fix: simplify login page i18n labels (#12584 )

fix: fixed issue with model account invalid in hermes (#12590 )
fix: Fix the pagination issue in the historical version list (#12583 )
2026-10-09 08:00:27 +00:00 · 2026-04-23 18:22:51 +08:00 · 2026-04-23 18:01:54 +08:00 · 2026-04-23 11:20:12 +08:00 · 2026-04-22 17:31:53 +08:00 · 2026-04-22 16:53:24 +08:00
855 changed files with 85998 additions and 16077 deletions
@@ -0,0 +1,14 @@
+version: 2
+
+updates:
+  - package-ecosystem: "gomod"
+    directories:
+      - "/agent"
+      - "/core"
+    schedule:
+      interval: "daily"
+
+  - package-ecosystem: "npm"
+    directory: "/frontend"
+    schedule:
+      interval: "daily"
@@ -6,7 +6,7 @@ permissions:
 jobs:
  generic_handler:
    name: Add Labels to PR
-    if: github.repository == '1Panel-dev/1Panel'
+    if: github.repository == '1Panel-dev/1Panel' && github.event.pull_request.user.login != 'dependabot[bot]'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
@@ -1,33 +1,43 @@
-name: Create Release And Upload Cloudflare R2
+name: Build And Publish (OSS + R2)
+
 on:
  push:
    tags:
      - 'v*'
+
 jobs:
  create-release:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4
+
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
-          node-version: '22.19.0'
+          node-version: '24.11.1'
+
      - name: Build Web
        run: |
          cd frontend && npm install && npm run build:pro
        env:
          NODE_OPTIONS: --max-old-space-size=8192
+
      - name: Setup Go
        uses: actions/setup-go@v5
        with:
-          go-version: '1.24'
+          go-version: '1.25'
+          cache-dependency-path: |
+            core/go.sum
+            agent/go.sum
+
      - name: Build Release
        uses: goreleaser/goreleaser-action@v6
        with:
          distribution: goreleaser
          version: '~> v2'
          args: release --skip=publish --clean
+
      - name: Upload Assets
        uses: softprops/action-gh-release@v1
        if: startsWith(github.ref, 'refs/tags/')
@@ -36,10 +46,24 @@ jobs:
          files: |
            dist/*.tar.gz
            dist/checksums.txt
+
+      - name: Setup OSSUTIL
+        uses: yizhoumo/setup-ossutil@v2
+        with:
+          endpoint: ${{ secrets.OSS_ENDPOINT }}
+          access-key-id: ${{ secrets.OSS_ACCESS_KEY_ID }}
+          access-key-secret: ${{ secrets.OSS_ACCESS_KEY_SECRET }}
+          ossutil-version: '1.7.18'
+
+      - name: Upload Assets to OSS
+        run: |
+          ossutil cp -r dist/ oss://resource-fit2cloud-com/1panel/package/v2/stable/${{ github.ref_name }}/release/ --include "*.tar.gz" --include "checksums.txt" --only-current-dir --force
+
      - name: Setup Rclone
        uses: AnimMouse/setup-rclone@v1
        with:
          rclone_config: ${{ secrets.RCLONE_CONFIG }}
+
      - name: Upload to Cloudflare R2
        run: |
          rclone copy dist/ cloudflare_r2:package/v2/stable/${{ github.ref_name }}/release/ --include "*.tar.gz" --include "checksums.txt" --progress
@@ -1,47 +0,0 @@
-name: Create Release And Upload assets
-on:
-  push:
-    tags:
-      - 'v*'
-jobs:
-  create-release:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Code
-        uses: actions/checkout@v4
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: '22.19.0'
-      - name: Build Web
-        run: |
-          cd frontend && npm install && npm run build:pro
-        env:
-          NODE_OPTIONS: --max-old-space-size=8192
-      - name: Setup Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: '1.24'
-      - name: Build Release
-        uses: goreleaser/goreleaser-action@v6
-        with:
-          distribution: goreleaser
-          version: '~> v2'
-          args: release --skip=publish --clean
-      - name: Upload Assets
-        uses: softprops/action-gh-release@v1
-        if: startsWith(github.ref, 'refs/tags/')
-        with:
-          draft: true
-          files: |
-            dist/*.tar.gz
-            dist/checksums.txt
-      - name: Setup OSSUTIL
-        uses: yizhoumo/setup-ossutil@v2
-        with:
-          endpoint: ${{ secrets.OSS_ENDPOINT }}
-          access-key-id: ${{ secrets.OSS_ACCESS_KEY_ID }}
-          access-key-secret: ${{ secrets.OSS_ACCESS_KEY_SECRET }}
-          ossutil-version: '1.7.18'
-      - name: Upload Assets to OSS
-        run: ossutil cp -r dist/ oss://resource-fit2cloud-com/1panel/package/v2/stable/${{ github.ref_name }}/release/ --include "*.tar.gz" --include "checksums.txt" --only-current-dir --force
@@ -9,7 +9,6 @@ build/1panel-core

 # Mac
 .DS_Store
-*/.DS_Store

 # VS Code
 .vscode
@@ -41,15 +40,11 @@ core/cmd/server/web/index.html
 frontend/auto-imports.d.ts
 frontend/components.d.ts
 frontend/src/xpack
+frontend/src/xpack-ee
 agent/xpack
-agent/router/entry_xpack.go
-agent/server/init_xpack.go
-agent/utils/xpack/xpack_xpack.go
+agent/xpack-ee
 core/xpack
-core/router/entry_xpack.go
-core/server/init_xpack.go
-core/utils/xpack/xpack_xpack.go
-xpack
+core/xpack-ee

 .history/
 dist/
@@ -62,4 +57,12 @@ cmd/server/fileList.txt
 1Panel.code-workspace

 core/.golangci.yml
-agent/.golangci.yml
+agent/.golangci.yml
+
+.opencode
+openspec
+CLAUDE.md
+AGENTS.md
+opencode.json
+superpowers
+.worktrees/
@@ -10,10 +10,12 @@ PR are always welcome, even if they only contain small fixes like typos or a few

 Please submit a PR broken down into small changes bit by bit. A PR consisting of a lot of features and code changes may be hard to review. It is recommended to submit PRs in an incremental fashion.

-This [development guideline](https://docs.1panel.pro/dev_manual/dev_manual/) contains information about repository structure, how to set up development environment, how to run it, and more.
-
 Note: If you split your pull request to small changes, please make sure any of the changes goes to master will not break anything. Otherwise, it can not be merged until this feature complete.

+## Add a new translation
+
+If you'd like to help translate 1Panel into a new language, please read the [Translation Contribution Guide](docs/TRANSLATION.md). It lists every file you need to create or modify, along with a reference PR you can use as a concrete example.
+
 ## Report issues
 It is a great way to contribute by reporting an issue. Well-written and complete bug reports are always welcome! Please open an issue and follow the template to fill in required information.

@@ -1,17 +1,23 @@
 <p align="center"><a href="https://1panel.pro"><img src="https://resource.1panel.pro/img/1panel-logo.png" alt="1Panel" width="300" /></a></p>
-<p align="center"><b>Top-Rated Web-based Linux Server Management Tool</b><br>Best VPS control panel<br>新一代的 Linux 服务器运维管理面板</p>
+
+<h3 align="center">The open-source VPS control panel with native AI agent support</h3>
+
+<p align="center">
+  Trusted by <strong>2,000,000+</strong> self-hosters worldwide
+</p>
+
 <p align="center">
  <a href="https://trendshift.io/repositories/2462" target="_blank"><img src="https://trendshift.io/api/badge/repositories/2462" alt="1Panel-dev%2F1Panel | Trendshift" style="width: 240px; height: auto;" /></a>
 </p>
+
 <p align="center">
  <a href="https://www.gnu.org/licenses/gpl-3.0.html"><img src="https://shields.io/github/license/1Panel-dev/1Panel?color=%231890FF" alt="License: GPL v3"></a>
-  <a href="https://app.codacy.com/gh/1Panel-dev/1Panel?utm_source=github.com&utm_medium=referral&utm_content=1Panel-dev/1Panel&utm_campaign=Badge_Grade_Dashboard"><img src="https://app.codacy.com/project/badge/Grade/da67574fd82b473992781d1386b937ef" alt="Codacy"></a>
-  <a href="https://discord.gg/bUpUqWqdRr" target="_blank">
-        <img src="https://img.shields.io/discord/1318846410149335080?logo=discord&labelColor=%20%235462eb&logoColor=%20%23f5f5f5&color=%20%235462eb"
-            alt="chat on Discord"></a>
+  <a href="https://app.codacy.com/gh/1Panel-dev/1Panel"><img src="https://app.codacy.com/project/badge/Grade/da67574fd82b473992781d1386b937ef" alt="Codacy"></a>
+  <a href="https://discord.gg/bUpUqWqdRr"><img src="https://img.shields.io/discord/1318846410149335080?logo=discord&labelColor=%20%235462eb&logoColor=%20%23f5f5f5&color=%20%235462eb" alt="Discord"></a>
  <a href="https://github.com/1Panel-dev/1Panel/releases"><img src="https://img.shields.io/github/v/release/1Panel-dev/1Panel" alt="GitHub release"></a>
-  <a href="https://github.com/1Panel-dev/1Panel"><img src="https://img.shields.io/github/stars/1Panel-dev/1Panel?color=%231890FF&style=flat-square" alt="Stars"></a><br>
+  <a href="https://github.com/1Panel-dev/1Panel"><img src="https://img.shields.io/github/stars/1Panel-dev/1Panel?color=%231890FF&style=flat-square" alt="Stars"></a>
 </p>
+
 <p align="center">
  <a href="/README.md"><img alt="English" src="https://img.shields.io/badge/English-d9d9d9"></a>
  <a href="/docs/README.zh-Hans.md"><img alt="中文(简体)" src="https://img.shields.io/badge/中文(简体)-d9d9d9"></a>
@@ -19,58 +25,91 @@
  <a href="/docs/README.pt-br.md"><img alt="Português (Brasil)" src="https://img.shields.io/badge/Português (Brasil)-d9d9d9"></a>
  <a href="/docs/README.ar.md"><img alt="العربية" src="https://img.shields.io/badge/العربية-d9d9d9"></a>
  <a href="/docs/README.de.md"><img alt="Deutsch" src="https://img.shields.io/badge/Deutsch-d9d9d9"></a>
-  <a href="/docs/README.es.md"><img alt="Español" src="https://img.shields.io/badge/Español-d9d9d9"></a><br>
+  <a href="/docs/README.es.md"><img alt="Español" src="https://img.shields.io/badge/Español-d9d9d9"></a>
  <a href="/docs/README.fr.md"><img alt="français" src="https://img.shields.io/badge/français-d9d9d9"></a>
  <a href="/docs/README.ko.md"><img alt="한국어" src="https://img.shields.io/badge/한국어-d9d9d9"></a>
  <a href="/docs/README.id.md"><img alt="Bahasa Indonesia" src="https://img.shields.io/badge/Bahasa Indonesia-d9d9d9"></a>
  <a href="/docs/README.zh-Hant.md"><img alt="中文(繁體)" src="https://img.shields.io/badge/中文(繁體)-d9d9d9"></a>
  <a href="/docs/README.tr.md"><img alt="Türkçe" src="https://img.shields.io/badge/Türkçe-d9d9d9"></a>
-  <a href="/docs/README.ru.md"><img alt="Русский" src="https://img.shields.io/badge/%D0%A0%D1%83%D1%81%D1%81%D0%BA%D0%B8%D0%B9-d9d9d9"></a>
+  <a href="/docs/README.ru.md"><img alt="Русский" src="https://img.shields.io/badge/Русский-d9d9d9"></a>
  <a href="/docs/README.ms.md"><img alt="Bahasa Melayu" src="https://img.shields.io/badge/Bahasa Melayu-d9d9d9"></a>
 </p>

------------------------------
+---

-1Panel is an open-source, modern web-based control panel for Linux server management.
+## What is 1Panel?

- **Efficient Management**: Through a user-friendly web graphical interface, 1Panel enables users to effortlessly manage their Linux servers. Key features include host monitoring, file management, database administration, container management, LLMs management.
- **Rapid Website Deployment**: With deep integration of the popular open-source website building software WordPress, 1Panel streamlines the process of domain binding and SSL certificate configuration, all achievable with just one click.
- **Application Store**: 1Panel curates a wide range of high-quality open-source tools and applications, facilitating easy installation and updates for its users.
- **Security and Reliability**: By leveraging containerization and secure application deployment practices, 1Panel minimizes vulnerability exposure. It further enhances security through integrated firewall management and log auditing capabilities.
- **One-Click Backup & Restore**: Data protection is made simple with 1Panel's one-click backup and restore functionality, supporting various cloud storage solutions to ensure data integrity and availability.
+1Panel is a modern, open-source VPS control panel — and the only one with **native AI agent support**. Run Ollama models, deploy OpenClaw agents, and manage your entire server stack from one clean web interface. No CLI memorization required.
+
+👉 Watch the [2-minute introduction](https://www.youtube.com/watch?v=Jl_wqp-XA08)
+
+## Why 1Panel?
+
+| | 1Panel | cPanel / Plesk | aaPanel | Webmin |
+|--|--------|----------------|---------|--------|
+| Free & open source | ✅ | ❌ | Partial | ✅ |
+| Native AI agent runtime | ✅ | ❌ | ❌ | ❌ |
+| One-click app marketplace | ✅ 165+ apps | ❌ | ✅ | ❌ |
+| Modern UI (post-2020) | ✅ | ❌ | Partial | ❌ |
+| Docker / container management | ✅ | ❌ | ❌ | ❌ |
+| Active development | ✅ | ✅ | ✅ | Slow |
+
+## Key Features
+
+- **AI Agent Runtime**: Deploy Ollama LLMs, spin up OpenClaw personal agents, and monitor GPU utilization — all from the dashboard. No separate AI stack to manage.
+- **One-Click Website Deployment**: Launch production-ready websites with automatic domain binding, SSL provisioning, and Nginx config — zero manual setup.
+- **App Marketplace**: 165+ trusted open-source apps (Nextcloud, Bitwarden, Umami, NocoBase, and more) installed and updated with a single click.
+- **Docker & Container Management**: Create, start, stop, and inspect containers, images, networks, and volumes through a visual UI — no CLI juggling.
+- **Security Out of the Box**: Firewall rules, fail2ban, container isolation, WAF, and audit logs — configured and running from day one.
+- **Backup & Restore**: Schedule automated backups to AWS S3, Cloudflare R2, or local storage. Restore any snapshot in one click.

 ## Quick Start

-Execute the script below and follow the prompts to install 1Panel:
+> **Requirements:** Linux VPS (Debian / Ubuntu / CentOS / Rocky), 1 GB RAM, internet access.  
+> Takes ~60 seconds.

 ```bash
-curl -sSL https://resource.1panel.pro/quick_start.sh -o quick_start.sh && bash quick_start.sh
+bash -c "$(curl -sSL https://resource.1panel.pro/v2/quick_start.sh)"
 ```

-Please refer to our [documentation](https://docs.1panel.pro/quick_start/) for more details.
-
-中国用户请使用这个 [安装脚本](https://1panel.cn/docs/installation/online_installation/)，其应用数量比国际版本更丰富。
+After installation, open `http://<your-server-ip>:<port>/<security-path>` in your browser.  
+Run `1pctl user-info` via SSH if you need to retrieve your access credentials.

 ## Screenshot

-![UI Display](https://resource.1panel.pro/img/1panel.png)
+![1Panel UI](https://resource.1panel.pro/img/overview_en_v2.png)
+
+## Pro Edition
+
+1Panel OSS is free forever. Pro adds features built for teams and production workloads:
+
+| Feature | OSS | Pro |
+|---------|:---:|:---:|
+| One-click app installs | ✅ | ✅ |
+| AI agents (OpenClaw) | 1 agent | Unlimited |
+| WAF & advanced security | Basic | ✅ |
+| Website tamper protection | ❌ | ✅ |
+| Website uptime monitoring | ❌ | ✅ |
+| Multi-node management | ❌ | ✅ |
+| Custom logo & theme | ❌ | ✅ |
+| Priority support | ❌ | ✅ |
+
+**From $80/year.** [Compare plans & start 30-day free trial →](https://1panel.pro/pricing)

 ## Star History

 [![Star History Chart](https://api.star-history.com/svg?repos=1Panel-dev/1Panel&type=Date)](https://star-history.com/#1Panel-dev/1Panel&Date)

-## Pro Edition
+## Community & Support

-Compared to the OSS Edition, 1Panel Pro Edition provides users with a wealth of enhanced features and technical support services. Enhanced features include WAF enhancement, website tamper protection, website monitoring, GPU monitoring, custom logo and theme color, etc. [Click to view the detailed introduction of the Pro Edition](https://1panel.pro/pricing).
+- **Discord** — [Join the community](https://discord.gg/bUpUqWqdRr) for help, feature requests, and show-and-tell
+- **Docs** — [1panel.pro/docs](https://1panel.pro/docs)
+- **Issues** — [GitHub Issues](https://github.com/1Panel-dev/1Panel/issues) for bug reports

-## Security Information
+## Security

-If you discover any security issues, please refer to [SECURITY.md](/SECURITY.md).
+Found a vulnerability? Please read [SECURITY.md](/SECURITY.md) before disclosing.

 ## License

-Licensed under The GNU General Public License version 3 (GPLv3)  (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
-
-<https://www.gnu.org/licenses/gpl-3.0.html>
-
-Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+Licensed under the [GNU General Public License v3.0](https://www.gnu.org/licenses/gpl-3.0.html).
@@ -2,12 +2,12 @@ package v2

 import (
 	"net/http"
-	"time"

 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
 	"github.com/1Panel-dev/1Panel/agent/i18n"
+	"github.com/1Panel-dev/1Panel/agent/utils/appicon"
 	"github.com/gin-gonic/gin"
 )

@@ -164,7 +164,7 @@ func (b *BaseApi) InstallApp(c *gin.Context) {
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	install, err := appService.Install(req)
+	install, err := appService.Install(req, true)
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -203,20 +203,53 @@ func (b *BaseApi) GetAppListUpdate(c *gin.Context) {
 // @Success 200 {file} file "app icon"
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /apps/icon/:appId [get]
+// @Router /apps/icon/:key [get]
 func (b *BaseApi) GetAppIcon(c *gin.Context) {
-	appID, err := helper.GetIntParamByKey(c, "appID")
+	appKey, err := helper.GetStrParamByKey(c, "key")
 	if err != nil {
 		helper.BadRequest(c, err)
 		return
 	}
-	iconBytes, err := appService.GetAppIcon(appID)
+	iconBytes, filename, etag, err := appService.GetAppIcon(appKey)
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
-	c.Header("Content-Type", "image/png")
-	c.Header("Cache-Control", "public, max-age=31536000, immutable")
-	c.Header("Last-Modified", time.Now().UTC().Format(http.TimeFormat))
-	c.Data(http.StatusOK, "image/png", iconBytes)
+
+	if len(iconBytes) == 0 {
+		c.Status(http.StatusNoContent)
+		return
+	}
+
+	c.Header("Cache-Control", "public, max-age=2592000")
+
+	if etag != "" && filename != "" {
+		c.Header("ETag", etag)
+		if c.GetHeader("If-None-Match") == etag {
+			c.Status(http.StatusNotModified)
+			return
+		}
+	}
+
+	c.Data(http.StatusOK, appicon.ContentTypePNG, iconBytes)
+}
+
+// @Tags App
+// @Summary Search app detail by appkey and version
+// @Accept json
+// @Param appId path integer true "app key"
+// @Param version path string true "app version"
+// @Success 200 {object} response.AppDetailSimpleDTO
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /apps/detail/node/:appKey/:version [get]
+func (b *BaseApi) GetAppDetailForNode(c *gin.Context) {
+	appKey := c.Param("appKey")
+	version := c.Param("version")
+	appDetailDTO, err := appService.GetAppDetailByKey(appKey, version)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, appDetailDTO)
 }
@@ -109,7 +109,7 @@ func (b *BaseApi) LoadPort(c *gin.Context) {
 // @Success 200 {object} response.DatabaseConn
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /apps/installed/conninfo [POST]
+// @Router /apps/installed/conninfo [post]
 func (b *BaseApi) LoadConnInfo(c *gin.Context) {
 	var req dto.OperationWithNameAndType
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -294,7 +294,7 @@ func (b *BaseApi) GetParams(c *gin.Context) {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /apps/installed/params/update [post]
-// @x-panel-log {"bodyKeys":["installId"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"应用参数修改 [installId]","formatEN":"Application param update [installId]"}
+// @x-panel-log {"bodyKeys":["installId"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"installId","isList":false,"db":"app_installs","output_column":"name","output_value":"name"}],"formatZH":"应用参数修改 [name]","formatEN":"Application param update [name]"}
 func (b *BaseApi) UpdateInstalled(c *gin.Context) {
 	var req request.AppInstalledUpdate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -349,3 +349,15 @@ func (b *BaseApi) GetAppInstallInfo(c *gin.Context) {
 	}
 	helper.SuccessWithData(c, info)
 }
+
+func (b *BaseApi) UpdateAppInstallSort(c *gin.Context) {
+	var req request.AppInstallSort
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := appInstallService.UpdateSort(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
@@ -415,6 +415,11 @@ func (b *BaseApi) Backup(c *gin.Context) {
 			helper.InternalServer(c, err)
 			return
 		}
+	case "mongodb":
+		if err := backupService.MongodbBackup(req); err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
 	case constant.AppPostgresql, constant.AppPostgresqlCluster:
 		if err := backupService.PostgresqlBackup(req); err != nil {
 			helper.InternalServer(c, err)
@@ -430,6 +435,16 @@ func (b *BaseApi) Backup(c *gin.Context) {
 			helper.InternalServer(c, err)
 			return
 		}
+	case "container":
+		if err := backupService.ContainerBackup(req); err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
+	case "compose":
+		if err := backupService.ComposeBackup(req); err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
 	}
 	helper.Success(c)
 }
@@ -465,6 +480,11 @@ func (b *BaseApi) Recover(c *gin.Context) {
 			helper.InternalServer(c, err)
 			return
 		}
+	case "mongodb":
+		if err := backupService.MongodbRecover(req); err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
 	case constant.AppPostgresql, constant.AppPostgresqlCluster:
 		if err := backupService.PostgresqlRecover(req); err != nil {
 			helper.InternalServer(c, err)
@@ -485,6 +505,16 @@ func (b *BaseApi) Recover(c *gin.Context) {
 			helper.InternalServer(c, err)
 			return
 		}
+	case "container":
+		if err := backupService.ContainerRecover(req); err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
+	case "compose":
+		if err := backupService.ComposeRecover(req); err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
 	}
 	helper.Success(c)
 }
@@ -510,6 +540,11 @@ func (b *BaseApi) RecoverByUpload(c *gin.Context) {
 			helper.InternalServer(c, err)
 			return
 		}
+	case "mongodb":
+		if err := backupService.MongodbRecoverByUpload(req); err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
 	case constant.AppPostgresql, constant.AppPostgresqlCluster:
 		if err := backupService.PostgresqlRecoverByUpload(req); err != nil {
 			helper.InternalServer(c, err)
@@ -525,6 +560,16 @@ func (b *BaseApi) RecoverByUpload(c *gin.Context) {
 			helper.InternalServer(c, err)
 			return
 		}
+	case "container":
+		if err := backupService.ContainerRecover(req); err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
+	case "compose":
+		if err := backupService.ComposeRecover(req); err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
 	}
 	helper.Success(c)
 }
@@ -1,6 +1,9 @@
 package v2

 import (
+	"net/http"
+	"net/url"
+	"path"
 	"strconv"

 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
@@ -53,6 +56,162 @@ func (b *BaseApi) LoadContainerUsers(c *gin.Context) {
 	helper.SuccessWithData(c, containerService.LoadUsers(req))
 }

+// @Tags Container
+// @Summary List container files
+// @Accept json
+// @Param request body dto.ContainerFileReq true "request"
+// @Success 200 {array} dto.ContainerFileInfo
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /containers/files/search [post]
+func (b *BaseApi) ListContainerFiles(c *gin.Context) {
+	var req dto.ContainerFileReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	files, err := containerService.ListContainerFiles(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, files)
+}
+
+// @Tags Container
+// @Summary Upload container file
+// @Accept multipart/form-data
+// @Param containerID formData string true "containerID"
+// @Param path formData string true "path"
+// @Param file formData file true "file"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /containers/files/upload [post]
+// @x-panel-log {"bodyKeys":["containerID","path"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"容器 [containerID] 上传文件到 [path]","formatEN":"Upload file to [path] in container [containerID]"}
+func (b *BaseApi) UploadContainerFile(c *gin.Context) {
+	form, err := c.MultipartForm()
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	containerIDs := form.Value["containerID"]
+	paths := form.Value["path"]
+	uploadFiles := form.File["file"]
+	if len(containerIDs) == 0 || len(paths) == 0 || len(uploadFiles) == 0 {
+		helper.BadRequest(c, errors.New("invalid container file upload params"))
+		return
+	}
+	req := dto.ContainerFileReq{
+		ContainerID: containerIDs[0],
+		Path:        paths[0],
+	}
+	for _, uploadFile := range uploadFiles {
+		file, err := uploadFile.Open()
+		if err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
+		err = containerService.UploadContainerFile(req, path.Base(uploadFile.Filename), uploadFile.Size, file)
+		_ = file.Close()
+		if err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
+	}
+	helper.Success(c)
+}
+
+// @Tags Container
+// @Summary Get container file content
+// @Accept json
+// @Param request body dto.ContainerFileReq true "request"
+// @Success 200 {object} dto.ContainerFileContent
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /containers/files/content [post]
+func (b *BaseApi) GetContainerFileContent(c *gin.Context) {
+	var req dto.ContainerFileReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	content, err := containerService.GetContainerFileContent(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, content)
+}
+
+// @Tags Container
+// @Summary Get container file size
+// @Accept json
+// @Param request body dto.ContainerFileReq true "request"
+// @Success 200 {int} size
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /containers/files/size [post]
+func (b *BaseApi) GetContainerFileSize(c *gin.Context) {
+	var req dto.ContainerFileReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	size, err := containerService.GetContainerFileSize(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, size)
+}
+
+// @Tags Container
+// @Summary Delete container file
+// @Accept json
+// @Param request body dto.ContainerFileBatchDeleteReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /containers/files/del [post]
+// @x-panel-log {"bodyKeys":["containerID","paths"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"删除容器 [containerID] 文件 [paths]","formatEN":"Delete files [paths] in container [containerID]"}
+func (b *BaseApi) DeleteContainerFile(c *gin.Context) {
+	var req dto.ContainerFileBatchDeleteReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := containerService.DeleteContainerFile(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Container
+// @Summary Download container file
+// @Accept json
+// @Param request body dto.ContainerFileReq true "request"
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /containers/files/download [post]
+// @x-panel-log {"bodyKeys":["containerID","path"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"下载容器 [containerID] 文件 [path]","formatEN":"Download file [path] from container [containerID]"}
+func (b *BaseApi) DownloadContainerFile(c *gin.Context) {
+	var req dto.ContainerFileReq
+	if err := c.ShouldBindJSON(&req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	if req.ContainerID == "" || req.Path == "" {
+		helper.BadRequest(c, errors.New("invalid container file download params"))
+		return
+	}
+	reader, fileName, contentType, err := containerService.DownloadContainerFile(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	defer reader.Close()
+	c.Header("Content-Disposition", "attachment; filename*=utf-8''"+url.PathEscape(fileName))
+	c.DataFromReader(http.StatusOK, -1, contentType, reader, nil)
+}
+
 // @Tags Container
 // @Summary List containers
 // @Accept json
@@ -306,27 +465,6 @@ func (b *BaseApi) ContainerCreate(c *gin.Context) {
 	helper.Success(c)
 }

-// @Tags Container
-// @Summary Create container by command
-// @Accept json
-// @Param request body dto.ContainerCreateByCommand true "request"
-// @Success 200
-// @Security ApiKeyAuth
-// @Security Timestamp
-// @Router /containers/command [post]
-func (b *BaseApi) ContainerCreateByCommand(c *gin.Context) {
-	var req dto.ContainerCreateByCommand
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
-		return
-	}
-
-	if err := containerService.ContainerCreateByCommand(req); err != nil {
-		helper.InternalServer(c, err)
-		return
-	}
-	helper.Success(c)
-}
-
 // @Tags Container
 // @Summary Upgrade container
 // @Accept json
@@ -529,7 +667,7 @@ func (b *BaseApi) DownloadContainerLogs(c *gin.Context) {
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	err := containerService.DownloadContainerLogs(req.ContainerType, req.Container, req.Since, strconv.Itoa(int(req.Tail)), c)
+	err := containerService.DownloadContainerLogs(req.ContainerType, req.Container, req.Since, strconv.Itoa(int(req.Tail)), req.Timestamp, c)
 	if err != nil {
 		helper.InternalServer(c, err)
 	}
@@ -731,12 +869,33 @@ func (b *BaseApi) ComposeUpdate(c *gin.Context) {
 	helper.Success(c)
 }

+// @Tags Container Compose
+// @Summary Load compose environment variables
+// @Accept json
+// @Param request body dto.FilePath true "request"
+// @Success 200 {array} string
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /containers/compose/env [post]
+func (b *BaseApi) LoadComposeEnv(c *gin.Context) {
+	var req dto.FilePath
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := containerService.LoadComposeEnv(req.Path)
+	if err != nil {
+		helper.InternalServer(c, err)
+	}
+	helper.SuccessWithData(c, data)
+}
+
 // @Tags Container
 // @Summary Container logs
 // @Param container query string false "容器名称"
 // @Param since query string false "时间筛选"
 // @Param follow query string false "是否追踪"
 // @Param tail query string false "显示行号"
+// @Param timestamp query string false "是否显示时间"
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
@@ -750,6 +909,7 @@ func (b *BaseApi) ContainerStreamLogs(c *gin.Context) {
 	since := c.Query("since")
 	follow := c.Query("follow") == "true"
 	tail := c.Query("tail")
+	timestamp := c.Query("timestamp") == "true"

 	container := c.Query("container")
 	compose := c.Query("compose")
@@ -759,6 +919,7 @@ func (b *BaseApi) ContainerStreamLogs(c *gin.Context) {
 		Since:     since,
 		Follow:    follow,
 		Tail:      tail,
+		Timestamp: timestamp,
 		Type:      "container",
 	}
 	if compose != "" {
@@ -0,0 +1,294 @@
+package v2
+
+import (
+	"context"
+	"encoding/base64"
+
+	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/gin-gonic/gin"
+)
+
+// @Tags Database Mongodb
+// @Summary Create mongodb database
+// @Accept json
+// @Param request body dto.MongodbDBCreate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/mongodb [post]
+// @x-panel-log {"bodyKeys":["name"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"创建 mongodb 数据库 [name]","formatEN":"create mongodb database [name]"}
+func (b *BaseApi) CreateMongodb(c *gin.Context) {
+	var req dto.MongodbDBCreate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	if len(req.Password) != 0 {
+		password, err := base64.StdEncoding.DecodeString(req.Password)
+		if err != nil {
+			helper.BadRequest(c, err)
+			return
+		}
+		req.Password = string(password)
+	}
+
+	if _, err := mongodbService.Create(context.Background(), req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Database Mongodb
+// @Summary Page mongodb databases
+// @Accept json
+// @Param request body dto.MongodbDBSearch true "request"
+// @Success 200 {object} dto.PageResult
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/mongodb/search [post]
+func (b *BaseApi) SearchMongodb(c *gin.Context) {
+	var req dto.MongodbDBSearch
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	total, list, err := mongodbService.SearchWithPage(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+
+	helper.SuccessWithData(c, dto.PageResult{
+		Items: list,
+		Total: total,
+	})
+}
+
+// @Tags Database Mongodb
+// @Summary Update mongodb database description
+// @Accept json
+// @Param request body dto.UpdateDescription true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/mongodb/description [post]
+// @x-panel-log {"bodyKeys":["id","description"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"id","isList":false,"db":"database_mongodbs","output_column":"name","output_value":"name"}],"formatZH":"mongodb 数据库 [name] 描述信息修改 [description]","formatEN":"The description of the mongodb database [name] is modified => [description]"}
+func (b *BaseApi) UpdateMongodbDescription(c *gin.Context) {
+	var req dto.UpdateDescription
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	if err := mongodbService.UpdateDescription(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Database Mongodb
+// @Summary Load mongodb database from remote
+// @Accept json
+// @Param request body dto.MongodbLoadDB true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/mongodb/load [post]
+func (b *BaseApi) LoadMongodbFromRemote(c *gin.Context) {
+	var req dto.MongodbLoadDB
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	if err := mongodbService.LoadFromRemote(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Database Mongodb
+// @Summary Bind mongodb database user info
+// @Accept json
+// @Param request body dto.MongodbBind true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/mongodb/bind [post]
+// @x-panel-log {"bodyKeys":["database", "name", "username"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"绑定 mongodb 数据库 [database] [name] 用户 [username]","formatEN":"bind mongodb database [database] [name] user [username]"}
+func (b *BaseApi) BindMongodbUser(c *gin.Context) {
+	var req dto.MongodbBind
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	if len(req.Password) != 0 {
+		password, err := base64.StdEncoding.DecodeString(req.Password)
+		if err != nil {
+			helper.BadRequest(c, err)
+			return
+		}
+		req.Password = string(password)
+	}
+
+	if err := mongodbService.BindUser(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Database Mongodb
+// @Summary Change mongodb database password
+// @Accept json
+// @Param request body dto.MongodbPassword true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/mongodb/password [post]
+// @x-panel-log {"bodyKeys":["database", "name"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新 mongodb 数据库 [database] [name] 密码","formatEN":"update mongodb database [database] [name] password"}
+func (b *BaseApi) ChangeMongodbPassword(c *gin.Context) {
+	var req dto.MongodbPassword
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	if len(req.Password) != 0 {
+		password, err := base64.StdEncoding.DecodeString(req.Password)
+		if err != nil {
+			helper.BadRequest(c, err)
+			return
+		}
+		req.Password = string(password)
+	}
+
+	if err := mongodbService.ChangePassword(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Database Mongodb
+// @Summary Change mongodb root password
+// @Accept json
+// @Param request body dto.ChangeDBInfo true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/mongodb/root/password [post]
+// @x-panel-log {"bodyKeys":["database"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新 mongodb 数据库 [database] root 密码","formatEN":"update mongodb database [database] root password"}
+func (b *BaseApi) ChangeMongodbRootPassword(c *gin.Context) {
+	var req dto.ChangeDBInfo
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	if len(req.Value) != 0 {
+		value, err := base64.StdEncoding.DecodeString(req.Value)
+		if err != nil {
+			helper.BadRequest(c, err)
+			return
+		}
+		req.Value = string(value)
+	}
+
+	if err := mongodbService.ChangeRootPassword(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Database Mongodb
+// @Summary Load mongodb privileges
+// @Accept json
+// @Param request body dto.MongodbPrivilegesLoad true "request"
+// @Success 200 {string} string
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/mongodb/privileges [post]
+func (b *BaseApi) LoadMongodbPrivileges(c *gin.Context) {
+	var req dto.MongodbPrivilegesLoad
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	permission, err := mongodbService.LoadPrivileges(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, permission)
+}
+
+// @Tags Database Mongodb
+// @Summary Change mongodb privileges
+// @Accept json
+// @Param request body dto.MongodbPrivileges true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/mongodb/privileges/change [post]
+// @x-panel-log {"bodyKeys":["database", "username"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新 mongodb 数据库 [database] 用户 [username] 权限","formatEN":"update mongodb database [database] user [username] privileges"}
+func (b *BaseApi) ChangeMongodbPrivileges(c *gin.Context) {
+	var req dto.MongodbPrivileges
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	if err := mongodbService.ChangePrivileges(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Database Mongodb
+// @Summary Check before delete mongodb database
+// @Accept json
+// @Param request body dto.MongodbDBDeleteCheck true "request"
+// @Success 200 {array} string
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/mongodb/del/check [post]
+func (b *BaseApi) DeleteCheckMongodb(c *gin.Context) {
+	var req dto.MongodbDBDeleteCheck
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	apps, err := mongodbService.DeleteCheck(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, apps)
+}
+
+// @Tags Database Mongodb
+// @Summary Delete mongodb database
+// @Accept json
+// @Param request body dto.MongodbDBDelete true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /databases/mongodb/del [post]
+// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"id","isList":false,"db":"database_mongodbs","output_column":"name","output_value":"name"}],"formatZH":"删除 mongodb 数据库 [name]","formatEN":"delete mongodb database [name]"}
+func (b *BaseApi) DeleteMongodb(c *gin.Context) {
+	var req dto.MongodbDBDelete
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	tx, ctx := helper.GetTxAndContext()
+	if err := mongodbService.Delete(ctx, req); err != nil {
+		helper.InternalServer(c, err)
+		tx.Rollback()
+		return
+	}
+	tx.Commit()
+	helper.Success(c)
+}
@@ -12,7 +12,7 @@ import (
 // @Tags Container Docker
 // @Summary Load docker status
 // @Produce json
-// @Success 200 {string} dto.DockerStatus
+// @Success 200 {object} dto.DockerStatus
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /containers/docker/status [get]
@@ -24,7 +24,7 @@ func (b *BaseApi) LoadDockerStatus(c *gin.Context) {
 // @Tags Container Docker
 // @Summary Load docker daemon.json
 // @Produce json
-// @Success 200 {object} string
+// @Success 200 {string} string
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /containers/daemonjson/file [get]
@@ -20,6 +20,7 @@ var (
 	aiToolService      = service.NewIAIToolService()
 	mcpServerService   = service.NewIMcpServerService()
 	tensorrtLLMService = service.NewITensorRTLLMService()
+	agentService       = service.NewIAgentService()

 	containerService       = service.NewIContainerService()
 	composeTemplateService = service.NewIComposeTemplateService()
@@ -30,17 +31,20 @@ var (
 	dbCommonService   = service.NewIDBCommonService()
 	mysqlService      = service.NewIMysqlService()
 	postgresqlService = service.NewIPostgresqlService()
+	mongodbService    = service.NewIMongodbService()
 	databaseService   = service.NewIDatabaseService()
 	redisService      = service.NewIRedisService()

 	cronjobService = service.NewICronjobService()

-	fileService     = service.NewIFileService()
-	sshService      = service.NewISSHService()
-	firewallService = service.NewIFirewallService()
-	iptablesService = service.NewIIptablesService()
-	monitorService  = service.NewIMonitorService()
-	systemService   = service.NewISystemService()
+	fileService        = service.NewIFileService()
+	fileHistoryService = service.NewIFileHistoryService()
+	fileShareService   = service.NewIFileShareService()
+	sshService         = service.NewISSHService()
+	firewallService    = service.NewIFirewallService()
+	iptablesService    = service.NewIIptablesService()
+	monitorService     = service.NewIMonitorService()
+	systemService      = service.NewISystemService()

 	deviceService   = service.NewIDeviceService()
 	fail2banService = service.NewIFail2BanService()
@@ -69,6 +73,7 @@ var (

 	recycleBinService = service.NewIRecycleBinService()
 	favoriteService   = service.NewIFavoriteService()
+	hostService       = service.NewIHostService()

 	websiteCAService = service.NewIWebsiteCAService()
 	taskService      = service.NewITaskService()
@@ -25,6 +25,7 @@ import (
 	websocket2 "github.com/1Panel-dev/1Panel/agent/utils/websocket"
 	"github.com/gin-gonic/gin"
 	"github.com/gorilla/websocket"
+	qrcode "github.com/skip2/go-qrcode"
 )

 // @Tags File
@@ -48,6 +49,31 @@ func (b *BaseApi) ListFiles(c *gin.Context) {
 	helper.SuccessWithData(c, fileList)
 }

+// @Tags File
+// @Summary File search: content grep + optional AI summary
+// @Description When file-management AI is enabled, returns mode=ai with summary and hits. When disabled, returns mode=grep with hits only. Scans file contents only. Supports match options, extension/size/time filters, and scan limits.
+// @Accept json
+// @Param request body request.FileAISearch true "request"
+// @Success 200 {object} response.FileAISearchResult
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/ai-search [post]
+func (b *BaseApi) FileAISearch(c *gin.Context) {
+	var req request.FileAISearch
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if strings.TrimSpace(req.ResponseLanguage) == "" {
+		req.ResponseLanguage = strings.TrimSpace(c.GetHeader("Accept-Language"))
+	}
+	res, err := fileService.AISearch(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, res)
+}
+
 // @Tags File
 // @Summary Page file
 // @Accept json
@@ -224,6 +250,26 @@ func (b *BaseApi) CompressFile(c *gin.Context) {
 	helper.Success(c)
 }

+// @Tags File
+// @Summary Stop compress task
+// @Accept json
+// @Param request body request.FileCompressStopReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/compress/stop [post]
+func (b *BaseApi) StopCompressFile(c *gin.Context) {
+	var req request.FileCompressStopReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := fileService.StopCompress(req.TaskID); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags File
 // @Summary Decompress file
 // @Accept json
@@ -515,6 +561,29 @@ func (b *BaseApi) WgetFile(c *gin.Context) {
 	})
 }

+// @Tags File
+// @Summary Stop wget file download
+// @Accept json
+// @Param request body request.FileProcessReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/wget/stop [post]
+// @x-panel-log {"bodyKeys":["key"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"停止下载任务 [key]","formatEN":"Stop wget task [key]"}
+func (b *BaseApi) StopWget(c *gin.Context) {
+	var req request.FileProcessReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if strings.TrimSpace(req.Key) == "" {
+		helper.BadRequest(c, errors.New("key is required"))
+		return
+	}
+
+	files.CancelDownload(req.Key)
+	helper.Success(c)
+}
+
 // @Tags File
 // @Summary Move file
 // @Accept json
@@ -978,3 +1047,281 @@ func (b *BaseApi) ConvertLog(c *gin.Context) {
 		Total: total,
 	})
 }
+
+// @Tags File
+// @Summary Batch get file remarks
+// @Accept json
+// @Param request body request.FileRemarkBatch true "request"
+// @Success 200 {object} response.FileRemarksRes
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/remarks [post]
+func (b *BaseApi) BatchGetFileRemarks(c *gin.Context) {
+	var req request.FileRemarkBatch
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	remarks := fileService.BatchGetRemarks(req)
+	helper.SuccessWithData(c, response.FileRemarksRes{Remarks: remarks})
+}
+
+// @Tags File
+// @Summary Set file remark
+// @Accept json
+// @Param request body request.FileRemarkUpdate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/remark [post]
+func (b *BaseApi) SetFileRemark(c *gin.Context) {
+	var req request.FileRemarkUpdate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := fileService.SetRemark(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags File
+// @Summary List file shares
+// @Accept json
+// @Param request body dto.PageInfo true "request"
+// @Success 200 {object} dto.PageResult
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/share/search [post]
+func (b *BaseApi) SearchFileShare(c *gin.Context) {
+	var req dto.PageInfo
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	total, list, err := fileShareService.Page(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, dto.PageResult{
+		Total: total,
+		Items: list,
+	})
+}
+
+// @Tags File
+// @Summary Get file share detail by path
+// @Accept json
+// @Param request body dto.FilePath true "request"
+// @Success 200 {object} response.FileShareInfo
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/share/detail [post]
+func (b *BaseApi) GetFileShareDetail(c *gin.Context) {
+	var req dto.FilePath
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	info, err := fileShareService.GetByPath(req.Path)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, info)
+}
+
+// @Tags File
+// @Summary Get file share detail by code (no login)
+// @Param code query string true "share code"
+// @Success 200 {object} response.FileSharePublicInfo
+// @Router /files/share/info [get]
+func (b *BaseApi) GetPublicFileShareInfo(c *gin.Context) {
+	code := strings.TrimSpace(c.Query("code"))
+	if code == "" {
+		helper.BadRequest(c, errors.New("code is required"))
+		return
+	}
+	info, err := fileShareService.GetPublicByCode(code)
+	if err != nil {
+		if be, ok := err.(buserr.BusinessError); ok {
+			helper.ErrorWithDetail(c, http.StatusBadRequest, be.Msg, be)
+			return
+		}
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, info)
+}
+
+func buildSharePublicURL(c *gin.Context, code, operateNode string) string {
+	scheme := strings.TrimSpace(c.GetHeader("X-Forwarded-Proto"))
+	if scheme == "" {
+		if c.Request.TLS != nil {
+			scheme = "https"
+		} else {
+			scheme = "http"
+		}
+	}
+	host := strings.TrimSpace(c.GetHeader("X-Forwarded-Host"))
+	if host == "" {
+		host = c.Request.Host
+	}
+	shareURL := url.URL{
+		Scheme: scheme,
+		Host:   host,
+		Path:   "/s/" + url.PathEscape(code),
+	}
+	query := shareURL.Query()
+	if strings.TrimSpace(operateNode) != "" {
+		query.Set("operateNode", operateNode)
+	}
+	shareURL.RawQuery = query.Encode()
+	return shareURL.String()
+}
+
+// @Tags File
+// @Summary Get file share QR code image
+// @Produce png
+// @Param code query string true "share code"
+// @Param operateNode query string false "operate node"
+// @Success 200 {file} file
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/share/qrcode [get]
+func (b *BaseApi) GetFileShareQRCode(c *gin.Context) {
+	code := strings.TrimSpace(c.Query("code"))
+	if code == "" {
+		helper.BadRequest(c, errors.New("code is required"))
+		return
+	}
+	if _, err := fileShareService.GetByCode(code); err != nil {
+		if be, ok := err.(buserr.BusinessError); ok {
+			helper.ErrorWithDetail(c, http.StatusBadRequest, be.Msg, be)
+			return
+		}
+		helper.InternalServer(c, err)
+		return
+	}
+
+	png, err := qrcode.Encode(buildSharePublicURL(c, code, c.Query("operateNode")), qrcode.Medium, 256)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	c.Header("Cache-Control", "private, max-age=300")
+	c.Data(http.StatusOK, "image/png", png)
+}
+
+// @Tags File
+// @Summary Create temporary file share link
+// @Accept json
+// @Param request body request.FileShareCreate true "request"
+// @Success 200 {object} response.FileShareInfo
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/share/create [post]
+// @x-panel-log {"bodyKeys":["path","expireMinutes"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"创建文件分享 [path]","formatEN":"Create file share [path]"}
+func (b *BaseApi) CreateFileShare(c *gin.Context) {
+	var req request.FileShareCreate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	res, err := fileShareService.Create(req)
+	if err != nil {
+		if be, ok := err.(buserr.BusinessError); ok {
+			helper.ErrorWithDetail(c, http.StatusInternalServerError, be.Msg, be.Err)
+			return
+		}
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, res)
+}
+
+// @Tags File
+// @Summary Delete file share by path
+// @Accept json
+// @Param request body dto.FilePath true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/share/del [post]
+// @x-panel-log {"bodyKeys":["path"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"关闭文件分享 [path]","formatEN":"Close file share [path]"}
+func (b *BaseApi) DeleteFileShare(c *gin.Context) {
+	var req dto.FilePath
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := fileShareService.DeleteByPath(req.Path); err != nil {
+		if be, ok := err.(buserr.BusinessError); ok {
+			helper.ErrorWithDetail(c, http.StatusInternalServerError, be.Msg, be.Err)
+			return
+		}
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags File
+// @Summary Check file share code (no login)
+// @Param code query string true "share code"
+// @Param password query string false "optional password"
+// @Success 200 {object} dto.Response
+// @Router /files/share/check [get]
+func (b *BaseApi) CheckFileShare(c *gin.Context) {
+	code := strings.TrimSpace(c.Query("code"))
+	password := c.Query("password")
+	if code == "" {
+		helper.BadRequest(c, errors.New("code is required"))
+		return
+	}
+	if err := fileShareService.Check(code, password); err != nil {
+		if be, ok := err.(buserr.BusinessError); ok {
+			helper.ErrorWithDetail(c, http.StatusBadRequest, be.Msg, be)
+			return
+		}
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags File
+// @Summary Download file by share code (no login)
+// @Produce octet-stream
+// @Param code query string true "share code"
+// @Param password query string false "optional password"
+// @Success 200 {file} file
+// @Router /files/share/download [get]
+func (b *BaseApi) DownloadFileShare(c *gin.Context) {
+	code := strings.TrimSpace(c.Query("code"))
+	password := c.Query("password")
+	if code == "" {
+		helper.BadRequest(c, errors.New("code is required"))
+		return
+	}
+	filePath, displayName, err := fileShareService.PrepareDownload(code, password)
+	if err != nil {
+		if be, ok := err.(buserr.BusinessError); ok {
+			helper.ErrorWithDetail(c, http.StatusBadRequest, be.Msg, be)
+			return
+		}
+		helper.InternalServer(c, err)
+		return
+	}
+	file, err := os.Open(filePath)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	defer file.Close()
+	info, err := file.Stat()
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	c.Header("Content-Length", strconv.FormatInt(info.Size(), 10))
+	c.Header("Content-Disposition", "attachment; filename*=utf-8''"+url.PathEscape(displayName))
+	http.ServeContent(c.Writer, c.Request, displayName, info.ModTime(), file)
+}
@@ -0,0 +1,91 @@
+package v2
+
+import (
+	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
+	"github.com/gin-gonic/gin"
+)
+
+// @Tags File
+// @Summary Load file history list
+// @Accept json
+// @Param request body request.FileHistorySearchReq true "request"
+// @Success 200 {object} response.PageResult
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/history/search [post]
+func (b *BaseApi) SearchFileHistory(c *gin.Context) {
+	var req request.FileHistorySearchReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	total, items, err := fileHistoryService.Search(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, dto.PageResult{Items: items, Total: total})
+}
+
+// @Tags File
+// @Summary Load file history content
+// @Accept json
+// @Param request body request.FileHistoryContentReq true "request"
+// @Success 200 {object} response.FileHistoryInfo
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/history/content [post]
+func (b *BaseApi) GetFileHistoryContent(c *gin.Context) {
+	var req request.FileHistoryContentReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	item, err := fileHistoryService.GetContent(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, item)
+}
+
+// @Tags File
+// @Summary Delete file history record
+// @Accept json
+// @Param request body request.FileHistoryDeleteReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/history/del [post]
+func (b *BaseApi) DeleteFileHistory(c *gin.Context) {
+	var req request.FileHistoryDeleteReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := fileHistoryService.Delete(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags File
+// @Summary Restore file history record
+// @Accept json
+// @Param request body request.FileHistoryRestoreReq true "request"
+// @Success 200 {object} response.FileInfo
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/history/restore [post]
+func (b *BaseApi) RestoreFileHistory(c *gin.Context) {
+	var req request.FileHistoryRestoreReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	info, err := fileHistoryService.Restore(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, info)
+}
@@ -0,0 +1,167 @@
+package v2
+
+import (
+	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/utils/encrypt"
+	"github.com/gin-gonic/gin"
+)
+
+func (b *BaseApi) CreateHost(c *gin.Context) {
+	var req dto.HostOperate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	host, err := hostService.Create(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, host)
+}
+
+func (b *BaseApi) TestByInfo(c *gin.Context) {
+	var req dto.HostConnTest
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	helper.SuccessWithData(c, hostService.TestByInfo(req))
+}
+
+func (b *BaseApi) TestByID(c *gin.Context) {
+	var req dto.OperateByID
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	helper.SuccessWithData(c, hostService.TestLocalConn(req.ID))
+}
+
+func (b *BaseApi) HostTree(c *gin.Context) {
+	var req dto.SearchForTree
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	data, err := hostService.SearchForTree(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+func (b *BaseApi) SearchHost(c *gin.Context) {
+	var req dto.SearchPageWithGroup
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	total, list, err := hostService.SearchWithPage(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+
+	helper.SuccessWithData(c, dto.PageResult{Items: list, Total: total})
+}
+
+func (b *BaseApi) DeleteHost(c *gin.Context) {
+	var req dto.OperateByIDs
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	if err := hostService.Delete(req.IDs); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+func (b *BaseApi) UpdateHost(c *gin.Context) {
+	var req dto.HostOperate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	var err error
+	if len(req.Password) != 0 && req.AuthMode == "password" {
+		req.Password, err = hostService.EncryptHost(req.Password)
+		if err != nil {
+			helper.BadRequest(c, err)
+			return
+		}
+		req.PrivateKey = ""
+		req.PassPhrase = ""
+	}
+	if len(req.PrivateKey) != 0 && req.AuthMode == "key" {
+		req.PrivateKey, err = hostService.EncryptHost(req.PrivateKey)
+		if err != nil {
+			helper.BadRequest(c, err)
+			return
+		}
+		if len(req.PassPhrase) != 0 {
+			req.PassPhrase, err = encrypt.StringEncrypt(req.PassPhrase)
+			if err != nil {
+				helper.BadRequest(c, err)
+				return
+			}
+		}
+		req.Password = ""
+	}
+
+	upMap := map[string]interface{}{
+		"name":              req.Name,
+		"group_id":          req.GroupID,
+		"addr":              req.Addr,
+		"port":              req.Port,
+		"user":              req.User,
+		"auth_mode":         req.AuthMode,
+		"remember_password": req.RememberPassword,
+		"description":       req.Description,
+	}
+	if req.AuthMode == "password" {
+		upMap["password"] = req.Password
+		upMap["private_key"] = ""
+		upMap["pass_phrase"] = ""
+	} else {
+		upMap["password"] = ""
+		upMap["private_key"] = req.PrivateKey
+		upMap["pass_phrase"] = req.PassPhrase
+	}
+	hostItem, err := hostService.Update(req.ID, upMap)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, hostItem)
+}
+
+func (b *BaseApi) UpdateHostGroup(c *gin.Context) {
+	var req dto.ChangeGroup
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	if _, err := hostService.Update(req.ID, map[string]interface{}{"group_id": req.GroupID}); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+func (b *BaseApi) GetHostByID(c *gin.Context) {
+	var req dto.OperateByID
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	info, err := hostService.GetHostByID(req.ID)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, info)
+}
@@ -57,3 +57,18 @@ func (b *BaseApi) GetProcessInfoByPID(c *gin.Context) {
 	}
 	helper.SuccessWithData(c, data)
 }
+
+// @Tags Process
+// @Summary Get Listening Process
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /process/listening [post]
+func (b *BaseApi) GetListeningProcess(c *gin.Context) {
+	procs, err := processService.GetListeningProcess(c)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, procs)
+}
@@ -5,6 +5,7 @@ import (

