fix: align compose project name handling (#13500)

* fix: handle external login state and emit readiness event

* fix: handle external login state and improve SAML2 logout response handling

.github/workflows/build-and-publish.yml

@@ -1,69 +0,0 @@
-name: Build And Publish (OSS + R2)
-
-on:
-  push:
-    tags:
-      - 'v*'
-
-jobs:
-  create-release:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Code
-        uses: actions/checkout@v4
-
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: '24.11.1'
-
-      - name: Build Web
-        run: |
-          cd frontend && npm install && npm run build:pro
-        env:
-          NODE_OPTIONS: --max-old-space-size=8192
-
-      - name: Setup Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: '1.25'
-          cache-dependency-path: |
-            core/go.sum
-            agent/go.sum
-
-      - name: Build Release
-        uses: goreleaser/goreleaser-action@v6
-        with:
-          distribution: goreleaser
-          version: '~> v2'
-          args: release --skip=publish --clean
-
-      - name: Upload Assets
-        uses: softprops/action-gh-release@v1
-        if: startsWith(github.ref, 'refs/tags/')
-        with:
-          draft: true
-          files: |
-            dist/*.tar.gz
-            dist/checksums.txt
-
-      - name: Setup OSSUTIL
-        uses: yizhoumo/setup-ossutil@v2
-        with:
-          endpoint: ${{ secrets.OSS_ENDPOINT }}
-          access-key-id: ${{ secrets.OSS_ACCESS_KEY_ID }}
-          access-key-secret: ${{ secrets.OSS_ACCESS_KEY_SECRET }}
-          ossutil-version: '1.7.18'
-
-      - name: Upload Assets to OSS
-        run: |
-          ossutil cp -r dist/ oss://resource-fit2cloud-com/1panel/package/v2/stable/${{ github.ref_name }}/release/ --include "*.tar.gz" --include "checksums.txt" --only-current-dir --force
-
-      - name: Setup Rclone
-        uses: AnimMouse/setup-rclone@v1
-        with:
-          rclone_config: ${{ secrets.RCLONE_CONFIG }}
-
-      - name: Upload to Cloudflare R2
-        run: |
-          rclone copy dist/ cloudflare_r2:package/v2/stable/${{ github.ref_name }}/release/ --include "*.tar.gz" --include "checksums.txt" --progress

.github/workflows/llm-code-review.yml

@@ -1,25 +0,0 @@
-name: LLM Code Review
-permissions:
-  contents: read
-  pull-requests: write
-on:
-  pull_request:
-    types: [opened, reopened, synchronize]
-jobs:
-  llm-code-review:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: fit2cloud/LLM-CodeReview-Action@main
-        env:
-          GITHUB_TOKEN: ${{ secrets.FIT2CLOUDRD_LLM_CODE_REVIEW_TOKEN }}
-          OPENAI_API_KEY: ${{ secrets.ALIYUN_LLM_API_KEY }}
-          LANGUAGE: English
-          OPENAI_API_ENDPOINT: https://dashscope.aliyuncs.com/compatible-mode/v1
-          MODEL: qwen2.5-coder-3b-instruct
-          PROMPT: "Please check the following code differences for any irregularities, potential issues, or optimization suggestions, and provide your answers in English."
-          top_p: 1
-          temperature: 1
-          # max_tokens: 10000
-          MAX_PATCH_LENGTH: 10000 
-          IGNORE_PATTERNS: "/node_modules,*.md,/dist,/.github"
-          FILE_PATTERNS: "*.java,*.go,*.py,*.vue,*.ts,*.js,*.css,*.scss,*.html"

.github/workflows/sonarcloud-scan.yml

@@ -1,21 +0,0 @@
-name: SonarCloud Scan
-on:
-  push:
-    branches:
-      - dev
-  pull_request:
-    types: [opened, synchronize, reopened]
-jobs:
-  sonarcloud:
-    name: SonarCloud
-    if: github.repository == '1Panel-dev/1Panel'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-      - name: SonarCloud Scan
-        uses: SonarSource/sonarcloud-github-action@master
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUBTOKEN }}
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/sync2gitee.yml

@@ -6,7 +6,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Mirror the Github organization repos to Gitee.
-        uses: Yikun/hub-mirror-action@master
+        uses: Yikun/hub-mirror-action@ba51c01b28a6c9f95a25d4f1bcf6af2a147c0e18 # master
         with:
           src: 'github/1Panel-dev'
           dst: 'gitee/fit2cloud-feizhiyun'

.github/workflows/tyops-check.yml

@@ -1,11 +0,0 @@
-name: Typos Check
-on: pull_request
-jobs:
-  run:
-    name: Spell Check with Typos
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout Actions Repository
-      uses: actions/checkout@v2
-    - name: Check spelling
-      uses: crate-ci/typos@master

.gitignore

@@ -40,11 +40,23 @@ core/cmd/server/web/index.html
 frontend/auto-imports.d.ts
 frontend/components.d.ts
 frontend/src/xpack
-frontend/src/xpack-ee
+frontend/src/enterprise
 agent/xpack
-agent/xpack-ee
+agent/enterprise
+agent/router/entry_xpack.go
+agent/router/entry_enterprise.go
+agent/server/init_xpack.go
+agent/server/init_enterprise.go
+agent/utils/xpack/xpack.go
+agent/utils/xpack/enterprise.go
 core/xpack
-core/xpack-ee
+core/enterprise
+core/router/entry_xpack.go
+core/router/entry_enterprise.go
+core/server/init_xpack.go
+core/server/init_enterprise.go
+core/utils/xpack/xpack.go
+core/utils/xpack/enterprise.go
 
 .history/
 dist/
@@ -66,3 +78,4 @@ AGENTS.md
 opencode.json
 superpowers
 .worktrees/
+.codex/

.goreleaser.yaml

@@ -1,82 +0,0 @@
-# yaml-language-server: $schema=https://goreleaser.com/static/schema.json
-# vim: set ts=2 sw=2 tw=0 fo=jcroql
-version: 2
-
-before:
-  hooks:
-    # - export NODE_OPTIONS="--max-old-space-size=8192"
-    # - make build_web
-    - chmod +x ./ci/script.sh
-    - ./ci/script.sh
-    - sed -i 's@ORIGINAL_VERSION=.*@ORIGINAL_VERSION=v{{ .Version }}@g' 1pctl
-    
-builds:
-  - id: agent
-    dir: agent
-    main: cmd/server/main.go
-    binary: 1panel-agent
-    flags:
-      - -tags=xpack
-      - -trimpath
-    ldflags:
-      - -w -s
-    env:
-      - CGO_ENABLED=0
-    goos:
-      - linux
-    goarm:
-      - 7
-    goarch:
-      - amd64
-      - arm64
-      - arm
-      - ppc64le
-      - s390x
-      - riscv64
-
-  - id: core
-    dir: core
-    main: cmd/server/main.go
-    binary: 1panel-core
-    flags:
-      - -tags=xpack
-      - -trimpath
-    ldflags:
-      - -w -s
-    env:
-      - CGO_ENABLED=0
-    goos:
-      - linux
-    goarm:
-      - 7
-    goarch:
-      - amd64
-      - arm64
-      - arm
-      - ppc64le
-      - s390x
-      - riscv64
-
-archives:
-  - formats: [ 'tar.gz' ]
-    ids: [core, agent]
-    name_template: "1panel-v{{ .Version }}-{{ .Os }}-{{ .Arch }}{{- if .Arm }}v{{ .Arm }}{{ end }}"
-    wrap_in_directory: true
-    files:
-      - 1pctl
-      - install.sh
-      - 1panel-core.service
-      - 1panel-agent.service
-      - initscript/*
-      - lang/*
-      - GeoIP.mmdb
-
-checksum:
-  name_template: 'checksums.txt'
-
-changelog:
-  sort: asc
-  filters:
-    exclude:
-      - "^docs:"
-      - "^test:"

OWNERS

@@ -2,8 +2,10 @@ reviewers:
 - wanghe-fit2cloud
 - zhengkunwang223
 - ssongliu
+- lan-yonghui
 
 approvers:
 - wanghe-fit2cloud
 - zhengkunwang223
 - ssongliu
+- lan-yonghui

README.md

@@ -25,7 +25,7 @@
   <a href="/docs/README.pt-br.md"><img alt="Português (Brasil)" src="https://img.shields.io/badge/Português (Brasil)-d9d9d9"></a>
   <a href="/docs/README.ar.md"><img alt="العربية" src="https://img.shields.io/badge/العربية-d9d9d9"></a>
   <a href="/docs/README.de.md"><img alt="Deutsch" src="https://img.shields.io/badge/Deutsch-d9d9d9"></a>
-  <a href="/docs/README.es.md"><img alt="Español" src="https://img.shields.io/badge/Español-d9d9d9"></a>
+  <a href="/docs/README.es-es.md"><img alt="Español" src="https://img.shields.io/badge/Español-d9d9d9"></a>
   <a href="/docs/README.fr.md"><img alt="français" src="https://img.shields.io/badge/français-d9d9d9"></a>
   <a href="/docs/README.ko.md"><img alt="한국어" src="https://img.shields.io/badge/한국어-d9d9d9"></a>
   <a href="/docs/README.id.md"><img alt="Bahasa Indonesia" src="https://img.shields.io/badge/Bahasa Indonesia-d9d9d9"></a>
@@ -33,6 +33,8 @@
   <a href="/docs/README.tr.md"><img alt="Türkçe" src="https://img.shields.io/badge/Türkçe-d9d9d9"></a>
   <a href="/docs/README.ru.md"><img alt="Русский" src="https://img.shields.io/badge/Русский-d9d9d9"></a>
   <a href="/docs/README.ms.md"><img alt="Bahasa Melayu" src="https://img.shields.io/badge/Bahasa Melayu-d9d9d9"></a>
+  <a href="/docs/README.fa.md"><img alt="Persian" src="https://img.shields.io/badge/%D9%81%D8%A7%D8%B1%D8%B3%DB%8C-d9d9d9"></a>
+  <a href="/docs/README.lo.md"><img alt="ພາສາລາວ" src="https://img.shields.io/badge/%E0%BA%9E%E0%BA%B2%E0%BA%AA%E0%BA%B2%E0%BA%A5%E0%BA%B2%E0%BA%A7-d9d9d9"></a>
 </p>
 
 ---

agent/app/api/v2/agents.go

@@ -27,6 +27,90 @@ func (b *BaseApi) CreateAgent(c *gin.Context) {
 	helper.SuccessWithData(c, res)
 }
 
+// @Tags AI
+// @Summary Batch install Agent
+// @Accept json
+// @Param request body dto.AgentBatchInstallReq true "request"
+// @Success 200 {object} dto.AgentItem
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/batch/install [post]
+func (b *BaseApi) BatchInstallAgent(c *gin.Context) {
+	var req dto.AgentBatchInstallReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	res, err := agentService.BatchInstall(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, res)
+}
+
+// @Tags AI
+// @Summary Batch upgrade Agent
+// @Accept json
+// @Param request body dto.AgentBatchUpgradeReq true "request"
+// @Success 200 {array} dto.AgentBatchUpgradeResult
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/batch/upgrade [post]
+func (b *BaseApi) BatchUpgradeAgent(c *gin.Context) {
+	var req dto.AgentBatchUpgradeReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	res, err := agentService.BatchUpgrade(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, res)
+}
+
+// @Tags AI
+// @Summary Batch install Agent Skill
+// @Accept json
+// @Param request body dto.AgentBatchSkillInstallReq true "request"
+// @Success 200 {array} dto.AgentBatchSkillInstallResult
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/batch/skill/install [post]
+func (b *BaseApi) BatchInstallAgentSkill(c *gin.Context) {
+	var req dto.AgentBatchSkillInstallReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	res, err := agentService.BatchInstallSkill(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, res)
+}
+
+// @Tags AI
+// @Summary Batch operate Agent
+// @Accept json
+// @Param request body dto.AgentBatchOperateReq true "request"
+// @Success 200 {array} dto.AgentBatchOperateResult
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/batch/operate [post]
+func (b *BaseApi) BatchOperateAgent(c *gin.Context) {
+	var req dto.AgentBatchOperateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	res, err := agentService.BatchOperate(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, res)
+}
+
 // @Tags AI
 // @Summary Page Agents
 // @Accept json
@@ -296,11 +380,11 @@ func (b *BaseApi) DeleteHermesChatSession(c *gin.Context) {
 }
 
 // @Tags AI
-// @Summary Get Providers
+// @Summary Get model account providers
 // @Success 200 {array} dto.ProviderInfo
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /ai/agents/providers [get]
+// @Router /ai/accounts/providers [get]
 func (b *BaseApi) GetAgentProviders(c *gin.Context) {
 	list, err := agentService.GetProviders()
 	if err != nil {
@@ -311,13 +395,13 @@ func (b *BaseApi) GetAgentProviders(c *gin.Context) {
 }
 
 // @Tags AI
-// @Summary Create Agent account
+// @Summary Create model account
 // @Accept json
 // @Param request body dto.AgentAccountCreateReq true "request"
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /ai/agents/accounts [post]
+// @Router /ai/accounts [post]
 func (b *BaseApi) CreateAgentAccount(c *gin.Context) {
 	var req dto.AgentAccountCreateReq
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -331,13 +415,13 @@ func (b *BaseApi) CreateAgentAccount(c *gin.Context) {
 }
 
 // @Tags AI
-// @Summary Update Agent account
+// @Summary Update model account
 // @Accept json
 // @Param request body dto.AgentAccountUpdateReq true "request"
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /ai/agents/accounts/update [post]
+// @Router /ai/accounts/update [post]
 func (b *BaseApi) UpdateAgentAccount(c *gin.Context) {
 	var req dto.AgentAccountUpdateReq
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -351,13 +435,13 @@ func (b *BaseApi) UpdateAgentAccount(c *gin.Context) {
 }
 
 // @Tags AI
-// @Summary Page Agent accounts
+// @Summary Page model accounts
 // @Accept json
 // @Param request body dto.AgentAccountSearch true "request"
 // @Success 200 {object} dto.PageResult
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /ai/agents/accounts/search [post]
+// @Router /ai/accounts/search [post]
 func (b *BaseApi) PageAgentAccounts(c *gin.Context) {
 	var req dto.AgentAccountSearch
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -375,13 +459,34 @@ func (b *BaseApi) PageAgentAccounts(c *gin.Context) {
 }
 
 // @Tags AI
-// @Summary List Agent account models
+// @Summary Count model accounts by provider
+// @Accept json
+// @Param request body dto.AgentAccountProviderCountReq true "request"
+// @Success 200 {object} map[string]int64
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/accounts/counts [post]
+func (b *BaseApi) CountAgentAccountsByProviders(c *gin.Context) {
+	var req dto.AgentAccountProviderCountReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	counts, err := agentService.CountAccountsByProviders(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, counts)
+}
+
+// @Tags AI
+// @Summary List model account models
 // @Accept json
 // @Param request body dto.AgentAccountModelReq true "request"
 // @Success 200 {array} dto.AgentAccountModel
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /ai/agents/accounts/models [post]
+// @Router /ai/accounts/models [post]
 func (b *BaseApi) GetAgentAccountModels(c *gin.Context) {
 	var req dto.AgentAccountModelReq
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -396,13 +501,34 @@ func (b *BaseApi) GetAgentAccountModels(c *gin.Context) {
 }
 
 // @Tags AI
-// @Summary Create Agent account model
+// @Summary Discover custom provider models
+// @Accept json
+// @Param request body dto.AgentAccountModelDiscoverReq true "request"
+// @Success 200 {array} dto.AgentAccountModel
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/accounts/models/discover [post]
+func (b *BaseApi) DiscoverAgentAccountModels(c *gin.Context) {
+	var req dto.AgentAccountModelDiscoverReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	list, err := agentService.DiscoverAccountModels(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, list)
+}
+
+// @Tags AI
+// @Summary Create model account model
 // @Accept json
 // @Param request body dto.AgentAccountModelCreateReq true "request"
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /ai/agents/accounts/models/create [post]
+// @Router /ai/accounts/models/create [post]
 func (b *BaseApi) CreateAgentAccountModel(c *gin.Context) {
 	var req dto.AgentAccountModelCreateReq
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -416,13 +542,13 @@ func (b *BaseApi) CreateAgentAccountModel(c *gin.Context) {
 }
 
 // @Tags AI
-// @Summary Update Agent account model
+// @Summary Update model account model
 // @Accept json
 // @Param request body dto.AgentAccountModelUpdateReq true "request"
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /ai/agents/accounts/models/update [post]
+// @Router /ai/accounts/models/update [post]
 func (b *BaseApi) UpdateAgentAccountModel(c *gin.Context) {
 	var req dto.AgentAccountModelUpdateReq
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -436,13 +562,13 @@ func (b *BaseApi) UpdateAgentAccountModel(c *gin.Context) {
 }
 
 // @Tags AI
-// @Summary Delete Agent account model
+// @Summary Delete model account model
 // @Accept json
 // @Param request body dto.AgentAccountModelDeleteReq true "request"
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /ai/agents/accounts/models/delete [post]
+// @Router /ai/accounts/models/delete [post]
 func (b *BaseApi) DeleteAgentAccountModel(c *gin.Context) {
 	var req dto.AgentAccountModelDeleteReq
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -456,13 +582,13 @@ func (b *BaseApi) DeleteAgentAccountModel(c *gin.Context) {
 }
 
 // @Tags AI
-// @Summary Verify Agent account
+// @Summary Verify model account
 // @Accept json
 // @Param request body dto.AgentAccountVerifyReq true "request"
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /ai/agents/accounts/verify [post]
+// @Router /ai/accounts/verify [post]
 func (b *BaseApi) VerifyAgentAccount(c *gin.Context) {
 	var req dto.AgentAccountVerifyReq
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -476,13 +602,13 @@ func (b *BaseApi) VerifyAgentAccount(c *gin.Context) {
 }
 
 // @Tags AI
-// @Summary Delete Agent account
+// @Summary Delete model account
 // @Accept json
 // @Param request body dto.AgentAccountDeleteReq true "request"
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /ai/agents/accounts/delete [post]
+// @Router /ai/accounts/delete [post]
 func (b *BaseApi) DeleteAgentAccount(c *gin.Context) {
 	var req dto.AgentAccountDeleteReq
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -1252,6 +1378,88 @@ func (b *BaseApi) UninstallAgentSkill(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags AI
+// @Summary List OpenClaw plugins
+// @Accept json
+// @Param request body dto.AgentPluginsReq true "request"
+// @Success 200 {array} dto.AgentPluginItem
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/plugins/list [post]
+func (b *BaseApi) ListAgentPlugins(c *gin.Context) {
+	var req dto.AgentPluginsReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := agentService.ListPlugins(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Search OpenClaw plugins
+// @Accept json
+// @Param request body dto.AgentPluginSearchReq true "request"
+// @Success 200 {array} dto.AgentPluginSearchItem
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/plugins/search [post]
+func (b *BaseApi) SearchAgentPlugins(c *gin.Context) {
+	var req dto.AgentPluginSearchReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := agentService.SearchPlugins(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Install an OpenClaw marketplace plugin
+// @Accept json
+// @Param request body dto.AgentPluginMarketInstallReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/plugins/install [post]
+func (b *BaseApi) InstallAgentMarketPlugin(c *gin.Context) {
+	var req dto.AgentPluginMarketInstallReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.InstallMarketPlugin(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Operate an OpenClaw plugin
+// @Accept json
+// @Param request body dto.AgentPluginOperateReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/plugins/operate [post]
+func (b *BaseApi) OperateAgentPlugin(c *gin.Context) {
+	var req dto.AgentPluginOperateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.OperatePlugin(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags AI
 // @Summary Login Agent Weixin channel
 // @Accept json

agent/app/api/v2/ai.go

@@ -3,9 +3,6 @@ package v2
 import (
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
-	"github.com/1Panel-dev/1Panel/agent/utils/ai_tools/gpu"
-	"github.com/1Panel-dev/1Panel/agent/utils/ai_tools/gpu/common"
-	"github.com/1Panel-dev/1Panel/agent/utils/ai_tools/xpu"
 	"github.com/gin-gonic/gin"
 )
 
@@ -163,37 +160,6 @@ func (b *BaseApi) DeleteOllamaModel(c *gin.Context) {
 	helper.Success(c)
 }
 
-// @Tags AI
-// @Summary Load gpu / xpu info
-// @Accept json
-// @Success 200
-// @Security ApiKeyAuth
-// @Security Timestamp
-// @Router /ai/gpu/load [get]
-func (b *BaseApi) LoadGpuInfo(c *gin.Context) {
-	ok, client := gpu.New()
-	if ok {
-		info, err := client.LoadGpuInfo()
-		if err != nil {
-			helper.BadRequest(c, err)
-			return
-		}
-		helper.SuccessWithData(c, info)
-		return
-	}
-	xpuOK, xpuClient := xpu.New()
-	if xpuOK {
-		info, err := xpuClient.LoadGpuInfo()
-		if err != nil {
-			helper.BadRequest(c, err)
-			return
-		}
-		helper.SuccessWithData(c, info)
-		return
-	}
-	helper.SuccessWithData(c, &common.GpuInfo{})
-}
-
 // @Tags AI
 // @Summary Bind domain
 // @Accept json
@@ -235,14 +201,15 @@ func (b *BaseApi) GetBindDomain(c *gin.Context) {
 	helper.SuccessWithData(c, res)
 }
 
-// Tags AI
-// Summary Update bind domain
-// Accept json
-// Param request body dto.OllamaBindDomain true "request"
-// Success 200
-// Security ApiKeyAuth
-// Security Timestamp
-// Router /ai/domain/update [post]
+// @Tags AI
+// @Summary Update bind domain
+// @Accept json
+// @Param request body dto.OllamaBindDomain true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/domain/update [post]
+// @x-panel-log {"bodyKeys":["domain"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新 Ollama 绑定域名 [domain]","formatEN":"update Ollama bind domain [domain]"}
 func (b *BaseApi) UpdateBindDomain(c *gin.Context) {
 	var req dto.OllamaBindDomain
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {

agent/app/api/v2/alert.go

@@ -2,11 +2,24 @@ package v2
 
 import (
 	"errors"
+	"net/url"
+	"strings"
+
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/gin-gonic/gin"
 )
 
+const defaultAuditUser = "system"
+
+// @Tags Alert
+// @Summary Page alert
+// @Accept json
+// @Param request body dto.AlertSearch true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /alert/search [post]
 func (b *BaseApi) PageAlert(c *gin.Context) {
 	var req dto.AlertSearch
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -32,12 +45,21 @@ func (b *BaseApi) GetAlerts(c *gin.Context) {
 	helper.SuccessWithData(c, alerts)
 }
 
+// @Tags Alert
+// @Summary Create alert
+// @Accept json
+// @Param request body dto.AlertCreate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /alert [post]
+// @x-panel-log {"bodyKeys":["title"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"创建告警任务 [title]","formatEN":"create alert [title]"}
 func (b *BaseApi) CreateAlert(c *gin.Context) {
 	var req dto.AlertCreate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	err := alertService.CreateAlert(req)
+	err := alertService.CreateAlert(req, loadAuditUser(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -45,6 +67,15 @@ func (b *BaseApi) CreateAlert(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags Alert
+// @Summary Delete alert
+// @Accept json
+// @Param request body dto.DeleteRequest true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /alert/del [post]
+// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"删除告警任务 [id]","formatEN":"delete alert [id]"}
 func (b *BaseApi) DeleteAlert(c *gin.Context) {
 	var req dto.DeleteRequest
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -58,12 +89,21 @@ func (b *BaseApi) DeleteAlert(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags Alert
+// @Summary Update alert
+// @Accept json
+// @Param request body dto.AlertUpdate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /alert/update [post]
+// @x-panel-log {"bodyKeys":["title"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新告警任务 [title]","formatEN":"update alert [title]"}
 func (b *BaseApi) UpdateAlert(c *gin.Context) {
 	var req dto.AlertUpdate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	if err := alertService.UpdateAlert(req); err != nil {
+	if err := alertService.UpdateAlert(req, loadAuditUser(c)); err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
@@ -84,6 +124,15 @@ func (b *BaseApi) GetAlert(c *gin.Context) {
 	helper.SuccessWithData(c, alert)
 }
 
+// @Tags Alert
+// @Summary Update alert status
+// @Accept json
+// @Param request body dto.AlertUpdateStatus true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /alert/status [post]
+// @x-panel-log {"bodyKeys":["id","status"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新告警任务 [id] 状态 [status]","formatEN":"update alert [id] status [status]"}
 func (b *BaseApi) UpdateAlertStatus(c *gin.Context) {
 	var req dto.AlertUpdateStatus
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -97,6 +146,12 @@ func (b *BaseApi) UpdateAlertStatus(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags Alert
+// @Summary Get disks
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /alert/disks/list [get]
 func (b *BaseApi) GetDisks(c *gin.Context) {
 	alerts, err := alertService.GetDisks()
 	if err != nil {
@@ -106,6 +161,14 @@ func (b *BaseApi) GetDisks(c *gin.Context) {
 	helper.SuccessWithData(c, alerts)
 }
 
+// @Tags Alert
+// @Summary Page alert logs
+// @Accept json
+// @Param request body dto.AlertLogSearch true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /alert/logs/search [post]
 func (b *BaseApi) PageAlertLogs(c *gin.Context) {
 	var req dto.AlertLogSearch
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -122,6 +185,13 @@ func (b *BaseApi) PageAlertLogs(c *gin.Context) {
 	})
 }
 
+// @Tags Alert
+// @Summary Clean alert logs
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /alert/logs/clean [post]
+// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"清空告警日志","formatEN":"clean alert logs"}
 func (b *BaseApi) CleanAlertLogs(c *gin.Context) {
 	if err := alertService.CleanAlertLogs(); err != nil {
 		helper.InternalServer(c, err)
@@ -130,6 +200,12 @@ func (b *BaseApi) CleanAlertLogs(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags Alert
+// @Summary Get clams
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /alert/clams/list [get]
 func (b *BaseApi) GetClams(c *gin.Context) {
 	clams, err := alertService.GetClams()
 	if err != nil {
@@ -139,6 +215,14 @@ func (b *BaseApi) GetClams(c *gin.Context) {
 	helper.SuccessWithData(c, clams)
 }
 
+// @Tags Alert
+// @Summary Get cron jobs
+// @Accept json
+// @Param request body dto.CronJobReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /alert/cronjob/list [post]
 func (b *BaseApi) GetCronJobs(c *gin.Context) {
 	var req dto.CronJobReq
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -152,8 +236,18 @@ func (b *BaseApi) GetCronJobs(c *gin.Context) {
 	helper.SuccessWithData(c, cronJobs)
 }
 
+// @Tags Alert
+// @Summary Get alert config
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /alert/config/info [post]
 func (b *BaseApi) GetAlertConfig(c *gin.Context) {
-	config, err := alertService.GetAlertConfig()
+	var req dto.AlertConfigQuery
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	config, err := alertService.GetAlertConfig(req)
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -161,18 +255,71 @@ func (b *BaseApi) GetAlertConfig(c *gin.Context) {
 	helper.SuccessWithData(c, config)
 }
 
+// @Tags Alert
+// @Summary Page alert config
+// @Accept json
+// @Param request body dto.AlertConfigPageReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /alert/config/search [post]
+func (b *BaseApi) PageAlertConfig(c *gin.Context) {
+	var req dto.AlertConfigPageReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	total, configs, err := alertService.PageAlertConfig(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, dto.PageResult{
+		Total: total,
+		Items: configs,
+	})
+}
+
+// @Tags Alert
+// @Summary Update alert config
+// @Accept json
+// @Param request body dto.AlertConfigUpdate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /alert/config/update [post]
+// @x-panel-log {"bodyKeys":["id","displayName"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新告警配置 [id][displayName]","formatEN":"update alert config [id][displayName]"}
 func (b *BaseApi) UpdateAlertConfig(c *gin.Context) {
 	var req dto.AlertConfigUpdate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	if err := alertService.UpdateAlertConfig(req); err != nil {
+	if err := alertService.UpdateAlertConfig(req, loadAuditUser(c)); err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
 	helper.Success(c)
 }
 
+func loadAuditUser(c *gin.Context) string {
+	userName := strings.TrimSpace(c.GetHeader("X-Panel-User"))
+	if userName == "" {
+		return defaultAuditUser
+	}
+	if decoded, err := url.QueryUnescape(userName); err == nil {
+		return decoded
+	}
+	return userName
+}
+
+// @Tags Alert
+// @Summary Delete alert config
+// @Accept json
+// @Param request body dto.DeleteRequest true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /alert/config/del [post]
+// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"删除告警配置 [id]","formatEN":"delete alert config [id]"}
 func (b *BaseApi) DeleteAlertConfig(c *gin.Context) {
 	var req dto.DeleteRequest
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -186,6 +333,14 @@ func (b *BaseApi) DeleteAlertConfig(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags Alert
+// @Summary Test alert config
+// @Accept json
+// @Param request body dto.AlertConfigTest true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /alert/config/test [post]
 func (b *BaseApi) TestAlertConfig(c *gin.Context) {
 	var req dto.AlertConfigTest
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {

agent/app/api/v2/app.go

@@ -107,7 +107,7 @@ func (b *BaseApi) GetApp(c *gin.Context) {
 // @Accept json
 // @Param appId path integer true "app id"
 // @Param version path string true "app 版本"
-// @Param version path string true "app 类型"
+// @Param type path string true "app 类型"
 // @Success 200 {object} response.AppDetailDTO
 // @Security ApiKeyAuth
 // @Security Timestamp
@@ -131,7 +131,7 @@ func (b *BaseApi) GetAppDetail(c *gin.Context) {
 // @Tags App
 // @Summary Get app detail by id
 // @Accept json
-// @Param appId path integer true "id"
+// @Param id path integer true "id"
 // @Success 200 {object} response.AppDetailDTO
 // @Security ApiKeyAuth
 // @Security Timestamp
@@ -172,6 +172,12 @@ func (b *BaseApi) InstallApp(c *gin.Context) {
 	helper.SuccessWithData(c, install)
 }
 
+// @Tags App
+// @Summary Get app tags
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /apps/tags [get]
 func (b *BaseApi) GetAppTags(c *gin.Context) {
 	tags, err := appService.GetAppTags(c)
 	if err != nil {
@@ -199,7 +205,7 @@ func (b *BaseApi) GetAppListUpdate(c *gin.Context) {
 // @Tags App
 // @Summary Get app icon by app_id
 // @Accept json
-// @Param appId path integer true "app id"
+// @Param key path string true "app key"
 // @Success 200 {file} file "app icon"
 // @Security ApiKeyAuth
 // @Security Timestamp
@@ -237,7 +243,7 @@ func (b *BaseApi) GetAppIcon(c *gin.Context) {
 // @Tags App
 // @Summary Search app detail by appkey and version
 // @Accept json
-// @Param appId path integer true "app key"
+// @Param appKey path string true "app key"
 // @Param version path string true "app version"
 // @Success 200 {object} response.AppDetailSimpleDTO
 // @Security ApiKeyAuth

agent/app/api/v2/app_install.go

@@ -203,7 +203,6 @@ func (b *BaseApi) GetServices(c *gin.Context) {
 // @Tags App
 // @Summary Search app update version by install id
 // @Accept json
-// @Param appInstallId path integer true "request"
 // @Success 200 {array} dto.AppVersion
 // @Security ApiKeyAuth
 // @Security Timestamp
@@ -267,7 +266,7 @@ func (b *BaseApi) GetDefaultConfig(c *gin.Context) {
 // @Tags App
 // @Summary Search params by appInstallId
 // @Accept json
-// @Param appInstallId path string true "request"
+// @Param appInstallId path integer true "request"
 // @Success 200 {object} response.AppConfig
 // @Security ApiKeyAuth
 // @Security Timestamp
@@ -350,6 +349,15 @@ func (b *BaseApi) GetAppInstallInfo(c *gin.Context) {
 	helper.SuccessWithData(c, info)
 }
 
+// @Tags App
+// @Summary Update app install sort
+// @Accept json
+// @Param request body request.AppInstallSort true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /apps/installed/sort/update [post]
+// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新已安装应用排序","formatEN":"update installed app sort"}
 func (b *BaseApi) UpdateAppInstallSort(c *gin.Context) {
 	var req request.AppInstallSort
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {

agent/app/api/v2/backup.go

@@ -10,6 +10,13 @@ import (
 	"github.com/gin-gonic/gin"
 )
 
+// @Tags Backup Account
+// @Summary Check backup used
+// @Param name path string true "name"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /backups/check/{name} [get]
 func (b *BaseApi) CheckBackupUsed(c *gin.Context) {
 	name, err := helper.GetStrParamByKey(c, "name")
 	if err != nil {
@@ -32,7 +39,7 @@ func (b *BaseApi) CheckBackupUsed(c *gin.Context) {
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /backups/check [post]
+// @Router /backups/conn/check [post]
 func (b *BaseApi) CheckBackup(c *gin.Context) {
 	var req dto.BackupOperate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -136,7 +143,7 @@ func (b *BaseApi) DeleteBackup(c *gin.Context) {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /backups/update [post]
-// @x-panel-log {"bodyKeys":["type"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新备份账号 [types]","formatEN":"update backup account [types]"}
+// @x-panel-log {"bodyKeys":["type"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新备份账号 [type]","formatEN":"update backup account [type]"}
 func (b *BaseApi) UpdateBackup(c *gin.Context) {
 	var req dto.BackupOperate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -406,10 +413,15 @@ func (b *BaseApi) Backup(c *gin.Context) {
 
 	switch req.Type {
 	case "app":
-		if _, err := backupService.AppBackup(req); err != nil {
+		record, err := backupService.AppBackup(req)
+		if err != nil {
 			helper.InternalServer(c, err)
 			return
 		}
+		if req.IsImmediate {
+			helper.SuccessWithData(c, record)
+			return
+		}
 	case "mysql", "mariadb", constant.AppMysqlCluster:
 		if err := backupService.MysqlBackup(req); err != nil {
 			helper.InternalServer(c, err)

agent/app/api/v2/clam.go

@@ -21,7 +21,7 @@ func (b *BaseApi) CreateClam(c *gin.Context) {
 		return
 	}
 
-	if err := clamService.Create(req); err != nil {
+	if err := clamService.Create(req, loadAuditUser(c)); err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
@@ -43,7 +43,7 @@ func (b *BaseApi) UpdateClam(c *gin.Context) {
 		return
 	}
 
-	if err := clamService.Update(req); err != nil {
+	if err := clamService.Update(req, loadAuditUser(c)); err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
@@ -123,7 +123,7 @@ func (b *BaseApi) LoadClamBaseInfo(c *gin.Context) {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /toolbox/clam/operate [post]
-// @x-panel-log {"bodyKeys":["operation"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"[operation] Clam","formatEN":"[operation] FTP"}
+// @x-panel-log {"bodyKeys":["operation"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"[operation] Clam","formatEN":"[operation] Clam"}
 func (b *BaseApi) OperateClam(c *gin.Context) {
 	var req dto.Operate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {

agent/app/api/v2/container.go

@@ -5,6 +5,7 @@ import (
 	"net/url"
 	"path"
 	"strconv"
+	"strings"
 
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
@@ -394,6 +395,7 @@ func (b *BaseApi) ContainerInfo(c *gin.Context) {
 	helper.SuccessWithData(c, data)
 }
 
+// @Tags Container
 // @Summary Load container limits
 // @Success 200 {object} dto.ResourceLimit
 // @Security ApiKeyAuth
@@ -408,6 +410,7 @@ func (b *BaseApi) LoadResourceLimit(c *gin.Context) {
 	helper.SuccessWithData(c, data)
 }
 
+// @Tags Container
 // @Summary Load container stats
 // @Success 200 {array} dto.ContainerListStats
 // @Security ApiKeyAuth
@@ -422,6 +425,7 @@ func (b *BaseApi) ContainerListStats(c *gin.Context) {
 	helper.SuccessWithData(c, data)
 }
 
