feat(container): add image update checks with scheduling and task logs

* fix(ai): preserve legacy Feishu and migrate bundled plugin upgrades

* fix(ai): override inherited Feishu allowlists when cleared

README.md

@@ -1,9 +1,6 @@
 <p align="center"><a href="https://1panel.pro"><img src="https://resource.1panel.pro/img/1panel-logo.png" alt="1Panel" width="300" /></a></p>
-
-<h3 align="center">The open-source VPS control panel with native AI agent support</h3>
-
 <p align="center">
-  Trusted by <strong>2,000,000+</strong> self-hosters worldwide
+  Loved by a global community of <strong>2.5M+</strong> self-hosters.
 </p>
 
 <p align="center">
@@ -12,7 +9,6 @@
 
 <p align="center">
   <a href="https://www.gnu.org/licenses/gpl-3.0.html"><img src="https://shields.io/github/license/1Panel-dev/1Panel?color=%231890FF" alt="License: GPL v3"></a>
-  <a href="https://app.codacy.com/gh/1Panel-dev/1Panel"><img src="https://app.codacy.com/project/badge/Grade/da67574fd82b473992781d1386b937ef" alt="Codacy"></a>
   <a href="https://discord.gg/bUpUqWqdRr"><img src="https://img.shields.io/discord/1318846410149335080?logo=discord&labelColor=%20%235462eb&logoColor=%20%23f5f5f5&color=%20%235462eb" alt="Discord"></a>
   <a href="https://github.com/1Panel-dev/1Panel/releases"><img src="https://img.shields.io/github/v/release/1Panel-dev/1Panel" alt="GitHub release"></a>
   <a href="https://github.com/1Panel-dev/1Panel"><img src="https://img.shields.io/github/stars/1Panel-dev/1Panel?color=%231890FF&style=flat-square" alt="Stars"></a>
@@ -41,34 +37,28 @@
 
 ## What is 1Panel?
 
-1Panel is a modern, open-source VPS control panel — and the only one with **native AI agent support**. Run Ollama models, deploy OpenClaw agents, and manage your entire server stack from one clean web interface. No CLI memorization required.
-
-👉 Watch the [2-minute introduction](https://www.youtube.com/watch?v=Jl_wqp-XA08)
+1Panel is a modern, open-source Linux server management panel and a lightweight AI management platform. Through an intuitive web interface, it provides users with comprehensive, one-stop server management capabilities:
+- **AI Management**: Offers a unified management platform from bare metal to agents (Metal-to-Agent). It integrates an AI gateway, and Skills Hub, while supporting centralized management of agents and models.
+- **Efficient Visual Operations**: Easily manage Linux servers through a web-based GUI, streamlining tasks such as host monitoring, file management, database management, and container management.
+- **Rapid Website Deployment**: Deeply integrates with popular website builders like WordPress and Halo. It enables one-click domain binding and SSL certificate configuration, significantly lowering the barrier to website creation.
+- **Curated App Store**: Features a built-in store of high-quality open-source applications, providing one-click installation and upgrade services to effortlessly extend server capabilities.
+- **Enterprise-Grade Security**: Deploys applications based on container technology to effectively minimize vulnerability exposure. It also provides security features such as WAF and log auditing to ensure comprehensive server protection.
+- **One-Click Data Backup**: Supports one-click backup and restoration, and integrates with various cloud storage solutions to ensure data security and prevent loss.
 
 ## Why 1Panel?
 
 | | 1Panel | cPanel / Plesk | aaPanel | Webmin |
 |--|--------|----------------|---------|--------|
 | Free & open source | ✅ | ❌ | Partial | ✅ |
-| Native AI agent runtime | ✅ | ❌ | ❌ | ❌ |
+| AI management | ✅ | ❌ | ❌ | ❌ |
 | One-click app marketplace | ✅ 165+ apps | ❌ | ✅ | ❌ |
 | Modern UI (post-2020) | ✅ | ❌ | Partial | ❌ |
 | Docker / container management | ✅ | ❌ | ❌ | ❌ |
 | Active development | ✅ | ✅ | ✅ | Slow |
 
-## Key Features
-
-- **AI Agent Runtime**: Deploy Ollama LLMs, spin up OpenClaw personal agents, and monitor GPU utilization — all from the dashboard. No separate AI stack to manage.
-- **One-Click Website Deployment**: Launch production-ready websites with automatic domain binding, SSL provisioning, and Nginx config — zero manual setup.
-- **App Marketplace**: 165+ trusted open-source apps (Nextcloud, Bitwarden, Umami, NocoBase, and more) installed and updated with a single click.
-- **Docker & Container Management**: Create, start, stop, and inspect containers, images, networks, and volumes through a visual UI — no CLI juggling.
-- **Security Out of the Box**: Firewall rules, fail2ban, container isolation, WAF, and audit logs — configured and running from day one.
-- **Backup & Restore**: Schedule automated backups to AWS S3, Cloudflare R2, or local storage. Restore any snapshot in one click.
-
 ## Quick Start
 
-> **Requirements:** Linux VPS (Debian / Ubuntu / CentOS / Rocky), 1 GB RAM, internet access.  
-> Takes ~60 seconds.
+Prepare your Linux server and run the following script:
 
 ```bash
 bash -c "$(curl -sSL https://resource.1panel.pro/v2/quick_start.sh)"
@@ -83,24 +73,20 @@ Run `1pctl user-info` via SSH if you need to retrieve your access credentials.
 
 ## Pro Edition
 
-1Panel OSS is free forever. Pro adds features built for teams and production workloads:
+1Panel OSS is free forever. 1Panel Pro and Ent adds features built for teams and production workloads:
 
-| Feature | OSS | Pro |
-|---------|:---:|:---:|
-| One-click app installs | ✅ | ✅ |
-| AI agents (OpenClaw) | 1 agent | Unlimited |
-| WAF & advanced security | Basic | ✅ |
-| Website tamper protection | ❌ | ✅ |
-| Website uptime monitoring | ❌ | ✅ |
-| Multi-node management | ❌ | ✅ |
-| Custom logo & theme | ❌ | ✅ |
-| Priority support | ❌ | ✅ |
-
-**From $80/year.** [Compare plans & start 30-day free trial →](https://1panel.pro/pricing)
-
-## Star History
-
-[![Star History Chart](https://api.star-history.com/svg?repos=1Panel-dev/1Panel&type=Date)](https://star-history.com/#1Panel-dev/1Panel&Date)
+| Feature | OSS | Pro | Ent |
+|---------|:---:|:---:|:---:|
+| One-click app installs | ✅ | ✅ | ✅ |
+| AI agents (OpenClaw) | 5 agent | Unlimited | ✅ |
+| WAF & advanced security | Basic | ✅ | ✅ |
+| Website tamper protection | ❌ | ✅ | ✅ |
+| Website uptime monitoring | ❌ | ✅ | ✅ |
+| Multi-node management | ❌ | ✅ | ✅ |
+| Custom logo & theme | ❌ | ✅ | ✅ |
+| KVM Web UI | ❌ | ❌ | ✅ |
+| AI Gateway | ❌ | ❌ | ✅ |
+| Priority support | ❌ | ❌ | ✅ |
 
 ## Community & Support
 

agent/app/api/v2/agents.go

@@ -826,6 +826,26 @@ func (b *BaseApi) UpdateAgentFeishuConfig(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags AI
+// @Summary Switch to the bundled OpenClaw Feishu plugin
+// @Accept json
+// @Param request body dto.AgentFeishuSwitchReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/channel/feishu/switch [post]
+func (b *BaseApi) SwitchAgentFeishuPlugin(c *gin.Context) {
+	var req dto.AgentFeishuSwitchReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.SwitchFeishuPlugin(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags AI
 // @Summary Get Agent Telegram channel config
 // @Accept json

agent/app/api/v2/ai.go

@@ -72,22 +72,6 @@ func (b *BaseApi) CloseOllamaModel(c *gin.Context) {
 	helper.SuccessWithData(c, nil)
 }
 
-// @Tags AI
-// @Summary Sync Ollama model list
-// @Success 200 {array} dto.OllamaModelDropList
-// @Security ApiKeyAuth
-// @Security Timestamp
-// @Router /ai/ollama/model/sync [post]
-// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"同步 Ollama 模型列表","formatEN":"sync Ollama model list"}
-func (b *BaseApi) SyncOllamaModel(c *gin.Context) {
-	list, err := aiToolService.Sync()
-	if err != nil {
-		helper.BadRequest(c, err)
-		return
-	}
-	helper.SuccessWithData(c, list)
-}
-
 // @Tags AI
 // @Summary Page Ollama models
 // @Accept json
@@ -114,6 +98,18 @@ func (b *BaseApi) SearchOllamaModel(c *gin.Context) {
 	})
 }
 
+func (b *BaseApi) SyncOllamaModelAccount(c *gin.Context) {
+	var req dto.OllamaModelAccountSync
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := aiToolService.SyncAccount(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags AI
 // @Summary Page Ollama models
 // @Accept json

agent/app/api/v2/ai_benchmark.go

@@ -0,0 +1,16 @@
+package v2
+
+import (
+	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
+	"github.com/1Panel-dev/1Panel/agent/app/service"
+	"github.com/gin-gonic/gin"
+)
+
+func (b *BaseApi) AIBenchmarkSources(c *gin.Context) {
+	sources, err := service.AIBenchmarkSources(c.Query("kind"), c.Query("selected"))
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, sources)
+}

agent/app/api/v2/alert.go

@@ -2,11 +2,17 @@ package v2
 
 import (
 	"errors"
+	"net/http"
 	"net/url"
 	"strings"
 
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/repo"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/i18n"
+	"github.com/1Panel-dev/1Panel/agent/utils/webhook_sender"
 	"github.com/gin-gonic/gin"
 )
 
@@ -287,13 +293,43 @@ func (b *BaseApi) PageAlertConfig(c *gin.Context) {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /alert/config/update [post]
-// @x-panel-log {"bodyKeys":["id","displayName"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新告警配置 [id][displayName]","formatEN":"update alert config [id][displayName]"}
+// @x-panel-log {"bodyKeys":["displayName"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新告警配置 [displayName]","formatEN":"update alert config [displayName]"}
 func (b *BaseApi) UpdateAlertConfig(c *gin.Context) {
 	var req dto.AlertConfigUpdate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
 	if err := alertService.UpdateAlertConfig(req, loadAuditUser(c)); err != nil {
+		switch {
+		case errors.Is(err, repo.ErrAlertConfigRevisionConflict):
+			helper.ErrorWithBusinessCode(c, http.StatusConflict, "ALERT_CONFIG_REVISION_CONFLICT", "ErrInvalidParams", err)
+		case errors.Is(err, repo.ErrAlertConfigRevisionRequired):
+			helper.ErrorWithBusinessCode(c, http.StatusConflict, "ALERT_CONFIG_REVISION_REQUIRED", "ErrInvalidParams", err)
+		default:
+			helper.InternalServer(c, err)
+		}
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Alert
+// @Summary Update alert config status
+// @Accept json
+// @Param request body dto.AlertConfigStatusUpdate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /alert/config/status [post]
+// @x-panel-log {"bodyKeys":["status"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新告警配置状态 [name][status]","formatEN":"update alert config status [name][status]"}
+func (b *BaseApi) UpdateAlertConfigStatus(c *gin.Context) {
+	var req dto.AlertConfigStatusUpdate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	name, err := alertService.UpdateAlertConfigStatus(req, loadAuditUser(c))
+	helper.SetOperationLogValues(c, map[string]string{"name": name})
+	if err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
@@ -319,13 +355,14 @@ func loadAuditUser(c *gin.Context) string {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /alert/config/del [post]
-// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"删除告警配置 [id]","formatEN":"delete alert config [id]"}
+// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"删除告警配置 [name]","formatEN":"delete alert config [name]"}
 func (b *BaseApi) DeleteAlertConfig(c *gin.Context) {
 	var req dto.DeleteRequest
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	err := alertService.DeleteAlertConfig(req.ID)
+	name, err := alertService.DeleteAlertConfig(req.ID)
+	helper.SetOperationLogValues(c, map[string]string{"name": name})
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -346,6 +383,29 @@ func (b *BaseApi) TestAlertConfig(c *gin.Context) {
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
+	if req.Type == constant.Custom {
+		lang := strings.TrimSpace(c.GetHeader("Accept-Language"))
+		if lang == "" {
+			lang = i18n.GetLanguageFromDB()
+		}
+		result, err := alertService.TestCustomAlertConfig(req, lang)
+		if err != nil {
+			if global.LOG != nil {
+				global.LOG.Warnf("webhook test preparation failed: configID=%d error=%q", req.ID,
+					webhook_sender.DiagnosticText(err.Error(), webhook_sender.Request{
+						Format: webhook_sender.BodyJSON, Body: []byte(req.Config),
+					}))
+			}
+			result = dto.AlertConfigTestResult{Success: false}
+		}
+		result.Response = ""
+		result.Message = ""
+		if !result.Success {
+			result.Message = i18n.GetMsgByKeyAndLang(lang, "ErrWebhookTestFailed")
+		}
+		helper.SuccessWithData(c, result)
+		return
+	}
 	flag, err := alertService.TestAlertConfig(req)
 	if err != nil {
 		helper.InternalServer(c, err)

agent/app/api/v2/app.go

@@ -8,6 +8,7 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
 	"github.com/1Panel-dev/1Panel/agent/i18n"
 	"github.com/1Panel-dev/1Panel/agent/utils/appicon"
+	"github.com/1Panel-dev/1Panel/agent/utils/mcpapi"
 	"github.com/gin-gonic/gin"
 )
 
@@ -160,10 +161,25 @@ func (b *BaseApi) GetAppDetailByID(c *gin.Context) {
 // @Router /apps/install [post]
 // @x-panel-log {"bodyKeys":["name"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"安装应用 [name]","formatEN":"Install app [name]"}
 func (b *BaseApi) InstallApp(c *gin.Context) {
+	mcpRequest, trustedMCP := mcpapi.Check(c.Request)
+	if mcpRequest && !trustedMCP {
+		c.AbortWithStatus(http.StatusForbidden)
+		return
+	}
 	var req request.AppInstallCreate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
+	if mcpRequest {
+		req.MCPPreserveWebsiteDir = true
+		if value, exists := req.Params["WEBSITE_DIR"]; exists {
+			directory, ok := value.(string)
+			if !ok || directory == "" || directory != settingService.GetWebsiteDir() {
+				c.AbortWithStatus(http.StatusForbidden)
+				return
+			}
+		}
+	}
 	install, err := appService.Install(req, true)
 	if err != nil {
 		helper.InternalServer(c, err)

agent/app/api/v2/app_install.go

@@ -1,7 +1,11 @@
 package v2
 
 import (
+	"net/http"
+
 	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
+	"github.com/1Panel-dev/1Panel/agent/app/service"
+	"github.com/1Panel-dev/1Panel/agent/utils/mcpapi"
 
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
@@ -336,11 +340,25 @@ func (b *BaseApi) UpdateAppConfig(c *gin.Context) {
 // @Security Timestamp
 // @Router /apps/installed/info/:appInstallId [get]
 func (b *BaseApi) GetAppInstallInfo(c *gin.Context) {
+	mcpRequest, trustedMCP := mcpapi.Check(c.Request)
+	if mcpRequest && !trustedMCP {
+		c.AbortWithStatus(http.StatusForbidden)
+		return
+	}
 	appInstallId, err := helper.GetIntParamByKey(c, "appInstallId")
 	if err != nil {
 		helper.BadRequest(c, err)
 		return
 	}
+	if mcpRequest {
+		info, err := (&service.AppInstallService{}).GetAppInstallInfoForMCP(c.Request.Context(), appInstallId)
+		if err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
+		helper.SuccessWithData(c, info)
+		return
+	}
 	info, err := appInstallService.GetAppInstallInfo(appInstallId)
 	if err != nil {
 		helper.InternalServer(c, err)

agent/app/api/v2/container.go

@@ -28,7 +28,7 @@ func (b *BaseApi) SearchContainer(c *gin.Context) {
 		return
 	}
 
-	total, list, err := containerService.Page(req)
+	total, list, err := containerService.Page(c.Request.Context(), req)
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -249,9 +249,10 @@ func (b *BaseApi) ListContainerByImage(c *gin.Context) {
 // @Success 200 {object} dto.ContainerStatus
 // @Security ApiKeyAuth
 // @Security Timestamp
+// @Param containersOnly query boolean false "Only count containers"
 // @Router /containers/status [get]
 func (b *BaseApi) LoadContainerStatus(c *gin.Context) {
-	data, err := containerService.LoadStatus()
+	data, err := containerService.LoadStatus(c.Request.Context(), c.Query("containersOnly") == "true")
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -415,9 +416,14 @@ func (b *BaseApi) LoadResourceLimit(c *gin.Context) {
 // @Success 200 {array} dto.ContainerListStats
 // @Security ApiKeyAuth
 // @Security Timestamp
+// @Param ids query string false "Comma-separated container IDs; omitted selects all containers"
 // @Router /containers/list/stats [get]
 func (b *BaseApi) ContainerListStats(c *gin.Context) {
-	data, err := containerService.ContainerListStats()
+	var ids []string
+	if _, supplied := c.Request.URL.Query()["ids"]; supplied {
+		ids = strings.FieldsFunc(c.Query("ids"), func(r rune) bool { return r == ',' })
+	}
+	data, err := containerService.ContainerListStats(c.Request.Context(), ids)
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -439,7 +445,7 @@ func (b *BaseApi) ContainerItemStats(c *gin.Context) {
 		return
 	}
 
-	data, err := containerService.ContainerItemStats(req)
+	data, err := containerService.ContainerItemStats(c.Request.Context(), req)
 	if err != nil {
 		helper.InternalServer(c, err)
 		return

agent/app/api/v2/container_image_check_update.go

@@ -0,0 +1,43 @@
+package v2
+
+import (
+	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
+	"github.com/1Panel-dev/1Panel/agent/app/service"
+	"github.com/gin-gonic/gin"
+)
+
+func (b *BaseApi) GetContainerImageCheckUpdateStatus(c *gin.Context) {
+	status, err := service.GetContainerImageCheckUpdateStatus()
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, status)
+}
+func (b *BaseApi) ContainerImageCheckUpdate(c *gin.Context) {
+	taskID, err := service.StartContainerImageCheckUpdate()
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	status, err := service.GetContainerImageCheckUpdateStatus()
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	status.TaskID = taskID
+	helper.SuccessWithData(c, status)
+}
+func (b *BaseApi) SetContainerImageCheckUpdateSchedule(c *gin.Context) {
+	var req struct {
+		Enabled *bool `json:"enabled" validate:"required"`
+	}
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := service.SetContainerImageCheckUpdateSchedule(*req.Enabled); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	b.GetContainerImageCheckUpdateStatus(c)
+}

agent/app/api/v2/database.go

@@ -2,9 +2,12 @@ package v2
 
 import (
 	"encoding/base64"
+	"net/http"
 
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/service"
+	"github.com/1Panel-dev/1Panel/agent/utils/mcpapi"
 	"github.com/gin-gonic/gin"
 )
 
@@ -98,11 +101,25 @@ func (b *BaseApi) SearchDatabase(c *gin.Context) {
 // @Param type path string true "type"
 // @Router /databases/db/list/:type [get]
 func (b *BaseApi) ListDatabase(c *gin.Context) {
+	mcpRequest, trustedMCP := mcpapi.Check(c.Request)
+	if mcpRequest && !trustedMCP {
+		c.AbortWithStatus(http.StatusForbidden)
+		return
+	}
 	dbType, err := helper.GetStrParamByKey(c, "type")
 	if err != nil {
 		helper.BadRequest(c, err)
 		return
 	}
+	if mcpRequest {
+		list, err := (&service.DatabaseService{}).ListForMCP(c.Request.Context(), dbType)
+		if err != nil {
+			helper.BadRequest(c, err)
+			return
+		}
+		helper.SuccessWithData(c, list)
+		return
+	}
 	list, err := databaseService.List(dbType)
 	if err != nil {
 		helper.InternalServer(c, err)

agent/app/api/v2/database_mysql.go

@@ -3,9 +3,12 @@ package v2
 import (
 	"context"
 	"encoding/base64"
+	"net/http"
 
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/service"
+	"github.com/1Panel-dev/1Panel/agent/utils/mcpapi"
 	"github.com/gin-gonic/gin"
 )
 
@@ -19,6 +22,11 @@ import (
 // @Router /databases [post]
 // @x-panel-log {"bodyKeys":["name"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"创建 mysql 数据库 [name]","formatEN":"create mysql database [name]"}
 func (b *BaseApi) CreateMysql(c *gin.Context) {
+	mcpRequest, trustedMCP := mcpapi.Check(c.Request)
+	if mcpRequest && !trustedMCP {
+		c.AbortWithStatus(http.StatusForbidden)
+		return
+	}
 	var req dto.MysqlDBCreate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
@@ -32,6 +40,16 @@ func (b *BaseApi) CreateMysql(c *gin.Context) {
 		}
 		req.Password = string(password)
 	}
+	if mcpRequest {
+		created, err := (&service.MysqlService{}).CreateForMCP(c.Request.Context(), req)
+		if err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
+		nodeID, _ := mcpapi.NodeID(c.Request)
+		helper.SuccessWithData(c, map[string]any{"id": created.ID, "database": created.MysqlName, "name": created.Name, "nodeId": nodeID})
+		return
+	}
 
 	if _, err := mysqlService.Create(context.Background(), req); err != nil {
 		helper.InternalServer(c, err)
@@ -513,11 +531,25 @@ func (b *BaseApi) LoadRemoteAccess(c *gin.Context) {
 // @Security Timestamp
 // @Router /databases/status [post]
 func (b *BaseApi) LoadStatus(c *gin.Context) {
+	mcpRequest, trustedMCP := mcpapi.Check(c.Request)
+	if mcpRequest && !trustedMCP {
+		c.AbortWithStatus(http.StatusForbidden)
+		return
+	}
 	var req dto.OperationWithNameAndType
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
 
+	if mcpRequest {
+		data, err := (&service.MysqlService{}).LoadStatusForMCP(c.Request.Context(), req)
+		if err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
+		helper.SuccessWithData(c, data)
+		return
+	}
 	data, err := mysqlService.LoadStatus(req)
 	if err != nil {
 		helper.InternalServer(c, err)

agent/app/api/v2/database_redis.go

@@ -86,17 +86,23 @@ func (b *BaseApi) CheckHasCli(c *gin.Context) {
 
 // @Tags Database Redis
 // @Summary Install redis-cli
-// @Success 200
+// @Accept json
+// @Param request body dto.RedisCliInstall true "request"
+// @Success 200 {string} string
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /databases/redis/install/cli [post]
 func (b *BaseApi) InstallCli(c *gin.Context) {
-	if err := redisService.InstallCli(); err != nil {
+	var req dto.RedisCliInstall
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := redisService.InstallCli(req)
+	if err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
-
-	helper.Success(c)
+	helper.SuccessWithData(c, data)
 }
 
 // @Tags Database Redis

agent/app/api/v2/entry.go

@@ -42,8 +42,9 @@ var (
 	fileShareService          = service.NewIFileShareService()
 	sshService                = service.NewISSHService()
 	firewallService           = service.NewIFirewallService()
+	firewallSettingService    = service.NewIFirewallSettingService()
 	forwardingService         = service.NewIForwardingService()
-	iptablesService           = service.NewIIptablesService()
+	dockerPortGuardService    = service.NewIDockerPortGuardService()
 	monitorService            = service.NewIMonitorService()
 	systemService             = service.NewISystemService()
 	runtimeDiagnosticsService = service.NewIRuntimeDiagnosticsService()

agent/app/api/v2/file.go

@@ -35,6 +35,81 @@ var cancelledChunkUploads = struct {
 	ids map[string]struct{}
 }{ids: make(map[string]struct{})}
 
+type chunkUploadLock struct {
+	mutex sync.Mutex
+	refs  int
+}
+
+var chunkUploadLocks = struct {
+	sync.Mutex
+	items map[string]*chunkUploadLock
+}{items: make(map[string]*chunkUploadLock)}
+
+type completedChunkUpload struct {
+	dstDir   string
+	filename string
+	fileSize int64
+}
+
+var completedChunkUploads = struct {
+	sync.RWMutex
+	items map[string]completedChunkUpload
+}{items: make(map[string]completedChunkUpload)}
+
+var activeChunkUploadTTL = 24 * time.Hour
+
+var (
+	errChunkUploadCancelled = errors.New("upload cancelled")
+	errInvalidChunkUpload   = errors.New("invalid chunk upload")
+)
+
+type activeChunkUpload struct {
+	upload    completedChunkUpload
+	expiresAt time.Time
+	timer     *time.Timer
+}
+
+var activeChunkUploads = struct {
+	sync.RWMutex
+	items map[string]activeChunkUpload
+}{items: make(map[string]activeChunkUpload)}
+
+type resumableUploadChunk struct {
+	UploadID   string
+	Filename   string
+	DstDir     string
+	ChunkIndex int
+	ChunkCount int
+	Offset     int64
+	FileSize   int64
+	Overwrite  bool
+}
+
+func invalidChunkUploadError(message string) error {
+	return fmt.Errorf("%w: %s", errInvalidChunkUpload, message)
+}
+
+func isRetryableChunkUploadError(err error) bool {
+	if err == nil {
+		return false
+	}
+	if errors.Is(err, errChunkUploadCancelled) ||
+		errors.Is(err, errInvalidChunkUpload) ||
+		errors.Is(err, os.ErrExist) ||
+		errors.Is(err, os.ErrPermission) ||
+		errors.Is(err, os.ErrInvalid) ||
+		errors.Is(err, syscall.ENOSPC) ||
+		errors.Is(err, syscall.EDQUOT) ||
+		errors.Is(err, syscall.EROFS) ||
+		errors.Is(err, syscall.EFBIG) ||
+		errors.Is(err, syscall.ENAMETOOLONG) ||
+		errors.Is(err, syscall.ENOTDIR) ||
+		errors.Is(err, syscall.EISDIR) {
+		return false
+	}
+	return true
+}
+
 // @Tags File
 // @Summary List files
 // @Accept json
@@ -474,11 +549,7 @@ func (b *BaseApi) UploadFiles(c *gin.Context) {
 			continue
 		}
 		dstInfo, statErr := os.Stat(dstFilename)
-		if overwrite {
-			_ = os.Remove(dstFilename)
-		}
-
-		err = os.Rename(tmpFilename, dstFilename)
+		err = finalizeUploadedFile(tmpFilename, dstFilename, overwrite)
 		if err != nil {
 			_ = os.Remove(tmpFilename)
 			e := fmt.Errorf("upload [%s] file failed, err: %v", file.Filename, err)
@@ -613,10 +684,35 @@ func (b *BaseApi) StopWget(c *gin.Context) {
 		return
 	}
 
-	files.CancelDownload(req.Key)
+	if err := files.CancelDownload(req.Key); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
 	helper.Success(c)
 }
 
+// @Tags File
+// @Summary Remove finished download progress records without deleting files
+// @Accept json
+// @Param request body request.FileProcessRemoveReq true "request"
+// @Success 200 {object} response.FileProcessKeys
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/wget/process/remove [post]
+// @x-panel-log {"bodyKeys":["keys"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"移除已结束下载记录 [keys]","formatEN":"Remove finished download records [keys]"}
+func (b *BaseApi) RemoveWgetRecords(c *gin.Context) {
+	var req request.FileProcessRemoveReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	keys, err := files.RemoveDownloadRecords(req.Keys)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, response.FileProcessKeys{Keys: keys})
+}
+
 // @Tags File
 // @Summary Move file
 // @Accept json
@@ -638,6 +734,26 @@ func (b *BaseApi) MoveFile(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags File
+// @Summary Stop file move task
+// @Accept json
+// @Param request body request.FileMoveStopReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/move/stop [post]
+func (b *BaseApi) StopMoveFile(c *gin.Context) {
+	var req request.FileMoveStopReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := fileService.StopMvFile(req.TaskID); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags File
 // @Summary Download file
 // @Accept json
@@ -792,6 +908,289 @@ func (b *BaseApi) DepthDirSize(c *gin.Context) {
 	helper.SuccessWithData(c, res)
 }
 
+func lockChunkUpload(uploadID string) func() {
+	chunkUploadLocks.Lock()
+	lock, ok := chunkUploadLocks.items[uploadID]
+	if !ok {
+		lock = &chunkUploadLock{}
+		chunkUploadLocks.items[uploadID] = lock
+	}
+	lock.refs++
+	chunkUploadLocks.Unlock()
+
+	lock.mutex.Lock()
+	return func() {
+		lock.mutex.Unlock()
+		chunkUploadLocks.Lock()
+		lock.refs--
+		if lock.refs == 0 {
+			delete(chunkUploadLocks.items, uploadID)
+		}
+		chunkUploadLocks.Unlock()
+	}
+}
+
+func resumableUploadPartPath(dstDir, uploadID string) string {
+	return filepath.Join(dstDir, fmt.Sprintf(".1panel-upload-%s.part", uploadID))
+}
+
+func finalizeUploadedFile(tmpFile, dstFile string, overwrite bool) error {
+	if overwrite {
+		return os.Rename(tmpFile, dstFile)
+	}
+	if err := os.Link(tmpFile, dstFile); err != nil {
+		return err
+	}
+	if err := os.Remove(tmpFile); err != nil {
+		if rollbackErr := os.Remove(dstFile); rollbackErr != nil {
+			return fmt.Errorf("remove upload temporary file failed: %v, rollback destination failed: %w", err, rollbackErr)
+		}
+		return err
+	}
+	return nil
+}
+
+func registerActiveChunkUpload(uploadID string, upload completedChunkUpload) error {
+	activeChunkUploads.Lock()
+	defer activeChunkUploads.Unlock()
+	if active, ok := activeChunkUploads.items[uploadID]; ok {
+		if active.upload != upload {
+			return invalidChunkUploadError("upload ID is already used by another file")
+		}
+		active.timer.Stop()
+	}
+	expiresAt := time.Now().Add(activeChunkUploadTTL)
+	timer := time.AfterFunc(activeChunkUploadTTL, func() {
+		expireActiveChunkUpload(uploadID, expiresAt)
+	})
+	activeChunkUploads.items[uploadID] = activeChunkUpload{
+		upload:    upload,
+		expiresAt: expiresAt,
+		timer:     timer,
+	}
+	return nil
+}
+
+func loadActiveChunkUpload(uploadID string) (completedChunkUpload, bool) {
+	activeChunkUploads.RLock()
+	active, ok := activeChunkUploads.items[uploadID]
+	activeChunkUploads.RUnlock()
+	return active.upload, ok
+}
+
+func deleteActiveChunkUpload(uploadID string) {
+	activeChunkUploads.Lock()
+	if active, ok := activeChunkUploads.items[uploadID]; ok {
+		active.timer.Stop()
+	}
+	delete(activeChunkUploads.items, uploadID)
+	activeChunkUploads.Unlock()
+}
+
+func discardActiveChunkUpload(uploadID, partFile string) error {
+	deleteActiveChunkUpload(uploadID)
+	if err := os.Remove(partFile); err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("remove upload temporary file failed: %w", err)
+	}
+	return nil
+}
+
+func finalizeActiveChunkUpload(uploadID, partFile, dstFile string, overwrite bool) error {
+	if err := finalizeUploadedFile(partFile, dstFile, overwrite); err != nil {
+		if removeErr := discardActiveChunkUpload(uploadID, partFile); removeErr != nil {
+			return errors.Join(err, removeErr)
+		}
+		return err
+	}
+	return nil
+}
+
+func expireActiveChunkUpload(uploadID string, expiresAt time.Time) {
+	unlock := lockChunkUpload(uploadID)
+	defer unlock()
+	activeChunkUploads.Lock()
+	active, ok := activeChunkUploads.items[uploadID]
+	if !ok || !active.expiresAt.Equal(expiresAt) {
+		activeChunkUploads.Unlock()
+		return
+	}
+	delete(activeChunkUploads.items, uploadID)
+	activeChunkUploads.Unlock()
+	partFile := resumableUploadPartPath(active.upload.dstDir, uploadID)
+	if err := os.Remove(partFile); err != nil && !os.IsNotExist(err) {
+		global.LOG.Warnf("remove inactive upload part [%s] failed: %v", partFile, err)
+	}
+}
+
+func removeActiveResumableUploadPart(uploadID string) error {
+	unlock := lockChunkUpload(uploadID)
+	defer unlock()
+	upload, ok := loadActiveChunkUpload(uploadID)
+	if !ok {
+		return nil
+	}
+	err := os.Remove(resumableUploadPartPath(upload.dstDir, uploadID))
+	if err == nil || os.IsNotExist(err) {
+		deleteActiveChunkUpload(uploadID)
+		return nil
+	}
+	return err
+}
+
+func loadCompletedChunkUpload(uploadID string) (completedChunkUpload, bool) {
+	completedChunkUploads.RLock()
+	completed, ok := completedChunkUploads.items[uploadID]
+	completedChunkUploads.RUnlock()
+	return completed, ok
+}
+
+func markChunkUploadCompleted(uploadID string, completed completedChunkUpload) {
+	completedChunkUploads.Lock()
+	completedChunkUploads.items[uploadID] = completed
+	completedChunkUploads.Unlock()
+	time.AfterFunc(10*time.Minute, func() {
+		completedChunkUploads.Lock()
+		delete(completedChunkUploads.items, uploadID)
+		completedChunkUploads.Unlock()
+	})
+}
+
+func writeResumableUploadChunk(chunk resumableUploadChunk, chunkData []byte) error {
+	unlock := lockChunkUpload(chunk.UploadID)
+	defer unlock()
+	if chunkUploadCancelled(chunk.UploadID) {
+		return errChunkUploadCancelled
+	}
+	if chunk.UploadID == "" || filepath.Base(chunk.UploadID) != chunk.UploadID || strings.ContainsAny(chunk.UploadID, `/\`) {
+		return invalidChunkUploadError("invalid upload ID")
+	}
+	if chunk.Filename == "" || filepath.Base(chunk.Filename) != chunk.Filename || strings.ContainsAny(chunk.Filename, `/\`) {
+		return invalidChunkUploadError("invalid filename")
+	}
+	if strings.TrimSpace(chunk.DstDir) == "" {
+		return invalidChunkUploadError("upload destination is required")
+	}
+	dstDir := filepath.Clean(strings.TrimSpace(chunk.DstDir))
+
+	if chunk.ChunkCount <= 0 || chunk.ChunkIndex < 0 || chunk.ChunkIndex >= chunk.ChunkCount {
+		return invalidChunkUploadError("invalid chunk index")
+	}
+	if chunk.FileSize <= 0 || chunk.Offset < 0 || chunk.Offset > chunk.FileSize {
+		return invalidChunkUploadError("invalid upload offset")
+	}
+	chunkEnd := chunk.Offset + int64(len(chunkData))
+	if chunkEnd > chunk.FileSize {
+		return invalidChunkUploadError("chunk exceeds file size")
+	}
+	if chunk.ChunkIndex+1 == chunk.ChunkCount {
+		if chunkEnd != chunk.FileSize {
+			return invalidChunkUploadError("final chunk does not match file size")
+		}
+	} else if chunkEnd >= chunk.FileSize {
+		return invalidChunkUploadError("non-final chunk reaches file size")
+	}
+	if completed, ok := loadCompletedChunkUpload(chunk.UploadID); ok {
+		if completed.dstDir == dstDir && completed.filename == chunk.Filename && completed.fileSize == chunk.FileSize {
+			return nil
+		}
+		return invalidChunkUploadError("upload ID has already completed another file")
+	}
+	upload := completedChunkUpload{dstDir: dstDir, filename: chunk.Filename, fileSize: chunk.FileSize}
+	if err := registerActiveChunkUpload(chunk.UploadID, upload); err != nil {
+		return err
+	}
+
+	mode, err := files.GetParentMode(dstDir)
+	if err != nil {
+		return err
+	}
+	if err = os.MkdirAll(dstDir, mode); err != nil {
+		return err
+	}
+	dstDirInfo, err := os.Stat(dstDir)
+	if err != nil {
+		return err
+	}
+	if !dstDirInfo.IsDir() {
+		return invalidChunkUploadError(fmt.Sprintf("upload destination [%s] is not a directory", dstDir))
+	}
+
+	dstFile := filepath.Join(dstDir, chunk.Filename)
+	partFile := resumableUploadPartPath(dstDir, chunk.UploadID)
+	if dstFile == partFile {
+		return invalidChunkUploadError("filename conflicts with upload temporary file")
+	}
+	fileMode := dstDirInfo.Mode().Perm()
+	ownerInfo := dstDirInfo
+	if dstInfo, statErr := os.Stat(dstFile); statErr == nil {
+		if !chunk.Overwrite {
+			if err := discardActiveChunkUpload(chunk.UploadID, partFile); err != nil {
+				return errors.Join(os.ErrExist, err)
+			}
+			return os.ErrExist
+		}
+		fileMode = dstInfo.Mode().Perm()
+		ownerInfo = dstInfo
+	} else if !os.IsNotExist(statErr) {
+		return statErr
+	}
+
+	part, err := os.OpenFile(partFile, os.O_CREATE|os.O_RDWR, fileMode)
+	if err != nil {
+		return err
+	}
+	partClosed := false
+	defer func() {
+		if !partClosed {
+			_ = part.Close()
+		}
+	}()
+	if stat, statErr := part.Stat(); statErr != nil {
+		return statErr
+	} else if chunk.Offset > stat.Size() {
+		return invalidChunkUploadError(fmt.Sprintf("unexpected upload offset %d, current size is %d", chunk.Offset, stat.Size()))
+	} else if chunk.Offset < stat.Size() && chunkEnd > stat.Size() {
+		if err = part.Truncate(chunk.Offset); err != nil {
+			return err
+		}
+	}
+	if _, err = part.WriteAt(chunkData, chunk.Offset); err != nil {
+		return err
+	}
+
+	if chunk.ChunkIndex+1 != chunk.ChunkCount {
+		return nil
+	}
+	partInfo, err := part.Stat()
+	if err != nil {
+		return err
+	}
+	if partInfo.Size() != chunk.FileSize {
+		return invalidChunkUploadError(fmt.Sprintf("uploaded file size mismatch: expected %d, got %d", chunk.FileSize, partInfo.Size()))
+	}
+	if err = part.Close(); err != nil {
+		return err
+	}
+	partClosed = true
+	if err = os.Chmod(partFile, fileMode); err != nil {
+		return err
+	}
+	if stat, ok := ownerInfo.Sys().(*syscall.Stat_t); ok {
+		if err = os.Chown(partFile, int(stat.Uid), int(stat.Gid)); err != nil {
+			return err
+		}
+	}
+	if chunkUploadCancelled(chunk.UploadID) {
+		return errChunkUploadCancelled
+	}
+	if err = finalizeActiveChunkUpload(chunk.UploadID, partFile, dstFile, chunk.Overwrite); err != nil {
+		return err
+	}
+	markChunkUploadCompleted(chunk.UploadID, upload)
+	deleteActiveChunkUpload(chunk.UploadID)
+	return nil
+}
+
 func mergeChunks(fileName string, fileDir string, dstDir string, chunkCount int, overwrite bool) error {
 	defer func() {
 		_ = os.RemoveAll(fileDir)
@@ -871,6 +1270,10 @@ func (b *BaseApi) UploadChunkFiles(c *gin.Context) {
 		helper.BadRequest(c, err)
 		return
 	}
+	if chunkCount <= 0 || chunkIndex < 0 || chunkIndex >= chunkCount {
+		helper.BadRequest(c, errors.New("invalid chunk index"))
+		return
+	}
 	fileOp := files.NewFileOp()
 	tmpDir := path.Join(global.Dir.TmpDir, "upload")
 	if !fileOp.Stat(tmpDir) {
@@ -885,20 +1288,25 @@ func (b *BaseApi) UploadChunkFiles(c *gin.Context) {
 		return
 	}
 	uploadID := strings.TrimSpace(c.PostForm("uploadID"))
+	resumable := c.PostForm("fileSize") != "" || c.PostForm("offset") != ""
 	cancellable := uploadID != ""
 	if cancellable && (filepath.Base(uploadID) != uploadID || strings.ContainsAny(uploadID, `/\\`)) {
 		helper.BadRequest(c, errors.New("invalid upload ID"))
 		return
 	}
+	if resumable && !cancellable {
+		helper.BadRequest(c, errors.New("upload ID is required"))
+		return
+	}
 	if !cancellable {
 		uploadID = filename
 	}
 	fileDir := filepath.Join(tmpDir, uploadID)
 	if cancellable && chunkUploadCancelled(uploadID) {
-		helper.BadRequest(c, errors.New("upload cancelled"))
+		helper.BadRequest(c, errChunkUploadCancelled)
 		return
 	}
-	if chunkIndex == 0 {
+	if !resumable && chunkIndex == 0 {
 		if fileOp.Stat(fileDir) {
 			_ = fileOp.DeleteDir(fileDir)
 		}
@@ -907,32 +1315,67 @@ func (b *BaseApi) UploadChunkFiles(c *gin.Context) {
 	filePath := filepath.Join(fileDir, filename)
 
 	defer func() {
-		if err != nil {
+		if !resumable && err != nil {
 			_ = os.RemoveAll(fileDir)
 		}
 	}()
-	var (
-		emptyFile *os.File
-		chunkData []byte
-	)
-
-	emptyFile, err = os.Create(filePath)
-	if err != nil {
-		helper.BadRequest(c, err)
-		return
-	}
-	defer emptyFile.Close()
-
-	chunkData, err = io.ReadAll(uploadFile)
+	chunkData, err := io.ReadAll(uploadFile)
 	if err != nil {
 		helper.InternalServer(c, buserr.WithMap("ErrFileUpload", map[string]interface{}{"name": filename, "detail": err.Error()}, err))
 		return
 	}
 	if cancellable && chunkUploadCancelled(uploadID) {
-		err = errors.New("upload cancelled")
+		err = errChunkUploadCancelled
 		helper.BadRequest(c, err)
 		return
 	}
+	if resumable {
+		offset, parseErr := strconv.ParseInt(c.PostForm("offset"), 10, 64)
+		if parseErr != nil {
+			helper.BadRequest(c, parseErr)
+			return
+		}
+		fileSize, parseErr := strconv.ParseInt(c.PostForm("fileSize"), 10, 64)
+		if parseErr != nil {
+			helper.BadRequest(c, parseErr)
+			return
+		}
+		overwrite := true
+		if ow := c.PostForm("overwrite"); ow != "" {
+			overwrite, _ = strconv.ParseBool(ow)
+		}
+		err = writeResumableUploadChunk(resumableUploadChunk{
+			UploadID:   uploadID,
+			Filename:   filename,
+			DstDir:     c.PostForm("path"),
+			ChunkIndex: chunkIndex,
+			ChunkCount: chunkCount,
+			Offset:     offset,
+			FileSize:   fileSize,
+			Overwrite:  overwrite,
+		}, chunkData)
+		if err != nil {
+			uploadErr := buserr.WithMap("ErrFileUpload", map[string]interface{}{"name": filename, "detail": err.Error()}, err)
+			helper.ErrorWithDetailAndData(c, http.StatusInternalServerError, "ErrInternalServer", uploadErr, gin.H{
+				"retryable": isRetryableChunkUploadError(err),
+			})
+			return
+		}
+		if chunkIndex+1 == chunkCount {
+			cancelledChunkUploads.Lock()
+			delete(cancelledChunkUploads.ids, uploadID)
+			cancelledChunkUploads.Unlock()
+		}
+		helper.SuccessWithData(c, true)
+		return
+	}
+
+	emptyFile, err := os.Create(filePath)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	defer emptyFile.Close()
 
 	chunkPath := filepath.Join(fileDir, fmt.Sprintf("%s.%d", filename, chunkIndex))
 	err = os.WriteFile(chunkPath, chunkData, constant.DirPerm)
@@ -985,6 +1428,10 @@ func (b *BaseApi) StopChunkUpload(c *gin.Context) {
 		helper.InternalServer(c, err)
 		return
 	}
+	if err := removeActiveResumableUploadPart(uploadID); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
 	helper.Success(c)
 }
 

agent/app/api/v2/firewall.go

@@ -1,34 +1,53 @@
 package v2
 
 import (
+	"errors"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"net/http"
+
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
+
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/utils/docker"
+	"github.com/1Panel-dev/1Panel/agent/utils/firewall/filter"
 	"github.com/gin-gonic/gin"
 )
 
+func (b *BaseApi) UpdatePanelFirewallPort(c *gin.Context) {
+	if !global.IsMaster {
+		c.AbortWithStatus(http.StatusForbidden)
+		return
+	}
+	var request struct {
+		OldPort uint `json:"oldPort" validate:"required,min=1,max=65535"`
+		NewPort uint `json:"newPort" validate:"required,min=1,max=65535"`
+	}
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	if err := firewallService.UpdatePanelPort(c.Request.Context(), request.OldPort, request.NewPort); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags Firewall
 // @Summary Load firewall base info
 // @Accept json
 // @Param request body dto.OperationWithName true "request"
-// @Success 200 {object} dto.FirewallBaseInfo
+// @Success 200 {object} dto.FirewallSubsystemStatus
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /hosts/firewall/base [post]
 func (b *BaseApi) LoadFirewallBaseInfo(c *gin.Context) {
-	var req dto.OperationWithName
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+	var request dto.OperationWithName
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
 		return
 	}
 
-	var (
-		data dto.FirewallBaseInfo
-		err  error
-	)
-	if req.Name == "forward" {
-		data, err = forwardingService.LoadBaseInfo()
-	} else {
-		data, err = firewallService.LoadBaseInfo(req.Name)
-	}
+	data, err := firewallService.LoadBaseInfo(request.Name)
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -37,331 +56,625 @@ func (b *BaseApi) LoadFirewallBaseInfo(c *gin.Context) {
 	helper.SuccessWithData(c, data)
 }
 
-// @Tags Firewall
-// @Summary Page firewall rules
-// @Accept json
-// @Param request body dto.RuleSearch true "request"
-// @Success 200 {object} dto.PageResult
-// @Security ApiKeyAuth
-// @Security Timestamp
-// @Router /hosts/firewall/search [post]
-func (b *BaseApi) SearchFirewallRule(c *gin.Context) {
-	var req dto.RuleSearch
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
-		return
-	}
-
-	var (
-		total int64
-		list  interface{}
-		err   error
-	)
-	if req.Type == "forward" {
-		total, list, err = forwardingService.SearchWithPage(dto.ForwardRuleSearch{
-			PageInfo: req.PageInfo,
-			Info:     req.Info,
-			Status:   req.Status,
-			Strategy: req.Strategy,
-		})
-	} else {
-		total, list, err = firewallService.SearchWithPage(req)
-	}
-	if err != nil {
-		helper.InternalServer(c, err)
-		return
-	}
-
-	helper.SuccessWithData(c, dto.PageResult{
-		Items: list,
-		Total: total,
-	})
-}
-
 // @Tags Firewall
 // @Summary Operate firewall
 // @Accept json
-// @Param request body dto.FirewallOperation true "request"
-// @Success 200
+// @Param request body dto.FirewallLifecycleOperation true "request"
+// @Success 200 {object} dto.FirewallLifecycleOperationResponse
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /hosts/firewall/operate [post]
 // @x-panel-log {"bodyKeys":["operation"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"[operation] 防火墙","formatEN":"[operation] firewall"}
 func (b *BaseApi) OperateFirewall(c *gin.Context) {
-	var req dto.FirewallOperation
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+	var request dto.FirewallLifecycleOperation
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
 		return
 	}
 
-	if err := firewallService.OperateFirewall(req); err != nil {
+	result, err := firewallService.QueueFirewallOperation(request)
+	if err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
 
-	helper.Success(c)
+	helper.SuccessWithData(c, result)
 }
 
 // @Tags Firewall
-// @Summary Create group
+// @Summary Load forwarding base info
 // @Accept json
-// @Param request body dto.PortRuleOperate true "request"
-// @Success 200
+// @Success 200 {object} dto.FirewallSubsystemStatus
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /hosts/firewall/port [post]
-// @x-panel-log {"bodyKeys":["port","strategy"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"添加端口规则 [strategy] [port]","formatEN":"create port rules [strategy][port]"}
-func (b *BaseApi) OperatePortRule(c *gin.Context) {
-	var req dto.PortRuleOperate
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
-		return
-	}
-
-	if err := firewallService.OperatePortRule(req, true); err != nil {
+// @Router /hosts/firewall/forward/base [post]
+func (b *BaseApi) LoadForwardingBaseInfo(c *gin.Context) {
+	data, err := forwardingService.LoadBaseInfo(c.Request.Context())
+	if err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
-	helper.Success(c)
-}
-
-// OperateForwardRule
-// @Tags Firewall
-// @Summary Operate forward rule
-// @Accept json
-// @Param request body dto.ForwardRuleOperate true "request"
-// @Success 200
-// @Security ApiKeyAuth
-// @Security Timestamp
-// @Router /hosts/firewall/forward [post]
-// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新端口转发规则","formatEN":"update port forward rules"}
-func (b *BaseApi) OperateForwardRule(c *gin.Context) {
-	var req dto.ForwardRuleOperate
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
-		return
-	}
-
-	if err := forwardingService.Operate(req); err != nil {
-		helper.InternalServer(c, err)
-		return
-	}
-	helper.Success(c)
+	helper.SuccessWithData(c, data)
 }
 
 // @Tags Firewall
-// @Summary Operate Ip rule
+// @Summary Page forwarding rules
 // @Accept json
-// @Param request body dto.AddrRuleOperate true "request"
-// @Success 200
-// @Security ApiKeyAuth
-// @Security Timestamp
-// @Router /hosts/firewall/ip [post]
-// @x-panel-log {"bodyKeys":["strategy","address"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"添加 ip 规则 [strategy] [address]","formatEN":"create address rules [strategy][address]"}
-func (b *BaseApi) OperateIPRule(c *gin.Context) {
-	var req dto.AddrRuleOperate
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
-		return
-	}
-
-	if err := firewallService.OperateAddressRule(req, true); err != nil {
-		helper.InternalServer(c, err)
-		return
-	}
-	helper.Success(c)
-}
-
-// @Tags Firewall
-// @Summary Batch operate rule
-// @Accept json
-// @Param request body dto.BatchRuleOperate true "request"
-// @Success 200
-// @Security ApiKeyAuth
-// @Security Timestamp
-// @Router /hosts/firewall/batch [post]
-func (b *BaseApi) BatchOperateRule(c *gin.Context) {
-	var req dto.BatchRuleOperate
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
-		return
-	}
-
-	if err := firewallService.BatchOperateRule(req); err != nil {
-		helper.InternalServer(c, err)
-		return
-	}
-	helper.Success(c)
-}
-
-// @Tags Firewall
-// @Summary Update rule description
-// @Accept json
-// @Param request body dto.UpdateFirewallDescription true "request"
-// @Success 200
-// @Security ApiKeyAuth
-// @Security Timestamp
-// @Router /hosts/firewall/update/description [post]
-func (b *BaseApi) UpdateFirewallDescription(c *gin.Context) {
-	var req dto.UpdateFirewallDescription
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
-		return
-	}
-
-	if err := firewallService.UpdateDescription(req); err != nil {
-		helper.InternalServer(c, err)
-		return
-	}
-	helper.Success(c)
-}
-
-// @Tags Firewall
-// @Summary Update port rule
-// @Accept json
-// @Param request body dto.PortRuleUpdate true "request"
-// @Success 200
-// @Security ApiKeyAuth
-// @Security Timestamp
-// @Router /hosts/firewall/update/port [post]
-func (b *BaseApi) UpdatePortRule(c *gin.Context) {
-	var req dto.PortRuleUpdate
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
-		return
-	}
-
-	if err := firewallService.UpdatePortRule(req); err != nil {
-		helper.InternalServer(c, err)
-		return
-	}
-	helper.Success(c)
-}
-
-// @Tags Firewall
-// @Summary Update Ip rule
-// @Accept json
-// @Param request body dto.AddrRuleUpdate true "request"
-// @Success 200
-// @Security ApiKeyAuth
-// @Security Timestamp
-// @Router /hosts/firewall/update/addr [post]
-func (b *BaseApi) UpdateAddrRule(c *gin.Context) {
-	var req dto.AddrRuleUpdate
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
-		return
-	}
-
-	if err := firewallService.UpdateAddrRule(req); err != nil {
-		helper.InternalServer(c, err)
-		return
-	}
-	helper.Success(c)
-}
-
-// @Tags Firewall
-// @Summary search iptables filter rules
-// @Accept json
-// @Param request body dto.SearchPageWithType true "request"
+// @Param request body dto.ForwardRuleSearch true "request"
 // @Success 200 {object} dto.PageResult
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /hosts/firewall/filter/rule/search [post]
-func (b *BaseApi) SearchFilterRules(c *gin.Context) {
-	var req dto.SearchPageWithType
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+// @Router /hosts/firewall/forward/search [post]
+func (b *BaseApi) SearchForwardingRules(c *gin.Context) {
+	var request dto.ForwardRuleSearch
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
 		return
 	}
-
-	total, list, err := iptablesService.Search(req)
+	total, items, err := forwardingService.SearchRules(c.Request.Context(), request)
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
 
-	helper.SuccessWithData(c, dto.PageResult{
-		Items: list,
-		Total: total,
-	})
+	helper.SuccessWithData(c, dto.PageResult{Items: items, Total: total})
 }
 
 // @Tags Firewall
-// @Summary Operate iptables filter rule
+// @Summary Operate forwarding rules
 // @Accept json
-// @Param request body dto.IptablesRuleOp true "request"
-// @Success 200
+// @Param request body dto.ForwardRuleOperate true "request"
+// @Success 200 {object} dto.FilterChainOperationResponse
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /hosts/firewall/filter/rule/operate [post]
-// @x-panel-log {"bodyKeys":["operation","chain"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"[operation] filter规则到 [chain]","formatEN":"[operation] filter rule to [chain]"}
-func (b *BaseApi) OperateFilterRule(c *gin.Context) {
-	var req dto.IptablesRuleOp
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+// @Router /hosts/firewall/forward/operate [post]
+// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新端口转发规则","formatEN":"update port forward rules"}
+func (b *BaseApi) OperateForwardingRules(c *gin.Context) {
+	var request dto.ForwardRuleOperate
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
 		return
 	}
-	if err := iptablesService.OperateRule(req, true); err != nil {
+
+	result, err := forwardingService.OperateRules(request)
+	if err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
-
-	helper.Success(c)
+	helper.SuccessWithData(c, result)
 }
 
 // @Tags Firewall
-// @Summary Batch operate iptables filter rules
+// @Summary Enable forwarding
 // @Accept json
-// @Param request body dto.IptablesBatchOperate true "request"
-// @Success 200
+// @Param request body dto.FirewallInitializationTask true "request"
+// @Success 200 {object} dto.FilterChainOperationResponse
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /hosts/firewall/filter/rule/batch [post]
-func (b *BaseApi) BatchOperateFilterRule(c *gin.Context) {
-	var req dto.IptablesBatchOperate
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+// @Router /hosts/firewall/forward/enable [post]
+// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"初始化并启用端口转发","formatEN":"initialize and enable port forwarding"}
+func (b *BaseApi) EnableForwarding(c *gin.Context) {
+	var request dto.FirewallInitializationTask
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
 		return
 	}
-
-	if err := iptablesService.BatchOperate(req); err != nil {
+	result, err := forwardingService.QueueInitialization(request)
+	if err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
-
-	helper.Success(c)
+	helper.SuccessWithData(c, result)
 }
 
 // @Tags Firewall
-// @Summary Apply/Unload/Init iptables filter
+// @Summary Apply/Unload/Init firewall filter chain
 // @Accept json
-// @Param request body dto.IptablesOp true "request"
-// @Success 200
+// @Param request body dto.FilterChainOperation true "request"
+// @Success 200 {object} dto.FilterChainOperationResponse
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /hosts/firewall/filter/operate [post]
-// @x-panel-log {"bodyKeys":["operate"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"[operate] iptables filter 防火墙","formatEN":"[operate] iptables filter firewall"}
+// @x-panel-log {"bodyKeys":["operate"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"[operate] 防火墙过滤链","formatEN":"[operate] firewall filter chain"}
 func (b *BaseApi) OperateFilterChain(c *gin.Context) {
-	var req dto.IptablesOp
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+	var request dto.FilterChainOperation
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
 		return
 	}
-	var err error
-	if req.Operate == "init-forward" {
-		err = forwardingService.Enable()
-	} else {
-		err = iptablesService.Operate(req)
+	if request.Operate == "init-base" {
+		result, err := firewallService.QueueFilterChainInitialization(request)
+		if err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
+		helper.SuccessWithData(c, result)
+		return
 	}
-	if err != nil {
+	if err := firewallService.OperateFilterChain(request); err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
+	helper.SuccessWithData(c, dto.FilterChainOperationResponse{})
+}
 
+// @Tags Firewall
+// @Summary List unified firewall v2 rules
+// @Accept json
+// @Param request body dto.FirewallRuleInventory true "request"
+// @Success 200 {object} dto.FirewallRuleInventoryResponse
+// @Failure 400 {object} dto.Response
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/rules/search [post]
+func (b *BaseApi) SearchFirewallRules(c *gin.Context) {
+	var request dto.FirewallRuleInventory
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	inventory, err := firewallService.Inventory(c.Request.Context(), request)
+	if err != nil {
+		handleFirewallRuleError(c, err)
+		return
+	}
+	helper.SuccessWithData(c, inventory)
+}
+
+// @Tags Firewall
+// @Summary Reset firewall rules
+// @Accept json
+// @Param request body dto.FirewallRuleReset true "request"
+// @Success 200 {object} dto.FirewallRuleResetResponse
+// @Failure 400 {object} dto.Response
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/rules/reset [post]
+// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"重置防火墙规则","formatEN":"reset firewall rules"}
+func (b *BaseApi) ResetFirewallRules(c *gin.Context) {
+	var request dto.FirewallRuleReset
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	result, err := firewallService.Reset(c.Request.Context(), request)
+	if err != nil {
+		handleFirewallRuleError(c, err)
+		return
+	}
+	helper.SuccessWithData(c, result)
+}
+
+// @Tags Firewall
+// @Summary Load one provider-native firewall object definition
+// @Accept json
+// @Param request body dto.FirewallNativeDetail true "request"
+// @Success 200 {string} string
+// @Failure 400 {object} dto.Response
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/rules/native/detail [post]
+func (b *BaseApi) LoadFirewallNativeDetail(c *gin.Context) {
+	var request dto.FirewallNativeDetail
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	info, err := firewallService.LoadFirewallNativeDetail(c.Request.Context(), request)
+	if err != nil {
+		handleFirewallRuleError(c, err)
+		return
+	}
+	helper.SuccessWithData(c, info)
+}
+
+// @Tags Firewall
+// @Summary Queue firewall rule creation
+// @Description Creation and import return a taskID immediately; validation and execution results are written to the task log.
+// @Accept json
+// @Param request body dto.FirewallRuleCreate true "request"
+// @Success 200 {object} dto.FirewallRuleCreateResponse
+// @Failure 400 {object} dto.Response
+// @Failure 409 {object} dto.Response
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/rules [post]
+// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"添加防火墙规则","formatEN":"create firewall rules"}
+func (b *BaseApi) CreateFirewallRules(c *gin.Context) {
+	var request dto.FirewallRuleCreate
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	result, err := firewallService.Create(c.Request.Context(), request)
+	if err != nil {
+		handleFirewallRuleError(c, err)
+		return
+	}
+	helper.SuccessWithData(c, result)
+}
+
+// @Tags Firewall
+// @Summary Queue firewall rule deletion
+// @Description Deletes non-whitelist rules by scope and instance key. Returns a taskID immediately; results are written to the task log.
