feat: support enterprise demo mode

* fix(ssh): correlate disconnect logs by client endpoint

* fix(ssh): scope endpoint correlation to active sessions

---------

Co-authored-by: JayLee-sre <1.18655426e+08+JayLee-sre@users.noreply.github.com>
Co-authored-by: ssongliu <sloooop1x@gmail.com>

.github/workflows/llm-code-review.yml

@@ -1,25 +0,0 @@
-name: LLM Code Review
-permissions:
-  contents: read
-  pull-requests: write
-on:
-  pull_request:
-    types: [opened, reopened, synchronize]
-jobs:
-  llm-code-review:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: fit2cloud/LLM-CodeReview-Action@main
-        env:
-          GITHUB_TOKEN: ${{ secrets.FIT2CLOUDRD_LLM_CODE_REVIEW_TOKEN }}
-          OPENAI_API_KEY: ${{ secrets.ALIYUN_LLM_API_KEY }}
-          LANGUAGE: English
-          OPENAI_API_ENDPOINT: https://dashscope.aliyuncs.com/compatible-mode/v1
-          MODEL: qwen2.5-coder-3b-instruct
-          PROMPT: "Please check the following code differences for any irregularities, potential issues, or optimization suggestions, and provide your answers in English."
-          top_p: 1
-          temperature: 1
-          # max_tokens: 10000
-          MAX_PATCH_LENGTH: 10000 
-          IGNORE_PATTERNS: "/node_modules,*.md,/dist,/.github"
-          FILE_PATTERNS: "*.java,*.go,*.py,*.vue,*.ts,*.js,*.css,*.scss,*.html"

.github/workflows/sonarcloud-scan.yml

@@ -1,21 +0,0 @@
-name: SonarCloud Scan
-on:
-  push:
-    branches:
-      - dev
-  pull_request:
-    types: [opened, synchronize, reopened]
-jobs:
-  sonarcloud:
-    name: SonarCloud
-    if: github.repository == '1Panel-dev/1Panel'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-      - name: SonarCloud Scan
-        uses: SonarSource/sonarcloud-github-action@master
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUBTOKEN }}
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/sync2gitee.yml

@@ -6,7 +6,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Mirror the Github organization repos to Gitee.
-        uses: Yikun/hub-mirror-action@master
+        uses: Yikun/hub-mirror-action@ba51c01b28a6c9f95a25d4f1bcf6af2a147c0e18 # master
         with:
           src: 'github/1Panel-dev'
           dst: 'gitee/fit2cloud-feizhiyun'

.github/workflows/tyops-check.yml

@@ -1,11 +0,0 @@
-name: Typos Check
-on: pull_request
-jobs:
-  run:
-    name: Spell Check with Typos
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout Actions Repository
-      uses: actions/checkout@v2
-    - name: Check spelling
-      uses: crate-ci/typos@master

README.md

@@ -1,9 +1,6 @@
 <p align="center"><a href="https://1panel.pro"><img src="https://resource.1panel.pro/img/1panel-logo.png" alt="1Panel" width="300" /></a></p>
-
-<h3 align="center">The open-source VPS control panel with native AI agent support</h3>
-
 <p align="center">
-  Trusted by <strong>2,000,000+</strong> self-hosters worldwide
+  Loved by a global community of <strong>2.5M+</strong> self-hosters.
 </p>
 
 <p align="center">
@@ -12,7 +9,6 @@
 
 <p align="center">
   <a href="https://www.gnu.org/licenses/gpl-3.0.html"><img src="https://shields.io/github/license/1Panel-dev/1Panel?color=%231890FF" alt="License: GPL v3"></a>
-  <a href="https://app.codacy.com/gh/1Panel-dev/1Panel"><img src="https://app.codacy.com/project/badge/Grade/da67574fd82b473992781d1386b937ef" alt="Codacy"></a>
   <a href="https://discord.gg/bUpUqWqdRr"><img src="https://img.shields.io/discord/1318846410149335080?logo=discord&labelColor=%20%235462eb&logoColor=%20%23f5f5f5&color=%20%235462eb" alt="Discord"></a>
   <a href="https://github.com/1Panel-dev/1Panel/releases"><img src="https://img.shields.io/github/v/release/1Panel-dev/1Panel" alt="GitHub release"></a>
   <a href="https://github.com/1Panel-dev/1Panel"><img src="https://img.shields.io/github/stars/1Panel-dev/1Panel?color=%231890FF&style=flat-square" alt="Stars"></a>
@@ -25,7 +21,7 @@
   <a href="/docs/README.pt-br.md"><img alt="Português (Brasil)" src="https://img.shields.io/badge/Português (Brasil)-d9d9d9"></a>
   <a href="/docs/README.ar.md"><img alt="العربية" src="https://img.shields.io/badge/العربية-d9d9d9"></a>
   <a href="/docs/README.de.md"><img alt="Deutsch" src="https://img.shields.io/badge/Deutsch-d9d9d9"></a>
-  <a href="/docs/README.es.md"><img alt="Español" src="https://img.shields.io/badge/Español-d9d9d9"></a>
+  <a href="/docs/README.es-es.md"><img alt="Español" src="https://img.shields.io/badge/Español-d9d9d9"></a>
   <a href="/docs/README.fr.md"><img alt="français" src="https://img.shields.io/badge/français-d9d9d9"></a>
   <a href="/docs/README.ko.md"><img alt="한국어" src="https://img.shields.io/badge/한국어-d9d9d9"></a>
   <a href="/docs/README.id.md"><img alt="Bahasa Indonesia" src="https://img.shields.io/badge/Bahasa Indonesia-d9d9d9"></a>
@@ -33,40 +29,36 @@
   <a href="/docs/README.tr.md"><img alt="Türkçe" src="https://img.shields.io/badge/Türkçe-d9d9d9"></a>
   <a href="/docs/README.ru.md"><img alt="Русский" src="https://img.shields.io/badge/Русский-d9d9d9"></a>
   <a href="/docs/README.ms.md"><img alt="Bahasa Melayu" src="https://img.shields.io/badge/Bahasa Melayu-d9d9d9"></a>
+  <a href="/docs/README.fa.md"><img alt="Persian" src="https://img.shields.io/badge/%D9%81%D8%A7%D8%B1%D8%B3%DB%8C-d9d9d9"></a>
+  <a href="/docs/README.lo.md"><img alt="ພາສາລາວ" src="https://img.shields.io/badge/%E0%BA%9E%E0%BA%B2%E0%BA%AA%E0%BA%B2%E0%BA%A5%E0%BA%B2%E0%BA%A7-d9d9d9"></a>
 </p>
 
 ---
 
 ## What is 1Panel?
 
-1Panel is a modern, open-source VPS control panel — and the only one with **native AI agent support**. Run Ollama models, deploy OpenClaw agents, and manage your entire server stack from one clean web interface. No CLI memorization required.
-
-👉 Watch the [2-minute introduction](https://www.youtube.com/watch?v=Jl_wqp-XA08)
+1Panel is a modern, open-source Linux server management panel and a lightweight AI management platform. Through an intuitive web interface, it provides users with comprehensive, one-stop server management capabilities:
+- **AI Management**: Offers a unified management platform from bare metal to agents (Metal-to-Agent). It integrates an AI gateway, and Skills Hub, while supporting centralized management of agents and models.
+- **Efficient Visual Operations**: Easily manage Linux servers through a web-based GUI, streamlining tasks such as host monitoring, file management, database management, and container management.
+- **Rapid Website Deployment**: Deeply integrates with popular website builders like WordPress and Halo. It enables one-click domain binding and SSL certificate configuration, significantly lowering the barrier to website creation.
+- **Curated App Store**: Features a built-in store of high-quality open-source applications, providing one-click installation and upgrade services to effortlessly extend server capabilities.
+- **Enterprise-Grade Security**: Deploys applications based on container technology to effectively minimize vulnerability exposure. It also provides security features such as WAF and log auditing to ensure comprehensive server protection.
+- **One-Click Data Backup**: Supports one-click backup and restoration, and integrates with various cloud storage solutions to ensure data security and prevent loss.
 
 ## Why 1Panel?
 
 | | 1Panel | cPanel / Plesk | aaPanel | Webmin |
 |--|--------|----------------|---------|--------|
 | Free & open source | ✅ | ❌ | Partial | ✅ |
-| Native AI agent runtime | ✅ | ❌ | ❌ | ❌ |
+| AI management | ✅ | ❌ | ❌ | ❌ |
 | One-click app marketplace | ✅ 165+ apps | ❌ | ✅ | ❌ |
 | Modern UI (post-2020) | ✅ | ❌ | Partial | ❌ |
 | Docker / container management | ✅ | ❌ | ❌ | ❌ |
 | Active development | ✅ | ✅ | ✅ | Slow |
 
-## Key Features
-
-- **AI Agent Runtime**: Deploy Ollama LLMs, spin up OpenClaw personal agents, and monitor GPU utilization — all from the dashboard. No separate AI stack to manage.
-- **One-Click Website Deployment**: Launch production-ready websites with automatic domain binding, SSL provisioning, and Nginx config — zero manual setup.
-- **App Marketplace**: 165+ trusted open-source apps (Nextcloud, Bitwarden, Umami, NocoBase, and more) installed and updated with a single click.
-- **Docker & Container Management**: Create, start, stop, and inspect containers, images, networks, and volumes through a visual UI — no CLI juggling.
-- **Security Out of the Box**: Firewall rules, fail2ban, container isolation, WAF, and audit logs — configured and running from day one.
-- **Backup & Restore**: Schedule automated backups to AWS S3, Cloudflare R2, or local storage. Restore any snapshot in one click.
-
 ## Quick Start
 
