diff --git a/Cargo.lock b/Cargo.lock
index 1da15a9..9379b2d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -413,6 +413,7 @@ dependencies = [
  "serde_json",
  "serde_urlencoded",
  "serde_yaml",
+ "tempfile",
  "thiserror 2.0.18",
  "time",
  "tokio",
@@ -476,6 +477,7 @@ dependencies = [
  "tower-sessions",
  "tower-sessions-sqlx-store",
  "tracing",
+ "tracing-appender",
  "tracing-subscriber",
  "url",
  "urlencoding",
diff --git a/Cargo.toml b/Cargo.toml
index 44bf7b0..614796a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -20,7 +20,7 @@ bytes = "1.10.1"
 rand = "0.8"
 serde_urlencoded = "0.7"
 
-tokio = { version = "1", features = ["macros", "rt-multi-thread", "process", "signal"] }
+tokio = { version = "1", features = ["macros", "rt-multi-thread", "process", "signal", "sync"] }
 futures = "0.3.31"
 async-trait = "0.1.87"
 
diff --git a/app/(app)/archives/page.tsx b/app/(app)/archives/page.tsx
new file mode 100644
index 0000000..8990dfe
--- /dev/null
+++ b/app/(app)/archives/page.tsx
@@ -0,0 +1,134 @@
+'use client'
+
+import { BiliArchive, BiliArchivePage, fetcher } from '@/app/lib/api-streamer'
+import { humDate } from '@/app/lib/utils'
+import { useBiliUsers } from '@/app/lib/use-streamers'
+import { IconUserCardVideo } from '@douyinfe/semi-icons'
+import { Banner, Layout, Nav, Pagination, Select, Table, Typography } from '@douyinfe/semi-ui'
+import { useState } from 'react'
+import useSWR from 'swr'
+
+const statusOptions = [
+  { label: '全部状态', value: 'all' },
+  { label: '审核中', value: 'is_pubing' },
+  { label: '已通过', value: 'pubed' },
+  { label: '未通过', value: 'not_pubed' },
+]
+
+export default function ArchivesPage() {
+  const { Header, Content } = Layout
+  const { Text } = Typography
+  const { biliUsers, isLoading: usersLoading } = useBiliUsers()
+  const [userId, setUserId] = useState<number>()
+  const [status, setStatus] = useState('all')
+  const [pageNumber, setPageNumber] = useState(1)
+  const key = userId
+    ? `/v1/users/${userId}/archives?status=${status}&from_page=${pageNumber}&max_pages=1`
+    : null
+  const { data, error, isLoading } = useSWR<BiliArchivePage>(key, fetcher)
+
+  const columns = [
+    {
+      title: 'BV号',
+      dataIndex: 'bvid',
+      render: (bvid: string) => (
+        <a href={`https://www.bilibili.com/video/${bvid}`} target="_blank" rel="noreferrer">
+          {bvid}
+        </a>
+      ),
+    },
+    {
+      title: '标题',
+      dataIndex: 'title',
+      render: (title: string) => <Text strong>{title}</Text>,
+    },
+    {
+      title: '状态',
+      dataIndex: 'state_desc',
+      render: (stateDescription: string, archive: BiliArchive) =>
+        archive.reject_reason || stateDescription || `状态 ${archive.state}`,
+    },
+    {
+      title: '时长',
+      dataIndex: 'duration',
+      render: (duration: number) => `${Math.floor(duration / 60)}:${String(duration % 60).padStart(2, '0')}`,
+    },
+    {
+      title: '发布时间',
+      dataIndex: 'ptime',
+      render: (ptime: number, archive: BiliArchive) => {
+        const timestamp = ptime || archive.ctime
+        return timestamp ? humDate(timestamp) : '-'
+      },
+    },
+  ]
+
+  return (
+    <>
+      <Header style={{ backgroundColor: 'var(--semi-color-bg-1)' }}>
+        <Nav
+          style={{ border: 'none' }}
+          header={
+            <>
+              <IconUserCardVideo size="large" />
+              <h4 style={{ marginLeft: 12 }}>B站稿件</h4>
+            </>
+          }
+          mode="horizontal"
+        />
+      </Header>
+      <Content style={{ padding: 24, backgroundColor: 'var(--semi-color-bg-0)' }}>
+        <div style={{ display: 'flex', gap: 12, flexWrap: 'wrap', marginBottom: 20 }}>
+          <Select
+            placeholder="请选择 B 站账号"
+            loading={usersLoading}
+            value={userId}
+            style={{ minWidth: 260 }}
+            onChange={value => {
+              setUserId(Number(value))
+              setPageNumber(1)
+            }}
+          >
+            {biliUsers.map(user => (
+              <Select.Option key={user.id} value={user.id}>
+                {user.name}
+              </Select.Option>
+            ))}
+          </Select>
+          <Select
+            value={status}
+            optionList={statusOptions}
+            onChange={value => {
+              setStatus(String(value))
+              setPageNumber(1)
+            }}
+          />
+        </div>
+
+        {!userId && <Banner type="info" description="请先明确选择一个账号，再读取该账号的远程稿件。" />}
+        {error && <Banner type="danger" description={error.message || '读取稿件失败'} />}
+        {userId && (
+          <>
+            <Table
+              rowKey="aid"
+              size="small"
+              loading={isLoading}
+              columns={columns}
+              dataSource={data?.archives ?? []}
+              pagination={false}
+            />
+            {!!data && data.total > 0 && (
+              <Pagination
+                style={{ marginTop: 16, justifyContent: 'flex-end' }}
+                currentPage={pageNumber}
+                pageSize={data.page_size}
+                total={data.total}
+                onPageChange={setPageNumber}
+              />
+            )}
+          </>
+        )}
+      </Content>
+    </>
+  )
+}
diff --git a/app/(app)/layout.tsx b/app/(app)/layout.tsx
index 28218c3..ace5950 100644
--- a/app/(app)/layout.tsx
+++ b/app/(app)/layout.tsx
@@ -16,6 +16,7 @@ import {
     IconHome,
     IconSetting,
     IconHistory,
+    IconUserCardVideo,
 } from '@douyinfe/semi-icons'
 import Image from 'next/image'
 import ThemeButton from '../ui/ThemeButton'
@@ -109,6 +110,23 @@ export default function Layout({ children }: { children: React.ReactNode }) {
                         </div>
                     ),
                 },
+                {
+                    itemKey: 'archives',
+                    text: 'B站稿件',
+                    icon: (
+                        <div
+                            style={{
+                                backgroundColor: '#00a1d6',
+                                borderRadius: 'var(--semi-border-radius-medium)',
+                                color: 'var(--semi-color-bg-0)',
+                                display: 'flex',
+                                padding: '4px',
+                            }}
+                        >
+                            <IconUserCardVideo size="small" />
+                        </div>
+                    ),
+                },
                 {
                     itemKey: 'dashboard',
                     text: '空间配置',
@@ -207,6 +225,7 @@ export default function Layout({ children }: { children: React.ReactNode }) {
             dashboard: '/dashboard',
             streamers: '/streamers',
             'upload-manager': '/upload-manager',
+            archives: '/archives',
             job: '/job',
             status: '/status',
             logViewer: '/logviewer',
diff --git a/app/(app)/upload-manager/page.tsx b/app/(app)/upload-manager/page.tsx
index 82b0d11..4ce02ba 100644
--- a/app/(app)/upload-manager/page.tsx
+++ b/app/(app)/upload-manager/page.tsx
@@ -66,8 +66,8 @@ export default function Union() {
   const handleOk = async () => {
     await sendRequest('/v1/uploads', {
       arg: {
-        files: selectFiles,
-        params: selectEntity,
+        files: selectFiles.map(String),
+        template_id: selectEntity?.id,
       },
     })
     setVisibleModal(false)
diff --git a/app/(auth)/login/page.jsx b/app/(auth)/login/page.jsx
index eb567a5..db17f35 100644
--- a/app/(auth)/login/page.jsx
+++ b/app/(auth)/login/page.jsx
@@ -55,14 +55,25 @@ const Component = () => {
 
             if (response.ok) {
                 Toast.success(isRegisterMode ? '注册成功' : '登录成功');
-                // 获取当前 URL 的查询参数
                 const urlParams = new URLSearchParams(window.location.search);
-                // 获取 next 参数的值
                 const nextPath = urlParams.get('next');
                 if (nextPath) {
-                    window.location.href = decodeURIComponent(nextPath); // 解码 %2F 等转义字符
+                    try {
+                        // URLSearchParams has already decoded the value. Only
+                        // allow a same-origin destination so a crafted login URL
+                        // cannot become an open redirect after authentication.
+                        const destination = new URL(nextPath, window.location.origin);
+                        if (destination.origin === window.location.origin) {
+                            window.location.assign(
+                                `${destination.pathname}${destination.search}${destination.hash}`
+                            );
+                            return;
+                        }
+                    } catch {
+                        // Fall through to the safe default route.
+                    }
                 }
-                // router.push('/');
+                window.location.assign('/');
             } else {
                 const result = await response.json();
                 Toast.error(result.message || (isRegisterMode ? '注册失败' : '登录失败'));
diff --git a/app/lib/api-streamer.ts b/app/lib/api-streamer.ts
index b3880f8..f7daead 100644
--- a/app/lib/api-streamer.ts
+++ b/app/lib/api-streamer.ts
@@ -128,6 +128,31 @@ export interface User {
 	platform: string;
 }
 
+export interface BiliArchive {
+	aid: number;
+	bvid: string;
+	title: string;
+	cover: string;
+	reject_reason: string;
+	reject_reason_url: string;
+	duration: number;
+	desc: string;
+	state: number;
+	state_desc: string;
+	dtime: number;
+	ptime: number;
+	ctime: number;
+}
+
+export interface BiliArchivePage {
+	from_page: number;
+	page_size: number;
+	total: number;
+	total_pages: number;
+	fetched_pages: number;
+	archives: BiliArchive[];
+}
+
 export interface FileList {
 	key: number;
 	name: string;
diff --git a/app/lib/use-streamers.ts b/app/lib/use-streamers.ts
index 34cb438..88ce083 100644
--- a/app/lib/use-streamers.ts
+++ b/app/lib/use-streamers.ts
@@ -3,7 +3,7 @@ import useSWR from "swr";
 import {
   BiliType,
   fetcher,
-  LiveStreamerEntity, proxy,
+  LiveStreamerEntity,
   User
 } from "./api-streamer";
 import {useEffect, useState} from "react";
@@ -28,23 +28,18 @@ export function useBiliUsers() {
     }
     const updateList = async (item: User) => {
       try {
-        const res = await fetcher(`/bili/space/myinfo?user=${item.value}`, undefined);
-        const pRes = await proxy(`/bili/proxy?url=${res.data?.face}`);
-        const myBlob = await pRes.blob();
-
+        const res = await fetcher(`/v1/users/${item.id}`, undefined);
         return {
           ...item,
           name: res.data.name,
-          face: URL.createObjectURL(myBlob),
+          face: res.data?.face || "/noface.jpg",
         };
       } catch (error) {
         console.error(error);
-        const pRes = await proxy("/bili/proxy?url=https://i0.hdslb.com/bfs/face/member/noface.jpg");
-        const myBlob = await pRes.blob();
         return {
           ...item,
           name: "Cookie已失效",
-          face: URL.createObjectURL(myBlob),
+          face: "/noface.jpg",
         };
       }
     };
diff --git a/app/ui/AvatarCard/index.tsx b/app/ui/AvatarCard/index.tsx
index 78d4834..f4d9e2f 100644
--- a/app/ui/AvatarCard/index.tsx
+++ b/app/ui/AvatarCard/index.tsx
@@ -21,8 +21,8 @@ const AvatarCard: React.FC<ICardProps> = ({ abbr, label, value, onRemove, url })
       <div className={styles.email}>{value}</div>
     </div>
     <Popconfirm
-      title="确定是否要删除？"
-      content="此操作将不可逆"
+      title="删除这个 B 站账号？"
+      content="若没有上传模板或其他账号记录引用同一凭据，服务器还会物理删除本地凭据文件。此操作不可逆。"
       onConfirm={onRemove}
       // onCancel={onCancel}
     >
diff --git a/app/ui/UserList.tsx b/app/ui/UserList.tsx
index 5714796..c837e43 100644
--- a/app/ui/UserList.tsx
+++ b/app/ui/UserList.tsx
@@ -1,15 +1,8 @@
-import React, { useEffect, useRef, useState } from 'react'
+import React, { useRef, useState } from 'react'
 import {
-  fetcher,
-  LiveStreamerEntity,
-  proxy,
   requestDelete,
   sendRequest,
-  StudioEntity,
-  User,
 } from '../lib/api-streamer'
-import useSWR from 'swr'
-import { useRouter } from 'next/router'
 import {
   Button,
   Form,
@@ -50,16 +43,7 @@ const UserList: React.FC<UserListProps> = ({ onCancel, visible }) => {
   const addUser = async (value: any) => {
     setConfirmLoading(true)
     try {
-      const ret = await fetcher(`/bili/space/myinfo?user=${value}`, undefined)
-      if (ret.code) {
-        throw new Error(ret.message)
-      }
       await trigger({
-        // id: 0,
-        // name: value,
-        // value: value,
-        // platform: 'bilibili-cookies',
-        key: 'bilibili-cookies',
         value: value
       })
       setVisible(false)
diff --git a/biliup/plugins/bili_webup.py b/biliup/plugins/bili_webup.py
index d43218c..0ac978a 100644
--- a/biliup/plugins/bili_webup.py
+++ b/biliup/plugins/bili_webup.py
@@ -28,6 +28,13 @@ from typing import NamedTuple
 logger = logging.getLogger('biliup')
 
 
+def _safe_response_status(response):
+    """Return only fixed, non-credential status fields for logging."""
+    if not isinstance(response, dict):
+        return {"type": type(response).__name__}
+    return {key: response[key] for key in ("code", "OK") if key in response}
+
+
 class FileInfo(NamedTuple):
     video: str
     danmaku: Optional[str] = None
@@ -135,7 +142,7 @@ class BiliWeb:
             if self.cover_path:
                 video.cover = bili.cover_up(self.cover_path).replace('http:', '')
             ret = bili.submit(self.submit_api)  # 提交视频
-        logger.info(f"上传成功: {ret}")
+        logger.info("上传成功: %s", _safe_response_status(ret))
         return file_list
 
     def creditsToDesc_v2(self):
@@ -325,7 +332,7 @@ class BiliBili:
                                        data={**payload, 'sign': self.sign(parse.urlencode(payload))})
         r = response.json()
         if r['code'] != 0 or r.get('data') is None or r['data'].get('cookie_info') is None:
-            raise RuntimeError(r)
+            raise RuntimeError(f"password login failed: {_safe_response_status(r)}")
         try:
             for cookie in r['data']['cookie_info']['cookies']:
                 self.__session.cookies.set(cookie['name'], cookie['value'])
@@ -334,8 +341,10 @@ class BiliBili:
             self.cookies = self.__session.cookies.get_dict()
             self.access_token = r['data']['token_info']['access_token']
             self.refresh_token = r['data']['token_info']['refresh_token']
-        except:
-            raise RuntimeError(r)
+        except Exception as error:
+            raise RuntimeError(
+                f"password login response was incomplete: {_safe_response_status(r)}"
+            ) from error
         return r
 
     def login_by_cookies(self, cookie):
@@ -346,7 +355,7 @@ class BiliBili:
             self.__bili_jct = cookies_dict['bili_jct']
         data = self.__session.get("https://api.bilibili.com/x/web-interface/nav", timeout=5).json()
         if data["code"] != 0:
-            raise Exception(data)
+            raise RuntimeError(f"cookie login failed: {_safe_response_status(data)}")
         print('使用cookies上传')
 
     def sign(self, param):
@@ -454,7 +463,11 @@ class BiliBili:
                 f"https://member.bilibili.com/preupload?{self._auto_os['query']}", params=query,
                 timeout=5)
             ret = resp.json()
-            logger.debug(f"preupload: {ret}")
+            logger.debug(
+                "preupload response accepted: storage=%s chunk_size=%s",
+                self._auto_os['os'],
+                ret.get('chunk_size'),
+            )
             if preferred_upos_cdn:
                 original_endpoint: str = ret['endpoint']
                 if re.match(r'//upos-(sz|cs)-upcdnbda2\.bilivideo\.com', original_endpoint):
@@ -525,7 +538,7 @@ class BiliBili:
                                           timeout=15)
                 if res.status_code == 200:
                     break
-                raise IOError(res.text)
+                raise IOError(f"merge request failed with HTTP {res.status_code}")
             except IOError:
                 ii += 1
                 logger.info("请求合并分片出现问题，尝试重连，次数：" + str(ii))
@@ -535,9 +548,9 @@ class BiliBili:
             try:
                 res = self.__session.post("https:" + ret["fetch_url"], headers=fetch_headers, timeout=15).json()
                 if res.get('OK') == 1:
-                    logger.info(f'{filename} uploaded >> {total_size / 1000 / 1000 / cost:.2f}MB/s. {res}')
+                    logger.info(f'{filename} uploaded >> {total_size / 1000 / 1000 / cost:.2f}MB/s')
                     return {"title": splitext(os.path.basename(filename))[0], "filename": ret["bili_filename"], "desc": ""}
-                raise IOError(res)
+                raise IOError(f"fetch failed: {_safe_response_status(res)}")
             except IOError:
                 ii += 1
                 logger.info("上传出现问题，尝试重连，次数：" + str(ii))
@@ -578,7 +591,7 @@ class BiliBili:
                             data=','.join(map(lambda x: x['ctx'], parts)), headers=headers, timeout=10)
         r = self.__session.post(f"https:{fetch_url}", headers=fetch_headers, timeout=5).json()
         if r["OK"] != 1:
-            raise Exception(r)
+            raise RuntimeError(f"Kodo fetch failed: {_safe_response_status(r)}")
         return {"title": splitext(os.path.basename(filename))[0], "filename": bili_filename, "desc": ""}
 
     async def upos(self, file, total_size, ret, tasks=3):
@@ -626,9 +639,9 @@ class BiliBili:
             try:
                 r = self.__session.post(url, params=p, json={"parts": parts}, headers=headers, timeout=15).json()
                 if r.get('OK') == 1:
-                    logger.info(f'{filename} uploaded >> {total_size / 1000 / 1000 / cost:.2f}MB/s. {r}')
+                    logger.info(f'{filename} uploaded >> {total_size / 1000 / 1000 / cost:.2f}MB/s')
                     return {"title": splitext(os.path.basename(filename))[0], "filename": splitext(basename(upos_uri))[0], "desc": ""}
-                raise IOError(r)
+                raise IOError(f"UPOS merge failed: {_safe_response_status(r)}")
             except IOError:
                 attempt += 1
                 logger.info(f"请求合并分片时出现问题，尝试重连，次数：" + str(attempt))
@@ -653,8 +666,13 @@ class BiliBili:
                     try:
                         await afunc(session, chunks_data, clone)
                         break
-                    except (asyncio.TimeoutError, aiohttp.ClientError) as e:
-                        logger.error(f"retry chunk{clone['chunk']} >> {i + 1}. {e}")
+                    except (asyncio.TimeoutError, aiohttp.ClientError) as error:
+                        logger.error(
+                            "retry chunk%s >> %s (%s)",
+                            clone['chunk'],
+                            i + 1,
+                            type(error).__name__,
+                        )
 
         async with aiohttp.ClientSession() as session:
             await asyncio.gather(*[upload_chunk() for _ in range(tasks)])
@@ -667,7 +685,7 @@ class BiliBili:
         if submit_api is None:
             total_info = self.__session.get('http://api.bilibili.com/x/space/myinfo', timeout=15).json()
             if total_info.get('data') is None:
-                logger.error(total_info)
+                logger.error("用户信息接口未返回 data: %s", _safe_response_status(total_info))
             total_info = total_info.get('data')
             if total_info['level'] > 3 and total_info['follower'] > 1000:
                 user_weight = 2
@@ -679,8 +697,8 @@ class BiliBili:
         if submit_api == 'web':
             ret = self.submit_web()
             if ret["code"] != 0:
-                logger.error(f'网页端接口提交失败: {ret}')
-                raise Exception(ret)
+                logger.error("网页端接口提交失败: %s", _safe_response_status(ret))
+                raise RuntimeError(f"网页端接口提交失败: {_safe_response_status(ret)}")
         if not ret:
             raise Exception(f'不存在的选项：{submit_api}')
         return ret
@@ -701,7 +719,7 @@ class BiliBili:
             ret = self.__session.post(f'http://member.bilibili.com/x/vu/client/add?access_key={self.access_token}',
                                       timeout=5, json=asdict(self.video)).json()
             if ret['code'] == -101:
-                logger.info(f'刷新token{ret}')
+                logger.info("客户端登录状态失效，正在刷新凭据: %s", _safe_response_status(ret))
                 self.login_by_password(**config['user']['account'])
                 self.store()
                 continue
@@ -736,7 +754,7 @@ class BiliBili:
         buffered.close()
         res = r.json()
         if res.get('data') is None:
-            raise Exception(res)
+            raise RuntimeError(f"cover upload failed: {_safe_response_status(res)}")
         return res['data']['url']
 
     def get_tags(self, upvideo, typeid="", desc="", cover="", groupid=1, vfea=""):
@@ -802,7 +820,7 @@ class BiliBili:
             timeout=10
         ).json()
         if r['code'] != 0:
-            raise Exception(r)
+            raise RuntimeError(f"list seasons failed: {_safe_response_status(r)}")
         return r['data']
 
     def get_season_section(self, section_id, sort=''):
@@ -827,7 +845,7 @@ class BiliBili:
             params=params, timeout=10
         ).json()
         if r['code'] != 0:
-            raise Exception(r)
+            raise RuntimeError(f"get season section failed: {_safe_response_status(r)}")
         return r['data']
 
     def get_video_info(self, aid):
@@ -842,7 +860,7 @@ class BiliBili:
             params={'aid': aid}, timeout=10
         ).json()
         if r['code'] != 0:
-            raise Exception(r)
+            raise RuntimeError(f"get video info failed: {_safe_response_status(r)}")
         return r['data']
 
     def add_to_season(self, section_id, episodes):
@@ -878,7 +896,7 @@ class BiliBili:
             timeout=10
         ).json()
         if r['code'] != 0:
-            raise Exception(r)
+            raise RuntimeError(f"add to season failed: {_safe_response_status(r)}")
         return r
 
     def remove_from_season(self, episode_id):
@@ -901,7 +919,7 @@ class BiliBili:
             timeout=10
         ).json()
         if r['code'] != 0:
-            raise Exception(r)
+            raise RuntimeError(f"remove from season failed: {_safe_response_status(r)}")
         return r
 
     def sort_season_episodes(self, section_id, season_id, sorts, section_title='正片'):
@@ -945,7 +963,7 @@ class BiliBili:
             timeout=15
         ).json()
         if r['code'] != 0:
-            raise Exception(r)
+            raise RuntimeError(f"sort season episodes failed: {_safe_response_status(r)}")
         return r
 
     def __enter__(self):
diff --git a/biliup/plugins/bili_webup_sync.py b/biliup/plugins/bili_webup_sync.py
index bfcd6a6..3a25e25 100644
--- a/biliup/plugins/bili_webup_sync.py
+++ b/biliup/plugins/bili_webup_sync.py
@@ -32,6 +32,13 @@ from requests.adapters import HTTPAdapter, Retry
 logger = logging.getLogger('biliup.engine.bili_web_sync')
 
