feat: add delete and reveal endpoints, support deleted_at field

agent/app/api/v2/container_image_check_update.go

@@ -1,43 +0,0 @@
-package v2
-
-import (
-	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
-	"github.com/1Panel-dev/1Panel/agent/app/service"
-	"github.com/gin-gonic/gin"
-)
-
-func (b *BaseApi) GetContainerImageCheckUpdateStatus(c *gin.Context) {
-	status, err := service.GetContainerImageCheckUpdateStatus()
-	if err != nil {
-		helper.InternalServer(c, err)
-		return
-	}
-	helper.SuccessWithData(c, status)
-}
-func (b *BaseApi) ContainerImageCheckUpdate(c *gin.Context) {
-	taskID, err := service.StartContainerImageCheckUpdate()
-	if err != nil {
-		helper.InternalServer(c, err)
-		return
-	}
-	status, err := service.GetContainerImageCheckUpdateStatus()
-	if err != nil {
-		helper.InternalServer(c, err)
-		return
-	}
-	status.TaskID = taskID
-	helper.SuccessWithData(c, status)
-}
-func (b *BaseApi) SetContainerImageCheckUpdateSchedule(c *gin.Context) {
-	var req struct {
-		Enabled *bool `json:"enabled" validate:"required"`
-	}
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
-		return
-	}
-	if err := service.SetContainerImageCheckUpdateSchedule(*req.Enabled); err != nil {
-		helper.InternalServer(c, err)
-		return
-	}
-	b.GetContainerImageCheckUpdateStatus(c)
-}

agent/app/api/v2/image_remote.go

@@ -1,16 +0,0 @@
-package v2
-
-import (
-	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
-	"github.com/1Panel-dev/1Panel/agent/app/service"
-	"github.com/gin-gonic/gin"
-)
-
-func (b *BaseApi) GetImageRemoteCheckStatus(c *gin.Context) {
-	status, err := service.GetImageRemoteCheckStatus()
-	if err != nil {
-		helper.InternalServer(c, err)
-		return
-	}
-	helper.SuccessWithData(c, status)
-}

agent/app/dto/container.go

@@ -21,16 +21,13 @@ type InspectReq struct {
 }
 
 type ContainerInfo struct {
-	LatestVersion string `json:"latestVersion"`
-	TargetImage   string `json:"targetImage"`
-	HasUpdate     bool   `json:"hasUpdate"`
-	ContainerID   string `json:"containerID"`
-	Name          string `json:"name"`
-	ImageId       string `json:"imageID"`
-	ImageName     string `json:"imageName"`
-	CreateTime    string `json:"createTime"`
-	State         string `json:"state"`
-	RunTime       string `json:"runTime"`
+	ContainerID string `json:"containerID"`
+	Name        string `json:"name"`
+	ImageId     string `json:"imageID"`
+	ImageName   string `json:"imageName"`
+	CreateTime  string `json:"createTime"`
+	State       string `json:"state"`
+	RunTime     string `json:"runTime"`
 
 	Network []string `json:"network"`
 	Ports   []string `json:"ports"`

agent/app/model/container_image_check_update.go

@@ -1,20 +0,0 @@
-package model
-
-import "time"
-
-// ContainerImageCheckUpdate is a cache tied to the exact image used by a container.
-type ContainerImageCheckUpdate struct {
-	ContainerID   string    `gorm:"primaryKey" json:"containerID"`
-	ImageID       string    `json:"imageID"`
-	ImageName     string    `json:"imageName"`
-	LatestVersion string    `json:"latestVersion"`
-	TargetImage   string    `json:"targetImage"`
-	TargetImageID string    `json:"-"`
-	HasUpdate     bool      `gorm:"not null;default:false" json:"hasUpdate"`
-	CheckedAt     time.Time `json:"checkedAt"`
-	CheckStatus   string    `json:"checkStatus"`
-	CheckError    string    `json:"checkError"`
-}
-
-// TableName preserves the table created by the original migration.
-func (ContainerImageCheckUpdate) TableName() string { return "container_image_updates" }

agent/app/service/container.go

@@ -140,29 +140,6 @@ func (u *ContainerService) Page(ctx context.Context, req dto.PageContainer) (int
 		backData = records[start:end]
 	}
 
-	// Batch-load persisted checks; never contact Docker Hub while rendering the list.
-	ids := make([]string, 0, len(backData))
-	for _, row := range backData {
-		ids = append(ids, row.ContainerID)
-	}
-	if len(ids) > 0 {
-		var checks []model.ContainerImageCheckUpdate
-		if err := global.DB.Where("container_id IN ?", ids).Find(&checks).Error; err != nil {
-			return 0, nil, err
-		}
-		byID := make(map[string]model.ContainerImageCheckUpdate, len(checks))
-		for _, check := range checks {
-			byID[check.ContainerID] = check
-		}
-		for i := range backData {
-			check, ok := byID[backData[i].ContainerID]
-			if ok && sameContainerImage(check.ImageID, backData[i].ImageId) && check.ImageName == backData[i].ImageName {
-				backData[i].LatestVersion = check.LatestVersion
-				backData[i].TargetImage = check.TargetImage
-				backData[i].HasUpdate = check.HasUpdate
-			}
-		}
-	}
 	for i := 0; i < len(backData); i++ {
 		install, _ := appInstallRepo.GetFirst(appInstallRepo.WithContainerName(backData[i].Name))
 		if install.ID > 0 {

agent/app/service/container_image_check_update.go

@@ -1,396 +0,0 @@
-package service
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"net/http"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/1Panel-dev/1Panel/agent/app/model"
-	"github.com/1Panel-dev/1Panel/agent/app/task"
-	"github.com/1Panel-dev/1Panel/agent/global"
-	"github.com/1Panel-dev/1Panel/agent/i18n"
-	"github.com/1Panel-dev/1Panel/agent/utils/docker"
-	"github.com/1Panel-dev/1Panel/agent/utils/dockerhub"
-	"github.com/docker/cli/cli/config"
-	"github.com/docker/docker/api/types/container"
-	"github.com/docker/docker/api/types/image"
-	"github.com/docker/docker/client"
-	"github.com/docker/docker/errdefs"
-	"gorm.io/gorm"
-	"gorm.io/gorm/clause"
-)
-
-const imageCheckUpdateSetting = "ContainerImageUpdateEnabled"
-
-type ImageCheckUpdateStatus struct {
-	TaskID     string `json:"taskID"`
-	Enabled    bool   `json:"enabled"`
-	Running    bool   `json:"running"`
-	Checked    int    `json:"checked"`
-	Updates    int    `json:"updates"`
-	Failed     int    `json:"failed"`
-	Skipped    int    `json:"skipped"`
-	Error      string `json:"error"`
-	FinishedAt int64  `json:"finishedAt"`
-}
-
-var imageCheckUpdateState struct {
-	sync.Mutex
-	status ImageCheckUpdateStatus
-}
-
-func GetContainerImageCheckUpdateStatus() (ImageCheckUpdateStatus, error) {
-	var setting model.Setting
-	if err := global.DB.Where("key = ?", imageCheckUpdateSetting).First(&setting).Error; err != nil {
-		return ImageCheckUpdateStatus{}, err
-	}
-	imageCheckUpdateState.Lock()
-	defer imageCheckUpdateState.Unlock()
-	status := imageCheckUpdateState.status
-	status.Enabled = setting.Value == "Enable"
-	return status, nil
-}
-func SetContainerImageCheckUpdateSchedule(enabled bool) error {
-	value := "Disable"
-	if enabled {
-		httpClient, err := dockerhub.NewHTTPClient()
-		if err != nil {
-			return err
-		}
-		if httpClient.Transport != nil {
-			httpClient.CloseIdleConnections()
-		}
-		value = "Enable"
-	}
-	return global.DB.Model(&model.Setting{}).Where("key = ?", imageCheckUpdateSetting).Update("value", value).Error
-}
-
-// StartContainerImageCheckUpdate coalesces manual and scheduled runs on this node.
-func StartContainerImageCheckUpdate() (string, error) {
-	imageCheckUpdateState.Lock()
-	defer imageCheckUpdateState.Unlock()
-	if imageCheckUpdateState.status.Running {
-		return imageCheckUpdateState.status.TaskID, nil
-	}
-	taskItem, err := task.NewTask(i18n.GetMsgByKey("ContainerImageCheckUpdate"), task.TaskScan, task.TaskScopeImage, "", 0)
-	if err != nil {
-		return "", err
-	}
-	// Persist before returning the ID so the log drawer can immediately find it.
-	if err := global.TaskDB.Save(taskItem.Task).Error; err != nil {
-		_ = taskItem.Logger.Out.(io.Closer).Close()
-		taskItem.DeleteLogFile()
-		if cancel, ok := global.LoadTaskCancel(taskItem.TaskID); ok {
-			cancel()
-		}
-		global.RemoveTaskCancel(taskItem.TaskID)
-		return "", err
-	}
-	imageCheckUpdateState.status = ImageCheckUpdateStatus{Running: true, TaskID: taskItem.TaskID}
-	go func() {
-		result := ImageCheckUpdateStatus{TaskID: taskItem.TaskID}
-		defer func() {
-			result.FinishedAt = time.Now().UnixMilli()
-			imageCheckUpdateState.Lock()
-			imageCheckUpdateState.status = result
-			imageCheckUpdateState.Unlock()
-		}()
-		// The action owns its deadline so the task runner waits for cleanup and logs.
-		taskItem.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerImageCheckUpdate"), func(t *task.Task) (err error) {
-			defer func() {
-				if recovered := recover(); recovered != nil {
-					err = fmt.Errorf("image update check failed: %v", recovered)
-				}
-				t.Log(i18n.GetMsgWithMap("ContainerImageCheckSummary", map[string]interface{}{
-					"checked": result.Checked, "updates": result.Updates, "failed": result.Failed, "skipped": result.Skipped,
-				}))
-			}()
-			ctx, cancel := context.WithTimeout(t.TaskCtx, 30*time.Minute)
-			defer cancel()
-			if err = runContainerImageCheckUpdate(ctx, &result, t.Log); err != nil {
-				return err
-			}
-			if result.Failed > 0 {
-				return fmt.Errorf("%s", i18n.GetMsgWithMap("ContainerImageCheckFailures", map[string]interface{}{"count": result.Failed}))
-			}
-			return nil
-		}, nil, 0, 0)
-		if err := taskItem.Execute(); err != nil {
-			result.Error = err.Error()
-			global.LOG.Errorf("container image check: %s", err)
-		}
-	}()
-	return taskItem.TaskID, nil
-}
-
-// These caches live only for one check. Remote results do not depend on a
-// container's local image ID, which is compared separately for every baseline.
-type imageCheckUpdateRepository struct {
-	client     imageCheckUpdateHubClient
-	err        error
-	tags       []string
-	tagsLoaded bool
-	tagsErr    error
-}
-type imageCheckUpdateTargetKey struct {
-	repository, tag string
-	platform        dockerhub.Platform
-}
-type imageCheckUpdateTargetResult struct {
-	target     dockerhub.Target
-	compatible bool
-	err        error
-}
-type imageCheckUpdateResult struct {
-	record model.ContainerImageCheckUpdate
-	err    error
-}
-type imageCheckUpdateCache struct {
-	username, password string
-	httpClient         *http.Client
-	repositories       map[string]*imageCheckUpdateRepository
-	targets            map[imageCheckUpdateTargetKey]imageCheckUpdateTargetResult
-}
-
-func runContainerImageCheckUpdate(ctx context.Context, result *ImageCheckUpdateStatus, logger func(string)) error {
-	httpClient, err := dockerhub.NewHTTPClient()
-	if err != nil {
-		return err
-	}
-	if httpClient.Transport != nil {
-		defer httpClient.CloseIdleConnections()
-	}
-	log := func(key string, values map[string]interface{}) {
-		if logger != nil {
-			logger(i18n.GetMsgWithMap(key, values))
-		}
-	}
-	cli, err := newImageCheckUpdateDockerClient()
-	if err != nil {
-		return err
-	}
-	defer cli.Close()
-	containers, err := cli.ContainerList(ctx, container.ListOptions{All: true})
-	if err != nil {
-		return err
-	}
-	log("ContainerImageCheckScope", map[string]interface{}{"count": len(containers)})
-	// Load old results once, rather than issuing one SELECT for every failed check.
-	var previousRows []model.ContainerImageCheckUpdate
-	if err := global.DB.WithContext(ctx).Find(&previousRows).Error; err != nil {
-		return err
-	}
-	previous := make(map[string]model.ContainerImageCheckUpdate, len(previousRows))
-	for _, row := range previousRows {
-		previous[row.ContainerID] = row
-	}
-	cache := imageCheckUpdateCache{httpClient: httpClient, repositories: map[string]*imageCheckUpdateRepository{}, targets: map[imageCheckUpdateTargetKey]imageCheckUpdateTargetResult{}}
-	cfg := config.LoadDefaultConfigFile(io.Discard)
-	if cfg != nil {
-		for _, host := range []string{"https://index.docker.io/v1/", "docker.io", "registry-1.docker.io"} {
-			auth, e := cfg.GetAuthConfig(host)
-			if e == nil && auth.Username != "" {
-				cache.username, cache.password = auth.Username, auth.Password
-				break
-			}
-		}
-	}
-	checks := map[string]imageCheckUpdateResult{}
-	ids := make([]string, 0, len(containers))
-	names := make(map[string]string, len(containers))
-	pending := make([]model.ContainerImageCheckUpdate, 0, 100)
-	for _, item := range containers {
-		if err := ctx.Err(); err != nil {
-			return err
-		}
-		ids = append(ids, item.ID)
-		name := item.ID
-		if len(item.Names) > 0 {
-			name = strings.TrimPrefix(item.Names[0], "/")
-		}
-		names[item.ID] = name
-		log("ContainerImageCheckItem", map[string]interface{}{"name": name, "image": item.Image})
-		repository, tag, supported := dockerhub.Reference(item.Image)
-		key := repository + ":" + tag + "@" + item.ImageID
-		entry, found := checks[key]
-		if !found {
-			entry.record, entry.err = checkContainerImageUpdate(ctx, cli, item, repository, tag, supported, &cache)
-			checks[key] = entry
-		}
-		record := entry.record
-		record.ContainerID, record.ImageName = item.ID, item.Image
-		if entry.err != nil {
-			record.CheckStatus, record.CheckError = "failed", entry.err.Error()
-			old := previous[item.ID]
-			if old.ImageID == item.ImageID && old.ImageName == item.Image {
-				record.LatestVersion, record.TargetImage, record.TargetImageID, record.HasUpdate = old.LatestVersion, old.TargetImage, old.TargetImageID, old.HasUpdate
-			}
-		}
-		pending = append(pending, record)
-		if len(pending) == 100 {
-			if err := saveContainerImageCheckUpdates(ctx, cli, pending, names, result, log); err != nil {
-				return err
-			}
-			pending = pending[:0]
-		}
-	}
-	if err := saveContainerImageCheckUpdates(ctx, cli, pending, names, result, log); err != nil {
-		return err
-	}
-	query := global.DB.WithContext(ctx).Where("1 = 1")
-	if len(ids) > 0 {
-		query = query.Where("container_id NOT IN ?", ids)
-	}
-	return query.Delete(&model.ContainerImageCheckUpdate{}).Error
-}
-
-func checkContainerImageUpdate(ctx context.Context, cli imageCheckUpdateDockerClient, item container.Summary, repository, tag string, supported bool, cache *imageCheckUpdateCache) (model.ContainerImageCheckUpdate, error) {
-	record := model.ContainerImageCheckUpdate{ImageID: item.ImageID, ImageName: item.Image, CheckStatus: "success", CheckedAt: time.Now()}
-	if !supported {
-		record.CheckStatus = "skipped"
-		return record, nil
-	}
-	inspected, err := cli.ImageInspect(ctx, item.ImageID)
-	if err != nil {
-		return record, err
-	}
-	repo, loaded := cache.repositories[repository]
-	if !loaded {
-		repo = &imageCheckUpdateRepository{}
-		repo.client, repo.err = newImageCheckUpdateHubClient(ctx, repository, cache.username, cache.password, cache.httpClient)
-		cache.repositories[repository] = repo
-	}
-	if repo.err != nil {
-		return record, repo.err
-	}
-	if dockerhub.NeedsTags(tag) {
-		if !repo.tagsLoaded {
-			repo.tags, repo.tagsErr = repo.client.Tags(ctx)
-			repo.tagsLoaded = true
-		}
-		if repo.tagsErr != nil {
-			return record, repo.tagsErr
-		}
-	}
-	platform := dockerhub.Platform{OS: inspected.Os, Architecture: inspected.Architecture, Variant: inspected.Variant}
-	for _, candidate := range dockerhub.Candidates(tag, repo.tags) {
-		key := imageCheckUpdateTargetKey{repository: repository, tag: candidate, platform: platform}
-		remote, loaded := cache.targets[key]
-		if !loaded {
-			remote.target, remote.compatible, remote.err = repo.client.Resolve(ctx, candidate, platform)
-			cache.targets[key] = remote
-		}
-		if remote.err != nil {
-			return record, remote.err
-		}
-		if !remote.compatible {
-			continue
-		}
-		record.LatestVersion = remote.target.Tag
-		record.TargetImage = "docker.io/" + repository + ":" + remote.target.Tag
-		record.TargetImageID = remote.target.ConfigDigest
-		// Both versioned and floating tags can be republished with new image content.
-		record.HasUpdate = remote.target.Tag != tag || remote.target.ConfigDigest != inspected.ID
-		return record, nil
-	}
-	return record, fmt.Errorf("no compatible image for %s/%s", platform.OS, platform.Architecture)
-}
-
-// Revalidate immediately before each small write batch. Never hold a database
-// transaction open while waiting for Docker or Docker Hub.
-func saveContainerImageCheckUpdates(ctx context.Context, cli imageCheckUpdateDockerClient, pending []model.ContainerImageCheckUpdate, names map[string]string, result *ImageCheckUpdateStatus, log func(string, map[string]interface{})) error {
-	records := make([]model.ContainerImageCheckUpdate, 0, len(pending))
-	for _, record := range pending {
-		current, err := cli.ContainerInspect(ctx, record.ContainerID)
-		if err != nil && !errdefs.IsNotFound(err) {
-			return err
-		}
-		if err != nil || current.Image != record.ImageID {
-			result.Skipped++
-			log("ContainerImageCheckChanged", map[string]interface{}{"name": names[record.ContainerID]})
-			continue
-		}
-		records = append(records, record)
-	}
-	if len(records) == 0 {
-		return nil
-	}
-	if err := global.DB.WithContext(ctx).Clauses(clause.OnConflict{UpdateAll: true}).CreateInBatches(&records, 100).Error; err != nil {
-		return err
-	}
-	// Count and announce only results that were successfully persisted.
-	for _, record := range records {
-		values := map[string]interface{}{"name": names[record.ContainerID], "image": record.ImageName}
-		switch record.CheckStatus {
-		case "failed":
-			result.Failed++
-			values["error"] = record.CheckError
-			log("ContainerImageCheckFailed", values)
-		case "skipped":
-			result.Skipped++
-			log("ContainerImageCheckSkipped", values)
-		default:
-			result.Checked++
-			if record.HasUpdate {
-				result.Updates++
-				values["target"] = record.TargetImage
-				log("ContainerImageCheckAvailable", values)
-			} else {
-				log("ContainerImageCheckCurrent", values)
-			}
-		}
-	}
-	return nil
-}
-
-// sameContainerImage guards cached results after external image changes.
-func sameContainerImage(stored, displayed string) bool {
-	return strings.TrimPrefix(stored, "sha256:") == strings.TrimPrefix(displayed, "sha256:")
-}
-
-// Reconcile only after Docker confirms the replacement container uses the target.
-func reconcileContainerImageCheckUpdate(oldID, newID, imageID, imageName string) error {
-	return global.DB.Transaction(func(tx *gorm.DB) error {
-		var previous model.ContainerImageCheckUpdate
-		if err := tx.Where("container_id = ?", oldID).Find(&previous).Error; err != nil {
-			return err
-		}
-		if previous.ContainerID == "" {
-			return nil
-		}
-		if err := tx.Where("container_id = ?", oldID).Delete(&model.ContainerImageCheckUpdate{}).Error; err != nil {
-			return err
-		}
-		if previous.TargetImageID != imageID {
-			return nil
-		}
-		previous.ContainerID = newID
-		previous.ImageID = imageID
-		previous.ImageName = imageName
-		previous.HasUpdate = false
-		previous.CheckStatus = "success"
-		previous.CheckError = ""
-		previous.CheckedAt = time.Now()
-		return tx.Clauses(clause.OnConflict{UpdateAll: true}).Create(&previous).Error
-	})
-}
-
-type imageCheckUpdateDockerClient interface {
-	ContainerList(context.Context, container.ListOptions) ([]container.Summary, error)
-	ContainerInspect(context.Context, string) (container.InspectResponse, error)
-	ImageInspect(context.Context, string, ...client.ImageInspectOption) (image.InspectResponse, error)
-	Close() error
-}
-type imageCheckUpdateHubClient interface {
-	Tags(context.Context) ([]string, error)
-	Resolve(context.Context, string, dockerhub.Platform) (dockerhub.Target, bool, error)
-}
-
-var newImageCheckUpdateDockerClient = func() (imageCheckUpdateDockerClient, error) { return docker.NewDockerClient() }
-var newImageCheckUpdateHubClient = func(ctx context.Context, repository, username, password string, httpClient *http.Client) (imageCheckUpdateHubClient, error) {
-	return dockerhub.New(ctx, repository, username, password, httpClient)
-}

agent/app/service/container_update.go

@@ -163,11 +163,6 @@ func (u *ContainerService) ContainerUpgrade(req dto.ContainerUpgrade) error {
 				upgradeErrors = append(upgradeErrors, upgradeErr)
 				return upgradeErr
 			}
-			if updated, inspectErr := client.ContainerInspect(ctx, item); inspectErr == nil {
-				if cacheErr := reconcileContainerImageCheckUpdate(oldContainer.ID, updated.ID, updated.Image, updated.Config.Image); cacheErr != nil {
-					global.LOG.Warnf("refresh container image update state: %v", cacheErr)
-				}
-			}
 			if cleanupErr != nil {
 				t.Log(i18n.GetWithNameAndErr("ContainerCleanupWarning", containerSwitchBackupName(oldContainer.ID), cleanupErr))
 			}
@@ -312,6 +307,7 @@ func switchContainer(
 	return switchContainerWithRecovery(ctx, cli, name, oldContainer, createNew, tty, logger, false)
 }
 
+
 const (
 	containerUpgradePullTimeout     = 30 * time.Minute
 	containerUpgradeReplaceTimeout  = 15 * time.Minute

agent/app/service/image_remote.go

@@ -1,29 +0,0 @@
-package service
-
-import (
-	"errors"
-
-	"github.com/1Panel-dev/1Panel/agent/buserr"
-	"github.com/1Panel-dev/1Panel/agent/utils/dockerhub"
-)
-
-type ImageRemoteCheckStatus struct {
-	ProxyRequired bool `json:"proxyRequired"`
-}
-
-// GetImageRemoteCheckStatus validates local settings without contacting Docker Hub.
-// Both image searches and update checks use the same proxy policy.
-func GetImageRemoteCheckStatus() (ImageRemoteCheckStatus, error) {
-	client, err := dockerhub.NewHTTPClient()
-	if err != nil {
-		var business buserr.BusinessError
-		if errors.As(err, &business) && business.Msg == "ErrImageCheckProxyRequired" {
-			return ImageRemoteCheckStatus{ProxyRequired: true}, nil
-		}
-		return ImageRemoteCheckStatus{}, err
-	}
-	if client.Transport != nil {
-		client.CloseIdleConnections()
-	}
-	return ImageRemoteCheckStatus{}, nil
-}

agent/cron/cron.go

@@ -77,11 +77,7 @@ func Run() {
 		global.LOG.Errorf("generate random hour failed: %v", err)
 		hourRand = big.NewInt(0)
 	}
-	appSyncSchedule := fmt.Sprintf("%v %v * * *", minuteRand.Int64(), hourRand.Int64())
-	if _, err := global.Cron.AddJob(appSyncSchedule, job.NewContainerImageCheckUpdateJob()); err != nil {
-		global.LOG.Errorf("cannot add container image update cron job: %v", err)
-	}
-	if _, err := global.Cron.AddJob(appSyncSchedule, job.NewAppStoreJob()); err != nil {
+	if _, err := global.Cron.AddJob(fmt.Sprintf("%v %v * * *", minuteRand.Int64(), hourRand.Int64()), job.NewAppStoreJob()); err != nil {
 		global.LOG.Errorf("can not add  appstore corn job: %s", err.Error())
 	}
 	if _, err := global.Cron.AddJob("0 3 */31 * *", job.NewBackupJob()); err != nil {

agent/cron/job/container_image_check_update.go

@@ -1,24 +0,0 @@
-package job
-
-import (
-	"github.com/1Panel-dev/1Panel/agent/app/service"
-	"github.com/1Panel-dev/1Panel/agent/global"
-)
-
-type containerImageCheckUpdate struct{}
-
-func NewContainerImageCheckUpdateJob() *containerImageCheckUpdate {
-	return &containerImageCheckUpdate{}
-}
-func (j *containerImageCheckUpdate) Run() {
-	status, err := service.GetContainerImageCheckUpdateStatus()
-	if err != nil {
-		global.LOG.Errorf("load container image update schedule: %v", err)
-		return
-	}
-	if status.Enabled {
-		if _, err := service.StartContainerImageCheckUpdate(); err != nil {
-			global.LOG.Errorf("start container image update check: %v", err)
-		}
-	}
-}

agent/i18n/lang/en.yaml

@@ -802,15 +802,3 @@ ErrFeishuUpgradeMounts: "These mounts cannot be fully backed up or restored. Use
 AgentFeishuRecoveryDisabled: "Gateway recovered with Feishu disabled; the original configuration backup is retained."
 