-> **Requirements:** Linux VPS (Debian / Ubuntu / CentOS / Rocky), 1 GB RAM, internet access.  
-> Takes ~60 seconds.
+Prepare your Linux server and run the following script:
 
 ```bash
 bash -c "$(curl -sSL https://resource.1panel.pro/v2/quick_start.sh)"
@@ -81,24 +73,20 @@ Run `1pctl user-info` via SSH if you need to retrieve your access credentials.
 
 ## Pro Edition
 
-1Panel OSS is free forever. Pro adds features built for teams and production workloads:
+1Panel OSS is free forever. 1Panel Pro and Ent adds features built for teams and production workloads:
 
-| Feature | OSS | Pro |
-|---------|:---:|:---:|
-| One-click app installs | ✅ | ✅ |
-| AI agents (OpenClaw) | 1 agent | Unlimited |
-| WAF & advanced security | Basic | ✅ |
-| Website tamper protection | ❌ | ✅ |
-| Website uptime monitoring | ❌ | ✅ |
-| Multi-node management | ❌ | ✅ |
-| Custom logo & theme | ❌ | ✅ |
-| Priority support | ❌ | ✅ |
-
-**From $80/year.** [Compare plans & start 30-day free trial →](https://1panel.pro/pricing)
-
-## Star History
-
-[![Star History Chart](https://api.star-history.com/svg?repos=1Panel-dev/1Panel&type=Date)](https://star-history.com/#1Panel-dev/1Panel&Date)
+| Feature | OSS | Pro | Ent |
+|---------|:---:|:---:|:---:|
+| One-click app installs | ✅ | ✅ | ✅ |
+| AI agents (OpenClaw) | 5 agent | Unlimited | ✅ |
+| WAF & advanced security | Basic | ✅ | ✅ |
+| Website tamper protection | ❌ | ✅ | ✅ |
+| Website uptime monitoring | ❌ | ✅ | ✅ |
+| Multi-node management | ❌ | ✅ | ✅ |
+| Custom logo & theme | ❌ | ✅ | ✅ |
+| KVM Web UI | ❌ | ❌ | ✅ |
+| AI Gateway | ❌ | ❌ | ✅ |
+| Priority support | ❌ | ❌ | ✅ |
 
 ## Community & Support
 

agent/app/api/v2/agents.go

@@ -124,7 +124,7 @@ func (b *BaseApi) PageAgents(c *gin.Context) {
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	total, list, err := agentService.Page(req)
+	total, list, err := agentService.Page(req, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.BadRequest(c, err)
 		return
@@ -447,7 +447,7 @@ func (b *BaseApi) PageAgentAccounts(c *gin.Context) {
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	total, list, err := agentService.PageAccounts(req)
+	total, list, err := agentService.PageAccounts(req, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.BadRequest(c, err)
 		return
@@ -500,6 +500,27 @@ func (b *BaseApi) GetAgentAccountModels(c *gin.Context) {
 	helper.SuccessWithData(c, list)
 }
 
+// @Tags AI
+// @Summary Discover custom provider models
+// @Accept json
+// @Param request body dto.AgentAccountModelDiscoverReq true "request"
+// @Success 200 {array} dto.AgentAccountModel
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/accounts/models/discover [post]
+func (b *BaseApi) DiscoverAgentAccountModels(c *gin.Context) {
+	var req dto.AgentAccountModelDiscoverReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	list, err := agentService.DiscoverAccountModels(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, list)
+}
+
 // @Tags AI
 // @Summary Create model account model
 // @Accept json
@@ -1357,6 +1378,88 @@ func (b *BaseApi) UninstallAgentSkill(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags AI
+// @Summary List OpenClaw plugins
+// @Accept json
+// @Param request body dto.AgentPluginsReq true "request"
+// @Success 200 {array} dto.AgentPluginItem
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/plugins/list [post]
+func (b *BaseApi) ListAgentPlugins(c *gin.Context) {
+	var req dto.AgentPluginsReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := agentService.ListPlugins(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Search OpenClaw plugins
+// @Accept json
+// @Param request body dto.AgentPluginSearchReq true "request"
+// @Success 200 {array} dto.AgentPluginSearchItem
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/plugins/search [post]
+func (b *BaseApi) SearchAgentPlugins(c *gin.Context) {
+	var req dto.AgentPluginSearchReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := agentService.SearchPlugins(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Install an OpenClaw marketplace plugin
+// @Accept json
+// @Param request body dto.AgentPluginMarketInstallReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/plugins/install [post]
+func (b *BaseApi) InstallAgentMarketPlugin(c *gin.Context) {
+	var req dto.AgentPluginMarketInstallReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.InstallMarketPlugin(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Operate an OpenClaw plugin
+// @Accept json
+// @Param request body dto.AgentPluginOperateReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/plugins/operate [post]
+func (b *BaseApi) OperateAgentPlugin(c *gin.Context) {
+	var req dto.AgentPluginOperateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.OperatePlugin(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags AI
 // @Summary Login Agent Weixin channel
 // @Accept json

agent/app/api/v2/alert.go

@@ -268,7 +268,7 @@ func (b *BaseApi) PageAlertConfig(c *gin.Context) {
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	total, configs, err := alertService.PageAlertConfig(req)
+	total, configs, err := alertService.PageAlertConfig(req, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return

agent/app/api/v2/app.go

@@ -120,7 +120,7 @@ func (b *BaseApi) GetAppDetail(c *gin.Context) {
 	}
 	version := c.Param("version")
 	appType := c.Param("type")
-	appDetailDTO, err := appService.GetAppDetail(appID, version, appType)
+	appDetailDTO, err := appService.GetAppDetail(appID, version, appType, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return

agent/app/api/v2/app_ignore_upgrade.go

@@ -14,7 +14,7 @@ import (
 // @Security Timestamp
 // @Router /apps/ignored/detail [get]
 func (b *BaseApi) ListAppIgnored(c *gin.Context) {
-	res, err := appIgnoreUpgradeService.List()
+	res, err := appIgnoreUpgradeService.List(helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return

agent/app/api/v2/app_install.go

@@ -21,6 +21,7 @@ func (b *BaseApi) SearchAppInstalled(c *gin.Context) {
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
+	req.ReadOnly = helper.IsDemoRequest(c)
 	if req.All {
 		list, err := appInstallService.SearchForWebsite(req)
 		if err != nil {
@@ -73,6 +74,7 @@ func (b *BaseApi) CheckAppInstalled(c *gin.Context) {
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
+	req.ReadOnly = helper.IsDemoRequest(c)
 	checkData, err := appInstallService.CheckExist(req)
 	if err != nil {
 		helper.InternalServer(c, err)
@@ -115,7 +117,7 @@ func (b *BaseApi) LoadConnInfo(c *gin.Context) {
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	conn, err := appInstallService.LoadConnInfo(req)
+	conn, err := appInstallService.LoadConnInfo(req, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -137,7 +139,7 @@ func (b *BaseApi) DeleteCheck(c *gin.Context) {
 		helper.BadRequest(c, err)
 		return
 	}
-	checkData, err := appInstallService.DeleteCheck(appInstallId)
+	checkData, err := appInstallService.DeleteCheck(appInstallId, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -277,7 +279,7 @@ func (b *BaseApi) GetParams(c *gin.Context) {
 		helper.BadRequest(c, err)
 		return
 	}
-	content, err := appInstallService.GetParams(appInstallId)
+	content, err := appInstallService.GetParams(appInstallId, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -341,7 +343,7 @@ func (b *BaseApi) GetAppInstallInfo(c *gin.Context) {
 		helper.BadRequest(c, err)
 		return
 	}
-	info, err := appInstallService.GetAppInstallInfo(appInstallId)
+	info, err := appInstallService.GetAppInstallInfo(appInstallId, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return

agent/app/api/v2/backup.go

@@ -209,7 +209,7 @@ func (b *BaseApi) SearchBackup(c *gin.Context) {
 		return
 	}
 
-	total, list, err := backupService.SearchWithPage(req)
+	total, list, err := backupService.SearchWithPage(req, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -413,10 +413,15 @@ func (b *BaseApi) Backup(c *gin.Context) {
 
 	switch req.Type {
 	case "app":
-		if _, err := backupService.AppBackup(req); err != nil {
+		record, err := backupService.AppBackup(req)
+		if err != nil {
 			helper.InternalServer(c, err)
 			return
 		}
+		if req.IsImmediate {
+			helper.SuccessWithData(c, record)
+			return
+		}
 	case "mysql", "mariadb", constant.AppMysqlCluster:
 		if err := backupService.MysqlBackup(req); err != nil {
 			helper.InternalServer(c, err)

agent/app/api/v2/clam.go

@@ -106,7 +106,7 @@ func (b *BaseApi) SearchClam(c *gin.Context) {
 // @Security Timestamp
 // @Router /toolbox/clam/base [post]
 func (b *BaseApi) LoadClamBaseInfo(c *gin.Context) {
-	info, err := clamService.LoadBaseInfo()
+	info, err := clamService.LoadBaseInfo(helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return

agent/app/api/v2/compose_template.go

@@ -65,7 +65,7 @@ func (b *BaseApi) SearchComposeTemplate(c *gin.Context) {
 		return
 	}
 
-	total, list, err := composeTemplateService.SearchWithPage(req)
+	total, list, err := composeTemplateService.SearchWithPage(req, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -85,7 +85,7 @@ func (b *BaseApi) SearchComposeTemplate(c *gin.Context) {
 // @Security Timestamp
 // @Router /containers/template [get]
 func (b *BaseApi) ListComposeTemplate(c *gin.Context) {
-	list, err := composeTemplateService.List()
+	list, err := composeTemplateService.List(helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return

agent/app/api/v2/container.go

@@ -273,7 +273,7 @@ func (b *BaseApi) SearchCompose(c *gin.Context) {
 		return
 	}
 
-	total, list, err := containerService.PageCompose(req)
+	total, list, err := containerService.PageCompose(req, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -387,7 +387,7 @@ func (b *BaseApi) ContainerInfo(c *gin.Context) {
 		return
 	}
 
-	data, err := containerService.ContainerInfo(req)
+	data, err := containerService.ContainerInfo(req, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -881,6 +881,26 @@ func (b *BaseApi) ComposeUpdate(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags Container Compose
+// @Summary Pin compose
+// @Accept json
+// @Param request body dto.ComposePin true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /containers/compose/pin [post]
+func (b *BaseApi) ComposePin(c *gin.Context) {
+	var req dto.ComposePin
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := containerService.ComposePin(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags Container Compose
 // @Summary Load compose environment variables
 // @Accept json

agent/app/api/v2/cronjob.go

@@ -144,7 +144,7 @@ func (b *BaseApi) SearchCronjob(c *gin.Context) {
 		return
 	}
 
-	total, list, err := cronjobService.SearchWithPage(req)
+	total, list, err := cronjobService.SearchWithPage(req, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return

agent/app/api/v2/database.go

@@ -78,7 +78,7 @@ func (b *BaseApi) SearchDatabase(c *gin.Context) {
 		return
 	}
 
-	total, list, err := databaseService.SearchWithPage(req)
+	total, list, err := databaseService.SearchWithPage(req, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -147,7 +147,7 @@ func (b *BaseApi) GetDatabase(c *gin.Context) {
 		helper.BadRequest(c, err)
 		return
 	}
-	data, err := databaseService.Get(name)
+	data, err := databaseService.Get(name, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return

agent/app/api/v2/database_mongodb.go

@@ -54,7 +54,7 @@ func (b *BaseApi) SearchMongodb(c *gin.Context) {
 		return
 	}
 
-	total, list, err := mongodbService.SearchWithPage(req)
+	total, list, err := mongodbService.SearchWithPage(req, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return

agent/app/api/v2/database_mysql.go

@@ -41,20 +41,40 @@ func (b *BaseApi) CreateMysql(c *gin.Context) {
 }
 
 // @Tags Database Mysql
-// @Summary Bind user of mysql database
+// @Summary List mysql users
 // @Accept json
-// @Param request body dto.BindUser true "request"
-// @Success 200
+// @Param request body dto.MysqlUserSearch true "request"
+// @Success 200 {array} dto.MysqlUser
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /databases/bind [post]
-// @x-panel-log {"bodyKeys":["database", "username"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"绑定 mysql 数据库名 [database] [username]","formatEN":"bind mysql database [database] [username]"}
-func (b *BaseApi) BindUser(c *gin.Context) {
-	var req dto.BindUser
+// @Router /databases/users/search [post]
+func (b *BaseApi) ListMysqlUsers(c *gin.Context) {
+	var req dto.MysqlUserSearch
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
+	data, err := mysqlService.ListUsers(req, helper.IsDemoRequest(c))
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
 
+// @Tags Database Mysql
+// @Summary Create mysql user
+// @Accept json
+// @Param request body dto.MysqlUserCreate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/users [post]
+// @x-panel-log {"bodyKeys":["database","username","host"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"创建 mysql 数据库 [database] 用户 [username]@[host]","formatEN":"create mysql database [database] user [username]@[host]"}
+func (b *BaseApi) CreateMysqlUser(c *gin.Context) {
+	var req dto.MysqlUserCreate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
 	if len(req.Password) != 0 {
 		password, err := base64.StdEncoding.DecodeString(req.Password)
 		if err != nil {
@@ -63,8 +83,191 @@ func (b *BaseApi) BindUser(c *gin.Context) {
 		}
 		req.Password = string(password)
 	}
+	if err := mysqlService.CreateUser(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
 
-	if err := mysqlService.BindUser(req); err != nil {
+// @Tags Database Mysql
+// @Summary Delete mysql user
+// @Accept json
+// @Param request body dto.MysqlUserDelete true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/users/del [post]
+// @x-panel-log {"bodyKeys":["database","username","host"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"删除 mysql 数据库 [database] 用户 [username]@[host]","formatEN":"delete mysql database [database] user [username]@[host]"}
+func (b *BaseApi) DeleteMysqlUser(c *gin.Context) {
+	var req dto.MysqlUserDelete
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := mysqlService.DeleteUser(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Database Mysql
+// @Summary Update mysql user
+// @Accept json
+// @Param request body dto.MysqlUserUpdate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/users/update [post]
+// @x-panel-log {"bodyKeys":["database","username","host","newHost","description"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新 mysql 数据库 [database] 用户 [username] 访问权限 [host] => [newHost] 描述 [description]","formatEN":"update mysql database [database] user [username] access [host] => [newHost] description [description]"}
+func (b *BaseApi) UpdateMysqlUser(c *gin.Context) {
+	var req dto.MysqlUserUpdate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := mysqlService.UpdateUser(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Database Mysql
+// @Summary Change mysql user password
+// @Accept json
+// @Param request body dto.MysqlUserPassword true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/users/password [post]
+// @x-panel-log {"bodyKeys":["database","username","host"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新 mysql 数据库 [database] 用户 [username]@[host] 密码","formatEN":"update mysql database [database] user [username]@[host] password"}
+func (b *BaseApi) ChangeMysqlUserPassword(c *gin.Context) {
+	var req dto.MysqlUserPassword
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if len(req.Password) != 0 {
+		password, err := base64.StdEncoding.DecodeString(req.Password)
+		if err != nil {
+			helper.BadRequest(c, err)
+			return
+		}
+		req.Password = string(password)
+	}
+	if err := mysqlService.ChangeUserPassword(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Database Mysql
+// @Summary Save mysql user password locally
+// @Accept json
+// @Param request body dto.MysqlUserPassword true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/users/password/save [post]
+// @x-panel-log {"bodyKeys":["database","username","host"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"补充 mysql 数据库 [database] 用户 [username]@[host] 密码","formatEN":"save mysql database [database] user [username]@[host] password locally"}
+func (b *BaseApi) SaveMysqlUserPassword(c *gin.Context) {
+	var req dto.MysqlUserPassword
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if len(req.Password) != 0 {
+		password, err := base64.StdEncoding.DecodeString(req.Password)
+		if err != nil {
+			helper.BadRequest(c, err)
+			return
+		}
+		req.Password = string(password)
+	}
+	if err := mysqlService.SaveUserPassword(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Database Mysql
+// @Summary List mysql grants
+// @Accept json
+// @Param request body dto.MysqlUserSearch true "request"
+// @Success 200 {array} dto.MysqlGrant
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/grants/search [post]
+func (b *BaseApi) ListMysqlGrants(c *gin.Context) {
+	var req dto.MysqlUserSearch
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := mysqlService.ListGrants(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags Database Mysql
+// @Summary List mysql grant summary
+// @Accept json
+// @Param request body dto.MysqlGrantSummarySearch true "request"
+// @Success 200 {object} map[string][]dto.MysqlUser
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/grants/summary [post]
+func (b *BaseApi) ListMysqlGrantSummary(c *gin.Context) {
+	var req dto.MysqlGrantSummarySearch
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := mysqlService.ListGrantSummary(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags Database Mysql
+// @Summary Grant mysql user
+// @Accept json
+// @Param request body dto.MysqlGrantCreate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/grants [post]
+// @x-panel-log {"bodyKeys":["database","db","username","host"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"授权 mysql 数据库 [database] 用户 [username]@[host] 访问 [db]","formatEN":"grant mysql database [database] user [username]@[host] access to [db]"}
+func (b *BaseApi) GrantMysqlUser(c *gin.Context) {
+	var req dto.MysqlGrantCreate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := mysqlService.GrantUser(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Database Mysql
+// @Summary Revoke mysql grant
+// @Accept json
+// @Param request body dto.MysqlGrantDelete true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/grants/del [post]
+// @x-panel-log {"bodyKeys":["database","db","username","host"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"取消 mysql 数据库 [database] 用户 [username]@[host] 对 [db] 的授权","formatEN":"revoke mysql database [database] user [username]@[host] access to [db]"}
+func (b *BaseApi) RevokeMysqlGrant(c *gin.Context) {
+	var req dto.MysqlGrantDelete
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := mysqlService.RevokeGrant(req); err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
@@ -94,14 +297,14 @@ func (b *BaseApi) UpdateMysqlDescription(c *gin.Context) {
 }
 
 // @Tags Database Mysql
-// @Summary Change mysql password
+// @Summary Change mysql root password
 // @Accept json
 // @Param request body dto.ChangeDBInfo true "request"
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /databases/change/password [post]
-// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"id","isList":false,"db":"database_mysqls","output_column":"name","output_value":"name"}],"formatZH":"更新数据库 [name] 密码","formatEN":"Update database [name] password"}
+// @x-panel-log {"bodyKeys":["database"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新数据库 [database] root 密码","formatEN":"Update database [database] root password"}
 func (b *BaseApi) ChangeMysqlPassword(c *gin.Context) {
 	var req dto.ChangeDBInfo
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -125,14 +328,14 @@ func (b *BaseApi) ChangeMysqlPassword(c *gin.Context) {
 }
 
 // @Tags Database Mysql
-// @Summary Change mysql access
+// @Summary Change mysql root access
 // @Accept json
 // @Param request body dto.ChangeDBInfo true "request"
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /databases/change/access [post]
-// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"id","isList":false,"db":"database_mysqls","output_column":"name","output_value":"name"}],"formatZH":"更新数据库 [name] 访问权限","formatEN":"Update database [name] access"}
+// @x-panel-log {"bodyKeys":["database"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新数据库 [database] root 访问权限","formatEN":"Update database [database] root access"}
 func (b *BaseApi) ChangeMysqlAccess(c *gin.Context) {
 	var req dto.ChangeDBInfo
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {

agent/app/api/v2/database_postgresql.go

@@ -151,7 +151,7 @@ func (b *BaseApi) SearchPostgresql(c *gin.Context) {
 		return
 	}
 
-	total, list, err := postgresqlService.SearchWithPage(req)
+	total, list, err := postgresqlService.SearchWithPage(req, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return

agent/app/api/v2/entry.go

@@ -37,14 +37,16 @@ var (
 
 	cronjobService = service.NewICronjobService()
 
-	fileService        = service.NewIFileService()
-	fileHistoryService = service.NewIFileHistoryService()
-	fileShareService   = service.NewIFileShareService()
-	sshService         = service.NewISSHService()
-	firewallService    = service.NewIFirewallService()
-	iptablesService    = service.NewIIptablesService()
-	monitorService     = service.NewIMonitorService()
-	systemService      = service.NewISystemService()
+	fileService               = service.NewIFileService()
+	fileHistoryService        = service.NewIFileHistoryService()
+	fileShareService          = service.NewIFileShareService()
+	sshService                = service.NewISSHService()
+	firewallService           = service.NewIFirewallService()
+	forwardingService         = service.NewIForwardingService()
+	iptablesService           = service.NewIIptablesService()
+	monitorService            = service.NewIMonitorService()
+	systemService             = service.NewISystemService()
+	runtimeDiagnosticsService = service.NewIRuntimeDiagnosticsService()
 
 	deviceService   = service.NewIDeviceService()
 	fail2banService = service.NewIFail2BanService()
@@ -59,6 +61,7 @@ var (
 	websiteDnsAccountService  = service.NewIWebsiteDnsAccountService()
 	websiteSSLService         = service.NewIWebsiteSSLService()
 	websiteAcmeAccountService = service.NewIWebsiteAcmeAccountService()
+	websiteTemplateService    = service.NewIWebsiteTemplateService()
 
 	nginxService = service.NewINginxService()
 

agent/app/api/v2/file.go

@@ -12,7 +12,9 @@ import (
 	"path/filepath"
 	"strconv"
 	"strings"
+	"sync"
 	"syscall"
+	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
@@ -28,6 +30,86 @@ import (
 	qrcode "github.com/skip2/go-qrcode"
 )
 
+var cancelledChunkUploads = struct {
+	sync.RWMutex
+	ids map[string]struct{}
+}{ids: make(map[string]struct{})}
+
+type chunkUploadLock struct {
+	mutex sync.Mutex
+	refs  int
+}
+
+var chunkUploadLocks = struct {
+	sync.Mutex
+	items map[string]*chunkUploadLock
+}{items: make(map[string]*chunkUploadLock)}
+
+type completedChunkUpload struct {
+	dstDir   string
+	filename string
+	fileSize int64
+}
+
+var completedChunkUploads = struct {
+	sync.RWMutex
+	items map[string]completedChunkUpload
+}{items: make(map[string]completedChunkUpload)}
+
+var activeChunkUploadTTL = 24 * time.Hour
+
+var (
+	errChunkUploadCancelled = errors.New("upload cancelled")
+	errInvalidChunkUpload   = errors.New("invalid chunk upload")
+)
+
+type activeChunkUpload struct {
+	upload    completedChunkUpload
+	expiresAt time.Time
+	timer     *time.Timer
+}
+
+var activeChunkUploads = struct {
+	sync.RWMutex
+	items map[string]activeChunkUpload
+}{items: make(map[string]activeChunkUpload)}
+
+type resumableUploadChunk struct {
+	UploadID   string
+	Filename   string
+	DstDir     string
+	ChunkIndex int
+	ChunkCount int
+	Offset     int64
+	FileSize   int64
+	Overwrite  bool
+}
+
+func invalidChunkUploadError(message string) error {
+	return fmt.Errorf("%w: %s", errInvalidChunkUpload, message)
+}
+
+func isRetryableChunkUploadError(err error) bool {
+	if err == nil {
+		return false
+	}
+	if errors.Is(err, errChunkUploadCancelled) ||
+		errors.Is(err, errInvalidChunkUpload) ||
+		errors.Is(err, os.ErrExist) ||
+		errors.Is(err, os.ErrPermission) ||
+		errors.Is(err, os.ErrInvalid) ||
+		errors.Is(err, syscall.ENOSPC) ||
+		errors.Is(err, syscall.EDQUOT) ||
+		errors.Is(err, syscall.EROFS) ||
+		errors.Is(err, syscall.EFBIG) ||
+		errors.Is(err, syscall.ENAMETOOLONG) ||
+		errors.Is(err, syscall.ENOTDIR) ||
+		errors.Is(err, syscall.EISDIR) {
+		return false
+	}
+	return true
+}
+
 // @Tags File
 // @Summary List files
 // @Accept json
@@ -66,7 +148,7 @@ func (b *BaseApi) FileAISearch(c *gin.Context) {
 	if strings.TrimSpace(req.ResponseLanguage) == "" {
 		req.ResponseLanguage = strings.TrimSpace(c.GetHeader("Accept-Language"))
 	}
-	res, err := fileService.AISearch(req)
+	res, err := fileService.AISearch(req, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -467,11 +549,7 @@ func (b *BaseApi) UploadFiles(c *gin.Context) {
 			continue
 		}
 		dstInfo, statErr := os.Stat(dstFilename)
-		if overwrite {
-			_ = os.Remove(dstFilename)
-		}
-
-		err = os.Rename(tmpFilename, dstFilename)
+		err = finalizeUploadedFile(tmpFilename, dstFilename, overwrite)
 		if err != nil {
 			_ = os.Remove(tmpFilename)
 			e := fmt.Errorf("upload [%s] file failed, err: %v", file.Filename, err)
@@ -631,6 +709,26 @@ func (b *BaseApi) MoveFile(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags File
+// @Summary Stop file move task
+// @Accept json
+// @Param request body request.FileMoveStopReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/move/stop [post]
+func (b *BaseApi) StopMoveFile(c *gin.Context) {
+	var req request.FileMoveStopReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := fileService.StopMvFile(req.TaskID); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags File
 // @Summary Download file
 // @Accept json
@@ -785,6 +883,289 @@ func (b *BaseApi) DepthDirSize(c *gin.Context) {
 	helper.SuccessWithData(c, res)
 }
 
+func lockChunkUpload(uploadID string) func() {
+	chunkUploadLocks.Lock()
+	lock, ok := chunkUploadLocks.items[uploadID]
+	if !ok {
+		lock = &chunkUploadLock{}
+		chunkUploadLocks.items[uploadID] = lock
+	}
+	lock.refs++
+	chunkUploadLocks.Unlock()
+
+	lock.mutex.Lock()
+	return func() {
+		lock.mutex.Unlock()
+		chunkUploadLocks.Lock()
+		lock.refs--
+		if lock.refs == 0 {
+			delete(chunkUploadLocks.items, uploadID)
+		}
+		chunkUploadLocks.Unlock()
+	}
+}
+
+func resumableUploadPartPath(dstDir, uploadID string) string {
+	return filepath.Join(dstDir, fmt.Sprintf(".1panel-upload-%s.part", uploadID))
+}
+
+func finalizeUploadedFile(tmpFile, dstFile string, overwrite bool) error {
+	if overwrite {
+		return os.Rename(tmpFile, dstFile)
+	}
+	if err := os.Link(tmpFile, dstFile); err != nil {
+		return err
+	}
+	if err := os.Remove(tmpFile); err != nil {
+		if rollbackErr := os.Remove(dstFile); rollbackErr != nil {
+			return fmt.Errorf("remove upload temporary file failed: %v, rollback destination failed: %w", err, rollbackErr)
+		}
+		return err
+	}
+	return nil
+}
+
+func registerActiveChunkUpload(uploadID string, upload completedChunkUpload) error {
+	activeChunkUploads.Lock()
+	defer activeChunkUploads.Unlock()
+	if active, ok := activeChunkUploads.items[uploadID]; ok {
+		if active.upload != upload {
+			return invalidChunkUploadError("upload ID is already used by another file")
+		}
+		active.timer.Stop()
+	}
+	expiresAt := time.Now().Add(activeChunkUploadTTL)
+	timer := time.AfterFunc(activeChunkUploadTTL, func() {
+		expireActiveChunkUpload(uploadID, expiresAt)
+	})
+	activeChunkUploads.items[uploadID] = activeChunkUpload{
+		upload:    upload,
+		expiresAt: expiresAt,
+		timer:     timer,
+	}
+	return nil
+}
+
+func loadActiveChunkUpload(uploadID string) (completedChunkUpload, bool) {
+	activeChunkUploads.RLock()
+	active, ok := activeChunkUploads.items[uploadID]
+	activeChunkUploads.RUnlock()
+	return active.upload, ok
+}
+
+func deleteActiveChunkUpload(uploadID string) {
+	activeChunkUploads.Lock()
+	if active, ok := activeChunkUploads.items[uploadID]; ok {
+		active.timer.Stop()
+	}
+	delete(activeChunkUploads.items, uploadID)
+	activeChunkUploads.Unlock()
+}
+
+func discardActiveChunkUpload(uploadID, partFile string) error {
+	deleteActiveChunkUpload(uploadID)
+	if err := os.Remove(partFile); err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("remove upload temporary file failed: %w", err)
+	}
+	return nil
+}
+
+func finalizeActiveChunkUpload(uploadID, partFile, dstFile string, overwrite bool) error {
+	if err := finalizeUploadedFile(partFile, dstFile, overwrite); err != nil {
+		if removeErr := discardActiveChunkUpload(uploadID, partFile); removeErr != nil {
+			return errors.Join(err, removeErr)
+		}
+		return err
+	}
+	return nil
+}
+
+func expireActiveChunkUpload(uploadID string, expiresAt time.Time) {
+	unlock := lockChunkUpload(uploadID)
+	defer unlock()
+	activeChunkUploads.Lock()
+	active, ok := activeChunkUploads.items[uploadID]
+	if !ok || !active.expiresAt.Equal(expiresAt) {
+		activeChunkUploads.Unlock()
+		return
+	}
+	delete(activeChunkUploads.items, uploadID)
+	activeChunkUploads.Unlock()
+	partFile := resumableUploadPartPath(active.upload.dstDir, uploadID)
+	if err := os.Remove(partFile); err != nil && !os.IsNotExist(err) {
+		global.LOG.Warnf("remove inactive upload part [%s] failed: %v", partFile, err)
+	}
+}
+
+func removeActiveResumableUploadPart(uploadID string) error {
+	unlock := lockChunkUpload(uploadID)
+	defer unlock()
+	upload, ok := loadActiveChunkUpload(uploadID)
+	if !ok {
+		return nil
+	}
+	err := os.Remove(resumableUploadPartPath(upload.dstDir, uploadID))
+	if err == nil || os.IsNotExist(err) {
+		deleteActiveChunkUpload(uploadID)
+		return nil
+	}
+	return err
+}
+
+func loadCompletedChunkUpload(uploadID string) (completedChunkUpload, bool) {
+	completedChunkUploads.RLock()
+	completed, ok := completedChunkUploads.items[uploadID]
+	completedChunkUploads.RUnlock()
+	return completed, ok
+}
+
+func markChunkUploadCompleted(uploadID string, completed completedChunkUpload) {
+	completedChunkUploads.Lock()
+	completedChunkUploads.items[uploadID] = completed
+	completedChunkUploads.Unlock()
+	time.AfterFunc(10*time.Minute, func() {
+		completedChunkUploads.Lock()
+		delete(completedChunkUploads.items, uploadID)
+		completedChunkUploads.Unlock()
+	})
+}
+
+func writeResumableUploadChunk(chunk resumableUploadChunk, chunkData []byte) error {
+	unlock := lockChunkUpload(chunk.UploadID)
+	defer unlock()
+	if chunkUploadCancelled(chunk.UploadID) {
+		return errChunkUploadCancelled
+	}
+	if chunk.UploadID == "" || filepath.Base(chunk.UploadID) != chunk.UploadID || strings.ContainsAny(chunk.UploadID, `/\`) {
+		return invalidChunkUploadError("invalid upload ID")
+	}
+	if chunk.Filename == "" || filepath.Base(chunk.Filename) != chunk.Filename || strings.ContainsAny(chunk.Filename, `/\`) {
+		return invalidChunkUploadError("invalid filename")
+	}
+	if strings.TrimSpace(chunk.DstDir) == "" {
+		return invalidChunkUploadError("upload destination is required")
+	}
+	dstDir := filepath.Clean(strings.TrimSpace(chunk.DstDir))
+
+	if chunk.ChunkCount <= 0 || chunk.ChunkIndex < 0 || chunk.ChunkIndex >= chunk.ChunkCount {
+		return invalidChunkUploadError("invalid chunk index")
+	}
+	if chunk.FileSize <= 0 || chunk.Offset < 0 || chunk.Offset > chunk.FileSize {
+		return invalidChunkUploadError("invalid upload offset")
+	}
+	chunkEnd := chunk.Offset + int64(len(chunkData))
+	if chunkEnd > chunk.FileSize {
+		return invalidChunkUploadError("chunk exceeds file size")
+	}
+	if chunk.ChunkIndex+1 == chunk.ChunkCount {
+		if chunkEnd != chunk.FileSize {
+			return invalidChunkUploadError("final chunk does not match file size")
+		}
+	} else if chunkEnd >= chunk.FileSize {
+		return invalidChunkUploadError("non-final chunk reaches file size")
+	}
+	if completed, ok := loadCompletedChunkUpload(chunk.UploadID); ok {
+		if completed.dstDir == dstDir && completed.filename == chunk.Filename && completed.fileSize == chunk.FileSize {
+			return nil
+		}
+		return invalidChunkUploadError("upload ID has already completed another file")
+	}
+	upload := completedChunkUpload{dstDir: dstDir, filename: chunk.Filename, fileSize: chunk.FileSize}
+	if err := registerActiveChunkUpload(chunk.UploadID, upload); err != nil {
+		return err
+	}
+
+	mode, err := files.GetParentMode(dstDir)
+	if err != nil {
+		return err
+	}
+	if err = os.MkdirAll(dstDir, mode); err != nil {
+		return err
+	}
+	dstDirInfo, err := os.Stat(dstDir)
+	if err != nil {
+		return err
+	}
+	if !dstDirInfo.IsDir() {
+		return invalidChunkUploadError(fmt.Sprintf("upload destination [%s] is not a directory", dstDir))
+	}
+
+	dstFile := filepath.Join(dstDir, chunk.Filename)
+	partFile := resumableUploadPartPath(dstDir, chunk.UploadID)
+	if dstFile == partFile {
+		return invalidChunkUploadError("filename conflicts with upload temporary file")
+	}
+	fileMode := dstDirInfo.Mode().Perm()
+	ownerInfo := dstDirInfo
+	if dstInfo, statErr := os.Stat(dstFile); statErr == nil {
+		if !chunk.Overwrite {
+			if err := discardActiveChunkUpload(chunk.UploadID, partFile); err != nil {
+				return errors.Join(os.ErrExist, err)
+			}
+			return os.ErrExist
+		}
+		fileMode = dstInfo.Mode().Perm()
+		ownerInfo = dstInfo
+	} else if !os.IsNotExist(statErr) {
+		return statErr
+	}
+
+	part, err := os.OpenFile(partFile, os.O_CREATE|os.O_RDWR, fileMode)
+	if err != nil {
+		return err
+	}
+	partClosed := false
+	defer func() {
+		if !partClosed {
+			_ = part.Close()
+		}
+	}()
+	if stat, statErr := part.Stat(); statErr != nil {
+		return statErr
+	} else if chunk.Offset > stat.Size() {
+		return invalidChunkUploadError(fmt.Sprintf("unexpected upload offset %d, current size is %d", chunk.Offset, stat.Size()))
+	} else if chunk.Offset < stat.Size() && chunkEnd > stat.Size() {
+		if err = part.Truncate(chunk.Offset); err != nil {
+			return err
+		}
+	}
+	if _, err = part.WriteAt(chunkData, chunk.Offset); err != nil {
+		return err
+	}
+
+	if chunk.ChunkIndex+1 != chunk.ChunkCount {
+		return nil
+	}
+	partInfo, err := part.Stat()
+	if err != nil {
+		return err
+	}
+	if partInfo.Size() != chunk.FileSize {
+		return invalidChunkUploadError(fmt.Sprintf("uploaded file size mismatch: expected %d, got %d", chunk.FileSize, partInfo.Size()))
+	}
+	if err = part.Close(); err != nil {
+		return err
+	}
+	partClosed = true
+	if err = os.Chmod(partFile, fileMode); err != nil {
+		return err
+	}
+	if stat, ok := ownerInfo.Sys().(*syscall.Stat_t); ok {
+		if err = os.Chown(partFile, int(stat.Uid), int(stat.Gid)); err != nil {
+			return err
+		}
+	}
+	if chunkUploadCancelled(chunk.UploadID) {
+		return errChunkUploadCancelled
+	}
+	if err = finalizeActiveChunkUpload(chunk.UploadID, partFile, dstFile, chunk.Overwrite); err != nil {
+		return err
+	}
+	markChunkUploadCompleted(chunk.UploadID, upload)
+	deleteActiveChunkUpload(chunk.UploadID)
+	return nil
+}
+
 func mergeChunks(fileName string, fileDir string, dstDir string, chunkCount int, overwrite bool) error {
 	defer func() {
 		_ = os.RemoveAll(fileDir)
@@ -864,6 +1245,10 @@ func (b *BaseApi) UploadChunkFiles(c *gin.Context) {
 		helper.BadRequest(c, err)
 		return
 	}
+	if chunkCount <= 0 || chunkIndex < 0 || chunkIndex >= chunkCount {
+		helper.BadRequest(c, errors.New("invalid chunk index"))
+		return
+	}
 	fileOp := files.NewFileOp()
 	tmpDir := path.Join(global.Dir.TmpDir, "upload")
 	if !fileOp.Stat(tmpDir) {
@@ -873,8 +1258,30 @@ func (b *BaseApi) UploadChunkFiles(c *gin.Context) {
 		}
 	}
 	filename := c.PostForm("filename")
-	fileDir := filepath.Join(tmpDir, filename)
-	if chunkIndex == 0 {
+	if filename == "" || filepath.Base(filename) != filename || strings.ContainsAny(filename, `/\\`) {
+		helper.BadRequest(c, errors.New("invalid filename"))
+		return
+	}
+	uploadID := strings.TrimSpace(c.PostForm("uploadID"))
+	resumable := c.PostForm("fileSize") != "" || c.PostForm("offset") != ""
+	cancellable := uploadID != ""
+	if cancellable && (filepath.Base(uploadID) != uploadID || strings.ContainsAny(uploadID, `/\\`)) {
+		helper.BadRequest(c, errors.New("invalid upload ID"))
+		return
+	}
+	if resumable && !cancellable {
+		helper.BadRequest(c, errors.New("upload ID is required"))
+		return
+	}
+	if !cancellable {
+		uploadID = filename
+	}
+	fileDir := filepath.Join(tmpDir, uploadID)
+	if cancellable && chunkUploadCancelled(uploadID) {
+		helper.BadRequest(c, errChunkUploadCancelled)
+		return
+	}
+	if !resumable && chunkIndex == 0 {
 		if fileOp.Stat(fileDir) {
 			_ = fileOp.DeleteDir(fileDir)
 		}
@@ -883,28 +1290,68 @@ func (b *BaseApi) UploadChunkFiles(c *gin.Context) {
 	filePath := filepath.Join(fileDir, filename)
 
 	defer func() {
-		if err != nil {
-			_ = os.Remove(fileDir)
+		if !resumable && err != nil {
+			_ = os.RemoveAll(fileDir)
 		}
 	}()
-	var (
-		emptyFile *os.File
-		chunkData []byte
-	)
+	chunkData, err := io.ReadAll(uploadFile)
+	if err != nil {
+		helper.InternalServer(c, buserr.WithMap("ErrFileUpload", map[string]interface{}{"name": filename, "detail": err.Error()}, err))
+		return
+	}
+	if cancellable && chunkUploadCancelled(uploadID) {
+		err = errChunkUploadCancelled
+		helper.BadRequest(c, err)
+		return
+	}
+	if resumable {
+		offset, parseErr := strconv.ParseInt(c.PostForm("offset"), 10, 64)
+		if parseErr != nil {
+			helper.BadRequest(c, parseErr)
+			return
+		}
+		fileSize, parseErr := strconv.ParseInt(c.PostForm("fileSize"), 10, 64)
+		if parseErr != nil {
+			helper.BadRequest(c, parseErr)
+			return
+		}
+		overwrite := true
+		if ow := c.PostForm("overwrite"); ow != "" {
+			overwrite, _ = strconv.ParseBool(ow)
+		}
+		err = writeResumableUploadChunk(resumableUploadChunk{
+			UploadID:   uploadID,
+			Filename:   filename,
+			DstDir:     c.PostForm("path"),
+			ChunkIndex: chunkIndex,
+			ChunkCount: chunkCount,
+			Offset:     offset,
+			FileSize:   fileSize,
+			Overwrite:  overwrite,
+		}, chunkData)
+		if err != nil {
+			uploadErr := buserr.WithMap("ErrFileUpload", map[string]interface{}{"name": filename, "detail": err.Error()}, err)
+			helper.ErrorWithDetailAndData(c, http.StatusInternalServerError, "ErrInternalServer", uploadErr, gin.H{
+				"retryable": isRetryableChunkUploadError(err),
+			})
+			return
+		}
+		if chunkIndex+1 == chunkCount {
+			cancelledChunkUploads.Lock()
+			delete(cancelledChunkUploads.ids, uploadID)
+			cancelledChunkUploads.Unlock()
+		}
+		helper.SuccessWithData(c, true)
+		return
+	}
 
-	emptyFile, err = os.Create(filePath)
+	emptyFile, err := os.Create(filePath)
 	if err != nil {
 		helper.BadRequest(c, err)
 		return
 	}
 	defer emptyFile.Close()
 
-	chunkData, err = io.ReadAll(uploadFile)
-	if err != nil {
-		helper.InternalServer(c, buserr.WithMap("ErrFileUpload", map[string]interface{}{"name": filename, "detail": err.Error()}, err))
-		return
-	}
-
 	chunkPath := filepath.Join(fileDir, fmt.Sprintf("%s.%d", filename, chunkIndex))
 	err = os.WriteFile(chunkPath, chunkData, constant.DirPerm)
 	if err != nil {
@@ -922,12 +1369,54 @@ func (b *BaseApi) UploadChunkFiles(c *gin.Context) {
 			helper.InternalServer(c, buserr.WithMap("ErrFileUpload", map[string]interface{}{"name": filename, "detail": err.Error()}, err))
 			return
 		}
+		if cancellable {
+			cancelledChunkUploads.Lock()
+			delete(cancelledChunkUploads.ids, uploadID)
+			cancelledChunkUploads.Unlock()
+		}
 		helper.SuccessWithData(c, true)
 	} else {
 		return
 	}
 }
 
+// StopChunkUpload removes temporary chunks left by a cancelled upload.
+func (b *BaseApi) StopChunkUpload(c *gin.Context) {