 
+def _safe_response_status(response):
+    """Return only fixed, non-credential status fields for logging."""
+    if not isinstance(response, dict):
+        return {"type": type(response).__name__}
+    return {key: response[key] for key in ("code", "OK") if key in response}
+
+
 class FileInfo(NamedTuple):
     video: str
     danmaku: Optional[str] = None
@@ -298,7 +305,7 @@ class BiliBili:
                                        data={**payload, 'sign': self.sign(parse.urlencode(payload))})
         r = response.json()
         if r['code'] != 0 or r.get('data') is None or r['data'].get('cookie_info') is None:
-            raise RuntimeError(r)
+            raise RuntimeError(f"password login failed: {_safe_response_status(r)}")
         try:
             for cookie in r['data']['cookie_info']['cookies']:
                 self.__session.cookies.set(cookie['name'], cookie['value'])
@@ -307,8 +314,10 @@ class BiliBili:
             self.cookies = self.__session.cookies.get_dict()
             self.access_token = r['data']['token_info']['access_token']
             self.refresh_token = r['data']['token_info']['refresh_token']
-        except:
-            raise RuntimeError(r)
+        except Exception as error:
+            raise RuntimeError(
+                f"password login response was incomplete: {_safe_response_status(r)}"
+            ) from error
         return r
 
     def login_by_cookies(self, cookie):
@@ -318,7 +327,7 @@ class BiliBili:
             self.__bili_jct = cookies_dict['bili_jct']
         data = self.__session.get("https://api.bilibili.com/x/web-interface/nav", timeout=5).json()
         if data["code"] != 0:
-            raise Exception(data)
+            raise RuntimeError(f"cookie login failed: {_safe_response_status(data)}")
         print('使用cookies上传')
 
     def sign(self, param):
@@ -426,7 +435,11 @@ class BiliBili:
         if "chunk_size" not in ret:
             stop_event.set()
             return
-        logger.debug(f"preupload: {ret}")
+        logger.debug(
+            "preupload response accepted: storage=%s chunk_size=%s",
+            self._auto_os['os'],
+            ret.get('chunk_size'),
+        )
         if preferred_upos_cdn:
             # 如果返回的endpoint不在probe_url中，则尝试在endpoints中校验probe_url是否可用
             if ret['endpoint'] not in self._auto_os['probe_url']:
@@ -454,9 +467,9 @@ class BiliBili:
         ret = self.submit(submit_api=submit_api, edit=edit, videos=videos)
         # logger.info(f"上传成功: {ret}")
         if edit:
-            logger.info(f"编辑添加成功: {ret}")
+            logger.info("编辑添加成功: %s", _safe_response_status(ret))
         else:
-            logger.info(f"上传成功: {ret}")
+            logger.info("上传成功: %s", _safe_response_status(ret))
         aid = ret['data']['aid']
         videos.aid = aid
         context['sync_downloader_map'][str(self.database_row_id)] = videos.__dict__
@@ -549,9 +562,9 @@ class BiliBili:
             try:
                 r = self.__session.post(url, params=p, json={"parts": parts}, headers=headers, timeout=15).json()
                 if r.get('OK') == 1:
-                    logger.info(f'{file_name} uploaded >> {total_size / 1000 / 1000 / cost:.2f}MB/s. {r}')
+                    logger.info(f'{file_name} uploaded >> {total_size / 1000 / 1000 / cost:.2f}MB/s')
                     return {"title": splitext(file_name)[0], "filename": splitext(basename(upos_uri))[0], "desc": ""}
-                raise IOError(r)
+                raise IOError(f"UPOS merge failed: {_safe_response_status(r)}")
             except IOError:
                 logger.info(f"请求合并分片 {file_name} 时出现问题，尝试重连，次数：" + str(attempt))
                 attempt += 1
@@ -587,9 +600,14 @@ class BiliBili:
                     backoff_time = backoff_factor ** retries
                     time.sleep(backoff_time)
 
-            except Exception as e:
+            except Exception as error:
                 retries += 1
-                logger.error(f"upload_chunk_thread err {str(e)}. Retrying {retries}/{max_retries}")
+                logger.error(
+                    "upload_chunk_thread error (%s). Retrying %s/%s",
+                    type(error).__name__,
+                    retries,
+                    max_retries,
+                )
 
                 # 计算退避时间，逐步增加重试间隔
                 backoff_time = backoff_factor ** retries
@@ -677,7 +695,7 @@ class BiliBili:
         if submit_api is None:
             total_info = self.myinfo()
             if total_info.get('data') is None:
-                logger.error(total_info)
+                logger.error("用户信息接口未返回 data: %s", _safe_response_status(total_info))
             total_info = total_info.get('data')
             if total_info['level'] > 3 and total_info['follower'] > 1000:
                 user_weight = 2
@@ -692,7 +710,7 @@ class BiliBili:
             ret = self.submit_web(post_data, edit=edit)
             if ret["code"] == 21138:
                 time.sleep(5)
-                logger.info(f'改用客户端接口提交{ret}')
+                logger.info("网页端提交要求客户端回退: %s", _safe_response_status(ret))
                 submit_api = 'client'
         if submit_api == 'client':
             ret = self.submit_client(post_data, edit=edit)
@@ -701,7 +719,7 @@ class BiliBili:
         if ret["code"] == 0:
             return ret
         else:
-            raise Exception(ret)
+            raise RuntimeError(f"submit failed: {_safe_response_status(ret)}")
 
     def submit_web(self, post_data, edit=False):
         logger.info('使用网页端api提交')
@@ -723,11 +741,11 @@ class BiliBili:
         api = 'http://member.bilibili.com/x/vu/client/add?access_key=' + self.access_token
         if edit:
             api = 'http://member.bilibili.com/x/vu/client/edit?access_key=' + self.access_token
-        logger.debug(f"client api submit: {post_data}")
+        logger.debug("client api submit prepared with %d fields", len(post_data))
         while True:
             ret = self.__session.post(api, timeout=5, json=post_data).json()
             if ret['code'] == -101:
-                logger.info(f'刷新token{ret}')
+                logger.info("客户端登录状态失效，正在刷新凭据: %s", _safe_response_status(ret))
                 self.login_by_password(**config['user']['account'])
                 self.store()
                 continue
@@ -762,7 +780,7 @@ class BiliBili:
         buffered.close()
         res = r.json()
         if res.get('data') is None:
-            raise Exception(res)
+            raise RuntimeError(f"cover upload failed: {_safe_response_status(res)}")
         return res['data']['url']
 
     def get_tags(self, upvideo, typeid="", desc="", cover="", groupid=1, vfea=""):
diff --git a/crates/biliup-cli/Cargo.toml b/crates/biliup-cli/Cargo.toml
index 597e878..192108d 100644
--- a/crates/biliup-cli/Cargo.toml
+++ b/crates/biliup-cli/Cargo.toml
@@ -20,6 +20,7 @@ toml = { workspace = true }
 tokio = { workspace = true, features = ["io-std"] }
 tracing = { workspace = true }
 tracing-subscriber = { workspace = true, features = ["env-filter"] }  # 添加特性（特性是累加的）  }
+tracing-appender = { workspace = true }
 thiserror = { workspace = true }
 rand = { workspace = true }
 serde_urlencoded = { workspace = true }
diff --git a/crates/biliup-cli/migrations/3_secure_configuration_identities.sql b/crates/biliup-cli/migrations/3_secure_configuration_identities.sql
new file mode 100644
index 0000000..d673123
--- /dev/null
+++ b/crates/biliup-cli/migrations/3_secure_configuration_identities.sql
@@ -0,0 +1,23 @@
+-- A Web login has exactly one administrator identity.  Creating the partial
+-- unique index intentionally fails when an existing database already contains
+-- multiple `biliup` rows: choosing one automatically could preserve an
+-- attacker-created password, so startup must fail closed until the operator
+-- resolves the conflicting rows.
+CREATE UNIQUE INDEX IF NOT EXISTS uq_configuration_biliup_identity
+    ON configuration (key)
+    WHERE key = 'biliup';
+
+-- Duplicate references to the exact same cookie file are semantically
+-- equivalent and can be collapsed safely before enforcing atomic idempotency.
+DELETE FROM configuration
+WHERE key = 'bilibili-cookies'
+  AND id NOT IN (
+      SELECT MIN(id)
+      FROM configuration
+      WHERE key = 'bilibili-cookies'
+      GROUP BY value
+  );
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_configuration_bilibili_cookie
+    ON configuration (key, value)
+    WHERE key = 'bilibili-cookies';
diff --git a/crates/biliup-cli/src/cli.rs b/crates/biliup-cli/src/cli.rs
index f5eb39e..2bbae12 100644
--- a/crates/biliup-cli/src/cli.rs
+++ b/crates/biliup-cli/src/cli.rs
@@ -159,7 +159,7 @@ pub enum Commands {
     /// 启动web服务，默认端口19159
     Server {
         /// Specify bind address
-        #[arg(short, long, default_value = "0.0.0.0")]
+        #[arg(short, long, default_value = "127.0.0.1")]
         bind: String,
 
         /// Port to use
@@ -214,3 +214,34 @@ fn parse_u8(string: &[u8]) -> Result<f64, String> {
         .parse()
         .map_err(|e| format!("{string} is not ascii digit. {:?}", e))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::{Cli, Commands};
+    use clap::Parser;
+    use std::path::Path;
+
+    #[test]
+    fn server_defaults_to_loopback_and_default_cookie_file() {
+        let cli = Cli::try_parse_from(["biliup", "server"]).unwrap();
+
+        assert_eq!(cli.user_cookie, Path::new("cookies.json"));
+        assert!(matches!(
+            cli.command,
+            Commands::Server { ref bind, auth: false, .. } if bind == "127.0.0.1"
+        ));
+    }
+
+    #[test]
+    fn server_preserves_an_explicit_cookie_file() {
+        let cli = Cli::try_parse_from([
+            "biliup",
+            "--user-cookie",
+            "/tmp/private-account.json",
+            "server",
+        ])
+        .unwrap();
+
+        assert_eq!(cli.user_cookie, Path::new("/tmp/private-account.json"));
+    }
+}
diff --git a/crates/biliup-cli/src/lib.rs b/crates/biliup-cli/src/lib.rs
index e25954d..ba92f19 100644
--- a/crates/biliup-cli/src/lib.rs
+++ b/crates/biliup-cli/src/lib.rs
@@ -16,9 +16,10 @@ use crate::server::infrastructure::models::upload_streamer::{
 };
 use crate::server::infrastructure::repositories;
 use crate::server::infrastructure::service_register::ServiceRegister;
+use crate::server::infrastructure::users::Backend;
 use clap::ValueEnum;
-use error_stack::{Report, ResultExt};
-use std::net::ToSocketAddrs;
+use error_stack::{Report, ResultExt, bail};
+use std::net::{SocketAddr, ToSocketAddrs};
 use std::path::{Path, PathBuf};
 use std::sync::{Arc, RwLock};
 use tracing_subscriber::{EnvFilter, Registry, reload};
@@ -34,6 +35,34 @@ pub async fn run(
     log_handle: LogHandle,
     config_path: Option<PathBuf>,
 ) -> AppResult<()> {
+    run_with_cookie(
+        addr,
+        auth,
+        log_handle,
+        config_path,
+        PathBuf::from("cookies.json"),
+    )
+    .await
+}
+
+pub async fn run_with_cookie(
+    addr: (&str, u16),
+    auth: bool,
+    log_handle: LogHandle,
+    config_path: Option<PathBuf>,
+    user_cookie: PathBuf,
+) -> AppResult<()> {
+    let addr = addr
+        .to_socket_addrs()
+        .change_context(AppError::Unknown)?
+        .next()
+        .ok_or_else(|| {
+            Report::new(AppError::Custom(
+                "bind address resolved to no sockets".into(),
+            ))
+        })?;
+    validate_server_exposure(addr, auth)?;
+
     // let config = Arc::new(AppConfig::parse());
 
     tracing::info!(
@@ -41,7 +70,17 @@ pub async fn run(
     );
     let conn_pool = ConnectionManager::new_pool("data/data.sqlite3")
         .await
-        .expect("could not initialize the database connection pool");
+        .attach("could not initialize the database connection pool")?;
+    validate_remote_auth_bootstrap(addr, auth, Backend::new(conn_pool.clone()).exists().await?)?;
+
+    if let Some(configuration) =
+        repositories::register_bilibili_cookie(&conn_pool, &user_cookie).await?
+    {
+        tracing::info!(
+            cookie_file = %configuration.value,
+            "registered CLI Bilibili cookie file for Web UI"
+        );
+    }
 
     let loaded_config = if let Some(path) = config_path.as_deref() {
         let config = Config::load(path)?;
@@ -72,17 +111,35 @@ pub async fn run(
     }
 
     tracing::info!("migrations successfully ran, initializing axum server...");
-    let addr = addr
-        .to_socket_addrs()
-        .change_context(AppError::Unknown)?
-        .next()
-        .unwrap();
     ApplicationController::serve(&addr, auth, service_register)
         .await
         .attach("could not initialize application routes")?;
     Ok(())
 }
 
+fn validate_server_exposure(addr: SocketAddr, auth: bool) -> AppResult<()> {
+    if !addr.ip().is_loopback() && !auth {
+        bail!(AppError::Custom(format!(
+            "refusing to expose the unauthenticated Web API on {addr}; use a loopback bind address or enable --auth"
+        )));
+    }
+    Ok(())
+}
+
+fn validate_remote_auth_bootstrap(
+    addr: SocketAddr,
+    auth: bool,
+    administrator_exists: bool,
+) -> AppResult<()> {
+    if auth && !addr.ip().is_loopback() && !administrator_exists {
+        bail!(AppError::Custom(
+            "refusing remote first-user bootstrap; initialize the Web administrator on a loopback bind before exposing the authenticated server"
+                .into(),
+        ));
+    }
+    Ok(())
+}
+
 async fn import_config_streamers(path: &Path, service_register: &ServiceRegister) -> AppResult<()> {
     let streamers: Vec<_> = {
         let config = service_register.config.read().unwrap();
@@ -318,3 +375,42 @@ pub enum UploadLine {
     Estx,
     Akbd,
 }
+
+#[cfg(test)]
+mod server_exposure_tests {
+    use super::{validate_remote_auth_bootstrap, validate_server_exposure};
+    use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr};
+
+    #[test]
+    fn unauthenticated_server_is_limited_to_loopback() {
+        for ip in [
+            IpAddr::V4(Ipv4Addr::LOCALHOST),
+            IpAddr::V6(Ipv6Addr::LOCALHOST),
+        ] {
+            assert!(validate_server_exposure(SocketAddr::new(ip, 19159), false).is_ok());
+        }
+        assert!(
+            validate_server_exposure(
+                SocketAddr::new(IpAddr::V4(Ipv4Addr::UNSPECIFIED), 19159),
+                false,
+            )
+            .is_err()
+        );
+    }
+
+    #[test]
+    fn authenticated_server_can_bind_non_loopback_after_local_bootstrap() {
+        let addr = SocketAddr::new(IpAddr::V4(Ipv4Addr::UNSPECIFIED), 19159);
+        assert!(validate_server_exposure(addr, true).is_ok());
+        assert!(validate_remote_auth_bootstrap(addr, true, false).is_err());
+        assert!(validate_remote_auth_bootstrap(addr, true, true).is_ok());
+        assert!(
+            validate_remote_auth_bootstrap(
+                SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 19159),
+                true,
+                false,
+            )
+            .is_ok()
+        );
+    }
+}
diff --git a/crates/biliup-cli/src/main.rs b/crates/biliup-cli/src/main.rs
index 73df55b..61941f3 100644
--- a/crates/biliup-cli/src/main.rs
+++ b/crates/biliup-cli/src/main.rs
@@ -14,6 +14,10 @@ use tracing_subscriber::layer::SubscriberExt;
 use tracing_subscriber::reload;
 use tracing_subscriber::util::SubscriberInitExt;
 
+fn writes_web_log(command: &Commands) -> bool {
+    matches!(command, Commands::Server { .. })
+}
+
 #[tokio::main]
 async fn main() -> AppResult<()> {
     // a builder for `FmtSubscriber`.
@@ -39,9 +43,25 @@ async fn main() -> AppResult<()> {
     let console_filter = tracing_subscriber::EnvFilter::new(&cli.rust_log);
     // let (file_filter_layer, file_reload_handle) = reload::Layer::new(file_filter);
     let (console_filter_layer, console_reload_handle) = reload::Layer::new(console_filter);
+
+    // Only the Web server owns `ds_update.log`. Short-lived credential
+    // commands still log to the console, but do not persist their output.
+    let (file_layer, file_guard) = if writes_web_log(&cli.command) {
+        let file_appender = tracing_appender::rolling::never(".", "ds_update.log");
+        let (file_writer, file_guard) = tracing_appender::non_blocking(file_appender);
+        let file_layer = tracing_subscriber::fmt::layer()
+            .with_timer(timer.clone())
+            .with_writer(file_writer)
+            .with_ansi(false);
+        (Some(file_layer), Some(file_guard))
+    } else {
+        (None, None)
+    };
+
     tracing_subscriber::registry()
         .with(console_filter_layer)
         .with(tracing_subscriber::fmt::layer().with_timer(timer))
+        .with(file_layer)
         .init();
 
     let user_cookie = expand_path(cli.user_cookie);
@@ -135,7 +155,16 @@ async fn main() -> AppResult<()> {
             port,
             auth,
             config,
-        } => biliup_cli::run((&bind, port), auth, console_reload_handle, config).await?,
+        } => {
+            biliup_cli::run_with_cookie(
+                (&bind, port),
+                auth,
+                console_reload_handle,
+                config,
+                user_cookie,
+            )
+            .await?
+        }
         Commands::List {
             is_pubing,
             pubed,
@@ -155,5 +184,25 @@ async fn main() -> AppResult<()> {
             .await?
         }
     };
+    // Keep the optional server writer alive until queued records are flushed.
+    drop(file_guard);
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::writes_web_log;
+    use biliup_cli::cli::Cli;
+    use clap::Parser;
+
+    #[test]
+    fn persistent_log_is_enabled_only_for_the_server_command() {
+        let server = Cli::try_parse_from(["biliup", "server"]).unwrap();
+        let renew = Cli::try_parse_from(["biliup", "renew"]).unwrap();
+        let list = Cli::try_parse_from(["biliup", "list"]).unwrap();
+
+        assert!(writes_web_log(&server.command));
+        assert!(!writes_web_log(&renew.command));
+        assert!(!writes_web_log(&list.command));
+    }
+}
diff --git a/crates/biliup-cli/src/server/api/auth.rs b/crates/biliup-cli/src/server/api/auth.rs
index edcbc6d..cc0123c 100644
--- a/crates/biliup-cli/src/server/api/auth.rs
+++ b/crates/biliup-cli/src/server/api/auth.rs
@@ -1,19 +1,10 @@
+use crate::server::infrastructure::users::{AuthSession, CreateUserError, Credentials};
 use axum::{
     Router,
     http::StatusCode,
     response::{IntoResponse, Redirect},
     routing::{get, post},
 };
-use serde::Deserialize;
-
-use crate::server::infrastructure::users::{AuthSession, Credentials};
-
-// This allows us to extract the "next" field from the query string. We use this
-// to redirect after log in.
-#[derive(Debug, Deserialize)]
-pub struct NextUrl {
-    _next: Option<String>,
-}
 
 pub fn router() -> Router<()> {
     Router::new()
@@ -44,7 +35,28 @@ mod post {
 
         let user = match auth_session.backend.create_user(creds).await {
             Ok(user) => user,
-            Err(_) => return StatusCode::INTERNAL_SERVER_ERROR.into_response(),
+            Err(CreateUserError::InvalidCredentials) => {
+                return (
+                    StatusCode::BAD_REQUEST,
+                    Json(serde_json::json!({ "message": "用户名必须为 biliup，且密码必须为 1 至 1024 字节" })),
+                )
+                    .into_response();
+            }
+            Err(CreateUserError::AlreadyExists) => {
+                return (
+                    StatusCode::CONFLICT,
+                    Json(serde_json::json!({ "message": "管理员已初始化，不能重复注册" })),
+                )
+                    .into_response();
+            }
+            Err(CreateUserError::Database(error)) => {
+                tracing::error!(error = ?error, "failed to initialize Web administrator");
+                return StatusCode::INTERNAL_SERVER_ERROR.into_response();
+            }
+            Err(CreateUserError::HashingTask(error)) => {
+                tracing::error!(error = ?error, "Web administrator password hashing task failed");
+                return StatusCode::INTERNAL_SERVER_ERROR.into_response();
+            }
         };
 
