feat: add delete and reveal endpoints, support deleted_at field

* feat(mcp): add Panel MCP task configuration and website binding structures

* fix(mcp): correct variable assignment in mcpWebsiteDomain function

agent/app/api/v2/agents.go

@@ -826,6 +826,26 @@ func (b *BaseApi) UpdateAgentFeishuConfig(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags AI
+// @Summary Switch to the bundled OpenClaw Feishu plugin
+// @Accept json
+// @Param request body dto.AgentFeishuSwitchReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/channel/feishu/switch [post]
+func (b *BaseApi) SwitchAgentFeishuPlugin(c *gin.Context) {
+	var req dto.AgentFeishuSwitchReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.SwitchFeishuPlugin(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags AI
 // @Summary Get Agent Telegram channel config
 // @Accept json

agent/app/api/v2/ai.go

@@ -72,22 +72,6 @@ func (b *BaseApi) CloseOllamaModel(c *gin.Context) {
 	helper.SuccessWithData(c, nil)
 }
 
-// @Tags AI
-// @Summary Sync Ollama model list
-// @Success 200 {array} dto.OllamaModelDropList
-// @Security ApiKeyAuth
-// @Security Timestamp
-// @Router /ai/ollama/model/sync [post]
-// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"同步 Ollama 模型列表","formatEN":"sync Ollama model list"}
-func (b *BaseApi) SyncOllamaModel(c *gin.Context) {
-	list, err := aiToolService.Sync()
-	if err != nil {
-		helper.BadRequest(c, err)
-		return
-	}
-	helper.SuccessWithData(c, list)
-}
-
 // @Tags AI
 // @Summary Page Ollama models
 // @Accept json
@@ -114,6 +98,18 @@ func (b *BaseApi) SearchOllamaModel(c *gin.Context) {
 	})
 }
 
+func (b *BaseApi) SyncOllamaModelAccount(c *gin.Context) {
+	var req dto.OllamaModelAccountSync
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := aiToolService.SyncAccount(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags AI
 // @Summary Page Ollama models
 // @Accept json

agent/app/api/v2/ai_benchmark.go

@@ -0,0 +1,16 @@
+package v2
+
+import (
+	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
+	"github.com/1Panel-dev/1Panel/agent/app/service"
+	"github.com/gin-gonic/gin"
+)
+
+func (b *BaseApi) AIBenchmarkSources(c *gin.Context) {
+	sources, err := service.AIBenchmarkSources(c.Query("kind"), c.Query("selected"))
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, sources)
+}

agent/app/api/v2/alert.go

@@ -293,7 +293,7 @@ func (b *BaseApi) PageAlertConfig(c *gin.Context) {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /alert/config/update [post]
-// @x-panel-log {"bodyKeys":["id","displayName"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新告警配置 [id][displayName]","formatEN":"update alert config [id][displayName]"}
+// @x-panel-log {"bodyKeys":["displayName"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新告警配置 [displayName]","formatEN":"update alert config [displayName]"}
 func (b *BaseApi) UpdateAlertConfig(c *gin.Context) {
 	var req dto.AlertConfigUpdate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -321,13 +321,15 @@ func (b *BaseApi) UpdateAlertConfig(c *gin.Context) {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /alert/config/status [post]
-// @x-panel-log {"bodyKeys":["id","status"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新告警配置状态 [id][status]","formatEN":"update alert config status [id][status]"}
+// @x-panel-log {"bodyKeys":["status"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新告警配置状态 [name][status]","formatEN":"update alert config status [name][status]"}
 func (b *BaseApi) UpdateAlertConfigStatus(c *gin.Context) {
 	var req dto.AlertConfigStatusUpdate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	if err := alertService.UpdateAlertConfigStatus(req, loadAuditUser(c)); err != nil {
+	name, err := alertService.UpdateAlertConfigStatus(req, loadAuditUser(c))
+	helper.SetOperationLogValues(c, map[string]string{"name": name})
+	if err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
@@ -353,13 +355,14 @@ func loadAuditUser(c *gin.Context) string {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /alert/config/del [post]
-// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"删除告警配置 [id]","formatEN":"delete alert config [id]"}
+// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"删除告警配置 [name]","formatEN":"delete alert config [name]"}
 func (b *BaseApi) DeleteAlertConfig(c *gin.Context) {
 	var req dto.DeleteRequest
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	err := alertService.DeleteAlertConfig(req.ID)
+	name, err := alertService.DeleteAlertConfig(req.ID)
+	helper.SetOperationLogValues(c, map[string]string{"name": name})
 	if err != nil {
 		helper.InternalServer(c, err)
 		return

agent/app/api/v2/container.go

@@ -28,7 +28,7 @@ func (b *BaseApi) SearchContainer(c *gin.Context) {
 		return
 	}
 
-	total, list, err := containerService.Page(req)
+	total, list, err := containerService.Page(c.Request.Context(), req)
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -249,9 +249,10 @@ func (b *BaseApi) ListContainerByImage(c *gin.Context) {
 // @Success 200 {object} dto.ContainerStatus
 // @Security ApiKeyAuth
 // @Security Timestamp
+// @Param containersOnly query boolean false "Only count containers"
 // @Router /containers/status [get]
 func (b *BaseApi) LoadContainerStatus(c *gin.Context) {
-	data, err := containerService.LoadStatus()
+	data, err := containerService.LoadStatus(c.Request.Context(), c.Query("containersOnly") == "true")
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -415,9 +416,14 @@ func (b *BaseApi) LoadResourceLimit(c *gin.Context) {
 // @Success 200 {array} dto.ContainerListStats
 // @Security ApiKeyAuth
 // @Security Timestamp
+// @Param ids query string false "Comma-separated container IDs; omitted selects all containers"
 // @Router /containers/list/stats [get]
 func (b *BaseApi) ContainerListStats(c *gin.Context) {
-	data, err := containerService.ContainerListStats()
+	var ids []string
+	if _, supplied := c.Request.URL.Query()["ids"]; supplied {
+		ids = strings.FieldsFunc(c.Query("ids"), func(r rune) bool { return r == ',' })
+	}
+	data, err := containerService.ContainerListStats(c.Request.Context(), ids)
 	if err != nil {
 		helper.InternalServer(c, err)
 		return

agent/app/api/v2/database_mysql.go

@@ -32,7 +32,6 @@ func (b *BaseApi) CreateMysql(c *gin.Context) {
 		}
 		req.Password = string(password)
 	}
-
 	if _, err := mysqlService.Create(context.Background(), req); err != nil {
 		helper.InternalServer(c, err)
 		return

agent/app/api/v2/helper/helper.go

@@ -3,6 +3,7 @@ package helper
 import (
 	"compress/gzip"
 	"context"
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"net/http"
@@ -11,6 +12,7 @@ import (
 	"sync"
 
 	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/utils/mcpapi"
 	"gorm.io/gorm"
 
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
@@ -21,6 +23,7 @@ import (
 )
 
 func ErrorWithDetail(ctx *gin.Context, code int, msgKey string, err error) {
+	mcpapi.SetBusinessErrorHeader(ctx.Request, ctx.Writer.Header(), err)
 	res := dto.Response{
 		Code:    code,
 		Message: "",
@@ -31,6 +34,7 @@ func ErrorWithDetail(ctx *gin.Context, code int, msgKey string, err error) {
 }
 
 func ErrorWithBusinessCode(ctx *gin.Context, code int, businessCode, msgKey string, err error) {
+	mcpapi.SetBusinessErrorHeader(ctx.Request, ctx.Writer.Header(), err)
 	res := dto.Response{
 		Code:      code,
 		ErrorCode: businessCode,
@@ -41,6 +45,7 @@ func ErrorWithBusinessCode(ctx *gin.Context, code int, businessCode, msgKey stri
 }
 
 func ErrorWithDetailAndData(ctx *gin.Context, code int, msgKey string, err error, data interface{}) {
+	mcpapi.SetBusinessErrorHeader(ctx.Request, ctx.Writer.Header(), err)
 	res := dto.Response{
 		Code: code,
 		Data: data,
@@ -184,3 +189,23 @@ func GetParamInt32(paramName string, c *gin.Context) (int32, error) {
 	intNum, _ := strconv.Atoi(idParam)
 	return int32(intNum), nil
 }
+
+// SetOperationLogValues supplies server-resolved values to Core's operation log.
+// Call before writing the response. Only pass public audit fields, never credentials.
+func SetOperationLogValues(c *gin.Context, values map[string]string) {
+	const header = "X-Op-Resolved"
+	resolved := make(map[string]string)
+	if data, err := base64.RawURLEncoding.DecodeString(c.Writer.Header().Get(header)); err == nil {
+		_ = json.Unmarshal(data, &resolved)
+	}
+	if resolved == nil {
+		resolved = make(map[string]string)
+	}
+	for key, value := range values {
+		resolved[key] = value
+	}
+	data, err := json.Marshal(resolved)
+	if err == nil {
+		c.Header(header, base64.RawURLEncoding.EncodeToString(data))
+	}
+}

agent/app/api/v2/mcp_business.go

@@ -0,0 +1,137 @@
+package v2
+
+import (
+	"encoding/base64"
+	"net/http"
+
+	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/app/service"
+	"github.com/1Panel-dev/1Panel/agent/utils/mcpapi"
+	"github.com/gin-gonic/gin"
+)
+
+type mcpBusinessAPI struct {
+	installApp func(request.AppInstallCreate, bool) (*model.AppInstall, error)
+}
+
+func MCPBusinessDispatch() gin.HandlerFunc {
+	return (&mcpBusinessAPI{installApp: (&service.AppService{}).InstallForMCP}).dispatch()
+}
+
+func (api *mcpBusinessAPI) dispatch() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var handler gin.HandlerFunc
+		switch c.Request.Method + " " + c.FullPath() {
+		case "POST /api/v2/databases":
+			handler = api.createMysql
+		case "POST /api/v2/databases/status":
+			handler = api.mysqlStatus
+		case "GET /api/v2/databases/db/list/:type":
+			handler = api.databases
+		case "POST /api/v2/apps/install":
+			handler = api.install
+		case "GET /api/v2/apps/installed/info/:appInstallId":
+			handler = api.appInfo
+		default:
+			c.Next()
+			return
+		}
+		present, trusted := mcpapi.Check(c.Request)
+		if !present {
+			c.Next()
+			return
+		}
+		if !trusted {
+			c.AbortWithStatus(http.StatusForbidden)
+			return
+		}
+		handler(c)
+		c.Abort()
+	}
+}
+
+func (api *mcpBusinessAPI) createMysql(c *gin.Context) {
+	var req dto.MysqlDBCreate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if len(req.Password) != 0 {
+		password, err := base64.StdEncoding.DecodeString(req.Password)
+		if err != nil {
+			helper.BadRequest(c, err)
+			return
+		}
+		req.Password = string(password)
+	}
+	created, err := (&service.MysqlService{}).CreateForMCP(c.Request.Context(), req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	nodeID, _ := mcpapi.NodeID(c.Request)
+	helper.SuccessWithData(c, map[string]any{"id": created.ID, "database": created.MysqlName, "name": created.Name, "nodeId": nodeID})
+}
+
+func (api *mcpBusinessAPI) mysqlStatus(c *gin.Context) {
+	var req dto.OperationWithNameAndType
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := (&service.MysqlService{}).LoadStatusForMCP(c.Request.Context(), req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+func (api *mcpBusinessAPI) databases(c *gin.Context) {
+	dbType, err := helper.GetStrParamByKey(c, "type")
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	list, err := (&service.DatabaseService{}).ListForMCP(c.Request.Context(), dbType)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, list)
+}
+
+func (api *mcpBusinessAPI) install(c *gin.Context) {
+	var req request.AppInstallCreate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if value, exists := req.Params["WEBSITE_DIR"]; exists {
+		directory, ok := value.(string)
+		if !ok || directory == "" || directory != settingService.GetWebsiteDir() {
+			c.AbortWithStatus(http.StatusForbidden)
+			return
+		}
+	}
+	installed, err := api.installApp(req, true)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, installed)
+}
+
+func (api *mcpBusinessAPI) appInfo(c *gin.Context) {
+	id, err := helper.GetIntParamByKey(c, "appInstallId")
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	info, err := (&service.AppInstallService{}).GetAppInstallInfoForMCP(c.Request.Context(), id)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, info)
+}

agent/app/api/v2/mcp_tasks.go

@@ -0,0 +1,29 @@
+package v2
+
+import (
+	"net"
+	"net/http"
+
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/utils/taskscope"
+	"github.com/gin-gonic/gin"
+)
+
+func PanelMCPTaskAccess() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if hasPanelMCPTaskAccess(c.Request) {
+			c.Request = c.Request.WithContext(taskscope.WithGrants(c.Request.Context(), constant.TaskScopePanelMCP))
+		}
+		c.Next()
+	}
+}
+
+func hasPanelMCPTaskAccess(req *http.Request) bool {
+	if !global.IsMaster {
+		return false
+	}
+	local, ok := req.Context().Value(http.LocalAddrContextKey).(net.Addr)
+	values := req.Header.Values("X-Panel-MCP-Task-Access")
+	return ok && local.Network() == "unix" && len(values) == 1 && values[0] == "1"
+}

agent/app/api/v2/quick_directory.go

@@ -0,0 +1,84 @@
+package v2
+
+import (
+	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/gin-gonic/gin"
+)
+
+// @Tags Dashboard
+// @Summary List quick directories
+// @Success 200 {array} model.QuickDirectory
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /dashboard/quick/directory [get]
+func (b *BaseApi) ListQuickDirectories(c *gin.Context) {
+	items, err := dashboardService.ListQuickDirectories()
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, items)
+}
+
+// @Tags Dashboard
+// @Summary Create quick directory
+// @Accept json
+// @Param request body dto.QuickDirectoryCreate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /dashboard/quick/directory [post]
+func (b *BaseApi) CreateQuickDirectory(c *gin.Context) {
+	var req dto.QuickDirectoryCreate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	item, err := dashboardService.CreateQuickDirectory(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, item)
+}
+
+// @Tags Dashboard
+// @Summary Update quick directory
+// @Accept json
+// @Param request body dto.QuickDirectoryUpdate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /dashboard/quick/directory/update [post]
+func (b *BaseApi) UpdateQuickDirectory(c *gin.Context) {
+	var req dto.QuickDirectoryUpdate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	item, err := dashboardService.UpdateQuickDirectory(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, item)
+}
+
+// @Tags Dashboard
+// @Summary Delete quick directory
+// @Accept json
+// @Param request body dto.QuickDirectoryDelete true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /dashboard/quick/directory/del [post]
+func (b *BaseApi) DeleteQuickDirectory(c *gin.Context) {
+	var req dto.QuickDirectoryDelete
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := dashboardService.DeleteQuickDirectory(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}

agent/app/api/v2/runtime.go

@@ -61,13 +61,14 @@ func (b *BaseApi) CreateRuntime(c *gin.Context) {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /runtimes/del [post]
-// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"删除运行环境 [id]","formatEN":"Delete runtime [id]"}
+// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"删除运行环境 [name]","formatEN":"Delete runtime [name]"}
 func (b *BaseApi) DeleteRuntime(c *gin.Context) {
 	var req request.RuntimeDelete
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	err := runtimeService.Delete(req)
+	name, err := runtimeService.Delete(req)
+	helper.SetOperationLogValues(c, map[string]string{"name": name})
 	if err != nil {
 		helper.InternalServer(c, err)
 		return

agent/app/api/v2/task.go

@@ -5,6 +5,8 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/response"
+	"github.com/1Panel-dev/1Panel/agent/app/service"
+	"github.com/1Panel-dev/1Panel/agent/utils/taskscope"
 	"github.com/gin-gonic/gin"
 )
 
@@ -21,7 +23,7 @@ func (b *BaseApi) PageTasks(c *gin.Context) {
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	total, list, err := taskService.Page(req)
+	total, list, err := taskServiceForRequest(c).Page(req)
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -45,7 +47,7 @@ func (b *BaseApi) ReadTaskLogByLine(c *gin.Context) {
 		return
 	}
 	var res *response.FileLineContent
-	res, err := taskService.ReadByLine(req)
+	res, err := taskServiceForRequest(c).ReadByLine(req)
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -64,10 +66,17 @@ func (b *BaseApi) ReadTaskLogByLine(c *gin.Context) {
 // @Security Timestamp
 // @Router /logs/tasks/executing/count [get]
 func (b *BaseApi) CountExecutingTasks(c *gin.Context) {
-	count, err := taskService.CountExecutingTask()
+	count, err := taskServiceForRequest(c).CountExecutingTask()
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
 	helper.SuccessWithData(c, count)
 }
+
+func taskServiceForRequest(c *gin.Context) service.ITaskLogService {
+	if granted := taskscope.Grants(c.Request.Context()); len(granted) != 0 {
+		return service.NewITaskService(granted...)
+	}
+	return taskService
+}

agent/app/api/v2/website.go

@@ -402,7 +402,7 @@ func (b *BaseApi) ChangeDefaultServer(c *gin.Context) {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /websites/php/version [post]
-// @x-panel-log {"bodyKeys":["websiteId"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"websiteId","isList":false,"db":"websites","output_column":"primary_domain","output_value":"domain"}],"formatZH":"php 版本变更 [domain]","formatEN":"php version update [domain]"}
+// @x-panel-log {"bodyKeys":["websiteID"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"websiteID","isList":false,"db":"websites","output_column":"primary_domain","output_value":"domain"}],"formatZH":"php 版本变更 [domain]","formatEN":"php version update [domain]"}
 func (b *BaseApi) ChangePHPVersion(c *gin.Context) {
 	var req request.WebsitePHPVersionReq
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {

agent/app/api/v2/website_ca.go

@@ -1,13 +1,16 @@
 package v2
 
 import (
+	"io"
 	"net/http"
 	"net/url"
 	"strconv"
+	"strings"
 
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
 	"github.com/gin-gonic/gin"
 )
 
@@ -176,3 +179,64 @@ func (b *BaseApi) DownloadCAFile(c *gin.Context) {
 	c.Header("Content-Disposition", "attachment; filename*=utf-8''"+url.PathEscape(info.Name()))
 	http.ServeContent(c.Writer, c.Request, info.Name(), info.ModTime(), file)
 }
+
+// @Tags Website CA
+// @Summary Upload website CA archive
+// @Accept multipart/form-data
+// @Param file formData file true "ZIP containing ca.crt and ca.key"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/ca/upload [post]
+func (b *BaseApi) UploadWebsiteCA(c *gin.Context) {
+	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, 11<<20)
+	if err := c.Request.ParseMultipartForm(11 << 20); err != nil {
+		helper.InternalServer(c, buserr.New("ErrCAUpload"))
+		return
+	}
+	if c.Request.MultipartForm != nil {
+		defer c.Request.MultipartForm.RemoveAll()
+	}
+	file, err := c.FormFile("file")
+	if err != nil || file.Size > 10<<20 || !strings.HasSuffix(strings.ToLower(file.Filename), ".zip") {
+		helper.InternalServer(c, buserr.New("ErrCAUpload"))
+		return
+	}
+	stream, err := file.Open()
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	defer stream.Close()
+	data, err := io.ReadAll(io.LimitReader(stream, (10<<20)+1))
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	if err = websiteCAService.Upload(file.Filename[:len(file.Filename)-len(".zip")], data); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Website CA
+// @Summary Import website CA from PEM or server files
+// @Accept json
+// @Param request body request.WebsiteCAImport true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/ca/import [post]
+func (b *BaseApi) ImportWebsiteCA(c *gin.Context) {
+	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, 3<<20)
+	var req request.WebsiteCAImport
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := websiteCAService.Import(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}

agent/app/dto/agents.go

@@ -9,7 +9,8 @@ type AgentCreateReq struct {
 	WebUIPort         int      `json:"webUIPort" validate:"required,min=1,max=65535"`
 	BridgePort        int      `json:"bridgePort"`
 	AllowedOrigins    []string `json:"allowedOrigins"`
-	AgentType         string   `json:"agentType" validate:"required,oneof=openclaw copaw hermes-agent"`
+	AgentType         string   `json:"agentType" validate:"required,oneof=openclaw copaw hermes-agent deepseek-harness octop"`
+	AccessHost        string   `json:"accessHost"`
 	Model             string   `json:"model"`
 	AccountID         uint     `json:"accountId"`
 	Token             string   `json:"token"`
@@ -110,6 +111,7 @@ type AgentBatchOperateResult struct {
 }
 
 type AgentItem struct {
+	AccessHost           string    `json:"accessHost"`
 	ID                   uint      `json:"id"`
 	Name                 string    `json:"name"`
 	Remark               string    `json:"remark"`
@@ -384,6 +386,7 @@ type AgentAccountProviderCountReq struct {
 }
 
 type AgentAccountInfo struct {
+	AppInstallID    uint                `json:"appInstallId"`
 	ID              uint                `json:"id"`
 	MasterAccountID uint                `json:"masterAccountId"`
 	Provider        string              `json:"provider"`
@@ -430,32 +433,53 @@ type AgentFeishuConfigReq struct {
 	AgentID uint `json:"agentId" validate:"required"`
 }
 
+type AgentFeishuTransition struct {
+	Confirmed         bool   `json:"confirmed"`
+	Streaming         bool   `json:"streaming"`
+	GroupSessionScope string `json:"groupSessionScope"`
+	RequireMention    string `json:"requireMention"`
+}
+
+type AgentFeishuSwitchReq struct {
+	AgentID           uint   `json:"agentId" validate:"required"`
+	TaskID            string `json:"taskID" validate:"required"`
+	Streaming         bool   `json:"streaming"`
+	GroupSessionScope string `json:"groupSessionScope" validate:"required,oneof=group group_sender group_topic group_topic_sender"`
+	RequireMention    string `json:"requireMention" validate:"required,oneof=true false"`
+}
+
 type AgentFeishuConfigUpdateReq struct {
-	AgentID        uint             `json:"agentId" validate:"required"`
-	Enabled        bool             `json:"enabled"`
-	ThreadSession  bool             `json:"threadSession"`
-	ReplyMode      string           `json:"replyMode" validate:"required"`
-	Streaming      bool             `json:"streaming"`
-	RequireMention string           `json:"requireMention" validate:"required,oneof=true false open"`
-	GroupPolicy    string           `json:"groupPolicy" validate:"required,oneof=open allowlist disabled"`
-	GroupAllowFrom []string         `json:"groupAllowFrom"`
-	Domain         string           `json:"domain"`
-	ConnectionMode string           `json:"connectionMode"`
-	Bots           []AgentFeishuBot `json:"bots" validate:"required,min=1"`
+	GroupSessionScope string           `json:"groupSessionScope" validate:"omitempty,oneof=group group_sender group_topic group_topic_sender"`
+	AgentID           uint             `json:"agentId" validate:"required"`
+	Enabled           bool             `json:"enabled"`
+	ThreadSession     bool             `json:"threadSession"`
+	ReplyMode         string           `json:"replyMode" validate:"required"`
+	Streaming         bool             `json:"streaming"`
+	RequireMention    string           `json:"requireMention" validate:"required,oneof=true false open"`
+	GroupPolicy       string           `json:"groupPolicy" validate:"required,oneof=open allowlist disabled"`
+	GroupAllowFrom    []string         `json:"groupAllowFrom"`
+	Domain            string           `json:"domain"`
+	ConnectionMode    string           `json:"connectionMode"`
+	Bots              []AgentFeishuBot `json:"bots" validate:"required,min=1"`
 }
 
 type AgentFeishuConfig struct {
-	Enabled        bool             `json:"enabled"`
-	ThreadSession  bool             `json:"threadSession"`
-	ReplyMode      string           `json:"replyMode"`
-	Streaming      bool             `json:"streaming"`
-	RequireMention string           `json:"requireMention"`
-	GroupPolicy    string           `json:"groupPolicy"`
-	GroupAllowFrom []string         `json:"groupAllowFrom"`
-	Domain         string           `json:"domain"`
-	ConnectionMode string           `json:"connectionMode"`
-	Bots           []AgentFeishuBot `json:"bots"`
-	Installed      bool             `json:"installed"`
+	BuiltinManaged    bool             `json:"builtinManaged"`
+	LegacyConfigured  bool             `json:"legacyConfigured"`
+	GroupSessionScope string           `json:"groupSessionScope"`
+	BuiltinAvailable  bool             `json:"builtinAvailable"`
+	Legacy            bool             `json:"legacy"`
+	Enabled           bool             `json:"enabled"`
+	ThreadSession     bool             `json:"threadSession"`
+	ReplyMode         string           `json:"replyMode"`
+	Streaming         bool             `json:"streaming"`
+	RequireMention    string           `json:"requireMention"`
+	GroupPolicy       string           `json:"groupPolicy"`
+	GroupAllowFrom    []string         `json:"groupAllowFrom"`
+	Domain            string           `json:"domain"`
+	ConnectionMode    string           `json:"connectionMode"`
+	Bots              []AgentFeishuBot `json:"bots"`
+	Installed         bool             `json:"installed"`
 }
 
 type AgentTelegramConfigReq struct {

agent/app/dto/ai.go

@@ -14,16 +14,17 @@ type OllamaModelInfo struct {
 	CreatedAt time.Time `json:"createdAt"`
 }
 
-type OllamaModelDropList struct {
-	ID   uint   `json:"id"`
-	Name string `json:"name"`
-}
-
 type OllamaModelName struct {
 	Name   string `json:"name"`
 	TaskID string `json:"taskID"`
 }
 
+type OllamaModelAccountSync struct {
+	ID                      uint   `json:"id" validate:"required"`
+	ModelAccountBaseURLType string `json:"modelAccountBaseURLType" validate:"required,oneof=container localhost systemIP custom"`
+	ModelAccountBaseURL     string `json:"modelAccountBaseURL"`
+}
+
 type OllamaBindDomain struct {
 	Domain       string `json:"domain" validate:"required"`
 	AppInstallID uint   `json:"appInstallID" validate:"required"`

agent/app/dto/ai_benchmark.go

@@ -0,0 +1,13 @@
+package dto
+
+type AIBenchmarkSource struct {
+	ID        string   `json:"id"`
+	Kind      string   `json:"kind"`
+	Name      string   `json:"name"`
+	Status    string   `json:"status"`
+	BaseURL   string   `json:"baseUrl"`
+	Endpoint  string   `json:"endpoint"`
+	Models    []string `json:"models"`
+	Tokenizer string   `json:"tokenizer"`
+	Message   string   `json:"message"`
+}

agent/app/dto/app.go

@@ -43,9 +43,11 @@ type AppOssConfig struct {
 }
 
 type AppVersion struct {
-	Version       string `json:"version"`
-	DetailId      uint   `json:"detailId"`
-	DockerCompose string `json:"dockerCompose"`
+	FeishuLegacy     bool   `json:"feishuLegacy,omitempty"`
+	FeishuConfigured bool   `json:"feishuConfigured,omitempty"`
+	Version          string `json:"version"`
+	DetailId         uint   `json:"detailId"`
+	DockerCompose    string `json:"dockerCompose"`
 }
 
 type AppList struct {

agent/app/dto/container.go

@@ -171,7 +171,8 @@ type ContainerItemStats struct {
 	BuildCacheReclaimable int64 `json:"buildCacheReclaimable"`
 }
 type ContainerListStats struct {
-	ContainerID string `json:"containerID"`
+	ContainerID   string `json:"containerID"`
+	ContainerName string `json:"containerName"`
 
 	CPUTotalUsage uint64  `json:"cpuTotalUsage"`
 	SystemUsage   uint64  `json:"systemUsage"`

agent/app/dto/dashboard.go

@@ -31,7 +31,27 @@ type DashboardBase struct {
 }
 
 type ChangeQuicks struct {
-	Quicks []QuickJump `json:"quicks"`
+	Quicks []QuickVisibility `json:"quicks" validate:"required,dive"`
+}
+
+type QuickVisibility struct {
+	ID     uint `json:"id" validate:"required"`
+	IsShow bool `json:"isShow"`
+}
+
+type QuickDirectoryCreate struct {
+	Path  string `json:"path" validate:"required"`
+	Alias string `json:"alias"`
+}
+
+type QuickDirectoryDelete struct {
+	ID     uint `json:"id" validate:"required"`
+	Legacy bool `json:"legacy"`
+}
+
+type QuickDirectoryUpdate struct {
+	QuickDirectoryDelete
+	QuickDirectoryCreate
 }
 
 type QuickJump struct {

agent/app/dto/firewall.go

@@ -26,6 +26,7 @@ type FirewallSubsystemStatus struct {
 }
 
 type FirewallLifecycleOperation struct {
+	BackupFile        string `json:"backupFile,omitempty" validate:"omitempty,max=255"`
 	Operation         string `json:"operation" validate:"required,oneof=start stop restart disableBanPing enableBanPing"`
 	WithDockerRestart bool   `json:"withDockerRestart"`
 }

agent/app/dto/monitor.go

@@ -1,6 +1,7 @@
 package dto
 
 import (
+	"encoding/json"
 	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/app/model"
@@ -144,6 +145,11 @@ type MonitorVLLMCurrent struct {
 	AppInstallID uint `json:"appInstallID" validate:"required"`
 }
 
+type MonitorVLLMCurrentData struct {
+	model.MonitorVLLM
+	Metrics map[string]json.RawMessage `json:"metrics,omitempty"`
+}
+
 type MonitorVLLMClean struct {
 	AppInstallID uint `json:"appInstallID" validate:"required"`
 }

agent/app/dto/request/app.go

@@ -23,6 +23,10 @@ type AppInstallCreate struct {
 	Services    map[string]string      `json:"services"`
 	TaskID      string                 `json:"taskID"`
 
+	SyncModelAccount        *bool  `json:"syncModelAccount"`
+	ModelAccountBaseURLType string `json:"modelAccountBaseURLType" validate:"omitempty,oneof=container localhost systemIP custom"`
+	ModelAccountBaseURL     string `json:"modelAccountBaseURL"`
+
 	AppContainerConfig
 	NodePushConfig
 }
@@ -83,31 +87,33 @@ type AppBackupDelete struct {
 }
 
 type AppInstalledOperate struct {
-	InstallId     uint                `json:"installId" validate:"required"`
-	BackupId      uint                `json:"backupId"`
-	DetailId      uint                `json:"detailId"`
-	Operate       constant.AppOperate `json:"operate" validate:"required"`
-	ForceDelete   bool                `json:"forceDelete"`
-	DeleteBackup  bool                `json:"deleteBackup"`
-	DeleteDB      bool                `json:"deleteDB"`
-	Backup        bool                `json:"backup"`
-	PullImage     bool                `json:"pullImage"`
-	DockerCompose string              `json:"dockerCompose"`
-	TaskID        string              `json:"taskID"`
-	DeleteImage   bool                `json:"deleteImage"`
-	Favorite      bool                `json:"favorite"`
+	FeishuTransition *dto.AgentFeishuTransition `json:"feishuTransition,omitempty"`
+	InstallId        uint                       `json:"installId" validate:"required"`
+	BackupId         uint                       `json:"backupId"`
+	DetailId         uint                       `json:"detailId"`
+	Operate          constant.AppOperate        `json:"operate" validate:"required"`
+	ForceDelete      bool                       `json:"forceDelete"`
+	DeleteBackup     bool                       `json:"deleteBackup"`
+	DeleteDB         bool                       `json:"deleteDB"`
+	Backup           bool                       `json:"backup"`
+	PullImage        bool                       `json:"pullImage"`
+	DockerCompose    string                     `json:"dockerCompose"`
+	TaskID           string                     `json:"taskID"`
+	DeleteImage      bool                       `json:"deleteImage"`
+	Favorite         bool                       `json:"favorite"`
 
 	UseLifecycleScripts bool `json:"-"`
 }
 
 type AppInstallUpgrade struct {
-	InstallID     uint   `json:"installId"`
-	DetailID      uint   `json:"detailId"`
-	Backup        bool   `json:"backup"`
-	PullImage     bool   `json:"pullImage"`
-	DeleteImage   bool   `json:"deleteImage"`
-	DockerCompose string `json:"dockerCompose"`
-	TaskID        string `json:"taskID"`
+	FeishuTransition *dto.AgentFeishuTransition `json:"feishuTransition,omitempty"`
+	InstallID        uint                       `json:"installId"`
+	DetailID         uint                       `json:"detailId"`
+	Backup           bool                       `json:"backup"`
+	PullImage        bool                       `json:"pullImage"`
+	DeleteImage      bool                       `json:"deleteImage"`
+	DockerCompose    string                     `json:"dockerCompose"`
+	TaskID           string                     `json:"taskID"`
 }
 
 type AppInstallDelete struct {
@@ -122,9 +128,12 @@ type AppInstallDelete struct {
 }
 
 type AppInstalledUpdate struct {
-	InstallId uint                   `json:"installId" validate:"required"`
-	Params    map[string]interface{} `json:"params" validate:"required"`
-	TaskID    string                 `json:"-"`
+	SyncModelAccount        *bool                  `json:"syncModelAccount"`
+	ModelAccountBaseURLType string                 `json:"modelAccountBaseURLType" validate:"omitempty,oneof=container localhost systemIP custom"`
+	ModelAccountBaseURL     string                 `json:"modelAccountBaseURL"`
+	InstallId               uint                   `json:"installId" validate:"required"`
+	Params                  map[string]interface{} `json:"params" validate:"required"`
+	TaskID                  string                 `json:"-"`
 	AppContainerConfig
 }
 

agent/app/dto/request/mcp_website.go

@@ -0,0 +1,14 @@
+package request
+
+type MCPWebsiteBinding struct {
+	Operation string `json:"operation"`
+	RequestID string `json:"requestId"`
+	BindingID string `json:"bindingId"`
+	WebsiteID uint   `json:"websiteId"`
+	Domain    string `json:"domain"`
+	EnableSSL bool   `json:"enableSSL"`
+	SSLID     uint   `json:"sslID"`
+	Upstream  string `json:"upstream"`
+	CoreHost  string `json:"coreHost"`
+	ProxyKey  string `json:"proxyKey"`
+}

agent/app/dto/request/website_ssl.go

@@ -182,3 +182,12 @@ type WebsiteSSLFileUpload struct {
 	PushNode    bool   `json:"pushNode"`
 	Nodes       string `json:"nodes"`
 }
+
+type WebsiteCAImport struct {
+	Name            string `json:"name" validate:"required,max=128"`
+	Type            string `json:"type" validate:"required,oneof=paste local"`
+	Certificate     string `json:"certificate" validate:"required_if=Type paste"`
+	PrivateKey      string `json:"privateKey" validate:"required_if=Type paste"`
+	CertificatePath string `json:"certificatePath" validate:"required_if=Type local"`
+	PrivateKeyPath  string `json:"privateKeyPath" validate:"required_if=Type local"`
+}

agent/app/dto/response/app.go

@@ -50,19 +50,21 @@ type TagDTO struct {
 }
 
 type AppInstalledCheck struct {
-	IsExist       bool      `json:"isExist"`
-	Name          string    `json:"name"`
-	App           string    `json:"app"`
-	Version       string    `json:"version"`
-	Status        string    `json:"status"`
-	CreatedAt     time.Time `json:"createdAt"`
-	LastBackupAt  string    `json:"lastBackupAt"`
-	AppInstallID  uint      `json:"appInstallId"`
-	ContainerName string    `json:"containerName"`
-	InstallPath   string    `json:"installPath"`
-	HttpPort      int       `json:"httpPort"`
-	HttpsPort     int       `json:"httpsPort"`
-	WebsiteDir    string    `json:"websiteDir"`
+	ModelAccountBaseURLType string    `json:"modelAccountBaseURLType"`
+	ModelAccountBaseURL     string    `json:"modelAccountBaseURL"`
+	IsExist                 bool      `json:"isExist"`
+	Name                    string    `json:"name"`
+	App                     string    `json:"app"`
+	Version                 string    `json:"version"`
+	Status                  string    `json:"status"`
+	CreatedAt               time.Time `json:"createdAt"`
+	LastBackupAt            string    `json:"lastBackupAt"`
+	AppInstallID            uint      `json:"appInstallId"`
+	ContainerName           string    `json:"containerName"`
+	InstallPath             string    `json:"installPath"`
+	HttpPort                int       `json:"httpPort"`
+	HttpsPort               int       `json:"httpsPort"`
+	WebsiteDir              string    `json:"websiteDir"`
 }
 
 type AppDetailDTO struct {
@@ -184,7 +186,13 @@ type AppParam struct {
 }
 
 type AppConfig struct {
-	Params     []AppParam `json:"params"`
-	RawCompose string     `json:"rawCompose"`
+	AppKey                  string     `json:"appKey"`
+	Name                    string     `json:"name"`
+	HttpPort                int        `json:"httpPort"`
+	SyncModelAccount        bool       `json:"syncModelAccount"`
+	ModelAccountBaseURLType string     `json:"modelAccountBaseURLType"`
+	ModelAccountBaseURL     string     `json:"modelAccountBaseURL"`
+	Params                  []AppParam `json:"params"`
+	RawCompose              string     `json:"rawCompose"`
 	request.AppContainerConfig
 }

agent/app/dto/response/mcp_website.go

@@ -0,0 +1,17 @@
+package response
+
+type MCPWebsiteBinding struct {
+	State         string `json:"state"`
+	WebsiteID     uint   `json:"websiteId"`
+	BindingID     string `json:"bindingId"`
+	RequestID     string `json:"requestId"`
+	Domain        string `json:"domain"`
+	Endpoint      string `json:"endpoint"`
+	EnableSSL     bool   `json:"enableSSL"`
+	SSLID         uint   `json:"sslID"`
+	WebsiteStatus string `json:"websiteStatus"`
+	Reason        string `json:"reason"`
+	Code          string `json:"code,omitempty"`
+	Error         string `json:"error,omitempty"`
+	Definitive    bool   `json:"definitive,omitempty"`
+}

agent/app/model/agent_account.go

@@ -2,6 +2,7 @@ package model
 
 type AgentAccount struct {
 	BaseModel
+	AppInstallID    uint   `json:"appInstallId"`
 	Provider        string `json:"provider"`
 	Name            string `json:"name"`
 	APIKey          string `json:"apiKey"`

agent/app/model/app_install.go

@@ -28,6 +28,10 @@ type AppInstall struct {
 	Favorite      bool   `json:"favorite"`
 	SortOrder     int    `json:"sortOrder" gorm:"default:0"`
 
+	SyncModelAccount        bool   `json:"syncModelAccount"`
+	ModelAccountBaseURLType string `json:"modelAccountBaseURLType"`
+	ModelAccountBaseURL     string `json:"modelAccountBaseURL"`
+
 	App App `json:"app" gorm:"-:migration"`
 }
 

agent/app/model/app_launcher.go

@@ -5,6 +5,13 @@ type AppLauncher struct {
 	Key string `json:"key"`
 }
 
+type QuickDirectory struct {
+	BaseModel
+	Path   string `json:"path"`
+	Alias  string `json:"alias"`
+	Legacy bool   `json:"legacy" gorm:"-"`
+}
+
 type QuickJump struct {
 	BaseModel
 	Name      string `json:"name"`

agent/app/model/monitor.go

@@ -86,7 +86,9 @@ type MonitorVLLM struct {
 	RawMetrics              string             `json:"-"`
 	HistogramDeltas         string             `json:"-"`
 	IntervalSeconds         float64            `json:"intervalSeconds" gorm:"-"`
+	SampleIntervalSeconds   int                `json:"-"`
 	RequestDeltas           string             `json:"-"`
+	CompletedRequests       *float64           `json:"completedRequests" gorm:"-"`
 	QueueTime               *float64           `json:"queueTime"`
 	AverageGenerationTokens *float64           `json:"averageGenerationTokens"`
 	PrefixCacheHitRate      *float64           `json:"prefixCacheHitRate"`

agent/app/provider/catalog.go

@@ -66,7 +66,7 @@ var catalog = map[string]Meta{
 			{APIType: "openai-responses", BaseURL: "https://api.deepseek.com"},
 			anthropicAPIConfig("https://api.deepseek.com/anthropic", AuthModeXAPIKey),
 		},
-		Models: []Model{{ID: "deepseek-v4-flash", Name: "deepseek-v4-flash"}, {ID: "deepseek-v4-pro", Name: "deepseek-v4-pro"}},
+		Models: []Model{{ID: "deepseek-flash", Name: "deepseek-flash"}, {ID: "deepseek-v4-pro", Name: "deepseek-v4-pro"}},
 	},
 	"bailian-coding-plan": {
 		Key: "bailian-coding-plan", DisplayNameKey: "AIProviderBailianCodingPlan", Sort: 30, DefaultAPIType: "openai-completions", EnvKey: "QWEN_API_KEY",
@@ -82,7 +82,6 @@ var catalog = map[string]Meta{
 			{ID: "kimi-k2.5", Name: "Kimi K2.5"},
 			{ID: "qwen3.5-plus", Name: "Qwen3.5-Plus"},
 			{ID: "glm-5", Name: "GLM-5"},
-			{ID: "MiniMax-M2.5", Name: "MiniMax M2.5"},
 			{ID: "qwen3.6-plus", Name: "Qwen3.6-Plus"},
 			{ID: "qwen3.7-plus", Name: "Qwen3.7-Plus"},
 		},
@@ -114,7 +113,7 @@ var catalog = map[string]Meta{
 			{APIType: "openai-completions", BaseURL: "https://api.minimaxi.com/v1"},
 			{APIType: "minimax-images", BaseURL: "https://api.minimaxi.com"},
 		},
-		Models: []Model{{ID: "MiniMax-M3", Name: "MiniMax M3"}, {ID: "MiniMax-M2.7", Name: "MiniMax M2.7"}, {ID: "MiniMax-M2.7-highspeed", Name: "MiniMax M2.7 highspeed"}},
+		Models: []Model{{ID: "MiniMax-M3.1-Flash", Name: "MiniMax M3.1 Flash"}, {ID: "MiniMax-M3", Name: "MiniMax M3"}},
 	},
 	"xiaomi": {
 		Key: "xiaomi", DisplayName: "Xiaomi", Sort: 46, DefaultAPIType: "openai-completions", EnvKey: "XIAOMI_API_KEY",

agent/app/provider/minimax_test.go

@@ -0,0 +1,100 @@
+package provider
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"reflect"
+	"strings"
+	"testing"
+)
+
+func TestMiniMaxCatalog(t *testing.T) {
+	meta, ok := Get("minimax")
+	if !ok || !reflect.DeepEqual(meta.Models, []Model{{ID: "MiniMax-M3.1-Flash", Name: "MiniMax M3.1 Flash"}, {ID: "MiniMax-M3", Name: "MiniMax M3"}}) {
+		t.Fatalf("unexpected MiniMax models: %+v", meta.Models)
+	}
+	if meta.DefaultAPIType != "anthropic-messages" {
+		t.Fatalf("changed default protocol: %s", meta.DefaultAPIType)
+	}
+	for _, provider := range All() {
+		for _, model := range provider.Models {
+			if strings.Contains(strings.ToLower(model.ID), "minimax") && model.ID != "MiniMax-M3.1-Flash" && model.ID != "MiniMax-M3" {
+				t.Errorf("legacy suggestion in %s: %s", provider.Key, model.ID)
+			}
+		}
+	}
+}
+
+func TestMiniMaxVerificationRequests(t *testing.T) {
+	for _, region := range []string{"https://api.minimaxi.com", "https://api.minimax.io"} {
+		for _, protocol := range []string{"anthropic-messages", "openai-completions"} {
+			for _, auth := range []string{AuthModeXAPIKey, AuthModeBearer} {
+				for _, model := range []string{"MiniMax-M3.1-Flash", "MiniMax-M3", "MiniMax-M2.7", "MiniMax-M2.7-highspeed", "custom-model"} {
+					t.Run(region+"/"+protocol+"/"+auth+"/"+model, func(t *testing.T) {
+						base, endpoint := region+"/v1", "/chat/completions"
+						if protocol == "anthropic-messages" {
+							base, endpoint = region+"/anthropic", "/v1/messages"
+						}
+						built := BuildVerifyRequest("minimax", protocol, auth, base, "test-key", model)
+						if built.URL != base+endpoint {
+							t.Fatalf("URL = %s", built.URL)
+						}
+						var captured map[string]interface{}
+						server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+							if r.Method != http.MethodPost || r.URL.Path != strings.TrimPrefix(base, region)+endpoint {
+								t.Errorf("unexpected request: %s %s", r.Method, r.URL.Path)
+							}
+							if protocol == "anthropic-messages" && auth == AuthModeXAPIKey {
+								if r.Header.Get("x-api-key") != "test-key" || r.Header.Get("Authorization") != "" {
+									t.Error("incorrect API key authentication")
+								}
+							} else if r.Header.Get("Authorization") != "Bearer test-key" {
+								t.Error("incorrect bearer authentication")
+							}
+							if err := json.NewDecoder(r.Body).Decode(&captured); err != nil {
+								t.Error(err)
+							}
+							w.WriteHeader(http.StatusOK)
+						}))
+						defer server.Close()
+						if err := VerifyAccount("minimax", protocol, auth, server.URL+strings.TrimPrefix(base, region), "test-key", model); err != nil {
+							t.Fatal(err)
+						}
+						if captured["model"] != model || captured["stream"] != false || captured["max_tokens"] != float64(defaultVerifyMaxTokens) {
+							t.Fatalf("unexpected serialized body: %#v", captured)
+						}
+						if model == "MiniMax-M3.1-Flash" {
+							if protocol == "anthropic-messages" {
+								if !reflect.DeepEqual(captured["thinking"], map[string]interface{}{"type": "adaptive"}) || !reflect.DeepEqual(captured["output_config"], map[string]interface{}{"effort": "max"}) || captured["reasoning_effort"] != nil {
+									t.Fatalf("invalid Anthropic Flash reasoning: %#v", captured)
+								}
+							} else if captured["reasoning_effort"] != "max" || captured["thinking"] != nil || captured["output_config"] != nil {
+								t.Fatalf("invalid OpenAI Flash reasoning: %#v", captured)
+							}
+						} else if captured["reasoning_effort"] != nil || captured["thinking"] != nil || captured["output_config"] != nil {
+							t.Fatalf("changed legacy/custom reasoning: %#v", captured)
+						}
+					})
+				}
+			}
+		}
+	}
+}
+
+func TestMiniMaxExplicitGatewayAndCustomModels(t *testing.T) {
+	for _, provider := range []string{"bailian-coding-plan", "custom", "openrouter"} {
+		for _, protocol := range []string{"openai-completions", "anthropic-messages"} {
+			for _, model := range []string{"MiniMax-M2.5", "MiniMax-M3.1-Flash", "my-custom-model"} {
+				request := BuildVerifyRequest(provider, protocol, AuthModeBearer, "https://example.test/v1", "test-key", model)
+				var body map[string]interface{}
+				if err := json.Unmarshal(request.Body, &body); err != nil {
+					t.Fatal(err)
+				}
+				if body["model"] != model || body["reasoning_effort"] != nil || body["output_config"] != nil || body["thinking"] != nil {
+					t.Fatalf("changed explicit %s request: %#v", provider, body)
+				}
+			}
+		}
+	}
+}

agent/app/provider/verify.go

@@ -118,10 +118,15 @@ func BuildVerifyRequest(provider, apiType, authMode, baseURL, apiKey, model stri
 			headers["x-api-key"] = apiKey
 		}
 		headers["anthropic-version"] = "2023-06-01"
-		request.Body = mustJSON(map[string]interface{}{
+		body := map[string]interface{}{
 			"model": model, "max_tokens": defaultVerifyMaxTokens, "stream": false,
 			"messages": []map[string]interface{}{{"role": "user", "content": []map[string]string{{"type": "text", "text": "test"}}}},
-		})
+		}
+		if provider == "minimax" && model == "MiniMax-M3.1-Flash" {
+			body["thinking"] = map[string]string{"type": "adaptive"}
+			body["output_config"] = map[string]string{"effort": "max"}
+		}
+		request.Body = mustJSON(body)
 	case "openai-responses":
 		request.URL = baseURL + "/responses"
 		headers["Authorization"] = "Bearer " + apiKey
@@ -131,9 +136,13 @@ func BuildVerifyRequest(provider, apiType, authMode, baseURL, apiKey, model stri
 		if (provider != "ollama" && provider != "llmman") || strings.TrimSpace(apiKey) != "" {
 			headers["Authorization"] = "Bearer " + apiKey
 		}
-		request.Body = mustJSON(map[string]interface{}{
+		body := map[string]interface{}{
 			"model": model, "messages": []map[string]string{{"role": "user", "content": "test"}}, "max_tokens": defaultVerifyMaxTokens, "stream": false,
-		})
+		}
+		if provider == "minimax" && model == "MiniMax-M3.1-Flash" {
+			body["reasoning_effort"] = "max"
+		}
+		request.Body = mustJSON(body)
 	}
 	return request
 }

agent/app/repo/agent_account.go

@@ -4,6 +4,7 @@ import (
 	"strings"
 
