Documentation
+
+- 📘 [Docs](https://doc.oplist.org)
+- 🌏 [CN Mirror](https://doc.oplist.org.cn)
+- ⚖️ [Terms of Use](https://doc.oplist.org/terms)
+- 🔒 [Privacy Policy](https://doc.oplist.org/privacy)
+
+## Démo
+
+- 🌎 [Global Demo](https://demo.oplist.org)
+- 🇨🇳 [CN Demo](https://demo.oplist.org.cn)
+
+## Discussion
+
+Please refer to [Discussions](https://github.com/OpenListTeam/OpenList/discussions) for general questions; Issues are for bug reports and feature requests only.
+
+## Sponsor
+
+[![VPS.Town](https://vps.town/static/images/sponsor.png)](https://vps.town "VPS.Town - Trust, Effortlessly. Your Cloud, Reimagined.")
+
+## Donateurs
+
+Thanks to the following donors for their generous support:
+
+- [HisAtri](https://github.com/HisAtri)
+- 爱发电用户_7jTh
+- suka
+
+## Licence
+
+OpenList is open-source software licensed under the [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.txt) license.
+
+## Nous contacter
+
+- [@GitHub](https://github.com/OpenListTeam)
+- [Telegram Group](https://t.me/OpenListTeam)
+- [Telegram Channel](https://t.me/OpenListOfficial)
+
+## Contributeurs
+
+We sincerely thank [Xhofe](https://github.com/Xhofe), author of the original project [AlistGo/alist](https://github.com/AlistGo/alist), and all other contributors.
+
+[![Contributors](https://contrib.rocks/image?repo=OpenListTeam/OpenList)](https://github.com/OpenListTeam/OpenList/graphs/contributors)
@@ -14,11 +14,11 @@

 ---

- [English](./README.md) | [中文](./README_cn.md) | 日本語 | [Dutch](./README_nl.md)
+- [English](../README.md) | [中文](./README_cn.md) | 日本語 | [Dutch](./README_nl.md) | [한국어](./README_ko.md) | [Deutsch](./README_de.md) | [Русский](./README_ru.md) | [Français](./README_fr.md) | [Español](./README_es.md) | [العربية](./README_ar.md)

- [コントリビュート](./CONTRIBUTING.md)
- [行動規範](./CODE_OF_CONDUCT.md)
- [ライセンス](./LICENSE)
+- [コントリビュート](../CONTRIBUTING.md)
+- [行動規範](../CODE_OF_CONDUCT.md)
+- [ライセンス](../LICENSE)

 ## 免責事項

@@ -66,7 +66,7 @@ OpenListプロジェクトへのご支援とご理解をありがとうござい
  - [x] Teambition([中国](https://www.teambition.com), [国際](https://us.teambition.com))
  - [x] [Mediatrack](https://www.mediatrack.cn)
  - [x] [ProtonDrive](https://proton.me/drive)
-  - [x] [139yun](https://yun.139.com)（個人、家族、グループ）
+  - [x] [139yun](https://yun.139.com)（個人、家族、グループ、共有）
  - [x] [YandexDisk](https://disk.yandex.com)
  - [x] [BaiduNetdisk](http://pan.baidu.com)
  - [x] [Terabox](https://www.terabox.com/main)
@@ -94,6 +94,7 @@ OpenListプロジェクトへのご支援とご理解をありがとうござい
  - [x] [OpenList](https://github.com/OpenListTeam/OpenList)
  - [x] [Teldrive](https://github.com/tgdrive/teldrive)
  - [x] [Weiyun](https://www.weiyun.com)
+  - [x] [DingTalk ドキュメント](https://alidocs.dingtalk.com/)
  - [x] [MediaFire](https://www.mediafire.com)
 - [x] 簡単にデプロイでき、すぐに使える
 - [x] ファイルプレビュー（PDF、markdown、コード、テキストなど）
@@ -116,14 +117,15 @@ OpenListプロジェクトへのご支援とご理解をありがとうござい

 ## ドキュメント

- 📘 [グローバルサイト](https://doc.oplist.org)
- 📚 [バックアップサイト](https://doc.openlist.team)
- 🌏 [CNサイト](https://doc.oplist.org.cn)
+- 📘 [ドキュメント](https://doc.oplist.org)
+- 🌏 [中国ミラー](https://doc.oplist.org.cn)
+- ⚖️ [利用規約](https://doc.oplist.org/terms)
+- 🔒 [プライバシーポリシー](https://doc.oplist.org/privacy)

-## デモ
+## Demo

- 🌎 [グローバルデモ](https://demo.oplist.org)
- 🇨🇳 [CNデモ](https://demo.oplist.org.cn)
+- 🌎 [グローバル Demo](https://demo.oplist.org)
+- 🇨🇳 [中国 Demo](https://demo.oplist.org.cn)

 ## ディスカッション

@@ -133,6 +135,14 @@ OpenListプロジェクトへのご支援とご理解をありがとうござい

 [![VPS.Town](https://vps.town/static/images/sponsor.png)](https://vps.town "VPS.Town - Trust, Effortlessly. Your Cloud, Reimagined.")

+## 寄付者
+
+以下の方々の寛大なご支援に感謝いたします：
+
+- [HisAtri](https://github.com/HisAtri)
+- 爱发电用户_7jTh
+- suka
+
 ## ライセンス

 「OpenList」は [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.txt) ライセンスの下で公開されているオープンソースソフトウェアです。
@@ -147,7 +157,7 @@ OpenListプロジェクトへのご支援とご理解をありがとうござい
 - 本ソフトウェアは「現状有姿」で提供されており、商品性や特定目的への適合性を含むいかなる保証もありません。
 - 本ソフトウェアの使用または使用不能によるいかなる直接的・間接的損害についても、メンテナは責任を負いません。
 - 本ソフトウェアの利用に伴うすべてのリスク（アカウントの凍結やダウンロード速度制限などを含む）は、利用者自身が負うものとします。
- 本プロジェクトは [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.txt) ライセンスに従います。詳細は [LICENSE](./LICENSE) ファイルをご覧ください。
+- 本プロジェクトは [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.txt) ライセンスに従います。詳細は [LICENSE](../LICENSE) ファイルをご覧ください。

 ## お問い合わせ

@@ -0,0 +1,136 @@
+<div align="center">
+  <img src="https://raw.githubusercontent.com/OpenListTeam/Logo/main/logo.svg" width="128" height="128" alt="logo" />
+
+  <p><em>OpenList는 신뢰 기반 공격으로부터 오픈 소스를 보호하기 위해 만들어진, 탄력적이고 장기 거버넌스를 지향하는 커뮤니티 주도 AList 포크입니다.</em></p>
+
+  <img src="https://goreportcard.com/badge/github.com/OpenListTeam/OpenList/v3" alt="latest version" />
+  <a href="https://github.com/OpenListTeam/OpenList/blob/main/LICENSE"><img src="https://img.shields.io/github/license/OpenListTeam/OpenList" alt="License" /></a>
+  <a href="https://github.com/OpenListTeam/OpenList/actions?query=workflow%3ABuild"><img src="https://img.shields.io/github/actions/workflow/status/OpenListTeam/OpenList/build.yml?branch=main" alt="Build status" /></a>
+  <a href="https://github.com/OpenListTeam/OpenList/releases"><img src="https://img.shields.io/github/release/OpenListTeam/OpenList" alt="latest version" /></a>
+
+  <a href="https://github.com/OpenListTeam/OpenList/discussions"><img src="https://img.shields.io/github/discussions/OpenListTeam/OpenList?color=%23ED8936" alt="discussions" /></a>
+  <a href="https://github.com/OpenListTeam/OpenList/releases"><img src="https://img.shields.io/github/downloads/OpenListTeam/OpenList/total?color=%239F7AEA&logo=github" alt="Downloads" /></a>
+</div>
+
+---
+
+- [English](../README.md) | [中文](./README_cn.md) | [日本語](./README_ja.md) | [Dutch](./README_nl.md) | 한국어 | [Deutsch](./README_de.md) | [Русский](./README_ru.md) | [Français](./README_fr.md) | [Español](./README_es.md) | [العربية](./README_ar.md)
+
+- [Contributing](../CONTRIBUTING.md)
+- [CODE OF CONDUCT](../CODE_OF_CONDUCT.md)
+- [LICENSE](../LICENSE)
+
+## 면책 조항
+
+OpenList is an open-source project independently maintained by the OpenList Team under the AGPL-3.0 license, with a commitment to code openness and modification transparency.
+
+OpenList has no official association with third-party derivative projects that use similar names, including OpenListApp/OpenListApp or paid proprietary software using the same or similar names.
+
+- All software, code, and services of this project are maintained by the OpenList Team and are freely available on GitHub.
+- Project documentation and API services primarily rely on charitable resources provided by Cloudflare. There are currently no paid plans or commercial deployments.
+- Downstream projects should not use the "OpenList" name for impersonation or commercial confusion, and must not distribute OpenList-based code as closed source in violation of the AGPL license.
+- This software is provided "as is" without warranties. Please comply with applicable laws and regulations when using it.
+
+## 기능
+
+- [x] Multiple storages
+  - [x] Local storage
+  - [x] [Aliyundrive](https://www.alipan.com)
+  - [x] OneDrive / Sharepoint ([Global](https://www.microsoft.com/en-us/microsoft-365/onedrive/online-cloud-storage), [CN](https://portal.partner.microsoftonline.cn), DE, US)
+  - [x] [189cloud](https://cloud.189.cn) (Personal, Family)
+  - [x] [GoogleDrive](https://drive.google.com)
+  - [x] [123pan](https://www.123pan.com)
+  - [x] [FTP / SFTP](https://en.wikipedia.org/wiki/File_Transfer_Protocol)
+  - [x] [PikPak](https://www.mypikpak.com)
+  - [x] [S3](https://aws.amazon.com/s3)
+  - [x] [Seafile](https://seafile.com)
+  - [x] [UPYUN Storage Service](https://www.upyun.com/products/file-storage)
+  - [x] [WebDAV](https://en.wikipedia.org/wiki/WebDAV)
+  - [x] Teambition([China](https://www.teambition.com), [International](https://us.teambition.com))
+  - [x] [MediaFire](https://www.mediafire.com)
+  - [x] [Mediatrack](https://www.mediatrack.cn)
+  - [x] [ProtonDrive](https://proton.me/drive)
+  - [x] [139yun](https://yun.139.com) (Personal, Family, Group, Share)
+  - [x] [YandexDisk](https://disk.yandex.com)
+  - [x] [BaiduNetdisk](http://pan.baidu.com)
+  - [x] [Terabox](https://www.terabox.com/main)
+  - [x] [UC](https://drive.uc.cn)
+  - [x] [Quark](https://pan.quark.cn)
+  - [x] [Thunder](https://pan.xunlei.com)
+  - [x] [Lanzou](https://www.lanzou.com)
+  - [x] [ILanzou](https://www.ilanzou.com)
+  - [x] [Google photo](https://photos.google.com)
+  - [x] [Mega.nz](https://mega.nz)
+  - [x] [Baidu photo](https://photo.baidu.com)
+  - [x] [SMB](https://en.wikipedia.org/wiki/Server_Message_Block)
+  - [x] [115](https://115.com)
+  - [x] [Cloudreve](https://cloudreve.org)
+  - [x] [Dropbox](https://www.dropbox.com)
+  - [x] [FeijiPan](https://www.feijipan.com)
+  - [x] [dogecloud](https://www.dogecloud.com/product/oss)
+  - [x] [Azure Blob Storage](https://azure.microsoft.com/products/storage/blobs)
+  - [x] [Chaoxing](https://www.chaoxing.com)
+  - [x] [CNB](https://cnb.cool/)
+  - [x] [Degoo](https://degoo.com)
+  - [x] [Doubao](https://www.doubao.com)
+  - [x] [Febbox](https://www.febbox.com)
+  - [x] [GitHub](https://github.com)
+  - [x] [OpenList](https://github.com/OpenListTeam/OpenList)
+  - [x] [Teldrive](https://github.com/tgdrive/teldrive)
+  - [x] [Weiyun](https://www.weiyun.com)
+  - [x] [DingTalk Docs](https://alidocs.dingtalk.com/)
+- [x] Easy to deploy and out-of-the-box
+- [x] File preview (PDF, markdown, code, plain text, ...)
+- [x] Image preview in gallery mode
+- [x] Video and audio preview, with lyrics and subtitles support
+- [x] Office document preview (docx, pptx, xlsx, ...)
+- [x] `README.md` preview rendering
+- [x] File permalink copy and direct file download
+- [x] Dark mode and i18n
+- [x] Protected routes, WebDAV, Docker deploy, and Cloudflare Workers proxy
+- [x] File/folder package download and web upload operations
+- [x] Offline download, cross-storage copy, and multi-thread download acceleration
+
+## 문서
+
+- 📘 [Docs](https://doc.oplist.org)
+- 🌏 [CN Mirror](https://doc.oplist.org.cn)
+- ⚖️ [Terms of Use](https://doc.oplist.org/terms)
+- 🔒 [Privacy Policy](https://doc.oplist.org/privacy)
+
+## 데모
+
+- 🌎 [Global Demo](https://demo.oplist.org)
+- 🇨🇳 [CN Demo](https://demo.oplist.org.cn)
+
+## 토론
+
+Please refer to [Discussions](https://github.com/OpenListTeam/OpenList/discussions) for general questions; Issues are for bug reports and feature requests only.
+
+## 후원
+
+[![VPS.Town](https://vps.town/static/images/sponsor.png)](https://vps.town "VPS.Town - Trust, Effortlessly. Your Cloud, Reimagined.")
+
+## 후원자
+
+Thanks to the following donors for their generous support:
+
+- [HisAtri](https://github.com/HisAtri)
+- 爱发电用户_7jTh
+- suka
+
+## 라이선스
+
+OpenList is open-source software licensed under the [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.txt) license.
+
+## 문의
+
+- [@GitHub](https://github.com/OpenListTeam)
+- [Telegram Group](https://t.me/OpenListTeam)
+- [Telegram Channel](https://t.me/OpenListOfficial)
+
+## 기여자
+
+We sincerely thank [Xhofe](https://github.com/Xhofe), author of the original project [AlistGo/alist](https://github.com/AlistGo/alist), and all other contributors.
+
+[![Contributors](https://contrib.rocks/image?repo=OpenListTeam/OpenList)](https://github.com/OpenListTeam/OpenList/graphs/contributors)
@@ -14,11 +14,11 @@

 ---

- [English](./README.md) | [中文](./README_cn.md) | [日本語](./README_ja.md) | Dutch
+- [English](../README.md) | [中文](./README_cn.md) | [日本語](./README_ja.md) | Dutch | [한국어](./README_ko.md) | [Deutsch](./README_de.md) | [Русский](./README_ru.md) | [Français](./README_fr.md) | [Español](./README_es.md) | [العربية](./README_ar.md)

- [Bijdragen](./CONTRIBUTING.md)
- [Gedragscode](./CODE_OF_CONDUCT.md)
- [Licentie](./LICENSE)
+- [Bijdragen](../CONTRIBUTING.md)
+- [Gedragscode](../CODE_OF_CONDUCT.md)
+- [Licentie](../LICENSE)

 ## Disclaimer

@@ -67,7 +67,7 @@ Dank u voor uw ondersteuning en begrip
  - [x] [MediaFire](https://www.mediafire.com)
  - [x] [Mediatrack](https://www.mediatrack.cn)
  - [x] [ProtonDrive](https://proton.me/drive)
-  - [x] [139yun](https://yun.139.com) (Persoonlijk, Familie, Groep)
+  - [x] [139yun](https://yun.139.com) (Persoonlijk, Familie, Groep, Delen)
  - [x] [YandexDisk](https://disk.yandex.com)
  - [x] [BaiduNetdisk](http://pan.baidu.com)
  - [x] [Terabox](https://www.terabox.com/main)
@@ -95,6 +95,7 @@ Dank u voor uw ondersteuning en begrip
  - [x] [OpenList](https://github.com/OpenListTeam/OpenList)
  - [x] [Teldrive](https://github.com/tgdrive/teldrive)
  - [x] [Weiyun](https://www.weiyun.com)
+  - [x] [DingTalk-documenten](https://alidocs.dingtalk.com/)
 - [x] Eenvoudig te implementeren en direct te gebruiken
 - [x] Bestandsvoorbeeld (PDF, markdown, code, platte tekst, ...)
 - [x] Afbeeldingsvoorbeeld in galerijweergave
@@ -116,9 +117,10 @@ Dank u voor uw ondersteuning en begrip

 ## Documentatie

- 📘 [Global Site](https://doc.oplist.org)
- 📚 [Backup Site](https://doc.openlist.team)
- 🌏 [CN Site](https://doc.oplist.org.cn)
+- 📘 [Documentatie](https://doc.oplist.org)
+- 🌏 [CN Mirror](https://doc.oplist.org.cn)
+- ⚖️ [Gebruiksvoorwaarden](https://doc.oplist.org/terms)
+- 🔒 [Privacybeleid](https://doc.oplist.org/privacy)

 ## Demo

@@ -133,6 +135,14 @@ Stel algemene vragen in [*Discussions*](https://github.com/OpenListTeam/OpenList

 [![VPS.Town](https://vps.town/static/images/sponsor.png)](https://vps.town "VPS.Town - Trust, Effortlessly. Your Cloud, Reimagined.")

+## Donatie Bijdragers
+
+Dank aan de volgende donateurs voor hun steun:
+
+- [HisAtri](https://github.com/HisAtri)
+- 爱发电用户_7jTh
+- suka
+
 ## Licentie

 `OpenList` is open-source software onder de [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.txt) licentie.
@@ -147,7 +157,7 @@ Stel algemene vragen in [*Discussions*](https://github.com/OpenListTeam/OpenList
 - De software wordt geleverd "zoals deze is", zonder enige vorm van garantie, expliciet of impliciet, inclusief maar niet beperkt tot garanties van verkoopbaarheid of geschiktheid voor een bepaald doel.
 - De beheerders zijn niet aansprakelijk voor enige directe of indirecte schade die voortvloeit uit het gebruik van of het onvermogen om deze software te gebruiken.
 - U bent zelf verantwoordelijk voor alle risico's die gepaard gaan met het gebruik van deze software, inclusief maar niet beperkt tot accountblokkades of downloadbeperkingen.
- Dit project valt onder de [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.txt) licentie. Zie het [LICENSE](./LICENSE) bestand voor details.
+- Dit project valt onder de [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.txt) licentie. Zie het [LICENSE](../LICENSE) bestand voor details.

 ## Contact

@@ -0,0 +1,136 @@
+<div align="center">
+  <img src="https://raw.githubusercontent.com/OpenListTeam/Logo/main/logo.svg" width="128" height="128" alt="logo" />
+
+  <p><em>OpenList — устойчивый, управляемый сообществом форк AList с долгосрочным управлением, созданный для защиты open source от атак, основанных на доверии.</em></p>
+
+  <img src="https://goreportcard.com/badge/github.com/OpenListTeam/OpenList/v3" alt="latest version" />
+  <a href="https://github.com/OpenListTeam/OpenList/blob/main/LICENSE"><img src="https://img.shields.io/github/license/OpenListTeam/OpenList" alt="License" /></a>
+  <a href="https://github.com/OpenListTeam/OpenList/actions?query=workflow%3ABuild"><img src="https://img.shields.io/github/actions/workflow/status/OpenListTeam/OpenList/build.yml?branch=main" alt="Build status" /></a>
+  <a href="https://github.com/OpenListTeam/OpenList/releases"><img src="https://img.shields.io/github/release/OpenListTeam/OpenList" alt="latest version" /></a>
+
+  <a href="https://github.com/OpenListTeam/OpenList/discussions"><img src="https://img.shields.io/github/discussions/OpenListTeam/OpenList?color=%23ED8936" alt="discussions" /></a>
+  <a href="https://github.com/OpenListTeam/OpenList/releases"><img src="https://img.shields.io/github/downloads/OpenListTeam/OpenList/total?color=%239F7AEA&logo=github" alt="Downloads" /></a>
+</div>
+
+---
+
+- [English](../README.md) | [中文](./README_cn.md) | [日本語](./README_ja.md) | [Dutch](./README_nl.md) | [한국어](./README_ko.md) | [Deutsch](./README_de.md) | Русский | [Français](./README_fr.md) | [Español](./README_es.md) | [العربية](./README_ar.md)
+
+- [Contributing](../CONTRIBUTING.md)
+- [CODE OF CONDUCT](../CODE_OF_CONDUCT.md)
+- [LICENSE](../LICENSE)
+
+## Отказ от ответственности
+
+OpenList is an open-source project independently maintained by the OpenList Team under the AGPL-3.0 license, with a commitment to code openness and modification transparency.
+
+OpenList has no official association with third-party derivative projects that use similar names, including OpenListApp/OpenListApp or paid proprietary software using the same or similar names.
+
+- All software, code, and services of this project are maintained by the OpenList Team and are freely available on GitHub.
+- Project documentation and API services primarily rely on charitable resources provided by Cloudflare. There are currently no paid plans or commercial deployments.
+- Downstream projects should not use the "OpenList" name for impersonation or commercial confusion, and must not distribute OpenList-based code as closed source in violation of the AGPL license.
+- This software is provided "as is" without warranties. Please comply with applicable laws and regulations when using it.
+
+## Возможности
+
+- [x] Multiple storages
+  - [x] Local storage
+  - [x] [Aliyundrive](https://www.alipan.com)
+  - [x] OneDrive / Sharepoint ([Global](https://www.microsoft.com/en-us/microsoft-365/onedrive/online-cloud-storage), [CN](https://portal.partner.microsoftonline.cn), DE, US)
+  - [x] [189cloud](https://cloud.189.cn) (Personal, Family)
+  - [x] [GoogleDrive](https://drive.google.com)
+  - [x] [123pan](https://www.123pan.com)
+  - [x] [FTP / SFTP](https://en.wikipedia.org/wiki/File_Transfer_Protocol)
+  - [x] [PikPak](https://www.mypikpak.com)
+  - [x] [S3](https://aws.amazon.com/s3)
+  - [x] [Seafile](https://seafile.com)
+  - [x] [UPYUN Storage Service](https://www.upyun.com/products/file-storage)
+  - [x] [WebDAV](https://en.wikipedia.org/wiki/WebDAV)
+  - [x] Teambition([China](https://www.teambition.com), [International](https://us.teambition.com))
+  - [x] [MediaFire](https://www.mediafire.com)
+  - [x] [Mediatrack](https://www.mediatrack.cn)
+  - [x] [ProtonDrive](https://proton.me/drive)
+  - [x] [139yun](https://yun.139.com) (Personal, Family, Group, Share)
+  - [x] [YandexDisk](https://disk.yandex.com)
+  - [x] [BaiduNetdisk](http://pan.baidu.com)
+  - [x] [Terabox](https://www.terabox.com/main)
+  - [x] [UC](https://drive.uc.cn)
+  - [x] [Quark](https://pan.quark.cn)
+  - [x] [Thunder](https://pan.xunlei.com)
+  - [x] [Lanzou](https://www.lanzou.com)
+  - [x] [ILanzou](https://www.ilanzou.com)
+  - [x] [Google photo](https://photos.google.com)
+  - [x] [Mega.nz](https://mega.nz)
+  - [x] [Baidu photo](https://photo.baidu.com)
+  - [x] [SMB](https://en.wikipedia.org/wiki/Server_Message_Block)
+  - [x] [115](https://115.com)
+  - [x] [Cloudreve](https://cloudreve.org)
+  - [x] [Dropbox](https://www.dropbox.com)
+  - [x] [FeijiPan](https://www.feijipan.com)
+  - [x] [dogecloud](https://www.dogecloud.com/product/oss)
+  - [x] [Azure Blob Storage](https://azure.microsoft.com/products/storage/blobs)
+  - [x] [Chaoxing](https://www.chaoxing.com)
+  - [x] [CNB](https://cnb.cool/)
+  - [x] [Degoo](https://degoo.com)
+  - [x] [Doubao](https://www.doubao.com)
+  - [x] [Febbox](https://www.febbox.com)
+  - [x] [GitHub](https://github.com)
+  - [x] [OpenList](https://github.com/OpenListTeam/OpenList)
+  - [x] [Teldrive](https://github.com/tgdrive/teldrive)
+  - [x] [Weiyun](https://www.weiyun.com)
+  - [x] [DingTalk Docs](https://alidocs.dingtalk.com/)
+- [x] Easy to deploy and out-of-the-box
+- [x] File preview (PDF, markdown, code, plain text, ...)
+- [x] Image preview in gallery mode
+- [x] Video and audio preview, with lyrics and subtitles support
+- [x] Office document preview (docx, pptx, xlsx, ...)
+- [x] `README.md` preview rendering
+- [x] File permalink copy and direct file download
+- [x] Dark mode and i18n
+- [x] Protected routes, WebDAV, Docker deploy, and Cloudflare Workers proxy
+- [x] File/folder package download and web upload operations
+- [x] Offline download, cross-storage copy, and multi-thread download acceleration
+
+## Документация
+
+- 📘 [Docs](https://doc.oplist.org)
+- 🌏 [CN Mirror](https://doc.oplist.org.cn)
+- ⚖️ [Terms of Use](https://doc.oplist.org/terms)
+- 🔒 [Privacy Policy](https://doc.oplist.org/privacy)
+
+## Демо
+
+- 🌎 [Global Demo](https://demo.oplist.org)
+- 🇨🇳 [CN Demo](https://demo.oplist.org.cn)
+
+## Обсуждение
+
+Please refer to [Discussions](https://github.com/OpenListTeam/OpenList/discussions) for general questions; Issues are for bug reports and feature requests only.
+
+## Спонсор
+
+[![VPS.Town](https://vps.town/static/images/sponsor.png)](https://vps.town "VPS.Town - Trust, Effortlessly. Your Cloud, Reimagined.")
+
+## Доноры
+
+Thanks to the following donors for their generous support:
+
+- [HisAtri](https://github.com/HisAtri)
+- 爱发电用户_7jTh
+- suka
+
+## Лицензия
+
+OpenList is open-source software licensed under the [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.txt) license.
+
+## Связаться с нами
+
+- [@GitHub](https://github.com/OpenListTeam)
+- [Telegram Group](https://t.me/OpenListTeam)
+- [Telegram Channel](https://t.me/OpenListOfficial)
+
+## Участники
+
+We sincerely thank [Xhofe](https://github.com/Xhofe), author of the original project [AlistGo/alist](https://github.com/AlistGo/alist), and all other contributors.
+
+[![Contributors](https://contrib.rocks/image?repo=OpenListTeam/OpenList)](https://github.com/OpenListTeam/OpenList/graphs/contributors)
@@ -1,7 +1,7 @@
 set -e
 appName="openlist"
 builtAt="$(date +'%F %T %z')"
-gitAuthor="The OpenList Projects Contributors <noreply@openlist.team>"
+gitAuthor="The OpenList Projects Contributors <noreply@oplist.org>"
 gitCommit=$(git log --pretty=format:"%h" -1)

 # Set frontend repository, default to OpenListTeam/OpenList-Frontend
@@ -97,7 +97,7 @@ AssertStaticBinary() {
 }

 FetchWebRolling() {
-  pre_release_json=$(eval "curl -fsSL --max-time 2 $githubAuthArgs -H \"Accept: application/vnd.github.v3+json\" \"https://api.github.com/repos/$frontendRepo/releases/tags/rolling\"")
+  pre_release_json=$(eval "curl -fsSL --max-time 2 $githubAuthArgs -H \"Accept: application/vnd.github.v3+json\" \"https://api.github.com/repos/$frontendRepo/releases/tags/edge\"")
  pre_release_assets=$(echo "$pre_release_json" | jq -r '.assets[].browser_download_url')
  
  # There is no lite for rolling
@@ -178,7 +178,6 @@ BuildWin7() {
 }

 BuildDev() {
-  rm -rf .git/
  mkdir -p "dist"
  muslflags="$(GetMuslStaticLdflags)"
  BASE="https://github.com/OpenListTeam/musl-compilers/releases/latest/download/"
@@ -269,7 +268,6 @@ BuildDockerMultiplatform() {
 }

 BuildRelease() {
-  rm -rf .git/
  mkdir -p "build"
  BuildWinArm64 ./build/"$appName"-windows-arm64.exe
  BuildWin7 ./build/"$appName"-windows7
@@ -289,7 +287,7 @@ BuildRelease() {
 BuildLoongGLIBC() {
  local target_abi="$2"
  local output_file="$1"
-  local oldWorldGoVersion="1.25.0"
+  local oldWorldGoVersion="1.26.4"
  local loong_tags
  loong_tags=$(GetBuildTagsForTarget "linux-loong64")
  
@@ -309,13 +307,13 @@ BuildLoongGLIBC() {
    
    # Download and setup patched Go compiler for old-world
    if ! curl -fsSL --retry 3 -H "Authorization: Bearer $GITHUB_TOKEN" \
-      "https://github.com/loong64/loong64-abi1.0-toolchains/releases/download/20250821/go${oldWorldGoVersion}.linux-amd64.tar.gz" \
+      "https://github.com/loong64-abi1-0/golang/releases/download/go${oldWorldGoVersion}/go${oldWorldGoVersion}.linux-amd64.tar.gz" \
      -o go-loong64-abi1.0.tar.gz; then
      echo "Error: Failed to download patched Go compiler for old-world ABI1.0"
      if [ -n "$GITHUB_TOKEN" ]; then
        echo "Error output from curl:"
        curl -fsSL --retry 3 -H "Authorization: Bearer $GITHUB_TOKEN" \
-          "https://github.com/loong64/loong64-abi1.0-toolchains/releases/download/20250821/go${oldWorldGoVersion}.linux-amd64.tar.gz" \
+          "https://github.com/loong64-abi1-0/golang/releases/download/go${oldWorldGoVersion}/go${oldWorldGoVersion}.linux-amd64.tar.gz" \
          -o go-loong64-abi1.0.tar.gz || true
      fi
      return 1
@@ -442,7 +440,6 @@ BuildLoongGLIBC() {
 }

 BuildReleaseLinuxMusl() {
-  rm -rf .git/
  mkdir -p "build"
  muslflags="$(GetMuslStaticLdflags)"
  BASE="https://github.com/OpenListTeam/musl-compilers/releases/latest/download/"
@@ -471,7 +468,6 @@ BuildReleaseLinuxMusl() {
 }

 BuildReleaseLinuxMuslArm() {
-  rm -rf .git/
  mkdir -p "build"
  muslflags="$(GetMuslStaticLdflags)"
  BASE="https://github.com/OpenListTeam/musl-compilers/releases/latest/download/"
@@ -502,7 +498,6 @@ BuildReleaseLinuxMuslArm() {


 BuildReleaseAndroid() {
-  rm -rf .git/
  mkdir -p "build"
  wget https://dl.google.com/android/repository/android-ndk-r26b-linux.zip
  unzip android-ndk-r26b-linux.zip
@@ -523,7 +518,6 @@ BuildReleaseAndroid() {
 }

 BuildReleaseFreeBSD() {
-  rm -rf .git/
  mkdir -p "build/freebsd"
  
  # Get latest FreeBSD 14.x release version from GitHub 
@@ -537,8 +531,8 @@ BuildReleaseFreeBSD() {
    sed 's/\.0$//')
  
  if [ -z "$freebsd_version" ]; then
-    echo "Failed to get FreeBSD version, falling back to 14.3"
-    freebsd_version="14.3"
+    echo "Failed to get FreeBSD version, falling back to 14.4"
+    freebsd_version="14.4"
  fi

  echo "Using FreeBSD version: $freebsd_version"
@@ -23,7 +23,7 @@ type options struct {

 	pwd                string //de/encrypt password
 	salt               string
-	filenameEncryption string //reference drivers\crypt\meta.go Addtion
+	filenameEncryption string //reference drivers\crypt\meta.go Addition
 	dirnameEncryption  string
 	filenameEncode     string
 	suffix             string
@@ -8,6 +8,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"strconv"
+	"strings"

 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
@@ -31,14 +32,23 @@ func start() {
 			return
 		}
 	}
-	args := os.Args
-	args[1] = "server"
-	args = append(args, "--force-bin-dir")
-	cmd := &exec.Cmd{
-		Path: args[0],
-		Args: args,
-		Env:  os.Environ(),
+	exe, err := os.Executable()
+	if err != nil {
+		log.Fatal("failed to resolve executable path: ", err)
 	}
+	childArgs := append([]string{"server"}, os.Args[2:]...)
+	hasForceBinDir := false
+	for _, arg := range childArgs {
+		if arg == "--force-bin-dir" || strings.HasPrefix(arg, "--force-bin-dir=") {
+			hasForceBinDir = true
+			break
+		}
+	}
+	if !hasForceBinDir {
+		childArgs = append(childArgs, "--force-bin-dir")
+	}
+	cmd := exec.Command(exe, childArgs...)
+	cmd.Env = os.Environ()
 	stdout, err := os.OpenFile(filepath.Join(filepath.Dir(pidFile), "start.log"), os.O_WRONLY|os.O_APPEND|os.O_CREATE, 0666)
 	if err != nil {
 		log.Fatal(os.Getpid(), ": failed to open start log file:", err)
@@ -1,565 +0,0 @@
-// Command openlist-transcode-worker 是独立的远程转码 Worker 节点。
-// 它通过 OpenList 自研协议（HTTP/JSON）注册到 Master，长轮询领任务，调用
-// 本机 ffmpeg 转码，并把生成的 HLS 切片实时上传回 Master。
-package main
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"flag"
-	"fmt"
-	"io"
-	"net/http"
-	"os"
-	"os/exec"
-	"os/signal"
-	"path/filepath"
-	"runtime"
-	"strconv"
-	"strings"
-	"sync"
-	"syscall"
-	"time"
-)
-
-var (
-	masterURL = flag.String("master", "http://127.0.0.1:5244", "OpenList Master URL")
-	secret    = flag.String("secret", "", "Worker 共享密钥（与 Master 配置一致）")
-	name      = flag.String("name", hostname(), "Worker 名称")
-	capacity  = flag.Int("capacity", 2, "并发任务数")
-	hwaccel   = flag.String("hwaccel", "none", "硬件加速：none/auto/nvenc/qsv/vaapi/amf/videotoolbox")
-	workdir   = flag.String("workdir", "./worker_tmp", "临时工作目录")
-	ffmpeg    = flag.String("ffmpeg", "ffmpeg", "ffmpeg 路径")
-)
-
-func hostname() string {
-	h, _ := os.Hostname()
-	if h == "" {
-		h = "worker"
-	}
-	return h
-}
-
-// ---- 协议结构 ----（与 Master 端 internal/transcode/protocol.go 一致）
-
-type RegisterReq struct {
-	Name          string   `json:"name"`
-	Version       string   `json:"version"`
-	Capacity      int      `json:"capacity"`
-	HWAccel       []string `json:"hwaccel"`
-	CodecsDecode  []string `json:"codecs_decode"`
-	CodecsEncode  []string `json:"codecs_encode"`
-	MaxResolution string   `json:"max_resolution"`
-	Tags          []string `json:"tags"`
-}
-type RegisterResp struct {
-	Data struct {
-		WorkerID          string `json:"worker_id"`
-		HeartbeatInterval int    `json:"heartbeat_interval"`
-	} `json:"data"`
-}
-
-type HeartbeatReq struct {
-	WorkerID  string   `json:"worker_id"`
-	Load      float64  `json:"load"`
-	Running   []string `json:"running"`
-	FreeSlots int      `json:"free_slots"`
-}
-type HeartbeatResp struct {
-	Data struct {
-		OK     bool     `json:"ok"`
-		Kick   bool     `json:"kick"`
-		Cancel []string `json:"cancel"`
-	} `json:"data"`
-}
-
-type ClaimReq struct {
-	WorkerID string `json:"worker_id"`
-	Slots    int    `json:"slots"`
-	Wait     int    `json:"wait"`
-}
-
-type Profile struct {
-	Name         string `json:"name"`
-	VideoCodec   string `json:"video_codec"`
-	VideoBitrate string `json:"video_bitrate"`
-	Scale        string `json:"scale"`
-	AudioCodec   string `json:"audio_codec"`
-	AudioBitrate string `json:"audio_bitrate"`
-	HWAccel      string `json:"hwaccel"`
-}
-type OutputSpec struct {
-	Format          string `json:"format"`
-	SegmentDuration int    `json:"segment_duration"`
-}
-type Job struct {
-	ID            string     `json:"id"`
-	Path          string     `json:"path"`
-	SourceURL     string     `json:"source_url"`
-	Profiles      []Profile  `json:"profiles"`
-	Output        OutputSpec `json:"output"`
-	CallbackToken string     `json:"callback_token"`
-	Deadline      int64      `json:"deadline"`
-}
-type ClaimResp struct {
-	Data struct {
-		Jobs []Job `json:"jobs"`
-	} `json:"data"`
-}
-
-type FinishReq struct {
-	JobID  string `json:"job_id"`
-	Status string `json:"status"`
-	Error  string `json:"error,omitempty"`
-	Stats  struct {
-		Elapsed  float64 `json:"elapsed"`
-		BytesOut int64   `json:"bytes_out"`
-	} `json:"stats"`
-}
-
-// ---- HTTP helper ----
-
-var httpClient = &http.Client{Timeout: 60 * time.Second}
-
-func postJSON(path string, body any, out any, bearer string) error {
-	buf, _ := json.Marshal(body)
-	req, _ := http.NewRequest(http.MethodPost, *masterURL+path, bytes.NewReader(buf))
-	req.Header.Set("Content-Type", "application/json")
-	if bearer != "" {
-		req.Header.Set("Authorization", "Bearer "+bearer)
-	}
-	resp, err := httpClient.Do(req)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode >= 400 {
-		raw, _ := io.ReadAll(resp.Body)
-		return fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(raw))
-	}
-	if out != nil {
-		return json.NewDecoder(resp.Body).Decode(out)
-	}
-	return nil
-}
-
-// ---- main ----
-
-func main() {
-	flag.Parse()
-	if *secret == "" {
-		fmt.Fprintln(os.Stderr, "missing -secret")
-		os.Exit(1)
-	}
-	if err := os.MkdirAll(*workdir, 0o755); err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(1)
-	}
-
-	workerID, hbInterval, err := registerOnce()
-	if err != nil {
-		fmt.Fprintln(os.Stderr, "register failed:", err)
-		os.Exit(1)
-	}
-	fmt.Printf("[worker] registered: id=%s heartbeat=%ds\n", workerID, hbInterval)
-
-	ctx, cancel := context.WithCancel(context.Background())
-	sigCh := make(chan os.Signal, 1)
-	signal.Notify(sigCh, syscall.SIGINT, syscall.SIGTERM)
-	go func() {
-		<-sigCh
-		fmt.Println("[worker] shutting down")
-		cancel()
-	}()
-
-	state := &workerState{
-		id:        workerID,
-		runningMu: sync.Mutex{},
-		running:   map[string]context.CancelFunc{},
-	}
-
-	// 心跳协程
-	go func() {
-		t := time.NewTicker(time.Duration(hbInterval) * time.Second)
-		defer t.Stop()
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			case <-t.C:
-				state.heartbeat()
-			}
-		}
-	}()
-	// 工作协程
-	for i := 0; i < *capacity; i++ {
-		go state.workLoop(ctx)
-	}
-	<-ctx.Done()
-	time.Sleep(500 * time.Millisecond)
-}
-
-func registerOnce() (string, int, error) {
-	req := RegisterReq{
-		Name:          *name,
-		Version:       "1.0.0",
-		Capacity:      *capacity,
-		HWAccel:       []string{*hwaccel},
-		CodecsDecode:  []string{"h264", "hevc", "av1", "vp9", "mpeg4", "mpeg2video"},
-		CodecsEncode:  []string{"h264", "hevc"},
-		MaxResolution: "3840x2160",
-		Tags:          []string{runtime.GOOS, runtime.GOARCH},
-	}
-	var resp RegisterResp
-	if err := postJSON("/api/transcode/worker/register", req, &resp, *secret); err != nil {
-		return "", 0, err
-	}
-	if resp.Data.WorkerID == "" {
-		return "", 0, fmt.Errorf("master returned empty worker_id")
-	}
-	if resp.Data.HeartbeatInterval == 0 {
-		resp.Data.HeartbeatInterval = 10
-	}
-	return resp.Data.WorkerID, resp.Data.HeartbeatInterval, nil
-}
-
-// ---- 状态机 ----
-
-type workerState struct {
-	id        string
-	runningMu sync.Mutex
-	running   map[string]context.CancelFunc
-}
-
-func (s *workerState) heartbeat() {
-	s.runningMu.Lock()
-	ids := make([]string, 0, len(s.running))
-	for id := range s.running {
-		ids = append(ids, id)
-	}
-	free := *capacity - len(ids)
-	s.runningMu.Unlock()
-	var resp HeartbeatResp
-	if err := postJSON("/api/transcode/worker/heartbeat", HeartbeatReq{
-		WorkerID:  s.id,
-		Running:   ids,
-		FreeSlots: free,
-	}, &resp, *secret); err != nil {
-		fmt.Println("[worker] heartbeat error:", err)
-		return
-	}
-	for _, jid := range resp.Data.Cancel {
-		s.runningMu.Lock()
-		if cancel, ok := s.running[jid]; ok {
-			cancel()
-		}
-		s.runningMu.Unlock()
-	}
-}
-
-func (s *workerState) workLoop(ctx context.Context) {
-	for {
-		if ctx.Err() != nil {
-			return
-		}
-		var resp ClaimResp
-		err := postJSON("/api/transcode/worker/claim", ClaimReq{
-			WorkerID: s.id, Slots: 1, Wait: 20,
-		}, &resp, *secret)
-		if err != nil {
-			fmt.Println("[worker] claim error:", err)
-			time.Sleep(5 * time.Second)
-			continue
-		}
-		if len(resp.Data.Jobs) == 0 {
-			continue
-		}
-		for _, j := range resp.Data.Jobs {
-			s.runJob(ctx, j)
-		}
-	}
-}
-
-func (s *workerState) runJob(parent context.Context, job Job) {
-	jobCtx, cancel := context.WithCancel(parent)
-	s.runningMu.Lock()
-	s.running[job.ID] = cancel
-	s.runningMu.Unlock()
-	defer func() {
-		s.runningMu.Lock()
-		delete(s.running, job.ID)
-		s.runningMu.Unlock()
-		cancel()
-	}()
-
-	startedAt := time.Now()
-	tmpDir := filepath.Join(*workdir, job.ID)
-	_ = os.MkdirAll(tmpDir, 0o755)
-	defer os.RemoveAll(tmpDir)
-
-	if len(job.Profiles) == 0 {
-		s.finish(job, "failed", "no profiles", 0, 0)
-		return
-	}
-	profile := job.Profiles[0]
-	playlist := filepath.Join(tmpDir, "playlist.m3u8")
-	segPattern := filepath.Join(tmpDir, "seg-%d.ts")
-	args := buildFFmpegArgs(job, profile, segPattern, playlist)
-
-	cmd := exec.CommandContext(jobCtx, *ffmpeg, args...)
-	stderr := &bytes.Buffer{}
-	cmd.Stderr = stderr
-	fmt.Printf("[worker] running job %s, ffmpeg %s\n", job.ID, strings.Join(args, " "))
-	if err := cmd.Start(); err != nil {
-		s.finish(job, "failed", err.Error(), 0, 0)
-		return
-	}
-
-	// 上传协程
-	stopUpload := make(chan struct{})
-	uploadDone := make(chan struct{})
-	go func() {
-		defer close(uploadDone)
-		s.watchAndUpload(jobCtx, job, profile.Name, tmpDir, stopUpload)
-	}()
-
-	err := cmd.Wait()
-	close(stopUpload)
-	<-uploadDone
-	// 最后一次扫描：把还未上传的尾片传上去
-	s.uploadOnce(job, profile.Name, tmpDir, true)
-
-	if err != nil {
-		if jobCtx.Err() == context.Canceled {
-			s.finish(job, "cancelled", "cancelled by master", 0, 0)
-			return
-		}
-		s.finish(job, "failed", fmt.Sprintf("%v: %s", err, truncate(stderr.String(), 1024)), 0, 0)
-		return
-	}
-	s.finish(job, "finished", "", time.Since(startedAt).Seconds(), 0)
-}
-
-func (s *workerState) finish(job Job, status, errStr string, elapsed float64, bytesOut int64) {
-	req := FinishReq{
-		JobID: job.ID, Status: status, Error: errStr,
-	}
-	req.Stats.Elapsed = elapsed
-	req.Stats.BytesOut = bytesOut
-	if err := postJSON("/api/transcode/worker/job/finish", req, nil, job.CallbackToken); err != nil {
-		fmt.Printf("[worker] finish report failed: %v\n", err)
-	}
-}
-
-func (s *workerState) watchAndUpload(_ context.Context, job Job, profile, dir string, stop chan struct{}) {
-	t := time.NewTicker(800 * time.Millisecond)
-	defer t.Stop()
-	uploaded := map[int]bool{}
-	flush := func(final bool) {
-		s.uploadDelta(job, profile, dir, uploaded, final)
-	}
-	for {
-		select {
-		case <-stop:
-			flush(false)
-			return
-		case <-t.C:
-			flush(false)
-		}
-	}
-}
-
-func (s *workerState) uploadOnce(job Job, profile, dir string, final bool) {
-	uploaded := map[int]bool{}
-	s.uploadDelta(job, profile, dir, uploaded, final)
-}
-
-// uploadDelta 扫描目录，上传新切片（uploaded 跟踪已传过的 seq；最后一片到 final 时才上传）
-func (s *workerState) uploadDelta(job Job, profile, dir string, uploaded map[int]bool, final bool) {
-	entries, err := os.ReadDir(dir)
-	if err != nil {
-		return
-	}
-	type segFile struct {
-		seq  int
-		path string
-	}
-	var segs []segFile
-	for _, e := range entries {
-		if e.IsDir() {
-			continue
-		}
-		n := e.Name()
-		if !strings.HasPrefix(n, "seg-") || !strings.HasSuffix(n, ".ts") {
-			continue
-		}
-		num, err := strconv.Atoi(strings.TrimSuffix(strings.TrimPrefix(n, "seg-"), ".ts"))
-		if err != nil {
-			continue
-		}
-		segs = append(segs, segFile{num, filepath.Join(dir, n)})
-	}
-	// 排序
-	for i := 0; i < len(segs); i++ {
-		for j := i + 1; j < len(segs); j++ {
-			if segs[j].seq < segs[i].seq {
-				segs[i], segs[j] = segs[j], segs[i]
-			}
-		}
-	}
-	limit := len(segs)
-	if !final && limit > 0 {
-		limit-- // 最后一片可能还在写，留到下一轮
-	}
-	segDur := job.Output.SegmentDuration
-	if segDur == 0 {
-		segDur = 6
-	}
-	for i := 0; i < limit; i++ {
-		seg := segs[i]
-		if uploaded[seg.seq] {
-			continue
-		}
-		isLast := final && i == limit-1
-		if err := s.uploadSegment(job, profile, seg.seq, float64(segDur), seg.path, isLast); err != nil {
-			fmt.Printf("[worker] upload seg-%d failed: %v\n", seg.seq, err)
-			return
-		}
-		uploaded[seg.seq] = true
-	}
-}
-
-func (s *workerState) uploadSegment(job Job, profile string, seq int, dur float64, file string, final bool) error {
-	f, err := os.Open(file)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-	q := fmt.Sprintf("?job=%s&profile=%s&seq=%d&duration=%f&final=%t",
-		job.ID, profile, seq, dur, final)
-	req, _ := http.NewRequest(http.MethodPut, *masterURL+"/api/transcode/worker/segment"+q, f)
-	req.Header.Set("Content-Type", "video/mp2t")
-	req.Header.Set("Authorization", "Bearer "+job.CallbackToken)
-	resp, err := httpClient.Do(req)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode >= 400 {
-		raw, _ := io.ReadAll(resp.Body)
-		return fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(raw))
-	}
-	return nil
-}
-
-// ---- ffmpeg args（与 master 端 local_runner 保持一致）----
-
-func buildFFmpegArgs(job Job, profile Profile, segPattern, playlist string) []string {
-	hw := strings.ToLower(profile.HWAccel)
-	args := []string{"-y", "-loglevel", "warning"}
-	switch hw {
-	case "nvenc":
-		args = append(args, "-hwaccel", "cuda")
-	case "qsv":
-		args = append(args, "-hwaccel", "qsv")
-	case "vaapi":
-		args = append(args, "-hwaccel", "vaapi", "-hwaccel_output_format", "vaapi", "-vaapi_device", "/dev/dri/renderD128")
-	case "amf":
-		args = append(args, "-hwaccel", "d3d11va")
-	case "videotoolbox":
-		args = append(args, "-hwaccel", "videotoolbox")
-	case "auto":
-		args = append(args, "-hwaccel", "auto")
-	}
-	args = append(args, "-i", job.SourceURL)
-	args = append(args, "-c:v", pickEncoder(profile.VideoCodec, hw))
-	if profile.VideoBitrate != "" {
-		args = append(args, "-b:v", profile.VideoBitrate, "-maxrate", profile.VideoBitrate, "-bufsize", profile.VideoBitrate)
-	}
-	if profile.Scale != "" {
-		switch hw {
-		case "vaapi":
-			args = append(args, "-vf", "scale_vaapi="+profile.Scale)
-		case "qsv":
-			args = append(args, "-vf", "scale_qsv="+profile.Scale)
-		default:
-			args = append(args, "-vf", "scale="+profile.Scale)
-		}
-	}
-	if profile.AudioCodec == "copy" {
-		args = append(args, "-c:a", "copy")
-	} else {
-		ac := profile.AudioCodec
-		if ac == "" {
-			ac = "aac"
-		}
-		args = append(args, "-c:a", ac)
-		if profile.AudioBitrate != "" {
-			args = append(args, "-b:a", profile.AudioBitrate)
-		}
-	}
-	segDur := job.Output.SegmentDuration
-	if segDur == 0 {
-		segDur = 6
-	}
-	args = append(args,
-		"-f", "hls",
-		"-hls_time", strconv.Itoa(segDur),
-		"-hls_playlist_type", "vod",
-		"-hls_segment_filename", segPattern,
-		"-hls_flags", "independent_segments",
-		playlist,
-	)
-	return args
-}
-
-func pickEncoder(codec, hw string) string {
-	codec = strings.ToLower(codec)
-	switch codec {
-	case "h264", "":
-		switch hw {
-		case "nvenc":
-			return "h264_nvenc"
-		case "qsv":
-			return "h264_qsv"
-		case "vaapi":
-			return "h264_vaapi"
-		case "amf":
-			return "h264_amf"
-		case "videotoolbox":
-			return "h264_videotoolbox"
-		}
-		return "libx264"
-	case "hevc", "h265":
-		switch hw {
-		case "nvenc":
-			return "hevc_nvenc"
-		case "qsv":
-			return "hevc_qsv"
-		case "vaapi":
-			return "hevc_vaapi"
-		case "amf":
-			return "hevc_amf"
-		case "videotoolbox":
-			return "hevc_videotoolbox"
-		}
-		return "libx265"
-	case "av1":
-		switch hw {
-		case "nvenc":
-			return "av1_nvenc"
-		case "qsv":
-			return "av1_qsv"
-		}
-		return "libsvtav1"
-	}
-	return "libx264"
-}
-
-func truncate(s string, n int) string {
-	if len(s) <= n {
-		return s
-	}
-	return s[:n]
-}
@@ -1,167 +0,0 @@
-# OpenList 转码协议 v1（自研）
-
-> 用于 OpenList Master 与远程 FFmpeg 转码 Worker 之间的通信。
-> 协议本身、所有依赖、推荐编码 (H.264/AV1) 均为开源免费，可商用。
-
-## 总览
-
-```
-Player ──► Master(/api/transcode/play) ──► Scheduler.Submit
-Worker ──► Master(/api/transcode/worker/register)             # 启动一次
-Worker ──► Master(/api/transcode/worker/heartbeat)            # 周期 10s
-Worker ──► Master(/api/transcode/worker/claim)                # 长轮询拉任务
-Worker ──► Master(/api/transcode/worker/segment)              # 流式回推切片
-Worker ──► Master(/api/transcode/worker/job/finish)           # 上报完成
-Player ──► Master(/tc/{job}/{token}/master.m3u8)              # 拉取播放列表
-Player ──► Master(/tc/{job}/{token}/{profile}/seg-N.ts)       # 拉取切片
-```
-
-## 通用约定
- 所有请求体均为 JSON。
- Worker 与 Master 间通过两类凭据鉴权：
-  - **shared_secret**（管理端 `transcode_worker_secret` 设置项）：用于 register / heartbeat / claim
-  - **callback_token**（Master 在 job 中下发，一次性）：用于 segment / job/finish
- Header 形式：`Authorization: Bearer <token>`
- 返回包统一使用 OpenList 通用响应：`{"code":200,"message":"success","data":{...}}`
-
-## 端点详细
-
-### POST /api/transcode/worker/register
-> 鉴权：Bearer = shared_secret
-
-请求：
-```json
-{
-  "name": "gpu-node-01",
-  "version": "1.0.0",
-  "capacity": 4,
-  "hwaccel": ["nvenc"],
-  "codecs_decode": ["h264","hevc","av1","vp9"],
-  "codecs_encode": ["h264","hevc"],
-  "max_resolution": "3840x2160",
-  "tags": ["linux","amd64"]
-}
-```
-
-响应：
-```json
-{
-  "code":200,"message":"success",
-  "data": {
-    "worker_id":"wk_xxx",
-    "heartbeat_interval":10,
-    "claim_strategy":"pull",
-    "protocol_version":"v1"
-  }
-}
-```
-
-### POST /api/transcode/worker/heartbeat
-> 鉴权：Bearer = shared_secret
-> 间隔：register 返回的 `heartbeat_interval`；服务端 30s 未收到则剔除 worker
-
-请求：
-```json
-{ "worker_id":"wk_xxx", "load":0.4, "running":["job_a"], "free_slots":3 }
-```
-
-响应：
-```json
-{ "code":200,"message":"success","data":{"ok":true,"kick":false,"cancel":["job_x"]}}
-```
- `kick=true`：服务端要求 Worker 主动退出
- `cancel`：需要 Worker 立刻终止的 job_ids（异步取消通道）
-
-### POST /api/transcode/worker/claim
-> 鉴权：Bearer = shared_secret
-> 长轮询：当无任务时，服务端最多挂起 `wait` 秒（最大 30）
-
-请求：
-```json
-{ "worker_id":"wk_xxx", "slots":1, "wait":20 }
-```
-
-响应：
-```json
-{ "code":200,"message":"success","data":{"jobs":[{
-  "id":"job_xxx",
-  "path":"/movies/x.mkv",
-  "source_url":"https://example.com/d/movies/x.mkv?sign=...",
-  "profiles":[{
-    "name":"1080p","video_codec":"h264","video_bitrate":"4000k",
-    "scale":"1920:-2","audio_codec":"aac","audio_bitrate":"160k",
-    "hwaccel":"nvenc"
-  }],
-  "output":{"format":"hls","segment_duration":6},
-  "callback_token":"tk_xxx",
-  "deadline":1731601234
-}]}}
-```
-
-### PUT /api/transcode/worker/segment
-> 鉴权：Bearer = callback_token
-> Query 参数：
-> - `job` 任务 ID
-> - `profile` profile 名（如 `1080p`）
-> - `seq` 切片序号（从 0 开始）
-> - `duration` 该切片秒数
-> - `final` 是否为最后一片（true/false）
->
-> Body：原始 MPEG-TS 二进制（`Content-Type: video/mp2t`）
-
-响应：`204 No Content`
-
-### POST /api/transcode/worker/job/finish
-> 鉴权：Bearer = callback_token
-
-请求：
-```json
-{
-  "job_id":"job_xxx",
-  "status":"finished",
-  "error":"",
-  "stats":{"elapsed":312.4,"fps":120,"speed":2.1,"bytes_out":890123456}
-}
-```
-status 取值：`finished` / `failed` / `cancelled`
-
-## 播放端
-
-### POST /api/fs/transcode/play
-> 由前端播放器调用，用户登录态可见
-> 请求：`{"path":"/movies/x.mkv"}`
->
-> 响应（无需转码）：
-> `{"transcode":false,"reason":"size below threshold"}`
->
-> 响应（已下发转码任务）：
-> `{"transcode":true,"job_id":"job_xx","master_url":"https://.../tc/.../master.m3u8","profile":"1080p"}`
-
-### GET /tc/:job/:token/master.m3u8
-返回多档位主 m3u8。
-
-### GET /tc/:job/:token/:profile/playlist.m3u8
-阻塞等待首切片就绪（最多 30s）后返回 HLS 播放列表，未结束时不带 `#EXT-X-ENDLIST`。
-
-### GET /tc/:job/:token/:profile/seg-N.ts
-返回 N 号切片；如果尚未生成，最多等待 60s。
-
-## 启动远程 Worker
-
-```bash
-# 用 Master 配置中的 transcode_worker_secret 作为密钥
-go build -o openlist-worker ./cmd/worker
-
-./openlist-worker \
-  -master http://openlist.example.com:5244 \
-  -secret <transcode_worker_secret> \
-  -capacity 2 \
-  -hwaccel nvenc \
-  -ffmpeg /usr/bin/ffmpeg \
-  -workdir /tmp/openlist-worker
-```
-
-## License 说明
- 协议：自研，可自由使用
- FFmpeg：使用系统包提供的 LGPL 版本即可（含 libx264/libx265，libx264 是 GPL，建议在 Worker 镜像中遵循 GPL 公开/动态链接合规）
- 推荐编码：H.264 互联网分发免授权 / AV1 永久免版税
@@ -337,9 +337,11 @@ func (d *Pan115) UploadByMultipart(ctx context.Context, params *driver115.Upload
 			for chunk := range chunksCh {
 				var part oss.UploadPart // 出现错误就继续尝试，共尝试3次
 				for retry := 0; retry < 3; retry++ {
-					select {
-					case <-ctx.Done():
+					if utils.IsCanceled(ctx) {
+						err = ctx.Err()
 						break
+					}
+					select {
 					case <-ticker.C:
 						if ossToken, err = d.client.GetOSSToken(); err != nil { // 到时重新获取ossToken
 							errCh <- errors.Wrap(err, "刷新token时出现错误")
@@ -2,6 +2,7 @@ package _115_open