         // Log the newly-created user in.
@@ -59,18 +71,16 @@ mod post {
         mut auth_session: AuthSession,
         Json(creds): Json<Credentials>,
     ) -> impl IntoResponse {
-        info!("Login with credentials {:?}", creds);
+        info!("Web login attempt");
         let user = match auth_session.authenticate(creds.clone()).await {
             Ok(Some(user)) => user,
             Ok(None) => {
                 info!("Invalid credentials");
-
-                let mut login_url = "/login".to_string();
-                if let Some(next) = creds.next {
-                    login_url = format!("{login_url}?next={next}");
-                };
-
-                return Redirect::to(&login_url).into_response();
+                return (
+                    StatusCode::UNAUTHORIZED,
+                    Json(serde_json::json!({ "message": "用户名或密码错误" })),
+                )
+                    .into_response();
             }
             Err(_) => return StatusCode::INTERNAL_SERVER_ERROR.into_response(),
         };
@@ -90,6 +100,51 @@ mod post {
     }
 }
 
+#[cfg(test)]
+mod tests {
+    use super::router;
+    use crate::server::infrastructure::connection_pool::ConnectionManager;
+    use crate::server::infrastructure::users::Backend;
+    use axum::body::Body;
+    use axum::http::{Request, StatusCode, header};
+    use axum_login::AuthManagerLayerBuilder;
+    use tower::ServiceExt;
+    use tower_sessions::SessionManagerLayer;
+    use tower_sessions_sqlx_store::SqliteStore;
+
+    #[tokio::test]
+    async fn invalid_login_is_an_explicit_error_not_a_followed_redirect() {
+        let dir = tempfile::tempdir().unwrap();
+        let db = dir.path().join("data.sqlite3");
+        let pool = ConnectionManager::new_pool(db.to_str().unwrap())
+            .await
+            .unwrap();
+        let session_store = SqliteStore::new(pool.clone());
+        session_store.migrate().await.unwrap();
+        let auth_layer = AuthManagerLayerBuilder::new(
+            Backend::new(pool),
+            SessionManagerLayer::new(session_store).with_secure(false),
+        )
+        .build();
+        let app = router().layer(auth_layer);
+
+        let response = app
+            .oneshot(
+                Request::builder()
+                    .method("POST")
+                    .uri("/v1/users/login")
+                    .header(header::CONTENT_TYPE, "application/json")
+                    .body(Body::from(r#"{"username":"biliup","password":"wrong"}"#))
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+
+        assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
+        assert!(response.headers().get(header::LOCATION).is_none());
+    }
+}
+
 mod get {
     use super::*;
 
diff --git a/crates/biliup-cli/src/server/api/bilibili_endpoints.rs b/crates/biliup-cli/src/server/api/bilibili_endpoints.rs
index 0d22fd4..d1623ff 100644
--- a/crates/biliup-cli/src/server/api/bilibili_endpoints.rs
+++ b/crates/biliup-cli/src/server/api/bilibili_endpoints.rs
@@ -2,13 +2,14 @@ use crate::server::errors::{AppError, report_to_response};
 use crate::server::infrastructure::connection_pool::ConnectionPool;
 use crate::server::infrastructure::models::Configuration;
 use axum::Json;
-use axum::extract::{Query, State};
-use axum::response::Response;
-use biliup::client::StatelessClient;
+use axum::extract::{Path, Query, State};
+use axum::http::StatusCode;
+use axum::response::{IntoResponse, Response};
+use biliup::uploader::bilibili::ArchivePage;
 use biliup::uploader::credential::login_by_cookies;
-use bytes::Bytes;
 use error_stack::{Report, ResultExt};
 use ormlite::Model;
+use serde::Deserialize;
 use std::collections::HashMap;
 
 /// B站投稿预处理端点
@@ -42,14 +43,26 @@ pub async fn archive_pre_endpoint(
     ))))
 }
 
-/// 获取B站用户信息端点
-pub async fn get_myinfo_endpoint(
-    Query(params): Query<HashMap<String, String>>,
-) -> Result<Json<serde_json::Value>, Response> {
-    // 使用指定用户的Cookie登录
-    let bili = login_by_cookies(&params["user"], None)
+async fn get_registered_cookie(pool: &ConnectionPool, id: i64) -> Result<Configuration, Response> {
+    Configuration::select()
+        .where_("id = ? AND key = 'bilibili-cookies'")
+        .bind(id)
+        .fetch_optional(pool)
         .await
-        .change_context(AppError::Custom(params["user"].to_string()))
+        .change_context(AppError::Unknown)
+        .map_err(report_to_response)?
+        .ok_or_else(|| (StatusCode::NOT_FOUND, "B 站用户不存在").into_response())
+}
+
+/// 获取已登记 B 站用户的信息；客户端只能提交不透明的数据库 ID。
+pub async fn get_user_profile_endpoint(
+    Path(id): Path<i64>,
+    State(pool): State<ConnectionPool>,
+) -> Result<Json<serde_json::Value>, Response> {
+    let cookie = get_registered_cookie(&pool, id).await?;
+    let bili = login_by_cookies(&cookie.value, None)
+        .await
+        .change_context(AppError::Custom("无法读取或刷新该用户凭据".into()))
         .map_err(report_to_response)?;
 
     // 获取用户信息
@@ -61,21 +74,133 @@ pub async fn get_myinfo_endpoint(
     ))
 }
 
-/// 代理请求端点
-pub async fn get_proxy_endpoint(
-    State(client): State<StatelessClient>,
-    Query(params): Query<HashMap<String, String>>,
-) -> Result<Bytes, Response> {
-    // 代理HTTP请求
-    client
-        .client
-        .get(&params["url"])
-        .send()
-        .await
-        .change_context(AppError::Unknown)
-        .map_err(report_to_response)?
-        .bytes()
-        .await
-        .change_context(AppError::Unknown)
-        .map_err(report_to_response)
+fn default_page() -> u32 {
+    1
+}
+
+#[derive(Debug, Deserialize)]
+pub struct ArchivesQuery {
+    #[serde(default)]
+    status: Option<String>,
+    #[serde(default = "default_page")]
+    from_page: u32,
+    #[serde(default = "default_page")]
+    max_pages: u32,
+}
+
+impl ArchivesQuery {
+    fn validate(&self) -> Result<&'static str, Response> {
+        if self.from_page == 0 {
+            return Err((StatusCode::BAD_REQUEST, "from_page 必须大于等于 1").into_response());
+        }
+        if !(1..=20).contains(&self.max_pages) {
+            return Err((StatusCode::BAD_REQUEST, "max_pages 必须在 1 到 20 之间").into_response());
+        }
+        match self.status.as_deref().unwrap_or("all") {
+            "all" => Ok("is_pubing,pubed,not_pubed"),
+            "is_pubing" => Ok("is_pubing"),
+            "pubed" => Ok("pubed"),
+            "not_pubed" => Ok("not_pubed"),
+            _ => Err((StatusCode::BAD_REQUEST, "无效的稿件状态").into_response()),
+        }
+    }
+}
+
+/// 获取一个明确账号的远程 B 站稿件列表。
+pub async fn get_user_archives_endpoint(
+    Path(id): Path<i64>,
+    State(pool): State<ConnectionPool>,
+    Query(query): Query<ArchivesQuery>,
+) -> Result<Json<ArchivePage>, Response> {
+    let status = query.validate()?;
+    let cookie = get_registered_cookie(&pool, id).await?;
+    let bili = login_by_cookies(&cookie.value, None)
+        .await
+        .change_context(AppError::Custom("无法读取或刷新该用户凭据".into()))
+        .map_err(report_to_response)?;
+    let page = bili
+        .recent_archives_page(status, query.from_page, Some(query.max_pages))
+        .await
+        .change_context(AppError::Unknown)
+        .map_err(report_to_response)?;
+    Ok(Json(page))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{ArchivesQuery, get_registered_cookie};
+    use crate::server::infrastructure::connection_pool::ConnectionManager;
+    use axum::http::StatusCode;
+
+    #[test]
+    fn archives_query_has_safe_bounds_and_known_statuses() {
+        let default = ArchivesQuery {
+            status: None,
+            from_page: 1,
+            max_pages: 1,
+        };
+        assert_eq!(default.validate().unwrap(), "is_pubing,pubed,not_pubed");
+
+        for query in [
+            ArchivesQuery {
+                status: None,
+                from_page: 0,
+                max_pages: 1,
+            },
+            ArchivesQuery {
+                status: None,
+                from_page: 1,
+                max_pages: 0,
+            },
+            ArchivesQuery {
+                status: None,
+                from_page: 1,
+                max_pages: 21,
+            },
+            ArchivesQuery {
+                status: Some("unknown".into()),
+                from_page: 1,
+                max_pages: 1,
+            },
+        ] {
+            assert_eq!(
+                query.validate().unwrap_err().status(),
+                StatusCode::BAD_REQUEST
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn profile_and_archive_lookup_cannot_select_other_configuration_types() {
+        let dir = tempfile::tempdir().unwrap();
+        let db = dir.path().join("data.sqlite3");
+        let pool = ConnectionManager::new_pool(db.to_str().unwrap())
+            .await
+            .unwrap();
+        let config = sqlx::query("INSERT INTO configuration (key, value) VALUES ('config', '{}')")
+            .execute(&pool)
+            .await
+            .unwrap();
+        let cookie = sqlx::query(
+            "INSERT INTO configuration (key, value) VALUES ('bilibili-cookies', 'cookie.json')",
+        )
+        .execute(&pool)
+        .await
+        .unwrap();
+
+        assert_eq!(
+            get_registered_cookie(&pool, config.last_insert_rowid())
+                .await
+                .unwrap_err()
+                .status(),
+            StatusCode::NOT_FOUND
+        );
+        assert_eq!(
+            get_registered_cookie(&pool, cookie.last_insert_rowid())
+                .await
+                .unwrap()
+                .key,
+            "bilibili-cookies"
+        );
+    }
 }
diff --git a/crates/biliup-cli/src/server/api/endpoints.rs b/crates/biliup-cli/src/server/api/endpoints.rs
index 286c90c..a3fe962 100644
--- a/crates/biliup-cli/src/server/api/endpoints.rs
+++ b/crates/biliup-cli/src/server/api/endpoints.rs
@@ -10,11 +10,10 @@ use crate::server::infrastructure::models::live_streamer::{InsertLiveStreamer, L
 use crate::server::infrastructure::models::upload_streamer::{
     InsertUploadStreamer, UploadStreamer,
 };
-use crate::server::infrastructure::models::{
-    Configuration, FileItem, InsertConfiguration, StreamerInfo,
-};
+use crate::server::infrastructure::models::{Configuration, FileItem, StreamerInfo};
 use crate::server::infrastructure::repositories::{
-    del_streamer, get_all_streamer, get_upload_config,
+    del_streamer, delete_bilibili_cookie, get_all_streamer, get_upload_config,
+    register_bilibili_cookie,
 };
 use crate::server::infrastructure::service_register::ServiceRegister;
 use crate::{LogHandle, UploadLine};
@@ -22,7 +21,7 @@ use axum::Json;
 use axum::extract::{Path, State};
 use axum::http::StatusCode;
 use axum::response::{IntoResponse, Response};
-use biliup::credential::Credential;
+use biliup::credential::{Credential, save_login_info};
 use chrono::Utc;
 use clap::ValueEnum;
 use error_stack::{Report, ResultExt};
@@ -33,7 +32,6 @@ use std::path::PathBuf;
 use std::sync::{Arc, RwLock};
 use std::time::{Duration, UNIX_EPOCH};
 use tokio::fs;
-use tokio::io::AsyncWriteExt;
 use tracing::info;
 use tracing_subscriber::EnvFilter;
 
@@ -411,28 +409,85 @@ pub async fn get_users_endpoint(
 
 pub async fn add_user_endpoint(
     State(pool): State<ConnectionPool>,
-    Json(user): Json<InsertConfiguration>,
+    Json(user): Json<AddBilibiliUser>,
 ) -> Result<Json<Configuration>, Response> {
-    let res = user
-        .insert(&pool)
+    let res = register_bilibili_cookie(&pool, &user.value)
         .await
-        .change_context(AppError::Unknown)
-        .map_err(report_to_response)?;
+        .map_err(report_to_response)?
+        .ok_or_else(|| {
+            (
+                StatusCode::BAD_REQUEST,
+                "凭据文件不存在、不是普通文件或无法访问",
+            )
+                .into_response()
+        })?;
     Ok(Json(res))
 }
 
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct AddBilibiliUser {
+    value: PathBuf,
+}
+
+#[cfg(test)]
+mod user_payload_tests {
+    use super::{AddBilibiliUser, PostUploads};
+    use std::path::Path;
+
+    #[test]
+    fn add_user_payload_rejects_a_client_supplied_configuration_key() {
+        assert!(
+            serde_json::from_value::<AddBilibiliUser>(serde_json::json!({
+                "key": "config",
+                "value": "cookies.json"
+            }))
+            .is_err()
+        );
+        let payload: AddBilibiliUser = serde_json::from_value(serde_json::json!({
+            "value": "cookies.json"
+        }))
+        .unwrap();
+        assert_eq!(payload.value, Path::new("cookies.json"));
+    }
+
+    #[test]
+    fn page_upload_requires_a_server_side_template_id() {
+        assert!(
+            serde_json::from_value::<PostUploads>(serde_json::json!({
+                "files": ["video.mp4"],
+                "params": {
+                    "id": 99,
+                    "user_cookie": "/tmp/client-controlled.json"
+                }
+            }))
+            .is_err()
+        );
+
+        let payload: PostUploads = serde_json::from_value(serde_json::json!({
+            "files": ["video.mp4"],
+            "template_id": 7
+        }))
+        .unwrap();
+        assert_eq!(payload.template_id, 7);
+        assert_eq!(payload.files, ["video.mp4"]);
+    }
+}
+
 pub async fn delete_user_endpoint(
     Path(id): Path<i64>,
     State(pool): State<ConnectionPool>,
-) -> Result<Json<()>, Response> {
-    let x = sqlx::query("DELETE FROM configuration WHERE id = ?")
-        .bind(id)
-        .execute(&pool)
+) -> Result<Json<crate::server::infrastructure::repositories::DeletedBilibiliCookie>, Response> {
+    let deleted = delete_bilibili_cookie(&pool, id)
         .await
-        .change_context(AppError::Unknown)
         .map_err(report_to_response)?;
-    info!("{:?}", x);
-    Ok(Json(()))
+    info!(
+        user_id = deleted.id,
+        file_deleted = deleted.file_deleted,
+        references_remaining = deleted.references_remaining,
+        "deleted Bilibili user registration"
+    );
+    Ok(Json(deleted))
 }
 
 pub async fn get_qrcode() -> Result<Json<serde_json::Value>, Response> {
@@ -462,11 +517,7 @@ pub async fn login_by_qrcode(
     let mid = info.token_info.mid;
     let filename = format!("data/{}.json", mid);
 
-    let mut file = fs::File::create(&filename)
-        .await
-        .change_context(AppError::Unknown)
-        .map_err(report_to_response)?;
-    file.write_all(&serde_json::to_vec_pretty(&info).unwrap())
+    save_login_info(&filename, &info)
         .await
         .change_context(AppError::Unknown)
         .map_err(report_to_response)?;
@@ -545,17 +596,26 @@ pub async fn get_status(
 }
 
 #[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
 pub struct PostUploads {
-    files: Vec<PathBuf>,
-    params: UploadStreamer,
+    files: Vec<String>,
+    template_id: i64,
 }
 
 // #[debug_handler]
 pub async fn post_uploads(
     State(config): State<Arc<RwLock<Config>>>,
+    State(pool): State<ConnectionPool>,
     Json(json_data): Json<PostUploads>,
 ) -> Result<Json<serde_json::Value>, Response> {
-    let upload_config = json_data.params;
+    let upload_config = UploadStreamer::select()
+        .where_("id = ?")
+        .bind(json_data.template_id)
+        .fetch_optional(&pool)
+        .await
+        .change_context(AppError::Unknown)
+        .map_err(report_to_response)?
+        .ok_or_else(|| (StatusCode::NOT_FOUND, "上传模板不存在").into_response())?;
     if upload_config.is_noop_uploader() {
         info!(
             uploader = ?upload_config.uploader,
@@ -571,36 +631,63 @@ pub async fn post_uploads(
         let submit_api = config.submit_api.clone();
         (line, limit, submit_api)
     };
+    let root = std::env::current_dir()
+        .change_context(AppError::Unknown)
+        .map_err(report_to_response)?;
+    let files = json_data
+        .files
+        .iter()
+        .map(|file| {
+            crate::server::router::resolve_media_path(&root, file).map_err(|_| {
+                (
+                    StatusCode::BAD_REQUEST,
+                    format!("无效或越界的媒体文件名: {file}"),
+                )
+                    .into_response()
+            })
+        })
+        .collect::<Result<Vec<_>, Response>>()?;
+    if files.is_empty() {
+        return Err((StatusCode::BAD_REQUEST, "至少选择一个媒体文件").into_response());
+    }
     info!("通过页面开始上传");
     tokio::spawn(async move {
-        let (bilibili, videos) = upload(
-            upload_config
-                .user_cookie
-                .as_deref()
-                .unwrap_or("cookies.json"),
-            None,
-            line,
-            &json_data.files,
-            limit as usize,
-        )
-        .await?;
-        if !videos.is_empty() {
-            let recorder = Recorder::new(
-                upload_config.title.clone(),
-                StreamerInfo::new(
-                    &upload_config.template_name,
-                    "stream_title",
-                    "",
-                    Utc::now(),
-                    "",
-                ),
-            );
-            let studio = build_studio(&upload_config, &bilibili, videos, &recorder).await?;
-            let response_data =
+        let result = async {
+            let (bilibili, videos) = upload(
+                upload_config
+                    .user_cookie
+                    .as_deref()
+                    .unwrap_or("cookies.json"),
+                None,
+                line,
+                &files,
+                limit as usize,
+            )
+            .await?;
+            if !videos.is_empty() {
+                let recorder = Recorder::new(
+                    upload_config.title.clone(),
+                    StreamerInfo::new(
+                        &upload_config.template_name,
+                        "stream_title",
+                        "",
+                        Utc::now(),
+                        "",
+                    ),
+                );
+                let studio = build_studio(&upload_config, &bilibili, videos, &recorder).await?;
                 submit_to_bilibili(&bilibili, &studio, submit_api.as_deref()).await?;
-            info!("通过页面上传成功 {:?}", response_data);
+                info!(template_id = upload_config.id, "通过页面上传成功");
+            }
+            Ok::<_, Report<AppError>>(())
+        }
+        .await;
+        if result.is_err() {
+            // Upload failures can wrap upstream response bodies containing
+            // short-lived upload authorization. Keep persistent Web logs free
+            // of those response bodies.
+            tracing::error!(template_id = upload_config.id, "页面上传失败");
         }
-        Ok::<_, Report<AppError>>(())
     });
 
     Ok(Json(serde_json::json!({})))
diff --git a/crates/biliup-cli/src/server/api/ws.rs b/crates/biliup-cli/src/server/api/ws.rs
index 7d8f3fb..78dd29a 100644
--- a/crates/biliup-cli/src/server/api/ws.rs
+++ b/crates/biliup-cli/src/server/api/ws.rs
@@ -1,16 +1,22 @@
 use axum::extract::ws::{Message, Utf8Bytes, WebSocket};
 use axum::extract::{Query, WebSocketUpgrade};
+use axum::http::{HeaderMap, StatusCode, header};
+use axum::response::{IntoResponse, Response};
 use serde::Deserialize;
 use std::collections::VecDeque;
 use std::io::ErrorKind;
 use std::path::PathBuf;
+use std::sync::{Arc, OnceLock};
 use std::time::Duration;
 use tokio::fs;
 use tokio::io::{AsyncBufReadExt, AsyncReadExt, AsyncSeekExt, BufReader};
+use tokio::sync::{OwnedSemaphorePermit, Semaphore};
 use tokio::time::{MissedTickBehavior, interval};
 use tracing::{debug, error, info};
 
 static ALLOWED_FILES: &[&str] = &["ds_update.log", "download.log", "upload.log"];
+const MAX_LOG_CONNECTIONS: usize = 8;
+static LOG_CONNECTIONS: OnceLock<Arc<Semaphore>> = OnceLock::new();
 
