From 7c5556add3eee61842ff7ebed7be35336934752d Mon Sep 17 00:00:00 2001
From: liukewia <liukewia@gmail.com>
Date: Wed, 26 Aug 2026 17:50:15 +0800
Subject: [PATCH 1/6] chore: bump harness-browser to 0.7.6

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 pyproject.toml | 2 +-
 uv.lock        | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index c64d3f0f..04b34153 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -32,7 +32,7 @@ dependencies = [
     "acme>=5.6.0",
     "josepy>=2.2.0",
     "boto3>=1.40.61",
-    "harness-browser>=0.7.5",
+    "harness-browser>=0.7.6",
     "playwright>=1.40",
     "psycopg[binary]>=3.2",
     "langgraph-checkpoint-postgres>=2.0",
diff --git a/uv.lock b/uv.lock
index 53819ab0..98ea5b90 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1293,7 +1293,7 @@ wheels = [
 
 [[package]]
 name = "harness-browser"
-version = "0.7.5"
+version = "0.7.6"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "aiohttp" },
@@ -1301,9 +1301,9 @@ dependencies = [
     { name = "pydantic" },
     { name = "websockets" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/98/e2/fd855aac21ff8cb75dd49a3ad804de9a94d668fcb5299c31a73f8db3c23e/harness_browser-0.7.5.tar.gz", hash = "sha256:ab3dd40d830c896da881132745c8a3c3de04dd24cfef9923d97a1ab58c9d3ae8", size = 326189, upload-time = "2026-08-12T11:18:54.865Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e1/0c/1abe8206743dfbdb017ae77b2820359ac066941853ac726bcc6d76800509/harness_browser-0.7.6.tar.gz", hash = "sha256:1a40f849813899bf04168926cafa677cdda6c49617e57d26eff975b929539aa0", size = 329380, upload-time = "2026-08-26T09:35:56.964Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/2e/57/d170b7ace2342a3c3a813f4d341320861e638b6bfd6e808b0bef169513a0/harness_browser-0.7.5-py3-none-any.whl", hash = "sha256:ed3bb6fe5fe452d37aacce4b730c14b12d6bd3266b11a0c9056f116e0f2a0a97", size = 92581, upload-time = "2026-08-12T11:18:52.971Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/7f/b81b2c3f14bb69843501873947703d1d3d0f5471fbda87ca3ffea45abf33/harness_browser-0.7.6-py3-none-any.whl", hash = "sha256:4c533301fe7b052bc30cd176600f19d5ffa122857856a766de3d10560c54f58e", size = 95146, upload-time = "2026-08-26T09:35:55.034Z" },
 ]
 
 [[package]]
@@ -2548,7 +2548,7 @@ requires-dist = [
     { name = "edge-tts", specifier = ">=6.1" },
     { name = "fastapi", specifier = ">=0.110" },
     { name = "fastembed", marker = "extra == 'local-embedding'", specifier = ">=0.4" },
-    { name = "harness-browser", specifier = ">=0.7.5" },
+    { name = "harness-browser", specifier = ">=0.7.6" },
     { name = "harness-gateway", specifier = ">=0.9.3" },
     { name = "harness-memory", specifier = ">=0.9.7" },
     { name = "httpx", marker = "extra == 'dev'", specifier = ">=0.27" },

From c38b512a5cff65af19402dad304cc2fd9c9a10d6 Mon Sep 17 00:00:00 2001
From: jubaoliang <jubaoliang@tencent.com>
Date: Wed, 26 Aug 2026 10:53:45 +0000
Subject: [PATCH 2/6] fix: gate update UI by permission and speed up local
 tests

Hide check-for-updates entry points unless the user has the update module
permission, show compact offloads under .octop/conversation_history, and
add pytest-xdist / test-fast with isolated HOME for parallel runs.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 CHANGELOG.md                                  |  9 +++
 Makefile                                      | 11 +++-
 .../src/components/AppVersionBadge/index.tsx  |  9 +--
 dashboard/src/components/AvatarDropdown.tsx   | 25 +++++----
 .../components/CurrentVersionBadge/index.tsx  | 11 ++--
 pyproject.toml                                |  8 ++-
 src/octop/infra/backend/resolver.py           | 12 ++--
 .../infra/gateway/slash/handlers/composite.py | 10 +++-
 tests/conftest.py                             | 55 +++++++++++++++++--
 tests/unit/gateway/test_slash_compact.py      | 31 +++++++++++
 tests/unit/infra/setup/test_service.py        | 11 +++-
 uv.lock                                       | 34 ++++++++++--
 12 files changed, 182 insertions(+), 44 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 594bbbf9..5565d4d3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,15 @@
 
 ## [Unreleased]
 
+### 修复
+
+- 无「应用更新」权限时隐藏检查更新入口（按权限而非 admin 角色）
+- `/compact` 卸载路径展示兼容 `.octop/conversation_history/`
+
+### 其他
+
+- 测试：`pytest-xdist` 并行、`make test-fast`、`slow` 标记与隔离 HOME
+
 ## [0.9.27] - 2026-08-26
 
 ### 新增
diff --git a/Makefile b/Makefile
index 37ac43ee..cdf862e8 100644
--- a/Makefile
+++ b/Makefile
@@ -28,6 +28,8 @@ UV   := $(shell command -v uv 2>/dev/null)
 RUN  := $(if $(UV),uv run,)
 PYTHON := $(if $(UV),uv run python,python3)
 PIP  := $(if $(UV),uv pip,python3 -m pip)
+# Parallel workers for make test / make test-fast (override: make test PYTEST_JOBS=4)
+PYTEST_JOBS ?= auto
 
 # ─── Help ────────────────────────────────────────────────────────────────────
 
@@ -219,8 +221,13 @@ typecheck:
 
 .PHONY: test
 test:
-	@echo "[test] pytest (not live)..."
-	$(RUN) pytest -m "not live"
+	@echo "[test] pytest (not live, -n $(PYTEST_JOBS))..."
+	$(RUN) pytest -n $(PYTEST_JOBS) -m "not live"
+
+.PHONY: test-fast
+test-fast:
+	@echo "[test-fast] pytest (not live, not slow, -n $(PYTEST_JOBS))..."
+	$(RUN) pytest -n $(PYTEST_JOBS) -m "not live and not slow"
 
 .PHONY: test-live
 test-live:
diff --git a/dashboard/src/components/AppVersionBadge/index.tsx b/dashboard/src/components/AppVersionBadge/index.tsx
index 5e4d85cc..d9e6b821 100644
--- a/dashboard/src/components/AppVersionBadge/index.tsx
+++ b/dashboard/src/components/AppVersionBadge/index.tsx
@@ -3,7 +3,8 @@ import { useNavigate } from "react-router-dom";
 import { Tooltip } from "antd";
 import { ArrowUpCircle } from "lucide-react";
 import { useUpdateStatus } from "../../hooks/useUpdateStatus";
-import { useUserRole } from "../../hooks/useUserRole";
+import { useCurrentUser } from "../../hooks/useCurrentUser";
+import { userCan } from "../../utils/permissions";
 import styles from "./index.module.less";
 
 interface AppVersionBadgeProps {
@@ -13,11 +14,11 @@ interface AppVersionBadgeProps {
 export default function AppVersionBadge({ isMobile }: AppVersionBadgeProps) {
   const { t } = useTranslation();
   const navigate = useNavigate();
-  const role = useUserRole();
+  const user = useCurrentUser();
   const { status, hasUpdate } = useUpdateStatus();
 