+// @Tags Container
 // @Summary Load container stats size
 // @Accept json
 // @Param request body dto.OperationWithName true "request"
@@ -662,6 +666,14 @@ func (b *BaseApi) Inspect(c *gin.Context) {
 	helper.SuccessWithData(c, result)
 }
 
+// @Tags Container
+// @Summary Download container logs
+// @Accept json
+// @Param request body dto.ContainerLog true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /containers/download/log [post]
 func (b *BaseApi) DownloadContainerLogs(c *gin.Context) {
 	var req dto.ContainerLog
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -869,6 +881,26 @@ func (b *BaseApi) ComposeUpdate(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags Container Compose
+// @Summary Pin compose
+// @Accept json
+// @Param request body dto.ComposePin true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /containers/compose/pin [post]
+func (b *BaseApi) ComposePin(c *gin.Context) {
+	var req dto.ComposePin
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := containerService.ComposePin(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags Container Compose
 // @Summary Load compose environment variables
 // @Accept json
@@ -901,6 +933,10 @@ func (b *BaseApi) LoadComposeEnv(c *gin.Context) {
 // @Security Timestamp
 // @Router /containers/search/log [get]
 func (b *BaseApi) ContainerStreamLogs(c *gin.Context) {
+	if !strings.Contains(strings.ToLower(c.GetHeader("Accept")), "text/event-stream") {
+		helper.Success(c)
+		return
+	}
 	c.Header("Content-Type", "text/event-stream")
 	c.Header("Cache-Control", "no-cache")
 	c.Header("Connection", "keep-alive")

agent/app/api/v2/cronjob.go

@@ -26,7 +26,7 @@ func (b *BaseApi) CreateCronjob(c *gin.Context) {
 		return
 	}
 
-	if err := cronjobService.Create(req); err != nil {
+	if err := cronjobService.Create(req, loadAuditUser(c)); err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
@@ -91,7 +91,7 @@ func (b *BaseApi) ImportCronjob(c *gin.Context) {
 		return
 	}
 
-	if err := cronjobService.Import(req.Cronjobs); err != nil {
+	if err := cronjobService.Import(req.Cronjobs, loadAuditUser(c)); err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
@@ -285,7 +285,7 @@ func (b *BaseApi) UpdateCronjob(c *gin.Context) {
 		return
 	}
 
-	if err := cronjobService.Update(req.ID, req); err != nil {
+	if err := cronjobService.Update(req.ID, req, loadAuditUser(c)); err != nil {
 		helper.InternalServer(c, err)
 		return
 	}

agent/app/api/v2/database.go

@@ -95,6 +95,7 @@ func (b *BaseApi) SearchDatabase(c *gin.Context) {
 // @Success 200 {array} dto.DatabaseOption
 // @Security ApiKeyAuth
 // @Security Timestamp
+// @Param type path string true "type"
 // @Router /databases/db/list/:type [get]
 func (b *BaseApi) ListDatabase(c *gin.Context) {
 	dbType, err := helper.GetStrParamByKey(c, "type")
@@ -116,6 +117,7 @@ func (b *BaseApi) ListDatabase(c *gin.Context) {
 // @Success 200 {array} dto.DatabaseItem
 // @Security ApiKeyAuth
 // @Security Timestamp
+// @Param type path string true "type"
 // @Router /databases/db/item/:type [get]
 func (b *BaseApi) LoadDatabaseItems(c *gin.Context) {
 	dbType, err := helper.GetStrParamByKey(c, "type")
@@ -137,6 +139,7 @@ func (b *BaseApi) LoadDatabaseItems(c *gin.Context) {
 // @Success 200 {object} dto.DatabaseInfo
 // @Security ApiKeyAuth
 // @Security Timestamp
+// @Param name path string true "name"
 // @Router /databases/db/:name [get]
 func (b *BaseApi) GetDatabase(c *gin.Context) {
 	name, err := helper.GetStrParamByKey(c, "name")

agent/app/api/v2/database_mysql.go

@@ -41,20 +41,40 @@ func (b *BaseApi) CreateMysql(c *gin.Context) {
 }
 
 // @Tags Database Mysql
-// @Summary Bind user of mysql database
+// @Summary List mysql users
 // @Accept json
-// @Param request body dto.BindUser true "request"
-// @Success 200
+// @Param request body dto.MysqlUserSearch true "request"
+// @Success 200 {array} dto.MysqlUser
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /databases/bind [post]
-// @x-panel-log {"bodyKeys":["database", "username"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"绑定 mysql 数据库名 [database] [username]","formatEN":"bind mysql database [database] [username]"}
-func (b *BaseApi) BindUser(c *gin.Context) {
-	var req dto.BindUser
+// @Router /databases/users/search [post]
+func (b *BaseApi) ListMysqlUsers(c *gin.Context) {
+	var req dto.MysqlUserSearch
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
+	data, err := mysqlService.ListUsers(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
 
+// @Tags Database Mysql
+// @Summary Create mysql user
+// @Accept json
+// @Param request body dto.MysqlUserCreate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/users [post]
+// @x-panel-log {"bodyKeys":["database","username","host"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"创建 mysql 数据库 [database] 用户 [username]@[host]","formatEN":"create mysql database [database] user [username]@[host]"}
+func (b *BaseApi) CreateMysqlUser(c *gin.Context) {
+	var req dto.MysqlUserCreate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
 	if len(req.Password) != 0 {
 		password, err := base64.StdEncoding.DecodeString(req.Password)
 		if err != nil {
@@ -63,8 +83,191 @@ func (b *BaseApi) BindUser(c *gin.Context) {
 		}
 		req.Password = string(password)
 	}
+	if err := mysqlService.CreateUser(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
 
-	if err := mysqlService.BindUser(req); err != nil {
+// @Tags Database Mysql
+// @Summary Delete mysql user
+// @Accept json
+// @Param request body dto.MysqlUserDelete true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/users/del [post]
+// @x-panel-log {"bodyKeys":["database","username","host"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"删除 mysql 数据库 [database] 用户 [username]@[host]","formatEN":"delete mysql database [database] user [username]@[host]"}
+func (b *BaseApi) DeleteMysqlUser(c *gin.Context) {
+	var req dto.MysqlUserDelete
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := mysqlService.DeleteUser(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Database Mysql
+// @Summary Update mysql user
+// @Accept json
+// @Param request body dto.MysqlUserUpdate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/users/update [post]
+// @x-panel-log {"bodyKeys":["database","username","host","newHost","description"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新 mysql 数据库 [database] 用户 [username] 访问权限 [host] => [newHost] 描述 [description]","formatEN":"update mysql database [database] user [username] access [host] => [newHost] description [description]"}
+func (b *BaseApi) UpdateMysqlUser(c *gin.Context) {
+	var req dto.MysqlUserUpdate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := mysqlService.UpdateUser(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Database Mysql
+// @Summary Change mysql user password
+// @Accept json
+// @Param request body dto.MysqlUserPassword true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/users/password [post]
+// @x-panel-log {"bodyKeys":["database","username","host"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新 mysql 数据库 [database] 用户 [username]@[host] 密码","formatEN":"update mysql database [database] user [username]@[host] password"}
+func (b *BaseApi) ChangeMysqlUserPassword(c *gin.Context) {
+	var req dto.MysqlUserPassword
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if len(req.Password) != 0 {
+		password, err := base64.StdEncoding.DecodeString(req.Password)
+		if err != nil {
+			helper.BadRequest(c, err)
+			return
+		}
+		req.Password = string(password)
+	}
+	if err := mysqlService.ChangeUserPassword(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Database Mysql
+// @Summary Save mysql user password locally
+// @Accept json
+// @Param request body dto.MysqlUserPassword true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/users/password/save [post]
+// @x-panel-log {"bodyKeys":["database","username","host"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"补充 mysql 数据库 [database] 用户 [username]@[host] 密码","formatEN":"save mysql database [database] user [username]@[host] password locally"}
+func (b *BaseApi) SaveMysqlUserPassword(c *gin.Context) {
+	var req dto.MysqlUserPassword
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if len(req.Password) != 0 {
+		password, err := base64.StdEncoding.DecodeString(req.Password)
+		if err != nil {
+			helper.BadRequest(c, err)
+			return
+		}
+		req.Password = string(password)
+	}
+	if err := mysqlService.SaveUserPassword(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Database Mysql
+// @Summary List mysql grants
+// @Accept json
+// @Param request body dto.MysqlUserSearch true "request"
+// @Success 200 {array} dto.MysqlGrant
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/grants/search [post]
+func (b *BaseApi) ListMysqlGrants(c *gin.Context) {
+	var req dto.MysqlUserSearch
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := mysqlService.ListGrants(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags Database Mysql
+// @Summary List mysql grant summary
+// @Accept json
+// @Param request body dto.MysqlGrantSummarySearch true "request"
+// @Success 200 {object} map[string][]dto.MysqlUser
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/grants/summary [post]
+func (b *BaseApi) ListMysqlGrantSummary(c *gin.Context) {
+	var req dto.MysqlGrantSummarySearch
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := mysqlService.ListGrantSummary(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags Database Mysql
+// @Summary Grant mysql user
+// @Accept json
+// @Param request body dto.MysqlGrantCreate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/grants [post]
+// @x-panel-log {"bodyKeys":["database","db","username","host"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"授权 mysql 数据库 [database] 用户 [username]@[host] 访问 [db]","formatEN":"grant mysql database [database] user [username]@[host] access to [db]"}
+func (b *BaseApi) GrantMysqlUser(c *gin.Context) {
+	var req dto.MysqlGrantCreate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := mysqlService.GrantUser(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Database Mysql
+// @Summary Revoke mysql grant
+// @Accept json
+// @Param request body dto.MysqlGrantDelete true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/grants/del [post]
+// @x-panel-log {"bodyKeys":["database","db","username","host"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"取消 mysql 数据库 [database] 用户 [username]@[host] 对 [db] 的授权","formatEN":"revoke mysql database [database] user [username]@[host] access to [db]"}
+func (b *BaseApi) RevokeMysqlGrant(c *gin.Context) {
+	var req dto.MysqlGrantDelete
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := mysqlService.RevokeGrant(req); err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
@@ -94,14 +297,14 @@ func (b *BaseApi) UpdateMysqlDescription(c *gin.Context) {
 }
 
 // @Tags Database Mysql
-// @Summary Change mysql password
+// @Summary Change mysql root password
 // @Accept json
 // @Param request body dto.ChangeDBInfo true "request"
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /databases/change/password [post]
-// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"id","isList":false,"db":"database_mysqls","output_column":"name","output_value":"name"}],"formatZH":"更新数据库 [name] 密码","formatEN":"Update database [name] password"}
+// @x-panel-log {"bodyKeys":["database"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新数据库 [database] root 密码","formatEN":"Update database [database] root password"}
 func (b *BaseApi) ChangeMysqlPassword(c *gin.Context) {
 	var req dto.ChangeDBInfo
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -125,14 +328,14 @@ func (b *BaseApi) ChangeMysqlPassword(c *gin.Context) {
 }
 
 // @Tags Database Mysql
-// @Summary Change mysql access
+// @Summary Change mysql root access
 // @Accept json
 // @Param request body dto.ChangeDBInfo true "request"
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /databases/change/access [post]
-// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"id","isList":false,"db":"database_mysqls","output_column":"name","output_value":"name"}],"formatZH":"更新数据库 [name] 访问权限","formatEN":"Update database [name] access"}
+// @x-panel-log {"bodyKeys":["database"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新数据库 [database] root 访问权限","formatEN":"Update database [database] root access"}
 func (b *BaseApi) ChangeMysqlAccess(c *gin.Context) {
 	var req dto.ChangeDBInfo
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {

agent/app/api/v2/database_postgresql.go

@@ -92,7 +92,7 @@ func (b *BaseApi) UpdatePostgresqlDescription(c *gin.Context) {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /databases/pg/privileges [post]
-// @x-panel-log {"bodyKeys":["database", "username"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新数据库 [database] 用户 [username] 权限","formatEN":"Update [user] privileges of database [database]"}
+// @x-panel-log {"bodyKeys":["database", "username"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新数据库 [database] 用户 [username] 权限","formatEN":"Update [username] privileges of database [database]"}
 func (b *BaseApi) ChangePostgresqlPrivileges(c *gin.Context) {
 	var req dto.PostgresqlPrivileges
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -170,6 +170,7 @@ func (b *BaseApi) SearchPostgresql(c *gin.Context) {
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
+// @Param database path string true "database"
 // @Router /databases/pg/:database/load [post]
 func (b *BaseApi) LoadPostgresqlDBFromRemote(c *gin.Context) {
 	database, err := helper.GetStrParamByKey(c, "database")

agent/app/api/v2/database_redis.go

@@ -74,6 +74,12 @@ func (b *BaseApi) LoadPersistenceConf(c *gin.Context) {
 	helper.SuccessWithData(c, data)
 }
 
+// @Tags Database Redis
+// @Summary Check has cli
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/redis/check [get]
 func (b *BaseApi) CheckHasCli(c *gin.Context) {
 	helper.SuccessWithData(c, redisService.CheckHasCli())
 }

agent/app/api/v2/entry.go

@@ -37,14 +37,16 @@ var (
 
 	cronjobService = service.NewICronjobService()
 
-	fileService        = service.NewIFileService()
-	fileHistoryService = service.NewIFileHistoryService()
-	fileShareService   = service.NewIFileShareService()
-	sshService         = service.NewISSHService()
-	firewallService    = service.NewIFirewallService()
-	iptablesService    = service.NewIIptablesService()
-	monitorService     = service.NewIMonitorService()
-	systemService      = service.NewISystemService()
+	fileService               = service.NewIFileService()
+	fileHistoryService        = service.NewIFileHistoryService()
+	fileShareService          = service.NewIFileShareService()
+	sshService                = service.NewISSHService()
+	firewallService           = service.NewIFirewallService()
+	forwardingService         = service.NewIForwardingService()
+	iptablesService           = service.NewIIptablesService()
+	monitorService            = service.NewIMonitorService()
+	systemService             = service.NewISystemService()
+	runtimeDiagnosticsService = service.NewIRuntimeDiagnosticsService()
 
 	deviceService   = service.NewIDeviceService()
 	fail2banService = service.NewIFail2BanService()
@@ -59,6 +61,7 @@ var (
 	websiteDnsAccountService  = service.NewIWebsiteDnsAccountService()
 	websiteSSLService         = service.NewIWebsiteSSLService()
 	websiteAcmeAccountService = service.NewIWebsiteAcmeAccountService()
+	websiteTemplateService    = service.NewIWebsiteTemplateService()
 
 	nginxService = service.NewINginxService()
 

agent/app/api/v2/file.go

@@ -12,7 +12,9 @@ import (
 	"path/filepath"
 	"strconv"
 	"strings"
+	"sync"
 	"syscall"
+	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
@@ -28,6 +30,11 @@ import (
 	qrcode "github.com/skip2/go-qrcode"
 )
 
+var cancelledChunkUploads = struct {
+	sync.RWMutex
+	ids map[string]struct{}
+}{ids: make(map[string]struct{})}
+
 // @Tags File
 // @Summary List files
 // @Accept json
@@ -193,7 +200,7 @@ func (b *BaseApi) BatchDeleteFile(c *gin.Context) {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /files/mode [post]
-// @x-panel-log {"bodyKeys":["path","mode"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"修改权限 [paths] => [mode]","formatEN":"Change mode [paths] => [mode]"}
+// @x-panel-log {"bodyKeys":["path","mode"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"修改权限 [path] => [mode]","formatEN":"Change mode [path] => [mode]"}
 func (b *BaseApi) ChangeFileMode(c *gin.Context) {
 	var req request.FileCreate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -215,7 +222,7 @@ func (b *BaseApi) ChangeFileMode(c *gin.Context) {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /files/owner [post]
-// @x-panel-log {"bodyKeys":["path","user","group"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"修改用户/组 [paths] => [user]/[group]","formatEN":"Change owner [paths] => [user]/[group]"}
+// @x-panel-log {"bodyKeys":["path","user","group"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"修改用户/组 [path] => [user]/[group]","formatEN":"Change owner [path] => [user]/[group]"}
 func (b *BaseApi) ChangeFileOwner(c *gin.Context) {
 	var req request.FileRoleUpdate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -411,7 +418,7 @@ func (b *BaseApi) UploadFiles(c *gin.Context) {
 		helper.BadRequest(c, errors.New("error paths in request"))
 		return
 	}
-	dir := path.Dir(paths[0])
+	dir := path.Clean(paths[0])
 
 	_, err = os.Stat(dir)
 	if err != nil && os.IsNotExist(err) {
@@ -452,8 +459,14 @@ func (b *BaseApi) UploadFiles(c *gin.Context) {
 			}
 			_ = os.Chown(dstDir, uid, gid)
 		}
+		dstDirMode := mode
+		dstFileMode := mode.Perm()
+		if dstDirInfo, err := os.Stat(dstDir); err == nil {
+			dstDirMode = dstDirInfo.Mode()
+			dstFileMode = dstDirInfo.Mode().Perm()
+		}
 		tmpFilename := dstFilename + ".tmp"
-		if err := c.SaveUploadedFile(file, tmpFilename); err != nil {
+		if err := c.SaveUploadedFile(file, tmpFilename, dstDirMode); err != nil {
 			_ = os.Remove(tmpFilename)
 			e := fmt.Errorf("upload [%s] file failed, err: %v", file.Filename, err)
 			failures[file.Filename] = e
@@ -476,7 +489,7 @@ func (b *BaseApi) UploadFiles(c *gin.Context) {
 		if statErr == nil {
 			_ = os.Chmod(dstFilename, dstInfo.Mode())
 		} else {
-			_ = os.Chmod(dstFilename, mode)
+			_ = os.Chmod(dstFilename, dstFileMode)
 		}
 		if uid != -1 && gid != -1 {
 			_ = os.Chown(dstFilename, uid, gid)
@@ -634,6 +647,10 @@ func (b *BaseApi) MoveFile(c *gin.Context) {
 // @Router /files/download [get]
 func (b *BaseApi) Download(c *gin.Context) {
 	filePath := c.Query("path")
+	if files.ShouldDenySensitiveFileRead(filePath) {
+		helper.InternalServer(c, buserr.New("ErrSensitiveFileRead"))
+		return
+	}
 	file, err := os.Open(filePath)
 	if err != nil {
 		helper.InternalServer(c, err)
@@ -669,6 +686,10 @@ func (b *BaseApi) DownloadChunkFiles(c *gin.Context) {
 		helper.ErrorWithDetail(c, http.StatusInternalServerError, "ErrPathNotFound", nil)
 		return
 	}
+	if files.ShouldDenySensitiveFileRead(req.Path) {
+		helper.InternalServer(c, buserr.New("ErrSensitiveFileRead"))
+		return
+	}
 	filePath := req.Path
 	fstFile, err := fileOp.OpenFile(filePath)
 	if err != nil {
@@ -787,12 +808,13 @@ func mergeChunks(fileName string, fileDir string, dstDir string, chunkCount int,
 			return err
 		}
 	}
+	if dstDirInfo, err := os.Stat(dstDir); err == nil {
+		mode = dstDirInfo.Mode().Perm()
+	}
 	dstFileName := filepath.Join(dstDir, fileName)
 	dstInfo, statErr := os.Stat(dstFileName)
 	if statErr == nil {
 		mode = dstInfo.Mode()
-	} else {
-		mode = 0644
 	}
 	if overwrite {
 		_ = os.Remove(dstFileName)
@@ -814,6 +836,7 @@ func mergeChunks(fileName string, fileDir string, dstDir string, chunkCount int,
 		}
 		_ = os.Remove(chunkPath)
 	}
+	_ = os.Chmod(dstFileName, mode)
 
 	return nil
 }
@@ -857,7 +880,24 @@ func (b *BaseApi) UploadChunkFiles(c *gin.Context) {
 		}
 	}
 	filename := c.PostForm("filename")
-	fileDir := filepath.Join(tmpDir, filename)
+	if filename == "" || filepath.Base(filename) != filename || strings.ContainsAny(filename, `/\\`) {
+		helper.BadRequest(c, errors.New("invalid filename"))
+		return
+	}
+	uploadID := strings.TrimSpace(c.PostForm("uploadID"))
+	cancellable := uploadID != ""
+	if cancellable && (filepath.Base(uploadID) != uploadID || strings.ContainsAny(uploadID, `/\\`)) {
+		helper.BadRequest(c, errors.New("invalid upload ID"))
+		return
+	}
+	if !cancellable {
+		uploadID = filename
+	}
+	fileDir := filepath.Join(tmpDir, uploadID)
+	if cancellable && chunkUploadCancelled(uploadID) {
+		helper.BadRequest(c, errors.New("upload cancelled"))
+		return
+	}
 	if chunkIndex == 0 {
 		if fileOp.Stat(fileDir) {
 			_ = fileOp.DeleteDir(fileDir)
@@ -868,7 +908,7 @@ func (b *BaseApi) UploadChunkFiles(c *gin.Context) {
 
 	defer func() {
 		if err != nil {
-			_ = os.Remove(fileDir)
+			_ = os.RemoveAll(fileDir)
 		}
 	}()
 	var (
@@ -888,6 +928,11 @@ func (b *BaseApi) UploadChunkFiles(c *gin.Context) {
 		helper.InternalServer(c, buserr.WithMap("ErrFileUpload", map[string]interface{}{"name": filename, "detail": err.Error()}, err))
 		return
 	}
+	if cancellable && chunkUploadCancelled(uploadID) {
+		err = errors.New("upload cancelled")
+		helper.BadRequest(c, err)
+		return
+	}
 
 	chunkPath := filepath.Join(fileDir, fmt.Sprintf("%s.%d", filename, chunkIndex))
 	err = os.WriteFile(chunkPath, chunkData, constant.DirPerm)
@@ -906,19 +951,67 @@ func (b *BaseApi) UploadChunkFiles(c *gin.Context) {
 			helper.InternalServer(c, buserr.WithMap("ErrFileUpload", map[string]interface{}{"name": filename, "detail": err.Error()}, err))
 			return
 		}
+		if cancellable {
+			cancelledChunkUploads.Lock()
+			delete(cancelledChunkUploads.ids, uploadID)
+			cancelledChunkUploads.Unlock()
+		}
 		helper.SuccessWithData(c, true)
 	} else {
 		return
 	}
 }
 
+// StopChunkUpload removes temporary chunks left by a cancelled upload.
+func (b *BaseApi) StopChunkUpload(c *gin.Context) {
+	var req request.FileProcessReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	uploadID := strings.TrimSpace(req.Key)
+	if uploadID == "" || filepath.Base(uploadID) != uploadID || strings.ContainsAny(uploadID, `/\\`) {
+		helper.BadRequest(c, errors.New("invalid upload ID"))
+		return
+	}
+	cancelledChunkUploads.Lock()
+	cancelledChunkUploads.ids[uploadID] = struct{}{}
+	cancelledChunkUploads.Unlock()
+	time.AfterFunc(10*time.Minute, func() {
+		cancelledChunkUploads.Lock()
+		delete(cancelledChunkUploads.ids, uploadID)
+		cancelledChunkUploads.Unlock()
+	})
+	if err := os.RemoveAll(filepath.Join(global.Dir.TmpDir, "upload", uploadID)); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+func chunkUploadCancelled(uploadID string) bool {
+	cancelledChunkUploads.RLock()
+	_, ok := cancelledChunkUploads.ids[uploadID]
+	cancelledChunkUploads.RUnlock()
+	return ok
+}
+
 var wsUpgrade = websocket.Upgrader{
 	CheckOrigin: func(r *http.Request) bool {
 		return true
 	},
 }
 
+// @Tags File
+// @Summary Wget process
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/wget/process [get]
 func (b *BaseApi) WgetProcess(c *gin.Context) {
+	if !websocket.IsWebSocketUpgrade(c.Request) {
+		helper.Success(c)
+		return
+	}
 	ws, err := wsUpgrade.Upgrade(c.Writer, c.Request, nil)
 	if err != nil {
 		return
@@ -928,6 +1021,12 @@ func (b *BaseApi) WgetProcess(c *gin.Context) {
 	go wsClient.Write()
 }
 
+// @Tags File
+// @Summary Process keys
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/wget/process/keys [get]
 func (b *BaseApi) ProcessKeys(c *gin.Context) {
 	res := &response.FileProcessKeys{}
 	keys := global.CACHE.PrefixScanKey("file-wget-")
@@ -947,16 +1046,20 @@ func (b *BaseApi) ProcessKeys(c *gin.Context) {
 
 // @Tags File
 // @Summary Read file by Line
+// @Param type path string true "type"
 // @Param request body request.FileReadByLineReq true "request"
 // @Success 200 {object} response.FileLineContent
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /files/read [post]
+// @Router /files/read/{type} [post]
 func (b *BaseApi) ReadFileByLine(c *gin.Context) {
 	var req request.FileReadByLineReq
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
+	if readType := strings.TrimSpace(c.Param("type")); readType != "" {
+		req.Type = readType
+	}
 	res, err := fileService.ReadLogByLine(req)
 	if err != nil {
 		helper.InternalServer(c, err)
@@ -989,16 +1092,6 @@ func (b *BaseApi) BatchChangeModeAndOwner(c *gin.Context) {
 	helper.Success(c)
 }
 
-func (b *BaseApi) GetPathByType(c *gin.Context) {
-	pathType, ok := c.Params.Get("type")
-	if !ok {
-		helper.BadRequest(c, errors.New("error pathType id in path"))
-		return
-	}
-	resPath := fileService.GetPathByType(pathType)
-	helper.SuccessWithData(c, resPath)
-}
-
 // @Tags File
 // @Summary system mount
 // @Accept json
@@ -1330,6 +1423,10 @@ func (b *BaseApi) DownloadFileShare(c *gin.Context) {
 		helper.InternalServer(c, err)
 		return
 	}
+	if files.ShouldDenySensitiveFileRead(filePath) {
+		helper.InternalServer(c, buserr.New("ErrSensitiveFileRead"))
+		return
+	}
 	file, err := os.Open(filePath)
 	if err != nil {
 		helper.InternalServer(c, err)

agent/app/api/v2/file_history.go

@@ -11,7 +11,7 @@ import (
 // @Summary Load file history list
 // @Accept json
 // @Param request body request.FileHistorySearchReq true "request"
-// @Success 200 {object} response.PageResult
+// @Success 200 {object} dto.PageResult
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /files/history/search [post]

agent/app/api/v2/firewall.go

@@ -20,7 +20,15 @@ func (b *BaseApi) LoadFirewallBaseInfo(c *gin.Context) {
 		return
 	}
 
-	data, err := firewallService.LoadBaseInfo(req.Name)
+	var (
+		data dto.FirewallBaseInfo
+		err  error
+	)
+	if req.Name == "forward" {
+		data, err = forwardingService.LoadBaseInfo()
+	} else {
+		data, err = firewallService.LoadBaseInfo(req.Name)
+	}
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -43,7 +51,21 @@ func (b *BaseApi) SearchFirewallRule(c *gin.Context) {
 		return
 	}
 
-	total, list, err := firewallService.SearchWithPage(req)
+	var (
+		total int64
+		list  interface{}
+		err   error
+	)
+	if req.Type == "forward" {
+		total, list, err = forwardingService.SearchWithPage(dto.ForwardRuleSearch{
+			PageInfo: req.PageInfo,
+			Info:     req.Info,
+			Status:   req.Status,
+			Strategy: req.Strategy,
+		})
+	} else {
+		total, list, err = firewallService.SearchWithPage(req)
+	}
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -116,7 +138,7 @@ func (b *BaseApi) OperateForwardRule(c *gin.Context) {
 		return
 	}
 
-	if err := firewallService.OperateForwardRule(req); err != nil {
+	if err := forwardingService.Operate(req); err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
@@ -236,7 +258,7 @@ func (b *BaseApi) UpdateAddrRule(c *gin.Context) {
 // @Success 200 {object} dto.PageResult
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /hosts/firewall/filter/search [post]
+// @Router /hosts/firewall/filter/rule/search [post]
 func (b *BaseApi) SearchFilterRules(c *gin.Context) {
 	var req dto.SearchPageWithType
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -313,7 +335,13 @@ func (b *BaseApi) OperateFilterChain(c *gin.Context) {
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	if err := iptablesService.Operate(req); err != nil {
+	var err error
+	if req.Operate == "init-forward" {
+		err = forwardingService.Enable()
+	} else {
+		err = iptablesService.Operate(req)
+	}
+	if err != nil {
 		helper.InternalServer(c, err)
 		return
 	}

agent/app/api/v2/gpu.go

@@ -0,0 +1,72 @@
+package v2
+
+import (
+	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/utils/ai_tools/gpu"
+	"github.com/1Panel-dev/1Panel/agent/utils/ai_tools/gpu/common"
+	"github.com/1Panel-dev/1Panel/agent/utils/ai_tools/xpu"
+	"github.com/gin-gonic/gin"
+)
+
+// @Tags AI
+// @Summary Load gpu / xpu info
+// @Accept json
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/gpu/load [get]
+func (b *BaseApi) LoadGpuInfo(c *gin.Context) {
+	ok, client := gpu.New()
+	if ok {
+		info, err := client.LoadGpuInfo()
+		if err != nil {
+			helper.BadRequest(c, err)
+			return
+		}
+		helper.SuccessWithData(c, info)
+		return
+	}
+	xpuOK, xpuClient := xpu.New()
+	if xpuOK {
+		info, err := xpuClient.LoadGpuInfo()
+		if err != nil {
+			helper.BadRequest(c, err)
+			return
+		}
+		helper.SuccessWithData(c, info)
+		return
+	}
+	helper.SuccessWithData(c, &common.GpuInfo{})
+}
+
+// @Tags AI
+// @Summary Get CPU options
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/gpu/options [get]
+func (b *BaseApi) GetCPUOptions(c *gin.Context) {
+	helper.SuccessWithData(c, monitorService.LoadGPUOptions())
+}
+
+// @Tags Monitor
+// @Summary Load monitor data
+// @Param request body dto.MonitorGPUSearch true "request"
+// @Success 200 {object} dto.MonitorGPUData
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/gpu/search [post]
+func (b *BaseApi) LoadGPUMonitor(c *gin.Context) {
+	var req dto.MonitorGPUSearch
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	data, err := monitorService.LoadGPUMonitorData(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}

agent/app/api/v2/health.go

@@ -5,6 +5,12 @@ import (
 	"github.com/gin-gonic/gin"
 )
 
+// @Tags Health
+// @Summary Check health
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /health/check [get]
 func (b *BaseApi) CheckHealth(c *gin.Context) {
 	helper.Success(c)
 }

agent/app/api/v2/host.go

@@ -7,6 +7,15 @@ import (
 	"github.com/gin-gonic/gin"
 )
 
+// @Tags Host
+// @Summary Create host
+// @Accept json
+// @Param request body dto.HostOperate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts [post]
+// @x-panel-log {"bodyKeys":["name","addr"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"创建主机 [name][addr]","formatEN":"create host [name][addr]"}
 func (b *BaseApi) CreateHost(c *gin.Context) {
 	var req dto.HostOperate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -21,6 +30,14 @@ func (b *BaseApi) CreateHost(c *gin.Context) {
 	helper.SuccessWithData(c, host)
 }
 
+// @Tags Host
+// @Summary Test by info
+// @Accept json
+// @Param request body dto.HostConnTest true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/test/byinfo [post]
 func (b *BaseApi) TestByInfo(c *gin.Context) {
 	var req dto.HostConnTest
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -30,6 +47,14 @@ func (b *BaseApi) TestByInfo(c *gin.Context) {
 	helper.SuccessWithData(c, hostService.TestByInfo(req))
 }
 
+// @Tags Host
+// @Summary Test by ID
+// @Accept json
+// @Param request body dto.OperateByID true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/test/byid [post]
 func (b *BaseApi) TestByID(c *gin.Context) {
 	var req dto.OperateByID
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -39,6 +64,14 @@ func (b *BaseApi) TestByID(c *gin.Context) {
 	helper.SuccessWithData(c, hostService.TestLocalConn(req.ID))
 }
 
+// @Tags Host
+// @Summary Host tree
+// @Accept json
+// @Param request body dto.SearchForTree true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/tree [post]
 func (b *BaseApi) HostTree(c *gin.Context) {
 	var req dto.SearchForTree
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -53,6 +86,14 @@ func (b *BaseApi) HostTree(c *gin.Context) {
 	helper.SuccessWithData(c, data)
 }
 
+// @Tags Host
+// @Summary Search host
+// @Accept json
+// @Param request body dto.SearchPageWithGroup true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/search [post]
 func (b *BaseApi) SearchHost(c *gin.Context) {
 	var req dto.SearchPageWithGroup
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -68,6 +109,15 @@ func (b *BaseApi) SearchHost(c *gin.Context) {
 	helper.SuccessWithData(c, dto.PageResult{Items: list, Total: total})
 }
 
+// @Tags Host
+// @Summary Delete host
+// @Accept json
+// @Param request body dto.OperateByIDs true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/del [post]
+// @x-panel-log {"bodyKeys":["ids"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"ids","isList":true,"db":"hosts","output_column":"name","output_value":"names"}],"formatZH":"删除主机 [names]","formatEN":"delete host [names]"}
 func (b *BaseApi) DeleteHost(c *gin.Context) {
 	var req dto.OperateByIDs
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -81,6 +131,15 @@ func (b *BaseApi) DeleteHost(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags Host
+// @Summary Update host
+// @Accept json
+// @Param request body dto.HostOperate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/update [post]
+// @x-panel-log {"bodyKeys":["name","addr"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新主机 [name][addr]","formatEN":"update host [name][addr]"}
 func (b *BaseApi) UpdateHost(c *gin.Context) {
 	var req dto.HostOperate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -140,6 +199,15 @@ func (b *BaseApi) UpdateHost(c *gin.Context) {
 	helper.SuccessWithData(c, hostItem)
 }
 
+// @Tags Host
+// @Summary Update host group
+// @Accept json
+// @Param request body dto.ChangeGroup true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/update/group [post]
+// @x-panel-log {"bodyKeys":["id","groupID"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"id","isList":false,"db":"hosts","output_column":"name","output_value":"name"}],"formatZH":"更新主机 [name] 分组","formatEN":"update host [name] group"}
 func (b *BaseApi) UpdateHostGroup(c *gin.Context) {
 	var req dto.ChangeGroup
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -153,6 +221,14 @@ func (b *BaseApi) UpdateHostGroup(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags Host
+// @Summary Get host by ID
+// @Accept json
+// @Param request body dto.OperateByID true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/info [post]
 func (b *BaseApi) GetHostByID(c *gin.Context) {
 	var req dto.OperateByID
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {

agent/app/api/v2/host_tool.go

@@ -9,13 +9,13 @@ import (
 // @Tags Host tool
 // @Summary Get tool status
 // @Accept json
-// @Param request body request.HostToolReq true "request"
+// @Param request body request.HostToolTypeReq true "request"
 // @Success 200 {object} response.HostToolRes
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /hosts/tool [post]
+// @Router /hosts/tool/status [post]
 func (b *BaseApi) GetToolStatus(c *gin.Context) {
-	var req request.HostToolReq
+	var req request.HostToolTypeReq
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
@@ -53,14 +53,14 @@ func (b *BaseApi) InitToolConfig(c *gin.Context) {
 // @Tags Host tool
 // @Summary Operate tool
 // @Accept json
-// @Param request body request.HostToolReq true "request"
+// @Param request body request.HostToolOperateReq true "request"
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /hosts/tool/operate [post]
 // @x-panel-log {"bodyKeys":["operate","type"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"[operate] [type] ","formatEN":"[operate] [type]"}
 func (b *BaseApi) OperateTool(c *gin.Context) {
-	var req request.HostToolReq
+	var req request.HostToolOperateReq
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
@@ -75,19 +75,18 @@ func (b *BaseApi) OperateTool(c *gin.Context) {
 // @Tags Host tool
 // @Summary Get tool config
 // @Accept json
-// @Param request body request.HostToolConfig true "request"
+// @Param request body request.HostToolTypeReq true "request"
 // @Success 200 {object} response.HostToolConfig
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /hosts/tool/config [post]
-// @x-panel-log {"bodyKeys":["operate"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"[operate] 主机工具配置文件 ","formatEN":"[operate] tool config"}
-func (b *BaseApi) OperateToolConfig(c *gin.Context) {
-	var req request.HostToolConfig
+// @Router /hosts/tool/config/get [post]
+func (b *BaseApi) GetToolConfig(c *gin.Context) {
+	var req request.HostToolTypeReq
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
 