+	var req request.FileProcessReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	uploadID := strings.TrimSpace(req.Key)
+	if uploadID == "" || filepath.Base(uploadID) != uploadID || strings.ContainsAny(uploadID, `/\\`) {
+		helper.BadRequest(c, errors.New("invalid upload ID"))
+		return
+	}
+	cancelledChunkUploads.Lock()
+	cancelledChunkUploads.ids[uploadID] = struct{}{}
+	cancelledChunkUploads.Unlock()
+	time.AfterFunc(10*time.Minute, func() {
+		cancelledChunkUploads.Lock()
+		delete(cancelledChunkUploads.ids, uploadID)
+		cancelledChunkUploads.Unlock()
+	})
+	if err := os.RemoveAll(filepath.Join(global.Dir.TmpDir, "upload", uploadID)); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	if err := removeActiveResumableUploadPart(uploadID); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+func chunkUploadCancelled(uploadID string) bool {
+	cancelledChunkUploads.RLock()
+	_, ok := cancelledChunkUploads.ids[uploadID]
+	cancelledChunkUploads.RUnlock()
+	return ok
+}
+
 var wsUpgrade = websocket.Upgrader{
 	CheckOrigin: func(r *http.Request) bool {
 		return true
@@ -1144,7 +1633,7 @@ func (b *BaseApi) SearchFileShare(c *gin.Context) {
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	total, list, err := fileShareService.Page(req)
+	total, list, err := fileShareService.Page(req, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -1168,7 +1657,7 @@ func (b *BaseApi) GetFileShareDetail(c *gin.Context) {
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	info, err := fileShareService.GetByPath(req.Path)
+	info, err := fileShareService.GetByPath(req.Path, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -1187,7 +1676,7 @@ func (b *BaseApi) GetPublicFileShareInfo(c *gin.Context) {
 		helper.BadRequest(c, errors.New("code is required"))
 		return
 	}
-	info, err := fileShareService.GetPublicByCode(code)
+	info, err := fileShareService.GetPublicByCode(code, helper.IsDemoRequest(c))
 	if err != nil {
 		if be, ok := err.(buserr.BusinessError); ok {
 			helper.ErrorWithDetail(c, http.StatusBadRequest, be.Msg, be)
@@ -1240,7 +1729,7 @@ func (b *BaseApi) GetFileShareQRCode(c *gin.Context) {
 		helper.BadRequest(c, errors.New("code is required"))
 		return
 	}
-	if _, err := fileShareService.GetByCode(code); err != nil {
+	if _, err := fileShareService.GetByCode(code, helper.IsDemoRequest(c)); err != nil {
 		if be, ok := err.(buserr.BusinessError); ok {
 			helper.ErrorWithDetail(c, http.StatusBadRequest, be.Msg, be)
 			return
@@ -1322,7 +1811,7 @@ func (b *BaseApi) CheckFileShare(c *gin.Context) {
 		helper.BadRequest(c, errors.New("code is required"))
 		return
 	}
-	if err := fileShareService.Check(code, password); err != nil {
+	if err := fileShareService.Check(code, password, helper.IsDemoRequest(c)); err != nil {
 		if be, ok := err.(buserr.BusinessError); ok {
 			helper.ErrorWithDetail(c, http.StatusBadRequest, be.Msg, be)
 			return
@@ -1347,7 +1836,7 @@ func (b *BaseApi) DownloadFileShare(c *gin.Context) {
 		helper.BadRequest(c, errors.New("code is required"))
 		return
 	}
-	filePath, displayName, err := fileShareService.PrepareDownload(code, password)
+	filePath, displayName, err := fileShareService.PrepareDownload(code, password, helper.IsDemoRequest(c))
 	if err != nil {
 		if be, ok := err.(buserr.BusinessError); ok {
 			helper.ErrorWithDetail(c, http.StatusBadRequest, be.Msg, be)

agent/app/api/v2/firewall.go

@@ -20,7 +20,15 @@ func (b *BaseApi) LoadFirewallBaseInfo(c *gin.Context) {
 		return
 	}
 
-	data, err := firewallService.LoadBaseInfo(req.Name)
+	var (
+		data dto.FirewallBaseInfo
+		err  error
+	)
+	if req.Name == "forward" {
+		data, err = forwardingService.LoadBaseInfo()
+	} else {
+		data, err = firewallService.LoadBaseInfo(req.Name)
+	}
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -43,7 +51,21 @@ func (b *BaseApi) SearchFirewallRule(c *gin.Context) {
 		return
 	}
 
-	total, list, err := firewallService.SearchWithPage(req)
+	var (
+		total int64
+		list  interface{}
+		err   error
+	)
+	if req.Type == "forward" {
+		total, list, err = forwardingService.SearchWithPage(dto.ForwardRuleSearch{
+			PageInfo: req.PageInfo,
+			Info:     req.Info,
+			Status:   req.Status,
+			Strategy: req.Strategy,
+		})
+	} else {
+		total, list, err = firewallService.SearchWithPage(req)
+	}
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -116,7 +138,7 @@ func (b *BaseApi) OperateForwardRule(c *gin.Context) {
 		return
 	}
 
-	if err := firewallService.OperateForwardRule(req); err != nil {
+	if err := forwardingService.Operate(req); err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
@@ -313,7 +335,13 @@ func (b *BaseApi) OperateFilterChain(c *gin.Context) {
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	if err := iptablesService.Operate(req); err != nil {
+	var err error
+	if req.Operate == "init-forward" {
+		err = forwardingService.Enable()
+	} else {
+		err = iptablesService.Operate(req)
+	}
+	if err != nil {
 		helper.InternalServer(c, err)
 		return
 	}

agent/app/api/v2/ftp.go

@@ -87,7 +87,7 @@ func (b *BaseApi) SearchFtp(c *gin.Context) {
 		return
 	}
 
-	total, list, err := ftpService.SearchWithPage(req)
+	total, list, err := ftpService.SearchWithPage(req, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return

agent/app/api/v2/helper/helper.go

@@ -30,6 +30,16 @@ func ErrorWithDetail(ctx *gin.Context, code int, msgKey string, err error) {
 	ctx.Abort()
 }
 
+func ErrorWithDetailAndData(ctx *gin.Context, code int, msgKey string, err error, data interface{}) {
+	res := dto.Response{
+		Code: code,
+		Data: data,
+	}
+	res.Message = i18n.GetMsgWithDetail(msgKey, err.Error())
+	ctx.JSON(http.StatusOK, res)
+	ctx.Abort()
+}
+
 func InternalServer(ctx *gin.Context, err error) {
 	ErrorWithDetail(ctx, http.StatusInternalServerError, "ErrInternalServer", err)
 }
@@ -38,6 +48,10 @@ func BadRequest(ctx *gin.Context, err error) {
 	ErrorWithDetail(ctx, http.StatusBadRequest, "ErrInvalidParams", err)
 }
 
+func IsDemoRequest(ctx *gin.Context) bool {
+	return global.CONF.Base.IsDemo || ctx.GetHeader(constant.DemoModeHeader) == strconv.FormatBool(true)
+}
+
 func SuccessWithData(ctx *gin.Context, data interface{}) {
 	if data == nil {
 		data = gin.H{}

agent/app/api/v2/host.go

@@ -100,7 +100,7 @@ func (b *BaseApi) SearchHost(c *gin.Context) {
 		return
 	}
 
-	total, list, err := hostService.SearchWithPage(req)
+	total, list, err := hostService.SearchWithPage(req, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return

agent/app/api/v2/image_repo.go

@@ -21,7 +21,7 @@ func (b *BaseApi) SearchRepo(c *gin.Context) {
 		return
 	}
 
-	total, list, err := imageRepoService.Page(req)
+	total, list, err := imageRepoService.Page(req, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return

agent/app/api/v2/logs.go

@@ -2,6 +2,7 @@ package v2
 
 import (
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/gin-gonic/gin"
 )
 
@@ -20,3 +21,57 @@ func (b *BaseApi) GetSystemFiles(c *gin.Context) {
 
 	helper.SuccessWithData(c, data)
 }
+
+// @Tags Logs
+// @Summary Get host system log status
+// @Produce json
+// @Success 200 {object} dto.SystemLogStatus
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /logs/system/status [get]
+func (b *BaseApi) GetSystemLogStatus(c *gin.Context) {
+	data, err := logService.GetSystemLogStatus()
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags Logs
+// @Summary Read host logs
+// @Accept json
+// @Param request body dto.SystemLogReq true "request"
+// @Produce json
+// @Success 200 {object} dto.SystemLogRes
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /logs/system/read [post]
+func (b *BaseApi) ReadSystemLog(c *gin.Context) {
+	var req dto.SystemLogReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := logService.ReadSystemLog(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags Logs
+// @Summary List running host services
+// @Produce json
+// @Success 200 {array} string
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /logs/system/services [get]
+func (b *BaseApi) ListRunningServices(c *gin.Context) {
+	data, err := logService.ListRunningServices()
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}

agent/app/api/v2/mcp_server.go

@@ -19,10 +19,31 @@ func (b *BaseApi) PageMcpServers(c *gin.Context) {
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	list := mcpServerService.Page(req)
+	list := mcpServerService.Page(req, helper.IsDemoRequest(c))
 	helper.SuccessWithData(c, list)
 }
 
+// @Tags McpServer
+// @Summary Load mcp server detail
+// @Accept json
+// @Param request body request.McpServerDetail true "request"
+// @Success 200 {object} response.McpServerDTO
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/mcp/server/detail [post]
+func (b *BaseApi) LoadMcpServerDetail(c *gin.Context) {
+	var req request.McpServerDetail
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	res, err := mcpServerService.Detail(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, res)
+}
+
 // @Tags McpServer
 // @Summary Create mcp server
 // @Accept json
@@ -107,6 +128,48 @@ func (b *BaseApi) OperateMcpServer(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags McpServer
+// @Summary Sync mcp server status
+// @Accept json
+// @Param request body request.McpServerStatusSync true "request"
+// @Success 200 {array} response.McpServerStatusDTO
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/mcp/server/status/sync [post]
+func (b *BaseApi) SyncMcpServerStatus(c *gin.Context) {
+	var req request.McpServerStatusSync
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	res, err := mcpServerService.SyncStatus(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, res)
+}
+
+// @Tags McpServer
+// @Summary Test mcp server connection
+// @Accept json
+// @Param request body request.McpServerConnectionTest true "request"
+// @Success 200 {object} response.McpServerConnectionTestRes
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/mcp/server/connection/test [post]
+func (b *BaseApi) TestMcpServerConnection(c *gin.Context) {
+	var req request.McpServerConnectionTest
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	res, err := mcpServerService.TestConnection(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, res)
+}
+
 // @Tags McpServer
 // @Summary Bind Domain for mcp server
 // @Accept json

agent/app/api/v2/runtime.go

@@ -20,6 +20,7 @@ func (b *BaseApi) SearchRuntimes(c *gin.Context) {
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
+	req.ReadOnly = helper.IsDemoRequest(c)
 	total, items, err := runtimeService.Page(req)
 	if err != nil {
 		helper.InternalServer(c, err)
@@ -132,7 +133,7 @@ func (b *BaseApi) GetRuntime(c *gin.Context) {
 		helper.BadRequest(c, err)
 		return
 	}
-	res, err := runtimeService.Get(id)
+	res, err := runtimeService.Get(id, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -529,7 +530,7 @@ func (b *BaseApi) GetPHPContainerConfig(c *gin.Context) {
 		helper.BadRequest(c, err)
 		return
 	}
-	data, err := runtimeService.GetPHPContainerConfig(id)
+	data, err := runtimeService.GetPHPContainerConfig(id, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return

agent/app/api/v2/runtime_diagnostics.go

@@ -0,0 +1,63 @@
+package v2
+
+import (
+	"os"
+
+	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/gin-gonic/gin"
+)
+
+// @Tags RuntimeDiagnostics
+// @Summary Load runtime diagnostics summary
+// @Success 200 {object} dto.RuntimeDiagnosticsSummary
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/diagnostics/summary [get]
+func (b *BaseApi) LoadRuntimeDiagnosticsSummary(c *gin.Context) {
+	data, err := runtimeDiagnosticsService.Summary()
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags RuntimeDiagnostics
+// @Summary Load grouped goroutine snapshot
+// @Success 200 {object} dto.RuntimeGoroutineSnapshot
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/diagnostics/goroutines [get]
+func (b *BaseApi) LoadRuntimeGoroutines(c *gin.Context) {
+	data, err := runtimeDiagnosticsService.Goroutines()
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithDataGzipped(c, data)
+}
+
+// @Tags RuntimeDiagnostics
+// @Summary Capture runtime profile
+// @Param request body dto.RuntimeProfileCreate true "request"
+// @Success 200 {file} file
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/diagnostics/profiles [post]
+func (b *BaseApi) CreateRuntimeProfile(c *gin.Context) {
+	var req dto.RuntimeProfileCreate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	profile, err := runtimeDiagnosticsService.CreateProfile(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	defer os.Remove(profile.Path)
+	c.Header("Content-Disposition", `attachment; filename="`+profile.Name+`"`)
+	c.Header("Content-Type", "application/octet-stream")
+	c.File(profile.Path)
+	c.Abort()
+}

agent/app/api/v2/setting.go

@@ -191,7 +191,7 @@ func (b *BaseApi) LoadBaseDir(c *gin.Context) {
 // @Security Timestamp
 // @Router /settings/ssh/conn [get]
 func (b *BaseApi) LoadLocalConn(c *gin.Context) {
-	helper.SuccessWithData(c, settingService.GetLocalConn())
+	helper.SuccessWithData(c, settingService.GetLocalConn(helper.IsDemoRequest(c)))
 }
 
 // @Tags System Setting

agent/app/api/v2/ssh.go

@@ -144,7 +144,7 @@ func (b *BaseApi) SearchRootCert(c *gin.Context) {
 		return
 	}
 
-	total, data, err := sshService.SearchRootCerts(req)
+	total, data, err := sshService.SearchRootCerts(req, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -224,6 +224,21 @@ func (b *BaseApi) ExportSSHLogs(c *gin.Context) {
 	helper.SuccessWithData(c, tmpFile)
 }
 
+// @Tags SSH
+// @Summary Clean host SSH logs
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/ssh/log/clean [post]
+// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"清空 SSH 登录日志","formatEN":"clean SSH login logs"}
+func (b *BaseApi) CleanSSHLogs(c *gin.Context) {
+	if err := sshService.CleanLog(); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags SSH
 // @Summary Load host SSH conf
 // @Accept json

agent/app/api/v2/tensorrt_llm.go

@@ -19,7 +19,7 @@ func (b *BaseApi) PageTensorRTLLMs(c *gin.Context) {
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	list := tensorrtLLMService.Page(req)
+	list := tensorrtLLMService.Page(req, helper.IsDemoRequest(c))
 	helper.SuccessWithData(c, list)
 }
 

agent/app/api/v2/terminal.go

@@ -98,7 +98,7 @@ func prepareTerminalSession(c *gin.Context) (*websocket.Conn, int, int, bool) {
 		return nil, 0, 0, false
 	}
 
-	if global.CONF.Base.IsDemo {
+	if helper.IsDemoRequest(c) {
 		if wshandleError(wsConn, errors.New("   demo server, prohibit this operation!")) {
 			return nil, 0, 0, false
 		}

agent/app/api/v2/website.go

@@ -255,7 +255,7 @@ func (b *BaseApi) GetHTTPSConfig(c *gin.Context) {
 		helper.BadRequest(c, err)
 		return
 	}
-	res, err := websiteService.GetWebsiteHTTPS(id)
+	res, err := websiteService.GetWebsiteHTTPS(id, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -1080,7 +1080,7 @@ func (b *BaseApi) GetWebsiteResource(c *gin.Context) {
 		helper.BadRequest(c, err)
 		return
 	}
-	res, err := websiteService.GetWebsiteResource(id)
+	res, err := websiteService.GetWebsiteResource(id, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return

agent/app/api/v2/website_acme_account.go

@@ -20,7 +20,7 @@ func (b *BaseApi) PageWebsiteAcmeAccount(c *gin.Context) {
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	total, accounts, err := websiteAcmeAccountService.Page(req)
+	total, accounts, err := websiteAcmeAccountService.Page(req, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return

agent/app/api/v2/website_ca.go

@@ -24,7 +24,7 @@ func (b *BaseApi) PageWebsiteCA(c *gin.Context) {
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	total, cas, err := websiteCAService.Page(req)
+	total, cas, err := websiteCAService.Page(req, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -70,7 +70,7 @@ func (b *BaseApi) GetWebsiteCA(c *gin.Context) {
 	if err != nil {
 		return
 	}
-	res, err := websiteCAService.GetCA(id)
+	res, err := websiteCAService.GetCA(id, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return

agent/app/api/v2/website_dns_account.go

@@ -20,7 +20,7 @@ func (b *BaseApi) PageWebsiteDnsAccount(c *gin.Context) {
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	total, accounts, err := websiteDnsAccountService.Page(req)
+	total, accounts, err := websiteDnsAccountService.Page(req, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return

agent/app/api/v2/website_ssl.go

@@ -28,7 +28,7 @@ func (b *BaseApi) PageWebsiteSSL(c *gin.Context) {
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	total, accounts, err := websiteSSLService.Page(req)
+	total, accounts, err := websiteSSLService.Page(req, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -159,7 +159,7 @@ func (b *BaseApi) GetWebsiteSSLByWebsiteId(c *gin.Context) {
 		helper.BadRequest(c, err)
 		return
 	}
-	websiteSSL, err := websiteSSLService.GetWebsiteSSL(websiteId)
+	websiteSSL, err := websiteSSLService.GetWebsiteSSL(websiteId, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -181,7 +181,7 @@ func (b *BaseApi) GetWebsiteSSLById(c *gin.Context) {
 		helper.BadRequest(c, err)
 		return
 	}
-	websiteSSL, err := websiteSSLService.GetSSL(id)
+	websiteSSL, err := websiteSSLService.GetSSL(id, helper.IsDemoRequest(c))
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -210,6 +210,27 @@ func (b *BaseApi) UpdateWebsiteSSL(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags Website SSL
+// @Summary Push ssl to nodes
+// @Accept json
+// @Param request body request.WebsiteSSLPush true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/ssl/push [post]
+// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"id","isList":false,"db":"website_ssls","output_column":"primary_domain","output_value":"domain"}],"formatZH":"推送证书到节点 [domain]","formatEN":"Push ssl to nodes [domain]"}
+func (b *BaseApi) PushWebsiteSSLToNode(c *gin.Context) {
+	var req request.WebsiteSSLPush
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := websiteSSLService.PushToNode(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags Website SSL
 // @Summary Upload ssl
 // @Accept json
@@ -248,6 +269,8 @@ func (b *BaseApi) UploadSSLFile(c *gin.Context) {
 	var req request.WebsiteSSLFileUpload
 
 	req.Description = c.PostForm("description")
+	req.Nodes = c.PostForm("nodes")
+	req.PushNode, _ = strconv.ParseBool(c.PostForm("pushNode"))
 	sslID := c.PostForm("sslID")
 	if sslID != "" {
 		req.SSLID, _ = strconv.ParseUint(sslID, 10, 64)
@@ -283,6 +306,8 @@ func (b *BaseApi) UploadSSLFile(c *gin.Context) {
 		Certificate: string(certificateContent),
 		Description: req.Description,
 		SSLID:       uint(req.SSLID),
+		PushNode:    req.PushNode,
+		Nodes:       req.Nodes,
 	}
 
 	if err := websiteSSLService.Upload(uploadReq); err != nil {

agent/app/api/v2/website_template.go

@@ -0,0 +1,259 @@
+package v2
+
+import (
+	"io"
+
+	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
+	"github.com/gin-gonic/gin"
+)
+
+// @Tags Website Template
+// @Summary Page website templates
+// @Accept json
+// @Param request body request.WebsiteTemplateSearch true "request"
+// @Success 200 {object} dto.PageResult
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/templates/search [post]
+func (b *BaseApi) PageWebsiteTemplate(c *gin.Context) {
+	var req request.WebsiteTemplateSearch
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	total, templates, err := websiteTemplateService.PageTemplate(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, dto.PageResult{
+		Total: total,
+		Items: templates,
+	})
+}
+
+// @Tags Website Template
+// @Summary Create website template
+// @Accept json
+// @Param request body request.WebsiteTemplateCreate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/templates [post]
+// @x-panel-log {"bodyKeys":["name"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"创建网站模板 [name]","formatEN":"Create website template [name]"}
+func (b *BaseApi) CreateWebsiteTemplate(c *gin.Context) {
+	var req request.WebsiteTemplateCreate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := websiteTemplateService.CreateTemplate(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Website Template
+// @Summary Update website template
+// @Accept json
+// @Param request body request.WebsiteTemplateUpdate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/templates/update [post]
+// @x-panel-log {"bodyKeys":["name"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新网站模板 [name]","formatEN":"Update website template [name]"}
+func (b *BaseApi) UpdateWebsiteTemplate(c *gin.Context) {
+	var req request.WebsiteTemplateUpdate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := websiteTemplateService.UpdateTemplate(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Website Template
+// @Summary Delete website template
+// @Accept json
+// @Param request body dto.OperateByID true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/templates/del [post]
+// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"id","isList":false,"db":"website_templates","output_column":"name","output_value":"name"}],"formatZH":"删除网站模板 [name]","formatEN":"Delete website template [name]"}
+func (b *BaseApi) DeleteWebsiteTemplate(c *gin.Context) {
+	var req dto.OperateByID
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := websiteTemplateService.DeleteTemplate(req.ID); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Website Template
+// @Summary Get website template
+// @Accept json
+// @Param request body dto.OperateByID true "request"
+// @Success 200 {object} response.WebsiteTemplateDTO
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/templates/get [post]
+func (b *BaseApi) GetWebsiteTemplate(c *gin.Context) {
+	var req dto.OperateByID
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	template, err := websiteTemplateService.GetTemplate(req.ID)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, template)
+}
+
+// @Tags Website Template
+// @Summary Upload website template zip
+// @Accept multipart/form-data
+// @Param file formData file true "file"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/templates/upload [post]
+func (b *BaseApi) UploadTemplateZip(c *gin.Context) {
+	fileHeader, err := c.FormFile("file")
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	file, err := fileHeader.Open()
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	defer file.Close()
+	content, err := io.ReadAll(file)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	filePath, variables, err := websiteTemplateService.SaveUploadZip(fileHeader.Filename, content)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, gin.H{"filePath": filePath, "variables": variables})
+}
+
+// @Tags Website Template
+// @Summary Preview website template
+// @Accept json
+// @Param request body request.WebsitePreviewReq true "request"
+// @Success 200 {object} response.WebsitePreviewDTO
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/templates/preview [post]
+func (b *BaseApi) PreviewWebsiteTemplate(c *gin.Context) {
+	var req request.WebsitePreviewReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	preview, err := websiteTemplateService.Preview(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, preview)
+}
+
+// @Tags Website Template
+// @Summary Page website template outputs
+// @Accept json
+// @Param request body request.WebsiteTemplateOutputSearch true "request"
+// @Success 200 {object} dto.PageResult
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/templates/outputs/search [post]
+func (b *BaseApi) PageWebsiteTemplateOutput(c *gin.Context) {
+	var req request.WebsiteTemplateOutputSearch
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	total, outputs, err := websiteTemplateService.PageOutput(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, dto.PageResult{
+		Total: total,
+		Items: outputs,
+	})
+}
+
+// @Tags Website Template
+// @Summary Create website template output
+// @Accept json
+// @Param request body request.WebsiteTemplateOutputCreate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/templates/outputs [post]
+// @x-panel-log {"bodyKeys":["name"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"生成模板产物 [name]","formatEN":"Generate template output [name]"}
+func (b *BaseApi) CreateWebsiteTemplateOutput(c *gin.Context) {
+	var req request.WebsiteTemplateOutputCreate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := websiteTemplateService.CreateOutput(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Website Template
+// @Summary Delete website template output
+// @Accept json
+// @Param request body dto.OperateByID true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/templates/outputs/del [post]
+// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"id","isList":false,"db":"website_template_outputs","output_column":"name","output_value":"name"}],"formatZH":"删除模板产物 [name]","formatEN":"Delete template output [name]"}
+func (b *BaseApi) DeleteWebsiteTemplateOutput(c *gin.Context) {
+	var req dto.OperateByID
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := websiteTemplateService.DeleteOutput(req.ID); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Website Template
+// @Summary Get website template output
+// @Accept json
+// @Param request body dto.OperateByID true "request"
+// @Success 200 {object} response.WebsiteTemplateOutputDTO
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/templates/outputs/get [post]
+func (b *BaseApi) GetWebsiteTemplateOutput(c *gin.Context) {
+	var req dto.OperateByID
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	output, err := websiteTemplateService.GetOutput(req.ID)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, output)
+}

agent/app/dto/agents.go

@@ -3,28 +3,30 @@ package dto
 import "time"
 
 type AgentCreateReq struct {
-	Name           string   `json:"name" validate:"required"`
-	Remark         string   `json:"remark"`
-	AppVersion     string   `json:"appVersion" validate:"required"`
-	WebUIPort      int      `json:"webUIPort" validate:"required,min=1,max=65535"`
-	BridgePort     int      `json:"bridgePort"`
-	AllowedOrigins []string `json:"allowedOrigins"`
-	AgentType      string   `json:"agentType" validate:"required,oneof=openclaw copaw hermes-agent"`
-	Model          string   `json:"model"`
-	AccountID      uint     `json:"accountId"`
-	Token          string   `json:"token"`
-	TaskID         string   `json:"taskID"`
-	Advanced       bool     `json:"advanced"`
-	ContainerName  string   `json:"containerName"`
-	AllowPort      bool     `json:"allowPort"`
-	SpecifyIP      string   `json:"specifyIP"`
-	RestartPolicy  string   `json:"restartPolicy"`
-	CpuQuota       float64  `json:"cpuQuota"`
-	MemoryLimit    float64  `json:"memoryLimit"`
-	MemoryUnit     string   `json:"memoryUnit"`
-	PullImage      bool     `json:"pullImage"`
-	EditCompose    bool     `json:"editCompose"`
-	DockerCompose  string   `json:"dockerCompose"`
+	Name              string   `json:"name" validate:"required"`
+	Remark            string   `json:"remark"`
+	AppVersion        string   `json:"appVersion" validate:"required"`
+	WebUIPort         int      `json:"webUIPort" validate:"required,min=1,max=65535"`
+	BridgePort        int      `json:"bridgePort"`
+	AllowedOrigins    []string `json:"allowedOrigins"`
+	AgentType         string   `json:"agentType" validate:"required,oneof=openclaw copaw hermes-agent"`
+	Model             string   `json:"model"`
+	AccountID         uint     `json:"accountId"`
+	Token             string   `json:"token"`
+	DashboardUsername string   `json:"dashboardUsername"`
+	DashboardPassword string   `json:"dashboardPassword"`
+	TaskID            string   `json:"taskID"`
+	Advanced          bool     `json:"advanced"`
+	ContainerName     string   `json:"containerName"`
+	AllowPort         bool     `json:"allowPort"`
+	SpecifyIP         string   `json:"specifyIP"`
+	RestartPolicy     string   `json:"restartPolicy"`
+	CpuQuota          float64  `json:"cpuQuota"`
+	MemoryLimit       float64  `json:"memoryLimit"`
+	MemoryUnit        string   `json:"memoryUnit"`
+	PullImage         bool     `json:"pullImage"`
+	EditCompose       bool     `json:"editCompose"`
+	DockerCompose     string   `json:"dockerCompose"`
 }
 
 type AgentBatchInstallReq struct {
@@ -38,6 +40,8 @@ type AgentBatchInstallReq struct {
 	Model              string              `json:"model"`
 	AccountID          uint                `json:"accountId"`
 	Token              string              `json:"token"`
+	DashboardUsername  string              `json:"dashboardUsername"`
+	DashboardPassword  string              `json:"dashboardPassword"`
 	TaskID             string              `json:"taskID"`
 	Advanced           bool                `json:"advanced"`
 	ContainerName      string              `json:"containerName"`
@@ -114,11 +118,11 @@ type AgentItem struct {
 	ProviderName         string    `json:"providerName"`
 	Model                string    `json:"model"`
 	APIType              string    `json:"apiType"`
-	MaxTokens            int       `json:"maxTokens"`
-	ContextWindow        int       `json:"contextWindow"`
 	BaseURL              string    `json:"baseUrl"`
 	APIKey               string    `json:"apiKey"`
 	Token                string    `json:"token"`
+	DashboardUsername    string    `json:"dashboardUsername"`
+	DashboardPassword    string    `json:"dashboardPassword"`
 	Status               string    `json:"status"`
 	Message              string    `json:"message"`
 	AppInstallID         uint      `json:"appInstallId"`
@@ -286,19 +290,22 @@ type AgentOverviewSnapshot struct {
 }
 
 type AgentAccountModel struct {
-	RecordID      uint     `json:"recordId"`
-	ID            string   `json:"id"`
-	Name          string   `json:"name"`
-	ContextWindow int      `json:"contextWindow"`
-	MaxTokens     int      `json:"maxTokens"`
-	Reasoning     bool     `json:"reasoning"`
-	Input         []string `json:"input"`
+	RecordID uint   `json:"recordId"`
+	ID       string `json:"id"`
+	Name     string `json:"name"`
 }
 
 type AgentAccountModelReq struct {
 	AccountID uint `json:"accountId" validate:"required"`
 }
 
+type AgentAccountModelDiscoverReq struct {
+	Provider string `json:"provider" validate:"required"`
+	BaseURL  string `json:"baseURL" validate:"required"`
+	APIKey   string `json:"apiKey" validate:"required"`
+	APIType  string `json:"apiType" validate:"required"`
+}
+
 type AgentAccountModelCreateReq struct {
 	AccountID uint              `json:"accountId" validate:"required"`
 	Model     AgentAccountModel `json:"model" validate:"required"`
@@ -315,31 +322,40 @@ type AgentAccountModelDeleteReq struct {
 }
 
 type AgentAccountCreateReq struct {
-	Provider       string              `json:"provider" validate:"required"`
-	Name           string              `json:"name" validate:"required"`
-	APIKey         string              `json:"apiKey" validate:"required"`
-	RememberAPIKey bool                `json:"rememberApiKey"`
-	BaseURL        string              `json:"baseURL"`
-	Models         []AgentAccountModel `json:"models"`
-	APIType        string              `json:"apiType" validate:"required"`
-	Remark         string              `json:"remark"`
+	Provider             string              `json:"provider" validate:"required"`
+	Name                 string              `json:"name" validate:"required"`
+	APIKey               string              `json:"apiKey" validate:"required"`
+	RememberAPIKey       bool                `json:"rememberApiKey"`
+	BaseURL              string              `json:"baseURL"`
+	Models               []AgentAccountModel `json:"models"`
+	APIType              string              `json:"apiType" validate:"required"`
+	AuthMode             string              `json:"authMode"`
+	VerifyModel          string              `json:"verifyModel"`
+	ValidateAvailability *bool               `json:"validateAvailability"`
+	Remark               string              `json:"remark"`
 }
 
 type AgentAccountUpdateReq struct {
-	ID             uint   `json:"id" validate:"required"`
-	Name           string `json:"name" validate:"required"`
-	APIKey         string `json:"apiKey" validate:"required"`
-	RememberAPIKey bool   `json:"rememberApiKey"`
-	BaseURL        string `json:"baseURL"`
-	APIType        string `json:"apiType" validate:"required"`
-	Remark         string `json:"remark"`
-	SyncAgents     bool   `json:"syncAgents"`
+	ID                   uint   `json:"id" validate:"required"`
+	Name                 string `json:"name" validate:"required"`
+	APIKey               string `json:"apiKey" validate:"required"`
+	RememberAPIKey       bool   `json:"rememberApiKey"`
+	BaseURL              string `json:"baseURL"`
+	APIType              string `json:"apiType" validate:"required"`
+	AuthMode             string `json:"authMode"`
+	VerifyModel          string `json:"verifyModel"`
+	ValidateAvailability *bool  `json:"validateAvailability"`
+	Remark               string `json:"remark"`
+	SyncAgents           bool   `json:"syncAgents"`
 }
 
 type AgentAccountVerifyReq struct {
 	Provider string `json:"provider" validate:"required"`
 	APIKey   string `json:"apiKey" validate:"required"`
 	BaseURL  string `json:"baseURL"`
+	APIType  string `json:"apiType" validate:"required"`
+	AuthMode string `json:"authMode"`
+	Model    string `json:"model"`
 }
 
 type AgentAccountDeleteReq struct {
@@ -349,6 +365,8 @@ type AgentAccountDeleteReq struct {
 type AgentAccountSearch struct {
 	PageInfo
 	Provider string `json:"provider"`
+	APIType  string `json:"apiType"`
+	TextOnly bool   `json:"textOnly"`
 	Name     string `json:"name"`
 }
 
@@ -367,26 +385,36 @@ type AgentAccountInfo struct {
 	BaseURL         string              `json:"baseUrl"`
 	Models          []AgentAccountModel `json:"models"`
 	APIType         string              `json:"apiType"`
+	AuthMode        string              `json:"authMode"`
+	VerifyModel     string              `json:"verifyModel"`
 	Verified        bool                `json:"verified"`
 	Remark          string              `json:"remark"`
 	CreatedAt       time.Time           `json:"createdAt"`
 }
 
 type ProviderModelInfo struct {
-	ID            string   `json:"id"`
-	Name          string   `json:"name"`
-	ContextWindow int      `json:"contextWindow"`
-	MaxTokens     int      `json:"maxTokens"`
-	Reasoning     bool     `json:"reasoning"`
-	Input         []string `json:"input"`
+	ID   string `json:"id"`
+	Name string `json:"name"`
+}
+
+type ProviderAPIInfo struct {
+	APIType                string              `json:"apiType"`
+	BaseURL                string              `json:"baseUrl"`
+	EditableBaseURL        bool                `json:"editableBaseUrl"`
+	SupportsModelDiscovery bool                `json:"supportsModelDiscovery"`
+	DefaultAuthMode        string              `json:"defaultAuthMode"`
+	AuthModes              []string            `json:"authModes"`
+	Models                 []ProviderModelInfo `json:"models"`
 }
 
 type ProviderInfo struct {
-	Sort        uint                `json:"-"`
-	Provider    string              `json:"provider"`
-	DisplayName string              `json:"displayName"`
-	BaseURL     string              `json:"baseUrl"`
-	Models      []ProviderModelInfo `json:"models"`
+	Sort           uint                `json:"-"`
+	Provider       string              `json:"provider"`
+	DisplayName    string              `json:"displayName"`
+	BaseURL        string              `json:"baseUrl"`
+	DefaultAPIType string              `json:"defaultApiType"`
+	APITypes       []ProviderAPIInfo   `json:"apiTypes"`
+	Models         []ProviderModelInfo `json:"models"`
 }
 
 type AgentFeishuConfigReq struct {
@@ -407,11 +435,6 @@ type AgentFeishuConfigUpdateReq struct {
 	Bots           []AgentFeishuBot `json:"bots" validate:"required,min=1"`
 }
 
-type AgentFeishuPairingApproveReq struct {
-	AgentID     uint   `json:"agentId" validate:"required"`
-	PairingCode string `json:"pairingCode" validate:"required"`
-}
-
 type AgentFeishuConfig struct {
 	Enabled        bool             `json:"enabled"`
 	ThreadSession  bool             `json:"threadSession"`
@@ -581,6 +604,52 @@ type AgentPluginStatus struct {
 	Upgradable     bool   `json:"upgradable"`
 }
 
+type AgentPluginsReq struct {
+	AgentID uint `json:"agentId" validate:"required"`
+}
+
+type AgentPluginSearchReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	Keyword string `json:"keyword" validate:"required,max=100"`
+	Limit   int    `json:"limit" validate:"omitempty,min=1,max=100"`
+}
+
+type AgentPluginMarketInstallReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	Package string `json:"package" validate:"required,max=200"`
+	Version string `json:"version" validate:"required,max=100"`
+	TaskID  string `json:"taskID" validate:"required"`
+}
+
+type AgentPluginOperateReq struct {
+	AgentID  uint   `json:"agentId" validate:"required"`
+	PluginID string `json:"pluginId" validate:"required,max=200"`
+	Operate  string `json:"operate" validate:"required,oneof=enable disable update uninstall"`
+	TaskID   string `json:"taskID" validate:"required"`
+}
+
+type AgentPluginItem struct {
+	ID      string `json:"id"`
+	Name    string `json:"name"`
+	Version string `json:"version"`
+	Origin  string `json:"origin"`
+	Enabled bool   `json:"enabled"`
+}
+
+type AgentPluginSearchItem struct {
+	Package          string   `json:"package"`
+	PluginID         string   `json:"pluginId"`
+	Name             string   `json:"name"`
+	Description      string   `json:"description"`
+	Version          string   `json:"version"`
+	Channel          string   `json:"channel"`
+	VerificationTier string   `json:"verificationTier"`
+	Categories       []string `json:"categories"`
+	Official         bool     `json:"official"`
+	Downloads        int64    `json:"downloads"`
+	Score            float64  `json:"score"`
+}
+
 type AgentDiscordConfigUpdateReq struct {
 	AgentID        uint              `json:"agentId" validate:"required"`
 	Enabled        bool              `json:"enabled"`
@@ -660,16 +729,20 @@ type AgentSecurityConfig struct {
 }
 
 type AgentOtherConfigUpdateReq struct {
-	AgentID        uint   `json:"agentId" validate:"required"`
-	UserTimezone   string `json:"userTimezone" validate:"required"`
-	BrowserEnabled bool   `json:"browserEnabled"`
-	NPMRegistry    string `json:"npmRegistry" validate:"required"`
+	AgentID           uint   `json:"agentId" validate:"required"`
+	UserTimezone      string `json:"userTimezone"`
+	BrowserEnabled    bool   `json:"browserEnabled"`
+	NPMRegistry       string `json:"npmRegistry"`
+	DashboardUsername string `json:"dashboardUsername"`
+	DashboardPassword string `json:"dashboardPassword"`
 }
 
 type AgentOtherConfig struct {
-	UserTimezone   string `json:"userTimezone"`
-	BrowserEnabled bool   `json:"browserEnabled"`
-	NPMRegistry    string `json:"npmRegistry"`
+	UserTimezone      string `json:"userTimezone"`
+	BrowserEnabled    bool   `json:"browserEnabled"`
+	NPMRegistry       string `json:"npmRegistry"`
+	DashboardUsername string `json:"dashboardUsername"`
+	DashboardPassword string `json:"dashboardPassword"`
 }
 
 type AgentConfigFileReq struct {

agent/app/dto/alert.go

@@ -113,8 +113,10 @@ type DiskDTO struct {
 
 type AlertLogSearch struct {
 	PageInfo
-	Count  uint   `json:"count"`
-	Status string `json:"status"`
+	Count     uint      `json:"count"`
+	Status    string    `json:"status"`
+	StartTime time.Time `json:"startTime"`
+	EndTime   time.Time `json:"endTime"`
 }
 
 type AlertLogDTO struct {

agent/app/dto/app.go

@@ -2,6 +2,7 @@ package dto
 
 import (
 	"context"
+
 	"github.com/1Panel-dev/1Panel/agent/app/model"
 	"github.com/1Panel-dev/1Panel/agent/app/task"
 )
@@ -132,6 +133,8 @@ type Locale struct {
 	Ko     string `json:"ko"`
 	Tr     string `json:"tr"`
 	Es     string `json:"es-es" yaml:"es-es"`
+	Fa     string `json:"fa"`
+	Lo     string `json:"lo"`
 }
 