+// @Accept json
+// @Param request body dto.FirewallRuleDelete true "request"
+// @Success 200 {object} dto.FirewallRuleDeleteResponse
+// @Failure 400 {object} dto.Response
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/rules/delete [post]
+// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"删除防火墙规则","formatEN":"delete firewall rules"}
+func (b *BaseApi) DeleteFirewallRules(c *gin.Context) {
+	var request dto.FirewallRuleDelete
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	result, err := firewallService.Delete(c.Request.Context(), request)
+	if err != nil {
+		handleFirewallRuleError(c, err)
+		return
+	}
+	helper.SuccessWithData(c, result)
+}
+
+// @Tags Firewall
+// @Summary Update a firewall rule
+// @Accept json
+// @Param request body dto.FirewallRuleUpdate true "request"
+// @Success 200
+// @Failure 400 {object} dto.Response
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/rules/update [post]
+// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新防火墙规则","formatEN":"update firewall rule"}
+func (b *BaseApi) UpdateFirewallRule(c *gin.Context) {
+	var request dto.FirewallRuleUpdate
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	if err := firewallService.Update(c.Request.Context(), request); err != nil {
+		handleFirewallRuleError(c, err)
+		return
+	}
 	helper.Success(c)
 }
 
 // @Tags Firewall
-// @Summary load chain status with name
+// @Summary Reorder a firewall rule
 // @Accept json
-// @Param request body dto.OperationWithName true "request"
+// @Param request body dto.FirewallRuleReorder true "request"
+// @Success 200
+// @Failure 400 {object} dto.Response
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/rules/reorder [post]
+// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"调整防火墙规则顺序","formatEN":"reorder firewall rule"}
+func (b *BaseApi) ReorderFirewallRule(c *gin.Context) {
+	var request dto.FirewallRuleReorder
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	if err := firewallService.Reorder(c.Request.Context(), request); err != nil {
+		handleFirewallRuleError(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+func handleFirewallRuleError(c *gin.Context, err error) {
+	var businessErr buserr.BusinessError
+	isBusinessError := errors.As(err, &businessErr)
+	switch {
+	case errors.Is(err, filter.ErrProtectedRule):
+		helper.ErrorWithBusinessCode(c, http.StatusBadRequest, "FW_LOCKOUT_RISK", "ErrInvalidParams", err)
+	case errors.Is(err, filter.ErrRuleStale):
+		helper.ErrorWithBusinessCode(c, http.StatusConflict, "FW_RULE_STALE", "ErrInvalidParams", err)
+	case errors.Is(err, filter.ErrUnsupportedScope), errors.Is(err, filter.ErrInvalidScope),
+		errors.Is(err, filter.ErrProviderUnavailable), errors.Is(err, filter.ErrAdapterUnavailable):
+		helper.ErrorWithBusinessCode(c, http.StatusBadRequest, "FW_SCOPE_UNSUPPORTED", "ErrInvalidParams", err)
+	case errors.Is(err, filter.ErrInvalidRule), errors.Is(err, filter.ErrRuleOperation):
+		helper.ErrorWithBusinessCode(c, http.StatusBadRequest, "FW_RULE_UNSUPPORTED", "ErrInvalidParams", err)
+	case isBusinessError && businessErr.Msg == "ErrRecordExist":
+		c.JSON(http.StatusOK, dto.Response{Code: http.StatusConflict, ErrorCode: "FW_RULE_DUPLICATE", Message: err.Error()})
+		c.Abort()
+	case isBusinessError && businessErr.Msg == "ErrFirewallRuleConflict":
+		c.JSON(http.StatusOK, dto.Response{Code: http.StatusConflict, ErrorCode: "FW_RULE_CONFLICT", Message: err.Error()})
+		c.Abort()
+	case isBusinessError && businessErr.Msg == "ErrInvalidParams":
+		c.JSON(http.StatusOK, dto.Response{Code: http.StatusBadRequest, ErrorCode: "FW_RULE_UNSUPPORTED", Message: err.Error()})
+		c.Abort()
+	default:
+		helper.ErrorWithBusinessCode(c, http.StatusInternalServerError, "FW_APPLY_FAILED", "ErrInternalServer", err)
+	}
+}
+
+// @Tags Firewall
+// @Summary Load firewall settings
+// @Success 200 {object} dto.FirewallSettings
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/settings [get]
+func (b *BaseApi) LoadFirewallSettings(c *gin.Context) {
+	data, err := firewallSettingService.Load(c.Request.Context())
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags Firewall
+// @Summary Create firewall port whitelist rules
+// @Description Saves whitelist configuration and applies missing allowances; existing rules are not removed.
+// @Accept json
+// @Param request body dto.FirewallPortWhitelistCreate true "request"
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /hosts/firewall/filter/chain/status [post]
-func (b *BaseApi) LoadChainStatus(c *gin.Context) {
-	var req dto.OperationWithName
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+// @Router /hosts/firewall/settings/whitelist [post]
+// @x-panel-log {"bodyKeys":["rule"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"创建防火墙端口白名单","formatEN":"create firewall port whitelist"}
+func (b *BaseApi) CreateFirewallPortWhitelist(c *gin.Context) {
+	var request dto.FirewallPortWhitelistCreate
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
 		return
 	}
+	if err := firewallSettingService.CreatePortWhitelist(c.Request.Context(), request); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
 
-	helper.SuccessWithData(c, iptablesService.LoadChainStatus(req))
+// @Tags Firewall
+// @Summary Update firewall port whitelist rules
+// @Description Saves whitelist configuration and applies missing allowances; existing rules are not removed.
+// @Accept json
+// @Param request body dto.FirewallPortWhitelistUpdate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/settings/whitelist/update [post]
+// @x-panel-log {"bodyKeys":["oldRule","rule"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"编辑防火墙端口白名单","formatEN":"update firewall port whitelist"}
+func (b *BaseApi) UpdateFirewallPortWhitelist(c *gin.Context) {
+	var request dto.FirewallPortWhitelistUpdate
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	if err := firewallSettingService.UpdatePortWhitelist(c.Request.Context(), request); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Firewall
+// @Summary Delete firewall port whitelist rules
+// @Description Removes whitelist configuration; existing firewall rules are not removed.
+// @Accept json
+// @Param request body dto.FirewallPortWhitelistDelete true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/settings/whitelist/delete [post]
+// @x-panel-log {"bodyKeys":["rules"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"删除防火墙端口白名单","formatEN":"delete firewall port whitelist"}
+func (b *BaseApi) DeleteFirewallPortWhitelist(c *gin.Context) {
+	var request dto.FirewallPortWhitelistDelete
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	if err := firewallSettingService.DeletePortWhitelist(c.Request.Context(), request); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Firewall
+// @Summary Operate firewall backend
+// @Accept json
+// @Param request body dto.FirewallBackendOperation true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/settings/operate [post]
+// @x-panel-log {"bodyKeys":["subsystem","backend","operation"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"防火墙子系统 [subsystem] 后端 [operation] [backend]","formatEN":"[operation] firewall [subsystem] backend [backend]"}
+func (b *BaseApi) OperateFirewallBackend(c *gin.Context) {
+	var request dto.FirewallBackendOperation
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	if err := firewallSettingService.Operate(c.Request.Context(), request); err != nil {
+		var businessErr buserr.BusinessError
+		if errors.As(err, &businessErr) && businessErr.Msg == "ErrFirewallBackendCleanupRequired" {
+			c.JSON(http.StatusOK, dto.Response{Code: http.StatusConflict, ErrorCode: "FW_BACKEND_CLEANUP_REQUIRED", Message: err.Error()})
+			c.Abort()
+			return
+		}
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Firewall
+// @Summary List Docker port guard status and policies
+// @Success 200 {object} dto.DockerPortGuardList
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/docker/ports [get]
+func (b *BaseApi) ListDockerPortGuard(c *gin.Context) {
+	data, err := dockerPortGuardService.LoadOverview(c.Request.Context())
+	if err != nil {
+		handleDockerPortGuardError(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags Firewall
+// @Summary List Docker published ports
+// @Success 200 {array} dto.DockerPortGuardContainer
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/docker/endpoints [get]
+func (b *BaseApi) ListDockerPublishedPorts(c *gin.Context) {
+	data, err := dockerPortGuardService.LoadPublishedPorts(c.Request.Context())
+	if err != nil {
+		handleDockerPortGuardError(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags Firewall
+// @Summary Operate Docker port guard
+// @Accept json
+// @Param request body dto.DockerPortGuardOperation true "request"
+// @Success 200 {object} dto.FilterChainOperationResponse
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/docker/operate [post]
+// @x-panel-log {"bodyKeys":["operation"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"[operation] Docker 端口防护","formatEN":"[operation] Docker port guard"}
+func (b *BaseApi) OperateDockerPortGuard(c *gin.Context) {
+	var request dto.DockerPortGuardOperation
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	if request.Operation == "initialize" {
+		result, err := dockerPortGuardService.QueueInitialization(request)
+		if err != nil {
+			handleDockerPortGuardError(c, err)
+			return
+		}
+		helper.SuccessWithData(c, result)
+		return
+	}
+	if err := dockerPortGuardService.Operate(c.Request.Context(), request); err != nil {
+		handleDockerPortGuardError(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Firewall
+// @Summary Delete Docker port guard policies
+// @Accept json
+// @Param request body dto.DockerPortGuardPolicyBatchDelete true "request"
+// @Success 200 {object} dto.FilterChainOperationResponse
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/docker/policies/delete/batch [post]
+// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"删除 Docker 端口防护策略","formatEN":"delete Docker port guard policies"}
+func (b *BaseApi) DeleteDockerPortGuardPolicies(c *gin.Context) {
+	var request dto.DockerPortGuardPolicyBatchDelete
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	result, err := dockerPortGuardService.DeletePolicies(request)
+	if err != nil {
+		handleDockerPortGuardError(c, err)
+		return
+	}
+	helper.SuccessWithData(c, result)
+}
+
+// @Tags Firewall
+// @Summary Batch upsert Docker port guard policies
+// @Accept json
+// @Param request body dto.DockerPortGuardPolicyBatch true "request"
+// @Success 200 {object} dto.FilterChainOperationResponse
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/docker/policies/batch [post]
+// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"批量更新 Docker 端口防护策略","formatEN":"batch update Docker port guard policies"}
+func (b *BaseApi) UpsertDockerPortGuardPolicies(c *gin.Context) {
+	var request dto.DockerPortGuardPolicyBatch
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	result, err := dockerPortGuardService.UpsertPolicies(request)
+	if err != nil {
+		handleDockerPortGuardError(c, err)
+		return
+	}
+	helper.SuccessWithData(c, result)
+}
+
+func handleDockerPortGuardError(c *gin.Context, err error) {
+	var businessErr buserr.BusinessError
+	if errors.As(err, &businessErr) {
+		code, errorCode := http.StatusInternalServerError, ""
+		switch businessErr.Msg {
+		case "ErrDockerIptablesChainUnavailable":
+			code, errorCode = http.StatusServiceUnavailable, "FW_DOCKER_IPTABLES_CHAIN_UNAVAILABLE"
+		case "ErrDockerNftablesChainUnavailable":
+			code, errorCode = http.StatusServiceUnavailable, "FW_DOCKER_NFTABLES_CHAIN_UNAVAILABLE"
+		case "ErrInvalidParams":
+			code, errorCode = http.StatusBadRequest, "FW_DOCKER_GUARD_INVALID"
+		case "ErrDockerFailed":
+			code, errorCode = http.StatusServiceUnavailable, "FW_DOCKER_UNAVAILABLE"
+		}
+		if errorCode != "" {
+			c.JSON(http.StatusOK, dto.Response{Code: code, ErrorCode: errorCode, Message: err.Error()})
+			c.Abort()
+			return
+		}
+	}
+	if errors.Is(err, docker.ErrUnavailable) {
+		helper.ErrorWithBusinessCode(c, http.StatusServiceUnavailable, "FW_DOCKER_UNAVAILABLE", "ErrDockerFailed", err)
+		return
+	}
+	helper.ErrorWithBusinessCode(c, http.StatusInternalServerError, "FW_DOCKER_GUARD_FAILED", "ErrInternalServer", err)
+}
+
+// @Tags Firewall
+// @Summary List firewall rule backups
+// @Param subsystem query string false "Firewall subsystem" Enums(system,forwarding,docker) default(system)
+// @Success 200 {object} dto.FirewallRuleBackups
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/rules/backups [get]
+func (b *BaseApi) ListFirewallRuleBackups(c *gin.Context) {
+	result, err := firewallService.ListRuleBackups(c.Request.Context(), c.DefaultQuery("subsystem", "system"))
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, result)
+}
+
+// @Tags Firewall
+// @Summary Initialize, repair or bind one firewall address family
+// @Accept json
+// @Param request body dto.FirewallFamilyOperation true "request"
+// @Success 200 {object} dto.FilterChainOperationResponse
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/family/operate [post]
+// @x-panel-log {"bodyKeys":["subsystem","family","operation"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"[operation] [subsystem] [family] 防火墙链","formatEN":"[operation] [subsystem] [family] firewall chains"}
+func (b *BaseApi) OperateFirewallFamily(c *gin.Context) {
+	var request dto.FirewallFamilyOperation
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	result, err := firewallSettingService.OperateFamily(request)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, result)
+}
+
+// @Tags Firewall
+// @Summary Update firewall IPv6 support
+// @Accept json
+// @Param request body dto.FirewallIPv6Operation true "request"
+// @Success 200 {object} dto.FilterChainOperationResponse
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/settings/ipv6 [post]
+// @x-panel-log {"bodyKeys":["status"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"设置防火墙 IPv6 支持为 [status]","formatEN":"Set firewall IPv6 support to [status]"}
+func (b *BaseApi) OperateFirewallIPv6(c *gin.Context) {
+	var request dto.FirewallIPv6Operation
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	result, err := firewallSettingService.OperateIPv6(request)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, result)
 }

agent/app/api/v2/gpu.go

@@ -3,9 +3,8 @@ package v2
 import (
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
-	"github.com/1Panel-dev/1Panel/agent/utils/ai_tools/gpu"
-	"github.com/1Panel-dev/1Panel/agent/utils/ai_tools/gpu/common"
-	"github.com/1Panel-dev/1Panel/agent/utils/ai_tools/xpu"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/utils/ai_tools/accelerator"
 	"github.com/gin-gonic/gin"
 )
 
@@ -17,27 +16,20 @@ import (
 // @Security Timestamp
 // @Router /ai/gpu/load [get]
 func (b *BaseApi) LoadGpuInfo(c *gin.Context) {
-	ok, client := gpu.New()
+	ok, client := accelerator.New()
 	if ok {
-		info, err := client.LoadGpuInfo()
+		snapshot, err := client.Collect(c.Request.Context())
 		if err != nil {
 			helper.BadRequest(c, err)
 			return
 		}
-		helper.SuccessWithData(c, info)
-		return
-	}
-	xpuOK, xpuClient := xpu.New()
-	if xpuOK {
-		info, err := xpuClient.LoadGpuInfo()
-		if err != nil {
-			helper.BadRequest(c, err)
-			return
+		if warning := snapshot.Warning(); warning != nil {
+			global.LOG.Warnf("load realtime accelerator data partially failed, err: %v", warning)
 		}
-		helper.SuccessWithData(c, info)
+		helper.SuccessWithData(c, &snapshot.Info)
 		return
 	}
-	helper.SuccessWithData(c, &common.GpuInfo{})
+	helper.SuccessWithData(c, &accelerator.Info{})
 }
 
 // @Tags AI

agent/app/api/v2/helper/helper.go

@@ -3,6 +3,7 @@ package helper
 import (
 	"compress/gzip"
 	"context"
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"net/http"
@@ -11,6 +12,7 @@ import (
 	"sync"
 
 	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/utils/mcpapi"
 	"gorm.io/gorm"
 
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
@@ -21,6 +23,7 @@ import (
 )
 
 func ErrorWithDetail(ctx *gin.Context, code int, msgKey string, err error) {
+	mcpapi.SetBusinessErrorHeader(ctx.Request, ctx.Writer.Header(), err)
 	res := dto.Response{
 		Code:    code,
 		Message: "",
@@ -30,6 +33,28 @@ func ErrorWithDetail(ctx *gin.Context, code int, msgKey string, err error) {
 	ctx.Abort()
 }
 
+func ErrorWithBusinessCode(ctx *gin.Context, code int, businessCode, msgKey string, err error) {
+	mcpapi.SetBusinessErrorHeader(ctx.Request, ctx.Writer.Header(), err)
+	res := dto.Response{
+		Code:      code,
+		ErrorCode: businessCode,
+		Message:   i18n.GetMsgWithDetail(msgKey, err.Error()),
+	}
+	ctx.JSON(http.StatusOK, res)
+	ctx.Abort()
+}
+
+func ErrorWithDetailAndData(ctx *gin.Context, code int, msgKey string, err error, data interface{}) {
+	mcpapi.SetBusinessErrorHeader(ctx.Request, ctx.Writer.Header(), err)
+	res := dto.Response{
+		Code: code,
+		Data: data,
+	}
+	res.Message = i18n.GetMsgWithDetail(msgKey, err.Error())
+	ctx.JSON(http.StatusOK, res)
+	ctx.Abort()
+}
+
 func InternalServer(ctx *gin.Context, err error) {
 	ErrorWithDetail(ctx, http.StatusInternalServerError, "ErrInternalServer", err)
 }
@@ -164,3 +189,23 @@ func GetParamInt32(paramName string, c *gin.Context) (int32, error) {
 	intNum, _ := strconv.Atoi(idParam)
 	return int32(intNum), nil
 }
+
+// SetOperationLogValues supplies server-resolved values to Core's operation log.
+// Call before writing the response. Only pass public audit fields, never credentials.
+func SetOperationLogValues(c *gin.Context, values map[string]string) {
+	const header = "X-Op-Resolved"
+	resolved := make(map[string]string)
+	if data, err := base64.RawURLEncoding.DecodeString(c.Writer.Header().Get(header)); err == nil {
+		_ = json.Unmarshal(data, &resolved)
+	}
+	if resolved == nil {
+		resolved = make(map[string]string)
+	}
+	for key, value := range values {
+		resolved[key] = value
+	}
+	data, err := json.Marshal(resolved)
+	if err == nil {
+		c.Header(header, base64.RawURLEncoding.EncodeToString(data))
+	}
+}

agent/app/api/v2/monitor.go

@@ -1,13 +1,9 @@
 package v2
 
 import (
-	"sort"
-
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/gin-gonic/gin"
-	"github.com/shirou/gopsutil/v4/disk"
-	"github.com/shirou/gopsutil/v4/net"
 )
 
 // @Tags Monitor
@@ -32,14 +28,19 @@ func (b *BaseApi) LoadMonitor(c *gin.Context) {
 }
 
 // @Tags Monitor
-// @Summary Clean monitor data
+// @Summary Clean host or GPU monitor data
+// @Param request body dto.MonitorClean true "request"
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /hosts/monitor/clean [post]
-// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"清空监控数据","formatEN":"clean monitor datas"}
+// @x-panel-log {"bodyKeys":["type"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"清空 [type] 监控数据","formatEN":"clean [type] monitoring data"}
 func (b *BaseApi) CleanMonitor(c *gin.Context) {
-	if err := monitorService.CleanData(); err != nil {
+	var req dto.MonitorClean
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := monitorService.CleanData(req.Type); err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
@@ -91,14 +92,7 @@ func (b *BaseApi) UpdateMonitorSetting(c *gin.Context) {
 // @Security Timestamp
 // @Router /hosts/monitor/netoptions [get]
 func (b *BaseApi) GetNetworkOptions(c *gin.Context) {
-	netStat, _ := net.IOCounters(true)
-	var options []string
-	options = append(options, "all")
-	for _, net := range netStat {
-		options = append(options, net.Name)
-	}
-	sort.Strings(options)
-	helper.SuccessWithData(c, options)
+	helper.SuccessWithData(c, monitorService.LoadNetworkOptions())
 }
 
 // @Tags Monitor
@@ -108,12 +102,5 @@ func (b *BaseApi) GetNetworkOptions(c *gin.Context) {
 // @Security Timestamp
 // @Router /hosts/monitor/iooptions [get]
 func (b *BaseApi) GetIOOptions(c *gin.Context) {
-	diskStat, _ := disk.IOCounters()
-	var options []string
-	options = append(options, "all")
-	for _, net := range diskStat {
-		options = append(options, net.Name)
-	}
-	sort.Strings(options)
-	helper.SuccessWithData(c, options)
+	helper.SuccessWithData(c, monitorService.LoadIOOptions())
 }

agent/app/api/v2/monitor_vllm.go

@@ -0,0 +1,45 @@
+package v2
+
+import (
+	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/gin-gonic/gin"
+)
+
+func (b *BaseApi) LoadVLLMMonitor(c *gin.Context) {
+	var req dto.MonitorVLLMSearch
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := monitorService.LoadVLLMMonitorData(c.Request.Context(), req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+func (b *BaseApi) LoadVLLMCurrent(c *gin.Context) {
+	var req dto.MonitorVLLMCurrent
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := monitorService.LoadVLLMCurrent(c.Request.Context(), req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+func (b *BaseApi) CleanVLLMMonitor(c *gin.Context) {
+	var req dto.MonitorVLLMClean
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := monitorService.CleanVLLMMonitor(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}

agent/app/api/v2/quick_directory.go

@@ -0,0 +1,84 @@
+package v2
+
+import (
+	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/gin-gonic/gin"
+)
+
+// @Tags Dashboard
+// @Summary List quick directories
+// @Success 200 {array} model.QuickDirectory
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /dashboard/quick/directory [get]
+func (b *BaseApi) ListQuickDirectories(c *gin.Context) {
+	items, err := dashboardService.ListQuickDirectories()
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, items)
+}
+
+// @Tags Dashboard
+// @Summary Create quick directory
+// @Accept json
+// @Param request body dto.QuickDirectoryCreate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /dashboard/quick/directory [post]
+func (b *BaseApi) CreateQuickDirectory(c *gin.Context) {
+	var req dto.QuickDirectoryCreate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	item, err := dashboardService.CreateQuickDirectory(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, item)
+}
+
+// @Tags Dashboard
+// @Summary Update quick directory
+// @Accept json
+// @Param request body dto.QuickDirectoryUpdate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /dashboard/quick/directory/update [post]
+func (b *BaseApi) UpdateQuickDirectory(c *gin.Context) {
+	var req dto.QuickDirectoryUpdate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	item, err := dashboardService.UpdateQuickDirectory(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, item)
+}
+
+// @Tags Dashboard
+// @Summary Delete quick directory
+// @Accept json
+// @Param request body dto.QuickDirectoryDelete true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /dashboard/quick/directory/del [post]
+func (b *BaseApi) DeleteQuickDirectory(c *gin.Context) {
+	var req dto.QuickDirectoryDelete
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := dashboardService.DeleteQuickDirectory(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}

agent/app/api/v2/runtime.go

@@ -61,13 +61,14 @@ func (b *BaseApi) CreateRuntime(c *gin.Context) {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /runtimes/del [post]
-// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"删除运行环境 [id]","formatEN":"Delete runtime [id]"}
+// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"删除运行环境 [name]","formatEN":"Delete runtime [name]"}
 func (b *BaseApi) DeleteRuntime(c *gin.Context) {
 	var req request.RuntimeDelete
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	err := runtimeService.Delete(req)
+	name, err := runtimeService.Delete(req)
+	helper.SetOperationLogValues(c, map[string]string{"name": name})
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -169,7 +170,7 @@ func (b *BaseApi) GetNodePackageRunScript(c *gin.Context) {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /runtimes/operate [post]
-// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"操作运行环境 [id]","formatEN":"Operate runtime [id]"}
+// @x-panel-log {"bodyKeys":["ID"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"ID","isList":false,"db":"runtimes","output_column":"name","output_value":"name"}],"formatZH":"操作运行环境 [name]","formatEN":"Operate runtime [name]"}
 func (b *BaseApi) OperateRuntime(c *gin.Context) {
 	var req request.RuntimeOperate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {

agent/app/api/v2/ssh.go

@@ -83,6 +83,7 @@ func (b *BaseApi) CreateRootCert(c *gin.Context) {
 	}
 	if err := loadCertAfterDecrypt(&req); err != nil {
 		helper.BadRequest(c, err)
+		return
 	}
 	if err := sshService.CreateRootCert(req); err != nil {
 		helper.InternalServer(c, err)
@@ -107,6 +108,7 @@ func (b *BaseApi) EditRootCert(c *gin.Context) {
 	}
 	if err := loadCertAfterDecrypt(&req); err != nil {
 		helper.BadRequest(c, err)
+		return
 	}
 	if err := sshService.EditRootCert(req); err != nil {
 		helper.InternalServer(c, err)

agent/app/api/v2/terminal.go

@@ -1,11 +1,14 @@
 package v2
 
 import (
+	"crypto/sha256"
 	"encoding/base64"
+	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"net/http"
 	"strconv"
+	"strings"
 	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
@@ -19,29 +22,35 @@ import (
 	"github.com/gin-gonic/gin"
 	"github.com/gorilla/websocket"
 	"github.com/pkg/errors"
+	gossh "golang.org/x/crypto/ssh"
 )
 
 // @Tags Terminal
 // @Summary Ws local terminal
 // @Param command query string false "command"
+// @Param session query string false "session id to reattach"
+// @Param terminalPersistent query boolean false "allow recovery after an unexpected disconnect"
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /hosts/terminal/local [get]
 func (b *BaseApi) WsLocalTerminal(c *gin.Context) {
-	b.runSSHSession(c, loadLocalConn, c.DefaultQuery("command", ""))
+	b.runSSHSession(c, "local", loadLocalConn, c.DefaultQuery("command", ""))
 }
 
 // @Tags Terminal
 // @Summary Ws host SSH
 // @Param id query integer false "id"
 // @Param command query string false "command"
+// @Param session query string false "session id to reattach"
+// @Param title query string false "session title shown in the session list"
+// @Param terminalPersistent query boolean false "allow recovery after an unexpected disconnect"
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /hosts/terminal/ssh [get]
 func (b *BaseApi) WsHostSSH(c *gin.Context) {
-	b.runSSHSession(c, func() (*ssh.SSHClient, error) {
+	b.runSSHSession(c, "ssh", func() (*ssh.SSHClient, error) {
 		hostID, _ := strconv.Atoi(c.DefaultQuery("id", "0"))
 		if hostID <= 0 {
 			return nil, errors.New("missing host id")
@@ -65,26 +74,33 @@ func (b *BaseApi) WsContainerTerminal(c *gin.Context) {
 		return
 	}
 	defer wsConn.Close()
-
-	slave, err := loadContainerTerminalCommand(c)
-	if wshandleError(wsConn, err) {
-		return
-	}
-	defer slave.Close()
-
-	tty, err := terminal.NewLocalWsSession(cols, rows, wsConn, slave, false)
-	if wshandleError(wsConn, err) {
+	identity, ok := loadTerminalIdentity(c)
+	if !ok {
+		_ = wshandleError(wsConn, errors.New("missing terminal identity"))
 		return
 	}
 
-	quitChan := make(chan bool, 3)
-	tty.Start(quitChan)
-	go slave.Wait(quitChan)
+	opts := terminal.SessionOptions{
+		Identity: identity,
+		Kind:     "container",
+		Target:   containerTerminalTarget(c),
+		Cols:     cols,
+		Rows:     rows,
+	}
+	if err := terminal.ServeCommand(wsConn, strings.TrimSpace(c.Query("session")), opts, func() (*terminal.LocalCommand, error) {
+		return loadContainerTerminalCommand(c)
+	}); err != nil {
+		_ = wshandleError(wsConn, err)
+	}
+}
 
-	<-quitChan
-
-	global.LOG.Info("websocket finished")
-	closeTerminalConn(wsConn)
+func containerTerminalTarget(c *gin.Context) string {
+	query := c.Request.URL.Query()
+	for _, key := range []string{"cols", "rows", "session", "terminalRevalidate"} {
+		query.Del(key)
+	}
+	sum := sha256.Sum256([]byte(query.Encode()))
+	return hex.EncodeToString(sum[:])
 }
 
 func prepareTerminalSession(c *gin.Context) (*websocket.Conn, int, int, bool) {
@@ -115,32 +131,138 @@ func prepareTerminalSession(c *gin.Context) (*websocket.Conn, int, int, bool) {
 	return wsConn, cols, rows, true
 }
 
-func (b *BaseApi) runSSHSession(c *gin.Context, connect func() (*ssh.SSHClient, error), command string) {
+func (b *BaseApi) runSSHSession(c *gin.Context, kind string, connect func() (*ssh.SSHClient, error), command string) {
 	wsConn, cols, rows, ok := prepareTerminalSession(c)
 	if !ok {
 		return
 	}
 	defer wsConn.Close()
-
-	client, clientErr := connect()
-	if wshandleError(wsConn, errors.WithMessage(clientErr, "failed to set up the connection. Please check the host information")) {
+	identity, ok := loadTerminalIdentity(c)
+	if !ok {
+		_ = wshandleError(wsConn, errors.New("missing terminal identity"))
 		return
 	}
-	defer client.Close()
 
-	sws, err := terminal.NewLogicSshWsSession(cols, rows, client.Client, wsConn, command)
-	if wshandleError(wsConn, err) {
+	hostID := 0
+	if kind == "ssh" {
+		hostID, _ = strconv.Atoi(c.DefaultQuery("id", "0"))
+	}
+	opts := terminal.SessionOptions{
+		Identity:   identity,
+		Kind:       kind,
+		Title:      sanitizeTerminalTitle(c.Query("title")),
+		Persistent: c.Query("terminalPersistent") == "true",
+		HostID:     uint(max(hostID, 0)),
+		Cols:       cols,
+		Rows:       rows,
+		InitCmd:    command,
+	}
+	err := terminal.Serve(wsConn, strings.TrimSpace(c.Query("session")), opts, func() (*gossh.Client, error) {
+		client, err := connect()
+		if err != nil {
+			return nil, errors.WithMessage(err, "failed to set up the connection. Please check the host information")
+		}
+		return client.Client, nil
+	})
+	if err != nil {
+		_ = wshandleError(wsConn, err)
+	}
+}
+
+// @Tags Terminal
+// @Summary List the caller's live terminal sessions
+// @Success 200 {array} terminal.Info
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/terminal/sessions/search [post]
+func (b *BaseApi) SearchTerminalSessions(c *gin.Context) {
+	identity, ok := loadTerminalIdentity(c)
+	if !ok {
+		helper.BadRequest(c, errors.New("missing terminal identity"))
 		return
 	}
-	defer sws.Close()
+	helper.SuccessWithData(c, terminal.List(identity))
+}
 
-	quitChan := make(chan bool, 3)
-	sws.Start(quitChan)
-	go sws.Wait(quitChan)
+// @Tags Terminal
+// @Summary Close a terminal session
+// @Accept json
+// @Param request body dto.TerminalSessionClose true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/terminal/sessions/close [post]
+func (b *BaseApi) CloseTerminalSession(c *gin.Context) {
+	var req dto.TerminalSessionClose
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	identity, ok := loadTerminalIdentity(c)
+	if !ok {
+		helper.BadRequest(c, errors.New("missing terminal identity"))
+		return
+	}
+	if err := terminal.CloseSession(req.ID, identity); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
 
-	<-quitChan
+// @Tags Terminal
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/terminal/sessions/closeAll [post]
+func (b *BaseApi) CloseAllTerminalSessions(c *gin.Context) {
+	identity, ok := loadTerminalIdentity(c)
+	if !ok {
+		helper.BadRequest(c, errors.New("missing terminal identity"))
+		return
+	}
+	terminal.Revoke("auth_session", identity.UserID, identity.AuthSessionID)
+	helper.Success(c)
+}
 
-	closeTerminalConn(wsConn)
+func (b *BaseApi) RevokeTerminalSessions(c *gin.Context) {
+	var req dto.TerminalSessionRevoke
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if (req.Scope == "auth_session" && (req.UserID == "" || req.AuthSessionID == "")) ||
+		(req.Scope == "user" && req.UserID == "") {
+		helper.BadRequest(c, errors.New("missing terminal revocation identity"))
+		return
+	}
+	terminal.Revoke(req.Scope, req.UserID, req.AuthSessionID)
+	helper.Success(c)
+}
+
+func loadTerminalIdentity(c *gin.Context) (terminal.Identity, bool) {
+	identity := terminal.Identity{
+		UserID:        strings.TrimSpace(c.GetHeader(terminal.HeaderUserID)),
+		AuthSessionID: strings.TrimSpace(c.GetHeader(terminal.HeaderAuthSessionID)),
+	}
+	if value := c.GetHeader(terminal.HeaderAuthLeaseUntil); value != "" {
+		millis, err := strconv.ParseInt(value, 10, 64)
+		if err != nil || millis <= 0 {
+			return terminal.Identity{}, false
+		}
+		identity.AuthLeaseUntil = time.UnixMilli(millis)
+		if maximum := time.Now().Add(90 * time.Second); identity.AuthLeaseUntil.After(maximum) {
+			identity.AuthLeaseUntil = maximum
+		}
+	}
+	return identity, identity.Valid()
+}
+
+// sanitizeTerminalTitle keeps the title a short single line.
+func sanitizeTerminalTitle(title string) string {
+	title = strings.Join(strings.Fields(title), " ")
+	if r := []rune(title); len(r) > 64 {
+		title = string(r[:64])
+	}
+	return title
 }
 
 func closeTerminalConn(wsConn *websocket.Conn) {

agent/app/api/v2/terminal_capabilities.go

@@ -0,0 +1,10 @@
+package v2
+
+import (
+	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
+	"github.com/gin-gonic/gin"
+)
+
+func (b *BaseApi) TerminalCapabilities(c *gin.Context) {
+	helper.SuccessWithData(c, gin.H{"apiKeyLeaseVersion": 1})
+}

agent/app/api/v2/website.go

@@ -402,7 +402,7 @@ func (b *BaseApi) ChangeDefaultServer(c *gin.Context) {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /websites/php/version [post]
-// @x-panel-log {"bodyKeys":["websiteId"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"websiteId","isList":false,"db":"websites","output_column":"primary_domain","output_value":"domain"}],"formatZH":"php 版本变更 [domain]","formatEN":"php version update [domain]"}
+// @x-panel-log {"bodyKeys":["websiteID"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"websiteID","isList":false,"db":"websites","output_column":"primary_domain","output_value":"domain"}],"formatZH":"php 版本变更 [domain]","formatEN":"php version update [domain]"}
 func (b *BaseApi) ChangePHPVersion(c *gin.Context) {
 	var req request.WebsitePHPVersionReq
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {

agent/app/api/v2/website_ca.go

@@ -1,13 +1,16 @@
 package v2
 
 import (
+	"io"
 	"net/http"
 	"net/url"
 	"strconv"
+	"strings"
 
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
 	"github.com/gin-gonic/gin"
 )
 
@@ -176,3 +179,64 @@ func (b *BaseApi) DownloadCAFile(c *gin.Context) {
 	c.Header("Content-Disposition", "attachment; filename*=utf-8''"+url.PathEscape(info.Name()))
 	http.ServeContent(c.Writer, c.Request, info.Name(), info.ModTime(), file)
 }
+
+// @Tags Website CA
+// @Summary Upload website CA archive
+// @Accept multipart/form-data
+// @Param file formData file true "ZIP containing ca.crt and ca.key"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/ca/upload [post]
+func (b *BaseApi) UploadWebsiteCA(c *gin.Context) {
+	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, 11<<20)
+	if err := c.Request.ParseMultipartForm(11 << 20); err != nil {
+		helper.InternalServer(c, buserr.New("ErrCAUpload"))
+		return
+	}
+	if c.Request.MultipartForm != nil {
+		defer c.Request.MultipartForm.RemoveAll()
+	}
+	file, err := c.FormFile("file")
+	if err != nil || file.Size > 10<<20 || !strings.HasSuffix(strings.ToLower(file.Filename), ".zip") {
+		helper.InternalServer(c, buserr.New("ErrCAUpload"))
+		return
+	}
+	stream, err := file.Open()
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	defer stream.Close()
+	data, err := io.ReadAll(io.LimitReader(stream, (10<<20)+1))
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	if err = websiteCAService.Upload(file.Filename[:len(file.Filename)-len(".zip")], data); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Website CA
+// @Summary Import website CA from PEM or server files
+// @Accept json
+// @Param request body request.WebsiteCAImport true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/ca/import [post]
+func (b *BaseApi) ImportWebsiteCA(c *gin.Context) {
+	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, 3<<20)
+	var req request.WebsiteCAImport
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := websiteCAService.Import(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}

agent/app/dto/agents.go

@@ -9,7 +9,8 @@ type AgentCreateReq struct {
 	WebUIPort         int      `json:"webUIPort" validate:"required,min=1,max=65535"`
 	BridgePort        int      `json:"bridgePort"`
 	AllowedOrigins    []string `json:"allowedOrigins"`
-	AgentType         string   `json:"agentType" validate:"required,oneof=openclaw copaw hermes-agent"`
+	AgentType         string   `json:"agentType" validate:"required,oneof=openclaw copaw hermes-agent deepseek-harness octop"`
+	AccessHost        string   `json:"accessHost"`
 	Model             string   `json:"model"`
 	AccountID         uint     `json:"accountId"`
 	Token             string   `json:"token"`
@@ -110,6 +111,7 @@ type AgentBatchOperateResult struct {
 }
 
 type AgentItem struct {
+	AccessHost           string    `json:"accessHost"`
 	ID                   uint      `json:"id"`
 	Name                 string    `json:"name"`
 	Remark               string    `json:"remark"`
@@ -162,16 +164,25 @@ type AgentWebsiteBindReq struct {
 }
 
 type AgentModelConfigUpdateReq struct {
-	AgentID   uint     `json:"agentId" validate:"required"`
-	AccountID uint     `json:"accountId" validate:"required"`
-	Model     string   `json:"model" validate:"required"`
-	Fallbacks []string `json:"fallbacks"`
+	AgentID   uint                 `json:"agentId" validate:"required"`
+	AccountID uint                 `json:"accountId" validate:"required"`
+	Model     string               `json:"model" validate:"required"`
+	Fallbacks []string             `json:"fallbacks"`
+	Metadata  []AgentModelMetadata `json:"metadata" validate:"dive"`
 }
 
 type AgentModelConfig struct {
-	AccountID uint     `json:"accountId"`
-	Model     string   `json:"model"`
-	Fallbacks []string `json:"fallbacks"`
+	AccountID uint                 `json:"accountId"`
+	Model     string               `json:"model"`
+	Fallbacks []string             `json:"fallbacks"`
+	Metadata  []AgentModelMetadata `json:"metadata"`
+}
+
+type AgentModelMetadata struct {
+	Model         string `json:"model" validate:"required"`
+	InputMode     string `json:"inputMode" validate:"required,oneof=auto text image"`
+	ContextWindow int    `json:"contextWindow" validate:"min=0"`
+	MaxTokens     int    `json:"maxTokens" validate:"min=0"`
 }
 
 type AgentHermesChatSessionItem struct {
@@ -375,6 +386,7 @@ type AgentAccountProviderCountReq struct {
 }
 
 type AgentAccountInfo struct {
+	AppInstallID    uint                `json:"appInstallId"`
 	ID              uint                `json:"id"`
 	MasterAccountID uint                `json:"masterAccountId"`
 	Provider        string              `json:"provider"`
@@ -421,32 +433,53 @@ type AgentFeishuConfigReq struct {
 	AgentID uint `json:"agentId" validate:"required"`
 }
 
+type AgentFeishuTransition struct {
+	Confirmed         bool   `json:"confirmed"`
+	Streaming         bool   `json:"streaming"`
+	GroupSessionScope string `json:"groupSessionScope"`
+	RequireMention    string `json:"requireMention"`
+}
+
+type AgentFeishuSwitchReq struct {
+	AgentID           uint   `json:"agentId" validate:"required"`
+	TaskID            string `json:"taskID" validate:"required"`
+	Streaming         bool   `json:"streaming"`
+	GroupSessionScope string `json:"groupSessionScope" validate:"required,oneof=group group_sender group_topic group_topic_sender"`
+	RequireMention    string `json:"requireMention" validate:"required,oneof=true false"`
+}
+
 type AgentFeishuConfigUpdateReq struct {
-	AgentID        uint             `json:"agentId" validate:"required"`
-	Enabled        bool             `json:"enabled"`
-	ThreadSession  bool             `json:"threadSession"`
-	ReplyMode      string           `json:"replyMode" validate:"required"`
-	Streaming      bool             `json:"streaming"`
-	RequireMention string           `json:"requireMention" validate:"required,oneof=true false open"`
-	GroupPolicy    string           `json:"groupPolicy" validate:"required,oneof=open allowlist disabled"`
-	GroupAllowFrom []string         `json:"groupAllowFrom"`
-	Domain         string           `json:"domain"`
-	ConnectionMode string           `json:"connectionMode"`
-	Bots           []AgentFeishuBot `json:"bots" validate:"required,min=1"`
+	GroupSessionScope string           `json:"groupSessionScope" validate:"omitempty,oneof=group group_sender group_topic group_topic_sender"`
+	AgentID           uint             `json:"agentId" validate:"required"`
+	Enabled           bool             `json:"enabled"`
+	ThreadSession     bool             `json:"threadSession"`
+	ReplyMode         string           `json:"replyMode" validate:"required"`
+	Streaming         bool             `json:"streaming"`
+	RequireMention    string           `json:"requireMention" validate:"required,oneof=true false open"`
+	GroupPolicy       string           `json:"groupPolicy" validate:"required,oneof=open allowlist disabled"`
+	GroupAllowFrom    []string         `json:"groupAllowFrom"`
+	Domain            string           `json:"domain"`
+	ConnectionMode    string           `json:"connectionMode"`
+	Bots              []AgentFeishuBot `json:"bots" validate:"required,min=1"`
 }
 
 type AgentFeishuConfig struct {
-	Enabled        bool             `json:"enabled"`
-	ThreadSession  bool             `json:"threadSession"`
-	ReplyMode      string           `json:"replyMode"`
-	Streaming      bool             `json:"streaming"`
-	RequireMention string           `json:"requireMention"`
-	GroupPolicy    string           `json:"groupPolicy"`
-	GroupAllowFrom []string         `json:"groupAllowFrom"`
-	Domain         string           `json:"domain"`
-	ConnectionMode string           `json:"connectionMode"`
-	Bots           []AgentFeishuBot `json:"bots"`
-	Installed      bool             `json:"installed"`
+	BuiltinManaged    bool             `json:"builtinManaged"`
+	LegacyConfigured  bool             `json:"legacyConfigured"`
+	GroupSessionScope string           `json:"groupSessionScope"`
+	BuiltinAvailable  bool             `json:"builtinAvailable"`
+	Legacy            bool             `json:"legacy"`
+	Enabled           bool             `json:"enabled"`
+	ThreadSession     bool             `json:"threadSession"`
+	ReplyMode         string           `json:"replyMode"`
+	Streaming         bool             `json:"streaming"`
+	RequireMention    string           `json:"requireMention"`
+	GroupPolicy       string           `json:"groupPolicy"`
+	GroupAllowFrom    []string         `json:"groupAllowFrom"`
+	Domain            string           `json:"domain"`
+	ConnectionMode    string           `json:"connectionMode"`
+	Bots              []AgentFeishuBot `json:"bots"`
+	Installed         bool             `json:"installed"`
 }
 
 type AgentTelegramConfigReq struct {

agent/app/dto/ai.go

@@ -14,16 +14,17 @@ type OllamaModelInfo struct {
 	CreatedAt time.Time `json:"createdAt"`
 }
 
-type OllamaModelDropList struct {
-	ID   uint   `json:"id"`
-	Name string `json:"name"`
-}
-
 type OllamaModelName struct {
 	Name   string `json:"name"`
 	TaskID string `json:"taskID"`
 }
 
+type OllamaModelAccountSync struct {
+	ID                      uint   `json:"id" validate:"required"`
+	ModelAccountBaseURLType string `json:"modelAccountBaseURLType" validate:"required,oneof=container localhost systemIP custom"`
+	ModelAccountBaseURL     string `json:"modelAccountBaseURL"`
+}
+
 type OllamaBindDomain struct {
 	Domain       string `json:"domain" validate:"required"`
 	AppInstallID uint   `json:"appInstallID" validate:"required"`

agent/app/dto/ai_benchmark.go

@@ -0,0 +1,13 @@
+package dto
+
+type AIBenchmarkSource struct {
+	ID        string   `json:"id"`
+	Kind      string   `json:"kind"`
+	Name      string   `json:"name"`
+	Status    string   `json:"status"`
+	BaseURL   string   `json:"baseUrl"`
+	Endpoint  string   `json:"endpoint"`
+	Models    []string `json:"models"`
+	Tokenizer string   `json:"tokenizer"`
+	Message   string   `json:"message"`
+}

agent/app/dto/alert.go

@@ -21,6 +21,7 @@ type AlertBase struct {
 }
 
 type PushAlert struct {
+	Result    string `json:"result,omitempty"`
 	TaskName  string `json:"taskName"`
 	AlertType string `json:"alertType"`
 	EntryID   uint   `json:"entryID"`
@@ -53,6 +54,7 @@ type AlertDTO struct {
 	Method         string    `json:"method"`
 	Title          string    `json:"title"`
 	Project        string    `json:"project"`
+	TaskName       string    `json:"taskName,omitempty"`
 	Status         string    `json:"status"`
 	SendCount      uint      `json:"sendCount"`
 	AdvancedParams string    `json:"advancedParams"`
@@ -151,16 +153,25 @@ type AlertLog struct {
 }
 
 type AlertDetail struct {
-	LicenseId   string  `json:"licenseId"`
-	Type        string  `json:"type"`
-	SubType     string  `json:"subType"`
-	Title       string  `json:"title"`
-	Method      string  `json:"method"`
-	LicenseCode string  `json:"licenseCode"`
-	DeviceId    string  `json:"deviceId"`
-	Project     string  `json:"project"`
-	Params      []Param `json:"params"`
-	Phone       string  `json:"phone"`
+	LicenseId   string             `json:"licenseId"`
+	Type        string             `json:"type"`
+	SubType     string             `json:"subType"`
+	Title       string             `json:"title"`
+	Method      string             `json:"method"`
+	LicenseCode string             `json:"licenseCode"`
+	DeviceId    string             `json:"deviceId"`
+	Project     string             `json:"project"`
+	Params      []Param            `json:"params"`
+	Phone       string             `json:"phone"`
+	Task        *AlertTaskMetadata `json:"task,omitempty"`
+}
+
+type AlertTaskMetadata struct {
+	AlertID   uint   `json:"alertId"`
+	Type      string `json:"type"`
+	Quota     string `json:"quota"`
+	QuotaType string `json:"quotaType"`
+	Method    string `json:"method"`
 }
 
 type AlertRule struct {
@@ -295,15 +306,19 @@ type OfflineQueryRequest struct {
 }
 
 type AlertConfigUpdate struct {
-	ID          uint   `json:"id"`
-	Type        string `json:"type"`
-	Title       string `json:"title"`
-	Status      string `json:"status"`
-	Config      string `json:"config"`
-	DisplayName string `json:"displayName"`
+	ID          uint       `json:"id"`
+	Type        string     `json:"type"`
+	Title       string     `json:"title"`
+	Status      string     `json:"status"`
+	Config      string     `json:"config"`
+	DisplayName string     `json:"displayName"`
+	Revision    *time.Time `json:"revision"`
 }
 
 type AlertConfigTest struct {
+	ID          uint   `json:"id"`
+	Type        string `json:"type"`
+	Config      string `json:"config"`
 	Host        string `json:"host"`
 	Port        int    `json:"port"`
 	Sender      string `json:"sender"`

agent/app/dto/alert_webhook.go

@@ -0,0 +1,80 @@
+package dto
+
+const AlertCustomWebhookSchemaVersion = 1
+
+type AlertConfigStatusUpdate struct {
+	ID     uint   `json:"id" validate:"required"`
+	Status string `json:"status" validate:"required,oneof=Enable Disable"`
+}
+
+type AlertCustomWebhookSecretMutation struct {
+	Action string `json:"action,omitempty"`
+	Value  string `json:"value,omitempty"`
+}
+
+type AlertCustomWebhookURL struct {
+	AlertCustomWebhookSecretMutation
+	Configured bool   `json:"configured"`
+	Masked     string `json:"masked,omitempty"`
+}
+
+type AlertCustomWebhookBody struct {
+	Type     string                        `json:"type"`
+	Template string                        `json:"template,omitempty"`
+	Fields   []AlertCustomWebhookFormField `json:"fields,omitempty"`
+}
+
+type AlertCustomWebhookFormField struct {
+	Key   string `json:"key"`
+	Value string `json:"value"`
+}
+
+type AlertCustomWebhookHeader struct {
+	UID        string `json:"uid"`
+	Key        string `json:"key"`
+	Secret     bool   `json:"secret"`
+	Action     string `json:"action,omitempty"`
+	Value      string `json:"value,omitempty"`
+	Configured bool   `json:"configured,omitempty"`
+	Masked     string `json:"masked,omitempty"`
+}
+
+type AlertCustomWebhookConfig struct {
+	SchemaVersion int                        `json:"schemaVersion"`
+	State         string                     `json:"state,omitempty"`
+	DisplayName   string                     `json:"displayName"`
+	Preset        string                     `json:"preset"`
+	Method        string                     `json:"method"`
+	URL           AlertCustomWebhookURL      `json:"url"`
+	Body          AlertCustomWebhookBody     `json:"body"`
+	Headers       []AlertCustomWebhookHeader `json:"headers"`
+}
+
+type AlertCustomWebhookSecretConfig struct {
+	SchemaVersion int               `json:"schemaVersion"`
+	URL           string            `json:"url"`
+	Headers       map[string]string `json:"headers,omitempty"`
+}
+
+type AlertCustomWebhookResolvedConfig struct {
+	SchemaVersion int
+	DisplayName   string
+	Preset        string
+	Method        string
+	URL           string
+	Body          AlertCustomWebhookBody
+	Headers       []AlertCustomWebhookResolvedHeader
+}
+
+type AlertCustomWebhookResolvedHeader struct {
+	Key   string
+	Value string
+}
+
+type AlertConfigTestResult struct {
+	Success    bool   `json:"success"`
+	StatusCode int    `json:"statusCode,omitempty"`
+	Duration   int64  `json:"duration,omitempty"` // milliseconds
+	Message    string `json:"message,omitempty"`
+	Response   string `json:"response,omitempty"`
+}

agent/app/dto/app.go

@@ -43,9 +43,11 @@ type AppOssConfig struct {
 }
 
 type AppVersion struct {
-	Version       string `json:"version"`
-	DetailId      uint   `json:"detailId"`
-	DockerCompose string `json:"dockerCompose"`
+	FeishuLegacy     bool   `json:"feishuLegacy,omitempty"`
+	FeishuConfigured bool   `json:"feishuConfigured,omitempty"`
+	Version          string `json:"version"`
+	DetailId         uint   `json:"detailId"`
+	DockerCompose    string `json:"dockerCompose"`
 }
 
 type AppList struct {

agent/app/dto/common_res.go

@@ -6,9 +6,10 @@ type PageResult struct {
 }
 
 type Response struct {
-	Code    int         `json:"code"`
-	Message string      `json:"message"`
-	Data    interface{} `json:"data"`
+	Code      int         `json:"code"`
+	ErrorCode string      `json:"errorCode,omitempty"`
+	Message   string      `json:"message"`
+	Data      interface{} `json:"data"`
 }
 
 type Options struct {

agent/app/dto/container.go

@@ -21,13 +21,16 @@ type InspectReq struct {
 }
 
 type ContainerInfo struct {
-	ContainerID string `json:"containerID"`
-	Name        string `json:"name"`
-	ImageId     string `json:"imageID"`
-	ImageName   string `json:"imageName"`
-	CreateTime  string `json:"createTime"`
-	State       string `json:"state"`
-	RunTime     string `json:"runTime"`
+	LatestVersion string `json:"latestVersion"`
+	TargetImage   string `json:"targetImage"`
+	HasUpdate     bool   `json:"hasUpdate"`
+	ContainerID   string `json:"containerID"`
+	Name          string `json:"name"`
+	ImageId       string `json:"imageID"`
+	ImageName     string `json:"imageName"`
+	CreateTime    string `json:"createTime"`
+	State         string `json:"state"`
+	RunTime       string `json:"runTime"`
 
 	Network []string `json:"network"`
 	Ports   []string `json:"ports"`
@@ -171,7 +174,8 @@ type ContainerItemStats struct {
 	BuildCacheReclaimable int64 `json:"buildCacheReclaimable"`
 }
 type ContainerListStats struct {
-	ContainerID string `json:"containerID"`
+	ContainerID   string `json:"containerID"`
+	ContainerName string `json:"containerName"`
 
 	CPUTotalUsage uint64  `json:"cpuTotalUsage"`
 	SystemUsage   uint64  `json:"systemUsage"`

agent/app/dto/cronjob.go

@@ -51,9 +51,10 @@ type CronjobOperate struct {
 	Secret            string `json:"secret"`
 	Args              string `json:"args"`
 
-	AlertCount  uint   `json:"alertCount"`
-	AlertTitle  string `json:"alertTitle"`
-	AlertMethod string `json:"alertMethod"`
+	AlertCount       uint   `json:"alertCount"`
+	AlertTitle       string `json:"alertTitle"`
+	AlertMethod      string `json:"alertMethod"`
+	AlertTriggerMode string `json:"alertTriggerMode" validate:"omitempty,oneof=failed success both"`
 
 	CleanLogConfig
 }
@@ -126,7 +127,8 @@ type CronjobInfo struct {
 	Secret           string `json:"secret"`
 	Args             string `json:"args"`
 
-	AlertCount uint `json:"alertCount"`
+	AlertCount       uint   `json:"alertCount"`
+	AlertTriggerMode string `json:"alertTriggerMode"`
 }
 
 type CronjobImport struct {
@@ -169,9 +171,10 @@ type CronjobTrans struct {
 	SourceAccounts  []string `json:"sourceAccounts"`
 	DownloadAccount string   `json:"downloadAccount"`
 
-	AlertCount  uint   `json:"alertCount"`
-	AlertTitle  string `json:"alertTitle"`
-	AlertMethod string `json:"alertMethod"`
+	AlertCount       uint   `json:"alertCount"`
+	AlertTitle       string `json:"alertTitle"`
+	AlertMethod      string `json:"alertMethod"`
+	AlertTriggerMode string `json:"alertTriggerMode" validate:"omitempty,oneof=failed success both"`
 }
 type TransHelper struct {
 	Name       string `json:"name"`

agent/app/dto/dashboard.go

@@ -31,7 +31,27 @@ type DashboardBase struct {
 }
 
 type ChangeQuicks struct {
-	Quicks []QuickJump `json:"quicks"`
+	Quicks []QuickVisibility `json:"quicks" validate:"required,dive"`
+}
+
+type QuickVisibility struct {
+	ID     uint `json:"id" validate:"required"`
+	IsShow bool `json:"isShow"`
+}
+
+type QuickDirectoryCreate struct {
+	Path  string `json:"path" validate:"required"`
+	Alias string `json:"alias"`
+}
+
+type QuickDirectoryDelete struct {
+	ID     uint `json:"id" validate:"required"`
+	Legacy bool `json:"legacy"`
+}
+
+type QuickDirectoryUpdate struct {
+	QuickDirectoryDelete
+	QuickDirectoryCreate
 }
 
 type QuickJump struct {
@@ -121,6 +141,7 @@ type DashboardCurrent struct {
 	NetBytesRecv uint64 `json:"netBytesRecv"`
 
 	GPUData []GPUInfo `json:"gpuData"`
+	NPUData []NPUInfo `json:"npuData"`
 	XPUData []XPUInfo `json:"xpuData"`
 
 	TopCPUItems []Process `json:"topCPUItems"`
@@ -156,8 +177,12 @@ type DiskInfo struct {
 }
 
 type GPUInfo struct {
+	Type             string `json:"type"`
 	Index            uint   `json:"index"`
+	NPUIndex         uint   `json:"npuIndex"`
+	ChipIndex        uint   `json:"chipIndex"`
 	ProductName      string `json:"productName"`
+	BusID            string `json:"busID"`
 	GPUUtil          string `json:"gpuUtil"`
 	Temperature      string `json:"temperature"`
 	PerformanceState string `json:"performanceState"`
@@ -170,6 +195,27 @@ type GPUInfo struct {
 	FanSpeed         string `json:"fanSpeed"`
 }
 
+type NPUInfo struct {
+	Type           string `json:"type"`
+	Index          uint   `json:"index"`
+	NPUIndex       uint   `json:"npuIndex"`
+	ChipIndex      uint   `json:"chipIndex"`
+	ProductName    string `json:"productName"`
+	BusID          string `json:"busID"`
+	Health         string `json:"health"`
+	Temperature    string `json:"temperature"`
+	PowerDraw      string `json:"powerDraw"`
+	AICore         string `json:"aiCore"`
+	MemUsed        string `json:"memUsed"`
+	MemTotal       string `json:"memTotal"`
+	MemoryUsed     string `json:"memoryUsed"`
+	MemoryTotal    string `json:"memoryTotal"`
+	HBMUsed        string `json:"hbmUsed"`
+	HBMTotal       string `json:"hbmTotal"`
+	HugepagesUsed  string `json:"hugepagesUsed"`
+	HugepagesTotal string `json:"hugepagesTotal"`
+}
+
 type AppLauncher struct {
 	Key         string `json:"key"`
 	Type        string `json:"type"`
@@ -202,11 +248,13 @@ type LauncherOption struct {
 }
 
 type XPUInfo struct {
-	DeviceID    int    `json:"deviceID"`
-	DeviceName  string `json:"deviceName"`
-	Memory      string `json:"memory"`
-	Temperature string `json:"temperature"`
-	MemoryUsed  string `json:"memoryUsed"`
-	Power       string `json:"power"`
-	MemoryUtil  string `json:"memoryUtil"`
+	DeviceID      int    `json:"deviceID"`
+	DeviceName    string `json:"deviceName"`
+	PciBdfAddress string `json:"pciBdfAddress"`
+	Memory        string `json:"memory"`
+	Temperature   string `json:"temperature"`
+	GPUUtil       string `json:"gpuUtil"`
+	MemoryUsed    string `json:"memoryUsed"`
+	Power         string `json:"power"`
+	MemoryUtil    string `json:"memoryUtil"`
 }

agent/app/dto/database.go

@@ -22,6 +22,10 @@ type DBBaseInfo struct {
 	Port          int64  `json:"port"`
 }
 
+type RedisCliInstall struct {
+	TaskID string `json:"taskID" validate:"omitempty,uuid"`
+}
+
 // mysql
 type MysqlDBSearch struct {
 	PageInfo

agent/app/dto/firewall.go

@@ -1,100 +1,354 @@
 package dto
 
-type FirewallBaseInfo struct {
-	Name       string `json:"name"`
-	IsExist    bool   `json:"isExist"`
-	IsActive   bool   `json:"isActive"`
-	IsInit     bool   `json:"isInit"`
-	IsBind     bool   `json:"isBind"`
-	Version    string `json:"version"`
-	PingStatus string `json:"pingStatus"`
+import (
+	"github.com/1Panel-dev/1Panel/agent/utils/firewall"
+	dockerfirewall "github.com/1Panel-dev/1Panel/agent/utils/firewall/docker_guard"
+	"github.com/1Panel-dev/1Panel/agent/utils/firewall/filter"
+	"github.com/1Panel-dev/1Panel/agent/utils/firewall/forwarding"
+)
+
+type FirewallSubsystemStatus struct {
+	IPv6Enabled     bool                        `json:"ipv6Enabled"`
+	Name            string                      `json:"name"`
+	Backend         string                      `json:"backend"`
+	ConflictBackend string                      `json:"conflictBackend,omitempty"`
+	IsExist         bool                        `json:"isExist"`
+	IsActive        bool                        `json:"isActive"`
+	IsInit          bool                        `json:"isInit"`
+	IsBind          bool                        `json:"isBind"`
+	Version         string                      `json:"version"`
+	PingStatus      string                      `json:"pingStatus"`
+	Message         string                      `json:"message,omitempty"`
+	Reason          string                      `json:"reason,omitempty"`
+	LifecycleTaskID string                      `json:"lifecycleTaskID,omitempty"`
+	IPv4            FirewallBackendFamilyStatus `json:"ipv4"`
+	IPv6            FirewallBackendFamilyStatus `json:"ipv6"`
 }
 
-type RuleSearch struct {
-	PageInfo
-	Info     string `json:"info"`
-	Status   string `json:"status"`
-	Strategy string `json:"strategy"`
-	Type     string `json:"type" validate:"required"`
-}
-
-type FirewallOperation struct {
+type FirewallLifecycleOperation struct {
+	BackupFile        string `json:"backupFile,omitempty" validate:"omitempty,max=255"`
 	Operation         string `json:"operation" validate:"required,oneof=start stop restart disableBanPing enableBanPing"`
 	WithDockerRestart bool   `json:"withDockerRestart"`
 }
 
-type PortRuleOperate struct {
-	ID        uint   `json:"id"`
-	Operation string `json:"operation" validate:"required,oneof=add remove"`
-	Chain     string `json:"chain"`
-	Address   string `json:"address"`
-	Port      string `json:"port" validate:"required"`
-	Protocol  string `json:"protocol" validate:"required,oneof=tcp udp tcp/udp"`
-	Strategy  string `json:"strategy" validate:"required,oneof=accept drop"`
-
-	Description string `json:"description"`
+type FirewallLifecycleOperationResponse struct {
+	TaskID string `json:"taskID,omitempty"`
+	Queued bool   `json:"queued"`
 }
 
-type UpdateFirewallDescription struct {
-	Type     string `json:"type"`
-	Chain    string `json:"chain"`
-	SrcIP    string `json:"srcIP"`
-	DstIP    string `json:"dstIP"`
-	SrcPort  string `json:"srcPort"`
-	DstPort  string `json:"dstPort"`
-	Protocol string `json:"protocol"`
-	Strategy string `json:"strategy" validate:"required,oneof=accept drop"`
-
-	Description string `json:"description"`
+type FirewallBackendOption struct {
+	Name           string                      `json:"name"`
+	Installed      bool                        `json:"installed"`
+	Active         bool                        `json:"active"`
+	Initialized    bool                        `json:"initialized"`
+	Bound          bool                        `json:"bound"`
+	Supported      bool                        `json:"supported"`
+	SupportReason  string                      `json:"supportReason,omitempty"`
+	Implementation string                      `json:"implementation,omitempty"`
+	Message        string                      `json:"message,omitempty"`
+	IPv4           FirewallBackendFamilyStatus `json:"ipv4"`
+	IPv6           FirewallBackendFamilyStatus `json:"ipv6"`
 }
 
-type AddrRuleOperate struct {
-	ID        uint   `json:"id"`
-	Operation string `json:"operation" validate:"required,oneof=add remove"`
-	Address   string `json:"address"  validate:"required"`
-	Strategy  string `json:"strategy" validate:"required,oneof=accept drop"`
-
-	Description string `json:"description"`
+type FirewallBackendFamilyStatus struct {
+	Partial      bool     `json:"partial"`
+	Available    bool     `json:"available"`
+	Initialized  bool     `json:"initialized"`
+	Bound        bool     `json:"bound"`
+	Reason       string   `json:"reason,omitempty"`
+	RAInterfaces []string `json:"raInterfaces,omitempty"`
 }
 
-type PortRuleUpdate struct {
-	OldRule PortRuleOperate `json:"oldRule"`
-	NewRule PortRuleOperate `json:"newRule"`
+type FirewallBackendGroup struct {
+	Selected string                  `json:"selected"`
+	Current  string                  `json:"current,omitempty"`
+	Options  []FirewallBackendOption `json:"options"`
 }
 
-type AddrRuleUpdate struct {
-	OldRule AddrRuleOperate `json:"oldRule"`
-	NewRule AddrRuleOperate `json:"newRule"`
+type FirewallSettings struct {
+	IPv6Enabled   bool                   `json:"ipv6Enabled"`
+	System        FirewallBackendGroup   `json:"system"`
+	Forwarding    FirewallBackendGroup   `json:"forwarding"`
+	Docker        FirewallBackendGroup   `json:"docker"`
+	PingStatus    string                 `json:"pingStatus"`
+	PortWhitelist []filter.PortWhitelist `json:"portWhiteList"`
+	PanelPort     string                 `json:"panelPort"`
+	SSHPort       string                 `json:"sshPort"`
 }
 
-type BatchRuleOperate struct {
-	Type  string            `json:"type" validate:"required"`
-	Rules []PortRuleOperate `json:"rules"`
+type FirewallPortWhitelistCreate struct {
+	Rule filter.PortWhitelist `json:"rule" validate:"required"`
 }
 
-type IptablesOp struct {
-	Name    string `json:"name" validate:"required,oneof=1PANEL_INPUT 1PANEL_OUTPUT 1PANEL_BASIC 1PANEL_FORWARD"`
-	Operate string `json:"operate" validate:"required,oneof=init-base init-forward init-advance bind-base unbind-base bind unbind"`
+type FirewallPortWhitelistUpdate struct {
+	OldRule filter.PortWhitelist `json:"oldRule" validate:"required"`
+	Rule    filter.PortWhitelist `json:"rule" validate:"required"`
 }
 
-type IptablesRuleOp struct {
-	Operation   string `json:"operation" validate:"required,oneof=add remove"`
-	ID          uint   `json:"id"`
-	Chain       string `json:"chain" validate:"required,oneof=1PANEL_BASIC 1PANEL_BASIC_BEFORE 1PANEL_INPUT 1PANEL_OUTPUT"`
-	Protocol    string `json:"protocol"`
-	SrcIP       string `json:"srcIP"`
-	SrcPort     uint   `json:"srcPort"`
-	DstIP       string `json:"dstIP"`
-	DstPort     uint   `json:"dstPort"`
-	Strategy    string `json:"strategy" validate:"required,oneof=accept drop reject"`
-	Description string `json:"description"`
+type FirewallPortWhitelistDelete struct {
+	Rule *filter.PortWhitelist `json:"rule" validate:"required"`
 }
 
-type IptablesBatchOperate struct {
-	Rules []IptablesRuleOp `json:"rules"`
+type FirewallBackendOperation struct {
+	Subsystem string `json:"subsystem" validate:"required,oneof=system forwarding docker"`
+	Backend   string `json:"backend" validate:"required,oneof=firewalld ufw iptables nftables"`
+	Operation string `json:"operation" validate:"required,oneof=select initialize cleanup"`
 }
 
-type IptablesChainStatus struct {
-	IsBind          bool   `json:"isBind"`
-	DefaultStrategy string `json:"defaultStrategy"`
+type FirewallIPv6Operation struct {
+	Status string `json:"status" validate:"required,oneof=Enable Disable"`
+}
+
+type FirewallFamilyOperation struct {
+	Subsystem string `json:"subsystem" validate:"required,oneof=system forwarding docker"`
+	Backend   string `json:"backend" validate:"required,oneof=iptables nftables"`
+	Family    string `json:"family" validate:"required,oneof=ipv4 ipv6"`
+	Operation string `json:"operation" validate:"required,oneof=initialize repair bind"`
+}
+
+type FilterChainOperation struct {
+	Name    string `json:"name" validate:"required,eq=1PANEL_BASIC"`
+	Operate string `json:"operate" validate:"required,oneof=init-base bind-base unbind-base"`
+	TaskID  string `json:"taskID,omitempty" validate:"omitempty,max=64"`
+}
+
+type FilterChainOperationResponse struct {
+	TaskID string `json:"taskID"`
+	Queued bool   `json:"queued"`
+}
+
+type FirewallInitializationTask struct {
+	BackupFile string `json:"backupFile,omitempty" validate:"omitempty,max=255"`
+	TaskID     string `json:"taskID,omitempty" validate:"omitempty,max=64"`
+}
+
+type FirewallSystemPort = firewall.SystemPort
+
+type FirewallRuleInventoryResponse struct {
+	IPv4Range filter.PositionRange   `json:"ipv4Range"`
+	IPv6Range filter.PositionRange   `json:"ipv6Range"`
+	Total     int64                  `json:"total"`
+	AllTotal  int64                  `json:"allTotal"`
+	Items     []filter.InventoryItem `json:"items"`
+	Notices   []filter.ScopeNotice   `json:"notices,omitempty"`
+}
+
+type FirewallRuleBackup struct {
+	Name       string          `json:"name"`
+	Provider   filter.Provider `json:"provider"`
+	RuleCount  int             `json:"ruleCount"`
+	ModifiedAt int64           `json:"modifiedAt"`
+}
+
+type FirewallRuleBackups struct {
+	Directory string               `json:"directory"`
+	Files     []FirewallRuleBackup `json:"files"`
+}
+
+type FirewallRuleResetResponse struct {
+	BackupPath string `json:"backupPath"`
+	Removed    int    `json:"removed"`
+	Disabled   bool   `json:"disabled"`
+}
+
+type FirewallRuleReset struct {
+	Subsystem         string          `json:"subsystem,omitempty" validate:"omitempty,oneof=system forwarding docker"`
+	Backup            *bool           `json:"backup,omitempty" default:"true"`
+	Provider          filter.Provider `json:"provider,omitempty" validate:"omitempty,oneof=firewalld ufw iptables nftables"`
+	WithDockerRestart bool            `json:"withDockerRestart"`
+}
+
+type FirewallRuleInventory struct {
+	PageInfo
+	Scope         filter.Scope    `json:"scope,omitempty"`
+	Scopes        []filter.Scope  `json:"scopes,omitempty" validate:"max=16"`
+	All           bool            `json:"all,omitempty"`
+	Info          string          `json:"info"`
+	Families      []filter.Family `json:"families,omitempty" validate:"omitempty,dive,oneof=ipv4 ipv6"`
+	Actions       []string        `json:"actions,omitempty" validate:"omitempty,dive,oneof=accept deny"`
+	ExcludeChains []string        `json:"excludeChains,omitempty" validate:"omitempty,dive,oneof=1PANEL_BASIC_BEFORE 1PANEL_BASIC 1PANEL_BASIC_AFTER"`
+}
+
+type FirewallNativeDetail struct {
+	Provider   filter.Provider   `json:"provider" validate:"required,oneof=firewalld ufw"`
+	NativeKind filter.NativeKind `json:"nativeKind" validate:"required,oneof=zone_service ufw_application"`
+	Name       string            `json:"name" validate:"required"`
+	Permanent  bool              `json:"permanent"`
+}
+
+type DockerPortGuardBase struct {
+	IPv6Enabled bool                        `json:"ipv6Enabled"`
+	Name        string                      `json:"name"`
+	Version     string                      `json:"version"`
+	IsExist     bool                        `json:"isExist"`
+	Initialized bool                        `json:"initialized"`
+	Bound       bool                        `json:"bound"`
+	IPv4        DockerPortGuardFamilyStatus `json:"ipv4"`
+	IPv6        DockerPortGuardFamilyStatus `json:"ipv6"`
+	Backend     string                      `json:"backend"`
+	Message     string                      `json:"message,omitempty"`
+}
+
+type DockerPortGuardFamilyStatus struct {
+	Partial     bool   `json:"partial"`
+	State       string `json:"state"`
+	Reason      string `json:"reason,omitempty"`
+	Initialized bool   `json:"initialized"`
+	Bound       bool   `json:"bound"`
+	Effective   bool   `json:"effective"`
+}
+
+type DockerPortGuardEndpoint struct {
+	Family           string   `json:"family"`
+	HostIP           string   `json:"hostIP"`
+	HostPort         uint16   `json:"hostPort"`
+	Protocol         string   `json:"protocol"`
+	ContainerID      string   `json:"containerID"`
+	ContainerName    string   `json:"containerName"`
+	ContainerState   string   `json:"containerState,omitempty"`
+	ContainerPort    uint16   `json:"containerPort"`
+	Compose          string   `json:"compose,omitempty"`
+	Application      string   `json:"application,omitempty"`
+	PolicyUUID       string   `json:"policyUUID,omitempty"`
+	Mode             string   `json:"mode,omitempty"`
+	Sources          []string `json:"sources"`
+	Effective        bool     `json:"effective"`
+	TrafficPath      string   `json:"trafficPath"`
+	ManagementTarget string   `json:"managementTarget"`
+	ManagementReason string   `json:"managementReason,omitempty"`
+}
+
+type DockerPortGuardPortGroup struct {
+	Key       string                    `json:"key"`
+	Label     string                    `json:"label"`
+	Endpoint  DockerPortGuardEndpoint   `json:"endpoint"`
+	Endpoints []DockerPortGuardEndpoint `json:"endpoints"`
+}
+
+type DockerPortGuardContainer struct {
+	Key         string                     `json:"key"`
+	Name        string                     `json:"name"`
+	Compose     string                     `json:"compose,omitempty"`
+	Application string                     `json:"application,omitempty"`
+	Endpoints   []DockerPortGuardEndpoint  `json:"endpoints"`
+	PortGroups  []DockerPortGuardPortGroup `json:"portGroups"`
+}
+
+type DockerPortGuardList struct {
+	Base           DockerPortGuardBase        `json:"base"`
+	Containers     []DockerPortGuardContainer `json:"containers"`
+	OrphanPolicies []DockerPortGuardEndpoint  `json:"orphanPolicies"`
+}
+
+type DockerPortGuardEndpointIdentity struct {
+	Family   string `json:"family" validate:"required,oneof=ipv4 ipv6"`
+	HostIP   string `json:"hostIP" validate:"required,max=45"`
+	HostPort uint16 `json:"hostPort" validate:"required,min=1"`
+	Protocol string `json:"protocol" validate:"required,oneof=tcp udp"`
+}
+
+type DockerPortGuardPolicyBatch struct {
+	Policies []DockerPortGuardPolicy `json:"policies" validate:"required,min=1,dive"`
+	Import   bool                    `json:"import"`
+}
+
+type DockerPortGuardPolicyBatchDelete struct {
+	UUIDs []string `json:"uuids" validate:"required,min=1,dive,required,max=64"`
+}
+
+type DockerPortGuardPolicy struct {
+	DockerPortGuardEndpointIdentity
+	Mode    string   `json:"mode" validate:"required,oneof=deny_sources allow_sources deny_all accept_sources accept_all"`
+	Sources []string `json:"sources" validate:"dive,required,max=64"`
+}
+
+type DockerPortGuardOperation struct {
+	BackupFile string `json:"backupFile,omitempty" validate:"omitempty,max=255"`
+	Operation  string `json:"operation" validate:"required,oneof=initialize bind unbind"`
+	TaskID     string `json:"taskID,omitempty" validate:"omitempty,max=64"`
+}
+
+type FirewallRuleCreateItem struct {
+	Raw         string              `json:"raw,omitempty"`
+	ParseStatus filter.ParseStatus  `json:"parseStatus,omitempty"`
+	Rule        filter.FirewallRule `json:"rule" validate:"required"`
+	SourceKind  string              `json:"sourceKind" validate:"omitempty,oneof=user imported"`
+}
+
+type FirewallRuleCreate struct {
+	BackupFile string                   `json:"backupFile,omitempty" validate:"omitempty,max=255"`
+	Initialize bool                     `json:"initialize"`
+	Items      []FirewallRuleCreateItem `json:"items" validate:"dive"`
+}
+
+type FirewallRuleCreateResponse struct {
+	TaskID    string                      `json:"taskID,omitempty"`
+	Queued    bool                        `json:"queued,omitempty"`
+	Succeeded int                         `json:"succeeded"`
+	Failed    int                         `json:"failed"`
+	Skipped   int                         `json:"skipped"`
+	Errors    []FirewallRuleCreateFailure `json:"errors,omitempty"`
+}
+
+type FirewallRuleCreateFailure struct {
+	Index  int                 `json:"index"`
+	Status string              `json:"status"`
+	Rule   filter.FirewallRule `json:"rule"`
+	Error  string              `json:"error,omitempty"`
+}
+
+type FirewallRuleDelete struct {
+	Targets []FirewallRuleDeleteItem `json:"targets" validate:"required,min=1,dive"`
+}
+
+type FirewallRuleDeleteItem struct {
+	FirewallRuleDeleteTarget
+	Observed filter.ObservedRule `json:"observed" validate:"required"`
+}
+
+type FirewallRuleDeleteTarget struct {
+	Scope       filter.Scope `json:"scope" validate:"required"`
+	InstanceKey string       `json:"instanceKey" validate:"required,max=128"`
+}
+
+type FirewallRuleDeleteResponse struct {
+	TaskID    string                      `json:"taskID,omitempty"`
+	Queued    bool                        `json:"queued,omitempty"`
+	Succeeded int                         `json:"succeeded"`
+	Failed    int                         `json:"failed"`
+	Errors    []FirewallRuleDeleteFailure `json:"errors,omitempty"`
+}
+
+type FirewallRuleDeleteFailure struct {
+	Index       int    `json:"index"`
+	InstanceKey string `json:"instanceKey"`
+	Error       string `json:"error"`
+}
+
+type FirewallRuleUpdate struct {
+	FirewallRuleDeleteTarget
+	Rule        *filter.FirewallRule `json:"rule,omitempty" validate:"required_without_all=Description OrderIndex Priority,excluded_with=Description OrderIndex Priority"`
+	Description *string              `json:"description,omitempty" validate:"excluded_with=Rule"`
+	OrderIndex  *int64               `json:"orderIndex,omitempty" validate:"excluded_with=Rule Priority"`
+	Priority    *int                 `json:"priority,omitempty" validate:"excluded_with=Rule OrderIndex"`
+}
+
+type FirewallRuleReorder struct {
+	FirewallRuleDeleteTarget
+	TargetPosition *int64 `json:"targetPosition"`
+	Priority       *int   `json:"priority"`
+}
+
+type FirewallRuleExportItem struct {
+	filter.FirewallRule
+	Raw         string             `json:"raw,omitempty"`
+	ParseStatus filter.ParseStatus `json:"parseStatus,omitempty"`
+}
+
+type FirewallSubsystemBackup struct {
+	Families   []string                        `json:"families,omitempty"`
+	Subsystem  string                          `json:"subsystem"`
+	Provider   filter.Provider                 `json:"provider"`
+	Forwarding []forwarding.Rule               `json:"forwarding"`
+	Docker     *dockerfirewall.PolicyInventory `json:"docker,omitempty"`
 }

agent/app/dto/forwarding.go

@@ -2,13 +2,12 @@ package dto
 
 type ForwardRuleSearch struct {
 	PageInfo
+	All      bool   `json:"all,omitempty"`
 	Info     string `json:"info"`
 	Status   string `json:"status"`
 	Strategy string `json:"strategy"`
 }
 
-// ForwardRule preserves the existing firewall search response shape while
-// keeping forwarding data separate from the filter client model.