-  const isAdmin = role === "admin";
-  if (!status?.current_version || !hasUpdate || !isAdmin) return null;
+  const canUpdate = userCan(user, "update");
+  if (!status?.current_version || !hasUpdate || !canUpdate) return null;
 
   const tooltip = t("header.versionUpdateAvailable", {
     current: status.current_version,
diff --git a/dashboard/src/components/AvatarDropdown.tsx b/dashboard/src/components/AvatarDropdown.tsx
index 1102cbfa..145fa30d 100644
--- a/dashboard/src/components/AvatarDropdown.tsx
+++ b/dashboard/src/components/AvatarDropdown.tsx
@@ -43,6 +43,7 @@ import PaletteSwitcher from "./PaletteSwitcher";
 import type { OctopUser } from "../api/modules/auth";
 import { useLayoutMode } from "../context/LayoutModeContext";
 import type { LayoutMode } from "../layouts/layoutModeStorage";
+import { userCan } from "../utils/permissions";
 import styles from "./AvatarDropdown.module.less";
 
 const GITHUB_URL = "https://github.com/TencentCloud/Octop";
@@ -259,17 +260,19 @@ export default function AvatarDropdown({
         <span>{t("account.changePassword")}</span>
       </button>
 
-      <button
-        type="button"
-        className={styles.menuItem}
-        onClick={() => {
-          setMenuOpen(false);
-          navigate("/admin/advanced?tab=updates");
-        }}
-      >
-        <RefreshCw size={16} strokeWidth={1.8} />
-        <span>{t("account.checkUpdates")}</span>
-      </button>
+      {userCan(user, "update") && (
+        <button
+          type="button"
+          className={styles.menuItem}
+          onClick={() => {
+            setMenuOpen(false);
+            navigate("/admin/advanced?tab=updates");
+          }}
+        >
+          <RefreshCw size={16} strokeWidth={1.8} />
+          <span>{t("account.checkUpdates")}</span>
+        </button>
+      )}
 
       <Divider className={styles.menuDivider} />
 
diff --git a/dashboard/src/components/CurrentVersionBadge/index.tsx b/dashboard/src/components/CurrentVersionBadge/index.tsx
index 3dbab8a4..e6f8e59a 100644
--- a/dashboard/src/components/CurrentVersionBadge/index.tsx
+++ b/dashboard/src/components/CurrentVersionBadge/index.tsx
@@ -2,7 +2,8 @@ import { useTranslation } from "react-i18next";
 import { useNavigate } from "react-router-dom";
 import { Tooltip } from "antd";
 import { useUpdateStatus } from "../../hooks/useUpdateStatus";
-import { useUserRole } from "../../hooks/useUserRole";
+import { useCurrentUser } from "../../hooks/useCurrentUser";
+import { userCan } from "../../utils/permissions";
 import styles from "./index.module.less";
 
 interface CurrentVersionBadgeProps {
@@ -14,19 +15,19 @@ export default function CurrentVersionBadge({
 }: CurrentVersionBadgeProps) {
   const { t } = useTranslation();
   const navigate = useNavigate();
-  const role = useUserRole();
+  const user = useCurrentUser();
   const { status } = useUpdateStatus();
 
   const version = status?.current_version;
   if (!version) return null;
 
-  const isAdmin = role === "admin";
-  const tooltip = isAdmin
+  const canUpdate = userCan(user, "update");
+  const tooltip = canUpdate
     ? t("header.currentVersionAdmin", { version })
     : t("header.currentVersion", { version });
   const label = `v${version}`;
 
-  if (isAdmin) {
+  if (canUpdate) {
     return (
       <Tooltip title={tooltip} mouseEnterDelay={0.35}>
         <button
diff --git a/pyproject.toml b/pyproject.toml
index 04b34153..2754a746 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -21,7 +21,7 @@ dependencies = [
     "apscheduler>=3.10,<4",
     "argon2-cffi>=23.1",
     "pyjwt>=2.8",
-    "orcakit-harness-agent[all]>=0.9.26",
+    "orcakit-harness-agent[all]>=0.9.27",
     "harness-memory>=0.9.7",
     "harness-gateway>=0.9.3",
     "cryptography>=41",
@@ -52,6 +52,7 @@ dev = [
     "pytest-asyncio>=0.23",
     "pytest-cov>=4.1",
     "pytest-testmon>=2.0",
+    "pytest-xdist>=3.6",
     "httpx>=0.27",
     "ruff>=0.4",
     "mypy>=1.10",
@@ -74,6 +75,7 @@ dev = [
     "pytest-asyncio>=0.23",
     "pytest-cov>=4.1",
     "pytest-testmon>=2.0",
+    "pytest-xdist>=3.6",
     "httpx>=0.27",
     "ruff>=0.4",
     "mypy>=1.10",
@@ -191,7 +193,8 @@ disable_error_code = ["attr-defined"]
 testpaths = ["tests"]
 asyncio_mode = "auto"
 markers = [
-    "live: tests that hit real LLM endpoints (skipped by default)",
+    "live: tests that hit real LLM / external services (skipped by default)",
+    "slow: expensive tests (integration boot, real harness, browser); skipped by make test-fast",
     "postgresql: tests that need a live PostgreSQL (set OCTOP_TEST_DATABASE_URL)",
 ]
 # The project pins a starlette fork (1.3.1) whose TestClient prefers a
@@ -202,4 +205,3 @@ markers = [
 filterwarnings = [
     "ignore::starlette.exceptions.StarletteDeprecationWarning",
 ]
-
diff --git a/src/octop/infra/backend/resolver.py b/src/octop/infra/backend/resolver.py
index fc988789..a34c6ab3 100644
--- a/src/octop/infra/backend/resolver.py
+++ b/src/octop/infra/backend/resolver.py
@@ -13,12 +13,12 @@ def default_agent_backend_spec(workspace_dir: Path) -> dict[str, Any]:
     """Harness backend for agents with no explicit ``backend`` in config.
 
     On POSIX this matches harness ``DEFAULT_BACKEND_SPEC`` (host-rooted virtual
-    paths). harness ``resolve_backend(..., workspace_dir=...)`` wraps that
-    host root in a composite whose ``artifacts_root`` is the agent workspace,
-    so deepagents conversation history stays writable. On Windows
-    ``root_dir='/'`` resolves to the process current-drive root, which often
-    differs from the drive hosting ``workspace_dir`` — scope the default to
-    the agent workspace instead.
+    paths). harness ``resolve_backend(..., workspace_dir=..., system_files_path=...)``
+    wraps that host root in a composite whose ``artifacts_root`` is the agent
+    workspace system-files prefix (Octop: ``.octop``), so deepagents conversation
+    history stays with skills / sessions. On Windows ``root_dir='/'`` resolves to
+    the process current-drive root, which often differs from the drive hosting
+    ``workspace_dir`` — scope the default to the agent workspace instead.
     """
     from harness_agent.backends import DEFAULT_BACKEND_SPEC  # noqa: PLC0415
 