 type AppForm struct {

agent/app/dto/backup.go

@@ -65,14 +65,15 @@ type UploadForRecover struct {
 }
 
 type CommonBackup struct {
-	Type       string   `json:"type" validate:"required,oneof=app mysql mariadb redis website postgresql mongodb mysql-cluster postgresql-cluster redis-cluster container compose"`
-	Name       string   `json:"name"`
-	DetailName string   `json:"detailName"`
-	Secret     string   `json:"secret"`
-	StopBefore bool     `json:"stopBefore"`
-	TaskID     string   `json:"taskID"`
-	FileName   string   `json:"fileName"`
-	Args       []string `json:"args"`
+	Type        string   `json:"type" validate:"required,oneof=app mysql mariadb redis website postgresql mongodb mysql-cluster postgresql-cluster redis-cluster container compose"`
+	Name        string   `json:"name"`
+	DetailName  string   `json:"detailName"`
+	Secret      string   `json:"secret"`
+	IsImmediate bool     `json:"isImmediate"`
+	StopBefore  bool     `json:"stopBefore"`
+	TaskID      string   `json:"taskID"`
+	FileName    string   `json:"fileName"`
+	Args        []string `json:"args"`
 
 	Description string `json:"description"`
 }

agent/app/dto/common_req.go

@@ -2,7 +2,8 @@ package dto
 
 type SearchWithPage struct {
 	PageInfo
-	Info string `json:"info"`
+	Info            string `json:"info"`
+	ExcludeAppStore bool   `json:"excludeAppStore"`
 }
 
 type SearchPageWithType struct {

agent/app/dto/container.go

@@ -134,10 +134,15 @@ type ExtraHost struct {
 	IP       string `json:"ip"`
 }
 type ContainerNetwork struct {
-	Network string `json:"network"`
-	Ipv4    string `json:"ipv4"`
-	Ipv6    string `json:"ipv6"`
-	MacAddr string `json:"macAddr"`
+	Network      string            `json:"network"`
+	Ipv4         string            `json:"ipv4"`
+	Ipv6         string            `json:"ipv6"`
+	MacAddr      string            `json:"macAddr"`
+	Links        []string          `json:"links"`
+	Aliases      []string          `json:"aliases"`
+	DriverOpts   map[string]string `json:"driverOpts"`
+	GwPriority   int               `json:"gwPriority"`
+	LinkLocalIPs []string          `json:"linkLocalIPs"`
 }
 
 type ContainerCreateByCommand struct {
@@ -295,6 +300,7 @@ type ComposeInfo struct {
 	ConfigFile        string             `json:"configFile"`
 	Workdir           string             `json:"workdir"`
 	ComposeFileExists bool               `json:"composeFileExists"`
+	IsPinned          bool               `json:"isPinned"`
 	Path              string             `json:"path"`
 	Containers        []ComposeContainer `json:"containers"`
 	Env               string             `json:"env"`
@@ -309,6 +315,7 @@ type ComposeContainer struct {
 type ComposeCreate struct {
 	TaskID    string `json:"taskID"`
 	Name      string `json:"name"`
+	DirName   string `json:"dirName"`
 	From      string `json:"from" validate:"required,oneof=edit path template"`
 	File      string `json:"file"`
 	Path      string `json:"path"`
@@ -319,7 +326,7 @@ type ComposeCreate struct {
 type ComposeOperation struct {
 	Name      string `json:"name" validate:"required"`
 	Path      string `json:"path"`
-	Operation string `json:"operation" validate:"required,oneof=up start restart stop down delete"`
+	Operation string `json:"operation" validate:"required,oneof=up start restart stop down delete rebuild"`
 	WithFile  bool   `json:"withFile"`
 	Force     bool   `json:"force"`
 }
@@ -332,6 +339,10 @@ type ComposeUpdate struct {
 	Env        string `json:"env"`
 	ForcePull  bool   `json:"forcePull"`
 }
+type ComposePin struct {
+	Name     string `json:"name" validate:"required"`
+	IsPinned bool   `json:"isPinned"`
+}
 type ComposeLogClean struct {
 	Name       string `json:"name" validate:"required"`
 	Path       string `json:"path" validate:"required"`

agent/app/dto/cronjob.go

@@ -197,6 +197,7 @@ type SearchRecord struct {
 
 type Record struct {
 	ID         uint   `json:"id"`
+	CronjobID  uint   `json:"cronjobID"`
 	TaskID     string `json:"taskID"`
 	StartTime  string `json:"startTime"`
 	Records    string `json:"records"`

agent/app/dto/dashboard.go

@@ -79,8 +79,9 @@ type NodeCurrent struct {
 }
 
 type DashboardCurrent struct {
-	Uptime          uint64 `json:"uptime"`
-	TimeSinceUptime string `json:"timeSinceUptime"`
+	Uptime          uint64      `json:"uptime"`
+	TimeSinceUptime string      `json:"timeSinceUptime"`
+	RunningTime     RunningTime `json:"runningTime"`
 
 	Procs uint64 `json:"procs"`
 
@@ -128,6 +129,13 @@ type DashboardCurrent struct {
 	ShotTime time.Time `json:"shotTime"`
 }
 
+type RunningTime struct {
+	Days    uint64 `json:"days"`
+	Hours   uint64 `json:"hours"`
+	Minutes uint64 `json:"minutes"`
+	Seconds uint64 `json:"seconds"`
+}
+
 type AppLauncherSync struct {
 	Keys []string `json:"keys"`
 }
@@ -148,6 +156,7 @@ type DiskInfo struct {
 }
 
 type GPUInfo struct {
+	Type             string `json:"type"`
 	Index            uint   `json:"index"`
 	ProductName      string `json:"productName"`
 	GPUUtil          string `json:"gpuUtil"`

agent/app/dto/database.go

@@ -60,25 +60,84 @@ type MysqlDBCreate struct {
 	Database    string `json:"database" validate:"required"`
 	Format      string `json:"format" validate:"required"`
 	Collation   string `json:"collation"`
-	Username    string `json:"username" validate:"required"`
-	Password    string `json:"password" validate:"required"`
+	Username    string `json:"username"`
+	Password    string `json:"password"`
 	Permission  string `json:"permission" validate:"required"`
 	Description string `json:"description"`
 }
 
+type MysqlUser struct {
+	Username    string `json:"username"`
+	Host        string `json:"host"`
+	Password    string `json:"password"`
+	Description string `json:"description"`
+	IsDelete    bool   `json:"isDelete"`
+}
+
+type MysqlGrant struct {
+	Database string `json:"database"`
+	Username string `json:"username"`
+	Host     string `json:"host"`
+}
+
+type MysqlGrantSummarySearch struct {
+	Database string   `json:"database" validate:"required"`
+	DBs      []string `json:"dbs" validate:"required"`
+}
+
+type MysqlUserSearch struct {
+	Database string `json:"database" validate:"required"`
+}
+
+type MysqlUserCreate struct {
+	Database    string   `json:"database" validate:"required"`
+	Username    string   `json:"username" validate:"required"`
+	Password    string   `json:"password" validate:"required"`
+	Host        string   `json:"host" validate:"required"`
+	Description string   `json:"description"`
+	DBs         []string `json:"dbs"`
+}
+
+type MysqlUserDelete struct {
+	Database string `json:"database" validate:"required"`
+	Username string `json:"username" validate:"required"`
+	Host     string `json:"host" validate:"required"`
+}
+
+type MysqlUserUpdate struct {
+	Database    string `json:"database" validate:"required"`
+	Username    string `json:"username" validate:"required"`
+	Host        string `json:"host" validate:"required"`
+	NewHost     string `json:"newHost" validate:"required"`
+	Description string `json:"description"`
+}
+
+type MysqlUserPassword struct {
+	Database string `json:"database" validate:"required"`
+	Username string `json:"username" validate:"required"`
+	Host     string `json:"host" validate:"required"`
+	Password string `json:"password" validate:"required"`
+}
+
+type MysqlGrantCreate struct {
+	Database string `json:"database" validate:"required"`
+	DB       string `json:"db" validate:"required"`
+	Username string `json:"username" validate:"required"`
+	Host     string `json:"host" validate:"required"`
+}
+
+type MysqlGrantDelete struct {
+	Database string `json:"database" validate:"required"`
+	DB       string `json:"db" validate:"required"`
+	Username string `json:"username" validate:"required"`
+	Host     string `json:"host" validate:"required"`
+}
+
 type MysqlFormatCollationOption struct {
 	Format     string   `json:"format"`
 	Collations []string `json:"collations"`
 }
 
-type BindUser struct {
-	Database   string `json:"database" validate:"required"`
-	DB         string `json:"db" validate:"required"`
-	Username   string `json:"username" validate:"required"`
-	Password   string `json:"password" validate:"required"`
-	Permission string `json:"permission" validate:"required"`
-}
-
 type MysqlLoadDB struct {
 	From     string `json:"from" validate:"required,oneof=local remote"`
 	Type     string `json:"type" validate:"required,oneof=mysql mariadb mysql-cluster"`

agent/app/dto/firewall.go

@@ -35,19 +35,6 @@ type PortRuleOperate struct {
 	Description string `json:"description"`
 }
 
-type ForwardRuleOperate struct {
-	ForceDelete bool `json:"forceDelete"`
-	Rules       []struct {
-		Operation  string `json:"operation" validate:"required,oneof=add remove"`
-		Num        string `json:"num"`
-		Protocol   string `json:"protocol" validate:"required,oneof=tcp udp tcp/udp"`
-		Interface  string `json:"interface"`
-		Port       string `json:"port" validate:"required"`
-		TargetIP   string `json:"targetIP"`
-		TargetPort string `json:"targetPort" validate:"required"`
-	} `json:"rules"`
-}
-
 type UpdateFirewallDescription struct {
 	Type     string `json:"type"`
 	Chain    string `json:"chain"`
@@ -86,7 +73,7 @@ type BatchRuleOperate struct {
 }
 
 type IptablesOp struct {
-	Name    string `json:"name" validate:"required,oneof=1PANEL_INPUT 1PANEL_OUTPUT 1PANEL_BASIC"`
+	Name    string `json:"name" validate:"required,oneof=1PANEL_INPUT 1PANEL_OUTPUT 1PANEL_BASIC 1PANEL_FORWARD"`
 	Operate string `json:"operate" validate:"required,oneof=init-base init-forward init-advance bind-base unbind-base bind unbind"`
 }
 

agent/app/dto/forwarding.go

@@ -0,0 +1,43 @@
+package dto
+
+type ForwardRuleSearch struct {
+	PageInfo
+	Info     string `json:"info"`
+	Status   string `json:"status"`
+	Strategy string `json:"strategy"`
+}
+
+// ForwardRule preserves the existing firewall search response shape while
+// keeping forwarding data separate from the filter client model.
+type ForwardRule struct {
+	ID       uint   `json:"id"`
+	Chain    string `json:"chain"`
+	Family   string `json:"family"`
+	Address  string `json:"address"`
+	Port     string `json:"port"`
+	Protocol string `json:"protocol"`
+	Strategy string `json:"strategy"`
+
+	Num        string `json:"num"`
+	TargetIP   string `json:"targetIP"`
+	TargetPort string `json:"targetPort"`
+	Interface  string `json:"interface"`
+
+	UsedStatus  string `json:"usedStatus"`
+	Description string `json:"description"`
+}
+
+type ForwardRuleOperate struct {
+	ForceDelete bool                   `json:"forceDelete"`
+	Rules       []ForwardRuleOperation `json:"rules"`
+}
+
+type ForwardRuleOperation struct {
+	Operation  string `json:"operation" validate:"required,oneof=add remove"`
+	Num        string `json:"num"`
+	Protocol   string `json:"protocol" validate:"required,oneof=tcp udp tcp/udp"`
+	Interface  string `json:"interface"`
+	Port       string `json:"port" validate:"required"`
+	TargetIP   string `json:"targetIP"`
+	TargetPort string `json:"targetPort" validate:"required"`
+}

agent/app/dto/logs.go

@@ -1,6 +1,8 @@
 package dto
 
 import (
+	"time"
+
 	"github.com/1Panel-dev/1Panel/agent/app/model"
 )
 
@@ -14,3 +16,37 @@ type SearchTaskLogReq struct {
 type TaskDTO struct {
 	model.Task
 }
+
+type SystemLogReq struct {
+	PageSize  int       `json:"pageSize" validate:"omitempty,min=1,max=500"`
+	Cursor    string    `json:"cursor"`
+	StartTime time.Time `json:"startTime"`
+	EndTime   time.Time `json:"endTime"`
+	Keyword   string    `json:"keyword"`
+	Priority  string    `json:"priority"`
+	Service   string    `json:"service"`
+}
+
+type SystemLogRes struct {
+	Source     string          `json:"source"`
+	Items      []SystemLogItem `json:"items"`
+	HasMore    bool            `json:"hasMore"`
+	NextCursor string          `json:"nextCursor"`
+}
+
+type SystemLogStatus struct {
+	Source                 string `json:"source"`
+	Version                string `json:"version"`
+	KeywordFilterSupported bool   `json:"keywordFilterSupported"`
+	Message                string `json:"message"`
+}
+
+type SystemLogItem struct {
+	Timestamp int64  `json:"-"`
+	Cursor    string `json:"-"`
+	Time      string `json:"time"`
+	Priority  string `json:"priority"`
+	Service   string `json:"service"`
+	Message   string `json:"message"`
+	Raw       string `json:"raw"`
+}

agent/app/dto/monitor.go

@@ -49,6 +49,7 @@ type GPUChartHide struct {
 	GPU         bool   `json:"gpu"`
 	Memory      bool   `json:"memory"`
 	Power       bool   `json:"power"`
+	PowerLimit  bool   `json:"powerLimit"`
 	Temperature bool   `json:"temperature"`
 	Speed       bool   `json:"speed"`
 }

agent/app/dto/nginx.go

@@ -1,6 +1,8 @@
 package dto
 
 import (
+	"time"
+
 	"github.com/1Panel-dev/1Panel/agent/app/model"
 	"github.com/1Panel-dev/1Panel/agent/utils/nginx/components"
 )
@@ -87,9 +89,41 @@ var LBAlgorithms = map[string]struct{}{"ip_hash": {}, "least_conn": {}}
 var RealIPKeys = map[string]struct{}{"X-Forwarded-For": {}, "X-Real-IP": {}, "CF-Connecting-IP": {}}
 
 type NginxModule struct {
-	Name     string   `json:"name"`
-	Script   string   `json:"script"`
-	Packages []string `json:"packages"`
-	Params   string   `json:"params"`
-	Enable   bool     `json:"enable"`
+	Name      string             `json:"name"`
+	Custom    bool               `json:"custom,omitempty"`
+	Script    string             `json:"script"`
+	Packages  []string           `json:"packages"`
+	Params    string             `json:"params"`
+	Enable    bool               `json:"enable"`
+	BuildMode string             `json:"buildMode,omitempty"`
+	Provider  string             `json:"provider,omitempty"`
+	LoadOrder int                `json:"loadOrder,omitempty"`
+	Builds    []NginxModuleBuild `json:"builds,omitempty"`
+	LastError string             `json:"lastError,omitempty"`
+}
+
+type NginxModuleBuild struct {
+	Provider  string                `json:"provider"`
+	BuildMode string                `json:"buildMode"`
+	Status    string                `json:"status"`
+	Hash      string                `json:"hash"`
+	Target    NginxModuleTarget     `json:"target"`
+	Artifacts []NginxModuleArtifact `json:"artifacts,omitempty"`
+	Error     string                `json:"error,omitempty"`
+	BuiltAt   time.Time             `json:"builtAt,omitempty"`
+}
+
+type NginxModuleTarget struct {
+	Key              string `json:"key"`
+	OpenRestyVersion string `json:"openrestyVersion"`
+	Architecture     string `json:"architecture"`
+	Image            string `json:"image,omitempty"`
+	ImageDigest      string `json:"imageDigest,omitempty"`
+	BuilderDigest    string `json:"builderDigest,omitempty"`
+}
+
+type NginxModuleArtifact struct {
+	Name     string `json:"name"`
+	Path     string `json:"path"`
+	Checksum string `json:"checksum"`
 }

agent/app/dto/request/app.go

@@ -62,11 +62,13 @@ type AppInstalledSearch struct {
 	All         bool     `json:"all"`
 	Sync        bool     `json:"sync"`
 	CheckUpdate bool     `json:"checkUpdate"`
+	ReadOnly    bool     `json:"-"`
 }
 
 type AppInstalledInfo struct {
-	Key  string `json:"key" validate:"required"`
-	Name string `json:"name"`
+	Key      string `json:"key" validate:"required"`
+	Name     string `json:"name"`
+	ReadOnly bool   `json:"-"`
 }
 
 type AppBackupSearch struct {
@@ -99,6 +101,7 @@ type AppInstallUpgrade struct {
 	DetailID      uint   `json:"detailId"`
 	Backup        bool   `json:"backup"`
 	PullImage     bool   `json:"pullImage"`
+	DeleteImage   bool   `json:"deleteImage"`
 	DockerCompose string `json:"dockerCompose"`
 	TaskID        string `json:"taskID"`
 }

agent/app/dto/request/file.go

@@ -131,6 +131,11 @@ type FileMove struct {
 	Name       string   `json:"name"`
 	Cover      bool     `json:"cover"`
 	CoverPaths []string `json:"coverPaths"`
+	TaskID     string   `json:"taskID"`
+}
+
+type FileMoveStopReq struct {
+	TaskID string `json:"taskID" validate:"required"`
 }
 
 type FileDownload struct {

agent/app/dto/request/mcp_server.go

@@ -21,6 +21,10 @@ type McpServerCreate struct {
 	StreamableHttpPath string        `json:"streamableHttpPath"`
 	OutputTransport    string        `json:"outputTransport" validate:"required"`
 	Type               string        `json:"type" validate:"required"`
+	GatewayImage       string        `json:"gatewayImage"`
+	ProtocolVersion    string        `json:"protocolVersion"`
+	GatewayArgs        string        `json:"gatewayArgs" validate:"max=4096"`
+	TaskID             string        `json:"taskID"`
 }
 
 type McpServerUpdate struct {
@@ -32,11 +36,23 @@ type McpServerDelete struct {
 	ID uint `json:"id" validate:"required"`
 }
 
+type McpServerDetail struct {
+	ID uint `json:"id" validate:"required"`
+}
+
+type McpServerStatusSync struct {
+	IDs []uint `json:"ids"`
+}
+
 type McpServerOperate struct {
 	ID      uint   `json:"id" validate:"required"`
 	Operate string `json:"operate" validate:"required"`
 }
 
+type McpServerConnectionTest struct {
+	ID uint `json:"id" validate:"required"`
+}
+
 type McpBindDomain struct {
 	Domain string `json:"domain" validate:"required"`
 	SSLID  uint   `json:"sslID"`

agent/app/dto/request/nginx.go

@@ -114,17 +114,22 @@ type NginxRedirectUpdate struct {
 }
 
 type NginxBuildReq struct {
-	TaskID string `json:"taskID" validate:"required"`
-	Mirror string `json:"mirror"  validate:"required"`
+	TaskID  string   `json:"taskID" validate:"required"`
+	Mirror  string   `json:"mirror" validate:"required"`
+	Modules []string `json:"modules"`
+	Force   bool     `json:"force"`
 }
 
 type NginxModuleUpdate struct {
-	Operate  string `json:"operate" validate:"required,oneof=create delete update"`
-	Name     string `json:"name" validate:"required"`
-	Script   string `json:"script"`
-	Packages string `json:"packages"`
-	Enable   bool   `json:"enable"`
-	Params   string `json:"params"`
+	Operate   string `json:"operate" validate:"required,oneof=create delete update"`
+	Name      string `json:"name" validate:"required"`
+	Script    string `json:"script"`
+	Packages  string `json:"packages"`
+	Enable    bool   `json:"enable"`
+	Params    string `json:"params"`
+	BuildMode string `json:"buildMode" validate:"omitempty,oneof=dynamic static"`
+	Provider  string `json:"provider" validate:"omitempty,oneof=local prebuilt"`
+	LoadOrder int    `json:"loadOrder" validate:"omitempty,min=0,max=9999"`
 }
 
 type NginxOperateReq struct {

agent/app/dto/request/runtime.go

@@ -6,9 +6,10 @@ import (
 
 type RuntimeSearch struct {
 	dto.PageInfo
-	Type   string `json:"type"`
-	Name   string `json:"name"`
-	Status string `json:"status"`
+	Type     string `json:"type"`
+	Name     string `json:"name"`
+	Status   string `json:"status"`
+	ReadOnly bool   `json:"-"`
 }
 
 type RuntimeCreate struct {
@@ -21,13 +22,14 @@ type RuntimeCreate struct {
 	Source      string `json:"source"`
 	CodeDir     string `json:"codeDir"`
 	Remark      string `json:"remark"`
+	TaskID      string `json:"taskID"`
 
 	Params map[string]interface{} `json:"params"`
 	NodeConfig
 }
 
 type NodeConfig struct {
-	Install      bool          `json:"install"`
+	Install      *bool         `json:"install"`
 	Clean        bool          `json:"clean"`
 	ExposedPorts []ExposedPort `json:"exposedPorts"`
 	Environments []Environment `json:"environments"`
@@ -42,12 +44,14 @@ type Environment struct {
 type Volume struct {
 	Source string `json:"source"`
 	Target string `json:"target"`
+	Mode   string `json:"mode"`
 }
 
 type ExposedPort struct {
 	HostPort      int    `json:"hostPort"`
 	ContainerPort int    `json:"containerPort"`
 	HostIP        string `json:"hostIP"`
+	Protocol      string `json:"protocol"`
 }
 
 type ExtraHost struct {
@@ -56,8 +60,10 @@ type ExtraHost struct {
 }
 
 type RuntimeDelete struct {
-	ID          uint `json:"id"`
-	ForceDelete bool `json:"forceDelete"`
+	ID          uint   `json:"id"`
+	ForceDelete bool   `json:"forceDelete"`
+	DeleteImage bool   `json:"deleteImage"`
+	TaskID      string `json:"taskID"`
 }
 
 type RuntimeUpdate struct {

agent/app/dto/request/website.go

@@ -34,6 +34,8 @@ type WebsiteCreate struct {
 
 	SiteDir string `json:"siteDir"`
 
+	TemplateOutputID uint `json:"templateOutputID"`
+
 	RuntimeConfig
 	FtpConfig
 	DataBaseConfig

agent/app/dto/request/website_ssl.go

@@ -126,6 +126,16 @@ type WebsiteSSLUpload struct {
 	Type            string `json:"type" validate:"required,oneof=paste local"`
 	SSLID           uint   `json:"sslID"`
 	Description     string `json:"description"`
+	PushNode        bool   `json:"pushNode"`
+	Nodes           string `json:"nodes"`
+}
+
+type WebsiteSSLPush struct {
+	ID       uint   `json:"id" validate:"required"`
+	PushNode bool   `json:"pushNode"`
+	Nodes    string `json:"nodes"`
+	TaskID   string `json:"taskID" validate:"required"`
+	Sync     bool   `json:"sync"`
 }
 
 type WebsiteCASearch struct {
@@ -157,6 +167,8 @@ type WebsiteCAObtain struct {
 	Description string `json:"description"`
 	ExecShell   bool   `json:"execShell"`
 	Shell       string `json:"shell"`
+	PushNode    bool   `json:"pushNode"`
+	Nodes       string `json:"nodes"`
 }
 
 type WebsiteCARenew struct {
@@ -167,4 +179,6 @@ type WebsiteSSLFileUpload struct {
 	Type        string `json:"type"`
 	Description string `json:"description"`
 	SSLID       uint64 `json:"sslID"`
+	PushNode    bool   `json:"pushNode"`
+	Nodes       string `json:"nodes"`
 }

agent/app/dto/request/website_template.go

@@ -0,0 +1,46 @@
+package request
+
+import (
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+)
+
+type WebsiteTemplateSearch struct {
+	dto.PageInfo
+	Name string `json:"name"`
+	Type string `json:"type"`
+}
+
+type WebsiteTemplateCreate struct {
+	Name      string `json:"name" validate:"required"`
+	Type      string `json:"type" validate:"required,oneof=single multi"`
+	Content   string `json:"content"`
+	FilePath  string `json:"filePath"`
+	Variables string `json:"variables"`
+	Remark    string `json:"remark"`
+}
+
+type WebsiteTemplateUpdate struct {
+	ID        uint   `json:"id" validate:"required"`
+	Name      string `json:"name" validate:"required"`
+	Type      string `json:"type" validate:"required,oneof=single multi"`
+	Content   string `json:"content"`
+	FilePath  string `json:"filePath"`
+	Variables string `json:"variables"`
+	Remark    string `json:"remark"`
+}
+
+type WebsiteTemplateOutputSearch struct {
+	dto.PageInfo
+	TemplateID uint `json:"templateID"`
+}
+
+type WebsiteTemplateOutputCreate struct {
+	TemplateID     uint              `json:"templateID" validate:"required"`
+	Name           string            `json:"name" validate:"required"`
+	VariableValues map[string]string `json:"variableValues"`
+}
+
+type WebsitePreviewReq struct {
+	TemplateID     uint              `json:"templateID" validate:"required"`
+	VariableValues map[string]string `json:"variableValues"`
+}

agent/app/dto/response/app.go

@@ -104,34 +104,36 @@ type AppDetail struct {
 }
 
 type AppInstallDTO struct {
-	ID            uint      `json:"id"`
-	Name          string    `json:"name"`
-	AppID         uint      `json:"appID"`
-	AppDetailID   uint      `json:"appDetailID"`
-	Version       string    `json:"version"`
-	Status        string    `json:"status"`
-	Message       string    `json:"message"`
-	HttpPort      int       `json:"httpPort"`
-	HttpsPort     int       `json:"httpsPort"`
-	Path          string    `json:"path"`
-	CanUpdate     bool      `json:"canUpdate"`
-	Icon          string    `json:"icon"`
-	AppName       string    `json:"appName"`
-	Ready         int       `json:"ready"`
-	Total         int       `json:"total"`
-	AppKey        string    `json:"appKey"`
-	AppType       string    `json:"appType"`
-	AppStatus     string    `json:"appStatus"`
-	DockerCompose string    `json:"dockerCompose"`
-	WebUI         string    `json:"webUI"`
-	CreatedAt     time.Time `json:"createdAt"`
-	Favorite      bool      `json:"favorite"`
-	SortOrder     int       `json:"sortOrder"`
-	App           AppDetail `json:"app"`
-	Container     string    `json:"container"`
-	IsEdit        bool      `json:"isEdit"`
-	LinkDB        bool      `json:"linkDB"`
-	ServiceName   string    `json:"serviceName"`
+	ID            uint                   `json:"id"`
+	Name          string                 `json:"name"`
+	AppID         uint                   `json:"appID"`
+	AppDetailID   uint                   `json:"appDetailID"`
+	Version       string                 `json:"version"`
+	Status        string                 `json:"status"`
+	Message       string                 `json:"message"`
+	HttpPort      int                    `json:"httpPort"`
+	HttpsPort     int                    `json:"httpsPort"`
+	Path          string                 `json:"path"`
+	CanUpdate     bool                   `json:"canUpdate"`
+	Icon          string                 `json:"icon"`
+	AppName       string                 `json:"appName"`
+	Ready         int                    `json:"ready"`
+	Total         int                    `json:"total"`
+	AppKey        string                 `json:"appKey"`
+	AppType       string                 `json:"appType"`
+	AppStatus     string                 `json:"appStatus"`
+	DockerCompose string                 `json:"dockerCompose"`
+	WebUI         string                 `json:"webUI"`
+	CreatedAt     time.Time              `json:"createdAt"`
+	Favorite      bool                   `json:"favorite"`
+	SortOrder     int                    `json:"sortOrder"`
+	App           AppDetail              `json:"app"`
+	Container     string                 `json:"container"`
+	IsEdit        bool                   `json:"isEdit"`
+	LinkDB        bool                   `json:"linkDB"`
+	ResourceKeys  []string               `json:"resourceKeys"`
+	ServiceName   string                 `json:"serviceName"`
+	Env           map[string]interface{} `json:"env"`
 }
 
 type AppInstallInfo struct {

agent/app/dto/response/mcp_server.go

@@ -16,6 +16,12 @@ type McpServerDTO struct {
 	Volumes      []request.Volume      `json:"volumes"`
 }
 
+type McpServerStatusDTO struct {
+	ID      uint   `json:"id"`
+	Status  string `json:"status"`
+	Message string `json:"message"`
+}
+
 type McpBindDomainRes struct {
 	Domain        string   `json:"domain"`
 	SSLID         uint     `json:"sslID"`
@@ -24,3 +30,11 @@ type McpBindDomainRes struct {
 	WebsiteID     uint     `json:"websiteID"`
 	ConnUrl       string   `json:"connUrl"`
 }
+
+type McpServerConnectionTestRes struct {
+	Success         bool   `json:"success"`
+	Endpoint        string `json:"endpoint"`
+	OutputTransport string `json:"outputTransport"`
+	ProtocolVersion string `json:"protocolVersion,omitempty"`
+	Message         string `json:"message"`
+}

agent/app/dto/response/nginx.go

@@ -69,16 +69,25 @@ type NginxProxyCache struct {
 }
 
 type NginxModule struct {
-	Name     string `json:"name"`
-	Script   string `json:"script"`
-	Packages string `json:"packages"`
-	Params   string `json:"params"`
-	Enable   bool   `json:"enable"`
+	Name        string                    `json:"name"`
+	Custom      bool                      `json:"custom"`
+	Script      string                    `json:"script"`
+	Packages    string                    `json:"packages"`
+	Params      string                    `json:"params"`
+	Enable      bool                      `json:"enable"`
+	BuildMode   string                    `json:"buildMode"`
+	Provider    string                    `json:"provider"`
+	LoadOrder   int                       `json:"loadOrder"`
+	BuildStatus string                    `json:"buildStatus"`
+	LoadStatus  string                    `json:"loadStatus"`
+	Artifacts   []dto.NginxModuleArtifact `json:"artifacts"`
+	LastError   string                    `json:"lastError"`
 }
 
 type NginxBuildConfig struct {
-	Mirror  string        `json:"mirror"`
-	Modules []NginxModule `json:"modules"`
+	Mirror           string        `json:"mirror"`
+	DynamicSupported bool          `json:"dynamicSupported"`
+	Modules          []NginxModule `json:"modules"`
 }
 
 type NginxConfigRes struct {

agent/app/dto/response/website_template.go

@@ -0,0 +1,18 @@
+package response
+
+import (
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+)
+
+type WebsiteTemplateDTO struct {
+	model.WebsiteTemplate
+}
+
+type WebsiteTemplateOutputDTO struct {
+	model.WebsiteTemplateOutput
+	TemplateName string `json:"templateName"`
+}
+
+type WebsitePreviewDTO struct {
+	HTML string `json:"html"`
+}

agent/app/dto/runtime_diagnostics.go

@@ -0,0 +1,30 @@
+package dto
+
+import "time"
+
+type RuntimeDiagnosticsSummary struct {
+	RSS         uint64 `json:"rss"`
+	HeapAlloc   uint64 `json:"heapAlloc"`
+	HeapObjects uint64 `json:"heapObjects"`
+	Goroutines  int    `json:"goroutines"`
+}
+
+type RuntimeGoroutineGroup struct {
+	State string   `json:"state"`
+	Top   string   `json:"top"`
+	Count int      `json:"count"`
+	Stack []string `json:"stack"`
+}
+
+type RuntimeGoroutineSnapshot struct {
+	Total      int                     `json:"total"`
+	GroupCount int                     `json:"groupCount"`
+	Truncated  bool                    `json:"truncated"`
+	CapturedAt time.Time               `json:"capturedAt"`
+	Goroutines []RuntimeGoroutineGroup `json:"goroutines"`
+}
+
+type RuntimeProfileCreate struct {
+	Type     string `json:"type" validate:"required,oneof=cpu heap goroutine mutex block"`
+	Duration int    `json:"duration" validate:"omitempty,min=5,max=30"`
+}

agent/app/model/agent_account.go

@@ -7,6 +7,8 @@ type AgentAccount struct {
 	APIKey          string `json:"apiKey"`
 	BaseURL         string `json:"baseUrl"`
 	APIType         string `json:"apiType"`
+	AuthMode        string `json:"authMode"`
+	VerifyModel     string `json:"verifyModel"`
 	RememberAPIKey  bool   `json:"rememberApiKey"`
 	Verified        bool   `json:"verified"`
 	Remark          string `json:"remark"`

agent/app/model/agent_account_model.go

@@ -2,14 +2,10 @@ package model
 
 type AgentAccountModel struct {
 	BaseModel
-	AccountID     uint   `json:"accountId" gorm:"index"`
-	Model         string `json:"model" gorm:"index"`
-	Name          string `json:"name"`
-	ContextWindow int    `json:"contextWindow"`
-	MaxTokens     int    `json:"maxTokens"`
-	Reasoning     bool   `json:"reasoning"`
-	Input         string `json:"input" gorm:"type:text"`
-	SortOrder     int    `json:"sortOrder" gorm:"index"`
+	AccountID uint   `json:"accountId" gorm:"index"`
+	Model     string `json:"model" gorm:"index"`
+	Name      string `json:"name"`
+	SortOrder int    `json:"sortOrder" gorm:"index"`
 }
 
 func (AgentAccountModel) TableName() string {

agent/app/model/backup.go

@@ -31,4 +31,5 @@ type BackupRecord struct {
 	Status      string `json:"status"`
 	Message     string `json:"message"`
 	Description string `json:"description"`
+	Args        string `gorm:"not null;default:''" json:"args"`
 }

agent/app/model/compose_template.go

@@ -11,6 +11,7 @@ type ComposeTemplate struct {
 type Compose struct {
 	BaseModel
 
-	Name string `json:"name"`
-	Path string `json:"path"`
+	Name     string `json:"name"`
+	Path     string `json:"path"`
+	IsPinned bool   `json:"isPinned"`
 }

agent/app/model/database_user.go

@@ -0,0 +1,21 @@
+package model
+
+type DatabaseUser struct {
+	BaseModel
+	Type        string `json:"type" gorm:"not null;uniqueIndex:idx_database_user"`
+	Database    string `json:"database" gorm:"not null;uniqueIndex:idx_database_user"`
+	Username    string `json:"username" gorm:"not null;uniqueIndex:idx_database_user"`
+	Host        string `json:"host" gorm:"uniqueIndex:idx_database_user"`
+	Password    string `json:"password"`
+	Description string `json:"description"`
+	IsDelete    bool   `json:"isDelete"`
+}
+
+type DatabaseUserGrant struct {
+	BaseModel
+	Type     string `json:"type" gorm:"not null;uniqueIndex:idx_database_user_grant"`
+	Database string `json:"database" gorm:"not null;uniqueIndex:idx_database_user_grant"`
+	DBName   string `json:"dbName" gorm:"not null;uniqueIndex:idx_database_user_grant"`
+	Username string `json:"username" gorm:"not null;uniqueIndex:idx_database_user_grant"`
+	Host     string `json:"host" gorm:"not null;uniqueIndex:idx_database_user_grant"`
+}

agent/app/model/ftp.go

@@ -8,4 +8,6 @@ type Ftp struct {
 	Status      string `gorm:"not null" json:"status"`
 	Path        string `gorm:"not null" json:"path"`
 	Description string `gorm:"not null" json:"description"`
+	UID         uint   `gorm:"column:uid;not null;default:1000" json:"-"`
+	GID         uint   `gorm:"column:gid;not null;default:1000" json:"-"`
 }

agent/app/model/mcp_server.go

@@ -18,4 +18,7 @@ type McpServer struct {
 	StreamableHttpPath string `json:"streamableHttpPath"`
 	OutputTransport    string `json:"outputTransport"`
 	Type               string `json:"type"`
+	GatewayImage       string `json:"gatewayImage"`
+	ProtocolVersion    string `json:"protocolVersion"`
+	GatewayArgs        string `json:"gatewayArgs"`
 }

agent/app/model/website_template.go

@@ -0,0 +1,28 @@
+package model
+
+type WebsiteTemplate struct {
+	BaseModel
+	Name      string `gorm:"not null" json:"name"`
+	Type      string `gorm:"not null" json:"type"` // single | multi
+	Content   string `gorm:"type:longtext" json:"content"`
+	FilePath  string `json:"filePath"`
+	Variables string `gorm:"type:text" json:"variables"`
+	Remark    string `json:"remark"`
+}
+
+func (w WebsiteTemplate) TableName() string {
+	return "website_templates"
+}
+
+type WebsiteTemplateOutput struct {
+	BaseModel
+	Name           string `gorm:"not null" json:"name"`
+	TemplateID     uint   `gorm:"not null" json:"templateID"`
+	TemplateType   string `json:"templateType"`
+	VariableValues string `gorm:"type:text" json:"variableValues"`
+	OutputPath     string `json:"outputPath"`
+}
+
+func (w WebsiteTemplateOutput) TableName() string {
+	return "website_template_outputs"
+}

agent/app/provider/catalog.go

@@ -1,319 +1,253 @@
 package provider
 
 import (
+	"fmt"
+	"net/url"
 	"strings"
 )
 
-type Model struct {
-	ID            string
-	Name          string
-	ContextWindow int
-	MaxTokens     int
-	Reasoning     bool
-	Input         []string
+type APIConfig struct {
+	APIType         string
+	BaseURL         string
+	EditableBaseURL bool
+	DiscoverModels  bool
+	DefaultAuthMode string
+	AuthModes       []string
+	Models          []Model
 }
 
-type RuntimeDefault struct {
-	APIType       string
-	ContextWindow int
-	MaxTokens     int
-	Input         []string
+const (
+	AuthModeBearer  = "bearer"
+	AuthModeXAPIKey = "x-api-key"
+)
+
+type Model struct {
+	ID   string
+	Name string
 }
 
 type Meta struct {
 	Key            string
 	DisplayName    string
+	DisplayNameKey string
 	Sort           uint
-	DefaultBaseURL string
+	DefaultAPIType string
+	APIConfigs     []APIConfig
 	EnvKey         string
-	Default        RuntimeDefault
 	Models         []Model
 }
 
 var catalog = map[string]Meta{
 	"custom": {
-		Key:            "custom",
-		DisplayName:    "Custom",
-		Sort:           10,
-		DefaultBaseURL: "",
-		EnvKey:         "CUSTOM_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "openai-completions",
-			ContextWindow: 128000,
-			MaxTokens:     8192,
-			Input:         []string{"text"},
-		},
-		Models: []Model{},
+		Key: "custom", DisplayName: "Custom", Sort: 10, DefaultAPIType: "openai-completions", EnvKey: "CUSTOM_API_KEY",
+		APIConfigs: editableAPIConfigs(true, "openai-completions", "openai-responses", "anthropic-messages", "openai-images", "openai-embeddings"),
 	},
 	"ollama": {
-		Key:         "ollama",
-		DisplayName: "Ollama",
-		Sort:        15,
-		Default: RuntimeDefault{
-			APIType:       "openai-responses",
-			ContextWindow: 160000,
-			MaxTokens:     8192,
-			Input:         []string{"text"},
-		},
+		Key: "ollama", DisplayName: "Ollama", Sort: 15, DefaultAPIType: "openai-responses",
+		APIConfigs: editableAPIConfigs(false, "openai-responses", "openai-completions", "openai-embeddings"),
 	},
 	"vllm": {
-		Key:            "vllm",
-		DisplayName:    "vLLM",
-		Sort:           20,
-		DefaultBaseURL: "",
-		EnvKey:         "VLLM_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "openai-completions",
-			ContextWindow: 128000,
-			MaxTokens:     8192,
-			Input:         []string{"text"},
-		},
-		Models: []Model{},
+		Key: "vllm", DisplayName: "vLLM", Sort: 20, DefaultAPIType: "openai-completions", EnvKey: "VLLM_API_KEY",
+		APIConfigs: editableAPIConfigs(false, "openai-completions", "openai-responses", "anthropic-messages", "openai-images", "openai-embeddings"),
 	},
 	"deepseek": {
-		Key:            "deepseek",
-		DisplayName:    "DeepSeek",
-		Sort:           25,
-		DefaultBaseURL: "https://api.deepseek.com/v1",
-		EnvKey:         "DEEPSEEK_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "openai-completions",
-			ContextWindow: 131072,
-			MaxTokens:     8192,
-			Input:         []string{"text"},
-		},
-		Models: []Model{
-			{ID: "deepseek/deepseek-v4-flash", Name: "deepseek-v4-flash"},
-			{ID: "deepseek/deepseek-v4-pro", Name: "deepseek-v4-pro"},
+		Key: "deepseek", DisplayName: "DeepSeek", Sort: 25, DefaultAPIType: "openai-completions", EnvKey: "DEEPSEEK_API_KEY",
+		APIConfigs: []APIConfig{
+			{APIType: "openai-completions", BaseURL: "https://api.deepseek.com"},
+			{APIType: "openai-responses", BaseURL: "https://api.deepseek.com"},
+			anthropicAPIConfig("https://api.deepseek.com/anthropic", AuthModeXAPIKey),
 		},
+		Models: []Model{{ID: "deepseek-v4-flash", Name: "deepseek-v4-flash"}, {ID: "deepseek-v4-pro", Name: "deepseek-v4-pro"}},
 	},
 	"bailian-coding-plan": {
-		Key:            "bailian-coding-plan",
-		DisplayName:    "阿里云百炼 Coding Plan",
-		Sort:           30,
-		DefaultBaseURL: "https://coding.dashscope.aliyuncs.com/v1",
-		EnvKey:         "QWEN_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "openai-completions",
-			ContextWindow: 256000,
-			MaxTokens:     8192,
-			Input:         []string{"text"},
+		Key: "bailian-coding-plan", DisplayNameKey: "AIProviderBailianCodingPlan", Sort: 30, DefaultAPIType: "openai-completions", EnvKey: "QWEN_API_KEY",
+		APIConfigs: []APIConfig{
+			{APIType: "openai-completions", BaseURL: "https://coding.dashscope.aliyuncs.com/v1"},
+			anthropicAPIConfig("https://coding.dashscope.aliyuncs.com/apps/anthropic", AuthModeBearer),
 		},
 		Models: []Model{
-			{ID: "bailian-coding-plan/qwen3.5-plus", Name: "Qwen3.5-Plus", Reasoning: true},
-			{ID: "bailian-coding-plan/qwen3-max", Name: "Qwen3-Max", Reasoning: true},
-			{ID: "bailian-coding-plan/qwen3-coder-next", Name: "Qwen3-Coder-Next", Reasoning: true},
-			{ID: "bailian-coding-plan/qwen3-coder-plus", Name: "Qwen3-Coder-Plus", Reasoning: true},
-			{ID: "bailian-coding-plan/minimax-m2.5", Name: "MiniMax M2.5", Reasoning: true},
-			{ID: "bailian-coding-plan/glm-5", Name: "GLM-5", Reasoning: true},
-			{ID: "bailian-coding-plan/kimi-k2.5", Name: "Kimi-k2.5", Reasoning: true},
-			{ID: "bailian-coding-plan/glm-4.7", Name: "GLM-4.7", Reasoning: true},
+			{ID: "qwen3-coder-plus", Name: "Qwen3-Coder-Plus"},
+			{ID: "qwen3-max-2026-01-23", Name: "Qwen3-Max-2026-01-23"},
+			{ID: "qwen3-coder-next", Name: "Qwen3-Coder-Next"},
+			{ID: "glm-4.7", Name: "GLM-4.7"},
+			{ID: "kimi-k2.5", Name: "Kimi K2.5"},
+			{ID: "qwen3.5-plus", Name: "Qwen3.5-Plus"},
+			{ID: "glm-5", Name: "GLM-5"},
+			{ID: "MiniMax-M2.5", Name: "MiniMax M2.5"},
+			{ID: "qwen3.6-plus", Name: "Qwen3.6-Plus"},
+			{ID: "qwen3.7-plus", Name: "Qwen3.7-Plus"},
 		},
 	},
 	"ark-coding-plan": {
-		Key:            "ark-coding-plan",
-		DisplayName:    "方舟 Coding Plan",
-		Sort:           35,
-		DefaultBaseURL: "https://ark.cn-beijing.volces.com/api/coding/v3",
-		EnvKey:         "ARK_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "openai-completions",
-			ContextWindow: 256000,
-			MaxTokens:     4096,
-			Input:         []string{"text"},
+		Key: "ark-coding-plan", DisplayNameKey: "AIProviderArkCodingPlan", Sort: 35, DefaultAPIType: "openai-completions", EnvKey: "ARK_API_KEY",
+		APIConfigs: []APIConfig{
