fix: Fixed issue with build backend failed (#12199)

Co-authored-by: ssongliu <songlius11@163.com>

.github/workflows/build-and-publish.yml

@@ -1,33 +1,43 @@
-name: Create Release And Upload Cloudflare R2
+name: Build And Publish (OSS + R2)
+
 on:
   push:
     tags:
       - 'v*'
+
 jobs:
   create-release:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4
+
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
           node-version: '22.19.0'
+
       - name: Build Web
         run: |
           cd frontend && npm install && npm run build:pro
         env:
           NODE_OPTIONS: --max-old-space-size=8192
+
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
           go-version: '1.24'
+          cache-dependency-path: |
+            core/go.sum
+            agent/go.sum
+
       - name: Build Release
         uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser
           version: '~> v2'
           args: release --skip=publish --clean
+
       - name: Upload Assets
         uses: softprops/action-gh-release@v1
         if: startsWith(github.ref, 'refs/tags/')
@@ -36,10 +46,24 @@ jobs:
           files: |
             dist/*.tar.gz
             dist/checksums.txt
+
+      - name: Setup OSSUTIL
+        uses: yizhoumo/setup-ossutil@v2
+        with:
+          endpoint: ${{ secrets.OSS_ENDPOINT }}
+          access-key-id: ${{ secrets.OSS_ACCESS_KEY_ID }}
+          access-key-secret: ${{ secrets.OSS_ACCESS_KEY_SECRET }}
+          ossutil-version: '1.7.18'
+
+      - name: Upload Assets to OSS
+        run: |
+          ossutil cp -r dist/ oss://resource-fit2cloud-com/1panel/package/v2/stable/${{ github.ref_name }}/release/ --include "*.tar.gz" --include "checksums.txt" --only-current-dir --force
+
       - name: Setup Rclone
         uses: AnimMouse/setup-rclone@v1
         with:
           rclone_config: ${{ secrets.RCLONE_CONFIG }}
+
       - name: Upload to Cloudflare R2
         run: |
           rclone copy dist/ cloudflare_r2:package/v2/stable/${{ github.ref_name }}/release/ --include "*.tar.gz" --include "checksums.txt" --progress

.github/workflows/build-publish-to-oss.yml

@@ -1,47 +0,0 @@
-name: Create Release And Upload assets
-on:
-  push:
-    tags:
-      - 'v*'
-jobs:
-  create-release:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Code
-        uses: actions/checkout@v4
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: '22.19.0'
-      - name: Build Web
-        run: |
-          cd frontend && npm install && npm run build:pro
-        env:
-          NODE_OPTIONS: --max-old-space-size=8192
-      - name: Setup Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: '1.24'
-      - name: Build Release
-        uses: goreleaser/goreleaser-action@v6
-        with:
-          distribution: goreleaser
-          version: '~> v2'
-          args: release --skip=publish --clean
-      - name: Upload Assets
-        uses: softprops/action-gh-release@v1
-        if: startsWith(github.ref, 'refs/tags/')
-        with:
-          draft: true
-          files: |
-            dist/*.tar.gz
-            dist/checksums.txt
-      - name: Setup OSSUTIL
-        uses: yizhoumo/setup-ossutil@v2
-        with:
-          endpoint: ${{ secrets.OSS_ENDPOINT }}
-          access-key-id: ${{ secrets.OSS_ACCESS_KEY_ID }}
-          access-key-secret: ${{ secrets.OSS_ACCESS_KEY_SECRET }}
-          ossutil-version: '1.7.18'
-      - name: Upload Assets to OSS
-        run: ossutil cp -r dist/ oss://resource-fit2cloud-com/1panel/package/v2/stable/${{ github.ref_name }}/release/ --include "*.tar.gz" --include "checksums.txt" --only-current-dir --force

.gitignore

@@ -44,12 +44,17 @@ frontend/src/xpack
 agent/xpack
 agent/router/entry_xpack.go
 agent/server/init_xpack.go
+agent/utils/xpack/xpack.go
 agent/utils/xpack/xpack_xpack.go
 core/xpack
 core/router/entry_xpack.go
 core/server/init_xpack.go
+core/utils/xpack/xpack.go
 core/utils/xpack/xpack_xpack.go
-xpack
+core/xpack-ee
+core/router/entry_xpackee.go
+core/server/init_xpackee.go
+core/utils/xpack/xpack_xpackee.go
 
 .history/
 dist/
@@ -68,4 +73,6 @@ agent/.golangci.yml
 openspec
 CLAUDE.md
 AGENTS.md
-opencode.json
+opencode.json
+superpowers
+.worktrees/

README.md

@@ -1,5 +1,5 @@
 <p align="center"><a href="https://1panel.pro"><img src="https://resource.1panel.pro/img/1panel-logo.png" alt="1Panel" width="300" /></a></p>
-<p align="center"><b>Top-Rated Web-based Linux Server Management Tool</b><br>Best VPS control panel<br>新一代的 Linux 服务器运维管理面板</p>
+<h3 align="center">Take control of your VPS with 1Panel</h3>
 <p align="center">
   <a href="https://trendshift.io/repositories/2462" target="_blank"><img src="https://trendshift.io/api/badge/repositories/2462" alt="1Panel-dev%2F1Panel | Trendshift" style="width: 240px; height: auto;" /></a>
 </p>
@@ -30,30 +30,30 @@
 </p>
 
 ------------------------------
+## What is 1Panel? 
 
-1Panel is an open-source, modern web-based control panel for Linux server management.
+1Panel is a modern, open-source VPS control panel that streamlines administration through an intuitive, clean web interface. 
 
-- **Efficient Management**: Through a user-friendly web graphical interface, 1Panel enables users to effortlessly manage their Linux servers. Key features include host monitoring, file management, database administration, container management, LLMs management.
-- **Rapid Website Deployment**: With deep integration of the popular open-source website building software WordPress, 1Panel streamlines the process of domain binding and SSL certificate configuration, all achievable with just one click.
-- **Application Store**: 1Panel curates a wide range of high-quality open-source tools and applications, facilitating easy installation and updates for its users.
-- **Security and Reliability**: By leveraging containerization and secure application deployment practices, 1Panel minimizes vulnerability exposure. It further enhances security through integrated firewall management and log auditing capabilities.
-- **One-Click Backup & Restore**: Data protection is made simple with 1Panel's one-click backup and restore functionality, supporting various cloud storage solutions to ensure data integrity and availability.
+## Key Features  
+
+- **One-Click OpenClaw Deployment**: Seamlessly deploy OpenClaw agents, host local LLMs using Ollama, and monitor GPU utilization—all within a unified workspace.  
+- **One-Click Website Deployment**: Launch production-ready websites instantly with automatic domain binding, SSL certificate provisioning, and configuration—zero manual setup required.  
+- **Curated App Marketplace**: Discover, install, and update trusted open-source applications (Nextcloud, Bitwarden, Umami, and more) with a single click.  
+- **Centralized Server Management**: Monitor system resources and manage files, databases, containers, and services effortlessly through a unified, intuitive dashboard.  
+- **Enterprise-Grade Security**: Strengthen your defenses with container isolation, firewall controls, audit logging, and secure deployment practices—ensuring compliance and peace of mind.  
+- **Intelligent Backup & Restore**: Schedule automated backups or perform instant restores to local storage or major cloud platforms (AWS S3, Cloudflare R2, and more), with flexible retention and destination options.  
 
 ## Quick Start
 
 Execute the script below and follow the prompts to install 1Panel:
 
 ```bash
-curl -sSL https://resource.1panel.pro/quick_start.sh -o quick_start.sh && bash quick_start.sh
+bash -c "$(curl -sSL https://resource.1panel.pro/v2/quick_start.sh)"
 ```
 
-Please refer to our [documentation](https://docs.1panel.pro/quick_start/) for more details.
-
-中国用户请使用这个 [安装脚本](https://1panel.cn/docs/installation/online_installation/)，其应用数量比国际版本更丰富。
-
 ## Screenshot
 
-![UI Display](https://resource.1panel.pro/img/1panel.png)
+![UI Display](https://resource.1panel.pro/img/overview_en_v2.png)
 
 ## Star History
 
@@ -73,4 +73,4 @@ Licensed under The GNU General Public License version 3 (GPLv3)  (the "License")
 
 <https://www.gnu.org/licenses/gpl-3.0.html>
 
-Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

agent/app/api/v2/agents.go

@@ -0,0 +1,579 @@
+package v2
+
+import (
+	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/gin-gonic/gin"
+)
+
+// @Tags AI
+// @Summary Create Agent
+// @Accept json
+// @Param request body dto.AgentCreateReq true "request"
+// @Success 200 {object} dto.AgentItem
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents [post]
+func (b *BaseApi) CreateAgent(c *gin.Context) {
+	var req dto.AgentCreateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	res, err := agentService.Create(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, res)
+}
+
+// @Tags AI
+// @Summary Page Agents
+// @Accept json
+// @Param request body dto.SearchWithPage true "request"
+// @Success 200 {object} dto.PageResult
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/search [post]
+func (b *BaseApi) PageAgents(c *gin.Context) {
+	var req dto.SearchWithPage
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	total, list, err := agentService.Page(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, dto.PageResult{
+		Items: list,
+		Total: total,
+	})
+}
+
+// @Tags AI
+// @Summary Delete Agent
+// @Accept json
+// @Param request body dto.AgentDeleteReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/delete [post]
+func (b *BaseApi) DeleteAgent(c *gin.Context) {
+	var req dto.AgentDeleteReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.Delete(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Reset Agent token
+// @Accept json
+// @Param request body dto.AgentTokenResetReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/token/reset [post]
+func (b *BaseApi) ResetAgentToken(c *gin.Context) {
+	var req dto.AgentTokenResetReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.ResetToken(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Update Agent model config
+// @Accept json
+// @Param request body dto.AgentModelConfigUpdateReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/model/update [post]
+func (b *BaseApi) UpdateAgentModelConfig(c *gin.Context) {
+	var req dto.AgentModelConfigUpdateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.UpdateModelConfig(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Get Providers
+// @Success 200 {array} dto.ProviderInfo
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/providers [get]
+func (b *BaseApi) GetAgentProviders(c *gin.Context) {
+	list, err := agentService.GetProviders()
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, list)
+}
+
+// @Tags AI
+// @Summary Create Agent account
+// @Accept json
+// @Param request body dto.AgentAccountCreateReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/accounts [post]
+func (b *BaseApi) CreateAgentAccount(c *gin.Context) {
+	var req dto.AgentAccountCreateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.CreateAccount(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Update Agent account
+// @Accept json
+// @Param request body dto.AgentAccountUpdateReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/accounts/update [post]
+func (b *BaseApi) UpdateAgentAccount(c *gin.Context) {
+	var req dto.AgentAccountUpdateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.UpdateAccount(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Page Agent accounts
+// @Accept json
+// @Param request body dto.AgentAccountSearch true "request"
+// @Success 200 {object} dto.PageResult
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/accounts/search [post]
+func (b *BaseApi) PageAgentAccounts(c *gin.Context) {
+	var req dto.AgentAccountSearch
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	total, list, err := agentService.PageAccounts(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, dto.PageResult{
+		Items: list,
+		Total: total,
+	})
+}
+
+// @Tags AI
+// @Summary Verify Agent account
+// @Accept json
+// @Param request body dto.AgentAccountVerifyReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/accounts/verify [post]
+func (b *BaseApi) VerifyAgentAccount(c *gin.Context) {
+	var req dto.AgentAccountVerifyReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.VerifyAccount(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Delete Agent account
+// @Accept json
+// @Param request body dto.AgentAccountDeleteReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/accounts/delete [post]
+func (b *BaseApi) DeleteAgentAccount(c *gin.Context) {
+	var req dto.AgentAccountDeleteReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.DeleteAccount(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Get Agent Feishu channel config
+// @Accept json
+// @Param request body dto.AgentFeishuConfigReq true "request"
+// @Success 200 {object} dto.AgentFeishuConfig
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/channel/feishu/get [post]
+func (b *BaseApi) GetAgentFeishuConfig(c *gin.Context) {
+	var req dto.AgentFeishuConfigReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := agentService.GetFeishuConfig(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Update Agent Feishu channel config
+// @Accept json
+// @Param request body dto.AgentFeishuConfigUpdateReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/channel/feishu/update [post]
+func (b *BaseApi) UpdateAgentFeishuConfig(c *gin.Context) {
+	var req dto.AgentFeishuConfigUpdateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.UpdateFeishuConfig(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Get Agent Telegram channel config
+// @Accept json
+// @Param request body dto.AgentTelegramConfigReq true "request"
+// @Success 200 {object} dto.AgentTelegramConfig
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/channel/telegram/get [post]
+func (b *BaseApi) GetAgentTelegramConfig(c *gin.Context) {
+	var req dto.AgentTelegramConfigReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := agentService.GetTelegramConfig(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Update Agent Telegram channel config
+// @Accept json
+// @Param request body dto.AgentTelegramConfigUpdateReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/channel/telegram/update [post]
+func (b *BaseApi) UpdateAgentTelegramConfig(c *gin.Context) {
+	var req dto.AgentTelegramConfigUpdateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.UpdateTelegramConfig(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Get Agent Discord channel config
+// @Accept json
+// @Param request body dto.AgentDiscordConfigReq true "request"
+// @Success 200 {object} dto.AgentDiscordConfig
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/channel/discord/get [post]
+func (b *BaseApi) GetAgentDiscordConfig(c *gin.Context) {
+	var req dto.AgentDiscordConfigReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := agentService.GetDiscordConfig(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Update Agent Discord channel config
+// @Accept json
+// @Param request body dto.AgentDiscordConfigUpdateReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/channel/discord/update [post]
+func (b *BaseApi) UpdateAgentDiscordConfig(c *gin.Context) {
+	var req dto.AgentDiscordConfigUpdateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.UpdateDiscordConfig(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Get Agent QQ Bot channel config
+// @Accept json
+// @Param request body dto.AgentWecomConfigReq true "request"
+// @Success 200 {object} dto.AgentWecomConfig
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/channel/wecom/get [post]
+func (b *BaseApi) GetAgentWecomConfig(c *gin.Context) {
+	var req dto.AgentWecomConfigReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := agentService.GetWecomConfig(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Update Agent WeCom channel config
+// @Accept json
+// @Param request body dto.AgentWecomConfigUpdateReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/channel/wecom/update [post]
+func (b *BaseApi) UpdateAgentWecomConfig(c *gin.Context) {
+	var req dto.AgentWecomConfigUpdateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.UpdateWecomConfig(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Get Agent QQ Bot channel config
+// @Accept json
+// @Param request body dto.AgentQQBotConfigReq true "request"
+// @Success 200 {object} dto.AgentQQBotConfig
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/channel/qqbot/get [post]
+func (b *BaseApi) GetAgentQQBotConfig(c *gin.Context) {
+	var req dto.AgentQQBotConfigReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := agentService.GetQQBotConfig(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Update Agent QQ Bot channel config
+// @Accept json
+// @Param request body dto.AgentQQBotConfigUpdateReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/channel/qqbot/update [post]
+func (b *BaseApi) UpdateAgentQQBotConfig(c *gin.Context) {
+	var req dto.AgentQQBotConfigUpdateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.UpdateQQBotConfig(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Install Agent plugin
+// @Accept json
+// @Param request body dto.AgentPluginInstallReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/plugin/install [post]
+func (b *BaseApi) InstallAgentPlugin(c *gin.Context) {
+	var req dto.AgentPluginInstallReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.InstallPlugin(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Check Agent plugin installation status
+// @Accept json
+// @Param request body dto.AgentPluginCheckReq true "request"
+// @Success 200 {object} dto.AgentPluginStatus
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/plugin/check [post]
+func (b *BaseApi) CheckAgentPlugin(c *gin.Context) {
+	var req dto.AgentPluginCheckReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := agentService.CheckPlugin(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Get Agent Security config
+// @Accept json
+// @Param request body dto.AgentSecurityConfigReq true "request"
+// @Success 200 {object} dto.AgentSecurityConfig
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/security/get [post]
+func (b *BaseApi) GetAgentSecurityConfig(c *gin.Context) {
+	var req dto.AgentSecurityConfigReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := agentService.GetSecurityConfig(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Update Agent Security config
+// @Accept json
+// @Param request body dto.AgentSecurityConfigUpdateReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/security/update [post]
+func (b *BaseApi) UpdateAgentSecurityConfig(c *gin.Context) {
+	var req dto.AgentSecurityConfigUpdateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.UpdateSecurityConfig(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Get Agent Other config
+// @Accept json
+// @Param request body dto.AgentOtherConfigReq true "request"
+// @Success 200 {object} dto.AgentOtherConfig
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/other/get [post]
+func (b *BaseApi) GetAgentOtherConfig(c *gin.Context) {
+	var req dto.AgentOtherConfigReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := agentService.GetOtherConfig(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Update Agent Other config
+// @Accept json
+// @Param request body dto.AgentOtherConfigUpdateReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/other/update [post]
+func (b *BaseApi) UpdateAgentOtherConfig(c *gin.Context) {
+	var req dto.AgentOtherConfigUpdateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.UpdateOtherConfig(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Approve Agent channel pairing code
+// @Accept json
+// @Param request body dto.AgentChannelPairingApproveReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/channel/pairing/approve [post]
+func (b *BaseApi) ApproveAgentChannelPairing(c *gin.Context) {
+	var req dto.AgentChannelPairingApproveReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.ApproveChannelPairing(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}

agent/app/api/v2/app.go

@@ -2,12 +2,12 @@ package v2
 
 import (
 	"net/http"
-	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
 	"github.com/1Panel-dev/1Panel/agent/i18n"
+	"github.com/1Panel-dev/1Panel/agent/utils/appicon"
 	"github.com/gin-gonic/gin"
 )
 
@@ -164,7 +164,7 @@ func (b *BaseApi) InstallApp(c *gin.Context) {
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	install, err := appService.Install(req)
+	install, err := appService.Install(req, true)
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -210,15 +210,28 @@ func (b *BaseApi) GetAppIcon(c *gin.Context) {
 		helper.BadRequest(c, err)
 		return
 	}
-	iconBytes, err := appService.GetAppIcon(appKey)
+	iconBytes, filename, etag, err := appService.GetAppIcon(appKey)
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
-	c.Header("Content-Type", "image/png")
-	c.Header("Cache-Control", "public, max-age=31536000, immutable")
-	c.Header("Last-Modified", time.Now().UTC().Format(http.TimeFormat))
-	c.Data(http.StatusOK, "image/png", iconBytes)
+
+	if len(iconBytes) == 0 {
+		c.Status(http.StatusNoContent)
+		return
+	}
+
+	c.Header("Cache-Control", "public, max-age=2592000")
+
+	if etag != "" && filename != "" {
+		c.Header("ETag", etag)
+		if c.GetHeader("If-None-Match") == etag {
+			c.Status(http.StatusNotModified)
+			return
+		}
+	}
+
+	c.Data(http.StatusOK, appicon.ContentTypePNG, iconBytes)
 }
 
 // @Tags App

agent/app/api/v2/app_install.go

@@ -109,7 +109,7 @@ func (b *BaseApi) LoadPort(c *gin.Context) {
 // @Success 200 {object} response.DatabaseConn
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /apps/installed/conninfo [POST]
+// @Router /apps/installed/conninfo [post]
 func (b *BaseApi) LoadConnInfo(c *gin.Context) {
 	var req dto.OperationWithNameAndType
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -294,7 +294,7 @@ func (b *BaseApi) GetParams(c *gin.Context) {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /apps/installed/params/update [post]
-// @x-panel-log {"bodyKeys":["installId"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"应用参数修改 [installId]","formatEN":"Application param update [installId]"}
+// @x-panel-log {"bodyKeys":["installId"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"installId","isList":false,"db":"app_installs","output_column":"name","output_value":"name"}],"formatZH":"应用参数修改 [name]","formatEN":"Application param update [name]"}
 func (b *BaseApi) UpdateInstalled(c *gin.Context) {
 	var req request.AppInstalledUpdate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -349,3 +349,15 @@ func (b *BaseApi) GetAppInstallInfo(c *gin.Context) {
 	}
 	helper.SuccessWithData(c, info)
 }
+
+func (b *BaseApi) UpdateAppInstallSort(c *gin.Context) {
+	var req request.AppInstallSort
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := appInstallService.UpdateSort(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}

agent/app/api/v2/backup.go

@@ -430,6 +430,16 @@ func (b *BaseApi) Backup(c *gin.Context) {
 			helper.InternalServer(c, err)
 			return
 		}
+	case "container":
+		if err := backupService.ContainerBackup(req); err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
+	case "compose":
+		if err := backupService.ComposeBackup(req); err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
 	}
 	helper.Success(c)
 }
@@ -485,6 +495,16 @@ func (b *BaseApi) Recover(c *gin.Context) {
 			helper.InternalServer(c, err)
 			return
 		}
+	case "container":
+		if err := backupService.ContainerRecover(req); err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
+	case "compose":
+		if err := backupService.ComposeRecover(req); err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
 	}
 	helper.Success(c)
 }
@@ -525,6 +545,16 @@ func (b *BaseApi) RecoverByUpload(c *gin.Context) {
 			helper.InternalServer(c, err)
 			return
 		}
+	case "container":
+		if err := backupService.ContainerRecover(req); err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
+	case "compose":
+		if err := backupService.ComposeRecover(req); err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
 	}
 	helper.Success(c)
 }

agent/app/api/v2/container.go

@@ -1,6 +1,9 @@
 package v2
 
 import (
+	"net/http"
+	"net/url"
+	"path"
 	"strconv"
 
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
@@ -53,6 +56,162 @@ func (b *BaseApi) LoadContainerUsers(c *gin.Context) {
 	helper.SuccessWithData(c, containerService.LoadUsers(req))
 }
 
+// @Tags Container
+// @Summary List container files
+// @Accept json
+// @Param request body dto.ContainerFileReq true "request"
+// @Success 200 {array} dto.ContainerFileInfo
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /containers/files/search [post]
+func (b *BaseApi) ListContainerFiles(c *gin.Context) {
+	var req dto.ContainerFileReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	files, err := containerService.ListContainerFiles(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, files)
+}
+
+// @Tags Container
+// @Summary Upload container file
+// @Accept multipart/form-data
+// @Param containerID formData string true "containerID"
+// @Param path formData string true "path"
+// @Param file formData file true "file"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /containers/files/upload [post]
+// @x-panel-log {"bodyKeys":["containerID","path"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"容器 [containerID] 上传文件到 [path]","formatEN":"Upload file to [path] in container [containerID]"}
+func (b *BaseApi) UploadContainerFile(c *gin.Context) {
+	form, err := c.MultipartForm()
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	containerIDs := form.Value["containerID"]
+	paths := form.Value["path"]
+	uploadFiles := form.File["file"]
+	if len(containerIDs) == 0 || len(paths) == 0 || len(uploadFiles) == 0 {
+		helper.BadRequest(c, errors.New("invalid container file upload params"))
+		return
+	}
+	req := dto.ContainerFileReq{
+		ContainerID: containerIDs[0],
+		Path:        paths[0],
+	}
+	for _, uploadFile := range uploadFiles {
+		file, err := uploadFile.Open()
+		if err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
+		err = containerService.UploadContainerFile(req, path.Base(uploadFile.Filename), uploadFile.Size, file)
+		_ = file.Close()
+		if err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
+	}
+	helper.Success(c)
+}
+
+// @Tags Container
+// @Summary Get container file content
+// @Accept json
+// @Param request body dto.ContainerFileReq true "request"
+// @Success 200 {object} dto.ContainerFileContent
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /containers/files/content [post]
+func (b *BaseApi) GetContainerFileContent(c *gin.Context) {
+	var req dto.ContainerFileReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	content, err := containerService.GetContainerFileContent(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, content)
+}
+
+// @Tags Container
+// @Summary Get container file size
+// @Accept json
+// @Param request body dto.ContainerFileReq true "request"
+// @Success 200 {int} size
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /containers/files/size [post]
+func (b *BaseApi) GetContainerFileSize(c *gin.Context) {
+	var req dto.ContainerFileReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	size, err := containerService.GetContainerFileSize(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, size)
+}
+
+// @Tags Container
+// @Summary Delete container file
+// @Accept json
+// @Param request body dto.ContainerFileBatchDeleteReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /containers/files/del [post]
+// @x-panel-log {"bodyKeys":["containerID","paths"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"删除容器 [containerID] 文件 [paths]","formatEN":"Delete files [paths] in container [containerID]"}
+func (b *BaseApi) DeleteContainerFile(c *gin.Context) {
+	var req dto.ContainerFileBatchDeleteReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := containerService.DeleteContainerFile(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Container
+// @Summary Download container file
+// @Accept json
+// @Param request body dto.ContainerFileReq true "request"
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /containers/files/download [post]
+// @x-panel-log {"bodyKeys":["containerID","path"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"下载容器 [containerID] 文件 [path]","formatEN":"Download file [path] from container [containerID]"}
+func (b *BaseApi) DownloadContainerFile(c *gin.Context) {
+	var req dto.ContainerFileReq
+	if err := c.ShouldBindJSON(&req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	if req.ContainerID == "" || req.Path == "" {
+		helper.BadRequest(c, errors.New("invalid container file download params"))
+		return
+	}
+	reader, fileName, contentType, err := containerService.DownloadContainerFile(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	defer reader.Close()
+	c.Header("Content-Disposition", "attachment; filename*=utf-8''"+url.PathEscape(fileName))
+	c.DataFromReader(http.StatusOK, -1, contentType, reader, nil)
+}
+
 // @Tags Container
 // @Summary List containers
 // @Accept json
@@ -306,27 +465,6 @@ func (b *BaseApi) ContainerCreate(c *gin.Context) {
 	helper.Success(c)
 }
 