 import (
 	"context"
+	"errors"
 	"fmt"
 	"net/http"
 	stdpath "path"
@@ -14,6 +15,7 @@ import (
 	"github.com/OpenListTeam/OpenList/v4/cmd/flags"
 	"github.com/OpenListTeam/OpenList/v4/drivers/base"
 	"github.com/OpenListTeam/OpenList/v4/internal/driver"
+	"github.com/OpenListTeam/OpenList/v4/internal/errs"
 	"github.com/OpenListTeam/OpenList/v4/internal/model"
 	"github.com/OpenListTeam/OpenList/v4/internal/op"
 	"github.com/OpenListTeam/OpenList/v4/internal/stream"
@@ -169,15 +171,60 @@ func (d *Open115) Get(ctx context.Context, path string) (model.Obj, error) {
 	path = stdpath.Join(d.parentPath, path)
 	resp, err := d.client.GetFolderInfoByPath(ctx, path)
 	if err != nil {
+		if errors.Is(err, sdk.ErrObjectNotFound) {
+			return d.getFromParent(ctx, path, "")
+		}
 		return nil, err
 	}
-	return &Obj{
+	obj := &Obj{
 		Fid:  resp.FileID,
 		Fn:   resp.FileName,
 		Fc:   resp.FileCategory,
 		Sha1: resp.Sha1,
 		Pc:   resp.PickCode,
-	}, nil
+		FS:   resp.SizeByte,
+		Upt:  parseTime(resp.UTime),
+		UpPt: parseTime(resp.PTime),
+	}
+	if !obj.IsDir() && obj.ModTime().Unix() <= 0 {
+		return d.getFromParent(ctx, path, obj.GetID())
+	}
+	return obj, nil
+}
+
+func (d *Open115) getFromParent(ctx context.Context, path, id string) (model.Obj, error) {
+	path = stdpath.Clean(path)
+	parent, name := stdpath.Split(path)
+	parent = stdpath.Clean(parent)
+	parentID := d.GetRootId()
+	if stdpath.Clean(parent) != stdpath.Clean(d.parentPath) {
+		if err := d.WaitLimit(ctx); err != nil {
+			return nil, err
+		}
+		parentInfo, err := d.client.GetFolderInfoByPath(ctx, parent)
+		if err != nil {
+			if !errors.Is(err, sdk.ErrObjectNotFound) {
+				return nil, err
+			}
+			parentObj, err := d.getFromParent(ctx, parent, "")
+			if err != nil {
+				return nil, err
+			}
+			parentID = parentObj.GetID()
+		} else {
+			parentID = parentInfo.FileID
+		}
+	}
+	files, err := d.List(ctx, &Obj{Fid: parentID, Fc: "0"}, model.ListArgs{})
+	if err != nil {
+		return nil, err
+	}
+	for _, file := range files {
+		if (id != "" && file.GetID() == id) || (id == "" && file.GetName() == name) {
+			return file, nil
+		}
+	}
+	return nil, errs.ObjectNotFound
 }

 func (d *Open115) MakeDir(ctx context.Context, parentDir model.Obj, dirName string) (model.Obj, error) {
@@ -199,18 +246,15 @@ func (d *Open115) MakeDir(ctx context.Context, parentDir model.Obj, dirName stri
 	}, nil
 }

-func (d *Open115) Move(ctx context.Context, srcObj, dstDir model.Obj) (model.Obj, error) {
+func (d *Open115) Move(ctx context.Context, srcObj, dstDir model.Obj) error {
 	if err := d.WaitLimit(ctx); err != nil {
-		return nil, err
+		return err
 	}
 	_, err := d.client.Move(ctx, &sdk.MoveReq{
 		FileIDs: srcObj.GetID(),
 		ToCid:   dstDir.GetID(),
 	})
-	if err != nil {
-		return nil, err
-	}
-	return srcObj, nil
+	return err
 }

 func (d *Open115) Rename(ctx context.Context, srcObj model.Obj, newName string) (model.Obj, error) {
@@ -218,7 +262,7 @@ func (d *Open115) Rename(ctx context.Context, srcObj model.Obj, newName string)
 		return nil, err
 	}
 	_, err := d.client.UpdateFile(ctx, &sdk.UpdateFileReq{
-		FileID:  srcObj.GetID(),
+		FileID:   srcObj.GetID(),
 		FileName: newName,
 	})
 	if err != nil {
@@ -227,23 +271,21 @@ func (d *Open115) Rename(ctx context.Context, srcObj model.Obj, newName string)
 	obj, ok := srcObj.(*Obj)
 	if ok {
 		obj.Fn = newName
+		return srcObj, nil
 	}
-	return srcObj, nil
+	return nil, nil
 }

-func (d *Open115) Copy(ctx context.Context, srcObj, dstDir model.Obj) (model.Obj, error) {
+func (d *Open115) Copy(ctx context.Context, srcObj, dstDir model.Obj) error {
 	if err := d.WaitLimit(ctx); err != nil {
-		return nil, err
+		return err
 	}
 	_, err := d.client.Copy(ctx, &sdk.CopyReq{
 		PID:     dstDir.GetID(),
 		FileID:  srcObj.GetID(),
 		NoDupli: "1",
 	})
-	if err != nil {
-		return nil, err
-	}
-	return srcObj, nil
+	return err
 }

 func (d *Open115) Remove(ctx context.Context, obj model.Obj) error {
@@ -3,9 +3,9 @@ package _115_open
 import (
 	"time"

+	sdk "github.com/OpenListTeam/115-sdk-go"
 	"github.com/OpenListTeam/OpenList/v4/internal/model"
 	"github.com/OpenListTeam/OpenList/v4/pkg/utils"
-	sdk "github.com/OpenListTeam/115-sdk-go"
 )

 type Obj sdk.GetFilesResp_File
@@ -3,6 +3,7 @@ package _115_open
 import (
 	"context"
 	"encoding/base64"
+	"errors"
 	"io"
 	"time"

@@ -70,6 +71,19 @@ func (d *Open115) singleUpload(ctx context.Context, tempF model.File, tokenResp
 // 	} `json:"data"`
 // }

+// retryExpiredToken retries only the rejected OSS operation, preserving the upload ID.
+func retryExpiredToken(refresh func() error, operation func() error) error {
+	err := operation()
+	var serviceErr oss.ServiceError
+	if !errors.As(err, &serviceErr) || serviceErr.Code != "SecurityTokenExpired" {
+		return err
+	}
+	if err := refresh(); err != nil {
+		return err
+	}
+	return operation()
+}
+
 func (d *Open115) multpartUpload(ctx context.Context, stream model.FileStreamer, up driver.UpdateProgress, tokenResp *sdk.UploadGetTokenResp, initResp *sdk.UploadInitResp) error {
 	ossClient, err := netutil.NewOSSClient(tokenResp.Endpoint, tokenResp.AccessKeyId, tokenResp.AccessKeySecret, oss.SecurityToken(tokenResp.SecurityToken))
 	if err != nil {
@@ -80,7 +94,32 @@ func (d *Open115) multpartUpload(ctx context.Context, stream model.FileStreamer,
 		return err
 	}

-	imur, err := bucket.InitiateMultipartUpload(initResp.Object, oss.Sequential())
+	refresh := func() error {
+		if err := d.WaitLimit(ctx); err != nil {
+			return err
+		}
+		token, err := d.client.UploadGetToken(ctx)
+		if err != nil {
+			return err
+		}
+		client, err := netutil.NewOSSClient(token.Endpoint, token.AccessKeyId, token.AccessKeySecret, oss.SecurityToken(token.SecurityToken))
+		if err != nil {
+			return err
+		}
+		newBucket, err := client.Bucket(initResp.Bucket)
+		if err != nil {
+			return err
+		}
+		bucket = newBucket
+		return nil
+	}
+
+	var imur oss.InitiateMultipartUploadResult
+	err = retryExpiredToken(refresh, func() error {
+		var err error
+		imur, err = bucket.InitiateMultipartUpload(initResp.Object, oss.Sequential(), oss.WithContext(ctx))
+		return err
+	})
 	if err != nil {
 		return err
 	}
@@ -109,13 +148,17 @@ func (d *Open115) multpartUpload(ctx context.Context, stream model.FileStreamer,
 			return err
 		}
 		err = retry.Do(func() error {
-			rd.Seek(0, io.SeekStart)
-			part, err := bucket.UploadPart(imur, driver.NewLimitedUploadStream(ctx, rd), partSize, int(i))
-			if err != nil {
-				return err
-			}
-			parts[i-1] = part
-			return nil
+			return retryExpiredToken(refresh, func() error {
+				if _, err := rd.Seek(0, io.SeekStart); err != nil {
+					return err
+				}
+				part, err := bucket.UploadPart(imur, driver.NewLimitedUploadStream(ctx, rd), partSize, int(i), oss.WithContext(ctx))
+				if err != nil {
+					return err
+				}
+				parts[i-1] = part
+				return nil
+			})
 		},
 			retry.Context(ctx),
 			retry.Attempts(3),
@@ -134,14 +177,16 @@ func (d *Open115) multpartUpload(ctx context.Context, stream model.FileStreamer,
 		up(float64(offset) * 100 / float64(fileSize))
 	}

-	// callbackRespBytes := make([]byte, 1024)
-	_, err = bucket.CompleteMultipartUpload(
-		imur,
-		parts,
-		oss.Callback(base64.StdEncoding.EncodeToString([]byte(initResp.Callback.Value.Callback))),
-		oss.CallbackVar(base64.StdEncoding.EncodeToString([]byte(initResp.Callback.Value.CallbackVar))),
-		// oss.CallbackResult(&callbackRespBytes),
-	)
+	err = retryExpiredToken(refresh, func() error {
+		_, err := bucket.CompleteMultipartUpload(
+			imur,
+			parts,
+			oss.Callback(base64.StdEncoding.EncodeToString([]byte(initResp.Callback.Value.Callback))),
+			oss.CallbackVar(base64.StdEncoding.EncodeToString([]byte(initResp.Callback.Value.CallbackVar))),
+			oss.WithContext(ctx),
+		)
+		return err
+	})
 	if err != nil {
 		return err
 	}
@@ -1,6 +1,9 @@
 package _115_open

-import "encoding/json"
+import (
+	"encoding/json"
+	"strconv"
+)

 func ParseInt64(v json.Number) (int64, error) {
 	i, err := v.Int64()
@@ -13,3 +16,8 @@ func ParseInt64(v json.Number) (int64, error) {
 	}
 	return int64(0), err
 }
+
+func parseTime(value string) int64 {
+	timestamp, _ := strconv.ParseInt(value, 10, 64)
+	return timestamp
+}
@@ -2,6 +2,7 @@ package _115_share

 import (
 	"context"
+	"net/http"

 	"github.com/OpenListTeam/OpenList/v4/drivers/base"
 	"github.com/OpenListTeam/OpenList/v4/internal/driver"
@@ -89,15 +90,16 @@ func (d *Pan115Share) Link(ctx context.Context, file model.Obj, args model.LinkA
 	if args.Header != nil {
 		ua = args.Header.Get("User-Agent")
 	}
-	if ua == "" {
-		ua = base.UserAgent
-	}
 	downloadInfo, err := d.client.DownloadByShareCodeWithUA(ua, d.ShareCode, d.ReceiveCode, file.GetID())
 	if err != nil {
 		return nil, err
 	}
-
-	return &model.Link{URL: downloadInfo.URL.URL}, nil
+	header := http.Header{}
+	header.Set("User-Agent", ua)
+	return &model.Link{
+		URL:    downloadInfo.URL.URL,
+		Header: header,
+	}, nil
 }

 func (d *Pan115Share) MakeDir(ctx context.Context, parentDir model.Obj, dirName string) error {
@@ -98,7 +98,7 @@ func (d *Pan123) Link(ctx context.Context, file model.Obj, args model.LinkArgs)
 		}

 		log.Debug("download url: ", u_)
-		res, err := base.NoRedirectClient.R().SetHeader("Referer", "https://www.123pan.com/").Get(u_)
+		res, err := base.NoRedirectClient.R().SetHeader("Referer", "https://yun.123pan.com/").Get(u_)
 		if err != nil {
 			return nil, err
 		}
@@ -24,9 +24,9 @@ import (
 // do others that not defined in Driver interface

 const (
-	Api              = "https://www.123pan.com/api"
-	AApi             = "https://www.123pan.com/a/api"
-	BApi             = "https://www.123pan.com/b/api"
+	Api              = "https://yun.123pan.com/api"
+	AApi             = "https://yun.123pan.com/a/api"
+	BApi             = "https://yun.123pan.com/b/api"
 	LoginApi         = "https://login.123pan.com/api"
 	MainApi          = BApi
 	SignIn           = LoginApi + "/user/sign_in"
@@ -169,8 +169,8 @@ func (d *Pan123) login() error {
 	}
 	res, err := base.RestyClient.R().
 		SetHeaders(map[string]string{
-			"origin":      "https://www.123pan.com",
-			"referer":     "https://www.123pan.com/",
+			"origin":      "https://yun.123pan.com",
+			"referer":     "https://yun.123pan.com/",
 			"user-agent":  "Dart/2.19(dart:io)-openlist",
 			"platform":    "web",
 			"app-version": "3",
@@ -207,8 +207,8 @@ func (d *Pan123) Request(url string, method string, callback base.ReqCallback, r
 do:
 	req := base.RestyClient.R()
 	req.SetHeaders(map[string]string{
-		"origin":        "https://www.123pan.com",
-		"referer":       "https://www.123pan.com/",
+		"origin":        "https://yun.123pan.com",
+		"referer":       "https://yun.123pan.com/",
 		"authorization": "Bearer " + d.AccessToken,
 		"user-agent":    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) openlist-client",
 		"platform":      d.Platform,
@@ -101,7 +101,7 @@ func (d *Pan123Share) Link(ctx context.Context, file model.Obj, args model.LinkA
 		}

 		log.Debug("download url: ", u_)
-		res, err := base.NoRedirectClient.R().SetHeader("Referer", "https://www.123pan.com/").Get(u_)
+		res, err := base.NoRedirectClient.R().SetHeader("Referer", "https://yun.123pan.com/").Get(u_)
 		if err != nil {
 			return nil, err
 		}
@@ -20,9 +20,9 @@ import (
 )

 const (
-	Api          = "https://www.123pan.com/api"
-	AApi         = "https://www.123pan.com/a/api"
-	BApi         = "https://www.123pan.com/b/api"
+	Api          = "https://yun.123pan.com/api"
+	AApi         = "https://yun.123pan.com/a/api"
+	BApi         = "https://yun.123pan.com/b/api"
 	MainApi      = BApi
 	FileList     = MainApi + "/share/get"
 	DownloadInfo = MainApi + "/share/download/info"
@@ -58,8 +58,8 @@ func (d *Pan123Share) request(url string, method string, callback base.ReqCallba
 	}
 	req := base.RestyClient.R()
 	req.SetHeaders(map[string]string{
-		"origin":        "https://www.123pan.com",
-		"referer":       "https://www.123pan.com/",
+		"origin":        "https://yun.123pan.com",
+		"referer":       "https://yun.123pan.com/",
 		"authorization": "Bearer " + d.AccessToken,
 		"user-agent":    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) openlist-client",
 		"platform":      "web",
@@ -19,6 +19,7 @@ import (
 	"github.com/OpenListTeam/OpenList/v4/pkg/cron"
 	"github.com/OpenListTeam/OpenList/v4/pkg/utils"
 	"github.com/OpenListTeam/OpenList/v4/pkg/utils/random"
+	"github.com/avast/retry-go"
 	log "github.com/sirupsen/logrus"
 )

@@ -29,7 +30,9 @@ type Yun139 struct {
 	Account           string
 	ref               *Yun139
 	PersonalCloudHost string
-	RootPath          string
+	FamilyCloudHost   string
+	GroupCloudHost    string
+	ProviderRoot      string
 }

 func (d *Yun139) Config() driver.Config {
@@ -42,53 +45,62 @@ func (d *Yun139) GetAddition() driver.Additional {

 func (d *Yun139) Init(ctx context.Context) error {
 	if d.ref == nil {
-		if len(d.Authorization) == 0 {
-			if d.Username != "" && d.Password != "" {
-				log.Infof("139yun: authorization is empty, trying to login with password.")
-				newAuth, err := d.loginWithPassword()
-				log.Debugf("newAuth: Ok: %s", newAuth)
-				if err != nil {
-					return fmt.Errorf("login with password failed: %w", err)
-				}
-			} else {
-				return fmt.Errorf("authorization is empty and username/password is not provided")
+		// Share links may be browsed without account credentials. All other
+		// storage types need an authorization or a supported login fallback.
+		if !d.isShare() {
+			if err := d.validateAndInitCredentials(); err != nil {
+				return err
 			}
 		}
-		err := d.refreshToken()
-		if err != nil {
-			return err
-		}
-
-		// Query Route Policy
-		var resp QueryRoutePolicyResp
-		_, err = d.requestRoute(base.Json{
-			"userInfo": base.Json{
-				"userType":    1,
-				"accountType": 1,
-				"accountName": d.Account,
-			},
-			"modAddrType": 1,
-		}, &resp)
-		if err != nil {
-			return err
-		}
-		for _, policyItem := range resp.Data.RoutePolicyList {
-			if policyItem.ModName == "personal" {
-				d.PersonalCloudHost = policyItem.HttpsUrl
-				break
-			}
-		}
-		if len(d.PersonalCloudHost) == 0 {
-			return fmt.Errorf("PersonalCloudHost is empty")
-		}
-
-		d.cron = cron.NewCron(time.Hour * 12)
-		d.cron.Do(func() {
+		if d.Authorization != "" {
 			err := d.refreshToken()
 			if err != nil {
-				log.Errorf("%+v", err)
+				return err
 			}
-		})
+
+			// Query Route Policy
+			var resp QueryRoutePolicyResp
+			_, err = d.requestRoute(base.Json{
+				"userInfo": base.Json{
+					"userType":    1,
+					"accountType": 1,
+					"accountName": d.Account,
+				},
+				"modAddrType": 1,
+			}, &resp)
+			if err != nil {
+				return err
+			}
+			for _, policyItem := range resp.Data.RoutePolicyList {
+				switch policyItem.ModName {
+				case "personal":
+					d.PersonalCloudHost = policyItem.HttpsUrl
+				case "group":
+					d.GroupCloudHost = policyItem.HttpsUrl
+				case "family":
+					d.FamilyCloudHost = policyItem.HttpsUrl
+				}
+			}
+			if len(d.PersonalCloudHost) == 0 {
+				return fmt.Errorf("PersonalCloudHost is empty")
+			}
+			if d.isGroup() || d.isFamily() {
+				if len(d.GroupCloudHost) == 0 {
+					return fmt.Errorf("GroupCloudHost is empty")
+				}
+				if len(d.FamilyCloudHost) == 0 {
+					return fmt.Errorf("FamilyCloudHost is empty")
+				}
+			}
+
+			d.cron = cron.NewCron(time.Hour * 12)
+			d.cron.Do(func() {
+				err := d.refreshToken()
+				if err != nil {
+					log.Errorf("%+v", err)
+				}
+			})
+		}
 	}
 	switch d.Addition.Type {
 	case MetaPersonalNew:
@@ -107,15 +119,25 @@ func (d *Yun139) Init(ctx context.Context) error {
 		if err != nil {
 			return err
 		}
-	case MetaFamily:
+	case MetaShare:
 		if len(d.Addition.RootFolderID) == 0 {
-			// Attempt to obtain data.path as the root via a query and persist it.
-			if root, err := d.getFamilyRootPath(d.CloudID); err == nil && root != "" {
-				d.RootFolderID = root
-				op.MustSaveDriverStorage(d)
-			}
+			d.RootFolderID = "root"
 		}
-		_, err := d.familyGetFiles(d.RootFolderID)
+		if len(d.shareEntries()) == 0 {
+			return fmt.Errorf("link_id is empty")
+		}
+	case MetaFamily:
+		// Attempt to obtain data.path as the root via a query and persist it.
+		root, err := d.getFamilyRootPath(d.CloudID)
+		if err != nil || root == "" {
+			return fmt.Errorf("failed to get family root path: %w", err)
+		}
+		d.ProviderRoot = root
+		if len(d.Addition.RootFolderID) == 0 {
+			d.RootFolderID = root
+			op.MustSaveDriverStorage(d)
+		}
+		_, err = d.familyGetFiles(d.RootFolderID)
 		if err != nil {
 			return err
 		}
@@ -134,6 +156,19 @@ func (d *Yun139) InitReference(storage driver.Driver) error {
 	return errs.NotSupport
 }

+func (d *Yun139) Get(ctx context.Context, path string) (model.Obj, error) {
+	if !d.isShare() {
+		return nil, errs.NotImplement
+	}
+	if path == "/" {
+		return &model.Object{ID: "root", Name: "root", IsFolder: true, Path: "/"}, nil
+	}
+	if obj, err := d.shareGetObj(path); err == nil {
+		return obj, nil
+	}
+	return nil, errs.ObjectNotFound
+}
+
 func (d *Yun139) Drop(ctx context.Context) error {
 	if d.cron != nil {
 		d.cron.Stop()
@@ -152,12 +187,23 @@ func (d *Yun139) List(ctx context.Context, dir model.Obj, args model.ListArgs) (
 		return d.familyGetFiles(dir.GetID())
 	case MetaGroup:
 		return d.groupGetFiles(dir.GetID())
+	case MetaShare:
+		if dir.GetID() == "root" {
+			return d.shareGetMergedFiles(d.shareRootEntries())
+		}
+		if refs, ok := decodeShareRefs(dir.GetID()); ok {
+			return d.shareGetMergedFiles(refs)
+		}
+		return d.shareGetFilesWithRef(shareRef{LinkID: d.LinkID, NodeID: dir.GetID()}, dir.GetID())
 	default:
 		return nil, errs.NotImplement
 	}
 }

 func (d *Yun139) Link(ctx context.Context, file model.Obj, args model.LinkArgs) (*model.Link, error) {
+	if file.IsDir() {
+		return nil, errs.NotFile
+	}
 	var url string
 	var err error
 	switch d.Addition.Type {
@@ -169,6 +215,16 @@ func (d *Yun139) Link(ctx context.Context, file model.Obj, args model.LinkArgs)
 		url, err = d.familyGetLink(file.GetID(), file.GetPath())
 	case MetaGroup:
 		url, err = d.groupGetLink(file.GetID(), file.GetPath())
+	case MetaShare:
+		if refs, ok := decodeShareRefs(file.GetID()); ok && len(refs) > 0 {
+			return d.shareGetLinkWithRef(refs[0], refs[0].NodeID, args.Type)
+		}
+		fallbackRef := shareRef{LinkID: d.LinkID, NodeID: "root"}
+		if entries := d.shareEntries(); len(entries) > 0 {
+			fallbackRef.LinkID = entries[0].LinkID
+			fallbackRef.Password = entries[0].Password
+		}
+		return d.shareGetLinkWithRef(fallbackRef, file.GetID(), args.Type)
 	default:
 		return nil, errs.NotImplement
 	}
@@ -179,6 +235,9 @@ func (d *Yun139) Link(ctx context.Context, file model.Obj, args model.LinkArgs)
 }

 func (d *Yun139) MakeDir(ctx context.Context, parentDir model.Obj, dirName string) error {
+	if d.isShare() {
+		return errs.NotImplement
+	}
 	var err error
 	switch d.Addition.Type {
 	case MetaPersonalNew:
@@ -212,7 +271,7 @@ func (d *Yun139) MakeDir(ctx context.Context, parentDir model.Obj, dirName strin
 				"accountType": 1,
 			},
 			"docLibName": dirName,
-			"path":       path.Join(parentDir.GetPath(), parentDir.GetID()),
+			"path":       d.dirPath(parentDir),
 		}
 		pathname := "/orchestration/familyCloud-rebuild/cloudCatalog/v1.0/createCloudDoc"
 		_, err = d.post(pathname, data, nil)
@@ -225,7 +284,7 @@ func (d *Yun139) MakeDir(ctx context.Context, parentDir model.Obj, dirName strin
 			},
 			"groupID":      d.CloudID,
 			"parentFileId": parentDir.GetID(),
-			"path":         path.Join(parentDir.GetPath(), parentDir.GetID()),
+			"path":         d.dirPath(parentDir),
 		}
 		pathname := "/orchestration/group-rebuild/catalog/v1.0/createGroupCatalog"
 		_, err = d.post(pathname, data, nil)
@@ -236,6 +295,9 @@ func (d *Yun139) MakeDir(ctx context.Context, parentDir model.Obj, dirName strin
 }

 func (d *Yun139) Move(ctx context.Context, srcObj, dstDir model.Obj) (model.Obj, error) {
+	if d.isShare() {
+		return nil, errs.NotImplement
+	}
 	switch d.Addition.Type {
 	case MetaPersonalNew:
 		data := base.Json{
@@ -310,9 +372,9 @@ func (d *Yun139) Move(ctx context.Context, srcObj, dstDir model.Obj) (model.Obj,
 		var contentList []string
 		var catalogList []string
 		if srcObj.IsDir() {
-			catalogList = append(catalogList, path.Join(srcObj.GetPath(), srcObj.GetID()))
+			catalogList = append(catalogList, d.dirPath(srcObj))
 		} else {
-			contentList = append(contentList, path.Join(srcObj.GetPath(), srcObj.GetID()))
+			contentList = append(contentList, d.dirPath(srcObj))
 		}

 		body := base.Json{
@@ -324,7 +386,7 @@ func (d *Yun139) Move(ctx context.Context, srcObj, dstDir model.Obj) (model.Obj,
 			"contentList":   contentList,
 			"destCatalogID": dstDir.GetID(),
 			"destGroupID":   d.CloudID,
-			"destPath":      path.Join(dstDir.GetPath(), dstDir.GetID()),
+			"destPath":      d.dirPath(dstDir),
 			"destType":      0,
 			"srcGroupID":    d.CloudID,
 			"srcType":       0,
@@ -347,6 +409,9 @@ func (d *Yun139) Move(ctx context.Context, srcObj, dstDir model.Obj) (model.Obj,
 }

 func (d *Yun139) Rename(ctx context.Context, srcObj model.Obj, newName string) error {
+	if d.isShare() {
+		return errs.NotImplement
+	}
 	var err error
 	switch d.Addition.Type {
 	case MetaPersonalNew:
@@ -425,7 +490,7 @@ func (d *Yun139) Rename(ctx context.Context, srcObj model.Obj, newName string) e
 				},
 				"docLibName":   newName,
 				"docLibraryID": srcObj.GetID(),
-				"path":         path.Join(srcObj.GetPath(), srcObj.GetID()),
+				"path":         d.dirPath(srcObj),
 			}
 			var resp ModifyCloudDocV2Resp
 			_, err = d.andAlbumRequest(pathname, data, &resp)
@@ -456,6 +521,9 @@ func (d *Yun139) Rename(ctx context.Context, srcObj model.Obj, newName string) e
 }

 func (d *Yun139) Copy(ctx context.Context, srcObj, dstDir model.Obj) error {
+	if d.isShare() {
+		return errs.NotImplement
+	}
 	var err error
 	switch d.Addition.Type {
 	case MetaPersonalNew:
@@ -525,6 +593,9 @@ func (d *Yun139) Copy(ctx context.Context, srcObj, dstDir model.Obj) error {
 }

 func (d *Yun139) Remove(ctx context.Context, obj model.Obj) error {
+	if d.isShare() {
+		return errs.NotImplement
+	}
 	switch d.Addition.Type {
 	case MetaPersonalNew:
 		data := base.Json{
@@ -615,8 +686,25 @@ func (d *Yun139) getPartSize(size int64) int64 {
 }

 func (d *Yun139) Put(ctx context.Context, dstDir model.Obj, stream model.FileStreamer, up driver.UpdateProgress) error {
-	switch d.Addition.Type {
-	case MetaPersonalNew:
+	if d.isShare() {
+		return errs.NotImplement
+	}
+	// PersonalNew 以及 Group/Family 在非旧流模式时走新上传路径
+	if d.Addition.Type == MetaPersonalNew ||
+		((d.isGroup() || d.isFamily()) && !d.UseOldStreamUpload) {
+		var createPath, getUploadUrlPath, completePath string
+		if d.isGroup() || d.isFamily() {
+			// 家庭云和共享群共用同一套新上传 API
+			createPath = "/dynamic/file/create"
+			getUploadUrlPath = "/dynamic/file/getUploadUrl"
+			completePath = "/dynamic/file/complete"
+		} else {
+			// MetaPersonalNew
+			createPath = "/file/create"
+			getUploadUrlPath = "/file/getUploadUrl"
+			completePath = "/file/complete"
+		}
+
 		var err error
 		fullHash := stream.GetHash().GetHash(utils.SHA256)
 		if len(fullHash) != utils.SHA256.Width {
@@ -671,9 +759,22 @@ func (d *Yun139) Put(ctx context.Context, dstDir model.Obj, stream model.FileStr
 			"type":                 "file",
 			"fileRenameMode":       "auto_rename",
 		}
-		pathname := "/file/create"
+		// 家庭云和共享群需要额外的参数
+		if d.isGroup() || d.isFamily() {
+			if d.CloudID == "" {
+				return fmt.Errorf("cloud_id is required for group/family upload")
+			}
+			data["groupId"] = d.CloudID
+			if d.isGroup() {
+				data["groupType"] = 2
+			} else if d.isFamily() {
+				data["groupType"] = 1
+			}
+			data["catalogType"] = 3
+			data["seqNo"] = random.String(32)
+		}
 		var resp PersonalUploadResp
-		_, err = d.personalPost(pathname, data, &resp)
+		_, err = d.newPost(createPath, data, &resp)
 		if err != nil {
 			return err
 		}
@@ -690,10 +791,19 @@ func (d *Yun139) Put(ctx context.Context, dstDir model.Obj, stream model.FileStr
 		if resp.Data.PartInfos != nil {
 			// Progress
 			p := driver.NewProgress(size, up)
+
 			rateLimited := driver.NewLimitedUploadStream(ctx, stream)
+			ss, err := streamPkg.NewStreamSectionReader(&streamPkg.FileStream{
+				Ctx:    ctx,
+				Reader: rateLimited,
+				Obj:    &model.Object{Size: size},
+			}, int(partSize), &up)
+			if err != nil {
+				return err
+			}

 			// 先上传前100个分片
-			err = d.uploadPersonalParts(ctx, partInfos, resp.Data.PartInfos, rateLimited, p)
+			err = d.uploadPersonalParts(ctx, partInfos, resp.Data.PartInfos, ss, p)
 			if err != nil {
 				return err
 			}
@@ -711,13 +821,12 @@ func (d *Yun139) Put(ctx context.Context, dstDir model.Obj, stream model.FileStr
 						"accountType": 1,
 					},
 				}
-				pathname := "/file/getUploadUrl"
 				var moreresp PersonalUploadUrlResp
-				_, err = d.personalPost(pathname, moredata, &moreresp)
+				_, err = d.newPost(getUploadUrlPath, moredata, &moreresp)
 				if err != nil {
 					return err
 				}
-				err = d.uploadPersonalParts(ctx, partInfos, moreresp.Data.PartInfos, rateLimited, p)
+				err = d.uploadPersonalParts(ctx, partInfos, moreresp.Data.PartInfos, ss, p)
 				if err != nil {
 					return err
 				}
@@ -730,7 +839,11 @@ func (d *Yun139) Put(ctx context.Context, dstDir model.Obj, stream model.FileStr
 				"fileId":               resp.Data.FileId,
 				"uploadId":             resp.Data.UploadId,
 			}
-			_, err = d.personalPost("/file/complete", data, nil)
+			// 家庭云和共享群需要额外的参数
+			if d.isGroup() || d.isFamily() {
+				data["groupId"] = d.CloudID
+			}
+			_, err = d.newPost(completePath, data, nil)
 			if err != nil {
 				return err
 			}
@@ -775,11 +888,11 @@ func (d *Yun139) Put(ctx context.Context, dstDir model.Obj, stream model.FileStr
 			}
 		}
 		return nil
-	case MetaPersonal:
-		fallthrough
-	case MetaGroup:
-		fallthrough
-	case MetaFamily:
+	}
+
+	// 旧上传路径
+	switch d.Addition.Type {
+	case MetaPersonal, MetaGroup, MetaFamily:
 		// 处理冲突
 		// 获取文件列表
 		files, err := d.List(ctx, dstDir, model.ListArgs{})
@@ -826,11 +939,11 @@ func (d *Yun139) Put(ctx context.Context, dstDir model.Obj, stream model.FileStr
 			},
 		}
 		pathname := "/orchestration/personalCloud/uploadAndDownload/v1.0/pcUploadFileRequest"
-		if d.isFamily() || d.Addition.Type == MetaGroup {
-			uploadPath := path.Join(dstDir.GetPath(), dstDir.GetID())
-			// if dstDir is root folder
-			if dstDir.GetID() == d.RootFolderID {
-				uploadPath = d.RootPath
+		if d.isFamily() || d.isGroup() {
+			uploadPath := d.dirPath(dstDir)
+			// 共享群的根目录上传路径为 0
+			if d.isGroup() && dstDir.GetID() == d.RootFolderID {
+				uploadPath = "0"
 			}
 			data = d.newJson(base.Json{
 				"fileCount":    1,
@@ -858,56 +971,86 @@ func (d *Yun139) Put(ctx context.Context, dstDir model.Obj, stream model.FileStr
 		}

 		size := stream.GetSize()
+		partSize := d.getPartSize(size)
+
 		// Progress
 		p := driver.NewProgress(size, up)
-		partSize := d.getPartSize(size)
+		rateLimited := driver.NewLimitedUploadStream(ctx, stream)
+
+		// StreamSectionReader for per-chunk buffering and retry
+		ss, err := streamPkg.NewStreamSectionReader(&streamPkg.FileStream{
+			Ctx:    ctx,
+			Reader: rateLimited,
+			Obj:    &model.Object{Size: size},
+		}, int(partSize), &up)
+		if err != nil {
+			return err
+		}
+
 		part := int64(1)
 		if size > partSize {
 			part = (size + partSize - 1) / partSize
 		}
-		rateLimited := driver.NewLimitedUploadStream(ctx, stream)
 		for i := int64(0); i < part; i++ {
 			if utils.IsCanceled(ctx) {
 				return ctx.Err()
 			}
-
 			start := i * partSize
 			byteSize := min(size-start, partSize)

