diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 78a88ff..c68da89 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -3,12 +3,16 @@
 # 支持内网穿透，资源存储在MinIO存储桶
 # 从私有镜像仓库拉取镜像，无需源码
 # ============================================
+# Harbor 项目结构：
+# - flnxi-public (公开): Agent、runtime 依赖镜像
+# - flnxi (私有): 素材系统镜像，需 token 拉取
+# ============================================
 
 services:
   # PostgreSQL 数据库
   postgres:
-    # 从 Harbor 的 runtime 子目录拉取（正式环境使用公开镜像）
-    image: ${POSTGRES_IMAGE:-harbor.flnxi.com/flnxi/runtime/postgres:15-alpine}
+    # 从 Harbor 的 flnxi-public 项目拉取（公开，无需登录）
+    image: ${POSTGRES_IMAGE:-harbor.flnxi.com/flnxi-public/runtime/postgres:15-alpine}
     container_name: flnxi-postgres
     restart: unless-stopped
     environment:
@@ -29,8 +33,8 @@ services:
   # MinIO 对象存储
   # 使用特定版本号确保稳定性（符合项目宗旨：稳定性优先）
   minio:
-    # 从 Harbor 的 flnxi 项目下的 runtime 子目录拉取
-    image: ${MINIO_IMAGE:-harbor.flnxi.com/flnxi/runtime/minio:RELEASE.2025-04-22T22-12-26Z}
+    # 从 Harbor 的 flnxi-public 项目拉取（公开，无需登录）
+    image: ${MINIO_IMAGE:-harbor.flnxi.com/flnxi-public/runtime/minio:RELEASE.2025-04-22T22-12-26Z}
     container_name: flnxi-minio
     restart: unless-stopped
     command: server /data --console-address ":9001"
@@ -53,8 +57,8 @@ services:
   # MinIO 初始化服务（创建bucket）
   # 使用 latest 标签确保可用性（mc 客户端版本兼容性好）
   minio-init:
-    # 从 Harbor 的 flnxi 项目下的 runtime 子目录拉取
-    image: ${MINIO_MC_IMAGE:-harbor.flnxi.com/flnxi/runtime/minio-mc:latest}
+    # 从 Harbor 的 flnxi-public 项目拉取（公开，无需登录）
+    image: ${MINIO_MC_IMAGE:-harbor.flnxi.com/flnxi-public/runtime/minio-mc:latest}
     container_name: flnxi-minio-init
     depends_on:
       minio:
@@ -71,12 +75,11 @@ services:
     networks:
       - app-network
 