 ContainerUpgradeWaiting: "Waiting for a container upgrade execution slot"
-ContainerImageCheckUpdate: "Check for image updates"
-ContainerImageCheckScope: "Checking all {{ .count }} containers on this node, regardless of pagination or filters"
-ContainerImageCheckItem: "Checking container {{ .name }}, image {{ .image }}"
-ContainerImageCheckFailed: "Container {{ .name }} check failed: {{ .error }}; retaining previous results matching the current image"
-ContainerImageCheckSkipped: "Skipping {{ .name }}: not a tagged Docker Hub image, a local image, or pinned digest"
-ContainerImageCheckAvailable: "Container {{ .name }} has an update: {{ .image }} -> {{ .target }}"
-ContainerImageCheckCurrent: "No update found for container {{ .name }}"
-ContainerImageCheckChanged: "Container {{ .name }} was removed or its image changed; result was not saved"
-ContainerImageCheckSummary: "Check finished: {{ .checked }} checked, {{ .updates }} upgradable, {{ .failed }} failed, {{ .skipped }} skipped"
-ContainerImageCheckFailures: "{{ .count }} container checks failed; see the task log"
-
-ErrImageCheckProxyRequired: "To check for image updates in the current runtime environment, please configure a proxy server first."

agent/i18n/lang/es-ES.yaml

@@ -802,15 +802,3 @@ ErrFeishuUpgradeMounts: "Estos montajes no permiten una copia y restauración co
 AgentFeishuRecoveryDisabled: "Puerta de enlace recuperada con Feishu desactivado; se conserva la copia de configuración original."
 
 ContainerUpgradeWaiting: "Waiting for a container upgrade execution slot"
-ContainerImageCheckUpdate: "Buscar actualizaciones de imágenes"
-ContainerImageCheckScope: "Comprobando los {{ .count }} contenedores de este nodo, sin aplicar paginación ni filtros"
-ContainerImageCheckItem: "Comprobando el contenedor {{ .name }}, imagen {{ .image }}"
-ContainerImageCheckFailed: "Error al comprobar el contenedor {{ .name }}: {{ .error }}; se conservan los resultados anteriores correspondientes a la imagen actual"
-ContainerImageCheckSkipped: "Se omite {{ .name }}: no es una imagen de Docker Hub con etiqueta, es una imagen local o tiene un digest fijo"
-ContainerImageCheckAvailable: "El contenedor {{ .name }} tiene una actualización: {{ .image }} → {{ .target }}"
-ContainerImageCheckCurrent: "No se encontraron actualizaciones para el contenedor {{ .name }}"
-ContainerImageCheckChanged: "El contenedor {{ .name }} se eliminó o su imagen cambió; no se guardó el resultado"
-ContainerImageCheckSummary: "Comprobación finalizada: comprobados {{ .checked }}, actualizables {{ .updates }}, fallidos {{ .failed }}, omitidos {{ .skipped }}"
-ContainerImageCheckFailures: "Falló la comprobación de {{ .count }} contenedores; consulte el registro de la tarea"
-
-ErrImageCheckProxyRequired: "Para comprobar actualizaciones de imágenes en el entorno actual, configura primero un servidor proxy."

agent/i18n/lang/fa.yaml

@@ -803,15 +803,3 @@ ErrFeishuUpgradeMounts: "این اتصال‌های ذخیره‌سازی کام
 AgentFeishuRecoveryDisabled: "دروازه بازیابی شد و Feishu غیرفعال است؛ پشتیبان تنظیمات اصلی حفظ شد."
 
 ContainerUpgradeWaiting: "Waiting for a container upgrade execution slot"
-ContainerImageCheckUpdate: "بررسی به‌روزرسانی ایمیج‌ها"
-ContainerImageCheckScope: "در حال بررسی همه {{ .count }} کانتینر این گره، بدون توجه به صفحه‌بندی و فیلترها"
-ContainerImageCheckItem: "در حال بررسی کانتینر {{ .name }}، ایمیج {{ .image }}"
-ContainerImageCheckFailed: "بررسی کانتینر {{ .name }} ناموفق بود: {{ .error }}؛ نتایج قبلیِ منطبق با ایمیج فعلی حفظ می‌شوند"
-ContainerImageCheckSkipped: "کانتینر {{ .name }} رد شد: ایمیج تگ‌دار Docker Hub نیست، ایمیج محلی است یا digest ثابت دارد"
-ContainerImageCheckAvailable: "برای کانتینر {{ .name }} به‌روزرسانی موجود است: {{ .image }} → {{ .target }}"
-ContainerImageCheckCurrent: "به‌روزرسانی برای کانتینر {{ .name }} یافت نشد"
-ContainerImageCheckChanged: "کانتینر {{ .name }} حذف شده یا ایمیج آن تغییر کرده است؛ نتیجه ذخیره نشد"
-ContainerImageCheckSummary: "بررسی پایان یافت: بررسی‌شده {{ .checked }}، قابل ارتقا {{ .updates }}، ناموفق {{ .failed }}، ردشده {{ .skipped }}"
-ContainerImageCheckFailures: "بررسی {{ .count }} کانتینر ناموفق بود؛ گزارش وظیفه را مشاهده کنید"
-
-ErrImageCheckProxyRequired: "برای بررسی به‌روزرسانی تصاویر در محیط فعلی، ابتدا یک سرور پروکسی پیکربندی کنید."

agent/i18n/lang/ja.yaml

@@ -802,15 +802,3 @@ ErrFeishuUpgradeMounts: "現在のマウントは完全なバックアップ・
 AgentFeishuRecoveryDisabled: "ゲートウェイを復旧しました。Feishu は無効のままで、元の設定のバックアップは保持しています。"
 
 ContainerUpgradeWaiting: "Waiting for a container upgrade execution slot"
-ContainerImageCheckUpdate: "イメージの更新を確認"
-ContainerImageCheckScope: "ページ分割やフィルターに関係なく、このノードの全 {{ .count }} コンテナを確認します"
-ContainerImageCheckItem: "コンテナ {{ .name }}、イメージ {{ .image }} を確認しています"
-ContainerImageCheckFailed: "コンテナ {{ .name }} の確認に失敗しました：{{ .error }}。現在のイメージに対応する前回の結果を保持します"
-ContainerImageCheckSkipped: "{{ .name }} をスキップ：タグ付きの Docker Hub イメージではないか、ローカルイメージまたは digest 固定のイメージです"
-ContainerImageCheckAvailable: "コンテナ {{ .name }} は更新可能です：{{ .image }} → {{ .target }}"
-ContainerImageCheckCurrent: "コンテナ {{ .name }} の更新は見つかりませんでした"
-ContainerImageCheckChanged: "コンテナ {{ .name }} が削除されたか、イメージが変更されたため、結果は保存されませんでした"
-ContainerImageCheckSummary: "確認終了：成功 {{ .checked }}、更新可能 {{ .updates }}、失敗 {{ .failed }}、スキップ {{ .skipped }}"
-ContainerImageCheckFailures: "{{ .count }} コンテナの確認に失敗しました。タスクログを確認してください"
-
-ErrImageCheckProxyRequired: "現在の実行環境でイメージの更新を確認するには、先にプロキシサーバーを設定してください。"

agent/i18n/lang/ko.yaml

@@ -802,15 +802,3 @@ ErrFeishuUpgradeMounts: "현재 마운트는 전체 백업 및 복원을 지원
 AgentFeishuRecoveryDisabled: "게이트웨이가 복구되었습니다. Feishu는 비활성 상태이며 원본 설정 백업은 유지됩니다."
 
 ContainerUpgradeWaiting: "Waiting for a container upgrade execution slot"
-ContainerImageCheckUpdate: "이미지 업데이트 확인"
-ContainerImageCheckScope: "페이지 및 필터와 관계없이 현재 노드의 모든 컨테이너 {{ .count }}개를 확인합니다"
-ContainerImageCheckItem: "컨테이너 {{ .name }}, 이미지 {{ .image }} 확인 중"
-ContainerImageCheckFailed: "컨테이너 {{ .name }} 확인 실패: {{ .error }}. 현재 이미지와 일치하는 이전 결과를 유지합니다"
-ContainerImageCheckSkipped: "{{ .name }} 건너뜀: 태그가 있는 Docker Hub 이미지가 아니거나 로컬 이미지 또는 digest가 고정된 이미지입니다"
-ContainerImageCheckAvailable: "컨테이너 {{ .name }} 업데이트 가능: {{ .image }} → {{ .target }}"
-ContainerImageCheckCurrent: "컨테이너 {{ .name }}의 업데이트를 찾지 못했습니다"
-ContainerImageCheckChanged: "컨테이너 {{ .name }}이 삭제되었거나 이미지가 변경되어 결과를 저장하지 않았습니다"
-ContainerImageCheckSummary: "확인 종료: 성공 {{ .checked }}, 업데이트 가능 {{ .updates }}, 실패 {{ .failed }}, 건너뜀 {{ .skipped }}"
-ContainerImageCheckFailures: "컨테이너 {{ .count }}개 확인에 실패했습니다. 작업 로그를 확인하세요"
-
-ErrImageCheckProxyRequired: "현재 실행 환경에서 이미지 업데이트를 확인하려면 먼저 프록시 서버를 설정하세요."

agent/i18n/lang/lo.yaml

@@ -793,15 +793,3 @@ ErrFeishuUpgradeMounts: "ຈຸດເຊື່ອມຂໍ້ມູນນີ້
 AgentFeishuRecoveryDisabled: "ເກດເວກູ້ຄືນແລ້ວ ແຕ່ Feishu ຍັງປິດ; ສຳຮອງການຕັ້ງຄ່າເດີມຍັງຖືກເກັບໄວ້."
 
 ContainerUpgradeWaiting: "Waiting for a container upgrade execution slot"
-ContainerImageCheckUpdate: "ກວດສອບການອັບເດດອິມເມຈ"
-ContainerImageCheckScope: "ກຳລັງກວດສອບທັງໝົດ {{ .count }} ຄອນເທນເນີໃນໂນດນີ້ ໂດຍບໍ່ຂຶ້ນກັບການແບ່ງໜ້າ ຫຼື ຕົວກອງ"
-ContainerImageCheckItem: "ກຳລັງກວດສອບຄອນເທນເນີ {{ .name }}, ອິມເມຈ {{ .image }}"
-ContainerImageCheckFailed: "ກວດສອບຄອນເທນເນີ {{ .name }} ລົ້ມເຫຼວ: {{ .error }}; ເກັບຜົນກ່ອນໜ້າທີ່ກົງກັບອິມເມຈປັດຈຸບັນໄວ້"
-ContainerImageCheckSkipped: "ຂ້າມ {{ .name }}: ບໍ່ແມ່ນອິມເມຈ Docker Hub ທີ່ມີແທັກ, ເປັນອິມເມຈພາຍໃນ ຫຼື ກຳນົດ digest ຄົງທີ່"
-ContainerImageCheckAvailable: "ຄອນເທນເນີ {{ .name }} ມີອັບເດດ: {{ .image }} → {{ .target }}"
-ContainerImageCheckCurrent: "ບໍ່ພົບອັບເດດສຳລັບຄອນເທນເນີ {{ .name }}"
-ContainerImageCheckChanged: "ຄອນເທນເນີ {{ .name }} ຖືກລຶບ ຫຼື ອິມເມຈປ່ຽນແປງ; ບໍ່ໄດ້ບັນທຶກຜົນ"
-ContainerImageCheckSummary: "ກວດສອບສິ້ນສຸດ: ກວດແລ້ວ {{ .checked }}, ອັບເກຣດໄດ້ {{ .updates }}, ລົ້ມເຫຼວ {{ .failed }}, ຂ້າມ {{ .skipped }}"
-ContainerImageCheckFailures: "ກວດສອບ {{ .count }} ຄອນເທນເນີລົ້ມເຫຼວ; ກະລຸນາເບິ່ງບັນທຶກວຽກ"
-
-ErrImageCheckProxyRequired: "ເພື່ອກວດສອບການອັບເດດອິມເມຈໃນສະພາບແວດລ້ອມປັດຈຸບັນ ກະລຸນາຕັ້ງຄ່າພຣັອກຊີເຊີບເວີກ່ອນ."

agent/i18n/lang/ms.yaml

@@ -802,15 +802,3 @@ ErrFeishuUpgradeMounts: "Lekapan ini tidak boleh disandar dan dipulihkan sepenuh
 AgentFeishuRecoveryDisabled: "Gerbang dipulihkan dengan Feishu dinyahaktifkan; sandaran konfigurasi asal dikekalkan."
 
 ContainerUpgradeWaiting: "Waiting for a container upgrade execution slot"
-ContainerImageCheckUpdate: "Semak kemas kini imej"
-ContainerImageCheckScope: "Menyemak kesemua {{ .count }} kontena pada nod ini tanpa mengira pembahagian halaman atau penapis"
-ContainerImageCheckItem: "Menyemak kontena {{ .name }}, imej {{ .image }}"
-ContainerImageCheckFailed: "Semakan kontena {{ .name }} gagal: {{ .error }}; keputusan terdahulu yang sepadan dengan imej semasa dikekalkan"
-ContainerImageCheckSkipped: "Melangkau {{ .name }}: bukan imej Docker Hub bertag, imej setempat atau digest ditetapkan"
-ContainerImageCheckAvailable: "Kontena {{ .name }} mempunyai kemas kini: {{ .image }} → {{ .target }}"
-ContainerImageCheckCurrent: "Tiada kemas kini ditemui untuk kontena {{ .name }}"
-ContainerImageCheckChanged: "Kontena {{ .name }} telah dipadam atau imejnya berubah; keputusan tidak disimpan"
-ContainerImageCheckSummary: "Semakan selesai: disemak {{ .checked }}, boleh dikemas kini {{ .updates }}, gagal {{ .failed }}, dilangkau {{ .skipped }}"
-ContainerImageCheckFailures: "Semakan {{ .count }} kontena gagal; lihat log tugas"
-
-ErrImageCheckProxyRequired: "Untuk menyemak kemas kini imej dalam persekitaran semasa, sila konfigurasikan pelayan proksi terlebih dahulu."

agent/i18n/lang/pt-BR.yaml

@@ -802,15 +802,3 @@ ErrFeishuUpgradeMounts: "Estas montagens não permitem backup e restauração co
 AgentFeishuRecoveryDisabled: "Gateway recuperado com Feishu desativado; o backup da configuração original foi mantido."
 
 ContainerUpgradeWaiting: "Waiting for a container upgrade execution slot"
-ContainerImageCheckUpdate: "Verificar atualizações de imagens"
-ContainerImageCheckScope: "Verificando todos os {{ .count }} contêineres deste nó, independentemente da paginação e dos filtros"
-ContainerImageCheckItem: "Verificando o contêiner {{ .name }}, imagem {{ .image }}"
-ContainerImageCheckFailed: "Falha ao verificar o contêiner {{ .name }}: {{ .error }}; os resultados anteriores correspondentes à imagem atual serão mantidos"
-ContainerImageCheckSkipped: "Ignorando {{ .name }}: não é uma imagem do Docker Hub com tag, é uma imagem local ou tem digest fixo"
-ContainerImageCheckAvailable: "O contêiner {{ .name }} tem uma atualização: {{ .image }} → {{ .target }}"
-ContainerImageCheckCurrent: "Nenhuma atualização encontrada para o contêiner {{ .name }}"
-ContainerImageCheckChanged: "O contêiner {{ .name }} foi removido ou sua imagem mudou; o resultado não foi salvo"
-ContainerImageCheckSummary: "Verificação concluída: verificados {{ .checked }}, atualizáveis {{ .updates }}, falhas {{ .failed }}, ignorados {{ .skipped }}"
-ContainerImageCheckFailures: "Falha na verificação de {{ .count }} contêineres; consulte o log da tarefa"
-
-ErrImageCheckProxyRequired: "Para verificar atualizações de imagens no ambiente atual, configure primeiro um servidor proxy."

agent/i18n/lang/ru.yaml

@@ -802,15 +802,3 @@ ErrFeishuUpgradeMounts: "Эти монтирования не поддержив
 AgentFeishuRecoveryDisabled: "Шлюз восстановлен, Feishu отключён; исходная резервная копия конфигурации сохранена."
 
 ContainerUpgradeWaiting: "Waiting for a container upgrade execution slot"
-ContainerImageCheckUpdate: "Проверить обновления образов"
-ContainerImageCheckScope: "Проверка всех контейнеров на текущем узле ({{ .count }}) независимо от страниц и фильтров"
-ContainerImageCheckItem: "Проверка контейнера {{ .name }}, образ {{ .image }}"
-ContainerImageCheckFailed: "Ошибка проверки контейнера {{ .name }}: {{ .error }}; сохранены предыдущие результаты, соответствующие текущему образу"
-ContainerImageCheckSkipped: "Пропуск {{ .name }}: это не образ Docker Hub с тегом, локальный образ или образ с фиксированным digest"
-ContainerImageCheckAvailable: "Доступно обновление контейнера {{ .name }}: {{ .image }} → {{ .target }}"
-ContainerImageCheckCurrent: "Обновлений для контейнера {{ .name }} не найдено"
-ContainerImageCheckChanged: "Контейнер {{ .name }} удалён или его образ изменился; результат не сохранён"
-ContainerImageCheckSummary: "Проверка завершена: проверено {{ .checked }}, доступны обновления {{ .updates }}, ошибок {{ .failed }}, пропущено {{ .skipped }}"
-ContainerImageCheckFailures: "Не удалось проверить контейнеры: {{ .count }}. Подробности в журнале задачи"
-
-ErrImageCheckProxyRequired: "Для проверки обновлений образов в текущей среде сначала настройте прокси-сервер."

agent/i18n/lang/tr.yaml

@@ -802,15 +802,3 @@ ErrFeishuUpgradeMounts: "Bu bağlamalar tam yedeklenip geri yüklenemiyor. Uygul
 AgentFeishuRecoveryDisabled: "Ağ geçidi kurtarıldı, Feishu kapalı; özgün yapılandırma yedeği korundu."
 
 ContainerUpgradeWaiting: "Waiting for a container upgrade execution slot"
-ContainerImageCheckUpdate: "İmaj güncellemelerini denetle"
-ContainerImageCheckScope: "Sayfalama ve filtrelerden bağımsız olarak bu düğümdeki {{ .count }} konteynerin tümü denetleniyor"
-ContainerImageCheckItem: "Konteyner {{ .name }}, imaj {{ .image }} denetleniyor"
-ContainerImageCheckFailed: "{{ .name }} konteyneri denetlenemedi: {{ .error }}; mevcut imajla eşleşen önceki sonuçlar korunuyor"
-ContainerImageCheckSkipped: "{{ .name }} atlanıyor: etiketli bir Docker Hub imajı değil, yerel bir imaj veya digest değeri sabitlenmiş"
-ContainerImageCheckAvailable: "{{ .name }} konteyneri için güncelleme mevcut: {{ .image }} → {{ .target }}"
-ContainerImageCheckCurrent: "{{ .name }} konteyneri için güncelleme bulunamadı"
-ContainerImageCheckChanged: "{{ .name }} konteyneri silindi veya imajı değişti; sonuç kaydedilmedi"
-ContainerImageCheckSummary: "Denetim tamamlandı: denetlenen {{ .checked }}, güncellenebilir {{ .updates }}, başarısız {{ .failed }}, atlanan {{ .skipped }}"
-ContainerImageCheckFailures: "{{ .count }} konteyner denetlenemedi; görev günlüğünü inceleyin"
-
-ErrImageCheckProxyRequired: "Geçerli çalışma ortamında imaj güncellemelerini kontrol etmek için önce bir proxy sunucusu yapılandırın."

agent/i18n/lang/zh-Hant.yaml

@@ -802,15 +802,3 @@ ErrFeishuUpgradeMounts: "目前掛載無法完整備份或還原，請使用應
 AgentFeishuRecoveryDisabled: "閘道已恢復，飛書保持停用；原設定備份已保留。"
 
 ContainerUpgradeWaiting: "等待容器升級任務執行名額"
-ContainerImageCheckUpdate: "檢查更新映像"
-ContainerImageCheckScope: "檢查目前節點全部 {{ .count }} 個容器，不受分頁和篩選影響"
-ContainerImageCheckItem: "檢查容器 {{ .name }}，映像 {{ .image }}"
-ContainerImageCheckFailed: "容器 {{ .name }} 檢查失敗：{{ .error }}；保留符合目前映像的上次結果"
-ContainerImageCheckSkipped: "略過 {{ .name }}：非 Docker Hub 標籤映像、本機映像或固定 digest"
-ContainerImageCheckAvailable: "容器 {{ .name }} 可升級：{{ .image }} → {{ .target }}"
-ContainerImageCheckCurrent: "容器 {{ .name }} 未發現更新"
-ContainerImageCheckChanged: "容器 {{ .name }} 已刪除或映像已變更，未儲存本次結果"
-ContainerImageCheckSummary: "檢查結束：成功 {{ .checked }}，可升級 {{ .updates }}，失敗 {{ .failed }}，略過 {{ .skipped }}"
-ContainerImageCheckFailures: "{{ .count }} 個容器檢查失敗，請查看任務日誌"
-
-ErrImageCheckProxyRequired: "目前運行環境下，如需檢查映像是否更新，請先設定代理伺服器"

agent/i18n/lang/zh.yaml

@@ -802,15 +802,3 @@ ErrFeishuUpgradeMounts: "当前挂载无法完整备份或恢复，请使用应
 AgentFeishuRecoveryDisabled: "网关已恢复，飞书保持停用；原配置备份已保留。"
 
 ContainerUpgradeWaiting: "等待容器升级任务执行名额"
-ContainerImageCheckUpdate: "检查更新镜像"
-ContainerImageCheckScope: "检查当前节点全部 {{ .count }} 个容器，不受分页和筛选影响"
-ContainerImageCheckItem: "检查容器 {{ .name }}，镜像 {{ .image }}"
-ContainerImageCheckFailed: "容器 {{ .name }} 检查失败：{{ .error }}；保留匹配当前镜像的上次结果"
-ContainerImageCheckSkipped: "跳过 {{ .name }}：非 Docker Hub 标签镜像、本地镜像或固定 digest"
-ContainerImageCheckAvailable: "容器 {{ .name }} 可升级：{{ .image }} → {{ .target }}"
-ContainerImageCheckCurrent: "容器 {{ .name }} 未发现更新"
-ContainerImageCheckChanged: "容器 {{ .name }} 已删除或镜像发生变化，未保存本次结果"
-ContainerImageCheckSummary: "检查结束：成功 {{ .checked }}，可升级 {{ .updates }}，失败 {{ .failed }}，跳过 {{ .skipped }}"
-ContainerImageCheckFailures: "{{ .count }} 个容器检查失败，请查看任务日志"
-
-ErrImageCheckProxyRequired: "当前运行环境下，如需检查镜像是否更新，请优先配置代理服务器"

agent/init/migration/migrate.go

@@ -119,7 +119,6 @@ func agentDBMigrations() []*gormigrate.Migration {
 		migrations.AddQuickDirectory,
 		migrations.AddLocalModelAccountLink,
 		migrations.AddOllamaModelAccountSync,
-		migrations.AddContainerImageCheckUpdates,
 	}
 }
 

agent/init/migration/migrations/container_image_check_update.go

@@ -1,17 +0,0 @@
-package migrations
-
-import (
-	"github.com/1Panel-dev/1Panel/agent/app/model"
-	"github.com/go-gormigrate/gormigrate/v2"
-	"gorm.io/gorm"
-)
-
-var AddContainerImageCheckUpdates = &gormigrate.Migration{
-	ID: "20261028-container-image-updates",
-	Migrate: func(tx *gorm.DB) error {
-		if err := tx.AutoMigrate(&model.ContainerImageCheckUpdate{}); err != nil {
-			return err
-		}
-		return tx.Where("key = ?", "ContainerImageUpdateEnabled").FirstOrCreate(&model.Setting{Key: "ContainerImageUpdateEnabled", Value: "Disable"}).Error
-	},
-}

agent/router/ro_container.go

@@ -16,9 +16,6 @@ func (s *ContainerRouter) InitRouter(Router *gin.RouterGroup) {
 		baRouter.POST("", baseApi.ContainerCreate)
 		baRouter.POST("/update", baseApi.ContainerUpdate)
 		baRouter.POST("/upgrade", baseApi.ContainerUpgrade)
-		baRouter.GET("/image-updates", baseApi.GetContainerImageCheckUpdateStatus)
-		baRouter.POST("/image-updates/check", baseApi.ContainerImageCheckUpdate)
-		baRouter.POST("/image-updates/schedule", baseApi.SetContainerImageCheckUpdateSchedule)
 		baRouter.POST("/info", baseApi.ContainerInfo)
 		baRouter.POST("/search", baseApi.SearchContainer)
 		baRouter.POST("/list", baseApi.ListContainer)
@@ -67,7 +64,6 @@ func (s *ContainerRouter) InitRouter(Router *gin.RouterGroup) {
 		baRouter.POST("/template", baseApi.CreateComposeTemplate)
 		baRouter.POST("/template/del", baseApi.DeleteComposeTemplate)
 