 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
 	"github.com/1Panel-dev/1Panel/agent/app/model"
 	"github.com/1Panel-dev/1Panel/agent/global"
 	"github.com/1Panel-dev/1Panel/agent/utils/ssh"
@@ -27,6 +28,15 @@ func (b *BaseApi) GetSettingInfo(c *gin.Context) {
 	helper.SuccessWithData(c, setting)
 }

+func (b *BaseApi) GetTerminalAISettingInfo(c *gin.Context) {
+	setting, err := settingService.GetTerminalAIInfo()
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, setting)
+}
+
 // @Tags System Setting
 // @Summary Load system available status
 // @Success 200
@@ -59,6 +69,75 @@ func (b *BaseApi) UpdateSetting(c *gin.Context) {
 	helper.Success(c)
 }

+func (b *BaseApi) UpdateTerminalAISetting(c *gin.Context) {
+	var req dto.TerminalAIInfo
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	if err := settingService.UpdateTerminalAI(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+func (b *BaseApi) GetFileManageAISettingInfo(c *gin.Context) {
+	setting, err := settingService.GetFileManageAIInfo()
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, setting)
+}
+
+func (b *BaseApi) UpdateFileManageAISetting(c *gin.Context) {
+	var req dto.FileManageAIInfo
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := settingService.UpdateFileManageAI(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags System Setting
+// @Summary Load file history setting info
+// @Success 200 {object} response.FileHistorySettingInfo
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /settings/file-history/search [post]
+func (b *BaseApi) GetFileHistorySettingInfo(c *gin.Context) {
+	setting, err := settingService.GetFileHistorySettingInfo()
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, setting)
+}
+
+// @Tags System Setting
+// @Summary Update file history setting
+// @Accept json
+// @Param request body request.FileHistorySettingUpdate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /settings/file-history/update [post]
+func (b *BaseApi) UpdateFileHistorySetting(c *gin.Context) {
+	var req request.FileHistorySettingUpdate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := settingService.UpdateFileHistorySetting(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags System Setting
 // @Summary Load local backup dir
 // @Success 200 {string} path
@@ -80,7 +159,10 @@ func (b *BaseApi) LoadLocalConn(c *gin.Context) {
 }

 func (b *BaseApi) CheckLocalConn(c *gin.Context) {
-	_, err := loadLocalConn()
+	client, err := loadLocalConn()
+	if err == nil && client != nil {
+		client.Close()
+	}
 	helper.SuccessWithData(c, err == nil)
 }

@@ -249,14 +249,14 @@ func (b *BaseApi) LoadSSHFile(c *gin.Context) {
 // @Tags SSH
 // @Summary Update host SSH setting by file
 // @Accept json
-// @Param request body dto.SSHConf true "request"
+// @Param request body dto.SSHConfUpdate true "request"
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /hosts/ssh/file/update [post]
 // @x-panel-log {"bodyKeys":["key"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"修改 SSH 配置文件 [key]","formatEN":"update SSH conf [key]"}
 func (b *BaseApi) UpdateSSHByFile(c *gin.Context) {
-	var req dto.SettingUpdate
+	var req dto.SSHConfUpdate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
@@ -32,7 +32,7 @@ func (b *BaseApi) PageTasks(c *gin.Context) {

 // @Tags TaskLog
 // @Summary Get the number of executing tasks
-// @Success 200 {object} int64
+// @Success 200 {integer} int64
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /logs/tasks/executing/count [get]
@@ -9,8 +9,10 @@ import (
 	"time"

 	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/service"
 	"github.com/1Panel-dev/1Panel/agent/global"
 	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
+	"github.com/1Panel-dev/1Panel/agent/utils/ssh"
 	"github.com/1Panel-dev/1Panel/agent/utils/terminal"
 	"github.com/gin-gonic/gin"
 	"github.com/gorilla/websocket"
@@ -40,9 +42,33 @@ func (b *BaseApi) WsSSH(c *gin.Context) {
 		return
 	}

-	client, err := loadLocalConn()
-	if wshandleError(wsConn, errors.WithMessage(err, "failed to set up the connection. Please check the host information")) {
-		return
+	hostID, _ := strconv.Atoi(c.DefaultQuery("id", "0"))
+	var client *ssh.SSHClient
+	if hostID > 0 {
+		host, err := service.GetHostInfo(uint(hostID))
+		if wshandleError(wsConn, errors.WithMessage(err, "load host info by id failed")) {
+			return
+		}
+		connInfo := ssh.ConnInfo{
+			Addr:       host.Addr,
+			Port:       int(host.Port),
+			User:       host.User,
+			AuthMode:   host.AuthMode,
+			Password:   host.Password,
+			PrivateKey: []byte(host.PrivateKey),
+		}
+		if len(host.PassPhrase) != 0 {
+			connInfo.PassPhrase = []byte(host.PassPhrase)
+		}
+		client, err = ssh.NewClient(connInfo)
+		if wshandleError(wsConn, errors.WithMessage(err, "failed to set up the connection. Please check the host information")) {
+			return
+		}
+	} else {
+		client, err = loadLocalConn()
+		if wshandleError(wsConn, errors.WithMessage(err, "failed to set up the connection. Please check the host information")) {
+			return
+		}
 	}
 	defer client.Close()
 	command := c.DefaultQuery("command", "")
@@ -187,19 +213,29 @@ func loadContainerInitCmd(c *gin.Context) ([]string, error) {
 func loadDatabaseInitCmd(c *gin.Context) ([]string, error) {
 	database := c.Query("database")
 	databaseType := c.Query("databaseType")
-	if len(database) == 0 || len(databaseType) == 0 {
+	if len(databaseType) == 0 {
 		return nil, fmt.Errorf("error param of database: %s or database type: %s", database, databaseType)
 	}
 	databaseConn, err := appInstallService.LoadConnInfo(dto.OperationWithNameAndType{Type: databaseType, Name: database})
 	if err != nil {
 		return nil, fmt.Errorf("no such database in db, err: %v", err)
 	}
+	if len(databaseConn.ContainerName) == 0 {
+		return nil, fmt.Errorf("no such database container for database: %s or database type: %s", database, databaseType)
+	}
 	commands := []string{"exec", "-it", databaseConn.ContainerName}
 	switch databaseType {
 	case "mysql", "mysql-cluster":
 		commands = append(commands, []string{"mysql", "-uroot", "-p" + databaseConn.Password}...)
 	case "mariadb":
 		commands = append(commands, []string{"mariadb", "-uroot", "-p" + databaseConn.Password}...)
+	case "mongodb":
+		commands = append(commands, []string{
+			"mongosh",
+			"--username", databaseConn.Username,
+			"--password", databaseConn.Password,
+			"--authenticationDatabase", "admin",
+		}...)
 	case "postgresql", "postgresql-cluster":
 		commands = []string{"exec", "-e", fmt.Sprintf("PGPASSWORD=%s", databaseConn.Password), "-it", databaseConn.ContainerName, "psql", "-t", "-U", databaseConn.Username}
 	}
@@ -506,7 +506,7 @@ func (b *BaseApi) GetProxyConfig(c *gin.Context) {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /websites/proxies/update [post]
-// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"id","isList":false,"db":"websites","output_column":"primary_domain","output_value":"domain"}],"formatZH":"修改网站 [domain] 反向代理配置 ","formatEN":"Update domain [domain] proxy config"}
+// @x-panel-log {"bodyKeys":["id","name","operate"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"id","isList":false,"db":"websites","output_column":"primary_domain","output_value":"domain"}],"formatZH":"修改 [operate] 网站 [domain] 反向代理配置 [name] ","formatEN":"Update [operate] domain [domain] proxy config [name]"}
 func (b *BaseApi) UpdateProxyConfig(c *gin.Context) {
 	var req request.WebsiteProxyConfig
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -520,6 +520,50 @@ func (b *BaseApi) UpdateProxyConfig(c *gin.Context) {
 	helper.Success(c)
 }

+// @Tags Website
+// @Summary Delete proxy config
+// @Accept json
+// @Param request body request.WebsiteProxyDel true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/proxies/delete [post]
+// @x-panel-log {"bodyKeys":["id","name"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"id","isList":false,"db":"websites","output_column":"primary_domain","output_value":"domain"}],"formatZH":"删除网站 [domain] 反向代理配置 [name] ","formatEN":"Delete domain [domain] proxy config [name]"}
+func (b *BaseApi) DeleteProxyConfig(c *gin.Context) {
+	var req request.WebsiteProxyDel
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	err := websiteService.DeleteProxy(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Website
+// @Summary Update proxy config status
+// @Accept json
+// @Param request body request.WebsiteProxyStatusUpdate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/proxies/status [post]
+// @x-panel-log {"bodyKeys":["id","name","status"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"id","isList":false,"db":"websites","output_column":"primary_domain","output_value":"domain"}],"formatZH":"修改网站 [domain] 反向代理配置 [name] 状态 [status] ","formatEN":"Update domain [domain] proxy config [name] status [status]"}
+func (b *BaseApi) UpdateProxyConfigStatus(c *gin.Context) {
+	var req request.WebsiteProxyStatusUpdate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	err := websiteService.UpdateProxyStatus(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags Website
 // @Summary Update proxy file
 // @Accept json
@@ -528,7 +572,7 @@ func (b *BaseApi) UpdateProxyConfig(c *gin.Context) {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /websites/proxies/file [post]
-// @x-panel-log {"bodyKeys":["websiteID"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"websiteID","isList":false,"db":"websites","output_column":"primary_domain","output_value":"domain"}],"formatZH":"更新反向代理文件 [domain]","formatEN":"Nginx conf proxy file update [domain]"}
+// @x-panel-log {"bodyKeys":["websiteID","name"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"websiteID","isList":false,"db":"websites","output_column":"primary_domain","output_value":"domain"}],"formatZH":"修改网站 [domain] 反向代理配置文件 [name] ","formatEN":"Update domain [domain] proxy config file [name]"}
 func (b *BaseApi) UpdateProxyConfigFile(c *gin.Context) {
 	var req request.NginxProxyUpdate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -5,7 +5,6 @@ import (
 	"mime/multipart"
 	"net/http"
 	"net/url"
-	"reflect"
 	"strconv"

 	"github.com/1Panel-dev/1Panel/agent/app/model"
@@ -26,27 +25,39 @@ import (
 // @Router /websites/ssl/search [post]
 func (b *BaseApi) PageWebsiteSSL(c *gin.Context) {
 	var req request.WebsiteSSLSearch
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	total, accounts, err := websiteSSLService.Page(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithDataGzipped(c, dto.PageResult{
+		Total: total,
+		Items: accounts,
+	})
+}
+
+// @Tags Website SSL
+// @Summary List website ssl
+// @Accept json
+// @Param request body request.WebsiteSSLListReq true "request"
+// @Success 200 {array} response.WebsiteSSLDTO
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/ssl/list [post]
+func (b *BaseApi) ListWebsiteSSL(c *gin.Context) {
+	var req request.WebsiteSSLListReq
 	if err := helper.CheckBind(&req, c); err != nil {
 		return
 	}
-	if !reflect.DeepEqual(req.PageInfo, dto.PageInfo{}) {
-		total, accounts, err := websiteSSLService.Page(req)
-		if err != nil {
-			helper.InternalServer(c, err)
-			return
-		}
-		helper.SuccessWithDataGzipped(c, dto.PageResult{
-			Total: total,
-			Items: accounts,
-		})
-	} else {
-		list, err := websiteSSLService.Search(req)
-		if err != nil {
-			helper.InternalServer(c, err)
-			return
-		}
-		helper.SuccessWithDataGzipped(c, list)
+	list, err := websiteSSLService.Search(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
 	}
+	helper.SuccessWithDataGzipped(c, list)
 }

 // @Tags Website SSL
@@ -0,0 +1,652 @@
+package dto
+
+import "time"
+
+type AgentCreateReq struct {
+	Name           string   `json:"name" validate:"required"`
+	Remark         string   `json:"remark"`
+	AppVersion     string   `json:"appVersion" validate:"required"`
+	WebUIPort      int      `json:"webUIPort" validate:"required,min=1,max=65535"`
+	BridgePort     int      `json:"bridgePort"`
+	AllowedOrigins []string `json:"allowedOrigins"`
+	AgentType      string   `json:"agentType" validate:"required,oneof=openclaw copaw hermes-agent"`
+	Model          string   `json:"model"`
+	AccountID      uint     `json:"accountId"`
+	Token          string   `json:"token"`
+	TaskID         string   `json:"taskID"`
+	Advanced       bool     `json:"advanced"`
+	ContainerName  string   `json:"containerName"`
+	AllowPort      bool     `json:"allowPort"`
+	SpecifyIP      string   `json:"specifyIP"`
+	RestartPolicy  string   `json:"restartPolicy"`
+	CpuQuota       float64  `json:"cpuQuota"`
+	MemoryLimit    float64  `json:"memoryLimit"`
+	MemoryUnit     string   `json:"memoryUnit"`
+	PullImage      bool     `json:"pullImage"`
+	EditCompose    bool     `json:"editCompose"`
+	DockerCompose  string   `json:"dockerCompose"`
+}
+
+type AgentItem struct {
+	ID                   uint      `json:"id"`
+	Name                 string    `json:"name"`
+	Remark               string    `json:"remark"`
+	AgentType            string    `json:"agentType"`
+	Provider             string    `json:"provider"`
+	ProviderName         string    `json:"providerName"`
+	Model                string    `json:"model"`
+	APIType              string    `json:"apiType"`
+	MaxTokens            int       `json:"maxTokens"`
+	ContextWindow        int       `json:"contextWindow"`
+	BaseURL              string    `json:"baseUrl"`
+	APIKey               string    `json:"apiKey"`
+	Token                string    `json:"token"`
+	Status               string    `json:"status"`
+	Message              string    `json:"message"`
+	AppInstallID         uint      `json:"appInstallId"`
+	WebsiteID            uint      `json:"websiteId"`
+	WebsitePrimaryDomain string    `json:"websitePrimaryDomain"`
+	WebsiteType          string    `json:"websiteType"`
+	WebsiteProtocol      string    `json:"websiteProtocol"`
+	AccountID            uint      `json:"accountId"`
+	AppVersion           string    `json:"appVersion"`
+	Container            string    `json:"containerName"`
+	WebUIPort            int       `json:"webUIPort"`
+	BridgePort           int       `json:"bridgePort"`
+	Path                 string    `json:"path"`
+	ConfigPath           string    `json:"configPath"`
+	Upgradable           bool      `json:"upgradable"`
+	CreatedAt            time.Time `json:"createdAt"`
+}
+
+type AgentDeleteReq struct {
+	ID          uint   `json:"id" validate:"required"`
+	TaskID      string `json:"taskID"`
+	ForceDelete bool   `json:"forceDelete"`
+}
+
+type AgentTokenResetReq struct {
+	ID uint `json:"id" validate:"required"`
+}
+
+type AgentRemarkUpdateReq struct {
+	ID     uint   `json:"id" validate:"required"`
+	Remark string `json:"remark"`
+}
+
+type AgentWebsiteBindReq struct {
+	AgentID   uint `json:"agentId" validate:"required"`
+	WebsiteID uint `json:"websiteId" validate:"required"`
+}
+
+type AgentModelConfigUpdateReq struct {
+	AgentID   uint     `json:"agentId" validate:"required"`
+	AccountID uint     `json:"accountId" validate:"required"`
+	Model     string   `json:"model" validate:"required"`
+	Fallbacks []string `json:"fallbacks"`
+}
+
+type AgentModelConfig struct {
+	AccountID uint     `json:"accountId"`
+	Model     string   `json:"model"`
+	Fallbacks []string `json:"fallbacks"`
+}
+
+type AgentHermesChatSessionItem struct {
+	ID           string `json:"id"`
+	Title        string `json:"title"`
+	Model        string `json:"model"`
+	MessageCount int64  `json:"messageCount"`
+	StartedAt    string `json:"startedAt"`
+	LastActive   string `json:"lastActive"`
+}
+
+type AgentOverviewReq struct {
+	AgentID uint `json:"agentId" validate:"required"`
+}
+
+type AgentIDReq struct {
+	AgentID uint `json:"agentId" validate:"required"`
+}
+
+type AgentHermesChatSessionRenameReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	ID      string `json:"id" validate:"required"`
+	Title   string `json:"title" validate:"required"`
+}
+
+type AgentHermesChatSessionDeleteReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	ID      string `json:"id" validate:"required"`
+}
+
+type AgentOverview struct {
+	Snapshot AgentOverviewSnapshot `json:"snapshot"`
+}
+
+type AgentRoleBinding struct {
+	Channel   string `json:"channel" validate:"required"`
+	AccountID string `json:"accountId"`
+}
+
+type AgentRoleCreateReq struct {
+	AgentID  uint               `json:"agentId" validate:"required"`
+	Name     string             `json:"name" validate:"required"`
+	Model    string             `json:"model"`
+	Bindings []AgentRoleBinding `json:"bindings"`
+}
+
+type AgentRoleCreateResp struct {
+	Output string `json:"output"`
+}
+
+type AgentRoleDeleteReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	ID      string `json:"id" validate:"required"`
+}
+
+type AgentRoleBindReq struct {
+	AgentID   uint   `json:"agentId" validate:"required"`
+	ID        string `json:"id" validate:"required"`
+	Channel   string `json:"channel" validate:"required"`
+	AccountID string `json:"accountId"`
+}
+
+type AgentConfiguredAgentsReq struct {
+	AgentID uint `json:"agentId" validate:"required"`
+}
+
+type AgentRoleChannelsReq struct {
+	AgentID uint `json:"agentId" validate:"required"`
+}
+
+type AgentRoleChannelItem struct {
+	Name       string   `json:"name"`
+	Bound      bool     `json:"bound"`
+	AccountIDs []string `json:"accountIds"`
+}
+
+type AgentRoleMarkdownFilesReq struct {
+	AgentID   uint   `json:"agentId" validate:"required"`
+	Workspace string `json:"workspace" validate:"required"`
+}
+
+type AgentConfiguredAgentItem struct {
+	ID        string             `json:"id"`
+	Name      string             `json:"name"`
+	Workspace string             `json:"workspace"`
+	Model     string             `json:"model"`
+	AgentDir  string             `json:"agentDir"`
+	Bindings  []AgentRoleBinding `json:"bindings"`
+}
+
+type AgentRoleMarkdownFileItem struct {
+	Name    string `json:"name"`
+	Content string `json:"content"`
+}
+
+type AgentRoleMarkdownFileUpdateItem struct {
+	Name    string `json:"name" validate:"required,oneof=AGENTS.md SOUL.md USER.md IDENTITY.md TOOLS.md HEARTBEAT.md BOOT.md BOOTSTRAP.md"`
+	Content string `json:"content"`
+}
+
+type AgentRoleMarkdownFilesUpdateReq struct {
+	AgentID   uint                              `json:"agentId" validate:"required"`
+	Workspace string                            `json:"workspace" validate:"required"`
+	Restart   bool                              `json:"restart"`
+	Files     []AgentRoleMarkdownFileUpdateItem `json:"files" validate:"required"`
+}
+
+type AgentOverviewSnapshot struct {
+	ContainerStatus string `json:"containerStatus"`
+	AppVersion      string `json:"appVersion"`
+	DefaultModel    string `json:"defaultModel"`
+	ChannelCount    int    `json:"channelCount"`
+	SkillCount      int    `json:"skillCount"`
+	JobCount        int    `json:"jobCount"`
+	SessionCount    int    `json:"sessionCount"`
+}
+
+type AgentAccountModel struct {
+	RecordID      uint     `json:"recordId"`
+	ID            string   `json:"id"`
+	Name          string   `json:"name"`
+	ContextWindow int      `json:"contextWindow"`
+	MaxTokens     int      `json:"maxTokens"`
+	Reasoning     bool     `json:"reasoning"`
+	Input         []string `json:"input"`
+}
+
+type AgentAccountModelReq struct {
+	AccountID uint `json:"accountId" validate:"required"`
+}
+
+type AgentAccountModelCreateReq struct {
+	AccountID uint              `json:"accountId" validate:"required"`
+	Model     AgentAccountModel `json:"model" validate:"required"`
+}
+
+type AgentAccountModelUpdateReq struct {
+	AccountID uint              `json:"accountId" validate:"required"`
+	Model     AgentAccountModel `json:"model" validate:"required"`
+}
+
+type AgentAccountModelDeleteReq struct {
+	AccountID uint `json:"accountId" validate:"required"`
+	RecordID  uint `json:"recordId" validate:"required"`
+}
+
+type AgentAccountCreateReq struct {
+	Provider       string              `json:"provider" validate:"required"`
+	Name           string              `json:"name" validate:"required"`
+	APIKey         string              `json:"apiKey" validate:"required"`
+	RememberAPIKey bool                `json:"rememberApiKey"`
+	BaseURL        string              `json:"baseURL"`
+	Models         []AgentAccountModel `json:"models"`
+	APIType        string              `json:"apiType" validate:"required"`
+	Remark         string              `json:"remark"`
+}
+
+type AgentAccountUpdateReq struct {
+	ID             uint   `json:"id" validate:"required"`
+	Name           string `json:"name" validate:"required"`
+	APIKey         string `json:"apiKey" validate:"required"`
+	RememberAPIKey bool   `json:"rememberApiKey"`
+	BaseURL        string `json:"baseURL"`
+	APIType        string `json:"apiType" validate:"required"`
+	Remark         string `json:"remark"`
+	SyncAgents     bool   `json:"syncAgents"`
+}
+
+type AgentAccountVerifyReq struct {
+	Provider string `json:"provider" validate:"required"`
+	APIKey   string `json:"apiKey" validate:"required"`
+	BaseURL  string `json:"baseURL"`
+}
+
+type AgentAccountDeleteReq struct {
+	ID uint `json:"id" validate:"required"`
+}
+
+type AgentAccountSearch struct {
+	PageInfo
+	Provider string `json:"provider"`
+	Name     string `json:"name"`
+}
+
+type AgentAccountInfo struct {
+	ID             uint                `json:"id"`
+	Provider       string              `json:"provider"`
+	ProviderName   string              `json:"providerName"`
+	Name           string              `json:"name"`
+	APIKey         string              `json:"apiKey"`
+	RememberAPIKey bool                `json:"rememberApiKey"`
+	BaseURL        string              `json:"baseUrl"`
+	Models         []AgentAccountModel `json:"models"`
+	APIType        string              `json:"apiType"`
+	Verified       bool                `json:"verified"`
+	Remark         string              `json:"remark"`
+	CreatedAt      time.Time           `json:"createdAt"`
+}
+
+type ProviderModelInfo struct {
+	ID            string   `json:"id"`
+	Name          string   `json:"name"`
+	ContextWindow int      `json:"contextWindow"`
+	MaxTokens     int      `json:"maxTokens"`
+	Reasoning     bool     `json:"reasoning"`
+	Input         []string `json:"input"`
+}
+
+type ProviderInfo struct {
+	Sort        uint                `json:"-"`
+	Provider    string              `json:"provider"`
+	DisplayName string              `json:"displayName"`
+	BaseURL     string              `json:"baseUrl"`
+	Models      []ProviderModelInfo `json:"models"`
+}
+
+type AgentFeishuConfigReq struct {
+	AgentID uint `json:"agentId" validate:"required"`
+}
+
+type AgentFeishuConfigUpdateReq struct {
+	AgentID        uint             `json:"agentId" validate:"required"`
+	Enabled        bool             `json:"enabled"`
+	ThreadSession  bool             `json:"threadSession"`
+	ReplyMode      string           `json:"replyMode" validate:"required"`
+	Streaming      bool             `json:"streaming"`
+	RequireMention string           `json:"requireMention" validate:"required,oneof=true false open"`
+	GroupPolicy    string           `json:"groupPolicy" validate:"required,oneof=open allowlist disabled"`
+	GroupAllowFrom []string         `json:"groupAllowFrom"`
+	Domain         string           `json:"domain"`
+	ConnectionMode string           `json:"connectionMode"`
+	Bots           []AgentFeishuBot `json:"bots" validate:"required,min=1"`
+}
+
+type AgentFeishuPairingApproveReq struct {
+	AgentID     uint   `json:"agentId" validate:"required"`
+	PairingCode string `json:"pairingCode" validate:"required"`
+}
+
+type AgentFeishuConfig struct {
+	Enabled        bool             `json:"enabled"`
+	ThreadSession  bool             `json:"threadSession"`
+	ReplyMode      string           `json:"replyMode"`
+	Streaming      bool             `json:"streaming"`
+	RequireMention string           `json:"requireMention"`
+	GroupPolicy    string           `json:"groupPolicy"`
+	GroupAllowFrom []string         `json:"groupAllowFrom"`
+	Domain         string           `json:"domain"`
+	ConnectionMode string           `json:"connectionMode"`
+	Bots           []AgentFeishuBot `json:"bots"`
+	Installed      bool             `json:"installed"`
+}
+
+type AgentTelegramConfigReq struct {
+	AgentID uint `json:"agentId" validate:"required"`
+}
+
+type AgentTelegramConfigUpdateReq struct {
+	AgentID        uint               `json:"agentId" validate:"required"`
+	Enabled        bool               `json:"enabled"`
+	DmPolicy       string             `json:"dmPolicy" validate:"required,oneof=pairing open allowlist disabled"`
+	AllowFrom      []string           `json:"allowFrom"`
+	RequireMention bool               `json:"requireMention"`
+	GroupPolicy    string             `json:"groupPolicy" validate:"required,oneof=open allowlist disabled"`
+	GroupAllowFrom []string           `json:"groupAllowFrom"`
+	Proxy          string             `json:"proxy"`
+	Streaming      string             `json:"streaming" validate:"required,oneof=off partial block progress"`
+	DefaultAccount string             `json:"defaultAccount" validate:"required"`
+	Bots           []AgentTelegramBot `json:"bots" validate:"required,min=1"`
+}
+
+type AgentTelegramConfig struct {
+	Enabled        bool               `json:"enabled"`
+	DmPolicy       string             `json:"dmPolicy"`
+	AllowFrom      []string           `json:"allowFrom"`
+	RequireMention bool               `json:"requireMention"`
+	GroupPolicy    string             `json:"groupPolicy"`
+	GroupAllowFrom []string           `json:"groupAllowFrom"`
+	Proxy          string             `json:"proxy"`
+	Streaming      string             `json:"streaming"`
+	DefaultAccount string             `json:"defaultAccount"`
+	Bots           []AgentTelegramBot `json:"bots"`
+}
+
+type AgentChannelPairingApproveReq struct {
+	AgentID     uint   `json:"agentId" validate:"required"`
+	Type        string `json:"type" validate:"required,oneof=feishu telegram discord wecom qqbot dingtalk"`
+	PairingCode string `json:"pairingCode" validate:"required"`
+	AccountID   string `json:"accountId"`
+}
+
+type AgentChannelDeleteReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	Type    string `json:"type" validate:"required,oneof=feishu telegram discord wecom qqbot dingtalk weixin"`
+}
+
+type AgentWecomConfigUpdateReq struct {
+	AgentID        uint     `json:"agentId" validate:"required"`
+	Enabled        bool     `json:"enabled"`
+	DmPolicy       string   `json:"dmPolicy" validate:"required,oneof=pairing open allowlist disabled"`
+	AllowFrom      []string `json:"allowFrom"`
+	GroupPolicy    string   `json:"groupPolicy" validate:"required,oneof=open allowlist disabled"`
+	GroupAllowFrom []string `json:"groupAllowFrom"`
+	BotID          string   `json:"botId" validate:"required"`
+	Secret         string   `json:"secret" validate:"required"`
+}
+
+type AgentWecomConfig struct {
+	Enabled        bool     `json:"enabled"`
+	DmPolicy       string   `json:"dmPolicy"`
+	AllowFrom      []string `json:"allowFrom"`
+	GroupPolicy    string   `json:"groupPolicy"`
+	GroupAllowFrom []string `json:"groupAllowFrom"`
+	BotID          string   `json:"botId"`
+	Secret         string   `json:"secret"`
+	Installed      bool     `json:"installed"`
+}
+
+type AgentDingTalkConfigUpdateReq struct {
+	AgentID                         uint               `json:"agentId" validate:"required"`
+	Enabled                         bool               `json:"enabled"`
+	DmPolicy                        string             `json:"dmPolicy" validate:"required,oneof=pairing allowlist open disabled"`
+	AllowFrom                       []string           `json:"allowFrom"`
+	GroupPolicy                     string             `json:"groupPolicy" validate:"required,oneof=open allowlist disabled"`
+	GroupAllowFrom                  []string           `json:"groupAllowFrom"`
+	SeparateSessionByConversation   bool               `json:"separateSessionByConversation"`
+	GroupSessionScope               string             `json:"groupSessionScope" validate:"required,oneof=group group_sender"`
+	SharedMemoryAcrossConversations bool               `json:"sharedMemoryAcrossConversations"`
+	AsyncMode                       bool               `json:"asyncMode"`
+	AckText                         string             `json:"ackText"`
+	Bots                            []AgentDingTalkBot `json:"bots" validate:"required,min=1"`
+}
+
+type AgentDingTalkConfig struct {
+	Enabled                         bool               `json:"enabled"`
+	DmPolicy                        string             `json:"dmPolicy"`
+	AllowFrom                       []string           `json:"allowFrom"`
+	GroupPolicy                     string             `json:"groupPolicy"`
+	GroupAllowFrom                  []string           `json:"groupAllowFrom"`
+	SeparateSessionByConversation   bool               `json:"separateSessionByConversation"`
+	GroupSessionScope               string             `json:"groupSessionScope"`
+	SharedMemoryAcrossConversations bool               `json:"sharedMemoryAcrossConversations"`
+	AsyncMode                       bool               `json:"asyncMode"`
+	AckText                         string             `json:"ackText"`
+	Bots                            []AgentDingTalkBot `json:"bots"`
+	Installed                       bool               `json:"installed"`
+}
+
+type AgentWeixinLoginReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	TaskID  string `json:"taskID" validate:"required"`
+}
+
+type AgentWeixinConfig struct {
+	Enabled bool `json:"enabled"`
+}
+
+type AgentQQBotConfigUpdateReq struct {
+	AgentID        uint            `json:"agentId" validate:"required"`
+	Enabled        bool            `json:"enabled"`
+	DmPolicy       string          `json:"dmPolicy"`
+	AllowFrom      []string        `json:"allowFrom"`
+	GroupPolicy    string          `json:"groupPolicy"`
+	GroupAllowFrom []string        `json:"groupAllowFrom"`
+	Bots           []AgentQQBotBot `json:"bots" validate:"required,min=1"`
+}
+
+type AgentQQBotConfig struct {
+	Enabled        bool            `json:"enabled"`
+	DmPolicy       string          `json:"dmPolicy"`
+	AllowFrom      []string        `json:"allowFrom"`
+	GroupPolicy    string          `json:"groupPolicy"`
+	GroupAllowFrom []string        `json:"groupAllowFrom"`
+	Bots           []AgentQQBotBot `json:"bots"`
+	Installed      bool            `json:"installed"`
+}
+
+type AgentPluginInstallReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	Type    string `json:"type" validate:"required,oneof=feishu qqbot wecom dingtalk weixin"`
+	TaskID  string `json:"taskID" validate:"required"`
+}
+
+type AgentPluginUpgradeReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	Type    string `json:"type" validate:"required,oneof=feishu qqbot wecom dingtalk weixin"`
+	TaskID  string `json:"taskID" validate:"required"`
+}
+
+type AgentPluginUninstallReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	Type    string `json:"type" validate:"required,oneof=feishu qqbot wecom dingtalk weixin"`
+	TaskID  string `json:"taskID" validate:"required"`
+}
+
+type AgentPluginCheckReq struct {
+	AgentID     uint   `json:"agentId" validate:"required"`
+	Type        string `json:"type" validate:"required,oneof=feishu qqbot wecom dingtalk weixin"`
+	CheckLatest bool   `json:"checkLatest"`
+}
+
+type AgentPluginStatus struct {
+	Installed      bool   `json:"installed"`
+	CurrentVersion string `json:"currentVersion"`
+	LatestVersion  string `json:"latestVersion"`
+	Upgradable     bool   `json:"upgradable"`
+}
+
+type AgentDiscordConfigUpdateReq struct {
+	AgentID        uint              `json:"agentId" validate:"required"`
+	Enabled        bool              `json:"enabled"`
+	DmPolicy       string            `json:"dmPolicy" validate:"required"`
+	AllowFrom      []string          `json:"allowFrom"`
+	RequireMention bool              `json:"requireMention"`
+	GroupPolicy    string            `json:"groupPolicy" validate:"required,oneof=open allowlist disabled"`
+	Proxy          string            `json:"proxy"`
+	DefaultAccount string            `json:"defaultAccount" validate:"required"`
+	Bots           []AgentDiscordBot `json:"bots" validate:"required,min=1"`
+}
+
+type AgentDiscordConfig struct {
+	Enabled        bool              `json:"enabled"`
+	DmPolicy       string            `json:"dmPolicy"`
+	AllowFrom      []string          `json:"allowFrom"`
+	RequireMention bool              `json:"requireMention"`
+	GroupPolicy    string            `json:"groupPolicy"`
+	Proxy          string            `json:"proxy"`
+	DefaultAccount string            `json:"defaultAccount"`
+	Bots           []AgentDiscordBot `json:"bots"`
+}
+
+type AgentChannelBotBase struct {
+	AccountID string `json:"accountId"`
+	Name      string `json:"name"`
+	Enabled   bool   `json:"enabled"`
+	IsDefault bool   `json:"isDefault"`
+}
+
+func (b AgentChannelBotBase) IsEnabled() bool {
+	return b.Enabled
+}
+
+type AgentFeishuBot struct {
+	AgentChannelBotBase
+	AppID     string   `json:"appId"`
+	AppSecret string   `json:"appSecret"`
+	DmPolicy  string   `json:"dmPolicy"`
+	AllowFrom []string `json:"allowFrom"`
+}
+
+type AgentTelegramBot struct {
+	AgentChannelBotBase
+	BotToken    string `json:"botToken"`
+	DmPolicy    string `json:"dmPolicy"`
+	GroupPolicy string `json:"groupPolicy"`
+	Streaming   string `json:"streaming"`
+}
+
+type AgentDiscordBot struct {
+	AgentChannelBotBase
+	Token string `json:"token"`
+}
+
+type AgentQQBotBot struct {
+	AgentChannelBotBase
+	AppID        string   `json:"appId"`
+	ClientSecret string   `json:"clientSecret"`
+	AllowFrom    []string `json:"allowFrom"`
+	SystemPrompt string   `json:"systemPrompt"`
+}
+
+type AgentDingTalkBot struct {
+	AgentChannelBotBase
+	ClientID     string `json:"clientId"`
+	ClientSecret string `json:"clientSecret"`
+}
+
+type AgentSecurityConfigUpdateReq struct {
+	AgentID        uint     `json:"agentId" validate:"required"`
+	AllowedOrigins []string `json:"allowedOrigins"`
+}
+
+type AgentSecurityConfig struct {
+	AllowedOrigins []string `json:"allowedOrigins"`
+}
+
+type AgentOtherConfigUpdateReq struct {
+	AgentID        uint   `json:"agentId" validate:"required"`
+	UserTimezone   string `json:"userTimezone" validate:"required"`
+	BrowserEnabled bool   `json:"browserEnabled"`
+	NPMRegistry    string `json:"npmRegistry" validate:"required"`
+}
+
+type AgentOtherConfig struct {
+	UserTimezone   string `json:"userTimezone"`
+	BrowserEnabled bool   `json:"browserEnabled"`
+	NPMRegistry    string `json:"npmRegistry"`
+}
+
+type AgentConfigFileReq struct {
+	AgentID uint `json:"agentId" validate:"required"`
+}
+
+type AgentConfigFileUpdateReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	Content string `json:"content" validate:"required"`
+}
+
+type AgentConfigFile struct {
+	Content string `json:"content"`
+}
+
+type AgentSkillSearchReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	Source  string `json:"source" validate:"required,oneof=clawhub-global clawhub-cn skillhub official skills-sh"`
+	Keyword string `json:"keyword" validate:"required"`
+}
+
+type AgentSkillItem struct {
+	Name          string   `json:"name"`
+	Description   string   `json:"description"`
+	Category      string   `json:"category"`
+	Tags          []string `json:"tags"`
+	Source        string   `json:"source"`
+	Trust         string   `json:"trust"`
+	Identifier    string   `json:"identifier"`
+	Bundled       bool     `json:"bundled"`
+	Disabled      bool     `json:"disabled"`
+	Uninstallable bool     `json:"uninstallable"`
+}
+
+type AgentSkillSearchItem struct {
+	Slug        string `json:"slug"`
+	Identifier  string `json:"identifier"`
+	Name        string `json:"name"`
+	Description string `json:"description"`
+	Summary     string `json:"summary"`
+	Version     string `json:"version"`
+	Source      string `json:"source"`
+	Trust       string `json:"trust"`
+	Score       string `json:"score"`
+}
+
+type AgentSkillUpdateReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	Name    string `json:"name" validate:"required"`
+	Enabled bool   `json:"enabled"`
+}
+
+type AgentSkillInstallReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	Source  string `json:"source" validate:"required,oneof=clawhub-global clawhub-cn skillhub official skills-sh"`
+	Slug    string `json:"slug" validate:"required"`
+	TaskID  string `json:"taskID" validate:"required"`
+}
+
+type AgentSkillUninstallReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	Name    string `json:"name" validate:"required"`
+}
@@ -330,3 +330,13 @@ type AlertEmailConfig struct {
 	Encryption  string `json:"encryption"` // "ssl" / "tls" / "none"
 	Recipient   string `json:"recipient"`
 }
+
+type AgentInfo struct {
+	NodeName string `json:"nodeName"`
+	NodeAddr string `json:"nodeAddr"`
+}
+
+type AlertWebhookConfig struct {
+	DisplayName string `json:"displayName"`
+	Url         string `json:"url"`
+}
@@ -84,25 +84,26 @@ type ExtraProperties struct {
 }

 type AppProperty struct {
-	Name               string   `json:"name"`
-	Type               string   `json:"type"`
-	Tags               []string `json:"tags"`
-	ShortDescZh        string   `json:"shortDescZh" yaml:"shortDescZh"`
-	ShortDescEn        string   `json:"shortDescEn" yaml:"shortDescEn"`
-	Description        Locale   `json:"description"`
-	Key                string   `json:"key"`
-	Required           []string `json:"Required"`
-	CrossVersionUpdate bool     `json:"crossVersionUpdate" yaml:"crossVersionUpdate"`
-	Limit              int      `json:"limit" yaml:"limit"`
-	Recommend          int      `json:"recommend" yaml:"recommend"`
-	Website            string   `json:"website"`
-	Github             string   `json:"github"`
-	Document           string   `json:"document"`
-	Architectures      []string `json:"architectures"`
-	MemoryRequired     int      `json:"memoryRequired" yaml:"memoryRequired"`
-	GpuSupport         bool     `json:"gpuSupport" yaml:"gpuSupport"`
-	Version            float64  `json:"version"`
-	Deprecated         float64  `json:"deprecated"`
+	Name                string   `json:"name"`
+	Type                string   `json:"type"`
+	Tags                []string `json:"tags"`
+	ShortDescZh         string   `json:"shortDescZh" yaml:"shortDescZh"`
+	ShortDescEn         string   `json:"shortDescEn" yaml:"shortDescEn"`
+	Description         Locale   `json:"description"`
+	Key                 string   `json:"key"`
+	Required            []string `json:"Required"`
+	CrossVersionUpdate  bool     `json:"crossVersionUpdate" yaml:"crossVersionUpdate"`
+	Limit               int      `json:"limit" yaml:"limit"`
+	Recommend           int      `json:"recommend" yaml:"recommend"`
+	Website             string   `json:"website"`
+	Github              string   `json:"github"`
+	Document            string   `json:"document"`
+	Architectures       []string `json:"architectures"`
+	MemoryRequired      int      `json:"memoryRequired" yaml:"memoryRequired"`
+	GpuSupport          bool     `json:"gpuSupport" yaml:"gpuSupport"`
+	Version             float64  `json:"version"`
+	Deprecated          float64  `json:"deprecated"`
+	BatchInstallSupport bool     `json:"batchInstallSupport"`
 }

 type AppConfigVersion struct {
@@ -65,25 +65,28 @@ type UploadForRecover struct {
 }

 type CommonBackup struct {
-	Type       string `json:"type" validate:"required,oneof=app mysql mariadb redis website postgresql mysql-cluster postgresql-cluster redis-cluster"`
-	Name       string `json:"name"`
-	DetailName string `json:"detailName"`
-	Secret     string `json:"secret"`
-	TaskID     string `json:"taskID"`
-	FileName   string `json:"fileName"`
+	Type       string   `json:"type" validate:"required,oneof=app mysql mariadb redis website postgresql mongodb mysql-cluster postgresql-cluster redis-cluster container compose"`
+	Name       string   `json:"name"`
+	DetailName string   `json:"detailName"`
+	Secret     string   `json:"secret"`
+	StopBefore bool     `json:"stopBefore"`
+	TaskID     string   `json:"taskID"`
+	FileName   string   `json:"fileName"`
+	Args       []string `json:"args"`

 	Description string `json:"description"`
 }
 type CommonRecover struct {
-	DownloadAccountID uint   `json:"downloadAccountID" validate:"required"`
-	Type              string `json:"type" validate:"required,oneof=app mysql mariadb redis website postgresql mysql-cluster postgresql-cluster redis-cluster"`
-	Name              string `json:"name"`
-	DetailName        string `json:"detailName"`
-	File              string `json:"file"`
-	Secret            string `json:"secret"`
-	TaskID            string `json:"taskID"`
-	BackupRecordID    uint   `json:"backupRecordID"`
-	Timeout           int    `json:"timeout"`
+	DownloadAccountID  uint   `json:"downloadAccountID" validate:"required"`
+	Type               string `json:"type" validate:"required,oneof=app mysql mariadb redis website postgresql mongodb mysql-cluster postgresql-cluster redis-cluster container compose"`
+	Name               string `json:"name"`
+	DetailName         string `json:"detailName"`
+	File               string `json:"file"`
+	Secret             string `json:"secret"`
+	DropAllCollections bool   `json:"dropAllCollections"`
+	TaskID             string `json:"taskID"`
+	BackupRecordID     uint   `json:"backupRecordID"`
+	Timeout            int    `json:"timeout"`
 }

 type RecordSearch struct {
@@ -11,6 +11,12 @@ type SearchPageWithType struct {
 	Type string `json:"type"`
 }

+type SearchPageWithGroup struct {
+	PageInfo
+	GroupID uint   `json:"groupID"`
+	Info    string `json:"info"`
+}
+
 type PageInfo struct {
 	Page     int `json:"page" validate:"required,number"`
 	PageSize int `json:"pageSize" validate:"required,number"`
@@ -48,6 +48,34 @@ type ContainerOptions struct {
 	State string `json:"state"`
 }

+type ContainerFileReq struct {
+	ContainerID string `json:"containerID" validate:"required"`
+	Path        string `json:"path" validate:"required"`
+}
+
+type ContainerFileBatchDeleteReq struct {
+	ContainerID string   `json:"containerID" validate:"required"`
+	Paths       []string `json:"paths" validate:"required,min=1,dive,required"`
+}
+
+type ContainerFileInfo struct {
+	Name    string `json:"name"`
+	Path    string `json:"path"`
+	IsDir   bool   `json:"isDir"`
+	IsLink  bool   `json:"isLink"`
+	LinkTo  string `json:"linkTo"`
+	Size    int64  `json:"size"`
+	Mode    string `json:"mode"`
+	ModTime string `json:"modTime"`
+}
+
+type ContainerFileContent struct {
+	Content   string `json:"content"`
+	Size      int64  `json:"size"`
+	Truncated bool   `json:"truncated"`
+	IsBinary  bool   `json:"isBinary"`
+}
+
 type ContainerStatus struct {
 	Created    int `json:"created"`
 	Running    int `json:"running"`
@@ -95,10 +123,16 @@ type ContainerOperate struct {
 	Privileged      bool           `json:"privileged"`
 	AutoRemove      bool           `json:"autoRemove"`
 	Volumes         []VolumeHelper `json:"volumes"`
+	ExtraHosts      []ExtraHost    `json:"extraHosts"`
 	Labels          []string       `json:"labels"`
 	Env             []string       `json:"env"`
 	RestartPolicy   string         `json:"restartPolicy"`
 }
+
+type ExtraHost struct {
+	Hostname string `json:"hostname"`
+	IP       string `json:"ip"`
+}
 type ContainerNetwork struct {
 	Network string `json:"network"`
 	Ipv4    string `json:"ipv4"`
@@ -253,16 +287,17 @@ type BatchDelete struct {
 }

 type ComposeInfo struct {
-	Name           string             `json:"name"`
-	CreatedAt      string             `json:"createdAt"`
-	CreatedBy      string             `json:"createdBy"`
-	ContainerCount int                `json:"containerCount"`
-	RunningCount   int                `json:"runningCount"`
-	ConfigFile     string             `json:"configFile"`
-	Workdir        string             `json:"workdir"`
-	Path           string             `json:"path"`
-	Containers     []ComposeContainer `json:"containers"`
-	Env            string             `json:"env"`
+	Name              string             `json:"name"`
+	CreatedAt         string             `json:"createdAt"`
+	CreatedBy         string             `json:"createdBy"`
+	ContainerCount    int                `json:"containerCount"`
+	RunningCount      int                `json:"runningCount"`
+	ConfigFile        string             `json:"configFile"`
+	Workdir           string             `json:"workdir"`
+	ComposeFileExists bool               `json:"composeFileExists"`
+	Path              string             `json:"path"`
+	Containers        []ComposeContainer `json:"containers"`
+	Env               string             `json:"env"`
 }
 type ComposeContainer struct {
 	ContainerID string   `json:"containerID"`
@@ -272,13 +307,14 @@ type ComposeContainer struct {
 	Ports       []string `json:"ports"`
 }
 type ComposeCreate struct {
-	TaskID   string `json:"taskID"`
-	Name     string `json:"name"`
-	From     string `json:"from" validate:"required,oneof=edit path template"`
-	File     string `json:"file"`
-	Path     string `json:"path"`
-	Template uint   `json:"template"`
-	Env      string `json:"env"`
+	TaskID    string `json:"taskID"`
+	Name      string `json:"name"`
+	From      string `json:"from" validate:"required,oneof=edit path template"`
+	File      string `json:"file"`
+	Path      string `json:"path"`
+	Template  uint   `json:"template"`
+	Env       string `json:"env"`
+	ForcePull bool   `json:"forcePull"`
 }
 type ComposeOperation struct {
 	Name      string `json:"name" validate:"required"`
@@ -288,11 +324,13 @@ type ComposeOperation struct {
 	Force     bool   `json:"force"`
 }
 type ComposeUpdate struct {
+	TaskID     string `json:"taskID"`
 	Name       string `json:"name" validate:"required"`
 	Path       string `json:"path" validate:"required"`
 	DetailPath string `json:"detailPath"`
 	Content    string `json:"content" validate:"required"`
 	Env        string `json:"env"`
+	ForcePull  bool   `json:"forcePull"`
 }
 type ComposeLogClean struct {
 	Name       string `json:"name" validate:"required"`
@@ -304,6 +342,7 @@ type ContainerLog struct {
 	Container     string `json:"container" validate:"required"`
 	Since         string `json:"since"`
 	Tail          uint   `json:"tail"`
+	Timestamp     bool   `json:"timestamp"`
 	ContainerType string `json:"containerType"`
 }

@@ -313,5 +352,6 @@ type StreamLog struct {
 	Since     string
 	Follow    bool
 	Tail      string
+	Timestamp bool
 	Type      string
 }
@@ -49,6 +49,7 @@ type CronjobOperate struct {
 	Timeout           uint   `json:"timeout" validate:"number,min=1"`
 	IgnoreErr         bool   `json:"ignoreErr"`
 	Secret            string `json:"secret"`
+	Args              string `json:"args"`