-	config, err := hostToolService.OperateToolConfig(req)
+	config, err := hostToolService.GetToolConfig(req)
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -95,6 +94,28 @@ func (b *BaseApi) OperateToolConfig(c *gin.Context) {
 	helper.SuccessWithData(c, config)
 }
 
+// @Tags Host tool
+// @Summary Update tool config
+// @Accept json
+// @Param request body request.HostToolConfigUpdate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/tool/config/set [post]
+// @x-panel-log {"bodyKeys":["type"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新 [type] 主机工具配置文件 ","formatEN":"update [type] tool config"}
+func (b *BaseApi) UpdateToolConfig(c *gin.Context) {
+	var req request.HostToolConfigUpdate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	if err := hostToolService.UpdateToolConfig(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags Host tool
 // @Summary Create Supervisor process
 // @Accept json
@@ -137,18 +158,44 @@ func (b *BaseApi) GetProcess(c *gin.Context) {
 // @Tags Host tool
 // @Summary Get Supervisor process config file
 // @Accept json
-// @Param request body request.SupervisorProcessFileReq true "request"
+// @Param request body request.HostSupervisorProcessFileGetReq true "request"
 // @Success 200 {string} content
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /hosts/tool/supervisor/process/file [post]
-// @x-panel-log {"bodyKeys":["operate"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"[operate] Supervisor 进程文件 ","formatEN":"[operate] Supervisor Process Config file"}
+// @Router /hosts/tool/supervisor/process/file/get [post]
 func (b *BaseApi) GetProcessFile(c *gin.Context) {
-	var req request.SupervisorProcessFileReq
+	var req request.HostSupervisorProcessFileGetReq
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	content, err := hostToolService.OperateSupervisorProcessFile(req)
+	content, err := hostToolService.GetSupervisorProcessFile(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, content)
+}
+
+// @Tags Host tool
+// @Summary Operate Supervisor process config file
+// @Accept json
+// @Param request body request.HostSupervisorProcessFileOperateReq true "request"
+// @Success 200 {string} content
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/tool/supervisor/process/file [post]
+// @x-panel-log {"bodyKeys":["operate"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"[operate] Supervisor 进程文件 ","formatEN":"[operate] Supervisor Process Config file"}
+func (b *BaseApi) OperateProcessFile(c *gin.Context) {
+	var req request.HostSupervisorProcessFileOperateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	content, err := hostToolService.OperateSupervisorProcessFile(request.SupervisorProcessFileReq{
+		Name:    req.Name,
+		Operate: req.Operate,
+		Content: req.Content,
+		File:    req.File,
+	})
 	if err != nil {
 		helper.InternalServer(c, err)
 		return

agent/app/api/v2/logs.go

@@ -2,6 +2,7 @@ package v2
 
 import (
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/gin-gonic/gin"
 )
 
@@ -20,3 +21,57 @@ func (b *BaseApi) GetSystemFiles(c *gin.Context) {
 
 	helper.SuccessWithData(c, data)
 }
+
+// @Tags Logs
+// @Summary Get host system log status
+// @Produce json
+// @Success 200 {object} dto.SystemLogStatus
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /logs/system/status [get]
+func (b *BaseApi) GetSystemLogStatus(c *gin.Context) {
+	data, err := logService.GetSystemLogStatus()
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags Logs
+// @Summary Read host logs
+// @Accept json
+// @Param request body dto.SystemLogReq true "request"
+// @Produce json
+// @Success 200 {object} dto.SystemLogRes
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /logs/system/read [post]
+func (b *BaseApi) ReadSystemLog(c *gin.Context) {
+	var req dto.SystemLogReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := logService.ReadSystemLog(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags Logs
+// @Summary List running host services
+// @Produce json
+// @Success 200 {array} string
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /logs/system/services [get]
+func (b *BaseApi) ListRunningServices(c *gin.Context) {
+	data, err := logService.ListRunningServices()
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}

agent/app/api/v2/mcp_server.go

@@ -23,6 +23,27 @@ func (b *BaseApi) PageMcpServers(c *gin.Context) {
 	helper.SuccessWithData(c, list)
 }
 
+// @Tags McpServer
+// @Summary Load mcp server detail
+// @Accept json
+// @Param request body request.McpServerDetail true "request"
+// @Success 200 {object} response.McpServerDTO
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/mcp/server/detail [post]
+func (b *BaseApi) LoadMcpServerDetail(c *gin.Context) {
+	var req request.McpServerDetail
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	res, err := mcpServerService.Detail(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, res)
+}
+
 // @Tags McpServer
 // @Summary Create mcp server
 // @Accept json
@@ -107,6 +128,48 @@ func (b *BaseApi) OperateMcpServer(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags McpServer
+// @Summary Sync mcp server status
+// @Accept json
+// @Param request body request.McpServerStatusSync true "request"
+// @Success 200 {array} response.McpServerStatusDTO
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/mcp/server/status/sync [post]
+func (b *BaseApi) SyncMcpServerStatus(c *gin.Context) {
+	var req request.McpServerStatusSync
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	res, err := mcpServerService.SyncStatus(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, res)
+}
+
+// @Tags McpServer
+// @Summary Test mcp server connection
+// @Accept json
+// @Param request body request.McpServerConnectionTest true "request"
+// @Success 200 {object} response.McpServerConnectionTestRes
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/mcp/server/connection/test [post]
+func (b *BaseApi) TestMcpServerConnection(c *gin.Context) {
+	var req request.McpServerConnectionTest
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	res, err := mcpServerService.TestConnection(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, res)
+}
+
 // @Tags McpServer
 // @Summary Bind Domain for mcp server
 // @Accept json

agent/app/api/v2/monitor.go

@@ -31,27 +31,6 @@ func (b *BaseApi) LoadMonitor(c *gin.Context) {
 	helper.SuccessWithDataGzipped(c, data)
 }
 
-// @Tags Monitor
-// @Summary Load monitor data
-// @Param request body dto.MonitorGPUSearch true "request"
-// @Success 200 {object} dto.MonitorGPUData
-// @Security ApiKeyAuth
-// @Security Timestamp
-// @Router /hosts/monitor/gpu/search [post]
-func (b *BaseApi) LoadGPUMonitor(c *gin.Context) {
-	var req dto.MonitorGPUSearch
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
-		return
-	}
-
-	data, err := monitorService.LoadGPUMonitorData(req)
-	if err != nil {
-		helper.InternalServer(c, err)
-		return
-	}
-	helper.SuccessWithData(c, data)
-}
-
 // @Tags Monitor
 // @Summary Clean monitor data
 // @Success 200
@@ -91,7 +70,7 @@ func (b *BaseApi) LoadMonitorSetting(c *gin.Context) {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /hosts/monitor/setting/update [post]
-// @x-panel-log {"bodyKeys":["key", "value"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"修改默认监控网卡 [name]-[value]","formatEN":"update default monitor [name]-[value]"}
+// @x-panel-log {"bodyKeys":["key", "value"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"修改默认监控网卡 [key]-[value]","formatEN":"update default monitor [key]-[value]"}
 func (b *BaseApi) UpdateMonitorSetting(c *gin.Context) {
 	var req dto.MonitorSettingUpdate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -105,6 +84,12 @@ func (b *BaseApi) UpdateMonitorSetting(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags Monitor
+// @Summary Get network options
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/monitor/netoptions [get]
 func (b *BaseApi) GetNetworkOptions(c *gin.Context) {
 	netStat, _ := net.IOCounters(true)
 	var options []string
@@ -116,6 +101,12 @@ func (b *BaseApi) GetNetworkOptions(c *gin.Context) {
 	helper.SuccessWithData(c, options)
 }
 
+// @Tags Monitor
+// @Summary Get IO options
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/monitor/iooptions [get]
 func (b *BaseApi) GetIOOptions(c *gin.Context) {
 	diskStat, _ := disk.IOCounters()
 	var options []string
@@ -126,7 +117,3 @@ func (b *BaseApi) GetIOOptions(c *gin.Context) {
 	sort.Strings(options)
 	helper.SuccessWithData(c, options)
 }
-
-func (b *BaseApi) GetCPUOptions(c *gin.Context) {
-	helper.SuccessWithData(c, monitorService.LoadGPUOptions())
-}

agent/app/api/v2/process.go

@@ -5,9 +5,20 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
 	websocket2 "github.com/1Panel-dev/1Panel/agent/utils/websocket"
 	"github.com/gin-gonic/gin"
+	"github.com/gorilla/websocket"
 )
 
+// @Tags Process
+// @Summary Process ws
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /process/ws [get]
 func (b *BaseApi) ProcessWs(c *gin.Context) {
+	if !websocket.IsWebSocketUpgrade(c.Request) {
+		helper.Success(c)
+		return
+	}
 	ws, err := wsUpgrade.Upgrade(c.Writer, c.Request, nil)
 	if err != nil {
 		return

agent/app/api/v2/runtime.go

@@ -61,7 +61,7 @@ func (b *BaseApi) CreateRuntime(c *gin.Context) {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /runtimes/del [post]
-// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"删除运行环境 [name]","formatEN":"Delete runtime [name]"}
+// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"删除运行环境 [id]","formatEN":"Delete runtime [id]"}
 func (b *BaseApi) DeleteRuntime(c *gin.Context) {
 	var req request.RuntimeDelete
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -81,6 +81,7 @@ func (b *BaseApi) DeleteRuntime(c *gin.Context) {
 // @Success 200 {array} dto.AppResource
 // @Security ApiKeyAuth
 // @Security Timestamp
+// @Param id path integer true "id"
 // @Router /runtimes/installed/delete/check/:id [get]
 func (b *BaseApi) DeleteRuntimeCheck(c *gin.Context) {
 	runTimeId, err := helper.GetIntParamByKey(c, "id")
@@ -120,7 +121,7 @@ func (b *BaseApi) UpdateRuntime(c *gin.Context) {
 // @Tags Runtime
 // @Summary Get runtime
 // @Accept json
-// @Param id path string true "request"
+// @Param id path integer true "request"
 // @Success 200 {object} response.RuntimeDTO
 // @Security ApiKeyAuth
 // @Security Timestamp
@@ -168,7 +169,7 @@ func (b *BaseApi) GetNodePackageRunScript(c *gin.Context) {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /runtimes/operate [post]
-// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"操作运行环境 [name]","formatEN":"Operate runtime [name]"}
+// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"操作运行环境 [id]","formatEN":"Operate runtime [id]"}
 func (b *BaseApi) OperateRuntime(c *gin.Context) {
 	var req request.RuntimeOperate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -242,7 +243,7 @@ func (b *BaseApi) SyncStatus(c *gin.Context) {
 // @Tags Runtime
 // @Summary Get php runtime extension
 // @Accept json
-// @Param id path string true "request"
+// @Param id path integer true "request"
 // @Success 200 {object} response.PHPExtensionRes
 // @Security ApiKeyAuth
 // @Security Timestamp

agent/app/api/v2/runtime_diagnostics.go

@@ -0,0 +1,63 @@
+package v2
+
+import (
+	"os"
+
+	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/gin-gonic/gin"
+)
+
+// @Tags RuntimeDiagnostics
+// @Summary Load runtime diagnostics summary
+// @Success 200 {object} dto.RuntimeDiagnosticsSummary
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/diagnostics/summary [get]
+func (b *BaseApi) LoadRuntimeDiagnosticsSummary(c *gin.Context) {
+	data, err := runtimeDiagnosticsService.Summary()
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags RuntimeDiagnostics
+// @Summary Load grouped goroutine snapshot
+// @Success 200 {object} dto.RuntimeGoroutineSnapshot
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/diagnostics/goroutines [get]
+func (b *BaseApi) LoadRuntimeGoroutines(c *gin.Context) {
+	data, err := runtimeDiagnosticsService.Goroutines()
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithDataGzipped(c, data)
+}
+
+// @Tags RuntimeDiagnostics
+// @Summary Capture runtime profile
+// @Param request body dto.RuntimeProfileCreate true "request"
+// @Success 200 {file} file
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/diagnostics/profiles [post]
+func (b *BaseApi) CreateRuntimeProfile(c *gin.Context) {
+	var req dto.RuntimeProfileCreate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	profile, err := runtimeDiagnosticsService.CreateProfile(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	defer os.Remove(profile.Path)
+	c.Header("Content-Disposition", `attachment; filename="`+profile.Name+`"`)
+	c.Header("Content-Type", "application/octet-stream")
+	c.File(profile.Path)
+	c.Abort()
+}

agent/app/api/v2/setting.go

@@ -1,16 +1,12 @@
 package v2
 
 import (
-	"encoding/json"
-
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
-	"github.com/1Panel-dev/1Panel/agent/app/model"
 	"github.com/1Panel-dev/1Panel/agent/global"
 	"github.com/1Panel-dev/1Panel/agent/utils/ssh"
 	"github.com/gin-gonic/gin"
-	"github.com/pkg/errors"
 )
 
 // @Tags System Setting
@@ -28,6 +24,12 @@ func (b *BaseApi) GetSettingInfo(c *gin.Context) {
 	helper.SuccessWithData(c, setting)
 }
 
+// @Tags System Setting
+// @Summary Get terminal AI setting info
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /settings/terminal/ai/search [post]
 func (b *BaseApi) GetTerminalAISettingInfo(c *gin.Context) {
 	setting, err := settingService.GetTerminalAIInfo()
 	if err != nil {
@@ -50,14 +52,14 @@ func (b *BaseApi) GetSystemAvailable(c *gin.Context) {
 // @Tags System Setting
 // @Summary Update system setting
 // @Accept json
-// @Param request body dto.SettingUpdate true "request"
+// @Param request body dto.AgentSettingUpdate true "request"
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /settings/update [post]
 // @x-panel-log {"bodyKeys":["key","value"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"修改系统配置 [key] => [value]","formatEN":"update system setting [key] => [value]"}
 func (b *BaseApi) UpdateSetting(c *gin.Context) {
-	var req dto.SettingUpdate
+	var req dto.AgentSettingUpdate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
@@ -69,6 +71,15 @@ func (b *BaseApi) UpdateSetting(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags System Setting
+// @Summary Update terminal AI setting
+// @Accept json
+// @Param request body dto.TerminalAIInfo true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /settings/terminal/ai/update [post]
+// @x-panel-log {"bodyKeys":["aiStatus","aiAccountId"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新终端 AI 设置 [aiStatus][aiAccountId]","formatEN":"update terminal AI setting [aiStatus][aiAccountId]"}
 func (b *BaseApi) UpdateTerminalAISetting(c *gin.Context) {
 	var req dto.TerminalAIInfo
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -82,6 +93,12 @@ func (b *BaseApi) UpdateTerminalAISetting(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags System Setting
+// @Summary Get file manage AI setting info
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /settings/files/ai/search [post]
 func (b *BaseApi) GetFileManageAISettingInfo(c *gin.Context) {
 	setting, err := settingService.GetFileManageAIInfo()
 	if err != nil {
@@ -91,6 +108,15 @@ func (b *BaseApi) GetFileManageAISettingInfo(c *gin.Context) {
 	helper.SuccessWithData(c, setting)
 }
 
+// @Tags System Setting
+// @Summary Update file manage AI setting
+// @Accept json
+// @Param request body dto.FileManageAIInfo true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /settings/files/ai/update [post]
+// @x-panel-log {"bodyKeys":["aiStatus","aiAccountId"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新文件管理 AI 设置 [aiStatus][aiAccountId]","formatEN":"update file manage AI setting [aiStatus][aiAccountId]"}
 func (b *BaseApi) UpdateFileManageAISetting(c *gin.Context) {
 	var req dto.FileManageAIInfo
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -138,6 +164,16 @@ func (b *BaseApi) UpdateFileHistorySetting(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags System Setting
+// @Summary Load website dir
+// @Success 200 {string} path
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /settings/website/dir [get]
+func (b *BaseApi) LoadWebsiteDir(c *gin.Context) {
+	helper.SuccessWithData(c, settingService.GetWebsiteDir())
+}
+
 // @Tags System Setting
 // @Summary Load local backup dir
 // @Success 200 {string} path
@@ -158,6 +194,12 @@ func (b *BaseApi) LoadLocalConn(c *gin.Context) {
 	helper.SuccessWithData(c, settingService.GetLocalConn())
 }
 
+// @Tags System Setting
+// @Summary Check local conn
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /settings/ssh/check [post]
 func (b *BaseApi) CheckLocalConn(c *gin.Context) {
 	client, err := loadLocalConn()
 	if err == nil && client != nil {
@@ -173,7 +215,7 @@ func (b *BaseApi) CheckLocalConn(c *gin.Context) {
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /settings/ssh/conn/default [post]
+// @Router /settings/ssh/default [post]
 // @x-panel-log {"bodyKeys":["defaultConn"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"本地终端默认连接 [defaultConn]","formatEN":"update system default conn [defaultConn]"}
 func (b *BaseApi) SetDefaultIsConn(c *gin.Context) {
 	var req dto.SSHDefaultConn
@@ -223,12 +265,8 @@ func (b *BaseApi) SaveLocalConn(c *gin.Context) {
 }
 
 func loadLocalConn() (*ssh.SSHClient, error) {
-	connInfoInDB := settingService.GetSettingByKey("LocalSSHConn")
-	if len(connInfoInDB) == 0 {
-		return nil, errors.New("no such ssh conn info in db!")
-	}
-	var connInDB model.LocalConnInfo
-	if err := json.Unmarshal([]byte(connInfoInDB), &connInDB); err != nil {
+	connInDB, err := settingService.GetLocalConnForSSH()
+	if err != nil {
 		return nil, err
 	}
 	sshInfo := ssh.ConnInfo{
@@ -243,23 +281,6 @@ func loadLocalConn() (*ssh.SSHClient, error) {
 	return ssh.NewClient(sshInfo)
 }
 
-// @Tags System Setting
-// @Summary Load system setting by key
-// @Param key path string true "key"
-// @Success 200 {object} dto.SettingInfo
-// @Security ApiKeyAuth
-// @Security Timestamp
-// @Router /settings/get/{key} [get]
-func (b *BaseApi) GetSettingByKey(c *gin.Context) {
-	key := c.Param("key")
-	if len(key) == 0 {
-		helper.BadRequest(c, errors.New("key is empty"))
-		return
-	}
-	value := settingService.GetSettingByKey(key)
-	helper.SuccessWithData(c, value)
-}
-
 // @Tags System Setting
 // @Summary Save common description
 // @Accept json

agent/app/api/v2/ssh.go

@@ -224,6 +224,21 @@ func (b *BaseApi) ExportSSHLogs(c *gin.Context) {
 	helper.SuccessWithData(c, tmpFile)
 }
 
+// @Tags SSH
+// @Summary Clean host SSH logs
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/ssh/log/clean [post]
+// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"清空 SSH 登录日志","formatEN":"clean SSH login logs"}
+func (b *BaseApi) CleanSSHLogs(c *gin.Context) {
+	if err := sshService.CleanLog(); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags SSH
 // @Summary Load host SSH conf
 // @Accept json

agent/app/api/v2/task.go

@@ -3,6 +3,8 @@ package v2
 import (
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
+	"github.com/1Panel-dev/1Panel/agent/app/dto/response"
 	"github.com/gin-gonic/gin"
 )
 
@@ -30,6 +32,31 @@ func (b *BaseApi) PageTasks(c *gin.Context) {
 	})
 }
 
+// @Tags TaskLog
+// @Summary Read task log by Line
+// @Param request body request.TaskLogReadReq true "request"
+// @Success 200 {object} response.FileLineContent
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /logs/tasks/read [post]
+func (b *BaseApi) ReadTaskLogByLine(c *gin.Context) {
+	var req request.TaskLogReadReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	var res *response.FileLineContent
+	res, err := taskService.ReadByLine(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	if res.TotalLines > 100 {
+		helper.SuccessWithDataGzipped(c, res)
+	} else {
+		helper.SuccessWithData(c, res)
+	}
+}
+
 // @Tags TaskLog
 // @Summary Get the number of executing tasks
 // @Success 200 {integer} int64

agent/app/api/v2/tensorrt_llm.go

@@ -6,6 +6,14 @@ import (
 	"github.com/gin-gonic/gin"
 )
 
+// @Tags TensorRT LLM
+// @Summary Page TensorRT LLMs
+// @Accept json
+// @Param request body request.TensorRTLLMSearch true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/tensorrt/search [post]
 func (b *BaseApi) PageTensorRTLLMs(c *gin.Context) {
 	var req request.TensorRTLLMSearch
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -15,6 +23,15 @@ func (b *BaseApi) PageTensorRTLLMs(c *gin.Context) {
 	helper.SuccessWithData(c, list)
 }
 
+// @Tags TensorRT LLM
+// @Summary Create TensorRT LLM
+// @Accept json
+// @Param request body request.TensorRTLLMCreate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/tensorrt/create [post]
+// @x-panel-log {"bodyKeys":["name"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"创建 TensorRT LLM [name]","formatEN":"create TensorRT LLM [name]"}
 func (b *BaseApi) CreateTensorRTLLM(c *gin.Context) {
 	var req request.TensorRTLLMCreate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -28,6 +45,15 @@ func (b *BaseApi) CreateTensorRTLLM(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags TensorRT LLM
+// @Summary Update TensorRT LLM
+// @Accept json
+// @Param request body request.TensorRTLLMUpdate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/tensorrt/update [post]
+// @x-panel-log {"bodyKeys":["id","name"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新 TensorRT LLM [id][name]","formatEN":"update TensorRT LLM [id][name]"}
 func (b *BaseApi) UpdateTensorRTLLM(c *gin.Context) {
 	var req request.TensorRTLLMUpdate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -41,6 +67,15 @@ func (b *BaseApi) UpdateTensorRTLLM(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags TensorRT LLM
+// @Summary Delete TensorRT LLM
+// @Accept json
+// @Param request body request.TensorRTLLMDelete true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/tensorrt/delete [post]
+// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"删除 TensorRT LLM [id]","formatEN":"delete TensorRT LLM [id]"}
 func (b *BaseApi) DeleteTensorRTLLM(c *gin.Context) {
 	var req request.TensorRTLLMDelete
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -54,6 +89,15 @@ func (b *BaseApi) DeleteTensorRTLLM(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags TensorRT LLM
+// @Summary Operate TensorRT LLM
+// @Accept json
+// @Param request body request.TensorRTLLMOperate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/tensorrt/operate [post]
+// @x-panel-log {"bodyKeys":["id","operate"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"操作 TensorRT LLM [id][operate]","formatEN":"operate TensorRT LLM [id][operate]"}
 func (b *BaseApi) OperateTensorRTLLM(c *gin.Context) {
 	var req request.TensorRTLLMOperate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {

agent/app/api/v2/terminal.go

@@ -8,7 +8,9 @@ import (
 	"strconv"
 	"time"
 
+	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
 	"github.com/1Panel-dev/1Panel/agent/app/service"
 	"github.com/1Panel-dev/1Panel/agent/global"
 	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
@@ -19,117 +21,52 @@ import (
 	"github.com/pkg/errors"
 )
 
-func (b *BaseApi) WsSSH(c *gin.Context) {
-	wsConn, err := upGrader.Upgrade(c.Writer, c.Request, nil)
-	if err != nil {
-		global.LOG.Errorf("gin context http handler failed, err: %v", err)
-		return
-	}
-	defer wsConn.Close()
-
-	if global.CONF.Base.IsDemo {
-		if wshandleError(wsConn, errors.New("   demo server, prohibit this operation!")) {
-			return
-		}
-	}
-
-	cols, err := strconv.Atoi(c.DefaultQuery("cols", "80"))
-	if wshandleError(wsConn, errors.WithMessage(err, "invalid param cols in request")) {
-		return
-	}
-	rows, err := strconv.Atoi(c.DefaultQuery("rows", "40"))
-	if wshandleError(wsConn, errors.WithMessage(err, "invalid param rows in request")) {
-		return
-	}
-
-	hostID, _ := strconv.Atoi(c.DefaultQuery("id", "0"))
-	var client *ssh.SSHClient
-	if hostID > 0 {
-		host, err := service.GetHostInfo(uint(hostID))
-		if wshandleError(wsConn, errors.WithMessage(err, "load host info by id failed")) {
-			return
-		}
-		connInfo := ssh.ConnInfo{
-			Addr:       host.Addr,
-			Port:       int(host.Port),
-			User:       host.User,
-			AuthMode:   host.AuthMode,
-			Password:   host.Password,
-			PrivateKey: []byte(host.PrivateKey),
-		}
-		if len(host.PassPhrase) != 0 {
-			connInfo.PassPhrase = []byte(host.PassPhrase)
-		}
-		client, err = ssh.NewClient(connInfo)
-		if wshandleError(wsConn, errors.WithMessage(err, "failed to set up the connection. Please check the host information")) {
-			return
-		}
-	} else {
-		client, err = loadLocalConn()
-		if wshandleError(wsConn, errors.WithMessage(err, "failed to set up the connection. Please check the host information")) {
-			return
-		}
-	}
-	defer client.Close()
-	command := c.DefaultQuery("command", "")
-	sws, err := terminal.NewLogicSshWsSession(cols, rows, client.Client, wsConn, command)
-	if wshandleError(wsConn, err) {
-		return
-	}
-	defer sws.Close()
-
-	quitChan := make(chan bool, 3)
-	sws.Start(quitChan)
-	go sws.Wait(quitChan)
-
-	<-quitChan
-
-	dt := time.Now().Add(time.Second)
-	_ = wsConn.WriteControl(websocket.CloseMessage, nil, dt)
+// @Tags Terminal
+// @Summary Ws local terminal
+// @Param command query string false "command"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/terminal/local [get]
+func (b *BaseApi) WsLocalTerminal(c *gin.Context) {
+	b.runSSHSession(c, loadLocalConn, c.DefaultQuery("command", ""))
 }
 
-func (b *BaseApi) ContainerWsSSH(c *gin.Context) {
-	wsConn, err := upGrader.Upgrade(c.Writer, c.Request, nil)
-	if err != nil {
-		global.LOG.Errorf("gin context http handler failed, err: %v", err)
+// @Tags Terminal
+// @Summary Ws host SSH
+// @Param id query integer false "id"
+// @Param command query string false "command"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/terminal/ssh [get]
+func (b *BaseApi) WsHostSSH(c *gin.Context) {
+	b.runSSHSession(c, func() (*ssh.SSHClient, error) {
+		hostID, _ := strconv.Atoi(c.DefaultQuery("id", "0"))
+		if hostID <= 0 {
+			return nil, errors.New("missing host id")
+		}
+		host, err := service.GetHostInfo(uint(hostID))
+		return newHostSSHClient(host, err)
+	}, c.DefaultQuery("command", ""))
+}
+
+// @Tags Terminal
+// @Summary Ws container terminal
+// @Param cols query integer false "cols"
+// @Param rows query integer false "rows"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/terminal/container [get]
+func (b *BaseApi) WsContainerTerminal(c *gin.Context) {
+	wsConn, cols, rows, ok := prepareTerminalSession(c)
+	if !ok {
 		return
 	}
 	defer wsConn.Close()
 
-	if global.CONF.Base.IsDemo {
-		if wshandleError(wsConn, errors.New("   demo server, prohibit this operation!")) {
-			return
-		}
-	}
-
-	cols, err := strconv.Atoi(c.DefaultQuery("cols", "80"))
-	if wshandleError(wsConn, errors.WithMessage(err, "invalid param cols in request")) {
-		return
-	}
-	rows, err := strconv.Atoi(c.DefaultQuery("rows", "40"))
-	if wshandleError(wsConn, errors.WithMessage(err, "invalid param rows in request")) {
-		return
-	}
-	source := c.Query("source")
-	var initCmd []string
-	switch source {
-	case "redis", "redis-cluster":
-		initCmd, err = loadRedisInitCmd(c, source)
-	case "ollama":
-		initCmd, err = loadOllamaInitCmd(c)
-	case "container":
-		initCmd, err = loadContainerInitCmd(c)
-	case "database":
-		initCmd, err = loadDatabaseInitCmd(c)
-	default:
-		if wshandleError(wsConn, fmt.Errorf("not support such source %s", source)) {
-			return
-		}
-	}
-	if wshandleError(wsConn, err) {
-		return
-	}
-	slave, err := terminal.NewCommand("docker", initCmd...)
+	slave, err := loadContainerTerminalCommand(c)
 	if wshandleError(wsConn, err) {
 		return
 	}
@@ -147,10 +84,112 @@ func (b *BaseApi) ContainerWsSSH(c *gin.Context) {
 	<-quitChan
 
 	global.LOG.Info("websocket finished")
+	closeTerminalConn(wsConn)
+}
+
+func prepareTerminalSession(c *gin.Context) (*websocket.Conn, int, int, bool) {
+	if !websocket.IsWebSocketUpgrade(c.Request) {
+		helper.Success(c)
+		return nil, 0, 0, false
+	}
+	wsConn, err := upGrader.Upgrade(c.Writer, c.Request, nil)
+	if err != nil {
+		global.LOG.Errorf("gin context http handler failed, err: %v", err)
+		return nil, 0, 0, false
+	}
+
+	if global.CONF.Base.IsDemo {
+		if wshandleError(wsConn, errors.New("   demo server, prohibit this operation!")) {
+			return nil, 0, 0, false
+		}
+	}
+
+	cols, err := strconv.Atoi(c.DefaultQuery("cols", "80"))
+	if wshandleError(wsConn, errors.WithMessage(err, "invalid param cols in request")) {
+		return nil, 0, 0, false
+	}
+	rows, err := strconv.Atoi(c.DefaultQuery("rows", "40"))
+	if wshandleError(wsConn, errors.WithMessage(err, "invalid param rows in request")) {
+		return nil, 0, 0, false
+	}
+	return wsConn, cols, rows, true
+}
+
+func (b *BaseApi) runSSHSession(c *gin.Context, connect func() (*ssh.SSHClient, error), command string) {
+	wsConn, cols, rows, ok := prepareTerminalSession(c)
+	if !ok {
+		return
+	}
+	defer wsConn.Close()
+
+	client, clientErr := connect()
+	if wshandleError(wsConn, errors.WithMessage(clientErr, "failed to set up the connection. Please check the host information")) {
+		return
+	}
+	defer client.Close()
+
+	sws, err := terminal.NewLogicSshWsSession(cols, rows, client.Client, wsConn, command)
+	if wshandleError(wsConn, err) {
+		return
+	}
+	defer sws.Close()
+
+	quitChan := make(chan bool, 3)
+	sws.Start(quitChan)
+	go sws.Wait(quitChan)
+
+	<-quitChan
+
+	closeTerminalConn(wsConn)
+}
+
+func closeTerminalConn(wsConn *websocket.Conn) {
 	dt := time.Now().Add(time.Second)
 	_ = wsConn.WriteControl(websocket.CloseMessage, nil, dt)
 }
 
+func newHostSSHClient(host *model.Host, err error) (*ssh.SSHClient, error) {
+	if err != nil {
+		return nil, errors.WithMessage(err, "load host info by id failed")
+	}
+	connInfo := ssh.ConnInfo{
+		Addr:       host.Addr,
+		Port:       int(host.Port),
+		User:       host.User,
+		AuthMode:   host.AuthMode,
+		Password:   host.Password,
+		PrivateKey: []byte(host.PrivateKey),
+	}
+	if len(host.PassPhrase) != 0 {
+		connInfo.PassPhrase = []byte(host.PassPhrase)
+	}
+	return ssh.NewClient(connInfo)
+}
+
+func loadContainerTerminalCommand(c *gin.Context) (*terminal.LocalCommand, error) {
+	source := c.Query("source")
+	var (
+		initCmd []string
+		err     error
+	)
+	switch source {
+	case "redis", "redis-cluster":
+		initCmd, err = loadRedisInitCmd(c, source)
+	case "ollama":
+		initCmd, err = loadOllamaInitCmd(c)
+	case "container":
+		initCmd, err = loadContainerInitCmd(c)
+	case "database":
+		initCmd, err = loadDatabaseInitCmd(c)
+	default:
+		return nil, fmt.Errorf("not support such source %s", source)
+	}
+	if err != nil {
+		return nil, err
+	}
+	return terminal.NewCommand("docker", initCmd...)
+}
+
 func loadRedisInitCmd(c *gin.Context, redisType string) ([]string, error) {
 	name := c.Query("name")
 	from := c.Query("from")

agent/app/api/v2/website.go

@@ -181,6 +181,7 @@ func (b *BaseApi) GetWebsite(c *gin.Context) {
 // @Success 200 {object} response.FileInfo
 // @Security ApiKeyAuth
 // @Security Timestamp
+// @Param type path string true "type"
 // @Router /websites/:id/config/:type [get]
 func (b *BaseApi) GetWebsiteNginx(c *gin.Context) {
 	id, err := helper.GetParamID(c)
@@ -269,6 +270,7 @@ func (b *BaseApi) GetHTTPSConfig(c *gin.Context) {
 // @Success 200 {object} response.WebsiteHTTPS
 // @Security ApiKeyAuth
 // @Security Timestamp
+// @Param id path string true "id"
 // @Router /websites/:id/https [post]
 // @x-panel-log {"bodyKeys":["websiteId"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"websiteId","isList":false,"db":"websites","output_column":"primary_domain","output_value":"domain"}],"formatZH":"更新网站 [domain] https 配置","formatEN":"Update website https [domain] conf"}
 func (b *BaseApi) UpdateHTTPSConfig(c *gin.Context) {
@@ -330,25 +332,45 @@ func (b *BaseApi) UpdateWebsiteNginxConfig(c *gin.Context) {
 }
 
 // @Tags Website
-// @Summary Operate website log
+// @Summary Get website log
 // @Accept json
-// @Param request body request.WebsiteLogReq true "request"
+// @Param request body request.WebsiteLogSearchReq true "request"
 // @Success 200 {object} response.WebsiteLog
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /websites/log [post]
+// @Router /websites/log/search [post]
+func (b *BaseApi) GetWebsiteLog(c *gin.Context) {
+	var req request.WebsiteLogSearchReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	res, err := websiteService.GetWebsiteLog(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, res)
+}
+
+// @Tags Website
+// @Summary Operate website log
+// @Accept json
+// @Param request body request.WebsiteLogReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/log/operate [post]
 // @x-panel-log {"bodyKeys":["id", "operate"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"id","isList":false,"db":"websites","output_column":"primary_domain","output_value":"domain"}],"formatZH":"[domain][operate] 日志","formatEN":"[domain][operate] logs"}
 func (b *BaseApi) OpWebsiteLog(c *gin.Context) {
 	var req request.WebsiteLogReq
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	res, err := websiteService.OpWebsiteLog(req)
-	if err != nil {
+	if err := websiteService.OpWebsiteLog(req); err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
-	helper.SuccessWithData(c, res)
+	helper.Success(c)
 }
 