diff --git a/src/octop/infra/gateway/slash/handlers/composite.py b/src/octop/infra/gateway/slash/handlers/composite.py
index b0cface2..926fa8c4 100644
--- a/src/octop/infra/gateway/slash/handlers/composite.py
+++ b/src/octop/infra/gateway/slash/handlers/composite.py
@@ -120,7 +120,15 @@ async def cmd_compact(
     if raw_path:
         p = Path(str(raw_path))
         # Prefer short workspace-relative display over absolute host paths.
-        short_path = f"conversation_history/{p.name}" if p.name else str(raw_path)
+        # Offloads land under ``{system_files_path}/conversation_history/``
+        # (Octop default: ``.octop/conversation_history/``).
+        parts = [part for part in p.parts if part not in ("/", "\\")]
+        if "conversation_history" in parts:
+            idx = parts.index("conversation_history")
+            start = idx - 1 if idx > 0 and parts[idx - 1].startswith(".") else idx
+            short_path = "/".join(parts[start:])
+        else:
+            short_path = f"conversation_history/{p.name}" if p.name else str(raw_path)
         await sink.text(
             tr("compact.done_offload", lang, count=count, short=tid[-6:], path=short_path)
         )
diff --git a/tests/conftest.py b/tests/conftest.py
index caafc02d..8d37cb87 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -9,17 +9,60 @@
 
 _REPO_ROOT = Path(__file__).resolve().parents[1]
 
+# Modules whose tests boot OctopServer, real harness, browser tooling, or bwrap.
+# Tagged ``slow`` so ``make test-fast`` can skip them during local iteration.
+_SLOW_TEST_MODULES = frozenset(
+    {
+        "tests/unit/browser/test_browser_setup.py",
+        "tests/unit/infra/utils/test_bwrap.py",
+        "tests/unit/agents/test_skills_hub_raw.py",
+        "tests/unit/agents/test_skillhub_market.py",
+        "tests/unit/gateway/test_attachment_hints.py",
+        "tests/unit/agents/test_agent_manager.py",
+        "tests/unit/agents/test_agent_registry.py",
+        "tests/unit/api/test_jwt_auth_middleware.py",
+        "tests/unit/api/test_openapi_meta.py",
+        "tests/unit/api/test_exception_handlers.py",
+    },
+)
+
+
+def _module_path(nodeid: str) -> str:
+    return nodeid.split("::", 1)[0]
+
+
+def pytest_collection_modifyitems(items: list[pytest.Item]) -> None:
+    for item in items:
+        module = _module_path(item.nodeid)
+        if module in _SLOW_TEST_MODULES or module.startswith("tests/integration/"):
+            item.add_marker(pytest.mark.slow)
+
 
 @pytest.fixture(scope="session")
 def repo_root() -> Path:
     return _REPO_ROOT
 
 
-@pytest.fixture
-def tmp_octop_home(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Iterator[Path]:
-    """Redirect ``HOME`` so ``~/.octop`` resolves under a tmpdir."""
-    home = tmp_path / "home"
-    home.mkdir()
+@pytest.fixture(autouse=True)
+def _isolated_user_home(
+    tmp_path_factory: pytest.TempPathFactory,
+    monkeypatch: pytest.MonkeyPatch,
+) -> Path:
+    """Per-test HOME outside the test's ``tmp_path``.
+
+    Keeping HOME off ``tmp_path`` avoids polluting directory listings and
+    colliding with tests that create ``tmp_path / \"home\"`` themselves.
+    Required for xdist so workers never share ``~/.octop`` / CLI state.
+    """
+    home = tmp_path_factory.mktemp("user-home")
     monkeypatch.setenv("HOME", str(home))
     monkeypatch.setenv("USERPROFILE", str(home))
-    yield home / ".octop"
+    return home
+
+
+@pytest.fixture
+def tmp_octop_home(_isolated_user_home: Path) -> Iterator[Path]:
+    """Redirect ``~/.octop`` under the autouse isolated HOME."""
+    octop = _isolated_user_home / ".octop"
+    octop.mkdir(exist_ok=True)
+    yield octop
diff --git a/tests/unit/gateway/test_slash_compact.py b/tests/unit/gateway/test_slash_compact.py
index 306a211e..db7d3d16 100644
--- a/tests/unit/gateway/test_slash_compact.py
+++ b/tests/unit/gateway/test_slash_compact.py
@@ -97,6 +97,37 @@ async def test_cmd_compact_calls_harness_without_reset(ctx, dispatcher) -> None:
     assert "/home/" not in text
 
 
+@pytest.mark.asyncio
+async def test_cmd_compact_shows_octop_relative_offload_path(ctx, dispatcher) -> None:
+    await ctx.thread_registry.get_or_create_by_key(
+        session_key=ctx.session_key,
+        agent_id=ctx.agent_id,
+        user_id=ctx.user_id,
+        channel_type=ctx.channel_type,
+    )
+    tid = ctx.thread_registry.get_bound_thread_id(ctx.session_key)
+    assert tid
+
+    harness = MagicMock()
+    harness.acompact_conversation = AsyncMock(
+        return_value=CompactResult(
+            ok=True,
+            summarized_count=3,
+            preserved_count=4,
+            file_path=f"/home/wally/.octop/workspaces/X/.octop/conversation_history/{tid}.md",
+            reason="ok",
+        )
+    )
+    ctx.agent_manager.get_agent = MagicMock(return_value=harness)
+
+    sink = BufferSink()
+    await cmd_compact(dispatcher, SlashCommand("compact", ""), ctx, sink)
+
+    text = "\n".join(sink.lines)
+    assert ".octop/conversation_history/" in text
+    assert "/home/wally" not in text
+
+
 @pytest.mark.asyncio
 async def test_cmd_compact_uses_composer_model_ref(ctx, dispatcher) -> None:
     await ctx.thread_registry.get_or_create_by_key(
diff --git a/tests/unit/infra/setup/test_service.py b/tests/unit/infra/setup/test_service.py
index dec2697d..9dd20d3b 100644
--- a/tests/unit/infra/setup/test_service.py
+++ b/tests/unit/infra/setup/test_service.py
@@ -372,11 +372,18 @@ class _Proc:
 
 
 def test_unit_path_launchd_user_is_under_home(monkeypatch: pytest.MonkeyPatch) -> None:
-    """User-scope macOS installs land in ~/Library/LaunchAgents (writable, no sudo)."""
+    """User-scope macOS installs land in ~/Library/LaunchAgents (writable, no sudo).
+
+    ``unit_path`` resolves the owner via passwd (not ``Path.home()`` / ``$HOME``),
+    so sudo installs still target the invoking user — match that here.
+    """
+    import pwd
+
     monkeypatch.setattr(service_mod, "is_root", lambda: False)
     monkeypatch.setenv("OCTOP_SERVICE_SCOPE", "user")
     path = unit_path("launchd")
-    assert path == Path.home() / "Library" / "LaunchAgents" / "octop.plist"
+    owner_home = Path(pwd.getpwnam(getpass.getuser()).pw_dir)
+    assert path == owner_home / "Library" / "LaunchAgents" / "octop.plist"
 
 
 def test_unit_path_launchd_system_is_under_library(monkeypatch: pytest.MonkeyPatch) -> None:
diff --git a/uv.lock b/uv.lock
index 98ea5b90..6b3aef88 100644
--- a/uv.lock
+++ b/uv.lock
@@ -958,6 +958,15 @@ version = "1.9.3"
 source = { registry = "https://pypi.org/simple" }
 sdist = { url = "https://files.pythonhosted.org/packages/a5/f5/397b61091120a9ca5001041dd7bf76c385b3bfd67a0e5bcb74b852bd22a4/evdev-1.9.3.tar.gz", hash = "sha256:2c140e01ac8437758fa23fe5c871397412461f42d421aa20241dc8fe8cfccbc9", size = 32723, upload-time = "2026-02-05T21:54:24.987Z" }
 
