diff --git a/manual_trading_hub/hub.py b/manual_trading_hub/hub.py
index 42cd70f..c7fd379 100644
--- a/manual_trading_hub/hub.py
+++ b/manual_trading_hub/hub.py
@@ -39,6 +39,7 @@ HUB_BRIDGE_TOKEN = (os.getenv("HUB_BRIDGE_TOKEN") or os.getenv("CONTROL_TOKEN")
 _trust_raw = (os.getenv("HUB_TRUST_LAN", "true") or "").strip().lower()
 HUB_TRUST_LAN = _trust_raw not in ("0", "false", "no", "off")
 DIR = Path(__file__).resolve().parent
+HUB_BUILD = "20260521-no-trade-ui"
 
 
 def _is_local(host: str | None) -> bool:
@@ -431,8 +432,10 @@ def api_ping():
     return {
         "ok": True,
         "service": "manual-trading-hub",
+        "build": HUB_BUILD,
         "trade_ui": False,
         "features": ["monitor", "settings", "auth"],
+        "password_required": password_required(),
     }
 
 
diff --git a/manual_trading_hub/hub_web_auth.py b/manual_trading_hub/hub_web_auth.py
index dbc4d83..30323c7 100644
--- a/manual_trading_hub/hub_web_auth.py
+++ b/manual_trading_hub/hub_web_auth.py
@@ -100,7 +100,7 @@ def is_public_path(path: str, method: str) -> bool:
     p = (path or "").split("?")[0].rstrip("/") or "/"
     if p.startswith("/assets"):
         return True
-    if p in ("/login", "/api/auth/login", "/api/auth/status"):
+    if p in ("/login", "/api/auth/login", "/api/auth/status", "/api/ping"):
         return True
     if p == "/api/auth/logout" and method.upper() == "POST":
         return True
diff --git a/manual_trading_hub/scripts/verify_hub_deploy.sh b/manual_trading_hub/scripts/verify_hub_deploy.sh
new file mode 100644
index 0000000..eebafa1
--- /dev/null
+++ b/manual_trading_hub/scripts/verify_hub_deploy.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# 在服务器上检查中控是否为最新代码（无 api_trade_key、已装 multipart）
+set -euo pipefail
+HUB_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$HUB_DIR"
+echo "=== hub.py 检查 ==="
+if grep -n 'def api_trade_key' hub.py 2>/dev/null; then
+  echo "FAIL: 仍是旧版 hub.py（含 api_trade_key），请 git pull 或同步最新代码"
+  exit 1
+fi
+if ! grep -q 'HUB_BUILD' hub.py; then
+  echo "FAIL: hub.py 缺少 HUB_BUILD 标记，代码过旧"
+  exit 1
+fi
+echo "OK: 无 api_trade_key，含 HUB_BUILD"
+
+echo "=== python-multipart ==="
+# shellcheck source=/dev/null
+source .venv/bin/activate
+python -c "import multipart; print('OK:', multipart.__version__)"
+
+echo "=== /api/ping ==="
+curl -sf http://127.0.0.1:5100/api/ping | python -m json.tool
+echo ""
+echo "若 build 不是 20260521-no-trade-ui，请 pm2 restart manual-trading-hub"