-// @Tags Container
-// @Summary Create container by command
-// @Accept json
-// @Param request body dto.ContainerCreateByCommand true "request"
-// @Success 200
-// @Security ApiKeyAuth
-// @Security Timestamp
-// @Router /containers/command [post]
-func (b *BaseApi) ContainerCreateByCommand(c *gin.Context) {
-	var req dto.ContainerCreateByCommand
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
-		return
-	}
-
-	if err := containerService.ContainerCreateByCommand(req); err != nil {
-		helper.InternalServer(c, err)
-		return
-	}
-	helper.Success(c)
-}
-
 // @Tags Container
 // @Summary Upgrade container
 // @Accept json
@@ -529,7 +667,7 @@ func (b *BaseApi) DownloadContainerLogs(c *gin.Context) {
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	err := containerService.DownloadContainerLogs(req.ContainerType, req.Container, req.Since, strconv.Itoa(int(req.Tail)), c)
+	err := containerService.DownloadContainerLogs(req.ContainerType, req.Container, req.Since, strconv.Itoa(int(req.Tail)), req.Timestamp, c)
 	if err != nil {
 		helper.InternalServer(c, err)
 	}
@@ -731,12 +869,33 @@ func (b *BaseApi) ComposeUpdate(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags Container Compose
+// @Summary Load compose environment variables
+// @Accept json
+// @Param request body dto.FilePath true "request"
+// @Success 200 {array} string
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /containers/compose/env [post]
+func (b *BaseApi) LoadComposeEnv(c *gin.Context) {
+	var req dto.FilePath
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := containerService.LoadComposeEnv(req.Path)
+	if err != nil {
+		helper.InternalServer(c, err)
+	}
+	helper.SuccessWithData(c, data)
+}
+
 // @Tags Container
 // @Summary Container logs
 // @Param container query string false "容器名称"
 // @Param since query string false "时间筛选"
 // @Param follow query string false "是否追踪"
 // @Param tail query string false "显示行号"
+// @Param timestamp query string false "是否显示时间"
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
@@ -750,6 +909,7 @@ func (b *BaseApi) ContainerStreamLogs(c *gin.Context) {
 	since := c.Query("since")
 	follow := c.Query("follow") == "true"
 	tail := c.Query("tail")
+	timestamp := c.Query("timestamp") == "true"
 
 	container := c.Query("container")
 	compose := c.Query("compose")
@@ -759,6 +919,7 @@ func (b *BaseApi) ContainerStreamLogs(c *gin.Context) {
 		Since:     since,
 		Follow:    follow,
 		Tail:      tail,
+		Timestamp: timestamp,
 		Type:      "container",
 	}
 	if compose != "" {

agent/app/api/v2/docker.go

@@ -12,7 +12,7 @@ import (
 // @Tags Container Docker
 // @Summary Load docker status
 // @Produce json
-// @Success 200 {string} dto.DockerStatus
+// @Success 200 {object} dto.DockerStatus
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /containers/docker/status [get]
@@ -24,7 +24,7 @@ func (b *BaseApi) LoadDockerStatus(c *gin.Context) {
 // @Tags Container Docker
 // @Summary Load docker daemon.json
 // @Produce json
-// @Success 200 {object} string
+// @Success 200 {string} string
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /containers/daemonjson/file [get]

agent/app/api/v2/entry.go

@@ -20,6 +20,7 @@ var (
 	aiToolService      = service.NewIAIToolService()
 	mcpServerService   = service.NewIMcpServerService()
 	tensorrtLLMService = service.NewITensorRTLLMService()
+	agentService       = service.NewIAgentService()
 
 	containerService       = service.NewIContainerService()
 	composeTemplateService = service.NewIComposeTemplateService()

agent/app/api/v2/file.go

@@ -978,3 +978,40 @@ func (b *BaseApi) ConvertLog(c *gin.Context) {
 		Total: total,
 	})
 }
+
+// @Tags File
+// @Summary Batch get file remarks
+// @Accept json
+// @Param request body request.FileRemarkBatch true "request"
+// @Success 200 {object} response.FileRemarksRes
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/remarks [post]
+func (b *BaseApi) BatchGetFileRemarks(c *gin.Context) {
+	var req request.FileRemarkBatch
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	remarks := fileService.BatchGetRemarks(req)
+	helper.SuccessWithData(c, response.FileRemarksRes{Remarks: remarks})
+}
+
+// @Tags File
+// @Summary Set file remark
+// @Accept json
+// @Param request body request.FileRemarkUpdate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/remark [post]
+func (b *BaseApi) SetFileRemark(c *gin.Context) {
+	var req request.FileRemarkUpdate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := fileService.SetRemark(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}

agent/app/api/v2/process.go

@@ -57,3 +57,18 @@ func (b *BaseApi) GetProcessInfoByPID(c *gin.Context) {
 	}
 	helper.SuccessWithData(c, data)
 }
+
+// @Tags Process
+// @Summary Get Listening Process
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /process/listening [post]
+func (b *BaseApi) GetListeningProcess(c *gin.Context) {
+	procs, err := processService.GetListeningProcess(c)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, procs)
+}

agent/app/api/v2/setting.go

@@ -80,7 +80,10 @@ func (b *BaseApi) LoadLocalConn(c *gin.Context) {
 }
 
 func (b *BaseApi) CheckLocalConn(c *gin.Context) {
-	_, err := loadLocalConn()
+	client, err := loadLocalConn()
+	if err == nil && client != nil {
+		client.Close()
+	}
 	helper.SuccessWithData(c, err == nil)
 }
 

agent/app/api/v2/task.go

@@ -32,7 +32,7 @@ func (b *BaseApi) PageTasks(c *gin.Context) {
 
 // @Tags TaskLog
 // @Summary Get the number of executing tasks
-// @Success 200 {object} int64
+// @Success 200 {integer} int64
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /logs/tasks/executing/count [get]

agent/app/api/v2/website.go

@@ -506,7 +506,7 @@ func (b *BaseApi) GetProxyConfig(c *gin.Context) {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /websites/proxies/update [post]
-// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"id","isList":false,"db":"websites","output_column":"primary_domain","output_value":"domain"}],"formatZH":"修改网站 [domain] 反向代理配置 ","formatEN":"Update domain [domain] proxy config"}
+// @x-panel-log {"bodyKeys":["id","name","operate"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"id","isList":false,"db":"websites","output_column":"primary_domain","output_value":"domain"}],"formatZH":"修改 [operate] 网站 [domain] 反向代理配置 [name] ","formatEN":"Update [operate] domain [domain] proxy config [name]"}
 func (b *BaseApi) UpdateProxyConfig(c *gin.Context) {
 	var req request.WebsiteProxyConfig
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -520,6 +520,50 @@ func (b *BaseApi) UpdateProxyConfig(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags Website
+// @Summary Delete proxy config
+// @Accept json
+// @Param request body request.WebsiteProxyDel true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/proxies/delete [post]
+// @x-panel-log {"bodyKeys":["id","name"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"id","isList":false,"db":"websites","output_column":"primary_domain","output_value":"domain"}],"formatZH":"删除网站 [domain] 反向代理配置 [name] ","formatEN":"Delete domain [domain] proxy config [name]"}
+func (b *BaseApi) DeleteProxyConfig(c *gin.Context) {
+	var req request.WebsiteProxyDel
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	err := websiteService.DeleteProxy(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Website
+// @Summary Update proxy config status
+// @Accept json
+// @Param request body request.WebsiteProxyStatusUpdate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/proxies/status [post]
+// @x-panel-log {"bodyKeys":["id","name","status"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"id","isList":false,"db":"websites","output_column":"primary_domain","output_value":"domain"}],"formatZH":"修改网站 [domain] 反向代理配置 [name] 状态 [status] ","formatEN":"Update domain [domain] proxy config [name] status [status]"}
+func (b *BaseApi) UpdateProxyConfigStatus(c *gin.Context) {
+	var req request.WebsiteProxyStatusUpdate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	err := websiteService.UpdateProxyStatus(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags Website
 // @Summary Update proxy file
 // @Accept json
@@ -528,7 +572,7 @@ func (b *BaseApi) UpdateProxyConfig(c *gin.Context) {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /websites/proxies/file [post]
-// @x-panel-log {"bodyKeys":["websiteID"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"websiteID","isList":false,"db":"websites","output_column":"primary_domain","output_value":"domain"}],"formatZH":"更新反向代理文件 [domain]","formatEN":"Nginx conf proxy file update [domain]"}
+// @x-panel-log {"bodyKeys":["websiteID","name"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"websiteID","isList":false,"db":"websites","output_column":"primary_domain","output_value":"domain"}],"formatZH":"修改网站 [domain] 反向代理配置文件 [name] ","formatEN":"Update domain [domain] proxy config file [name]"}
 func (b *BaseApi) UpdateProxyConfigFile(c *gin.Context) {
 	var req request.NginxProxyUpdate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {

agent/app/api/v2/website_ssl.go

@@ -5,7 +5,6 @@ import (
 	"mime/multipart"
 	"net/http"
 	"net/url"
-	"reflect"
 	"strconv"
 
 	"github.com/1Panel-dev/1Panel/agent/app/model"
@@ -26,27 +25,39 @@ import (
 // @Router /websites/ssl/search [post]
 func (b *BaseApi) PageWebsiteSSL(c *gin.Context) {
 	var req request.WebsiteSSLSearch
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	total, accounts, err := websiteSSLService.Page(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithDataGzipped(c, dto.PageResult{
+		Total: total,
+		Items: accounts,
+	})
+}
+
+// @Tags Website SSL
+// @Summary List website ssl
+// @Accept json
+// @Param request body request.WebsiteSSLListReq true "request"
+// @Success 200 {array} response.WebsiteSSLDTO
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/ssl/list [post]
+func (b *BaseApi) ListWebsiteSSL(c *gin.Context) {
+	var req request.WebsiteSSLListReq
 	if err := helper.CheckBind(&req, c); err != nil {
 		return
 	}
-	if !reflect.DeepEqual(req.PageInfo, dto.PageInfo{}) {
-		total, accounts, err := websiteSSLService.Page(req)
-		if err != nil {
-			helper.InternalServer(c, err)
-			return
-		}
-		helper.SuccessWithDataGzipped(c, dto.PageResult{
-			Total: total,
-			Items: accounts,
-		})
-	} else {
-		list, err := websiteSSLService.Search(req)
-		if err != nil {
-			helper.InternalServer(c, err)
-			return
-		}
-		helper.SuccessWithDataGzipped(c, list)
+	list, err := websiteSSLService.Search(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
 	}
+	helper.SuccessWithDataGzipped(c, list)
 }
 
 // @Tags Website SSL

agent/app/dto/agents.go

@@ -0,0 +1,302 @@
+package dto
+
+import "time"
+
+type AgentCreateReq struct {
+	Name           string   `json:"name" validate:"required"`
+	AppVersion     string   `json:"appVersion" validate:"required"`
+	WebUIPort      int      `json:"webUIPort" validate:"required"`
+	BridgePort     int      `json:"bridgePort"`
+	AllowedOrigins []string `json:"allowedOrigins"`
+	AgentType      string   `json:"agentType"`
+	Provider       string   `json:"provider"`
+	Model          string   `json:"model"`
+	APIType        string   `json:"apiType"`
+	MaxTokens      int      `json:"maxTokens"`
+	ContextWindow  int      `json:"contextWindow"`
+	AccountID      uint     `json:"accountId"`
+	APIKey         string   `json:"apiKey"`
+	BaseURL        string   `json:"baseURL"`
+	Token          string   `json:"token"`
+	TaskID         string   `json:"taskID"`
+	Advanced       bool     `json:"advanced"`
+	ContainerName  string   `json:"containerName"`
+	AllowPort      bool     `json:"allowPort"`
+	SpecifyIP      string   `json:"specifyIP"`
+	RestartPolicy  string   `json:"restartPolicy"`
+	CpuQuota       float64  `json:"cpuQuota"`
+	MemoryLimit    float64  `json:"memoryLimit"`
+	MemoryUnit     string   `json:"memoryUnit"`
+	PullImage      bool     `json:"pullImage"`
+	EditCompose    bool     `json:"editCompose"`
+	DockerCompose  string   `json:"dockerCompose"`
+}
+
+type AgentItem struct {
+	ID            uint      `json:"id"`
+	Name          string    `json:"name"`
+	AgentType     string    `json:"agentType"`
+	Provider      string    `json:"provider"`
+	ProviderName  string    `json:"providerName"`
+	Model         string    `json:"model"`
+	APIType       string    `json:"apiType"`
+	MaxTokens     int       `json:"maxTokens"`
+	ContextWindow int       `json:"contextWindow"`
+	BaseURL       string    `json:"baseUrl"`
+	APIKey        string    `json:"apiKey"`
+	Token         string    `json:"token"`
+	Status        string    `json:"status"`
+	Message       string    `json:"message"`
+	AppInstallID  uint      `json:"appInstallId"`
+	AccountID     uint      `json:"accountId"`
+	AppVersion    string    `json:"appVersion"`
+	Container     string    `json:"containerName"`
+	WebUIPort     int       `json:"webUIPort"`
+	BridgePort    int       `json:"bridgePort"`
+	Path          string    `json:"path"`
+	ConfigPath    string    `json:"configPath"`
+	Upgradable    bool      `json:"upgradable"`
+	CreatedAt     time.Time `json:"createdAt"`
+}
+
+type AgentDeleteReq struct {
+	ID          uint   `json:"id" validate:"required"`
+	TaskID      string `json:"taskID"`
+	ForceDelete bool   `json:"forceDelete"`
+}
+
+type AgentTokenResetReq struct {
+	ID uint `json:"id" validate:"required"`
+}
+
+type AgentModelConfigUpdateReq struct {
+	AgentID   uint   `json:"agentId" validate:"required"`
+	AccountID uint   `json:"accountId" validate:"required"`
+	Model     string `json:"model" validate:"required"`
+}
+
+type AgentAccountCreateReq struct {
+	Provider       string `json:"provider" validate:"required"`
+	Name           string `json:"name" validate:"required"`
+	APIKey         string `json:"apiKey" validate:"required"`
+	RememberAPIKey bool   `json:"rememberApiKey"`
+	BaseURL        string `json:"baseURL"`
+	Model          string `json:"model"`
+	APIType        string `json:"apiType"`
+	MaxTokens      int    `json:"maxTokens"`
+	ContextWindow  int    `json:"contextWindow"`
+	Remark         string `json:"remark"`
+}
+
+type AgentAccountUpdateReq struct {
+	ID             uint   `json:"id" validate:"required"`
+	Name           string `json:"name" validate:"required"`
+	APIKey         string `json:"apiKey" validate:"required"`
+	RememberAPIKey bool   `json:"rememberApiKey"`
+	BaseURL        string `json:"baseURL"`
+	Model          string `json:"model"`
+	APIType        string `json:"apiType"`
+	MaxTokens      int    `json:"maxTokens"`
+	ContextWindow  int    `json:"contextWindow"`
+	Remark         string `json:"remark"`
+	SyncAgents     bool   `json:"syncAgents"`
+}
+
+type AgentAccountVerifyReq struct {
+	Provider string `json:"provider" validate:"required"`
+	APIKey   string `json:"apiKey" validate:"required"`
+	BaseURL  string `json:"baseURL"`
+}
+
+type AgentAccountDeleteReq struct {
+	ID uint `json:"id" validate:"required"`
+}
+
+type AgentAccountSearch struct {
+	PageInfo
+	Provider string `json:"provider"`
+	Name     string `json:"name"`
+}
+
+type AgentAccountInfo struct {
+	ID             uint      `json:"id"`
+	Provider       string    `json:"provider"`
+	ProviderName   string    `json:"providerName"`
+	Name           string    `json:"name"`
+	APIKey         string    `json:"apiKey"`
+	RememberAPIKey bool      `json:"rememberApiKey"`
+	BaseURL        string    `json:"baseUrl"`
+	Model          string    `json:"model"`
+	APIType        string    `json:"apiType"`
+	MaxTokens      int       `json:"maxTokens"`
+	ContextWindow  int       `json:"contextWindow"`
+	Verified       bool      `json:"verified"`
+	Remark         string    `json:"remark"`
+	CreatedAt      time.Time `json:"createdAt"`
+}
+
+type ProviderModelInfo struct {
+	ID   string `json:"id"`
+	Name string `json:"name"`
+}
+
+type ProviderInfo struct {
+	Sort        uint                `json:"-"`
+	Provider    string              `json:"provider"`
+	DisplayName string              `json:"displayName"`
+	BaseURL     string              `json:"baseUrl"`
+	Models      []ProviderModelInfo `json:"models"`
+}
+
+type AgentFeishuConfigReq struct {
+	AgentID uint `json:"agentId" validate:"required"`
+}
+
+type AgentFeishuConfigUpdateReq struct {
+	AgentID   uint   `json:"agentId" validate:"required"`
+	BotName   string `json:"botName" validate:"required"`
+	AppID     string `json:"appId" validate:"required"`
+	AppSecret string `json:"appSecret" validate:"required"`
+	Enabled   bool   `json:"enabled"`
+	DmPolicy  string `json:"dmPolicy" validate:"required"`
+}
+
+type AgentFeishuPairingApproveReq struct {
+	AgentID     uint   `json:"agentId" validate:"required"`
+	PairingCode string `json:"pairingCode" validate:"required"`
+}
+
+type AgentFeishuConfig struct {
+	Enabled   bool   `json:"enabled"`
+	DmPolicy  string `json:"dmPolicy"`
+	BotName   string `json:"botName"`
+	AppID     string `json:"appId"`
+	AppSecret string `json:"appSecret"`
+}
+
+type AgentTelegramConfigReq struct {
+	AgentID uint `json:"agentId" validate:"required"`
+}
+
+type AgentTelegramConfigUpdateReq struct {
+	AgentID  uint   `json:"agentId" validate:"required"`
+	Enabled  bool   `json:"enabled"`
+	DmPolicy string `json:"dmPolicy" validate:"required"`
+	BotToken string `json:"botToken" validate:"required"`
+	Proxy    string `json:"proxy"`
+}
+
+type AgentTelegramConfig struct {
+	Enabled  bool   `json:"enabled"`
+	DmPolicy string `json:"dmPolicy"`
+	BotToken string `json:"botToken"`
+	Proxy    string `json:"proxy"`
+}
+
+type AgentChannelPairingApproveReq struct {
+	AgentID     uint   `json:"agentId" validate:"required"`
+	Type        string `json:"type" validate:"required,oneof=feishu telegram discord wecom"`
+	PairingCode string `json:"pairingCode" validate:"required"`
+}
+
+type AgentWecomConfigReq struct {
+	AgentID uint `json:"agentId" validate:"required"`
+}
+
+type AgentWecomConfigUpdateReq struct {
+	AgentID  uint   `json:"agentId" validate:"required"`
+	Enabled  bool   `json:"enabled"`
+	DmPolicy string `json:"dmPolicy" validate:"required,oneof=pairing open"`
+	BotID    string `json:"botId" validate:"required"`
+	Secret   string `json:"secret" validate:"required"`
+}
+
+type AgentWecomConfig struct {
+	Enabled   bool   `json:"enabled"`
+	DmPolicy  string `json:"dmPolicy"`
+	BotID     string `json:"botId"`
+	Secret    string `json:"secret"`
+	Installed bool   `json:"installed"`
+}
+
+type AgentQQBotConfigReq struct {
+	AgentID uint `json:"agentId" validate:"required"`
+}
+
+type AgentQQBotConfigUpdateReq struct {
+	AgentID      uint   `json:"agentId" validate:"required"`
+	Enabled      bool   `json:"enabled"`
+	AppID        string `json:"appId" validate:"required"`
+	ClientSecret string `json:"clientSecret" validate:"required"`
+}
+
+type AgentQQBotConfig struct {
+	Enabled      bool   `json:"enabled"`
+	AppID        string `json:"appId"`
+	ClientSecret string `json:"clientSecret"`
+	Installed    bool   `json:"installed"`
+}
+
+type AgentPluginInstallReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	Type    string `json:"type" validate:"required,oneof=qqbot wecom"`
+	TaskID  string `json:"taskID" validate:"required"`
+}
+
+type AgentPluginCheckReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	Type    string `json:"type" validate:"required,oneof=qqbot wecom"`
+}
+
+type AgentPluginStatus struct {
+	Installed bool `json:"installed"`
+}
+
+type AgentDiscordConfigReq struct {
+	AgentID uint `json:"agentId" validate:"required"`
+}
+
+type AgentDiscordConfigUpdateReq struct {
+	AgentID     uint   `json:"agentId" validate:"required"`
+	Enabled     bool   `json:"enabled"`
+	DmPolicy    string `json:"dmPolicy" validate:"required"`
+	GroupPolicy string `json:"groupPolicy" validate:"required,oneof=open allowlist disabled"`
+	Token       string `json:"token" validate:"required"`
+	Proxy       string `json:"proxy"`
+}
+
+type AgentDiscordConfig struct {
+	Enabled     bool   `json:"enabled"`
+	DmPolicy    string `json:"dmPolicy"`
+	GroupPolicy string `json:"groupPolicy"`
+	Token       string `json:"token"`
+	Proxy       string `json:"proxy"`
+}
+
+type AgentSecurityConfigReq struct {
+	AgentID uint `json:"agentId" validate:"required"`
+}
+
+type AgentSecurityConfigUpdateReq struct {
+	AgentID        uint     `json:"agentId" validate:"required"`
+	AllowedOrigins []string `json:"allowedOrigins"`
+}
+
+type AgentSecurityConfig struct {
+	AllowedOrigins []string `json:"allowedOrigins"`
+}
+
+type AgentOtherConfigReq struct {
+	AgentID uint `json:"agentId" validate:"required"`
+}
+
+type AgentOtherConfigUpdateReq struct {
+	AgentID        uint   `json:"agentId" validate:"required"`
+	UserTimezone   string `json:"userTimezone" validate:"required"`
+	BrowserEnabled bool   `json:"browserEnabled"`
+}
+
+type AgentOtherConfig struct {
+	UserTimezone   string `json:"userTimezone"`
+	BrowserEnabled bool   `json:"browserEnabled"`
+}

agent/app/dto/alert.go

@@ -335,3 +335,8 @@ type AgentInfo struct {
 	NodeName string `json:"nodeName"`
 	NodeAddr string `json:"nodeAddr"`
 }
+
+type AlertWebhookConfig struct {
+	DisplayName string `json:"displayName"`
+	Url         string `json:"url"`
+}

agent/app/dto/backup.go

@@ -65,10 +65,11 @@ type UploadForRecover struct {
 }
 
 type CommonBackup struct {
-	Type       string   `json:"type" validate:"required,oneof=app mysql mariadb redis website postgresql mysql-cluster postgresql-cluster redis-cluster"`
+	Type       string   `json:"type" validate:"required,oneof=app mysql mariadb redis website postgresql mysql-cluster postgresql-cluster redis-cluster container compose"`
 	Name       string   `json:"name"`
 	DetailName string   `json:"detailName"`
 	Secret     string   `json:"secret"`
+	StopBefore bool     `json:"stopBefore"`
 	TaskID     string   `json:"taskID"`
 	FileName   string   `json:"fileName"`
 	Args       []string `json:"args"`
@@ -77,7 +78,7 @@ type CommonBackup struct {
 }
 type CommonRecover struct {
 	DownloadAccountID uint   `json:"downloadAccountID" validate:"required"`
-	Type              string `json:"type" validate:"required,oneof=app mysql mariadb redis website postgresql mysql-cluster postgresql-cluster redis-cluster"`
+	Type              string `json:"type" validate:"required,oneof=app mysql mariadb redis website postgresql mysql-cluster postgresql-cluster redis-cluster container compose"`
 	Name              string `json:"name"`
 	DetailName        string `json:"detailName"`
 	File              string `json:"file"`

agent/app/dto/container.go

@@ -48,6 +48,34 @@ type ContainerOptions struct {
 	State string `json:"state"`
 }
 
+type ContainerFileReq struct {
+	ContainerID string `json:"containerID" validate:"required"`
+	Path        string `json:"path" validate:"required"`
+}
+
+type ContainerFileBatchDeleteReq struct {
+	ContainerID string   `json:"containerID" validate:"required"`
+	Paths       []string `json:"paths" validate:"required,min=1,dive,required"`
+}
+
+type ContainerFileInfo struct {
+	Name    string `json:"name"`
+	Path    string `json:"path"`
+	IsDir   bool   `json:"isDir"`
+	IsLink  bool   `json:"isLink"`
+	LinkTo  string `json:"linkTo"`
+	Size    int64  `json:"size"`
+	Mode    string `json:"mode"`
+	ModTime string `json:"modTime"`
+}
+
+type ContainerFileContent struct {
+	Content   string `json:"content"`
+	Size      int64  `json:"size"`
+	Truncated bool   `json:"truncated"`
+	IsBinary  bool   `json:"isBinary"`
+}
+
 type ContainerStatus struct {
 	Created    int `json:"created"`
 	Running    int `json:"running"`
@@ -95,10 +123,16 @@ type ContainerOperate struct {
 	Privileged      bool           `json:"privileged"`
 	AutoRemove      bool           `json:"autoRemove"`
 	Volumes         []VolumeHelper `json:"volumes"`
+	ExtraHosts      []ExtraHost    `json:"extraHosts"`
 	Labels          []string       `json:"labels"`
 	Env             []string       `json:"env"`
 	RestartPolicy   string         `json:"restartPolicy"`
 }
+
+type ExtraHost struct {
+	Hostname string `json:"hostname"`
+	IP       string `json:"ip"`
+}
 type ContainerNetwork struct {
 	Network string `json:"network"`
 	Ipv4    string `json:"ipv4"`
@@ -272,13 +306,14 @@ type ComposeContainer struct {
 	Ports       []string `json:"ports"`
 }
 type ComposeCreate struct {
-	TaskID   string `json:"taskID"`
-	Name     string `json:"name"`
-	From     string `json:"from" validate:"required,oneof=edit path template"`
-	File     string `json:"file"`
-	Path     string `json:"path"`
-	Template uint   `json:"template"`
-	Env      string `json:"env"`
+	TaskID    string `json:"taskID"`
+	Name      string `json:"name"`
+	From      string `json:"from" validate:"required,oneof=edit path template"`
+	File      string `json:"file"`
+	Path      string `json:"path"`
+	Template  uint   `json:"template"`
+	Env       string `json:"env"`
+	ForcePull bool   `json:"forcePull"`
 }
 type ComposeOperation struct {
 	Name      string `json:"name" validate:"required"`
@@ -288,11 +323,13 @@ type ComposeOperation struct {
 	Force     bool   `json:"force"`
 }
 type ComposeUpdate struct {
+	TaskID     string `json:"taskID"`
 	Name       string `json:"name" validate:"required"`
 	Path       string `json:"path" validate:"required"`
 	DetailPath string `json:"detailPath"`
 	Content    string `json:"content" validate:"required"`
 	Env        string `json:"env"`
+	ForcePull  bool   `json:"forcePull"`
 }
 type ComposeLogClean struct {
 	Name       string `json:"name" validate:"required"`
@@ -304,6 +341,7 @@ type ContainerLog struct {
 	Container     string `json:"container" validate:"required"`
 	Since         string `json:"since"`
 	Tail          uint   `json:"tail"`
+	Timestamp     bool   `json:"timestamp"`
 	ContainerType string `json:"containerType"`
 }
 
@@ -313,5 +351,6 @@ type StreamLog struct {
 	Since     string
 	Follow    bool
 	Tail      string
+	Timestamp bool
 	Type      string
 }

agent/app/dto/dashboard.go

@@ -4,6 +4,7 @@ import "time"
 
 type DashboardBase struct {
 	WebsiteNumber      int `json:"websiteNumber"`
+	AgentNumber        int `json:"agentNumber"`
 	DatabaseNumber     int `json:"databaseNumber"`
 	CronjobNumber      int `json:"cronjobNumber"`
 	AppInstalledNumber int `json:"appInstalledNumber"`

agent/app/dto/image.go

@@ -21,8 +21,8 @@ type ImageInfo struct {
 }
 
 type ImageLoad struct {
-	TaskID string `json:"taskID"`
-	Path   string `json:"path" validate:"required"`
+	TaskID string   `json:"taskID"`
+	Paths  []string `json:"paths" validate:"required,dive,required"`
 }
 
 type ImageBuild struct {

agent/app/dto/request/app.go

@@ -54,13 +54,14 @@ type AppContainerConfig struct {
 
 type AppInstalledSearch struct {
 	dto.PageInfo
-	Type   string   `json:"type"`
-	Name   string   `json:"name"`
-	Tags   []string `json:"tags"`
-	Update bool     `json:"update"`
-	Unused bool     `json:"unused"`
-	All    bool     `json:"all"`
-	Sync   bool     `json:"sync"`
+	Type        string   `json:"type"`
+	Name        string   `json:"name"`
+	Tags        []string `json:"tags"`
+	Update      bool     `json:"update"`
+	Unused      bool     `json:"unused"`
+	All         bool     `json:"all"`
+	Sync        bool     `json:"sync"`
+	CheckUpdate bool     `json:"checkUpdate"`
 }
 
 type AppInstalledInfo struct {
@@ -137,3 +138,12 @@ type AppUpdateVersion struct {
 	AppInstallID  uint   `json:"appInstallID" validate:"required"`
 	UpdateVersion string `json:"updateVersion"`
 }
+
+type AppInstallSortItem struct {
+	InstallID uint `json:"installID"`
+	SortOrder int  `json:"sortOrder"`
+}
+
+type AppInstallSort struct {
+	Items []AppInstallSortItem `json:"items" validate:"required"`
+}

agent/app/dto/request/file.go

@@ -163,3 +163,12 @@ type FileConvertRequest struct {
 	DeleteSource bool          `json:"deleteSource"`
 	TaskID       string        `json:"taskID"`
 }
+
+type FileRemarkBatch struct {
+	Paths []string `json:"paths" validate:"required"`
+}
+
+type FileRemarkUpdate struct {
+	Path   string `json:"path" validate:"required"`
+	Remark string `json:"remark"`
+}

agent/app/dto/request/website.go

@@ -272,6 +272,17 @@ type WebsiteProxyConfig struct {
 	CorsConfig
 }
 
+type WebsiteProxyDelete struct {
+	ID   uint   `json:"id" validate:"required"`
+	Name string `json:"name" validate:"required"`
+}
+
+type WebsiteProxyStatusUpdate struct {
+	ID     uint   `json:"id" validate:"required"`
+	Name   string `json:"name" validate:"required"`
+	Status string `json:"status" validate:"required"`
+}
+
 type CorsConfig struct {
 	Cors             bool   `json:"cors"`
 	AllowOrigins     string `json:"allowOrigins"`

agent/app/dto/request/website_ssl.go

@@ -6,8 +6,12 @@ type WebsiteSSLSearch struct {
 	dto.PageInfo
 	AcmeAccountID string `json:"acmeAccountID"`
 	Domain        string `json:"domain"`
-	OrderBy       string `json:"orderBy" validate:"required,oneof=expire_date"`
-	Order         string `json:"order" validate:"required,oneof=null ascending descending"`
+	OrderBy       string `json:"orderBy" validate:"omitempty,oneof=created_at expire_date"`
+	Order         string `json:"order" validate:"omitempty,oneof=null ascending descending"`
+}
+
+type WebsiteSSLListReq struct {
+	AcmeAccountID string `json:"acmeAccountID"`
 }
 
 type WebsiteSSLCreate struct {
@@ -63,6 +67,7 @@ type WebsiteAcmeAccountCreate struct {
 	EabHmacKey string `json:"eabHmacKey"`
 	UseProxy   bool   `json:"useProxy"`
 	CaDirURL   string `json:"caDirURL"`
+	UseEAB     bool   `json:"useEAB"`
 }
 
 type WebsiteAcmeAccountUpdate struct {

agent/app/dto/response/app.go

@@ -126,6 +126,7 @@ type AppInstallDTO struct {
 	WebUI         string    `json:"webUI"`
 	CreatedAt     time.Time `json:"createdAt"`
 	Favorite      bool      `json:"favorite"`
+	SortOrder     int       `json:"sortOrder"`
 	App           AppDetail `json:"app"`
 	Container     string    `json:"container"`
 	IsEdit        bool      `json:"isEdit"`

agent/app/dto/response/file.go

@@ -81,3 +81,7 @@ type FileConvertLog struct {
 	Status  string `json:"status"`
 	Message string `json:"message"`
 }
+
+type FileRemarksRes struct {
+	Remarks map[string]string `json:"remarks"`
+}

agent/app/dto/response/website.go

@@ -40,6 +40,7 @@ type WebsiteRes struct {
 	SSLStatus     string    `json:"sslStatus"`
 	AppInstallID  uint      `json:"appInstallId"`
 	ChildSites    []string  `json:"childSites"`
+	ParentSite    string    `json:"parentSite"`
 	RuntimeType   string    `json:"runtimeType"`
 	Favorite      bool      `json:"favorite"`
 	IPV6          bool      `json:"IPV6"`

agent/app/model/agent.go

@@ -0,0 +1,20 @@
+package model
+
+type Agent struct {
+	BaseModel
+	Name          string `json:"name" gorm:"not null;unique"`
+	AgentType     string `json:"agentType" gorm:"default:openclaw"`
+	Provider      string `json:"provider"`
+	Model         string `json:"model"`
+	APIType       string `json:"apiType"`
+	MaxTokens     int    `json:"maxTokens"`
+	ContextWindow int    `json:"contextWindow"`
+	BaseURL       string `json:"baseUrl"`
+	APIKey        string `json:"apiKey"`
+	Token         string `json:"token"`
+	Status        string `json:"status"`
+	Message       string `json:"message"`
+	AppInstallID  uint   `json:"appInstallId"`
+	AccountID     uint   `json:"accountId"`
+	ConfigPath    string `json:"configPath"`
+}

agent/app/model/agent_account.go

@@ -0,0 +1,20 @@
+package model
+
+type AgentAccount struct {
+	BaseModel
+	Provider       string `json:"provider"`
+	Name           string `json:"name"`
+	APIKey         string `json:"apiKey"`
+	BaseURL        string `json:"baseUrl"`
+	Model          string `json:"model"`
+	APIType        string `json:"apiType"`
+	MaxTokens      int    `json:"maxTokens"`
+	ContextWindow  int    `json:"contextWindow"`
+	RememberAPIKey bool   `json:"rememberApiKey"`
+	Verified       bool   `json:"verified"`
+	Remark         string `json:"remark"`
+}
+
+func (AgentAccount) TableName() string {
+	return "agent_provider_accounts"
+}

agent/app/model/alert.go

@@ -11,7 +11,7 @@ type Alert struct {
 	Status         string `gorm:"type:varchar(64);not null" json:"status"`
 	Method         string `gorm:"type:varchar(64);not null" json:"method"`
 	SendCount      uint   `gorm:"type:integer" json:"sendCount"`
-	AdvancedParams string `gorm:"type:longText" json:"advancedParam"`
+	AdvancedParams string `gorm:"type:longText" json:"advancedParams"`
 }
 
 type AlertTask struct {

agent/app/model/app_install.go

@@ -26,6 +26,7 @@ type AppInstall struct {
 	HttpsPort     int    `json:"httpsPort"`
 	WebUI         string `json:"webUI"`
 	Favorite      bool   `json:"favorite"`
+	SortOrder     int    `json:"sortOrder" gorm:"default:0"`
 