 #[derive(Debug, Deserialize, Clone)]
 pub struct LogsQuery {
@@ -20,8 +26,59 @@ pub struct LogsQuery {
 pub async fn ws_logs(
     ws: WebSocketUpgrade,
     Query(query): Query<LogsQuery>,
-) -> axum::response::Response {
-    ws.on_upgrade(move |socket| websocket_logs(socket, query))
+    headers: HeaderMap,
+) -> Response {
+    if !websocket_origin_allowed(&headers) {
+        return (StatusCode::FORBIDDEN, "WebSocket Origin 不受信任").into_response();
+    }
+    let limiter = LOG_CONNECTIONS
+        .get_or_init(|| Arc::new(Semaphore::new(MAX_LOG_CONNECTIONS)))
+        .clone();
+    let Some(permit) = acquire_log_permit(limiter) else {
+        return (StatusCode::TOO_MANY_REQUESTS, "日志连接数已达上限").into_response();
+    };
+
+    ws.on_upgrade(move |socket| async move {
+        let _permit = permit;
+        websocket_logs(socket, query).await;
+    })
+}
+
+fn acquire_log_permit(limiter: Arc<Semaphore>) -> Option<OwnedSemaphorePermit> {
+    limiter.try_acquire_owned().ok()
+}
+
+fn websocket_origin_allowed(headers: &HeaderMap) -> bool {
+    let Some(origin) = headers
+        .get(header::ORIGIN)
+        .and_then(|value| value.to_str().ok())
+    else {
+        return false;
+    };
+    let Ok(origin) = url::Url::parse(origin) else {
+        return false;
+    };
+    if !matches!(origin.scheme(), "http" | "https") {
+        return false;
+    }
+    if origin.username() != ""
+        || origin.password().is_some()
+        || origin.path() != "/"
+        || origin.query().is_some()
+        || origin.fragment().is_some()
+    {
+        return false;
+    }
+    let origin_authority = &origin[url::Position::BeforeHost..url::Position::AfterPort];
+    let host_matches = headers
+        .get(header::HOST)
+        .and_then(|value| value.to_str().ok())
+        .is_some_and(|host| host.eq_ignore_ascii_case(origin_authority));
+    let trusted_dev_origin = matches!(
+        origin.as_str().trim_end_matches('/'),
+        "http://localhost:3000" | "http://127.0.0.1:3000" | "http://[::1]:3000"
+    );
+    host_matches || trusted_dev_origin
 }
 
 async fn websocket_logs(mut ws: WebSocket, query: LogsQuery) {
@@ -213,3 +270,56 @@ async fn send_new_lines_from_offset(
     }
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::{MAX_LOG_CONNECTIONS, acquire_log_permit, websocket_origin_allowed};
+    use axum::http::{HeaderMap, HeaderValue, header};
+    use std::sync::Arc;
+    use tokio::sync::Semaphore;
+
+    fn headers(host: &str, origin: Option<&str>) -> HeaderMap {
+        let mut headers = HeaderMap::new();
+        headers.insert(header::HOST, HeaderValue::from_str(host).unwrap());
+        if let Some(origin) = origin {
+            headers.insert(header::ORIGIN, HeaderValue::from_str(origin).unwrap());
+        }
+        headers
+    }
+
+    #[test]
+    fn websocket_origin_must_match_host_or_trusted_dev_frontend() {
+        assert!(websocket_origin_allowed(&headers(
+            "example.test",
+            Some("https://example.test")
+        )));
+        assert!(websocket_origin_allowed(&headers(
+            "127.0.0.1:19159",
+            Some("http://localhost:3000")
+        )));
+        assert!(!websocket_origin_allowed(&headers(
+            "127.0.0.1:19159",
+            Some("https://attacker.example")
+        )));
+        assert!(!websocket_origin_allowed(&headers(
+            "example.test",
+            Some("https://example.test/not-an-origin")
+        )));
+        assert!(!websocket_origin_allowed(&headers(
+            "example.test",
+            Some("https://user@example.test")
+        )));
+        assert!(!websocket_origin_allowed(&headers("127.0.0.1:19159", None)));
+    }
+
+    #[test]
+    fn websocket_log_connections_are_bounded() {
+        let limiter = Arc::new(Semaphore::new(MAX_LOG_CONNECTIONS));
+        let permits: Vec<_> = (0..MAX_LOG_CONNECTIONS)
+            .map(|_| acquire_log_permit(limiter.clone()).unwrap())
+            .collect();
+        assert!(acquire_log_permit(limiter.clone()).is_none());
+        drop(permits);
+        assert!(acquire_log_permit(limiter).is_some());
+    }
+}
diff --git a/crates/biliup-cli/src/server/app.rs b/crates/biliup-cli/src/server/app.rs
index adacaff..1c6192a 100644
--- a/crates/biliup-cli/src/server/app.rs
+++ b/crates/biliup-cli/src/server/app.rs
@@ -50,7 +50,10 @@ impl ApplicationController {
 
         // 配置会话管理层
         let session_layer = SessionManagerLayer::new(session_store)
-            .with_secure(false)
+            // Loopback development uses plain HTTP.  A non-loopback bind is
+            // expected to sit behind TLS, so never send its session cookie over
+            // an insecure browser connection.
+            .with_secure(!addr.ip().is_loopback())
             .with_name("biliup.sid")
             .with_expiry(Expiry::OnInactivity(Duration::days(7)));
         // .with_signed(key);
@@ -62,12 +65,9 @@ impl ApplicationController {
 
         // 构建应用程序路由
         // 是否启用登录保护
-        let mut app = server::router::router(service_register.clone());
-        if enable_login_guard {
-            app = app
-                .route_layer(login_required!(Backend)) // 添加登录验证中间件
-                .merge(auth::router()); // 合并认证路由
-        }
+        let protected_routes =
+            server::router::router(service_register.clone()).route("/v1/ws/logs", get(ws_logs));
+        let mut app = with_optional_auth(protected_routes, enable_login_guard);
         app = app
             .layer(auth_layer) // 添加认证层
             .layer(
@@ -81,7 +81,6 @@ impl ApplicationController {
                     .allow_origin("http://localhost:3000".parse::<HeaderValue>().unwrap())
                     .allow_methods(AllowMethods::any()),
             )
-            .route("/v1/ws/logs", get(ws_logs)) // 获取视频列表
             .fallback(static_handler); // 静态文件处理回退
 
         // 启动HTTP服务器
@@ -123,6 +122,15 @@ impl ApplicationController {
     }
 }
 
+fn with_optional_auth(app: axum::Router<()>, enable_login_guard: bool) -> axum::Router<()> {
+    if enable_login_guard {
+        app.route_layer(login_required!(Backend))
+            .merge(auth::router())
+    } else {
+        app
+    }
+}
+
 /// 优雅关闭信号处理
 async fn shutdown_signal(
     deletion_task_abort_handle: AbortHandle,
@@ -155,3 +163,51 @@ async fn shutdown_signal(
     }
     service_register.cleanup().await;
 }
+
+#[cfg(test)]
+mod tests {
+    use super::with_optional_auth;
+    use crate::server::infrastructure::connection_pool::ConnectionManager;
+    use crate::server::infrastructure::users::Backend;
+    use axum::Router;
+    use axum::body::Body;
+    use axum::http::{Request, StatusCode};
+    use axum::routing::get;
+    use axum_login::AuthManagerLayerBuilder;
+    use tower::ServiceExt;
+    use tower_sessions::SessionManagerLayer;
+    use tower_sessions_sqlx_store::SqliteStore;
+
+    async fn request_log_route(enable_login_guard: bool) -> StatusCode {
+        let dir = tempfile::tempdir().unwrap();
+        let db = dir.path().join("data.sqlite3");
+        let pool = ConnectionManager::new_pool(db.to_str().unwrap())
+            .await
+            .unwrap();
+        let session_store = SqliteStore::new(pool.clone());
+        session_store.migrate().await.unwrap();
+        let auth_layer = AuthManagerLayerBuilder::new(
+            Backend::new(pool),
+            SessionManagerLayer::new(session_store).with_secure(false),
+        )
+        .build();
+        let protected = Router::new().route("/v1/ws/logs", get(|| async { StatusCode::OK }));
+        let app = with_optional_auth(protected, enable_login_guard).layer(auth_layer);
+
+        app.oneshot(
+            Request::builder()
+                .uri("/v1/ws/logs")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap()
+        .status()
+    }
+
+    #[tokio::test]
+    async fn log_websocket_route_is_protected_when_auth_is_enabled() {
+        assert_eq!(request_log_route(true).await, StatusCode::UNAUTHORIZED);
+        assert_eq!(request_log_route(false).await, StatusCode::OK);
+    }
+}
diff --git a/crates/biliup-cli/src/server/core/monitor.rs b/crates/biliup-cli/src/server/core/monitor.rs
index 996936a..7e9455c 100644
--- a/crates/biliup-cli/src/server/core/monitor.rs
+++ b/crates/biliup-cli/src/server/core/monitor.rs
@@ -122,7 +122,10 @@ impl Monitor {
             // 未开播直接跳过（不占用下载槽位、不做逐间请求），并以较短间隔轮换到
             // 下一个房间，使整条队列在一个检测周期内扫完；批量请求本身由缓存 TTL 限流。
             if plugin.supports_batch_check() {
-                match self.batch_verdict(platform_name, &plugin, &room, interval).await {
+                match self
+                    .batch_verdict(platform_name, &plugin, &room, interval)
+                    .await
+                {
                     BatchVerdict::Offline => {
                         self.wake_waker(room.id()).await;
                         debug!(url = url, "批量检测未开播");
diff --git a/crates/biliup-cli/src/server/infrastructure/connection_pool.rs b/crates/biliup-cli/src/server/infrastructure/connection_pool.rs
index cd4f6a9..012a6a1 100644
--- a/crates/biliup-cli/src/server/infrastructure/connection_pool.rs
+++ b/crates/biliup-cli/src/server/infrastructure/connection_pool.rs
@@ -59,3 +59,53 @@ impl ConnectionManager {
         Ok(pool)
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::ConnectionManager;
+
+    #[tokio::test]
+    async fn identity_migration_fails_closed_on_multiple_existing_administrators() {
+        let dir = tempfile::tempdir().unwrap();
+        let db = dir.path().join("data.sqlite3");
+        let pool = ConnectionManager::new_pool(db.to_str().unwrap())
+            .await
+            .unwrap();
+        sqlx::query("DROP INDEX uq_configuration_biliup_identity")
+            .execute(&pool)
+            .await
+            .unwrap();
+        sqlx::query("DELETE FROM _sqlx_migrations WHERE version = 3")
+            .execute(&pool)
+            .await
+            .unwrap();
+        sqlx::query(
+            "INSERT INTO configuration (key, value) VALUES ('biliup', 'first'), ('biliup', 'second')",
+        )
+        .execute(&pool)
+        .await
+        .unwrap();
+        pool.close().await;
+
+        assert!(
+            ConnectionManager::new_pool(db.to_str().unwrap())
+                .await
+                .is_err()
+        );
+
+        let options = sqlx::sqlite::SqlitePoolOptions::new()
+            .max_connections(1)
+            .connect(&format!("sqlite://{}", db.display()))
+            .await
+            .unwrap();
+        let count: i64 =
+            sqlx::query_scalar("SELECT COUNT(*) FROM configuration WHERE key = 'biliup'")
+                .fetch_one(&options)
+                .await
+                .unwrap();
+        assert_eq!(
+            count, 2,
+            "migration must not pick an administrator implicitly"
+        );
+    }
+}
diff --git a/crates/biliup-cli/src/server/infrastructure/repositories.rs b/crates/biliup-cli/src/server/infrastructure/repositories.rs
index 0188f51..7d885fa 100644
--- a/crates/biliup-cli/src/server/infrastructure/repositories.rs
+++ b/crates/biliup-cli/src/server/infrastructure/repositories.rs
@@ -6,8 +6,12 @@ use crate::server::infrastructure::models::upload_streamer::{
     InsertUploadStreamer, UploadStreamer,
 };
 use crate::server::infrastructure::models::{Configuration, InsertConfiguration};
+use biliup::uploader::credential::{LoginInfo, lock_credential_file, normalize_credential_path};
 use error_stack::{ResultExt, bail};
 use ormlite::{Insert, Model};
+use serde::Serialize;
+use std::io::Write;
+use std::path::{Path, PathBuf};
 