 	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/global"
 	"gorm.io/gorm"
 )
 
@@ -18,6 +19,7 @@ type IAgentAccountRepo interface {
 	DeleteByID(id uint) error
 	List(opts ...DBOption) ([]model.AgentAccount, error)
 	CountTextByProviders(providers []string) (map[string]int64, error)
+	SaveLocal(account *model.AgentAccount, models []model.AgentAccountModel) error
 }
 
 func NewIAgentAccountRepo() IAgentAccountRepo {
@@ -97,6 +99,25 @@ func (a AgentAccountRepo) CountTextByProviders(providers []string) (map[string]i
 	return counts, nil
 }
 
+func (a AgentAccountRepo) SaveLocal(account *model.AgentAccount, models []model.AgentAccountModel) error {
+	return global.DB.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Save(account).Error; err != nil {
+			return err
+		}
+		if err := tx.Where("account_id = ?", account.ID).Delete(&model.AgentAccountModel{}).Error; err != nil {
+			return err
+		}
+		if len(models) == 0 {
+			return nil
+		}
+		for i := range models {
+			models[i].AccountID = account.ID
+			models[i].SortOrder = i + 1
+		}
+		return tx.Create(&models).Error
+	})
+}
+
 func normalizeProviders(providers []string) []string {
 	seen := make(map[string]struct{}, len(providers))
 	result := make([]string, 0, len(providers))

agent/app/repo/ai.go

@@ -1,6 +1,8 @@
 package repo
 
 import (
+	"context"
+
 	"github.com/1Panel-dev/1Panel/agent/app/model"
 	"github.com/1Panel-dev/1Panel/agent/global"
 )
@@ -14,6 +16,7 @@ type IAiRepo interface {
 	Create(cronjob *model.OllamaModel) error
 	Update(id uint, vars map[string]interface{}) error
 	Delete(opts ...DBOption) error
+	DeleteAll(ctx context.Context) error
 }
 
 func NewIAiRepo() IAiRepo {
@@ -67,3 +70,7 @@ func (u *AiRepo) Delete(opts ...DBOption) error {
 	}
 	return db.Delete(&model.OllamaModel{}).Error
 }
+
+func (u *AiRepo) DeleteAll(ctx context.Context) error {
+	return getTx(ctx).Where("1 = 1").Delete(&model.OllamaModel{}).Error
+}

agent/app/repo/app_install.go

@@ -38,6 +38,7 @@ type IAppInstallRepo interface {
 	LoadBaseInfo(key string, name string) (*RootInfo, error)
 	LoadInstallAppByKeyAndName(key string, name string) (*model.AppInstall, error)
 	GetFirstByCtx(ctx context.Context, opts ...DBOption) (model.AppInstall, error)
+	GetSnapshot(ctx context.Context, id uint) (model.AppInstall, error)
 }
 
 func NewIAppInstallRepo() IAppInstallRepo {
@@ -131,6 +132,12 @@ func (a *AppInstallRepo) GetFirstByCtx(ctx context.Context, opts ...DBOption) (m
 	return install, err
 }
 
+func (a *AppInstallRepo) GetSnapshot(ctx context.Context, id uint) (model.AppInstall, error) {
+	var install model.AppInstall
+	err := getTx(ctx).WithContext(ctx).Preload("App").Where("id = ?", id).First(&install).Error
+	return install, err
+}
+
 func (a *AppInstallRepo) Create(ctx context.Context, install *model.AppInstall) error {
 	db := getTx(ctx).Model(&model.AppInstall{})
 	return db.Omit(clause.Associations).Create(&install).Error

agent/app/repo/app_launcher.go

@@ -3,6 +3,7 @@ package repo
 import (
 	"github.com/1Panel-dev/1Panel/agent/app/model"
 	"github.com/1Panel-dev/1Panel/agent/global"
+	"gorm.io/gorm"
 )
 
 type LauncherRepo struct{}
@@ -17,6 +18,11 @@ type ILauncherRepo interface {
 	GetQuickJump(opts ...DBOption) (model.QuickJump, error)
 	ListQuickJump(withAll bool) []model.QuickJump
 	UpdateQuicks(quicks []model.QuickJump) error
+	ListQuickDirectories() ([]model.QuickDirectory, error)
+	CountQuickDirectories() (int64, error)
+	CreateQuickDirectory(item *model.QuickDirectory) error
+	UpdateQuickDirectory(item *model.QuickDirectory) error
+	DeleteQuickDirectory(id uint, legacy bool) error
 }
 
 func NewILauncherRepo() ILauncherRepo {
@@ -95,13 +101,73 @@ func (u *LauncherRepo) UpdateQuicks(quicks []model.QuickJump) error {
 	for _, item := range quicks {
 		if err := tx.Model(&model.QuickJump{}).Where("id = ?", item.ID).Updates(map[string]interface{}{
 			"is_show": item.IsShow,
-			"detail":  item.Detail,
-			"alias":   item.Alias,
 		}).Error; err != nil {
 			tx.Rollback()
 			return err
 		}
 	}
-	tx.Commit()
+	return tx.Commit().Error
+}
+
+// Legacy entries remain in the overview configuration until explicitly deleted.
+func legacyQuickDirectories(db *gorm.DB) *gorm.DB {
+	return db.Model(&model.QuickJump{}).Where("name = ? AND is_show = ? AND detail <> ?", "File", true, "")
+}
+
+func (u *LauncherRepo) ListQuickDirectories() ([]model.QuickDirectory, error) {
+	items := make([]model.QuickDirectory, 0)
+	if err := global.DB.Order("id ASC").Find(&items).Error; err != nil {
+		return nil, err
+	}
+	var quicks []model.QuickJump
+	if err := legacyQuickDirectories(global.DB).Order("id ASC").Find(&quicks).Error; err != nil {
+		return nil, err
+	}
+	for _, quick := range quicks {
+		items = append(items, model.QuickDirectory{BaseModel: quick.BaseModel, Path: quick.Detail, Alias: quick.Alias, Legacy: true})
+	}
+	return items, nil
+}
+func (u *LauncherRepo) CountQuickDirectories() (int64, error) {
+	var count, legacyCount int64
+	if err := global.DB.Model(&model.QuickDirectory{}).Count(&count).Error; err != nil {
+		return 0, err
+	}
+	if err := legacyQuickDirectories(global.DB).Count(&legacyCount).Error; err != nil {
+		return 0, err
+	}
+	return count + legacyCount, nil
+}
+func (u *LauncherRepo) CreateQuickDirectory(item *model.QuickDirectory) error {
+	return global.DB.Create(item).Error
+}
+func (u *LauncherRepo) UpdateQuickDirectory(item *model.QuickDirectory) error {
+	var result *gorm.DB
+	if item.Legacy {
+		result = legacyQuickDirectories(global.DB).Where("id = ?", item.ID).Updates(map[string]interface{}{"detail": item.Path, "alias": item.Alias})
+	} else {
+		result = global.DB.Model(&model.QuickDirectory{}).Where("id = ?", item.ID).Updates(map[string]interface{}{"path": item.Path, "alias": item.Alias})
+	}
+	if result.Error != nil {
+		return result.Error
+	}
+	if result.RowsAffected == 0 {
+		return gorm.ErrRecordNotFound
+	}
+	return nil
+}
+func (u *LauncherRepo) DeleteQuickDirectory(id uint, legacy bool) error {
+	var result *gorm.DB
+	if legacy {
+		result = legacyQuickDirectories(global.DB).Where("id = ?", id).Updates(map[string]interface{}{"detail": nil, "alias": nil})
+	} else {
+		result = global.DB.Delete(&model.QuickDirectory{}, id)
+	}
+	if result.Error != nil {
+		return result.Error
+	}
+	if result.RowsAffected == 0 {
+		return gorm.ErrRecordNotFound
+	}
 	return nil
 }

agent/app/repo/database.go

@@ -6,6 +6,7 @@ import (
 	"strings"
 
 	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/global"
 	"github.com/1Panel-dev/1Panel/agent/utils/encrypt"
 	"gorm.io/gorm"
@@ -20,6 +21,8 @@ type IDatabaseRepo interface {
 	Update(id uint, vars map[string]interface{}) error
 	Delete(ctx context.Context, opts ...DBOption) error
 	Get(opts ...DBOption) (model.Database, error)
+	ListInstalledLocalMysql(ctx context.Context) ([]InstalledLocalMysql, error)
+	GetInstalledLocalMysql(ctx context.Context, name string) (InstalledLocalMysql, error)
 	WithoutByFrom(from string) DBOption
 	WithAppInstallID(appInstallID uint) DBOption
 	WithTypeList(dbType string) DBOption
@@ -29,6 +32,32 @@ func NewIDatabaseRepo() IDatabaseRepo {
 	return &DatabaseRepo{}
 }
 
+type InstalledLocalMysql struct {
+	ID                          uint
+	Type, From, Database        string
+	ContainerName, Version, Env string
+}
+
+func installedLocalMysqlQuery(ctx context.Context) *gorm.DB {
+	return getTx(ctx).WithContext(ctx).Table("databases AS d").
+		Joins("JOIN app_installs AS ai ON ai.id = d.app_install_id AND ai.name = d.name").
+		Joins("JOIN apps AS a ON a.id = ai.app_id").
+		Where("d.type = ? AND d.\"from\" = ? AND a.key = ?", constant.AppMysql, "local", constant.AppMysql).
+		Where("ai.status <> ? AND ai.container_name <> ?", constant.StatusDeleted, "")
+}
+
+func (d *DatabaseRepo) ListInstalledLocalMysql(ctx context.Context) ([]InstalledLocalMysql, error) {
+	result := make([]InstalledLocalMysql, 0)
+	err := installedLocalMysqlQuery(ctx).Select("d.id, d.type, d.\"from\", d.name AS database, ai.version").Order("d.id").Scan(&result).Error
+	return result, err
+}
+
+func (d *DatabaseRepo) GetInstalledLocalMysql(ctx context.Context, name string) (InstalledLocalMysql, error) {
+	var result InstalledLocalMysql
+	err := installedLocalMysqlQuery(ctx).Where("d.name = ?", name).Select("d.id, ai.container_name, ai.version, ai.env").Take(&result).Error
+	return result, err
+}
+
 func (d *DatabaseRepo) Get(opts ...DBOption) (model.Database, error) {
 	var database model.Database
 	db := global.DB

agent/app/repo/database_mysql.go

@@ -18,6 +18,7 @@ type IMysqlRepo interface {
 	List(opts ...DBOption) ([]model.DatabaseMysql, error)
 	Page(limit, offset int, opts ...DBOption) (int64, []model.DatabaseMysql, error)
 	Create(ctx context.Context, mysql *model.DatabaseMysql) error
+	CreateMetadata(ctx context.Context, mysql *model.DatabaseMysql) error
 	Delete(ctx context.Context, opts ...DBOption) error
 	Update(id uint, vars map[string]interface{}) error
 	DeleteLocal(ctx context.Context) error
@@ -94,6 +95,10 @@ func (u *MysqlRepo) Create(ctx context.Context, mysql *model.DatabaseMysql) erro
 	return getTx(ctx).Create(mysql).Error
 }
 
+func (u *MysqlRepo) CreateMetadata(ctx context.Context, mysql *model.DatabaseMysql) error {
+	return getTx(ctx).WithContext(ctx).Create(mysql).Error
+}
+
 func (u *MysqlRepo) Delete(ctx context.Context, opts ...DBOption) error {
 	return getTx(ctx, opts...).Delete(&model.DatabaseMysql{}).Error
 }

agent/app/repo/database_user.go

@@ -14,8 +14,10 @@ type DatabaseUserRepo struct{}
 
 type IDatabaseUserRepo interface {
 	Get(opts ...DBOption) (model.DatabaseUser, error)
+	GetEncryptedWithContext(ctx context.Context, opts ...DBOption) (model.DatabaseUser, error)
 	List(opts ...DBOption) ([]model.DatabaseUser, error)
 	Save(user *model.DatabaseUser) error
+	SaveEncryptedWithContext(ctx context.Context, user *model.DatabaseUser) error
 	Delete(opts ...DBOption) error
 	DeleteBy(ctx context.Context, opts ...DBOption) error
 	Update(vars map[string]interface{}, opts ...DBOption) error
@@ -45,6 +47,13 @@ func (u *DatabaseUserRepo) Get(opts ...DBOption) (model.DatabaseUser, error) {
 	return user, nil
 }
 
+// GetEncryptedWithContext leaves credential transformation to the caller.
+func (u *DatabaseUserRepo) GetEncryptedWithContext(ctx context.Context, opts ...DBOption) (model.DatabaseUser, error) {
+	var user model.DatabaseUser
+	err := getTx(ctx, opts...).WithContext(ctx).First(&user).Error
+	return user, err
+}
+
 func (u *DatabaseUserRepo) List(opts ...DBOption) ([]model.DatabaseUser, error) {
 	var users []model.DatabaseUser
 	db := global.DB.Model(&model.DatabaseUser{})
@@ -75,6 +84,10 @@ func (u *DatabaseUserRepo) Save(user *model.DatabaseUser) error {
 	return global.DB.Save(user).Error
 }
 
+func (u *DatabaseUserRepo) SaveEncryptedWithContext(ctx context.Context, user *model.DatabaseUser) error {
+	return getTx(ctx).WithContext(ctx).Save(user).Error
+}
+
 func (u *DatabaseUserRepo) Delete(opts ...DBOption) error {
 	db := global.DB
 	for _, opt := range opts {

agent/app/repo/database_user_grant.go

@@ -14,6 +14,7 @@ type IDatabaseUserGrantRepo interface {
 	Get(opts ...DBOption) (model.DatabaseUserGrant, error)
 	List(opts ...DBOption) ([]model.DatabaseUserGrant, error)
 	Save(grant *model.DatabaseUserGrant) error
+	CreateIfAbsent(ctx context.Context, grant *model.DatabaseUserGrant) error
 	Replace(dbType, database string, grants []model.DatabaseUserGrant) error
 	Delete(opts ...DBOption) error
 	DeleteBy(ctx context.Context, opts ...DBOption) error
@@ -52,6 +53,12 @@ func (u *DatabaseUserGrantRepo) Save(grant *model.DatabaseUserGrant) error {
 	return global.DB.Save(grant).Error
 }
 
+func (u *DatabaseUserGrantRepo) CreateIfAbsent(ctx context.Context, grant *model.DatabaseUserGrant) error {
+	return getTx(ctx).WithContext(ctx).
+		Where("type = ? AND database = ? AND db_name = ? AND username = ? AND host = ?", grant.Type, grant.Database, grant.DBName, grant.Username, grant.Host).
+		FirstOrCreate(grant).Error
+}
+
 func (u *DatabaseUserGrantRepo) Replace(dbType, database string, grants []model.DatabaseUserGrant) error {
 	return global.DB.Transaction(func(tx *gorm.DB) error {
 		if err := tx.Where("`type` = ? AND database = ?", dbType, database).Delete(&model.DatabaseUserGrant{}).Error; err != nil {

agent/app/repo/monitor_vllm.go

@@ -16,7 +16,8 @@ type VLLMMonitorRepo struct{}
 
 type VLLMHistoryPoint struct {
 	model.MonitorVLLM
-	Bucket int64
+	Bucket            int64
+	CompletedRequests *float64
 }
 
 func (r *VLLMMonitorRepo) Create(point *model.MonitorVLLM) error {
@@ -77,12 +78,19 @@ func (r *VLLMMonitorRepo) History(ctx context.Context, id uint, start, end time.
 		}
 		db = db.Group("bucket").Order("bucket ASC")
 	} else {
-		columns = append([]string{"id", "created_at", "app_install_id", "status"}, metrics...)
+		columns = append([]string{"id", "created_at", "app_install_id", "status", "sample_interval_seconds"}, metrics...)
 		if group == "" || group == "requests" {
 			columns = append(columns, "histogram_deltas", "request_deltas")
 		}
 		db = db.Order("created_at ASC, id ASC")
 	}
+	if group == "" || group == "overview" {
+		count := "CASE WHEN json_valid(request_deltas) THEN CASE WHEN json_extract(request_deltas, '$.seconds') > 0 THEN ROUND(request_throughput * json_extract(request_deltas, '$.seconds')) END END"
+		if seconds > 0 {
+			count = "SUM(" + count + ")"
+		}
+		columns = append(columns, count+" AS completed_requests")
+	}
 	var points []VLLMHistoryPoint
 	err := db.Select(strings.Join(columns, ", ")).Scan(&points).Error
 	return points, err

agent/app/repo/setting.go

@@ -15,10 +15,13 @@ type SettingRepo struct{}
 type ISettingRepo interface {
 	GetList(opts ...DBOption) ([]model.Setting, error)
 	Get(opts ...DBOption) (model.Setting, error)
+	GetWithContext(ctx context.Context, opts ...DBOption) (model.Setting, error)
 	GetValueByKey(key string) (string, error)
 	GetCoreValueByKey(key string) (string, error)
 	Create(key, value string) error
+	CreateWithContext(ctx context.Context, setting *model.Setting) error
 	Update(key, value string) error
+	UpdateIfMatch(ctx context.Context, id uint, expectedValue, value string) (int64, error)
 	WithByKey(key string) DBOption
 
 	UpdateOrCreate(key, value string) error
@@ -67,6 +70,22 @@ func (s *SettingRepo) Get(opts ...DBOption) (model.Setting, error) {
 	return settings, err
 }
 
+func (s *SettingRepo) GetWithContext(ctx context.Context, opts ...DBOption) (model.Setting, error) {
+	var setting model.Setting
+	err := getTx(ctx, opts...).WithContext(ctx).First(&setting).Error
+	return setting, err
+}
+
+func (s *SettingRepo) CreateWithContext(ctx context.Context, setting *model.Setting) error {
+	return getTx(ctx).WithContext(ctx).Create(setting).Error
+}
+
+func (s *SettingRepo) UpdateIfMatch(ctx context.Context, id uint, expectedValue, value string) (int64, error) {
+	result := getTx(ctx).WithContext(ctx).Model(&model.Setting{}).
+		Where("id = ? AND value = ?", id, expectedValue).Update("value", value)
+	return result.RowsAffected, result.Error
+}
+
 func (s *SettingRepo) GetValueByKey(key string) (string, error) {
 	var setting model.Setting
 	if err := global.DB.Model(&model.Setting{}).Where("key = ?", key).First(&setting).Error; err != nil {

agent/app/repo/task.go

@@ -19,8 +19,8 @@ type ITaskRepo interface {
 	GetFirst(opts ...DBOption) (model.Task, error)
 	Page(page, size int, opts ...DBOption) (int64, []model.Task, error)
 	Update(ctx context.Context, task *model.Task) error
-	UpdateRunningTaskToFailed() error
-	CountExecutingTask() (int64, error)
+	UpdateRunningTaskToFailed(opts ...DBOption) error
+	CountExecutingTask(opts ...DBOption) (int64, error)
 	Delete(opts ...DBOption) error
 	DeleteAll() error
 
@@ -29,6 +29,7 @@ type ITaskRepo interface {
 	WithResourceID(id uint) DBOption
 	WithOperate(taskOperate string) DBOption
 	WithByStatus(status string) DBOption
+	WithoutScopes(scopes ...string) DBOption
 }
 
 func NewITaskRepo() ITaskRepo {
@@ -110,18 +111,30 @@ func (t TaskRepo) Update(ctx context.Context, task *model.Task) error {
 	return getTaskTx(ctx).Save(&task).Error
 }
 
-func (t TaskRepo) UpdateRunningTaskToFailed() error {
-	return getTaskDb(t.WithByStatus(constant.StatusExecuting)).Model(&model.Task{}).Updates(map[string]interface{}{
+func (t TaskRepo) UpdateRunningTaskToFailed(opts ...DBOption) error {
+	opts = append(opts, t.WithByStatus(constant.StatusExecuting))
+	return getTaskDb(opts...).Model(&model.Task{}).Updates(map[string]interface{}{
 		"status": constant.StatusFailed, "error_msg": constant.InterruptedMsg, "end_at": time.Now(),
 	}).Error
 }
 
-func (t TaskRepo) CountExecutingTask() (int64, error) {
+func (t TaskRepo) CountExecutingTask(opts ...DBOption) (int64, error) {
 	var count int64
-	err := getTaskDb(t.WithByStatus(constant.StatusExecuting)).Model(&model.Task{}).Count(&count).Error
+	opts = append(opts, t.WithByStatus(constant.StatusExecuting))
+	err := getTaskDb(opts...).Model(&model.Task{}).Count(&count).Error
 	return count, err
 }
 
+func (t TaskRepo) WithoutScopes(scopes ...string) DBOption {
+	excluded := append([]string(nil), scopes...)
+	return func(db *gorm.DB) *gorm.DB {
+		if len(excluded) == 0 {
+			return db
+		}
+		return db.Where("type IS NULL OR type NOT IN ?", excluded)
+	}
+}
+
 func (t TaskRepo) Delete(opts ...DBOption) error {
 	db := global.TaskDB
 	for _, opt := range opts {

agent/app/service/agents.go

@@ -88,6 +88,7 @@ type IAgentService interface {
 
 	GetFeishuConfig(req dto.AgentFeishuConfigReq) (*dto.AgentFeishuConfig, error)
 	UpdateFeishuConfig(req dto.AgentFeishuConfigUpdateReq) error
+	SwitchFeishuPlugin(req dto.AgentFeishuSwitchReq) error
 	GetTelegramConfig(req dto.AgentTelegramConfigReq) (*dto.AgentTelegramConfig, error)
 	UpdateTelegramConfig(req dto.AgentTelegramConfigUpdateReq) error
 	GetDiscordConfig(req dto.AgentIDReq) (*dto.AgentDiscordConfig, error)
@@ -142,6 +143,9 @@ const (
 
 func (a AgentService) Create(req dto.AgentCreateReq) (*dto.AgentItem, error) {
 	agentType := req.AgentType
+	if err := validateNativeAgentCreate(req); err != nil {
+		return nil, err
+	}
 	if err := checkPortExist(req.WebUIPort); err != nil {
 		return nil, err
 	}
@@ -237,6 +241,8 @@ func (a AgentService) Create(req dto.AgentCreateReq) (*dto.AgentItem, error) {
 		}
 	} else if agentType == constant.AppCopaw {
 		dashboardAuth = normalizeAgentDashboardAuth(req.DashboardUsername, req.DashboardPassword)
+	} else if agentType == constant.AppDeepSeekHarness || agentType == constant.AppOctop {
+		dashboardAuth = agentDashboardAuth{Username: req.DashboardUsername, Password: req.DashboardPassword}
 	}
 
 	params := map[string]interface{}{
@@ -245,6 +251,12 @@ func (a AgentService) Create(req dto.AgentCreateReq) (*dto.AgentItem, error) {
 		constant.HostIP:      "",
 	}
 	setAgentWebUIParams(params, agentType, detail.Version, req.WebUIPort)
+	if agentType == constant.AppDeepSeekHarness {
+		params["HTTPS_ACCESS_HOST"] = req.AccessHost
+	}
+	if agentType == constant.AppOctop {
+		params["OCTOP_LOG_LEVEL"] = "info"
+	}
 	if agentType == constant.AppOpenclaw {
 		if allowedOrigin := firstAllowedOrigin(allowedOrigins); allowedOrigin != "" {
 			params["ALLOWED_ORIGIN"] = allowedOrigin
@@ -738,7 +750,7 @@ func requiresAgentAccount(agentType string) bool {
 }
 
 func setAgentWebUIParams(params map[string]interface{}, agentType, appVersion string, webUIPort int) {
-	if agentType == constant.AppOpenclaw && isOpenclawHTTPSWindowVersion(appVersion) {
+	if agentType == constant.AppDeepSeekHarness || agentType == constant.AppOpenclaw && isOpenclawHTTPSWindowVersion(appVersion) {
 		params["PANEL_APP_PORT_HTTPS"] = webUIPort
 		return
 	}
@@ -1044,7 +1056,7 @@ func (a AgentService) CreateAccount(req dto.AgentAccountCreateReq) error {
 		return err
 	}
 	validateAvailability := req.ValidateAvailability == nil || *req.ValidateAvailability
-	resolvedInput, err := resolveAgentAccountInput(provider, req.APIType, req.AuthMode, req.APIKey, req.BaseURL, verifyModel, validateAvailability)
+	resolvedInput, err := resolveAgentAccountInput(provider, req.APIType, req.AuthMode, req.APIKey, req.BaseURL, verifyModel, validateAvailability, false)
 	if err != nil {
 		return err
 	}
@@ -1097,12 +1109,15 @@ func (a AgentService) UpdateAccount(req dto.AgentAccountUpdateReq) error {
 	if strings.TrimSpace(requestedVerifyModel) == "" {
 		requestedVerifyModel = account.VerifyModel
 	}
-	verifyModel, err := resolveAgentAccountVerifyModel(provider, requestedVerifyModel, models)
-	if err != nil {
-		return err
+	verifyModel := ""
+	if account.AppInstallID == 0 || len(models) > 0 {
+		verifyModel, err = resolveAgentAccountVerifyModel(provider, requestedVerifyModel, models)
+		if err != nil {
+			return err
+		}
 	}
 	validateAvailability := req.ValidateAvailability == nil || *req.ValidateAvailability
-	resolvedInput, err := resolveAgentAccountInput(provider, req.APIType, req.AuthMode, req.APIKey, req.BaseURL, verifyModel, validateAvailability)
+	resolvedInput, err := resolveAgentAccountInput(provider, req.APIType, req.AuthMode, req.APIKey, req.BaseURL, verifyModel, validateAvailability, account.AppInstallID != 0 && len(models) == 0)
 	if err != nil {
 		return err
 	}
@@ -1116,7 +1131,7 @@ func (a AgentService) UpdateAccount(req dto.AgentAccountUpdateReq) error {
 	account.Remark = req.Remark
 	account.Verified = true
 
-	if err := global.DB.Save(account).Error; err != nil {
+	if err := agentAccountRepo.Save(account); err != nil {
 		return err
 	}
 	terminalai.InvalidateTerminalRuntimeCache()
@@ -1147,13 +1162,34 @@ func (a AgentService) PageAccounts(req dto.AgentAccountSearch) (int64, []dto.Age
 	if err != nil {
 		return 0, nil, err
 	}
+	installIDs := make([]uint, 0, len(list))
+	for _, account := range list {
+		if account.AppInstallID != 0 {
+			installIDs = append(installIDs, account.AppInstallID)
+		}
+	}
+	localInstalls := make(map[uint]bool, len(installIDs))
+	if len(installIDs) > 0 {
+		installs, err := appInstallRepo.ListBy(context.Background(), repo.WithByIDs(installIDs))
+		if err != nil {
+			return 0, nil, err
+		}
+		for _, install := range installs {
+			localInstalls[install.ID] = true
+		}
+	}
 	items := make([]dto.AgentAccountInfo, 0, len(list))
 	for _, item := range list {
 		apiKey := ""
 		if item.RememberAPIKey {
 			apiKey = item.APIKey
 		}
+		appInstallID := uint(0)
+		if localInstalls[item.AppInstallID] {
+			appInstallID = item.AppInstallID
+		}
 		items = append(items, dto.AgentAccountInfo{
+			AppInstallID:    appInstallID,
 			ID:              item.ID,
 			MasterAccountID: item.MasterAccountID,
 			Provider:        item.Provider,
@@ -1351,13 +1387,27 @@ func (a AgentService) SyncAgentsByAccount(account *model.AgentAccount) error {
 }
 
 func (a AgentService) VerifyAccount(req dto.AgentAccountVerifyReq) error {
-	_, err := resolveAgentAccountInput(req.Provider, req.APIType, req.AuthMode, req.APIKey, req.BaseURL, req.Model, true)
+	_, err := resolveAgentAccountInput(req.Provider, req.APIType, req.AuthMode, req.APIKey, req.BaseURL, req.Model, true, false)
 	return err
 }
 
 func (a AgentService) DeleteAccount(req dto.AgentAccountDeleteReq) error {
 	agentAccountMutationMu.Lock()
 	defer agentAccountMutationMu.Unlock()
+	account, err := agentAccountRepo.GetFirst(repo.WithByID(req.ID))
+	if err != nil {
+		return err
+	}
+	if account.AppInstallID != 0 && account.Provider != "ollama" {
+		_, err := appInstallRepo.GetFirst(repo.WithByID(account.AppInstallID))
+		if err == nil {
+			return buserr.WithDetail("ErrInvalidParams", "Delete the local inference engine instead", nil)
+		}
+		if !errors.Is(err, gorm.ErrRecordNotFound) {
+			return err
+		}
+	}
+
 	if err := global.DB.Transaction(func(tx *gorm.DB) error {
 		var agentCount int64
 		if err := tx.Model(&model.Agent{}).Where("account_id = ?", req.ID).Count(&agentCount).Error; err != nil {
@@ -1542,6 +1592,10 @@ func (a AgentService) UpdateConfigFile(req dto.AgentConfigFileUpdateReq) error {
 	if err != nil {
 		return err
 	}
+	if _, busy := feishuSwitches.LoadOrStore(agent.ConfigPath, true); busy {
+		return buserr.New("TaskIsExecuting")
+	}
+	defer feishuSwitches.Delete(agent.ConfigPath)
 	if err := validateAgentConfigFileContent(agent.AgentType, req.Content); err != nil {
 		return err
 	}

agent/app/service/agents_channels.go

@@ -45,9 +45,29 @@ func (a AgentService) GetFeishuConfig(req dto.AgentFeishuConfigReq) (*dto.AgentF
 	if err != nil {
 		return nil, err
 	}
+	if agent.AgentType != constant.AppOpenclaw || !isOpenclawBundledFeishuVersion(install.Version) {
+		result := extractFeishuConfig(conf)
+		result.Installed, _ = checkPluginInstalled(install.GetPath(), "feishu")
+		return &result, nil
+	}
+	legacy, configured, err := classifyLegacyFeishu(conf, install.GetPath())
+	if err != nil {
+		return nil, err
+	}
 	result := extractFeishuConfig(conf)
-	installed, _ := checkPluginInstalled(install.GetPath(), "feishu")
-	result.Installed = installed
+	if !legacy {
+		result = extractBundledFeishuConfig(conf)
+	}
+	result.BuiltinManaged = true
+	result.BuiltinAvailable = hasBundledFeishu(install.ContainerName)
+	result.Installed = result.BuiltinAvailable
+	result.Legacy, result.LegacyConfigured = legacy, configured
+	if legacy {
+		result.GroupSessionScope = "group"
+		if result.ThreadSession {
+			result.GroupSessionScope = "group_topic"
+		}
+	}
 	return &result, nil
 }
 
@@ -72,6 +92,9 @@ func (a AgentService) UpdateFeishuConfig(req dto.AgentFeishuConfigUpdateReq) err
 			})
 		})
 	}
+	if agent.AgentType == constant.AppOpenclaw && isOpenclawBundledFeishuVersion(install.Version) {
+		return saveBundledFeishuConfig(agent, install, req)
+	}
 	return a.mutateAgentConfig(req.AgentID, func(_ *model.Agent, _ *model.AppInstall, conf map[string]interface{}) error {
 		config := dto.AgentFeishuConfig{
 			Enabled:        req.Enabled,
@@ -358,6 +381,9 @@ func (a AgentService) InstallPlugin(req dto.AgentPluginInstallReq) error {
 	if err != nil {
 		return err
 	}
+	if req.Type == "feishu" && agent.AgentType == constant.AppOpenclaw && isOpenclawBundledFeishuVersion(install.Version) {
+		return buserr.New("ErrFeishuManaged")
+	}
 	if err := task.CheckScopeTaskIsExecuting(task.TaskScopeAI, req.AgentID); err != nil {
 		return err
 	}
@@ -403,6 +429,9 @@ func (a AgentService) UpgradePlugin(req dto.AgentPluginUpgradeReq) error {
 	if err != nil {
 		return err
 	}
+	if req.Type == "feishu" && agent.AgentType == constant.AppOpenclaw && isOpenclawBundledFeishuVersion(install.Version) {
+		return buserr.New("ErrFeishuManaged")
+	}
 	if err := task.CheckScopeTaskIsExecuting(task.TaskScopeAI, req.AgentID); err != nil {
 		return err
 	}
@@ -443,6 +472,9 @@ func (a AgentService) UninstallPlugin(req dto.AgentPluginUninstallReq) error {
 	if err != nil {
 		return err
 	}
+	if req.Type == "feishu" && agent.AgentType == constant.AppOpenclaw && isOpenclawBundledFeishuVersion(install.Version) {
+		return buserr.New("ErrFeishuManaged")
+	}
 	if err := task.CheckScopeTaskIsExecuting(task.TaskScopeAI, req.AgentID); err != nil {
 		return err
 	}
@@ -538,10 +570,13 @@ func (a AgentService) DeleteChannelConfig(req dto.AgentChannelDeleteReq) error {
 }
 
 func (a AgentService) CheckPlugin(req dto.AgentPluginCheckReq) (*dto.AgentPluginStatus, error) {
-	_, install, err := a.loadAgentAndInstall(req.AgentID)
+	agent, install, err := a.loadAgentAndInstall(req.AgentID)
 	if err != nil {
 		return nil, err
 	}
+	if req.Type == "feishu" && agent.AgentType == constant.AppOpenclaw && isOpenclawBundledFeishuVersion(install.Version) {
+		return &dto.AgentPluginStatus{Installed: hasBundledFeishu(install.ContainerName)}, nil
+	}
 	installed, err := checkPluginInstalled(install.GetPath(), req.Type)
 	if err != nil {
 		return nil, err