 	AlertCount  uint   `json:"alertCount"`
 	AlertTitle  string `json:"alertTitle"`
@@ -123,6 +124,7 @@ type CronjobInfo struct {
 	LastRecordTime   string `json:"lastRecordTime"`
 	Status           string `json:"status"`
 	Secret           string `json:"secret"`
+	Args             string `json:"args"`

 	AlertCount uint `json:"alertCount"`
 }
@@ -162,6 +164,7 @@ type CronjobTrans struct {
 	IgnoreErr    bool                `json:"ignoreErr"`
 	SnapshotRule SnapshotTransHelper `json:"snapshotRule"`
 	Secret       string              `json:"secret"`
+	Args         string              `json:"args"`

 	SourceAccounts  []string `json:"sourceAccounts"`
 	DownloadAccount string   `json:"downloadAccount"`
@@ -4,6 +4,7 @@ import "time"

 type DashboardBase struct {
 	WebsiteNumber      int `json:"websiteNumber"`
+	AgentNumber        int `json:"agentNumber"`
 	DatabaseNumber     int `json:"databaseNumber"`
 	CronjobNumber      int `json:"cronjobNumber"`
 	AppInstalledNumber int `json:"appInstalledNumber"`
@@ -11,7 +11,7 @@ type DBConfUpdateByFile struct {
 type ChangeDBInfo struct {
 	ID       uint   `json:"id"`
 	From     string `json:"from" validate:"required,oneof=local remote"`
-	Type     string `json:"type" validate:"required,oneof=mysql mariadb postgresql redis mysql-cluster postgresql-cluster redis-cluster"`
+	Type     string `json:"type" validate:"required,oneof=mysql mariadb postgresql redis mongodb mysql-cluster postgresql-cluster redis-cluster"`
 	Database string `json:"database" validate:"required"`
 	Value    string `json:"value" validate:"required"`
 }
@@ -137,6 +137,83 @@ type MysqlStatus struct {
 	Position                     string `json:"Position"`
 }

+// mongodb
+type MongodbDBSearch struct {
+	PageInfo
+	Info     string `json:"info"`
+	Database string `json:"database" validate:"required"`
+	OrderBy  string `json:"orderBy" validate:"required,oneof=name createdAt"`
+	Order    string `json:"order" validate:"required,oneof=null ascending descending"`
+}
+
+type MongodbDBInfo struct {
+	ID          uint      `json:"id"`
+	CreatedAt   time.Time `json:"createdAt"`
+	Name        string    `json:"name"`
+	From        string    `json:"from"`
+	MongodbName string    `json:"mongodbName"`
+	Username    string    `json:"username"`
+	Password    string    `json:"password"`
+	IsDelete    bool      `json:"isDelete"`
+	Description string    `json:"description"`
+}
+
+type MongodbDBCreate struct {
+	Name        string `json:"name" validate:"required"`
+	From        string `json:"from" validate:"required,oneof=local remote"`
+	Database    string `json:"database" validate:"required"`
+	Username    string `json:"username" validate:"required"`
+	Password    string `json:"password" validate:"required"`
+	Permission  string `json:"permission" validate:"required,oneof=dbOwner read readWrite userAdmin"`
+	Description string `json:"description"`
+}
+
+type MongodbLoadDB struct {
+	From     string `json:"from" validate:"required,oneof=local remote"`
+	Type     string `json:"type" validate:"required,oneof=mongodb"`
+	Database string `json:"database" validate:"required"`
+}
+
+type MongodbDBDeleteCheck struct {
+	ID       uint   `json:"id" validate:"required"`
+	Type     string `json:"type" validate:"required,oneof=mongodb"`
+	Database string `json:"database" validate:"required"`
+}
+
+type MongodbDBDelete struct {
+	ID           uint   `json:"id" validate:"required"`
+	Type         string `json:"type" validate:"required,oneof=mongodb"`
+	Database     string `json:"database" validate:"required"`
+	ForceDelete  bool   `json:"forceDelete"`
+	DeleteBackup bool   `json:"deleteBackup"`
+}
+
+type MongodbBind struct {
+	Database string `json:"database" validate:"required"`
+	Name     string `json:"name" validate:"required"`
+	Username string `json:"username" validate:"required"`
+	Password string `json:"password" validate:"required"`
+}
+
+type MongodbPassword struct {
+	Database string `json:"database" validate:"required"`
+	Name     string `json:"name" validate:"required"`
+	Password string `json:"password" validate:"required"`
+}
+
+type MongodbPrivileges struct {
+	Database   string `json:"database" validate:"required"`
+	Name       string `json:"name" validate:"required"`
+	Username   string `json:"username" validate:"required"`
+	Permission string `json:"permission" validate:"required,oneof=dbOwner read readWrite userAdmin"`
+}
+
+type MongodbPrivilegesLoad struct {
+	Database string `json:"database" validate:"required"`
+	Name     string `json:"name" validate:"required"`
+	Username string `json:"username" validate:"required"`
+}
+
 type MysqlVariables struct {
 	BinlogCacheSize      string `json:"binlog_cache_size"`
 	InnodbBufferPoolSize string `json:"innodb_buffer_pool_size"`
@@ -19,7 +19,7 @@ type RuleSearch struct {
 }

 type FirewallOperation struct {
-	Operation         string `json:"operation" validate:"required,oneof=start stop restart disablePing enablePing"`
+	Operation         string `json:"operation" validate:"required,oneof=start stop restart disableBanPing enableBanPing"`
 	WithDockerRestart bool   `json:"withDockerRestart"`
 }

@@ -1,8 +1,6 @@
 package dto

-import (
-	"time"
-)
+import "time"

 type HostOperate struct {
 	ID               uint   `json:"id"`
@@ -34,11 +32,6 @@ type SearchForTree struct {
 	Info string `json:"info"`
 }

-type ChangeHostGroup struct {
-	ID      uint `json:"id" validate:"required"`
-	GroupID uint `json:"groupID" validate:"required"`
-}
-
 type HostInfo struct {
 	ID               uint      `json:"id"`
 	CreatedAt        time.Time `json:"createdAt"`
@@ -21,8 +21,8 @@ type ImageInfo struct {
 }

 type ImageLoad struct {
-	TaskID string `json:"taskID"`
-	Path   string `json:"path" validate:"required"`
+	TaskID string   `json:"taskID"`
+	Paths  []string `json:"paths" validate:"required,dive,required"`
 }

 type ImageBuild struct {
@@ -7,6 +7,7 @@ import (
 type SearchTaskLogReq struct {
 	Status string `json:"status"`
 	Type   string `json:"type"`
+	TaskID string `json:"taskID"`
 	PageInfo
 }

@@ -22,7 +22,16 @@ type AppInstallCreate struct {
 	Name        string                 `json:"name" validate:"required"`
 	Services    map[string]string      `json:"services"`
 	TaskID      string                 `json:"taskID"`
+
 	AppContainerConfig
+	NodePushConfig
+}
+
+type NodePushConfig struct {
+	Nodes    []string `json:"nodes"`
+	PushNode bool     `json:"pushNode"`
+	AppKey   string   `json:"appKey"`
+	Version  string   `json:"version"`
 }

 type AppContainerConfig struct {
@@ -45,13 +54,14 @@ type AppContainerConfig struct {

 type AppInstalledSearch struct {
 	dto.PageInfo
-	Type   string   `json:"type"`
-	Name   string   `json:"name"`
-	Tags   []string `json:"tags"`
-	Update bool     `json:"update"`
-	Unused bool     `json:"unused"`
-	All    bool     `json:"all"`
-	Sync   bool     `json:"sync"`
+	Type        string   `json:"type"`
+	Name        string   `json:"name"`
+	Tags        []string `json:"tags"`
+	Update      bool     `json:"update"`
+	Unused      bool     `json:"unused"`
+	All         bool     `json:"all"`
+	Sync        bool     `json:"sync"`
+	CheckUpdate bool     `json:"checkUpdate"`
 }

 type AppInstalledInfo struct {
@@ -128,3 +138,12 @@ type AppUpdateVersion struct {
 	AppInstallID  uint   `json:"appInstallID" validate:"required"`
 	UpdateVersion string `json:"updateVersion"`
 }
+
+type AppInstallSortItem struct {
+	InstallID uint `json:"installID"`
+	SortOrder int  `json:"sortOrder"`
+}
+
+type AppInstallSort struct {
+	Items []AppInstallSortItem `json:"items" validate:"required"`
+}
@@ -13,6 +13,7 @@ type DiskMountRequest struct {
 	MountPoint string `json:"mountPoint" validate:"required"`
 	Filesystem string `json:"filesystem" validate:"required,oneof=ext4 xfs"`
 	AutoMount  bool   `json:"autoMount"`
+	NoFail     bool   `json:"noFail"`
 }

 type DiskUnmountRequest struct {
@@ -9,6 +9,29 @@ type FileOption struct {
 	files.FileOption
 }

+type FileAISearch struct {
+	Path             string   `json:"path" validate:"required"`
+	Query            string   `json:"query" validate:"required"`
+	ResponseLanguage string   `json:"responseLanguage,omitempty"`
+	ContainSub       *bool    `json:"containSub,omitempty"`
+	MaxItems         int      `json:"maxItems" validate:"omitempty,min=1,max=2000"`
+	MatchCase        bool     `json:"matchCase"`
+	WholeWord        bool     `json:"wholeWord"`
+	UseRegex         bool     `json:"useRegex"`
+	Extensions       []string `json:"extensions,omitempty"`
+	MinSize          int64    `json:"minSize"`
+	MaxSize          int64    `json:"maxSize"`
+	ModifiedAfter    string   `json:"modifiedAfter,omitempty"`
+	ModifiedBefore   string   `json:"modifiedBefore,omitempty"`
+
+	MaxScanFiles              int   `json:"maxScanFiles"`
+	MaxFileBytes              int64 `json:"maxFileBytes"`
+	MaxHitsPerFile            int   `json:"maxHitsPerFile"`
+	MaxTotalHits              int   `json:"maxTotalHits"`
+	ContentHitsPromptMaxBytes int   `json:"contentHitsPromptMaxBytes"`
+	LlmMaxOutputTokens        int   `json:"llmMaxOutputTokens"`
+}
+
 type FileContentReq struct {
 	Path     string `json:"path" validate:"required"`
 	IsDetail bool   `json:"isDetail"`
@@ -55,6 +78,11 @@ type FileCompress struct {
 	Name    string   `json:"name" validate:"required"`
 	Replace bool     `json:"replace"`
 	Secret  string   `json:"secret"`
+	TaskID  string   `json:"taskID"`
+}
+
+type FileCompressStopReq struct {
+	TaskID string `json:"taskID" validate:"required"`
 }

 type FileDeCompress struct {
@@ -163,3 +191,18 @@ type FileConvertRequest struct {
 	DeleteSource bool          `json:"deleteSource"`
 	TaskID       string        `json:"taskID"`
 }
+
+type FileRemarkBatch struct {
+	Paths []string `json:"paths" validate:"required"`
+}
+
+type FileRemarkUpdate struct {
+	Path   string `json:"path" validate:"required"`
+	Remark string `json:"remark"`
+}
+
+type FileShareCreate struct {
+	Path          string  `json:"path" validate:"required"`
+	ExpireMinutes int     `json:"expireMinutes" validate:"min=0,max=10080"`
+	Password      *string `json:"password"`
+}
@@ -0,0 +1,52 @@
+package request
+
+import (
+	"encoding/json"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+)
+
+type FileHistorySearchReq struct {
+	dto.PageInfo
+	Path      string `json:"path"`
+	Scope     string `json:"scope" validate:"required,oneof=current all"`
+	Operation string `json:"operation"`
+}
+
+type FileHistoryContentReq struct {
+	ID uint `json:"id" validate:"required"`
+}
+
+type FileHistoryIDs []uint
+
+func (ids *FileHistoryIDs) UnmarshalJSON(data []byte) error {
+	type alias []uint
+	var direct alias
+	if err := json.Unmarshal(data, &direct); err == nil {
+		*ids = FileHistoryIDs(direct)
+		return nil
+	}
+
+	var wrapped struct {
+		IDs []uint `json:"ids"`
+	}
+	if err := json.Unmarshal(data, &wrapped); err != nil {
+		return err
+	}
+	*ids = FileHistoryIDs(wrapped.IDs)
+	return nil
+}
+
+type FileHistoryDeleteReq struct {
+	IDs FileHistoryIDs `json:"ids" validate:"required"`
+}
+
+type FileHistoryRestoreReq struct {
+	ID uint `json:"id" validate:"required"`
+}
+
+type FileHistorySettingUpdate struct {
+	Enable      string `json:"enable" validate:"required,oneof=Enable Disable"`
+	MaxPerPath  int    `json:"maxPerPath" validate:"min=0,max=1000"`
+	DiskQuotaMB int    `json:"diskQuotaMB" validate:"min=0,max=1048576"`
+}
@@ -1 +0,0 @@
-package request
@@ -45,6 +45,7 @@ type StreamConfig struct {
 	StreamPorts string `json:"streamPorts"`
 	Name        string `json:"name"`
 	Algorithm   string `json:"algorithm"`
+	UDP         bool   `json:"udp"`

 	Servers []dto.NginxUpstreamServer `json:"servers"`
 }
@@ -268,9 +269,21 @@ type WebsiteProxyConfig struct {
 	Replaces        map[string]string `json:"replaces"`
 	SNI             bool              `json:"sni"`
 	ProxySSLName    string            `json:"proxySSLName"`
+	SSLVerify       bool              `json:"sslVerify"`
 	CorsConfig
 }

+type WebsiteProxyDelete struct {
+	ID   uint   `json:"id" validate:"required"`
+	Name string `json:"name" validate:"required"`
+}
+
+type WebsiteProxyStatusUpdate struct {
+	ID     uint   `json:"id" validate:"required"`
+	Name   string `json:"name" validate:"required"`
+	Status string `json:"status" validate:"required"`
+}
+
 type CorsConfig struct {
 	Cors             bool   `json:"cors"`
 	AllowOrigins     string `json:"allowOrigins"`
@@ -310,6 +323,7 @@ type WebsiteHtmlReq struct {
 type WebsiteHtmlUpdate struct {
 	Type    string `json:"type" validate:"required"`
 	Content string `json:"content" validate:"required"`
+	Sync    bool   `json:"sync"`
 }

 type WebsiteLBCreate struct {
@@ -6,8 +6,12 @@ type WebsiteSSLSearch struct {
 	dto.PageInfo
 	AcmeAccountID string `json:"acmeAccountID"`
 	Domain        string `json:"domain"`
-	OrderBy       string `json:"orderBy" validate:"required,oneof=expire_date"`
-	Order         string `json:"order" validate:"required,oneof=null ascending descending"`
+	OrderBy       string `json:"orderBy" validate:"omitempty,oneof=created_at expire_date"`
+	Order         string `json:"order" validate:"omitempty,oneof=null ascending descending"`
+}
+
+type WebsiteSSLListReq struct {
+	AcmeAccountID string `json:"acmeAccountID"`
 }

 type WebsiteSSLCreate struct {
@@ -47,7 +51,6 @@ type WebsiteSSLApply struct {
 	ID           uint     `json:"ID" validate:"required"`
 	SkipDNSCheck bool     `json:"skipDNSCheck"`
 	Nameservers  []string `json:"nameservers"`
-	DisableLog   bool     `json:"disableLog"`
 }

 type WebsiteSSLObtain struct {
@@ -63,6 +66,7 @@ type WebsiteAcmeAccountCreate struct {
 	EabHmacKey string `json:"eabHmacKey"`
 	UseProxy   bool   `json:"useProxy"`
 	CaDirURL   string `json:"caDirURL"`
+	UseEAB     bool   `json:"useEAB"`
 }

 type WebsiteAcmeAccountUpdate struct {
@@ -29,17 +29,18 @@ type AppDTO struct {
 }

 type AppItem struct {
-	Name        string   `json:"name"`
-	Key         string   `json:"key"`
-	ID          uint     `json:"id"`
-	Description string   `json:"description"`
-	Status      string   `json:"status"`
-	Installed   bool     `json:"installed"`
-	Limit       int      `json:"limit"`
-	Tags        []string `json:"tags"`
-	GpuSupport  bool     `json:"gpuSupport"`
-	Recommend   int      `json:"recommend"`
-	Type        string   `json:"type"`
+	Name                string   `json:"name"`
+	Key                 string   `json:"key"`
+	ID                  uint     `json:"id"`
+	Description         string   `json:"description"`
+	Status              string   `json:"status"`
+	Installed           bool     `json:"installed"`
+	Limit               int      `json:"limit"`
+	Tags                []string `json:"tags"`
+	GpuSupport          bool     `json:"gpuSupport"`
+	Recommend           int      `json:"recommend"`
+	Type                string   `json:"type"`
+	BatchInstallSupport bool     `json:"batchInstallSupport"`
 }

 type TagDTO struct {
@@ -75,6 +76,10 @@ type AppDetailDTO struct {
 	GpuSupport     bool        `json:"gpuSupport"`
 }

+type AppDetailSimpleDTO struct {
+	ID uint `json:"id"`
+}
+
 type IgnoredApp struct {
 	Icon     string `json:"icon"`
 	Name     string `json:"name"`
@@ -121,6 +126,7 @@ type AppInstallDTO struct {
 	WebUI         string    `json:"webUI"`
 	CreatedAt     time.Time `json:"createdAt"`
 	Favorite      bool      `json:"favorite"`
+	SortOrder     int       `json:"sortOrder"`
 	App           AppDetail `json:"app"`
 	Container     string    `json:"container"`
 	IsEdit        bool      `json:"isEdit"`
@@ -81,3 +81,45 @@ type FileConvertLog struct {
 	Status  string `json:"status"`
 	Message string `json:"message"`
 }
+
+type FileRemarksRes struct {
+	Remarks map[string]string `json:"remarks"`
+}
+
+type FileShareInfo struct {
+	Code        string `json:"code"`
+	Path        string `json:"path"`
+	FileName    string `json:"fileName"`
+	ExpiresAt   int64  `json:"expiresAt"`
+	Permanent   bool   `json:"permanent"`
+	HasPassword bool   `json:"hasPassword"`
+	Password    string `json:"password,omitempty"`
+}
+
+type FileSharePublicInfo struct {
+	FileName    string `json:"fileName"`
+	ExpiresAt   int64  `json:"expiresAt"`
+	Permanent   bool   `json:"permanent"`
+	HasPassword bool   `json:"hasPassword"`
+}
+
+type FileAIContentHit struct {
+	Path string `json:"path"`
+	Line int    `json:"line"`
+	Text string `json:"text"`
+}
+
+type FileAISearchResult struct {
+	Mode                 string             `json:"mode"`
+	Summary              string             `json:"summary"`
+	Hits                 []FileAIContentHit `json:"hits"`
+	ContentScannedFiles  int                `json:"contentScannedFiles"`
+	ContentHitsTruncated bool               `json:"contentHitsTruncated"`
+	Truncated            bool               `json:"truncated"`
+	PreFiltered          bool               `json:"preFiltered"`
+	ItemCount            int                `json:"itemCount"`
+	PromptTokens         int                `json:"promptTokens"`
+	CompletionTokens     int                `json:"completionTokens"`
+	TotalTokens          int                `json:"totalTokens"`
+	Duration             string             `json:"duration"`
+}
@@ -0,0 +1,31 @@
+package response
+
+import "time"
+
+type FileHistoryInfo struct {
+	ID             uint      `json:"id"`
+	FileID         string    `json:"fileId"`
+	Path           string    `json:"path"`
+	CurrentPath    string    `json:"currentPath"`
+	PreviousID     uint      `json:"previousId"`
+	SourcePath     string    `json:"sourcePath"`
+	TargetPath     string    `json:"targetPath"`
+	FileName       string    `json:"fileName"`
+	Extension      string    `json:"extension"`
+	FileMode       string    `json:"fileMode"`
+	Operation      string    `json:"operation"`
+	Deleted        bool      `json:"deleted"`
+	ContentSize    int64     `json:"contentSize"`
+	ContentSHA     string    `json:"contentSHA"`
+	StoragePath    string    `json:"storagePath,omitempty"`
+	Content        string    `json:"content,omitempty"`
+	CurrentContent string    `json:"currentContent,omitempty"`
+	CreatedAt      time.Time `json:"createdAt"`
+	UpdatedAt      time.Time `json:"updatedAt"`
+}
+
+type FileHistorySettingInfo struct {
+	Enable      string `json:"enable"`
+	MaxPerPath  int    `json:"maxPerPath"`
+	DiskQuotaMB int    `json:"diskQuotaMB"`
+}
@@ -18,6 +18,7 @@ type WebsiteDTO struct {
 	SiteDir       string `json:"siteDir"`
 	OpenBaseDir   bool   `json:"openBaseDir"`
 	Algorithm     string `json:"algorithm"`
+	UDP           bool   `json:"udp"`

 	Servers []dto.NginxUpstreamServer `json:"servers"`
 }
@@ -39,6 +40,7 @@ type WebsiteRes struct {
 	SSLStatus     string    `json:"sslStatus"`
 	AppInstallID  uint      `json:"appInstallId"`
 	ChildSites    []string  `json:"childSites"`
+	ParentSite    string    `json:"parentSite"`
 	RuntimeType   string    `json:"runtimeType"`
 	Favorite      bool      `json:"favorite"`
 	IPV6          bool      `json:"IPV6"`
@@ -55,6 +55,7 @@ type CleanTree struct {
 	Size        uint64 `json:"size"`
 	IsCheck     bool   `json:"isCheck"`
 	IsRecommend bool   `json:"isRecommend"`
+	CanDelete   bool   `json:"canDelete"`
 }

 type Clean struct {
@@ -87,6 +88,19 @@ type SystemProxy struct {
 	Password string `json:"password"`
 }

+type TerminalAIInfo struct {
+	AIStatus              string `json:"aiStatus"`
+	AIAccountID           string `json:"aiAccountId"`
+	AIPrefix              string `json:"aiPrefix" validate:"required,oneof=@ai #ai /ai"`
+	AIRiskCommands        string `json:"aiRiskCommands"`
+	AIRiskCommandsDefault string `json:"aiRiskCommandsDefault"`
+}
+
+type FileManageAIInfo struct {
+	AIStatus    string `json:"aiStatus"`
+	AIAccountID string `json:"aiAccountId"`
+}
+
 type CommonDescription struct {
 	ID          string `json:"id" validate:"required"`
 	Type        string `json:"type" validate:"required"`
@@ -4,7 +4,6 @@ import "time"

 type SSHUpdate struct {
 	Key      string `json:"key" validate:"required"`
-	OldValue string `json:"oldValue"`
 	NewValue string `json:"newValue"`
 }

@@ -50,6 +49,12 @@ type GenerateLoad struct {
 type SSHConf struct {
 	File string `json:"file"`
 }
+
+type SSHConfUpdate struct {
+	Key   string `json:"key" validate:"required"`
+	Path  string `json:"path"`
+	Value string `json:"value"`
+}
 type SearchSSHLog struct {
 	PageInfo
 	Info   string `json:"info"`
@@ -0,0 +1,22 @@
+package model
+
+type Agent struct {
+	BaseModel
+	Name          string `json:"name" gorm:"not null;unique"`
+	Remark        string `json:"remark"`
+	AgentType     string `json:"agentType" gorm:"default:openclaw"`
+	Provider      string `json:"provider"`
+	Model         string `json:"model"`
+	APIType       string `json:"apiType"`
+	MaxTokens     int    `json:"maxTokens"`
+	ContextWindow int    `json:"contextWindow"`
+	BaseURL       string `json:"baseUrl"`
+	APIKey        string `json:"apiKey"`
+	Token         string `json:"token"`
+	Status        string `json:"status"`
+	Message       string `json:"message"`
+	AppInstallID  uint   `json:"appInstallId"`
+	WebsiteID     uint   `json:"websiteId"`
+	AccountID     uint   `json:"accountId"`
+	ConfigPath    string `json:"configPath"`
+}
@@ -0,0 +1,17 @@
+package model
+
+type AgentAccount struct {
+	BaseModel
+	Provider       string `json:"provider"`
+	Name           string `json:"name"`
+	APIKey         string `json:"apiKey"`
+	BaseURL        string `json:"baseUrl"`
+	APIType        string `json:"apiType"`
+	RememberAPIKey bool   `json:"rememberApiKey"`
+	Verified       bool   `json:"verified"`
+	Remark         string `json:"remark"`
+}
+
+func (AgentAccount) TableName() string {
+	return "agent_provider_accounts"
+}
@@ -0,0 +1,17 @@
+package model
+
+type AgentAccountModel struct {
+	BaseModel
+	AccountID     uint   `json:"accountId" gorm:"index"`
+	Model         string `json:"model" gorm:"index"`
+	Name          string `json:"name"`
+	ContextWindow int    `json:"contextWindow"`
+	MaxTokens     int    `json:"maxTokens"`
+	Reasoning     bool   `json:"reasoning"`
+	Input         string `json:"input" gorm:"type:text"`
+	SortOrder     int    `json:"sortOrder" gorm:"index"`
+}
+
+func (AgentAccountModel) TableName() string {
+	return "agent_account_models"
+}
@@ -11,7 +11,7 @@ type Alert struct {
 	Status         string `gorm:"type:varchar(64);not null" json:"status"`
 	Method         string `gorm:"type:varchar(64);not null" json:"method"`
 	SendCount      uint   `gorm:"type:integer" json:"sendCount"`
-	AdvancedParams string `gorm:"type:longText" json:"advancedParam"`
+	AdvancedParams string `gorm:"type:longText" json:"advancedParams"`
 }

 type AlertTask struct {
@@ -34,6 +34,7 @@ type App struct {
 	MemoryRequired       int     `json:"memoryRequired"`
 	GpuSupport           bool    `json:"gpuSupport"`
 	RequiredPanelVersion float64 `json:"requiredPanelVersion"`
+	BatchInstallSupport  bool    `json:"batchInstallSupport" yaml:"batchInstallSupport"`

 	Details []AppDetail `json:"-" gorm:"-:migration"`
 	TagsKey []string    `json:"tags" yaml:"tags" gorm:"-"`
@@ -26,6 +26,7 @@ type AppInstall struct {
 	HttpsPort     int    `json:"httpsPort"`
 	WebUI         string `json:"webUI"`
 	Favorite      bool   `json:"favorite"`
+	SortOrder     int    `json:"sortOrder" gorm:"default:0"`

 	App App `json:"app" gorm:"-:migration"`
 }
@@ -37,6 +37,7 @@ type Cronjob struct {
 	Timeout           uint   `json:"timeout"`
 	IgnoreErr         bool   `json:"ignoreErr"`
 	RetainCopies      uint64 `json:"retainCopies"`
+	Args              string `json:"args"`

 	IsExecuting bool         `json:"isExecuting"`
 	Status      string       `json:"status"`
@@ -0,0 +1,12 @@
+package model
+
+type DatabaseMongodb struct {
+	BaseModel
+	Name        string `json:"name" gorm:"not null"`
+	From        string `json:"from" gorm:"not null;default:local"`
+	MongodbName string `json:"mongodbName" gorm:"not null"`
+	Username    string `json:"username" gorm:"not null"`
+	Password    string `json:"password" gorm:"not null"`
+	IsDelete    bool   `json:"isDelete"`
+	Description string `json:"description"`
+}
@@ -0,0 +1,19 @@
+package model
+
+type FileHistory struct {
+	BaseModel
+	FileID      string `json:"fileId" gorm:"not null;index:idx_file_history_file_id_created_at,priority:1;index:idx_file_history_file_id_deleted_created_at,priority:1"`
+	Path        string `json:"path" gorm:"not null;index:idx_file_history_path_created_at,priority:1;index:idx_file_history_path_hash_created_at,priority:1;index:idx_file_history_related_path,priority:1"`
+	PathHash    string `json:"pathHash" gorm:"not null;index:idx_file_history_path_created_at,priority:2;index:idx_file_history_path_hash_created_at,priority:2"`
+	PreviousID  uint   `json:"previousId" gorm:"index"`
+	SourcePath  string `json:"sourcePath" gorm:"index:idx_file_history_related_path,priority:2"`
+	TargetPath  string `json:"targetPath" gorm:"index:idx_file_history_related_path,priority:3"`
+	FileName    string `json:"fileName" gorm:"not null"`
+	Extension   string `json:"extension"`
+	FileMode    string `json:"fileMode"`
+	Operation   string `json:"operation" gorm:"not null;index:idx_file_history_operation_created_at,priority:1"`
+	Deleted     bool   `json:"deleted" gorm:"not null;default:false;index:idx_file_history_deleted_created_at,priority:1;index:idx_file_history_file_id_deleted_created_at,priority:2"`
+	ContentSize int64  `json:"contentSize" gorm:"not null"`
+	ContentSHA  string `json:"contentSHA" gorm:"not null;index"`
+	StoragePath string `json:"storagePath" gorm:"not null;uniqueIndex"`
+}
@@ -0,0 +1,14 @@
+package model
+
+type FileShare struct {
+	BaseModel
+	Path          string `gorm:"not null;uniqueIndex" json:"path"`
+	Token         string `gorm:"not null;uniqueIndex" json:"token"`
+	FileName      string `gorm:"not null" json:"fileName"`
+	ExpiresUnix   int64  `json:"expiresUnix"`
+	PasswordEnc   string `json:"-"`
+	PasswordSalt  string `json:"passwordSalt"`
+	PasswordHash  string `json:"passwordHash"`
+	MaxDownloads  int    `json:"maxDownloads"`
+	DownloadCount int    `json:"downloadCount"`
+}
@@ -11,6 +11,7 @@ type WebsiteAcmeAccount struct {
 	KeyType    string `gorm:"not null;default:2048" json:"keyType"`
 	UseProxy   bool   `gorm:"default:false" json:"useProxy"`
 	CaDirURL   string `json:"caDirURL"`
+	UseEAB     bool   `json:"useEAB"`
 }

 func (w WebsiteAcmeAccount) TableName() string {
@@ -0,0 +1,438 @@
+package provider
+
+import (
+	"strings"
+)
+
+type Model struct {
+	ID            string
+	Name          string
+	ContextWindow int
+	MaxTokens     int
+	Reasoning     bool
+	Input         []string
+}
+
+type RuntimeDefault struct {
+	APIType       string
+	ContextWindow int
+	MaxTokens     int
+	Input         []string
+}
+
+type Meta struct {
+	Key            string
+	DisplayName    string
+	Sort           uint
+	DefaultBaseURL string
+	EnvKey         string
+	Default        RuntimeDefault
+	Models         []Model
+}
+
+var catalog = map[string]Meta{
+	"custom": {
+		Key:            "custom",
+		DisplayName:    "Custom",
+		Sort:           10,
+		DefaultBaseURL: "",
+		EnvKey:         "CUSTOM_API_KEY",
+		Default: RuntimeDefault{
+			APIType:       "openai-completions",
+			ContextWindow: 128000,
+			MaxTokens:     8192,
+			Input:         []string{"text"},
+		},
+		Models: []Model{},
+	},
+	"ollama": {
+		Key:         "ollama",
+		DisplayName: "Ollama",
+		Sort:        15,
+		Default: RuntimeDefault{
+			APIType:       "openai-responses",
+			ContextWindow: 160000,
+			MaxTokens:     8192,
+			Input:         []string{"text"},
+		},
+	},
+	"vllm": {
+		Key:            "vllm",
+		DisplayName:    "vLLM",
+		Sort:           20,
+		DefaultBaseURL: "",
+		EnvKey:         "VLLM_API_KEY",
+		Default: RuntimeDefault{
+			APIType:       "openai-completions",
+			ContextWindow: 128000,
+			MaxTokens:     8192,
+			Input:         []string{"text"},
+		},
+		Models: []Model{},
+	},
+	"deepseek": {
+		Key:            "deepseek",
+		DisplayName:    "DeepSeek",
+		Sort:           25,
+		DefaultBaseURL: "https://api.deepseek.com/v1",
+		EnvKey:         "DEEPSEEK_API_KEY",
+		Default: RuntimeDefault{
+			APIType:       "openai-completions",
+			ContextWindow: 131072,
+			MaxTokens:     8192,
+			Input:         []string{"text"},
+		},
+		Models: []Model{
+			{ID: "deepseek/deepseek-chat", Name: "DeepSeek Chat"},
+			{ID: "deepseek/deepseek-reasoner", Name: "DeepSeek Reasoner", MaxTokens: 65536, ContextWindow: 131072, Reasoning: true},
+		},
+	},
+	"bailian-coding-plan": {
+		Key:            "bailian-coding-plan",
+		DisplayName:    "阿里云百炼 Coding Plan",
+		Sort:           30,
+		DefaultBaseURL: "https://coding.dashscope.aliyuncs.com/v1",
+		EnvKey:         "QWEN_API_KEY",
+		Default: RuntimeDefault{
+			APIType:       "openai-completions",
+			ContextWindow: 256000,
+			MaxTokens:     8192,
+			Input:         []string{"text"},
+		},
+		Models: []Model{
+			{ID: "bailian-coding-plan/qwen3.5-plus", Name: "Qwen3.5-Plus", Reasoning: true},
+			{ID: "bailian-coding-plan/qwen3-max", Name: "Qwen3-Max", Reasoning: true},
+			{ID: "bailian-coding-plan/qwen3-coder-next", Name: "Qwen3-Coder-Next", Reasoning: true},
+			{ID: "bailian-coding-plan/qwen3-coder-plus", Name: "Qwen3-Coder-Plus", Reasoning: true},
+			{ID: "bailian-coding-plan/minimax-m2.5", Name: "MiniMax M2.5", Reasoning: true},
+			{ID: "bailian-coding-plan/glm-5", Name: "GLM-5", Reasoning: true},
+			{ID: "bailian-coding-plan/kimi-k2.5", Name: "Kimi-k2.5", Reasoning: true},
+			{ID: "bailian-coding-plan/glm-4.7", Name: "GLM-4.7", Reasoning: true},
+		},
+	},
+	"ark-coding-plan": {
+		Key:            "ark-coding-plan",
+		DisplayName:    "方舟 Coding Plan",
+		Sort:           35,
+		DefaultBaseURL: "https://ark.cn-beijing.volces.com/api/coding/v3",
+		EnvKey:         "ARK_API_KEY",
+		Default: RuntimeDefault{
+			APIType:       "openai-completions",
+			ContextWindow: 256000,
+			MaxTokens:     4096,
+			Input:         []string{"text"},
+		},
+		Models: []Model{
+			{ID: "ark-coding-plan/ark-code-latest", Name: "Ark Coding Plan", ContextWindow: 256000, MaxTokens: 4096},
+			{ID: "ark-coding-plan/doubao-seed-code", Name: "Doubao Seed Code", ContextWindow: 256000, MaxTokens: 4096},
+			{ID: "ark-coding-plan/glm-4.7", Name: "GLM 4.7 Coding", ContextWindow: 200000, MaxTokens: 4096},
+			{ID: "ark-coding-plan/kimi-k2-thinking", Name: "Kimi K2 Thinking", ContextWindow: 256000, MaxTokens: 4096},
+			{ID: "ark-coding-plan/kimi-k2.5", Name: "Kimi K2.5 Coding", ContextWindow: 256000, MaxTokens: 4096},
+			{ID: "ark-coding-plan/doubao-seed-code-preview-251028", Name: "Doubao Seed Code Preview", ContextWindow: 256000, MaxTokens: 4096},
+		},
+	},
+	"zai": {
+		Key:            "zai",
+		DisplayName:    "Z.ai",
+		Sort:           40,
+		DefaultBaseURL: "https://open.bigmodel.cn/api/paas/v4",
+		EnvKey:         "ZAI_API_KEY",
+		Default: RuntimeDefault{
+			APIType:       "openai-completions",
+			ContextWindow: 204800,
+			MaxTokens:     131072,
+			Input:         []string{"text"},
+		},
+		Models: []Model{
+			{ID: "zai/glm-5", Name: "GLM-5", Reasoning: true},
+			{ID: "zai/glm-4.7", Name: "GLM-4.7", Reasoning: true},
+			{ID: "zai/glm-4.7-flash", Name: "GLM-4.7-Flash", Reasoning: true},
+			{ID: "zai/glm-4.7-flashx", Name: "GLM-4.7-FlashX", Reasoning: true},
+		},
+	},
+	"minimax": {
+		Key:            "minimax",
+		DisplayName:    "MiniMax (CN)",
+		Sort:           45,
+		DefaultBaseURL: "https://api.minimaxi.com/anthropic",
+		EnvKey:         "MINIMAX_API_KEY",
+		Default: RuntimeDefault{
+			APIType:       "anthropic-messages",
+			ContextWindow: 200000,
+			MaxTokens:     8192,
+			Input:         []string{"text"},
+		},
+		Models: []Model{
+			{ID: "minimax/MiniMax-M2.7", Name: "MiniMax M2.7"},
+			{ID: "minimax/MiniMax-M2.7-highspeed", Name: "MiniMax M2.7 highspeed"},
+			{ID: "minimax/MiniMax-M2.5", Name: "MiniMax M2.5", Reasoning: true},
+			{ID: "minimax/MiniMax-M2.5-highspeed", Name: "MiniMax M2.5 highspeed"},
+		},
+	},
+	"xiaomi": {
+		Key:            "xiaomi",
+		DisplayName:    "Xiaomi",
+		Sort:           46,
+		DefaultBaseURL: "https://api.xiaomimimo.com/v1",
+		EnvKey:         "XIAOMI_API_KEY",
+		Default: RuntimeDefault{
+			APIType:       "openai-completions",
+			ContextWindow: 262144,
+			MaxTokens:     8192,
+			Input:         []string{"text"},
+		},
+		Models: []Model{
+			{ID: "xiaomi/mimo-v2-flash", Name: "Xiaomi MiMo V2 Flash", ContextWindow: 262144, MaxTokens: 8192, Input: []string{"text"}},
+			{ID: "xiaomi/mimo-v2-pro", Name: "Xiaomi MiMo V2 Pro", ContextWindow: 1048576, MaxTokens: 32000, Reasoning: true, Input: []string{"text"}},
+			{ID: "xiaomi/mimo-v2-omni", Name: "Xiaomi MiMo V2 Omni", ContextWindow: 262144, MaxTokens: 32000, Reasoning: true, Input: []string{"text", "image"}},
+		},
+	},
+	"kimi": {
+		Key:            "kimi",
+		DisplayName:    "Kimi (CN)",
+		Sort:           50,
+		DefaultBaseURL: "https://api.moonshot.cn/v1",
+		EnvKey:         "KIMI_API_KEY",
+		Default: RuntimeDefault{
+			APIType:       "openai-completions",
+			ContextWindow: 256000,
+			MaxTokens:     8192,
+			Input:         []string{"text", "image"},
+		},
+		Models: []Model{
+			{ID: "kimi/kimi-k2.5", Name: "Kimi K2.5", Reasoning: true},
+			{ID: "kimi/kimi-k2-0905-preview", Name: "Kimi K2 0905 Preview"},
+			{ID: "kimi/kimi-k2-thinking", Name: "Kimi K2 Thinking", Reasoning: true},
+		},
+	},
+	"kimi-coding": {
+		Key:            "kimi-coding",
+		DisplayName:    "Kimi Coding",
+		Sort:           51,
+		DefaultBaseURL: "https://api.kimi.com/coding/",
+		EnvKey:         "KIMI_API_KEY",
+		Default: RuntimeDefault{
+			APIType:       "anthropic-messages",
+			ContextWindow: 262144,
+			MaxTokens:     32768,
+			Input:         []string{"text", "image"},
+		},
+		Models: []Model{
+			{ID: "kimi-coding/kimi-code", Name: "Kimi Code", ContextWindow: 262144, MaxTokens: 32768, Reasoning: true, Input: []string{"text", "image"}},
+			{ID: "kimi-coding/k2p5", Name: "Kimi K2.5", ContextWindow: 262144, MaxTokens: 32768, Reasoning: true, Input: []string{"text", "image"}},
+		},
+	},
+	"openai": {
+		Key:            "openai",
+		DisplayName:    "OpenAI",
+		Sort:           55,
+		DefaultBaseURL: "https://api.openai.com/v1",
+		EnvKey:         "OPENAI_API_KEY",
+		Default: RuntimeDefault{
+			APIType:       "openai-responses",
+			ContextWindow: 272000,
+			MaxTokens:     128000,
+			Input:         []string{"text", "image"},
+		},
+		Models: []Model{
+			{ID: "openai/gpt-5.4", Name: "gpt-5.4", ContextWindow: 272000, MaxTokens: 128000, Reasoning: true, Input: []string{"text", "image"}},
+			{ID: "openai/gpt-5.4-pro", Name: "gpt-5.4-pro", ContextWindow: 1050000, MaxTokens: 128000, Reasoning: true, Input: []string{"text", "image"}},
+			{ID: "openai/gpt-5.4-mini", Name: "gpt-5.4-mini", ContextWindow: 400000, MaxTokens: 128000, Reasoning: true, Input: []string{"text", "image"}},
+			{ID: "openai/gpt-5.4-nano", Name: "gpt-5.4-nano", ContextWindow: 400000, MaxTokens: 128000, Reasoning: true, Input: []string{"text", "image"}},
+		},
+	},
+	"openrouter": {
+		Key:            "openrouter",
+		DisplayName:    "OpenRouter",
+		Sort:           56,
+		DefaultBaseURL: "https://openrouter.ai/api/v1",
+		EnvKey:         "OPENROUTER_API_KEY",
+		Default: RuntimeDefault{
+			APIType:       "openai-completions",
+			ContextWindow: 128000,
+			MaxTokens:     8192,
+			Input:         []string{"text"},
+		},
+		Models: []Model{
+			{ID: "openrouter/free", Name: "openrouter/free"},
+			{ID: "openrouter/auto", Name: "openrouter/auto"},
+		},
+	},
+	"anthropic": {
+		Key:            "anthropic",
+		DisplayName:    "Anthropic",
+		Sort:           60,
+		DefaultBaseURL: "https://api.anthropic.com",
+		EnvKey:         "ANTHROPIC_API_KEY",
+		Default: RuntimeDefault{
+			APIType:       "anthropic-messages",
+			ContextWindow: 256000,
+			MaxTokens:     8192,
+			Input:         []string{"text", "image"},
+		},
+		Models: []Model{
+			{ID: "anthropic/claude-sonnet-4-6", Name: "Claude Sonnet 4.6", Reasoning: true},
+			{ID: "anthropic/claude-opus-4-6", Name: "Claude Opus 4.6", Reasoning: true},
+			{ID: "anthropic/claude-opus-4-5", Name: "Claude Opus 4.5"},
+			{ID: "anthropic/claude-sonnet-4-5", Name: "Claude Sonnet 4.5"},
+			{ID: "anthropic/claude-haiku-4-5", Name: "Claude Haiku 4.5"},
+		},
+	},
+	"gemini": {
+		Key:            "gemini",
+		DisplayName:    "Gemini",
+		Sort:           65,
+		DefaultBaseURL: "https://generativelanguage.googleapis.com",
+		EnvKey:         "GEMINI_API_KEY",
+		Default: RuntimeDefault{
+			APIType:       "openai-completions",
+			ContextWindow: 256000,
+			MaxTokens:     8192,
+			Input:         []string{"text", "image"},
+		},
+		Models: []Model{
+			{ID: "google/gemini-3-flash-preview", Name: "Gemini 3 Flash Preview", Reasoning: true},
+			{ID: "google/gemini-flash-latest", Name: "Gemini Flash Latest"},
+			{ID: "google/gemini-3-pro-preview", Name: "Gemini 3 Pro Preview", Reasoning: true},
+		},
+	},
+	"moonshot": {
+		Key:            "moonshot",
+		DisplayName:    "Moonshot (Global)",
+		Sort:           70,
+		DefaultBaseURL: "https://api.moonshot.ai/v1",
+		EnvKey:         "MOONSHOT_API_KEY",
+		Default: RuntimeDefault{
+			APIType:       "openai-completions",
+			ContextWindow: 256000,
+			MaxTokens:     8192,
+			Input:         []string{"text"},
+		},
+		Models: []Model{
+			{ID: "moonshot/kimi-k2.5", Name: "Kimi K2.5", Reasoning: true},
+			{ID: "moonshot/kimi-k2-0905-preview", Name: "Kimi K2 0905 Preview"},
+			{ID: "moonshot/kimi-k2-thinking", Name: "Kimi K2 Thinking", Reasoning: true},
+		},
+	},
+}
+
+func Get(key string) (Meta, bool) {
+	meta, ok := catalog[key]
+	if !ok {
+		return Meta{}, false
+	}
+	return cloneMeta(meta), true
+}
+
+func All() map[string]Meta {
+	result := make(map[string]Meta, len(catalog))
+	for key, meta := range catalog {
+		result[key] = cloneMeta(meta)
+	}
+	return result
+}
+
+func DefaultBaseURL(key string) (string, bool) {
+	meta, ok := catalog[key]
+	if !ok || strings.TrimSpace(meta.DefaultBaseURL) == "" {
+		return "", false
+	}
+	return meta.DefaultBaseURL, true
+}
+
+func EnvKey(key string) string {
+	meta, ok := catalog[key]
+	if !ok {
+		return ""
+	}
+	return meta.EnvKey
+}
+
+func DisplayName(key string) string {
+	meta, ok := catalog[key]
+	if !ok {
+		return key
+	}
+	if strings.TrimSpace(meta.DisplayName) == "" {
+		return key
+	}
+	return meta.DisplayName
+}
+
+func FindModel(key, modelID string) (Model, bool) {
+	meta, ok := Get(key)
+	if !ok {
+		return Model{}, false
+	}
+	for _, item := range meta.Models {
+		if item.ID == modelID {
+			return item, true
+		}
+	}
+	return Model{}, false
+}
+
+func cloneMeta(meta Meta) Meta {
+	clone := meta
+	if len(meta.Default.Input) > 0 {
+		clone.Default.Input = make([]string, len(meta.Default.Input))
+		copy(clone.Default.Input, meta.Default.Input)
+	}
+	if len(meta.Models) > 0 {
+		clone.Models = make([]Model, len(meta.Models))
+		for i, item := range meta.Models {
+			clone.Models[i] = normalizeModel(meta, item)
+		}
+	}
+	return clone
+}
+
+func normalizeModel(meta Meta, model Model) Model {
+	clone := model
+	clone.ID = strings.TrimSpace(clone.ID)
+	clone.Name = strings.TrimSpace(clone.Name)
+	if clone.Name == "" {
+		clone.Name = clone.ID
+	}
+	if clone.MaxTokens <= 0 {
+		clone.MaxTokens = meta.Default.MaxTokens
+	}
+	if clone.ContextWindow <= 0 {
+		clone.ContextWindow = meta.Default.ContextWindow
+	}
+	if len(clone.Input) == 0 && len(meta.Default.Input) > 0 {
+		clone.Input = make([]string, len(meta.Default.Input))
+		copy(clone.Input, meta.Default.Input)
+	}
+	return clone
+}
+
+func ResolveRuntimeParams(provider, apiType string, maxTokens, contextWindow int) (string, int, int) {
+	defaultAPIType := "openai-completions"
+	defaultMaxTokens := 8192
+	defaultContextWindow := 256000
+	if meta, ok := Get(provider); ok {
+		if meta.Default.APIType != "" {
+			defaultAPIType = meta.Default.APIType
+		}
+		if meta.Default.MaxTokens > 0 {
+			defaultMaxTokens = meta.Default.MaxTokens
+		}
+		if meta.Default.ContextWindow > 0 {
+			defaultContextWindow = meta.Default.ContextWindow
+		}
+	}
+	resolvedAPI := apiType
+	if strings.TrimSpace(apiType) == "" {
+		resolvedAPI = defaultAPIType
+	}
+	resolvedMaxTokens := defaultMaxTokens
+	resolvedContextWindow := defaultContextWindow
+	if maxTokens > 0 {
+		resolvedMaxTokens = maxTokens
+	}
+	if contextWindow > 0 {
+		resolvedContextWindow = contextWindow
+	}
+	return resolvedAPI, resolvedMaxTokens, resolvedContextWindow
+}
@@ -0,0 +1,86 @@
+package provider
+
+import (
+	"fmt"
+	"strings"
+)
+
+type OpenClawProviderPatch struct {
+	PrimaryModel string
+	ProviderKey  string
+	ModelID      string
+	APIKey       string
+	BaseURL      string
+	APIType      string
+	AuthHeader   bool
+}
+
+func BuildOpenClawProviderPatch(provider, modelName, apiType, baseURL, apiKey string) (*OpenClawProviderPatch, error) {
+	if modelName == "" {
+		return nil, fmt.Errorf("model is required")
+	}
+	resolvedAPIType, _, _ := ResolveRuntimeParams(provider, apiType, 0, 0)
+	modelID := resolveOpenClawModelID(provider, modelName)
+	switch provider {
+	case "deepseek":
+		return newOpenClawProviderPatch(modelName, "deepseek", modelID, apiKey, baseURL, "openai-completions", false), nil
+	case "gemini":
+		return newOpenClawProviderPatch("google/"+modelID, "google", modelID, apiKey, baseURL, resolvedAPIType, false), nil
+	case "moonshot", "kimi":
+		return buildMoonshotProviderPatch(provider, modelName, modelID, baseURL, apiKey), nil
+	case "bailian-coding-plan":
+		return newOpenClawProviderPatch("bailian-coding-plan/"+modelID, "bailian-coding-plan", modelID, apiKey, baseURL, "openai-completions", false), nil
+	case "ark-coding-plan":
+		return newOpenClawProviderPatch("ark-coding-plan/"+modelID, "ark-coding-plan", modelID, apiKey, baseURL, "openai-completions", false), nil
+	case "minimax":
+		return newOpenClawProviderPatch("minimax/"+modelID, "minimax", modelID, apiKey, baseURL, "anthropic-messages", true), nil
+	case "xiaomi":
+		return newOpenClawProviderPatch("xiaomi/"+modelID, "xiaomi", modelID, apiKey, baseURL, "openai-completions", false), nil
+	case "custom", "vllm":
+		return newOpenClawProviderPatch(provider+"/"+modelID, provider, modelID, apiKey, baseURL, resolvedAPIType, false), nil
+	case "ollama":
+		return newOpenClawProviderPatch(modelName, "ollama", modelID, "ollama", baseURL, resolvedAPIType, false), nil
+	case "kimi-coding":
+		return newOpenClawProviderPatch(modelName, "kimi-coding", modelID, apiKey, baseURL, "anthropic-messages", false), nil
+	case "zai":
+		return newOpenClawProviderPatch("zai/"+modelID, "zai", modelID, apiKey, baseURL, "openai-completions", false), nil
+	default:
+		return newOpenClawProviderPatch(modelName, provider, modelID, apiKey, baseURL, resolvedAPIType, false), nil
+	}
+}
+
+func buildMoonshotProviderPatch(provider, modelName, modelID, baseURL, apiKey string) *OpenClawProviderPatch {
+	providerKey := provider
+	primaryModel := modelName
+	if provider == "kimi" {
+		providerKey = "moonshot"
+		primaryModel = "moonshot/" + modelID
+	}
+	return newOpenClawProviderPatch(primaryModel, providerKey, modelID, apiKey, baseURL, "openai-completions", false)
+}
+
+func newOpenClawProviderPatch(primaryModel, providerKey, modelID, apiKey, baseURL, apiType string, authHeader bool) *OpenClawProviderPatch {
+	return &OpenClawProviderPatch{
+		PrimaryModel: primaryModel,
+		ProviderKey:  providerKey,
+		ModelID:      modelID,
+		APIKey:       apiKey,
+		BaseURL:      baseURL,
+		APIType:      apiType,
+		AuthHeader:   authHeader,
+	}
+}
+
+func resolveOpenClawModelID(provider, modelName string) string {
+	if provider == "custom" || provider == "vllm" {
+		target := strings.TrimLeft(modelName, "/")
+		if parts := strings.SplitN(target, "/", 2); len(parts) == 2 && parts[0] == "custom" {
+			return strings.TrimLeft(parts[1], "/")
+		}
+		return target
+	}
+	if parts := strings.SplitN(modelName, "/", 2); len(parts) == 2 {
+		return parts[1]
+	}
+	return modelName
+}
@@ -0,0 +1,181 @@
+package provider
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+)
+
+type VerifyRequest struct {
+	Method  string
+	URL     string
+	Headers map[string]string
+	Body    []byte
+}
+
+const (
+	defaultVerifyTimeout = 30 * time.Second
+)
+
+func SkipVerification(key string) bool {
+	switch key {
+	case "custom", "vllm", "ollama", "kimi-coding":
+		return true
+	default:
+		return false
+	}
+}
+
+func VerifyAccount(provider, baseURL, apiKey string) error {
+	req := BuildVerifyRequest(provider, baseURL, apiKey)
+	var body *bytes.Buffer
+	if len(req.Body) > 0 {
+		body = bytes.NewBuffer(req.Body)
+	} else {
+		body = bytes.NewBuffer(nil)
+	}
+	httpReq, err := http.NewRequest(req.Method, req.URL, body)
+	if err != nil {
+		return err
+	}
+	for key, value := range req.Headers {
+		httpReq.Header.Set(key, value)
+	}
+	resp, err := (&http.Client{Timeout: verifyTimeout()}).Do(httpReq)
+	if err != nil {
+		return buserr.WithErr("ErrAgentAccountUnavailable", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 400 {
+		return buserr.WithErr("ErrAgentAccountUnavailable", fmt.Errorf("verify failed: %s", resp.Status))
+	}
+	return nil
+}
+
+func verifyTimeout() time.Duration {
+	return defaultVerifyTimeout
+}
+
+func BuildVerifyRequest(provider, baseURL, apiKey string) VerifyRequest {
+	base := strings.TrimRight(strings.TrimSpace(baseURL), "/")
+	headers := map[string]string{}
+	request := VerifyRequest{Method: http.MethodGet, Headers: headers}
+
+	switch provider {
+	case "anthropic", "kimi-coding":
+		headers["x-api-key"] = apiKey
+		headers["anthropic-version"] = "2023-06-01"
+		if strings.Contains(base, "/v1") {
+			request.URL = base + "/models"
+		} else {
+			request.URL = base + "/v1/models"
+		}
+	case "gemini":
+		request.Method = http.MethodPost
+		if strings.Contains(base, "/v1beta") {
+			request.URL = base + "/models/gemini-3-flash-preview:generateContent"
+		} else {
+			request.URL = base + "/v1beta/models/gemini-3-flash-preview:generateContent"
+		}
+		headers["x-goog-api-key"] = apiKey
+		headers["Content-Type"] = "application/json"
+		request.Body = mustJSON(map[string]interface{}{
+			"contents": []map[string]interface{}{{
+				"parts": []map[string]string{{
+					"text": "Explain how AI works in a few words",
+				}},
+			}},
+		})
+	case "zai":
+		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
+		request.URL = base + "/models"
+	case "bailian-coding-plan":
+		request.Method = http.MethodPost
+		if !strings.Contains(base, "/v1") {
+			base = base + "/v1"
+		}
+		request.URL = base + "/chat/completions"
+		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
+		headers["Content-Type"] = "application/json"
+		request.Body = mustJSON(map[string]interface{}{
+			"model":      "qwen3.5-plus",
+			"messages":   []map[string]string{{"role": "user", "content": "test"}},
+			"max_tokens": 1,
+		})
+	case "ark-coding-plan":
+		request.Method = http.MethodPost
+		if !strings.Contains(base, "/api/coding/v3") {
+			base = "https://ark.cn-beijing.volces.com/api/coding/v3"
+		}
+		request.URL = base + "/chat/completions"
+		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
+		headers["Content-Type"] = "application/json"
+		request.Body = mustJSON(map[string]interface{}{
+			"model":      "ark-code-latest",
+			"messages":   []map[string]string{{"role": "user", "content": "test"}},
+			"max_tokens": 1,
+		})
+	case "minimax":
+		request.Method = http.MethodPost
+		headers["x-api-key"] = apiKey
+		headers["anthropic-version"] = "2023-06-01"
+		headers["Content-Type"] = "application/json"
+		if strings.Contains(base, "/v1") {
+			request.URL = base + "/messages"
+		} else {
+			request.URL = base + "/v1/messages"
+		}
+		request.Body = mustJSON(map[string]interface{}{
+			"model":      "MiniMax-M2.5",
+			"max_tokens": 1,
+			"messages": []map[string]interface{}{{
+				"role": "user",
+				"content": []map[string]string{{
+					"type": "text",
+					"text": "test",
+				}},
+			}},
+		})
+	case "xiaomi":
+		request.Method = http.MethodPost
+		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
+		headers["Content-Type"] = "application/json"
+		if !strings.Contains(base, "/v1") {
+			base = base + "/v1"
+		}
+		request.URL = base + "/chat/completions"
+		request.Body = mustJSON(map[string]interface{}{
+			"model":      "mimo-v2-flash",
+			"max_tokens": 1,
+			"messages":   []map[string]string{{"role": "user", "content": "test"}},
+		})
+	case "openrouter":
+		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
+		if strings.Contains(base, "/v1") {
+			request.URL = base + "/key"
+		} else {
+			request.URL = base + "/v1/key"
+		}
+	default:
+		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
+		if strings.Contains(base, "/v1") {
+			request.URL = base + "/models"
+		} else {
+			request.URL = base + "/v1/models"
+		}
+	}
+	return request
+}
+
+func mustJSON(value interface{}) []byte {
+	payload, err := json.Marshal(value)
+	if err != nil {
+		return []byte("{}")
+	}
+	return payload
+}
@@ -0,0 +1,83 @@
+package repo
+
+import (
+	"context"
+
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+)
+
+type AgentRepo struct{}
+
+type IAgentRepo interface {
+	Page(page, size int, opts ...DBOption) (int64, []model.Agent, error)
+	GetFirst(opts ...DBOption) (*model.Agent, error)
+	Create(agent *model.Agent) error
+	Save(agent *model.Agent) error
+	DeleteByID(id uint) error
+	DeleteByAppInstallID(appInstallID uint) error
+	DeleteByAppInstallIDWithCtx(ctx context.Context, appInstallID uint) error
+	ClearWebsiteIDByWebsiteIDWithCtx(ctx context.Context, websiteID uint) error
+	List(opts ...DBOption) ([]model.Agent, error)
+}
+
+func NewIAgentRepo() IAgentRepo {
+	return &AgentRepo{}
+}
+
+func (a AgentRepo) Page(page, size int, opts ...DBOption) (int64, []model.Agent, error) {
+	var agents []model.Agent
+	db := getDb(opts...).Model(&model.Agent{})
+	count := int64(0)
+	db = db.Count(&count)
+	err := db.Limit(size).Offset(size * (page - 1)).Find(&agents).Error
+	return count, agents, err
+}
+
+func (a AgentRepo) GetFirst(opts ...DBOption) (*model.Agent, error) {
+	var agent model.Agent
+	if err := getDb(opts...).First(&agent).Error; err != nil {
+		return nil, err
+	}
+	return &agent, nil
+}
+
+func (a AgentRepo) Create(agent *model.Agent) error {
+	return getDb().Create(agent).Error
+}
+
+func (a AgentRepo) Save(agent *model.Agent) error {
+	return getDb().Save(agent).Error
+}
+
+func (a AgentRepo) DeleteByID(id uint) error {
+	return getDb().Delete(&model.Agent{}, id).Error
+}
+
+func (a AgentRepo) DeleteByAppInstallID(appInstallID uint) error {
+	if appInstallID == 0 {
+		return nil
+	}
+	return getDb().Where("app_install_id = ?", appInstallID).Delete(&model.Agent{}).Error
+}
+
+func (a AgentRepo) DeleteByAppInstallIDWithCtx(ctx context.Context, appInstallID uint) error {
+	if appInstallID == 0 {
+		return nil
+	}
+	return getTx(ctx).Where("app_install_id = ?", appInstallID).Delete(&model.Agent{}).Error
+}
+
+func (a AgentRepo) ClearWebsiteIDByWebsiteIDWithCtx(ctx context.Context, websiteID uint) error {
+	if websiteID == 0 {
+		return nil
+	}
+	return getTx(ctx).Model(&model.Agent{}).Where("website_id = ?", websiteID).Update("website_id", 0).Error
+}
+
+func (a AgentRepo) List(opts ...DBOption) ([]model.Agent, error) {
+	var agents []model.Agent
+	if err := getDb(opts...).Find(&agents).Error; err != nil {
+		return nil, err
+	}
+	return agents, nil
+}
@@ -0,0 +1,55 @@
+package repo
+
+import "github.com/1Panel-dev/1Panel/agent/app/model"
+
+type AgentAccountRepo struct{}
+
+type IAgentAccountRepo interface {
+	Page(page, size int, opts ...DBOption) (int64, []model.AgentAccount, error)
+	GetFirst(opts ...DBOption) (*model.AgentAccount, error)
+	Create(account *model.AgentAccount) error
+	Save(account *model.AgentAccount) error
+	DeleteByID(id uint) error
+	List(opts ...DBOption) ([]model.AgentAccount, error)
+}
+
+func NewIAgentAccountRepo() IAgentAccountRepo {
+	return &AgentAccountRepo{}
+}
+
+func (a AgentAccountRepo) Page(page, size int, opts ...DBOption) (int64, []model.AgentAccount, error) {
+	var accounts []model.AgentAccount
+	db := getDb(opts...).Model(&model.AgentAccount{})
+	count := int64(0)
+	db = db.Count(&count)
+	err := db.Limit(size).Offset(size * (page - 1)).Find(&accounts).Error
+	return count, accounts, err
+}
+
+func (a AgentAccountRepo) GetFirst(opts ...DBOption) (*model.AgentAccount, error) {
+	var account model.AgentAccount
+	if err := getDb(opts...).First(&account).Error; err != nil {
+		return nil, err
+	}
+	return &account, nil
+}
+
+func (a AgentAccountRepo) Create(account *model.AgentAccount) error {
+	return getDb().Create(account).Error
+}
+
+func (a AgentAccountRepo) Save(account *model.AgentAccount) error {
+	return getDb().Save(account).Error
+}
+
+func (a AgentAccountRepo) DeleteByID(id uint) error {
+	return getDb().Delete(&model.AgentAccount{}, id).Error
+}
+
+func (a AgentAccountRepo) List(opts ...DBOption) ([]model.AgentAccount, error) {
+	var accounts []model.AgentAccount
+	if err := getDb(opts...).Find(&accounts).Error; err != nil {
+		return nil, err
+	}
+	return accounts, nil
+}
@@ -0,0 +1,50 @@
+package repo
+
+import "github.com/1Panel-dev/1Panel/agent/app/model"
+
+type AgentAccountModelRepo struct{}
+
+type IAgentAccountModelRepo interface {
+	List(opts ...DBOption) ([]model.AgentAccountModel, error)
+	GetFirst(opts ...DBOption) (*model.AgentAccountModel, error)
+	Create(item *model.AgentAccountModel) error
+	Save(item *model.AgentAccountModel) error
+	DeleteByID(id uint) error
+	Delete(opts ...DBOption) error
+}
+
+func NewIAgentAccountModelRepo() IAgentAccountModelRepo {
+	return &AgentAccountModelRepo{}
+}
+
+func (a AgentAccountModelRepo) List(opts ...DBOption) ([]model.AgentAccountModel, error) {
+	var list []model.AgentAccountModel
+	if err := getDb(opts...).Find(&list).Error; err != nil {
+		return nil, err
+	}
+	return list, nil
+}
+
+func (a AgentAccountModelRepo) GetFirst(opts ...DBOption) (*model.AgentAccountModel, error) {
+	var item model.AgentAccountModel
+	if err := getDb(opts...).First(&item).Error; err != nil {
+		return nil, err
+	}
+	return &item, nil
+}
+
+func (a AgentAccountModelRepo) Create(item *model.AgentAccountModel) error {
+	return getDb().Create(item).Error
+}
+
+func (a AgentAccountModelRepo) Save(item *model.AgentAccountModel) error {
+	return getDb().Save(item).Error
+}
+
+func (a AgentAccountModelRepo) DeleteByID(id uint) error {
+	return getDb().Delete(&model.AgentAccountModel{}, id).Error
+}
+
+func (a AgentAccountModelRepo) Delete(opts ...DBOption) error {
+	return getDb(opts...).Delete(&model.AgentAccountModel{}).Error
+}
@@ -20,6 +20,7 @@ type IAppRepo interface {
 	WithResource(resource string) DBOption
 	WithNotLocal() DBOption
 	WithByLikeName(name string) DBOption
+	WithKeyIn(keys []string) DBOption
 	WithArch(arch string) DBOption
 	WithPanelVersion(panelVersion string) DBOption