 type ForwardRule struct {
 	ID       uint   `json:"id"`
 	Chain    string `json:"chain"`
@@ -28,13 +27,14 @@ type ForwardRule struct {
 }
 
 type ForwardRuleOperate struct {
-	ForceDelete bool                   `json:"forceDelete"`
-	Rules       []ForwardRuleOperation `json:"rules"`
+	Import bool                   `json:"import"`
+	Rules  []ForwardRuleOperation `json:"rules" validate:"required,min=1,dive"`
 }
 
 type ForwardRuleOperation struct {
 	Operation  string `json:"operation" validate:"required,oneof=add remove"`
 	Num        string `json:"num"`
+	Family     string `json:"family" validate:"omitempty,oneof=ipv4 ipv6"`
 	Protocol   string `json:"protocol" validate:"required,oneof=tcp udp tcp/udp"`
 	Interface  string `json:"interface"`
 	Port       string `json:"port" validate:"required"`

agent/app/dto/monitor.go

@@ -1,6 +1,11 @@
 package dto
 
-import "time"
+import (
+	"encoding/json"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+)
 
 type MonitorSearch struct {
 	Param     string    `json:"param" validate:"required,oneof=all cpu memory load io network"`
@@ -26,50 +31,92 @@ type Process struct {
 }
 
 type MonitorSetting struct {
-	MonitorStatus    string `json:"monitorStatus"`
-	MonitorStoreDays string `json:"monitorStoreDays"`
-	MonitorInterval  string `json:"monitorInterval"`
-	DefaultNetwork   string `json:"defaultNetwork"`
-	DefaultIO        string `json:"defaultIO"`
+	GPUMonitorStatus     string `json:"gpuMonitorStatus"`
+	GPUMonitorStoreDays  string `json:"gpuMonitorStoreDays"`
+	GPUMonitorInterval   string `json:"gpuMonitorInterval"`
+	VLLMMonitorStatus    string `json:"vllmMonitorStatus"`
+	VLLMMonitorStoreDays string `json:"vllmMonitorStoreDays"`
+	VLLMMonitorInterval  string `json:"vllmMonitorInterval"`
+	MonitorStatus        string `json:"monitorStatus"`
+	MonitorStoreDays     string `json:"monitorStoreDays"`
+	MonitorInterval      string `json:"monitorInterval"`
+	DefaultNetwork       string `json:"defaultNetwork"`
+	DefaultIO            string `json:"defaultIO"`
 }
 
 type MonitorSettingUpdate struct {
-	Key   string `json:"key" validate:"required,oneof=MonitorStatus MonitorStoreDays MonitorInterval DefaultNetwork DefaultIO"`
+	Key   string `json:"key" validate:"required,oneof=MonitorStatus MonitorStoreDays MonitorInterval GPUMonitorStatus GPUMonitorStoreDays GPUMonitorInterval VLLMMonitorStatus VLLMMonitorStoreDays VLLMMonitorInterval DefaultNetwork DefaultIO"`
 	Value string `json:"value"`
 }
 
 type MonitorGPUOptions struct {
+	Supported bool           `json:"supported"`
 	GPUType   string         `json:"gpuType"`
 	ChartHide []GPUChartHide `json:"chartHide"`
 	Options   []string       `json:"options"`
 }
 type GPUChartHide struct {
+	DeviceID    string `json:"deviceID"`
+	Legacy      bool   `json:"legacy"`
 	ProductName string `json:"productName"`
+	Type        string `json:"type"`
 	Process     bool   `json:"process"`
 	GPU         bool   `json:"gpu"`
 	Memory      bool   `json:"memory"`
 	Power       bool   `json:"power"`
+	PowerLimit  bool   `json:"powerLimit"`
 	Temperature bool   `json:"temperature"`
 	Speed       bool   `json:"speed"`
 }
 type MonitorGPUSearch struct {
+	Aggregation string    `json:"aggregation" validate:"omitempty,oneof=avg max"`
+	DeviceID    string    `json:"deviceID"`
+	Legacy      bool      `json:"legacy"`
 	ProductName string    `json:"productName"`
 	StartTime   time.Time `json:"startTime"`
 	EndTime     time.Time `json:"endTime"`
 }
 type MonitorGPUData struct {
-	Date             []time.Time `json:"date"`
-	GPUValue         []float64   `json:"gpuValue"`
-	TemperatureValue []float64   `json:"temperatureValue"`
-	PowerTotal       []float64   `json:"powerTotal"`
-	PowerUsed        []float64   `json:"powerUsed"`
-	PowerPercent     []float64   `json:"powerPercent"`
-	MemoryTotal      []float64   `json:"memoryTotal"`
-	MemoryUsed       []float64   `json:"memoryUsed"`
-	MemoryPercent    []float64   `json:"memoryPercent"`
-	SpeedValue       []int       `json:"speedValue"`
+	MemoryActivity     []*float64 `json:"memoryActivity"`
+	EncoderUtil        []*float64 `json:"encoderUtil"`
+	DecoderUtil        []*float64 `json:"decoderUtil"`
+	JPEGUtil           []*float64 `json:"jpegUtil"`
+	OFAUtil            []*float64 `json:"ofaUtil"`
+	MediaUtil          []*float64 `json:"mediaUtil"`
+	ComputeUtil        []*float64 `json:"computeUtil"`
+	CopyUtil           []*float64 `json:"copyUtil"`
+	HotspotTemperature []*float64 `json:"hotspotTemperature"`
+	FanRPM             []*float64 `json:"fanRPM"`
+	AICPUUtil          []*float64 `json:"aiCPUUtil"`
+	CtrlCPUUtil        []*float64 `json:"ctrlCPUUtil"`
+	DDRUsed            []*float64 `json:"ddrUsed"`
+	DDRTotal           []*float64 `json:"ddrTotal"`
+	HBMUsed            []*float64 `json:"hbmUsed"`
+	HBMTotal           []*float64 `json:"hbmTotal"`
+	DDRBandwidth       []*float64 `json:"ddrBandwidth"`
+	HBMBandwidth       []*float64 `json:"hbmBandwidth"`
+	MemoryBandwidth    []*float64 `json:"memoryBandwidth"`
+	MediaFrequency     []*float64 `json:"mediaFrequency"`
+	HugepagesUsed      []*float64 `json:"hugepagesUsed"`
+	HugepagesTotal     []*float64 `json:"hugepagesTotal"`
 
-	ProcessCount []int          `json:"processCount"`
+	BucketSeconds          int64       `json:"bucketSeconds"`
+	SampleCount            int64       `json:"sampleCount"`
+	MemoryTemperatureValue []*float64  `json:"memoryTemperatureValue"`
+	FrequencyValue         []*float64  `json:"frequencyValue"`
+	MemoryFrequencyValue   []*float64  `json:"memoryFrequencyValue"`
+	Date                   []time.Time `json:"date"`
+	GPUValue               []*float64  `json:"gpuValue"`
+	TemperatureValue       []*float64  `json:"temperatureValue"`
+	PowerTotal             []*float64  `json:"powerTotal"`
+	PowerUsed              []*float64  `json:"powerUsed"`
+	PowerPercent           []*float64  `json:"powerPercent"`
+	MemoryTotal            []*float64  `json:"memoryTotal"`
+	MemoryUsed             []*float64  `json:"memoryUsed"`
+	MemoryPercent          []*float64  `json:"memoryPercent"`
+	SpeedValue             []*float64  `json:"speedValue"`
+
+	ProcessCount []*float64     `json:"processCount"`
 	GPUProcesses [][]GPUProcess `json:"gpuProcesses"`
 }
 
@@ -79,3 +126,34 @@ type GPUProcess struct {
 	ProcessName string `json:"processName"`
 	UsedMemory  string `json:"usedMemory"`
 }
+
+type MonitorVLLMSearch struct {
+	Group        string    `json:"group" validate:"omitempty,oneof=overview latency requests"`
+	AppInstallID uint      `json:"appInstallID" validate:"required"`
+	StartTime    time.Time `json:"startTime" validate:"required"`
+	EndTime      time.Time `json:"endTime" validate:"required"`
+	Aggregation  string    `json:"aggregation" validate:"omitempty,oneof=avg max"`
+}
+
+type MonitorVLLMData struct {
+	SampleCount   int64               `json:"sampleCount"`
+	BucketSeconds int64               `json:"bucketSeconds"`
+	Points        []model.MonitorVLLM `json:"points"`
+}
+
+type MonitorVLLMCurrent struct {
+	AppInstallID uint `json:"appInstallID" validate:"required"`
+}
+
+type MonitorVLLMCurrentData struct {
+	model.MonitorVLLM
+	Metrics map[string]json.RawMessage `json:"metrics,omitempty"`
+}
+
+type MonitorVLLMClean struct {
+	AppInstallID uint `json:"appInstallID" validate:"required"`
+}
+
+type MonitorClean struct {
+	Type string `json:"type" validate:"required,oneof=host gpu"`
+}

agent/app/dto/nginx.go

@@ -51,13 +51,19 @@ const (
 	CACHE      NginxKey = "cache"
 	HttpPer    NginxKey = "http-per"
 	ProxyCache NginxKey = "proxy-cache"
+	Brotli     NginxKey = "brotli"
 )
 
+// BrotliKeys are served from the panel-managed http.d file rather than
+// nginx.conf, because the module is optional: its directives must disappear
+// together with the module, otherwise nginx refuses to start.
+var BrotliKeys = []string{"brotli", "brotli_comp_level", "brotli_min_length", "brotli_types"}
+
 var ScopeKeyMap = map[NginxKey][]string{
 	Index:     {"index"},
 	LimitConn: {"limit_conn", "limit_rate", "limit_conn_zone"},
 	SSL:       {"ssl_certificate", "ssl_certificate_key"},
-	HttpPer:   {"server_names_hash_bucket_size", "client_header_buffer_size", "client_max_body_size", "keepalive_timeout", "gzip", "gzip_min_length", "gzip_comp_level"},
+	HttpPer:   {"server_names_hash_bucket_size", "client_header_buffer_size", "client_max_body_size", "keepalive_timeout", "gzip", "gzip_min_length", "gzip_comp_level", "gzip_types", "gzip_vary", "gzip_proxied"},
 }
 
 var StaticFileKeyMap = map[NginxKey]struct {

agent/app/dto/request/app.go

@@ -23,6 +23,12 @@ type AppInstallCreate struct {
 	Services    map[string]string      `json:"services"`
 	TaskID      string                 `json:"taskID"`
 
+	SyncModelAccount        *bool  `json:"syncModelAccount"`
+	ModelAccountBaseURLType string `json:"modelAccountBaseURLType" validate:"omitempty,oneof=container localhost systemIP custom"`
+	ModelAccountBaseURL     string `json:"modelAccountBaseURL"`
+
+	MCPPreserveWebsiteDir bool `json:"-"`
+
 	AppContainerConfig
 	NodePushConfig
 }
@@ -50,6 +56,10 @@ type AppContainerConfig struct {
 	Type          string  `json:"type"`
 	SpecifyIP     string  `json:"specifyIP"`
 	RestartPolicy string  `json:"restartPolicy" validate:"omitempty,oneof=always unless-stopped no on-failure"`
+
+	KeepServiceName         bool `json:"-"`
+	SkipComposeCommonConfig bool `json:"-"`
+	UseLifecycleScripts     bool `json:"-"`
 }
 
 type AppInstalledSearch struct {
@@ -79,29 +89,33 @@ type AppBackupDelete struct {
 }
 
 type AppInstalledOperate struct {
-	InstallId     uint                `json:"installId" validate:"required"`
-	BackupId      uint                `json:"backupId"`
-	DetailId      uint                `json:"detailId"`
-	Operate       constant.AppOperate `json:"operate" validate:"required"`
-	ForceDelete   bool                `json:"forceDelete"`
-	DeleteBackup  bool                `json:"deleteBackup"`
-	DeleteDB      bool                `json:"deleteDB"`
-	Backup        bool                `json:"backup"`
-	PullImage     bool                `json:"pullImage"`
-	DockerCompose string              `json:"dockerCompose"`
-	TaskID        string              `json:"taskID"`
-	DeleteImage   bool                `json:"deleteImage"`
-	Favorite      bool                `json:"favorite"`
+	FeishuTransition *dto.AgentFeishuTransition `json:"feishuTransition,omitempty"`
+	InstallId        uint                       `json:"installId" validate:"required"`
+	BackupId         uint                       `json:"backupId"`
+	DetailId         uint                       `json:"detailId"`
+	Operate          constant.AppOperate        `json:"operate" validate:"required"`
+	ForceDelete      bool                       `json:"forceDelete"`
+	DeleteBackup     bool                       `json:"deleteBackup"`
+	DeleteDB         bool                       `json:"deleteDB"`
+	Backup           bool                       `json:"backup"`
+	PullImage        bool                       `json:"pullImage"`
+	DockerCompose    string                     `json:"dockerCompose"`
+	TaskID           string                     `json:"taskID"`
+	DeleteImage      bool                       `json:"deleteImage"`
+	Favorite         bool                       `json:"favorite"`
+
+	UseLifecycleScripts bool `json:"-"`
 }
 
 type AppInstallUpgrade struct {
-	InstallID     uint   `json:"installId"`
-	DetailID      uint   `json:"detailId"`
-	Backup        bool   `json:"backup"`
-	PullImage     bool   `json:"pullImage"`
-	DeleteImage   bool   `json:"deleteImage"`
-	DockerCompose string `json:"dockerCompose"`
-	TaskID        string `json:"taskID"`
+	FeishuTransition *dto.AgentFeishuTransition `json:"feishuTransition,omitempty"`
+	InstallID        uint                       `json:"installId"`
+	DetailID         uint                       `json:"detailId"`
+	Backup           bool                       `json:"backup"`
+	PullImage        bool                       `json:"pullImage"`
+	DeleteImage      bool                       `json:"deleteImage"`
+	DockerCompose    string                     `json:"dockerCompose"`
+	TaskID           string                     `json:"taskID"`
 }
 
 type AppInstallDelete struct {
@@ -111,11 +125,17 @@ type AppInstallDelete struct {
 	DeleteDB     bool   `json:"deleteDB"`
 	DeleteImage  bool   `json:"deleteImage"`
 	TaskID       string `json:"taskID"`
+
+	UseLifecycleScripts bool `json:"-"`
 }
 
 type AppInstalledUpdate struct {
-	InstallId uint                   `json:"installId" validate:"required"`
-	Params    map[string]interface{} `json:"params" validate:"required"`
+	SyncModelAccount        *bool                  `json:"syncModelAccount"`
+	ModelAccountBaseURLType string                 `json:"modelAccountBaseURLType" validate:"omitempty,oneof=container localhost systemIP custom"`
+	ModelAccountBaseURL     string                 `json:"modelAccountBaseURL"`
+	InstallId               uint                   `json:"installId" validate:"required"`
+	Params                  map[string]interface{} `json:"params" validate:"required"`
+	TaskID                  string                 `json:"-"`
 	AppContainerConfig
 }
 

agent/app/dto/request/file.go

@@ -122,6 +122,7 @@ type FileWget struct {
 	Name              string `json:"name" validate:"required"`
 	IgnoreCertificate bool   `json:"ignoreCertificate"`
 	UseProxy          bool   `json:"useProxy"`
+	UseServerFilename bool   `json:"useServerFilename"`
 }
 
 type FileMove struct {
@@ -131,6 +132,11 @@ type FileMove struct {
 	Name       string   `json:"name"`
 	Cover      bool     `json:"cover"`
 	CoverPaths []string `json:"coverPaths"`
+	TaskID     string   `json:"taskID"`
+}
+
+type FileMoveStopReq struct {
+	TaskID string `json:"taskID" validate:"required"`
 }
 
 type FileDownload struct {
@@ -153,6 +159,10 @@ type FileProcessReq struct {
 	Key string `json:"key"`
 }
 
+type FileProcessRemoveReq struct {
+	Keys []string `json:"keys" validate:"required,min=1,max=1000"`
+}
+
 type FileRoleUpdate struct {
 	Path  string `json:"path" validate:"required"`
 	User  string `json:"user" validate:"required"`

agent/app/dto/request/runtime.go

@@ -66,14 +66,15 @@ type RuntimeDelete struct {
 }
 
 type RuntimeUpdate struct {
-	Name    string `json:"name"`
-	ID      uint   `json:"id"`
-	Image   string `json:"image"`
-	Version string `json:"version"`
-	Rebuild bool   `json:"rebuild"`
-	Source  string `json:"source"`
-	CodeDir string `json:"codeDir"`
-	Remark  string `json:"remark"`
+	AppDetailID uint   `json:"appDetailId"`
+	Name        string `json:"name"`
+	ID          uint   `json:"id"`
+	Image       string `json:"image"`
+	Version     string `json:"version"`
+	Rebuild     bool   `json:"rebuild"`
+	Source      string `json:"source"`
+	CodeDir     string `json:"codeDir"`
+	Remark      string `json:"remark"`
 
 	Params map[string]interface{} `json:"params"`
 	NodeConfig

agent/app/dto/request/website_ssl.go

@@ -182,3 +182,12 @@ type WebsiteSSLFileUpload struct {
 	PushNode    bool   `json:"pushNode"`
 	Nodes       string `json:"nodes"`
 }
+
+type WebsiteCAImport struct {
+	Name            string `json:"name" validate:"required,max=128"`
+	Type            string `json:"type" validate:"required,oneof=paste local"`
+	Certificate     string `json:"certificate" validate:"required_if=Type paste"`
+	PrivateKey      string `json:"privateKey" validate:"required_if=Type paste"`
+	CertificatePath string `json:"certificatePath" validate:"required_if=Type local"`
+	PrivateKeyPath  string `json:"privateKeyPath" validate:"required_if=Type local"`
+}

agent/app/dto/response/app.go

@@ -50,19 +50,21 @@ type TagDTO struct {
 }
 
 type AppInstalledCheck struct {
-	IsExist       bool      `json:"isExist"`
-	Name          string    `json:"name"`
-	App           string    `json:"app"`
-	Version       string    `json:"version"`
-	Status        string    `json:"status"`
-	CreatedAt     time.Time `json:"createdAt"`
-	LastBackupAt  string    `json:"lastBackupAt"`
-	AppInstallID  uint      `json:"appInstallId"`
-	ContainerName string    `json:"containerName"`
-	InstallPath   string    `json:"installPath"`
-	HttpPort      int       `json:"httpPort"`
-	HttpsPort     int       `json:"httpsPort"`
-	WebsiteDir    string    `json:"websiteDir"`
+	ModelAccountBaseURLType string    `json:"modelAccountBaseURLType"`
+	ModelAccountBaseURL     string    `json:"modelAccountBaseURL"`
+	IsExist                 bool      `json:"isExist"`
+	Name                    string    `json:"name"`
+	App                     string    `json:"app"`
+	Version                 string    `json:"version"`
+	Status                  string    `json:"status"`
+	CreatedAt               time.Time `json:"createdAt"`
+	LastBackupAt            string    `json:"lastBackupAt"`
+	AppInstallID            uint      `json:"appInstallId"`
+	ContainerName           string    `json:"containerName"`
+	InstallPath             string    `json:"installPath"`
+	HttpPort                int       `json:"httpPort"`
+	HttpsPort               int       `json:"httpsPort"`
+	WebsiteDir              string    `json:"websiteDir"`
 }
 
 type AppDetailDTO struct {
@@ -184,7 +186,13 @@ type AppParam struct {
 }
 
 type AppConfig struct {
-	Params     []AppParam `json:"params"`
-	RawCompose string     `json:"rawCompose"`
+	AppKey                  string     `json:"appKey"`
+	Name                    string     `json:"name"`
+	HttpPort                int        `json:"httpPort"`
+	SyncModelAccount        bool       `json:"syncModelAccount"`
+	ModelAccountBaseURLType string     `json:"modelAccountBaseURLType"`
+	ModelAccountBaseURL     string     `json:"modelAccountBaseURL"`
+	Params                  []AppParam `json:"params"`
+	RawCompose              string     `json:"rawCompose"`
 	request.AppContainerConfig
 }

agent/app/dto/response/nginx.go

@@ -17,6 +17,17 @@ type NginxParam struct {
 	Params []string `json:"params"`
 }
 
+// NginxBrotliRes carries the brotli settings together with where they live.
+// ManagedExternally is true when the user defined brotli by hand, in which
+// case the panel only reports the values and must not write its own copy.
+// ManagedUnavailable is true when the panel could not wire the managed
+// configuration into nginx.conf at all, so the reported values are inert.
+type NginxBrotliRes struct {
+	Params             []NginxParam `json:"params"`
+	ManagedExternally  bool         `json:"managedExternally"`
+	ManagedUnavailable bool         `json:"managedUnavailable"`
+}
+
 type NginxAuthRes struct {
 	Enable bool            `json:"enable"`
 	Items  []dto.NginxAuth `json:"items"`

agent/app/dto/setting.go

@@ -35,7 +35,7 @@ type SettingUpdate struct {
 }
 
 type AgentSettingUpdate struct {
-	Key   string `json:"key" validate:"required,oneof=SystemIP DockerSockPath FileRecycleBin FirewallPortWhiteList"`
+	Key   string `json:"key" validate:"required,oneof=SystemIP DockerSockPath FileRecycleBin"`
 	Value string `json:"value"`
 }
 

agent/app/dto/ssh.go

@@ -25,7 +25,7 @@ type RootCertOperate struct {
 	ID             uint   `json:"id"`
 	Name           string `json:"name"`
 	Mode           string `json:"mode"`
-	EncryptionMode string `json:"encryptionMode" validate:"required,oneof=rsa ed25519 ecdsa dsa"`
+	EncryptionMode string `json:"encryptionMode"`
 	PassPhrase     string `json:"passPhrase"`
 	PublicKey      string `json:"publicKey"`
 	PrivateKey     string `json:"privateKey"`

agent/app/dto/terminal.go

@@ -0,0 +1,11 @@
+package dto
+
+type TerminalSessionClose struct {
+	ID string `json:"id" validate:"required"`
+}
+
+type TerminalSessionRevoke struct {
+	Scope         string `json:"scope" validate:"required,oneof=auth_session user all"`
+	UserID        string `json:"userId"`
+	AuthSessionID string `json:"authSessionId"`
+}

agent/app/model/agent_account.go

@@ -2,6 +2,7 @@ package model
 
 type AgentAccount struct {
 	BaseModel
+	AppInstallID    uint   `json:"appInstallId"`
 	Provider        string `json:"provider"`
 	Name            string `json:"name"`
 	APIKey          string `json:"apiKey"`

agent/app/model/alert.go

@@ -1,5 +1,12 @@
 package model
 
+import (
+	"strings"
+
+	"github.com/google/uuid"
+	"gorm.io/gorm"
+)
+
 type Alert struct {
 	BaseModel
 
@@ -18,10 +25,11 @@ type Alert struct {
 
 type AlertTask struct {
 	BaseModel
-	Type      string `gorm:"type:varchar(64);not null" json:"type"`
-	Quota     string `gorm:"type:varchar(64)" json:"quota"`
-	QuotaType string `gorm:"type:varchar(64)" json:"quotaType"`
-	Method    string `gorm:"type:varchar(128);not null;default:'sms'" json:"method"`
+	Type          string `gorm:"type:varchar(64);not null" json:"type"`
+	Quota         string `gorm:"type:varchar(64)" json:"quota"`
+	QuotaType     string `gorm:"type:varchar(64)" json:"quotaType"`
+	Method        string `gorm:"type:varchar(128);not null;default:'sms'" json:"method"`
+	DeliveryLogID *uint  `gorm:"uniqueIndex" json:"-"`
 }
 
 type AlertLog struct {
@@ -41,12 +49,21 @@ type AlertLog struct {
 
 type AlertConfig struct {
 	BaseModel
-	Type       string `gorm:"type:varchar(64);not null" json:"type"`
-	Title      string `gorm:"type:varchar(64);not null" json:"title"`
-	Status     string `gorm:"type:varchar(64);not null" json:"status"`
-	Config     string `gorm:"type:varchar(256);not null" json:"config"`
-	CreateUser string `gorm:"type:varchar(256)" json:"createUser"`
-	UpdateUser string `gorm:"type:varchar(256)" json:"updateUser"`
+	UID          string `gorm:"type:varchar(64);not null;uniqueIndex" json:"uid"`
+	Type         string `gorm:"type:varchar(64);not null" json:"type"`
+	Title        string `gorm:"type:varchar(64);not null" json:"title"`
+	Status       string `gorm:"type:varchar(64);not null" json:"status"`
+	Config       string `gorm:"type:text;not null" json:"config"`
+	SecretConfig string `gorm:"type:text;not null;default:''" json:"-"`
+	CreateUser   string `gorm:"type:varchar(256)" json:"createUser"`
+	UpdateUser   string `gorm:"type:varchar(256)" json:"updateUser"`
+}
+
+func (a *AlertConfig) BeforeCreate(_ *gorm.DB) error {
+	if strings.TrimSpace(a.UID) == "" {
+		a.UID = uuid.NewString()
+	}
+	return nil
 }
 
 type LoginLog struct {

agent/app/model/app_install.go

@@ -28,6 +28,10 @@ type AppInstall struct {
 	Favorite      bool   `json:"favorite"`
 	SortOrder     int    `json:"sortOrder" gorm:"default:0"`
 
+	SyncModelAccount        bool   `json:"syncModelAccount"`
+	ModelAccountBaseURLType string `json:"modelAccountBaseURLType"`
+	ModelAccountBaseURL     string `json:"modelAccountBaseURL"`
+
 	App App `json:"app" gorm:"-:migration"`
 }
 

agent/app/model/app_launcher.go

@@ -5,6 +5,13 @@ type AppLauncher struct {
 	Key string `json:"key"`
 }
 
+type QuickDirectory struct {
+	BaseModel
+	Path   string `json:"path"`
+	Alias  string `json:"alias"`
+	Legacy bool   `json:"legacy" gorm:"-"`
+}
+
 type QuickJump struct {
 	BaseModel
 	Name      string `json:"name"`

agent/app/model/container_image_check_update.go

@@ -0,0 +1,20 @@
+package model
+
+import "time"
+
+// ContainerImageCheckUpdate is a cache tied to the exact image used by a container.
+type ContainerImageCheckUpdate struct {
+	ContainerID   string    `gorm:"primaryKey" json:"containerID"`
+	ImageID       string    `json:"imageID"`
+	ImageName     string    `json:"imageName"`
+	LatestVersion string    `json:"latestVersion"`
+	TargetImage   string    `json:"targetImage"`
+	TargetImageID string    `json:"-"`
+	HasUpdate     bool      `gorm:"not null;default:false" json:"hasUpdate"`
+	CheckedAt     time.Time `json:"checkedAt"`
+	CheckStatus   string    `json:"checkStatus"`
+	CheckError    string    `json:"checkError"`
+}
+
+// TableName preserves the table created by the original migration.
+func (ContainerImageCheckUpdate) TableName() string { return "container_image_updates" }

agent/app/model/firewall.go

@@ -1,18 +0,0 @@
-package model
-
-type Firewall struct {
-	BaseModel
-
-	Type    string `json:"type"`
-	Port    string `json:"port"`    // Deprecated
-	Address string `json:"address"` // Deprecated
-
-	Chain       string `json:"chain"`
-	Protocol    string `json:"protocol"`
-	SrcIP       string `json:"srcIP"`
-	SrcPort     string `json:"srcPort"`
-	DstIP       string `json:"dstIP"`
-	DstPort     string `json:"dstPort"`
-	Strategy    string `gorm:"not null" json:"strategy"`
-	Description string `json:"description"`
-}

agent/app/model/monitor.go

@@ -1,5 +1,7 @@
 package model
 
+import "time"
+
 type MonitorBase struct {
 	BaseModel
 	Cpu         float64     `json:"cpu"`
@@ -33,14 +35,88 @@ type MonitorNetwork struct {
 }
 
 type MonitorGPU struct {
+	MemoryUtil         *float64 `json:"memoryUtil"`
+	MemoryActivity     *float64 `json:"memoryActivity"`
+	EncoderUtil        *float64 `json:"encoderUtil"`
+	DecoderUtil        *float64 `json:"decoderUtil"`
+	JPEGUtil           *float64 `json:"jpegUtil"`
+	OFAUtil            *float64 `json:"ofaUtil"`
+	MediaUtil          *float64 `json:"mediaUtil"`
+	ComputeUtil        *float64 `json:"computeUtil"`
+	CopyUtil           *float64 `json:"copyUtil"`
+	HotspotTemperature *float64 `json:"hotspotTemperature"`
+	FanRPM             *float64 `json:"fanRPM"`
+	AICPUUtil          *float64 `json:"aiCPUUtil"`
+	CtrlCPUUtil        *float64 `json:"ctrlCPUUtil"`
+	DDRUsed            *float64 `json:"ddrUsed"`
+	DDRTotal           *float64 `json:"ddrTotal"`
+	HBMUsed            *float64 `json:"hbmUsed"`
+	HBMTotal           *float64 `json:"hbmTotal"`
+	DDRBandwidth       *float64 `json:"ddrBandwidth"`
+	HBMBandwidth       *float64 `json:"hbmBandwidth"`
+	MemoryBandwidth    *float64 `json:"memoryBandwidth"`
+	MediaFrequency     *float64 `json:"mediaFrequency"`
+	HugepagesUsed      *float64 `json:"hugepagesUsed"`
+	HugepagesTotal     *float64 `json:"hugepagesTotal"`
+
+	MemoryTemperature *float64 `json:"memoryTemperature"`
+	DeviceID          string   `json:"deviceID"`
+	DeviceType        string   `json:"deviceType"`
+	ProcessStatus     string   `json:"processStatus"`
+	Frequency         *float64 `json:"frequency"`
+	MemoryFrequency   *float64 `json:"memoryFrequency"`
+	IntervalSeconds   int      `json:"intervalSeconds"`
 	BaseModel
-	ProductName   string  `json:"productName"`
-	GPUUtil       float64 `json:"gpuUtil"`
-	Temperature   float64 `json:"temperature"`
-	PowerDraw     float64 `json:"powerDraw"`
-	MaxPowerLimit float64 `json:"maxPowerLimit"`
-	MemUsed       float64 `json:"memUsed"`
-	MemTotal      float64 `json:"memTotal"`
-	FanSpeed      int     `json:"fanSpeed"`
-	Processes     string  `json:"processes"`
+	ProductName   string   `json:"productName"`
+	GPUUtil       *float64 `json:"gpuUtil"`
+	Temperature   *float64 `json:"temperature"`
+	PowerDraw     *float64 `json:"powerDraw"`
+	MaxPowerLimit *float64 `json:"maxPowerLimit"`
+	MemUsed       *float64 `json:"memUsed"`
+	MemTotal      *float64 `json:"memTotal"`
+	FanSpeed      *float64 `json:"fanSpeed"`
+	Processes     string   `json:"processes"`
+}
+
+type MonitorVLLM struct {
+	ID                      uint               `json:"-" gorm:"primarykey;autoIncrement"`
+	CreatedAt               time.Time          `json:"createdAt"`
+	AppInstallID            uint               `json:"appInstallID"`
+	Status                  string             `json:"status"`
+	RawMetrics              string             `json:"-"`
+	HistogramDeltas         string             `json:"-"`
+	IntervalSeconds         float64            `json:"intervalSeconds" gorm:"-"`
+	SampleIntervalSeconds   int                `json:"-"`
+	RequestDeltas           string             `json:"-"`
+	CompletedRequests       *float64           `json:"completedRequests" gorm:"-"`
+	QueueTime               *float64           `json:"queueTime"`
+	AverageGenerationTokens *float64           `json:"averageGenerationTokens"`
+	PrefixCacheHitRate      *float64           `json:"prefixCacheHitRate"`
+	FinishReasons           map[string]float64 `json:"finishReasons" gorm:"-"`
+	PromptDistribution      map[string]float64 `json:"promptDistribution" gorm:"-"`
+	GenerationDistribution  map[string]float64 `json:"generationDistribution" gorm:"-"`
+
+	Running               *float64 `json:"running"`
+	Waiting               *float64 `json:"waiting"`
+	CacheUsage            *float64 `json:"cacheUsage"`
+	PromptThroughput      *float64 `json:"promptThroughput"`
+	GenerationThroughput  *float64 `json:"generationThroughput"`
+	RequestThroughput     *float64 `json:"requestThroughput"`
+	TimeToFirstToken      *float64 `json:"timeToFirstToken"`
+	TimePerOutputToken    *float64 `json:"timePerOutputToken"`
+	RequestLatency        *float64 `json:"requestLatency"`
+	PrefillTime           *float64 `json:"prefillTime"`
+	DecodeTime            *float64 `json:"decodeTime"`
+	TimeToFirstTokenP50   *float64 `json:"timeToFirstTokenP50"`
+	TimeToFirstTokenP90   *float64 `json:"timeToFirstTokenP90"`
+	TimeToFirstTokenP95   *float64 `json:"timeToFirstTokenP95"`
+	TimeToFirstTokenP99   *float64 `json:"timeToFirstTokenP99"`
+	TimePerOutputTokenP50 *float64 `json:"timePerOutputTokenP50"`
+	TimePerOutputTokenP90 *float64 `json:"timePerOutputTokenP90"`
+	TimePerOutputTokenP95 *float64 `json:"timePerOutputTokenP95"`
+	TimePerOutputTokenP99 *float64 `json:"timePerOutputTokenP99"`
+	RequestLatencyP50     *float64 `json:"requestLatencyP50"`
+	RequestLatencyP90     *float64 `json:"requestLatencyP90"`
+	RequestLatencyP95     *float64 `json:"requestLatencyP95"`
+	RequestLatencyP99     *float64 `json:"requestLatencyP99"`
 }

agent/app/provider/catalog.go

@@ -40,23 +40,33 @@ type Meta struct {
 var catalog = map[string]Meta{
 	"custom": {
 		Key: "custom", DisplayName: "Custom", Sort: 10, DefaultAPIType: "openai-completions", EnvKey: "CUSTOM_API_KEY",
-		APIConfigs: editableAPIConfigs(true, "openai-completions", "openai-responses", "anthropic-messages", "openai-images"),
+		APIConfigs: editableAPIConfigs(true, "openai-completions", "openai-responses", "anthropic-messages", "openai-images", "dashscope-images", "openai-embeddings"),
 	},
 	"ollama": {
 		Key: "ollama", DisplayName: "Ollama", Sort: 15, DefaultAPIType: "openai-responses",
-		APIConfigs: editableAPIConfigs(false, "openai-responses", "openai-completions"),
+		APIConfigs: editableAPIConfigs(false, "openai-responses", "openai-completions", "openai-embeddings"),
+	},
+	// llmman (https://github.com/llmmanorg/llmman): local runner with Ollama/OpenAI-compatible routes on 127.0.0.1:17434.
+	"llmman": {
+		Key: "llmman", DisplayName: "llmman", Sort: 16, DefaultAPIType: "openai-responses",
+		APIConfigs: []APIConfig{
+			{APIType: "openai-responses", BaseURL: "http://127.0.0.1:17434/v1", EditableBaseURL: true},
+			{APIType: "openai-completions", BaseURL: "http://127.0.0.1:17434/v1", EditableBaseURL: true},
+			{APIType: "openai-embeddings", BaseURL: "http://127.0.0.1:17434/v1", EditableBaseURL: true},
+		},
 	},
 	"vllm": {
 		Key: "vllm", DisplayName: "vLLM", Sort: 20, DefaultAPIType: "openai-completions", EnvKey: "VLLM_API_KEY",
-		APIConfigs: editableAPIConfigs(false, "openai-completions", "openai-responses", "anthropic-messages", "openai-images"),
+		APIConfigs: editableAPIConfigs(false, "openai-completions", "openai-responses", "anthropic-messages", "openai-images", "openai-embeddings"),
 	},
 	"deepseek": {
 		Key: "deepseek", DisplayName: "DeepSeek", Sort: 25, DefaultAPIType: "openai-completions", EnvKey: "DEEPSEEK_API_KEY",
 		APIConfigs: []APIConfig{
 			{APIType: "openai-completions", BaseURL: "https://api.deepseek.com"},
+			{APIType: "openai-responses", BaseURL: "https://api.deepseek.com"},
 			anthropicAPIConfig("https://api.deepseek.com/anthropic", AuthModeXAPIKey),
 		},
-		Models: []Model{{ID: "deepseek-v4-flash", Name: "deepseek-v4-flash"}, {ID: "deepseek-v4-pro", Name: "deepseek-v4-pro"}},
+		Models: []Model{{ID: "deepseek-flash", Name: "deepseek-flash"}, {ID: "deepseek-v4-pro", Name: "deepseek-v4-pro"}},
 	},
 	"bailian-coding-plan": {
 		Key: "bailian-coding-plan", DisplayNameKey: "AIProviderBailianCodingPlan", Sort: 30, DefaultAPIType: "openai-completions", EnvKey: "QWEN_API_KEY",
@@ -72,7 +82,6 @@ var catalog = map[string]Meta{
 			{ID: "kimi-k2.5", Name: "Kimi K2.5"},
 			{ID: "qwen3.5-plus", Name: "Qwen3.5-Plus"},
 			{ID: "glm-5", Name: "GLM-5"},
-			{ID: "MiniMax-M2.5", Name: "MiniMax M2.5"},
 			{ID: "qwen3.6-plus", Name: "Qwen3.6-Plus"},
 			{ID: "qwen3.7-plus", Name: "Qwen3.7-Plus"},
 		},
@@ -104,7 +113,7 @@ var catalog = map[string]Meta{
 			{APIType: "openai-completions", BaseURL: "https://api.minimaxi.com/v1"},
 			{APIType: "minimax-images", BaseURL: "https://api.minimaxi.com"},
 		},
-		Models: []Model{{ID: "MiniMax-M3", Name: "MiniMax M3"}, {ID: "MiniMax-M2.7", Name: "MiniMax M2.7"}, {ID: "MiniMax-M2.7-highspeed", Name: "MiniMax M2.7 highspeed"}},
+		Models: []Model{{ID: "MiniMax-M3.1-Flash", Name: "MiniMax M3.1 Flash"}, {ID: "MiniMax-M3", Name: "MiniMax M3"}},
 	},
 	"xiaomi": {
 		Key: "xiaomi", DisplayName: "Xiaomi", Sort: 46, DefaultAPIType: "openai-completions", EnvKey: "XIAOMI_API_KEY",
@@ -131,6 +140,10 @@ var catalog = map[string]Meta{
 			{APIType: "openai-responses", BaseURL: "https://api.openai.com/v1"},
 			{APIType: "openai-completions", BaseURL: "https://api.openai.com/v1"},
 			{APIType: "openai-images", BaseURL: "https://api.openai.com/v1"},
+			{APIType: "openai-embeddings", BaseURL: "https://api.openai.com/v1", Models: []Model{
+				{ID: "text-embedding-3-small", Name: "text-embedding-3-small"},
+				{ID: "text-embedding-3-large", Name: "text-embedding-3-large"},
+			}},
 		},
 		Models: []Model{{ID: "gpt-5.4", Name: "gpt-5.4"}, {ID: "gpt-5.4-pro", Name: "gpt-5.4-pro"}, {ID: "gpt-5.4-mini", Name: "gpt-5.4-mini"}, {ID: "gpt-5.4-nano", Name: "gpt-5.4-nano"}},
 	},
@@ -296,7 +309,7 @@ func DefaultModels(key, apiType string) []Model {
 		if len(config.Models) > 0 {
 			return append([]Model(nil), config.Models...)