-		baRouter.GET("/image/remote/check", baseApi.GetImageRemoteCheckStatus)
 		baRouter.GET("/image", baseApi.ListImage)
 		baRouter.GET("/image/all", baseApi.ListAllImage)
 		baRouter.POST("/image/search", baseApi.SearchImage)

agent/utils/dockerhub/client.go

@@ -1,323 +0,0 @@
-// Package dockerhub checks Docker Hub metadata without downloading image layers.
-package dockerhub
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net"
-	"net/http"
-	"net/url"
-	"regexp"
-	"sort"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/1Panel-dev/1Panel/agent/app/model"
-	"github.com/1Panel-dev/1Panel/agent/buserr"
-	"github.com/1Panel-dev/1Panel/agent/global"
-	"github.com/1Panel-dev/1Panel/agent/utils/encrypt"
-	"github.com/distribution/reference"
-)
-
-const registryURL = "https://registry-1.docker.io"
-
-// Reference only accepts tagged Docker Hub references. Digest pins are intentional.
-func Reference(raw string) (string, string, bool) {
-	if strings.HasPrefix(raw, "sha256:") {
-		return "", "", false
-	}
-	ref, err := reference.ParseNormalizedNamed(raw)
-	if err != nil || reference.Domain(ref) != "docker.io" {
-		return "", "", false
-	}
-	if _, pinned := ref.(reference.Digested); pinned {
-		return "", "", false
-	}
-	tagged := reference.TagNameOnly(ref).(reference.NamedTagged)
-	return reference.Path(ref), tagged.Tag(), true
-}
-
-type Client struct {
-	HTTP       *http.Client
-	repository string
-	token      string
-}
-
-type Platform struct{ OS, Architecture, Variant string }
-type Target struct{ Tag, Digest, ConfigDigest string }
-
-func New(ctx context.Context, repository, username, password string, httpClient *http.Client) (*Client, error) {
-	if httpClient == nil {
-		httpClient = &http.Client{Timeout: 30 * time.Second}
-	}
-	c := &Client{HTTP: httpClient, repository: repository}
-	endpoint := "https://auth.docker.io/token?service=registry.docker.io&scope=" + url.QueryEscape("repository:"+repository+":pull")
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
-	if err != nil {
-		return nil, err
-	}
-	if username != "" {
-		req.SetBasicAuth(username, password)
-	}
-	resp, err := c.HTTP.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("Docker Hub authentication: HTTP %d", resp.StatusCode)
-	}
-	var body struct {
-		Token       string `json:"token"`
-		AccessToken string `json:"access_token"`
-	}
-	if err := json.NewDecoder(io.LimitReader(resp.Body, 1<<20)).Decode(&body); err != nil {
-		return nil, err
-	}
-	c.token = body.Token
-	if c.token == "" {
-		c.token = body.AccessToken
-	}
-	if c.token == "" {
-		return nil, fmt.Errorf("Docker Hub returned an empty token")
-	}
-	return c, nil
-}
-
-func (c *Client) get(ctx context.Context, endpoint string, result interface{}) (http.Header, error) {
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
-	if err != nil {
-		return nil, err
-	}
-	req.Header.Set("Authorization", "Bearer "+c.token)
-	req.Header.Set("Accept", "application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json")
-	resp, err := c.HTTP.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("Docker Hub metadata: HTTP %d", resp.StatusCode)
-	}
-	err = json.NewDecoder(io.LimitReader(resp.Body, 16<<20)).Decode(result)
-	return resp.Header, err
-}
-
-func (c *Client) Tags(ctx context.Context) ([]string, error) {
-	endpoint := registryURL + "/v2/" + c.repository + "/tags/list?n=1000"
-	var tags []string
-	for page := 0; page < 100; page++ {
-		var body struct {
-			Tags []string `json:"tags"`
-		}
-		headers, err := c.get(ctx, endpoint, &body)
-		if err != nil {
-			return nil, err
-		}
-		tags = append(tags, body.Tags...)
-		link := headers.Get("Link")
-		if link == "" {
-			return tags, nil
-		}
-		start, end := strings.Index(link, "<"), strings.Index(link, ">")
-		if start < 0 || end <= start {
-			return nil, fmt.Errorf("invalid Docker Hub pagination")
-		}
-		base, _ := url.Parse(registryURL)
-		next, err := base.Parse(link[start+1 : end])
-		if err != nil || next.Scheme != "https" || next.Host != base.Host || next.Path != "/v2/"+c.repository+"/tags/list" {
-			return nil, fmt.Errorf("invalid Docker Hub pagination URL")
-		}
-		endpoint = next.String()
-	}
-	return nil, fmt.Errorf("Docker Hub tag pagination limit exceeded")
-}
-
-type manifest struct {
-	Config struct {
-		Digest string `json:"digest"`
-	} `json:"config"`
-	Manifests []struct {
-		Digest   string `json:"digest"`
-		Platform struct {
-			OS           string `json:"os"`
-			Architecture string `json:"architecture"`
-			Variant      string `json:"variant"`
-		} `json:"platform"`
-	} `json:"manifests"`
-}
-
-func (c *Client) Resolve(ctx context.Context, tag string, platform Platform) (Target, bool, error) {
-	var m manifest
-	headers, err := c.get(ctx, registryURL+"/v2/"+c.repository+"/manifests/"+url.PathEscape(tag), &m)
-	if err != nil {
-		return Target{}, false, err
-	}
-	digest := headers.Get("Docker-Content-Digest")
-	if len(m.Manifests) > 0 {
-		digest = ""
-		for _, item := range m.Manifests {
-			if item.Platform.OS == platform.OS && item.Platform.Architecture == platform.Architecture && normalizedVariant(platform.Architecture, item.Platform.Variant) == normalizedVariant(platform.Architecture, platform.Variant) {
-				digest = item.Digest
-				break
-			}
-		}
-		if digest == "" {
-			return Target{}, false, nil
-		}
-		m = manifest{}
-		if _, err := c.get(ctx, registryURL+"/v2/"+c.repository+"/manifests/"+url.PathEscape(digest), &m); err != nil {
-			return Target{}, false, err
-		}
-	}
-	if m.Config.Digest == "" {
-		return Target{}, false, fmt.Errorf("unsupported Docker Hub manifest")
-	}
-	// Validate single-platform manifests too; the config digest is the Docker Image ID.
-	var config struct {
-		OS           string `json:"os"`
-		Architecture string `json:"architecture"`
-		Variant      string `json:"variant"`
-	}
-	if _, err := c.get(ctx, registryURL+"/v2/"+c.repository+"/blobs/"+url.PathEscape(m.Config.Digest), &config); err != nil {
-		return Target{}, false, err
-	}
-	if config.OS != platform.OS || config.Architecture != platform.Architecture || (platform.Variant != "" && config.Variant != "" && config.Variant != platform.Variant) {
-		return Target{}, false, nil
-	}
-	return Target{Tag: tag, Digest: digest, ConfigDigest: m.Config.Digest}, true, nil
-}
-
-var versionPattern = regexp.MustCompile(`^v?(\d+)\.(\d+)(?:\.(\d+))?(-[a-zA-Z][a-zA-Z0-9_.-]*)?$`)
-var prereleasePattern = regexp.MustCompile(`(?i)(^|[-_.])(alpha|beta|rc|dev|nightly|edge|test|unstable|preview)([0-9_.-]|$)`)
-
-type version struct {
-	numbers [3]uint64
-	parts   int
-	variant string
-}
-
-func parseVersion(tag string) (version, bool) {
-	m := versionPattern.FindStringSubmatch(tag)
-	if m == nil || prereleasePattern.MatchString(m[4]) {
-		return version{}, false
-	}
-	v := version{parts: 2, variant: m[4]}
-	for i := 0; i < 3; i++ {
-		if m[i+1] != "" {
-			n, err := strconv.ParseUint(m[i+1], 10, 64)
-			if err != nil {
-				return version{}, false
-			}
-			v.numbers[i] = n
-		}
-	}
-	if m[3] != "" {
-		v.parts = 3
-	}
-	return v, true
-}
-func greater(a, b version) bool {
-	for i := 0; i < 3; i++ {
-		if a.numbers[i] != b.numbers[i] {
-			return a.numbers[i] > b.numbers[i]
-		}
-	}
-	return false
-}
-
-// Candidates preserves the current tag's major version, variant and precision. Unknown/floating
-// tags are checked only for content changes, never guessed from upload dates.
-func Candidates(current string, tags []string) []string {
-	baseline, ok := parseVersion(current)
-	if !ok {
-		return []string{current}
-	}
-	type candidate struct {
-		tag     string
-		version version
-	}
-	candidates := []candidate{}
-	seen := map[string]bool{}
-	for _, tag := range tags {
-		v, valid := parseVersion(tag)
-		if valid && v.numbers[0] == baseline.numbers[0] && v.parts == baseline.parts && v.variant == baseline.variant && greater(v, baseline) && !seen[tag] {
-			candidates = append(candidates, candidate{tag: tag, version: v})
-			seen[tag] = true
-		}
-	}
-	sort.Slice(candidates, func(i, j int) bool {
-		a, b := candidates[i], candidates[j]
-		if a.version.numbers == b.version.numbers {
-			return a.tag < b.tag
-		}
-		return greater(a.version, b.version)
-	})
-	result := make([]string, 0, len(candidates)+1)
-	for _, candidate := range candidates {
-		result = append(result, candidate.tag)
-	}
-
-	return append(result, current)
-}
-
-func NeedsTags(tag string) bool { _, ok := parseVersion(tag); return ok }
-
-func normalizedVariant(architecture, variant string) string {
-	if architecture == "arm64" && variant == "" {
-		return "v8"
-	}
-	return variant
-}
-
-// NewHTTPClient reads the synchronized panel settings for each check, including cron.
-func NewHTTPClient() (*http.Client, error) {
-	var rows []model.Setting
-	if err := global.DB.Where("key IN ?", []string{"Edition", "ProxyType", "ProxyUrl", "ProxyPort", "ProxyUser", "ProxyPasswd"}).Find(&rows).Error; err != nil {
-		return nil, err
-	}
-	settings := make(map[string]string, len(rows))
-	for _, row := range rows {
-		settings[row.Key] = row.Value
-	}
-	client := &http.Client{Timeout: 30 * time.Second}
-	if settings["Edition"] == "intl" {
-		return client, nil
-	}
-	kind, host, port := settings["ProxyType"], strings.TrimSpace(settings["ProxyUrl"]), settings["ProxyPort"]
-	if kind == "" || kind == "close" || host == "" || port == "" {
-		return nil, buserr.New("ErrImageCheckProxyRequired")
-	}
-	if kind != "http" && kind != "https" && kind != "socks5" {
-		return nil, buserr.New("ErrImageCheckProxyRequired")
-	}
-	number, err := strconv.Atoi(port)
-	if err != nil || number < 1 || number > 65535 {
-		return nil, buserr.New("ErrImageCheckProxyRequired")
-	}
-	if !strings.Contains(host, "://") {
-		host = kind + "://" + host
-	}
-	address, err := url.Parse(host)
-	if err != nil || address.Scheme != kind || address.Hostname() == "" || address.User != nil || address.RawQuery != "" || address.Fragment != "" || (address.Path != "" && address.Path != "/") {
-		return nil, buserr.New("ErrImageCheckProxyRequired")
-	}
-	address.Host = net.JoinHostPort(address.Hostname(), port)
-	address.Path = ""
-	if settings["ProxyUser"] != "" {
-		password, err := encrypt.StringDecrypt(settings["ProxyPasswd"])
-		if err != nil {
-			return nil, buserr.New("ErrImageCheckProxyRequired")
-		}
-		address.User = url.UserPassword(settings["ProxyUser"], password)
-	}
-	transport := http.DefaultTransport.(*http.Transport).Clone()
-	// Explicit proxy selection prevents NO_PROXY from bypassing the panel proxy.
-	// net/http also supports SOCKS5 URLs and proxy authentication.
-	transport.Proxy = http.ProxyURL(address)
-	client.Transport = transport
-	return client, nil
-}

core/app/api/v2/api_key.go

@@ -15,7 +15,7 @@ import (
 )
 
 func bindAPIKeyRequest(c *gin.Context, value interface{}) bool {
-	if _, err := auth.RequireAPIKeySession(c); err != nil {
+	if _, err := auth.RequireAPIKeyManagement(c); err != nil {
 		helper.BadAuth(c, "ErrNotLogin", nil)
 		return false
 	}
@@ -41,6 +41,24 @@ func apiKeyError(c *gin.Context, err error) {
 	helper.InternalServer(c, err)
 }
 
+// Swag's legacy || syntax combines schemes in one requirement (AND);
+// separate @Security lines represent alternative authentication methods.
+// @Tags API Key
+// @Summary List the current account's API keys
+// @Description Accepts a panel login session with CSRF protection, or a valid API Key signature. The authenticated account determines ownership; another account cannot be selected in the request.
+// @Description Returns key metadata and masked hints, never plaintext secrets. The legacy key is included when present; deleted keys are excluded.
+// @Description Authentication and business errors use HTTP 200 with envelope code 400, 401 or 500; check code rather than HTTP status alone.
+// @Accept json
+// @Produce json
+// @Param request body dto.APIKeySearch true "Pagination and revoked-key filter"
+// @Param 1Panel-Key-ID header string false "Optional ID of the authenticating independent key; omit for legacy keys"
+// @Param 1Panel-Signature-Version header string false "Signature algorithm; omission accepts either supported algorithm" Enums(v1,md5,hmac-sha256)
+// @Success 200 {object} dto.Response{data=dto.APIKeyPage} "code=200 on success; data is null on errors"
+// @Failure 403 {object} dto.Response "Invalid or missing CSRF token for a session request"
+// @Header 200 {string} Cache-Control "no-store"
+// @Security ApiKeyAuth || Timestamp
+// @Security PanelSession || CSRFToken
+// @Router /core/auth/api/keys/search [post]
 func (b *BaseApi) SearchAPIKeys(c *gin.Context) {
 	var req dto.APIKeySearch
 	if !bindAPIKeyRequest(c, &req) {
@@ -55,6 +73,25 @@ func (b *BaseApi) SearchAPIKeys(c *gin.Context) {
 	helper.SuccessWithData(c, result)
 }
 
+// @Tags API Key
+// @Summary Create an API key for the current account
+// @Description Accepts a panel login session with CSRF protection, or a valid API Key signature. The new key belongs to the authenticated account.
+// @Description requestID is optional. Omitted or empty values are generated by the server. For idempotent retries, supply a UUID and reuse it with the same payload.
+// @Description A successful first request returns the plaintext secret. Repeating the same requestID and payload returns alreadyCreated=true and an empty apiKey; changing the payload for that requestID is rejected.
+// @Description Omitted expiresAt defaults to 90 days; explicit null means no expiration. Omitted apiKeyValidityTime defaults to 120 minutes; zero disables timestamp validation.
+// @Description API-created keys may have a longer lifetime or broader IP policy than the calling key. Revoking the calling key does not revoke keys it created.
+// @Description Authentication and business errors use HTTP 200 with envelope code 400, 401 or 500; check code rather than HTTP status alone. Unknown fields and bodies larger than 32 KiB are rejected.
+// @Accept json
+// @Produce json
+// @Param request body dto.APIKeyCreate true "Key policy and an optional UUID requestID for idempotency"
+// @Param 1Panel-Key-ID header string false "Optional ID of the authenticating independent key; omit for legacy keys"
+// @Param 1Panel-Signature-Version header string false "Signature algorithm; omission accepts either supported algorithm" Enums(v1,md5,hmac-sha256)
+// @Success 200 {object} dto.Response{data=dto.APIKeyCreated} "code=200 on success; data is null on errors"
+// @Failure 403 {object} dto.Response "Invalid or missing CSRF token for a session request"
+// @Header 200 {string} Cache-Control "no-store"
+// @Security ApiKeyAuth || Timestamp
+// @Security PanelSession || CSRFToken
+// @Router /core/auth/api/keys/create [post]
 func (b *BaseApi) CreateAPIKey(c *gin.Context) {
 	req := dto.APIKeyCreate{APIKeyFields: dto.APIKeyFields{APIKeyValidityTime: 120}}
 	if !bindAPIKeyRequest(c, &req) {
@@ -69,6 +106,22 @@ func (b *BaseApi) CreateAPIKey(c *gin.Context) {
 	helper.SuccessWithData(c, result)
 }
 
+// @Tags API Key
+// @Summary Update an API key's policy
+// @Description Accepts a panel login session with CSRF protection, or a valid API Key signature. Only keys owned by the authenticated account can be changed.
+// @Description Submit the current revision returned by search; stale revisions are rejected. This replaces editable policy fields without changing the secret. expiresAt must be supplied as an RFC 3339 timestamp or null.
+// @Description Use id=legacy for the legacy key; its name is fixed and expiresAt must be null. Revoked or deleted independent keys cannot be updated.
+// @Description Success increments the revision; search again before another mutation. Authentication and business errors use HTTP 200 with envelope code 400, 401 or 500.
+// @Accept json
+// @Produce json
+// @Param request body dto.APIKeyUpdate true "Key ID, current revision and complete editable policy"
+// @Param 1Panel-Key-ID header string false "Optional ID of the authenticating independent key; omit for legacy keys"
+// @Param 1Panel-Signature-Version header string false "Signature algorithm; omission accepts either supported algorithm" Enums(v1,md5,hmac-sha256)
+// @Success 200 {object} dto.Response{data=dto.APIKeyMutationResult} "code=200 on success; data is null on errors"
+// @Failure 403 {object} dto.Response "Invalid or missing CSRF token for a session request"
+// @Security ApiKeyAuth || Timestamp
+// @Security PanelSession || CSRFToken
+// @Router /core/auth/api/keys/update [post]
 func (b *BaseApi) UpdateAPIKey(c *gin.Context) {
 	var req dto.APIKeyUpdate
 	if !bindAPIKeyRequest(c, &req) {
@@ -81,6 +134,21 @@ func (b *BaseApi) UpdateAPIKey(c *gin.Context) {
 	apiKeyMutationSuccess(c)
 }
 
+// @Tags API Key
+// @Summary Enable or disable an API key
+// @Description Accepts a panel login session with CSRF protection, or a valid API Key signature. Only keys owned by the authenticated account can be changed; id=legacy is supported.
+// @Description Submit the current revision returned by search. Revoked or deleted keys cannot be enabled; expired keys must first receive a future expiration time. Disabling a key also closes its active terminal sessions.
+// @Description Success increments the revision; search again before another mutation. Authentication and business errors use HTTP 200 with envelope code 400, 401 or 500.
+// @Accept json
+// @Produce json
+// @Param request body dto.APIKeyStatus true "Key ID, current revision and Enable or Disable status"
+// @Param 1Panel-Key-ID header string false "Optional ID of the authenticating independent key; omit for legacy keys"
+// @Param 1Panel-Signature-Version header string false "Signature algorithm; omission accepts either supported algorithm" Enums(v1,md5,hmac-sha256)
+// @Success 200 {object} dto.Response{data=dto.APIKeyMutationResult} "code=200 on success; data is null on errors"
+// @Failure 403 {object} dto.Response "Invalid or missing CSRF token for a session request"
+// @Security ApiKeyAuth || Timestamp
+// @Security PanelSession || CSRFToken
+// @Router /core/auth/api/keys/status [post]
 func (b *BaseApi) SetAPIKeyStatus(c *gin.Context) {
 	var req dto.APIKeyStatus
 	if !bindAPIKeyRequest(c, &req) {
@@ -93,6 +161,22 @@ func (b *BaseApi) SetAPIKeyStatus(c *gin.Context) {
 	apiKeyMutationSuccess(c)
 }
 
+// @Tags API Key
+// @Summary Revoke an API key
+// @Description Accepts a panel login session with CSRF protection, or a valid API Key signature. Only keys owned by the authenticated account can be revoked.
+// @Description Submit the current revision returned by search. Revocation destroys the independent key's stored secret and cannot be undone; its metadata remains listed. For id=legacy, the legacy secret is cleared and API access is disabled.
+// @Description A key can revoke itself; subsequent requests signed with it fail. Keys previously created by the revoked key remain independent. Success increments the revision and closes associated terminal sessions.
+// @Description Authentication and business errors use HTTP 200 with envelope code 400, 401 or 500.
+// @Accept json
+// @Produce json
+// @Param request body dto.APIKeyMutation true "Key ID and current revision"
+// @Param 1Panel-Key-ID header string false "Optional ID of the authenticating independent key; omit for legacy keys"
+// @Param 1Panel-Signature-Version header string false "Signature algorithm; omission accepts either supported algorithm" Enums(v1,md5,hmac-sha256)
+// @Success 200 {object} dto.Response{data=dto.APIKeyMutationResult} "code=200 on success; data is null on errors"
+// @Failure 403 {object} dto.Response "Invalid or missing CSRF token for a session request"
+// @Security ApiKeyAuth || Timestamp
+// @Security PanelSession || CSRFToken
+// @Router /core/auth/api/keys/revoke [post]
 func (b *BaseApi) RevokeAPIKey(c *gin.Context) {
 	var req dto.APIKeyMutation
 	if !bindAPIKeyRequest(c, &req) {
@@ -106,5 +190,63 @@ func (b *BaseApi) RevokeAPIKey(c *gin.Context) {
 }
 
 func apiKeyMutationSuccess(c *gin.Context) {
-	helper.SuccessWithData(c, gin.H{"terminalClosePending": c.GetBool("API_KEY_TERMINAL_CLOSE_PENDING")})
+	helper.SuccessWithData(c, dto.APIKeyMutationResult{TerminalClosePending: c.GetBool("API_KEY_TERMINAL_CLOSE_PENDING")})
+}
+
+// @Tags API Key
+// @Summary Delete an independent API key
+// @Description Accepts a panel login session with CSRF protection, or a valid API Key signature. Only keys owned by the authenticated account can be deleted; id=legacy is not supported.
+// @Description Submit the current revision returned by search. Deletion immediately revokes the key, destroys its stored secret and removes it from lists. Audit and idempotency records are retained. Already-revoked keys can be deleted; deletion cannot be undone.
+// @Description A key can delete itself; subsequent requests signed with it fail. Authentication and business errors use HTTP 200 with envelope code 400, 401 or 500.
+// @Accept json
+// @Produce json
+// @Param request body dto.APIKeyMutation true "Independent key ID and current revision"
+// @Param 1Panel-Key-ID header string false "Optional ID of the authenticating independent key; omit for legacy keys"
+// @Param 1Panel-Signature-Version header string false "Signature algorithm; omission accepts either supported algorithm" Enums(v1,md5,hmac-sha256)
+// @Success 200 {object} dto.Response{data=dto.APIKeyMutationResult} "code=200 on success; data is null on errors"
+// @Failure 403 {object} dto.Response "Invalid or missing CSRF token for a session request"
+// @Security ApiKeyAuth || Timestamp
+// @Security PanelSession || CSRFToken
+// @Router /core/auth/api/keys/delete [post]
+func (b *BaseApi) DeleteAPIKey(c *gin.Context) {
+	var req dto.APIKeyMutation
+	if !bindAPIKeyRequest(c, &req) {
+		return
+	}
+	if err := service.NewAPIKeyService().Delete(c, req); err != nil {
+		apiKeyError(c, err)
+		return
+	}
+	apiKeyMutationSuccess(c)
+}
+
+// @Tags API Key
+// @Summary Reveal an independent API key's plaintext secret
+// @Description Requires a panel login session and CSRF token. API Key authentication is not supported, including requests that also contain a valid session cookie; omit all 1Panel authentication headers.
+// @Description Only the current account's independent keys can be revealed. Submit the current revision returned by search. Legacy, revoked and deleted keys are rejected; disabled or expired keys can still be revealed.
+// @Description Secret disclosure is audited. Authentication and business errors use HTTP 200 with envelope code 400, 401 or 500. The response must not be cached or logged.
+// @Accept json
+// @Produce json
+// @Param request body dto.APIKeyMutation true "Independent key ID and current revision"
+// @Success 200 {object} dto.Response{data=dto.APIKeyRevealed} "code=200 on success; data is null on errors"
+// @Failure 403 {object} dto.Response "Invalid or missing CSRF token"
+// @Header 200 {string} Cache-Control "no-store"
+// @Security PanelSession || CSRFToken
+// @Router /core/auth/api/keys/reveal [post]
+func (b *BaseApi) RevealAPIKey(c *gin.Context) {
+	c.Header("Cache-Control", "no-store")
+	if _, err := auth.RequireAPIKeySession(c); err != nil {
+		helper.BadAuth(c, "ErrNotLogin", nil)
+		return
+	}
+	var req dto.APIKeyMutation
+	if !bindAPIKeyRequest(c, &req) {
+		return
+	}
+	result, err := service.NewAPIKeyService().Reveal(c, req)
+	if err != nil {
+		apiKeyError(c, err)
+		return
+	}
+	helper.SuccessWithData(c, result)
 }

core/app/api/v2/auth.go

@@ -417,11 +417,13 @@ func (b *BaseApi) MFAClose(c *gin.Context) {
 }
 
 // @Tags Auth
-// @Summary generate api key
+// @Summary Generate or reset the legacy API key
+// @Description Requires a panel login session and CSRF token. API Key authentication is not supported. This replaces the current account's legacy secret; existing clients using the previous secret must be updated. Independent API keys are unaffected.
 // @Accept json
-// @Success 200 {string} key
-// @Security ApiKeyAuth
-// @Security Timestamp
+// @Produce json
+// @Success 200 {object} dto.Response{data=string} "code=200 with the new secret; authentication and business errors use envelope code 400, 401 or 500"
+// @Header 200 {string} Cache-Control "no-store"
+// @Security PanelSession || CSRFToken
 // @Router /core/auth/api/generate [post]
 // @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"生成 API 接口密钥","formatEN":"generate api key"}
 func (b *BaseApi) GenerateApiKey(c *gin.Context) {
@@ -440,12 +442,13 @@ func (b *BaseApi) GenerateApiKey(c *gin.Context) {
 }
 