@@ -55,6 +56,12 @@ func (a AppRepo) WithKey(key string) DBOption {
 	}
 }

+func (a AppRepo) WithKeyIn(keys []string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("`key` in (?)", keys)
+	}
+}
+
 func (a AppRepo) WithType(typeStr string) DBOption {
 	return func(g *gorm.DB) *gorm.DB {
 		return g.Where("type = ?", typeStr)
@@ -80,9 +80,10 @@ func (u *LauncherRepo) ListQuickJump(withAll bool) []model.QuickJump {
 	}
 	if !withAll && len(quicks) == 0 {
 		return []model.QuickJump{
+			{Name: "Agent", Title: "aiTools.agents.agent", Recommend: 1, IsShow: true, Router: "/ai/agents/agent"},
 			{Name: "Website", Title: "menu.website", Recommend: 10, IsShow: true, Router: "/websites"},
 			{Name: "Database", Title: "menu.database", Recommend: 30, IsShow: true, Router: "/databases"},
-			{Name: "Cronjob", Title: "menu.cronjob", Recommend: 50, IsShow: true, Router: "/cronjobs"},
+			{Name: "Cronjob", Title: "menu.cronjob", Recommend: 50, IsShow: false, Router: "/cronjobs"},
 			{Name: "AppInstalled", Title: "home.appInstalled", Recommend: 70, IsShow: true, Router: "/apps/installed"},
 		}
 	}
@@ -7,6 +7,7 @@ import (

 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/utils/re"
 	"gorm.io/gorm"
 )

@@ -18,6 +19,12 @@ func WithByID(id uint) DBOption {
 	}
 }

+func WithByGroupID(id uint) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		return g.Where("group_id = ?", id)
+	}
+}
+
 func WithByNOTID(id uint) DBOption {
 	return func(g *gorm.DB) *gorm.DB {
 		return g.Where("id != ?", id)
@@ -42,6 +49,12 @@ func WithByName(name string) DBOption {
 	}
 }

+func WithByAddr(addr string) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		return g.Where("addr = ?", addr)
+	}
+}
+
 func WithByKey(key string) DBOption {
 	return func(g *gorm.DB) *gorm.DB {
 		return g.Where("key = ?", key)
@@ -72,6 +85,51 @@ func WithByDetailName(detailName string) DBOption {
 	}
 }

+func WithByProvider(provider string) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		if len(provider) == 0 {
+			return g
+		}
+		return g.Where("provider = ?", provider)
+	}
+}
+
+func WithByModel(model string) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		if len(model) == 0 {
+			return g
+		}
+		return g.Where("model = ?", model)
+	}
+}
+
+func WithByAccountID(accountID uint) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		if accountID == 0 {
+			return g
+		}
+		return g.Where("account_id = ?", accountID)
+	}
+}
+
+func WithByWebsiteID(websiteID uint) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		if websiteID == 0 {
+			return g
+		}
+		return g.Where("website_id = ?", websiteID)
+	}
+}
+
+func WithByAppInstallID(appInstallID uint) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		if appInstallID == 0 {
+			return g
+		}
+		return g.Where("app_install_id = ?", appInstallID)
+	}
+}
+
 func WithByType(tp string) DBOption {
 	return func(g *gorm.DB) *gorm.DB {
 		return g.Where("`type` = ?", tp)
@@ -124,23 +182,30 @@ func WithByCreatedAt(startTime, endTime time.Time) DBOption {
 	}
 }

-func WithOrderBy(orderStr string) DBOption {
-	if orderStr == "createdAt" {
-		orderStr = "created_at"
-	}
-	return func(g *gorm.DB) *gorm.DB {
-		return g.Order(orderStr)
-	}
+func WithOrderDesc(orderBy string) DBOption {
+	return WithOrderRuleBy(orderBy, constant.Desc)
 }
+
+func WithOrderAsc(orderBy string) DBOption {
+	return WithOrderRuleBy(orderBy, constant.Asc)
+}
+
 func WithOrderRuleBy(orderBy, order string) DBOption {
 	if orderBy == "createdAt" {
 		orderBy = "created_at"
 	}
+	if !re.GetRegex(re.OrderByValidationPattern).MatchString(orderBy) {
+		orderBy = "created_at"
+	}
 	switch order {
 	case constant.OrderDesc:
 		order = "desc"
 	case constant.OrderAsc:
 		order = "asc"
+	case constant.Desc:
+		order = "desc"
+	case constant.Asc:
+		order = "asc"
 	default:
 		orderBy = "created_at"
 		order = "desc"
@@ -0,0 +1,113 @@
+package repo
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/utils/encrypt"
+	"gorm.io/gorm"
+)
+
+type MongodbRepo struct{}
+
+type IMongodbRepo interface {
+	Get(opts ...DBOption) (model.DatabaseMongodb, error)
+	WithByMongodbName(mongodbName string) DBOption
+	List(opts ...DBOption) ([]model.DatabaseMongodb, error)
+	Page(limit, offset int, opts ...DBOption) (int64, []model.DatabaseMongodb, error)
+	Create(ctx context.Context, mongodb *model.DatabaseMongodb) error
+	Delete(ctx context.Context, opts ...DBOption) error
+	Update(id uint, vars map[string]interface{}) error
+	DeleteLocal(ctx context.Context) error
+}
+
+func NewIMongodbRepo() IMongodbRepo {
+	return &MongodbRepo{}
+}
+
+func (u *MongodbRepo) Get(opts ...DBOption) (model.DatabaseMongodb, error) {
+	var mongodb model.DatabaseMongodb
+	db := global.DB
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	if err := db.First(&mongodb).Error; err != nil {
+		return mongodb, err
+	}
+
+	pass, err := encrypt.StringDecrypt(mongodb.Password)
+	if err != nil {
+		global.LOG.Errorf("decrypt mongodb db %s password failed, err: %v", mongodb.Name, err)
+	}
+	mongodb.Password = pass
+	return mongodb, err
+}
+
+func (u *MongodbRepo) List(opts ...DBOption) ([]model.DatabaseMongodb, error) {
+	var mongodbs []model.DatabaseMongodb
+	db := global.DB.Model(&model.DatabaseMongodb{})
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	if err := db.Find(&mongodbs).Error; err != nil {
+		return mongodbs, err
+	}
+	for i := 0; i < len(mongodbs); i++ {
+		pass, err := encrypt.StringDecrypt(mongodbs[i].Password)
+		if err != nil {
+			global.LOG.Errorf("decrypt mongodb db %s password failed, err: %v", mongodbs[i].Name, err)
+		}
+		mongodbs[i].Password = pass
+	}
+	return mongodbs, nil
+}
+
+func (u *MongodbRepo) Page(page, size int, opts ...DBOption) (int64, []model.DatabaseMongodb, error) {
+	var mongodbs []model.DatabaseMongodb
+	db := global.DB.Model(&model.DatabaseMongodb{})
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	count := int64(0)
+	db = db.Count(&count)
+	if err := db.Limit(size).Offset(size * (page - 1)).Find(&mongodbs).Error; err != nil {
+		return count, mongodbs, err
+	}
+	for i := 0; i < len(mongodbs); i++ {
+		pass, err := encrypt.StringDecrypt(mongodbs[i].Password)
+		if err != nil {
+			global.LOG.Errorf("decrypt mongodb db %s password failed, err: %v", mongodbs[i].Name, err)
+		}
+		mongodbs[i].Password = pass
+	}
+	return count, mongodbs, nil
+}
+
+func (u *MongodbRepo) Create(ctx context.Context, mongodb *model.DatabaseMongodb) error {
+	pass, err := encrypt.StringEncrypt(mongodb.Password)
+	if err != nil {
+		return fmt.Errorf("encrypt mongodb db %s password failed, err: %v", mongodb.Name, err)
+	}
+	mongodb.Password = pass
+	return getTx(ctx).Create(mongodb).Error
+}
+
+func (u *MongodbRepo) Delete(ctx context.Context, opts ...DBOption) error {
+	return getTx(ctx, opts...).Delete(&model.DatabaseMongodb{}).Error
+}
+
+func (u *MongodbRepo) DeleteLocal(ctx context.Context) error {
+	return getTx(ctx).Where("`from` = ?", "local").Delete(&model.DatabaseMongodb{}).Error
+}
+
+func (u *MongodbRepo) Update(id uint, vars map[string]interface{}) error {
+	return global.DB.Model(&model.DatabaseMongodb{}).Where("id = ?", id).Updates(vars).Error
+}
+
+func (u *MongodbRepo) WithByMongodbName(mongodbName string) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		return g.Where("mongodb_name = ?", mongodbName)
+	}
+}
@@ -0,0 +1,121 @@
+package repo
+
+import (
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"gorm.io/gorm"
+)
+
+type FileHistoryRepo struct{}
+
+type IFileHistoryRepo interface {
+	Get(opts ...DBOption) (model.FileHistory, error)
+	Page(limit, offset int, opts ...DBOption) (int64, []model.FileHistory, error)
+	Create(history *model.FileHistory) error
+	Delete(opts ...DBOption) error
+	DeleteByIDs(ids []uint) error
+	WithByID(id uint) DBOption
+	WithByFileID(fileID string) DBOption
+	WithByPath(path string) DBOption
+	WithByPathHash(pathHash string) DBOption
+	WithByPathLike(path string) DBOption
+	WithByOperation(operation string) DBOption
+	WithNotOperation(operation string) DBOption
+	WithByRelatedPath(path string) DBOption
+}
+
+func NewIFileHistoryRepo() IFileHistoryRepo {
+	return &FileHistoryRepo{}
+}
+
+func (r *FileHistoryRepo) Get(opts ...DBOption) (model.FileHistory, error) {
+	var item model.FileHistory
+	db := global.DB.Model(&model.FileHistory{})
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	return item, db.First(&item).Error
+}
+
+func (r *FileHistoryRepo) Page(limit, offset int, opts ...DBOption) (int64, []model.FileHistory, error) {
+	var total int64
+	var items []model.FileHistory
+	db := global.DB.Model(&model.FileHistory{})
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	if err := db.Count(&total).Error; err != nil {
+		return 0, nil, err
+	}
+	if err := db.Order("created_at desc").Limit(limit).Offset(offset).Find(&items).Error; err != nil {
+		return 0, nil, err
+	}
+	return total, items, nil
+}
+
+func (r *FileHistoryRepo) Create(history *model.FileHistory) error {
+	return global.DB.Create(history).Error
+}
+
+func (r *FileHistoryRepo) Delete(opts ...DBOption) error {
+	db := global.DB.Model(&model.FileHistory{})
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	return db.Delete(&model.FileHistory{}).Error
+}
+
+func (r *FileHistoryRepo) DeleteByIDs(ids []uint) error {
+	if len(ids) == 0 {
+		return nil
+	}
+	return global.DB.Where("id in ?", ids).Delete(&model.FileHistory{}).Error
+}
+
+func (r *FileHistoryRepo) WithByID(id uint) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("id = ?", id)
+	}
+}
+
+func (r *FileHistoryRepo) WithByFileID(fileID string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("file_id = ?", fileID)
+	}
+}
+
+func (r *FileHistoryRepo) WithByPath(path string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("path = ?", path)
+	}
+}
+
+func (r *FileHistoryRepo) WithByPathHash(pathHash string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("path_hash = ?", pathHash)
+	}
+}
+
+func (r *FileHistoryRepo) WithByPathLike(path string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("path like ?", "%"+path+"%")
+	}
+}
+
+func (r *FileHistoryRepo) WithByOperation(operation string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("operation = ?", operation)
+	}
+}
+
+func (r *FileHistoryRepo) WithNotOperation(operation string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("operation <> ?", operation)
+	}
+}
+
+func (r *FileHistoryRepo) WithByRelatedPath(path string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("path = ? OR source_path = ? OR target_path = ?", path, path, path)
+	}
+}
@@ -0,0 +1,77 @@
+package repo
+
+import (
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"gorm.io/gorm"
+)
+
+type FileShareRepo struct{}
+
+type IFileShareRepo interface {
+	Page(page, size int, opts ...DBOption) (int64, []model.FileShare, error)
+	Create(fileShare *model.FileShare) error
+	Save(fileShare *model.FileShare) error
+	Delete(opts ...DBOption) error
+	GetFirst(opts ...DBOption) (model.FileShare, error)
+	All() ([]model.FileShare, error)
+	WithByPath(path string) DBOption
+	WithByCode(code string) DBOption
+}
+
+func NewIFileShareRepo() IFileShareRepo {
+	return &FileShareRepo{}
+}
+
+func (r *FileShareRepo) WithByPath(path string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("path = ?", path)
+	}
+}
+
+func (r *FileShareRepo) WithByCode(code string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("token = ?", code)
+	}
+}
+
+func (r *FileShareRepo) Page(page, size int, opts ...DBOption) (int64, []model.FileShare, error) {
+	var (
+		items []model.FileShare
+		count int64
+	)
+	db := getDb(opts...).Model(&model.FileShare{})
+	db = db.Count(&count)
+	err := db.Order("path asc").Limit(size).Offset(size * (page - 1)).Find(&items).Error
+	return count, items, err
+}
+
+func (r *FileShareRepo) Create(fileShare *model.FileShare) error {
+	return global.DB.Create(fileShare).Error
+}
+
+func (r *FileShareRepo) Save(fileShare *model.FileShare) error {
+	return global.DB.Save(fileShare).Error
+}
+
+func (r *FileShareRepo) GetFirst(opts ...DBOption) (model.FileShare, error) {
+	var item model.FileShare
+	db := getDb(opts...).Model(&model.FileShare{})
+	if err := db.First(&item).Error; err != nil {
+		return item, err
+	}
+	return item, nil
+}
+
+func (r *FileShareRepo) Delete(opts ...DBOption) error {
+	db := getDb(opts...).Model(&model.FileShare{})
+	return db.Delete(&model.FileShare{}).Error
+}
+
+func (r *FileShareRepo) All() ([]model.FileShare, error) {
+	var items []model.FileShare
+	if err := getDb().Order("path asc").Find(&items).Error; err != nil {
+		return nil, err
+	}
+	return items, nil
+}
@@ -10,6 +10,18 @@ import (
 type HostRepo struct{}

 type IHostRepo interface {
+	Get(opts ...DBOption) (model.Host, error)
+	GetList(opts ...DBOption) ([]model.Host, error)
+	Page(limit, offset int, opts ...DBOption) (int64, []model.Host, error)
+	Create(host *model.Host) error
+	Update(id uint, vars map[string]interface{}) error
+	UpdateGroup(group, newGroup uint) error
+	Delete(opts ...DBOption) error
+
+	WithByInfo(info string) DBOption
+	WithByPort(port uint) DBOption
+	WithByUser(user string) DBOption
+
 	GetFirewallRecord(opts ...DBOption) (model.Firewall, error)
 	ListFirewallRecord(opts ...DBOption) ([]model.Firewall, error)
 	SaveFirewallRecord(firewall *model.Firewall) error
@@ -30,6 +42,80 @@ func NewIHostRepo() IHostRepo {
 	return &HostRepo{}
 }

+func (h *HostRepo) Get(opts ...DBOption) (model.Host, error) {
+	var host model.Host
+	db := global.DB
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	err := db.First(&host).Error
+	return host, err
+}
+
+func (h *HostRepo) GetList(opts ...DBOption) ([]model.Host, error) {
+	var hosts []model.Host
+	db := global.DB.Model(&model.Host{})
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	err := db.Find(&hosts).Error
+	return hosts, err
+}
+
+func (h *HostRepo) Page(page, size int, opts ...DBOption) (int64, []model.Host, error) {
+	var hosts []model.Host
+	db := global.DB.Model(&model.Host{})
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	count := int64(0)
+	db = db.Count(&count)
+	err := db.Limit(size).Offset(size * (page - 1)).Find(&hosts).Error
+	return count, hosts, err
+}
+
+func (h *HostRepo) WithByInfo(info string) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		if len(info) == 0 {
+			return g
+		}
+		infoStr := "%" + info + "%"
+		return g.Where("name LIKE ? OR addr LIKE ?", infoStr, infoStr)
+	}
+}
+
+func (h *HostRepo) WithByPort(port uint) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		return g.Where("port = ?", port)
+	}
+}
+
+func (h *HostRepo) WithByUser(user string) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		return g.Where("user = ?", user)
+	}
+}
+
+func (h *HostRepo) Create(host *model.Host) error {
+	return global.DB.Create(host).Error
+}
+
+func (h *HostRepo) Update(id uint, vars map[string]interface{}) error {
+	return global.DB.Model(&model.Host{}).Where("id = ?", id).Updates(vars).Error
+}
+
+func (h *HostRepo) UpdateGroup(group, newGroup uint) error {
+	return global.DB.Model(&model.Host{}).Where("group_id = ?", group).Updates(map[string]interface{}{"group_id": newGroup}).Error
+}
+
+func (h *HostRepo) Delete(opts ...DBOption) error {
+	db := global.DB
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	return db.Delete(&model.Host{}).Error
+}
+
 func (h *HostRepo) GetFirewallRecord(opts ...DBOption) (model.Firewall, error) {
 	var firewall model.Firewall
 	db := global.DB
@@ -79,6 +165,9 @@ func (h *HostRepo) SaveFirewallRecord(firewall *model.Firewall) error {
 			firewall.Strategy,
 		).First(&data).Error
 	}
+	if data.ID != 0 {
+		firewall.ID = data.ID
+	}
 	return global.DB.Save(firewall).Error
 }

@@ -73,28 +73,13 @@ func (u *MonitorRepo) CreateMonitorBase(model model.MonitorBase) error {
 	return global.MonitorDB.Create(&model).Error
 }
 func (s *MonitorRepo) BatchCreateMonitorGPU(list []model.MonitorGPU) error {
-	for _, item := range list {
-		if err := global.GPUMonitorDB.Create(&item).Error; err != nil {
-			global.LOG.Errorf("create Monitor GPU record failed, err: %v", err)
-		}
-	}
-	return nil
+	return global.GPUMonitorDB.CreateInBatches(&list, len(list)).Error
 }
-func (u *MonitorRepo) BatchCreateMonitorIO(list []model.MonitorIO) error {
-	for _, item := range list {
-		if err := global.MonitorDB.Create(&item).Error; err != nil {
-			global.LOG.Errorf("create Monitor IO record failed, err: %v", err)
-		}
-	}
-	return nil
+func (u *MonitorRepo) BatchCreateMonitorIO(ioList []model.MonitorIO) error {
+	return global.MonitorDB.CreateInBatches(ioList, len(ioList)).Error
 }
-func (u *MonitorRepo) BatchCreateMonitorNet(list []model.MonitorNetwork) error {
-	for _, item := range list {
-		if err := global.MonitorDB.Create(&item).Error; err != nil {
-			global.LOG.Errorf("create Monitor Network record failed, err: %v", err)
-		}
-	}
-	return nil
+func (u *MonitorRepo) BatchCreateMonitorNet(ioList []model.MonitorNetwork) error {
+	return global.MonitorDB.CreateInBatches(ioList, len(ioList)).Error
 }
 func (u *MonitorRepo) DelMonitorBase(timeForDelete time.Time) error {
 	return global.MonitorDB.Where("created_at < ?", timeForDelete).Delete(&model.MonitorBase{}).Error
@@ -10,6 +10,7 @@ import (

 type IWebsiteRepo interface {
 	WithAppInstallId(appInstallId uint) DBOption
+	WithAppInstallIds(appInstallIds []uint) DBOption
 	WithDomain(domain string) DBOption
 	WithAlias(alias string) DBOption
 	WithWebsiteSSLID(sslId uint) DBOption
@@ -48,6 +49,15 @@ func (w *WebsiteRepo) WithAppInstallId(appInstallID uint) DBOption {
 	}
 }

+func (w *WebsiteRepo) WithAppInstallIds(appInstallIDs []uint) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		if len(appInstallIDs) == 0 {
+			return db
+		}
+		return db.Where("app_install_id in (?)", appInstallIDs)
+	}
+}
+
 func (w *WebsiteRepo) WithRuntimeID(runtimeID uint) DBOption {
 	return func(db *gorm.DB) *gorm.DB {
 		return db.Where("runtime_id = ?", runtimeID)
@@ -13,6 +13,7 @@ type WebsiteDomainRepo struct {

 type IWebsiteDomainRepo interface {
 	WithWebsiteId(websiteId uint) DBOption
+	WithWebsiteIds(websiteIds []uint) DBOption
 	WithPort(port int) DBOption
 	WithDomain(domain string) DBOption
 	WithDomainLike(domain string) DBOption
@@ -36,6 +37,15 @@ func (w WebsiteDomainRepo) WithWebsiteId(websiteId uint) DBOption {
 	}
 }