 /// 根据ID获取直播主播信息
 ///
@@ -257,3 +261,664 @@ pub async fn get_all_uploader(pool: &ConnectionPool) -> AppResult<Vec<UploadStre
         .await
         .change_context(AppError::Unknown)
 }
+
+/// Register a CLI cookie file in the Web UI's user registry.
+///
+/// The CLI stores Bilibili credentials in a JSON file, while the Web UI stores
+/// references to those files in the `configuration` table.  Keep the two
+/// representations linked by registering an existing file at server startup.
+/// The canonical path makes the entry usable even when callers use different
+/// relative-path spellings, and the upsert is idempotent so restarting the
+/// server does not create duplicate accounts.
+pub async fn register_bilibili_cookie(
+    pool: &ConnectionPool,
+    cookie_file: impl AsRef<Path>,
+) -> AppResult<Option<Configuration>> {
+    let requested_cookie_file = cookie_file.as_ref();
+    let cookie_file = normalize_credential_path(requested_cookie_file)
+        .change_context(AppError::Unknown)
+        .attach_with(|| format!("normalize cookie file {}", requested_cookie_file.display()))?;
+    let _guard = lock_credential_file(&cookie_file)
+        .await
+        .change_context(AppError::Unknown)
+        .attach_with(|| format!("lock cookie file {}", cookie_file.display()))?;
+    if !cookie_file.is_file() {
+        return Ok(None);
+    }
+
+    // Registration confers permission to read and eventually delete this file,
+    // so require it to actually be a supported credential document.
+    let file = std::fs::File::open(&cookie_file)
+        .change_context(AppError::Unknown)
+        .attach_with(|| format!("open cookie file {}", cookie_file.display()))?;
+    serde_json::from_reader::<_, LoginInfo>(std::io::BufReader::new(file))
+        .change_context(AppError::Custom("无效的 B 站凭据文件".into()))?;
+
+    let cookie_path = cookie_file.to_string_lossy().into_owned();
+
+    let inserted = sqlx::query_as::<_, Configuration>(
+        r#"
+        INSERT INTO configuration (key, value)
+        VALUES ('bilibili-cookies', ?1)
+        ON CONFLICT DO NOTHING
+        RETURNING id, key, value
+        "#,
+    )
+    .bind(&cookie_path)
+    .fetch_optional(pool)
+    .await
+    .change_context(AppError::Unknown)?;
+    if inserted.is_some() {
+        return Ok(inserted);
+    }
+
+    Configuration::select()
+        .where_("key = ? AND value = ?")
+        .bind("bilibili-cookies")
+        .bind(&cookie_path)
+        .fetch_optional(pool)
+        .await
+        .change_context(AppError::Unknown)
+}
+
+#[derive(Debug, Serialize)]
+pub struct DeletedBilibiliCookie {
+    pub id: i64,
+    pub file_deleted: bool,
+    pub references_remaining: usize,
+}
+
+fn normalize_cookie_reference(
+    value: impl AsRef<Path>,
+    server_root: &Path,
+) -> std::io::Result<PathBuf> {
+    let value = value.as_ref();
+    if value.is_absolute() {
+        normalize_credential_path(value)
+    } else {
+        normalize_credential_path(server_root.join(value))
+    }
+}
+
+fn references_path(value: &str, target: &Path, server_root: &Path) -> bool {
+    normalize_cookie_reference(value, server_root)
+        .map(|path| path == target)
+        .unwrap_or(false)
+}
+
+fn restore_file(
+    path: &Path,
+    contents: &[u8],
+    permissions: std::fs::Permissions,
+) -> std::io::Result<()> {
+    let parent = path.parent().unwrap_or_else(|| Path::new("."));
+    let file_name = path
+        .file_name()
+        .and_then(|name| name.to_str())
+        .unwrap_or("credentials");
+    let temporary = parent.join(format!(
+        ".{file_name}.biliup-restore-{}-{:016x}",
+        std::process::id(),
+        rand::random::<u64>()
+    ));
+    let result = (|| {
+        let mut options = std::fs::OpenOptions::new();
+        options.write(true).create_new(true);
+        let mut file = options.open(&temporary)?;
+        file.set_permissions(permissions)?;
+        file.write_all(contents)?;
+        file.sync_all()?;
+        std::fs::rename(&temporary, path)
+    })();
+    if result.is_err() {
+        let _ = std::fs::remove_file(&temporary);
+    }
+    result
+}
+
+/// Delete one Web user registration and, if no other configuration or upload
+/// template references it, remove the credential file as well.
+pub async fn delete_bilibili_cookie(
+    pool: &ConnectionPool,
+    id: i64,
+) -> AppResult<DeletedBilibiliCookie> {
+    let server_root = std::env::current_dir().change_context(AppError::Unknown)?;
+    delete_bilibili_cookie_from(pool, id, &server_root).await
+}
+
+async fn delete_bilibili_cookie_from(
+    pool: &ConnectionPool,
+    id: i64,
+    server_root: &Path,
+) -> AppResult<DeletedBilibiliCookie> {
+    let initial = sqlx::query_as::<_, Configuration>(
+        "SELECT id, key, value FROM configuration WHERE id = ?1 AND key = 'bilibili-cookies'",
+    )
+    .bind(id)
+    .fetch_optional(pool)
+    .await
+    .change_context(AppError::Unknown)?
+    .ok_or_else(|| AppError::Custom("B 站用户不存在".into()))?;
+
+    let target_path = normalize_cookie_reference(&initial.value, server_root)
+        .change_context(AppError::Unknown)
+        .attach_with(|| format!("normalize cookie file registered as user {id}"))?;
+    let _guard = lock_credential_file(&target_path)
+        .await
+        .change_context(AppError::Unknown)?;
+
+    let mut tx = pool.begin().await.change_context(AppError::Unknown)?;
+    // Upgrade the SQLite transaction to a writer before checking references,
+    // preventing a template or configuration insert from racing the decision.
+    sqlx::query("UPDATE configuration SET id = id WHERE 0")
+        .execute(&mut *tx)
+        .await
+        .change_context(AppError::Unknown)?;
+
+    let target = sqlx::query_as::<_, Configuration>(
+        "SELECT id, key, value FROM configuration WHERE id = ?1 AND key = 'bilibili-cookies'",
+    )
+    .bind(id)
+    .fetch_optional(&mut *tx)
+    .await
+    .change_context(AppError::Unknown)?
+    .ok_or_else(|| AppError::Custom("B 站用户不存在".into()))?;
+    if normalize_cookie_reference(&target.value, server_root).change_context(AppError::Unknown)?
+        != target_path
+    {
+        bail!(AppError::Custom("用户凭据路径在删除期间发生变化".into()));
+    }
+
+    let configurations = sqlx::query_as::<_, Configuration>(
+        "SELECT id, key, value FROM configuration WHERE id <> ?1",
+    )
+    .bind(id)
+    .fetch_all(&mut *tx)
+    .await
+    .change_context(AppError::Unknown)?;
+    let mut references_remaining = configurations
+        .iter()
+        .filter(|configuration| references_path(&configuration.value, &target_path, server_root))
+        .count();
+
+    let upload_cookie_paths: Vec<Option<String>> =
+        sqlx::query_scalar("SELECT user_cookie FROM uploadstreamers")
+            .fetch_all(&mut *tx)
+            .await
+            .change_context(AppError::Unknown)?;
+    let default_cookie = normalize_cookie_reference("cookies.json", server_root)
+        .change_context(AppError::Unknown)?;
+    for reference in upload_cookie_paths {
+        match reference {
+            Some(reference) if references_path(&reference, &target_path, server_root) => {
+                references_remaining += 1;
+            }
+            None if default_cookie == target_path => references_remaining += 1,
+            _ => {}
+        }
+    }
+
+    let mut quarantine: Option<PathBuf> = None;
+    let mut backup = None;
+    if references_remaining == 0 && target_path.exists() {
+        let metadata = std::fs::metadata(&target_path)
+            .change_context(AppError::Unknown)
+            .attach("read credential metadata before deletion")?;
+        if !metadata.is_file() {
+            bail!(AppError::Custom("登记的凭据路径不是普通文件".into()));
+        }
+        const MAX_CREDENTIAL_SIZE: u64 = 16 * 1024 * 1024;
+        if metadata.len() > MAX_CREDENTIAL_SIZE {
+            bail!(AppError::Custom("凭据文件异常过大，拒绝自动删除".into()));
+        }
+        let contents = std::fs::read(&target_path)
+            .change_context(AppError::Unknown)
+            .attach("back up credential before deletion")?;
+        let parent = target_path.parent().unwrap_or_else(|| Path::new("."));
+        let file_name = target_path
+            .file_name()
+            .and_then(|name| name.to_str())
+            .unwrap_or("credentials");
+        let quarantined = parent.join(format!(
+            ".{file_name}.biliup-delete-{}-{:016x}",
+            std::process::id(),
+            rand::random::<u64>()
+        ));
+        std::fs::rename(&target_path, &quarantined)
+            .change_context(AppError::Unknown)
+            .attach("quarantine credential before deletion")?;
+        quarantine = Some(quarantined);
+        backup = Some((contents, metadata.permissions()));
+    }
+
+    let delete_result =
+        sqlx::query("DELETE FROM configuration WHERE id = ?1 AND key = 'bilibili-cookies'")
+            .bind(id)
+            .execute(&mut *tx)
+            .await;
+    let delete_result = match delete_result {
+        Ok(result) if result.rows_affected() == 1 => result,
+        Ok(_) => {
+            if let Some(quarantine) = quarantine.as_ref() {
+                std::fs::rename(quarantine, &target_path)
+                    .change_context(AppError::Unknown)
+                    .attach("restore quarantined credential after an empty database delete")?;
+            }
+            bail!(AppError::Custom("B 站用户不存在".into()));
+        }
+        Err(error) => {
+            if let Some(quarantine) = quarantine.as_ref() {
+                if let Err(restore_error) = std::fs::rename(quarantine, &target_path) {
+                    bail!(AppError::Custom(format!(
+                        "数据库删除失败且无法恢复已隔离的凭据文件: {error}; {restore_error}"
+                    )));
+                }
+            }
+            return Err(error).change_context(AppError::Unknown);
+        }
+    };
+    debug_assert_eq!(delete_result.rows_affected(), 1);
+
+    if let Some(quarantine) = quarantine.as_ref()
+        && let Err(error) = std::fs::remove_file(quarantine)
+    {
+        let restore_result = std::fs::rename(quarantine, &target_path);
+        tx.rollback().await.change_context(AppError::Unknown)?;
+        return match restore_result {
+            Ok(()) => Err(error)
+                .change_context(AppError::Custom("删除凭据文件失败，用户记录已保留".into())),
+            Err(restore_error) => bail!(AppError::Custom(format!(
+                "删除凭据文件失败且无法从隔离路径恢复: {error}; {restore_error}"
+            ))),
+        };
+    }
+
+    if let Err(commit_error) = tx.commit().await {
+        if let Some((contents, permissions)) = backup {
+            restore_file(&target_path, &contents, permissions)
+                .change_context(AppError::Unknown)
+                .attach("restore credential after database commit failure")?;
+        }
+        return Err(commit_error).change_context(AppError::Unknown);
+    }
+
+    Ok(DeletedBilibiliCookie {
+        id,
+        file_deleted: quarantine.is_some(),
+        references_remaining,
+    })
+}
+
+#[cfg(test)]
+mod cookie_tests {
+    use super::{delete_bilibili_cookie_from, register_bilibili_cookie};
+    use crate::server::infrastructure::connection_pool::ConnectionManager;
+    use std::fs;
+    use std::path::Path;
+
+    fn write_cookie(path: &Path) {
+        fs::write(
+            path,
+            r#"{
+                "cookie_info": {"cookies": []},
+                "sso": [],
+                "token_info": {
+                    "access_token": "test-access-token",
+                    "expires_in": 3600,
+                    "mid": 1,
+                    "refresh_token": "test-refresh-token"
+                },
+                "platform": "Android"
+            }"#,
+        )
+        .unwrap();
+    }
+
+    async fn setup() -> (
+        tempfile::TempDir,
+        crate::server::infrastructure::connection_pool::ConnectionPool,
+    ) {
+        let dir = tempfile::tempdir().unwrap();
+        let db = dir.path().join("data.sqlite3");
+        let pool = ConnectionManager::new_pool(db.to_str().unwrap())
+            .await
+            .unwrap();
+        (dir, pool)
+    }
+
+    #[tokio::test]
+    async fn registers_existing_cookie_file_once_using_canonical_path() {
+        let dir = tempfile::tempdir().unwrap();
+        let db = dir.path().join("data.sqlite3");
+        let cookie = dir.path().join("cookies.json");
+        write_cookie(&cookie);
+        let pool = ConnectionManager::new_pool(db.to_str().unwrap())
+            .await
+            .unwrap();
+
+        let first = register_bilibili_cookie(&pool, &cookie).await.unwrap();
+        let second = register_bilibili_cookie(&pool, &cookie).await.unwrap();
+
+        assert_eq!(
+            first.as_ref().map(|value| value.value.as_str()),
+            Some(cookie.canonicalize().unwrap().to_str().unwrap())
+        );
+        assert_eq!(
+            second.as_ref().map(|value| value.id),
+            first.as_ref().map(|value| value.id)
+        );
+        let count: i64 =
+            sqlx::query_scalar("SELECT COUNT(*) FROM configuration WHERE key = 'bilibili-cookies'")
+                .fetch_one(&pool)
+                .await
+                .unwrap();
+        assert_eq!(count, 1);
+    }
+
+    #[tokio::test]
+    async fn ignores_missing_cookie_file() {
+        let dir = tempfile::tempdir().unwrap();
+        let db = dir.path().join("data.sqlite3");
+        let pool = ConnectionManager::new_pool(db.to_str().unwrap())
+            .await
+            .unwrap();
+
+        assert!(
+            register_bilibili_cookie(&pool, dir.path().join("missing.json"))
+                .await
+                .unwrap()
+                .is_none()
+        );
+    }
+
+    #[tokio::test]
+    async fn concurrent_registration_is_atomic_and_idempotent() {
+        let dir = tempfile::tempdir().unwrap();
+        let db = dir.path().join("data.sqlite3");
+        let cookie = dir.path().join("cookies.json");
+        write_cookie(&cookie);
+        let pool = ConnectionManager::new_pool(db.to_str().unwrap())
+            .await
+            .unwrap();
+
+        let mut tasks = Vec::new();
+        for _ in 0..12 {
+            let pool = pool.clone();
+            let cookie = cookie.clone();
+            tasks.push(tokio::spawn(async move {
+                register_bilibili_cookie(&pool, cookie).await.unwrap()
+            }));
+        }
+        for task in tasks {
+            assert!(task.await.unwrap().is_some());
+        }
+
+        let count: i64 =
+            sqlx::query_scalar("SELECT COUNT(*) FROM configuration WHERE key = 'bilibili-cookies'")
+                .fetch_one(&pool)
+                .await
+                .unwrap();
+        assert_eq!(count, 1);
+    }
+
+    #[tokio::test]
+    async fn rejects_non_credential_json() {
+        let (dir, pool) = setup().await;
+        let cookie = dir.path().join("not-a-cookie.json");
+        fs::write(&cookie, "{}").unwrap();
+
+        assert!(register_bilibili_cookie(&pool, cookie).await.is_err());
+    }
+
+    #[tokio::test]
+    async fn deletes_an_unreferenced_cookie_file_and_only_its_user_row() {
+        let (dir, pool) = setup().await;
+        let cookie = dir.path().join("private.json");
+        write_cookie(&cookie);
+        let user = register_bilibili_cookie(&pool, &cookie)
+            .await
+            .unwrap()
+            .unwrap();
+        sqlx::query("INSERT INTO configuration (key, value) VALUES ('config', '{}')")
+            .execute(&pool)
+            .await
+            .unwrap();
+
+        let deleted = delete_bilibili_cookie_from(&pool, user.id, dir.path())
+            .await
+            .unwrap();
+
+        assert!(deleted.file_deleted);
+        assert_eq!(deleted.references_remaining, 0);
+        assert!(!cookie.exists());
+        let config_count: i64 =
+            sqlx::query_scalar("SELECT COUNT(*) FROM configuration WHERE key = 'config'")
+                .fetch_one(&pool)
+                .await
+                .unwrap();
+        assert_eq!(config_count, 1);
+    }
+
+    #[tokio::test]
+    async fn shared_relative_and_symlink_references_preserve_the_file() {
+        let (dir, pool) = setup().await;
+        let cookie = dir.path().join("shared.json");
+        write_cookie(&cookie);
+        let user = register_bilibili_cookie(&pool, &cookie)
+            .await
+            .unwrap()
+            .unwrap();
+
+        #[cfg(unix)]
+        let reference = {
+            use std::os::unix::fs::symlink;
+            let link = dir.path().join("linked.json");
+            symlink(&cookie, &link).unwrap();
+            "linked.json"
+        };
+        #[cfg(not(unix))]
+        let reference = "shared.json";
+        sqlx::query("INSERT INTO configuration (key, value) VALUES ('bilibili-cookies', ?1)")
+            .bind(reference)
+            .execute(&pool)
+            .await
+            .unwrap();
+
+        let deleted = delete_bilibili_cookie_from(&pool, user.id, dir.path())
+            .await
+            .unwrap();
+        assert!(!deleted.file_deleted);
+        assert_eq!(deleted.references_remaining, 1);
+        assert!(cookie.exists());
+    }
+
+    #[tokio::test]
+    async fn explicit_upload_template_reference_preserves_the_file() {
+        let (dir, pool) = setup().await;
+        let cookie = dir.path().join("template.json");
+        write_cookie(&cookie);
+        let user = register_bilibili_cookie(&pool, &cookie)
+            .await
+            .unwrap()
+            .unwrap();
+        sqlx::query(
+            "INSERT INTO uploadstreamers (template_name, tags, user_cookie) VALUES ('template', '[]', 'template.json')",
+        )
+        .execute(&pool)
+        .await
+        .unwrap();
+
+        let deleted = delete_bilibili_cookie_from(&pool, user.id, dir.path())
+            .await
+            .unwrap();
+        assert!(!deleted.file_deleted);
+        assert_eq!(deleted.references_remaining, 1);
+        assert!(cookie.exists());
+    }
+
+    #[tokio::test]
+    async fn null_upload_template_reference_preserves_the_default_cookie() {
+        let (dir, pool) = setup().await;
+        let cookie = dir.path().join("cookies.json");
+        write_cookie(&cookie);
+        let user = register_bilibili_cookie(&pool, &cookie)
+            .await
+            .unwrap()
+            .unwrap();
+        sqlx::query(
+            "INSERT INTO uploadstreamers (template_name, tags, user_cookie) VALUES ('default-template', '[]', NULL)",
+        )
+        .execute(&pool)
+        .await
+        .unwrap();
+
+        let deleted = delete_bilibili_cookie_from(&pool, user.id, dir.path())
+            .await
+            .unwrap();
+        assert!(!deleted.file_deleted);
+        assert_eq!(deleted.references_remaining, 1);
+        assert!(cookie.exists());
+    }
+
+    #[tokio::test]
+    async fn refuses_to_delete_non_cookie_configuration_rows() {
+        let (dir, pool) = setup().await;
+        let result = sqlx::query("INSERT INTO configuration (key, value) VALUES ('config', '{}')")
+            .execute(&pool)
+            .await
+            .unwrap();
+
+        assert!(
+            delete_bilibili_cookie_from(&pool, result.last_insert_rowid(), dir.path())
+                .await
+                .is_err()
+        );
+        let count: i64 =
+            sqlx::query_scalar("SELECT COUNT(*) FROM configuration WHERE key = 'config'")
+                .fetch_one(&pool)
+                .await
+                .unwrap();
+        assert_eq!(count, 1);
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn filesystem_failure_keeps_the_user_row_and_file() {
+        use std::os::unix::fs::PermissionsExt;
+
+        let (dir, pool) = setup().await;
+        let credential_dir = dir.path().join("credentials");
+        fs::create_dir(&credential_dir).unwrap();
+        let cookie = credential_dir.join("protected.json");
+        write_cookie(&cookie);
+        let user = register_bilibili_cookie(&pool, &cookie)
+            .await
+            .unwrap()
+            .unwrap();
+        fs::set_permissions(&credential_dir, fs::Permissions::from_mode(0o500)).unwrap();
+
+        let result = delete_bilibili_cookie_from(&pool, user.id, dir.path()).await;
+        fs::set_permissions(&credential_dir, fs::Permissions::from_mode(0o700)).unwrap();
+
+        assert!(result.is_err());
+        assert!(cookie.exists());
+        let count: i64 = sqlx::query_scalar(
+            "SELECT COUNT(*) FROM configuration WHERE id = ?1 AND key = 'bilibili-cookies'",
+        )
+        .bind(user.id)
+        .fetch_one(&pool)
+        .await
+        .unwrap();
+        assert_eq!(count, 1);
+    }
+
+    #[tokio::test]
+    async fn database_delete_failure_restores_the_quarantined_file_and_row() {
+        let (dir, pool) = setup().await;
+        let cookie = dir.path().join("rollback.json");
+        write_cookie(&cookie);
+        let original = fs::read(&cookie).unwrap();
+        let user = register_bilibili_cookie(&pool, &cookie)
+            .await
+            .unwrap()
+            .unwrap();
+        sqlx::query(&format!(
+            "CREATE TRIGGER prevent_cookie_delete BEFORE DELETE ON configuration WHEN OLD.id = {} BEGIN SELECT RAISE(ABORT, 'blocked'); END",
+            user.id
+        ))
+        .execute(&pool)
+        .await
+        .unwrap();
+
+        assert!(
+            delete_bilibili_cookie_from(&pool, user.id, dir.path())
+                .await
+                .is_err()
+        );
+        assert_eq!(fs::read(&cookie).unwrap(), original);
+        let count: i64 = sqlx::query_scalar(
+            "SELECT COUNT(*) FROM configuration WHERE id = ?1 AND key = 'bilibili-cookies'",
+        )
+        .bind(user.id)
+        .fetch_one(&pool)
+        .await
+        .unwrap();
+        assert_eq!(count, 1);
+    }
+
+    #[tokio::test]
+    async fn qr_style_relative_cookie_path_is_deleted_from_the_server_root() {
+        let (dir, pool) = setup().await;
+        let data = dir.path().join("data");
+        fs::create_dir(&data).unwrap();
+        let cookie = data.join("42.json");
+        write_cookie(&cookie);
+        let inserted = sqlx::query(
+            "INSERT INTO configuration (key, value) VALUES ('bilibili-cookies', 'data/42.json')",
+        )
+        .execute(&pool)
+        .await
+        .unwrap();
+
+        let deleted = delete_bilibili_cookie_from(&pool, inserted.last_insert_rowid(), dir.path())
+            .await
+            .unwrap();
+        assert!(deleted.file_deleted);
+        assert!(!cookie.exists());
+    }
+
+    #[tokio::test]
+    async fn concurrent_deletes_remove_exactly_one_row_and_file() {
+        let (dir, pool) = setup().await;
+        let cookie = dir.path().join("concurrent-delete.json");
+        write_cookie(&cookie);
+        let user = register_bilibili_cookie(&pool, &cookie)
+            .await
+            .unwrap()
+            .unwrap();
+
+        let first = tokio::spawn({
+            let pool = pool.clone();
+            let root = dir.path().to_path_buf();
+            async move { delete_bilibili_cookie_from(&pool, user.id, &root).await }
+        });
+        let second = tokio::spawn({
+            let pool = pool.clone();
+            let root = dir.path().to_path_buf();
+            async move { delete_bilibili_cookie_from(&pool, user.id, &root).await }
+        });
+        let results = [first.await.unwrap(), second.await.unwrap()];
+
+        assert_eq!(results.iter().filter(|result| result.is_ok()).count(), 1);
+        assert_eq!(results.iter().filter(|result| result.is_err()).count(), 1);
+        assert!(!cookie.exists());
+        let count: i64 = sqlx::query_scalar(
+            "SELECT COUNT(*) FROM configuration WHERE id = ?1 AND key = 'bilibili-cookies'",
+        )
+        .bind(user.id)
+        .fetch_one(&pool)
+        .await
+        .unwrap();
+        assert_eq!(count, 0);
+    }
+}
diff --git a/crates/biliup-cli/src/server/infrastructure/users.rs b/crates/biliup-cli/src/server/infrastructure/users.rs
index 7a124b5..34782c9 100644
--- a/crates/biliup-cli/src/server/infrastructure/users.rs
+++ b/crates/biliup-cli/src/server/infrastructure/users.rs
@@ -1,12 +1,26 @@
 use crate::server::errors::{AppError, AppResult};
 use crate::server::infrastructure::connection_pool::ConnectionPool;
 use axum_login::{AuthUser, AuthnBackend, UserId};
-use error_stack::{ResultExt, bail};
+use error_stack::ResultExt;
 use password_auth::{generate_hash, verify_password};
 use serde::{Deserialize, Serialize};
 use sqlx::FromRow;
+use std::sync::{Arc, OnceLock};
+use tokio::sync::{OwnedSemaphorePermit, Semaphore};
 use tokio::task;
 
+const MAX_CONCURRENT_PASSWORD_TASKS: usize = 4;
+static PASSWORD_TASKS: OnceLock<Arc<Semaphore>> = OnceLock::new();
+
+async fn acquire_password_task_permit() -> OwnedSemaphorePermit {
+    PASSWORD_TASKS
+        .get_or_init(|| Arc::new(Semaphore::new(MAX_CONCURRENT_PASSWORD_TASKS)))
+        .clone()
+        .acquire_owned()
+        .await
+        .expect("the password-task semaphore is never closed")
+}
+
 /// 用户数据结构
 /// 存储用户的基本信息，包括ID、用户名和密码哈希
 #[derive(Clone, Serialize, Deserialize, FromRow)]
@@ -102,15 +116,48 @@ impl Backend {
     ///
     /// # 返回
     /// 返回创建的用户信息
-    pub async fn create_user(&mut self, creds: Credentials) -> AppResult<User> {
+    pub async fn create_user(&self, creds: Credentials) -> Result<User, CreateUserError> {
         // 创建新用户账户
         // 验证输入
-        if creds.username.is_empty() || creds.password.is_empty() {
-            bail!(AppError::Custom("用户名和密码不能为空".into()))
+        const MAX_PASSWORD_BYTES: usize = 1024;
+        if creds.username != "biliup"
+            || creds.password.is_empty()
+            || creds.password.len() > MAX_PASSWORD_BYTES
+        {
+            return Err(CreateUserError::InvalidCredentials);
         }
 
-        // 生成密码哈希
-        let password_hash = generate_hash(&creds.password);
+        // Avoid an unbounded Argon2 CPU sink on the public bootstrap route once
+        // the one permitted administrator already exists. The unique index is
+        // still the authoritative guard for concurrent first-time requests.
+        let initialized: i64 =
+            sqlx::query_scalar("SELECT EXISTS(SELECT 1 FROM configuration WHERE key = 'biliup')")
+                .fetch_one(&self.db)
+                .await
+                .map_err(CreateUserError::Database)?;
+        if initialized != 0 {
+            return Err(CreateUserError::AlreadyExists);
+        }
+
+        // Argon2 is deliberately expensive and must not block an async worker.
+        let permit = acquire_password_task_permit().await;
+        // Requests may have queued behind the bounded password workers while
+        // another bootstrap completed. Re-check before spending CPU, and keep
+        // the permit until the unique insert finishes so queued requests see
+        // the newly-created identity instead of hashing needlessly.
+        let initialized: i64 =
+            sqlx::query_scalar("SELECT EXISTS(SELECT 1 FROM configuration WHERE key = 'biliup')")
+                .fetch_one(&self.db)
+                .await
+                .map_err(CreateUserError::Database)?;
+        if initialized != 0 {
+            return Err(CreateUserError::AlreadyExists);
+        }
+        let password = creds.password;
+        let (password_hash, _permit) =
+            task::spawn_blocking(move || (generate_hash(password), permit))
+                .await
+                .map_err(CreateUserError::HashingTask)?;
         // 插入用户并返回
         let user = sqlx::query_as(
             r#"
@@ -125,15 +172,27 @@ impl Backend {
         .await
         .map_err(|e| match e {
             sqlx::Error::Database(db_err) if db_err.is_unique_violation() => {
-                AppError::Custom("用户名已存在".into())
+                CreateUserError::AlreadyExists
             }
-            _ => AppError::Custom(e.to_string()),
+            error => CreateUserError::Database(error),
         })?;
 
         Ok(user)
     }
 }
 
+#[derive(Debug, thiserror::Error)]
+pub enum CreateUserError {
+    #[error("username must be 'biliup' and password must contain 1 to 1024 bytes")]
+    InvalidCredentials,
+    #[error("the Web administrator has already been initialized")]
+    AlreadyExists,
+    #[error("database error")]
+    Database(#[source] sqlx::Error),
+    #[error("password hashing task failed")]
+    HashingTask(#[source] task::JoinError),
+}
+
 /// 认证相关的错误类型
 #[derive(Debug, thiserror::Error)]
 pub enum Error {
@@ -162,13 +221,18 @@ impl AuthnBackend for Backend {
         &self,
         creds: Self::Credentials,
     ) -> Result<Option<Self::User>, Self::Error> {
+        if creds.username != "biliup" || creds.password.is_empty() || creds.password.len() > 1024 {
+            return Ok(None);
+        }
         let user: Option<Self::User> = sqlx::query_as("select * from configuration where key = ? ")
             .bind("biliup")
             .fetch_optional(&self.db)
             .await?;
 
         // 密码验证是阻塞且可能较慢的操作，所以通过spawn_blocking执行
-        task::spawn_blocking(|| {
+        let permit = acquire_password_task_permit().await;
+        task::spawn_blocking(move || {
+            let _permit = permit;
             // 使用基于密码的认证 - 通过比较表单输入与argon2密码哈希来工作
             Ok(user.filter(|user| verify_password(creds.password, &user.value).is_ok()))
         })
@@ -180,8 +244,9 @@ impl AuthnBackend for Backend {
     /// # 参数
     /// * `user_id` - 用户ID
     async fn get_user(&self, user_id: &UserId<Self>) -> Result<Option<Self::User>, Self::Error> {
-        let user = sqlx::query_as("select * from configuration where id = ?")
+        let user = sqlx::query_as("select * from configuration where id = ? and key = ?")
             .bind(user_id)
+            .bind("biliup")
             .fetch_optional(&self.db)
             .await?;
 