-			limitReader := io.LimitReader(rateLimited, byteSize)
-			// Update Progress
-			r := io.TeeReader(limitReader, p)
-			req, err := http.NewRequestWithContext(ctx, http.MethodPost, resp.Data.UploadResult.RedirectionURL, r)
-			if err != nil {
-				return err
+			rd, getErr := ss.GetSectionReader(start, byteSize)
+			if getErr != nil {
+				return getErr
 			}
-			req.Header.Set("Content-Type", "text/plain;name="+unicode(stream.GetName()))
-			req.Header.Set("contentSize", strconv.FormatInt(size, 10))
-			req.Header.Set("range", fmt.Sprintf("bytes=%d-%d", start, start+byteSize-1))
-			req.Header.Set("uploadtaskID", resp.Data.UploadResult.UploadTaskID)
-			req.Header.Set("rangeType", "0")
-			req.ContentLength = byteSize

-			res, err := base.HttpClient.Do(req)
+			err = retry.Do(
+				func() error {
+					if _, err := rd.Seek(0, io.SeekStart); err != nil {
+						return err
+					}
+					req, reqErr := http.NewRequestWithContext(ctx, http.MethodPost, resp.Data.UploadResult.RedirectionURL,
+						io.TeeReader(rd, p))
+					if reqErr != nil {
+						return reqErr
+					}
+					req.Header.Set("Content-Type", "text/plain;name="+unicode(stream.GetName()))
+					req.Header.Set("contentSize", strconv.FormatInt(size, 10))
+					req.Header.Set("range", fmt.Sprintf("bytes=%d-%d", start, start+byteSize-1))
+					req.Header.Set("uploadtaskID", resp.Data.UploadResult.UploadTaskID)
+					req.Header.Set("rangeType", "0")
+					req.ContentLength = byteSize
+
+					res, doErr := base.HttpClient.Do(req)
+					if doErr != nil {
+						return doErr
+					}
+					defer res.Body.Close()
+					bodyBytes, readErr := io.ReadAll(res.Body)
+					if readErr != nil {
+						return fmt.Errorf("error reading response body: %v", readErr)
+					}
+					if res.StatusCode != http.StatusOK {
+						return fmt.Errorf("unexpected status code: %d, body: %s", res.StatusCode, string(bodyBytes))
+					}
+					var result InterLayerUploadResult
+					xmlErr := xml.Unmarshal(bodyBytes, &result)
+					if xmlErr != nil {
+						return fmt.Errorf("error parsing XML: %v", xmlErr)
+					}
+					if result.ResultCode != 0 {
+						return fmt.Errorf("upload failed with result code: %d, message: %s", result.ResultCode, result.Msg)
+					}
+					return nil
+				},
+				retry.Context(ctx),
+				retry.Attempts(3),
+				retry.DelayType(retry.BackOffDelay),
+				retry.Delay(time.Second),
+			)
+			ss.FreeSectionReader(rd)
 			if err != nil {
 				return err
 			}
-			if res.StatusCode != http.StatusOK {
-				res.Body.Close()
-				return fmt.Errorf("unexpected status code: %d", res.StatusCode)
-			}
-			bodyBytes, err := io.ReadAll(res.Body)
-			if err != nil {
-				return fmt.Errorf("error reading response body: %v", err)
-			}
-			var result InterLayerUploadResult
-			err = xml.Unmarshal(bodyBytes, &result)
-			if err != nil {
-				return fmt.Errorf("error parsing XML: %v", err)
-			}
-			if result.ResultCode != 0 {
-				return fmt.Errorf("upload failed with result code: %d, message: %s", result.ResultCode, result.Msg)
-			}
 		}
 		return nil
 	default:
@@ -944,38 +1087,14 @@ func (d *Yun139) GetDetails(ctx context.Context) (*model.StorageDetails, error)
 	if d.UserDomainID == "" {
 		return nil, errs.NotImplement
 	}
-	var total, used int64
-	if d.isFamily() {
-		diskInfo, err := d.getFamilyDiskInfo(ctx)
-		if err != nil {
-			return nil, err
-		}
-		totalMb, err := strconv.ParseInt(diskInfo.Data.DiskSize, 10, 64)
-		if err != nil {
-			return nil, fmt.Errorf("failed convert disk size into integer: %+v", err)
-		}
-		usedMb, err := strconv.ParseInt(diskInfo.Data.UsedSize, 10, 64)
-		if err != nil {
-			return nil, fmt.Errorf("failed convert used size into integer: %+v", err)
-		}
-		total = totalMb * 1024 * 1024
-		used = usedMb * 1024 * 1024
-	} else {
-		diskInfo, err := d.getPersonalDiskInfo(ctx)
-		if err != nil {
-			return nil, err
-		}
-		totalMb, err := strconv.ParseInt(diskInfo.Data.DiskSize, 10, 64)
-		if err != nil {
-			return nil, fmt.Errorf("failed convert disk size into integer: %+v", err)
-		}
-		freeMb, err := strconv.ParseInt(diskInfo.Data.FreeDiskSize, 10, 64)
-		if err != nil {
-			return nil, fmt.Errorf("failed convert free size into integer: %+v", err)
-		}
-		total = totalMb * 1024 * 1024
-		used = total - (freeMb * 1024 * 1024)
+	detail, err := d.getDiskQuotaDetail(ctx)
+	if err != nil {
+		return nil, err
 	}
+
+	total := detail.Data.DiskSize * utils.MB
+	used := (detail.Data.DiskSize - detail.Data.FreeDiskSize) * utils.MB
+
 	return &model.StorageDetails{
 		DiskUsage: model.DiskUsage{
 			TotalSpace: total,
@@ -7,17 +7,20 @@ import (

 type Addition struct {
 	//Account       string `json:"account" required:"true"`
-	Authorization string `json:"authorization" type:"text" required:"true"`
-	Username      string `json:"username" required:"true"`
-	Password      string `json:"password" required:"true" secret:"true"`
-	MailCookies   string `json:"mail_cookies" required:"true" type:"text" help:"Cookies from mail.139.com used for login authentication."`
+	Authorization string `json:"authorization" type:"text" help:"Authorization can be used alone. If empty, use username + password; mail_cookies is optional and will be established/updated automatically. Existing mail_cookies can also be used alone for fast login."`
+	Username      string `json:"username" help:"Use together with password when Authorization is empty. mail_cookies may be left empty on the first login."`
+	Password      string `json:"password" secret:"true" help:"Use together with username when Authorization is empty. mail_cookies may be left empty on the first login."`
+	SmsCode       string `json:"sms_code" secret:"true" help:"Fill this only after OpenList reports that a 139 Mail SMS verification code was sent, then save the storage again."`
+	MailCookies   string `json:"mail_cookies" type:"text" help:"Optional cookies from mail.10086.cn. Leave empty for a first username/password login; cookies created or updated by password/SMS login are persisted and reused as device context. Existing cookies may also be used alone for fast login."`
 	driver.RootID
-	Type                 string `json:"type" type:"select" options:"personal_new,family,group,personal" default:"personal_new"`
+	Type                 string `json:"type" type:"select" options:"personal_new,family,group,personal,share" default:"personal_new"`
+	LinkID               string `json:"link_id" type:"text" help:"Multiple shares are separated by commas or new lines. Use link_id#password for password-protected shares."`
 	CloudID              string `json:"cloud_id"`
 	UserDomainID         string `json:"user_domain_id" help:"ud_id in Cookie, fill in to show disk usage"`
 	CustomUploadPartSize int64  `json:"custom_upload_part_size" type:"number" default:"0" help:"0 for auto"`
 	ReportRealSize       bool   `json:"report_real_size" type:"bool" default:"true" help:"Enable to report the real file size during upload"`
 	UseLargeThumbnail    bool   `json:"use_large_thumbnail" type:"bool" default:"false" help:"Enable to use large thumbnail for images"`
+	UseOldStreamUpload   bool   `json:"use_old_stream_upload" type:"bool" default:"false" help:"Enable to use old stream upload method (not support rapid upload)"`
 }

 var config = driver.Config{
@@ -0,0 +1,35 @@
+package _139
+
+import (
+	"testing"
+)
+
+func TestShareEntriesAndRefEncoding(t *testing.T) {
+	d := &Yun139{Addition: Addition{
+		Type:   MetaShare,
+		LinkID: "share-a,share-b,share-c#pass",
+	}}
+
+	entries := d.shareEntries()
+	if len(entries) != 3 {
+		t.Fatalf("expected 3 share entries, got %d", len(entries))
+	}
+	if entries[2].LinkID != "share-c" || entries[2].Password != "pass" {
+		t.Fatalf("unexpected password share entry: %+v", entries[2])
+	}
+
+	refs := []shareRef{
+		{LinkID: entries[0].LinkID, Password: entries[0].Password, NodeID: "root-a"},
+		{LinkID: entries[2].LinkID, Password: entries[2].Password, NodeID: "root-b"},
+	}
+	encoded := encodeShareRefs(refs)
+	decoded, ok := decodeShareRefs(encoded)
+	if !ok || len(decoded) != len(refs) {
+		t.Fatalf("failed to decode merged share refs: %q", encoded)
+	}
+	for i := range refs {
+		if decoded[i] != refs[i] {
+			t.Fatalf("unexpected decoded ref at %d: %+v", i, decoded[i])
+		}
+	}
+}
@@ -9,6 +9,7 @@ const (
 	MetaFamily      string = "family"
 	MetaGroup       string = "group"
 	MetaPersonalNew string = "personal_new"
+	MetaShare       string = "share"
 )

 type BaseResp struct {
@@ -285,6 +286,56 @@ type PersonalUploadUrlResp struct {
 	}
 }

+type ShareCatalog struct {
+	CaID   string `json:"caId"`
+	CaName string `json:"caName"`
+	UdTime string `json:"udTime"`
+}
+
+type ShareContent struct {
+	CoID        string `json:"coId"`
+	CoName      string `json:"coName"`
+	CoSize      int64  `json:"coSize"`
+	CoType      int    `json:"coType"`
+	UdTime      string `json:"udTime"`
+	CoPath      string `json:"coPath"`
+	PresentURL  string `json:"presentURL"`
+	DownloadURL string `json:"downloadURL"`
+}
+
+type ShareListResp struct {
+	BaseResp
+	Data struct {
+		LKName string         `json:"lkName"`
+		Passwd string         `json:"password"`
+		CaLst  []ShareCatalog `json:"caLst"`
+		CoLst  []ShareContent `json:"coLst"`
+	} `json:"data"`
+}
+
+type ShareContentInfo struct {
+	PresentURL  string `json:"presentURL"`
+	DownloadURL string `json:"cdnDownLoadUrl"`
+}
+
+type ShareDownloadResp struct {
+	BaseResp
+	Data struct {
+		DownloadURL string `json:"downloadURL"`
+		RedrURL     string `json:"redrUrl"`
+		ExtInfo     struct {
+			CDNDownloadURL string `json:"cdnDownloadUrl"`
+		} `json:"extInfo"`
+	} `json:"data"`
+}
+
+type ShareContentInfoResp struct {
+	BaseResp
+	Data struct {
+		ContentInfo ShareContentInfo `json:"contentInfo"`
+	} `json:"data"`
+}
+
 type QueryRoutePolicyResp struct {
 	Success bool   `json:"success"`
 	Code    string `json:"code"`
@@ -313,20 +364,16 @@ type RefreshTokenResp struct {
 	Desc        string   `xml:"desc"`
 }

-type PersonalDiskInfoResp struct {
+type DiskQuotaDetail struct {
 	BaseResp
 	Data struct {
-		FreeDiskSize         string `json:"freeDiskSize"`
-		DiskSize             string `json:"diskSize"`
-		IsInfinitePicStorage *bool  `json:"isInfinitePicStorage"`
-	} `json:"data"`
-}
-
-type FamilyDiskInfoResp struct {
-	BaseResp
-	Data struct {
-		UsedSize string `json:"usedSize"`
-		DiskSize string `json:"diskSize"`
+		FreeDiskSize int64 `json:"freeDiskSize"`
+		DiskSize     int64 `json:"diskSize"`
+		// QuotaList    []struct {
+		// 	DriveType int    `json:"driveType"`
+		// 	DriveName string `json:"driveName"`
+		// 	UsedSize  int64  `json:"usedSize"`
+		// } `json:"quotaList"`
 	} `json:"data"`
 }

@@ -0,0 +1,474 @@
+package _139
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/OpenListTeam/OpenList/v4/drivers/base"
+	"github.com/go-resty/resty/v2"
+)
+
+func useRetryingTestClient(t *testing.T) {
+	t.Helper()
+	oldClient := base.RestyClient
+	base.RestyClient = resty.New().SetRetryCount(3)
+	t.Cleanup(func() {
+		base.RestyClient = oldClient
+	})
+}
+
+func TestMergeMailCookiesPreservesExistingOrderAndAppendsNewNames(t *testing.T) {
+	got := mergeMailCookieHeader("z=zv; behaviorid=b; Os_SSo_Sid=old", []*http.Cookie{
+		{Name: "RMKEY", Value: "rm"},
+		{Name: "Os_SSo_Sid", Value: "sid"},
+		{Name: "a", Value: "av"},
+	})
+	want := "z=zv;behaviorid=b;Os_SSo_Sid=sid;RMKEY=rm;a=av"
+	if got != want {
+		t.Fatalf("mergeMailCookieHeader() = %q, want %q", got, want)
+	}
+}
+
+func TestExtractFastLoginCookies(t *testing.T) {
+	sid, rmkey := extractFastLoginCookies("RMKEY=rm; Os_SSo_Sid=sid")
+	if sid != "sid" || rmkey != "rm" {
+		t.Fatalf("extractFastLoginCookies() = %q, %q; want sid, rm", sid, rmkey)
+	}
+}
+
+func TestCredentialState(t *testing.T) {
+	tests := []struct {
+		name string
+		d    Yun139
+		want credentialState
+		err  bool
+	}{
+		{
+			name: "authorization",
+			d:    Yun139{Addition: Addition{Authorization: " auth "}},
+			want: credentialStateAuthorization,
+		},
+		{
+			name: "full login",
+			d: Yun139{Addition: Addition{
+				MailCookies: "RMKEY=rm; Os_SSo_Sid=sid",
+				Username:    "user",
+				Password:    "password",
+			}},
+			want: credentialStateFullLogin,
+		},
+		{
+			name: "full login without initial cookies",
+			d: Yun139{Addition: Addition{
+				Username: "user",
+				Password: "password",
+			}},
+			want: credentialStateFullLogin,
+		},
+		{
+			name: "cookies only",
+			d:    Yun139{Addition: Addition{MailCookies: "RMKEY=rm; Os_SSo_Sid=sid"}},
+			want: credentialStateCookiesOnly,
+		},
+		{
+			name: "partial password login",
+			d:    Yun139{Addition: Addition{Username: "user"}},
+			err:  true,
+		},
+		{
+			name: "missing credentials",
+			d:    Yun139{},
+			err:  true,
+		},
+		{
+			name: "invalid cookie",
+			d:    Yun139{Addition: Addition{MailCookies: "invalid-cookie"}},
+			err:  true,
+		},
+		{
+			name: "authorization with basic prefix",
+			d:    Yun139{Addition: Addition{Authorization: "Basic abc"}},
+			err:  true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := tt.d.credentialState()
+			if tt.err {
+				if err == nil {
+					t.Fatal("credentialState() expected error")
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("credentialState() unexpected error: %v", err)
+			}
+			if got != tt.want {
+				t.Fatalf("credentialState() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestIntegrationLoginObtainsAuthorization(t *testing.T) {
+	if os.Getenv("OPENLIST_139_INTEGRATION") != "1" {
+		t.Skip("set OPENLIST_139_INTEGRATION=1 to run live 139Yun login checks")
+	}
+	base.RestyClient = resty.New().
+		SetHeader("user-agent", base.UserAgent).
+		SetRetryCount(3).
+		SetRetryResetReaders(true).
+		SetTimeout(30 * time.Second)
+
+	username := os.Getenv("OPENLIST_139_USERNAME")
+	password := os.Getenv("OPENLIST_139_PASSWORD")
+	mailCookies := os.Getenv("OPENLIST_139_MAIL_COOKIES")
+	authorization := strings.TrimSpace(os.Getenv("OPENLIST_139_AUTHORIZATION"))
+
+	if authorization != "" {
+		t.Run("authorization", func(t *testing.T) {
+			d := Yun139{Addition: Addition{Authorization: authorization}}
+			state, err := d.credentialState()
+			if err != nil {
+				t.Fatalf("credentialState() unexpected error: %v", err)
+			}
+			if state != credentialStateAuthorization {
+				t.Fatalf("credentialState() = %v, want authorization", state)
+			}
+			if d.Authorization == "" || strings.HasPrefix(strings.ToLower(d.Authorization), "basic ") {
+				t.Fatal("authorization should be present without Basic prefix")
+			}
+		})
+	}
+
+	if mailCookies == "" {
+		t.Fatal("OPENLIST_139_MAIL_COOKIES is required")
+	}
+
+	runFastLogin := func(mailCookies string) error {
+		d := Yun139{Addition: Addition{MailCookies: mailCookies}}
+		state, err := d.credentialState()
+		if err != nil {
+			return fmt.Errorf("credentialState() error: %w", err)
+		}
+		if state != credentialStateCookiesOnly {
+			return fmt.Errorf("credentialState() = %v, want cookies only", state)
+		}
+		sid, rmkey := extractFastLoginCookies(d.MailCookies)
+		if sid == "" || rmkey == "" {
+			return fmt.Errorf("mail cookies are missing Os_SSo_Sid or RMKEY")
+		}
+		token, err := d.step2_get_single_token(sid)
+		if err != nil {
+			return fmt.Errorf("step2_get_single_token() error: %w", err)
+		}
+		auth, err := d.step3_third_party_login(token)
+		if err != nil {
+			return fmt.Errorf("step3_third_party_login() error: %w", err)
+		}
+		if auth == "" {
+			return fmt.Errorf("authorization is empty after fast login")
+		}
+		return nil
+	}
+
+	if username == "" || password == "" {
+		t.Fatal("OPENLIST_139_USERNAME and OPENLIST_139_PASSWORD are required for password fallback")
+	}
+
+	var refreshedMailCookies string
+	var generatedAuthorization string
+	t.Run("password login fallback", func(t *testing.T) {
+		d := Yun139{Addition: Addition{
+			MailCookies: mailCookies,
+			Username:    username,
+			Password:    password,
+		}}
+		state, err := d.credentialState()
+		if err != nil {
+			t.Fatalf("credentialState() unexpected error: %v", err)
+		}
+		if state != credentialStateFullLogin {
+			t.Fatalf("credentialState() = %v, want full login", state)
+		}
+		passId, err := d.step1_password_login()
+		if err != nil {
+			t.Fatalf("step1_password_login() error: %v", err)
+		}
+		token, err := d.step2_get_single_token(passId)
+		if err != nil {
+			t.Fatalf("step2_get_single_token() error: %v", err)
+		}
+		auth, err := d.step3_third_party_login(token)
+		if err != nil {
+			t.Fatalf("step3_third_party_login() error: %v", err)
+		}
+		d.Authorization = auth
+		if auth == "" || d.Authorization == "" {
+			t.Fatal("authorization is empty after password login")
+		}
+		generatedAuthorization = auth
+		refreshedMailCookies = d.MailCookies
+	})
+
+	t.Run("authorization generated by password login", func(t *testing.T) {
+		if generatedAuthorization == "" {
+			t.Fatal("password login did not generate authorization")
+		}
+		d := Yun139{Addition: Addition{Authorization: generatedAuthorization}}
+		state, err := d.credentialState()
+		if err != nil {
+			t.Fatalf("credentialState() unexpected error: %v", err)
+		}
+		if state != credentialStateAuthorization {
+			t.Fatalf("credentialState() = %v, want authorization", state)
+		}
+		if strings.HasPrefix(strings.ToLower(d.Authorization), "basic ") {
+			t.Fatal("authorization should not include Basic prefix")
+		}
+	})
+
+	t.Run("mail cookies fast login from input", func(t *testing.T) {
+		sid, rmkey := extractFastLoginCookies(mailCookies)
+		if sid == "" || rmkey == "" {
+			t.Skip("input mail cookies are missing Os_SSo_Sid or RMKEY")
+		}
+		if err := runFastLogin(mailCookies); err != nil {
+			t.Skipf("input mail cookies are stale or unusable: %v", err)
+		}
+	})
+
+	t.Run("mail cookies fast login after password login", func(t *testing.T) {
+		if refreshedMailCookies == "" {
+			t.Fatal("password login did not refresh mail cookies")
+		}
+		if err := runFastLogin(refreshedMailCookies); err != nil {
+			t.Fatalf("refreshed mail cookies fast login failed: %v", err)
+		}
+	})
+}
+
+func TestInvalidAuthorizationDoesNotUseCookieFastLogin(t *testing.T) {
+	d := Yun139{Addition: Addition{
+		Authorization: "not-base64",
+		MailCookies:   "Os_SSo_Sid=sid; RMKEY=rmkey",
+	}}
+
+	err := d.refreshToken()
+	if err == nil || !strings.Contains(err.Error(), "password login failed") {
+		t.Fatalf("refreshToken() error = %v, want password login fallback error", err)
+	}
+	if d.Authorization != "not-base64" {
+		t.Fatalf("Authorization = %q, want original invalid value retained", d.Authorization)
+	}
+}
+
+func TestSMSSceneForRisk(t *testing.T) {
+	tests := map[string]int{
+		"S025":         1,
+		"S035":         1,
+		"PML401010062": 2,
+		"MW0016":       4,
+	}
+	for riskCode, want := range tests {
+		got, ok := smsSceneForRisk(riskCode)
+		if !ok || got != want {
+			t.Fatalf("smsSceneForRisk(%q) = %d, %t; want %d, true", riskCode, got, ok, want)
+		}
+	}
+	if _, ok := smsSceneForRisk("PICTURE_ONLY"); ok {
+		t.Fatal("smsSceneForRisk() accepted unsupported risk code")
+	}
+}
+
+func TestSendSMSVerificationCode(t *testing.T) {
+	useRetryingTestClient(t)
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		body, err := io.ReadAll(r.Body)
+		if err != nil {
+			t.Fatalf("read request body: %v", err)
+		}
+		if r.URL.Query().Get("func") != "login:sendSmsCodeByScene" {
+			t.Errorf("func = %q", r.URL.Query().Get("func"))
+		}
+		if !strings.Contains(string(body), `<string name="scene">1</string>`) {
+			t.Errorf("request body = %s", body)
+		}
+		if !strings.Contains(r.Header.Get("Cookie"), "device=fingerprint") {
+			t.Errorf("Cookie = %q", r.Header.Get("Cookie"))
+		}
+		http.SetCookie(w, &http.Cookie{Name: "challenge", Value: "sms"})
+		_, _ = io.WriteString(w, `{"code":"S_OK"}`)
+	}))
+	defer server.Close()
+
+	oldURL := mailSMSURL
+	mailSMSURL = server.URL
+	defer func() { mailSMSURL = oldURL }()
+
+	d := Yun139{Addition: Addition{Username: "18800000000", MailCookies: "device=fingerprint"}}
+	if err := d.sendSMSVerificationCode("S025"); err != nil {
+		t.Fatalf("sendSMSVerificationCode() error = %v", err)
+	}
+	if !strings.Contains(d.MailCookies, "challenge=sms") {
+		t.Fatalf("MailCookies = %q", d.MailCookies)
+	}
+}
+
+func TestSendSMSVerificationCodeStopsAtPictureChallenge(t *testing.T) {
+	useRetryingTestClient(t)
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = io.WriteString(w, `{"code":"PML401010021"}`)
+	}))
+	defer server.Close()
+
+	oldURL := mailSMSURL
+	mailSMSURL = server.URL
+	defer func() { mailSMSURL = oldURL }()
+
+	d := Yun139{Addition: Addition{Username: "18800000000"}}
+	err := d.sendSMSVerificationCode("S025")
+	if err == nil || !strings.Contains(err.Error(), "requires picture verification") {
+		t.Fatalf("sendSMSVerificationCode() error = %v", err)
+	}
+}
+
+func TestVerifySMSCode(t *testing.T) {
+	useRetryingTestClient(t)
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		body, err := io.ReadAll(r.Body)
+		if err != nil {
+			t.Fatalf("read request body: %v", err)
+		}
+		if r.URL.Query().Get("func") != "/login/inlogin.action" {
+			t.Errorf("func = %q", r.URL.Query().Get("func"))
+		}
+		wantHash := sha1Hash("fetion.com.cn:123456")
+		if !strings.Contains(string(body), `<string name="loginPassword">`+wantHash+`</string>`) {
+			t.Errorf("request body does not contain SMS code hash: %s", body)
+		}
+		http.SetCookie(w, &http.Cookie{Name: "RMKEY", Value: "new-rmkey"})
+		_, _ = io.WriteString(w, `{"code":"S_OK","var":{"loginSuccessUrl":"https://mail.10086.cn/?sid=sms-sid"}}`)
+	}))
+	defer server.Close()
+
+	oldURL := mailSMSURL
+	mailSMSURL = server.URL
+	defer func() { mailSMSURL = oldURL }()
+
+	d := Yun139{Addition: Addition{
+		Username:    "18800000000",
+		SmsCode:     "123456",
+		MailCookies: "challenge=sms",
+	}}
+	sid, err := d.verifySMSCode("S025")
+	if err != nil {
+		t.Fatalf("verifySMSCode() error = %v", err)
+	}
+	if sid != "sms-sid" {
+		t.Fatalf("sid = %q", sid)
+	}
+	if d.SmsCode != "" {
+		t.Fatalf("SmsCode = %q, want cleared", d.SmsCode)
+	}
+	if !strings.Contains(d.MailCookies, "RMKEY=new-rmkey") {
+		t.Fatalf("MailCookies = %q", d.MailCookies)
+	}
+}
+
+func TestPasswordLoginWithoutInitialCookiesStopsAtRedirectAndPersistsCookies(t *testing.T) {
+	useRetryingTestClient(t)
+
+	var loginRequests, redirectRequests int
+	var server *httptest.Server
+	server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/Login/Login.ashx":
+			loginRequests++
+			http.SetCookie(w, &http.Cookie{Name: "RMKEY", Value: "new-rm"})
+			http.SetCookie(w, &http.Cookie{Name: "Os_SSo_Sid", Value: "new-sid"})
+			w.Header().Set("Location", server.URL+"/appmail?sid=single-sid")
+			w.WriteHeader(http.StatusFound)
+		case "/appmail":
+			redirectRequests++
+			w.WriteHeader(http.StatusOK)
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+
+	oldURL := mailPasswordURL
+	mailPasswordURL = server.URL + "/Login/Login.ashx"
+	defer func() { mailPasswordURL = oldURL }()
+
+	d := Yun139{Addition: Addition{Username: "18800000000", Password: "password"}}
+	sid, err := d.step1_password_login()
+	if err != nil || sid != "single-sid" {
+		t.Fatalf("sid=%q err=%v", sid, err)
+	}
+	if loginRequests != 1 || redirectRequests != 0 {
+		t.Fatalf("login/redirect requests=%d/%d, want 1/0", loginRequests, redirectRequests)
+	}
+	if !strings.Contains(d.MailCookies, "RMKEY=new-rm") || !strings.Contains(d.MailCookies, "Os_SSo_Sid=new-sid") {
+		t.Fatalf("response cookies were not persisted: %q", d.MailCookies)
+	}
+}
+
+func TestPasswordLoginReusesRawRefreshedCookies(t *testing.T) {
+	useRetryingTestClient(t)
+
+	var n int
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		n++
+		cookie := r.Header.Get("Cookie")
+		if !strings.Contains(cookie, "JSESSIONID=stale") || !strings.Contains(cookie, "behaviorid=device") {
+			t.Errorf("login %d lost raw cookie context: %q", n, cookie)
+		}
+		if n == 1 {
+			http.SetCookie(w, &http.Cookie{Name: "RMKEY", Value: "rm-1"})
+			http.SetCookie(w, &http.Cookie{Name: "Os_SSo_Sid", Value: "sid-1"})
+			w.Header().Set("Location", "https://mail.10086.cn/?sid=first")
+		} else {
+			if !strings.Contains(cookie, "RMKEY=rm-1") || !strings.Contains(cookie, "Os_SSo_Sid=sid-1") {
+				t.Errorf("second login did not reuse first refreshed cookies: %q", cookie)
+			}
+			http.SetCookie(w, &http.Cookie{Name: "RMKEY", Value: "rm-2"})
+			http.SetCookie(w, &http.Cookie{Name: "Os_SSo_Sid", Value: "sid-2"})
+			w.Header().Set("Location", "https://mail.10086.cn/?sid=second")
+		}
+		w.WriteHeader(http.StatusFound)
+	}))
+	defer server.Close()
+
+	oldURL := mailPasswordURL
+	mailPasswordURL = server.URL
+	defer func() { mailPasswordURL = oldURL }()
+
+	d := Yun139{Addition: Addition{Username: "18800000000", Password: "password", MailCookies: "Os_SSo_Sid=old; RMKEY=old; JSESSIONID=stale; behaviorid=device"}}
+	if sid, err := d.step1_password_login(); err != nil || sid != "first" {
+		t.Fatalf("first login sid=%q err=%v", sid, err)
+	}
+	refreshed := d.MailCookies
+	if !strings.Contains(refreshed, "RMKEY=rm-1") || !strings.Contains(refreshed, "Os_SSo_Sid=sid-1") {
+		t.Fatalf("first login did not persist refreshed cookies: %q", refreshed)
+	}
+	d.Authorization = ""
+	d.MailCookies = refreshed
+	if sid, err := d.step1_password_login(); err != nil || sid != "second" {
+		t.Fatalf("second login sid=%q err=%v", sid, err)
+	}
+	if n != 2 {
+		t.Fatalf("login count=%d, want 2", n)
+	}
+}
@@ -0,0 +1,149 @@
+package _189
+
+import (
+	"context"
+	"crypto/sha1"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/OpenListTeam/OpenList/v4/internal/model"
+	"github.com/OpenListTeam/OpenList/v4/pkg/torrent"
+	"github.com/OpenListTeam/OpenList/v4/pkg/utils"
+)
+
+// GenerateTorrent 根据上传过程中收集的哈希信息生成包含 CAS 扩展的 torrent 文件
+func GenerateTorrent(fileName string, fileSize int64, fileMD5 string, sliceMD5s []string, sliceSize int64, pieceHashes []byte) ([]byte, error) {
+	// 计算 sliceMD5
+	sliceMD5 := fileMD5
+	if len(sliceMD5s) > 1 {
+		joined := strings.Join(sliceMD5s, "\n")
+		sliceMD5 = strings.ToUpper(torrent.GetMD5Str(joined))
+	}
+
+	t := torrent.NewTorrent(fileName, fileSize, fileMD5)
+	t.Info.PieceLength = sliceSize
+	t.SetPieces(pieceHashes)
+	t.SetCASInfo(&torrent.CASInfo{
+		FileMD5:   fileMD5,
+		SliceMD5:  sliceMD5,
+		SliceMD5s: sliceMD5s,
+		SliceSize: sliceSize,
+		Cloud:     "189",
+	})
+
+	return t.Encode()
+}
+
+// RapidUploadFromTorrent 从 torrent 文件中提取 CAS 信息进行秒传
+func (d *Cloud189) RapidUploadFromTorrent(ctx context.Context, dstDir model.Obj, torrentData []byte) error {
+	// 解析 torrent
+	t, err := torrent.Decode(torrentData)
+	if err != nil {
+		return fmt.Errorf("解析 torrent 失败: %w", err)
+	}
+
+	// 检查是否包含 CAS 扩展信息
+	if !t.HasCASInfo() {
+		return fmt.Errorf("torrent 不包含 CAS 扩展信息，无法秒传")
+	}
+
+	cas := t.CAS
+	fileName := t.Info.Name
+	fileSize := t.GetTotalSize()
+
+	// 获取 sessionKey
+	sessionKey, err := d.getSessionKey()
+	if err != nil {
+		return err
+	}
+	d.sessionKey = sessionKey
+
+	// 初始化上传
+	res, err := d.uploadRequest("/person/initMultiUpload", map[string]string{
+		"parentFolderId": dstDir.GetID(),
+		"fileName":       encode(fileName),
+		"fileSize":       fmt.Sprint(fileSize),
+		"sliceSize":      fmt.Sprint(cas.SliceSize),
+		"lazyCheck":      "1",
+	}, nil)
+	if err != nil {
+		return fmt.Errorf("初始化上传失败: %w", err)
+	}
+
+	uploadFileId := utils.Json.Get(res, "data", "uploadFileId").ToString()
+
+	// 提交上传（使用 CAS 信息秒传）
+	_, err = d.uploadRequest("/person/commitMultiUploadFile", map[string]string{
+		"uploadFileId": uploadFileId,
+		"fileMd5":      cas.FileMD5,
+		"sliceMd5":     cas.SliceMD5,
+		"lazyCheck":    "1",
+		"opertype":     "3",
+	}, nil)
+	if err != nil {
+		return fmt.Errorf("秒传提交失败: %w", err)
+	}
+
+	return nil
+}
+
+// ComputeTorrentFromReader 从 io.Reader 计算并生成 torrent 文件
+func ComputeTorrentFromReader(reader io.Reader, fileName string, fileSize int64, sliceSize int64) ([]byte, error) {
+	if sliceSize <= 0 {
+		sliceSize = torrent.DefaultPieceSize
+	}
+
+	hw := torrent.NewHashWriter(sliceSize, sliceSize)
+
+	buf := make([]byte, 32*1024)
+	for {
+		n, err := reader.Read(buf)
+		if n > 0 {
+			hw.Write(buf[:n])
+		}
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return nil, err
+		}
+	}
+	hw.Finish()
+
+	fileMD5 := hw.GetFileMD5()
+	sliceMD5s := hw.GetSliceMD5s()
+	pieceHashes := hw.GetPieceHashes()
+
+	return GenerateTorrent(fileName, fileSize, fileMD5, sliceMD5s, sliceSize, pieceHashes)
+}
+
+// ComputePieceSHA1 计算单个分片的 SHA-1 哈希
+func ComputePieceSHA1(data []byte) []byte {
+	h := sha1.Sum(data)
+	return h[:]
+}
+
+// ExtractCASFromTorrent 从 torrent 数据中提取 CAS 信息
+func ExtractCASFromTorrent(torrentData []byte) (*torrent.CASInfo, string, int64, error) {
+	t, err := torrent.Decode(torrentData)
+	if err != nil {
+		return nil, "", 0, fmt.Errorf("解析 torrent 失败: %w", err)
+	}
+
+	if !t.HasCASInfo() {
+		return nil, "", 0, fmt.Errorf("torrent 不包含 CAS 扩展信息")
+	}
+
+	return t.CAS, t.Info.Name, t.GetTotalSize(), nil
+}
+
+// GetInfoHashHex 获取 torrent 的 info_hash（十六进制字符串）
+func GetInfoHashHex(torrentData []byte) (string, error) {
+	t, err := torrent.Decode(torrentData)
+	if err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(t.InfoHash), nil
+}
@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"crypto/md5"
+	sha1Pkg "crypto/sha1"
 	"encoding/base64"
 	"encoding/hex"
 	"errors"
@@ -18,6 +19,8 @@ import (
 	"github.com/OpenListTeam/OpenList/v4/drivers/base"
 	"github.com/OpenListTeam/OpenList/v4/internal/driver"
 	"github.com/OpenListTeam/OpenList/v4/internal/model"
+	"github.com/OpenListTeam/OpenList/v4/internal/op"
+	"github.com/OpenListTeam/OpenList/v4/internal/stream"
 	"github.com/OpenListTeam/OpenList/v4/pkg/utils"
 	myrand "github.com/OpenListTeam/OpenList/v4/pkg/utils/random"
 	"github.com/go-resty/resty/v2"
@@ -311,48 +314,107 @@ func (d *Cloud189) newUpload(ctx context.Context, dstDir model.Obj, file model.F
 	}
 	d.sessionKey = sessionKey
 	const DEFAULT int64 = 10485760
-	count := int64(math.Ceil(float64(file.GetSize()) / float64(DEFAULT)))
+	fileSize := file.GetSize()
+	count := int64(math.Ceil(float64(fileSize) / float64(DEFAULT)))

-	res, err := d.uploadRequest("/person/initMultiUpload", map[string]string{
+	// 先计算文件完整MD5和分片MD5，用于秒传判断
+	fileMd5Hex := file.GetHash().GetHash(utils.MD5)
+	sliceMd5Hex := ""
+	md5s := make([]string, 0)
+
+	if len(fileMd5Hex) < utils.MD5.Width {
+		// 没有MD5，先缓存流并同时计算文件MD5和分片MD5
+		fileMd5Hash := md5.New()
+		sliceMd5Hash := md5.New()
+		var finish int64
+		cache, err := file.CacheFullAndWriter(nil, io.MultiWriter(fileMd5Hash, &sliceHashWriter{
+			hash:      sliceMd5Hash,
+			md5s:      &md5s,
+			sliceSize: DEFAULT,
+			finish:    &finish,
+			fileSize:  fileSize,
+			up:        up,
+			ctx:       ctx,
+		}))
+		if err != nil {
+			return err
+		}
+		// 处理最后一个分片的MD5
+		if finish%DEFAULT != 0 || finish == 0 {
+			md5s = append(md5s, strings.ToUpper(hex.EncodeToString(sliceMd5Hash.Sum(nil))))
+		}
+		fileMd5Hex = hex.EncodeToString(fileMd5Hash.Sum(nil))
+
+		// seek回起始位置，供后续上传使用
+		if _, err := cache.Seek(0, io.SeekStart); err != nil {
+			return err
+		}
+	}
+
+	// 计算sliceMd5
+	if fileSize > DEFAULT && len(md5s) > 0 {
+		sliceMd5Hex = utils.GetMD5EncodeStr(strings.Join(md5s, "\n"))
+	} else {
+		sliceMd5Hex = fileMd5Hex
+	}
+
+	// 带fileMd5调用initMultiUpload，支持秒传
+	initParams := map[string]string{
 		"parentFolderId": dstDir.GetID(),
 		"fileName":       encode(file.GetName()),
-		"fileSize":       strconv.FormatInt(file.GetSize(), 10),
+		"fileSize":       strconv.FormatInt(fileSize, 10),
 		"sliceSize":      strconv.FormatInt(DEFAULT, 10),
-		"lazyCheck":      "1",
-	}, nil)
+		"fileMd5":        fileMd5Hex,
+		"sliceMd5":       sliceMd5Hex,
+	}
+
+	res, err := d.uploadRequest("/person/initMultiUpload", initParams, nil)
 	if err != nil {
 		return err
 	}
 	uploadFileId := jsoniter.Get(res, "data", "uploadFileId").ToString()
-	//_, err = d.uploadRequest("/person/getUploadedPartsInfo", map[string]string{
-	//	"uploadFileId": uploadFileId,
-	//}, nil)
+	fileDataExists := jsoniter.Get(res, "data", "fileDataExists").ToInt()
+
+	// 秒传成功，直接提交
+	if fileDataExists == 1 {
+		_, err = d.uploadRequest("/person/commitMultiUploadFile", map[string]string{
+			"uploadFileId": uploadFileId,
+			"fileMd5":      fileMd5Hex,
+			"sliceMd5":     sliceMd5Hex,
+			"lazyCheck":    "1",
+			"opertype":     "3",
+		}, nil)
+		return err
+	}
+
+	// 非秒传，需要上传分片
 	var finish int64 = 0
 	var i int64
 	var byteSize int64
-	md5s := make([]string, 0)
-	md5Sum := md5.New()
+
+	// 额外计算 SHA-1 piece hash 用于生成 torrent
+	pieceSHA1Hashes := make([]byte, 0, int(count)*20)
+
 	for i = 1; i <= count; i++ {
 		if utils.IsCanceled(ctx) {
 			return ctx.Err()
 		}
-		byteSize = file.GetSize() - finish
+		byteSize = fileSize - finish
 		if DEFAULT < byteSize {
 			byteSize = DEFAULT
 		}
-		// log.Debugf("%d,%d", byteSize, finish)
 		byteData := make([]byte, byteSize)
 		n, err := io.ReadFull(file, byteData)
-		// log.Debug(err, n)
 		if err != nil {
 			return err
 		}
 		finish += int64(n)
 		md5Bytes := getMd5(byteData)
-		md5Hex := hex.EncodeToString(md5Bytes)
 		md5Base64 := base64.StdEncoding.EncodeToString(md5Bytes)
-		md5s = append(md5s, strings.ToUpper(md5Hex))
-		md5Sum.Write(byteData)
+
+		// 计算 SHA-1 piece hash
+		sha1Hash := sha1Pkg.Sum(byteData)
+		pieceSHA1Hashes = append(pieceSHA1Hashes, sha1Hash[:]...)
 		var resp UploadUrlsResp
 		res, err = d.uploadRequest("/person/getMultiUploadUrls", map[string]string{
 			"partInfo":     fmt.Sprintf("%s-%s", strconv.FormatInt(i, 10), md5Base64),
@@ -379,21 +441,58 @@ func (d *Cloud189) newUpload(ctx context.Context, dstDir model.Obj, file model.F
 		}
 		log.Debugf("%+v %+v", r, r.Request.Header)
 		_ = r.Body.Close()
-		up(float64(i) * 100 / float64(count))
-	}
-	fileMd5 := hex.EncodeToString(md5Sum.Sum(nil))
-	sliceMd5 := fileMd5
-	if file.GetSize() > DEFAULT {
-		sliceMd5 = utils.GetMD5EncodeStr(strings.Join(md5s, "\n"))
+		up(50 + float64(i)*50/float64(count))
 	}
 	res, err = d.uploadRequest("/person/commitMultiUploadFile", map[string]string{
 		"uploadFileId": uploadFileId,
-		"fileMd5":      fileMd5,
-		"sliceMd5":     sliceMd5,
+		"fileMd5":      fileMd5Hex,
+		"sliceMd5":     sliceMd5Hex,
 		"lazyCheck":    "1",
 		"opertype":     "3",
 	}, nil)
-	return err
+	if err != nil {
+		return err
+	}
+
+	// 生成 torrent 文件（异步，不影响上传结果）
+	capturedDstDir := dstDir
+	capturedFileName := file.GetName()
+	capturedFileSize := fileSize
+	capturedFileMd5Hex := fileMd5Hex
+	capturedMd5s := md5s
+	go func() {
+		fileMD5Upper := strings.ToUpper(capturedFileMd5Hex)
+		torrentData, err := GenerateTorrent(capturedFileName, capturedFileSize, fileMD5Upper, capturedMd5s, DEFAULT, pieceSHA1Hashes)
+		if err != nil {
+			log.Warnf("生成 torrent 失败: %v", err)
+			return
+		}
+		infoHash, _ := GetInfoHashHex(torrentData)
+		torrentName := capturedFileName + ".cas.torrent"
+		log.Infof("已生成 torrent: %s (info_hash: %s, size: %d bytes)",
+			torrentName, infoHash, len(torrentData))
+
+		// 将 torrent 文件上传到同一目录
+		torrentFileStream := &stream.FileStream{
+			Ctx: context.Background(),
+			Obj: &model.Object{
+				Name:     torrentName,
+				Size:     int64(len(torrentData)),
+				IsFolder: false,
+			},
+			Reader:   bytes.NewReader(torrentData),
+			Mimetype: "application/x-bittorrent",
+		}
+		uploadErr := d.oldUpload(capturedDstDir, torrentFileStream)
+		if uploadErr != nil {
+			log.Warnf("上传 torrent 文件失败: %v", uploadErr)
+		} else {
+			log.Infof("torrent 文件已上传: %s", torrentName)
+			op.Cache.DeleteDirectory(d, capturedDstDir.GetPath())
+		}
+	}()
+
+	return nil
 }

 func (d *Cloud189) getCapacityInfo(ctx context.Context) (*CapacityResp, error) {
@@ -406,3 +505,52 @@ func (d *Cloud189) getCapacityInfo(ctx context.Context) (*CapacityResp, error) {
 	}
 	return &resp, nil
 }
+
+// sliceHashWriter 在写入过程中按分片大小自动切分并计算每个分片的MD5，
+// 同时支持进度回调和取消检查。
+type sliceHashWriter struct {
+	hash      io.Writer // 当前分片的MD5 hash
+	md5s      *[]string // 收集每个分片的MD5十六进制字符串
+	sliceSize int64     // 分片大小
+	finish    *int64    // 已写入的总字节数
+	fileSize  int64     // 文件总大小
+	up        driver.UpdateProgress
+	ctx       context.Context
+}
+
+func (w *sliceHashWriter) Write(p []byte) (int, error) {
+	if utils.IsCanceled(w.ctx) {
+		return 0, w.ctx.Err()
+	}
+	total := len(p)
+	written := 0
+	for written < total {
+		// 当前分片还能写入的字节数
+		sliceRemain := w.sliceSize - (*w.finish % w.sliceSize)
+		toWrite := int64(total - written)
+		if toWrite > sliceRemain {
+			toWrite = sliceRemain
+		}
+		n, err := w.hash.Write(p[written : written+int(toWrite)])
+		if err != nil {
+			return written, err
+		}
+		written += n
+		*w.finish += int64(n)
+
+		// 当前分片写满，记录MD5并重置
+		if *w.finish%w.sliceSize == 0 {
+			if h, ok := w.hash.(interface{ Sum([]byte) []byte }); ok {
+				*w.md5s = append(*w.md5s, strings.ToUpper(hex.EncodeToString(h.Sum(nil))))
+			}
+			if resetter, ok := w.hash.(interface{ Reset() }); ok {
+				resetter.Reset()
+			}
+		}
+	}
+	// 报告进度（缓存阶段占50%）
+	if w.fileSize > 0 && w.up != nil {
+		w.up(float64(*w.finish) / float64(w.fileSize) * 50)
+	}
+	return total, nil
+}
@@ -5,12 +5,15 @@ import (
 	"crypto/hmac"
 	"crypto/sha1"
 	"encoding/hex"
+	"encoding/json"
 	"encoding/xml"
 	"fmt"
 	"net/http"
 	"regexp"
 	"strings"
 	"time"
+
+	"github.com/OpenListTeam/OpenList/v4/pkg/utils"
 )

 func clientSuffix() map[string]string {
@@ -57,7 +60,13 @@ func timestamp() int64 {

 type Time time.Time

-func (t *Time) UnmarshalJSON(b []byte) error { return t.Unmarshal(b) }
+func (t *Time) UnmarshalJSON(b []byte) error {
+	var s string
+	if err := json.Unmarshal(b, &s); err != nil {
+		return err
+	}
+	return t.Unmarshal([]byte(s))
+}
 func (t *Time) UnmarshalXML(e *xml.Decoder, ee xml.StartElement) error {
 	b, err := e.Token()
 	if err != nil {
@@ -72,10 +81,19 @@ func (t *Time) UnmarshalXML(e *xml.Decoder, ee xml.StartElement) error {
 }
 func (t *Time) Unmarshal(b []byte) error {
 	bs := strings.Trim(string(b), "\"")
+	// 189 时间串里 AM/PM 前可能使用 U+202F 窄不换行空格或 U+00A0 不换行空格，统一替换为普通空格
+	bs = strings.ReplaceAll(bs, "\u202f", " ")
+	bs = strings.ReplaceAll(bs, "\u00a0", " ")
 	var v time.Time
 	var err error
-	for _, f := range []string{"2006-01-02 15:04:05 -07", "Jan 2, 2006 15:04:05 PM -07"} {
-		v, err = time.ParseInLocation(f, bs+" +08", time.Local)
+	// 189 返回的时间可能自带时区（如 "Aug 11, 2026, 10:37:18 PM +08"），也可能不带，分别尝试
+	for _, s := range []string{bs, bs + " +08"} {
+		for _, f := range []string{"2006-01-02 15:04:05 -07", "Jan 2, 2006 3:04:05 PM -07", "Jan 2, 2006, 3:04:05 PM -07"} {
+			v, err = time.ParseInLocation(f, s, utils.CNLoc)
+			if err == nil {
+				break
+			}
+		}
 		if err == nil {
 			break
 		}
@@ -0,0 +1,65 @@
+package _189_tv
+
+import (
+	"encoding/json"
+	"encoding/xml"
+	"testing"
+	"time"
+)
+
+func TestTimeUnmarshal(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  time.Time
+	}{
+		{"numeric date", `"2026-08-11 10:37:18"`, time.Date(2026, 8, 11, 10, 37, 18, 0, time.FixedZone("", 8*3600))},
+		{"legacy month date", `"Aug 11, 2026 10:37:18 PM"`, time.Date(2026, 8, 11, 22, 37, 18, 0, time.FixedZone("", 8*3600))},
+		{"new format with tz", `"Aug 11, 2026, 10:37:18 PM +08"`, time.Date(2026, 8, 11, 22, 37, 18, 0, time.FixedZone("", 8*3600))},
+		{"new format no tz", `"Aug 11, 2026, 10:37:18 PM"`, time.Date(2026, 8, 11, 22, 37, 18, 0, time.FixedZone("", 8*3600))},
+		{"narrow no-break space (U+202F)", "\"Aug 12, 2026, 12:35:41\u202fAM +08\"", time.Date(2026, 8, 12, 0, 35, 41, 0, time.FixedZone("", 8*3600))},
+		{"no-break space (U+00A0)", "\"Aug 12, 2026, 12:35:41\u00a0AM +08\"", time.Date(2026, 8, 12, 0, 35, 41, 0, time.FixedZone("", 8*3600))},
+		{"JSON escaped narrow space", `"Sep 4, 2026, 10:59:33\u202fPM +08"`, time.Date(2026, 9, 4, 22, 59, 33, 0, time.FixedZone("", 8*3600))},
+		{"JSON escaped space without timezone", `"Sep 4, 2026, 12:59:33\u00a0AM"`, time.Date(2026, 9, 4, 0, 59, 33, 0, time.FixedZone("", 8*3600))},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var tm Time
+			if err := json.Unmarshal([]byte(tt.input), &tm); err != nil {
+				t.Fatalf("Unmarshal(%s) error: %v", tt.input, err)
+			}
+			if !tt.want.Equal(time.Time(tm)) {
+				t.Fatalf("Unmarshal(%s) = %v, want %v", tt.input, time.Time(tm), tt.want)
+			}
+		})
+	}
+}
+
+func TestTimeUnmarshalRejectsInvalid(t *testing.T) {
+	var tm Time
+	if err := tm.Unmarshal([]byte("Aug 12, 2026, 25:32:44 AM")); err == nil {
+		t.Fatal("Unmarshal accepted an invalid time")
+	}
+}
+
+func TestTimeUnmarshalJSONRejectsInvalid(t *testing.T) {
+	for _, input := range []string{`"invalid"`, `123`, `null`, `"Sep 4, 2026, 10:59:33\uZZZZPM +08"`} {
+		t.Run(input, func(t *testing.T) {
+			var tm Time
+			if err := tm.UnmarshalJSON([]byte(input)); err == nil {
+				t.Fatalf("UnmarshalJSON(%s) accepted invalid input", input)
+			}
+		})
+	}
+}
+
+func TestTimeUnmarshalXML(t *testing.T) {
+	var tm Time
+	if err := xml.Unmarshal([]byte(`<time>Sep 4, 2026, 10:59:33&#x202f;PM +08</time>`), &tm); err != nil {
+		t.Fatal(err)
+	}
+	want := time.Date(2026, 9, 4, 22, 59, 33, 0, time.FixedZone("", 8*3600))
+	if !want.Equal(time.Time(tm)) {
+		t.Fatalf("UnmarshalXML = %v, want %v", time.Time(tm), want)
+	}
+}
@@ -184,6 +184,7 @@ func (y *Cloud189TV) getFiles(ctx context.Context, fileId string, isFamily bool)
 	}
 	fullUrl += "/listFiles.action"