+func (w WebsiteDomainRepo) WithWebsiteIds(websiteIds []uint) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		if len(websiteIds) == 0 {
+			return db
+		}
+		return db.Where("website_id in (?)", websiteIds)
+	}
+}
+
 func (w WebsiteDomainRepo) WithPort(port int) DBOption {
 	return func(db *gorm.DB) *gorm.DB {
 		return db.Where("port = ?", port)
@@ -0,0 +1,533 @@
+package service
+
+import (
+	"os"
+	"path"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
+)
+
+var agentMarkdownFileNames = []string{"AGENTS.md", "SOUL.md", "USER.md", "IDENTITY.md", "TOOLS.md", "HEARTBEAT.md", "BOOT.md", "BOOTSTRAP.md"}
+
+func (a AgentService) CreateRole(req dto.AgentRoleCreateReq) (*dto.AgentRoleCreateResp, error) {
+	_, install, err := a.loadAgentAndInstall(req.AgentID)
+	if err != nil {
+		return nil, err
+	}
+
+	args := []string{"exec", install.ContainerName, "openclaw", "agents", "add", req.Name}
+	workspace := "/home/node/.openclaw/workspace-agent_" + req.Name
+	agentDir := "/home/node/.openclaw/agents/" + req.Name
+	args = append(args, "--workspace", workspace)
+	if model := strings.TrimSpace(req.Model); model != "" {
+		args = append(args, "--model", model)
+	}
+	for _, binding := range req.Bindings {
+		channel := binding.Channel
+		if channel == "" {
+			continue
+		}
+		if accountID := binding.AccountID; accountID != "" {
+			channel = channel + ":" + accountID
+		}
+		args = append(args, "--bind", channel)
+	}
+	args = append(args, "--agent-dir", agentDir)
+	args = append(args, "--non-interactive", "--json")
+
+	mgr := cmd.NewCommandMgr(cmd.WithTimeout(5 * time.Minute))
+	output, err := mgr.RunWithStdout("docker", args...)
+	if err != nil {
+		return nil, err
+	}
+	return &dto.AgentRoleCreateResp{Output: strings.TrimSpace(output)}, nil
+}
+
+func (a AgentService) GetConfiguredAgents(req dto.AgentConfiguredAgentsReq) ([]dto.AgentConfiguredAgentItem, error) {
+	agent, _, conf, err := a.loadAgentConfig(req.AgentID)
+	if err != nil {
+		return nil, err
+	}
+	agents, ok := conf["agents"].(map[string]interface{})
+	if !ok {
+		return []dto.AgentConfiguredAgentItem{}, nil
+	}
+	rawList, ok := agents["list"].([]interface{})
+	if !ok {
+		return []dto.AgentConfiguredAgentItem{}, nil
+	}
+	result := make([]dto.AgentConfiguredAgentItem, 0, len(rawList))
+	baseDir := path.Join(global.Dir.AppInstallDir, agent.AgentType, agent.Name, "data")
+	for _, item := range rawList {
+		record, ok := item.(map[string]interface{})
+		if !ok {
+			continue
+		}
+		configured := extractConfiguredAgentItem(baseDir, record)
+		if strings.EqualFold(configured.ID, "main") {
+			continue
+		}
+		result = append(result, configured)
+	}
+	applyConfiguredAgentBindings(result, conf["bindings"])
+	return result, nil
+}
+
+func (a AgentService) GetRoleChannels(req dto.AgentRoleChannelsReq) ([]dto.AgentRoleChannelItem, error) {
+	_, _, conf, err := a.loadAgentConfig(req.AgentID)
+	if err != nil {
+		return nil, err
+	}
+	channels, ok := conf["channels"].(map[string]interface{})
+	if !ok || len(channels) == 0 {
+		return []dto.AgentRoleChannelItem{}, nil
+	}
+	boundBindings := loadBoundChannelBindings(conf["bindings"])
+	result := make([]dto.AgentRoleChannelItem, 0, len(channels))
+	for key := range channels {
+		if key == "" {
+			continue
+		}
+		accountIDs := extractRoleChannelAccountIDs(conf, key)
+		availableAccountIDs := filterAvailableChannelAccountIDs(boundBindings, key, accountIDs)
+		result = append(result, dto.AgentRoleChannelItem{
+			Name:       key,
+			Bound:      isRoleChannelFullyBound(boundBindings, key, accountIDs, availableAccountIDs),
+			AccountIDs: availableAccountIDs,
+		})
+	}
+	sort.Slice(result, func(i, j int) bool {
+		return result[i].Name < result[j].Name
+	})
+	return result, nil
+}
+
+func (a AgentService) DeleteRole(req dto.AgentRoleDeleteReq) error {
+	agent, install, conf, err := a.loadAgentConfig(req.AgentID)
+	if err != nil {
+		return err
+	}
+
+	baseDir := path.Join(global.Dir.AppInstallDir, agent.AgentType, agent.Name, "data")
+	if req.ID == "" {
+		return buserr.New("ErrRecordNotFound")
+	}
+	target, ok := findConfiguredAgentByID(baseDir, conf, req.ID)
+	if !ok {
+		return buserr.New("ErrRecordNotFound")
+	}
+
+	args := []string{"exec", install.ContainerName, "openclaw", "agents", "delete", req.ID, "--force"}
+
+	mgr := cmd.NewCommandMgr(cmd.WithTimeout(5 * time.Minute))
+	if _, err = mgr.RunWithStdout("docker", args...); err != nil {
+		return err
+	}
+	if target.Workspace != "" {
+		if err := os.RemoveAll(target.Workspace); err != nil {
+			return err
+		}
+	}
+	if target.AgentDir != "" {
+		if err := os.RemoveAll(target.AgentDir); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (a AgentService) BindRole(req dto.AgentRoleBindReq) error {
+	return a.operateRoleBinding(req, "bind")
+}
+
+func (a AgentService) UnbindRole(req dto.AgentRoleBindReq) error {
+	return a.operateRoleBinding(req, "unbind")
+}
+
+func (a AgentService) operateRoleBinding(req dto.AgentRoleBindReq, action string) error {
+	agent, install, conf, err := a.loadAgentConfig(req.AgentID)
+	if err != nil {
+		return err
+	}
+
+	baseDir := path.Join(global.Dir.AppInstallDir, agent.AgentType, agent.Name, "data")
+	if req.ID == "" {
+		return buserr.New("ErrRecordNotFound")
+	}
+	if _, ok := findConfiguredAgentByID(baseDir, conf, req.ID); !ok {
+		return buserr.New("ErrRecordNotFound")
+	}
+
+	binding := formatRoleBinding(req.Channel, req.AccountID)
+	if binding == "" {
+		return buserr.New("ErrInvalidParams")
+	}
+	args := []string{
+		"exec",
+		install.ContainerName,
+		"openclaw",
+		"agents",
+		action,
+		"--agent",
+		req.ID,
+		"--bind",
+		binding,
+	}
+	args = append(args, "--json")
+	mgr := cmd.NewCommandMgr(cmd.WithTimeout(5 * time.Minute))
+	_, err = mgr.RunWithStdout("docker", args...)
+	return err
+}
+
+func (a AgentService) GetRoleMarkdownFiles(req dto.AgentRoleMarkdownFilesReq) ([]dto.AgentRoleMarkdownFileItem, error) {
+	agent, err := loadOpenclawAgentByID(req.AgentID)
+	if err != nil {
+		return nil, err
+	}
+
+	baseDir := path.Join(global.Dir.AppInstallDir, agent.AgentType, agent.Name, "data")
+	workspaceDir, err := resolveMarkdownWorkspaceDir(baseDir, req.Workspace)
+	if err != nil {
+		return nil, err
+	}
+
+	items := make([]dto.AgentRoleMarkdownFileItem, 0, len(agentMarkdownFileNames))
+	for _, name := range agentMarkdownFileNames {
+		item := dto.AgentRoleMarkdownFileItem{
+			Name: name,
+		}
+		content, readErr := os.ReadFile(path.Join(workspaceDir, name))
+		if readErr == nil {
+			item.Content = string(content)
+		} else if !os.IsNotExist(readErr) {
+			return nil, readErr
+		}
+		items = append(items, item)
+	}
+	return items, nil
+}
+
+func (a AgentService) UpdateRoleMarkdownFiles(req dto.AgentRoleMarkdownFilesUpdateReq) error {
+	agent, install, err := a.loadOpenclawAgentAndInstall(req.AgentID)
+	if err != nil {
+		return err
+	}
+
+	baseDir := path.Join(global.Dir.AppInstallDir, agent.AgentType, agent.Name, "data")
+	dirPath, err := resolveMarkdownWorkspaceDir(baseDir, req.Workspace)
+	if err != nil {
+		return err
+	}
+	if err = os.MkdirAll(dirPath, 0755); err != nil {
+		return err
+	}
+	for _, item := range req.Files {
+		file := path.Join(dirPath, item.Name)
+		if err = os.WriteFile(file, []byte(item.Content), 0644); err != nil {
+			return err
+		}
+	}
+	if req.Restart {
+		return NewIAppInstalledService().Operate(request.AppInstalledOperate{
+			InstallId: install.ID,
+			Operate:   constant.Restart,
+		})
+	}
+	return nil
+}
+
+func extractConfiguredAgentItem(installDir string, record map[string]interface{}) dto.AgentConfiguredAgentItem {
+	item := dto.AgentConfiguredAgentItem{Bindings: []dto.AgentRoleBinding{}}
+	if id, ok := record["id"].(string); ok {
+		item.ID = id
+	} else if id, ok := record["agentId"].(string); ok {
+		item.ID = id
+	}
+	if name, ok := record["name"].(string); ok {
+		item.Name = name
+	}
+	if workspace, ok := record["workspace"].(string); ok {
+		item.Workspace = resolveRoleDir(installDir, workspace)
+	}
+	if model, ok := record["model"].(string); ok {
+		item.Model = model
+	}
+	if agentDir, ok := record["agentDir"].(string); ok {
+		item.AgentDir = agentDir
+	} else if agentDir, ok := record["agent_dir"].(string); ok {
+		item.AgentDir = agentDir
+	}
+	item.AgentDir = resolveRoleDir(installDir, item.AgentDir)
+	return item
+}
+
+func findConfiguredAgentByID(baseDir string, conf map[string]interface{}, id string) (dto.AgentConfiguredAgentItem, bool) {
+	agents, ok := conf["agents"].(map[string]interface{})
+	if !ok {
+		return dto.AgentConfiguredAgentItem{}, false
+	}
+	rawList, ok := agents["list"].([]interface{})
+	if !ok {
+		return dto.AgentConfiguredAgentItem{}, false
+	}
+	for _, item := range rawList {
+		record, ok := item.(map[string]interface{})
+		if !ok {
+			continue
+		}
+		configured := extractConfiguredAgentItem(baseDir, record)
+		if strings.EqualFold(configured.ID, id) {
+			return configured, true
+		}
+	}
+	return dto.AgentConfiguredAgentItem{}, false
+}
+
+func formatRoleBinding(channel, accountID string) string {
+	if channel == "" {
+		return ""
+	}
+	if accountID == "" {
+		return channel
+	}
+	return channel + ":" + accountID
+}
+
+func applyConfiguredAgentBindings(agents []dto.AgentConfiguredAgentItem, value interface{}) {
+	bindings, ok := value.([]interface{})
+	if !ok || len(agents) == 0 {
+		return
+	}
+	indexByID := make(map[string]int, len(agents))
+	indexByName := make(map[string]int, len(agents))
+	for i, agent := range agents {
+		if agent.ID != "" {
+			indexByID[agent.ID] = i
+		}
+		if agent.Name != "" {
+			indexByName[agent.Name] = i
+		}
+	}
+	for _, binding := range bindings {
+		record, ok := binding.(map[string]interface{})
+		if !ok {
+			continue
+		}
+		if bindingType, _ := record["type"].(string); !strings.EqualFold(bindingType, "route") {
+			continue
+		}
+		targetID, _ := record["agentId"].(string)
+		if targetID == "" {
+			continue
+		}
+		match, ok := record["match"].(map[string]interface{})
+		if !ok {
+			continue
+		}
+		channel, _ := match["channel"].(string)
+		if channel == "" {
+			continue
+		}
+		index, ok := indexByID[targetID]
+		if !ok {
+			index, ok = indexByName[targetID]
+		}
+		if !ok {
+			continue
+		}
+		accountID, _ := match["accountId"].(string)
+		if accountID == "" {
+			accountID, _ = record["accountId"].(string)
+		}
+		agents[index].Bindings = append(agents[index].Bindings, dto.AgentRoleBinding{
+			Channel:   channel,
+			AccountID: accountID,
+		})
+	}
+}
+
+func loadBoundChannelBindings(value interface{}) map[string]map[string]struct{} {
+	result := make(map[string]map[string]struct{})
+	bindings, ok := value.([]interface{})
+	if !ok {
+		return result
+	}
+	for _, binding := range bindings {
+		record, ok := binding.(map[string]interface{})
+		if !ok {
+			continue
+		}
+		if bindingType, _ := record["type"].(string); !strings.EqualFold(bindingType, "route") {
+			continue
+		}
+		match, ok := record["match"].(map[string]interface{})
+		if !ok {
+			continue
+		}
+		channel, _ := match["channel"].(string)
+		if channel == "" {
+			continue
+		}
+		accountID, _ := match["accountId"].(string)
+		if accountID == "" {
+			accountID, _ = record["accountId"].(string)
+		}
+		if _, ok := result[channel]; !ok {
+			result[channel] = make(map[string]struct{})
+		}
+		result[channel][accountID] = struct{}{}
+	}
+	return result
+}
+
+func extractRoleChannelAccountIDs(conf map[string]interface{}, channel string) []string {
+	switch channel {
+	case "feishu":
+		config := extractFeishuConfig(conf)
+		accountIDs := make([]string, 0, len(config.Bots))
+		for _, item := range config.Bots {
+			if accountID := item.AccountID; accountID != "" {
+				accountIDs = append(accountIDs, accountID)
+			}
+		}
+		sort.Strings(accountIDs)
+		return accountIDs
+	case "telegram":
+		config := extractTelegramConfig(conf)
+		accountIDs := make([]string, 0, len(config.Bots))
+		for _, item := range config.Bots {
+			if accountID := item.AccountID; accountID != "" {
+				accountIDs = append(accountIDs, accountID)
+			}
+		}
+		sort.Strings(accountIDs)
+		return accountIDs
+	case "discord":
+		config := extractDiscordConfig(conf)
+		accountIDs := make([]string, 0, len(config.Bots))
+		for _, item := range config.Bots {
+			if accountID := item.AccountID; accountID != "" {
+				accountIDs = append(accountIDs, accountID)
+			}
+		}
+		sort.Strings(accountIDs)
+		return accountIDs
+	case "qqbot":
+		config := extractQQBotConfig(conf)
+		accountIDs := make([]string, 0, len(config.Bots))
+		for _, item := range config.Bots {
+			if accountID := item.AccountID; accountID != "" {
+				accountIDs = append(accountIDs, accountID)
+			}
+		}
+		sort.Strings(accountIDs)
+		return accountIDs
+	case "dingtalk-connector":
+		config := extractDingTalkConfig(conf)
+		accountIDs := make([]string, 0, len(config.Bots))
+		for _, item := range config.Bots {
+			if accountID := item.AccountID; accountID != "" {
+				accountIDs = append(accountIDs, accountID)
+			}
+		}
+		sort.Strings(accountIDs)
+		return accountIDs
+	case "wecom":
+		return []string{}
+	default:
+		return extractRawChannelAccountIDs(getChannelConfig(conf, channel))
+	}
+}
+
+func filterAvailableChannelAccountIDs(bindings map[string]map[string]struct{}, channel string, accountIDs []string) []string {
+	channelBindings, ok := bindings[channel]
+	if !ok || len(channelBindings) == 0 {
+		return append([]string(nil), accountIDs...)
+	}
+	if _, ok := channelBindings[""]; ok {
+		return []string{}
+	}
+	result := make([]string, 0, len(accountIDs))
+	for _, accountID := range accountIDs {
+		if _, ok := channelBindings[accountID]; ok {
+			continue
+		}
+		result = append(result, accountID)
+	}
+	return result
+}
+
+func isRoleChannelFullyBound(bindings map[string]map[string]struct{}, channel string, allAccountIDs, availableAccountIDs []string) bool {
+	channelBindings, ok := bindings[channel]
+	if !ok || len(channelBindings) == 0 {
+		return false
+	}
+	if _, ok := channelBindings[""]; ok {
+		return true
+	}
+	if len(allAccountIDs) == 0 {
+		return true
+	}
+	return len(availableAccountIDs) == 0
+}
+
+func extractRawChannelAccountIDs(channel map[string]interface{}) []string {
+	if len(channel) == 0 {
+		return []string{}
+	}
+	accounts, ok := channel["accounts"].(map[string]interface{})
+	if !ok || len(accounts) == 0 {
+		return []string{}
+	}
+	result := make([]string, 0, len(accounts))
+	for key := range accounts {
+		if key == "" {
+			continue
+		}
+		result = append(result, key)
+	}
+	sort.Strings(result)
+	return result
+}
+
+func resolveRoleDir(installDir, workspace string) string {
+	if workspace == "" {
+		return ""
+	}
+	if strings.HasPrefix(workspace, "/home/node/.openclaw/workspace/") {
+		return strings.ReplaceAll(workspace, "/home/node/.openclaw", installDir)
+	}
+	return strings.ReplaceAll(workspace, "/home/node/.openclaw", path.Join(installDir, "conf"))
+}
+
+func resolveMarkdownWorkspaceDir(installDir, workspace string) (string, error) {
+	if workspace == "" {
+		return "", buserr.New("ErrRecordNotFound")
+	}
+
+	confDir := path.Join(installDir, "conf")
+	allowedOpenclawPrefixes := []string{
+		"/home/node/.openclaw/workspace/",
+		"/home/node/.openclaw/workspace-agent_",
+	}
+	for _, prefix := range allowedOpenclawPrefixes {
+		if strings.HasPrefix(workspace, prefix) {
+			return resolveRoleDir(installDir, workspace), nil
+		}
+	}
+
+	cleanWorkspace := path.Clean(workspace)
+	cleanConfDir := path.Clean(confDir)
+	if cleanWorkspace == cleanConfDir || strings.HasPrefix(cleanWorkspace, cleanConfDir+"/") {
+		return cleanWorkspace, nil
+	}
+	return "", buserr.New("ErrRecordNotFound")
+}
@@ -0,0 +1,731 @@
+package service
+
+import (
+	"errors"
+	"fmt"
+	"path"
+	"strings"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	providercatalog "github.com/1Panel-dev/1Panel/agent/app/provider"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/utils/common"
+	agentenv "github.com/1Panel-dev/1Panel/agent/utils/env"
+	"github.com/1Panel-dev/1Panel/agent/utils/files"
+	"github.com/joho/godotenv"
+	"gopkg.in/yaml.v3"
+)
+
+const hermesWorkspaceDir = "/opt/data/workspace"
+const hermesExecutablePath = "/opt/hermes/.venv/bin/hermes"
+
+type hermesConfig struct {
+	Model    hermesModelConfig    `yaml:"model"`
+	Terminal hermesTerminalConfig `yaml:"terminal"`
+	Timezone string               `yaml:"timezone,omitempty"`
+}
+
+type hermesModelConfig struct {
+	Default  string `yaml:"default"`
+	Provider string `yaml:"provider"`
+	BaseURL  string `yaml:"base_url,omitempty"`
+	APIKey   string `yaml:"api_key,omitempty"`
+}
+
+type hermesTerminalConfig struct {
+	Backend string `yaml:"backend"`
+	Cwd     string `yaml:"cwd"`
+}
+
+type hermesEnvEntry struct {
+	Key   string
+	Value string
+}
+
+func buildHermesDockerExecCommandArgs(containerName, command string, commandArgs ...string) []string {
+	args := []string{"exec", "-u", "hermes", containerName, command}
+	return append(args, commandArgs...)
+}
+
+func buildHermesDockerExecArgs(containerName string, hermesArgs ...string) []string {
+	return buildHermesDockerExecCommandArgs(containerName, "hermes", hermesArgs...)
+}
+
+func writeHermesConfig(confDir string, account *model.AgentAccount, modelName string, timezone string) error {
+	if strings.TrimSpace(confDir) == "" {
+		return fmt.Errorf("config dir is required")
+	}
+	if account == nil {
+		return fmt.Errorf("account is required")
+	}
+	if strings.TrimSpace(modelName) == "" {
+		return fmt.Errorf("model is required")
+	}
+	fileOp := files.NewFileOp()
+	if !fileOp.Stat(confDir) {
+		if err := fileOp.CreateDir(confDir, constant.DirPerm); err != nil {
+			return err
+		}
+	}
+
+	provider := resolveHermesProvider(account.Provider)
+	configPath := path.Join(confDir, "config.yaml")
+	cfg, err := readHermesConfigMap(configPath)
+	if err != nil {
+		return err
+	}
+	model := map[string]interface{}{
+		"default":  resolveHermesModel(account.Provider, provider, modelName),
+		"provider": provider,
+		"base_url": account.BaseURL,
+	}
+	if provider == "custom" && account.APIKey != "" {
+		model["api_key"] = "${CUSTOM_API_KEY}"
+	}
+	cfg["model"] = model
+	cfg["terminal"] = map[string]interface{}{
+		"backend": "local",
+		"cwd":     hermesWorkspaceDir,
+	}
+	if timezone != "" {
+		cfg["timezone"] = timezone
+	} else {
+		delete(cfg, "timezone")
+	}
+	if err := writeHermesConfigMap(configPath, cfg); err != nil {
+		return err
+	}
+	return writeHermesModelEnv(path.Join(confDir, ".env"), account)
+}
+
+func prepareHermesInstallFiles(appInstall *model.AppInstall, account *model.AgentAccount, modelName string) error {
+	if appInstall == nil {
+		return fmt.Errorf("app install is required")
+	}
+	dataDir := path.Join(appInstall.GetPath(), "data")
+	if err := writeHermesConfig(dataDir, account, modelName, normalizeHermesTimezone(common.LoadTimeZoneByCmd())); err != nil {
+		return err
+	}
+	return files.NewFileOp().ChownR(dataDir, "1000", "1000", true)
+}
+
+func readHermesConfig(configPath string) (*hermesConfig, error) {
+	content, err := files.NewFileOp().GetContent(configPath)
+	if err != nil {
+		return nil, err
+	}
+	var cfg hermesConfig
+	if err := yaml.Unmarshal(content, &cfg); err != nil {
+		return nil, err
+	}
+	return &cfg, nil
+}
+
+func readHermesConfigMap(configPath string) (map[string]interface{}, error) {
+	fileOp := files.NewFileOp()
+	if !fileOp.Stat(configPath) {
+		return map[string]interface{}{}, nil
+	}
+	content, err := fileOp.GetContent(configPath)
+	if err != nil {
+		return nil, err
+	}
+	cfg := map[string]interface{}{}
+	if strings.TrimSpace(string(content)) == "" {
+		return cfg, nil
+	}
+	if err := yaml.Unmarshal(content, &cfg); err != nil {
+		return nil, err
+	}
+	return cfg, nil
+}
+
+func writeHermesConfigMap(configPath string, cfg map[string]interface{}) error {
+	payload, err := yaml.Marshal(cfg)
+	if err != nil {
+		return err
+	}
+	return files.NewFileOp().SaveFile(configPath, string(payload), 0600)
+}
+
+func readHermesTelegramChannelConfig(confDir string) (*dto.AgentTelegramConfig, error) {
+	envMap, err := readHermesEnvMap(path.Join(confDir, ".env"))
+	if err != nil {
+		return nil, err
+	}
+	cfg, err := readHermesConfigMap(path.Join(confDir, "config.yaml"))
+	if err != nil {
+		return nil, err
+	}
+
+	allowFrom := splitHermesEnvList(envMap["TELEGRAM_ALLOWED_USERS"])
+	requireMention := extractBoolValue(childMap(cfg, "telegram")["require_mention"], false)
+	dmPolicy := ""
+	if extractHermesEnvBool(envMap, "TELEGRAM_ALLOW_ALL_USERS", false) {
+		dmPolicy = "open"
+	} else if len(allowFrom) > 0 {
+		dmPolicy = "allowlist"
+	} else if envMap["TELEGRAM_BOT_TOKEN"] != "" {
+		dmPolicy = "pairing"
+	}
+	groupPolicy := ""
+	if requireMention {
+		groupPolicy = "allowlist"
+	} else if envMap["TELEGRAM_BOT_TOKEN"] != "" {
+		groupPolicy = "open"
+	}
+	token := envMap["TELEGRAM_BOT_TOKEN"]
+	result := &dto.AgentTelegramConfig{
+		Enabled:        token != "",
+		DmPolicy:       dmPolicy,
+		AllowFrom:      allowFrom,
+		RequireMention: requireMention,
+		GroupPolicy:    groupPolicy,
+		GroupAllowFrom: []string{},
+		Streaming:      "",
+		DefaultAccount: "",
+	}
+	if token != "" {
+		result.Bots = []dto.AgentTelegramBot{
+			{
+				AgentChannelBotBase: dto.AgentChannelBotBase{
+					AccountID: "default",
+					Name:      "Default",
+					Enabled:   true,
+					IsDefault: true,
+				},
+				BotToken:    token,
+				DmPolicy:    dmPolicy,
+				GroupPolicy: groupPolicy,
+				Streaming:   "",
+			},
+		}
+	}
+	return result, nil
+}
+
+func writeHermesTelegramChannelConfig(confDir string, config dto.AgentTelegramConfig) error {
+	envPath := path.Join(confDir, ".env")
+	envMap, err := readHermesEnvMap(envPath)
+	if err != nil {
+		return err
+	}
+	token := firstHermesTelegramBotToken(config.Bots, config.DefaultAccount)
+	if token != "" {
+		envMap["TELEGRAM_BOT_TOKEN"] = token
+	} else {
+		delete(envMap, "TELEGRAM_BOT_TOKEN")
+	}
+	delete(envMap, "TELEGRAM_ALLOWED_USERS")
+	delete(envMap, "TELEGRAM_ALLOW_ALL_USERS")
+	switch config.DmPolicy {
+	case "open":
+		envMap["TELEGRAM_ALLOW_ALL_USERS"] = "true"
+	case "allowlist":
+		if allow := joinHermesEnvList(config.AllowFrom); allow != "" {
+			envMap["TELEGRAM_ALLOWED_USERS"] = allow
+		}
+	}
+	if err := writeHermesEnvMap(envPath, envMap, []string{
+		"TELEGRAM_BOT_TOKEN",
+		"TELEGRAM_ALLOWED_USERS",
+		"TELEGRAM_ALLOW_ALL_USERS",
+	}); err != nil {
+		return err
+	}
+
+	configPath := path.Join(confDir, "config.yaml")
+	cfg, err := readHermesConfigMap(configPath)
+	if err != nil {
+		return err
+	}
+	telegram := ensureChildMap(cfg, "telegram")
+	telegram["require_mention"] = config.RequireMention
+	return writeHermesConfigMap(configPath, cfg)
+}
+
+func readHermesDiscordChannelConfig(confDir string) (*dto.AgentDiscordConfig, error) {
+	envMap, err := readHermesEnvMap(path.Join(confDir, ".env"))
+	if err != nil {
+		return nil, err
+	}
+	cfg, err := readHermesConfigMap(path.Join(confDir, "config.yaml"))
+	if err != nil {
+		return nil, err
+	}
+
+	allowFrom := splitHermesEnvList(envMap["DISCORD_ALLOWED_USERS"])
+	requireMention := extractBoolValue(childMap(cfg, "discord")["require_mention"], false)
+	dmPolicy := ""
+	if extractHermesEnvBool(envMap, "DISCORD_ALLOW_ALL_USERS", false) {
+		dmPolicy = "open"
+	} else if len(allowFrom) > 0 {
+		dmPolicy = "allowlist"
+	} else if envMap["DISCORD_BOT_TOKEN"] != "" {
+		dmPolicy = "pairing"
+	}
+	groupPolicy := ""
+	if requireMention {
+		groupPolicy = "allowlist"
+	} else if envMap["DISCORD_BOT_TOKEN"] != "" {
+		groupPolicy = "open"
+	}
+	token := envMap["DISCORD_BOT_TOKEN"]
+	result := &dto.AgentDiscordConfig{
+		Enabled:        token != "",
+		DmPolicy:       dmPolicy,
+		AllowFrom:      allowFrom,
+		RequireMention: requireMention,
+		GroupPolicy:    groupPolicy,
+		DefaultAccount: "",
+	}
+	if token != "" {
+		result.Bots = []dto.AgentDiscordBot{
+			{
+				AgentChannelBotBase: dto.AgentChannelBotBase{
+					AccountID: "default",
+					Name:      "Default",
+					Enabled:   true,
+					IsDefault: true,
+				},
+				Token: token,
+			},
+		}
+	}
+	return result, nil
+}
+
+func writeHermesDiscordChannelConfig(confDir string, config dto.AgentDiscordConfig) error {
+	envPath := path.Join(confDir, ".env")
+	envMap, err := readHermesEnvMap(envPath)
+	if err != nil {
+		return err
+	}
+	token := firstHermesDiscordBotToken(config.Bots, config.DefaultAccount)
+	if token != "" {
+		envMap["DISCORD_BOT_TOKEN"] = token
+	} else {
+		delete(envMap, "DISCORD_BOT_TOKEN")
+	}
+	delete(envMap, "DISCORD_ALLOWED_USERS")
+	delete(envMap, "DISCORD_ALLOW_ALL_USERS")
+	switch config.DmPolicy {
+	case "open":
+		envMap["DISCORD_ALLOW_ALL_USERS"] = "true"
+	case "allowlist":
+		if allow := joinHermesEnvList(config.AllowFrom); allow != "" {
+			envMap["DISCORD_ALLOWED_USERS"] = allow
+		}
+	}
+	if err := writeHermesEnvMap(envPath, envMap, []string{
+		"DISCORD_BOT_TOKEN",
+		"DISCORD_ALLOWED_USERS",
+		"DISCORD_ALLOW_ALL_USERS",
+	}); err != nil {
+		return err
+	}
+
+	configPath := path.Join(confDir, "config.yaml")
+	cfg, err := readHermesConfigMap(configPath)
+	if err != nil {
+		return err
+	}
+	discord := ensureChildMap(cfg, "discord")
+	discord["require_mention"] = config.RequireMention
+	return writeHermesConfigMap(configPath, cfg)
+}
+
+func deleteHermesEnvKeys(confDir string, keys ...string) error {
+	envPath := path.Join(confDir, ".env")
+	envMap, err := readHermesEnvMap(envPath)
+	if err != nil {
+		return err
+	}
+	for _, key := range keys {
+		delete(envMap, key)
+	}
+	return writeHermesEnvMap(envPath, envMap, keys)
+}
+
+func deleteHermesConfigSections(confDir string, topLevelKeys []string, platformKeys []string) error {
+	configPath := path.Join(confDir, "config.yaml")
+	cfg, err := readHermesConfigMap(configPath)
+	if err != nil {
+		return err
+	}
+	for _, key := range topLevelKeys {
+		delete(cfg, key)
+	}
+	if len(platformKeys) > 0 {
+		if platforms, ok := cfg["platforms"].(map[string]interface{}); ok {
+			for _, key := range platformKeys {
+				delete(platforms, key)
+			}
+			if len(platforms) == 0 {
+				delete(cfg, "platforms")
+			}
+		}
+	}
+	return writeHermesConfigMap(configPath, cfg)
+}
+
+func deleteHermesTelegramChannelConfig(confDir string) error {
+	if err := deleteHermesEnvKeys(confDir,
+		"TELEGRAM_BOT_TOKEN",
+		"TELEGRAM_ALLOWED_USERS",
+		"TELEGRAM_ALLOW_ALL_USERS",
+		"TELEGRAM_HOME_CHANNEL",
+	); err != nil {
+		return err
+	}
+	return deleteHermesConfigSections(confDir, []string{"telegram"}, []string{"telegram"})
+}
+
+func deleteHermesDiscordChannelConfig(confDir string) error {
+	if err := deleteHermesEnvKeys(confDir,
+		"DISCORD_BOT_TOKEN",
+		"DISCORD_ALLOWED_USERS",
+		"DISCORD_ALLOW_ALL_USERS",
+		"DISCORD_HOME_CHANNEL",
+	); err != nil {
+		return err
+	}
+	return deleteHermesConfigSections(confDir, []string{"discord"}, []string{"discord"})
+}
+
+func normalizeHermesTimezone(timezone string) string {
+	timezone = strings.TrimSpace(timezone)
+	if timezone == "" {
+		return ""
+	}
+	if _, err := time.LoadLocation(timezone); err != nil {
+		return ""
+	}
+	return timezone
+}
+
+func resolveHermesProvider(provider string) string {
+	switch provider {
+	case "":
+		return "custom"
+	case "openrouter", "anthropic", "gemini", "zai", "kimi-coding", "xiaomi":
+		return provider
+	case "minimax":
+		return "minimax-cn"
+	default:
+		return "custom"
+	}
+}
+
+func resolveHermesModel(sourceProvider, targetProvider, modelName string) string {
+	target := strings.TrimSpace(modelName)
+	if target == "" {
+		return ""
+	}
+	if targetProvider != "custom" {
+		return target
+	}
+	if sourceProvider == "custom" || sourceProvider == "vllm" {
+		return normalizeCustomModel(target)
+	}
+	if strings.Contains(target, "/") {
+		parts := strings.SplitN(target, "/", 2)
+		model := strings.TrimSpace(parts[1])
+		if model != "" {
+			return model
+		}
+	}
+	return target
+}
+
+func resolveHermesConfiguredModelID(account *model.AgentAccount, accountModels []dto.AgentAccountModel, configuredModel string) (string, error) {
+	if account == nil {
+		return "", buserr.New("ErrAgentModelNotInAccount")
+	}
+	configuredModel = strings.TrimSpace(configuredModel)
+	if configuredModel == "" {
+		return "", buserr.New("ErrAgentModelNotInAccount")
+	}
+	provider := resolveHermesProvider(account.Provider)
+	for _, item := range accountModels {
+		if resolveHermesModel(account.Provider, provider, item.ID) == configuredModel {
+			return item.ID, nil
+		}
+	}
+	return "", buserr.New("ErrAgentModelNotInAccount")
+}
+
+func resolveHermesEnvEntries(account *model.AgentAccount) []hermesEnvEntry {
+	if account == nil {
+		return nil
+	}
+	if resolveHermesProvider(account.Provider) == "custom" {
+		if account.APIKey == "" {
+			return nil
+		}
+		return []hermesEnvEntry{
+			{Key: "CUSTOM_API_KEY", Value: account.APIKey},
+		}
+	}
+	apiKey := account.APIKey
+	baseURL := account.BaseURL
+	entries := make([]hermesEnvEntry, 0, 4)
+
+	appendEntry := func(key, value string) {
+		if key == "" || value == "" {
+			return
+		}
+		entries = append(entries, hermesEnvEntry{Key: key, Value: value})
+	}
+
+	switch account.Provider {
+	case "openrouter":
+		appendEntry("OPENROUTER_API_KEY", apiKey)
+		appendEntry("OPENROUTER_BASE_URL", baseURL)
+	case "anthropic":
+		appendEntry("ANTHROPIC_API_KEY", apiKey)
+	case "gemini":
+		appendEntry("GOOGLE_API_KEY", apiKey)
+		appendEntry("GEMINI_API_KEY", apiKey)
+		appendEntry("GEMINI_BASE_URL", baseURL)
+	case "zai":
+		appendEntry("GLM_API_KEY", apiKey)
+		appendEntry("ZAI_API_KEY", apiKey)
+		appendEntry("Z_AI_API_KEY", apiKey)
+		appendEntry("GLM_BASE_URL", baseURL)
+	case "kimi-coding", "moonshot":
+		appendEntry("KIMI_API_KEY", apiKey)
+		appendEntry("KIMI_BASE_URL", baseURL)
+	case "kimi":
+		appendEntry("KIMI_CN_API_KEY", apiKey)
+		appendEntry("KIMI_BASE_URL", baseURL)
+	case "minimax":
+		appendEntry("MINIMAX_CN_API_KEY", apiKey)
+		appendEntry("MINIMAX_CN_BASE_URL", baseURL)
+	case "xiaomi":
+		appendEntry("XIAOMI_API_KEY", apiKey)
+		appendEntry("XIAOMI_BASE_URL", baseURL)
+	case "deepseek":
+		appendEntry("DEEPSEEK_API_KEY", apiKey)
+		appendEntry("DEEPSEEK_BASE_URL", baseURL)
+	case "bailian-coding-plan":
+		appendEntry("DASHSCOPE_API_KEY", apiKey)
+		appendEntry("DASHSCOPE_BASE_URL", baseURL)
+	case "openai":
+		appendEntry("OPENAI_API_KEY", apiKey)
+		appendEntry("OPENAI_BASE_URL", baseURL)
+	case "custom", "vllm":
+		if account.APIType == "openai-completions" || account.APIType == "openai-responses" {
+			appendEntry("OPENAI_API_KEY", apiKey)
+			appendEntry("OPENAI_BASE_URL", baseURL)
+		}
+	default:
+		if envKey := providercatalog.EnvKey(account.Provider); envKey != "" {
+			appendEntry(envKey, apiKey)
+		}
+	}
+
+	return entries
+}
+
+func writeHermesModelEnv(envPath string, account *model.AgentAccount) error {
+	envMap, err := readHermesEnvMap(envPath)
+	if err != nil {
+		return err
+	}
+	for _, key := range hermesManagedModelEnvKeys() {
+		delete(envMap, key)
+	}
+	entries := resolveHermesEnvEntries(account)
+	order := make([]string, 0, len(entries))
+	for _, entry := range entries {
+		if entry.Key == "" || entry.Value == "" {
+			continue
+		}
+		envMap[entry.Key] = entry.Value
+		order = append(order, entry.Key)
+	}
+	return writeHermesEnvMap(envPath, envMap, order)
+}
+
+func hermesManagedModelEnvKeys() []string {
+	keys := []string{
+		"OPENROUTER_API_KEY",
+		"OPENROUTER_BASE_URL",
+		"ANTHROPIC_API_KEY",
+		"GOOGLE_API_KEY",
+		"GEMINI_API_KEY",
+		"GEMINI_BASE_URL",
+		"GLM_API_KEY",
+		"ZAI_API_KEY",
+		"Z_AI_API_KEY",
+		"GLM_BASE_URL",
+		"KIMI_API_KEY",
+		"KIMI_CN_API_KEY",
+		"KIMI_BASE_URL",
+		"MINIMAX_CN_API_KEY",
+		"MINIMAX_CN_BASE_URL",
+		"XIAOMI_API_KEY",
+		"XIAOMI_BASE_URL",
+		"DEEPSEEK_API_KEY",
+		"DEEPSEEK_BASE_URL",
+		"DASHSCOPE_API_KEY",
+		"DASHSCOPE_BASE_URL",
+		"OPENAI_API_KEY",
+		"OPENAI_BASE_URL",
+	}
+	seen := make(map[string]struct{}, len(keys))
+	result := make([]string, 0, len(keys))
+	appendKey := func(key string) {
+		if key == "" {
+			return
+		}
+		if _, ok := seen[key]; ok {
+			return
+		}
+		seen[key] = struct{}{}
+		result = append(result, key)
+	}
+	for _, key := range keys {
+		appendKey(key)
+	}
+	for _, meta := range providercatalog.All() {
+		appendKey(meta.EnvKey)
+	}
+	return result
+}
+
+func writeHermesEnv(envPath string, entries []hermesEnvEntry) error {
+	envMap, err := readHermesEnvMap(envPath)
+	if err != nil {
+		return err
+	}
+	for _, entry := range entries {
+		if entry.Key == "" || entry.Value == "" {
+			continue
+		}
+		envMap[entry.Key] = entry.Value
+	}
+	order := make([]string, 0, len(entries))
+	for _, entry := range entries {
+		if entry.Key == "" {
+			continue
+		}
+		order = append(order, entry.Key)
+	}
+	return writeHermesEnvMap(envPath, envMap, order)
+}
+
+func readHermesEnvMap(envPath string) (map[string]string, error) {
+	fileOp := files.NewFileOp()
+	if !fileOp.Stat(envPath) {
+		return map[string]string{}, nil
+	}
+	envMap, err := godotenv.Read(envPath)
+	if err != nil {
+		return nil, err
+	}
+	return envMap, nil
+}
+
+func writeHermesEnvMap(envPath string, envMap map[string]string, order []string) error {
+	if len(envMap) == 0 {
+		return files.NewFileOp().SaveFile(envPath, "", 0600)
+	}
+	return agentenv.WriteWithOrder(envMap, envPath, order)
+}
+
+func splitHermesEnvList(value string) []string {
+	if value == "" {
+		return []string{}
+	}
+	parts := strings.Split(value, ",")
+	result := make([]string, 0, len(parts))
+	seen := make(map[string]struct{}, len(parts))
+	for _, part := range parts {
+		item := strings.TrimSpace(part)
+		if item == "" {
+			continue
+		}
+		if _, ok := seen[item]; ok {
+			continue
+		}
+		seen[item] = struct{}{}
+		result = append(result, item)
+	}
+	return result
+}
+
+func joinHermesEnvList(values []string) string {
+	if len(values) == 0 {
+		return ""
+	}
+	result := make([]string, 0, len(values))
+	seen := make(map[string]struct{}, len(values))
+	for _, value := range values {
+		item := strings.TrimSpace(value)
+		if item == "" {
+			continue
+		}
+		if _, ok := seen[item]; ok {
+			continue
+		}
+		seen[item] = struct{}{}
+		result = append(result, item)
+	}
+	return strings.Join(result, ",")
+}
+
+func firstHermesTelegramBotToken(bots []dto.AgentTelegramBot, defaultAccount string) string {
+	for _, bot := range bots {
+		if bot.AccountID == defaultAccount || bot.IsDefault {
+			return bot.BotToken
+		}
+	}
+	if len(bots) == 0 {
+		return ""
+	}
+	return bots[0].BotToken
+}
+
+func firstHermesDiscordBotToken(bots []dto.AgentDiscordBot, defaultAccount string) string {
+	for _, bot := range bots {
+		if bot.AccountID == defaultAccount || bot.IsDefault {
+			return bot.Token
+		}
+	}
+	if len(bots) == 0 {
+		return ""
+	}
+	return bots[0].Token
+}
+
+func extractHermesEnvBool(envMap map[string]string, key string, defaultValue bool) bool {
+	value, ok := envMap[key]
+	if !ok || value == "" {
+		return defaultValue
+	}
+	return strings.EqualFold(value, "true")
+}
+
+func validateHermesPairingApproveResult(output string, err error) error {
+	if strings.Contains(output, "Approved!") {
+		return nil
+	}
+	if strings.Contains(output, "not found or expired for platform") {
+		return buserr.New("ErrHermesPairingCodeUnavailable")
+	}
+	if err == nil {
+		if strings.TrimSpace(output) == "" {
+			return fmt.Errorf("unexpected hermes pairing approve result")
+		}
+		return errors.New(strings.TrimSpace(output))
+	}
+	if strings.Contains(err.Error(), "not found or expired for platform") {
+		return buserr.New("ErrHermesPairingCodeUnavailable")
+	}
+	return err
+}
@@ -0,0 +1,591 @@
+package service
+
+import (
+	"path"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+)
+
+const hermesWeixinLoginScript = `import asyncio
+from gateway.platforms.weixin import qr_login
+from hermes_cli.config import save_env_value
+
+creds = asyncio.run(qr_login('/opt/data'))
+print('RESULT =', creds)
+
+if not creds:
+    raise SystemExit(1)
+
+save_env_value('WEIXIN_ACCOUNT_ID', creds.get('account_id', ''))
+save_env_value('WEIXIN_TOKEN', creds.get('token', ''))
+if creds.get('base_url'):
+    save_env_value('WEIXIN_BASE_URL', creds['base_url'])
+save_env_value('WEIXIN_CDN_BASE_URL', 'https://novac2c.cdn.weixin.qq.com/c2c')
+save_env_value('WEIXIN_DM_POLICY', 'open')
+save_env_value('WEIXIN_ALLOW_ALL_USERS', 'true')
+save_env_value('WEIXIN_ALLOWED_USERS', '')
+save_env_value('WEIXIN_GROUP_POLICY', 'disabled')
+save_env_value('WEIXIN_GROUP_ALLOWED_USERS', '')
+save_env_value('WEIXIN_HOME_CHANNEL', creds.get('user_id', ''))
+
+print('WEIXIN ENV WRITTEN')
+print('Restart the Hermes-Agent container to apply the new Weixin settings.')
+`
+
+func readHermesQQBotChannelConfig(confDir string) (*dto.AgentQQBotConfig, error) {
+	envMap, err := readHermesEnvMap(path.Join(confDir, ".env"))
+	if err != nil {
+		return nil, err
+	}
+	cfg, err := readHermesConfigMap(path.Join(confDir, "config.yaml"))
+	if err != nil {
+		return nil, err
+	}
+
+	platform := childMap(childMap(cfg, "platforms"), "qq")
+	extra := childMap(platform, "extra")
+	appID := envMap["QQ_APP_ID"]
+	clientSecret := envMap["QQ_CLIENT_SECRET"]
+	dmPolicy := extractStringValue(extra["dm_policy"])
+	allowFrom := splitHermesEnvList(envMap["QQ_ALLOWED_USERS"])
+	groupPolicy := extractStringValue(extra["group_policy"])
+	groupAllowFrom := splitHermesEnvList(envMap["QQ_GROUP_ALLOWED_USERS"])
+
+	result := &dto.AgentQQBotConfig{
+		Enabled:        extractBoolValue(platform["enabled"], false) && appID != "" && clientSecret != "",
+		DmPolicy:       dmPolicy,
+		AllowFrom:      allowFrom,
+		GroupPolicy:    groupPolicy,
+		GroupAllowFrom: groupAllowFrom,
+	}
+	if appID != "" || clientSecret != "" {
+		result.Bots = []dto.AgentQQBotBot{
+			{
+				AgentChannelBotBase: dto.AgentChannelBotBase{
+					AccountID: "default",
+					Name:      "Default",
+					Enabled:   true,
+					IsDefault: true,
+				},
+				AppID:        appID,
+				ClientSecret: clientSecret,
+			},
+		}
+	}
+	return result, nil
+}
+
+func writeHermesQQBotChannelConfig(confDir string, config dto.AgentQQBotConfig) error {
+	envPath := path.Join(confDir, ".env")
+	envMap, err := readHermesEnvMap(envPath)
+	if err != nil {
+		return err
+	}
+
+	defaultBot := getDefaultQQBot(config.Bots)
+	envMap["QQ_APP_ID"] = defaultBot.AppID
+	envMap["QQ_CLIENT_SECRET"] = defaultBot.ClientSecret
+	delete(envMap, "QQ_ALLOWED_USERS")
+	delete(envMap, "QQ_GROUP_ALLOWED_USERS")
+	delete(envMap, "QQ_ALLOW_ALL_USERS")
+	delete(envMap, "QQ_MARKDOWN_SUPPORT")
+	if config.DmPolicy == "open" {
+		envMap["QQ_ALLOW_ALL_USERS"] = "true"
+	} else if config.DmPolicy == "allowlist" {
+		if allow := joinHermesEnvList(config.AllowFrom); allow != "" {
+			envMap["QQ_ALLOWED_USERS"] = allow
+		}
+	}
+	if config.GroupPolicy == "allowlist" {
+		if allow := joinHermesEnvList(config.GroupAllowFrom); allow != "" {
+			envMap["QQ_GROUP_ALLOWED_USERS"] = allow
+		}
+	}
+	if err := writeHermesEnvMap(envPath, envMap, []string{
+		"QQ_APP_ID",
+		"QQ_CLIENT_SECRET",
+		"QQ_ALLOW_ALL_USERS",
+		"QQ_ALLOWED_USERS",
+		"QQ_GROUP_ALLOWED_USERS",
+		"QQ_HOME_CHANNEL",
+		"QQ_HOME_CHANNEL_NAME",
+		"QQ_STT_API_KEY",
+		"QQ_STT_BASE_URL",
+		"QQ_STT_MODEL",
+	}); err != nil {
+		return err
+	}
+
+	configPath := path.Join(confDir, "config.yaml")
+	cfg, err := readHermesConfigMap(configPath)
+	if err != nil {
+		return err
+	}
+
+	platform := ensureChildMap(ensureChildMap(cfg, "platforms"), "qq")
+	platform["enabled"] = config.Enabled && defaultBot.AppID != "" && defaultBot.ClientSecret != ""
+	extra := ensureChildMap(platform, "extra")
+	extra["markdown_support"] = true
+	extra["dm_policy"] = config.DmPolicy
+	extra["group_policy"] = config.GroupPolicy
+	delete(extra, "app_id")
+	delete(extra, "client_secret")
+	if config.DmPolicy == "allowlist" {
+		extra["allow_from"] = append([]string(nil), config.AllowFrom...)
+	} else {
+		delete(extra, "allow_from")
+	}
+	if config.GroupPolicy == "allowlist" {
+		extra["group_allow_from"] = append([]string(nil), config.GroupAllowFrom...)
+	} else {
+		delete(extra, "group_allow_from")
+	}
+	return writeHermesConfigMap(configPath, cfg)
+}
+
+func deleteHermesQQBotChannelConfig(confDir string) error {
+	if err := deleteHermesEnvKeys(confDir,
+		"QQ_APP_ID",
+		"QQ_CLIENT_SECRET",
+		"QQ_ALLOW_ALL_USERS",
+		"QQ_ALLOWED_USERS",
+		"QQ_GROUP_ALLOWED_USERS",
+		"QQ_HOME_CHANNEL",
+		"QQ_HOME_CHANNEL_NAME",
+		"QQ_STT_API_KEY",
+		"QQ_STT_BASE_URL",
+		"QQ_STT_MODEL",
+	); err != nil {
+		return err
+	}
+	return deleteHermesConfigSections(confDir, nil, []string{"qq"})
+}
+
+func readHermesWecomChannelConfig(confDir string) (*dto.AgentWecomConfig, error) {
+	envMap, err := readHermesEnvMap(path.Join(confDir, ".env"))
+	if err != nil {
+		return nil, err
+	}
+	cfg, err := readHermesConfigMap(path.Join(confDir, "config.yaml"))
+	if err != nil {
+		return nil, err
+	}
+
+	platform := childMap(childMap(cfg, "platforms"), "wecom")
+	allowFrom := splitHermesEnvList(envMap["WECOM_ALLOWED_USERS"])
+	groupAllowFrom := splitHermesEnvList(envMap["WECOM_GROUP_ALLOWED_USERS"])
+	dmPolicy := envMap["WECOM_DM_POLICY"]
+	groupPolicy := envMap["WECOM_GROUP_POLICY"]
+
+	botID := envMap["WECOM_BOT_ID"]
+	secret := envMap["WECOM_SECRET"]
+
+	return &dto.AgentWecomConfig{
+		Enabled:        extractBoolValue(platform["enabled"], false) && botID != "" && secret != "",
+		DmPolicy:       dmPolicy,
+		AllowFrom:      allowFrom,
+		GroupPolicy:    groupPolicy,
+		GroupAllowFrom: groupAllowFrom,
+		BotID:          botID,
+		Secret:         secret,
+	}, nil
+}
+
+func writeHermesWecomChannelConfig(confDir string, config dto.AgentWecomConfig) error {
+	envPath := path.Join(confDir, ".env")
+	envMap, err := readHermesEnvMap(envPath)
+	if err != nil {
+		return err
+	}
+	if config.BotID != "" {
+		envMap["WECOM_BOT_ID"] = config.BotID
+	} else {
+		delete(envMap, "WECOM_BOT_ID")
+	}
+	if config.Secret != "" {
+		envMap["WECOM_SECRET"] = config.Secret
+	} else {
+		delete(envMap, "WECOM_SECRET")
+	}
+	delete(envMap, "WECOM_ALLOWED_USERS")
+	delete(envMap, "WECOM_GROUP_ALLOWED_USERS")
+	delete(envMap, "WECOM_ALLOW_ALL_USERS")
+	delete(envMap, "WECOM_DM_POLICY")
+	delete(envMap, "WECOM_GROUP_POLICY")
+	if config.DmPolicy != "" {
+		envMap["WECOM_DM_POLICY"] = config.DmPolicy
+	}
+	if config.GroupPolicy != "" {
+		envMap["WECOM_GROUP_POLICY"] = config.GroupPolicy
+	}
+	if config.DmPolicy == "allowlist" {
+		if allow := joinHermesEnvList(config.AllowFrom); allow != "" {
+			envMap["WECOM_ALLOWED_USERS"] = allow
+		}
+	}
+	if config.GroupPolicy == "allowlist" {
+		if allow := joinHermesEnvList(config.GroupAllowFrom); allow != "" {
+			envMap["WECOM_GROUP_ALLOWED_USERS"] = allow
+		}
+	}
+	if err := writeHermesEnvMap(envPath, envMap, []string{
+		"WECOM_BOT_ID",
+		"WECOM_SECRET",
+		"WECOM_DM_POLICY",
+		"WECOM_ALLOWED_USERS",
+		"WECOM_GROUP_POLICY",
+		"WECOM_GROUP_ALLOWED_USERS",
+	}); err != nil {
+		return err
+	}
+
+	configPath := path.Join(confDir, "config.yaml")
+	cfg, err := readHermesConfigMap(configPath)
+	if err != nil {
+		return err
+	}
+	platform := ensureChildMap(ensureChildMap(cfg, "platforms"), "wecom")
+	platform["enabled"] = config.Enabled && config.BotID != "" && config.Secret != ""
+	extra := ensureChildMap(platform, "extra")
+	extra["dm_policy"] = config.DmPolicy
+	extra["group_policy"] = config.GroupPolicy
+	delete(extra, "bot_id")
+	delete(extra, "secret")
+	if config.DmPolicy == "allowlist" {
+		extra["allow_from"] = append([]string(nil), config.AllowFrom...)
+	} else {
+		delete(extra, "allow_from")
+	}
+	if config.GroupPolicy == "allowlist" {
+		extra["group_allow_from"] = append([]string(nil), config.GroupAllowFrom...)
+	} else {
+		delete(extra, "group_allow_from")
+	}
+	return writeHermesConfigMap(configPath, cfg)
+}
+
+func deleteHermesWecomChannelConfig(confDir string) error {
+	if err := deleteHermesEnvKeys(confDir,
+		"WECOM_BOT_ID",
+		"WECOM_SECRET",
+		"WECOM_ALLOW_ALL_USERS",
+		"WECOM_DM_POLICY",
+		"WECOM_ALLOWED_USERS",
+		"WECOM_GROUP_POLICY",
+		"WECOM_GROUP_ALLOWED_USERS",
+		"WECOM_HOME_CHANNEL",
+	); err != nil {
+		return err
+	}
+	return deleteHermesConfigSections(confDir, nil, []string{"wecom"})
+}
+
+func readHermesDingTalkChannelConfig(confDir string) (*dto.AgentDingTalkConfig, error) {
+	envMap, err := readHermesEnvMap(path.Join(confDir, ".env"))
+	if err != nil {
+		return nil, err
+	}
+	cfg, err := readHermesConfigMap(path.Join(confDir, "config.yaml"))
+	if err != nil {
+		return nil, err
+	}
+
+	platform := childMap(childMap(cfg, "platforms"), "dingtalk")
+	extra := childMap(platform, "extra")
+	clientID := envMap["DINGTALK_CLIENT_ID"]
+	clientSecret := envMap["DINGTALK_CLIENT_SECRET"]
+	allowFrom := splitHermesEnvList(envMap["DINGTALK_ALLOWED_USERS"])
+	dmPolicy := ""
+	if extractHermesEnvBool(envMap, "DINGTALK_ALLOW_ALL_USERS", false) {
+		dmPolicy = "open"
+	} else if len(allowFrom) > 0 {
+		dmPolicy = "allowlist"
+	} else if extractStringValue(extra["unauthorized_dm_behavior"]) == "ignore" {
+		dmPolicy = "disabled"
+	} else if clientID != "" || clientSecret != "" {
+		dmPolicy = "pairing"
+	}
+	result := &dto.AgentDingTalkConfig{
+		Enabled:        extractBoolValue(platform["enabled"], clientID != "" && clientSecret != ""),
+		DmPolicy:       dmPolicy,
+		AllowFrom:      allowFrom,
+		GroupPolicy:    "",
+		GroupAllowFrom: []string{},
+	}
+	if clientID != "" || clientSecret != "" {
+		result.Bots = []dto.AgentDingTalkBot{
+			{
+				AgentChannelBotBase: dto.AgentChannelBotBase{
+					AccountID: "default",
+					Name:      "Default",
+					Enabled:   true,
+					IsDefault: true,
+				},
+				ClientID:     clientID,
+				ClientSecret: clientSecret,
+			},
+		}
+	}
+	return result, nil
+}
+
+func writeHermesDingTalkChannelConfig(confDir string, config dto.AgentDingTalkConfig) error {
+	envPath := path.Join(confDir, ".env")
+	envMap, err := readHermesEnvMap(envPath)
+	if err != nil {
+		return err
+	}
+	clientID, clientSecret := firstHermesDingTalkBotCredentials(config.Bots)
+	if config.Enabled && clientID != "" {
+		envMap["DINGTALK_CLIENT_ID"] = clientID
+	} else {
+		delete(envMap, "DINGTALK_CLIENT_ID")
+	}
+	if config.Enabled && clientSecret != "" {
+		envMap["DINGTALK_CLIENT_SECRET"] = clientSecret
+	} else {
+		delete(envMap, "DINGTALK_CLIENT_SECRET")
+	}
+	delete(envMap, "DINGTALK_ALLOWED_USERS")
+	delete(envMap, "DINGTALK_ALLOW_ALL_USERS")
+	if config.DmPolicy == "allowlist" {
+		if allow := joinHermesEnvList(config.AllowFrom); allow != "" {
+			envMap["DINGTALK_ALLOWED_USERS"] = allow
+		}
+	} else if config.DmPolicy == "open" {
+		envMap["DINGTALK_ALLOW_ALL_USERS"] = "true"
+	}
+	if err := writeHermesEnvMap(envPath, envMap, []string{
+		"DINGTALK_CLIENT_ID",
+		"DINGTALK_CLIENT_SECRET",
+		"DINGTALK_ALLOW_ALL_USERS",
+		"DINGTALK_ALLOWED_USERS",
+	}); err != nil {
+		return err
+	}
+
+	configPath := path.Join(confDir, "config.yaml")
+	cfg, err := readHermesConfigMap(configPath)
+	if err != nil {
+		return err
+	}
+	platform := ensureChildMap(ensureChildMap(cfg, "platforms"), "dingtalk")
+	platform["enabled"] = config.Enabled && clientID != "" && clientSecret != ""
+	extra := ensureChildMap(platform, "extra")
+	switch config.DmPolicy {
+	case "pairing":
+		extra["unauthorized_dm_behavior"] = "pair"
+	case "disabled":
+		extra["unauthorized_dm_behavior"] = "ignore"
+	default:
+		delete(extra, "unauthorized_dm_behavior")
+	}
+	return writeHermesConfigMap(configPath, cfg)
+}
+
+func deleteHermesDingTalkChannelConfig(confDir string) error {
+	if err := deleteHermesEnvKeys(confDir,
+		"DINGTALK_CLIENT_ID",
+		"DINGTALK_CLIENT_SECRET",
+		"DINGTALK_ALLOW_ALL_USERS",
+		"DINGTALK_ALLOWED_USERS",
+		"DINGTALK_HOME_CHANNEL",
+	); err != nil {
+		return err
+	}
+	return deleteHermesConfigSections(confDir, nil, []string{"dingtalk"})
+}
+
+func readHermesFeishuChannelConfig(confDir string) (*dto.AgentFeishuConfig, error) {
+	envMap, err := readHermesEnvMap(path.Join(confDir, ".env"))
+	if err != nil {
+		return nil, err
+	}
+	cfg, err := readHermesConfigMap(path.Join(confDir, "config.yaml"))
+	if err != nil {
+		return nil, err
+	}
+
+	platform := childMap(childMap(cfg, "platforms"), "feishu")
+	appID := envMap["FEISHU_APP_ID"]
+	appSecret := envMap["FEISHU_APP_SECRET"]
+	allowFrom := splitHermesEnvList(envMap["FEISHU_ALLOWED_USERS"])
+	dmPolicy := ""
+	if extractHermesEnvBool(envMap, "FEISHU_ALLOW_ALL_USERS", false) {
+		dmPolicy = "open"
+	} else if len(allowFrom) > 0 {
+		dmPolicy = "allowlist"
+	} else if appID != "" || appSecret != "" {
+		dmPolicy = "pairing"
+	}
+	groupPolicy := envMap["FEISHU_GROUP_POLICY"]
+	result := &dto.AgentFeishuConfig{
+		Enabled:        extractBoolValue(platform["enabled"], appID != "" && appSecret != ""),
+		ThreadSession:  false,
+		ReplyMode:      "",
+		Streaming:      false,
+		RequireMention: "",
+		GroupPolicy:    groupPolicy,
+		GroupAllowFrom: []string{},
+		Domain:         envMap["FEISHU_DOMAIN"],
+		ConnectionMode: envMap["FEISHU_CONNECTION_MODE"],
+	}
+	if appID != "" || appSecret != "" {
+		result.Bots = []dto.AgentFeishuBot{
+			{
+				AgentChannelBotBase: dto.AgentChannelBotBase{
+					AccountID: "default",
+					Name:      "Default",
+					Enabled:   true,
+					IsDefault: true,
+				},
+				AppID:     appID,
+				AppSecret: appSecret,
+				DmPolicy:  dmPolicy,
+				AllowFrom: allowFrom,
+			},
+		}
+	}
+	return result, nil
+}
+
+func writeHermesFeishuChannelConfig(confDir string, config dto.AgentFeishuConfig) error {
+	envPath := path.Join(confDir, ".env")
+	envMap, err := readHermesEnvMap(envPath)
+	if err != nil {
+		return err
+	}
+	bot := firstHermesFeishuBot(config.Bots)
+	if config.GroupPolicy == "allowlist" && bot.DmPolicy == "pairing" {
+		return buserr.New("ErrHermesFeishuGroupAllowlistRequiresAllowlist")
+	}
+	if bot.AppID != "" {
+		envMap["FEISHU_APP_ID"] = bot.AppID
+	} else {
+		delete(envMap, "FEISHU_APP_ID")
+	}
+	if bot.AppSecret != "" {
+		envMap["FEISHU_APP_SECRET"] = bot.AppSecret
+	} else {
+		delete(envMap, "FEISHU_APP_SECRET")
+	}
+	envMap["FEISHU_DOMAIN"] = "feishu"
+	envMap["FEISHU_CONNECTION_MODE"] = "websocket"
+	envMap["FEISHU_GROUP_POLICY"] = config.GroupPolicy
+	delete(envMap, "FEISHU_ALLOW_ALL_USERS")
+	delete(envMap, "FEISHU_ALLOWED_USERS")
+	switch bot.DmPolicy {
+	case "open":
+		envMap["FEISHU_ALLOW_ALL_USERS"] = "true"
+	case "allowlist":
+		if allow := joinHermesEnvList(bot.AllowFrom); allow != "" {
+			envMap["FEISHU_ALLOWED_USERS"] = allow
+		}
+	}
+	if config.GroupPolicy == "allowlist" {
+		if allow := joinHermesEnvList(bot.AllowFrom); allow != "" {
+			envMap["FEISHU_ALLOWED_USERS"] = allow
+		}
+	}
+	if err := writeHermesEnvMap(envPath, envMap, []string{
+		"FEISHU_APP_ID",
+		"FEISHU_APP_SECRET",
+		"FEISHU_DOMAIN",
+		"FEISHU_CONNECTION_MODE",
+		"FEISHU_ALLOW_ALL_USERS",
+		"FEISHU_ALLOWED_USERS",
+		"FEISHU_GROUP_POLICY",
+	}); err != nil {
+		return err
+	}
+
+	configPath := path.Join(confDir, "config.yaml")
+	cfg, err := readHermesConfigMap(configPath)
+	if err != nil {
+		return err
+	}
+	platform := ensureChildMap(ensureChildMap(cfg, "platforms"), "feishu")
+	platform["enabled"] = config.Enabled && bot.AppID != "" && bot.AppSecret != ""
+	return writeHermesConfigMap(configPath, cfg)
+}
+
+func deleteHermesFeishuChannelConfig(confDir string) error {
+	if err := deleteHermesEnvKeys(confDir,
+		"FEISHU_APP_ID",
+		"FEISHU_APP_SECRET",
+		"FEISHU_DOMAIN",
+		"FEISHU_CONNECTION_MODE",
+		"FEISHU_ALLOW_ALL_USERS",
+		"FEISHU_ALLOWED_USERS",
+		"FEISHU_GROUP_POLICY",
+		"FEISHU_HOME_CHANNEL",
+		"FEISHU_VERIFICATION_TOKEN",
+		"FEISHU_ENCRYPT_KEY",
+	); err != nil {
+		return err
+	}
+	return deleteHermesConfigSections(confDir, nil, []string{"feishu"})
+}
+
+func readHermesWeixinChannelConfig(confDir string) (*dto.AgentWeixinConfig, error) {
+	envMap, err := readHermesEnvMap(path.Join(confDir, ".env"))
+	if err != nil {
+		return nil, err
+	}
+	return &dto.AgentWeixinConfig{
+		Enabled: envMap["WEIXIN_ACCOUNT_ID"] != "" || envMap["WEIXIN_TOKEN"] != "",
+	}, nil
+}
+
+func deleteHermesWeixinChannelConfig(confDir string) error {
+	if err := deleteHermesEnvKeys(confDir,
+		"WEIXIN_ACCOUNT_ID",
+		"WEIXIN_TOKEN",
+		"WEIXIN_BASE_URL",
+		"WEIXIN_CDN_BASE_URL",
+		"WEIXIN_DM_POLICY",
+		"WEIXIN_ALLOW_ALL_USERS",
+		"WEIXIN_ALLOWED_USERS",
+		"WEIXIN_GROUP_POLICY",
+		"WEIXIN_GROUP_ALLOWED_USERS",
+		"WEIXIN_HOME_CHANNEL",
+	); err != nil {
+		return err
+	}
+	return deleteHermesConfigSections(confDir, nil, []string{"weixin"})
+}
+
+func firstHermesDingTalkBotCredentials(bots []dto.AgentDingTalkBot) (string, string) {
+	for _, bot := range bots {
+		if bot.IsDefault || bot.AccountID == "default" {
+			return bot.ClientID, bot.ClientSecret
+		}
+	}
+	if len(bots) == 0 {
+		return "", ""
+	}
+	return bots[0].ClientID, bots[0].ClientSecret
+}
+
+func firstHermesFeishuBot(bots []dto.AgentFeishuBot) dto.AgentFeishuBot {
+	for _, bot := range bots {
+		if bot.IsDefault || bot.AccountID == "default" {
+			return bot
+		}
+	}
+	if len(bots) == 0 {
+		return dto.AgentFeishuBot{}
+	}
+	return bots[0]
+}
+
+func buildHermesWeixinLoginArgs(containerName string) []string {
+	return buildHermesDockerExecCommandArgs(
+		containerName,
+		"/opt/hermes/.venv/bin/python",
+		"-u",
+		"-c",
+		hermesWeixinLoginScript,
+	)
+}
@@ -0,0 +1,126 @@
+package service
+
+import (
+	"database/sql"
+	"fmt"
+	"math"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
+	"github.com/1Panel-dev/1Panel/agent/utils/files"
+)
+
+const hermesSessionListLimit = 100
+
+func (a AgentService) GetHermesChatSessions(req dto.AgentIDReq) ([]dto.AgentHermesChatSessionItem, error) {
+	agent, install, err := a.loadAgentAndInstall(req.AgentID)
+	if err != nil {
+		return nil, err
+	}
+	if agent.AgentType != constant.AppHermesAgent {
+		return nil, fmt.Errorf("%s does not support", agent.AgentType)
+	}
+	return listHermesChatSessionsFromStateDB(filepath.Join(install.GetPath(), "data", "state.db"))
+}
+
+func (a AgentService) RenameHermesChatSession(req dto.AgentHermesChatSessionRenameReq) error {
+	agent, install, err := a.loadAgentAndInstall(req.AgentID)
+	if err != nil {
+		return err
+	}
+	if agent.AgentType != constant.AppHermesAgent {
+		return fmt.Errorf("%s does not support", agent.AgentType)
+	}
+
+	_, err = cmd.NewCommandMgr(cmd.WithTimeout(20*time.Second)).RunWithStdout(
+		"docker",
+		buildHermesDockerExecArgs(install.ContainerName, "sessions", "rename", req.ID, req.Title)...,
+	)
+	return err
+}
+
+func (a AgentService) DeleteHermesChatSession(req dto.AgentHermesChatSessionDeleteReq) error {
+	agent, install, err := a.loadAgentAndInstall(req.AgentID)
+	if err != nil {
+		return err
+	}
+	if agent.AgentType != constant.AppHermesAgent {
+		return fmt.Errorf("%s does not support", agent.AgentType)
+	}
+
+	_, err = cmd.NewCommandMgr(cmd.WithTimeout(20*time.Second)).RunWithStdout(
+		"docker",
+		buildHermesDockerExecArgs(install.ContainerName, "sessions", "delete", req.ID, "--yes")...,
+	)
+	return err
+}
+
+func listHermesChatSessionsFromStateDB(stateDBPath string) ([]dto.AgentHermesChatSessionItem, error) {
+	if !files.NewFileOp().Stat(stateDBPath) {
+		return []dto.AgentHermesChatSessionItem{}, nil
+	}
+
+	db, err := sql.Open("sqlite", stateDBPath)
+	if err != nil {
+		return nil, err
+	}
+	defer db.Close()
+
+	rows, err := db.Query(`
+SELECT
+    s.id,
+    COALESCE(NULLIF(TRIM(s.title), ''), s.id) AS title,
+    COALESCE(s.model, '') AS model,
+    COALESCE(s.message_count, 0) AS message_count,
+    s.started_at,
+    COALESCE(MAX(m.timestamp), s.started_at) AS last_active
+FROM sessions s
+LEFT JOIN messages m ON m.session_id = s.id
+WHERE s.source = 'cli'
+GROUP BY s.id, title, model, s.message_count, s.started_at
+ORDER BY last_active DESC
+LIMIT ?
+`, hermesSessionListLimit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	items := make([]dto.AgentHermesChatSessionItem, 0, 8)
+	for rows.Next() {
+		var item dto.AgentHermesChatSessionItem
+		var title sql.NullString
+		var model sql.NullString
+		var startedAt sql.NullFloat64
+		var lastActive sql.NullFloat64
+		if err := rows.Scan(&item.ID, &title, &model, &item.MessageCount, &startedAt, &lastActive); err != nil {
+			return nil, err
+		}
+		item.Title = strings.TrimSpace(title.String)
+		if item.Title == "" {
+			item.Title = item.ID
+		}
+		item.Model = strings.TrimSpace(model.String)
+		item.StartedAt = formatHermesSessionTimestamp(startedAt)
+		item.LastActive = formatHermesSessionTimestamp(lastActive)
+		items = append(items, item)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+
+	return items, nil
+}
+
+func formatHermesSessionTimestamp(value sql.NullFloat64) string {
+	if !value.Valid || value.Float64 <= 0 {
+		return ""
+	}
+
+	seconds, fraction := math.Modf(value.Float64)
+	return time.Unix(int64(seconds), int64(fraction*float64(time.Second))).UTC().Format(time.RFC3339)
+}
@@ -0,0 +1,215 @@
+package service
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
+)
+
+type hermesSkillsListEntry struct {
+	Name        string `json:"name"`
+	Description string `json:"description"`
+	Category    string `json:"category"`
+}
+
+type hermesSkillsListPayload struct {
+	Skills []hermesSkillsListEntry `json:"skills"`
+}
+
+func listHermesSkills(containerName string) ([]dto.AgentSkillItem, error) {
+	output, err := runHermesSkillsCommandWithStdout(2*time.Minute, containerName, "list", "--source", "all")
+	if err != nil {
+		return nil, err
+	}
+	items, err := parseHermesSkillsListOutput(output)
+	if err != nil {
+		return nil, err
+	}
+	metadata, err := readHermesSkillsListMetadata(containerName)
+	if err != nil {
+		return nil, err
+	}
+	return mergeHermesSkillsWithMetadata(items, metadata), nil
+}
+
+func searchHermesSkills(containerName, source, keyword string) ([]dto.AgentSkillSearchItem, error) {
+	if source != "official" && source != "skills-sh" {
+		return nil, fmt.Errorf("unsupported hermes skill source: %s", source)
+	}
+	output, err := runHermesSkillsCommandWithStdout(
+		2*time.Minute,
+		containerName,
+		"search",
+		keyword,
+		"--source",
+		source,
+		"--limit",
+		"20",
+	)
+	if err != nil {
+		return nil, err
+	}
+	return parseHermesSkillSearchOutput(output)
+}
+
+func runHermesSkillsCommandWithStdout(timeout time.Duration, containerName string, hermesArgs ...string) (string, error) {
+	args := []string{"exec", "-e", "COLUMNS=240", "-u", "hermes", containerName, "hermes", "skills"}
+	args = append(args, hermesArgs...)
+	return cmd.NewCommandMgr(cmd.WithTimeout(timeout)).RunWithStdout("docker", args...)
+}
+
+func readHermesSkillsListMetadata(containerName string) (map[string]hermesSkillsListEntry, error) {
+	output, err := cmd.NewCommandMgr(cmd.WithTimeout(2*time.Minute)).RunWithStdout(
+		"docker",
+		"exec",
+		"-u",
+		"hermes",
+		containerName,
+		"python",
+		"-c",
+		"import sys; sys.path.insert(0, '/opt/hermes'); from tools.skills_tool import skills_list; print(skills_list())",
+	)
+	if err != nil {
+		return nil, err
+	}
+	return parseHermesSkillsListMetadataOutput(output)
+}
+
+func parseHermesSkillsListOutput(output string) ([]dto.AgentSkillItem, error) {
+	headers, rows, err := parseHermesTableOutput(output)
+	if err != nil {
+		return nil, err
+	}
+	items := make([]dto.AgentSkillItem, 0, len(rows))
+	for _, row := range rows {
+		item := dto.AgentSkillItem{
+			Name:          row[headers["Name"]],
+			Category:      row[headers["Category"]],
+			Source:        row[headers["Source"]],
+			Trust:         row[headers["Trust"]],
+			Uninstallable: row[headers["Source"]] != "builtin" && row[headers["Source"]] != "local",
+		}
+		items = append(items, item)
+	}
+	return items, nil
+}
+
+func parseHermesSkillsListMetadataOutput(output string) (map[string]hermesSkillsListEntry, error) {
+	if strings.TrimSpace(output) == "" {
+		return map[string]hermesSkillsListEntry{}, nil
+	}
+	var payload hermesSkillsListPayload
+	if err := json.Unmarshal([]byte(output), &payload); err != nil {
+		return nil, err
+	}
+	metadata := make(map[string]hermesSkillsListEntry, len(payload.Skills))
+	for _, skill := range payload.Skills {
+		if skill.Name == "" {
+			continue
+		}
+		metadata[skill.Name] = skill
+	}
+	return metadata, nil
+}
+
+func mergeHermesSkillsWithMetadata(items []dto.AgentSkillItem, metadata map[string]hermesSkillsListEntry) []dto.AgentSkillItem {
+	for i := range items {
+		entry, ok := metadata[items[i].Name]
+		if !ok {
+			continue
+		}
+		items[i].Description = entry.Description
+		if items[i].Category == "" && entry.Category != "" {
+			items[i].Category = entry.Category
+		}
+	}
+	return items
+}
+
+func parseHermesSkillSearchOutput(output string) ([]dto.AgentSkillSearchItem, error) {
+	if strings.Contains(output, "No skills found matching your query.") {
+		return []dto.AgentSkillSearchItem{}, nil
+	}
+	headers, rows, err := parseHermesTableOutput(output)
+	if err != nil {
+		return nil, err
+	}
+	items := make([]dto.AgentSkillSearchItem, 0, len(rows))
+	for _, row := range rows {
+		identifier := row[headers["Identifier"]]
+		items = append(items, dto.AgentSkillSearchItem{
+			Slug:        identifier,
+			Identifier:  identifier,
+			Name:        row[headers["Name"]],
+			Description: row[headers["Description"]],
+			Source:      row[headers["Source"]],
+			Trust:       row[headers["Trust"]],
+		})
+	}
+	return items, nil
+}
+
+func parseHermesTableOutput(output string) (map[string]int, [][]string, error) {
+	lines := strings.Split(strings.TrimSpace(ansiEscapePattern.ReplaceAllString(output, "")), "\n")
+	var headers []string
+	rows := make([][]string, 0)
+	var current []string
+
+	for _, rawLine := range lines {
+		line := strings.TrimSpace(rawLine)
+		if (!strings.HasPrefix(line, "│") || !strings.HasSuffix(line, "│")) &&
+			(!strings.HasPrefix(line, "┃") || !strings.HasSuffix(line, "┃")) {
+			continue
+		}
+		line = strings.ReplaceAll(line, "┃", "│")
+		parts := strings.Split(line, "│")
+		if len(parts) < 3 {
+			continue
+		}
+		cols := make([]string, 0, len(parts)-2)
+		for _, part := range parts[1 : len(parts)-1] {
+			cols = append(cols, strings.TrimSpace(part))
+		}
+		if len(headers) == 0 {
+			headers = cols
+			continue
+		}
+		if cols[0] != "" {
+			if current != nil {
+				rows = append(rows, current)
+			}
+			current = cols
+			continue
+		}
+		if current == nil {
+			continue
+		}
+		for i := range cols {
+			if cols[i] == "" {
+				continue
+			}
+			if current[i] == "" {
+				current[i] = cols[i]
+				continue
+			}
+			current[i] = current[i] + " " + cols[i]
+		}
+	}
+
+	if current != nil {
+		rows = append(rows, current)
+	}
+	if len(headers) == 0 {
+		return nil, nil, fmt.Errorf("hermes skills table not found")
+	}
+
+	headerIndex := make(map[string]int, len(headers))
+	for i, header := range headers {
+		headerIndex[header] = i
+	}
+	return headerIndex, rows, nil
+}
@@ -0,0 +1,239 @@
+package service
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+)
+
+const (
+	openclawCronJobsRelativePath     = "data/conf/cron/jobs.json"
+	openclawSessionStoreRelativeGlob = "data/conf/agents/*/sessions/sessions.json"
+	openclawSessionFilesRelativeGlob = "data/conf/agents/*/sessions/*.jsonl"
+)
+
+func (a AgentService) GetOverview(req dto.AgentOverviewReq) (*dto.AgentOverview, error) {
+	agent, install, conf, err := a.loadOpenclawAgentConfig(req.AgentID)
+	if err != nil {
+		return nil, err
+	}
+
+	overview := &dto.AgentOverview{
+		Snapshot: dto.AgentOverviewSnapshot{
+			ContainerStatus: install.Status,
+			AppVersion:      install.Version,
+			DefaultModel:    extractOpenclawDefaultModel(conf),
+			ChannelCount:    countOpenclawConfiguredChannels(conf),
+		},
+	}
+	if overview.Snapshot.DefaultModel == "" {
+		overview.Snapshot.DefaultModel = agent.Model
+	}
+	if install.Status != constant.StatusRunning {
+		return overview, nil
+	}
+
+	var wg sync.WaitGroup
+	wg.Add(3)
+	go func() {
+		defer wg.Done()
+		skillCount, err := loadOpenclawOverviewSkillStats(install.ContainerName)
+		if err == nil {
+			overview.Snapshot.SkillCount = skillCount
+		}
+	}()
+	go func() {
+		defer wg.Done()
+		sessionCount, err := loadOpenclawOverviewSessionCount(install.GetPath())
+		if err == nil {
+			overview.Snapshot.SessionCount = sessionCount
+		}
+	}()
+	go func() {
+		defer wg.Done()
+		jobCount, err := loadOpenclawOverviewJobCount(install.GetPath())
+		if err == nil {
+			overview.Snapshot.JobCount = jobCount
+		}
+	}()
+	wg.Wait()
+
+	return overview, nil
+}
+
+func extractOpenclawDefaultModel(conf map[string]interface{}) string {
+	agents, ok := conf["agents"].(map[string]interface{})
+	if !ok {
+		return ""
+	}
+	defaults, ok := agents["defaults"].(map[string]interface{})
+	if !ok {
+		return ""
+	}
+	model, ok := defaults["model"].(map[string]interface{})
+	if !ok {
+		return ""
+	}
+	primary, _ := model["primary"].(string)
+	return strings.TrimSpace(primary)
+}
+
+func countOpenclawConfiguredChannels(conf map[string]interface{}) int {
+	channels, ok := conf["channels"].(map[string]interface{})
+	if !ok {
+		return 0
+	}
+	count := 0
+	for _, value := range channels {
+		channel, ok := value.(map[string]interface{})
+		if !ok || len(channel) == 0 {
+			continue
+		}
+		count++
+	}
+	return count
+}
+
+func loadOpenclawOverviewSkillStats(containerName string) (int, error) {
+	output, err := runDockerExecWithStdout(5*time.Minute, containerName, "sh", "-c", "openclaw skills list --json 2>&1")
+	if err != nil {
+		return 0, err
+	}
+	if strings.TrimSpace(output) == "" {
+		return 0, nil
+	}
+	skills, err := parseOpenclawSkillsList(output)
+	if err != nil {
+		return 0, err
+	}
+	return len(skills), nil
+}
+
+func loadOpenclawOverviewSessionCount(installPath string) (int, error) {
+	sessionStorePaths, err := filepath.Glob(filepath.Join(installPath, openclawSessionStoreRelativeGlob))
+	if err != nil {
+		return 0, err
+	}
+	total := 0
+	for _, sessionStorePath := range sessionStorePaths {
+		count, err := loadOpenclawSessionCountFromFile(sessionStorePath)
+		if err != nil {
+			continue
+		}
+		total += count
+	}
+	if total > 0 {
+		return total, nil
+	}
+	sessionFiles, err := filepath.Glob(filepath.Join(installPath, openclawSessionFilesRelativeGlob))
+	if err != nil {
+		return 0, err
+	}
+	return len(sessionFiles), nil
+}
+
+func loadOpenclawSessionCountFromFile(sessionStorePath string) (int, error) {
+	content, err := os.ReadFile(sessionStorePath)
+	if err != nil {
+		return 0, err
+	}
+	return parseOpenclawSessionCount(string(content))
+}
+
+func loadOpenclawOverviewJobCount(installPath string) (int, error) {
+	content, err := os.ReadFile(filepath.Join(installPath, openclawCronJobsRelativePath))
+	if err != nil {
+		if os.IsNotExist(err) {
+			return 0, nil
+		}
+		return 0, err
+	}
+	return parseOpenclawCronCount(string(content))
+}
+
+func parseOpenclawSessionCount(output string) (int, error) {
+	if strings.TrimSpace(output) == "" {
+		return 0, nil
+	}
+	var payload interface{}
+	if err := json.Unmarshal([]byte(strings.TrimSpace(output)), &payload); err != nil {
+		return 0, err
+	}
+	return countOpenclawSessions(payload), nil
+}
+
+func parseOpenclawCronCount(output string) (int, error) {
+	if strings.TrimSpace(output) == "" {
+		return 0, nil
+	}
+	var payload interface{}
+	if err := json.Unmarshal([]byte(strings.TrimSpace(output)), &payload); err != nil {
+		return 0, err
+	}
+	switch value := payload.(type) {
+	case []interface{}:
+		return len(value), nil
+	case map[string]interface{}:
+		if total, ok := value["total"].(float64); ok {
+			return int(total), nil
+		}
+		if jobs, ok := value["jobs"].([]interface{}); ok {
+			return len(jobs), nil
+		}
+		return len(value), nil
+	default:
+		return 0, nil
+	}
+}
+
+func countOpenclawSessions(payload interface{}) int {
+	switch value := payload.(type) {
+	case []interface{}:
+		return len(value)
+	case map[string]interface{}:
+		if count, ok := value["count"].(float64); ok {
+			return int(count)
+		}
+		if sessions, ok := value["sessions"]; ok {
+			return countOpenclawSessions(sessions)
+		}
+		count := 0
+		for _, item := range value {
+			switch typed := item.(type) {
+			case map[string]interface{}:
+				if looksLikeOpenclawSession(typed) {
+					count++
+				}
+			case string:
+				if strings.HasSuffix(strings.TrimSpace(typed), ".jsonl") {
+					count++
+				}
+			}
+		}
+		return count
+	default:
+		return 0
+	}
+}
+
+func looksLikeOpenclawSession(item map[string]interface{}) bool {
+	if _, ok := item["sessionFile"]; ok {
+		return true
+	}
+	if _, ok := item["agentId"]; ok {
+		return true
+	}
+	if _, ok := item["lastActivityTs"]; ok {
+		return true
+	}
+	if _, ok := item["updatedAt"]; ok {
+		return true
+	}
+	return false
+}
@@ -0,0 +1,338 @@
+package service
+
+import (
+	"encoding/json"
+	"fmt"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/task"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
+)
+
+const clawhubGlobalRegistry = "https://clawhub.com"
+const clawhubChinaRegistry = "https://mirror-cn.clawhub.com"
+
+type openclawSkillsList struct {
+	Skills []openclawSkillListItem `json:"skills"`
+}
+
+type openclawSkillListItem struct {
+	Name        string `json:"name"`
+	Description string `json:"description"`
+	Source      string `json:"source"`
+	Bundled     bool   `json:"bundled"`
+	Disabled    bool   `json:"disabled"`
+}
+
+type openclawSkillInfo struct {
+	SkillKey string `json:"skillKey"`
+}
+
+type skillhubSearchPayload struct {
+	Skills  []dto.AgentSkillSearchItem `json:"skills"`
+	Results []dto.AgentSkillSearchItem `json:"results"`
+}
+
+var clawhubSearchLinePattern = regexp.MustCompile(`^(\S+)\s+(.+?)\s+\(([\d.]+)\)$`)
+var ansiEscapePattern = regexp.MustCompile(`\x1b\[[0-9;?]*[ -/]*[@-~]`)
+
+func (a AgentService) ListSkills(req dto.AgentIDReq) ([]dto.AgentSkillItem, error) {
+	agent, install, err := a.loadAgentAndInstall(req.AgentID)
+	if err != nil {
+		return nil, err
+	}
+	if err := ensureContainerRunning(install.ContainerName); err != nil {
+		return nil, err
+	}
+	if agent.AgentType == constant.AppHermesAgent {
+		return listHermesSkills(install.ContainerName)
+	}
+	if agent.AgentType != constant.AppOpenclaw {
+		return nil, fmt.Errorf("%s does not support", agent.AgentType)
+	}
+	output, err := runDockerExecWithStdout(5*time.Minute, install.ContainerName, "sh", "-c", "openclaw skills list --json 2>&1")
+	if err != nil {
+		return nil, err
+	}
+	if len(output) == 0 {
+		return nil, nil
+	}
+	return parseOpenclawSkillsList(output)
+}
+
+func (a AgentService) SearchSkills(req dto.AgentSkillSearchReq) ([]dto.AgentSkillSearchItem, error) {
+	agent, install, err := a.loadAgentAndInstall(req.AgentID)
+	if err != nil {
+		return nil, err
+	}
+	if err := ensureContainerRunning(install.ContainerName); err != nil {
+		return nil, err
+	}
+	if agent.AgentType == constant.AppHermesAgent {
+		return searchHermesSkills(install.ContainerName, req.Source, req.Keyword)
+	}
+	if agent.AgentType != constant.AppOpenclaw {
+		return nil, fmt.Errorf("%s does not support", agent.AgentType)
+	}
+	output, err := loadOpenclawSkillSearchOutput(install.ContainerName, req.Source, req.Keyword)
+	if err != nil {
+		return nil, err
+	}
+	if len(output) == 0 {
+		return nil, nil
+	}
+	switch req.Source {
+	case "skillhub":
+		return parseSkillhubSearchResult(output)
+	default:
+		return parseClawhubSearchResult(output, req.Source), nil
+	}
+}
+
+func (a AgentService) UpdateSkill(req dto.AgentSkillUpdateReq) error {
+	agent, install, err := a.loadOpenclawAgentAndInstall(req.AgentID)
+	if err != nil {
+		return err
+	}
+	if err := ensureContainerRunning(install.ContainerName); err != nil {
+		return err
+	}
+	conf, err := readOpenclawConfig(agent.ConfigPath)
+	if err != nil {
+		return err
+	}
+	skillKey, err := getOpenclawSkillKey(install.ContainerName, req.Name)
+	if err != nil {
+		return err
+	}
+	setOpenclawSkillEnabled(conf, skillKey, req.Enabled)
+	return writeOpenclawConfigRaw(agent.ConfigPath, conf)
+}
+
+func (a AgentService) InstallSkill(req dto.AgentSkillInstallReq) error {
+	agent, install, err := a.loadAgentAndInstall(req.AgentID)
+	if err != nil {
+		return err
+	}
+	if err := ensureContainerRunning(install.ContainerName); err != nil {
+		return err
+	}
+	installTask, err := task.NewTaskWithOps(req.Slug, task.TaskInstall, task.TaskScopeAI, req.TaskID, req.AgentID)
+	if err != nil {
+		return err
+	}
+	if agent.AgentType == constant.AppHermesAgent {
+		installTask.AddSubTask("Install Hermes skill", func(t *task.Task) error {
+			mgr := cmd.NewCommandMgr(cmd.WithTask(*t), cmd.WithContext(t.TaskCtx), cmd.WithTimeout(20*time.Minute))
+			return mgr.Run("docker", buildHermesDockerExecArgs(install.ContainerName, "skills", "install", req.Slug, "--yes")...)
+		}, nil)
+		go func() {
+			if err := installTask.Execute(); err != nil {
+				global.LOG.Errorf("install hermes skill failed: %v", err)
+			}
+		}()
+		return nil
+	}
+	if agent.AgentType != constant.AppOpenclaw {
+		return fmt.Errorf("%s does not support", agent.AgentType)
+	}
+	installTask.AddSubTask("Install OpenClaw skill", func(t *task.Task) error {
+		mgr := cmd.NewCommandMgr(cmd.WithTask(*t), cmd.WithContext(t.TaskCtx), cmd.WithTimeout(20*time.Minute))
+		return mgr.Run("docker", "exec", install.ContainerName, "sh", "-c", buildOpenclawSkillInstallCommand(req.Source, req.Slug))
+	}, nil)
+	go func() {
+		if err := installTask.Execute(); err != nil {
+			global.LOG.Errorf("install openclaw skill failed: %v", err)
+		}
+	}()
+	return nil
+}
+
+func (a AgentService) UninstallSkill(req dto.AgentSkillUninstallReq) error {
+	agent, install, err := a.loadAgentAndInstall(req.AgentID)
+	if err != nil {
+		return err
+	}
+	if agent.AgentType != constant.AppHermesAgent {
+		return fmt.Errorf("%s does not support", agent.AgentType)
+	}
+	if err := ensureContainerRunning(install.ContainerName); err != nil {
+		return err
+	}
+	return cmd.NewCommandMgr(cmd.WithTimeout(5*time.Minute)).Run(
+		"docker",
+		buildHermesDockerExecCommandArgs(
+			install.ContainerName,
+			"sh",
+			"-lc",
+			fmt.Sprintf(`printf 'y\n' | %s skills uninstall "$1"`, hermesExecutablePath),
+			"sh",
+			req.Name,
+		)...,
+	)
+}
+
+func parseOpenclawSkillsList(output string) ([]dto.AgentSkillItem, error) {
+	payloadBytes, err := extractEmbeddedJSON(output)
+	if err != nil {
+		return nil, err
+	}
+	if len(payloadBytes) == 0 {
+		return nil, nil
+	}
+	var payload openclawSkillsList
+	if err := json.Unmarshal(payloadBytes, &payload); err != nil {
+		return nil, err
+	}
+	items := make([]dto.AgentSkillItem, 0, len(payload.Skills))
+	for _, item := range payload.Skills {
+		items = append(items, dto.AgentSkillItem{
+			Name:        item.Name,
+			Description: item.Description,
+			Source:      item.Source,
+			Bundled:     item.Bundled,
+			Disabled:    item.Disabled,
+		})
+	}
+	return items, nil
+}
+
+func loadOpenclawSkillSearchOutput(containerName, source, keyword string) (string, error) {
+	switch source {
+	case "skillhub":
+		return runDockerExecWithStdout(2*time.Minute, containerName, "skillhub", "search", keyword, "--json")
+	default:
+		return runDockerExecWithStdout(
+			2*time.Minute,
+			containerName,
+			"sh",
+			"-c",
+			fmt.Sprintf("CLAWHUB_REGISTRY=%q clawhub search %q", resolveClawhubRegistry(source), keyword),
+		)
+	}
+}
+
+func parseSkillhubSearchResult(output string) ([]dto.AgentSkillSearchItem, error) {
+	trimmed := strings.TrimSpace(output)
+	if trimmed == "" {
+		return nil, nil
+	}
+	var list []dto.AgentSkillSearchItem
+	if err := json.Unmarshal([]byte(trimmed), &list); err == nil {
+		for i := range list {
+			list[i].Source = "skillhub"
+		}
+		return list, nil
+	}
+	var payload skillhubSearchPayload
+	if err := json.Unmarshal([]byte(trimmed), &payload); err != nil {
+		return nil, err
+	}
+	items := payload.Skills
+	if len(items) == 0 {
+		items = payload.Results
+	}
+	for i := range items {
+		items[i].Source = "skillhub"
+	}
+	return items, nil
+}
+
+func parseClawhubSearchResult(output, source string) []dto.AgentSkillSearchItem {
+	lines := strings.Split(strings.TrimSpace(output), "\n")
+	items := make([]dto.AgentSkillSearchItem, 0, len(lines))
+	for _, line := range lines {
+		matches := clawhubSearchLinePattern.FindStringSubmatch(strings.TrimSpace(line))
+		if len(matches) != 4 {
+			continue
+		}
+		items = append(items, dto.AgentSkillSearchItem{
+			Slug:   matches[1],
+			Name:   matches[2],
+			Score:  matches[3],
+			Source: source,
+		})
+	}
+	return items
+}
+
+func buildOpenclawSkillInstallCommand(source, slug string) string {
+	switch source {
+	case "clawhub-global", "clawhub-cn":
+		return fmt.Sprintf(
+			"mkdir -p %s && CLAWHUB_REGISTRY=%q clawhub --workdir /home/node/.openclaw --dir skills install %q",
+			openclawManagedSkillsDir,
+			resolveClawhubRegistry(source),
+			slug,
+		)
+	default:
+		return fmt.Sprintf(
+			"mkdir -p %s && skillhub --dir %s install %q",
+			openclawManagedSkillsDir,
+			openclawManagedSkillsDir,
+			slug,
+		)
+	}
+}
+
+func resolveClawhubRegistry(source string) string {
+	switch source {
+	case "clawhub-cn":
+		return clawhubChinaRegistry
+	default:
+		return clawhubGlobalRegistry
+	}
+}
+
+func getOpenclawSkillKey(containerName, name string) (string, error) {
+	output, err := runDockerExecWithStdout(2*time.Minute, containerName, "sh", "-c", fmt.Sprintf("openclaw skills info %q --json 2>&1", name))
+	if err != nil {
+		return "", err
+	}
+	return parseOpenclawSkillKey(name, output)
+}
+
+func parseOpenclawSkillKey(name, output string) (string, error) {
+	payloadBytes, err := extractEmbeddedJSON(output)
+	if err != nil {
+		return "", err
+	}
+	var payload openclawSkillInfo
+	if err := json.Unmarshal(payloadBytes, &payload); err != nil {
+		return "", err
+	}
+	if payload.SkillKey == "" {
+		return "", fmt.Errorf("skill %s does not have a skillKey", name)
+	}
+	return payload.SkillKey, nil
+}
+
+func extractEmbeddedJSON(output string) ([]byte, error) {
+	trimmed := strings.TrimSpace(ansiEscapePattern.ReplaceAllString(output, ""))
+	if trimmed == "" {
+		return nil, nil
+	}
+	for i := 0; i < len(trimmed); i++ {
+		if trimmed[i] != '{' && trimmed[i] != '[' {
+			continue
+		}
+		decoder := json.NewDecoder(strings.NewReader(trimmed[i:]))
+		var raw json.RawMessage
+		if err := decoder.Decode(&raw); err == nil {
+			return raw, nil
+		}
+	}
+	return nil, fmt.Errorf("json payload not found")
+}
+
+func setOpenclawSkillEnabled(conf map[string]interface{}, skillKey string, enabled bool) {
+	skills := ensureChildMap(conf, "skills")
+	entries := ensureChildMap(skills, "entries")
+	entry := ensureChildMap(entries, skillKey)
+	entry["enabled"] = enabled
+}
@@ -0,0 +1,338 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"sort"
+	"strings"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/app/repo"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"gorm.io/gorm"
+)
+
+func (a AgentService) BindWebsite(req dto.AgentWebsiteBindReq) error {
+	agent, err := agentRepo.GetFirst(repo.WithByID(req.AgentID))
+	if err != nil {
+		return err
+	}
+	if agent.WebsiteID != 0 {
+		return buserr.New("ErrAgentWebsiteBound")
+	}
+
+	website, err := websiteRepo.GetFirst(repo.WithByID(req.WebsiteID))
+	if err != nil {
+		return err
+	}
+	if !isBindableAgentWebsiteType(website.Type) {
+		return buserr.New("ErrAgentWebsiteTypeUnsupported")
+	}
+
+	boundAgent, err := agentRepo.GetFirst(repo.WithByWebsiteID(req.WebsiteID))
+	if err == nil && boundAgent.ID > 0 {
+		return buserr.New("ErrAgentWebsiteInUse")
+	}
+	if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
+		return err
+	}
+
+	agent.WebsiteID = req.WebsiteID
+	if err := agentRepo.Save(agent); err != nil {
+		return err
+	}
+	return ensureOpenclawWebsiteAllowedOrigin(agent, &website)
+}
+
+func (a AgentService) UnbindWebsite(req dto.AgentIDReq) error {
+	agent, err := agentRepo.GetFirst(repo.WithByID(req.AgentID))
+	if err != nil {
+		return err
+	}
+	if agent.WebsiteID == 0 {
+		return nil
+	}
+
+	website, err := websiteRepo.GetFirst(repo.WithByID(agent.WebsiteID))
+	if err != nil {
+		return err
+	}
+	if website.Type == constant.Deployment {
+		return buserr.New("ErrAgentWebsiteUnbindUnsupported")
+	}
+
+	agent.WebsiteID = 0
+	return agentRepo.Save(agent)
+}
+
+func hydrateAgentWebsiteItems(items []dto.AgentItem) error {
+	explicitWebsiteMap, err := loadAgentWebsiteMapByID(items)
+	if err != nil {
+		return err
+	}
+	websiteDomainMap, err := loadAgentWebsiteDomainMapByWebsiteID(items)
+	if err != nil {
+		return err
+	}
+	fillAgentWebsiteItems(items, explicitWebsiteMap, websiteDomainMap)
+	return nil
+}
+
+func loadAgentWebsiteMapByID(items []dto.AgentItem) (map[uint]model.Website, error) {
+	websiteIDs := make([]uint, 0, len(items))
+	for _, item := range items {
+		if item.WebsiteID > 0 {
+			websiteIDs = append(websiteIDs, item.WebsiteID)
+		}
+	}
+	if len(websiteIDs) == 0 {
+		return map[uint]model.Website{}, nil
+	}
+	websites, err := websiteRepo.GetBy(repo.WithByIDs(uniqueUintList(websiteIDs)))
+	if err != nil {
+		return nil, err
+	}
+	websiteMap := make(map[uint]model.Website, len(websites))
+	for _, website := range websites {
+		websiteMap[website.ID] = website
+	}
+	return websiteMap, nil
+}
+
+func loadAgentWebsiteDomainMapByWebsiteID(items []dto.AgentItem) (map[uint][]model.WebsiteDomain, error) {
+	websiteIDs := make([]uint, 0, len(items))
+	for _, item := range items {
+		if item.WebsiteID > 0 {
+			websiteIDs = append(websiteIDs, item.WebsiteID)
+		}
+	}
+	if len(websiteIDs) == 0 {
+		return map[uint][]model.WebsiteDomain{}, nil
+	}
+	websiteDomains, err := websiteDomainRepo.GetBy(websiteDomainRepo.WithWebsiteIds(uniqueUintList(websiteIDs)), repo.WithOrderAsc("id"))
+	if err != nil {
+		return nil, err
+	}
+	websiteDomainMap := make(map[uint][]model.WebsiteDomain, len(websiteDomains))
+	for _, websiteDomain := range websiteDomains {
+		websiteDomainMap[websiteDomain.WebsiteID] = append(websiteDomainMap[websiteDomain.WebsiteID], websiteDomain)
+	}
+	return websiteDomainMap, nil
+}
+
+func loadAgentWebsiteResourceName(website model.Website) (string, error) {
+	websiteDomains, err := websiteDomainRepo.GetBy(websiteDomainRepo.WithWebsiteId(website.ID), repo.WithOrderAsc("id"))
+	if err != nil {
+		return "", err
+	}
+	if len(websiteDomains) > 0 {
+		return websiteDomains[0].Domain, nil
+	}
+	if website.PrimaryDomain != "" {
+		return website.PrimaryDomain, nil
+	}
+	return fmt.Sprintf("%d", website.ID), nil
+}
+
+func fillAgentWebsiteItems(items []dto.AgentItem, explicitWebsiteMap map[uint]model.Website, websiteDomainMap map[uint][]model.WebsiteDomain) {
+	for index := range items {
+		if items[index].WebsiteID == 0 {
+			continue
+		}
+		website, ok := explicitWebsiteMap[items[index].WebsiteID]
+		if !ok {
+			items[index].WebsiteID = 0
+			items[index].WebsitePrimaryDomain = ""
+			items[index].WebsiteType = ""
+			items[index].WebsiteProtocol = ""
+			continue
+		}
+		items[index].WebsiteType = website.Type
+		items[index].WebsiteProtocol = website.Protocol
+		websiteDomains := websiteDomainMap[items[index].WebsiteID]
+		if len(websiteDomains) == 0 {
+			items[index].WebsitePrimaryDomain = ""
+			continue
+		}
+		items[index].WebsitePrimaryDomain = websiteDomains[0].Domain
+	}
+}
+
+func uniqueDeploymentWebsiteMapByAppInstall(websites []model.Website) map[uint]model.Website {
+	websiteMap := make(map[uint]model.Website)
+	duplicateAppInstallIDs := make(map[uint]struct{})
+	for _, website := range websites {
+		if website.AppInstallID == 0 {
+			continue
+		}
+		if _, duplicated := duplicateAppInstallIDs[website.AppInstallID]; duplicated {
+			continue
+		}
+		if _, exists := websiteMap[website.AppInstallID]; exists {
+			delete(websiteMap, website.AppInstallID)
+			duplicateAppInstallIDs[website.AppInstallID] = struct{}{}
+			continue
+		}
+		websiteMap[website.AppInstallID] = website
+	}
+	return websiteMap
+}
+
+func UniqueDeploymentWebsiteMapForMigration(websites []model.Website) map[uint]model.Website {
+	return uniqueDeploymentWebsiteMapByAppInstall(websites)
+}
+
+func uniqueUintList(items []uint) []uint {
+	itemMap := make(map[uint]struct{}, len(items))
+	uniq := make([]uint, 0, len(items))
+	for _, item := range items {
+		if item == 0 {
+			continue
+		}
+		if _, exists := itemMap[item]; exists {
+			continue
+		}
+		itemMap[item] = struct{}{}
+		uniq = append(uniq, item)
+	}
+	return uniq
+}
+
+func isBindableAgentWebsiteType(websiteType string) bool {
+	return websiteType == constant.Proxy || websiteType == constant.Static
+}
+
+func bindDeploymentWebsiteToAgentByAppInstall(website *model.Website) error {
+	if website.ID == 0 || website.Type != constant.Deployment || website.AppInstallID == 0 {
+		return nil
+	}
+
+	appInstall, err := appInstallRepo.GetFirst(repo.WithByID(website.AppInstallID))
+	if err != nil {
+		return err
+	}
+	if appInstall.App.Key != constant.AppOpenclaw && appInstall.App.Key != constant.AppCopaw && appInstall.App.Key != constant.AppHermesAgent {
+		return nil
+	}
+
+	agent, err := agentRepo.GetFirst(repo.WithByAppInstallID(website.AppInstallID))
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	if agent.WebsiteID != 0 {
+		return nil
+	}
+
+	agent.WebsiteID = website.ID
+	if err := agentRepo.Save(agent); err != nil {
+		return err
+	}
+	return ensureOpenclawWebsiteAllowedOrigin(agent, website)
+}
+
+func ensureOpenclawWebsiteAllowedOrigin(agent *model.Agent, website *model.Website) error {
+	if agent == nil || website == nil || agent.AgentType != constant.AppOpenclaw {
+		return nil
+	}
+
+	origins, err := buildWebsiteAllowedOrigins(website)
+	if err != nil {
+		return err
+	}
+	if len(origins) == 0 {
+		return nil
+	}
+
+	install, err := appInstallRepo.GetFirst(repo.WithByID(agent.AppInstallID))
+	if err != nil {
+		return err
+	}
+	conf, err := readOpenclawConfig(agent.ConfigPath)
+	if err != nil {
+		return err
+	}
+
+	allowedOrigins := extractSecurityConfig(conf).AllowedOrigins
+	allowedOrigins, err = normalizeAllowedOrigins(append(allowedOrigins, origins...))
+	if err != nil {
+		return err
+	}
+	setSecurityConfig(conf, dto.AgentSecurityConfig{AllowedOrigins: allowedOrigins})
+	if err := writeOpenclawConfigRaw(agent.ConfigPath, conf); err != nil {
+		return err
+	}
+	if err := syncOpenclawAllowedOriginEnv(&install, allowedOrigins); err != nil {
+		return err
+	}
+	return appInstallRepo.Save(context.Background(), &install)
+}
+
+func buildWebsiteAllowedOrigins(website *model.Website) ([]string, error) {
+	websiteDomains, err := websiteDomainRepo.GetBy(websiteDomainRepo.WithWebsiteId(website.ID), repo.WithOrderAsc("id"))
+	if err != nil {
+		return nil, err
+	}
+	if len(websiteDomains) == 0 {
+		return nil, nil
+	}
+	defaultHTTPSPort := 443
+	if strings.EqualFold(website.Protocol, "https") {
+		nginxInstall, err := getAppInstallByKey(constant.AppOpenresty)
+		if err == nil && nginxInstall.HttpsPort > 0 {
+			defaultHTTPSPort = nginxInstall.HttpsPort
+		}
+	}
+	return buildWebsiteAllowedOriginsFromDomains(website, websiteDomains, defaultHTTPSPort)
+}
+
+func buildWebsiteAllowedOriginsFromDomains(website *model.Website, websiteDomains []model.WebsiteDomain, defaultHTTPSPort int) ([]string, error) {
+	if len(websiteDomains) == 0 {
+		return nil, nil
+	}
+	sort.Slice(websiteDomains, func(i, j int) bool {
+		return websiteDomains[i].ID < websiteDomains[j].ID
+	})
+	origins := make([]string, 0, len(websiteDomains))
+	for _, websiteDomain := range websiteDomains {
+		origin, err := buildWebsiteDomainOrigin(website.Protocol, websiteDomain, defaultHTTPSPort)
+		if err != nil {
+			return nil, err
+		}
+		origins = append(origins, origin)
+	}
+	return origins, nil
+}
+
+func buildWebsiteDomainOrigin(protocol string, websiteDomain model.WebsiteDomain, defaultHTTPSPort int) (string, error) {
+	origin := strings.ToLower(strings.TrimSpace(protocol)) + "://" + formatWebsiteDomainHost(websiteDomain.Domain)
+	switch strings.ToLower(strings.TrimSpace(protocol)) {
+	case "http":
+		if websiteDomain.Port > 0 && websiteDomain.Port != 80 {
+			origin = fmt.Sprintf("%s:%d", origin, websiteDomain.Port)
+		}
+	case "https":
+		port := websiteDomain.Port
+		if !websiteDomain.SSL {
+			port = defaultHTTPSPort
+		}
+		if port > 0 && port != 443 {
+			origin = fmt.Sprintf("%s:%d", origin, port)
+		}
+	}
+	return normalizeAllowedOrigin(origin)
+}
+
+func formatWebsiteDomainHost(domain string) string {
+	host := strings.Trim(strings.TrimSpace(domain), "[]")
+	if ip := net.ParseIP(host); ip != nil && strings.Contains(host, ":") {
+		return "[" + host + "]"
+	}
+	return host
+}
@@ -1,11 +1,14 @@
 package service