@@ -192,3 +257,104 @@ impl AuthnBackend for Backend {
 // 为了方便使用的类型别名
 // 注意这里我们提供了具体的后端实现
 pub type AuthSession = axum_login::AuthSession<Backend>;
+
+#[cfg(test)]
+mod tests {
+    use super::{AuthnBackend, Backend, CreateUserError, Credentials};
+    use crate::server::infrastructure::connection_pool::ConnectionManager;
+
+    fn credentials(password: &str) -> Credentials {
+        Credentials {
+            username: "biliup".into(),
+            password: password.into(),
+            next: None,
+        }
+    }
+
+    #[tokio::test]
+    async fn administrator_bootstrap_is_one_time_and_passwords_are_checked() {
+        let dir = tempfile::tempdir().unwrap();
+        let db = dir.path().join("data.sqlite3");
+        let pool = ConnectionManager::new_pool(db.to_str().unwrap())
+            .await
+            .unwrap();
+        let backend = Backend::new(pool);
+
+        assert!(matches!(
+            backend.create_user(credentials("")).await,
+            Err(CreateUserError::InvalidCredentials)
+        ));
+        assert!(matches!(
+            backend.create_user(credentials(&"x".repeat(1025))).await,
+            Err(CreateUserError::InvalidCredentials)
+        ));
+        backend
+            .create_user(credentials("correct horse"))
+            .await
+            .unwrap();
+        assert!(matches!(
+            backend.create_user(credentials("second password")).await,
+            Err(CreateUserError::AlreadyExists)
+        ));
+        assert!(
+            backend
+                .authenticate(credentials("wrong password"))
+                .await
+                .unwrap()
+                .is_none()
+        );
+        assert!(
+            backend
+                .authenticate(credentials("correct horse"))
+                .await
+                .unwrap()
+                .is_some()
+        );
+        assert!(
+            backend
+                .authenticate(credentials(&"x".repeat(1025)))
+                .await
+                .unwrap()
+                .is_none()
+        );
+    }
+
+    #[tokio::test]
+    async fn concurrent_bootstrap_creates_exactly_one_administrator() {
+        let dir = tempfile::tempdir().unwrap();
+        let db = dir.path().join("data.sqlite3");
+        let pool = ConnectionManager::new_pool(db.to_str().unwrap())
+            .await
+            .unwrap();
+        let backend = Backend::new(pool.clone());
+
+        let mut tasks = Vec::new();
+        for index in 0..4 {
+            let backend = backend.clone();
+            tasks.push(tokio::spawn(async move {
+                backend
+                    .create_user(credentials(&format!("password-{index}")))
+                    .await
+            }));
+        }
+
+        let mut created = 0;
+        let mut rejected = 0;
+        for task in tasks {
+            match task.await.unwrap() {
+                Ok(_) => created += 1,
+                Err(CreateUserError::AlreadyExists) => rejected += 1,
+                Err(error) => panic!("unexpected bootstrap error: {error}"),
+            }
+        }
+        assert_eq!(created, 1);
+        assert_eq!(rejected, 3);
+
+        let count: i64 =
+            sqlx::query_scalar("SELECT COUNT(*) FROM configuration WHERE key = 'biliup'")
+                .fetch_one(&pool)
+                .await
+                .unwrap();
+        assert_eq!(count, 1);
+    }
+}
diff --git a/crates/biliup-cli/src/server/router.rs b/crates/biliup-cli/src/server/router.rs
index e013301..ce13285 100644
--- a/crates/biliup-cli/src/server/router.rs
+++ b/crates/biliup-cli/src/server/router.rs
@@ -1,5 +1,5 @@
 use crate::server::api::bilibili_endpoints::{
-    archive_pre_endpoint, get_myinfo_endpoint, get_proxy_endpoint,
+    archive_pre_endpoint, get_user_archives_endpoint, get_user_profile_endpoint,
 };
 use crate::server::api::endpoints::{
     add_upload_streamer_endpoint, add_user_endpoint, delete_streamers_endpoint,
@@ -13,10 +13,14 @@ use crate::server::infrastructure::service_register::ServiceRegister;
 use axum::Router;
 use axum::body::Body;
 use axum::http::Request;
-use axum::response::IntoResponse;
+use axum::http::StatusCode;
+use axum::response::{IntoResponse, Response};
 use axum::routing::{delete, get, post, put};
 use tower::ServiceExt;
 use tower_http::services::ServeFile;
+
+const ALLOWED_MEDIA_EXTENSIONS: &[&str] = &["mp4", "flv", "3gp", "webm", "mkv", "ts"];
+const ALLOWED_LOG_FILES: &[&str] = &["ds_update.log", "download.log", "upload.log"];
 /// 创建应用程序路由
 pub fn router(service_register: ServiceRegister) -> Router<()> {
     Router::new()
@@ -47,11 +51,13 @@ pub fn router(service_register: ServiceRegister) -> Router<()> {
         .route("/v1/upload/streamers", post(add_upload_streamer_endpoint)) // 添加上传模板
         // 用户管理路由
         .route("/v1/users", get(get_users_endpoint).post(add_user_endpoint)) // 获取用户列表/添加用户
-        .route("/v1/users/{id}", delete(delete_user_endpoint)) // 删除用户
+        .route(
+            "/v1/users/{id}",
+            get(get_user_profile_endpoint).delete(delete_user_endpoint),
+        )
+        .route("/v1/users/{id}/archives", get(get_user_archives_endpoint))
         // B站API代理路由
         .route("/bili/archive/pre", get(archive_pre_endpoint)) // 投稿预处理
-        .route("/bili/space/myinfo", get(get_myinfo_endpoint)) // 获取用户信息
-        .route("/bili/proxy", get(get_proxy_endpoint)) // 代理请求
         // 认证相关路由
         .route("/v1/get_qrcode", get(get_qrcode)) // 获取二维码
         .route("/v1/login_by_qrcode", post(login_by_qrcode)) // 二维码登录
@@ -59,14 +65,161 @@ pub fn router(service_register: ServiceRegister) -> Router<()> {
         .route("/v1/videos", get(get_videos)) // 获取视频列表
         .route("/v1/status", get(get_status))
         .route("/v1/uploads", post(post_uploads))
-        .route_service("/static/{path}", get(using_serve_file_from_a_route))
+        .route("/static/{path}", get(using_serve_file_from_a_route))
         .with_state(service_register) // 注入服务注册器状态
 }
 
 async fn using_serve_file_from_a_route(
     axum::extract::Path(path): axum::extract::Path<String>,
     request: Request<Body>,
-) -> impl IntoResponse {
-    let serve_file = ServeFile::new(path);
-    serve_file.oneshot(request).await
+) -> Response {
+    let root = match std::env::current_dir() {
+        Ok(root) => root,
+        Err(_) => return StatusCode::INTERNAL_SERVER_ERROR.into_response(),
+    };
+    let path = match resolve_static_path(&root, &path) {
+        Ok(path) => path,
+        Err(StaticPathError::Invalid) => return StatusCode::BAD_REQUEST.into_response(),
+        Err(StaticPathError::NotFound) => return StatusCode::NOT_FOUND.into_response(),
+    };
+
+    ServeFile::new(path).oneshot(request).await.into_response()
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub(crate) enum StaticPathError {
+    Invalid,
+    NotFound,
+}
+
+fn resolve_static_path(
+    root: &std::path::Path,
+    requested: &str,
+) -> Result<std::path::PathBuf, StaticPathError> {
+    use std::path::{Component, Path};
+
+    // The endpoint intentionally accepts an opaque basename, not a filesystem
+    // path.  Reject both separator styles so the same rule holds on every OS.
+    if requested.is_empty() || requested.contains('/') || requested.contains('\\') {
+        return Err(StaticPathError::Invalid);
+    }
+    let requested_path = Path::new(requested);
+    let mut components = requested_path.components();
+    if !matches!(components.next(), Some(Component::Normal(_))) || components.next().is_some() {
+        return Err(StaticPathError::Invalid);
+    }
+
+    if !ALLOWED_LOG_FILES.contains(&requested) {
+        return resolve_media_path(root, requested);
+    }
+
+    let root = root.canonicalize().map_err(|_| StaticPathError::NotFound)?;
+    let candidate = root.join(requested);
+    let canonical = candidate
+        .canonicalize()
+        .map_err(|_| StaticPathError::NotFound)?;
+    if !canonical.starts_with(&root) || !canonical.is_file() {
+        return Err(StaticPathError::Invalid);
+    }
+    Ok(canonical)
+}
+
+pub(crate) fn resolve_media_path(
+    root: &std::path::Path,
+    requested: &str,
+) -> Result<std::path::PathBuf, StaticPathError> {
+    use std::path::{Component, Path};
+
+    if requested.is_empty() || requested.contains('/') || requested.contains('\\') {
+        return Err(StaticPathError::Invalid);
+    }
+    let requested_path = Path::new(requested);
+    let mut components = requested_path.components();
+    if !matches!(components.next(), Some(Component::Normal(_))) || components.next().is_some() {
+        return Err(StaticPathError::Invalid);
+    }
+    let allowed = requested_path
+        .extension()
+        .and_then(|extension| extension.to_str())
+        .is_some_and(|extension| {
+            ALLOWED_MEDIA_EXTENSIONS
+                .iter()
+                .any(|allowed| extension.eq_ignore_ascii_case(allowed))
+        });
+    if !allowed {
+        return Err(StaticPathError::Invalid);
+    }
+
+    let root = root.canonicalize().map_err(|_| StaticPathError::NotFound)?;
+    let canonical = root
+        .join(requested)
+        .canonicalize()
+        .map_err(|_| StaticPathError::NotFound)?;
+    if !canonical.starts_with(&root) || !canonical.is_file() {
+        return Err(StaticPathError::Invalid);
+    }
+    Ok(canonical)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{StaticPathError, resolve_static_path};
+    use std::fs;
+
+    #[test]
+    fn static_files_are_limited_to_media_and_known_logs() {
+        let root = tempfile::tempdir().unwrap();
+        let video = root.path().join("recording.mp4");
+        let log = root.path().join("ds_update.log");
+        let cookie = root.path().join("cookies.json");
+        fs::write(&video, b"video").unwrap();
+        fs::write(&log, b"log").unwrap();
+        fs::write(&cookie, b"secret").unwrap();
+
+        assert_eq!(
+            resolve_static_path(root.path(), "recording.mp4").unwrap(),
+            video
+        );
+        assert_eq!(
+            resolve_static_path(root.path(), "ds_update.log").unwrap(),
+            log
+        );
+        assert_eq!(
+            resolve_static_path(root.path(), "cookies.json"),
+            Err(StaticPathError::Invalid)
+        );
+    }
+
+    #[test]
+    fn static_files_reject_absolute_and_traversal_paths() {
+        let root = tempfile::tempdir().unwrap();
+
+        for path in [
+            "../secret.mp4",
+            "/etc/passwd.mp4",
+            "nested/video.mp4",
+            "..\\secret.mp4",
+        ] {
+            assert_eq!(
+                resolve_static_path(root.path(), path),
+                Err(StaticPathError::Invalid)
+            );
+        }
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn static_files_reject_symlinks_that_escape_the_root() {
+        use std::os::unix::fs::symlink;
+
+        let root = tempfile::tempdir().unwrap();
+        let outside = tempfile::NamedTempFile::new().unwrap();
+        let link = root.path().join("escape.mp4");
+        symlink(outside.path(), &link).unwrap();
+
+        assert_eq!(
+            resolve_static_path(root.path(), "escape.mp4"),
+            Err(StaticPathError::Invalid)
+        );
+    }
 }
diff --git a/crates/biliup-cli/src/uploader.rs b/crates/biliup-cli/src/uploader.rs
index 3e0ef44..215cbc4 100644
--- a/crates/biliup-cli/src/uploader.rs
+++ b/crates/biliup-cli/src/uploader.rs
@@ -4,7 +4,7 @@ use crate::upload_lock::UploadLock;
 use biliup::client::StatelessClient;
 use biliup::error::Kind;
 use biliup::uploader::bilibili::{BiliBili, Studio, Vid, Video};
-use biliup::uploader::credential::{Credential, LoginInfo};
+use biliup::uploader::credential::{Credential, LoginInfo, save_login_info};
 use biliup::uploader::line::Probe;
 use biliup::uploader::util::SubmitOption;
 use biliup::uploader::{VideoFile, credential, line, load_config};
@@ -22,7 +22,6 @@ use qrcode::render::unicode;
 use reqwest::Body;
 use serde::{Deserialize, Serialize};
 use std::ffi::OsStr;
-use std::io::Seek;
 use std::path::{Path, PathBuf};
 use std::pin::Pin;
 use std::sync::{Arc, Mutex};
@@ -94,26 +93,18 @@ pub async fn login(user_cookie: PathBuf, proxy: Option<&str>) -> AppResult<()> {
         5 => login_by_webqr_cookies(client).await?,
         _ => panic!(),
     };
-    let file = std::fs::File::create(user_cookie).change_context_lazy(|| AppError::Unknown)?;
-    serde_json::to_writer_pretty(&file, &info).change_context_lazy(|| AppError::Unknown)?;
-    info!("登录成功，数据保存在{:?}", file);
+    save_login_info(&user_cookie, &info)
+        .await
+        .change_context_lazy(|| AppError::Unknown)?;
+    info!("登录成功，凭据已保存到 {}", user_cookie.display());
     Ok(())
 }
 
 pub async fn renew(user_cookie: PathBuf, proxy: Option<&str>) -> AppResult<()> {
-    let client = Credential::new(proxy);
-    let mut file = fopen_rw(user_cookie)?;
-    let login_info: LoginInfo =
-        serde_json::from_reader(&file).change_context_lazy(|| AppError::Unknown)?;
-    let new_info = client
-        .renew_tokens(login_info)
+    credential::renew_login_info_file(&user_cookie, proxy)
         .await
         .change_context_lazy(|| AppError::Unknown)?;
-    file.rewind().change_context_lazy(|| AppError::Unknown)?;
-    file.set_len(0).change_context_lazy(|| AppError::Unknown)?;
-    serde_json::to_writer_pretty(std::io::BufWriter::new(&file), &new_info)
-        .change_context_lazy(|| AppError::Unknown)?;
-    info!("{new_info:?}");
+    info!("登录凭据刷新成功");
     Ok(())
 }
 
diff --git a/crates/biliup/Cargo.toml b/crates/biliup/Cargo.toml
index 9de085f..fc48ad1 100644
--- a/crates/biliup/Cargo.toml
+++ b/crates/biliup/Cargo.toml
@@ -44,6 +44,7 @@ libsm = "0.6.0"
 
 [dev-dependencies]
 tracing-subscriber = { workspace = true, features = ["env-filter"] }  # 添加特性（特性是累加的）  }
+tempfile = "3.14"
 
 [features]
 cli = ["clap"]
diff --git a/crates/biliup/src/downloader/hls.rs b/crates/biliup/src/downloader/hls.rs
index d86ea7a..5650d43 100644
--- a/crates/biliup/src/downloader/hls.rs
+++ b/crates/biliup/src/downloader/hls.rs
@@ -37,7 +37,12 @@ pub async fn download(
                 .iter()
                 .filter(|v| !v.is_i_frame && v.resolution.is_some())
                 .max_by_key(|v| v.bandwidth)
-                .or_else(|| pl.variants.iter().filter(|v| !v.is_i_frame).max_by_key(|v| v.bandwidth))
+                .or_else(|| {
+                    pl.variants
+                        .iter()
+                        .filter(|v| !v.is_i_frame)
+                        .max_by_key(|v| v.bandwidth)
+                })
                 .unwrap_or(&pl.variants[0]);
             info!(
                 "Selected variant: bandwidth={}, resolution={:?}, video={:?}",
diff --git a/crates/biliup/src/downloader/live/bilibili.rs b/crates/biliup/src/downloader/live/bilibili.rs
index abd13e0..7a77e16 100644
--- a/crates/biliup/src/downloader/live/bilibili.rs
+++ b/crates/biliup/src/downloader/live/bilibili.rs
@@ -596,7 +596,12 @@ impl BilibiliLive {
         let selected = self
             .cdn
             .iter()
-            .find_map(|cdn| group.iter().copied().find(|candidate| &candidate.cdn == cdn))
+            .find_map(|cdn| {
+                group
+                    .iter()
+                    .copied()
+                    .find(|candidate| &candidate.cdn == cdn)
+            })
             .unwrap_or(group[0]);
 
         if !self.cdn_fallback {
diff --git a/crates/biliup/src/downloader/live/douyu.rs b/crates/biliup/src/downloader/live/douyu.rs
index 9d96e37..09ad3d5 100644
--- a/crates/biliup/src/downloader/live/douyu.rs
+++ b/crates/biliup/src/downloader/live/douyu.rs
@@ -458,9 +458,8 @@ impl<'a> DouyuLive<'a> {
             }
         }
 
-        Err(last_error.unwrap_or_else(|| {
-            LiveError::custom(format!("获取 txSecret 失败: {stream_id}"))
-        }))
+        Err(last_error
+            .unwrap_or_else(|| LiveError::custom(format!("获取 txSecret 失败: {stream_id}"))))
     }
 
     async fn request_txsecret(&self, api: &str, stream_id: &str) -> LiveResult<XP2PTxSecret> {
@@ -860,7 +859,9 @@ mod tests {
 
         for _ in 0..50 {
             let ua = random_chrome_user_agent();
-            let caps = re.captures(&ua).unwrap_or_else(|| panic!("UA 格式错误: {ua}"));
+            let caps = re
+                .captures(&ua)
+                .unwrap_or_else(|| panic!("UA 格式错误: {ua}"));
             let version: u32 = caps[1].parse().unwrap();
             assert!(
                 (100..=120).contains(&version),
@@ -889,7 +890,8 @@ mod tests {
     }
 
     #[test]
-    fn white_encrypt_key_missing_expire_at_defaults_to_zero() {        let key: WhiteEncryptKey = serde_json::from_str(
+    fn white_encrypt_key_missing_expire_at_defaults_to_zero() {
+        let key: WhiteEncryptKey = serde_json::from_str(
             r#"{"rand_str":"r","enc_time":2,"is_special":0,"key":"k","enc_data":"e"}"#,
         )
         .unwrap();
@@ -927,10 +929,8 @@ mod tests {
     async fn resolve_room_id_uses_cached_real_room_id() {
         let url = "https://www.douyu.com/somename";
         let encrypt_key_cache = Mutex::new(None);
-        let real_room_id_cache = RwLock::new(HashMap::from([(
-            url.to_string(),
-            "10568722".to_string(),
-        )]));
+        let real_room_id_cache =
+            RwLock::new(HashMap::from([(url.to_string(), "10568722".to_string())]));
         let live = make_live(url, &encrypt_key_cache, &real_room_id_cache);
 
         // 命中缓存时不请求移动端页面
diff --git a/crates/biliup/src/downloader/live/huya.rs b/crates/biliup/src/downloader/live/huya.rs
index 8f28615..7d875bd 100644
--- a/crates/biliup/src/downloader/live/huya.rs
+++ b/crates/biliup/src/downloader/live/huya.rs
@@ -110,8 +110,7 @@ impl<'a> HuyaLive<'a> {
         // 因此 cdn_fallback 无论是否回退，最后都要重新取一次流地址
         if self.huya_cdn_fallback {
             if !self.check_url_healthy(&raw_stream_url).await {
-                let cdn_list: Vec<&str> =
-                    stream_urls.iter().map(|(cdn, _)| cdn.as_str()).collect();
+                let cdn_list: Vec<&str> = stream_urls.iter().map(|(cdn, _)| cdn.as_str()).collect();
                 info!(name = %self.name, "cdn_fallback 顺序尝试 {cdn_list:?}");
                 let mut fallback = None;
                 for (cdn, url) in &stream_urls {
@@ -427,7 +426,8 @@ impl<'a> HuyaLive<'a> {
             .into_iter()
             .filter(|(cdn, _, _)| !matches!(cdn.as_str(), "HY" | "HUYA" | "HYZJ"))
             .map(|(cdn, _, url)| (cdn, url))
-            .collect())    }
+            .collect())
+    }
 
     async fn get_cdn_token_info_ex(&self, stream_name: &str) -> LiveResult<String> {
         let ua = huya_wup::random_hyapp_ua();
@@ -687,11 +687,7 @@ fn find_json_value_end(input: &str, start: usize) -> Option<usize> {
     None
 }
 
-fn build_anticode(
-    stream_name: &str,
-    anti_code: &str,
-    presenter_uid: u64,
-) -> LiveResult<String> {
+fn build_anticode(stream_name: &str, anti_code: &str, presenter_uid: u64) -> LiveResult<String> {
     let query = serde_urlencoded::from_str::<HashMap<String, String>>(anti_code)
         .map_err(|err| LiveError::custom(format!("解析虎牙防盗链参数失败: {err}")))?;
     let Some(fm) = query.get("fm") else {
diff --git a/crates/biliup/src/downloader/live/picarto.rs b/crates/biliup/src/downloader/live/picarto.rs
index 4fa22aa..cd79119 100644
--- a/crates/biliup/src/downloader/live/picarto.rs
+++ b/crates/biliup/src/downloader/live/picarto.rs
@@ -74,9 +74,7 @@ impl LivePlugin for Picarto {
                 .map_err(|err| LiveError::custom(format!("获取 Picarto explore 失败: {err}")))?
                 .json()
                 .await
-                .map_err(|err| {
-                    LiveError::custom(format!("解析 Picarto explore 失败: {err}"))
-                })?;
+                .map_err(|err| LiveError::custom(format!("解析 Picarto explore 失败: {err}")))?;
 
             for entry in &explore.data {
                 if let Some(url) = wanted.remove(&entry.name.to_lowercase()) {
diff --git a/crates/biliup/src/downloader/live/twitch.rs b/crates/biliup/src/downloader/live/twitch.rs
index a645b62..8b60b4f 100644
--- a/crates/biliup/src/downloader/live/twitch.rs
+++ b/crates/biliup/src/downloader/live/twitch.rs
@@ -15,9 +15,11 @@ use std::collections::{HashMap, HashSet};
 use std::hash::{Hash, Hasher};
 use std::path::PathBuf;
 use std::process::Stdio;
-use std::sync::RwLock;
+use std::sync::{OnceLock, RwLock};
 use tokio::fs;
+use tokio::io::AsyncWriteExt;
 use tokio::process::Command;
+use tokio::sync::Mutex;
 use tokio::time::Duration;
 use tracing::warn;
 