+[[package]]
+name = "execnet"
+version = "2.1.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/bf/89/780e11f9588d9e7128a3f87788354c7946a9cbb1401ad38a48c4db9a4f07/execnet-2.1.2.tar.gz", hash = "sha256:63d83bfdd9a23e35b9c6a3261412324f964c2ec8dcd8d3c6916ee9373e0befcd", size = 166622, upload-time = "2025-11-12T09:56:37.75Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ab/84/02fc1827e8cdded4aa65baef11296a9bbe595c474f0d6d758af082d849fd/execnet-2.1.2-py3-none-any.whl", hash = "sha256:67fba928dd5a544b783f6056f449e5e3931a5c378b128bc18501f7ea79e296ec", size = 40708, upload-time = "2025-11-12T09:56:36.333Z" },
+]
+
 [[package]]
 name = "fastapi"
 version = "0.138.2"
@@ -2517,6 +2526,7 @@ dev = [
     { name = "pytest-asyncio" },
     { name = "pytest-cov" },
     { name = "pytest-testmon" },
+    { name = "pytest-xdist" },
     { name = "ruff" },
 ]
 local-embedding = [
@@ -2533,6 +2543,7 @@ dev = [
     { name = "pytest-asyncio" },
     { name = "pytest-cov" },
     { name = "pytest-testmon" },
+    { name = "pytest-xdist" },
     { name = "ruff" },
 ]
 
@@ -2559,7 +2570,7 @@ requires-dist = [
     { name = "mcp", specifier = ">=1.9,<2" },
     { name = "mss", marker = "extra == 'desktop'", specifier = ">=9.0" },
     { name = "mypy", marker = "extra == 'dev'", specifier = ">=1.10" },
-    { name = "orcakit-harness-agent", extras = ["all"], specifier = ">=0.9.26" },
+    { name = "orcakit-harness-agent", extras = ["all"], specifier = ">=0.9.27" },
     { name = "pillow", specifier = ">=10.0" },
     { name = "playwright", specifier = ">=1.40" },
     { name = "playwright", marker = "extra == 'browser'", specifier = ">=1.40" },
@@ -2573,6 +2584,7 @@ requires-dist = [
     { name = "pytest-asyncio", marker = "extra == 'dev'", specifier = ">=0.23" },
     { name = "pytest-cov", marker = "extra == 'dev'", specifier = ">=4.1" },
     { name = "pytest-testmon", marker = "extra == 'dev'", specifier = ">=2.0" },
+    { name = "pytest-xdist", marker = "extra == 'dev'", specifier = ">=3.6" },
     { name = "python-docx", specifier = ">=1.2.0" },
     { name = "python-pptx", specifier = ">=1.0" },
     { name = "questionary", specifier = ">=2.0" },
@@ -2594,6 +2606,7 @@ dev = [
     { name = "pytest-asyncio", specifier = ">=0.23" },
     { name = "pytest-cov", specifier = ">=4.1" },
     { name = "pytest-testmon", specifier = ">=2.0" },
+    { name = "pytest-xdist", specifier = ">=3.6" },
     { name = "ruff", specifier = ">=0.4" },
 ]
 
@@ -2731,7 +2744,7 @@ wheels = [
 
 [[package]]
 name = "orcakit-harness-agent"
-version = "0.9.26"
+version = "0.9.27"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "deepagents" },
@@ -2749,9 +2762,9 @@ dependencies = [
     { name = "mcp" },
     { name = "pyyaml" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/e4/74/c4724071aa68cec47fc9c82ed6e2c48b9fd491d6c66e2f79eb7af1ccdaf3/orcakit_harness_agent-0.9.26.tar.gz", hash = "sha256:e5998d15fff25870a5e7fce49b9cb840ee0c35dc6a5cc93d7b576532d0da069d", size = 1183490, upload-time = "2026-08-26T04:05:50.255Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/d2/b1/bd9e23e840bf48d8cea12e0d24bae2caaecaf8e2364893466846f5f427e4/orcakit_harness_agent-0.9.27.tar.gz", hash = "sha256:40c7816f4a47ed610131c1442cc391198ca5519fcd650752803f14a85a075e54", size = 1182826, upload-time = "2026-08-26T10:50:24.475Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/dc/5c/3ed38b4625e03c673fe11f61942a765252a82cddc631e1b8d5abd7959511/orcakit_harness_agent-0.9.26-py3-none-any.whl", hash = "sha256:ea947905ab92affb438125123fc9ff2f3874fa80489d88081f2f863e4ecc12e8", size = 1408183, upload-time = "2026-08-26T04:05:46.49Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/16/446c4fc6c5a6f0c9f84b8c742ec325cb48b4c1e59572811cef17157811e4/orcakit_harness_agent-0.9.27-py3-none-any.whl", hash = "sha256:328898750cff1d98db3ac36ce5e8a776b47f8288955b8e2a79bdfabd52a90659", size = 1407139, upload-time = "2026-08-26T10:50:20.842Z" },
 ]
 
 [package.optional-dependencies]
@@ -3699,6 +3712,19 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/61/55/ebb3c2f59fb089f08d00f764830d35780fc4e4c41dffcadafa3264682b65/pytest_testmon-2.2.0-py3-none-any.whl", hash = "sha256:2604ca44a54d61a2e830d9ce828b41a837075e4ebc1f81b148add8e90d34815b", size = 25199, upload-time = "2025-12-01T07:30:23.623Z" },
 ]
 
+[[package]]
+name = "pytest-xdist"
+version = "3.8.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "execnet" },
+    { name = "pytest" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/78/b4/439b179d1ff526791eb921115fca8e44e596a13efeda518b9d845a619450/pytest_xdist-3.8.0.tar.gz", hash = "sha256:7e578125ec9bc6050861aa93f2d59f1d8d085595d6551c2c90b6f4fad8d3a9f1", size = 88069, upload-time = "2025-07-01T13:30:59.346Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ca/31/d4e37e9e550c2b92a9cbc2e4d0b7420a27224968580b5a447f420847c975/pytest_xdist-3.8.0-py3-none-any.whl", hash = "sha256:202ca578cfeb7370784a8c33d6d05bc6e13b4f25b5053c30a152269fd10f0b88", size = 46396, upload-time = "2025-07-01T13:30:56.632Z" },
+]
+
 [[package]]
 name = "python-dateutil"
 version = "2.9.0.post0"