 import (
+	"bytes"
 	"context"
 	"fmt"
 	"os"
+	"os/exec"
 	"path"
 	"strings"
+	"syscall"
 	"time"

 	"github.com/1Panel-dev/1Panel/agent/app/dto"
@@ -19,6 +22,7 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/i18n"
 	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
 	"github.com/1Panel-dev/1Panel/agent/utils/common"
+	"github.com/1Panel-dev/1Panel/agent/utils/re"
 	"github.com/jinzhu/copier"
 )

@@ -107,8 +111,7 @@ func (u *AIToolService) Create(req dto.OllamaModelName) error {
 	}
 	go func() {
 		taskItem.AddSubTask(i18n.GetWithName("OllamaModelPull", req.Name), func(t *task.Task) error {
-			cmdMgr := cmd.NewCommandMgr(cmd.WithTask(*taskItem), cmd.WithTimeout(time.Hour))
-			return cmdMgr.Run("docker", "exec", containerName, "ollama", "pull", info.Name)
+			return runOllamaPullWithProcess(t, containerName, info.Name)
 		}, nil)
 		taskItem.AddSubTask(i18n.GetWithName("OllamaModelSize", req.Name), func(t *task.Task) error {
 			itemSize, err := loadModelSize(info.Name, containerName)
@@ -162,8 +165,7 @@ func (u *AIToolService) Recreate(req dto.OllamaModelName) error {
 	}
 	go func() {
 		taskItem.AddSubTask(i18n.GetWithName("OllamaModelPull", req.Name), func(t *task.Task) error {
-			cmdMgr := cmd.NewCommandMgr(cmd.WithTask(*taskItem), cmd.WithTimeout(time.Hour))
-			return cmdMgr.Run("docker", "exec", containerName, "ollama", "pull", req.Name)
+			return runOllamaPullWithProcess(t, containerName, req.Name)
 		}, nil)
 		taskItem.AddSubTask(i18n.GetWithName("OllamaModelSize", req.Name), func(t *task.Task) error {
 			itemSize, err := loadModelSize(modelInfo.Name, containerName)
@@ -394,3 +396,127 @@ func loadModelSize(name string, containerName string) (string, error) {
 	}
 	return "", fmt.Errorf("no such model %s in ollama list, std: %s", name, stdout)
 }
+
+func runOllamaPullWithProcess(taskItem *task.Task, containerName, modelName string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), time.Hour)
+	defer cancel()
+
+	cmdItem := exec.CommandContext(ctx, "docker", "exec", containerName, "ollama", "pull", modelName)
+	cmdItem.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+	writer := &ollamaPullLogWriter{taskItem: taskItem}
+	cmdItem.Stdout = writer
+	cmdItem.Stderr = writer
+
+	if err := cmdItem.Start(); err != nil {
+		return fmt.Errorf("failed to start ollama pull %s: %w", modelName, err)
+	}
+	waitErr := cmdItem.Wait()
+	writer.Flush()
+	if ctx.Err() == context.DeadlineExceeded {
+		if cmdItem.Process != nil && cmdItem.Process.Pid > 0 {
+			_ = syscall.Kill(-cmdItem.Process.Pid, syscall.SIGKILL)
+		}
+		return buserr.New("ErrCmdTimeout")
+	}
+	if waitErr == nil {
+		return nil
+	}
+	if len(strings.TrimSpace(writer.errBuf.String())) > 0 {
+		return fmt.Errorf("%s", strings.TrimSpace(writer.errBuf.String()))
+	}
+	return waitErr
+}
+
+type ollamaPullLogWriter struct {
+	taskItem *task.Task
+	errBuf   bytes.Buffer
+}
+
+func (w *ollamaPullLogWriter) Write(p []byte) (n int, err error) {
+	w.errBuf.Write(p)
+	for _, segment := range splitOllamaPullSegments(string(p)) {
+		w.logLine(segment)
+	}
+	return len(p), nil
+}
+
+func (w *ollamaPullLogWriter) Flush() {}
+
+func (w *ollamaPullLogWriter) logLine(line string) {
+	if w == nil || w.taskItem == nil {
+		return
+	}
+	line = sanitizeOllamaPullLine(line)
+	if line == "" {
+		return
+	}
+	if prefix := resolveOllamaPullLogPrefix(line); prefix != "" {
+		_ = replaceOllamaPullLogLine(prefix, line, w.taskItem)
+		return
+	}
+	w.taskItem.Log(line)
+}
+
+func sanitizeOllamaPullLine(line string) string {
+	line = re.StripAnsiControlSeq(line)
+	line = strings.TrimSpace(line)
+	if strings.HasPrefix(line, "pulling manifes") {
+		return ""
+	}
+	return line
+}
+
+func splitOllamaPullSegments(chunk string) []string {
+	if chunk == "" {
+		return nil
+	}
+	chunk = strings.ReplaceAll(chunk, "\r", "\n")
+	parts := strings.Split(chunk, "\x1b[1G")
+	segments := make([]string, 0, len(parts))
+	for _, part := range parts {
+		for _, line := range strings.Split(part, "\n") {
+			line = strings.TrimSpace(line)
+			if line == "" {
+				continue
+			}
+			segments = append(segments, line)
+		}
+	}
+	return segments
+}
+
+func resolveOllamaPullLogPrefix(line string) string {
+	if strings.HasPrefix(line, "pulling ") {
+		if idx := strings.Index(line, ":"); idx > 0 {
+			return strings.TrimSpace(line[:idx])
+		}
+		fields := strings.Fields(line)
+		if len(fields) >= 2 {
+			return strings.TrimSpace(fields[0] + " " + fields[1])
+		}
+	}
+	return ""
+}
+
+func replaceOllamaPullLogLine(prefix, newLine string, taskItem *task.Task) error {
+	if taskItem == nil || taskItem.Task == nil {
+		return nil
+	}
+	data, err := os.ReadFile(taskItem.Task.LogFile)
+	if err != nil {
+		return err
+	}
+	lines := strings.Split(string(data), "\n")
+	for idx, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		if trimmed == "" {
+			continue
+		}
+		if strings.Contains(trimmed, prefix) {
+			lines[idx] = time.Now().Format("2006/01/02 15:04:05") + " " + newLine
+			return os.WriteFile(taskItem.Task.LogFile, []byte(strings.Join(lines, "\n")), os.ModePerm)
+		}
+	}
+	taskItem.Log(newLine)
+	return nil
+}
@@ -15,6 +15,7 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/utils/email"
 	"github.com/1Panel-dev/1Panel/agent/utils/xpack"
 	"github.com/shirou/gopsutil/v4/disk"
+	"mime"
 	"sort"
 	"strings"
 	"sync"
@@ -60,7 +61,7 @@ func (a AlertService) PageAlert(search dto.AlertSearch) (int64, []dto.AlertDTO,
 	if search.Type != "" {
 		opts = append(opts, alertRepo.WithByType(search.Type))
 	}
-	opts = append(opts, repo.WithOrderBy("created_at desc"))
+	opts = append(opts, repo.WithOrderDesc("created_at"))

 	total, alerts, err := alertRepo.Page(search.Page, search.PageSize, opts...)
 	if err != nil {
@@ -343,7 +344,7 @@ func (a AlertService) PageAlertLogs(search dto.AlertLogSearch) (int64, []dto.Ale
 	if search.Count != 0 {
 		opts = append(opts, alertRepo.WithByCount(search.Count))
 	}
-	opts = append(opts, repo.WithOrderBy("created_at desc"))
+	opts = append(opts, repo.WithOrderDesc("created_at"))

 	total, alerts, err := alertRepo.PageLog(search.Page, search.PageSize, opts...)
 	if err != nil {
@@ -483,13 +484,14 @@ func (a AlertService) TestAlertConfig(req dto.AlertConfigTest) (bool, error) {
 	if username == "" {
 		username = req.Sender
 	}
+	encodedDisplayName := mime.BEncoding.Encode("UTF-8", req.DisplayName)
 	cfg := email.SMTPConfig{
 		Host:       req.Host,
 		Port:       req.Port,
 		Sender:     req.Sender,
 		Username:   username,
 		Password:   req.Password,
-		From:       fmt.Sprintf(`"%s" <%s>`, req.DisplayName, req.Sender),
+		From:       fmt.Sprintf(`"%s" <%s>`, encodedDisplayName, req.Sender),
 		Encryption: req.Encryption,
 		Recipient:  req.Recipient,
 	}
@@ -2,6 +2,13 @@ package service

 import (
 	"encoding/json"
+	"fmt"
+	"math"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/model"
 	"github.com/1Panel-dev/1Panel/agent/app/repo"
@@ -17,11 +24,6 @@ import (
 	"github.com/shirou/gopsutil/v4/load"
 	"github.com/shirou/gopsutil/v4/mem"
 	"github.com/shirou/gopsutil/v4/net"
-	"math"
-	"sort"
-	"strconv"
-	"strings"
-	"time"
 )

 const (
@@ -110,7 +112,7 @@ func (m *AlertTaskHelper) getClassifiedAlerts() (baseAlerts, resourceAlerts []dt

 func handleBaseAlerts(baseAlerts []dto.AlertDTO) {
 	if len(baseAlerts) == 0 {
-		stopResourceJob()
+		stopBaseJob()
 		return
 	}
 	if global.AlertBaseJobID == 0 {
@@ -227,11 +229,30 @@ func loadSSLInfo(alert dto.AlertDTO) {
 		return
 	}
 	sender := NewAlertSender(alert, projectJSON)
+	minDays := math.MaxInt
+	maxDays := 0
+	allDomains := make([]string, 0)
 	for daysDiff, domains := range daysDiffMap {
-		domainStr := strings.Join(domains, ",")
-		params := createAlertBaseParams(strconv.Itoa(len(domains)), strconv.Itoa(daysDiff))
-		sender.Send(domainStr, params)
+		allDomains = append(allDomains, domains...)
+		if daysDiff < minDays {
+			minDays = daysDiff
+		}
+		if daysDiff > maxDays {
+			maxDays = daysDiff
+		}
 	}
+	if len(allDomains) == 0 {
+		return
+	}
+	var daysStr string
+	if len(allDomains) == 1 {
+		daysStr = strconv.Itoa(minDays)
+	} else {
+		daysStr = strconv.Itoa(minDays) + "-" + strconv.Itoa(maxDays)
+	}
+	domainStr := strings.Join(allDomains, ",")
+	params := createAlertBaseParams(strconv.Itoa(len(daysDiffMap)), daysStr)
+	sender.Send(domainStr, params)
 }

 func loadWebsiteInfo(alert dto.AlertDTO) {
@@ -247,11 +268,30 @@ func loadWebsiteInfo(alert dto.AlertDTO) {
 		return
 	}
 	sender := NewAlertSender(alert, projectJSON)
+	minDays := math.MaxInt
+	maxDays := 0
+	allDomains := make([]string, 0)
 	for daysDiff, domains := range daysDiffMap {
-		domainStr := strings.Join(domains, ",")
-		params := createAlertBaseParams(strconv.Itoa(len(domains)), strconv.Itoa(daysDiff))
-		sender.Send(domainStr, params)
+		allDomains = append(allDomains, domains...)
+		if daysDiff < minDays {
+			minDays = daysDiff
+		}
+		if daysDiff > maxDays {
+			maxDays = daysDiff
+		}
 	}
+	if len(allDomains) == 0 {
+		return
+	}
+	var daysStr string
+	if len(allDomains) == 1 {
+		daysStr = strconv.Itoa(minDays)
+	} else {
+		daysStr = strconv.Itoa(minDays) + "-" + strconv.Itoa(maxDays)
+	}
+	domainStr := strings.Join(allDomains, ",")
+	params := createAlertBaseParams(strconv.Itoa(len(daysDiffMap)), daysStr)
+	sender.Send(domainStr, params)
 }

 func loadPanelPwd(alert dto.AlertDTO) {
@@ -384,25 +424,19 @@ func loadDiskUsage(alert dto.AlertDTO) {
 	}
 	if isAlertDue(newDate) {
 		if strings.Contains(alert.Project, "all") {
-			err = processAllDisks(alert)
+			_ = processAllDisks(alert)
 		} else {
-			err = processSingleDisk(alert)
+			_ = processSingleDisk(alert)
 		}
 	}
 }

 func loadPanelLogin(alert dto.AlertDTO) {
 	count, isAlert, err := alertUtil.CountRecentFailedLoginLogs(alert.Cycle, alert.Count)
-	alertType := alert.Type
-	quota := strconv.Itoa(count)
-	quotaType := strconv.Itoa(int(alert.Cycle))
 	if err != nil {
 		global.LOG.Errorf("Failed to count recent failed login logs: %v", err)
 	}
 	if isAlert {
-		alertType = "panelLogin"
-		quota = strconv.Itoa(count)
-		quotaType = "panelLogin"
 		params := []dto.Param{
 			{
 				Index: "1",
@@ -415,7 +449,7 @@ func loadPanelLogin(alert dto.AlertDTO) {
 				Value: "",
 			},
 		}
-		sendAlerts(alert, alertType, quota, quotaType, params)
+		sendAlerts(alert, "panelLogin", strconv.Itoa(count), "panelLogin", params)
 	}

 	whitelist := strings.Split(strings.TrimSpace(alert.AdvancedParams), "\n")
@@ -424,15 +458,13 @@ func loadPanelLogin(alert dto.AlertDTO) {
 		global.LOG.Errorf("Failed to check recent failed ip login logs: %v", err)
 	}
 	if len(records) > 0 {
-		quota = strings.Join(func() []string {
+		quota := strings.Join(func() []string {
 			var ips []string
 			for _, r := range records {
 				ips = append(ips, r.IP)
 			}
 			return ips
 		}(), "\n")
-		alertType = "panelIpLogin"
-		quotaType = "panelIpLogin"
 		params := []dto.Param{
 			{
 				Index: "1",
@@ -445,22 +477,16 @@ func loadPanelLogin(alert dto.AlertDTO) {
 				Value: " IP ",
 			},
 		}
-		sendAlerts(alert, alertType, quota, quotaType, params)
+		sendAlerts(alert, "panelIpLogin", quota, "panelIpLogin", params)
 	}
 }

 func loadSSHLogin(alert dto.AlertDTO) {
 	count, isAlert, err := alertUtil.CountRecentFailedSSHLog(alert.Cycle, alert.Count)
-	alertType := alert.Type
-	quota := strconv.Itoa(count)
-	quotaType := strconv.Itoa(int(alert.Cycle))
 	if err != nil {
 		global.LOG.Errorf("Failed to count recent failed ssh login logs: %v", err)
 	}
 	if isAlert {
-		alertType = "sshLogin"
-		quota = strconv.Itoa(count)
-		quotaType = "sshLogin"
 		params := []dto.Param{
 			{
 				Index: "1",
@@ -473,7 +499,7 @@ func loadSSHLogin(alert dto.AlertDTO) {
 				Value: "",
 			},
 		}
-		sendAlerts(alert, alertType, quota, quotaType, params)
+		sendAlerts(alert, "sshLogin", strconv.Itoa(count), "sshLogin", params)
 	}
 	whitelist := strings.Split(strings.TrimSpace(alert.AdvancedParams), "\n")
 	records, err := alertUtil.FindRecentSuccessLoginNotInWhitelist(30, whitelist)
@@ -481,9 +507,7 @@ func loadSSHLogin(alert dto.AlertDTO) {
 		global.LOG.Errorf("Failed to check recent failed ip ssh login logs: %v", err)
 	}
 	if len(records) > 0 {
-		quota = strings.Join(records, "\n")
-		alertType = "sshIpLogin"
-		quotaType = "sshIpLogin"
+		quota := strings.Join(records, "\n")
 		params := []dto.Param{
 			{
 				Index: "1",
@@ -496,7 +520,7 @@ func loadSSHLogin(alert dto.AlertDTO) {
 				Value: " IP ",
 			},
 		}
-		sendAlerts(alert, alertType, quota, quotaType, params)
+		sendAlerts(alert, "sshIpLogin", quota, "sshIpLogin", params)
 	}
 }

