diff --git a/app/Http/Controllers/Admin/CourseController.php b/app/Http/Controllers/Admin/CourseController.php
index 8d8a6c1..304aa0f 100755
--- a/app/Http/Controllers/Admin/CourseController.php
+++ b/app/Http/Controllers/Admin/CourseController.php
@@ -434,13 +434,27 @@ class CourseController extends BaseController
         if ($validator->fails()) {
             return $this->fail([ResponseCode::ERROR_PARAMETER, implode(',', $validator->errors()->all())]);
         }
-        // generate=1 时才调用微信生成；默认仅返回已有文件，避免弹窗打开即 500
-        $generate = !empty($all['generate']);
-        $url = (new Course())->getCourseQrcode($all['id'], $generate);
-        if ($generate && empty($url)) {
-            return $this->fail([ResponseCode::ERROR_BUSINESS, '二维码生成失败，请检查微信配置或缓存后重试']);
+        try {
+            // generate=1 时才调用微信生成；默认仅返回已有文件，避免弹窗打开即 500
+            $generate = !empty($all['generate']);
+            $url = (new Course())->getCourseQrcode($all['id'], $generate);
+            if ($generate && empty($url)) {
+                return $this->fail([ResponseCode::ERROR_BUSINESS, '二维码生成失败，请检查微信配置或缓存后重试']);
+            }
+            return $this->success($url ?: '');
+        } catch (\Throwable $e) {
+            \Log::error('courses/qrcode failed', [
+                'id' => $all['id'] ?? null,
+                'generate' => $all['generate'] ?? null,
+                'message' => $e->getMessage(),
+                'file' => $e->getFile(),
+                'line' => $e->getLine(),
+            ]);
+            return $this->fail([
+                ResponseCode::ERROR_BUSINESS,
+                '二维码生成失败: ' . $e->getMessage(),
+            ]);
         }
-        return $this->success($url ?: '');
     }
 
     /**
diff --git a/wechat_qrcode_diag.php b/wechat_qrcode_diag.php
index 90e93ca..381738a 100644
--- a/wechat_qrcode_diag.php
+++ b/wechat_qrcode_diag.php
@@ -1,23 +1,33 @@
 <?php
 /**
- * 微信小程序码 / access_token 一键诊断
+ * 微信小程序码 / access_token 一键诊断（可长期保留）
  *
- * 用法（任选其一）：
- * 1) 命令行：php wechat_qrcode_diag.php
- * 2) 命令行指定课程：php wechat_qrcode_diag.php 188
- * 3) 浏览器（用完务必删除本文件）：
- *    https://你的域名/wechat_qrcode_diag.php?key=stbc-diag-2026&course_id=188
+ * 默认仅允许命令行，避免被公网访问：
+ *   php wechat_qrcode_diag.php
+ *   php wechat_qrcode_diag.php 188
+ *
+ * 结果文件：
+ *   wechat_qrcode_diag_result.txt
+ *
+ * 如确需浏览器访问，把下面 $allowWeb 改成 true，并自行改 $webSecret。
+ * 用完建议改回 false。
  */
 
 $cli = PHP_SAPI === 'cli';
-$secret = 'stbc-diag-2026';
+$allowWeb = false; // 长期保留时请保持 false
+$webSecret = 'CHANGE_ME_TO_A_LONG_RANDOM_SECRET';
 $courseId = $cli
     ? (int) (isset($argv[1]) ? $argv[1] : 188)
     : (int) (isset($_GET['course_id']) ? $_GET['course_id'] : 188);
 
 if (!$cli) {
     header('Content-Type: text/plain; charset=utf-8');
-    if (($_GET['key'] ?? '') !== $secret) {
+    if (!$allowWeb) {
+        http_response_code(403);
+        echo "web access disabled, use: php wechat_qrcode_diag.php 188\n";
+        exit(1);
+    }
+    if ($webSecret === '' || $webSecret === 'CHANGE_ME_TO_A_LONG_RANDOM_SECRET' || ($_GET['key'] ?? '') !== $webSecret) {
         http_response_code(403);
         echo "forbidden\n";
         exit(1);
@@ -157,6 +167,21 @@ if ($appId === '' || $secretCfg === '') {
     }
 }
 
+$put('');
+$put('--- deploy check ---');
+try {
+    $ref = new ReflectionMethod(App\Models\Course::class, 'getCourseQrcode');
+    $put('getCourseQrcode_params=' . $ref->getNumberOfParameters());
+    $put('has_resolveMiniProgramQrcode=' . (method_exists(App\Models\Course::class, 'resolveMiniProgramQrcode') ? 'yes' : 'no'));
+    $appends = (new ReflectionClass(App\Models\Course::class))->getDefaultProperties()['appends'] ?? [];
+    $put('qrcode_in_appends=' . (in_array('qrcode', $appends, true) ? 'yes' : 'no'));
+    $ctrl = file_get_contents(__DIR__ . '/app/Http/Controllers/Admin/CourseController.php');
+    $put('controller_has_generate_flag=' . (strpos($ctrl, "generate") !== false && strpos($ctrl, 'getCourseQrcode') !== false ? 'yes' : 'no'));
+    $put('controller_has_try_catch_qrcode=' . (strpos($ctrl, 'courses/qrcode failed') !== false ? 'yes' : 'no'));
+} catch (Throwable $e) {
+    $put('deploy_check_FAIL: ' . $e->getMessage());
+}
+
 $put('');
 $put('--- course model generate ---');
 try {