From a9217bc72ebc5193bf9eae95e4e0e1eb079e16ab Mon Sep 17 00:00:00 2001
From: veenyi <60565189+veenyi@users.noreply.github.com>
Date: Wed, 26 Aug 2026 18:56:54 +0800
Subject: [PATCH 3/6] =?UTF-8?q?fix(fnos):=20=E9=95=9C=E5=83=8F=E5=91=BD?=
 =?UTF-8?q?=E5=90=8D=E7=A9=BA=E9=97=B4=E6=94=B9=E4=B8=BA=20ghcr.io/jubaoli?=
 =?UTF-8?q?ang/octop?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- fnos-build-fpk.yml / fnos/README.md / fnos/docker/Dockerfile / docker-compose.yaml / manifest 的镜像引用从 ghcr.io/TencentCloud/octop 改为 ghcr.io/jubaoliang/octop（Docker 仓库名必须小写，原大写 T 的 tag 无法通过 buildx）
- workflow 镜像 tags 增加 ghcr.io/jubaoliang/octop:latest（Docker 版 FPK 的 docker-compose 按 :latest 拉取，此前只推 :vanilla 会导致飞牛拉不到镜像）
---
 .github/workflows/fnos-build-fpk.yml       | 11 ++++++-----
 fnos/README.md                             |  8 ++++----
 fnos/docker/Dockerfile                     |  2 +-
 fnos/docker/app/docker/docker-compose.yaml |  2 +-
 fnos/docker/manifest                       |  2 +-
 5 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/fnos-build-fpk.yml b/.github/workflows/fnos-build-fpk.yml
index 25fec8dc..d293a77d 100644
--- a/.github/workflows/fnos-build-fpk.yml
+++ b/.github/workflows/fnos-build-fpk.yml
@@ -5,12 +5,12 @@ name: Build Octop FPK (template)
 # # then publishes GitHub releases (fixed version + rolling latest).
 # #
 # # To enable on your fork:
-# #   1. Replace ghcr.io/TencentCloud/octop with your own image namespace (or fork a copy).
+# #   1. Replace ghcr.io/jubaoliang/octop with your own image namespace (or fork a copy).
 # #   2. Optionally add a push trigger below (e.g. branches: [main]) so a rebuild happens
 # #      automatically on every upstream sync. It is intentionally workflow_dispatch-only
 # #      here so it never runs on the upstream repository.
 # #
-#   image  job：从仓库源码构建 Octop Docker 镜像，推送到 GHCR（ghcr.io/TencentCloud/octop:vanilla）
+#   image  job：从仓库源码构建 Octop Docker 镜像，推送到 GHCR（ghcr.io/jubaoliang/octop:vanilla）
 #   fpk    job：构建「Docker 版」飞牛安装包 Fnos-octop-vanilla-<ver>-<iter>.fpk（依赖 image，确保镜像已就绪）
 #   native job：构建「本地版（非 Docker）」飞牛安装包 Fnos-octop-vanilla-native-<ver>-<iter>.fpk。
 #               不内置 Python 运行时（依赖飞牛应用商店 Python 3.12），
@@ -99,8 +99,9 @@ jobs:
           file: fnos/docker/Dockerfile
           push: true
           tags: |
-            ghcr.io/TencentCloud/octop:vanilla
-            ghcr.io/TencentCloud/octop:vanilla-v${{ needs.version.outputs.version }}
+            ghcr.io/jubaoliang/octop:latest
+            ghcr.io/jubaoliang/octop:vanilla
+            ghcr.io/jubaoliang/octop:vanilla-v${{ needs.version.outputs.version }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
@@ -304,7 +305,7 @@ jobs:
             echo "## 安装说明"
             echo ""
             echo "1. 飞牛应用中心 → 设置 → 手动安装应用，选择对应 .fpk。"
-            echo "2. Docker 版 **Fnos-octop-vanilla-${VER}-${ITER}.fpk**（约 80KB）：飞牛自动从 GHCR 拉取镜像运行，镜像为 \\"ghcr.io/TencentCloud/octop:vanilla\\"。"
+            echo "2. Docker 版 **Fnos-octop-vanilla-${VER}-${ITER}.fpk**（约 80KB）：飞牛自动从 GHCR 拉取镜像运行，镜像为 \\"ghcr.io/jubaoliang/octop:vanilla\\"。"
             echo "3. 本地版 **Fnos-octop-vanilla-native-${VER}-${ITER}.fpk**（约 200MB）：非 Docker，原生运行在飞牛主机；安装时自动关联系统 Python 3.12 开发工具；浏览器、远程桌面等附加组件在 Octop 应用内按需安装。"
             echo ""
             echo "---"
diff --git a/fnos/README.md b/fnos/README.md
index 524d2f90..e7b5ea09 100644
--- a/fnos/README.md
+++ b/fnos/README.md
@@ -19,7 +19,7 @@ After install, open the app (Docker: `http://<device-ip>:8088`, native: `http://
 
 | 版本 | 包名 | 体积 | 运行方式 | 依赖 |
 |------|------|------|----------|------|
-| **Docker 版** | `octop-<ver>.fpk` | ~8 KB | 飞牛自动从 `ghcr.io/TencentCloud/octop:latest` 拉镜像运行 | 宿主需有 Docker 运行时 |
+| **Docker 版** | `octop-<ver>.fpk` | ~8 KB | 飞牛自动从 `ghcr.io/jubaoliang/octop:latest` 拉镜像运行 | 宿主需有 Docker 运行时 |
 | **本地版（非 Docker）** | `octop-native-<ver>.fpk` | ~560 MB | 自带 Python 3.12 运行时 + 前端 + 全部附加组件 + Chromium，原生运行在飞牛主机 | 无需 Docker |
 
 - **Docker 版**实现为 FnOS `docker-project`：包体只含 `docker-compose.yaml` 与向导配置，运行时由飞牛拉取 GHCR 镜像。镜像已内置全部附加组件（`browser` 浏览器自动化 + `desktop` 桌面控制）与前端。
@@ -44,7 +44,7 @@ fnos/
 │   │   └── install         # 安装向导（可配置管理员账号/密码、日志级别、LLM 密钥）
 │   ├── app/
 │   │   ├── docker/
-│   │   │   └── docker-compose.yaml   # 引用 ghcr.io/TencentCloud/octop:latest
+│   │   │   └── docker-compose.yaml   # 引用 ghcr.io/jubaoliang/octop:latest
 │   │   └── ui/
 │   │       ├── config                # 桌面图标入口
 │   │       └── images/icon-{64,256}.png
@@ -64,7 +64,7 @@ fnos/
 ## 工作机制
 
 1. **源码同步**：`.github/workflows/zz-sync-upstream.yml` 每 6 小时把上游 `TencentCloud/Octop` 的更新合并进本仓 `main` 分支（使用仓库自带 `GITHUB_TOKEN`，无需 PAT）。
-2. **镜像构建**：`.github/workflows/fnos-build-fpk.yml` 的 `image` job 在 `main` 更新时，用 `fnos/docker/Dockerfile` 从仓库源码构建 Octop 镜像并推送到 `ghcr.io/TencentCloud/octop:latest`（含全部附加组件）。
+2. **镜像构建**：`.github/workflows/fnos-build-fpk.yml` 的 `image` job 在 `main` 更新时，用 `fnos/docker/Dockerfile` 从仓库源码构建 Octop 镜像并推送到 `ghcr.io/jubaoliang/octop:latest`（含全部附加组件）。
 3. **安装包构建**：同一 workflow 的 `fpk` job 用 `scripts/build-fpk.sh` 把 `fnos/docker/` 打成 Docker 版 `.fpk`；`native` job 用 python-build-standalone 构建 Python 3.12 运行时、安装全部依赖与 Playwright Chromium，把 `fnos/native/` 打成本地版 `.fpk`（`continue-on-error`，失败不阻塞 Docker 版）。两者均以滚动发布 `fnos-latest` 提供下载。
 