@@ -580,10 +604,12 @@ func sendAlerts(alert dto.AlertDTO, alertType, quota, quotaType string, params [
 					AlertId: alert.ID,
 					Count:   todayCount + 1,
 				}
-				_ = xpack.CreateSMSAlertLog(alertType, alert, create, quotaType, params, constant.SMS)
+				alertErr := xpack.CreateSMSAlertLog(alertType, alert, create, quotaType, params, constant.SMS)
+				if alertErr != nil {
+					global.LOG.Infof("%s alert sms push faild, err: %v", alertType, alertErr.Error())
+					continue
+				}
 				alertUtil.CreateNewAlertTask(quota, alertType, quotaType, constant.SMS)
-				global.LOG.Infof("%s alert sms push successful", alertType)
-
 			case constant.Email:
 				todayCount, isValid := canSendAlertToday(alertType, quotaType, alert.SendCount, constant.Email)
 				if !isValid {
@@ -599,9 +625,54 @@ func sendAlerts(alert dto.AlertDTO, alertType, quota, quotaType string, params [
 				create.AlertRule = alertUtil.ProcessAlertRule(alert)
 				create.AlertDetail = alertUtil.ProcessAlertDetail(alertInfo, quotaType, params, constant.Email)
 				transport := xpack.LoadRequestTransport()
-				_ = alertUtil.CreateEmailAlertLog(create, alertInfo, params, transport)
+				agentInfo, _ := xpack.GetAgentInfo()
+				alertErr := alertUtil.CreateEmailAlertLog(create, alertInfo, params, transport, agentInfo)
+				if alertErr != nil {
+					global.LOG.Infof("%s alert email push faild, err: %v", alertType, alertErr.Error())
+					continue
+				}
 				alertUtil.CreateNewAlertTask(quota, alertType, quotaType, constant.Email)
-				global.LOG.Infof("%s alert email push successful", alertType)
+			case constant.WeCom, constant.DingTalk, constant.FeiShu:
+				todayCount, isValid := canSendAlertToday(alertType, quotaType, alert.SendCount, m)
+				if !isValid {
+					continue
+				}
+				var create = dto.AlertLogCreate{
+					Type:    alertUtil.GetCronJobType(alert.Type),
+					AlertId: alert.ID,
+					Count:   todayCount + 1,
+				}
+				transport := xpack.LoadRequestTransport()
+				agentInfo, _ := xpack.GetAgentInfo()
+				err := xpack.CreateWebhookAlertLog(alertType, alert, create, quotaType, params, m, transport, agentInfo)
+				if err != nil {
+					global.LOG.Infof("%s alert webhook %s push faild, err: %v", alertType, m, err)
+					continue
+				}
+				alertUtil.CreateNewAlertTask(quota, alertType, quotaType, m)
+			case constant.Bark:
+				todayCount, isValid := canSendAlertToday(alertType, quotaType, alert.SendCount, m)
+				if !isValid {
+					continue
+				}
+				var create = dto.AlertLogCreate{
+					Type:    alertUtil.GetCronJobType(alert.Type),
+					AlertId: alert.ID,
+					Count:   todayCount + 1,
+				}
+				alertInfo := alert
+				alertInfo.Type = alertType
+				create.AlertRule = alertUtil.ProcessAlertRule(alert)
+				create.AlertDetail = alertUtil.ProcessAlertDetail(alertInfo, quotaType, params, m)
+				transport := xpack.LoadRequestTransport()
+				agentInfo, _ := xpack.GetAgentInfo()
+				alertErr := alertUtil.CreateBarkAlertLog(create, alertInfo, params, transport, agentInfo)
+				if alertErr != nil {
+					global.LOG.Infof("%s alert %s push failed, err: %v", alertType, m, alertErr.Error())
+					continue
+				}
+				alertUtil.CreateNewAlertTask(quota, alertType, quotaType, m)
+			default:
 			}
 		}
 	}
@@ -641,7 +712,9 @@ func calculateSSLExpiryDays(sslList []model.WebsiteSSL, cycle uint) (map[int][]s
 	projectMap := make(map[uint][]time.Time)

 	for _, ssl := range sslList {
-		daysDiff := int(ssl.ExpireDate.Sub(currentDate).Hours() / 24)
+		daysDiff := int(math.Ceil(
+			ssl.ExpireDate.Sub(currentDate).Hours() / 24,
+		))
 		if daysDiff > 0 && int(cycle) >= daysDiff {
 			daysDiffMap[daysDiff] = append(daysDiffMap[daysDiff], ssl.PrimaryDomain)
 			projectMap[ssl.ID] = append(projectMap[ssl.ID], ssl.ExpireDate)
@@ -656,7 +729,9 @@ func calculateWebsiteExpiryDays(websites []model.Website, cycle uint) (map[int][
 	projectMap := make(map[uint][]time.Time)

 	for _, website := range websites {
-		daysDiff := int(website.ExpireDate.Sub(currentDate).Hours() / 24)
+		daysDiff := int(math.Ceil(
+			website.ExpireDate.Sub(currentDate).Hours() / 24,
+		))
 		if daysDiff > 0 && int(cycle) >= daysDiff {
 			daysDiffMap[daysDiff] = append(daysDiffMap[daysDiff], website.PrimaryDomain)
 			projectMap[website.ID] = append(projectMap[website.ID], website.ExpireDate)
@@ -820,30 +895,36 @@ func processAllDisks(alert dto.AlertDTO) error {
 		global.LOG.Errorf("error getting disk list, err: %v", err)
 		return err
 	}
+	var errMsgs []string
 	for _, item := range diskList {
-		if success, err := checkAndCreateDiskAlert(alert, item.Path); err == nil && success {
-			global.LOG.Infof("disk alert pushed successfully for %s", item.Path)
+		err := checkAndCreateDiskAlert(alert, item.Path)
+		if err != nil {
+			errMsg := fmt.Sprintf("disk path %s process failed: %v", item.Path, err)
+			errMsgs = append(errMsgs, errMsg)
+			global.LOG.Errorf("%s", errMsg)
+			continue
 		}
 	}
+	if len(errMsgs) > 0 {
+		return fmt.Errorf("batch process disks failed, error count: %d, details: %s", len(errMsgs), strings.Join(errMsgs, "; "))
+	}
 	return nil
 }

 func processSingleDisk(alert dto.AlertDTO) error {
-	success, err := checkAndCreateDiskAlert(alert, alert.Project)
+	err := checkAndCreateDiskAlert(alert, alert.Project)
 	if err != nil {
+		global.LOG.Errorf("%s", err.Error())
 		return err
 	}
-	if success {
-		global.LOG.Infof("disk alert pushed successfully for %s", alert.Project)
-	}
 	return nil
 }

-func checkAndCreateDiskAlert(alert dto.AlertDTO, path string) (bool, error) {
+func checkAndCreateDiskAlert(alert dto.AlertDTO, path string) error {
 	usageStat, err := psutil.DISK.GetUsage(path, false)
 	if err != nil {
 		global.LOG.Errorf("error getting disk usage for %s, err: %v", path, err)
-		return false, err
+		return err
 	}

 	usedTotal, usedStr := calculateUsedTotal(alert.Cycle, usageStat)
@@ -852,13 +933,12 @@ func checkAndCreateDiskAlert(alert dto.AlertDTO, path string) (bool, error) {
 		commonTotal *= 1024 * 1024 * 1024
 	}
 	if usedTotal < commonTotal {
-		return false, nil
+		return nil
 	}
-	global.LOG.Infof("disk「 %s 」usage: %s", path, usedStr)
 	params := createAlertDiskParams(path, usedStr)
 	sender := NewAlertSender(alert, alert.Project)
 	sender.ResourceSend(path, params)
-	return true, nil
+	return nil
 }

 func calculateUsedTotal(cycle uint, usageStat *disk.UsageStat) (float64, string) {
@@ -30,6 +30,10 @@ func (s *AlertSender) Send(quota string, params []dto.Param) {
 			s.sendSMS(quota, params)
 		case constant.Email:
 			s.sendEmail(quota, params)
+		case constant.Bark:
+			s.sendBark(quota, params)
+		case constant.WeCom, constant.DingTalk, constant.FeiShu:
+			s.sendWebhook(quota, params, method)
 		}
 	}
 }
@@ -43,6 +47,10 @@ func (s *AlertSender) ResourceSend(quota string, params []dto.Param) {
 			s.sendResourceSMS(quota, params)
 		case constant.Email:
 			s.sendResourceEmail(quota, params)
+		case constant.Bark:
+			s.sendResourceBark(quota, params)
+		case constant.WeCom, constant.DingTalk, constant.FeiShu:
+			s.sendResourceWebhook(quota, params, method)
 		}
 	}
 }
@@ -64,9 +72,12 @@ func (s *AlertSender) sendSMS(quota string, params []dto.Param) {
 		Type:    s.alert.Type,
 	}

-	_ = xpack.CreateSMSAlertLog(s.alert.Type, s.alert, create, quota, params, constant.SMS)
+	err := xpack.CreateSMSAlertLog(s.alert.Type, s.alert, create, quota, params, constant.SMS)
+	if err != nil {
+		global.LOG.Errorf("%s alert sms push failed: %v", s.alert.Type, err)
+		return
+	}
 	alertUtil.CreateNewAlertTask(quota, s.alert.Type, s.quotaType, constant.SMS)
-	global.LOG.Infof("%s alert sms push successful", s.alert.Type)
 }

 func (s *AlertSender) sendEmail(quota string, params []dto.Param) {
@@ -85,9 +96,60 @@ func (s *AlertSender) sendEmail(quota string, params []dto.Param) {
 	}

 	transport := xpack.LoadRequestTransport()
-	_ = alertUtil.CreateEmailAlertLog(create, s.alert, params, transport)
+	agentInfo, _ := xpack.GetAgentInfo()
+	err := alertUtil.CreateEmailAlertLog(create, s.alert, params, transport, agentInfo)
+	if err != nil {
+		global.LOG.Errorf("%s alert email push failed: %v", s.alert.Type, err)
+		return
+	}
 	alertUtil.CreateNewAlertTask(quota, s.alert.Type, s.quotaType, constant.Email)
-	global.LOG.Infof("%s alert email push successful", s.alert.Type)
+}
+
+func (s *AlertSender) sendBark(quota string, params []dto.Param) {
+	totalCount, isValid := s.canSendAlert(constant.Bark)
+	if !isValid {
+		return
+	}
+
+	create := dto.AlertLogCreate{
+		Status:      constant.AlertSuccess,
+		Count:       totalCount + 1,
+		AlertId:     s.alert.ID,
+		Type:        s.alert.Type,
+		AlertRule:   alertUtil.ProcessAlertRule(s.alert),
+		AlertDetail: alertUtil.ProcessAlertDetail(s.alert, quota, params, constant.Bark),
+	}
+
+	transport := xpack.LoadRequestTransport()
+	agentInfo, _ := xpack.GetAgentInfo()
+	err := alertUtil.CreateBarkAlertLog(create, s.alert, params, transport, agentInfo)
+	if err != nil {
+		global.LOG.Errorf("%s alert bark push failed: %v", s.alert.Type, err)
+		return
+	}
+	alertUtil.CreateNewAlertTask(quota, s.alert.Type, s.quotaType, constant.Bark)
+}
+
+func (s *AlertSender) sendWebhook(quota string, params []dto.Param, method string) {
+	totalCount, isValid := s.canSendAlert(method)
+	if !isValid {
+		return
+	}
+
+	create := dto.AlertLogCreate{
+		Status:  constant.AlertSuccess,
+		Count:   totalCount + 1,
+		AlertId: s.alert.ID,
+		Type:    s.alert.Type,
+	}
+	transport := xpack.LoadRequestTransport()
+	agentInfo, _ := xpack.GetAgentInfo()
+	err := xpack.CreateWebhookAlertLog(s.alert.Type, s.alert, create, quota, params, method, transport, agentInfo)
+	if err != nil {
+		global.LOG.Errorf("%s alert %s webhook push failed: %v", s.alert.Type, method, err)
+		return
+	}
+	alertUtil.CreateNewAlertTask(quota, s.alert.Type, s.quotaType, method)
 }

 func (s *AlertSender) sendResourceSMS(quota string, params []dto.Param) {
@@ -112,7 +174,6 @@ func (s *AlertSender) sendResourceSMS(quota string, params []dto.Param) {
 		return
 	}
 	alertUtil.CreateNewAlertTask(quota, s.alert.Type, s.quotaType, constant.SMS)
-	global.LOG.Infof("%s alert sms push successful", s.alert.Type)
 }

 func (s *AlertSender) sendResourceEmail(quota string, params []dto.Param) {
@@ -131,12 +192,57 @@ func (s *AlertSender) sendResourceEmail(quota string, params []dto.Param) {
 	}

 	transport := xpack.LoadRequestTransport()
-	if err := alertUtil.CreateEmailAlertLog(create, s.alert, params, transport); err != nil {
+	agentInfo, _ := xpack.GetAgentInfo()
+	if err := alertUtil.CreateEmailAlertLog(create, s.alert, params, transport, agentInfo); err != nil {
 		global.LOG.Errorf("failed to send Email alert: %v", err)
 		return
 	}
 	alertUtil.CreateNewAlertTask(quota, s.alert.Type, s.quotaType, constant.Email)
-	global.LOG.Infof("%s alert email push successful", s.alert.Type)
+}
+
+func (s *AlertSender) sendResourceBark(quota string, params []dto.Param) {
+	todayCount, isValid := s.canResourceSendAlert(constant.Bark)
+	if !isValid {
+		return
+	}
+
+	create := dto.AlertLogCreate{
+		Status:      constant.AlertSuccess,
+		Count:       todayCount + 1,
+		AlertId:     s.alert.ID,
+		Type:        s.alert.Type,
+		AlertRule:   alertUtil.ProcessAlertRule(s.alert),
+		AlertDetail: alertUtil.ProcessAlertDetail(s.alert, quota, params, constant.Bark),
+	}
+
+	transport := xpack.LoadRequestTransport()
+	agentInfo, _ := xpack.GetAgentInfo()
+	if err := alertUtil.CreateBarkAlertLog(create, s.alert, params, transport, agentInfo); err != nil {
+		global.LOG.Errorf("failed to send Bark alert: %v", err)
+		return
+	}
+	alertUtil.CreateNewAlertTask(quota, s.alert.Type, s.quotaType, constant.Bark)
+}
+
+func (s *AlertSender) sendResourceWebhook(quota string, params []dto.Param, method string) {
+	todayCount, isValid := s.canResourceSendAlert(method)
+	if !isValid {
+		return
+	}
+
+	create := dto.AlertLogCreate{
+		Status:  constant.AlertSuccess,
+		Count:   todayCount + 1,
+		AlertId: s.alert.ID,
+		Type:    s.alert.Type,
+	}
+	transport := xpack.LoadRequestTransport()
+	agentInfo, _ := xpack.GetAgentInfo()
+	if err := xpack.CreateWebhookAlertLog(s.alert.Type, s.alert, create, quota, params, method, transport, agentInfo); err != nil {
+		global.LOG.Errorf("%s alert %s webhook push failed: %v", s.alert.Type, method, err)
+		return
+	}
+	alertUtil.CreateNewAlertTask(quota, s.alert.Type, s.quotaType, method)
 }

 func (s *AlertSender) canSendAlert(method string) (uint, bool) {
@@ -12,6 +12,8 @@ import (
 	"reflect"
 	"strconv"
 	"strings"
+	"sync"
+	"time"

 	"github.com/gin-gonic/gin"

@@ -25,6 +27,7 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/global"
 	"github.com/1Panel-dev/1Panel/agent/i18n"
+	"github.com/1Panel-dev/1Panel/agent/utils/appicon"
 	"github.com/1Panel-dev/1Panel/agent/utils/common"
 	"github.com/1Panel-dev/1Panel/agent/utils/docker"
 	"github.com/1Panel-dev/1Panel/agent/utils/files"
@@ -33,6 +36,11 @@ import (
 	"gopkg.in/yaml.v3"
 )

+var (
+	appStoreSyncMu  sync.Mutex
+	appStoreSyncing bool
+)
+
 type AppService struct {
 }

@@ -41,12 +49,17 @@ type IAppService interface {
 	GetAppTags(ctx *gin.Context) ([]response.TagDTO, error)
 	GetApp(ctx *gin.Context, key string) (*response.AppDTO, error)
 	GetAppDetail(appId uint, version, appType string) (response.AppDetailDTO, error)
-	Install(req request.AppInstallCreate) (*model.AppInstall, error)
+	Install(req request.AppInstallCreate, executeScript bool) (*model.AppInstall, error)
 	SyncAppListFromRemote(taskID string) error
 	GetAppUpdate() (*response.AppUpdateRes, error)
 	GetAppDetailByID(id uint) (*response.AppDetailDTO, error)
 	SyncAppListFromLocal(taskID string)
-	GetAppIcon(appID uint) ([]byte, error)
+	GetAppIcon(key string) ([]byte, string, string, error)
+	GetAppDetailByKey(appKey, version string) (response.AppDetailSimpleDTO, error)
+}
+
+type appInstallHooks struct {
+	AfterCopyData func(appInstall *model.AppInstall) error
 }

 func NewIAppService() IAppService {
@@ -118,14 +131,15 @@ func (a AppService) PageApp(ctx *gin.Context, req request.AppSearch) (*response.
 			}
 		}
 		appDTO := &response.AppItem{
-			ID:          ap.ID,
-			Name:        ap.Name,
-			Key:         ap.Key,
-			Limit:       ap.Limit,
-			GpuSupport:  ap.GpuSupport,
-			Recommend:   ap.Recommend,
-			Description: ap.GetDescription(ctx),
-			Type:        ap.Type,
+			ID:                  ap.ID,
+			Name:                ap.Name,
+			Key:                 ap.Key,
+			Limit:               ap.Limit,
+			GpuSupport:          ap.GpuSupport,
+			Recommend:           ap.Recommend,
+			Description:         ap.GetDescription(ctx),
+			Type:                ap.Type,
+			BatchInstallSupport: ap.BatchInstallSupport,
 		}
 		appDTOs = append(appDTOs, appDTO)
 		tags, err := getAppTags(ap.ID, lang)
@@ -203,6 +217,20 @@ func (a AppService) GetApp(ctx *gin.Context, key string) (*response.AppDTO, erro
 	return &appDTO, nil
 }

+func (a AppService) GetAppDetailByKey(appKey, version string) (response.AppDetailSimpleDTO, error) {
+	var appDetailDTO response.AppDetailSimpleDTO
+	app, err := appRepo.GetFirst(appRepo.WithKey(appKey))
+	if err != nil {
+		return appDetailDTO, err
+	}
+	appDetail, err := appDetailRepo.GetFirst(appDetailRepo.WithAppId(app.ID), appDetailRepo.WithVersion(version))
+	if err != nil {
+		return appDetailDTO, err
+	}
+	appDetailDTO.ID = appDetail.ID
+	return appDetailDTO, nil
+}
+
 func (a AppService) GetAppDetail(appID uint, version, appType string) (response.AppDetailDTO, error) {
 	var (
 		appDetailDTO response.AppDetailDTO
@@ -316,7 +344,11 @@ func (a AppService) GetAppDetailByID(id uint) (*response.AppDetailDTO, error) {
 	return res, nil
 }

-func (a AppService) Install(req request.AppInstallCreate) (appInstall *model.AppInstall, err error) {
+func (a AppService) Install(req request.AppInstallCreate, executeScript bool) (appInstall *model.AppInstall, err error) {
+	return a.installWithHooks(req, executeScript, nil)
+}
+
+func (a AppService) installWithHooks(req request.AppInstallCreate, executeScript bool, hooks *appInstallHooks) (appInstall *model.AppInstall, err error) {
 	if err = docker.CreateDefaultDockerNetwork(); err != nil {
 		err = buserr.WithDetail("Err1PanelNetworkFailed", err.Error(), nil)
 		return
@@ -386,11 +418,21 @@ func (a AppService) Install(req request.AppInstallCreate) (appInstall *model.App
 		App:         app,
 	}
 	composeMap := make(map[string]interface{})
+	var composeRes []byte
 	if req.EditCompose {
 		if err = yaml.Unmarshal([]byte(req.DockerCompose), &composeMap); err != nil {
 			return
 		}
 	} else {
+		if appDetail.DockerCompose == "" {
+			dockerComposeUrl := fmt.Sprintf("%s/%s/1panel/%s/%s/docker-compose.yml", global.AppRepoURL(), global.CONF.Base.Mode, app.Key, appDetail.Version)
+			_, composeRes, err = req_helper.HandleRequest(dockerComposeUrl, http.MethodGet, constant.TimeOut20s)
+			if err != nil {
+				return
+			}
+			appDetail.DockerCompose = string(composeRes)
+			_ = appDetailRepo.Update(context.Background(), appDetail)
+		}
 		if err = yaml.Unmarshal([]byte(appDetail.DockerCompose), &composeMap); err != nil {
 			return
 		}
@@ -483,6 +525,10 @@ func (a AppService) Install(req request.AppInstallCreate) (appInstall *model.App
 	}
 	appInstall.Env = string(paramByte)

+	var maxSort int
+	global.DB.Model(&model.AppInstall{}).Where("favorite = ?", false).Select("COALESCE(MAX(sort_order),0)").Scan(&maxSort)
+	appInstall.SortOrder = maxSort + 1
+
 	if err = appInstallRepo.Create(context.Background(), appInstall); err != nil {
 		return
 	}
@@ -500,8 +546,15 @@ func (a AppService) Install(req request.AppInstallCreate) (appInstall *model.App
 		if err = copyData(t, app, appDetail, appInstall, req); err != nil {
 			return err
 		}
-		if err = runScript(t, appInstall, "init"); err != nil {
-			return err
+		if hooks != nil && hooks.AfterCopyData != nil {
+			if err = hooks.AfterCopyData(appInstall); err != nil {
+				return err
+			}
+		}
+		if executeScript {
+			if err = runScript(t, appInstall, "init"); err != nil {
+				return err
+			}
 		}
 		if app.Key == "openresty" {
 			if err = handleSiteDir(app, appDetail, req, t); err != nil {
@@ -524,7 +577,7 @@ func (a AppService) Install(req request.AppInstallCreate) (appInstall *model.App
 		_ = appInstallRepo.Save(context.Background(), appInstall)
 	}

-	installTask.AddSubTask(task.GetTaskName(appInstall.Name, task.TaskInstall, task.TaskScopeApp), installApp, handleAppStatus)
+	installTask.AddSubTaskWithOps(task.GetTaskName(appInstall.Name, task.TaskInstall, task.TaskScopeApp), installApp, handleAppStatus, 0, time.Hour)

 	go func() {
 		if taskErr := installTask.Execute(); taskErr != nil {
@@ -776,8 +829,13 @@ func (a AppService) GetAppUpdate() (*response.AppUpdateRes, error) {
 	res := &response.AppUpdateRes{
 		CanUpdate: false,
 	}
+	mysql, _ := appRepo.GetFirst(appRepo.WithKey("mysql"))
+	if !mysql.BatchInstallSupport {
+		res.CanUpdate = true
+		return res, nil
+	}

-	versionUrl := fmt.Sprintf("%s/%s/1panel.json.version.txt", global.CONF.RemoteURL.AppRepo, global.CONF.Base.Mode)
+	versionUrl := fmt.Sprintf("%s/%s/1panel.json.version.txt", global.AppRepoURL(), global.CONF.Base.Mode)
 	_, versionRes, err := req_helper.HandleRequest(versionUrl, http.MethodGet, constant.TimeOut20s)
 	if err != nil {
 		return nil, err
@@ -808,6 +866,13 @@ func (a AppService) GetAppUpdate() (*response.AppUpdateRes, error) {
 			res.CanUpdate = true
 			return res, err
 		}
+		if appicon.IsIconFile(app.Icon) {
+			fileName, _ := appicon.ParseIconField(app.Icon)
+			if fileName == "" || !appicon.IconFileExists(fileName) {
+				res.CanUpdate = true
+				return res, err
+			}
+		}
 	}

 	list, err := getAppList()
@@ -842,7 +907,7 @@ func getAppFromRepo(downloadPath string) error {

 func getAppList() (*dto.AppList, error) {
 	list := &dto.AppList{}
-	if err := getAppFromRepo(fmt.Sprintf("%s/%s/1panel.json.zip", global.CONF.RemoteURL.AppRepo, global.CONF.Base.Mode)); err != nil {
+	if err := getAppFromRepo(fmt.Sprintf("%s/%s/1panel.json.zip", global.AppRepoURL(), global.CONF.Base.Mode)); err != nil {
 		return nil, err
 	}
 	listFile := filepath.Join(global.Dir.ResourceDir, "1panel.json")
@@ -865,295 +930,116 @@ var InitTypes = map[string]struct{}{
 }

 func deleteCustomApp() {
+	installs, err := appInstallRepo.ListBy(context.Background())
+	if err != nil {
+		global.LOG.Errorf("[AppStore] deleteCustomApp: failed to list installs, skipping: %v", err)
+		return
+	}
 	var appIDS []uint
-	installs, _ := appInstallRepo.ListBy(context.Background())
 	for _, install := range installs {
 		appIDS = append(appIDS, install.AppId)
 	}
 	var ops []repo.DBOption
-	ops = append(ops, repo.WithByIDNotIn(appIDS))
 	if len(appIDS) > 0 {
 		ops = append(ops, repo.WithByIDNotIn(appIDS))
 	}
-	apps, _ := appRepo.GetBy(ops...)
+	apps, err := appRepo.GetBy(ops...)
+	if err != nil {
+		global.LOG.Errorf("[AppStore] deleteCustomApp: failed to get apps, skipping: %v", err)
+		return
+	}
 	var deleteIDS []uint
 	for _, app := range apps {
 		if app.Resource == constant.AppResourceCustom {
 			deleteIDS = append(deleteIDS, app.ID)
 		}
 	}
-	_ = appRepo.DeleteByIDs(context.Background(), deleteIDS)
-	_ = appDetailRepo.DeleteByAppIds(context.Background(), deleteIDS)
+	if len(deleteIDS) == 0 {
+		return
+	}
+	if err = appRepo.DeleteByIDs(context.Background(), deleteIDS); err != nil {
+		global.LOG.Errorf("[AppStore] deleteCustomApp: failed to delete apps: %v", err)
+	}
+	if err = appDetailRepo.DeleteByAppIds(context.Background(), deleteIDS); err != nil {
+		global.LOG.Errorf("[AppStore] deleteCustomApp: failed to delete app details: %v", err)
+	}
 }

 func (a AppService) SyncAppListFromRemote(taskID string) (err error) {
 	if xpack.IsUseCustomApp() {
 		return nil
 	}
+
+	appStoreSyncMu.Lock()
+	global.LOG.Info("[AppStore] sync app from remote task create start")
+	if appStoreSyncing {
+		appStoreSyncMu.Unlock()
+		global.LOG.Info("[AppStore] sync already in progress, skipping")
+		return nil
+	}
+	appStoreSyncing = true
+	appStoreSyncMu.Unlock()
+
 	syncTask, err := task.NewTaskWithOps(i18n.GetMsgByKey("App"), task.TaskSync, task.TaskScopeAppStore, taskID, 0)
 	if err != nil {
+		appStoreSyncMu.Lock()
+		appStoreSyncing = false
+		appStoreSyncMu.Unlock()
 		return err
 	}
-	syncTask.AddSubTask(task.GetTaskName(i18n.GetMsgByKey("App"), task.TaskSync, task.TaskScopeAppStore), func(t *task.Task) (err error) {
-		updateRes, err := a.GetAppUpdate()
-		if err != nil {
-			return err
-		}
-		if !updateRes.CanUpdate {
-			if updateRes.IsSyncing {
-				t.Log(i18n.GetMsgByKey("AppStoreIsSyncing"))
-				return nil
-			}
-			t.Log(i18n.GetMsgByKey("AppStoreIsUpToDate"))
-			return nil
-		}
-		list := &dto.AppList{}
-		if updateRes.AppList == nil {
-			list, err = getAppList()
-			if err != nil {
-				return err
-			}
-		} else {
-			list = updateRes.AppList
-		}
-		settingService := NewISettingService()
-		_ = settingService.Update("AppStoreSyncStatus", constant.StatusSyncing)

-		setting, err := settingService.GetSettingInfo()
-		if err != nil {
-			return err
-		}
-		var (
-			appTags   []*model.AppTag
-			oldAppIds []uint
-		)
-		if err = SyncTags(list.Extra); err != nil {
-			return err
-		}
-		deleteCustomApp()
-		oldApps, err := appRepo.GetBy(appRepo.WithNotLocal())
-		if err != nil {
-			return err
-		}
-		for _, old := range oldApps {
-			oldAppIds = append(oldAppIds, old.ID)
-		}
+	var sharedCtx *appSyncContext

-		baseRemoteUrl := fmt.Sprintf("%s/%s/1panel", global.CONF.RemoteURL.AppRepo, global.CONF.Base.Mode)
-
-		appsMap := getApps(oldApps, list.Apps, setting.SystemVersion, t)
-
-		t.LogStart(i18n.GetMsgByKey("SyncAppDetail"))
-		for _, l := range list.Apps {
-			app, ok := appsMap[l.AppProperty.Key]
-			if !ok {
-				continue
-			}
-			iconStr := ""
-			_, iconRes, err := req_helper.HandleRequest(l.Icon, http.MethodGet, constant.TimeOut20s)
-			if err == nil {
-				if !strings.Contains(string(iconRes), "<xml>") {
-					iconStr = base64.StdEncoding.EncodeToString(iconRes)
-				}
-			}
-			app.Icon = iconStr
-			app.TagsKey = l.AppProperty.Tags
-			if l.AppProperty.Recommend > 0 {
-				app.Recommend = l.AppProperty.Recommend
-			} else {
-				app.Recommend = 9999
-			}
-			app.ReadMe = l.ReadMe
-			app.LastModified = l.LastModified
-			versions := l.Versions
-			detailsMap := getAppDetails(app.Details, versions)
-			for _, v := range versions {
-				version := v.Name
-				detail := detailsMap[version]
-				versionUrl := fmt.Sprintf("%s/%s/%s", baseRemoteUrl, app.Key, version)
-				paramByte, _ := json.Marshal(v.AppForm)
-				var appForm dto.AppForm
-				_ = json.Unmarshal(paramByte, &appForm)
-				if appForm.SupportVersion > 0 && common.CompareVersion(strconv.FormatFloat(appForm.SupportVersion, 'f', -1, 64), setting.SystemVersion) {
-					delete(detailsMap, version)
-					continue
-				}
-				if _, ok := InitTypes[app.Type]; ok {
-					dockerComposeUrl := fmt.Sprintf("%s/%s", versionUrl, "docker-compose.yml")
-					_, composeRes, err := req_helper.HandleRequest(dockerComposeUrl, http.MethodGet, constant.TimeOut20s)
-					if err == nil {
-						detail.DockerCompose = string(composeRes)
-					}
-				} else {
-					detail.DockerCompose = ""
-				}
-
-				detail.Params = string(paramByte)
-				detail.DownloadUrl = fmt.Sprintf("%s/%s", versionUrl, app.Key+"-"+version+".tar.gz")
-				detail.DownloadCallBackUrl = v.DownloadCallBackUrl
-				detail.Update = true
-				detail.LastModified = v.LastModified
-				detailsMap[version] = detail
-			}
-			var newDetails []model.AppDetail
-			for _, detail := range detailsMap {
-				newDetails = append(newDetails, detail)
-			}
-			app.Details = newDetails
-			appsMap[l.AppProperty.Key] = app
-		}
-		t.LogSuccess(i18n.GetMsgByKey("SyncAppDetail"))
-
-		tags, _ := tagRepo.All()
-		var (
-			addAppArray    []model.App
-			updateAppArray []model.App
-			deleteAppArray []model.App
-			deleteIds      []uint
-			tagMap         = make(map[string]uint, len(tags))
-		)
-
-		for _, v := range appsMap {
-			if v.ID == 0 {
-				addAppArray = append(addAppArray, v)
-			} else {
-				if v.Status == constant.AppTakeDown {
-					installs, _ := appInstallRepo.ListBy(context.Background(), appInstallRepo.WithAppId(v.ID))
-					if len(installs) > 0 {
-						updateAppArray = append(updateAppArray, v)
-						continue
-					}
-					deleteAppArray = append(deleteAppArray, v)
-					deleteIds = append(deleteIds, v.ID)
-				} else {
-					updateAppArray = append(updateAppArray, v)
-				}
-			}
-		}
-
-		tx, ctx := getTxAndContext()
-		defer func() {
-			if err != nil {
-				tx.Rollback()
-				return
-			}
-		}()
-		if len(addAppArray) > 0 {
-			if err = appRepo.BatchCreate(ctx, addAppArray); err != nil {
-				return
-			}
-		}
-		if len(deleteAppArray) > 0 {
-			if err = appRepo.BatchDelete(ctx, deleteAppArray); err != nil {
-				return
-			}
-			if err = appDetailRepo.DeleteByAppIds(ctx, deleteIds); err != nil {
-				return
-			}
-		}
-		for _, tag := range tags {
-			tagMap[tag.Key] = tag.ID
-		}
-		for _, update := range updateAppArray {
-			if err = appRepo.Save(ctx, &update); err != nil {
-				return
-			}
-		}
-		apps := append(addAppArray, updateAppArray...)
-
-		var (
-			addDetails    []model.AppDetail
-			updateDetails []model.AppDetail
-			deleteDetails []model.AppDetail
-		)
-		for _, app := range apps {
-			for _, tag := range app.TagsKey {
-				tagId, ok := tagMap[tag]
-				if ok {
-					exist, _ := appTagRepo.GetFirst(ctx, appTagRepo.WithByTagID(tagId), appTagRepo.WithByAppID(app.ID))
-					if exist == nil {
-						appTags = append(appTags, &model.AppTag{
-							AppId: app.ID,
-							TagId: tagId,
-						})
-					}
-				}
-			}
-			for _, d := range app.Details {
-				d.AppId = app.ID
-				if d.ID == 0 {
-					addDetails = append(addDetails, d)
-				} else {
-					if d.Status == constant.AppTakeDown {
-						runtime, _ := runtimeRepo.GetFirst(ctx, runtimeRepo.WithDetailId(d.ID))
-						if runtime != nil {
-							updateDetails = append(updateDetails, d)
-							continue
-						}
-						installs, _ := appInstallRepo.ListBy(ctx, appInstallRepo.WithDetailIdsIn([]uint{d.ID}))
-						if len(installs) > 0 {
-							updateDetails = append(updateDetails, d)
-							continue
-						}
-						deleteDetails = append(deleteDetails, d)
-					} else {
-						updateDetails = append(updateDetails, d)
-					}
-				}
-			}
-		}
-		if len(addDetails) > 0 {
-			if err = appDetailRepo.BatchCreate(ctx, addDetails); err != nil {
-				return
-			}
-		}
-		if len(deleteDetails) > 0 {
-			if err = appDetailRepo.BatchDelete(ctx, deleteDetails); err != nil {
-				return
-			}
-		}
-		for _, u := range updateDetails {
-			if err = appDetailRepo.Update(ctx, u); err != nil {
-				return
-			}
-		}
-
-		if len(oldAppIds) > 0 {
-			if err = appTagRepo.DeleteByAppIds(ctx, deleteIds); err != nil {
-				return
-			}
-		}
-
-		if len(appTags) > 0 {
-			if err = appTagRepo.BatchCreate(ctx, appTags); err != nil {
-				return
-			}
-		}
-		tx.Commit()
-
-		_ = settingService.Update("AppStoreSyncStatus", constant.StatusSyncSuccess)
-		_ = settingService.Update("AppStoreLastModified", strconv.Itoa(list.LastModified))
-		return nil
-	}, nil)
+	syncTask.AddSubTask(task.GetTaskName(i18n.GetMsgByKey("App"), task.TaskSync, task.TaskScopeAppStore), a.createSyncAppStoreTask(&sharedCtx), nil)
+	syncTask.AddSubTask(i18n.GetMsgByKey("SyncAppDetail"), a.createSyncAppStoreMetaTask(&sharedCtx), nil)

 	go func() {
+		defer func() {
+			if r := recover(); r != nil {
+				global.LOG.Errorf("[AppStore] sync goroutine recovered from panic: %v", r)
+				if updateErr := NewISettingService().Update("AppStoreSyncStatus", constant.StatusError); updateErr != nil {
+					global.LOG.Warnf("[AppStore] failed to update sync status after panic: %v", updateErr)
+				}
+			}
+			appStoreSyncMu.Lock()
+			appStoreSyncing = false
+			appStoreSyncMu.Unlock()
+		}()
 		if err := syncTask.Execute(); err != nil {
-			_ = NewISettingService().Update("AppStoreLastModified", "0")
-			_ = NewISettingService().Update("AppStoreSyncStatus", constant.StatusError)
+			if updateErr := NewISettingService().Update("AppStoreLastModified", "0"); updateErr != nil {
+				global.LOG.Warnf("[AppStore] failed to reset last modified: %v", updateErr)
+			}
+			if updateErr := NewISettingService().Update("AppStoreSyncStatus", constant.StatusError); updateErr != nil {
+				global.LOG.Warnf("[AppStore] failed to update sync status to error: %v", updateErr)
+			}
+			return
 		}
 	}()

+	global.LOG.Info("[AppStore] sync app from remote task create ok")
 	return nil
 }

-func (a AppService) GetAppIcon(appID uint) ([]byte, error) {
-	app, err := appRepo.GetFirst(repo.WithByID(appID))
+func (a AppService) GetAppIcon(key string) ([]byte, string, string, error) {
+	app, err := appRepo.GetFirst(appRepo.WithKey(key))
 	if err != nil {
-		return nil, err
+		return nil, "", "", err
 	}
+
+	if appicon.IsIconFile(app.Icon) {
+		fileName, etag := appicon.ParseIconField(app.Icon)
+		iconBytes, err := appicon.ReadIconFile(fileName)
+		if err != nil {
+			global.LOG.Warnf("[AppIcon] read icon file failed key=%s, file=%s, err=%v", key, fileName, err)
+			return nil, "", "", nil
+		}
+		return iconBytes, fileName, etag, nil
+	}
+
 	iconBytes, err := base64.StdEncoding.DecodeString(app.Icon)
 	if err != nil {
-		return nil, err
+		global.LOG.Warnf("[AppIcon] decode base64 icon failed key=%s, err=%v", key, err)
+		return nil, "", "", nil
 	}
-	return iconBytes, nil
+	return iconBytes, "", "", nil
 }
@@ -57,6 +57,7 @@ type IAppInstallService interface {
 	UpdateAppConfig(req request.AppConfigUpdate) error
 	GetInstallList() ([]dto.AppInstallInfo, error)
 	GetAppInstallInfo(appInstallID uint) (*response.AppInstallInfo, error)
+	UpdateSort(req request.AppInstallSort) error
 }

 func NewIAppInstalledService() IAppInstallService {
@@ -83,6 +84,7 @@ func (a *AppInstallService) Page(req request.AppInstalledSearch) (int64, []respo
 		err      error
 	)
 	opts = append(opts, repo.WithOrderRuleBy("favorite", "descending"))
+	opts = append(opts, repo.WithOrderRuleBy("sort_order", "ascending"))

 	if req.Name != "" {
 		opts = append(opts, repo.WithByLikeName(req.Name))
@@ -121,7 +123,7 @@ func (a *AppInstallService) Page(req request.AppInstalledSearch) (int64, []respo
 		}
 	}

-	installDTOs, _ := handleInstalled(installs, req.Update, req.Sync)
+	installDTOs, _ := handleInstalled(installs, req.Update, req.Sync, req.CheckUpdate)
 	if req.Update {
 		total = int64(len(installDTOs))
 	}
@@ -238,7 +240,7 @@ func (a *AppInstallService) SearchForWebsite(req request.AppInstalledSearch) ([]
 		}
 	}

-	return handleInstalled(installs, false, true)
+	return handleInstalled(installs, false, true, false)
 }

 func (a *AppInstallService) Operate(req request.AppInstalledOperate) error {
@@ -300,6 +302,9 @@ func (a *AppInstallService) Operate(req request.AppInstalledOperate) error {
 		return opNginx(install.ContainerName, constant.NginxReload)
 	case constant.Favorite:
 		install.Favorite = req.Favorite
+		var maxSort int
+		global.DB.Model(&model.AppInstall{}).Where("favorite = ?", req.Favorite).Select("COALESCE(MAX(sort_order),0)").Scan(&maxSort)
+		install.SortOrder = maxSort + 1
 		return appInstallRepo.Save(context.Background(), &install)
 	default:
 		return errors.New("operate not support")
@@ -318,17 +323,25 @@ func (a *AppInstallService) UpdateAppConfig(req request.AppConfigUpdate) error {
 	return appInstallRepo.Save(context.Background(), &installed)
 }

+func (a *AppInstallService) UpdateSort(req request.AppInstallSort) error {
+	for _, item := range req.Items {
+		if err := appInstallRepo.BatchUpdateBy(map[string]interface{}{"sort_order": item.SortOrder}, repo.WithByID(item.InstallID)); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 func (a *AppInstallService) Update(req request.AppInstalledUpdate) error {
 	installed, err := appInstallRepo.GetFirst(repo.WithByID(req.InstallId))
 	if err != nil {
 		return err
 	}
-	changePort := false
+	oldInstalled := installed
 	port, ok := req.Params["PANEL_APP_PORT_HTTP"]
 	if ok {
 		portN := int(math.Ceil(port.(float64)))
 		if portN != installed.HttpPort {
-			changePort = true
 			httpPort, err := checkPort("PANEL_APP_PORT_HTTP", req.Params)
 			if err != nil {
 				return err
@@ -414,9 +427,17 @@ func (a *AppInstallService) Update(req request.AppInstalledUpdate) error {
 	installed.Status = constant.StatusRunning
 	_ = appInstallRepo.Save(context.Background(), &installed)

+	proxyChanged := hasAppInstallProxyPassChanged(&oldInstalled, &installed)
+	currentProxy, currentProxyErr := getAppInstallProxyPass(&installed)
 	website, _ := websiteRepo.GetFirst(websiteRepo.WithAppInstallId(installed.ID))
-	if changePort && website.ID != 0 && website.Status == constant.StatusRunning {
-		go func() {
+	if proxyChanged && website.ID != 0 && currentProxyErr == nil {
+		website.Proxy = currentProxy
+		if err := websiteRepo.SaveWithoutCtx(&website); err != nil {
+			global.LOG.Error(buserr.WithErr("ErrUpdateBuWebsite", err).Error())
+		}
+	}
+	if proxyChanged && website.ID != 0 && website.Status == constant.StatusRunning && currentProxyErr == nil {
+		go func(website model.Website, proxy string) {
 			nginxInstall, err := getNginxFull(&website)
 			if err != nil {
 				global.LOG.Error(buserr.WithErr("ErrUpdateBuWebsite", err).Error())
@@ -429,7 +450,6 @@ func (a *AppInstallService) Update(req request.AppInstalledUpdate) error {
 				return
 			}
 			server := servers[0]
-			proxy := fmt.Sprintf("http://127.0.0.1:%d", installed.HttpPort)
 			server.UpdateRootProxy([]string{proxy})

 			if err := nginx.WriteConfig(config, nginx.IndentedStyle); err != nil {
@@ -440,7 +460,10 @@ func (a *AppInstallService) Update(req request.AppInstalledUpdate) error {
 				global.LOG.Error(buserr.WithErr("ErrUpdateBuWebsite", err).Error())
 				return
 			}
-		}()
+		}(website, currentProxy)
+	}
+	if proxyChanged && website.ID != 0 && currentProxyErr != nil {
+		global.LOG.Error(buserr.WithErr("ErrUpdateBuWebsite", currentProxyErr).Error())
 	}
 	return nil
 }
@@ -830,6 +853,10 @@ func syncAppInstallStatus(appInstall *model.AppInstall, force bool) error {
 	return nil
 }