+    pageSize := 130  // 每一页返回的文件数量
 	res := make([]model.Obj, 0, 130)
 	for pageNum := 1; ; pageNum++ {
 		var resp Cloud189FilesResp
@@ -195,7 +196,7 @@ func (y *Cloud189TV) getFiles(ctx context.Context, fileId string, isFamily bool)
 				"mediaAttr":  "0",
 				"iconOption": "5",
 				"pageNum":    fmt.Sprint(pageNum),
-				"pageSize":   "130",
+				"pageSize":   fmt.Sprint(pageSize),
 			})
 			if isFamily {
 				r.SetQueryParams(map[string]string{
@@ -218,13 +219,22 @@ func (y *Cloud189TV) getFiles(ctx context.Context, fileId string, isFamily bool)
 		if resp.FileListAO.Count == 0 {
 			break
 		}
+		
+		FolderCount := len(resp.FileListAO.FolderList) // 当前文件夹总数
+        FileCount := len(resp.FileListAO.FileList) // 当前文件总数
+        PageCount := FolderCount + FileCount // 当前页数总数

-		for i := 0; i < len(resp.FileListAO.FolderList); i++ {
+		for i := 0; i < FolderCount; i++ {
 			res = append(res, &resp.FileListAO.FolderList[i])
 		}
-		for i := 0; i < len(resp.FileListAO.FileList); i++ {
+		for i := 0; i < FileCount; i++ {
 			res = append(res, &resp.FileListAO.FileList[i])
 		}
+		
+		// 文件数量小于设定数量时跳出
+		if PageCount < pageSize {
+            break
+        }
 	}
 	return res, nil
 }
@@ -87,7 +87,12 @@ func (y *Cloud189PC) Init(ctx context.Context) (err error) {
 		}

 		// 先尝试用Token刷新，之后尝试登陆
-		if y.Addition.RefreshToken != "" {
+		if y.Addition.AccessToken != "" {
+			y.tokenInfo = &AppSessionResp{AccessToken: y.Addition.AccessToken, RefreshToken: y.Addition.RefreshToken}
+			if err = y.refreshSession(); err != nil {
+				return err
+			}
+		} else if y.Addition.RefreshToken != "" {
 			y.tokenInfo = &AppSessionResp{RefreshToken: y.Addition.RefreshToken}
 			if err = y.refreshToken(); err != nil {
 				return err
@@ -257,6 +262,16 @@ func (y *Cloud189PC) Move(ctx context.Context, srcObj, dstDir model.Obj) (model.
 	if err = y.WaitBatchTask("MOVE", resp.TaskID, time.Millisecond*400); err != nil {
 		return nil, err
 	}
+
+	// 跟随移动 torrent 文件
+	if !srcObj.IsDir() {
+		var srcFolderId string
+		if f, ok := srcObj.(*Cloud189File); ok {
+			srcFolderId = f.ParentID
+		}
+		y.torrentFollowMove(srcFolderId, srcObj.GetName(), dstDir)
+	}
+
 	return srcObj, nil
 }

@@ -286,13 +301,19 @@ func (y *Cloud189PC) Rename(ctx context.Context, srcObj model.Obj, newName strin
 	var resp RenameResp
 	_, err := y.request(fullUrl, method, func(req *resty.Request) {
 		req.SetContext(ctx).SetQueryParams(queryParam)
-	}, nil, resp, isFamily)
+	}, nil, &resp, isFamily)
 	if err != nil {
-		if resp.ResCode == "FileAlreadyExists" {
+		if code, ok := resp.ResCode.(string); ok && code == "FileAlreadyExists" {
 			return nil, errs.ObjectAlreadyExists
 		}
 		return nil, err
 	}
+
+	// 跟随重命名 torrent 文件
+	if f, ok := srcObj.(*Cloud189File); ok {
+		y.torrentFollowRename(f.ParentID, srcObj.GetName(), newName)
+	}
+
 	switch f := srcObj.(type) {
 	case *Cloud189File:
 		return resp.toFile(f), nil
@@ -314,7 +335,20 @@ func (y *Cloud189PC) Copy(ctx context.Context, srcObj, dstDir model.Obj) error {
 	if err != nil {
 		return err
 	}
-	return y.WaitBatchTask("COPY", resp.TaskID, time.Second)
+	if err = y.WaitBatchTask("COPY", resp.TaskID, time.Second); err != nil {
+		return err
+	}
+
+	// 跟随复制 torrent 文件
+	if !srcObj.IsDir() {
+		var srcFolderId string
+		if f, ok := srcObj.(*Cloud189File); ok {
+			srcFolderId = f.ParentID
+		}
+		y.torrentFollowCopy(srcFolderId, srcObj.GetName(), dstDir)
+	}
+
+	return nil
 }

 func (y *Cloud189PC) Remove(ctx context.Context, obj model.Obj) error {
@@ -338,6 +372,7 @@ func (y *Cloud189PC) Put(ctx context.Context, dstDir model.Obj, stream model.Fil

 	// 响应时间长,按需启用
 	if y.Addition.RapidUpload && !stream.IsForceStreamUpload() {
+		// 尝试妙传
 		if newObj, err := y.RapidUpload(ctx, dstDir, stream, isFamily, overwrite); err == nil {
 			return newObj, nil
 		}
@@ -346,10 +381,11 @@ func (y *Cloud189PC) Put(ctx context.Context, dstDir model.Obj, stream model.Fil
 	uploadMethod := y.UploadMethod
 	if stream.IsForceStreamUpload() {
 		uploadMethod = "stream"
-	}
-
-	// 旧版上传家庭云也有限制
-	if uploadMethod == "old" {
+	} else if y.Addition.RapidUpload && stream.GetFile() != nil {
+		// 文件流支持随机读取，走FastUpload计算MD5并尝试秒传
+		uploadMethod = "rapid"
+	} else if uploadMethod == "old" {
+		// 旧版上传家庭云也有限制
 		return y.OldUpload(ctx, dstDir, stream, up, isFamily, overwrite)
 	}

@@ -9,6 +9,7 @@ import (
 	"crypto/sha1"
 	"crypto/x509"
 	"encoding/hex"
+	"encoding/json"
 	"encoding/pem"
 	"encoding/xml"
 	"fmt"
@@ -19,6 +20,7 @@ import (
 	"time"

 	"github.com/OpenListTeam/OpenList/v4/internal/model"
+	"github.com/OpenListTeam/OpenList/v4/pkg/utils"
 	"github.com/OpenListTeam/OpenList/v4/pkg/utils/random"
 )

@@ -101,7 +103,13 @@ func MustParseTime(str string) *time.Time {

 type Time time.Time

-func (t *Time) UnmarshalJSON(b []byte) error { return t.Unmarshal(b) }
+func (t *Time) UnmarshalJSON(b []byte) error {
+	var s string
+	if err := json.Unmarshal(b, &s); err != nil {
+		return err
+	}
+	return t.Unmarshal([]byte(s))
+}
 func (t *Time) UnmarshalXML(e *xml.Decoder, ee xml.StartElement) error {
 	b, err := e.Token()
 	if err != nil {
@@ -116,10 +124,19 @@ func (t *Time) UnmarshalXML(e *xml.Decoder, ee xml.StartElement) error {
 }
 func (t *Time) Unmarshal(b []byte) error {
 	bs := strings.Trim(string(b), "\"")
+	// 189 时间串里 AM/PM 前可能使用 U+202F 窄不换行空格或 U+00A0 不换行空格，统一替换为普通空格
+	bs = strings.ReplaceAll(bs, "\u202f", " ")
+	bs = strings.ReplaceAll(bs, "\u00a0", " ")
 	var v time.Time
 	var err error
-	for _, f := range []string{"2006-01-02 15:04:05 -07", "Jan 2, 2006 15:04:05 PM -07"} {
-		v, err = time.ParseInLocation(f, bs+" +08", time.Local)
+	// 189 返回的时间可能自带时区（如 "Aug 11, 2026, 10:37:18 PM +08"），也可能不带，分别尝试
+	for _, s := range []string{bs, bs + " +08"} {
+		for _, f := range []string{"2006-01-02 15:04:05 -07", "Jan 2, 2006 3:04:05 PM -07", "Jan 2, 2006, 3:04:05 PM -07"} {
+			v, err = time.ParseInLocation(f, s, utils.CNLoc)
+			if err == nil {
+				break
+			}
+		}
 		if err == nil {
 			break
 		}
@@ -0,0 +1,65 @@
+package _189pc
+
+import (
+	"encoding/json"
+	"encoding/xml"
+	"testing"
+	"time"
+)
+
+func TestTimeUnmarshal(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  time.Time
+	}{
+		{"numeric date", `"2026-08-11 10:37:18"`, time.Date(2026, 8, 11, 10, 37, 18, 0, time.FixedZone("", 8*3600))},
+		{"legacy month date", `"Aug 11, 2026 10:37:18 PM"`, time.Date(2026, 8, 11, 22, 37, 18, 0, time.FixedZone("", 8*3600))},
+		{"new format with tz", `"Aug 11, 2026, 10:37:18 PM +08"`, time.Date(2026, 8, 11, 22, 37, 18, 0, time.FixedZone("", 8*3600))},
+		{"new format no tz", `"Aug 11, 2026, 10:37:18 PM"`, time.Date(2026, 8, 11, 22, 37, 18, 0, time.FixedZone("", 8*3600))},
+		{"narrow no-break space (U+202F)", "\"Aug 12, 2026, 12:35:41\u202fAM +08\"", time.Date(2026, 8, 12, 0, 35, 41, 0, time.FixedZone("", 8*3600))},
+		{"no-break space (U+00A0)", "\"Aug 12, 2026, 12:35:41\u00a0AM +08\"", time.Date(2026, 8, 12, 0, 35, 41, 0, time.FixedZone("", 8*3600))},
+		{"JSON escaped narrow space", `"Sep 4, 2026, 10:59:33\u202fPM +08"`, time.Date(2026, 9, 4, 22, 59, 33, 0, time.FixedZone("", 8*3600))},
+		{"JSON escaped space without timezone", `"Sep 4, 2026, 12:59:33\u00a0AM"`, time.Date(2026, 9, 4, 0, 59, 33, 0, time.FixedZone("", 8*3600))},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var tm Time
+			if err := json.Unmarshal([]byte(tt.input), &tm); err != nil {
+				t.Fatalf("Unmarshal(%s) error: %v", tt.input, err)
+			}
+			if !tt.want.Equal(time.Time(tm)) {
+				t.Fatalf("Unmarshal(%s) = %v, want %v", tt.input, time.Time(tm), tt.want)
+			}
+		})
+	}
+}
+
+func TestTimeUnmarshalRejectsInvalid(t *testing.T) {
+	var tm Time
+	if err := tm.Unmarshal([]byte("Aug 12, 2026, 25:32:44 AM")); err == nil {
+		t.Fatal("Unmarshal accepted an invalid time")
+	}
+}
+
+func TestTimeUnmarshalJSONRejectsInvalid(t *testing.T) {
+	for _, input := range []string{`"invalid"`, `123`, `null`, `"Sep 4, 2026, 10:59:33\uZZZZPM +08"`} {
+		t.Run(input, func(t *testing.T) {
+			var tm Time
+			if err := tm.UnmarshalJSON([]byte(input)); err == nil {
+				t.Fatalf("UnmarshalJSON(%s) accepted invalid input", input)
+			}
+		})
+	}
+}
+
+func TestTimeUnmarshalXML(t *testing.T) {
+	var tm Time
+	if err := xml.Unmarshal([]byte(`<time>Sep 4, 2026, 10:59:33&#x202f;PM +08</time>`), &tm); err != nil {
+		t.Fatal(err)
+	}
+	want := time.Date(2026, 9, 4, 22, 59, 33, 0, time.FixedZone("", 8*3600))
+	if !want.Equal(time.Time(tm)) {
+		t.Fatalf("UnmarshalXML = %v, want %v", time.Time(tm), want)
+	}
+}
@@ -7,20 +7,27 @@ import (

 type Addition struct {
 	LoginType    string `json:"login_type" type:"select" options:"password,qrcode" default:"password" required:"true"`
-	Username     string `json:"username" required:"true"`
-	Password     string `json:"password" required:"true"`
+	Username     string `json:"username" help:"Not needed when an access token or refresh token is provided"`
+	Password     string `json:"password" help:"Not needed when an access token or refresh token is provided"`
 	VCode        string `json:"validate_code"`
+	SmsCode      string `json:"sms_code" help:"SMS code for the second device verification, fill it in and save again when login asks for it"`
+	AccessToken  string `json:"access_token" required:"false"`
 	RefreshToken string `json:"refresh_token" help:"To switch accounts, please clear this field"`
+	DeviceID     string `json:"device_id" help:"DEVICEID cookie issued after the second device verification, keep it to avoid verifying again"`
+	ClientSn     string `json:"client_sn" help:"Device serial number captured from the official client, leave it empty if you do not have one"`
+	JgOpenId     string `json:"jg_open_id" help:"Optional push id reported by the official client"`
+	UserFinger   string `json:"user_finger" help:"Device fingerprint sent with login requests, generated and kept automatically when empty"`
 	driver.RootID
-	OrderBy        string `json:"order_by" type:"select" options:"filename,filesize,lastOpTime" default:"filename"`
-	OrderDirection string `json:"order_direction" type:"select" options:"asc,desc" default:"asc"`
-	Type           string `json:"type" type:"select" options:"personal,family" default:"personal"`
-	FamilyID       string `json:"family_id"`
-	UploadMethod   string `json:"upload_method" type:"select" options:"stream,rapid,old" default:"stream"`
-	UploadThread   string `json:"upload_thread" default:"3" help:"1<=thread<=32"`
-	FamilyTransfer bool   `json:"family_transfer"`
-	RapidUpload    bool   `json:"rapid_upload"`
-	NoUseOcr       bool   `json:"no_use_ocr"`
+	OrderBy         string `json:"order_by" type:"select" options:"filename,filesize,lastOpTime" default:"filename"`
+	OrderDirection  string `json:"order_direction" type:"select" options:"asc,desc" default:"asc"`
+	Type            string `json:"type" type:"select" options:"personal,family" default:"personal"`
+	FamilyID        string `json:"family_id"`
+	UploadMethod    string `json:"upload_method" type:"select" options:"stream,rapid,old" default:"stream"`
+	UploadThread    string `json:"upload_thread" default:"3" help:"1<=thread<=32"`
+	FamilyTransfer  bool   `json:"family_transfer"`
+	RapidUpload     bool   `json:"rapid_upload"`
+	NoUseOcr        bool   `json:"no_use_ocr"`
+	GenerateTorrent bool   `json:"generate_torrent" help:"Generate torrent file with CAS extension after upload"`
 }

 var config = driver.Config{
@@ -0,0 +1,449 @@
+package _189pc
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha1"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/go-resty/resty/v2"
+
+	"github.com/OpenListTeam/OpenList/v4/internal/model"
+	"github.com/OpenListTeam/OpenList/v4/internal/op"
+	"github.com/OpenListTeam/OpenList/v4/internal/stream"
+	"github.com/OpenListTeam/OpenList/v4/pkg/torrent"
+	"github.com/OpenListTeam/OpenList/v4/pkg/utils"
+)
+
+// GenerateTorrent 根据上传过程中收集的哈希信息生成包含 CAS 扩展的 torrent 文件
+// fileMD5: 整文件 MD5（大写十六进制）
+// sliceMD5s: 每个分片的 MD5 列表（大写十六进制）
+// sliceSize: 分片大小
+// pieceHashes: SHA-1 piece hashes 拼接（每 20 字节一个）
+// fileName: 文件名
+// fileSize: 文件大小
+func GenerateTorrent(fileName string, fileSize int64, fileMD5 string, sliceMD5s []string, sliceSize int64, pieceHashes []byte) ([]byte, error) {
+	// 计算 sliceMD5
+	sliceMD5 := fileMD5
+	if len(sliceMD5s) > 1 {
+		joined := strings.Join(sliceMD5s, "\n")
+		sliceMD5 = strings.ToUpper(torrent.GetMD5Str(joined))
+	}
+
+	t := torrent.NewTorrent(fileName, fileSize, fileMD5)
+	t.Info.PieceLength = sliceSize
+	t.SetPieces(pieceHashes)
+	t.SetCASInfo(&torrent.CASInfo{
+		FileMD5:   fileMD5,
+		SliceMD5:  sliceMD5,
+		SliceMD5s: sliceMD5s,
+		SliceSize: sliceSize,
+		Cloud:     "189",
+	})
+
+	return t.Encode()
+}
+
+// RapidUploadFromTorrent 从 torrent 文件中提取 CAS 信息进行秒传
+// 返回值：上传成功的文件对象、错误
+func (y *Cloud189PC) RapidUploadFromTorrent(ctx context.Context, dstDir model.Obj, torrentData []byte, overwrite bool) (model.Obj, error) {
+	isFamily := y.isFamily()
+
+	// 解析 torrent
+	t, err := torrent.Decode(torrentData)
+	if err != nil {
+		return nil, fmt.Errorf("解析 torrent 失败: %w", err)
+	}
+
+	// 检查是否包含 CAS 扩展信息
+	if !t.HasCASInfo() {
+		return nil, fmt.Errorf("torrent 不包含 CAS 扩展信息，无法秒传")
+	}
+
+	cas := t.CAS
+	fileName := t.Info.Name
+	fileSize := t.GetTotalSize()
+
+	// 统一 MD5 为大写（与正常上传保持一致，天翼云盘要求大写）
+	fileMD5Upper := strings.ToUpper(cas.FileMD5)
+
+	// 优先使用 torrent 中嵌入的分片大小，与生成时保持一致
+	sliceSize := cas.SliceSize
+	if sliceSize <= 0 {
+		sliceSize = partSize(fileSize)
+	}
+
+	// 计算 sliceMd5（与上传时一致的算法）
+	// 优先使用 torrent 中已有的 SliceMD5；仅当有多分片列表时才重新计算
+	sliceMd5Hex := strings.ToUpper(cas.SliceMD5)
+	if sliceMd5Hex == "" {
+		sliceMd5Hex = fileMD5Upper
+	}
+	if len(cas.SliceMD5s) > 1 {
+		// 分片 MD5 也需要统一大写后再拼接计算
+		upperSliceMD5s := make([]string, len(cas.SliceMD5s))
+		for i, s := range cas.SliceMD5s {
+			upperSliceMD5s[i] = strings.ToUpper(s)
+		}
+		sliceMd5Hex = strings.ToUpper(utils.GetMD5EncodeStr(strings.Join(upperSliceMD5s, "\n")))
+	}
+
+	// 使用与 Web 端一致的三步秒传流程
+	fullUrl := "https://upload.cloud.189.cn"
+	if isFamily {
+		fullUrl += "/family"
+	} else {
+		fullUrl += "/person"
+	}
+
+	// Step 1: initMultiUpload（不传 fileMd5/sliceMd5，只传 lazyCheck）
+	initParams := Params{
+		"parentFolderId": dstDir.GetID(),
+		"fileName":       url.QueryEscape(fileName),
+		"fileSize":       fmt.Sprint(fileSize),
+		"sliceSize":      fmt.Sprint(sliceSize),
+		"lazyCheck":      "1",
+	}
+	if isFamily {
+		initParams.Set("familyId", y.FamilyID)
+	}
+
+	var uploadInfo InitMultiUploadResp
+	_, err = y.request(fullUrl+"/initMultiUpload", "GET", func(req *resty.Request) {
+		req.SetContext(ctx)
+	}, initParams, &uploadInfo, isFamily)
+	if err != nil {
+		return nil, fmt.Errorf("initMultiUpload 失败: %w", err)
+	}
+
+	uploadFileId := uploadInfo.Data.UploadFileID
+
+	// Step 2: checkTransSecond（用 fileMd5 + sliceMd5 + uploadFileId 检查秒传）
+	checkParams := Params{
+		"fileMd5":      fileMD5Upper,
+		"sliceMd5":     sliceMd5Hex,
+		"uploadFileId": uploadFileId,
+	}
+
+	var checkResp struct {
+		Data struct {
+			FileDataExists int `json:"fileDataExists"`
+		} `json:"data"`
+	}
+	_, err = y.request(fullUrl+"/checkTransSecond", "GET", func(req *resty.Request) {
+		req.SetContext(ctx)
+	}, checkParams, &checkResp, isFamily)
+	if err != nil {
+		utils.Log.Errorf("[RapidUpload] checkTransSecond 失败: uploadFileId=%s, err=%v", uploadFileId, err)
+		return nil, fmt.Errorf("秒传检查失败: %w", err)
+	}
+
+	if checkResp.Data.FileDataExists != 1 {
+		return nil, fmt.Errorf("秒传失败：云端不存在该文件（fileMD5=%s, sliceMD5=%s, size=%d）", fileMD5Upper, sliceMd5Hex, fileSize)
+	}
+
+	// Step 3: commitMultiUploadFile（传 fileMd5 + sliceMd5）
+
+	var resp CommitMultiUploadFileResp
+	commitParams := Params{
+		"uploadFileId": uploadFileId,
+		"fileMd5":      fileMD5Upper,
+		"sliceMd5":     sliceMd5Hex,
+		"lazyCheck":    "1",
+		"opertype":     IF(overwrite, "3", "1"),
+	}
+
+	_, err = y.request(fullUrl+"/commitMultiUploadFile", "GET", func(req *resty.Request) {
+		req.SetContext(ctx)
+	}, commitParams, &resp, isFamily)
+	if err != nil {
+		utils.Log.Errorf("[RapidUpload] commitMultiUploadFile 失败: uploadFileId=%s, err=%v", uploadFileId, err)
+		return nil, fmt.Errorf("提交上传失败: %w", err)
+	}
+
+	// 秒传成功后，将 torrent 文件上传到目标目录（异步，不影响秒传结果）
+	if y.Addition.GenerateTorrent {
+		capturedDstDir := dstDir
+		capturedIsFamily := isFamily
+		go func() {
+			torrentName := fileName + ".cas.torrent"
+			infoHash, _ := GetInfoHashHex(torrentData)
+			utils.Log.Infof("秒传成功，上传 torrent: %s (info_hash: %s, size: %d bytes)",
+				torrentName, infoHash, len(torrentData))
+
+			torrentFileStream := &stream.FileStream{
+				Ctx: context.Background(),
+				Obj: &model.Object{
+					Name:     torrentName,
+					Size:     int64(len(torrentData)),
+					IsFolder: false,
+				},
+				Reader:   bytes.NewReader(torrentData),
+				Mimetype: "application/x-bittorrent",
+			}
+			_, uploadErr := y.fastUpload(context.Background(), capturedDstDir, torrentFileStream, func(p float64) {}, capturedIsFamily, false, false)
+			if uploadErr != nil {
+				utils.Log.Warnf("上传 torrent 文件失败: %v", uploadErr)
+			} else {
+				utils.Log.Infof("torrent 文件已上传: %s", torrentName)
+				op.Cache.DeleteDirectory(y, capturedDstDir.GetPath())
+			}
+		}()
+	}
+
+	return resp.toFile(), nil
+}
+
+// ComputeTorrentFromReader 从 io.Reader 计算并生成 torrent 文件
+// 适用于：已有文件需要生成 torrent 的场景（如下载完成后生成）
+func ComputeTorrentFromReader(reader io.Reader, fileName string, fileSize int64, sliceSize int64) ([]byte, error) {
+	if sliceSize <= 0 {
+		sliceSize = torrent.DefaultPieceSize
+	}
+
+	hw := torrent.NewHashWriter(sliceSize, sliceSize)
+
+	buf := make([]byte, 32*1024)
+	for {
+		n, err := reader.Read(buf)
+		if n > 0 {
+			hw.Write(buf[:n])
+		}
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return nil, err
+		}
+	}
+	hw.Finish()
+
+	fileMD5 := hw.GetFileMD5()
+	sliceMD5s := hw.GetSliceMD5s()
+	pieceHashes := hw.GetPieceHashes()
+
+	return GenerateTorrent(fileName, fileSize, fileMD5, sliceMD5s, sliceSize, pieceHashes)
+}
+
+// ComputePieceSHA1 计算单个分片的 SHA-1 哈希
+func ComputePieceSHA1(data []byte) []byte {
+	h := sha1.Sum(data)
+	return h[:]
+}
+
+// ExtractCASFromTorrent 从 torrent 数据中提取 CAS 信息
+// 返回：CAS 信息、文件名、文件大小、错误
+func ExtractCASFromTorrent(torrentData []byte) (*torrent.CASInfo, string, int64, error) {
+	t, err := torrent.Decode(torrentData)
+	if err != nil {
+		return nil, "", 0, fmt.Errorf("解析 torrent 失败: %w", err)
+	}
+
+	if !t.HasCASInfo() {
+		return nil, "", 0, fmt.Errorf("torrent 不包含 CAS 扩展信息")
+	}
+
+	return t.CAS, t.Info.Name, t.GetTotalSize(), nil
+}
+
+// InjectCASIntoTorrent 向已有的 torrent 文件注入 CAS 扩展信息
+// 用于：下载完成后，计算了 MD5 信息，写回到 torrent 中
+func InjectCASIntoTorrent(torrentData []byte, fileMD5 string, sliceMD5s []string, sliceSize int64) ([]byte, error) {
+	t, err := torrent.Decode(torrentData)
+	if err != nil {
+		return nil, fmt.Errorf("解析 torrent 失败: %w", err)
+	}
+
+	// 计算 sliceMD5
+	sliceMD5 := fileMD5
+	if len(sliceMD5s) > 1 {
+		joined := strings.Join(sliceMD5s, "\n")
+		sliceMD5 = strings.ToUpper(torrent.GetMD5Str(joined))
+	}
+
+	// 注入 CAS 信息
+	t.SetCASInfo(&torrent.CASInfo{
+		FileMD5:   fileMD5,
+		SliceMD5:  sliceMD5,
+		SliceMD5s: sliceMD5s,
+		SliceSize: sliceSize,
+		Cloud:     "189",
+	})
+
+	// 同时更新 info 中的 md5sum 字段
+	if t.Info.MD5Sum == "" {
+		t.Info.MD5Sum = fileMD5
+	}
+
+	return t.Encode()
+}
+
+// GetInfoHashHex 获取 torrent 的 info_hash（十六进制字符串）
+func GetInfoHashHex(torrentData []byte) (string, error) {
+	t, err := torrent.Decode(torrentData)
+	if err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(t.InfoHash), nil
+}
+
+func isCASTorrentFile(fileName string) bool {
+	return strings.HasSuffix(fileName, ".cas.torrent")
+}
+
+// ComputeSliceMD5sFromReader 从 reader 中计算每个 10MB 分片的 MD5
+// 返回：整文件 MD5、分片 MD5 列表
+func ComputeSliceMD5sFromReader(reader io.Reader, sliceSize int64) (string, []string, error) {
+	if sliceSize <= 0 {
+		sliceSize = torrent.DefaultPieceSize
+	}
+
+	fileMD5Hash := utils.MD5.NewFunc()
+	sliceMD5s := make([]string, 0)
+
+	buf := make([]byte, sliceSize)
+	for {
+		n, err := io.ReadFull(reader, buf)
+		if n > 0 {
+			chunk := buf[:n]
+			fileMD5Hash.Write(chunk)
+			// 计算该分片的 MD5
+			sliceMD5 := strings.ToUpper(utils.HashData(utils.MD5, chunk))
+			sliceMD5s = append(sliceMD5s, sliceMD5)
+		}
+		if err == io.EOF || err == io.ErrUnexpectedEOF {
+			break
+		}
+		if err != nil {
+			return "", nil, err
+		}
+	}
+
+	fileMD5Hex := strings.ToUpper(hex.EncodeToString(fileMD5Hash.Sum(nil)))
+	return fileMD5Hex, sliceMD5s, nil
+}
+
+// torrentFollowCopy 跟随复制 torrent 文件（异步，不影响主操作）
+// srcFolderId: 源文件所在目录 ID
+// srcFileName: 源文件名
+// dstDir: 目标目录
+func (y *Cloud189PC) torrentFollowCopy(srcFolderId string, srcFileName string, dstDir model.Obj) {
+	if !y.Addition.GenerateTorrent {
+		return
+	}
+	if srcFolderId == "" {
+		return
+	}
+	torrentName := srcFileName + ".cas.torrent"
+	isFamily := y.isFamily()
+
+	go func() {
+		torrentFile, err := y.findFileByName(context.Background(), torrentName, srcFolderId, isFamily)
+		if err != nil {
+			utils.Log.Debugf("查找 torrent 文件失败（跟随复制）: %v", err)
+			return
+		}
+		// 复制 torrent 文件到目标目录
+		resp, copyErr := y.CreateBatchTask("COPY", IF(isFamily, y.FamilyID, ""), dstDir.GetID(),
+			map[string]string{"targetFileName": dstDir.GetName()},
+			BatchTaskInfo{
+				FileId:   torrentFile.GetID(),
+				FileName: torrentFile.GetName(),
+				IsFolder: 0,
+			})
+		if copyErr != nil {
+			utils.Log.Warnf("跟随复制 torrent 文件失败: %v", copyErr)
+			return
+		}
+		if err = y.WaitBatchTask("COPY", resp.TaskID, time.Second); err != nil {
+			utils.Log.Warnf("等待跟随复制 torrent 文件失败: %v", err)
+		}
+	}()
+}
+
+// torrentFollowMove 跟随移动 torrent 文件（异步，不影响主操作）
+// srcFolderId: 源文件所在目录 ID
+// srcFileName: 源文件名
+// dstDir: 目标目录
+func (y *Cloud189PC) torrentFollowMove(srcFolderId string, srcFileName string, dstDir model.Obj) {
+	if !y.Addition.GenerateTorrent {
+		return
+	}
+	if srcFolderId == "" {
+		return
+	}
+	torrentName := srcFileName + ".cas.torrent"
+	isFamily := y.isFamily()
+
+	go func() {
+		torrentFile, err := y.findFileByName(context.Background(), torrentName, srcFolderId, isFamily)
+		if err != nil {
+			utils.Log.Debugf("查找 torrent 文件失败（跟随移动）: %v", err)
+			return
+		}
+		// 移动 torrent 文件到目标目录
+		resp, moveErr := y.CreateBatchTask("MOVE", IF(isFamily, y.FamilyID, ""), dstDir.GetID(),
+			map[string]string{"targetFileName": dstDir.GetName()},
+			BatchTaskInfo{
+				FileId:   torrentFile.GetID(),
+				FileName: torrentFile.GetName(),
+				IsFolder: 0,
+			})
+		if moveErr != nil {
+			utils.Log.Warnf("跟随移动 torrent 文件失败: %v", moveErr)
+			return
+		}
+		if err = y.WaitBatchTask("MOVE", resp.TaskID, time.Millisecond*400); err != nil {
+			utils.Log.Warnf("等待跟随移动 torrent 文件失败: %v", err)
+		}
+	}()
+}
+
+// torrentFollowRename 跟随重命名 torrent 文件（异步，不影响主操作）
+// folderId: 文件所在目录 ID
+// oldFileName: 原文件名
+// newFileName: 新文件名
+func (y *Cloud189PC) torrentFollowRename(folderId string, oldFileName string, newFileName string) {
+	if !y.Addition.GenerateTorrent {
+		return
+	}
+	if folderId == "" {
+		return
+	}
+	oldTorrentName := oldFileName + ".cas.torrent"
+	newTorrentName := newFileName + ".cas.torrent"
+	isFamily := y.isFamily()
+
+	go func() {
+		torrentFile, err := y.findFileByName(context.Background(), oldTorrentName, folderId, isFamily)
+		if err != nil {
+			utils.Log.Debugf("查找 torrent 文件失败（跟随重命名）: %v", err)
+			return
+		}
+
+		// 重命名 torrent 文件
+		queryParam := make(map[string]string)
+		fullUrl := API_URL
+		method := "POST"
+		if isFamily {
+			fullUrl += "/family/file"
+			method = "GET"
+			queryParam["familyId"] = y.FamilyID
+		}
+		fullUrl += "/renameFile.action"
+		queryParam["fileId"] = torrentFile.GetID()
+		queryParam["destFileName"] = newTorrentName
+
+		_, renameErr := y.request(fullUrl, method, func(req *resty.Request) {
+			req.SetContext(context.Background()).SetQueryParams(queryParam)
+		}, nil, &RenameResp{}, isFamily)
+		if renameErr != nil {
+			utils.Log.Warnf("跟随重命名 torrent 文件失败: %v", renameErr)
+		}
+	}()
+}
@@ -72,6 +72,8 @@ type BaseLoginParam struct {
 	// 请求头参数
 	Lt    string
 	ReqId string
+	// logbox页面地址，作为后续请求的Referer，缺失会被判定为陌生设备
+	Referer string

 	// 表单参数
 	ParamId string
@@ -97,10 +99,20 @@ type LoginParam struct {

 	// rsa密钥
 	jRsaKey string
+	// 加密字段的前缀，服务端下发（如 {NRP}）
+	rsaPrefix string
+
+	// 设备二次校验时服务端返回的加密手机号
+	SecondAuthMobile string

 	BaseLoginParam
 }

+// encryptSecret 用登陆时拿到的公钥加密敏感值，格式与userName/epd一致
+func (p *LoginParam) encryptSecret(value string) string {
+	return p.rsaPrefix + RsaEncrypt(p.jRsaKey, value)
+}
+
 // 登陆加密相关
 type EncryptConfResp struct {
 	Result int `json:"result"`
@@ -116,6 +128,35 @@ type LoginResp struct {
 	Msg    string `json:"msg"`
 	Result int    `json:"result"`
 	ToUrl  string `json:"toUrl"`
+	// 设备二次校验时返回的加密手机号
+	Mobile string `json:"mobile"`
+}
+
+// 登陆页配置，新版登陆页的paramId由该接口下发
+// 该接口的result可能是数字也可能是字符串
+type AppConfResp struct {
+	Result any    `json:"result"`
+	Msg    string `json:"msg"`
+	Data   struct {
+		ParamId     string `json:"paramId"`
+		AccountType string `json:"accountType"`
+		ReturnUrl   string `json:"returnUrl"`
+		MailSuffix  string `json:"mailSuffix"`
+	} `json:"data"`
+}
+
+func (r *AppConfResp) Succeeded() bool {
+	switch v := r.Result.(type) {
+	case nil:
+		return true
+	case string:
+		return v == "0" || v == ""
+	case float64:
+		return v == 0
+	case int:
+		return v == 0
+	}
+	return false
 }

 // 刷新session返回
@@ -149,6 +190,27 @@ type AppSessionResp struct {
 	RefreshToken string `json:"refreshToken"`
 }

+// 刷新token返回，失败时以HTTP 200返回result/msg，需要单独判断
+type RefreshTokenResp struct {
+	AccessToken  string `json:"accessToken"`
+	RefreshToken string `json:"refreshToken"`
+	ExpiresIn    int    `json:"expiresIn"`
+
+	Result int    `json:"result"`
+	Msg    string `json:"msg"`
+}
+
+func (r *RefreshTokenResp) HasError() bool {
+	return r.Result != 0 || r.AccessToken == ""
+}
+
+func (r *RefreshTokenResp) Error() string {
+	if r.Msg != "" {
+		return fmt.Sprintf("refresh token failed, result: %d, msg: %s", r.Result, r.Msg)
+	}
+	return fmt.Sprintf("refresh token failed, result: %d", r.Result)
+}
+
 // 家庭云账户
 type FamilyInfoListResp struct {
 	FamilyInfoResp []FamilyInfoResp `json:"familyInfoResp"`
@@ -166,10 +228,11 @@ type FamilyInfoResp struct {
 /*文件部分*/
 // 文件
 type Cloud189File struct {
-	ID   String `json:"id"`
-	Name string `json:"name"`
-	Size int64  `json:"size"`
-	Md5  string `json:"md5"`
+	ID       String `json:"id"`
+	Name     string `json:"name"`
+	Size     int64  `json:"size"`
+	Md5      string `json:"md5"`
+	ParentID string `json:"-"` // 由 getFiles 设置，不从 JSON 解析

 	LastOpTime Time `json:"lastOpTime"`
 	CreateDate Time `json:"createDate"`
@@ -190,6 +253,10 @@ type Cloud189File struct {
 	// StarLabel   int64  `json:"starLabel"`
 }

+func normalizeCloud189Name(name string) string {
+	return strings.ReplaceAll(name, "\\'", "'")
+}
+
 func (c *Cloud189File) CreateTime() time.Time {
 	return time.Time(c.CreateDate)
 }
@@ -206,6 +273,8 @@ func (c *Cloud189File) GetID() string      { return string(c.ID) }
 func (c *Cloud189File) GetPath() string    { return "" }
 func (c *Cloud189File) Thumb() string      { return c.Icon.SmallUrl }

+func (c *Cloud189File) GetDisplayName() string { return normalizeCloud189Name(c.Name) }
+
 // 文件夹
 type Cloud189Folder struct {
 	ID       String `json:"id"`
@@ -237,6 +306,8 @@ func (c *Cloud189Folder) IsDir() bool        { return true }
 func (c *Cloud189Folder) GetID() string      { return string(c.ID) }
 func (c *Cloud189Folder) GetPath() string    { return "" }

+func (c *Cloud189Folder) GetDisplayName() string { return normalizeCloud189Name(c.Name) }
+
 type Cloud189FilesResp struct {
 	//ResCode    int    `json:"res_code"`
 	//ResMessage string `json:"res_message"`
@@ -432,7 +503,7 @@ type RenameResp struct {
 	ResMsg      string `json:"res_message"`
 	CreateDate  Time   `json:"createDate"`
 	FileCate    int    `json:"fileCata"`
-	ID          string `json:"id"`
+	ID          String `json:"id"`
 	LastOpTime  Time   `json:"lastOpTime"`
 	MD5         string `json:"md5"`
 	MediaType   int    `json:"mediaType"`
@@ -441,12 +512,12 @@ type RenameResp struct {
 	ParentID    int64  `json:"parentId"`
 	Rev         string `json:"rev"`
 	Size        int64  `json:"size"`
-	ResCode     string `json:"res_code"`
+	ResCode     any    `json:"res_code"` // int or string
 }

 func (r *RenameResp) toFile(f *Cloud189File) *Cloud189File {
 	return &Cloud189File{
-		ID:         String(r.ID),
+		ID:         r.ID,
 		Name:       r.Name,
 		Size:       r.Size,
 		Md5:        r.MD5,
@@ -458,7 +529,7 @@ func (r *RenameResp) toFile(f *Cloud189File) *Cloud189File {

 func (r *RenameResp) toFolder() *Cloud189Folder {
 	return &Cloud189Folder{
-		ID:         String(r.ID),
+		ID:         r.ID,
 		Name:       r.Name,
 		ParentID:   r.ParentID,
 		LastOpTime: r.LastOpTime,
@@ -3,6 +3,7 @@ package _189pc
 import (
 	"bytes"
 	"context"
+	sha1Pkg "crypto/sha1"
 	"encoding/base64"
 	"encoding/hex"
 	"encoding/xml"
@@ -29,6 +30,7 @@ import (
 	"github.com/OpenListTeam/OpenList/v4/internal/stream"
 	"github.com/OpenListTeam/OpenList/v4/pkg/errgroup"
 	"github.com/OpenListTeam/OpenList/v4/pkg/utils"
+	"github.com/OpenListTeam/OpenList/v4/pkg/utils/random"
 	"github.com/skip2/go-qrcode"

 	"github.com/avast/retry-go"
@@ -40,9 +42,13 @@ import (

 const (
 	ACCOUNT_TYPE = "02"
-	APP_ID       = "8025431004"
-	CLIENT_TYPE  = "10020"
-	VERSION      = "6.2"
+	// 官方 PC 端（cloud.189.cn 网页/客户端）使用的 appId，
+	// 登录、生成二维码、换取 session 必须全程使用同一个 appId
+	APP_ID      = "9317140619"
+	CLIENT_TYPE = "10020"
+	// 扫码状态轮询使用的 clientType，与密码登录的 10020 不同
+	QR_CLIENT_TYPE = "1"
+	VERSION        = "7.2.4.0"

 	WEB_URL    = "https://cloud.189.cn"
 	AUTH_URL   = "https://open.e.189.cn"
@@ -56,8 +62,18 @@ const (