-  # 主应用（Pro版 - 从私有镜像仓库拉取）
+  # 主应用（Pro版 - 从私有镜像仓库拉取，需 token）
   app:
-    # 根据环境从不同的 Harbor 项目拉取：
-    # - 测试环境: harbor.flnxi.com/flnxi-test/flnxi-material:pro-test (私有，需登录)
-    # - 正式环境: harbor.flnxi.com/flnxi/flnxi-material:pro-latest (公开，无需登录)
-    image: ${APP_IMAGE:-${DOCKER_REGISTRY:-harbor.flnxi.com/flnxi}/flnxi-material:pro-${IMAGE_TAG:-latest}}
+    # 从 Harbor 的 flnxi 项目拉取（私有，需许可证 token 登录）
+    # Agent 会在验证许可证后自动获取 token 并拉取此镜像
+    image: ${APP_IMAGE:-harbor.flnxi.com/flnxi/flnxi-material:pro-${IMAGE_TAG:-latest}}
     container_name: flnxi-material
     restart: unless-stopped
     ports:
diff --git a/发布管理.ps1 b/发布管理.ps1
index 9f80782..858549f 100644
--- a/发布管理.ps1
+++ b/发布管理.ps1
@@ -16,7 +16,8 @@ $Config = @{
     Server = "45.249.208.118"
     SshKey = "$env:USERPROFILE\.ssh\youyidian_prod_ed25519"
     HarborHost = "harbor.flnxi.com"
-    HarborProject = "flnxi"
+    HarborProject = "flnxi"              # 私有项目（素材系统）
+    HarborPublicProject = "flnxi-public" # 公开项目（Agent、runtime）
     DockerHubUser = "flnxi"
     HealthCheckPort = 4320
     HealthCheckTimeout = 45
@@ -245,11 +246,11 @@ function Show-Menu {
     Write-Color "║  [1] 构建并部署测试版                                     ║" "White"
     Write-Color "║                                                           ║" "Cyan"
     Write-Color "║  === 正式发布 (需要确认) ===                              ║" "Yellow"
-    Write-Color "║  [2] 发布素材系统正式版 ⚠️                                ║" "Yellow"
-    Write-Color "║  [3] 发布 Agent 安装程序 ⚠️                               ║" "Yellow"
+    Write-Color "║  [2] 发布素材系统正式版 (flnxi 私有) ⚠️                   ║" "Yellow"
+    Write-Color "║  [3] 发布 Agent (flnxi-public 公开) ⚠️                    ║" "Yellow"
     Write-Color "║                                                           ║" "Cyan"
     Write-Color "║  === 基础设施 ===                                         ║" "White"
-    Write-Color "║  [4] 同步 Runtime 镜像到 Harbor                           ║" "White"
+    Write-Color "║  [4] 同步 Runtime 镜像 (flnxi-public 公开)                ║" "White"
     Write-Color "║  [5] 部署许可证服务器 ⚠️                                  ║" "Yellow"
     Write-Color "║                                                           ║" "Cyan"
     Write-Color "║  === 维护 ===                                             ║" "White"
@@ -408,9 +409,9 @@ function Publish-Agent {
     $currentVersion = Get-AgentVersion
     Write-Info "当前 Agent 版本: $currentVersion"
     
-    # Docker Hub 镜像配置
-    # 格式: flnxi/flnxi-material:agent-版本号
-    $dockerHubRepo = "$($Config.DockerHubUser)/flnxi-material"
+    # Harbor 公开项目镜像配置
+    # 格式: harbor.flnxi.com/flnxi-public/agent:版本号
+    $harborRepo = "$($Config.HarborHost)/$($Config.HarborPublicProject)/agent"
     
     $newVersion = Read-Host "请输入新版本号 (当前: $currentVersion)"
     if ([string]::IsNullOrWhiteSpace($newVersion)) {
@@ -419,19 +420,27 @@ function Publish-Agent {
     }
     
     Write-Host ""
-    Write-Info "镜像将推送到:"
-    Write-Info "  ${dockerHubRepo}:agent-${newVersion}"
-    Write-Info "  ${dockerHubRepo}:agent-latest"
+    Write-Info "镜像将推送到 Harbor flnxi-public 项目 (公开，无需登录即可拉取):"
+    Write-Info "  ${harborRepo}:${newVersion}"
+    Write-Info "  ${harborRepo}:latest"
     Write-Host ""
     
     # 确认
     if (-not (Confirm-Action `
-        "将发布 Agent $newVersion 到 Docker Hub" `
-        "此操作将更新 Docker Hub 上的安装程序，影响所有新安装的客户！")) {
+        "将发布 Agent $newVersion 到 Harbor (flnxi-public)" `
+        "此操作将更新 Harbor 上的安装程序，影响所有新安装的客户！")) {
         Write-Warning "取消发布"
         return
     }
     