+func SyncAppInstallStatus(appInstall *model.AppInstall, force bool) error {
+	return syncAppInstallStatus(appInstall, force)
+}
+
 func updateInstallInfoInDB(appKey, appName, param string, value interface{}) error {
 	if param != "password" && param != "port" && param != "user-password" {
 		return nil
@@ -847,7 +874,7 @@ func updateInstallInfoInDB(appKey, appName, param string, value interface{}) err
 	envKey := ""
 	switch param {
 	case "password":
-		if appKey == "mysql" || appKey == "mariadb" || appKey == "postgresql" {
+		if appKey == "mysql" || appKey == "mariadb" || appKey == "postgresql" || appKey == "mongodb" {
 			envKey = "PANEL_DB_ROOT_PASSWORD="
 		} else {
 			envKey = "PANEL_REDIS_ROOT_PASSWORD="
@@ -888,7 +915,7 @@ func updateInstallInfoInDB(appKey, appName, param string, value interface{}) err
 			"param": strings.ReplaceAll(appInstall.Param, oldVal, newVal),
 			"env":   strings.ReplaceAll(appInstall.Env, oldVal, newVal),
 		}, repo.WithByID(appInstall.ID))
-		if appKey == "mysql" || appKey == "postgresql" {
+		if appKey == "mysql" || appKey == "postgresql" || appKey == "mongodb" {
 			return nil
 		}
 	}
@@ -0,0 +1,608 @@
+package service
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/app/task"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/i18n"
+	"github.com/1Panel-dev/1Panel/agent/utils/appicon"
+	"github.com/1Panel-dev/1Panel/agent/utils/common"
+	"github.com/1Panel-dev/1Panel/agent/utils/req_helper"
+	"github.com/1Panel-dev/1Panel/agent/utils/xpack"
+)
+
+type appSyncContext struct {
+	task           *task.Task
+	httpClient     http.Client
+	baseRemoteUrl  string
+	systemVersion  string
+	appsMap        map[string]model.App
+	settingService ISettingService
+	list           *dto.AppList
+	oldAppIds      []uint
+	appTags        []*model.AppTag
+	skipMetaSync   bool
+	pendingIcons   map[string]string
+}
+
+func (a AppService) createSyncAppStoreTask(sharedCtx **appSyncContext) func(t *task.Task) error {
+	return func(t *task.Task) (err error) {
+		t.LogStart(i18n.GetMsgByKey("AppStore") + " " + i18n.GetMsgByKey("TaskSync"))
+
+		updateRes, err := a.GetAppUpdate()
+		if err != nil {
+			t.LogFailedWithErr(i18n.GetMsgByKey("CheckAppStoreUpdate"), err)
+			return err
+		}
+		if !updateRes.CanUpdate {
+			if updateRes.IsSyncing {
+				t.Log(i18n.GetMsgByKey("AppStoreIsSyncing"))
+				return nil
+			}
+			global.LOG.Infof("[AppStore] Appstore is up to date")
+			t.Log(i18n.GetMsgByKey("AppStoreIsUpToDate"))
+			*sharedCtx = &appSyncContext{skipMetaSync: true}
+			t.LogSuccess(i18n.GetMsgByKey("AppStore") + " " + i18n.GetMsgByKey("TaskSync"))
+			return nil
+		}
+
+		list := &dto.AppList{}
+		if updateRes.AppList == nil {
+			list, err = getAppList()
+			if err != nil {
+				t.LogFailedWithErr(i18n.GetMsgByKey("DownloadAppList"), err)
+				return err
+			}
+		} else {
+			list = updateRes.AppList
+		}
+
+		settingService := NewISettingService()
+		if err := settingService.Update("AppStoreSyncStatus", constant.StatusSyncing); err != nil {
+			global.LOG.Warnf("[AppStore] failed to update sync status to syncing: %v", err)
+		}
+
+		setting, err := settingService.GetSettingInfo()
+		if err != nil {
+			t.LogFailedWithErr("GetSettingInfo", err)
+			return err
+		}
+
+		ctx := &appSyncContext{
+			task:           t,
+			httpClient:     http.Client{Timeout: time.Duration(constant.TimeOut20s) * time.Second, Transport: xpack.LoadRequestTransport()},
+			baseRemoteUrl:  fmt.Sprintf("%s/%s/1panel", global.AppRepoURL(), global.CONF.Base.Mode),
+			systemVersion:  setting.SystemVersion,
+			settingService: settingService,
+			list:           list,
+			appTags:        make([]*model.AppTag, 0),
+			pendingIcons:   make(map[string]string),
+		}
+
+		if err = SyncTags(list.Extra); err != nil {
+			t.LogFailedWithErr(i18n.GetMsgByKey("SyncTags"), err)
+			return err
+		}
+		deleteCustomApp()
+
+		oldApps, err := appRepo.GetBy(appRepo.WithNotLocal())
+		if err != nil {
+			t.LogFailedWithErr(i18n.GetMsgByKey("LoadLocalApps"), err)
+			return err
+		}
+		ctx.oldAppIds = make([]uint, 0, len(oldApps))
+		for _, old := range oldApps {
+			ctx.oldAppIds = append(ctx.oldAppIds, old.ID)
+		}
+
+		ctx.appsMap, ctx.pendingIcons = getApps(oldApps, list.Apps, setting.SystemVersion, t)
+
+		var addCount, updateCount, deleteCount int
+		if err = ctx.classifyAndPersistAppsWithStats(&addCount, &updateCount, &deleteCount); err != nil {
+			t.LogFailedWithErr(i18n.GetMsgByKey("PersistApps"), err)
+			return err
+		}
+
+		if err := settingService.Update("AppStoreSyncStatus", constant.StatusSyncSuccess); err != nil {
+			global.LOG.Warnf("[AppStore] failed to update sync status to success: %v", err)
+		}
+		if err := settingService.Update("AppStoreLastModified", strconv.Itoa(list.LastModified)); err != nil {
+			global.LOG.Warnf("[AppStore] failed to update last modified: %v", err)
+		}
+		global.LOG.Infof("[AppStore] Appstore sync completed")
+
+		*sharedCtx = ctx
+		t.LogSuccess(i18n.GetMsgByKey("AppStore") + " " + i18n.GetMsgByKey("TaskSync"))
+		return nil
+	}
+}
+
+type appWorkItem struct {
+	appDef  dto.AppDefine
+	app     model.App
+	iconUrl string
+	hadIcon bool
+}
+
+type appWorkResult struct {
+	appKey     string
+	app        model.App
+	iconStatus int
+	hadIcon    bool
+	httpFailed bool
+}
+
+func (c *appSyncContext) processOneApp(item appWorkItem) appWorkResult {
+	app := item.app
+	l := item.appDef
+	result := appWorkResult{
+		appKey:  l.AppProperty.Key,
+		hadIcon: item.hadIcon,
+	}
+
+	if item.hadIcon {
+		status, iconField := c.downloadAppIcon(item.iconUrl, l.AppProperty.Key, app.Icon)
+		result.iconStatus = status
+		switch status {
+		case http.StatusOK:
+			app.Icon = iconField
+		case http.StatusNotModified:
+		default:
+			result.httpFailed = true
+		}
+	}
+
+	app.TagsKey = l.AppProperty.Tags
+	if l.AppProperty.Recommend > 0 {
+		app.Recommend = l.AppProperty.Recommend
+	} else {
+		app.Recommend = 9999
+	}
+	app.ReadMe = l.ReadMe
+	app.LastModified = l.LastModified
+
+	versions := l.Versions
+	detailsMap := getAppDetails(app.Details, versions)
+	for _, v := range versions {
+		version := v.Name
+		detail := detailsMap[version]
+		versionUrl := fmt.Sprintf("%s/%s/%s", c.baseRemoteUrl, app.Key, version)
+
+		paramByte, _ := json.Marshal(v.AppForm)
+		var appForm dto.AppForm
+		_ = json.Unmarshal(paramByte, &appForm)
+
+		if appForm.SupportVersion > 0 && common.CompareVersion(strconv.FormatFloat(appForm.SupportVersion, 'f', -1, 64), c.systemVersion) {
+			delete(detailsMap, version)
+			continue
+		}
+
+		if _, ok := InitTypes[app.Type]; ok {
+			dockerComposeUrl := fmt.Sprintf("%s/%s", versionUrl, "docker-compose.yml")
+			_, composeRes, err := req_helper.HandleRequestWithClient(&c.httpClient, dockerComposeUrl, http.MethodGet, constant.TimeOut20s)
+			if err == nil {
+				detail.DockerCompose = string(composeRes)
+			} else {
+				result.httpFailed = true
+			}
+		} else {
+			detail.DockerCompose = ""
+		}
+
+		detail.Params = string(paramByte)
+		detail.DownloadUrl = fmt.Sprintf("%s/%s", versionUrl, app.Key+"-"+version+".tar.gz")
+		detail.DownloadCallBackUrl = v.DownloadCallBackUrl
+		detail.Update = true
+		detail.LastModified = v.LastModified
+		detailsMap[version] = detail
+	}
+
+	newDetails := make([]model.AppDetail, 0, len(detailsMap))
+	for _, detail := range detailsMap {
+		newDetails = append(newDetails, detail)
+	}
+	app.Details = newDetails
+
+	result.app = app
+	return result
+}
+
+func (c *appSyncContext) syncAppIconsAndDetails() error {
+	total := len(c.list.Apps)
+	global.LOG.Infof("[AppStore] sync app detail start, total apps: %d", total)
+
+	workItems := make([]appWorkItem, 0, total)
+	for _, l := range c.list.Apps {
+		app, ok := c.appsMap[l.AppProperty.Key]
+		if !ok {
+			continue
+		}
+		iconUrl, hasPending := c.pendingIcons[l.AppProperty.Key]
+		workItems = append(workItems, appWorkItem{
+			appDef:  l,
+			app:     app,
+			iconUrl: iconUrl,
+			hadIcon: hasPending,
+		})
+	}
+
+	totalWork := len(workItems)
+	if totalWork == 0 {
+		return nil
+	}
+
+	const maxWorkers = 4
+	var (
+		failFlag atomic.Bool
+		workCh   = make(chan int, maxWorkers)
+		resultCh = make(chan appWorkResult, maxWorkers)
+		wg       sync.WaitGroup
+	)
+
+	wg.Add(maxWorkers)
+	for range maxWorkers {
+		go func() {
+			defer wg.Done()
+			for idx := range workCh {
+				result := c.processOneApp(workItems[idx])
+				resultCh <- result
+				if result.httpFailed {
+					failFlag.Store(true)
+				}
+			}
+		}()
+	}
+	go func() { wg.Wait(); close(resultCh) }()
+
+	var fed atomic.Int32
+	go func() {
+		for i := range workItems {
+			if failFlag.Load() {
+				break
+			}
+			workCh <- i
+			fed.Store(int32(i + 1))
+		}
+		close(workCh)
+	}()
+
+	var (
+		completed    int
+		icon200Count int
+		icon304Count int
+		iconFailCount int
+	)
+	milestones := [4]int{totalWork / 4, totalWork / 2, totalWork * 3 / 4, totalWork}
+	nextMS := 0
+	checkProgress := func() {
+		if nextMS < len(milestones) && completed >= milestones[nextMS] {
+			c.task.LogWithProgress(i18n.GetMsgByKey("SyncAppDetail"), completed, totalWork)
+			nextMS++
+		}
+	}
+
+	applyResult := func(result appWorkResult) {
+		c.appsMap[result.appKey] = result.app
+		if result.hadIcon {
+			switch result.iconStatus {
+			case http.StatusOK:
+				icon200Count++
+			case http.StatusNotModified:
+				icon304Count++
+			default:
+				iconFailCount++
+			}
+		}
+		completed++
+		checkProgress()
+	}
+
+	for result := range resultCh {
+		applyResult(result)
+	}
+
+	fedCount := int(fed.Load())
+	if failFlag.Load() && fedCount < len(workItems) {
+		global.LOG.Warnf("[AppStore] HTTP failure detected, falling back to serial for remaining %d apps", len(workItems)-fedCount)
+		for i := fedCount; i < len(workItems); i++ {
+			result := c.processOneApp(workItems[i])
+			applyResult(result)
+		}
+	}
+
+	global.LOG.Infof("[AppStore] icon download completed - total: %d, success(200): %d, cached(304): %d, failed: %d",
+		total, icon200Count, icon304Count, iconFailCount)
+
+	return nil
+}
+
+func (c *appSyncContext) downloadAppIcon(iconUrl, appKey, oldIcon string) (status int, iconField string) {
+	iconFileName, existingEtag := appicon.ParseIconField(oldIcon)
+
+	reqHeaders := make(map[string]string)
+	if existingEtag != "" && iconFileName != "" && appicon.IconFileExists(iconFileName) {
+		reqHeaders["If-None-Match"] = existingEtag
+	}
+
+	resp, err := req_helper.HandleRequestWithHeaders(&c.httpClient, iconUrl, http.MethodGet, constant.TimeOut20s, reqHeaders)
+	if err != nil {
+		global.LOG.Warnf("[AppStore] request icon failed url=%s, err=%v", iconUrl, err)
+		return 0, ""
+	}
+
+	if resp.StatusCode == http.StatusNotModified {
+		return http.StatusNotModified, ""
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		global.LOG.Warnf("[AppStore] download icon failed url=%s, status=%d", iconUrl, resp.StatusCode)
+		return 0, ""
+	}
+
+	if len(resp.Body) == 0 {
+		global.LOG.Warnf("[AppStore] download icon empty body url=%s", iconUrl)
+		return 0, ""
+	}
+
+	if resp.Body[0] == '<' {
+		global.LOG.Warnf("[AppStore] download icon got HTML response url=%s", iconUrl)
+		return 0, ""
+	}
+
+	contentType := resp.Header.Get("Content-Type")
+	ct := strings.TrimSpace(strings.Split(contentType, ";")[0])
+	if strings.ToLower(ct) != "image/png" {
+		global.LOG.Warnf("[AppStore] unexpected icon content-type: %s, expected image/png, url=%s", ct, iconUrl)
+	}
+
+	fileName, err := appicon.WriteIconFile(appKey, resp.Body)
+	if err != nil {
+		global.LOG.Warnf("[AppStore] write icon file failed appKey=%s, err=%v", appKey, err)
+		return 0, ""
+	}
+
+	newEtag := resp.Header.Get("ETag")
+	iconField = appicon.BuildIconField(fileName, newEtag)
+
+	return http.StatusOK, iconField
+}
+
+func (a AppService) createSyncAppStoreMetaTask(sharedCtx **appSyncContext) func(t *task.Task) error {
+	return func(t *task.Task) (err error) {
+		t.LogStart(i18n.GetMsgByKey("SyncAppDetail"))
+		ctx := *sharedCtx
+		if ctx == nil {
+			global.LOG.Warnf("[AppStore] meta sync skipped: shared context is nil")
+			t.Log(i18n.GetMsgByKey("SyncAppDetail") + " skipped: shared context is nil")
+			return nil
+		}
+
+		if ctx.skipMetaSync {
+			global.LOG.Infof("[AppStore] meta sync skipped: no update needed")
+			t.Log(i18n.GetMsgByKey("SyncAppDetail") + " skipped: no update needed")
+			return nil
+		}
+
+		if ctx.list == nil || ctx.appsMap == nil {
+			global.LOG.Errorf("[AppStore] meta sync failed: shared context data not initialized")
+			err := fmt.Errorf("shared context data not initialized")
+			t.LogFailedWithErr(i18n.GetMsgByKey("SyncAppDetail"), err)
+			return err
+		}
+
+		t.Logf("%s: %d apps", i18n.GetMsgByKey("SyncAppDetail"), len(ctx.list.Apps))
+
+		ctx.task = t
+		ctx.appTags = make([]*model.AppTag, 0)
+
+		if err = ctx.syncAppIconsAndDetails(); err != nil {
+			t.LogFailedWithErr(i18n.GetMsgByKey("SyncAppDetail"), err)
+			return err
+		}
+
+		if err = ctx.classifyAndPersistApps(); err != nil {
+			t.LogFailedWithErr(i18n.GetMsgByKey("PersistAppDetails"), err)
+			return err
+		}
+
+		global.LOG.Infof("[AppStore] Appstore meta sync completed")
+		return nil
+	}
+}
+
+func (c *appSyncContext) classifyAndPersistApps() (err error) {
+	var addCount, updateCount, deleteCount int
+	return c.classifyAndPersistAppsWithStats(&addCount, &updateCount, &deleteCount)
+}
+
+func (c *appSyncContext) classifyAndPersistAppsWithStats(addCount, updateCount, deleteCount *int) (err error) {
+	tags, _ := tagRepo.All()
+	var (
+		addAppArray    []model.App
+		updateAppArray []model.App
+		deleteAppArray []model.App
+		deleteIds      []uint
+		tagMap         = make(map[string]uint, len(tags))
+	)
+
+	for _, v := range c.appsMap {
+		if v.ID == 0 {
+			addAppArray = append(addAppArray, v)
+		} else {
+			if v.Status == constant.AppTakeDown {
+				installs, _ := appInstallRepo.ListBy(context.Background(), appInstallRepo.WithAppId(v.ID))
+				if len(installs) > 0 {
+					updateAppArray = append(updateAppArray, v)
+					continue
+				}
+				deleteAppArray = append(deleteAppArray, v)
+				deleteIds = append(deleteIds, v.ID)
+			} else {
+				updateAppArray = append(updateAppArray, v)
+			}
+		}
+	}
+
+	if len(addAppArray) > 0 {
+		addKeys := make([]string, 0, len(addAppArray))
+		for _, app := range addAppArray {
+			addKeys = append(addKeys, app.Key)
+		}
+		existingApps, _ := appRepo.GetBy(appRepo.WithKeyIn(addKeys))
+		if len(existingApps) > 0 {
+			existingMap := make(map[string]model.App, len(existingApps))
+			for _, e := range existingApps {
+				existingMap[e.Key] = e
+			}
+			filteredAdd := make([]model.App, 0, len(addAppArray))
+			for _, app := range addAppArray {
+				if existing, ok := existingMap[app.Key]; ok {
+					app.ID = existing.ID
+					if len(app.Details) == 0 {
+						app.Details = existing.Details
+					}
+					updateAppArray = append(updateAppArray, app)
+				} else {
+					filteredAdd = append(filteredAdd, app)
+				}
+			}
+			addAppArray = filteredAdd
+		}
+	}
+
+	*addCount = len(addAppArray)
+	*updateCount = len(updateAppArray)
+	*deleteCount = len(deleteAppArray)
+
+	tx, ctx := getTxAndContext()
+	defer func() {
+		if err != nil {
+			tx.Rollback()
+			return
+		}
+	}()
+
+	if len(addAppArray) > 0 {
+		if err = appRepo.BatchCreate(ctx, addAppArray); err != nil {
+			return
+		}
+	}
+
+	if len(deleteAppArray) > 0 {
+		if err = appRepo.BatchDelete(ctx, deleteAppArray); err != nil {
+			return
+		}
+		if err = appDetailRepo.DeleteByAppIds(ctx, deleteIds); err != nil {
+			return
+		}
+	}
+
+	for _, tag := range tags {
+		tagMap[tag.Key] = tag.ID
+	}
+
+	if len(updateAppArray) > 0 {
+		for _, update := range updateAppArray {
+			if err = appRepo.Save(ctx, &update); err != nil {
+				return
+			}
+		}
+	}
+
+	apps := append(addAppArray, updateAppArray...)
+
+	var (
+		addDetails    []model.AppDetail
+		updateDetails []model.AppDetail
+		deleteDetails []model.AppDetail
+	)
+
+	totalDetails := 0
+	for _, app := range apps {
+		for _, tag := range app.TagsKey {
+			tagId, ok := tagMap[tag]
+			if ok {
+				exist, _ := appTagRepo.GetFirst(ctx, appTagRepo.WithByTagID(tagId), appTagRepo.WithByAppID(app.ID))
+				if exist == nil {
+					c.appTags = append(c.appTags, &model.AppTag{
+						AppId: app.ID,
+						TagId: tagId,
+					})
+				}
+			}
+		}
+
+		for _, d := range app.Details {
+			totalDetails++
+			d.AppId = app.ID
+			if d.ID == 0 {
+				addDetails = append(addDetails, d)
+			} else {
+				if d.Status == constant.AppTakeDown {
+					runtime, _ := runtimeRepo.GetFirst(ctx, runtimeRepo.WithDetailId(d.ID))
+					if runtime != nil {
+						updateDetails = append(updateDetails, d)
+						continue
+					}
+					installs, _ := appInstallRepo.ListBy(ctx, appInstallRepo.WithDetailIdsIn([]uint{d.ID}))
+					if len(installs) > 0 {
+						updateDetails = append(updateDetails, d)
+						continue
+					}
+					deleteDetails = append(deleteDetails, d)
+				} else {
+					updateDetails = append(updateDetails, d)
+				}
+			}
+		}
+	}
+
+	if len(addDetails) > 0 {
+		if err = appDetailRepo.BatchCreate(ctx, addDetails); err != nil {
+			return
+		}
+	}
+
+	if len(deleteDetails) > 0 {
+		if err = appDetailRepo.BatchDelete(ctx, deleteDetails); err != nil {
+			return
+		}
+	}
+
+	if len(updateDetails) > 0 {
+		for _, u := range updateDetails {
+			if err = appDetailRepo.Update(ctx, u); err != nil {
+				return
+			}
+		}
+	}
+
+	if len(c.oldAppIds) > 0 {
+		if err = appTagRepo.DeleteByAppIds(ctx, deleteIds); err != nil {
+			return
+		}
+	}
+
+	if len(c.appTags) > 0 {
+		if err = appTagRepo.BatchCreate(ctx, c.appTags); err != nil {
+			return
+		}
+	}
+
+	if err = tx.Commit().Error; err != nil {
+		return
+	}
+	return nil
+}
@@ -33,7 +33,6 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/utils/common"
 	"github.com/1Panel-dev/1Panel/agent/utils/compose"
 	"github.com/1Panel-dev/1Panel/agent/utils/docker"
-	composeV2 "github.com/1Panel-dev/1Panel/agent/utils/docker"
 	"github.com/1Panel-dev/1Panel/agent/utils/env"
 	"github.com/1Panel-dev/1Panel/agent/utils/files"
 	"github.com/1Panel-dev/1Panel/agent/utils/nginx"
@@ -363,7 +362,7 @@ func deleteAppInstall(deleteReq request.AppInstallDelete) error {
 				if err != nil {
 					return err
 				}
-				images, err := composeV2.GetImagesFromDockerCompose(content, []byte(install.DockerCompose))
+				images, err := docker.GetImagesFromDockerCompose(content, []byte(install.DockerCompose))
 				if err != nil {
 					return err
 				}
@@ -392,6 +391,10 @@ func deleteAppInstall(deleteReq request.AppInstallDelete) error {
 		if err = appInstallRepo.Delete(ctx, install); err != nil {
 			return err
 		}
+		appKey := install.App.Key
+		if isAgentAppKey(appKey) {
+			_ = agentRepo.DeleteByAppInstallIDWithCtx(ctx, install.ID)
+		}

 		resources, _ := appInstallResourceRepo.GetBy(appInstallResourceRepo.WithAppInstallId(install.ID))
 		if len(resources) > 0 {
@@ -422,6 +425,8 @@ func deleteAppInstall(deleteReq request.AppInstallDelete) error {
 		switch install.App.Key {
 		case constant.AppMysql, constant.AppMariaDB, constant.AppMysqlCluster:
 			_ = mysqlRepo.Delete(ctx, mysqlRepo.WithByMysqlName(install.Name))
+		case constant.AppMongodb:
+			_ = mongodbRepo.Delete(ctx, mongodbRepo.WithByMongodbName(install.Name))
 		case constant.AppPostgresql, constant.AppPostgresqlCluster:
 			_ = postgresqlRepo.Delete(ctx, postgresqlRepo.WithByPostgresqlName(install.Name))
 		}
@@ -672,6 +677,7 @@ func upgradeInstall(req request.AppInstallUpgrade) error {
 	if err != nil {
 		return err
 	}
+	oldVersion := install.Version
 	detail, err := appDetailRepo.GetFirst(repo.WithByID(req.DetailID))
 	if err != nil {
 		return err
@@ -748,7 +754,7 @@ func upgradeInstall(req request.AppInstallUpgrade) error {
 			if req.DockerCompose != "" {
 				composeContent = []byte(req.DockerCompose)
 			}
-			images, err := composeV2.GetImagesFromDockerCompose(content, composeContent)
+			images, err := docker.GetImagesFromDockerCompose(content, composeContent)
 			if err != nil {
 				return err
 			}
@@ -764,6 +770,30 @@ func upgradeInstall(req request.AppInstallUpgrade) error {

 		command := exec.Command("/bin/bash", "-c", fmt.Sprintf("cp -rn %s/* %s || true", detailDir, install.GetPath()))
 		_, _ = command.CombinedOutput()
+		if install.App.Key == constant.AppOpenresty {
+			installBuildDir := path.Join(install.GetPath(), "build")
+			detailBuildDir := path.Join(detailDir, "build")
+			if !fileOp.Stat(installBuildDir) {
+				if err := fileOp.CreateDir(installBuildDir, constant.DirPerm); err != nil {
+					return err
+				}
+			}
+			if err := fileOp.DeleteDir(path.Join(installBuildDir, "tmp")); err != nil {
+				return err
+			}
+			if err := fileOp.CopyDir(path.Join(detailBuildDir, "tmp"), installBuildDir); err != nil {
+				return err
+			}
+			if err := fileOp.CopyFile(path.Join(detailBuildDir, "Dockerfile"), installBuildDir); err != nil {
+				return err
+			}
+			if err := fileOp.CopyFile(path.Join(detailBuildDir, "nginx.conf"), installBuildDir); err != nil {
+				return err
+			}
+			if err := fileOp.CopyFile(path.Join(detailBuildDir, "nginx.vh.default.conf"), installBuildDir); err != nil {
+				return err
+			}
+		}
 		sourceScripts := path.Join(detailDir, "scripts")
 		if fileOp.Stat(sourceScripts) {
 			dstScripts := path.Join(install.GetPath(), "scripts")
@@ -774,6 +804,9 @@ func upgradeInstall(req request.AppInstallUpgrade) error {
 		}

 		var newCompose string
+		if err = migrateOpenclawProtocolUpgrade(&install, oldVersion, detail.Version); err != nil {
+			return err
+		}
 		if req.DockerCompose == "" {
 			newCompose, err = getUpgradeCompose(install, detail)
 			if err != nil {
@@ -883,7 +916,7 @@ func getContainerNames(install model.AppInstall) ([]string, error) {
 	if err != nil {
 		return nil, err
 	}
-	project, err := composeV2.GetComposeProject(install.Name, install.GetPath(), []byte(install.DockerCompose), []byte(envStr), true)
+	project, err := docker.GetComposeProject(install.Name, install.GetPath(), []byte(install.DockerCompose), []byte(envStr), true)
 	if err != nil {
 		return nil, err
 	}
@@ -1105,7 +1138,7 @@ func runScript(task *task.Task, appInstall *model.AppInstall, operate string) er
 }

 func checkContainerNameIsExist(containerName, appDir string) (bool, error) {
-	client, err := composeV2.NewDockerClient()
+	client, err := docker.NewDockerClient()
 	if err != nil {
 		return false, err
 	}
@@ -1141,7 +1174,7 @@ func upApp(task *task.Task, appInstall *model.AppInstall, pullImages bool) error
 			if err != nil {
 				return err
 			}
-			images, err := composeV2.GetImagesFromDockerCompose(envByte, []byte(appInstall.DockerCompose))
+			images, err := docker.GetImagesFromDockerCompose(envByte, []byte(appInstall.DockerCompose))
 			if err != nil {
 				return err
 			}
@@ -1271,8 +1304,9 @@ func getAppDetails(details []model.AppDetail, versions []dto.AppConfigVersion) m
 	return appDetails
 }

-func getApps(oldApps []model.App, items []dto.AppDefine, systemVersion string, task *task.Task) map[string]model.App {
+func getApps(oldApps []model.App, items []dto.AppDefine, systemVersion string, task *task.Task) (map[string]model.App, map[string]string) {
 	apps := make(map[string]model.App, len(oldApps))
+	pendingIcons := make(map[string]string, len(items))
 	for _, old := range oldApps {
 		old.Status = constant.AppTakeDown
 		apps[old.Key] = old
@@ -1312,9 +1346,13 @@ func getApps(oldApps []model.App, items []dto.AppDefine, systemVersion string, t
 		app.MemoryRequired = config.MemoryRequired
 		app.Architectures = strings.Join(config.Architectures, ",")
 		app.GpuSupport = config.GpuSupport
+		app.BatchInstallSupport = config.BatchInstallSupport
+		if item.Icon != "" {
+			pendingIcons[key] = item.Icon
+		}
 		apps[key] = app
 	}
-	return apps
+	return apps, pendingIcons
 }

 func handleLocalAppDetail(versionDir string, appDetail *model.AppDetail) error {
@@ -1530,7 +1568,7 @@ func synAppInstall(containers map[string]container.Summary, appInstall *model.Ap
 	_ = appInstallRepo.Save(context.Background(), appInstall)
 }

-func handleInstalled(appInstallList []model.AppInstall, updated bool, sync bool) ([]response.AppInstallDTO, error) {
+func handleInstalled(appInstallList []model.AppInstall, updated, sync, checkUpdate bool) ([]response.AppInstallDTO, error) {
 	var (
 		res           []response.AppInstallDTO
 		containersMap map[string]container.Summary
@@ -1553,6 +1591,7 @@ func handleInstalled(appInstallList []model.AppInstall, updated bool, sync bool)
 		if updated && ignoreUpdate(installed) {
 			continue
 		}
+
 		if sync && !doNotNeedSync(installed) {
 			synAppInstall(containersMap, &installed, false)
 		}
@@ -1579,23 +1618,34 @@ func handleInstalled(appInstallList []model.AppInstall, updated bool, sync bool)
 				Document: installed.App.Document,
 			},
 			Favorite:    installed.Favorite,
+			SortOrder:   installed.SortOrder,
 			Container:   installed.ContainerName,
 			ServiceName: strings.ToLower(installed.ServiceName),
 		}
-		if !updated {
+
+		if !updated && !checkUpdate {
 			installDTO.LinkDB = hasLinkDB(installed.ID)
 			res = append(res, installDTO)
 			continue
 		}
+
 		if installed.Version == "latest" {
+			if checkUpdate {
+				installDTO.CanUpdate = false
+				installDTO.LinkDB = hasLinkDB(installed.ID)
+				res = append(res, installDTO)
+			}
 			continue
 		}
+
 		installDTO.DockerCompose = installed.DockerCompose
 		installDTO.IsEdit = isEditCompose(installed)
+
 		details, err := appDetailRepo.GetBy(appDetailRepo.WithAppId(installed.App.ID))
 		if err != nil {
 			return nil, err
 		}
+
 		var versions []string
 		for _, appDetail := range details {
 			ignores, _ := appIgnoreUpgradeRepo.List(runtimeRepo.WithDetailId(appDetail.ID), appIgnoreUpgradeRepo.WithScope("version"))
@@ -1607,11 +1657,19 @@ func handleInstalled(appInstallList []model.AppInstall, updated bool, sync bool)
 			}
 			versions = append(versions, appDetail.Version)
 		}
+
 		if len(versions) == 0 {
+			if checkUpdate {
+				installDTO.CanUpdate = false
+				installDTO.LinkDB = hasLinkDB(installed.ID)
+				res = append(res, installDTO)
+			}
 			continue
 		}
+
 		versions = common.GetSortedVersions(versions)
 		lastVersion := versions[0]
+
 		if installed.App.Key == constant.AppMysql || installed.App.Key == constant.AppMysqlCluster {
 			for _, version := range versions {
 				majorVersion := getMajorVersion(installed.Version)
@@ -1623,15 +1681,23 @@ func handleInstalled(appInstallList []model.AppInstall, updated bool, sync bool)
 				}
 			}
 		}
+
 		if common.IsCrossVersion(installed.Version, lastVersion) {
 			installDTO.CanUpdate = installed.App.CrossVersionUpdate
 		} else {
 			installDTO.CanUpdate = common.CompareVersion(lastVersion, installed.Version)
 		}
-		if installDTO.CanUpdate {
+
+		if updated {
+			if installDTO.CanUpdate {
+				res = append(res, installDTO)
+			}
+		} else if checkUpdate {
+			installDTO.LinkDB = hasLinkDB(installed.ID)
 			res = append(res, installDTO)
 		}
 	}
+
 	return res, nil
 }

@@ -1960,23 +2026,26 @@ func handleSiteDir(app model.App, appDetail model.AppDetail, req request.AppInst
 			req.Params["WEBSITE_DIR"] = siteDir
 			oldWebStePath, _ := settingRepo.GetValueByKey("WEBSITE_DIR")
 			fileOp := files.NewFileOp()
+			movePath := func(src, dst string) error {
+				return cmd.NewCommandMgr().Run("mv", src, dst)
+			}
 			if oldWebStePath != "" && oldWebStePath != siteDir && fileOp.Stat(oldWebStePath) {
 				t.Log(i18n.GetWithName("MoveSiteDir", siteDir))
 				if fileOp.Stat(siteDir) {
 					if fileOp.Stat(path.Join(siteDir, "conf.d")) {
-						_ = fileOp.Rename(path.Join(siteDir, "conf.d"), path.Join(siteDir, "conf.d.bak"))
+						_ = movePath(path.Join(siteDir, "conf.d"), path.Join(siteDir, "conf.d.bak"))
 					}
 					if fileOp.Stat(path.Join(siteDir, "sites")) {
-						_ = fileOp.Rename(path.Join(siteDir, "sites"), path.Join(siteDir, "sites.bak"))
+						_ = movePath(path.Join(siteDir, "sites"), path.Join(siteDir, "sites.bak"))
 					}
-					if err := fileOp.Rename(path.Join(oldWebStePath, "sites"), path.Join(siteDir, "sites")); err != nil {
+					if err := movePath(path.Join(oldWebStePath, "sites"), path.Join(siteDir, "sites")); err != nil {
 						return err
 					}
-					if err := fileOp.Rename(path.Join(oldWebStePath, "conf.d"), path.Join(siteDir, "conf.d")); err != nil {
+					if err := movePath(path.Join(oldWebStePath, "conf.d"), path.Join(siteDir, "conf.d")); err != nil {
 						return err
 					}
 				} else {
-					err := fileOp.Rename(oldWebStePath, siteDir)
+					err := movePath(oldWebStePath, siteDir)
 					if err != nil {
 						return err
 					}
@@ -2091,15 +2160,21 @@ func handleSSLConfig(appInstall *model.AppInstall, hasDefaultWebsite bool, sslRe
 	return nil
 }

-func SyncTags(remoteProperties dto.ExtraProperties) error {
+func SyncTags(remoteProperties dto.ExtraProperties) (err error) {
 	tx, ctx := getTxAndContext()
-	defer tx.Rollback()
-	localTags, _ := tagRepo.All()
+	defer func() {
+		if err != nil {
+			tx.Rollback()
+		}
+	}()
+	localTags, err := tagRepo.All()
+	if err != nil {
+		return err
+	}
 	localTagsMap := make(map[string]*model.Tag)
 	for i := range localTags {
 		localTagsMap[localTags[i].Key] = &localTags[i]
 	}
-	var err error
 	remoteTagsMap := make(map[string]*dto.Tag)
 	for i := range remoteProperties.Tags {
 		remoteTagsMap[remoteProperties.Tags[i].Key] = &remoteProperties.Tags[i]
@@ -2107,7 +2182,9 @@ func SyncTags(remoteProperties dto.ExtraProperties) error {

 	for key, localTag := range localTagsMap {
 		if _, exists := remoteTagsMap[key]; !exists {
-			_ = tagRepo.DeleteByID(ctx, localTag.ID)
+			if err = tagRepo.DeleteByID(ctx, localTag.ID); err != nil {
+				return err
+			}
 		}
 	}

@@ -2137,7 +2214,9 @@ func SyncTags(remoteProperties dto.ExtraProperties) error {
 		}
 	}

-	tx.Commit()
+	if err = tx.Commit().Error; err != nil {
+		return err
+	}
 	return nil
 }

@@ -2169,10 +2248,39 @@ func isEditCompose(installed model.AppInstall) bool {
 	if rawCompose == "" || err != nil {
 		return false
 	}
-	if rawCompose != installed.DockerCompose {
-		return true
+	equal, err := composeEqualExceptImage(rawCompose, installed.DockerCompose)
+	if err != nil {
+		return false
+	}
+	return !equal
+}
+
+func composeEqualExceptImage(expected, current string) (bool, error) {
+	expectedCompose := make(map[string]interface{})
+	if err := yaml.Unmarshal([]byte(expected), &expectedCompose); err != nil {
+		return false, err
+	}
+	currentCompose := make(map[string]interface{})
+	if err := yaml.Unmarshal([]byte(current), &currentCompose); err != nil {
+		return false, err
+	}
+	removeComposeServiceImages(expectedCompose)
+	removeComposeServiceImages(currentCompose)
+	return reflect.DeepEqual(expectedCompose, currentCompose), nil
+}
+
+func removeComposeServiceImages(composeMap map[string]interface{}) {
+	services, ok := composeMap["services"].(map[string]interface{})
+	if !ok {
+		return
+	}
+	for _, service := range services {
+		serviceMap, ok := service.(map[string]interface{})
+		if !ok {
+			continue
+		}
+		delete(serviceMap, "image")
 	}
-	return false
 }

 func getAppVersions(key string, details []model.AppDetail) []string {
@@ -44,10 +44,13 @@ type IBackupService interface {

 	MysqlBackup(db dto.CommonBackup) error
 	PostgresqlBackup(db dto.CommonBackup) error
+	MongodbBackup(db dto.CommonBackup) error
 	MysqlRecover(db dto.CommonRecover) error
 	PostgresqlRecover(db dto.CommonRecover) error
+	MongodbRecover(db dto.CommonRecover) error
 	MysqlRecoverByUpload(req dto.CommonRecover) error
 	PostgresqlRecoverByUpload(req dto.CommonRecover) error
+	MongodbRecoverByUpload(req dto.CommonRecover) error

 	RedisBackup(db dto.CommonBackup) error
 	RedisRecover(db dto.CommonRecover) error
@@ -57,6 +60,11 @@ type IBackupService interface {

 	AppBackup(db dto.CommonBackup) (*model.BackupRecord, error)
 	AppRecover(req dto.CommonRecover) error
+
+	ContainerBackup(req dto.CommonBackup) error
+	ContainerRecover(req dto.CommonRecover) error
+	ComposeBackup(req dto.CommonBackup) error
+	ComposeRecover(req dto.CommonRecover) error
 }

 func NewIBackupService() IBackupService {
@@ -72,7 +80,7 @@ func (u *BackupService) GetLocalDir() (string, error) {
 }

 func (u *BackupService) SearchWithPage(req dto.SearchPageWithType) (int64, interface{}, error) {
-	options := []repo.DBOption{repo.WithOrderBy("created_at desc")}
+	options := []repo.DBOption{repo.WithOrderDesc("created_at")}
 	if len(req.Type) != 0 {
 		options = append(options, repo.WithByType(req.Type))
 	}
@@ -372,7 +380,7 @@ func (u *BackupService) checkBackupConn(backup *model.BackupAccount) (bool, erro
 }

 func (u *BackupService) LoadBackupOptions() ([]dto.BackupOption, error) {
-	accounts, err := backupRepo.List(repo.WithOrderBy("created_at desc"))
+	accounts, err := backupRepo.List(repo.WithOrderDesc("created_at"))
 	if err != nil {
 		return nil, err
 	}
@@ -535,7 +543,7 @@ func loadRefreshTokenByCode(backup *model.BackupAccount) (string, error) {
 	if err := json.Unmarshal([]byte(backup.Vars), &varMap); err != nil {
 		return "", fmt.Errorf("unmarshal backup vars failed, err: %v", err)
 	}
-	if _, ok := varMap["refresh_token"]; ok {
+	if token, ok := varMap["refresh_token"]; ok && len(token.(string)) != 0 {
 		return "", nil
 	}
 	refreshToken := ""
@@ -11,6 +11,7 @@ import (
 	"time"

 	"github.com/1Panel-dev/1Panel/agent/app/repo"
+	"github.com/subosito/gotenv"

 	"github.com/1Panel-dev/1Panel/agent/app/task"
 	"github.com/1Panel-dev/1Panel/agent/i18n"
@@ -179,6 +180,9 @@ func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverF
 			return err
 		}
 		tmpPath := strings.ReplaceAll(recoverFile, ".tar.gz", "")
+		if err := fileOp.TarGzExtractPro(tmpPath+"/app.tar.gz", tmpPath, ""); err != nil {
+			return err
+		}
 		defer func() {
 			_, _ = compose.Up(install.GetComposePath())
 			_ = os.RemoveAll(strings.ReplaceAll(recoverFile, ".tar.gz", ""))
@@ -187,19 +191,26 @@ func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverF
 		if !fileOp.Stat(tmpPath+"/app.json") || !fileOp.Stat(tmpPath+"/app.tar.gz") {
 			return errors.New(i18n.GetMsgByKey("AppBackupFileIncomplete"))
 		}
-		var oldInstall model.AppInstall
+		var backupInstall model.AppInstall
 		appJson, err := os.ReadFile(tmpPath + "/app.json")
 		if err != nil {
 			return err
 		}
-		if err := json.Unmarshal(appJson, &oldInstall); err != nil {
+		if err := json.Unmarshal(appJson, &backupInstall); err != nil {
 			return fmt.Errorf("unmarshal app.json failed, err: %v", err)
 		}
-		if oldInstall.App.Key != install.App.Key || oldInstall.Name != install.Name {
+		if backupInstall.App.Key != install.App.Key || backupInstall.Name != install.Name {
 			return errors.New(i18n.GetMsgByKey("AppAttributesNotMatch"))
 		}
-
-		newEnvFile := ""
+		backupEnvMap, err := getEnvMapByPath(path.Join(tmpPath, install.Name, ".env"))
+		if err != nil {
+			return err
+		}
+		installedEnvMap, err := getEnvMapByPath(install.GetEnvPath())
+		if err != nil {
+			return err
+		}
+		var mergedEnvContent string
 		resources, _ := appInstallResourceRepo.GetBy(appInstallResourceRepo.WithAppInstallId(install.ID))
 		for _, resource := range resources {
 			var database model.Database
@@ -225,11 +236,20 @@ func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverF
 				if err != nil {
 					return err
 				}
+				newDB, err := reCreatePostgresqlDB(db.ID, database, backupEnvMap)
+				if err != nil {
+					return err
+				}
+				backupInstall.Env, mergedEnvContent, err = buildRecoverEnv(backupInstall.Env, backupEnvMap, installedEnvMap)
+				if err != nil {
+					return err
+				}
+				_ = appInstallResourceRepo.BatchUpdateBy(map[string]interface{}{"resource_id": newDB.ID}, repo.WithByID(resource.ID))
 				taskName := task.GetTaskName(db.Name, task.TaskRecover, task.TaskScopeDatabase)
 				t.LogStart(taskName)
 				if err := handlePostgresqlRecover(dto.CommonRecover{
-					Name:       database.Name,
-					DetailName: db.Name,
+					Name:       newDB.PostgresqlName,
+					DetailName: newDB.Name,
 					File:       fmt.Sprintf("%s/%s.sql.gz", tmpPath, install.Name),
 				}, parentTask, true); err != nil {
 					t.LogFailedWithErr(taskName, err)
@@ -241,15 +261,11 @@ func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverF
 				if err != nil {
 					return err
 				}
-				newDB, envMap, err := reCreateDB(db.ID, database, oldInstall.Env)
+				newDB, err := reCreateDB(db.ID, database, backupEnvMap)
 				if err != nil {
 					return err
 				}
-				oldHost := fmt.Sprintf("\"PANEL_DB_HOST\":\"%v\"", envMap["PANEL_DB_HOST"].(string))
-				newHost := fmt.Sprintf("\"PANEL_DB_HOST\":\"%v\"", database.Address)
-				oldInstall.Env = strings.ReplaceAll(oldInstall.Env, oldHost, newHost)
-				envMap["PANEL_DB_HOST"] = database.Address
-				newEnvFile, err = coverEnvJsonToStr(oldInstall.Env)
+				backupInstall.Env, mergedEnvContent, err = buildRecoverEnv(backupInstall.Env, backupEnvMap, installedEnvMap)
 				if err != nil {
 					return err
 				}
@@ -284,22 +300,22 @@ func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverF
 		t.LogSuccess(deCompressName)
 		_ = fileOp.DeleteDir(backPath)

-		if len(newEnvFile) != 0 {
+		if len(mergedEnvContent) != 0 {
 			envPath := fmt.Sprintf("%s/%s/.env", install.GetAppPath(), install.Name)
 			file, err := os.OpenFile(envPath, os.O_WRONLY|os.O_TRUNC, 0640)
 			if err != nil {
 				return err
 			}
 			defer file.Close()
-			_, _ = file.WriteString(newEnvFile)
+			_, _ = file.WriteString(mergedEnvContent)
 		}

-		oldInstall.ID = install.ID
-		oldInstall.Status = constant.StatusRunning
-		oldInstall.AppId = install.AppId
-		oldInstall.AppDetailId = install.AppDetailId
-		oldInstall.App.ID = install.AppId
-		if err := appInstallRepo.Save(context.Background(), &oldInstall); err != nil {
+		backupInstall.ID = install.ID
+		backupInstall.Status = constant.StatusRunning
+		backupInstall.AppId = install.AppId
+		backupInstall.AppDetailId = install.AppDetailId
+		backupInstall.App.ID = install.AppId
+		if err := appInstallRepo.Save(context.Background(), &backupInstall); err != nil {
 			global.LOG.Errorf("save db app install failed, err: %v", err)
 			return err
 		}
@@ -373,33 +389,131 @@ func doAppBackup(install *model.AppInstall, parentTask *task.Task, backupDir, fi
 	return nil
 }

-func reCreateDB(dbID uint, database model.Database, oldEnv string) (*model.DatabaseMysql, map[string]interface{}, error) {
+func reCreateDB(dbID uint, database model.Database, envMap map[string]interface{}) (*model.DatabaseMysql, error) {
 	mysqlService := NewIMysqlService()
 	ctx := context.Background()
 	_ = mysqlService.Delete(ctx, dto.MysqlDBDelete{ID: dbID, Database: database.Name, Type: database.Type, DeleteBackup: false, ForceDelete: true})

-	envMap := make(map[string]interface{})
-	if err := json.Unmarshal([]byte(oldEnv), &envMap); err != nil {
-		return nil, envMap, err
-	}
-	oldName, _ := envMap["PANEL_DB_NAME"].(string)
-	oldUser, _ := envMap["PANEL_DB_USER"].(string)
-	oldPassword, _ := envMap["PANEL_DB_USER_PASSWORD"].(string)
+	dbInfo := getDBCreateInfoFromEnv(envMap, "utf8mb4")
 	createDB, err := mysqlService.Create(context.Background(), dto.MysqlDBCreate{
-		Name:       oldName,
+		Name:       dbInfo.Name,
 		From:       database.From,
 		Database:   database.Name,
-		Format:     "utf8mb4",
-		Username:   oldUser,
-		Password:   oldPassword,
+		Format:     dbInfo.Format,
+		Username:   dbInfo.User,
+		Password:   dbInfo.Password,
 		Permission: "%",
 	})
-	cronjobs, _ := cronjobRepo.List(cronjobRepo.WithByDbName(fmt.Sprintf("%v", dbID)))
-	for _, job := range cronjobs {
-		_ = cronjobRepo.Update(job.ID, map[string]interface{}{"db_name": fmt.Sprintf("%v", createDB.ID)})
-	}
 	if err != nil {
-		return nil, envMap, err
+		return nil, err
 	}
-	return createDB, envMap, nil
+	updateCronjobsDBRef(dbID, createDB.ID)
+	return createDB, nil
+}
+
+func reCreatePostgresqlDB(dbID uint, database model.Database, envMap map[string]interface{}) (*model.DatabasePostgresql, error) {
+	postgresqlService := NewIPostgresqlService()
+	_ = postgresqlService.Delete(context.Background(), dto.PostgresqlDBDelete{
+		ID:           dbID,
+		Type:         database.Type,
+		Database:     database.Name,
+		DeleteBackup: false,
+		ForceDelete:  true,
+	})
+
+	dbInfo := getDBCreateInfoFromEnv(envMap, "UTF8")
+	createDB, err := postgresqlService.Create(context.Background(), dto.PostgresqlDBCreate{
+		Name:      dbInfo.Name,
+		From:      database.From,
+		Database:  database.Name,
+		Format:    dbInfo.Format,
+		Username:  dbInfo.User,
+		Password:  dbInfo.Password,
+		SuperUser: true,
+	})
+	if err != nil {
+		return nil, err
+	}
+	updateCronjobsDBRef(dbID, createDB.ID)
+	return createDB, nil
+}
+
+type dbRecreateInfo struct {
+	Name     string
+	User     string
+	Password string
+	Format   string
+}
+
+func getDBCreateInfoFromEnv(envMap map[string]interface{}, defaultFormat string) dbRecreateInfo {
+	name, _ := envMap["PANEL_DB_NAME"].(string)
+	user, _ := envMap["PANEL_DB_USER"].(string)
+	password, _ := envMap["PANEL_DB_USER_PASSWORD"].(string)
+	format, _ := envMap["format"].(string)
+	if len(format) == 0 {
+		format = defaultFormat
+	}
+	return dbRecreateInfo{
+		Name:     name,
+		User:     user,
+		Password: password,
+		Format:   format,
+	}
+}
+
+func updateCronjobsDBRef(oldDBID, newDBID uint) {
+	cronjobs, _ := cronjobRepo.List(cronjobRepo.WithByDbName(fmt.Sprintf("%v", oldDBID)))
+	for _, job := range cronjobs {
+		_ = cronjobRepo.Update(job.ID, map[string]interface{}{"db_name": fmt.Sprintf("%v", newDBID)})
+	}
+}
+
+func buildRecoverEnv(appEnv string, backupEnvMap, installedEnvMap map[string]interface{}) (string, string, error) {
+	currentHostVal, hasCurrentHost := installedEnvMap["PANEL_DB_HOST"]
+	if hasCurrentHost && fmt.Sprintf("%v", currentHostVal) != "" {
+		backupHost := fmt.Sprintf("\"PANEL_DB_HOST\":\"%v\"", backupEnvMap["PANEL_DB_HOST"])
+		currentHost := fmt.Sprintf("\"PANEL_DB_HOST\":\"%v\"", currentHostVal)
+		appEnv = strings.ReplaceAll(appEnv, backupHost, currentHost)
+		if _, ok := backupEnvMap["CASDOOR_DATASOURCE_NAME"]; ok {
+			backupEnvMap["CASDOOR_DATASOURCE_NAME"] = strings.ReplaceAll(
+				fmt.Sprintf("%v", backupEnvMap["CASDOOR_DATASOURCE_NAME"]),
+				fmt.Sprintf("%v", backupEnvMap["PANEL_DB_HOST"]),
+				fmt.Sprintf("%v", currentHostVal),
+			)
+		}
+		backupEnvMap["PANEL_DB_HOST"] = currentHostVal
+	}
+	newEnvMap := make(map[string]string, len(backupEnvMap))
+	handleMap(backupEnvMap, newEnvMap)
+	mergedEnvContent, err := gotenv.Marshal(newEnvMap)
+	if err != nil {
+		return appEnv, "", err
+	}
+	return appEnv, mergedEnvContent, nil
+}
+
+func getEnvMapByPath(envPath string) (map[string]interface{}, error) {
+	envMap := make(map[string]interface{})
+	envFile, err := os.ReadFile(envPath)
+	if err != nil {
+		return envMap, err
+	}
+	lines := strings.Split(string(envFile), "\n")
+	for _, line := range lines {
+		line = strings.TrimSpace(line)
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		parts := strings.SplitN(line, "=", 2)
+		if len(parts) == 2 {
+			value := strings.TrimSpace(parts[1])
+			if len(value) >= 2 {
+				if (value[0] == '"' && value[len(value)-1] == '"') || (value[0] == '\'' && value[len(value)-1] == '\'') {
+					value = value[1 : len(value)-1]
+				}
+			}
+			envMap[parts[0]] = value
+		}
+	}
+	return envMap, nil
 }
--- a/Show More
+++ b/Show More