agent/app/service/agents_feishu.go

@@ -0,0 +1,677 @@
+package service
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"sync"
+	"syscall"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/app/task"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/i18n"
+	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
+	"github.com/1Panel-dev/1Panel/agent/utils/common"
+	"github.com/1Panel-dev/1Panel/agent/utils/compose"
+)
+
+// Keep panel configuration writes out of the backup/activation/recovery window.
+var feishuSwitches sync.Map
+
+func isOpenclawBundledFeishuVersion(version string) bool {
+	return common.CompareAppVersion(version, "2026.10.7")
+}
+
+func hasBundledFeishu(container string) bool {
+	image, err := feishuContainerImage(container)
+	if err != nil {
+		return false
+	}
+	_, err = bundledFeishuImage(image)
+	return err == nil
+}
+
+func usesBundledFeishu(conf map[string]interface{}) bool {
+	f := getChannelConfig(conf, "feishu")
+	for _, key := range []string{"threadSession", "replyMode"} {
+		if _, old := f[key]; old {
+			return false
+		}
+	}
+	if _, old := f["streaming"].(bool); old {
+		return false
+	}
+	entries := childMap(childMap(conf, "plugins"), "entries")
+	if extractBoolValue(childMap(entries, "openclaw-lark")["enabled"], false) {
+		return false
+	}
+	_, streaming := f["streaming"].(map[string]interface{})
+	_, selected := entries["feishu"]
+	return selected && (extractBoolValue(childMap(entries, "feishu")["enabled"], false) || f["groupSessionScope"] != nil || streaming)
+}
+
+func hasLegacyFeishu(conf map[string]interface{}, installPath string) bool {
+	legacy, _, err := classifyLegacyFeishu(conf, installPath)
+	return err != nil || legacy
+}
+
+func selectBundledFeishu(conf map[string]interface{}, enabled bool) {
+	plugins := ensureChildMap(conf, "plugins")
+	entries := ensureChildMap(plugins, "entries")
+	if legacy, ok := entries["openclaw-lark"]; ok {
+		if entry, ok := legacy.(map[string]interface{}); ok {
+			entry["enabled"] = false
+		}
+	}
+	ensureChildMap(entries, "feishu")["enabled"] = enabled
+	// Preserve an absent allowlist; creating one would disable unrelated plugins.
+	if allow, ok := plugins["allow"]; ok && len(extractStringList(allow)) > 0 {
+		ids := slices.DeleteFunc(extractStringList(allow), func(id string) bool { return id == "openclaw-lark" })
+		if !slices.Contains(ids, "feishu") {
+			ids = append(ids, "feishu")
+		}
+		plugins["allow"] = ids
+	}
+	if deny, ok := plugins["deny"]; ok {
+		plugins["deny"] = slices.DeleteFunc(extractStringList(deny), func(id string) bool { return id == "feishu" })
+	}
+}
+
+func feishuConfigError(field string) error { return buserr.WithDetail("ErrFeishuConfig", field, nil) }
+
+func convertLegacyFeishu(conf map[string]interface{}, req dto.AgentFeishuSwitchReq) error {
+	f := getChannelConfig(conf, "feishu")
+	if len(f) == 0 {
+		if raw, exists := childMap(conf, "channels")["feishu"]; exists && raw != nil {
+			if _, ok := raw.(map[string]interface{}); !ok {
+				return feishuConfigError("channels.feishu")
+			}
+		}
+		f = ensureChildMap(ensureChildMap(conf, "channels"), "feishu")
+		f["enabled"], f["dmPolicy"], f["groupPolicy"] = false, "pairing", "allowlist"
+	}
+	if err := checkLegacyFeishuFields(f, "channels.feishu", false); err != nil {
+		return err
+	}
+	if err := convertFeishuAccess(f, "channels.feishu"); err != nil {
+		return err
+	}
+	delete(f, "threadSession")
+	delete(f, "replyMode")
+	f["streaming"] = map[string]interface{}{"mode": "off"}
+	if req.Streaming {
+		f["streaming"] = map[string]interface{}{"mode": "partial"}
+	}
+	f["groupSessionScope"] = req.GroupSessionScope
+	f["requireMention"] = req.RequireMention == "true"
+	delete(f, "topicSessionMode")
+	// Preserve legacy defaults explicitly; bundled defaults are more restrictive.
+	if _, ok := f["groupPolicy"]; !ok {
+		f["groupPolicy"] = "open"
+	}
+	entries := ensureChildMap(ensureChildMap(conf, "plugins"), "entries")
+	ensureChildMap(entries, "openclaw-lark")["enabled"] = false
+	selectBundledFeishu(conf, extractBoolValue(f["enabled"], true))
+	return nil
+}
+
+// Limit automatic conversion to the shared channel fields; custom plugin options require review.
+func checkLegacyFeishuFields(f map[string]interface{}, field string, group bool) error {
+	allowed := strings.Fields("enabled name appId appSecret encryptKey verificationToken domain connectionMode webhookPath defaultAccount dmPolicy allowFrom groupPolicy groupAllowFrom groupSenderAllowFrom requireMention accounts groups streaming threadSession replyMode groupSessionScope topicSessionMode replyInThread")
+	if group {
+		allowed = strings.Fields("enabled requireMention allowFrom groupSessionScope topicSessionMode replyInThread")
+	}
+	for _, key := range sortedChildKeys(f) {
+		if !slices.Contains(allowed, key) {
+			return feishuConfigError(field + "." + key)
+		}
+	}
+	if enabled, exists := f["enabled"]; exists {
+		if _, ok := enabled.(bool); !ok {
+			return feishuConfigError(field + ".enabled")
+		}
+	}
+	for _, key := range []string{"dmPolicy", "groupPolicy"} {
+		if raw, exists := f[key]; exists {
+			value, ok := raw.(string)
+			options := []string{"open", "allowlist", "disabled"}
+			if key == "dmPolicy" {
+				options = append(options, "pairing")
+			}
+			if !ok || !slices.Contains(options, value) {
+				return feishuConfigError(field + "." + key)
+			}
+		}
+	}
+	for _, key := range []string{"allowFrom", "groupSenderAllowFrom"} {
+		if raw, exists := f[key]; exists {
+			values, ok := raw.([]interface{})
+			if !ok {
+				return feishuConfigError(field + "." + key)
+			}
+			for _, value := range values {
+				if _, ok := value.(string); !ok {
+					return feishuConfigError(field + "." + key)
+				}
+			}
+		}
+	}
+	for _, section := range []string{"accounts", "groups"} {
+		raw, exists := f[section]
+		if !exists {
+			continue
+		}
+		entries, ok := raw.(map[string]interface{})
+		if !ok {
+			return feishuConfigError(field + "." + section)
+		}
+		for _, id := range sortedChildKeys(entries) {
+			entry, ok := entries[id].(map[string]interface{})
+			name := field + "." + section + "." + id
+			if !ok {
+				return feishuConfigError(name)
+			}
+			if err := checkLegacyFeishuFields(entry, name, section == "groups"); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func convertFeishuAccess(f map[string]interface{}, field string) error {
+	if raw, ok := f["groupAllowFrom"]; ok {
+		values, ok := raw.([]interface{})
+		if !ok {
+			return feishuConfigError(field + ".groupAllowFrom")
+		}
+		groups, senders := []string{}, []string{}
+		for _, value := range values {
+			id, ok := value.(string)
+			if !ok {
+				return feishuConfigError(field + ".groupAllowFrom")
+			}
+			switch {
+			case strings.HasPrefix(id, "oc_"):
+				groups = append(groups, id)
+			case strings.HasPrefix(id, "ou_"):
+				senders = append(senders, id)
+			default:
+				return feishuConfigError(field + ".groupAllowFrom")
+			}
+		}
+		// A sender-only legacy allowlist has different group admission semantics.
+		if len(senders) > 0 && (len(groups) == 0 || f["groupSenderAllowFrom"] != nil) {
+			return feishuConfigError(field + ".groupAllowFrom")
+		}
+		f["groupAllowFrom"] = groups
+		if len(senders) > 0 {
+			f["groupSenderAllowFrom"] = senders
+		}
+	}
+	for _, section := range []string{"accounts", "groups"} {
+		for id, value := range childMap(f, section) {
+			entry, ok := value.(map[string]interface{})
+			name := field + "." + section + "." + id
+			if !ok {
+				return feishuConfigError(name)
+			}
+			// Account/group overrides must be resolved explicitly, not flattened.
+			for _, key := range []string{"threadSession", "replyMode"} {
+				if _, ok := entry[key]; ok {
+					return feishuConfigError(name + "." + key)
+				}
+			}
+			if mention, ok := entry["requireMention"]; ok {
+				if _, ok := mention.(bool); !ok {
+					return feishuConfigError(name + ".requireMention")
+				}
+			}
+			if raw, exists := entry["streaming"]; exists {
+				streaming, ok := raw.(bool)
+				if !ok || streaming {
+					return feishuConfigError(name + ".streaming")
+				}
+				entry["streaming"] = map[string]interface{}{"mode": "off"}
+			}
+			if err := convertFeishuAccess(entry, name); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func extractBundledFeishuConfig(conf map[string]interface{}) dto.AgentFeishuConfig {
+	result := extractFeishuConfig(conf)
+	f := getChannelConfig(conf, "feishu")
+	result.Enabled = extractBoolValue(f["enabled"], true) && extractBoolValue(childMap(childMap(childMap(conf, "plugins"), "entries"), "feishu")["enabled"], true)
+	result.GroupSessionScope = extractStringValue(f["groupSessionScope"])
+	if result.GroupSessionScope == "" {
+		result.GroupSessionScope = "group"
+	}
+	result.Streaming = extractStringValue(childMap(f, "streaming")["mode"]) != "off"
+	result.GroupPolicy = extractStringValue(f["groupPolicy"])
+	if result.GroupPolicy == "" {
+		result.GroupPolicy = "allowlist"
+	}
+	if len(f) == 0 {
+		result.Streaming = false
+		result.RequireMention = "true"
+	} else if _, ok := f["requireMention"]; !ok {
+		result.RequireMention = "open"
+	}
+	accounts := childMap(f, "accounts")
+	ids := sortedChildKeys(accounts)
+	if (f["appId"] != nil || f["appSecret"] != nil) && !slices.Contains(ids, "default") {
+		ids = append([]string{"default"}, ids...)
+	}
+	result.Bots = []dto.AgentFeishuBot{}
+	for _, id := range ids {
+		effective := make(map[string]interface{}, len(f))
+		for k, v := range f {
+			effective[k] = v
+		}
+		for k, v := range childMap(accounts, id) {
+			effective[k] = v
+		}
+		bot := defaultFeishuBot()
+		bot.AccountID, bot.IsDefault = id, id == "default"
+		bot.Name = extractDisplayName(childMap(accounts, id), "", id)
+		bot.Enabled = extractBoolValue(childMap(accounts, id)["enabled"], true)
+		bot.AppID, bot.AppSecret = extractStringValue(effective["appId"]), extractStringValue(effective["appSecret"])
+		bot.DmPolicy = extractStringValue(effective["dmPolicy"])
+		if bot.DmPolicy == "" {
+			bot.DmPolicy = "pairing"
+		}
+		bot.AllowFrom = extractStringList(effective["allowFrom"])
+		result.Bots = append(result.Bots, bot)
+	}
+	return result
+}
+
+func setBundledFeishuConfig(conf map[string]interface{}, req dto.AgentFeishuConfigUpdateReq) error {
+	if !slices.Contains([]string{"group", "group_sender", "group_topic", "group_topic_sender"}, req.GroupSessionScope) {
+		return feishuConfigError("groupSessionScope")
+	}
+	f := ensureChildMap(ensureChildMap(conf, "channels"), "feishu")
+	accounts := childMap(f, "accounts")
+	seen := map[string]bool{}
+	appIDs := map[string]bool{}
+	for _, bot := range req.Bots {
+		if bot.AccountID == "" || bot.AccountID != strings.ToLower(strings.TrimSpace(bot.AccountID)) || seen[bot.AccountID] || appIDs[bot.AppID] || bot.AppID == "" || !slices.Contains([]string{"pairing", "open", "allowlist", "disabled"}, bot.DmPolicy) || (bot.DmPolicy == "allowlist" && len(bot.AllowFrom) == 0) {
+			return feishuConfigError("accounts")
+		}
+		seen[bot.AccountID] = true
+		appIDs[bot.AppID] = true
+		entry := childMap(accounts, bot.AccountID)
+		if _, exists := entry["appSecret"]; !exists && bot.AppSecret == "" {
+			entry["appSecret"] = f["appSecret"]
+		}
+		// SecretRef credentials cannot be represented by the form: keep them intact.
+		if _, secretRef := entry["appSecret"].(map[string]interface{}); !secretRef && bot.AppSecret == "" {
+			return feishuConfigError("accounts." + bot.AccountID + ".appSecret")
+		}
+		entry["appId"], entry["name"], entry["enabled"], entry["dmPolicy"] = bot.AppID, bot.Name, bot.Enabled, bot.DmPolicy
+		if bot.AppSecret != "" {
+			entry["appSecret"] = bot.AppSecret
+		}
+		switch bot.DmPolicy {
+		case "open":
+			entry["allowFrom"] = []string{"*"}
+		case "allowlist":
+			entry["allowFrom"] = bot.AllowFrom
+		default:
+			if len(bot.AllowFrom) > 0 {
+				entry["allowFrom"] = bot.AllowFrom
+			} else {
+				entry["allowFrom"] = []string{}
+			}
+		}
+		accounts[bot.AccountID] = entry
+	}
+	for id := range accounts {
+		if !seen[id] {
+			delete(accounts, id)
+		}
+	}
+	if !seen["default"] {
+		delete(f, "appId")
+		delete(f, "appSecret")
+	}
+	if id := extractStringValue(f["defaultAccount"]); id != "" && !seen[id] {
+		return feishuConfigError("defaultAccount")
+	}
+	if len(accounts) > 0 {
+		f["accounts"] = accounts
+	} else {
+		delete(f, "accounts")
+	}
+	f["enabled"], f["groupSessionScope"], f["groupPolicy"] = req.Enabled, req.GroupSessionScope, req.GroupPolicy
+	if req.RequireMention == "open" {
+		delete(f, "requireMention")
+	} else {
+		f["requireMention"] = req.RequireMention == "true"
+	}
+	if req.GroupPolicy == "allowlist" {
+		f["groupAllowFrom"] = req.GroupAllowFrom
+	} else {
+		delete(f, "groupAllowFrom")
+	}
+	streaming := ensureChildMap(f, "streaming")
+	streaming["mode"] = "off"
+	if req.Streaming {
+		streaming["mode"] = "partial"
+	}
+	selectBundledFeishu(conf, req.Enabled && hasEnabledBots(req.Bots))
+	return nil
+}
+
+// Write beside the original so validation and rename preserve the mounted filesystem and owner.
+func stageFeishuConfig(configPath string, payload []byte) (string, error) {
+	info, err := os.Lstat(configPath)
+	if err != nil {
+		return "", err
+	}
+	if !info.Mode().IsRegular() {
+		return "", feishuConfigError("openclaw.json")
+	}
+	f, err := os.CreateTemp(filepath.Dir(configPath), ".feishu-*.json")
+	if err != nil {
+		return "", err
+	}
+	name := f.Name()
+	defer func() {
+		f.Close()
+		if err != nil {
+			os.Remove(name)
+		}
+	}()
+	if stat, ok := info.Sys().(*syscall.Stat_t); ok {
+		err = f.Chown(int(stat.Uid), int(stat.Gid))
+	}
+	if err == nil {
+		err = f.Chmod(info.Mode().Perm())
+	}
+	if err == nil {
+		_, err = f.Write(payload)
+	}
+	if err == nil {
+		err = f.Sync()
+	}
+	if err == nil {
+		err = f.Close()
+	}
+	return name, err
+}
+
+func validateFeishuConfig(container, configPath string) error {
+	out, err := cmd.RunDockerExecWithStdout(time.Minute, container, "env", "OPENCLAW_CONFIG_PATH=/home/node/.openclaw/"+filepath.Base(configPath), "openclaw", "config", "validate", "--json")
+	return feishuValidationResult(out, err)
+}
+
+func replaceFeishuConfig(configPath string, expected, payload []byte) error {
+	tmp, err := stageFeishuConfig(configPath, payload)
+	if err != nil {
+		return err
+	}
+	defer os.Remove(tmp)
+	current, err := os.ReadFile(configPath)
+	if err != nil {
+		return err
+	}
+	if !bytes.Equal(current, expected) {
+		return buserr.New("ErrFeishuConfigChanged")
+	}
+	return os.Rename(tmp, configPath)
+}
+
+func (a AgentService) SwitchFeishuPlugin(req dto.AgentFeishuSwitchReq) error {
+	agent, install, err := a.loadOpenclawAgentAndInstall(req.AgentID)
+	if err != nil {
+		return err
+	}
+	if !isOpenclawBundledFeishuVersion(install.Version) {
+		return buserr.New("ErrFeishuImageRequired")
+	}
+	if _, busy := feishuSwitches.LoadOrStore(agent.ConfigPath, true); busy {
+		return buserr.New("TaskIsExecuting")
+	}
+	started := false
+	defer func() {
+		if !started {
+			feishuSwitches.Delete(agent.ConfigPath)
+		}
+	}()
+	if err := task.CheckScopeTaskIsExecuting(task.TaskScopeAI, req.AgentID); err != nil {
+		return err
+	}
+	if !hasBundledFeishu(install.ContainerName) {
+		return buserr.New("ErrFeishuImageRequired")
+	}
+	conf, err := readOpenclawConfig(agent.ConfigPath)
+	if err != nil {
+		return err
+	}
+	legacy, configured, err := classifyLegacyFeishu(conf, install.GetPath())
+	if err != nil {
+		return err
+	}
+	if !legacy {
+		return buserr.New("ErrFeishuAlreadySwitched")
+	}
+	if err := prepareLegacyFeishu(conf, configured, &dto.AgentFeishuTransition{Confirmed: true, Streaming: req.Streaming, GroupSessionScope: req.GroupSessionScope, RequireMention: req.RequireMention}); err != nil {
+		return err
+	}
+	switchTask, err := task.NewTaskWithOps("Feishu", task.TaskUpdate, task.TaskScopeAI, req.TaskID, req.AgentID)
+	if err != nil {
+		return err
+	}
+	switchTask.AddSubTaskWithAlias("AgentFeishuSwitch", func(t *task.Task) error { return a.runFeishuSwitch(agent, install, req, t) }, nil)
+	started = true
+	go func() { defer feishuSwitches.Delete(agent.ConfigPath); executeAgentPluginTask(switchTask) }()
+	return nil
+}
+
+func (a AgentService) runFeishuSwitch(agent *model.Agent, install *model.AppInstall, req dto.AgentFeishuSwitchReq, t *task.Task) (result error) {
+	original, conf, err := readFeishuConfigBytes(agent.ConfigPath)
+	if err != nil {
+		return err
+	}
+	legacy, configured, err := classifyLegacyFeishu(conf, install.GetPath())
+	if err != nil {
+		return err
+	}
+	if !legacy {
+		return buserr.New("ErrFeishuAlreadySwitched")
+	}
+	image, err := feishuContainerImage(install.ContainerName)
+	if err != nil {
+		return err
+	}
+	image, err = bundledFeishuImage(image)
+	if err != nil {
+		return err
+	}
+	if err = prepareLegacyFeishu(conf, configured, &dto.AgentFeishuTransition{Confirmed: true, Streaming: req.Streaming, GroupSessionScope: req.GroupSessionScope, RequireMention: req.RequireMention}); err != nil {
+		return err
+	}
+	payload, err := json.MarshalIndent(conf, "", "  ")
+	if err != nil {
+		return err
+	}
+	recovery, err := feishuRecoveryPayload(payload, configured)
+	if err != nil {
+		return err
+	}
+	// Validate both candidates without invoking Doctor or mutating retained state.
+	for _, candidate := range [][]byte{payload, recovery} {
+		staged, stageErr := stageFeishuConfig(agent.ConfigPath, candidate)
+		if stageErr != nil {
+			return stageErr
+		}
+		validateErr := validateFeishuImageConfig(image, staged)
+		os.Remove(staged)
+		if validateErr != nil {
+			return validateErr
+		}
+	}
+	if _, err = compose.Stop(install.GetComposePath()); err != nil {
+		return err
+	}
+	replaced := false
+	defer func() {
+		if !replaced {
+			if _, startErr := compose.Operate(install.GetComposePath(), "start"); startErr != nil {
+				result = errors.Join(result, buserr.WithErr("ErrFeishuRestore", startErr))
+			}
+			return
+		}
+		if result == nil {
+			return
+		}
+		if _, stopErr := compose.Stop(install.GetComposePath()); stopErr != nil {
+			result = errors.Join(result, buserr.WithErr("ErrFeishuRestore", stopErr))
+			return
+		}
+		if restoreErr := replaceFeishuConfig(agent.ConfigPath, payload, recovery); restoreErr != nil {
+			result = errors.Join(result, buserr.WithErr("ErrFeishuRestore", restoreErr))
+			return
+		}
+		if _, startErr := compose.Operate(install.GetComposePath(), "start"); startErr != nil {
+			result = errors.Join(result, buserr.WithErr("ErrFeishuRestore", startErr))
+			return
+		}
+		if healthErr := verifyFeishuActivation(install.ContainerName, false); healthErr != nil {
+			result = errors.Join(result, buserr.WithErr("ErrFeishuRestore", healthErr))
+			return
+		}
+		t.Log(i18n.GetMsgByKey("AgentFeishuRecoveryDisabled"))
+	}()
+	current, err := os.ReadFile(agent.ConfigPath)
+	if err != nil {
+		return err
+	}
+	if !bytes.Equal(current, original) {
+		return buserr.New("ErrFeishuConfigChanged")
+	}
+	backup, err := backupFeishuConfig(agent.ConfigPath, original)
+	if err != nil {
+		return err
+	}
+	t.Log(i18n.GetWithName("AgentFeishuBackup", filepath.Base(backup)))
+	if err = replaceFeishuConfig(agent.ConfigPath, original, payload); err != nil {
+		return err
+	}
+	replaced = true
+	if _, err = compose.Operate(install.GetComposePath(), "start"); err != nil {
+		return err
+	}
+	enabled := configured && extractBoolValue(getChannelConfig(conf, "feishu")["enabled"], true)
+	if err = verifyFeishuActivation(install.ContainerName, enabled); err != nil {
+		return err
+	}
+	if enabled {
+		probeFeishuConnection(install.ContainerName, t)
+	}
+	if configured {
+		t.Log(i18n.GetMsgByKey("AgentFeishuVerifyMessages"))
+	} else {
+		t.Log(i18n.GetMsgByKey("AgentFeishuRecoveryDisabled"))
+	}
+	return nil
+}
+
+func saveBundledFeishuConfig(agent *model.Agent, install *model.AppInstall, req dto.AgentFeishuConfigUpdateReq) error {
+	if !isOpenclawBundledFeishuVersion(install.Version) {
+		return buserr.New("ErrFeishuImageRequired")
+	}
+	if _, busy := feishuSwitches.LoadOrStore(agent.ConfigPath, true); busy {
+		return buserr.New("TaskIsExecuting")
+	}
+	defer feishuSwitches.Delete(agent.ConfigPath)
+	if err := task.CheckScopeTaskIsExecuting(task.TaskScopeAI, req.AgentID); err != nil {
+		return err
+	}
+	if !hasBundledFeishu(install.ContainerName) {
+		return buserr.New("ErrFeishuImageRequired")
+	}
+	original, err := os.ReadFile(agent.ConfigPath)
+	if err != nil {
+		return err
+	}
+	var conf map[string]interface{}
+	if err = json.Unmarshal(original, &conf); err != nil {
+		return err
+	}
+	if hasLegacyFeishu(conf, install.GetPath()) {
+		return buserr.New("ErrFeishuSwitchRequired")
+	}
+	if err = setBundledFeishuConfig(conf, req); err != nil {
+		return err
+	}
+	payload, err := json.MarshalIndent(conf, "", "  ")
+	if err != nil {
+		return err
+	}
+	staged, err := stageFeishuConfig(agent.ConfigPath, payload)
+	if err != nil {
+		return err
+	}
+	defer os.Remove(staged)
+	if err = validateFeishuConfig(install.ContainerName, staged); err != nil {
+		return err
+	}
+	return replaceFeishuConfig(agent.ConfigPath, original, payload)
+}
+
+func feishuProbeOK(output string) bool {
+	raw, err := extractEmbeddedJSON(output)
+	if err != nil {
+		return false
+	}
+	var status struct {
+		ChannelAccounts map[string][]struct {
+			Enabled    bool `json:"enabled"`
+			Configured bool `json:"configured"`
+			Running    bool `json:"running"`
+			Probe      struct {
+				OK bool `json:"ok"`
+			} `json:"probe"`
+		} `json:"channelAccounts"`
+	}
+	if json.Unmarshal(raw, &status) != nil {
+		return false
+	}
+	accounts, ok := status.ChannelAccounts["feishu"]
+	if !ok {
+		return false
+	}
+	for _, account := range accounts {
+		if account.Enabled && (!account.Configured || !account.Running || !account.Probe.OK) {
+			return false
+		}
+	}
+	return true
+}
+
+func feishuGatewayReady(output string, enabled bool) bool {
+	raw, err := extractEmbeddedJSON(output)
+	if err != nil {
+		return false
+	}
+	var health struct {
+		OK      bool `json:"ok"`
+		Plugins struct {
+			Loaded []string `json:"loaded"`
+		} `json:"plugins"`
+	}
+	return json.Unmarshal(raw, &health) == nil && health.OK && !slices.Contains(health.Plugins.Loaded, "openclaw-lark") && (!enabled || slices.Contains(health.Plugins.Loaded, "feishu"))
+}

agent/app/service/agents_feishu_runtime.go

@@ -0,0 +1,201 @@
+package service
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
+	"github.com/1Panel-dev/1Panel/agent/utils/docker"
+	"github.com/docker/docker/api/types/container"
+)
+
+// Inspect a stopped disposable container; its entrypoint never touches retained state.
+func bundledFeishuImage(image string) (string, error) {
+	cli, err := docker.NewDockerClient()
+	if err != nil {
+		return "", err
+	}
+	defer cli.Close()
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	info, _, err := cli.ImageInspectWithRaw(ctx, image)
+	if err != nil {
+		return "", buserr.New("ErrFeishuImageRequired")
+	}
+	created, err := cli.ContainerCreate(ctx, &container.Config{Image: info.ID, Entrypoint: []string{"/bin/true"}}, &container.HostConfig{NetworkMode: "none"}, nil, nil, "")
+	if err != nil {
+		return "", err
+	}
+	defer func() {
+		cleanup, done := context.WithTimeout(context.Background(), 10*time.Second)
+		defer done()
+		_ = cli.ContainerRemove(cleanup, created.ID, container.RemoveOptions{Force: true, RemoveVolumes: true})
+	}()
+	if _, err = cli.ContainerStatPath(ctx, created.ID, "/app/.1panel-feishu-bundled-v1"); err != nil {
+		return "", buserr.New("ErrFeishuImageRequired")
+	}
+	return info.ID, nil
+}
+
+func feishuContainerImage(name string) (string, error) {
+	cli, err := docker.NewDockerClient()
+	if err != nil {
+		return "", err
+	}
+	defer cli.Close()
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+	info, err := cli.ContainerInspect(ctx, name)
+	if err != nil {
+		return "", err
+	}
+	return info.Image, nil
+}
+
+// The original state is read-only and the normal Doctor entrypoint is bypassed.
+func validateFeishuImageConfig(image, configPath string) error {
+	info, err := os.Stat(configPath)
+	if err != nil {
+		return err
+	}
+	uid, gid := uint32(1000), uint32(1000)
+	if stat, ok := info.Sys().(*syscall.Stat_t); ok {
+		uid, gid = stat.Uid, stat.Gid
+	}
+	user := fmt.Sprintf("%d:%d", uid, gid)
+	tmpfs := fmt.Sprintf("/tmp:rw,mode=0700,uid=%d,gid=%d", uid, gid)
+	name := "1panel-feishu-" + strings.TrimSuffix(filepath.Base(configPath), ".json")
+	mgr := cmd.NewCommandMgr(cmd.WithTimeout(2 * time.Minute))
+	defer func() { _ = cmd.NewCommandMgr(cmd.WithTimeout(15*time.Second)).Run("docker", "rm", "-f", "-v", name) }()
+	out, runErr := mgr.RunWithStdout("docker", "run", "--name", name, "--rm", "--network", "none", "--read-only", "--user", user,
+		"--tmpfs", tmpfs,
+		"--mount", "type=bind,src="+filepath.Dir(configPath)+",dst=/home/node/.openclaw,readonly",
+		"--env", "HOME=/home/node", "--env", "TMPDIR=/tmp", "--env", "OPENCLAW_STATE_DIR=/tmp/state",
+		"--env", "OPENCLAW_CONFIG_PATH=/home/node/.openclaw/"+filepath.Base(configPath),
+		"--entrypoint", "sh", image, "-c", "mkdir -m 700 /tmp/state && ln -s /home/node/.openclaw/extensions /tmp/state/extensions && exec node /app/openclaw.mjs config validate --json")
+	return feishuValidationResult(out, runErr)
+}
+
+func feishuValidationResult(out string, runErr error) error {
+	raw, _ := extractEmbeddedJSON(out)
+	var result struct {
+		Valid  bool `json:"valid"`
+		Issues []struct {
+			Path string `json:"path"`
+		} `json:"issues"`
+	}
+	if json.Unmarshal(raw, &result) == nil && result.Valid && runErr == nil {
+		return nil
+	}
+	fields := []string{}
+	for _, issue := range result.Issues {
+		if issue.Path != "" {
+			fields = append(fields, issue.Path)
+		}
+	}
+	if len(fields) == 0 {
+		fields = append(fields, "openclaw.json")
+	}
+	return feishuConfigError(strings.Join(fields, ", "))
+}
+
+func backupFeishuConfig(configPath string, original []byte) (string, error) {
+	f, err := os.CreateTemp(filepath.Dir(configPath), ".feishu-backup-*.json")
+	if err != nil {
+		return "", err
+	}
+	if _, err = f.Write(original); err == nil {
+		err = f.Sync()
+	}
+	closeErr := f.Close()
+	if err != nil {
+		return "", err
+	}
+	if closeErr != nil {
+		return "", closeErr
+	}
+	return f.Name(), nil
+}
+
+// Doctor can spend 94 seconds waiting for the previous container's owner lease.
+func waitOpenclawReady(name string) error {
+	script := `const fs=require('fs');const c=JSON.parse(fs.readFileSync('/home/node/.openclaw/openclaw.json','utf8'));const tls=c.gateway?.tls?.enabled===true;const h=require(tls?'https':'http');function check(p){const r=h.get({hostname:'127.0.0.1',port:c.gateway?.port||18789,path:p,rejectUnauthorized:false,timeout:3000},s=>{s.resume();if(s.statusCode===404&&p==='/readyz')return check('/healthz');process.exitCode=s.statusCode===200?0:1});r.on('timeout',()=>r.destroy());r.on('error',()=>process.exitCode=1)}check('/readyz')`
+	deadline := time.Now().Add(4 * time.Minute)
+	for time.Now().Before(deadline) {
+		if cmd.RunDockerExec(8*time.Second, name, "node", "-e", script) == nil {
+			return nil
+		}
+		time.Sleep(2 * time.Second)
+	}
+	return buserr.New("ErrFeishuActivation")
+}
+
+func verifyFeishuActivation(name string, enabled bool) error {
+	if err := waitOpenclawReady(name); err != nil {
+		return err
+	}
+	output, err := cmd.RunDockerExecWithStdout(time.Minute, name, "openclaw", "plugins", "list", "--json")
+	if err != nil {
+		return buserr.New("ErrFeishuActivation")
+	}
+	raw, _ := extractEmbeddedJSON(output)
+	var result struct {
+		Plugins []struct {
+			ID     string `json:"id"`
+			Status string `json:"status"`
+			Origin string `json:"origin"`
+		} `json:"plugins"`
+	}
+	if json.Unmarshal(raw, &result) != nil {
+		return buserr.New("ErrFeishuActivation")
+	}
+	found := false
+	for _, p := range result.Plugins {
+		if p.ID == "openclaw-lark" && p.Status != "disabled" {
+			return buserr.New("ErrFeishuActivation")
+		}
+		if p.ID == "feishu" && p.Origin == "bundled" && (p.Status == "loaded" || (!enabled && p.Status == "disabled")) {
+			found = true
+		}
+	}
+	if !found {
+		return buserr.New("ErrFeishuActivation")
+	}
+	health, err := cmd.RunDockerExecWithStdout(20*time.Second, name, "openclaw", "gateway", "health", "--json")
+	if err != nil || !feishuGatewayReady(health, enabled) {
+		return buserr.New("ErrFeishuActivation")
+	}
+	return nil
+}
+
+func readFeishuConfigBytes(file string) ([]byte, map[string]interface{}, error) {
+	info, err := os.Lstat(file)
+	if err != nil {
+		return nil, nil, err
+	}
+	if !info.Mode().IsRegular() {
+		return nil, nil, feishuConfigError("openclaw.json")
+	}
+	f, err := os.Open(file)
+	if err != nil {
+		return nil, nil, err
+	}
+	defer f.Close()
+	raw, err := io.ReadAll(f)
+	if err != nil {
+		return nil, nil, err
+	}
+	var conf map[string]interface{}
+	if err = json.Unmarshal(raw, &conf); err != nil || conf == nil {
+		return nil, nil, feishuConfigError("openclaw.json")
+	}
+	return raw, conf, nil
+}

agent/app/service/agents_hermes_channels.go

@@ -8,11 +8,15 @@ import (
 )
 
 const hermesWeixinLoginScript = `import asyncio
-from gateway.platforms.weixin import qr_login
+try:
+    from plugins.platforms.weixin.adapter import qr_login
+except ModuleNotFoundError as exc:
+    if exc.name not in ('plugins', 'plugins.platforms', 'plugins.platforms.weixin', 'plugins.platforms.weixin.adapter'):
+        raise
+    from gateway.platforms.weixin import qr_login
 from hermes_cli.config import save_env_value
 
 creds = asyncio.run(qr_login('/opt/data'))
-print('RESULT =', creds)
 
 if not creds:
     raise SystemExit(1)

agent/app/service/agents_local.go

@@ -0,0 +1,202 @@
+package service
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/app/repo"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	terminalai "github.com/1Panel-dev/1Panel/agent/utils/terminal/ai"
+	"gorm.io/gorm"
+)
+
+func SyncLocalModelAccount(install model.AppInstall, accountID uint, baseURL string, models []dto.AgentAccountModel, updateBaseURL, createIfMissing bool) (*model.AgentAccount, error) {
+	if install.ID == 0 || (install.App.Key != "ollama" && install.App.Key != "vllm") {
+		return nil, fmt.Errorf("invalid local model installation")
+	}
+	agentAccountMutationMu.Lock()
+	defer agentAccountMutationMu.Unlock()
+	account, err := agentAccountRepo.GetFirst(repo.WithByAppInstallID(install.ID))
+	if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, err
+	}
+	if errors.Is(err, gorm.ErrRecordNotFound) && accountID != 0 {
+		account, err = agentAccountRepo.GetFirst(repo.WithByID(accountID), repo.WithByProvider(install.App.Key))
+		if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, err
+		}
+		if err == nil && account.AppInstallID != 0 && account.AppInstallID != install.ID {
+			return nil, fmt.Errorf("model account belongs to another installation")
+		}
+	}
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		if !createIfMissing {
+			return nil, nil
+		}
+		name := install.Name
+		for suffix := 1; ; suffix++ {
+			existing, err := agentAccountRepo.List(repo.WithByProvider(install.App.Key), repo.WithByName(name))
+			if err != nil {
+				return nil, err
+			}
+			if len(existing) == 0 {
+				break
+			}
+			name = fmt.Sprintf("%s-%d", install.Name, suffix)
+		}
+		apiType, apiKey := "openai-completions", "vllm-local"
+		if install.App.Key == "ollama" {
+			apiType, apiKey = "openai-responses", "ollama-local"
+		}
+		account = &model.AgentAccount{Name: name, Provider: install.App.Key, BaseURL: baseURL, APIType: apiType, APIKey: apiKey, RememberAPIKey: true, Verified: true}
+	}
+	accountChanged := account.ID == 0 || account.AppInstallID != install.ID || (updateBaseURL && account.BaseURL != baseURL)
+	account.AppInstallID = install.ID
+	if updateBaseURL {
+		account.BaseURL = baseURL
+	}
+	rows := make([]model.AgentAccountModel, 0, len(models))
+	verifyModelExists := account.VerifyModel == ""
+	for _, item := range models {
+		rows = append(rows, model.AgentAccountModel{Model: item.ID, Name: item.Name})
+		if item.ID == account.VerifyModel {
+			verifyModelExists = true
+		}
+	}
+	if !verifyModelExists {
+		account.VerifyModel = ""
+		accountChanged = true
+	}
+	var previous []model.AgentAccountModel
+	if account.ID != 0 {
+		previous, err = agentAccountModelRepo.List(repo.WithByAccountID(account.ID), repo.WithOrderAsc("sort_order"), repo.WithOrderAsc("id"))
+		if err != nil {
+			return nil, err
+		}
+	}
+	modelsChanged := len(previous) != len(rows)
+	if !modelsChanged {
+		for i := range rows {
+			if previous[i].Model != rows[i].Model || previous[i].Name != rows[i].Name {
+				modelsChanged = true
+				break
+			}
+		}
+	}
+	if modelsChanged {
+		err = agentAccountRepo.SaveLocal(account, rows)
+	} else if accountChanged {
+		err = agentAccountRepo.Save(account)
+	} else {
+		return account, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	terminalai.InvalidateTerminalRuntimeCache()
+	terminalai.InvalidateFileAIRuntimeCache()
+	return account, nil
+}
+
+func SyncOllamaModelAccount(createIfMissing bool) error {
+	app, err := appRepo.GetFirst(appRepo.WithKey("ollama"))
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	install, err := appInstallRepo.GetFirst(appInstallRepo.WithAppId(app.ID))
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	if !install.SyncModelAccount {
+		return nil
+	}
+	return syncOllamaModelAccount(install, fmt.Sprintf("http://%s:11434/v1", install.ContainerName), false, createIfMissing)
+}
+
+func syncOllamaModelAccount(install model.AppInstall, baseURL string, updateBaseURL, createIfMissing bool) error {
+	models, err := aiRepo.List(repo.WithByStatus(constant.StatusSuccess), repo.WithOrderAsc("name"))
+	if err != nil {
+		return err
+	}
+	items := make([]dto.AgentAccountModel, 0, len(models))
+	for _, item := range models {
+		items = append(items, dto.AgentAccountModel{ID: item.Name, Name: item.Name})
+	}
+	_, err = SyncLocalModelAccount(install, 0, baseURL, items, updateBaseURL, createIfMissing)
+	return err
+}
+
+func loadOllamaModelAccountAddress(install model.AppInstall) (string, string, error) {
+	addressType := install.ModelAccountBaseURLType
+	if addressType == "" {
+		addressType = "container"
+	}
+	account, err := agentAccountRepo.GetFirst(repo.WithByAppInstallID(install.ID), repo.WithByProvider("ollama"))
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return addressType, install.ModelAccountBaseURL, nil
+	}
+	if err != nil {
+		return "", "", err
+	}
+	if addressType != "custom" {
+		expectedURL, err := ResolveLocalModelAccountBaseURL(addressType, "", install.ContainerName, "11434", install.HttpPort)
+		if err != nil {
+			return "", "", err
+		}
+		if strings.TrimRight(account.BaseURL, "/") != expectedURL {
+			addressType = "custom"
+		}
+	}
+	return addressType, account.BaseURL, nil
+}
+
+func CleanupLocalModelAccount(installID uint) {
+	if installID == 0 {
+		return
+	}
+	accounts, err := agentAccountRepo.List(repo.WithByAppInstallID(installID))
+	if err != nil {
+		global.LOG.Errorf("load local model accounts: %v", err)
+		return
+	}
+	for _, account := range accounts {
+		if err := (AgentService{}).DeleteAccount(dto.AgentAccountDeleteReq{ID: account.ID}); err != nil {
+			global.LOG.Warnf("keep local model account %d after uninstall: %v", account.ID, err)
+		}
+	}
+}
+
+func ResolveLocalModelAccountBaseURL(addressType, customURL, containerName, containerPort string, hostPort int) (string, error) {
+	switch addressType {
+	case "custom":
+		baseURL := strings.TrimRight(strings.TrimSpace(customURL), "/")
+		if !strings.HasPrefix(baseURL, "http://") && !strings.HasPrefix(baseURL, "https://") {
+			return "", fmt.Errorf("model account base URL must start with http:// or https://")
+		}
+		return baseURL, nil
+	case "localhost":
+		return fmt.Sprintf("http://127.0.0.1:%d/v1", hostPort), nil
+	case "systemIP":
+		systemIP, err := settingRepo.GetValueByKey("SystemIP")
+		if err != nil {
+			return "", err
+		}
+		systemIP = strings.TrimSpace(systemIP)
+		if systemIP == "" {
+			systemIP = "127.0.0.1"
+		}
+		return fmt.Sprintf("http://%s:%d/v1", systemIP, hostPort), nil
+	default:
+		return fmt.Sprintf("http://%s:%s/v1", containerName, containerPort), nil
+	}
+}

agent/app/service/agents_minimax_test.go

@@ -0,0 +1,115 @@
+package service
+
+import (
+	"encoding/json"
+	"path/filepath"
+	"reflect"
+	"testing"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	providercatalog "github.com/1Panel-dev/1Panel/agent/app/provider"
+)
+
+func TestMiniMaxOpenclawModelMetadata(t *testing.T) {
+	for _, provider := range []string{"minimax", "custom", "bailian-coding-plan"} {
+		for _, protocol := range []string{"anthropic-messages", "openai-completions"} {
+			for _, id := range []string{"MiniMax-M3.1-Flash", "MiniMax-M3", "MiniMax-M2.7", "MiniMax-M2.5", "saved-custom"} {
+				t.Run(provider+"/"+protocol+"/"+id, func(t *testing.T) {
+					account := &model.AgentAccount{Provider: provider, APIType: protocol, BaseURL: "https://example.test/v1", APIKey: "test-key"}
+					_, entry, _, _, err := buildOpenclawAccountModelConfig(account, dto.AgentAccountModel{ID: id, Name: "Saved name"})
+					if err != nil {
+						t.Fatal(err)
+					}
+					payload, err := json.Marshal(entry)
+					if err != nil {
+						t.Fatal(err)
+					}
+					var actual modelEntry
+					if err := json.Unmarshal(payload, &actual); err != nil {
+						t.Fatal(err)
+					}
+					if actual.ID != id || actual.Name != "Saved name" {
+						t.Fatalf("changed saved identity: %s", payload)
+					}
+					if provider == "minimax" && id == "MiniMax-M3.1-Flash" {
+						if actual.ContextWindow != 1000000 || actual.MaxTokens != 524288 || !reflect.DeepEqual(actual.Input, []string{"text", "image"}) {
+							t.Fatalf("incorrect direct Flash metadata: %s", payload)
+						}
+					} else if actual.ContextWindow != 0 || actual.MaxTokens != 0 {
+						t.Fatalf("changed existing/gateway limits: %s", payload)
+					}
+				})
+			}
+		}
+	}
+}
+
+func TestMiniMaxPreservesSavedOpenclawMetadata(t *testing.T) {
+	current := &modelsConfig{Mode: "merge", Providers: map[string]modelProvider{
+		"minimax": {Models: []modelEntry{{ID: "MiniMax-M3.1-Flash", Input: []string{"text"}, ContextWindow: 32000, MaxTokens: 4096}}},
+	}}
+	conf := map[string]interface{}{}
+	if err := applyOpenclawModelsConfig(conf, current); err != nil {
+		t.Fatal(err)
+	}
+	next := &modelsConfig{Mode: "merge", Providers: map[string]modelProvider{
+		"minimax": {Models: []modelEntry{{ID: "MiniMax-M3.1-Flash", Input: []string{"text", "image"}, ContextWindow: 1000000, MaxTokens: 524288}}},
+	}}
+	preserveOpenclawModelMetadata(conf, next)
+	if !reflect.DeepEqual(next.Providers["minimax"].Models, current.Providers["minimax"].Models) {
+		t.Fatalf("saved metadata changed: %+v", next)
+	}
+}
+
+func TestMiniMaxDefaultAccountRequest(t *testing.T) {
+	for _, protocol := range []string{"anthropic-messages", "openai-completions"} {
+		account := &model.AgentAccount{Provider: "minimax", APIType: protocol}
+		models, err := buildInitialAgentAccountModels(account, nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		selected, err := resolveAgentAccountVerifyModel("minimax", "", models)
+		if err != nil || selected != "MiniMax-M3.1-Flash" || len(models) != 2 || models[1].ID != "MiniMax-M3" {
+			t.Fatalf("unexpected default: %s, %+v, %v", selected, models, err)
+		}
+		request := providercatalog.BuildVerifyRequest("minimax", protocol, "", "https://example.test", "test-key", selected)
+		var body map[string]interface{}
+		if err := json.Unmarshal(request.Body, &body); err != nil || body["model"] != selected {
+			t.Fatalf("default request: %s, %v", request.Body, err)
+		}
+	}
+}
+
+func TestMiniMaxHermesConfiguration(t *testing.T) {
+	for _, protocol := range []string{"anthropic-messages", "openai-completions"} {
+		for _, id := range []string{"MiniMax-M3.1-Flash", "MiniMax-M3", "MiniMax-M2.7", "my-custom-model"} {
+			dir := t.TempDir()
+			account := &model.AgentAccount{Provider: "minimax", APIType: protocol, BaseURL: "https://api.minimaxi.com/anthropic", APIKey: "test-key"}
+			if err := writeHermesConfig(dir, account, id, ""); err != nil {
+				t.Fatal(err)
+			}
+			conf, err := readHermesConfig(filepath.Join(dir, "config.yaml"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if conf.Model.Default != id || conf.Model.Provider != "minimax-cn" || conf.Model.BaseURL != account.BaseURL {
+				t.Fatalf("changed Hermes selection: %+v", conf.Model)
+			}
+		}
+	}
+}
+
+func TestMiniMaxExplicitAccountModels(t *testing.T) {
+	for _, provider := range []string{"minimax", "bailian-coding-plan", "custom"} {
+		account := &model.AgentAccount{Provider: provider, APIType: "openai-completions"}
+		requested := []dto.AgentAccountModel{{ID: "MiniMax-M2.5", Name: "Saved legacy"}, {ID: "my-custom-model", Name: "Saved custom"}}
+		actual, err := buildInitialAgentAccountModels(account, requested)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !reflect.DeepEqual(actual, requested) {
+			t.Fatalf("changed explicit %s models: %+v", provider, actual)
+		}
+	}
+}

agent/app/service/agents_native.go

@@ -0,0 +1,69 @@
+package service
+
+import (
+	"net"
+	"regexp"
+	"strings"
+	"unicode"
+	"unicode/utf8"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+)
+
+var deepSeekUsernamePattern = regexp.MustCompile(`^[A-Za-z0-9._-]+$`)
+var deepSeekHostLabelPattern = regexp.MustCompile(`^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$`)
+
+func isDeepSeekAccessHost(value string) bool {
+	if ip := net.ParseIP(value); ip != nil {
+		return ip.To4() != nil && !strings.Contains(value, ":")
+	}
+	if value == "" || len(value) > 253 || strings.Trim(value, "0123456789.") == "" {
+		return false
+	}
+	for _, label := range strings.Split(value, ".") {
+		if !deepSeekHostLabelPattern.MatchString(label) {
+			return false
+		}
+	}
+	return true
+}
+
+func validateNativeAgentCreate(req dto.AgentCreateReq) error {
+	if req.AgentType != constant.AppDeepSeekHarness && req.AgentType != constant.AppOctop {
+		return nil
+	}
+	if strings.TrimSpace(req.DashboardUsername) == "" || strings.ContainsAny(req.DashboardUsername, "\r\n\x00") {
+		return buserr.WithDetail("ErrInvalidParams", "dashboardUsername", nil)
+	}
+	if strings.ContainsAny(req.DashboardPassword, "\r\n\x00") || req.DashboardPassword != strings.TrimSpace(req.DashboardPassword) {
+		return buserr.WithDetail("ErrInvalidParams", "dashboardPassword", nil)
+	}
+	if req.AgentType == constant.AppDeepSeekHarness {
+		if !isDeepSeekAccessHost(req.AccessHost) {
+			return buserr.WithDetail("ErrInvalidParams", "accessHost", nil)
+		}
+		if !deepSeekUsernamePattern.MatchString(req.DashboardUsername) {
+			return buserr.WithDetail("ErrInvalidParams", "dashboardUsername", nil)
+		}
+		if utf8.RuneCountInString(req.DashboardPassword) < 12 {
+			return buserr.WithDetail("ErrInvalidParams", "dashboardPassword", nil)
+		}
+		return nil
+	}
+	hasLetter, hasDigit := false, false
+	for _, char := range req.DashboardPassword {
+		hasLetter = hasLetter || unicode.IsLetter(char)
+		hasDigit = hasDigit || unicode.IsDigit(char)
+	}
+	if utf8.RuneCountInString(req.DashboardPassword) < 8 || !hasLetter || !hasDigit {
+		return buserr.WithDetail("ErrInvalidParams", "dashboardPassword", nil)
+	}
+	switch strings.ToLower(req.DashboardPassword) {
+	case "password", "password1", "password12", "password123", "12345678", "123456789", "qwerty123",
+		"admin123", "welcome1", "letmein1", "changeme1", "octop123", "abc12345", "iloveyou1":
+		return buserr.WithDetail("ErrInvalidParams", "dashboardPassword", nil)
+	}
+	return nil
+}

agent/app/service/agents_plugins.go

@@ -107,6 +107,9 @@ func (a AgentService) InstallMarketPlugin(req dto.AgentPluginMarketInstallReq) e
 	if err != nil {
 		return err
 	}
+	if isOpenclawBundledFeishuVersion(install.Version) && (strings.TrimSpace(req.Package) == "@larksuite/openclaw-lark" || strings.TrimSpace(req.Package) == "@openclaw/feishu") {
+		return buserr.New("ErrFeishuManaged")
+	}
 	if err := task.CheckScopeTaskIsExecuting(task.TaskScopeAI, req.AgentID); err != nil {
 		return err
 	}
@@ -132,6 +135,9 @@ func (a AgentService) OperatePlugin(req dto.AgentPluginOperateReq) error {
 	if err != nil {
 		return err
 	}
+	if isOpenclawBundledFeishuVersion(install.Version) && (req.PluginID == "openclaw-lark" || req.PluginID == "feishu") {
+		return buserr.New("ErrFeishuManaged")
+	}
 	if err := task.CheckScopeTaskIsExecuting(task.TaskScopeAI, req.AgentID); err != nil {
 		return err
 	}

agent/app/service/agents_utils.go

@@ -98,7 +98,7 @@ func ensureContainerRunning(containerName string) error {
 	return nil
 }
 
-func resolveAgentAccountInput(provider, apiType, authMode, apiKey, baseURL, modelID string, validateAvailability bool) (resolvedAgentAccountInput, error) {
+func resolveAgentAccountInput(provider, apiType, authMode, apiKey, baseURL, modelID string, validateAvailability, allowEmptyModel bool) (resolvedAgentAccountInput, error) {
 	resolvedAPIKey := strings.TrimSpace(apiKey)
 	resolvedAPIType := strings.TrimSpace(apiType)
 	resolvedAuthMode, err := providercatalog.ResolveAuthMode(provider, resolvedAPIType, authMode)
@@ -113,7 +113,7 @@ func resolveAgentAccountInput(provider, apiType, authMode, apiKey, baseURL, mode
 		return resolvedAgentAccountInput{}, err
 	}
 	modelID = strings.TrimSpace(modelID)
-	if modelID == "" {
+	if modelID == "" && !allowEmptyModel {
 		return resolvedAgentAccountInput{}, buserr.New("ErrAgentAccountModelsRequired")
 	}
 	imageAPI := providercatalog.IsImageAPIType(resolvedAPIType)
@@ -148,6 +148,10 @@ func readOpenclawConfig(configPath string) (map[string]interface{}, error) {
 }
 
 func writeOpenclawConfigRaw(configPath string, conf map[string]interface{}) error {
+	if _, busy := feishuSwitches.LoadOrStore(configPath, true); busy {
+		return buserr.New("TaskIsExecuting")
+	}
+	defer feishuSwitches.Delete(configPath)
 	ensureGatewaySecurityDefaults(conf)
 	ensureOpenclawUpdateDefaults(conf)
 	payload, err := json.MarshalIndent(conf, "", "  ")
@@ -415,6 +419,15 @@ func buildAgentItem(agent *model.Agent, appInstall *model.AppInstall, envMap map
 		} else {
 			item.WebUIPort = appInstall.HttpPort
 		}
+		if agentType == constant.AppDeepSeekHarness {
+			item.WebUIPort = appInstall.HttpsPort
+			if values, err := readAgentEnvMap(appInstall.GetEnvPath()); err == nil {
+				accessHost := values["HTTPS_ACCESS_HOST"]
+				if isDeepSeekAccessHost(accessHost) {
+					item.AccessHost = accessHost
+				}
+			}
+		}
 		item.Path = appInstall.GetPath()
 		item.Status = appInstall.Status
 		item.Message = appInstall.Message
@@ -442,7 +455,8 @@ func localizedAgentProviderName(provider string) string {
 }
 
 func isAgentAppKey(appKey string) bool {
-	return appKey == constant.AppOpenclaw || appKey == constant.AppCopaw || appKey == constant.AppHermesAgent
+	return appKey == constant.AppOpenclaw || appKey == constant.AppCopaw || appKey == constant.AppHermesAgent ||
+		appKey == constant.AppDeepSeekHarness || appKey == constant.AppOctop
 }
 
 func isOpenclawLegacyHTTPVersion(version string) bool {
@@ -1253,7 +1267,12 @@ func buildOpenclawAccountModelConfig(account *model.AgentAccount, model dto.Agen
 	if err != nil {
 		return "", modelEntry{}, "", modelProvider{}, err
 	}
-	return providerPatch.PrimaryModel, buildOpenclawModelEntry(providerPatch.ModelID, model), providerPatch.ProviderKey, modelProvider{
+	entry := buildOpenclawModelEntry(providerPatch.ModelID, model)
+	if account.Provider == "minimax" && providerPatch.ModelID == "MiniMax-M3.1-Flash" {
+		entry.ContextWindow = 1000000
+		entry.MaxTokens = 524288
+	}
+	return providerPatch.PrimaryModel, entry, providerPatch.ProviderKey, modelProvider{
 		ApiKey:     providerPatch.APIKey,
 		BaseUrl:    providerPatch.BaseURL,
 		Api:        providerPatch.APIType,
@@ -1641,6 +1660,10 @@ func agentDashboardAuthEnvKeys(agentType string) (string, string, bool) {
 		return hermesDashboardUsernameEnvKey, hermesDashboardPasswordEnvKey, true
 	case constant.AppCopaw:
 		return qwenPawAuthUsernameEnvKey, qwenPawAuthPasswordEnvKey, true
+	case constant.AppDeepSeekHarness:
+		return "DSH_AUTH_USERNAME", "DSH_AUTH_PASSWORD", true
+	case constant.AppOctop:
+		return "OCTOP_ADMIN_USERNAME", "OCTOP_DEFAULT_PASSWORD", true
 	default:
 		return "", "", false
 	}

agent/app/service/ai.go

@@ -8,6 +8,7 @@ import (
 	"os/exec"
 	"path"
 	"strings"
+	"sync"
 	"syscall"
 	"time"
 
@@ -28,13 +29,15 @@ import (
 
 type AIToolService struct{}
 
+var ollamaModelMu sync.Mutex
+
 type IAIToolService interface {
 	Search(search dto.SearchWithPage) (int64, []dto.OllamaModelInfo, error)
 	Create(req dto.OllamaModelName) error
 	Close(name string) error
 	Recreate(req dto.OllamaModelName) error
 	Delete(req dto.ForceDelete) error
-	Sync() ([]dto.OllamaModelDropList, error)
+	SyncAccount(req dto.OllamaModelAccountSync) error
 	LoadDetail(name string) (string, error)
 	BindDomain(req dto.OllamaBindDomain) error
 	GetBindDomain(req dto.OllamaBindDomainReq) (*dto.OllamaBindDomainRes, error)
@@ -46,6 +49,7 @@ func NewIAIToolService() IAIToolService {
 }
 
 func (u *AIToolService) Search(req dto.SearchWithPage) (int64, []dto.OllamaModelInfo, error) {
+	syncErr := syncOllamaModels()
 	var options []repo.DBOption
 	if len(req.Info) != 0 {
 		options = append(options, repo.WithByLikeName(req.Info))
@@ -60,6 +64,11 @@ func (u *AIToolService) Search(req dto.SearchWithPage) (int64, []dto.OllamaModel
 		if err := copier.Copy(&item, &itemModel); err != nil {
 			return 0, nil, buserr.WithDetail("ErrStructTransform", err.Error(), nil)
 		}
+		if syncErr != nil && item.Status != constant.StatusWaiting {
+			item.Status = constant.StatusUnknown
+			item.Message = syncErr.Error()
+			item.Size = ""
+		}
 		taskModel, _ := taskRepo.GetFirst(taskRepo.WithResourceID(item.ID), repo.WithByType(task.TaskScopeAI))
 		if len(taskModel.ID) != 0 {
 			item.LogFileExist = true
@@ -85,6 +94,8 @@ func (u *AIToolService) LoadDetail(name string) (string, error) {
 }
 
 func (u *AIToolService) Create(req dto.OllamaModelName) error {
+	ollamaModelMu.Lock()
+	defer ollamaModelMu.Unlock()
 	if cmd.CheckIllegal(req.Name) {
 		return buserr.New("ErrCmdIllegal")
 	}
@@ -125,6 +136,9 @@ func (u *AIToolService) Create(req dto.OllamaModelName) error {
 		if err := taskItem.Execute(); err != nil {
 			_ = aiRepo.Update(info.ID, map[string]interface{}{"status": constant.StatusFailed, "message": err.Error()})
 		}
+		if err := SyncOllamaModelAccount(false); err != nil {
+			global.LOG.Errorf("sync Ollama model account after pull: %v", err)
+		}
 	}()
 	return nil
 }
@@ -144,6 +158,8 @@ func (u *AIToolService) Close(name string) error {
 }
 
 func (u *AIToolService) Recreate(req dto.OllamaModelName) error {
+	ollamaModelMu.Lock()
+	defer ollamaModelMu.Unlock()
 	if cmd.CheckIllegal(req.Name) {
 		return buserr.New("ErrCmdIllegal")
 	}
@@ -179,11 +195,16 @@ func (u *AIToolService) Recreate(req dto.OllamaModelName) error {
 		if err := taskItem.Execute(); err != nil {
 			_ = aiRepo.Update(modelInfo.ID, map[string]interface{}{"status": constant.StatusFailed, "message": err.Error()})
 		}
+		if err := SyncOllamaModelAccount(false); err != nil {
+			global.LOG.Errorf("sync Ollama model account after pull: %v", err)
+		}
 	}()
 	return nil
 }
 
 func (u *AIToolService) Delete(req dto.ForceDelete) error {
+	ollamaModelMu.Lock()
+	defer ollamaModelMu.Unlock()
 	ollamaList, _ := aiRepo.List(repo.WithByIDs(req.IDs))
 	if len(ollamaList) == 0 {
 		return buserr.New("ErrRecordNotFound")
@@ -202,55 +223,28 @@ func (u *AIToolService) Delete(req dto.ForceDelete) error {
 		logItem := path.Join(global.Dir.DataDir, "log", "AITools", item.Name)
 		_ = os.Remove(logItem)
 	}
-	return nil
+	return SyncOllamaModelAccount(false)
 }
 