+    # 检查 Harbor 登录
+    $loginCheck = docker login $Config.HarborHost 2>&1
+    if ($LASTEXITCODE -ne 0) {
+        Write-Warning "请先登录 Harbor: docker login $($Config.HarborHost)"
+        return
+    }
+    Write-Success "Harbor 登录状态: OK"
+    
     # 更新版本文件
     $newVersion | Out-File -FilePath "flnxi-agent/VERSION.txt" -Encoding UTF8 -NoNewline
     Write-Success "Agent 版本文件已更新: $newVersion"
@@ -447,8 +456,8 @@ function Publish-Agent {
         $buildArgs = @(
             "build",
             "--progress=plain",
-            "-t", "${dockerHubRepo}:agent-${newVersion}",
-            "-t", "${dockerHubRepo}:agent-latest",
+            "-t", "${harborRepo}:${newVersion}",
+            "-t", "${harborRepo}:latest",
             "--build-arg", "AGENT_VERSION=$newVersion",
             "."
         )
@@ -460,18 +469,18 @@ function Publish-Agent {
         }
         Write-Success "构建完成"
         
-        # 推送到 Docker Hub
-        Write-Info "推送到 Docker Hub..."
-        docker push "${dockerHubRepo}:agent-${newVersion}"
-        docker push "${dockerHubRepo}:agent-latest"
+        # 推送到 Harbor flnxi-public 项目
+        Write-Info "推送到 Harbor (flnxi-public)..."
+        docker push "${harborRepo}:${newVersion}"
+        docker push "${harborRepo}:latest"
         
         if ($LASTEXITCODE -eq 0) {
             Write-Success "Agent $newVersion 发布完成！"
             Write-Host ""
             Write-Color "═══════════════════════════════════════════════════════════" "Cyan"
-            Write-Info "镜像地址: docker.io/${dockerHubRepo}:agent-latest"
+            Write-Info "镜像地址: ${harborRepo}:latest"
             Write-Info "客户安装命令:"
-            Write-Color "  docker run -d -p 3080:3080 -v /var/run/docker.sock:/var/run/docker.sock ${dockerHubRepo}:agent-latest" "White"
+            Write-Color "  docker run -d -p 3080:3080 -v /var/run/docker.sock:/var/run/docker.sock ${harborRepo}:latest" "White"
             Write-Color "═══════════════════════════════════════════════════════════" "Cyan"
         } else {
             Write-Error "推送失败"
@@ -484,19 +493,22 @@ function Publish-Agent {
 
 # 4. 同步 Runtime 镜像
 function Sync-RuntimeImages {
-    Write-Title "同步 Runtime 镜像到 Harbor"
+    Write-Title "同步 Runtime 镜像到 Harbor (flnxi-public)"
     
     # Runtime 镜像列表（含国内镜像源）
+    # 推送到 flnxi-public 公开项目，无需登录即可拉取
     $runtimeImages = @(
         @{ Source = "postgres:16-alpine"; Mirror = "registry.cn-hangzhou.aliyuncs.com/library/postgres:16-alpine"; Target = "runtime/postgres:16-alpine" },
+        @{ Source = "postgres:15-alpine"; Mirror = "registry.cn-hangzhou.aliyuncs.com/library/postgres:15-alpine"; Target = "runtime/postgres:15-alpine" },
         @{ Source = "minio/minio:latest"; Mirror = "quay.io/minio/minio:latest"; Target = "runtime/minio:latest" },
-        @{ Source = "minio/mc:latest"; Mirror = "quay.io/minio/mc:latest"; Target = "runtime/mc:latest" },
+        @{ Source = "minio/minio:RELEASE.2025-04-22T22-12-26Z"; Mirror = "quay.io/minio/minio:RELEASE.2025-04-22T22-12-26Z"; Target = "runtime/minio:RELEASE.2025-04-22T22-12-26Z" },
+        @{ Source = "minio/mc:latest"; Mirror = "quay.io/minio/mc:latest"; Target = "runtime/minio-mc:latest" },
         @{ Source = "redis:7-alpine"; Mirror = "registry.cn-hangzhou.aliyuncs.com/library/redis:7-alpine"; Target = "runtime/redis:7-alpine" },
         @{ Source = "nginx:alpine"; Mirror = "registry.cn-hangzhou.aliyuncs.com/library/nginx:alpine"; Target = "runtime/nginx:alpine" },
         @{ Source = "node:20-alpine"; Mirror = "registry.cn-hangzhou.aliyuncs.com/library/node:20-alpine"; Target = "runtime/node:20-alpine" }
     )
     