 ## 本地构建 .fpk（无需 Docker）
@@ -84,6 +84,6 @@ bash scripts/build-fpk.sh native     # 仅本地版      → dist/octop-native-<
    - 不想依赖 Docker、希望自带运行时原生运行 → 选 `octop-native-<version>.fpk`
 2. 安装向导中设置管理员账号/密码、日志级别、LLM 密钥（可选）。
 3. 安装完成后桌面出现「Octop AI 助手」图标，浏览器打开 `http://<设备IP>:8088`。
-4. Docker 版镜像首次会从 `ghcr.io/TencentCloud/octop:latest` 拉取；请确保该镜像为公开（workflow 已自动设为 public）。本地版无需联网拉镜像，首次启动会按需要补装 Chromium 系统库（需 root 权限，已尽力处理）。
+4. Docker 版镜像首次会从 `ghcr.io/jubaoliang/octop:latest` 拉取；请确保该镜像为公开（workflow 已自动设为 public）。本地版无需联网拉镜像，首次启动会按需要补装 Chromium 系统库（需 root 权限，已尽力处理）。
 
 > 服务端口固定为 `8088`（飞牛端口映射与桌面图标均据此）。附加组件（browser 浏览器自动化 + desktop 桌面控制）已在镜像中默认安装。
diff --git a/fnos/docker/Dockerfile b/fnos/docker/Dockerfile
index 7c892772..292ca879 100644
--- a/fnos/docker/Dockerfile
+++ b/fnos/docker/Dockerfile
@@ -7,7 +7,7 @@
 #   - desktop  （mss / pynput / pillow，桌面控制附加组件）
 #
 # 构建上下文必须为仓库根目录（fnpack / CI 中以仓库根为 context）：
-#   docker build -f fnos/docker/Dockerfile -t ghcr.io/TencentCloud/octop:latest .
+#   docker build -f fnos/docker/Dockerfile -t ghcr.io/jubaoliang/octop:latest .
 #
 # 国内加速（可选 build-arg）：
 #   PIP_INDEX_URL / PIP_TRUSTED_HOST / NPM_REGISTRY / APT_MIRROR
diff --git a/fnos/docker/app/docker/docker-compose.yaml b/fnos/docker/app/docker/docker-compose.yaml
index 82e39a92..fb860327 100644
--- a/fnos/docker/app/docker/docker-compose.yaml
+++ b/fnos/docker/app/docker/docker-compose.yaml
@@ -1,6 +1,6 @@
 services:
   octop:
-    image: ghcr.io/TencentCloud/octop:latest
+    image: ghcr.io/jubaoliang/octop:latest
     container_name: octop
     restart: unless-stopped
     pull_policy: always
diff --git a/fnos/docker/manifest b/fnos/docker/manifest
index 6c7a3daf..efdb1f64 100644
--- a/fnos/docker/manifest
+++ b/fnos/docker/manifest
@@ -1,7 +1,7 @@
 appname=octop
 version=0.9.15
 display_name=OCTOP
-desc=腾讯开源的多用户多智能体 AI 助手平台，支持 Web 控制台、CLI、IM 渠道与定时任务，数据全部本地存储。<br/><br/><strong>安装后使用：</strong><br/>在应用中心点击「打开」按钮即可进入 Web 控制台，默认地址 http://设备IP:8088。<br/>初始管理员账号：admin，初始密码：Octop123（首次登录后请在头像菜单修改密码）。<br/><br/><strong>首次登录后：</strong><br/>请在控制台「设置」中配置 LLM 模型、IM 渠道、远程桌面、浏览器等组件。<br/><br/>注意：Docker 版通过容器部署，会自动从 ghcr.io/TencentCloud/octop:latest 拉取镜像运行，已预装 browser / desktop 附加组件。
+desc=腾讯开源的多用户多智能体 AI 助手平台，支持 Web 控制台、CLI、IM 渠道与定时任务，数据全部本地存储。<br/><br/><strong>安装后使用：</strong><br/>在应用中心点击「打开」按钮即可进入 Web 控制台，默认地址 http://设备IP:8088。<br/>初始管理员账号：admin，初始密码：Octop123（首次登录后请在头像菜单修改密码）。<br/><br/><strong>首次登录后：</strong><br/>请在控制台「设置」中配置 LLM 模型、IM 渠道、远程桌面、浏览器等组件。<br/><br/>注意：Docker 版通过容器部署，会自动从 ghcr.io/jubaoliang/octop:latest 拉取镜像运行，已预装 browser / desktop 附加组件。
 source=thirdparty
 platform=all
 maintainer=TencentCloud OrcaKit

From 63a48510c82f98efdaf3ea1e2ce72591d9a4bedc Mon Sep 17 00:00:00 2001
From: veenyi <60565189+veenyi@users.noreply.github.com>
Date: Wed, 26 Aug 2026 19:50:24 +0800
Subject: [PATCH 4/6] =?UTF-8?q?fix(fnos):=20=E9=95=9C=E5=83=8F=E5=8F=91?=
 =?UTF-8?q?=E5=B8=83=E7=9B=AE=E6=A0=87=E6=94=B9=E4=B8=BA=20Docker=20Hub=20?=
 =?UTF-8?q?jubaoliang/octop=EF=BC=88=E9=9D=9E=20ghcr.io=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