 		}
-		if IsImageAPIType(config.APIType) {
+		if IsImageAPIType(config.APIType) || IsEmbeddingAPIType(config.APIType) {
 			return nil
 		}
 		break
@@ -359,7 +372,7 @@ func ResolveBaseURL(key, apiType, requested string) (string, error) {
 	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
 		return "", fmt.Errorf("invalid base url")
 	}
-	if key == "custom" && IsImageAPIType(config.APIType) {
+	if key == "custom" && (IsImageAPIType(config.APIType) || IsEmbeddingAPIType(config.APIType)) {
 		return baseURL, nil
 	}
 	parsed.Path = normalizeEndpointPath(config.APIType, parsed.Path)
@@ -381,6 +394,8 @@ func normalizeEndpointPath(apiType, value string) string {
 		suffixes = []string{"/responses"}
 	case "anthropic-messages":
 		suffixes = []string{"/v1/messages", "/messages"}
+	case "openai-embeddings":
+		suffixes = []string{"/v1/embeddings", "/embeddings"}
 	}
 	for _, suffix := range suffixes {
 		if strings.HasSuffix(strings.ToLower(path), suffix) {
@@ -390,6 +405,10 @@ func normalizeEndpointPath(apiType, value string) string {
 	return path
 }
 
+func IsEmbeddingAPIType(apiType string) bool {
+	return apiType == "openai-embeddings"
+}
+
 func IsImageAPIType(apiType string) bool {
 	switch apiType {
 	case "openai-images", "dashscope-images", "minimax-images", "openrouter-images":
@@ -442,6 +461,7 @@ var legacyModelPrefixes = map[string][]string{
 	"custom":              {"custom"},
 	"vllm":                {"custom"},
 	"ollama":              {"ollama"},
+	"llmman":              {"llmman"},
 	"deepseek":            {"deepseek"},
 	"bailian-coding-plan": {"bailian-coding-plan"},
 	"ark-coding-plan":     {"ark-coding-plan"},

agent/app/provider/minimax_test.go

@@ -0,0 +1,100 @@
+package provider
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"reflect"
+	"strings"
+	"testing"
+)
+
+func TestMiniMaxCatalog(t *testing.T) {
+	meta, ok := Get("minimax")
+	if !ok || !reflect.DeepEqual(meta.Models, []Model{{ID: "MiniMax-M3.1-Flash", Name: "MiniMax M3.1 Flash"}, {ID: "MiniMax-M3", Name: "MiniMax M3"}}) {
+		t.Fatalf("unexpected MiniMax models: %+v", meta.Models)
+	}
+	if meta.DefaultAPIType != "anthropic-messages" {
+		t.Fatalf("changed default protocol: %s", meta.DefaultAPIType)
+	}
+	for _, provider := range All() {
+		for _, model := range provider.Models {
+			if strings.Contains(strings.ToLower(model.ID), "minimax") && model.ID != "MiniMax-M3.1-Flash" && model.ID != "MiniMax-M3" {
+				t.Errorf("legacy suggestion in %s: %s", provider.Key, model.ID)
+			}
+		}
+	}
+}
+
+func TestMiniMaxVerificationRequests(t *testing.T) {
+	for _, region := range []string{"https://api.minimaxi.com", "https://api.minimax.io"} {
+		for _, protocol := range []string{"anthropic-messages", "openai-completions"} {
+			for _, auth := range []string{AuthModeXAPIKey, AuthModeBearer} {
+				for _, model := range []string{"MiniMax-M3.1-Flash", "MiniMax-M3", "MiniMax-M2.7", "MiniMax-M2.7-highspeed", "custom-model"} {
+					t.Run(region+"/"+protocol+"/"+auth+"/"+model, func(t *testing.T) {
+						base, endpoint := region+"/v1", "/chat/completions"
+						if protocol == "anthropic-messages" {
+							base, endpoint = region+"/anthropic", "/v1/messages"
+						}
+						built := BuildVerifyRequest("minimax", protocol, auth, base, "test-key", model)
+						if built.URL != base+endpoint {
+							t.Fatalf("URL = %s", built.URL)
+						}
+						var captured map[string]interface{}
+						server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+							if r.Method != http.MethodPost || r.URL.Path != strings.TrimPrefix(base, region)+endpoint {
+								t.Errorf("unexpected request: %s %s", r.Method, r.URL.Path)
+							}
+							if protocol == "anthropic-messages" && auth == AuthModeXAPIKey {
+								if r.Header.Get("x-api-key") != "test-key" || r.Header.Get("Authorization") != "" {
+									t.Error("incorrect API key authentication")
+								}
+							} else if r.Header.Get("Authorization") != "Bearer test-key" {
+								t.Error("incorrect bearer authentication")
+							}
+							if err := json.NewDecoder(r.Body).Decode(&captured); err != nil {
+								t.Error(err)
+							}
+							w.WriteHeader(http.StatusOK)
+						}))
+						defer server.Close()
+						if err := VerifyAccount("minimax", protocol, auth, server.URL+strings.TrimPrefix(base, region), "test-key", model); err != nil {
+							t.Fatal(err)
+						}
+						if captured["model"] != model || captured["stream"] != false || captured["max_tokens"] != float64(defaultVerifyMaxTokens) {
+							t.Fatalf("unexpected serialized body: %#v", captured)
+						}
+						if model == "MiniMax-M3.1-Flash" {
+							if protocol == "anthropic-messages" {
+								if !reflect.DeepEqual(captured["thinking"], map[string]interface{}{"type": "adaptive"}) || !reflect.DeepEqual(captured["output_config"], map[string]interface{}{"effort": "max"}) || captured["reasoning_effort"] != nil {
+									t.Fatalf("invalid Anthropic Flash reasoning: %#v", captured)
+								}
+							} else if captured["reasoning_effort"] != "max" || captured["thinking"] != nil || captured["output_config"] != nil {
+								t.Fatalf("invalid OpenAI Flash reasoning: %#v", captured)
+							}
+						} else if captured["reasoning_effort"] != nil || captured["thinking"] != nil || captured["output_config"] != nil {
+							t.Fatalf("changed legacy/custom reasoning: %#v", captured)
+						}
+					})
+				}
+			}
+		}
+	}
+}
+
+func TestMiniMaxExplicitGatewayAndCustomModels(t *testing.T) {
+	for _, provider := range []string{"bailian-coding-plan", "custom", "openrouter"} {
+		for _, protocol := range []string{"openai-completions", "anthropic-messages"} {
+			for _, model := range []string{"MiniMax-M2.5", "MiniMax-M3.1-Flash", "my-custom-model"} {
+				request := BuildVerifyRequest(provider, protocol, AuthModeBearer, "https://example.test/v1", "test-key", model)
+				var body map[string]interface{}
+				if err := json.Unmarshal(request.Body, &body); err != nil {
+					t.Fatal(err)
+				}
+				if body["model"] != model || body["reasoning_effort"] != nil || body["output_config"] != nil || body["thinking"] != nil {
+					t.Fatalf("changed explicit %s request: %#v", provider, body)
+				}
+			}
+		}
+	}
+}

agent/app/provider/openclaw.go

@@ -23,7 +23,7 @@ func BuildOpenClawProviderPatch(provider, modelName, apiType, authMode, baseURL,
 	if _, ok := FindAPIConfig(provider, resolvedAPIType); !ok {
 		resolvedAPIType = DefaultAPIType(provider)
 	}
-	if IsImageAPIType(resolvedAPIType) {
+	if IsImageAPIType(resolvedAPIType) || IsEmbeddingAPIType(resolvedAPIType) {
 		return nil, fmt.Errorf("api type %s does not support text generation", resolvedAPIType)
 	}
 	resolvedAuthMode, err := ResolveAuthMode(provider, resolvedAPIType, authMode)
@@ -43,8 +43,8 @@ func BuildOpenClawProviderPatch(provider, modelName, apiType, authMode, baseURL,
 		providerKey = "moonshot"
 		resolvedAPIType = "openai-completions"
 		usesBearer = false
-	case "ollama":
-		apiKey = "ollama"
+	case "ollama", "llmman":
+		apiKey = provider
 		usesBearer = false
 	case "openai", "openrouter", "anthropic":
 		preserveQualifiedModel = strings.Contains(modelName, "/")

agent/app/provider/verify.go

@@ -27,11 +27,14 @@ type verifyErrorResponse struct {
 	Message string `json:"message"`
 }
 
-const defaultVerifyTimeout = 30 * time.Second
+const (
+	defaultVerifyTimeout   = 30 * time.Second
+	defaultVerifyMaxTokens = 16
+)
 
 func SkipVerification(provider string) bool {
 	switch provider {
-	case "vllm", "ollama", "kimi-coding":
+	case "vllm", "ollama", "llmman", "kimi-coding":
 		return true
 	default:
 		return false
@@ -81,6 +84,10 @@ func BuildVerifyRequest(provider, apiType, authMode, baseURL, apiKey, model stri
 	}
 
 	switch apiType {
+	case "openai-embeddings":
+		request.URL = embeddingVerifyURL(baseURL)
+		headers["Authorization"] = "Bearer " + apiKey
+		request.Body = mustJSON(map[string]interface{}{"model": model, "input": "ping"})
 	case "openai-images":
 		request.URL = imageVerifyURL(provider, baseURL, "/images/generations")
 		headers["Authorization"] = "Bearer " + apiKey
@@ -111,26 +118,46 @@ func BuildVerifyRequest(provider, apiType, authMode, baseURL, apiKey, model stri
 			headers["x-api-key"] = apiKey
 		}
 		headers["anthropic-version"] = "2023-06-01"
-		request.Body = mustJSON(map[string]interface{}{
-			"model": model, "max_tokens": 1, "stream": false,
+		body := map[string]interface{}{
+			"model": model, "max_tokens": defaultVerifyMaxTokens, "stream": false,
 			"messages": []map[string]interface{}{{"role": "user", "content": []map[string]string{{"type": "text", "text": "test"}}}},
-		})
+		}
+		if provider == "minimax" && model == "MiniMax-M3.1-Flash" {
+			body["thinking"] = map[string]string{"type": "adaptive"}
+			body["output_config"] = map[string]string{"effort": "max"}
+		}
+		request.Body = mustJSON(body)
 	case "openai-responses":
 		request.URL = baseURL + "/responses"
 		headers["Authorization"] = "Bearer " + apiKey
-		request.Body = mustJSON(map[string]interface{}{"model": model, "input": "test", "max_output_tokens": 1, "stream": false})
+		request.Body = mustJSON(map[string]interface{}{"model": model, "input": "test", "max_output_tokens": defaultVerifyMaxTokens, "stream": false})
 	default:
 		request.URL = baseURL + "/chat/completions"
-		if provider != "ollama" || strings.TrimSpace(apiKey) != "" {
+		if (provider != "ollama" && provider != "llmman") || strings.TrimSpace(apiKey) != "" {
 			headers["Authorization"] = "Bearer " + apiKey
 		}
-		request.Body = mustJSON(map[string]interface{}{
-			"model": model, "messages": []map[string]string{{"role": "user", "content": "test"}}, "max_tokens": 1, "stream": false,
-		})
+		body := map[string]interface{}{
+			"model": model, "messages": []map[string]string{{"role": "user", "content": "test"}}, "max_tokens": defaultVerifyMaxTokens, "stream": false,
+		}
+		if provider == "minimax" && model == "MiniMax-M3.1-Flash" {
+			body["reasoning_effort"] = "max"
+		}
+		request.Body = mustJSON(body)
 	}
 	return request
 }
 
+func embeddingVerifyURL(baseURL string) string {
+	lowerBaseURL := strings.ToLower(baseURL)
+	if strings.HasSuffix(lowerBaseURL, "/embeddings") {
+		return baseURL
+	}
+	if strings.HasSuffix(lowerBaseURL, "/v1") {
+		return baseURL + "/embeddings"
+	}
+	return baseURL + "/v1/embeddings"
+}
+
 func imageVerifyURL(provider, baseURL, endpoint string) string {
 	if provider == "custom" || strings.HasSuffix(strings.ToLower(baseURL), endpoint) {
 		return baseURL

agent/app/repo/agent_account.go

@@ -4,6 +4,7 @@ import (
 	"strings"
 
 	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/global"
 	"gorm.io/gorm"
 )
 
@@ -18,6 +19,7 @@ type IAgentAccountRepo interface {
 	DeleteByID(id uint) error
 	List(opts ...DBOption) ([]model.AgentAccount, error)
 	CountTextByProviders(providers []string) (map[string]int64, error)
+	SaveLocal(account *model.AgentAccount, models []model.AgentAccountModel) error
 }
 
 func NewIAgentAccountRepo() IAgentAccountRepo {
@@ -86,7 +88,7 @@ func (a AgentAccountRepo) CountTextByProviders(providers []string) (map[string]i
 		Model(&model.AgentAccount{}).
 		Select("provider, COUNT(*) as count").
 		Where("provider IN ?", normalizedProviders).
-		Where("api_type NOT LIKE ?", "%-images").
+		Scopes(WithTextAPIType()).
 		Group("provider").
 		Scan(&rows).Error; err != nil {
 		return nil, err
@@ -97,6 +99,25 @@ func (a AgentAccountRepo) CountTextByProviders(providers []string) (map[string]i
 	return counts, nil
 }
 
+func (a AgentAccountRepo) SaveLocal(account *model.AgentAccount, models []model.AgentAccountModel) error {
+	return global.DB.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Save(account).Error; err != nil {
+			return err
+		}
+		if err := tx.Where("account_id = ?", account.ID).Delete(&model.AgentAccountModel{}).Error; err != nil {
+			return err
+		}
+		if len(models) == 0 {
+			return nil
+		}
+		for i := range models {
+			models[i].AccountID = account.ID
+			models[i].SortOrder = i + 1
+		}
+		return tx.Create(&models).Error
+	})
+}
+
 func normalizeProviders(providers []string) []string {
 	seen := make(map[string]struct{}, len(providers))
 	result := make([]string, 0, len(providers))

agent/app/repo/ai.go

@@ -1,6 +1,8 @@
 package repo
 
 import (
+	"context"
+
 	"github.com/1Panel-dev/1Panel/agent/app/model"
 	"github.com/1Panel-dev/1Panel/agent/global"
 )
@@ -14,6 +16,7 @@ type IAiRepo interface {
 	Create(cronjob *model.OllamaModel) error
 	Update(id uint, vars map[string]interface{}) error
 	Delete(opts ...DBOption) error
+	DeleteAll(ctx context.Context) error
 }
 
 func NewIAiRepo() IAiRepo {
@@ -67,3 +70,7 @@ func (u *AiRepo) Delete(opts ...DBOption) error {
 	}
 	return db.Delete(&model.OllamaModel{}).Error
 }
+
+func (u *AiRepo) DeleteAll(ctx context.Context) error {
+	return getTx(ctx).Where("1 = 1").Delete(&model.OllamaModel{}).Error
+}

agent/app/repo/alert.go

@@ -1,20 +1,30 @@
 package repo
 
 import (
+	"encoding/base64"
 	"encoding/json"
+	"errors"
+	"fmt"
+	"strconv"
 	"strings"
+	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/app/model"
 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/google/uuid"
 	"google.golang.org/genproto/googleapis/type/date"
 	"gorm.io/gorm"
-	"strconv"
-	"time"
+	"gorm.io/gorm/clause"
 )
 
 type AlertRepo struct{}
 
+var (
+	ErrAlertConfigRevisionConflict = errors.New("alert config revision conflict")
+	ErrAlertConfigRevisionRequired = errors.New("alert config revision is required")
+)
+
 type IAlertRepo interface {
 	WithByType(alertType string) DBOption
 	WithByStatusIn(status []string) DBOption
@@ -24,6 +34,7 @@ type IAlertRepo interface {
 	WithByCreateAt(date *date.Date) DBOption
 	WithByLicenseId(licenseId string) DBOption
 	WithByRecordId(recordId uint) DBOption
+	WithByDeliveryLogID(logID uint) DBOption
 	WithByAlertMethodContainsConfigID(id uint) DBOption
 	WithByMethodConfigIDs(ids []uint) DBOption
 
@@ -45,6 +56,8 @@ type IAlertRepo interface {
 	CleanAlertLogs() error
 
 	CreateAlertTask(alertTaskBase *model.AlertTask) error
+	CreatePendingAlertTask(logID, alertID uint, alertTask *model.AlertTask) (bool, error)
+	FinalizePendingAlertTask(logID uint, succeeded bool, message string, fallback *model.AlertTask) (bool, error)
 	DeleteAlertTask(opts ...DBOption) error
 	GetAlertTask(opts ...DBOption) (model.AlertTask, error)
 	LoadTaskCount(alertType string, project string, method string) (uint, uint, error)
@@ -55,6 +68,7 @@ type IAlertRepo interface {
 	GetConfigById(id uint) (model.AlertConfig, error)
 	AlertConfigList(opts ...DBOption) ([]model.AlertConfig, error)
 	UpdateAlertConfig(maps map[string]interface{}, opts ...DBOption) error
+	UpdateAlertConfigWithRevision(maps map[string]interface{}, revision *time.Time, opts ...DBOption) error
 	CreateAlertConfig(config *model.AlertConfig) error
 	DeleteAlertConfig(opts ...DBOption) error
 
@@ -223,13 +237,78 @@ func (a *AlertRepo) DeleteLog(opts ...DBOption) error {
 }
 
 func (a *AlertRepo) CleanAlertLogs() error {
-	return global.AlertDB.Where("1 = 1").Delete(&model.AlertLog{}).Error
+	return global.AlertDB.Where("status <> ?", constant.AlertPushing).Delete(&model.AlertLog{}).Error
 }
 
 func (a *AlertRepo) CreateAlertTask(alertTaskBase *model.AlertTask) error {
 	return global.AlertDB.Model(&model.AlertTask{}).Create(&alertTaskBase).Error
 }
 
+func (a *AlertRepo) CreatePendingAlertTask(logID, alertID uint, alertTask *model.AlertTask) (bool, error) {
+	if alertTask == nil {
+		return false, fmt.Errorf("pending alert task is required")
+	}
+	created := false
+	err := global.AlertDB.Transaction(func(tx *gorm.DB) error {
+		var log model.AlertLog
+		if err := tx.Where("id = ? AND status = ?", logID, constant.AlertPushing).First(&log).Error; err != nil {
+			return err
+		}
+		if log.AlertId != alertID || log.Type != alertTask.Type || log.Method != alertTask.Method {
+			return fmt.Errorf("pending alert task does not match delivery log %d", logID)
+		}
+		alertTask.DeliveryLogID = &logID
+		result := tx.Clauses(clause.OnConflict{
+			Columns:   []clause.Column{{Name: "delivery_log_id"}},
+			DoNothing: true,
+		}).Create(alertTask)
+		if result.Error != nil {
+			return result.Error
+		}
+		created = result.RowsAffected > 0
+		return nil
+	})
+	return created, err
+}
+
+func (a *AlertRepo) FinalizePendingAlertTask(logID uint, succeeded bool, message string, fallback *model.AlertTask) (bool, error) {
+	finalized := false
+	err := global.AlertDB.Transaction(func(tx *gorm.DB) error {
+		status := constant.AlertError
+		if succeeded {
+			status = constant.AlertSuccess
+			message = ""
+		}
+		result := tx.Model(&model.AlertLog{}).
+			Where("id = ? AND status = ?", logID, constant.AlertPushing).
+			Updates(map[string]interface{}{"status": status, "message": message})
+		if result.Error != nil {
+			return result.Error
+		}
+		if result.RowsAffected == 0 {
+			return nil
+		}
+		finalized = true
+		if !succeeded {
+			return tx.Where("delivery_log_id = ?", logID).Delete(&model.AlertTask{}).Error
+		}
+
+		var count int64
+		if err := tx.Model(&model.AlertTask{}).Where("delivery_log_id = ?", logID).Count(&count).Error; err != nil {
+			return err
+		}
+		if count > 0 {
+			return nil
+		}
+		if fallback == nil {
+			return fmt.Errorf("pending alert task metadata is unavailable for delivery log %d", logID)
+		}
+		fallback.DeliveryLogID = &logID
+		return tx.Create(fallback).Error
+	})
+	return finalized, err
+}
+
 func (a *AlertRepo) DeleteAlertTask(opts ...DBOption) error {
 	db, _ := getAlertDB(opts...)
 	return db.Delete(&model.AlertTask{}).Error
@@ -310,7 +389,23 @@ func (a *AlertRepo) UpdateAlertConfig(maps map[string]interface{}, opts ...DBOpt
 	return db.Model(&model.AlertConfig{}).Updates(maps).Error
 }
 
+func (a *AlertRepo) UpdateAlertConfigWithRevision(maps map[string]interface{}, revision *time.Time, opts ...DBOption) error {
+	if revision == nil {
+		return a.UpdateAlertConfig(maps, opts...)
+	}
+	db, _ := getAlertDB(opts...)
+	result := db.Model(&model.AlertConfig{}).Where("updated_at = ?", *revision).Updates(maps)
+	if result.Error != nil {
+		return result.Error
+	}
+	if result.RowsAffected == 0 {
+		return ErrAlertConfigRevisionConflict
+	}
+	return nil
+}
+
 func (a *AlertRepo) CreateAlertConfig(config *model.AlertConfig) error {
+	ensureAlertConfigUID(config)
 	return global.AlertDB.Model(&model.AlertConfig{}).Create(config).Error
 }
 
@@ -338,6 +433,12 @@ func (a *AlertRepo) WithByTypeNotIn(types []string) DBOption {
 	}
 }
 
+func (a *AlertRepo) WithByDeliveryLogID(logID uint) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		return g.Where("delivery_log_id = ?", logID)
+	}
+}
+
 func (a *AlertRepo) PageAlertConfig(page, size int, opts ...DBOption) (int64, []model.AlertConfig, error) {
 	var configs []model.AlertConfig
 	db := global.AlertDB.Model(&model.AlertConfig{})
@@ -378,26 +479,44 @@ func (a *AlertRepo) SyncAll(data []model.AlertConfig) error {
 		return err
 	}
 
-	oldConfigMap := make(map[string]uint)
+	oldConfigMap := make(map[string]model.AlertConfig)
+	oldConfigByUID := make(map[string]model.AlertConfig)
 	oldConfigByType := make(map[string][]model.AlertConfig)
 	oldConfigByKey := make(map[string][]model.AlertConfig)
 	consumedConfigIDs := make(map[uint]struct{})
 	for _, item := range oldConfigs {
+		if strings.TrimSpace(item.UID) != "" {
+			oldConfigByUID[item.UID] = item
+		}
 		if singletonTypes[item.Type] {
-			oldConfigMap[item.Type] = item.ID
+			oldConfigMap[item.Type] = item
 			continue
 		}
 		oldConfigByType[item.Type] = append(oldConfigByType[item.Type], item)
 		oldConfigByKey[alertConfigSyncKey(item)] = append(oldConfigByKey[alertConfigSyncKey(item)], item)
 	}
 	for _, item := range data {
+		if uid := strings.TrimSpace(item.UID); uid != "" {
+			if matched, ok := oldConfigByUID[uid]; ok && matched.Type != item.Type {
+				tx.Rollback()
+				return fmt.Errorf("alert config UID %q belongs to type %q, not %q", uid, matched.Type, item.Type)
+			}
+		}
 		if singletonTypes[item.Type] {
-			if val, ok := oldConfigMap[item.Type]; ok {
-				item.ID = val
+			if matched, ok := oldConfigMap[item.Type]; ok {
+				if err := inheritAlertConfigSyncState(&item, matched); err != nil {
+					tx.Rollback()
+					return err
+				}
 				delete(oldConfigMap, item.Type)
 				consumedConfigIDs[item.ID] = struct{}{}
 			} else {
 				item.ID = 0
+				ensureAlertConfigUID(&item)
+				if err := validateAlertConfigSyncSecret(&item); err != nil {
+					tx.Rollback()
+					return err
+				}
 			}
 			if item.ID == 0 {
 				if err := tx.Create(&item).Error; err != nil {
@@ -411,9 +530,31 @@ func (a *AlertRepo) SyncAll(data []model.AlertConfig) error {
 			continue
 		}
 
+		if strings.TrimSpace(item.UID) != "" {
+			if matched, ok := oldConfigByUID[item.UID]; ok {
+				delete(oldConfigByUID, item.UID)
+				if err := inheritAlertConfigSyncState(&item, matched); err != nil {
+					tx.Rollback()
+					return err
+				}
+				consumedConfigIDs[item.ID] = struct{}{}
+				if err := tx.Save(&item).Error; err != nil {
+					tx.Rollback()
+					return err
+				}
+				deleteAlertConfigByID(oldConfigByType, matched.ID)
+				deleteAlertConfigByID(oldConfigByKey, matched.ID)
+				continue
+			}
+		}
+
 		key := alertConfigSyncKey(item)
 		if matched, ok := popAlertConfigByKey(oldConfigByKey, key); ok {
-			item.ID = matched.ID
+			delete(oldConfigByUID, matched.UID)
+			if err := inheritAlertConfigSyncState(&item, matched); err != nil {
+				tx.Rollback()
+				return err
+			}
 			consumedConfigIDs[item.ID] = struct{}{}
 			if err := tx.Save(&item).Error; err != nil {
 				tx.Rollback()
@@ -424,7 +565,12 @@ func (a *AlertRepo) SyncAll(data []model.AlertConfig) error {
 		}
 
 		if matched, ok := popUnusedAlertConfigByType(oldConfigByType, usedConfigIDs, item.Type); ok {
-			item.ID = matched.ID
+			delete(oldConfigByUID, matched.UID)
+			deleteAlertConfigByID(oldConfigByKey, matched.ID)
+			if err := inheritAlertConfigSyncState(&item, matched); err != nil {
+				tx.Rollback()
+				return err
+			}
 			consumedConfigIDs[item.ID] = struct{}{}
 			if err := tx.Save(&item).Error; err != nil {
 				tx.Rollback()
@@ -434,6 +580,11 @@ func (a *AlertRepo) SyncAll(data []model.AlertConfig) error {
 		}
 
 		item.ID = 0
+		ensureAlertConfigUID(&item)
+		if err := validateAlertConfigSyncSecret(&item); err != nil {
+			tx.Rollback()
+			return err
+		}
 		if err := tx.Create(&item).Error; err != nil {
 			tx.Rollback()
 			return err
@@ -458,6 +609,63 @@ func (a *AlertRepo) SyncAll(data []model.AlertConfig) error {
 	return nil
 }
 
+func ensureAlertConfigUID(config *model.AlertConfig) {
+	if config != nil && strings.TrimSpace(config.UID) == "" {
+		config.UID = uuid.NewString()
+	}
+}
+
+func inheritAlertConfigSyncState(incoming *model.AlertConfig, existing model.AlertConfig) error {
+	if incoming.Type != existing.Type {
+		return fmt.Errorf("alert config UID %q belongs to type %q, not %q", incoming.UID, existing.Type, incoming.Type)
+	}
+	preserveExistingCustom := incoming.Type == constant.Custom &&
+		existing.Status == constant.AlertDisable &&
+		incoming.Title == existing.Title &&
+		incoming.Status == existing.Status &&
+		incoming.Config == existing.Config &&
+		(incoming.SecretConfig == "" || incoming.SecretConfig == existing.SecretConfig)
+	incoming.ID = existing.ID
+	if strings.TrimSpace(incoming.UID) == "" {
+		incoming.UID = existing.UID
+	}
+	if incoming.Type == constant.Custom && incoming.SecretConfig == "" {
+		incoming.SecretConfig = existing.SecretConfig
+	}
+	if preserveExistingCustom {
+		return nil
+	}
+	return validateAlertConfigSyncSecret(incoming)
+}
+
+func validateAlertConfigSyncSecret(incoming *model.AlertConfig) error {
+	if incoming.Type != constant.Custom {
+		incoming.SecretConfig = ""
+		return nil
+	}
+	if strings.TrimSpace(incoming.SecretConfig) == "" {
+		return fmt.Errorf("custom webhook sync secret is missing")
+	}
+	var version struct {
+		SchemaVersion int `json:"schemaVersion"`
+	}
+	if err := json.Unmarshal([]byte(incoming.Config), &version); err != nil || version.SchemaVersion != 1 {
+		return fmt.Errorf("custom webhook sync config must use schemaVersion 1")
+	}
+	secret := incoming.SecretConfig
+	for _, prefix := range []string{"core:v1:", "agent:v1:"} {
+		if !strings.HasPrefix(secret, prefix) {
+			continue
+		}
+		ciphertext, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(secret, prefix))
+		if err != nil || len(ciphertext) < 32 || len(ciphertext)%16 != 0 {
+			return fmt.Errorf("custom webhook sync secret envelope is invalid")
+		}
+		return nil
+	}
+	return fmt.Errorf("custom webhook sync secret must use a versioned envelope")
+}
+
 func loadUsedAlertConfigIDs(tx *gorm.DB) (map[uint]struct{}, error) {
 	var alerts []model.Alert
 	if err := tx.Select("method").Find(&alerts).Error; err != nil {

agent/app/repo/app_launcher.go

@@ -3,6 +3,7 @@ package repo
 import (
 	"github.com/1Panel-dev/1Panel/agent/app/model"
 	"github.com/1Panel-dev/1Panel/agent/global"
+	"gorm.io/gorm"
 )
 
 type LauncherRepo struct{}
@@ -17,6 +18,11 @@ type ILauncherRepo interface {
 	GetQuickJump(opts ...DBOption) (model.QuickJump, error)
 	ListQuickJump(withAll bool) []model.QuickJump
 	UpdateQuicks(quicks []model.QuickJump) error
+	ListQuickDirectories() ([]model.QuickDirectory, error)
+	CountQuickDirectories() (int64, error)
+	CreateQuickDirectory(item *model.QuickDirectory) error
+	UpdateQuickDirectory(item *model.QuickDirectory) error
+	DeleteQuickDirectory(id uint, legacy bool) error
 }
 
 func NewILauncherRepo() ILauncherRepo {
@@ -95,13 +101,73 @@ func (u *LauncherRepo) UpdateQuicks(quicks []model.QuickJump) error {
 	for _, item := range quicks {
 		if err := tx.Model(&model.QuickJump{}).Where("id = ?", item.ID).Updates(map[string]interface{}{
 			"is_show": item.IsShow,
-			"detail":  item.Detail,
-			"alias":   item.Alias,
 		}).Error; err != nil {
 			tx.Rollback()
 			return err
 		}
 	}
-	tx.Commit()
+	return tx.Commit().Error
+}
+
+// Legacy entries remain in the overview configuration until explicitly deleted.
+func legacyQuickDirectories(db *gorm.DB) *gorm.DB {
+	return db.Model(&model.QuickJump{}).Where("name = ? AND is_show = ? AND detail <> ?", "File", true, "")
+}
+
+func (u *LauncherRepo) ListQuickDirectories() ([]model.QuickDirectory, error) {
+	items := make([]model.QuickDirectory, 0)
+	if err := global.DB.Order("id ASC").Find(&items).Error; err != nil {
+		return nil, err
+	}
+	var quicks []model.QuickJump
+	if err := legacyQuickDirectories(global.DB).Order("id ASC").Find(&quicks).Error; err != nil {
+		return nil, err
+	}
+	for _, quick := range quicks {
+		items = append(items, model.QuickDirectory{BaseModel: quick.BaseModel, Path: quick.Detail, Alias: quick.Alias, Legacy: true})
+	}
+	return items, nil
+}
+func (u *LauncherRepo) CountQuickDirectories() (int64, error) {
+	var count, legacyCount int64
+	if err := global.DB.Model(&model.QuickDirectory{}).Count(&count).Error; err != nil {
+		return 0, err
+	}
+	if err := legacyQuickDirectories(global.DB).Count(&legacyCount).Error; err != nil {
+		return 0, err
+	}
+	return count + legacyCount, nil
+}
+func (u *LauncherRepo) CreateQuickDirectory(item *model.QuickDirectory) error {
+	return global.DB.Create(item).Error
+}
+func (u *LauncherRepo) UpdateQuickDirectory(item *model.QuickDirectory) error {
+	var result *gorm.DB
+	if item.Legacy {
+		result = legacyQuickDirectories(global.DB).Where("id = ?", item.ID).Updates(map[string]interface{}{"detail": item.Path, "alias": item.Alias})
+	} else {
+		result = global.DB.Model(&model.QuickDirectory{}).Where("id = ?", item.ID).Updates(map[string]interface{}{"path": item.Path, "alias": item.Alias})
+	}
+	if result.Error != nil {
+		return result.Error
+	}
+	if result.RowsAffected == 0 {
+		return gorm.ErrRecordNotFound
+	}
+	return nil
+}
+func (u *LauncherRepo) DeleteQuickDirectory(id uint, legacy bool) error {
+	var result *gorm.DB
+	if legacy {
+		result = legacyQuickDirectories(global.DB).Where("id = ?", id).Updates(map[string]interface{}{"detail": nil, "alias": nil})
+	} else {
+		result = global.DB.Delete(&model.QuickDirectory{}, id)
+	}
+	if result.Error != nil {
+		return result.Error
+	}
+	if result.RowsAffected == 0 {
+		return gorm.ErrRecordNotFound
+	}
 	return nil
 }

agent/app/repo/common.go

@@ -108,7 +108,7 @@ func WithByAPIType(apiType string) DBOption {
 
 func WithTextAPIType() DBOption {
 	return func(g *gorm.DB) *gorm.DB {
-		return g.Where("api_type NOT LIKE ?", "%-images")
+		return g.Where("api_type NOT LIKE ? AND api_type <> ?", "%-images", "openai-embeddings")
 	}
 }
 

agent/app/repo/host.go

@@ -22,11 +22,6 @@ type IHostRepo interface {
 	WithByPort(port uint) DBOption
 	WithByUser(user string) DBOption
 
-	GetFirewallRecord(opts ...DBOption) (model.Firewall, error)
-	ListFirewallRecord(opts ...DBOption) ([]model.Firewall, error)
-	SaveFirewallRecord(firewall *model.Firewall) error
-	DeleteFirewallRecordByID(id uint) error
-
 	SyncCert(data []model.RootCert) error
 	GetCert(opts ...DBOption) (model.RootCert, error)
 	PageCert(limit, offset int, opts ...DBOption) (int64, []model.RootCert, error)
@@ -34,8 +29,6 @@ type IHostRepo interface {
 	SaveCert(cert *model.RootCert) error
 	UpdateCert(id uint, vars map[string]interface{}) error
 	DeleteCert(opts ...DBOption) error
-
-	WithByChain(chain string) DBOption
 }
 
 func NewIHostRepo() IHostRepo {
@@ -116,65 +109,6 @@ func (h *HostRepo) Delete(opts ...DBOption) error {
 	return db.Delete(&model.Host{}).Error
 }
 
-func (h *HostRepo) GetFirewallRecord(opts ...DBOption) (model.Firewall, error) {
-	var firewall model.Firewall
-	db := global.DB
-	for _, opt := range opts {
-		db = opt(db)
-	}
-	err := db.First(&firewall).Error
-	return firewall, err
-}
-
-func (h *HostRepo) ListFirewallRecord(opts ...DBOption) ([]model.Firewall, error) {
-	var firewalls []model.Firewall
-	db := global.DB
-	for _, opt := range opts {
-		db = opt(db)
-	}
-	if err := global.DB.Find(&firewalls).Error; err != nil {
-		return firewalls, nil
-	}
-	return firewalls, nil
-}
-
-func (h *HostRepo) SaveFirewallRecord(firewall *model.Firewall) error {
-	if firewall.ID != 0 {
-		return global.DB.Save(firewall).Error
-	}
-	var data model.Firewall
-	switch firewall.Type {
-	case "port":
-		_ = global.DB.Where("type = ? AND dst_port = ? AND protocol = ? AND src_ip = ? AND strategy = ?", "port",
-			firewall.DstPort,
-			firewall.Protocol,
-			firewall.SrcIP,
-			firewall.Strategy,
-		).First(&data).Error
-	case "ip":
-		_ = global.DB.Where("type = ? AND src_ip = ? AND strategy = ?", "address", firewall.SrcIP, firewall.Strategy).First(&data)
-	default:
-		_ = global.DB.Where("type = ? AND chain = ? AND src_port = ? AND dst_port = ? AND protocol = ? AND src_ip = ? AND dst_ip = ? AND strategy = ?",
-			firewall.Type,
-			firewall.Chain,
-			firewall.SrcPort,
-			firewall.DstPort,
-			firewall.Protocol,
-			firewall.SrcIP,
-			firewall.DstIP,
-			firewall.Strategy,
-		).First(&data).Error
-	}
-	if data.ID != 0 {
-		firewall.ID = data.ID
-	}
-	return global.DB.Save(firewall).Error
-}
-
-func (h *HostRepo) DeleteFirewallRecordByID(id uint) error {
-	return global.DB.Where("id = ?", id).Delete(&model.Firewall{}).Error
-}
-
 func (u *HostRepo) GetCert(opts ...DBOption) (model.RootCert, error) {
 	var cert model.RootCert
 	db := global.DB
@@ -253,9 +187,3 @@ func (u *HostRepo) SyncCert(data []model.RootCert) error {
 	tx.Commit()
 	return nil
 }
-
-func (u *HostRepo) WithByChain(chain string) DBOption {
-	return func(g *gorm.DB) *gorm.DB {
-		return g.Where("chain = ?", chain)
-	}
-}

agent/app/repo/monitor.go

@@ -1,6 +1,8 @@
 package repo
 
 import (
+	"fmt"
+	"strings"
 	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/app/model"
@@ -10,11 +12,25 @@ import (
 
 type MonitorRepo struct{}
 
+type GPUHistoryPoint struct {
+	model.MonitorGPU
+	Bucket        int64
+	PowerPercent  *float64
+	MemoryPercent *float64
+	ProcessCount  *float64
+}
+
 type IMonitorRepo interface {
+	CleanHost() error
+	CleanGPU() error
 	GetBase(opts ...DBOption) ([]model.MonitorBase, error)
-	GetGPU(opts ...DBOption) ([]model.MonitorGPU, error)
+	CountGPU(opts ...DBOption) (int64, error)
+	GetGPUHistory(start time.Time, bucketSeconds int64, aggregation string, opts ...DBOption) ([]GPUHistoryPoint, error)
+	GetGPUDevices() ([]model.MonitorGPU, error)
 	GetIO(opts ...DBOption) ([]model.MonitorIO, error)
 	GetNetwork(opts ...DBOption) ([]model.MonitorNetwork, error)
+	GetIONames() ([]string, error)
+	GetNetworkNames() ([]string, error)
 
 	CreateMonitorBase(model model.MonitorBase) error
 	BatchCreateMonitorGPU(list []model.MonitorGPU) error
@@ -25,13 +41,26 @@ type IMonitorRepo interface {
 	DelMonitorIO(timeForDelete time.Time) error
 	DelMonitorNet(timeForDelete time.Time) error
 
-	WithByProductName(name string) DBOption
+	WithByGPUDevice(deviceID, name string, legacy bool) DBOption
 }
 
 func NewIMonitorRepo() IMonitorRepo {
 	return &MonitorRepo{}
 }
 
+func (s *MonitorRepo) CleanHost() error {
+	for _, item := range []interface{}{&model.MonitorBase{}, &model.MonitorIO{}, &model.MonitorNetwork{}} {
+		if err := global.MonitorDB.Where("1 = 1").Delete(item).Error; err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (s *MonitorRepo) CleanGPU() error {
+	return global.GPUMonitorDB.Where("1 = 1").Delete(&model.MonitorGPU{}).Error
+}
+
 func (u *MonitorRepo) GetBase(opts ...DBOption) ([]model.MonitorBase, error) {
 	var data []model.MonitorBase
 	db := global.MonitorDB
@@ -59,20 +88,25 @@ func (u *MonitorRepo) GetNetwork(opts ...DBOption) ([]model.MonitorNetwork, erro
 	err := db.Find(&data).Error
 	return data, err
 }
-func (u *MonitorRepo) GetGPU(opts ...DBOption) ([]model.MonitorGPU, error) {
-	var data []model.MonitorGPU
-	db := global.GPUMonitorDB
-	for _, opt := range opts {
-		db = opt(db)
-	}
-	err := db.Find(&data).Error
-	return data, err
+func (u *MonitorRepo) GetIONames() ([]string, error) {
+	var names []string
+	err := global.MonitorDB.Model(&model.MonitorIO{}).Distinct().Pluck("name", &names).Error
+	return names, err
+}
+
+func (u *MonitorRepo) GetNetworkNames() ([]string, error) {
+	var names []string
+	err := global.MonitorDB.Model(&model.MonitorNetwork{}).Distinct().Pluck("name", &names).Error
+	return names, err
 }
 
 func (u *MonitorRepo) CreateMonitorBase(model model.MonitorBase) error {
 	return global.MonitorDB.Create(&model).Error
 }
 func (s *MonitorRepo) BatchCreateMonitorGPU(list []model.MonitorGPU) error {
+	if len(list) == 0 {
+		return nil
+	}
 	return global.GPUMonitorDB.CreateInBatches(&list, len(list)).Error
 }
 func (u *MonitorRepo) BatchCreateMonitorIO(ioList []model.MonitorIO) error {
@@ -94,8 +128,67 @@ func (s *MonitorRepo) DelMonitorGPU(timeForDelete time.Time) error {
 	return global.GPUMonitorDB.Where("created_at < ?", timeForDelete).Delete(&model.MonitorGPU{}).Error
 }
 
-func (s *MonitorRepo) WithByProductName(name string) DBOption {
-	return func(g *gorm.DB) *gorm.DB {
-		return g.Where("product_name = ?", name)
+func (u *MonitorRepo) GetGPUDevices() ([]model.MonitorGPU, error) {
+	var data []model.MonitorGPU
+	err := global.GPUMonitorDB.Model(&model.MonitorGPU{}).Select("device_id, product_name, device_type").Group("device_id, product_name, device_type").Order("product_name, device_id").Find(&data).Error
+	return data, err
+}
+
+func (u *MonitorRepo) WithByGPUDevice(deviceID, name string, legacy bool) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		if deviceID != "" {
+			return db.Where("device_id = ?", deviceID)
+		}
+		db = db.Where("product_name = ?", name)
+		if legacy {
+			db = db.Where("device_id IS NULL OR device_id = ''")
+		}
+		return db
 	}
 }
+
+func (u *MonitorRepo) CountGPU(opts ...DBOption) (int64, error) {
+	db := global.GPUMonitorDB.Model(&model.MonitorGPU{})
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	var count int64
+	err := db.Count(&count).Error
+	return count, err
+}
+
+func (u *MonitorRepo) GetGPUHistory(start time.Time, bucketSeconds int64, aggregation string, opts ...DBOption) ([]GPUHistoryPoint, error) {
+	db := global.GPUMonitorDB.Model(&model.MonitorGPU{})
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	expressions := []string{
+		"CASE WHEN max_power_limit > 0 THEN 100.0 * power_draw / max_power_limit END",
+		"CASE WHEN mem_total > 0 AND mem_used IS NOT NULL THEN 100.0 * mem_used / mem_total ELSE memory_util END",
+		"CASE WHEN (process_status = 'ok' OR process_status IS NULL OR process_status = '') AND json_valid(processes) THEN CASE WHEN json_type(processes) = 'array' THEN json_array_length(processes) END END",
+	}
+	aliases := []string{"power_percent", "memory_percent", "process_count"}
+	columns := []string{"*"}
+	if bucketSeconds > 0 {
+		operation := "AVG"
+		if aggregation == "max" {
+			operation = "MAX"
+		}
+		columns = []string{fmt.Sprintf("(CAST(strftime('%%s', created_at) AS INTEGER) - %d) / %d AS bucket", start.Unix(), bucketSeconds)}
+		for _, column := range []string{"memory_activity", "encoder_util", "decoder_util", "jpeg_util", "ofa_util", "media_util", "compute_util", "copy_util", "hotspot_temperature", "fan_rpm", "ai_cpu_util", "ctrl_cpu_util", "ddr_used", "ddr_total", "hbm_used", "hbm_total", "ddr_bandwidth", "hbm_bandwidth", "memory_bandwidth", "media_frequency", "hugepages_used", "hugepages_total", "gpu_util", "temperature", "memory_temperature", "power_draw", "max_power_limit", "mem_used", "mem_total", "frequency", "memory_frequency", "fan_speed"} {
+			columns = append(columns, operation+"("+column+") AS "+column)
+		}
+		for i := range expressions {
+			expressions[i] = operation + "(" + expressions[i] + ")"
+		}
+		db = db.Group("bucket").Order("bucket ASC")
+	} else {
+		db = db.Order("created_at ASC, id ASC")
+	}
+	for i, expression := range expressions {
+		columns = append(columns, expression+" AS "+aliases[i])
+	}
+	var data []GPUHistoryPoint
+	err := db.Select(strings.Join(columns, ", ")).Scan(&data).Error
+	return data, err
+}

agent/app/repo/monitor_vllm.go

@@ -0,0 +1,132 @@
+package repo
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"gorm.io/gorm"
+)
+
+type VLLMMonitorRepo struct{}
+
+type VLLMHistoryPoint struct {
+	model.MonitorVLLM
+	Bucket            int64
+	CompletedRequests *float64
+}
+
+func (r *VLLMMonitorRepo) Create(point *model.MonitorVLLM) error {
+	return global.VLLMMonitorDB.Create(point).Error
+}
+
+func (r *VLLMMonitorRepo) Latest(id uint) (model.MonitorVLLM, error) {
+	var point model.MonitorVLLM
+	db := global.VLLMMonitorDB.Where("app_install_id = ?", id)
+	err := db.Order("created_at DESC, id DESC").First(&point).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return point, nil
+	}
+	return point, err
+}
+
+func (r *VLLMMonitorRepo) CleanTarget(id uint) error {
+	return global.VLLMMonitorDB.Where("app_install_id = ?", id).Delete(&model.MonitorVLLM{}).Error
+}
+
+func (r *VLLMMonitorRepo) DeleteBefore(before time.Time) error {
+	return global.VLLMMonitorDB.Where("created_at < ?", before).Delete(&model.MonitorVLLM{}).Error
+}
+
+func (r *VLLMMonitorRepo) Count(ctx context.Context, id uint, start, end time.Time) (int64, error) {
+	var count int64
+	db := global.VLLMMonitorDB.WithContext(ctx).Model(&model.MonitorVLLM{}).Where("app_install_id = ? AND created_at >= ? AND created_at <= ?", id, start, end)
+	err := db.Count(&count).Error
+	return count, err
+}
+
+func (r *VLLMMonitorRepo) History(ctx context.Context, id uint, start, end time.Time, seconds int64, aggregation, group string) ([]VLLMHistoryPoint, error) {
+	db := global.VLLMMonitorDB.WithContext(ctx).Model(&model.MonitorVLLM{}).Where("app_install_id = ? AND created_at >= ? AND created_at <= ?", id, start, end)
+	var metrics []string
+	if group == "" || group == "overview" {
+		metrics = append(metrics, "running", "waiting", "cache_usage", "prompt_throughput", "generation_throughput", "request_throughput")
+		if seconds <= 0 || aggregation == "max" {
+			metrics = append(metrics, "prefix_cache_hit_rate")
+		}
+	}
+	if seconds <= 0 || aggregation == "max" {
+		if group == "" || group == "latency" {
+			metrics = append(metrics, "queue_time", "time_to_first_token", "time_per_output_token", "request_latency", "prefill_time", "decode_time", "time_to_first_token_p50", "time_to_first_token_p90", "time_to_first_token_p95", "time_to_first_token_p99", "time_per_output_token_p50", "time_per_output_token_p90", "time_per_output_token_p95", "time_per_output_token_p99", "request_latency_p50", "request_latency_p90", "request_latency_p95", "request_latency_p99")
+		}
+		if group == "" || group == "requests" {
+			metrics = append(metrics, "average_generation_tokens")
+		}
+	}
+	var columns []string
+	if seconds > 0 {
+		operation := "AVG"
+		if aggregation == "max" {
+			operation = "MAX"
+		}
+		columns = []string{fmt.Sprintf("(CAST(strftime('%%s', created_at) AS INTEGER) - %d) / %d AS bucket", start.Unix(), seconds)}
+		for _, column := range metrics {
+			columns = append(columns, operation+"("+column+") AS "+column)
+		}
+		db = db.Group("bucket").Order("bucket ASC")
+	} else {
+		columns = append([]string{"id", "created_at", "app_install_id", "status", "sample_interval_seconds"}, metrics...)
+		if group == "" || group == "requests" {
+			columns = append(columns, "histogram_deltas", "request_deltas")
+		}
+		db = db.Order("created_at ASC, id ASC")
+	}
+	if group == "" || group == "overview" {
+		count := "CASE WHEN json_valid(request_deltas) THEN CASE WHEN json_extract(request_deltas, '$.seconds') > 0 THEN ROUND(request_throughput * json_extract(request_deltas, '$.seconds')) END END"
+		if seconds > 0 {
+			count = "SUM(" + count + ")"
+		}
+		columns = append(columns, count+" AS completed_requests")
+	}
+	var points []VLLMHistoryPoint
+	err := db.Select(strings.Join(columns, ", ")).Scan(&points).Error
+	return points, err
+}
+
+func (r *VLLMMonitorRepo) WalkDeltas(ctx context.Context, id uint, start, end time.Time, seconds int64, aggregation, group string, visit func(int64, string, string) error) error {
+	histograms, requests := "''", "''"
+	if group == "" || group == "requests" || (group == "latency" && aggregation != "max") {
+		histograms = "COALESCE(histogram_deltas, '')"
+	}
+	if group == "" || group == "requests" || (group == "overview" && aggregation != "max") {
+		requests = "COALESCE(request_deltas, '')"
+	}
+	if histograms == "''" && requests == "''" {
+		return ctx.Err()
+	}
+	bucket := fmt.Sprintf("(CAST(strftime('%%s', created_at) AS INTEGER) - %d) / %d", start.Unix(), seconds)
+	rows, err := global.VLLMMonitorDB.WithContext(ctx).Model(&model.MonitorVLLM{}).
+		Where("app_install_id = ? AND created_at >= ? AND created_at <= ?", id, start, end).
+		Select(bucket + ", " + histograms + ", " + requests).Rows()
+	if err != nil {
+		return err
+	}
+	defer rows.Close()
+	for rows.Next() {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		var index int64
+		var histograms, requests string
+		if err := rows.Scan(&index, &histograms, &requests); err != nil {
+			return err
+		}
+		if err := visit(index, histograms, requests); err != nil {
+			return err
+		}
+	}
+	return rows.Err()
+}

agent/app/repo/setting.go

@@ -1,11 +1,13 @@
 package repo
 
 import (
+	"context"
 	"errors"
 
 	"github.com/1Panel-dev/1Panel/agent/app/model"
 	"github.com/1Panel-dev/1Panel/agent/global"
 	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
 )
 
 type SettingRepo struct{}
@@ -14,17 +16,22 @@ type ISettingRepo interface {
 	GetList(opts ...DBOption) ([]model.Setting, error)
 	Get(opts ...DBOption) (model.Setting, error)
 	GetValueByKey(key string) (string, error)
+	GetCoreValueByKey(key string) (string, error)
 	Create(key, value string) error
 	Update(key, value string) error
 	WithByKey(key string) DBOption
 
 	UpdateOrCreate(key, value string) error
+	UpdateValues(map[string]string) error
 
 	GetDescription(opts ...DBOption) (model.CommonDescription, error)
 	GetDescriptionList(opts ...DBOption) ([]model.CommonDescription, error)
 	CreateDescription(data *model.CommonDescription) error
+	SaveDescriptions(context.Context, []model.CommonDescription) error
 	UpdateDescription(id string, val map[string]interface{}) error
 	DelDescription(id string) error
+	DeleteDescriptions(context.Context, string, []string, bool) (int64, error)
+	WithDescriptionIDs(ids []string) DBOption
 	WithByDescriptionID(id string) DBOption
 }
 
@@ -68,6 +75,17 @@ func (s *SettingRepo) GetValueByKey(key string) (string, error) {
 	return setting.Value, nil
 }
 
+func (s *SettingRepo) GetCoreValueByKey(key string) (string, error) {
+	if global.CoreDB == nil {
+		return "", errors.New("core database is unavailable")
+	}
+	var setting model.Setting
+	if err := global.CoreDB.Where("key = ?", key).First(&setting).Error; err != nil {
+		return "", err
+	}
+	return setting.Value, nil
+}
+
 func (s *SettingRepo) WithByKey(key string) DBOption {
 	return func(g *gorm.DB) *gorm.DB {
 		return g.Where("key = ?", key)
@@ -90,6 +108,25 @@ func (s *SettingRepo) UpdateOrCreate(key, value string) error {
 	return global.DB.Model(&setting).UpdateColumn("value", value).Error
 }
 
+func (s *SettingRepo) UpdateValues(values map[string]string) error {
+	return global.DB.Transaction(func(tx *gorm.DB) error {
+		for key, value := range values {
+			var setting model.Setting
+			err := tx.Where("key = ?", key).First(&setting).Error
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				if err := tx.Create(&model.Setting{Key: key, Value: value}).Error; err != nil {
+					return err
+				}
+			} else if err != nil {
+				return err
+			} else if err := tx.Model(&setting).UpdateColumn("value", value).Error; err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+}
+
 func (s *SettingRepo) GetDescriptionList(opts ...DBOption) ([]model.CommonDescription, error) {
 	var lists []model.CommonDescription
 	db := global.DB.Model(&model.CommonDescription{})
@@ -111,14 +148,42 @@ func (s *SettingRepo) GetDescription(opts ...DBOption) (model.CommonDescription,
 func (s *SettingRepo) CreateDescription(data *model.CommonDescription) error {
 	return global.DB.Create(data).Error
 }
+
+func (s *SettingRepo) SaveDescriptions(ctx context.Context, descriptions []model.CommonDescription) error {
+	return global.DB.WithContext(ctx).Clauses(clause.OnConflict{
+		Columns:   []clause.Column{{Name: "id"}},
+		DoUpdates: clause.AssignmentColumns([]string{"description"}),
+	}).CreateInBatches(&descriptions, 100).Error
+}
+
 func (s *SettingRepo) UpdateDescription(id string, val map[string]interface{}) error {
 	return global.DB.Model(&model.CommonDescription{}).Where("id = ?", id).Updates(val).Error
 }
 func (s *SettingRepo) DelDescription(id string) error {
 	return global.DB.Where("id = ?", id).Delete(&model.CommonDescription{}).Error
 }
+
+func (s *SettingRepo) DeleteDescriptions(ctx context.Context, kind string, ids []string, emptyOnly bool) (int64, error) {
+	var deleted int64
+	for start := 0; start < len(ids); start += 500 {
+		query := global.DB.WithContext(ctx).Where("type = ? AND id IN ?", kind, ids[start:min(start+500, len(ids))])
+		if emptyOnly {
+			query = query.Where("description = ? AND is_pinned = ?", "", false)
+		}
+		result := query.Delete(&model.CommonDescription{})
+		deleted += result.RowsAffected
+		if result.Error != nil {
+			return deleted, result.Error
+		}
+	}
+	return deleted, nil
+}
 func (s *SettingRepo) WithByDescriptionID(id string) DBOption {
 	return func(g *gorm.DB) *gorm.DB {
 		return g.Where("id = ?", id)
 	}
 }
+
+func (s *SettingRepo) WithDescriptionIDs(ids []string) DBOption {
+	return func(db *gorm.DB) *gorm.DB { return db.Where("id IN ?", ids) }
+}

agent/app/repo/task.go

@@ -2,6 +2,7 @@ package repo
 
 import (
 	"context"
+	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/global"
@@ -110,7 +111,9 @@ func (t TaskRepo) Update(ctx context.Context, task *model.Task) error {
 }
 
 func (t TaskRepo) UpdateRunningTaskToFailed() error {
-	return getTaskDb(t.WithByStatus(constant.StatusExecuting)).Model(&model.Task{}).Updates(map[string]interface{}{"status": constant.StatusFailed, "error_msg": "1Panel restart causes failure"}).Error
+	return getTaskDb(t.WithByStatus(constant.StatusExecuting)).Model(&model.Task{}).Updates(map[string]interface{}{
+		"status": constant.StatusFailed, "error_msg": constant.InterruptedMsg, "end_at": time.Now(),
+	}).Error
 }
 
 func (t TaskRepo) CountExecutingTask() (int64, error) {

agent/app/service/agents.go

@@ -88,6 +88,7 @@ type IAgentService interface {
 
 	GetFeishuConfig(req dto.AgentFeishuConfigReq) (*dto.AgentFeishuConfig, error)
 	UpdateFeishuConfig(req dto.AgentFeishuConfigUpdateReq) error
+	SwitchFeishuPlugin(req dto.AgentFeishuSwitchReq) error
 	GetTelegramConfig(req dto.AgentTelegramConfigReq) (*dto.AgentTelegramConfig, error)
 	UpdateTelegramConfig(req dto.AgentTelegramConfigUpdateReq) error
 	GetDiscordConfig(req dto.AgentIDReq) (*dto.AgentDiscordConfig, error)
@@ -142,6 +143,9 @@ const (
 
 func (a AgentService) Create(req dto.AgentCreateReq) (*dto.AgentItem, error) {
 	agentType := req.AgentType
+	if err := validateNativeAgentCreate(req); err != nil {
+		return nil, err
+	}
 	if err := checkPortExist(req.WebUIPort); err != nil {
 		return nil, err
 	}
@@ -237,6 +241,8 @@ func (a AgentService) Create(req dto.AgentCreateReq) (*dto.AgentItem, error) {
 		}
 	} else if agentType == constant.AppCopaw {
 		dashboardAuth = normalizeAgentDashboardAuth(req.DashboardUsername, req.DashboardPassword)
+	} else if agentType == constant.AppDeepSeekHarness || agentType == constant.AppOctop {
+		dashboardAuth = agentDashboardAuth{Username: req.DashboardUsername, Password: req.DashboardPassword}
 	}
 
 	params := map[string]interface{}{
@@ -245,6 +251,12 @@ func (a AgentService) Create(req dto.AgentCreateReq) (*dto.AgentItem, error) {
 		constant.HostIP:      "",
 	}
 	setAgentWebUIParams(params, agentType, detail.Version, req.WebUIPort)
+	if agentType == constant.AppDeepSeekHarness {
+		params["HTTPS_ACCESS_HOST"] = req.AccessHost
+	}
+	if agentType == constant.AppOctop {
+		params["OCTOP_LOG_LEVEL"] = "info"
+	}
 	if agentType == constant.AppOpenclaw {
 		if allowedOrigin := firstAllowedOrigin(allowedOrigins); allowedOrigin != "" {
 			params["ALLOWED_ORIGIN"] = allowedOrigin
@@ -738,7 +750,7 @@ func requiresAgentAccount(agentType string) bool {
 }
 
 func setAgentWebUIParams(params map[string]interface{}, agentType, appVersion string, webUIPort int) {
-	if agentType == constant.AppOpenclaw && isOpenclawHTTPSWindowVersion(appVersion) {
+	if agentType == constant.AppDeepSeekHarness || agentType == constant.AppOpenclaw && isOpenclawHTTPSWindowVersion(appVersion) {
 		params["PANEL_APP_PORT_HTTPS"] = webUIPort
 		return
 	}
@@ -936,6 +948,7 @@ func (a AgentService) GetModelConfig(req dto.AgentIDReq) (*dto.AgentModelConfig,
 		AccountID: agent.AccountID,
 		Model:     model,
 		Fallbacks: extractOpenclawFallbackModelIDs(conf, account, models, model),
+		Metadata:  extractOpenclawModelMetadata(conf, account, models),
 	}, nil
 }
 
@@ -967,7 +980,7 @@ func (a AgentService) UpdateModelConfig(req dto.AgentModelConfigUpdateReq) error
 		if agent.AgentType != constant.AppOpenclaw {
 			return fmt.Errorf("%s does not support", agent.AgentType)
 		}
-		if err := writeOpenclawConfig(confDir, account, modelName, agent.Token, nil, req.Fallbacks); err != nil {
+		if err := writeOpenclawConfig(confDir, account, modelName, agent.Token, nil, req.Fallbacks, req.Metadata); err != nil {
 			return err
 		}
 	}
@@ -1043,7 +1056,7 @@ func (a AgentService) CreateAccount(req dto.AgentAccountCreateReq) error {
 		return err
 	}
 	validateAvailability := req.ValidateAvailability == nil || *req.ValidateAvailability
-	resolvedInput, err := resolveAgentAccountInput(provider, req.APIType, req.AuthMode, req.APIKey, req.BaseURL, verifyModel, validateAvailability)
+	resolvedInput, err := resolveAgentAccountInput(provider, req.APIType, req.AuthMode, req.APIKey, req.BaseURL, verifyModel, validateAvailability, false)
 	if err != nil {
 		return err
 	}
@@ -1096,12 +1109,15 @@ func (a AgentService) UpdateAccount(req dto.AgentAccountUpdateReq) error {
 	if strings.TrimSpace(requestedVerifyModel) == "" {
 		requestedVerifyModel = account.VerifyModel
 	}
-	verifyModel, err := resolveAgentAccountVerifyModel(provider, requestedVerifyModel, models)
-	if err != nil {
-		return err
+	verifyModel := ""
+	if account.AppInstallID == 0 || len(models) > 0 {
+		verifyModel, err = resolveAgentAccountVerifyModel(provider, requestedVerifyModel, models)
+		if err != nil {
+			return err
+		}
 	}
 	validateAvailability := req.ValidateAvailability == nil || *req.ValidateAvailability
-	resolvedInput, err := resolveAgentAccountInput(provider, req.APIType, req.AuthMode, req.APIKey, req.BaseURL, verifyModel, validateAvailability)
+	resolvedInput, err := resolveAgentAccountInput(provider, req.APIType, req.AuthMode, req.APIKey, req.BaseURL, verifyModel, validateAvailability, account.AppInstallID != 0 && len(models) == 0)
 	if err != nil {
 		return err
 	}
@@ -1115,7 +1131,7 @@ func (a AgentService) UpdateAccount(req dto.AgentAccountUpdateReq) error {
 	account.Remark = req.Remark
 	account.Verified = true
 
-	if err := global.DB.Save(account).Error; err != nil {
+	if err := agentAccountRepo.Save(account); err != nil {
 		return err
 	}
 	terminalai.InvalidateTerminalRuntimeCache()
@@ -1146,13 +1162,34 @@ func (a AgentService) PageAccounts(req dto.AgentAccountSearch) (int64, []dto.Age
 	if err != nil {
 		return 0, nil, err
 	}
+	installIDs := make([]uint, 0, len(list))
+	for _, account := range list {
+		if account.AppInstallID != 0 {
+			installIDs = append(installIDs, account.AppInstallID)
+		}
+	}
+	localInstalls := make(map[uint]bool, len(installIDs))
+	if len(installIDs) > 0 {
+		installs, err := appInstallRepo.ListBy(context.Background(), repo.WithByIDs(installIDs))
+		if err != nil {
+			return 0, nil, err
+		}
+		for _, install := range installs {
+			localInstalls[install.ID] = true
+		}
+	}
 	items := make([]dto.AgentAccountInfo, 0, len(list))
 	for _, item := range list {
 		apiKey := ""
 		if item.RememberAPIKey {
 			apiKey = item.APIKey
 		}
+		appInstallID := uint(0)
+		if localInstalls[item.AppInstallID] {
+			appInstallID = item.AppInstallID
+		}
 		items = append(items, dto.AgentAccountInfo{
+			AppInstallID:    appInstallID,
 			ID:              item.ID,
 			MasterAccountID: item.MasterAccountID,
 			Provider:        item.Provider,
@@ -1350,13 +1387,27 @@ func (a AgentService) SyncAgentsByAccount(account *model.AgentAccount) error {
 }
 
 func (a AgentService) VerifyAccount(req dto.AgentAccountVerifyReq) error {
-	_, err := resolveAgentAccountInput(req.Provider, req.APIType, req.AuthMode, req.APIKey, req.BaseURL, req.Model, true)
+	_, err := resolveAgentAccountInput(req.Provider, req.APIType, req.AuthMode, req.APIKey, req.BaseURL, req.Model, true, false)
 	return err
 }
 
 func (a AgentService) DeleteAccount(req dto.AgentAccountDeleteReq) error {
 	agentAccountMutationMu.Lock()
 	defer agentAccountMutationMu.Unlock()
+	account, err := agentAccountRepo.GetFirst(repo.WithByID(req.ID))
+	if err != nil {
+		return err
+	}
+	if account.AppInstallID != 0 && account.Provider != "ollama" {
+		_, err := appInstallRepo.GetFirst(repo.WithByID(account.AppInstallID))
+		if err == nil {
+			return buserr.WithDetail("ErrInvalidParams", "Delete the local inference engine instead", nil)
+		}
+		if !errors.Is(err, gorm.ErrRecordNotFound) {
+			return err
+		}
+	}
+
 	if err := global.DB.Transaction(func(tx *gorm.DB) error {
 		var agentCount int64
 		if err := tx.Model(&model.Agent{}).Where("account_id = ?", req.ID).Count(&agentCount).Error; err != nil {
@@ -1541,6 +1592,10 @@ func (a AgentService) UpdateConfigFile(req dto.AgentConfigFileUpdateReq) error {
 	if err != nil {
 		return err
 	}
+	if _, busy := feishuSwitches.LoadOrStore(agent.ConfigPath, true); busy {
+		return buserr.New("TaskIsExecuting")
+	}
+	defer feishuSwitches.Delete(agent.ConfigPath)
 	if err := validateAgentConfigFileContent(agent.AgentType, req.Content); err != nil {
 		return err
 	}
@@ -1684,7 +1739,7 @@ func (a AgentService) syncAgentsByAccount(account *model.AgentAccount) error {
 				return err
 			}
 			fallbacks := extractOpenclawFallbackModelIDs(conf, account, accountModels, selectedAccountModel.ID)
-			if err := writeOpenclawConfig(confDir, account, modelName, agent.Token, nil, fallbacks); err != nil {
+			if err := writeOpenclawConfig(confDir, account, modelName, agent.Token, nil, fallbacks, nil); err != nil {
 				return err
 			}
 		case constant.AppHermesAgent:

agent/app/service/agents_channels.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"path"
+	"slices"
 	"sort"
 	"strings"
 	"time"
@@ -44,9 +45,29 @@ func (a AgentService) GetFeishuConfig(req dto.AgentFeishuConfigReq) (*dto.AgentF
 	if err != nil {
 		return nil, err
 	}
+	if agent.AgentType != constant.AppOpenclaw || !isOpenclawBundledFeishuVersion(install.Version) {
+		result := extractFeishuConfig(conf)
+		result.Installed, _ = checkPluginInstalled(install.GetPath(), "feishu")
+		return &result, nil
+	}
+	legacy, configured, err := classifyLegacyFeishu(conf, install.GetPath())
+	if err != nil {
+		return nil, err
+	}
 	result := extractFeishuConfig(conf)
-	installed, _ := checkPluginInstalled(install.GetPath(), "feishu")
-	result.Installed = installed
+	if !legacy {
+		result = extractBundledFeishuConfig(conf)
+	}
+	result.BuiltinManaged = true
+	result.BuiltinAvailable = hasBundledFeishu(install.ContainerName)
+	result.Installed = result.BuiltinAvailable
+	result.Legacy, result.LegacyConfigured = legacy, configured
+	if legacy {
+		result.GroupSessionScope = "group"
+		if result.ThreadSession {
+			result.GroupSessionScope = "group_topic"
+		}
+	}
 	return &result, nil
 }
 
@@ -71,6 +92,9 @@ func (a AgentService) UpdateFeishuConfig(req dto.AgentFeishuConfigUpdateReq) err
 			})
 		})
 	}
+	if agent.AgentType == constant.AppOpenclaw && isOpenclawBundledFeishuVersion(install.Version) {
+		return saveBundledFeishuConfig(agent, install, req)
+	}
 	return a.mutateAgentConfig(req.AgentID, func(_ *model.Agent, _ *model.AppInstall, conf map[string]interface{}) error {
 		config := dto.AgentFeishuConfig{
 			Enabled:        req.Enabled,
@@ -357,6 +381,9 @@ func (a AgentService) InstallPlugin(req dto.AgentPluginInstallReq) error {
 	if err != nil {
 		return err
 	}
+	if req.Type == "feishu" && agent.AgentType == constant.AppOpenclaw && isOpenclawBundledFeishuVersion(install.Version) {
+		return buserr.New("ErrFeishuManaged")
+	}
 	if err := task.CheckScopeTaskIsExecuting(task.TaskScopeAI, req.AgentID); err != nil {
 		return err
 	}
@@ -402,6 +429,9 @@ func (a AgentService) UpgradePlugin(req dto.AgentPluginUpgradeReq) error {
 	if err != nil {
 		return err
 	}
+	if req.Type == "feishu" && agent.AgentType == constant.AppOpenclaw && isOpenclawBundledFeishuVersion(install.Version) {
+		return buserr.New("ErrFeishuManaged")
+	}
 	if err := task.CheckScopeTaskIsExecuting(task.TaskScopeAI, req.AgentID); err != nil {
 		return err
 	}
@@ -442,6 +472,9 @@ func (a AgentService) UninstallPlugin(req dto.AgentPluginUninstallReq) error {
 	if err != nil {
 		return err
 	}
+	if req.Type == "feishu" && agent.AgentType == constant.AppOpenclaw && isOpenclawBundledFeishuVersion(install.Version) {
+		return buserr.New("ErrFeishuManaged")
+	}
 	if err := task.CheckScopeTaskIsExecuting(task.TaskScopeAI, req.AgentID); err != nil {
 		return err
 	}
@@ -537,10 +570,13 @@ func (a AgentService) DeleteChannelConfig(req dto.AgentChannelDeleteReq) error {
 }
 
 func (a AgentService) CheckPlugin(req dto.AgentPluginCheckReq) (*dto.AgentPluginStatus, error) {
-	_, install, err := a.loadAgentAndInstall(req.AgentID)
+	agent, install, err := a.loadAgentAndInstall(req.AgentID)
 	if err != nil {
 		return nil, err
 	}
+	if req.Type == "feishu" && agent.AgentType == constant.AppOpenclaw && isOpenclawBundledFeishuVersion(install.Version) {
+		return &dto.AgentPluginStatus{Installed: hasBundledFeishu(install.ContainerName)}, nil
+	}
 	installed, err := checkPluginInstalled(install.GetPath(), req.Type)
 	if err != nil {
 		return nil, err
@@ -1320,6 +1356,10 @@ func appendPluginAllow(conf map[string]interface{}, pluginID string) {
 }
 
 func installOpenclawPlugin(mgr *cmd.CommandHelper, containerName, spec, pluginID string) error {
+	help, err := cmd.RunDockerExecWithStdout(time.Minute, containerName, "openclaw", "plugins", "install", "--help")
+	if err != nil {
+		return err
+	}
 	workdir := path.Join(openclawPluginPackageTmpDir, pluginID)
 	defer func() {
 		_ = mgr.Run("docker", "exec", containerName, "rm", "-rf", workdir)
@@ -1341,7 +1381,19 @@ func installOpenclawPlugin(mgr *cmd.CommandHelper, containerName, spec, pluginID
 	if pkgPath == "" {
 		return fmt.Errorf("openclaw plugin package not found")
 	}
-	return mgr.Run("docker", "exec", containerName, "openclaw", "plugins", "install", pkgPath, "--dangerously-force-unsafe-install")
+	args := []string{"exec", containerName, "openclaw", "plugins", "install", pkgPath}
+	// Newer CLIs require source confirmation; older releases do not support --force.