 	CHANNEL_ID = "web_cloud.189.cn"

+	// 服务端通过短信二次校验后下发的设备标识，复用它可以避免再次触发校验
+	DEVICE_ID_COOKIE = "DEVICEID"
+
+	// 扫码登录本地轮询参数，超时后把二维码交回前端，避免请求被反向代理掐断
+	QRCODE_POLL_INTERVAL = 2 * time.Second
+	QRCODE_POLL_TIMEOUT  = 20 * time.Second
+
 	// Error codes
 	UserInvalidOpenTokenError = "UserInvalidOpenToken"
+
+	// 密码登录返回该结果表示需要设备二次校验
+	SecondDeviceAuthResult = -133
 )

 func (y *Cloud189PC) SignatureHeader(url, method, params string, isFamily bool) map[string]string {
@@ -194,9 +210,10 @@ func (y *Cloud189PC) put(ctx context.Context, url string, headers map[string]str
 }

 func (y *Cloud189PC) getFiles(ctx context.Context, fileId string, isFamily bool) ([]model.Obj, error) {
+    pageSize := 1000  // 每一页返回的文件数量
 	res := make([]model.Obj, 0, 100)
 	for pageNum := 1; ; pageNum++ {
-		resp, err := y.getFilesWithPage(ctx, fileId, isFamily, pageNum, 1000, y.OrderBy, y.OrderDirection)
+		resp, err := y.getFilesWithPage(ctx, fileId, isFamily, pageNum, pageSize, y.OrderBy, y.OrderDirection)
 		if err != nil {
 			return nil, err
 		}
@@ -204,13 +221,23 @@ func (y *Cloud189PC) getFiles(ctx context.Context, fileId string, isFamily bool)
 		if resp.FileListAO.Count == 0 {
 			break
 		}
+		
+		FolderCount := len(resp.FileListAO.FolderList) // 当前文件夹总数
+        FileCount := len(resp.FileListAO.FileList) // 当前文件总数
+        PageCount := FolderCount + FileCount // 当前页数总数

-		for i := 0; i < len(resp.FileListAO.FolderList); i++ {
+		for i := 0; i < FolderCount; i++ {
 			res = append(res, &resp.FileListAO.FolderList[i])
 		}
-		for i := 0; i < len(resp.FileListAO.FileList); i++ {
+		for i := 0; i < FileCount; i++ {
+			resp.FileListAO.FileList[i].ParentID = fileId
 			res = append(res, &resp.FileListAO.FileList[i])
 		}
+		
+		// 当前文件数量小于设定数量则跳出
+		if PageCount < pageSize {
+            break
+        }
 	}
 	return res, nil
 }
@@ -276,9 +303,72 @@ func (y *Cloud189PC) login() error {
 	if y.LoginType == "qrcode" {
 		return y.loginByQRCode()
 	}
+	if y.Username == "" || y.Password == "" {
+		return errors.New("please fill in the username and password, or provide an access token / refresh token")
+	}
 	return y.loginByPassword()
 }

+// 设备指纹，为空时生成并保存，服务端以此识别是否为同一台设备
+func (y *Cloud189PC) getUserFinger() string {
+	if y.Addition.UserFinger == "" {
+		y.Addition.UserFinger = fmt.Sprint(random.Rand.Int63n(9e9) + 1e9)
+		op.MustSaveDriverStorage(y)
+	}
+	return y.Addition.UserFinger
+}
+
+// 换取会话时携带的设备参数，与官方PC客户端保持一致
+// clientSn/jgOpenId 只在用户从官方客户端抓到并填写后才发送，避免上报一个服务端不认识的设备号
+func (y *Cloud189PC) deviceParams() map[string]string {
+	params := map[string]string{"returnType": "JSON"}
+	if y.Addition.ClientSn != "" {
+		params["clientSn"] = y.Addition.ClientSn
+	}
+	if y.Addition.JgOpenId != "" {
+		params["jgOpenId"] = y.Addition.JgOpenId
+	}
+	return params
+}
+
+// logbox接口的公共请求头，缺少user-finger和Referer会被判定为陌生设备
+func (y *Cloud189PC) loginHeaders(param BaseLoginParam) map[string]string {
+	return map[string]string{
+		"REQID":       param.ReqId,
+		"lt":          param.Lt,
+		"user-finger": y.getUserFinger(),
+		"Referer":     IF(param.Referer != "", param.Referer, AUTH_URL),
+	}
+}
+
+// 把已保存的设备标识写入cookie，避免重复触发设备二次校验
+func (y *Cloud189PC) applyDeviceID(jar http.CookieJar) {
+	if y.Addition.DeviceID == "" {
+		return
+	}
+	authUrl, err := url.Parse(AUTH_URL)
+	if err != nil {
+		return
+	}
+	jar.SetCookies(authUrl, []*http.Cookie{{
+		Name:   DEVICE_ID_COOKIE,
+		Value:  y.Addition.DeviceID,
+		Domain: "e.189.cn",
+		Path:   "/",
+	}})
+}
+
+// 保存服务端下发的设备标识，下次登陆复用即可跳过设备二次校验
+func (y *Cloud189PC) saveDeviceID(res *resty.Response) {
+	for _, cookie := range res.Cookies() {
+		if cookie.Name == DEVICE_ID_COOKIE && cookie.Value != "" && cookie.Value != y.Addition.DeviceID {
+			y.Addition.DeviceID = cookie.Value
+			op.MustSaveDriverStorage(y)
+			return
+		}
+	}
+}
+
 func (y *Cloud189PC) loginByPassword() (err error) {
 	// 初始化登陆所需参数
 	if y.loginParam == nil {
@@ -287,9 +377,16 @@ func (y *Cloud189PC) loginByPassword() (err error) {
 			return err
 		}
 	}
+	// 设备二次校验必须复用同一套登陆参数，此时不能销毁也不能重新初始化
+	keepLoginParam := false
 	defer func() {
 		// 销毁验证码
 		y.VCode = ""
+		if keepLoginParam {
+			y.Status = err.Error()
+			op.MustSaveDriverStorage(y)
+			return
+		}
 		// 销毁登陆参数
 		y.loginParam = nil
 		// 遇到错误，重新加载登陆参数(刷新验证码)
@@ -307,17 +404,18 @@ func (y *Cloud189PC) loginByPassword() (err error) {

 	param := y.loginParam
 	var loginresp LoginResp
-	_, err = y.client.R().
+	res, err := y.client.R().
 		ForceContentType("application/json;charset=UTF-8").SetResult(&loginresp).
-		SetHeaders(map[string]string{
-			"REQID": param.ReqId,
-			"lt":    param.Lt,
-		}).
+		SetHeaders(y.loginHeaders(param.BaseLoginParam)).
 		SetFormData(map[string]string{
+			"version":      "v2.0",
+			"apToken":      "",
 			"appKey":       APP_ID,
+			"pageKey":      "normal",
 			"accountType":  ACCOUNT_TYPE,
 			"userName":     param.RsaUsername,
 			"password":     param.RsaPassword,
+			"epd":          param.RsaPassword,
 			"validateCode": y.VCode,
 			"captchaToken": param.CaptchaToken,
 			"returnUrl":    RETURN_URL,
@@ -333,17 +431,106 @@ func (y *Cloud189PC) loginByPassword() (err error) {
 	if err != nil {
 		return err
 	}
+	y.saveDeviceID(res)
+
+	// 设备二次校验：服务端要求短信验证，保留登陆参数并引导填写短信验证码
+	if loginresp.Result == SecondDeviceAuthResult {
+		err = y.secondDeviceAuth(loginresp.Mobile)
+		// 校验未完成时保留登陆参数，等待用户回填短信验证码
+		keepLoginParam = err != nil && y.loginParam != nil
+		return err
+	}
+
 	if loginresp.ToUrl == "" {
 		return fmt.Errorf("login failed,No toUrl obtained, msg: %s", loginresp.Msg)
 	}

-	// 获取Session
+	return y.getSessionByRedirectURL(loginresp.ToUrl)
+}
+
+// 设备二次校验：先发短信，用户回填验证码后再提交
+func (y *Cloud189PC) secondDeviceAuth(mobile string) error {
+	param := y.loginParam
+	if mobile != "" {
+		param.SecondAuthMobile = mobile
+	}
+	if param.SecondAuthMobile == "" {
+		return errors.New("second device verification is required, but no mobile was returned")
+	}
+
+	// 已填写短信验证码，直接提交校验
+	if y.SmsCode != "" {
+		smsCode := y.SmsCode
+		y.SmsCode = ""
+		op.MustSaveDriverStorage(y)
+		return y.submitSecondDeviceAuth(smsCode)
+	}
+
+	var smsResp LoginResp
+	_, err := y.client.R().
+		ForceContentType("application/json;charset=UTF-8").SetResult(&smsResp).
+		SetHeaders(y.loginHeaders(param.BaseLoginParam)).
+		SetFormData(map[string]string{
+			"mobile": param.SecondAuthMobile,
+			"appKey": APP_ID,
+		}).
+		Post(AUTH_URL + "/api/logbox/oauth2/sendSmsCodeForSecondAuth.do")
+	if err != nil {
+		return err
+	}
+	if smsResp.Result != 0 {
+		return fmt.Errorf("failed to send the verification SMS: %s", smsResp.Msg)
+	}
+	// 保留登陆参数，等待用户回填短信验证码后重新保存
+	return errors.New("second device verification is required, an SMS code has been sent, please fill it into `sms_code` and save again")
+}
+
+// 提交短信验证码完成设备二次校验
+// 注意：该接口没有独立的短信码字段，短信码要加密后放在epd里（登陆时epd装的是密码）
+func (y *Cloud189PC) submitSecondDeviceAuth(smsCode string) error {
+	param := y.loginParam
+	var authResp LoginResp
+	res, err := y.client.R().
+		ForceContentType("application/json;charset=UTF-8").SetResult(&authResp).
+		SetHeaders(y.loginHeaders(param.BaseLoginParam)).
+		SetFormData(map[string]string{
+			"mobile":      param.SecondAuthMobile,
+			"appKey":      APP_ID,
+			"userName":    param.RsaUsername,
+			"epd":         param.encryptSecret(smsCode),
+			"accountType": ACCOUNT_TYPE,
+			"returnUrl":   RETURN_URL,
+			"isOauth2":    "false",
+			"cb_SaveName": "1",
+			"state":       "",
+			"paramId":     param.ParamId,
+		}).
+		Post(AUTH_URL + "/api/logbox/oauth2/submitForSecondAuth.do")
+	if err != nil {
+		return err
+	}
+	// 校验通过后服务端会下发DEVICEID，保存下来以后就不会再触发二次校验
+	y.saveDeviceID(res)
+
+	if authResp.Result != 0 {
+		return fmt.Errorf("second device verification failed: %s", authResp.Msg)
+	}
+	if authResp.ToUrl == "" {
+		return fmt.Errorf("second device verification failed, no toUrl obtained, msg: %s", authResp.Msg)
+	}
+	return y.getSessionByRedirectURL(authResp.ToUrl)
+}
+
+// 用登陆结果的跳转地址换取会话
+func (y *Cloud189PC) getSessionByRedirectURL(redirectURL string) error {
 	var erron RespErr
 	var tokenInfo AppSessionResp
-	_, err = y.client.R().
+	_, err := y.client.R().
 		SetResult(&tokenInfo).SetError(&erron).
 		SetQueryParams(clientSuffix()).
-		SetQueryParam("redirectURL", loginresp.ToUrl).
+		SetQueryParams(y.deviceParams()).
+		SetQueryParam("redirectURL", redirectURL).
+		SetHeader("X-Request-ID", uuid.NewString()).
 		Post(API_URL + "/getSessionForPC.action")
 	if err != nil {
 		return err
@@ -353,13 +540,13 @@ func (y *Cloud189PC) loginByPassword() (err error) {
 		return &erron
 	}
 	if tokenInfo.ResCode != 0 {
-		err = fmt.Errorf(tokenInfo.ResMessage)
-		return err
+		return errors.New(tokenInfo.ResMessage)
 	}
+	y.Addition.AccessToken = tokenInfo.AccessToken
 	y.Addition.RefreshToken = tokenInfo.RefreshToken
 	y.tokenInfo = &tokenInfo
 	op.MustSaveDriverStorage(y)
-	return err
+	return nil
 }

 func (y *Cloud189PC) loginByQRCode() error {
@@ -370,65 +557,74 @@ func (y *Cloud189PC) loginByQRCode() error {
 		}
 	}

-	var state struct {
-		Status      int    `json:"status"`
-		RedirectUrl string `json:"redirectUrl"`
-		Msg         string `json:"msg"`
+	// 本地轮询，扫码确认后自动继续，不需要用户反复保存
+	deadline := time.Now().Add(QRCODE_POLL_TIMEOUT)
+	lastStatus := -106
+	for {
+		state, err := y.checkQRCodeState()
+		if err != nil {
+			return fmt.Errorf("failed to check QR code state: %w", err)
+		}
+		lastStatus = state.Status
+
+		switch state.Status {
+		case 0: // 登录成功
+			y.qrcodeParam = nil
+			return y.getSessionByRedirectURL(state.RedirectUrl)
+		case -106, -11002: // -106 等待扫描，-11002 已扫描等待确认
+		case -11001: // 二维码过期
+			y.qrcodeParam = nil
+			return errors.New("QR code expired, please try again")
+		default: // 其他错误
+			y.qrcodeParam = nil
+			return fmt.Errorf("QR code login failed with status %d: %s", state.Status, state.Msg)
+		}
+
+		if time.Now().Add(QRCODE_POLL_INTERVAL).After(deadline) {
+			break
+		}
+		time.Sleep(QRCODE_POLL_INTERVAL)
 	}

+	// 轮询超时，把二维码交回前端等待下一次保存
+	if lastStatus == -11002 {
+		return y.genQRCode("QR code has been scanned, please confirm the login on your phone and save again")
+	}
+	return y.genQRCode("QR code has not been scanned yet, please scan and save again")
+}
+
+type qrCodeState struct {
+	Status      int    `json:"status"`
+	RedirectUrl string `json:"redirectUrl"`
+	Msg         string `json:"msg"`
+}
+
+// 查询扫码状态，参数需与官方PC端一致，否则服务端不会返回授权结果
+func (y *Cloud189PC) checkQRCodeState() (*qrCodeState, error) {
 	now := time.Now()
+	var state qrCodeState
 	_, err := y.client.R().
-		SetHeaders(map[string]string{
-			"Referer": AUTH_URL,
-			"Reqid":   y.qrcodeParam.ReqId,
-			"lt":      y.qrcodeParam.Lt,
-		}).
+		SetHeaders(y.loginHeaders(y.qrcodeParam.BaseLoginParam)).
 		SetFormData(map[string]string{
-			"appId":      APP_ID,
-			"clientType": CLIENT_TYPE,
-			"returnUrl":  RETURN_URL,
-			"paramId":    y.qrcodeParam.ParamId,
-			"uuid":       y.qrcodeParam.UUID,
-			"encryuuid":  y.qrcodeParam.EncryUUID,
-			"date":       formatDate(now),
-			"timeStamp":  fmt.Sprint(now.UTC().UnixNano() / 1e6),
+			"appId":       APP_ID,
+			"clientType":  QR_CLIENT_TYPE,
+			"returnUrl":   RETURN_URL,
+			"paramId":     y.qrcodeParam.ParamId,
+			"uuid":        y.qrcodeParam.UUID,
+			"encryuuid":   y.qrcodeParam.EncryUUID,
+			"cb_SaveName": "3",
+			"isOauth2":    "false",
+			"state":       "",
+			"date":        formatDate(now),
+			"timeStamp":   fmt.Sprint(now.UTC().UnixNano() / 1e6),
 		}).
 		ForceContentType("application/json;charset=UTF-8").
 		SetResult(&state).
 		Post(AUTH_URL + "/api/logbox/oauth2/qrcodeLoginState.do")
 	if err != nil {
-		return fmt.Errorf("failed to check QR code state: %w", err)
-	}
-
-	switch state.Status {
-	case 0: // 登录成功
-		var tokenInfo AppSessionResp
-		_, err = y.client.R().
-			SetResult(&tokenInfo).
-			SetQueryParams(clientSuffix()).
-			SetQueryParam("redirectURL", state.RedirectUrl).
-			Post(API_URL + "/getSessionForPC.action")
-		if err != nil {
-			return err
-		}
-		if tokenInfo.ResCode != 0 {
-			return fmt.Errorf(tokenInfo.ResMessage)
-		}
-		y.Addition.RefreshToken = tokenInfo.RefreshToken
-		y.tokenInfo = &tokenInfo
-		op.MustSaveDriverStorage(y)
-		return nil
-	case -11001: // 二维码过期
-		y.qrcodeParam = nil
-		return errors.New("QR code expired, please try again")
-	case -106: // 等待扫描
-		return y.genQRCode("QR code has not been scanned yet, please scan and save again")
-	case -11002: // 等待确认
-		return y.genQRCode("QR code has been scanned, please confirm the login on your phone and save again")
-	default: // 其他错误
-		y.qrcodeParam = nil
-		return fmt.Errorf("QR code login failed with status %d: %s", state.Status, state.Msg)
+		return nil, err
 	}
+	return &state, nil
 }

 func (y *Cloud189PC) genQRCode(text string) error {
@@ -454,8 +650,9 @@ func (y *Cloud189PC) genQRCode(text string) error {
 }

 func (y *Cloud189PC) initBaseParams() (*BaseLoginParam, error) {
-	// 清除cookie
+	// 清除cookie，并带上已保存的设备标识
 	jar, _ := cookiejar.New(nil)
+	y.applyDeviceID(jar)
 	y.client.SetCookieJar(jar)

 	res, err := y.client.R().
@@ -470,14 +667,98 @@ func (y *Cloud189PC) initBaseParams() (*BaseLoginParam, error) {
 		return nil, err
 	}

+	// 当前登陆页把lt/reqId放在跳转地址上，老页面则写在页内变量里，两种都要支持
+	param, err := parseBaseParamFromRedirect(res.RawResponse.Request.URL)
+	if err != nil {
+		param, err = parseBaseParamFromPage(res.String())
+		if err != nil {
+			return nil, err
+		}
+		return param, nil
+	}
+
+	// 跳转地址上没有paramId，需要再问一次appConf.do
+	var appConf AppConfResp
+	_, err = y.client.R().
+		SetHeaders(y.loginHeaders(*param)).
+		ForceContentType("application/json;charset=UTF-8").
+		SetResult(&appConf).
+		SetFormData(map[string]string{
+			"version": "2.0",
+			"appKey":  APP_ID,
+		}).
+		Post(AUTH_URL + "/api/logbox/oauth2/appConf.do")
+	if err != nil {
+		return nil, err
+	}
+	if !appConf.Succeeded() || appConf.Data.ParamId == "" {
+		return nil, fmt.Errorf("failed to get the login paramId: %s", appConf.Msg)
+	}
+	param.ParamId = appConf.Data.ParamId
+	return param, nil
+}
+
+// parseBaseParamFromRedirect 从logbox跳转地址提取登陆参数，并以该地址作为后续请求的Referer
+func parseBaseParamFromRedirect(finalUrl *url.URL) (*BaseLoginParam, error) {
+	if finalUrl == nil {
+		return nil, errors.New("no login page redirect")
+	}
+	query := finalUrl.Query()
+	lt, reqId := query.Get("lt"), query.Get("reqId")
+	if lt == "" || reqId == "" {
+		return nil, errors.New("no lt/reqId in the login page redirect")
+	}
 	return &BaseLoginParam{
-		CaptchaToken: regexp.MustCompile(`'captchaToken' value='(.+?)'`).FindStringSubmatch(res.String())[1],
-		Lt:           regexp.MustCompile(`lt = "(.+?)"`).FindStringSubmatch(res.String())[1],
-		ParamId:      regexp.MustCompile(`paramId = "(.+?)"`).FindStringSubmatch(res.String())[1],
-		ReqId:        regexp.MustCompile(`reqId = "(.+?)"`).FindStringSubmatch(res.String())[1],
+		Lt:      lt,
+		ReqId:   reqId,
+		Referer: finalUrl.String(),
 	}, nil
 }

+// parseBaseParamFromPage 兼容把参数写在页内变量里的老登陆页
+func parseBaseParamFromPage(body string) (*BaseLoginParam, error) {
+	lt, err := matchLoginParam(body, `lt = "(.+?)"`, "lt")
+	if err != nil {
+		return nil, err
+	}
+	reqId, err := matchLoginParam(body, `reqId = "(.+?)"`, "reqId")
+	if err != nil {
+		return nil, err
+	}
+	paramId, err := matchLoginParam(body, `paramId = "(.+?)"`, "paramId")
+	if err != nil {
+		return nil, err
+	}
+	// 老页面才有内嵌的图形验证码token
+	captchaToken, _ := matchLoginParam(body, `'captchaToken' value='(.+?)'`, "captchaToken")
+
+	param := &BaseLoginParam{
+		CaptchaToken: captchaToken,
+		Lt:           lt,
+		ParamId:      paramId,
+		ReqId:        reqId,
+	}
+	encryptUrl, _ := matchLoginParam(body, `encryptUrl = "(.+?)"`, "encryptUrl")
+	param.Referer = AUTH_URL + "/api/logbox/separate/web/index.html?" + strings.Join([]string{
+		"appId=" + url.QueryEscape(APP_ID),
+		"lt=" + url.QueryEscape(param.Lt),
+		"reqId=" + url.QueryEscape(param.ReqId),
+	}, "&")
+	if encryptUrl != "" {
+		param.Referer += "&encryptUrl=" + url.QueryEscape(encryptUrl)
+	}
+	return param, nil
+}
+
+// matchLoginParam 从登陆页面提取参数，缺失时返回可读的错误而不是panic
+func matchLoginParam(body, pattern, name string) (string, error) {
+	matches := regexp.MustCompile(pattern).FindStringSubmatch(body)
+	if len(matches) < 2 {
+		return "", fmt.Errorf("failed to get %s from the login page", name)
+	}
+	return matches[1], nil
+}
+
 /* 初始化登陆需要的参数
 *  如果遇到验证码返回错误
 */
@@ -502,12 +783,13 @@ func (y *Cloud189PC) initLoginParam() error {
 	}

 	y.loginParam.jRsaKey = fmt.Sprintf("-----BEGIN PUBLIC KEY-----\n%s\n-----END PUBLIC KEY-----", encryptConf.Data.PubKey)
-	y.loginParam.RsaUsername = encryptConf.Data.Pre + RsaEncrypt(y.loginParam.jRsaKey, y.Username)
-	y.loginParam.RsaPassword = encryptConf.Data.Pre + RsaEncrypt(y.loginParam.jRsaKey, y.Password)
+	y.loginParam.rsaPrefix = encryptConf.Data.Pre
+	y.loginParam.RsaUsername = y.loginParam.encryptSecret(y.Username)
+	y.loginParam.RsaPassword = y.loginParam.encryptSecret(y.Password)

 	// 判断是否需要验证码
 	resp, err := y.client.R().
-		SetHeader("REQID", y.loginParam.ReqId).
+		SetHeaders(y.loginHeaders(y.loginParam.BaseLoginParam)).
 		SetFormData(map[string]string{
 			"appKey":      APP_ID,
 			"accountType": ACCOUNT_TYPE,
@@ -562,6 +844,7 @@ func (y *Cloud189PC) initQRCodeParam() (err error) {

 	var qrcodeParam QRLoginParam
 	_, err = y.client.R().
+		SetHeaders(y.loginHeaders(*baseParam)).
 		SetFormData(map[string]string{"appId": APP_ID}).
 		ForceContentType("application/json;charset=UTF-8").
 		SetResult(&qrcodeParam).
@@ -569,6 +852,9 @@ func (y *Cloud189PC) initQRCodeParam() (err error) {
 	if err != nil {
 		return err
 	}
+	if qrcodeParam.UUID == "" {
+		return errors.New("failed to get the QR code uuid")
+	}
 	qrcodeParam.BaseLoginParam = *baseParam
 	y.qrcodeParam = &qrcodeParam

@@ -589,6 +875,7 @@ func (y *Cloud189PC) refreshSessionWithRetry(retryCount int) (err error) {
 	_, err = y.client.R().
 		SetResult(&userSessionResp).SetError(&erron).
 		SetQueryParams(clientSuffix()).
+		SetQueryParams(y.deviceParams()).
 		SetQueryParams(map[string]string{
 			"appId":       APP_ID,
 			"accessToken": y.tokenInfo.AccessToken,
@@ -629,12 +916,11 @@ func (y *Cloud189PC) refreshTokenWithRetry(retryCount int) (err error) {
 		return errors.New("refresh token failed after maximum retries")
 	}

-	var erron RespErr
-	var tokenInfo AppSessionResp
+	// 该接口刷新失败时以HTTP 200返回 result/msg，SetError不会触发，必须解析响应体判断
+	var tokenInfo RefreshTokenResp
 	_, err = y.client.R().
 		SetResult(&tokenInfo).
 		ForceContentType("application/json;charset=UTF-8").
-		SetError(&erron).
 		SetFormData(map[string]string{
 			"clientId":     APP_ID,
 			"refreshToken": y.tokenInfo.RefreshToken,
@@ -647,7 +933,8 @@ func (y *Cloud189PC) refreshTokenWithRetry(retryCount int) (err error) {
 	}

 	// 如果刷新失败，返回错误给上层处理
-	if erron.HasError() {
+	if tokenInfo.HasError() {
+		refreshErr := tokenInfo.Error()
 		if y.Addition.RefreshToken != "" {
 			y.Addition.RefreshToken = ""
 			op.MustSaveDriverStorage(y)
@@ -655,14 +942,20 @@ func (y *Cloud189PC) refreshTokenWithRetry(retryCount int) (err error) {

 		// 根据登录类型决定下一步行为
 		if y.LoginType == "qrcode" {
-			return errors.New("QR code session has expired, please re-scan the code to log in")
+			return fmt.Errorf("QR code session has expired, please re-scan the code to log in: %s", refreshErr)
+		}
+		// 没有账号密码时无法回退到完整登录，直接把刷新失败的原因返回
+		if y.Username == "" || y.Password == "" {
+			return errors.New(refreshErr)
 		}
 		// 密码登录模式下，尝试回退到完整登录
 		return y.login()
 	}

+	y.Addition.AccessToken = tokenInfo.AccessToken
 	y.Addition.RefreshToken = tokenInfo.RefreshToken
-	y.tokenInfo = &tokenInfo
+	y.tokenInfo.AccessToken = tokenInfo.AccessToken
+	y.tokenInfo.RefreshToken = tokenInfo.RefreshToken
 	op.MustSaveDriverStorage(y)
 	return y.refreshSessionWithRetry(retryCount + 1)
 }
@@ -739,6 +1032,10 @@ func (y *Cloud189PC) StreamUpload(ctx context.Context, dstDir model.Obj, file mo
 	silceMd5 := utils.MD5.NewFunc()
 	var writers io.Writer = silceMd5

+	// 如果启用了 torrent 生成，额外计算 SHA-1 piece hash
+	generateTorrent := y.Addition.GenerateTorrent
+	pieceSHA1Hashes := make([]byte, 0, count*20)
+
 	fileMd5Hex := file.GetHash().GetHash(utils.MD5)
 	var fileMd5 hash.Hash
 	if len(fileMd5Hex) != utils.MD5.Width {
@@ -763,7 +1060,18 @@ func (y *Cloud189PC) StreamUpload(ctx context.Context, dstDir model.Obj, file mo
 					return err
 				}
 				silceMd5.Reset()
-				w, err := utils.CopyWithBuffer(writers, reader)
+
+				// 如果需要生成 torrent，同时计算 SHA-1
+				var sha1Writer hash.Hash
+				var multiWriter io.Writer
+				if generateTorrent {
+					sha1Writer = sha1Pkg.New()
+					multiWriter = io.MultiWriter(writers, sha1Writer)
+				} else {
+					multiWriter = writers
+				}
+
+				w, err := utils.CopyWithBuffer(multiWriter, reader)
 				if w != partSize {
 					return fmt.Errorf("failed to read all data: (expect =%d, actual =%d) %w", partSize, w, err)
 				}
@@ -771,6 +1079,11 @@ func (y *Cloud189PC) StreamUpload(ctx context.Context, dstDir model.Obj, file mo
 				md5Bytes := silceMd5.Sum(nil)
 				silceMd5Hexs = append(silceMd5Hexs, strings.ToUpper(hex.EncodeToString(md5Bytes)))
 				partInfo = fmt.Sprintf("%d-%s", i, base64.StdEncoding.EncodeToString(md5Bytes))
+
+				// 收集 SHA-1 piece hash
+				if generateTorrent && sha1Writer != nil {
+					pieceSHA1Hashes = append(pieceSHA1Hashes, sha1Writer.Sum(nil)...)
+				}
 				return nil
 			},
 			Do: func(ctx context.Context) (err error) {
@@ -824,6 +1137,45 @@ func (y *Cloud189PC) StreamUpload(ctx context.Context, dstDir model.Obj, file mo
 	if err != nil {
 		return nil, err
 	}
+
+	// 生成 torrent 文件（异步，不影响上传结果）
+	if generateTorrent && len(pieceSHA1Hashes) > 0 {
+		// 捕获必要的变量
+		capturedDstDir := dstDir
+		capturedIsFamily := isFamily
+		capturedFileName := file.GetName()
+		go func() {
+			torrentData, err := GenerateTorrent(capturedFileName, fileSize, fileMd5Hex, silceMd5Hexs, sliceSize, pieceSHA1Hashes)
+			if err != nil {
+				utils.Log.Warnf("生成 torrent 失败: %v", err)
+				return
+			}
+			infoHash, _ := GetInfoHashHex(torrentData)
+			torrentName := capturedFileName + ".cas.torrent"
+			utils.Log.Infof("已生成 torrent: %s (info_hash: %s, size: %d bytes)",
+				torrentName, infoHash, len(torrentData))
+
+			// 将 torrent 文件上传到同一目录（使用 FastUpload，因为 torrent 文件很小）
+			torrentFileStream := &stream.FileStream{
+				Ctx: context.Background(),
+				Obj: &model.Object{
+					Name:     torrentName,
+					Size:     int64(len(torrentData)),
+					IsFolder: false,
+				},
+				Reader:   bytes.NewReader(torrentData),
+				Mimetype: "application/x-bittorrent",
+			}
+			_, uploadErr := y.FastUpload(context.Background(), capturedDstDir, torrentFileStream, func(p float64) {}, capturedIsFamily, false)
+			if uploadErr != nil {
+				utils.Log.Warnf("上传 torrent 文件失败: %v", uploadErr)
+			} else {
+				utils.Log.Infof("torrent 文件已上传: %s", torrentName)
+				op.Cache.DeleteDirectory(y, capturedDstDir.GetPath())
+			}
+		}()
+	}
+
 	return resp.toFile(), nil
 }

@@ -847,6 +1199,11 @@ func (y *Cloud189PC) RapidUpload(ctx context.Context, dstDir model.Obj, stream m

 // 快传
 func (y *Cloud189PC) FastUpload(ctx context.Context, dstDir model.Obj, file model.FileStreamer, up driver.UpdateProgress, isFamily bool, overwrite bool) (model.Obj, error) {
+	generateTorrent := y.Addition.GenerateTorrent && !isCASTorrentFile(file.GetName())
+	return y.fastUpload(ctx, dstDir, file, up, isFamily, overwrite, generateTorrent)
+}
+
+func (y *Cloud189PC) fastUpload(ctx context.Context, dstDir model.Obj, file model.FileStreamer, up driver.UpdateProgress, isFamily bool, overwrite bool, generateTorrent bool) (model.Obj, error) {
 	var (
 		cache = file.GetFile()
 		tmpF  *os.File
@@ -884,6 +1241,9 @@ func (y *Cloud189PC) FastUpload(ctx context.Context, dstDir model.Obj, file mode
 	if tmpF != nil {
 		writers = append(writers, tmpF)
 	}
+
+	pieceSHA1Hashes := make([]byte, 0, count*20)
+
 	written := int64(0)
 	for i := 1; i <= count; i++ {
 		if utils.IsCanceled(ctx) {
@@ -894,7 +1254,17 @@ func (y *Cloud189PC) FastUpload(ctx context.Context, dstDir model.Obj, file mode
 			byteSize = lastSliceSize
 		}

-		n, err := utils.CopyWithBufferN(io.MultiWriter(writers...), file, byteSize)
+		// 如果需要生成 torrent，同时计算 SHA-1
+		var sha1Writer hash.Hash
+		var multiWriter io.Writer
+		if generateTorrent {
+			sha1Writer = sha1Pkg.New()
+			multiWriter = io.MultiWriter(append(writers, sha1Writer)...)
+		} else {
+			multiWriter = io.MultiWriter(writers...)
+		}
+
+		n, err := utils.CopyWithBufferN(multiWriter, file, byteSize)
 		written += n
 		if err != nil && err != io.EOF {
 			return nil, err
@@ -903,6 +1273,11 @@ func (y *Cloud189PC) FastUpload(ctx context.Context, dstDir model.Obj, file mode
 		sliceMd5Hexs = append(sliceMd5Hexs, strings.ToUpper(hex.EncodeToString(md5Byte)))
 		partInfos = append(partInfos, fmt.Sprint(i, "-", base64.StdEncoding.EncodeToString(md5Byte)))
 		sliceMd5.Reset()
+
+		// 收集 SHA-1 piece hash（仅在本次分片实际写入了数据时追加）
+		if generateTorrent && n > 0 {
+			pieceSHA1Hashes = append(pieceSHA1Hashes, sha1Writer.Sum(nil)...)
+		}
 	}

 	if tmpF != nil {
@@ -1018,6 +1393,44 @@ func (y *Cloud189PC) FastUpload(ctx context.Context, dstDir model.Obj, file mode
 	if err != nil {
 		return nil, err
 	}
+
+	// 生成 torrent 文件（异步，不影响上传结果）
+	if generateTorrent && size > 0 && len(pieceSHA1Hashes) > 0 {
+		capturedDstDir := dstDir
+		capturedIsFamily := isFamily
+		capturedFileName := file.GetName()
+		go func() {
+			torrentData, err := GenerateTorrent(capturedFileName, size, fileMd5Hex, sliceMd5Hexs, sliceSize, pieceSHA1Hashes)
+			if err != nil {
+				utils.Log.Warnf("生成 torrent 失败: %v", err)
+				return
+			}
+			infoHash, _ := GetInfoHashHex(torrentData)
+			torrentName := capturedFileName + ".cas.torrent"
+			utils.Log.Infof("已生成 torrent: %s (info_hash: %s, size: %d bytes)",
+				torrentName, infoHash, len(torrentData))
+
+			// 将 torrent 文件上传到同一目录
+			torrentFileStream := &stream.FileStream{
+				Ctx: context.Background(),
+				Obj: &model.Object{
+					Name:     torrentName,
+					Size:     int64(len(torrentData)),
+					IsFolder: false,
+				},
+				Reader:   bytes.NewReader(torrentData),
+				Mimetype: "application/x-bittorrent",
+			}
+			_, uploadErr := y.fastUpload(context.Background(), capturedDstDir, torrentFileStream, func(p float64) {}, capturedIsFamily, false, false)
+			if uploadErr != nil {
+				utils.Log.Warnf("上传 torrent 文件失败: %v", uploadErr)
+			} else {
+				utils.Log.Infof("torrent 文件已上传: %s", torrentName)
+				op.Cache.DeleteDirectory(y, capturedDstDir.GetPath())
+			}
+		}()
+	}
+
 	return resp.toFile(), nil
 }

@@ -249,6 +249,7 @@ func (d *Alias) Link(ctx context.Context, file model.Obj, args model.LinkArgs) (
 		}
 		linkClosers := make([]io.Closer, 0, len(files))
 		rrf := make([]model.RangeReaderIF, 0, len(files))
+		requireReference := false
 		for _, f := range files {
 			link, fi, err := d.link(ctx, f.GetPath(), args)
 			if err != nil {
@@ -258,9 +259,13 @@ func (d *Alias) Link(ctx context.Context, file model.Obj, args model.LinkArgs) (
 				_ = link.Close()
 				continue
 			}
-			l := *link // 复制一份，避免修改到原始link
-			if l.ContentLength == 0 {
-				l.ContentLength = fi.GetSize()
+			l := &model.Link{
+				URL:           link.URL,
+				Header:        link.Header,
+				RangeReader:   link.RangeReader,
+				Concurrency:   link.Concurrency,
+				PartSize:      link.PartSize,
+				ContentLength: link.ContentLength,
 			}
 			if d.DownloadConcurrency > 0 {
 				l.Concurrency = d.DownloadConcurrency
@@ -268,20 +273,27 @@ func (d *Alias) Link(ctx context.Context, file model.Obj, args model.LinkArgs) (
 			if d.DownloadPartSize > 0 {
 				l.PartSize = d.DownloadPartSize * utils.KB
 			}
-			rr, err := stream.GetRangeReaderFromLink(l.ContentLength, &l)
+			if l.ContentLength == 0 {
+				l.ContentLength = fi.GetSize()
+			}
+			rr, err := stream.GetRangeReaderFromLink(l.ContentLength, l)
 			if err != nil {
 				_ = link.Close()
 				continue
 			}
 			linkClosers = append(linkClosers, link)
+			if link.RequireReference {
+				requireReference = true
+			}
 			rrf = append(rrf, rr)
 		}
 		rr := func(ctx context.Context, httpRange http_range.Range) (io.ReadCloser, error) {
 			return rrf[rand.Intn(len(rrf))].RangeRead(ctx, httpRange)
 		}
 		return &model.Link{
-			RangeReader: stream.RangeReaderFunc(rr),
-			SyncClosers: utils.NewSyncClosers(linkClosers...),
+			RangeReader:      stream.RangeReaderFunc(rr),
+			SyncClosers:      utils.NewSyncClosers(linkClosers...),
+			RequireReference: requireReference,
 		}, nil
 	}

@@ -315,14 +327,9 @@ func (d *Alias) Link(ctx context.Context, file model.Obj, args model.LinkArgs) (
 	if err != nil {
 		return nil, err
 	}
-	resultLink := *link // 复制一份，避免修改到原始link
-	resultLink.Expiration = nil
-	resultLink.SyncClosers = utils.NewSyncClosers(link)
+	resultLink := link.Clone() // 复制一份，避免修改到原始link
 	if args.Redirect {
-		return &resultLink, nil
-	}
-	if resultLink.ContentLength == 0 {
-		resultLink.ContentLength = fi.GetSize()
+		return resultLink, nil
 	}
 	if d.DownloadConcurrency > 0 {
 		resultLink.Concurrency = d.DownloadConcurrency
@@ -330,7 +337,10 @@ func (d *Alias) Link(ctx context.Context, file model.Obj, args model.LinkArgs) (
 	if d.DownloadPartSize > 0 {
 		resultLink.PartSize = d.DownloadPartSize * utils.KB
 	}
-	return &resultLink, nil
+	if resultLink.ContentLength == 0 {
+		resultLink.ContentLength = fi.GetSize()
+	}
+	return resultLink, nil
 }

 func (d *Alias) Other(ctx context.Context, args model.OtherArgs) (interface{}, error) {
@@ -501,9 +511,7 @@ func (d *Alias) Extract(ctx context.Context, obj model.Obj, args model.ArchiveIn
 				sign.SignArchive(reqPath)),
 		}, nil
 	}
-	resultLink := *link
-	resultLink.SyncClosers = utils.NewSyncClosers(link)
-	return &resultLink, nil
+	return link.Clone(), nil
 }