 // @Tags Website
@@ -799,6 +821,7 @@ func (b *BaseApi) GetDirConfig(c *gin.Context) {
 // @Success 200 {object} response.WebsiteHtmlRes
 // @Security ApiKeyAuth
 // @Security Timestamp
+// @Param type path string true "type"
 // @Router /websites/default/html/:type [get]
 func (b *BaseApi) GetDefaultHtml(c *gin.Context) {
 	resourceType, err := helper.GetStrParamByKey(c, "type")
@@ -838,11 +861,11 @@ func (b *BaseApi) UpdateDefaultHtml(c *gin.Context) {
 // @Tags Website
 // @Summary Get website upstreams
 // @Accept json
-// @Param request body request.WebsiteCommonReq true "request"
+// @Param id path integer true "id"
 // @Success 200 {array} dto.NginxUpstream
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /websites/lbs [get]
+// @Router /websites/{id}/lbs [get]
 func (b *BaseApi) GetLoadBalances(c *gin.Context) {
 	id, err := helper.GetParamID(c)
 	if err != nil {
@@ -937,6 +960,15 @@ func (b *BaseApi) UpdateLoadBalanceFile(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags Website
+// @Summary Change website group
+// @Accept json
+// @Param request body dto.UpdateGroup true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/group/change [post]
+// @x-panel-log {"bodyKeys":["group","newGroup"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"网站分组 [group] 迁移到 [newGroup]","formatEN":"change website group [group] to [newGroup]"}
 func (b *BaseApi) ChangeWebsiteGroup(c *gin.Context) {
 	var req dto.UpdateGroup
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -969,6 +1001,7 @@ func (b *BaseApi) UpdateProxyCache(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags Website
 // @Summary Get website proxy cache config
 // @Accept json
 // @Param id path int true "id"
@@ -1295,7 +1328,7 @@ func (b *BaseApi) UpdateStreamConfig(c *gin.Context) {
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /websites/batch/https [post]
+// @Router /websites/batch/ssl [post]
 func (b *BaseApi) BatchSetHttps(c *gin.Context) {
 	var req request.BatchWebsiteHttps
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {

agent/app/api/v2/website_ssl.go

@@ -210,6 +210,27 @@ func (b *BaseApi) UpdateWebsiteSSL(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags Website SSL
+// @Summary Push ssl to nodes
+// @Accept json
+// @Param request body request.WebsiteSSLPush true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/ssl/push [post]
+// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"id","isList":false,"db":"website_ssls","output_column":"primary_domain","output_value":"domain"}],"formatZH":"推送证书到节点 [domain]","formatEN":"Push ssl to nodes [domain]"}
+func (b *BaseApi) PushWebsiteSSLToNode(c *gin.Context) {
+	var req request.WebsiteSSLPush
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := websiteSSLService.PushToNode(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags Website SSL
 // @Summary Upload ssl
 // @Accept json
@@ -248,6 +269,8 @@ func (b *BaseApi) UploadSSLFile(c *gin.Context) {
 	var req request.WebsiteSSLFileUpload
 
 	req.Description = c.PostForm("description")
+	req.Nodes = c.PostForm("nodes")
+	req.PushNode, _ = strconv.ParseBool(c.PostForm("pushNode"))
 	sslID := c.PostForm("sslID")
 	if sslID != "" {
 		req.SSLID, _ = strconv.ParseUint(sslID, 10, 64)
@@ -283,6 +306,8 @@ func (b *BaseApi) UploadSSLFile(c *gin.Context) {
 		Certificate: string(certificateContent),
 		Description: req.Description,
 		SSLID:       uint(req.SSLID),
+		PushNode:    req.PushNode,
+		Nodes:       req.Nodes,
 	}
 
 	if err := websiteSSLService.Upload(uploadReq); err != nil {
@@ -333,6 +358,15 @@ func (b *BaseApi) DownloadWebsiteSSL(c *gin.Context) {
 	http.ServeContent(c.Writer, c.Request, info.Name(), info.ModTime(), file)
 }
 
+// @Tags Website SSL
+// @Summary Import master SSL
+// @Accept json
+// @Param request body model.WebsiteSSL true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/ssl/import [post]
+// @x-panel-log {"bodyKeys":["primaryDomain"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"导入主节点证书 [primaryDomain]","formatEN":"import master SSL [primaryDomain]"}
 func (b *BaseApi) ImportMasterSSL(c *gin.Context) {
 	var req model.WebsiteSSL
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {

agent/app/api/v2/website_template.go

@@ -0,0 +1,259 @@
+package v2
+
+import (
+	"io"
+
+	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
+	"github.com/gin-gonic/gin"
+)
+
+// @Tags Website Template
+// @Summary Page website templates
+// @Accept json
+// @Param request body request.WebsiteTemplateSearch true "request"
+// @Success 200 {object} dto.PageResult
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/templates/search [post]
+func (b *BaseApi) PageWebsiteTemplate(c *gin.Context) {
+	var req request.WebsiteTemplateSearch
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	total, templates, err := websiteTemplateService.PageTemplate(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, dto.PageResult{
+		Total: total,
+		Items: templates,
+	})
+}
+
+// @Tags Website Template
+// @Summary Create website template
+// @Accept json
+// @Param request body request.WebsiteTemplateCreate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/templates [post]
+// @x-panel-log {"bodyKeys":["name"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"创建网站模板 [name]","formatEN":"Create website template [name]"}
+func (b *BaseApi) CreateWebsiteTemplate(c *gin.Context) {
+	var req request.WebsiteTemplateCreate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := websiteTemplateService.CreateTemplate(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Website Template
+// @Summary Update website template
+// @Accept json
+// @Param request body request.WebsiteTemplateUpdate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/templates/update [post]
+// @x-panel-log {"bodyKeys":["name"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新网站模板 [name]","formatEN":"Update website template [name]"}
+func (b *BaseApi) UpdateWebsiteTemplate(c *gin.Context) {
+	var req request.WebsiteTemplateUpdate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := websiteTemplateService.UpdateTemplate(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Website Template
+// @Summary Delete website template
+// @Accept json
+// @Param request body dto.OperateByID true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/templates/del [post]
+// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"id","isList":false,"db":"website_templates","output_column":"name","output_value":"name"}],"formatZH":"删除网站模板 [name]","formatEN":"Delete website template [name]"}
+func (b *BaseApi) DeleteWebsiteTemplate(c *gin.Context) {
+	var req dto.OperateByID
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := websiteTemplateService.DeleteTemplate(req.ID); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Website Template
+// @Summary Get website template
+// @Accept json
+// @Param request body dto.OperateByID true "request"
+// @Success 200 {object} response.WebsiteTemplateDTO
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/templates/get [post]
+func (b *BaseApi) GetWebsiteTemplate(c *gin.Context) {
+	var req dto.OperateByID
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	template, err := websiteTemplateService.GetTemplate(req.ID)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, template)
+}
+
+// @Tags Website Template
+// @Summary Upload website template zip
+// @Accept multipart/form-data
+// @Param file formData file true "file"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/templates/upload [post]
+func (b *BaseApi) UploadTemplateZip(c *gin.Context) {
+	fileHeader, err := c.FormFile("file")
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	file, err := fileHeader.Open()
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	defer file.Close()
+	content, err := io.ReadAll(file)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	filePath, variables, err := websiteTemplateService.SaveUploadZip(fileHeader.Filename, content)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, gin.H{"filePath": filePath, "variables": variables})
+}
+
+// @Tags Website Template
+// @Summary Preview website template
+// @Accept json
+// @Param request body request.WebsitePreviewReq true "request"
+// @Success 200 {object} response.WebsitePreviewDTO
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/templates/preview [post]
+func (b *BaseApi) PreviewWebsiteTemplate(c *gin.Context) {
+	var req request.WebsitePreviewReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	preview, err := websiteTemplateService.Preview(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, preview)
+}
+
+// @Tags Website Template
+// @Summary Page website template outputs
+// @Accept json
+// @Param request body request.WebsiteTemplateOutputSearch true "request"
+// @Success 200 {object} dto.PageResult
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/templates/outputs/search [post]
+func (b *BaseApi) PageWebsiteTemplateOutput(c *gin.Context) {
+	var req request.WebsiteTemplateOutputSearch
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	total, outputs, err := websiteTemplateService.PageOutput(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, dto.PageResult{
+		Total: total,
+		Items: outputs,
+	})
+}
+
+// @Tags Website Template
+// @Summary Create website template output
+// @Accept json
+// @Param request body request.WebsiteTemplateOutputCreate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/templates/outputs [post]
+// @x-panel-log {"bodyKeys":["name"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"生成模板产物 [name]","formatEN":"Generate template output [name]"}
+func (b *BaseApi) CreateWebsiteTemplateOutput(c *gin.Context) {
+	var req request.WebsiteTemplateOutputCreate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := websiteTemplateService.CreateOutput(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Website Template
+// @Summary Delete website template output
+// @Accept json
+// @Param request body dto.OperateByID true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/templates/outputs/del [post]
+// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"id","isList":false,"db":"website_template_outputs","output_column":"name","output_value":"name"}],"formatZH":"删除模板产物 [name]","formatEN":"Delete template output [name]"}
+func (b *BaseApi) DeleteWebsiteTemplateOutput(c *gin.Context) {
+	var req dto.OperateByID
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := websiteTemplateService.DeleteOutput(req.ID); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Website Template
+// @Summary Get website template output
+// @Accept json
+// @Param request body dto.OperateByID true "request"
+// @Success 200 {object} response.WebsiteTemplateOutputDTO
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/templates/outputs/get [post]
+func (b *BaseApi) GetWebsiteTemplateOutput(c *gin.Context) {
+	var req dto.OperateByID
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	output, err := websiteTemplateService.GetOutput(req.ID)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, output)
+}

agent/app/dto/agents.go

@@ -3,28 +3,110 @@ package dto
 import "time"
 
 type AgentCreateReq struct {
-	Name           string   `json:"name" validate:"required"`
-	Remark         string   `json:"remark"`
-	AppVersion     string   `json:"appVersion" validate:"required"`
-	WebUIPort      int      `json:"webUIPort" validate:"required,min=1,max=65535"`
-	BridgePort     int      `json:"bridgePort"`
-	AllowedOrigins []string `json:"allowedOrigins"`
-	AgentType      string   `json:"agentType" validate:"required,oneof=openclaw copaw hermes-agent"`
-	Model          string   `json:"model"`
-	AccountID      uint     `json:"accountId"`
-	Token          string   `json:"token"`
-	TaskID         string   `json:"taskID"`
-	Advanced       bool     `json:"advanced"`
-	ContainerName  string   `json:"containerName"`
-	AllowPort      bool     `json:"allowPort"`
-	SpecifyIP      string   `json:"specifyIP"`
-	RestartPolicy  string   `json:"restartPolicy"`
-	CpuQuota       float64  `json:"cpuQuota"`
-	MemoryLimit    float64  `json:"memoryLimit"`
-	MemoryUnit     string   `json:"memoryUnit"`
-	PullImage      bool     `json:"pullImage"`
-	EditCompose    bool     `json:"editCompose"`
-	DockerCompose  string   `json:"dockerCompose"`
+	Name              string   `json:"name" validate:"required"`
+	Remark            string   `json:"remark"`
+	AppVersion        string   `json:"appVersion" validate:"required"`
+	WebUIPort         int      `json:"webUIPort" validate:"required,min=1,max=65535"`
+	BridgePort        int      `json:"bridgePort"`
+	AllowedOrigins    []string `json:"allowedOrigins"`
+	AgentType         string   `json:"agentType" validate:"required,oneof=openclaw copaw hermes-agent"`
+	Model             string   `json:"model"`
+	AccountID         uint     `json:"accountId"`
+	Token             string   `json:"token"`
+	DashboardUsername string   `json:"dashboardUsername"`
+	DashboardPassword string   `json:"dashboardPassword"`
+	TaskID            string   `json:"taskID"`
+	Advanced          bool     `json:"advanced"`
+	ContainerName     string   `json:"containerName"`
+	AllowPort         bool     `json:"allowPort"`
+	SpecifyIP         string   `json:"specifyIP"`
+	RestartPolicy     string   `json:"restartPolicy"`
+	CpuQuota          float64  `json:"cpuQuota"`
+	MemoryLimit       float64  `json:"memoryLimit"`
+	MemoryUnit        string   `json:"memoryUnit"`
+	PullImage         bool     `json:"pullImage"`
+	EditCompose       bool     `json:"editCompose"`
+	DockerCompose     string   `json:"dockerCompose"`
+}
+
+type AgentBatchInstallReq struct {
+	Name               string              `json:"name"`
+	Remark             string              `json:"remark"`
+	AppVersion         string              `json:"appVersion" validate:"required"`
+	WebUIPort          int                 `json:"webUIPort" validate:"required,min=1,max=65535"`
+	BridgePort         int                 `json:"bridgePort"`
+	AllowedOrigins     []string            `json:"allowedOrigins"`
+	AgentType          string              `json:"agentType" validate:"required,oneof=openclaw copaw hermes-agent"`
+	Model              string              `json:"model"`
+	AccountID          uint                `json:"accountId"`
+	Token              string              `json:"token"`
+	DashboardUsername  string              `json:"dashboardUsername"`
+	DashboardPassword  string              `json:"dashboardPassword"`
+	TaskID             string              `json:"taskID"`
+	Advanced           bool                `json:"advanced"`
+	ContainerName      string              `json:"containerName"`
+	AllowPort          bool                `json:"allowPort"`
+	SpecifyIP          string              `json:"specifyIP"`
+	RestartPolicy      string              `json:"restartPolicy"`
+	CpuQuota           float64             `json:"cpuQuota"`
+	MemoryLimit        float64             `json:"memoryLimit"`
+	MemoryUnit         string              `json:"memoryUnit"`
+	PullImage          bool                `json:"pullImage"`
+	EditCompose        bool                `json:"editCompose"`
+	DockerCompose      string              `json:"dockerCompose"`
+	MasterAccountID    uint                `json:"masterAccountId"`
+	FallbackAccessHost string              `json:"fallbackAccessHost"`
+	AccountSnapshot    AgentAccountInfo    `json:"accountSnapshot"`
+	AccountModels      []AgentAccountModel `json:"accountModels"`
+}
+
+type AgentBatchUpgradeReq struct {
+	AgentType     string `json:"agentType" validate:"required,oneof=openclaw copaw hermes-agent"`
+	TargetVersion string `json:"targetVersion" validate:"required"`
+	Backup        bool   `json:"backup"`
+	PullImage     bool   `json:"pullImage"`
+	TaskID        string `json:"taskID"`
+}
+
+type AgentBatchUpgradeResult struct {
+	AgentID      uint   `json:"agentID"`
+	AgentName    string `json:"agentName"`
+	AppInstallID uint   `json:"appInstallID"`
+	Success      bool   `json:"success"`
+	Skipped      bool   `json:"skipped"`
+	Message      string `json:"message"`
+}
+
+type AgentBatchSkillInstallReq struct {
+	AgentType   string `json:"agentType" validate:"required,oneof=openclaw hermes-agent"`
+	SkillName   string `json:"skillName" validate:"required"`
+	PackagePath string `json:"packagePath" validate:"required"`
+	TaskID      string `json:"taskID"`
+}
+
+type AgentBatchSkillInstallResult struct {
+	AgentID      uint   `json:"agentID"`
+	AgentName    string `json:"agentName"`
+	AppInstallID uint   `json:"appInstallID"`
+	Success      bool   `json:"success"`
+	Skipped      bool   `json:"skipped"`
+	Message      string `json:"message"`
+}
+
+type AgentBatchOperateReq struct {
+	AgentType   string `json:"agentType" validate:"required,oneof=openclaw copaw hermes-agent"`
+	Operate     string `json:"operate" validate:"required,oneof=start stop restart delete"`
+	ForceDelete bool   `json:"forceDelete"`
+	TaskID      string `json:"taskID"`
+}
+
+type AgentBatchOperateResult struct {
+	AgentID      uint   `json:"agentID"`
+	AgentName    string `json:"agentName"`
+	AppInstallID uint   `json:"appInstallID"`
+	Success      bool   `json:"success"`
+	Skipped      bool   `json:"skipped"`
+	Message      string `json:"message"`
 }
 
 type AgentItem struct {
@@ -36,11 +118,11 @@ type AgentItem struct {
 	ProviderName         string    `json:"providerName"`
 	Model                string    `json:"model"`
 	APIType              string    `json:"apiType"`
-	MaxTokens            int       `json:"maxTokens"`
-	ContextWindow        int       `json:"contextWindow"`
 	BaseURL              string    `json:"baseUrl"`
 	APIKey               string    `json:"apiKey"`
 	Token                string    `json:"token"`
+	DashboardUsername    string    `json:"dashboardUsername"`
+	DashboardPassword    string    `json:"dashboardPassword"`
 	Status               string    `json:"status"`
 	Message              string    `json:"message"`
 	AppInstallID         uint      `json:"appInstallId"`
@@ -208,19 +290,22 @@ type AgentOverviewSnapshot struct {
 }
 
 type AgentAccountModel struct {
-	RecordID      uint     `json:"recordId"`
-	ID            string   `json:"id"`
-	Name          string   `json:"name"`
-	ContextWindow int      `json:"contextWindow"`
-	MaxTokens     int      `json:"maxTokens"`
-	Reasoning     bool     `json:"reasoning"`
-	Input         []string `json:"input"`
+	RecordID uint   `json:"recordId"`
+	ID       string `json:"id"`
+	Name     string `json:"name"`
 }
 
 type AgentAccountModelReq struct {
 	AccountID uint `json:"accountId" validate:"required"`
 }
 
+type AgentAccountModelDiscoverReq struct {
+	Provider string `json:"provider" validate:"required"`
+	BaseURL  string `json:"baseURL" validate:"required"`
+	APIKey   string `json:"apiKey" validate:"required"`
+	APIType  string `json:"apiType" validate:"required"`
+}
+
 type AgentAccountModelCreateReq struct {
 	AccountID uint              `json:"accountId" validate:"required"`
 	Model     AgentAccountModel `json:"model" validate:"required"`
@@ -237,31 +322,40 @@ type AgentAccountModelDeleteReq struct {
 }
 
 type AgentAccountCreateReq struct {
-	Provider       string              `json:"provider" validate:"required"`
-	Name           string              `json:"name" validate:"required"`
-	APIKey         string              `json:"apiKey" validate:"required"`
-	RememberAPIKey bool                `json:"rememberApiKey"`
-	BaseURL        string              `json:"baseURL"`
-	Models         []AgentAccountModel `json:"models"`
-	APIType        string              `json:"apiType" validate:"required"`
-	Remark         string              `json:"remark"`
+	Provider             string              `json:"provider" validate:"required"`
+	Name                 string              `json:"name" validate:"required"`
+	APIKey               string              `json:"apiKey" validate:"required"`
+	RememberAPIKey       bool                `json:"rememberApiKey"`
+	BaseURL              string              `json:"baseURL"`
+	Models               []AgentAccountModel `json:"models"`
+	APIType              string              `json:"apiType" validate:"required"`
+	AuthMode             string              `json:"authMode"`
+	VerifyModel          string              `json:"verifyModel"`
+	ValidateAvailability *bool               `json:"validateAvailability"`
+	Remark               string              `json:"remark"`
 }
 
 type AgentAccountUpdateReq struct {
-	ID             uint   `json:"id" validate:"required"`
-	Name           string `json:"name" validate:"required"`
-	APIKey         string `json:"apiKey" validate:"required"`
-	RememberAPIKey bool   `json:"rememberApiKey"`
-	BaseURL        string `json:"baseURL"`
-	APIType        string `json:"apiType" validate:"required"`
-	Remark         string `json:"remark"`
-	SyncAgents     bool   `json:"syncAgents"`
+	ID                   uint   `json:"id" validate:"required"`
+	Name                 string `json:"name" validate:"required"`
+	APIKey               string `json:"apiKey" validate:"required"`
+	RememberAPIKey       bool   `json:"rememberApiKey"`
+	BaseURL              string `json:"baseURL"`
+	APIType              string `json:"apiType" validate:"required"`
+	AuthMode             string `json:"authMode"`
+	VerifyModel          string `json:"verifyModel"`
+	ValidateAvailability *bool  `json:"validateAvailability"`
+	Remark               string `json:"remark"`
+	SyncAgents           bool   `json:"syncAgents"`
 }
 
 type AgentAccountVerifyReq struct {
 	Provider string `json:"provider" validate:"required"`
 	APIKey   string `json:"apiKey" validate:"required"`
 	BaseURL  string `json:"baseURL"`
+	APIType  string `json:"apiType" validate:"required"`
+	AuthMode string `json:"authMode"`
+	Model    string `json:"model"`
 }
 
 type AgentAccountDeleteReq struct {
@@ -271,39 +365,56 @@ type AgentAccountDeleteReq struct {
 type AgentAccountSearch struct {
 	PageInfo
 	Provider string `json:"provider"`
+	APIType  string `json:"apiType"`
+	TextOnly bool   `json:"textOnly"`
 	Name     string `json:"name"`
 }
 
+type AgentAccountProviderCountReq struct {
+	Providers []string `json:"providers"`
+}
+
 type AgentAccountInfo struct {
-	ID             uint                `json:"id"`
-	Provider       string              `json:"provider"`
-	ProviderName   string              `json:"providerName"`
-	Name           string              `json:"name"`
-	APIKey         string              `json:"apiKey"`
-	RememberAPIKey bool                `json:"rememberApiKey"`
-	BaseURL        string              `json:"baseUrl"`
-	Models         []AgentAccountModel `json:"models"`
-	APIType        string              `json:"apiType"`
-	Verified       bool                `json:"verified"`
-	Remark         string              `json:"remark"`
-	CreatedAt      time.Time           `json:"createdAt"`
+	ID              uint                `json:"id"`
+	MasterAccountID uint                `json:"masterAccountId"`
+	Provider        string              `json:"provider"`
+	ProviderName    string              `json:"providerName"`
+	Name            string              `json:"name"`
+	APIKey          string              `json:"apiKey"`
+	RememberAPIKey  bool                `json:"rememberApiKey"`
+	BaseURL         string              `json:"baseUrl"`
+	Models          []AgentAccountModel `json:"models"`
+	APIType         string              `json:"apiType"`
+	AuthMode        string              `json:"authMode"`
+	VerifyModel     string              `json:"verifyModel"`
+	Verified        bool                `json:"verified"`
+	Remark          string              `json:"remark"`
+	CreatedAt       time.Time           `json:"createdAt"`
 }
 
 type ProviderModelInfo struct {
-	ID            string   `json:"id"`
-	Name          string   `json:"name"`
-	ContextWindow int      `json:"contextWindow"`
-	MaxTokens     int      `json:"maxTokens"`
-	Reasoning     bool     `json:"reasoning"`
-	Input         []string `json:"input"`
+	ID   string `json:"id"`
+	Name string `json:"name"`
+}
+
+type ProviderAPIInfo struct {
+	APIType                string              `json:"apiType"`
+	BaseURL                string              `json:"baseUrl"`
+	EditableBaseURL        bool                `json:"editableBaseUrl"`
+	SupportsModelDiscovery bool                `json:"supportsModelDiscovery"`
+	DefaultAuthMode        string              `json:"defaultAuthMode"`
+	AuthModes              []string            `json:"authModes"`
+	Models                 []ProviderModelInfo `json:"models"`
 }
 
 type ProviderInfo struct {
-	Sort        uint                `json:"-"`
-	Provider    string              `json:"provider"`
-	DisplayName string              `json:"displayName"`
-	BaseURL     string              `json:"baseUrl"`
-	Models      []ProviderModelInfo `json:"models"`
+	Sort           uint                `json:"-"`
+	Provider       string              `json:"provider"`
+	DisplayName    string              `json:"displayName"`
+	BaseURL        string              `json:"baseUrl"`
+	DefaultAPIType string              `json:"defaultApiType"`
+	APITypes       []ProviderAPIInfo   `json:"apiTypes"`
+	Models         []ProviderModelInfo `json:"models"`
 }
 
 type AgentFeishuConfigReq struct {
@@ -324,11 +435,6 @@ type AgentFeishuConfigUpdateReq struct {
 	Bots           []AgentFeishuBot `json:"bots" validate:"required,min=1"`
 }
 
-type AgentFeishuPairingApproveReq struct {
-	AgentID     uint   `json:"agentId" validate:"required"`
-	PairingCode string `json:"pairingCode" validate:"required"`
-}
-
 type AgentFeishuConfig struct {
 	Enabled        bool             `json:"enabled"`
 	ThreadSession  bool             `json:"threadSession"`
@@ -498,6 +604,52 @@ type AgentPluginStatus struct {
 	Upgradable     bool   `json:"upgradable"`
 }
 
+type AgentPluginsReq struct {
+	AgentID uint `json:"agentId" validate:"required"`
+}
+
+type AgentPluginSearchReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	Keyword string `json:"keyword" validate:"required,max=100"`
+	Limit   int    `json:"limit" validate:"omitempty,min=1,max=100"`
+}
+
+type AgentPluginMarketInstallReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	Package string `json:"package" validate:"required,max=200"`
+	Version string `json:"version" validate:"required,max=100"`
+	TaskID  string `json:"taskID" validate:"required"`
+}
+
+type AgentPluginOperateReq struct {
+	AgentID  uint   `json:"agentId" validate:"required"`
+	PluginID string `json:"pluginId" validate:"required,max=200"`
+	Operate  string `json:"operate" validate:"required,oneof=enable disable update uninstall"`
+	TaskID   string `json:"taskID" validate:"required"`
+}
+
+type AgentPluginItem struct {
+	ID      string `json:"id"`
+	Name    string `json:"name"`
+	Version string `json:"version"`
+	Origin  string `json:"origin"`
+	Enabled bool   `json:"enabled"`
+}
+
+type AgentPluginSearchItem struct {
+	Package          string   `json:"package"`
+	PluginID         string   `json:"pluginId"`
+	Name             string   `json:"name"`
+	Description      string   `json:"description"`
+	Version          string   `json:"version"`
+	Channel          string   `json:"channel"`
+	VerificationTier string   `json:"verificationTier"`
+	Categories       []string `json:"categories"`
+	Official         bool     `json:"official"`
+	Downloads        int64    `json:"downloads"`
+	Score            float64  `json:"score"`
+}
+
 type AgentDiscordConfigUpdateReq struct {
 	AgentID        uint              `json:"agentId" validate:"required"`
 	Enabled        bool              `json:"enabled"`
@@ -577,16 +729,20 @@ type AgentSecurityConfig struct {
 }
 
 type AgentOtherConfigUpdateReq struct {
-	AgentID        uint   `json:"agentId" validate:"required"`
-	UserTimezone   string `json:"userTimezone" validate:"required"`
-	BrowserEnabled bool   `json:"browserEnabled"`
-	NPMRegistry    string `json:"npmRegistry" validate:"required"`
+	AgentID           uint   `json:"agentId" validate:"required"`
+	UserTimezone      string `json:"userTimezone"`
+	BrowserEnabled    bool   `json:"browserEnabled"`
+	NPMRegistry       string `json:"npmRegistry"`
+	DashboardUsername string `json:"dashboardUsername"`
+	DashboardPassword string `json:"dashboardPassword"`
 }
 
 type AgentOtherConfig struct {
-	UserTimezone   string `json:"userTimezone"`
-	BrowserEnabled bool   `json:"browserEnabled"`
-	NPMRegistry    string `json:"npmRegistry"`
+	UserTimezone      string `json:"userTimezone"`
+	BrowserEnabled    bool   `json:"browserEnabled"`
+	NPMRegistry       string `json:"npmRegistry"`
+	DashboardUsername string `json:"dashboardUsername"`
+	DashboardPassword string `json:"dashboardPassword"`
 }
 
 type AgentConfigFileReq struct {
@@ -604,7 +760,7 @@ type AgentConfigFile struct {
 
 type AgentSkillSearchReq struct {
 	AgentID uint   `json:"agentId" validate:"required"`
-	Source  string `json:"source" validate:"required,oneof=clawhub-global clawhub-cn skillhub official skills-sh"`
+	Source  string `json:"source" validate:"required,oneof=clawhub-global clawhub-cn skillhub official skills-sh local-hub"`
 	Keyword string `json:"keyword" validate:"required"`
 }
 
@@ -641,7 +797,7 @@ type AgentSkillUpdateReq struct {
 
 type AgentSkillInstallReq struct {
 	AgentID uint   `json:"agentId" validate:"required"`
-	Source  string `json:"source" validate:"required,oneof=clawhub-global clawhub-cn skillhub official skills-sh"`
+	Source  string `json:"source" validate:"required,oneof=clawhub-global clawhub-cn skillhub official skills-sh local-hub"`
 	Slug    string `json:"slug" validate:"required"`
 	TaskID  string `json:"taskID" validate:"required"`
 }

agent/app/dto/alert.go

@@ -2,8 +2,9 @@ package dto
 
 import (
 	"encoding/json"
-	"github.com/1Panel-dev/1Panel/agent/app/model"
 	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/model"
 )
 
 type CreateOrUpdateAlert struct {
@@ -35,6 +36,15 @@ type AlertSearch struct {
 	Method  string `json:"method"`
 }
 
+type AlertConfigQuery struct {
+	ExcludeTypes []string `json:"excludeTypes"`
+}
+
+type AlertConfigPageReq struct {
+	PageInfo
+	ExcludeTypes []string `json:"excludeTypes"`
+}
+
 type AlertDTO struct {
 	ID             uint      `json:"id"`
 	Type           string    `json:"type"`
@@ -46,6 +56,8 @@ type AlertDTO struct {
 	Status         string    `json:"status"`
 	SendCount      uint      `json:"sendCount"`
 	AdvancedParams string    `json:"advancedParams"`
+	CreateUser     string    `json:"createUser"`
+	UpdateUser     string    `json:"updateUser"`
 	CreatedAt      time.Time `json:"createdAt"`
 	UpdatedAt      time.Time `json:"updatedAt"`
 }
@@ -101,8 +113,10 @@ type DiskDTO struct {
 
 type AlertLogSearch struct {
 	PageInfo
-	Count  uint   `json:"count"`
-	Status string `json:"status"`
+	Count     uint      `json:"count"`
+	Status    string    `json:"status"`
+	StartTime time.Time `json:"startTime"`
+	EndTime   time.Time `json:"endTime"`
 }
 
 type AlertLogDTO struct {
@@ -281,11 +295,12 @@ type OfflineQueryRequest struct {
 }
 
 type AlertConfigUpdate struct {
-	ID     uint   `json:"id"`
-	Type   string `json:"type"`
-	Title  string `json:"title"`
-	Status string `json:"status"`
-	Config string `json:"config"`
+	ID          uint   `json:"id"`
+	Type        string `json:"type"`
+	Title       string `json:"title"`
+	Status      string `json:"status"`
+	Config      string `json:"config"`
+	DisplayName string `json:"displayName"`
 }
 
 type AlertConfigTest struct {

agent/app/dto/app.go

@@ -2,6 +2,7 @@ package dto
 
 import (
 	"context"
+
 	"github.com/1Panel-dev/1Panel/agent/app/model"
 	"github.com/1Panel-dev/1Panel/agent/app/task"
 )
@@ -132,6 +133,8 @@ type Locale struct {
 	Ko     string `json:"ko"`
 	Tr     string `json:"tr"`
 	Es     string `json:"es-es" yaml:"es-es"`
+	Fa     string `json:"fa"`
+	Lo     string `json:"lo"`
 }
 
 type AppForm struct {

agent/app/dto/backup.go

@@ -65,14 +65,15 @@ type UploadForRecover struct {
 }
 
 type CommonBackup struct {
-	Type       string   `json:"type" validate:"required,oneof=app mysql mariadb redis website postgresql mongodb mysql-cluster postgresql-cluster redis-cluster container compose"`
-	Name       string   `json:"name"`
-	DetailName string   `json:"detailName"`
-	Secret     string   `json:"secret"`
-	StopBefore bool     `json:"stopBefore"`
-	TaskID     string   `json:"taskID"`
-	FileName   string   `json:"fileName"`
-	Args       []string `json:"args"`
+	Type        string   `json:"type" validate:"required,oneof=app mysql mariadb redis website postgresql mongodb mysql-cluster postgresql-cluster redis-cluster container compose"`
+	Name        string   `json:"name"`
+	DetailName  string   `json:"detailName"`
+	Secret      string   `json:"secret"`
+	IsImmediate bool     `json:"isImmediate"`
+	StopBefore  bool     `json:"stopBefore"`
+	TaskID      string   `json:"taskID"`
+	FileName    string   `json:"fileName"`
+	Args        []string `json:"args"`
 
 	Description string `json:"description"`
 }

agent/app/dto/common_req.go

@@ -2,7 +2,8 @@ package dto
 
 type SearchWithPage struct {
 	PageInfo
-	Info string `json:"info"`
+	Info            string `json:"info"`
+	ExcludeAppStore bool   `json:"excludeAppStore"`
 }
 
 type SearchPageWithType struct {

agent/app/dto/container.go

@@ -134,10 +134,15 @@ type ExtraHost struct {
 	IP       string `json:"ip"`
 }
 type ContainerNetwork struct {
-	Network string `json:"network"`
-	Ipv4    string `json:"ipv4"`
-	Ipv6    string `json:"ipv6"`
-	MacAddr string `json:"macAddr"`
+	Network      string            `json:"network"`
+	Ipv4         string            `json:"ipv4"`
+	Ipv6         string            `json:"ipv6"`
+	MacAddr      string            `json:"macAddr"`
+	Links        []string          `json:"links"`
+	Aliases      []string          `json:"aliases"`
+	DriverOpts   map[string]string `json:"driverOpts"`
+	GwPriority   int               `json:"gwPriority"`
+	LinkLocalIPs []string          `json:"linkLocalIPs"`
 }
 
 type ContainerCreateByCommand struct {
@@ -295,6 +300,7 @@ type ComposeInfo struct {
 	ConfigFile        string             `json:"configFile"`
 	Workdir           string             `json:"workdir"`
 	ComposeFileExists bool               `json:"composeFileExists"`
+	IsPinned          bool               `json:"isPinned"`
 	Path              string             `json:"path"`
 	Containers        []ComposeContainer `json:"containers"`
 	Env               string             `json:"env"`
@@ -309,6 +315,7 @@ type ComposeContainer struct {
 type ComposeCreate struct {
 	TaskID    string `json:"taskID"`
 	Name      string `json:"name"`
+	DirName   string `json:"dirName"`
 	From      string `json:"from" validate:"required,oneof=edit path template"`
 	File      string `json:"file"`
 	Path      string `json:"path"`
@@ -319,7 +326,7 @@ type ComposeCreate struct {
 type ComposeOperation struct {
 	Name      string `json:"name" validate:"required"`
 	Path      string `json:"path"`
-	Operation string `json:"operation" validate:"required,oneof=up start restart stop down delete"`
+	Operation string `json:"operation" validate:"required,oneof=up start restart stop down delete rebuild"`
 	WithFile  bool   `json:"withFile"`
 	Force     bool   `json:"force"`
 }
@@ -332,6 +339,10 @@ type ComposeUpdate struct {
 	Env        string `json:"env"`
 	ForcePull  bool   `json:"forcePull"`
 }
+type ComposePin struct {
+	Name     string `json:"name" validate:"required"`
+	IsPinned bool   `json:"isPinned"`
+}
 type ComposeLogClean struct {
 	Name       string `json:"name" validate:"required"`
 	Path       string `json:"path" validate:"required"`

agent/app/dto/cronjob.go

@@ -197,6 +197,7 @@ type SearchRecord struct {
 
 type Record struct {
 	ID         uint   `json:"id"`
+	CronjobID  uint   `json:"cronjobID"`
 	TaskID     string `json:"taskID"`
 	StartTime  string `json:"startTime"`
 	Records    string `json:"records"`

agent/app/dto/dashboard.go

@@ -79,8 +79,9 @@ type NodeCurrent struct {
 }
 
 type DashboardCurrent struct {
-	Uptime          uint64 `json:"uptime"`
-	TimeSinceUptime string `json:"timeSinceUptime"`
+	Uptime          uint64      `json:"uptime"`
+	TimeSinceUptime string      `json:"timeSinceUptime"`
+	RunningTime     RunningTime `json:"runningTime"`
 
 	Procs uint64 `json:"procs"`
 
@@ -128,6 +129,13 @@ type DashboardCurrent struct {
 	ShotTime time.Time `json:"shotTime"`
 }
 