@@ -29,6 +31,8 @@ const GQL_BATCH_LIMIT: usize = 30;
 /// Twitch 已失效的 auth_token（Twitch 与 TwitchVideos 共享，进程内长期记忆）。
 /// 对应 Python 版 TwitchUtils._invalid_auth_token 类级属性。
 static INVALID_AUTH_TOKEN: RwLock<Option<String>> = RwLock::new(None);
+static TWITCH_COOKIE_NONCE: OnceLock<u64> = OnceLock::new();
+static TWITCH_COOKIE_FILE_LOCK: OnceLock<Mutex<()>> = OnceLock::new();
 
 /// 返回可用的 auth_token：未配置、为空或已被记为失效时返回 None。
 fn effective_auth_token(auth_token: Option<&str>) -> Option<String> {
@@ -151,8 +155,7 @@ impl LivePlugin for Twitch {
                 })
                 .collect();
 
-            let responses =
-                post_gql_batch(&request.client, auth_token.as_deref(), &ops).await?;
+            let responses = post_gql_batch(&request.client, auth_token.as_deref(), &ops).await?;
 
             for (index, url) in chunk.iter().enumerate() {
                 let is_live = responses
@@ -207,9 +210,8 @@ impl TwitchLive {
     async fn check_stream(&self) -> LiveResult<LiveStatus> {
         let channel_name = self.channel_name(&self.url)?;
         let gql: GqlResponse = self
-            .post_gql(
-                json!({
-                    "query": r#"
+            .post_gql(json!({
+                "query": r#"
                         query query($channel_name:String!) {
                             user(login: $channel_name){
                                 stream {
@@ -230,8 +232,8 @@ impl TwitchLive {
                             }
                         }
                     "#,
-                    "variables": { "channel_name": channel_name }
-                }))
+                "variables": { "channel_name": channel_name }
+            }))
             .await?;
 
         let user = gql
@@ -672,19 +674,72 @@ fn netscape_cookie_file_content(auth_token: &str) -> String {
 fn cookie_file_path(auth_token: &str) -> PathBuf {
     let mut hasher = DefaultHasher::new();
     auth_token.hash(&mut hasher);
-    std::env::temp_dir().join(format!("biliup-twitch-cookies-{:016x}.txt", hasher.finish()))
+    let nonce = TWITCH_COOKIE_NONCE.get_or_init(rand::random::<u64>);
+    std::env::temp_dir().join(format!(
+        "biliup-twitch-cookies-{}-{nonce:016x}-{:016x}.txt",
+        std::process::id(),
+        hasher.finish()
+    ))
 }
 
 /// 将 auth_token 写入 Netscape cookie 文件并返回路径；内容未变化时不重写。
 /// 写入失败仅告警并返回 None（降级为匿名请求）。
 async fn write_cookie_file(auth_token: &str) -> Option<PathBuf> {
+    let _guard = TWITCH_COOKIE_FILE_LOCK
+        .get_or_init(|| Mutex::new(()))
+        .lock()
+        .await;
     let path = cookie_file_path(auth_token);
     let content = netscape_cookie_file_content(auth_token);
-    if fs::read_to_string(&path).await.ok().as_deref() != Some(content.as_str()) {
-        if let Err(err) = fs::write(&path, &content).await {
-            warn!("写入 Twitch cookie 文件失败: {}: {err}", path.display());
+
+    match fs::symlink_metadata(&path).await {
+        Ok(metadata) => {
+            if !metadata.file_type().is_file() {
+                warn!("Twitch cookie 临时路径不是普通文件，拒绝使用");
+                return None;
+            }
+            #[cfg(unix)]
+            {
+                use std::os::unix::fs::PermissionsExt;
+                if metadata.permissions().mode() & 0o077 != 0 {
+                    warn!("Twitch cookie 临时文件权限过宽，拒绝使用");
+                    return None;
+                }
+            }
+            if fs::read_to_string(&path).await.ok().as_deref() == Some(content.as_str()) {
+                return Some(path);
+            }
+            warn!("Twitch cookie 临时路径已存在但内容不匹配，拒绝覆盖");
             return None;
         }
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+        Err(error) => {
+            warn!("无法检查 Twitch cookie 临时文件: {error}");
+            return None;
+        }
+    }
+
+    let mut options = fs::OpenOptions::new();
+    options.write(true).create_new(true);
+    #[cfg(unix)]
+    {
+        options.mode(0o600);
+    }
+    let mut file = match options.open(&path).await {
+        Ok(file) => file,
+        Err(error) => {
+            warn!("无法安全创建 Twitch cookie 临时文件: {error}");
+            return None;
+        }
+    };
+    let result = match file.write_all(content.as_bytes()).await {
+        Ok(()) => file.sync_all().await,
+        Err(error) => Err(error),
+    };
+    if let Err(error) = result {
+        let _ = fs::remove_file(&path).await;
+        warn!("写入 Twitch cookie 临时文件失败: {error}");
+        return None;
     }
     Some(path)
 }
@@ -738,13 +793,23 @@ mod tests {
             .unwrap();
         runtime.block_on(async {
             let token = "unit-test-token";
-            let path = write_cookie_file(token).await.expect("写入 cookie 文件失败");
+            let path = write_cookie_file(token)
+                .await
+                .expect("写入 cookie 文件失败");
             assert_eq!(
                 fs::read_to_string(&path).await.unwrap(),
                 netscape_cookie_file_content(token)
             );
             // 复用同一路径
             assert_eq!(write_cookie_file(token).await.as_deref(), Some(&*path));
+            #[cfg(unix)]
+            {
+                use std::os::unix::fs::PermissionsExt;
+                assert_eq!(
+                    fs::metadata(&path).await.unwrap().permissions().mode() & 0o777,
+                    0o600
+                );
+            }
             let _ = fs::remove_file(&path).await;
         });
     }
diff --git a/crates/biliup/src/downloader/live/youtube.rs b/crates/biliup/src/downloader/live/youtube.rs
index 9535adb..961e3f5 100644
--- a/crates/biliup/src/downloader/live/youtube.rs
+++ b/crates/biliup/src/downloader/live/youtube.rs
@@ -255,7 +255,10 @@ impl YoutubeLive {
 
         // flat 条目缺少 upload_date 时单条完整提取后再判定（对齐 youtube.py:259-272）
         let mut candidate = value.clone();
-        if candidate.get("upload_date").and_then(Value::as_str).is_none()
+        if candidate
+            .get("upload_date")
+            .and_then(Value::as_str)
+            .is_none()
             && let Some(url) = string_field(&candidate, &["webpage_url", "url"])
             && let Some(resolved) = self.extract_info(&url, true).await?
         {
@@ -524,9 +527,15 @@ mod tests {
             EntryDecision::Select(json!({}))
         );
         // 早于 after_date：列表按时间倒序，停止扫描
-        assert_eq!(live.date_decision(json!({}), "20231231"), EntryDecision::Stop);
+        assert_eq!(
+            live.date_decision(json!({}), "20231231"),
+            EntryDecision::Stop
+        );
         // 晚于 before_date：跳过当前条目继续扫描
-        assert_eq!(live.date_decision(json!({}), "20250101"), EntryDecision::Skip);
+        assert_eq!(
+            live.date_decision(json!({}), "20250101"),
+            EntryDecision::Skip
+        );
     }
 
     #[tokio::test]
diff --git a/crates/biliup/src/error.rs b/crates/biliup/src/error.rs
index 04f8ac7..cdd08ff 100644
--- a/crates/biliup/src/error.rs
+++ b/crates/biliup/src/error.rs
@@ -13,10 +13,10 @@ pub enum Kind {
     IO(#[from] std::io::Error),
 
     #[error(transparent)]
-    Reqwest(#[from] reqwest::Error),
+    Reqwest(reqwest::Error),
 
     #[error(transparent)]
-    ReqwestMiddleware(#[from] reqwest_middleware::Error),
+    ReqwestMiddleware(reqwest_middleware::Error),
 
     #[error(transparent)]
     InvalidHeaderValue(#[from] InvalidHeaderValue),
@@ -51,3 +51,45 @@ impl From<String> for Kind {
         Self::Custom(s)
     }
 }
+
+impl From<reqwest::Error> for Kind {
+    fn from(error: reqwest::Error) -> Self {
+        // Request URLs can contain access keys, CSRF values, upload IDs and
+        // signed query strings. Keep the error category/status, but never let
+        // the URL reach CLI output or persistent Web logs.
+        Self::Reqwest(error.without_url())
+    }
+}
+
+impl From<reqwest_middleware::Error> for Kind {
+    fn from(error: reqwest_middleware::Error) -> Self {
+        Self::ReqwestMiddleware(error.without_url())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::Kind;
+
+    fn request_error_with_secret_url() -> reqwest::Error {
+        reqwest::Client::new()
+            .get("://invalid")
+            .build()
+            .unwrap_err()
+            .with_url(
+                reqwest::Url::parse("https://example.invalid/?access_key=url-secret-marker")
+                    .unwrap(),
+            )
+    }
+
+    #[test]
+    fn uploader_http_errors_strip_sensitive_request_urls() {
+        let direct = Kind::from(request_error_with_secret_url());
+        assert!(!format!("{direct:?}").contains("url-secret-marker"));
+
+        let middleware = Kind::from(reqwest_middleware::Error::from(
+            request_error_with_secret_url(),
+        ));
+        assert!(!format!("{middleware:?}").contains("url-secret-marker"));
+    }
+}
diff --git a/crates/biliup/src/uploader/bilibili.rs b/crates/biliup/src/uploader/bilibili.rs
index 67b5a43..59a1873 100644
--- a/crates/biliup/src/uploader/bilibili.rs
+++ b/crates/biliup/src/uploader/bilibili.rs
@@ -171,6 +171,133 @@ pub struct Archive {
     pub ctime: u64,
 }
 
+#[derive(Debug, Serialize, Deserialize)]
+pub struct ArchivePage {
+    pub from_page: u32,
+    pub page_size: u32,
+    pub total: u64,
+    pub total_pages: u32,
+    pub fetched_pages: u32,
+    pub archives: Vec<Archive>,
+}
+
+#[derive(Debug, Deserialize, PartialEq, Eq)]
+struct RawArchivePageMetadata {
+    ps: u64,
+    count: u64,
+}
+
+#[derive(Debug, Deserialize)]
+struct RawArchiveAudit {
+    #[serde(rename = "Archive")]
+    archive: Archive,
+}
+
+#[derive(Debug, Deserialize)]
+struct RawArchivePage {
+    page: RawArchivePageMetadata,
+    #[serde(default)]
+    arc_audits: Option<Vec<RawArchiveAudit>>,
+}
+
+#[derive(Debug, PartialEq, Eq)]
+struct PaginationPlan {
+    page_size: u32,
+    total: u64,
+    total_pages: u32,
+    fetched_pages: u32,
+    to_page: u32,
+}
+
+fn pagination_plan(
+    page_size: u64,
+    total: u64,
+    from_page: u32,
+    max_pages: Option<u32>,
+) -> Result<PaginationPlan> {
+    if from_page == 0 {
+        return Err(Kind::Custom("from_page must be at least 1".into()));
+    }
+    if max_pages == Some(0) {
+        return Err(Kind::Custom("max_pages must be at least 1".into()));
+    }
+    if page_size == 0 {
+        return Err(Kind::Custom("archive API returned a zero page size".into()));
+    }
+    let page_size = u32::try_from(page_size)
+        .map_err(|_| Kind::Custom("archive API page size is too large".into()))?;
+    let total_pages_u64 = total.div_ceil(u64::from(page_size));
+    let total_pages = u32::try_from(total_pages_u64)
+        .map_err(|_| Kind::Custom("archive API page count is too large".into()))?;
+
+    if total_pages == 0 {
+        if from_page != 1 {
+            return Err(Kind::Custom(
+                "from_page exceeds the empty archive result".into(),
+            ));
+        }
+        return Ok(PaginationPlan {
+            page_size,
+            total,
+            total_pages,
+            fetched_pages: 1,
+            to_page: 1,
+        });
+    }
+    if from_page > total_pages {
+        return Err(Kind::Custom(format!(
+            "from_page {from_page} exceeds total_pages {total_pages}"
+        )));
+    }
+
+    let remaining_pages = total_pages - from_page + 1;
+    let fetched_pages = max_pages
+        .map(|maximum| remaining_pages.min(maximum))
+        .unwrap_or(remaining_pages);
+    let to_page = from_page
+        .checked_add(fetched_pages - 1)
+        .ok_or_else(|| Kind::Custom("archive page range is too large".into()))?;
+    Ok(PaginationPlan {
+        page_size,
+        total,
+        total_pages,
+        fetched_pages,
+        to_page,
+    })
+}
+
+fn parse_archive_page(value: Value) -> Result<(RawArchivePageMetadata, Vec<Archive>)> {
+    let raw: RawArchivePage = serde_json::from_value(value)?;
+    let audits = match raw.arc_audits {
+        Some(audits) => audits,
+        None if raw.page.count == 0 => Vec::new(),
+        None => {
+            return Err(Kind::Custom(
+                "archive API omitted entries for a non-empty result".into(),
+            ));
+        }
+    };
+    Ok((
+        raw.page,
+        audits.into_iter().map(|audit| audit.archive).collect(),
+    ))
+}
+
+fn validate_archive_page_metadata(
+    expected: &RawArchivePageMetadata,
+    actual: &RawArchivePageMetadata,
+) -> Result<()> {
+    if actual.ps == 0 {
+        return Err(Kind::Custom("archive API returned a zero page size".into()));
+    }
+    if actual != expected {
+        return Err(Kind::Custom(
+            "archive API pagination metadata changed between pages".into(),
+        ));
+    }
+    Ok(())
+}
+
 impl Archive {
     pub fn to_string_pretty(&self) -> String {
         let status_string = match self.state {
@@ -770,54 +897,54 @@ impl BiliBili {
 
         match res {
             ResponseData {
-                code: _,
-                data: None,
-                ..
-            } => Err(Kind::Custom(format!("{:?}", res))),
-            ResponseData {
-                code: _,
+                code: 0,
                 data: Some(v),
                 ..
             } => Ok(v),
+            ResponseData { code, .. } => Err(Kind::Custom(format!(
+                "archive API returned Bilibili code {code}"
+            ))),
         }
     }
 
-    async fn recent_archives_data(
+    /// Fetch a bounded page range while preserving pagination metadata.
+    pub async fn recent_archives_page(
         &self,
         status: &str,
         from_page: u32,
         max_pages: Option<u32>,
-    ) -> Result<Vec<Value>> {
-        let mut first_page = self.archives(status, from_page).await?;
-
-        let (page_size, count) = {
-            let page = first_page["page"].take();
-            let page_size = page["ps"].as_u64().ok_or("all_studios ps error")?;
-            let count = page["count"].as_u64().ok_or("all_studios count error")?;
-            (page_size as u32, count as u32)
-        };
-
-        let total_pages = {
-            let mut pages = count / page_size;
-            if pages * page_size < count {
-                pages += 1;
-            }
-            pages
-        };
-
-        let fetch_pages = match max_pages {
-            Some(mp) => std::cmp::min(total_pages - from_page + 1, mp),
-            None => total_pages - from_page + 1,
-        };
-        let to_page = from_page - 1 + fetch_pages;
-
-        let mut all_pages = vec![first_page];
-        for page_num in from_page + 1..=to_page {
-            let page = self.archives(status, page_num).await?;
-            all_pages.push(page);
+    ) -> Result<ArchivePage> {
+        // Validate request-only bounds before issuing a network request.
+        if from_page == 0 {
+            return Err(Kind::Custom("from_page must be at least 1".into()));
+        }
+        if max_pages == Some(0) {
+            return Err(Kind::Custom("max_pages must be at least 1".into()));
         }
 
-        Ok(all_pages)
+        let first_page = self.archives(status, from_page).await?;
+        let (metadata, mut archives) = parse_archive_page(first_page)?;
+        let plan = pagination_plan(metadata.ps, metadata.count, from_page, max_pages)?;
+
+        let mut page_num = from_page;
+        while page_num < plan.to_page {
+            page_num = page_num
+                .checked_add(1)
+                .ok_or_else(|| Kind::Custom("archive page range is too large".into()))?;
+            let page = self.archives(status, page_num).await?;
+            let (page_metadata, mut page_archives) = parse_archive_page(page)?;
+            validate_archive_page_metadata(&metadata, &page_metadata)?;
+            archives.append(&mut page_archives);
+        }
+
+        Ok(ArchivePage {
+            from_page,
+            page_size: plan.page_size,
+            total: plan.total,
+            total_pages: plan.total_pages,
+            fetched_pages: plan.fetched_pages,
+            archives,
+        })
     }
 
     /// 获取所有稿件
@@ -833,18 +960,10 @@ impl BiliBili {
         from_page: u32,
         max_pages: Option<u32>,
     ) -> Result<Vec<Archive>> {
-        let studios = self
-            .recent_archives_data(status, from_page, max_pages)
+        Ok(self
+            .recent_archives_page(status, from_page, max_pages)
             .await?
-            .iter_mut()
-            .map(|page| page["arc_audits"].take())
-            .filter_map(|audits| serde_json::from_value::<Vec<Value>>(audits).ok())
-            .flat_map(|archives| archives.into_iter())
-            .map(|mut arc| arc["Archive"].take())
-            .filter_map(|studio| serde_json::from_value::<_>(studio).ok())
-            .collect::<Vec<_>>();
-
-        Ok(studios)
+            .archives)
     }
 
     fn get_cookie(&self) -> Result<String> {
@@ -883,3 +1002,119 @@ impl<T: Serialize> Display for ResponseData<T> {
         )
     }
 }
+
+#[cfg(test)]
+mod archive_tests {
+    use super::{
+        RawArchivePageMetadata, pagination_plan, parse_archive_page, validate_archive_page_metadata,
+    };
+    use serde_json::json;
+
+    fn archive() -> serde_json::Value {
+        json!({
+            "aid": 1,
+            "bvid": "BV1test",
+            "title": "fixture",
+            "cover": "https://i0.hdslb.com/fixture.jpg",
+            "reject_reason": "",
+            "reject_reason_url": "",
+            "duration": 10,
+            "desc": "description",
+            "state": 0,
+            "state_desc": "已通过",
+            "dtime": 0,
+            "ptime": 1,
+            "ctime": 1
+        })
+    }
+
+    #[test]
+    fn pagination_rejects_zero_and_out_of_range_values() {
+        assert!(pagination_plan(10, 20, 0, Some(1)).is_err());
+        assert!(pagination_plan(10, 20, 1, Some(0)).is_err());
+        assert!(pagination_plan(0, 20, 1, Some(1)).is_err());
+        assert!(pagination_plan(10, 20, 3, Some(1)).is_err());
+        assert!(pagination_plan(10, 0, 2, Some(1)).is_err());
+    }
+
+    #[test]
+    fn pagination_is_bounded_without_unsigned_underflow() {
+        let plan = pagination_plan(10, 25, 2, Some(20)).unwrap();
+        assert_eq!(plan.page_size, 10);
+        assert_eq!(plan.total_pages, 3);
+        assert_eq!(plan.fetched_pages, 2);
+        assert_eq!(plan.to_page, 3);
+
+        let empty = pagination_plan(10, 0, 1, Some(1)).unwrap();
+        assert_eq!(empty.total_pages, 0);
+        assert_eq!(empty.fetched_pages, 1);
+        assert_eq!(empty.to_page, 1);
+
+        let maximum = pagination_plan(1, u64::from(u32::MAX), u32::MAX, Some(1)).unwrap();
+        assert_eq!(maximum.fetched_pages, 1);
+        assert_eq!(maximum.to_page, u32::MAX);
+    }
+
+    #[test]
+    fn archive_fixture_preserves_metadata_and_entries() {
+        let (metadata, archives) = parse_archive_page(json!({
+            "page": {"ps": 10, "count": 21},
+            "arc_audits": [{"Archive": archive()}]
+        }))
+        .unwrap();
+
+        assert_eq!(metadata.ps, 10);
+        assert_eq!(metadata.count, 21);
+        assert_eq!(archives.len(), 1);
+        assert_eq!(archives[0].bvid, "BV1test");
+    }
+
+    #[test]
+    fn malformed_archive_entries_are_reported_instead_of_silently_dropped() {
+        assert!(
+            parse_archive_page(json!({
+                "page": {"ps": 10, "count": 1},
+                "arc_audits": [{"unexpected": archive()}]
+            }))
+            .is_err()
+        );
+        assert!(
+            parse_archive_page(json!({
+                "page": {"ps": 10, "count": 1}
+            }))
+            .is_err()
+        );
+        assert!(
+            parse_archive_page(json!({
+                "page": {"ps": 10, "count": 0}
+            }))
+            .unwrap()
+            .1
+            .is_empty()
+        );
+    }
+
+    #[test]
+    fn followup_pages_must_keep_nonzero_consistent_metadata() {
+        let expected = RawArchivePageMetadata { ps: 10, count: 21 };
+        assert!(validate_archive_page_metadata(&expected, &expected).is_ok());
+        assert!(
+            validate_archive_page_metadata(&expected, &RawArchivePageMetadata { ps: 0, count: 21 })
+                .is_err()
+        );
+        assert!(
+            validate_archive_page_metadata(
+                &expected,
+                &RawArchivePageMetadata { ps: 20, count: 21 }
+            )
+            .is_err()
+        );
+        assert!(
+            validate_archive_page_metadata(
+                &expected,
+                &RawArchivePageMetadata { ps: 10, count: 22 }
+            )
+            .is_err()
+        );
+    }
+}
diff --git a/crates/biliup/src/uploader/credential.rs b/crates/biliup/src/uploader/credential.rs
index 6584dc8..e0321f2 100644
--- a/crates/biliup/src/uploader/credential.rs
+++ b/crates/biliup/src/uploader/credential.rs
@@ -1,8 +1,11 @@
 use crate::client::StatefulClient;
 use futures::Future;
 use reqwest::header;
-use std::io::Seek;
-use std::path::Path;
+use std::collections::HashMap;
+use std::io::Write;
+use std::path::{Component, Path, PathBuf};
+use std::sync::{Arc, Mutex, OnceLock};
+use tokio::sync::{Mutex as AsyncMutex, OwnedMutexGuard};
 
 use crate::error::{Kind, Result};
 use crate::uploader::bilibili::{BiliBili, ResponseData};
@@ -60,6 +63,164 @@ pub fn bilibili_from_cookies(file: impl AsRef<Path>, proxy: Option<&str>) -> Res
     bilibili_from_info(login_info, proxy)
 }
 