 	App App `json:"app" gorm:"-:migration"`
 }

agent/app/model/website_acme_account.go

@@ -11,6 +11,7 @@ type WebsiteAcmeAccount struct {
 	KeyType    string `gorm:"not null;default:2048" json:"keyType"`
 	UseProxy   bool   `gorm:"default:false" json:"useProxy"`
 	CaDirURL   string `json:"caDirURL"`
+	UseEAB     bool   `json:"useEAB"`
 }
 
 func (w WebsiteAcmeAccount) TableName() string {

agent/app/provider/catalog.go

@@ -0,0 +1,270 @@
+package provider
+
+import (
+	"strings"
+)
+
+type Model struct {
+	ID   string
+	Name string
+}
+
+type Meta struct {
+	Key            string
+	DisplayName    string
+	Sort           uint
+	DefaultBaseURL string
+	EnvKey         string
+	Models         []Model
+	Enabled        bool
+}
+
+var catalog = map[string]Meta{
+	"custom": {
+		Key:            "custom",
+		DisplayName:    "Custom",
+		Sort:           10,
+		DefaultBaseURL: "",
+		EnvKey:         "CUSTOM_API_KEY",
+		Enabled:        true,
+		Models:         []Model{},
+	},
+	"ollama": {
+		Key:         "ollama",
+		DisplayName: "Ollama",
+		Sort:        15,
+		Enabled:     true,
+	},
+	"vllm": {
+		Key:            "vllm",
+		DisplayName:    "vLLM",
+		Sort:           20,
+		DefaultBaseURL: "",
+		EnvKey:         "VLLM_API_KEY",
+		Enabled:        true,
+		Models:         []Model{},
+	},
+	"deepseek": {
+		Key:            "deepseek",
+		DisplayName:    "DeepSeek",
+		Sort:           25,
+		DefaultBaseURL: "https://api.deepseek.com/v1",
+		EnvKey:         "DEEPSEEK_API_KEY",
+		Enabled:        true,
+		Models: []Model{
+			{ID: "deepseek/deepseek-chat", Name: "DeepSeek Chat"},
+			{ID: "deepseek/deepseek-reasoner", Name: "DeepSeek Reasoner"},
+			{ID: "deepseek/deepseek-r1:1.5b", Name: "DeepSeek R1 1.5B"},
+		},
+	},
+	"bailian-coding-plan": {
+		Key:            "bailian-coding-plan",
+		DisplayName:    "阿里云百炼 Coding Plan",
+		Sort:           30,
+		DefaultBaseURL: "https://coding.dashscope.aliyuncs.com/v1",
+		EnvKey:         "QWEN_API_KEY",
+		Enabled:        true,
+		Models: []Model{
+			{ID: "bailian-coding-plan/qwen3.5-plus", Name: "Qwen3.5-Plus"},
+			{ID: "bailian-coding-plan/qwen3-max", Name: "Qwen3-Max"},
+			{ID: "bailian-coding-plan/qwen3-coder-next", Name: "Qwen3-Coder-Next"},
+			{ID: "bailian-coding-plan/qwen3-coder-plus", Name: "Qwen3-Coder-Plus"},
+			{ID: "bailian-coding-plan/minimax-m2.5", Name: "MiniMax M2.5"},
+			{ID: "bailian-coding-plan/glm-5", Name: "GLM-5"},
+			{ID: "bailian-coding-plan/kimi-k2.5", Name: "Kimi-k2.5"},
+			{ID: "bailian-coding-plan/glm-4.7", Name: "GLM-4.7"},
+		},
+	},
+	"ark-coding-plan": {
+		Key:            "ark-coding-plan",
+		DisplayName:    "方舟 Coding Plan",
+		Sort:           35,
+		DefaultBaseURL: "https://ark.cn-beijing.volces.com/api/coding/v3",
+		EnvKey:         "ARK_API_KEY",
+		Enabled:        true,
+		Models: []Model{
+			{ID: "ark-coding-plan/doubao-seed-2.0-code", Name: "Doubao-Seed-2.0-Code"},
+			{ID: "ark-coding-plan/doubao-seed-code", Name: "Doubao-Seed-Code"},
+			{ID: "ark-coding-plan/kimi-k2.5", Name: "Kimi-K2.5"},
+			{ID: "ark-coding-plan/glm-4.7", Name: "GLM-4.7"},
+			{ID: "ark-coding-plan/deepseek-v3.2", Name: "DeepSeek-V3.2"},
+			{ID: "ark-coding-plan/kimi-k2-thinking", Name: "Kimi-K2-thinking"},
+		},
+	},
+	"zai": {
+		Key:            "zai",
+		DisplayName:    "Z.ai",
+		Sort:           40,
+		DefaultBaseURL: "https://open.bigmodel.cn/api/paas/v4",
+		EnvKey:         "ZAI_API_KEY",
+		Enabled:        true,
+		Models: []Model{
+			{ID: "zai/glm-5", Name: "GLM-5"},
+			{ID: "zai/glm-4.7", Name: "GLM-4.7"},
+			{ID: "zai/glm-4.7-flash", Name: "GLM-4.7-Flash"},
+			{ID: "zai/glm-4.7-flashx", Name: "GLM-4.7-FlashX"},
+		},
+	},
+	"minimax": {
+		Key:            "minimax",
+		DisplayName:    "MiniMax (CN)",
+		Sort:           45,
+		DefaultBaseURL: "https://api.minimaxi.com/anthropic",
+		EnvKey:         "MINIMAX_API_KEY",
+		Enabled:        true,
+		Models: []Model{
+			{ID: "minimax/MiniMax-M2.5", Name: "MiniMax M2.5"},
+			{ID: "minimax/MiniMax-M2.5-highspeed", Name: "MiniMax M2.5 highspeed"},
+		},
+	},
+	"kimi": {
+		Key:            "kimi",
+		DisplayName:    "Kimi (CN)",
+		Sort:           50,
+		DefaultBaseURL: "https://api.moonshot.cn/v1",
+		EnvKey:         "KIMI_API_KEY",
+		Enabled:        true,
+		Models: []Model{
+			{ID: "kimi/kimi-k2.5", Name: "Kimi K2.5"},
+			{ID: "kimi/kimi-k2-0905-preview", Name: "Kimi K2 0905 Preview"},
+			{ID: "kimi/kimi-k2-thinking", Name: "Kimi K2 Thinking"},
+		},
+	},
+	"kimi-coding": {
+		Key:            "kimi-coding",
+		DisplayName:    "Kimi Coding",
+		Sort:           51,
+		DefaultBaseURL: "https://api.kimi.com/coding/",
+		EnvKey:         "KIMI_API_KEY",
+		Enabled:        true,
+		Models: []Model{
+			{ID: "kimi-coding/k2p5", Name: "Kimi K2.5"},
+		},
+	},
+	"openai": {
+		Key:            "openai",
+		DisplayName:    "OpenAI",
+		Sort:           55,
+		DefaultBaseURL: "https://api.openai.com/v1",
+		EnvKey:         "OPENAI_API_KEY",
+		Enabled:        true,
+		Models: []Model{
+			{ID: "openai/codex-mini-latest", Name: "Codex Mini"},
+			{ID: "openai/gpt-4.1", Name: "GPT-4.1"},
+			{ID: "openai/gpt-4o", Name: "GPT-4o"},
+			{ID: "openai/gpt-4o-mini", Name: "GPT-4o Mini"},
+			{ID: "openai/gpt-5", Name: "GPT-5"},
+			{ID: "openai/gpt-5-mini", Name: "GPT-5 Mini"},
+		},
+	},
+	"openrouter": {
+		Key:            "openrouter",
+		DisplayName:    "OpenRouter",
+		Sort:           56,
+		DefaultBaseURL: "https://openrouter.ai/api/v1",
+		EnvKey:         "OPENROUTER_API_KEY",
+		Enabled:        true,
+		Models: []Model{
+			{ID: "openrouter/free", Name: "openrouter/free"},
+			{ID: "openrouter/auto", Name: "openrouter/auto"},
+		},
+	},
+	"anthropic": {
+		Key:            "anthropic",
+		DisplayName:    "Anthropic",
+		Sort:           60,
+		DefaultBaseURL: "https://api.anthropic.com",
+		EnvKey:         "ANTHROPIC_API_KEY",
+		Enabled:        true,
+		Models: []Model{
+			{ID: "anthropic/claude-3-haiku-20240307", Name: "Claude 3 Haiku"},
+			{ID: "anthropic/claude-3-5-haiku-latest", Name: "Claude 3.5 Haiku"},
+			{ID: "anthropic/claude-3-5-sonnet-20241022", Name: "Claude 3.5 Sonnet"},
+			{ID: "anthropic/claude-3-7-sonnet-20250219", Name: "Claude 3.7 Sonnet"},
+			{ID: "anthropic/claude-opus-4-1", Name: "Claude Opus 4.1"},
+		},
+	},
+	"gemini": {
+		Key:            "gemini",
+		DisplayName:    "Gemini",
+		Sort:           65,
+		DefaultBaseURL: "https://generativelanguage.googleapis.com",
+		EnvKey:         "GEMINI_API_KEY",
+		Enabled:        true,
+		Models: []Model{
+			{ID: "google/gemini-3-flash-preview", Name: "Gemini 3 Flash Preview"},
+			{ID: "google/gemini-flash-latest", Name: "Gemini Flash Latest"},
+			{ID: "google/gemini-3-pro-preview", Name: "Gemini 3 Pro Preview"},
+		},
+	},
+	"moonshot": {
+		Key:            "moonshot",
+		DisplayName:    "Moonshot (Global)",
+		Sort:           70,
+		DefaultBaseURL: "https://api.moonshot.ai/v1",
+		EnvKey:         "MOONSHOT_API_KEY",
+		Enabled:        true,
+		Models: []Model{
+			{ID: "moonshot/kimi-k2.5", Name: "Kimi K2.5"},
+			{ID: "moonshot/kimi-k2-0905-preview", Name: "Kimi K2 0905 Preview"},
+			{ID: "moonshot/kimi-k2-thinking", Name: "Kimi K2 Thinking"},
+		},
+	},
+}
+
+func Get(key string) (Meta, bool) {
+	meta, ok := catalog[strings.ToLower(strings.TrimSpace(key))]
+	if !ok {
+		return Meta{}, false
+	}
+	return cloneMeta(meta), true
+}
+
+func All() map[string]Meta {
+	result := make(map[string]Meta, len(catalog))
+	for key, meta := range catalog {
+		result[key] = cloneMeta(meta)
+	}
+	return result
+}
+
+func IsEnabled(key string) bool {
+	meta, ok := catalog[strings.ToLower(strings.TrimSpace(key))]
+	return ok && meta.Enabled
+}
+
+func DefaultBaseURL(key string) (string, bool) {
+	meta, ok := catalog[strings.ToLower(strings.TrimSpace(key))]
+	if !ok || strings.TrimSpace(meta.DefaultBaseURL) == "" {
+		return "", false
+	}
+	return meta.DefaultBaseURL, true
+}
+
+func EnvKey(key string) string {
+	meta, ok := catalog[strings.ToLower(strings.TrimSpace(key))]
+	if !ok {
+		return ""
+	}
+	return meta.EnvKey
+}
+
+func DisplayName(key string) string {
+	meta, ok := catalog[strings.ToLower(strings.TrimSpace(key))]
+	if !ok {
+		return key
+	}
+	if strings.TrimSpace(meta.DisplayName) == "" {
+		return key
+	}
+	return meta.DisplayName
+}
+
+func cloneMeta(meta Meta) Meta {
+	clone := meta
+	if len(meta.Models) > 0 {
+		clone.Models = make([]Model, len(meta.Models))
+		copy(clone.Models, meta.Models)
+	}
+	return clone
+}

agent/app/provider/openclaw.go

@@ -0,0 +1,339 @@
+package provider
+
+import (
+	"fmt"
+	"strings"
+)
+
+type OpenClawPatch struct {
+	PrimaryModel string
+	Models       map[string]interface{}
+}
+
+func BuildOpenClawPatch(provider, modelName, apiType string, maxTokens, contextWindow int, baseURL, apiKey string) (*OpenClawPatch, error) {
+	provider = strings.ToLower(strings.TrimSpace(provider))
+	modelName = strings.TrimSpace(modelName)
+	if modelName == "" {
+		return nil, fmt.Errorf("model is required")
+	}
+	modelID := modelName
+	if parts := strings.SplitN(modelName, "/", 2); len(parts) == 2 {
+		modelID = parts[1]
+	}
+
+	switch provider {
+	case "deepseek":
+		return buildDeepseekPatch(modelName, baseURL, apiKey), nil
+	case "gemini":
+		return buildGeminiPatch(modelName), nil
+	case "moonshot", "kimi":
+		return buildMoonshotPatch(provider, modelName, modelID, baseURL, apiKey), nil
+	case "bailian-coding-plan":
+		return buildBailianPatch(modelID, maxTokens, contextWindow, baseURL, apiKey), nil
+	case "ark-coding-plan":
+		return buildArkPatch(modelID, maxTokens, contextWindow, baseURL, apiKey), nil
+	case "minimax":
+		return buildMiniMaxPatch(modelID, baseURL, apiKey), nil
+	case "custom", "vllm":
+		return buildCustomPatch(provider, modelName, apiType, maxTokens, contextWindow, baseURL, apiKey), nil
+	case "ollama":
+		return buildOllamaPatch(modelName, modelID, apiType, baseURL), nil
+	case "kimi-coding":
+		return buildKimiCodingPatch(modelName, modelID, baseURL, apiKey), nil
+	case "zai":
+		return buildZaiPatch(modelID, maxTokens, contextWindow, baseURL, apiKey), nil
+	default:
+		return buildGenericPatch(provider, modelName, modelID, apiType, maxTokens, contextWindow, baseURL, apiKey), nil
+	}
+}
+
+func buildGeminiPatch(modelName string) *OpenClawPatch {
+	return &OpenClawPatch{PrimaryModel: modelName}
+}
+
+func buildDeepseekPatch(modelName, baseURL, apiKey string) *OpenClawPatch {
+	return &OpenClawPatch{
+		PrimaryModel: modelName,
+		Models: providerModels("deepseek", strings.TrimSpace(apiKey), firstNonEmpty(strings.TrimSpace(baseURL), "https://api.deepseek.com/v1"), "openai-completions", map[string]interface{}{
+			"id":            "deepseek-chat",
+			"name":          "DeepSeek Chat",
+			"reasoning":     false,
+			"input":         []string{"text"},
+			"contextWindow": 128000,
+			"maxTokens":     8192,
+			"cost":          map[string]interface{}{},
+		}),
+	}
+}
+
+func buildMoonshotPatch(provider, modelName, modelID, baseURL, apiKey string) *OpenClawPatch {
+	configProvider := provider
+	primaryModel := modelName
+	if provider == "kimi" {
+		configProvider = "moonshot"
+		primaryModel = "moonshot/" + modelID
+	}
+	return &OpenClawPatch{
+		PrimaryModel: primaryModel,
+		Models: providerModels(configProvider, strings.TrimSpace(apiKey), withCatalogDefault(provider, baseURL), "openai-completions", map[string]interface{}{
+			"id":            modelID,
+			"name":          modelID,
+			"reasoning":     strings.Contains(strings.ToLower(modelID), "thinking"),
+			"input":         []string{"text"},
+			"contextWindow": 256000,
+			"maxTokens":     8192,
+			"cost":          map[string]interface{}{},
+		}),
+	}
+}
+
+func buildBailianPatch(modelID string, maxTokens, contextWindow int, baseURL, apiKey string) *OpenClawPatch {
+	normalizedID := normalizeBailianCodingPlanModelID(modelID)
+	return &OpenClawPatch{
+		PrimaryModel: "bailian-coding-plan/" + bailianPrimaryModelID(normalizedID),
+		Models: providerModels("bailian-coding-plan", strings.TrimSpace(apiKey), withCatalogDefault("bailian-coding-plan", baseURL), "openai-completions", map[string]interface{}{
+			"id":            normalizedID,
+			"name":          normalizedID,
+			"reasoning":     isReasoningModel(normalizedID),
+			"input":         []string{"text"},
+			"contextWindow": fallbackInt(contextWindow, 256000),
+			"maxTokens":     fallbackInt(maxTokens, 8192),
+			"cost":          map[string]interface{}{},
+		}),
+	}
+}
+
+func buildArkPatch(modelID string, maxTokens, contextWindow int, baseURL, apiKey string) *OpenClawPatch {
+	normalizedID := normalizeArkCodingPlanModelID(modelID)
+	return &OpenClawPatch{
+		PrimaryModel: "ark-coding-plan/" + normalizedID,
+		Models: providerModels("ark-coding-plan", strings.TrimSpace(apiKey), withCatalogDefault("ark-coding-plan", baseURL), "openai-completions", map[string]interface{}{
+			"id":            normalizedID,
+			"name":          normalizedID,
+			"reasoning":     isReasoningModel(normalizedID),
+			"input":         []string{"text"},
+			"contextWindow": fallbackInt(contextWindow, 256000),
+			"maxTokens":     fallbackInt(maxTokens, 8192),
+			"cost":          map[string]interface{}{},
+		}),
+	}
+}
+
+func buildMiniMaxPatch(modelID, baseURL, apiKey string) *OpenClawPatch {
+	normalizedID := normalizeMiniMaxModelID(modelID)
+	return &OpenClawPatch{
+		PrimaryModel: "minimax-portal/" + normalizedID,
+		Models: providerModels("minimax-portal", strings.TrimSpace(apiKey), firstNonEmpty(strings.TrimSpace(baseURL), "https://api.minimaxi.com/anthropic"), "anthropic-messages", map[string]interface{}{
+			"id":            normalizedID,
+			"name":          strings.ReplaceAll(normalizedID, "-", " "),
+			"reasoning":     false,
+			"input":         []string{"text"},
+			"contextWindow": 200000,
+			"maxTokens":     8192,
+			"cost":          map[string]interface{}{},
+		}),
+	}
+}
+
+func buildCustomPatch(provider, modelName, apiType string, maxTokens, contextWindow int, baseURL, apiKey string) *OpenClawPatch {
+	customModelID := normalizeCustomModel(modelName)
+	return &OpenClawPatch{
+		PrimaryModel: provider + "/" + customModelID,
+		Models: providerModels(provider, strings.TrimSpace(apiKey), strings.TrimSpace(baseURL), apiType, map[string]interface{}{
+			"id":            customModelID,
+			"name":          customModelID,
+			"reasoning":     isReasoningModel(customModelID),
+			"input":         []string{"text"},
+			"contextWindow": fallbackInt(contextWindow, 128000),
+			"maxTokens":     fallbackInt(maxTokens, 8192),
+			"cost":          map[string]interface{}{},
+		}),
+	}
+}
+
+func buildOllamaPatch(modelName, modelID, apiType, baseURL string) *OpenClawPatch {
+	api := normalizeAPIType(apiType)
+	if api != "openai-completions" && api != "openai-responses" {
+		api = "openai-responses"
+	}
+	return &OpenClawPatch{
+		PrimaryModel: modelName,
+		Models: providerModels("ollama", "ollama", strings.TrimSpace(baseURL), api, map[string]interface{}{
+			"id":            modelID,
+			"name":          modelID,
+			"reasoning":     api != "openai-completions",
+			"input":         []string{"text"},
+			"contextWindow": 160000,
+			"maxTokens":     8192,
+			"cost":          map[string]interface{}{},
+		}),
+	}
+}
+
+func buildKimiCodingPatch(modelName, modelID, baseURL, apiKey string) *OpenClawPatch {
+	return &OpenClawPatch{
+		PrimaryModel: modelName,
+		Models: providerModels("kimi-coding", strings.TrimSpace(apiKey), withCatalogDefault("kimi-coding", baseURL), "anthropic-messages", map[string]interface{}{
+			"id":            modelID,
+			"name":          "Kimi for Coding",
+			"reasoning":     true,
+			"input":         []string{"text", "image"},
+			"contextWindow": 262144,
+			"maxTokens":     32768,
+			"cost":          map[string]interface{}{},
+		}),
+	}
+}
+
+func buildZaiPatch(modelID string, maxTokens, contextWindow int, baseURL, apiKey string) *OpenClawPatch {
+	return &OpenClawPatch{
+		PrimaryModel: "zai/" + modelID,
+		Models: providerModels("zai", strings.TrimSpace(apiKey), withCatalogDefault("zai", baseURL), "openai-completions", map[string]interface{}{
+			"id":            modelID,
+			"name":          zaiModelDisplayName(modelID),
+			"reasoning":     modelID == "glm-5",
+			"input":         []string{"text"},
+			"contextWindow": fallbackInt(contextWindow, 204800),
+			"maxTokens":     fallbackInt(maxTokens, 131072),
+			"cost":          map[string]interface{}{},
+		}),
+	}
+}
+
+func buildGenericPatch(provider, modelName, modelID, apiType string, maxTokens, contextWindow int, baseURL, apiKey string) *OpenClawPatch {
+	providerName := provider
+	primaryModel := modelName
+	if provider == "gemini" {
+		providerName = "google"
+		primaryModel = "google/" + modelID
+	}
+	return &OpenClawPatch{
+		PrimaryModel: primaryModel,
+		Models: providerModels(providerName, strings.TrimSpace(apiKey), withCatalogDefault(provider, baseURL), normalizeAPIType(apiType), map[string]interface{}{
+			"id":            modelID,
+			"name":          modelID,
+			"reasoning":     isReasoningModel(modelID),
+			"input":         []string{"text"},
+			"contextWindow": fallbackInt(contextWindow, 256000),
+			"maxTokens":     fallbackInt(maxTokens, 8192),
+			"cost":          map[string]interface{}{},
+		}),
+	}
+}
+
+func providerModels(provider, apiKey, baseURL, api string, model map[string]interface{}) map[string]interface{} {
+	return map[string]interface{}{
+		"mode": "merge",
+		"providers": map[string]interface{}{
+			provider: map[string]interface{}{
+				"apiKey":  apiKey,
+				"baseUrl": baseURL,
+				"api":     api,
+				"models":  []map[string]interface{}{model},
+			},
+		},
+	}
+}
+
+func withCatalogDefault(provider, baseURL string) string {
+	if strings.TrimSpace(baseURL) != "" {
+		return strings.TrimSpace(baseURL)
+	}
+	if defaultURL, ok := DefaultBaseURL(provider); ok {
+		return defaultURL
+	}
+	return ""
+}
+
+func firstNonEmpty(values ...string) string {
+	for _, value := range values {
+		if strings.TrimSpace(value) != "" {
+			return strings.TrimSpace(value)
+		}
+	}
+	return ""
+}
+
+func fallbackInt(value, fallback int) int {
+	if value > 0 {
+		return value
+	}
+	return fallback
+}
+
+func normalizeAPIType(apiType string) string {
+	trim := strings.ToLower(strings.TrimSpace(apiType))
+	if trim == "" {
+		return "openai-completions"
+	}
+	return trim
+}
+
+func normalizeCustomModel(modelName string) string {
+	trim := strings.TrimSpace(modelName)
+	trim = strings.TrimLeft(trim, "/")
+	if parts := strings.SplitN(trim, "/", 2); len(parts) == 2 && strings.EqualFold(parts[0], "custom") {
+		return strings.TrimLeft(strings.TrimSpace(parts[1]), "/")
+	}
+	return trim
+}
+
+func normalizeBailianCodingPlanModelID(modelID string) string {
+	trim := strings.TrimSpace(modelID)
+	switch strings.ToLower(trim) {
+	case "minimax-m2.5", "minimax m2.5", "minimax/minimax-m2.5", "minimax/minimax m2.5":
+		return "MiniMax/MiniMax-M2.5"
+	default:
+		return trim
+	}
+}
+
+func normalizeArkCodingPlanModelID(modelID string) string {
+	return strings.ToLower(strings.TrimSpace(modelID))
+}
+
+func normalizeMiniMaxModelID(modelID string) string {
+	switch strings.ToLower(strings.TrimSpace(modelID)) {
+	case "minimax-m2.1", "minimax m2.1", "minimax-m2.1-preview", "minimax-m2.1-latest":
+		return "MiniMax-M2.1"
+	case "minimax-m2.1-lightning", "minimax m2.1 lightning":
+		return "MiniMax-M2.1-lightning"
+	default:
+		return modelID
+	}
+}
+
+func zaiModelDisplayName(modelID string) string {
+	switch strings.ToLower(strings.TrimSpace(modelID)) {
+	case "glm-5":
+		return "GLM-5"
+	case "glm-4.7":
+		return "GLM-4.7"
+	case "glm-4.7-flash":
+		return "GLM-4.7-Flash"
+	case "glm-4.7-flashx":
+		return "GLM-4.7-FlashX"
+	default:
+		return strings.TrimSpace(modelID)
+	}
+}
+
+func bailianPrimaryModelID(modelID string) string {
+	trim := strings.TrimSpace(modelID)
+	if trim == "" {
+		return ""
+	}
+	parts := strings.Split(trim, "/")
+	for i := len(parts) - 1; i >= 0; i-- {
+		part := strings.TrimSpace(parts[i])
+		if part != "" {
+			return part
+		}
+	}
+	return trim
+}
+
+func isReasoningModel(modelID string) bool {
+	trim := strings.ToLower(strings.TrimSpace(modelID))
+	return strings.Contains(trim, "reason") || strings.Contains(trim, "thinking")
+}