+type RunningTime struct {
+	Days    uint64 `json:"days"`
+	Hours   uint64 `json:"hours"`
+	Minutes uint64 `json:"minutes"`
+	Seconds uint64 `json:"seconds"`
+}
+
 type AppLauncherSync struct {
 	Keys []string `json:"keys"`
 }

agent/app/dto/database.go

@@ -60,25 +60,84 @@ type MysqlDBCreate struct {
 	Database    string `json:"database" validate:"required"`
 	Format      string `json:"format" validate:"required"`
 	Collation   string `json:"collation"`
-	Username    string `json:"username" validate:"required"`
-	Password    string `json:"password" validate:"required"`
+	Username    string `json:"username"`
+	Password    string `json:"password"`
 	Permission  string `json:"permission" validate:"required"`
 	Description string `json:"description"`
 }
 
+type MysqlUser struct {
+	Username    string `json:"username"`
+	Host        string `json:"host"`
+	Password    string `json:"password"`
+	Description string `json:"description"`
+	IsDelete    bool   `json:"isDelete"`
+}
+
+type MysqlGrant struct {
+	Database string `json:"database"`
+	Username string `json:"username"`
+	Host     string `json:"host"`
+}
+
+type MysqlGrantSummarySearch struct {
+	Database string   `json:"database" validate:"required"`
+	DBs      []string `json:"dbs" validate:"required"`
+}
+
+type MysqlUserSearch struct {
+	Database string `json:"database" validate:"required"`
+}
+
+type MysqlUserCreate struct {
+	Database    string   `json:"database" validate:"required"`
+	Username    string   `json:"username" validate:"required"`
+	Password    string   `json:"password" validate:"required"`
+	Host        string   `json:"host" validate:"required"`
+	Description string   `json:"description"`
+	DBs         []string `json:"dbs"`
+}
+
+type MysqlUserDelete struct {
+	Database string `json:"database" validate:"required"`
+	Username string `json:"username" validate:"required"`
+	Host     string `json:"host" validate:"required"`
+}
+
+type MysqlUserUpdate struct {
+	Database    string `json:"database" validate:"required"`
+	Username    string `json:"username" validate:"required"`
+	Host        string `json:"host" validate:"required"`
+	NewHost     string `json:"newHost" validate:"required"`
+	Description string `json:"description"`
+}
+
+type MysqlUserPassword struct {
+	Database string `json:"database" validate:"required"`
+	Username string `json:"username" validate:"required"`
+	Host     string `json:"host" validate:"required"`
+	Password string `json:"password" validate:"required"`
+}
+
+type MysqlGrantCreate struct {
+	Database string `json:"database" validate:"required"`
+	DB       string `json:"db" validate:"required"`
+	Username string `json:"username" validate:"required"`
+	Host     string `json:"host" validate:"required"`
+}
+
+type MysqlGrantDelete struct {
+	Database string `json:"database" validate:"required"`
+	DB       string `json:"db" validate:"required"`
+	Username string `json:"username" validate:"required"`
+	Host     string `json:"host" validate:"required"`
+}
+
 type MysqlFormatCollationOption struct {
 	Format     string   `json:"format"`
 	Collations []string `json:"collations"`
 }
 
-type BindUser struct {
-	Database   string `json:"database" validate:"required"`
-	DB         string `json:"db" validate:"required"`
-	Username   string `json:"username" validate:"required"`
-	Password   string `json:"password" validate:"required"`
-	Permission string `json:"permission" validate:"required"`
-}
-
 type MysqlLoadDB struct {
 	From     string `json:"from" validate:"required,oneof=local remote"`
 	Type     string `json:"type" validate:"required,oneof=mysql mariadb mysql-cluster"`

agent/app/dto/firewall.go

@@ -35,19 +35,6 @@ type PortRuleOperate struct {
 	Description string `json:"description"`
 }
 
-type ForwardRuleOperate struct {
-	ForceDelete bool `json:"forceDelete"`
-	Rules       []struct {
-		Operation  string `json:"operation" validate:"required,oneof=add remove"`
-		Num        string `json:"num"`
-		Protocol   string `json:"protocol" validate:"required,oneof=tcp udp tcp/udp"`
-		Interface  string `json:"interface"`
-		Port       string `json:"port" validate:"required"`
-		TargetIP   string `json:"targetIP"`
-		TargetPort string `json:"targetPort" validate:"required"`
-	} `json:"rules"`
-}
-
 type UpdateFirewallDescription struct {
 	Type     string `json:"type"`
 	Chain    string `json:"chain"`
@@ -86,7 +73,7 @@ type BatchRuleOperate struct {
 }
 
 type IptablesOp struct {
-	Name    string `json:"name" validate:"required,oneof=1PANEL_INPUT 1PANEL_OUTPUT 1PANEL_BASIC"`
+	Name    string `json:"name" validate:"required,oneof=1PANEL_INPUT 1PANEL_OUTPUT 1PANEL_BASIC 1PANEL_FORWARD"`
 	Operate string `json:"operate" validate:"required,oneof=init-base init-forward init-advance bind-base unbind-base bind unbind"`
 }
 

agent/app/dto/forwarding.go

@@ -0,0 +1,43 @@
+package dto
+
+type ForwardRuleSearch struct {
+	PageInfo
+	Info     string `json:"info"`
+	Status   string `json:"status"`
+	Strategy string `json:"strategy"`
+}
+
+// ForwardRule preserves the existing firewall search response shape while
+// keeping forwarding data separate from the filter client model.
+type ForwardRule struct {
+	ID       uint   `json:"id"`
+	Chain    string `json:"chain"`
+	Family   string `json:"family"`
+	Address  string `json:"address"`
+	Port     string `json:"port"`
+	Protocol string `json:"protocol"`
+	Strategy string `json:"strategy"`
+
+	Num        string `json:"num"`
+	TargetIP   string `json:"targetIP"`
+	TargetPort string `json:"targetPort"`
+	Interface  string `json:"interface"`
+
+	UsedStatus  string `json:"usedStatus"`
+	Description string `json:"description"`
+}
+
+type ForwardRuleOperate struct {
+	ForceDelete bool                   `json:"forceDelete"`
+	Rules       []ForwardRuleOperation `json:"rules"`
+}
+
+type ForwardRuleOperation struct {
+	Operation  string `json:"operation" validate:"required,oneof=add remove"`
+	Num        string `json:"num"`
+	Protocol   string `json:"protocol" validate:"required,oneof=tcp udp tcp/udp"`
+	Interface  string `json:"interface"`
+	Port       string `json:"port" validate:"required"`
+	TargetIP   string `json:"targetIP"`
+	TargetPort string `json:"targetPort" validate:"required"`
+}

agent/app/dto/logs.go

@@ -1,6 +1,8 @@
 package dto
 
 import (
+	"time"
+
 	"github.com/1Panel-dev/1Panel/agent/app/model"
 )
 
@@ -14,3 +16,37 @@ type SearchTaskLogReq struct {
 type TaskDTO struct {
 	model.Task
 }
+
+type SystemLogReq struct {
+	PageSize  int       `json:"pageSize" validate:"omitempty,min=1,max=500"`
+	Cursor    string    `json:"cursor"`
+	StartTime time.Time `json:"startTime"`
+	EndTime   time.Time `json:"endTime"`
+	Keyword   string    `json:"keyword"`
+	Priority  string    `json:"priority"`
+	Service   string    `json:"service"`
+}
+
+type SystemLogRes struct {
+	Source     string          `json:"source"`
+	Items      []SystemLogItem `json:"items"`
+	HasMore    bool            `json:"hasMore"`
+	NextCursor string          `json:"nextCursor"`
+}
+
+type SystemLogStatus struct {
+	Source                 string `json:"source"`
+	Version                string `json:"version"`
+	KeywordFilterSupported bool   `json:"keywordFilterSupported"`
+	Message                string `json:"message"`
+}
+
+type SystemLogItem struct {
+	Timestamp int64  `json:"-"`
+	Cursor    string `json:"-"`
+	Time      string `json:"time"`
+	Priority  string `json:"priority"`
+	Service   string `json:"service"`
+	Message   string `json:"message"`
+	Raw       string `json:"raw"`
+}

agent/app/dto/nginx.go

@@ -1,6 +1,8 @@
 package dto
 
 import (
+	"time"
+
 	"github.com/1Panel-dev/1Panel/agent/app/model"
 	"github.com/1Panel-dev/1Panel/agent/utils/nginx/components"
 )
@@ -87,9 +89,41 @@ var LBAlgorithms = map[string]struct{}{"ip_hash": {}, "least_conn": {}}
 var RealIPKeys = map[string]struct{}{"X-Forwarded-For": {}, "X-Real-IP": {}, "CF-Connecting-IP": {}}
 
 type NginxModule struct {
-	Name     string   `json:"name"`
-	Script   string   `json:"script"`
-	Packages []string `json:"packages"`
-	Params   string   `json:"params"`
-	Enable   bool     `json:"enable"`
+	Name      string             `json:"name"`
+	Custom    bool               `json:"custom,omitempty"`
+	Script    string             `json:"script"`
+	Packages  []string           `json:"packages"`
+	Params    string             `json:"params"`
+	Enable    bool               `json:"enable"`
+	BuildMode string             `json:"buildMode,omitempty"`
+	Provider  string             `json:"provider,omitempty"`
+	LoadOrder int                `json:"loadOrder,omitempty"`
+	Builds    []NginxModuleBuild `json:"builds,omitempty"`
+	LastError string             `json:"lastError,omitempty"`
+}
+
+type NginxModuleBuild struct {
+	Provider  string                `json:"provider"`
+	BuildMode string                `json:"buildMode"`
+	Status    string                `json:"status"`
+	Hash      string                `json:"hash"`
+	Target    NginxModuleTarget     `json:"target"`
+	Artifacts []NginxModuleArtifact `json:"artifacts,omitempty"`
+	Error     string                `json:"error,omitempty"`
+	BuiltAt   time.Time             `json:"builtAt,omitempty"`
+}
+
+type NginxModuleTarget struct {
+	Key              string `json:"key"`
+	OpenRestyVersion string `json:"openrestyVersion"`
+	Architecture     string `json:"architecture"`
+	Image            string `json:"image,omitempty"`
+	ImageDigest      string `json:"imageDigest,omitempty"`
+	BuilderDigest    string `json:"builderDigest,omitempty"`
+}
+
+type NginxModuleArtifact struct {
+	Name     string `json:"name"`
+	Path     string `json:"path"`
+	Checksum string `json:"checksum"`
 }

agent/app/dto/request/app.go

@@ -99,6 +99,7 @@ type AppInstallUpgrade struct {
 	DetailID      uint   `json:"detailId"`
 	Backup        bool   `json:"backup"`
 	PullImage     bool   `json:"pullImage"`
+	DeleteImage   bool   `json:"deleteImage"`
 	DockerCompose string `json:"dockerCompose"`
 	TaskID        string `json:"taskID"`
 }

agent/app/dto/request/file.go

@@ -121,6 +121,7 @@ type FileWget struct {
 	Path              string `json:"path" validate:"required"`
 	Name              string `json:"name" validate:"required"`
 	IgnoreCertificate bool   `json:"ignoreCertificate"`
+	UseProxy          bool   `json:"useProxy"`
 }
 
 type FileMove struct {
@@ -162,13 +163,20 @@ type FileRoleUpdate struct {
 type FileReadByLineReq struct {
 	Page     int    `json:"page" validate:"required"`
 	PageSize int    `json:"pageSize" validate:"required"`
-	Type     string `json:"type" validate:"required"`
+	Type     string `json:"type"`
 	ID       uint   `json:"ID"`
 	Name     string `json:"name"`
 	Latest   bool   `json:"latest"`
 	TaskReq
 }
 
+type TaskLogReadReq struct {
+	Page     int  `json:"page" validate:"required,min=1"`
+	PageSize int  `json:"pageSize" validate:"required,min=1"`
+	Latest   bool `json:"latest"`
+	TaskReq
+}
+
 type TaskReq struct {
 	TaskID      string `json:"taskID"`
 	TaskType    string `json:"taskType"`

agent/app/dto/request/host_tool.go

@@ -1,8 +1,12 @@
 package request
 
-type HostToolReq struct {
+type HostToolTypeReq struct {
+	Type string `json:"type" validate:"required,oneof=supervisord"`
+}
+
+type HostToolOperateReq struct {
 	Type    string `json:"type" validate:"required,oneof=supervisord"`
-	Operate string `json:"operate" validate:"oneof=status restart start stop"`
+	Operate string `json:"operate" validate:"required,oneof=restart start stop"`
 }
 
 type HostToolCreate struct {
@@ -15,13 +19,8 @@ type SupervisorConfig struct {
 	ServiceName string `json:"serviceName"`
 }
 
-type HostToolLogReq struct {
-	Type string `json:"type" validate:"required,oneof=supervisord"`
-}
-
-type HostToolConfig struct {
+type HostToolConfigUpdate struct {
 	Type    string `json:"type" validate:"required,oneof=supervisord"`
-	Operate string `json:"operate" validate:"oneof=get set"`
 	Content string `json:"content"`
 }
 
@@ -43,3 +42,15 @@ type SupervisorProcessFileReq struct {
 	Content string `json:"content"`
 	File    string `json:"file" validate:"required,oneof=out.log err.log config"`
 }
+
+type HostSupervisorProcessFileGetReq struct {
+	Name string `json:"name" validate:"required"`
+	File string `json:"file" validate:"required,oneof=out.log err.log config"`
+}
+
+type HostSupervisorProcessFileOperateReq struct {
+	Name    string `json:"name" validate:"required"`
+	Operate string `json:"operate" validate:"required,oneof=clear update"`
+	Content string `json:"content"`
+	File    string `json:"file" validate:"required,oneof=out.log err.log config"`
+}

agent/app/dto/request/mcp_server.go

@@ -21,6 +21,10 @@ type McpServerCreate struct {
 	StreamableHttpPath string        `json:"streamableHttpPath"`
 	OutputTransport    string        `json:"outputTransport" validate:"required"`
 	Type               string        `json:"type" validate:"required"`
+	GatewayImage       string        `json:"gatewayImage"`
+	ProtocolVersion    string        `json:"protocolVersion"`
+	GatewayArgs        string        `json:"gatewayArgs" validate:"max=4096"`
+	TaskID             string        `json:"taskID"`
 }
 
 type McpServerUpdate struct {
@@ -32,11 +36,23 @@ type McpServerDelete struct {
 	ID uint `json:"id" validate:"required"`
 }
 
+type McpServerDetail struct {
+	ID uint `json:"id" validate:"required"`
+}
+
+type McpServerStatusSync struct {
+	IDs []uint `json:"ids"`
+}
+
 type McpServerOperate struct {
 	ID      uint   `json:"id" validate:"required"`
 	Operate string `json:"operate" validate:"required"`
 }
 
+type McpServerConnectionTest struct {
+	ID uint `json:"id" validate:"required"`
+}
+
 type McpBindDomain struct {
 	Domain string `json:"domain" validate:"required"`
 	SSLID  uint   `json:"sslID"`

agent/app/dto/request/nginx.go

@@ -114,17 +114,22 @@ type NginxRedirectUpdate struct {
 }
 
 type NginxBuildReq struct {
-	TaskID string `json:"taskID" validate:"required"`
-	Mirror string `json:"mirror"  validate:"required"`
+	TaskID  string   `json:"taskID" validate:"required"`
+	Mirror  string   `json:"mirror" validate:"required"`
+	Modules []string `json:"modules"`
+	Force   bool     `json:"force"`
 }
 
 type NginxModuleUpdate struct {
-	Operate  string `json:"operate" validate:"required,oneof=create delete update"`
-	Name     string `json:"name" validate:"required"`
-	Script   string `json:"script"`
-	Packages string `json:"packages"`
-	Enable   bool   `json:"enable"`
-	Params   string `json:"params"`
+	Operate   string `json:"operate" validate:"required,oneof=create delete update"`
+	Name      string `json:"name" validate:"required"`
+	Script    string `json:"script"`
+	Packages  string `json:"packages"`
+	Enable    bool   `json:"enable"`
+	Params    string `json:"params"`
+	BuildMode string `json:"buildMode" validate:"omitempty,oneof=dynamic static"`
+	Provider  string `json:"provider" validate:"omitempty,oneof=local prebuilt"`
+	LoadOrder int    `json:"loadOrder" validate:"omitempty,min=0,max=9999"`
 }
 
 type NginxOperateReq struct {

agent/app/dto/request/runtime.go

@@ -21,13 +21,14 @@ type RuntimeCreate struct {
 	Source      string `json:"source"`
 	CodeDir     string `json:"codeDir"`
 	Remark      string `json:"remark"`
+	TaskID      string `json:"taskID"`
 
 	Params map[string]interface{} `json:"params"`
 	NodeConfig
 }
 
 type NodeConfig struct {
-	Install      bool          `json:"install"`
+	Install      *bool         `json:"install"`
 	Clean        bool          `json:"clean"`
 	ExposedPorts []ExposedPort `json:"exposedPorts"`
 	Environments []Environment `json:"environments"`
@@ -42,12 +43,14 @@ type Environment struct {
 type Volume struct {
 	Source string `json:"source"`
 	Target string `json:"target"`
+	Mode   string `json:"mode"`
 }
 
 type ExposedPort struct {
 	HostPort      int    `json:"hostPort"`
 	ContainerPort int    `json:"containerPort"`
 	HostIP        string `json:"hostIP"`
+	Protocol      string `json:"protocol"`
 }
 
 type ExtraHost struct {
@@ -56,8 +59,10 @@ type ExtraHost struct {
 }
 
 type RuntimeDelete struct {
-	ID          uint `json:"id"`
-	ForceDelete bool `json:"forceDelete"`
+	ID          uint   `json:"id"`
+	ForceDelete bool   `json:"forceDelete"`
+	DeleteImage bool   `json:"deleteImage"`
+	TaskID      string `json:"taskID"`
 }
 
 type RuntimeUpdate struct {

agent/app/dto/request/website.go

@@ -34,6 +34,8 @@ type WebsiteCreate struct {
 
 	SiteDir string `json:"siteDir"`
 
+	TemplateOutputID uint `json:"templateOutputID"`
+
 	RuntimeConfig
 	FtpConfig
 	DataBaseConfig
@@ -223,9 +225,14 @@ type WebsiteNginxUpdate struct {
 }
 
 type WebsiteLogReq struct {
+	ID      uint   `json:"id" validate:"required"`
+	Operate string `json:"operate" validate:"required,oneof=enable disable delete"`
+	LogType string `json:"logType" validate:"required,oneof=access.log error.log"`
+}
+
+type WebsiteLogSearchReq struct {
 	ID       uint   `json:"id" validate:"required"`
-	Operate  string `json:"operate" validate:"required"`
-	LogType  string `json:"logType" validate:"required"`
+	LogType  string `json:"logType" validate:"required,oneof=access.log error.log"`
 	Page     int    `json:"page"`
 	PageSize int    `json:"pageSize"`
 }

agent/app/dto/request/website_ssl.go

@@ -6,7 +6,7 @@ type WebsiteSSLSearch struct {
 	dto.PageInfo
 	AcmeAccountID string `json:"acmeAccountID"`
 	Domain        string `json:"domain"`
-	OrderBy       string `json:"orderBy" validate:"omitempty,oneof=created_at expire_date"`
+	OrderBy       string `json:"orderBy" validate:"omitempty,oneof=created_at updated_at expire_date"`
 	Order         string `json:"order" validate:"omitempty,oneof=null ascending descending"`
 }
 
@@ -61,7 +61,7 @@ type WebsiteSSLObtain struct {
 type WebsiteAcmeAccountCreate struct {
 	Email      string `json:"email" validate:"required"`
 	Type       string `json:"type" validate:"required,oneof=letsencrypt zerossl buypass google custom"`
-	KeyType    string `json:"keyType" validate:"required,oneof=P256 P384 2048 3072 4096 8192"`
+	KeyType    string `json:"keyType" validate:"required,oneof=EC256 EC384 RSA2048 RSA3072 RSA4096 RSA8192"`
 	EabKid     string `json:"eabKid"`
 	EabHmacKey string `json:"eabHmacKey"`
 	UseProxy   bool   `json:"useProxy"`
@@ -126,6 +126,16 @@ type WebsiteSSLUpload struct {
 	Type            string `json:"type" validate:"required,oneof=paste local"`
 	SSLID           uint   `json:"sslID"`
 	Description     string `json:"description"`
+	PushNode        bool   `json:"pushNode"`
+	Nodes           string `json:"nodes"`
+}
+
+type WebsiteSSLPush struct {
+	ID       uint   `json:"id" validate:"required"`
+	PushNode bool   `json:"pushNode"`
+	Nodes    string `json:"nodes"`
+	TaskID   string `json:"taskID" validate:"required"`
+	Sync     bool   `json:"sync"`
 }
 
 type WebsiteCASearch struct {
@@ -138,7 +148,7 @@ type WebsiteCACreate struct {
 	Organization     string `json:"organization" validate:"required"`
 	OrganizationUint string `json:"organizationUint"`
 	Name             string `json:"name" validate:"required"`
-	KeyType          string `json:"keyType" validate:"required,oneof=P256 P384 2048 3072 4096 8192"`
+	KeyType          string `json:"keyType" validate:"required,oneof=EC256 EC384 RSA2048 RSA3072 RSA4096 RSA8192"`
 	Province         string `json:"province" `
 	City             string `json:"city"`
 }
@@ -146,7 +156,7 @@ type WebsiteCACreate struct {
 type WebsiteCAObtain struct {
 	ID          uint   `json:"id" validate:"required"`
 	Domains     string `json:"domains" validate:"required"`
-	KeyType     string `json:"keyType" validate:"required,oneof=P256 P384 2048 3072 4096 8192"`
+	KeyType     string `json:"keyType" validate:"required,oneof=EC256 EC384 RSA2048 RSA3072 RSA4096 RSA8192"`
 	Time        int    `json:"time" validate:"required"`
 	Unit        string `json:"unit" validate:"required"`
 	PushDir     bool   `json:"pushDir"`
@@ -157,6 +167,8 @@ type WebsiteCAObtain struct {
 	Description string `json:"description"`
 	ExecShell   bool   `json:"execShell"`
 	Shell       string `json:"shell"`
+	PushNode    bool   `json:"pushNode"`
+	Nodes       string `json:"nodes"`
 }
 
 type WebsiteCARenew struct {
@@ -167,4 +179,6 @@ type WebsiteSSLFileUpload struct {
 	Type        string `json:"type"`
 	Description string `json:"description"`
 	SSLID       uint64 `json:"sslID"`
+	PushNode    bool   `json:"pushNode"`
+	Nodes       string `json:"nodes"`
 }

agent/app/dto/request/website_template.go

@@ -0,0 +1,46 @@
+package request
+
+import (
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+)
+
+type WebsiteTemplateSearch struct {
+	dto.PageInfo
+	Name string `json:"name"`
+	Type string `json:"type"`
+}
+
+type WebsiteTemplateCreate struct {
+	Name      string `json:"name" validate:"required"`
+	Type      string `json:"type" validate:"required,oneof=single multi"`
+	Content   string `json:"content"`
+	FilePath  string `json:"filePath"`
+	Variables string `json:"variables"`
+	Remark    string `json:"remark"`
+}
+
+type WebsiteTemplateUpdate struct {
+	ID        uint   `json:"id" validate:"required"`
+	Name      string `json:"name" validate:"required"`
+	Type      string `json:"type" validate:"required,oneof=single multi"`
+	Content   string `json:"content"`
+	FilePath  string `json:"filePath"`
+	Variables string `json:"variables"`
+	Remark    string `json:"remark"`
+}
+
+type WebsiteTemplateOutputSearch struct {
+	dto.PageInfo
+	TemplateID uint `json:"templateID"`
+}
+
+type WebsiteTemplateOutputCreate struct {
+	TemplateID     uint              `json:"templateID" validate:"required"`
+	Name           string            `json:"name" validate:"required"`
+	VariableValues map[string]string `json:"variableValues"`
+}
+
+type WebsitePreviewReq struct {
+	TemplateID     uint              `json:"templateID" validate:"required"`
+	VariableValues map[string]string `json:"variableValues"`
+}

agent/app/dto/response/app.go

@@ -104,34 +104,36 @@ type AppDetail struct {
 }
 
 type AppInstallDTO struct {
-	ID            uint      `json:"id"`
-	Name          string    `json:"name"`
-	AppID         uint      `json:"appID"`
-	AppDetailID   uint      `json:"appDetailID"`
-	Version       string    `json:"version"`
-	Status        string    `json:"status"`
-	Message       string    `json:"message"`
-	HttpPort      int       `json:"httpPort"`
-	HttpsPort     int       `json:"httpsPort"`
-	Path          string    `json:"path"`
-	CanUpdate     bool      `json:"canUpdate"`
-	Icon          string    `json:"icon"`
-	AppName       string    `json:"appName"`
-	Ready         int       `json:"ready"`
-	Total         int       `json:"total"`
-	AppKey        string    `json:"appKey"`
-	AppType       string    `json:"appType"`
-	AppStatus     string    `json:"appStatus"`
-	DockerCompose string    `json:"dockerCompose"`
-	WebUI         string    `json:"webUI"`
-	CreatedAt     time.Time `json:"createdAt"`
-	Favorite      bool      `json:"favorite"`
-	SortOrder     int       `json:"sortOrder"`
-	App           AppDetail `json:"app"`
-	Container     string    `json:"container"`
-	IsEdit        bool      `json:"isEdit"`
-	LinkDB        bool      `json:"linkDB"`
-	ServiceName   string    `json:"serviceName"`
+	ID            uint                   `json:"id"`
+	Name          string                 `json:"name"`
+	AppID         uint                   `json:"appID"`
+	AppDetailID   uint                   `json:"appDetailID"`
+	Version       string                 `json:"version"`
+	Status        string                 `json:"status"`
+	Message       string                 `json:"message"`
+	HttpPort      int                    `json:"httpPort"`
+	HttpsPort     int                    `json:"httpsPort"`
+	Path          string                 `json:"path"`
+	CanUpdate     bool                   `json:"canUpdate"`
+	Icon          string                 `json:"icon"`
+	AppName       string                 `json:"appName"`
+	Ready         int                    `json:"ready"`
+	Total         int                    `json:"total"`
+	AppKey        string                 `json:"appKey"`
+	AppType       string                 `json:"appType"`
+	AppStatus     string                 `json:"appStatus"`
+	DockerCompose string                 `json:"dockerCompose"`
+	WebUI         string                 `json:"webUI"`
+	CreatedAt     time.Time              `json:"createdAt"`
+	Favorite      bool                   `json:"favorite"`
+	SortOrder     int                    `json:"sortOrder"`
+	App           AppDetail              `json:"app"`
+	Container     string                 `json:"container"`
+	IsEdit        bool                   `json:"isEdit"`
+	LinkDB        bool                   `json:"linkDB"`
+	ResourceKeys  []string               `json:"resourceKeys"`
+	ServiceName   string                 `json:"serviceName"`
+	Env           map[string]interface{} `json:"env"`
 }
 
 type AppInstallInfo struct {

agent/app/dto/response/mcp_server.go

@@ -16,6 +16,12 @@ type McpServerDTO struct {
 	Volumes      []request.Volume      `json:"volumes"`
 }
 
+type McpServerStatusDTO struct {
+	ID      uint   `json:"id"`
+	Status  string `json:"status"`
+	Message string `json:"message"`
+}
+
 type McpBindDomainRes struct {
 	Domain        string   `json:"domain"`
 	SSLID         uint     `json:"sslID"`
@@ -24,3 +30,11 @@ type McpBindDomainRes struct {
 	WebsiteID     uint     `json:"websiteID"`
 	ConnUrl       string   `json:"connUrl"`
 }
+
+type McpServerConnectionTestRes struct {
+	Success         bool   `json:"success"`
+	Endpoint        string `json:"endpoint"`
+	OutputTransport string `json:"outputTransport"`
+	ProtocolVersion string `json:"protocolVersion,omitempty"`
+	Message         string `json:"message"`
+}

agent/app/dto/response/nginx.go

@@ -69,16 +69,25 @@ type NginxProxyCache struct {
 }
 
 type NginxModule struct {
-	Name     string `json:"name"`
-	Script   string `json:"script"`
-	Packages string `json:"packages"`
-	Params   string `json:"params"`
-	Enable   bool   `json:"enable"`
+	Name        string                    `json:"name"`
+	Custom      bool                      `json:"custom"`
+	Script      string                    `json:"script"`
+	Packages    string                    `json:"packages"`
+	Params      string                    `json:"params"`
+	Enable      bool                      `json:"enable"`
+	BuildMode   string                    `json:"buildMode"`
+	Provider    string                    `json:"provider"`
+	LoadOrder   int                       `json:"loadOrder"`
+	BuildStatus string                    `json:"buildStatus"`
+	LoadStatus  string                    `json:"loadStatus"`
+	Artifacts   []dto.NginxModuleArtifact `json:"artifacts"`
+	LastError   string                    `json:"lastError"`
 }
 
 type NginxBuildConfig struct {
-	Mirror  string        `json:"mirror"`
-	Modules []NginxModule `json:"modules"`
+	Mirror           string        `json:"mirror"`
+	DynamicSupported bool          `json:"dynamicSupported"`
+	Modules          []NginxModule `json:"modules"`
 }
 
 type NginxConfigRes struct {

agent/app/dto/response/website_template.go

@@ -0,0 +1,18 @@
+package response
+
+import (
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+)
+
+type WebsiteTemplateDTO struct {
+	model.WebsiteTemplate
+}
+
+type WebsiteTemplateOutputDTO struct {
+	model.WebsiteTemplateOutput
+	TemplateName string `json:"templateName"`
+}
+
+type WebsitePreviewDTO struct {
+	HTML string `json:"html"`
+}

agent/app/dto/runtime_diagnostics.go

@@ -0,0 +1,30 @@
+package dto
+
+import "time"
+
+type RuntimeDiagnosticsSummary struct {
+	RSS         uint64 `json:"rss"`
+	HeapAlloc   uint64 `json:"heapAlloc"`
+	HeapObjects uint64 `json:"heapObjects"`
+	Goroutines  int    `json:"goroutines"`
+}
+
+type RuntimeGoroutineGroup struct {
+	State string   `json:"state"`
+	Top   string   `json:"top"`
+	Count int      `json:"count"`
+	Stack []string `json:"stack"`
+}
+
+type RuntimeGoroutineSnapshot struct {
+	Total      int                     `json:"total"`
+	GroupCount int                     `json:"groupCount"`
+	Truncated  bool                    `json:"truncated"`
+	CapturedAt time.Time               `json:"capturedAt"`
+	Goroutines []RuntimeGoroutineGroup `json:"goroutines"`
+}
+
+type RuntimeProfileCreate struct {
+	Type     string `json:"type" validate:"required,oneof=cpu heap goroutine mutex block"`
+	Duration int    `json:"duration" validate:"omitempty,min=5,max=30"`
+}

agent/app/dto/setting.go

@@ -23,7 +23,10 @@ type SettingInfo struct {
 	AppStoreLastModified string `json:"appStoreLastModified"`
 	AppStoreSyncStatus   string `json:"appStoreSyncStatus"`
 
-	FileRecycleBin string `json:"fileRecycleBin"`
+	FileRecycleBin   string `json:"fileRecycleBin"`
+	LocalSSHConnShow string `json:"localSSHConnShow"`
+
+	FirewallPortWhiteList string `json:"firewallPortWhiteList"`
 }
 
 type SettingUpdate struct {
@@ -31,6 +34,11 @@ type SettingUpdate struct {
 	Value string `json:"value"`
 }
 
+type AgentSettingUpdate struct {
+	Key   string `json:"key" validate:"required,oneof=SystemIP DockerSockPath FileRecycleBin FirewallPortWhiteList"`
+	Value string `json:"value"`
+}
+
 type SyncTime struct {
 	NtpSite string `json:"ntpSite" validate:"required"`
 }

agent/app/dto/ssh.go

@@ -57,8 +57,10 @@ type SSHConfUpdate struct {
 }
 type SearchSSHLog struct {
 	PageInfo
-	Info   string `json:"info"`
-	Status string `json:"Status" validate:"required,oneof=Success Failed All"`
+	Info      string    `json:"info"`
+	Status    string    `json:"Status" validate:"required,oneof=Success Failed All"`
+	StartTime time.Time `json:"startTime"`
+	EndTime   time.Time `json:"endTime"`
 }
 
 type SSHHistory struct {

agent/app/model/agent_account.go

@@ -2,14 +2,17 @@ package model
 
 type AgentAccount struct {
 	BaseModel
-	Provider       string `json:"provider"`
-	Name           string `json:"name"`
-	APIKey         string `json:"apiKey"`
-	BaseURL        string `json:"baseUrl"`
-	APIType        string `json:"apiType"`
-	RememberAPIKey bool   `json:"rememberApiKey"`
-	Verified       bool   `json:"verified"`
-	Remark         string `json:"remark"`
+	Provider        string `json:"provider"`
+	Name            string `json:"name"`
+	APIKey          string `json:"apiKey"`
+	BaseURL         string `json:"baseUrl"`
+	APIType         string `json:"apiType"`
+	AuthMode        string `json:"authMode"`
+	VerifyModel     string `json:"verifyModel"`
+	RememberAPIKey  bool   `json:"rememberApiKey"`
+	Verified        bool   `json:"verified"`
+	Remark          string `json:"remark"`
+	MasterAccountID uint   `json:"masterAccountId" gorm:"index"`
 }
 
 func (AgentAccount) TableName() string {

agent/app/model/agent_account_model.go

@@ -2,14 +2,10 @@ package model
 
 type AgentAccountModel struct {
 	BaseModel
-	AccountID     uint   `json:"accountId" gorm:"index"`
-	Model         string `json:"model" gorm:"index"`
-	Name          string `json:"name"`
-	ContextWindow int    `json:"contextWindow"`
-	MaxTokens     int    `json:"maxTokens"`
-	Reasoning     bool   `json:"reasoning"`
-	Input         string `json:"input" gorm:"type:text"`
-	SortOrder     int    `json:"sortOrder" gorm:"index"`
+	AccountID uint   `json:"accountId" gorm:"index"`
+	Model     string `json:"model" gorm:"index"`
+	Name      string `json:"name"`
+	SortOrder int    `json:"sortOrder" gorm:"index"`
 }
 
 func (AgentAccountModel) TableName() string {

agent/app/model/alert.go

@@ -9,9 +9,11 @@ type Alert struct {
 	Count          uint   `gorm:"type:integer;not null" json:"count"`
 	Project        string `gorm:"type:varchar(64)" json:"project"`
 	Status         string `gorm:"type:varchar(64);not null" json:"status"`
-	Method         string `gorm:"type:varchar(64);not null" json:"method"`
+	Method         string `gorm:"type:text;not null" json:"method"`
 	SendCount      uint   `gorm:"type:integer" json:"sendCount"`
 	AdvancedParams string `gorm:"type:longText" json:"advancedParams"`
+	CreateUser     string `gorm:"type:varchar(256)" json:"createUser"`
+	UpdateUser     string `gorm:"type:varchar(256)" json:"updateUser"`
 }
 
 type AlertTask struct {
@@ -19,7 +21,7 @@ type AlertTask struct {
 	Type      string `gorm:"type:varchar(64);not null" json:"type"`
 	Quota     string `gorm:"type:varchar(64)" json:"quota"`
 	QuotaType string `gorm:"type:varchar(64)" json:"quotaType"`
-	Method    string `gorm:"type:varchar(64);not null;default:'sms'" json:"method"`
+	Method    string `gorm:"type:varchar(128);not null;default:'sms'" json:"method"`
 }
 
 type AlertLog struct {
@@ -34,15 +36,17 @@ type AlertLog struct {
 	Message     string `gorm:"type:varchar(256);" json:"message"`
 	RecordId    uint   `gorm:"type:integer;" json:"recordId"`
 	LicenseId   string `gorm:"type:varchar(256);not null;" json:"licenseId" `
-	Method      string `gorm:"type:varchar(64);not null;default:'sms'" json:"method"`
+	Method      string `gorm:"type:varchar(128);not null;default:'sms'" json:"method"`
 }
 
 type AlertConfig struct {
 	BaseModel
-	Type   string `gorm:"type:varchar(64);not null" json:"type"`
-	Title  string `gorm:"type:varchar(64);not null" json:"title"`
-	Status string `gorm:"type:varchar(64);not null" json:"status"`
-	Config string `gorm:"type:varchar(256);not null" json:"config"`
+	Type       string `gorm:"type:varchar(64);not null" json:"type"`
+	Title      string `gorm:"type:varchar(64);not null" json:"title"`
+	Status     string `gorm:"type:varchar(64);not null" json:"status"`
+	Config     string `gorm:"type:varchar(256);not null" json:"config"`
+	CreateUser string `gorm:"type:varchar(256)" json:"createUser"`
+	UpdateUser string `gorm:"type:varchar(256)" json:"updateUser"`
 }
 
 type LoginLog struct {

agent/app/model/backup.go

@@ -31,4 +31,5 @@ type BackupRecord struct {
 	Status      string `json:"status"`
 	Message     string `json:"message"`
 	Description string `json:"description"`
+	Args        string `gorm:"not null;default:''" json:"args"`
 }

agent/app/model/compose_template.go

@@ -11,6 +11,7 @@ type ComposeTemplate struct {
 type Compose struct {
 	BaseModel
 