+			{APIType: "openai-completions", BaseURL: "https://ark.cn-beijing.volces.com/api/coding/v3"},
+			anthropicAPIConfig("https://ark.cn-beijing.volces.com/api/coding", AuthModeBearer),
 		},
 		Models: []Model{
-			{ID: "ark-coding-plan/ark-code-latest", Name: "Ark Coding Plan", ContextWindow: 256000, MaxTokens: 4096},
-			{ID: "ark-coding-plan/doubao-seed-code", Name: "Doubao Seed Code", ContextWindow: 256000, MaxTokens: 4096},
-			{ID: "ark-coding-plan/glm-4.7", Name: "GLM 4.7 Coding", ContextWindow: 200000, MaxTokens: 4096},
-			{ID: "ark-coding-plan/kimi-k2-thinking", Name: "Kimi K2 Thinking", ContextWindow: 256000, MaxTokens: 4096},
-			{ID: "ark-coding-plan/kimi-k2.5", Name: "Kimi K2.5 Coding", ContextWindow: 256000, MaxTokens: 4096},
-			{ID: "ark-coding-plan/doubao-seed-code-preview-251028", Name: "Doubao Seed Code Preview", ContextWindow: 256000, MaxTokens: 4096},
+			{ID: "ark-code-latest", Name: "Ark Coding Plan"}, {ID: "doubao-seed-code", Name: "Doubao Seed Code"},
+			{ID: "glm-4.7", Name: "GLM 4.7 Coding"}, {ID: "kimi-k2-thinking", Name: "Kimi K2 Thinking"},
+			{ID: "kimi-k2.5", Name: "Kimi K2.5 Coding"}, {ID: "doubao-seed-code-preview-251028", Name: "Doubao Seed Code Preview"},
 		},
 	},
 	"zai": {
-		Key:            "zai",
-		DisplayName:    "Z.ai",
-		Sort:           40,
-		DefaultBaseURL: "https://open.bigmodel.cn/api/paas/v4",
-		EnvKey:         "ZAI_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "openai-completions",
-			ContextWindow: 204800,
-			MaxTokens:     131072,
-			Input:         []string{"text"},
-		},
-		Models: []Model{
-			{ID: "zai/glm-5", Name: "GLM-5", Reasoning: true},
-			{ID: "zai/glm-4.7", Name: "GLM-4.7", Reasoning: true},
-			{ID: "zai/glm-4.7-flash", Name: "GLM-4.7-Flash", Reasoning: true},
-			{ID: "zai/glm-4.7-flashx", Name: "GLM-4.7-FlashX", Reasoning: true},
+		Key: "zai", DisplayName: "Z.ai", Sort: 40, DefaultAPIType: "openai-completions", EnvKey: "ZAI_API_KEY",
+		APIConfigs: []APIConfig{
+			{APIType: "openai-completions", BaseURL: "https://open.bigmodel.cn/api/paas/v4", EditableBaseURL: true},
+			{APIType: "openai-images", BaseURL: "https://open.bigmodel.cn/api/paas/v4", EditableBaseURL: true},
 		},
+		Models: []Model{{ID: "glm-5", Name: "GLM-5"}, {ID: "glm-4.7", Name: "GLM-4.7"}, {ID: "glm-4.7-flash", Name: "GLM-4.7-Flash"}, {ID: "glm-4.7-flashx", Name: "GLM-4.7-FlashX"}},
 	},
 	"minimax": {
-		Key:            "minimax",
-		DisplayName:    "MiniMax (CN)",
-		Sort:           45,
-		DefaultBaseURL: "https://api.minimaxi.com/anthropic",
-		EnvKey:         "MINIMAX_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "anthropic-messages",
-			ContextWindow: 200000,
-			MaxTokens:     8192,
-			Input:         []string{"text"},
-		},
-		Models: []Model{
-			{ID: "minimax/MiniMax-M2.7", Name: "MiniMax M2.7"},
-			{ID: "minimax/MiniMax-M2.7-highspeed", Name: "MiniMax M2.7 highspeed"},
-			{ID: "minimax/MiniMax-M2.5", Name: "MiniMax M2.5", Reasoning: true},
-			{ID: "minimax/MiniMax-M2.5-highspeed", Name: "MiniMax M2.5 highspeed"},
+		Key: "minimax", DisplayName: "MiniMax (CN)", Sort: 45, DefaultAPIType: "anthropic-messages", EnvKey: "MINIMAX_API_KEY",
+		APIConfigs: []APIConfig{
+			anthropicAPIConfig("https://api.minimaxi.com/anthropic", AuthModeXAPIKey, AuthModeBearer),
+			{APIType: "openai-completions", BaseURL: "https://api.minimaxi.com/v1"},
+			{APIType: "minimax-images", BaseURL: "https://api.minimaxi.com"},
 		},
+		Models: []Model{{ID: "MiniMax-M3", Name: "MiniMax M3"}, {ID: "MiniMax-M2.7", Name: "MiniMax M2.7"}, {ID: "MiniMax-M2.7-highspeed", Name: "MiniMax M2.7 highspeed"}},
 	},
 	"xiaomi": {
-		Key:            "xiaomi",
-		DisplayName:    "Xiaomi",
-		Sort:           46,
-		DefaultBaseURL: "https://api.xiaomimimo.com/v1",
-		EnvKey:         "XIAOMI_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "openai-completions",
-			ContextWindow: 262144,
-			MaxTokens:     8192,
-			Input:         []string{"text"},
-		},
-		Models: []Model{
-			{ID: "xiaomi/mimo-v2-flash", Name: "Xiaomi MiMo V2 Flash", ContextWindow: 262144, MaxTokens: 8192, Input: []string{"text"}},
-			{ID: "xiaomi/mimo-v2-pro", Name: "Xiaomi MiMo V2 Pro", ContextWindow: 1048576, MaxTokens: 32000, Reasoning: true, Input: []string{"text"}},
-			{ID: "xiaomi/mimo-v2-omni", Name: "Xiaomi MiMo V2 Omni", ContextWindow: 262144, MaxTokens: 32000, Reasoning: true, Input: []string{"text", "image"}},
+		Key: "xiaomi", DisplayName: "Xiaomi", Sort: 46, DefaultAPIType: "openai-completions", EnvKey: "XIAOMI_API_KEY",
+		APIConfigs: []APIConfig{
+			{APIType: "openai-completions", BaseURL: "https://api.xiaomimimo.com/v1"},
+			{APIType: "openai-responses", BaseURL: "https://api.xiaomimimo.com/v1"},
+			anthropicAPIConfig("https://api.xiaomimimo.com/anthropic", AuthModeBearer),
 		},
+		Models: []Model{{ID: "mimo-v2.5", Name: "Xiaomi MiMo V2.5"}, {ID: "mimo-v2.5-pro", Name: "Xiaomi MiMo V2.5 Pro"}},
 	},
 	"kimi": {
-		Key:            "kimi",
-		DisplayName:    "Kimi (CN)",
-		Sort:           50,
-		DefaultBaseURL: "https://api.moonshot.cn/v1",
-		EnvKey:         "KIMI_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "openai-completions",
-			ContextWindow: 256000,
-			MaxTokens:     8192,
-			Input:         []string{"text", "image"},
-		},
-		Models: []Model{
-			{ID: "kimi/kimi-k2.5", Name: "Kimi K2.5", Reasoning: true},
-			{ID: "kimi/kimi-k2-0905-preview", Name: "Kimi K2 0905 Preview"},
-			{ID: "kimi/kimi-k2-thinking", Name: "Kimi K2 Thinking", Reasoning: true},
-		},
+		Key: "kimi", DisplayName: "Kimi (CN)", Sort: 50, DefaultAPIType: "openai-completions", EnvKey: "KIMI_API_KEY",
+		APIConfigs: []APIConfig{{APIType: "openai-completions", BaseURL: "https://api.moonshot.cn/v1"}},
+		Models:     []Model{{ID: "kimi-k2.5", Name: "Kimi K2.5"}, {ID: "kimi-k2-0905-preview", Name: "Kimi K2 0905 Preview"}, {ID: "kimi-k2-thinking", Name: "Kimi K2 Thinking"}},
 	},
 	"kimi-coding": {
-		Key:            "kimi-coding",
-		DisplayName:    "Kimi Coding",
-		Sort:           51,
-		DefaultBaseURL: "https://api.kimi.com/coding/",
-		EnvKey:         "KIMI_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "anthropic-messages",
-			ContextWindow: 262144,
-			MaxTokens:     32768,
-			Input:         []string{"text", "image"},
-		},
-		Models: []Model{
-			{ID: "kimi-coding/kimi-code", Name: "Kimi Code", ContextWindow: 262144, MaxTokens: 32768, Reasoning: true, Input: []string{"text", "image"}},
-			{ID: "kimi-coding/k2p5", Name: "Kimi K2.5", ContextWindow: 262144, MaxTokens: 32768, Reasoning: true, Input: []string{"text", "image"}},
-		},
+		Key: "kimi-coding", DisplayName: "Kimi Coding", Sort: 51, DefaultAPIType: "anthropic-messages", EnvKey: "KIMI_API_KEY",
+		APIConfigs: []APIConfig{anthropicAPIConfig("https://api.kimi.com/coding/", AuthModeXAPIKey)},
+		Models:     []Model{{ID: "kimi-code", Name: "Kimi Code"}, {ID: "k2p5", Name: "Kimi K2.5"}},
 	},
 	"openai": {
-		Key:            "openai",
-		DisplayName:    "OpenAI",
-		Sort:           55,
-		DefaultBaseURL: "https://api.openai.com/v1",
-		EnvKey:         "OPENAI_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "openai-responses",
-			ContextWindow: 272000,
-			MaxTokens:     128000,
-			Input:         []string{"text", "image"},
-		},
-		Models: []Model{
-			{ID: "openai/gpt-5.4", Name: "gpt-5.4", ContextWindow: 272000, MaxTokens: 128000, Reasoning: true, Input: []string{"text", "image"}},
-			{ID: "openai/gpt-5.4-pro", Name: "gpt-5.4-pro", ContextWindow: 1050000, MaxTokens: 128000, Reasoning: true, Input: []string{"text", "image"}},
-			{ID: "openai/gpt-5.4-mini", Name: "gpt-5.4-mini", ContextWindow: 400000, MaxTokens: 128000, Reasoning: true, Input: []string{"text", "image"}},
-			{ID: "openai/gpt-5.4-nano", Name: "gpt-5.4-nano", ContextWindow: 400000, MaxTokens: 128000, Reasoning: true, Input: []string{"text", "image"}},
+		Key: "openai", DisplayName: "OpenAI", Sort: 55, DefaultAPIType: "openai-responses", EnvKey: "OPENAI_API_KEY",
+		APIConfigs: []APIConfig{
+			{APIType: "openai-responses", BaseURL: "https://api.openai.com/v1"},
+			{APIType: "openai-completions", BaseURL: "https://api.openai.com/v1"},
+			{APIType: "openai-images", BaseURL: "https://api.openai.com/v1"},
+			{APIType: "openai-embeddings", BaseURL: "https://api.openai.com/v1", Models: []Model{
+				{ID: "text-embedding-3-small", Name: "text-embedding-3-small"},
+				{ID: "text-embedding-3-large", Name: "text-embedding-3-large"},
+			}},
 		},
+		Models: []Model{{ID: "gpt-5.4", Name: "gpt-5.4"}, {ID: "gpt-5.4-pro", Name: "gpt-5.4-pro"}, {ID: "gpt-5.4-mini", Name: "gpt-5.4-mini"}, {ID: "gpt-5.4-nano", Name: "gpt-5.4-nano"}},
 	},
 	"openrouter": {
-		Key:            "openrouter",
-		DisplayName:    "OpenRouter",
-		Sort:           56,
-		DefaultBaseURL: "https://openrouter.ai/api/v1",
-		EnvKey:         "OPENROUTER_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "openai-completions",
-			ContextWindow: 128000,
-			MaxTokens:     8192,
-			Input:         []string{"text"},
-		},
-		Models: []Model{
-			{ID: "openrouter/free", Name: "openrouter/free"},
-			{ID: "openrouter/auto", Name: "openrouter/auto"},
+		Key: "openrouter", DisplayName: "OpenRouter", Sort: 56, DefaultAPIType: "openai-completions", EnvKey: "OPENROUTER_API_KEY",
+		APIConfigs: []APIConfig{
+			{APIType: "openai-completions", BaseURL: "https://openrouter.ai/api/v1"},
+			{APIType: "openrouter-images", BaseURL: "https://openrouter.ai"},
 		},
+		Models: []Model{{ID: "openrouter/free", Name: "openrouter/free"}, {ID: "openrouter/auto", Name: "openrouter/auto"}},
 	},
 	"anthropic": {
-		Key:            "anthropic",
-		DisplayName:    "Anthropic",
-		Sort:           60,
-		DefaultBaseURL: "https://api.anthropic.com",
-		EnvKey:         "ANTHROPIC_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "anthropic-messages",
-			ContextWindow: 256000,
-			MaxTokens:     8192,
-			Input:         []string{"text", "image"},
-		},
-		Models: []Model{
-			{ID: "anthropic/claude-sonnet-4-6", Name: "Claude Sonnet 4.6", Reasoning: true},
-			{ID: "anthropic/claude-opus-4-6", Name: "Claude Opus 4.6", Reasoning: true},
-			{ID: "anthropic/claude-opus-4-5", Name: "Claude Opus 4.5"},
-			{ID: "anthropic/claude-sonnet-4-5", Name: "Claude Sonnet 4.5"},
-			{ID: "anthropic/claude-haiku-4-5", Name: "Claude Haiku 4.5"},
-		},
+		Key: "anthropic", DisplayName: "Anthropic", Sort: 60, DefaultAPIType: "anthropic-messages", EnvKey: "ANTHROPIC_API_KEY",
+		APIConfigs: []APIConfig{anthropicAPIConfig("https://api.anthropic.com", AuthModeXAPIKey)},
+		Models:     []Model{{ID: "claude-sonnet-4-6", Name: "Claude Sonnet 4.6"}, {ID: "claude-opus-4-6", Name: "Claude Opus 4.6"}, {ID: "claude-opus-4-5", Name: "Claude Opus 4.5"}, {ID: "claude-sonnet-4-5", Name: "Claude Sonnet 4.5"}, {ID: "claude-haiku-4-5", Name: "Claude Haiku 4.5"}},
 	},
 	"gemini": {
-		Key:            "gemini",
-		DisplayName:    "Gemini",
-		Sort:           65,
-		DefaultBaseURL: "https://generativelanguage.googleapis.com",
-		EnvKey:         "GEMINI_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "openai-completions",
-			ContextWindow: 256000,
-			MaxTokens:     8192,
-			Input:         []string{"text", "image"},
-		},
-		Models: []Model{
-			{ID: "google/gemini-3-flash-preview", Name: "Gemini 3 Flash Preview", Reasoning: true},
-			{ID: "google/gemini-flash-latest", Name: "Gemini Flash Latest"},
-			{ID: "google/gemini-3-pro-preview", Name: "Gemini 3 Pro Preview", Reasoning: true},
-		},
+		Key: "gemini", DisplayName: "Gemini", Sort: 65, DefaultAPIType: "gemini-generate-content", EnvKey: "GEMINI_API_KEY",
+		APIConfigs: []APIConfig{{APIType: "gemini-generate-content", BaseURL: "https://generativelanguage.googleapis.com"}},
+		Models:     []Model{{ID: "gemini-3-flash-preview", Name: "Gemini 3 Flash Preview"}, {ID: "gemini-flash-latest", Name: "Gemini Flash Latest"}, {ID: "gemini-3-pro-preview", Name: "Gemini 3 Pro Preview"}},
 	},
 	"moonshot": {
-		Key:            "moonshot",
-		DisplayName:    "Moonshot (Global)",
-		Sort:           70,
-		DefaultBaseURL: "https://api.moonshot.ai/v1",
-		EnvKey:         "MOONSHOT_API_KEY",
-		Default: RuntimeDefault{
-			APIType:       "openai-completions",
-			ContextWindow: 256000,
-			MaxTokens:     8192,
-			Input:         []string{"text"},
-		},
-		Models: []Model{
-			{ID: "moonshot/kimi-k2.5", Name: "Kimi K2.5", Reasoning: true},
-			{ID: "moonshot/kimi-k2-0905-preview", Name: "Kimi K2 0905 Preview"},
-			{ID: "moonshot/kimi-k2-thinking", Name: "Kimi K2 Thinking", Reasoning: true},
+		Key: "moonshot", DisplayName: "Moonshot (Global)", Sort: 70, DefaultAPIType: "openai-completions", EnvKey: "MOONSHOT_API_KEY",
+		APIConfigs: []APIConfig{{APIType: "openai-completions", BaseURL: "https://api.moonshot.ai/v1"}},
+		Models:     []Model{{ID: "kimi-k2.5", Name: "Kimi K2.5"}, {ID: "kimi-k2-0905-preview", Name: "Kimi K2 0905 Preview"}, {ID: "kimi-k2-thinking", Name: "Kimi K2 Thinking"}},
+	},
+	"bailian": {
+		Key: "bailian", DisplayNameKey: "AIProviderBailian", Sort: 31, DefaultAPIType: "openai-completions", EnvKey: "DASHSCOPE_API_KEY",
+		APIConfigs: []APIConfig{
+			{
+				APIType: "openai-completions", BaseURL: "https://dashscope.aliyuncs.com/compatible-mode/v1",
+				DiscoverModels: true,
+				Models:         []Model{{ID: "qwen3.7-plus", Name: "qwen3.7-plus"}, {ID: "qwen3.6-plus", Name: "qwen3.6-plus"}, {ID: "qwen3.6-flash", Name: "qwen3.6-flash"}},
+			},
+			{
+				APIType: "openai-responses", BaseURL: "https://dashscope.aliyuncs.com/compatible-mode/v1",
+				DiscoverModels: true,
+				Models:         []Model{{ID: "qwen3.7-plus", Name: "qwen3.7-plus"}, {ID: "qwen3.6-plus", Name: "qwen3.6-plus"}, {ID: "qwen3.6-flash", Name: "qwen3.6-flash"}},
+			},
+			{
+				APIType: "anthropic-messages", BaseURL: "https://dashscope.aliyuncs.com/apps/anthropic",
+				DefaultAuthMode: AuthModeBearer,
+				AuthModes:       []string{AuthModeBearer},
+				Models:          []Model{{ID: "qwen3.7-plus", Name: "qwen3.7-plus"}, {ID: "qwen3.6-plus", Name: "qwen3.6-plus"}, {ID: "qwen3.6-flash", Name: "qwen3.6-flash"}},
+			},
+			{
+				APIType: "dashscope-images", BaseURL: "https://dashscope.aliyuncs.com",
+				Models: []Model{
+					{ID: "qwen-image-2.0-pro", Name: "qwen-image-2.0-pro"},
+					{ID: "qwen-image-2.0", Name: "qwen-image-2.0"},
+					{ID: "wan2.7-image-pro", Name: "wan2.7-image-pro"},
+					{ID: "wan2.7-image", Name: "wan2.7-image"},
+				},
+			},
 		},
 	},
+	"ark": {
+		Key: "ark", DisplayNameKey: "AIProviderArk", Sort: 36, DefaultAPIType: "openai-completions", EnvKey: "ARK_API_KEY",
+		APIConfigs: []APIConfig{
+			{
+				APIType: "openai-completions", BaseURL: "https://ark.cn-beijing.volces.com/api/v3",
+				DiscoverModels: true,
+				Models:         []Model{{ID: "doubao-seed-2-0-pro-260215", Name: "doubao-seed-2-0-pro-260215"}, {ID: "doubao-seed-2-0-lite-260215", Name: "doubao-seed-2-0-lite-260215"}},
+			},
+			{
+				APIType: "openai-responses", BaseURL: "https://ark.cn-beijing.volces.com/api/v3",
+				DiscoverModels: true,
+				Models:         []Model{{ID: "doubao-seed-2-0-pro-260215", Name: "doubao-seed-2-0-pro-260215"}, {ID: "doubao-seed-2-0-lite-260215", Name: "doubao-seed-2-0-lite-260215"}},
+			},
+			{
+				APIType: "openai-images", BaseURL: "https://ark.cn-beijing.volces.com/api/v3",
+				Models: []Model{
+					{ID: "doubao-seedream-5-0-260128", Name: "doubao-seedream-5-0-260128"},
+					{ID: "doubao-seedream-5-0-lite-260128", Name: "doubao-seedream-5-0-lite-260128"},
+					{ID: "doubao-seedream-4-5-251128", Name: "doubao-seedream-4-5-251128"},
+				},
+			},
+		},
+	},
+}
+
+func editableAPIConfigs(discoverModels bool, apiTypes ...string) []APIConfig {
+	configs := make([]APIConfig, 0, len(apiTypes))
+	for _, apiType := range apiTypes {
+		if apiType == "anthropic-messages" {
+			config := anthropicAPIConfig("", AuthModeXAPIKey, AuthModeBearer)
+			config.EditableBaseURL = true
+			configs = append(configs, config)
+			continue
+		}
+		configs = append(configs, APIConfig{
+			APIType:         apiType,
+			EditableBaseURL: true,
+			DiscoverModels:  discoverModels && (apiType == "openai-completions" || apiType == "openai-responses"),
+		})
+	}
+	return configs
+}
+
+func anthropicAPIConfig(baseURL, defaultAuthMode string, additionalAuthModes ...string) APIConfig {
+	authModes := []string{defaultAuthMode}
+	for _, authMode := range additionalAuthModes {
+		if authMode != defaultAuthMode {
+			authModes = append(authModes, authMode)
+		}
+	}
+	return APIConfig{
+		APIType:         "anthropic-messages",
+		BaseURL:         baseURL,
+		DefaultAuthMode: defaultAuthMode,
+		AuthModes:       authModes,
+	}
 }
 
 func Get(key string) (Meta, bool) {
@@ -332,12 +266,148 @@ func All() map[string]Meta {
 	return result
 }
 
-func DefaultBaseURL(key string) (string, bool) {
+func FindAPIConfig(key, apiType string) (APIConfig, bool) {
 	meta, ok := catalog[key]
-	if !ok || strings.TrimSpace(meta.DefaultBaseURL) == "" {
+	if !ok {
+		return APIConfig{}, false
+	}
+	target := strings.TrimSpace(apiType)
+	if target == "" {
+		target = meta.DefaultAPIType
+	}
+	for _, config := range meta.APIConfigs {
+		if config.APIType == target {
+			config.AuthModes = append([]string(nil), config.AuthModes...)
+			config.Models = append([]Model(nil), config.Models...)
+			return config, true
+		}
+	}
+	return APIConfig{}, false
+}
+
+func DefaultModels(key, apiType string) []Model {
+	meta, ok := catalog[key]
+	if !ok {
+		return nil
+	}
+	target := strings.TrimSpace(apiType)
+	if target == "" {
+		target = meta.DefaultAPIType
+	}
+	for _, config := range meta.APIConfigs {
+		if config.APIType != target {
+			continue
+		}
+		if len(config.Models) > 0 {
+			return append([]Model(nil), config.Models...)
+		}
+		if IsImageAPIType(config.APIType) || IsEmbeddingAPIType(config.APIType) {
+			return nil
+		}
+		break
+	}
+	return append([]Model(nil), meta.Models...)
+}
+
+func ResolveAuthMode(provider, apiType, requested string) (string, error) {
+	config, ok := FindAPIConfig(provider, apiType)
+	if !ok {
+		return "", fmt.Errorf("provider %s does not support api type %s", provider, apiType)
+	}
+	if config.APIType != "anthropic-messages" {
+		return "", nil
+	}
+	authMode := strings.TrimSpace(requested)
+	if authMode == "" {
+		authMode = config.DefaultAuthMode
+	}
+	for _, allowed := range config.AuthModes {
+		if authMode == allowed {
+			return authMode, nil
+		}
+	}
+	return "", fmt.Errorf("provider %s does not support auth mode %s", provider, authMode)
+}
+
+func DefaultBaseURL(key string) (string, bool) {
+	config, ok := FindAPIConfig(key, "")
+	if !ok || strings.TrimSpace(config.BaseURL) == "" {
 		return "", false
 	}
-	return meta.DefaultBaseURL, true
+	return config.BaseURL, true
+}
+
+func DefaultAPIType(key string) string {
+	meta, ok := catalog[key]
+	if !ok || strings.TrimSpace(meta.DefaultAPIType) == "" {
+		return "openai-completions"
+	}
+	return meta.DefaultAPIType
+}
+
+func ResolveBaseURL(key, apiType, requested string) (string, error) {
+	config, ok := FindAPIConfig(key, apiType)
+	if !ok {
+		return "", fmt.Errorf("provider %s does not support api type %s", key, apiType)
+	}
+	if !config.EditableBaseURL {
+		return strings.TrimRight(config.BaseURL, "/"), nil
+	}
+	baseURL := strings.TrimSpace(requested)
+	if baseURL == "" {
+		baseURL = config.BaseURL
+	}
+	if baseURL == "" {
+		return "", fmt.Errorf("base url is required")
+	}
+	parsed, err := url.Parse(baseURL)
+	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
+		return "", fmt.Errorf("invalid base url")
+	}
+	if key == "custom" && (IsImageAPIType(config.APIType) || IsEmbeddingAPIType(config.APIType)) {
+		return baseURL, nil
+	}
+	parsed.Path = normalizeEndpointPath(config.APIType, parsed.Path)
+	parsed.RawQuery = ""
+	parsed.Fragment = ""
+	return strings.TrimRight(parsed.String(), "/"), nil
+}
+
+func normalizeEndpointPath(apiType, value string) string {
+	if IsImageAPIType(apiType) {
+		return strings.TrimRight(value, "/")
+	}
+	path := strings.TrimRight(value, "/")
+	suffixes := []string{}
+	switch apiType {
+	case "openai-completions":
+		suffixes = []string{"/chat/completions"}
+	case "openai-responses":
+		suffixes = []string{"/responses"}
+	case "anthropic-messages":
+		suffixes = []string{"/v1/messages", "/messages"}
+	case "openai-embeddings":
+		suffixes = []string{"/v1/embeddings", "/embeddings"}
+	}
+	for _, suffix := range suffixes {
+		if strings.HasSuffix(strings.ToLower(path), suffix) {
+			return path[:len(path)-len(suffix)]
+		}
+	}
+	return path
+}
+
+func IsEmbeddingAPIType(apiType string) bool {
+	return apiType == "openai-embeddings"
+}
+
+func IsImageAPIType(apiType string) bool {
+	switch apiType {
+	case "openai-images", "dashscope-images", "minimax-images", "openrouter-images":
+		return true
+	default:
+		return false
+	}
 }
 
 func EnvKey(key string) string {
@@ -350,89 +420,61 @@ func EnvKey(key string) string {
 
 func DisplayName(key string) string {
 	meta, ok := catalog[key]
-	if !ok {
-		return key
-	}
-	if strings.TrimSpace(meta.DisplayName) == "" {
+	if !ok || strings.TrimSpace(meta.DisplayName) == "" {
 		return key
 	}
 	return meta.DisplayName
 }
 
-func FindModel(key, modelID string) (Model, bool) {
-	meta, ok := Get(key)
+func DisplayNameKey(key string) string {
+	meta, ok := catalog[key]
 	if !ok {
-		return Model{}, false
+		return ""
 	}
-	for _, item := range meta.Models {
-		if item.ID == modelID {
-			return item, true
+	return meta.DisplayNameKey
+}
+
+func NormalizeModelID(provider, modelID string) string {
+	target := strings.TrimLeft(strings.TrimSpace(modelID), "/")
+	for _, prefix := range legacyModelPrefixes[provider] {
+		legacyPrefix := prefix + "/"
+		if !strings.HasPrefix(target, legacyPrefix) {
+			continue
+		}
+		candidate := strings.TrimSpace(strings.TrimPrefix(target, legacyPrefix))
+		if candidate != "" {
+			return candidate
 		}
 	}
-	return Model{}, false
+	return target
+}
+
+var legacyModelPrefixes = map[string][]string{
+	"custom":              {"custom"},
+	"vllm":                {"custom"},
+	"ollama":              {"ollama"},
+	"deepseek":            {"deepseek"},
+	"bailian-coding-plan": {"bailian-coding-plan"},
+	"ark-coding-plan":     {"ark-coding-plan"},
+	"zai":                 {"zai"},
+	"minimax":             {"minimax"},
+	"xiaomi":              {"xiaomi"},
+	"kimi":                {"kimi", "moonshot"},
+	"kimi-coding":         {"kimi-coding"},
+	"openai":              {"openai"},
+	"anthropic":           {"anthropic"},
+	"gemini":              {"google", "gemini"},
+	"moonshot":            {"moonshot"},
 }
 
 func cloneMeta(meta Meta) Meta {
 	clone := meta
-	if len(meta.Default.Input) > 0 {
-		clone.Default.Input = make([]string, len(meta.Default.Input))
-		copy(clone.Default.Input, meta.Default.Input)
-	}
-	if len(meta.Models) > 0 {
-		clone.Models = make([]Model, len(meta.Models))
-		for i, item := range meta.Models {
-			clone.Models[i] = normalizeModel(meta, item)
-		}
+	clone.APIConfigs = make([]APIConfig, len(meta.APIConfigs))
+	for index, config := range meta.APIConfigs {
+		clone.APIConfigs[index] = config
+		clone.APIConfigs[index].AuthModes = append([]string(nil), config.AuthModes...)
+		clone.APIConfigs[index].Models = append([]Model(nil), config.Models...)
 	}
+	clone.Models = append([]Model(nil), meta.Models...)
 	return clone
 }
-
-func normalizeModel(meta Meta, model Model) Model {
-	clone := model
-	clone.ID = strings.TrimSpace(clone.ID)
-	clone.Name = strings.TrimSpace(clone.Name)
-	if clone.Name == "" {
-		clone.Name = clone.ID
-	}
-	if clone.MaxTokens <= 0 {
-		clone.MaxTokens = meta.Default.MaxTokens
-	}
-	if clone.ContextWindow <= 0 {
-		clone.ContextWindow = meta.Default.ContextWindow
-	}
-	if len(clone.Input) == 0 && len(meta.Default.Input) > 0 {
-		clone.Input = make([]string, len(meta.Default.Input))
-		copy(clone.Input, meta.Default.Input)
-	}
-	return clone
-}
-
-func ResolveRuntimeParams(provider, apiType string, maxTokens, contextWindow int) (string, int, int) {
-	defaultAPIType := "openai-completions"
-	defaultMaxTokens := 8192
-	defaultContextWindow := 256000
-	if meta, ok := Get(provider); ok {
-		if meta.Default.APIType != "" {
-			defaultAPIType = meta.Default.APIType
-		}
-		if meta.Default.MaxTokens > 0 {
-			defaultMaxTokens = meta.Default.MaxTokens
-		}
-		if meta.Default.ContextWindow > 0 {
-			defaultContextWindow = meta.Default.ContextWindow
-		}
-	}
-	resolvedAPI := apiType
-	if strings.TrimSpace(apiType) == "" {
-		resolvedAPI = defaultAPIType
-	}
-	resolvedMaxTokens := defaultMaxTokens
-	resolvedContextWindow := defaultContextWindow
-	if maxTokens > 0 {
-		resolvedMaxTokens = maxTokens
-	}
-	if contextWindow > 0 {
-		resolvedContextWindow = contextWindow
-	}
-	return resolvedAPI, resolvedMaxTokens, resolvedContextWindow
-}

agent/app/provider/discover.go

@@ -0,0 +1,74 @@
+package provider
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+)
+
+func DiscoverModels(baseURL, apiKey string) ([]string, error) {
+	req, err := http.NewRequest(http.MethodGet, buildModelDiscoveryURL(baseURL), nil)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Authorization", "Bearer "+apiKey)
+	resp, err := (&http.Client{Timeout: defaultVerifyTimeout}).Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= http.StatusBadRequest {
+		return nil, fmt.Errorf("request failed: %s", resp.Status)
+	}
+	var payload struct {
+		Data []struct {
+			ID string `json:"id"`
+		} `json:"data"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&payload); err != nil {
+		return nil, err
+	}
+	models := make([]string, 0, len(payload.Data))
+	seen := make(map[string]struct{}, len(payload.Data))
+	for _, item := range payload.Data {
+		id := strings.TrimSpace(item.ID)
+		if id == "" {
+			continue
+		}
+		if _, ok := seen[id]; ok {
+			continue
+		}
+		seen[id] = struct{}{}
+		models = append(models, id)
+	}
+	if len(models) == 0 {
+		return nil, fmt.Errorf("no models found")
+	}
+	return models, nil
+}
+
+func buildModelDiscoveryURL(baseURL string) string {
+	base := strings.TrimRight(strings.TrimSpace(baseURL), "/")
+	for _, apiType := range []string{"openai-completions", "openai-responses", "anthropic-messages"} {
+		base = normalizeEndpointPath(apiType, base)
+	}
+	switch {
+	case strings.HasSuffix(base, "/models"):
+		return base
+	case hasAPIVersionSuffix(base):
+		return base + "/models"
+	default:
+		return base + "/v1/models"
+	}
+}
+
+func hasAPIVersionSuffix(value string) bool {
+	segment := value[strings.LastIndex(value, "/")+1:]
+	if len(segment) < 2 || segment[0] != 'v' {
+		return false
+	}
+	_, err := strconv.Atoi(segment[1:])
+	return err == nil
+}

agent/app/provider/openclaw.go

@@ -15,72 +15,52 @@ type OpenClawProviderPatch struct {
 	AuthHeader   bool
 }
 
-func BuildOpenClawProviderPatch(provider, modelName, apiType, baseURL, apiKey string) (*OpenClawProviderPatch, error) {
+func BuildOpenClawProviderPatch(provider, modelName, apiType, authMode, baseURL, apiKey string) (*OpenClawProviderPatch, error) {
 	if modelName == "" {
 		return nil, fmt.Errorf("model is required")
 	}
-	resolvedAPIType, _, _ := ResolveRuntimeParams(provider, apiType, 0, 0)
-	modelID := resolveOpenClawModelID(provider, modelName)
-	switch provider {
-	case "deepseek":
-		return newOpenClawProviderPatch(modelName, "deepseek", modelID, apiKey, baseURL, "openai-completions", false), nil
-	case "gemini":
-		return newOpenClawProviderPatch("google/"+modelID, "google", modelID, apiKey, baseURL, resolvedAPIType, false), nil
-	case "moonshot", "kimi":
-		return buildMoonshotProviderPatch(provider, modelName, modelID, baseURL, apiKey), nil
-	case "bailian-coding-plan":
-		return newOpenClawProviderPatch("bailian-coding-plan/"+modelID, "bailian-coding-plan", modelID, apiKey, baseURL, "openai-completions", false), nil
-	case "ark-coding-plan":
-		return newOpenClawProviderPatch("ark-coding-plan/"+modelID, "ark-coding-plan", modelID, apiKey, baseURL, "openai-completions", false), nil
-	case "minimax":
-		return newOpenClawProviderPatch("minimax/"+modelID, "minimax", modelID, apiKey, baseURL, "anthropic-messages", true), nil
-	case "xiaomi":
-		return newOpenClawProviderPatch("xiaomi/"+modelID, "xiaomi", modelID, apiKey, baseURL, "openai-completions", false), nil
-	case "custom", "vllm":
-		return newOpenClawProviderPatch(provider+"/"+modelID, provider, modelID, apiKey, baseURL, resolvedAPIType, false), nil
-	case "ollama":
-		return newOpenClawProviderPatch(modelName, "ollama", modelID, "ollama", baseURL, resolvedAPIType, false), nil
-	case "kimi-coding":
-		return newOpenClawProviderPatch(modelName, "kimi-coding", modelID, apiKey, baseURL, "anthropic-messages", false), nil
-	case "zai":
-		return newOpenClawProviderPatch("zai/"+modelID, "zai", modelID, apiKey, baseURL, "openai-completions", false), nil
-	default:
-		return newOpenClawProviderPatch(modelName, provider, modelID, apiKey, baseURL, resolvedAPIType, false), nil
+	resolvedAPIType := apiType
+	if _, ok := FindAPIConfig(provider, resolvedAPIType); !ok {
+		resolvedAPIType = DefaultAPIType(provider)
 	}
-}
-
-func buildMoonshotProviderPatch(provider, modelName, modelID, baseURL, apiKey string) *OpenClawProviderPatch {
+	if IsImageAPIType(resolvedAPIType) || IsEmbeddingAPIType(resolvedAPIType) {
+		return nil, fmt.Errorf("api type %s does not support text generation", resolvedAPIType)
+	}
+	resolvedAuthMode, err := ResolveAuthMode(provider, resolvedAPIType, authMode)
+	if err != nil {
+		return nil, err
+	}
+	usesBearer := resolvedAuthMode == AuthModeBearer
+	modelID := NormalizeModelID(provider, modelName)
 	providerKey := provider
-	primaryModel := modelName
-	if provider == "kimi" {
+	preserveQualifiedModel := false
+	switch provider {
+	case "gemini":
+		providerKey = "google"
+		resolvedAPIType = "google-generative-ai"
+		usesBearer = false
+	case "moonshot", "kimi":
 		providerKey = "moonshot"
-		primaryModel = "moonshot/" + modelID
+		resolvedAPIType = "openai-completions"
+		usesBearer = false
+	case "ollama":
+		apiKey = "ollama"
+		usesBearer = false
+	case "openai", "openrouter", "anthropic":
+		preserveQualifiedModel = strings.Contains(modelName, "/")
 	}
-	return newOpenClawProviderPatch(primaryModel, providerKey, modelID, apiKey, baseURL, "openai-completions", false)
-}
 
-func newOpenClawProviderPatch(primaryModel, providerKey, modelID, apiKey, baseURL, apiType string, authHeader bool) *OpenClawProviderPatch {
+	primaryModel := providerKey + "/" + modelID
+	if preserveQualifiedModel {
+		primaryModel = modelName
+	}
 	return &OpenClawProviderPatch{
 		PrimaryModel: primaryModel,
 		ProviderKey:  providerKey,
 		ModelID:      modelID,
 		APIKey:       apiKey,
 		BaseURL:      baseURL,
-		APIType:      apiType,
-		AuthHeader:   authHeader,
-	}
-}
-
-func resolveOpenClawModelID(provider, modelName string) string {
-	if provider == "custom" || provider == "vllm" {
-		target := strings.TrimLeft(modelName, "/")
-		if parts := strings.SplitN(target, "/", 2); len(parts) == 2 && parts[0] == "custom" {
-			return strings.TrimLeft(parts[1], "/")
-		}
-		return target
-	}
-	if parts := strings.SplitN(modelName, "/", 2); len(parts) == 2 {
-		return parts[1]
-	}
-	return modelName
+		APIType:      resolvedAPIType,
+		AuthHeader:   usesBearer,
+	}, nil
 }

agent/app/provider/verify.go

@@ -3,7 +3,9 @@ package provider
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
+	"io"
 	"net/http"
 	"strings"
 	"time"
@@ -18,160 +20,155 @@ type VerifyRequest struct {
 	Body    []byte
 }
 
-const (
-	defaultVerifyTimeout = 30 * time.Second
-)
+type verifyErrorResponse struct {
+	Error struct {
+		Message string `json:"message"`
+	} `json:"error"`
+	Message string `json:"message"`
+}
 
-func SkipVerification(key string) bool {
-	switch key {
-	case "custom", "vllm", "ollama", "kimi-coding":
+const defaultVerifyTimeout = 30 * time.Second
+
+func SkipVerification(provider string) bool {
+	switch provider {
+	case "vllm", "ollama", "kimi-coding":
 		return true
 	default:
 		return false
 	}
 }
 
-func VerifyAccount(provider, baseURL, apiKey string) error {
-	req := BuildVerifyRequest(provider, baseURL, apiKey)
-	var body *bytes.Buffer
-	if len(req.Body) > 0 {
-		body = bytes.NewBuffer(req.Body)
-	} else {
-		body = bytes.NewBuffer(nil)
-	}
-	httpReq, err := http.NewRequest(req.Method, req.URL, body)
+func VerifyAccount(provider, apiType, authMode, baseURL, apiKey, model string) error {
+	req := BuildVerifyRequest(provider, apiType, authMode, baseURL, apiKey, model)
+	httpReq, err := http.NewRequest(req.Method, req.URL, bytes.NewReader(req.Body))
 	if err != nil {
 		return err
 	}
 	for key, value := range req.Headers {
 		httpReq.Header.Set(key, value)
 	}
-	resp, err := (&http.Client{Timeout: verifyTimeout()}).Do(httpReq)
+	httpReq.Header.Set("Accept", "application/json")
+	resp, err := (&http.Client{Timeout: defaultVerifyTimeout}).Do(httpReq)
 	if err != nil {
 		return buserr.WithErr("ErrAgentAccountUnavailable", err)
 	}
 	defer resp.Body.Close()
-	if resp.StatusCode >= 400 {
-		return buserr.WithErr("ErrAgentAccountUnavailable", fmt.Errorf("verify failed: %s", resp.Status))
+	if resp.StatusCode < http.StatusOK || resp.StatusCode >= http.StatusMultipleChoices {
+		body, readErr := io.ReadAll(io.LimitReader(resp.Body, 1024*1024))
+		if readErr != nil {
+			return buserr.WithErr("ErrAgentAccountUnavailable", readErr)
+		}
+		return buserr.WithErr("ErrAgentAccountUnavailable", errors.New(verifyHTTPError(resp.StatusCode, body)))
 	}
 	return nil
 }
 
-func verifyTimeout() time.Duration {
-	return defaultVerifyTimeout
-}
+func BuildVerifyRequest(provider, apiType, authMode, baseURL, apiKey, model string) VerifyRequest {
+	baseURL = strings.TrimSpace(baseURL)
+	if provider != "custom" || !IsImageAPIType(apiType) {
+		baseURL = strings.TrimRight(baseURL, "/")
+	}
+	headers := map[string]string{"Content-Type": "application/json"}
+	request := VerifyRequest{Method: http.MethodPost, Headers: headers}
 
-func BuildVerifyRequest(provider, baseURL, apiKey string) VerifyRequest {
-	base := strings.TrimRight(strings.TrimSpace(baseURL), "/")
-	headers := map[string]string{}
-	request := VerifyRequest{Method: http.MethodGet, Headers: headers}
-
-	switch provider {
-	case "anthropic", "kimi-coding":
-		headers["x-api-key"] = apiKey
-		headers["anthropic-version"] = "2023-06-01"
-		if strings.Contains(base, "/v1") {
-			request.URL = base + "/models"
-		} else {
-			request.URL = base + "/v1/models"
-		}
-	case "gemini":
-		request.Method = http.MethodPost
-		if strings.Contains(base, "/v1beta") {
-			request.URL = base + "/models/gemini-3-flash-preview:generateContent"
-		} else {
-			request.URL = base + "/v1beta/models/gemini-3-flash-preview:generateContent"
-		}
+	if provider == "gemini" {
+		request.URL = baseURL + "/v1beta/models/" + strings.TrimSpace(model) + ":generateContent"
 		headers["x-goog-api-key"] = apiKey
-		headers["Content-Type"] = "application/json"
 		request.Body = mustJSON(map[string]interface{}{
-			"contents": []map[string]interface{}{{
-				"parts": []map[string]string{{
-					"text": "Explain how AI works in a few words",
-				}},
+			"contents": []map[string]interface{}{{"parts": []map[string]string{{"text": "test"}}}},
+		})
+		return request
+	}
+
+	switch apiType {
+	case "openai-embeddings":
+		request.URL = embeddingVerifyURL(baseURL)
+		headers["Authorization"] = "Bearer " + apiKey
+		request.Body = mustJSON(map[string]interface{}{"model": model, "input": "ping"})
+	case "openai-images":
+		request.URL = imageVerifyURL(provider, baseURL, "/images/generations")
+		headers["Authorization"] = "Bearer " + apiKey
+		request.Body = mustJSON(map[string]interface{}{"model": model, "prompt": "test", "n": 1, "response_format": "url"})
+	case "dashscope-images":
+		request.URL = imageVerifyURL(provider, baseURL, "/api/v1/services/aigc/multimodal-generation/generation")
+		headers["Authorization"] = "Bearer " + apiKey
+		request.Body = mustJSON(map[string]interface{}{
+			"model": model,
+			"input": map[string]interface{}{"messages": []map[string]interface{}{
+				{"role": "user", "content": []map[string]string{{"text": "test"}}},
 			}},
+			"parameters": map[string]interface{}{"n": 1},
 		})
-	case "zai":
-		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
-		request.URL = base + "/models"
-	case "bailian-coding-plan":
-		request.Method = http.MethodPost
-		if !strings.Contains(base, "/v1") {
-			base = base + "/v1"
+	case "minimax-images":
+		request.URL = imageVerifyURL(provider, baseURL, "/v1/image_generation")
+		headers["Authorization"] = "Bearer " + apiKey
+		request.Body = mustJSON(map[string]interface{}{"model": model, "prompt": "test", "n": 1, "response_format": "url"})
+	case "openrouter-images":
+		request.URL = imageVerifyURL(provider, baseURL, "/api/v1/images")
+		headers["Authorization"] = "Bearer " + apiKey
+		request.Body = mustJSON(map[string]interface{}{"model": model, "prompt": "test", "n": 1, "response_format": "url"})
+	case "anthropic-messages":
+		request.URL = baseURL + "/v1/messages"
+		if authMode == AuthModeBearer {
+			headers["Authorization"] = "Bearer " + apiKey
+		} else {
+			headers["x-api-key"] = apiKey
 		}
-		request.URL = base + "/chat/completions"
-		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
-		headers["Content-Type"] = "application/json"
-		request.Body = mustJSON(map[string]interface{}{
-			"model":      "qwen3.5-plus",
-			"messages":   []map[string]string{{"role": "user", "content": "test"}},
-			"max_tokens": 1,
-		})
-	case "ark-coding-plan":
-		request.Method = http.MethodPost
-		if !strings.Contains(base, "/api/coding/v3") {
-			base = "https://ark.cn-beijing.volces.com/api/coding/v3"
-		}
-		request.URL = base + "/chat/completions"
-		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
-		headers["Content-Type"] = "application/json"
-		request.Body = mustJSON(map[string]interface{}{
-			"model":      "ark-code-latest",
-			"messages":   []map[string]string{{"role": "user", "content": "test"}},
-			"max_tokens": 1,
-		})
-	case "minimax":
-		request.Method = http.MethodPost
-		headers["x-api-key"] = apiKey
 		headers["anthropic-version"] = "2023-06-01"
-		headers["Content-Type"] = "application/json"
-		if strings.Contains(base, "/v1") {
-			request.URL = base + "/messages"
-		} else {
-			request.URL = base + "/v1/messages"
-		}
 		request.Body = mustJSON(map[string]interface{}{
-			"model":      "MiniMax-M2.5",
-			"max_tokens": 1,
-			"messages": []map[string]interface{}{{
-				"role": "user",
-				"content": []map[string]string{{
-					"type": "text",
-					"text": "test",
-				}},
-			}},
+			"model": model, "max_tokens": 1, "stream": false,
+			"messages": []map[string]interface{}{{"role": "user", "content": []map[string]string{{"type": "text", "text": "test"}}}},
 		})
-	case "xiaomi":
-		request.Method = http.MethodPost
-		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
-		headers["Content-Type"] = "application/json"
-		if !strings.Contains(base, "/v1") {
-			base = base + "/v1"
-		}
-		request.URL = base + "/chat/completions"
-		request.Body = mustJSON(map[string]interface{}{
-			"model":      "mimo-v2-flash",
-			"max_tokens": 1,
-			"messages":   []map[string]string{{"role": "user", "content": "test"}},
-		})
-	case "openrouter":
-		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
-		if strings.Contains(base, "/v1") {
-			request.URL = base + "/key"
-		} else {
-			request.URL = base + "/v1/key"
-		}
+	case "openai-responses":
+		request.URL = baseURL + "/responses"
+		headers["Authorization"] = "Bearer " + apiKey
+		request.Body = mustJSON(map[string]interface{}{"model": model, "input": "test", "max_output_tokens": 1, "stream": false})
 	default:
-		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
-		if strings.Contains(base, "/v1") {
-			request.URL = base + "/models"
-		} else {
-			request.URL = base + "/v1/models"
+		request.URL = baseURL + "/chat/completions"