agent/app/provider/verify.go

@@ -0,0 +1,146 @@
+package provider
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+)
+
+type VerifyRequest struct {
+	Method  string
+	URL     string
+	Headers map[string]string
+	Body    []byte
+}
+
+func SkipVerification(key string) bool {
+	switch strings.ToLower(strings.TrimSpace(key)) {
+	case "custom", "vllm", "ollama", "kimi-coding":
+		return true
+	default:
+		return false
+	}
+}
+
+func VerifyAccount(provider, baseURL, apiKey string) error {
+	req := BuildVerifyRequest(provider, baseURL, apiKey)
+	var body *bytes.Buffer
+	if len(req.Body) > 0 {
+		body = bytes.NewBuffer(req.Body)
+	} else {
+		body = bytes.NewBuffer(nil)
+	}
+	httpReq, err := http.NewRequest(req.Method, req.URL, body)
+	if err != nil {
+		return err
+	}
+	for key, value := range req.Headers {
+		httpReq.Header.Set(key, value)
+	}
+	resp, err := (&http.Client{Timeout: 10 * time.Second}).Do(httpReq)
+	if err != nil {
+		return buserr.WithErr("ErrAgentAccountUnavailable", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 400 {
+		return buserr.WithErr("ErrAgentAccountUnavailable", fmt.Errorf("verify failed: %s", resp.Status))
+	}
+	return nil
+}
+
+func BuildVerifyRequest(provider, baseURL, apiKey string) VerifyRequest {
+	provider = strings.ToLower(strings.TrimSpace(provider))
+	base := strings.TrimRight(strings.TrimSpace(baseURL), "/")
+	headers := map[string]string{}
+	request := VerifyRequest{Method: http.MethodGet, Headers: headers}
+
+	switch provider {
+	case "anthropic", "kimi-coding":
+		headers["x-api-key"] = apiKey
+		headers["anthropic-version"] = "2023-06-01"
+		if strings.Contains(base, "/v1") {
+			request.URL = base + "/models"
+		} else {
+			request.URL = base + "/v1/models"
+		}
+	case "gemini":
+		request.Method = http.MethodPost
+		if strings.Contains(base, "/v1beta") {
+			request.URL = base + "/models/gemini-3-flash-preview:generateContent"
+		} else {
+			request.URL = base + "/v1beta/models/gemini-3-flash-preview:generateContent"
+		}
+		headers["x-goog-api-key"] = apiKey
+		headers["Content-Type"] = "application/json"
+		request.Body = mustJSON(map[string]interface{}{
+			"contents": []map[string]interface{}{{
+				"parts": []map[string]string{{
+					"text": "Explain how AI works in a few words",
+				}},
+			}},
+		})
+	case "zai":
+		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
+		request.URL = base + "/models"
+	case "bailian-coding-plan":
+		request.Method = http.MethodPost
+		if !strings.Contains(base, "/v1") {
+			base = base + "/v1"
+		}
+		request.URL = base + "/chat/completions"
+		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
+		headers["Content-Type"] = "application/json"
+		request.Body = mustJSON(map[string]interface{}{
+			"model":      "qwen3.5-plus",
+			"messages":   []map[string]string{{"role": "user", "content": "test"}},
+			"max_tokens": 1,
+		})
+	case "ark-coding-plan":
+		request.Method = http.MethodPost
+		if !strings.Contains(base, "/api/coding/v3") {
+			base = "https://ark.cn-beijing.volces.com/api/coding/v3"
+		}
+		request.URL = base + "/chat/completions"
+		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
+		headers["Content-Type"] = "application/json"
+		request.Body = mustJSON(map[string]interface{}{
+			"model":      "doubao-seed-2.0-code",
+			"messages":   []map[string]string{{"role": "user", "content": "test"}},
+			"max_tokens": 1,
+		})
+	case "minimax":
+		request.Method = http.MethodPost
+		if !strings.Contains(base, "/v1") {
+			base = base + "/v1"
+		}
+		request.URL = base + "/chat/completions"
+		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
+		headers["Content-Type"] = "application/json"
+		request.Body = mustJSON(map[string]interface{}{
+			"model":      "MiniMax-M2.1",
+			"messages":   []map[string]string{{"role": "user", "content": "test"}},
+			"max_tokens": 1,
+		})
+	default:
+		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
+		if strings.Contains(base, "/v1") {
+			request.URL = base + "/models"
+		} else {
+			request.URL = base + "/v1/models"
+		}
+	}
+	return request
+}
+
+func mustJSON(value interface{}) []byte {
+	payload, err := json.Marshal(value)
+	if err != nil {
+		return []byte("{}")
+	}
+	return payload
+}

agent/app/repo/agent.go

@@ -0,0 +1,75 @@
+package repo
+
+import (
+	"context"
+
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+)
+
+type AgentRepo struct{}
+
+type IAgentRepo interface {
+	Page(page, size int, opts ...DBOption) (int64, []model.Agent, error)
+	GetFirst(opts ...DBOption) (*model.Agent, error)
+	Create(agent *model.Agent) error
+	Save(agent *model.Agent) error
+	DeleteByID(id uint) error
+	DeleteByAppInstallID(appInstallID uint) error
+	DeleteByAppInstallIDWithCtx(ctx context.Context, appInstallID uint) error
+	List(opts ...DBOption) ([]model.Agent, error)
+}
+
+func NewIAgentRepo() IAgentRepo {
+	return &AgentRepo{}
+}
+
+func (a AgentRepo) Page(page, size int, opts ...DBOption) (int64, []model.Agent, error) {
+	var agents []model.Agent
+	db := getDb(opts...).Model(&model.Agent{})
+	count := int64(0)
+	db = db.Count(&count)
+	err := db.Limit(size).Offset(size * (page - 1)).Find(&agents).Error
+	return count, agents, err
+}
+
+func (a AgentRepo) GetFirst(opts ...DBOption) (*model.Agent, error) {
+	var agent model.Agent
+	if err := getDb(opts...).First(&agent).Error; err != nil {
+		return nil, err
+	}
+	return &agent, nil
+}
+
+func (a AgentRepo) Create(agent *model.Agent) error {
+	return getDb().Create(agent).Error
+}
+
+func (a AgentRepo) Save(agent *model.Agent) error {
+	return getDb().Save(agent).Error
+}
+
+func (a AgentRepo) DeleteByID(id uint) error {
+	return getDb().Delete(&model.Agent{}, id).Error
+}
+
+func (a AgentRepo) DeleteByAppInstallID(appInstallID uint) error {
+	if appInstallID == 0 {
+		return nil
+	}
+	return getDb().Where("app_install_id = ?", appInstallID).Delete(&model.Agent{}).Error
+}
+
+func (a AgentRepo) DeleteByAppInstallIDWithCtx(ctx context.Context, appInstallID uint) error {
+	if appInstallID == 0 {
+		return nil
+	}
+	return getTx(ctx).Where("app_install_id = ?", appInstallID).Delete(&model.Agent{}).Error
+}
+
+func (a AgentRepo) List(opts ...DBOption) ([]model.Agent, error) {
+	var agents []model.Agent
+	if err := getDb(opts...).Find(&agents).Error; err != nil {
+		return nil, err
+	}
+	return agents, nil
+}

agent/app/repo/agent_account.go

@@ -0,0 +1,55 @@
+package repo
+
+import "github.com/1Panel-dev/1Panel/agent/app/model"
+
+type AgentAccountRepo struct{}
+
+type IAgentAccountRepo interface {
+	Page(page, size int, opts ...DBOption) (int64, []model.AgentAccount, error)
+	GetFirst(opts ...DBOption) (*model.AgentAccount, error)
+	Create(account *model.AgentAccount) error
+	Save(account *model.AgentAccount) error
+	DeleteByID(id uint) error
+	List(opts ...DBOption) ([]model.AgentAccount, error)
+}
+
+func NewIAgentAccountRepo() IAgentAccountRepo {
+	return &AgentAccountRepo{}
+}
+
+func (a AgentAccountRepo) Page(page, size int, opts ...DBOption) (int64, []model.AgentAccount, error) {
+	var accounts []model.AgentAccount
+	db := getDb(opts...).Model(&model.AgentAccount{})
+	count := int64(0)
+	db = db.Count(&count)
+	err := db.Limit(size).Offset(size * (page - 1)).Find(&accounts).Error
+	return count, accounts, err
+}
+
+func (a AgentAccountRepo) GetFirst(opts ...DBOption) (*model.AgentAccount, error) {
+	var account model.AgentAccount
+	if err := getDb(opts...).First(&account).Error; err != nil {
+		return nil, err
+	}
+	return &account, nil
+}
+
+func (a AgentAccountRepo) Create(account *model.AgentAccount) error {
+	return getDb().Create(account).Error
+}
+
+func (a AgentAccountRepo) Save(account *model.AgentAccount) error {
+	return getDb().Save(account).Error
+}
+
+func (a AgentAccountRepo) DeleteByID(id uint) error {
+	return getDb().Delete(&model.AgentAccount{}, id).Error
+}
+
+func (a AgentAccountRepo) List(opts ...DBOption) ([]model.AgentAccount, error) {
+	var accounts []model.AgentAccount
+	if err := getDb(opts...).Find(&accounts).Error; err != nil {
+		return nil, err
+	}
+	return accounts, nil
+}

agent/app/repo/app.go

@@ -20,6 +20,7 @@ type IAppRepo interface {
 	WithResource(resource string) DBOption
 	WithNotLocal() DBOption
 	WithByLikeName(name string) DBOption
+	WithKeyIn(keys []string) DBOption
 	WithArch(arch string) DBOption
 	WithPanelVersion(panelVersion string) DBOption
 
@@ -55,6 +56,12 @@ func (a AppRepo) WithKey(key string) DBOption {
 	}
 }
 
+func (a AppRepo) WithKeyIn(keys []string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("`key` in (?)", keys)
+	}
+}
+
 func (a AppRepo) WithType(typeStr string) DBOption {
 	return func(g *gorm.DB) *gorm.DB {
 		return g.Where("type = ?", typeStr)

agent/app/repo/app_launcher.go

@@ -80,9 +80,10 @@ func (u *LauncherRepo) ListQuickJump(withAll bool) []model.QuickJump {
 	}
 	if !withAll && len(quicks) == 0 {
 		return []model.QuickJump{
+			{Name: "Agent", Title: "aiTools.agents.agents", Recommend: 1, IsShow: true, Router: "/ai/agents/agent"},
 			{Name: "Website", Title: "menu.website", Recommend: 10, IsShow: true, Router: "/websites"},
 			{Name: "Database", Title: "menu.database", Recommend: 30, IsShow: true, Router: "/databases"},
-			{Name: "Cronjob", Title: "menu.cronjob", Recommend: 50, IsShow: true, Router: "/cronjobs"},
+			{Name: "Cronjob", Title: "menu.cronjob", Recommend: 50, IsShow: false, Router: "/cronjobs"},
 			{Name: "AppInstalled", Title: "home.appInstalled", Recommend: 70, IsShow: true, Router: "/apps/installed"},
 		}
 	}

agent/app/repo/common.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/utils/re"
 	"gorm.io/gorm"
 )
 
@@ -72,6 +73,33 @@ func WithByDetailName(detailName string) DBOption {
 	}
 }
 
+func WithByProvider(provider string) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		if len(provider) == 0 {
+			return g
+		}
+		return g.Where("provider = ?", provider)
+	}
+}
+
+func WithByModel(model string) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		if len(model) == 0 {
+			return g
+		}
+		return g.Where("model = ?", model)
+	}
+}
+
+func WithByAccountID(accountID uint) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		if accountID == 0 {
+			return g
+		}
+		return g.Where("account_id = ?", accountID)
+	}
+}
+
 func WithByType(tp string) DBOption {
 	return func(g *gorm.DB) *gorm.DB {
 		return g.Where("`type` = ?", tp)
@@ -124,23 +152,30 @@ func WithByCreatedAt(startTime, endTime time.Time) DBOption {
 	}
 }
 
-func WithOrderBy(orderStr string) DBOption {
-	if orderStr == "createdAt" {
-		orderStr = "created_at"
-	}
-	return func(g *gorm.DB) *gorm.DB {
-		return g.Order(orderStr)
-	}
+func WithOrderDesc(orderBy string) DBOption {
+	return WithOrderRuleBy(orderBy, constant.Desc)
 }
+
+func WithOrderAsc(orderBy string) DBOption {
+	return WithOrderRuleBy(orderBy, constant.Asc)
+}
+
 func WithOrderRuleBy(orderBy, order string) DBOption {
 	if orderBy == "createdAt" {
 		orderBy = "created_at"
 	}
+	if !re.GetRegex(re.OrderByValidationPattern).MatchString(orderBy) {
+		orderBy = "created_at"
+	}
 	switch order {
 	case constant.OrderDesc:
 		order = "desc"
 	case constant.OrderAsc:
 		order = "asc"
+	case constant.Desc:
+		order = "desc"
+	case constant.Asc:
+		order = "asc"
 	default:
 		orderBy = "created_at"
 		order = "desc"

agent/app/service/alert.go

@@ -15,6 +15,7 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/utils/email"
 	"github.com/1Panel-dev/1Panel/agent/utils/xpack"
 	"github.com/shirou/gopsutil/v4/disk"
+	"mime"
 	"sort"
 	"strings"
 	"sync"
@@ -60,7 +61,7 @@ func (a AlertService) PageAlert(search dto.AlertSearch) (int64, []dto.AlertDTO,
 	if search.Type != "" {
 		opts = append(opts, alertRepo.WithByType(search.Type))
 	}
-	opts = append(opts, repo.WithOrderBy("created_at desc"))
+	opts = append(opts, repo.WithOrderDesc("created_at"))
 
 	total, alerts, err := alertRepo.Page(search.Page, search.PageSize, opts...)
 	if err != nil {
@@ -343,7 +344,7 @@ func (a AlertService) PageAlertLogs(search dto.AlertLogSearch) (int64, []dto.Ale
 	if search.Count != 0 {
 		opts = append(opts, alertRepo.WithByCount(search.Count))
 	}
-	opts = append(opts, repo.WithOrderBy("created_at desc"))
+	opts = append(opts, repo.WithOrderDesc("created_at"))
 
 	total, alerts, err := alertRepo.PageLog(search.Page, search.PageSize, opts...)
 	if err != nil {
@@ -483,13 +484,14 @@ func (a AlertService) TestAlertConfig(req dto.AlertConfigTest) (bool, error) {
 	if username == "" {
 		username = req.Sender
 	}
+	encodedDisplayName := mime.BEncoding.Encode("UTF-8", req.DisplayName)
 	cfg := email.SMTPConfig{
 		Host:       req.Host,
 		Port:       req.Port,
 		Sender:     req.Sender,
 		Username:   username,
 		Password:   req.Password,
-		From:       fmt.Sprintf(`"%s" <%s>`, req.DisplayName, req.Sender),
+		From:       fmt.Sprintf(`"%s" <%s>`, encodedDisplayName, req.Sender),
 		Encryption: req.Encryption,
 		Recipient:  req.Recipient,
 	}

agent/app/service/alert_helper.go

@@ -2,6 +2,13 @@ package service
 
 import (
 	"encoding/json"
+	"fmt"
+	"math"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/model"
 	"github.com/1Panel-dev/1Panel/agent/app/repo"
@@ -17,11 +24,6 @@ import (
 	"github.com/shirou/gopsutil/v4/load"
 	"github.com/shirou/gopsutil/v4/mem"
 	"github.com/shirou/gopsutil/v4/net"
-	"math"
-	"sort"
-	"strconv"
-	"strings"
-	"time"
 )
 
 const (
@@ -110,7 +112,7 @@ func (m *AlertTaskHelper) getClassifiedAlerts() (baseAlerts, resourceAlerts []dt
 
 func handleBaseAlerts(baseAlerts []dto.AlertDTO) {
 	if len(baseAlerts) == 0 {
-		stopResourceJob()
+		stopBaseJob()
 		return
 	}
 	if global.AlertBaseJobID == 0 {
@@ -227,11 +229,30 @@ func loadSSLInfo(alert dto.AlertDTO) {
 		return
 	}
 	sender := NewAlertSender(alert, projectJSON)
+	minDays := math.MaxInt
+	maxDays := 0
+	allDomains := make([]string, 0)
 	for daysDiff, domains := range daysDiffMap {
-		domainStr := strings.Join(domains, ",")
-		params := createAlertBaseParams(strconv.Itoa(len(domains)), strconv.Itoa(daysDiff))
-		sender.Send(domainStr, params)
+		allDomains = append(allDomains, domains...)
+		if daysDiff < minDays {
+			minDays = daysDiff
+		}
+		if daysDiff > maxDays {
+			maxDays = daysDiff
+		}
 	}
+	if len(allDomains) == 0 {
+		return
+	}
+	var daysStr string
+	if len(allDomains) == 1 {
+		daysStr = strconv.Itoa(minDays)
+	} else {
+		daysStr = strconv.Itoa(minDays) + "-" + strconv.Itoa(maxDays)
+	}
+	domainStr := strings.Join(allDomains, ",")
+	params := createAlertBaseParams(strconv.Itoa(len(daysDiffMap)), daysStr)
+	sender.Send(domainStr, params)
 }
 
 func loadWebsiteInfo(alert dto.AlertDTO) {
@@ -247,11 +268,30 @@ func loadWebsiteInfo(alert dto.AlertDTO) {
 		return
 	}
 	sender := NewAlertSender(alert, projectJSON)
+	minDays := math.MaxInt
+	maxDays := 0
+	allDomains := make([]string, 0)
 	for daysDiff, domains := range daysDiffMap {
-		domainStr := strings.Join(domains, ",")
-		params := createAlertBaseParams(strconv.Itoa(len(domains)), strconv.Itoa(daysDiff))
-		sender.Send(domainStr, params)
+		allDomains = append(allDomains, domains...)
+		if daysDiff < minDays {
+			minDays = daysDiff
+		}
+		if daysDiff > maxDays {
+			maxDays = daysDiff
+		}
 	}
+	if len(allDomains) == 0 {
+		return
+	}
+	var daysStr string
+	if len(allDomains) == 1 {
+		daysStr = strconv.Itoa(minDays)
+	} else {
+		daysStr = strconv.Itoa(minDays) + "-" + strconv.Itoa(maxDays)
+	}
+	domainStr := strings.Join(allDomains, ",")
+	params := createAlertBaseParams(strconv.Itoa(len(daysDiffMap)), daysStr)
+	sender.Send(domainStr, params)
 }
 
 func loadPanelPwd(alert dto.AlertDTO) {
@@ -384,25 +424,19 @@ func loadDiskUsage(alert dto.AlertDTO) {
 	}
 	if isAlertDue(newDate) {
 		if strings.Contains(alert.Project, "all") {
-			err = processAllDisks(alert)
+			_ = processAllDisks(alert)
 		} else {
-			err = processSingleDisk(alert)
+			_ = processSingleDisk(alert)
 		}
 	}
 }
 
 func loadPanelLogin(alert dto.AlertDTO) {
 	count, isAlert, err := alertUtil.CountRecentFailedLoginLogs(alert.Cycle, alert.Count)
-	alertType := alert.Type
-	quota := strconv.Itoa(count)
-	quotaType := strconv.Itoa(int(alert.Cycle))
 	if err != nil {
 		global.LOG.Errorf("Failed to count recent failed login logs: %v", err)
 	}
 	if isAlert {
-		alertType = "panelLogin"
-		quota = strconv.Itoa(count)
-		quotaType = "panelLogin"
 		params := []dto.Param{
 			{
 				Index: "1",
@@ -415,7 +449,7 @@ func loadPanelLogin(alert dto.AlertDTO) {
 				Value: "",
 			},
 		}
-		sendAlerts(alert, alertType, quota, quotaType, params)
+		sendAlerts(alert, "panelLogin", strconv.Itoa(count), "panelLogin", params)
 	}
 
 	whitelist := strings.Split(strings.TrimSpace(alert.AdvancedParams), "\n")
@@ -424,15 +458,13 @@ func loadPanelLogin(alert dto.AlertDTO) {
 		global.LOG.Errorf("Failed to check recent failed ip login logs: %v", err)
 	}
 	if len(records) > 0 {
-		quota = strings.Join(func() []string {
+		quota := strings.Join(func() []string {
 			var ips []string
 			for _, r := range records {
 				ips = append(ips, r.IP)
 			}
 			return ips
 		}(), "\n")
-		alertType = "panelIpLogin"
-		quotaType = "panelIpLogin"
 		params := []dto.Param{
 			{
 				Index: "1",
@@ -445,22 +477,16 @@ func loadPanelLogin(alert dto.AlertDTO) {
 				Value: " IP ",
 			},
 		}
-		sendAlerts(alert, alertType, quota, quotaType, params)
+		sendAlerts(alert, "panelIpLogin", quota, "panelIpLogin", params)
 	}
 }
 
 func loadSSHLogin(alert dto.AlertDTO) {
 	count, isAlert, err := alertUtil.CountRecentFailedSSHLog(alert.Cycle, alert.Count)
-	alertType := alert.Type
-	quota := strconv.Itoa(count)
-	quotaType := strconv.Itoa(int(alert.Cycle))
 	if err != nil {
 		global.LOG.Errorf("Failed to count recent failed ssh login logs: %v", err)
 	}
 	if isAlert {
-		alertType = "sshLogin"
-		quota = strconv.Itoa(count)
-		quotaType = "sshLogin"
 		params := []dto.Param{
 			{
 				Index: "1",
@@ -473,7 +499,7 @@ func loadSSHLogin(alert dto.AlertDTO) {
 				Value: "",
 			},
 		}
-		sendAlerts(alert, alertType, quota, quotaType, params)
+		sendAlerts(alert, "sshLogin", strconv.Itoa(count), "sshLogin", params)
 	}
 	whitelist := strings.Split(strings.TrimSpace(alert.AdvancedParams), "\n")
 	records, err := alertUtil.FindRecentSuccessLoginNotInWhitelist(30, whitelist)
@@ -481,9 +507,7 @@ func loadSSHLogin(alert dto.AlertDTO) {
 		global.LOG.Errorf("Failed to check recent failed ip ssh login logs: %v", err)
 	}
 	if len(records) > 0 {
-		quota = strings.Join(records, "\n")
-		alertType = "sshIpLogin"
-		quotaType = "sshIpLogin"
+		quota := strings.Join(records, "\n")
 		params := []dto.Param{
 			{
 				Index: "1",
@@ -496,7 +520,7 @@ func loadSSHLogin(alert dto.AlertDTO) {
 				Value: " IP ",
 			},
 		}
-		sendAlerts(alert, alertType, quota, quotaType, params)
+		sendAlerts(alert, "sshIpLogin", quota, "sshIpLogin", params)
 	}
 }
 
@@ -586,8 +610,6 @@ func sendAlerts(alert dto.AlertDTO, alertType, quota, quotaType string, params [
 					continue
 				}
 				alertUtil.CreateNewAlertTask(quota, alertType, quotaType, constant.SMS)
-				global.LOG.Infof("%s alert sms push successful", alertType)
-
 			case constant.Email:
 				todayCount, isValid := canSendAlertToday(alertType, quotaType, alert.SendCount, constant.Email)
 				if !isValid {
@@ -610,7 +632,25 @@ func sendAlerts(alert dto.AlertDTO, alertType, quota, quotaType string, params [
 					continue
 				}
 				alertUtil.CreateNewAlertTask(quota, alertType, quotaType, constant.Email)
-				global.LOG.Infof("%s alert email push successful", alertType)
+			case constant.WeCom, constant.DingTalk, constant.FeiShu:
+				todayCount, isValid := canSendAlertToday(alertType, quotaType, alert.SendCount, m)
+				if !isValid {
+					continue
+				}
+				var create = dto.AlertLogCreate{
+					Type:    alertUtil.GetCronJobType(alert.Type),
+					AlertId: alert.ID,
+					Count:   todayCount + 1,
+				}
+				transport := xpack.LoadRequestTransport()
+				agentInfo, _ := xpack.GetAgentInfo()
+				err := xpack.CreateWebhookAlertLog(alertType, alert, create, quotaType, params, m, transport, agentInfo)
+				if err != nil {
+					global.LOG.Infof("%s alert webhook %s push faild, err: %v", alertType, m, err)
+					continue
+				}
+				alertUtil.CreateNewAlertTask(quota, alertType, quotaType, m)
+			default:
 			}
 		}
 	}
@@ -650,7 +690,9 @@ func calculateSSLExpiryDays(sslList []model.WebsiteSSL, cycle uint) (map[int][]s
 	projectMap := make(map[uint][]time.Time)
 
 	for _, ssl := range sslList {
-		daysDiff := int(ssl.ExpireDate.Sub(currentDate).Hours() / 24)
+		daysDiff := int(math.Ceil(
+			ssl.ExpireDate.Sub(currentDate).Hours() / 24,
+		))
 		if daysDiff > 0 && int(cycle) >= daysDiff {
 			daysDiffMap[daysDiff] = append(daysDiffMap[daysDiff], ssl.PrimaryDomain)
 			projectMap[ssl.ID] = append(projectMap[ssl.ID], ssl.ExpireDate)
@@ -665,7 +707,9 @@ func calculateWebsiteExpiryDays(websites []model.Website, cycle uint) (map[int][
 	projectMap := make(map[uint][]time.Time)
 
 	for _, website := range websites {
-		daysDiff := int(website.ExpireDate.Sub(currentDate).Hours() / 24)
+		daysDiff := int(math.Ceil(
+			website.ExpireDate.Sub(currentDate).Hours() / 24,
+		))
 		if daysDiff > 0 && int(cycle) >= daysDiff {
 			daysDiffMap[daysDiff] = append(daysDiffMap[daysDiff], website.PrimaryDomain)
 			projectMap[website.ID] = append(projectMap[website.ID], website.ExpireDate)
@@ -829,30 +873,36 @@ func processAllDisks(alert dto.AlertDTO) error {
 		global.LOG.Errorf("error getting disk list, err: %v", err)
 		return err
 	}
+	var errMsgs []string
 	for _, item := range diskList {
-		if success, err := checkAndCreateDiskAlert(alert, item.Path); err == nil && success {
-			global.LOG.Infof("disk alert pushed successfully for %s", item.Path)
+		err := checkAndCreateDiskAlert(alert, item.Path)
+		if err != nil {
+			errMsg := fmt.Sprintf("disk path %s process failed: %v", item.Path, err)
+			errMsgs = append(errMsgs, errMsg)
+			global.LOG.Errorf("%s", errMsg)
+			continue
 		}
 	}
+	if len(errMsgs) > 0 {
+		return fmt.Errorf("batch process disks failed, error count: %d, details: %s", len(errMsgs), strings.Join(errMsgs, "; "))
+	}
 	return nil
 }
 
 func processSingleDisk(alert dto.AlertDTO) error {
-	success, err := checkAndCreateDiskAlert(alert, alert.Project)
+	err := checkAndCreateDiskAlert(alert, alert.Project)
 	if err != nil {
+		global.LOG.Errorf("%s", err.Error())
 		return err
 	}
-	if success {
-		global.LOG.Infof("disk alert pushed successfully for %s", alert.Project)
-	}
 	return nil
 }
 
-func checkAndCreateDiskAlert(alert dto.AlertDTO, path string) (bool, error) {
+func checkAndCreateDiskAlert(alert dto.AlertDTO, path string) error {
 	usageStat, err := psutil.DISK.GetUsage(path, false)
 	if err != nil {
 		global.LOG.Errorf("error getting disk usage for %s, err: %v", path, err)
-		return false, err
+		return err
 	}
 
 	usedTotal, usedStr := calculateUsedTotal(alert.Cycle, usageStat)
@@ -861,13 +911,12 @@ func checkAndCreateDiskAlert(alert dto.AlertDTO, path string) (bool, error) {
 		commonTotal *= 1024 * 1024 * 1024
 	}
 	if usedTotal < commonTotal {
-		return false, nil
+		return nil
 	}
-	global.LOG.Infof("disk「 %s 」usage: %s", path, usedStr)
 	params := createAlertDiskParams(path, usedStr)
 	sender := NewAlertSender(alert, alert.Project)
 	sender.ResourceSend(path, params)
-	return true, nil
+	return nil
 }
 
 func calculateUsedTotal(cycle uint, usageStat *disk.UsageStat) (float64, string) {

agent/app/service/alert_sender.go

@@ -30,6 +30,8 @@ func (s *AlertSender) Send(quota string, params []dto.Param) {
 			s.sendSMS(quota, params)
 		case constant.Email:
 			s.sendEmail(quota, params)
+		case constant.WeCom, constant.DingTalk, constant.FeiShu:
+			s.sendWebhook(quota, params, method)
 		}
 	}
 }
@@ -43,6 +45,8 @@ func (s *AlertSender) ResourceSend(quota string, params []dto.Param) {
 			s.sendResourceSMS(quota, params)
 		case constant.Email:
 			s.sendResourceEmail(quota, params)
+		case constant.WeCom, constant.DingTalk, constant.FeiShu:
+			s.sendResourceWebhook(quota, params, method)
 		}
 	}
 }
@@ -64,9 +68,12 @@ func (s *AlertSender) sendSMS(quota string, params []dto.Param) {
 		Type:    s.alert.Type,
 	}
 
-	_ = xpack.CreateSMSAlertLog(s.alert.Type, s.alert, create, quota, params, constant.SMS)
+	err := xpack.CreateSMSAlertLog(s.alert.Type, s.alert, create, quota, params, constant.SMS)
+	if err != nil {
+		global.LOG.Errorf("%s alert sms push failed: %v", s.alert.Type, err)
+		return
+	}
 	alertUtil.CreateNewAlertTask(quota, s.alert.Type, s.quotaType, constant.SMS)
-	global.LOG.Infof("%s alert sms push successful", s.alert.Type)
 }
 
 func (s *AlertSender) sendEmail(quota string, params []dto.Param) {
@@ -86,9 +93,34 @@ func (s *AlertSender) sendEmail(quota string, params []dto.Param) {
 
 	transport := xpack.LoadRequestTransport()
 	agentInfo, _ := xpack.GetAgentInfo()
-	_ = alertUtil.CreateEmailAlertLog(create, s.alert, params, transport, agentInfo)
+	err := alertUtil.CreateEmailAlertLog(create, s.alert, params, transport, agentInfo)
+	if err != nil {
+		global.LOG.Errorf("%s alert email push failed: %v", s.alert.Type, err)
+		return
+	}
 	alertUtil.CreateNewAlertTask(quota, s.alert.Type, s.quotaType, constant.Email)
-	global.LOG.Infof("%s alert email push successful", s.alert.Type)
+}
+
+func (s *AlertSender) sendWebhook(quota string, params []dto.Param, method string) {
+	totalCount, isValid := s.canSendAlert(method)
+	if !isValid {
+		return
+	}
+
+	create := dto.AlertLogCreate{
+		Status:  constant.AlertSuccess,
+		Count:   totalCount + 1,
+		AlertId: s.alert.ID,
+		Type:    s.alert.Type,
+	}
+	transport := xpack.LoadRequestTransport()
+	agentInfo, _ := xpack.GetAgentInfo()
+	err := xpack.CreateWebhookAlertLog(s.alert.Type, s.alert, create, quota, params, method, transport, agentInfo)
+	if err != nil {
+		global.LOG.Errorf("%s alert %s webhook push failed: %v", s.alert.Type, method, err)
+		return
+	}
+	alertUtil.CreateNewAlertTask(quota, s.alert.Type, s.quotaType, method)
 }
 
 func (s *AlertSender) sendResourceSMS(quota string, params []dto.Param) {
@@ -113,7 +145,6 @@ func (s *AlertSender) sendResourceSMS(quota string, params []dto.Param) {
 		return
 	}
 	alertUtil.CreateNewAlertTask(quota, s.alert.Type, s.quotaType, constant.SMS)
-	global.LOG.Infof("%s alert sms push successful", s.alert.Type)
 }
 
 func (s *AlertSender) sendResourceEmail(quota string, params []dto.Param) {
@@ -138,7 +169,27 @@ func (s *AlertSender) sendResourceEmail(quota string, params []dto.Param) {
 		return
 	}
 	alertUtil.CreateNewAlertTask(quota, s.alert.Type, s.quotaType, constant.Email)
-	global.LOG.Infof("%s alert email push successful", s.alert.Type)
+}
+
+func (s *AlertSender) sendResourceWebhook(quota string, params []dto.Param, method string) {
+	todayCount, isValid := s.canResourceSendAlert(method)
+	if !isValid {
+		return
+	}
+
+	create := dto.AlertLogCreate{
+		Status:  constant.AlertSuccess,
+		Count:   todayCount + 1,
+		AlertId: s.alert.ID,
+		Type:    s.alert.Type,
+	}
+	transport := xpack.LoadRequestTransport()
+	agentInfo, _ := xpack.GetAgentInfo()
+	if err := xpack.CreateWebhookAlertLog(s.alert.Type, s.alert, create, quota, params, method, transport, agentInfo); err != nil {
+		global.LOG.Errorf("%s alert %s webhook push failed: %v", s.alert.Type, method, err)
+		return
+	}
+	alertUtil.CreateNewAlertTask(quota, s.alert.Type, s.quotaType, method)
 }
 
 func (s *AlertSender) canSendAlert(method string) (uint, bool) {

agent/app/service/app.go

@@ -12,6 +12,7 @@ import (
 	"reflect"
 	"strconv"
 	"strings"
+	"sync"
 