-	Name string `json:"name"`
-	Path string `json:"path"`
+	Name     string `json:"name"`
+	Path     string `json:"path"`
+	IsPinned bool   `json:"isPinned"`
 }

agent/app/model/database_user.go

@@ -0,0 +1,21 @@
+package model
+
+type DatabaseUser struct {
+	BaseModel
+	Type        string `json:"type" gorm:"not null;uniqueIndex:idx_database_user"`
+	Database    string `json:"database" gorm:"not null;uniqueIndex:idx_database_user"`
+	Username    string `json:"username" gorm:"not null;uniqueIndex:idx_database_user"`
+	Host        string `json:"host" gorm:"uniqueIndex:idx_database_user"`
+	Password    string `json:"password"`
+	Description string `json:"description"`
+	IsDelete    bool   `json:"isDelete"`
+}
+
+type DatabaseUserGrant struct {
+	BaseModel
+	Type     string `json:"type" gorm:"not null;uniqueIndex:idx_database_user_grant"`
+	Database string `json:"database" gorm:"not null;uniqueIndex:idx_database_user_grant"`
+	DBName   string `json:"dbName" gorm:"not null;uniqueIndex:idx_database_user_grant"`
+	Username string `json:"username" gorm:"not null;uniqueIndex:idx_database_user_grant"`
+	Host     string `json:"host" gorm:"not null;uniqueIndex:idx_database_user_grant"`
+}

agent/app/model/ftp.go

@@ -8,4 +8,6 @@ type Ftp struct {
 	Status      string `gorm:"not null" json:"status"`
 	Path        string `gorm:"not null" json:"path"`
 	Description string `gorm:"not null" json:"description"`
+	UID         uint   `gorm:"column:uid;not null;default:1000" json:"-"`
+	GID         uint   `gorm:"column:gid;not null;default:1000" json:"-"`
 }

agent/app/model/mcp_server.go

@@ -18,4 +18,7 @@ type McpServer struct {
 	StreamableHttpPath string `json:"streamableHttpPath"`
 	OutputTransport    string `json:"outputTransport"`
 	Type               string `json:"type"`
+	GatewayImage       string `json:"gatewayImage"`
+	ProtocolVersion    string `json:"protocolVersion"`
+	GatewayArgs        string `json:"gatewayArgs"`
 }

agent/app/model/website_acme_account.go

@@ -8,7 +8,7 @@ type WebsiteAcmeAccount struct {
 	Type       string `gorm:"not null;default:letsencrypt" json:"type"`
 	EabKid     string `json:"eabKid"`
 	EabHmacKey string `json:"eabHmacKey"`
-	KeyType    string `gorm:"not null;default:2048" json:"keyType"`
+	KeyType    string `gorm:"not null;default:RSA2048" json:"keyType"`
 	UseProxy   bool   `gorm:"default:false" json:"useProxy"`
 	CaDirURL   string `json:"caDirURL"`
 	UseEAB     bool   `json:"useEAB"`

agent/app/model/website_ca.go

@@ -5,5 +5,5 @@ type WebsiteCA struct {
 	CSR        string `gorm:"not null;" json:"csr"`
 	Name       string `gorm:"not null;" json:"name"`
 	PrivateKey string `gorm:"not null" json:"privateKey"`
-	KeyType    string `gorm:"not null;default:2048" json:"keyType"`
+	KeyType    string `gorm:"not null;default:RSA2048" json:"keyType"`
 }

agent/app/model/website_template.go

@@ -0,0 +1,28 @@
+package model
+
+type WebsiteTemplate struct {
+	BaseModel
+	Name      string `gorm:"not null" json:"name"`
+	Type      string `gorm:"not null" json:"type"` // single | multi
+	Content   string `gorm:"type:longtext" json:"content"`
+	FilePath  string `json:"filePath"`
+	Variables string `gorm:"type:text" json:"variables"`
+	Remark    string `json:"remark"`
+}
+
+func (w WebsiteTemplate) TableName() string {
+	return "website_templates"
+}
+
+type WebsiteTemplateOutput struct {
+	BaseModel
+	Name           string `gorm:"not null" json:"name"`
+	TemplateID     uint   `gorm:"not null" json:"templateID"`
+	TemplateType   string `json:"templateType"`
+	VariableValues string `gorm:"type:text" json:"variableValues"`
+	OutputPath     string `json:"outputPath"`
+}
+
+func (w WebsiteTemplateOutput) TableName() string {
+	return "website_template_outputs"
+}

agent/app/provider/catalog.go

@@ -1,319 +1,248 @@
 package provider
 
 import (
+	"fmt"
+	"net/url"
 	"strings"
 )
 
-type Model struct {
-	ID            string
-	Name          string
-	ContextWindow int
-	MaxTokens     int
-	Reasoning     bool
-	Input         []string
+type APIConfig struct {
+	APIType         string
+	BaseURL         string
+	EditableBaseURL bool
+	DiscoverModels  bool
+	DefaultAuthMode string
+	AuthModes       []string
+	Models          []Model
 }
 
-type RuntimeDefault struct {
-	APIType       string
-	ContextWindow int
-	MaxTokens     int
-	Input         []string
+const (
+	AuthModeBearer  = "bearer"
+	AuthModeXAPIKey = "x-api-key"
+)
+
+type Model struct {
+	ID   string
+	Name string
 }
 
 type Meta struct {
 	Key            string
 	DisplayName    string
+	DisplayNameKey string
 	Sort           uint
-	DefaultBaseURL string
+	DefaultAPIType string
+	APIConfigs     []APIConfig
 	EnvKey         string
-	Default        RuntimeDefault
 	Models         []Model
 }
 
 var catalog = map[string]Meta{
 	"custom": {
-		Key:            "custom",
-		DisplayName:    "Custom",
-		Sort:           10,
-		DefaultBaseURL: "",
-		EnvKey:         "CUSTOM_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "openai-completions",
-			ContextWindow: 128000,
-			MaxTokens:     8192,
-			Input:         []string{"text"},
-		},
-		Models: []Model{},
+		Key: "custom", DisplayName: "Custom", Sort: 10, DefaultAPIType: "openai-completions", EnvKey: "CUSTOM_API_KEY",
+		APIConfigs: editableAPIConfigs(true, "openai-completions", "openai-responses", "anthropic-messages", "openai-images"),
 	},
 	"ollama": {
-		Key:         "ollama",
-		DisplayName: "Ollama",
-		Sort:        15,
-		Default: RuntimeDefault{
-			APIType:       "openai-responses",
-			ContextWindow: 160000,
-			MaxTokens:     8192,
-			Input:         []string{"text"},
-		},
+		Key: "ollama", DisplayName: "Ollama", Sort: 15, DefaultAPIType: "openai-responses",
+		APIConfigs: editableAPIConfigs(false, "openai-responses", "openai-completions"),
 	},
 	"vllm": {
-		Key:            "vllm",
-		DisplayName:    "vLLM",
-		Sort:           20,
-		DefaultBaseURL: "",
-		EnvKey:         "VLLM_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "openai-completions",
-			ContextWindow: 128000,
-			MaxTokens:     8192,
-			Input:         []string{"text"},
-		},
-		Models: []Model{},
+		Key: "vllm", DisplayName: "vLLM", Sort: 20, DefaultAPIType: "openai-completions", EnvKey: "VLLM_API_KEY",
+		APIConfigs: editableAPIConfigs(false, "openai-completions", "openai-responses", "anthropic-messages", "openai-images"),
 	},
 	"deepseek": {
-		Key:            "deepseek",
-		DisplayName:    "DeepSeek",
-		Sort:           25,
-		DefaultBaseURL: "https://api.deepseek.com/v1",
-		EnvKey:         "DEEPSEEK_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "openai-completions",
-			ContextWindow: 131072,
-			MaxTokens:     8192,
-			Input:         []string{"text"},
-		},
-		Models: []Model{
-			{ID: "deepseek/deepseek-v4-flash", Name: "deepseek-v4-flash"},
-			{ID: "deepseek/deepseek-v4-pro", Name: "deepseek-v4-pro"},
+		Key: "deepseek", DisplayName: "DeepSeek", Sort: 25, DefaultAPIType: "openai-completions", EnvKey: "DEEPSEEK_API_KEY",
+		APIConfigs: []APIConfig{
+			{APIType: "openai-completions", BaseURL: "https://api.deepseek.com"},
+			anthropicAPIConfig("https://api.deepseek.com/anthropic", AuthModeXAPIKey),
 		},
+		Models: []Model{{ID: "deepseek-v4-flash", Name: "deepseek-v4-flash"}, {ID: "deepseek-v4-pro", Name: "deepseek-v4-pro"}},
 	},
 	"bailian-coding-plan": {
-		Key:            "bailian-coding-plan",
-		DisplayName:    "阿里云百炼 Coding Plan",
-		Sort:           30,
-		DefaultBaseURL: "https://coding.dashscope.aliyuncs.com/v1",
-		EnvKey:         "QWEN_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "openai-completions",
-			ContextWindow: 256000,
-			MaxTokens:     8192,
-			Input:         []string{"text"},
+		Key: "bailian-coding-plan", DisplayNameKey: "AIProviderBailianCodingPlan", Sort: 30, DefaultAPIType: "openai-completions", EnvKey: "QWEN_API_KEY",
+		APIConfigs: []APIConfig{
+			{APIType: "openai-completions", BaseURL: "https://coding.dashscope.aliyuncs.com/v1"},
+			anthropicAPIConfig("https://coding.dashscope.aliyuncs.com/apps/anthropic", AuthModeBearer),
 		},
 		Models: []Model{
-			{ID: "bailian-coding-plan/qwen3.5-plus", Name: "Qwen3.5-Plus", Reasoning: true},
-			{ID: "bailian-coding-plan/qwen3-max", Name: "Qwen3-Max", Reasoning: true},
-			{ID: "bailian-coding-plan/qwen3-coder-next", Name: "Qwen3-Coder-Next", Reasoning: true},
-			{ID: "bailian-coding-plan/qwen3-coder-plus", Name: "Qwen3-Coder-Plus", Reasoning: true},
-			{ID: "bailian-coding-plan/minimax-m2.5", Name: "MiniMax M2.5", Reasoning: true},
-			{ID: "bailian-coding-plan/glm-5", Name: "GLM-5", Reasoning: true},
-			{ID: "bailian-coding-plan/kimi-k2.5", Name: "Kimi-k2.5", Reasoning: true},
-			{ID: "bailian-coding-plan/glm-4.7", Name: "GLM-4.7", Reasoning: true},
+			{ID: "qwen3-coder-plus", Name: "Qwen3-Coder-Plus"},
+			{ID: "qwen3-max-2026-01-23", Name: "Qwen3-Max-2026-01-23"},
+			{ID: "qwen3-coder-next", Name: "Qwen3-Coder-Next"},
+			{ID: "glm-4.7", Name: "GLM-4.7"},
+			{ID: "kimi-k2.5", Name: "Kimi K2.5"},
+			{ID: "qwen3.5-plus", Name: "Qwen3.5-Plus"},
+			{ID: "glm-5", Name: "GLM-5"},
+			{ID: "MiniMax-M2.5", Name: "MiniMax M2.5"},
+			{ID: "qwen3.6-plus", Name: "Qwen3.6-Plus"},
+			{ID: "qwen3.7-plus", Name: "Qwen3.7-Plus"},
 		},
 	},
 	"ark-coding-plan": {
-		Key:            "ark-coding-plan",
-		DisplayName:    "方舟 Coding Plan",
-		Sort:           35,
-		DefaultBaseURL: "https://ark.cn-beijing.volces.com/api/coding/v3",
-		EnvKey:         "ARK_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "openai-completions",
-			ContextWindow: 256000,
-			MaxTokens:     4096,
-			Input:         []string{"text"},
+		Key: "ark-coding-plan", DisplayNameKey: "AIProviderArkCodingPlan", Sort: 35, DefaultAPIType: "openai-completions", EnvKey: "ARK_API_KEY",
+		APIConfigs: []APIConfig{
+			{APIType: "openai-completions", BaseURL: "https://ark.cn-beijing.volces.com/api/coding/v3"},
+			anthropicAPIConfig("https://ark.cn-beijing.volces.com/api/coding", AuthModeBearer),
 		},
 		Models: []Model{
-			{ID: "ark-coding-plan/ark-code-latest", Name: "Ark Coding Plan", ContextWindow: 256000, MaxTokens: 4096},
-			{ID: "ark-coding-plan/doubao-seed-code", Name: "Doubao Seed Code", ContextWindow: 256000, MaxTokens: 4096},
-			{ID: "ark-coding-plan/glm-4.7", Name: "GLM 4.7 Coding", ContextWindow: 200000, MaxTokens: 4096},
-			{ID: "ark-coding-plan/kimi-k2-thinking", Name: "Kimi K2 Thinking", ContextWindow: 256000, MaxTokens: 4096},
-			{ID: "ark-coding-plan/kimi-k2.5", Name: "Kimi K2.5 Coding", ContextWindow: 256000, MaxTokens: 4096},
-			{ID: "ark-coding-plan/doubao-seed-code-preview-251028", Name: "Doubao Seed Code Preview", ContextWindow: 256000, MaxTokens: 4096},
+			{ID: "ark-code-latest", Name: "Ark Coding Plan"}, {ID: "doubao-seed-code", Name: "Doubao Seed Code"},
+			{ID: "glm-4.7", Name: "GLM 4.7 Coding"}, {ID: "kimi-k2-thinking", Name: "Kimi K2 Thinking"},
+			{ID: "kimi-k2.5", Name: "Kimi K2.5 Coding"}, {ID: "doubao-seed-code-preview-251028", Name: "Doubao Seed Code Preview"},
 		},
 	},
 	"zai": {
-		Key:            "zai",
-		DisplayName:    "Z.ai",
-		Sort:           40,
-		DefaultBaseURL: "https://open.bigmodel.cn/api/paas/v4",
-		EnvKey:         "ZAI_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "openai-completions",
-			ContextWindow: 204800,
-			MaxTokens:     131072,
-			Input:         []string{"text"},
-		},
-		Models: []Model{
-			{ID: "zai/glm-5", Name: "GLM-5", Reasoning: true},
-			{ID: "zai/glm-4.7", Name: "GLM-4.7", Reasoning: true},
-			{ID: "zai/glm-4.7-flash", Name: "GLM-4.7-Flash", Reasoning: true},
-			{ID: "zai/glm-4.7-flashx", Name: "GLM-4.7-FlashX", Reasoning: true},
+		Key: "zai", DisplayName: "Z.ai", Sort: 40, DefaultAPIType: "openai-completions", EnvKey: "ZAI_API_KEY",
+		APIConfigs: []APIConfig{
+			{APIType: "openai-completions", BaseURL: "https://open.bigmodel.cn/api/paas/v4", EditableBaseURL: true},
+			{APIType: "openai-images", BaseURL: "https://open.bigmodel.cn/api/paas/v4", EditableBaseURL: true},
 		},
+		Models: []Model{{ID: "glm-5", Name: "GLM-5"}, {ID: "glm-4.7", Name: "GLM-4.7"}, {ID: "glm-4.7-flash", Name: "GLM-4.7-Flash"}, {ID: "glm-4.7-flashx", Name: "GLM-4.7-FlashX"}},
 	},
 	"minimax": {
-		Key:            "minimax",
-		DisplayName:    "MiniMax (CN)",
-		Sort:           45,
-		DefaultBaseURL: "https://api.minimaxi.com/anthropic",
-		EnvKey:         "MINIMAX_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "anthropic-messages",
-			ContextWindow: 200000,
-			MaxTokens:     8192,
-			Input:         []string{"text"},
-		},
-		Models: []Model{
-			{ID: "minimax/MiniMax-M2.7", Name: "MiniMax M2.7"},
-			{ID: "minimax/MiniMax-M2.7-highspeed", Name: "MiniMax M2.7 highspeed"},
-			{ID: "minimax/MiniMax-M2.5", Name: "MiniMax M2.5", Reasoning: true},
-			{ID: "minimax/MiniMax-M2.5-highspeed", Name: "MiniMax M2.5 highspeed"},
+		Key: "minimax", DisplayName: "MiniMax (CN)", Sort: 45, DefaultAPIType: "anthropic-messages", EnvKey: "MINIMAX_API_KEY",
+		APIConfigs: []APIConfig{
+			anthropicAPIConfig("https://api.minimaxi.com/anthropic", AuthModeXAPIKey, AuthModeBearer),
+			{APIType: "openai-completions", BaseURL: "https://api.minimaxi.com/v1"},
+			{APIType: "minimax-images", BaseURL: "https://api.minimaxi.com"},
 		},
+		Models: []Model{{ID: "MiniMax-M3", Name: "MiniMax M3"}, {ID: "MiniMax-M2.7", Name: "MiniMax M2.7"}, {ID: "MiniMax-M2.7-highspeed", Name: "MiniMax M2.7 highspeed"}},
 	},
 	"xiaomi": {
-		Key:            "xiaomi",
-		DisplayName:    "Xiaomi",
-		Sort:           46,
-		DefaultBaseURL: "https://api.xiaomimimo.com/v1",
-		EnvKey:         "XIAOMI_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "openai-completions",
-			ContextWindow: 262144,
-			MaxTokens:     8192,
-			Input:         []string{"text"},
-		},
-		Models: []Model{
-			{ID: "xiaomi/mimo-v2-flash", Name: "Xiaomi MiMo V2 Flash", ContextWindow: 262144, MaxTokens: 8192, Input: []string{"text"}},
-			{ID: "xiaomi/mimo-v2-pro", Name: "Xiaomi MiMo V2 Pro", ContextWindow: 1048576, MaxTokens: 32000, Reasoning: true, Input: []string{"text"}},
-			{ID: "xiaomi/mimo-v2-omni", Name: "Xiaomi MiMo V2 Omni", ContextWindow: 262144, MaxTokens: 32000, Reasoning: true, Input: []string{"text", "image"}},
+		Key: "xiaomi", DisplayName: "Xiaomi", Sort: 46, DefaultAPIType: "openai-completions", EnvKey: "XIAOMI_API_KEY",
+		APIConfigs: []APIConfig{
+			{APIType: "openai-completions", BaseURL: "https://api.xiaomimimo.com/v1"},
+			{APIType: "openai-responses", BaseURL: "https://api.xiaomimimo.com/v1"},
+			anthropicAPIConfig("https://api.xiaomimimo.com/anthropic", AuthModeBearer),
 		},
+		Models: []Model{{ID: "mimo-v2.5", Name: "Xiaomi MiMo V2.5"}, {ID: "mimo-v2.5-pro", Name: "Xiaomi MiMo V2.5 Pro"}},
 	},
 	"kimi": {
-		Key:            "kimi",
-		DisplayName:    "Kimi (CN)",
-		Sort:           50,
-		DefaultBaseURL: "https://api.moonshot.cn/v1",
-		EnvKey:         "KIMI_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "openai-completions",
-			ContextWindow: 256000,
-			MaxTokens:     8192,
-			Input:         []string{"text", "image"},
-		},
-		Models: []Model{
-			{ID: "kimi/kimi-k2.5", Name: "Kimi K2.5", Reasoning: true},
-			{ID: "kimi/kimi-k2-0905-preview", Name: "Kimi K2 0905 Preview"},
-			{ID: "kimi/kimi-k2-thinking", Name: "Kimi K2 Thinking", Reasoning: true},
-		},
+		Key: "kimi", DisplayName: "Kimi (CN)", Sort: 50, DefaultAPIType: "openai-completions", EnvKey: "KIMI_API_KEY",
+		APIConfigs: []APIConfig{{APIType: "openai-completions", BaseURL: "https://api.moonshot.cn/v1"}},
+		Models:     []Model{{ID: "kimi-k2.5", Name: "Kimi K2.5"}, {ID: "kimi-k2-0905-preview", Name: "Kimi K2 0905 Preview"}, {ID: "kimi-k2-thinking", Name: "Kimi K2 Thinking"}},
 	},
 	"kimi-coding": {
-		Key:            "kimi-coding",
-		DisplayName:    "Kimi Coding",
-		Sort:           51,
-		DefaultBaseURL: "https://api.kimi.com/coding/",
-		EnvKey:         "KIMI_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "anthropic-messages",
-			ContextWindow: 262144,
-			MaxTokens:     32768,
-			Input:         []string{"text", "image"},
-		},
-		Models: []Model{
-			{ID: "kimi-coding/kimi-code", Name: "Kimi Code", ContextWindow: 262144, MaxTokens: 32768, Reasoning: true, Input: []string{"text", "image"}},
-			{ID: "kimi-coding/k2p5", Name: "Kimi K2.5", ContextWindow: 262144, MaxTokens: 32768, Reasoning: true, Input: []string{"text", "image"}},
-		},
+		Key: "kimi-coding", DisplayName: "Kimi Coding", Sort: 51, DefaultAPIType: "anthropic-messages", EnvKey: "KIMI_API_KEY",
+		APIConfigs: []APIConfig{anthropicAPIConfig("https://api.kimi.com/coding/", AuthModeXAPIKey)},
+		Models:     []Model{{ID: "kimi-code", Name: "Kimi Code"}, {ID: "k2p5", Name: "Kimi K2.5"}},
 	},
 	"openai": {
-		Key:            "openai",
-		DisplayName:    "OpenAI",
-		Sort:           55,
-		DefaultBaseURL: "https://api.openai.com/v1",
-		EnvKey:         "OPENAI_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "openai-responses",
-			ContextWindow: 272000,
-			MaxTokens:     128000,
-			Input:         []string{"text", "image"},
-		},
-		Models: []Model{
-			{ID: "openai/gpt-5.4", Name: "gpt-5.4", ContextWindow: 272000, MaxTokens: 128000, Reasoning: true, Input: []string{"text", "image"}},
-			{ID: "openai/gpt-5.4-pro", Name: "gpt-5.4-pro", ContextWindow: 1050000, MaxTokens: 128000, Reasoning: true, Input: []string{"text", "image"}},
-			{ID: "openai/gpt-5.4-mini", Name: "gpt-5.4-mini", ContextWindow: 400000, MaxTokens: 128000, Reasoning: true, Input: []string{"text", "image"}},
-			{ID: "openai/gpt-5.4-nano", Name: "gpt-5.4-nano", ContextWindow: 400000, MaxTokens: 128000, Reasoning: true, Input: []string{"text", "image"}},
+		Key: "openai", DisplayName: "OpenAI", Sort: 55, DefaultAPIType: "openai-responses", EnvKey: "OPENAI_API_KEY",
+		APIConfigs: []APIConfig{
+			{APIType: "openai-responses", BaseURL: "https://api.openai.com/v1"},
+			{APIType: "openai-completions", BaseURL: "https://api.openai.com/v1"},
+			{APIType: "openai-images", BaseURL: "https://api.openai.com/v1"},
 		},
+		Models: []Model{{ID: "gpt-5.4", Name: "gpt-5.4"}, {ID: "gpt-5.4-pro", Name: "gpt-5.4-pro"}, {ID: "gpt-5.4-mini", Name: "gpt-5.4-mini"}, {ID: "gpt-5.4-nano", Name: "gpt-5.4-nano"}},
 	},
 	"openrouter": {
-		Key:            "openrouter",
-		DisplayName:    "OpenRouter",
-		Sort:           56,
-		DefaultBaseURL: "https://openrouter.ai/api/v1",
-		EnvKey:         "OPENROUTER_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "openai-completions",
-			ContextWindow: 128000,
-			MaxTokens:     8192,
-			Input:         []string{"text"},
-		},
-		Models: []Model{
-			{ID: "openrouter/free", Name: "openrouter/free"},
-			{ID: "openrouter/auto", Name: "openrouter/auto"},
+		Key: "openrouter", DisplayName: "OpenRouter", Sort: 56, DefaultAPIType: "openai-completions", EnvKey: "OPENROUTER_API_KEY",
+		APIConfigs: []APIConfig{
+			{APIType: "openai-completions", BaseURL: "https://openrouter.ai/api/v1"},
+			{APIType: "openrouter-images", BaseURL: "https://openrouter.ai"},
 		},
+		Models: []Model{{ID: "openrouter/free", Name: "openrouter/free"}, {ID: "openrouter/auto", Name: "openrouter/auto"}},
 	},
 	"anthropic": {
-		Key:            "anthropic",
-		DisplayName:    "Anthropic",
-		Sort:           60,
-		DefaultBaseURL: "https://api.anthropic.com",
-		EnvKey:         "ANTHROPIC_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "anthropic-messages",
-			ContextWindow: 256000,
-			MaxTokens:     8192,
-			Input:         []string{"text", "image"},
-		},
-		Models: []Model{
-			{ID: "anthropic/claude-sonnet-4-6", Name: "Claude Sonnet 4.6", Reasoning: true},
-			{ID: "anthropic/claude-opus-4-6", Name: "Claude Opus 4.6", Reasoning: true},
-			{ID: "anthropic/claude-opus-4-5", Name: "Claude Opus 4.5"},
-			{ID: "anthropic/claude-sonnet-4-5", Name: "Claude Sonnet 4.5"},
-			{ID: "anthropic/claude-haiku-4-5", Name: "Claude Haiku 4.5"},
-		},
+		Key: "anthropic", DisplayName: "Anthropic", Sort: 60, DefaultAPIType: "anthropic-messages", EnvKey: "ANTHROPIC_API_KEY",
+		APIConfigs: []APIConfig{anthropicAPIConfig("https://api.anthropic.com", AuthModeXAPIKey)},
+		Models:     []Model{{ID: "claude-sonnet-4-6", Name: "Claude Sonnet 4.6"}, {ID: "claude-opus-4-6", Name: "Claude Opus 4.6"}, {ID: "claude-opus-4-5", Name: "Claude Opus 4.5"}, {ID: "claude-sonnet-4-5", Name: "Claude Sonnet 4.5"}, {ID: "claude-haiku-4-5", Name: "Claude Haiku 4.5"}},
 	},
 	"gemini": {
-		Key:            "gemini",
-		DisplayName:    "Gemini",
-		Sort:           65,
-		DefaultBaseURL: "https://generativelanguage.googleapis.com",
-		EnvKey:         "GEMINI_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "openai-completions",
-			ContextWindow: 256000,
-			MaxTokens:     8192,
-			Input:         []string{"text", "image"},
-		},
-		Models: []Model{
-			{ID: "google/gemini-3-flash-preview", Name: "Gemini 3 Flash Preview", Reasoning: true},
-			{ID: "google/gemini-flash-latest", Name: "Gemini Flash Latest"},
-			{ID: "google/gemini-3-pro-preview", Name: "Gemini 3 Pro Preview", Reasoning: true},
-		},
+		Key: "gemini", DisplayName: "Gemini", Sort: 65, DefaultAPIType: "gemini-generate-content", EnvKey: "GEMINI_API_KEY",
+		APIConfigs: []APIConfig{{APIType: "gemini-generate-content", BaseURL: "https://generativelanguage.googleapis.com"}},
+		Models:     []Model{{ID: "gemini-3-flash-preview", Name: "Gemini 3 Flash Preview"}, {ID: "gemini-flash-latest", Name: "Gemini Flash Latest"}, {ID: "gemini-3-pro-preview", Name: "Gemini 3 Pro Preview"}},
 	},
 	"moonshot": {
-		Key:            "moonshot",
-		DisplayName:    "Moonshot (Global)",
-		Sort:           70,
-		DefaultBaseURL: "https://api.moonshot.ai/v1",
-		EnvKey:         "MOONSHOT_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "openai-completions",
-			ContextWindow: 256000,
-			MaxTokens:     8192,
-			Input:         []string{"text"},
-		},
-		Models: []Model{
-			{ID: "moonshot/kimi-k2.5", Name: "Kimi K2.5", Reasoning: true},
-			{ID: "moonshot/kimi-k2-0905-preview", Name: "Kimi K2 0905 Preview"},
-			{ID: "moonshot/kimi-k2-thinking", Name: "Kimi K2 Thinking", Reasoning: true},
+		Key: "moonshot", DisplayName: "Moonshot (Global)", Sort: 70, DefaultAPIType: "openai-completions", EnvKey: "MOONSHOT_API_KEY",
+		APIConfigs: []APIConfig{{APIType: "openai-completions", BaseURL: "https://api.moonshot.ai/v1"}},
+		Models:     []Model{{ID: "kimi-k2.5", Name: "Kimi K2.5"}, {ID: "kimi-k2-0905-preview", Name: "Kimi K2 0905 Preview"}, {ID: "kimi-k2-thinking", Name: "Kimi K2 Thinking"}},
+	},
+	"bailian": {
+		Key: "bailian", DisplayNameKey: "AIProviderBailian", Sort: 31, DefaultAPIType: "openai-completions", EnvKey: "DASHSCOPE_API_KEY",
+		APIConfigs: []APIConfig{
+			{
+				APIType: "openai-completions", BaseURL: "https://dashscope.aliyuncs.com/compatible-mode/v1",
+				DiscoverModels: true,
+				Models:         []Model{{ID: "qwen3.7-plus", Name: "qwen3.7-plus"}, {ID: "qwen3.6-plus", Name: "qwen3.6-plus"}, {ID: "qwen3.6-flash", Name: "qwen3.6-flash"}},
+			},
+			{
+				APIType: "openai-responses", BaseURL: "https://dashscope.aliyuncs.com/compatible-mode/v1",
+				DiscoverModels: true,
+				Models:         []Model{{ID: "qwen3.7-plus", Name: "qwen3.7-plus"}, {ID: "qwen3.6-plus", Name: "qwen3.6-plus"}, {ID: "qwen3.6-flash", Name: "qwen3.6-flash"}},
+			},
+			{
+				APIType: "anthropic-messages", BaseURL: "https://dashscope.aliyuncs.com/apps/anthropic",
+				DefaultAuthMode: AuthModeBearer,
+				AuthModes:       []string{AuthModeBearer},
+				Models:          []Model{{ID: "qwen3.7-plus", Name: "qwen3.7-plus"}, {ID: "qwen3.6-plus", Name: "qwen3.6-plus"}, {ID: "qwen3.6-flash", Name: "qwen3.6-flash"}},
+			},
+			{
+				APIType: "dashscope-images", BaseURL: "https://dashscope.aliyuncs.com",
+				Models: []Model{
+					{ID: "qwen-image-2.0-pro", Name: "qwen-image-2.0-pro"},
+					{ID: "qwen-image-2.0", Name: "qwen-image-2.0"},
+					{ID: "wan2.7-image-pro", Name: "wan2.7-image-pro"},
+					{ID: "wan2.7-image", Name: "wan2.7-image"},
+				},
+			},
 		},
 	},
+	"ark": {
+		Key: "ark", DisplayNameKey: "AIProviderArk", Sort: 36, DefaultAPIType: "openai-completions", EnvKey: "ARK_API_KEY",
+		APIConfigs: []APIConfig{
+			{
+				APIType: "openai-completions", BaseURL: "https://ark.cn-beijing.volces.com/api/v3",
+				DiscoverModels: true,
+				Models:         []Model{{ID: "doubao-seed-2-0-pro-260215", Name: "doubao-seed-2-0-pro-260215"}, {ID: "doubao-seed-2-0-lite-260215", Name: "doubao-seed-2-0-lite-260215"}},
+			},
+			{
+				APIType: "openai-responses", BaseURL: "https://ark.cn-beijing.volces.com/api/v3",
+				DiscoverModels: true,
+				Models:         []Model{{ID: "doubao-seed-2-0-pro-260215", Name: "doubao-seed-2-0-pro-260215"}, {ID: "doubao-seed-2-0-lite-260215", Name: "doubao-seed-2-0-lite-260215"}},
+			},
+			{
+				APIType: "openai-images", BaseURL: "https://ark.cn-beijing.volces.com/api/v3",
+				Models: []Model{
+					{ID: "doubao-seedream-5-0-260128", Name: "doubao-seedream-5-0-260128"},
+					{ID: "doubao-seedream-5-0-lite-260128", Name: "doubao-seedream-5-0-lite-260128"},
+					{ID: "doubao-seedream-4-5-251128", Name: "doubao-seedream-4-5-251128"},
+				},
+			},
+		},
+	},
+}
+
+func editableAPIConfigs(discoverModels bool, apiTypes ...string) []APIConfig {
+	configs := make([]APIConfig, 0, len(apiTypes))
+	for _, apiType := range apiTypes {
+		if apiType == "anthropic-messages" {
+			config := anthropicAPIConfig("", AuthModeXAPIKey, AuthModeBearer)
+			config.EditableBaseURL = true
+			configs = append(configs, config)
+			continue
+		}
+		configs = append(configs, APIConfig{
+			APIType:         apiType,
+			EditableBaseURL: true,
+			DiscoverModels:  discoverModels && (apiType == "openai-completions" || apiType == "openai-responses"),
+		})
+	}
+	return configs
+}
+
+func anthropicAPIConfig(baseURL, defaultAuthMode string, additionalAuthModes ...string) APIConfig {
+	authModes := []string{defaultAuthMode}
+	for _, authMode := range additionalAuthModes {
+		if authMode != defaultAuthMode {
+			authModes = append(authModes, authMode)
+		}
+	}
+	return APIConfig{
+		APIType:         "anthropic-messages",
+		BaseURL:         baseURL,
+		DefaultAuthMode: defaultAuthMode,
+		AuthModes:       authModes,
+	}
 }
 
 func Get(key string) (Meta, bool) {
@@ -332,12 +261,142 @@ func All() map[string]Meta {
 	return result
 }
 