 // @Tags Auth
-// @Summary Update api config
+// @Summary Update the legacy API key configuration
+// @Description Requires a panel login session and CSRF token. API Key authentication is not supported. This updates only the current account's legacy API configuration.
 // @Accept json
+// @Produce json
 // @Param request body dto.ApiInterfaceConfig true "request"
-// @Success 200
-// @Security ApiKeyAuth
-// @Security Timestamp
+// @Success 200 {object} dto.Response "code=200 on success; authentication and business errors use envelope code 400, 401 or 500"
+// @Security PanelSession || CSRFToken
 // @Router /core/auth/api/update [post]
 // @x-panel-log {"bodyKeys":["ipWhiteList","apiTrustedProxies"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新 API 接口配置 => IP 白名单: [ipWhiteList], API 可信代理: [apiTrustedProxies]","formatEN":"update api config => IP Allowlist: [ipWhiteList], API Trusted Proxies: [apiTrustedProxies]"}
 func (b *BaseApi) UpdateApiConfig(c *gin.Context) {

core/app/auth/api_auth.go

@@ -7,6 +7,7 @@ import (
 	"encoding/hex"
 	"errors"
 	"net"
+	"net/http"
 	"strconv"
 	"strings"
 	"time"
@@ -42,7 +43,7 @@ func APIAuthMiddleware(loadConfig APIAuthConfigLoader, onSuccess APIAuthSuccessH
 		ownerProvider = ownerProviders[0]
 	}
 	return func(c *gin.Context) {
-		if strings.HasPrefix(c.Request.URL.Path, "/api/v2/core/auth") {
+		if strings.HasPrefix(c.Request.URL.Path, "/api/v2/core/auth") && !isAPIKeyManagementRequest(c) {
 			c.Next()
 			return
 		}
@@ -97,6 +98,20 @@ func APIAuthMiddleware(loadConfig APIAuthConfigLoader, onSuccess APIAuthSuccessH
 	}
 }
 
+func isAPIKeyManagementRequest(c *gin.Context) bool {
+	if c.Request.Method != http.MethodPost {
+		return false
+	}
+	switch c.Request.URL.Path {
+	case "/api/v2/core/auth/api/keys/search", "/api/v2/core/auth/api/keys/create",
+		"/api/v2/core/auth/api/keys/update", "/api/v2/core/auth/api/keys/status",
+		"/api/v2/core/auth/api/keys/revoke", "/api/v2/core/auth/api/keys/delete":
+		return true
+	default:
+		return false
+	}
+}
+
 func LoadAPIAuthConfig(_ *gin.Context) (APIAuthConfig, error) {
 	settingRepo := repo.NewISettingRepo()
 	config := APIAuthConfig{}

core/app/auth/api_key.go

@@ -66,6 +66,26 @@ func RequireAPIKeySession(c *gin.Context) (psession.SessionUser, error) {
 	return u, nil
 }
 
+func RequireAPIKeyManagement(c *gin.Context) (psession.SessionUser, error) {
+	if c == nil || !c.GetBool("API_AUTH") {
+		return RequireAPIKeySession(c)
+	}
+	if c.GetBool("LOCAL_REQUEST") {
+		return psession.SessionUser{}, buserr.New("ErrNotLogin")
+	}
+	kind, keyID := c.GetString("API_AUTH_KEY_KIND"), c.GetString("API_AUTH_KEY_ID")
+	if (kind != "apiKey" && kind != "legacy") || keyID == "" || (kind == "legacy") != (keyID == "legacy") {
+		return psession.SessionUser{}, buserr.New("ErrNotLogin")
+	}
+	ownerType, ownerID := c.GetString("API_AUTH_OWNER_TYPE"), c.GetString("API_AUTH_OWNER_ID")
+	value, _ := c.Get(psession.GinContextSessionUserKey)
+	u, ok := value.(psession.SessionUser)
+	if (ownerType != APIKeyOwnerPanelAdmin && ownerType != APIKeyOwnerEnterpriseUser) || ownerID == "" || !ok || u.ID != ownerID || u.Name == "" {
+		return psession.SessionUser{}, buserr.New("ErrNotLogin")
+	}
+	return u, nil
+}
+
 func HasAPICredentials(c *gin.Context) bool {
 	return c.GetHeader("1Panel-Token") != "" || c.GetHeader("1Panel-Timestamp") != "" || c.GetHeader("1Panel-Key-ID") != "" || c.GetHeader("1Panel-Signature-Version") != ""
 }
@@ -87,7 +107,7 @@ func LegacyAPIKeyFingerprint(owner APIKeyOwner, config APIAuthConfig, policy mod
 }
 
 func APIKeySecret(key model.APIKey) (string, error) {
-	if key.SecretVersion != 1 || key.SecretCiphertext == "" {
+	if key.DeletedAt != nil || key.Status == "Revoked" || key.SecretVersion != 1 || key.SecretCiphertext == "" {
 		return "", buserr.New("ErrApiConfigKeyInvalid")
 	}
 	master, err := encrypt.APIKeyEncryptionKey()
@@ -98,7 +118,7 @@ func APIKeySecret(key model.APIKey) (string, error) {
 }
 
 func ValidateAPIKeyState(key model.APIKey, now time.Time) error {
-	if key.Status != constant.StatusEnable {
+	if key.DeletedAt != nil || key.Status != constant.StatusEnable {
 		return buserr.New("ErrApiConfigStatusInvalid")
 	}
 	if key.ExpiresAt != nil && !now.Before(*key.ExpiresAt) {
@@ -113,7 +133,7 @@ func configForAPIKey(key model.APIKey, secret string, owner APIKeyOwner) APIAuth
 
 func loadMultiAPIKeyConfig(c *gin.Context, legacy APIAuthConfigLoader, provider APIKeyOwnerProvider) (APIAuthConfig, error) {
 	keyID := c.GetHeader("1Panel-Key-ID")
-	q := global.DB.Model(&model.APIKey{}).Select("id", "secret_ciphertext", "secret_version", "revision")
+	q := global.DB.Model(&model.APIKey{}).Where("deleted_at IS NULL").Select("id", "secret_ciphertext", "secret_version", "revision")
 	if keyID != "" {
 		q = q.Where("id = ?", keyID)
 	} else {

core/app/dto/api_key.go

@@ -6,41 +6,42 @@ import (
 )
 
 type APIKeyItem struct {
-	ID                 string     `json:"id"`
-	Kind               string     `json:"kind"`
-	Name               string     `json:"name"`
-	Description        string     `json:"description"`
-	KeyHint            string     `json:"keyHint"`
-	Status             string     `json:"status"`
-	IPWhiteList        string     `json:"ipWhiteList"`
-	APITrustedProxies  string     `json:"apiTrustedProxies"`
-	APIKeyValidityTime int        `json:"apiKeyValidityTime"`
-	ExpiresAt          *time.Time `json:"expiresAt"`
-	AllowAppBinding    bool       `json:"allowAppBinding"`
-	Revision           uint64     `json:"revision"`
-	CreatedAt          *time.Time `json:"createdAt"`
+	ID                 string     `json:"id" example:"8a8f0f77-1ec8-4d46-8f5a-0ea8807e2d8a"`
+	Kind               string     `json:"kind" enums:"apiKey,legacy" example:"apiKey"`
+	Name               string     `json:"name" example:"Deployment automation"`
+	Description        string     `json:"description" example:"Used by the deployment service"`
+	KeyHint            string     `json:"keyHint" example:"abcd••••1234"`
+	Status             string     `json:"status" enums:"Enable,Disable,Revoked,Expired" example:"Enable"`
+	IPWhiteList        string     `json:"ipWhiteList" example:"192.0.2.10"`
+	APITrustedProxies  string     `json:"apiTrustedProxies" example:"192.0.2.1"`
+	APIKeyValidityTime int        `json:"apiKeyValidityTime" example:"120"`
+	ExpiresAt          *time.Time `json:"expiresAt" format:"date-time" extensions:"x-nullable"`
+	AllowAppBinding    bool       `json:"allowAppBinding" example:"false"`
+	Revision           uint64     `json:"revision" minimum:"1" example:"1"`
+	CreatedAt          *time.Time `json:"createdAt" format:"date-time" extensions:"x-nullable"`
 }
 
 type APIKeySearch struct {
-	Page           int  `json:"page"`
-	PageSize       int  `json:"pageSize"`
-	ExcludeRevoked bool `json:"excludeRevoked"`
+	Page           int  `json:"page" minimum:"1" example:"1"`
+	PageSize       int  `json:"pageSize" minimum:"1" maximum:"100" example:"20"`
+	ExcludeRevoked bool `json:"excludeRevoked" default:"false"`
 }
 type APIKeyPage struct {
 	Items []APIKeyItem `json:"items"`
 	Total int          `json:"total"`
 }
 type APIKeyFields struct {
-	Name               string          `json:"name"`
-	Description        string          `json:"description"`
-	IPWhiteList        string          `json:"ipWhiteList"`
-	APITrustedProxies  string          `json:"apiTrustedProxies"`
-	APIKeyValidityTime int             `json:"apiKeyValidityTime"`
-	ExpiresAt          json.RawMessage `json:"expiresAt"`
-	AllowAppBinding    bool            `json:"allowAppBinding"`
+	Name               string          `json:"name" minLength:"1" maxLength:"64" example:"Deployment automation"`
+	Description        string          `json:"description" maxLength:"256" example:"Used by the deployment service"`
+	IPWhiteList        string          `json:"ipWhiteList" maxLength:"4096" example:"192.0.2.10"`
+	APITrustedProxies  string          `json:"apiTrustedProxies" maxLength:"4096" example:"192.0.2.1"`
+	APIKeyValidityTime int             `json:"apiKeyValidityTime" minimum:"0" maximum:"1440" example:"120"`
+	ExpiresAt          json.RawMessage `json:"expiresAt" swaggertype:"string" format:"date-time" extensions:"x-nullable" example:"2030-01-01T00:00:00Z"`
+	AllowAppBinding    bool            `json:"allowAppBinding" default:"false"`
 }
 type APIKeyCreate struct {
-	RequestID string `json:"requestID"`
+	// Optional client-generated UUID for idempotent retries. Omitted or empty values are generated by the server.
+	RequestID string `json:"requestID" format:"uuid" example:"df1a75a3-5f56-4fa3-9e7a-a573a853d894"`
 	APIKeyFields
 }
 type APIKeyCreated struct {
@@ -49,8 +50,15 @@ type APIKeyCreated struct {
 	AlreadyCreated bool       `json:"alreadyCreated,omitempty"`
 }
 type APIKeyMutation struct {
-	ID       string `json:"id"`
-	Revision uint64 `json:"revision"`
+	ID       string `json:"id" example:"8a8f0f77-1ec8-4d46-8f5a-0ea8807e2d8a"`
+	Revision uint64 `json:"revision" minimum:"1" example:"1"`
+}
+type APIKeyMutationResult struct {
+	TerminalClosePending bool `json:"terminalClosePending"`
+}
+type APIKeyRevealed struct {
+	APIKeyMutation
+	APIKey string `json:"apiKey"`
 }
 type APIKeyUpdate struct {
 	APIKeyMutation
@@ -58,5 +66,5 @@ type APIKeyUpdate struct {
 }
 type APIKeyStatus struct {
 	APIKeyMutation
-	Status string `json:"status"`
+	Status string `json:"status" enums:"Enable,Disable" example:"Disable"`
 }

core/app/model/api_key.go

@@ -24,6 +24,7 @@ type APIKey struct {
 	CreatedAt          time.Time  `json:"-"`
 	UpdatedAt          time.Time  `json:"-"`
 	RevokedAt          *time.Time `json:"-"`
+	DeletedAt          *time.Time `json:"-"`
 }
 
 type LegacyAPIKeyPolicy struct {

core/app/repo/api_key.go

@@ -14,12 +14,12 @@ func APIKeyOwnerQuery(db *gorm.DB, ownerType, ownerID string) *gorm.DB {
 }
 func (r *APIKeyRepo) Get(id string) (model.APIKey, error) {
 	var key model.APIKey
-	err := global.DB.Where("id = ?", id).First(&key).Error
+	err := global.DB.Where("id = ? AND deleted_at IS NULL", id).First(&key).Error
 	return key, err
 }
 func (r *APIKeyRepo) List(ownerType, ownerID string, excludeRevoked bool) ([]model.APIKey, error) {
 	items := make([]model.APIKey, 0)
-	q := APIKeyOwnerQuery(global.DB, ownerType, ownerID)
+	q := APIKeyOwnerQuery(global.DB, ownerType, ownerID).Where("deleted_at IS NULL")
 	if excludeRevoked {
 		q = q.Where("status <> ?", "Revoked")
 	}

core/app/service/api_key.go

@@ -52,6 +52,27 @@ func (s *APIKeyService) owner(c *gin.Context) (auth.APIKeyOwner, error) {
 	return s.Provider.CurrentAPIKeyOwner(c)
 }
 
+func (s *APIKeyService) managementOwner(c *gin.Context) (auth.APIKeyOwner, error) {
+	if _, err := auth.RequireAPIKeyManagement(c); err != nil {
+		return auth.APIKeyOwner{}, err
+	}
+	if s.Provider == nil {
+		return auth.APIKeyOwner{}, buserr.New("ErrApiConfigStatusInvalid")
+	}
+	if !c.GetBool("API_AUTH") {
+		return s.Provider.CurrentAPIKeyOwner(c)
+	}
+	ownerType, ownerID := c.GetString("API_AUTH_OWNER_TYPE"), c.GetString("API_AUTH_OWNER_ID")
+	owner, err := s.Provider.ResolveAPIKeyOwner(c, ownerType, ownerID)
+	if err != nil {
+		return auth.APIKeyOwner{}, err
+	}
+	if owner.Type != ownerType || owner.ID != ownerID {
+		return auth.APIKeyOwner{}, buserr.New("ErrNotLogin")
+	}
+	return owner, nil
+}
+
 func apiKeyItem(key model.APIKey) dto.APIKeyItem {
 	status := key.Status
 	if status != "Revoked" && key.ExpiresAt != nil && !time.Now().Before(*key.ExpiresAt) {
@@ -75,7 +96,7 @@ func (s *APIKeyService) legacy(owner auth.APIKeyOwner) (dto.APIKeyItem, auth.API
 }
 
 func (s *APIKeyService) Search(c *gin.Context, req dto.APIKeySearch) (*dto.APIKeyPage, error) {
-	owner, err := s.owner(c)
+	owner, err := s.managementOwner(c)
 	if err != nil {
 		return nil, err
 	}
@@ -146,11 +167,13 @@ func keyHint(secret string) string {
 }
 
 func (s *APIKeyService) Create(c *gin.Context, req dto.APIKeyCreate) (*dto.APIKeyCreated, error) {
-	owner, err := s.owner(c)
+	owner, err := s.managementOwner(c)
 	if err != nil {
 		return nil, err
 	}
-	if _, err = uuid.Parse(req.RequestID); err != nil {
+	if req.RequestID == "" {
+		req.RequestID = uuid.NewString()
+	} else if _, err = uuid.Parse(req.RequestID); err != nil {
 		return nil, buserr.New("ErrInvalidParams")
 	}
 	expires, err := validateAPIKeyFields(&req.APIKeyFields, true)
@@ -172,6 +195,9 @@ func (s *APIKeyService) Create(c *gin.Context, req dto.APIKeyCreate) (*dto.APIKe
 		q := repo.APIKeyOwnerQuery(tx, owner.Type, owner.ID)
 		err := q.Where("request_id = ?", req.RequestID).First(&key).Error
 		if err == nil {
+			if key.DeletedAt != nil {
+				return buserr.New("ErrAPIKeyNotFound")
+			}
 			if key.RequestHash != requestHash {
 				return buserr.New("ErrAPIKeyConflict")
 			}
@@ -219,7 +245,7 @@ func ensureAPIKeyName(tx *gorm.DB, owner auth.APIKeyOwner, name, id string) erro
 }
 
 func (s *APIKeyService) Update(c *gin.Context, req dto.APIKeyUpdate) error {
-	owner, err := s.owner(c)
+	owner, err := s.managementOwner(c)
 	if err != nil {
 		return err
 	}
@@ -247,7 +273,7 @@ func (s *APIKeyService) Update(c *gin.Context, req dto.APIKeyUpdate) error {
 }
 
 func (s *APIKeyService) Status(c *gin.Context, req dto.APIKeyStatus) error {
-	owner, err := s.owner(c)
+	owner, err := s.managementOwner(c)
 	if err != nil {
 		return err
 	}
@@ -271,7 +297,7 @@ func (s *APIKeyService) Status(c *gin.Context, req dto.APIKeyStatus) error {
 }
 
 func (s *APIKeyService) Revoke(c *gin.Context, req dto.APIKeyMutation) error {
-	owner, err := s.owner(c)
+	owner, err := s.managementOwner(c)
 	if err != nil {
 		return err
 	}
@@ -289,21 +315,75 @@ func (s *APIKeyService) Revoke(c *gin.Context, req dto.APIKeyMutation) error {
 	})
 }
 
+func (s *APIKeyService) Delete(c *gin.Context, req dto.APIKeyMutation) error {
+	owner, err := s.managementOwner(c)
+	if err != nil {
+		return err
+	}
+	if req.ID == "legacy" {
+		return buserr.New("ErrInvalidParams")
+	}
+	return s.mutate(c, owner, req, "delete", func(_ *gorm.DB, key *model.APIKey) error {
+		now := time.Now()
+		key.Status = "Revoked"
+		if key.RevokedAt == nil {
+			key.RevokedAt = &now
+		}
+		key.DeletedAt = &now
+		key.ActiveName = nil
+		key.SecretCiphertext = ""
+		key.KeyHint = ""
+		key.AllowAppBinding = false
+		return nil
+	})
+}
+
+func (s *APIKeyService) Reveal(c *gin.Context, req dto.APIKeyMutation) (*dto.APIKeyRevealed, error) {
+	owner, err := s.owner(c)
+	if err != nil {
+		return nil, err
+	}
+	if req.ID == "" || req.ID == "legacy" || req.Revision == 0 {
+		return nil, buserr.New("ErrInvalidParams")
+	}
+	// Serialize the snapshot and disclosure audit with revocation/deletion.
+	apiKeyMutationMu.Lock()
+	defer apiKeyMutationMu.Unlock()
+	var key model.APIKey
+	if err = repo.APIKeyOwnerQuery(global.DB, owner.Type, owner.ID).Where("id = ? AND deleted_at IS NULL", req.ID).First(&key).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, buserr.New("ErrAPIKeyNotFound")
+		}
+		return nil, err
+	}
+	if key.Revision != req.Revision || key.Status == "Revoked" {
+		return nil, buserr.New("ErrAPIKeyConflict")
+	}
+	secret, err := auth.APIKeySecret(key)
+	if err != nil {
+		return nil, buserr.New("ErrApiConfigKeyInvalid")
+	}
+	if err = apikey_audit.Record(c, apikey_audit.Event{OwnerType: owner.Type, OwnerID: owner.ID, KeyID: key.ID, KeyName: key.Name, Action: "reveal", Status: constant.StatusSuccess}); err != nil {
+		return nil, err
+	}
+	return &dto.APIKeyRevealed{APIKeyMutation: req, APIKey: secret}, nil
+}
+
 func (s *APIKeyService) mutate(c *gin.Context, owner auth.APIKeyOwner, req dto.APIKeyMutation, action string, change func(*gorm.DB, *model.APIKey) error) error {
 	if req.ID == "" || req.Revision == 0 {
 		return buserr.New("ErrInvalidParams")
 	}
 	apiKeyMutationMu.Lock()
 	var key model.APIKey
-	closeTerminals := action == "disable" || action == "revoke"
+	closeTerminals := action == "disable" || action == "revoke" || action == "delete"
 	err := global.DB.Transaction(func(tx *gorm.DB) error {
-		if err := repo.APIKeyOwnerQuery(tx, owner.Type, owner.ID).Where("id = ?", req.ID).First(&key).Error; err != nil {
+		if err := repo.APIKeyOwnerQuery(tx, owner.Type, owner.ID).Where("id = ? AND deleted_at IS NULL", req.ID).First(&key).Error; err != nil {
 			if errors.Is(err, gorm.ErrRecordNotFound) {
 				return buserr.New("ErrAPIKeyNotFound")
 			}
 			return err
 		}
-		if key.Revision != req.Revision || key.Status == "Revoked" {
+		if key.Revision != req.Revision || (key.Status == "Revoked" && action != "delete") {
 			return buserr.New("ErrAPIKeyConflict")
 		}
 		before := key

core/cmd/server/main.go

@@ -18,7 +18,10 @@ import (
 // @schemes http https
 
 // @securityDefinitions.apikey ApiKeyAuth
-// @description Custom Token Format, Format: md5('1panel' + API-Key + UnixTimestamp).
+// @description Signed API Key authentication. Send the signature, never the plaintext API Key, in 1Panel-Token.
+// @description Supported formats: hex(HMAC-SHA256(API-Key, '1panel:' + UnixTimestamp)) or md5('1panel' + API-Key + UnixTimestamp).
+// @description Send the matching Unix timestamp in 1Panel-Timestamp. Optionally set 1Panel-Signature-Version to hmac-sha256, v1 or md5; omission accepts either algorithm.
+// @description Independent keys may include their ID in 1Panel-Key-ID to select the credential; omit that header for a legacy key.
 // @description ```
 // @description eg:
 // @description curl -X GET "http://{host}:{port}/api/v2/toolbox/device/base" \
@@ -27,7 +30,7 @@ import (
 // @description ```
 // @description - `1Panel-Token` is the key for the panel API Key.
 // @type apiKey
-// @in Header
+// @in header
 // @name 1Panel-Token
 // @securityDefinitions.apikey Timestamp
 // @type apiKey

core/init/migration/migrate.go

@@ -72,5 +72,6 @@ func coreMigrations() []*gormigrate.Migration {
 		migrations.UpdateAiMenuOrder,
 		migrations.UpdateAiMenuOrderV2,
 		migrations.AddPanelMCP,
+		migrations.AddAPIKeyDeletedAt,
 	}
 }

core/init/migration/migrations/api_key.go

@@ -15,3 +15,8 @@ var AddOperationLogAPIKey = &gormigrate.Migration{
 	ID:      "20260915-add-operation-log-api-key",
 	Migrate: func(tx *gorm.DB) error { return tx.AutoMigrate(&model.OperationLog{}) },
 }
+
+var AddAPIKeyDeletedAt = &gormigrate.Migration{
+	ID:      "20261028-api-key-deleted-at",
+	Migrate: func(tx *gorm.DB) error { return tx.AutoMigrate(&model.APIKey{}) },
+}