-func (u *AIToolService) Sync() ([]dto.OllamaModelDropList, error) {
-	containerName, err := LoadContainerName()
+func (u *AIToolService) SyncAccount(req dto.OllamaModelAccountSync) error {
+	install, err := appInstallRepo.GetFirst(repo.WithByID(req.ID))
 	if err != nil {
-		return nil, err
+		return err
 	}
-	stdout, err := cmd.RunDockerExecWithStdout(20*time.Second, containerName, "ollama", "list")
+	if install.App.Key != "ollama" {
+		return buserr.New("ErrInvalidParams")
+	}
+	baseURL, err := ResolveLocalModelAccountBaseURL(req.ModelAccountBaseURLType, req.ModelAccountBaseURL, install.ContainerName, "11434", install.HttpPort)
 	if err != nil {
-		return nil, err
+		return err
 	}
-	var list []model.OllamaModel
-	lines := strings.Split(stdout, "\n")
-	for _, line := range lines {
-		parts := strings.Fields(line)
-		if len(parts) < 5 {
-			continue
-		}
-		if parts[0] == "NAME" {
-			continue
-		}
-		list = append(list, model.OllamaModel{Name: parts[0], Size: parts[2] + " " + parts[3]})
+	if err := syncOllamaModelAccount(install, baseURL, true, true); err != nil {
+		return err
 	}
-	listInDB, _ := aiRepo.List()
-	var dropList []dto.OllamaModelDropList
-	for _, itemModel := range listInDB {
-		isExit := false
-		for i := 0; i < len(list); i++ {
-			if list[i].Name == itemModel.Name {
-				_ = aiRepo.Update(itemModel.ID, map[string]interface{}{"status": constant.StatusSuccess, "message": "", "size": list[i].Size})
-				list = append(list[:i], list[(i+1):]...)
-				isExit = true
-				break
-			}
-		}
-		if !isExit && itemModel.Status != constant.StatusWaiting {
-			_ = aiRepo.Update(itemModel.ID, map[string]interface{}{"status": constant.StatusDeleted, "message": "not exist", "size": ""})
-			dropList = append(dropList, dto.OllamaModelDropList{ID: itemModel.ID, Name: itemModel.Name})
-			continue
-		}
-	}
-	for _, item := range list {
-		item.Status = constant.StatusSuccess
-		item.From = "remote"
-		_ = aiRepo.Create(&item)
-	}
-
-	return dropList, nil
+	return appInstallRepo.BatchUpdateBy(map[string]interface{}{
+		"model_account_base_url_type": req.ModelAccountBaseURLType,
+		"model_account_base_url":      baseURL,
+	}, repo.WithByID(install.ID))
 }
 
 func (u *AIToolService) BindDomain(req dto.OllamaBindDomain) error {
@@ -370,6 +364,72 @@ func (u *AIToolService) UpdateBindDomain(req dto.OllamaBindDomain) error {
 	return nil
 }
 
+func syncOllamaModels() error {
+	ollamaModelMu.Lock()
+	defer ollamaModelMu.Unlock()
+	containerName, err := LoadContainerName()
+	if err != nil {
+		return err
+	}
+	stdout, err := cmd.RunDockerExecWithStdout(20*time.Second, containerName, "ollama", "list")
+	if err != nil {
+		return err
+	}
+	models := make(map[string]string)
+	lines := strings.Split(strings.TrimSpace(stdout), "\n")
+	if len(lines) == 0 || !strings.HasPrefix(strings.TrimSpace(lines[0]), "NAME") {
+		return fmt.Errorf("invalid ollama list output: %s", stdout)
+	}
+	for _, line := range lines[1:] {
+		if strings.TrimSpace(line) == "" {
+			continue
+		}
+		parts := strings.Fields(line)
+		if len(parts) < 5 {
+			return fmt.Errorf("invalid ollama model entry: %s", line)
+		}
+		models[parts[0]] = parts[2] + " " + parts[3]
+	}
+	list, err := aiRepo.List()
+	if err != nil {
+		return err
+	}
+	known := make(map[string]bool, len(list))
+	for _, item := range list {
+		name := item.Name
+		if !strings.Contains(path.Base(name), ":") {
+			name += ":latest"
+		}
+		size, exists := models[name]
+		known[name] = true
+		if item.Status == constant.StatusWaiting {
+			continue
+		}
+		status, message := constant.StatusSuccess, ""
+		if !exists {
+			if item.Status == constant.StatusFailed || item.Status == constant.StatusCanceled {
+				continue
+			}
+			status, message = constant.StatusDeleted, "not exist"
+		}
+		if item.Status != status || item.Size != size || item.Message != message {
+			if err := aiRepo.Update(item.ID, map[string]interface{}{"status": status, "size": size, "message": message}); err != nil {
+				return err
+			}
+		}
+	}
+	for name, size := range models {
+		if known[name] {
+			continue
+		}
+		item := model.OllamaModel{Name: name, Size: size, From: "remote", Status: constant.StatusSuccess}
+		if err := aiRepo.Create(&item); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 func LoadContainerName() (string, error) {
 	ollamaBaseInfo, err := appInstallRepo.LoadBaseInfo("ollama", "")
 	if err != nil {
@@ -387,12 +447,12 @@ func loadModelSize(name string, containerName string) (string, error) {
 		return "", err
 	}
 	lines := strings.Split(stdout, "\n")
+	if !strings.Contains(path.Base(name), ":") {
+		name += ":latest"
+	}
 	for _, line := range lines {
-		if !strings.Contains(line, name) {
-			continue
-		}
 		parts := strings.Fields(line)
-		if len(parts) < 5 {
+		if len(parts) < 5 || parts[0] != name {
 			continue
 		}
 		return parts[2] + " " + parts[3], nil

agent/app/service/ai_benchmark.go

@@ -0,0 +1,209 @@
+package service
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"os"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/utils/docker"
+	"github.com/mattn/go-shellwords"
+)
+
+func AIBenchmarkSources(kind, selected string) ([]dto.AIBenchmarkSource, error) {
+	if kind != "vllm" && kind != "ollama" {
+		return nil, errors.New("unsupported benchmark source")
+	}
+	selectedID := strings.SplitN(selected, ":", 2)[0]
+	type instance struct {
+		id              uint
+		name, container string
+		port            int
+	}
+	instances := []instance{}
+	apps, err := appRepo.GetBy(appRepo.WithKey(kind))
+	if err != nil {
+		return nil, err
+	}
+	for _, app := range apps {
+		installs, err := appInstallRepo.ListBy(context.Background(), appInstallRepo.WithAppId(app.ID))
+		if err != nil {
+			return nil, err
+		}
+		for _, install := range installs {
+			if selected != "" && strconv.FormatUint(uint64(install.ID), 10) != selectedID {
+				continue
+			}
+			instances = append(instances, instance{id: install.ID, name: install.Name, container: install.ContainerName, port: install.HttpPort})
+		}
+	}
+	results := []dto.AIBenchmarkSource{}
+	if len(instances) == 0 {
+		return results, nil
+	}
+	client, err := docker.NewDockerClient()
+	if err != nil {
+		return nil, err
+	}
+	defer client.Close()
+	if !strings.HasPrefix(client.DaemonHost(), "unix://") {
+		return nil, errors.New("benchmark shortcuts require a Docker daemon on the main node; enter the remote service address manually")
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+	for _, instance := range instances {
+		base := dto.AIBenchmarkSource{Kind: kind, Name: instance.name, Endpoint: "/v1/chat/completions", Models: []string{}, Status: "unknown"}
+		inspected, err := client.ContainerInspect(ctx, instance.container)
+		if err != nil {
+			base.ID = strconv.FormatUint(uint64(instance.id), 10)
+			base.Message = "container inspection unavailable"
+			results = append(results, base)
+			continue
+		}
+		if inspected.State != nil {
+			base.Status = inspected.State.Status
+		}
+		args := []string{}
+		if inspected.Config != nil {
+			args = append(args, inspected.Config.Entrypoint...)
+			args = append(args, inspected.Config.Cmd...)
+		}
+		if len(args) >= 3 && (args[0] == "sh" || args[0] == "bash" || strings.HasSuffix(args[0], "/sh") || strings.HasSuffix(args[0], "/bash")) && args[1] == "-c" {
+			parser := shellwords.NewParser()
+			parser.ParseEnv = false
+			parser.ParseBacktick = false
+			if parsed, err := parser.Parse(args[2]); err == nil {
+				args = parsed
+			}
+		}
+		flags := map[string]string{}
+		for i, arg := range args {
+			if key, value, ok := strings.Cut(arg, "="); ok && strings.HasPrefix(key, "--") {
+				flags[key] = value
+			} else if strings.HasPrefix(arg, "--") && i+1 < len(args) && !strings.HasPrefix(args[i+1], "--") {
+				flags[arg] = args[i+1]
+			}
+		}
+		if name := flags["--served-model-name"]; name != "" {
+			base.Models = []string{name}
+		}
+		tokenizer := flags["--tokenizer"]
+		if tokenizer == "" {
+			tokenizer = flags["--model"]
+			for i, arg := range args {
+				if tokenizer == "" && arg == "serve" && i+1 < len(args) && !strings.HasPrefix(args[i+1], "-") {
+					tokenizer = args[i+1]
+				}
+			}
+		}
+		if kind != "ollama" && tokenizer != "" {
+			if !filepath.IsAbs(tokenizer) {
+				base.Tokenizer = tokenizer
+			} else {
+				longest := 0
+				for _, mount := range inspected.Mounts {
+					relative, err := filepath.Rel(mount.Destination, tokenizer)
+					if err == nil && relative != ".." && !strings.HasPrefix(relative, ".."+string(filepath.Separator)) && len(mount.Destination) > longest {
+						candidate := filepath.Join(mount.Source, relative)
+						if info, err := os.Stat(candidate); err == nil && info.IsDir() {
+							base.Tokenizer = candidate
+							longest = len(mount.Destination)
+						}
+					}
+				}
+			}
+		}
+		ports := map[int]string{}
+		if instance.port > 0 {
+			ports[instance.port] = "127.0.0.1"
+		}
+		if inspected.NetworkSettings != nil {
+			for _, bindings := range inspected.NetworkSettings.Ports {
+				for _, binding := range bindings {
+					port, _ := strconv.Atoi(binding.HostPort)
+					if port > 0 {
+						host := binding.HostIP
+						if host == "" || host == "0.0.0.0" || host == "::" {
+							host = "127.0.0.1"
+						}
+						ports[port] = host
+					}
+				}
+			}
+		}
+		if len(ports) == 0 && inspected.HostConfig != nil && inspected.HostConfig.NetworkMode == "host" {
+			port, _ := strconv.Atoi(flags["--port"])
+			if port > 0 {
+				ports[port] = "127.0.0.1"
+			}
+		}
+		ordered := []int{}
+		for port := range ports {
+			ordered = append(ordered, port)
+		}
+		sort.Ints(ordered)
+		if len(ordered) == 0 {
+			ordered = append(ordered, 0)
+		}
+		for _, port := range ordered {
+			source := base
+			source.ID = fmt.Sprintf("%d:%d", instance.id, port)
+			if selected != "" && source.ID != selected {
+				continue
+			}
+			if port > 0 {
+				source.BaseURL = "http://" + net.JoinHostPort(ports[port], strconv.Itoa(port))
+			}
+			if selected == source.ID && source.BaseURL != "" && source.Status == "running" {
+				endpoint := "/v1/models"
+				if kind == "ollama" {
+					endpoint = "/api/tags"
+				}
+				request, err := http.NewRequestWithContext(ctx, http.MethodGet, source.BaseURL+endpoint, nil)
+				if err != nil {
+					return nil, err
+				}
+				response, err := (&http.Client{Timeout: 3 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}).Do(request)
+				if err != nil {
+					source.Message = "model list unavailable; enter the served model name"
+				} else {
+					raw, readErr := io.ReadAll(io.LimitReader(response.Body, 2*1024*1024))
+					response.Body.Close()
+					if response.StatusCode == http.StatusOK && readErr == nil {
+						var data struct {
+							Data []struct {
+								ID string `json:"id"`
+							} `json:"data"`
+							Models []struct {
+								Name string `json:"name"`
+							} `json:"models"`
+						}
+						if err := json.Unmarshal(raw, &data); err == nil {
+							source.Models = []string{}
+							for _, model := range data.Data {
+								source.Models = append(source.Models, model.ID)
+							}
+							for _, model := range data.Models {
+								source.Models = append(source.Models, model.Name)
+							}
+						}
+					} else {
+						source.Message = fmt.Sprintf("model list HTTP %d; provide model name and credentials if required", response.StatusCode)
+					}
+				}
+			}
+			results = append(results, source)
+		}
+	}
+	return results, nil
+}

agent/app/service/alert.go

@@ -74,8 +74,8 @@ type IAlertService interface {
 	GetAlertConfig(req dto.AlertConfigQuery) ([]model.AlertConfig, error)
 	PageAlertConfig(req dto.AlertConfigPageReq) (int64, []model.AlertConfig, error)
 	UpdateAlertConfig(req dto.AlertConfigUpdate, operator string) error
-	UpdateAlertConfigStatus(req dto.AlertConfigStatusUpdate, operator string) error
-	DeleteAlertConfig(id uint) error
+	UpdateAlertConfigStatus(req dto.AlertConfigStatusUpdate, operator string) (string, error)
+	DeleteAlertConfig(id uint) (string, error)
 	TestAlertConfig(req dto.AlertConfigTest) (bool, error)
 	TestCustomAlertConfig(req dto.AlertConfigTest, lang string) (dto.AlertConfigTestResult, error)
 }
@@ -623,25 +623,26 @@ func (a AlertService) updateCustomAlertConfig(req dto.AlertConfigUpdate, operato
 	})
 }
 
-func (a AlertService) UpdateAlertConfigStatus(req dto.AlertConfigStatusUpdate, operator string) error {
+func (a AlertService) UpdateAlertConfigStatus(req dto.AlertConfigStatusUpdate, operator string) (string, error) {
 	if err := validateAlertConfigStatus(req.Status); err != nil {
-		return err
+		return "", err
 	}
 	config, err := alertRepo.GetConfigById(req.ID)
 	if err != nil {
-		return err
+		return "", err
 	}
+	name := alertConfigLogName(config.Config, config.Title)
 	if req.Status == constant.AlertEnable {
 		if err := a.validateCommunityAlertConfigType(config.Type); err != nil {
-			return err
+			return name, err
 		}
 		if config.Type == constant.Custom {
 			if _, err := alertwebhook.Resolve(config); err != nil {
-				return err
+				return name, err
 			}
 		}
 	}
-	return alertRepo.UpdateAlertConfig(map[string]interface{}{
+	return name, alertRepo.UpdateAlertConfig(map[string]interface{}{
 		"status":      req.Status,
 		"update_user": operator,
 	}, repo.WithByID(req.ID))
@@ -813,19 +814,20 @@ func alertConfigSMSPhone(configData string) string {
 	return strings.TrimSpace(cfg.Phone)
 }
 
-func (a AlertService) DeleteAlertConfig(id uint) error {
-	_, err := alertRepo.GetConfigById(id)
+func (a AlertService) DeleteAlertConfig(id uint) (string, error) {
+	config, err := alertRepo.GetConfigById(id)
 	if err != nil {
-		return err
+		return "", err
 	}
+	name := alertConfigLogName(config.Config, config.Title)
 	usedAlerts, err := alertRepo.List(alertRepo.WithByAlertMethodContainsConfigID(id))
 	if err != nil {
-		return err
+		return name, err
 	}
 	if len(usedAlerts) > 0 {
-		return buserr.New("ErrAlertConfigInUse")
+		return name, buserr.New("ErrAlertConfigInUse")
 	}
-	return alertRepo.DeleteAlertConfig(repo.WithByID(id))
+	return name, alertRepo.DeleteAlertConfig(repo.WithByID(id))
 }
 
 func (a AlertService) TestAlertConfig(req dto.AlertConfigTest) (bool, error) {
@@ -1043,3 +1045,13 @@ func (a AlertService) validateCronJobAlertChannels(alertType, advanced, method s
 	_, err = a.validateAlertMethodReferences(method)
 	return err
 }
+
+func alertConfigLogName(config, title string) string {
+	var value struct {
+		DisplayName string `json:"displayName"`
+	}
+	if json.Unmarshal([]byte(config), &value) == nil && strings.TrimSpace(value.DisplayName) != "" {
+		return strings.TrimSpace(value.DisplayName)
+	}
+	return title
+}

agent/app/service/app.go

@@ -59,7 +59,8 @@ type IAppService interface {
 }
 
 type appInstallHooks struct {
-	AfterCopyData func(appInstall *model.AppInstall) error
+	AfterCopyData  func(appInstall *model.AppInstall) error
+	PrepareSiteDir func(model.App, model.AppDetail, request.AppInstallCreate, *task.Task) error
 }
 
 func NewIAppService() IAppService {
@@ -258,26 +259,35 @@ func (a AppService) GetAppDetail(appID uint, version, appType string) (response.
 		fileOp := files.NewFileOp()
 
 		versionPath := filepath.Join(app.GetAppResourcePath(), detail.Version)
-		if !fileOp.Stat(versionPath) || detail.Update {
-			if err = downloadApp(app, detail, nil, nil); err != nil && !fileOp.Stat(versionPath) {
-				return appDetailDTO, err
-			}
+		if err = downloadApp(app, detail, nil, nil); err != nil && !fileOp.Stat(versionPath) {
+			return appDetailDTO, err
+		}
+		if err == nil && app.Resource == constant.AppResourceRemote {
+			detail.Update = false
+			appDetailDTO.Update = false
 		}
 		switch app.Type {
 		case constant.RuntimePHP:
-			paramsPath := filepath.Join(versionPath, "data.yml")
-			if !fileOp.Stat(paramsPath) {
-				return appDetailDTO, buserr.WithDetail("ErrFileNotExist", paramsPath, nil)
-			}
-			param, err := fileOp.GetContent(paramsPath)
-			if err != nil {
-				return appDetailDTO, err
-			}
 			paramMap := make(map[string]interface{})
-			if err = yaml.Unmarshal(param, &paramMap); err != nil {
-				return appDetailDTO, err
+			if app.Resource == constant.AppResourceRemote {
+				if err = json.Unmarshal([]byte(detail.Params), &paramMap); err != nil {
+					return appDetailDTO, err
+				}
+				appDetailDTO.Params = paramMap
+			} else {
+				paramsPath := filepath.Join(versionPath, "data.yml")
+				if !fileOp.Stat(paramsPath) {
+					return appDetailDTO, buserr.WithDetail("ErrFileNotExist", paramsPath, nil)
+				}
+				param, err := fileOp.GetContent(paramsPath)
+				if err != nil {
+					return appDetailDTO, err
+				}
+				if err = yaml.Unmarshal(param, &paramMap); err != nil {
+					return appDetailDTO, err
+				}
+				appDetailDTO.Params = paramMap["additionalProperties"]
 			}
-			appDetailDTO.Params = paramMap["additionalProperties"]
 			composePath := filepath.Join(versionPath, "docker-compose.yml")
 			if !fileOp.Stat(composePath) {
 				return appDetailDTO, buserr.WithDetail("ErrFileNotExist", composePath, nil)
@@ -308,6 +318,12 @@ func (a AppService) GetAppDetail(appID uint, version, appType string) (response.
 	if appDetailDTO.DockerCompose == "" {
 		filename := filepath.Base(appDetailDTO.DownloadUrl)
 		dockerComposeUrl := fmt.Sprintf("%s%s", strings.TrimSuffix(appDetailDTO.DownloadUrl, filename), "docker-compose.yml")
+		if app.Resource == constant.AppResourceRemote {
+			dockerComposeUrl, err = currentAppDownloadURL(dockerComposeUrl)
+			if err != nil {
+				return appDetailDTO, err
+			}
+		}
 		statusCode, composeRes, err := req_helper.HandleRequest(dockerComposeUrl, http.MethodGet, constant.TimeOut20s)
 		if statusCode == http.StatusNotFound {
 			return appDetailDTO, buserr.New("ErrAppVersionUnavailable")
@@ -434,6 +450,12 @@ func (a AppService) installWithHooks(req request.AppInstallCreate, executeScript
 	} else {
 		if appDetail.DockerCompose == "" {
 			dockerComposeUrl := fmt.Sprintf("%s/%s/1panel/%s/%s/docker-compose.yml", global.AppRepoURL(), global.CONF.Base.Mode, app.Key, appDetail.Version)
+			if app.Resource == constant.AppResourceRemote {
+				dockerComposeUrl, err = currentAppDownloadURL(dockerComposeUrl)
+				if err != nil {
+					return
+				}
+			}
 			var statusCode int
 			statusCode, composeRes, err = req_helper.HandleRequest(dockerComposeUrl, http.MethodGet, constant.TimeOut20s)
 			if statusCode == http.StatusNotFound {
@@ -478,6 +500,22 @@ func (a AppService) installWithHooks(req request.AppInstallCreate, executeScript
 	req.Params[constant.ContainerName] = containerName
 	appInstall.ContainerName = containerName
 
+	modelAccountBaseURL := ""
+	if app.Key == "ollama" {
+		appInstall.SyncModelAccount = req.SyncModelAccount == nil || *req.SyncModelAccount
+		appInstall.ModelAccountBaseURLType = req.ModelAccountBaseURLType
+		if appInstall.ModelAccountBaseURLType == "" {
+			appInstall.ModelAccountBaseURLType = "container"
+		}
+		appInstall.ModelAccountBaseURL = req.ModelAccountBaseURL
+	}
+	if app.Key == "ollama" && appInstall.SyncModelAccount {
+		modelAccountBaseURL, err = ResolveLocalModelAccountBaseURL(req.ModelAccountBaseURLType, req.ModelAccountBaseURL, containerName, "11434", httpPort)
+		if err != nil {
+			return
+		}
+	}
+
 	index := 0
 	serviceName := ""
 	for k := range servicesMap {
@@ -577,7 +615,7 @@ func (a AppService) installWithHooks(req request.AppInstallCreate, executeScript
 			}
 		}
 		if app.Key == "openresty" {
-			if err = handleSiteDir(app, appDetail, req, t); err != nil {
+			if err = prepareAppInstallSiteDirectory(app, appDetail, req, t, hooks); err != nil {
 				return err
 			}
 			if err = handleOpenrestyFile(appInstall); err != nil {
@@ -588,6 +626,10 @@ func (a AppService) installWithHooks(req request.AppInstallCreate, executeScript
 			return err
 		}
 		updateToolApp(appInstall)
+		if app.Key == "ollama" && appInstall.SyncModelAccount {
+			_, err := SyncLocalModelAccount(*appInstall, 0, modelAccountBaseURL, nil, false, true)
+			return err
+		}
 		return nil
 	}
 

agent/app/service/app_install.go

@@ -159,6 +159,14 @@ func (a *AppInstallService) CheckExist(req request.AppInstalledInfo) (*response.
 	}
 
 	res.ContainerName = appInstall.ContainerName
+	res.ModelAccountBaseURLType = appInstall.ModelAccountBaseURLType
+	res.ModelAccountBaseURL = appInstall.ModelAccountBaseURL
+	if app.Key == "ollama" {
+		res.ModelAccountBaseURLType, res.ModelAccountBaseURL, err = loadOllamaModelAccountAddress(appInstall)
+		if err != nil {
+			return nil, err
+		}
+	}
 	res.Name = appInstall.Name
 	res.Version = appInstall.Version
 	res.CreatedAt = appInstall.CreatedAt
@@ -297,13 +305,14 @@ func (a *AppInstallService) Operate(req request.AppInstalledOperate) error {
 		return syncAppInstallStatus(&install, true)
 	case constant.Upgrade:
 		upgradeReq := request.AppInstallUpgrade{
-			InstallID:     install.ID,
-			DetailID:      req.DetailId,
-			Backup:        req.Backup,
-			PullImage:     req.PullImage,
-			DeleteImage:   req.DeleteImage,
-			DockerCompose: req.DockerCompose,
-			TaskID:        req.TaskID,
+			FeishuTransition: req.FeishuTransition,
+			InstallID:        install.ID,
+			DetailID:         req.DetailId,
+			Backup:           req.Backup,
+			PullImage:        req.PullImage,
+			DeleteImage:      req.DeleteImage,
+			DockerCompose:    req.DockerCompose,
+			TaskID:           req.TaskID,
 		}
 		return upgradeInstall(upgradeReq)
 	case constant.Reload:
@@ -438,6 +447,32 @@ func (a *AppInstallService) Update(req request.AppInstalledUpdate) error {
 		}
 	}
 
+	modelAccountBaseURL := ""
+	if installed.App.Key == "ollama" {
+		if req.SyncModelAccount != nil {
+			installed.SyncModelAccount = *req.SyncModelAccount
+		}
+		if req.ModelAccountBaseURLType != "" {
+			installed.ModelAccountBaseURLType = req.ModelAccountBaseURLType
+			installed.ModelAccountBaseURL = req.ModelAccountBaseURL
+		} else if installed.SyncModelAccount {
+			installed.ModelAccountBaseURLType, installed.ModelAccountBaseURL, err = loadOllamaModelAccountAddress(oldInstalled)
+			if err != nil {
+				return err
+			}
+		}
+		if installed.SyncModelAccount {
+			containerName := installed.ContainerName
+			if req.Advanced && req.ContainerName != "" {
+				containerName = req.ContainerName
+			}
+			modelAccountBaseURL, err = ResolveLocalModelAccountBaseURL(installed.ModelAccountBaseURLType, installed.ModelAccountBaseURL, containerName, "11434", installed.HttpPort)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
 	backupDockerCompose := installed.DockerCompose
 	if req.Advanced {
 		composeMap := make(map[string]interface{})
@@ -563,6 +598,9 @@ func (a *AppInstallService) Update(req request.AppInstalledUpdate) error {
 	if proxyChanged && website.ID != 0 && currentProxyErr != nil {
 		global.LOG.Error(buserr.WithErr("ErrUpdateBuWebsite", currentProxyErr).Error())
 	}
+	if installed.App.Key == "ollama" && installed.SyncModelAccount {
+		return syncOllamaModelAccount(installed, modelAccountBaseURL, true, true)
+	}
 	return nil
 }
 
@@ -679,6 +717,7 @@ func (a *AppInstallService) GetUpdateVersions(req request.AppUpdateVersion) ([]d
 	if err != nil {
 		return versions, err
 	}
+	var feishuLegacy, feishuConfigured, feishuChecked bool
 	details, err := appDetailRepo.GetBy(appDetailRepo.WithAppId(app.ID))
 	if err != nil {
 		return versions, err
@@ -703,10 +742,28 @@ func (a *AppInstallService) GetUpdateVersions(req request.AppUpdateVersion) ([]d
 			canUpgrade = isVllmUpgradeCandidate(install.Version, detail.Version, currentImage)
 		}
 		if canUpgrade {
+			feishuTarget := app.Key == constant.AppOpenclaw && isOpenclawBundledFeishuVersion(detail.Version)
+			if feishuTarget && !feishuChecked {
+				conf, readErr := readOpenclawConfig(path.Join(install.GetPath(), "data/conf/openclaw.json"))
+				if readErr != nil {
+					return versions, readErr
+				}
+				feishuLegacy, feishuConfigured, err = classifyLegacyFeishu(conf, install.GetPath())
+				if err != nil {
+					return versions, err
+				}
+				feishuChecked = true
+			}
 			var newCompose string
 			if req.UpdateVersion != "" && req.UpdateVersion == detail.Version && detail.DockerCompose == "" && !app.IsLocalApp() {
 				filename := filepath.Base(detail.DownloadUrl)
 				dockerComposeUrl := fmt.Sprintf("%s%s", strings.TrimSuffix(detail.DownloadUrl, filename), "docker-compose.yml")
+				if app.Resource == constant.AppResourceRemote {
+					dockerComposeUrl, err = currentAppDownloadURL(dockerComposeUrl)
+					if err != nil {
+						return versions, err
+					}
+				}
 				statusCode, composeRes, err := req_helper.HandleRequest(dockerComposeUrl, http.MethodGet, constant.TimeOut20s)
 				if statusCode == http.StatusNotFound {
 					return versions, buserr.New("ErrAppVersionUnavailable")
@@ -731,9 +788,11 @@ func (a *AppInstallService) GetUpdateVersions(req request.AppUpdateVersion) ([]d
 				}
 			}
 			versions = append(versions, dto.AppVersion{
-				Version:       detail.Version,
-				DetailId:      detail.ID,
-				DockerCompose: newCompose,
+				FeishuLegacy:     feishuTarget && feishuLegacy,
+				FeishuConfigured: feishuTarget && feishuConfigured,
+				Version:          detail.Version,
+				DetailId:         detail.ID,
+				DockerCompose:    newCompose,
 			})
 		}
 	}
@@ -928,6 +987,18 @@ func (a *AppInstallService) GetParams(id uint) (*response.AppConfig, error) {
 	config := getAppCommonConfig(envs)
 	config.DockerCompose = install.DockerCompose
 	res.Params = params
+	res.AppKey = install.App.Key
+	res.Name = install.Name
+	res.HttpPort = install.HttpPort
+	res.SyncModelAccount = install.SyncModelAccount
+	res.ModelAccountBaseURLType = install.ModelAccountBaseURLType
+	res.ModelAccountBaseURL = install.ModelAccountBaseURL
+	if install.App.Key == "ollama" {
+		res.ModelAccountBaseURLType, res.ModelAccountBaseURL, err = loadOllamaModelAccountAddress(install)
+		if err != nil {
+			return nil, err
+		}
+	}
 	if config.ContainerName == "" {
 		config.ContainerName = install.ContainerName
 	}

agent/app/service/app_mcp.go

@@ -0,0 +1,19 @@
+package service
+
+import (
+	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/app/task"
+)
+
+func (a AppService) InstallForMCP(req request.AppInstallCreate, executeScript bool) (*model.AppInstall, error) {
+	return a.installWithHooks(req, executeScript, &appInstallHooks{PrepareSiteDir: prepareMCPInstallSiteDirectory})
+}
+
+func prepareMCPInstallSiteDirectory(app model.App, detail model.AppDetail, req request.AppInstallCreate, _ *task.Task) error {
+	if !managesOpenrestySiteDirectory(app, detail) {
+		return nil
+	}
+	directory, _ := req.Params["WEBSITE_DIR"].(string)
+	return ensureCurrentWebsiteDirectory(directory)
+}

agent/app/service/app_site_directory.go

@@ -0,0 +1,49 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path"
+
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"gorm.io/gorm"
+)
+
+func ensureCurrentWebsiteDirectory(directory string) error {
+	changed := errors.New("website directory changed; inspect the installation before retrying")
+	if directory == "" || global.DB == nil {
+		return changed
+	}
+	return global.DB.Transaction(func(tx *gorm.DB) error {
+		ctx := context.WithValue(tx.Statement.Context, constant.DB, tx)
+		setting, err := settingRepo.GetWithContext(ctx, settingRepo.WithByKey("WEBSITE_DIR"))
+		missing := errors.Is(err, gorm.ErrRecordNotFound)
+		if err != nil && !missing {
+			return err
+		}
+		current := setting.Value
+		if current == "" {
+			current = path.Join(global.Dir.BaseDir, "1panel", "www")
+		}
+		if directory != current {
+			return changed
+		}
+		if missing {
+			if err := settingRepo.CreateWithContext(ctx, &model.Setting{Key: "WEBSITE_DIR", Value: directory}); err != nil {
+				return err
+			}
+		} else if setting.Value == "" {
+			updated, err := settingRepo.UpdateIfMatch(ctx, setting.ID, "", directory)
+			if err != nil {
+				return err
+			}
+			if updated != 1 {
+				return changed
+			}
+		}
+		return os.MkdirAll(path.Join(directory, "conf.d"), constant.DirPerm)
+	})
+}

agent/app/service/app_sync_task.go

@@ -191,7 +191,11 @@ func (c *appSyncContext) processOneApp(item appWorkItem) appWorkResult {
 
 		if _, ok := InitTypes[app.Type]; ok {
 			dockerComposeUrl := fmt.Sprintf("%s/%s", versionUrl, "docker-compose.yml")
-			_, composeRes, err := req_helper.HandleRequestWithClient(&c.httpClient, dockerComposeUrl, http.MethodGet, constant.TimeOut20s)
+			dockerComposeUrl, err := appDownloadURL(dockerComposeUrl, strconv.Itoa(c.list.LastModified))
+			var composeRes []byte
+			if err == nil {
+				_, composeRes, err = req_helper.HandleRequestWithClient(&c.httpClient, dockerComposeUrl, http.MethodGet, constant.TimeOut20s)
+			}
 			if err == nil {
 				detail.DockerCompose = string(composeRes)
 			} else {

agent/app/service/app_upgrade.go

@@ -60,10 +60,16 @@ type upgradeFileSnapshot struct {
 }
 
 type appUpgradeContext struct {
-	req       request.AppInstallUpgrade
-	original  model.AppInstall
-	candidate model.AppInstall
-	detail    model.AppDetail
+	openclawOriginal []byte
+	feishuOriginal   []byte
+	feishuImage      string
+	feishuOldImage   string
+	feishuEnabled    bool
+	feishuLockPath   string
+	req              request.AppInstallUpgrade
+	original         model.AppInstall
+	candidate        model.AppInstall
+	detail           model.AppDetail
 
 	phase         appUpgradePhase
 	stopAttempted bool
@@ -102,6 +108,19 @@ func upgradeInstall(req request.AppInstallUpgrade) error {
 		}
 	}()
 
+	feishuLockPath := ""
+	if install.App.Key == constant.AppOpenclaw {
+		feishuLockPath = path.Join(install.GetPath(), "data/conf/openclaw.json")
+		if _, busy := feishuSwitches.LoadOrStore(feishuLockPath, true); busy {
+			return buserr.New("TaskIsExecuting")
+		}
+		defer func() {
+			if releaseLock {
+				feishuSwitches.Delete(feishuLockPath)
+			}
+		}()
+	}
+
 	detail, err := appDetailRepo.GetFirst(repo.WithByID(req.DetailID))
 	if err != nil {
 		return err
@@ -129,6 +148,7 @@ func upgradeInstall(req request.AppInstallUpgrade) error {
 		return err
 	}
 	ctx := &appUpgradeContext{
+		feishuLockPath:   feishuLockPath,
 		req:              req,
 		original:         install,
 		candidate:        install,
@@ -222,6 +242,10 @@ func (u *appUpgradeContext) prepare(t *task.Task) error {
 		if err = copyUpgradeStageFile(u.original.GetPath(), u.stageDir, path.Join("data", "conf", "openclaw.json")); err != nil {
 			return err
 		}
+		u.openclawOriginal, err = os.ReadFile(path.Join(u.stageDir, "data/conf/openclaw.json"))
+		if err != nil {
+			return err
+		}
 	}
 	if u.original.App.Key == constant.AppOpenresty {
 		for _, relativePath := range []string{
@@ -330,6 +354,9 @@ func (u *appUpgradeContext) prepare(t *task.Task) error {
 	if u.original.App.Resource == constant.AppResourceRemote {
 		go RequestDownloadCallBack(u.detail.DownloadCallBackUrl)
 	}
+	if err = u.prepareFeishuUpgrade(); err != nil {
+		return err
+	}
 	u.phase = appUpgradePrepared
 	return nil
 }
@@ -387,6 +414,9 @@ func (u *appUpgradeContext) cutover(t *task.Task) error {
 	}
 	t.LogSuccess(i18n.GetMsgByKey("UpgradeStop"))
 	u.phase = appUpgradeStopped
+	if err := u.checkFeishuUpgradeSource(); err != nil {
+		return err
+	}
 
 	var err error
 	if u.original.App.Key == constant.AppOpenresty {
@@ -454,6 +484,9 @@ func (u *appUpgradeContext) cutover(t *task.Task) error {
 	} else {
 		t.Log("WARNING: no containers found for the upgraded application")
 	}
+	if err = u.verifyFeishuUpgrade(t); err != nil {
+		return err
+	}
 	u.candidate.Status = constant.StatusRunning
 	u.candidate.Message = ""
 
@@ -579,8 +612,34 @@ func (u *appUpgradeContext) rollback(t *task.Task) (rollbackErr error) {
 		if out != "" {
 			err = fmt.Errorf("%s: %w", out, err)
 		}
+		if u.feishuOriginal != nil {
+			return err
+		}
 		rollbackErr = err
 	}
+	if u.feishuOriginal != nil {
+		if u.backupFile == "" {
+			return buserr.New("ErrFeishuUpgradeBackup")
+		}
+		if err := u.restoreManagedFiles(); err != nil {
+			return err
+		}
+		if err := handleAppRecover(&u.original, t, u.backupFile, true, "", "", false); err != nil {
+			return err
+		}
+		if err := pinFeishuRollbackImage(u.original.GetComposePath(), u.feishuOldImage); err != nil {
+			return err
+		}
+		restoredCompose, err := os.ReadFile(u.original.GetComposePath())
+		if err != nil {
+			return err
+		}
+		u.original.DockerCompose = string(restoredCompose)
+		if _, err := compose.UpWithoutBuild(u.original.GetComposePath()); err != nil {
+			return err
+		}
+		return u.finishRollback()
+	}
 	if u.backupFile != "" {
 		_ = u.restoreManagedFiles()
 		if err := handleAppRecover(&u.original, t, u.backupFile, true, "", ""); err != nil {
@@ -602,6 +661,11 @@ func (u *appUpgradeContext) rollback(t *task.Task) (rollbackErr error) {
 }
 
 func (u *appUpgradeContext) finishRollback() error {
+	if u.feishuOriginal != nil {
+		if err := waitOpenclawReady(u.original.ContainerName); err != nil {
+			return err
+		}
+	}
 	restored := u.original
 	if err := appInstallRepo.Save(context.Background(), &restored); err != nil {
 		return err
@@ -643,6 +707,12 @@ func (u *appUpgradeContext) deleteOldImages(t *task.Task) {
 }
 
 func (u *appUpgradeContext) cleanup() {
+	if u.feishuLockPath != "" {
+		feishuSwitches.Delete(u.feishuLockPath)
+	}
+	if u.feishuOriginal != nil && u.rollbackErr != nil {
+		return
+	}
 	if u.snapshot != nil {
 		u.snapshot.Cleanup()
 	}

agent/app/service/app_upgrade_feishu.go

@@ -0,0 +1,336 @@
+package service
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/task"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/i18n"
+	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
+	"github.com/1Panel-dev/1Panel/agent/utils/docker"
+	"gopkg.in/yaml.v3"
+)
+
+func classifyLegacyFeishu(conf map[string]interface{}, installPath string) (legacy, configured bool, err error) {
+	for _, field := range []string{"channels", "channels.feishu", "plugins", "plugins.entries", "plugins.entries.openclaw-lark", "plugins.entries.feishu"} {
+		parts := strings.Split(field, ".")
+		parent := conf
+		for _, part := range parts[:len(parts)-1] {
+			parent = childMap(parent, part)
+		}
+		if raw, exists := parent[parts[len(parts)-1]]; exists {
+			if _, ok := raw.(map[string]interface{}); !ok {
+				return false, false, feishuConfigError(field)
+			}
+		}
+	}
+	plugins := childMap(conf, "plugins")
+	for _, key := range []string{"allow", "deny"} {
+		if raw, exists := plugins[key]; exists {
+			if _, ok := raw.([]string); ok {
+				continue
+			}
+			ids, ok := raw.([]interface{})
+			if !ok {
+				return false, false, feishuConfigError("plugins." + key)
+			}
+			for _, id := range ids {
+				if _, ok := id.(string); !ok {
+					return false, false, feishuConfigError("plugins." + key)
+				}
+			}
+		}
+	}
+	for _, id := range []string{"openclaw-lark", "feishu"} {
+		if raw, exists := childMap(childMap(plugins, "entries"), id)["enabled"]; exists {
+			if _, ok := raw.(bool); !ok {
+				return false, false, feishuConfigError("plugins.entries." + id + ".enabled")
+			}
+		}
+	}
+	if usesBundledFeishu(conf) {
+		return false, false, nil
+	}
+	f := getChannelConfig(conf, "feishu")
+	configured = len(f) > 0
+	if raw, exists := conf["bindings"]; exists {
+		bindings, ok := raw.([]interface{})
+		if !ok {
+			return false, false, feishuConfigError("bindings")
+		}
+		for _, raw := range bindings {
+			binding, ok := raw.(map[string]interface{})
+			if !ok {
+				return false, false, feishuConfigError("bindings")
+			}
+			if match, exists := binding["match"]; exists {
+				if _, ok := match.(map[string]interface{}); !ok {
+					return false, false, feishuConfigError("bindings.match")
+				}
+			}
+			if extractStringValue(childMap(binding, "match")["channel"]) == "feishu" {
+				configured = true
+			}
+		}
+	}
+	entries := childMap(childMap(conf, "plugins"), "entries")
+	entry, selected := entries["openclaw-lark"]
+	if selected {
+		old, ok := entry.(map[string]interface{})
+		if !ok {
+			return false, configured, feishuConfigError("plugins.entries.openclaw-lark")
+		}
+		// A completed disable-only repair must not repeat on every upgrade.
+		if enabled, ok := old["enabled"].(bool); ok && !enabled && !configured {
+			return false, false, nil
+		}
+	}
+	installed, err := checkPluginInstalled(installPath, "feishu")
+	if err != nil {
+		return false, configured, err
+	}
+	_, oldThread := f["threadSession"]
+	_, oldReply := f["replyMode"]
+	_, oldStreaming := f["streaming"].(bool)
+	return selected || installed || oldThread || oldReply || oldStreaming, configured, nil
+}
+
+func prepareLegacyFeishu(conf map[string]interface{}, configured bool, transition *dto.AgentFeishuTransition) error {
+	if !configured {
+		ensureChildMap(ensureChildMap(ensureChildMap(conf, "plugins"), "entries"), "openclaw-lark")["enabled"] = false
+		return nil
+	}
+	if transition == nil || !transition.Confirmed {
+		return buserr.New("ErrFeishuUpgradeConfirm")
+	}
+	if !validFeishuTransition(transition.GroupSessionScope, transition.RequireMention) {
+		return feishuConfigError("feishuTransition")
+	}
+	return convertLegacyFeishu(conf, dto.AgentFeishuSwitchReq{Streaming: transition.Streaming, GroupSessionScope: transition.GroupSessionScope, RequireMention: transition.RequireMention})
+}
+
+func validFeishuTransition(scope, mention string) bool {
+	return (scope == "group" || scope == "group_sender" || scope == "group_topic" || scope == "group_topic_sender") && (mention == "true" || mention == "false")
+}
+
+func feishuRecoveryPayload(candidate []byte, configured bool) ([]byte, error) {
+	var conf map[string]interface{}
+	if err := json.Unmarshal(candidate, &conf); err != nil {
+		return nil, err
+	}
+	if configured {
+		ensureChildMap(ensureChildMap(conf, "channels"), "feishu")["enabled"] = false
+		selectBundledFeishu(conf, false)
+	}
+	ensureChildMap(ensureChildMap(ensureChildMap(conf, "plugins"), "entries"), "openclaw-lark")["enabled"] = false
+	return json.MarshalIndent(conf, "", "  ")
+}
+
+func (u *appUpgradeContext) prepareFeishuUpgrade() error {
+	if u.original.App.Key != constant.AppOpenclaw || !isOpenclawBundledFeishuVersion(u.candidate.Version) {
+		return nil
+	}
+	source := filepath.Join(u.original.GetPath(), "data/conf/openclaw.json")
+	staged := filepath.Join(u.stageDir, "data/conf/openclaw.json")
+	// The staged copy predates protocol migration and is the exact cutover comparison source.
+	original := u.openclawOriginal
+	current, err := os.ReadFile(source)
+	if err != nil {
+		return err
+	}
+	if !bytes.Equal(original, current) {
+		return buserr.New("ErrFeishuConfigChanged")
+	}
+	_, conf, err := readFeishuConfigBytes(staged)
+	if err != nil {
+		return err
+	}
+	legacy, configured, err := classifyLegacyFeishu(conf, u.original.GetPath())
+	if err != nil || !legacy {
+		return err
+	}
+	if !u.req.Backup {
+		return buserr.New("ErrFeishuUpgradeBackup")
+	}
+	if err = prepareLegacyFeishu(conf, configured, u.req.FeishuTransition); err != nil {
+		return err
+	}
+	project, err := docker.GetComposeProject(u.original.Name, u.original.GetPath(), []byte(u.candidate.DockerCompose), u.envContent, false)
+	if err != nil {
+		return err
+	}
+	if len(project.Services) != 1 {
+		return buserr.New("ErrFeishuUpgradeMounts")
+	}
+	for _, service := range project.Services {
+		if service.Build != nil {
+			return buserr.New("ErrFeishuImageRequired")
+		}
+		u.feishuImage, err = bundledFeishuImage(service.Image)
+		if err != nil {
+			return err
+		}
+		configMounted := false
+		for _, v := range service.Volumes {
+			if v.Target == "/etc/localtime" {
+				continue
+			}
+			if v.Type != "bind" {
+				return buserr.New("ErrFeishuUpgradeMounts")
+			}
+			if err = feishuBackupPath(u.original.GetPath(), v.Source); err != nil {
+				return err
+			}
+			if v.Target == "/home/node/.openclaw" {
+				configMounted = filepath.Clean(v.Source) == filepath.Dir(source)
+			}
+		}
+		if !configMounted {
+			return buserr.New("ErrFeishuUpgradeMounts")
+		}
+	}
+	cli, err := docker.NewDockerClient()
+	if err != nil {
+		return err
+	}
+	defer cli.Close()
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+	info, err := cli.ContainerInspect(ctx, u.original.ContainerName)
+	if err != nil {
+		return err
+	}
+	u.feishuOldImage = info.Image
+	for _, m := range info.Mounts {
+		if m.Destination == "/etc/localtime" {
+			continue
+		}
+		if string(m.Type) != "bind" {
+			return buserr.New("ErrFeishuUpgradeMounts")
+		}
+		if err = feishuBackupPath(u.original.GetPath(), m.Source); err != nil {
+			return err
+		}
+	}
+	// Tar preserves symlinks: an external target would not be in the application backup.
+	if err = filepath.WalkDir(filepath.Join(u.original.GetPath(), "data"), func(file string, d os.DirEntry, walkErr error) error {
+		if walkErr != nil {
+			return walkErr
+		}
+		if d.Type()&os.ModeSymlink != 0 {
+			return feishuBackupPath(u.original.GetPath(), file)
+		}
+		return nil
+	}); err != nil {
+		return err
+	}
+	u.feishuOriginal = original
+	u.feishuEnabled = configured && extractBoolValue(getChannelConfig(conf, "feishu")["enabled"], true)
+	payload, err := json.MarshalIndent(conf, "", "  ")
+	if err != nil {
+		return err
+	}
+	before, err := os.ReadFile(staged)
+	if err != nil {
+		return err
+	}
+	if err = replaceFeishuConfig(staged, before, payload); err != nil {
+		return err
+	}
+	targetCompose := filepath.Join(u.stageDir, "docker-compose.yml")
+	if err = pinFeishuRollbackImage(targetCompose, u.feishuImage); err != nil {
+		return err
+	}
+	pinned, err := os.ReadFile(targetCompose)
+	if err != nil {
+		return err
+	}
+	u.candidate.DockerCompose = string(pinned)
+	return nil
+}
+
+func feishuBackupPath(root, source string) error {
+	root, err := filepath.EvalSymlinks(root)
+	if err != nil {
+		return err
+	}
+	resolved, err := filepath.EvalSymlinks(source)
+	if err != nil {
+		return buserr.New("ErrFeishuUpgradeMounts")
+	}
+	rel, err := filepath.Rel(root, resolved)
+	if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
+		return buserr.New("ErrFeishuUpgradeMounts")
+	}
+	return nil
+}
+
+func (u *appUpgradeContext) checkFeishuUpgradeSource() error {
+	if u.feishuOriginal == nil {
+		return nil
+	}
+	current, err := os.ReadFile(filepath.Join(u.original.GetPath(), "data/conf/openclaw.json"))
+	if err != nil {
+		return err
+	}
+	if !bytes.Equal(current, u.feishuOriginal) {
+		return buserr.New("ErrFeishuConfigChanged")
+	}
+	return nil
+}
+
+func (u *appUpgradeContext) verifyFeishuUpgrade(t *task.Task) error {
+	if u.feishuOriginal == nil {
+		return nil
+	}
+	if err := verifyFeishuActivation(u.candidate.ContainerName, u.feishuEnabled); err != nil {
+		return err
+	}
+	if u.feishuEnabled {
+		probeFeishuConnection(u.candidate.ContainerName, t)
+	}
+	return nil
+}
+
+func probeFeishuConnection(name string, t *task.Task) {
+	output, err := cmd.RunDockerExecWithStdout(30*time.Second, name, "openclaw", "channels", "status", "--channel", "feishu", "--probe", "--json")
+	if err != nil || !feishuProbeOK(output) {
+		t.Log(i18n.GetMsgByKey("AgentFeishuProbeWarning"))
+	}
+}
+
+// Pin the restored service to the actual old image, even if its registry tag moved.
+func pinFeishuRollbackImage(composeFile string, image string) error {
+	raw, err := os.ReadFile(composeFile)
+	if err != nil {
+		return err
+	}
+	var conf map[string]interface{}
+	if err = yaml.Unmarshal(raw, &conf); err != nil {
+		return err
+	}
+	services := childMap(conf, "services")
+	if len(services) != 1 {
+		return buserr.New("ErrFeishuUpgradeMounts")
+	}
+	for _, raw := range services {
+		service, ok := raw.(map[string]interface{})
+		if !ok {
+			return buserr.New("ErrFeishuUpgradeMounts")
+		}
+		service["image"] = image
+	}
+	payload, err := yaml.Marshal(conf)
+	if err != nil {
+		return err
+	}
+	return writeUpgradeFile(composeFile, payload, constant.FilePerm)
+}

agent/app/service/app_utils.go

@@ -8,6 +8,7 @@ import (
 	"maps"
 	"math"
 	"net/http"
+	"net/url"
 	"os"
 	"path"
 	"path/filepath"
@@ -390,12 +391,27 @@ func deleteAppInstall(deleteReq request.AppInstallDelete) error {
 				}
 			}
 		}
+		if install.App.Key == "ollama" {
+			ollamaModelMu.Lock()
+			defer ollamaModelMu.Unlock()
+		}
 		tx, ctx := helper.GetTxAndContext()
 		defer tx.Rollback()
 		if err = appInstallRepo.Delete(ctx, install); err != nil {
 			return err
 		}
 		appKey := install.App.Key
+		if appKey == "ollama" {
+			remaining, listErr := appInstallRepo.ListBy(ctx, appInstallRepo.WithAppId(install.AppId))
+			if listErr != nil {
+				return listErr
+			}
+			if len(remaining) == 0 {
+				if err = aiRepo.DeleteAll(ctx); err != nil {
+					return err
+				}
+			}
+		}
 		if isAgentAppKey(appKey) {
 			_ = agentRepo.DeleteByAppInstallIDWithCtx(ctx, install.ID)
 		}
@@ -468,7 +484,12 @@ func deleteAppInstall(deleteReq request.AppInstallDelete) error {
 		if err == nil && len(entries) == 0 {
 			_ = op.DeleteDir(parentDir)
 		}
-		tx.Commit()
+		if err := tx.Commit().Error; err != nil {
+			return err
+		}
+		if install.App.Key == "ollama" || install.App.Key == "vllm" {
+			CleanupLocalModelAccount(install.ID)
+		}
 
 		existApps, _ := appInstallRepo.ListBy(context.Background(), appInstallRepo.WithAppId(install.AppId))
 		if len(existApps) == 0 {
@@ -891,16 +912,52 @@ func handleMap(params map[string]interface{}, envParams map[string]string) {
 	}
 }
 