-func DefaultBaseURL(key string) (string, bool) {
+func FindAPIConfig(key, apiType string) (APIConfig, bool) {
 	meta, ok := catalog[key]
-	if !ok || strings.TrimSpace(meta.DefaultBaseURL) == "" {
+	if !ok {
+		return APIConfig{}, false
+	}
+	target := strings.TrimSpace(apiType)
+	if target == "" {
+		target = meta.DefaultAPIType
+	}
+	for _, config := range meta.APIConfigs {
+		if config.APIType == target {
+			config.AuthModes = append([]string(nil), config.AuthModes...)
+			config.Models = append([]Model(nil), config.Models...)
+			return config, true
+		}
+	}
+	return APIConfig{}, false
+}
+
+func DefaultModels(key, apiType string) []Model {
+	meta, ok := catalog[key]
+	if !ok {
+		return nil
+	}
+	target := strings.TrimSpace(apiType)
+	if target == "" {
+		target = meta.DefaultAPIType
+	}
+	for _, config := range meta.APIConfigs {
+		if config.APIType != target {
+			continue
+		}
+		if len(config.Models) > 0 {
+			return append([]Model(nil), config.Models...)
+		}
+		if IsImageAPIType(config.APIType) {
+			return nil
+		}
+		break
+	}
+	return append([]Model(nil), meta.Models...)
+}
+
+func ResolveAuthMode(provider, apiType, requested string) (string, error) {
+	config, ok := FindAPIConfig(provider, apiType)
+	if !ok {
+		return "", fmt.Errorf("provider %s does not support api type %s", provider, apiType)
+	}
+	if config.APIType != "anthropic-messages" {
+		return "", nil
+	}
+	authMode := strings.TrimSpace(requested)
+	if authMode == "" {
+		authMode = config.DefaultAuthMode
+	}
+	for _, allowed := range config.AuthModes {
+		if authMode == allowed {
+			return authMode, nil
+		}
+	}
+	return "", fmt.Errorf("provider %s does not support auth mode %s", provider, authMode)
+}
+
+func DefaultBaseURL(key string) (string, bool) {
+	config, ok := FindAPIConfig(key, "")
+	if !ok || strings.TrimSpace(config.BaseURL) == "" {
 		return "", false
 	}
-	return meta.DefaultBaseURL, true
+	return config.BaseURL, true
+}
+
+func DefaultAPIType(key string) string {
+	meta, ok := catalog[key]
+	if !ok || strings.TrimSpace(meta.DefaultAPIType) == "" {
+		return "openai-completions"
+	}
+	return meta.DefaultAPIType
+}
+
+func ResolveBaseURL(key, apiType, requested string) (string, error) {
+	config, ok := FindAPIConfig(key, apiType)
+	if !ok {
+		return "", fmt.Errorf("provider %s does not support api type %s", key, apiType)
+	}
+	if !config.EditableBaseURL {
+		return strings.TrimRight(config.BaseURL, "/"), nil
+	}
+	baseURL := strings.TrimSpace(requested)
+	if baseURL == "" {
+		baseURL = config.BaseURL
+	}
+	if baseURL == "" {
+		return "", fmt.Errorf("base url is required")
+	}
+	parsed, err := url.Parse(baseURL)
+	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
+		return "", fmt.Errorf("invalid base url")
+	}
+	if key == "custom" && IsImageAPIType(config.APIType) {
+		return baseURL, nil
+	}
+	parsed.Path = normalizeEndpointPath(config.APIType, parsed.Path)
+	parsed.RawQuery = ""
+	parsed.Fragment = ""
+	return strings.TrimRight(parsed.String(), "/"), nil
+}
+
+func normalizeEndpointPath(apiType, value string) string {
+	if IsImageAPIType(apiType) {
+		return strings.TrimRight(value, "/")
+	}
+	path := strings.TrimRight(value, "/")
+	suffixes := []string{}
+	switch apiType {
+	case "openai-completions":
+		suffixes = []string{"/chat/completions"}
+	case "openai-responses":
+		suffixes = []string{"/responses"}
+	case "anthropic-messages":
+		suffixes = []string{"/v1/messages", "/messages"}
+	}
+	for _, suffix := range suffixes {
+		if strings.HasSuffix(strings.ToLower(path), suffix) {
+			return path[:len(path)-len(suffix)]
+		}
+	}
+	return path
+}
+
+func IsImageAPIType(apiType string) bool {
+	switch apiType {
+	case "openai-images", "dashscope-images", "minimax-images", "openrouter-images":
+		return true
+	default:
+		return false
+	}
 }
 
 func EnvKey(key string) string {
@@ -350,89 +409,61 @@ func EnvKey(key string) string {
 
 func DisplayName(key string) string {
 	meta, ok := catalog[key]
-	if !ok {
-		return key
-	}
-	if strings.TrimSpace(meta.DisplayName) == "" {
+	if !ok || strings.TrimSpace(meta.DisplayName) == "" {
 		return key
 	}
 	return meta.DisplayName
 }
 
-func FindModel(key, modelID string) (Model, bool) {
-	meta, ok := Get(key)
+func DisplayNameKey(key string) string {
+	meta, ok := catalog[key]
 	if !ok {
-		return Model{}, false
+		return ""
 	}
-	for _, item := range meta.Models {
-		if item.ID == modelID {
-			return item, true
+	return meta.DisplayNameKey
+}
+
+func NormalizeModelID(provider, modelID string) string {
+	target := strings.TrimLeft(strings.TrimSpace(modelID), "/")
+	for _, prefix := range legacyModelPrefixes[provider] {
+		legacyPrefix := prefix + "/"
+		if !strings.HasPrefix(target, legacyPrefix) {
+			continue
+		}
+		candidate := strings.TrimSpace(strings.TrimPrefix(target, legacyPrefix))
+		if candidate != "" {
+			return candidate
 		}
 	}
-	return Model{}, false
+	return target
+}
+
+var legacyModelPrefixes = map[string][]string{
+	"custom":              {"custom"},
+	"vllm":                {"custom"},
+	"ollama":              {"ollama"},
+	"deepseek":            {"deepseek"},
+	"bailian-coding-plan": {"bailian-coding-plan"},
+	"ark-coding-plan":     {"ark-coding-plan"},
+	"zai":                 {"zai"},
+	"minimax":             {"minimax"},
+	"xiaomi":              {"xiaomi"},
+	"kimi":                {"kimi", "moonshot"},
+	"kimi-coding":         {"kimi-coding"},
+	"openai":              {"openai"},
+	"anthropic":           {"anthropic"},
+	"gemini":              {"google", "gemini"},
+	"moonshot":            {"moonshot"},
 }
 
 func cloneMeta(meta Meta) Meta {
 	clone := meta
-	if len(meta.Default.Input) > 0 {
-		clone.Default.Input = make([]string, len(meta.Default.Input))
-		copy(clone.Default.Input, meta.Default.Input)
-	}
-	if len(meta.Models) > 0 {
-		clone.Models = make([]Model, len(meta.Models))
-		for i, item := range meta.Models {
-			clone.Models[i] = normalizeModel(meta, item)
-		}
+	clone.APIConfigs = make([]APIConfig, len(meta.APIConfigs))
+	for index, config := range meta.APIConfigs {
+		clone.APIConfigs[index] = config
+		clone.APIConfigs[index].AuthModes = append([]string(nil), config.AuthModes...)
+		clone.APIConfigs[index].Models = append([]Model(nil), config.Models...)
 	}
+	clone.Models = append([]Model(nil), meta.Models...)
 	return clone
 }
-
-func normalizeModel(meta Meta, model Model) Model {
-	clone := model
-	clone.ID = strings.TrimSpace(clone.ID)
-	clone.Name = strings.TrimSpace(clone.Name)
-	if clone.Name == "" {
-		clone.Name = clone.ID
-	}
-	if clone.MaxTokens <= 0 {
-		clone.MaxTokens = meta.Default.MaxTokens
-	}
-	if clone.ContextWindow <= 0 {
-		clone.ContextWindow = meta.Default.ContextWindow
-	}
-	if len(clone.Input) == 0 && len(meta.Default.Input) > 0 {
-		clone.Input = make([]string, len(meta.Default.Input))
-		copy(clone.Input, meta.Default.Input)
-	}
-	return clone
-}
-
-func ResolveRuntimeParams(provider, apiType string, maxTokens, contextWindow int) (string, int, int) {
-	defaultAPIType := "openai-completions"
-	defaultMaxTokens := 8192
-	defaultContextWindow := 256000
-	if meta, ok := Get(provider); ok {
-		if meta.Default.APIType != "" {
-			defaultAPIType = meta.Default.APIType
-		}
-		if meta.Default.MaxTokens > 0 {
-			defaultMaxTokens = meta.Default.MaxTokens
-		}
-		if meta.Default.ContextWindow > 0 {
-			defaultContextWindow = meta.Default.ContextWindow
-		}
-	}
-	resolvedAPI := apiType
-	if strings.TrimSpace(apiType) == "" {
-		resolvedAPI = defaultAPIType
-	}
-	resolvedMaxTokens := defaultMaxTokens
-	resolvedContextWindow := defaultContextWindow
-	if maxTokens > 0 {
-		resolvedMaxTokens = maxTokens
-	}
-	if contextWindow > 0 {
-		resolvedContextWindow = contextWindow
-	}
-	return resolvedAPI, resolvedMaxTokens, resolvedContextWindow
-}

agent/app/provider/discover.go

@@ -0,0 +1,74 @@
+package provider
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+)
+
+func DiscoverModels(baseURL, apiKey string) ([]string, error) {
+	req, err := http.NewRequest(http.MethodGet, buildModelDiscoveryURL(baseURL), nil)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Authorization", "Bearer "+apiKey)
+	resp, err := (&http.Client{Timeout: defaultVerifyTimeout}).Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= http.StatusBadRequest {
+		return nil, fmt.Errorf("request failed: %s", resp.Status)
+	}
+	var payload struct {
+		Data []struct {
+			ID string `json:"id"`
+		} `json:"data"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&payload); err != nil {
+		return nil, err
+	}
+	models := make([]string, 0, len(payload.Data))
+	seen := make(map[string]struct{}, len(payload.Data))
+	for _, item := range payload.Data {
+		id := strings.TrimSpace(item.ID)
+		if id == "" {
+			continue
+		}
+		if _, ok := seen[id]; ok {
+			continue
+		}
+		seen[id] = struct{}{}
+		models = append(models, id)
+	}
+	if len(models) == 0 {
+		return nil, fmt.Errorf("no models found")
+	}
+	return models, nil
+}
+
+func buildModelDiscoveryURL(baseURL string) string {
+	base := strings.TrimRight(strings.TrimSpace(baseURL), "/")
+	for _, apiType := range []string{"openai-completions", "openai-responses", "anthropic-messages"} {
+		base = normalizeEndpointPath(apiType, base)
+	}
+	switch {
+	case strings.HasSuffix(base, "/models"):
+		return base
+	case hasAPIVersionSuffix(base):
+		return base + "/models"
+	default:
+		return base + "/v1/models"
+	}
+}
+
+func hasAPIVersionSuffix(value string) bool {
+	segment := value[strings.LastIndex(value, "/")+1:]
+	if len(segment) < 2 || segment[0] != 'v' {
+		return false
+	}
+	_, err := strconv.Atoi(segment[1:])
+	return err == nil
+}

agent/app/provider/openclaw.go

@@ -15,72 +15,52 @@ type OpenClawProviderPatch struct {
 	AuthHeader   bool
 }
 
-func BuildOpenClawProviderPatch(provider, modelName, apiType, baseURL, apiKey string) (*OpenClawProviderPatch, error) {
+func BuildOpenClawProviderPatch(provider, modelName, apiType, authMode, baseURL, apiKey string) (*OpenClawProviderPatch, error) {
 	if modelName == "" {
 		return nil, fmt.Errorf("model is required")
 	}
-	resolvedAPIType, _, _ := ResolveRuntimeParams(provider, apiType, 0, 0)
-	modelID := resolveOpenClawModelID(provider, modelName)
-	switch provider {
-	case "deepseek":
-		return newOpenClawProviderPatch(modelName, "deepseek", modelID, apiKey, baseURL, "openai-completions", false), nil
-	case "gemini":
-		return newOpenClawProviderPatch("google/"+modelID, "google", modelID, apiKey, baseURL, resolvedAPIType, false), nil
-	case "moonshot", "kimi":
-		return buildMoonshotProviderPatch(provider, modelName, modelID, baseURL, apiKey), nil
-	case "bailian-coding-plan":
-		return newOpenClawProviderPatch("bailian-coding-plan/"+modelID, "bailian-coding-plan", modelID, apiKey, baseURL, "openai-completions", false), nil
-	case "ark-coding-plan":
-		return newOpenClawProviderPatch("ark-coding-plan/"+modelID, "ark-coding-plan", modelID, apiKey, baseURL, "openai-completions", false), nil
-	case "minimax":
-		return newOpenClawProviderPatch("minimax/"+modelID, "minimax", modelID, apiKey, baseURL, "anthropic-messages", true), nil
-	case "xiaomi":
-		return newOpenClawProviderPatch("xiaomi/"+modelID, "xiaomi", modelID, apiKey, baseURL, "openai-completions", false), nil
-	case "custom", "vllm":
-		return newOpenClawProviderPatch(provider+"/"+modelID, provider, modelID, apiKey, baseURL, resolvedAPIType, false), nil
-	case "ollama":
-		return newOpenClawProviderPatch(modelName, "ollama", modelID, "ollama", baseURL, resolvedAPIType, false), nil
-	case "kimi-coding":
-		return newOpenClawProviderPatch(modelName, "kimi-coding", modelID, apiKey, baseURL, "anthropic-messages", false), nil
-	case "zai":
-		return newOpenClawProviderPatch("zai/"+modelID, "zai", modelID, apiKey, baseURL, "openai-completions", false), nil
-	default:
-		return newOpenClawProviderPatch(modelName, provider, modelID, apiKey, baseURL, resolvedAPIType, false), nil
+	resolvedAPIType := apiType
+	if _, ok := FindAPIConfig(provider, resolvedAPIType); !ok {
+		resolvedAPIType = DefaultAPIType(provider)
 	}
-}
-
-func buildMoonshotProviderPatch(provider, modelName, modelID, baseURL, apiKey string) *OpenClawProviderPatch {
+	if IsImageAPIType(resolvedAPIType) {
+		return nil, fmt.Errorf("api type %s does not support text generation", resolvedAPIType)
+	}
+	resolvedAuthMode, err := ResolveAuthMode(provider, resolvedAPIType, authMode)
+	if err != nil {
+		return nil, err
+	}
+	usesBearer := resolvedAuthMode == AuthModeBearer
+	modelID := NormalizeModelID(provider, modelName)
 	providerKey := provider
-	primaryModel := modelName
-	if provider == "kimi" {
+	preserveQualifiedModel := false
+	switch provider {
+	case "gemini":
+		providerKey = "google"
+		resolvedAPIType = "google-generative-ai"
+		usesBearer = false
+	case "moonshot", "kimi":
 		providerKey = "moonshot"
-		primaryModel = "moonshot/" + modelID
+		resolvedAPIType = "openai-completions"
+		usesBearer = false
+	case "ollama":
+		apiKey = "ollama"
+		usesBearer = false
+	case "openai", "openrouter", "anthropic":
+		preserveQualifiedModel = strings.Contains(modelName, "/")
 	}
-	return newOpenClawProviderPatch(primaryModel, providerKey, modelID, apiKey, baseURL, "openai-completions", false)
-}
 
-func newOpenClawProviderPatch(primaryModel, providerKey, modelID, apiKey, baseURL, apiType string, authHeader bool) *OpenClawProviderPatch {
+	primaryModel := providerKey + "/" + modelID
+	if preserveQualifiedModel {
+		primaryModel = modelName
+	}
 	return &OpenClawProviderPatch{
 		PrimaryModel: primaryModel,
 		ProviderKey:  providerKey,
 		ModelID:      modelID,
 		APIKey:       apiKey,
 		BaseURL:      baseURL,
-		APIType:      apiType,
-		AuthHeader:   authHeader,
-	}
-}
-
-func resolveOpenClawModelID(provider, modelName string) string {
-	if provider == "custom" || provider == "vllm" {
-		target := strings.TrimLeft(modelName, "/")
-		if parts := strings.SplitN(target, "/", 2); len(parts) == 2 && parts[0] == "custom" {
-			return strings.TrimLeft(parts[1], "/")
-		}
-		return target
-	}
-	if parts := strings.SplitN(modelName, "/", 2); len(parts) == 2 {
-		return parts[1]
-	}
-	return modelName
+		APIType:      resolvedAPIType,
+		AuthHeader:   usesBearer,
+	}, nil
 }

agent/app/provider/verify.go

@@ -3,7 +3,9 @@ package provider
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
+	"io"
 	"net/http"
 	"strings"
 	"time"
@@ -18,160 +20,140 @@ type VerifyRequest struct {
 	Body    []byte
 }
 
-const (
-	defaultVerifyTimeout = 30 * time.Second
-)
+type verifyErrorResponse struct {
+	Error struct {
+		Message string `json:"message"`
+	} `json:"error"`
+	Message string `json:"message"`
+}
 
-func SkipVerification(key string) bool {
-	switch key {
-	case "custom", "vllm", "ollama", "kimi-coding":
+const defaultVerifyTimeout = 30 * time.Second
+
+func SkipVerification(provider string) bool {
+	switch provider {
+	case "vllm", "ollama", "kimi-coding":
 		return true
 	default:
 		return false
 	}
 }
 
-func VerifyAccount(provider, baseURL, apiKey string) error {
-	req := BuildVerifyRequest(provider, baseURL, apiKey)
-	var body *bytes.Buffer
-	if len(req.Body) > 0 {
-		body = bytes.NewBuffer(req.Body)
-	} else {
-		body = bytes.NewBuffer(nil)
-	}
-	httpReq, err := http.NewRequest(req.Method, req.URL, body)
+func VerifyAccount(provider, apiType, authMode, baseURL, apiKey, model string) error {
+	req := BuildVerifyRequest(provider, apiType, authMode, baseURL, apiKey, model)
+	httpReq, err := http.NewRequest(req.Method, req.URL, bytes.NewReader(req.Body))
 	if err != nil {
 		return err
 	}
 	for key, value := range req.Headers {
 		httpReq.Header.Set(key, value)
 	}
-	resp, err := (&http.Client{Timeout: verifyTimeout()}).Do(httpReq)
+	httpReq.Header.Set("Accept", "application/json")
+	resp, err := (&http.Client{Timeout: defaultVerifyTimeout}).Do(httpReq)
 	if err != nil {
 		return buserr.WithErr("ErrAgentAccountUnavailable", err)
 	}
 	defer resp.Body.Close()
-	if resp.StatusCode >= 400 {
-		return buserr.WithErr("ErrAgentAccountUnavailable", fmt.Errorf("verify failed: %s", resp.Status))
+	if resp.StatusCode < http.StatusOK || resp.StatusCode >= http.StatusMultipleChoices {
+		body, readErr := io.ReadAll(io.LimitReader(resp.Body, 1024*1024))
+		if readErr != nil {
+			return buserr.WithErr("ErrAgentAccountUnavailable", readErr)
+		}
+		return buserr.WithErr("ErrAgentAccountUnavailable", errors.New(verifyHTTPError(resp.StatusCode, body)))
 	}
 	return nil
 }
 
-func verifyTimeout() time.Duration {
-	return defaultVerifyTimeout
-}
+func BuildVerifyRequest(provider, apiType, authMode, baseURL, apiKey, model string) VerifyRequest {
+	baseURL = strings.TrimSpace(baseURL)
+	if provider != "custom" || !IsImageAPIType(apiType) {
+		baseURL = strings.TrimRight(baseURL, "/")
+	}
+	headers := map[string]string{"Content-Type": "application/json"}
+	request := VerifyRequest{Method: http.MethodPost, Headers: headers}
 
-func BuildVerifyRequest(provider, baseURL, apiKey string) VerifyRequest {
-	base := strings.TrimRight(strings.TrimSpace(baseURL), "/")
-	headers := map[string]string{}
-	request := VerifyRequest{Method: http.MethodGet, Headers: headers}
-
-	switch provider {
-	case "anthropic", "kimi-coding":
-		headers["x-api-key"] = apiKey
-		headers["anthropic-version"] = "2023-06-01"
-		if strings.Contains(base, "/v1") {
-			request.URL = base + "/models"
-		} else {
-			request.URL = base + "/v1/models"
-		}
-	case "gemini":
-		request.Method = http.MethodPost
-		if strings.Contains(base, "/v1beta") {
-			request.URL = base + "/models/gemini-3-flash-preview:generateContent"
-		} else {
-			request.URL = base + "/v1beta/models/gemini-3-flash-preview:generateContent"
-		}
+	if provider == "gemini" {
+		request.URL = baseURL + "/v1beta/models/" + strings.TrimSpace(model) + ":generateContent"
 		headers["x-goog-api-key"] = apiKey
-		headers["Content-Type"] = "application/json"
 		request.Body = mustJSON(map[string]interface{}{
-			"contents": []map[string]interface{}{{
-				"parts": []map[string]string{{
-					"text": "Explain how AI works in a few words",
-				}},
+			"contents": []map[string]interface{}{{"parts": []map[string]string{{"text": "test"}}}},
+		})
+		return request
+	}
+
+	switch apiType {
+	case "openai-images":
+		request.URL = imageVerifyURL(provider, baseURL, "/images/generations")
+		headers["Authorization"] = "Bearer " + apiKey
+		request.Body = mustJSON(map[string]interface{}{"model": model, "prompt": "test", "n": 1, "response_format": "url"})
+	case "dashscope-images":
+		request.URL = imageVerifyURL(provider, baseURL, "/api/v1/services/aigc/multimodal-generation/generation")
+		headers["Authorization"] = "Bearer " + apiKey
+		request.Body = mustJSON(map[string]interface{}{
+			"model": model,
+			"input": map[string]interface{}{"messages": []map[string]interface{}{
+				{"role": "user", "content": []map[string]string{{"text": "test"}}},
 			}},
+			"parameters": map[string]interface{}{"n": 1},
 		})
-	case "zai":
-		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
-		request.URL = base + "/models"
-	case "bailian-coding-plan":
-		request.Method = http.MethodPost
-		if !strings.Contains(base, "/v1") {
-			base = base + "/v1"
+	case "minimax-images":
+		request.URL = imageVerifyURL(provider, baseURL, "/v1/image_generation")
+		headers["Authorization"] = "Bearer " + apiKey
+		request.Body = mustJSON(map[string]interface{}{"model": model, "prompt": "test", "n": 1, "response_format": "url"})
+	case "openrouter-images":
+		request.URL = imageVerifyURL(provider, baseURL, "/api/v1/images")
+		headers["Authorization"] = "Bearer " + apiKey
+		request.Body = mustJSON(map[string]interface{}{"model": model, "prompt": "test", "n": 1, "response_format": "url"})
+	case "anthropic-messages":
+		request.URL = baseURL + "/v1/messages"
+		if authMode == AuthModeBearer {
+			headers["Authorization"] = "Bearer " + apiKey
+		} else {
+			headers["x-api-key"] = apiKey
 		}
-		request.URL = base + "/chat/completions"
-		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
-		headers["Content-Type"] = "application/json"
-		request.Body = mustJSON(map[string]interface{}{
-			"model":      "qwen3.5-plus",
-			"messages":   []map[string]string{{"role": "user", "content": "test"}},
-			"max_tokens": 1,
-		})
-	case "ark-coding-plan":
-		request.Method = http.MethodPost
-		if !strings.Contains(base, "/api/coding/v3") {
-			base = "https://ark.cn-beijing.volces.com/api/coding/v3"
-		}
-		request.URL = base + "/chat/completions"
-		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
-		headers["Content-Type"] = "application/json"
-		request.Body = mustJSON(map[string]interface{}{
-			"model":      "ark-code-latest",
-			"messages":   []map[string]string{{"role": "user", "content": "test"}},
-			"max_tokens": 1,
-		})
-	case "minimax":
-		request.Method = http.MethodPost
-		headers["x-api-key"] = apiKey
 		headers["anthropic-version"] = "2023-06-01"
-		headers["Content-Type"] = "application/json"
-		if strings.Contains(base, "/v1") {
-			request.URL = base + "/messages"
-		} else {
-			request.URL = base + "/v1/messages"
-		}
 		request.Body = mustJSON(map[string]interface{}{
-			"model":      "MiniMax-M2.5",
-			"max_tokens": 1,
-			"messages": []map[string]interface{}{{
-				"role": "user",
-				"content": []map[string]string{{
-					"type": "text",
-					"text": "test",
-				}},
-			}},
+			"model": model, "max_tokens": 1, "stream": false,
+			"messages": []map[string]interface{}{{"role": "user", "content": []map[string]string{{"type": "text", "text": "test"}}}},
 		})
-	case "xiaomi":
-		request.Method = http.MethodPost
-		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
-		headers["Content-Type"] = "application/json"
-		if !strings.Contains(base, "/v1") {
-			base = base + "/v1"
-		}
-		request.URL = base + "/chat/completions"
-		request.Body = mustJSON(map[string]interface{}{
-			"model":      "mimo-v2-flash",
-			"max_tokens": 1,
-			"messages":   []map[string]string{{"role": "user", "content": "test"}},
-		})
-	case "openrouter":
-		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
-		if strings.Contains(base, "/v1") {
-			request.URL = base + "/key"
-		} else {
-			request.URL = base + "/v1/key"
-		}
+	case "openai-responses":
+		request.URL = baseURL + "/responses"
+		headers["Authorization"] = "Bearer " + apiKey
+		request.Body = mustJSON(map[string]interface{}{"model": model, "input": "test", "max_output_tokens": 1, "stream": false})
 	default:
-		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
-		if strings.Contains(base, "/v1") {
-			request.URL = base + "/models"
-		} else {
-			request.URL = base + "/v1/models"
+		request.URL = baseURL + "/chat/completions"
+		if provider != "ollama" || strings.TrimSpace(apiKey) != "" {
+			headers["Authorization"] = "Bearer " + apiKey
 		}
+		request.Body = mustJSON(map[string]interface{}{
+			"model": model, "messages": []map[string]string{{"role": "user", "content": "test"}}, "max_tokens": 1, "stream": false,
+		})
 	}
 	return request
 }
 
+func imageVerifyURL(provider, baseURL, endpoint string) string {
+	if provider == "custom" || strings.HasSuffix(strings.ToLower(baseURL), endpoint) {
+		return baseURL
+	}
+	return baseURL + endpoint
+}
+
+func verifyHTTPError(statusCode int, body []byte) string {
+	message := strings.TrimSpace(string(body))
+	var payload verifyErrorResponse
+	if err := json.Unmarshal(body, &payload); err == nil {
+		if value := strings.TrimSpace(payload.Error.Message); value != "" {
+			message = value
+		} else if value := strings.TrimSpace(payload.Message); value != "" {
+			message = value
+		}
+	}
+	if message == "" {
+		return fmt.Sprintf("validation request returned status %d", statusCode)
+	}
+	return message
+}
+
 func mustJSON(value interface{}) []byte {
 	payload, err := json.Marshal(value)
 	if err != nil {

agent/app/repo/agent_account.go

@@ -1,16 +1,23 @@
 package repo
 
-import "github.com/1Panel-dev/1Panel/agent/app/model"
+import (
+	"strings"
+
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"gorm.io/gorm"
+)
 
 type AgentAccountRepo struct{}
 
 type IAgentAccountRepo interface {
 	Page(page, size int, opts ...DBOption) (int64, []model.AgentAccount, error)
 	GetFirst(opts ...DBOption) (*model.AgentAccount, error)
+	WithByMasterAccountID(masterID uint) DBOption
 	Create(account *model.AgentAccount) error
 	Save(account *model.AgentAccount) error
 	DeleteByID(id uint) error
 	List(opts ...DBOption) ([]model.AgentAccount, error)
+	CountTextByProviders(providers []string) (map[string]int64, error)
 }
 
 func NewIAgentAccountRepo() IAgentAccountRepo {
@@ -34,6 +41,12 @@ func (a AgentAccountRepo) GetFirst(opts ...DBOption) (*model.AgentAccount, error
 	return &account, nil
 }
 
+func (a AgentAccountRepo) WithByMasterAccountID(masterID uint) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		return g.Where("master_account_id = ?", masterID)
+	}
+}
+
 func (a AgentAccountRepo) Create(account *model.AgentAccount) error {
 	return getDb().Create(account).Error
 }
@@ -53,3 +66,50 @@ func (a AgentAccountRepo) List(opts ...DBOption) ([]model.AgentAccount, error) {
 	}
 	return accounts, nil
 }
+
+func (a AgentAccountRepo) CountTextByProviders(providers []string) (map[string]int64, error) {
+	normalizedProviders := normalizeProviders(providers)
+	counts := make(map[string]int64, len(normalizedProviders))
+	for _, provider := range normalizedProviders {
+		counts[provider] = 0
+	}
+	if len(normalizedProviders) == 0 {
+		return counts, nil
+	}
+
+	type providerCount struct {
+		Provider string
+		Count    int64
+	}
+	var rows []providerCount
+	if err := getDb().
+		Model(&model.AgentAccount{}).
+		Select("provider, COUNT(*) as count").
+		Where("provider IN ?", normalizedProviders).
+		Where("api_type NOT LIKE ?", "%-images").
+		Group("provider").
+		Scan(&rows).Error; err != nil {
+		return nil, err
+	}
+	for _, row := range rows {
+		counts[row.Provider] = row.Count
+	}
+	return counts, nil
+}
+
+func normalizeProviders(providers []string) []string {
+	seen := make(map[string]struct{}, len(providers))
+	result := make([]string, 0, len(providers))
+	for _, provider := range providers {
+		provider = strings.TrimSpace(provider)
+		if provider == "" {
+			continue
+		}
+		if _, ok := seen[provider]; ok {
+			continue
+		}
+		seen[provider] = struct{}{}
+		result = append(result, provider)
+	}
+	return result
+}

agent/app/repo/alert.go

@@ -1,11 +1,15 @@
 package repo
 
 import (
+	"encoding/json"
+	"strings"
+
 	"github.com/1Panel-dev/1Panel/agent/app/model"
 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/global"
 	"google.golang.org/genproto/googleapis/type/date"
 	"gorm.io/gorm"
+	"strconv"
 	"time"
 )
 
@@ -20,7 +24,8 @@ type IAlertRepo interface {
 	WithByCreateAt(date *date.Date) DBOption
 	WithByLicenseId(licenseId string) DBOption
 	WithByRecordId(recordId uint) DBOption
-	WithByMethod(method string) DBOption
+	WithByAlertMethodContainsConfigID(id uint) DBOption
+	WithByMethodConfigIDs(ids []uint) DBOption
 
 	Create(alert *model.Alert) error
 	Get(opts ...DBOption) (model.Alert, error)
@@ -47,11 +52,15 @@ type IAlertRepo interface {
 	GetLicensePushCount(method string) (uint, error)
 
 	GetConfig(opts ...DBOption) (model.AlertConfig, error)
+	GetConfigById(id uint) (model.AlertConfig, error)
 	AlertConfigList(opts ...DBOption) ([]model.AlertConfig, error)
 	UpdateAlertConfig(maps map[string]interface{}, opts ...DBOption) error
 	CreateAlertConfig(config *model.AlertConfig) error
 	DeleteAlertConfig(opts ...DBOption) error
 
+	WithByTypeNotIn(types []string) DBOption
+	PageAlertConfig(page, size int, opts ...DBOption) (int64, []model.AlertConfig, error)
+
 	SyncAll(data []model.AlertConfig) error
 }
 
@@ -101,9 +110,20 @@ func (a *AlertRepo) WithByRecordId(recordId uint) DBOption {
 	}
 }
 
-func (a *AlertRepo) WithByMethod(method string) DBOption {
+func (a *AlertRepo) WithByAlertMethodContainsConfigID(id uint) DBOption {
+	method := strconv.Itoa(int(id))
 	return func(g *gorm.DB) *gorm.DB {
-		return g.Where("method = ?", method)
+		return g.Where("(method = ? OR method LIKE ? OR method LIKE ? OR method LIKE ?)", method, method+",%", "%,"+method, "%,"+method+",%")
+	}
+}
+
+func (a *AlertRepo) WithByMethodConfigIDs(ids []uint) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		methods := make([]string, 0, len(ids))
+		for _, id := range ids {
+			methods = append(methods, strconv.Itoa(int(id)))
+		}
+		return g.Where("method IN ?", methods)
 	}
 }
 
@@ -306,32 +326,233 @@ func (a *AlertRepo) GetConfig(opts ...DBOption) (model.AlertConfig, error) {
 	return alertConfig, err
 }
 
+func (a *AlertRepo) GetConfigById(id uint) (model.AlertConfig, error) {
+	var config model.AlertConfig
+	err := global.AlertDB.First(&config, id).Error
+	return config, err
+}
+
+func (a *AlertRepo) WithByTypeNotIn(types []string) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		return g.Where("`type` NOT IN (?)", types)
+	}
+}
+
+func (a *AlertRepo) PageAlertConfig(page, size int, opts ...DBOption) (int64, []model.AlertConfig, error) {
+	var configs []model.AlertConfig
+	db := global.AlertDB.Model(&model.AlertConfig{})
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	count := int64(0)
+	db = db.Count(&count)
+	err := db.Limit(size).Offset(size * (page - 1)).Find(&configs).Error
+	return count, configs, err
+}
+
+var singletonTypes = map[string]bool{
+	constant.CommonConfig: true,
+}
+
 func (a *AlertRepo) SyncAll(data []model.AlertConfig) error {
 	tx := global.AlertDB.Begin()
+	if tx.Error != nil {
+		return tx.Error
+	}
+	defer func() {
+		if r := recover(); r != nil {
+			tx.Rollback()
+			panic(r)
+		}
+	}()
+
 	var oldConfigs []model.AlertConfig
-	_ = tx.Find(&oldConfigs).Error
+	if err := tx.Find(&oldConfigs).Error; err != nil {
+		tx.Rollback()
+		return err
+	}
+
+	usedConfigIDs, err := loadUsedAlertConfigIDs(tx)
+	if err != nil {
+		tx.Rollback()
+		return err
+	}
+
 	oldConfigMap := make(map[string]uint)
+	oldConfigByType := make(map[string][]model.AlertConfig)
+	oldConfigByKey := make(map[string][]model.AlertConfig)
+	consumedConfigIDs := make(map[uint]struct{})
 	for _, item := range oldConfigs {
-		oldConfigMap[item.Type] = item.ID
+		if singletonTypes[item.Type] {
+			oldConfigMap[item.Type] = item.ID
+			continue
+		}
+		oldConfigByType[item.Type] = append(oldConfigByType[item.Type], item)
+		oldConfigByKey[alertConfigSyncKey(item)] = append(oldConfigByKey[alertConfigSyncKey(item)], item)
 	}
 	for _, item := range data {
-		if val, ok := oldConfigMap[item.Type]; ok {
-			item.ID = val
-			delete(oldConfigMap, item.Type)
-		} else {
-			item.ID = 0
+		if singletonTypes[item.Type] {
+			if val, ok := oldConfigMap[item.Type]; ok {
+				item.ID = val
+				delete(oldConfigMap, item.Type)
+				consumedConfigIDs[item.ID] = struct{}{}
+			} else {
+				item.ID = 0
+			}
+			if item.ID == 0 {
+				if err := tx.Create(&item).Error; err != nil {
+					tx.Rollback()
+					return err
+				}
+			} else if err := tx.Save(&item).Error; err != nil {
+				tx.Rollback()
+				return err
+			}
+			continue
 		}
-		if err := tx.Model(model.AlertConfig{}).Where("id = ?", item.ID).Save(&item).Error; err != nil {
+
+		key := alertConfigSyncKey(item)
+		if matched, ok := popAlertConfigByKey(oldConfigByKey, key); ok {
+			item.ID = matched.ID
+			consumedConfigIDs[item.ID] = struct{}{}
+			if err := tx.Save(&item).Error; err != nil {
+				tx.Rollback()
+				return err
+			}
+			deleteAlertConfigByID(oldConfigByType, matched.ID)
+			continue
+		}
+
+		if matched, ok := popUnusedAlertConfigByType(oldConfigByType, usedConfigIDs, item.Type); ok {
+			item.ID = matched.ID
+			consumedConfigIDs[item.ID] = struct{}{}
+			if err := tx.Save(&item).Error; err != nil {
+				tx.Rollback()
+				return err
+			}
+			continue
+		}
+
+		item.ID = 0
+		if err := tx.Create(&item).Error; err != nil {
 			tx.Rollback()
 			return err
 		}
 	}
-	for _, val := range oldConfigMap {
-		if err := tx.Where("id = ?", val).Delete(&model.AlertConfig{}).Error; err != nil {
+	for _, item := range oldConfigs {
+		if _, used := usedConfigIDs[item.ID]; used {
+			continue
+		}
+		if _, kept := consumedConfigIDs[item.ID]; kept {
+			continue
+		}
+		if err := tx.Where("id = ?", item.ID).Delete(&model.AlertConfig{}).Error; err != nil {
 			tx.Rollback()
 			return err
 		}
 	}
-	tx.Commit()
+	if err := tx.Commit().Error; err != nil {
+		tx.Rollback()
+		return err
+	}
 	return nil
 }
+
+func loadUsedAlertConfigIDs(tx *gorm.DB) (map[uint]struct{}, error) {
+	var alerts []model.Alert
+	if err := tx.Select("method").Find(&alerts).Error; err != nil {
+		return nil, err
+	}
+
+	usedIDs := make(map[uint]struct{})
+	for _, alert := range alerts {
+		for _, item := range strings.Split(alert.Method, ",") {
+			item = strings.TrimSpace(item)
+			if item == "" {
+				continue
+			}
+			id, err := strconv.ParseUint(item, 10, 64)
+			if err != nil {
+				continue
+			}
+			usedIDs[uint(id)] = struct{}{}
+		}
+	}
+	return usedIDs, nil
+}
+
+func alertConfigSyncKey(item model.AlertConfig) string {
+	return item.Type + "::" + normalizeAlertConfigJSON(item.Config)
+}
+
+func normalizeAlertConfigJSON(config string) string {
+	trimmed := strings.TrimSpace(config)
+	if trimmed == "" {
+		return ""
+	}
+
+	var data any
+	if err := json.Unmarshal([]byte(trimmed), &data); err != nil {
+		return trimmed
+	}
+	buf, err := json.Marshal(data)
+	if err != nil {
+		return trimmed
+	}
+	return string(buf)
+}
+
+func popAlertConfigByKey(configMap map[string][]model.AlertConfig, key string) (model.AlertConfig, bool) {
+	items := configMap[key]
+	if len(items) == 0 {
+		return model.AlertConfig{}, false
+	}
+
+	item := items[0]
+	if len(items) == 1 {
+		delete(configMap, key)
+	} else {
+		configMap[key] = items[1:]
+	}
+	return item, true
+}
+
+func popUnusedAlertConfigByType(configMap map[string][]model.AlertConfig, usedConfigIDs map[uint]struct{}, configType string) (model.AlertConfig, bool) {
+	items := configMap[configType]
+	if len(items) == 0 {
+		return model.AlertConfig{}, false
+	}
+
+	for idx, item := range items {
+		if _, used := usedConfigIDs[item.ID]; used {
+			continue
+		}
+		if idx == 0 {
+			if len(items) == 1 {
+				delete(configMap, configType)
+			} else {
+				configMap[configType] = items[1:]
+			}
+		} else {
+			configMap[configType] = append(items[:idx], items[idx+1:]...)
+		}
+		return item, true
+	}
+	return model.AlertConfig{}, false
+}
+
+func deleteAlertConfigByID(configMap map[string][]model.AlertConfig, id uint) {
+	for key, items := range configMap {
+		for idx, item := range items {
+			if item.ID != id {
+				continue
+			}
+			if len(items) == 1 {
+				delete(configMap, key)
+			} else {
+				configMap[key] = append(items[:idx], items[idx+1:]...)
+			}
+			return
+		}
+	}
+}

agent/app/repo/app_install_resource.go

@@ -15,6 +15,7 @@ type IAppInstallResourceRpo interface {
 	WithAppInstallId(appInstallId uint) DBOption
 	WithLinkId(linkId uint) DBOption
 	WithResourceId(resourceId uint) DBOption
+	WithResourceIds(resourceIds []uint) DBOption
 	GetBy(opts ...DBOption) ([]model.AppInstallResource, error)
 	GetFirst(opts ...DBOption) (model.AppInstallResource, error)
 	Create(ctx context.Context, resource *model.AppInstallResource) error
@@ -44,6 +45,12 @@ func (a AppInstallResourceRpo) WithResourceId(resourceId uint) DBOption {
 	}
 }
 