根据反馈，镜像仓库位于 hub.docker.com：
- 镜像名从 ghcr.io/jubaoliang/octop 改为 jubaoliang/octop（docker pull jubaoliang/octop 无前缀即 Docker Hub）
- workflow 登录从 GHCR/GITHUB_TOKEN 改为 Docker Hub 的 DOCKERHUB_USERNAME/DOCKERHUB_TOKEN（与 docker-publish.yml 同一套凭据）
---
 .github/workflows/fnos-build-fpk.yml       | 20 ++++++++++----------
 fnos/README.md                             | 10 +++++-----
 fnos/docker/Dockerfile                     |  2 +-
 fnos/docker/app/docker/docker-compose.yaml |  2 +-
 fnos/docker/manifest                       |  2 +-
 5 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/fnos-build-fpk.yml b/.github/workflows/fnos-build-fpk.yml
index d293a77d..05c6a338 100644
--- a/.github/workflows/fnos-build-fpk.yml
+++ b/.github/workflows/fnos-build-fpk.yml
@@ -5,12 +5,12 @@ name: Build Octop FPK (template)
 # # then publishes GitHub releases (fixed version + rolling latest).
 # #
 # # To enable on your fork:
-# #   1. Replace ghcr.io/jubaoliang/octop with your own image namespace (or fork a copy).
+# #   1. Replace jubaoliang/octop with your own image namespace (or fork a copy).
 # #   2. Optionally add a push trigger below (e.g. branches: [main]) so a rebuild happens
 # #      automatically on every upstream sync. It is intentionally workflow_dispatch-only
 # #      here so it never runs on the upstream repository.
 # #
-#   image  job：从仓库源码构建 Octop Docker 镜像，推送到 GHCR（ghcr.io/jubaoliang/octop:vanilla）
+#   image  job：从仓库源码构建 Octop Docker 镜像，推送到 Docker Hub（jubaoliang/octop:vanilla）
 #   fpk    job：构建「Docker 版」飞牛安装包 Fnos-octop-vanilla-<ver>-<iter>.fpk（依赖 image，确保镜像已就绪）
 #   native job：构建「本地版（非 Docker）」飞牛安装包 Fnos-octop-vanilla-native-<ver>-<iter>.fpk。
 #               不内置 Python 运行时（依赖飞牛应用商店 Python 3.12），
@@ -85,12 +85,12 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Login to GHCR
+      - name: Login to Docker Hub
         uses: docker/login-action@v3
         with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          # Docker Hub（与 docker-publish.yml 同一凭据，DOCKERHUB_USERNAME 为 jubaoliang 时推送 jubaoliang/octop）
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push image
         uses: docker/build-push-action@v6
@@ -99,9 +99,9 @@ jobs:
           file: fnos/docker/Dockerfile
           push: true
           tags: |
-            ghcr.io/jubaoliang/octop:latest
-            ghcr.io/jubaoliang/octop:vanilla
-            ghcr.io/jubaoliang/octop:vanilla-v${{ needs.version.outputs.version }}
+            jubaoliang/octop:latest
+            jubaoliang/octop:vanilla
+            jubaoliang/octop:vanilla-v${{ needs.version.outputs.version }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
@@ -305,7 +305,7 @@ jobs:
             echo "## 安装说明"
             echo ""
             echo "1. 飞牛应用中心 → 设置 → 手动安装应用，选择对应 .fpk。"
-            echo "2. Docker 版 **Fnos-octop-vanilla-${VER}-${ITER}.fpk**（约 80KB）：飞牛自动从 GHCR 拉取镜像运行，镜像为 \\"ghcr.io/jubaoliang/octop:vanilla\\"。"
+            echo "2. Docker 版 **Fnos-octop-vanilla-${VER}-${ITER}.fpk**（约 80KB）：飞牛自动从 Docker Hub 拉取镜像运行，镜像为 \\"jubaoliang/octop:vanilla\\"。"
             echo "3. 本地版 **Fnos-octop-vanilla-native-${VER}-${ITER}.fpk**（约 200MB）：非 Docker，原生运行在飞牛主机；安装时自动关联系统 Python 3.12 开发工具；浏览器、远程桌面等附加组件在 Octop 应用内按需安装。"
             echo ""
             echo "---"
diff --git a/fnos/README.md b/fnos/README.md
index e7b5ea09..2dfde019 100644
--- a/fnos/README.md
+++ b/fnos/README.md
@@ -19,10 +19,10 @@ After install, open the app (Docker: `http://<device-ip>:8088`, native: `http://
 
 | 版本 | 包名 | 体积 | 运行方式 | 依赖 |
 |------|------|------|----------|------|
-| **Docker 版** | `octop-<ver>.fpk` | ~8 KB | 飞牛自动从 `ghcr.io/jubaoliang/octop:latest` 拉镜像运行 | 宿主需有 Docker 运行时 |
+| **Docker 版** | `octop-<ver>.fpk` | ~8 KB | 飞牛自动从 Docker Hub 拉取 `jubaoliang/octop:latest` 镜像运行 | 宿主需有 Docker 运行时 |
 | **本地版（非 Docker）** | `octop-native-<ver>.fpk` | ~560 MB | 自带 Python 3.12 运行时 + 前端 + 全部附加组件 + Chromium，原生运行在飞牛主机 | 无需 Docker |
 
-- **Docker 版**实现为 FnOS `docker-project`：包体只含 `docker-compose.yaml` 与向导配置，运行时由飞牛拉取 GHCR 镜像。镜像已内置全部附加组件（`browser` 浏览器自动化 + `desktop` 桌面控制）与前端。
+- **Docker 版**实现为 FnOS `docker-project`：包体只含 `docker-compose.yaml` 与向导配置，运行时由飞牛从 Docker Hub 拉取镜像。镜像已内置全部附加组件（`browser` 浏览器自动化 + `desktop` 桌面控制）与前端。
 - **本地版**实现为 FnOS 原生 `app`：包内自带独立 Python 3.12 运行时、Octop 全部依赖、前端构建产物、Playwright Chromium，以及 `data-share` 共享数据目录，直接以进程方式运行，不依赖 Docker。
 
 > 两款包都在滚动发布 **`fnos-latest`**：<https://github.com/TencentCloud/Octop/releases/tag/fnos-latest>
@@ -44,7 +44,7 @@ fnos/
 │   │   └── install         # 安装向导（可配置管理员账号/密码、日志级别、LLM 密钥）
 │   ├── app/
 │   │   ├── docker/
-│   │   │   └── docker-compose.yaml   # 引用 ghcr.io/jubaoliang/octop:latest
+│   │   │   └── docker-compose.yaml   # 引用 jubaoliang/octop:latest
 │   │   └── ui/
 │   │       ├── config                # 桌面图标入口
 │   │       └── images/icon-{64,256}.png
@@ -64,7 +64,7 @@ fnos/
 ## 工作机制
 
 1. **源码同步**：`.github/workflows/zz-sync-upstream.yml` 每 6 小时把上游 `TencentCloud/Octop` 的更新合并进本仓 `main` 分支（使用仓库自带 `GITHUB_TOKEN`，无需 PAT）。
-2. **镜像构建**：`.github/workflows/fnos-build-fpk.yml` 的 `image` job 在 `main` 更新时，用 `fnos/docker/Dockerfile` 从仓库源码构建 Octop 镜像并推送到 `ghcr.io/jubaoliang/octop:latest`（含全部附加组件）。
+2. **镜像构建**：`.github/workflows/fnos-build-fpk.yml` 的 `image` job 在 `main` 更新时，用 `fnos/docker/Dockerfile` 从仓库源码构建 Octop 镜像并推送到 Docker Hub `jubaoliang/octop:latest`（含全部附加组件）。
 3. **安装包构建**：同一 workflow 的 `fpk` job 用 `scripts/build-fpk.sh` 把 `fnos/docker/` 打成 Docker 版 `.fpk`；`native` job 用 python-build-standalone 构建 Python 3.12 运行时、安装全部依赖与 Playwright Chromium，把 `fnos/native/` 打成本地版 `.fpk`（`continue-on-error`，失败不阻塞 Docker 版）。两者均以滚动发布 `fnos-latest` 提供下载。
 
 ## 本地构建 .fpk（无需 Docker）
@@ -84,6 +84,6 @@ bash scripts/build-fpk.sh native     # 仅本地版      → dist/octop-native-<
    - 不想依赖 Docker、希望自带运行时原生运行 → 选 `octop-native-<version>.fpk`
 2. 安装向导中设置管理员账号/密码、日志级别、LLM 密钥（可选）。
 3. 安装完成后桌面出现「Octop AI 助手」图标，浏览器打开 `http://<设备IP>:8088`。
-4. Docker 版镜像首次会从 `ghcr.io/jubaoliang/octop:latest` 拉取；请确保该镜像为公开（workflow 已自动设为 public）。本地版无需联网拉镜像，首次启动会按需要补装 Chromium 系统库（需 root 权限，已尽力处理）。
+4. Docker 版镜像首次会从 Docker Hub `jubaoliang/octop:latest` 拉取；请确保该镜像为公开（workflow 已自动设为 public）。本地版无需联网拉镜像，首次启动会按需要补装 Chromium 系统库（需 root 权限，已尽力处理）。
 