+func appDownloadURL(rawURL, version string) (string, error) {
+	parsedURL, err := url.Parse(rawURL)
+	if err != nil {
+		return "", err
+	}
+	query := parsedURL.Query()
+	query.Set("v", version)
+	parsedURL.RawQuery = query.Encode()
+	return parsedURL.String(), nil
+}
+
+func currentAppDownloadURL(rawURL string) (string, error) {
+	storeVersion, err := settingRepo.GetValueByKey("AppStoreLastModified")
+	if err != nil {
+		return "", err
+	}
+	return appDownloadURL(rawURL, storeVersion)
+}
+
 func downloadApp(app model.App, appDetail model.AppDetail, appInstall *model.AppInstall, logger *logrus.Logger) (err error) {
 	if app.IsLocalApp() || app.IsCustomApp() {
 		return nil
 	}
+	defer func() {
+		if err != nil && appInstall != nil {
+			appInstall.Status = constant.StatusDownloadErr
+			appInstall.Message = err.Error()
+		}
+	}()
 	appResourceDir := path.Join(global.Dir.AppResourceDir, app.Resource)
 	appDownloadDir := app.GetAppResourcePath()
 	appVersionDir := path.Join(appDownloadDir, appDetail.Version)
 	fileOp := files.NewFileOp()
+	storeVersion, err := settingRepo.GetValueByKey("AppStoreLastModified")
+	if err != nil {
+		return err
+	}
+	cacheVersionPath := path.Join(appVersionDir, ".1panel-appstore-version")
 	if !appDetail.Update && fileOp.Stat(appVersionDir) {
-		return
+		if cachedVersion, readErr := os.ReadFile(cacheVersionPath); readErr == nil && string(cachedVersion) == storeVersion {
+			return nil
+		}
+	}
+	downloadURL, err := appDownloadURL(appDetail.DownloadUrl, storeVersion)
+	if err != nil {
+		return err
 	}
 	if !fileOp.Stat(appDownloadDir) {
 		_ = fileOp.CreateDir(appDownloadDir, constant.DirPerm)
@@ -909,23 +966,14 @@ func downloadApp(app model.App, appDetail model.AppDetail, appInstall *model.App
 		_ = fileOp.CreateDir(appVersionDir, constant.DirPerm)
 	}
 	if logger == nil {
-		global.LOG.Infof("download app [%s] from %s", app.Name, appDetail.DownloadUrl)
+		global.LOG.Infof("download app [%s] from %s", app.Name, downloadURL)
 	} else {
-		logger.Printf("download app [%s] from %s", app.Name, appDetail.DownloadUrl)
+		logger.Printf("download app [%s] from %s", app.Name, downloadURL)
 	}
 
 	filePath := path.Join(appVersionDir, app.Key+"-"+appDetail.Version+".tar.gz")
 
-	defer func() {
-		if err != nil {
-			if appInstall != nil {
-				appInstall.Status = constant.StatusDownloadErr
-				appInstall.Message = err.Error()
-			}
-		}
-	}()
-
-	if err = files.DownloadFileWithProxy(appDetail.DownloadUrl, filePath); err != nil {
+	if err = files.DownloadFileWithProxy(downloadURL, filePath); err != nil {
 		if logger == nil {
 			global.LOG.Errorf("download app [%s] error %v", app.Name, err)
 		} else {
@@ -942,6 +990,9 @@ func downloadApp(app model.App, appDetail model.AppDetail, appInstall *model.App
 		return
 	}
 	_ = fileOp.DeleteFile(filePath)
+	if err = os.WriteFile(cacheVersionPath, []byte(storeVersion), constant.FilePerm); err != nil {
+		return err
+	}
 	appDetail.Update = false
 	_ = appDetailRepo.Update(context.Background(), appDetail)
 	return
@@ -1982,8 +2033,19 @@ func getAppTags(appID uint, lang string) ([]response.TagDTO, error) {
 	return res, nil
 }
 
+func prepareAppInstallSiteDirectory(app model.App, appDetail model.AppDetail, req request.AppInstallCreate, t *task.Task, hooks *appInstallHooks) error {
+	if hooks != nil && hooks.PrepareSiteDir != nil {
+		return hooks.PrepareSiteDir(app, appDetail, req, t)
+	}
+	return handleSiteDir(app, appDetail, req, t)
+}
+
+func managesOpenrestySiteDirectory(app model.App, appDetail model.AppDetail) bool {
+	return app.Key == "openresty" && (app.Resource == "remote" || app.Resource == "custom") && common.CompareVersion(appDetail.Version, "1.27")
+}
+
 func handleSiteDir(app model.App, appDetail model.AppDetail, req request.AppInstallCreate, t *task.Task) error {
-	if app.Key == "openresty" && (app.Resource == "remote" || app.Resource == "custom") && common.CompareVersion(appDetail.Version, "1.27") {
+	if managesOpenrestySiteDirectory(app, appDetail) {
 		if dir, ok := req.Params["WEBSITE_DIR"]; ok {
 			siteDir := dir.(string)
 			if siteDir == "" || !strings.HasPrefix(siteDir, "/") {

agent/app/service/backup_app.go

@@ -197,7 +197,8 @@ func handleAppBackup(install *model.AppInstall, parentTask *task.Task, recordID
 	return nil
 }
 
-func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverFile string, isRollback bool, secret, taskID string) error {
+func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverFile string, isRollback bool, secret, taskID string, startAfterRecover ...bool) error {
+	startAfter := len(startAfterRecover) == 0 || startAfterRecover[0]
 	// Validate AI Gateway backups before stopping the app, creating rollback
 	// backups, or touching its files/database. Keep the validated extraction for
 	// the restore so uploaded/encrypted archives are not unpacked twice.
@@ -246,12 +247,15 @@ func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverF
 			return err
 		}
 		defer func() {
+			defer os.RemoveAll(tmpPath)
+			if !startAfter {
+				return
+			}
 			if isRollback {
 				_, _ = compose.UpWithoutBuild(install.GetComposePath())
 			} else {
 				_, _ = compose.Up(install.GetComposePath())
 			}
-			_ = os.RemoveAll(tmpPath)
 		}()
 
 		if !fileOp.Stat(tmpPath+"/app.json") || !fileOp.Stat(tmpPath+"/app.tar.gz") {
@@ -352,8 +356,12 @@ func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverF
 
 		appDir := install.GetPath()
 		backPath := fmt.Sprintf("%s_bak", appDir)
-		_ = fileOp.Rename(appDir, backPath)
-		_ = fileOp.CreateDir(appDir, constant.DirPerm)
+		if err := fileOp.Rename(appDir, backPath); err != nil && !startAfter {
+			return err
+		}
+		if err := fileOp.CreateDir(appDir, constant.DirPerm); err != nil && !startAfter {
+			return err
+		}
 
 		deCompressName := i18n.GetWithName("DeCompressFile", "app.tar.gz")
 		t.LogStart(deCompressName)
@@ -376,6 +384,10 @@ func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverF
 			_, _ = file.WriteString(mergedEnvContent)
 		}
 
+		// The upgrade transaction verifies readiness before saving its restored install.
+		if !startAfter {
+			return nil
+		}
 		backupInstall.ID = install.ID
 		backupInstall.Status = constant.StatusRunning
 		backupInstall.AppId = install.AppId

agent/app/service/backup_website.go

@@ -261,7 +261,7 @@ func doWebsiteBackup(website *model.Website, parentTask *task.Task, backupDir, f
 		return err
 	}
 	nginxConfFile := GetWebsiteConfigPath(*website)
-	if err := fileOp.CopyFile(nginxConfFile, tmpDir); err != nil {
+	if err := exportWebsiteNginxConfig(*website, nginxConfFile, tmpDir); err != nil {
 		return err
 	}
 	parentTask.Log(i18n.GetMsgByKey("BackupNginxConfig"))

agent/app/service/container.go

@@ -58,10 +58,10 @@ type ContainerService struct{}
 var containerLogAnsiRegex = regexp.MustCompile("\x1b\\[[0-9;?]*[A-Za-z]|\x1b=|\x1b>")
 
 type IContainerService interface {
-	Page(req dto.PageContainer) (int64, interface{}, error)
+	Page(ctx context.Context, req dto.PageContainer) (int64, interface{}, error)
 	List() []dto.ContainerOptions
 	ListByImage(imageName string) []dto.ContainerOptions
-	LoadStatus() (dto.ContainerStatus, error)
+	LoadStatus(ctx context.Context, containersOnly bool) (dto.ContainerStatus, error)
 	PageNetwork(req dto.SearchWithPage) (int64, interface{}, error)
 	ListNetwork() ([]dto.Options, error)
 	PageVolume(req dto.SearchWithPage) (int64, interface{}, error)
@@ -80,7 +80,7 @@ type IContainerService interface {
 	ContainerUpdate(req dto.ContainerOperate) error
 	ContainerUpgrade(req dto.ContainerUpgrade) error
 	ContainerInfo(req dto.OperationWithName) (*dto.ContainerOperate, error)
-	ContainerListStats() ([]dto.ContainerListStats, error)
+	ContainerListStats(ctx context.Context, ids []string) ([]dto.ContainerListStats, error)
 	ContainerItemStats(ctx context.Context, req dto.OperationWithName) (dto.ContainerItemStats, error)
 	LoadResourceLimit() (*dto.ResourceLimit, error)
 	ContainerRename(req dto.ContainerRename) error
@@ -112,7 +112,7 @@ func NewIContainerService() IContainerService {
 	return &ContainerService{}
 }
 
-func (u *ContainerService) Page(req dto.PageContainer) (int64, interface{}, error) {
+func (u *ContainerService) Page(ctx context.Context, req dto.PageContainer) (int64, interface{}, error) {
 	client, err := docker.NewDockerClient()
 	if err != nil {
 		return 0, nil, err
@@ -123,7 +123,7 @@ func (u *ContainerService) Page(req dto.PageContainer) (int64, interface{}, erro
 		options.Filters = filters.NewArgs()
 		options.Filters.Add("label", req.Filters)
 	}
-	containers, err := client.ContainerList(context.Background(), options)
+	containers, err := client.ContainerList(ctx, options)
 	if err != nil {
 		return 0, nil, err
 	}
@@ -206,27 +206,30 @@ func (u *ContainerService) ListByImage(imageName string) []dto.ContainerOptions
 	return options
 }
 
-func (u *ContainerService) LoadStatus() (dto.ContainerStatus, error) {
+func (u *ContainerService) LoadStatus(ctx context.Context, containersOnly bool) (dto.ContainerStatus, error) {
 	var data dto.ContainerStatus
 	client, err := docker.NewDockerClient()
 	if err != nil {
 		return data, err
 	}
 	defer client.Close()
-	c := context.Background()
-
-	images, _ := client.ImageList(c, image.ListOptions{All: true})
-	data.ImageCount = len(images)
-	repo, _ := imageRepoRepo.List()
-	data.RepoCount = len(repo)
-	templates, _ := composeRepo.List()
-	data.ComposeTemplateCount = len(templates)
-	networks, _ := client.NetworkList(c, network.ListOptions{})
-	data.NetworkCount = len(networks)
-	volumes, _ := client.VolumeList(c, volume.ListOptions{})
-	data.VolumeCount = len(volumes.Volumes)
-	data.ComposeCount = loadComposeCount(client)
-	containers, _ := client.ContainerList(c, container.ListOptions{All: true})
+	if !containersOnly {
+		images, _ := client.ImageList(ctx, image.ListOptions{All: true})
+		data.ImageCount = len(images)
+		repo, _ := imageRepoRepo.List()
+		data.RepoCount = len(repo)
+		templates, _ := composeRepo.List()
+		data.ComposeTemplateCount = len(templates)
+		networks, _ := client.NetworkList(ctx, network.ListOptions{})
+		data.NetworkCount = len(networks)
+		volumes, _ := client.VolumeList(ctx, volume.ListOptions{})
+		data.VolumeCount = len(volumes.Volumes)
+		data.ComposeCount = loadComposeCount(client)
+	}
+	containers, err := client.ContainerList(ctx, container.ListOptions{All: true})
+	if err != nil {
+		return data, err
+	}
 	data.ContainerCount = len(containers)
 	for _, item := range containers {
 		switch item.State {
@@ -292,25 +295,48 @@ func (u *ContainerService) ContainerItemStats(ctx context.Context, req dto.Opera
 	}
 	return data, nil
 }
-func (u *ContainerService) ContainerListStats() ([]dto.ContainerListStats, error) {
+func (u *ContainerService) ContainerListStats(ctx context.Context, ids []string) ([]dto.ContainerListStats, error) {
 	client, err := docker.NewDockerClient()
 	if err != nil {
 		return nil, err
 	}
 	defer client.Close()
-	list, err := client.ContainerList(context.Background(), container.ListOptions{All: true})
+	options := container.ListOptions{All: true}
+	if ids != nil {
+		if len(ids) == 0 {
+			return []dto.ContainerListStats{}, nil
+		}
+		options.Filters = filters.NewArgs()
+		for _, id := range ids {
+			options.Filters.Add("id", id)
+		}
+	}
+	list, err := client.ContainerList(ctx, options)
 	if err != nil {
 		return nil, err
 	}
 	datas := make([]dto.ContainerListStats, len(list))
+	jobs := make(chan int)
 	var wg sync.WaitGroup
-	wg.Add(len(list))
-	for i := 0; i < len(list); i++ {
-		go func(index int, item container.Summary) {
-			datas[index] = loadCpuAndMem(client, item.ID)
-			wg.Done()
-		}(i, list[i])
+	for worker := 0; worker < min(8, len(list)); worker++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for index := range jobs {
+				datas[index].ContainerID = list[index].ID
+				if ctx.Err() == nil && list[index].State == "running" {
+					datas[index] = loadCpuAndMem(ctx, client, list[index].ID)
+				}
+				if len(list[index].Names) > 0 {
+					datas[index].ContainerName = strings.TrimPrefix(list[index].Names[0], "/")
+				}
+			}
+		}()
 	}
+	for index := range list {
+		jobs <- index
+	}
+	close(jobs)
 	wg.Wait()
 	return datas, nil
 }
@@ -1634,6 +1660,10 @@ func calculateNetwork(network map[string]container.NetworkStats) (float64, float
 }
 
 func checkImageExist(client *client.Client, imageItem string) bool {
+	return checkImageExistContext(context.Background(), client, imageItem)
+}
+
+func checkImageExistContext(ctx context.Context, client *client.Client, imageItem string) bool {
 	if client == nil {
 		var err error
 		client, err = docker.NewDockerClient()
@@ -1641,7 +1671,7 @@ func checkImageExist(client *client.Client, imageItem string) bool {
 			return false
 		}
 	}
-	images, err := client.ImageList(context.Background(), image.ListOptions{})
+	images, err := client.ImageList(ctx, image.ListOptions{})
 	if err != nil {
 		return false
 	}
@@ -1683,6 +1713,10 @@ func checkImageLike(client *client.Client, imageName string) bool {
 }
 
 func pullImages(task *task.Task, client *client.Client, imageName string) error {
+	return pullImagesContext(context.Background(), task, client, imageName)
+}
+
+func pullImagesContext(ctx context.Context, task *task.Task, client *client.Client, imageName string) error {
 	dockerCli := docker.NewClientWithExist(client)
 	repos, err := imageRepoRepo.List()
 	if err != nil {
@@ -1690,7 +1724,7 @@ func pullImages(task *task.Task, client *client.Client, imageName string) error
 	}
 	imageRepo := selectImageRepo(imageName, repos)
 	if imageRepo == nil || !imageRepo.Auth {
-		return dockerCli.PullImageWithProcess(task, imageName)
+		return dockerCli.PullImageWithProcessContext(ctx, task, imageName)
 	}
 
 	options := image.PullOptions{}
@@ -1703,7 +1737,7 @@ func pullImages(task *task.Task, client *client.Client, imageName string) error
 		return err
 	}
 	options.RegistryAuth = base64.URLEncoding.EncodeToString(encodedJSON)
-	return dockerCli.PullImageWithProcessAndOptions(task, imageName, options)
+	return dockerCli.PullImageWithProcessAndOptionsContext(ctx, task, imageName, options)
 }
 
 func selectImageRepo(imageName string, repos []model.ImageRepo) *model.ImageRepo {
@@ -1722,11 +1756,13 @@ func selectImageRepo(imageName string, repos []model.ImageRepo) *model.ImageRepo
 	return selected
 }
 
-func loadCpuAndMem(client *client.Client, containerItem string) dto.ContainerListStats {
+func loadCpuAndMem(ctx context.Context, client *client.Client, containerItem string) dto.ContainerListStats {
+	ctx, cancel := context.WithTimeout(ctx, 3*time.Second)
+	defer cancel()
 	data := dto.ContainerListStats{
 		ContainerID: containerItem,
 	}
-	res, err := client.ContainerStats(context.Background(), containerItem, false)
+	res, err := client.ContainerStats(ctx, containerItem, false)
 	if err != nil {
 		return data
 	}

agent/app/service/container_update.go

@@ -91,81 +91,95 @@ func (u *ContainerService) ContainerUpdate(req dto.ContainerOperate) error {
 	return nil
 }
 
+const containerUpgradeConcurrency = 2
+
+// Shared by all upgrade requests handled by this agent.
+var containerUpgradeSlots = make(chan struct{}, containerUpgradeConcurrency)
+
 func (u *ContainerService) ContainerUpgrade(req dto.ContainerUpgrade) error {
 	client, err := docker.NewDockerClient()
 	if err != nil {
 		return err
 	}
-	ctx := context.Background()
 	taskItem, err := task.NewTaskWithOps(req.Image, task.TaskUpgrade, task.TaskScopeImage, req.TaskID, 1)
 	if err != nil {
 		_ = client.Close()
 		global.LOG.Errorf("new task for create container failed, err: %v", err)
 		return err
 	}
-	go func() {
-		defer client.Close()
-		taskItem.AddSubTask(i18n.GetWithName("ContainerImagePull", req.Image), func(t *task.Task) error {
-			taskItem.LogStart(i18n.GetWithName("ContainerImagePull", req.Image))
-			if !checkImageExist(client, req.Image) || req.ForcePull {
-				if err := pullImages(taskItem, client, req.Image); err != nil {
-					if !req.ForcePull {
-						return err
-					}
-					return fmt.Errorf("pull image %s failed, err: %v", req.Image, err)
-				}
+	taskItem.AddSubTask(i18n.GetWithName("ContainerImagePull", req.Image), func(t *task.Task) error {
+		ctx, cancel := context.WithTimeout(context.Background(), containerUpgradePullTimeout)
+		defer cancel()
+		taskItem.LogStart(i18n.GetWithName("ContainerImagePull", req.Image))
+		if req.ForcePull || !checkImageExistContext(ctx, client, req.Image) {
+			if err := pullImagesContext(ctx, taskItem, client, req.Image); err != nil {
+				return fmt.Errorf("pull image %s failed: %w", req.Image, err)
+			}
+		}
+		return nil
+	}, nil)
+	var upgradeErrors []error
+	for _, item := range req.Names {
+		item := item
+		taskItem.AddSubTaskWithIgnoreErr(i18n.GetWithName("ContainerUpgradeItem", item), func(t *task.Task) error {
+			t.Logf("----------------- %s -----------------", item)
+			t.LogStart(i18n.GetWithName("ContainerAcquireLock", item))
+			ctx, cancel := context.WithTimeout(context.Background(), containerUpgradeReplaceTimeout)
+			defer cancel()
+			unlock, lockErr := containerOperationLock.lockContext(ctx, item)
+			if lockErr != nil {
+				upgradeErrors = append(upgradeErrors, fmt.Errorf("wait for container %s lock: %w", item, lockErr))
+				return lockErr
+			}
+			defer unlock()
+			t.LogWithStatus(i18n.GetWithName("ContainerAcquireLock", item), nil)
+
+			oldContainer, inspectErr := client.ContainerInspect(ctx, item)
+			t.LogWithStatus(i18n.GetWithName("ContainerLoadInfo", item), inspectErr)
+			if inspectErr != nil {
+				err := fmt.Errorf("reload container %s failed: %w", item, inspectErr)
+				upgradeErrors = append(upgradeErrors, err)
+				return err
+			}
+			config := cloneContainerConfig(oldContainer.Config)
+			config.Image = req.Image
+			if config.Labels == nil {
+				config.Labels = make(map[string]string)
+			}
+			config.Labels[containerUpgradeOwnerLabel] = oldContainer.ID
+			hostConf := cloneContainerHostConfig(oldContainer.HostConfig)
+			preserveContainerVolumeMounts(hostConf, oldContainer.Mounts)
+			networkConf, extraNetworks := buildContainerRecoverNetworkConfig(oldContainer.NetworkSettings, hostConf)
+			if err := normalizeContainerEndpointSettings(ctx, client, networkConf, extraNetworks); err != nil {
+				upgradeErr := fmt.Errorf("prepare networks for container %s failed: %w", item, err)
+				upgradeErrors = append(upgradeErrors, upgradeErr)
+				return upgradeErr
+			}
+			cleanupErr, err := switchContainerWithRecovery(ctx, client, item, oldContainer, func() (container.CreateResponse, error) {
+				return createContainerWithNetworks(ctx, client, config, hostConf, networkConf, extraNetworks, item)
+			}, config.Tty, t, true)
+			if err != nil {
+				upgradeErr := fmt.Errorf("upgrade container %s failed: %w", item, err)
+				upgradeErrors = append(upgradeErrors, upgradeErr)
+				return upgradeErr
+			}
+			if cleanupErr != nil {
+				t.Log(i18n.GetWithNameAndErr("ContainerCleanupWarning", containerSwitchBackupName(oldContainer.ID), cleanupErr))
 			}
 			return nil
-		}, nil)
-		var upgradeErrors []error
-		for _, item := range req.Names {
-			item := item
-			taskItem.AddSubTaskWithIgnoreErr(i18n.GetWithName("ContainerUpgradeItem", item), func(t *task.Task) error {
-				t.Logf("----------------- %s -----------------", item)
-				t.LogStart(i18n.GetWithName("ContainerAcquireLock", item))
-				unlock := containerOperationLock.lock(item)
-				defer unlock()
-				t.LogWithStatus(i18n.GetWithName("ContainerAcquireLock", item), nil)
-
-				oldContainer, inspectErr := client.ContainerInspect(ctx, item)
-				t.LogWithStatus(i18n.GetWithName("ContainerLoadInfo", item), inspectErr)
-				if inspectErr != nil {
-					err := fmt.Errorf("reload container %s failed: %w", item, inspectErr)
-					upgradeErrors = append(upgradeErrors, err)
-					return err
-				}
-				config := cloneContainerConfig(oldContainer.Config)
-				config.Image = req.Image
-				hostConf := cloneContainerHostConfig(oldContainer.HostConfig)
-				preserveContainerVolumeMounts(hostConf, oldContainer.Mounts)
-				networkConf, extraNetworks := buildContainerRecoverNetworkConfig(oldContainer.NetworkSettings, hostConf)
-				if err := normalizeContainerEndpointSettings(ctx, client, networkConf, extraNetworks); err != nil {
-					upgradeErr := fmt.Errorf("prepare networks for container %s failed: %w", item, err)
-					upgradeErrors = append(upgradeErrors, upgradeErr)
-					return upgradeErr
-				}
-				cleanupErr, err := switchContainer(ctx, client, item, oldContainer, func() (container.CreateResponse, error) {
-					return createContainerWithNetworks(ctx, client, config, hostConf, networkConf, extraNetworks, item)
-				}, config.Tty, t)
-				if err != nil {
-					upgradeErr := fmt.Errorf("upgrade container %s failed: %w", item, err)
-					upgradeErrors = append(upgradeErrors, upgradeErr)
-					return upgradeErr
-				}
-				if cleanupErr != nil {
-					t.Log(i18n.GetWithNameAndErr("ContainerCleanupWarning", containerSwitchBackupName(oldContainer.ID), cleanupErr))
-				}
-				return nil
-			})
-		}
-		taskItem.AddSubTask(i18n.GetMsgByKey("ContainerUpgradeSummary"), func(t *task.Task) error {
-			return errors.Join(upgradeErrors...)
-		}, nil)
-		if err := taskItem.Execute(); err != nil {
-			global.LOG.Error(err.Error())
-		}
-	}()
-
+		})
+	}
+	taskItem.AddSubTask(i18n.GetMsgByKey("ContainerUpgradeSummary"), func(t *task.Task) error {
+		return errors.Join(upgradeErrors...)
+	}, nil)
+	// Stage contexts own the deadlines, including a separate recovery budget.
+	for _, subTask := range taskItem.SubTasks {
+		subTask.Timeout = 0
+	}
+	if err := taskItem.ExecuteQueued(containerUpgradeSlots, "ContainerUpgradeWaiting", func() { _ = client.Close() }); err != nil {
+		_ = client.Close()
+		return err
+	}
 	return nil
 }
 
@@ -192,11 +206,16 @@ type containerOperationMutex struct {
 var containerOperationLock containerOperationMutex
 
 type containerOperationLockEntry struct {
-	mutex      sync.Mutex
+	token      chan struct{}
 	references int
 }
 
 func (l *containerOperationMutex) lock(names ...string) func() {
+	unlock, _ := l.lockContext(context.Background(), names...)
+	return unlock
+}
+
+func (l *containerOperationMutex) lockContext(ctx context.Context, names ...string) (func(), error) {
 	nameSet := make(map[string]struct{}, len(names))
 	for _, name := range names {
 		if name != "" {
@@ -209,7 +228,7 @@ func (l *containerOperationMutex) lock(names ...string) func() {
 	}
 	sort.Strings(orderedNames)
 	if len(orderedNames) == 0 {
-		return func() {}
+		return func() {}, nil
 	}
 
 	l.mutex.Lock()
@@ -220,7 +239,7 @@ func (l *containerOperationMutex) lock(names ...string) func() {
 	for _, name := range orderedNames {
 		entry := l.locks[name]
 		if entry == nil {
-			entry = &containerOperationLockEntry{}
+			entry = &containerOperationLockEntry{token: make(chan struct{}, 1)}
 			l.locks[name] = entry
 		}
 		entry.references++
@@ -228,12 +247,10 @@ func (l *containerOperationMutex) lock(names ...string) func() {
 	}
 	l.mutex.Unlock()
 
-	for _, entry := range entries {
-		entry.mutex.Lock()
-	}
-	return func() {
-		for index := len(entries) - 1; index >= 0; index-- {
-			entries[index].mutex.Unlock()
+	acquired := 0
+	release := func() {
+		for index := acquired - 1; index >= 0; index-- {
+			<-entries[index].token
 		}
 		l.mutex.Lock()
 		defer l.mutex.Unlock()
@@ -245,6 +262,20 @@ func (l *containerOperationMutex) lock(names ...string) func() {
 			}
 		}
 	}
+	for _, entry := range entries {
+		select {
+		case entry.token <- struct{}{}:
+			acquired++
+		case <-ctx.Done():
+			release()
+			return nil, ctx.Err()
+		}
+	}
+	if err := ctx.Err(); err != nil {
+		release()
+		return nil, err
+	}
+	return release, nil
 }
 
 type containerNetworkAttachment struct {
@@ -272,6 +303,131 @@ func switchContainer(
 	createNew func() (container.CreateResponse, error),
 	tty bool,
 	logger containerSwitchLogger,
+) (cleanupErr error, err error) {
+	return switchContainerWithRecovery(ctx, cli, name, oldContainer, createNew, tty, logger, false)
+}
+
+
+const (
+	containerUpgradePullTimeout     = 30 * time.Minute
+	containerUpgradeReplaceTimeout  = 15 * time.Minute
+	containerUpgradeRecoveryTimeout = 5 * time.Minute
+	containerUpgradeOwnerLabel      = "io.1panel.upgrade.original-id"
+)
+
+// Reconcile against Docker's actual state: a failed request may already have
+// changed names, created a container, or disconnected a network on the daemon.
+func recoverContainerUpgrade(ctx context.Context, cli containerSwitchClient, name string, old container.InspectResponse, newID string, logger containerSwitchLogger) error {
+	original, err := cli.ContainerInspect(ctx, old.ID)
+	if err != nil {
+		return fmt.Errorf("inspect original %s: %w", old.ID, err)
+	}
+	if original.State == nil {
+		return fmt.Errorf("original container state unavailable")
+	}
+
+	replacement, inspectErr := cli.ContainerInspect(ctx, name)
+	if inspectErr != nil && !client.IsErrNotFound(inspectErr) {
+		return fmt.Errorf("inspect replacement by name: %w", inspectErr)
+	}
+	if inspectErr == nil && replacement.ID != old.ID {
+		if replacement.Config == nil || replacement.Config.Labels[containerUpgradeOwnerLabel] != old.ID {
+			return fmt.Errorf("container %s belongs to another operation; refusing to remove it", name)
+		}
+		if newID != "" && replacement.ID != newID {
+			return fmt.Errorf("replacement ID changed; refusing to remove it")
+		}
+		newID = replacement.ID
+	}
+	if newID != "" {
+		replacement, inspectErr = cli.ContainerInspect(ctx, newID)
+		if inspectErr != nil && !client.IsErrNotFound(inspectErr) {
+			return fmt.Errorf("inspect replacement %s: %w", newID, inspectErr)
+		}
+		if inspectErr == nil {
+			if replacement.ID == old.ID || replacement.Config == nil || replacement.Config.Labels[containerUpgradeOwnerLabel] != old.ID {
+				return fmt.Errorf("replacement identity could not be confirmed")
+			}
+			err = cli.ContainerRemove(ctx, newID, container.RemoveOptions{Force: true, RemoveVolumes: false})
+			logContainerSwitchStep(logger, "ContainerRollbackRemoveReplacement", name, err)
+			if err != nil && !client.IsErrNotFound(err) {
+				return fmt.Errorf("remove replacement: %w", err)
+			}
+		}
+	}
+	if strings.TrimPrefix(original.Name, "/") != name {
+		err = cli.ContainerRename(ctx, old.ID, name)
+		logContainerSwitchStep(logger, "ContainerRollbackRenameOld", name, err)
+		if err != nil {
+			return fmt.Errorf("restore original name: %w", err)
+		}
+	}
+	// Reload after mutations; connect only networks which are actually missing.
+	original, err = cli.ContainerInspect(ctx, old.ID)
+	if err != nil {
+		return err
+	}
+	primary, extras := buildContainerRecoverNetworkConfig(old.NetworkSettings, old.HostConfig)
+	wanted := make(map[string]*network.EndpointSettings)
+	if primary != nil {
+		for n, endpoint := range primary.EndpointsConfig {
+			if n != "bridge" {
+				wanted[n] = endpoint
+			}
+		}
+	}
+	for n, endpoint := range extras {
+		if n != "bridge" {
+			wanted[n] = endpoint
+		}
+	}
+	var reconnectErr error
+	for n, endpoint := range wanted {
+		if original.NetworkSettings != nil && original.NetworkSettings.Networks[n] != nil {
+			continue
+		}
+		err = cli.NetworkConnect(ctx, n, old.ID, endpoint)
+		logContainerSwitchStep(logger, "ContainerRollbackReconnectOld", n, err)
+		if err != nil {
+			reconnectErr = errors.Join(reconnectErr, fmt.Errorf("reconnect network %s: %w", n, err))
+		}
+	}
+	if reconnectErr != nil {
+		return reconnectErr
+	}
+	if old.State != nil && old.State.Running {
+		if original.State == nil {
+			return fmt.Errorf("original state unavailable after recovery")
+		}
+		if !original.State.Running {
+			err = restartOriginalContainer(ctx, cli, old.ID)
+			logContainerSwitchStep(logger, "ContainerRollbackRestartOld", name, err)
+			if err != nil {
+				return err
+			}
+		}
+	}
+	verified, err := cli.ContainerInspect(ctx, old.ID)
+	if err != nil {
+		return fmt.Errorf("verify recovery: %w", err)
+	}
+	if strings.TrimPrefix(verified.Name, "/") != name {
+		return fmt.Errorf("original name was not restored")
+	}
+	if old.State != nil && old.State.Running && (verified.State == nil || !verified.State.Running) {
+		return fmt.Errorf("original container is not running after recovery")
+	}
+	for n := range wanted {
+		if verified.NetworkSettings == nil || verified.NetworkSettings.Networks[n] == nil {
+			return fmt.Errorf("network %s was not restored", n)
+		}
+	}
+	return nil
+}
+
+func switchContainerWithRecovery(ctx context.Context, cli containerSwitchClient, name string,
+	oldContainer container.InspectResponse, createNew func() (container.CreateResponse, error),
+	tty bool, logger containerSwitchLogger, boundedRecovery bool,
 ) (cleanupErr error, err error) {
 	if oldContainer.ID == "" {
 		return nil, fmt.Errorf("original container ID is empty")
@@ -281,9 +437,32 @@ func switchContainer(
 		return nil, fmt.Errorf("cannot safely replace container %s with auto-remove enabled", name)
 	}
 
+	recoverUpgrade := func(newID string, cause error) error {
+		recoveryCtx, cancel := context.WithTimeout(context.Background(), containerUpgradeRecoveryTimeout)
+		defer cancel()
+		if newID != "" {
+			logContainerStartupLogs(recoveryCtx, cli, newID, name, tty, logger)
+		}
+		recoveryErr := recoverContainerUpgrade(recoveryCtx, cli, name, oldContainer, newID, logger)
+		if ctx.Err() != nil {
+			recoveryErr = errors.Join(recoveryErr, fmt.Errorf("Docker request timed out or was canceled; daemon-side completion cannot be confirmed: %w", ctx.Err()))
+		}
+		if recoveryErr != nil {
+			message := fmt.Sprintf("Recovery unconfirmed for container %s (original ID %s, backup %s): %v", name, oldContainer.ID, containerSwitchBackupName(oldContainer.ID), recoveryErr)
+			if logger != nil {
+				logger.Log(message)
+			}
+			return errors.Join(cause, errors.New(message))
+		}
+		return cause
+	}
+
 	if wasRunning {
 		if err := cli.ContainerStop(ctx, oldContainer.ID, container.StopOptions{}); err != nil {
 			logContainerSwitchStep(logger, "ContainerStopOld", name, err)
+			if boundedRecovery {
+				return nil, recoverUpgrade("", fmt.Errorf("stop original container failed: %w", err))
+			}
 			current, inspectErr := cli.ContainerInspect(ctx, oldContainer.ID)
 			if inspectErr == nil && current.State != nil && !current.State.Running {
 				restartErr := restartOriginalContainer(ctx, cli, oldContainer.ID)
@@ -298,6 +477,9 @@ func switchContainer(
 	backupName := containerSwitchBackupName(oldContainer.ID)
 	if err := cli.ContainerRename(ctx, oldContainer.ID, backupName); err != nil {
 		logContainerSwitchStep(logger, "ContainerRenameOld", name, err)
+		if boundedRecovery {
+			return nil, recoverUpgrade("", fmt.Errorf("rename original container failed: %w", err))
+		}
 		if wasRunning {
 			restartErr := restartOriginalContainer(ctx, cli, oldContainer.ID)
 			logContainerSwitchStep(logger, "ContainerRollbackRestartOld", name, restartErr)
@@ -309,6 +491,9 @@ func switchContainer(
 	disconnectedNetworks, disconnectErr := disconnectOriginalContainerNetworks(ctx, cli, oldContainer)
 	logContainerSwitchStep(logger, "ContainerDisconnectOld", backupName, disconnectErr)
 	if disconnectErr != nil {
+		if boundedRecovery {
+			return nil, recoverUpgrade("", disconnectErr)
+		}
 		rollbackErr := restoreOriginalContainer(ctx, cli, oldContainer.ID, name, wasRunning, "", disconnectedNetworks, logger)
 		return nil, errors.Join(disconnectErr, rollbackErr)
 	}
@@ -316,11 +501,17 @@ func switchContainer(
 	created, createErr := createNew()
 	logContainerSwitchStep(logger, "ContainerCreateReplacement", name, createErr)
 	if createErr != nil {
+		if boundedRecovery {
+			return nil, recoverUpgrade(created.ID, createErr)
+		}
 		rollbackErr := restoreOriginalContainer(ctx, cli, oldContainer.ID, name, wasRunning, created.ID, disconnectedNetworks, logger)
 		return nil, errors.Join(createErr, rollbackErr)
 	}
 	if err := cli.ContainerStart(ctx, created.ID, container.StartOptions{}); err != nil {
 		logContainerSwitchStep(logger, "ContainerStartReplacement", name, err)
+		if boundedRecovery {
+			return nil, recoverUpgrade(created.ID, fmt.Errorf("start new container failed: %w", err))
+		}
 		logContainerStartupLogs(ctx, cli, created.ID, name, tty, logger)
 		rollbackErr := restoreOriginalContainer(ctx, cli, oldContainer.ID, name, wasRunning, created.ID, disconnectedNetworks, logger)
 		return nil, errors.Join(fmt.Errorf("start new container failed: %w", err), rollbackErr)
@@ -329,6 +520,9 @@ func switchContainer(
 	if wasRunning {
 		if err := waitContainerReady(ctx, cli, created.ID); err != nil {
 			logContainerSwitchStep(logger, "ContainerWaitReplacement", name, err)
+			if boundedRecovery {
+				return nil, recoverUpgrade(created.ID, fmt.Errorf("new container readiness check failed: %w", err))
+			}
 			logContainerStartupLogs(ctx, cli, created.ID, name, tty, logger)
 			rollbackErr := restoreOriginalContainer(ctx, cli, oldContainer.ID, name, wasRunning, created.ID, disconnectedNetworks, logger)
 			return nil, errors.Join(fmt.Errorf("new container readiness check failed: %w", err), rollbackErr)
@@ -336,6 +530,11 @@ func switchContainer(
 		logContainerSwitchStep(logger, "ContainerWaitReplacement", name, nil)
 	}
 
+	if boundedRecovery {
+		cleanupCtx, cancel := context.WithTimeout(context.Background(), containerUpgradeRecoveryTimeout)
+		defer cancel()
+		ctx = cleanupCtx
+	}
 	cleanupErr = cli.ContainerRemove(ctx, oldContainer.ID, container.RemoveOptions{Force: true, RemoveVolumes: false})
 	logContainerSwitchStep(logger, "ContainerRemoveOld", backupName, cleanupErr)
 	return cleanupErr, nil

agent/app/service/dashboard.go

@@ -43,6 +43,10 @@ type IDashboardService interface {
 
 	LoadQuickOptions() []dto.QuickJump
 	ChangeQuick(req dto.ChangeQuicks) error
+	ListQuickDirectories() ([]model.QuickDirectory, error)
+	CreateQuickDirectory(req dto.QuickDirectoryCreate) (*model.QuickDirectory, error)
+	UpdateQuickDirectory(req dto.QuickDirectoryUpdate) (*model.QuickDirectory, error)
+	DeleteQuickDirectory(req dto.QuickDirectoryDelete) error
 
 	LoadAppLauncher(ctx *gin.Context) ([]dto.AppLauncher, error)
 	ChangeShow(req dto.SettingUpdate) error
@@ -397,16 +401,15 @@ func (u *DashboardService) LoadQuickOptions() []dto.QuickJump {
 }
 func (u *DashboardService) ChangeQuick(req dto.ChangeQuicks) error {
 	showCount := 0
-	var quicks []model.QuickJump
+	quicks := make([]model.QuickJump, 0, len(req.Quicks))
 	for _, item := range req.Quicks {
-		var quick model.QuickJump
 		if item.IsShow {
 			showCount++
 		}
-		if err := copier.Copy(&quick, &item); err != nil {
-			return err
-		}
-		quicks = append(quicks, quick)
+		quicks = append(quicks, model.QuickJump{
+			BaseModel: model.BaseModel{ID: item.ID},
+			IsShow:    item.IsShow,
+		})
 	}
 	if showCount == 0 {
 		return buserr.New("ErrMinQuickJump")
@@ -706,6 +709,13 @@ func loadQuickJump(base *dto.DashboardBase) {
 	quicks := launcherRepo.ListQuickJump(false)
 	for i := 0; i < len(quicks); i++ {
 		switch quicks[i].Name {
+		case "File":
+			count, err := launcherRepo.CountQuickDirectories()
+			if err != nil {
+				global.LOG.Errorf("load quick directory count: %v", err)
+			}
+			quicks[i].Detail = fmt.Sprintf("%d", count)
+			quicks[i].Alias = ""
 		case "Agent":
 			quicks[i].Detail = fmt.Sprintf("%d", base.AgentNumber)
 		case "Website":

agent/app/service/database.go

@@ -5,12 +5,14 @@ import (
 	"fmt"
 	"os"
 	"path"
+	"strings"
 