+func (a AppInstallResourceRpo) WithResourceIds(resourceIds []uint) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("resource_id IN ?", resourceIds)
+	}
+}
+
 func (a AppInstallResourceRpo) GetBy(opts ...DBOption) ([]model.AppInstallResource, error) {
 	db := global.DB.Model(&model.AppInstallResource{})
 	var resources []model.AppInstallResource

agent/app/repo/common.go

@@ -49,6 +49,12 @@ func WithByName(name string) DBOption {
 	}
 }
 
+func WithByPath(path string) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		return g.Where("path = ?", path)
+	}
+}
+
 func WithByAddr(addr string) DBOption {
 	return func(g *gorm.DB) *gorm.DB {
 		return g.Where("addr = ?", addr)
@@ -94,6 +100,18 @@ func WithByProvider(provider string) DBOption {
 	}
 }
 
+func WithByAPIType(apiType string) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		return g.Where("api_type = ?", apiType)
+	}
+}
+
+func WithTextAPIType() DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		return g.Where("api_type NOT LIKE ?", "%-images")
+	}
+}
+
 func WithByModel(model string) DBOption {
 	return func(g *gorm.DB) *gorm.DB {
 		if len(model) == 0 {

agent/app/repo/database_user.go

@@ -0,0 +1,121 @@
+package repo
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/utils/encrypt"
+	"gorm.io/gorm"
+)
+
+type DatabaseUserRepo struct{}
+
+type IDatabaseUserRepo interface {
+	Get(opts ...DBOption) (model.DatabaseUser, error)
+	List(opts ...DBOption) ([]model.DatabaseUser, error)
+	Save(user *model.DatabaseUser) error
+	Delete(opts ...DBOption) error
+	DeleteBy(ctx context.Context, opts ...DBOption) error
+	Update(vars map[string]interface{}, opts ...DBOption) error
+	WithByDatabase(database string) DBOption
+	WithByUser(username, host string) DBOption
+	WithByUserList(users [][2]string) DBOption
+}
+
+func NewIDatabaseUserRepo() IDatabaseUserRepo {
+	return &DatabaseUserRepo{}
+}
+
+func (u *DatabaseUserRepo) Get(opts ...DBOption) (model.DatabaseUser, error) {
+	var user model.DatabaseUser
+	db := global.DB.Model(&model.DatabaseUser{})
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	if err := db.First(&user).Error; err != nil {
+		return user, err
+	}
+	password, err := encrypt.StringDecrypt(user.Password)
+	if err != nil {
+		global.LOG.Errorf("decrypt database user %s password failed, err: %v", user.Username, err)
+	}
+	user.Password = password
+	return user, nil
+}
+
+func (u *DatabaseUserRepo) List(opts ...DBOption) ([]model.DatabaseUser, error) {
+	var users []model.DatabaseUser
+	db := global.DB.Model(&model.DatabaseUser{})
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	if err := db.Find(&users).Error; err != nil {
+		return users, err
+	}
+	for i := 0; i < len(users); i++ {
+		password, err := encrypt.StringDecrypt(users[i].Password)
+		if err != nil {
+			global.LOG.Errorf("decrypt database user %s password failed, err: %v", users[i].Username, err)
+		}
+		users[i].Password = password
+	}
+	return users, nil
+}
+
+func (u *DatabaseUserRepo) Save(user *model.DatabaseUser) error {
+	if len(user.Password) != 0 {
+		password, err := encrypt.StringEncrypt(user.Password)
+		if err != nil {
+			return fmt.Errorf("encrypt database user %s password failed, err: %v", user.Username, err)
+		}
+		user.Password = password
+	}
+	return global.DB.Save(user).Error
+}
+
+func (u *DatabaseUserRepo) Delete(opts ...DBOption) error {
+	db := global.DB
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	return db.Delete(&model.DatabaseUser{}).Error
+}
+
+func (u *DatabaseUserRepo) DeleteBy(ctx context.Context, opts ...DBOption) error {
+	return getTx(ctx, opts...).Delete(&model.DatabaseUser{}).Error
+}
+
+func (u *DatabaseUserRepo) Update(vars map[string]interface{}, opts ...DBOption) error {
+	db := global.DB.Model(&model.DatabaseUser{})
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	return db.Updates(vars).Error
+}
+
+func (u *DatabaseUserRepo) WithByDatabase(database string) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		return g.Where("database = ?", database)
+	}
+}
+
+func (u *DatabaseUserRepo) WithByUser(username, host string) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		return g.Where("username = ? AND host = ?", username, host)
+	}
+}
+
+func (u *DatabaseUserRepo) WithByUserList(users [][2]string) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		if len(users) == 0 {
+			return g.Where("1 = 0")
+		}
+		values := make([][]interface{}, 0, len(users))
+		for _, user := range users {
+			values = append(values, []interface{}{user[0], user[1]})
+		}
+		return g.Where("(username, host) IN ?", values)
+	}
+}

agent/app/repo/database_user_grant.go

@@ -0,0 +1,109 @@
+package repo
+
+import (
+	"context"
+
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"gorm.io/gorm"
+)
+
+type DatabaseUserGrantRepo struct{}
+
+type IDatabaseUserGrantRepo interface {
+	Get(opts ...DBOption) (model.DatabaseUserGrant, error)
+	List(opts ...DBOption) ([]model.DatabaseUserGrant, error)
+	Save(grant *model.DatabaseUserGrant) error
+	Replace(dbType, database string, grants []model.DatabaseUserGrant) error
+	Delete(opts ...DBOption) error
+	DeleteBy(ctx context.Context, opts ...DBOption) error
+	Update(vars map[string]interface{}, opts ...DBOption) error
+	WithByDatabase(database string) DBOption
+	WithByDBName(dbName string) DBOption
+	WithByDBNames(dbNames []string) DBOption
+	WithByUser(username, host string) DBOption
+}
+
+func (u *DatabaseUserGrantRepo) Get(opts ...DBOption) (model.DatabaseUserGrant, error) {
+	var grant model.DatabaseUserGrant
+	db := global.DB.Model(&model.DatabaseUserGrant{})
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	err := db.First(&grant).Error
+	return grant, err
+}
+
+func NewIDatabaseUserGrantRepo() IDatabaseUserGrantRepo {
+	return &DatabaseUserGrantRepo{}
+}
+
+func (u *DatabaseUserGrantRepo) List(opts ...DBOption) ([]model.DatabaseUserGrant, error) {
+	var grants []model.DatabaseUserGrant
+	db := global.DB.Model(&model.DatabaseUserGrant{})
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	err := db.Find(&grants).Error
+	return grants, err
+}
+
+func (u *DatabaseUserGrantRepo) Save(grant *model.DatabaseUserGrant) error {
+	return global.DB.Save(grant).Error
+}
+
+func (u *DatabaseUserGrantRepo) Replace(dbType, database string, grants []model.DatabaseUserGrant) error {
+	return global.DB.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Where("`type` = ? AND database = ?", dbType, database).Delete(&model.DatabaseUserGrant{}).Error; err != nil {
+			return err
+		}
+		if len(grants) != 0 {
+			return tx.Create(&grants).Error
+		}
+		return nil
+	})
+}
+
+func (u *DatabaseUserGrantRepo) Delete(opts ...DBOption) error {
+	db := global.DB
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	return db.Delete(&model.DatabaseUserGrant{}).Error
+}
+
+func (u *DatabaseUserGrantRepo) DeleteBy(ctx context.Context, opts ...DBOption) error {
+	return getTx(ctx, opts...).Delete(&model.DatabaseUserGrant{}).Error
+}
+
+func (u *DatabaseUserGrantRepo) Update(vars map[string]interface{}, opts ...DBOption) error {
+	db := global.DB.Model(&model.DatabaseUserGrant{})
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	return db.Updates(vars).Error
+}
+
+func (u *DatabaseUserGrantRepo) WithByDatabase(database string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("database = ?", database)
+	}
+}
+
+func (u *DatabaseUserGrantRepo) WithByDBName(dbName string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("db_name = ?", dbName)
+	}
+}
+
+func (u *DatabaseUserGrantRepo) WithByDBNames(dbNames []string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("db_name IN ?", dbNames)
+	}
+}
+
+func (u *DatabaseUserGrantRepo) WithByUser(username, host string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("username = ? AND host = ?", username, host)
+	}
+}

agent/app/repo/website.go

@@ -17,10 +17,12 @@ type IWebsiteRepo interface {
 	WithGroupID(groupId uint) DBOption
 	WithDefaultServer() DBOption
 	WithDomainLike(domain string) DBOption
+	WithSearchKeyword(keyword string, ids []uint) DBOption
 	WithRuntimeID(runtimeID uint) DBOption
 	WithParentID(websiteID uint) DBOption
 	WithType(websiteType string) DBOption
 	WithDBType(dbType string) DBOption
+	WithDBTypes(dbTypes []string) DBOption
 	WithDBID(dbID uint) DBOption
 
 	Page(page, size int, opts ...DBOption) (int64, []model.Website, error)
@@ -76,6 +78,19 @@ func (w *WebsiteRepo) WithDomainLike(domain string) DBOption {
 	}
 }
 
+func (w *WebsiteRepo) WithSearchKeyword(keyword string, ids []uint) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		if keyword == "" {
+			return db
+		}
+		keyword = "%" + keyword + "%"
+		if len(ids) == 0 {
+			return db.Where("(primary_domain like ? OR alias like ?)", keyword, keyword)
+		}
+		return db.Where("(primary_domain like ? OR alias like ? OR id in (?))", keyword, keyword, ids)
+	}
+}
+
 func (w *WebsiteRepo) WithAlias(alias string) DBOption {
 	return func(db *gorm.DB) *gorm.DB {
 		return db.Where("alias = ?", alias)
@@ -118,6 +133,12 @@ func (w *WebsiteRepo) WithDBType(dbType string) DBOption {
 	}
 }
 
+func (w *WebsiteRepo) WithDBTypes(dbTypes []string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("db_type IN ?", dbTypes)
+	}
+}
+
 func (w *WebsiteRepo) WithDBID(dbID uint) DBOption {
 	return func(db *gorm.DB) *gorm.DB {
 		return db.Where("db_id = ?", dbID)

agent/app/repo/website_ssl.go

@@ -2,8 +2,10 @@ package repo
 
 import (
 	"context"
+	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/constant"
 	"gorm.io/gorm"
 )
 
@@ -21,6 +23,7 @@ type ISSLRepo interface {
 	Page(page, size int, opts ...DBOption) (int64, []model.WebsiteSSL, error)
 	GetFirst(opts ...DBOption) (*model.WebsiteSSL, error)
 	List(opts ...DBOption) ([]model.WebsiteSSL, error)
+	TryMarkApplying(id uint) (bool, error)
 	Create(ctx context.Context, ssl *model.WebsiteSSL) error
 	Save(ssl *model.WebsiteSSL) error
 	DeleteBy(opts ...DBOption) error
@@ -76,12 +79,12 @@ func (w WebsiteSSLRepo) Page(page, size int, opts ...DBOption) (int64, []model.W
 }
 
 func (w WebsiteSSLRepo) GetFirst(opts ...DBOption) (*model.WebsiteSSL, error) {
-	var website *model.WebsiteSSL
+	var website model.WebsiteSSL
 	db := getDb(opts...).Model(&model.WebsiteSSL{})
 	if err := db.Preload("AcmeAccount").Preload("DnsAccount").First(&website).Error; err != nil {
-		return website, err
+		return nil, err
 	}
-	return website, nil
+	return &website, nil
 }
 
 func (w WebsiteSSLRepo) List(opts ...DBOption) ([]model.WebsiteSSL, error) {
@@ -93,14 +96,25 @@ func (w WebsiteSSLRepo) List(opts ...DBOption) ([]model.WebsiteSSL, error) {
 	return websites, nil
 }
 
+func (w WebsiteSSLRepo) TryMarkApplying(id uint) (bool, error) {
+	db := getDb().Model(&model.WebsiteSSL{}).
+		Where("id = ? AND status <> ?", id, constant.SSLApply).
+		Updates(map[string]interface{}{
+			"status":     constant.SSLApply,
+			"updated_at": time.Now(),
+		})
+	if db.Error != nil {
+		return false, db.Error
+	}
+	return db.RowsAffected > 0, nil
+}
+
 func (w WebsiteSSLRepo) Create(ctx context.Context, ssl *model.WebsiteSSL) error {
 	return getTx(ctx).Create(ssl).Error
 }
 
 func (w WebsiteSSLRepo) Save(ssl *model.WebsiteSSL) error {
-	return getDb().Model(&model.WebsiteSSL{BaseModel: model.BaseModel{
-		ID: ssl.ID,
-	}}).Save(&ssl).Error
+	return getDb().Save(ssl).Error
 }
 
 func (w WebsiteSSLRepo) SaveByMap(ssl *model.WebsiteSSL, params map[string]interface{}) error {

agent/app/repo/website_template.go

@@ -0,0 +1,131 @@
+package repo
+
+import (
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"gorm.io/gorm"
+)
+
+type IWebsiteTemplateRepo interface {
+	Page(page, size int, opts ...DBOption) (int64, []model.WebsiteTemplate, error)
+	GetFirst(opts ...DBOption) (*model.WebsiteTemplate, error)
+	List(opts ...DBOption) ([]model.WebsiteTemplate, error)
+	Create(template *model.WebsiteTemplate) error
+	Save(template *model.WebsiteTemplate) error
+	DeleteBy(opts ...DBOption) error
+	WithName(name string) DBOption
+	WithType(templateType string) DBOption
+}
+
+func NewIWebsiteTemplateRepo() IWebsiteTemplateRepo {
+	return &WebsiteTemplateRepo{}
+}
+
+type WebsiteTemplateRepo struct {
+}
+
+func (w *WebsiteTemplateRepo) WithName(name string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("name like ?", "%"+name+"%")
+	}
+}
+
+func (w *WebsiteTemplateRepo) WithType(templateType string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("type = ?", templateType)
+	}
+}
+
+func (w *WebsiteTemplateRepo) Page(page, size int, opts ...DBOption) (int64, []model.WebsiteTemplate, error) {
+	var templates []model.WebsiteTemplate
+	db := getDb(opts...).Model(&model.WebsiteTemplate{})
+	count := int64(0)
+	db = db.Count(&count)
+	err := db.Limit(size).Offset(size * (page - 1)).Find(&templates).Error
+	return count, templates, err
+}
+
+func (w *WebsiteTemplateRepo) GetFirst(opts ...DBOption) (*model.WebsiteTemplate, error) {
+	var template model.WebsiteTemplate
+	db := getDb(opts...).Model(&model.WebsiteTemplate{})
+	if err := db.First(&template).Error; err != nil {
+		return nil, err
+	}
+	return &template, nil
+}
+
+func (w *WebsiteTemplateRepo) List(opts ...DBOption) ([]model.WebsiteTemplate, error) {
+	var templates []model.WebsiteTemplate
+	err := getDb(opts...).Model(&model.WebsiteTemplate{}).Find(&templates).Error
+	return templates, err
+}
+
+func (w *WebsiteTemplateRepo) Create(template *model.WebsiteTemplate) error {
+	return getDb().Create(template).Error
+}
+
+func (w *WebsiteTemplateRepo) Save(template *model.WebsiteTemplate) error {
+	return getDb().Save(template).Error
+}
+
+func (w *WebsiteTemplateRepo) DeleteBy(opts ...DBOption) error {
+	return getDb(opts...).Delete(&model.WebsiteTemplate{}).Error
+}
+
+type IWebsiteTemplateOutputRepo interface {
+	Page(page, size int, opts ...DBOption) (int64, []model.WebsiteTemplateOutput, error)
+	GetFirst(opts ...DBOption) (*model.WebsiteTemplateOutput, error)
+	List(opts ...DBOption) ([]model.WebsiteTemplateOutput, error)
+	Create(output *model.WebsiteTemplateOutput) error
+	Save(output *model.WebsiteTemplateOutput) error
+	DeleteBy(opts ...DBOption) error
+	WithByTemplateID(templateID uint) DBOption
+}
+
+func NewIWebsiteTemplateOutputRepo() IWebsiteTemplateOutputRepo {
+	return &WebsiteTemplateOutputRepo{}
+}
+
+type WebsiteTemplateOutputRepo struct {
+}
+
+func (w *WebsiteTemplateOutputRepo) WithByTemplateID(templateID uint) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("template_id = ?", templateID)
+	}
+}
+
+func (w *WebsiteTemplateOutputRepo) Page(page, size int, opts ...DBOption) (int64, []model.WebsiteTemplateOutput, error) {
+	var outputs []model.WebsiteTemplateOutput
+	db := getDb(opts...).Model(&model.WebsiteTemplateOutput{})
+	count := int64(0)
+	db = db.Count(&count)
+	err := db.Limit(size).Offset(size * (page - 1)).Find(&outputs).Error
+	return count, outputs, err
+}
+
+func (w *WebsiteTemplateOutputRepo) GetFirst(opts ...DBOption) (*model.WebsiteTemplateOutput, error) {
+	var output model.WebsiteTemplateOutput
+	db := getDb(opts...).Model(&model.WebsiteTemplateOutput{})
+	if err := db.First(&output).Error; err != nil {
+		return nil, err
+	}
+	return &output, nil
+}
+
+func (w *WebsiteTemplateOutputRepo) List(opts ...DBOption) ([]model.WebsiteTemplateOutput, error) {
+	var outputs []model.WebsiteTemplateOutput
+	err := getDb(opts...).Model(&model.WebsiteTemplateOutput{}).Find(&outputs).Error
+	return outputs, err
+}
+
+func (w *WebsiteTemplateOutputRepo) Create(output *model.WebsiteTemplateOutput) error {
+	return getDb().Create(output).Error
+}
+
+func (w *WebsiteTemplateOutputRepo) Save(output *model.WebsiteTemplateOutput) error {
+	return getDb().Save(output).Error
+}
+
+func (w *WebsiteTemplateOutputRepo) DeleteBy(opts ...DBOption) error {
+	return getDb(opts...).Delete(&model.WebsiteTemplateOutput{}).Error
+}

agent/app/service/agents_agents.go

@@ -23,7 +23,7 @@ func (a AgentService) CreateRole(req dto.AgentRoleCreateReq) (*dto.AgentRoleCrea
 		return nil, err
 	}
 
-	args := []string{"exec", install.ContainerName, "openclaw", "agents", "add", req.Name}
+	args := []string{"openclaw", "agents", "add", req.Name}
 	workspace := "/home/node/.openclaw/workspace-agent_" + req.Name
 	agentDir := "/home/node/.openclaw/agents/" + req.Name
 	args = append(args, "--workspace", workspace)
@@ -43,8 +43,7 @@ func (a AgentService) CreateRole(req dto.AgentRoleCreateReq) (*dto.AgentRoleCrea
 	args = append(args, "--agent-dir", agentDir)
 	args = append(args, "--non-interactive", "--json")
 
-	mgr := cmd.NewCommandMgr(cmd.WithTimeout(5 * time.Minute))
-	output, err := mgr.RunWithStdout("docker", args...)
+	output, err := cmd.RunDockerExecWithStdout(5*time.Minute, install.ContainerName, args...)
 	if err != nil {
 		return nil, err
 	}
@@ -125,10 +124,8 @@ func (a AgentService) DeleteRole(req dto.AgentRoleDeleteReq) error {
 		return buserr.New("ErrRecordNotFound")
 	}
 
-	args := []string{"exec", install.ContainerName, "openclaw", "agents", "delete", req.ID, "--force"}
-
-	mgr := cmd.NewCommandMgr(cmd.WithTimeout(5 * time.Minute))
-	if _, err = mgr.RunWithStdout("docker", args...); err != nil {
+	args := []string{"openclaw", "agents", "delete", req.ID, "--force"}
+	if _, err = cmd.RunDockerExecWithStdout(5*time.Minute, install.ContainerName, args...); err != nil {
 		return err
 	}
 	if target.Workspace != "" {
@@ -171,8 +168,6 @@ func (a AgentService) operateRoleBinding(req dto.AgentRoleBindReq, action string
 		return buserr.New("ErrInvalidParams")
 	}
 	args := []string{
-		"exec",
-		install.ContainerName,
 		"openclaw",
 		"agents",
 		action,
@@ -182,8 +177,7 @@ func (a AgentService) operateRoleBinding(req dto.AgentRoleBindReq, action string
 		binding,
 	}
 	args = append(args, "--json")
-	mgr := cmd.NewCommandMgr(cmd.WithTimeout(5 * time.Minute))
-	_, err = mgr.RunWithStdout("docker", args...)
+	_, err = cmd.RunDockerExecWithStdout(5*time.Minute, install.ContainerName, args...)
 	return err
 }
 

agent/app/service/agents_channels.go

@@ -372,14 +372,14 @@ func (a AgentService) InstallPlugin(req dto.AgentPluginInstallReq) error {
 		mgr := cmd.NewCommandMgr(cmd.WithTask(*t), cmd.WithContext(t.TaskCtx), cmd.WithTimeout(10*time.Minute))
 		if req.Type == "qqbot" {
 			legacyPluginPath := path.Join(openclawPluginBaseDir, "qqbot")
-			if err := mgr.RunBashCf("docker exec %s test -d %s", install.ContainerName, legacyPluginPath); err == nil {
-				if _, err := mgr.RunWithStdout("docker", "exec", "-i", install.ContainerName, "sh", "-c", buildOpenclawPluginUninstallScript("qqbot")); err != nil {
+			if err := mgr.Run("docker", "exec", install.ContainerName, "test", "-d", legacyPluginPath); err == nil {
+				if err := uninstallOpenclawPlugin(mgr, install.ContainerName, "qqbot"); err != nil {
 					return err
 				}
 				time.Sleep(2 * time.Second)
 			}
 		}
-		if _, err := mgr.RunWithStdout("docker", "exec", install.ContainerName, "sh", "-c", buildOpenclawPluginInstallScript(spec, pluginID)); err != nil {
+		if err := installOpenclawPlugin(mgr, install.ContainerName, spec, pluginID); err != nil {
 			return err
 		}
 		conf, err := readOpenclawConfig(agent.ConfigPath)
@@ -415,11 +415,11 @@ func (a AgentService) UpgradePlugin(req dto.AgentPluginUpgradeReq) error {
 	}
 	upgradeTask.AddSubTask("Upgrade OpenClaw plugin", func(t *task.Task) error {
 		mgr := cmd.NewCommandMgr(cmd.WithTask(*t), cmd.WithContext(t.TaskCtx), cmd.WithTimeout(10*time.Minute))
-		if _, err := mgr.RunWithStdout("docker", "exec", "-i", install.ContainerName, "sh", "-c", buildOpenclawPluginUninstallScript(pluginID)); err != nil {
+		if err := uninstallOpenclawPlugin(mgr, install.ContainerName, pluginID); err != nil {
 			return err
 		}
 		time.Sleep(2 * time.Second)
-		if _, err := mgr.RunWithStdout("docker", "exec", install.ContainerName, "sh", "-c", buildOpenclawPluginInstallScript(spec, pluginID)); err != nil {
+		if err := installOpenclawPlugin(mgr, install.ContainerName, spec, pluginID); err != nil {
 			return err
 		}
 		conf, err := readOpenclawConfig(agent.ConfigPath)
@@ -455,7 +455,7 @@ func (a AgentService) UninstallPlugin(req dto.AgentPluginUninstallReq) error {
 	}
 	uninstallTask.AddSubTask("Uninstall OpenClaw plugin", func(t *task.Task) error {
 		mgr := cmd.NewCommandMgr(cmd.WithTask(*t), cmd.WithContext(t.TaskCtx), cmd.WithTimeout(10*time.Minute))
-		if _, err := mgr.RunWithStdout("docker", "exec", "-i", install.ContainerName, "sh", "-c", buildOpenclawPluginUninstallScript(pluginID)); err != nil {
+		if err := uninstallOpenclawPlugin(mgr, install.ContainerName, pluginID); err != nil {
 			return err
 		}
 		conf, err := readOpenclawConfig(agent.ConfigPath)
@@ -487,7 +487,7 @@ func (a AgentService) LoginWeixinChannel(req dto.AgentWeixinLoginReq) error {
 		if agent.AgentType == constant.AppHermesAgent {
 			return mgr.Run("docker", buildHermesWeixinLoginArgs(install.ContainerName)...)
 		}
-		return mgr.RunBashCf("docker exec %s openclaw channels login --channel openclaw-weixin", install.ContainerName)
+		return mgr.Run("docker", "exec", install.ContainerName, "openclaw", "channels", "login", "--channel", "openclaw-weixin")
 	}, nil)
 	if agent.AgentType == constant.AppHermesAgent {
 		loginTask.AddSubTask("Restart Hermes-Agent container", func(t *task.Task) error {
@@ -584,17 +584,26 @@ func (a AgentService) ApproveChannelPairing(req dto.AgentChannelPairingApproveRe
 		return validateHermesPairingApproveResult(output, err)
 	}
 	if req.AccountID != "" {
-		return cmd.RunDefaultBashCf(
-			"docker exec %s openclaw pairing approve %s %q --account %q",
+		return cmd.NewCommandMgr(cmd.WithTimeout(20*time.Second)).Run(
+			"docker",
+			"exec",
 			install.ContainerName,
+			"openclaw",
+			"pairing",
+			"approve",
 			req.Type,
 			req.PairingCode,
+			"--account",
 			req.AccountID,
 		)
 	}
-	return cmd.RunDefaultBashCf(
-		"docker exec %s openclaw pairing approve %s %q",
+	return cmd.NewCommandMgr(cmd.WithTimeout(20*time.Second)).Run(
+		"docker",
+		"exec",
 		install.ContainerName,
+		"openclaw",
+		"pairing",
+		"approve",
 		req.Type,
 		req.PairingCode,
 	)
@@ -802,9 +811,7 @@ func extractTelegramConfig(conf map[string]interface{}) dto.AgentTelegramConfig
 	result.RequireMention = result.GroupPolicy == "allowlist"
 	result.GroupAllowFrom = extractStringList(telegram["groupAllowFrom"])
 	result.Proxy = extractStringValue(telegram["proxy"])
-	if streaming := extractStringValue(telegram["streaming"]); streaming != "" {
-		result.Streaming = streaming
-	}
+	result.Streaming = normalizeTelegramStreamingMode(telegram["streaming"], result.Streaming)
 	accounts := childMap(telegram, "accounts")
 	if len(accounts) == 0 {
 		botToken := extractStringValue(telegram["botToken"])
@@ -830,7 +837,7 @@ func extractTelegramConfig(conf map[string]interface{}) dto.AgentTelegramConfig
 			BotToken:    extractStringValue(account["botToken"]),
 			DmPolicy:    extractStringValue(account["dmPolicy"]),
 			GroupPolicy: extractStringValue(account["groupPolicy"]),
-			Streaming:   extractStringValue(account["streaming"]),
+			Streaming:   normalizeTelegramStreamingMode(account["streaming"], result.Streaming),
 		})
 	}
 	result.DefaultAccount = normalizeDefaultAccount(extractStringValue(telegram["defaultAccount"]), getTelegramBotAccountIDs(bots))
@@ -870,7 +877,7 @@ func setTelegramConfig(conf map[string]interface{}, config dto.AgentTelegramConf
 	} else {
 		delete(telegram, "proxy")
 	}
-	telegram["streaming"] = config.Streaming
+	telegram["streaming"] = buildTelegramStreamingConfig(config.Streaming)
 	accounts := make(map[string]interface{}, len(config.Bots))
 	for _, bot := range config.Bots {
 		account := map[string]interface{}{
@@ -879,7 +886,7 @@ func setTelegramConfig(conf map[string]interface{}, config dto.AgentTelegramConf
 			"botToken":    bot.BotToken,
 			"dmPolicy":    bot.DmPolicy,
 			"groupPolicy": bot.GroupPolicy,
-			"streaming":   bot.Streaming,
+			"streaming":   buildTelegramStreamingConfig(bot.Streaming),
 		}
 		if bot.DmPolicy == "open" {
 			account["allowFrom"] = []string{"*"}
@@ -890,6 +897,29 @@ func setTelegramConfig(conf map[string]interface{}, config dto.AgentTelegramConf
 	delete(telegram, "botToken")
 }
 
+func normalizeTelegramStreamingMode(value interface{}, defaultMode string) string {
+	mode := defaultMode
+	switch typed := value.(type) {
+	case string:
+		mode = typed
+	case map[string]interface{}:
+		mode = extractStringValue(typed["mode"])
+	}
+	mode = strings.ToLower(strings.TrimSpace(mode))
+	switch mode {
+	case "off", "partial", "block", "progress":
+		return mode
+	default:
+		return "partial"
+	}
+}
+
+func buildTelegramStreamingConfig(mode string) map[string]interface{} {
+	return map[string]interface{}{
+		"mode": normalizeTelegramStreamingMode(mode, "partial"),
+	}
+}
+
 func extractDiscordConfig(conf map[string]interface{}) dto.AgentDiscordConfig {
 	result := dto.AgentDiscordConfig{Enabled: true, DmPolicy: "pairing", AllowFrom: []string{}, RequireMention: false, GroupPolicy: "open"}
 	discord := getChannelConfig(conf, "discord")
@@ -1289,20 +1319,40 @@ func appendPluginAllow(conf map[string]interface{}, pluginID string) {
 	plugins["allow"] = append(allow, pluginID)
 }
 
-func buildOpenclawPluginInstallScript(spec, pluginID string) string {
-	return fmt.Sprintf(
-		"set -e; workdir=%s/%s; rm -rf \"$workdir\"; mkdir -p \"$workdir\"; cd \"$workdir\"; npm pack --silent %q >/dev/null 2>&1; pkg=$(find \"$workdir\" -maxdepth 1 -type f -name '*.tgz' | head -n 1); printf '%%s\\n' \"$pkg\"; openclaw plugins install \"$pkg\" --dangerously-force-unsafe-install; rm -rf \"$workdir\"",
-		openclawPluginPackageTmpDir,
-		pluginID,
-		spec,
-	)
+func installOpenclawPlugin(mgr *cmd.CommandHelper, containerName, spec, pluginID string) error {
+	workdir := path.Join(openclawPluginPackageTmpDir, pluginID)
+	defer func() {
+		_ = mgr.Run("docker", "exec", containerName, "rm", "-rf", workdir)
+	}()
+	if err := mgr.Run("docker", "exec", containerName, "rm", "-rf", workdir); err != nil {
+		return err
+	}
+	if err := mgr.Run("docker", "exec", containerName, "mkdir", "-p", workdir); err != nil {
+		return err
+	}
+	if err := mgr.Run("docker", "exec", "-w", workdir, containerName, "npm", "pack", "--silent", spec); err != nil {
+		return err
+	}
+	pkgPath, err := cmd.RunDockerExecWithStdout(10*time.Minute, containerName, "find", workdir, "-maxdepth", "1", "-type", "f", "-name", "*.tgz", "-print", "-quit")
+	if err != nil {
+		return err
+	}
+	pkgPath = strings.TrimSpace(pkgPath)
+	if pkgPath == "" {
+		return fmt.Errorf("openclaw plugin package not found")
+	}
+	return mgr.Run("docker", "exec", containerName, "openclaw", "plugins", "install", pkgPath, "--dangerously-force-unsafe-install")
 }
 
-func buildOpenclawPluginUninstallScript(pluginID string) string {
-	return fmt.Sprintf(
-		"set +e; printf 'yes\\n' | openclaw plugins uninstall %s; code=$?; if [ \"$code\" -eq 137 ]; then exit 0; fi; exit \"$code\"",
-		pluginID,
+func uninstallOpenclawPlugin(mgr *cmd.CommandHelper, containerName, pluginID string) error {
+	_, err := mgr.RunPipe(
+		cmd.PipeCommand{Name: "printf", Args: []string{"yes\n"}},
+		cmd.PipeCommand{Name: "docker", Args: []string{"exec", "-i", containerName, "openclaw", "plugins", "uninstall", pluginID}},
 	)
+	if err != nil && strings.Contains(err.Error(), "exit status 137") {
+		return nil
+	}
+	return err
 }
 
 func resolvePluginMeta(pluginType string) (string, string, error) {
@@ -1357,7 +1407,7 @@ func loadOpenclawPluginLatestVersion(containerName, pluginType string) (string,
 	if err != nil {
 		return "", err
 	}
-	output, err := runDockerExecWithStdout(20*time.Second, containerName, "npm", "view", spec, "version", "--json")
+	output, err := cmd.RunDockerExecWithStdout(20*time.Second, containerName, "npm", "view", spec, "version", "--json")
 	if err != nil {
 		return "", err
 	}