-    Write-Info "将同步以下镜像到 Harbor (优先使用国内镜像源):"
+    Write-Info "将同步以下镜像到 Harbor flnxi-public 项目 (公开，无需登录即可拉取):"
     foreach ($img in $runtimeImages) {
         Write-Info "  - $($img.Source)"
     }
@@ -519,7 +531,8 @@ function Sync-RuntimeImages {
         $index = $runtimeImages.IndexOf($img) + 1
         $source = $img.Source
         $mirror = $img.Mirror
-        $target = "$($Config.HarborHost)/$($Config.HarborProject)/$($img.Target)"
+        # 推送到 flnxi-public 公开项目
+        $target = "$($Config.HarborHost)/$($Config.HarborPublicProject)/$($img.Target)"
         
         Write-Color "[$index/$total] $source -> $target" "White"
         
@@ -857,6 +870,11 @@ function Show-Status {
     Write-Info "Agent 版本: $(Get-AgentVersion)"
     Write-Host ""
     
+    Write-Color "=== Harbor 项目结构 ===" "Yellow"
+    Write-Info "flnxi-public (公开): Agent、runtime 依赖"
+    Write-Info "flnxi (私有): 素材系统镜像"
+    Write-Host ""
+    
     Write-Color "=== Harbor 镜像 ===" "Yellow"
     Write-Info "检查 Harbor 镜像..."
     
@@ -865,26 +883,23 @@ function Show-Status {
     if ($LASTEXITCODE -eq 0) {
         Write-Success "Harbor 已登录"
         
-        # 列出镜像
+        # 列出私有项目镜像
         Write-Host ""
-        Write-Color "material/ (正式版):" "White"
-        docker images "$($Config.HarborHost)/$($Config.HarborProject)/material/*" --format "  {{.Repository}}:{{.Tag}}\t{{.CreatedSince}}" 2>$null
+        Write-Color "flnxi/ (私有 - 素材系统):" "White"
+        docker images "$($Config.HarborHost)/$($Config.HarborProject)/*" --format "  {{.Repository}}:{{.Tag}}\t{{.CreatedSince}}" 2>$null
+        
+        # 列出公开项目镜像
+        Write-Host ""
+        Write-Color "flnxi-public/agent (公开 - Agent):" "White"
+        docker images "$($Config.HarborHost)/$($Config.HarborPublicProject)/agent*" --format "  {{.Repository}}:{{.Tag}}\t{{.CreatedSince}}" 2>$null
         
         Write-Host ""
-        Write-Color "material-dev/ (测试版):" "White"
-        docker images "$($Config.HarborHost)/$($Config.HarborProject)/material-dev/*" --format "  {{.Repository}}:{{.Tag}}\t{{.CreatedSince}}" 2>$null
-        
-        Write-Host ""
-        Write-Color "runtime/ (依赖镜像):" "White"
-        docker images "$($Config.HarborHost)/$($Config.HarborProject)/runtime/*" --format "  {{.Repository}}:{{.Tag}}\t{{.CreatedSince}}" 2>$null
+        Write-Color "flnxi-public/runtime (公开 - 依赖镜像):" "White"
+        docker images "$($Config.HarborHost)/$($Config.HarborPublicProject)/runtime/*" --format "  {{.Repository}}:{{.Tag}}\t{{.CreatedSince}}" 2>$null
     } else {
         Write-Warning "未登录 Harbor，请先执行: docker login $($Config.HarborHost)"
     }
     
-    Write-Host ""
-    Write-Color "=== Docker Hub (Agent) ===" "Yellow"
-    docker images "$($Config.DockerHubUser)/flnxi-agent" --format "  {{.Repository}}:{{.Tag}}\t{{.CreatedSince}}" 2>$null
-    
     Write-Host ""
     Write-Color "=== 服务器状态 ===" "Yellow"
     Write-Info "检查服务器 $($Config.Server)..."