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/repo"
 	"github.com/1Panel-dev/1Panel/agent/buserr"
 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
 	"github.com/1Panel-dev/1Panel/agent/utils/encrypt"
 	"github.com/1Panel-dev/1Panel/agent/utils/mysql"
 	"github.com/1Panel-dev/1Panel/agent/utils/mysql/client"
@@ -126,6 +128,9 @@ func (u *DatabaseService) LoadItems(dbType string) ([]dto.DatabaseItem, error) {
 }
 
 func (u *DatabaseService) CheckDatabase(req dto.DatabaseCreate) bool {
+	if (req.Type == constant.AppMysql || req.Type == constant.AppMariaDB || req.Type == constant.AppPostgresql || req.Type == constant.AppMongodb) && (cmd.CheckIllegal(req.Username, req.Password) || strings.Contains(req.Password, " ")) {
+		return false
+	}
 	if req.Timeout == 0 {
 		req.Timeout = 30
 	}
@@ -180,6 +185,9 @@ func (u *DatabaseService) CheckDatabase(req dto.DatabaseCreate) bool {
 }
 
 func (u *DatabaseService) Create(req dto.DatabaseCreate) error {
+	if (req.Type == constant.AppMysql || req.Type == constant.AppMariaDB || req.Type == constant.AppPostgresql || req.Type == constant.AppMongodb) && (cmd.CheckIllegal(req.Username, req.Password) || strings.Contains(req.Password, " ")) {
+		return buserr.New("ErrCmdIllegal")
+	}
 	if req.Timeout == 0 {
 		req.Timeout = 30
 	}
@@ -303,6 +311,9 @@ func (u *DatabaseService) Delete(req dto.DatabaseDelete) error {
 }
 
 func (u *DatabaseService) Update(req dto.DatabaseUpdate) error {
+	if (req.Type == constant.AppMysql || req.Type == constant.AppMariaDB || req.Type == constant.AppPostgresql || req.Type == constant.AppMongodb) && (cmd.CheckIllegal(req.Username, req.Password) || strings.Contains(req.Password, " ")) {
+		return buserr.New("ErrCmdIllegal")
+	}
 	switch req.Type {
 	case constant.AppPostgresql:
 		if _, err := postgresql.NewPostgresqlClient(pgclient.DBInfo{

agent/app/service/database_mongodb.go

@@ -64,7 +64,7 @@ func (u *MongodbService) UpdateDescription(req dto.UpdateDescription) error {
 }
 
 func (u *MongodbService) Create(ctx context.Context, req dto.MongodbDBCreate) (*model.DatabaseMongodb, error) {
-	if cmd.CheckIllegal(req.Name, req.Username, req.Password) {
+	if cmd.CheckIllegal(req.Name, req.Username, req.Password) || strings.Contains(req.Password, " ") {
 		return nil, buserr.New("ErrCmdIllegal")
 	}
 	if !isSupportedMongodbPrivilege(req.Permission) {
@@ -146,7 +146,7 @@ func (u *MongodbService) LoadFromRemote(req dto.MongodbLoadDB) error {
 }
 
 func (u *MongodbService) BindUser(req dto.MongodbBind) error {
-	if cmd.CheckIllegal(req.Database, req.Name, req.Username, req.Password) {
+	if cmd.CheckIllegal(req.Database, req.Name, req.Username, req.Password) || strings.Contains(req.Password, " ") {
 		return buserr.New("ErrCmdIllegal")
 	}
 
@@ -168,7 +168,7 @@ func (u *MongodbService) BindUser(req dto.MongodbBind) error {
 }
 
 func (u *MongodbService) ChangePassword(req dto.MongodbPassword) error {
-	if cmd.CheckIllegal(req.Database, req.Name, req.Password) {
+	if cmd.CheckIllegal(req.Database, req.Name, req.Password) || strings.Contains(req.Password, " ") {
 		return buserr.New("ErrCmdIllegal")
 	}
 
@@ -190,7 +190,7 @@ func (u *MongodbService) ChangePassword(req dto.MongodbPassword) error {
 }
 
 func (u *MongodbService) ChangeRootPassword(req dto.ChangeDBInfo) error {
-	if cmd.CheckIllegal(req.Value) {
+	if cmd.CheckIllegal(req.Value) || strings.Contains(req.Value, " ") {
 		return buserr.New("ErrCmdIllegal")
 	}
 	if req.From != constant.AppResourceLocal {

agent/app/service/database_mysql.go

@@ -433,7 +433,46 @@ func (u *MysqlService) ListDBOption() ([]dto.MysqlOption, error) {
 }
 
 func (u *MysqlService) Create(ctx context.Context, req dto.MysqlDBCreate) (*model.DatabaseMysql, error) {
-	if cmd.CheckIllegal(req.Name, req.Username, req.Password, req.Format, req.Collation, req.Permission) {
+	creation, err := prepareMysqlCreation(req)
+	if err != nil {
+		return nil, err
+	}
+	req = creation.request
+	cli, version, err := LoadMysqlClientByFrom(req.Database)
+	if err != nil {
+		return nil, err
+	}
+	defer cli.Close()
+	if err := cli.Create(creation.createInfo(version)); err != nil {
+		return nil, err
+	}
+	if len(req.Username) != 0 {
+		if err := saveDatabaseUserCredentials(creation.dbType, req.Database, req.Username, req.Permission, req.Password, req.Description); err != nil {
+			return nil, err
+		}
+		for _, host := range creation.permissionHosts {
+			if err := saveDatabaseUserGrant(creation.dbType, req.Database, req.Name, req.Username, host); err != nil {
+				return nil, err
+			}
+		}
+	}
+
+	global.LOG.Infof("create database %s successful!", req.Name)
+	if err := mysqlRepo.Create(ctx, &creation.item); err != nil {
+		return nil, err
+	}
+	return &creation.item, nil
+}
+
+type mysqlCreation struct {
+	request         dto.MysqlDBCreate
+	dbType          string
+	permissionHosts []string
+	item            model.DatabaseMysql
+}
+
+func prepareMysqlCreation(req dto.MysqlDBCreate) (*mysqlCreation, error) {
+	if cmd.CheckIllegal(req.Name, req.Username, req.Password, req.Format, req.Collation, req.Permission) || strings.Contains(req.Password, " ") {
 		return nil, buserr.New("ErrCmdIllegal")
 	}
 	if len(req.Username) != 0 && len(req.Password) == 0 {
@@ -470,13 +509,13 @@ func (u *MysqlService) Create(ctx context.Context, req dto.MysqlDBCreate) (*mode
 		return nil, errors.New("cannot set root as user name")
 	}
 
-	cli, version, err := LoadMysqlClientByFrom(req.Database)
-	if err != nil {
-		return nil, err
-	}
 	createItem.MysqlName = req.Database
-	defer cli.Close()
-	if err := cli.Create(client.CreateInfo{
+	return &mysqlCreation{request: req, dbType: dbType, permissionHosts: permissionHosts, item: createItem}, nil
+}
+
+func (creation *mysqlCreation) createInfo(version string) client.CreateInfo {
+	req := creation.request
+	return client.CreateInfo{
 		Name:       req.Name,
 		Format:     req.Format,
 		Collation:  req.Collation,
@@ -485,25 +524,46 @@ func (u *MysqlService) Create(ctx context.Context, req dto.MysqlDBCreate) (*mode
 		Permission: req.Permission,
 		Version:    version,
 		Timeout:    300,
-	}); err != nil {
-		return nil, err
 	}
-	if len(req.Username) != 0 {
-		if err := saveDatabaseUserCredentials(dbType, req.Database, req.Username, req.Permission, req.Password, req.Description); err != nil {
-			return nil, err
-		}
-		for _, host := range permissionHosts {
-			if err := saveDatabaseUserGrant(dbType, req.Database, req.Name, req.Username, host); err != nil {
-				return nil, err
+}
+
+func saveMysqlCreationMetadata(ctx context.Context, req dto.MysqlDBCreate, hosts []string, item *model.DatabaseMysql) error {
+	return global.DB.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		txCtx := context.WithValue(ctx, constant.DB, tx)
+		if req.Username != "" {
+			key := global.CONF.Base.EncryptKey
+			if key == "" {
+				setting, err := settingRepo.GetWithContext(txCtx, repo.WithByKey("EncryptKey"))
+				if err != nil {
+					return err
+				}
+				key = setting.Value
+			}
+			password, err := encrypt.StringEncryptWithKey(req.Password, key)
+			if err != nil {
+				return err
+			}
+			for _, host := range hosts {
+				user, err := databaseUserRepo.GetEncryptedWithContext(txCtx, repo.WithByType("mysql"), databaseUserRepo.WithByDatabase(req.Database), databaseUserRepo.WithByUser(req.Username, host))
+				if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
+					return err
+				}
+				user.Type, user.Database, user.Username, user.Host = "mysql", req.Database, req.Username, host
+				user.Password, user.IsDelete = password, false
+				if req.Description != "" {
+					user.Description = req.Description
+				}
+				if err := databaseUserRepo.SaveEncryptedWithContext(txCtx, &user); err != nil {
+					return err
+				}
+				grant := model.DatabaseUserGrant{Type: "mysql", Database: req.Database, DBName: req.Name, Username: req.Username, Host: host}
+				if err := databaseUserGrantRepo.CreateIfAbsent(txCtx, &grant); err != nil {
+					return err
+				}
 			}
 		}
-	}
-
-	global.LOG.Infof("create database %s successful!", req.Name)
-	if err := mysqlRepo.Create(ctx, &createItem); err != nil {
-		return nil, err
-	}
-	return &createItem, nil
+		return mysqlRepo.CreateMetadata(txCtx, item)
+	})
 }
 
 func (u *MysqlService) ListUsers(req dto.MysqlUserSearch) ([]dto.MysqlUser, error) {
@@ -615,7 +675,7 @@ func (u *MysqlService) ListGrantSummary(req dto.MysqlGrantSummarySearch) (map[st
 }
 
 func (u *MysqlService) CreateUser(req dto.MysqlUserCreate) error {
-	if cmd.CheckIllegal(req.Username, req.Password, req.Host) {
+	if cmd.CheckIllegal(req.Username, req.Password, req.Host) || strings.Contains(req.Password, " ") {
 		return buserr.New("ErrCmdIllegal")
 	}
 	dbs := make([]string, 0, len(req.DBs))
@@ -818,7 +878,7 @@ func (u *MysqlService) UpdateUser(req dto.MysqlUserUpdate) error {
 }
 
 func (u *MysqlService) ChangeUserPassword(req dto.MysqlUserPassword) error {
-	if cmd.CheckIllegal(req.Username, req.Host, req.Password) {
+	if cmd.CheckIllegal(req.Username, req.Host, req.Password) || strings.Contains(req.Password, " ") {
 		return buserr.New("ErrCmdIllegal")
 	}
 	if err := checkMysqlNormalUser(req.Username); err != nil {
@@ -871,7 +931,7 @@ func (u *MysqlService) ChangeUserPassword(req dto.MysqlUserPassword) error {
 }
 
 func (u *MysqlService) SaveUserPassword(req dto.MysqlUserPassword) error {
-	if cmd.CheckIllegal(req.Username, req.Host, req.Password) {
+	if cmd.CheckIllegal(req.Username, req.Host, req.Password) || strings.Contains(req.Password, " ") {
 		return buserr.New("ErrCmdIllegal")
 	}
 	if err := checkMysqlNormalUser(req.Username); err != nil {
@@ -1237,7 +1297,7 @@ func isMysqlDatabaseResourceInUseError(err error) bool {
 }
 
 func (u *MysqlService) ChangePassword(req dto.ChangeDBInfo) error {
-	if cmd.CheckIllegal(req.Value) {
+	if cmd.CheckIllegal(req.Value) || strings.Contains(req.Value, " ") {
 		return buserr.New("ErrCmdIllegal")
 	}
 	cli, version, err := LoadMysqlClientByFrom(req.Database)
@@ -1398,7 +1458,14 @@ func (u *MysqlService) LoadStatus(req dto.OperationWithNameAndType) (*dto.MysqlS
 		return nil, err
 	}
 
-	statusMap, err := executeSqlForMaps(app.ContainerName, app.Key, app.Password, "show global status;")
+	return loadMysqlStatus(req, app, executeSqlForMaps, executeSqlForRows)
+}
+
+func loadMysqlStatus(req dto.OperationWithNameAndType, app *repo.RootInfo,
+	maps func(string, string, string, string) (map[string]string, error),
+	rowsQuery func(string, string, string, string) ([]string, error),
+) (*dto.MysqlStatus, error) {
+	statusMap, err := maps(app.ContainerName, app.Key, app.Password, "show global status;")
 	if err != nil {
 		return nil, err
 	}
@@ -1426,7 +1493,7 @@ func (u *MysqlService) LoadStatus(req dto.OperationWithNameAndType) (*dto.MysqlS
 	if common.CompareAppVersion(app.Version, "8.4.0") && (req.Type == constant.AppMysql || req.Type == constant.AppMysqlCluster) {
 		masterStatus = "show binary log status;"
 	}
-	rows, err := executeSqlForRows(app.ContainerName, app.Key, app.Password, masterStatus)
+	rows, err := rowsQuery(app.ContainerName, app.Key, app.Password, masterStatus)
 	if err != nil {
 		return nil, err
 	}
@@ -1531,6 +1598,34 @@ func updateMyCnf(oldFiles []string, group string, param string, value interface{
 }
 
 func LoadMysqlClientByFrom(database string) (mysql.MysqlClient, string, error) {
+	databaseItem, err := databaseRepo.Get(repo.WithByName(database))
+	if err != nil {
+		return nil, "", err
+	}
+	return newMysqlClientForDatabase(databaseItem, database)
+}
+
+func loadInstalledLocalMysqlClient(database string) (*client.Local, string, error) {
+	databaseItem, err := databaseRepo.Get(repo.WithByName(database))
+	if err != nil {
+		return nil, "", err
+	}
+	if databaseItem.ID == 0 || databaseItem.From != "local" || databaseItem.Type != "mysql" || databaseItem.AppInstallID == 0 {
+		return nil, "", errors.New("an installed local MySQL instance is required")
+	}
+	cli, version, err := newMysqlClientForDatabase(databaseItem, database)
+	if err != nil {
+		return nil, "", err
+	}
+	local, ok := cli.(*client.Local)
+	if !ok {
+		cli.Close()
+		return nil, "", errors.New("an installed local MySQL instance is required")
+	}
+	return local, version, nil
+}
+
+func newMysqlClientForDatabase(databaseItem model.Database, database string) (mysql.MysqlClient, string, error) {
 	var (
 		dbInfo  client.DBInfo
 		version string
@@ -1538,10 +1633,6 @@ func LoadMysqlClientByFrom(database string) (mysql.MysqlClient, string, error) {
 	)
 
 	dbInfo.Timeout = 300
-	databaseItem, err := databaseRepo.Get(repo.WithByName(database))
-	if err != nil {
-		return nil, "", err
-	}
 	dbInfo.Type = databaseItem.Type
 	dbInfo.From = databaseItem.From
 	dbInfo.Database = database

agent/app/service/database_mysql_mcp.go

@@ -0,0 +1,50 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/utils/mcpapi"
+)
+
+func (u *MysqlService) CreateForMCP(ctx context.Context, req dto.MysqlDBCreate) (*model.DatabaseMysql, error) {
+	if req.From != "local" || ctx.Err() != nil {
+		return nil, errors.New("invalid MCP database target or request")
+	}
+	writeContext, cancel := context.WithTimeout(context.WithoutCancel(ctx), 310*time.Second)
+	defer cancel()
+	created, err := createMCPMysqlDatabase(writeContext, req)
+	if err != nil {
+		return nil, mcpapi.SanitizeBusinessError(err, "database creation failed; inspect the invocation before retrying")
+	}
+	return created, nil
+}
+
+func createMCPMysqlDatabase(ctx context.Context, req dto.MysqlDBCreate) (*model.DatabaseMysql, error) {
+	creation, err := prepareMysqlCreation(req)
+	if err != nil {
+		return nil, err
+	}
+	local, version, err := loadInstalledLocalMysqlClient(creation.request.Database)
+	if err != nil {
+		return nil, err
+	}
+	defer local.Close()
+	deadline := time.Now().Add(300 * time.Second)
+	if writeDeadline, ok := ctx.Deadline(); ok && writeDeadline.Add(-10*time.Second).Before(deadline) {
+		deadline = writeDeadline.Add(-10 * time.Second)
+	}
+	sqlContext, cancel := context.WithDeadline(ctx, deadline)
+	err = local.CreateWithContext(sqlContext, creation.createInfo(version))
+	cancel()
+	if err != nil {
+		return nil, err
+	}
+	if err := saveMysqlCreationMetadata(ctx, creation.request, creation.permissionHosts, &creation.item); err != nil {
+		return nil, err
+	}
+	return &creation.item, nil
+}

agent/app/service/database_postgresql.go

@@ -87,7 +87,7 @@ func (u *PostgresqlService) ListDBOption() ([]dto.PostgresqlOption, error) {
 }
 
 func (u *PostgresqlService) BindUser(req dto.PostgresqlBindUser) error {
-	if cmd.CheckIllegal(req.Name, req.Username, req.Password) {
+	if cmd.CheckIllegal(req.Name, req.Username, req.Password) || strings.Contains(req.Password, " ") {
 		return buserr.New("ErrCmdIllegal")
 	}
 	dbItem, err := postgresqlRepo.Get(postgresqlRepo.WithByPostgresqlName(req.Database), repo.WithByName(req.Name))
@@ -123,7 +123,7 @@ func (u *PostgresqlService) BindUser(req dto.PostgresqlBindUser) error {
 }
 
 func (u *PostgresqlService) Create(ctx context.Context, req dto.PostgresqlDBCreate) (*model.DatabasePostgresql, error) {
-	if cmd.CheckIllegal(req.Name, req.Username, req.Password, req.Format) {
+	if cmd.CheckIllegal(req.Name, req.Username, req.Password, req.Format) || strings.Contains(req.Password, " ") {
 		return nil, buserr.New("ErrCmdIllegal")
 	}
 
@@ -366,7 +366,7 @@ func (u *PostgresqlService) ChangePrivileges(req dto.PostgresqlPrivileges) error
 }
 
 func (u *PostgresqlService) ChangePassword(req dto.ChangeDBInfo) error {
-	if cmd.CheckIllegal(req.Value) {
+	if cmd.CheckIllegal(req.Value) || strings.Contains(req.Value, " ") {
 		return buserr.New("ErrCmdIllegal")
 	}
 	cli, err := LoadPostgresqlClientByFrom(req.Database)

agent/app/service/file.go

@@ -882,6 +882,16 @@ func (f *FileService) ChangeName(req request.FileRename) error {
 	if hasInvalidFileName(req.NewName) {
 		return buserr.New("ErrInvalidChar")
 	}
+	if req.OldName == req.NewName {
+		return nil
+	}
+	// os.Rename silently replaces an existing target on Linux, so reject the
+	// rename here to avoid losing the target file without confirmation.
+	if _, err := os.Lstat(req.NewName); err == nil {
+		return buserr.New("ErrFileIsExist")
+	} else if !os.IsNotExist(err) {
+		return err
+	}
 	fo := files.NewFileOp()
 	content, mode, shouldRecordHistory := readEditableFileHistoryContent(req.OldName)
 	if err := fo.Rename(req.OldName, req.NewName); err != nil {

agent/app/service/file_test.go

@@ -0,0 +1,63 @@
+package service
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+)
+
+func TestChangeNameRejectsExistingTarget(t *testing.T) {
+	dir := t.TempDir()
+	oldPath := filepath.Join(dir, "old.txt")
+	targetPath := filepath.Join(dir, "target.txt")
+	// Binary source content keeps this test independent of the file-history DB.
+	if err := os.WriteFile(oldPath, []byte("old\x00"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(targetPath, []byte("target"), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	err := (&FileService{}).ChangeName(request.FileRename{OldName: oldPath, NewName: targetPath})
+	if err == nil {
+		t.Fatal("expected an error when the target name already exists")
+	}
+	var bizErr buserr.BusinessError
+	if !errors.As(err, &bizErr) || bizErr.Msg != "ErrFileIsExist" {
+		t.Fatalf("expected ErrFileIsExist, got %v", err)
+	}
+
+	content, err := os.ReadFile(targetPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(content) != "target" {
+		t.Fatalf("target file was overwritten, content = %q", content)
+	}
+	if _, err := os.Stat(oldPath); err != nil {
+		t.Fatalf("source file should still exist after a rejected rename: %v", err)
+	}
+}
+
+func TestChangeNameRenamesToNewName(t *testing.T) {
+	dir := t.TempDir()
+	oldPath := filepath.Join(dir, "old")
+	newPath := filepath.Join(dir, "new")
+	if err := os.Mkdir(oldPath, 0755); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := (&FileService{}).ChangeName(request.FileRename{OldName: oldPath, NewName: newPath}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(newPath); err != nil {
+		t.Fatalf("renamed path does not exist: %v", err)
+	}
+	if _, err := os.Stat(oldPath); !os.IsNotExist(err) {
+		t.Fatalf("old path should be gone, stat err = %v", err)
+	}
+}

agent/app/service/firewall.go

@@ -131,6 +131,9 @@ func (s *FirewallService) LoadBaseInfo(chainGroup string) (dto.FirewallSubsystem
 
 func (s *FirewallService) QueueFirewallOperation(request dto.FirewallLifecycleOperation) (dto.FirewallLifecycleOperationResponse, error) {
 	response := dto.FirewallLifecycleOperationResponse{}
+	if request.BackupFile != "" && request.Operation != string(lifecycle.OperationStart) {
+		return response, fmt.Errorf("backup restoration is only supported when starting firewalld or ufw")
+	}
 	if request.Operation == "disableBanPing" || request.Operation == "enableBanPing" {
 		return response, s.OperateFirewall(request)
 	}
@@ -155,6 +158,19 @@ func (s *FirewallService) QueueFirewallOperation(request dto.FirewallLifecycleOp
 	if err != nil {
 		return response, err
 	}
+	var restoreRequest dto.FirewallRuleCreate
+	if request.BackupFile != "" {
+		if client.Name() != lifecycle.ProviderFirewalld && client.Name() != lifecycle.ProviderUFW {
+			return response, fmt.Errorf("backup restoration is only supported when starting firewalld or ufw")
+		}
+		restoreRequest, err = prepareFirewallRuleCreate(dto.FirewallRuleCreate{BackupFile: request.BackupFile, Initialize: true})
+		if err != nil {
+			return response, err
+		}
+		if err := validateFirewallCreateBatch(restoreRequest, filter.Provider(client.Name())); err != nil {
+			return response, err
+		}
+	}
 	if (client.Name() != lifecycle.ProviderFirewalld && client.Name() != lifecycle.ProviderUFW) ||
 		(request.Operation != string(lifecycle.OperationStart) && request.Operation != string(lifecycle.OperationStop) &&
 			request.Operation != string(lifecycle.OperationRestart)) {
@@ -173,7 +189,26 @@ func (s *FirewallService) QueueFirewallOperation(request dto.FirewallLifecycleOp
 		return response, err
 	}
 	taskItem.AddSubTaskWithOps(name, func(t *task.Task) error {
-		return s.runFirewallLifecycleTask(t, client, request, true)
+		if request.BackupFile != "" {
+			if err := s.checkSelectedProvider(t.TaskCtx, filter.Provider(client.Name())); err != nil {
+				return err
+			}
+		}
+		prepareStart := func(lifecycle.Client) error {
+			if request.BackupFile != "" {
+				return runFirewallLifecycleAction(t, i18n.GetMsgByKey("FirewallCreateRulesStep"), func() error {
+					return s.runFirewallCreateRulesTask(t, restoreRequest, filter.Provider(client.Name()))
+				})
+			}
+			return runFirewallLifecycleAction(t, i18n.GetMsgByKey("FirewallSyncWhitelistStep"), func() error {
+				err := s.SyncPortWhitelist(t.TaskCtx)
+				if err == nil && client.Name() == lifecycle.ProviderFirewalld {
+					err = lifecycleproviders.RemoveFirewalldSSHService()
+				}
+				return err
+			})
+		}
+		return s.runFirewallLifecycleTask(t, client, request, prepareStart)
 	}, nil, 0, 0)
 	if err := taskRepo.Save(context.Background(), taskItem.Task); err != nil {
 		closeUnstartedFirewallTask(taskItem)
@@ -554,29 +589,9 @@ func (s *FirewallService) LoadFirewallNativeDetail(ctx context.Context, request
 }
 
 func (s *FirewallService) Create(ctx context.Context, request dto.FirewallRuleCreate) (dto.FirewallRuleCreateResponse, error) {
-	if request.BackupFile != "" {
-		if len(request.Items) != 0 {
-			return dto.FirewallRuleCreateResponse{}, filter.ErrInvalidRule
-		}
-		items, err := readFirewallBackup(request.BackupFile)
-		if err != nil {
-			return dto.FirewallRuleCreateResponse{}, err
-		}
-		for _, item := range items {
-			request.Items = append(request.Items, dto.FirewallRuleCreateItem{Rule: item.FirewallRule, Raw: item.Raw, ParseStatus: item.ParseStatus, SourceKind: constant.FirewallRuleSourceImported})
-		}
-	}
-
-	for index, item := range request.Items {
-		if item.SourceKind != constant.FirewallRuleSourceImported || item.Rule.Scope.Provider != filter.ProviderUFW || item.ParseStatus != filter.ParseStatusPartial || item.Raw == "" {
-			continue
-		}
-		observed := filterufw.ParseRules(item.Rule.Scope, item.Raw)
-		if len(observed) == 1 && observed[0].ParseStatus == filter.ParseStatusSupported {
-			observed[0].Rule.Description = item.Rule.Description
-			request.Items[index].Rule = observed[0].Rule
-			request.Items[index].ParseStatus, request.Items[index].Raw = filter.ParseStatusSupported, ""
-		}
+	request, err := prepareFirewallRuleCreate(request)
+	if err != nil {
+		return dto.FirewallRuleCreateResponse{}, err
 	}
 
 	provider, err := s.selectedProvider(ctx)
@@ -609,30 +624,11 @@ func (s *FirewallService) Create(ctx context.Context, request dto.FirewallRuleCr
 			if err != nil {
 				return err
 			}
-			return s.runFirewallLifecycleTask(t, client, dto.FirewallLifecycleOperation{Operation: "start"}, false)
+			return s.runFirewallLifecycleTask(t, client, dto.FirewallLifecycleOperation{Operation: "start"}, nil)
 		}, nil)
 	}
-	ruleState := make(map[string]filter.RuleSet)
 	taskItem.AddSubTaskWithOps(i18n.GetMsgByKey("FirewallCreateRulesStep"), func(t *task.Task) error {
-		firewallRuleMutationMu.Lock()
-		if err := s.checkSelectedProvider(t.TaskCtx, provider); err != nil {
-			firewallRuleMutationMu.Unlock()
-			return err
-		}
-		_, err := s.createRules(t.TaskCtx, request, t, ruleState)
-		firewallRuleMutationMu.Unlock()
-		if !request.Initialize || errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
-			return err
-		}
-		if err != nil {
-			ruleState = nil
-		}
-		whitelistErr := s.syncPortWhitelist(t.TaskCtx, ruleState)
-		if whitelistErr == nil && provider == filter.ProviderFirewalld {
-			whitelistErr = lifecycleproviders.RemoveFirewalldSSHService()
-		}
-		t.LogWithStatus(i18n.GetMsgByKey("FirewallSyncWhitelistStep"), whitelistErr)
-		return errors.Join(err, whitelistErr)
+		return s.runFirewallCreateRulesTask(t, request, provider)
 	}, nil, 0, 0)
 	if err := taskRepo.Save(context.Background(), taskItem.Task); err != nil {
 		taskItem.LogFailedWithErr(taskItem.Name, err)
@@ -777,7 +773,11 @@ func (s *FirewallService) restoreFirewallAfterStart(client lifecycle.Client) err
 			return nil
 		}
 	}
-	recordFailure("restore whitelist allowances", s.SyncPortWhitelist(ctx))
+	whitelistErr := s.SyncPortWhitelist(ctx)
+	if whitelistErr == nil && provider == filter.ProviderFirewalld {
+		whitelistErr = lifecycleproviders.RemoveFirewalldSSHService()
+	}
+	recordFailure("restore whitelist allowances", whitelistErr)
 	return errors.Join(recoveryErrors...)
 }
 
@@ -805,17 +805,9 @@ func (s *FirewallService) restoreFirewalldRuntimeDependents(ctx context.Context,
 	return restoreErr
 }
 
-func (s *FirewallService) runFirewallLifecycleTask(t *task.Task, client lifecycle.Client, request dto.FirewallLifecycleOperation, syncWhitelist bool) error {
+func (s *FirewallService) runFirewallLifecycleTask(t *task.Task, client lifecycle.Client, request dto.FirewallLifecycleOperation, prepareStart func(lifecycle.Client) error) error {
 	ctx := t.TaskCtx
 	provider := filter.Provider(client.Name())
-	var prepareStart func(lifecycle.Client) error
-	if syncWhitelist {
-		prepareStart = func(lifecycle.Client) error {
-			return runFirewallLifecycleAction(t, i18n.GetMsgByKey("FirewallSyncWhitelistStep"), func() error {
-				return s.SyncPortWhitelist(ctx)
-			})
-		}
-	}
 	operationErr := operateFirewallLifecycle(firewallLifecycleClient{client}, request.Operation, request.WithDockerRestart, prepareStart, t)
 	if request.Operation == string(lifecycle.OperationStop) {
 		return operationErr

agent/app/service/firewall_utils.go

@@ -554,6 +554,58 @@ func (s *FirewallService) checkSelectedProvider(ctx context.Context, requested f
 	return nil
 }
 
+func prepareFirewallRuleCreate(request dto.FirewallRuleCreate) (dto.FirewallRuleCreate, error) {
+	if request.BackupFile != "" {
+		if len(request.Items) != 0 {
+			return request, filter.ErrInvalidRule
+		}
+		items, err := readFirewallBackup(request.BackupFile)
+		if err != nil {
+			return request, err
+		}
+		for _, item := range items {
+			request.Items = append(request.Items, dto.FirewallRuleCreateItem{Rule: item.FirewallRule, Raw: item.Raw, ParseStatus: item.ParseStatus, SourceKind: constant.FirewallRuleSourceImported})
+		}
+	}
+
+	for index, item := range request.Items {
+		if item.SourceKind != constant.FirewallRuleSourceImported || item.Rule.Scope.Provider != filter.ProviderUFW || item.ParseStatus != filter.ParseStatusPartial || item.Raw == "" {
+			continue
+		}
+		observed := filterufw.ParseRules(item.Rule.Scope, item.Raw)
+		if len(observed) == 1 && observed[0].ParseStatus == filter.ParseStatusSupported {
+			observed[0].Rule.Description = item.Rule.Description
+			request.Items[index].Rule = observed[0].Rule
+			request.Items[index].ParseStatus, request.Items[index].Raw = filter.ParseStatusSupported, ""
+		}
+	}
+
+	return request, nil
+}
+
+func (s *FirewallService) runFirewallCreateRulesTask(t *task.Task, request dto.FirewallRuleCreate, provider filter.Provider) error {
+	ruleState := make(map[string]filter.RuleSet)
+	firewallRuleMutationMu.Lock()
+	if err := s.checkSelectedProvider(t.TaskCtx, provider); err != nil {
+		firewallRuleMutationMu.Unlock()
+		return err
+	}
+	_, err := s.createRules(t.TaskCtx, request, t, ruleState)
+	firewallRuleMutationMu.Unlock()
+	if !request.Initialize || errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
+		return err
+	}
+	if err != nil {
+		ruleState = nil
+	}
+	whitelistErr := s.syncPortWhitelist(t.TaskCtx, ruleState)
+	if whitelistErr == nil && provider == filter.ProviderFirewalld {
+		whitelistErr = lifecycleproviders.RemoveFirewalldSSHService()
+	}
+	t.LogWithStatus(i18n.GetMsgByKey("FirewallSyncWhitelistStep"), whitelistErr)
+	return errors.Join(err, whitelistErr)
+}
+
 func (s *FirewallService) createRules(ctx context.Context, request dto.FirewallRuleCreate, t *task.Task, ruleState map[string]filter.RuleSet) (result dto.FirewallRuleCreateResponse, taskErr error) {
 	var firstFailure error
 	defer func() {
@@ -1734,9 +1786,6 @@ func operateFirewallLifecycle(client lifecycle.Client, operation string, withDoc
 	var recoveryErrors []error
 	if prepareStart != nil {
 		err := prepareStart(client)
-		if err == nil && client.Name() == constant.FirewallProviderFirewalld {
-			err = lifecycleproviders.RemoveFirewalldSSHService()
-		}
 		if err != nil {
 			recoveryErrors = append(recoveryErrors, fmt.Errorf("prepare firewall after %s: %w", operation, err))
 		}
@@ -1758,17 +1807,82 @@ func operateFirewallLifecycle(client lifecycle.Client, operation string, withDoc
 }
 
 func (c firewallLifecycleClient) Start() error {
+	firewallWhitelistMu.Lock()
+	defer firewallWhitelistMu.Unlock()
 	firewallRuleMutationMu.Lock()
 	defer firewallRuleMutationMu.Unlock()
+	if err := c.prepareAccessWhitelistBeforeStart(); err != nil {
+		global.LOG.Warnf("prepare %s access whitelist before start failed: %v", c.Name(), err)
+	}
 	return c.Client.Start()
 }
 
 func (c firewallLifecycleClient) Restart() error {
+	firewallWhitelistMu.Lock()
+	defer firewallWhitelistMu.Unlock()
 	firewallRuleMutationMu.Lock()
 	defer firewallRuleMutationMu.Unlock()
+	if err := c.prepareAccessWhitelistBeforeStart(); err != nil {
+		global.LOG.Warnf("prepare %s access whitelist before restart failed: %v", c.Name(), err)
+	}
 	return c.Client.Restart()
 }
 
+func (c firewallLifecycleClient) prepareAccessWhitelistBeforeStart() error {
+	provider := filter.Provider(c.Name())
+	if provider != filter.ProviderFirewalld && provider != filter.ProviderUFW {
+		return nil
+	}
+	ports, err := LoadRequiredFirewallPortWhiteList()
+	if err != nil {
+		return err
+	}
+	var adapter filter.Adapter
+	var active bool
+	if provider == filter.ProviderFirewalld {
+		active, err = c.Status()
+		if err != nil {
+			return err
+		}
+		adapter = filterfirewalld.NewAdapter()
+	} else {
+		adapter = filterufw.NewAdapter()
+	}
+	var commands []filter.NativeCommand
+	for _, port := range firewall.ExpandPortWhitelist(ports) {
+		rule := firewall.RuleForSystemPort(provider, port)
+		rule.Scope = rule.Scope.Normalize()
+		rule.UUID = uuid.NewString()
+		if provider == filter.ProviderUFW {
+			position := int64(1)
+			rule.OrderIndex = &position
+		}
+		plan, err := adapter.BuildCommands(filter.RuleSet{Scope: rule.Scope}, []filter.RuleChange{{Operation: filter.ChangeCreate, After: &rule}})
+		if err != nil {
+			return err
+		}
+		for _, item := range plan.Rules {
+			for _, command := range item.Commands {
+				if provider == filter.ProviderFirewalld {
+					if active {
+						command.Args = append(command.Args, "--permanent")
+					} else {
+						command.Executable = "firewall-offline-cmd"
+					}
+				}
+				commands = append(commands, command)
+			}
+		}
+	}
+	manager := cmd.NewCommandMgr(cmd.WithTimeout(60*time.Second), cmd.WithEnv("LC_ALL=C", "LANGUAGE=en_US:en"))
+	for _, command := range commands {
+		if err := manager.RunWithOptionalSudo(command.Executable, command.Args...); err != nil {
+			return fmt.Errorf("prepare %s access whitelist before start: %w", provider, err)
+		}
+	}
+	return nil
+}
+
 func runFirewallLifecycleAction(t *task.Task, name string, action func() error) error {
 	t.Log(i18n.GetWithName("TaskStart", name))
 	started := time.Now()

agent/app/service/mcp_mysql_errors.go

@@ -0,0 +1,50 @@
+package service
+
+import (
+	"errors"
+	"regexp"
+	"strings"
+	"unicode"
+	"unicode/utf8"
+
+	"github.com/1Panel-dev/1Panel/agent/utils/mcpapi"
+)
+
+const mcpMysqlStoppedMessage = "The selected MySQL instance is not running. Start the database service and try the query again."
+const mcpMysqlConnectionFailedMessage = "Cannot connect to the selected MySQL instance. Check the database service, connection settings and panel logs."
+
+var errMCPMysqlStopped = mcpapi.NewBusinessError(mcpapi.CodeMySQLStopped, mcpMysqlStoppedMessage)
+var errMCPMysqlConnectionFailed = mcpapi.NewBusinessError(mcpapi.CodeMySQLConnectionFailed, mcpMysqlConnectionFailedMessage)
+
+var mcpMysqlStoppedPattern = regexp.MustCompile(`^Error response from daemon: [Cc]ontainer [A-Za-z0-9][A-Za-z0-9_.-]{0,127} is not running$`)
+var mcpMysqlConnectionPatterns = []*regexp.Regexp{
+	regexp.MustCompile(`^ERROR 2002 \(HY000\): Can't connect to local MySQL server through socket '[^'\r\n]{1,1000}' \([0-9]{1,10}\)$`),
+	regexp.MustCompile(`^ERROR 2003 \(HY000\): Can't connect to MySQL server on '[^'\r\n]{1,1000}' \([0-9]{1,10}\)$`),
+	regexp.MustCompile(`^ERROR 1045 \(28000\): Access denied for user '[^'\r\n]{1,128}'@'[^'\r\n]{1,255}' \(using password: (YES|NO)\)$`),
+}
+
+func classifyMCPMysqlReadFailure(stderr string) error {
+	generic := errors.New("local MySQL status query failed")
+	if len(stderr) == 0 || len(stderr) > 2048 || !utf8.ValidString(stderr) {
+		return generic
+	}
+	warning := "mysql: [Warning] Using a password on the command line interface can be insecure."
+	stderr = strings.TrimPrefix(stderr, warning+"\n")
+	if strings.HasSuffix(stderr, "\r\n") {
+		stderr = strings.TrimSuffix(stderr, "\r\n")
+	} else {
+		stderr = strings.TrimSuffix(stderr, "\n")
+	}
+	if strings.IndexFunc(stderr, unicode.IsControl) >= 0 {
+		return generic
+	}
+	if mcpMysqlStoppedPattern.MatchString(stderr) {
+		return errMCPMysqlStopped
+	}
+	for _, pattern := range mcpMysqlConnectionPatterns {
+		if pattern.MatchString(stderr) {
+			return errMCPMysqlConnectionFailed
+		}
+	}
+	return generic
+}

agent/app/service/mcp_queries.go

@@ -0,0 +1,189 @@
+package service
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"os/exec"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/dto/response"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/app/repo"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"gorm.io/gorm"
+)
+
+const mcpMysqlQueryTimeout = 30 * time.Second
+const mcpMysqlQueryOutputLimit = 1 << 20
+
+func mcpLocalMysqlQuery(ctx context.Context) *gorm.DB {
+	return global.DB.WithContext(ctx).Table("databases AS d").
+		Joins("JOIN app_installs AS ai ON ai.id = d.app_install_id AND ai.name = d.name").
+		Joins("JOIN apps AS a ON a.id = ai.app_id").
+		Where("d.type = ? AND d.\"from\" = ? AND a.key = ?", constant.AppMysql, "local", constant.AppMysql).
+		Where("ai.status <> ? AND ai.container_name <> ?", constant.StatusDeleted, "")
+}
+
+func (u *DatabaseService) ListForMCP(ctx context.Context, dbType string) ([]dto.DatabaseOption, error) {
+	if dbType != constant.AppMysql {
+		return nil, errors.New("only installed local MySQL instances are supported")
+	}
+	result := make([]dto.DatabaseOption, 0)
+	err := mcpLocalMysqlQuery(ctx).Select("d.id, d.type, d.\"from\", d.name AS database, ai.version").Order("d.id").Scan(&result).Error
+	if err != nil {
+		return nil, errors.New("cannot read local MySQL instances")
+	}
+	return result, nil
+}
+
+type mcpMysqlReadRunner func(context.Context, string, string, string) (string, error)
+
+func (u *MysqlService) LoadStatusForMCP(ctx context.Context, req dto.OperationWithNameAndType) (*dto.MysqlStatus, error) {
+	return u.loadStatusForMCP(ctx, req, runMCPMysqlRead)
+}
+func (u *MysqlService) loadStatusForMCP(ctx context.Context, req dto.OperationWithNameAndType, run mcpMysqlReadRunner) (*dto.MysqlStatus, error) {
+	if req.Type != constant.AppMysql || req.Name == "" || len(req.Name) > 128 || strings.TrimSpace(req.Name) != req.Name || strings.ContainsAny(req.Name, "\x00\r\n/\\") || ctx.Err() != nil {
+		return nil, errors.New("an explicitly named installed local MySQL instance is required")
+	}
+	ctx, cancel := context.WithTimeout(ctx, mcpMysqlQueryTimeout)
+	defer cancel()
+	var target struct {
+		ID                          uint
+		ContainerName, Version, Env string
+	}
+	if err := mcpLocalMysqlQuery(ctx).Where("d.name = ?", req.Name).Select("d.id, ai.container_name, ai.version, ai.env").Take(&target).Error; err != nil || target.ID == 0 {
+		return nil, errors.New("the installed local MySQL instance is unavailable")
+	}
+	var env map[string]any
+	if json.Unmarshal([]byte(target.Env), &env) != nil {
+		return nil, errors.New("local MySQL configuration is unavailable")
+	}
+	password, ok := env["PANEL_DB_ROOT_PASSWORD"].(string)
+	if !ok || password == "" {
+		return nil, errors.New("local MySQL configuration is unavailable")
+	}
+	app := &repo.RootInfo{ContainerName: target.ContainerName, Version: target.Version, Key: constant.AppMysql, Password: password}
+	rows := func(container, _, password, sql string) ([]string, error) {
+		if ctx.Err() != nil {
+			return nil, errors.New("local MySQL status query failed")
+		}
+		output, err := run(ctx, container, password, sql)
+		if err != nil {
+			if err == errMCPMysqlStopped || err == errMCPMysqlConnectionFailed {
+				return nil, err
+			}
+			return nil, errors.New("local MySQL status query failed")
+		}
+		return strings.Split(output, "\n"), nil
+	}
+	maps := func(container, dbType, password, sql string) (map[string]string, error) {
+		lines, err := rows(container, dbType, password, sql)
+		if err != nil {
+			return nil, err
+		}
+		values := map[string]string{}
+		for _, line := range lines {
+			if pair := strings.Split(line, "\t"); len(pair) == 2 {
+				values[pair[0]] = pair[1]
+			}
+		}
+		return values, nil
+	}
+	return loadMysqlStatus(req, app, maps, rows)
+}
+
+type mcpQueryOutput struct {
+	buffer   bytes.Buffer
+	mu       sync.Mutex
+	exceeded bool
+}
+
+func (b *mcpQueryOutput) Write(data []byte) (int, error) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if len(data) > mcpMysqlQueryOutputLimit-b.buffer.Len() {
+		b.exceeded = true
+		return 0, errors.New("query output limit exceeded")
+	}
+	return b.buffer.Write(data)
+}
+func (b *mcpQueryOutput) Len() int {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.buffer.Len()
+}
+func (b *mcpQueryOutput) String() string {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.buffer.String()
+}
+func runMCPMysqlRead(ctx context.Context, container, password, sql string) (string, error) {
+	switch sql {
+	case "show global status;", "show master status;", "show binary log status;":
+	default:
+		return "", errors.New("unsupported MySQL monitoring query")
+	}
+	command := exec.CommandContext(ctx, "docker", "exec", container, "mysql", "-uroot", "-p"+password, "-e", sql)
+	output := &mcpQueryOutput{}
+	var stderr bytes.Buffer
+	command.Stdout, command.Stderr = output, io.MultiWriter(output, &stderr)
+	runErr := command.Run()
+	if ctx.Err() != nil || output.exceeded {
+		return "", errors.New("local MySQL status query failed")
+	}
+	if runErr != nil {
+		return "", classifyMCPMysqlReadFailure(stderr.String())
+	}
+	value := strings.ReplaceAll(output.String(), "mysql: [Warning] Using a password on the command line interface can be insecure.\n", "")
+	if strings.HasPrefix(value, "ERROR ") {
+		return "", errors.New("local MySQL status query failed")
+	}
+	return value, nil
+}
+
+func (a *AppInstallService) GetAppInstallInfoForMCP(ctx context.Context, id uint) (*response.AppInstallInfo, error) {
+	var installed model.AppInstall
+	if id == 0 {
+		return nil, errors.New("invalid installed application")
+	}
+	err := global.DB.WithContext(ctx).Preload("App").Where("id = ?", id).First(&installed).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return &response.AppInstallInfo{Status: constant.StatusDeleted}, nil
+	}
+	if err != nil {
+		return nil, errors.New("installed application metadata is unavailable")
+	}
+	var env map[string]any
+	if json.Unmarshal([]byte(installed.Env), &env) != nil {
+		return nil, errors.New("installed application metadata is unavailable")
+	}
+	result := &response.AppInstallInfo{ID: installed.ID, Name: installed.Name, Version: installed.Version, Status: installed.Status, HttpPort: installed.HttpPort, AppKey: installed.App.Key, AppPorts: []int{}}
+	for key, value := range env {
+		if !strings.Contains(strings.ToUpper(key), "PANEL_APP_PORT") {
+			continue
+		}
+		var port int
+		switch item := value.(type) {
+		case string:
+			port, _ = strconv.Atoi(item)
+		case float64:
+			if item == float64(int(item)) {
+				port = int(item)
+			}
+		}
+		if port > 0 && port <= 65535 {
+			result.AppPorts = append(result.AppPorts, port)
+		}
+	}
+	sort.Ints(result.AppPorts)
+	return result, nil
+}

agent/app/service/mcp_tasks.go

@@ -0,0 +1,10 @@
+package service
+
+import (
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/utils/taskscope"
+)
+
+func ConfigurePanelMCPTasks() error {
+	return taskscope.Configure(taskscope.Rule{Scope: constant.TaskScopePanelMCP, Restricted: true, ExternalExecutor: true})
+}