core/middleware/operation.go

@@ -42,6 +42,10 @@ func OperationLog() gin.HandlerFunc {
 			return
 		}
 		switch c.Request.URL.Path {
+		case "/api/v2/core/auth/api/keys/reveal":
+			// Disclosure has its own audit and must not enter response-body capture.
+			c.Next()
+			return
 		case "/api/v2/core/mcp/credentials/create", "/api/v2/core/mcp/credentials/reveal", "/api/v2/core/mcp/credentials/rotate", "/api/v2/core/mcp/credentials/export":
 			c.Next()
 			return

core/router/ro_base.go

@@ -40,6 +40,8 @@ func (s *BaseRouter) InitRouter(Router *gin.RouterGroup) {
 		authRouter.POST("/api/keys/update", baseApi.UpdateAPIKey)
 		authRouter.POST("/api/keys/status", baseApi.SetAPIKeyStatus)
 		authRouter.POST("/api/keys/revoke", baseApi.RevokeAPIKey)
+		authRouter.POST("/api/keys/delete", baseApi.DeleteAPIKey)
+		authRouter.POST("/api/keys/reveal", baseApi.RevealAPIKey)
 
 		authRouter.GET("/current", baseApi.GetCurrentUser)
 		authRouter.POST("/current/update", baseApi.UpdateCurrentUser)

core/utils/apikey_audit/audit.go

@@ -45,6 +45,8 @@ func Build(c *gin.Context, event Event) (*model.OperationLog, error) {
 		"enable":      {"启用 API Key", "Enable API key"},
 		"disable":     {"停用 API Key", "Disable API key"},
 		"revoke":      {"撤销 API Key", "Revoke API key"},
+		"delete":      {"删除 API Key", "Delete API key"},
+		"reveal":      {"查看 API Key", "Reveal API key"},
 		"app_binding": {"向 APP 交付 API Key", "Deliver API key to APP"},
 	}
 	label, ok := labels[event.Action]
@@ -80,6 +82,17 @@ func Build(c *gin.Context, event Event) (*model.OperationLog, error) {
 			record.UserAgent = c.Request.UserAgent()
 			record.IP = c.ClientIP()
 		}
+		if c.GetBool("API_AUTH") && event.Action != "app_binding" {
+			record.AuthMethod = "api_key"
+			record.APIKeyID = c.GetString("API_AUTH_KEY_ID")
+			record.APIKeyName = c.GetString("API_AUTH_KEY_NAME")
+			if c.GetString("API_AUTH_KEY_KIND") == "legacy" {
+				record.APIKeyID = "legacy:" + c.GetString("API_AUTH_OWNER_TYPE") + ":" + c.GetString("API_AUTH_OWNER_ID")
+			}
+			if clientIP := c.GetString("API_AUTH_CLIENT_IP"); clientIP != "" {
+				record.IP = clientIP
+			}
+		}
 	}
 	if event.ClientIP != "" {
 		record.IP = event.ClientIP

frontend/src/api/interface/api-key.ts

@@ -30,4 +30,7 @@ export namespace APIKey {
         id: string;
         revision: number;
     }
+    export interface Revealed extends Reference {
+        apiKey: string;
+    }
 }

frontend/src/api/interface/container.ts

@@ -136,9 +136,6 @@ export namespace Container {
         mode: string;
     }
     export interface ContainerInfo {
-        latestVersion?: string;
-        targetImage?: string;
-        hasUpdate?: boolean;
         containerID: string;
         name: string;
         imageName: string;

frontend/src/api/modules/api-key.ts

@@ -6,7 +6,7 @@ const prefix = '/core/auth/api/keys';
 export const searchAPIKeys = (params: { page: number; pageSize: number; excludeRevoked?: boolean }) => {
     return http.post<APIKey.Search>(`${prefix}/search`, params);
 };
-export const createAPIKey = (params: APIKey.Editable & { requestID: string }) => {
+export const createAPIKey = (params: APIKey.Editable & { requestID?: string }) => {
     return http.post<APIKey.Created>(`${prefix}/create`, params);
 };
 export const updateAPIKey = (params: APIKey.Editable & APIKey.Reference) => {
@@ -18,3 +18,9 @@ export const setAPIKeyStatus = (params: APIKey.Reference & { status: 'Enable' |
 export const revokeAPIKey = (params: APIKey.Reference) => {
     return http.post<{ terminalClosePending: boolean }>(`${prefix}/revoke`, params);
 };
+export const deleteAPIKey = (params: APIKey.Reference) => {
+    return http.post<{ terminalClosePending: boolean }>(`${prefix}/delete`, params);
+};
+export const revealAPIKey = (params: APIKey.Reference) => {
+    return http.post<APIKey.Revealed>(`${prefix}/reveal`, params);
+};

frontend/src/api/modules/container.ts

@@ -290,43 +290,3 @@ export const updateIpv6Option = (fixedCidrV6: string, ip6Tables: boolean, experi
 export const updateDaemonJsonByfile = (params: Container.DaemonJsonUpdateByFile) => {
     return http.post(`/containers/daemonjson/update/byfile`, params, TimeoutEnum.T_3M);
 };
-
-export interface ImageRemoteCheckStatus {
-    proxyRequired: boolean;
-}
-export const getImageRemoteCheckStatus = (node: string, signal?: AbortSignal) =>
-    http.get<ImageRemoteCheckStatus>(
-        '/containers/image/remote/check',
-        {},
-        { headers: { CurrentNode: node }, signal },
-    );
-
-export interface ContainerImageCheckUpdateStatus {
-    taskID: string;
-    enabled: boolean;
-    running: boolean;
-    checked: number;
-    updates: number;
-    failed: number;
-    skipped: number;
-    error: string;
-    finishedAt: number;
-}
-export const getContainerImageCheckUpdateStatus = (node: string, signal?: AbortSignal) =>
-    http.get<ContainerImageCheckUpdateStatus>(
-        '/containers/image-updates',
-        {},
-        { headers: { CurrentNode: node }, signal },
-    );
-export const runContainerImageCheckUpdate = (node: string) =>
-    http.postWithConfig<ContainerImageCheckUpdateStatus>(
-        '/containers/image-updates/check',
-        {},
-        { headers: { CurrentNode: node } },
-    );
-export const setContainerImageCheckUpdateSchedule = (enabled: boolean, node: string) =>
-    http.postWithConfig<ContainerImageCheckUpdateStatus>(
-        '/containers/image-updates/schedule',
-        { enabled },
-        { headers: { CurrentNode: node } },
-    );

frontend/src/assets/iconfont/iconfont.css

@@ -1,9 +1,9 @@
 @font-face {
   font-family: "iconfont"; /* Project id 4776196 */
-  src: url('iconfont.woff2?t=1793239167475') format('woff2'),
-       url('iconfont.woff?t=1793239167475') format('woff'),
-       url('iconfont.ttf?t=1793239167475') format('truetype'),
-       url('iconfont.svg?t=1793239167475#iconfont') format('svg');
+  src: url('iconfont.woff2?t=1786526991803') format('woff2'),
+       url('iconfont.woff?t=1786526991803') format('woff'),
+       url('iconfont.ttf?t=1786526991803') format('truetype'),
+       url('iconfont.svg?t=1786526991803#iconfont') format('svg');
 }
 
 .iconfont {
@@ -14,14 +14,6 @@
   -moz-osx-font-smoothing: grayscale;
 }
 
-.p-huggingface1:before {
-  content: "\e656";
-}
-
-.p-modelscope:before {
-  content: "\e6be";
-}
-
 .p-shuju:before {
   content: "\e634";
 }

frontend/src/assets/iconfont/iconfont.json

@@ -5,20 +5,6 @@
   "css_prefix_text": "p-",
   "description": "",
   "glyphs": [
-    {
-      "icon_id": "38704691",
-      "name": "huggingface",
-      "font_class": "huggingface1",
-      "unicode": "e656",
-      "unicode_decimal": 58966
-    },
-    {
-      "icon_id": "45461892",
-      "name": "modelscope",
-      "font_class": "modelscope",
-      "unicode": "e6be",
-      "unicode_decimal": 59070
-    },
     {
       "icon_id": "12903469",
       "name": "本地数据",

frontend/src/components/api-key-management/editor.vue

@@ -6,27 +6,14 @@
         :confirm-before-close="true"
         @before-close="beforeClose"
     >
-        <template v-if="created">
-            <el-alert
-                :title="$t(secret ? 'apiKeyManagement.saveSecret' : 'apiKeyManagement.alreadyCreated')"
-                :type="secret ? 'warning' : 'info'"
-                :closable="false"
-                show-icon
-                class="mb-4"
-            />
-            <el-form label-position="top">
-                <el-form-item :label="$t('commons.table.name')">{{ created.name }}</el-form-item>
-                <el-form-item v-if="secret" :label="$t('setting.apiKey')">
-                    <el-input :model-value="secret" readonly autocomplete="off">
-                        <template #append>
-                            <CopyButton :content="secret" :is-icon="false" />
-                        </template>
-                    </el-input>
-                </el-form-item>
-            </el-form>
-            <el-checkbox v-if="secret" v-model="saved">{{ $t('apiKeyManagement.saved') }}</el-checkbox>
-        </template>
-        <el-form v-else ref="formRef" :model="form" :rules="rules" label-position="top" @submit.prevent="submit">
+        <el-form
+            ref="formRef"
+            :model="form"
+            :rules="rules"
+            label-position="top"
+            class="text-[var(--el-text-color-regular)]"
+            @submit.prevent="submit"
+        >
             <el-alert v-if="!item" type="warning" :closable="false" class="!mb-4">
                 <ul class="m-0 list-disc space-y-1 pl-4 break-words leading-6">
                     <li>
@@ -139,13 +126,10 @@
             </el-form-item>
         </el-form>
         <template #footer>
-            <el-button v-if="!created" :disabled="busy" @click="beforeClose(() => (visible = false))">
+            <el-button :disabled="busy" @click="beforeClose(() => (visible = false))">
                 {{ $t('commons.button.cancel') }}
             </el-button>
-            <el-button v-if="created" type="primary" :disabled="!!secret && !saved" @click="finish">
-                {{ $t('commons.button.confirm') }}
-            </el-button>
-            <el-button v-else type="primary" :loading="busy" @click="submit">
+            <el-button type="primary" :loading="busy" @click="submit">
                 {{ $t(item ? 'commons.button.save' : 'apiKeyManagement.create') }}
             </el-button>
         </template>
@@ -154,7 +138,7 @@
 
 <script setup lang="ts">
 import { computed, nextTick, onBeforeUnmount, reactive, ref, watch } from 'vue';
-import { ElMessageBox, type FormInstance } from 'element-plus';
+import type { FormInstance } from 'element-plus';
 import { isAxiosError } from 'axios';
 import { v4 as uuidv4 } from 'uuid';
 import { onBeforeRouteLeave } from 'vue-router';
@@ -174,9 +158,6 @@ const visible = ref(false);
 const busy = ref(false);
 const uncertain = ref(false);
 const item = ref<APIKey.Item>();
-const created = ref<APIKey.Item>();
-const secret = ref('');
-const saved = ref(false);
 const formRef = ref<FormInstance>();
 const ipMode = ref('restricted');
 const neverExpires = ref(false);
@@ -196,8 +177,6 @@ let editorVersion = 0;
 
 const discardEditor = () => {
     editorVersion++;
-    secret.value = '';
-    created.value = undefined;
     visible.value = false;
     busy.value = false;
 };
@@ -240,9 +219,6 @@ const rules = {
 const open = (existing?: APIKey.Item, fromApp = false) => {
     editorVersion++;
     item.value = existing;
-    created.value = undefined;
-    secret.value = '';
-    saved.value = false;
     uncertain.value = false;
     pendingCreate = undefined;
     requestID = uuidv4();
@@ -269,19 +245,9 @@ const open = (existing?: APIKey.Item, fromApp = false) => {
     nextTick(() => formRef.value?.clearValidate());
 };
 
-const finish = () => {
-    secret.value = '';
-    visible.value = false;
-    if (created.value) emit('created', created.value);
-};
-const beforeClose = async (done: () => void) => {
+const beforeClose = (done: () => void) => {
     if (busy.value) return;
-    if (secret.value && !saved.value) {
-        await ElMessageBox.alert(i18n.global.t('apiKeyManagement.saveSecret'), i18n.global.t('apiKeyManagement.title'));
-        return;
-    }
-    if (created.value) finish();
-    else if (uncertain.value) emit('changed');
+    if (uncertain.value) emit('changed');
     done();
 };
 
@@ -310,9 +276,13 @@ const submit = async () => {
             pendingCreate ??= { ...payload, requestID };
             const response = await createAPIKey(pendingCreate);
             if (ticket !== editorVersion) return;
-            created.value = response.data.item;
-            secret.value = response.data.apiKey;
             uncertain.value = false;
+            pendingCreate = undefined;
+            MsgSuccess(i18n.global.t('commons.msg.createSuccess'));
+            visible.value = false;
+            emit('changed');
+            emit('created', response.data.item);
+            return;
         }
         emit('changed');
     } catch (error) {
@@ -341,16 +311,12 @@ watch(
     { flush: 'sync' },
 );
 onBeforeUnmount(discardEditor);
-onBeforeRouteLeave(async (to) => {
+onBeforeRouteLeave((to) => {
     if (!globalStore.isLogin || ['entrance', 'Expired', 'EnterpriseLicenseRequired'].includes(String(to.name))) {
         discardEditor();
         return true;
     }
     if (busy.value) return false;
-    if (secret.value && !saved.value) {
-        await ElMessageBox.alert(i18n.global.t('apiKeyManagement.saveSecret'), i18n.global.t('apiKeyManagement.title'));
-        return false;
-    }
     discardEditor();
     return true;
 });

frontend/src/components/table/TableOperationActions.vue

@@ -13,16 +13,14 @@
                 @click.stop="handleButtonClick(button)"
             >
                 <el-icon v-if="button.icon" class="mr-1"><component :is="button.icon" /></el-icon>
-                <el-badge is-dot :hidden="!hasDot(button)">
-                    <span>{{ button.label }}</span>
-                </el-badge>
+                <span>{{ button.label }}</span>
             </el-button>
         </span>
         <span v-if="actions.more.length" class="fu-table-operations__action">
             <el-dropdown class="fu-table-more-button" :trigger="trigger" @command="handleButtonClick">
                 <span class="fu-table-operations__dropdown-trigger">
                     <el-button class="fu-table-operations__button" link type="primary">
-                        <el-badge is-dot :hidden="!actions.more.some(hasDot)">{{ t('fu.table.more') }}</el-badge>
+                        {{ t('fu.table.more') }}
                     </el-button>
                 </span>
                 <template #dropdown>
@@ -35,9 +33,7 @@
                             :divided="button.divided"
                         >
                             <el-icon v-if="button.icon" class="mr-1"><component :is="button.icon" /></el-icon>
-                            <el-badge is-dot :hidden="!hasDot(button)">
-                                <span>{{ button.label }}</span>
-                            </el-badge>
+                            <span>{{ button.label }}</span>
                         </el-dropdown-item>
                     </el-dropdown-menu>
                 </template>
@@ -79,9 +75,6 @@ const actions = computed(() => {
     };
 });
 
-const hasDot = (button: FuTableOperationButton) =>
-    typeof button.dot === 'function' ? button.dot(props.row) : Boolean(button.dot);
-
 const handleButtonClick = (button: FuTableOperationButton) => {
     if (!isOperationDisabled(button, props.row)) {
         button.click?.(props.row);

frontend/src/components/table/shared.ts

@@ -23,7 +23,6 @@ export interface FuTableOperationButton<Row = any> {
     type?: string;
     icon?: any;
     divided?: boolean;
-    dot?: boolean | ((row: Row) => boolean);
 }
 
 export const FU_TABLE_STORAGE_PREFIX = 'FU-T-';

frontend/src/lang/modules/en.ts

@@ -2,6 +2,11 @@ import { getFuLocaleMessage } from '@/lang/fu';
 
 const message = {
     apiKeyManagement: {
+        reveal: 'Show secret',
+        hideSecret: 'Hide secret',
+        revealHelp: 'Keep this secret secure. Disabled or expired keys remain unusable even when displayed.',
+        deleteConfirm:
+            'Delete “{0}”? Its secret will be destroyed and the key removed from the list. New requests will be rejected and terminal connections closed. Audit records are retained; running jobs are not cancelled. This cannot be undone.',
         title: 'API Key',
         manage: 'Manage API Keys',
         personalEntry: 'Manage your keys, access conditions, and APP binding in Settings.',
@@ -23,10 +28,6 @@ const message = {
         allowAppBinding: 'Allow APP QR binding',
         bindingDisableHelp:
             'Disabling QR binding prevents new device bindings. Devices already bound can continue to use the key until it is disabled, revoked, or expires.',
-        saveSecret: 'Copy and save this secret now. After closing, ordinary key management cannot display it again.',
-        saved: 'I have saved the secret',
-        alreadyCreated:
-            'This key was already created. Its secret will not be shown again. If the original response was lost, revoke and recreate it, or use QR binding if allowed.',
         uncertain:
             'The request result is uncertain. Retry with the same details to avoid duplicate keys, or close and check the list before creating another.',
         legacyHelp:
@@ -1086,7 +1087,7 @@ const message = {
                 'Container address is for agent containers; 127.0.0.1, system IP, or custom address is for AI Gateway or external services.',
             containerAddress: 'Container address',
             customAddress: 'Custom address',
-            downloader: 'Downloads',
+            downloader: 'Downloader',
             modelDir: 'Model directory',
             modelSource: 'Model source',
             repoID: 'Repository ID',
@@ -2116,19 +2117,6 @@ const message = {
         batchUpgradeWaiting: 'Queued',
         batchUpgradeRunning: 'Upgrading',
         batchUpgradeSubmitted: 'Upgrade task submitted',
-        imageCheckUpdateProxyRequired:
-            'To check for image updates in the current runtime environment, please configure a proxy server first.',
-        imageCheckUpdateConfigureProxy: 'Configure',
-        imageCheckUpdateAvailableVersion: 'Available version “{version}”',
-        imageCheckUpdateContentChanged: '(image content changed)',
-        imageCheckUpdates: 'Check for image updates',
-        imageCheckUpdateNow: 'Check now',
-        imageCheckUpdateSchedule: 'Scheduled checks',
-        imageCheckUpdateDisable: 'Disable scheduled checks',
-        imageCheckUpdateStarted: 'Checking images used by all containers on this node',
-        imageCheckUpdateResult:
-            'Check complete: {checked} checked, {updates} upgradable, {failed} failed, {skipped} skipped',
-
         createByCommand: 'Create by command',
         importContainerBackupTip: 'Import container backup file, only .tar.gz is supported',
         importComposeBackupTip: 'Import compose backup file, only .tar.gz is supported',
@@ -7005,7 +6993,7 @@ const message = {
                 'Search HuggingFace model repositories directly and view downloads, likes, model details, and file lists.',
             modelDownloaderTitle2: 'Accelerated Downloads',
             modelDownloaderContent2:
-                'Configure a HuggingFace acceleration endpoint and HuggingFace Token for the official site, mirrors, and private models.',
+                'Configure a HuggingFace acceleration endpoint and HF Token for the official site, mirrors, and private models.',
             modelDownloaderTitle3: 'Task Tracking',
             modelDownloaderContent3:
                 'Review download queues, task status, progress, and errors, with support for canceling, retrying, and clearing records.',

frontend/src/lang/modules/es-es.ts

@@ -2,6 +2,11 @@ import { getFuLocaleMessage } from '@/lang/fu';
 
 const message = {
     apiKeyManagement: {
+        reveal: 'Mostrar secreto',
+        hideSecret: 'Ocultar secreto',
+        revealHelp: 'Guarde el secreto de forma segura. Mostrarlo no reactiva claves deshabilitadas o caducadas.',
+        deleteConfirm:
+            '¿Eliminar «{0}»? Se destruirá el secreto y se quitará la clave de la lista. Se rechazarán nuevas solicitudes y se cerrarán sus terminales. Se conservará la auditoría; las tareas en ejecución no se cancelarán. Esta acción es irreversible.',
         title: 'API Key',
         manage: 'Gestionar claves API',
         personalEntry: 'Gestiona tus claves, condiciones de acceso y vinculación de la APP en Ajustes.',
@@ -23,10 +28,6 @@ const message = {
         allowAppBinding: 'Permitir vinculación de APP por QR',
         bindingDisableHelp:
             'Desactivar la vinculación por QR impide nuevas vinculaciones. Los dispositivos ya vinculados pueden seguir usando la clave hasta que se desactive, se revoque o caduque.',
-        saveSecret: 'Copia y guarda la clave ahora. Tras cerrar, la gestión normal no podrá mostrarla de nuevo.',
-        saved: 'He guardado la clave',
-        alreadyCreated:
-            'La clave ya se creó y no se mostrará de nuevo. Si se perdió la respuesta original, revócala y crea otra, o usa QR si está permitido.',
         uncertain:
             'El resultado es incierto. Reintenta con los mismos datos para evitar duplicados, o cierra y revisa la lista antes de crear otra.',
         legacyHelp:
@@ -1088,7 +1089,7 @@ const message = {
                 'La dirección del contenedor es para contenedores de agentes; 127.0.0.1, IP del sistema o dirección personalizada es para AI Gateway o servicios externos.',
             containerAddress: 'Dirección del contenedor',
             customAddress: 'Dirección personalizada',
-            downloader: 'Gestión de descargas',
+            downloader: 'Descargador',
             modelDir: 'Directorio del modelo',
             modelSource: 'Fuente del modelo',
             repoID: 'ID del repositorio',
@@ -2135,19 +2136,6 @@ const message = {
         batchUpgradeWaiting: 'Queued',
         batchUpgradeRunning: 'Upgrading',
         batchUpgradeSubmitted: 'Upgrade task submitted',
-        imageCheckUpdateProxyRequired:
-            'Para comprobar actualizaciones de imágenes en el entorno actual, configura primero un servidor proxy.',
-        imageCheckUpdateConfigureProxy: 'Configurar',
-        imageCheckUpdateAvailableVersion: 'Versión disponible «{version}»',
-        imageCheckUpdateContentChanged: '(el contenido de la imagen ha cambiado)',
-        imageCheckUpdates: 'Buscar actualizaciones de imágenes',
-        imageCheckUpdateNow: 'Comprobar ahora',
-        imageCheckUpdateSchedule: 'Comprobación programada',
-        imageCheckUpdateDisable: 'Desactivar comprobación programada',
-        imageCheckUpdateStarted: 'Buscando actualizaciones de las imágenes de todos los contenedores de este nodo',
-        imageCheckUpdateResult:
-            'Comprobación finalizada: comprobados {checked}, actualizables {updates}, fallidos {failed}, omitidos {skipped}',
-
         createByCommand: 'Crear por comando',
         importContainerBackupTip: 'Importar archivo de copia de seguridad de contenedor, solo se admite .tar.gz',
         importComposeBackupTip: 'Importar archivo de copia de seguridad de compose, solo se admite .tar.gz',
@@ -7106,7 +7094,7 @@ const message = {
                 'Busca repositorios de modelos de HuggingFace directamente y consulta descargas, me gusta, detalles y archivos.',
             modelDownloaderTitle2: 'Descargas aceleradas',
             modelDownloaderContent2:
-                'Configura un endpoint de aceleración de HuggingFace y HuggingFace Token para el sitio oficial, espejos y modelos privados.',
+                'Configura un endpoint de aceleración de HuggingFace y HF Token para el sitio oficial, espejos y modelos privados.',
             modelDownloaderTitle3: 'Seguimiento de tareas',
             modelDownloaderContent3:
                 'Consulta la cola, el estado, el progreso y los errores de descarga, con soporte para cancelar, reintentar y limpiar registros.',

frontend/src/lang/modules/fa.ts

@@ -2,6 +2,11 @@ import { getFuLocaleMessage } from '@/lang/fu';
 