+	options := strings.Fields(help)
+	if slices.Contains(options, "--force") {
+		args = append(args, "--force")
+	} else if slices.Contains(options, "--dangerously-force-unsafe-install") {
+		args = append(args, "--dangerously-force-unsafe-install")
+	}
+	// Source confirmation does not grant the selected channel plugin's capabilities.
+	if slices.Contains(options, "--accept-capabilities") {
+		args = append(args, "--accept-capabilities")
+	}
+	return mgr.Run("docker", args...)
 }
 
 func uninstallOpenclawPlugin(mgr *cmd.CommandHelper, containerName, pluginID string) error {

agent/app/service/agents_feishu.go

@@ -0,0 +1,677 @@
+package service
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"sync"
+	"syscall"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/app/task"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/i18n"
+	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
+	"github.com/1Panel-dev/1Panel/agent/utils/common"
+	"github.com/1Panel-dev/1Panel/agent/utils/compose"
+)
+
+// Keep panel configuration writes out of the backup/activation/recovery window.
+var feishuSwitches sync.Map
+
+func isOpenclawBundledFeishuVersion(version string) bool {
+	return common.CompareAppVersion(version, "2026.10.7")
+}
+
+func hasBundledFeishu(container string) bool {
+	image, err := feishuContainerImage(container)
+	if err != nil {
+		return false
+	}
+	_, err = bundledFeishuImage(image)
+	return err == nil
+}
+
+func usesBundledFeishu(conf map[string]interface{}) bool {
+	f := getChannelConfig(conf, "feishu")
+	for _, key := range []string{"threadSession", "replyMode"} {
+		if _, old := f[key]; old {
+			return false
+		}
+	}
+	if _, old := f["streaming"].(bool); old {
+		return false
+	}
+	entries := childMap(childMap(conf, "plugins"), "entries")
+	if extractBoolValue(childMap(entries, "openclaw-lark")["enabled"], false) {
+		return false
+	}
+	_, streaming := f["streaming"].(map[string]interface{})
+	_, selected := entries["feishu"]
+	return selected && (extractBoolValue(childMap(entries, "feishu")["enabled"], false) || f["groupSessionScope"] != nil || streaming)
+}
+
+func hasLegacyFeishu(conf map[string]interface{}, installPath string) bool {
+	legacy, _, err := classifyLegacyFeishu(conf, installPath)
+	return err != nil || legacy
+}
+
+func selectBundledFeishu(conf map[string]interface{}, enabled bool) {
+	plugins := ensureChildMap(conf, "plugins")
+	entries := ensureChildMap(plugins, "entries")
+	if legacy, ok := entries["openclaw-lark"]; ok {
+		if entry, ok := legacy.(map[string]interface{}); ok {
+			entry["enabled"] = false
+		}
+	}
+	ensureChildMap(entries, "feishu")["enabled"] = enabled
+	// Preserve an absent allowlist; creating one would disable unrelated plugins.
+	if allow, ok := plugins["allow"]; ok && len(extractStringList(allow)) > 0 {
+		ids := slices.DeleteFunc(extractStringList(allow), func(id string) bool { return id == "openclaw-lark" })
+		if !slices.Contains(ids, "feishu") {
+			ids = append(ids, "feishu")
+		}
+		plugins["allow"] = ids
+	}
+	if deny, ok := plugins["deny"]; ok {
+		plugins["deny"] = slices.DeleteFunc(extractStringList(deny), func(id string) bool { return id == "feishu" })
+	}
+}
+
+func feishuConfigError(field string) error { return buserr.WithDetail("ErrFeishuConfig", field, nil) }
+
+func convertLegacyFeishu(conf map[string]interface{}, req dto.AgentFeishuSwitchReq) error {
+	f := getChannelConfig(conf, "feishu")
+	if len(f) == 0 {
+		if raw, exists := childMap(conf, "channels")["feishu"]; exists && raw != nil {
+			if _, ok := raw.(map[string]interface{}); !ok {
+				return feishuConfigError("channels.feishu")
+			}
+		}
+		f = ensureChildMap(ensureChildMap(conf, "channels"), "feishu")
+		f["enabled"], f["dmPolicy"], f["groupPolicy"] = false, "pairing", "allowlist"
+	}
+	if err := checkLegacyFeishuFields(f, "channels.feishu", false); err != nil {
+		return err
+	}
+	if err := convertFeishuAccess(f, "channels.feishu"); err != nil {
+		return err
+	}
+	delete(f, "threadSession")
+	delete(f, "replyMode")
+	f["streaming"] = map[string]interface{}{"mode": "off"}
+	if req.Streaming {
+		f["streaming"] = map[string]interface{}{"mode": "partial"}
+	}
+	f["groupSessionScope"] = req.GroupSessionScope
+	f["requireMention"] = req.RequireMention == "true"
+	delete(f, "topicSessionMode")
+	// Preserve legacy defaults explicitly; bundled defaults are more restrictive.
+	if _, ok := f["groupPolicy"]; !ok {
+		f["groupPolicy"] = "open"
+	}
+	entries := ensureChildMap(ensureChildMap(conf, "plugins"), "entries")
+	ensureChildMap(entries, "openclaw-lark")["enabled"] = false
+	selectBundledFeishu(conf, extractBoolValue(f["enabled"], true))
+	return nil
+}
+
+// Limit automatic conversion to the shared channel fields; custom plugin options require review.
+func checkLegacyFeishuFields(f map[string]interface{}, field string, group bool) error {
+	allowed := strings.Fields("enabled name appId appSecret encryptKey verificationToken domain connectionMode webhookPath defaultAccount dmPolicy allowFrom groupPolicy groupAllowFrom groupSenderAllowFrom requireMention accounts groups streaming threadSession replyMode groupSessionScope topicSessionMode replyInThread")
+	if group {
+		allowed = strings.Fields("enabled requireMention allowFrom groupSessionScope topicSessionMode replyInThread")
+	}
+	for _, key := range sortedChildKeys(f) {
+		if !slices.Contains(allowed, key) {
+			return feishuConfigError(field + "." + key)
+		}
+	}
+	if enabled, exists := f["enabled"]; exists {
+		if _, ok := enabled.(bool); !ok {
+			return feishuConfigError(field + ".enabled")
+		}
+	}
+	for _, key := range []string{"dmPolicy", "groupPolicy"} {
+		if raw, exists := f[key]; exists {
+			value, ok := raw.(string)
+			options := []string{"open", "allowlist", "disabled"}
+			if key == "dmPolicy" {
+				options = append(options, "pairing")
+			}
+			if !ok || !slices.Contains(options, value) {
+				return feishuConfigError(field + "." + key)
+			}
+		}
+	}
+	for _, key := range []string{"allowFrom", "groupSenderAllowFrom"} {
+		if raw, exists := f[key]; exists {
+			values, ok := raw.([]interface{})
+			if !ok {
+				return feishuConfigError(field + "." + key)
+			}
+			for _, value := range values {
+				if _, ok := value.(string); !ok {
+					return feishuConfigError(field + "." + key)
+				}
+			}
+		}
+	}
+	for _, section := range []string{"accounts", "groups"} {
+		raw, exists := f[section]
+		if !exists {
+			continue
+		}
+		entries, ok := raw.(map[string]interface{})
+		if !ok {
+			return feishuConfigError(field + "." + section)
+		}
+		for _, id := range sortedChildKeys(entries) {
+			entry, ok := entries[id].(map[string]interface{})
+			name := field + "." + section + "." + id
+			if !ok {
+				return feishuConfigError(name)
+			}
+			if err := checkLegacyFeishuFields(entry, name, section == "groups"); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func convertFeishuAccess(f map[string]interface{}, field string) error {
+	if raw, ok := f["groupAllowFrom"]; ok {
+		values, ok := raw.([]interface{})
+		if !ok {
+			return feishuConfigError(field + ".groupAllowFrom")
+		}
+		groups, senders := []string{}, []string{}
+		for _, value := range values {
+			id, ok := value.(string)
+			if !ok {
+				return feishuConfigError(field + ".groupAllowFrom")
+			}
+			switch {
+			case strings.HasPrefix(id, "oc_"):
+				groups = append(groups, id)
+			case strings.HasPrefix(id, "ou_"):
+				senders = append(senders, id)
+			default:
+				return feishuConfigError(field + ".groupAllowFrom")
+			}
+		}
+		// A sender-only legacy allowlist has different group admission semantics.
+		if len(senders) > 0 && (len(groups) == 0 || f["groupSenderAllowFrom"] != nil) {
+			return feishuConfigError(field + ".groupAllowFrom")
+		}
+		f["groupAllowFrom"] = groups
+		if len(senders) > 0 {
+			f["groupSenderAllowFrom"] = senders
+		}
+	}
+	for _, section := range []string{"accounts", "groups"} {
+		for id, value := range childMap(f, section) {
+			entry, ok := value.(map[string]interface{})
+			name := field + "." + section + "." + id
+			if !ok {
+				return feishuConfigError(name)
+			}
+			// Account/group overrides must be resolved explicitly, not flattened.
+			for _, key := range []string{"threadSession", "replyMode"} {
+				if _, ok := entry[key]; ok {
+					return feishuConfigError(name + "." + key)
+				}
+			}
+			if mention, ok := entry["requireMention"]; ok {
+				if _, ok := mention.(bool); !ok {
+					return feishuConfigError(name + ".requireMention")
+				}
+			}
+			if raw, exists := entry["streaming"]; exists {
+				streaming, ok := raw.(bool)
+				if !ok || streaming {
+					return feishuConfigError(name + ".streaming")
+				}
+				entry["streaming"] = map[string]interface{}{"mode": "off"}
+			}
+			if err := convertFeishuAccess(entry, name); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func extractBundledFeishuConfig(conf map[string]interface{}) dto.AgentFeishuConfig {
+	result := extractFeishuConfig(conf)
+	f := getChannelConfig(conf, "feishu")
+	result.Enabled = extractBoolValue(f["enabled"], true) && extractBoolValue(childMap(childMap(childMap(conf, "plugins"), "entries"), "feishu")["enabled"], true)
+	result.GroupSessionScope = extractStringValue(f["groupSessionScope"])
+	if result.GroupSessionScope == "" {
+		result.GroupSessionScope = "group"
+	}
+	result.Streaming = extractStringValue(childMap(f, "streaming")["mode"]) != "off"
+	result.GroupPolicy = extractStringValue(f["groupPolicy"])
+	if result.GroupPolicy == "" {
+		result.GroupPolicy = "allowlist"
+	}
+	if len(f) == 0 {
+		result.Streaming = false
+		result.RequireMention = "true"
+	} else if _, ok := f["requireMention"]; !ok {
+		result.RequireMention = "open"
+	}
+	accounts := childMap(f, "accounts")
+	ids := sortedChildKeys(accounts)
+	if (f["appId"] != nil || f["appSecret"] != nil) && !slices.Contains(ids, "default") {
+		ids = append([]string{"default"}, ids...)
+	}
+	result.Bots = []dto.AgentFeishuBot{}
+	for _, id := range ids {
+		effective := make(map[string]interface{}, len(f))
+		for k, v := range f {
+			effective[k] = v
+		}
+		for k, v := range childMap(accounts, id) {
+			effective[k] = v
+		}
+		bot := defaultFeishuBot()
+		bot.AccountID, bot.IsDefault = id, id == "default"
+		bot.Name = extractDisplayName(childMap(accounts, id), "", id)
+		bot.Enabled = extractBoolValue(childMap(accounts, id)["enabled"], true)
+		bot.AppID, bot.AppSecret = extractStringValue(effective["appId"]), extractStringValue(effective["appSecret"])
+		bot.DmPolicy = extractStringValue(effective["dmPolicy"])
+		if bot.DmPolicy == "" {
+			bot.DmPolicy = "pairing"
+		}
+		bot.AllowFrom = extractStringList(effective["allowFrom"])
+		result.Bots = append(result.Bots, bot)
+	}
+	return result
+}
+
+func setBundledFeishuConfig(conf map[string]interface{}, req dto.AgentFeishuConfigUpdateReq) error {
+	if !slices.Contains([]string{"group", "group_sender", "group_topic", "group_topic_sender"}, req.GroupSessionScope) {
+		return feishuConfigError("groupSessionScope")
+	}
+	f := ensureChildMap(ensureChildMap(conf, "channels"), "feishu")
+	accounts := childMap(f, "accounts")
+	seen := map[string]bool{}
+	appIDs := map[string]bool{}
+	for _, bot := range req.Bots {
+		if bot.AccountID == "" || bot.AccountID != strings.ToLower(strings.TrimSpace(bot.AccountID)) || seen[bot.AccountID] || appIDs[bot.AppID] || bot.AppID == "" || !slices.Contains([]string{"pairing", "open", "allowlist", "disabled"}, bot.DmPolicy) || (bot.DmPolicy == "allowlist" && len(bot.AllowFrom) == 0) {
+			return feishuConfigError("accounts")
+		}
+		seen[bot.AccountID] = true
+		appIDs[bot.AppID] = true
+		entry := childMap(accounts, bot.AccountID)
+		if _, exists := entry["appSecret"]; !exists && bot.AppSecret == "" {
+			entry["appSecret"] = f["appSecret"]
+		}
+		// SecretRef credentials cannot be represented by the form: keep them intact.
+		if _, secretRef := entry["appSecret"].(map[string]interface{}); !secretRef && bot.AppSecret == "" {
+			return feishuConfigError("accounts." + bot.AccountID + ".appSecret")
+		}
+		entry["appId"], entry["name"], entry["enabled"], entry["dmPolicy"] = bot.AppID, bot.Name, bot.Enabled, bot.DmPolicy
+		if bot.AppSecret != "" {
+			entry["appSecret"] = bot.AppSecret
+		}
+		switch bot.DmPolicy {
+		case "open":
+			entry["allowFrom"] = []string{"*"}
+		case "allowlist":
+			entry["allowFrom"] = bot.AllowFrom
+		default:
+			if len(bot.AllowFrom) > 0 {
+				entry["allowFrom"] = bot.AllowFrom
+			} else {
+				entry["allowFrom"] = []string{}
+			}
+		}
+		accounts[bot.AccountID] = entry
+	}
+	for id := range accounts {
+		if !seen[id] {
+			delete(accounts, id)
+		}
+	}
+	if !seen["default"] {
+		delete(f, "appId")
+		delete(f, "appSecret")
+	}
+	if id := extractStringValue(f["defaultAccount"]); id != "" && !seen[id] {
+		return feishuConfigError("defaultAccount")
+	}
+	if len(accounts) > 0 {
+		f["accounts"] = accounts
+	} else {
+		delete(f, "accounts")
+	}
+	f["enabled"], f["groupSessionScope"], f["groupPolicy"] = req.Enabled, req.GroupSessionScope, req.GroupPolicy
+	if req.RequireMention == "open" {
+		delete(f, "requireMention")
+	} else {
+		f["requireMention"] = req.RequireMention == "true"
+	}
+	if req.GroupPolicy == "allowlist" {
+		f["groupAllowFrom"] = req.GroupAllowFrom
+	} else {
+		delete(f, "groupAllowFrom")
+	}
+	streaming := ensureChildMap(f, "streaming")
+	streaming["mode"] = "off"
+	if req.Streaming {
+		streaming["mode"] = "partial"
+	}
+	selectBundledFeishu(conf, req.Enabled && hasEnabledBots(req.Bots))
+	return nil
+}
+
+// Write beside the original so validation and rename preserve the mounted filesystem and owner.
+func stageFeishuConfig(configPath string, payload []byte) (string, error) {
+	info, err := os.Lstat(configPath)
+	if err != nil {
+		return "", err
+	}
+	if !info.Mode().IsRegular() {
+		return "", feishuConfigError("openclaw.json")
+	}
+	f, err := os.CreateTemp(filepath.Dir(configPath), ".feishu-*.json")
+	if err != nil {
+		return "", err
+	}
+	name := f.Name()
+	defer func() {
+		f.Close()
+		if err != nil {
+			os.Remove(name)
+		}
+	}()
+	if stat, ok := info.Sys().(*syscall.Stat_t); ok {
+		err = f.Chown(int(stat.Uid), int(stat.Gid))
+	}
+	if err == nil {
+		err = f.Chmod(info.Mode().Perm())
+	}
+	if err == nil {
+		_, err = f.Write(payload)
+	}
+	if err == nil {
+		err = f.Sync()
+	}
+	if err == nil {
+		err = f.Close()
+	}
+	return name, err
+}
+
+func validateFeishuConfig(container, configPath string) error {
+	out, err := cmd.RunDockerExecWithStdout(time.Minute, container, "env", "OPENCLAW_CONFIG_PATH=/home/node/.openclaw/"+filepath.Base(configPath), "openclaw", "config", "validate", "--json")
+	return feishuValidationResult(out, err)
+}
+
+func replaceFeishuConfig(configPath string, expected, payload []byte) error {
+	tmp, err := stageFeishuConfig(configPath, payload)
+	if err != nil {
+		return err
+	}
+	defer os.Remove(tmp)
+	current, err := os.ReadFile(configPath)
+	if err != nil {
+		return err
+	}
+	if !bytes.Equal(current, expected) {
+		return buserr.New("ErrFeishuConfigChanged")
+	}
+	return os.Rename(tmp, configPath)
+}
+
+func (a AgentService) SwitchFeishuPlugin(req dto.AgentFeishuSwitchReq) error {
+	agent, install, err := a.loadOpenclawAgentAndInstall(req.AgentID)
+	if err != nil {
+		return err
+	}
+	if !isOpenclawBundledFeishuVersion(install.Version) {
+		return buserr.New("ErrFeishuImageRequired")
+	}
+	if _, busy := feishuSwitches.LoadOrStore(agent.ConfigPath, true); busy {
+		return buserr.New("TaskIsExecuting")
+	}
+	started := false
+	defer func() {
+		if !started {
+			feishuSwitches.Delete(agent.ConfigPath)
+		}
+	}()
+	if err := task.CheckScopeTaskIsExecuting(task.TaskScopeAI, req.AgentID); err != nil {
+		return err
+	}
+	if !hasBundledFeishu(install.ContainerName) {
+		return buserr.New("ErrFeishuImageRequired")
+	}
+	conf, err := readOpenclawConfig(agent.ConfigPath)
+	if err != nil {
+		return err
+	}
+	legacy, configured, err := classifyLegacyFeishu(conf, install.GetPath())
+	if err != nil {
+		return err
+	}
+	if !legacy {
+		return buserr.New("ErrFeishuAlreadySwitched")
+	}
+	if err := prepareLegacyFeishu(conf, configured, &dto.AgentFeishuTransition{Confirmed: true, Streaming: req.Streaming, GroupSessionScope: req.GroupSessionScope, RequireMention: req.RequireMention}); err != nil {
+		return err
+	}
+	switchTask, err := task.NewTaskWithOps("Feishu", task.TaskUpdate, task.TaskScopeAI, req.TaskID, req.AgentID)
+	if err != nil {
+		return err
+	}
+	switchTask.AddSubTaskWithAlias("AgentFeishuSwitch", func(t *task.Task) error { return a.runFeishuSwitch(agent, install, req, t) }, nil)
+	started = true
+	go func() { defer feishuSwitches.Delete(agent.ConfigPath); executeAgentPluginTask(switchTask) }()
+	return nil
+}
+
+func (a AgentService) runFeishuSwitch(agent *model.Agent, install *model.AppInstall, req dto.AgentFeishuSwitchReq, t *task.Task) (result error) {
+	original, conf, err := readFeishuConfigBytes(agent.ConfigPath)
+	if err != nil {
+		return err
+	}
+	legacy, configured, err := classifyLegacyFeishu(conf, install.GetPath())
+	if err != nil {
+		return err
+	}
+	if !legacy {
+		return buserr.New("ErrFeishuAlreadySwitched")
+	}
+	image, err := feishuContainerImage(install.ContainerName)
+	if err != nil {
+		return err
+	}
+	image, err = bundledFeishuImage(image)
+	if err != nil {
+		return err
+	}
+	if err = prepareLegacyFeishu(conf, configured, &dto.AgentFeishuTransition{Confirmed: true, Streaming: req.Streaming, GroupSessionScope: req.GroupSessionScope, RequireMention: req.RequireMention}); err != nil {
+		return err
+	}
+	payload, err := json.MarshalIndent(conf, "", "  ")
+	if err != nil {
+		return err
+	}
+	recovery, err := feishuRecoveryPayload(payload, configured)
+	if err != nil {
+		return err
+	}
+	// Validate both candidates without invoking Doctor or mutating retained state.
+	for _, candidate := range [][]byte{payload, recovery} {
+		staged, stageErr := stageFeishuConfig(agent.ConfigPath, candidate)
+		if stageErr != nil {
+			return stageErr
+		}
+		validateErr := validateFeishuImageConfig(image, staged)
+		os.Remove(staged)
+		if validateErr != nil {
+			return validateErr
+		}
+	}
+	if _, err = compose.Stop(install.GetComposePath()); err != nil {
+		return err
+	}
+	replaced := false
+	defer func() {
+		if !replaced {
+			if _, startErr := compose.Operate(install.GetComposePath(), "start"); startErr != nil {
+				result = errors.Join(result, buserr.WithErr("ErrFeishuRestore", startErr))
+			}
+			return
+		}
+		if result == nil {
+			return
+		}
+		if _, stopErr := compose.Stop(install.GetComposePath()); stopErr != nil {
+			result = errors.Join(result, buserr.WithErr("ErrFeishuRestore", stopErr))
+			return
+		}
+		if restoreErr := replaceFeishuConfig(agent.ConfigPath, payload, recovery); restoreErr != nil {
+			result = errors.Join(result, buserr.WithErr("ErrFeishuRestore", restoreErr))
+			return
+		}
+		if _, startErr := compose.Operate(install.GetComposePath(), "start"); startErr != nil {
+			result = errors.Join(result, buserr.WithErr("ErrFeishuRestore", startErr))
+			return
+		}
+		if healthErr := verifyFeishuActivation(install.ContainerName, false); healthErr != nil {
+			result = errors.Join(result, buserr.WithErr("ErrFeishuRestore", healthErr))
+			return
+		}
+		t.Log(i18n.GetMsgByKey("AgentFeishuRecoveryDisabled"))
+	}()
+	current, err := os.ReadFile(agent.ConfigPath)
+	if err != nil {
+		return err
+	}
+	if !bytes.Equal(current, original) {
+		return buserr.New("ErrFeishuConfigChanged")
+	}
+	backup, err := backupFeishuConfig(agent.ConfigPath, original)
+	if err != nil {
+		return err
+	}
+	t.Log(i18n.GetWithName("AgentFeishuBackup", filepath.Base(backup)))
+	if err = replaceFeishuConfig(agent.ConfigPath, original, payload); err != nil {
+		return err
+	}
+	replaced = true
+	if _, err = compose.Operate(install.GetComposePath(), "start"); err != nil {
+		return err
+	}
+	enabled := configured && extractBoolValue(getChannelConfig(conf, "feishu")["enabled"], true)
+	if err = verifyFeishuActivation(install.ContainerName, enabled); err != nil {
+		return err
+	}
+	if enabled {
+		probeFeishuConnection(install.ContainerName, t)
+	}
+	if configured {
+		t.Log(i18n.GetMsgByKey("AgentFeishuVerifyMessages"))
+	} else {
+		t.Log(i18n.GetMsgByKey("AgentFeishuRecoveryDisabled"))
+	}
+	return nil
+}
+
+func saveBundledFeishuConfig(agent *model.Agent, install *model.AppInstall, req dto.AgentFeishuConfigUpdateReq) error {
+	if !isOpenclawBundledFeishuVersion(install.Version) {
+		return buserr.New("ErrFeishuImageRequired")
+	}
+	if _, busy := feishuSwitches.LoadOrStore(agent.ConfigPath, true); busy {
+		return buserr.New("TaskIsExecuting")
+	}
+	defer feishuSwitches.Delete(agent.ConfigPath)
+	if err := task.CheckScopeTaskIsExecuting(task.TaskScopeAI, req.AgentID); err != nil {
+		return err
+	}
+	if !hasBundledFeishu(install.ContainerName) {
+		return buserr.New("ErrFeishuImageRequired")
+	}
+	original, err := os.ReadFile(agent.ConfigPath)
+	if err != nil {
+		return err
+	}
+	var conf map[string]interface{}
+	if err = json.Unmarshal(original, &conf); err != nil {
+		return err
+	}
+	if hasLegacyFeishu(conf, install.GetPath()) {
+		return buserr.New("ErrFeishuSwitchRequired")
+	}
+	if err = setBundledFeishuConfig(conf, req); err != nil {
+		return err
+	}
+	payload, err := json.MarshalIndent(conf, "", "  ")
+	if err != nil {
+		return err
+	}
+	staged, err := stageFeishuConfig(agent.ConfigPath, payload)
+	if err != nil {
+		return err
+	}
+	defer os.Remove(staged)
+	if err = validateFeishuConfig(install.ContainerName, staged); err != nil {
+		return err
+	}
+	return replaceFeishuConfig(agent.ConfigPath, original, payload)
+}
+
+func feishuProbeOK(output string) bool {
+	raw, err := extractEmbeddedJSON(output)
+	if err != nil {
+		return false
+	}
+	var status struct {
+		ChannelAccounts map[string][]struct {
+			Enabled    bool `json:"enabled"`
+			Configured bool `json:"configured"`
+			Running    bool `json:"running"`
+			Probe      struct {
+				OK bool `json:"ok"`
+			} `json:"probe"`
+		} `json:"channelAccounts"`
+	}
+	if json.Unmarshal(raw, &status) != nil {
+		return false
+	}
+	accounts, ok := status.ChannelAccounts["feishu"]
+	if !ok {
+		return false
+	}
+	for _, account := range accounts {
+		if account.Enabled && (!account.Configured || !account.Running || !account.Probe.OK) {
+			return false
+		}
+	}
+	return true
+}
+
+func feishuGatewayReady(output string, enabled bool) bool {
+	raw, err := extractEmbeddedJSON(output)
+	if err != nil {
+		return false
+	}
+	var health struct {
+		OK      bool `json:"ok"`
+		Plugins struct {
+			Loaded []string `json:"loaded"`
+		} `json:"plugins"`
+	}
+	return json.Unmarshal(raw, &health) == nil && health.OK && !slices.Contains(health.Plugins.Loaded, "openclaw-lark") && (!enabled || slices.Contains(health.Plugins.Loaded, "feishu"))
+}

agent/app/service/agents_feishu_runtime.go

@@ -0,0 +1,201 @@
+package service
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
+	"github.com/1Panel-dev/1Panel/agent/utils/docker"
+	"github.com/docker/docker/api/types/container"
+)
+
+// Inspect a stopped disposable container; its entrypoint never touches retained state.
+func bundledFeishuImage(image string) (string, error) {
+	cli, err := docker.NewDockerClient()
+	if err != nil {
+		return "", err
+	}
+	defer cli.Close()
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	info, _, err := cli.ImageInspectWithRaw(ctx, image)
+	if err != nil {
+		return "", buserr.New("ErrFeishuImageRequired")
+	}
+	created, err := cli.ContainerCreate(ctx, &container.Config{Image: info.ID, Entrypoint: []string{"/bin/true"}}, &container.HostConfig{NetworkMode: "none"}, nil, nil, "")
+	if err != nil {
+		return "", err
+	}
+	defer func() {
+		cleanup, done := context.WithTimeout(context.Background(), 10*time.Second)
+		defer done()
+		_ = cli.ContainerRemove(cleanup, created.ID, container.RemoveOptions{Force: true, RemoveVolumes: true})
+	}()
+	if _, err = cli.ContainerStatPath(ctx, created.ID, "/app/.1panel-feishu-bundled-v1"); err != nil {
+		return "", buserr.New("ErrFeishuImageRequired")
+	}
+	return info.ID, nil
+}
+
+func feishuContainerImage(name string) (string, error) {
+	cli, err := docker.NewDockerClient()
+	if err != nil {
+		return "", err
+	}
+	defer cli.Close()
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+	info, err := cli.ContainerInspect(ctx, name)
+	if err != nil {
+		return "", err
+	}
+	return info.Image, nil
+}
+
+// The original state is read-only and the normal Doctor entrypoint is bypassed.
+func validateFeishuImageConfig(image, configPath string) error {
+	info, err := os.Stat(configPath)
+	if err != nil {
+		return err
+	}
+	uid, gid := uint32(1000), uint32(1000)
+	if stat, ok := info.Sys().(*syscall.Stat_t); ok {
+		uid, gid = stat.Uid, stat.Gid
+	}
+	user := fmt.Sprintf("%d:%d", uid, gid)
+	tmpfs := fmt.Sprintf("/tmp:rw,mode=0700,uid=%d,gid=%d", uid, gid)
+	name := "1panel-feishu-" + strings.TrimSuffix(filepath.Base(configPath), ".json")
+	mgr := cmd.NewCommandMgr(cmd.WithTimeout(2 * time.Minute))
+	defer func() { _ = cmd.NewCommandMgr(cmd.WithTimeout(15*time.Second)).Run("docker", "rm", "-f", "-v", name) }()
+	out, runErr := mgr.RunWithStdout("docker", "run", "--name", name, "--rm", "--network", "none", "--read-only", "--user", user,
+		"--tmpfs", tmpfs,
+		"--mount", "type=bind,src="+filepath.Dir(configPath)+",dst=/home/node/.openclaw,readonly",
+		"--env", "HOME=/home/node", "--env", "TMPDIR=/tmp", "--env", "OPENCLAW_STATE_DIR=/tmp/state",
+		"--env", "OPENCLAW_CONFIG_PATH=/home/node/.openclaw/"+filepath.Base(configPath),
+		"--entrypoint", "sh", image, "-c", "mkdir -m 700 /tmp/state && ln -s /home/node/.openclaw/extensions /tmp/state/extensions && exec node /app/openclaw.mjs config validate --json")
+	return feishuValidationResult(out, runErr)
+}
+
+func feishuValidationResult(out string, runErr error) error {
+	raw, _ := extractEmbeddedJSON(out)
+	var result struct {
+		Valid  bool `json:"valid"`
+		Issues []struct {
+			Path string `json:"path"`
+		} `json:"issues"`
+	}
+	if json.Unmarshal(raw, &result) == nil && result.Valid && runErr == nil {
+		return nil
+	}
+	fields := []string{}
+	for _, issue := range result.Issues {
+		if issue.Path != "" {
+			fields = append(fields, issue.Path)
+		}
+	}
+	if len(fields) == 0 {
+		fields = append(fields, "openclaw.json")
+	}
+	return feishuConfigError(strings.Join(fields, ", "))
+}
+
+func backupFeishuConfig(configPath string, original []byte) (string, error) {
+	f, err := os.CreateTemp(filepath.Dir(configPath), ".feishu-backup-*.json")
+	if err != nil {
+		return "", err
+	}
+	if _, err = f.Write(original); err == nil {
+		err = f.Sync()
+	}
+	closeErr := f.Close()
+	if err != nil {
+		return "", err
+	}
+	if closeErr != nil {
+		return "", closeErr
+	}
+	return f.Name(), nil
+}
+
+// Doctor can spend 94 seconds waiting for the previous container's owner lease.
+func waitOpenclawReady(name string) error {
+	script := `const fs=require('fs');const c=JSON.parse(fs.readFileSync('/home/node/.openclaw/openclaw.json','utf8'));const tls=c.gateway?.tls?.enabled===true;const h=require(tls?'https':'http');function check(p){const r=h.get({hostname:'127.0.0.1',port:c.gateway?.port||18789,path:p,rejectUnauthorized:false,timeout:3000},s=>{s.resume();if(s.statusCode===404&&p==='/readyz')return check('/healthz');process.exitCode=s.statusCode===200?0:1});r.on('timeout',()=>r.destroy());r.on('error',()=>process.exitCode=1)}check('/readyz')`
+	deadline := time.Now().Add(4 * time.Minute)
+	for time.Now().Before(deadline) {
+		if cmd.RunDockerExec(8*time.Second, name, "node", "-e", script) == nil {
+			return nil
+		}
+		time.Sleep(2 * time.Second)
+	}
+	return buserr.New("ErrFeishuActivation")
+}
+
+func verifyFeishuActivation(name string, enabled bool) error {
+	if err := waitOpenclawReady(name); err != nil {
+		return err
+	}
+	output, err := cmd.RunDockerExecWithStdout(time.Minute, name, "openclaw", "plugins", "list", "--json")
+	if err != nil {
+		return buserr.New("ErrFeishuActivation")
+	}
+	raw, _ := extractEmbeddedJSON(output)
+	var result struct {
+		Plugins []struct {
+			ID     string `json:"id"`
+			Status string `json:"status"`
+			Origin string `json:"origin"`
+		} `json:"plugins"`
+	}
+	if json.Unmarshal(raw, &result) != nil {
+		return buserr.New("ErrFeishuActivation")
+	}
+	found := false
+	for _, p := range result.Plugins {
+		if p.ID == "openclaw-lark" && p.Status != "disabled" {
+			return buserr.New("ErrFeishuActivation")
+		}
+		if p.ID == "feishu" && p.Origin == "bundled" && (p.Status == "loaded" || (!enabled && p.Status == "disabled")) {
+			found = true
+		}
+	}
+	if !found {
+		return buserr.New("ErrFeishuActivation")
+	}
+	health, err := cmd.RunDockerExecWithStdout(20*time.Second, name, "openclaw", "gateway", "health", "--json")
+	if err != nil || !feishuGatewayReady(health, enabled) {
+		return buserr.New("ErrFeishuActivation")
+	}
+	return nil
+}
+
+func readFeishuConfigBytes(file string) ([]byte, map[string]interface{}, error) {
+	info, err := os.Lstat(file)
+	if err != nil {
+		return nil, nil, err
+	}
+	if !info.Mode().IsRegular() {
+		return nil, nil, feishuConfigError("openclaw.json")
+	}
+	f, err := os.Open(file)
+	if err != nil {
+		return nil, nil, err
+	}
+	defer f.Close()
+	raw, err := io.ReadAll(f)
+	if err != nil {
+		return nil, nil, err
+	}
+	var conf map[string]interface{}
+	if err = json.Unmarshal(raw, &conf); err != nil || conf == nil {
+		return nil, nil, feishuConfigError("openclaw.json")
+	}
+	return raw, conf, nil
+}

agent/app/service/agents_hermes_channels.go

@@ -8,11 +8,15 @@ import (
 )
 
 const hermesWeixinLoginScript = `import asyncio
-from gateway.platforms.weixin import qr_login
+try:
+    from plugins.platforms.weixin.adapter import qr_login
+except ModuleNotFoundError as exc:
+    if exc.name not in ('plugins', 'plugins.platforms', 'plugins.platforms.weixin', 'plugins.platforms.weixin.adapter'):
+        raise
+    from gateway.platforms.weixin import qr_login
 from hermes_cli.config import save_env_value
 
 creds = asyncio.run(qr_login('/opt/data'))
-print('RESULT =', creds)
 
 if not creds:
     raise SystemExit(1)

agent/app/service/agents_local.go

@@ -0,0 +1,202 @@
+package service
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/app/repo"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	terminalai "github.com/1Panel-dev/1Panel/agent/utils/terminal/ai"
+	"gorm.io/gorm"
+)
+
+func SyncLocalModelAccount(install model.AppInstall, accountID uint, baseURL string, models []dto.AgentAccountModel, updateBaseURL, createIfMissing bool) (*model.AgentAccount, error) {
+	if install.ID == 0 || (install.App.Key != "ollama" && install.App.Key != "vllm") {
+		return nil, fmt.Errorf("invalid local model installation")
+	}
+	agentAccountMutationMu.Lock()
+	defer agentAccountMutationMu.Unlock()
+	account, err := agentAccountRepo.GetFirst(repo.WithByAppInstallID(install.ID))
+	if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, err
+	}
+	if errors.Is(err, gorm.ErrRecordNotFound) && accountID != 0 {
+		account, err = agentAccountRepo.GetFirst(repo.WithByID(accountID), repo.WithByProvider(install.App.Key))
+		if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, err
+		}
+		if err == nil && account.AppInstallID != 0 && account.AppInstallID != install.ID {
+			return nil, fmt.Errorf("model account belongs to another installation")
+		}
+	}
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		if !createIfMissing {
+			return nil, nil
+		}
+		name := install.Name
+		for suffix := 1; ; suffix++ {
+			existing, err := agentAccountRepo.List(repo.WithByProvider(install.App.Key), repo.WithByName(name))
+			if err != nil {
+				return nil, err
+			}
+			if len(existing) == 0 {
+				break
+			}
+			name = fmt.Sprintf("%s-%d", install.Name, suffix)
+		}
+		apiType, apiKey := "openai-completions", "vllm-local"
+		if install.App.Key == "ollama" {
+			apiType, apiKey = "openai-responses", "ollama-local"
+		}
+		account = &model.AgentAccount{Name: name, Provider: install.App.Key, BaseURL: baseURL, APIType: apiType, APIKey: apiKey, RememberAPIKey: true, Verified: true}
+	}
+	accountChanged := account.ID == 0 || account.AppInstallID != install.ID || (updateBaseURL && account.BaseURL != baseURL)
+	account.AppInstallID = install.ID
+	if updateBaseURL {
+		account.BaseURL = baseURL
+	}
+	rows := make([]model.AgentAccountModel, 0, len(models))
+	verifyModelExists := account.VerifyModel == ""
+	for _, item := range models {
+		rows = append(rows, model.AgentAccountModel{Model: item.ID, Name: item.Name})
+		if item.ID == account.VerifyModel {
+			verifyModelExists = true
+		}
+	}
+	if !verifyModelExists {
+		account.VerifyModel = ""
+		accountChanged = true
+	}
+	var previous []model.AgentAccountModel
+	if account.ID != 0 {
+		previous, err = agentAccountModelRepo.List(repo.WithByAccountID(account.ID), repo.WithOrderAsc("sort_order"), repo.WithOrderAsc("id"))
+		if err != nil {
+			return nil, err
+		}
+	}
+	modelsChanged := len(previous) != len(rows)
+	if !modelsChanged {
+		for i := range rows {
+			if previous[i].Model != rows[i].Model || previous[i].Name != rows[i].Name {
+				modelsChanged = true
+				break
+			}
+		}
+	}
+	if modelsChanged {
+		err = agentAccountRepo.SaveLocal(account, rows)
+	} else if accountChanged {
+		err = agentAccountRepo.Save(account)
+	} else {
+		return account, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	terminalai.InvalidateTerminalRuntimeCache()
+	terminalai.InvalidateFileAIRuntimeCache()
+	return account, nil
+}
+
+func SyncOllamaModelAccount(createIfMissing bool) error {
+	app, err := appRepo.GetFirst(appRepo.WithKey("ollama"))
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	install, err := appInstallRepo.GetFirst(appInstallRepo.WithAppId(app.ID))
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	if !install.SyncModelAccount {
+		return nil
+	}
+	return syncOllamaModelAccount(install, fmt.Sprintf("http://%s:11434/v1", install.ContainerName), false, createIfMissing)
+}
+
+func syncOllamaModelAccount(install model.AppInstall, baseURL string, updateBaseURL, createIfMissing bool) error {
+	models, err := aiRepo.List(repo.WithByStatus(constant.StatusSuccess), repo.WithOrderAsc("name"))
+	if err != nil {
+		return err
+	}
+	items := make([]dto.AgentAccountModel, 0, len(models))
+	for _, item := range models {
+		items = append(items, dto.AgentAccountModel{ID: item.Name, Name: item.Name})
+	}
+	_, err = SyncLocalModelAccount(install, 0, baseURL, items, updateBaseURL, createIfMissing)
+	return err
+}
+
+func loadOllamaModelAccountAddress(install model.AppInstall) (string, string, error) {
+	addressType := install.ModelAccountBaseURLType
+	if addressType == "" {
+		addressType = "container"
+	}
+	account, err := agentAccountRepo.GetFirst(repo.WithByAppInstallID(install.ID), repo.WithByProvider("ollama"))
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return addressType, install.ModelAccountBaseURL, nil
+	}
+	if err != nil {
+		return "", "", err
+	}
+	if addressType != "custom" {
+		expectedURL, err := ResolveLocalModelAccountBaseURL(addressType, "", install.ContainerName, "11434", install.HttpPort)
+		if err != nil {
+			return "", "", err
+		}
+		if strings.TrimRight(account.BaseURL, "/") != expectedURL {
+			addressType = "custom"
+		}
+	}
+	return addressType, account.BaseURL, nil
+}
+
+func CleanupLocalModelAccount(installID uint) {
+	if installID == 0 {
+		return
+	}
+	accounts, err := agentAccountRepo.List(repo.WithByAppInstallID(installID))
+	if err != nil {
+		global.LOG.Errorf("load local model accounts: %v", err)
+		return
+	}
+	for _, account := range accounts {
+		if err := (AgentService{}).DeleteAccount(dto.AgentAccountDeleteReq{ID: account.ID}); err != nil {
+			global.LOG.Warnf("keep local model account %d after uninstall: %v", account.ID, err)
+		}
+	}
+}
+
+func ResolveLocalModelAccountBaseURL(addressType, customURL, containerName, containerPort string, hostPort int) (string, error) {
+	switch addressType {
+	case "custom":
+		baseURL := strings.TrimRight(strings.TrimSpace(customURL), "/")
+		if !strings.HasPrefix(baseURL, "http://") && !strings.HasPrefix(baseURL, "https://") {
+			return "", fmt.Errorf("model account base URL must start with http:// or https://")
+		}
+		return baseURL, nil
+	case "localhost":
+		return fmt.Sprintf("http://127.0.0.1:%d/v1", hostPort), nil
+	case "systemIP":
+		systemIP, err := settingRepo.GetValueByKey("SystemIP")
+		if err != nil {
+			return "", err
+		}
+		systemIP = strings.TrimSpace(systemIP)
+		if systemIP == "" {
+			systemIP = "127.0.0.1"
+		}
+		return fmt.Sprintf("http://%s:%d/v1", systemIP, hostPort), nil
+	default:
+		return fmt.Sprintf("http://%s:%s/v1", containerName, containerPort), nil
+	}
+}

agent/app/service/agents_minimax_test.go

@@ -0,0 +1,115 @@
+package service
+
+import (
+	"encoding/json"
+	"path/filepath"
+	"reflect"
+	"testing"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	providercatalog "github.com/1Panel-dev/1Panel/agent/app/provider"
+)
+
+func TestMiniMaxOpenclawModelMetadata(t *testing.T) {
+	for _, provider := range []string{"minimax", "custom", "bailian-coding-plan"} {
+		for _, protocol := range []string{"anthropic-messages", "openai-completions"} {
+			for _, id := range []string{"MiniMax-M3.1-Flash", "MiniMax-M3", "MiniMax-M2.7", "MiniMax-M2.5", "saved-custom"} {
+				t.Run(provider+"/"+protocol+"/"+id, func(t *testing.T) {
+					account := &model.AgentAccount{Provider: provider, APIType: protocol, BaseURL: "https://example.test/v1", APIKey: "test-key"}
+					_, entry, _, _, err := buildOpenclawAccountModelConfig(account, dto.AgentAccountModel{ID: id, Name: "Saved name"})
+					if err != nil {
+						t.Fatal(err)
+					}
+					payload, err := json.Marshal(entry)
+					if err != nil {
+						t.Fatal(err)
+					}
+					var actual modelEntry
+					if err := json.Unmarshal(payload, &actual); err != nil {
+						t.Fatal(err)
+					}
+					if actual.ID != id || actual.Name != "Saved name" {
+						t.Fatalf("changed saved identity: %s", payload)
+					}
+					if provider == "minimax" && id == "MiniMax-M3.1-Flash" {
+						if actual.ContextWindow != 1000000 || actual.MaxTokens != 524288 || !reflect.DeepEqual(actual.Input, []string{"text", "image"}) {
+							t.Fatalf("incorrect direct Flash metadata: %s", payload)
+						}
+					} else if actual.ContextWindow != 0 || actual.MaxTokens != 0 {
+						t.Fatalf("changed existing/gateway limits: %s", payload)
+					}
+				})
+			}
+		}
+	}
+}
+
+func TestMiniMaxPreservesSavedOpenclawMetadata(t *testing.T) {
+	current := &modelsConfig{Mode: "merge", Providers: map[string]modelProvider{
+		"minimax": {Models: []modelEntry{{ID: "MiniMax-M3.1-Flash", Input: []string{"text"}, ContextWindow: 32000, MaxTokens: 4096}}},
+	}}
+	conf := map[string]interface{}{}
+	if err := applyOpenclawModelsConfig(conf, current); err != nil {
+		t.Fatal(err)
+	}
+	next := &modelsConfig{Mode: "merge", Providers: map[string]modelProvider{
+		"minimax": {Models: []modelEntry{{ID: "MiniMax-M3.1-Flash", Input: []string{"text", "image"}, ContextWindow: 1000000, MaxTokens: 524288}}},
+	}}
+	preserveOpenclawModelMetadata(conf, next)
+	if !reflect.DeepEqual(next.Providers["minimax"].Models, current.Providers["minimax"].Models) {
+		t.Fatalf("saved metadata changed: %+v", next)
+	}
+}
+
+func TestMiniMaxDefaultAccountRequest(t *testing.T) {
+	for _, protocol := range []string{"anthropic-messages", "openai-completions"} {
+		account := &model.AgentAccount{Provider: "minimax", APIType: protocol}
+		models, err := buildInitialAgentAccountModels(account, nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		selected, err := resolveAgentAccountVerifyModel("minimax", "", models)
+		if err != nil || selected != "MiniMax-M3.1-Flash" || len(models) != 2 || models[1].ID != "MiniMax-M3" {
+			t.Fatalf("unexpected default: %s, %+v, %v", selected, models, err)
+		}
+		request := providercatalog.BuildVerifyRequest("minimax", protocol, "", "https://example.test", "test-key", selected)
+		var body map[string]interface{}
+		if err := json.Unmarshal(request.Body, &body); err != nil || body["model"] != selected {
+			t.Fatalf("default request: %s, %v", request.Body, err)
+		}
+	}
+}
+
+func TestMiniMaxHermesConfiguration(t *testing.T) {
+	for _, protocol := range []string{"anthropic-messages", "openai-completions"} {
+		for _, id := range []string{"MiniMax-M3.1-Flash", "MiniMax-M3", "MiniMax-M2.7", "my-custom-model"} {
+			dir := t.TempDir()
+			account := &model.AgentAccount{Provider: "minimax", APIType: protocol, BaseURL: "https://api.minimaxi.com/anthropic", APIKey: "test-key"}
+			if err := writeHermesConfig(dir, account, id, ""); err != nil {
+				t.Fatal(err)
+			}
+			conf, err := readHermesConfig(filepath.Join(dir, "config.yaml"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if conf.Model.Default != id || conf.Model.Provider != "minimax-cn" || conf.Model.BaseURL != account.BaseURL {
+				t.Fatalf("changed Hermes selection: %+v", conf.Model)
+			}
+		}
+	}
+}
+
+func TestMiniMaxExplicitAccountModels(t *testing.T) {
+	for _, provider := range []string{"minimax", "bailian-coding-plan", "custom"} {
+		account := &model.AgentAccount{Provider: provider, APIType: "openai-completions"}
+		requested := []dto.AgentAccountModel{{ID: "MiniMax-M2.5", Name: "Saved legacy"}, {ID: "my-custom-model", Name: "Saved custom"}}
+		actual, err := buildInitialAgentAccountModels(account, requested)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !reflect.DeepEqual(actual, requested) {
+			t.Fatalf("changed explicit %s models: %+v", provider, actual)
+		}
+	}
+}

agent/app/service/agents_native.go

@@ -0,0 +1,69 @@
+package service
+
+import (
+	"net"
+	"regexp"
+	"strings"
+	"unicode"
+	"unicode/utf8"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+)
+
+var deepSeekUsernamePattern = regexp.MustCompile(`^[A-Za-z0-9._-]+$`)
+var deepSeekHostLabelPattern = regexp.MustCompile(`^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$`)
+
+func isDeepSeekAccessHost(value string) bool {
+	if ip := net.ParseIP(value); ip != nil {
+		return ip.To4() != nil && !strings.Contains(value, ":")
+	}
+	if value == "" || len(value) > 253 || strings.Trim(value, "0123456789.") == "" {
+		return false
+	}
+	for _, label := range strings.Split(value, ".") {
+		if !deepSeekHostLabelPattern.MatchString(label) {
+			return false
+		}
+	}
+	return true
+}
+
+func validateNativeAgentCreate(req dto.AgentCreateReq) error {
+	if req.AgentType != constant.AppDeepSeekHarness && req.AgentType != constant.AppOctop {
+		return nil
+	}
+	if strings.TrimSpace(req.DashboardUsername) == "" || strings.ContainsAny(req.DashboardUsername, "\r\n\x00") {
+		return buserr.WithDetail("ErrInvalidParams", "dashboardUsername", nil)
+	}
+	if strings.ContainsAny(req.DashboardPassword, "\r\n\x00") || req.DashboardPassword != strings.TrimSpace(req.DashboardPassword) {
+		return buserr.WithDetail("ErrInvalidParams", "dashboardPassword", nil)
+	}
+	if req.AgentType == constant.AppDeepSeekHarness {
+		if !isDeepSeekAccessHost(req.AccessHost) {
+			return buserr.WithDetail("ErrInvalidParams", "accessHost", nil)
+		}
+		if !deepSeekUsernamePattern.MatchString(req.DashboardUsername) {
+			return buserr.WithDetail("ErrInvalidParams", "dashboardUsername", nil)
+		}
+		if utf8.RuneCountInString(req.DashboardPassword) < 12 {
+			return buserr.WithDetail("ErrInvalidParams", "dashboardPassword", nil)
+		}
+		return nil
+	}
+	hasLetter, hasDigit := false, false
+	for _, char := range req.DashboardPassword {
+		hasLetter = hasLetter || unicode.IsLetter(char)
+		hasDigit = hasDigit || unicode.IsDigit(char)
+	}
+	if utf8.RuneCountInString(req.DashboardPassword) < 8 || !hasLetter || !hasDigit {
+		return buserr.WithDetail("ErrInvalidParams", "dashboardPassword", nil)
+	}
+	switch strings.ToLower(req.DashboardPassword) {
+	case "password", "password1", "password12", "password123", "12345678", "123456789", "qwerty123",
+		"admin123", "welcome1", "letmein1", "changeme1", "octop123", "abc12345", "iloveyou1":
+		return buserr.WithDetail("ErrInvalidParams", "dashboardPassword", nil)
+	}
+	return nil
+}

agent/app/service/agents_plugins.go

@@ -107,6 +107,9 @@ func (a AgentService) InstallMarketPlugin(req dto.AgentPluginMarketInstallReq) e
 	if err != nil {
 		return err
 	}
+	if isOpenclawBundledFeishuVersion(install.Version) && (strings.TrimSpace(req.Package) == "@larksuite/openclaw-lark" || strings.TrimSpace(req.Package) == "@openclaw/feishu") {
+		return buserr.New("ErrFeishuManaged")
+	}
 	if err := task.CheckScopeTaskIsExecuting(task.TaskScopeAI, req.AgentID); err != nil {
 		return err
 	}
@@ -132,6 +135,9 @@ func (a AgentService) OperatePlugin(req dto.AgentPluginOperateReq) error {
 	if err != nil {
 		return err
 	}
+	if isOpenclawBundledFeishuVersion(install.Version) && (req.PluginID == "openclaw-lark" || req.PluginID == "feishu") {
+		return buserr.New("ErrFeishuManaged")
+	}
 	if err := task.CheckScopeTaskIsExecuting(task.TaskScopeAI, req.AgentID); err != nil {
 		return err
 	}

agent/app/service/agents_utils.go

@@ -10,6 +10,7 @@ import (
 	"net/url"
 	"path"
 	"regexp"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -97,7 +98,7 @@ func ensureContainerRunning(containerName string) error {
 	return nil
 }
 
-func resolveAgentAccountInput(provider, apiType, authMode, apiKey, baseURL, modelID string, validateAvailability bool) (resolvedAgentAccountInput, error) {
+func resolveAgentAccountInput(provider, apiType, authMode, apiKey, baseURL, modelID string, validateAvailability, allowEmptyModel bool) (resolvedAgentAccountInput, error) {
 	resolvedAPIKey := strings.TrimSpace(apiKey)
 	resolvedAPIType := strings.TrimSpace(apiType)
 	resolvedAuthMode, err := providercatalog.ResolveAuthMode(provider, resolvedAPIType, authMode)
@@ -112,11 +113,11 @@ func resolveAgentAccountInput(provider, apiType, authMode, apiKey, baseURL, mode
 		return resolvedAgentAccountInput{}, err
 	}
 	modelID = strings.TrimSpace(modelID)
-	if modelID == "" {
+	if modelID == "" && !allowEmptyModel {
 		return resolvedAgentAccountInput{}, buserr.New("ErrAgentAccountModelsRequired")
 	}
 	imageAPI := providercatalog.IsImageAPIType(resolvedAPIType)
-	if validateAvailability && (imageAPI || !providercatalog.SkipVerification(provider)) {
+	if validateAvailability && (imageAPI || providercatalog.IsEmbeddingAPIType(resolvedAPIType) || !providercatalog.SkipVerification(provider)) {
 		if err := providercatalog.VerifyAccount(provider, resolvedAPIType, resolvedAuthMode, resolvedBaseURL, resolvedAPIKey, modelID); err != nil {
 			return resolvedAgentAccountInput{}, err
 		}
@@ -147,6 +148,10 @@ func readOpenclawConfig(configPath string) (map[string]interface{}, error) {
 }
 
 func writeOpenclawConfigRaw(configPath string, conf map[string]interface{}) error {
+	if _, busy := feishuSwitches.LoadOrStore(configPath, true); busy {
+		return buserr.New("TaskIsExecuting")
+	}
+	defer feishuSwitches.Delete(configPath)
 	ensureGatewaySecurityDefaults(conf)
 	ensureOpenclawUpdateDefaults(conf)
 	payload, err := json.MarshalIndent(conf, "", "  ")
@@ -414,6 +419,15 @@ func buildAgentItem(agent *model.Agent, appInstall *model.AppInstall, envMap map
 		} else {
 			item.WebUIPort = appInstall.HttpPort
 		}
+		if agentType == constant.AppDeepSeekHarness {
+			item.WebUIPort = appInstall.HttpsPort
+			if values, err := readAgentEnvMap(appInstall.GetEnvPath()); err == nil {
+				accessHost := values["HTTPS_ACCESS_HOST"]
+				if isDeepSeekAccessHost(accessHost) {
+					item.AccessHost = accessHost
+				}
+			}
+		}
 		item.Path = appInstall.GetPath()
 		item.Status = appInstall.Status
 		item.Message = appInstall.Message
@@ -441,7 +455,8 @@ func localizedAgentProviderName(provider string) string {
 }
 
 func isAgentAppKey(appKey string) bool {
-	return appKey == constant.AppOpenclaw || appKey == constant.AppCopaw || appKey == constant.AppHermesAgent
+	return appKey == constant.AppOpenclaw || appKey == constant.AppCopaw || appKey == constant.AppHermesAgent ||
+		appKey == constant.AppDeepSeekHarness || appKey == constant.AppOctop
 }
 
 func isOpenclawLegacyHTTPVersion(version string) bool {
@@ -651,7 +666,7 @@ func checkAgentUpgradable(install model.AppInstall) bool {
 		if len(ignores) > 0 {
 			continue
 		}
-		if common.IsCrossVersion(install.Version, item.Version) && !install.App.CrossVersionUpdate {
+		if isCrossAppVersion(install.App.Key, install.Version, item.Version) && !install.App.CrossVersionUpdate {
 			continue
 		}
 		versions = append(versions, item.Version)
@@ -659,12 +674,12 @@ func checkAgentUpgradable(install model.AppInstall) bool {
 	if len(versions) == 0 {
 		return false
 	}
-	versions = common.GetSortedVersions(versions)
+	versions = sortAppVersions(install.App.Key, versions)
 	lastVersion := versions[0]
-	if common.IsCrossVersion(install.Version, lastVersion) {
+	if isCrossAppVersion(install.App.Key, install.Version, lastVersion) {
 		return install.App.CrossVersionUpdate
 	}
-	return common.CompareVersion(lastVersion, install.Version)
+	return isNewerAppVersion(install.App.Key, lastVersion, install.Version)
 }
 
 type openclawConfig struct {
@@ -737,9 +752,11 @@ type modelProvider struct {
 }
 
 type modelEntry struct {
-	ID    string   `json:"id"`
-	Name  string   `json:"name"`
-	Input []string `json:"input,omitempty"`
+	ID            string   `json:"id"`
+	Name          string   `json:"name"`
+	Input         []string `json:"input,omitempty"`
+	ContextWindow int      `json:"contextWindow,omitempty"`
+	MaxTokens     int      `json:"maxTokens,omitempty"`
 }
 
 func requiresOpenclawProviderModels(provider string) bool {
@@ -767,7 +784,7 @@ type browserConfig struct {
 	DefaultProfile string `json:"defaultProfile"`
 }
 
-func writeOpenclawConfig(confDir string, account *model.AgentAccount, modelName, token string, allowedOrigins []string, fallbacks []string) error {
+func writeOpenclawConfig(confDir string, account *model.AgentAccount, modelName, token string, allowedOrigins []string, fallbacks []string, metadata []dto.AgentModelMetadata) error {
 	if strings.TrimSpace(confDir) == "" {
 		return fmt.Errorf("config dir is required")
 	}
@@ -852,6 +869,7 @@ func writeOpenclawConfig(confDir string, account *model.AgentAccount, modelName,
 		}
 		conf = initial
 	} else {
+		preserveOpenclawModelMetadata(conf, cfg.Models)
 		if err := applyOpenclawModelsConfig(conf, cfg.Models); err != nil {
 			return err
 		}
@@ -906,6 +924,9 @@ func writeOpenclawConfig(confDir string, account *model.AgentAccount, modelName,
 	if allowedOrigins != nil {
 		setSecurityConfig(conf, dto.AgentSecurityConfig{AllowedOrigins: allowedOrigins})
 	}
+	if err := applyOpenclawModelMetadata(conf, account, metadata); err != nil {
+		return err
+	}
 	if err := writeOpenclawConfigRaw(configPath, conf); err != nil {
 		return err
 	}
@@ -920,6 +941,144 @@ func writeOpenclawConfig(confDir string, account *model.AgentAccount, modelName,
 	return writeAgentEnvMap(path.Join(confDir, ".env"), envMap, order)
 }
 
+func readOpenclawModelsConfig(conf map[string]interface{}) *modelsConfig {
+	raw, ok := conf["models"]
+	if !ok {
+		return nil
+	}
+	payload, err := json.Marshal(raw)
+	if err != nil {
+		return nil
+	}
+	var models modelsConfig
+	if err := json.Unmarshal(payload, &models); err != nil {
+		return nil
+	}
+	return &models
+}
+
+func preserveOpenclawModelMetadata(conf map[string]interface{}, next *modelsConfig) {
+	current := readOpenclawModelsConfig(conf)
+	if current == nil || next == nil {
+		return
+	}
+	for providerID, nextProvider := range next.Providers {
+		currentProvider, ok := current.Providers[providerID]
+		if !ok {
+			continue
+		}
+		byID := make(map[string]modelEntry, len(currentProvider.Models))
+		for _, entry := range currentProvider.Models {
+			byID[entry.ID] = entry
+		}
+		for index := range nextProvider.Models {
+			currentEntry, ok := byID[nextProvider.Models[index].ID]
+			if !ok {
+				continue
+			}
+			nextProvider.Models[index].Input = currentEntry.Input
+			nextProvider.Models[index].ContextWindow = currentEntry.ContextWindow
+			nextProvider.Models[index].MaxTokens = currentEntry.MaxTokens
+		}
+		next.Providers[providerID] = nextProvider
+	}
+}
+
+func extractOpenclawModelMetadata(conf map[string]interface{}, account *model.AgentAccount, accountModels []dto.AgentAccountModel) []dto.AgentModelMetadata {
+	result := make([]dto.AgentModelMetadata, 0, len(accountModels))
+	configured := readOpenclawModelsConfig(conf)
+	for _, item := range accountModels {
+		_, inferred, providerID, _, err := buildOpenclawAccountModelConfig(account, item)
+		if err != nil {
+			continue
+		}
+		metadata := dto.AgentModelMetadata{Model: item.ID, InputMode: "auto"}
+		if configured != nil {
+			for _, entry := range configured.Providers[providerID].Models {
+				if entry.ID != inferred.ID {
+					continue
+				}
+				metadata.ContextWindow = entry.ContextWindow
+				metadata.MaxTokens = entry.MaxTokens
+				if len(entry.Input) > 0 && !slices.Equal(entry.Input, inferred.Input) {
+					if slices.Contains(entry.Input, "image") {
+						metadata.InputMode = "image"
+					} else {
+						metadata.InputMode = "text"
+					}
+				}
+				break
+			}
+		}
+		result = append(result, metadata)
+	}
+	return result
+}
+
+func applyOpenclawModelMetadata(conf map[string]interface{}, account *model.AgentAccount, requested []dto.AgentModelMetadata) error {
+	if len(requested) == 0 {
+		return nil
+	}
+	configured := readOpenclawModelsConfig(conf)
+	if configured == nil {
+		return fmt.Errorf("model metadata is not supported for provider %s", account.Provider)
+	}
+	accountModels, err := loadAgentAccountModels(account)
+	if err != nil {
+		return err
+	}
+	available := make(map[string]dto.AgentAccountModel, len(accountModels))
+	for _, item := range accountModels {
+		available[item.ID] = item
+	}
+	seen := make(map[string]struct{}, len(requested))
+	for _, metadata := range requested {
+		item, ok := available[metadata.Model]
+		if !ok {
+			return buserr.New("ErrAgentModelNotInAccount")
+		}
+		if _, ok := seen[metadata.Model]; ok {
+			return fmt.Errorf("duplicate model metadata: %s", metadata.Model)
+		}
+		seen[metadata.Model] = struct{}{}
+		_, inferred, providerID, _, err := buildOpenclawAccountModelConfig(account, item)
+		if err != nil {
+			return err
+		}
+		provider := configured.Providers[providerID]
+		found := false
+		for index := range provider.Models {
+			if provider.Models[index].ID != inferred.ID {
+				continue
+			}
+			found = true
+			provider.Models[index].ContextWindow = metadata.ContextWindow
+			provider.Models[index].MaxTokens = metadata.MaxTokens
+			switch metadata.InputMode {
+			case "auto":
+				provider.Models[index].Input = inferred.Input
+			case "text":
+				provider.Models[index].Input = []string{"text"}
+			case "image":
+				provider.Models[index].Input = []string{"text", "image"}
+			default:
+				return fmt.Errorf("unsupported model input mode: %s", metadata.InputMode)
+			}
+			break
+		}
+		if !found {
+			return buserr.New("ErrAgentModelNotInAccount")
+		}
+		configured.Providers[providerID] = provider
+	}
+	modelsMap, err := structToMap(configured)
+	if err != nil {
+		return err
+	}
+	conf["models"] = modelsMap
+	return nil
+}
+
 func resolveOpenclawFallbackModels(account *model.AgentAccount, primaryModel string, fallbackIDs []string) ([]string, error) {
 	accountModels, err := loadAgentAccountModels(account)
 	if err != nil {
@@ -1041,7 +1200,7 @@ func prepareOpenclawInstallFiles(appInstall *model.AppInstall, account *model.Ag
 		return fmt.Errorf("app install is required")
 	}
 	confDir := path.Join(appInstall.GetPath(), "data", "conf")
-	if err := writeOpenclawConfig(confDir, account, modelName, token, allowedOrigins, nil); err != nil {
+	if err := writeOpenclawConfig(confDir, account, modelName, token, allowedOrigins, nil, nil); err != nil {
 		return err
 	}
 	dataDir := path.Join(appInstall.GetPath(), "data")
@@ -1108,7 +1267,12 @@ func buildOpenclawAccountModelConfig(account *model.AgentAccount, model dto.Agen
 	if err != nil {
 		return "", modelEntry{}, "", modelProvider{}, err
 	}
-	return providerPatch.PrimaryModel, buildOpenclawModelEntry(providerPatch.ModelID, model), providerPatch.ProviderKey, modelProvider{
+	entry := buildOpenclawModelEntry(providerPatch.ModelID, model)
+	if account.Provider == "minimax" && providerPatch.ModelID == "MiniMax-M3.1-Flash" {
+		entry.ContextWindow = 1000000
+		entry.MaxTokens = 524288
+	}
+	return providerPatch.PrimaryModel, entry, providerPatch.ProviderKey, modelProvider{
 		ApiKey:     providerPatch.APIKey,
 		BaseUrl:    providerPatch.BaseURL,
 		Api:        providerPatch.APIType,
@@ -1338,7 +1502,7 @@ func normalizeAgentAccountModel(account *model.AgentAccount, model dto.AgentAcco
 
 func requiresInitialAgentAccountModels(provider string) bool {
 	switch provider {
-	case "custom", "vllm", "ollama":
+	case "custom", "vllm", "ollama", "llmman":
 		return true
 	default:
 		return false
@@ -1496,6 +1660,10 @@ func agentDashboardAuthEnvKeys(agentType string) (string, string, bool) {
 		return hermesDashboardUsernameEnvKey, hermesDashboardPasswordEnvKey, true
 	case constant.AppCopaw:
 		return qwenPawAuthUsernameEnvKey, qwenPawAuthPasswordEnvKey, true
+	case constant.AppDeepSeekHarness:
+		return "DSH_AUTH_USERNAME", "DSH_AUTH_PASSWORD", true
+	case constant.AppOctop:
+		return "OCTOP_ADMIN_USERNAME", "OCTOP_DEFAULT_PASSWORD", true
 	default:
 		return "", "", false
 	}

agent/app/service/ai.go

@@ -8,6 +8,7 @@ import (
 	"os/exec"
 	"path"
 	"strings"
+	"sync"
 	"syscall"
 	"time"
 
@@ -28,13 +29,15 @@ import (
 
 type AIToolService struct{}
 
+var ollamaModelMu sync.Mutex
+
 type IAIToolService interface {
 	Search(search dto.SearchWithPage) (int64, []dto.OllamaModelInfo, error)
 	Create(req dto.OllamaModelName) error
 	Close(name string) error
 	Recreate(req dto.OllamaModelName) error
 	Delete(req dto.ForceDelete) error
-	Sync() ([]dto.OllamaModelDropList, error)
+	SyncAccount(req dto.OllamaModelAccountSync) error
 	LoadDetail(name string) (string, error)
 	BindDomain(req dto.OllamaBindDomain) error
 	GetBindDomain(req dto.OllamaBindDomainReq) (*dto.OllamaBindDomainRes, error)
@@ -46,6 +49,7 @@ func NewIAIToolService() IAIToolService {
 }
 
 func (u *AIToolService) Search(req dto.SearchWithPage) (int64, []dto.OllamaModelInfo, error) {
+	syncErr := syncOllamaModels()
 	var options []repo.DBOption
 	if len(req.Info) != 0 {
 		options = append(options, repo.WithByLikeName(req.Info))
@@ -60,6 +64,11 @@ func (u *AIToolService) Search(req dto.SearchWithPage) (int64, []dto.OllamaModel
 		if err := copier.Copy(&item, &itemModel); err != nil {
 			return 0, nil, buserr.WithDetail("ErrStructTransform", err.Error(), nil)
 		}
+		if syncErr != nil && item.Status != constant.StatusWaiting {
+			item.Status = constant.StatusUnknown
+			item.Message = syncErr.Error()
+			item.Size = ""
+		}
 		taskModel, _ := taskRepo.GetFirst(taskRepo.WithResourceID(item.ID), repo.WithByType(task.TaskScopeAI))
 		if len(taskModel.ID) != 0 {
 			item.LogFileExist = true
@@ -85,6 +94,8 @@ func (u *AIToolService) LoadDetail(name string) (string, error) {
 }
 
 func (u *AIToolService) Create(req dto.OllamaModelName) error {
+	ollamaModelMu.Lock()
+	defer ollamaModelMu.Unlock()
 	if cmd.CheckIllegal(req.Name) {
 		return buserr.New("ErrCmdIllegal")
 	}
@@ -125,6 +136,9 @@ func (u *AIToolService) Create(req dto.OllamaModelName) error {
 		if err := taskItem.Execute(); err != nil {
 			_ = aiRepo.Update(info.ID, map[string]interface{}{"status": constant.StatusFailed, "message": err.Error()})
 		}
+		if err := SyncOllamaModelAccount(false); err != nil {
+			global.LOG.Errorf("sync Ollama model account after pull: %v", err)
+		}
 	}()
 	return nil
 }
@@ -144,6 +158,8 @@ func (u *AIToolService) Close(name string) error {
 }
 
 func (u *AIToolService) Recreate(req dto.OllamaModelName) error {
+	ollamaModelMu.Lock()
+	defer ollamaModelMu.Unlock()
 	if cmd.CheckIllegal(req.Name) {
 		return buserr.New("ErrCmdIllegal")
 	}
@@ -179,11 +195,16 @@ func (u *AIToolService) Recreate(req dto.OllamaModelName) error {
 		if err := taskItem.Execute(); err != nil {
 			_ = aiRepo.Update(modelInfo.ID, map[string]interface{}{"status": constant.StatusFailed, "message": err.Error()})
 		}
+		if err := SyncOllamaModelAccount(false); err != nil {
+			global.LOG.Errorf("sync Ollama model account after pull: %v", err)
+		}
 	}()
 	return nil
 }
 
 func (u *AIToolService) Delete(req dto.ForceDelete) error {
+	ollamaModelMu.Lock()
+	defer ollamaModelMu.Unlock()
 	ollamaList, _ := aiRepo.List(repo.WithByIDs(req.IDs))
 	if len(ollamaList) == 0 {
 		return buserr.New("ErrRecordNotFound")
@@ -202,55 +223,28 @@ func (u *AIToolService) Delete(req dto.ForceDelete) error {
 		logItem := path.Join(global.Dir.DataDir, "log", "AITools", item.Name)
 		_ = os.Remove(logItem)
 	}
-	return nil
+	return SyncOllamaModelAccount(false)
 }
 
-func (u *AIToolService) Sync() ([]dto.OllamaModelDropList, error) {
-	containerName, err := LoadContainerName()
+func (u *AIToolService) SyncAccount(req dto.OllamaModelAccountSync) error {
+	install, err := appInstallRepo.GetFirst(repo.WithByID(req.ID))
 	if err != nil {
-		return nil, err
+		return err
 	}
-	stdout, err := cmd.RunDockerExecWithStdout(20*time.Second, containerName, "ollama", "list")
+	if install.App.Key != "ollama" {
+		return buserr.New("ErrInvalidParams")
+	}
+	baseURL, err := ResolveLocalModelAccountBaseURL(req.ModelAccountBaseURLType, req.ModelAccountBaseURL, install.ContainerName, "11434", install.HttpPort)
 	if err != nil {
-		return nil, err
+		return err
 	}
-	var list []model.OllamaModel
-	lines := strings.Split(stdout, "\n")
-	for _, line := range lines {
-		parts := strings.Fields(line)
-		if len(parts) < 5 {
-			continue
-		}
-		if parts[0] == "NAME" {
-			continue
-		}
-		list = append(list, model.OllamaModel{Name: parts[0], Size: parts[2] + " " + parts[3]})
+	if err := syncOllamaModelAccount(install, baseURL, true, true); err != nil {
+		return err
 	}
-	listInDB, _ := aiRepo.List()
-	var dropList []dto.OllamaModelDropList
-	for _, itemModel := range listInDB {
-		isExit := false
-		for i := 0; i < len(list); i++ {
-			if list[i].Name == itemModel.Name {
-				_ = aiRepo.Update(itemModel.ID, map[string]interface{}{"status": constant.StatusSuccess, "message": "", "size": list[i].Size})
-				list = append(list[:i], list[(i+1):]...)