agent/app/service/mcp_website_binding.go

@@ -0,0 +1,821 @@
+package service
+
+import (
+	"context"
+	"crypto/sha256"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net"
+	"net/url"
+	"os"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
+	"github.com/1Panel-dev/1Panel/agent/app/dto/response"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/app/repo"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/utils/docker"
+	"github.com/1Panel-dev/1Panel/agent/utils/nginx"
+	"github.com/1Panel-dev/1Panel/agent/utils/nginx/parser"
+	"github.com/docker/docker/api/types/container"
+	"github.com/google/uuid"
+	"golang.org/x/net/idna"
+	"gorm.io/gorm"
+)
+
+const (
+	mcpWebsitePrivateDir = ".1panel-mcp"
+	mcpWebsiteProxyName  = "proxy.conf"
+	mcpWebsiteOwnerName  = "binding.json"
+)
+
+var mcpWebsiteMutation sync.Mutex
+
+func init() {
+	configureWebsiteManagedConfig(websiteManagedConfigPolicy{
+		protectedDirectories: func() []string {
+			return []string{filepath.Join(GetWebSiteRootDir(), mcpWebsitePrivateDir)}
+		},
+		backupIncludes: mcpWebsiteBackupIncludes,
+	})
+}
+
+type MCPWebsiteBindingService struct {
+	createWebsite func(request.WebsiteCreate) error
+	updateHTTPS   func(context.Context, request.WebsiteHTTPSOp) error
+	applyInclude  func(model.Website) error
+	removeInclude func(model.Website) error
+	checkReload   func() error
+	openresty     func() (model.AppInstall, error)
+	now           func() time.Time
+}
+
+func NewMCPWebsiteBindingService() *MCPWebsiteBindingService {
+	s := &MCPWebsiteBindingService{
+		createWebsite: func(req request.WebsiteCreate) error { return NewIWebsiteService().CreateWebsite(req) },
+		updateHTTPS: func(ctx context.Context, req request.WebsiteHTTPSOp) error {
+			if req.Enable {
+				current, err := NewIWebsiteService().GetWebsiteHTTPS(req.WebsiteID)
+				if err != nil {
+					return err
+				}
+				defaults := newWebsiteCreateHTTPSOp(req.WebsiteSSLID)
+				if current.Enable {
+					req.SSLProtocol, req.Algorithm = current.SSLProtocol, current.Algorithm
+					req.Hsts, req.HstsIncludeSubDomains, req.Http3 = current.Hsts, current.HstsIncludeSubDomains, current.Http3
+					req.HttpConfig = current.HttpConfig
+				} else {
+					defaults.WebsiteID = req.WebsiteID
+					req = defaults
+				}
+			}
+			_, err := NewIWebsiteService().OpWebsiteHTTPS(ctx, req)
+			return err
+		},
+		checkReload: func() error {
+			installed, err := getAppInstallByKey(constant.AppOpenresty)
+			if err != nil {
+				return err
+			}
+			if installed.Status != constant.StatusRunning {
+				return nil
+			}
+			if err = opNginx(installed.ContainerName, constant.NginxCheck); err != nil {
+				return err
+			}
+			return opNginx(installed.ContainerName, constant.NginxReload)
+		},
+		openresty: mcpWebsiteOpenresty,
+		now:       time.Now,
+	}
+	s.applyInclude = func(site model.Website) error { return s.setInclude(site, true) }
+	s.removeInclude = func(site model.Website) error { return s.setInclude(site, false) }
+	return s
+}
+
+func mcpWebsiteOpenresty() (model.AppInstall, error) {
+	installed, err := getAppInstallByKey(constant.AppOpenresty)
+	if err != nil || installed.ID == 0 || installed.Status != constant.StatusRunning {
+		return installed, err
+	}
+	client, err := docker.NewDockerClient()
+	if err != nil {
+		return model.AppInstall{}, errors.New("OpenResty mount is unavailable")
+	}
+	defer client.Close()
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	inspected, err := client.ContainerInspect(ctx, installed.ContainerName)
+	if err != nil || !mcpWebsiteHasWWWMount(inspected.Mounts, GetWebSiteRootDir()) {
+		return model.AppInstall{}, errors.New("OpenResty mount is unavailable")
+	}
+	return installed, nil
+}
+
+func mcpWebsiteHasWWWMount(mounts []container.MountPoint, root string) bool {
+	resolvedRoot, err := filepath.EvalSymlinks(root)
+	if err != nil {
+		return false
+	}
+	for _, mount := range mounts {
+		if filepath.Clean(mount.Destination) != "/www" {
+			continue
+		}
+		resolvedSource, sourceErr := filepath.EvalSymlinks(mount.Source)
+		if sourceErr == nil && resolvedSource == resolvedRoot {
+			return true
+		}
+	}
+	return false
+}
+
+type mcpWebsiteOwner struct {
+	BindingID   string `json:"bindingId"`
+	WebsiteID   uint   `json:"websiteId"`
+	KeyHash     string `json:"keyHash"`
+	BindHash    string `json:"bindHash"`
+	ProxyHash   string `json:"proxyHash"`
+	RequestID   string `json:"requestId"`
+	RequestHash string `json:"requestHash"`
+	Operation   string `json:"operation"`
+}
+
+func mcpWebsiteHash(value string) string {
+	digest := sha256.Sum256([]byte(value))
+	return hex.EncodeToString(digest[:])
+}
+
+func mcpWebsiteAlias(bindingID string) string { return "panel-mcp-" + bindingID }
+func mcpWebsitePrivatePath(site model.Website, name string) string {
+	return filepath.Join(GetWebSiteRootDir(), mcpWebsitePrivateDir, strings.TrimPrefix(site.Alias, "panel-mcp-"), name)
+}
+
+func mcpWebsiteInclude(site model.Website) string {
+	return "/www/" + mcpWebsitePrivateDir + "/" + strings.TrimPrefix(site.Alias, "panel-mcp-") + "/" + mcpWebsiteProxyName
+}
+
+func mcpWebsiteBackupIncludes(site model.Website) []string {
+	bindingID := strings.TrimPrefix(site.Alias, "panel-mcp-")
+	if site.Alias != mcpWebsiteAlias(bindingID) || !validMCPWebsiteID(bindingID) {
+		return nil
+	}
+	return []string{mcpWebsiteInclude(site)}
+}
+
+func mcpWebsitePrivateDirectory(site model.Website, create bool) error {
+	for _, directory := range []string{filepath.Join(GetWebSiteRootDir(), mcpWebsitePrivateDir), filepath.Dir(mcpWebsitePrivatePath(site, mcpWebsiteProxyName))} {
+		info, err := os.Lstat(directory)
+		if os.IsNotExist(err) && create {
+			if err = os.Mkdir(directory, 0700); err != nil {
+				return err
+			}
+			info, err = os.Lstat(directory)
+		}
+		if err != nil || !info.IsDir() || info.Mode()&os.ModeSymlink != 0 || info.Mode().Perm() != 0700 {
+			return errors.New("invalid MCP website private directory")
+		}
+	}
+	return nil
+}
+
+func (s *MCPWebsiteBindingService) setInclude(site model.Website, enabled bool) error {
+	configPath := GetSitePath(site, SiteConf)
+	old, err := os.ReadFile(configPath)
+	if err != nil {
+		return err
+	}
+	config, err := parser.NewStringParser(string(old)).Parse()
+	if err != nil || len(config.FindServers()) == 0 {
+		return errors.New("invalid website configuration")
+	}
+	server := config.FindServers()[0]
+	include := mcpWebsiteInclude(site)
+	for _, directive := range server.FindDirectives("include") {
+		parameters := directive.GetParameters()
+		if len(parameters) == 1 && strings.Trim(parameters[0], "\"'") == include {
+			server.RemoveDirective("include", parameters)
+		}
+	}
+	if enabled {
+		server.UpdateDirective("include", []string{include})
+	}
+	updated := []byte(nginx.DumpConfig(config, nginx.IndentedStyle))
+	if string(updated) == string(old) {
+		return nil
+	}
+	if err = mcpWebsiteAtomicWrite(configPath, updated); err != nil {
+		return err
+	}
+	if err = s.checkReload(); err != nil {
+		_ = mcpWebsiteAtomicWrite(configPath, old)
+		_ = s.checkReload()
+		return err
+	}
+	return nil
+}
+
+func mcpWebsiteRemark(req request.MCPWebsiteBinding) string {
+	return "1Panel MCP " + req.BindingID + " " + mcpWebsiteHash(req.ProxyKey)
+}
+
+func mcpWebsiteFailure(reason string, definitive, conflict bool) response.MCPWebsiteBinding {
+	code, message := "MCP_WEBSITE_UNAVAILABLE", "MCP website operation is unavailable"
+	if definitive {
+		code, message = "MCP_WEBSITE_INVALID_ARGUMENTS", "Invalid MCP website configuration"
+	}
+	if conflict {
+		code, message = "MCP_WEBSITE_CONFLICT", "MCP website configuration changed"
+	}
+	return response.MCPWebsiteBinding{State: "unavailable", Reason: reason, Code: code, Error: message, Definitive: definitive}
+}
+
+func validMCPWebsiteID(value string) bool {
+	parsed, err := uuid.Parse(value)
+	return err == nil && parsed != uuid.Nil && parsed.String() == value
+}
+
+func mcpWebsiteDomain(value string) (string, int, error) {
+	if value == "" || len(value) > 320 || strings.TrimSpace(value) != value || strings.ContainsAny(value, "/\\?#@\r\n\t ;{}\"'$\x00") {
+		return "", 0, errors.New("invalid domain")
+	}
+	host, port := value, 0
+	if parsedHost, parsedPort, err := net.SplitHostPort(value); err == nil {
+		host = parsedHost
+		port, err = strconv.Atoi(parsedPort)
+		if err != nil || port < 1 || port > 65535 {
+			return "", 0, errors.New("invalid port")
+		}
+	} else if strings.ContainsAny(value, ":[]") {
+		return "", 0, errors.New("invalid domain")
+	}
+	host, err := idna.Lookup.ToASCII(strings.ToLower(host))
+	if err != nil || len(host) > 253 || net.ParseIP(host) != nil {
+		return "", 0, errors.New("invalid domain")
+	}
+	for _, label := range strings.Split(host, ".") {
+		if label == "" || len(label) > 63 || label[0] == '-' || label[len(label)-1] == '-' {
+			return "", 0, errors.New("invalid domain")
+		}
+		for _, char := range label {
+			if char != '-' && (char < 'a' || char > 'z') && (char < '0' || char > '9') {
+				return "", 0, errors.New("invalid domain")
+			}
+		}
+	}
+	return host, port, nil
+}
+
+// Core can select a locally bound panel IP, but an external upstream is never
+// accepted even on this private API. Host/SNI is a literal hostname, not Nginx code.
+func validateMCPWebsiteUpstream(req request.MCPWebsiteBinding) bool {
+	if strings.ContainsAny(req.Upstream, "\r\n\t ;{}\"'$#?") {
+		return false
+	}
+	u, err := url.Parse(req.Upstream)
+	if err != nil || (u.Scheme != "http" && u.Scheme != "https") || u.Path != "/mcp" || u.RawPath != "" || u.User != nil || u.RawQuery != "" || u.Fragment != "" || u.Port() == "" {
+		return false
+	}
+	ip := net.ParseIP(u.Hostname())
+	if ip == nil || ip.IsUnspecified() {
+		return false
+	}
+	port, err := strconv.Atoi(u.Port())
+	if err != nil || port < 1 || port > 65535 {
+		return false
+	}
+	local := ip.IsLoopback()
+	if !local {
+		addresses, err := net.InterfaceAddrs()
+		if err != nil {
+			return false
+		}
+		for _, address := range addresses {
+			if network, ok := address.(*net.IPNet); ok && network.IP.Equal(ip) {
+				local = true
+				break
+			}
+		}
+	}
+	if !local || len(req.ProxyKey) != 64 {
+		return false
+	}
+	if _, err = hex.DecodeString(req.ProxyKey); err != nil {
+		return false
+	}
+	if req.CoreHost == "" || len(req.CoreHost) > 320 || strings.ContainsAny(req.CoreHost, "/\\?#@\r\n\t ;{}\"'$\x00") {
+		return false
+	}
+	host := req.CoreHost
+	if parsed, _, splitErr := net.SplitHostPort(host); splitErr == nil {
+		host = parsed
+	}
+	if strings.HasPrefix(host, "[") && strings.HasSuffix(host, "]") {
+		host = strings.Trim(host, "[]")
+	}
+	if net.ParseIP(host) == nil {
+		if _, _, domainErr := mcpWebsiteDomain(host); domainErr != nil {
+			return false
+		}
+	}
+	return true
+}
+
+func mcpWebsiteProxy(req request.MCPWebsiteBinding) []byte {
+	host := req.CoreHost
+	if parsed, _, err := net.SplitHostPort(host); err == nil {
+		host = parsed
+	}
+	host = strings.Trim(host, "[]")
+	var tlsDirectives string
+	if strings.HasPrefix(req.Upstream, "https://") {
+		tlsDirectives = "    proxy_ssl_server_name on;\n    proxy_ssl_name " + host + ";\n"
+	}
+	return []byte("# Managed by 1Panel MCP: " + req.BindingID + "\n" +
+		"location = /mcp {\n" +
+		"    proxy_pass " + req.Upstream + ";\n" +
+		"    proxy_http_version 1.1;\n" +
+		"    proxy_set_header Host " + req.CoreHost + ";\n" +
+		"    proxy_set_header Connection \"\";\n" +
+		"    proxy_set_header X-Panel-MCP-Website-Key " + req.ProxyKey + ";\n" +
+		"    proxy_set_header X-Panel-MCP-Website-Peer $realip_remote_addr;\n" +
+		"    proxy_set_header X-Forwarded-For $http_x_forwarded_for;\n" +
+		"    proxy_set_header X-Real-IP $http_x_real_ip;\n" +
+		"    proxy_set_header Forwarded $http_forwarded;\n" +
+		"    proxy_set_header Authorization $http_authorization;\n" +
+		"    proxy_set_header Origin $http_origin;\n" +
+		"    proxy_set_header Accept $http_accept;\n" +
+		"    proxy_set_header Content-Type $http_content_type;\n" +
+		"    proxy_set_header MCP-Protocol-Version $http_mcp_protocol_version;\n" +
+		"    proxy_buffering off;\n    proxy_request_buffering off;\n    proxy_cache off;\n" +
+		"    proxy_read_timeout 360s;\n    proxy_send_timeout 360s;\n    proxy_connect_timeout 5s;\n" +
+		"    proxy_next_upstream off;\n    client_max_body_size 1m;\n" + tlsDirectives + "}\n")
+}
+
+func (s *MCPWebsiteBindingService) validCertificate(id uint, domain string) bool {
+	certificate, err := websiteSSLRepo.GetFirst(repo.WithByID(id))
+	if err != nil {
+		return false
+	}
+	pair, err := tls.X509KeyPair([]byte(certificate.Pem), []byte(certificate.PrivateKey))
+	if err != nil || len(pair.Certificate) == 0 {
+		return false
+	}
+	leaf, err := x509.ParseCertificate(pair.Certificate[0])
+	if err != nil || s.now().Before(leaf.NotBefore) || !s.now().Before(leaf.NotAfter) || leaf.VerifyHostname(domain) != nil {
+		return false
+	}
+	if len(leaf.ExtKeyUsage) == 0 {
+		return true
+	}
+	for _, usage := range leaf.ExtKeyUsage {
+		if usage == x509.ExtKeyUsageServerAuth || usage == x509.ExtKeyUsageAny {
+			return true
+		}
+	}
+	return false
+}
+
+func mcpWebsiteReadOwner(site model.Website) (mcpWebsiteOwner, error) {
+	var owner mcpWebsiteOwner
+	if err := mcpWebsitePrivateDirectory(site, false); err != nil {
+		return owner, err
+	}
+	path := mcpWebsitePrivatePath(site, mcpWebsiteOwnerName)
+	info, err := os.Lstat(path)
+	if err != nil || !info.Mode().IsRegular() || info.Size() > 8192 {
+		return owner, errors.New("invalid MCP website ownership")
+	}
+	data, err := os.ReadFile(path)
+	if err != nil || json.Unmarshal(data, &owner) != nil {
+		return owner, errors.New("invalid MCP website ownership")
+	}
+	return owner, nil
+}
+
+func mcpWebsiteWriteOwner(site model.Website, owner mcpWebsiteOwner) error {
+	data, err := json.Marshal(owner)
+	if err != nil {
+		return err
+	}
+	return mcpWebsiteAtomicWrite(mcpWebsitePrivatePath(site, mcpWebsiteOwnerName), data)
+}
+
+func mcpWebsiteAtomicWrite(path string, data []byte) error {
+	if info, err := os.Lstat(path); err == nil && !info.Mode().IsRegular() {
+		return errors.New("managed file is not regular")
+	} else if err != nil && !os.IsNotExist(err) {
+		return err
+	}
+	temp, err := os.CreateTemp(filepath.Dir(path), ".panel-mcp-*")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(temp.Name())
+	if err = temp.Chmod(0600); err == nil {
+		_, err = temp.Write(data)
+	}
+	if closeErr := temp.Close(); err == nil {
+		err = closeErr
+	}
+	if err != nil {
+		return err
+	}
+	return os.Rename(temp.Name(), path)
+}
+
+func mcpWebsiteCurrentProxy(site model.Website, owner mcpWebsiteOwner) ([]byte, error) {
+	if err := mcpWebsitePrivateDirectory(site, false); err != nil {
+		return nil, err
+	}
+	path := mcpWebsitePrivatePath(site, mcpWebsiteProxyName)
+	info, err := os.Lstat(path)
+	if err != nil || !info.Mode().IsRegular() || info.Size() > 16<<10 {
+		return nil, errors.New("managed proxy is missing or invalid")
+	}
+	data, err := os.ReadFile(path)
+	if err != nil || mcpWebsiteHash(string(data)) != owner.ProxyHash {
+		return nil, errors.New("managed proxy was modified")
+	}
+	return data, nil
+}
+
+func mcpWebsiteReadProxy(path string) ([]byte, error) {
+	info, err := os.Lstat(path)
+	if err != nil {
+		return nil, err
+	}
+	if !info.Mode().IsRegular() || info.Size() > 16<<10 {
+		return nil, errors.New("managed proxy is not a regular file")
+	}
+	return os.ReadFile(path)
+}
+
+func mcpWebsitePayloadHash(req request.MCPWebsiteBinding) string {
+	return mcpWebsiteHash(fmt.Sprintf("%s\n%s\n%t\n%d", req.Operation, req.Domain, req.EnableSSL, req.SSLID))
+}
+
+func mcpWebsiteBindHash(req request.MCPWebsiteBinding) string {
+	return mcpWebsiteHash(fmt.Sprintf("%s\n%t\n%d", req.Domain, req.EnableSSL, req.SSLID))
+}
+
+func (s *MCPWebsiteBindingService) matchesInitialSite(req request.MCPWebsiteBinding, site model.Website) bool {
+	host, port, err := mcpWebsiteDomain(req.Domain)
+	if err != nil || (site.Protocol == constant.ProtocolHTTPS) != req.EnableSSL || site.WebsiteSSLID != req.SSLID {
+		return false
+	}
+	if port == 0 {
+		installed, installErr := s.openresty()
+		if installErr != nil {
+			return false
+		}
+		port = installed.HttpPort
+		if req.EnableSSL {
+			port = installed.HttpsPort
+		}
+	}
+	for _, domain := range site.Domains {
+		if domain.Domain == host && domain.Port == port {
+			return true
+		}
+	}
+	return false
+}
+
+func (s *MCPWebsiteBindingService) load(req request.MCPWebsiteBinding) (model.Website, error) {
+	if req.WebsiteID > 0 {
+		return websiteRepo.GetFirst(repo.WithByID(req.WebsiteID))
+	}
+	return websiteRepo.GetFirst(websiteRepo.WithAlias(mcpWebsiteAlias(req.BindingID)))
+}
+
+func mcpWebsiteProxyIncluded(site model.Website) bool {
+	server, err := getServer(site)
+	if err != nil {
+		return false
+	}
+	include := mcpWebsiteInclude(site)
+	for _, directive := range server.FindDirectives("include") {
+		parameters := directive.GetParameters()
+		if len(parameters) == 1 && strings.Trim(parameters[0], "\"'") == include {
+			return true
+		}
+	}
+	return false
+}
+
+func (s *MCPWebsiteBindingService) status(req request.MCPWebsiteBinding, site model.Website, owner mcpWebsiteOwner) response.MCPWebsiteBinding {
+	result := response.MCPWebsiteBinding{State: "bound", WebsiteID: site.ID, BindingID: req.BindingID, RequestID: owner.RequestID,
+		Domain: site.PrimaryDomain, EnableSSL: site.Protocol == constant.ProtocolHTTPS, SSLID: site.WebsiteSSLID, WebsiteStatus: site.Status}
+	if !result.EnableSSL {
+		result.SSLID = 0
+	}
+	if owner.Operation == "unbind" {
+		result.State = "unbound"
+		return result
+	}
+	if _, err := mcpWebsiteCurrentProxy(site, owner); err != nil {
+		result.State, result.Reason = "unavailable", "proxy_modified"
+		return result
+	}
+	if mcpWebsiteHash(string(mcpWebsiteProxy(req))) != owner.ProxyHash {
+		result.State, result.Reason = "unavailable", "upstream_changed"
+		return result
+	}
+	if site.Status != constant.WebRunning {
+		result.State, result.Reason = "unavailable", "website_stopped"
+		return result
+	}
+	if !mcpWebsiteProxyIncluded(site) {
+		result.State, result.Reason = "unavailable", "proxy_not_loaded"
+		return result
+	}
+	host, _, err := mcpWebsiteDomain(site.PrimaryDomain)
+	if err != nil {
+		result.State, result.Reason = "unavailable", "website_modified"
+		return result
+	}
+	if result.EnableSSL && !s.validCertificate(site.WebsiteSSLID, host) {
+		result.State, result.Reason = "unavailable", "certificate_invalid"
+		return result
+	}
+	installed, err := s.openresty()
+	if err != nil || installed.ID == 0 || installed.Status != constant.StatusRunning {
+		result.State, result.Reason = "unavailable", "openresty_unavailable"
+		return result
+	}
+	matching, matchingSSL := 0, 0
+	for _, domain := range site.Domains {
+		if domain.Domain != host || domain.Port < 1 {
+			continue
+		}
+		if matching == 0 || !domain.SSL {
+			matching = domain.Port
+		}
+		if domain.SSL {
+			matchingSSL = domain.Port
+		}
+	}
+	if matching == 0 {
+		result.State, result.Reason = "unavailable", "website_modified"
+		return result
+	}
+	port := matching
+	if result.EnableSSL {
+		port = matchingSSL
+		if port == 0 {
+			plan := buildWebsiteTLSPlan(site.Domains, installed.HttpPort, installed.HttpsPort)
+			if slices.Contains(plan.httpsPorts, installed.HttpsPort) {
+				port = installed.HttpsPort
+			} else if len(plan.httpsPorts) > 0 {
+				port = plan.httpsPorts[0]
+			}
+		}
+	}
+	if port == 0 {
+		result.State, result.Reason = "unavailable", "website_modified"
+		return result
+	}
+	scheme := "http"
+	if result.EnableSSL {
+		scheme = "https"
+	}
+	address := host
+	if result.EnableSSL && port != 443 || !result.EnableSSL && port != 80 {
+		address = net.JoinHostPort(host, strconv.Itoa(port))
+	}
+	result.Endpoint = (&url.URL{Scheme: scheme, Host: address, Path: "/mcp"}).String()
+	return result
+}
+
+func (s *MCPWebsiteBindingService) Handle(ctx context.Context, req request.MCPWebsiteBinding) (result response.MCPWebsiteBinding) {
+	mcpWebsiteMutation.Lock()
+	defer mcpWebsiteMutation.Unlock()
+	mutationStarted := false
+	defer func() {
+		if mutationStarted && result.Error != "" {
+			result.Definitive = false
+		}
+	}()
+	if req.Operation == "bind" && validMCPWebsiteID(req.BindingID) {
+		_, existingErr := websiteRepo.GetFirst(websiteRepo.WithAlias(mcpWebsiteAlias(req.BindingID)))
+		_, privateErr := os.Lstat(filepath.Join(GetWebSiteRootDir(), mcpWebsitePrivateDir, req.BindingID))
+		mutationStarted = !errors.Is(existingErr, gorm.ErrRecordNotFound) || !os.IsNotExist(privateErr)
+	}
+	if ctx.Err() != nil {
+		return mcpWebsiteFailure("request_cancelled", true, false)
+	}
+	if req.Operation != "status" && req.Operation != "bind" && req.Operation != "update" && req.Operation != "unbind" && req.Operation != "sync" {
+		return mcpWebsiteFailure("invalid_operation", true, false)
+	}
+	if req.BindingID == "" && req.WebsiteID == 0 && req.Operation == "status" {
+		return response.MCPWebsiteBinding{State: "unbound"}
+	}
+	if !validMCPWebsiteID(req.BindingID) || !validateMCPWebsiteUpstream(req) {
+		return mcpWebsiteFailure("invalid_configuration", true, false)
+	}
+	if req.Operation != "status" && req.Operation != "sync" && !validMCPWebsiteID(req.RequestID) {
+		return mcpWebsiteFailure("invalid_request", true, false)
+	}
+	if req.Operation == "bind" {
+		host, port, err := mcpWebsiteDomain(req.Domain)
+		if err != nil || (!req.EnableSSL && req.SSLID != 0) || (req.EnableSSL && (req.SSLID == 0 || !s.validCertificate(req.SSLID, host))) {
+			return mcpWebsiteFailure("invalid_domain_or_certificate", true, false)
+		}
+		req.Domain = host
+		if port != 0 {
+			req.Domain = net.JoinHostPort(host, strconv.Itoa(port))
+		}
+	}
+	site, err := s.load(req)
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		if req.Operation == "status" || req.Operation == "unbind" {
+			if req.WebsiteID == 0 || req.Operation == "unbind" {
+				return response.MCPWebsiteBinding{State: "unbound", BindingID: req.BindingID, RequestID: req.RequestID}
+			}
+			return response.MCPWebsiteBinding{State: "unavailable", WebsiteID: req.WebsiteID, BindingID: req.BindingID, Reason: "website_missing"}
+		}
+		if req.Operation != "bind" {
+			return mcpWebsiteFailure("website_missing", true, true)
+		}
+		installed, installErr := s.openresty()
+		if installErr != nil || installed.ID == 0 || installed.Status != constant.StatusRunning {
+			return mcpWebsiteFailure("openresty_unavailable", true, false)
+		}
+		group, groupErr := groupRepo.Get(groupRepo.WithByWebsiteDefault())
+		if groupErr != nil || group.ID == 0 {
+			return mcpWebsiteFailure("website_group_unavailable", true, false)
+		}
+		domain, port, _ := mcpWebsiteDomain(req.Domain)
+		if port == 0 {
+			port = installed.HttpPort
+			if req.EnableSSL {
+				port = installed.HttpsPort
+			}
+		}
+		if existing, conflictErr := websiteDomainRepo.GetFirst(websiteDomainRepo.WithDomain(domain), websiteDomainRepo.WithPort(port)); conflictErr == nil && existing.ID > 0 {
+			return mcpWebsiteFailure("domain_conflict", true, true)
+		} else if conflictErr != nil && !errors.Is(conflictErr, gorm.ErrRecordNotFound) {
+			return mcpWebsiteFailure("website_unavailable", false, false)
+		}
+		create := request.WebsiteCreate{Alias: mcpWebsiteAlias(req.BindingID), Type: constant.Static, Remark: mcpWebsiteRemark(req), WebsiteGroupID: group.ID,
+			Domains: []request.WebsiteDomain{{Domain: domain, Port: port, SSL: req.EnableSSL}}, SSLConfig: request.SSLConfig{EnableSSL: req.EnableSSL, WebsiteSSLID: req.SSLID}}
+		mutationStarted = true
+		if createErr := s.createWebsite(create); createErr != nil {
+			return mcpWebsiteFailure("website_create_failed", false, false)
+		}
+		site, err = s.load(req)
+	}
+	if err != nil {
+		return mcpWebsiteFailure("website_unavailable", false, false)
+	}
+	if site.Alias != mcpWebsiteAlias(req.BindingID) {
+		return mcpWebsiteFailure("website_ownership_changed", true, true)
+	}
+	owner, ownerErr := mcpWebsiteReadOwner(site)
+	if ownerErr == nil && owner.RequestID == req.RequestID && req.RequestID != "" {
+		mutationStarted = true
+	}
+	if req.Operation == "update" {
+		if req.Domain != "" && req.Domain != site.PrimaryDomain {
+			return mcpWebsiteFailure("domain_changed", true, true)
+		}
+		req.Domain = site.PrimaryDomain
+		host, _, domainErr := mcpWebsiteDomain(req.Domain)
+		if domainErr != nil || (!req.EnableSSL && req.SSLID != 0) || (req.EnableSSL && (req.SSLID == 0 || !s.validCertificate(req.SSLID, host))) {
+			return mcpWebsiteFailure("invalid_domain_or_certificate", true, false)
+		}
+	}
+	if info, dirErr := os.Lstat(GetSitePath(site, SiteDir)); dirErr == nil && (!info.IsDir() || info.Mode()&os.ModeSymlink != 0) {
+		return mcpWebsiteFailure("website_directory_changed", true, true)
+	} else if dirErr != nil && !os.IsNotExist(dirErr) {
+		return mcpWebsiteFailure("website_unavailable", false, false)
+	}
+	if ownerErr != nil {
+		if (req.Operation != "bind" && req.Operation != "unbind") || site.Remark != mcpWebsiteRemark(req) {
+			return mcpWebsiteFailure("website_ownership_changed", true, true)
+		}
+		if req.Operation == "bind" && !s.matchesInitialSite(req, site) {
+			return mcpWebsiteFailure("binding_request_changed", true, true)
+		}
+		owner = mcpWebsiteOwner{BindingID: req.BindingID, WebsiteID: site.ID, KeyHash: mcpWebsiteHash(req.ProxyKey), BindHash: mcpWebsiteBindHash(req)}
+	} else if owner.BindingID != req.BindingID || owner.WebsiteID != site.ID || owner.KeyHash != mcpWebsiteHash(req.ProxyKey) {
+		return mcpWebsiteFailure("website_ownership_changed", true, true)
+	}
+	if req.Operation == "status" {
+		return s.status(req, site, owner)
+	}
+	operationHash := mcpWebsitePayloadHash(req)
+	if owner.RequestID == req.RequestID && req.RequestID != "" {
+		if owner.RequestHash != operationHash {
+			return mcpWebsiteFailure("operation_request_changed", true, true)
+		}
+		if owner.Operation == "unbind" || owner.ProxyHash == mcpWebsiteHash(string(mcpWebsiteProxy(req))) {
+			return s.status(req, site, owner)
+		}
+	}
+	if req.Operation == "bind" && owner.BindHash != mcpWebsiteBindHash(req) {
+		return mcpWebsiteFailure("binding_request_changed", true, true)
+	}
+	if owner.ProxyHash != "" && owner.Operation != "unbind" && req.Operation != "unbind" && !mcpWebsiteProxyIncluded(site) {
+		return mcpWebsiteFailure("proxy_not_loaded", true, true)
+	}
+	proxyPath := mcpWebsitePrivatePath(site, mcpWebsiteProxyName)
+	if err = mcpWebsitePrivateDirectory(site, true); err != nil {
+		return mcpWebsiteFailure("proxy_directory_changed", true, true)
+	}
+	if ownerErr != nil {
+		mutationStarted = true
+		if err = mcpWebsiteWriteOwner(site, owner); err != nil {
+			return mcpWebsiteFailure("ownership_write_failed", false, false)
+		}
+	}
+	var oldProxy []byte
+	if owner.ProxyHash != "" && owner.Operation != "unbind" {
+		oldProxy, err = mcpWebsiteCurrentProxy(site, owner)
+		if err != nil {
+			actual, readErr := mcpWebsiteReadProxy(proxyPath)
+			if req.Operation == "unbind" && os.IsNotExist(readErr) {
+				oldProxy = nil
+			} else if readErr == nil && string(actual) == string(mcpWebsiteProxy(req)) {
+				oldProxy = actual
+			} else {
+				return mcpWebsiteFailure("proxy_modified", true, true)
+			}
+		}
+	} else if _, statErr := os.Lstat(proxyPath); statErr == nil {
+		actual, readErr := mcpWebsiteReadProxy(proxyPath)
+		if readErr != nil || string(actual) != string(mcpWebsiteProxy(req)) {
+			return mcpWebsiteFailure("proxy_already_exists", true, true)
+		}
+		oldProxy = actual
+	} else if !os.IsNotExist(statErr) {
+		return mcpWebsiteFailure("proxy_unavailable", false, false)
+	}
+	if req.Operation == "unbind" {
+		if mcpWebsiteProxyIncluded(site) {
+			mutationStarted = true
+			if err = s.removeInclude(site); err != nil {
+				return mcpWebsiteFailure("proxy_reload_failed", false, false)
+			}
+		}
+		if len(oldProxy) > 0 {
+			mutationStarted = true
+			if err = os.Remove(proxyPath); err != nil {
+				return mcpWebsiteFailure("proxy_remove_failed", false, false)
+			}
+		}
+		owner.Operation, owner.RequestID, owner.RequestHash = "unbind", req.RequestID, operationHash
+		mutationStarted = true
+		if err = mcpWebsiteWriteOwner(site, owner); err != nil {
+			return mcpWebsiteFailure("ownership_write_failed", false, false)
+		}
+		return s.status(req, site, owner)
+	}
+	if req.Operation == "update" {
+		if req.Domain != site.PrimaryDomain {
+			return mcpWebsiteFailure("domain_changed", true, true)
+		}
+		if site.Protocol == constant.ProtocolHTTPS && !req.EnableSSL || site.Protocol != constant.ProtocolHTTPS && req.EnableSSL || req.EnableSSL && site.WebsiteSSLID != req.SSLID {
+			mutationStarted = true
+			if err = s.updateHTTPS(context.WithoutCancel(ctx), request.WebsiteHTTPSOp{WebsiteID: site.ID, Enable: req.EnableSSL, Type: constant.SSLExisted, WebsiteSSLID: req.SSLID, HttpConfig: constant.HTTPSOnly}); err != nil {
+				return mcpWebsiteFailure("certificate_update_failed", false, false)
+			}
+			site, err = s.load(req)
+			if err != nil {
+				return mcpWebsiteFailure("website_unavailable", false, false)
+			}
+		}
+	}
+	newProxy := mcpWebsiteProxy(req)
+	mutationStarted = true
+	if err = mcpWebsiteAtomicWrite(proxyPath, newProxy); err != nil {
+		return mcpWebsiteFailure("proxy_write_failed", false, false)
+	}
+	if err = s.applyInclude(site); err != nil {
+		if len(oldProxy) == 0 {
+			_ = os.Remove(proxyPath)
+		} else {
+			_ = mcpWebsiteAtomicWrite(proxyPath, oldProxy)
+		}
+		_ = s.checkReload()
+		return mcpWebsiteFailure("proxy_reload_failed", false, false)
+	}
+	owner.ProxyHash = mcpWebsiteHash(string(newProxy))
+	if req.Operation != "sync" || req.RequestID != "" {
+		owner.RequestID, owner.RequestHash, owner.Operation = req.RequestID, operationHash, req.Operation
+	}
+	if err = mcpWebsiteWriteOwner(site, owner); err != nil {
+		return mcpWebsiteFailure("ownership_write_failed", false, false)
+	}
+	return s.status(req, site, owner)
+}

agent/app/service/monitor.go

@@ -55,7 +55,7 @@ type IMonitorService interface {
 	LoadIOOptions() []string
 	LoadNetworkOptions() []string
 	LoadVLLMMonitorData(ctx context.Context, req dto.MonitorVLLMSearch) (dto.MonitorVLLMData, error)
-	LoadVLLMCurrent(ctx context.Context, req dto.MonitorVLLMCurrent) (model.MonitorVLLM, error)
+	LoadVLLMCurrent(ctx context.Context, req dto.MonitorVLLMCurrent) (dto.MonitorVLLMCurrentData, error)
 	CleanVLLMMonitor(req dto.MonitorVLLMClean) error
 	LoadGPUOptions() dto.MonitorGPUOptions
 	LoadGPUMonitorData(req dto.MonitorGPUSearch) (dto.MonitorGPUData, error)

agent/app/service/monitor_vllm.go

@@ -60,6 +60,9 @@ func (m *MonitorService) LoadVLLMMonitorData(ctx context.Context, req dto.Monito
 	if err != nil {
 		return data, err
 	}
+	for i := range points {
+		points[i].MonitorVLLM.CompletedRequests = points[i].CompletedRequests
+	}
 	if data.BucketSeconds > 0 {
 		aggregates := map[int64]*vllm.HistoryAccumulator{}
 		err = vllmMonitorRepo.WalkDeltas(ctx, req.AppInstallID, req.StartTime, req.EndTime, data.BucketSeconds, req.Aggregation, req.Group, func(bucket int64, histograms, requests string) error {
@@ -91,15 +94,6 @@ func (m *MonitorService) LoadVLLMMonitorData(ctx context.Context, req dto.Monito
 			data.Points = append(data.Points, point)
 		}
 	} else {
-		setting, err := settingRepo.GetValueByKey("VLLMMonitorInterval")
-		if err != nil {
-			return data, err
-		}
-		intervalSeconds, err := strconv.Atoi(setting)
-		if err != nil || intervalSeconds <= 0 {
-			return data, fmt.Errorf("invalid vLLM monitoring interval: %s", setting)
-		}
-		interval := time.Duration(intervalSeconds) * time.Second
 		for i, point := range points {
 			if err := ctx.Err(); err != nil {
 				return data, err
@@ -109,8 +103,20 @@ func (m *MonitorService) LoadVLLMMonitorData(ctx context.Context, req dto.Monito
 				return data, err
 			}
 			aggregate.Apply(&point.MonitorVLLM, "max")
-			if i > 0 && point.CreatedAt.Sub(points[i-1].CreatedAt) > 2*interval {
-				data.Points = append(data.Points, model.MonitorVLLM{CreatedAt: points[i-1].CreatedAt.Add(interval), AppInstallID: req.AppInstallID})
+			if i > 0 {
+				previous := points[i-1]
+				interval := time.Duration(max(previous.SampleIntervalSeconds, point.SampleIntervalSeconds)) * time.Second
+				if interval == 0 {
+					if i > 1 {
+						interval = previous.CreatedAt.Sub(points[i-2].CreatedAt)
+					}
+					if i+1 < len(points) {
+						interval = max(interval, points[i+1].CreatedAt.Sub(point.CreatedAt))
+					}
+				}
+				if interval > 0 && point.CreatedAt.Sub(previous.CreatedAt) > 2*interval {
+					data.Points = append(data.Points, model.MonitorVLLM{CreatedAt: previous.CreatedAt.Add(interval), AppInstallID: req.AppInstallID})
+				}
 			}
 			data.Points = append(data.Points, point.MonitorVLLM)
 		}
@@ -118,31 +124,30 @@ func (m *MonitorService) LoadVLLMMonitorData(ctx context.Context, req dto.Monito
 	return data, nil
 }
 
-func (m *MonitorService) LoadVLLMCurrent(ctx context.Context, req dto.MonitorVLLMCurrent) (model.MonitorVLLM, error) {
+func (m *MonitorService) LoadVLLMCurrent(ctx context.Context, req dto.MonitorVLLMCurrent) (dto.MonitorVLLMCurrentData, error) {
 	install, err := appInstallRepo.GetFirst(repo.WithByID(req.AppInstallID))
 	if err != nil {
-		return model.MonitorVLLM{}, err
+		return dto.MonitorVLLMCurrentData{}, err
 	}
 	if install.App.Key != "vllm" {
-		return model.MonitorVLLM{}, fmt.Errorf("not a vLLM installation")
+		return dto.MonitorVLLMCurrentData{}, fmt.Errorf("not a vLLM installation")
 	}
-	previous, err := collectVLLMMetrics(ctx, install, model.MonitorVLLM{})
+	point, err := collectVLLMMetrics(ctx, install, model.MonitorVLLM{})
+	data := dto.MonitorVLLMCurrentData{MonitorVLLM: point}
 	if err != nil {
 		global.LOG.Debugf("Collect vLLM metrics on port %d failed: %v", install.HttpPort, err)
-		return previous, nil
+		return data, nil
 	}
-	timer := time.NewTimer(time.Second)
-	defer timer.Stop()
-	select {
-	case <-ctx.Done():
-		return model.MonitorVLLM{}, ctx.Err()
-	case <-timer.C:
+	if err := json.Unmarshal([]byte(point.RawMetrics), &data.Metrics); err != nil {
+		return data, err
 	}
-	point, err := collectVLLMMetrics(ctx, install, previous)
-	if err != nil {
-		global.LOG.Debugf("Collect vLLM metrics on port %d failed: %v", install.HttpPort, err)
+	for name := range data.Metrics {
+		if name == "request_prompt_tokens_sum" || name == "request_prompt_tokens_count" ||
+			(!strings.HasSuffix(name, "_total") && !strings.HasSuffix(name, "_sum") && !strings.HasSuffix(name, "_count")) {
+			delete(data.Metrics, name)
+		}
 	}
-	return point, nil
+	return data, nil
 }
 
 func (m *MonitorService) CleanVLLMMonitor(req dto.MonitorVLLMClean) error {
@@ -164,7 +169,7 @@ func StartVLLMMonitor(interval string) error {
 		return fmt.Errorf("invalid vLLM monitoring interval: %s", interval)
 	}
 	service := &MonitorService{}
-	job := cron.NewChain(cron.Recover(cron.DefaultLogger)).Then(cron.FuncJob(service.saveVLLMData))
+	job := cron.NewChain(cron.Recover(cron.DefaultLogger)).Then(cron.FuncJob(func() { service.saveVLLMData(seconds) }))
 	id, err := global.Cron.AddFunc(fmt.Sprintf("@every %ds", seconds), func() { go job.Run() })
 	if err != nil {
 		return err
@@ -176,7 +181,7 @@ func StartVLLMMonitor(interval string) error {
 	return nil
 }
 
-func (m *MonitorService) saveVLLMData() {
+func (m *MonitorService) saveVLLMData(intervalSeconds int) {
 	if !vllmMonitorMutex.TryLock() {
 		return
 	}
@@ -228,6 +233,7 @@ func (m *MonitorService) saveVLLMData() {
 				return err
 			}
 			point, err := collectVLLMMetrics(context.Background(), install, previous)
+			point.SampleIntervalSeconds = intervalSeconds
 			if err != nil {
 				global.LOG.Debugf("Collect vLLM metrics for %s failed: %v", install.Name, err)
 			}

agent/app/service/nginx_utils.go

@@ -78,9 +78,17 @@ func getNginxParamsByKeys(scope string, keys []string, website *model.Website) (
 	var res []response.NginxParam
 	var block components.IBlock
 	if scope == constant.NginxScopeHttp {
-		block = nginxFull.RootConfig.Config.FindHttp()
+		httpBlock := nginxFull.RootConfig.Config.FindHttp()
+		if httpBlock == nil {
+			return nil, fmt.Errorf("nginx HTTP configuration block is missing")
+		}
+		block = httpBlock
 	} else {
-		block = nginxFull.SiteConfig.Config.FindServers()[0]
+		servers := nginxFull.SiteConfig.Config.FindServers()
+		if len(servers) == 0 {
+			return nil, fmt.Errorf("website nginx server block is missing")
+		}
+		block = servers[0]
 	}
 	for _, key := range keys {
 		dirs := block.FindDirectives(key)

agent/app/service/quick_directory.go

@@ -0,0 +1,49 @@
+package service
+
+import (
+	"strings"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+)
+
+func (u *DashboardService) ListQuickDirectories() ([]model.QuickDirectory, error) {
+	return launcherRepo.ListQuickDirectories()
+}
+
+func quickDirectoryValues(req dto.QuickDirectoryCreate) (model.QuickDirectory, error) {
+	item := model.QuickDirectory{Path: req.Path, Alias: strings.TrimSpace(req.Alias)}
+	if strings.TrimSpace(item.Path) == "" {
+		return item, buserr.WithDetail("ErrInvalidParams", "path is required", nil)
+	}
+	return item, nil
+}
+
+func (u *DashboardService) CreateQuickDirectory(req dto.QuickDirectoryCreate) (*model.QuickDirectory, error) {
+	item, err := quickDirectoryValues(req)
+	if err != nil {
+		return nil, err
+	}
+	if err := launcherRepo.CreateQuickDirectory(&item); err != nil {
+		return nil, err
+	}
+	return &item, nil
+}
+
+func (u *DashboardService) UpdateQuickDirectory(req dto.QuickDirectoryUpdate) (*model.QuickDirectory, error) {
+	item, err := quickDirectoryValues(req.QuickDirectoryCreate)
+	if err != nil {
+		return nil, err
+	}
+	item.ID = req.ID
+	item.Legacy = req.Legacy
+	if err := launcherRepo.UpdateQuickDirectory(&item); err != nil {
+		return nil, err
+	}
+	return &item, nil
+}
+
+func (u *DashboardService) DeleteQuickDirectory(req dto.QuickDirectoryDelete) error {
+	return launcherRepo.DeleteQuickDirectory(req.ID, req.Legacy)
+}

agent/app/service/runtime.go

@@ -10,6 +10,7 @@ import (
 	"os/exec"
 	"path"
 	"path/filepath"
+	"slices"
 	"sort"
 	"strconv"
 	"strings"
@@ -46,7 +47,7 @@ type RuntimeService struct {
 type IRuntimeService interface {
 	Page(req request.RuntimeSearch) (int64, []response.RuntimeDTO, error)
 	Create(create request.RuntimeCreate) (*model.Runtime, error)
-	Delete(delete request.RuntimeDelete) error
+	Delete(delete request.RuntimeDelete) (string, error)
 	Update(req request.RuntimeUpdate) error
 	Get(id uint) (res *response.RuntimeDTO, err error)
 	GetNodePackageRunScript(req request.NodePackageReq) ([]response.PackageScripts, error)
@@ -376,16 +377,16 @@ func (r *RuntimeService) DeleteCheck(runTimeId uint) ([]dto.AppResource, error)
 	return res, nil
 }
 
-func (r *RuntimeService) Delete(runtimeDelete request.RuntimeDelete) error {
+func (r *RuntimeService) Delete(runtimeDelete request.RuntimeDelete) (string, error) {
 	runtime, err := runtimeRepo.GetFirst(context.Background(), repo.WithByID(runtimeDelete.ID))
 	if err != nil {
-		return err
+		return "", err
 	}
 	website, _ := websiteRepo.GetFirst(websiteRepo.WithRuntimeID(runtimeDelete.ID))
 	if website.ID > 0 {
-		return buserr.New("ErrDelWithWebsite")
+		return runtime.Name, buserr.New("ErrDelWithWebsite")
 	}
-	return startRuntimeDeleteTask(runtimeDelete, runtime)
+	return runtime.Name, startRuntimeDeleteTask(runtimeDelete, runtime)
 }
 
 func startRuntimeDeleteTask(runtimeDelete request.RuntimeDelete, runtime *model.Runtime) error {
@@ -584,6 +585,21 @@ func (r *RuntimeService) Get(id uint) (*response.RuntimeDTO, error) {
 
 		for _, form := range appForm.FormFields {
 			if v, ok := envs[form.EnvKey]; ok {
+				if form.EnvKey == "PHP_VERSION" {
+					// Refresh only version choices; keep the saved form if synchronized metadata is unavailable.
+					var latestForm dto.AppForm
+					if json.Unmarshal([]byte(appDetail.Params), &latestForm) == nil {
+						for _, latest := range latestForm.FormFields {
+							if latest.EnvKey == form.EnvKey && len(latest.Values) > 0 {
+								form.Values = latest.Values
+								break
+							}
+						}
+					}
+					if v != "" && !slices.ContainsFunc(form.Values, func(value dto.AppFormValue) bool { return value.Value == v }) {
+						form.Values = append(form.Values, dto.AppFormValue{Label: v, Value: v})
+					}
+				}
 				appParam := response.AppParam{
 					Edit:     false,
 					Key:      form.EnvKey,
@@ -631,7 +647,7 @@ func (r *RuntimeService) Get(id uint) (*response.RuntimeDTO, error) {
 	return &res, nil
 }
 