+static CREDENTIAL_FILE_LOCKS: OnceLock<Mutex<HashMap<PathBuf, Arc<AsyncMutex<()>>>>> =
+    OnceLock::new();
+
+fn replace_credential_file(temporary_path: &Path, destination: &Path) -> std::io::Result<()> {
+    #[cfg(not(windows))]
+    {
+        std::fs::rename(temporary_path, destination)
+    }
+    #[cfg(windows)]
+    {
+        if !destination.exists() {
+            return std::fs::rename(temporary_path, destination);
+        }
+        let parent = destination.parent().unwrap_or_else(|| Path::new("."));
+        let backup = parent.join(format!(
+            ".biliup-replace-{}-{:016x}",
+            std::process::id(),
+            rand::random::<u64>()
+        ));
+        std::fs::rename(destination, &backup)?;
+        if let Err(error) = std::fs::rename(temporary_path, destination) {
+            let _ = std::fs::rename(&backup, destination);
+            return Err(error);
+        }
+        std::fs::remove_file(backup)
+    }
+}
+
+/// Resolve a credential path to a stable, absolute lock key.
+///
+/// Existing paths (including symlinks) are canonicalized. For a file that has
+/// not been created yet, the nearest existing parent is canonicalized and the
+/// remaining normal components are appended.
+pub fn normalize_credential_path(path: impl AsRef<Path>) -> std::io::Result<PathBuf> {
+    let path = path.as_ref();
+    if path.exists() {
+        return path.canonicalize();
+    }
+
+    let absolute = if path.is_absolute() {
+        path.to_path_buf()
+    } else {
+        std::env::current_dir()?.join(path)
+    };
+    let mut existing = absolute.as_path();
+    let mut suffix = Vec::new();
+    while !existing.exists() {
+        let Some(name) = existing.file_name() else {
+            return Err(std::io::Error::new(
+                std::io::ErrorKind::InvalidInput,
+                "credential path has no existing parent",
+            ));
+        };
+        suffix.push(name.to_os_string());
+        existing = existing.parent().ok_or_else(|| {
+            std::io::Error::new(
+                std::io::ErrorKind::InvalidInput,
+                "credential path has no existing parent",
+            )
+        })?;
+    }
+
+    let mut normalized = existing.canonicalize()?;
+    for component in suffix.into_iter().rev() {
+        let component_path = Path::new(&component);
+        if !matches!(
+            component_path.components().next(),
+            Some(Component::Normal(_))
+        ) {
+            return Err(std::io::Error::new(
+                std::io::ErrorKind::InvalidInput,
+                "credential path contains an invalid component",
+            ));
+        }
+        normalized.push(component);
+    }
+    Ok(normalized)
+}
+
+/// Serialize credential reads, refreshes, writes, registration and deletion
+/// inside the current process using the normalized physical path.
+pub async fn lock_credential_file(path: impl AsRef<Path>) -> std::io::Result<OwnedMutexGuard<()>> {
+    let key = normalize_credential_path(path)?;
+    let lock = {
+        let locks = CREDENTIAL_FILE_LOCKS.get_or_init(|| Mutex::new(HashMap::new()));
+        let mut locks = locks
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner());
+        locks
+            .entry(key)
+            .or_insert_with(|| Arc::new(AsyncMutex::new(())))
+            .clone()
+    };
+    Ok(lock.lock_owned().await)
+}
+
+fn write_login_info_unlocked(path: &Path, login_info: &LoginInfo) -> Result<()> {
+    let parent = path.parent().unwrap_or_else(|| Path::new("."));
+    let file_name = path
+        .file_name()
+        .and_then(|name| name.to_str())
+        .unwrap_or("credentials");
+    let mut temporary_path;
+    let mut temporary_file;
+    loop {
+        temporary_path = parent.join(format!(
+            ".{file_name}.biliup-write-{}-{:016x}",
+            std::process::id(),
+            rand::random::<u64>()
+        ));
+        let mut options = std::fs::OpenOptions::new();
+        options.write(true).create_new(true);
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::OpenOptionsExt;
+            options.mode(0o600);
+        }
+        match options.open(&temporary_path) {
+            Ok(file) => {
+                temporary_file = file;
+                break;
+            }
+            Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => continue,
+            Err(error) => return Err(error.into()),
+        }
+    }
+
+    let write_result = (|| -> Result<()> {
+        serde_json::to_writer_pretty(&mut temporary_file, login_info)?;
+        temporary_file.write_all(b"\n")?;
+        temporary_file.sync_all()?;
+        replace_credential_file(&temporary_path, path)?;
+        Ok(())
+    })();
+    if write_result.is_err() {
+        let _ = std::fs::remove_file(&temporary_path);
+    }
+    write_result
+}
+
+/// Atomically write a credential file with owner-only permissions on Unix.
+pub async fn save_login_info(path: impl AsRef<Path>, login_info: &LoginInfo) -> Result<()> {
+    let path = normalize_credential_path(path)?;
+    let _guard = lock_credential_file(&path).await?;
+    write_login_info_unlocked(&path, login_info)
+}
+
+/// Refresh one credential file while holding the same lock used by readers and
+/// atomic writers.
+pub async fn renew_login_info_file(path: impl AsRef<Path>, proxy: Option<&str>) -> Result<()> {
+    let path = normalize_credential_path(path)?;
+    let _guard = lock_credential_file(&path).await?;
+    let file = std::fs::File::options().read(true).open(&path)?;
+    let login_info: LoginInfo = serde_json::from_reader(std::io::BufReader::new(file))?;
+    let new_info = Credential::new(proxy).renew_tokens(login_info).await?;
+    write_login_info_unlocked(&path, &new_info)
+}
+
 pub fn bilibili_from_info(login_info: LoginInfo, proxy: Option<&str>) -> Result<BiliBili> {
     let client = Credential::new(proxy);
     client.set_cookie(&login_info.cookie_info);
@@ -71,8 +232,9 @@ pub fn bilibili_from_info(login_info: LoginInfo, proxy: Option<&str>) -> Result<
 }
 
 pub async fn login_by_cookies(file: impl AsRef<Path>, proxy: Option<&str>) -> Result<BiliBili> {
-    // let path = file.as_ref();
-    let mut file = std::fs::File::options().read(true).write(true).open(file)?;
+    let path = normalize_credential_path(file)?;
+    let _guard = lock_credential_file(&path).await?;
+    let file = std::fs::File::options().read(true).open(&path)?;
     let login_info: LoginInfo = serde_json::from_reader(std::io::BufReader::new(&file))?;
 
     let client: Credential = Credential::new(proxy);
@@ -80,9 +242,8 @@ pub async fn login_by_cookies(file: impl AsRef<Path>, proxy: Option<&str>) -> Re
 
     if need_refresh {
         let new_info = client.renew_tokens(login_info).await?;
-        file.rewind()?;
-        file.set_len(0)?;
-        serde_json::to_writer_pretty(std::io::BufWriter::new(&file), &new_info)?;
+        drop(file);
+        write_login_info_unlocked(&path, &new_info)?;
         bilibili_from_info(new_info, proxy)
     } else {
         debug!("无需更新cookie");
@@ -90,7 +251,7 @@ pub async fn login_by_cookies(file: impl AsRef<Path>, proxy: Option<&str>) -> Re
     }
 }
 
-#[derive(Deserialize, Serialize, Debug, Clone)]
+#[derive(Deserialize, Serialize, Clone)]
 #[serde(untagged)]
 pub enum ResponseValue {
     Login(LoginInfo),
@@ -98,7 +259,7 @@ pub enum ResponseValue {
     Value(serde_json::Value),
 }
 
-#[derive(Deserialize, Serialize, Debug, Clone)]
+#[derive(Deserialize, Serialize, Clone)]
 pub struct LoginInfo {
     pub cookie_info: serde_json::Value,
     // message: String,
@@ -109,7 +270,7 @@ pub struct LoginInfo {
     pub platform: Option<String>,
 }
 
-#[derive(Deserialize, Serialize, Debug, Clone)]
+#[derive(Deserialize, Serialize, Clone)]
 pub struct TokenInfo {
     pub access_token: String,
     expires_in: u32,
@@ -117,7 +278,7 @@ pub struct TokenInfo {
     refresh_token: String,
 }
 
-#[derive(Deserialize, Serialize, Debug, Clone)]
+#[derive(Deserialize, Serialize, Clone)]
 pub struct OAuthInfo {
     pub mid: u64,
     pub access_token: String,
@@ -125,6 +286,158 @@ pub struct OAuthInfo {
     pub refresh: bool,
 }
 
+impl std::fmt::Debug for ResponseValue {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Login(info) => f.debug_tuple("Login").field(info).finish(),
+            Self::OAuth(info) => f.debug_tuple("OAuth").field(info).finish(),
+            Self::Value(_) => f.debug_tuple("Value").field(&"[redacted]").finish(),
+        }
+    }
+}
+
+impl std::fmt::Debug for LoginInfo {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("LoginInfo")
+            .field("cookie_info", &"[redacted]")
+            .field("sso", &"[redacted]")
+            .field("token_info", &self.token_info)
+            .field("platform", &self.platform)
+            .finish()
+    }
+}
+
+impl std::fmt::Debug for TokenInfo {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("TokenInfo")
+            .field("access_token", &"[redacted]")
+            .field("expires_in", &self.expires_in)
+            .field("mid", &self.mid)
+            .field("refresh_token", &"[redacted]")
+            .finish()
+    }
+}
+
+impl std::fmt::Debug for OAuthInfo {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("OAuthInfo")
+            .field("mid", &self.mid)
+            .field("access_token", &"[redacted]")
+            .field("expires_in", &self.expires_in)
+            .field("refresh", &self.refresh)
+            .finish()
+    }
+}
+
+#[cfg(test)]
+mod redaction_tests {
+    use super::{LoginInfo, OAuthInfo, ResponseValue, TokenInfo, save_login_info};
+    use serde_json::json;
+
+    fn login_info(token: &str) -> LoginInfo {
+        LoginInfo {
+            cookie_info: json!({"cookies": [{"name": "SESSDATA", "value": token}]}),
+            sso: vec!["example.com".into()],
+            token_info: TokenInfo {
+                access_token: token.into(),
+                expires_in: 3600,
+                mid: 42,
+                refresh_token: token.into(),
+            },
+            platform: Some("Android".into()),
+        }
+    }
+
+    #[test]
+    fn credential_debug_output_redacts_all_secret_material() {
+        let mut login = login_info("cookie-secret");
+        login.token_info.access_token = "access-secret".into();
+        login.token_info.refresh_token = "refresh-secret".into();
+        let login_debug = format!("{login:?}");
+        for secret in ["cookie-secret", "access-secret", "refresh-secret"] {
+            assert!(!login_debug.contains(secret));
+        }
+        assert!(login_debug.contains("[redacted]"));
+        assert!(login_debug.contains("42"));
+
+        let oauth = OAuthInfo {
+            mid: 42,
+            access_token: "oauth-secret".into(),
+            expires_in: 3600,
+            refresh: true,
+        };
+        assert!(!format!("{oauth:?}").contains("oauth-secret"));
+        assert!(
+            !format!("{:?}", ResponseValue::Value(json!({"token": "raw-secret"})))
+                .contains("raw-secret")
+        );
+    }
+
+    #[tokio::test]
+    async fn concurrent_credential_writes_remain_atomic_and_parseable() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("cookies.json");
+        let mut tasks = Vec::new();
+        for index in 0..12 {
+            let path = path.clone();
+            tasks.push(tokio::spawn(async move {
+                save_login_info(path, &login_info(&format!("token-{index}")))
+                    .await
+                    .unwrap();
+            }));
+        }
+        for task in tasks {
+            task.await.unwrap();
+        }
+
+        let saved: LoginInfo =
+            serde_json::from_reader(std::fs::File::open(&path).unwrap()).unwrap();
+        assert!(saved.token_info.access_token.starts_with("token-"));
+        assert_eq!(
+            std::fs::read_dir(dir.path())
+                .unwrap()
+                .filter_map(|entry| entry.ok())
+                .count(),
+            1
+        );
+
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            assert_eq!(
+                std::fs::metadata(path).unwrap().permissions().mode() & 0o777,
+                0o600
+            );
+        }
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn atomic_save_updates_a_symlink_target_without_replacing_the_link() {
+        use std::os::unix::fs::symlink;
+
+        let dir = tempfile::tempdir().unwrap();
+        let target = dir.path().join("target.json");
+        let link = dir.path().join("cookies.json");
+        save_login_info(&target, &login_info("before"))
+            .await
+            .unwrap();
+        symlink(&target, &link).unwrap();
+
+        save_login_info(&link, &login_info("after")).await.unwrap();
+
+        assert!(
+            std::fs::symlink_metadata(&link)
+                .unwrap()
+                .file_type()
+                .is_symlink()
+        );
+        let saved: LoginInfo =
+            serde_json::from_reader(std::fs::File::open(target).unwrap()).unwrap();
+        assert_eq!(saved.token_info.access_token, "after");
+    }
+}
+
 #[derive(Debug)]
 pub struct Credential(StatefulClient);
 
@@ -159,7 +472,7 @@ impl Credential {
             payload
         };
 
-        let response = self
+        let response: ResponseData<ResponseValue> = self
             .0
             .client
             .get("https://passport.bilibili.com/x/passport-login/oauth2/info")
@@ -172,12 +485,17 @@ impl Credential {
         //     return Err(CustomError::Custom(response.to_string()));
         // }
 
+        let response_code = response.code;
         let refresh = match response {
             ResponseData {
                 data: Some(ResponseValue::OAuth(OAuthInfo { refresh, .. })),
                 ..
             } => refresh,
-            _ => return Err(Kind::Custom(response.to_string())),
+            _ => {
+                return Err(Kind::Custom(format!(
+                    "credential validation failed with Bilibili code {response_code}"
+                )));
+            }
         };
 
         debug!("验证cookie");
@@ -215,6 +533,7 @@ impl Credential {
             .json()
             .await?;
         info!("更新cookie");
+        let response_code = response.code;
         match response.data {
             Some(ResponseValue::Login(info)) if !info.cookie_info.is_null() => {
                 self.set_cookie(&info.cookie_info);
@@ -223,7 +542,9 @@ impl Credential {
                     ..info
                 })
             }
-            _ => Err(Kind::Custom(response.to_string())),
+            _ => Err(Kind::Custom(format!(
+                "credential refresh failed with Bilibili code {response_code}"
+            ))),
         }
     }
 
@@ -267,6 +588,7 @@ impl Credential {
             .json()
             .await?;
         info!("通过密码登录");
+        let response_code = response.code;
         match response.data {
             Some(ResponseValue::Login(info)) if !info.cookie_info.is_null() => {
                 self.set_cookie(&info.cookie_info);
@@ -275,7 +597,9 @@ impl Credential {
                     ..info
                 })
             }
-            _ => Err(Kind::Custom(response.to_string())),
+            _ => Err(Kind::Custom(format!(
+                "password login failed with Bilibili code {response_code}"
+            ))),
         }
     }
 
@@ -297,6 +621,7 @@ impl Credential {
             .await?
             .json()
             .await?;
+        let response_code = res.code;
         match res.data {
             Some(ResponseValue::Login(info)) => {
                 self.set_cookie(&info.cookie_info);
@@ -305,7 +630,9 @@ impl Credential {
                     ..info
                 })
             }
-            _ => Err(Kind::Custom(res.to_string())),
+            _ => Err(Kind::Custom(format!(
+                "SMS login failed with Bilibili code {response_code}"
+            ))),
         }
     }
 
@@ -405,6 +732,7 @@ impl Credential {
             .json()
             .await?;
         // println!("{}", res);
+        let response_code = res.code;
         match res.data {
             Some(ResponseValue::Value(mut data))
                 if !data["captcha_key"]
@@ -421,7 +749,9 @@ impl Credential {
                 let url = data["recaptcha_url"].as_str().unwrap().to_string();
                 Err(Kind::NeedRecaptcha(url))
             }
-            _ => Err(Kind::Custom(res.to_string())),
+            _ => Err(Kind::Custom(format!(
+                "SMS request failed with Bilibili code {response_code}"
+            ))),
         }
     }
 
@@ -449,8 +779,8 @@ impl Credential {
 
             let res: ResponseData<ResponseValue> = serde_json::from_slice(&full).map_err(|_| {
                 Kind::Custom(format!(
-                    "error decoding response body, content: {:#?}",
-                    String::from_utf8_lossy(&full)
+                    "error decoding credential API response body ({} bytes)",
+                    full.len()
                 ))
             })?;
             match res {
@@ -612,11 +942,17 @@ impl Credential {
             .send()
             .await?;
         if !response.status().is_success() {
-            return Err(Kind::Custom(response.text().await?));
+            return Err(Kind::Custom(format!(
+                "Web QR confirmation failed with HTTP {}",
+                response.status()
+            )));
         }
         let res: ResponseData = response.json().await?;
         if res.code != 0 {
-            return Err(Kind::Custom(format!("{res:#?}")));
+            return Err(Kind::Custom(format!(
+                "Web QR confirmation failed with Bilibili code {}",
+                res.code
+            )));
         }
         Ok(())
     }
diff --git a/crates/stream-gears/src/login.rs b/crates/stream-gears/src/login.rs
index ff90aa1..5c8aeca 100644
--- a/crates/stream-gears/src/login.rs
+++ b/crates/stream-gears/src/login.rs
@@ -1,5 +1,5 @@
 use biliup::uploader::bilibili::BiliBili;
-use biliup::uploader::credential::Credential;
+use biliup::uploader::credential::{Credential, save_login_info};
 use biliup_cli::server::errors::{AppError, AppResult};
 use error_stack::ResultExt;
 
@@ -31,8 +31,9 @@ pub async fn login_by_sms(
         .login_by_sms(code, res)
         .await
         .change_context_lazy(|| AppError::Unknown)?;
-    let file = std::fs::File::create("cookies.json").change_context_lazy(|| AppError::Unknown)?;
-    serde_json::to_writer_pretty(&file, &info).change_context_lazy(|| AppError::Unknown)?;
+    save_login_info("cookies.json", &info)
+        .await
+        .change_context_lazy(|| AppError::Unknown)?;
     Ok(true)
 }
 
@@ -53,8 +54,9 @@ pub async fn login_by_web_cookies(
         .login_by_web_cookies(sess_data, bili_jct)
         .await
         .change_context_lazy(|| AppError::Unknown)?;
-    let file = std::fs::File::create("cookies.json").change_context_lazy(|| AppError::Unknown)?;
-    serde_json::to_writer_pretty(&file, &info).change_context_lazy(|| AppError::Unknown)?;
+    save_login_info("cookies.json", &info)
+        .await
+        .change_context_lazy(|| AppError::Unknown)?;
     Ok(true)
 }
 
@@ -67,7 +69,8 @@ pub async fn login_by_web_qrcode(
         .login_by_web_qrcode(sess_data, dede_user_id)
         .await
         .change_context_lazy(|| AppError::Unknown)?;
-    let file = std::fs::File::create("cookies.json").change_context_lazy(|| AppError::Unknown)?;
-    serde_json::to_writer_pretty(&file, &info).change_context_lazy(|| AppError::Unknown)?;
+    save_login_info("cookies.json", &info)
+        .await
+        .change_context_lazy(|| AppError::Unknown)?;
     Ok(true)
 }
diff --git a/crates/stream-gears/src/server.rs b/crates/stream-gears/src/server.rs
index bd84e3c..be421f6 100644
--- a/crates/stream-gears/src/server.rs
+++ b/crates/stream-gears/src/server.rs
@@ -286,7 +286,14 @@ pub(crate) async fn _main(args: &[String]) -> AppResult<()> {
             auth,
             config,
         } => {
-            biliup_cli::run((&bind, port), auth, reload_handle, config).await?;
+            biliup_cli::run_with_cookie(
+                (&bind, port),
+                auth,
+                reload_handle,
+                config,
+                cli.user_cookie,
+            )
+            .await?;
         }
         Commands::List {
             is_pubing,