+		if provider != "ollama" || strings.TrimSpace(apiKey) != "" {
+			headers["Authorization"] = "Bearer " + apiKey
 		}
+		request.Body = mustJSON(map[string]interface{}{
+			"model": model, "messages": []map[string]string{{"role": "user", "content": "test"}}, "max_tokens": 1, "stream": false,
+		})
 	}
 	return request
 }
 
+func embeddingVerifyURL(baseURL string) string {
+	lowerBaseURL := strings.ToLower(baseURL)
+	if strings.HasSuffix(lowerBaseURL, "/embeddings") {
+		return baseURL
+	}
+	if strings.HasSuffix(lowerBaseURL, "/v1") {
+		return baseURL + "/embeddings"
+	}
+	return baseURL + "/v1/embeddings"
+}
+
+func imageVerifyURL(provider, baseURL, endpoint string) string {
+	if provider == "custom" || strings.HasSuffix(strings.ToLower(baseURL), endpoint) {
+		return baseURL
+	}
+	return baseURL + endpoint
+}
+
+func verifyHTTPError(statusCode int, body []byte) string {
+	message := strings.TrimSpace(string(body))
+	var payload verifyErrorResponse
+	if err := json.Unmarshal(body, &payload); err == nil {
+		if value := strings.TrimSpace(payload.Error.Message); value != "" {
+			message = value
+		} else if value := strings.TrimSpace(payload.Message); value != "" {
+			message = value
+		}
+	}
+	if message == "" {
+		return fmt.Sprintf("validation request returned status %d", statusCode)
+	}
+	return message
+}
+
 func mustJSON(value interface{}) []byte {
 	payload, err := json.Marshal(value)
 	if err != nil {

agent/app/repo/agent_account.go

@@ -17,7 +17,7 @@ type IAgentAccountRepo interface {
 	Save(account *model.AgentAccount) error
 	DeleteByID(id uint) error
 	List(opts ...DBOption) ([]model.AgentAccount, error)
-	CountByProviders(providers []string) (map[string]int64, error)
+	CountTextByProviders(providers []string) (map[string]int64, error)
 }
 
 func NewIAgentAccountRepo() IAgentAccountRepo {
@@ -67,7 +67,7 @@ func (a AgentAccountRepo) List(opts ...DBOption) ([]model.AgentAccount, error) {
 	return accounts, nil
 }
 
-func (a AgentAccountRepo) CountByProviders(providers []string) (map[string]int64, error) {
+func (a AgentAccountRepo) CountTextByProviders(providers []string) (map[string]int64, error) {
 	normalizedProviders := normalizeProviders(providers)
 	counts := make(map[string]int64, len(normalizedProviders))
 	for _, provider := range normalizedProviders {
@@ -86,6 +86,7 @@ func (a AgentAccountRepo) CountByProviders(providers []string) (map[string]int64
 		Model(&model.AgentAccount{}).
 		Select("provider, COUNT(*) as count").
 		Where("provider IN ?", normalizedProviders).
+		Scopes(WithTextAPIType()).
 		Group("provider").
 		Scan(&rows).Error; err != nil {
 		return nil, err

agent/app/repo/app_install_resource.go

@@ -15,6 +15,7 @@ type IAppInstallResourceRpo interface {
 	WithAppInstallId(appInstallId uint) DBOption
 	WithLinkId(linkId uint) DBOption
 	WithResourceId(resourceId uint) DBOption
+	WithResourceIds(resourceIds []uint) DBOption
 	GetBy(opts ...DBOption) ([]model.AppInstallResource, error)
 	GetFirst(opts ...DBOption) (model.AppInstallResource, error)
 	Create(ctx context.Context, resource *model.AppInstallResource) error
@@ -44,6 +45,12 @@ func (a AppInstallResourceRpo) WithResourceId(resourceId uint) DBOption {
 	}
 }
 
+func (a AppInstallResourceRpo) WithResourceIds(resourceIds []uint) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("resource_id IN ?", resourceIds)
+	}
+}
+
 func (a AppInstallResourceRpo) GetBy(opts ...DBOption) ([]model.AppInstallResource, error) {
 	db := global.DB.Model(&model.AppInstallResource{})
 	var resources []model.AppInstallResource

agent/app/repo/common.go

@@ -49,6 +49,12 @@ func WithByName(name string) DBOption {
 	}
 }
 
+func WithByPath(path string) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		return g.Where("path = ?", path)
+	}
+}
+
 func WithByAddr(addr string) DBOption {
 	return func(g *gorm.DB) *gorm.DB {
 		return g.Where("addr = ?", addr)
@@ -94,6 +100,18 @@ func WithByProvider(provider string) DBOption {
 	}
 }
 
+func WithByAPIType(apiType string) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		return g.Where("api_type = ?", apiType)
+	}
+}
+
+func WithTextAPIType() DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		return g.Where("api_type NOT LIKE ? AND api_type <> ?", "%-images", "openai-embeddings")
+	}
+}
+
 func WithByModel(model string) DBOption {
 	return func(g *gorm.DB) *gorm.DB {
 		if len(model) == 0 {

agent/app/repo/database_user.go

@@ -0,0 +1,121 @@
+package repo
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/utils/encrypt"
+	"gorm.io/gorm"
+)
+
+type DatabaseUserRepo struct{}
+
+type IDatabaseUserRepo interface {
+	Get(opts ...DBOption) (model.DatabaseUser, error)
+	List(opts ...DBOption) ([]model.DatabaseUser, error)
+	Save(user *model.DatabaseUser) error
+	Delete(opts ...DBOption) error
+	DeleteBy(ctx context.Context, opts ...DBOption) error
+	Update(vars map[string]interface{}, opts ...DBOption) error
+	WithByDatabase(database string) DBOption
+	WithByUser(username, host string) DBOption
+	WithByUserList(users [][2]string) DBOption
+}
+
+func NewIDatabaseUserRepo() IDatabaseUserRepo {
+	return &DatabaseUserRepo{}
+}
+
+func (u *DatabaseUserRepo) Get(opts ...DBOption) (model.DatabaseUser, error) {
+	var user model.DatabaseUser
+	db := global.DB.Model(&model.DatabaseUser{})
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	if err := db.First(&user).Error; err != nil {
+		return user, err
+	}
+	password, err := encrypt.StringDecrypt(user.Password)
+	if err != nil {
+		global.LOG.Errorf("decrypt database user %s password failed, err: %v", user.Username, err)
+	}
+	user.Password = password
+	return user, nil
+}
+
+func (u *DatabaseUserRepo) List(opts ...DBOption) ([]model.DatabaseUser, error) {
+	var users []model.DatabaseUser
+	db := global.DB.Model(&model.DatabaseUser{})
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	if err := db.Find(&users).Error; err != nil {
+		return users, err
+	}
+	for i := 0; i < len(users); i++ {
+		password, err := encrypt.StringDecrypt(users[i].Password)
+		if err != nil {
+			global.LOG.Errorf("decrypt database user %s password failed, err: %v", users[i].Username, err)
+		}
+		users[i].Password = password
+	}
+	return users, nil
+}
+
+func (u *DatabaseUserRepo) Save(user *model.DatabaseUser) error {
+	if len(user.Password) != 0 {
+		password, err := encrypt.StringEncrypt(user.Password)
+		if err != nil {
+			return fmt.Errorf("encrypt database user %s password failed, err: %v", user.Username, err)
+		}
+		user.Password = password
+	}
+	return global.DB.Save(user).Error
+}
+
+func (u *DatabaseUserRepo) Delete(opts ...DBOption) error {
+	db := global.DB
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	return db.Delete(&model.DatabaseUser{}).Error
+}
+
+func (u *DatabaseUserRepo) DeleteBy(ctx context.Context, opts ...DBOption) error {
+	return getTx(ctx, opts...).Delete(&model.DatabaseUser{}).Error
+}
+
+func (u *DatabaseUserRepo) Update(vars map[string]interface{}, opts ...DBOption) error {
+	db := global.DB.Model(&model.DatabaseUser{})
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	return db.Updates(vars).Error
+}
+
+func (u *DatabaseUserRepo) WithByDatabase(database string) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		return g.Where("database = ?", database)
+	}
+}
+
+func (u *DatabaseUserRepo) WithByUser(username, host string) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		return g.Where("username = ? AND host = ?", username, host)
+	}
+}
+
+func (u *DatabaseUserRepo) WithByUserList(users [][2]string) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		if len(users) == 0 {
+			return g.Where("1 = 0")
+		}
+		values := make([][]interface{}, 0, len(users))
+		for _, user := range users {
+			values = append(values, []interface{}{user[0], user[1]})
+		}
+		return g.Where("(username, host) IN ?", values)
+	}
+}

agent/app/repo/database_user_grant.go

@@ -0,0 +1,109 @@
+package repo
+
+import (
+	"context"
+
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"gorm.io/gorm"
+)
+
+type DatabaseUserGrantRepo struct{}
+
+type IDatabaseUserGrantRepo interface {
+	Get(opts ...DBOption) (model.DatabaseUserGrant, error)
+	List(opts ...DBOption) ([]model.DatabaseUserGrant, error)
+	Save(grant *model.DatabaseUserGrant) error
+	Replace(dbType, database string, grants []model.DatabaseUserGrant) error
+	Delete(opts ...DBOption) error
+	DeleteBy(ctx context.Context, opts ...DBOption) error
+	Update(vars map[string]interface{}, opts ...DBOption) error
+	WithByDatabase(database string) DBOption
+	WithByDBName(dbName string) DBOption
+	WithByDBNames(dbNames []string) DBOption
+	WithByUser(username, host string) DBOption
+}
+
+func (u *DatabaseUserGrantRepo) Get(opts ...DBOption) (model.DatabaseUserGrant, error) {
+	var grant model.DatabaseUserGrant
+	db := global.DB.Model(&model.DatabaseUserGrant{})
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	err := db.First(&grant).Error
+	return grant, err
+}
+
+func NewIDatabaseUserGrantRepo() IDatabaseUserGrantRepo {
+	return &DatabaseUserGrantRepo{}
+}
+
+func (u *DatabaseUserGrantRepo) List(opts ...DBOption) ([]model.DatabaseUserGrant, error) {
+	var grants []model.DatabaseUserGrant
+	db := global.DB.Model(&model.DatabaseUserGrant{})
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	err := db.Find(&grants).Error
+	return grants, err
+}
+
+func (u *DatabaseUserGrantRepo) Save(grant *model.DatabaseUserGrant) error {
+	return global.DB.Save(grant).Error
+}
+
+func (u *DatabaseUserGrantRepo) Replace(dbType, database string, grants []model.DatabaseUserGrant) error {
+	return global.DB.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Where("`type` = ? AND database = ?", dbType, database).Delete(&model.DatabaseUserGrant{}).Error; err != nil {
+			return err
+		}
+		if len(grants) != 0 {
+			return tx.Create(&grants).Error
+		}
+		return nil
+	})
+}
+
+func (u *DatabaseUserGrantRepo) Delete(opts ...DBOption) error {
+	db := global.DB
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	return db.Delete(&model.DatabaseUserGrant{}).Error
+}
+
+func (u *DatabaseUserGrantRepo) DeleteBy(ctx context.Context, opts ...DBOption) error {
+	return getTx(ctx, opts...).Delete(&model.DatabaseUserGrant{}).Error
+}
+
+func (u *DatabaseUserGrantRepo) Update(vars map[string]interface{}, opts ...DBOption) error {
+	db := global.DB.Model(&model.DatabaseUserGrant{})
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	return db.Updates(vars).Error
+}
+
+func (u *DatabaseUserGrantRepo) WithByDatabase(database string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("database = ?", database)
+	}
+}
+
+func (u *DatabaseUserGrantRepo) WithByDBName(dbName string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("db_name = ?", dbName)
+	}
+}
+
+func (u *DatabaseUserGrantRepo) WithByDBNames(dbNames []string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("db_name IN ?", dbNames)
+	}
+}
+
+func (u *DatabaseUserGrantRepo) WithByUser(username, host string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("username = ? AND host = ?", username, host)
+	}
+}

agent/app/repo/monitor.go

@@ -73,6 +73,9 @@ func (u *MonitorRepo) CreateMonitorBase(model model.MonitorBase) error {
 	return global.MonitorDB.Create(&model).Error
 }
 func (s *MonitorRepo) BatchCreateMonitorGPU(list []model.MonitorGPU) error {
+	if len(list) == 0 {
+		return nil
+	}
 	return global.GPUMonitorDB.CreateInBatches(&list, len(list)).Error
 }
 func (u *MonitorRepo) BatchCreateMonitorIO(ioList []model.MonitorIO) error {

agent/app/repo/website.go

@@ -17,10 +17,12 @@ type IWebsiteRepo interface {
 	WithGroupID(groupId uint) DBOption
 	WithDefaultServer() DBOption
 	WithDomainLike(domain string) DBOption
+	WithSearchKeyword(keyword string, ids []uint) DBOption
 	WithRuntimeID(runtimeID uint) DBOption
 	WithParentID(websiteID uint) DBOption
 	WithType(websiteType string) DBOption
 	WithDBType(dbType string) DBOption
+	WithDBTypes(dbTypes []string) DBOption
 	WithDBID(dbID uint) DBOption
 
 	Page(page, size int, opts ...DBOption) (int64, []model.Website, error)
@@ -76,6 +78,19 @@ func (w *WebsiteRepo) WithDomainLike(domain string) DBOption {
 	}
 }
 
+func (w *WebsiteRepo) WithSearchKeyword(keyword string, ids []uint) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		if keyword == "" {
+			return db
+		}
+		keyword = "%" + keyword + "%"
+		if len(ids) == 0 {
+			return db.Where("(primary_domain like ? OR alias like ?)", keyword, keyword)
+		}
+		return db.Where("(primary_domain like ? OR alias like ? OR id in (?))", keyword, keyword, ids)
+	}
+}
+
 func (w *WebsiteRepo) WithAlias(alias string) DBOption {
 	return func(db *gorm.DB) *gorm.DB {
 		return db.Where("alias = ?", alias)
@@ -118,6 +133,12 @@ func (w *WebsiteRepo) WithDBType(dbType string) DBOption {
 	}
 }
 
+func (w *WebsiteRepo) WithDBTypes(dbTypes []string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("db_type IN ?", dbTypes)
+	}
+}
+
 func (w *WebsiteRepo) WithDBID(dbID uint) DBOption {
 	return func(db *gorm.DB) *gorm.DB {
 		return db.Where("db_id = ?", dbID)

agent/app/repo/website_template.go

@@ -0,0 +1,131 @@
+package repo
+
+import (
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"gorm.io/gorm"
+)
+
+type IWebsiteTemplateRepo interface {
+	Page(page, size int, opts ...DBOption) (int64, []model.WebsiteTemplate, error)
+	GetFirst(opts ...DBOption) (*model.WebsiteTemplate, error)
+	List(opts ...DBOption) ([]model.WebsiteTemplate, error)
+	Create(template *model.WebsiteTemplate) error
+	Save(template *model.WebsiteTemplate) error
+	DeleteBy(opts ...DBOption) error
+	WithName(name string) DBOption
+	WithType(templateType string) DBOption
+}
+
+func NewIWebsiteTemplateRepo() IWebsiteTemplateRepo {
+	return &WebsiteTemplateRepo{}
+}
+
+type WebsiteTemplateRepo struct {
+}
+
+func (w *WebsiteTemplateRepo) WithName(name string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("name like ?", "%"+name+"%")
+	}
+}
+
+func (w *WebsiteTemplateRepo) WithType(templateType string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("type = ?", templateType)
+	}
+}
+
+func (w *WebsiteTemplateRepo) Page(page, size int, opts ...DBOption) (int64, []model.WebsiteTemplate, error) {
+	var templates []model.WebsiteTemplate
+	db := getDb(opts...).Model(&model.WebsiteTemplate{})
+	count := int64(0)
+	db = db.Count(&count)
+	err := db.Limit(size).Offset(size * (page - 1)).Find(&templates).Error
+	return count, templates, err
+}
+
+func (w *WebsiteTemplateRepo) GetFirst(opts ...DBOption) (*model.WebsiteTemplate, error) {
+	var template model.WebsiteTemplate
+	db := getDb(opts...).Model(&model.WebsiteTemplate{})
+	if err := db.First(&template).Error; err != nil {
+		return nil, err
+	}
+	return &template, nil
+}
+
+func (w *WebsiteTemplateRepo) List(opts ...DBOption) ([]model.WebsiteTemplate, error) {
+	var templates []model.WebsiteTemplate
+	err := getDb(opts...).Model(&model.WebsiteTemplate{}).Find(&templates).Error
+	return templates, err
+}
+
+func (w *WebsiteTemplateRepo) Create(template *model.WebsiteTemplate) error {
+	return getDb().Create(template).Error
+}
+
+func (w *WebsiteTemplateRepo) Save(template *model.WebsiteTemplate) error {
+	return getDb().Save(template).Error
+}
+
+func (w *WebsiteTemplateRepo) DeleteBy(opts ...DBOption) error {
+	return getDb(opts...).Delete(&model.WebsiteTemplate{}).Error
+}
+
+type IWebsiteTemplateOutputRepo interface {
+	Page(page, size int, opts ...DBOption) (int64, []model.WebsiteTemplateOutput, error)
+	GetFirst(opts ...DBOption) (*model.WebsiteTemplateOutput, error)
+	List(opts ...DBOption) ([]model.WebsiteTemplateOutput, error)
+	Create(output *model.WebsiteTemplateOutput) error
+	Save(output *model.WebsiteTemplateOutput) error
+	DeleteBy(opts ...DBOption) error
+	WithByTemplateID(templateID uint) DBOption
+}
+
+func NewIWebsiteTemplateOutputRepo() IWebsiteTemplateOutputRepo {
+	return &WebsiteTemplateOutputRepo{}
+}
+
+type WebsiteTemplateOutputRepo struct {
+}
+
+func (w *WebsiteTemplateOutputRepo) WithByTemplateID(templateID uint) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("template_id = ?", templateID)
+	}
+}
+
+func (w *WebsiteTemplateOutputRepo) Page(page, size int, opts ...DBOption) (int64, []model.WebsiteTemplateOutput, error) {
+	var outputs []model.WebsiteTemplateOutput
+	db := getDb(opts...).Model(&model.WebsiteTemplateOutput{})
+	count := int64(0)
+	db = db.Count(&count)
+	err := db.Limit(size).Offset(size * (page - 1)).Find(&outputs).Error
+	return count, outputs, err
+}
+
+func (w *WebsiteTemplateOutputRepo) GetFirst(opts ...DBOption) (*model.WebsiteTemplateOutput, error) {
+	var output model.WebsiteTemplateOutput
+	db := getDb(opts...).Model(&model.WebsiteTemplateOutput{})
+	if err := db.First(&output).Error; err != nil {
+		return nil, err
+	}
+	return &output, nil
+}
+
+func (w *WebsiteTemplateOutputRepo) List(opts ...DBOption) ([]model.WebsiteTemplateOutput, error) {
+	var outputs []model.WebsiteTemplateOutput
+	err := getDb(opts...).Model(&model.WebsiteTemplateOutput{}).Find(&outputs).Error
+	return outputs, err
+}
+
+func (w *WebsiteTemplateOutputRepo) Create(output *model.WebsiteTemplateOutput) error {
+	return getDb().Create(output).Error
+}
+
+func (w *WebsiteTemplateOutputRepo) Save(output *model.WebsiteTemplateOutput) error {
+	return getDb().Save(output).Error
+}
+
+func (w *WebsiteTemplateOutputRepo) DeleteBy(opts ...DBOption) error {
+	return getDb(opts...).Delete(&model.WebsiteTemplateOutput{}).Error
+}

agent/app/service/agents.go

@@ -8,8 +8,8 @@ import (
 	"os"
 	"path"
 	"sort"
-	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
@@ -30,13 +30,15 @@ import (
 	"gorm.io/gorm"
 )
 
+var agentAccountMutationMu sync.Mutex
+
 type IAgentService interface {
 	Create(req dto.AgentCreateReq) (*dto.AgentItem, error)
 	BatchInstall(req dto.AgentBatchInstallReq) (*dto.AgentItem, error)
 	BatchUpgrade(req dto.AgentBatchUpgradeReq) ([]dto.AgentBatchUpgradeResult, error)
 	BatchInstallSkill(req dto.AgentBatchSkillInstallReq) ([]dto.AgentBatchSkillInstallResult, error)
 	BatchOperate(req dto.AgentBatchOperateReq) ([]dto.AgentBatchOperateResult, error)
-	Page(req dto.SearchWithPage) (int64, []dto.AgentItem, error)
+	Page(req dto.SearchWithPage, readOnly bool) (int64, []dto.AgentItem, error)
 	DeleteCheck(req dto.AgentIDReq) ([]dto.AppResource, error)
 	Delete(req dto.AgentDeleteReq) error
 	ResetToken(req dto.AgentTokenResetReq) error
@@ -74,9 +76,10 @@ type IAgentService interface {
 	CreateAccount(req dto.AgentAccountCreateReq) error
 	UpdateAccount(req dto.AgentAccountUpdateReq) error
 	SyncAgentsByAccount(account *model.AgentAccount) error
-	PageAccounts(req dto.AgentAccountSearch) (int64, []dto.AgentAccountInfo, error)
+	PageAccounts(req dto.AgentAccountSearch, readOnly ...bool) (int64, []dto.AgentAccountInfo, error)
 	CountAccountsByProviders(req dto.AgentAccountProviderCountReq) (map[string]int64, error)
 	GetAccountModels(req dto.AgentAccountModelReq) ([]dto.AgentAccountModel, error)
+	DiscoverAccountModels(req dto.AgentAccountModelDiscoverReq) ([]dto.AgentAccountModel, error)
 	CreateAccountModel(req dto.AgentAccountModelCreateReq) error
 	UpdateAccountModel(req dto.AgentAccountModelUpdateReq) error
 	DeleteAccountModel(req dto.AgentAccountModelDeleteReq) error
@@ -102,6 +105,10 @@ type IAgentService interface {
 	UpgradePlugin(req dto.AgentPluginUpgradeReq) error
 	UninstallPlugin(req dto.AgentPluginUninstallReq) error
 	CheckPlugin(req dto.AgentPluginCheckReq) (*dto.AgentPluginStatus, error)
+	ListPlugins(req dto.AgentPluginsReq) ([]dto.AgentPluginItem, error)
+	SearchPlugins(req dto.AgentPluginSearchReq) ([]dto.AgentPluginSearchItem, error)
+	InstallMarketPlugin(req dto.AgentPluginMarketInstallReq) error
+	OperatePlugin(req dto.AgentPluginOperateReq) error
 	ApproveChannelPairing(req dto.AgentChannelPairingApproveReq) error
 }
 
@@ -144,7 +151,7 @@ func (a AgentService) Create(req dto.AgentCreateReq) (*dto.AgentItem, error) {
 	if installs, _ := appInstallRepo.ListBy(context.Background(), repo.WithByLowerName(req.Name)); len(installs) > 0 {
 		return nil, buserr.New("ErrNameIsExist")
 	}
-	if !xpack.MultiNodeProvider.IsXpack() {
+	if !global.CONF.Base.IsEnterprise && !xpack.MultiNodeProvider.IsXpack() {
 		count, _, err := agentRepo.Page(1, 1)
 		if err != nil {
 			return nil, err
@@ -165,8 +172,6 @@ func (a AgentService) Create(req dto.AgentCreateReq) (*dto.AgentItem, error) {
 	provider := ""
 	baseURL := ""
 	apiType := ""
-	maxTokens := 0
-	contextWindow := 0
 	apiKey := ""
 	runtimeModel := ""
 	accountID := uint(0)
@@ -176,6 +181,7 @@ func (a AgentService) Create(req dto.AgentCreateReq) (*dto.AgentItem, error) {
 	var allowedOrigins []string
 	var account *model.AgentAccount
 	var installHooks *appInstallHooks
+	var dashboardAuth agentDashboardAuth
 
 	if agentType == constant.AppOpenclaw || agentType == constant.AppHermesAgent {
 		if req.AccountID == 0 {
@@ -196,8 +202,6 @@ func (a AgentService) Create(req dto.AgentCreateReq) (*dto.AgentItem, error) {
 		}
 		storedModel = resolvedRuntime.StoredModel
 		apiType = resolvedRuntime.APIType
-		maxTokens = resolvedRuntime.MaxTokens
-		contextWindow = resolvedRuntime.ContextWindow
 		runtimeModel = resolvedRuntime.PrimaryModel
 		apiKey = account.APIKey
 		accountID = account.ID
@@ -222,11 +226,17 @@ func (a AgentService) Create(req dto.AgentCreateReq) (*dto.AgentItem, error) {
 			},
 		}
 	} else if agentType == constant.AppHermesAgent {
+		dashboardAuth = normalizeAgentDashboardAuth(req.DashboardUsername, req.DashboardPassword)
 		installHooks = &appInstallHooks{
 			AfterCopyData: func(appInstall *model.AppInstall) error {
-				return prepareHermesInstallFiles(appInstall, account, storedModel)
+				if err := prepareHermesInstallFiles(appInstall, account, storedModel); err != nil {
+					return err
+				}
+				return writeAgentDashboardAuthEnv(appInstall.GetEnvPath(), agentType, dashboardAuth, false)
 			},
 		}
+	} else if agentType == constant.AppCopaw {
+		dashboardAuth = normalizeAgentDashboardAuth(req.DashboardUsername, req.DashboardPassword)
 	}
 
 	params := map[string]interface{}{
@@ -242,12 +252,17 @@ func (a AgentService) Create(req dto.AgentCreateReq) (*dto.AgentItem, error) {
 		params["PROVIDER"] = provider
 		params["MODEL"] = runtimeModel
 		params["API_TYPE"] = apiType
-		params["MAX_TOKENS"] = maxTokens
-		params["CONTEXT_WINDOW"] = contextWindow
 		params["BASE_URL"] = baseURL
 		params["API_KEY"] = apiKey
 		params["OPENCLAW_GATEWAY_TOKEN"] = token
 	}
+	if usernameKey, passwordKey, ok := agentDashboardAuthEnvKeys(agentType); ok {
+		params[usernameKey] = dashboardAuth.Username
+		params[passwordKey] = dashboardAuth.Password
+		if agentType == constant.AppCopaw {
+			params[qwenPawAuthEnabledEnvKey] = "true"
+		}
+	}
 
 	if req.EditCompose && strings.TrimSpace(req.DockerCompose) == "" {
 		return nil, buserr.New("ErrAgentComposeRequired")
@@ -282,22 +297,20 @@ func (a AgentService) Create(req dto.AgentCreateReq) (*dto.AgentItem, error) {
 		configPath = path.Join(appInstall.GetPath(), "data", "config.yaml")
 	}
 	agent := &model.Agent{
-		Name:          req.Name,
-		Remark:        req.Remark,
-		AgentType:     agentType,
-		Provider:      provider,
-		Model:         storedModel,
-		APIType:       apiType,
-		MaxTokens:     maxTokens,
-		ContextWindow: contextWindow,
-		BaseURL:       baseURL,
-		APIKey:        apiKey,
-		Token:         token,
-		Status:        appInstall.Status,
-		Message:       appInstall.Message,
-		AppInstallID:  appInstall.ID,
-		AccountID:     accountID,
-		ConfigPath:    configPath,
+		Name:         req.Name,
+		Remark:       req.Remark,
+		AgentType:    agentType,
+		Provider:     provider,
+		Model:        storedModel,
+		APIType:      apiType,
+		BaseURL:      baseURL,
+		APIKey:       apiKey,
+		Token:        token,
+		Status:       appInstall.Status,
+		Message:      appInstall.Message,
+		AppInstallID: appInstall.ID,
+		AccountID:    accountID,
+		ConfigPath:   configPath,
 	}
 	if err := agentRepo.Create(agent); err != nil {
 		return nil, err
@@ -395,7 +408,7 @@ func (a AgentService) BatchInstallSkill(req dto.AgentBatchSkillInstallReq) ([]dt
 			results = append(results, result)
 			continue
 		}
-		installTask, err := task.NewTaskWithOps(skillName, task.TaskInstall, task.TaskScopeAI, buildBatchSkillInstallTaskID(req.TaskID, agent.ID), agent.ID)
+		installTask, err := task.NewTaskWithOps(skillName, task.TaskInstall, task.TaskScopeAI, buildBatchTaskID(req.TaskID, "batch-skill-install", agent.ID), agent.ID)
 		if err != nil {
 			result.Message = err.Error()
 			results = append(results, result)
@@ -437,7 +450,7 @@ func (a AgentService) BatchOperate(req dto.AgentBatchOperateReq) ([]dto.AgentBat
 		if operate == constant.Delete {
 			if err := a.Delete(dto.AgentDeleteReq{
 				ID:          agent.ID,
-				TaskID:      buildBatchOperateTaskID(req.TaskID, agent.ID),
+				TaskID:      buildBatchTaskID(req.TaskID, "batch-operate", agent.ID),
 				ForceDelete: req.ForceDelete,
 			}); err != nil {
 				result.Message = err.Error()
@@ -465,7 +478,7 @@ func (a AgentService) BatchOperate(req dto.AgentBatchOperateReq) ([]dto.AgentBat
 		if err := NewIAppInstalledService().Operate(request.AppInstalledOperate{
 			InstallId: install.ID,
 			Operate:   operate,
-			TaskID:    buildBatchOperateTaskID(req.TaskID, agent.ID),
+			TaskID:    buildBatchTaskID(req.TaskID, "batch-operate", agent.ID),
 		}); err != nil {
 			result.Message = err.Error()
 		} else {
@@ -549,35 +562,19 @@ func buildBatchUpgradePlans(req dto.AgentBatchUpgradeReq) ([]batchUpgradePlan, [
 				DetailID:  detail.ID,
 				Backup:    req.Backup,
 				PullImage: req.PullImage,
-				TaskID:    buildBatchUpgradeTaskID(req.TaskID, install.ID),
+				TaskID:    buildBatchTaskID(req.TaskID, "batch-upgrade", install.ID),
 			},
 		})
 	}
 	return plans, results, nil
 }
 
-func buildBatchUpgradeTaskID(taskID string, appInstallID uint) string {
+func buildBatchTaskID(taskID, prefix string, id uint) string {
 	taskID = strings.TrimSpace(taskID)
 	if taskID == "" {
-		taskID = fmt.Sprintf("batch-upgrade-%d-%d", appInstallID, time.Now().UnixNano())
+		taskID = fmt.Sprintf("%s-%d-%d", prefix, id, time.Now().UnixNano())
 	}
-	return fmt.Sprintf("%s-%d", taskID, appInstallID)
-}
-
-func buildBatchSkillInstallTaskID(taskID string, agentID uint) string {
-	taskID = strings.TrimSpace(taskID)
-	if taskID == "" {
-		taskID = fmt.Sprintf("batch-skill-install-%d-%d", agentID, time.Now().UnixNano())
-	}
-	return fmt.Sprintf("%s-%d", taskID, agentID)
-}
-
-func buildBatchOperateTaskID(taskID string, agentID uint) string {
-	taskID = strings.TrimSpace(taskID)
-	if taskID == "" {
-		taskID = fmt.Sprintf("batch-operate-%d-%d", agentID, time.Now().UnixNano())
-	}
-	return fmt.Sprintf("%s-%d", taskID, agentID)
+	return fmt.Sprintf("%s-%d", taskID, id)
 }
 
 func batchOperateSkipMessage(operate constant.AppOperate, status string) string {
@@ -604,28 +601,30 @@ func batchOperateSkipMessage(operate constant.AppOperate, status string) string
 
 func buildCreateReqFromBatchInstallReq(req dto.AgentBatchInstallReq) dto.AgentCreateReq {
 	return dto.AgentCreateReq{
-		Name:           req.Name,
-		Remark:         req.Remark,
-		AppVersion:     req.AppVersion,
-		WebUIPort:      req.WebUIPort,
-		BridgePort:     req.BridgePort,
-		AllowedOrigins: req.AllowedOrigins,
-		AgentType:      req.AgentType,
-		Model:          req.Model,
-		AccountID:      req.AccountID,
-		Token:          req.Token,
-		TaskID:         req.TaskID,
-		Advanced:       req.Advanced,
-		ContainerName:  req.ContainerName,
-		AllowPort:      req.AllowPort,
-		SpecifyIP:      req.SpecifyIP,
-		RestartPolicy:  req.RestartPolicy,
-		CpuQuota:       req.CpuQuota,
-		MemoryLimit:    req.MemoryLimit,
-		MemoryUnit:     req.MemoryUnit,
-		PullImage:      req.PullImage,
-		EditCompose:    req.EditCompose,
-		DockerCompose:  req.DockerCompose,
+		Name:              req.Name,
+		Remark:            req.Remark,
+		AppVersion:        req.AppVersion,
+		WebUIPort:         req.WebUIPort,
+		BridgePort:        req.BridgePort,
+		AllowedOrigins:    req.AllowedOrigins,
+		AgentType:         req.AgentType,
+		Model:             req.Model,
+		AccountID:         req.AccountID,
+		Token:             req.Token,
+		DashboardUsername: req.DashboardUsername,
+		DashboardPassword: req.DashboardPassword,
+		TaskID:            req.TaskID,
+		Advanced:          req.Advanced,
+		ContainerName:     req.ContainerName,
+		AllowPort:         req.AllowPort,
+		SpecifyIP:         req.SpecifyIP,
+		RestartPolicy:     req.RestartPolicy,
+		CpuQuota:          req.CpuQuota,
+		MemoryLimit:       req.MemoryLimit,
+		MemoryUnit:        req.MemoryUnit,
+		PullImage:         req.PullImage,
+		EditCompose:       req.EditCompose,
+		DockerCompose:     req.DockerCompose,
 	}
 }
 
@@ -704,6 +703,7 @@ func (a AgentService) ensureBatchInstallAccount(req dto.AgentBatchInstallReq) (u
 	account.RememberAPIKey = snapshot.RememberAPIKey
 	account.BaseURL = snapshot.BaseURL
 	account.APIType = snapshot.APIType
+	account.AuthMode = snapshot.AuthMode
 	account.Remark = snapshot.Remark
 	account.Verified = true
 
@@ -711,6 +711,11 @@ func (a AgentService) ensureBatchInstallAccount(req dto.AgentBatchInstallReq) (u
 	if err != nil {
 		return 0, err
 	}
+	verifyModel, err := resolveAgentAccountVerifyModel(account.Provider, snapshot.VerifyModel, initialModels)
+	if err != nil {
+		return 0, err
+	}
+	account.VerifyModel = verifyModel
 	if err := global.DB.Transaction(func(tx *gorm.DB) error {
 		if account.ID == 0 {
 			if err := tx.Create(account).Error; err != nil {
@@ -740,7 +745,7 @@ func setAgentWebUIParams(params map[string]interface{}, agentType, appVersion st
 	params["PANEL_APP_PORT_HTTP"] = webUIPort
 }
 
-func (a AgentService) Page(req dto.SearchWithPage) (int64, []dto.AgentItem, error) {
+func (a AgentService) Page(req dto.SearchWithPage, readOnly bool) (int64, []dto.AgentItem, error) {
 	var opts []repo.DBOption
 	if strings.TrimSpace(req.Info) != "" {
 		opts = append(opts, repo.WithByLikeName(req.Info))
@@ -755,11 +760,19 @@ func (a AgentService) Page(req dto.SearchWithPage) (int64, []dto.AgentItem, erro
 		appInstall, _ := appInstallRepo.GetFirst(repo.WithByID(item.AppInstallID))
 		appInstalls = append(appInstalls, appInstall)
 	}
-	syncAgentAppInstalls(appInstalls)
+	readOnlyMode := isDemoReadOnly(readOnly)
+	if !readOnlyMode {
+		syncAgentAppInstalls(appInstalls)
+	}
 	for index, item := range list {
 		appInstall := appInstalls[index]
 		envMap := readInstallEnv(appInstall.Env)
 		agentItem := buildAgentItem(&item, &appInstall, envMap)
+		if readOnlyMode {
+			agentItem.Token = ""
+			agentItem.APIKey = ""
+			agentItem.DashboardPassword = ""
+		}
 		agentItem.Upgradable = checkAgentUpgradable(appInstall)
 		items = append(items, agentItem)
 	}
@@ -948,7 +961,7 @@ func (a AgentService) UpdateModelConfig(req dto.AgentModelConfigUpdateReq) error
 		return err
 	}
 	modelName := resolvedRuntime.StoredModel
-	apiType, maxTokens, contextWindow := resolvedRuntime.APIType, resolvedRuntime.MaxTokens, resolvedRuntime.ContextWindow
+	apiType := resolvedRuntime.APIType
 	confDir := path.Dir(agent.ConfigPath)
 	if agent.AgentType == constant.AppHermesAgent {
 		cfg, err := readHermesConfig(agent.ConfigPath)
@@ -969,8 +982,6 @@ func (a AgentService) UpdateModelConfig(req dto.AgentModelConfigUpdateReq) error
 	agent.Provider = account.Provider
 	agent.Model = modelName
 	agent.APIType = apiType
-	agent.MaxTokens = maxTokens
-	agent.ContextWindow = contextWindow
 	agent.BaseURL = account.BaseURL
 	agent.APIKey = account.APIKey
 	agent.AccountID = account.ID
@@ -984,20 +995,38 @@ func (a AgentService) GetProviders() ([]dto.ProviderInfo, error) {
 		models := make([]dto.ProviderModelInfo, 0, len(def.Models))
 		for _, item := range def.Models {
 			models = append(models, dto.ProviderModelInfo{
-				ID:            item.ID,
-				Name:          item.Name,
-				ContextWindow: item.ContextWindow,
-				MaxTokens:     item.MaxTokens,
-				Reasoning:     item.Reasoning,
-				Input:         append([]string(nil), item.Input...),
+				ID:   item.ID,
+				Name: item.Name,
 			})
 		}
+		apiTypes := make([]dto.ProviderAPIInfo, 0, len(def.APIConfigs))
+		for _, item := range def.APIConfigs {
+			apiModels := make([]dto.ProviderModelInfo, 0, len(item.Models))
+			for _, model := range item.Models {
+				apiModels = append(apiModels, dto.ProviderModelInfo{
+					ID:   model.ID,
+					Name: model.Name,
+				})
+			}
+			apiTypes = append(apiTypes, dto.ProviderAPIInfo{
+				APIType:                item.APIType,
+				BaseURL:                item.BaseURL,
+				EditableBaseURL:        item.EditableBaseURL,
+				SupportsModelDiscovery: item.DiscoverModels,
+				DefaultAuthMode:        item.DefaultAuthMode,
+				AuthModes:              item.AuthModes,
+				Models:                 apiModels,
+			})
+		}
+		baseURL, _ := providercatalog.DefaultBaseURL(key)
 		providers = append(providers, dto.ProviderInfo{
-			Sort:        def.Sort,
-			Provider:    key,
-			DisplayName: def.DisplayName,
-			BaseURL:     def.DefaultBaseURL,
-			Models:      models,
+			Sort:           def.Sort,
+			Provider:       key,
+			DisplayName:    localizedAgentProviderName(key),
+			BaseURL:        baseURL,
+			DefaultAPIType: def.DefaultAPIType,
+			APITypes:       apiTypes,
+			Models:         models,
 		})
 	}
 	sort.Slice(providers, func(i, j int) bool {
@@ -1007,11 +1036,22 @@ func (a AgentService) GetProviders() ([]dto.ProviderInfo, error) {
 }
 
 func (a AgentService) CreateAccount(req dto.AgentAccountCreateReq) error {
+	agentAccountMutationMu.Lock()
+	defer agentAccountMutationMu.Unlock()
 	provider := req.Provider
-	if exist, _ := agentAccountRepo.GetFirst(repo.WithByProvider(provider), repo.WithByName(req.Name)); exist != nil && exist.ID > 0 {
-		return buserr.New("ErrRecordExist")
+	if err := ensureAgentAccountNameAvailable(provider, req.Name, 0); err != nil {
+		return err
 	}
-	resolvedInput, err := resolveAgentAccountInput(provider, req.APIKey, req.BaseURL)
+	initialModels, err := buildInitialAgentAccountModels(&model.AgentAccount{Provider: provider, APIType: req.APIType}, req.Models)
+	if err != nil {
+		return err
+	}
+	verifyModel, err := resolveAgentAccountVerifyModel(provider, req.VerifyModel, initialModels)
+	if err != nil {
+		return err
+	}
+	validateAvailability := req.ValidateAvailability == nil || *req.ValidateAvailability
+	resolvedInput, err := resolveAgentAccountInput(provider, req.APIType, req.AuthMode, req.APIKey, req.BaseURL, verifyModel, validateAvailability)
 	if err != nil {
 		return err
 	}
@@ -1021,14 +1061,12 @@ func (a AgentService) CreateAccount(req dto.AgentAccountCreateReq) error {
 		APIKey:         resolvedInput.APIKey,
 		RememberAPIKey: req.RememberAPIKey,
 		BaseURL:        resolvedInput.BaseURL,
-		APIType:        req.APIType,
+		APIType:        resolvedInput.APIType,
+		AuthMode:       resolvedInput.AuthMode,
+		VerifyModel:    verifyModel,
 		Verified:       true,
 		Remark:         req.Remark,
 	}
-	initialModels, err := buildInitialAgentAccountModels(account, req.Models)
-	if err != nil {
-		return err
-	}
 	if err := global.DB.Transaction(func(tx *gorm.DB) error {
 		if err := tx.Create(account).Error; err != nil {
 			return err
@@ -1045,12 +1083,33 @@ func (a AgentService) CreateAccount(req dto.AgentAccountCreateReq) error {
 }
 
 func (a AgentService) UpdateAccount(req dto.AgentAccountUpdateReq) error {
+	agentAccountMutationMu.Lock()
+	defer agentAccountMutationMu.Unlock()
 	account, err := agentAccountRepo.GetFirst(repo.WithByID(req.ID))
 	if err != nil {
 		return err
 	}
+	if req.APIType != account.APIType {
+		return buserr.WithDetail("ErrInvalidParams", "API type cannot be changed", nil)
+	}
 	provider := account.Provider
-	resolvedInput, err := resolveAgentAccountInput(provider, req.APIKey, req.BaseURL)
+	if err := ensureAgentAccountNameAvailable(provider, req.Name, account.ID); err != nil {
+		return err
+	}
+	models, err := loadAgentAccountModels(account)
+	if err != nil {
+		return err
+	}
+	requestedVerifyModel := req.VerifyModel
+	if strings.TrimSpace(requestedVerifyModel) == "" {
+		requestedVerifyModel = account.VerifyModel
+	}
+	verifyModel, err := resolveAgentAccountVerifyModel(provider, requestedVerifyModel, models)
+	if err != nil {
+		return err
+	}
+	validateAvailability := req.ValidateAvailability == nil || *req.ValidateAvailability
+	resolvedInput, err := resolveAgentAccountInput(provider, req.APIType, req.AuthMode, req.APIKey, req.BaseURL, verifyModel, validateAvailability)
 	if err != nil {
 		return err
 	}
@@ -1058,7 +1117,9 @@ func (a AgentService) UpdateAccount(req dto.AgentAccountUpdateReq) error {
 	account.APIKey = resolvedInput.APIKey
 	account.RememberAPIKey = req.RememberAPIKey
 	account.BaseURL = resolvedInput.BaseURL
-	account.APIType = req.APIType
+	account.APIType = resolvedInput.APIType
+	account.AuthMode = resolvedInput.AuthMode
+	account.VerifyModel = verifyModel
 	account.Remark = req.Remark
 	account.Verified = true
 
@@ -1075,11 +1136,17 @@ func (a AgentService) UpdateAccount(req dto.AgentAccountUpdateReq) error {
 	return nil
 }
 
-func (a AgentService) PageAccounts(req dto.AgentAccountSearch) (int64, []dto.AgentAccountInfo, error) {
+func (a AgentService) PageAccounts(req dto.AgentAccountSearch, readOnly ...bool) (int64, []dto.AgentAccountInfo, error) {
 	var opts []repo.DBOption
 	if strings.TrimSpace(req.Provider) != "" {
 		opts = append(opts, repo.WithByProvider(req.Provider))
 	}
+	if apiType := strings.TrimSpace(req.APIType); apiType != "" {
+		opts = append(opts, repo.WithByAPIType(apiType))
+	}
+	if req.TextOnly {
+		opts = append(opts, repo.WithTextAPIType())
+	}
 	if strings.TrimSpace(req.Name) != "" {
 		opts = append(opts, repo.WithByLikeName(req.Name))
 	}
@@ -1090,37 +1157,53 @@ func (a AgentService) PageAccounts(req dto.AgentAccountSearch) (int64, []dto.Age
 	items := make([]dto.AgentAccountInfo, 0, len(list))
 	for _, item := range list {
 		apiKey := ""
-		if item.RememberAPIKey {
+		if item.RememberAPIKey && !isDemoReadOnly(readOnly...) {
 			apiKey = item.APIKey
 		}
 		items = append(items, dto.AgentAccountInfo{
 			ID:              item.ID,
 			MasterAccountID: item.MasterAccountID,
 			Provider:        item.Provider,
-			ProviderName:    providercatalog.DisplayName(item.Provider),
+			ProviderName:    localizedAgentProviderName(item.Provider),
 			Name:            item.Name,
 			APIKey:          apiKey,
 			RememberAPIKey:  item.RememberAPIKey,
 			BaseURL:         item.BaseURL,
 			Models:          nil,
 			APIType:         item.APIType,
+			AuthMode:        item.AuthMode,
+			VerifyModel:     item.VerifyModel,
 			Verified:        item.Verified,
 			Remark:          item.Remark,
 			CreatedAt:       item.CreatedAt,
 		})
 	}
-	for i := range items {
-		models, err := loadAgentAccountModels(&list[i])
-		if err != nil {
+	if len(list) > 0 {
+		accountIDs := make([]uint, 0, len(list))
+		for _, account := range list {
+			accountIDs = append(accountIDs, account.ID)
+		}
+		var rows []model.AgentAccountModel
+		if err := global.DB.Where("account_id IN ?", accountIDs).Order("account_id ASC, sort_order ASC, id ASC").Find(&rows).Error; err != nil {
 			return 0, nil, err
 		}
-		items[i].Models = models
+		modelsByAccount := make(map[uint][]dto.AgentAccountModel, len(list))
+		for _, row := range rows {
+			modelsByAccount[row.AccountID] = append(modelsByAccount[row.AccountID], dto.AgentAccountModel{
+				RecordID: row.ID,
+				ID:       strings.TrimSpace(row.Model),
+				Name:     strings.TrimSpace(row.Name),
+			})
+		}
+		for index, account := range list {
+			items[index].Models = modelsByAccount[account.ID]
+		}
 	}
 	return count, items, nil
 }
 
 func (a AgentService) CountAccountsByProviders(req dto.AgentAccountProviderCountReq) (map[string]int64, error) {
-	return agentAccountRepo.CountByProviders(req.Providers)