 	"github.com/gin-gonic/gin"
 
@@ -25,6 +26,7 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/global"
 	"github.com/1Panel-dev/1Panel/agent/i18n"
+	"github.com/1Panel-dev/1Panel/agent/utils/appicon"
 	"github.com/1Panel-dev/1Panel/agent/utils/common"
 	"github.com/1Panel-dev/1Panel/agent/utils/docker"
 	"github.com/1Panel-dev/1Panel/agent/utils/files"
@@ -33,6 +35,11 @@ import (
 	"gopkg.in/yaml.v3"
 )
 
+var (
+	appStoreSyncMu  sync.Mutex
+	appStoreSyncing bool
+)
+
 type AppService struct {
 }
 
@@ -41,12 +48,12 @@ type IAppService interface {
 	GetAppTags(ctx *gin.Context) ([]response.TagDTO, error)
 	GetApp(ctx *gin.Context, key string) (*response.AppDTO, error)
 	GetAppDetail(appId uint, version, appType string) (response.AppDetailDTO, error)
-	Install(req request.AppInstallCreate) (*model.AppInstall, error)
+	Install(req request.AppInstallCreate, executeScript bool) (*model.AppInstall, error)
 	SyncAppListFromRemote(taskID string) error
 	GetAppUpdate() (*response.AppUpdateRes, error)
 	GetAppDetailByID(id uint) (*response.AppDetailDTO, error)
 	SyncAppListFromLocal(taskID string)
-	GetAppIcon(key string) ([]byte, error)
+	GetAppIcon(key string) ([]byte, string, string, error)
 	GetAppDetailByKey(appKey, version string) (response.AppDetailSimpleDTO, error)
 }
 
@@ -332,7 +339,7 @@ func (a AppService) GetAppDetailByID(id uint) (*response.AppDetailDTO, error) {
 	return res, nil
 }
 
-func (a AppService) Install(req request.AppInstallCreate) (appInstall *model.AppInstall, err error) {
+func (a AppService) Install(req request.AppInstallCreate, executeScript bool) (appInstall *model.AppInstall, err error) {
 	if err = docker.CreateDefaultDockerNetwork(); err != nil {
 		err = buserr.WithDetail("Err1PanelNetworkFailed", err.Error(), nil)
 		return
@@ -409,7 +416,7 @@ func (a AppService) Install(req request.AppInstallCreate) (appInstall *model.App
 		}
 	} else {
 		if appDetail.DockerCompose == "" {
-			dockerComposeUrl := fmt.Sprintf("%s/%s/1panel/%s/%s/docker-compose.yml", global.CONF.RemoteURL.AppRepo, global.CONF.Base.Mode, app.Key, appDetail.Version)
+			dockerComposeUrl := fmt.Sprintf("%s/%s/1panel/%s/%s/docker-compose.yml", global.AppRepoURL(), global.CONF.Base.Mode, app.Key, appDetail.Version)
 			_, composeRes, err = req_helper.HandleRequest(dockerComposeUrl, http.MethodGet, constant.TimeOut20s)
 			if err != nil {
 				return
@@ -509,6 +516,10 @@ func (a AppService) Install(req request.AppInstallCreate) (appInstall *model.App
 	}
 	appInstall.Env = string(paramByte)
 
+	var maxSort int
+	global.DB.Model(&model.AppInstall{}).Where("favorite = ?", false).Select("COALESCE(MAX(sort_order),0)").Scan(&maxSort)
+	appInstall.SortOrder = maxSort + 1
+
 	if err = appInstallRepo.Create(context.Background(), appInstall); err != nil {
 		return
 	}
@@ -526,8 +537,10 @@ func (a AppService) Install(req request.AppInstallCreate) (appInstall *model.App
 		if err = copyData(t, app, appDetail, appInstall, req); err != nil {
 			return err
 		}
-		if err = runScript(t, appInstall, "init"); err != nil {
-			return err
+		if executeScript {
+			if err = runScript(t, appInstall, "init"); err != nil {
+				return err
+			}
 		}
 		if app.Key == "openresty" {
 			if err = handleSiteDir(app, appDetail, req, t); err != nil {
@@ -808,7 +821,7 @@ func (a AppService) GetAppUpdate() (*response.AppUpdateRes, error) {
 		return res, nil
 	}
 
-	versionUrl := fmt.Sprintf("%s/%s/1panel.json.version.txt", global.CONF.RemoteURL.AppRepo, global.CONF.Base.Mode)
+	versionUrl := fmt.Sprintf("%s/%s/1panel.json.version.txt", global.AppRepoURL(), global.CONF.Base.Mode)
 	_, versionRes, err := req_helper.HandleRequest(versionUrl, http.MethodGet, constant.TimeOut20s)
 	if err != nil {
 		return nil, err
@@ -839,6 +852,13 @@ func (a AppService) GetAppUpdate() (*response.AppUpdateRes, error) {
 			res.CanUpdate = true
 			return res, err
 		}
+		if appicon.IsIconFile(app.Icon) {
+			fileName, _ := appicon.ParseIconField(app.Icon)
+			if fileName == "" || !appicon.IconFileExists(fileName) {
+				res.CanUpdate = true
+				return res, err
+			}
+		}
 	}
 
 	list, err := getAppList()
@@ -873,7 +893,7 @@ func getAppFromRepo(downloadPath string) error {
 
 func getAppList() (*dto.AppList, error) {
 	list := &dto.AppList{}
-	if err := getAppFromRepo(fmt.Sprintf("%s/%s/1panel.json.zip", global.CONF.RemoteURL.AppRepo, global.CONF.Base.Mode)); err != nil {
+	if err := getAppFromRepo(fmt.Sprintf("%s/%s/1panel.json.zip", global.AppRepoURL(), global.CONF.Base.Mode)); err != nil {
 		return nil, err
 	}
 	listFile := filepath.Join(global.Dir.ResourceDir, "1panel.json")
@@ -896,295 +916,116 @@ var InitTypes = map[string]struct{}{
 }
 
 func deleteCustomApp() {
+	installs, err := appInstallRepo.ListBy(context.Background())
+	if err != nil {
+		global.LOG.Errorf("[AppStore] deleteCustomApp: failed to list installs, skipping: %v", err)
+		return
+	}
 	var appIDS []uint
-	installs, _ := appInstallRepo.ListBy(context.Background())
 	for _, install := range installs {
 		appIDS = append(appIDS, install.AppId)
 	}
 	var ops []repo.DBOption
-	ops = append(ops, repo.WithByIDNotIn(appIDS))
 	if len(appIDS) > 0 {
 		ops = append(ops, repo.WithByIDNotIn(appIDS))
 	}
-	apps, _ := appRepo.GetBy(ops...)
+	apps, err := appRepo.GetBy(ops...)
+	if err != nil {
+		global.LOG.Errorf("[AppStore] deleteCustomApp: failed to get apps, skipping: %v", err)
+		return
+	}
 	var deleteIDS []uint
 	for _, app := range apps {
 		if app.Resource == constant.AppResourceCustom {
 			deleteIDS = append(deleteIDS, app.ID)
 		}
 	}
-	_ = appRepo.DeleteByIDs(context.Background(), deleteIDS)
-	_ = appDetailRepo.DeleteByAppIds(context.Background(), deleteIDS)
+	if len(deleteIDS) == 0 {
+		return
+	}
+	if err = appRepo.DeleteByIDs(context.Background(), deleteIDS); err != nil {
+		global.LOG.Errorf("[AppStore] deleteCustomApp: failed to delete apps: %v", err)
+	}
+	if err = appDetailRepo.DeleteByAppIds(context.Background(), deleteIDS); err != nil {
+		global.LOG.Errorf("[AppStore] deleteCustomApp: failed to delete app details: %v", err)
+	}
 }
 
 func (a AppService) SyncAppListFromRemote(taskID string) (err error) {
 	if xpack.IsUseCustomApp() {
 		return nil
 	}
+
+	appStoreSyncMu.Lock()
+	global.LOG.Info("[AppStore] sync app from remote task create start")
+	if appStoreSyncing {
+		appStoreSyncMu.Unlock()
+		global.LOG.Info("[AppStore] sync already in progress, skipping")
+		return nil
+	}
+	appStoreSyncing = true
+	appStoreSyncMu.Unlock()
+
 	syncTask, err := task.NewTaskWithOps(i18n.GetMsgByKey("App"), task.TaskSync, task.TaskScopeAppStore, taskID, 0)
 	if err != nil {
+		appStoreSyncMu.Lock()
+		appStoreSyncing = false
+		appStoreSyncMu.Unlock()
 		return err
 	}
-	syncTask.AddSubTask(task.GetTaskName(i18n.GetMsgByKey("App"), task.TaskSync, task.TaskScopeAppStore), func(t *task.Task) (err error) {
-		updateRes, err := a.GetAppUpdate()
-		if err != nil {
-			return err
-		}
-		if !updateRes.CanUpdate {
-			if updateRes.IsSyncing {
-				t.Log(i18n.GetMsgByKey("AppStoreIsSyncing"))
-				return nil
-			}
-			t.Log(i18n.GetMsgByKey("AppStoreIsUpToDate"))
-			return nil
-		}
-		list := &dto.AppList{}
-		if updateRes.AppList == nil {
-			list, err = getAppList()
-			if err != nil {
-				return err
-			}
-		} else {
-			list = updateRes.AppList
-		}
-		settingService := NewISettingService()
-		_ = settingService.Update("AppStoreSyncStatus", constant.StatusSyncing)
 
-		setting, err := settingService.GetSettingInfo()
-		if err != nil {
-			return err
-		}
-		var (
-			appTags   []*model.AppTag
-			oldAppIds []uint
-		)
-		if err = SyncTags(list.Extra); err != nil {
-			return err
-		}
-		deleteCustomApp()
-		oldApps, err := appRepo.GetBy(appRepo.WithNotLocal())
-		if err != nil {
-			return err
-		}
-		for _, old := range oldApps {
-			oldAppIds = append(oldAppIds, old.ID)
-		}
+	var sharedCtx *appSyncContext
 
-		baseRemoteUrl := fmt.Sprintf("%s/%s/1panel", global.CONF.RemoteURL.AppRepo, global.CONF.Base.Mode)
-
-		appsMap := getApps(oldApps, list.Apps, setting.SystemVersion, t)
-
-		t.LogStart(i18n.GetMsgByKey("SyncAppDetail"))
-		for _, l := range list.Apps {
-			app, ok := appsMap[l.AppProperty.Key]
-			if !ok {
-				continue
-			}
-			iconStr := ""
-			_, iconRes, err := req_helper.HandleRequest(l.Icon, http.MethodGet, constant.TimeOut20s)
-			if err == nil {
-				if !strings.Contains(string(iconRes), "<xml>") {
-					iconStr = base64.StdEncoding.EncodeToString(iconRes)
-				}
-			}
-			app.Icon = iconStr
-			app.TagsKey = l.AppProperty.Tags
-			if l.AppProperty.Recommend > 0 {
-				app.Recommend = l.AppProperty.Recommend
-			} else {
-				app.Recommend = 9999
-			}
-			app.ReadMe = l.ReadMe
-			app.LastModified = l.LastModified
-			versions := l.Versions
-			detailsMap := getAppDetails(app.Details, versions)
-			for _, v := range versions {
-				version := v.Name
-				detail := detailsMap[version]
-				versionUrl := fmt.Sprintf("%s/%s/%s", baseRemoteUrl, app.Key, version)
-				paramByte, _ := json.Marshal(v.AppForm)
-				var appForm dto.AppForm
-				_ = json.Unmarshal(paramByte, &appForm)
-				if appForm.SupportVersion > 0 && common.CompareVersion(strconv.FormatFloat(appForm.SupportVersion, 'f', -1, 64), setting.SystemVersion) {
-					delete(detailsMap, version)
-					continue
-				}
-				if _, ok := InitTypes[app.Type]; ok {
-					dockerComposeUrl := fmt.Sprintf("%s/%s", versionUrl, "docker-compose.yml")
-					_, composeRes, err := req_helper.HandleRequest(dockerComposeUrl, http.MethodGet, constant.TimeOut20s)
-					if err == nil {
-						detail.DockerCompose = string(composeRes)
-					}
-				} else {
-					detail.DockerCompose = ""
-				}
-
-				detail.Params = string(paramByte)
-				detail.DownloadUrl = fmt.Sprintf("%s/%s", versionUrl, app.Key+"-"+version+".tar.gz")
-				detail.DownloadCallBackUrl = v.DownloadCallBackUrl
-				detail.Update = true
-				detail.LastModified = v.LastModified
-				detailsMap[version] = detail
-			}
-			var newDetails []model.AppDetail
-			for _, detail := range detailsMap {
-				newDetails = append(newDetails, detail)
-			}
-			app.Details = newDetails
-			appsMap[l.AppProperty.Key] = app
-		}
-		t.LogSuccess(i18n.GetMsgByKey("SyncAppDetail"))
-
-		tags, _ := tagRepo.All()
-		var (
-			addAppArray    []model.App
-			updateAppArray []model.App
-			deleteAppArray []model.App
-			deleteIds      []uint
-			tagMap         = make(map[string]uint, len(tags))
-		)
-
-		for _, v := range appsMap {
-			if v.ID == 0 {
-				addAppArray = append(addAppArray, v)
-			} else {
-				if v.Status == constant.AppTakeDown {
-					installs, _ := appInstallRepo.ListBy(context.Background(), appInstallRepo.WithAppId(v.ID))
-					if len(installs) > 0 {
-						updateAppArray = append(updateAppArray, v)
-						continue
-					}
-					deleteAppArray = append(deleteAppArray, v)
-					deleteIds = append(deleteIds, v.ID)
-				} else {
-					updateAppArray = append(updateAppArray, v)
-				}
-			}
-		}
-
-		tx, ctx := getTxAndContext()
-		defer func() {
-			if err != nil {
-				tx.Rollback()
-				return
-			}
-		}()
-		if len(addAppArray) > 0 {
-			if err = appRepo.BatchCreate(ctx, addAppArray); err != nil {
-				return
-			}
-		}
-		if len(deleteAppArray) > 0 {
-			if err = appRepo.BatchDelete(ctx, deleteAppArray); err != nil {
-				return
-			}
-			if err = appDetailRepo.DeleteByAppIds(ctx, deleteIds); err != nil {
-				return
-			}
-		}
-		for _, tag := range tags {
-			tagMap[tag.Key] = tag.ID
-		}
-		for _, update := range updateAppArray {
-			if err = appRepo.Save(ctx, &update); err != nil {
-				return
-			}
-		}
-		apps := append(addAppArray, updateAppArray...)
-
-		var (
-			addDetails    []model.AppDetail
-			updateDetails []model.AppDetail
-			deleteDetails []model.AppDetail
-		)
-		for _, app := range apps {
-			for _, tag := range app.TagsKey {
-				tagId, ok := tagMap[tag]
-				if ok {
-					exist, _ := appTagRepo.GetFirst(ctx, appTagRepo.WithByTagID(tagId), appTagRepo.WithByAppID(app.ID))
-					if exist == nil {
-						appTags = append(appTags, &model.AppTag{
-							AppId: app.ID,
-							TagId: tagId,
-						})
-					}
-				}
-			}
-			for _, d := range app.Details {
-				d.AppId = app.ID
-				if d.ID == 0 {
-					addDetails = append(addDetails, d)
-				} else {
-					if d.Status == constant.AppTakeDown {
-						runtime, _ := runtimeRepo.GetFirst(ctx, runtimeRepo.WithDetailId(d.ID))
-						if runtime != nil {
-							updateDetails = append(updateDetails, d)
-							continue
-						}
-						installs, _ := appInstallRepo.ListBy(ctx, appInstallRepo.WithDetailIdsIn([]uint{d.ID}))
-						if len(installs) > 0 {
-							updateDetails = append(updateDetails, d)
-							continue
-						}
-						deleteDetails = append(deleteDetails, d)
-					} else {
-						updateDetails = append(updateDetails, d)
-					}
-				}
-			}
-		}
-		if len(addDetails) > 0 {
-			if err = appDetailRepo.BatchCreate(ctx, addDetails); err != nil {
-				return
-			}
-		}
-		if len(deleteDetails) > 0 {
-			if err = appDetailRepo.BatchDelete(ctx, deleteDetails); err != nil {
-				return
-			}
-		}
-		for _, u := range updateDetails {
-			if err = appDetailRepo.Update(ctx, u); err != nil {
-				return
-			}
-		}
-
-		if len(oldAppIds) > 0 {
-			if err = appTagRepo.DeleteByAppIds(ctx, deleteIds); err != nil {
-				return
-			}
-		}
-
-		if len(appTags) > 0 {
-			if err = appTagRepo.BatchCreate(ctx, appTags); err != nil {
-				return
-			}
-		}
-		tx.Commit()
-
-		_ = settingService.Update("AppStoreSyncStatus", constant.StatusSyncSuccess)
-		_ = settingService.Update("AppStoreLastModified", strconv.Itoa(list.LastModified))
-		return nil
-	}, nil)
+	syncTask.AddSubTask(task.GetTaskName(i18n.GetMsgByKey("App"), task.TaskSync, task.TaskScopeAppStore), a.createSyncAppStoreTask(&sharedCtx), nil)
+	syncTask.AddSubTask(i18n.GetMsgByKey("SyncAppDetail"), a.createSyncAppStoreMetaTask(&sharedCtx), nil)
 
 	go func() {
+		defer func() {
+			if r := recover(); r != nil {
+				global.LOG.Errorf("[AppStore] sync goroutine recovered from panic: %v", r)
+				if updateErr := NewISettingService().Update("AppStoreSyncStatus", constant.StatusError); updateErr != nil {
+					global.LOG.Warnf("[AppStore] failed to update sync status after panic: %v", updateErr)
+				}
+			}
+			appStoreSyncMu.Lock()
+			appStoreSyncing = false
+			appStoreSyncMu.Unlock()
+		}()
 		if err := syncTask.Execute(); err != nil {
-			_ = NewISettingService().Update("AppStoreLastModified", "0")
-			_ = NewISettingService().Update("AppStoreSyncStatus", constant.StatusError)
+			if updateErr := NewISettingService().Update("AppStoreLastModified", "0"); updateErr != nil {
+				global.LOG.Warnf("[AppStore] failed to reset last modified: %v", updateErr)
+			}
+			if updateErr := NewISettingService().Update("AppStoreSyncStatus", constant.StatusError); updateErr != nil {
+				global.LOG.Warnf("[AppStore] failed to update sync status to error: %v", updateErr)
+			}
+			return
 		}
 	}()
 
+	global.LOG.Info("[AppStore] sync app from remote task create ok")
 	return nil
 }
 
-func (a AppService) GetAppIcon(key string) ([]byte, error) {
+func (a AppService) GetAppIcon(key string) ([]byte, string, string, error) {
 	app, err := appRepo.GetFirst(appRepo.WithKey(key))
 	if err != nil {
-		return nil, err
+		return nil, "", "", err
 	}
+
+	if appicon.IsIconFile(app.Icon) {
+		fileName, etag := appicon.ParseIconField(app.Icon)
+		iconBytes, err := appicon.ReadIconFile(fileName)
+		if err != nil {
+			global.LOG.Warnf("[AppIcon] read icon file failed key=%s, file=%s, err=%v", key, fileName, err)
+			return nil, "", "", nil
+		}
+		return iconBytes, fileName, etag, nil
+	}
+
 	iconBytes, err := base64.StdEncoding.DecodeString(app.Icon)
 	if err != nil {
-		return nil, err
+		global.LOG.Warnf("[AppIcon] decode base64 icon failed key=%s, err=%v", key, err)
+		return nil, "", "", nil
 	}
-	return iconBytes, nil
+	return iconBytes, "", "", nil
 }

agent/app/service/app_install.go

@@ -57,6 +57,7 @@ type IAppInstallService interface {
 	UpdateAppConfig(req request.AppConfigUpdate) error
 	GetInstallList() ([]dto.AppInstallInfo, error)
 	GetAppInstallInfo(appInstallID uint) (*response.AppInstallInfo, error)
+	UpdateSort(req request.AppInstallSort) error
 }
 
 func NewIAppInstalledService() IAppInstallService {
@@ -83,6 +84,7 @@ func (a *AppInstallService) Page(req request.AppInstalledSearch) (int64, []respo
 		err      error
 	)
 	opts = append(opts, repo.WithOrderRuleBy("favorite", "descending"))
+	opts = append(opts, repo.WithOrderRuleBy("sort_order", "ascending"))
 
 	if req.Name != "" {
 		opts = append(opts, repo.WithByLikeName(req.Name))
@@ -121,7 +123,7 @@ func (a *AppInstallService) Page(req request.AppInstalledSearch) (int64, []respo
 		}
 	}
 
-	installDTOs, _ := handleInstalled(installs, req.Update, req.Sync)
+	installDTOs, _ := handleInstalled(installs, req.Update, req.Sync, req.CheckUpdate)
 	if req.Update {
 		total = int64(len(installDTOs))
 	}
@@ -238,7 +240,7 @@ func (a *AppInstallService) SearchForWebsite(req request.AppInstalledSearch) ([]
 		}
 	}
 
-	return handleInstalled(installs, false, true)
+	return handleInstalled(installs, false, true, false)
 }
 
 func (a *AppInstallService) Operate(req request.AppInstalledOperate) error {
@@ -300,6 +302,9 @@ func (a *AppInstallService) Operate(req request.AppInstalledOperate) error {
 		return opNginx(install.ContainerName, constant.NginxReload)
 	case constant.Favorite:
 		install.Favorite = req.Favorite
+		var maxSort int
+		global.DB.Model(&model.AppInstall{}).Where("favorite = ?", req.Favorite).Select("COALESCE(MAX(sort_order),0)").Scan(&maxSort)
+		install.SortOrder = maxSort + 1
 		return appInstallRepo.Save(context.Background(), &install)
 	default:
 		return errors.New("operate not support")
@@ -318,6 +323,15 @@ func (a *AppInstallService) UpdateAppConfig(req request.AppConfigUpdate) error {
 	return appInstallRepo.Save(context.Background(), &installed)
 }
 
+func (a *AppInstallService) UpdateSort(req request.AppInstallSort) error {
+	for _, item := range req.Items {
+		if err := appInstallRepo.BatchUpdateBy(map[string]interface{}{"sort_order": item.SortOrder}, repo.WithByID(item.InstallID)); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 func (a *AppInstallService) Update(req request.AppInstalledUpdate) error {
 	installed, err := appInstallRepo.GetFirst(repo.WithByID(req.InstallId))
 	if err != nil {