 const message = {
     apiKeyManagement: {
+        reveal: 'نمایش کلید محرمانه',
+        hideSecret: 'پنهان کردن کلید محرمانه',
+        revealHelp: 'کلید را در جای امن نگه دارید. نمایش آن، کلید غیرفعال یا منقضی‌شده را قابل استفاده نمی‌کند.',
+        deleteConfirm:
+            '«{0}» حذف شود؟ کلید محرمانه نابود و از فهرست حذف می‌شود. درخواست‌های جدید رد و اتصال‌های ترمینال مرتبط بسته می‌شوند. سوابق حسابرسی حفظ و کارهای در حال اجرا لغو نمی‌شوند. این عملیات برگشت‌پذیر نیست.',
         title: 'API Key',
         manage: 'مدیریت کلیدهای API',
         personalEntry: 'کلیدها، شرایط دسترسی و اتصال برنامه را در تنظیمات مدیریت کنید.',
@@ -23,10 +28,6 @@ const message = {
         allowAppBinding: 'اجازه اتصال برنامه با QR',
         bindingDisableHelp:
             'با غیرفعال کردن اتصال از طریق QR، اتصال دستگاه‌های جدید متوقف می‌شود. دستگاه‌های متصل می‌توانند تا زمان غیرفعال‌سازی، لغو یا انقضای کلید به استفاده از آن ادامه دهند.',
-        saveSecret: 'اکنون کلید را کپی و ذخیره کنید. پس از بستن، مدیریت عادی نمی‌تواند کلید کامل را دوباره نشان دهد.',
-        saved: 'کلید را ذخیره کردم',
-        alreadyCreated:
-            'این کلید قبلاً ایجاد شده و دوباره نمایش داده نمی‌شود. اگر پاسخ اصلی گم شده است، کلید را لغو و دوباره ایجاد کنید یا در صورت اجازه از QR استفاده کنید.',
         uncertain:
             'نتیجه درخواست نامشخص است. برای جلوگیری از تکرار، با همان اطلاعات دوباره تلاش کنید یا ببندید و پیش از ایجاد کلید دیگر فهرست را بررسی کنید.',
         legacyHelp:
@@ -1071,7 +1072,7 @@ const message = {
                 'آدرس کانتینر برای کانتینرهای عامل است؛ 127.0.0.1، IP سیستم یا آدرس سفارشی برای دروازه AI یا خدمات خارجی است.',
             containerAddress: 'آدرس کانتینر',
             customAddress: 'آدرس سفارشی',
-            downloader: 'مدیریت دانلودها',
+            downloader: 'دانلودکننده',
             modelDir: 'دایرکتوری مدل',
             modelSource: 'منبع مدل',
             repoID: 'شناسه مخزن',
@@ -2093,19 +2094,6 @@ const message = {
         batchUpgradeWaiting: 'Queued',
         batchUpgradeRunning: 'Upgrading',
         batchUpgradeSubmitted: 'Upgrade task submitted',
-        imageCheckUpdateProxyRequired:
-            'برای بررسی به‌روزرسانی تصاویر در محیط فعلی، ابتدا یک سرور پروکسی پیکربندی کنید.',
-        imageCheckUpdateConfigureProxy: 'پیکربندی',
-        imageCheckUpdateAvailableVersion: 'نسخه قابل ارتقا «{version}»',
-        imageCheckUpdateContentChanged: '(محتوای تصویر تغییر کرده است)',
-        imageCheckUpdates: 'بررسی به‌روزرسانی ایمیج‌ها',
-        imageCheckUpdateNow: 'بررسی اکنون',
-        imageCheckUpdateSchedule: 'بررسی زمان‌بندی‌شده',
-        imageCheckUpdateDisable: 'غیرفعال‌کردن بررسی زمان‌بندی‌شده',
-        imageCheckUpdateStarted: 'در حال بررسی به‌روزرسانی ایمیج‌های همه کانتینرهای این گره',
-        imageCheckUpdateResult:
-            'بررسی پایان یافت: بررسی‌شده {checked}، قابل ارتقا {updates}، ناموفق {failed}، ردشده {skipped}',
-
         createByCommand: 'ایجاد با دستور',
         importContainerBackupTip: 'واردات فایل پشتیبان کانتینر، فقط .tar.gz پشتیبانی می‌شود',
         importComposeBackupTip: 'واردات فایل پشتیبان compose، فقط .tar.gz پشتیبانی می‌شود',
@@ -6958,7 +6946,7 @@ const message = {
                 'مستقیماً مخازن مدل HuggingFace را جستجو کنید و دانلودها، لایک‌ها، جزئیات مدل و لیست فایل‌ها را مشاهده کنید.',
             modelDownloaderTitle2: 'دانلود شتاب‌دهنده',
             modelDownloaderContent2:
-                'یک نقطه پایانی شتاب HuggingFace و توکن HuggingFace را برای سایت رسمی، آینه‌ها و مدل‌های خصوصی پیکربندی کنید.',
+                'یک نقطه پایانی شتاب HuggingFace و توکن HF را برای سایت رسمی، آینه‌ها و مدل‌های خصوصی پیکربندی کنید.',
             modelDownloaderTitle3: 'ردیابی وظایف',
             modelDownloaderContent3:
                 'صف‌های دانلود، وضعیت وظایف، پیشرفت و خطاها را مرور کنید و از لغو، تلاش مجدد و پاک‌سازی رکوردها پشتیبانی کنید.',

frontend/src/lang/modules/ja.ts

@@ -2,6 +2,11 @@ import { getFuLocaleMessage } from '@/lang/fu';
 
 const message = {
     apiKeyManagement: {
+        reveal: 'シークレットを表示',
+        hideSecret: 'シークレットを隠す',
+        revealHelp: 'シークレットを安全に保管してください。表示しても無効または期限切れのキーは使用できません。',
+        deleteConfirm:
+            '「{0}」を削除しますか？シークレットは破棄され、キーは一覧から削除されます。新しいリクエストは拒否され、関連ターミナルは切断されます。監査記録は保持され、実行中のタスクは中止されません。この操作は元に戻せません。',
         title: 'API Key',
         manage: 'API Key を管理',
         personalEntry: '設定で自分のキー、アクセス条件、APP の QR 連携を管理します。',
@@ -23,10 +28,6 @@ const message = {
         allowAppBinding: 'APP の QR 連携を許可',
         bindingDisableHelp:
             'QR 連携を無効にすると、新規の連携を受け付けなくなります。連携済みの端末は、キーが無効化、失効、または期限切れになるまで引き続き利用できます。',
-        saveSecret: '今すぐキーをコピーして保存してください。閉じると通常のキー管理から完全なキーを再表示できません。',
-        saved: 'キーを保存しました',
-        alreadyCreated:
-            'このキーは作成済みで、再表示できません。最初の応答を受け取れなかった場合は失効させて再作成するか、許可されていれば QR を使用してください。',
         uncertain: 'リクエスト結果が不明です。重複を避けるため同じ設定で再試行するか、閉じて一覧を確認してください。',
         legacyHelp:
             '旧版キーは従来の API 接続との互換性を維持します。有効化、無効化、リセットはこのキーにのみ適用されます。',
@@ -1075,7 +1076,7 @@ const message = {
                 'コンテナアドレスはエージェントコンテナ向けです。127.0.0.1、システム IP、カスタムアドレスは AI Gateway または外部サービス向けです。',
             containerAddress: 'コンテナアドレス',
             customAddress: 'カスタムアドレス',
-            downloader: 'ダウンロード管理',
+            downloader: 'ダウンローダー',
             modelDir: 'モデルディレクトリ',
             modelSource: 'モデルソース',
             repoID: 'リポジトリ ID',
@@ -2100,18 +2101,6 @@ const message = {
         batchUpgradeWaiting: 'Queued',
         batchUpgradeRunning: 'Upgrading',
         batchUpgradeSubmitted: 'Upgrade task submitted',
-        imageCheckUpdateProxyRequired:
-            '現在の実行環境でイメージの更新を確認するには、先にプロキシサーバーを設定してください。',
-        imageCheckUpdateConfigureProxy: '設定へ',
-        imageCheckUpdateAvailableVersion: '更新可能なバージョン「{version}」',
-        imageCheckUpdateContentChanged: '（イメージの内容が変更されています）',
-        imageCheckUpdates: 'イメージの更新を確認',
-        imageCheckUpdateNow: '今すぐ確認',
-        imageCheckUpdateSchedule: '定期チェック',
-        imageCheckUpdateDisable: '定期チェックを無効にする',
-        imageCheckUpdateStarted: 'このノードのすべてのコンテナで使用されているイメージの更新を確認しています',
-        imageCheckUpdateResult: '確認完了：成功 {checked}、更新可能 {updates}、失敗 {failed}、スキップ {skipped}',
-
         createByCommand: 'コマンドで作成',
         importContainerBackupTip: 'コンテナバックアップファイルをインポートします。.tar.gz のみ対応です',
         importComposeBackupTip: 'Compose バックアップファイルをインポートします。.tar.gz のみ対応です',
@@ -6979,7 +6968,7 @@ const message = {
                 'HuggingFace のモデルリポジトリを直接検索し、ダウンロード数、いいね、モデル詳細、ファイル一覧を確認できます。',
             modelDownloaderTitle2: '高速ダウンロード',
             modelDownloaderContent2:
-                'HuggingFace アクセラレーションエンドポイントと HuggingFace Token を設定し、公式サイト、ミラー、プライベートモデルに対応します。',
+                'HuggingFace アクセラレーションエンドポイントと HF Token を設定し、公式サイト、ミラー、プライベートモデルに対応します。',
             modelDownloaderTitle3: 'タスク追跡',
             modelDownloaderContent3:
                 'ダウンロードキュー、タスク状態、進捗、エラーを一元確認し、キャンセル、再試行、記録の削除を行えます。',

frontend/src/lang/modules/ko.ts

@@ -2,6 +2,11 @@ import { getFuLocaleMessage } from '@/lang/fu';
 
 const message = {
     apiKeyManagement: {
+        reveal: '비밀 키 표시',
+        hideSecret: '비밀 키 숨기기',
+        revealHelp: '비밀 키를 안전하게 보관하세요. 표시해도 비활성화되거나 만료된 키는 사용할 수 없습니다.',
+        deleteConfirm:
+            '“{0}”을(를) 삭제하시겠습니까? 비밀 키가 파기되고 목록에서 제거됩니다. 새 요청은 거부되고 연결된 터미널은 종료됩니다. 감사 기록은 유지되며 실행 중인 작업은 취소되지 않습니다. 이 작업은 되돌릴 수 없습니다.',
         title: 'API Key',
         manage: 'API Key 관리',
         personalEntry: '설정에서 내 키, 접근 조건 및 APP QR 연결을 관리합니다.',
@@ -23,10 +28,6 @@ const message = {
         allowAppBinding: 'APP QR 연결 허용',
         bindingDisableHelp:
             'QR 연결을 비활성화하면 새로운 기기를 연결할 수 없습니다. 이미 연결된 기기는 키가 비활성화, 폐기 또는 만료될 때까지 계속 사용할 수 있습니다.',
-        saveSecret: '지금 키를 복사하여 저장하세요. 닫으면 일반 키 관리에서 전체 키를 다시 표시할 수 없습니다.',
-        saved: '키를 저장했습니다',
-        alreadyCreated:
-            '이 키는 이미 생성되어 다시 표시할 수 없습니다. 원래 응답을 잃었다면 폐기 후 다시 만들거나 허용된 QR 연결을 사용하세요.',
         uncertain:
             '요청 결과를 확인할 수 없습니다. 중복 생성을 피하려면 같은 설정으로 재시도하거나 닫고 목록을 확인하세요.',
         legacyHelp:
@@ -1064,7 +1065,7 @@ const message = {
                 '컨테이너 주소는 에이전트 컨테이너 호출에 적합합니다. 127.0.0.1, 시스템 IP 또는 사용자 지정 주소는 AI Gateway 또는 외부 서비스 호출에 적합합니다.',
             containerAddress: '컨테이너 주소',
             customAddress: '사용자 지정 주소',
-            downloader: '다운로드 관리',
+            downloader: '다운로더',
             modelDir: '모델 디렉토리',
             modelSource: '모델 소스',
             repoID: '저장소 ID',
@@ -2075,17 +2076,6 @@ const message = {
         batchUpgradeWaiting: 'Queued',
         batchUpgradeRunning: 'Upgrading',
         batchUpgradeSubmitted: 'Upgrade task submitted',
-        imageCheckUpdateProxyRequired: '현재 실행 환경에서 이미지 업데이트를 확인하려면 먼저 프록시 서버를 설정하세요.',
-        imageCheckUpdateConfigureProxy: '설정하기',
-        imageCheckUpdateAvailableVersion: '업그레이드 가능한 버전 “{version}”',
-        imageCheckUpdateContentChanged: '(이미지 내용 변경)',
-        imageCheckUpdates: '이미지 업데이트 확인',
-        imageCheckUpdateNow: '지금 확인',
-        imageCheckUpdateSchedule: '정기 확인',
-        imageCheckUpdateDisable: '정기 확인 끄기',
-        imageCheckUpdateStarted: '현재 노드의 모든 컨테이너에서 사용하는 이미지의 업데이트를 확인하고 있습니다',
-        imageCheckUpdateResult: '확인 완료: 성공 {checked}, 업데이트 가능 {updates}, 실패 {failed}, 건너뜀 {skipped}',
-
         createByCommand: '명령으로 생성',
         importContainerBackupTip: '컨테이너 백업 파일 가져오기, .tar.gz 형식만 지원합니다',
         importComposeBackupTip: 'Compose 백업 파일 가져오기, .tar.gz 형식만 지원합니다',
@@ -6835,7 +6825,7 @@ const message = {
                 'HuggingFace 모델 저장소를 직접 검색하고 다운로드 수, 좋아요, 모델 상세 정보, 파일 목록을 확인합니다.',
             modelDownloaderTitle2: '가속 다운로드',
             modelDownloaderContent2:
-                'HuggingFace 가속 엔드포인트와 HuggingFace Token을 설정하여 공식 사이트, 미러, 비공개 모델에 대응합니다.',
+                'HuggingFace 가속 엔드포인트와 HF Token을 설정하여 공식 사이트, 미러, 비공개 모델에 대응합니다.',
             modelDownloaderTitle3: '작업 추적',
             modelDownloaderContent3:
                 '다운로드 대기열, 작업 상태, 진행률, 오류를 한곳에서 확인하고 취소, 재시도, 기록 정리를 지원합니다.',

frontend/src/lang/modules/lo.ts

@@ -2,6 +2,11 @@ import { getFuLocaleMessage } from '@/lang/fu';
 
 const message = {
     apiKeyManagement: {
+        reveal: 'ສະແດງຄີລັບ',
+        hideSecret: 'ເຊື່ອງຄີລັບ',
+        revealHelp: 'ກະລຸນາເກັບຄີລັບໃຫ້ປອດໄພ. ການສະແດງບໍ່ເຮັດໃຫ້ຄີທີ່ປິດໃຊ້ງານ ຫຼືໝົດອາຍຸກັບມາໃຊ້ໄດ້.',
+        deleteConfirm:
+            'ລຶບ “{0}” ຫຼືບໍ່? ຄີລັບຈະຖືກທຳລາຍ ແລະລຶບອອກຈາກລາຍການ. ຄຳຮ້ອງຂໍໃໝ່ຈະຖືກປະຕິເສດ ແລະປິດເທີມິນັລທີ່ກ່ຽວຂ້ອງ. ບັນທຶກການກວດສອບຈະຍັງຄົງຢູ່; ວຽກທີ່ກຳລັງເຮັດຈະບໍ່ຖືກຍົກເລີກ. ບໍ່ສາມາດກູ້ຄືນໄດ້.',
         title: 'API Key',
         manage: 'ຈັດການ API Key',
         personalEntry: 'ຈັດການກະແຈ, ເງື່ອນໄຂເຂົ້າໃຊ້ ແລະ ການຜູກ APP ໃນການຕັ້ງຄ່າ.',
@@ -23,9 +28,6 @@ const message = {
         allowAppBinding: 'ອະນຸຍາດຜູກ APP ຜ່ານ QR',
         bindingDisableHelp:
             'ເມື່ອປິດການຜູກມັດຜ່ານ QR, ລະບົບຈະບໍ່ຮັບການຜູກມັດໃໝ່. ອຸປະກອນທີ່ຜູກມັດແລ້ວຍັງສາມາດໃຊ້ງານໄດ້ ຈົນກວ່າກະແຈຈະຖືກປິດໃຊ້, ຖອນ ຫຼື ໝົດອາຍຸ.',
-        saveSecret: 'ຄັດລອກ ແລະ ບັນທຶກກະແຈດຽວນີ້. ຫຼັງປິດແລ້ວ ການຈັດການປົກກະຕິຈະບໍ່ສະແດງກະແຈເຕັມອີກ.',
-        saved: 'ຂ້ອຍບັນທຶກກະແຈແລ້ວ',
-        alreadyCreated: 'ກະແຈນີ້ສ້າງແລ້ວ ແລະ ບໍ່ສະແດງອີກ. ຖ້າຄຳຕອບເກົ່າຫາຍ ໃຫ້ຖອນແລ້ວສ້າງໃໝ່ ຫຼື ໃຊ້ QR ຖ້າອະນຸຍາດ.',
         uncertain: 'ຍັງບໍ່ແນ່ໃຈຜົນຄຳຮ້ອງ. ລອງໃໝ່ດ້ວຍຂໍ້ມູນເດີມເພື່ອບໍ່ສ້າງຊ້ຳ ຫຼື ປິດແລ້ວກວດລາຍການກ່ອນສ້າງອີກ.',
         legacyHelp:
             'ກະແຈເກົ່າໃຊ້ເພື່ອຮອງຮັບການເຊື່ອມຕໍ່ API ເກົ່າ. ການເປີດໃຊ້, ປິດໃຊ້ ແລະ ຣີເຊັດ ມີຜົນສະເພາະກະແຈນີ້ເທົ່ານັ້ນ.',
@@ -1060,7 +1062,7 @@ const message = {
                 'ທີ່ຢູ່ຄອນເທນເນີແມ່ນສຳລັບຄອນເທນເນີຕົວແທນ; 127.0.0.1, IP ລະບົບ, ຫຼື ທີ່ຢູ່ກຳນົດເອງແມ່ນສຳລັບ AI Gateway ຫຼື ບໍລິການພາຍນອກ.',
             containerAddress: 'ທີ່ຢູ່ຄອນເທນເນີ',
             customAddress: 'ທີ່ຢູ່ກຳນົດເອງ',
-            downloader: 'ຈັດການການດາວໂຫຼດ',
+            downloader: 'ຕົວດາວໂຫຼດ',
             modelDir: 'ໄດເຣັກທໍຣີໂມເດວ',
             modelSource: 'ແຫຼ່ງທີ່ມາໂມເດວ',
             repoID: 'ID ຄັງເກັບ',
@@ -2060,19 +2062,6 @@ const message = {
         batchUpgradeWaiting: 'Queued',
         batchUpgradeRunning: 'Upgrading',
         batchUpgradeSubmitted: 'Upgrade task submitted',
-        imageCheckUpdateProxyRequired:
-            'ເພື່ອກວດສອບການອັບເດດອິມເມຈໃນສະພາບແວດລ້ອມປັດຈຸບັນ ກະລຸນາຕັ້ງຄ່າພຣັອກຊີເຊີບເວີກ່ອນ.',
-        imageCheckUpdateConfigureProxy: 'ໄປຕັ້ງຄ່າ',
-        imageCheckUpdateAvailableVersion: 'ເວີຊັນທີ່ອັບເກຣດໄດ້ “{version}”',
-        imageCheckUpdateContentChanged: '(ເນື້ອຫາອິມເມຈປ່ຽນແປງ)',
-        imageCheckUpdates: 'ກວດສອບການອັບເດດອິມເມຈ',
-        imageCheckUpdateNow: 'ກວດສອບຕອນນີ້',
-        imageCheckUpdateSchedule: 'ກວດສອບຕາມຕາຕະລາງ',
-        imageCheckUpdateDisable: 'ປິດການກວດສອບຕາມຕາຕະລາງ',
-        imageCheckUpdateStarted: 'ກຳລັງກວດສອບການອັບເດດອິມເມຈຂອງທຸກຄອນເທນເນີໃນໂນດນີ້',
-        imageCheckUpdateResult:
-            'ກວດສອບສຳເລັດ: ກວດແລ້ວ {checked}, ອັບເກຣດໄດ້ {updates}, ລົ້ມເຫຼວ {failed}, ຂ້າມ {skipped}',
-
         createByCommand: 'ສ້າງດ້ວຍຄຳສັ່ງ',
         importContainerBackupTip: 'ນຳເຂົ້າໄຟລ໌ສຳຮອງຄອນເທນເນີ, ຮອງຮັບສະເພາະ .tar.gz',
         importComposeBackupTip: 'ນຳເຂົ້າໄຟລ໌ສຳຮອງ compose, ຮອງຮັບສະເພາະ .tar.gz',
@@ -6780,8 +6769,7 @@ const message = {
             modelDownloaderTitle1: 'ຄົ້ນຫາມໍເດລ',
             modelDownloaderContent1: 'ຄົ້ນຫາຄັງມໍເດລ HuggingFace ໂດຍກົງ ແລະ ເບິ່ງຍອດດາວໂຫຼດ, ໄລ້ ແລະ ລາຍລະອຽດໄຟລ໌.',
             modelDownloaderTitle2: 'ດາວໂຫຼດເລັ່ງດ່ວນ',
-            modelDownloaderContent2:
-                'ຕັ້ງຄ່າ ຈຸດເຊື່ອມຕໍ່ເລັ່ງຄວາມໄວ HuggingFace ແລະ HuggingFace Token ສຳລັບມໍເດລສ່ວນຕົວ.',
+            modelDownloaderContent2: 'ຕັ້ງຄ່າ HuggingFace acceleration endpoint ແລະ Token ສຳລັບມໍເດລສ່ວນຕົວ.',
             modelDownloaderTitle3: 'ຕິດຕາມງານ',
             modelDownloaderContent3: 'ກວດສອບຄິວດາວໂຫຼດ, ສະຖານະ, ຄວາມຄືບໜ້າ ແລະ ຂໍ້ຜິດພາດ.',
             modelDownloaderTitle4: 'ຈັດການໃນເຄື່ອງ',

frontend/src/lang/modules/ms.ts

@@ -2,6 +2,12 @@ import { getFuLocaleMessage } from '@/lang/fu';
 
 const message = {
     apiKeyManagement: {
+        reveal: 'Papar rahsia',
+        hideSecret: 'Sembunyikan rahsia',
+        revealHelp:
+            'Simpan rahsia ini dengan selamat. Memaparkannya tidak mengaktifkan semula kunci yang dinyahdayakan atau tamat tempoh.',
+        deleteConfirm:
+            'Padam “{0}”? Rahsianya akan dimusnahkan dan kunci dibuang daripada senarai. Permintaan baharu akan ditolak dan terminal berkaitan ditutup. Rekod audit dikekalkan; tugas yang sedang berjalan tidak dibatalkan. Tindakan ini tidak boleh dibuat asal.',
         title: 'API Key',
         manage: 'Urus kunci API',
         personalEntry: 'Urus kunci, syarat akses dan pautan APP anda dalam Tetapan.',
@@ -23,11 +29,6 @@ const message = {
         allowAppBinding: 'Benarkan pautan APP melalui QR',
         bindingDisableHelp:
             'Menyahdayakan pautan QR menghalang pautan peranti baharu. Peranti yang telah dipautkan boleh terus digunakan sehingga kunci dinyahdayakan, dibatalkan atau tamat tempoh.',
-        saveSecret:
-            'Salin dan simpan kunci sekarang. Selepas ditutup, pengurusan biasa tidak dapat memaparkan kunci penuh lagi.',
-        saved: 'Saya telah menyimpan kunci',
-        alreadyCreated:
-            'Kunci ini telah dicipta dan tidak akan dipaparkan semula. Jika respons asal hilang, batalkan dan cipta semula atau gunakan QR jika dibenarkan.',
         uncertain:
             'Hasil permintaan belum pasti. Cuba semula dengan butiran sama untuk mengelakkan pendua, atau tutup dan semak senarai sebelum mencipta lagi.',
         legacyHelp:
@@ -1097,7 +1098,7 @@ const message = {
                 'Alamat kontena sesuai untuk kontena agen; 127.0.0.1, IP sistem, atau alamat tersuai sesuai untuk AI Gateway atau perkhidmatan luaran.',
             containerAddress: 'Alamat kontena',
             customAddress: 'Alamat tersuai',
-            downloader: 'Pengurusan muat turun',
+            downloader: 'Pemuat Turun',
             modelDir: 'Direktori Model',
             modelSource: 'Sumber model',
             repoID: 'ID Repositori',
@@ -2131,19 +2132,6 @@ const message = {
         batchUpgradeWaiting: 'Queued',
         batchUpgradeRunning: 'Upgrading',
         batchUpgradeSubmitted: 'Upgrade task submitted',
-        imageCheckUpdateProxyRequired:
-            'Untuk menyemak kemas kini imej dalam persekitaran semasa, sila konfigurasikan pelayan proksi terlebih dahulu.',
-        imageCheckUpdateConfigureProxy: 'Konfigurasi',
-        imageCheckUpdateAvailableVersion: 'Versi tersedia “{version}”',
-        imageCheckUpdateContentChanged: '(kandungan imej berubah)',
-        imageCheckUpdates: 'Semak kemas kini imej',
-        imageCheckUpdateNow: 'Semak sekarang',
-        imageCheckUpdateSchedule: 'Semakan berjadual',
-        imageCheckUpdateDisable: 'Matikan semakan berjadual',
-        imageCheckUpdateStarted: 'Menyemak kemas kini imej yang digunakan oleh semua kontena pada nod ini',
-        imageCheckUpdateResult:
-            'Semakan selesai: disemak {checked}, boleh dikemas kini {updates}, gagal {failed}, dilangkau {skipped}',
-
         createByCommand: 'Cipta melalui perintah',
         importContainerBackupTip: 'Import fail sandaran kontena, hanya format .tar.gz disokong',
         importComposeBackupTip: 'Import fail sandaran compose, hanya format .tar.gz disokong',
@@ -7087,7 +7075,7 @@ const message = {
                 'Cari repositori model HuggingFace secara langsung dan lihat muat turun, suka, butiran model dan senarai fail.',
             modelDownloaderTitle2: 'Muat Turun Dipercepat',
             modelDownloaderContent2:
-                'Konfigurasikan titik akhir pecutan HuggingFace dan HuggingFace Token untuk laman rasmi, cermin dan model persendirian.',
+                'Konfigurasikan titik akhir pecutan HuggingFace dan HF Token untuk laman rasmi, cermin dan model persendirian.',
             modelDownloaderTitle3: 'Penjejakan Tugas',
             modelDownloaderContent3:
                 'Semak baris gilir muat turun, status tugas, kemajuan dan ralat, dengan sokongan batal, cuba semula dan bersihkan rekod.',