+	return agentAccountRepo.CountTextByProviders(req.Providers)
 }
 
 func (a AgentService) GetAccountModels(req dto.AgentAccountModelReq) ([]dto.AgentAccountModel, error) {
@@ -1131,6 +1214,22 @@ func (a AgentService) GetAccountModels(req dto.AgentAccountModelReq) ([]dto.Agen
 	return loadAgentAccountModels(account)
 }
 
+func (a AgentService) DiscoverAccountModels(req dto.AgentAccountModelDiscoverReq) ([]dto.AgentAccountModel, error) {
+	config, ok := providercatalog.FindAPIConfig(req.Provider, req.APIType)
+	if !ok || !config.DiscoverModels {
+		return nil, buserr.New("ErrAgentAccountModelsRequired")
+	}
+	baseURL, err := providercatalog.ResolveBaseURL(req.Provider, req.APIType, req.BaseURL)
+	if err != nil {
+		return nil, buserr.WithErr("ErrAgentAccountUnavailable", err)
+	}
+	models, err := providercatalog.DiscoverModels(baseURL, req.APIKey)
+	if err != nil {
+		return nil, buserr.WithErr("ErrAgentAccountUnavailable", err)
+	}
+	return buildDiscoveredAgentAccountModels(models), nil
+}
+
 func (a AgentService) CreateAccountModel(req dto.AgentAccountModelCreateReq) error {
 	account, err := agentAccountRepo.GetFirst(repo.WithByID(req.AccountID))
 	if err != nil {
@@ -1140,24 +1239,19 @@ func (a AgentService) CreateAccountModel(req dto.AgentAccountModelCreateReq) err
 	if err != nil {
 		return err
 	}
-	nextModel := cloneAgentAccountModel(req.Model)
-	if _, ok := findAgentAccountModelForProvider(account.Provider, models, nextModel.ID); ok {
-		return buserr.New("ErrRecordExist")
-	}
-	inputPayload, err := json.Marshal(nextModel.Input)
+	nextModel, err := normalizeAgentAccountModel(account, req.Model)
 	if err != nil {
 		return err
 	}
+	if _, ok := findAgentAccountModelForProvider(account.Provider, models, nextModel.ID); ok {
+		return buserr.New("ErrRecordExist")
+	}
 	sortOrder := len(models) + 1
 	record := &model.AgentAccountModel{
-		AccountID:     account.ID,
-		Model:         nextModel.ID,
-		Name:          nextModel.Name,
-		ContextWindow: nextModel.ContextWindow,
-		MaxTokens:     nextModel.MaxTokens,
-		Reasoning:     nextModel.Reasoning,
-		Input:         string(inputPayload),
-		SortOrder:     sortOrder,
+		AccountID: account.ID,
+		Model:     nextModel.ID,
+		Name:      nextModel.Name,
+		SortOrder: sortOrder,
 	}
 	if err := agentAccountModelRepo.Create(record); err != nil {
 		return err
@@ -1178,7 +1272,11 @@ func (a AgentService) UpdateAccountModel(req dto.AgentAccountModelUpdateReq) err
 	if err != nil {
 		return err
 	}
-	nextModel := cloneAgentAccountModel(req.Model)
+	nextModel, err := normalizeAgentAccountModel(account, req.Model)
+	if err != nil {
+		return err
+	}
+	nextModel.RecordID = req.Model.RecordID
 	for _, item := range models {
 		if item.RecordID == req.Model.RecordID {
 			continue
@@ -1198,19 +1296,18 @@ func (a AgentService) UpdateAccountModel(req dto.AgentAccountModelUpdateReq) err
 	if err := ensureAccountModelsNotBound(account, nextModels); err != nil {
 		return err
 	}
-	inputPayload, err := json.Marshal(nextModel.Input)
-	if err != nil {
-		return err
-	}
+	previousModelID := record.Model
 	record.Model = nextModel.ID
 	record.Name = nextModel.Name
-	record.ContextWindow = nextModel.ContextWindow
-	record.MaxTokens = nextModel.MaxTokens
-	record.Reasoning = nextModel.Reasoning
-	record.Input = string(inputPayload)
 	if err := agentAccountModelRepo.Save(record); err != nil {
 		return err
 	}
+	if sameProviderModelID(account.Provider, account.VerifyModel, previousModelID) {
+		account.VerifyModel = nextModel.ID
+		if err := agentAccountRepo.Save(account); err != nil {
+			return err
+		}
+	}
 	terminalai.InvalidateTerminalRuntimeCache()
 	terminalai.InvalidateFileAIRuntimeCache()
 	return a.syncAgentsByAccount(account)
@@ -1221,9 +1318,13 @@ func (a AgentService) DeleteAccountModel(req dto.AgentAccountModelDeleteReq) err
 	if err != nil {
 		return err
 	}
-	if _, err := agentAccountModelRepo.GetFirst(repo.WithByID(req.RecordID), repo.WithByAccountID(req.AccountID)); err != nil {
+	record, err := agentAccountModelRepo.GetFirst(repo.WithByID(req.RecordID), repo.WithByAccountID(req.AccountID))
+	if err != nil {
 		return err
 	}
+	if sameProviderModelID(account.Provider, account.VerifyModel, record.Model) {
+		return buserr.New("ErrAgentVerifyModelInUse")
+	}
 	models, err := loadAgentAccountModels(account)
 	if err != nil {
 		return err
@@ -1257,25 +1358,45 @@ func (a AgentService) SyncAgentsByAccount(account *model.AgentAccount) error {
 }
 
 func (a AgentService) VerifyAccount(req dto.AgentAccountVerifyReq) error {
-	_, err := resolveAgentAccountInput(req.Provider, req.APIKey, req.BaseURL)
+	_, err := resolveAgentAccountInput(req.Provider, req.APIType, req.AuthMode, req.APIKey, req.BaseURL, req.Model, true)
 	return err
 }
 
 func (a AgentService) DeleteAccount(req dto.AgentAccountDeleteReq) error {
-	if exists, _ := agentRepo.GetFirst(repo.WithByAccountID(req.ID)); exists != nil && exists.ID > 0 {
-		return buserr.New("ErrAgentAccountBound")
-	}
-	if aiStatus, _ := settingRepo.GetValueByKey("AIStatus"); strings.EqualFold(strings.TrimSpace(aiStatus), constant.StatusEnable) {
-		if aiAccountID, _ := settingRepo.GetValueByKey("AIAccountID"); strings.TrimSpace(aiAccountID) == strconv.FormatUint(uint64(req.ID), 10) {
+	agentAccountMutationMu.Lock()
+	defer agentAccountMutationMu.Unlock()
+	if err := global.DB.Transaction(func(tx *gorm.DB) error {
+		var agentCount int64
+		if err := tx.Model(&model.Agent{}).Where("account_id = ?", req.ID).Count(&agentCount).Error; err != nil {
+			return err
+		}
+		if agentCount > 0 {
+			return buserr.New("ErrAgentAccountBound")
+		}
+		used, err := agentAccountUsedBySetting(tx, req.ID, "AIStatus", "AIAccountID")
+		if err != nil {
+			return err
+		}
+		if used {
 			return buserr.New("ErrTerminalAIAccountInUse")
 		}
-	}
-	if err := agentAccountModelRepo.Delete(repo.WithByAccountID(req.ID)); err != nil {
+		used, err = agentAccountUsedBySetting(tx, req.ID, "FileAIStatus", "FileAIAccountID")
+		if err != nil {
+			return err
+		}
+		if used {
+			return buserr.New("ErrFileAIAccountInUse")
+		}
+		if err := tx.Where("account_id = ?", req.ID).Delete(&model.AgentAccountModel{}).Error; err != nil {
+			return err
+		}
+		return tx.Delete(&model.AgentAccount{}, req.ID).Error
+	}); err != nil {
 		return err
 	}
 	terminalai.InvalidateTerminalRuntimeCache()
 	terminalai.InvalidateFileAIRuntimeCache()
-	return agentAccountRepo.DeleteByID(req.ID)
+	return nil
 }
 
 func (a AgentService) GetSecurityConfig(req dto.AgentIDReq) (*dto.AgentSecurityConfig, error) {
@@ -1327,10 +1448,20 @@ func (a AgentService) GetOtherConfig(req dto.AgentIDReq) (*dto.AgentOtherConfig,
 		if err != nil {
 			return nil, err
 		}
+		auth := readAgentDashboardAuthFromInstall(install, agent.AgentType)
 		return &dto.AgentOtherConfig{
-			UserTimezone:   cfg.Timezone,
-			BrowserEnabled: true,
-			NPMRegistry:    "https://registry.npmjs.org/",
+			UserTimezone:      cfg.Timezone,
+			BrowserEnabled:    true,
+			NPMRegistry:       "https://registry.npmjs.org/",
+			DashboardUsername: auth.Username,
+			DashboardPassword: auth.Password,
+		}, nil
+	}
+	if agent.AgentType == constant.AppCopaw {
+		auth := readAgentDashboardAuthFromInstall(install, agent.AgentType)
+		return &dto.AgentOtherConfig{
+			DashboardUsername: auth.Username,
+			DashboardPassword: auth.Password,
 		}, nil
 	}
 	conf, err := readOpenclawConfig(agent.ConfigPath)
@@ -1351,18 +1482,36 @@ func (a AgentService) UpdateOtherConfig(req dto.AgentOtherConfigUpdateReq) error
 		return err
 	}
 	if agent.AgentType == constant.AppHermesAgent {
+		if strings.TrimSpace(req.UserTimezone) == "" {
+			return buserr.New("ErrInvalidParams")
+		}
 		account, err := agentAccountRepo.GetFirst(repo.WithByID(agent.AccountID))
 		if err != nil {
 			return err
 		}
+		previousAuth := readAgentDashboardAuthFromInstall(install, agent.AgentType)
+		nextAuth := normalizeAgentDashboardAuth(req.DashboardUsername, req.DashboardPassword)
 		if err := writeHermesConfig(path.Dir(agent.ConfigPath), account, agent.Model, strings.TrimSpace(req.UserTimezone)); err != nil {
 			return err
 		}
+		if err := writeAgentDashboardAuthEnv(install.GetEnvPath(), agent.AgentType, nextAuth, true); err != nil {
+			return err
+		}
+		operate := constant.Restart
+		if previousAuth.Username != nextAuth.Username || previousAuth.Password != nextAuth.Password {
+			operate = constant.Rebuild
+		}
 		return NewIAppInstalledService().Operate(request.AppInstalledOperate{
 			InstallId: install.ID,
-			Operate:   constant.Restart,
+			Operate:   operate,
 		})
 	}
+	if agent.AgentType == constant.AppCopaw {
+		return updateQwenPawDashboardAuth(install, normalizeAgentDashboardAuth(req.DashboardUsername, req.DashboardPassword))
+	}
+	if strings.TrimSpace(req.UserTimezone) == "" || strings.TrimSpace(req.NPMRegistry) == "" {
+		return buserr.New("ErrInvalidParams")
+	}
 	if err := ensureContainerRunning(install.ContainerName); err != nil {
 		return err
 	}
@@ -1534,7 +1683,7 @@ func (a AgentService) syncAgentsByAccount(account *model.AgentAccount) error {
 			return err
 		}
 		modelName := resolvedRuntime.StoredModel
-		apiType, maxTokens, contextWindow := resolvedRuntime.APIType, resolvedRuntime.MaxTokens, resolvedRuntime.ContextWindow
+		apiType := resolvedRuntime.APIType
 		confDir := path.Dir(agent.ConfigPath)
 		switch agent.AgentType {
 		case constant.AppOpenclaw:
@@ -1562,8 +1711,6 @@ func (a AgentService) syncAgentsByAccount(account *model.AgentAccount) error {
 		agent.Provider = account.Provider
 		agent.Model = modelName
 		agent.APIType = apiType
-		agent.MaxTokens = maxTokens
-		agent.ContextWindow = contextWindow
 		_ = agentRepo.Save(&agent)
 	}
 	return nil

agent/app/service/agents_channels.go

@@ -811,9 +811,7 @@ func extractTelegramConfig(conf map[string]interface{}) dto.AgentTelegramConfig
 	result.RequireMention = result.GroupPolicy == "allowlist"
 	result.GroupAllowFrom = extractStringList(telegram["groupAllowFrom"])
 	result.Proxy = extractStringValue(telegram["proxy"])
-	if streaming := extractStringValue(telegram["streaming"]); streaming != "" {
-		result.Streaming = streaming
-	}
+	result.Streaming = normalizeTelegramStreamingMode(telegram["streaming"], result.Streaming)
 	accounts := childMap(telegram, "accounts")
 	if len(accounts) == 0 {
 		botToken := extractStringValue(telegram["botToken"])
@@ -839,7 +837,7 @@ func extractTelegramConfig(conf map[string]interface{}) dto.AgentTelegramConfig
 			BotToken:    extractStringValue(account["botToken"]),
 			DmPolicy:    extractStringValue(account["dmPolicy"]),
 			GroupPolicy: extractStringValue(account["groupPolicy"]),
-			Streaming:   extractStringValue(account["streaming"]),
+			Streaming:   normalizeTelegramStreamingMode(account["streaming"], result.Streaming),
 		})
 	}
 	result.DefaultAccount = normalizeDefaultAccount(extractStringValue(telegram["defaultAccount"]), getTelegramBotAccountIDs(bots))
@@ -879,7 +877,7 @@ func setTelegramConfig(conf map[string]interface{}, config dto.AgentTelegramConf
 	} else {
 		delete(telegram, "proxy")
 	}
-	telegram["streaming"] = config.Streaming
+	telegram["streaming"] = buildTelegramStreamingConfig(config.Streaming)
 	accounts := make(map[string]interface{}, len(config.Bots))
 	for _, bot := range config.Bots {
 		account := map[string]interface{}{
@@ -888,7 +886,7 @@ func setTelegramConfig(conf map[string]interface{}, config dto.AgentTelegramConf
 			"botToken":    bot.BotToken,
 			"dmPolicy":    bot.DmPolicy,
 			"groupPolicy": bot.GroupPolicy,
-			"streaming":   bot.Streaming,
+			"streaming":   buildTelegramStreamingConfig(bot.Streaming),
 		}
 		if bot.DmPolicy == "open" {
 			account["allowFrom"] = []string{"*"}
@@ -899,6 +897,29 @@ func setTelegramConfig(conf map[string]interface{}, config dto.AgentTelegramConf
 	delete(telegram, "botToken")
 }
 
+func normalizeTelegramStreamingMode(value interface{}, defaultMode string) string {
+	mode := defaultMode
+	switch typed := value.(type) {
+	case string:
+		mode = typed
+	case map[string]interface{}:
+		mode = extractStringValue(typed["mode"])
+	}
+	mode = strings.ToLower(strings.TrimSpace(mode))
+	switch mode {
+	case "off", "partial", "block", "progress":
+		return mode
+	default:
+		return "partial"
+	}
+}
+
+func buildTelegramStreamingConfig(mode string) map[string]interface{} {
+	return map[string]interface{}{
+		"mode": normalizeTelegramStreamingMode(mode, "partial"),
+	}
+}
+
 func extractDiscordConfig(conf map[string]interface{}) dto.AgentDiscordConfig {
 	result := dto.AgentDiscordConfig{Enabled: true, DmPolicy: "pairing", AllowFrom: []string{}, RequireMention: false, GroupPolicy: "open"}
 	discord := getChannelConfig(conf, "discord")

agent/app/service/agents_copaw.go

@@ -0,0 +1,128 @@
+package service
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+)
+
+type qwenPawAuthStatus struct {
+	Enabled  bool `json:"enabled"`
+	HasUsers bool `json:"has_users"`
+}
+
+type qwenPawLoginResponse struct {
+	Token string `json:"token"`
+}
+
+func updateQwenPawDashboardAuth(install *model.AppInstall, next agentDashboardAuth) error {
+	if install == nil || install.ID == 0 {
+		return buserr.New("ErrRecordNotFound")
+	}
+	current, err := readAgentDashboardAuthEnv(install.GetEnvPath(), constant.AppCopaw)
+	if err != nil {
+		return err
+	}
+	if current == next {
+		return writeAgentDashboardAuthEnv(install.GetEnvPath(), constant.AppCopaw, next, true)
+	}
+	if err := ensureContainerRunning(install.ContainerName); err != nil {
+		return err
+	}
+
+	baseURL := fmt.Sprintf("http://127.0.0.1:%d/api/auth", install.HttpPort)
+	var status qwenPawAuthStatus
+	if _, err := requestQwenPawAuth(http.MethodGet, baseURL+"/status", nil, "", &status); err != nil {
+		return buserr.WithMap("ErrQwenPawAuthRequest", map[string]interface{}{"err": err.Error()}, err)
+	}
+	if !status.Enabled {
+		return buserr.New("ErrQwenPawAuthDisabled")
+	}
+
+	if !status.HasUsers {
+		payload := map[string]string{"username": next.Username, "password": next.Password}
+		if _, err := requestQwenPawAuth(http.MethodPost, baseURL+"/register", payload, "", nil); err != nil {
+			return buserr.WithMap("ErrQwenPawAuthRequest", map[string]interface{}{"err": err.Error()}, err)
+		}
+	} else {
+		var login qwenPawLoginResponse
+		payload := map[string]string{"username": current.Username, "password": current.Password}
+		statusCode, err := requestQwenPawAuth(http.MethodPost, baseURL+"/login", payload, "", &login)
+		if statusCode == http.StatusUnauthorized {
+			return buserr.New("ErrQwenPawAuthOutOfSync")
+		}
+		if err != nil {
+			return buserr.WithMap("ErrQwenPawAuthRequest", map[string]interface{}{"err": err.Error()}, err)
+		}
+		payload = map[string]string{"current_password": current.Password}
+		if current.Username != next.Username {
+			payload["new_username"] = next.Username
+		}
+		if current.Password != next.Password {
+			payload["new_password"] = next.Password
+		}
+		if _, err := requestQwenPawAuth(http.MethodPost, baseURL+"/update-profile", payload, login.Token, nil); err != nil {
+			return buserr.WithMap("ErrQwenPawAuthRequest", map[string]interface{}{"err": err.Error()}, err)
+		}
+	}
+	return writeAgentDashboardAuthEnv(install.GetEnvPath(), constant.AppCopaw, next, true)
+}
+
+func requestQwenPawAuth(method, reqURL string, payload interface{}, token string, result interface{}) (int, error) {
+	var body io.Reader
+	if payload != nil {
+		data, err := json.Marshal(payload)
+		if err != nil {
+			return 0, err
+		}
+		body = bytes.NewReader(data)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	req, err := http.NewRequestWithContext(ctx, method, reqURL, body)
+	if err != nil {
+		return 0, err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	if token != "" {
+		req.Header.Set("Authorization", "Bearer "+token)
+	}
+	resp, err := (&http.Client{Timeout: 10 * time.Second}).Do(req)
+	if err != nil {
+		return 0, err
+	}
+	defer resp.Body.Close()
+	data, err := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+	if err != nil {
+		return resp.StatusCode, err
+	}
+	if resp.StatusCode < http.StatusOK || resp.StatusCode >= http.StatusMultipleChoices {
+		detail := strings.TrimSpace(string(data))
+		var errorResponse struct {
+			Detail string `json:"detail"`
+		}
+		if json.Unmarshal(data, &errorResponse) == nil && strings.TrimSpace(errorResponse.Detail) != "" {
+			detail = strings.TrimSpace(errorResponse.Detail)
+		}
+		if detail == "" {
+			detail = resp.Status
+		}
+		return resp.StatusCode, errors.New(detail)
+	}
+	if result != nil && len(data) > 0 {
+		if err := json.Unmarshal(data, result); err != nil {
+			return resp.StatusCode, err
+		}
+	}
+	return resp.StatusCode, nil
+}

agent/app/service/agents_hermes.go

@@ -13,9 +13,7 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/buserr"
 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/utils/common"
-	agentenv "github.com/1Panel-dev/1Panel/agent/utils/env"
 	"github.com/1Panel-dev/1Panel/agent/utils/files"
-	"github.com/joho/godotenv"
 	"gopkg.in/yaml.v3"
 )
 
@@ -71,7 +69,7 @@ func writeHermesConfig(confDir string, account *model.AgentAccount, modelName st
 		}
 	}
 
-	provider := resolveHermesProvider(account.Provider)
+	provider := resolveHermesProvider(account.Provider, account.APIType)
 	configPath := path.Join(confDir, "config.yaml")
 	cfg, err := readHermesConfigMap(configPath)
 	if err != nil {
@@ -152,7 +150,7 @@ func writeHermesConfigMap(configPath string, cfg map[string]interface{}) error {
 }
 
 func readHermesTelegramChannelConfig(confDir string) (*dto.AgentTelegramConfig, error) {
-	envMap, err := readHermesEnvMap(path.Join(confDir, ".env"))
+	envMap, err := readAgentEnvMap(path.Join(confDir, ".env"))
 	if err != nil {
 		return nil, err
 	}
@@ -209,7 +207,7 @@ func readHermesTelegramChannelConfig(confDir string) (*dto.AgentTelegramConfig,
 
 func writeHermesTelegramChannelConfig(confDir string, config dto.AgentTelegramConfig) error {
 	envPath := path.Join(confDir, ".env")
-	envMap, err := readHermesEnvMap(envPath)
+	envMap, err := readAgentEnvMap(envPath)
 	if err != nil {
 		return err
 	}
@@ -229,7 +227,7 @@ func writeHermesTelegramChannelConfig(confDir string, config dto.AgentTelegramCo
 			envMap["TELEGRAM_ALLOWED_USERS"] = allow
 		}
 	}
-	if err := writeHermesEnvMap(envPath, envMap, []string{
+	if err := writeAgentEnvMap(envPath, envMap, []string{
 		"TELEGRAM_BOT_TOKEN",
 		"TELEGRAM_ALLOWED_USERS",
 		"TELEGRAM_ALLOW_ALL_USERS",
@@ -248,7 +246,7 @@ func writeHermesTelegramChannelConfig(confDir string, config dto.AgentTelegramCo
 }
 
 func readHermesDiscordChannelConfig(confDir string) (*dto.AgentDiscordConfig, error) {
-	envMap, err := readHermesEnvMap(path.Join(confDir, ".env"))
+	envMap, err := readAgentEnvMap(path.Join(confDir, ".env"))
 	if err != nil {
 		return nil, err
 	}
@@ -300,7 +298,7 @@ func readHermesDiscordChannelConfig(confDir string) (*dto.AgentDiscordConfig, er
 
 func writeHermesDiscordChannelConfig(confDir string, config dto.AgentDiscordConfig) error {
 	envPath := path.Join(confDir, ".env")
-	envMap, err := readHermesEnvMap(envPath)
+	envMap, err := readAgentEnvMap(envPath)
 	if err != nil {
 		return err
 	}
@@ -320,7 +318,7 @@ func writeHermesDiscordChannelConfig(confDir string, config dto.AgentDiscordConf
 			envMap["DISCORD_ALLOWED_USERS"] = allow
 		}
 	}
-	if err := writeHermesEnvMap(envPath, envMap, []string{
+	if err := writeAgentEnvMap(envPath, envMap, []string{
 		"DISCORD_BOT_TOKEN",
 		"DISCORD_ALLOWED_USERS",
 		"DISCORD_ALLOW_ALL_USERS",
@@ -340,14 +338,14 @@ func writeHermesDiscordChannelConfig(confDir string, config dto.AgentDiscordConf
 
 func deleteHermesEnvKeys(confDir string, keys ...string) error {
 	envPath := path.Join(confDir, ".env")
-	envMap, err := readHermesEnvMap(envPath)
+	envMap, err := readAgentEnvMap(envPath)
 	if err != nil {
 		return err
 	}
 	for _, key := range keys {
 		delete(envMap, key)
 	}
-	return writeHermesEnvMap(envPath, envMap, keys)
+	return writeAgentEnvMap(envPath, envMap, keys)
 }
 
 func deleteHermesConfigSections(confDir string, topLevelKeys []string, platformKeys []string) error {
@@ -407,11 +405,18 @@ func normalizeHermesTimezone(timezone string) string {
 	return timezone
 }
 
-func resolveHermesProvider(provider string) string {
+func resolveHermesProvider(provider, apiType string) string {
+	if apiType == "anthropic-messages" && (provider == "deepseek" || provider == "bailian-coding-plan" || provider == "ark-coding-plan" || provider == "xiaomi") {
+		return "anthropic"
+	}
 	switch provider {
 	case "":
 		return "custom"
-	case "openrouter", "anthropic", "gemini", "zai", "kimi-coding", "xiaomi":
+	case "moonshot":
+		return "kimi-coding"
+	case "kimi":
+		return "kimi-coding-cn"
+	case "openrouter", "anthropic", "deepseek", "gemini", "zai", "kimi-coding", "xiaomi":
 		return provider
 	case "minimax":
 		return "minimax-cn"
@@ -428,17 +433,7 @@ func resolveHermesModel(sourceProvider, targetProvider, modelName string) string
 	if targetProvider != "custom" {
 		return target
 	}
-	if sourceProvider == "custom" || sourceProvider == "vllm" {
-		return normalizeCustomModel(target)
-	}
-	if strings.Contains(target, "/") {
-		parts := strings.SplitN(target, "/", 2)
-		model := strings.TrimSpace(parts[1])
-		if model != "" {
-			return model
-		}
-	}
-	return target
+	return providercatalog.NormalizeModelID(sourceProvider, target)
 }
 
 func resolveHermesConfiguredModelID(account *model.AgentAccount, accountModels []dto.AgentAccountModel, configuredModel string) (string, error) {
@@ -449,7 +444,7 @@ func resolveHermesConfiguredModelID(account *model.AgentAccount, accountModels [
 	if configuredModel == "" {
 		return "", buserr.New("ErrAgentModelNotInAccount")
 	}
-	provider := resolveHermesProvider(account.Provider)
+	provider := resolveHermesProvider(account.Provider, account.APIType)
 	for _, item := range accountModels {
 		if resolveHermesModel(account.Provider, provider, item.ID) == configuredModel {
 			return item.ID, nil
@@ -462,7 +457,8 @@ func resolveHermesEnvEntries(account *model.AgentAccount) []hermesEnvEntry {
 	if account == nil {
 		return nil
 	}
-	if resolveHermesProvider(account.Provider) == "custom" {
+	resolvedProvider := resolveHermesProvider(account.Provider, account.APIType)
+	if resolvedProvider == "custom" {
 		if account.APIKey == "" {
 			return nil
 		}
@@ -480,6 +476,11 @@ func resolveHermesEnvEntries(account *model.AgentAccount) []hermesEnvEntry {
 		}
 		entries = append(entries, hermesEnvEntry{Key: key, Value: value})
 	}
+	if resolvedProvider == "anthropic" {
+		appendEntry("ANTHROPIC_API_KEY", apiKey)
+		appendEntry("ANTHROPIC_BASE_URL", baseURL)
+		return entries
+	}
 
 	switch account.Provider {
 	case "openrouter":
@@ -487,6 +488,7 @@ func resolveHermesEnvEntries(account *model.AgentAccount) []hermesEnvEntry {
 		appendEntry("OPENROUTER_BASE_URL", baseURL)
 	case "anthropic":
 		appendEntry("ANTHROPIC_API_KEY", apiKey)
+		appendEntry("ANTHROPIC_BASE_URL", baseURL)
 	case "gemini":
 		appendEntry("GOOGLE_API_KEY", apiKey)
 		appendEntry("GEMINI_API_KEY", apiKey)
@@ -532,7 +534,7 @@ func resolveHermesEnvEntries(account *model.AgentAccount) []hermesEnvEntry {
 }
 
 func writeHermesModelEnv(envPath string, account *model.AgentAccount) error {
-	envMap, err := readHermesEnvMap(envPath)
+	envMap, err := readAgentEnvMap(envPath)
 	if err != nil {
 		return err
 	}
@@ -548,7 +550,7 @@ func writeHermesModelEnv(envPath string, account *model.AgentAccount) error {
 		envMap[entry.Key] = entry.Value
 		order = append(order, entry.Key)
 	}
-	return writeHermesEnvMap(envPath, envMap, order)
+	return writeAgentEnvMap(envPath, envMap, order)
 }
 
 func hermesManagedModelEnvKeys() []string {
@@ -556,6 +558,7 @@ func hermesManagedModelEnvKeys() []string {
 		"OPENROUTER_API_KEY",
 		"OPENROUTER_BASE_URL",
 		"ANTHROPIC_API_KEY",
+		"ANTHROPIC_BASE_URL",
 		"GOOGLE_API_KEY",
 		"GEMINI_API_KEY",
 		"GEMINI_BASE_URL",
@@ -598,46 +601,6 @@ func hermesManagedModelEnvKeys() []string {
 	return result
 }
 
-func writeHermesEnv(envPath string, entries []hermesEnvEntry) error {
-	envMap, err := readHermesEnvMap(envPath)
-	if err != nil {
-		return err
-	}
-	for _, entry := range entries {
-		if entry.Key == "" || entry.Value == "" {
-			continue
-		}
-		envMap[entry.Key] = entry.Value
-	}
-	order := make([]string, 0, len(entries))
-	for _, entry := range entries {
-		if entry.Key == "" {
-			continue
-		}
-		order = append(order, entry.Key)
-	}
-	return writeHermesEnvMap(envPath, envMap, order)
-}
-
-func readHermesEnvMap(envPath string) (map[string]string, error) {
-	fileOp := files.NewFileOp()
-	if !fileOp.Stat(envPath) {
-		return map[string]string{}, nil
-	}
-	envMap, err := godotenv.Read(envPath)
-	if err != nil {
-		return nil, err
-	}
-	return envMap, nil
-}
-
-func writeHermesEnvMap(envPath string, envMap map[string]string, order []string) error {
-	if len(envMap) == 0 {
-		return files.NewFileOp().SaveFile(envPath, "", 0600)
-	}
-	return agentenv.WriteWithOrder(envMap, envPath, order)
-}
-
 func splitHermesEnvList(value string) []string {
 	if value == "" {
 		return []string{}

agent/app/service/agents_hermes_channels.go

@@ -34,7 +34,7 @@ print('Restart the Hermes-Agent container to apply the new Weixin settings.')
 `
 
 func readHermesQQBotChannelConfig(confDir string) (*dto.AgentQQBotConfig, error) {
-	envMap, err := readHermesEnvMap(path.Join(confDir, ".env"))
+	envMap, err := readAgentEnvMap(path.Join(confDir, ".env"))
 	if err != nil {
 		return nil, err
 	}
@@ -78,7 +78,7 @@ func readHermesQQBotChannelConfig(confDir string) (*dto.AgentQQBotConfig, error)
 
 func writeHermesQQBotChannelConfig(confDir string, config dto.AgentQQBotConfig) error {
 	envPath := path.Join(confDir, ".env")
-	envMap, err := readHermesEnvMap(envPath)
+	envMap, err := readAgentEnvMap(envPath)
 	if err != nil {
 		return err
 	}
@@ -102,7 +102,7 @@ func writeHermesQQBotChannelConfig(confDir string, config dto.AgentQQBotConfig)
 			envMap["QQ_GROUP_ALLOWED_USERS"] = allow
 		}
 	}
-	if err := writeHermesEnvMap(envPath, envMap, []string{
+	if err := writeAgentEnvMap(envPath, envMap, []string{
 		"QQ_APP_ID",
 		"QQ_CLIENT_SECRET",
 		"QQ_ALLOW_ALL_USERS",
@@ -163,7 +163,7 @@ func deleteHermesQQBotChannelConfig(confDir string) error {
 }
 
 func readHermesWecomChannelConfig(confDir string) (*dto.AgentWecomConfig, error) {
-	envMap, err := readHermesEnvMap(path.Join(confDir, ".env"))
+	envMap, err := readAgentEnvMap(path.Join(confDir, ".env"))
 	if err != nil {
 		return nil, err
 	}
@@ -194,7 +194,7 @@ func readHermesWecomChannelConfig(confDir string) (*dto.AgentWecomConfig, error)
 
 func writeHermesWecomChannelConfig(confDir string, config dto.AgentWecomConfig) error {
 	envPath := path.Join(confDir, ".env")
-	envMap, err := readHermesEnvMap(envPath)
+	envMap, err := readAgentEnvMap(envPath)
 	if err != nil {
 		return err
 	}
@@ -229,7 +229,7 @@ func writeHermesWecomChannelConfig(confDir string, config dto.AgentWecomConfig)
 			envMap["WECOM_GROUP_ALLOWED_USERS"] = allow
 		}
 	}
-	if err := writeHermesEnvMap(envPath, envMap, []string{
+	if err := writeAgentEnvMap(envPath, envMap, []string{
 		"WECOM_BOT_ID",
 		"WECOM_SECRET",
 		"WECOM_DM_POLICY",
@@ -282,7 +282,7 @@ func deleteHermesWecomChannelConfig(confDir string) error {
 }
 
 func readHermesDingTalkChannelConfig(confDir string) (*dto.AgentDingTalkConfig, error) {
-	envMap, err := readHermesEnvMap(path.Join(confDir, ".env"))
+	envMap, err := readAgentEnvMap(path.Join(confDir, ".env"))
 	if err != nil {
 		return nil, err
 	}
@@ -332,7 +332,7 @@ func readHermesDingTalkChannelConfig(confDir string) (*dto.AgentDingTalkConfig,
 
 func writeHermesDingTalkChannelConfig(confDir string, config dto.AgentDingTalkConfig) error {
 	envPath := path.Join(confDir, ".env")
-	envMap, err := readHermesEnvMap(envPath)
+	envMap, err := readAgentEnvMap(envPath)
 	if err != nil {
 		return err
 	}
@@ -356,7 +356,7 @@ func writeHermesDingTalkChannelConfig(confDir string, config dto.AgentDingTalkCo
 	} else if config.DmPolicy == "open" {
 		envMap["DINGTALK_ALLOW_ALL_USERS"] = "true"
 	}
-	if err := writeHermesEnvMap(envPath, envMap, []string{
+	if err := writeAgentEnvMap(envPath, envMap, []string{
 		"DINGTALK_CLIENT_ID",
 		"DINGTALK_CLIENT_SECRET",
 		"DINGTALK_ALLOW_ALL_USERS",
@@ -398,7 +398,7 @@ func deleteHermesDingTalkChannelConfig(confDir string) error {
 }
 
 func readHermesFeishuChannelConfig(confDir string) (*dto.AgentFeishuConfig, error) {
-	envMap, err := readHermesEnvMap(path.Join(confDir, ".env"))
+	envMap, err := readAgentEnvMap(path.Join(confDir, ".env"))
 	if err != nil {
 		return nil, err
 	}
@@ -452,7 +452,7 @@ func readHermesFeishuChannelConfig(confDir string) (*dto.AgentFeishuConfig, erro
 
 func writeHermesFeishuChannelConfig(confDir string, config dto.AgentFeishuConfig) error {
 	envPath := path.Join(confDir, ".env")
-	envMap, err := readHermesEnvMap(envPath)
+	envMap, err := readAgentEnvMap(envPath)
 	if err != nil {
 		return err
 	}
@@ -488,7 +488,7 @@ func writeHermesFeishuChannelConfig(confDir string, config dto.AgentFeishuConfig
 			envMap["FEISHU_ALLOWED_USERS"] = allow
 		}
 	}
-	if err := writeHermesEnvMap(envPath, envMap, []string{
+	if err := writeAgentEnvMap(envPath, envMap, []string{
 		"FEISHU_APP_ID",
 		"FEISHU_APP_SECRET",
 		"FEISHU_DOMAIN",
@@ -529,7 +529,7 @@ func deleteHermesFeishuChannelConfig(confDir string) error {
 }
 
 func readHermesWeixinChannelConfig(confDir string) (*dto.AgentWeixinConfig, error) {
-	envMap, err := readHermesEnvMap(path.Join(confDir, ".env"))
+	envMap, err := readAgentEnvMap(path.Join(confDir, ".env"))
 	if err != nil {
 		return nil, err
 	}

agent/app/service/agents_plugins.go

@@ -0,0 +1,315 @@
+package service
+
+import (
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/app/task"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/i18n"
+	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
+	"github.com/1Panel-dev/1Panel/agent/utils/compose"
+)
+
+var (
+	openclawPluginPackagePattern = regexp.MustCompile(`^(@[a-z0-9][a-z0-9._-]*/)?[a-z0-9][a-z0-9._-]*$`)
+	openclawPluginVersionPattern = regexp.MustCompile(`^[0-9A-Za-z][0-9A-Za-z._-]*$`)
+	openclawPluginIDPattern      = regexp.MustCompile(`^(@[A-Za-z0-9][A-Za-z0-9._-]*/)?[A-Za-z0-9][A-Za-z0-9._-]*$`)
+)
+
+type openclawPluginListOutput struct {
+	Plugins []struct {
+		ID      string `json:"id"`
+		Name    string `json:"name"`
+		Version string `json:"version"`
+		Origin  string `json:"origin"`
+		Enabled bool   `json:"enabled"`
+	} `json:"plugins"`
+}
+
+type openclawPluginIndexItem struct {
+	PluginID       string `json:"pluginId"`
+	PackageName    string `json:"packageName"`
+	PackageVersion string `json:"packageVersion"`
+	Origin         string `json:"origin"`
+	Enabled        bool   `json:"enabled"`
+}
+
+type openclawPluginSearchOutput struct {
+	Results []struct {
+		Score   float64 `json:"score"`
+		Package struct {
+			Name             string   `json:"name"`
+			RuntimeID        string   `json:"runtimeId"`
+			DisplayName      string   `json:"displayName"`
+			Summary          string   `json:"summary"`
+			LatestVersion    string   `json:"latestVersion"`
+			Categories       []string `json:"categories"`
+			Channel          string   `json:"channel"`
+			IsOfficial       bool     `json:"isOfficial"`
+			VerificationTier string   `json:"verificationTier"`
+			Stats            struct {
+				Downloads int64 `json:"downloads"`
+			} `json:"stats"`
+		} `json:"package"`
+	} `json:"results"`
+}
+
+func (a AgentService) ListPlugins(req dto.AgentPluginsReq) ([]dto.AgentPluginItem, error) {
+	agent, install, err := a.loadOpenclawAgentAndInstall(req.AgentID)
+	if err != nil {
+		return nil, err
+	}
+	if plugins, err := readOpenclawPluginIndex(filepath.Join(filepath.Dir(agent.ConfigPath), "state", "openclaw.sqlite")); err == nil {
+		return plugins, nil
+	}
+	output, err := cmd.RunDockerExecWithStdout(2*time.Minute, install.ContainerName, "openclaw", "plugins", "list", "--json")
+	if err != nil {
+		return nil, err
+	}
+	return parseOpenclawPluginList([]byte(output))
+}
+
+func (a AgentService) SearchPlugins(req dto.AgentPluginSearchReq) ([]dto.AgentPluginSearchItem, error) {
+	_, install, err := a.loadOpenclawAgentAndInstall(req.AgentID)
+	if err != nil {
+		return nil, err
+	}
+	limit := req.Limit
+	if limit == 0 {
+		limit = 20
+	}
+	output, err := cmd.RunDockerExecWithStdout(
+		2*time.Minute,
+		install.ContainerName,
+		"openclaw", "plugins", "search", strings.TrimSpace(req.Keyword), "--limit", fmt.Sprint(limit), "--json",
+	)
+	if err != nil {
+		return nil, err
+	}
+	return parseOpenclawPluginSearch([]byte(output))
+}
+
+func (a AgentService) InstallMarketPlugin(req dto.AgentPluginMarketInstallReq) error {
+	spec, err := buildOpenclawPluginInstallSpec(req.Package, req.Version)
+	if err != nil {
+		return err
+	}
+	_, install, err := a.loadOpenclawAgentAndInstall(req.AgentID)
+	if err != nil {
+		return err
+	}
+	if err := task.CheckScopeTaskIsExecuting(task.TaskScopeAI, req.AgentID); err != nil {
+		return err
+	}
+	taskName := fmt.Sprintf("%s [%s]", i18n.GetMsgByKey("AgentPluginInstall"), req.Package)
+	installTask, err := task.NewTask(taskName, task.TaskInstall, task.TaskScopeAI, req.TaskID, req.AgentID)
+	if err != nil {
+		return err
+	}
+	installTask.AddSubTask(taskName, func(t *task.Task) error {
+		mgr := cmd.NewCommandMgr(cmd.WithTask(*t), cmd.WithContext(t.TaskCtx), cmd.WithTimeout(10*time.Minute))
+		return mgr.Run("docker", "exec", install.ContainerName, "openclaw", "plugins", "install", spec)
+	}, nil)
+	addOpenclawPluginRestartTask(installTask, install)
+	go executeAgentPluginTask(installTask)
+	return nil
+}
+
+func (a AgentService) OperatePlugin(req dto.AgentPluginOperateReq) error {
+	if !openclawPluginIDPattern.MatchString(req.PluginID) {
+		return buserr.New("ErrInvalidChar")
+	}
+	agent, install, err := a.loadOpenclawAgentAndInstall(req.AgentID)
+	if err != nil {
+		return err
+	}
+	if err := task.CheckScopeTaskIsExecuting(task.TaskScopeAI, req.AgentID); err != nil {
+		return err
+	}
+	if req.Operate == "update" || req.Operate == "uninstall" {
+		plugins, err := a.ListPlugins(dto.AgentPluginsReq{AgentID: req.AgentID})
+		if err != nil {
+			return err
+		}
+		for _, plugin := range plugins {
+			if plugin.ID == req.PluginID && plugin.Origin == "bundled" {
+				return buserr.WithName("ErrNotSupportType", req.Operate)
+			}
+		}
+	}
+
+	taskType := map[string]string{
+		"enable":    task.TaskUpdate,
+		"disable":   task.TaskUpdate,
+		"update":    task.TaskUpgrade,
+		"uninstall": task.TaskUninstall,
+	}[req.Operate]
+	taskName := fmt.Sprintf("%s [%s]", i18n.GetMsgByKey(map[string]string{
+		"enable":    "AgentPluginEnable",
+		"disable":   "AgentPluginDisable",
+		"update":    "AgentPluginUpdate",
+		"uninstall": "AgentPluginUninstall",
+	}[req.Operate]), req.PluginID)
+	operateTask, err := task.NewTask(taskName, taskType, task.TaskScopeAI, req.TaskID, req.AgentID)
+	if err != nil {
+		return err
+	}
+	operateTask.AddSubTask(taskName, func(t *task.Task) error {
+		mgr := cmd.NewCommandMgr(cmd.WithTask(*t), cmd.WithContext(t.TaskCtx), cmd.WithTimeout(10*time.Minute))
+		if req.Operate == "uninstall" {
+			if err := uninstallOpenclawPlugin(mgr, install.ContainerName, req.PluginID); err != nil {
+				return err
+			}
+			return cleanupManagedOpenclawPlugin(agent, req.PluginID)
+		}
+		return mgr.Run("docker", "exec", install.ContainerName, "openclaw", "plugins", req.Operate, req.PluginID)
+	}, nil)
+	addOpenclawPluginRestartTask(operateTask, install)
+	go executeAgentPluginTask(operateTask)
+	return nil
+}
+
+func parseOpenclawPluginList(raw []byte) ([]dto.AgentPluginItem, error) {
+	payload, err := extractEmbeddedJSON(string(raw))
+	if err != nil {
+		return nil, err
+	}
+	if len(payload) == 0 {
+		return []dto.AgentPluginItem{}, nil
+	}
+	var output openclawPluginListOutput
+	if err := json.Unmarshal(payload, &output); err != nil {
+		return nil, err
+	}
+	items := make([]dto.AgentPluginItem, 0, len(output.Plugins))
+	for _, plugin := range output.Plugins {
+		items = append(items, dto.AgentPluginItem{
+			ID:      plugin.ID,
+			Name:    plugin.Name,
+			Version: plugin.Version,
+			Origin:  plugin.Origin,
+			Enabled: plugin.Enabled,
+		})
+	}
+	return items, nil
+}
+
+func readOpenclawPluginIndex(dbPath string) ([]dto.AgentPluginItem, error) {
+	db, err := sql.Open("sqlite", "file:"+filepath.ToSlash(dbPath)+"?mode=ro")
+	if err != nil {
+		return nil, err
+	}
+	defer db.Close()
+
+	var raw []byte
+	if err := db.QueryRow(
+		"SELECT plugins_json FROM installed_plugin_index WHERE index_key = ?",
+		"installed-plugin-index",
+	).Scan(&raw); err != nil {
+		return nil, err
+	}
+
+	var plugins []openclawPluginIndexItem
+	if err := json.Unmarshal(raw, &plugins); err != nil {
+		return nil, err
+	}
+	items := make([]dto.AgentPluginItem, 0, len(plugins))
+	for _, plugin := range plugins {
+		name := plugin.PackageName
+		if name == "" {
+			name = plugin.PluginID
+		}
+		items = append(items, dto.AgentPluginItem{
+			ID:      plugin.PluginID,
+			Name:    name,
+			Version: plugin.PackageVersion,
+			Origin:  plugin.Origin,
+			Enabled: plugin.Enabled,
+		})
+	}
+	return items, nil
+}
+
+func parseOpenclawPluginSearch(raw []byte) ([]dto.AgentPluginSearchItem, error) {
+	payload, err := extractEmbeddedJSON(string(raw))
+	if err != nil {
+		return nil, err
+	}
+	if len(payload) == 0 {
+		return []dto.AgentPluginSearchItem{}, nil
+	}
+	var output openclawPluginSearchOutput
+	if err := json.Unmarshal(payload, &output); err != nil {
+		return nil, err
+	}
+	items := make([]dto.AgentPluginSearchItem, 0, len(output.Results))
+	for _, result := range output.Results {
+		items = append(items, dto.AgentPluginSearchItem{
+			Package:          result.Package.Name,
+			PluginID:         result.Package.RuntimeID,
+			Name:             result.Package.DisplayName,
+			Description:      result.Package.Summary,
+			Version:          result.Package.LatestVersion,
+			Channel:          result.Package.Channel,
+			VerificationTier: result.Package.VerificationTier,
+			Categories:       append([]string{}, result.Package.Categories...),
+			Official:         result.Package.IsOfficial,
+			Downloads:        result.Package.Stats.Downloads,
+			Score:            result.Score,
+		})
+	}
+	return items, nil
+}
+
+func buildOpenclawPluginInstallSpec(packageName, version string) (string, error) {
+	packageName = strings.TrimSpace(packageName)
+	version = strings.TrimSpace(version)
+	if !openclawPluginPackagePattern.MatchString(packageName) || !openclawPluginVersionPattern.MatchString(version) {
+		return "", buserr.New("ErrInvalidChar")
+	}
+	return "clawhub:" + packageName + "@" + version, nil
+}
+
+func cleanupManagedOpenclawPlugin(agent *model.Agent, pluginID string) error {
+	pluginType := map[string]string{
+		"openclaw-lark":         "feishu",
+		"openclaw-qqbot":        "qqbot",
+		"wecom-openclaw-plugin": "wecom",
+		"dingtalk-connector":    "dingtalk",
+		"openclaw-weixin":       "weixin",
+	}[pluginID]
+	if pluginType == "" {
+		return nil
+	}
+	conf, err := readOpenclawConfig(agent.ConfigPath)
+	if err != nil {
+		return err
+	}
+	cleanupOpenclawPluginConfig(conf, pluginType)
+	return writeOpenclawConfigRaw(agent.ConfigPath, conf)
+}
+
+func addOpenclawPluginRestartTask(t *task.Task, install *model.AppInstall) {
+	t.AddSubTask(task.GetTaskName("OpenClaw", task.TaskRestart, task.TaskScopeAI), func(t *task.Task) error {
+		output, err := compose.Restart(install.GetComposePath())
+		if output != "" {
+			t.Log(output)
+		}
+		return err
+	}, nil)
+}
+
+func executeAgentPluginTask(t *task.Task) {
+	if err := t.Execute(); err != nil {
+		global.LOG.Errorf("operate openclaw plugin failed: %v", err)
+	}
+}

agent/app/service/agents_utils.go

@@ -4,10 +4,12 @@ import (