-				isExit = true
-				break
-			}
-		}
-		if !isExit && itemModel.Status != constant.StatusWaiting {
-			_ = aiRepo.Update(itemModel.ID, map[string]interface{}{"status": constant.StatusDeleted, "message": "not exist", "size": ""})
-			dropList = append(dropList, dto.OllamaModelDropList{ID: itemModel.ID, Name: itemModel.Name})
-			continue
-		}
-	}
-	for _, item := range list {
-		item.Status = constant.StatusSuccess
-		item.From = "remote"
-		_ = aiRepo.Create(&item)
-	}
-
-	return dropList, nil
+	return appInstallRepo.BatchUpdateBy(map[string]interface{}{
+		"model_account_base_url_type": req.ModelAccountBaseURLType,
+		"model_account_base_url":      baseURL,
+	}, repo.WithByID(install.ID))
 }
 
 func (u *AIToolService) BindDomain(req dto.OllamaBindDomain) error {
@@ -370,6 +364,72 @@ func (u *AIToolService) UpdateBindDomain(req dto.OllamaBindDomain) error {
 	return nil
 }
 
+func syncOllamaModels() error {
+	ollamaModelMu.Lock()
+	defer ollamaModelMu.Unlock()
+	containerName, err := LoadContainerName()
+	if err != nil {
+		return err
+	}
+	stdout, err := cmd.RunDockerExecWithStdout(20*time.Second, containerName, "ollama", "list")
+	if err != nil {
+		return err
+	}
+	models := make(map[string]string)
+	lines := strings.Split(strings.TrimSpace(stdout), "\n")
+	if len(lines) == 0 || !strings.HasPrefix(strings.TrimSpace(lines[0]), "NAME") {
+		return fmt.Errorf("invalid ollama list output: %s", stdout)
+	}
+	for _, line := range lines[1:] {
+		if strings.TrimSpace(line) == "" {
+			continue
+		}
+		parts := strings.Fields(line)
+		if len(parts) < 5 {
+			return fmt.Errorf("invalid ollama model entry: %s", line)
+		}
+		models[parts[0]] = parts[2] + " " + parts[3]
+	}
+	list, err := aiRepo.List()
+	if err != nil {
+		return err
+	}
+	known := make(map[string]bool, len(list))
+	for _, item := range list {
+		name := item.Name
+		if !strings.Contains(path.Base(name), ":") {
+			name += ":latest"
+		}
+		size, exists := models[name]
+		known[name] = true
+		if item.Status == constant.StatusWaiting {
+			continue
+		}
+		status, message := constant.StatusSuccess, ""
+		if !exists {
+			if item.Status == constant.StatusFailed || item.Status == constant.StatusCanceled {
+				continue
+			}
+			status, message = constant.StatusDeleted, "not exist"
+		}
+		if item.Status != status || item.Size != size || item.Message != message {
+			if err := aiRepo.Update(item.ID, map[string]interface{}{"status": status, "size": size, "message": message}); err != nil {
+				return err
+			}
+		}
+	}
+	for name, size := range models {
+		if known[name] {
+			continue
+		}
+		item := model.OllamaModel{Name: name, Size: size, From: "remote", Status: constant.StatusSuccess}
+		if err := aiRepo.Create(&item); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 func LoadContainerName() (string, error) {
 	ollamaBaseInfo, err := appInstallRepo.LoadBaseInfo("ollama", "")
 	if err != nil {
@@ -387,12 +447,12 @@ func loadModelSize(name string, containerName string) (string, error) {
 		return "", err
 	}
 	lines := strings.Split(stdout, "\n")
+	if !strings.Contains(path.Base(name), ":") {
+		name += ":latest"
+	}
 	for _, line := range lines {
-		if !strings.Contains(line, name) {
-			continue
-		}
 		parts := strings.Fields(line)
-		if len(parts) < 5 {
+		if len(parts) < 5 || parts[0] != name {
 			continue
 		}
 		return parts[2] + " " + parts[3], nil

agent/app/service/ai_benchmark.go

@@ -0,0 +1,209 @@
+package service
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"os"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/utils/docker"
+	"github.com/mattn/go-shellwords"
+)
+
+func AIBenchmarkSources(kind, selected string) ([]dto.AIBenchmarkSource, error) {
+	if kind != "vllm" && kind != "ollama" {
+		return nil, errors.New("unsupported benchmark source")
+	}
+	selectedID := strings.SplitN(selected, ":", 2)[0]
+	type instance struct {
+		id              uint
+		name, container string
+		port            int
+	}
+	instances := []instance{}
+	apps, err := appRepo.GetBy(appRepo.WithKey(kind))
+	if err != nil {
+		return nil, err
+	}
+	for _, app := range apps {
+		installs, err := appInstallRepo.ListBy(context.Background(), appInstallRepo.WithAppId(app.ID))
+		if err != nil {
+			return nil, err
+		}
+		for _, install := range installs {
+			if selected != "" && strconv.FormatUint(uint64(install.ID), 10) != selectedID {
+				continue
+			}
+			instances = append(instances, instance{id: install.ID, name: install.Name, container: install.ContainerName, port: install.HttpPort})
+		}
+	}
+	results := []dto.AIBenchmarkSource{}
+	if len(instances) == 0 {
+		return results, nil
+	}
+	client, err := docker.NewDockerClient()
+	if err != nil {
+		return nil, err
+	}
+	defer client.Close()
+	if !strings.HasPrefix(client.DaemonHost(), "unix://") {
+		return nil, errors.New("benchmark shortcuts require a Docker daemon on the main node; enter the remote service address manually")
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+	for _, instance := range instances {
+		base := dto.AIBenchmarkSource{Kind: kind, Name: instance.name, Endpoint: "/v1/chat/completions", Models: []string{}, Status: "unknown"}
+		inspected, err := client.ContainerInspect(ctx, instance.container)
+		if err != nil {
+			base.ID = strconv.FormatUint(uint64(instance.id), 10)
+			base.Message = "container inspection unavailable"
+			results = append(results, base)
+			continue
+		}
+		if inspected.State != nil {
+			base.Status = inspected.State.Status
+		}
+		args := []string{}
+		if inspected.Config != nil {
+			args = append(args, inspected.Config.Entrypoint...)
+			args = append(args, inspected.Config.Cmd...)
+		}
+		if len(args) >= 3 && (args[0] == "sh" || args[0] == "bash" || strings.HasSuffix(args[0], "/sh") || strings.HasSuffix(args[0], "/bash")) && args[1] == "-c" {
+			parser := shellwords.NewParser()
+			parser.ParseEnv = false
+			parser.ParseBacktick = false
+			if parsed, err := parser.Parse(args[2]); err == nil {
+				args = parsed
+			}
+		}
+		flags := map[string]string{}
+		for i, arg := range args {
+			if key, value, ok := strings.Cut(arg, "="); ok && strings.HasPrefix(key, "--") {
+				flags[key] = value
+			} else if strings.HasPrefix(arg, "--") && i+1 < len(args) && !strings.HasPrefix(args[i+1], "--") {
+				flags[arg] = args[i+1]
+			}
+		}
+		if name := flags["--served-model-name"]; name != "" {
+			base.Models = []string{name}
+		}
+		tokenizer := flags["--tokenizer"]
+		if tokenizer == "" {
+			tokenizer = flags["--model"]
+			for i, arg := range args {
+				if tokenizer == "" && arg == "serve" && i+1 < len(args) && !strings.HasPrefix(args[i+1], "-") {
+					tokenizer = args[i+1]
+				}
+			}
+		}
+		if kind != "ollama" && tokenizer != "" {
+			if !filepath.IsAbs(tokenizer) {
+				base.Tokenizer = tokenizer
+			} else {
+				longest := 0
+				for _, mount := range inspected.Mounts {
+					relative, err := filepath.Rel(mount.Destination, tokenizer)
+					if err == nil && relative != ".." && !strings.HasPrefix(relative, ".."+string(filepath.Separator)) && len(mount.Destination) > longest {
+						candidate := filepath.Join(mount.Source, relative)
+						if info, err := os.Stat(candidate); err == nil && info.IsDir() {
+							base.Tokenizer = candidate
+							longest = len(mount.Destination)
+						}
+					}
+				}
+			}
+		}
+		ports := map[int]string{}
+		if instance.port > 0 {
+			ports[instance.port] = "127.0.0.1"
+		}
+		if inspected.NetworkSettings != nil {
+			for _, bindings := range inspected.NetworkSettings.Ports {
+				for _, binding := range bindings {
+					port, _ := strconv.Atoi(binding.HostPort)
+					if port > 0 {
+						host := binding.HostIP
+						if host == "" || host == "0.0.0.0" || host == "::" {
+							host = "127.0.0.1"
+						}
+						ports[port] = host
+					}
+				}
+			}
+		}
+		if len(ports) == 0 && inspected.HostConfig != nil && inspected.HostConfig.NetworkMode == "host" {
+			port, _ := strconv.Atoi(flags["--port"])
+			if port > 0 {
+				ports[port] = "127.0.0.1"
+			}
+		}
+		ordered := []int{}
+		for port := range ports {
+			ordered = append(ordered, port)
+		}
+		sort.Ints(ordered)
+		if len(ordered) == 0 {
+			ordered = append(ordered, 0)
+		}
+		for _, port := range ordered {
+			source := base
+			source.ID = fmt.Sprintf("%d:%d", instance.id, port)
+			if selected != "" && source.ID != selected {
+				continue
+			}
+			if port > 0 {
+				source.BaseURL = "http://" + net.JoinHostPort(ports[port], strconv.Itoa(port))
+			}
+			if selected == source.ID && source.BaseURL != "" && source.Status == "running" {
+				endpoint := "/v1/models"
+				if kind == "ollama" {
+					endpoint = "/api/tags"
+				}
+				request, err := http.NewRequestWithContext(ctx, http.MethodGet, source.BaseURL+endpoint, nil)
+				if err != nil {
+					return nil, err
+				}
+				response, err := (&http.Client{Timeout: 3 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}).Do(request)
+				if err != nil {
+					source.Message = "model list unavailable; enter the served model name"
+				} else {
+					raw, readErr := io.ReadAll(io.LimitReader(response.Body, 2*1024*1024))
+					response.Body.Close()
+					if response.StatusCode == http.StatusOK && readErr == nil {
+						var data struct {
+							Data []struct {
+								ID string `json:"id"`
+							} `json:"data"`
+							Models []struct {
+								Name string `json:"name"`
+							} `json:"models"`
+						}
+						if err := json.Unmarshal(raw, &data); err == nil {
+							source.Models = []string{}
+							for _, model := range data.Data {
+								source.Models = append(source.Models, model.ID)
+							}
+							for _, model := range data.Models {
+								source.Models = append(source.Models, model.Name)
+							}
+						}
+					} else {
+						source.Message = fmt.Sprintf("model list HTTP %d; provide model name and credentials if required", response.StatusCode)
+					}
+				}
+			}
+			results = append(results, source)
+		}
+	}
+	return results, nil
+}

agent/app/service/ai_gateway_recover.go

@@ -0,0 +1,63 @@
+package service
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/utils/files"
+)
+
+func prepareAIGatewayAppRecover(install *model.AppInstall, recoverFile, secret string) (string, func(), error) {
+	noop := func() {}
+	if !isAIGatewayApp(install.App.Key) {
+		return "", noop, nil
+	}
+	tmpDir, err := os.MkdirTemp(global.Dir.TmpDir, "ai-gateway-recover-")
+	if err != nil {
+		return "", noop, err
+	}
+	cleanup := func() { _ = os.RemoveAll(tmpDir) }
+	fail := func(err error) (string, func(), error) {
+		cleanup()
+		return "", noop, err
+	}
+	if err := files.NewFileOp().TarGzExtractPro(recoverFile, tmpDir, secret); err != nil {
+		return fail(err)
+	}
+	backupDir := filepath.Join(tmpDir, strings.ReplaceAll(filepath.Base(recoverFile), ".tar.gz", ""))
+	for _, name := range []string{"app.json", "app.tar.gz"} {
+		info, err := os.Lstat(filepath.Join(backupDir, name))
+		if err != nil || !info.Mode().IsRegular() {
+			return fail(buserr.New("AppBackupFileIncomplete"))
+		}
+	}
+	metadata, err := os.ReadFile(filepath.Join(backupDir, "app.json"))
+	if err != nil {
+		return fail(err)
+	}
+	var backup model.AppInstall
+	if err := json.Unmarshal(metadata, &backup); err != nil {
+		return fail(fmt.Errorf("unmarshal app.json failed: %w", err))
+	}
+	if backup.App.Key != install.App.Key || backup.Name != install.Name {
+		return fail(buserr.New("AppAttributesNotMatch"))
+	}
+	// Historical backups already include Version. Unsuffixed releases are
+	// SQLite; no new metadata field is required. Missing versions are invalid,
+	// not evidence that an archive contains SQLite data.
+	if strings.TrimSpace(backup.Version) == "" || strings.TrimSpace(install.Version) == "" {
+		return fail(buserr.New("AppBackupFileIncomplete"))
+	}
+	// Deliberately do not compare version order: restoring an older version of
+	// the same database type is required for failed-upgrade rollbacks.
+	if !isAIGatewayUpgradeVersionAllowed(install.App.Key, install.Version, backup.Version) {
+		return fail(buserr.New("ErrAIGatewayRecoverDatabaseTypeMismatch"))
+	}
+	return backupDir, cleanup, nil
+}

agent/app/service/ai_gateway_upgrade.go

@@ -0,0 +1,37 @@
+package service
+
+import (
+	"sort"
+	"strings"
+
+	"github.com/1Panel-dev/1Panel/agent/utils/common"
+)
+
+const aiGatewayAppKey = "ai-gateway"
+
+func isAIGatewayApp(appKey string) bool {
+	return appKey == aiGatewayAppKey || appKey == "local"+aiGatewayAppKey
+}
+
+func isAIGatewayPostgresVersion(version string) bool {
+	return strings.HasSuffix(version, "-pg") || strings.HasSuffix(version, "-postgres")
+}
+
+// Database variants are deployment choices, not interchangeable upgrades.
+func isAIGatewayUpgradeVersionAllowed(appKey, currentVersion, targetVersion string) bool {
+	return !isAIGatewayApp(appKey) ||
+		isAIGatewayPostgresVersion(currentVersion) == isAIGatewayPostgresVersion(targetVersion)
+}
+
+func sortAIGatewayVersions(versions []string) {
+	sort.SliceStable(versions, func(i, j int) bool {
+		if common.CompareVersion(versions[i], versions[j]) {
+			return true
+		}
+		if common.CompareVersion(versions[j], versions[i]) {
+			return false
+		}
+		// Prefer SQLite only when the numeric versions are equal.
+		return !isAIGatewayPostgresVersion(versions[i]) && isAIGatewayPostgresVersion(versions[j])
+	})
+}

agent/app/service/alert.go

@@ -4,11 +4,8 @@ import (
 	"encoding/json"
 	"fmt"
 	"mime"
-	"sort"
 	"strconv"
 	"strings"
-	"sync"
-	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/model"
@@ -17,11 +14,13 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/global"
 	"github.com/1Panel-dev/1Panel/agent/i18n"
-	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
+	alertUtil "github.com/1Panel-dev/1Panel/agent/utils/alert"
+	alertconfig "github.com/1Panel-dev/1Panel/agent/utils/alert_config"
+	alertwebhook "github.com/1Panel-dev/1Panel/agent/utils/alert_webhook"
 	"github.com/1Panel-dev/1Panel/agent/utils/copier"
 	"github.com/1Panel-dev/1Panel/agent/utils/email"
 	"github.com/1Panel-dev/1Panel/agent/utils/xpack"
-	"github.com/shirou/gopsutil/v4/disk"
+	"github.com/1Panel-dev/1Panel/agent/utils/xpack/providers"
 )
 
 type AlertService struct{}
@@ -34,6 +33,28 @@ var communityAlertMethodTypeNames = map[string]string{
 	constant.SMS:      "SMS",
 }
 
+var legacyAlertMethodTypeMap = map[string]string{
+	"mail":            constant.Email,
+	constant.Email:    constant.Email,
+	constant.SMS:      constant.SMS,
+	constant.Bark:     constant.Bark,
+	constant.WeChat:   constant.WeCom,
+	constant.WeCom:    constant.WeCom,
+	constant.DingTalk: constant.DingTalk,
+	constant.FeiShu:   constant.FeiShu,
+	constant.Custom:   constant.Custom,
+}
+
+var supportedAlertMethodTypes = map[string]struct{}{
+	constant.Email:    {},
+	constant.SMS:      {},
+	constant.Bark:     {},
+	constant.WeCom:    {},
+	constant.DingTalk: {},
+	constant.FeiShu:   {},
+	constant.Custom:   {},
+}
+
 type IAlertService interface {
 	PageAlert(req dto.AlertSearch) (int64, []dto.AlertDTO, error)
 	GetAlerts() ([]dto.AlertDTO, error)
@@ -53,8 +74,10 @@ type IAlertService interface {
 	GetAlertConfig(req dto.AlertConfigQuery) ([]model.AlertConfig, error)
 	PageAlertConfig(req dto.AlertConfigPageReq) (int64, []model.AlertConfig, error)
 	UpdateAlertConfig(req dto.AlertConfigUpdate, operator string) error
-	DeleteAlertConfig(id uint) error
+	UpdateAlertConfigStatus(req dto.AlertConfigStatusUpdate, operator string) (string, error)
+	DeleteAlertConfig(id uint) (string, error)
 	TestAlertConfig(req dto.AlertConfigTest) (bool, error)
+	TestCustomAlertConfig(req dto.AlertConfigTest, lang string) (dto.AlertConfigTestResult, error)
 }
 
 func NewIAlertService() IAlertService {
@@ -82,7 +105,38 @@ func (a AlertService) PageAlert(search dto.AlertSearch) (int64, []dto.AlertDTO,
 		return 0, nil, err
 	}
 
+	cronjobProjects := make(map[string]uint)
+	var cronjobIDs []uint
 	for _, item := range alerts {
+		if alertUtil.GetCronJobType(item.Type) != "cronJob" {
+			continue
+		}
+		if _, exists := cronjobProjects[item.Project]; exists {
+			continue
+		}
+		id, parseErr := strconv.ParseUint(item.Project, 10, strconv.IntSize)
+		if parseErr != nil || id == 0 {
+			continue
+		}
+		cronjobProjects[item.Project] = uint(id)
+		cronjobIDs = append(cronjobIDs, uint(id))
+	}
+	cronjobsByID := make(map[uint]model.Cronjob)
+	if len(cronjobIDs) > 0 {
+		cronjobs, err := cronjobRepo.List(repo.WithByIDs(cronjobIDs))
+		if err != nil {
+			return 0, nil, err
+		}
+		for _, cronjob := range cronjobs {
+			cronjobsByID[cronjob.ID] = cronjob
+		}
+	}
+
+	for _, item := range alerts {
+		var taskName string
+		if cronjob, exists := cronjobsByID[cronjobProjects[item.Project]]; exists && cronjob.Type == item.Type {
+			taskName = cronjob.Name
+		}
 
 		result = append(result, dto.AlertDTO{
 			ID:             item.ID,
@@ -92,6 +146,7 @@ func (a AlertService) PageAlert(search dto.AlertSearch) (int64, []dto.AlertDTO,
 			Method:         item.Method,
 			Title:          item.Title,
 			Project:        item.Project,
+			TaskName:       taskName,
 			Status:         item.Status,
 			SendCount:      item.SendCount,
 			AdvancedParams: item.AdvancedParams,
@@ -163,6 +218,16 @@ func (a AlertService) CreateAlert(create dto.AlertCreate, operator string) error
 			return err
 		}
 	} else {
+		advanced, err := prepareCronJobAlertParams(create.Type, "", create.AdvancedParams)
+		if err != nil {
+			return err
+		}
+		create.AdvancedParams = advanced
+		if create.Status != constant.AlertDisable {
+			if err := a.validateCronJobAlertChannels(create.Type, advanced, create.Method); err != nil {
+				return err
+			}
+		}
 		alertInfo.Status = constant.AlertEnable
 		if err := copier.Copy(&alertInfo, &create); err != nil {
 			return buserr.WithErr("ErrStructTransform", err)
@@ -180,9 +245,28 @@ func (a AlertService) CreateAlert(create dto.AlertCreate, operator string) error
 }
 
 func (a AlertService) UpdateAlert(req dto.AlertUpdate, operator string) error {
-	if err := a.validateCommunityAlertMethod(req.Method); err != nil {
+	if alertUtil.GetCronJobType(req.Type) == "cronJob" {
+		previous, err := alertRepo.Get(repo.WithByID(req.ID))
+		if err != nil {
+			return err
+		}
+		req.AdvancedParams, err = prepareCronJobAlertParams(req.Type, previous.AdvancedParams, req.AdvancedParams)
+		if err != nil {
+			return err
+		}
+	}
+	methodTypes, err := a.validateAlertMethodReferences(req.Method)
+	if err != nil {
 		return err
 	}
+	if req.Status != constant.AlertDisable {
+		if err := a.validateCronJobAlertChannels(req.Type, req.AdvancedParams, req.Method); err != nil {
+			return err
+		}
+		if err := a.validateAlertMethodEntitlement(methodTypes); err != nil {
+			return err
+		}
+	}
 
 	upMap := make(map[string]interface{})
 	upMap["id"] = req.ID
@@ -240,7 +324,19 @@ func (a AlertService) UpdateStatus(id uint, status string) error {
 	if alertInfo.ID == 0 {
 		return buserr.New("ErrRecordNotFound")
 	}
-	err := alertRepo.Update(map[string]interface{}{"status": status}, repo.WithByID(alertInfo.ID))
+	methodTypes, err := a.validateAlertMethodReferences(alertInfo.Method)
+	if err != nil {
+		return err
+	}
+	if status == constant.AlertEnable {
+		if err := a.validateCronJobAlertChannels(alertInfo.Type, alertInfo.AdvancedParams, alertInfo.Method); err != nil {
+			return err
+		}
+		if err := a.validateAlertMethodEntitlement(methodTypes); err != nil {
+			return err
+		}
+	}
+	err = alertRepo.Update(map[string]interface{}{"status": status}, repo.WithByID(alertInfo.ID))
 	if err != nil {
 		return err
 	}
@@ -257,122 +353,14 @@ func (a AlertService) UpdateStatus(id uint, status string) error {
 }
 
 func (a AlertService) GetDisks() ([]dto.DiskDTO, error) {
-	var disks []dto.DiskDTO
-	excludes := map[string]struct{}{
-		"/mnt/cdrom": {}, "/boot": {}, "/boot/efi": {}, "/dev": {}, "/dev/shm": {},
-		"/run/lock": {}, "/run": {}, "/run/shm": {}, "/run/user": {},
+	infos := loadDiskInfo(true)
+	disks := make([]dto.DiskDTO, 0, len(infos))
+	for _, item := range infos {
+		disks = append(disks, dto.DiskDTO(item))
 	}
-	stdout, err := executeDiskCommand()
-	if err != nil {
-		return disks, nil
-	}
-
-	lines := strings.Split(stdout, "\n")
-	var mounts []dto.AlertDiskInfo
-
-	for _, line := range lines {
-		fields := strings.Fields(line)
-		if len(fields) < 7 {
-			continue
-		}
-		mountPoint := strings.Join(fields[6:], " ")
-		if shouldExclude(fields, mountPoint, excludes) {
-			continue
-		}
-		mounts = append(mounts, dto.AlertDiskInfo{Type: fields[1], Device: fields[0], Mount: mountPoint})
-
-	}
-
-	var (
-		wg sync.WaitGroup
-		mu sync.Mutex
-	)
-	wg.Add(len(mounts))
-	for i := 0; i < len(mounts); i++ {
-		go func(timeoutCh <-chan time.Time, mount dto.AlertDiskInfo) {
-			defer wg.Done()
-
-			var itemData dto.DiskDTO
-			itemData.Path = mount.Mount
-			itemData.Type = mount.Type
-			itemData.Device = mount.Device
-			select {
-			case <-timeoutCh:
-				mu.Lock()
-				disks = append(disks, itemData)
-				mu.Unlock()
-				global.LOG.Errorf("load disk info from %s failed, err: timeout", mount.Mount)
-			default:
-				state, err := disk.Usage(mount.Mount)
-				if err != nil {
-					mu.Lock()
-					disks = append(disks, itemData)
-					mu.Unlock()
-					global.LOG.Errorf("load disk info from %s failed, err: %v", mount.Mount, err)
-					return
-				}
-				itemData.Total = state.Total
-				itemData.Free = state.Free
-				itemData.Used = state.Used
-				itemData.UsedPercent = state.UsedPercent
-				itemData.InodesTotal = state.InodesTotal
-				itemData.InodesUsed = state.InodesUsed
-				itemData.InodesFree = state.InodesFree
-				itemData.InodesUsedPercent = state.InodesUsedPercent
-				mu.Lock()
-				disks = append(disks, itemData)
-				mu.Unlock()
-			}
-		}(time.After(5*time.Second), mounts[i])
-	}
-	wg.Wait()
-
-	sort.Slice(disks, func(i, j int) bool {
-		return disks[i].Path < disks[j].Path
-	})
 	return disks, nil
 }
 
-func executeDiskCommand() (string, error) {
-	cmdMgr := cmd.NewCommandMgr(cmd.WithTimeout(2 * time.Second))
-	stdout, err := cmdMgr.RunWithStdout("df", "-hT", "-P")
-	if err != nil {
-		cmdMgr2 := cmd.NewCommandMgr(cmd.WithTimeout(1 * time.Second))
-		stdout, err = cmdMgr2.RunWithStdout("df", "-lhT", "-P")
-	}
-	if err != nil {
-		return stdout, err
-	}
-	var lines []string
-	for _, line := range strings.Split(stdout, "\n") {
-		if !strings.Contains(line, "/") || strings.Contains(line, "tmpfs") || strings.Contains(line, "snap/core") || strings.Contains(line, "udev") {
-			continue
-		}
-		lines = append(lines, line)
-	}
-	if len(lines) == 0 {
-		return "", nil
-	}
-	return strings.Join(lines, "\n"), nil
-}
-
-func shouldExclude(fields []string, mountPoint string, excludes map[string]struct{}) bool {
-	if strings.HasPrefix(mountPoint, "/snap") || len(strings.Split(mountPoint, "/")) > 10 {
-		return true
-	}
-	if strings.TrimSpace(fields[1]) == "tmpfs" {
-		return true
-	}
-	if strings.Contains(fields[2], "K") {
-		return true
-	}
-	if strings.Contains(mountPoint, "docker") {
-		return true
-	}
-	_, excluded := excludes[mountPoint]
-	return excluded
-}
-
 func (a AlertService) PageAlertLogs(search dto.AlertLogSearch) (int64, []dto.AlertLogDTO, error) {
 	var (
 		opts   []repo.DBOption
@@ -412,6 +400,7 @@ func (a AlertService) parseAlertLog(item model.AlertLog) (dto.AlertLogDTO, error
 	if err := unmarshalAlertInfo(item.AlertDetail, &alertDetail); err != nil {
 		return dto.AlertLogDTO{}, err
 	}
+	alertDetail.Task = nil
 	if err := unmarshalAlertInfo(item.AlertRule, &alertRule); err != nil {
 		return dto.AlertLogDTO{}, err
 	}
@@ -494,7 +483,13 @@ func (a AlertService) GetAlertConfig(req dto.AlertConfigQuery) ([]model.AlertCon
 	}
 	opts = append(opts, repo.WithByStatus(constant.AlertEnable))
 	configs, err := alertRepo.AlertConfigList(opts...)
-	return configs, err
+	if err != nil {
+		return nil, err
+	}
+	if err := exposeCustomAlertConfigSecrets(configs); err != nil {
+		return nil, err
+	}
+	return configs, nil
 }
 
 func (a AlertService) PageAlertConfig(req dto.AlertConfigPageReq) (int64, []model.AlertConfig, error) {
@@ -505,13 +500,49 @@ func (a AlertService) PageAlertConfig(req dto.AlertConfigPageReq) (int64, []mode
 	if len(req.ExcludeTypes) > 0 {
 		opts = append(opts, alertRepo.WithByTypeNotIn(req.ExcludeTypes))
 	}
-	return alertRepo.PageAlertConfig(req.Page, req.PageSize, opts...)
+	total, configs, err := alertRepo.PageAlertConfig(req.Page, req.PageSize, opts...)