agent/app/service/app_sync_task.go

@@ -0,0 +1,608 @@
+package service
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/app/task"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/i18n"
+	"github.com/1Panel-dev/1Panel/agent/utils/appicon"
+	"github.com/1Panel-dev/1Panel/agent/utils/common"
+	"github.com/1Panel-dev/1Panel/agent/utils/req_helper"
+	"github.com/1Panel-dev/1Panel/agent/utils/xpack"
+)
+
+type appSyncContext struct {
+	task           *task.Task
+	httpClient     http.Client
+	baseRemoteUrl  string
+	systemVersion  string
+	appsMap        map[string]model.App
+	settingService ISettingService
+	list           *dto.AppList
+	oldAppIds      []uint
+	appTags        []*model.AppTag
+	skipMetaSync   bool
+	pendingIcons   map[string]string
+}
+
+func (a AppService) createSyncAppStoreTask(sharedCtx **appSyncContext) func(t *task.Task) error {
+	return func(t *task.Task) (err error) {
+		t.LogStart(i18n.GetMsgByKey("AppStore") + " " + i18n.GetMsgByKey("TaskSync"))
+
+		updateRes, err := a.GetAppUpdate()
+		if err != nil {
+			t.LogFailedWithErr(i18n.GetMsgByKey("CheckAppStoreUpdate"), err)
+			return err
+		}
+		if !updateRes.CanUpdate {
+			if updateRes.IsSyncing {
+				t.Log(i18n.GetMsgByKey("AppStoreIsSyncing"))
+				return nil
+			}
+			global.LOG.Infof("[AppStore] Appstore is up to date")
+			t.Log(i18n.GetMsgByKey("AppStoreIsUpToDate"))
+			*sharedCtx = &appSyncContext{skipMetaSync: true}
+			t.LogSuccess(i18n.GetMsgByKey("AppStore") + " " + i18n.GetMsgByKey("TaskSync"))
+			return nil
+		}
+
+		list := &dto.AppList{}
+		if updateRes.AppList == nil {
+			list, err = getAppList()
+			if err != nil {
+				t.LogFailedWithErr(i18n.GetMsgByKey("DownloadAppList"), err)
+				return err
+			}
+		} else {
+			list = updateRes.AppList
+		}
+
+		settingService := NewISettingService()
+		if err := settingService.Update("AppStoreSyncStatus", constant.StatusSyncing); err != nil {
+			global.LOG.Warnf("[AppStore] failed to update sync status to syncing: %v", err)
+		}
+
+		setting, err := settingService.GetSettingInfo()
+		if err != nil {
+			t.LogFailedWithErr("GetSettingInfo", err)
+			return err
+		}
+
+		ctx := &appSyncContext{
+			task:           t,
+			httpClient:     http.Client{Timeout: time.Duration(constant.TimeOut20s) * time.Second, Transport: xpack.LoadRequestTransport()},
+			baseRemoteUrl:  fmt.Sprintf("%s/%s/1panel", global.AppRepoURL(), global.CONF.Base.Mode),
+			systemVersion:  setting.SystemVersion,
+			settingService: settingService,
+			list:           list,
+			appTags:        make([]*model.AppTag, 0),
+			pendingIcons:   make(map[string]string),
+		}
+
+		if err = SyncTags(list.Extra); err != nil {
+			t.LogFailedWithErr(i18n.GetMsgByKey("SyncTags"), err)
+			return err
+		}
+		deleteCustomApp()
+
+		oldApps, err := appRepo.GetBy(appRepo.WithNotLocal())
+		if err != nil {
+			t.LogFailedWithErr(i18n.GetMsgByKey("LoadLocalApps"), err)
+			return err
+		}
+		ctx.oldAppIds = make([]uint, 0, len(oldApps))
+		for _, old := range oldApps {
+			ctx.oldAppIds = append(ctx.oldAppIds, old.ID)
+		}
+
+		ctx.appsMap, ctx.pendingIcons = getApps(oldApps, list.Apps, setting.SystemVersion, t)
+
+		var addCount, updateCount, deleteCount int
+		if err = ctx.classifyAndPersistAppsWithStats(&addCount, &updateCount, &deleteCount); err != nil {
+			t.LogFailedWithErr(i18n.GetMsgByKey("PersistApps"), err)
+			return err
+		}
+
+		if err := settingService.Update("AppStoreSyncStatus", constant.StatusSyncSuccess); err != nil {
+			global.LOG.Warnf("[AppStore] failed to update sync status to success: %v", err)
+		}
+		if err := settingService.Update("AppStoreLastModified", strconv.Itoa(list.LastModified)); err != nil {
+			global.LOG.Warnf("[AppStore] failed to update last modified: %v", err)
+		}
+		global.LOG.Infof("[AppStore] Appstore sync completed")
+
+		*sharedCtx = ctx
+		t.LogSuccess(i18n.GetMsgByKey("AppStore") + " " + i18n.GetMsgByKey("TaskSync"))
+		return nil
+	}
+}
+
+type appWorkItem struct {
+	appDef  dto.AppDefine
+	app     model.App
+	iconUrl string
+	hadIcon bool
+}
+
+type appWorkResult struct {
+	appKey     string
+	app        model.App
+	iconStatus int
+	hadIcon    bool
+	httpFailed bool
+}
+
+func (c *appSyncContext) processOneApp(item appWorkItem) appWorkResult {
+	app := item.app
+	l := item.appDef
+	result := appWorkResult{
+		appKey:  l.AppProperty.Key,
+		hadIcon: item.hadIcon,
+	}
+
+	if item.hadIcon {
+		status, iconField := c.downloadAppIcon(item.iconUrl, l.AppProperty.Key, app.Icon)
+		result.iconStatus = status
+		switch status {
+		case http.StatusOK:
+			app.Icon = iconField
+		case http.StatusNotModified:
+		default:
+			result.httpFailed = true
+		}
+	}
+
+	app.TagsKey = l.AppProperty.Tags
+	if l.AppProperty.Recommend > 0 {
+		app.Recommend = l.AppProperty.Recommend
+	} else {
+		app.Recommend = 9999
+	}
+	app.ReadMe = l.ReadMe
+	app.LastModified = l.LastModified
+
+	versions := l.Versions
+	detailsMap := getAppDetails(app.Details, versions)
+	for _, v := range versions {
+		version := v.Name
+		detail := detailsMap[version]
+		versionUrl := fmt.Sprintf("%s/%s/%s", c.baseRemoteUrl, app.Key, version)
+
+		paramByte, _ := json.Marshal(v.AppForm)
+		var appForm dto.AppForm
+		_ = json.Unmarshal(paramByte, &appForm)
+
+		if appForm.SupportVersion > 0 && common.CompareVersion(strconv.FormatFloat(appForm.SupportVersion, 'f', -1, 64), c.systemVersion) {
+			delete(detailsMap, version)
+			continue
+		}
+
+		if _, ok := InitTypes[app.Type]; ok {
+			dockerComposeUrl := fmt.Sprintf("%s/%s", versionUrl, "docker-compose.yml")
+			_, composeRes, err := req_helper.HandleRequestWithClient(&c.httpClient, dockerComposeUrl, http.MethodGet, constant.TimeOut20s)
+			if err == nil {
+				detail.DockerCompose = string(composeRes)
+			} else {
+				result.httpFailed = true
+			}
+		} else {
+			detail.DockerCompose = ""
+		}
+
+		detail.Params = string(paramByte)
+		detail.DownloadUrl = fmt.Sprintf("%s/%s", versionUrl, app.Key+"-"+version+".tar.gz")
+		detail.DownloadCallBackUrl = v.DownloadCallBackUrl
+		detail.Update = true
+		detail.LastModified = v.LastModified
+		detailsMap[version] = detail
+	}
+
+	newDetails := make([]model.AppDetail, 0, len(detailsMap))
+	for _, detail := range detailsMap {
+		newDetails = append(newDetails, detail)
+	}
+	app.Details = newDetails
+
+	result.app = app
+	return result
+}
+
+func (c *appSyncContext) syncAppIconsAndDetails() error {
+	total := len(c.list.Apps)
+	global.LOG.Infof("[AppStore] sync app detail start, total apps: %d", total)
+
+	workItems := make([]appWorkItem, 0, total)
+	for _, l := range c.list.Apps {
+		app, ok := c.appsMap[l.AppProperty.Key]
+		if !ok {
+			continue
+		}
+		iconUrl, hasPending := c.pendingIcons[l.AppProperty.Key]
+		workItems = append(workItems, appWorkItem{
+			appDef:  l,
+			app:     app,
+			iconUrl: iconUrl,
+			hadIcon: hasPending,
+		})
+	}
+
+	totalWork := len(workItems)
+	if totalWork == 0 {
+		return nil
+	}
+
+	const maxWorkers = 4
+	var (
+		failFlag atomic.Bool
+		workCh   = make(chan int, maxWorkers)
+		resultCh = make(chan appWorkResult, maxWorkers)
+		wg       sync.WaitGroup
+	)
+
+	wg.Add(maxWorkers)
+	for range maxWorkers {
+		go func() {
+			defer wg.Done()
+			for idx := range workCh {
+				result := c.processOneApp(workItems[idx])
+				resultCh <- result
+				if result.httpFailed {
+					failFlag.Store(true)
+				}
+			}
+		}()
+	}
+	go func() { wg.Wait(); close(resultCh) }()
+
+	var fed atomic.Int32
+	go func() {
+		for i := range workItems {
+			if failFlag.Load() {
+				break
+			}
+			workCh <- i
+			fed.Store(int32(i + 1))
+		}
+		close(workCh)
+	}()
+
+	var (
+		completed    int
+		icon200Count int
+		icon304Count int
+		iconFailCount int
+	)
+	milestones := [4]int{totalWork / 4, totalWork / 2, totalWork * 3 / 4, totalWork}
+	nextMS := 0
+	checkProgress := func() {
+		if nextMS < len(milestones) && completed >= milestones[nextMS] {
+			c.task.LogWithProgress(i18n.GetMsgByKey("SyncAppDetail"), completed, totalWork)
+			nextMS++
+		}
+	}
+
+	applyResult := func(result appWorkResult) {
+		c.appsMap[result.appKey] = result.app
+		if result.hadIcon {
+			switch result.iconStatus {
+			case http.StatusOK:
+				icon200Count++
+			case http.StatusNotModified:
+				icon304Count++
+			default:
+				iconFailCount++
+			}
+		}
+		completed++
+		checkProgress()
+	}
+
+	for result := range resultCh {
+		applyResult(result)
+	}
+
+	fedCount := int(fed.Load())
+	if failFlag.Load() && fedCount < len(workItems) {
+		global.LOG.Warnf("[AppStore] HTTP failure detected, falling back to serial for remaining %d apps", len(workItems)-fedCount)
+		for i := fedCount; i < len(workItems); i++ {
+			result := c.processOneApp(workItems[i])
+			applyResult(result)
+		}
+	}
+
+	global.LOG.Infof("[AppStore] icon download completed - total: %d, success(200): %d, cached(304): %d, failed: %d",
+		total, icon200Count, icon304Count, iconFailCount)
+
+	return nil
+}
+
+func (c *appSyncContext) downloadAppIcon(iconUrl, appKey, oldIcon string) (status int, iconField string) {
+	iconFileName, existingEtag := appicon.ParseIconField(oldIcon)
+
+	reqHeaders := make(map[string]string)
+	if existingEtag != "" && iconFileName != "" && appicon.IconFileExists(iconFileName) {
+		reqHeaders["If-None-Match"] = existingEtag
+	}
+
+	resp, err := req_helper.HandleRequestWithHeaders(&c.httpClient, iconUrl, http.MethodGet, constant.TimeOut20s, reqHeaders)
+	if err != nil {
+		global.LOG.Warnf("[AppStore] request icon failed url=%s, err=%v", iconUrl, err)
+		return 0, ""
+	}
+
+	if resp.StatusCode == http.StatusNotModified {
+		return http.StatusNotModified, ""
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		global.LOG.Warnf("[AppStore] download icon failed url=%s, status=%d", iconUrl, resp.StatusCode)
+		return 0, ""
+	}
+
+	if len(resp.Body) == 0 {
+		global.LOG.Warnf("[AppStore] download icon empty body url=%s", iconUrl)
+		return 0, ""
+	}
+
+	if resp.Body[0] == '<' {
+		global.LOG.Warnf("[AppStore] download icon got HTML response url=%s", iconUrl)
+		return 0, ""
+	}
+
+	contentType := resp.Header.Get("Content-Type")
+	ct := strings.TrimSpace(strings.Split(contentType, ";")[0])
+	if strings.ToLower(ct) != "image/png" {
+		global.LOG.Warnf("[AppStore] unexpected icon content-type: %s, expected image/png, url=%s", ct, iconUrl)
+	}
+
+	fileName, err := appicon.WriteIconFile(appKey, resp.Body)
+	if err != nil {
+		global.LOG.Warnf("[AppStore] write icon file failed appKey=%s, err=%v", appKey, err)
+		return 0, ""
+	}
+
+	newEtag := resp.Header.Get("ETag")
+	iconField = appicon.BuildIconField(fileName, newEtag)
+
+	return http.StatusOK, iconField
+}
+
+func (a AppService) createSyncAppStoreMetaTask(sharedCtx **appSyncContext) func(t *task.Task) error {
+	return func(t *task.Task) (err error) {
+		t.LogStart(i18n.GetMsgByKey("SyncAppDetail"))
+		ctx := *sharedCtx
+		if ctx == nil {
+			global.LOG.Warnf("[AppStore] meta sync skipped: shared context is nil")
+			t.Log(i18n.GetMsgByKey("SyncAppDetail") + " skipped: shared context is nil")
+			return nil
+		}
+
+		if ctx.skipMetaSync {
+			global.LOG.Infof("[AppStore] meta sync skipped: no update needed")
+			t.Log(i18n.GetMsgByKey("SyncAppDetail") + " skipped: no update needed")
+			return nil
+		}
+
+		if ctx.list == nil || ctx.appsMap == nil {
+			global.LOG.Errorf("[AppStore] meta sync failed: shared context data not initialized")
+			err := fmt.Errorf("shared context data not initialized")
+			t.LogFailedWithErr(i18n.GetMsgByKey("SyncAppDetail"), err)
+			return err
+		}
+
+		t.Logf("%s: %d apps", i18n.GetMsgByKey("SyncAppDetail"), len(ctx.list.Apps))
+
+		ctx.task = t
+		ctx.appTags = make([]*model.AppTag, 0)
+
+		if err = ctx.syncAppIconsAndDetails(); err != nil {
+			t.LogFailedWithErr(i18n.GetMsgByKey("SyncAppDetail"), err)
+			return err
+		}
+
+		if err = ctx.classifyAndPersistApps(); err != nil {
+			t.LogFailedWithErr(i18n.GetMsgByKey("PersistAppDetails"), err)
+			return err
+		}
+
+		global.LOG.Infof("[AppStore] Appstore meta sync completed")
+		return nil
+	}
+}
+
+func (c *appSyncContext) classifyAndPersistApps() (err error) {
+	var addCount, updateCount, deleteCount int
+	return c.classifyAndPersistAppsWithStats(&addCount, &updateCount, &deleteCount)
+}
+
+func (c *appSyncContext) classifyAndPersistAppsWithStats(addCount, updateCount, deleteCount *int) (err error) {
+	tags, _ := tagRepo.All()
+	var (
+		addAppArray    []model.App
+		updateAppArray []model.App
+		deleteAppArray []model.App
+		deleteIds      []uint
+		tagMap         = make(map[string]uint, len(tags))
+	)
+
+	for _, v := range c.appsMap {
+		if v.ID == 0 {
+			addAppArray = append(addAppArray, v)
+		} else {
+			if v.Status == constant.AppTakeDown {
+				installs, _ := appInstallRepo.ListBy(context.Background(), appInstallRepo.WithAppId(v.ID))
+				if len(installs) > 0 {
+					updateAppArray = append(updateAppArray, v)
+					continue
+				}
+				deleteAppArray = append(deleteAppArray, v)
+				deleteIds = append(deleteIds, v.ID)
+			} else {
+				updateAppArray = append(updateAppArray, v)
+			}
+		}
+	}
+
+	if len(addAppArray) > 0 {
+		addKeys := make([]string, 0, len(addAppArray))
+		for _, app := range addAppArray {
+			addKeys = append(addKeys, app.Key)
+		}
+		existingApps, _ := appRepo.GetBy(appRepo.WithKeyIn(addKeys))
+		if len(existingApps) > 0 {
+			existingMap := make(map[string]model.App, len(existingApps))
+			for _, e := range existingApps {
+				existingMap[e.Key] = e
+			}
+			filteredAdd := make([]model.App, 0, len(addAppArray))
+			for _, app := range addAppArray {
+				if existing, ok := existingMap[app.Key]; ok {
+					app.ID = existing.ID
+					if len(app.Details) == 0 {
+						app.Details = existing.Details
+					}
+					updateAppArray = append(updateAppArray, app)
+				} else {
+					filteredAdd = append(filteredAdd, app)
+				}
+			}
+			addAppArray = filteredAdd
+		}
+	}
+
+	*addCount = len(addAppArray)
+	*updateCount = len(updateAppArray)
+	*deleteCount = len(deleteAppArray)
+
+	tx, ctx := getTxAndContext()
+	defer func() {
+		if err != nil {
+			tx.Rollback()
+			return
+		}
+	}()
+
+	if len(addAppArray) > 0 {
+		if err = appRepo.BatchCreate(ctx, addAppArray); err != nil {
+			return
+		}
+	}
+
+	if len(deleteAppArray) > 0 {
+		if err = appRepo.BatchDelete(ctx, deleteAppArray); err != nil {
+			return
+		}
+		if err = appDetailRepo.DeleteByAppIds(ctx, deleteIds); err != nil {
+			return
+		}
+	}
+
+	for _, tag := range tags {
+		tagMap[tag.Key] = tag.ID
+	}
+
+	if len(updateAppArray) > 0 {
+		for _, update := range updateAppArray {
+			if err = appRepo.Save(ctx, &update); err != nil {
+				return
+			}
+		}
+	}
+
+	apps := append(addAppArray, updateAppArray...)
+
+	var (
+		addDetails    []model.AppDetail
+		updateDetails []model.AppDetail
+		deleteDetails []model.AppDetail
+	)
+
+	totalDetails := 0
+	for _, app := range apps {
+		for _, tag := range app.TagsKey {
+			tagId, ok := tagMap[tag]
+			if ok {
+				exist, _ := appTagRepo.GetFirst(ctx, appTagRepo.WithByTagID(tagId), appTagRepo.WithByAppID(app.ID))
+				if exist == nil {
+					c.appTags = append(c.appTags, &model.AppTag{
+						AppId: app.ID,
+						TagId: tagId,
+					})
+				}
+			}
+		}
+
+		for _, d := range app.Details {
+			totalDetails++
+			d.AppId = app.ID
+			if d.ID == 0 {
+				addDetails = append(addDetails, d)
+			} else {
+				if d.Status == constant.AppTakeDown {
+					runtime, _ := runtimeRepo.GetFirst(ctx, runtimeRepo.WithDetailId(d.ID))
+					if runtime != nil {
+						updateDetails = append(updateDetails, d)
+						continue
+					}
+					installs, _ := appInstallRepo.ListBy(ctx, appInstallRepo.WithDetailIdsIn([]uint{d.ID}))
+					if len(installs) > 0 {
+						updateDetails = append(updateDetails, d)
+						continue
+					}
+					deleteDetails = append(deleteDetails, d)
+				} else {
+					updateDetails = append(updateDetails, d)
+				}
+			}
+		}
+	}
+
+	if len(addDetails) > 0 {
+		if err = appDetailRepo.BatchCreate(ctx, addDetails); err != nil {
+			return
+		}
+	}
+
+	if len(deleteDetails) > 0 {
+		if err = appDetailRepo.BatchDelete(ctx, deleteDetails); err != nil {
+			return
+		}
+	}
+
+	if len(updateDetails) > 0 {
+		for _, u := range updateDetails {
+			if err = appDetailRepo.Update(ctx, u); err != nil {
+				return
+			}
+		}
+	}
+
+	if len(c.oldAppIds) > 0 {
+		if err = appTagRepo.DeleteByAppIds(ctx, deleteIds); err != nil {
+			return
+		}
+	}
+
+	if len(c.appTags) > 0 {
+		if err = appTagRepo.BatchCreate(ctx, c.appTags); err != nil {
+			return
+		}
+	}
+
+	if err = tx.Commit().Error; err != nil {
+		return
+	}
+	return nil
+}

agent/app/service/app_utils.go

@@ -33,7 +33,6 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/utils/common"
 	"github.com/1Panel-dev/1Panel/agent/utils/compose"
 	"github.com/1Panel-dev/1Panel/agent/utils/docker"
-	composeV2 "github.com/1Panel-dev/1Panel/agent/utils/docker"
 	"github.com/1Panel-dev/1Panel/agent/utils/env"
 	"github.com/1Panel-dev/1Panel/agent/utils/files"
 	"github.com/1Panel-dev/1Panel/agent/utils/nginx"
@@ -363,7 +362,7 @@ func deleteAppInstall(deleteReq request.AppInstallDelete) error {
 				if err != nil {
 					return err
 				}
-				images, err := composeV2.GetImagesFromDockerCompose(content, []byte(install.DockerCompose))
+				images, err := docker.GetImagesFromDockerCompose(content, []byte(install.DockerCompose))
 				if err != nil {
 					return err
 				}
@@ -392,6 +391,10 @@ func deleteAppInstall(deleteReq request.AppInstallDelete) error {
 		if err = appInstallRepo.Delete(ctx, install); err != nil {
 			return err
 		}
+		appKey := install.App.Key
+		if appKey == constant.AppOpenclaw || appKey == constant.AppCopaw {
+			_ = agentRepo.DeleteByAppInstallIDWithCtx(ctx, install.ID)
+		}
 
 		resources, _ := appInstallResourceRepo.GetBy(appInstallResourceRepo.WithAppInstallId(install.ID))
 		if len(resources) > 0 {
@@ -672,6 +675,7 @@ func upgradeInstall(req request.AppInstallUpgrade) error {
 	if err != nil {
 		return err
 	}
+	oldVersion := install.Version
 	detail, err := appDetailRepo.GetFirst(repo.WithByID(req.DetailID))
 	if err != nil {
 		return err
@@ -748,7 +752,7 @@ func upgradeInstall(req request.AppInstallUpgrade) error {
 			if req.DockerCompose != "" {
 				composeContent = []byte(req.DockerCompose)
 			}
-			images, err := composeV2.GetImagesFromDockerCompose(content, composeContent)
+			images, err := docker.GetImagesFromDockerCompose(content, composeContent)
 			if err != nil {
 				return err
 			}
@@ -764,6 +768,30 @@ func upgradeInstall(req request.AppInstallUpgrade) error {
 
 		command := exec.Command("/bin/bash", "-c", fmt.Sprintf("cp -rn %s/* %s || true", detailDir, install.GetPath()))
 		_, _ = command.CombinedOutput()
+		if install.App.Key == constant.AppOpenresty {
+			installBuildDir := path.Join(install.GetPath(), "build")
+			detailBuildDir := path.Join(detailDir, "build")
+			if !fileOp.Stat(installBuildDir) {
+				if err := fileOp.CreateDir(installBuildDir, constant.DirPerm); err != nil {
+					return err
+				}
+			}
+			if err := fileOp.DeleteDir(path.Join(installBuildDir, "tmp")); err != nil {
+				return err
+			}
+			if err := fileOp.CopyDir(path.Join(detailBuildDir, "tmp"), installBuildDir); err != nil {
+				return err
+			}
+			if err := fileOp.CopyFile(path.Join(detailBuildDir, "Dockerfile"), installBuildDir); err != nil {
+				return err
+			}
+			if err := fileOp.CopyFile(path.Join(detailBuildDir, "nginx.conf"), installBuildDir); err != nil {
+				return err
+			}
+			if err := fileOp.CopyFile(path.Join(detailBuildDir, "nginx.vh.default.conf"), installBuildDir); err != nil {
+				return err
+			}
+		}
 		sourceScripts := path.Join(detailDir, "scripts")
 		if fileOp.Stat(sourceScripts) {
 			dstScripts := path.Join(install.GetPath(), "scripts")
@@ -774,6 +802,9 @@ func upgradeInstall(req request.AppInstallUpgrade) error {
 		}
 
 		var newCompose string
+		if err = migrateOpenclawHTTPSUpgrade(&install, oldVersion, detail.Version); err != nil {
+			return err
+		}
 		if req.DockerCompose == "" {
 			newCompose, err = getUpgradeCompose(install, detail)
 			if err != nil {
@@ -883,7 +914,7 @@ func getContainerNames(install model.AppInstall) ([]string, error) {
 	if err != nil {
 		return nil, err
 	}
-	project, err := composeV2.GetComposeProject(install.Name, install.GetPath(), []byte(install.DockerCompose), []byte(envStr), true)
+	project, err := docker.GetComposeProject(install.Name, install.GetPath(), []byte(install.DockerCompose), []byte(envStr), true)
 	if err != nil {
 		return nil, err
 	}
@@ -1105,7 +1136,7 @@ func runScript(task *task.Task, appInstall *model.AppInstall, operate string) er
 }
 
 func checkContainerNameIsExist(containerName, appDir string) (bool, error) {
-	client, err := composeV2.NewDockerClient()
+	client, err := docker.NewDockerClient()
 	if err != nil {
 		return false, err
 	}
@@ -1141,7 +1172,7 @@ func upApp(task *task.Task, appInstall *model.AppInstall, pullImages bool) error
 			if err != nil {
 				return err
 			}
-			images, err := composeV2.GetImagesFromDockerCompose(envByte, []byte(appInstall.DockerCompose))
+			images, err := docker.GetImagesFromDockerCompose(envByte, []byte(appInstall.DockerCompose))
 			if err != nil {
 				return err
 			}
@@ -1271,8 +1302,9 @@ func getAppDetails(details []model.AppDetail, versions []dto.AppConfigVersion) m
 	return appDetails
 }
 
-func getApps(oldApps []model.App, items []dto.AppDefine, systemVersion string, task *task.Task) map[string]model.App {
+func getApps(oldApps []model.App, items []dto.AppDefine, systemVersion string, task *task.Task) (map[string]model.App, map[string]string) {
 	apps := make(map[string]model.App, len(oldApps))
+	pendingIcons := make(map[string]string, len(items))
 	for _, old := range oldApps {
 		old.Status = constant.AppTakeDown
 		apps[old.Key] = old
@@ -1313,9 +1345,12 @@ func getApps(oldApps []model.App, items []dto.AppDefine, systemVersion string, t
 		app.Architectures = strings.Join(config.Architectures, ",")
 		app.GpuSupport = config.GpuSupport
 		app.BatchInstallSupport = config.BatchInstallSupport
+		if item.Icon != "" {
+			pendingIcons[key] = item.Icon
+		}
 		apps[key] = app
 	}
-	return apps
+	return apps, pendingIcons
 }
 
 func handleLocalAppDetail(versionDir string, appDetail *model.AppDetail) error {
@@ -1531,7 +1566,7 @@ func synAppInstall(containers map[string]container.Summary, appInstall *model.Ap
 	_ = appInstallRepo.Save(context.Background(), appInstall)
 }
 
-func handleInstalled(appInstallList []model.AppInstall, updated bool, sync bool) ([]response.AppInstallDTO, error) {
+func handleInstalled(appInstallList []model.AppInstall, updated, sync, checkUpdate bool) ([]response.AppInstallDTO, error) {
 	var (
 		res           []response.AppInstallDTO
 		containersMap map[string]container.Summary
@@ -1554,6 +1589,7 @@ func handleInstalled(appInstallList []model.AppInstall, updated bool, sync bool)
 		if updated && ignoreUpdate(installed) {
 			continue
 		}
+
 		if sync && !doNotNeedSync(installed) {
 			synAppInstall(containersMap, &installed, false)
 		}
@@ -1580,23 +1616,34 @@ func handleInstalled(appInstallList []model.AppInstall, updated bool, sync bool)
 				Document: installed.App.Document,
 			},
 			Favorite:    installed.Favorite,
+			SortOrder:   installed.SortOrder,
 			Container:   installed.ContainerName,
 			ServiceName: strings.ToLower(installed.ServiceName),
 		}
-		if !updated {
+
+		if !updated && !checkUpdate {
 			installDTO.LinkDB = hasLinkDB(installed.ID)
 			res = append(res, installDTO)
 			continue
 		}
+
 		if installed.Version == "latest" {
+			if checkUpdate {
+				installDTO.CanUpdate = false
+				installDTO.LinkDB = hasLinkDB(installed.ID)
+				res = append(res, installDTO)
+			}
 			continue
 		}
+
 		installDTO.DockerCompose = installed.DockerCompose
 		installDTO.IsEdit = isEditCompose(installed)
+
 		details, err := appDetailRepo.GetBy(appDetailRepo.WithAppId(installed.App.ID))
 		if err != nil {
 			return nil, err
 		}
+
 		var versions []string
 		for _, appDetail := range details {
 			ignores, _ := appIgnoreUpgradeRepo.List(runtimeRepo.WithDetailId(appDetail.ID), appIgnoreUpgradeRepo.WithScope("version"))
@@ -1608,11 +1655,19 @@ func handleInstalled(appInstallList []model.AppInstall, updated bool, sync bool)
 			}
 			versions = append(versions, appDetail.Version)
 		}
+
 		if len(versions) == 0 {
+			if checkUpdate {
+				installDTO.CanUpdate = false
+				installDTO.LinkDB = hasLinkDB(installed.ID)
+				res = append(res, installDTO)
+			}
 			continue
 		}
+
 		versions = common.GetSortedVersions(versions)
 		lastVersion := versions[0]
+
 		if installed.App.Key == constant.AppMysql || installed.App.Key == constant.AppMysqlCluster {
 			for _, version := range versions {
 				majorVersion := getMajorVersion(installed.Version)
@@ -1624,15 +1679,23 @@ func handleInstalled(appInstallList []model.AppInstall, updated bool, sync bool)
 				}
 			}
 		}
+
 		if common.IsCrossVersion(installed.Version, lastVersion) {
 			installDTO.CanUpdate = installed.App.CrossVersionUpdate
 		} else {
 			installDTO.CanUpdate = common.CompareVersion(lastVersion, installed.Version)
 		}
-		if installDTO.CanUpdate {
+
+		if updated {
+			if installDTO.CanUpdate {
+				res = append(res, installDTO)
+			}
+		} else if checkUpdate {
+			installDTO.LinkDB = hasLinkDB(installed.ID)
 			res = append(res, installDTO)
 		}
 	}
+
 	return res, nil
 }
 
@@ -1961,23 +2024,26 @@ func handleSiteDir(app model.App, appDetail model.AppDetail, req request.AppInst
 			req.Params["WEBSITE_DIR"] = siteDir
 			oldWebStePath, _ := settingRepo.GetValueByKey("WEBSITE_DIR")
 			fileOp := files.NewFileOp()
+			movePath := func(src, dst string) error {
+				return cmd.NewCommandMgr().Run("mv", src, dst)
+			}
 			if oldWebStePath != "" && oldWebStePath != siteDir && fileOp.Stat(oldWebStePath) {
 				t.Log(i18n.GetWithName("MoveSiteDir", siteDir))
 				if fileOp.Stat(siteDir) {
 					if fileOp.Stat(path.Join(siteDir, "conf.d")) {
-						_ = fileOp.Rename(path.Join(siteDir, "conf.d"), path.Join(siteDir, "conf.d.bak"))
+						_ = movePath(path.Join(siteDir, "conf.d"), path.Join(siteDir, "conf.d.bak"))
 					}
 					if fileOp.Stat(path.Join(siteDir, "sites")) {
-						_ = fileOp.Rename(path.Join(siteDir, "sites"), path.Join(siteDir, "sites.bak"))
+						_ = movePath(path.Join(siteDir, "sites"), path.Join(siteDir, "sites.bak"))
 					}
-					if err := fileOp.Rename(path.Join(oldWebStePath, "sites"), path.Join(siteDir, "sites")); err != nil {
+					if err := movePath(path.Join(oldWebStePath, "sites"), path.Join(siteDir, "sites")); err != nil {
 						return err
 					}
-					if err := fileOp.Rename(path.Join(oldWebStePath, "conf.d"), path.Join(siteDir, "conf.d")); err != nil {
+					if err := movePath(path.Join(oldWebStePath, "conf.d"), path.Join(siteDir, "conf.d")); err != nil {
 						return err
 					}
 				} else {
-					err := fileOp.Rename(oldWebStePath, siteDir)
+					err := movePath(oldWebStePath, siteDir)
 					if err != nil {
 						return err
 					}
@@ -2092,15 +2158,21 @@ func handleSSLConfig(appInstall *model.AppInstall, hasDefaultWebsite bool, sslRe
 	return nil
 }
 
-func SyncTags(remoteProperties dto.ExtraProperties) error {
+func SyncTags(remoteProperties dto.ExtraProperties) (err error) {
 	tx, ctx := getTxAndContext()
-	defer tx.Rollback()
-	localTags, _ := tagRepo.All()
+	defer func() {
+		if err != nil {
+			tx.Rollback()
+		}
+	}()
+	localTags, err := tagRepo.All()
+	if err != nil {
+		return err
+	}
 	localTagsMap := make(map[string]*model.Tag)
 	for i := range localTags {
 		localTagsMap[localTags[i].Key] = &localTags[i]
 	}
-	var err error
 	remoteTagsMap := make(map[string]*dto.Tag)
 	for i := range remoteProperties.Tags {
 		remoteTagsMap[remoteProperties.Tags[i].Key] = &remoteProperties.Tags[i]
@@ -2108,7 +2180,9 @@ func SyncTags(remoteProperties dto.ExtraProperties) error {
 
 	for key, localTag := range localTagsMap {
 		if _, exists := remoteTagsMap[key]; !exists {
-			_ = tagRepo.DeleteByID(ctx, localTag.ID)
+			if err = tagRepo.DeleteByID(ctx, localTag.ID); err != nil {
+				return err
+			}
 		}
 	}
 
@@ -2138,7 +2212,9 @@ func SyncTags(remoteProperties dto.ExtraProperties) error {
 		}
 	}
 