 func (d *Alias) ArchiveDecompress(ctx context.Context, srcObj, dstDir model.Obj, args model.ArchiveDecompressArgs) error {
@@ -0,0 +1,147 @@
+package alidoc
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/OpenListTeam/OpenList/v4/drivers/base"
+	"github.com/OpenListTeam/OpenList/v4/internal/driver"
+	"github.com/OpenListTeam/OpenList/v4/internal/model"
+	"github.com/go-resty/resty/v2"
+)
+
+type AliDoc struct {
+	model.Storage
+	Addition
+
+	client *resty.Client
+}
+
+func (d *AliDoc) Config() driver.Config {
+	return config
+}
+
+func (d *AliDoc) GetAddition() driver.Additional {
+	return &d.Addition
+}
+
+func (d *AliDoc) Init(ctx context.Context) error {
+	d.Cookie = strings.TrimSpace(d.Cookie)
+	d.RootFolderID = strings.TrimSpace(d.RootFolderID)
+	if d.Cookie == "" {
+		return fmt.Errorf("cookie is empty")
+	}
+	if d.RootFolderID == "" {
+		return fmt.Errorf("root folder id is empty")
+	}
+	d.client = newClient()
+	if err := d.checkCookie(ctx); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (d *AliDoc) Drop(ctx context.Context) error {
+	d.client = nil
+	return nil
+}
+
+func (d *AliDoc) List(ctx context.Context, dir model.Obj, args model.ListArgs) ([]model.Obj, error) {
+	items, err := d.list(ctx, dir.GetID())
+	if err != nil {
+		return nil, err
+	}
+
+	objs := make([]model.Obj, 0, len(items))
+	for _, item := range items {
+		if strings.TrimSpace(item.DentryUUID) == "" || strings.TrimSpace(item.Name) == "" {
+			continue
+		}
+		objs = append(objs, toObj(item))
+	}
+	return objs, nil
+}
+
+func (d *AliDoc) Link(ctx context.Context, file model.Obj, args model.LinkArgs) (*model.Link, error) {
+	if file.IsDir() {
+		return nil, fmt.Errorf("alidoc does not support directory links")
+	}
+	resp, err := d.download(ctx, file.GetID())
+	if err != nil {
+		return nil, err
+	}
+	url, err := firstDownloadURL(resp)
+	if err != nil {
+		return nil, err
+	}
+	return &model.Link{
+		URL: url,
+		Header: http.Header{
+			"User-Agent": []string{base.UserAgent},
+			"Referer":    []string{apiBase + "/"},
+		},
+	}, nil
+}
+
+func (d *AliDoc) MakeDir(ctx context.Context, parentDir model.Obj, dirName string) (model.Obj, error) {
+	err := d.post(ctx, "/box/api/v2/dentry/createfolder", map[string]string{
+		"dentryType":             "folder",
+		"name":                   dirName,
+		"parentDentryUuid":       parentDir.GetID(),
+		"conflictHandleStrategy": "auto_rename",
+	})
+	if err != nil {
+		return nil, err
+	}
+	return nil, nil
+}
+
+func (d *AliDoc) Move(ctx context.Context, srcObj, dstDir model.Obj) (model.Obj, error) {
+	err := d.post(ctx, "/box/api/v2/dentry/move", map[string]interface{}{
+		"targetParentDentryUuid": dstDir.GetID(),
+		"sourceDentryUuid":       srcObj.GetID(),
+		"operateFrom":            1,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return srcObj, nil
+}
+
+func (d *AliDoc) Rename(ctx context.Context, srcObj model.Obj, newName string) (model.Obj, error) {
+	err := d.post(ctx, "/box/api/v2/dentry/rename", map[string]string{
+		"dentryUuid": srcObj.GetID(),
+		"name":       newName,
+	})
+	if err != nil {
+		return nil, err
+	}
+	srcObj.(*model.Object).Name = newName
+	return srcObj, nil
+}
+
+func (d *AliDoc) Copy(ctx context.Context, srcObj, dstDir model.Obj) error {
+	return d.post(ctx, "/box/api/v2/dentry/copy", map[string]interface{}{
+		"sourceDentryUuid":       srcObj.GetID(),
+		"targetParentDentryUuid": dstDir.GetID(),
+		"operateFrom":            1,
+		"onlyCopyMeta":           false,
+	})
+}
+
+func (d *AliDoc) Remove(ctx context.Context, obj model.Obj) error {
+	return d.post(ctx, "/box/api/v1/dentry/recycle", map[string]string{
+		"dentryUuid": obj.GetID(),
+	})
+}
+
+var (
+	_ driver.Driver       = (*AliDoc)(nil)
+	_ driver.MkdirResult  = (*AliDoc)(nil)
+	_ driver.MoveResult   = (*AliDoc)(nil)
+	_ driver.RenameResult = (*AliDoc)(nil)
+	_ driver.Copy         = (*AliDoc)(nil)
+	_ driver.Remove       = (*AliDoc)(nil)
+)
@@ -0,0 +1,23 @@
+package alidoc
+
+import (
+	"github.com/OpenListTeam/OpenList/v4/internal/driver"
+	"github.com/OpenListTeam/OpenList/v4/internal/op"
+)
+
+type Addition struct {
+	driver.RootID
+	Cookie string `json:"cookie" type:"text" required:"true" help:"钉钉文档网页 Cookie"`
+}
+
+var config = driver.Config{
+	Name:        "AliDoc",
+	LocalSort:   true,
+	DefaultRoot: "",
+}
+
+func init() {
+	op.RegisterDriver(func() driver.Driver {
+		return &AliDoc{}
+	})
+}
@@ -0,0 +1,87 @@
+package alidoc
+
+type apiResp struct {
+	Status    int    `json:"status"`
+	IsSuccess bool   `json:"isSuccess"`
+	Message   string `json:"message"`
+	Msg       string `json:"msg"`
+}
+
+func (r apiResp) ErrMessage() string {
+	if r.Message != "" {
+		return r.Message
+	}
+	if r.Msg != "" {
+		return r.Msg
+	}
+	return ""
+}
+
+type listResp struct {
+	apiResp
+	Data listData `json:"data"`
+}
+
+type listData struct {
+	Children []dentry `json:"children"`
+}
+
+type dentry struct {
+	DentryType       string `json:"dentryType"`
+	DentryUUID       string `json:"dentryUuid"`
+	ParentDentryUUID string `json:"parentDentryUuid"`
+	Name             string `json:"name"`
+	Path             string `json:"path"`
+	FileSize         int64  `json:"fileSize"`
+	CreatedTime      int64  `json:"createdTime"`
+	UpdatedTime      int64  `json:"updatedTime"`
+	ContentType      string `json:"contentType"`
+	Extension        string `json:"extension"`
+	DentryStatistic  struct {
+		ChildrenCount int `json:"childrenCount"`
+	} `json:"dentryStatistic"`
+	URL struct {
+		PCChildAppPreviewURL string `json:"pcChildAppPreviewUrl"`
+		PCChildAppURL        string `json:"pcChildAppUrl"`
+	} `json:"url"`
+}
+
+type downloadResp struct {
+	apiResp
+	Data downloadData `json:"data"`
+}
+
+type downloadData struct {
+	OSSURLPreSignatureInfo struct {
+		PreSignURLs []string `json:"preSignUrls"`
+	} `json:"ossUrlPreSignatureInfo"`
+}
+
+type uploadInfoResp struct {
+	apiResp
+	Data uploadInfoData `json:"data"`
+}
+
+type uploadInfoData struct {
+	CurrentTimestamp         int64                  `json:"currentTimestamp"`
+	FileUploadProtocolConfig uploadProtocolConfig   `json:"fileUploadProtocolConfig"`
+	STSSignatureInfo         uploadSTSSignatureInfo `json:"stsSignatureInfo"`
+	UploadKey                string                 `json:"uploadKey"`
+	UploadType               string                 `json:"uploadType"`
+}
+
+type uploadProtocolConfig struct {
+	MinPartSize int64 `json:"minPartSize"`
+}
+
+type uploadSTSSignatureInfo struct {
+	AccelerateCname       string `json:"accelerateCname"`
+	AccessKeyID           string `json:"accessKeyId"`
+	AccessKeySecret       string `json:"accessKeySecret"`
+	AccessToken           string `json:"accessToken"`
+	AccessTokenExpiration int64  `json:"accessTokenExpiration"`
+	Bucket                string `json:"bucket"`
+	Cname                 string `json:"cname"`
+	EndPoint              string `json:"endPoint"`
+	ObjectKey             string `json:"objectKey"`
+}
@@ -0,0 +1,263 @@
+package alidoc
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"math"
+	"strings"
+	"time"
+
+	"github.com/OpenListTeam/OpenList/v4/internal/driver"
+	"github.com/OpenListTeam/OpenList/v4/internal/model"
+	netutil "github.com/OpenListTeam/OpenList/v4/internal/net"
+	streamPkg "github.com/OpenListTeam/OpenList/v4/internal/stream"
+	"github.com/aliyun/aliyun-oss-go-sdk/oss"
+	"github.com/avast/retry-go"
+	"github.com/google/uuid"
+)
+
+const (
+	defaultAliDocMultipartThreshold = 16 * 1024 * 1024
+	defaultAliDocPartSize           = 100 * 1024
+	maxAliDocMultipartParts         = 10000
+)
+
+func (d *AliDoc) Put(ctx context.Context, dstDir model.Obj, file model.FileStreamer, up driver.UpdateProgress) error {
+	size := file.GetSize()
+	useMultipart := size > defaultAliDocMultipartThreshold
+	info, err := d.getUploadInfo(ctx, dstDir.GetID(), file.GetName(), size, useMultipart)
+	if err != nil {
+		return err
+	}
+	if size > 0 {
+		partSize := calcAliDocPartSize(size, info.Data.FileUploadProtocolConfig.MinPartSize)
+		if size > partSize && !useMultipart {
+			useMultipart = true
+			info, err = d.getUploadInfo(ctx, dstDir.GetID(), file.GetName(), size, true)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	if useMultipart {
+		err = d.multipartUpload(ctx, file, size, info, up)
+	} else {
+		err = d.singleUpload(ctx, file, size, info, up)
+	}
+	if err != nil {
+		return err
+	}
+	if err := d.commitUpload(ctx, dstDir.GetID(), file.GetName(), size, info.Data.UploadKey); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (d *AliDoc) getUploadInfo(ctx context.Context, parentDentryUUID, name string, fileSize int64, multipart bool) (uploadInfoResp, error) {
+	var result uploadInfoResp
+	body := map[string]interface{}{
+		"uploadType":         "STS_SIGNATURE",
+		"supportUploadTypes": []string{"STS_SIGNATURE", "HTTP_TO_CENTER"},
+		"parentDentryUuid":   parentDentryUUID,
+		"fileSize":           fileSize,
+		"name":               name,
+		"multipart":          multipart,
+	}
+	resp, err := d.request(ctx).
+		SetBody(body).
+		SetResult(&result).
+		SetError(&result).
+		Post(apiBase + "/box/api/v2/file/uploadinfo")
+	if err != nil {
+		return result, err
+	}
+	if err := checkResp(resp, result.apiResp); err != nil {
+		return result, err
+	}
+	if strings.TrimSpace(result.Data.STSSignatureInfo.Bucket) == "" {
+		return result, fmt.Errorf("empty upload bucket")
+	}
+	return result, nil
+}
+
+func (d *AliDoc) commitUpload(ctx context.Context, parentDentryUUID, name string, fileSize int64, uploadKey string) error {
+	uploadKey = strings.TrimSpace(uploadKey)
+	if uploadKey == "" {
+		return fmt.Errorf("empty upload key")
+	}
+
+	var result apiResp
+	body := map[string]interface{}{
+		"parentDentryUuid":      parentDentryUUID,
+		"uploadKey":             uploadKey,
+		"fileSize":              fileSize,
+		"name":                  name,
+		"toPrevDentryUuid":      nil,
+		"toNextDentryUuid":      nil,
+		"batchId":               uuid.NewString(),
+		"batchUploadType":       1,
+		"batchParentDentryUuid": parentDentryUUID,
+	}
+	resp, err := d.request(ctx).
+		SetBody(body).
+		SetResult(&result).
+		SetError(&result).
+		Post(apiBase + "/box/api/v2/file/commit")
+	if err != nil {
+		return err
+	}
+	return checkResp(resp, result)
+}
+
+func calcAliDocPartSize(fileSize, minPartSize int64) int64 {
+	partSize := minPartSize
+	if partSize <= 0 {
+		partSize = defaultAliDocPartSize
+	}
+	if fileSize <= 0 {
+		return partSize
+	}
+	minRequired := int64(math.Ceil(float64(fileSize) / maxAliDocMultipartParts))
+	if minRequired > partSize {
+		partSize = minRequired
+	}
+	return partSize
+}
+
+func (d *AliDoc) singleUpload(ctx context.Context, src model.FileStreamer, size int64, info uploadInfoResp, up driver.UpdateProgress) error {
+	bucket, objectKey, err := d.newOSSBucket(info)
+	if err != nil {
+		return err
+	}
+	err = bucket.PutObject(
+		objectKey,
+		driver.NewLimitedUploadStream(ctx, io.TeeReader(src, driver.NewProgress(size, up))),
+	)
+	if err != nil {
+		return err
+	}
+	up(100)
+	return nil
+}
+
+func (d *AliDoc) multipartUpload(ctx context.Context, src model.FileStreamer, size int64, info uploadInfoResp, up driver.UpdateProgress) error {
+	bucket, objectKey, err := d.newOSSBucket(info)
+	if err != nil {
+		return err
+	}
+
+	imur, err := bucket.InitiateMultipartUpload(objectKey, oss.Sequential())
+	if err != nil {
+		return err
+	}
+
+	partSize := calcAliDocPartSize(size, info.Data.FileUploadProtocolConfig.MinPartSize)
+	partNum := int((size + partSize - 1) / partSize)
+	parts := make([]oss.UploadPart, 0, partNum)
+	ss, err := streamPkg.NewStreamSectionReader(src, int(partSize), &up)
+	if err != nil {
+		return err
+	}
+
+	var offset int64
+	for partNumber := 1; partNumber <= partNum; partNumber++ {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		length := partSize
+		if remain := size - offset; remain < length {
+			length = remain
+		}
+
+		reader, err := ss.GetSectionReader(offset, length)
+		if err != nil {
+			return err
+		}
+		var part oss.UploadPart
+		var uploadErr error
+		err = retry.Do(func() error {
+			if _, err := reader.Seek(0, io.SeekStart); err != nil {
+				return err
+			}
+			part, uploadErr = bucket.UploadPart(
+				imur,
+				driver.NewLimitedUploadStream(ctx, reader),
+				length,
+				partNumber,
+			)
+			return uploadErr
+		},
+			retry.Context(ctx),
+			retry.Attempts(3),
+			retry.DelayType(retry.BackOffDelay),
+			retry.Delay(time.Second),
+		)
+		ss.FreeSectionReader(reader)
+		if err != nil {
+			return err
+		}
+		parts = append(parts, part)
+		up(100 * float64(len(parts)) / float64(partNum+1))
+		offset += length
+	}
+
+	_, err = bucket.CompleteMultipartUpload(imur, parts)
+	if err != nil {
+		return err
+	}
+	up(100)
+	return nil
+}
+
+func (d *AliDoc) newOSSBucket(info uploadInfoResp) (*oss.Bucket, string, error) {
+	sts := info.Data.STSSignatureInfo
+	objectKey := strings.TrimSpace(sts.ObjectKey)
+	if objectKey == "" {
+		objectKey = strings.TrimSpace(info.Data.UploadKey)
+	}
+	if objectKey == "" {
+		return nil, "", fmt.Errorf("empty upload object key")
+	}
+
+	endpoint, useCname := pickAliDocOSSEndpoint(sts)
+	if endpoint == "" {
+		return nil, "", fmt.Errorf("empty upload endpoint")
+	}
+	if !strings.HasPrefix(endpoint, "http://") && !strings.HasPrefix(endpoint, "https://") {
+		endpoint = "https://" + endpoint
+	}
+
+	options := []oss.ClientOption{oss.SecurityToken(sts.AccessToken)}
+	if useCname {
+		options = append(options, oss.UseCname(true))
+	}
+	client, err := netutil.NewOSSClient(
+		endpoint,
+		sts.AccessKeyID,
+		sts.AccessKeySecret,
+		options...,
+	)
+	if err != nil {
+		return nil, "", err
+	}
+	bucket, err := client.Bucket(sts.Bucket)
+	if err != nil {
+		return nil, "", err
+	}
+	return bucket, objectKey, nil
+}
+
+func pickAliDocOSSEndpoint(sts uploadSTSSignatureInfo) (endpoint string, useCname bool) {
+	if endpoint = strings.TrimSpace(sts.EndPoint); endpoint != "" {
+		return endpoint, false
+	}
+	if endpoint = strings.TrimSpace(sts.Cname); endpoint != "" {
+		return endpoint, true
+	}
+	if endpoint = strings.TrimSpace(sts.AccelerateCname); endpoint != "" {
+		return endpoint, true
+	}
+	return "", false
+}
@@ -0,0 +1,135 @@
+package alidoc
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/OpenListTeam/OpenList/v4/drivers/base"
+	"github.com/OpenListTeam/OpenList/v4/internal/model"
+	"github.com/go-resty/resty/v2"
+)
+
+const apiBase = "https://alidocs.dingtalk.com"
+
+func (d *AliDoc) request(ctx context.Context) *resty.Request {
+	return d.client.R().
+		SetContext(ctx).
+		SetHeader("Cookie", d.Cookie).
+		SetHeader("Accept", "application/json, text/plain, */*").
+		SetHeader("Referer", apiBase+"/").
+		SetHeader("Origin", apiBase)
+}
+
+func msToTime(v int64) time.Time {
+	if v <= 0 {
+		return time.Time{}
+	}
+	return time.UnixMilli(v)
+}
+
+func checkResp(resp *resty.Response, result apiResp) error {
+	if resp != nil && resp.IsError() {
+		if msg := result.ErrMessage(); msg != "" {
+			return fmt.Errorf("%s", msg)
+		}
+		return fmt.Errorf("http error: %d", resp.StatusCode())
+	}
+	if !result.IsSuccess || result.Status != 200 {
+		msg := result.ErrMessage()
+		if msg == "" {
+			msg = "request failed"
+		}
+		return fmt.Errorf("%s", msg)
+	}
+	return nil
+}
+
+func toObj(item dentry) model.Obj {
+	return &model.Object{
+		ID:       item.DentryUUID,
+		Name:     item.Name,
+		Size:     item.FileSize,
+		Modified: msToTime(item.UpdatedTime),
+		Ctime:    msToTime(item.CreatedTime),
+		IsFolder: item.DentryType == "folder",
+	}
+}
+
+func firstDownloadURL(resp downloadResp) (string, error) {
+	if len(resp.Data.OSSURLPreSignatureInfo.PreSignURLs) == 0 {
+		return "", fmt.Errorf("empty download url")
+	}
+	return resp.Data.OSSURLPreSignatureInfo.PreSignURLs[0], nil
+}
+
+func newClient() *resty.Client {
+	client := base.NewRestyClient()
+	client.SetHeader("User-Agent", base.UserAgent)
+	return client
+}
+
+func (d *AliDoc) post(ctx context.Context, path string, body interface{}) error {
+	var result apiResp
+	resp, err := d.request(ctx).
+		SetBody(body).
+		SetResult(&result).
+		SetError(&result).
+		Post(apiBase + path)
+	if err != nil {
+		return err
+	}
+	return checkResp(resp, result)
+}
+
+func (d *AliDoc) checkCookie(ctx context.Context) error {
+	var result apiResp
+	resp, err := d.request(ctx).
+		SetResult(&result).
+		SetError(&result).
+		Get(apiBase + "/portal/api/v1/mine/info")
+	if err != nil {
+		return err
+	}
+	return checkResp(resp, result)
+}
+
+func (d *AliDoc) list(ctx context.Context, dentryUUID string) ([]dentry, error) {
+	var result listResp
+	resp, err := d.request(ctx).
+		SetQueryParam("dentryUuid", dentryUUID).
+		SetQueryParam("withParentAncestors", "true").
+		SetQueryParam("orderType", "SORT_KEY").
+		SetQueryParam("sortType", "desc").
+		SetQueryParam("listDentrySource", "2").
+		SetQueryParam("pageSize", "1000").
+		SetResult(&result).
+		SetError(&result).
+		Get(apiBase + "/box/api/v2/dentry/list")
+	if err != nil {
+		return nil, err
+	}
+	if err := checkResp(resp, result.apiResp); err != nil {
+		return nil, err
+	}
+	return result.Data.Children, nil
+}
+
+func (d *AliDoc) download(ctx context.Context, dentryUUID string) (downloadResp, error) {
+	var result downloadResp
+	resp, err := d.request(ctx).
+		SetQueryParam("dentryUuid", dentryUUID).
+		SetQueryParam("version", "1").
+		SetQueryParam("supportDownloadTypes", "URL_PRE_SIGNATURE,HTTP_TO_CENTER").
+		SetQueryParam("downloadType", "URL_PRE_SIGNATURE").
+		SetResult(&result).
+		SetError(&result).
+		Get(apiBase + "/box/api/v2/file/download")
+	if err != nil {
+		return result, err
+	}
+	if err := checkResp(resp, result.apiResp); err != nil {
+		return result, err
+	}
+	return result, nil
+}
@@ -95,6 +95,7 @@ func (d *AListV3) List(ctx context.Context, dir model.Obj, args model.ListArgs)
 		file := model.ObjThumb{
 			Object: model.Object{
 				Name:     f.Name,
+				Path:     path.Join(dir.GetPath(), f.Name),
 				Modified: f.Modified,
 				Ctime:    f.Created,
 				Size:     f.Size,
@@ -0,0 +1,65 @@
+package alist_v3
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/OpenListTeam/OpenList/v4/drivers/base"
+	"github.com/OpenListTeam/OpenList/v4/internal/driver"
+	"github.com/OpenListTeam/OpenList/v4/internal/model"
+	"github.com/go-resty/resty/v2"
+)
+
+// TestListSetsChildPaths descends two levels the way op.Get does, feeding an
+// object from one listing back into List as dir. Without a Path on that object
+// the driver asks upstream for "", which a real server answers with its own
+// root -- hence the fake upstream's fallback, and the endless self-similar tree.
+func TestListSetsChildPaths(t *testing.T) {
+	tree := map[string][]ObjResp{
+		"/":               {{Name: "root-marker", IsDir: true}},
+		"/drive":          {{Name: "concerts", IsDir: true}},
+		"/drive/concerts": {{Name: "show.mkv"}},
+	}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var req ListReq
+		_ = json.NewDecoder(r.Body).Decode(&req)
+		content, ok := tree[req.Path]
+		if !ok {
+			content = tree["/"]
+		}
+		w.Header().Set("Content-Type", "application/json") // resty only unmarshals JSON
+		_ = json.NewEncoder(w).Encode(map[string]any{
+			"code": 200, "message": "success",
+			"data": map[string]any{"content": content, "total": len(content)},
+		})
+	}))
+	t.Cleanup(srv.Close)
+
+	// conf.Conf is nil outside a booted server, so base.InitClient() is unusable.
+	prev := base.RestyClient
+	base.RestyClient = resty.New().SetTimeout(5 * time.Second)
+	t.Cleanup(func() { base.RestyClient = prev })
+
+	d := &AListV3{Addition: Addition{
+		RootPath: driver.RootPath{RootFolderPath: "/drive"},
+		Address:  srv.URL,
+	}}
+	dir := model.Obj(&model.Object{Path: "/drive", IsFolder: true})
+	for _, want := range []string{"/drive/concerts", "/drive/concerts/show.mkv"} {
+		objs, err := d.List(context.Background(), dir, model.ListArgs{})
+		if err != nil {
+			t.Fatalf("List(%q): %v", dir.GetPath(), err)
+		}
+		if len(objs) != 1 {
+			t.Fatalf("List(%q) returned %d objects, want 1", dir.GetPath(), len(objs))
+		}
+		if got := objs[0].GetPath(); got != want {
+			t.Fatalf("child of %q has path %q, want %q", dir.GetPath(), got, want)
+		}
+		dir = objs[0]
+	}
+}
@@ -0,0 +1,295 @@
+package aliyundrive_open
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"math/rand/v2"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/OpenListTeam/OpenList/v4/internal/conf"
+	"github.com/OpenListTeam/OpenList/v4/internal/errs"
+	anet "github.com/OpenListTeam/OpenList/v4/internal/net"
+	"github.com/OpenListTeam/OpenList/v4/internal/stream"
+	"github.com/OpenListTeam/OpenList/v4/pkg/http_range"
+)
+
+const (
+	defaultCallbackConcurrency = 1
+	callbackAcquireTimeout     = time.Second
+	callbackRequestAttempts    = 3
+	callbackRetryBaseDelay     = 200 * time.Millisecond
+	callbackErrorBodyLimit     = 64 << 10
+)
+
+var callbackLimiters = struct {
+	sync.Mutex
+	byUser map[string]*callbackLimiter
+}{byUser: make(map[string]*callbackLimiter)}
+
+type callbackLimiter struct {
+	userID        string
+	mu            sync.Mutex
+	active        int
+	nextID        uint64
+	registrations map[uint64]int
+	changed       chan struct{}
+}
+
+type callbackRegistration struct {
+	limiter *callbackLimiter
+	id      uint64
+	once    sync.Once
+}
+
+type callbackPermit struct {
+	limiter *callbackLimiter
+	once    sync.Once
+}
+
+func normalizeCallbackConcurrency(limit int) int {
+	if limit <= 0 {
+		return defaultCallbackConcurrency
+	}
+	return limit
+}
+
+func registerCallbackLimiter(userID string, limit int) *callbackRegistration {
+	callbackLimiters.Lock()
+	defer callbackLimiters.Unlock()
+
+	limiter := callbackLimiters.byUser[userID]
+	if limiter == nil {
+		limiter = &callbackLimiter{
+			userID:        userID,
+			registrations: make(map[uint64]int),
+			changed:       make(chan struct{}),
+		}
+		callbackLimiters.byUser[userID] = limiter
+	}
+	limiter.mu.Lock()
+	limiter.nextID++
+	id := limiter.nextID
+	limiter.registrations[id] = normalizeCallbackConcurrency(limit)
+	limiter.signalLocked()
+	limiter.mu.Unlock()
+	return &callbackRegistration{limiter: limiter, id: id}
+}
+
+func (r *callbackRegistration) unregister() {
+	if r == nil || r.limiter == nil {
+		return
+	}
+	r.once.Do(func() {
+		callbackLimiters.Lock()
+		defer callbackLimiters.Unlock()
+		r.limiter.mu.Lock()
+		delete(r.limiter.registrations, r.id)
+		r.limiter.signalLocked()
+		if len(r.limiter.registrations) == 0 && r.limiter.active == 0 {
+			delete(callbackLimiters.byUser, r.limiter.userID)
+		}
+		r.limiter.mu.Unlock()
+	})
+}
+
+func (r *callbackRegistration) acquire(ctx context.Context) (*callbackPermit, error) {
+	if r == nil || r.limiter == nil {
+		return nil, errs.NewErr(errs.TemporaryCapacity, "callback limiter is unavailable")
+	}
+	if err := ctx.Err(); err != nil {
+		return nil, err
+	}
+	waitCtx, cancel := context.WithTimeout(ctx, callbackAcquireTimeout)
+	defer cancel()
+	for {
+		r.limiter.mu.Lock()
+		if r.limiter.active < r.limiter.limitLocked() {
+			r.limiter.active++
+			r.limiter.mu.Unlock()
+			return &callbackPermit{limiter: r.limiter}, nil
+		}
+		changed := r.limiter.changed
+		r.limiter.mu.Unlock()
+		select {
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		case <-waitCtx.Done():
+			if err := ctx.Err(); err != nil {
+				return nil, err
+			}
+			return nil, errs.NewErr(errs.TemporaryCapacity, "timed out waiting for callback admission")
+		case <-changed:
+		}
+	}
+}
+
+func (l *callbackLimiter) limitLocked() int {
+	limit := 0
+	for _, registered := range l.registrations {
+		if limit == 0 || registered < limit {
+			limit = registered
+		}
+	}
+	return limit
+}
+
+func (l *callbackLimiter) signalLocked() {
+	close(l.changed)
+	l.changed = make(chan struct{})
+}
+
+func (p *callbackPermit) release() {
+	if p == nil || p.limiter == nil {
+		return
+	}
+	p.once.Do(func() {
+		callbackLimiters.Lock()
+		defer callbackLimiters.Unlock()
+		p.limiter.mu.Lock()
+		p.limiter.active--
+		p.limiter.signalLocked()
+		if len(p.limiter.registrations) == 0 && p.limiter.active == 0 {
+			delete(callbackLimiters.byUser, p.limiter.userID)
+		}
+		p.limiter.mu.Unlock()
+	})
+}
+
+func (d *AliyundriveOpen) callbackRegistration() *callbackRegistration {
+	if d.callback != nil {
+		return d.callback
+	}
+	if d.ref != nil {
+		return d.ref.callbackRegistration()
+	}
+	return nil
+}
+
+func (d *AliyundriveOpen) callbackRangeReader(url string, size int64) stream.RangeReaderFunc {
+	return func(ctx context.Context, requested http_range.Range) (io.ReadCloser, error) {
+		if requested.Length < 0 || requested.Start+requested.Length > size {
+			requested.Length = size - requested.Start
+		}
+		for attempt := 0; attempt < callbackRequestAttempts; attempt++ {
+			permit, err := d.callbackRegistration().acquire(ctx)
+			if err != nil {
+				return nil, err
+			}
+			body, retry, err := openCallbackRange(ctx, url, size, requested)
+			if !retry && err == nil {
+				return newCallbackBody(ctx, body, permit.release), nil
+			}
+			permit.release()
+			if !retry {
+				return nil, err
+			}
+			if attempt+1 == callbackRequestAttempts {
+				return nil, errs.NewErr(errs.TemporaryCapacity, "Aliyun callback concurrency limit rejected %d attempts", callbackRequestAttempts)
+			}
+			delay := callbackRetryBaseDelay << attempt
+			delay += time.Duration(rand.Int64N(int64(delay / 2)))
+			timer := time.NewTimer(delay)
+			select {
+			case <-ctx.Done():
+				timer.Stop()
+				return nil, ctx.Err()
+			case <-timer.C:
+			}
+		}
+		return nil, errs.NewErr(errs.TemporaryCapacity, "callback attempts exhausted")
+	}
+}
+
+func openCallbackRange(ctx context.Context, url string, size int64, requested http_range.Range) (io.ReadCloser, bool, error) {
+	requestHeader, _ := ctx.Value(conf.RequestHeaderKey).(http.Header)
+	header := anet.ProcessHeader(requestHeader, nil)
+	header = http_range.ApplyRangeToHttpHeader(requested, header)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return nil, false, fmt.Errorf("create Aliyun callback request: %w", err)
+	}
+	req.Header = header
+	response, err := anet.HttpClient().Do(req)
+	if err != nil {
+		return nil, false, fmt.Errorf("Aliyun callback request failed: %w", err)
+	}
+	if response.StatusCode >= http.StatusBadRequest {
+		defer response.Body.Close()
+		body, readErr := io.ReadAll(io.LimitReader(response.Body, callbackErrorBodyLimit))
+		if readErr != nil {
+			return nil, false, fmt.Errorf("read Aliyun callback error response: %w", readErr)
+		}
+		if isCallbackCapacityRejection(response.StatusCode, body) {
+			return nil, true, nil
+		}
+		message := strings.ReplaceAll(strings.TrimSpace(string(body)), url, "<redacted>")
+		return nil, false, fmt.Errorf("Aliyun callback request failed: %w; response: %s", anet.HttpStatusCodeError(response.StatusCode), message)
+	}
+	if requested.Start == 0 && requested.Length == size || response.StatusCode == http.StatusPartialContent || callbackContentRangeStartsAt(response.Header, requested.Start) {
+		return response.Body, false, nil
+	}
+	if response.StatusCode == http.StatusOK {
+		body, rangeErr := anet.GetRangedHttpReader(response.Body, requested.Start, requested.Length)
+		if rangeErr != nil {
+			response.Body.Close()
+			return nil, false, rangeErr
+		}
+		return body, false, nil
+	}
+	return response.Body, false, nil
+}
+
+func isCallbackCapacityRejection(status int, body []byte) bool {
+	return status == http.StatusForbidden &&
+		strings.Contains(string(body), "RequestDeniedByCallback") &&
+		strings.Contains(string(body), "ExceedMaxConcurrency")
+}
+
+func callbackContentRangeStartsAt(header http.Header, offset int64) bool {
+	start, _, err := http_range.ParseContentRange(header.Get("Content-Range"))
+	return err == nil && start == offset
+}
+
+type callbackBody struct {
+	body    io.ReadCloser
+	release func()
+	once    sync.Once
+	mu      sync.Mutex
+	stop    func() bool
+}
+
+func newCallbackBody(ctx context.Context, body io.ReadCloser, release func()) *callbackBody {
+	b := &callbackBody{body: body, release: release}
+	stop := context.AfterFunc(ctx, func() { _ = b.Close() })
+	b.mu.Lock()
+	b.stop = stop
+	b.mu.Unlock()
+	return b
+}
+
+func (b *callbackBody) Read(p []byte) (int, error) {
+	n, err := b.body.Read(p)
+	if err != nil {
+		_ = b.Close()
+	}
+	return n, err
+}
+
+func (b *callbackBody) Close() error {
+	var err error
+	b.once.Do(func() {
+		b.mu.Lock()
+		stop := b.stop
+		b.mu.Unlock()
+		if stop != nil {
+			stop()
+		}
+		err = b.body.Close()
+		b.release()
+	})
+	return err
+}
@@ -0,0 +1,365 @@
+package aliyundrive_open
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/OpenListTeam/OpenList/v4/drivers/base"
+	"github.com/OpenListTeam/OpenList/v4/internal/conf"
+	"github.com/OpenListTeam/OpenList/v4/internal/errs"
+	"github.com/OpenListTeam/OpenList/v4/internal/model"
+	"github.com/OpenListTeam/OpenList/v4/internal/stream"
+	"github.com/OpenListTeam/OpenList/v4/pkg/http_range"
+)
+
+func TestLinkSeparatesRedirectAndProxyRepresentations(t *testing.T) {
+	oldConf := conf.Conf
+	conf.Conf = &conf.Config{}
+	t.Cleanup(func() { conf.Conf = oldConf })
+	base.InitClient()
+
+	var server *httptest.Server
+	server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/adrive/v1.0/user/getDriveInfo":
+			_, _ = fmt.Fprint(w, `{"user_id":"user-1","resource_drive_id":"drive-1"}`)
+		case "/adrive/v1.0/openFile/getDownloadUrl":
+			_, _ = fmt.Fprintf(w, `{"url":%q}`, server.URL+"/callback")
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+
+	oldAPIURL := API_URL
+	API_URL = server.URL
+	defer func() { API_URL = oldAPIURL }()
+
+	d := &AliyundriveOpen{Addition: Addition{AccessToken: "token"}}
+	if err := d.Init(t.Context()); err != nil {
+		t.Fatal(err)
+	}
+	defer d.Drop(context.Background())
+	if d.CallbackConcurrency != defaultCallbackConcurrency {
+		t.Fatalf("normalized callback concurrency = %d, want %d", d.CallbackConcurrency, defaultCallbackConcurrency)
+	}
+
+	link, err := d.Link(t.Context(), &model.Object{ID: "file-1", Name: "file", Size: 1}, model.LinkArgs{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if link.RangeReader == nil {
+		t.Fatal("proxy link must own callback acquisition through a range reader")
+	}
+	if _, ok := link.RangeReader.(stream.RateLimitRangeReaderFunc); !ok {
+		t.Fatalf("proxy range reader type = %T, want server-rate-limited reader", link.RangeReader)
+	}
+	direct, err := d.Link(t.Context(), &model.Object{ID: "file-1", Name: "file", Size: 1}, model.LinkArgs{Redirect: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if direct.URL == "" || direct.RangeReader != nil {
+		t.Fatal("redirect link must remain URL-only")
+	}
+}
+
+func TestCallbackRangeHoldsPermitUntilBodyClose(t *testing.T) {
+	oldConf := conf.Conf
+	conf.Conf = &conf.Config{}
+	t.Cleanup(func() { conf.Conf = oldConf })
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Length", "1")
+		w.Header().Set("Content-Range", "bytes 0-0/1")
+		w.WriteHeader(http.StatusPartialContent)
+		_, _ = io.WriteString(w, "x")
+	}))
+	defer server.Close()
+
+	registration := registerCallbackLimiter(t.Name(), 1)
+	t.Cleanup(registration.unregister)
+	d := &AliyundriveOpen{callback: registration}
+	body, err := d.callbackRangeReader(server.URL, 1).RangeRead(t.Context(), http_range.Range{Length: 1})
+	if err != nil {
+		t.Fatal(err)
+	}
+	registration.limiter.mu.Lock()
+	active := registration.limiter.active
+	registration.limiter.mu.Unlock()
+	if active != 1 {
+		t.Fatalf("active callback bodies = %d, want 1", active)
+	}
+	if err := body.Close(); err != nil {
+		t.Fatal(err)
+	}
+	registration.limiter.mu.Lock()
+	active = registration.limiter.active
+	registration.limiter.mu.Unlock()
+	if active != 0 {
+		t.Fatalf("active callback bodies after Close = %d, want 0", active)
+	}
+}
+
+func TestCallbackLimiterUsesMinimumRegisteredLimit(t *testing.T) {
+	firstRegistration := registerCallbackLimiter(t.Name(), 2)
+	t.Cleanup(firstRegistration.unregister)
+	first, err := firstRegistration.acquire(t.Context())
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := firstRegistration.acquire(t.Context())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer first.release()
+	defer second.release()
+
+	lowerRegistration := registerCallbackLimiter(t.Name(), 1)
+	t.Cleanup(lowerRegistration.unregister)
+	acquired := make(chan *callbackPermit, 1)
+	go func() {
+		permit, acquireErr := lowerRegistration.acquire(t.Context())
+		if acquireErr == nil {
+			acquired <- permit
+		}
+	}()
+
+	first.release()
+	select {
+	case permit := <-acquired:
+		permit.release()
+		t.Fatal("lowering the shared limit must wait for all excess bodies to drain")
+	case <-time.After(100 * time.Millisecond):
+	}
+	second.release()
+	select {
+	case permit := <-acquired:
+		permit.release()
+	case <-time.After(time.Second):
+		t.Fatal("admission did not resume after active bodies drained below the new limit")
+	}
+}
+
+func TestCallbackLimiterSeparatesUsers(t *testing.T) {
+	firstUser := registerCallbackLimiter(t.Name()+"-first", 1)
+	secondUser := registerCallbackLimiter(t.Name()+"-second", 1)
+	t.Cleanup(firstUser.unregister)
+	t.Cleanup(secondUser.unregister)
+	first, err := firstUser.acquire(t.Context())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer first.release()
+	second, err := secondUser.acquire(t.Context())
+	if err != nil {
+		t.Fatalf("independent user was blocked: %v", err)
+	}
+	second.release()
+}
+
+func TestCallbackLimiterReconfigureWaitsForOldBodies(t *testing.T) {
+	userID := t.Name()
+	oldRegistration := registerCallbackLimiter(userID, 2)
+	first, err := oldRegistration.acquire(t.Context())
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := oldRegistration.acquire(t.Context())
+	if err != nil {
+		t.Fatal(err)
+	}
+	oldRegistration.unregister()
+
+	newRegistration := registerCallbackLimiter(userID, 1)
+	t.Cleanup(newRegistration.unregister)
+	acquired := make(chan *callbackPermit, 1)
+	go func() {
+		permit, acquireErr := newRegistration.acquire(t.Context())
+		if acquireErr == nil {
+			acquired <- permit
+		}
+	}()
+	first.release()
+	select {
+	case permit := <-acquired:
+		permit.release()
+		t.Fatal("reconfigured limiter admitted while an old body still occupied the new limit")
+	case <-time.After(100 * time.Millisecond):
+	}
+	second.release()
+	select {
+	case permit := <-acquired:
+		permit.release()
+	case <-time.After(time.Second):
+		t.Fatal("reconfigured limiter did not admit after old bodies drained")
+	}
+}
+
+func TestCallbackLimiterDistinguishesTimeoutAndCancellation(t *testing.T) {
+	registration := registerCallbackLimiter(t.Name(), 1)
+	t.Cleanup(registration.unregister)
+	permit, err := registration.acquire(t.Context())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer permit.release()
+
+	started := time.Now()
+	_, err = registration.acquire(t.Context())
+	if !errors.Is(err, errs.TemporaryCapacity) {
+		t.Fatalf("admission timeout error = %v, want TemporaryCapacity", err)
+	}
+	if time.Since(started) < callbackAcquireTimeout {
+		t.Fatal("admission timed out before the configured wait elapsed")
+	}
+
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+	_, err = registration.acquire(ctx)
+	if !errors.Is(err, context.Canceled) || errors.Is(err, errs.TemporaryCapacity) {
+		t.Fatalf("canceled admission error = %v, want only context.Canceled", err)
+	}
+}
+
+func TestCallbackCapacityRejectionRequiresBothExactMarkers(t *testing.T) {
+	tests := []struct {
+		name string
+		body string
+		want bool
+	}{
+		{name: "both", body: `{"code":"RequestDeniedByCallback","message":"ExceedMaxConcurrency"}`, want: true},
+		{name: "code only", body: `{"code":"RequestDeniedByCallback"}`},
+		{name: "message only", body: `{"message":"ExceedMaxConcurrency"}`},
+		{name: "case differs", body: `{"code":"requestdeniedbycallback","message":"ExceedMaxConcurrency"}`},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if got := isCallbackCapacityRejection(http.StatusForbidden, []byte(test.body)); got != test.want {
+				t.Fatalf("classification = %v, want %v", got, test.want)
+			}
+		})
+	}
+	if isCallbackCapacityRejection(http.StatusTooManyRequests, []byte(`RequestDeniedByCallback ExceedMaxConcurrency`)) {
+		t.Fatal("non-403 response must not be classified as callback capacity")
+	}
+}
+
+func TestCallbackRangeRetriesOnlyVerifiedCapacityRejections(t *testing.T) {
+	var requests atomic.Int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		requests.Add(1)
+		w.WriteHeader(http.StatusForbidden)
+		_, _ = io.WriteString(w, `{"code":"RequestDeniedByCallback","message":"ExceedMaxConcurrency"}`)
+	}))
+	defer server.Close()
+
+	registration := registerCallbackLimiter(t.Name(), 1)
+	t.Cleanup(registration.unregister)
+	d := &AliyundriveOpen{callback: registration}
+	_, err := d.callbackRangeReader(server.URL+"?token=secret", 1).RangeRead(t.Context(), http_range.Range{Length: 1})
+	if !errors.Is(err, errs.TemporaryCapacity) {
+		t.Fatalf("verified rejection error = %v, want TemporaryCapacity", err)
+	}
+	if requests.Load() != callbackRequestAttempts {
+		t.Fatalf("requests = %d, want %d", requests.Load(), callbackRequestAttempts)
+	}
+	if strings.Contains(err.Error(), "secret") {
+		t.Fatal("capacity error leaked the signed callback URL")
+	}
+	permit, acquireErr := registration.acquire(t.Context())
+	if acquireErr != nil {
+		t.Fatalf("capacity retries leaked admission: %v", acquireErr)
+	}
+	permit.release()
+
+	requests.Store(0)
+	permanent := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		requests.Add(1)
+		w.WriteHeader(http.StatusForbidden)
+		_, _ = io.WriteString(w, `{"code":"RequestDeniedByCallback","message":"denied"}`)
+	}))
+	defer permanent.Close()
+	_, err = d.callbackRangeReader(permanent.URL+"?token=secret", 1).RangeRead(t.Context(), http_range.Range{Length: 1})
+	if errors.Is(err, errs.TemporaryCapacity) {
+		t.Fatalf("permanent 403 error = %v, must not be TemporaryCapacity", err)
+	}
+	if requests.Load() != 1 {
+		t.Fatalf("permanent 403 requests = %d, want 1", requests.Load())
+	}
+	if strings.Contains(err.Error(), "secret") {
+		t.Fatal("permanent error leaked the signed callback URL")
+	}
+}
+
+type countingReadCloser struct {
+	reader io.Reader
+	closed atomic.Int32
+}
+
+func (r *countingReadCloser) Read(p []byte) (int, error) { return r.reader.Read(p) }
+func (r *countingReadCloser) Close() error {
+	r.closed.Add(1)
+	return nil
+}
+
+func TestCallbackBodyReleasesExactlyOnce(t *testing.T) {
+	underlying := &countingReadCloser{reader: strings.NewReader("x")}
+	var released atomic.Int32
+	body := newCallbackBody(t.Context(), underlying, func() { released.Add(1) })
+	_, _ = io.ReadAll(body)
+	if err := body.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if err := body.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if underlying.closed.Load() != 1 || released.Load() != 1 {
+		t.Fatalf("close count = %d, release count = %d; want 1, 1", underlying.closed.Load(), released.Load())
+	}
+}
+
+type failingReadCloser struct {
+	closed atomic.Int32
+}
+
+func (*failingReadCloser) Read([]byte) (int, error) { return 0, errors.New("read failed") }
+func (r *failingReadCloser) Close() error {
+	r.closed.Add(1)
+	return nil
+}
+
+func TestCallbackBodyReadFailureReleasesPermit(t *testing.T) {
+	underlying := &failingReadCloser{}
+	var released atomic.Int32
+	body := newCallbackBody(t.Context(), underlying, func() { released.Add(1) })
+	if _, err := body.Read(make([]byte, 1)); err == nil {
+		t.Fatal("read unexpectedly succeeded")
+	}
+	if underlying.closed.Load() != 1 || released.Load() != 1 {
+		t.Fatalf("close count = %d, release count = %d; want 1, 1", underlying.closed.Load(), released.Load())
+	}
+}
+
+func TestCallbackBodyCancellationReleasesPermit(t *testing.T) {
+	ctx, cancel := context.WithCancel(t.Context())
+	underlying := &countingReadCloser{reader: strings.NewReader("x")}
+	released := make(chan struct{}, 1)
+	_ = newCallbackBody(ctx, underlying, func() { released <- struct{}{} })
+	cancel()
+	select {
+	case <-released:
+	case <-time.After(time.Second):
+		t.Fatal("context cancellation did not release callback admission")
+	}
+	if underlying.closed.Load() != 1 {
+		t.Fatalf("underlying close count = %d, want 1", underlying.closed.Load())
+	}
+}
@@ -11,6 +11,7 @@ import (
 	"github.com/OpenListTeam/OpenList/v4/internal/driver"
 	"github.com/OpenListTeam/OpenList/v4/internal/errs"
 	"github.com/OpenListTeam/OpenList/v4/internal/model"
+	"github.com/OpenListTeam/OpenList/v4/internal/stream"
 	"github.com/OpenListTeam/OpenList/v4/pkg/utils"
 	"github.com/go-resty/resty/v2"
 	log "github.com/sirupsen/logrus"
@@ -22,8 +23,9 @@ type AliyundriveOpen struct {

 	DriveId string

-	limiter *limiter
-	ref     *AliyundriveOpen
+	limiter  *limiter
+	ref      *AliyundriveOpen
+	callback *callbackRegistration
 }

 func (d *AliyundriveOpen) Config() driver.Config {
@@ -35,6 +37,7 @@ func (d *AliyundriveOpen) GetAddition() driver.Additional {
 }

 func (d *AliyundriveOpen) Init(ctx context.Context) error {
+	d.CallbackConcurrency = normalizeCallbackConcurrency(d.CallbackConcurrency)
 	d.limiter = getLimiterForUser(globalLimiterUserID) // First create a globally shared limiter to limit the initial requests.
 	if d.LIVPDownloadFormat == "" {
 		d.LIVPDownloadFormat = "jpeg"
@@ -52,6 +55,7 @@ func (d *AliyundriveOpen) Init(ctx context.Context) error {
 	userid := utils.Json.Get(res, "user_id").ToString()
 	d.limiter.free()
 	d.limiter = getLimiterForUser(userid) // Allocate a corresponding limiter for each user.
+	d.callback = registerCallbackLimiter(userid, d.CallbackConcurrency)
 	return nil
 }

@@ -65,6 +69,10 @@ func (d *AliyundriveOpen) InitReference(storage driver.Driver) error {
 }

 func (d *AliyundriveOpen) Drop(ctx context.Context) error {
+	if d.callback != nil {
+		d.callback.unregister()
+		d.callback = nil
+	}
 	d.limiter.free()
 	d.limiter = nil
 	d.ref = nil
@@ -119,10 +127,16 @@ func (d *AliyundriveOpen) Link(ctx context.Context, file model.Obj, args model.L
 		url = utils.Json.Get(res, "streamsUrl", d.LIVPDownloadFormat).ToString()
 	}
 	exp := time.Minute
-	return &model.Link{
+	link := &model.Link{
 		URL:        url,
 		Expiration: &exp,
-	}, nil
+	}
+	if args.Redirect {
+		return link, nil
+	}
+	link.URL = ""
+	link.RangeReader = stream.RateLimitRangeReaderFunc(d.callbackRangeReader(url, file.GetSize()))
+	return link, nil
 }

 func (d *AliyundriveOpen) MakeDir(ctx context.Context, parentDir model.Obj, dirName string) (model.Obj, error) {
@@ -8,19 +8,20 @@ import (
 type Addition struct {
 	DriveType string `json:"drive_type" type:"select" options:"default,resource,backup" default:"resource"`
 	driver.RootID
-	RefreshToken       string `json:"refresh_token" required:"true"`
-	OrderBy            string `json:"order_by" type:"select" options:"name,size,updated_at,created_at"`
-	OrderDirection     string `json:"order_direction" type:"select" options:"ASC,DESC"`
-	UseOnlineAPI       bool   `json:"use_online_api" default:"true"`
-	AlipanType         string `json:"alipan_type" required:"true" type:"select" default:"default" options:"default,alipanTV"`
-	APIAddress         string `json:"api_url_address" default:"https://api.oplist.org/alicloud/renewapi"`
-	ClientID           string `json:"client_id" help:"Keep it empty if you don't have one"`
-	ClientSecret       string `json:"client_secret" help:"Keep it empty if you don't have one"`
-	RemoveWay          string `json:"remove_way" required:"true" type:"select" options:"trash,delete"`
-	RapidUpload        bool   `json:"rapid_upload" help:"If you enable this option, the file will be uploaded to the server first, so the progress will be incorrect"`
-	InternalUpload     bool   `json:"internal_upload" help:"If you are using Aliyun ECS is located in Beijing, you can turn it on to boost the upload speed"`
-	LIVPDownloadFormat string `json:"livp_download_format" type:"select" options:"jpeg,mov" default:"jpeg"`
-	AccessToken        string
+	RefreshToken        string `json:"refresh_token" required:"true"`
+	OrderBy             string `json:"order_by" type:"select" options:"name,size,updated_at,created_at"`
+	OrderDirection      string `json:"order_direction" type:"select" options:"ASC,DESC"`
+	UseOnlineAPI        bool   `json:"use_online_api" default:"true"`
+	AlipanType          string `json:"alipan_type" required:"true" type:"select" default:"default" options:"default,alipanTV"`
+	APIAddress          string `json:"api_url_address" default:"https://api.oplist.org/alicloud/renewapi"`
+	ClientID            string `json:"client_id" help:"Keep it empty if you don't have one"`
+	ClientSecret        string `json:"client_secret" help:"Keep it empty if you don't have one"`
+	RemoveWay           string `json:"remove_way" required:"true" type:"select" options:"trash,delete"`
+	RapidUpload         bool   `json:"rapid_upload" help:"If you enable this option, the file will be uploaded to the server first, so the progress will be incorrect"`
+	InternalUpload      bool   `json:"internal_upload" help:"If you are using Aliyun ECS is located in Beijing, you can turn it on to boost the upload speed"`
+	LIVPDownloadFormat  string `json:"livp_download_format" type:"select" options:"jpeg,mov" default:"jpeg"`
+	CallbackConcurrency int    `json:"callback_concurrency" type:"number" default:"1" help:"Maximum active proxied downloads shared by Aliyun user"`
+	AccessToken         string
 }

 var config = driver.Config{
@@ -13,6 +13,7 @@ import (
 	_ "github.com/OpenListTeam/OpenList/v4/drivers/189_tv"
 	_ "github.com/OpenListTeam/OpenList/v4/drivers/189pc"
 	_ "github.com/OpenListTeam/OpenList/v4/drivers/alias"
+	_ "github.com/OpenListTeam/OpenList/v4/drivers/alidoc"
 	_ "github.com/OpenListTeam/OpenList/v4/drivers/alist_v3"
 	_ "github.com/OpenListTeam/OpenList/v4/drivers/aliyundrive"
 	_ "github.com/OpenListTeam/OpenList/v4/drivers/aliyundrive_open"
@@ -21,8 +22,10 @@ import (
 	_ "github.com/OpenListTeam/OpenList/v4/drivers/azure_blob"
 	_ "github.com/OpenListTeam/OpenList/v4/drivers/baidu_netdisk"
 	_ "github.com/OpenListTeam/OpenList/v4/drivers/baidu_photo"
+	_ "github.com/OpenListTeam/OpenList/v4/drivers/bunny_storage"
 	_ "github.com/OpenListTeam/OpenList/v4/drivers/chaoxing"
 	_ "github.com/OpenListTeam/OpenList/v4/drivers/chunk"
+	_ "github.com/OpenListTeam/OpenList/v4/drivers/cloudflare_imgbed"
 	_ "github.com/OpenListTeam/OpenList/v4/drivers/cloudreve"
 	_ "github.com/OpenListTeam/OpenList/v4/drivers/cloudreve_v4"
 	_ "github.com/OpenListTeam/OpenList/v4/drivers/cnb_releases"
@@ -32,12 +35,14 @@ import (
 	_ "github.com/OpenListTeam/OpenList/v4/drivers/doubao_new"
 	_ "github.com/OpenListTeam/OpenList/v4/drivers/doubao_share"
 	_ "github.com/OpenListTeam/OpenList/v4/drivers/dropbox"
+	_ "github.com/OpenListTeam/OpenList/v4/drivers/emby"
 	_ "github.com/OpenListTeam/OpenList/v4/drivers/febbox"
 	_ "github.com/OpenListTeam/OpenList/v4/drivers/ftp"
 	_ "github.com/OpenListTeam/OpenList/v4/drivers/github"
 	_ "github.com/OpenListTeam/OpenList/v4/drivers/github_releases"
 	_ "github.com/OpenListTeam/OpenList/v4/drivers/google_drive"
 	_ "github.com/OpenListTeam/OpenList/v4/drivers/google_photo"
+	_ "github.com/OpenListTeam/OpenList/v4/drivers/guangyapan"
 	_ "github.com/OpenListTeam/OpenList/v4/drivers/halalcloud"
 	_ "github.com/OpenListTeam/OpenList/v4/drivers/halalcloud_open"
 	_ "github.com/OpenListTeam/OpenList/v4/drivers/ilanzou"
@@ -2,6 +2,7 @@ package azure_blob

 import (
 	"context"
+	"encoding/hex"
 	"fmt"
 	"io"
 	"path"
@@ -12,10 +13,13 @@ import (
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
 	"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob"
+	"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/blob"
 	"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/container"
 	"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/sas"
 	"github.com/OpenListTeam/OpenList/v4/internal/driver"
 	"github.com/OpenListTeam/OpenList/v4/internal/model"
+	"github.com/OpenListTeam/OpenList/v4/pkg/utils"
+	log "github.com/sirupsen/logrus"
 )