 > 服务端口固定为 `8088`（飞牛端口映射与桌面图标均据此）。附加组件（browser 浏览器自动化 + desktop 桌面控制）已在镜像中默认安装。
diff --git a/fnos/docker/Dockerfile b/fnos/docker/Dockerfile
index 292ca879..fabbfc4d 100644
--- a/fnos/docker/Dockerfile
+++ b/fnos/docker/Dockerfile
@@ -7,7 +7,7 @@
 #   - desktop  （mss / pynput / pillow，桌面控制附加组件）
 #
 # 构建上下文必须为仓库根目录（fnpack / CI 中以仓库根为 context）：
-#   docker build -f fnos/docker/Dockerfile -t ghcr.io/jubaoliang/octop:latest .
+#   docker build -f fnos/docker/Dockerfile -t jubaoliang/octop:latest .
 #
 # 国内加速（可选 build-arg）：
 #   PIP_INDEX_URL / PIP_TRUSTED_HOST / NPM_REGISTRY / APT_MIRROR
diff --git a/fnos/docker/app/docker/docker-compose.yaml b/fnos/docker/app/docker/docker-compose.yaml
index fb860327..c3ef0082 100644
--- a/fnos/docker/app/docker/docker-compose.yaml
+++ b/fnos/docker/app/docker/docker-compose.yaml
@@ -1,6 +1,6 @@
 services:
   octop:
-    image: ghcr.io/jubaoliang/octop:latest
+    image: jubaoliang/octop:latest
     container_name: octop
     restart: unless-stopped
     pull_policy: always
diff --git a/fnos/docker/manifest b/fnos/docker/manifest
index efdb1f64..7db0b030 100644
--- a/fnos/docker/manifest
+++ b/fnos/docker/manifest
@@ -1,7 +1,7 @@
 appname=octop
 version=0.9.15
 display_name=OCTOP
-desc=腾讯开源的多用户多智能体 AI 助手平台，支持 Web 控制台、CLI、IM 渠道与定时任务，数据全部本地存储。<br/><br/><strong>安装后使用：</strong><br/>在应用中心点击「打开」按钮即可进入 Web 控制台，默认地址 http://设备IP:8088。<br/>初始管理员账号：admin，初始密码：Octop123（首次登录后请在头像菜单修改密码）。<br/><br/><strong>首次登录后：</strong><br/>请在控制台「设置」中配置 LLM 模型、IM 渠道、远程桌面、浏览器等组件。<br/><br/>注意：Docker 版通过容器部署，会自动从 ghcr.io/jubaoliang/octop:latest 拉取镜像运行，已预装 browser / desktop 附加组件。
+desc=腾讯开源的多用户多智能体 AI 助手平台，支持 Web 控制台、CLI、IM 渠道与定时任务，数据全部本地存储。<br/><br/><strong>安装后使用：</strong><br/>在应用中心点击「打开」按钮即可进入 Web 控制台，默认地址 http://设备IP:8088。<br/>初始管理员账号：admin，初始密码：Octop123（首次登录后请在头像菜单修改密码）。<br/><br/><strong>首次登录后：</strong><br/>请在控制台「设置」中配置 LLM 模型、IM 渠道、远程桌面、浏览器等组件。<br/><br/>注意：Docker 版通过容器部署，会自动从 jubaoliang/octop:latest 拉取镜像运行，已预装 browser / desktop 附加组件。
 source=thirdparty
 platform=all
 maintainer=TencentCloud OrcaKit

From 364023e19c4b96a8254245679af184a99f09ba7f Mon Sep 17 00:00:00 2001
From: jubaoliang <jubaoliang@tencent.com>
Date: Wed, 26 Aug 2026 12:09:06 +0000
Subject: [PATCH 5/6] chore: release 0.9.28

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 CHANGELOG.md          | 11 +++++------
 README.md             |  2 +-
 pyproject.toml        |  2 +-
 src/octop/__init__.py |  2 +-
 4 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5565d4d3..4d1c00f0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,14 +6,13 @@
 
 ## [Unreleased]
 
-### 修复
-
-- 无「应用更新」权限时隐藏检查更新入口（按权限而非 admin 角色）
-- `/compact` 卸载路径展示兼容 `.octop/conversation_history/`
+## [0.9.28] - 2026-08-26
 
-### 其他
+### 修复
 
-- 测试：`pytest-xdist` 并行、`make test-fast`、`slow` 标记与隔离 HOME
+- 无更新权限时隐藏检查更新入口
+- `/compact` 兼容 `.octop/conversation_history/` 卸载路径
+- FnOS 镜像改为 Docker Hub `jubaoliang/octop`
 
 ## [0.9.27] - 2026-08-26
 
diff --git a/README.md b/README.md
index 26c9e2c6..78a3a558 100644
--- a/README.md
+++ b/README.md
@@ -9,7 +9,7 @@
 <p align="center">
   <a href="https://www.python.org/downloads/"><img alt="Python 3.12+" src="https://img.shields.io/badge/python-3.12%2B-blue?logo=python&logoColor=white" /></a>
   <a href="https://github.com/TencentCloud/Octop/blob/main/LICENSE"><img alt="License: MIT" src="https://img.shields.io/badge/license-MIT-green" /></a>
-  <a href="https://github.com/TencentCloud/Octop/releases"><img alt="Version" src="https://img.shields.io/badge/version-0.9.27-orange" /></a>
+  <a href="https://github.com/TencentCloud/Octop/releases"><img alt="Version" src="https://img.shields.io/badge/version-0.9.28-orange" /></a>
   <a href="https://pypi.org/project/octop/"><img src="https://img.shields.io/pypi/v/octop" alt="PyPI" /></a>
   <a href="https://github.com/astral-sh/ruff"><img alt="Code Style: Ruff" src="https://img.shields.io/badge/code%20style-ruff-000000?logo=ruff&logoColor=white" /></a>
   <a href="https://github.com/TencentCloud/Octop"><img alt="GitHub stars" src="https://img.shields.io/github/stars/TencentCloud/Octop?style=social" /></a>
diff --git a/pyproject.toml b/pyproject.toml
index 2754a746..4b33a445 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "octop"
-version = "0.9.27"
+version = "0.9.28"
 description = "Smarter self-hosted AI assistant for multiple users and agents, built on harness-agent"
 readme = "README.md"
 license = { text = "MIT" }
diff --git a/src/octop/__init__.py b/src/octop/__init__.py
index 6b3a6bf7..f999b8b4 100644
--- a/src/octop/__init__.py
+++ b/src/octop/__init__.py
@@ -2,4 +2,4 @@
 
 from __future__ import annotations
 
-__version__ = "0.9.27"
+__version__ = "0.9.28"

From a2db604a7f20efff9f394091a66501286863ce1a Mon Sep 17 00:00:00 2001
From: jubaoliang <jubaoliang@tencent.com>
Date: Wed, 26 Aug 2026 12:38:11 +0000
Subject: [PATCH 6/6] chore: sync uv.lock version to 0.9.28

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 uv.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/uv.lock b/uv.lock
index 6b3aef88..ec62161b 100644
--- a/uv.lock
+++ b/uv.lock
@@ -2474,7 +2474,7 @@ wheels = [
 
 [[package]]
 name = "octop"
-version = "0.9.27"
+version = "0.9.28"
 source = { editable = "." }
 dependencies = [
     { name = "acme" },