-	tx.Commit()
+	if err = tx.Commit().Error; err != nil {
+		return err
+	}
 	return nil
 }
 

agent/app/service/backup.go

@@ -57,6 +57,11 @@ type IBackupService interface {
 
 	AppBackup(db dto.CommonBackup) (*model.BackupRecord, error)
 	AppRecover(req dto.CommonRecover) error
+
+	ContainerBackup(req dto.CommonBackup) error
+	ContainerRecover(req dto.CommonRecover) error
+	ComposeBackup(req dto.CommonBackup) error
+	ComposeRecover(req dto.CommonRecover) error
 }
 
 func NewIBackupService() IBackupService {
@@ -72,7 +77,7 @@ func (u *BackupService) GetLocalDir() (string, error) {
 }
 
 func (u *BackupService) SearchWithPage(req dto.SearchPageWithType) (int64, interface{}, error) {
-	options := []repo.DBOption{repo.WithOrderBy("created_at desc")}
+	options := []repo.DBOption{repo.WithOrderDesc("created_at")}
 	if len(req.Type) != 0 {
 		options = append(options, repo.WithByType(req.Type))
 	}
@@ -372,7 +377,7 @@ func (u *BackupService) checkBackupConn(backup *model.BackupAccount) (bool, erro
 }
 
 func (u *BackupService) LoadBackupOptions() ([]dto.BackupOption, error) {
-	accounts, err := backupRepo.List(repo.WithOrderBy("created_at desc"))
+	accounts, err := backupRepo.List(repo.WithOrderDesc("created_at"))
 	if err != nil {
 		return nil, err
 	}
@@ -535,7 +540,7 @@ func loadRefreshTokenByCode(backup *model.BackupAccount) (string, error) {
 	if err := json.Unmarshal([]byte(backup.Vars), &varMap); err != nil {
 		return "", fmt.Errorf("unmarshal backup vars failed, err: %v", err)
 	}
-	if _, ok := varMap["refresh_token"]; ok {
+	if token, ok := varMap["refresh_token"]; ok && len(token.(string)) != 0 {
 		return "", nil
 	}
 	refreshToken := ""

agent/app/service/backup_app.go

@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/app/repo"
+	"github.com/subosito/gotenv"
 
 	"github.com/1Panel-dev/1Panel/agent/app/task"
 	"github.com/1Panel-dev/1Panel/agent/i18n"
@@ -179,6 +180,9 @@ func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverF
 			return err
 		}
 		tmpPath := strings.ReplaceAll(recoverFile, ".tar.gz", "")
+		if err := fileOp.TarGzExtractPro(tmpPath+"/app.tar.gz", tmpPath, ""); err != nil {
+			return err
+		}
 		defer func() {
 			_, _ = compose.Up(install.GetComposePath())
 			_ = os.RemoveAll(strings.ReplaceAll(recoverFile, ".tar.gz", ""))
@@ -187,19 +191,26 @@ func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverF
 		if !fileOp.Stat(tmpPath+"/app.json") || !fileOp.Stat(tmpPath+"/app.tar.gz") {
 			return errors.New(i18n.GetMsgByKey("AppBackupFileIncomplete"))
 		}
-		var oldInstall model.AppInstall
+		var backupInstall model.AppInstall
 		appJson, err := os.ReadFile(tmpPath + "/app.json")
 		if err != nil {
 			return err
 		}
-		if err := json.Unmarshal(appJson, &oldInstall); err != nil {
+		if err := json.Unmarshal(appJson, &backupInstall); err != nil {
 			return fmt.Errorf("unmarshal app.json failed, err: %v", err)
 		}
-		if oldInstall.App.Key != install.App.Key || oldInstall.Name != install.Name {
+		if backupInstall.App.Key != install.App.Key || backupInstall.Name != install.Name {
 			return errors.New(i18n.GetMsgByKey("AppAttributesNotMatch"))
 		}
-
-		newEnvFile := ""
+		backupEnvMap, err := getEnvMapByPath(path.Join(tmpPath, install.Name, ".env"))
+		if err != nil {
+			return err
+		}
+		installedEnvMap, err := getEnvMapByPath(install.GetEnvPath())
+		if err != nil {
+			return err
+		}
+		var mergedEnvContent string
 		resources, _ := appInstallResourceRepo.GetBy(appInstallResourceRepo.WithAppInstallId(install.ID))
 		for _, resource := range resources {
 			var database model.Database
@@ -225,11 +236,20 @@ func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverF
 				if err != nil {
 					return err
 				}
+				newDB, err := reCreatePostgresqlDB(db.ID, database, backupEnvMap)
+				if err != nil {
+					return err
+				}
+				backupInstall.Env, mergedEnvContent, err = buildRecoverEnv(backupInstall.Env, backupEnvMap, installedEnvMap)
+				if err != nil {
+					return err
+				}
+				_ = appInstallResourceRepo.BatchUpdateBy(map[string]interface{}{"resource_id": newDB.ID}, repo.WithByID(resource.ID))
 				taskName := task.GetTaskName(db.Name, task.TaskRecover, task.TaskScopeDatabase)
 				t.LogStart(taskName)
 				if err := handlePostgresqlRecover(dto.CommonRecover{
-					Name:       database.Name,
-					DetailName: db.Name,
+					Name:       newDB.PostgresqlName,
+					DetailName: newDB.Name,
 					File:       fmt.Sprintf("%s/%s.sql.gz", tmpPath, install.Name),
 				}, parentTask, true); err != nil {
 					t.LogFailedWithErr(taskName, err)
@@ -241,15 +261,11 @@ func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverF
 				if err != nil {
 					return err
 				}
-				newDB, envMap, err := reCreateDB(db.ID, database, oldInstall.Env)
+				newDB, err := reCreateDB(db.ID, database, backupEnvMap)
 				if err != nil {
 					return err
 				}
-				oldHost := fmt.Sprintf("\"PANEL_DB_HOST\":\"%v\"", envMap["PANEL_DB_HOST"].(string))
-				newHost := fmt.Sprintf("\"PANEL_DB_HOST\":\"%v\"", database.Address)
-				oldInstall.Env = strings.ReplaceAll(oldInstall.Env, oldHost, newHost)
-				envMap["PANEL_DB_HOST"] = database.Address
-				newEnvFile, err = coverEnvJsonToStr(oldInstall.Env)
+				backupInstall.Env, mergedEnvContent, err = buildRecoverEnv(backupInstall.Env, backupEnvMap, installedEnvMap)
 				if err != nil {
 					return err
 				}
@@ -284,22 +300,22 @@ func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverF
 		t.LogSuccess(deCompressName)
 		_ = fileOp.DeleteDir(backPath)
 
-		if len(newEnvFile) != 0 {
+		if len(mergedEnvContent) != 0 {
 			envPath := fmt.Sprintf("%s/%s/.env", install.GetAppPath(), install.Name)
 			file, err := os.OpenFile(envPath, os.O_WRONLY|os.O_TRUNC, 0640)
 			if err != nil {
 				return err
 			}
 			defer file.Close()
-			_, _ = file.WriteString(newEnvFile)
+			_, _ = file.WriteString(mergedEnvContent)
 		}
 
-		oldInstall.ID = install.ID
-		oldInstall.Status = constant.StatusRunning
-		oldInstall.AppId = install.AppId
-		oldInstall.AppDetailId = install.AppDetailId
-		oldInstall.App.ID = install.AppId
-		if err := appInstallRepo.Save(context.Background(), &oldInstall); err != nil {
+		backupInstall.ID = install.ID
+		backupInstall.Status = constant.StatusRunning
+		backupInstall.AppId = install.AppId
+		backupInstall.AppDetailId = install.AppDetailId
+		backupInstall.App.ID = install.AppId
+		if err := appInstallRepo.Save(context.Background(), &backupInstall); err != nil {
 			global.LOG.Errorf("save db app install failed, err: %v", err)
 			return err
 		}
@@ -373,33 +389,131 @@ func doAppBackup(install *model.AppInstall, parentTask *task.Task, backupDir, fi
 	return nil
 }
 
-func reCreateDB(dbID uint, database model.Database, oldEnv string) (*model.DatabaseMysql, map[string]interface{}, error) {
+func reCreateDB(dbID uint, database model.Database, envMap map[string]interface{}) (*model.DatabaseMysql, error) {
 	mysqlService := NewIMysqlService()
 	ctx := context.Background()
 	_ = mysqlService.Delete(ctx, dto.MysqlDBDelete{ID: dbID, Database: database.Name, Type: database.Type, DeleteBackup: false, ForceDelete: true})
 
-	envMap := make(map[string]interface{})
-	if err := json.Unmarshal([]byte(oldEnv), &envMap); err != nil {
-		return nil, envMap, err
-	}
-	oldName, _ := envMap["PANEL_DB_NAME"].(string)
-	oldUser, _ := envMap["PANEL_DB_USER"].(string)
-	oldPassword, _ := envMap["PANEL_DB_USER_PASSWORD"].(string)
+	dbInfo := getDBCreateInfoFromEnv(envMap, "utf8mb4")
 	createDB, err := mysqlService.Create(context.Background(), dto.MysqlDBCreate{
-		Name:       oldName,
+		Name:       dbInfo.Name,
 		From:       database.From,
 		Database:   database.Name,
-		Format:     "utf8mb4",
-		Username:   oldUser,
-		Password:   oldPassword,
+		Format:     dbInfo.Format,
+		Username:   dbInfo.User,
+		Password:   dbInfo.Password,
 		Permission: "%",
 	})
-	cronjobs, _ := cronjobRepo.List(cronjobRepo.WithByDbName(fmt.Sprintf("%v", dbID)))
-	for _, job := range cronjobs {
-		_ = cronjobRepo.Update(job.ID, map[string]interface{}{"db_name": fmt.Sprintf("%v", createDB.ID)})
-	}
 	if err != nil {
-		return nil, envMap, err
+		return nil, err
 	}
-	return createDB, envMap, nil
+	updateCronjobsDBRef(dbID, createDB.ID)
+	return createDB, nil
+}
+
+func reCreatePostgresqlDB(dbID uint, database model.Database, envMap map[string]interface{}) (*model.DatabasePostgresql, error) {
+	postgresqlService := NewIPostgresqlService()
+	_ = postgresqlService.Delete(context.Background(), dto.PostgresqlDBDelete{
+		ID:           dbID,
+		Type:         database.Type,
+		Database:     database.Name,
+		DeleteBackup: false,
+		ForceDelete:  true,
+	})
+
+	dbInfo := getDBCreateInfoFromEnv(envMap, "UTF8")
+	createDB, err := postgresqlService.Create(context.Background(), dto.PostgresqlDBCreate{
+		Name:      dbInfo.Name,
+		From:      database.From,
+		Database:  database.Name,
+		Format:    dbInfo.Format,
+		Username:  dbInfo.User,
+		Password:  dbInfo.Password,
+		SuperUser: true,
+	})
+	if err != nil {
+		return nil, err
+	}
+	updateCronjobsDBRef(dbID, createDB.ID)
+	return createDB, nil
+}
+
+type dbRecreateInfo struct {
+	Name     string
+	User     string
+	Password string
+	Format   string
+}
+
+func getDBCreateInfoFromEnv(envMap map[string]interface{}, defaultFormat string) dbRecreateInfo {
+	name, _ := envMap["PANEL_DB_NAME"].(string)
+	user, _ := envMap["PANEL_DB_USER"].(string)
+	password, _ := envMap["PANEL_DB_USER_PASSWORD"].(string)
+	format, _ := envMap["format"].(string)
+	if len(format) == 0 {
+		format = defaultFormat
+	}
+	return dbRecreateInfo{
+		Name:     name,
+		User:     user,
+		Password: password,
+		Format:   format,
+	}
+}
+
+func updateCronjobsDBRef(oldDBID, newDBID uint) {
+	cronjobs, _ := cronjobRepo.List(cronjobRepo.WithByDbName(fmt.Sprintf("%v", oldDBID)))
+	for _, job := range cronjobs {
+		_ = cronjobRepo.Update(job.ID, map[string]interface{}{"db_name": fmt.Sprintf("%v", newDBID)})
+	}
+}
+
+func buildRecoverEnv(appEnv string, backupEnvMap, installedEnvMap map[string]interface{}) (string, string, error) {
+	currentHostVal, hasCurrentHost := installedEnvMap["PANEL_DB_HOST"]
+	if hasCurrentHost && fmt.Sprintf("%v", currentHostVal) != "" {
+		backupHost := fmt.Sprintf("\"PANEL_DB_HOST\":\"%v\"", backupEnvMap["PANEL_DB_HOST"])
+		currentHost := fmt.Sprintf("\"PANEL_DB_HOST\":\"%v\"", currentHostVal)
+		appEnv = strings.ReplaceAll(appEnv, backupHost, currentHost)
+		if _, ok := backupEnvMap["CASDOOR_DATASOURCE_NAME"]; ok {
+			backupEnvMap["CASDOOR_DATASOURCE_NAME"] = strings.ReplaceAll(
+				fmt.Sprintf("%v", backupEnvMap["CASDOOR_DATASOURCE_NAME"]),
+				fmt.Sprintf("%v", backupEnvMap["PANEL_DB_HOST"]),
+				fmt.Sprintf("%v", currentHostVal),
+			)
+		}
+		backupEnvMap["PANEL_DB_HOST"] = currentHostVal
+	}
+	newEnvMap := make(map[string]string, len(backupEnvMap))
+	handleMap(backupEnvMap, newEnvMap)
+	mergedEnvContent, err := gotenv.Marshal(newEnvMap)
+	if err != nil {
+		return appEnv, "", err
+	}
+	return appEnv, mergedEnvContent, nil
+}
+
+func getEnvMapByPath(envPath string) (map[string]interface{}, error) {
+	envMap := make(map[string]interface{})
+	envFile, err := os.ReadFile(envPath)
+	if err != nil {
+		return envMap, err
+	}
+	lines := strings.Split(string(envFile), "\n")
+	for _, line := range lines {
+		line = strings.TrimSpace(line)
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		parts := strings.SplitN(line, "=", 2)
+		if len(parts) == 2 {
+			value := strings.TrimSpace(parts[1])
+			if len(value) >= 2 {
+				if (value[0] == '"' && value[len(value)-1] == '"') || (value[0] == '\'' && value[len(value)-1] == '\'') {
+					value = value[1 : len(value)-1]
+				}
+			}
+			envMap[parts[0]] = value
+		}
+	}
+	return envMap, nil
 }

agent/app/service/backup_compose.go

@@ -0,0 +1,707 @@
+package service
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io/fs"
+	"os"
+	"path"
+	"path/filepath"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/app/repo"
+	"github.com/1Panel-dev/1Panel/agent/app/task"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/i18n"
+	"github.com/1Panel-dev/1Panel/agent/utils/common"
+	"github.com/1Panel-dev/1Panel/agent/utils/compose"
+	dockerUtils "github.com/1Panel-dev/1Panel/agent/utils/docker"
+	"github.com/1Panel-dev/1Panel/agent/utils/files"
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/filters"
+	"github.com/docker/docker/client"
+)
+
+type composeBackupFile struct {
+	OriginalPath string `json:"originalPath"`
+	FileName     string `json:"fileName"`
+	RelativePath string `json:"relativePath,omitempty"`
+	BackupPath   string `json:"backupPath"`
+}
+
+type composeBackupMeta struct {
+	ComposeName string              `json:"composeName"`
+	ComposePath string              `json:"composePath"`
+	CreatedAt   string              `json:"createdAt"`
+	Files       []composeBackupFile `json:"files"`
+	Containers  []string            `json:"containers"`
+}
+
+type composeBackupContext struct {
+	req          dto.CommonBackup
+	composeName  string
+	composePath  string
+	composeFiles []string
+	composeDir   string
+	fileOp       files.FileOp
+	dockerClient *client.Client
+	stopped      bool
+	backupDir    string
+	fileName     string
+	filePath     string
+	tmpDir       string
+	meta         composeBackupMeta
+}
+
+type composeRecoverContext struct {
+	req         dto.CommonRecover
+	fileOp      files.FileOp
+	tmpDir      string
+	meta        composeBackupMeta
+	composeName string
+	targetDir   string
+	composePath string
+	enqueued    bool
+}
+
+func (u *BackupService) ComposeBackup(req dto.CommonBackup) error {
+	timeNow := time.Now().Format(constant.DateTimeSlimLayout) + common.RandStrAndNum(5)
+	fileName := req.FileName
+	if fileName == "" {
+		fileName = fmt.Sprintf("%s_%s.tar.gz", req.Name, timeNow)
+	}
+	if !strings.HasSuffix(fileName, ".tar.gz") {
+		fileName += ".tar.gz"
+	}
+	itemDir := fmt.Sprintf("compose/%s", req.Name)
+	backupDir := path.Join(global.Dir.LocalBackupDir, itemDir)
+	record := &model.BackupRecord{
+		Type:              req.Type,
+		Name:              req.Name,
+		SourceAccountIDs:  "1",
+		DownloadAccountID: 1,
+		FileDir:           itemDir,
+		FileName:          fileName,
+		TaskID:            req.TaskID,
+		Status:            constant.StatusWaiting,
+		Description:       req.Description,
+	}
+	if err := backupRepo.CreateRecord(record); err != nil {
+		global.LOG.Errorf("save compose backup record failed, err: %v", err)
+		return err
+	}
+	if err := handleComposeBackup(req, nil, record.ID, backupDir, fileName); err != nil {
+		backupRepo.UpdateRecordByMap(record.ID, map[string]interface{}{"status": constant.StatusFailed, "message": err.Error()})
+		return err
+	}
+	return nil
+}
+
+func (u *BackupService) ComposeRecover(req dto.CommonRecover) error {
+	return handleComposeRecover(req, nil)
+}
+
+func handleComposeBackup(req dto.CommonBackup, parentTask *task.Task, recordID uint, backupDir, fileName string) error {
+	composeCtx, err := newComposeBackupContext(req, backupDir, fileName)
+	if err != nil {
+		return err
+	}
+	containerNames, err := loadComposeContainerNames(composeCtx)
+	if err != nil {
+		composeCtx.close()
+		return err
+	}
+
+	backupTask := parentTask
+	if backupTask == nil {
+		backupTask, err = task.NewTaskWithOps(composeCtx.composeName, task.TaskBackup, task.TaskScopeBackup, req.TaskID, 1)
+		if err != nil {
+			return err
+		}
+	}
+	if req.StopBefore {
+		backupTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeBackupStop"), func(t *task.Task) error {
+			return stepStopComposeForBackup(composeCtx)
+		}, func(t *task.Task) {
+			_ = stepStartComposeAfterBackup(composeCtx)
+		}, 3, time.Hour)
+	}
+	backupTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeBackupPrepare"), func(t *task.Task) error { return stepPrepareComposeBackup(composeCtx) }, nil, 3, time.Hour)
+	backupTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeBackupFiles"), func(t *task.Task) error { return stepBackupComposeFiles(composeCtx) }, nil, 3, time.Hour)
+	backupTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeBackupContainers"), func(t *task.Task) error { return nil }, nil, 3, time.Hour)
+	for _, containerName := range containerNames {
+		backupFileName := fmt.Sprintf("%s.tar.gz", sanitizeComposeFileName(containerName))
+		backupFile := path.Join(composeCtx.tmpDir, "containers", backupFileName)
+		if err := handleContainerBackup(containerName, backupTask, 0, path.Dir(backupFile), path.Base(backupFile), "", "", false); err != nil {
+			return err
+		}
+		composeCtx.meta.Containers = append(composeCtx.meta.Containers, path.Join("containers", backupFileName))
+	}
+	backupTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeBackupMeta"), func(t *task.Task) error { return stepWriteComposeBackupMeta(composeCtx) }, nil, 3, time.Hour)
+	backupTask.AddSubTaskWithOps(task.GetTaskName(composeCtx.composeName, task.TaskBackup, task.TaskScopeBackup), func(t *task.Task) error {
+		return stepPackComposeBackup(composeCtx)
+	}, nil, 3, time.Hour)
+	if req.StopBefore {
+		backupTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeBackupStart"), func(t *task.Task) error {
+			return stepStartComposeAfterBackup(composeCtx)
+		}, nil, 3, time.Hour)
+	}
+	backupTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeBackupCleanup"), func(t *task.Task) error {
+		composeCtx.close()
+		return nil
+	}, nil, 0, time.Hour)
+	if parentTask != nil {
+		return nil
+	}
+	go func() {
+		defer composeCtx.close()
+		if err := backupTask.Execute(); err != nil {
+			backupRepo.UpdateRecordByMap(recordID, map[string]interface{}{"status": constant.StatusFailed, "message": err.Error()})
+			return
+		}
+		backupRepo.UpdateRecordByMap(recordID, map[string]interface{}{"status": constant.StatusSuccess})
+	}()
+	return nil
+}
+
+func loadComposeContainerNames(composeCtx *composeBackupContext) ([]string, error) {
+	options := container.ListOptions{All: true}
+	options.Filters = filters.NewArgs(filters.Arg("label", composeProjectLabel+"="+composeCtx.composeName))
+	containers, err := composeCtx.dockerClient.ContainerList(context.Background(), options)
+	if err != nil {
+		return nil, err
+	}
+	names := make([]string, 0, len(containers))
+	for _, item := range containers {
+		if len(item.Names) == 0 {
+			continue
+		}
+		names = append(names, strings.TrimPrefix(item.Names[0], "/"))
+	}
+	sort.Strings(names)
+	return names, nil
+}
+
+func handleComposeRecover(req dto.CommonRecover, parentTask *task.Task) error {
+	var recoverCtx *composeRecoverContext
+
+	recoverTask := parentTask
+	var err error
+	if recoverTask == nil {
+		if isImportRecover(req) {
+			taskName := i18n.GetMsgByKey("TaskImport") + i18n.GetMsgByKey("Compose")
+			recoverTask, err = task.NewTask(taskName, task.TaskImport, task.TaskScopeBackup, req.TaskID, 1)
+			if err != nil {
+				return err
+			}
+		} else {
+			taskName := req.Name
+			if taskName == "" {
+				taskName = "compose"
+			}
+			recoverTask, err = task.NewTaskWithOps(taskName, task.TaskRecover, task.TaskScopeBackup, req.TaskID, 1)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	timeout := loadRecoverTimeout(req.Timeout)
+	recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeRecoverPrepare"), func(t *task.Task) error {
+		ctx, err := newComposeRecoverContext(req)
+		if err != nil {
+			return err
+		}
+		recoverCtx = ctx
+		if err := stepPrepareComposeRecover(recoverCtx); err != nil {
+			recoverCtx.close()
+			recoverCtx = nil
+			return err
+		}
+		return nil
+	}, func(t *task.Task) {
+		if recoverCtx != nil {
+			recoverCtx.close()
+			recoverCtx = nil
+		}
+	}, 3, timeout)
+	recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeRecoverExtract"), func(t *task.Task) error { return stepExtractComposeRecover(recoverCtx) }, nil, 3, timeout)
+	recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeRecoverMeta"), func(t *task.Task) error {
+		if err := stepLoadComposeRecoverMeta(recoverCtx); err != nil {
+			return err
+		}
+		t.Log(i18n.GetMsgWithMap("ComposeRecoverMetaLogName", map[string]interface{}{
+			"name": recoverCtx.composeName,
+		}))
+		t.Log(i18n.GetMsgWithMap("ComposeRecoverMetaLogPath", map[string]interface{}{
+			"backupPath": recoverCtx.meta.ComposePath,
+			"targetDir":  recoverCtx.targetDir,
+		}))
+		t.Log(i18n.GetMsgWithMap("ComposeRecoverMetaLogCount", map[string]interface{}{
+			"files":      len(recoverCtx.meta.Files),
+			"containers": len(recoverCtx.meta.Containers),
+		}))
+		return nil
+	}, nil, 3, timeout)
+	recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeRecoverFiles"), func(t *task.Task) error { return stepRestoreComposeFiles(recoverCtx) }, nil, 3, timeout)
+	recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeRecoverContainers"), func(t *task.Task) error {
+		if recoverCtx.enqueued {
+			return nil
+		}
+		containerItems := make([]string, 0, len(recoverCtx.meta.Containers))
+		for _, item := range recoverCtx.meta.Containers {
+			backupItem := item
+			filePath, err := safeJoinWithinBase(recoverCtx.tmpDir, backupItem)
+			if err != nil {
+				return fmt.Errorf("invalid container backup path %q, err: %v", backupItem, err)
+			}
+			if !recoverCtx.fileOp.Stat(filePath) {
+				return fmt.Errorf("container backup file not found: %s", backupItem)
+			}
+			containerItems = append(containerItems, backupItem)
+		}
+		for _, backupItem := range containerItems {
+			filePath, err := safeJoinWithinBase(recoverCtx.tmpDir, backupItem)
+			if err != nil {
+				return fmt.Errorf("invalid container backup path %q, err: %v", backupItem, err)
+			}
+			containerLabel := strings.TrimSuffix(path.Base(backupItem), ".tar.gz")
+			containerReq := recoverCtx.req
+			containerReq.Type = "container"
+			containerReq.Name = containerLabel
+			containerReq.DetailName = ""
+			containerReq.File = filePath
+			containerReq.Secret = ""
+			if err := handleContainerRecover(containerReq, recoverTask); err != nil {
+				return err
+			}
+		}
+		recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeRecoverRecord"), func(t *task.Task) error {
+			return stepSaveComposeRecord(recoverCtx)
+		}, nil, 3, timeout)
+		recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeRecoverCleanup"), func(t *task.Task) error {
+			if recoverCtx != nil {
+				recoverCtx.close()
+				recoverCtx = nil
+			}
+			return nil
+		}, nil, 0, timeout)
+		recoverCtx.enqueued = true
+		return nil
+	}, nil, 3, timeout)
+	if parentTask != nil {
+		return nil
+	}
+	go func() {
+		_ = recoverTask.Execute()
+	}()
+	return nil
+}
+
+func newComposeBackupContext(req dto.CommonBackup, backupDir, fileName string) (*composeBackupContext, error) {
+	if req.Name == "" {
+		return nil, fmt.Errorf("compose name is required")
+	}
+	dockerClient, err := dockerUtils.NewDockerClient()
+	if err != nil {
+		return nil, err
+	}
+	composePath, composeFiles, err := loadComposePathAndFiles(req.Name, dockerClient)
+	if err != nil {
+		_ = dockerClient.Close()
+		return nil, err
+	}
+	filePath := path.Join(backupDir, fileName)
+	tmpDir := path.Join(path.Dir(filePath), strings.TrimSuffix(path.Base(filePath), ".tar.gz"))
+	ctx := &composeBackupContext{
+		req:          req,
+		composeName:  req.Name,
+		composePath:  composePath,
+		composeFiles: composeFiles,
+		composeDir:   path.Dir(composeFiles[0]),
+		fileOp:       files.NewFileOp(),
+		dockerClient: dockerClient,
+		backupDir:    backupDir,
+		fileName:     fileName,
+		filePath:     filePath,
+		tmpDir:       tmpDir,
+		meta: composeBackupMeta{
+			ComposeName: req.Name,
+			ComposePath: composePath,
+			CreatedAt:   time.Now().Format(constant.DateTimeLayout),
+			Files:       make([]composeBackupFile, 0),
+			Containers:  make([]string, 0),
+		},
+	}
+	return ctx, nil
+}
+
+func loadComposePathAndFiles(composeName string, dockerClient *client.Client) (string, []string, error) {
+	composeRecord, _ := composeRepo.GetRecord(repo.WithByName(composeName))
+	if composeRecord.ID == 0 {
+		composeRecord, _ = composeRepo.GetRecord(repo.WithByName(strings.ToLower(composeName)))
+	}
+	composePath := composeRecord.Path
+	if composePath == "" {
+		options := container.ListOptions{All: true}
+		options.Filters = filters.NewArgs(filters.Arg("label", composeProjectLabel))
+		list, err := dockerClient.ContainerList(context.Background(), options)
+		if err != nil {
+			return "", nil, err
+		}
+		if len(list) == 0 {
+			return "", nil, fmt.Errorf("compose %s not found", composeName)
+		}
+		var targetContainer *container.Summary
+		for i := range list {
+			if strings.EqualFold(list[i].Labels[composeProjectLabel], composeName) {
+				targetContainer = &list[i]
+				break
+			}
+		}
+		if targetContainer == nil {
+			return "", nil, fmt.Errorf("compose %s not found", composeName)
+		}
+		config := targetContainer.Labels[composeConfigLabel]
+		workdir := targetContainer.Labels[composeWorkdirLabel]
+		if len(config) != 0 && len(workdir) != 0 && strings.Contains(config, workdir) {
+			composePath = config
+		} else {
+			composePath = workdir
+		}
+	}
+	composeFiles := normalizeComposeFiles(composePath)
+	if len(composeFiles) == 0 {
+		return "", nil, fmt.Errorf("compose file not found for %s", composeName)
+	}
+	return composePath, composeFiles, nil
+}
+
+func normalizeComposeFiles(composePath string) []string {
+	items := strings.Split(composePath, ",")
+	result := make([]string, 0)
+	seen := make(map[string]struct{})
+	for _, item := range items {
+		item = strings.TrimSpace(item)
+		if item == "" {
+			continue
+		}
+		stat, err := os.Stat(item)
+		if err == nil && stat.IsDir() {
+			item = path.Join(item, "docker-compose.yml")
+		}
+		if _, err := os.Stat(item); err != nil {
+			continue
+		}
+		if _, ok := seen[item]; ok {
+			continue
+		}
+		seen[item] = struct{}{}
+		result = append(result, item)
+	}
+	sort.Strings(result)
+	return result
+}
+
+func (c *composeBackupContext) close() {
+	if c.dockerClient != nil {
+		_ = c.dockerClient.Close()
+		c.dockerClient = nil
+	}
+	if c.tmpDir != "" {
+		_ = os.RemoveAll(c.tmpDir)
+		c.tmpDir = ""
+	}
+}
+
+func stepPrepareComposeBackup(composeCtx *composeBackupContext) error {
+	if err := os.MkdirAll(composeCtx.backupDir, os.ModePerm); err != nil {
+		return fmt.Errorf("mkdir %s failed, err: %v", composeCtx.backupDir, err)
+	}
+	_ = os.RemoveAll(composeCtx.tmpDir)
+	if err := os.MkdirAll(path.Join(composeCtx.tmpDir, "compose_files"), os.ModePerm); err != nil {
+		return err
+	}
+	if err := os.MkdirAll(path.Join(composeCtx.tmpDir, "containers"), os.ModePerm); err != nil {
+		return err
+	}
+	return nil
+}
+
+func stepStopComposeForBackup(composeCtx *composeBackupContext) error {
+	if composeCtx.stopped {
+		return nil
+	}
+	options := container.ListOptions{All: false}
+	options.Filters = filters.NewArgs(filters.Arg("label", composeProjectLabel+"="+composeCtx.composeName))
+	runningList, err := composeCtx.dockerClient.ContainerList(context.Background(), options)
+	if err != nil {
+		return err
+	}
+	if len(runningList) == 0 {
+		return nil
+	}
+	if stdout, err := compose.Operate(composeCtx.composePath, "stop"); err != nil {
+		return fmt.Errorf("docker-compose stop failed, std: %s, err: %v", stdout, err)
+	}
+	composeCtx.stopped = true
+	return nil
+}
+
+func stepStartComposeAfterBackup(composeCtx *composeBackupContext) error {
+	if !composeCtx.stopped {
+		return nil
+	}
+	if stdout, err := compose.Up(composeCtx.composePath); err != nil {
+		return fmt.Errorf("docker-compose up failed, std: %s, err: %v", stdout, err)
+	}
+	composeCtx.stopped = false
+	return nil
+}
+
+func stepBackupComposeFiles(composeCtx *composeBackupContext) error {
+	for i, filePath := range composeCtx.composeFiles {
+		backupName := fmt.Sprintf("%02d_%s", i, path.Base(filePath))
+		backupPath := path.Join(composeCtx.tmpDir, "compose_files", backupName)
+		content, err := os.ReadFile(filePath)
+		if err != nil {
+			return err
+		}
+		if err := composeCtx.fileOp.SaveFile(backupPath, string(content), fs.ModePerm); err != nil {
+			return err
+		}
+		relativePath := path.Base(filePath)
+		if composeCtx.composeDir != "" {
+			rel, relErr := filepath.Rel(composeCtx.composeDir, filePath)
+			if relErr == nil {
+				rel = filepath.ToSlash(rel)
+				if rel != "" && rel != "." && !strings.HasPrefix(rel, "../") {
+					relativePath = rel
+				}
+			}
+		}
+		composeCtx.meta.Files = append(composeCtx.meta.Files, composeBackupFile{
+			OriginalPath: filePath,
+			FileName:     path.Base(filePath),
+			RelativePath: relativePath,
+			BackupPath:   path.Join("compose_files", backupName),
+		})
+	}
+	if len(composeCtx.composeFiles) != 0 {
+		envPath := path.Join(path.Dir(composeCtx.composeFiles[0]), ".env")
+		if composeCtx.fileOp.Stat(envPath) {
+			envContent, err := os.ReadFile(envPath)
+			if err != nil {
+				return err
+			}
+			if err := composeCtx.fileOp.SaveFile(path.Join(composeCtx.tmpDir, "compose_files", ".env"), string(envContent), fs.ModePerm); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func stepWriteComposeBackupMeta(composeCtx *composeBackupContext) error {
+	metaBytes, err := json.MarshalIndent(composeCtx.meta, "", "  ")
+	if err != nil {
+		return err
+	}
+	return composeCtx.fileOp.SaveFile(path.Join(composeCtx.tmpDir, "compose_meta.json"), string(metaBytes), fs.ModePerm)
+}
+
+func stepPackComposeBackup(composeCtx *composeBackupContext) error {
+	return composeCtx.fileOp.TarGzCompressPro(true, composeCtx.tmpDir, composeCtx.filePath, composeCtx.req.Secret, "")
+}
+
+func newComposeRecoverContext(req dto.CommonRecover) (*composeRecoverContext, error) {
+	tmpDir := path.Join(path.Dir(req.File), strings.TrimSuffix(path.Base(req.File), ".tar.gz"))
+	ctx := &composeRecoverContext{
+		req:    req,
+		fileOp: files.NewFileOp(),
+		tmpDir: tmpDir,
+		meta: composeBackupMeta{
+			Files:      make([]composeBackupFile, 0),
+			Containers: make([]string, 0),
+		},
+	}
+	return ctx, nil
+}
+
+func (c *composeRecoverContext) close() {
+	if c.tmpDir != "" {
+		_ = os.RemoveAll(c.tmpDir)
+	}
+}
+
+func stepPrepareComposeRecover(recoverCtx *composeRecoverContext) error {
+	if !recoverCtx.fileOp.Stat(recoverCtx.req.File) {
+		return buserr.WithName("ErrFileNotFound", recoverCtx.req.File)
+	}
+	_ = os.RemoveAll(recoverCtx.tmpDir)
+	return nil
+}
+
+func stepExtractComposeRecover(recoverCtx *composeRecoverContext) error {
+	return recoverCtx.fileOp.TarGzExtractPro(recoverCtx.req.File, path.Dir(recoverCtx.req.File), recoverCtx.req.Secret)
+}
+
+func stepLoadComposeRecoverMeta(recoverCtx *composeRecoverContext) error {
+	metaPath := path.Join(recoverCtx.tmpDir, "compose_meta.json")
+	if !recoverCtx.fileOp.Stat(metaPath) {
+		return fmt.Errorf("compose_meta.json not found in backup file")
+	}
+	metaBytes, err := os.ReadFile(metaPath)
+	if err != nil {
+		return err
+	}
+	if err := json.Unmarshal(metaBytes, &recoverCtx.meta); err != nil {
+		return fmt.Errorf("unmarshal compose_meta.json failed, err: %v", err)
+	}
+	recoverCtx.composeName = strings.TrimSpace(recoverCtx.req.Name)
+	if recoverCtx.composeName == "" {
+		recoverCtx.composeName = strings.TrimSpace(recoverCtx.meta.ComposeName)
+	}
+	if recoverCtx.composeName == "" {
+		return fmt.Errorf("compose name not found in recover request or backup file")
+	}
+	recoverCtx.targetDir = resolveComposeRecoverTargetDir(recoverCtx.meta, recoverCtx.composeName)
+	return nil
+}
+
+func resolveComposeRecoverTargetDir(meta composeBackupMeta, composeName string) string {
+	composePath := strings.TrimSpace(meta.ComposePath)
+	if composePath != "" {
+		items := strings.Split(composePath, ",")
+		for _, item := range items {
+			p := strings.TrimSpace(item)
+			if p == "" {
+				continue
+			}
+			ext := strings.ToLower(path.Ext(p))
+			if ext == ".yml" || ext == ".yaml" {
+				return path.Dir(p)
+			}
+			return p
+		}
+	}
+	return path.Join(global.Dir.DataDir, "docker/compose", composeName)
+}
+
+func safeJoinWithinBase(baseDir, name string) (string, error) {
+	base := filepath.Clean(baseDir)
+	candidate := strings.TrimSpace(name)
+	candidate = strings.ReplaceAll(candidate, "\\", "/")
+	candidate = filepath.Clean(filepath.FromSlash(candidate))
+	if candidate == "" || candidate == "." {
+		return "", fmt.Errorf("invalid path: empty")
+	}
+	if filepath.IsAbs(candidate) {
+		return "", fmt.Errorf("invalid path %q: absolute path is not allowed", name)
+	}
+	if candidate == ".." || strings.HasPrefix(candidate, ".."+string(filepath.Separator)) {
+		return "", fmt.Errorf("invalid path %q: path escapes base directory", name)
+	}
+	resolved := filepath.Clean(filepath.Join(base, candidate))
+	rel, err := filepath.Rel(base, resolved)
+	if err != nil {
+		return "", fmt.Errorf("resolve path %q failed, err: %v", name, err)
+	}
+	if rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
+		return "", fmt.Errorf("invalid path %q: path escapes base directory", name)
+	}
+	return resolved, nil
+}
+
+func stepRestoreComposeFiles(recoverCtx *composeRecoverContext) error {
+	if recoverCtx.targetDir != "" {
+		_ = os.RemoveAll(recoverCtx.targetDir)
+	}
+	if err := os.MkdirAll(recoverCtx.targetDir, os.ModePerm); err != nil {
+		return err
+	}
+	restored := make([]string, 0, len(recoverCtx.meta.Files))
+	for _, item := range recoverCtx.meta.Files {
+		backupPath, err := safeJoinWithinBase(recoverCtx.tmpDir, item.BackupPath)
+		if err != nil {
+			return fmt.Errorf("invalid compose backup path %q, err: %v", item.BackupPath, err)
+		}
+		if !recoverCtx.fileOp.Stat(backupPath) {
+			continue
+		}
+		targetName := item.FileName
+		if item.RelativePath != "" {
+			targetName = item.RelativePath
+		}
+		if targetName == "" {
+			targetName = path.Base(item.OriginalPath)
+		}
+		if targetName == "" {
+			targetName = "docker-compose.yml"
+		}
+		targetPath, err := safeJoinWithinBase(recoverCtx.targetDir, targetName)
+		if err != nil {
+			return fmt.Errorf("invalid compose target path %q, err: %v", targetName, err)
+		}
+		if err := os.MkdirAll(path.Dir(targetPath), os.ModePerm); err != nil {
+			return err
+		}
+		content, err := os.ReadFile(backupPath)
+		if err != nil {
+			return err
+		}
+		if err := recoverCtx.fileOp.SaveFile(targetPath, string(content), fs.ModePerm); err != nil {
+			return err
+		}
+		restored = append(restored, targetPath)
+	}
+	envPath := path.Join(recoverCtx.tmpDir, "compose_files", ".env")
+	if recoverCtx.fileOp.Stat(envPath) {
+		envContent, err := os.ReadFile(envPath)
+		if err != nil {
+			return err
+		}
+		if err := recoverCtx.fileOp.SaveFile(path.Join(recoverCtx.targetDir, ".env"), string(envContent), fs.ModePerm); err != nil {
+			return err
+		}
+	}
+	if len(restored) == 0 {
+		defaultPath := path.Join(recoverCtx.targetDir, "docker-compose.yml")
+		if !recoverCtx.fileOp.Stat(defaultPath) {
+			return fmt.Errorf("compose file not found in backup data")
+		}
+		restored = append(restored, defaultPath)
+	}
+	sort.Strings(restored)
+	recoverCtx.composePath = strings.Join(restored, ",")
+	return nil
+}
+
+func stepSaveComposeRecord(recoverCtx *composeRecoverContext) error {
+	if recoverCtx.composePath == "" {
+		recoverCtx.composePath = path.Join(recoverCtx.targetDir, "docker-compose.yml")
+	}
+	recordName := strings.ToLower(recoverCtx.composeName)
+	record, _ := composeRepo.GetRecord(repo.WithByName(recordName))
+	if record.ID == 0 {
+		return composeRepo.CreateRecord(&model.Compose{Name: recordName, Path: recoverCtx.composePath})
+	}
+	return composeRepo.UpdateRecord(recordName, map[string]interface{}{"path": recoverCtx.composePath})
+}
+
+func sanitizeComposeFileName(in string) string {
+	name := strings.TrimSpace(in)
+	name = strings.ReplaceAll(name, "/", "_")
+	name = strings.ReplaceAll(name, ":", "_")
+	if name == "" {
+		return "container"
+	}
+	return name
+}