+	if err != nil {
+		return 0, nil, err
+	}
+	if err := exposeCustomAlertConfigSecrets(configs); err != nil {
+		return 0, nil, err
+	}
+	return total, configs, nil
 }
 
 func (a AlertService) UpdateAlertConfig(req dto.AlertConfigUpdate, operator string) error {
+	if req.Type == constant.Custom {
+		if req.ID != 0 && req.Revision == nil {
+			return repo.ErrAlertConfigRevisionRequired
+		}
+		return a.updateCustomAlertConfig(req, operator)
+	}
+	usesMutation, err := alertconfig.UsesMutation(req.Type, req.Config)
+	if err != nil {
+		return err
+	}
+	if req.ID != 0 && usesMutation && req.Revision == nil {
+		return repo.ErrAlertConfigRevisionRequired
+	}
+	var existing *model.AlertConfig
+	if req.ID != 0 {
+		stored, err := alertRepo.GetConfigById(req.ID)
+		if err != nil {
+			return err
+		}
+		if stored.Type != req.Type {
+			return fmt.Errorf("alert config %d has type %s, not %s", req.ID, stored.Type, req.Type)
+		}
+		existing = &stored
+	}
 	if err := a.validateCommunityAlertConfigType(req.Type); err != nil {
 		return err
 	}
+	prepared, err := alertconfig.Prepare(req.Type, req.Config, req.Status, existing)
+	if err != nil {
+		return err
+	}
+	req.Config = prepared
 	if err := a.checkAlertConfigDisplayNameUnique(req); err != nil {
 		return err
 	}
@@ -526,7 +557,7 @@ func (a AlertService) UpdateAlertConfig(req dto.AlertConfigUpdate, operator stri
 		upMap["status"] = req.Status
 		upMap["config"] = req.Config
 		upMap["update_user"] = operator
-		if err := alertRepo.UpdateAlertConfig(upMap, repo.WithByID(req.ID)); err != nil {
+		if err := alertRepo.UpdateAlertConfigWithRevision(upMap, req.Revision, repo.WithByID(req.ID)); err != nil {
 			return err
 		}
 	} else {
@@ -544,6 +575,100 @@ func (a AlertService) UpdateAlertConfig(req dto.AlertConfigUpdate, operator stri
 	return nil
 }
 
+func (a AlertService) updateCustomAlertConfig(req dto.AlertConfigUpdate, operator string) error {
+	if err := validateAlertConfigStatus(req.Status); err != nil {
+		return err
+	}
+
+	var existing *model.AlertConfig
+	if req.ID != 0 {
+		config, err := alertRepo.GetConfigById(req.ID)
+		if err != nil {
+			return err
+		}
+		if config.Type != constant.Custom {
+			return fmt.Errorf("alert config %d is not a custom webhook", req.ID)
+		}
+		existing = &config
+	}
+	prepared, err := alertwebhook.Prepare(req.Config, req.Status, existing)
+	if err != nil {
+		return err
+	}
+	validatedReq := req
+	validatedReq.Config = prepared.Config
+	if err := a.checkAlertConfigDisplayNameUnique(validatedReq); err != nil {
+		return err
+	}
+
+	if existing != nil {
+		return alertRepo.UpdateAlertConfigWithRevision(map[string]interface{}{
+			"type":          constant.Custom,
+			"title":         req.Title,
+			"status":        req.Status,
+			"config":        prepared.Config,
+			"secret_config": prepared.SecretConfig,
+			"update_user":   operator,
+		}, req.Revision, repo.WithByID(req.ID))
+	}
+
+	return alertRepo.CreateAlertConfig(&model.AlertConfig{
+		Type:         constant.Custom,
+		Title:        req.Title,
+		Status:       req.Status,
+		Config:       prepared.Config,
+		SecretConfig: prepared.SecretConfig,
+		CreateUser:   operator,
+		UpdateUser:   operator,
+	})
+}
+
+func (a AlertService) UpdateAlertConfigStatus(req dto.AlertConfigStatusUpdate, operator string) (string, error) {
+	if err := validateAlertConfigStatus(req.Status); err != nil {
+		return "", err
+	}
+	config, err := alertRepo.GetConfigById(req.ID)
+	if err != nil {
+		return "", err
+	}
+	name := alertConfigLogName(config.Config, config.Title)
+	if req.Status == constant.AlertEnable {
+		if err := a.validateCommunityAlertConfigType(config.Type); err != nil {
+			return name, err
+		}
+		if config.Type == constant.Custom {
+			if _, err := alertwebhook.Resolve(config); err != nil {
+				return name, err
+			}
+		}
+	}
+	return name, alertRepo.UpdateAlertConfig(map[string]interface{}{
+		"status":      req.Status,
+		"update_user": operator,
+	}, repo.WithByID(req.ID))
+}
+
+func validateAlertConfigStatus(status string) error {
+	if status != constant.AlertEnable && status != constant.AlertDisable {
+		return fmt.Errorf("alert config status must be Enable or Disable")
+	}
+	return nil
+}
+
+func exposeCustomAlertConfigSecrets(configs []model.AlertConfig) error {
+	for index := range configs {
+		if configs[index].Type != constant.Custom {
+			continue
+		}
+		view, err := alertwebhook.PlainView(configs[index])
+		if err != nil {
+			return fmt.Errorf("build editable custom alert config %d: %w", configs[index].ID, err)
+		}
+		configs[index].Config = view
+	}
+	return nil
+}
+
 func (a AlertService) checkAlertConfigSMSPhoneUnique(req dto.AlertConfigUpdate) error {
 	if req.Type != constant.SMSConfig {
 		return nil
@@ -568,6 +693,9 @@ func (a AlertService) checkAlertConfigSMSPhoneUnique(req dto.AlertConfigUpdate)
 }
 
 func (a AlertService) checkAlertConfigDisplayNameUnique(req dto.AlertConfigUpdate) error {
+	if req.Type != constant.Custom && (global.CONF.Base.IsEnterprise || global.CONF.Base.Edition == "cn") {
+		return nil
+	}
 	displayName := alertConfigDisplayName(req.Type, req.Config)
 	if displayName == "" {
 		return nil
@@ -591,37 +719,67 @@ func (a AlertService) checkAlertConfigDisplayNameUnique(req dto.AlertConfigUpdat
 }
 
 func (a AlertService) validateCommunityAlertMethod(method string) error {
-	if global.CONF.Base.IsEnterprise || global.CONF.Base.Edition == "cn" {
-		return nil
-	}
-	if strings.TrimSpace(method) == "" {
-		return nil
+	methodTypes, err := a.validateAlertMethodReferences(method)
+	if err != nil {
+		return err
 	}
+	return a.validateAlertMethodEntitlement(methodTypes)
+}
 
+func (a AlertService) validateAlertMethodReferences(method string) ([]string, error) {
+	if strings.TrimSpace(method) == "" {
+		return nil, buserr.WithErr("ErrAlertMethodNotSupported", nil)
+	}
+	methodTypes := make([]string, 0)
 	for _, item := range strings.Split(method, ",") {
 		item = strings.TrimSpace(item)
 		if item == "" {
 			continue
 		}
+		configType := ""
 		if configID, err := strconv.ParseUint(item, 10, 64); err == nil {
 			config, err := alertRepo.GetConfigById(uint(configID))
 			if err != nil {
-				return err
+				return nil, err
 			}
-			if _, ok := communityAlertMethodTypeNames[config.Type]; ok {
-				return buserr.WithErr("ErrAlertMethodNotSupported", nil)
+			configType = config.Type
+		} else {
+			var ok bool
+			configType, ok = legacyAlertMethodTypeMap[item]
+			if !ok {
+				return nil, buserr.WithErr("ErrAlertMethodNotSupported", nil)
 			}
+		}
+		if _, ok := supportedAlertMethodTypes[configType]; !ok {
+			return nil, buserr.WithErr("ErrAlertMethodNotSupported", nil)
+		}
+		methodTypes = append(methodTypes, configType)
+	}
+	if len(methodTypes) == 0 {
+		return nil, buserr.WithErr("ErrAlertMethodNotSupported", nil)
+	}
+	return methodTypes, nil
+}
+
+func (a AlertService) validateAlertMethodEntitlement(methodTypes []string) error {
+	for _, configType := range methodTypes {
+		if configType == constant.Custom {
 			continue
 		}
-		if _, ok := communityAlertMethodTypeNames[item]; ok {
+		if global.CONF.Base.IsEnterprise || global.CONF.Base.Edition == "cn" {
+			continue
+		}
+		if _, ok := communityAlertMethodTypeNames[configType]; ok {
 			return buserr.WithErr("ErrAlertMethodNotSupported", nil)
 		}
 	}
-
 	return nil
 }
 
 func (a AlertService) validateCommunityAlertConfigType(configType string) error {
+	if configType == constant.Custom {
+		return nil
+	}
 	if global.CONF.Base.IsEnterprise || global.CONF.Base.Edition == "cn" {
 		return nil
 	}
@@ -633,7 +791,7 @@ func (a AlertService) validateCommunityAlertConfigType(configType string) error
 
 func alertConfigDisplayName(configType, configData string) string {
 	switch configType {
-	case constant.Email, constant.WeCom, constant.DingTalk, constant.FeiShu, constant.Bark, constant.SMS:
+	case constant.Email, constant.WeCom, constant.DingTalk, constant.FeiShu, constant.Bark, constant.SMS, constant.Custom:
 		var cfg struct {
 			DisplayName string `json:"displayName"`
 		}
@@ -656,41 +814,46 @@ func alertConfigSMSPhone(configData string) string {
 	return strings.TrimSpace(cfg.Phone)
 }
 
-func (a AlertService) DeleteAlertConfig(id uint) error {
-	_, err := alertRepo.GetConfigById(id)
+func (a AlertService) DeleteAlertConfig(id uint) (string, error) {
+	config, err := alertRepo.GetConfigById(id)
 	if err != nil {
-		return err
+		return "", err
 	}
+	name := alertConfigLogName(config.Config, config.Title)
 	usedAlerts, err := alertRepo.List(alertRepo.WithByAlertMethodContainsConfigID(id))
 	if err != nil {
-		return err
+		return name, err
 	}
 	if len(usedAlerts) > 0 {
-		return buserr.New("ErrAlertConfigInUse")
+		return name, buserr.New("ErrAlertConfigInUse")
 	}
-	return alertRepo.DeleteAlertConfig(repo.WithByID(id))
+	return name, alertRepo.DeleteAlertConfig(repo.WithByID(id))
 }
 
 func (a AlertService) TestAlertConfig(req dto.AlertConfigTest) (bool, error) {
-	username := req.UserName
-	if username == "" {
-		username = req.Sender
+	emailConfig, err := resolveEmailTestConfig(req)
+	if err != nil {
+		return false, err
 	}
-	encodedDisplayName := mime.BEncoding.Encode("UTF-8", req.DisplayName)
+	username := emailConfig.UserName
+	if username == "" {
+		username = emailConfig.Sender
+	}
+	encodedDisplayName := mime.BEncoding.Encode("UTF-8", emailConfig.DisplayName)
 	cfg := email.SMTPConfig{
-		Host:       req.Host,
-		Port:       req.Port,
-		Sender:     req.Sender,
+		Host:       emailConfig.Host,
+		Port:       emailConfig.Port,
+		Sender:     emailConfig.Sender,
 		Username:   username,
-		Password:   req.Password,
-		From:       fmt.Sprintf(`"%s" <%s>`, encodedDisplayName, req.Sender),
-		Encryption: req.Encryption,
-		Recipient:  req.Recipient,
+		Password:   emailConfig.Password,
+		From:       fmt.Sprintf(`"%s" <%s>`, encodedDisplayName, emailConfig.Sender),
+		Encryption: emailConfig.Encryption,
+		Recipient:  emailConfig.Recipient,
 	}
 
 	msg := email.EmailMessage{
 		Subject: i18n.GetMsgByKey("TestAlertTitle"),
-		Body:    i18n.GetMsgByKey("TestAlert"),
+		Body:    i18n.GetMsgByKey("TestAlertMessage"),
 		IsHTML:  false,
 	}
 	transport := xpack.MultiNodeProvider.LoadRequestTransport()
@@ -700,9 +863,97 @@ func (a AlertService) TestAlertConfig(req dto.AlertConfigTest) (bool, error) {
 	return true, nil
 }
 
+func resolveEmailTestConfig(req dto.AlertConfigTest) (dto.AlertEmailConfig, error) {
+	emailConfig := dto.AlertEmailConfig{
+		Host:        req.Host,
+		Port:        req.Port,
+		Sender:      req.Sender,
+		UserName:    req.UserName,
+		Password:    req.Password,
+		DisplayName: req.DisplayName,
+		Encryption:  req.Encryption,
+		Recipient:   req.Recipient,
+	}
+	if strings.TrimSpace(req.Config) != "" {
+		configType := req.Type
+		if configType == "" {
+			configType = constant.EmailConfig
+		}
+		if configType != constant.EmailConfig {
+			return dto.AlertEmailConfig{}, fmt.Errorf("alert config test type must be email")
+		}
+		var existing *model.AlertConfig
+		if req.ID != 0 {
+			stored, err := alertRepo.GetConfigById(req.ID)
+			if err != nil {
+				return dto.AlertEmailConfig{}, err
+			}
+			existing = &stored
+		}
+		prepared, err := alertconfig.Prepare(configType, req.Config, constant.AlertEnable, existing)
+		if err != nil {
+			return dto.AlertEmailConfig{}, err
+		}
+		if err := json.Unmarshal([]byte(prepared), &emailConfig); err != nil {
+			return dto.AlertEmailConfig{}, fmt.Errorf("decode email alert config: %w", err)
+		}
+	}
+	return emailConfig, nil
+}
+
+func (a AlertService) TestCustomAlertConfig(req dto.AlertConfigTest, lang string) (dto.AlertConfigTestResult, error) {
+	if req.Type != constant.Custom {
+		return dto.AlertConfigTestResult{}, fmt.Errorf("alert config test type must be custom")
+	}
+	var existing *model.AlertConfig
+	if req.ID != 0 {
+		config, err := alertRepo.GetConfigById(req.ID)
+		if err != nil {
+			return dto.AlertConfigTestResult{}, err
+		}
+		if config.Type != constant.Custom {
+			return dto.AlertConfigTestResult{}, fmt.Errorf("alert config %d is not a custom webhook", req.ID)
+		}
+		existing = &config
+	}
+	prepared, err := alertwebhook.Prepare(req.Config, constant.AlertEnable, existing)
+	if err != nil {
+		return dto.AlertConfigTestResult{}, err
+	}
+	resolved, err := alertwebhook.Resolve(model.AlertConfig{
+		Type:         constant.Custom,
+		Config:       prepared.Config,
+		SecretConfig: prepared.SecretConfig,
+	})
+	if err != nil {
+		return dto.AlertConfigTestResult{}, err
+	}
+	tester, ok := xpack.AlertProvider.(providers.CustomWebhookTester)
+	if !ok {
+		if global.LOG != nil {
+			global.LOG.Warnf("webhook test failed: %v", providers.ErrCustomWebhookUnsupported)
+		}
+		return dto.AlertConfigTestResult{
+			Success: false,
+			Message: providers.ErrCustomWebhookUnsupported.Error(),
+		}, nil
+	}
+	return tester.TestCustomWebhook(resolved, lang)
+}
+
 func (a AlertService) ExternalUpdateAlert(updateAlert dto.AlertCreate, operator string) error {
-	if err := a.validateCommunityAlertMethod(updateAlert.Method); err != nil {
-		return err
+	var methodTypes []string
+	if updateAlert.SendCount != 0 || strings.TrimSpace(updateAlert.Method) != "" {
+		var err error
+		methodTypes, err = a.validateAlertMethodReferences(updateAlert.Method)
+		if err != nil {
+			return err
+		}
+	}
+	if updateAlert.SendCount != 0 {
+		if err := a.validateAlertMethodEntitlement(methodTypes); err != nil {
+			return err
+		}
 	}
 	upMap := make(map[string]interface{})
 	var newStatus string
@@ -721,6 +972,23 @@ func (a AlertService) ExternalUpdateAlert(updateAlert dto.AlertCreate, operator
 		alertRepo.WithByType(updateAlert.Type),
 		alertRepo.WithByProject(updateAlert.Project),
 	)
+	advanced, err := prepareCronJobAlertParams(updateAlert.Type, alertInfo.AdvancedParams, updateAlert.AdvancedParams)
+	if err != nil {
+		return err
+	}
+	updateAlert.AdvancedParams = advanced
+	if alertUtil.GetCronJobType(updateAlert.Type) == "cronJob" {
+		upMap["advanced_params"] = advanced
+	}
+	if newStatus == constant.AlertEnable {
+		method := updateAlert.Method
+		if method == "" {
+			method = alertInfo.Method
+		}
+		if err := a.validateCronJobAlertChannels(updateAlert.Type, advanced, method); err != nil {
+			return err
+		}
+	}
 
 	if alertInfo.ID > 0 {
 		shouldUpdate := false
@@ -734,6 +1002,9 @@ func (a AlertService) ExternalUpdateAlert(updateAlert dto.AlertCreate, operator
 		if val, ok := upMap["method"]; ok && val != "" && val != alertInfo.Method {
 			shouldUpdate = true
 		}
+		if val, ok := upMap["advanced_params"]; ok && val != alertInfo.AdvancedParams {
+			shouldUpdate = true
+		}
 
 		if shouldUpdate {
 			if err := alertRepo.Update(
@@ -755,3 +1026,32 @@ func (a AlertService) ExternalUpdateAlert(updateAlert dto.AlertCreate, operator
 
 	return nil
 }
+
+func prepareCronJobAlertParams(alertType, previous, incoming string) (string, error) {
+	if alertUtil.GetCronJobType(alertType) != "cronJob" {
+		return incoming, nil
+	}
+	return alertUtil.MergeCronJobAlertParams(previous, incoming)
+}
+
+func (a AlertService) validateCronJobAlertChannels(alertType, advanced, method string) error {
+	if alertUtil.GetCronJobType(alertType) != "cronJob" {
+		return nil
+	}
+	mode, err := alertUtil.CronJobAlertTriggerMode(advanced)
+	if err != nil || mode != alertUtil.CronJobAlertSuccess {
+		return err
+	}
+	_, err = a.validateAlertMethodReferences(method)
+	return err
+}
+
+func alertConfigLogName(config, title string) string {
+	var value struct {
+		DisplayName string `json:"displayName"`
+	}
+	if json.Unmarshal([]byte(config), &value) == nil && strings.TrimSpace(value.DisplayName) != "" {
+		return strings.TrimSpace(value.DisplayName)
+	}
+	return title
+}

agent/app/service/alert_helper.go

@@ -2,6 +2,7 @@ package service
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"math"
 	"net"
@@ -29,9 +30,11 @@ import (
 )
 
 const (
-	ResourceAlertInterval = 30
-	CheckIntervalSec      = 3
-	LoadCheckIntervalMin  = 5
+	ResourceAlertInterval     = 30
+	CheckIntervalSec          = 3
+	LoadCheckIntervalMin      = 5
+	sshIPLoginWindow          = 30 * time.Minute
+	sslAutoRenewAlertSkipDays = 31
 )
 
 type AlertTaskHelper struct {
@@ -512,10 +515,32 @@ func loadPanelLogin(alert dto.AlertDTO) {
 }
 
 func loadSSHLogin(alert dto.AlertDTO) {
-	count, isAlert, err := alertUtil.CountRecentFailedSSHLog(alert.Cycle, alert.Count)
-	if err != nil {
-		global.LOG.Errorf("Failed to count recent failed ssh login logs: %v", err)
+	now := time.Now()
+	failedWindow := time.Duration(alert.Cycle) * time.Minute
+	loadWindow := failedWindow
+	if loadWindow < sshIPLoginWindow {
+		loadWindow = sshIPLoginWindow
 	}
+	location, err := time.LoadLocation(common.LoadTimeZoneByCmd())
+	if err != nil {
+		global.LOG.Errorf("Failed to load timezone for ssh login logs: %v", err)
+		location = time.Local
+	}
+	histories, err := loadSSHAlertHistories(defaultSSHLogDir, now.Add(-loadWindow), now, location)
+	if err != nil {
+		global.LOG.Errorf("Failed to load ssh login logs: %v", err)
+	}
+	interfaceAddrs, err := net.InterfaceAddrs()
+	if err != nil {
+		global.LOG.Warnf("Failed to load local IP addresses for ssh login alert: %v", err)
+	}
+	count, records := summarizeSSHLoginHistories(
+		histories,
+		now,
+		failedWindow,
+		sshSuccessLoginWhitelist(alert.AdvancedParams, interfaceAddrs),
+	)
+	isAlert := count >= int(alert.Count)
 	if isAlert {
 		params := []dto.Param{
 			{
@@ -531,12 +556,6 @@ func loadSSHLogin(alert dto.AlertDTO) {
 		}
 		sendAlerts(alert, "sshLogin", strconv.Itoa(count), "sshLogin", params)
 	}
-	whitelist := strings.Split(strings.TrimSpace(alert.AdvancedParams), "\n")
-	records, err := alertUtil.FindRecentSuccessLoginNotInWhitelist(30, whitelist)
-	if err != nil {
-		global.LOG.Errorf("Failed to check recent failed ip ssh login logs: %v", err)
-	}
-	records = filterSSHLoginEntriesNotInWhitelist(records, whitelist)
 	if len(records) > 0 {
 		quota := strings.Join(records, "\n")
 		params := []dto.Param{
@@ -555,6 +574,19 @@ func loadSSHLogin(alert dto.AlertDTO) {
 	}
 }
 
+func sshSuccessLoginWhitelist(configured string, interfaceAddrs []net.Addr) []string {
+	whitelist := strings.Split(strings.TrimSpace(configured), "\n")
+	whitelist = append(whitelist, "127.0.0.0/8", "::1")
+	for _, addr := range interfaceAddrs {
+		ipNet, ok := addr.(*net.IPNet)
+		if !ok || ipNet.IP == nil || ipNet.IP.IsUnspecified() {
+			continue
+		}
+		whitelist = append(whitelist, ipNet.IP.String())
+	}
+	return whitelist
+}
+
 func filterLoginLogsNotInWhitelist(records []model.LoginLog, whitelist []string) []model.LoginLog {
 	filtered := make([]model.LoginLog, 0, len(records))
 	for _, record := range records {
@@ -565,20 +597,6 @@ func filterLoginLogsNotInWhitelist(records []model.LoginLog, whitelist []string)
 	return filtered
 }
 
-func filterSSHLoginEntriesNotInWhitelist(records []string, whitelist []string) []string {
-	filtered := make([]string, 0, len(records))
-	for _, record := range records {
-		ip := record
-		if idx := strings.Index(record, "-"); idx >= 0 {
-			ip = record[:idx]
-		}
-		if !isIPInWhitelist(ip, whitelist) {
-			filtered = append(filtered, record)
-		}
-	}
-	return filtered
-}
-
 func isIPInWhitelist(ip string, whitelist []string) bool {
 	targetIP := net.ParseIP(strings.TrimSpace(ip))
 	if targetIP == nil {
@@ -695,9 +713,10 @@ func sendAlertsByConfigId(alert dto.AlertDTO, alertType, quota, quotaType string
 
 func sendAlertsByLegacyMethod(alert dto.AlertDTO, alertType, quota, quotaType string, params []dto.Param, method string) {
 	typeMap := map[string]string{
-		"mail":        constant.Email,
-		constant.Bark: constant.Bark,
-		constant.SMS:  constant.SMS,
+		"mail":          constant.Email,
+		constant.Bark:   constant.Bark,
+		constant.SMS:    constant.SMS,
+		constant.Custom: constant.Custom,
 	}
 	configType, ok := typeMap[method]
 	if !ok {
@@ -785,7 +804,7 @@ func doSendAlert(alert dto.AlertDTO, alertType, quota, quotaType string, params
 		}
 		alertUtil.CreateNewAlertTask(quota, alertType, quotaType, methodStr)
 
-	case constant.WeCom, constant.DingTalk, constant.FeiShu:
+	case constant.WeCom, constant.DingTalk, constant.FeiShu, constant.Custom:
 		todayCount, isValid := canSendAlertToday(alertType, quotaType, alert.SendCount, methodStr)
 		if !isValid {
 			return
@@ -798,12 +817,31 @@ func doSendAlert(alert dto.AlertDTO, alertType, quota, quotaType string, params
 		}
 		transport := xpack.MultiNodeProvider.LoadRequestTransport()
 		agentInfo, _ := xpack.MultiNodeProvider.GetAgentInfo()
-		alertErr := xpack.AlertProvider.CreateWebhookAlertLog(alertType, alert, create, quotaType, params, config, transport, agentInfo)
+		queued := false
+		var alertErr error
+		if config.Type == constant.Custom {
+			task := dto.AlertTaskMetadata{
+				AlertID:   alert.ID,
+				Type:      alertType,
+				Quota:     quota,
+				QuotaType: quotaType,
+				Method:    methodStr,
+			}
+			result, deliveryErr := xpack.DeliverCustomWebhookAlertLog(alertType, alert, create, quotaType, params, config, transport, agentInfo, task)
+			queued, alertErr = result.Queued, deliveryErr
+			if alertErr == nil && result.Queued {
+				_, alertErr = alertUtil.RecordQueuedAlertTask(result.LogID, task)
+			}
+		} else {
+			alertErr = xpack.AlertProvider.CreateWebhookAlertLog(alertType, alert, create, quotaType, params, config, transport, agentInfo)
+		}
 		if alertErr != nil {
 			global.LOG.Infof("%s alert webhook %s push faild, err: %v", alertType, methodStr, alertErr)
 			return
 		}
-		alertUtil.CreateNewAlertTask(quota, alertType, quotaType, methodStr)
+		if !queued {
+			alertUtil.CreateNewAlertTask(quota, alertType, quotaType, methodStr)
+		}
 	}
 }
 
@@ -844,7 +882,7 @@ func calculateSSLExpiryDays(sslList []model.WebsiteSSL, cycle uint) (map[int][]s
 		daysDiff := int(math.Ceil(
 			ssl.ExpireDate.Sub(currentDate).Hours() / 24,
 		))
-		if daysDiff > 0 && int(cycle) >= daysDiff {
+		if daysDiff > 0 && int(cycle) >= daysDiff && !shouldSuppressSSLExpiryAlert(ssl, daysDiff) {
 			daysDiffMap[daysDiff] = append(daysDiffMap[daysDiff], ssl.PrimaryDomain)
 			projectMap[ssl.ID] = append(projectMap[ssl.ID], ssl.ExpireDate)
 		}
@@ -852,6 +890,10 @@ func calculateSSLExpiryDays(sslList []model.WebsiteSSL, cycle uint) (map[int][]s
 	return daysDiffMap, projectMap
 }
 
+func shouldSuppressSSLExpiryAlert(ssl model.WebsiteSSL, remainingDays int) bool {
+	return ssl.AutoRenew && remainingDays < sslAutoRenewAlertSkipDays
+}
+
 func calculateWebsiteExpiryDays(websites []model.Website, cycle uint) (map[int][]string, map[uint][]time.Time) {
 	currentDate := time.Now()
 	daysDiffMap := make(map[int][]string)
@@ -1024,50 +1066,37 @@ func processAllDisks(alert dto.AlertDTO) error {
 		global.LOG.Errorf("error getting disk list, err: %v", err)
 		return err
 	}
-	var errMsgs []string
 	for _, item := range diskList {
-		err := checkAndCreateDiskAlert(alert, item.Path)
-		if err != nil {
-			errMsg := fmt.Sprintf("disk path %s process failed: %v", item.Path, err)
-			errMsgs = append(errMsgs, errMsg)
-			global.LOG.Errorf("%s", errMsg)
+		if item.Total == 0 {
 			continue
 		}
-	}
-	if len(errMsgs) > 0 {
-		return fmt.Errorf("batch process disks failed, error count: %d, details: %s", len(errMsgs), strings.Join(errMsgs, "; "))
+		checkAndCreateDiskAlert(alert, item.Path, &disk.UsageStat{Used: item.Used, UsedPercent: item.UsedPercent})
 	}
 	return nil
 }
 
 func processSingleDisk(alert dto.AlertDTO) error {
-	err := checkAndCreateDiskAlert(alert, alert.Project)
+	usageStat, err := loadDiskUsageWithTimeout(alert.Project, true)
 	if err != nil {
-		global.LOG.Errorf("%s", err.Error())
+		global.LOG.Errorf("error getting disk usage for %s, err: %v", alert.Project, err)
 		return err
 	}
+	checkAndCreateDiskAlert(alert, alert.Project, usageStat)
 	return nil
 }
 
-func checkAndCreateDiskAlert(alert dto.AlertDTO, path string) error {
-	usageStat, err := psutil.DISK.GetUsage(path, false)
-	if err != nil {
-		global.LOG.Errorf("error getting disk usage for %s, err: %v", path, err)
-		return err
-	}
-
+func checkAndCreateDiskAlert(alert dto.AlertDTO, path string, usageStat *disk.UsageStat) {
 	usedTotal, usedStr := calculateUsedTotal(alert.Cycle, usageStat)
 	commonTotal := float64(alert.Count)
 	if alert.Cycle == 1 {
 		commonTotal *= 1024 * 1024 * 1024
 	}
 	if usedTotal < commonTotal {
-		return nil
+		return
 	}
 	params := createAlertDiskParams(path, usedStr)
 	sender := NewAlertSender(alert, alert.Project)
 	sender.ResourceSend(path, params)
-	return nil
 }
 
 func calculateUsedTotal(cycle uint, usageStat *disk.UsageStat) (float64, string) {
@@ -1097,3 +1126,55 @@ func calculateMinutesDifference(newDate time.Time) int {
 	minutesDifference := int(now.Sub(newDate).Minutes())
 	return minutesDifference
 }
+
+func loadSSHAlertHistories(
+	baseDir string,
+	startTime, endTime time.Time,
+	location *time.Location,
+) ([]dto.SSHHistory, error) {
+	fileList, err := listSSHLogFiles(baseDir)
+	if err != nil {
+		return nil, err
+	}
+
+	var (
+		histories []dto.SSHHistory
+		loadErr   error
+	)
+	for _, file := range fileList {
+		items, err := loadSSHHistoriesFromFile(file.Name, "", "", startTime, endTime, file.Year, location)
+		if err != nil {
+			loadErr = errors.Join(loadErr, fmt.Errorf("load SSH log file %s: %w", file.Name, err))
+			continue
+		}
+		histories = append(histories, items...)
+	}
+	return histories, loadErr
+}
+
+func summarizeSSHLoginHistories(
+	histories []dto.SSHHistory,
+	now time.Time,
+	failedWindow time.Duration,
+	whitelist []string,
+) (int, []string) {
+	failedStartTime := now.Add(-failedWindow)
+	successStartTime := now.Add(-sshIPLoginWindow)
+	failedCount := 0
+	var abnormalLogins []string
+
+	for _, item := range histories {
+		switch item.Status {
+		case constant.StatusFailed:
+			if isSSHLogWithinTimeRange(item.Date, failedStartTime, now) {
+				failedCount++
+			}
+		case constant.StatusSuccess:
+			if !isSSHLogWithinTimeRange(item.Date, successStartTime, now) || isIPInWhitelist(item.Address, whitelist) {
+				continue
+			}
+			abnormalLogins = append(abnormalLogins, fmt.Sprintf("%s-%s", item.Address, item.Date.Format(constant.DateTimeLayout)))
+		}
+	}
+	return failedCount, abnormalLogins
+}

agent/app/service/alert_sender.go

@@ -75,7 +75,7 @@ func (s *AlertSender) sendByConfig(config model.AlertConfig, quota string, param
 		} else {
 			s.sendBarkWithConfig(config, quota, params)
 		}
-	case constant.WeCom, constant.DingTalk, constant.FeiShu:
+	case constant.WeCom, constant.DingTalk, constant.FeiShu, constant.Custom:
 		if isResource {
 			s.sendResourceWebhookWithConfig(config, quota, params)
 		} else {
@@ -86,7 +86,7 @@ func (s *AlertSender) sendByConfig(config model.AlertConfig, quota string, param
 
 func (s *AlertSender) sendByLegacyMethod(method string, quota string, params []dto.Param, isResource bool) {
 	alertRepo := repo.NewIAlertRepo()
-	typeMap := map[string]string{"mail": constant.Email, constant.Bark: constant.Bark, constant.SMS: constant.SMS}
+	typeMap := map[string]string{"mail": constant.Email, constant.Bark: constant.Bark, constant.SMS: constant.SMS, constant.Custom: constant.Custom}
 	configType := method
 	if mapped, ok := typeMap[method]; ok {
 		configType = mapped
@@ -308,12 +308,31 @@ func (s *AlertSender) sendWebhookWithConfig(config model.AlertConfig, quota stri
 	}
 	transport := xpack.MultiNodeProvider.LoadRequestTransport()
 	agentInfo, _ := xpack.MultiNodeProvider.GetAgentInfo()
-	err := xpack.AlertProvider.CreateWebhookAlertLog(s.alert.Type, s.alert, create, quota, params, config, transport, agentInfo)
+	queued := false
+	var err error
+	if config.Type == constant.Custom {
+		task := dto.AlertTaskMetadata{
+			AlertID:   s.alert.ID,
+			Type:      s.alert.Type,
+			Quota:     quota,
+			QuotaType: s.quotaType,
+			Method:    strconv.Itoa(int(config.ID)),
+		}
+		result, deliveryErr := xpack.DeliverCustomWebhookAlertLog(s.alert.Type, s.alert, create, quota, params, config, transport, agentInfo, task)
+		queued, err = result.Queued, deliveryErr
+		if err == nil && result.Queued {
+			_, err = alertUtil.RecordQueuedAlertTask(result.LogID, task)
+		}
+	} else {
+		err = xpack.AlertProvider.CreateWebhookAlertLog(s.alert.Type, s.alert, create, quota, params, config, transport, agentInfo)
+	}
 	if err != nil {
 		global.LOG.Errorf("%s alert %s webhook push failed: %v", s.alert.Type, config.Type, err)
 		return
 	}
-	alertUtil.CreateNewAlertTask(quota, s.alert.Type, s.quotaType, strconv.Itoa(int(config.ID)))
+	if !queued {
+		alertUtil.CreateNewAlertTask(quota, s.alert.Type, s.quotaType, strconv.Itoa(int(config.ID)))
+	}
 }
 
 func (s *AlertSender) sendResourceWebhookWithConfig(config model.AlertConfig, quota string, params []dto.Param) {
@@ -334,11 +353,31 @@ func (s *AlertSender) sendResourceWebhookWithConfig(config model.AlertConfig, qu
 	}
 	transport := xpack.MultiNodeProvider.LoadRequestTransport()
 	agentInfo, _ := xpack.MultiNodeProvider.GetAgentInfo()
-	if err := xpack.AlertProvider.CreateWebhookAlertLog(s.alert.Type, s.alert, create, quota, params, config, transport, agentInfo); err != nil {
+	queued := false
+	var err error
+	if config.Type == constant.Custom {
+		task := dto.AlertTaskMetadata{
+			AlertID:   s.alert.ID,
+			Type:      s.alert.Type,
+			Quota:     quota,
+			QuotaType: s.quotaType,
+			Method:    strconv.Itoa(int(config.ID)),
+		}
+		result, deliveryErr := xpack.DeliverCustomWebhookAlertLog(s.alert.Type, s.alert, create, quota, params, config, transport, agentInfo, task)
+		queued, err = result.Queued, deliveryErr
+		if err == nil && result.Queued {
+			_, err = alertUtil.RecordQueuedAlertTask(result.LogID, task)
+		}
+	} else {
+		err = xpack.AlertProvider.CreateWebhookAlertLog(s.alert.Type, s.alert, create, quota, params, config, transport, agentInfo)
+	}
+	if err != nil {
 		global.LOG.Errorf("%s alert %s webhook push failed: %v", s.alert.Type, config.Type, err)
 		return
 	}
-	alertUtil.CreateNewAlertTask(quota, s.alert.Type, s.quotaType, strconv.Itoa(int(config.ID)))
+	if !queued {
+		alertUtil.CreateNewAlertTask(quota, s.alert.Type, s.quotaType, strconv.Itoa(int(config.ID)))
+	}
 }
 
 func (s *AlertSender) sendWebhook(quota string, params []dto.Param, method string) {

agent/app/service/app.go

@@ -223,6 +223,9 @@ func (a AppService) GetAppDetailByKey(appKey, version string) (response.AppDetai
 	if err != nil {
 		return appDetailDTO, err
 	}
+	if err = checkVllmVersionAccess(app.Key, version); err != nil {
+		return appDetailDTO, err
+	}
 	appDetail, err := appDetailRepo.GetFirst(appDetailRepo.WithAppId(app.ID), appDetailRepo.WithVersion(version))
 	if err != nil {
 		return appDetailDTO, err
@@ -241,37 +244,49 @@ func (a AppService) GetAppDetail(appID uint, version, appType string) (response.
 	if err != nil {
 		return appDetailDTO, err
 	}
+	app, err := appRepo.GetFirst(repo.WithByID(detail.AppId))
+	if err != nil {
+		return appDetailDTO, err
+	}
+	if err = checkVllmVersionAccess(app.Key, detail.Version); err != nil {
+		return appDetailDTO, err
+	}
 	appDetailDTO.AppDetail = detail
 	appDetailDTO.Enable = true
 
 	if appType == "runtime" {
-		app, err := appRepo.GetFirst(repo.WithByID(appID))
-		if err != nil {
-			return appDetailDTO, err
-		}
 		fileOp := files.NewFileOp()
 
 		versionPath := filepath.Join(app.GetAppResourcePath(), detail.Version)
-		if !fileOp.Stat(versionPath) || detail.Update {
-			if err = downloadApp(app, detail, nil, nil); err != nil && !fileOp.Stat(versionPath) {
-				return appDetailDTO, err
-			}
+		if err = downloadApp(app, detail, nil, nil); err != nil && !fileOp.Stat(versionPath) {
+			return appDetailDTO, err
+		}
+		if err == nil && app.Resource == constant.AppResourceRemote {
+			detail.Update = false
+			appDetailDTO.Update = false
 		}
 		switch app.Type {
 		case constant.RuntimePHP:
-			paramsPath := filepath.Join(versionPath, "data.yml")
-			if !fileOp.Stat(paramsPath) {
-				return appDetailDTO, buserr.WithDetail("ErrFileNotExist", paramsPath, nil)
-			}
-			param, err := fileOp.GetContent(paramsPath)
-			if err != nil {
-				return appDetailDTO, err
-			}
 			paramMap := make(map[string]interface{})
-			if err = yaml.Unmarshal(param, &paramMap); err != nil {
-				return appDetailDTO, err
+			if app.Resource == constant.AppResourceRemote {
+				if err = json.Unmarshal([]byte(detail.Params), &paramMap); err != nil {
+					return appDetailDTO, err
+				}
+				appDetailDTO.Params = paramMap
+			} else {
+				paramsPath := filepath.Join(versionPath, "data.yml")
+				if !fileOp.Stat(paramsPath) {
+					return appDetailDTO, buserr.WithDetail("ErrFileNotExist", paramsPath, nil)
+				}
+				param, err := fileOp.GetContent(paramsPath)
+				if err != nil {
+					return appDetailDTO, err
+				}
+				if err = yaml.Unmarshal(param, &paramMap); err != nil {
+					return appDetailDTO, err
+				}
+				appDetailDTO.Params = paramMap["additionalProperties"]
 			}
-			appDetailDTO.Params = paramMap["additionalProperties"]
 			composePath := filepath.Join(versionPath, "docker-compose.yml")
 			if !fileOp.Stat(composePath) {
 				return appDetailDTO, buserr.WithDetail("ErrFileNotExist", composePath, nil)
@@ -302,6 +317,12 @@ func (a AppService) GetAppDetail(appID uint, version, appType string) (response.
 	if appDetailDTO.DockerCompose == "" {
 		filename := filepath.Base(appDetailDTO.DownloadUrl)
 		dockerComposeUrl := fmt.Sprintf("%s%s", strings.TrimSuffix(appDetailDTO.DownloadUrl, filename), "docker-compose.yml")
+		if app.Resource == constant.AppResourceRemote {
+			dockerComposeUrl, err = currentAppDownloadURL(dockerComposeUrl)
+			if err != nil {
+				return appDetailDTO, err
+			}
+		}
 		statusCode, composeRes, err := req_helper.HandleRequest(dockerComposeUrl, http.MethodGet, constant.TimeOut20s)
 		if statusCode == http.StatusNotFound {
 			return appDetailDTO, buserr.New("ErrAppVersionUnavailable")
@@ -319,10 +340,6 @@ func (a AppService) GetAppDetail(appID uint, version, appType string) (response.
 
 	appDetailDTO.HostMode = isHostModel(appDetailDTO.DockerCompose)
 
-	app, err := appRepo.GetFirst(repo.WithByID(detail.AppId))
-	if err != nil {
-		return appDetailDTO, err
-	}
 	if err := checkLimit(app); err != nil {
 		appDetailDTO.Enable = false
 	}
@@ -374,6 +391,9 @@ func (a AppService) installWithHooks(req request.AppInstallCreate, executeScript
 	if err != nil {
 		return
 	}
+	if err = checkVllmVersionAccess(app.Key, appDetail.Version); err != nil {
+		return
+	}
 	if DatabaseKeys[app.Key] > 0 {
 		if existDatabases, _ := databaseRepo.GetList(repo.WithByName(req.Name)); len(existDatabases) > 0 {
 			err = buserr.New("ErrRemoteExist")
@@ -429,6 +449,12 @@ func (a AppService) installWithHooks(req request.AppInstallCreate, executeScript
 	} else {
 		if appDetail.DockerCompose == "" {
 			dockerComposeUrl := fmt.Sprintf("%s/%s/1panel/%s/%s/docker-compose.yml", global.AppRepoURL(), global.CONF.Base.Mode, app.Key, appDetail.Version)
+			if app.Resource == constant.AppResourceRemote {
+				dockerComposeUrl, err = currentAppDownloadURL(dockerComposeUrl)
+				if err != nil {
+					return
+				}
+			}
 			var statusCode int
 			statusCode, composeRes, err = req_helper.HandleRequest(dockerComposeUrl, http.MethodGet, constant.TimeOut20s)
 			if statusCode == http.StatusNotFound {
@@ -473,6 +499,22 @@ func (a AppService) installWithHooks(req request.AppInstallCreate, executeScript
 	req.Params[constant.ContainerName] = containerName
 	appInstall.ContainerName = containerName
 
+	modelAccountBaseURL := ""
+	if app.Key == "ollama" {
+		appInstall.SyncModelAccount = req.SyncModelAccount == nil || *req.SyncModelAccount
+		appInstall.ModelAccountBaseURLType = req.ModelAccountBaseURLType
+		if appInstall.ModelAccountBaseURLType == "" {
+			appInstall.ModelAccountBaseURLType = "container"
+		}
+		appInstall.ModelAccountBaseURL = req.ModelAccountBaseURL
+	}
+	if app.Key == "ollama" && appInstall.SyncModelAccount {
+		modelAccountBaseURL, err = ResolveLocalModelAccountBaseURL(req.ModelAccountBaseURLType, req.ModelAccountBaseURL, containerName, "11434", httpPort)
+		if err != nil {
+			return
+		}
+	}
+
 	index := 0
 	serviceName := ""
 	for k := range servicesMap {
@@ -483,15 +525,17 @@ func (a AppService) installWithHooks(req request.AppInstallCreate, executeScript
 		index++
 	}
 	newServiceName := strings.ToLower(appInstall.Name)
-	if app.Limit == 0 && newServiceName != serviceName && len(servicesMap) == 1 {
+	if app.Limit == 0 && newServiceName != serviceName && len(servicesMap) == 1 && !req.KeepServiceName {
 		servicesMap[newServiceName] = servicesMap[serviceName]
 		delete(servicesMap, serviceName)
 		serviceName = newServiceName
 	}
 	appInstall.ServiceName = serviceName
 
-	if err = addDockerComposeCommonParam(composeMap, appInstall.ServiceName, req.AppContainerConfig, req.Params); err != nil {
-		return
+	if !req.SkipComposeCommonConfig {
+		if err = addDockerComposeCommonParam(composeMap, appInstall.ServiceName, req.AppContainerConfig, req.Params); err != nil {
+			return
+		}
 	}
 	var (
 		composeByte []byte
@@ -543,6 +587,11 @@ func (a AppService) installWithHooks(req request.AppInstallCreate, executeScript
 
 	installTask, err := task.NewTaskWithOps(appInstall.Name, task.TaskInstall, task.TaskScopeApp, req.TaskID, appInstall.ID)
 	if err != nil {
+		appInstall.Status = constant.StatusInstallErr
+		appInstall.Message = err.Error()
+		if saveErr := appInstallRepo.Save(context.Background(), appInstall); saveErr != nil {
+			err = fmt.Errorf("%w; save failed install status: %v", err, saveErr)
+		}
 		return
 	}
 
@@ -550,7 +599,7 @@ func (a AppService) installWithHooks(req request.AppInstallCreate, executeScript
 		return
 	}
 
-	installApp := func(t *task.Task) error {
+	installApp := func(t *task.Task) (err error) {
 		if err = copyData(t, app, appDetail, appInstall, req); err != nil {
 			return err
 		}
@@ -559,7 +608,7 @@ func (a AppService) installWithHooks(req request.AppInstallCreate, executeScript
 				return err
 			}
 		}
-		if executeScript {
+		if executeScript || req.UseLifecycleScripts {
 			if err = runScript(t, appInstall, "init"); err != nil {
 				return err
 			}
@@ -572,10 +621,14 @@ func (a AppService) installWithHooks(req request.AppInstallCreate, executeScript
 				return err
 			}
 		}
-		if err = upApp(t, appInstall, req.PullImage); err != nil {
+		if err = upApp(t, appInstall, req.PullImage, req.UseLifecycleScripts); err != nil {
 			return err
 		}
 		updateToolApp(appInstall)
+		if app.Key == "ollama" && appInstall.SyncModelAccount {
+			_, err := SyncLocalModelAccount(*appInstall, 0, modelAccountBaseURL, nil, false, true)
+			return err
+		}
 		return nil
 	}
 

agent/app/service/app_install.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"maps"
 	"math"
 	"net/http"
 	"os"
@@ -13,12 +14,14 @@ import (
 	"sort"
 	"strconv"
 	"strings"
+	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/response"
 	"github.com/1Panel-dev/1Panel/agent/app/model"
 	"github.com/1Panel-dev/1Panel/agent/app/repo"
+	"github.com/1Panel-dev/1Panel/agent/app/task"
 	"github.com/1Panel-dev/1Panel/agent/buserr"
 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/global"
@@ -156,6 +159,14 @@ func (a *AppInstallService) CheckExist(req request.AppInstalledInfo) (*response.
 	}
 
 	res.ContainerName = appInstall.ContainerName
+	res.ModelAccountBaseURLType = appInstall.ModelAccountBaseURLType
+	res.ModelAccountBaseURL = appInstall.ModelAccountBaseURL
+	if app.Key == "ollama" {
+		res.ModelAccountBaseURLType, res.ModelAccountBaseURL, err = loadOllamaModelAccountAddress(appInstall)
+		if err != nil {
+			return nil, err
+		}
+	}
 	res.Name = appInstall.Name
 	res.Version = appInstall.Version
 	res.CreatedAt = appInstall.CreatedAt
@@ -252,6 +263,9 @@ func (a *AppInstallService) Operate(req request.AppInstalledOperate) error {
 		return buserr.New("ErrInstallDirNotFound")
 	}
 	dockerComposePath := install.GetComposePath()
+	if req.UseLifecycleScripts && (req.Operate == constant.Start || req.Operate == constant.Stop || req.Operate == constant.Restart) {
+		return operateAppWithLifecycleScripts(install, req, nil)
+	}
 	switch req.Operate {
 	case constant.Rebuild:
 		return rebuildApp(install)
@@ -275,12 +289,13 @@ func (a *AppInstallService) Operate(req request.AppInstalledOperate) error {
 		return syncAppInstallStatus(&install, false)
 	case constant.Delete:
 		deleteReq := request.AppInstallDelete{
-			Install:      install,
-			DeleteBackup: req.DeleteBackup,
-			ForceDelete:  req.ForceDelete,
-			DeleteDB:     req.DeleteDB,
-			DeleteImage:  req.DeleteImage,
-			TaskID:       req.TaskID,
+			Install:             install,
+			DeleteBackup:        req.DeleteBackup,
+			ForceDelete:         req.ForceDelete,
+			DeleteDB:            req.DeleteDB,
+			DeleteImage:         req.DeleteImage,
+			TaskID:              req.TaskID,
+			UseLifecycleScripts: req.UseLifecycleScripts,
 		}
 		if err = deleteAppInstall(deleteReq); err != nil && !req.ForceDelete {
 			return err
@@ -290,13 +305,14 @@ func (a *AppInstallService) Operate(req request.AppInstalledOperate) error {
 		return syncAppInstallStatus(&install, true)
 	case constant.Upgrade:
 		upgradeReq := request.AppInstallUpgrade{
-			InstallID:     install.ID,
-			DetailID:      req.DetailId,
-			Backup:        req.Backup,
-			PullImage:     req.PullImage,
-			DeleteImage:   req.DeleteImage,
-			DockerCompose: req.DockerCompose,
-			TaskID:        req.TaskID,
+			FeishuTransition: req.FeishuTransition,
+			InstallID:        install.ID,
+			DetailID:         req.DetailId,
+			Backup:           req.Backup,
+			PullImage:        req.PullImage,
+			DeleteImage:      req.DeleteImage,
+			DockerCompose:    req.DockerCompose,
+			TaskID:           req.TaskID,
 		}
 		return upgradeInstall(upgradeReq)
 	case constant.Reload:
@@ -312,6 +328,75 @@ func (a *AppInstallService) Operate(req request.AppInstalledOperate) error {
 	}
 }
 
+func operateAppWithLifecycleScripts(install model.AppInstall, req request.AppInstalledOperate, onFailure func(error)) error {
+	taskType := task.TaskUpdate
+	switch req.Operate {
+	case constant.Start:
+		install.Status = constant.StatusStarting
+	case constant.Restart:
+		taskType = task.TaskRestart
+		install.Status = constant.StatusRestarting
+	case constant.Stop:
+		install.Status = constant.StatusWaiting
+	default:
+		return errors.New("lifecycle script operation not supported")
+	}
+	install.Message = ""
+	if err := appInstallRepo.Save(context.Background(), &install); err != nil {
+		return err
+	}
+
+	operationTask, err := task.NewTaskWithOps(install.Name, taskType, task.TaskScopeApp, req.TaskID, install.ID)
+	if err != nil {
+		install.Status = constant.StatusUpErr
+		install.Message = err.Error()
+		if saveErr := appInstallRepo.Save(context.Background(), &install); saveErr != nil {
+			return fmt.Errorf("%w; save failed operation status: %v", err, saveErr)
+		}
+		return err
+	}
+	operation := string(req.Operate)
+	operationTask.AddSubTaskWithOps(
+		task.GetTaskName(install.Name, taskType, task.TaskScopeApp),
+		func(t *task.Task) error {
+			if err := runScript(t, &install, operation); err != nil {
+				return err
+			}
+			if req.Operate == constant.Stop {
+				install.Status = constant.StatusStopped
+				install.Message = ""
+				return appInstallRepo.Save(context.Background(), &install)
+			}
+			containerNames, err := getContainerNames(install)
+			if err != nil {
+				return err
+			}
+			if len(containerNames) == 0 {
+				return buserr.WithName("ErrContainerNotFound", install.Name)
+			}
+			install.ContainerName = strings.Join(containerNames, ",")
+			install.Status = constant.StatusRunning
+			install.Message = ""
+			return appInstallRepo.Save(context.Background(), &install)
+		},
+		nil,
+		0,
+		time.Hour,
+	)
+	go func() {
+		if taskErr := operationTask.Execute(); taskErr != nil {
+			if onFailure != nil {
+				onFailure(taskErr)
+				return
+			}
+			install.Status = constant.StatusUpErr
+			install.Message = taskErr.Error()
+			_ = appInstallRepo.Save(context.Background(), &install)
+		}
+	}()
+	return nil
+}
+
 func (a *AppInstallService) UpdateAppConfig(req request.AppConfigUpdate) error {
 	installed, err := appInstallRepo.GetFirst(repo.WithByID(req.InstallID))
 	if err != nil {
@@ -362,6 +447,32 @@ func (a *AppInstallService) Update(req request.AppInstalledUpdate) error {
 		}
 	}
 
+	modelAccountBaseURL := ""
+	if installed.App.Key == "ollama" {
+		if req.SyncModelAccount != nil {
+			installed.SyncModelAccount = *req.SyncModelAccount
+		}
+		if req.ModelAccountBaseURLType != "" {
+			installed.ModelAccountBaseURLType = req.ModelAccountBaseURLType
+			installed.ModelAccountBaseURL = req.ModelAccountBaseURL
+		} else if installed.SyncModelAccount {
+			installed.ModelAccountBaseURLType, installed.ModelAccountBaseURL, err = loadOllamaModelAccountAddress(oldInstalled)
+			if err != nil {
+				return err
+			}
+		}
+		if installed.SyncModelAccount {
+			containerName := installed.ContainerName
+			if req.Advanced && req.ContainerName != "" {
+				containerName = req.ContainerName
+			}
+			modelAccountBaseURL, err = ResolveLocalModelAccountBaseURL(installed.ModelAccountBaseURLType, installed.ModelAccountBaseURL, containerName, "11434", installed.HttpPort)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
 	backupDockerCompose := installed.DockerCompose
 	if req.Advanced {
 		composeMap := make(map[string]interface{})
@@ -374,8 +485,10 @@ func (a *AppInstallService) Update(req request.AppInstalledUpdate) error {
 				return err
 			}
 		}
-		if err = addDockerComposeCommonParam(composeMap, installed.ServiceName, req.AppContainerConfig, req.Params); err != nil {
-			return err
+		if !req.SkipComposeCommonConfig {
+			if err = addDockerComposeCommonParam(composeMap, installed.ServiceName, req.AppContainerConfig, req.Params); err != nil {
+				return err
+			}
 		}
 		composeByte, err := yaml.Marshal(composeMap)
 		if err != nil {
@@ -408,7 +521,7 @@ func (a *AppInstallService) Update(req request.AppInstalledUpdate) error {
 	if err != nil {
 		return err
 	}
-	backupEnvMaps := oldEnvMaps
+	backupEnvMaps := maps.Clone(oldEnvMaps)
 	handleMap(req.Params, oldEnvMaps)
 	paramByte, err := json.Marshal(oldEnvMaps)
 	if err != nil {
@@ -420,13 +533,32 @@ func (a *AppInstallService) Update(req request.AppInstalledUpdate) error {
 	}
 	fileOp := files.NewFileOp()
 	_ = fileOp.WriteFile(installed.GetComposePath(), strings.NewReader(installed.DockerCompose), constant.DirPerm)
-	if err := rebuildApp(installed); err != nil {
+	restoreConfig := func(operationErr error) {
 		_ = env.Write(backupEnvMaps, envPath)
 		_ = fileOp.WriteFile(installed.GetComposePath(), strings.NewReader(backupDockerCompose), constant.DirPerm)
+		failed := oldInstalled
+		failed.Status = constant.StatusUpErr
+		failed.Message = operationErr.Error()
+		_ = appInstallRepo.Save(context.Background(), &failed)
+	}
+	if req.UseLifecycleScripts {
+		err = operateAppWithLifecycleScripts(installed, request.AppInstalledOperate{
+			InstallId:           installed.ID,
+			Operate:             constant.Restart,
+			TaskID:              req.TaskID,
+			UseLifecycleScripts: true,
+		}, restoreConfig)
+	} else {
+		err = rebuildApp(installed)
+	}
+	if err != nil {
+		restoreConfig(err)
 		return err
 	}
-	installed.Status = constant.StatusRunning
-	_ = appInstallRepo.Save(context.Background(), &installed)
+	if !req.UseLifecycleScripts {
+		installed.Status = constant.StatusRunning
+		_ = appInstallRepo.Save(context.Background(), &installed)
+	}
 
 	proxyChanged := hasAppInstallProxyPassChanged(&oldInstalled, &installed)
 	currentProxy, currentProxyErr := getAppInstallProxyPass(&installed)
@@ -466,6 +598,9 @@ func (a *AppInstallService) Update(req request.AppInstalledUpdate) error {
 	if proxyChanged && website.ID != 0 && currentProxyErr != nil {
 		global.LOG.Error(buserr.WithErr("ErrUpdateBuWebsite", currentProxyErr).Error())
 	}
+	if installed.App.Key == "ollama" && installed.SyncModelAccount {
+		return syncOllamaModelAccount(installed, modelAccountBaseURL, true, true)
+	}
 	return nil
 }
 
@@ -475,11 +610,15 @@ func (a *AppInstallService) SyncAll(systemInit bool) error {
 		return err
 	}
 	for _, i := range allList {
-		if i.Status == constant.StatusInstalling || i.Status == constant.StatusUpgrading || i.Status == constant.StatusRebuilding || i.Status == constant.StatusUninstalling {
+		if appInstallOperationInterruptedOnRestart(i.Status) {
 			if systemInit {
-				i.Status = constant.StatusError
-				i.Message = "1Panel restart causes the task to terminate"
-				_ = appInstallRepo.Save(context.Background(), &i)
+				i.Status = appInstallOperationFailureStatus(i.Status)
+				i.Message = constant.InterruptedMsg
+				if err := appInstallRepo.Save(context.Background(), &i); err != nil {
+					return err
+				}
+			} else if err := syncAppInstallStatus(&i, false); err != nil {
+				global.LOG.Errorf("sync install app[%s] error,mgs: %s", i.Name, err.Error())
 			}
 			continue
 		}
@@ -578,28 +717,53 @@ func (a *AppInstallService) GetUpdateVersions(req request.AppUpdateVersion) ([]d
 	if err != nil {
 		return versions, err
 	}
+	var feishuLegacy, feishuConfigured, feishuChecked bool
 	details, err := appDetailRepo.GetBy(appDetailRepo.WithAppId(app.ID))
 	if err != nil {
 		return versions, err
 	}
 	for _, detail := range details {
+		if !canAccessVllmVersion(app.Key, detail.Version) {
+			continue
+		}
+		if !isAIGatewayUpgradeVersionAllowed(app.Key, install.Version, detail.Version) {
+			continue
+		}
 		ignores, _ := appIgnoreUpgradeRepo.List(runtimeRepo.WithDetailId(detail.ID), appIgnoreUpgradeRepo.WithScope("version"))
 		if len(ignores) > 0 {
 			continue
 		}
-		if common.IsCrossVersion(install.Version, detail.Version) && !app.CrossVersionUpdate {
+		if isCrossAppVersion(app.Key, install.Version, detail.Version) && !app.CrossVersionUpdate {
 			continue
 		}
-		canUpgrade := common.CompareVersion(detail.Version, install.Version)
+		canUpgrade := isNewerAppVersion(app.Key, detail.Version, install.Version)
 		if app.Key == vllmAppKeyForUpgrade {
 			currentImage := loadVllmImageFromEnv(install.Env)
 			canUpgrade = isVllmUpgradeCandidate(install.Version, detail.Version, currentImage)
 		}
 		if canUpgrade {
+			feishuTarget := app.Key == constant.AppOpenclaw && isOpenclawBundledFeishuVersion(detail.Version)
+			if feishuTarget && !feishuChecked {
+				conf, readErr := readOpenclawConfig(path.Join(install.GetPath(), "data/conf/openclaw.json"))
+				if readErr != nil {
+					return versions, readErr
+				}
+				feishuLegacy, feishuConfigured, err = classifyLegacyFeishu(conf, install.GetPath())
+				if err != nil {
+					return versions, err
+				}
+				feishuChecked = true
+			}
 			var newCompose string
 			if req.UpdateVersion != "" && req.UpdateVersion == detail.Version && detail.DockerCompose == "" && !app.IsLocalApp() {
 				filename := filepath.Base(detail.DownloadUrl)
 				dockerComposeUrl := fmt.Sprintf("%s%s", strings.TrimSuffix(detail.DownloadUrl, filename), "docker-compose.yml")
+				if app.Resource == constant.AppResourceRemote {
+					dockerComposeUrl, err = currentAppDownloadURL(dockerComposeUrl)
+					if err != nil {
+						return versions, err
+					}
+				}
 				statusCode, composeRes, err := req_helper.HandleRequest(dockerComposeUrl, http.MethodGet, constant.TimeOut20s)
 				if statusCode == http.StatusNotFound {
 					return versions, buserr.New("ErrAppVersionUnavailable")
@@ -624,14 +788,16 @@ func (a *AppInstallService) GetUpdateVersions(req request.AppUpdateVersion) ([]d
 				}
 			}
 			versions = append(versions, dto.AppVersion{
-				Version:       detail.Version,
-				DetailId:      detail.ID,
-				DockerCompose: newCompose,
+				FeishuLegacy:     feishuTarget && feishuLegacy,
+				FeishuConfigured: feishuTarget && feishuConfigured,
+				Version:          detail.Version,
+				DetailId:         detail.ID,
+				DockerCompose:    newCompose,
 			})
 		}
 	}
 	sort.Slice(versions, func(i, j int) bool {
-		return common.CompareVersion(versions[i].Version, versions[j].Version)
+		return appVersionSortBefore(app.Key, versions[i].Version, versions[j].Version)
 	})
 	return versions, nil
 }
@@ -821,6 +987,18 @@ func (a *AppInstallService) GetParams(id uint) (*response.AppConfig, error) {
 	config := getAppCommonConfig(envs)
 	config.DockerCompose = install.DockerCompose
 	res.Params = params
+	res.AppKey = install.App.Key
+	res.Name = install.Name
+	res.HttpPort = install.HttpPort
+	res.SyncModelAccount = install.SyncModelAccount
+	res.ModelAccountBaseURLType = install.ModelAccountBaseURLType
+	res.ModelAccountBaseURL = install.ModelAccountBaseURL
+	if install.App.Key == "ollama" {
+		res.ModelAccountBaseURLType, res.ModelAccountBaseURL, err = loadOllamaModelAccountAddress(install)
+		if err != nil {
+			return nil, err
+		}
+	}
 	if config.ContainerName == "" {
 		config.ContainerName = install.ContainerName
 	}
@@ -836,8 +1014,34 @@ func (a *AppInstallService) GetParams(id uint) (*response.AppConfig, error) {
 }
 
 func syncAppInstallStatus(appInstall *model.AppInstall, force bool) error {
-	if appInstall.Status == constant.StatusInstalling || appInstall.Status == constant.StatusRebuilding || appInstall.Status == constant.StatusUpgrading || appInstall.Status == constant.StatusUninstalling {
+	operation := ""
+	switch appInstall.Status {
+	case constant.StatusInstalling:
+		operation = task.TaskInstall
+	case constant.StatusUpgrading:
+		operation = task.TaskUpgrade
+	case constant.StatusRebuilding:
+		operation = task.TaskBuild
+	case constant.StatusUninstalling:
+		operation = task.TaskUninstall
+	case constant.StatusStarting, constant.StatusWaiting:
+		operation = task.TaskUpdate
+	case constant.StatusRestarting:
+		operation = task.TaskRestart
+	}
+	if operation != "" {
+		if err := reconcileAppInstallTaskFailure(appInstall, operation, global.DB, global.TaskDB); err != nil {
+			return err
+		}
+	}
+	switch appInstall.Status {
+	case constant.StatusInstalling, constant.StatusRebuilding, constant.StatusUpgrading, constant.StatusUninstalling,
+		constant.StatusStarting, constant.StatusRestarting, constant.StatusWaiting:
 		return nil
+	case constant.StatusInstallErr, constant.StatusUpgradeErr, constant.StatusUpErr:
+		if !force {
+			return nil
+		}
 	}
 	cli, err := docker.NewClient()
 	if err != nil {

agent/app/service/app_mcp.go

@@ -0,0 +1,53 @@
+package service
+
+import (
+	"errors"
+	"os"
+	"path"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"gorm.io/gorm"
+)
+
+func prepareMCPWebsiteDirectory(req request.AppInstallCreate) error {
+	changed := errors.New("MCP website directory changed; inspect the installation before retrying")
+	directory, ok := req.Params["WEBSITE_DIR"].(string)
+	if !ok || directory == "" || global.DB == nil {
+		return changed
+	}
+	return global.DB.Transaction(func(tx *gorm.DB) error {
+		var setting model.Setting
+		err := tx.Where("key = ?", "WEBSITE_DIR").First(&setting).Error
+		missing := errors.Is(err, gorm.ErrRecordNotFound)
+		if err != nil && !missing {
+			return err
+		}
+		current := setting.Value
+		if current == "" {
+			current = path.Join(global.Dir.BaseDir, "1panel", "www")
+		}
+		if directory != current {
+			return changed
+		}
+		if missing {
+			if err := tx.Create(&model.Setting{Key: "WEBSITE_DIR", Value: directory}).Error; err != nil {
+				return err
+			}
+		} else if setting.Value == "" {
+			result := tx.Model(&model.Setting{}).Where("id = ? AND value = ?", setting.ID, "").Update("value", directory)
+			if result.Error != nil {
+				return result.Error
+			}
+			if result.RowsAffected != 1 {
+				return changed
+			}
+		}
+		if err := os.MkdirAll(path.Join(directory, "conf.d"), constant.DirPerm); err != nil {
+			return err
+		}
+		return nil
+	})
+}

agent/app/service/app_operation_status.go

@@ -0,0 +1,76 @@
+package service
+
+import (
+	"errors"
+
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"gorm.io/gorm"
+)
+
+func appInstallOperationFailureStatus(status string) string {
+	switch status {
+	case constant.StatusInstalling:
+		return constant.StatusInstallErr
+	case constant.StatusUpgrading:
+		return constant.StatusUpgradeErr
+	case constant.StatusUninstalling:
+		return constant.StatusError
+	default:
+		return constant.StatusUpErr
+	}
+}
+
+func appInstallOperationPending(status string) bool {
+	switch status {
+	case constant.StatusInstalling, constant.StatusRebuilding, constant.StatusUpgrading, constant.StatusUninstalling,
+		constant.StatusStarting, constant.StatusRestarting, constant.StatusWaiting:
+		return true
+	default:
+		return false
+	}
+}
+
+func appInstallOperationInterruptedOnRestart(status string) bool {
+	// ReStarting can also describe a container's Docker restart policy.
+	return appInstallOperationPending(status) && status != constant.StatusRestarting
+}
+
+func reconcileAppInstallTaskFailure(install *model.AppInstall, operation string, appDB, taskDB *gorm.DB) error {
+	if !appInstallOperationPending(install.Status) {
+		return nil
+	}
+	var operationTask model.Task
+	err := taskDB.Where("type = ? AND resource_id = ? AND operate = ?", "App", install.ID, operation).
+		Order("created_at DESC").First(&operationTask).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	if operationTask.Status != constant.StatusFailed && operationTask.Status != constant.StatusCanceled {
+		return nil
+	}
+	// A previous operation must not turn a newly queued retry into a failure.
+	if operationTask.CreatedAt.Before(install.UpdatedAt) &&
+		(operationTask.EndAt.IsZero() || operationTask.EndAt.Before(install.UpdatedAt)) {
+		return nil
+	}
+	message := operationTask.ErrorMsg
+	if message == "" {
+		message = "the application operation task failed"
+	}
+	status := appInstallOperationFailureStatus(install.Status)
+	result := appDB.Model(&model.AppInstall{}).
+		Where("id = ? AND status = ? AND updated_at = ?", install.ID, install.Status, install.UpdatedAt).
+		Updates(map[string]interface{}{"status": status, "message": message})
+	if result.Error != nil {
+		return result.Error
+	}
+	if result.RowsAffected > 0 {
+		install.Status = status
+		install.Message = message
+	}
+	return nil
+}

agent/app/service/app_operation_status_test.go

@@ -0,0 +1,147 @@
+package service
+
+import (
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/glebarez/sqlite"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+	"gorm.io/gorm/logger"
+)
+
+func operationStatusTestDB(t *testing.T) (*gorm.DB, *gorm.DB, model.AppInstall) {
+	t.Helper()
+	open := func(name string, schema interface{}) *gorm.DB {
+		db, err := gorm.Open(sqlite.Open(filepath.Join(t.TempDir(), name)), &gorm.Config{
+			Logger: logger.Default.LogMode(logger.Silent),
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err := db.AutoMigrate(schema); err != nil {
+			t.Fatal(err)
+		}
+		t.Cleanup(func() {
+			sqlDB, _ := db.DB()
+			if sqlDB != nil {
+				_ = sqlDB.Close()
+			}
+		})
+		return db
+	}
+	appDB := open("apps.db", &model.AppInstall{})
+	taskDB := open("tasks.db", &model.Task{})
+	install := model.AppInstall{
+		Name: "gb10-ds-vision", AppId: 1, AppDetailId: 1,
+		Version: "nvidia-gb10-dspark-0.1.1", ContainerName: "vllm-dspark-1", ServiceName: "vllm-dspark",
+		Status: constant.StatusStarting, Env: `{"MODEL_DIR":"/models/vision"}`,
+	}
+	if err := appDB.Omit(clause.Associations).Create(&install).Error; err != nil {
+		t.Fatal(err)
+	}
+	return appDB, taskDB, install
+}
+
+func TestAppInstallFailedTaskRecoversPendingState(t *testing.T) {
+	for _, state := range []string{constant.StatusStarting, constant.StatusWaiting, constant.StatusRestarting, constant.StatusInstalling} {
+		t.Run(state, func(t *testing.T) {
+			appDB, taskDB, install := operationStatusTestDB(t)
+			install.Status = state
+			if err := appDB.Omit(clause.Associations).Save(&install).Error; err != nil {
+				t.Fatal(err)
+			}
+			task := model.Task{ID: "failed", Type: "App", Operate: "TaskUpdate", ResourceID: install.ID,
+				Status: constant.StatusFailed, ErrorMsg: "model startup script failed", CreatedAt: install.UpdatedAt.Add(time.Second), EndAt: install.UpdatedAt.Add(2 * time.Second)}
+			if err := taskDB.Create(&task).Error; err != nil {
+				t.Fatal(err)
+			}
+			if err := reconcileAppInstallTaskFailure(&install, task.Operate, appDB, taskDB); err != nil {
+				t.Fatal(err)
+			}
+			want := constant.StatusUpErr
+			if state == constant.StatusInstalling {
+				want = constant.StatusInstallErr
+			}
+			var stored model.AppInstall
+			if err := appDB.First(&stored, install.ID).Error; err != nil {
+				t.Fatal(err)
+			}
+			if install.Status != want || stored.Status != want || stored.Message != task.ErrorMsg || stored.Env != install.Env {
+				t.Fatalf("recovered state = %s/%s, message %q, env %q", install.Status, stored.Status, stored.Message, stored.Env)
+			}
+		})
+	}
+}
+
+func TestAppInstallPendingStateKeepsActiveAndUnrelatedTasks(t *testing.T) {
+	for _, taskStatus := range []string{constant.StatusExecuting, constant.StatusSuccess, "missing", "previous-failure", "other-resource"} {
+		t.Run(taskStatus, func(t *testing.T) {
+			appDB, taskDB, install := operationStatusTestDB(t)
+			task := model.Task{ID: "task", Type: "App", Operate: "TaskUpdate", ResourceID: install.ID,
+				Status: taskStatus, CreatedAt: install.UpdatedAt.Add(time.Second), EndAt: install.UpdatedAt.Add(2 * time.Second)}
+			if taskStatus == "previous-failure" {
+				task.Status = constant.StatusFailed
+				task.CreatedAt = install.UpdatedAt.Add(-2 * time.Hour)
+				task.EndAt = install.UpdatedAt.Add(-time.Hour)
+			}
+			if taskStatus == "other-resource" {
+				task.Status = constant.StatusFailed
+				task.ResourceID++
+			}
+			if taskStatus != "missing" {
+				if err := taskDB.Create(&task).Error; err != nil {
+					t.Fatal(err)
+				}
+			}
+			if err := reconcileAppInstallTaskFailure(&install, task.Operate, appDB, taskDB); err != nil {
+				t.Fatal(err)
+			}
+			if install.Status != constant.StatusStarting {
+				t.Fatalf("unrelated or active task changed pending state to %s", install.Status)
+			}
+		})
+	}
+}
+
+func TestAppInstallRecoveryDoesNotOverwriteConcurrentRetry(t *testing.T) {
+	appDB, taskDB, install := operationStatusTestDB(t)
+	task := model.Task{ID: "failed", Type: "App", Operate: "TaskUpdate", ResourceID: install.ID,
+		Status: constant.StatusCanceled, ErrorMsg: "interrupted", CreatedAt: install.UpdatedAt.Add(time.Second), EndAt: install.UpdatedAt.Add(2 * time.Second)}
+	if err := taskDB.Create(&task).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := appDB.Callback().Update().Before("gorm:update").Register("new-operation", func(db *gorm.DB) {
+		if err := db.Exec("UPDATE app_installs SET updated_at = ?, message = ? WHERE id = ?", install.UpdatedAt.Add(time.Hour), "new attempt", install.ID).Error; err != nil {
+			t.Error(err)
+		}
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if err := reconcileAppInstallTaskFailure(&install, task.Operate, appDB, taskDB); err != nil {
+		t.Fatal(err)
+	}
+	var stored model.AppInstall
+	if err := appDB.First(&stored, install.ID).Error; err != nil {
+		t.Fatal(err)
+	}
+	if stored.Status != constant.StatusStarting || stored.Message != "new attempt" {
+		t.Fatalf("recovery overwrote a newer operation: %s, %s", stored.Status, stored.Message)
+	}
+}
+
+func TestAppInstallRestartRecoveryCoversLifecycleStates(t *testing.T) {
+	for _, state := range []string{constant.StatusStarting, constant.StatusWaiting, constant.StatusInstalling} {
+		if !appInstallOperationInterruptedOnRestart(state) {
+			t.Errorf("restart recovery omitted %s", state)
+		}
+	}
+	for _, state := range []string{constant.StatusRunning, constant.StatusStopped, constant.StatusRestarting} {
+		if appInstallOperationInterruptedOnRestart(state) {
+			t.Errorf("restart recovery changes a Docker runtime state: %s", state)
+		}
+	}
+}

agent/app/service/app_sync_task.go

@@ -191,7 +191,11 @@ func (c *appSyncContext) processOneApp(item appWorkItem) appWorkResult {
 
 		if _, ok := InitTypes[app.Type]; ok {
 			dockerComposeUrl := fmt.Sprintf("%s/%s", versionUrl, "docker-compose.yml")
-			_, composeRes, err := req_helper.HandleRequestWithClient(&c.httpClient, dockerComposeUrl, http.MethodGet, constant.TimeOut20s)
+			dockerComposeUrl, err := appDownloadURL(dockerComposeUrl, strconv.Itoa(c.list.LastModified))
+			var composeRes []byte
+			if err == nil {
+				_, composeRes, err = req_helper.HandleRequestWithClient(&c.httpClient, dockerComposeUrl, http.MethodGet, constant.TimeOut20s)
+			}
 			if err == nil {
 				detail.DockerCompose = string(composeRes)
 			} else {

agent/app/service/app_upgrade.go

@@ -40,14 +40,13 @@ const (
 	appUpgradeDown
 	appUpgradeMutated
 	appUpgradeStarted
-	appUpgradeReady
 	appUpgradeCommitted
 )
 
-const composeServiceLabel = "com.docker.compose.service"
-
 var appUpgradeLocks sync.Map
 
+const composeServiceLabel = "com.docker.compose.service"
+
 type appUpgradeSnapshot interface {
 	Restore() error
 	Cleanup()
@@ -61,10 +60,16 @@ type upgradeFileSnapshot struct {
 }
 
 type appUpgradeContext struct {
-	req       request.AppInstallUpgrade
-	original  model.AppInstall
-	candidate model.AppInstall
-	detail    model.AppDetail
+	openclawOriginal []byte
+	feishuOriginal   []byte
+	feishuImage      string
+	feishuOldImage   string
+	feishuEnabled    bool
+	feishuLockPath   string
+	req              request.AppInstallUpgrade
+	original         model.AppInstall
+	candidate        model.AppInstall
+	detail           model.AppDetail
 
 	phase         appUpgradePhase
 	stopAttempted bool
@@ -103,10 +108,34 @@ func upgradeInstall(req request.AppInstallUpgrade) error {
 		}
 	}()
 
+	feishuLockPath := ""
+	if install.App.Key == constant.AppOpenclaw {
+		feishuLockPath = path.Join(install.GetPath(), "data/conf/openclaw.json")
+		if _, busy := feishuSwitches.LoadOrStore(feishuLockPath, true); busy {
+			return buserr.New("TaskIsExecuting")
+		}
+		defer func() {
+			if releaseLock {
+				feishuSwitches.Delete(feishuLockPath)
+			}
+		}()
+	}
+
 	detail, err := appDetailRepo.GetFirst(repo.WithByID(req.DetailID))
 	if err != nil {
 		return err
 	}
+	if !isAIGatewayUpgradeVersionAllowed(install.App.Key, install.Version, detail.Version) {
+		return buserr.New("ErrAIGatewayDatabaseTypeMismatch")
+	}
+	if isHermesApp(install.App.Key) &&
+		(!isNewerAppVersion(install.App.Key, detail.Version, install.Version) ||
+			(isCrossAppVersion(install.App.Key, install.Version, detail.Version) && !install.App.CrossVersionUpdate)) {
+		return buserr.New("ErrHermesUpgradeVersion")
+	}
+	if err = checkVllmVersionAccess(install.App.Key, detail.Version); err != nil {
+		return err
+	}
 	if install.App.Key == vllmAppKeyForUpgrade && !isVllmUpgradeVersionAllowed(install.Version, detail.Version, loadVllmImageFromEnv(install.Env)) {
 		return errors.New("vLLM can only upgrade within the same image type")
 	}
@@ -119,6 +148,7 @@ func upgradeInstall(req request.AppInstallUpgrade) error {
 		return err
 	}
 	ctx := &appUpgradeContext{
+		feishuLockPath:   feishuLockPath,
 		req:              req,
 		original:         install,
 		candidate:        install,
@@ -212,6 +242,10 @@ func (u *appUpgradeContext) prepare(t *task.Task) error {
 		if err = copyUpgradeStageFile(u.original.GetPath(), u.stageDir, path.Join("data", "conf", "openclaw.json")); err != nil {
 			return err
 		}
+		u.openclawOriginal, err = os.ReadFile(path.Join(u.stageDir, "data/conf/openclaw.json"))
+		if err != nil {
+			return err
+		}
 	}
 	if u.original.App.Key == constant.AppOpenresty {
 		for _, relativePath := range []string{
@@ -320,6 +354,9 @@ func (u *appUpgradeContext) prepare(t *task.Task) error {
 	if u.original.App.Resource == constant.AppResourceRemote {
 		go RequestDownloadCallBack(u.detail.DownloadCallBackUrl)
 	}
+	if err = u.prepareFeishuUpgrade(); err != nil {
+		return err
+	}
 	u.phase = appUpgradePrepared
 	return nil
 }
@@ -377,6 +414,9 @@ func (u *appUpgradeContext) cutover(t *task.Task) error {
 	}
 	t.LogSuccess(i18n.GetMsgByKey("UpgradeStop"))
 	u.phase = appUpgradeStopped
+	if err := u.checkFeishuUpgradeSource(); err != nil {
+		return err
+	}
 
 	var err error
 	if u.original.App.Key == constant.AppOpenresty {
@@ -426,7 +466,7 @@ func (u *appUpgradeContext) cutover(t *task.Task) error {
 
 	logStr := fmt.Sprintf("%s %s", i18n.GetMsgByKey("Run"), i18n.GetMsgByKey("App"))
 	t.LogStart(logStr)
-	if out, upErr := compose.UpWithoutPull(u.original.GetComposePath()); upErr != nil {
+	if out, upErr := compose.UpWithoutBuild(u.original.GetComposePath()); upErr != nil {
 		if out != "" {
 			upErr = fmt.Errorf("%s: %w", out, upErr)
 		}
@@ -436,15 +476,17 @@ func (u *appUpgradeContext) cutover(t *task.Task) error {
 	t.LogSuccess(logStr)
 	u.phase = appUpgradeStarted
 
-	t.LogStart(i18n.GetMsgByKey("UpgradeWaitReady"))
-	containerNames, err := waitAppContainersReady(context.Background(), u.candidate)
-	if err != nil {
-		t.LogFailedWithErr(i18n.GetMsgByKey("UpgradeWaitReady"), err)
+	containerNames, discoverErr := discoverUpgradeContainerNames(u.candidate, u.envContent)
+	if discoverErr != nil {
+		t.Logf("WARNING: discover upgraded application containers failed: %v", discoverErr)
+	} else if len(containerNames) > 0 {
+		u.candidate.ContainerName = strings.Join(containerNames, ",")
+	} else {
+		t.Log("WARNING: no containers found for the upgraded application")
+	}
+	if err = u.verifyFeishuUpgrade(t); err != nil {
 		return err
 	}
-	t.LogSuccess(i18n.GetMsgByKey("UpgradeWaitReady"))
-	u.phase = appUpgradeReady
-	u.candidate.ContainerName = strings.Join(containerNames, ",")
 	u.candidate.Status = constant.StatusRunning
 	u.candidate.Message = ""
 
@@ -459,9 +501,21 @@ func (u *appUpgradeContext) cutover(t *task.Task) error {
 		}); err != nil {
 			return err
 		}
+		// Upgrades deliberately keep the user's nginx.conf, so corrected gzip
+		// defaults shipped with a new version would never reach existing
+		// installations. Rewrite only an untouched factory configuration, and
+		// never fail the upgrade over it.