 // Azure Blob Storage based on the blob APIs
@@ -283,6 +287,26 @@ func (d *AzureBlob) Put(ctx context.Context, dstDir model.Obj, stream model.File
 	// Determine optimal upload options based on file size
 	options := optimizedUploadOptions(stream.GetSize())

+	// Preserve the file content type for direct Azure Blob downloads.
+	contentType := stream.GetMimetype()
+	if contentType == "" {
+		contentType = "application/octet-stream"
+	}
+	options.HTTPHeaders = &blob.HTTPHeaders{
+		BlobContentType: &contentType,
+	}
+
+	// Preserve the MD5 checksum when it is available.
+	md5Hex := stream.GetHash().GetHash(utils.MD5)
+	if md5Hex != "" {
+		md5, err := hex.DecodeString(md5Hex)
+		if err == nil && len(md5) == 16 {
+			options.HTTPHeaders.BlobContentMD5 = md5
+		} else {
+			log.Warnf("Invalid MD5 hash: %s, error: %v", md5Hex, err)
+		}
+	}
+
 	// Track upload progress
 	progressTracker := &progressTracker{
 		total:          stream.GetSize(),
@@ -215,11 +215,13 @@ func (d *BaiduNetdisk) linkOfficial(file model.Obj, _ model.LinkArgs) (*model.Li
 	u = res.Header().Get("location")
 	//}

+	exp := time.Hour
 	return &model.Link{
 		URL: u,
 		Header: http.Header{
 			"User-Agent": []string{"pan.baidu.com"},
 		},
+		Expiration: &exp,
 	}, nil
 }

@@ -72,7 +72,7 @@ func (c *File) Thumb() string {
 }

 func (c *File) GetHash() utils.HashInfo {
-	return utils.NewHashInfo(utils.MD5, DecryptMd5(c.Md5))
+	return utils.HashInfo{}
 }

 /*相册部分*/
@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"strconv"
 	"strings"
+	"time"
 	"unicode"

 	"github.com/OpenListTeam/OpenList/v4/drivers/base"
@@ -411,12 +412,14 @@ func (d *BaiduPhoto) linkFile(ctx context.Context, file *File, args model.LinkAr
 	// }

 	// location := resp.Header().Get("Location")
+	exp := time.Hour
 	link := &model.Link{
 		URL: downloadUrl.Dlink,
 		Header: http.Header{
 			"User-Agent": []string{headers["User-Agent"]},
 			"Referer":    []string{"https://photo.baidu.com/"},
 		},
+		Expiration: &exp,
 	}
 	return link, nil
 }
@@ -0,0 +1,226 @@
+package bunny_storage
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"net/http"
+	"net/url"
+	stdpath "path"
+	"strings"
+	"time"
+
+	"github.com/OpenListTeam/OpenList/v4/drivers/base"
+	"github.com/OpenListTeam/OpenList/v4/internal/driver"
+	"github.com/OpenListTeam/OpenList/v4/internal/errs"
+	"github.com/OpenListTeam/OpenList/v4/internal/model"
+	"github.com/go-resty/resty/v2"
+)
+
+type BunnyStorage struct {
+	model.Storage
+	Addition
+	client   *resty.Client
+	endpoint *url.URL
+	cdnBase  *url.URL
+}
+
+func (d *BunnyStorage) Config() driver.Config {
+	cfg := config
+	if d.StorageZoneName != "" && d.CDNBaseURL == "" {
+		cfg.OnlyProxy = true
+		cfg.PreferProxy = true
+	}
+	if d.CDNTokenKey != "" && d.CDNTokenIncludeIP {
+		cfg.LinkCacheMode = driver.LinkCacheIP
+	}
+	return cfg
+}
+
+func (d *BunnyStorage) GetAddition() driver.Additional {
+	return &d.Addition
+}
+
+func (d *BunnyStorage) Init(ctx context.Context) error {
+	if d.RootFolderPath == "" {
+		d.RootFolderPath = "/"
+	}
+	if d.Endpoint == "" {
+		d.Endpoint = defaultEndpoint
+	}
+	if d.SignURLExpire <= 0 {
+		d.SignURLExpire = 4
+	}
+	if d.CDNTokenMethod == "" {
+		d.CDNTokenMethod = cdnTokenMethodSHA256
+	}
+	endpoint, err := normalizeBaseURL(d.Endpoint, defaultEndpoint)
+	if err != nil {
+		return fmt.Errorf("invalid endpoint: %w", err)
+	}
+	d.endpoint = endpoint
+	if d.CDNBaseURL != "" {
+		cdnBase, err := normalizeBaseURL(d.CDNBaseURL, "")
+		if err != nil {
+			return fmt.Errorf("invalid cdn_base_url: %w", err)
+		}
+		d.cdnBase = cdnBase
+	}
+	d.client = base.RestyClient
+	if d.client == nil {
+		d.client = base.NewRestyClient()
+	}
+	return nil
+}
+
+func (d *BunnyStorage) Drop(ctx context.Context) error {
+	return nil
+}
+
+func (d *BunnyStorage) List(ctx context.Context, dir model.Obj, args model.ListArgs) ([]model.Obj, error) {
+	var items []bunnyObject
+	resp, err := d.authRequest().
+		SetContext(ctx).
+		SetResult(&items).
+		Get(d.storageURL(dir.GetPath(), true))
+	if err != nil {
+		return nil, err
+	}
+	if err := d.handleResponseError(resp); err != nil {
+		return nil, err
+	}
+	result := make([]model.Obj, 0, len(items))
+	placeholder := d.placeholderName()
+	for _, item := range items {
+		if item.ObjectName == "" {
+			continue
+		}
+		if !args.S3ShowPlaceholder && !item.IsDirectory && item.ObjectName == placeholder {
+			continue
+		}
+		result = append(result, d.toObj(dir.GetPath(), item))
+	}
+	return result, nil
+}
+
+func (d *BunnyStorage) Link(ctx context.Context, file model.Obj, args model.LinkArgs) (*model.Link, error) {
+	if file.IsDir() {
+		return nil, errs.NotFile
+	}
+	cacheTTL := time.Duration(0)
+	if d.cdnBase != nil {
+		linkURL := d.cdnURL(d.cdnObjectPath(file.GetPath()))
+		link := &model.Link{
+			URL:           linkURL,
+			ContentLength: file.GetSize(),
+			Expiration:    &cacheTTL,
+		}
+		if d.CDNTokenKey != "" {
+			signedURL, _, err := d.signCDNURL(linkURL, args.IP)
+			if err != nil {
+				return nil, err
+			}
+			link.URL = signedURL
+		}
+		return link, nil
+	}
+	return &model.Link{
+		URL:           d.storageURL(file.GetPath(), false),
+		Header:        http.Header{"AccessKey": []string{d.AccessKey}},
+		ContentLength: file.GetSize(),
+		Expiration:    &cacheTTL,
+	}, nil
+}
+
+func (d *BunnyStorage) MakeDir(ctx context.Context, parentDir model.Obj, dirName string) (model.Obj, error) {
+	dirPath := stdpath.Join(parentDir.GetPath(), dirName)
+	placeholderPath := stdpath.Join(dirPath, d.placeholderName())
+	if err := d.putReader(ctx, placeholderPath, bytes.NewReader(nil), 0, "application/octet-stream", nil); err != nil {
+		return nil, err
+	}
+	now := time.Now()
+	return &model.Object{
+		Path:     dirPath,
+		Name:     dirName,
+		Modified: now,
+		Ctime:    now,
+		IsFolder: true,
+	}, nil
+}
+
+func (d *BunnyStorage) Remove(ctx context.Context, obj model.Obj) error {
+	resp, err := d.authRequest().
+		SetContext(ctx).
+		Delete(d.storageURL(obj.GetPath(), obj.IsDir()))
+	if err != nil {
+		return err
+	}
+	return d.handleResponseError(resp)
+}
+
+func (d *BunnyStorage) Put(ctx context.Context, dstDir model.Obj, file model.FileStreamer, up driver.UpdateProgress) (model.Obj, error) {
+	if up == nil {
+		up = func(float64) {}
+	}
+	dstPath := stdpath.Join(dstDir.GetPath(), file.GetName())
+	err := d.putReader(ctx, dstPath, driver.NewLimitedUploadStream(ctx, &driver.ReaderUpdatingProgress{
+		Reader:         file,
+		UpdateProgress: up,
+	}), file.GetSize(), file.GetMimetype(), nil)
+	if err != nil {
+		return nil, err
+	}
+	now := time.Now()
+	return &model.Object{
+		Path:     dstPath,
+		Name:     file.GetName(),
+		Size:     file.GetSize(),
+		Modified: now,
+		Ctime:    now,
+	}, nil
+}
+
+func (d *BunnyStorage) putReader(ctx context.Context, path string, body any, size int64, contentType string, extraHeaders http.Header) error {
+	if contentType == "" {
+		contentType = "application/octet-stream"
+	}
+	req := d.authRequest().
+		SetContext(ctx).
+		SetBody(body).
+		SetHeader("Content-Type", contentType)
+	if size >= 0 {
+		req.SetHeader("Content-Length", fmt.Sprint(size))
+	}
+	for key, values := range extraHeaders {
+		for _, value := range values {
+			req.SetHeader(key, value)
+		}
+	}
+	resp, err := req.Put(d.storageURL(path, false))
+	if err != nil {
+		return err
+	}
+	return d.handleResponseError(resp)
+}
+
+func (d *BunnyStorage) Get(ctx context.Context, path string) (model.Obj, error) {
+	fullPath := stdpath.Join(d.GetRootPath(), path)
+	parentPath, name := stdpath.Split(fullPath)
+	parentPath = strings.TrimSuffix(parentPath, "/")
+	if parentPath == "" {
+		parentPath = "/"
+	}
+	objs, err := d.List(ctx, &model.Object{Path: parentPath, IsFolder: true}, model.ListArgs{S3ShowPlaceholder: true})
+	if err != nil {
+		return nil, err
+	}
+	for _, obj := range objs {
+		if obj.GetName() == name {
+			return obj, nil
+		}
+	}
+	return nil, errs.ObjectNotFound
+}
+
+var _ driver.Driver = (*BunnyStorage)(nil)
+var _ driver.Getter = (*BunnyStorage)(nil)
@@ -0,0 +1,32 @@
+package bunny_storage
+
+import (
+	"github.com/OpenListTeam/OpenList/v4/internal/driver"
+	"github.com/OpenListTeam/OpenList/v4/internal/op"
+)
+
+type Addition struct {
+	driver.RootPath
+	StorageZoneName   string `json:"storage_zone_name" required:"true"`
+	AccessKey         string `json:"access_key" required:"true"`
+	Endpoint          string `json:"endpoint" required:"true" default:"storage.bunnycdn.com"`
+	CDNBaseURL        string `json:"cdn_base_url"`
+	CDNTokenKey       string `json:"cdn_token_key"`
+	CDNTokenMethod    string `json:"cdn_token_method" type:"select" options:"sha256,hmac_sha256" default:"sha256"`
+	CDNTokenIncludeIP bool   `json:"cdn_token_include_ip" default:"false"`
+	SignURLExpire     int    `json:"sign_url_expire" type:"number" default:"4"`
+	Placeholder       string `json:"placeholder" default:".openlist"`
+}
+
+var config = driver.Config{
+	Name:        "Bunny Storage",
+	LocalSort:   true,
+	DefaultRoot: "/",
+	CheckStatus: true,
+}
+
+func init() {
+	op.RegisterDriver(func() driver.Driver {
+		return &BunnyStorage{}
+	})
+}
@@ -0,0 +1,27 @@
+package bunny_storage
+
+import "time"
+
+type bunnyObject struct {
+	Guid            string `json:"Guid"`
+	StorageZoneName string `json:"StorageZoneName"`
+	Path            string `json:"Path"`
+	ObjectName      string `json:"ObjectName"`
+	Length          int64  `json:"Length"`
+	LastChanged     string `json:"LastChanged"`
+	IsDirectory     bool   `json:"IsDirectory"`
+	ServerID        int    `json:"ServerId"`
+	UserID          string `json:"UserId"`
+	DateCreated     string `json:"DateCreated"`
+	StorageZoneID   int64  `json:"StorageZoneId"`
+}
+
+type apiError struct {
+	HttpCode int    `json:"HttpCode"`
+	Message  string `json:"Message"`
+}
+
+type parsedTimes struct {
+	modified time.Time
+	created  time.Time
+}
@@ -0,0 +1,275 @@
+package bunny_storage
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	stdpath "path"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/OpenListTeam/OpenList/v4/internal/errs"
+	"github.com/OpenListTeam/OpenList/v4/internal/model"
+	"github.com/go-resty/resty/v2"
+)
+
+const (
+	defaultEndpoint    = "storage.bunnycdn.com"
+	defaultPlaceholder = ".openlist"
+
+	cdnTokenMethodSHA256     = "sha256"
+	cdnTokenMethodHMACSHA256 = "hmac_sha256"
+)
+
+func normalizeBaseURL(raw string, fallback string) (*url.URL, error) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		raw = fallback
+	}
+	if raw == "" {
+		return nil, fmt.Errorf("empty url")
+	}
+	if !strings.Contains(raw, "://") {
+		raw = "https://" + raw
+	}
+	u, err := url.Parse(raw)
+	if err != nil {
+		return nil, err
+	}
+	if u.Host == "" {
+		return nil, fmt.Errorf("invalid url: %s", raw)
+	}
+	u.Path = strings.TrimRight(u.Path, "/")
+	return u, nil
+}
+
+func cleanObjectPath(path string) string {
+	if path == "" {
+		return "/"
+	}
+	return stdpath.Clean("/" + strings.TrimPrefix(path, "/"))
+}
+
+func stripObjectPathPrefix(path string, prefix string) (string, bool) {
+	path = cleanObjectPath(path)
+	prefix = cleanObjectPath(prefix)
+	if prefix == "/" {
+		return path, false
+	}
+	if path == prefix {
+		return "/", true
+	}
+	if strings.HasPrefix(path, prefix+"/") {
+		return cleanObjectPath(strings.TrimPrefix(path, prefix)), true
+	}
+	return path, false
+}
+
+func isObjectPathOrChild(path string, parent string) bool {
+	path = cleanObjectPath(path)
+	parent = cleanObjectPath(parent)
+	return path == parent || strings.HasPrefix(path, parent+"/")
+}
+
+func trimCDNBasePath(path string, mountPath string) string {
+	path = cleanObjectPath(path)
+	if path == "/" {
+		return ""
+	}
+	if stripped, ok := stripObjectPathPrefix(path, mountPath); ok {
+		path = stripped
+	}
+	if path == "/" {
+		return ""
+	}
+	return strings.TrimRight(path, "/")
+}
+
+func (d *BunnyStorage) cdnObjectPath(path string) string {
+	objectPath := cleanObjectPath(path)
+	if stripped, ok := stripObjectPathPrefix(objectPath, d.GetStorage().MountPath); ok {
+		objectPath = stripped
+	}
+	rootPath := cleanObjectPath(d.GetRootPath())
+	if rootPath != "/" && !isObjectPathOrChild(objectPath, rootPath) {
+		objectPath = cleanObjectPath(stdpath.Join(rootPath, objectPath))
+	}
+	return objectPath
+}
+
+func (d *BunnyStorage) placeholderName() string {
+	if d.Placeholder == "" {
+		return defaultPlaceholder
+	}
+	return d.Placeholder
+}
+
+func (d *BunnyStorage) storageURL(path string, dir bool) string {
+	u := *d.endpoint
+	cleanPath := cleanObjectPath(path)
+	zone := strings.Trim(d.StorageZoneName, "/")
+	if cleanPath == "/" {
+		u.Path = "/" + zone + "/"
+		return u.String()
+	}
+	u.Path = "/" + zone + "/" + strings.TrimPrefix(cleanPath, "/")
+	if dir && !strings.HasSuffix(u.Path, "/") {
+		u.Path += "/"
+	}
+	return u.String()
+}
+
+func (d *BunnyStorage) cdnURL(path string) string {
+	u := *d.cdnBase
+	cleanPath := cleanObjectPath(path)
+	basePath := trimCDNBasePath(u.Path, d.GetStorage().MountPath)
+	if cleanPath == "/" {
+		if basePath == "" {
+			u.Path = "/"
+		} else {
+			u.Path = basePath + "/"
+		}
+		return u.String()
+	}
+	u.Path = basePath + "/" + strings.TrimPrefix(cleanPath, "/")
+	return u.String()
+}
+
+func (d *BunnyStorage) authRequest() *resty.Request {
+	return d.client.R().SetHeader("AccessKey", d.AccessKey)
+}
+
+func (d *BunnyStorage) handleResponseError(resp *resty.Response) error {
+	if resp == nil {
+		return fmt.Errorf("empty response")
+	}
+	if resp.StatusCode() >= http.StatusOK && resp.StatusCode() < http.StatusMultipleChoices {
+		return nil
+	}
+	message := strings.TrimSpace(resp.String())
+	var apiErrors []apiError
+	if err := json.Unmarshal(resp.Body(), &apiErrors); err == nil && len(apiErrors) > 0 && apiErrors[0].Message != "" {
+		message = apiErrors[0].Message
+	}
+	switch resp.StatusCode() {
+	case http.StatusUnauthorized, http.StatusForbidden:
+		return errs.NewErr(errs.PermissionDenied, "bunny storage request failed: %s", message)
+	case http.StatusNotFound:
+		return errs.NewErr(errs.ObjectNotFound, "bunny storage request failed: %s", message)
+	default:
+		return fmt.Errorf("bunny storage request failed: %s: %s", resp.Status(), message)
+	}
+}
+
+func (d *BunnyStorage) parseTimes(item bunnyObject) parsedTimes {
+	return parsedTimes{
+		modified: parseBunnyTime(item.LastChanged, d.Modified),
+		created:  parseBunnyTime(item.DateCreated, time.Time{}),
+	}
+}
+
+func parseBunnyTime(value string, fallback time.Time) time.Time {
+	if value == "" {
+		return fallback
+	}
+	if t, err := time.Parse(time.RFC3339Nano, value); err == nil {
+		return t
+	}
+	if t, err := time.Parse("2006-01-02T15:04:05.999999999", value); err == nil {
+		return t
+	}
+	if t, err := time.Parse("2006-01-02T15:04:05", value); err == nil {
+		return t
+	}
+	return fallback
+}
+
+func (d *BunnyStorage) toObj(parentPath string, item bunnyObject) model.Obj {
+	times := d.parseTimes(item)
+	return &model.Object{
+		ID:       item.Guid,
+		Path:     stdpath.Join(parentPath, item.ObjectName),
+		Name:     item.ObjectName,
+		Size:     item.Length,
+		Modified: times.modified,
+		Ctime:    times.created,
+		IsFolder: item.IsDirectory,
+	}
+}
+
+func canonicalQuery(values url.Values) (string, error) {
+	keys := make([]string, 0, len(values))
+	for key := range values {
+		if key == "token" || key == "expires" {
+			continue
+		}
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+	parts := make([]string, 0, len(keys))
+	for _, key := range keys {
+		vals := values[key]
+		if len(vals) > 1 {
+			return "", fmt.Errorf("duplicate query parameter %q is not supported", key)
+		}
+		value := ""
+		if len(vals) == 1 {
+			value = vals[0]
+		}
+		parts = append(parts, key+"="+value)
+	}
+	return strings.Join(parts, "&"), nil
+}
+
+func (d *BunnyStorage) signCDNURL(rawURL string, clientIP string) (string, time.Duration, error) {
+	return d.signCDNURLAt(rawURL, clientIP, time.Now())
+}
+
+func (d *BunnyStorage) signCDNURLAt(rawURL string, clientIP string, now time.Time) (string, time.Duration, error) {
+	expire := time.Hour * time.Duration(d.SignURLExpire)
+	if expire <= 0 {
+		expire = 4 * time.Hour
+	}
+	expires := now.Add(expire).Unix()
+	u, err := url.Parse(rawURL)
+	if err != nil {
+		return "", 0, err
+	}
+	query := u.Query()
+	parameterData, err := canonicalQuery(query)
+	if err != nil {
+		return "", 0, err
+	}
+	signaturePath, err := url.PathUnescape(u.EscapedPath())
+	if err != nil {
+		signaturePath = u.Path
+	}
+	if !d.CDNTokenIncludeIP {
+		clientIP = ""
+	}
+	token := d.signCDNToken(signaturePath, strconv.FormatInt(expires, 10), parameterData, clientIP)
+	query.Set("token", token)
+	query.Set("expires", strconv.FormatInt(expires, 10))
+	u.RawQuery = query.Encode()
+	return u.String(), expire, nil
+}
+
+func (d *BunnyStorage) signCDNToken(signaturePath string, expires string, parameterData string, clientIP string) string {
+	switch strings.ToLower(strings.TrimSpace(d.CDNTokenMethod)) {
+	case cdnTokenMethodHMACSHA256:
+		message := signaturePath + expires + parameterData + clientIP
+		mac := hmac.New(sha256.New, []byte(d.CDNTokenKey))
+		_, _ = mac.Write([]byte(message))
+		return "HS256-" + base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
+	default:
+		hashableBase := d.CDNTokenKey + signaturePath + expires + parameterData + clientIP
+		sum := sha256.Sum256([]byte(hashableBase))
+		return base64.RawURLEncoding.EncodeToString(sum[:])
+	}
+}
@@ -0,0 +1,255 @@
+package bunny_storage
+
+import (
+	"context"
+	"net/url"
+	"testing"
+	"time"
+
+	"github.com/OpenListTeam/OpenList/v4/internal/model"
+)
+
+func TestStorageURL(t *testing.T) {
+	endpoint, err := normalizeBaseURL("ny.storage.bunnycdn.com", defaultEndpoint)
+	if err != nil {
+		t.Fatal(err)
+	}
+	driver := &BunnyStorage{
+		Addition: Addition{
+			StorageZoneName: "my-zone",
+		},
+		endpoint: endpoint,
+	}
+	if got, want := driver.storageURL("/", true), "https://ny.storage.bunnycdn.com/my-zone/"; got != want {
+		t.Fatalf("root list url = %q, want %q", got, want)
+	}
+	if got, want := driver.storageURL("/dir/a file.txt", false), "https://ny.storage.bunnycdn.com/my-zone/dir/a%20file.txt"; got != want {
+		t.Fatalf("file url = %q, want %q", got, want)
+	}
+	if got, want := driver.storageURL("/dir", true), "https://ny.storage.bunnycdn.com/my-zone/dir/"; got != want {
+		t.Fatalf("dir url = %q, want %q", got, want)
+	}
+}
+
+func TestCDNURLWithBasePath(t *testing.T) {
+	cdnBase, err := normalizeBaseURL("https://cdn.example.com/prefix/", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	driver := &BunnyStorage{cdnBase: cdnBase}
+	if got, want := driver.cdnURL("/dir/a file.txt"), "https://cdn.example.com/prefix/dir/a%20file.txt"; got != want {
+		t.Fatalf("cdn url = %q, want %q", got, want)
+	}
+}
+
+func TestCDNURLUsesObjectPathWithoutMountPath(t *testing.T) {
+	cdnBase, err := normalizeBaseURL("https://cdn.firmant.me", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	driver := &BunnyStorage{
+		Storage: model.Storage{MountPath: "/BS"},
+		cdnBase: cdnBase,
+	}
+	if got, want := driver.cdnURL(driver.cdnObjectPath("/BS/Video")), "https://cdn.firmant.me/Video"; got != want {
+		t.Fatalf("cdn url = %q, want %q", got, want)
+	}
+}
+
+func TestCDNURLDropsMountPathFromBaseURL(t *testing.T) {
+	cdnBase, err := normalizeBaseURL("https://cdn.firmant.me/BS/", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	driver := &BunnyStorage{
+		Storage: model.Storage{MountPath: "/BS"},
+		cdnBase: cdnBase,
+	}
+	if got, want := driver.cdnURL(driver.cdnObjectPath("/Video")), "https://cdn.firmant.me/Video"; got != want {
+		t.Fatalf("cdn url = %q, want %q", got, want)
+	}
+}
+
+func TestCDNObjectPathKeepsRootFolderPath(t *testing.T) {
+	driver := &BunnyStorage{}
+	driver.MountPath = "/BS"
+	driver.RootFolderPath = "/library"
+	if got, want := driver.cdnObjectPath("/BS/Video"), "/library/Video"; got != want {
+		t.Fatalf("cdn object path = %q, want %q", got, want)
+	}
+	if got, want := driver.cdnObjectPath("/library/Video"), "/library/Video"; got != want {
+		t.Fatalf("cdn object path = %q, want %q", got, want)
+	}
+}
+
+func TestLinkDisablesLongLivedCache(t *testing.T) {
+	cdnBase, err := normalizeBaseURL("https://cdn.example.com", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	driver := &BunnyStorage{cdnBase: cdnBase}
+	link, err := driver.Link(context.Background(), &model.Object{
+		Path: "/video.mp4",
+		Name: "video.mp4",
+		Size: 123,
+	}, model.LinkArgs{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if link.Expiration == nil || *link.Expiration != 0 {
+		t.Fatalf("link expiration = %v, want immediate cache expiration", link.Expiration)
+	}
+}
+
+func TestSignCDNURL(t *testing.T) {
+	driver := &BunnyStorage{
+		Addition: Addition{
+			CDNTokenKey:       "secret",
+			CDNTokenIncludeIP: true,
+			SignURLExpire:     1,
+		},
+	}
+	signed, expire, err := driver.signCDNURLAt("https://zone.b-cdn.net/video.mp4?quality=high", "192.0.2.1", time.Unix(1700000000, 0))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if expire <= 0 {
+		t.Fatal("expected positive expiration")
+	}
+	parsed, err := url.Parse(signed)
+	if err != nil {
+		t.Fatal(err)
+	}
+	token := parsed.Query().Get("token")
+	if want := "FxSpFem88zFo6uHFziwTuoMQTgDaD2PEn5n1zTMBUBI"; token != want {
+		t.Fatalf("token = %q, want %q", token, want)
+	}
+	if parsed.Query().Get("expires") != "1700003600" {
+		t.Fatalf("expires = %q, want 1700003600", parsed.Query().Get("expires"))
+	}
+	if parsed.Query().Get("quality") != "high" {
+		t.Fatal("expected existing query parameters to be preserved")
+	}
+}
+
+func TestSignCDNURLSupportsHMACSHA256(t *testing.T) {
+	driver := &BunnyStorage{
+		Addition: Addition{
+			CDNTokenKey:       "secret",
+			CDNTokenMethod:    cdnTokenMethodHMACSHA256,
+			CDNTokenIncludeIP: true,
+			SignURLExpire:     1,
+		},
+	}
+	signed, _, err := driver.signCDNURLAt("https://zone.b-cdn.net/video.mp4?quality=high", "192.0.2.1", time.Unix(1700000000, 0))
+	if err != nil {
+		t.Fatal(err)
+	}
+	parsed, err := url.Parse(signed)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got, want := parsed.Query().Get("token"), "HS256-sdrSSJE2JVwhSk2AoDUrmTV1muH6R5UHpZVcVfHeNxg"; got != want {
+		t.Fatalf("token = %q, want %q", got, want)
+	}
+}
+
+func TestSignCDNURLUsesDecodedPathForSHA256(t *testing.T) {
+	driver := &BunnyStorage{
+		Addition: Addition{
+			CDNTokenKey:   "secret",
+			SignURLExpire: 1,
+		},
+	}
+	signed, _, err := driver.signCDNURLAt("https://zone.b-cdn.net/%E8%A7%86%E9%A2%91/%5Ba%20b%5D.mp4", "", time.Unix(1700000000, 0))
+	if err != nil {
+		t.Fatal(err)
+	}
+	parsed, err := url.Parse(signed)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got, want := parsed.Query().Get("token"), "yq1evD7klw0e3DjCbv8dJptbW4S4JwVW3GKLnxfeKGM"; got != want {
+		t.Fatalf("token = %q, want %q", got, want)
+	}
+}
+
+func TestSignCDNURLTreatsPlusAsLiteralPathCharacter(t *testing.T) {
+	driver := &BunnyStorage{
+		Addition: Addition{
+			CDNTokenKey:   "secret",
+			SignURLExpire: 1,
+		},
+	}
+	now := time.Unix(1700000000, 0)
+	literal, _, err := driver.signCDNURLAt("https://zone.b-cdn.net/a+b.mp4", "", now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	encoded, _, err := driver.signCDNURLAt("https://zone.b-cdn.net/a%2Bb.mp4", "", now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	space, _, err := driver.signCDNURLAt("https://zone.b-cdn.net/a%20b.mp4", "", now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	literalURL, err := url.Parse(literal)
+	if err != nil {
+		t.Fatal(err)
+	}
+	encodedURL, err := url.Parse(encoded)
+	if err != nil {
+		t.Fatal(err)
+	}
+	spaceURL, err := url.Parse(space)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got, want := literalURL.Query().Get("token"), encodedURL.Query().Get("token"); got != want {
+		t.Fatalf("literal plus token = %q, encoded plus token = %q", got, want)
+	}
+	if got, notWant := literalURL.Query().Get("token"), spaceURL.Query().Get("token"); got == notWant {
+		t.Fatalf("literal plus token = %q, space token should differ", got)
+	}
+}
+
+func TestSignCDNURLRejectsDuplicateQueryParameters(t *testing.T) {
+	driver := &BunnyStorage{
+		Addition: Addition{
+			CDNTokenKey:   "secret",
+			SignURLExpire: 1,
+		},
+	}
+	_, _, err := driver.signCDNURLAt("https://zone.b-cdn.net/video.mp4?quality=high&quality=low", "", time.Unix(1700000000, 0))
+	if err == nil {
+		t.Fatal("expected duplicate query parameters to be rejected")
+	}
+	if got, want := err.Error(), `duplicate query parameter "quality" is not supported`; got != want {
+		t.Fatalf("error = %q, want %q", got, want)
+	}
+}
+
+func TestParseBunnyTimeSupportsFractionalSecondsWithoutTimezone(t *testing.T) {
+	fallback := time.Unix(1, 0)
+	got := parseBunnyTime("2023-03-21T13:38:31.693", fallback)
+	want := time.Date(2023, 3, 21, 13, 38, 31, 693000000, time.UTC)
+	if !got.Equal(want) {
+		t.Fatalf("parsed time = %s, want %s", got.Format(time.RFC3339Nano), want.Format(time.RFC3339Nano))
+	}
+}
+
+func TestConfigProxyMode(t *testing.T) {
+	registeredConfig := (&BunnyStorage{}).Config()
+	if registeredConfig.OnlyProxy {
+		t.Fatal("driver registration config should allow users to choose proxy policy")
+	}
+	withoutCDN := (&BunnyStorage{Addition: Addition{StorageZoneName: "my-zone"}}).Config()
+	if !withoutCDN.OnlyProxy {
+		t.Fatal("storage API links require AccessKey headers and should be proxied without CDN")
+	}
+	withCDN := (&BunnyStorage{Addition: Addition{StorageZoneName: "my-zone", CDNBaseURL: "https://zone.b-cdn.net"}}).Config()
+	if withCDN.OnlyProxy {
+		t.Fatal("CDN links should be allowed to redirect directly")
+	}
+}
@@ -105,44 +105,82 @@ func (ios *int_str) UnmarshalJSON(data []byte) error {
 	return nil
 }

+// 时间戳同样存在字符串/数字两种形式，且毫秒级时间戳会超出 int32 范围，需用 int64 解析
+// 超星 API 返回的 uploadDate 有三种格式：
+// 1. 数字时间戳：1780191356415
+// 2. 字符串时间戳："1780191356415"
+// 3. 日期字符串："2024-11-06 07:49"
+type int64_str int64
+
+func (ios *int64_str) UnmarshalJSON(data []byte) error {
+	// 去除引号
+	str := string(bytes.Trim(data, "\""))
+
+	// 尝试直接解析为数字（处理格式 1 和 2）
+	intValue, err := strconv.ParseInt(str, 10, 64)
+	if err == nil {
+		*ios = int64_str(intValue)
+		return nil
+	}
+
+	// 尝试解析日期字符串（处理格式 3）
+	// 支持格式："2024-11-06 07:49" 或 "2024-11-06 07:49:30"
+	layouts := []string{
+		"2006-01-02 15:04",
+		"2006-01-02 15:04:05",
+	}
+
+	for _, layout := range layouts {
+		if t, err := time.Parse(layout, str); err == nil {
+			// 转换为毫秒时间戳
+			*ios = int64_str(t.UnixMilli())
+			return nil
+		}
+	}
+
+	// 所有格式都失败，返回 0（避免因时间格式问题导致整个解析失败）
+	*ios = 0
+	return nil
+}
+
 type File struct {
 	Cataid  int `json:"cataid"`
 	Cfid    int `json:"cfid"`
 	Content struct {
-		Cfid             int     `json:"cfid"`
-		Pid              int     `json:"pid"`
-		FolderName       string  `json:"folderName"`
-		ShareType        int     `json:"shareType"`
-		Preview          string  `json:"preview"`
-		Filetype         string  `json:"filetype"`
-		PreviewURL       string  `json:"previewUrl"`
-		IsImg            bool    `json:"isImg"`
-		ParentPath       string  `json:"parentPath"`
-		Icon             string  `json:"icon"`
-		Suffix           string  `json:"suffix"`
-		Duration         int     `json:"duration"`
-		Pantype          string  `json:"pantype"`
-		Puid             int_str `json:"puid"`
-		Filepath         string  `json:"filepath"`
-		Crc              string  `json:"crc"`
-		Isfile           bool    `json:"isfile"`
-		Residstr         string  `json:"residstr"`
-		ObjectID         string  `json:"objectId"`
-		Extinfo          string  `json:"extinfo"`
-		Thumbnail        string  `json:"thumbnail"`
-		Creator          int     `json:"creator"`
-		ResTypeValue     int     `json:"resTypeValue"`
-		UploadDateFormat string  `json:"uploadDateFormat"`
-		DisableOpt       bool    `json:"disableOpt"`
-		DownPath         string  `json:"downPath"`
-		Sort             int     `json:"sort"`
-		Topsort          int     `json:"topsort"`
-		Restype          string  `json:"restype"`
-		Size             int_str `json:"size"`
-		UploadDate       int64   `json:"uploadDate"`
-		FileSize         string  `json:"fileSize"`
-		Name             string  `json:"name"`
-		FileID           string  `json:"fileId"`
+		Cfid             int       `json:"cfid"`
+		Pid              int       `json:"pid"`
+		FolderName       string    `json:"folderName"`
+		ShareType        int       `json:"shareType"`
+		Preview          string    `json:"preview"`
+		Filetype         string    `json:"filetype"`
+		PreviewURL       string    `json:"previewUrl"`
+		IsImg            bool      `json:"isImg"`
+		ParentPath       string    `json:"parentPath"`
+		Icon             string    `json:"icon"`
+		Suffix           string    `json:"suffix"`
+		Duration         int       `json:"duration"`
+		Pantype          string    `json:"pantype"`
+		Puid             int_str   `json:"puid"`
+		Filepath         string    `json:"filepath"`
+		Crc              string    `json:"crc"`
+		Isfile           bool      `json:"isfile"`
+		Residstr         string    `json:"residstr"`
+		ObjectID         string    `json:"objectId"`
+		Extinfo          string    `json:"extinfo"`
+		Thumbnail        string    `json:"thumbnail"`
+		Creator          int       `json:"creator"`
+		ResTypeValue     int       `json:"resTypeValue"`
+		UploadDateFormat string    `json:"uploadDateFormat"`
+		DisableOpt       bool      `json:"disableOpt"`
+		DownPath         string    `json:"downPath"`
+		Sort             int       `json:"sort"`
+		Topsort          int       `json:"topsort"`
+		Restype          string    `json:"restype"`
+		Size             int_str   `json:"size"`
+		UploadDate       int64_str `json:"uploadDate"`
+		FileSize         string    `json:"fileSize"`
+		Name             string    `json:"name"`
+		FileID           string    `json:"fileId"`
 	} `json:"content"`
 	CreatorID  int    `json:"creatorId"`
 	DesID      string `json:"des_id"`
@@ -265,7 +303,7 @@ func fileToObj(f File) *model.Object {
 			IsFolder: true,
 		}
 	}
-	paserTime := time.UnixMilli(f.Content.UploadDate)
+	paserTime := time.UnixMilli(int64(f.Content.UploadDate))
 	return &model.Object{
 		ID:       fmt.Sprintf("%d$%s", f.ID, f.Content.FileID),
 		Name:     f.Content.Name,
@@ -53,8 +53,8 @@ func (d *Chunk) Drop(ctx context.Context) error {
 	return nil
 }