-func (r *RuntimeService) Update(req request.RuntimeUpdate) error {
+func (r *RuntimeService) Update(req request.RuntimeUpdate) (err error) {
 	runtime, err := runtimeRepo.GetFirst(context.Background(), repo.WithByID(req.ID))
 	if err != nil {
 		return err
@@ -640,6 +656,7 @@ func (r *RuntimeService) Update(req request.RuntimeUpdate) error {
 		runtime.Version = req.Version
 		return runtimeRepo.Save(runtime)
 	}
+	oldRuntime := *runtime
 	appDetail, err := getRuntimeUpdateAppDetail(runtime, req)
 	if err != nil {
 		return err
@@ -684,6 +701,20 @@ func (r *RuntimeService) Update(req request.RuntimeUpdate) error {
 	if err = downloadApp(app, appDetail, nil, nil); err != nil {
 		return err
 	}
+	var snapshot *runtimeUpdateSnapshot
+	if runtime.Type != constant.RuntimePHP {
+		snapshot, err = snapshotRuntimeUpdate(&oldRuntime)
+		if err != nil {
+			return err
+		}
+		defer func() {
+			if err != nil {
+				if restoreErr := snapshot.restoreFiles(); restoreErr != nil {
+					err = fmt.Errorf("%w; restore runtime configuration: %v", err, restoreErr)
+				}
+			}
+		}()
+	}
 	if versionChanged {
 		if err = updateRuntimeVersionFiles(runtime, appVersionDir); err != nil {
 			return err
@@ -757,7 +788,13 @@ func (r *RuntimeService) Update(req request.RuntimeUpdate) error {
 		if err = runtimeRepo.Save(runtime); err != nil {
 			return err
 		}
-		go reCreateRuntime(runtime)
+		go func() {
+			if err := prepareRuntimeUpdate(runtime, snapshot); err != nil {
+				global.LOG.Errorf("prepare runtime [%s] update failed: %v", runtime.Name, err)
+				return
+			}
+			reCreateRuntime(runtime)
+		}()
 	}
 	return nil
 }

agent/app/service/runtime_update.go

@@ -1,6 +1,9 @@
 package service
 
 import (
+	"errors"
+	"fmt"
+	"os"
 	"path/filepath"
 
 	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
@@ -12,6 +15,89 @@ import (
 	"gopkg.in/yaml.v3"
 )
 
+// Keep the on-disk configuration as well as the model: files may contain edits
+// that have not been reflected in the database.
+type runtimeUpdateSnapshot struct {
+	runtime model.Runtime
+	files   []runtimeUpdateFile
+}
+
+type runtimeUpdateFile struct {
+	path    string
+	content []byte
+	mode    os.FileMode
+	exists  bool
+}
+
+func snapshotRuntimeUpdate(runtime *model.Runtime) (*runtimeUpdateSnapshot, error) {
+	snapshot := &runtimeUpdateSnapshot{runtime: *runtime}
+	for _, name := range []string{"docker-compose.yml", ".env", "run.sh"} {
+		file := runtimeUpdateFile{path: filepath.Join(runtime.GetPath(), name)}
+		info, err := os.Stat(file.path)
+		if errors.Is(err, os.ErrNotExist) {
+			snapshot.files = append(snapshot.files, file)
+			continue
+		}
+		if err != nil {
+			return nil, err
+		}
+		file.content, err = os.ReadFile(file.path)
+		if err != nil {
+			return nil, err
+		}
+		file.exists, file.mode = true, info.Mode().Perm()
+		snapshot.files = append(snapshot.files, file)
+	}
+	return snapshot, nil
+}
+
+func (s *runtimeUpdateSnapshot) restoreFiles() error {
+	var result error
+	for _, file := range s.files {
+		var err error
+		if file.exists {
+			err = os.WriteFile(file.path, file.content, file.mode)
+			if err == nil {
+				err = os.Chmod(file.path, file.mode)
+			}
+		} else {
+			err = os.Remove(file.path)
+			if errors.Is(err, os.ErrNotExist) {
+				err = nil
+			}
+		}
+		if err != nil {
+			result = errors.Join(result, fmt.Errorf("restore %s: %w", file.path, err))
+		}
+	}
+	return result
+}
+
+// This must finish before reCreateRuntime stops the existing container. A
+// failed preparation restores the previous version without touching Docker.
+func prepareRuntimeUpdate(runtime *model.Runtime, snapshot *runtimeUpdateSnapshot) error {
+	if err := pullRuntimeComposeImages(runtime.GetComposePath(), false, nil); err != nil {
+		result := fmt.Errorf("prepare runtime images: %w", err)
+		restoreErr := snapshot.restoreFiles()
+		*runtime = snapshot.runtime
+		if restoreErr != nil {
+			result = errors.Join(result, restoreErr)
+			runtime.Status = constant.StatusError
+		}
+		runtime.Message = result.Error()
+		if saveErr := runtimeRepo.Save(runtime); saveErr != nil {
+			result = errors.Join(result, fmt.Errorf("restore runtime record: %w", saveErr))
+		}
+		logFile, logErr := os.OpenFile(runtime.GetLogPath(), os.O_CREATE|os.O_WRONLY|os.O_APPEND, constant.FilePerm)
+		if logErr == nil {
+			_, logErr = fmt.Fprintln(logFile, result.Error())
+			logErr = errors.Join(logErr, logFile.Close())
+		}
+		return errors.Join(result, logErr)
+	}
+	return nil
+}
+
 func getRuntimeUpdateAppDetail(runtime *model.Runtime, req request.RuntimeUpdate) (model.AppDetail, error) {
 	current, err := appDetailRepo.GetFirst(repo.WithByID(runtime.AppDetailID))
 	if err != nil {

agent/app/service/task.go

@@ -8,9 +8,12 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/app/dto/response"
 	"github.com/1Panel-dev/1Panel/agent/app/repo"
 	"github.com/1Panel-dev/1Panel/agent/utils/files"
+	"github.com/1Panel-dev/1Panel/agent/utils/taskscope"
 )
 
-type TaskLogService struct{}
+type TaskLogService struct {
+	grantedScopes []string
+}
 
 type ITaskLogService interface {
 	Page(req dto.SearchTaskLogReq) (int64, []dto.TaskDTO, error)
@@ -19,13 +22,18 @@ type ITaskLogService interface {
 	CountExecutingTask() (int64, error)
 }
 
-func NewITaskService() ITaskLogService {
-	return &TaskLogService{}
+func NewITaskService(grantedScopes ...string) ITaskLogService {
+	return &TaskLogService{grantedScopes: append([]string(nil), grantedScopes...)}
 }
 
 func (u *TaskLogService) Page(req dto.SearchTaskLogReq) (int64, []dto.TaskDTO, error) {
+	excluded, err := taskscope.ReadExclusions(u.grantedScopes...)
+	if err != nil {
+		return 0, nil, err
+	}
 	opts := []repo.DBOption{
 		repo.WithOrderDesc("created_at"),
+		taskRepo.WithoutScopes(excluded...),
 	}
 	if req.TaskID != "" {
 		opts = append(opts, taskRepo.WithByID(req.TaskID))
@@ -53,7 +61,11 @@ func (u *TaskLogService) Page(req dto.SearchTaskLogReq) (int64, []dto.TaskDTO, e
 }
 
 func (u *TaskLogService) ReadByLine(req request.TaskLogReadReq) (*response.FileLineContent, error) {
-	opts := []repo.DBOption{}
+	excluded, err := taskscope.ReadExclusions(u.grantedScopes...)
+	if err != nil {
+		return nil, err
+	}
+	opts := []repo.DBOption{taskRepo.WithoutScopes(excluded...)}
 	if req.TaskID != "" {
 		opts = append(opts, taskRepo.WithByID(req.TaskID))
 	} else {
@@ -112,9 +124,17 @@ func (u *TaskLogService) ReadByLine(req request.TaskLogReadReq) (*response.FileL
 }
 
 func (u *TaskLogService) SyncForRestart() error {
-	return taskRepo.UpdateRunningTaskToFailed()
+	excluded, err := taskscope.RecoveryExclusions()
+	if err != nil {
+		return err
+	}
+	return taskRepo.UpdateRunningTaskToFailed(taskRepo.WithoutScopes(excluded...))
 }
 
 func (u *TaskLogService) CountExecutingTask() (int64, error) {
-	return taskRepo.CountExecutingTask()
+	excluded, err := taskscope.ReadExclusions(u.grantedScopes...)
+	if err != nil {
+		return 0, err
+	}
+	return taskRepo.CountExecutingTask(taskRepo.WithoutScopes(excluded...))
 }

agent/app/service/website.go

@@ -3,6 +3,7 @@ package service
 import (
 	"bytes"
 	"context"
+	"database/sql"
 	"encoding/base64"
 	"errors"
 	"fmt"
@@ -973,11 +974,16 @@ func (w WebsiteService) GetWebsiteHTTPS(websiteId uint) (response.WebsiteHTTPS,
 	if err != nil {
 		return res, err
 	}
+	applyWebsiteHTTPSParams(&res, params)
+	return res, nil
+}
+
+func applyWebsiteHTTPSParams(res *response.WebsiteHTTPS, params []response.NginxParam) {
 	for _, p := range params {
 		if p.Name == "ssl_protocols" {
 			res.SSLProtocol = p.Params
 		}
-		if p.Name == "ssl_ciphers" {
+		if p.Name == "ssl_ciphers" && len(p.Params) > 0 {
 			res.Algorithm = p.Params[0]
 		}
 		if p.Name == "add_header" && len(p.Params) > 0 {
@@ -995,7 +1001,6 @@ func (w WebsiteService) GetWebsiteHTTPS(websiteId uint) (response.WebsiteHTTPS,
 			}
 		}
 	}
-	return res, nil
 }
 
 func (w WebsiteService) OpWebsiteHTTPS(ctx context.Context, req request.WebsiteHTTPSOp) (*response.WebsiteHTTPS, error) {
@@ -1325,11 +1330,12 @@ func (w WebsiteService) ChangeDefaultServer(id uint) error {
 	return websiteRepo.Save(context.Background(), &website)
 }
 
-func (w WebsiteService) ChangePHPVersion(req request.WebsitePHPVersionReq) error {
+func (w WebsiteService) ChangePHPVersion(req request.WebsitePHPVersionReq) (err error) {
 	website, err := websiteRepo.GetFirst(repo.WithByID(req.WebsiteID))
 	if err != nil {
 		return err
 	}
+	wasPHP := website.Type == constant.Runtime
 	if website.Type == constant.Runtime {
 		oldRuntime, err := runtimeRepo.GetFirst(context.Background(), repo.WithByID(website.RuntimeID))
 		if err != nil {
@@ -1347,26 +1353,8 @@ func (w WebsiteService) ChangePHPVersion(req request.WebsitePHPVersionReq) error
 			return buserr.WithName("ErrImageNotExist", oldRuntime.Name)
 		}
 	}
-	configPath := GetSitePath(website, SiteConf)
-	nginxContent, err := files.NewFileOp().GetContent(configPath)
-	if err != nil {
-		return err
-	}
-	config, err := parser.NewStringParser(string(nginxContent)).Parse()
-	if err != nil {
-		return err
-	}
-	servers := config.FindServers()
-	if len(servers) == 0 {
-		return errors.New("nginx config is not valid")
-	}
-	server := servers[0]
-	fileOp := files.NewFileOp()
-	indexPHPPath := path.Join(GetSitePath(website, SiteIndexDir), "index.php")
-	indexHtmlPath := path.Join(GetSitePath(website, SiteIndexDir), "index.html")
+
 	if req.RuntimeID > 0 {
-		server.UpdateDirective("index", []string{"index.php index.html index.htm default.php default.htm default.html"})
-		server.RemoveDirective("location", []string{"~", "[^/]\\.php(/|$)"})
 		runtime, err := runtimeRepo.GetFirst(context.Background(), repo.WithByID(req.RuntimeID))
 		if err != nil {
 			return err
@@ -1374,38 +1362,129 @@ func (w WebsiteService) ChangePHPVersion(req request.WebsitePHPVersionReq) error
 		if runtime.Resource == constant.ResourceLocal {
 			return buserr.New("ErrPHPResource")
 		}
-		website.RuntimeID = req.RuntimeID
+		website.RuntimeID = runtime.ID
 		website.AppInstallID = 0
-		phpProxy := fmt.Sprintf("127.0.0.1:%s", runtime.Port)
-		website.Proxy = phpProxy
-		server.UpdatePHPProxy([]string{website.Proxy}, "")
+		website.Proxy = fmt.Sprintf("127.0.0.1:%s", runtime.Port)
 		website.Type = constant.Runtime
-		if !fileOp.Stat(indexPHPPath) {
-			_ = fileOp.WriteFile(indexPHPPath, strings.NewReader(string(nginx_conf.IndexPHP)), constant.FilePerm)
-		}
 	} else {
-		server.UpdateDirective("index", []string{"index.html index.php index.htm default.php default.htm default.html"})
 		website.RuntimeID = 0
 		website.Type = constant.Static
 		website.Proxy = ""
-		server.RemoveDirective("location", []string{"~", "[^/]\\.php(/|$)"})
-		if !fileOp.Stat(indexHtmlPath) {
-			_ = fileOp.WriteFile(indexHtmlPath, strings.NewReader(string(nginx_conf.Index)), constant.FilePerm)
-		}
 	}
 
-	config.FilePath = configPath
-	if err = nginx.WriteConfig(config, nginx.IndentedStyle); err != nil {
+	subsites, err := websiteRepo.List(websiteRepo.WithParentID(website.ID), websiteRepo.WithType(constant.Subsite))
+	if err != nil {
 		return err
 	}
+	websites := append([]model.Website{website}, subsites...)
+	configs := make([]*components.Config, 0, len(websites))
+	oldContents := make(map[string][]byte, len(websites))
+	fileOp := files.NewFileOp()
+	for i := range websites {
+		site := &websites[i]
+		if i > 0 {
+			site.RuntimeID = website.RuntimeID
+			site.Proxy = website.Proxy
+		}
+		configPath := GetSitePath(*site, SiteConf)
+		content, err := fileOp.GetContent(configPath)
+		if err != nil {
+			return err
+		}
+		config, err := parser.NewStringParser(string(content)).Parse()
+		if err != nil {
+			return err
+		}
+		servers := config.FindServers()
+		if len(servers) == 0 {
+			return errors.New("nginx config is not valid")
+		}
+		server := servers[0]
+		if i == 0 || wasPHP != (req.RuntimeID > 0) {
+			if req.RuntimeID > 0 {
+				server.UpdateDirective("index", []string{"index.php index.html index.htm default.php default.htm default.html"})
+			} else {
+				server.UpdateDirective("index", []string{"index.html index.php index.htm default.php default.htm default.html"})
+			}
+		}
+		if req.RuntimeID > 0 && site.Status != constant.WebStopped {
+			updated := false
+			for _, location := range server.FindDirectives("location") {
+				if strings.Join(location.GetParameters(), " ") == "~ [^/]\\.php(/|$)" && location.GetBlock() != nil {
+					location.GetBlock().UpdateDirective("fastcgi_pass", []string{site.Proxy})
+					updated = true
+				}
+			}
+			if !updated {
+				server.UpdatePHPProxy([]string{site.Proxy}, "")
+			}
+		} else {
+			server.RemoveDirective("location", []string{"~", "[^/]\\.php(/|$)"})
+		}
+		config.FilePath = configPath
+		configs = append(configs, config)
+		oldContents[configPath] = content
+	}
+
+	indexPath := path.Join(GetSitePath(website, SiteIndexDir), "index.html")
+	indexContent := nginx_conf.Index
+	if req.RuntimeID > 0 {
+		indexPath = path.Join(GetSitePath(website, SiteIndexDir), "index.php")
+		indexContent = nginx_conf.IndexPHP
+	}
+	if !fileOp.Stat(indexPath) {
+		_ = fileOp.WriteFile(indexPath, strings.NewReader(string(indexContent)), constant.FilePerm)
+	}
+
 	nginxInstall, err := getAppInstallByKey(constant.AppOpenresty)
 	if err != nil {
 		return err
 	}
-	if err = nginxCheckAndReload(string(nginxContent), configPath, nginxInstall.ContainerName); err != nil {
+	tx, ctx := helper.GetTxAndContext()
+	if err = tx.Error; err != nil {
 		return err
 	}
-	return websiteRepo.Save(context.Background(), &website)
+	written := 0
+	reloadAttempted := false
+	defer func() {
+		if err == nil {
+			return
+		}
+		if rollbackErr := tx.Rollback().Error; rollbackErr != nil && !errors.Is(rollbackErr, sql.ErrTxDone) {
+			err = errors.Join(err, rollbackErr)
+		}
+		for _, config := range configs[:written] {
+			if restoreErr := fileOp.WriteFile(config.FilePath, strings.NewReader(string(oldContents[config.FilePath])), constant.FilePerm); restoreErr != nil {
+				err = errors.Join(err, fmt.Errorf("restore %s: %w", config.FilePath, restoreErr))
+			}
+		}
+		if reloadAttempted {
+			if checkErr := opNginx(nginxInstall.ContainerName, constant.NginxCheck); checkErr != nil {
+				err = errors.Join(err, fmt.Errorf("check restored nginx configuration: %w", checkErr))
+			} else if reloadErr := opNginx(nginxInstall.ContainerName, constant.NginxReload); reloadErr != nil {
+				err = errors.Join(err, fmt.Errorf("reload restored nginx configuration: %w", reloadErr))
+			}
+		}
+	}()
+	for i := range websites {
+		if err = websiteRepo.Save(ctx, &websites[i]); err != nil {
+			return err
+		}
+	}
+	for _, config := range configs {
+		written++
+		if err = nginx.WriteConfig(config, nginx.IndentedStyle); err != nil {
+			return err
+		}
+	}
+	if err = opNginx(nginxInstall.ContainerName, constant.NginxCheck); err != nil {
+		return err
+	}
+	reloadAttempted = true
+	if err = opNginx(nginxInstall.ContainerName, constant.NginxReload); err != nil {
+		return err
+	}
+	return tx.Commit().Error
 }
 
 func (w WebsiteService) UpdateSiteDir(req request.WebsiteUpdateDir) error {

agent/app/service/website_ca.go

@@ -1,15 +1,19 @@
 package service
 
 import (
+	"archive/zip"
 	"bytes"
 	"context"
 	"crypto/ecdsa"
 	"crypto/rand"
 	"crypto/rsa"
+	"crypto/tls"
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/pem"
+	"errors"
 	"fmt"
+	"io"
 	"log"
 	"math/big"
 	"net"
@@ -18,25 +22,27 @@ import (
 	"strings"
 	"time"
 
-	"github.com/1Panel-dev/1Panel/agent/app/repo"
-	"github.com/1Panel-dev/1Panel/agent/utils/common"
-
 	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/response"
 	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/app/repo"
 	"github.com/1Panel-dev/1Panel/agent/buserr"
 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/global"
 	"github.com/1Panel-dev/1Panel/agent/i18n"
+	"github.com/1Panel-dev/1Panel/agent/utils/common"
 	"github.com/1Panel-dev/1Panel/agent/utils/files"
 	"github.com/1Panel-dev/1Panel/agent/utils/ssl"
 	"github.com/go-acme/lego/v5/certcrypto"
+	"gorm.io/gorm"
 )
 
 type WebsiteCAService struct {
 }
 
 type IWebsiteCAService interface {
+	Import(req request.WebsiteCAImport) error
+	Upload(name string, archive []byte) error
 	Page(search request.WebsiteCASearch) (int64, []response.WebsiteCADTO, error)
 	Create(create request.WebsiteCACreate) (*request.WebsiteCACreate, error)
 	GetCA(id uint) (*response.WebsiteCADTO, error)
@@ -212,10 +218,17 @@ func (w WebsiteCAService) ObtainSSL(req request.WebsiteCAObtain) (*model.Website
 			websiteSSL.Shell = req.Shell
 		}
 		if req.PushDir {
-			if !files.NewFileOp().Stat(req.Dir) {
+			dirs := certificateDirectories(req.Dir)
+			if len(dirs) == 0 {
 				return nil, buserr.New("ErrLinkPathNotFound")
 			}
-			websiteSSL.Dir = req.Dir
+			for _, dir := range dirs {
+				info, err := os.Stat(dir)
+				if err != nil || !info.IsDir() {
+					return nil, buserr.New("ErrLinkPathNotFound")
+				}
+			}
+			websiteSSL.Dir = strings.Join(dirs, "\n")
 		}
 		if req.Domains != "" {
 			domainArray := strings.Split(req.Domains, "\n")
@@ -327,7 +340,7 @@ func (w WebsiteCAService) ObtainSSL(req request.WebsiteCAObtain) (*model.Website
 	websiteSSL.ExpireDate = cert.NotAfter
 	websiteSSL.StartDate = cert.NotBefore
 	websiteSSL.Type = cert.Issuer.CommonName
-	websiteSSL.Organization = rootCsr.Subject.Organization[0]
+	websiteSSL.Organization = strings.Join(rootCsr.Subject.Organization, ",")
 	websiteSSL.Status = constant.SSLReady
 
 	if req.Renew {
@@ -348,7 +361,9 @@ func (w WebsiteCAService) ObtainSSL(req request.WebsiteCAObtain) (*model.Website
 	if websiteSSL.ExecShell {
 		workDir := global.Dir.DataDir
 		if websiteSSL.PushDir {
-			workDir = websiteSSL.Dir
+			if dirs := certificateDirectories(websiteSSL.Dir); len(dirs) > 0 {
+				workDir = dirs[0]
+			}
 		}
 		logger.Println(i18n.GetMsgByKey("ExecShellStart"))
 		if err = runShellScriptFile(workDir, websiteSSL.Shell, logger); err != nil {
@@ -433,3 +448,150 @@ func (w WebsiteCAService) DownloadFile(id uint) (*os.File, error) {
 	}
 	return os.Open(path.Join(dir, fileName))
 }
+
+func (w WebsiteCAService) Upload(name string, archive []byte) error {
+	ca, err := parseCAArchive(archive)
+	if err != nil {
+		return err
+	}
+	return saveImportedCA(name, ca)
+}
+
+func saveImportedCA(name string, ca *model.WebsiteCA) error {
+	name = strings.TrimSpace(name)
+	if name == "" || len(name) > 128 || name == "." || name == ".." || strings.ContainsAny(name, "/\\\x00") {
+		return buserr.WithDetail("ErrInvalidParams", "name", nil)
+	}
+	exist, err := websiteCARepo.GetFirst(repo.WithByName(name))
+	if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
+		return err
+	}
+	if exist.ID > 0 {
+		return buserr.New("ErrNameIsExist")
+	}
+	ca.Name = name
+	return websiteCARepo.Create(context.Background(), ca)
+}
+
+// Read only the certificate and key in memory; never extract user-supplied paths.
+func parseCAArchive(archive []byte) (*model.WebsiteCA, error) {
+	invalid := func() (*model.WebsiteCA, error) { return nil, buserr.New("ErrCAUpload") }
+	if len(archive) > 10<<20 {
+		return invalid()
+	}
+	reader, err := zip.NewReader(bytes.NewReader(archive), int64(len(archive)))
+	if err != nil || len(reader.File) > 16 {
+		return invalid()
+	}
+	contents := make(map[string][]byte)
+	for _, file := range reader.File {
+		if file.FileInfo().IsDir() {
+			continue
+		}
+		name := path.Base(file.Name)
+		if (name != "ca.crt" && name != "ca.key") || contents[name] != nil || file.UncompressedSize64 > 1<<20 {
+			return invalid()
+		}
+		stream, err := file.Open()
+		if err != nil {
+			return invalid()
+		}
+		data, err := io.ReadAll(io.LimitReader(stream, (1<<20)+1))
+		stream.Close()
+		if err != nil || len(data) > 1<<20 {
+			return invalid()
+		}
+		contents[name] = data
+	}
+	return parseAndValidateRootCA(contents["ca.crt"], contents["ca.key"])
+}
+
+func parseAndValidateRootCA(certificate, privateKey []byte) (*model.WebsiteCA, error) {
+	invalid := func() (*model.WebsiteCA, error) { return nil, buserr.New("ErrCAImport") }
+	if len(certificate) > 1<<20 || len(privateKey) > 1<<20 {
+		return invalid()
+	}
+	pair, err := tls.X509KeyPair(certificate, privateKey)
+	if err != nil || len(pair.Certificate) != 1 {
+		return invalid()
+	}
+	cert := pair.Leaf
+	now := time.Now()
+	if cert == nil || !cert.IsCA || !cert.BasicConstraintsValid || cert.KeyUsage&x509.KeyUsageCertSign == 0 ||
+		!bytes.Equal(cert.RawIssuer, cert.RawSubject) || cert.CheckSignatureFrom(cert) != nil ||
+		now.Before(cert.NotBefore) || !now.Before(cert.NotAfter) {
+		return invalid()
+	}
+	ca := &model.WebsiteCA{CSR: string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: cert.Raw}))}
+	// Normalize keys to the formats used by ObtainSSL, including PKCS#8 uploads.
+	switch key := pair.PrivateKey.(type) {
+	case *ecdsa.PrivateKey:
+		bits := key.Curve.Params().BitSize
+		if bits != 256 && bits != 384 {
+			return invalid()
+		}
+		der, err := x509.MarshalECPrivateKey(key)
+		if err != nil {
+			return invalid()
+		}
+		ca.KeyType = fmt.Sprintf("EC%d", bits)
+		ca.PrivateKey = string(pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: der}))
+	case *rsa.PrivateKey:
+		bits := key.N.BitLen()
+		if bits != 2048 && bits != 3072 && bits != 4096 && bits != 8192 {
+			return invalid()
+		}
+		ca.KeyType = fmt.Sprintf("RSA%d", bits)
+		ca.PrivateKey = string(pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)}))
+	default:
+		return invalid()
+	}
+	return ca, nil
+}
+
+func (w WebsiteCAService) Import(req request.WebsiteCAImport) error {
+	certificate, privateKey := []byte(req.Certificate), []byte(req.PrivateKey)
+	switch req.Type {
+	case "local":
+		var err error
+		certificate, err = readCAImportFile(req.CertificatePath)
+		if err != nil {
+			return err
+		}
+		privateKey, err = readCAImportFile(req.PrivateKeyPath)
+		if err != nil {
+			return err
+		}
+	case "paste":
+	default:
+		return buserr.New("ErrCAImport")
+	}
+	ca, err := parseAndValidateRootCA(certificate, privateKey)
+	if err != nil {
+		return err
+	}
+	return saveImportedCA(req.Name, ca)
+}
+
+func readCAImportFile(name string) ([]byte, error) {
+	info, err := os.Stat(name)
+	if err != nil {
+		return nil, err
+	}
+	if !info.Mode().IsRegular() || info.Size() > 1<<20 {
+		return nil, buserr.New("ErrCAImport")
+	}
+	file, err := os.Open(name)
+	if err != nil {
+		return nil, err
+	}
+	defer file.Close()
+	content, err := io.ReadAll(io.LimitReader(file, (1<<20)+1))
+	if err != nil {
+		return nil, err
+	}
+	if len(content) > 1<<20 {
+		return nil, buserr.New("ErrCAImport")
+	}
+	return content, nil
+}

agent/app/service/website_managed_config.go

@@ -0,0 +1,100 @@
+package service
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/utils/files"
+	"github.com/1Panel-dev/1Panel/agent/utils/nginx"
+	"github.com/1Panel-dev/1Panel/agent/utils/nginx/parser"
+)
+
+type websiteManagedConfigPolicy struct {
+	protectedDirectories func() []string
+	backupIncludes       func(model.Website) []string
+}
+
+var websiteManagedConfigs websiteManagedConfigPolicy
+
+func configureWebsiteManagedConfig(policy websiteManagedConfigPolicy) {
+	if !policy.configured() || websiteManagedConfigs.configured() {
+		panic("invalid website managed configuration policy")
+	}
+	websiteManagedConfigs = policy
+}
+
+func (p websiteManagedConfigPolicy) configured() bool {
+	return p.protectedDirectories != nil && p.backupIncludes != nil
+}
+
+func (p websiteManagedConfigPolicy) pathAllowed(target string) bool {
+	if !p.configured() {
+		return false
+	}
+	resolved, err := websiteProxyResolvePath(target)
+	if err != nil {
+		return false
+	}
+	for _, directory := range p.protectedDirectories() {
+		if directory == "" {
+			return false
+		}
+		root, err := websiteProxyResolvePath(directory)
+		if err != nil {
+			return false
+		}
+		if relative, err := filepath.Rel(root, resolved); err != nil || relative != ".." && !strings.HasPrefix(relative, ".."+string(filepath.Separator)) {
+			return false
+		}
+	}
+	return true
+}
+
+func exportWebsiteNginxConfig(site model.Website, source, destination string) error {
+	return websiteManagedConfigs.exportNginxConfig(site, source, destination)
+}
+
+func (p websiteManagedConfigPolicy) exportNginxConfig(site model.Website, source, destination string) error {
+	if !p.configured() {
+		return errors.New("website managed configuration policy is unavailable")
+	}
+	includes := p.backupIncludes(site)
+	if len(includes) == 0 {
+		return files.NewFileOp().CopyFile(source, destination)
+	}
+	excluded := make(map[string]struct{}, len(includes))
+	for _, include := range includes {
+		if include == "" {
+			return errors.New("invalid managed website backup include")
+		}
+		excluded[include] = struct{}{}
+	}
+	content, err := os.ReadFile(source)
+	if err != nil {
+		return err
+	}
+	config, err := parser.NewStringParser(string(content)).Parse()
+	if err != nil {
+		return errors.New("invalid managed website backup configuration")
+	}
+	changed := false
+	for _, server := range config.FindServers() {
+		for _, directive := range server.FindDirectives("include") {
+			parameters := directive.GetParameters()
+			if len(parameters) != 1 {
+				continue
+			}
+			if _, found := excluded[strings.Trim(parameters[0], "\"'")]; found {
+				server.RemoveDirective("include", parameters)
+				changed = true
+			}
+		}
+	}
+	if changed {
+		content = []byte(nginx.DumpConfig(config, nginx.IndentedStyle))
+	}
+	return os.WriteFile(filepath.Join(destination, filepath.Base(source)), content, 0600)
+}

agent/app/service/website_proxy.go

@@ -4,7 +4,9 @@ import (
 	"bytes"
 	"errors"
 	"fmt"
+	"os"
 	"path"
+	"path/filepath"
 	"strconv"
 	"strings"
 
@@ -23,6 +25,63 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/utils/re"
 )
 
+func websiteProxyPathAllowed(directory, name string) bool {
+	if name == "" || name == "." || name == ".." || strings.ContainsAny(name, "/\\\x00") {
+		return false
+	}
+	resolvedDirectory, err := websiteProxyResolvePath(directory)
+	if err != nil || !websiteManagedConfigs.pathAllowed(resolvedDirectory) {
+		return false
+	}
+	for _, extension := range []string{".conf", ".bak"} {
+		filename := filepath.Join(directory, name+extension)
+		if info, statErr := os.Lstat(filename); statErr == nil && info.Mode()&os.ModeSymlink != 0 {
+			return false
+		}
+		resolved, resolveErr := websiteProxyResolvePath(filename)
+		if resolveErr != nil || !websiteProxyPathWithin(resolved, resolvedDirectory) || !websiteManagedConfigs.pathAllowed(resolved) {
+			return false
+		}
+	}
+	return true
+}
+
+func websiteProxyDirectoryAllowed(directory string) bool {
+	resolved, err := websiteProxyResolvePath(directory)
+	return err == nil && websiteManagedConfigs.pathAllowed(resolved)
+}
+
+func websiteProxyPathWithin(target, directory string) bool {
+	resolvedDirectory, err := websiteProxyResolvePath(directory)
+	if err != nil {
+		return false
+	}
+	relative, err := filepath.Rel(resolvedDirectory, target)
+	return err == nil && relative != ".." && !strings.HasPrefix(relative, ".."+string(filepath.Separator))
+}
+
+func websiteProxyResolvePath(target string) (string, error) {
+	absolute, err := filepath.Abs(target)
+	if err != nil {
+		return "", err
+	}
+	resolved, err := filepath.EvalSymlinks(absolute)
+	if err == nil {
+		return resolved, nil
+	}
+	if !os.IsNotExist(err) || filepath.Dir(absolute) == absolute {
+		return "", err
+	}
+	if info, statErr := os.Lstat(absolute); statErr == nil && info.Mode()&os.ModeSymlink != 0 {
+		return "", errors.New("invalid proxy symlink")
+	}
+	parent, err := websiteProxyResolvePath(filepath.Dir(absolute))
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(parent, filepath.Base(absolute)), nil
+}
+
 func (w WebsiteService) OperateProxy(req request.WebsiteProxyConfig) (err error) {
 	switch req.Operate {
 	case "delete":
@@ -51,6 +110,9 @@ func (w WebsiteService) OperateProxy(req request.WebsiteProxyConfig) (err error)
 	}
 	fileOp := files.NewFileOp()
 	includeDir := GetSitePath(website, SiteProxyDir)
+	if !websiteProxyPathAllowed(includeDir, req.Name) {
+		return errors.New("invalid proxy path")
+	}
 	if !fileOp.Stat(includeDir) {
 		_ = fileOp.CreateDir(includeDir, constant.DirPerm)
 	}
@@ -270,6 +332,9 @@ func (w WebsiteService) GetProxies(id uint) (res []request.WebsiteProxyConfig, e
 	}
 	includeDir := GetSitePath(website, SiteProxyDir)
 	fileOp := files.NewFileOp()
+	if !websiteProxyDirectoryAllowed(includeDir) {
+		return nil, errors.New("invalid proxy path")
+	}
 	if !fileOp.Stat(includeDir) {
 		return
 	}
@@ -282,12 +347,16 @@ func (w WebsiteService) GetProxies(id uint) (res []request.WebsiteProxyConfig, e
 		config  *components.Config
 	)
 	for _, configFile := range fileList.Items {
+		extension := filepath.Ext(configFile.Name)
+		name := strings.TrimSuffix(configFile.Name, extension)
+		if configFile.IsDir || (extension != ".conf" && extension != ".bak") || !websiteProxyPathAllowed(includeDir, name) {
+			continue
+		}
 		proxyConfig := request.WebsiteProxyConfig{
 			ID: website.ID,
 		}
-		parts := strings.Split(configFile.Name, ".")
-		proxyConfig.Name = parts[0]
-		if parts[1] == "conf" {
+		proxyConfig.Name = name
+		if extension == ".conf" {
 			proxyConfig.Enable = true
 		} else {
 			proxyConfig.Enable = false
@@ -360,6 +429,9 @@ func (w WebsiteService) UpdateProxyFile(req request.NginxProxyUpdate) (err error
 	if err != nil {
 		return err
 	}
+	if !websiteProxyPathAllowed(GetSitePath(website, SiteProxyDir), req.Name) {
+		return errors.New("invalid proxy path")
+	}
 	absolutePath := fmt.Sprintf("%s/%s.conf", GetSitePath(website, SiteProxyDir), req.Name)
 	fileOp := files.NewFileOp()
 	oldRewriteContent, err = fileOp.GetContent(absolutePath)
@@ -405,6 +477,9 @@ func (w WebsiteService) DeleteProxy(req request.WebsiteProxyDel) (err error) {
 		return
 	}
 	includeDir := GetSitePath(website, SiteProxyDir)
+	if !websiteProxyPathAllowed(includeDir, req.Name) {
+		return errors.New("invalid proxy path")
+	}
 	fileOp := files.NewFileOp()
 	if !fileOp.Stat(includeDir) {
 		return
@@ -425,6 +500,9 @@ func (w WebsiteService) UpdateProxyStatus(req request.WebsiteProxyStatusUpdate)
 		return
 	}
 	includeDir := GetSitePath(website, SiteProxyDir)
+	if !websiteProxyPathAllowed(includeDir, req.Name) {
+		return errors.New("invalid proxy path")
+	}
 	fileOp := files.NewFileOp()
 	if !fileOp.Stat(includeDir) {
 		return

agent/app/service/website_ssl.go

@@ -209,11 +209,17 @@ func (w WebsiteSSLService) Create(create request.WebsiteSSLCreate) (request.Webs
 		websiteSSL.Shell = create.Shell
 	}
 	if create.PushDir {
-		fileOP := files.NewFileOp()
-		if !fileOP.Stat(create.Dir) {
+		dirs := certificateDirectories(create.Dir)
+		if len(dirs) == 0 {
 			return res, buserr.New("ErrLinkPathNotFound")
 		}
-		websiteSSL.Dir = create.Dir
+		for _, dir := range dirs {
+			info, err := os.Stat(dir)
+			if err != nil || !info.IsDir() {
+				return res, buserr.New("ErrLinkPathNotFound")
+			}
+		}
+		websiteSSL.Dir = strings.Join(dirs, "\n")
 	}
 	setSSLPushConfig(&websiteSSL, create.PushNode, create.Nodes)
 
@@ -573,7 +579,9 @@ func (w WebsiteSSLService) obtainSSL(id uint, autoRenew bool) error {
 		if websiteSSL.ExecShell {
 			workDir := global.Dir.DataDir
 			if websiteSSL.PushDir {
-				workDir = websiteSSL.Dir
+				if dirs := certificateDirectories(websiteSSL.Dir); len(dirs) > 0 {
+					workDir = dirs[0]
+				}
 			}
 			printSSLLog(logger, "ExecShellStart", nil)
 			if err = runShellScriptFile(workDir, websiteSSL.Shell, logger); err != nil {
@@ -793,11 +801,16 @@ func (w WebsiteSSLService) Update(update request.WebsiteSSLUpdate) error {
 	}
 
 	if update.PushDir {
-		fileOP := files.NewFileOp()
-		if !fileOP.Stat(update.Dir) {
-			_ = fileOP.CreateDir(update.Dir, constant.DirPerm)
+		dirs := certificateDirectories(update.Dir)
+		if len(dirs) == 0 {
+			return buserr.New("ErrLinkPathNotFound")
 		}
-		updateParams["dir"] = update.Dir
+		for _, dir := range dirs {
+			if err := os.MkdirAll(dir, constant.DirPerm); err != nil {
+				return err
+			}
+		}
+		updateParams["dir"] = strings.Join(dirs, "\n")
 	}
 	var domains []string
 	if update.OtherDomains != "" {

agent/app/service/website_utils.go

@@ -1454,10 +1454,10 @@ func getWebsiteDomains(domains []request.WebsiteDomain, defaultHTTPPort, default
 			return
 		}
 		domainModel.Domain = strings.ToLower(domainModel.Domain)
-		domainModel.Port = domain.Port
 		if domain.Port == 0 {
 			domain.Port = defaultHTTPPort
 		}
+		domainModel.Port = domain.Port
 		domainModel.SSL = domain.SSL
 		domainModel.WebsiteID = websiteID
 		domainModels = append(domainModels, domainModel)
@@ -1529,26 +1529,41 @@ func checkWebsitePort(defaultHTTPsPort, port int, websiteType string) error {
 	return nil
 }
 
+// certificateDirectories accepts both legacy single paths and newline-separated paths.
+func certificateDirectories(value string) []string {
+	var dirs []string
+	seen := make(map[string]bool)
+	for _, dir := range strings.Split(value, "\n") {
+		dir = strings.TrimSpace(dir)
+		if dir == "" {
+			continue
+		}
+		dir = filepath.Clean(dir)
+		if !seen[dir] {
+			seen[dir] = true
+			dirs = append(dirs, dir)
+		}
+	}
+	return dirs
+}
+
 func saveCertificateFile(websiteSSL *model.WebsiteSSL, logger *log.Logger) {
-	if websiteSSL.PushDir {
-		fileOp := files.NewFileOp()
-		var (
-			pushErr error
-			MsgMap  = map[string]interface{}{"path": websiteSSL.Dir, "status": i18n.GetMsgByKey("Success")}
-		)
-		if pushErr = fileOp.SaveFile(path.Join(websiteSSL.Dir, "privkey.pem"), websiteSSL.PrivateKey, constant.FilePerm); pushErr != nil {
-			MsgMap["status"] = i18n.GetMsgByKey("Failed")
-			logger.Println(i18n.GetMsgWithMap("PushDirLog", MsgMap))
-			logger.Println("Push dir failed:" + pushErr.Error())
-		}
-		if pushErr = fileOp.SaveFile(path.Join(websiteSSL.Dir, "fullchain.pem"), websiteSSL.Pem, constant.FilePerm); pushErr != nil {
-			MsgMap["status"] = i18n.GetMsgByKey("Failed")
-			logger.Println(i18n.GetMsgWithMap("PushDirLog", MsgMap))
-			logger.Println("Push dir failed:" + pushErr.Error())
-		}
-		if pushErr == nil {
-			logger.Println(i18n.GetMsgWithMap("PushDirLog", MsgMap))
+	if !websiteSSL.PushDir {
+		return
+	}
+	fileOp := files.NewFileOp()
+	for _, dir := range certificateDirectories(websiteSSL.Dir) {
+		status := i18n.GetMsgByKey("Success")
+		for _, file := range []struct{ name, content string }{
+			{"privkey.pem", websiteSSL.PrivateKey},
+			{"fullchain.pem", websiteSSL.Pem},
+		} {
+			if err := fileOp.SaveFile(path.Join(dir, file.name), file.content, constant.FilePerm); err != nil {
+				status = i18n.GetMsgByKey("Failed")
+				logger.Printf("Push dir %s failed: %s", dir, err)
+			}
 		}
+		logger.Println(i18n.GetMsgWithMap("PushDirLog", map[string]interface{}{"path": dir, "status": status}))
 	}
 }
 

agent/app/task/task.go

@@ -292,10 +292,36 @@ func (t *Task) updateTask(task *model.Task) {
 	_ = t.taskRepo.Update(context.Background(), task)
 }
 
+// ExecuteQueued registers the task before returning and limits concurrent execution.
+// Subtasks must use Timeout = 0 and manage their own operation and recovery deadlines
+// so that a slot is held until the action and its cleanup have actually returned.
+func (t *Task) ExecuteQueued(slots chan struct{}, waitingStep string, onFinish func()) error {
+	t.Task.CurrentStep = waitingStep
+	if err := t.taskRepo.Save(context.Background(), t.Task); err != nil {
+		_ = t.logFile.Close()
+		global.RemoveTaskCancel(t.TaskID)
+		return err
+	}
+	t.Log(i18n.GetMsgByKey(waitingStep))
+	go func() {
+		slots <- struct{}{}
+		defer func() { <-slots }()
+		defer onFinish()
+		if err := t.executeRegistered(); err != nil {
+			global.LOG.Error(err.Error())
+		}
+	}()
+	return nil
+}
+
 func (t *Task) Execute() error {
 	if err := t.taskRepo.Save(context.Background(), t.Task); err != nil {
 		return err
 	}
+	return t.executeRegistered()
+}
+
+func (t *Task) executeRegistered() error {
 	var err error
 	t.Log(i18n.GetWithName("TaskStart", t.Name))
 	for i := 0; i < len(t.SubTasks); i++ {

agent/cmd/server/docs/x-log.json

@@ -53,13 +53,6 @@
 		"formatZH": "添加 Ollama 模型重试 [name]",
 		"formatEN": "re-add Ollama model [name]"
 	},
-	"/ai/ollama/model/sync": {
-		"bodyKeys": [],
-		"paramKeys": [],
-		"beforeFunctions": [],
-		"formatZH": "同步 Ollama 模型列表",
-		"formatEN": "sync Ollama model list"
-	},
 	"/ai/tensorrt/create": {
 		"bodyKeys": [
 			"name"
@@ -108,33 +101,29 @@
 		"formatEN": "create alert [title]"
 	},
 	"/alert/config/del": {
-		"bodyKeys": [
-			"id"
-		],
+		"bodyKeys": [],
 		"paramKeys": [],
-		"beforeFunctions": [],
-		"formatZH": "删除告警配置 [id]",
-		"formatEN": "delete alert config [id]"
+		"formatZH": "删除告警配置 [name]",
+		"formatEN": "delete alert config [name]",
+		"beforeFunctions": []
 	},
 	"/alert/config/status": {
 		"bodyKeys": [
-			"id",
 			"status"
 		],
 		"paramKeys": [],
-		"beforeFunctions": [],
-		"formatZH": "更新告警配置状态 [id][status]",
-		"formatEN": "update alert config status [id][status]"
+		"formatZH": "更新告警配置状态 [name][status]",
+		"formatEN": "update alert config status [name][status]",
+		"beforeFunctions": []
 	},
 	"/alert/config/update": {
 		"bodyKeys": [
-			"id",
 			"displayName"
 		],
 		"paramKeys": [],
-		"beforeFunctions": [],
-		"formatZH": "更新告警配置 [id][displayName]",
-		"formatEN": "update alert config [id][displayName]"
+		"formatZH": "更新告警配置 [displayName]",
+		"formatEN": "update alert config [displayName]",
+		"beforeFunctions": []
 	},
 	"/alert/del": {
 		"bodyKeys": [
@@ -3744,13 +3733,11 @@
 		"formatEN": "Create runtime [name]"
 	},
 	"/runtimes/del": {
-		"bodyKeys": [
-			"id"
-		],
+		"bodyKeys": [],
 		"paramKeys": [],
 		"beforeFunctions": [],
-		"formatZH": "删除运行环境 [id]",
-		"formatEN": "Delete runtime [id]"
+		"formatZH": "删除运行环境 [name]",
+		"formatEN": "Delete runtime [name]"
 	},
 	"/runtimes/operate": {
 		"bodyKeys": [
@@ -4586,13 +4573,13 @@
 	},
 	"/websites/php/version": {
 		"bodyKeys": [
-			"websiteId"
+			"websiteID"
 		],
 		"paramKeys": [],
 		"beforeFunctions": [
 			{
 				"input_column": "id",
-				"input_value": "websiteId",
+				"input_value": "websiteID",
 				"isList": false,
 				"db": "websites",
 				"output_column": "primary_domain",

agent/constant/app.go

@@ -10,6 +10,8 @@ const (
 	AppOpenclaw          = "openclaw"
 	AppCopaw             = "copaw"
 	AppHermesAgent       = "hermes-agent"
+	AppDeepSeekHarness   = "deepseek-harness"
+	AppOctop             = "octop"
 	AppMysql             = "mysql"
 	AppMariaDB           = "mariadb"
 	AppPostgresql        = "postgresql"