 	"crypto/rand"
 	"encoding/hex"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"net/url"
 	"path"
+	"regexp"
 	"strconv"
 	"strings"
 	"time"
@@ -19,9 +21,12 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/buserr"
 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/i18n"
 	"github.com/1Panel-dev/1Panel/agent/utils/common"
+	agentenv "github.com/1Panel-dev/1Panel/agent/utils/env"
 	"github.com/1Panel-dev/1Panel/agent/utils/files"
 	"github.com/1Panel-dev/1Panel/agent/utils/req_helper"
+	"github.com/joho/godotenv"
 	"gorm.io/gorm"
 )
 
@@ -35,6 +40,39 @@ type resolvedAgentAccountInput struct {
 	Provider string
 	APIKey   string
 	BaseURL  string
+	APIType  string
+	AuthMode string
+}
+
+func ensureAgentAccountNameAvailable(provider, name string, excludeID uint) error {
+	opts := []repo.DBOption{repo.WithByProvider(provider), repo.WithByName(name)}
+	if excludeID > 0 {
+		opts = append(opts, repo.WithByNOTID(excludeID))
+	}
+	account, err := agentAccountRepo.GetFirst(opts...)
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	if account != nil && account.ID > 0 {
+		return buserr.New("ErrRecordExist")
+	}
+	return nil
+}
+
+func agentAccountUsedBySetting(tx *gorm.DB, accountID uint, statusKey, accountIDKey string) (bool, error) {
+	var settings []model.Setting
+	if err := tx.Where("key IN ?", []string{statusKey, accountIDKey}).Find(&settings).Error; err != nil {
+		return false, err
+	}
+	values := make(map[string]string, len(settings))
+	for _, setting := range settings {
+		values[setting.Key] = setting.Value
+	}
+	return strings.EqualFold(strings.TrimSpace(values[statusKey]), constant.StatusEnable) &&
+		strings.TrimSpace(values[accountIDKey]) == strconv.FormatUint(uint64(accountID), 10), nil
 }
 
 func loadOpenclawAgentByID(agentID uint) (*model.Agent, error) {
@@ -59,19 +97,27 @@ func ensureContainerRunning(containerName string) error {
 	return nil
 }
 
-func resolveAgentAccountInput(provider, apiKey, baseURL string) (resolvedAgentAccountInput, error) {
+func resolveAgentAccountInput(provider, apiType, authMode, apiKey, baseURL, modelID string, validateAvailability bool) (resolvedAgentAccountInput, error) {
 	resolvedAPIKey := strings.TrimSpace(apiKey)
-	resolvedBaseURL := strings.TrimSpace(baseURL)
-	if resolvedBaseURL == "" {
-		if requiresInitialAgentAccountModels(provider) {
+	resolvedAPIType := strings.TrimSpace(apiType)
+	resolvedAuthMode, err := providercatalog.ResolveAuthMode(provider, resolvedAPIType, authMode)
+	if err != nil {
+		return resolvedAgentAccountInput{}, err
+	}
+	resolvedBaseURL, err := providercatalog.ResolveBaseURL(provider, resolvedAPIType, baseURL)
+	if err != nil {
+		if strings.Contains(err.Error(), "base url is required") {
 			return resolvedAgentAccountInput{}, buserr.New("ErrAgentBaseURLRequired")
 		}
-		if defaultURL, ok := providercatalog.DefaultBaseURL(provider); ok {
-			resolvedBaseURL = defaultURL
-		}
+		return resolvedAgentAccountInput{}, err
 	}
-	if !providercatalog.SkipVerification(provider) {
-		if err := providercatalog.VerifyAccount(provider, resolvedBaseURL, resolvedAPIKey); err != nil {
+	modelID = strings.TrimSpace(modelID)
+	if modelID == "" {
+		return resolvedAgentAccountInput{}, buserr.New("ErrAgentAccountModelsRequired")
+	}
+	imageAPI := providercatalog.IsImageAPIType(resolvedAPIType)
+	if validateAvailability && (imageAPI || providercatalog.IsEmbeddingAPIType(resolvedAPIType) || !providercatalog.SkipVerification(provider)) {
+		if err := providercatalog.VerifyAccount(provider, resolvedAPIType, resolvedAuthMode, resolvedBaseURL, resolvedAPIKey, modelID); err != nil {
 			return resolvedAgentAccountInput{}, err
 		}
 	}
@@ -79,6 +125,8 @@ func resolveAgentAccountInput(provider, apiKey, baseURL string) (resolvedAgentAc
 		Provider: provider,
 		APIKey:   resolvedAPIKey,
 		BaseURL:  resolvedBaseURL,
+		APIType:  resolvedAPIType,
+		AuthMode: resolvedAuthMode,
 	}, nil
 }
 
@@ -335,26 +383,24 @@ func setOtherConfig(conf map[string]interface{}, config dto.AgentOtherConfig) {
 func buildAgentItem(agent *model.Agent, appInstall *model.AppInstall, envMap map[string]interface{}) dto.AgentItem {
 	agentType := agent.AgentType
 	item := dto.AgentItem{
-		ID:            agent.ID,
-		Name:          agent.Name,
-		Remark:        agent.Remark,
-		AgentType:     agentType,
-		Provider:      agent.Provider,
-		ProviderName:  providercatalog.DisplayName(agent.Provider),
-		Model:         agent.Model,
-		APIType:       agent.APIType,
-		MaxTokens:     agent.MaxTokens,
-		ContextWindow: agent.ContextWindow,
-		BaseURL:       agent.BaseURL,
-		APIKey:        maskKey(agent.APIKey),
-		Token:         agent.Token,
-		Status:        agent.Status,
-		Message:       agent.Message,
-		AppInstallID:  agent.AppInstallID,
-		WebsiteID:     agent.WebsiteID,
-		AccountID:     agent.AccountID,
-		ConfigPath:    agent.ConfigPath,
-		CreatedAt:     agent.CreatedAt,
+		ID:           agent.ID,
+		Name:         agent.Name,
+		Remark:       agent.Remark,
+		AgentType:    agentType,
+		Provider:     agent.Provider,
+		ProviderName: localizedAgentProviderName(agent.Provider),
+		Model:        agent.Model,
+		APIType:      agent.APIType,
+		BaseURL:      agent.BaseURL,
+		APIKey:       maskKey(agent.APIKey),
+		Token:        agent.Token,
+		Status:       agent.Status,
+		Message:      agent.Message,
+		AppInstallID: agent.AppInstallID,
+		WebsiteID:    agent.WebsiteID,
+		AccountID:    agent.AccountID,
+		ConfigPath:   agent.ConfigPath,
+		CreatedAt:    agent.CreatedAt,
 	}
 	if appInstall != nil && appInstall.ID > 0 {
 		item.Container = appInstall.ContainerName
@@ -376,10 +422,24 @@ func buildAgentItem(agent *model.Agent, appInstall *model.AppInstall, envMap map
 				item.BridgePort = toInt(bridge)
 			}
 		}
+		if _, _, ok := agentDashboardAuthEnvKeys(agentType); ok {
+			auth := readAgentDashboardAuthFromInstall(appInstall, agentType)
+			item.DashboardUsername = auth.Username
+			item.DashboardPassword = auth.Password
+		}
 	}
 	return item
 }
 
+func localizedAgentProviderName(provider string) string {
+	if key := providercatalog.DisplayNameKey(provider); key != "" {
+		if name := strings.TrimSpace(i18n.GetMsgByKey(key)); name != "" {
+			return name
+		}
+	}
+	return providercatalog.DisplayName(provider)
+}
+
 func isAgentAppKey(appKey string) bool {
 	return appKey == constant.AppOpenclaw || appKey == constant.AppCopaw || appKey == constant.AppHermesAgent
 }
@@ -677,13 +737,9 @@ type modelProvider struct {
 }
 
 type modelEntry struct {
-	ID            string    `json:"id"`
-	Name          string    `json:"name"`
-	Reasoning     bool      `json:"reasoning"`
-	Input         []string  `json:"input"`
-	ContextWindow int       `json:"contextWindow"`
-	MaxTokens     int       `json:"maxTokens"`
-	Cost          modelCost `json:"cost"`
+	ID    string   `json:"id"`
+	Name  string   `json:"name"`
+	Input []string `json:"input,omitempty"`
 }
 
 func requiresOpenclawProviderModels(provider string) bool {
@@ -703,13 +759,6 @@ func applyOpenclawModelsConfig(conf map[string]interface{}, models *modelsConfig
 	return nil
 }
 
-type modelCost struct {
-	Input      float64 `json:"input"`
-	Output     float64 `json:"output"`
-	CacheRead  float64 `json:"cacheRead"`
-	CacheWrite float64 `json:"cacheWrite"`
-}
-
 type browserConfig struct {
 	Enabled        bool   `json:"enabled"`
 	ExecutablePath string `json:"executablePath"`
@@ -860,13 +909,15 @@ func writeOpenclawConfig(confDir string, account *model.AgentAccount, modelName,
 	if err := writeOpenclawConfigRaw(configPath, conf); err != nil {
 		return err
 	}
-	envPath := path.Join(confDir, ".env")
-	lines := []string{fmt.Sprintf("OPENCLAW_GATEWAY_TOKEN=%s", token)}
-	if envKey := providercatalog.EnvKey(account.Provider); envKey != "" && account.APIKey != "" {
-		lines = append(lines, fmt.Sprintf("%s=%s", envKey, account.APIKey))
+	envMap := map[string]string{
+		"OPENCLAW_GATEWAY_TOKEN": token,
 	}
-	content := strings.Join(lines, "\n") + "\n"
-	return fileOp.SaveFile(envPath, content, 0600)
+	order := []string{"OPENCLAW_GATEWAY_TOKEN"}
+	if envKey := providercatalog.EnvKey(account.Provider); envKey != "" && account.APIKey != "" {
+		envMap[envKey] = account.APIKey
+		order = append(order, envKey)
+	}
+	return writeAgentEnvMap(path.Join(confDir, ".env"), envMap, order)
 }
 
 func resolveOpenclawFallbackModels(account *model.AgentAccount, primaryModel string, fallbackIDs []string) ([]string, error) {
@@ -1053,7 +1104,7 @@ func buildOpenclawModelsFromAccount(account *model.AgentAccount, selectedModel s
 }
 
 func buildOpenclawAccountModelConfig(account *model.AgentAccount, model dto.AgentAccountModel) (string, modelEntry, string, modelProvider, error) {
-	providerPatch, err := providercatalog.BuildOpenClawProviderPatch(account.Provider, model.ID, account.APIType, account.BaseURL, account.APIKey)
+	providerPatch, err := providercatalog.BuildOpenClawProviderPatch(account.Provider, model.ID, account.APIType, account.AuthMode, account.BaseURL, account.APIKey)
 	if err != nil {
 		return "", modelEntry{}, "", modelProvider{}, err
 	}
@@ -1065,28 +1116,24 @@ func buildOpenclawAccountModelConfig(account *model.AgentAccount, model dto.Agen
 	}, nil
 }
 
+var openclawVisionModelPattern = regexp.MustCompile(`(?i)(\b(gpt-4o|gpt-4\.1|gpt-[5-9]|o[134])\b|\bclaude-(3|4|sonnet|opus|haiku)\b|\bgemini\b|\b(qwen[\w.-]*-?vl|qwen-vl|qwen3\.[5-9]-plus)\b|\b(kimi-k2\.(5|6)|kimi-k2\.7-code|minimax-m3)\b|\b(vision|llava|pixtral|internvl|mllama|minicpm-v|glm-4v|omni)\b|(^|[-_/])vl([-_/]|$))`)
+
 func buildOpenclawModelEntry(modelID string, model dto.AgentAccountModel) modelEntry {
 	name := strings.TrimSpace(model.Name)
 	if name == "" {
 		name = strings.TrimSpace(modelID)
 	}
-	return modelEntry{
-		ID:            strings.TrimSpace(modelID),
-		Name:          name,
-		Reasoning:     model.Reasoning,
-		Input:         sanitizeAgentAccountModelInputs(model.Input),
-		ContextWindow: model.ContextWindow,
-		MaxTokens:     model.MaxTokens,
-		Cost:          modelCost{},
+	entry := modelEntry{ID: strings.TrimSpace(modelID), Name: name}
+	if openclawVisionModelPattern.MatchString(modelID) {
+		entry.Input = []string{"text", "image"}
 	}
+	return entry
 }
 
 type openclawAccountModelRuntime struct {
-	StoredModel   string
-	PrimaryModel  string
-	APIType       string
-	MaxTokens     int
-	ContextWindow int
+	StoredModel  string
+	PrimaryModel string
+	APIType      string
 }
 
 func buildOpenclawAccountModelRuntime(account *model.AgentAccount, model dto.AgentAccountModel) (openclawAccountModelRuntime, error) {
@@ -1095,11 +1142,9 @@ func buildOpenclawAccountModelRuntime(account *model.AgentAccount, model dto.Age
 		return openclawAccountModelRuntime{}, err
 	}
 	return openclawAccountModelRuntime{
-		StoredModel:   model.ID,
-		PrimaryModel:  primaryModel,
-		APIType:       account.APIType,
-		MaxTokens:     model.MaxTokens,
-		ContextWindow: model.ContextWindow,
+		StoredModel:  model.ID,
+		PrimaryModel: primaryModel,
+		APIType:      account.APIType,
 	}, nil
 }
 
@@ -1119,35 +1164,38 @@ func buildInitialAgentAccountModels(account *model.AgentAccount, requested []dto
 	if account == nil {
 		return nil, fmt.Errorf("account is required")
 	}
-	if requiresInitialAgentAccountModels(account.Provider) && len(requested) > 1 {
+	if account.Provider != "custom" && requiresInitialAgentAccountModels(account.Provider) && len(requested) > 1 {
 		return nil, buserr.New("ErrAgentAccountSingleInitialModel")
 	}
 	if len(requested) > 0 {
-		models := make([]dto.AgentAccountModel, 0, len(requested))
-		for _, item := range requested {
-			models = append(models, cloneAgentAccountModel(item))
-		}
-		return models, nil
+		return normalizeAgentAccountModels(account, requested)
 	}
-	meta, ok := providercatalog.Get(account.Provider)
-	if !ok || len(meta.Models) == 0 {
+	defaultModels := providercatalog.DefaultModels(account.Provider, account.APIType)
+	if len(defaultModels) == 0 {
 		if requiresInitialAgentAccountModels(account.Provider) {
 			return nil, buserr.New("ErrAgentAccountModelsRequired")
 		}
 		return nil, nil
 	}
-	requested = make([]dto.AgentAccountModel, 0, len(meta.Models))
-	for _, item := range meta.Models {
+	requested = make([]dto.AgentAccountModel, 0, len(defaultModels))
+	for _, item := range defaultModels {
 		requested = append(requested, dto.AgentAccountModel{
-			ID:            item.ID,
-			Name:          item.Name,
-			ContextWindow: item.ContextWindow,
-			MaxTokens:     item.MaxTokens,
-			Reasoning:     item.Reasoning,
-			Input:         append([]string(nil), item.Input...),
+			ID:   item.ID,
+			Name: item.Name,
 		})
 	}
-	return requested, nil
+	return normalizeAgentAccountModels(account, requested)
+}
+
+func buildDiscoveredAgentAccountModels(modelIDs []string) []dto.AgentAccountModel {
+	models := make([]dto.AgentAccountModel, 0, len(modelIDs))
+	for _, modelID := range modelIDs {
+		models = append(models, dto.AgentAccountModel{
+			ID:   modelID,
+			Name: modelID,
+		})
+	}
+	return models
 }
 
 func compactPersistedAgentAccountModelSortOrder(accountID uint) error {
@@ -1175,18 +1223,6 @@ func loadAgentAccountModels(account *model.AgentAccount) ([]dto.AgentAccountMode
 	return listPersistedAgentAccountModels(account.ID)
 }
 
-func cloneAgentAccountModel(model dto.AgentAccountModel) dto.AgentAccountModel {
-	return dto.AgentAccountModel{
-		RecordID:      model.RecordID,
-		ID:            model.ID,
-		Name:          model.Name,
-		ContextWindow: model.ContextWindow,
-		MaxTokens:     model.MaxTokens,
-		Reasoning:     model.Reasoning,
-		Input:         append([]string(nil), model.Input...),
-	}
-}
-
 func MergeCatalogAgentAccountModelsForMigration(account *model.AgentAccount, existing []dto.AgentAccountModel) ([]dto.AgentAccountModel, error) {
 	if account == nil {
 		return nil, fmt.Errorf("account is required")
@@ -1210,12 +1246,8 @@ func MergeCatalogAgentAccountModelsForMigration(account *model.AgentAccount, exi
 			continue
 		}
 		requested = append(requested, dto.AgentAccountModel{
-			ID:            item.ID,
-			Name:          item.Name,
-			ContextWindow: item.ContextWindow,
-			MaxTokens:     item.MaxTokens,
-			Reasoning:     item.Reasoning,
-			Input:         append([]string(nil), item.Input...),
+			ID:   item.ID,
+			Name: item.Name,
 		})
 	}
 	if len(requested) == len(existing) {
@@ -1234,18 +1266,10 @@ func listPersistedAgentAccountModels(accountID uint) ([]dto.AgentAccountModel, e
 	}
 	result := make([]dto.AgentAccountModel, 0, len(rows))
 	for _, row := range rows {
-		inputs := []string{}
-		if strings.TrimSpace(row.Input) != "" {
-			_ = json.Unmarshal([]byte(row.Input), &inputs)
-		}
 		result = append(result, dto.AgentAccountModel{
-			RecordID:      row.ID,
-			ID:            strings.TrimSpace(row.Model),
-			Name:          strings.TrimSpace(row.Name),
-			ContextWindow: row.ContextWindow,
-			MaxTokens:     row.MaxTokens,
-			Reasoning:     row.Reasoning,
-			Input:         sanitizeAgentAccountModelInputs(inputs),
+			RecordID: row.ID,
+			ID:       strings.TrimSpace(row.Model),
+			Name:     strings.TrimSpace(row.Name),
 		})
 	}
 	return result, nil
@@ -1256,19 +1280,11 @@ func replacePersistedAgentAccountModelsWithTx(tx *gorm.DB, accountID uint, model
 		return err
 	}
 	for index, item := range models {
-		inputPayload, err := json.Marshal(sanitizeAgentAccountModelInputs(item.Input))
-		if err != nil {
-			return err
-		}
 		record := &model.AgentAccountModel{
-			AccountID:     accountID,
-			Model:         strings.TrimSpace(item.ID),
-			Name:          strings.TrimSpace(item.Name),
-			ContextWindow: item.ContextWindow,
-			MaxTokens:     item.MaxTokens,
-			Reasoning:     item.Reasoning,
-			Input:         string(inputPayload),
-			SortOrder:     index + 1,
+			AccountID: accountID,
+			Model:     strings.TrimSpace(item.ID),
+			Name:      strings.TrimSpace(item.Name),
+			SortOrder: index + 1,
 		}
 		if err := tx.Create(record).Error; err != nil {
 			return err
@@ -1309,86 +1325,17 @@ func normalizeAgentAccountModel(account *model.AgentAccount, model dto.AgentAcco
 	if modelID == "" {
 		return dto.AgentAccountModel{}, fmt.Errorf("model is required")
 	}
+	modelID = providercatalog.NormalizeModelID(account.Provider, modelID)
 	name := strings.TrimSpace(model.Name)
 	if name == "" {
 		name = modelID
 	}
-	inputs := sanitizeAgentAccountModelInputs(model.Input)
 	return dto.AgentAccountModel{
-		ID:            normalizeAgentAccountModelID(account.Provider, modelID),
-		Name:          name,
-		ContextWindow: model.ContextWindow,
-		MaxTokens:     model.MaxTokens,
-		Reasoning:     model.Reasoning,
-		Input:         inputs,
+		ID:   modelID,
+		Name: name,
 	}, nil
 }
 
-func normalizeAgentAccountModelID(provider, requestedID string) string {
-	switch provider {
-	case "custom", "vllm":
-		return normalizeCustomModel(requestedID)
-	case "ollama":
-		target := strings.TrimSpace(requestedID)
-		if strings.HasPrefix(target, "ollama/") {
-			return target
-		}
-		target = strings.TrimLeft(strings.TrimSpace(target), "/")
-		if target == "" {
-			return ""
-		}
-		return "ollama/" + target
-	default:
-		target := strings.TrimSpace(requestedID)
-		if target == "" {
-			return ""
-		}
-		prefix := poolModelPrefix(provider)
-		if strings.Contains(target, "/") {
-			parts := strings.SplitN(target, "/", 2)
-			targetPrefix := parts[0]
-			targetModel := strings.TrimSpace(parts[1])
-			if targetModel == "" {
-				return strings.TrimSpace(target)
-			}
-			for _, item := range supportedProviderModelPrefixes(provider) {
-				if item == targetPrefix {
-					if prefix != "" {
-						return prefix + "/" + targetModel
-					}
-					return strings.TrimSpace(target)
-				}
-			}
-			return strings.TrimSpace(target)
-		}
-		target = strings.TrimLeft(strings.TrimSpace(target), "/")
-		if prefix == "" {
-			return target
-		}
-		return prefix + "/" + target
-	}
-}
-
-func sanitizeAgentAccountModelInputs(values []string) []string {
-	result := make([]string, 0, len(values))
-	seen := make(map[string]struct{}, len(values))
-	for _, value := range values {
-		normalized := value
-		if normalized != "text" && normalized != "image" {
-			continue
-		}
-		if _, ok := seen[normalized]; ok {
-			continue
-		}
-		seen[normalized] = struct{}{}
-		result = append(result, normalized)
-	}
-	if len(result) == 0 {
-		return []string{"text"}
-	}
-	return result
-}
-
 func requiresInitialAgentAccountModels(provider string) bool {
 	switch provider {
 	case "custom", "vllm", "ollama":
@@ -1398,36 +1345,14 @@ func requiresInitialAgentAccountModels(provider string) bool {
 	}
 }
 
-func normalizeComparableProviderModelID(provider, modelID string) string {
-	target := strings.TrimSpace(modelID)
-	if target == "" {
-		return ""
-	}
-	if !strings.Contains(target, "/") {
-		return target
-	}
-	parts := strings.SplitN(target, "/", 2)
-	prefix := parts[0]
-	model := strings.TrimSpace(parts[1])
-	if model == "" {
-		return target
-	}
-	for _, item := range supportedProviderModelPrefixes(provider) {
-		if item == prefix {
-			return model
-		}
-	}
-	return target
-}
-
 func sameProviderModelID(provider, left, right string) bool {
 	leftTrimmed := strings.TrimSpace(left)
 	rightTrimmed := strings.TrimSpace(right)
 	if leftTrimmed == rightTrimmed {
 		return true
 	}
-	leftComparable := normalizeComparableProviderModelID(provider, leftTrimmed)
-	rightComparable := normalizeComparableProviderModelID(provider, rightTrimmed)
+	leftComparable := providercatalog.NormalizeModelID(provider, leftTrimmed)
+	rightComparable := providercatalog.NormalizeModelID(provider, rightTrimmed)
 	return leftComparable != "" && leftComparable == rightComparable
 }
 
@@ -1448,6 +1373,20 @@ func requireAgentAccountModelForProvider(provider string, models []dto.AgentAcco
 	return selectedAccountModel, nil
 }
 
+func resolveAgentAccountVerifyModel(provider, requested string, models []dto.AgentAccountModel) (string, error) {
+	if len(models) == 0 {
+		return "", buserr.New("ErrAgentAccountModelsRequired")
+	}
+	if strings.TrimSpace(requested) == "" {
+		return models[0].ID, nil
+	}
+	selected, ok := findAgentAccountModelForProvider(provider, models, requested)
+	if !ok {
+		return "", buserr.New("ErrAgentModelNotInAccount")
+	}
+	return selected.ID, nil
+}
+
 func ensureAccountModelsNotBound(account *model.AgentAccount, models []dto.AgentAccountModel) error {
 	if account == nil || account.ID == 0 {
 		return nil
@@ -1524,6 +1463,122 @@ func readInstallEnv(envStr string) map[string]interface{} {
 	return data
 }
 
+const (
+	hermesDashboardUsernameEnvKey = "HERMES_DASHBOARD_USERNAME"
+	hermesDashboardPasswordEnvKey = "HERMES_DASHBOARD_PASSWORD"
+	qwenPawAuthEnabledEnvKey      = "QWENPAW_AUTH_ENABLED"
+	qwenPawAuthUsernameEnvKey     = "QWENPAW_AUTH_USERNAME"
+	qwenPawAuthPasswordEnvKey     = "QWENPAW_AUTH_PASSWORD"
+)
+
+type agentDashboardAuth struct {
+	Username string
+	Password string
+}
+
+func normalizeAgentDashboardAuth(username, password string) agentDashboardAuth {
+	auth := agentDashboardAuth{
+		Username: strings.TrimSpace(username),
+		Password: strings.TrimSpace(password),
+	}
+	if auth.Username == "" {
+		auth.Username = "admin"
+	}
+	if auth.Password == "" {
+		auth.Password = common.RandStr(8)
+	}
+	return auth
+}
+
+func agentDashboardAuthEnvKeys(agentType string) (string, string, bool) {
+	switch agentType {
+	case constant.AppHermesAgent:
+		return hermesDashboardUsernameEnvKey, hermesDashboardPasswordEnvKey, true
+	case constant.AppCopaw:
+		return qwenPawAuthUsernameEnvKey, qwenPawAuthPasswordEnvKey, true
+	default:
+		return "", "", false
+	}
+}
+
+func writeAgentDashboardAuthEnv(envPath, agentType string, auth agentDashboardAuth, overwrite bool) error {
+	usernameKey, passwordKey, ok := agentDashboardAuthEnvKeys(agentType)
+	if !ok {
+		return fmt.Errorf("dashboard auth is not supported for %s", agentType)
+	}
+	values := map[string]string{
+		usernameKey: auth.Username,
+		passwordKey: auth.Password,
+	}
+	order := []string{usernameKey, passwordKey}
+	if agentType == constant.AppCopaw {
+		values[qwenPawAuthEnabledEnvKey] = "true"
+		order = append([]string{qwenPawAuthEnabledEnvKey}, order...)
+	}
+	return upsertAgentEnv(envPath, values, order, overwrite)
+}
+
+func readAgentDashboardAuthEnv(envPath, agentType string) (agentDashboardAuth, error) {
+	usernameKey, passwordKey, ok := agentDashboardAuthEnvKeys(agentType)
+	if !ok {
+		return agentDashboardAuth{}, fmt.Errorf("dashboard auth is not supported for %s", agentType)
+	}
+	envMap, err := readAgentEnvMap(envPath)
+	if err != nil {
+		return agentDashboardAuth{}, err
+	}
+	return agentDashboardAuth{
+		Username: strings.TrimSpace(envMap[usernameKey]),
+		Password: strings.TrimSpace(envMap[passwordKey]),
+	}, nil
+}
+
+func readAgentDashboardAuthFromInstall(appInstall *model.AppInstall, agentType string) agentDashboardAuth {
+	if appInstall == nil || appInstall.ID == 0 {
+		return agentDashboardAuth{}
+	}
+	auth, err := readAgentDashboardAuthEnv(appInstall.GetEnvPath(), agentType)
+	if err != nil {
+		return agentDashboardAuth{}
+	}
+	return auth
+}
+
+func readAgentEnvMap(envPath string) (map[string]string, error) {
+	fileOp := files.NewFileOp()
+	if !fileOp.Stat(envPath) {
+		return map[string]string{}, nil
+	}
+	envMap, err := godotenv.Read(envPath)
+	if err != nil {
+		return nil, err
+	}
+	return envMap, nil
+}
+
+func writeAgentEnvMap(envPath string, envMap map[string]string, order []string) error {
+	if len(envMap) == 0 {
+		return files.NewFileOp().SaveFile(envPath, "", 0600)
+	}
+	return agentenv.WriteWithOrder(envMap, envPath, order)
+}
+
+func upsertAgentEnv(envPath string, values map[string]string, order []string, overwrite bool) error {
+	envMap, err := readAgentEnvMap(envPath)
+	if err != nil {
+		return err
+	}
+	for key, value := range values {
+		if key == "" {
+			continue
+		}
+		if overwrite || strings.TrimSpace(envMap[key]) == "" {
+			envMap[key] = value
+		}
+	}
+	return writeAgentEnvMap(envPath, envMap, order)
+}
+
 func maskKey(value string) string {
 	trim := strings.TrimSpace(value)
 	if len(trim) <= 6 {
@@ -1551,57 +1606,6 @@ func toInt(value interface{}) int {
 	}
 }
 
-func normalizeCustomModel(modelName string) string {
-	trim := strings.TrimSpace(modelName)
-	trim = strings.TrimLeft(trim, "/")
-	if parts := strings.SplitN(trim, "/", 2); len(parts) == 2 {
-		if strings.EqualFold(parts[0], "custom") {
-			return strings.TrimLeft(strings.TrimSpace(parts[1]), "/")
-		}
-	}
-	return trim
-}
-
-func runtimeProviderModelPrefix(provider string) string {
-	switch provider {
-	case "gemini":
-		return "google"
-	case "kimi":
-		return "moonshot"
-	default:
-		return provider
-	}
-}
-
-func poolModelPrefix(provider string) string {
-	meta, ok := providercatalog.Get(provider)
-	if ok && len(meta.Models) > 0 {
-		parts := strings.SplitN(strings.TrimSpace(meta.Models[0].ID), "/", 2)
-		if len(parts) == 2 && strings.TrimSpace(parts[0]) != "" {
-			return parts[0]
-		}
-	}
-	return provider
-}
-
-func supportedProviderModelPrefixes(provider string) []string {
-	values := []string{poolModelPrefix(provider), runtimeProviderModelPrefix(provider)}
-	result := make([]string, 0, len(values))
-	seen := make(map[string]struct{}, len(values))
-	for _, value := range values {
-		target := value
-		if target == "" {
-			continue
-		}
-		if _, ok := seen[target]; ok {
-			continue
-		}
-		seen[target] = struct{}{}
-		result = append(result, target)
-	}
-	return result
-}
-
 func generateToken() string {
 	bytes := make([]byte, 24)
 	if _, err := rand.Read(bytes); err != nil {

agent/app/service/agents_website.go

@@ -162,7 +162,7 @@ func fillAgentWebsiteItems(items []dto.AgentItem, explicitWebsiteMap map[uint]mo
 	}
 }
 
-func uniqueDeploymentWebsiteMapByAppInstall(websites []model.Website) map[uint]model.Website {
+func UniqueDeploymentWebsiteMapByAppInstall(websites []model.Website) map[uint]model.Website {
 	websiteMap := make(map[uint]model.Website)
 	duplicateAppInstallIDs := make(map[uint]struct{})
 	for _, website := range websites {
@@ -182,10 +182,6 @@ func uniqueDeploymentWebsiteMapByAppInstall(websites []model.Website) map[uint]m
 	return websiteMap
 }
 
-func UniqueDeploymentWebsiteMapForMigration(websites []model.Website) map[uint]model.Website {
-	return uniqueDeploymentWebsiteMapByAppInstall(websites)
-}
-
 func uniqueUintList(items []uint) []uint {
 	itemMap := make(map[uint]struct{}, len(items))
 	uniq := make([]uint, 0, len(items))

agent/app/service/ai/vllm_upgrade.go

@@ -0,0 +1,139 @@
+package service
+
+import (
+	"encoding/json"
+	"strings"
+
+	"github.com/1Panel-dev/1Panel/agent/utils/common"
+)
+
+const (
+	vllmAppKeyForUpgrade = "vllm"
+	vllmImageEnvKey      = "IMAGE"
+	vllmImageTypeNvidia  = "nvidia"
+	vllmImageTypeIntel   = "intel"
+	vllmImageTypeAscend  = "ascend"
+)
+
+func resolveVllmVersionFamily(version, image string) string {
+	normalizedVersion := strings.ToLower(strings.TrimSpace(version))
+	if strings.HasPrefix(normalizedVersion, vllmImageTypeIntel+"-") {
+		return vllmImageTypeIntel
+	}
+	if strings.HasPrefix(normalizedVersion, vllmImageTypeAscend+"-") {
+		return vllmImageTypeAscend
+	}
+	if strings.HasPrefix(normalizedVersion, vllmImageTypeNvidia+"-") {
+		return vllmImageTypeNvidia
+	}
+	normalizedImage := strings.ToLower(strings.TrimSpace(image))
+	if strings.Contains(normalizedImage, "intel/") || strings.Contains(normalizedImage, "llm-scaler-vllm") {
+		return vllmImageTypeIntel
+	}
+	if strings.Contains(normalizedImage, "ascend/") || strings.Contains(normalizedImage, "vllm-ascend") {
+		return vllmImageTypeAscend
+	}
+	return vllmImageTypeNvidia
+}
+
+func trimVllmVersionFamily(version string) string {
+	trimmed := strings.TrimSpace(version)
+	normalized := strings.ToLower(trimmed)
+	for _, family := range []string{vllmImageTypeNvidia, vllmImageTypeIntel, vllmImageTypeAscend} {
+		prefix := family + "-"
+		if strings.HasPrefix(normalized, prefix) {
+			return strings.TrimSpace(trimmed[len(prefix):])
+		}
+	}
+	return trimmed
+}
+
+func buildDefaultVllmImageByVersion(version string) string {
+	tag := trimVllmVersionFamily(version)
+	family := resolveVllmVersionFamily(version, "")
+	if family == vllmImageTypeIntel {
+		return "intel/llm-scaler-vllm:" + tag
+	}
+	if tag != "" && !strings.HasPrefix(strings.ToLower(tag), "v") {
+		tag = "v" + tag
+	}
+	if family == vllmImageTypeAscend {
+		return "quay.io/ascend/vllm-ascend:" + tag
+	}
+	return "vllm/vllm-openai:" + tag
+}
+
+func isVllmUpgradeVersionAllowed(currentVersion, targetVersion, currentImage string) bool {
+	currentFamily := resolveVllmVersionFamily(currentVersion, currentImage)
+	targetFamily := resolveVllmVersionFamily(targetVersion, "")
+	return currentFamily == targetFamily
+}
+
+func hasVllmVersionFamilyPrefix(version string) bool {
+	normalized := strings.ToLower(strings.TrimSpace(version))
+	return strings.HasPrefix(normalized, vllmImageTypeNvidia+"-") ||
+		strings.HasPrefix(normalized, vllmImageTypeIntel+"-") ||
+		strings.HasPrefix(normalized, vllmImageTypeAscend+"-")
+}
+
+func isVllmUpgradeCandidate(currentVersion, targetVersion, currentImage string) bool {
+	if strings.TrimSpace(currentVersion) == strings.TrimSpace(targetVersion) {
+		return false
+	}
+	if !isVllmUpgradeVersionAllowed(currentVersion, targetVersion, currentImage) {
+		return false
+	}
+	if common.CompareVersion(targetVersion, currentVersion) {
+		return true
+	}
+	return !hasVllmVersionFamilyPrefix(currentVersion) &&
+		resolveVllmVersionFamily(targetVersion, "") == vllmImageTypeNvidia &&
+		trimVllmVersionFamily(currentVersion) == trimVllmVersionFamily(targetVersion)
+}
+
+func buildVllmUpgradeImage(currentImage, currentVersion, targetVersion string) string {
+	trimmedImage := strings.TrimSpace(currentImage)
+	if trimmedImage == "" || trimmedImage == buildDefaultVllmImageByVersion(currentVersion) {
+		return buildDefaultVllmImageByVersion(targetVersion)
+	}
+	return trimmedImage
+}
+
+func loadVllmImageFromEnv(raw string) string {
+	envs := make(map[string]interface{})
+	if strings.TrimSpace(raw) == "" {
+		return ""
+	}
+	if err := json.Unmarshal([]byte(raw), &envs); err != nil {
+		return ""
+	}
+	if image, ok := envs[vllmImageEnvKey].(string); ok {
+		return strings.TrimSpace(image)
+	}
+	return ""
+}
+
+func setVllmImageInEnvContent(content []byte, image string) []byte {
+	normalizedImage := strings.TrimSpace(image)
+	if normalizedImage == "" {
+		return content
+	}
+	lines := strings.Split(string(content), "\n")
+	replaced := false
+	for index, line := range lines {
+		if strings.HasPrefix(line, vllmImageEnvKey+"=") {
+			lines[index] = vllmImageEnvKey + "=" + normalizedImage
+			replaced = true
+			break
+		}
+	}
+	if !replaced {
+		if len(lines) > 0 && lines[len(lines)-1] == "" {
+			lines[len(lines)-1] = vllmImageEnvKey + "=" + normalizedImage
+			lines = append(lines, "")
+		} else {
+			lines = append(lines, vllmImageEnvKey+"="+normalizedImage)
+		}
+	}
+	return []byte(strings.Join(lines, "\n"))
+}

agent/app/service/alert.go

@@ -51,7 +51,7 @@ type IAlertService interface {
 	GetCronJobs(req dto.CronJobReq) ([]dto.CronJobDTO, error)
 
 	GetAlertConfig(req dto.AlertConfigQuery) ([]model.AlertConfig, error)
-	PageAlertConfig(req dto.AlertConfigPageReq) (int64, []model.AlertConfig, error)
+	PageAlertConfig(req dto.AlertConfigPageReq, readOnly ...bool) (int64, []model.AlertConfig, error)
 	UpdateAlertConfig(req dto.AlertConfigUpdate, operator string) error
 	DeleteAlertConfig(id uint) error
 	TestAlertConfig(req dto.AlertConfigTest) (bool, error)
@@ -384,6 +384,9 @@ func (a AlertService) PageAlertLogs(search dto.AlertLogSearch) (int64, []dto.Ale
 	if search.Count != 0 {
 		opts = append(opts, alertRepo.WithByCount(search.Count))
 	}
+	if !search.StartTime.IsZero() && !search.EndTime.IsZero() {
+		opts = append(opts, repo.WithByCreatedAt(search.StartTime, search.EndTime))
+	}
 	opts = append(opts, repo.WithOrderDesc("created_at"))
 
 	total, alerts, err := alertRepo.PageLog(search.Page, search.PageSize, opts...)
@@ -494,7 +497,7 @@ func (a AlertService) GetAlertConfig(req dto.AlertConfigQuery) ([]model.AlertCon
 	return configs, err
 }
 
-func (a AlertService) PageAlertConfig(req dto.AlertConfigPageReq) (int64, []model.AlertConfig, error) {
+func (a AlertService) PageAlertConfig(req dto.AlertConfigPageReq, readOnly ...bool) (int64, []model.AlertConfig, error) {
 	opts := []repo.DBOption{
 		alertRepo.WithByTypeNotIn([]string{"common"}),
 		repo.WithOrderDesc("created_at"),
@@ -502,7 +505,25 @@ func (a AlertService) PageAlertConfig(req dto.AlertConfigPageReq) (int64, []mode
 	if len(req.ExcludeTypes) > 0 {
 		opts = append(opts, alertRepo.WithByTypeNotIn(req.ExcludeTypes))
 	}
-	return alertRepo.PageAlertConfig(req.Page, req.PageSize, opts...)
+	total, configs, err := alertRepo.PageAlertConfig(req.Page, req.PageSize, opts...)
+	if err != nil || !isDemoReadOnly(readOnly...) {
+		return total, configs, err
+	}
+	for i := range configs {
+		var value interface{}
+		if err := json.Unmarshal([]byte(configs[i].Config), &value); err != nil {
+			configs[i].Config = ""
+			continue
+		}
+		redactSensitiveData(value)
+		data, err := json.Marshal(value)
+		if err != nil {
+			configs[i].Config = ""
+			continue
+		}
+		configs[i].Config = string(data)
+	}
+	return total, configs, nil
 }
 
 func (a AlertService) UpdateAlertConfig(req dto.AlertConfigUpdate, operator string) error {

agent/app/service/alert_helper.go

@@ -705,7 +705,6 @@ func sendAlertsByLegacyMethod(alert dto.AlertDTO, alertType, quota, quotaType st
 	}
 	config, err := alertRepo.GetConfig(alertRepo.WithByType(configType))
 	if err != nil {
-		global.LOG.Errorf("alert config not found for type %s: %v", configType, err)
 		return
 	}
 	doSendAlert(alert, alertType, quota, quotaType, params, config)

agent/app/service/alert_sender.go

@@ -93,7 +93,6 @@ func (s *AlertSender) sendByLegacyMethod(method string, quota string, params []d
 	}
 	config, err := alertRepo.GetConfig(alertRepo.WithByType(configType))
 	if err != nil {
-		global.LOG.Errorf("alert config not found for type %s: %v", configType, err)
 		return
 	}
 	if !alertUtil.IsAlertConfigEnabled(config) {

agent/app/service/app.go

@@ -48,7 +48,7 @@ type IAppService interface {
 	PageApp(ctx *gin.Context, req request.AppSearch) (*response.AppRes, error)
 	GetAppTags(ctx *gin.Context) ([]response.TagDTO, error)
 	GetApp(ctx *gin.Context, key string) (*response.AppDTO, error)
-	GetAppDetail(appId uint, version, appType string) (response.AppDetailDTO, error)
+	GetAppDetail(appId uint, version, appType string, readOnly ...bool) (response.AppDetailDTO, error)
 	Install(req request.AppInstallCreate, executeScript bool) (*model.AppInstall, error)
 	SyncAppListFromRemote(taskID string) error
 	GetAppUpdate() (*response.AppUpdateRes, error)
@@ -231,7 +231,7 @@ func (a AppService) GetAppDetailByKey(appKey, version string) (response.AppDetai
 	return appDetailDTO, nil
 }
 
-func (a AppService) GetAppDetail(appID uint, version, appType string) (response.AppDetailDTO, error) {
+func (a AppService) GetAppDetail(appID uint, version, appType string, readOnly ...bool) (response.AppDetailDTO, error) {
 	var (
 		appDetailDTO response.AppDetailDTO
 		opts         []repo.DBOption
@@ -243,6 +243,7 @@ func (a AppService) GetAppDetail(appID uint, version, appType string) (response.
 	}
 	appDetailDTO.AppDetail = detail
 	appDetailDTO.Enable = true
+	readOnlyMode := isDemoReadOnly(readOnly...)
 
 	if appType == "runtime" {
 		app, err := appRepo.GetFirst(repo.WithByID(appID))
@@ -252,42 +253,46 @@ func (a AppService) GetAppDetail(appID uint, version, appType string) (response.
 		fileOp := files.NewFileOp()
 
 		versionPath := filepath.Join(app.GetAppResourcePath(), detail.Version)
-		if !fileOp.Stat(versionPath) || detail.Update {
+		versionExists := fileOp.Stat(versionPath)
+		if (!versionExists || detail.Update) && !readOnlyMode {
 			if err = downloadApp(app, detail, nil, nil); err != nil && !fileOp.Stat(versionPath) {
 				return appDetailDTO, err
 			}
+			versionExists = fileOp.Stat(versionPath)
 		}
-		switch app.Type {
-		case constant.RuntimePHP:
-			paramsPath := filepath.Join(versionPath, "data.yml")
-			if !fileOp.Stat(paramsPath) {
-				return appDetailDTO, buserr.WithDetail("ErrFileNotExist", paramsPath, nil)
-			}
-			param, err := fileOp.GetContent(paramsPath)
-			if err != nil {
-				return appDetailDTO, err
-			}
-			paramMap := make(map[string]interface{})
-			if err = yaml.Unmarshal(param, &paramMap); err != nil {
-				return appDetailDTO, err
-			}
-			appDetailDTO.Params = paramMap["additionalProperties"]
-			composePath := filepath.Join(versionPath, "docker-compose.yml")
-			if !fileOp.Stat(composePath) {
-				return appDetailDTO, buserr.WithDetail("ErrFileNotExist", composePath, nil)
-			}
-			compose, err := fileOp.GetContent(composePath)
-			if err != nil {
-				return appDetailDTO, err
-			}
-			composeMap := make(map[string]interface{})
-			if err := yaml.Unmarshal(compose, &composeMap); err != nil {
-				return appDetailDTO, err
-			}
-			if service, ok := composeMap["services"]; ok {
-				servicesMap := service.(map[string]interface{})
-				for k := range servicesMap {
-					appDetailDTO.Image = k
+		if versionExists {
+			switch app.Type {
+			case constant.RuntimePHP:
+				paramsPath := filepath.Join(versionPath, "data.yml")
+				if !fileOp.Stat(paramsPath) {
+					return appDetailDTO, buserr.WithDetail("ErrFileNotExist", paramsPath, nil)
+				}
+				param, err := fileOp.GetContent(paramsPath)
+				if err != nil {
+					return appDetailDTO, err
+				}
+				paramMap := make(map[string]interface{})
+				if err = yaml.Unmarshal(param, &paramMap); err != nil {
+					return appDetailDTO, err
+				}
+				appDetailDTO.Params = paramMap["additionalProperties"]
+				composePath := filepath.Join(versionPath, "docker-compose.yml")
+				if !fileOp.Stat(composePath) {
+					return appDetailDTO, buserr.WithDetail("ErrFileNotExist", composePath, nil)
+				}
+				compose, err := fileOp.GetContent(composePath)
+				if err != nil {
+					return appDetailDTO, err
+				}
+				composeMap := make(map[string]interface{})
+				if err := yaml.Unmarshal(compose, &composeMap); err != nil {
+					return appDetailDTO, err
+				}
+				if service, ok := composeMap["services"]; ok {
+					servicesMap := service.(map[string]interface{})
+					for k := range servicesMap {
+						appDetailDTO.Image = k
+					}
 				}
 			}
 		}
@@ -299,10 +304,13 @@ func (a AppService) GetAppDetail(appID uint, version, appType string) (response.
 		appDetailDTO.Params = paramMap
 	}
 
-	if appDetailDTO.DockerCompose == "" {
+	if appDetailDTO.DockerCompose == "" && !readOnlyMode {
 		filename := filepath.Base(appDetailDTO.DownloadUrl)
 		dockerComposeUrl := fmt.Sprintf("%s%s", strings.TrimSuffix(appDetailDTO.DownloadUrl, filename), "docker-compose.yml")
 		statusCode, composeRes, err := req_helper.HandleRequest(dockerComposeUrl, http.MethodGet, constant.TimeOut20s)
+		if statusCode == http.StatusNotFound {
+			return appDetailDTO, buserr.New("ErrAppVersionUnavailable")
+		}
 		if err != nil {
 			return appDetailDTO, buserr.WithDetail("ErrGetCompose", err.Error(), err)
 		}
@@ -426,7 +434,12 @@ func (a AppService) installWithHooks(req request.AppInstallCreate, executeScript
 	} else {
 		if appDetail.DockerCompose == "" {
 			dockerComposeUrl := fmt.Sprintf("%s/%s/1panel/%s/%s/docker-compose.yml", global.AppRepoURL(), global.CONF.Base.Mode, app.Key, appDetail.Version)
-			_, composeRes, err = req_helper.HandleRequest(dockerComposeUrl, http.MethodGet, constant.TimeOut20s)
+			var statusCode int
+			statusCode, composeRes, err = req_helper.HandleRequest(dockerComposeUrl, http.MethodGet, constant.TimeOut20s)
+			if statusCode == http.StatusNotFound {
+				err = buserr.New("ErrAppVersionUnavailable")
+				return
+			}
 			if err != nil {
 				return
 			}