frontend/src/lang/modules/pt-br.ts

@@ -2,6 +2,11 @@ import { getFuLocaleMessage } from '@/lang/fu';
 
 const message = {
     apiKeyManagement: {
+        reveal: 'Mostrar segredo',
+        hideSecret: 'Ocultar segredo',
+        revealHelp: 'Guarde o segredo com segurança. Exibi-lo não reativa chaves desabilitadas ou expiradas.',
+        deleteConfirm:
+            'Excluir “{0}”? O segredo será destruído e a chave removida da lista. Novas solicitações serão rejeitadas e os terminais associados serão fechados. Os registros de auditoria serão mantidos; tarefas em execução não serão canceladas. Esta ação é irreversível.',
         title: 'API Key',
         manage: 'Gerenciar chaves API',
         personalEntry: 'Gerencie suas chaves, condições de acesso e vínculo do APP nas Configurações.',
@@ -23,10 +28,6 @@ const message = {
         allowAppBinding: 'Permitir vínculo do APP por QR',
         bindingDisableHelp:
             'Desativar a vinculação por QR impede novas vinculações. Os dispositivos já vinculados podem continuar usando a chave até que ela seja desativada, revogada ou expire.',
-        saveSecret: 'Copie e salve a chave agora. Após fechar, o gerenciamento normal não poderá exibi-la novamente.',
-        saved: 'Salvei a chave',
-        alreadyCreated:
-            'Esta chave já foi criada e não será exibida novamente. Se a resposta original foi perdida, revogue e recrie a chave ou use o QR, se permitido.',
         uncertain:
             'O resultado é incerto. Tente novamente com os mesmos dados para evitar duplicações ou feche e verifique a lista antes de criar outra.',
         legacyHelp:
@@ -1092,7 +1093,7 @@ const message = {
                 'Use o endereço do contêiner para agentes; 127.0.0.1, IP do sistema ou endereço personalizado para AI Gateway ou serviços externos.',
             containerAddress: 'Endereço do contêiner',
             customAddress: 'Endereço personalizado',
-            downloader: 'Gerenciamento de downloads',
+            downloader: 'Baixador',
             modelDir: 'Diretório do modelo',
             modelSource: 'Fonte do modelo',
             repoID: 'ID do repositório',
@@ -2134,19 +2135,6 @@ const message = {
         batchUpgradeWaiting: 'Queued',
         batchUpgradeRunning: 'Upgrading',
         batchUpgradeSubmitted: 'Upgrade task submitted',
-        imageCheckUpdateProxyRequired:
-            'Para verificar atualizações de imagens no ambiente atual, configure primeiro um servidor proxy.',
-        imageCheckUpdateConfigureProxy: 'Configurar',
-        imageCheckUpdateAvailableVersion: 'Versão disponível “{version}”',
-        imageCheckUpdateContentChanged: '(conteúdo da imagem alterado)',
-        imageCheckUpdates: 'Verificar atualizações de imagens',
-        imageCheckUpdateNow: 'Verificar agora',
-        imageCheckUpdateSchedule: 'Verificação agendada',
-        imageCheckUpdateDisable: 'Desativar verificação agendada',
-        imageCheckUpdateStarted: 'Verificando atualizações das imagens de todos os contêineres deste nó',
-        imageCheckUpdateResult:
-            'Verificação concluída: verificados {checked}, atualizáveis {updates}, falhas {failed}, ignorados {skipped}',
-
         createByCommand: 'Criar por comando',
         importContainerBackupTip: 'Importar arquivo de backup de contêiner, apenas .tar.gz é suportado',
         importComposeBackupTip: 'Importar arquivo de backup de compose, apenas .tar.gz é suportado',
@@ -7130,7 +7118,7 @@ const message = {
                 'Pesquise repositórios de modelos do HuggingFace diretamente e veja downloads, curtidas, detalhes do modelo e lista de arquivos.',
             modelDownloaderTitle2: 'Downloads acelerados',
             modelDownloaderContent2:
-                'Configure um endpoint de aceleração do HuggingFace e HuggingFace Token para o site oficial, espelhos e modelos privados.',
+                'Configure um endpoint de aceleração do HuggingFace e HF Token para o site oficial, espelhos e modelos privados.',
             modelDownloaderTitle3: 'Acompanhamento de tarefas',
             modelDownloaderContent3:
                 'Veja filas de download, status, progresso e erros, com suporte para cancelar, tentar novamente e limpar registros.',

frontend/src/lang/modules/ru.ts

@@ -2,6 +2,11 @@ import { getFuLocaleMessage } from '@/lang/fu';
 
 const message = {
     apiKeyManagement: {
+        reveal: 'Показать секрет',
+        hideSecret: 'Скрыть секрет',
+        revealHelp: 'Храните секрет в безопасности. Просмотр не активирует отключённые или просроченные ключи.',
+        deleteConfirm:
+            'Удалить «{0}»? Секрет будет уничтожен, а ключ удалён из списка. Новые запросы будут отклонены, связанные терминалы закрыты. Журнал аудита сохранится; выполняющиеся задачи не отменяются. Действие необратимо.',
         title: 'API Key',
         manage: 'Управление API-ключами',
         personalEntry: 'Управляйте своими ключами, условиями доступа и привязкой приложения в настройках.',
@@ -23,11 +28,6 @@ const message = {
         allowAppBinding: 'Разрешить привязку приложения по QR',
         bindingDisableHelp:
             'Отключение привязки по QR-коду запрещает новые привязки. Уже привязанные устройства могут продолжать работу, пока ключ не будет отключён, отозван или не истечёт срок его действия.',
-        saveSecret:
-            'Скопируйте и сохраните ключ сейчас. После закрытия обычное управление не сможет показать полный ключ снова.',
-        saved: 'Ключ сохранён',
-        alreadyCreated:
-            'Ключ уже создан и не будет показан повторно. Если исходный ответ потерян, отзовите и создайте ключ заново либо используйте разрешённую привязку по QR.',
         uncertain:
             'Результат запроса неизвестен. Повторите с теми же данными, чтобы избежать дублей, или закройте и проверьте список.',
         legacyHelp:
@@ -1085,7 +1085,7 @@ const message = {
                 'Адрес контейнера подходит для контейнеров агентов; 127.0.0.1, системный IP или пользовательский адрес подходит для AI Gateway или внешних сервисов.',
             containerAddress: 'Адрес контейнера',
             customAddress: 'Пользовательский адрес',
-            downloader: 'Управление загрузками',
+            downloader: 'Загрузчик',
             modelDir: 'Каталог модели',
             modelSource: 'Источник модели',
             repoID: 'ID репозитория',
@@ -2127,19 +2127,6 @@ const message = {
         batchUpgradeWaiting: 'Queued',
         batchUpgradeRunning: 'Upgrading',
         batchUpgradeSubmitted: 'Upgrade task submitted',
-        imageCheckUpdateProxyRequired:
-            'Для проверки обновлений образов в текущей среде сначала настройте прокси-сервер.',
-        imageCheckUpdateConfigureProxy: 'Настроить',
-        imageCheckUpdateAvailableVersion: 'Доступна версия «{version}»',
-        imageCheckUpdateContentChanged: '(содержимое образа изменилось)',
-        imageCheckUpdates: 'Проверить обновления образов',
-        imageCheckUpdateNow: 'Проверить сейчас',
-        imageCheckUpdateSchedule: 'Проверка по расписанию',
-        imageCheckUpdateDisable: 'Отключить проверку по расписанию',
-        imageCheckUpdateStarted: 'Проверка обновлений образов всех контейнеров на текущем узле',
-        imageCheckUpdateResult:
-            'Проверка завершена: проверено {checked}, доступны обновления {updates}, ошибок {failed}, пропущено {skipped}',
-
         createByCommand: 'Создать с помощью команды',
         importContainerBackupTip: 'Импорт файла резервной копии контейнера, поддерживается только .tar.gz',
         importComposeBackupTip: 'Импорт файла резервной копии compose, поддерживается только .tar.gz',
@@ -7099,7 +7086,7 @@ const message = {
                 'Ищите репозитории моделей HuggingFace напрямую и просматривайте загрузки, лайки, сведения о модели и список файлов.',
             modelDownloaderTitle2: 'Ускоренные загрузки',
             modelDownloaderContent2:
-                'Настройте endpoint ускорения HuggingFace и HuggingFace Token для официального сайта, зеркал и приватных моделей.',
+                'Настройте endpoint ускорения HuggingFace и HF Token для официального сайта, зеркал и приватных моделей.',
             modelDownloaderTitle3: 'Отслеживание задач',
             modelDownloaderContent3:
                 'Просматривайте очередь загрузок, статус, прогресс и ошибки, отменяйте, повторяйте и очищайте записи.',

frontend/src/lang/modules/tr.ts

@@ -2,6 +2,12 @@ import { getFuLocaleMessage } from '@/lang/fu';
 
 const message = {
     apiKeyManagement: {
+        reveal: 'Gizli anahtarı göster',
+        hideSecret: 'Gizli anahtarı gizle',
+        revealHelp:
+            'Gizli anahtarı güvenli tutun. Görüntülemek, devre dışı veya süresi dolmuş anahtarı kullanılabilir yapmaz.',
+        deleteConfirm:
+            '“{0}” silinsin mi? Gizli anahtar yok edilecek ve listeden kaldırılacaktır. Yeni istekler reddedilecek ve ilgili terminaller kapatılacaktır. Denetim kayıtları korunur; çalışan işler iptal edilmez. Bu işlem geri alınamaz.',
         title: 'API Key',
         manage: 'API anahtarlarını yönet',
         personalEntry: 'Ayarlar bölümünde anahtarlarınızı, erişim koşullarını ve uygulama QR bağlantısını yönetin.',
@@ -23,11 +29,6 @@ const message = {
         allowAppBinding: 'Uygulama QR bağlantısına izin ver',
         bindingDisableHelp:
             'QR eşleştirmesini devre dışı bırakmak yeni eşleştirmeleri engeller. Eşleştirilmiş cihazlar, anahtar devre dışı bırakılana, iptal edilene veya süresi dolana kadar kullanılmaya devam edebilir.',
-        saveSecret:
-            'Anahtarı şimdi kopyalayıp kaydedin. Kapattıktan sonra normal anahtar yönetimi tam anahtarı yeniden gösteremez.',
-        saved: 'Anahtarı kaydettim',
-        alreadyCreated:
-            'Bu anahtar zaten oluşturuldu ve yeniden gösterilmez. İlk yanıt kaybolduysa iptal edip yeniden oluşturun veya izin veriliyorsa QR bağlantısını kullanın.',
         uncertain:
             'İstek sonucu belirsiz. Tekrarları önlemek için aynı bilgilerle yeniden deneyin veya kapatıp yeni anahtar oluşturmadan listeyi kontrol edin.',
         legacyHelp:
@@ -1096,7 +1097,7 @@ const message = {
                 'Konteyner adresi ajan konteynerleri içindir; 127.0.0.1, sistem IP veya özel adres AI Gateway ya da harici servisler içindir.',
             containerAddress: 'Konteyner adresi',
             customAddress: 'Özel adres',
-            downloader: 'İndirme yönetimi',
+            downloader: 'İndirici',
             modelDir: 'Model dizini',
             modelSource: 'Model kaynağı',
             repoID: 'Depo ID',
@@ -2132,19 +2133,6 @@ const message = {
         batchUpgradeWaiting: 'Queued',
         batchUpgradeRunning: 'Upgrading',
         batchUpgradeSubmitted: 'Upgrade task submitted',
-        imageCheckUpdateProxyRequired:
-            'Geçerli çalışma ortamında imaj güncellemelerini kontrol etmek için önce bir proxy sunucusu yapılandırın.',
-        imageCheckUpdateConfigureProxy: 'Yapılandır',
-        imageCheckUpdateAvailableVersion: 'Yükseltilebilir sürüm “{version}”',
-        imageCheckUpdateContentChanged: '(imaj içeriği değişti)',
-        imageCheckUpdates: 'İmaj güncellemelerini denetle',
-        imageCheckUpdateNow: 'Şimdi denetle',
-        imageCheckUpdateSchedule: 'Zamanlanmış denetim',
-        imageCheckUpdateDisable: 'Zamanlanmış denetimi kapat',
-        imageCheckUpdateStarted: 'Bu düğümdeki tüm konteynerlerin imaj güncellemeleri denetleniyor',
-        imageCheckUpdateResult:
-            'Denetim tamamlandı: denetlenen {checked}, güncellenebilir {updates}, başarısız {failed}, atlanan {skipped}',
-
         createByCommand: 'Komutla oluştur',
         importContainerBackupTip: 'Konteyner yedek dosyasını içe aktar, yalnızca .tar.gz desteklenir',
         importComposeBackupTip: 'Compose yedek dosyasını içe aktar, yalnızca .tar.gz desteklenir',
@@ -7107,7 +7095,7 @@ const message = {
                 'HuggingFace model depolarını doğrudan arayın; indirme sayısı, beğeni, model ayrıntıları ve dosya listesini görüntüleyin.',
             modelDownloaderTitle2: 'Hızlandırılmış İndirme',
             modelDownloaderContent2:
-                'Resmi site, aynalar ve özel modeller için HuggingFace hızlandırma endpointi ve HuggingFace Token yapılandırın.',
+                'Resmi site, aynalar ve özel modeller için HuggingFace hızlandırma endpointi ve HF Token yapılandırın.',
             modelDownloaderTitle3: 'Görev Takibi',
             modelDownloaderContent3:
                 'İndirme kuyruğunu, görev durumunu, ilerlemeyi ve hataları görüntüleyin; iptal, yeniden deneme ve kayıt temizlemeyi destekler.',

frontend/src/lang/modules/zh-Hant.ts

@@ -2,6 +2,11 @@ import { getFuLocaleMessage } from '@/lang/fu';
 
 const message = {
     apiKeyManagement: {
+        reveal: '檢視密鑰',
+        hideSecret: '隱藏密鑰',
+        revealHelp: '請妥善保管密鑰。檢視不會恢復已停用或已過期密鑰的使用權限。',
+        deleteConfirm:
+            '確定刪除「{0}」嗎？密鑰將被銷毀並從列表移除，拒絕後續請求並關閉關聯終端。稽核記錄仍保留，執行中的工作不會取消，此操作無法復原。',
         title: 'API Key',
         manage: '管理 API Key',
         personalEntry: '前往設定管理自己的金鑰、存取條件與 APP 掃碼綁定。',
@@ -22,10 +27,6 @@ const message = {
         futureExpiry: '請選擇晚於目前時間的到期時間。',
         allowAppBinding: '允許 APP 掃碼綁定',
         bindingDisableHelp: '關閉掃碼綁定後，將停止接受新的綁定；已綁定裝置可繼續使用，直至金鑰被停用、撤銷或到期。',
-        saveSecret: '請立即複製並儲存金鑰。關閉後，一般金鑰管理無法再次顯示完整金鑰。',
-        saved: '我已儲存金鑰',
-        alreadyCreated:
-            '這把金鑰已建立，無法再次顯示明文。若原回應遺失，請撤銷後重新建立；允許掃碼綁定時，也可透過掃碼交付。',
         uncertain: '請求結果尚不確定。請保持原設定重試，避免重複建立；或關閉並檢查清單後再建立其他金鑰。',
         legacyHelp: '舊版 Key 用於相容歷史 API 連線，啟用、停用及重設操作僅對該 Key 生效。',
         showLegacy: '檢視舊版金鑰',
@@ -1025,7 +1026,7 @@ const message = {
                 '容器地址適合智能體容器呼叫；127.0.0.1、本機 IP 或自訂地址適合 AI 閘道或外部服務呼叫。',
             containerAddress: '容器地址',
             customAddress: '自訂地址',
-            downloader: '下載管理',
+            downloader: '下載器',
             modelDir: '模型目錄',
             modelSource: '模型來源',
             repoID: '倉庫 ID',
@@ -1997,17 +1998,6 @@ const message = {
         batchUpgradeWaiting: '等待執行',
         batchUpgradeRunning: '正在升級',
         batchUpgradeSubmitted: '已提交升級任務',
-        imageCheckUpdateProxyRequired: '目前運行環境下，如需檢查映像是否更新，請先設定代理伺服器',
-        imageCheckUpdateConfigureProxy: '前往設定',
-        imageCheckUpdateAvailableVersion: '可升級版本「{version}」',
-        imageCheckUpdateContentChanged: '（映像內容變更）',
-        imageCheckUpdates: '檢查更新映像',
-        imageCheckUpdateNow: '立即檢查',
-        imageCheckUpdateSchedule: '定時檢查',
-        imageCheckUpdateDisable: '關閉定時檢查',
-        imageCheckUpdateStarted: '已開始檢查目前節點全部容器的映像更新',
-        imageCheckUpdateResult: '檢查完成：成功 {checked}，可升級 {updates}，失敗 {failed}，略過 {skipped}',
-
         createByCommand: '指令建立',
         importContainerBackupTip: '匯入容器備份檔案，僅支援 .tar.gz 格式',
         importComposeBackupTip: '匯入編排備份檔案，僅支援 .tar.gz 格式',
@@ -6495,8 +6485,7 @@ const message = {
             modelDownloaderTitle1: '模型發現',
             modelDownloaderContent1: '直接搜尋 HuggingFace 模型倉庫，檢視下載量、點讚數、模型詳情與檔案列表。',
             modelDownloaderTitle2: '加速下載',
-            modelDownloaderContent2:
-                '支援設定 HuggingFace 加速地址與 HuggingFace Token，適配官方站、鏡像站和私有模型存取。',
+            modelDownloaderContent2: '支援設定 HuggingFace 加速地址與 HF Token，適配官方站、鏡像站和私有模型存取。',
             modelDownloaderTitle3: '任務追蹤',
             modelDownloaderContent3: '統一檢視下載佇列、任務狀態、進度、錯誤資訊，並支援取消、重試和記錄清理。',
             modelDownloaderTitle4: '本地管理',

frontend/src/lang/modules/zh.ts

@@ -2,6 +2,11 @@ import { getFuLocaleMessage } from '@/lang/fu';
 
 const message = {
     apiKeyManagement: {
+        reveal: '查看密钥',
+        hideSecret: '隐藏密钥',
+        revealHelp: '请妥善保管密钥。查看不会恢复已停用或已过期密钥的使用权限。',
+        deleteConfirm:
+            '确定删除“{0}”吗？密钥将被销毁并从列表移除，拒绝后续请求并关闭关联终端。审计记录仍保留，运行中的任务不会取消，此操作不可恢复。',
         title: 'API Key',
         manage: '管理 API Key',
         personalEntry: '前往设置管理自己的密钥、访问条件和 APP 扫码绑定。',
@@ -22,10 +27,6 @@ const message = {
         futureExpiry: '请选择晚于当前时间的到期时间。',
         allowAppBinding: '允许 APP 扫码绑定',
         bindingDisableHelp: '关闭扫码绑定后，将停止接受新的绑定；已绑定设备可继续使用，直至密钥被停用、撤销或到期。',
-        saveSecret: '请立即复制并保存密钥。关闭后，普通密钥管理无法再次显示完整密钥。',
-        saved: '我已保存密钥',
-        alreadyCreated:
-            '这把密钥已创建，无法再次展示明文。若原响应丢失，请撤销后重新创建；允许扫码绑定时，也可通过扫码交付。',
         uncertain: '请求结果尚不确定。请保持原配置重试，避免重复创建；或关闭并检查列表后再创建其他密钥。',
         legacyHelp: '旧版 Key 用于兼容历史 API 连接，启用、停用和重置操作仅对该 Key 生效。',
         showLegacy: '查看旧版密钥',
@@ -1038,7 +1039,7 @@ const message = {
                 '容器地址适合智能体容器调用；127.0.0.1、本机 IP 或自定义地址适合 AI 网关或外部服务调用。',
             containerAddress: '容器地址',
             customAddress: '自定义地址',
-            downloader: '下载管理',
+            downloader: '下载器',
             modelDir: '模型目录',
             modelSource: '模型来源',
             repoID: '仓库 ID',
@@ -2006,17 +2007,6 @@ const message = {
         batchUpgradeWaiting: '等待执行',
         batchUpgradeRunning: '正在升级',
         batchUpgradeSubmitted: '已提交升级任务',
-        imageCheckUpdateProxyRequired: '当前运行环境下，如需检查镜像是否更新，请优先配置代理服务器',
-        imageCheckUpdateConfigureProxy: '去配置',
-        imageCheckUpdateAvailableVersion: '可升级版本 “{version}”',
-        imageCheckUpdateContentChanged: '（镜像内容变化）',
-        imageCheckUpdates: '检查更新镜像',
-        imageCheckUpdateNow: '立即检查',
-        imageCheckUpdateSchedule: '定时检查',
-        imageCheckUpdateDisable: '关闭定时检查',
-        imageCheckUpdateStarted: '已开始检查当前节点全部容器的镜像更新',
-        imageCheckUpdateResult: '检查完成：成功 {checked}，可升级 {updates}，失败 {failed}，跳过 {skipped}',
-
         createByCommand: '命令创建',
         importContainerBackupTip: '导入容器备份文件，仅支持 .tar.gz 格式',
         importComposeBackupTip: '导入编排备份文件，仅支持 .tar.gz 格式',
@@ -5453,8 +5443,7 @@ const message = {
             modelDownloaderTitle1: '模型发现',
             modelDownloaderContent1: '直接搜索 HuggingFace 模型仓库，查看下载量、点赞数、模型详情与文件列表。',
             modelDownloaderTitle2: '加速下载',
-            modelDownloaderContent2:
-                '支持配置 HuggingFace 加速地址与 HuggingFace Token，适配官方站、镜像站和私有模型访问。',
+            modelDownloaderContent2: '支持配置 HuggingFace 加速地址与 HF Token，适配官方站、镜像站和私有模型访问。',
             modelDownloaderTitle3: '任务追踪',
             modelDownloaderContent3: '统一查看下载队列、任务状态、进度、错误信息，并支持取消、重试和记录清理。',
             modelDownloaderTitle4: '本地管理',

frontend/src/views/container/container/index.vue

@@ -31,34 +31,6 @@
                 <el-button v-permission type="primary" plain @click="onClean()">
                     {{ $t('container.containerPrune') }}
                 </el-button>
-                <el-dropdown v-permission trigger="click" @command="onImageCheckUpdateCommand">
-                    <el-button type="primary" plain :loading="imageCheckUpdateBusy">
-                        {{ $t('container.imageCheckUpdates') }}
-                        <el-icon class="el-icon--right"><ArrowDown /></el-icon>
-                    </el-button>
-                    <template #dropdown>
-                        <el-dropdown-menu>
-                            <el-dropdown-item
-                                command="check"
-                                :disabled="imageCheckUpdateBusy || imageCheckUpdateStatus?.running"
-                            >
-                                {{ $t('container.imageCheckUpdateNow') }}
-                            </el-dropdown-item>
-                            <el-dropdown-item
-                                command="schedule"
-                                :disabled="imageCheckUpdateBusy || !imageCheckUpdateStatus"
-                            >
-                                {{
-                                    $t(
-                                        imageCheckUpdateStatus?.enabled
-                                            ? 'container.imageCheckUpdateDisable'
-                                            : 'container.imageCheckUpdateSchedule',
-                                    )
-                                }}
-                            </el-dropdown-item>
-                        </el-dropdown-menu>
-                    </template>
-                </el-dropdown>
             </template>
             <template #rightToolBar>
                 <TableViewSwitch v-model="viewMode" storage-key="container" />
@@ -500,15 +472,8 @@ import Uploads from '@/components/upload/index.vue';
 import DockerStatus from '@/views/container/docker-status/index.vue';
 import ContainerLogDialog from '@/components/log/container-drawer/index.vue';
 import Status from '@/components/status/index.vue';
-import { toRef, computed, onMounted, onActivated, onBeforeUnmount, onDeactivated, reactive, ref, watch } from 'vue';
-import { ElMessageBox } from 'element-plus';
-import { ArrowDown } from '@element-plus/icons-vue';
+import { toRef, computed, onBeforeUnmount, onDeactivated, reactive, ref } from 'vue';
 import {
-    getContainerImageCheckUpdateStatus,
-    getImageRemoteCheckStatus,
-    runContainerImageCheckUpdate,
-    setContainerImageCheckUpdateSchedule,
-    type ContainerImageCheckUpdateStatus,
     containerItemStats,
     containerListStats,
     containerOperator,
@@ -812,125 +777,6 @@ const loadContainers = async (background = false, column?: any) => {
 
 const search = (column?: any) => loadContainers(false, column);
 