-func (Addition) GetRootPath() string {
-	return "/"
+func (*Chunk) GetRootPath() string {
+	return ""
 }

 func (d *Chunk) Get(ctx context.Context, path string) (model.Obj, error) {
@@ -80,7 +80,7 @@ func (d *Chunk) Get(ctx context.Context, path string) (model.Obj, error) {
 	if err != nil {
 		return nil, err
 	}
-	var totalSize int64 = 0
+	var totalSize int64
 	// 0号块默认为-1 以支持空文件
 	chunkSizes := []int64{-1}
 	h := make(map[*utils.HashType]string)
@@ -119,6 +119,25 @@ func (d *Chunk) Get(ctx context.Context, path string) (model.Obj, error) {
 		}
 	}
 	reqDir, _ := stdpath.Split(path)
+	// 文件块不完整时，返回文件夹对象
+	if chunkSizes[0] == -1 {
+		return &model.Object{
+			Path:     stdpath.Join(reqDir, chunkName),
+			Name:     chunkName,
+			IsFolder: true,
+			Modified: d.Modified,
+		}, nil
+	}
+	for i, l := 1, len(chunkSizes)-1; i < l; i++ {
+		if chunkSizes[i] == 0 {
+			return &model.Object{
+				Path:     stdpath.Join(reqDir, chunkName),
+				Name:     chunkName,
+				IsFolder: true,
+				Modified: d.Modified,
+			}, nil
+		}
+	}
 	objRes := chunkObject{
 		Object: model.Object{
 			Path:     stdpath.Join(reqDir, chunkName),
@@ -161,37 +180,69 @@ func (d *Chunk) List(ctx context.Context, dir model.Obj, args model.ListArgs) ([
 				result = append(result, nil)
 				listG.Go(func(ctx context.Context) error {
 					chunkObjs, err := op.List(ctx, remoteStorage, stdpath.Join(remoteActualDir, rawName), model.ListArgs{
-						ReqPath: stdpath.Join(args.ReqPath, rawName),
 						Refresh: args.Refresh,
 					})
 					if err != nil {
 						return err
 					}
-					totalSize := int64(0)
+					var totalSize int64
+					// 0号块默认为-1 以支持空文件
+					chunkSizes := []int64{-1}
 					h := make(map[*utils.HashType]string)
-					first := obj
+					var first model.Obj
 					for _, o := range chunkObjs {
 						if o.IsDir() {
 							continue
 						}
-						if after, ok := strings.CutPrefix(strings.TrimSuffix(o.GetName(), d.CustomExt), "hash_"); ok {
-							hn, value, ok := strings.Cut(after, "_")
+						if after, ok := strings.CutPrefix(o.GetName(), "hash_"); ok {
+							hn, value, ok := strings.Cut(strings.TrimSuffix(after, d.CustomExt), "_")
 							if ok {
 								ht, ok := utils.GetHashByName(hn)
 								if ok {
 									h[ht] = value
 								}
-								continue
 							}
+							continue
 						}
 						idx, err := strconv.Atoi(strings.TrimSuffix(o.GetName(), d.CustomExt))
 						if err != nil {
 							continue
 						}
-						if idx == 0 {
-							first = o
-						}
 						totalSize += o.GetSize()
+						if len(chunkSizes) > idx {
+							if idx == 0 {
+								first = o
+							}
+							chunkSizes[idx] = o.GetSize()
+						} else if len(chunkSizes) == idx {
+							chunkSizes = append(chunkSizes, o.GetSize())
+						} else {
+							newChunkSizes := make([]int64, idx+1)
+							copy(newChunkSizes, chunkSizes)
+							chunkSizes = newChunkSizes
+							chunkSizes[idx] = o.GetSize()
+						}
+					}
+					// 文件块不完整时，返回文件夹对象
+					if chunkSizes[0] == -1 {
+						result[resultIdx] = &model.Object{
+							Name:     rawName,
+							Size:     obj.GetSize(),
+							Modified: obj.ModTime(),
+							IsFolder: true,
+						}
+						return nil
+					}
+					for i, l := 1, len(chunkSizes)-1; i < l; i++ {
+						if chunkSizes[i] == 0 {
+							result[resultIdx] = &model.Object{
+								Name:     rawName,
+								Size:     obj.GetSize(),
+								Modified: obj.ModTime(),
+								IsFolder: true,
+							}
+							return nil
+						}
 					}
 					objRes := model.Object{
 						Name:     name,
@@ -263,9 +314,7 @@ func (d *Chunk) Link(ctx context.Context, file model.Obj, args model.LinkArgs) (
 		if err != nil {
 			return nil, err
 		}
-		resultLink := *l
-		resultLink.SyncClosers = utils.NewSyncClosers(l)
-		return &resultLink, nil
+		return l.Clone(), nil
 	}
 	// 检查0号块不等于-1 以支持空文件
 	// 如果块数量大于1 最后一块不可能为0
@@ -0,0 +1,168 @@
+package cloudflare_imgbed
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"path"
+	"strings"
+
+	"github.com/OpenListTeam/OpenList/v4/drivers/base"
+	"github.com/OpenListTeam/OpenList/v4/internal/cache"
+	"github.com/OpenListTeam/OpenList/v4/internal/driver"
+	"github.com/OpenListTeam/OpenList/v4/internal/errs"
+	"github.com/OpenListTeam/OpenList/v4/internal/model"
+	"github.com/OpenListTeam/OpenList/v4/pkg/utils"
+	"github.com/go-resty/resty/v2"
+)
+
+type CFImgBed struct {
+	model.Storage
+	Addition
+	client          *resty.Client
+	virtualDir      *cache.WeakCacheMap[string, model.Object]
+	publicUrlPrefix string
+}
+
+func (d *CFImgBed) Config() driver.Config          { return config }
+func (d *CFImgBed) GetAddition() driver.Additional { return &d.Addition }
+
+func (d *CFImgBed) Init(ctx context.Context) error {
+	d.UploadThread = min(d.UploadThread, 32)
+	if d.UploadThread < 1 {
+		d.UploadThread = 3
+	}
+	d.Address = strings.TrimRight(d.Address, "/")
+
+	d.client = base.NewRestyClient().
+		SetBaseURL(d.Address).
+		SetHeader("Authorization", "Bearer "+d.Token).
+		SetDebug(false)
+
+	// 连通性测试：尝试获取根目录单条数据
+	_, err := d.doRequest(ctx, http.MethodGet, listApi, func(req *resty.Request) {
+		req.SetQueryParams(map[string]string{
+			"start": "0",
+			"count": "1",
+			"dir":   "/",
+		})
+	}, nil)
+	if err != nil {
+		return fmt.Errorf("init verification failed: %w", err)
+	}
+	d.virtualDir = cache.NewWeakCacheMap[string, model.Object]()
+	return nil
+}
+
+func (d *CFImgBed) Drop(ctx context.Context) error {
+	if d.virtualDir != nil {
+		d.virtualDir.Clear()
+	}
+	return nil
+}
+
+func (d *CFImgBed) List(ctx context.Context, dir model.Obj, args model.ListArgs) ([]model.Obj, error) {
+	// if !args.Refresh && model.ObjHasMask(dir, model.Virtual) {
+	//      if _, ok := d.virtualDir.Load(dir.GetPath()); ok {
+	//              return nil, nil
+	//      }
+	// }
+
+	var dirSeen map[string]bool
+	var fileSeen map[string]bool
+	var objs []model.Obj
+
+	start := 0
+	for {
+		var resp ListResponse
+		_, err := d.doRequest(ctx, http.MethodGet, listApi, func(req *resty.Request) {
+			req.SetQueryParams(map[string]string{
+				"dir":   dir.GetPath(),
+				"start": fmt.Sprintf("%d", start),
+				"count": fmt.Sprintf("%d", listPageSize),
+			})
+		}, &resp)
+		if err != nil {
+			return nil, err
+		}
+		if len(resp.Files) == 0 && len(resp.Directories) == 0 {
+			break
+		}
+
+		if start == 0 {
+			dirSeen = make(map[string]bool, len(resp.Directories))
+			fileSeen = make(map[string]bool, len(resp.Files))
+			objs = make([]model.Obj, 0, len(resp.Directories)+len(resp.Files))
+		}
+
+		for _, rawDir := range resp.Directories {
+			rawDir = "/" + strings.TrimRight(rawDir, "/")
+			if !dirSeen[rawDir] {
+				dirSeen[rawDir] = true
+				objs = append(objs, &model.Object{
+					Path:     rawDir,
+					Name:     path.Base(rawDir),
+					Modified: d.Modified,
+					IsFolder: true,
+				})
+			}
+		}
+
+		for _, item := range resp.Files {
+			if !fileSeen[item.Name] {
+				fileSeen[item.Name] = true
+				objs = append(objs, parseFile(item))
+			}
+		}
+
+		// 如果当前获取的数量少于分页大小，说明已加载完毕
+		if len(resp.Files)+len(resp.Directories) < listPageSize {
+			break
+		}
+		start += listPageSize
+	}
+	return objs, nil
+}
+
+func (d *CFImgBed) Link(ctx context.Context, file model.Obj, args model.LinkArgs) (*model.Link, error) {
+	if d.publicUrlPrefix != "" {
+		return &model.Link{URL: d.publicUrlPrefix + utils.EncodePath(file.GetPath())}, nil
+	}
+	return &model.Link{URL: d.Address + "/file" + utils.EncodePath(file.GetPath())}, nil
+}
+
+func (d *CFImgBed) Get(ctx context.Context, pathStr string) (model.Obj, error) {
+	fullPath := path.Join(d.RootFolderPath, pathStr)
+	if obj, found := d.virtualDir.Load(fullPath); found {
+		return obj, nil
+	}
+	return nil, errs.NotSupport
+}
+
+// MakeDir 在图床中通常是虚拟的，此处返回虚拟目录对象以支持上传时的路径展示
+func (d *CFImgBed) MakeDir(ctx context.Context, parentDir model.Obj, dirName string) (model.Obj, error) {
+	fullPath := path.Join(parentDir.GetPath(), dirName)
+	temp := &model.Object{
+		Path:     fullPath,
+		Name:     dirName,
+		IsFolder: true,
+		Modified: d.Modified,
+		Mask:     model.Virtual,
+	}
+	d.virtualDir.Store(fullPath, temp)
+	return temp, nil
+}
+
+func (d *CFImgBed) Remove(ctx context.Context, obj model.Obj) error {
+	reqPath := obj.GetPath()
+	if model.ObjHasMask(obj, model.Virtual) {
+		d.virtualDir.Delete(reqPath)
+		return nil
+	}
+	_, err := d.doRequest(ctx, http.MethodPost, deleteApi+utils.EncodePath(reqPath), func(req *resty.Request) {
+		req.SetQueryParam("folder", fmt.Sprintf("%t", obj.IsDir()))
+	}, nil)
+	return err
+}
+
+var _ driver.Driver = (*CFImgBed)(nil)
@@ -0,0 +1,27 @@
+package cloudflare_imgbed
+
+import (
+	"github.com/OpenListTeam/OpenList/v4/internal/driver"
+	"github.com/OpenListTeam/OpenList/v4/internal/op"
+)
+
+type Addition struct {
+	driver.RootPath
+	Address          string `json:"address" required:"true" help:"Backend API address of the image hosting service, e.g., https://img.example.com"`
+	Token            string `json:"token" required:"true" help:"Authentication Token"`
+	SmallChannelName string `json:"smallChannelName" help:"Channel name for regular files (typically <20MB)"`
+	LargeChannelName string `json:"largeChannelName" help:"Channel name for large files"`
+	LargeChannelType string `json:"largeChannelType" type:"select" options:",huggingface,telegram,cfr2,s3,discord" help:"Large File Channel Type: Hugging Face (Direct Upload)、telegram/cfr2/s3/discord(Multipart Upload)"`
+	UploadThread     int    `json:"uploadThread" type:"number" default:"3" help:"Concurrent thread count for HuggingFace chunked direct upload"`
+}
+
+var config = driver.Config{
+	Name:        "cloudflare_imgbed",
+	LocalSort:   true,
+	NoUpload:    false,
+	DefaultRoot: "/",
+}
+
+func init() {
+	op.RegisterDriver(func() driver.Driver { return &CFImgBed{} })
+}
@@ -0,0 +1,117 @@
+package cloudflare_imgbed
+
+import (
+	"fmt"
+	"path"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/OpenListTeam/OpenList/v4/internal/model"
+)
+
+const listPageSize = 1000
+
+// ListResponse 列表接口响应
+type ListResponse struct {
+	Files       []FileItem `json:"files"`
+	Directories []string   `json:"directories"`
+}
+
+type FileItem struct {
+	Name     string                 `json:"name"`
+	Metadata map[string]interface{} `json:"metadata"` // 存储文件大小、哈希、时间戳等
+}
+
+type apiError struct {
+	Error   string `json:"error"`
+	Message string `json:"message"`
+}
+
+// standardUploadResp 标准上传成功返回的数组
+type standardUploadResp []struct {
+	Src       string `json:"src"`
+	PublicUrl string `json:"publicUrl"`
+}
+
+// hfGetUrlResp 获取 HF 直传授权地址的响应
+type hfGetUrlResp struct {
+	Success       bool          `json:"success"`
+	FullID        string        `json:"fullId"`
+	FilePath      string        `json:"filePath"`
+	ChannelName   string        `json:"channelName"`
+	Repo          string        `json:"repo"`
+	NeedsLfs      bool          `json:"needsLfs"`      // 是否需要进行 LFS 物理上传
+	AlreadyExists bool          `json:"alreadyExists"` // 是否秒传成功
+	Oid           string        `json:"oid"`           // Git LFS 对象 ID (SHA256)
+	UploadAction  *UploadAction `json:"uploadAction"`
+}
+
+type UploadAction struct {
+	Href   string            `json:"href"`
+	Header map[string]string `json:"header"`
+}
+
+type hfCommitResp struct {
+	Success   bool   `json:"success"`
+	Src       string `json:"src"`
+	PublicUrl string `json:"publicUrl"`
+	FileUrl   string `json:"fileUrl"`
+	FullID    string `json:"fullId"`
+}
+
+// 辅助函数：从 map 中安全提取字符串/数值
+func getString(m map[string]interface{}, keys ...string) string {
+	for _, k := range keys {
+		if v, ok := m[k]; ok {
+			switch val := v.(type) {
+			case string:
+				return val
+			case float64:
+				return strconv.FormatInt(int64(val), 10)
+			default:
+				return fmt.Sprintf("%v", val)
+			}
+		}
+	}
+	return ""
+}
+
+func getInt64(m map[string]interface{}, keys ...string) int64 {
+	for _, k := range keys {
+		if v, ok := m[k]; ok {
+			switch val := v.(type) {
+			case string:
+				n, _ := strconv.ParseInt(val, 10, 64)
+				return n
+			case float64:
+				return int64(val)
+			case int64:
+				return val
+			}
+		}
+	}
+	return 0
+}
+
+func parseFile(item FileItem) *model.Object {
+	name := path.Base(item.Name)
+	var size int64
+	var modTime time.Time
+
+	if item.Metadata != nil {
+		size = getInt64(item.Metadata, "FileSizeBytes", "File-Size")
+		ts := getInt64(item.Metadata, "TimeStamp")
+		if ts > 0 {
+			modTime = time.UnixMilli(ts)
+		}
+	}
+
+	return &model.Object{
+		Path:     "/" + strings.TrimRight(item.Name, "/"),
+		Name:     name,
+		Size:     size,
+		Modified: modTime,
+		IsFolder: false,
+	}
+}
@@ -0,0 +1,560 @@
+package cloudflare_imgbed
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"net/url"
+	"path"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/OpenListTeam/OpenList/v4/drivers/base"
+	"github.com/OpenListTeam/OpenList/v4/internal/driver"
+	"github.com/OpenListTeam/OpenList/v4/internal/model"
+	"github.com/OpenListTeam/OpenList/v4/internal/stream"
+	"github.com/OpenListTeam/OpenList/v4/pkg/errgroup"
+	"github.com/OpenListTeam/OpenList/v4/pkg/http_range"
+	"github.com/OpenListTeam/OpenList/v4/pkg/utils"
+	"github.com/avast/retry-go"
+	"github.com/go-resty/resty/v2"
+	log "github.com/sirupsen/logrus"
+)
+
+func (d *CFImgBed) Put(ctx context.Context, dstDir model.Obj, file model.FileStreamer, up driver.UpdateProgress) (newObj model.Obj, err error) {
+	if file.GetSize() < hfDirectThreshold {
+		newObj, err = d.standardUpload(ctx, dstDir, file, up)
+	} else {
+		switch d.LargeChannelType {
+		case "huggingface":
+			newObj, err = d.hfDirectUpload(ctx, dstDir, file, up)
+		case "telegram", "cfr2", "s3", "discord":
+			newObj, err = d.chunkedUpload(ctx, dstDir, file, up, d.LargeChannelType, d.LargeChannelName)
+		default:
+			newObj, err = d.standardUpload(ctx, dstDir, file, up)
+		}
+	}
+	if newObj != nil && model.ObjHasMask(dstDir, model.Virtual) {
+		key := dstDir.GetPath()
+		for d.virtualDir.Delete(key) {
+			key = path.Dir(key)
+		}
+	}
+	return
+}
+
+// standardUpload 通过普通 multipart 表单上传。
+// 使用 io.MultiReader 实现虚拟拼接，避免将整个大文件读入内存构建表单。
+func (d *CFImgBed) standardUpload(ctx context.Context, dstDir model.Obj, file model.FileStreamer, up driver.UpdateProgress) (model.Obj, error) {
+
+	channelName := d.SmallChannelName
+	if file.GetSize() >= hfDirectThreshold {
+		channelName = d.LargeChannelName
+		log.WithField("size", file.GetSize()).Warn("large file falls back to standard upload, consider configuring LargeChannelType")
+	}
+	if channelName == "" {
+		return nil, fmt.Errorf("channel name not configured")
+	}
+
+	// 1. 将参数放入 Query String
+	reqUrl, err := url.Parse(d.Address + uploadApi)
+	if err != nil {
+		return nil, err
+	}
+	q := reqUrl.Query()
+	q.Set("returnFormat", "default")
+	q.Set("channelName", channelName)
+	q.Set("uploadFolder", dstDir.GetPath())
+	q.Set("autoRetry", "true")
+	reqUrl.RawQuery = q.Encode()
+
+	// 2. 构建 multipart 表单的头部
+	b := bytes.NewBuffer(make([]byte, 0, 164+len(file.GetName()))) // 预估头部大小，避免频繁扩容
+	w := multipart.NewWriter(b)
+	_, err = w.CreateFormFile("file", file.GetName())
+	if err != nil {
+		return nil, err
+	}
+	headSize := b.Len()
+	err = w.Close()
+	if err != nil {
+		return nil, err
+	}
+	head := bytes.NewReader(b.Bytes()[:headSize])
+	tail := bytes.NewReader(b.Bytes()[headSize:])
+
+	// 3. 将 [表单头 + 文件流 + 表单尾] 组合成单一 Reader
+	rateLimitedReader := driver.NewLimitedUploadStream(ctx, &driver.ReaderUpdatingProgress{
+		Reader: &driver.SimpleReaderWithSize{
+			Reader: io.MultiReader(head, file, tail),
+			Size:   int64(b.Len()) + file.GetSize(),
+		},
+		UpdateProgress: up,
+	})
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, reqUrl.String(), rateLimitedReader)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Content-Type", w.FormDataContentType())
+	req.Header.Set("Authorization", "Bearer "+d.Token)
+	req.ContentLength = int64(b.Len()) + file.GetSize()
+	res, err := base.HttpClient.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer res.Body.Close()
+
+	b.Reset()
+	_, err = b.ReadFrom(res.Body)
+	if err != nil {
+		return nil, err
+	}
+	if res.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("upload failed %d: %s", res.StatusCode, b.String())
+	}
+
+	var resp standardUploadResp
+	if err := json.Unmarshal(b.Bytes(), &resp); err != nil {
+		return nil, err
+	}
+	if len(resp) == 0 || resp[0].Src == "" {
+		return nil, fmt.Errorf("no src returned")
+	}
+
+	srcPath := strings.TrimPrefix(resp[0].Src, "/file/")
+	srcPath = strings.TrimPrefix(srcPath, "/")
+
+	if resp[0].PublicUrl != "" {
+		if u, err := url.Parse(resp[0].PublicUrl); err == nil {
+			d.publicUrlPrefix = u.Scheme + "://" + u.Host
+		}
+	}
+
+	return &model.Object{
+		Path:     srcPath,
+		Name:     file.GetName(),
+		Size:     file.GetSize(),
+		Modified: file.ModTime(),
+		IsFolder: false,
+	}, nil
+}
+
+func (d *CFImgBed) chunkedUpload(ctx context.Context, dstDir model.Obj, file model.FileStreamer, up driver.UpdateProgress, channelType, channelName string) (model.Obj, error) {
+	if channelName == "" {
+		return nil, fmt.Errorf("channel name not configured for chunked upload")
+	}
+
+	fileSize := file.GetSize()
+	fileMime := file.GetMimetype()
+	fileName := file.GetName()
+
+	var chunkSizeMap = map[string]int64{
+
+	}
+	chunkSize := chunkSizeMap[channelType]
+	if chunkSize == 0 {
+		chunkSize = 5 * 1024 * 1024
+	}
+	totalChunks := int((fileSize + chunkSize - 1) / chunkSize)
+
+	// 第一步：initChunked
+	var initResp struct {
+		Success  bool   `json:"success"`
+		UploadId string `json:"uploadId"`
+	}
+	_, err := d.doRequest(ctx, http.MethodPost, uploadApi, func(req *resty.Request) {
+		req.SetQueryParams(map[string]string{
+			"initChunked":   "true",
+			"uploadChannel": channelType,
+			"channelName":   channelName,
+		})
+		req.SetFormData(map[string]string{
+			"originalFileName": fileName,
+			"originalFileType": fileMime,
+			"totalChunks":      strconv.Itoa(totalChunks),
+		})
+	}, &initResp)
+	if err != nil {
+		return nil, fmt.Errorf("initChunked failed: %w", err)
+	}
+	if !initResp.Success || initResp.UploadId == "" {
+		return nil, fmt.Errorf("initChunked returned no uploadId")
+	}
+	uploadId := initResp.UploadId
+
+	// 第二步：逐块上传
+	ss, err := stream.NewStreamSectionReader(file, int(chunkSize), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	reqUrl := d.Address + uploadApi + "?chunked=true&uploadChannel=" + channelType + "&channelName=" + channelName
+	b := bytes.NewBuffer(make([]byte, 0, 2048))
+
+	g, uploadCtx := errgroup.NewOrderedGroupWithContext(ctx, min(d.UploadThread, totalChunks),
+		retry.Attempts(3),
+		retry.Delay(time.Second),
+		retry.DelayType(retry.BackOffDelay))
+
+	for i := 0; i < totalChunks; i++ {
+		if utils.IsCanceled(uploadCtx) {
+			break
+		}
+		chunkIndex := i
+		offset := int64(chunkIndex) * chunkSize
+		sizeToRead := chunkSize
+		if offset+sizeToRead > fileSize {
+			sizeToRead = fileSize - offset
+		}
+
+		var reader io.ReadSeeker
+		g.GoWithLifecycle(errgroup.Lifecycle{
+			Before: func(ctx context.Context) (err error) {
+				reader, err = ss.GetSectionReader(offset, sizeToRead)
+				return
+			},
+			After: func(err error) {
+				ss.FreeSectionReader(reader)
+			},
+			Do: func(ctx context.Context) (err error) {
+				_, err = reader.Seek(0, io.SeekStart)
+				if err != nil {
+					return err
+				}
+
+				b.Reset()
+				w := multipart.NewWriter(b)
+				_ = w.WriteField("uploadId", uploadId)
+				_ = w.WriteField("chunkIndex", strconv.Itoa(chunkIndex))
+				_ = w.WriteField("totalChunks", strconv.Itoa(totalChunks))
+				_ = w.WriteField("originalFileName", fileName)
+				_ = w.WriteField("originalFileType", fileMime)
+				_, _ = w.CreateFormFile("file", fileName)
+				headSize := b.Len()
+				_ = w.Close()
+				head := bytes.NewReader(b.Bytes()[:headSize])
+				tail := bytes.NewReader(b.Bytes()[headSize:])
+
+				rateLimitedRd := driver.NewLimitedUploadStream(ctx, io.MultiReader(head, reader, tail))
+				req, err := http.NewRequestWithContext(ctx, http.MethodPost, reqUrl, rateLimitedRd)
+				if err != nil {
+					return err
+				}
+				req.Header.Set("Content-Type", w.FormDataContentType())
+				req.Header.Set("Authorization", "Bearer "+d.Token)
+				req.ContentLength = int64(headSize) + sizeToRead + int64(b.Len()-headSize)
+
+				res, err := base.HttpClient.Do(req)
+				if err != nil {
+					return err
+				}
+				defer res.Body.Close()
+				if res.StatusCode != http.StatusOK {
+					return fmt.Errorf("chunk %d upload failed: %d", chunkIndex, res.StatusCode)
+				}
+
+				up(90 * float64(chunkIndex+1) / float64(totalChunks))
+				return nil
+			},
+		})
+	}
+
+	if err := g.Wait(); err != nil {
+		return nil, err
+	}
+
+	// 第三步：merge
+	var mergeResp standardUploadResp
+	_, err = d.doRequest(ctx, http.MethodPost, uploadApi, func(req *resty.Request) {
+		req.SetQueryParams(map[string]string{
+			"chunked":       "true",
+			"merge":         "true",
+			"uploadChannel": channelType,
+			"channelName":   channelName,
+			"returnFormat":  "default",
+			"uploadFolder":  dstDir.GetPath(),
+		})
+		req.SetFormData(map[string]string{
+			"uploadId":         uploadId,
+			"totalChunks":      strconv.Itoa(totalChunks),
+			"originalFileName": fileName,
+			"originalFileType": fileMime,
+		})
+	}, &mergeResp)
+	if err != nil {
+		return nil, fmt.Errorf("merge failed: %w", err)
+	}
+	if len(mergeResp) == 0 || mergeResp[0].Src == "" {
+		return nil, fmt.Errorf("merge returned no src")
+	}
+
+	up(95)
+
+	srcPath := strings.TrimPrefix(mergeResp[0].Src, "/file/")
+	srcPath = strings.TrimPrefix(srcPath, "/")
+
+	if mergeResp[0].PublicUrl != "" {
+		if u, err := url.Parse(mergeResp[0].PublicUrl); err == nil {
+			d.publicUrlPrefix = u.Scheme + "://" + u.Host
+		}
+	}
+
+	return &model.Object{
+		Path:     srcPath,
+		Name:     fileName,
+		Size:     fileSize,
+		Modified: file.ModTime(),
+		IsFolder: false,
+	}, nil
+}
+
+// hfDirectUpload 处理 HuggingFace 的 LFS 直传逻辑（申请授权 -> 物理上传 -> 后端 Commit）
+func (d *CFImgBed) hfDirectUpload(ctx context.Context, dstDir model.Obj, file model.FileStreamer, up driver.UpdateProgress) (model.Obj, error) {
+	channelName := d.LargeChannelName
+	if channelName == "" {
+		return nil, errors.New("LargeChannelName not configured")
+	}
+
+	sha256Hash := file.GetHash().GetHash(utils.SHA256)
+	if len(sha256Hash) != utils.SHA256.Width {
+		var err error
+		_, sha256Hash, err = stream.CacheFullAndHash(file, &up, utils.SHA256)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	fileSize := file.GetSize()
+	sampleSize := min(fileSize, fileSampleSize)
+	sampleRd, err := file.RangeRead(http_range.Range{Start: 0, Length: sampleSize})
+	if err != nil {
+		return nil, err
+	}
+	sampleBuf := make([]byte, sampleSize)
+	_, err = io.ReadFull(sampleRd, sampleBuf)
+	if err != nil && !errors.Is(err, io.EOF) && !errors.Is(err, io.ErrUnexpectedEOF) {
+		return nil, err
+	}
+	fileSample := base64.StdEncoding.EncodeToString(sampleBuf)
+
+	fileMime := file.GetMimetype()
+	// 1. 请求图床后端获取 HF 授权地址
+	reqBody := map[string]interface{}{
+		"fileName":     file.GetName(),
+		"fileType":     fileMime,
+		"fileSize":     fileSize,
+		"sha256":       sha256Hash,
+		"fileSample":   fileSample,
+		"channelName":  channelName,
+		"uploadFolder": dstDir.GetPath(),
+	}
+
+	var getUrlResp hfGetUrlResp
+	_, err = d.doRequest(ctx, http.MethodPost, hfGetUrlApi, func(req *resty.Request) {
+		req.SetBody(reqBody)
+		req.SetHeader("Content-Type", "application/json")
+	}, &getUrlResp)
+	if err != nil {
+		return nil, err
+	}
+
+	// 秒传逻辑
+	if getUrlResp.AlreadyExists || !getUrlResp.NeedsLfs {
+		up(100)
+		return d.hfCommit(ctx, getUrlResp, file.GetName(), fileSize, fileMime, file.ModTime())
+	}
+
+	if getUrlResp.UploadAction == nil {
+		return nil, fmt.Errorf("HF upload action is nil")
+	}
+
+	headers := getUrlResp.UploadAction.Header
+	href := getUrlResp.UploadAction.Href
+
+	// 2. 根据响应判断是执行分片上传还是单文件上传
+	chunkSizeStr, needChunk := headers["chunk_size"]
+	if needChunk {
+		// 分片直传 (AWS S3 Multipart 风格)
+		chunkSize, _ := strconv.ParseInt(chunkSizeStr, 10, 64)
+		if chunkSize <= 0 {
+			chunkSize = 20 * 1024 * 1024
+		}
+
+		partUrls := make(map[int]string)
+		for k, v := range headers {
+			if k != "chunk_size" {
+				if idx, err := strconv.Atoi(k); err == nil {
+					partUrls[idx] = v
+				}
+			}
+		}
+		totalParts := len(partUrls)
+
+		ss, err := stream.NewStreamSectionReader(file, int(chunkSize), &up)
+		if err != nil {
+			return nil, err
+		}
+
+		g, uploadCtx := errgroup.NewOrderedGroupWithContext(ctx, min(d.UploadThread, totalParts),
+			retry.Attempts(3),
+			retry.Delay(time.Second),
+			retry.DelayType(retry.BackOffDelay))
+
+		parts := make([]map[string]any, totalParts)
+
+		for partNumber := range partUrls {
+			if utils.IsCanceled(uploadCtx) {
+				break
+			}
+			partUrl := partUrls[partNumber]
+			offset := int64(partNumber-1) * chunkSize
+			sizeToRead := chunkSize
+			if offset+sizeToRead > fileSize {
+				sizeToRead = fileSize - offset
+			}
+
+			var reader io.ReadSeeker
+			g.GoWithLifecycle(errgroup.Lifecycle{
+				Before: func(ctx context.Context) (err error) {
+					reader, err = ss.GetSectionReader(offset, sizeToRead)
+					return
+				},
+				After: func(err error) {
+					ss.FreeSectionReader(reader)
+				},
+				Do: func(ctx context.Context) (err error) {
+					_, err = reader.Seek(0, io.SeekStart)
+					if err != nil {
+						return err
+					}
+					limitedReader := driver.NewLimitedUploadStream(ctx, reader)
+					req, err := http.NewRequestWithContext(ctx, http.MethodPut, partUrl, limitedReader)
+					if err != nil {
+						return err
+					}
+
+					req.ContentLength = sizeToRead
+
+					res, err := base.HttpClient.Do(req)
+					if err != nil {
+						return err
+					}
+					defer res.Body.Close()
+
+					if res.StatusCode != http.StatusOK {
+						return fmt.Errorf("chunk %d failed: %d", partNumber, res.StatusCode)
+					}
+
+					etag := res.Header.Get("ETag")
+					parts[partNumber-1] = map[string]any{"partNumber": partNumber, "etag": etag}
+
+					up(95 * float64(g.Success()+1) / float64(totalParts))
+					return nil
+				},
+			})
+		}
+
+		if err := g.Wait(); err != nil {
+			return nil, err
+		}
+
+		// 合并分片
+		// sort.Slice(parts, func(i, j int) bool { return parts[i]["partNumber"].(int) < parts[j]["partNumber"].(int) })
+		mergeBody, _ := json.Marshal(map[string]any{"oid": getUrlResp.Oid, "parts": parts})
+		mergeReq, err := http.NewRequestWithContext(ctx, http.MethodPost, href, bytes.NewReader(mergeBody))
+		if err != nil {
+			return nil, err
+		}
+		mergeReq.Header.Set("Content-Type", "application/vnd.git-lfs+json")
+		if d.Token != "" {
+			mergeReq.Header.Set("Authorization", "Bearer "+d.Token)
+		}
+
+		res, err := base.HttpClient.Do(mergeReq)
+		if err != nil {
+			return nil, err
+		}
+		defer res.Body.Close()
+		body, _ := io.ReadAll(res.Body) // 读取 HF 返回的错误详情
+		if res.StatusCode != http.StatusOK {
+			log.WithField("status", res.StatusCode).WithField("response", string(body)).Error("HF merge chunks failed")
+			return nil, fmt.Errorf("merge chunks failed: %s", string(body))
+		}
+		up(97)
+
+	} else {
+		// 单文件直传 (PUT)
+		limitedReader := driver.NewLimitedUploadStream(ctx, &driver.ReaderUpdatingProgress{
+			Reader:         file,
+			UpdateProgress: model.UpdateProgressWithRange(up, 0, 97),
+		})
+
+		req, err := http.NewRequestWithContext(ctx, http.MethodPut, href, limitedReader)
+		if err != nil {
+			return nil, err
+		}
+		req.ContentLength = fileSize
+		for k, v := range headers {
+			req.Header.Set(k, v)
+		}
+		res, err := base.HttpClient.Do(req)
+		if err != nil {
+			return nil, err
+		}
+		defer res.Body.Close()
+		if res.StatusCode != http.StatusOK {
+			return nil, fmt.Errorf("direct upload failed")
+		}
+	}
+
+	defer up(100)
+
+	// 3. 通知图床后端完成文件登记
+	return d.hfCommit(ctx, getUrlResp, file.GetName(), fileSize, fileMime, file.ModTime())
+}
+
+func (d *CFImgBed) hfCommit(ctx context.Context, getUrlResp hfGetUrlResp, fileName string, fileSize int64, fileMime string, modTime time.Time) (model.Obj, error) {
+	commitBody := map[string]interface{}{
+		"fullId":      getUrlResp.FullID,
+		"filePath":    getUrlResp.FilePath,
+		"sha256":      getUrlResp.Oid,
+		"fileSize":    fileSize,
+		"fileName":    fileName,
+		"fileType":    fileMime,
+		"channelName": getUrlResp.ChannelName,
+	}
+	var commitResp hfCommitResp
+	_, err := d.doRequest(ctx, http.MethodPost, hfCommitApi, func(req *resty.Request) {
+		req.SetBody(commitBody)
+	}, &commitResp)
+	if err != nil {
+		return nil, fmt.Errorf("HF commit request failed: %w", err)
+	}
+	if !commitResp.Success {
+		return nil, fmt.Errorf("HF commit failed: success=false")
+	}
+
+	srcPath := strings.TrimPrefix(commitResp.Src, "/file/")
+	srcPath = strings.TrimPrefix(srcPath, "/")
+
+	if commitResp.PublicUrl != "" {
+		if u, err := url.Parse(commitResp.PublicUrl); err == nil {
+			d.publicUrlPrefix = u.Scheme + "://" + u.Host
+		}
+	}
+
+	return &model.Object{
+		Path:     srcPath,
+		Name:     fileName,
+		Size:     fileSize,
+		Modified: modTime,
+		IsFolder: false,
+	}, nil
+}
@@ -0,0 +1,70 @@
+package cloudflare_imgbed
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"time"
+
+	"github.com/go-resty/resty/v2"
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	listApi                 = "/api/manage/list"
+	deleteApi               = "/api/manage/delete"
+	uploadApi               = "/upload"
+	hfGetUrlApi             = "/upload/huggingface/getUploadUrl"
+	hfCommitApi             = "/upload/huggingface/commitUpload"
+	hfDirectThreshold int64 = 20 * 1024 * 1024
+	fileSampleSize          = 512 // HF 申请上传地址时需提供文件前 512 字节的 Sample
+)
+
+// doRequest 通用请求封装，包含重试和 API 错误解析
+func (d *CFImgBed) doRequest(ctx context.Context, method, urlPath string, callback func(*resty.Request), resp interface{}) ([]byte, error) {
+	maxRetries := 3
+	for i := 0; i < maxRetries; i++ {
+		req := d.client.R()
+		req.SetContext(ctx)
+		if callback != nil {
+			callback(req)
+		}
+		if resp != nil {
+			req.SetResult(resp)
+		}
+
+		res, err := req.Execute(method, urlPath)
+		if err != nil {
+			log.WithError(err).Warnf("request %s %s failed, attempt %d/%d", method, urlPath, i+1, maxRetries)
+			if i < maxRetries-1 {
+				time.Sleep(time.Duration(i+1) * time.Second)
+				continue
+			}
+			return nil, err
+		}
+
+		// Retry on rate limit before attempting to interpret the body as an API error.
+		if res.StatusCode() == 429 {
+			time.Sleep(time.Duration(i+1) * 2 * time.Second)
+			continue
+		}
+
+		body := res.Body()
+		var apiErr apiError
+		if err := json.Unmarshal(body, &apiErr); err == nil {
+			if apiErr.Error != "" || apiErr.Message != "" {
+				msg := apiErr.Error
+				if msg == "" {
+					msg = apiErr.Message
+				}
+				return nil, fmt.Errorf("API error: %s", msg)
+			}
+		}
+
+		if res.IsError() {
+			return nil, fmt.Errorf("HTTP %d", res.StatusCode())
+		}
+		return body, nil
+	}
+	return nil, fmt.Errorf("max retries exceeded")
+}
@@ -251,7 +251,7 @@ func (d *Crypt) Link(ctx context.Context, file model.Obj, _ model.LinkArgs) (*mo
 	rrf, err := stream.GetRangeReaderFromLink(remoteSize, remoteLink)
 	if err != nil {
 		_ = remoteLink.Close()
-		return nil, fmt.Errorf("the remote storage driver need to be enhanced to support encrytion")
+		return nil, fmt.Errorf("the remote storage driver need to be enhanced to support encryption")
 	}

 	mu := &sync.Mutex{}
@@ -12,6 +12,7 @@ import (
 	"io"
 	"net/http"
 	"net/url"
+	"os"
 	"sort"
 	"strings"
 	"sync"
@@ -300,7 +301,10 @@ func (d *DoubaoNew) Put(ctx context.Context, dstDir model.Obj, file model.FileSt
 	if err != nil {
 		return nil, err
 	}
-	defer tmpFile.Close()
+	defer func() {
+		_ = tmpFile.Close()
+		_ = os.Remove(tmpFile.Name())
+	}()

 	blockSize := uploadPrep.BlockSize
 	totalSize := file.GetSize()
@@ -0,0 +1,261 @@
+package emby
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"path"
+	"strings"
+	"time"
+
+	"github.com/OpenListTeam/OpenList/v4/drivers/base"
+	"github.com/OpenListTeam/OpenList/v4/internal/driver"
+	"github.com/OpenListTeam/OpenList/v4/internal/errs"
+	"github.com/OpenListTeam/OpenList/v4/internal/model"
+	"github.com/OpenListTeam/OpenList/v4/internal/op"
+)
+
+type Emby struct {
+	model.Storage
+	Addition
+
+	client *http.Client
+	token  string
+	userID string
+}
+
+func (d *Emby) Config() driver.Config {
+	return config
+}
+
+func (d *Emby) GetAddition() driver.Additional {
+	return &d.Addition
+}
+
+func (d *Emby) Init(ctx context.Context) error {
+	d.URL = strings.TrimRight(strings.TrimSpace(d.URL), "/")
+	if d.URL == "" {
+		return fmt.Errorf("url is required")
+	}
+
+	if strings.TrimSpace(d.RootFolderID) == "" {
+		d.RootFolderID = "1"
+	}
+
+	d.client = base.HttpClient
+	d.token = strings.TrimSpace(d.ApiKey)
+	d.userID = strings.TrimSpace(d.UserID)
+
+	if d.token != "" {
+		if d.userID == "" {
+			return fmt.Errorf("user_id is required when api_key is set")
+		}
+		op.MustSaveDriverStorage(d)
+		return nil
+	}
+
+	if strings.TrimSpace(d.Username) == "" {
+		return fmt.Errorf("please provide api_key+user_id or username(+password)")
+	}
+
+	if err := d.login(ctx); err != nil {
+		return err
+	}
+
+	d.ApiKey = d.token
+	d.UserID = d.userID
+	op.MustSaveDriverStorage(d)
+	return nil
+}
+
+func (d *Emby) Drop(ctx context.Context) error {
+	return nil
+}
+
+func (d *Emby) List(ctx context.Context, dir model.Obj, args model.ListArgs) ([]model.Obj, error) {
+	parentID := strings.TrimSpace(d.RootFolderID)
+	if dir != nil && strings.TrimSpace(dir.GetID()) != "" {
+		parentID = strings.TrimSpace(dir.GetID())
+	}
+
+	items, err := d.getItems(ctx, parentID)
+	if err != nil {
+		return nil, err
+	}
+
+	parentPath := "/"
+	if dir != nil && strings.TrimSpace(dir.GetPath()) != "" {
+		parentPath = dir.GetPath()
+	}
+
+	objs := make([]model.Obj, 0, len(items.Items))
+	for _, it := range items.Items {
+		modified := time.Now()
+		if it.DateCreated != "" {
+			if t, parseErr := time.Parse(time.RFC3339Nano, it.DateCreated); parseErr == nil {
+				modified = t
+			}
+		}
+
+		name := strings.TrimSpace(it.Name)
+		id := strings.TrimSpace(it.ID)
+		displayName := name
+		if name != "" && id != "" {
+			if it.IsFolder {
+				displayName = fmt.Sprintf("%s (ID%s)", name, id)
+			} else {
+				ext := path.Ext(strings.TrimSpace(it.Path))
+				if ext == "" {
+					ext = path.Ext(name)
+				}
+
+				base := strings.TrimSpace(strings.TrimSuffix(name, ext))
+				episodeCode := ""
+				if m := episodeCodeRegexp.FindString(base); m != "" {
+					episodeCode = strings.ToUpper(m)
+				} else if it.ParentIndex > 0 && it.IndexNumber > 0 {
+					episodeCode = fmt.Sprintf("S%02dE%02d", it.ParentIndex, it.IndexNumber)
+				}
+
+				title := strings.TrimSpace(base)
+				if episodeCode != "" {
+					title = strings.TrimSpace(episodeCodeRegexp.ReplaceAllString(title, ""))
+					title = strings.TrimSpace(strings.Trim(title, "-_:[]() "))
+				}
+
+				series := strings.TrimSpace(it.SeriesName)
+				if series == "" && episodeCode != "" {
+					if idx := strings.Index(title, " - "); idx > 0 {
+						series = strings.TrimSpace(title[:idx])
+						title = strings.TrimSpace(title[idx+3:])
+					}
+				}
+
+				core := title
+				if series != "" {
+					if title == "" || strings.EqualFold(series, title) {
+						core = series
+					} else {
+						core = series + " " + title
+					}
+				}
+				if core == "" {
+					core = base
+				}
+
+				if episodeCode != "" {
+					core = fmt.Sprintf("%s - [%s]", core, episodeCode)
+				}
+				if ext == "" {
+					displayName = fmt.Sprintf("%s (ID%s)", core, id)
+				} else {
+					displayName = fmt.Sprintf("%s (ID%s)%s", core, id, ext)
+				}
+			}
+		}
+
+		obj := &model.Object{
+			ID:       id,
+			Name:     displayName,
+			Path:     path.Join(parentPath, displayName),
+			Size:     it.Size,
+			Modified: modified,
+			IsFolder: it.IsFolder,
+		}
+		if it.IsFolder {
+			obj.Size = 0
+		}
+		objs = append(objs, obj)
+	}
+	return objs, nil
+}
+
+func (d *Emby) Link(ctx context.Context, file model.Obj, args model.LinkArgs) (*model.Link, error) {
+	if file.IsDir() {
+		return nil, errs.NotFile
+	}
+	fileID := strings.TrimSpace(file.GetID())
+	if fileID == "" {
+		return nil, fmt.Errorf("invalid file id")
+	}
+
+	u, err := url.Parse(d.URL)
+	if err != nil {
+		return nil, err
+	}
+	linkMethod := strings.ToLower(strings.TrimSpace(d.LinkMethod))
+	useDownload := linkMethod == "download"
+
+	mediaSourceID := ""
+	mediaContainer := ""
+	if !useDownload {
+		detailURL, parseErr := url.Parse(d.URL + "/Users/" + d.userID + "/Items/" + fileID)
+		if parseErr == nil {
+			q := detailURL.Query()
+			q.Set("Fields", "MediaSources")
+			q.Set("api_key", d.token)
+			detailURL.RawQuery = q.Encode()
+
+			req, reqErr := http.NewRequestWithContext(ctx, http.MethodGet, detailURL.String(), nil)
+			if reqErr == nil {
+				resp, doErr := d.client.Do(req)
+				if doErr == nil {
+					func() {
+						defer resp.Body.Close()
+						if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+							return
+						}
+						var detail itemDetailResp
+						if decodeErr := json.NewDecoder(resp.Body).Decode(&detail); decodeErr != nil || len(detail.MediaSources) == 0 {
+							return
+						}
+						for i := range detail.MediaSources {
+							if strings.TrimSpace(detail.MediaSources[i].ID) != "" && detail.MediaSources[i].SupportsDirectStream {
+								mediaSourceID = strings.TrimSpace(detail.MediaSources[i].ID)
+								mediaContainer = strings.TrimSpace(detail.MediaSources[i].Container)
+								return
+							}
+						}
+						for i := range detail.MediaSources {
+							if strings.TrimSpace(detail.MediaSources[i].ID) != "" {
+								mediaSourceID = strings.TrimSpace(detail.MediaSources[i].ID)
+								mediaContainer = strings.TrimSpace(detail.MediaSources[i].Container)
+								return
+							}
+						}
+					}()
+				}
+			}
+		}
+	}
+
+	if useDownload {
+		u.Path = path.Join(u.Path, "/Items", fileID, "Download")
+	} else {
+		if mediaContainer != "" {
+			u.Path = path.Join(u.Path, "/Videos", fileID, "stream."+mediaContainer)
+		} else {
+			u.Path = path.Join(u.Path, "/Videos", fileID, "stream")
+		}
+	}
+	q := u.Query()
+	q.Set("api_key", d.token)
+	if mediaSourceID != "" {
+		q.Set("MediaSourceId", mediaSourceID)
+	}
+	if !useDownload {
+		q.Set("Static", "true")
+	}
+	u.RawQuery = q.Encode()
+
+	return &model.Link{
+		URL: u.String(),
+		Header: http.Header{
+			"User-Agent": []string{base.UserAgent},
+		},
+	}, nil
+}
+
+var _ driver.Driver = (*Emby)(nil)
@@ -0,0 +1,30 @@
+package emby
+
+import (
+	"github.com/OpenListTeam/OpenList/v4/internal/driver"
+	"github.com/OpenListTeam/OpenList/v4/internal/op"
+)
+
+type Addition struct {
+	driver.RootID
+	URL        string `json:"url" required:"true"`
+	ApiKey     string `json:"api_key"`
+	UserID     string `json:"user_id"`
+	Username   string `json:"username"`
+	Password   string `json:"password"`
+	LinkMethod string `json:"link_method" type:"select" options:"stream,download" default:"stream"`
+}
+
+var config = driver.Config{
+	Name:        "Emby",
+	LocalSort:   true,
+	NoUpload:    true,
+	DefaultRoot: "1",
+	CheckStatus: true,
+}
+
+func init() {
+	op.RegisterDriver(func() driver.Driver {
+		return &Emby{}
+	})
+}
@@ -0,0 +1,41 @@
+package emby
+
+type authReq struct {
+	Username string `json:"Username"`
+	Pw       string `json:"Pw"`
+}
+
+type authResp struct {
+	AccessToken string `json:"AccessToken"`
+	User        struct {
+		ID string `json:"Id"`
+	} `json:"User"`
+}
+
+type listResp struct {
+	Items            []embyItem `json:"Items"`
+	TotalRecordCount int        `json:"TotalRecordCount"`
+}
+
+type embyItem struct {
+	Name        string `json:"Name"`
+	ID          string `json:"Id"`
+	Type        string `json:"Type"`
+	Path        string `json:"Path"`
+	SeriesName  string `json:"SeriesName"`
+	IndexNumber int    `json:"IndexNumber"`
+	ParentIndex int    `json:"ParentIndexNumber"`
+	IsFolder    bool   `json:"IsFolder"`
+	Size        int64  `json:"Size"`
+	DateCreated string `json:"DateCreated"`
+}
+
+type itemDetailResp struct {
+	MediaSources []embyMediaSource `json:"MediaSources"`
+}
+
+type embyMediaSource struct {
+	ID                   string `json:"Id"`
+	Container            string `json:"Container"`
+	SupportsDirectStream bool   `json:"SupportsDirectStream"`
+}
@@ -0,0 +1,91 @@
+package emby
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"regexp"
+	"strings"
+)
+
+var episodeCodeRegexp = regexp.MustCompile(`(?i)\bS\d{1,2}E\d{1,2}\b`)
+
+func (d *Emby) login(ctx context.Context) error {
+	payload, err := json.Marshal(authReq{
+		Username: d.Username,
+		Pw:       d.Password,
+	})
+	if err != nil {
+		return err
+	}
+
+	endpoint := d.URL + "/Users/AuthenticateByName"
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(payload))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("X-Emby-Authorization", `MediaBrowser Client="OpenList", Device="OpenList", DeviceId="openlist-emby", Version="1.0.0"`)
+
+	resp, err := d.client.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		body, _ := io.ReadAll(resp.Body)
+		return fmt.Errorf("emby auth failed: status=%d body=%s", resp.StatusCode, strings.TrimSpace(string(body)))
+	}
+
+	var data authResp
+	if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
+		return err
+	}
+	if strings.TrimSpace(data.AccessToken) == "" || strings.TrimSpace(data.User.ID) == "" {
+		return fmt.Errorf("emby auth response missing access token or user id")
+	}
+
+	d.token = data.AccessToken
+	d.userID = data.User.ID
+	return nil
+}
+
+func (d *Emby) getItems(ctx context.Context, parentID string) (*listResp, error) {
+	u, err := url.Parse(d.URL + "/Users/" + d.userID + "/Items")
+	if err != nil {
+		return nil, err
+	}
+	q := u.Query()
+	q.Set("ParentId", parentID)
+	q.Set("Recursive", "false")
+	q.Set("Fields", "Path,Size,DateCreated,SeriesName,IndexNumber,ParentIndexNumber")
+	q.Set("api_key", d.token)
+	u.RawQuery = q.Encode()
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	resp, err := d.client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		body, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("emby list failed: status=%d body=%s", resp.StatusCode, strings.TrimSpace(string(body)))
+	}
+
+	var data listResp
+	if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
+		return nil, err
+	}
+	return &data, nil
+}
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"io"
 	stdpath "path"
+	"strings"

 	"github.com/OpenListTeam/OpenList/v4/internal/driver"
 	"github.com/OpenListTeam/OpenList/v4/internal/errs"
@@ -51,13 +52,35 @@ func (d *FTP) List(ctx context.Context, dir model.Obj, args model.ListArgs) ([]m
 	if err := d.login(); err != nil {
 		return nil, err
 	}
-	entries, err := d.conn.List(encode(dir.GetPath(), d.Encoding))
+
+	path := encode(dir.GetPath(), d.Encoding)
+
+	var entries []*ftp.Entry
+	var err error
+
+	if d.CwdList {
+		origDir, cwdErr := d.conn.CurrentDir()
+		if cwdErr != nil {
+			return nil, cwdErr
+		}
+		if cwdErr = d.conn.ChangeDir(path); cwdErr != nil {
+			return nil, cwdErr
+		}
+		entries, err = d.conn.List("")
+		if restoreErr := d.conn.ChangeDir(origDir); restoreErr != nil {
+			d.conn = nil
+		}
+	} else {
+		entries, err = d.conn.List(path)
+	}
+
 	if err != nil {
 		return nil, err
 	}
+
 	res := make([]model.Obj, 0)
 	for _, entry := range entries {
-		if entry.Name == "." || entry.Name == ".." {
+		if entry.Name == "." || entry.Name == ".." || strings.Contains(entry.Name, "/") {
 			continue
 		}
 		name := decode(entry.Name, d.Encoding)
--- a/Show More
+++ b/Show More