+		if gzipErr := upgradeStockNginxGzipConfig(u.candidate); gzipErr != nil {
+			t.Logf("WARNING: update stock gzip configuration failed, keeping the current one: %v", gzipErr)
+		}
 	} else if err = appInstallRepo.Save(context.Background(), &u.candidate); err != nil {
 		return err
 	}
+	if discoverErr == nil && len(containerNames) > 0 {
+		if syncErr := syncAppInstallStatus(&u.candidate, true); syncErr != nil {
+			t.Logf("WARNING: sync upgraded application status failed: %v", syncErr)
+		}
+	}
 	u.phase = appUpgradeCommitted
 	u.deleteOldImages(t)
 	return nil
@@ -513,7 +567,6 @@ func (u *appUpgradeContext) applyStagedFiles() error {
 			nginxModuleBuildDir,
 			nginxModuleModulesDir,
 			path.Join(nginxModuleConfDir, nginxModuleEnabledConfDir),
-			path.Join(nginxModuleConfDir, "nginx.conf"),
 		} {
 			if err := replaceUpgradePath(u.stageDir, u.original.GetPath(), relativePath); err != nil {
 				return err
@@ -546,7 +599,7 @@ func (u *appUpgradeContext) rollback(t *task.Task) (rollbackErr error) {
 		return u.finishRollback()
 	}
 	if u.phase < appUpgradeMutated {
-		if out, err := compose.UpWithoutPull(u.original.GetComposePath()); err != nil {
+		if out, err := compose.UpWithoutBuild(u.original.GetComposePath()); err != nil {
 			if out != "" {
 				err = fmt.Errorf("%s: %w", out, err)
 			}
@@ -559,19 +612,45 @@ func (u *appUpgradeContext) rollback(t *task.Task) (rollbackErr error) {
 		if out != "" {
 			err = fmt.Errorf("%s: %w", out, err)
 		}
+		if u.feishuOriginal != nil {
+			return err
+		}
 		rollbackErr = err
 	}
+	if u.feishuOriginal != nil {
+		if u.backupFile == "" {
+			return buserr.New("ErrFeishuUpgradeBackup")
+		}
+		if err := u.restoreManagedFiles(); err != nil {
+			return err
+		}
+		if err := handleAppRecover(&u.original, t, u.backupFile, true, "", "", false); err != nil {
+			return err
+		}
+		if err := pinFeishuRollbackImage(u.original.GetComposePath(), u.feishuOldImage); err != nil {
+			return err
+		}
+		restoredCompose, err := os.ReadFile(u.original.GetComposePath())
+		if err != nil {
+			return err
+		}
+		u.original.DockerCompose = string(restoredCompose)
+		if _, err := compose.UpWithoutBuild(u.original.GetComposePath()); err != nil {
+			return err
+		}
+		return u.finishRollback()
+	}
 	if u.backupFile != "" {
 		_ = u.restoreManagedFiles()
 		if err := handleAppRecover(&u.original, t, u.backupFile, true, "", ""); err != nil {
-			_, _ = compose.UpWithoutPull(u.original.GetComposePath())
+			_, _ = compose.UpWithoutBuild(u.original.GetComposePath())
 			return errors.Join(rollbackErr, err)
 		}
 	} else {
 		if err := u.restoreManagedFiles(); err != nil {
 			return errors.Join(rollbackErr, err)
 		}
-		if out, err := compose.UpWithoutPull(u.original.GetComposePath()); err != nil {
+		if out, err := compose.UpWithoutBuild(u.original.GetComposePath()); err != nil {
 			if out != "" {
 				err = fmt.Errorf("%s: %w", out, err)
 			}
@@ -582,8 +661,10 @@ func (u *appUpgradeContext) rollback(t *task.Task) (rollbackErr error) {
 }
 
 func (u *appUpgradeContext) finishRollback() error {
-	if _, err := waitAppContainersReady(context.Background(), u.original); err != nil {
-		return err
+	if u.feishuOriginal != nil {
+		if err := waitOpenclawReady(u.original.ContainerName); err != nil {
+			return err
+		}
 	}
 	restored := u.original
 	if err := appInstallRepo.Save(context.Background(), &restored); err != nil {
@@ -626,6 +707,12 @@ func (u *appUpgradeContext) deleteOldImages(t *task.Task) {
 }
 
 func (u *appUpgradeContext) cleanup() {
+	if u.feishuLockPath != "" {
+		feishuSwitches.Delete(u.feishuLockPath)
+	}
+	if u.feishuOriginal != nil && u.rollbackErr != nil {
+		return
+	}
 	if u.snapshot != nil {
 		u.snapshot.Cleanup()
 	}
@@ -716,6 +803,20 @@ func renderUpgradeEnv(install *model.AppInstall, original []byte) ([]byte, error
 		return nil, err
 	}
 	handleMap(envs, params)
+	if install.App.Key == "openlist" {
+		// The upgrade script updates this too late for the pre-pull phase.
+		image := "openlistteam/openlist:v" + strings.TrimPrefix(install.Version, "v")
+		if preInstalled := params["PRE_INSTALLED"]; preInstalled != "" {
+			image += "-" + preInstalled
+		}
+		params["OPENLIST_IMAGE"] = image
+		envs["OPENLIST_IMAGE"] = image
+		content, err := json.Marshal(envs)
+		if err != nil {
+			return nil, err
+		}
+		install.Env = string(content)
+	}
 	if install.App.Key == constant.AppOpenresty {
 		for _, key := range []string{"CONTAINER_PACKAGE_URL", "RESTY_ADD_PACKAGE_BUILDDEPS", "RESTY_CONFIG_OPTIONS_MORE"} {
 			if value, ok := originalEnv[key]; ok {
@@ -858,28 +959,7 @@ func (s *upgradeFileSnapshot) Cleanup() {
 	}
 }
 
-type appContainerReadinessClient interface {
-	ContainerList(context.Context, container.ListOptions) ([]container.Summary, error)
-	ContainerInspect(context.Context, string) (container.InspectResponse, error)
-}
-
-func waitAppContainersReady(ctx context.Context, install model.AppInstall) ([]string, error) {
-	client, err := docker.NewDockerClient()
-	if err != nil {
-		return nil, err
-	}
-	defer client.Close()
-	return waitAppContainersReadyWithClient(ctx, client, install)
-}
-
-func waitAppContainersReadyWithClient(ctx context.Context, client appContainerReadinessClient, install model.AppInstall) ([]string, error) {
-	envContent, err := os.ReadFile(install.GetEnvPath())
-	if err != nil {
-		envContent, err = renderUpgradeEnv(&install, nil)
-		if err != nil {
-			return nil, err
-		}
-	}
+func discoverUpgradeContainerNames(install model.AppInstall, envContent []byte) ([]string, error) {
 	project, err := docker.GetComposeProject(install.Name, install.GetPath(), []byte(install.DockerCompose), envContent, false)
 	if err != nil {
 		return nil, err
@@ -893,36 +973,24 @@ func waitAppContainersReadyWithClient(ctx context.Context, client appContainerRe
 	if len(expectedServices) == 0 {
 		return strings.Split(install.ContainerName, ","), nil
 	}
-	options := container.ListOptions{
-		All: true,
-		Filters: filters.NewArgs(
-			filters.Arg("label", composeWorkdirLabel+"="+install.GetPath()),
-		),
+	client, err := docker.NewDockerClient()
+	if err != nil {
+		return nil, err
 	}
-	containers, err := client.ContainerList(ctx, options)
+	defer client.Close()
+	containers, err := client.ContainerList(context.Background(), container.ListOptions{
+		All:     true,
+		Filters: filters.NewArgs(filters.Arg("label", composeWorkdirLabel+"="+install.GetPath())),
+	})
 	if err != nil {
 		return nil, err
 	}
-	foundServices := make(map[string]bool, len(expectedServices))
 	containerNames := make([]string, 0, len(containers))
 	for _, item := range containers {
-		serviceName := item.Labels[composeServiceLabel]
-		if _, ok := expectedServices[serviceName]; !ok {
-			continue
-		}
-		if err = waitContainerReady(ctx, client, item.ID); err != nil {
-			return nil, fmt.Errorf("container %s is not ready: %w", serviceName, err)
-		}
-		foundServices[serviceName] = true
-		if len(item.Names) > 0 {
+		if _, ok := expectedServices[item.Labels[composeServiceLabel]]; ok && len(item.Names) > 0 {
 			containerNames = append(containerNames, strings.TrimPrefix(item.Names[0], "/"))
 		}
 	}
-	for serviceName := range expectedServices {
-		if !foundServices[serviceName] {
-			return nil, fmt.Errorf("container for service %s was not created", serviceName)
-		}
-	}
 	sort.Strings(containerNames)
 	return containerNames, nil
 }

agent/app/service/app_upgrade_feishu.go

@@ -0,0 +1,336 @@
+package service
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/task"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/i18n"
+	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
+	"github.com/1Panel-dev/1Panel/agent/utils/docker"
+	"gopkg.in/yaml.v3"
+)
+
+func classifyLegacyFeishu(conf map[string]interface{}, installPath string) (legacy, configured bool, err error) {
+	for _, field := range []string{"channels", "channels.feishu", "plugins", "plugins.entries", "plugins.entries.openclaw-lark", "plugins.entries.feishu"} {
+		parts := strings.Split(field, ".")
+		parent := conf
+		for _, part := range parts[:len(parts)-1] {
+			parent = childMap(parent, part)
+		}
+		if raw, exists := parent[parts[len(parts)-1]]; exists {
+			if _, ok := raw.(map[string]interface{}); !ok {
+				return false, false, feishuConfigError(field)
+			}
+		}
+	}
+	plugins := childMap(conf, "plugins")
+	for _, key := range []string{"allow", "deny"} {
+		if raw, exists := plugins[key]; exists {
+			if _, ok := raw.([]string); ok {
+				continue
+			}
+			ids, ok := raw.([]interface{})
+			if !ok {
+				return false, false, feishuConfigError("plugins." + key)
+			}
+			for _, id := range ids {
+				if _, ok := id.(string); !ok {
+					return false, false, feishuConfigError("plugins." + key)
+				}
+			}
+		}
+	}
+	for _, id := range []string{"openclaw-lark", "feishu"} {
+		if raw, exists := childMap(childMap(plugins, "entries"), id)["enabled"]; exists {
+			if _, ok := raw.(bool); !ok {
+				return false, false, feishuConfigError("plugins.entries." + id + ".enabled")
+			}
+		}
+	}
+	if usesBundledFeishu(conf) {
+		return false, false, nil
+	}
+	f := getChannelConfig(conf, "feishu")
+	configured = len(f) > 0
+	if raw, exists := conf["bindings"]; exists {
+		bindings, ok := raw.([]interface{})
+		if !ok {
+			return false, false, feishuConfigError("bindings")
+		}
+		for _, raw := range bindings {
+			binding, ok := raw.(map[string]interface{})
+			if !ok {
+				return false, false, feishuConfigError("bindings")
+			}
+			if match, exists := binding["match"]; exists {
+				if _, ok := match.(map[string]interface{}); !ok {
+					return false, false, feishuConfigError("bindings.match")
+				}
+			}
+			if extractStringValue(childMap(binding, "match")["channel"]) == "feishu" {
+				configured = true
+			}
+		}
+	}
+	entries := childMap(childMap(conf, "plugins"), "entries")
+	entry, selected := entries["openclaw-lark"]
+	if selected {
+		old, ok := entry.(map[string]interface{})
+		if !ok {
+			return false, configured, feishuConfigError("plugins.entries.openclaw-lark")
+		}
+		// A completed disable-only repair must not repeat on every upgrade.
+		if enabled, ok := old["enabled"].(bool); ok && !enabled && !configured {
+			return false, false, nil
+		}
+	}
+	installed, err := checkPluginInstalled(installPath, "feishu")
+	if err != nil {
+		return false, configured, err
+	}
+	_, oldThread := f["threadSession"]
+	_, oldReply := f["replyMode"]
+	_, oldStreaming := f["streaming"].(bool)
+	return selected || installed || oldThread || oldReply || oldStreaming, configured, nil
+}
+
+func prepareLegacyFeishu(conf map[string]interface{}, configured bool, transition *dto.AgentFeishuTransition) error {
+	if !configured {
+		ensureChildMap(ensureChildMap(ensureChildMap(conf, "plugins"), "entries"), "openclaw-lark")["enabled"] = false
+		return nil
+	}
+	if transition == nil || !transition.Confirmed {
+		return buserr.New("ErrFeishuUpgradeConfirm")
+	}
+	if !validFeishuTransition(transition.GroupSessionScope, transition.RequireMention) {
+		return feishuConfigError("feishuTransition")
+	}
+	return convertLegacyFeishu(conf, dto.AgentFeishuSwitchReq{Streaming: transition.Streaming, GroupSessionScope: transition.GroupSessionScope, RequireMention: transition.RequireMention})
+}
+
+func validFeishuTransition(scope, mention string) bool {
+	return (scope == "group" || scope == "group_sender" || scope == "group_topic" || scope == "group_topic_sender") && (mention == "true" || mention == "false")
+}
+
+func feishuRecoveryPayload(candidate []byte, configured bool) ([]byte, error) {
+	var conf map[string]interface{}
+	if err := json.Unmarshal(candidate, &conf); err != nil {
+		return nil, err
+	}
+	if configured {
+		ensureChildMap(ensureChildMap(conf, "channels"), "feishu")["enabled"] = false
+		selectBundledFeishu(conf, false)
+	}
+	ensureChildMap(ensureChildMap(ensureChildMap(conf, "plugins"), "entries"), "openclaw-lark")["enabled"] = false
+	return json.MarshalIndent(conf, "", "  ")
+}
+
+func (u *appUpgradeContext) prepareFeishuUpgrade() error {
+	if u.original.App.Key != constant.AppOpenclaw || !isOpenclawBundledFeishuVersion(u.candidate.Version) {
+		return nil
+	}
+	source := filepath.Join(u.original.GetPath(), "data/conf/openclaw.json")
+	staged := filepath.Join(u.stageDir, "data/conf/openclaw.json")
+	// The staged copy predates protocol migration and is the exact cutover comparison source.
+	original := u.openclawOriginal
+	current, err := os.ReadFile(source)
+	if err != nil {
+		return err
+	}
+	if !bytes.Equal(original, current) {
+		return buserr.New("ErrFeishuConfigChanged")
+	}
+	_, conf, err := readFeishuConfigBytes(staged)
+	if err != nil {
+		return err
+	}
+	legacy, configured, err := classifyLegacyFeishu(conf, u.original.GetPath())
+	if err != nil || !legacy {
+		return err
+	}
+	if !u.req.Backup {
+		return buserr.New("ErrFeishuUpgradeBackup")
+	}
+	if err = prepareLegacyFeishu(conf, configured, u.req.FeishuTransition); err != nil {
+		return err
+	}
+	project, err := docker.GetComposeProject(u.original.Name, u.original.GetPath(), []byte(u.candidate.DockerCompose), u.envContent, false)
+	if err != nil {
+		return err
+	}
+	if len(project.Services) != 1 {
+		return buserr.New("ErrFeishuUpgradeMounts")
+	}
+	for _, service := range project.Services {
+		if service.Build != nil {
+			return buserr.New("ErrFeishuImageRequired")
+		}
+		u.feishuImage, err = bundledFeishuImage(service.Image)
+		if err != nil {
+			return err
+		}
+		configMounted := false
+		for _, v := range service.Volumes {
+			if v.Target == "/etc/localtime" {
+				continue
+			}
+			if v.Type != "bind" {
+				return buserr.New("ErrFeishuUpgradeMounts")
+			}
+			if err = feishuBackupPath(u.original.GetPath(), v.Source); err != nil {
+				return err
+			}
+			if v.Target == "/home/node/.openclaw" {
+				configMounted = filepath.Clean(v.Source) == filepath.Dir(source)
+			}
+		}
+		if !configMounted {
+			return buserr.New("ErrFeishuUpgradeMounts")
+		}
+	}
+	cli, err := docker.NewDockerClient()
+	if err != nil {
+		return err
+	}
+	defer cli.Close()
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+	info, err := cli.ContainerInspect(ctx, u.original.ContainerName)
+	if err != nil {
+		return err
+	}
+	u.feishuOldImage = info.Image
+	for _, m := range info.Mounts {
+		if m.Destination == "/etc/localtime" {
+			continue
+		}
+		if string(m.Type) != "bind" {
+			return buserr.New("ErrFeishuUpgradeMounts")
+		}
+		if err = feishuBackupPath(u.original.GetPath(), m.Source); err != nil {
+			return err
+		}
+	}
+	// Tar preserves symlinks: an external target would not be in the application backup.
+	if err = filepath.WalkDir(filepath.Join(u.original.GetPath(), "data"), func(file string, d os.DirEntry, walkErr error) error {
+		if walkErr != nil {
+			return walkErr
+		}
+		if d.Type()&os.ModeSymlink != 0 {
+			return feishuBackupPath(u.original.GetPath(), file)
+		}
+		return nil
+	}); err != nil {
+		return err
+	}
+	u.feishuOriginal = original
+	u.feishuEnabled = configured && extractBoolValue(getChannelConfig(conf, "feishu")["enabled"], true)
+	payload, err := json.MarshalIndent(conf, "", "  ")
+	if err != nil {
+		return err
+	}
+	before, err := os.ReadFile(staged)
+	if err != nil {
+		return err
+	}
+	if err = replaceFeishuConfig(staged, before, payload); err != nil {
+		return err
+	}
+	targetCompose := filepath.Join(u.stageDir, "docker-compose.yml")
+	if err = pinFeishuRollbackImage(targetCompose, u.feishuImage); err != nil {
+		return err
+	}
+	pinned, err := os.ReadFile(targetCompose)
+	if err != nil {
+		return err
+	}
+	u.candidate.DockerCompose = string(pinned)
+	return nil
+}
+
+func feishuBackupPath(root, source string) error {
+	root, err := filepath.EvalSymlinks(root)
+	if err != nil {
+		return err
+	}
+	resolved, err := filepath.EvalSymlinks(source)
+	if err != nil {
+		return buserr.New("ErrFeishuUpgradeMounts")
+	}
+	rel, err := filepath.Rel(root, resolved)
+	if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
+		return buserr.New("ErrFeishuUpgradeMounts")
+	}
+	return nil
+}
+
+func (u *appUpgradeContext) checkFeishuUpgradeSource() error {
+	if u.feishuOriginal == nil {
+		return nil
+	}
+	current, err := os.ReadFile(filepath.Join(u.original.GetPath(), "data/conf/openclaw.json"))
+	if err != nil {
+		return err
+	}
+	if !bytes.Equal(current, u.feishuOriginal) {
+		return buserr.New("ErrFeishuConfigChanged")
+	}
+	return nil
+}
+
+func (u *appUpgradeContext) verifyFeishuUpgrade(t *task.Task) error {
+	if u.feishuOriginal == nil {
+		return nil
+	}
+	if err := verifyFeishuActivation(u.candidate.ContainerName, u.feishuEnabled); err != nil {
+		return err
+	}
+	if u.feishuEnabled {
+		probeFeishuConnection(u.candidate.ContainerName, t)
+	}
+	return nil
+}
+
+func probeFeishuConnection(name string, t *task.Task) {
+	output, err := cmd.RunDockerExecWithStdout(30*time.Second, name, "openclaw", "channels", "status", "--channel", "feishu", "--probe", "--json")
+	if err != nil || !feishuProbeOK(output) {
+		t.Log(i18n.GetMsgByKey("AgentFeishuProbeWarning"))
+	}
+}
+
+// Pin the restored service to the actual old image, even if its registry tag moved.
+func pinFeishuRollbackImage(composeFile string, image string) error {
+	raw, err := os.ReadFile(composeFile)
+	if err != nil {
+		return err
+	}
+	var conf map[string]interface{}
+	if err = yaml.Unmarshal(raw, &conf); err != nil {
+		return err
+	}
+	services := childMap(conf, "services")
+	if len(services) != 1 {
+		return buserr.New("ErrFeishuUpgradeMounts")
+	}
+	for _, raw := range services {
+		service, ok := raw.(map[string]interface{})
+		if !ok {
+			return buserr.New("ErrFeishuUpgradeMounts")
+		}
+		service["image"] = image
+	}
+	payload, err := yaml.Marshal(conf)
+	if err != nil {
+		return err
+	}
+	return writeUpgradeFile(composeFile, payload, constant.FilePerm)
+}

agent/app/service/app_utils.go

@@ -8,6 +8,7 @@ import (
 	"maps"
 	"math"
 	"net/http"
+	"net/url"
 	"os"
 	"path"
 	"path/filepath"
@@ -352,15 +353,33 @@ func deleteAppInstall(deleteReq request.AppInstallDelete) error {
 		if dir != nil {
 			logStr := i18n.GetMsgByKey("Stop") + i18n.GetMsgByKey("App")
 			t.Log(logStr)
+			cleanupFailed := false
 
-			out, err := compose.Down(install.GetComposePath())
-			if err != nil && !deleteReq.ForceDelete {
-				return handleErr(install, err, out)
+			if deleteReq.UseLifecycleScripts {
+				if scriptErr := runScript(t, &install, "uninstall"); scriptErr != nil {
+					cleanupFailed = true
+					if !deleteReq.ForceDelete {
+						return scriptErr
+					}
+				}
+			} else {
+				out, downErr := compose.Down(install.GetComposePath())
+				if downErr != nil {
+					cleanupFailed = true
+					if !deleteReq.ForceDelete {
+						return handleErr(install, downErr, out)
+					}
+				}
+				if scriptErr := runScript(t, &install, "uninstall"); scriptErr != nil {
+					cleanupFailed = true
+					if !deleteReq.ForceDelete {
+						_, _ = compose.Up(install.GetComposePath())
+						return scriptErr
+					}
+				}
 			}
-			t.LogSuccess(logStr)
-			if err = runScript(t, &install, "uninstall"); err != nil {
-				_, _ = compose.Up(install.GetComposePath())
-				return err
+			if !cleanupFailed {
+				t.LogSuccess(logStr)
 			}
 			if deleteReq.DeleteImage {
 				content, err := op.GetContent(install.GetEnvPath())
@@ -372,12 +391,27 @@ func deleteAppInstall(deleteReq request.AppInstallDelete) error {
 				}
 			}
 		}
+		if install.App.Key == "ollama" {
+			ollamaModelMu.Lock()
+			defer ollamaModelMu.Unlock()
+		}
 		tx, ctx := helper.GetTxAndContext()
 		defer tx.Rollback()
 		if err = appInstallRepo.Delete(ctx, install); err != nil {
 			return err
 		}
 		appKey := install.App.Key
+		if appKey == "ollama" {
+			remaining, listErr := appInstallRepo.ListBy(ctx, appInstallRepo.WithAppId(install.AppId))
+			if listErr != nil {
+				return listErr
+			}
+			if len(remaining) == 0 {
+				if err = aiRepo.DeleteAll(ctx); err != nil {
+					return err
+				}
+			}
+		}
 		if isAgentAppKey(appKey) {
 			_ = agentRepo.DeleteByAppInstallIDWithCtx(ctx, install.ID)
 		}
@@ -450,7 +484,12 @@ func deleteAppInstall(deleteReq request.AppInstallDelete) error {
 		if err == nil && len(entries) == 0 {
 			_ = op.DeleteDir(parentDir)
 		}
-		tx.Commit()
+		if err := tx.Commit().Error; err != nil {
+			return err
+		}
+		if install.App.Key == "ollama" || install.App.Key == "vllm" {
+			CleanupLocalModelAccount(install.ID)
+		}
 
 		existApps, _ := appInstallRepo.ListBy(context.Background(), appInstallRepo.WithAppId(install.AppId))
 		if len(existApps) == 0 {
@@ -460,8 +499,9 @@ func deleteAppInstall(deleteReq request.AppInstallDelete) error {
 	}
 	uninstallTask.AddSubTask(task.GetTaskName(install.Name, task.TaskUninstall, task.TaskScopeApp), uninstall, nil)
 	go func() {
-		if err := uninstallTask.Execute(); err != nil && !deleteReq.ForceDelete {
+		if err := uninstallTask.Execute(); err != nil {
 			install.Status = constant.StatusError
+			install.Message = err.Error()
 			_ = appInstallRepo.Save(context.Background(), &install)
 		}
 	}()
@@ -872,16 +912,52 @@ func handleMap(params map[string]interface{}, envParams map[string]string) {
 	}
 }
 
+func appDownloadURL(rawURL, version string) (string, error) {
+	parsedURL, err := url.Parse(rawURL)
+	if err != nil {
+		return "", err
+	}
+	query := parsedURL.Query()
+	query.Set("v", version)
+	parsedURL.RawQuery = query.Encode()
+	return parsedURL.String(), nil
+}
+
+func currentAppDownloadURL(rawURL string) (string, error) {
+	storeVersion, err := settingRepo.GetValueByKey("AppStoreLastModified")
+	if err != nil {
+		return "", err
+	}
+	return appDownloadURL(rawURL, storeVersion)
+}
+
 func downloadApp(app model.App, appDetail model.AppDetail, appInstall *model.AppInstall, logger *logrus.Logger) (err error) {
 	if app.IsLocalApp() || app.IsCustomApp() {
 		return nil
 	}
+	defer func() {
+		if err != nil && appInstall != nil {
+			appInstall.Status = constant.StatusDownloadErr
+			appInstall.Message = err.Error()
+		}
+	}()
 	appResourceDir := path.Join(global.Dir.AppResourceDir, app.Resource)
 	appDownloadDir := app.GetAppResourcePath()
 	appVersionDir := path.Join(appDownloadDir, appDetail.Version)
 	fileOp := files.NewFileOp()
+	storeVersion, err := settingRepo.GetValueByKey("AppStoreLastModified")
+	if err != nil {
+		return err
+	}
+	cacheVersionPath := path.Join(appVersionDir, ".1panel-appstore-version")
 	if !appDetail.Update && fileOp.Stat(appVersionDir) {
-		return
+		if cachedVersion, readErr := os.ReadFile(cacheVersionPath); readErr == nil && string(cachedVersion) == storeVersion {
+			return nil
+		}
+	}
+	downloadURL, err := appDownloadURL(appDetail.DownloadUrl, storeVersion)
+	if err != nil {
+		return err
 	}
 	if !fileOp.Stat(appDownloadDir) {
 		_ = fileOp.CreateDir(appDownloadDir, constant.DirPerm)
@@ -890,23 +966,14 @@ func downloadApp(app model.App, appDetail model.AppDetail, appInstall *model.App
 		_ = fileOp.CreateDir(appVersionDir, constant.DirPerm)
 	}
 	if logger == nil {
-		global.LOG.Infof("download app [%s] from %s", app.Name, appDetail.DownloadUrl)
+		global.LOG.Infof("download app [%s] from %s", app.Name, downloadURL)
 	} else {
-		logger.Printf("download app [%s] from %s", app.Name, appDetail.DownloadUrl)
+		logger.Printf("download app [%s] from %s", app.Name, downloadURL)
 	}
 
 	filePath := path.Join(appVersionDir, app.Key+"-"+appDetail.Version+".tar.gz")
 
-	defer func() {
-		if err != nil {
-			if appInstall != nil {
-				appInstall.Status = constant.StatusDownloadErr
-				appInstall.Message = err.Error()
-			}
-		}
-	}()
-
-	if err = files.DownloadFileWithProxy(appDetail.DownloadUrl, filePath); err != nil {
+	if err = files.DownloadFileWithProxy(downloadURL, filePath); err != nil {
 		if logger == nil {
 			global.LOG.Errorf("download app [%s] error %v", app.Name, err)
 		} else {
@@ -923,6 +990,9 @@ func downloadApp(app model.App, appDetail model.AppDetail, appInstall *model.App
 		return
 	}
 	_ = fileOp.DeleteFile(filePath)
+	if err = os.WriteFile(cacheVersionPath, []byte(storeVersion), constant.FilePerm); err != nil {
+		return err
+	}
 	appDetail.Update = false
 	_ = appDetailRepo.Update(context.Background(), appDetail)
 	return
@@ -999,6 +1069,12 @@ func runScript(task *task.Task, appInstall *model.AppInstall, operate string) er
 		scriptPath = path.Join(workDir, "scripts", "upgrade.sh")
 	case "uninstall":
 		scriptPath = path.Join(workDir, "scripts", "uninstall.sh")
+	case "start":
+		scriptPath = path.Join(workDir, "scripts", "start.sh")
+	case "stop":
+		scriptPath = path.Join(workDir, "scripts", "stop.sh")
+	case "restart":
+		scriptPath = path.Join(workDir, "scripts", "restart.sh")
 	}
 	fileOp := files.NewFileOp()
 	if !fileOp.Stat(scriptPath) {
@@ -1008,7 +1084,11 @@ func runScript(task *task.Task, appInstall *model.AppInstall, operate string) er
 	logStr := i18n.GetWithName("ExecShell", operate)
 	task.LogStart(logStr)
 
-	cmdMgr := cmd.NewCommandMgr(cmd.WithTimeout(10*time.Minute), cmd.WithWorkDir(workDir))
+	timeout := 10 * time.Minute
+	if operate == "start" || operate == "restart" {
+		timeout = time.Hour
+	}
+	cmdMgr := cmd.NewCommandMgr(cmd.WithTimeout(timeout), cmd.WithWorkDir(workDir), cmd.WithTask(*task))
 	if err := cmdMgr.Run("bash", scriptPath); err != nil {
 		task.LogFailedWithErr(logStr, err)
 		return err
@@ -1043,12 +1123,15 @@ func checkContainerNameIsExist(containerName, appDir string) (bool, error) {
 	return false, nil
 }
 
-func upApp(task *task.Task, appInstall *model.AppInstall, pullImages bool) error {
+func upApp(task *task.Task, appInstall *model.AppInstall, pullImages, useLifecycleScripts bool) error {
 	upProject := func(appInstall *model.AppInstall) (err error) {
 		var (
 			out    string
 			errMsg string
 		)
+		if useLifecycleScripts {
+			return runScript(task, appInstall, "start")
+		}
 		if pullImages && appInstall.App.Type != "php" {
 			envByte, err := files.NewFileOp().GetContent(appInstall.GetEnvPath())
 			if err != nil {
@@ -1374,8 +1457,8 @@ func handleErr(install model.AppInstall, err error, out string) error {
 }
 
 func doNotNeedSync(installed model.AppInstall) bool {
-	return installed.Status == constant.StatusInstalling || installed.Status == constant.StatusRebuilding || installed.Status == constant.StatusUpgrading ||
-		installed.Status == constant.StatusSyncing || installed.Status == constant.StatusUninstalling || installed.Status == constant.StatusInstallErr
+	return appInstallOperationPending(installed.Status) || installed.Status == constant.StatusSyncing ||
+		installed.Status == constant.StatusInstallErr || installed.Status == constant.StatusUpgradeErr || installed.Status == constant.StatusUpErr
 }
 
 func synAppInstall(containers map[string]container.Summary, appInstall *model.AppInstall, force bool) {
@@ -1469,6 +1552,11 @@ func handleInstalled(appInstallList []model.AppInstall, updated, sync, checkUpda
 	}
 
 	for _, installed := range appInstallList {
+		if sync && appInstallOperationPending(installed.Status) {
+			if err := syncAppInstallStatus(&installed, false); err != nil {
+				return nil, err
+			}
+		}
 		if updated && ignoreUpdate(installed) {
 			continue
 		}
@@ -1534,11 +1622,14 @@ func handleInstalled(appInstallList []model.AppInstall, updated, sync, checkUpda
 
 		var versions []string
 		for _, appDetail := range details {
+			if !isAIGatewayUpgradeVersionAllowed(installed.App.Key, installed.Version, appDetail.Version) {
+				continue
+			}
 			ignores, _ := appIgnoreUpgradeRepo.List(runtimeRepo.WithDetailId(appDetail.ID), appIgnoreUpgradeRepo.WithScope("version"))
 			if len(ignores) > 0 {
 				continue
 			}
-			if common.IsCrossVersion(installed.Version, appDetail.Version) && !installed.App.CrossVersionUpdate {
+			if isCrossAppVersion(installed.App.Key, installed.Version, appDetail.Version) && !installed.App.CrossVersionUpdate {
 				continue
 			}
 			versions = append(versions, appDetail.Version)
@@ -1553,7 +1644,7 @@ func handleInstalled(appInstallList []model.AppInstall, updated, sync, checkUpda
 			continue
 		}
 
-		versions = common.GetSortedVersions(versions)
+		versions = sortAppVersions(installed.App.Key, versions)
 		lastVersion := versions[0]
 
 		if installed.App.Key == constant.AppMysql || installed.App.Key == constant.AppMysqlCluster {
@@ -1568,10 +1659,10 @@ func handleInstalled(appInstallList []model.AppInstall, updated, sync, checkUpda
 			}
 		}
 
-		if common.IsCrossVersion(installed.Version, lastVersion) {
+		if isCrossAppVersion(installed.App.Key, installed.Version, lastVersion) {
 			installDTO.CanUpdate = installed.App.CrossVersionUpdate
 		} else {
-			installDTO.CanUpdate = common.CompareVersion(lastVersion, installed.Version)
+			installDTO.CanUpdate = isNewerAppVersion(installed.App.Key, lastVersion, installed.Version)
 		}
 
 		if updated {
@@ -1944,6 +2035,9 @@ func getAppTags(appID uint, lang string) ([]response.TagDTO, error) {
 
 func handleSiteDir(app model.App, appDetail model.AppDetail, req request.AppInstallCreate, t *task.Task) error {
 	if app.Key == "openresty" && (app.Resource == "remote" || app.Resource == "custom") && common.CompareVersion(appDetail.Version, "1.27") {
+		if req.MCPPreserveWebsiteDir {
+			return prepareMCPWebsiteDirectory(req)
+		}
 		if dir, ok := req.Params["WEBSITE_DIR"]; ok {
 			siteDir := dir.(string)
 			if siteDir == "" || !strings.HasPrefix(siteDir, "/") {
@@ -2229,6 +2323,9 @@ func getAppVersions(key string, details []model.AppDetail) []string {
 	hasLatest := false
 	latestVersion := ""
 	for _, detail := range details {
+		if !canAccessVllmVersion(key, detail.Version) {
+			continue
+		}
 		if key != "mssql" && strings.Contains(detail.Version, "latest") {
 			hasLatest = true
 			latestVersion = detail.Version
@@ -2239,7 +2336,12 @@ func getAppVersions(key string, details []model.AppDetail) []string {
 		}
 		versionsRaw = append(versionsRaw, detail.Version)
 	}
-	versions = common.GetSortedVersions(versionsRaw)
+	if isAIGatewayApp(key) {
+		sortAIGatewayVersions(versionsRaw)
+		versions = versionsRaw
+	} else {
+		versions = sortAppVersions(key, versionsRaw)
+	}
 	if hasLatest {
 		versions = append([]string{latestVersion}, versions...)
 	}

agent/app/service/backup_app.go

@@ -132,11 +132,9 @@ func (u *BackupService) AppRecover(req dto.CommonRecover) error {
 	if !fileOp.Stat(req.File) {
 		return buserr.WithName("ErrFileNotFound", req.File)
 	}
-	if _, err := compose.Down(install.GetComposePath()); err != nil {
-		return err
-	}
 	if err := handleAppRecover(&install, nil, req.File, false, req.Secret, req.TaskID); err != nil {
 		global.LOG.Errorf("recover app %s failed, err: %v", req.DetailName, err)
+		return err
 	}
 	return nil
 }
@@ -199,9 +197,22 @@ func handleAppBackup(install *model.AppInstall, parentTask *task.Task, recordID
 	return nil
 }
 
-func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverFile string, isRollback bool, secret, taskID string) error {
+func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverFile string, isRollback bool, secret, taskID string, startAfterRecover ...bool) error {
+	startAfter := len(startAfterRecover) == 0 || startAfterRecover[0]
+	// Validate AI Gateway backups before stopping the app, creating rollback
+	// backups, or touching its files/database. Keep the validated extraction for
+	// the restore so uploaded/encrypted archives are not unpacked twice.
+	preparedPath, cleanup, err := prepareAIGatewayAppRecover(install, recoverFile, secret)
+	if err != nil {
+		return err
+	}
+	if parentTask == nil && !isRollback {
+		if _, err := compose.Down(install.GetComposePath()); err != nil {
+			cleanup()
+			return err
+		}
+	}
 	var (
-		err          error
 		recoverTask  *task.Task
 		isOk         = false
 		rollbackFile string
@@ -210,11 +221,13 @@ func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverF
 	if parentTask == nil {
 		recoverTask, err = task.NewTaskWithOps(install.Name, task.TaskRecover, task.TaskScopeBackup, taskID, install.ID)
 		if err != nil {
+			cleanup()
 			return err
 		}
 	}
 
 	recoverApp := func(t *task.Task) error {
+		defer cleanup()
 		fileOp := files.NewFileOp()
 		if !isRollback {
 			rollbackFile = path.Join(global.Dir.TmpDir, fmt.Sprintf("app/%s_%s.tar.gz", install.Name, time.Now().Format(constant.DateTimeSlimLayout)))
@@ -223,20 +236,26 @@ func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverF
 			}
 		}
 
-		if err := fileOp.TarGzExtractPro(recoverFile, path.Dir(recoverFile), secret); err != nil {
-			return err
+		tmpPath := preparedPath
+		if tmpPath == "" {
+			if err := fileOp.TarGzExtractPro(recoverFile, path.Dir(recoverFile), secret); err != nil {
+				return err
+			}
+			tmpPath = strings.ReplaceAll(recoverFile, ".tar.gz", "")
 		}
-		tmpPath := strings.ReplaceAll(recoverFile, ".tar.gz", "")
 		if err := fileOp.TarGzExtractPro(tmpPath+"/app.tar.gz", tmpPath, ""); err != nil {
 			return err
 		}
 		defer func() {
+			defer os.RemoveAll(tmpPath)
+			if !startAfter {
+				return
+			}
 			if isRollback {
-				_, _ = compose.UpWithoutPull(install.GetComposePath())
+				_, _ = compose.UpWithoutBuild(install.GetComposePath())
 			} else {
 				_, _ = compose.Up(install.GetComposePath())
 			}
-			_ = os.RemoveAll(strings.ReplaceAll(recoverFile, ".tar.gz", ""))
 		}()
 
 		if !fileOp.Stat(tmpPath+"/app.json") || !fileOp.Stat(tmpPath+"/app.tar.gz") {
@@ -337,8 +356,12 @@ func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverF
 
 		appDir := install.GetPath()
 		backPath := fmt.Sprintf("%s_bak", appDir)
-		_ = fileOp.Rename(appDir, backPath)
-		_ = fileOp.CreateDir(appDir, constant.DirPerm)
+		if err := fileOp.Rename(appDir, backPath); err != nil && !startAfter {
+			return err
+		}
+		if err := fileOp.CreateDir(appDir, constant.DirPerm); err != nil && !startAfter {
+			return err
+		}
 
 		deCompressName := i18n.GetWithName("DeCompressFile", "app.tar.gz")
 		t.LogStart(deCompressName)
@@ -361,6 +384,10 @@ func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverF
 			_, _ = file.WriteString(mergedEnvContent)
 		}
 
+		// The upgrade transaction verifies readiness before saving its restored install.
+		if !startAfter {
+			return nil
+		}
 		backupInstall.ID = install.ID
 		backupInstall.Status = constant.StatusRunning
 		backupInstall.AppId = install.AppId
@@ -397,6 +424,7 @@ func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverF
 	}
 	recoverTask.AddSubTask(task.GetTaskName(install.Name, task.TaskRecover, task.TaskScopeBackup), recoverApp, rollBackApp)
 	go func() {
+		defer cleanup()
 		_ = recoverTask.Execute()
 	}()
 	return nil

agent/app/service/backup_compose.go

@@ -371,43 +371,39 @@ func loadComposePathAndFiles(composeName string, dockerClient *client.Client) (s
 		}
 		config := targetContainer.Labels[composeConfigLabel]
 		workdir := targetContainer.Labels[composeWorkdirLabel]
-		if len(config) != 0 && len(workdir) != 0 && strings.Contains(config, workdir) {
-			composePath = config
-		} else {
-			composePath = workdir
+		files, err := resolveComposeFiles(workdir, config)
+		if err != nil {
+			return "", nil, err
 		}
+		composePath = strings.Join(files, ",")
 	}
-	composeFiles := normalizeComposeFiles(composePath)
-	if len(composeFiles) == 0 {
-		return "", nil, fmt.Errorf("compose file not found for %s", composeName)
+	composeFiles, err := normalizeComposeFiles(composePath)
+	if err != nil {
+		return "", nil, err
 	}
-	return composePath, composeFiles, nil
+	return strings.Join(composeFiles, ","), composeFiles, nil
 }
 
-func normalizeComposeFiles(composePath string) []string {
-	items := strings.Split(composePath, ",")
-	result := make([]string, 0)
-	seen := make(map[string]struct{})
-	for _, item := range items {
-		item = strings.TrimSpace(item)
-		if item == "" {
-			continue
-		}
-		stat, err := os.Stat(item)
-		if err == nil && stat.IsDir() {
-			item = path.Join(item, "docker-compose.yml")
-		}
-		if _, err := os.Stat(item); err != nil {
-			continue
-		}
-		if _, ok := seen[item]; ok {
-			continue
-		}
-		seen[item] = struct{}{}
-		result = append(result, item)
+func normalizeComposeFiles(composePath string) ([]string, error) {
+	files, err := resolveComposeFiles("", composePath)
+	if err != nil {
+		return nil, err
 	}
-	sort.Strings(result)
-	return result
+	for i, file := range files {
+		info, err := os.Stat(file)
+		if err == nil && info.IsDir() {
+			file = filepath.Join(file, "docker-compose.yml")
+			info, err = os.Stat(file)
+			files[i] = file
+		}
+		if err != nil {
+			return nil, err
+		}
+		if !info.Mode().IsRegular() {
+			return nil, fmt.Errorf("compose path %s is not a regular file", file)
+		}
+	}
+	return files, nil
 }
 
 func (c *composeBackupContext) close() {
@@ -621,20 +617,46 @@ func safeJoinWithinBase(baseDir, name string) (string, error) {
 }
 
 func stepRestoreComposeFiles(recoverCtx *composeRecoverContext) error {
-	if recoverCtx.targetDir != "" {
-		_ = os.RemoveAll(recoverCtx.targetDir)
+	composeFiles := recoverCtx.meta.Files
+	if strings.TrimSpace(recoverCtx.meta.ComposePath) != "" {
+		filesByPath := make(map[string]composeBackupFile, len(composeFiles))
+		for _, item := range composeFiles {
+			filesByPath[filepath.Clean(item.OriginalPath)] = item
+		}
+		orderedFiles := make([]composeBackupFile, 0, len(composeFiles))
+		for _, file := range strings.Split(recoverCtx.meta.ComposePath, ",") {
+			file = strings.TrimSpace(file)
+			if file == "" {
+				continue
+			}
+			file = filepath.Clean(file)
+			item, ok := filesByPath[file]
+			if !ok {
+				if len(composeFiles) != 1 || file != filepath.Dir(composeFiles[0].OriginalPath) {
+					return fmt.Errorf("compose file %s is missing from backup metadata", file)
+				}
+				item = composeFiles[0]
+			}
+			orderedFiles = append(orderedFiles, item)
+		}
+		composeFiles = orderedFiles
 	}
-	if err := os.MkdirAll(recoverCtx.targetDir, os.ModePerm); err != nil {
-		return err
+	if len(composeFiles) == 0 {
+		return fmt.Errorf("compose files are missing from backup metadata")
 	}
-	restored := make([]string, 0, len(recoverCtx.meta.Files))
-	for _, item := range recoverCtx.meta.Files {
+	restored := make([]string, 0, len(composeFiles))
+	sourceByTarget := make(map[string]string, len(composeFiles))
+	for _, item := range composeFiles {
 		backupPath, err := safeJoinWithinBase(recoverCtx.tmpDir, item.BackupPath)
 		if err != nil {
 			return fmt.Errorf("invalid compose backup path %q, err: %v", item.BackupPath, err)
 		}
-		if !recoverCtx.fileOp.Stat(backupPath) {
-			continue
+		info, err := os.Stat(backupPath)
+		if err != nil {
+			return err
+		}
+		if !info.Mode().IsRegular() {
+			return fmt.Errorf("compose backup path %s is not a regular file", backupPath)
 		}
 		targetName := item.FileName
 		if item.RelativePath != "" {
@@ -650,6 +672,29 @@ func stepRestoreComposeFiles(recoverCtx *composeRecoverContext) error {
 		if err != nil {
 			return fmt.Errorf("invalid compose target path %q, err: %v", targetName, err)
 		}
+		sourcePath := item.OriginalPath
+		if sourcePath == "" {
+			sourcePath = backupPath
+		}
+		sourcePath = filepath.Clean(sourcePath)
+		if previous, ok := sourceByTarget[targetPath]; ok && previous != sourcePath {
+			return fmt.Errorf("compose files %q and %q resolve to the same restore path %q", previous, sourcePath, targetPath)
+		}
+		sourceByTarget[targetPath] = sourcePath
+		restored = append(restored, targetPath)
+	}
+	if recoverCtx.targetDir != "" {
+		_ = os.RemoveAll(recoverCtx.targetDir)
+	}
+	if err := os.MkdirAll(recoverCtx.targetDir, os.ModePerm); err != nil {
+		return err
+	}
+	for i, item := range composeFiles {
+		backupPath, err := safeJoinWithinBase(recoverCtx.tmpDir, item.BackupPath)
+		if err != nil {
+			return fmt.Errorf("invalid compose backup path %q, err: %v", item.BackupPath, err)
+		}
+		targetPath := restored[i]
 		if err := os.MkdirAll(path.Dir(targetPath), os.ModePerm); err != nil {
 			return err
 		}
@@ -660,7 +705,6 @@ func stepRestoreComposeFiles(recoverCtx *composeRecoverContext) error {
 		if err := recoverCtx.fileOp.SaveFile(targetPath, string(content), fs.ModePerm); err != nil {
 			return err
 		}
-		restored = append(restored, targetPath)
 	}
 	envPath := path.Join(recoverCtx.tmpDir, "compose_files", ".env")
 	if recoverCtx.fileOp.Stat(envPath) {
@@ -672,14 +716,6 @@ func stepRestoreComposeFiles(recoverCtx *composeRecoverContext) error {
 			return err
 		}
 	}
-	if len(restored) == 0 {
-		defaultPath := path.Join(recoverCtx.targetDir, "docker-compose.yml")
-		if !recoverCtx.fileOp.Stat(defaultPath) {
-			return fmt.Errorf("compose file not found in backup data")
-		}
-		restored = append(restored, defaultPath)
-	}
-	sort.Strings(restored)
 	recoverCtx.composePath = strings.Join(restored, ",")
 	return nil
 }

agent/app/service/backup_container.go

@@ -582,6 +582,10 @@ func stepRecreateContainer(recoverCtx *containerRecoverContext, taskItem *task.T
 	if config.Image == "" {
 		return fmt.Errorf("container image not found in backup file")
 	}
+	networkConf, extraNetworks := buildContainerRecoverNetworkConfig(recoverCtx.inspectInfo.NetworkSettings, hostConfig)
+	if err := normalizeContainerEndpointSettings(ctx, recoverCtx.client, networkConf, extraNetworks); err != nil {
+		return err
+	}
 	if !checkImageExist(recoverCtx.client, config.Image) {
 		if err := pullImages(taskItem, recoverCtx.client, config.Image); err != nil {
 			return err
@@ -596,7 +600,7 @@ func stepRecreateContainer(recoverCtx *containerRecoverContext, taskItem *task.T
 		return err
 	}
 
-	createRes, err := createContainerWithOldNetworks(ctx, recoverCtx.client, config, hostConfig, recoverCtx.inspectInfo.NetworkSettings, recoverCtx.targetName)
+	createRes, err := createContainerWithNetworks(ctx, recoverCtx.client, config, hostConfig, networkConf, extraNetworks, recoverCtx.targetName)
 	if err != nil {
 		return err
 	}
@@ -604,7 +608,7 @@ func stepRecreateContainer(recoverCtx *containerRecoverContext, taskItem *task.T
 	return nil
 }
 
-func normalizeContainerEndpointSettings(ctx context.Context, cli *client.Client, primary *network.NetworkingConfig, extras map[string]*network.EndpointSettings) {
+func normalizeContainerEndpointSettings(ctx context.Context, cli *client.Client, primary *network.NetworkingConfig, extras map[string]*network.EndpointSettings) error {
 	if cli.NewVersionError(ctx, "1.44", "specify mac-address per network") != nil {
 		removeEndpointMacAddresses(primary, extras)
 	}
@@ -619,11 +623,14 @@ func normalizeContainerEndpointSettings(ctx context.Context, cli *client.Client,
 			}
 			info, err := cli.NetworkInspect(ctx, netName, network.InspectOptions{})
 			if err != nil {
-				continue
+				return fmt.Errorf("inspect network %s failed: %w", netName, err)
+			}
+			if err := validateContainerEndpointStaticIP(netName, info, endpoint); err != nil {
+				return err
 			}
-			removeUnsupportedEndpointStaticIP(netName, info, endpoint)
 		}
 	}
+	return nil
 }
 
 func removeEndpointMacAddresses(primary *network.NetworkingConfig, extras map[string]*network.EndpointSettings) {
@@ -641,24 +648,28 @@ func removeEndpointMacAddresses(primary *network.NetworkingConfig, extras map[st
 	}
 }
 
-func removeUnsupportedEndpointStaticIP(netName string, info network.Inspect, endpoint *network.EndpointSettings) {
+func validateContainerEndpointStaticIP(netName string, info network.Inspect, endpoint *network.EndpointSettings) error {
 	if endpoint == nil || endpoint.IPAMConfig == nil {
-		return
+		return nil
 	}
-	if isDefaultBridgeNetwork(netName, info) {
-		endpoint.IPAMConfig = nil
-		return
+	ipam := endpoint.IPAMConfig
+	if err := ipam.Validate(); err != nil {
+		return fmt.Errorf("invalid IP configuration for network %s: %w", netName, err)
+	}
+	if ipam.IPv4Address == "" && ipam.IPv6Address == "" {
+		return nil
+	}
+	if netName == "host" || netName == "none" || isDefaultBridgeNetwork(netName, info) {
+		return fmt.Errorf("network %s does not support static IP configuration", netName)
 	}
 
-	if endpoint.IPAMConfig.IPv4Address != "" && !networkSupportsStaticIP(info, endpoint.IPAMConfig.IPv4Address, false) {
-		endpoint.IPAMConfig.IPv4Address = ""
+	if ipam.IPv4Address != "" && !networkSupportsStaticIP(info, ipam.IPv4Address, false) {
+		return fmt.Errorf("static IPv4 address %s is not in a configured subnet of network %s", ipam.IPv4Address, netName)
 	}
-	if endpoint.IPAMConfig.IPv6Address != "" && !networkSupportsStaticIP(info, endpoint.IPAMConfig.IPv6Address, true) {
-		endpoint.IPAMConfig.IPv6Address = ""
-	}
-	if endpoint.IPAMConfig.IPv4Address == "" && endpoint.IPAMConfig.IPv6Address == "" && len(endpoint.IPAMConfig.LinkLocalIPs) == 0 {
-		endpoint.IPAMConfig = nil
+	if ipam.IPv6Address != "" && !networkSupportsStaticIP(info, ipam.IPv6Address, true) {
+		return fmt.Errorf("static IPv6 address %s is not in a configured subnet of network %s", ipam.IPv6Address, netName)
 	}
+	return nil
 }
 
 func isDefaultBridgeNetwork(netName string, info network.Inspect) bool {
@@ -673,6 +684,7 @@ func networkSupportsStaticIP(info network.Inspect, ip string, isIPv6 bool) bool
 	if err != nil {
 		return false
 	}
+	addr = addr.Unmap()
 	if addr.Is6() != isIPv6 {
 		return false
 	}
@@ -813,11 +825,6 @@ func buildContainerRecoverNetworkConfig(networkSettings *container.NetworkSettin
 				IPv6Address:  endpoint.IPAMConfig.IPv6Address,
 				LinkLocalIPs: append([]string(nil), endpoint.IPAMConfig.LinkLocalIPs...),
 			}
-		} else if name != "bridge" && (endpoint.IPAddress != "" || endpoint.GlobalIPv6Address != "") {
-			endpointSetting.IPAMConfig = &network.EndpointIPAMConfig{
-				IPv4Address: endpoint.IPAddress,
-				IPv6Address: endpoint.GlobalIPv6Address,
-			}
 		}
 		if name == primaryName {
 			config.EndpointsConfig[name] = endpointSetting
@@ -831,39 +838,6 @@ func buildContainerRecoverNetworkConfig(networkSettings *container.NetworkSettin
 	return config, extraNetworks
 }
 
-const unsupportedUserSpecifiedIPAddress = "user specified IP address is supported only when connecting to networks with user configured subnets"
-
-func clearUnsupportedDynamicEndpointIPAM(err error, endpoints map[string]*network.EndpointSettings, networkSettings *container.NetworkSettings) bool {
-	if err == nil || !strings.Contains(err.Error(), unsupportedUserSpecifiedIPAddress) {
-		return false
-	}
-	for name, endpoint := range endpoints {
-		if !isDynamicContainerNetwork(networkSettings, name) || endpoint == nil || endpoint.IPAMConfig == nil {
-			continue
-		}
-		if strings.Contains(err.Error(), "network "+name+":") {
-			endpoint.IPAMConfig = nil
-			return true
-		}
-	}
-	cleared := false
-	for name, endpoint := range endpoints {
-		if isDynamicContainerNetwork(networkSettings, name) && endpoint != nil && endpoint.IPAMConfig != nil {
-			endpoint.IPAMConfig = nil
-			cleared = true
-		}
-	}
-	return cleared
-}
-
-func isDynamicContainerNetwork(networkSettings *container.NetworkSettings, name string) bool {
-	if networkSettings == nil || name == "bridge" {
-		return false
-	}
-	endpoint := networkSettings.Networks[name]
-	return endpoint != nil && endpoint.IPAMConfig == nil && (endpoint.IPAddress != "" || endpoint.GlobalIPv6Address != "")
-}
-
 func cloneContainerConfig(config *container.Config) *container.Config {
 	if config == nil {
 		return &container.Config{}