-const imageCheckUpdateStatus = ref<ContainerImageCheckUpdateStatus>();
-const imageCheckUpdateBusy = ref(false);
-let imageCheckUpdateTimer: ReturnType<typeof setTimeout> | undefined;
-let imageCheckUpdateGeneration = 0;
-let imageCheckUpdateActive = false;
-let imageCheckUpdateController: AbortController | undefined;
-const pauseImageCheckUpdatePolling = () => {
-    imageCheckUpdateGeneration++;
-    clearTimeout(imageCheckUpdateTimer);
-    imageCheckUpdateController?.abort();
-    imageCheckUpdateController = undefined;
-};
-const stopImageCheckUpdatePolling = () => {
-    imageCheckUpdateActive = false;
-    pauseImageCheckUpdatePolling();
-};
-const showImageCheckUpdateResult = (status: ContainerImageCheckUpdateStatus) => {
-    if (status.error) MsgWarning(status.error);
-    else {
-        const summary = i18n.global.t('container.imageCheckUpdateResult', { ...status });
-        if (status.failed) MsgWarning(summary);
-        else MsgSuccess(summary);
-    }
-};
-const refreshImageCheckUpdateStatus = async (generation: number) => {
-    if (!imageCheckUpdateActive || document.hidden || generation !== imageCheckUpdateGeneration) return;
-    const node = currentNode.value;
-    const controller = new AbortController();
-    imageCheckUpdateController = controller;
-    try {
-        const res = await getContainerImageCheckUpdateStatus(node, controller.signal);
-        if (generation !== imageCheckUpdateGeneration || node !== currentNode.value) return;
-        const previous = imageCheckUpdateStatus.value;
-        imageCheckUpdateStatus.value = res.data;
-        if (previous && res.data.finishedAt && previous.finishedAt !== res.data.finishedAt) {
-            await loadContainers();
-            if (generation !== imageCheckUpdateGeneration || node !== currentNode.value) return;
-            showImageCheckUpdateResult(res.data);
-        }
-    } catch {
-        // The HTTP layer displays errors. Retry on the next status poll.
-    } finally {
-        if (imageCheckUpdateController === controller) imageCheckUpdateController = undefined;
-        if (generation === imageCheckUpdateGeneration && imageCheckUpdateActive && !document.hidden) {
-            const interval = imageCheckUpdateStatus.value?.running ? 10000 : 60000;
-            imageCheckUpdateTimer = setTimeout(() => refreshImageCheckUpdateStatus(generation), interval);
-        }
-    }
-};
-const restartImageCheckUpdatePolling = () => {
-    pauseImageCheckUpdatePolling();
-    if (imageCheckUpdateActive && !document.hidden) void refreshImageCheckUpdateStatus(imageCheckUpdateGeneration);
-};
-const startImageCheckUpdatePolling = () => {
-    if (imageCheckUpdateActive) return;
-    imageCheckUpdateActive = true;
-    restartImageCheckUpdatePolling();
-};
-const onImageCheckUpdateCommand = async (command: string) => {
-    const node = currentNode.value;
-    const generation = imageCheckUpdateGeneration;
-    imageCheckUpdateBusy.value = true;
-    try {
-        const status = await getContainerImageCheckUpdateStatus(node);
-        if (generation !== imageCheckUpdateGeneration || node !== currentNode.value) return;
-        imageCheckUpdateStatus.value = status.data;
-        // Disabling an existing schedule must remain possible without a proxy.
-        const proxyStatus =
-            command === 'check' || !status.data.enabled ? await getImageRemoteCheckStatus(node) : undefined;
-        if (generation !== imageCheckUpdateGeneration || node !== currentNode.value) return;
-        if (proxyStatus?.data.proxyRequired) {
-            try {
-                await ElMessageBox.confirm(i18n.global.t('container.imageCheckUpdateProxyRequired'), '', {
-                    confirmButtonText: i18n.global.t('container.imageCheckUpdateConfigureProxy'),
-                    cancelButtonText: i18n.global.t('commons.button.cancel'),
-                    type: 'warning',
-                });
-                if (node === currentNode.value) routerToName('Panel');
-            } catch {
-                // Cancellation leaves the check and schedule untouched.
-            }
-            return;
-        }
-        const res =
-            command === 'check'
-                ? await runContainerImageCheckUpdate(node)
-                : await setContainerImageCheckUpdateSchedule(!imageCheckUpdateStatus.value?.enabled, node);
-        if (generation !== imageCheckUpdateGeneration || node !== currentNode.value) return;
-        imageCheckUpdateStatus.value = res.data;
-        if (command === 'check' && res.data.taskID) openTaskLog(res.data.taskID);
-        if (command === 'check' && !res.data.running) {
-            showImageCheckUpdateResult(res.data);
-            await loadContainers();
-        } else {
-            MsgSuccess(
-                i18n.global.t(
-                    command === 'check' ? 'container.imageCheckUpdateStarted' : 'commons.msg.operationSuccess',
-                ),
-            );
-        }
-        if (generation === imageCheckUpdateGeneration && node === currentNode.value) restartImageCheckUpdatePolling();
-    } catch {
-        // The HTTP layer reports failures; keep the last confirmed schedule state.
-    } finally {
-        if (node === currentNode.value) imageCheckUpdateBusy.value = false;
-    }
-};
-onMounted(startImageCheckUpdatePolling);
-onMounted(() => document.addEventListener('visibilitychange', restartImageCheckUpdatePolling));
-onBeforeUnmount(() => document.removeEventListener('visibilitychange', restartImageCheckUpdatePolling));
-onActivated(startImageCheckUpdatePolling);
-onBeforeUnmount(stopImageCheckUpdatePolling);
-onDeactivated(stopImageCheckUpdatePolling);
-watch(currentNode, () => {
-    imageCheckUpdateStatus.value = undefined;
-    imageCheckUpdateBusy.value = false;
-    restartImageCheckUpdatePolling();
-});
-
 const searchWithStatus = (item: string) => {
     activeTag.value = item;
     paginationConfig.state = activeTag.value;
@@ -1148,15 +994,8 @@ const buttons = [
     {
         label: i18n.global.t('commons.button.upgrade'),
         permission: true,
-        dot: (row: Container.ContainerInfo) => Boolean(row.hasUpdate),
         click: (row: Container.ContainerInfo) => {
-            dialogUpgradeRef.value!.acceptParams({
-                container: row.name,
-                image: row.imageName,
-                fromApp: row.isFromApp,
-                latestVersion: row.latestVersion,
-                hasUpdate: row.hasUpdate,
-            });
+            dialogUpgradeRef.value!.acceptParams({ container: row.name, image: row.imageName, fromApp: row.isFromApp });
         },
     },
     {

frontend/src/views/container/container/upgrade/index.vue

@@ -54,13 +54,6 @@
                         :disabled="loading || !group.names.length || !isGroupEditable(group)"
                     />
                     <span class="input-help">{{ $t('container.upgradeHelper') }}</span>
-                    <div v-if="group.availableVersion" class="input-help">
-                        {{ $t('container.imageCheckUpdateAvailableVersion', { version: group.availableVersion }) }}
-                        <span v-if="imageTag(group.currentImage) === group.availableVersion">
-                            {{ $t('container.imageCheckUpdateContentChanged') }}
-                        </span>
-                        <CopyButton :content="group.availableVersion" />
-                    </div>
                 </el-form-item>
                 <div v-if="group.state !== 'draft'" class="mb-3">
                     <el-tag :type="statusType(group)">{{ statusLabel(group) }}</el-tag>
@@ -107,7 +100,6 @@ import { GlobalStore } from '@/store';
 interface UpgradeGroup {
     currentImage: string;
     targetImage: string;
-    availableVersion: string;
     names: string[];
     appNames: string[];
     options: Container.ContainerOption[];
@@ -120,14 +112,7 @@ interface DialogProps {
     container: string;
     image: string;
     fromApp: boolean;
-    latestVersion?: string;
-    hasUpdate?: boolean;
 }
-const imageTag = (image: string) => {
-    const name = image.slice(image.lastIndexOf('/') + 1);
-    const separator = name.lastIndexOf(':');
-    return separator < 0 ? 'latest' : name.slice(separator + 1);
-};
 const isBatch = ref(false);
 const isGroupEditable = (group: UpgradeGroup) => ['draft', 'failed'].includes(group.state);
 const isGroupChecked = (group: UpgradeGroup) => group.options.length > 0 && group.names.length === group.options.length;
@@ -152,15 +137,7 @@ const acceptParams = async (props: DialogProps | Container.ContainerInfo[]) => {
     isBatch.value = Array.isArray(props);
     const containers = Array.isArray(props)
         ? props
-        : [
-              {
-                  name: props.container,
-                  imageName: props.image,
-                  isFromApp: props.fromApp,
-                  latestVersion: props.latestVersion,
-                  hasUpdate: props.hasUpdate,
-              },
-          ];
+        : [{ name: props.container, imageName: props.image, isFromApp: props.fromApp }];
     operateNode = GlobalStore().currentNode;
     clearTimeout(timer);
     generation++;
@@ -171,7 +148,6 @@ const acceptParams = async (props: DialogProps | Container.ContainerInfo[]) => {
             group = {
                 currentImage: item.imageName,
                 targetImage: item.imageName.includes('sha256:') ? '' : item.imageName,
-                availableVersion: '',
                 names: [],
                 appNames: [],
                 options: [],
@@ -182,7 +158,6 @@ const acceptParams = async (props: DialogProps | Container.ContainerInfo[]) => {
             };
             groups.set(item.imageName, group);
         }
-        if (item.hasUpdate && item.latestVersion) group.availableVersion = item.latestVersion;
         if (!group.names.includes(item.name)) {
             group.names.push(item.name);
             group.options.push({ name: item.name, state: '' });
@@ -190,7 +165,7 @@ const acceptParams = async (props: DialogProps | Container.ContainerInfo[]) => {
         if (item.isFromApp && !group.appNames.includes(item.name)) group.appNames.push(item.name);
     }
     form.groups = [...groups.values()];
-    form.forcePull = containers.some((item) => item.hasUpdate);
+    form.forcePull = false;
     started.value = false;
     visible.value = true;
     formRef.value?.clearValidate();

frontend/src/views/setting/api-keys/index.vue

@@ -42,7 +42,7 @@
                                     />
                                 </el-tooltip>
                             </div>
-                            <div class="text-xs text-gray-500 break-all">{{ row.keyHint }}</div>
+                            <div class="text-xs text-[var(--el-text-color-secondary)] break-all">{{ row.keyHint }}</div>
                         </template>
                     </el-table-column>
                     <el-table-column :label="$t('commons.table.status')" min-width="100" prop="status">
@@ -137,26 +137,50 @@
             v-model="detailVisible"
             :header="$t('apiKeyManagement.details')"
             size="min(640px, 100vw)"
-            @close="clearLegacySecret"
+            @close="clearSecret"
         >
             <APIKeySummary v-if="detail" :item="detail" />
-            <div v-if="detail?.kind === 'legacy' && detail.status !== 'Revoked'" class="mt-5 flex flex-col gap-3">
-                <el-alert :title="$t('apiKeyManagement.legacyHelp')" type="info" :closable="false" show-icon />
-                <el-space wrap>
-                    <el-button type="primary" plain :loading="legacyBusy" @click="revealLegacy">
-                        {{ $t('apiKeyManagement.showLegacy') }}
+            <div v-if="detail && detail.status !== 'Revoked'" class="mt-5 flex flex-col gap-3">
+                <el-alert
+                    :title="
+                        $t(detail.kind === 'legacy' ? 'apiKeyManagement.legacyHelp' : 'apiKeyManagement.revealHelp')
+                    "
+                    type="info"
+                    :closable="false"
+                    show-icon
+                />
+                <el-space v-if="detail.kind === 'legacy'" wrap>
+                    <el-button :disabled="secretBusy" @click="resetLegacy">
+                        {{ $t('setting.apiKeyReset') }}
                     </el-button>
-                    <el-button :disabled="legacyBusy" @click="resetLegacy">{{ $t('setting.apiKeyReset') }}</el-button>
                 </el-space>
                 <el-input
-                    v-if="legacySecret"
-                    :model-value="legacySecret"
+                    :model-value="secret || '********'"
+                    :type="secret ? 'text' : 'password'"
                     :aria-label="$t('setting.apiKey')"
                     readonly
                     autocomplete="off"
                 >
+                    <template #suffix>
+                        <el-button
+                            link
+                            :icon="secret ? Hide : View"
+                            :loading="secretBusy && secretAction === 'reveal'"
+                            :disabled="loading || secretBusy"
+                            :aria-label="$t(secret ? 'apiKeyManagement.hideSecret' : 'apiKeyManagement.reveal')"
+                            :title="$t(secret ? 'apiKeyManagement.hideSecret' : 'apiKeyManagement.reveal')"
+                            :aria-pressed="!!secret"
+                            @click="toggleSecret"
+                        />
+                    </template>
                     <template #append>
-                        <CopyButton :content="legacySecret" :is-icon="false" />
+                        <el-button
+                            :loading="secretBusy && secretAction === 'copy'"
+                            :disabled="loading || secretBusy"
+                            @click="copySecret"
+                        >
+                            {{ $t('commons.button.copy') }}
+                        </el-button>
                     </template>
                 </el-input>
             </div>
@@ -165,10 +189,11 @@
 </template>
 
 <script setup lang="ts">
-import { computed, onActivated, onBeforeUnmount, onDeactivated, onMounted, reactive, ref } from 'vue';
+import { computed, onActivated, onBeforeUnmount, onDeactivated, onMounted, reactive, ref, watch } from 'vue';
 import { ElMessageBox } from 'element-plus';
+import { Hide, View } from '@element-plus/icons-vue';
 import type { APIKey } from '@/api/interface/api-key';
-import { revokeAPIKey, searchAPIKeys, setAPIKeyStatus } from '@/api/modules/api-key';
+import { deleteAPIKey, revealAPIKey, revokeAPIKey, searchAPIKeys, setAPIKeyStatus } from '@/api/modules/api-key';
 import { generateApiKey, getUserInfo } from '@/api/modules/auth';
 import APIKeyEditor from '@/components/api-key-management/editor.vue';
 import APIKeySummary from '@/components/api-key-management/summary.vue';
@@ -176,35 +201,38 @@ import DrawerPro from '@/components/drawer-pro/index.vue';
 import type { FuTableOperationButton } from '@/components/table/shared';
 import { isAnyAPIKeyIP, normalizeAPIKeyIPs } from '@/utils/api-key';
 import { MsgSuccess, MsgWarning } from '@/utils/message';
+import { copyText } from '@/utils/clipboard';
 import i18n from '@/lang';
 import { useGlobalStore } from '@/composables/useGlobalStore';
 
-const { isMobile } = useGlobalStore();
+const { isMobile, globalStore } = useGlobalStore();
 
 const items = ref<APIKey.Item[]>([]);
 const loading = ref(false);
 const editor = ref<InstanceType<typeof APIKeyEditor>>();
 const detail = ref<APIKey.Item>();
 const detailVisible = ref(false);
-const legacySecret = ref('');
-const legacyBusy = ref(false);
+const secret = ref('');
+const secretBusy = ref(false);
+const secretAction = ref<'reveal' | 'copy'>('reveal');
 const pagination = reactive({ currentPage: 1, pageSize: 20, total: 0 });
 let searchVersion = 0;
 let secretRequestVersion = 0;
 let active = false;
+let operationPending = false;
 
 const whitelistEntries = (value: string) =>
     normalizeAPIKeyIPs(value || '')
         .split('\n')
         .filter(Boolean);
 
-const clearLegacySecret = () => {
+const clearSecret = () => {
     secretRequestVersion++;
-    legacySecret.value = '';
-    legacyBusy.value = false;
+    secret.value = '';
+    secretBusy.value = false;
 };
 
-const search = async (preserveLegacyRequest?: number) => {
+const search = async (preserveSecretRequest?: number) => {
     const ticket = ++searchVersion;
     loading.value = true;
     try {
@@ -213,7 +241,7 @@ const search = async (preserveLegacyRequest?: number) => {
         const lastPage = Math.max(1, Math.ceil(response.data.total / pagination.pageSize));
         if (pagination.currentPage > lastPage) {
             pagination.currentPage = lastPage;
-            await search(preserveLegacyRequest);
+            await search(preserveSecretRequest);
             return;
         }
         items.value = response.data.items || [];
@@ -221,8 +249,8 @@ const search = async (preserveLegacyRequest?: number) => {
         if (detail.value) {
             const previousRevision = detail.value.revision;
             detail.value = items.value.find((entry) => entry.id === detail.value?.id);
-            if (detail.value?.revision !== previousRevision && preserveLegacyRequest !== secretRequestVersion)
-                clearLegacySecret();
+            if (detail.value?.revision !== previousRevision && preserveSecretRequest !== secretRequestVersion)
+                clearSecret();
             if (!detail.value) detailVisible.value = false;
         }
     } finally {
@@ -230,7 +258,7 @@ const search = async (preserveLegacyRequest?: number) => {
     }
 };
 const showDetail = (entry: APIKey.Item) => {
-    clearLegacySecret();
+    clearSecret();
     detail.value = entry;
     detailVisible.value = true;
 };
@@ -239,15 +267,19 @@ const operate = async (entry: APIKey.Item, action: string) => {
         editor.value?.open(entry);
         return;
     }
-    if (action !== 'status' && action !== 'revoke') return;
+    if (!active || operationPending || !['status', 'revoke', 'delete'].includes(action)) return;
+    operationPending = true;
+    const requestVersion = searchVersion;
     try {
         await ElMessageBox.confirm(
             i18n.global.t(
-                action === 'revoke'
-                    ? 'apiKeyManagement.revokeConfirm'
-                    : entry.status === 'Enable'
-                      ? 'apiKeyManagement.disableConfirm'
-                      : 'apiKeyManagement.enableConfirm',
+                action === 'delete'
+                    ? 'apiKeyManagement.deleteConfirm'
+                    : action === 'revoke'
+                      ? 'apiKeyManagement.revokeConfirm'
+                      : entry.status === 'Enable'
+                        ? 'apiKeyManagement.disableConfirm'
+                        : 'apiKeyManagement.enableConfirm',
                 [entry.name],
             ),
             i18n.global.t('apiKeyManagement.title'),
@@ -258,20 +290,29 @@ const operate = async (entry: APIKey.Item, action: string) => {
             },
         );
     } catch {
+        operationPending = false;
         return;
     }
+    if (!active || requestVersion !== searchVersion) {
+        operationPending = false;
+        return;
+    }
+    clearSecret();
     loading.value = true;
     try {
         const reference = { id: entry.id, revision: entry.revision };
         const response =
-            action === 'revoke'
-                ? await revokeAPIKey(reference)
-                : await setAPIKeyStatus({ ...reference, status: entry.status === 'Enable' ? 'Disable' : 'Enable' });
-        clearLegacySecret();
+            action === 'delete'
+                ? await deleteAPIKey(reference)
+                : action === 'revoke'
+                  ? await revokeAPIKey(reference)
+                  : await setAPIKeyStatus({ ...reference, status: entry.status === 'Enable' ? 'Disable' : 'Enable' });
+        clearSecret();
         if (response.data?.terminalClosePending) MsgWarning(i18n.global.t('apiKeyManagement.closePending'));
         else MsgSuccess(i18n.global.t('commons.msg.operationSuccess'));
     } finally {
-        await search();
+        operationPending = false;
+        if (active) await search();
     }
 };
 const buttons = computed<FuTableOperationButton<APIKey.Item>[]>(() => [
@@ -300,21 +341,59 @@ const buttons = computed<FuTableOperationButton<APIKey.Item>[]>(() => [
         show: (row) => row.status !== 'Revoked',
         click: (row) => operate(row, 'revoke'),
     },
+    {
+        label: i18n.global.t('commons.button.delete'),
+        show: (row) => row.kind === 'apiKey',
+        click: (row) => operate(row, 'delete'),
+    },
 ]);
-const revealLegacy = async () => {
-    if (legacyBusy.value || !detailVisible.value || detail.value?.kind !== 'legacy') return;
+const toggleSecret = async () => {
+    if (secretBusy.value || loading.value) return;
+    if (secret.value) clearSecret();
+    else await revealSecret();
+};
+const accessSecret = async (action: 'reveal' | 'copy') => {
+    if (secretBusy.value || loading.value || !active || !detailVisible.value || !detail.value) return;
+    if (detail.value.status === 'Revoked') return;
+    const reference = { id: detail.value.id, revision: detail.value.revision };
+    const kind = detail.value.kind;
     const ticket = ++secretRequestVersion;
-    legacyBusy.value = true;
+    secretAction.value = action;
+    secretBusy.value = true;
     try {
-        const response = await getUserInfo();
-        if (ticket === secretRequestVersion && detailVisible.value && active && detail.value?.kind === 'legacy')
-            legacySecret.value = response.data.apiKey;
+        if (action === 'copy' && secret.value) {
+            await copyText(secret.value);
+            return;
+        }
+        secret.value = '';
+        const data =
+            kind === 'legacy'
+                ? { ...reference, apiKey: (await getUserInfo()).data.apiKey }
+                : (await revealAPIKey(reference)).data;
+        if (
+            ticket === secretRequestVersion &&
+            active &&
+            detailVisible.value &&
+            detail.value?.id === reference.id &&
+            detail.value?.kind === kind &&
+            detail.value?.revision === reference.revision &&
+            data.id === reference.id &&
+            data.revision === reference.revision &&
+            data.apiKey
+        ) {
+            if (action === 'copy') await copyText(data.apiKey);
+            else secret.value = data.apiKey;
+        }
+    } catch {
+        if (ticket === secretRequestVersion && active) await search();
     } finally {
-        if (ticket === secretRequestVersion) legacyBusy.value = false;
+        if (ticket === secretRequestVersion) secretBusy.value = false;
     }
 };
+const revealSecret = () => accessSecret('reveal');
+const copySecret = () => accessSecret('copy');
 const resetLegacy = async () => {
-    if (legacyBusy.value || !detailVisible.value || detail.value?.kind !== 'legacy') return;
+    if (secretBusy.value || !detailVisible.value || detail.value?.kind !== 'legacy') return;
     const ticket = ++secretRequestVersion;
     try {
         await ElMessageBox.confirm(i18n.global.t('setting.apiKeyResetHelper'), i18n.global.t('setting.apiKeyReset'));
@@ -322,17 +401,18 @@ const resetLegacy = async () => {
         return;
     }
     if (ticket !== secretRequestVersion || !detailVisible.value || !active) return;
-    legacyBusy.value = true;
-    legacySecret.value = '';
+    secretAction.value = 'reveal';
+    secretBusy.value = true;
+    secret.value = '';
     try {
         const response = await generateApiKey();
         await search(ticket);
         // A reset changes the revision and deliberately clears any older reveal.
         // Never restore a secret after the original details drawer was closed.
         if (ticket === secretRequestVersion && detailVisible.value && active && detail.value?.kind === 'legacy')
-            legacySecret.value = response.data;
+            secret.value = response.data;
     } finally {
-        if (ticket === secretRequestVersion) legacyBusy.value = false;
+        if (ticket === secretRequestVersion) secretBusy.value = false;
     }
 };
 const activate = () => {
@@ -343,9 +423,16 @@ const activate = () => {
 const deactivate = () => {
     active = false;
     searchVersion++;
-    clearLegacySecret();
+    clearSecret();
     detailVisible.value = false;
 };
+watch(
+    () => globalStore.isLogin,
+    (loggedIn) => {
+        if (!loggedIn) deactivate();
+    },
+    { flush: 'sync' },
+);
 onMounted(activate);
 onActivated(activate);
 onDeactivated(deactivate);