agent/app/service/backup_container.go

@@ -0,0 +1,914 @@
+package service
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io/fs"
+	"os"
+	"path"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/app/task"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/i18n"
+	"github.com/1Panel-dev/1Panel/agent/utils/common"
+	dockerUtils "github.com/1Panel-dev/1Panel/agent/utils/docker"
+	"github.com/1Panel-dev/1Panel/agent/utils/files"
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/mount"
+	"github.com/docker/docker/api/types/network"
+	"github.com/docker/docker/api/types/volume"
+	"github.com/docker/docker/client"
+)
+
+type containerBackupMeta struct {
+	ContainerName string                 `json:"containerName"`
+	ContainerID   string                 `json:"containerID"`
+	CreatedAt     string                 `json:"createdAt"`
+	Image         string                 `json:"image"`
+	HostConfig    *container.HostConfig  `json:"hostConfig,omitempty"`
+	Config        *container.Config      `json:"config,omitempty"`
+	Mounts        []containerMountBackup `json:"mounts"`
+}
+
+type containerMountBackup struct {
+	Type        string `json:"type"`
+	Name        string `json:"name,omitempty"`
+	Source      string `json:"source,omitempty"`
+	Destination string `json:"destination"`
+	Mode        string `json:"mode,omitempty"`
+	RW          bool   `json:"rw"`
+	Propagation string `json:"propagation,omitempty"`
+	BackupPath  string `json:"backupPath,omitempty"`
+	Status      string `json:"status"`
+	Message     string `json:"message,omitempty"`
+}
+
+type containerBackupContext struct {
+	containerName string
+	backupDir     string
+	fileName      string
+	secret        string
+	filePath      string
+	tmpDir        string
+	mountRoot     string
+	wasRunning    bool
+	stopped       bool
+	fileOp        files.FileOp
+	inspectInfo   container.InspectResponse
+	meta          containerBackupMeta
+}
+
+type containerRecoverContext struct {
+	req                dto.CommonRecover
+	targetName         string
+	fileOp             files.FileOp
+	client             *client.Client
+	tmpDir             string
+	meta               containerBackupMeta
+	inspectInfo        container.InspectResponse
+	shouldStart        bool
+	createdContainerID string
+}
+
+func (u *BackupService) ContainerBackup(req dto.CommonBackup) error {
+	timeNow := time.Now().Format(constant.DateTimeSlimLayout) + common.RandStrAndNum(5)
+	fileName := req.FileName
+	if fileName == "" {
+		fileName = fmt.Sprintf("%s_%s.tar.gz", req.Name, timeNow)
+	}
+	if !strings.HasSuffix(fileName, ".tar.gz") {
+		fileName += ".tar.gz"
+	}
+	itemDir := fmt.Sprintf("container/%s", req.Name)
+	backupDir := path.Join(global.Dir.LocalBackupDir, itemDir)
+	record := &model.BackupRecord{
+		Type:              req.Type,
+		Name:              req.Name,
+		SourceAccountIDs:  "1",
+		DownloadAccountID: 1,
+		FileDir:           itemDir,
+		FileName:          fileName,
+		TaskID:            req.TaskID,
+		Status:            constant.StatusWaiting,
+		Description:       req.Description,
+	}
+	if err := backupRepo.CreateRecord(record); err != nil {
+		global.LOG.Errorf("save backup record failed, err: %v", err)
+		return err
+	}
+	if err := handleContainerBackup(req.Name, nil, record.ID, backupDir, fileName, req.TaskID, req.Secret, req.StopBefore); err != nil {
+		backupRepo.UpdateRecordByMap(record.ID, map[string]interface{}{"status": constant.StatusFailed, "message": err.Error()})
+		return err
+	}
+	return nil
+}
+
+func (u *BackupService) ContainerRecover(req dto.CommonRecover) error {
+	return handleContainerRecover(req, nil)
+}
+
+func handleContainerBackup(containerName string, parentTask *task.Task, recordID uint, backupDir, fileName, taskID, secret string, stopBefore bool) error {
+	var (
+		err        error
+		backupTask *task.Task
+	)
+	backupCtx, err := newContainerBackupContext(containerName, backupDir, fileName, secret)
+	if err != nil {
+		return err
+	}
+	backupTask = parentTask
+	if backupTask == nil {
+		backupTask, err = task.NewTaskWithOps(containerName, task.TaskBackup, task.TaskScopeBackup, taskID, 1)
+		if err != nil {
+			return err
+		}
+	}
+	if stopBefore {
+		backupTask.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerBackupStop"), func(t *task.Task) error {
+			return stepStopContainerForBackup(backupCtx)
+		}, func(t *task.Task) {
+			_ = stepStartContainerAfterBackup(backupCtx)
+		}, 3, time.Hour)
+	}
+	backupTask.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerBackupPrepare"), func(t *task.Task) error {
+		t.Logf("------------------ %s ------------------", containerName)
+		return stepPrepareContainerBackup(backupCtx)
+	}, nil, 3, time.Hour)
+	backupTask.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerBackupInspect"), func(t *task.Task) error { return stepBackupContainerInspect(backupCtx) }, nil, 3, time.Hour)
+	backupTask.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerBackupMounts"), func(t *task.Task) error { return stepBackupContainerMounts(backupCtx) }, nil, 3, time.Hour)
+	backupTask.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerBackupMeta"), func(t *task.Task) error { return stepWriteContainerMeta(backupCtx) }, nil, 3, time.Hour)
+	backupTask.AddSubTaskWithOps(task.GetTaskName(containerName, task.TaskBackup, task.TaskScopeBackup), func(t *task.Task) error { return stepPackContainerBackup(backupCtx) }, nil, 3, time.Hour)
+	if stopBefore {
+		backupTask.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerBackupStart"), func(t *task.Task) error {
+			return stepStartContainerAfterBackup(backupCtx)
+		}, nil, 3, time.Hour)
+	}
+	if parentTask != nil {
+		return nil
+	}
+	go func() {
+		defer backupCtx.close()
+		if err := backupTask.Execute(); err != nil {
+			backupRepo.UpdateRecordByMap(recordID, map[string]interface{}{"status": constant.StatusFailed, "message": err.Error()})
+			return
+		}
+		backupRepo.UpdateRecordByMap(recordID, map[string]interface{}{"status": constant.StatusSuccess})
+	}()
+	return nil
+}
+
+func handleContainerRecover(req dto.CommonRecover, parentTask *task.Task) error {
+	var (
+		err         error
+		recoverTask *task.Task
+		recoverCtx  *containerRecoverContext
+	)
+	recoverTask = parentTask
+	if recoverTask == nil {
+		if isImportRecover(req) {
+			taskName := i18n.GetMsgByKey("TaskImport") + i18n.GetMsgByKey("Container")
+			recoverTask, err = task.NewTask(taskName, task.TaskImport, task.TaskScopeBackup, req.TaskID, 1)
+			if err != nil {
+				return err
+			}
+		} else {
+			recoverTask, err = task.NewTaskWithOps("container", task.TaskRecover, task.TaskScopeBackup, req.TaskID, 1)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	timeout := loadRecoverTimeout(req.Timeout)
+	logName := strings.TrimSpace(req.Name)
+	if logName == "" && req.File != "" {
+		logName = strings.TrimSuffix(path.Base(req.File), ".tar.gz")
+	}
+	if logName == "" {
+		logName = "container"
+	}
+	recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerRecoverPrepare"), func(t *task.Task) error {
+		ctx, err := newContainerRecoverContext(req)
+		if err != nil {
+			return err
+		}
+		recoverCtx = ctx
+		t.Logf("------------------ %s ------------------", logName)
+		if err := stepPrepareContainerRecover(recoverCtx); err != nil {
+			recoverCtx.close()
+			recoverCtx = nil
+			return err
+		}
+		return nil
+	}, func(t *task.Task) {
+		if recoverCtx != nil {
+			recoverCtx.close()
+			recoverCtx = nil
+		}
+	}, 3, timeout)
+	recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerRecoverExtract"), func(t *task.Task) error { return stepExtractContainerRecover(recoverCtx) }, nil, 3, timeout)
+	recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerRecoverParse"), func(t *task.Task) error { return stepLoadContainerRecoverData(recoverCtx) }, nil, 3, timeout)
+	recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerRecoverCreate"), func(t *task.Task) error { return stepRecreateContainer(recoverCtx, t) }, nil, 3, timeout)
+	recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerRecoverMounts"), func(t *task.Task) error { return stepRestoreContainerMounts(recoverCtx) }, nil, 3, timeout)
+	recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerRecoverStart"), func(t *task.Task) error { return stepStartRecoveredContainer(recoverCtx) }, nil, 3, timeout)
+	recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerRecoverCleanup"), func(t *task.Task) error {
+		if recoverCtx != nil {
+			recoverCtx.close()
+			recoverCtx = nil
+		}
+		return nil
+	}, nil, 0, timeout)
+	if parentTask != nil {
+		return nil
+	}
+	go func() {
+		_ = recoverTask.Execute()
+	}()
+	return nil
+}
+
+func loadRecoverTimeout(timeout int) time.Duration {
+	switch timeout {
+	case -1:
+		return 0
+	case 0:
+		return 3 * time.Hour
+	default:
+		return time.Duration(timeout) * time.Second
+	}
+}
+
+func isImportRecover(req dto.CommonRecover) bool {
+	return req.BackupRecordID == 0
+}
+
+func newContainerBackupContext(containerName, backupDir, fileName, secret string) (*containerBackupContext, error) {
+	dockerClient, err := dockerUtils.NewDockerClient()
+	if err != nil {
+		return nil, err
+	}
+	defer func() {
+		_ = dockerClient.Close()
+	}()
+	inspectInfo, err := dockerClient.ContainerInspect(context.Background(), containerName)
+	if err != nil {
+		return nil, err
+	}
+	filePath := path.Join(backupDir, fileName)
+	tmpDir := path.Join(path.Dir(filePath), strings.TrimSuffix(path.Base(filePath), ".tar.gz"))
+	backupCtx := &containerBackupContext{
+		containerName: containerName,
+		backupDir:     backupDir,
+		fileName:      fileName,
+		secret:        secret,
+		filePath:      filePath,
+		tmpDir:        tmpDir,
+		mountRoot:     path.Join(tmpDir, "mounts"),
+		wasRunning:    inspectInfo.State != nil && inspectInfo.State.Running,
+		fileOp:        files.NewFileOp(),
+		inspectInfo:   inspectInfo,
+		meta: containerBackupMeta{
+			ContainerName: containerName,
+			ContainerID:   inspectInfo.ID,
+			CreatedAt:     time.Now().Format(constant.DateTimeLayout),
+			Image:         inspectInfo.Config.Image,
+			HostConfig:    inspectInfo.HostConfig,
+			Config:        inspectInfo.Config,
+			Mounts:        make([]containerMountBackup, 0),
+		},
+	}
+	return backupCtx, nil
+}
+
+func newContainerRecoverContext(req dto.CommonRecover) (*containerRecoverContext, error) {
+	dockerClient, err := dockerUtils.NewDockerClient()
+	if err != nil {
+		return nil, err
+	}
+	tmpDir := path.Join(path.Dir(req.File), strings.TrimSuffix(path.Base(req.File), ".tar.gz"))
+	ctx := &containerRecoverContext{
+		req:        req,
+		targetName: req.Name,
+		fileOp:     files.NewFileOp(),
+		client:     dockerClient,
+		tmpDir:     tmpDir,
+		meta: containerBackupMeta{
+			Mounts: make([]containerMountBackup, 0),
+		},
+	}
+	return ctx, nil
+}
+
+func (c *containerBackupContext) close() {
+	if c.tmpDir != "" {
+		_ = os.RemoveAll(c.tmpDir)
+	}
+}
+
+func (c *containerRecoverContext) close() {
+	if c.client != nil {
+		_ = c.client.Close()
+	}
+	if c.tmpDir != "" {
+		_ = os.RemoveAll(c.tmpDir)
+	}
+}
+
+func stepPrepareContainerBackup(backupCtx *containerBackupContext) error {
+	if err := os.MkdirAll(backupCtx.backupDir, os.ModePerm); err != nil {
+		return fmt.Errorf("mkdir %s failed, err: %v", backupCtx.backupDir, err)
+	}
+	_ = os.RemoveAll(backupCtx.tmpDir)
+	if err := os.MkdirAll(backupCtx.mountRoot, os.ModePerm); err != nil {
+		return err
+	}
+	return nil
+}
+
+func stepStopContainerForBackup(backupCtx *containerBackupContext) error {
+	if !backupCtx.wasRunning || backupCtx.stopped {
+		return nil
+	}
+	dockerClient, err := dockerUtils.NewDockerClient()
+	if err != nil {
+		return err
+	}
+	defer func() {
+		_ = dockerClient.Close()
+	}()
+	if err := dockerClient.ContainerStop(context.Background(), backupCtx.inspectInfo.ID, container.StopOptions{}); err != nil {
+		return err
+	}
+	backupCtx.stopped = true
+	return nil
+}
+
+func stepStartContainerAfterBackup(backupCtx *containerBackupContext) error {
+	if !backupCtx.stopped {
+		return nil
+	}
+	dockerClient, err := dockerUtils.NewDockerClient()
+	if err != nil {
+		return err
+	}
+	defer func() {
+		_ = dockerClient.Close()
+	}()
+	if err := dockerClient.ContainerStart(context.Background(), backupCtx.inspectInfo.ID, container.StartOptions{}); err != nil {
+		return err
+	}
+	backupCtx.stopped = false
+	return nil
+}
+
+func stepBackupContainerInspect(backupCtx *containerBackupContext) error {
+	inspectBytes, err := json.MarshalIndent(backupCtx.inspectInfo, "", "  ")
+	if err != nil {
+		return err
+	}
+	if err := backupCtx.fileOp.SaveFile(path.Join(backupCtx.tmpDir, "inspect.json"), string(inspectBytes), fs.ModePerm); err != nil {
+		return err
+	}
+	if backupCtx.inspectInfo.NetworkSettings != nil {
+		networkBytes, err := json.MarshalIndent(backupCtx.inspectInfo.NetworkSettings, "", "  ")
+		if err != nil {
+			return err
+		}
+		if err := backupCtx.fileOp.SaveFile(path.Join(backupCtx.tmpDir, "network.json"), string(networkBytes), fs.ModePerm); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func stepBackupContainerMounts(backupCtx *containerBackupContext) error {
+	var (
+		dockerClient *client.Client
+		clientErr    error
+	)
+	ensureClient := func() (*client.Client, error) {
+		if dockerClient != nil || clientErr != nil {
+			return dockerClient, clientErr
+		}
+		dockerClient, clientErr = dockerUtils.NewDockerClient()
+		return dockerClient, clientErr
+	}
+	defer func() {
+		if dockerClient != nil {
+			_ = dockerClient.Close()
+		}
+	}()
+
+	for i, item := range backupCtx.inspectInfo.Mounts {
+		mountMeta := containerMountBackup{
+			Type:        string(item.Type),
+			Name:        item.Name,
+			Source:      item.Source,
+			Destination: item.Destination,
+			Mode:        item.Mode,
+			RW:          item.RW,
+			Propagation: string(item.Propagation),
+			Status:      "skipped",
+		}
+
+		mountDirName := fmt.Sprintf("%02d_%s", i, sanitizeContainerMountName(item.Destination))
+		mountDir := path.Join(backupCtx.mountRoot, mountDirName)
+		mountMeta.BackupPath = path.Join("mounts", mountDirName, "data")
+
+		switch item.Type {
+		case mount.TypeBind, mount.TypeVolume:
+			if item.Source == "" {
+				mountMeta.Message = "empty source"
+				backupCtx.meta.Mounts = append(backupCtx.meta.Mounts, mountMeta)
+				continue
+			}
+			sourceInfo, statErr := os.Stat(item.Source)
+			if statErr != nil {
+				mountMeta.Message = statErr.Error()
+				backupCtx.meta.Mounts = append(backupCtx.meta.Mounts, mountMeta)
+				continue
+			}
+			dataDir := path.Join(mountDir, "data")
+			if err := os.MkdirAll(dataDir, os.ModePerm); err != nil {
+				return err
+			}
+			if sourceInfo.IsDir() {
+				if err := backupCtx.fileOp.CopyDirWithNewName(item.Source, dataDir, "."); err != nil {
+					return err
+				}
+			} else {
+				if err := backupCtx.fileOp.CopyFile(item.Source, dataDir); err != nil {
+					return err
+				}
+			}
+
+			if item.Type == mount.TypeVolume && item.Name != "" {
+				cli, err := ensureClient()
+				if err != nil {
+					return err
+				}
+				volumeInfo, volumeErr := cli.VolumeInspect(context.Background(), item.Name)
+				if volumeErr == nil {
+					volumeBytes, volumeMarshalErr := json.MarshalIndent(volumeInfo, "", "  ")
+					if volumeMarshalErr == nil {
+						_ = backupCtx.fileOp.SaveFile(path.Join(mountDir, "volume.json"), string(volumeBytes), fs.ModePerm)
+					}
+				}
+			}
+			mountMeta.Status = "backed_up"
+		default:
+			mountMeta.Message = "mount type not supported for data backup"
+		}
+		backupCtx.meta.Mounts = append(backupCtx.meta.Mounts, mountMeta)
+	}
+	return nil
+}
+
+func stepWriteContainerMeta(backupCtx *containerBackupContext) error {
+	metaBytes, err := json.MarshalIndent(backupCtx.meta, "", "  ")
+	if err != nil {
+		return err
+	}
+	if err := backupCtx.fileOp.SaveFile(path.Join(backupCtx.tmpDir, "meta.json"), string(metaBytes), fs.ModePerm); err != nil {
+		return err
+	}
+	return nil
+}
+
+func stepPackContainerBackup(backupCtx *containerBackupContext) error {
+	if err := backupCtx.fileOp.TarGzCompressPro(true, backupCtx.tmpDir, backupCtx.filePath, backupCtx.secret, ""); err != nil {
+		return err
+	}
+	return nil
+}
+
+func stepPrepareContainerRecover(recoverCtx *containerRecoverContext) error {
+	if !recoverCtx.fileOp.Stat(recoverCtx.req.File) {
+		return buserr.WithName("ErrFileNotFound", recoverCtx.req.File)
+	}
+	_ = os.RemoveAll(recoverCtx.tmpDir)
+	return nil
+}
+
+func stepExtractContainerRecover(recoverCtx *containerRecoverContext) error {
+	return recoverCtx.fileOp.TarGzExtractPro(recoverCtx.req.File, path.Dir(recoverCtx.req.File), recoverCtx.req.Secret)
+}
+
+func stepLoadContainerRecoverData(recoverCtx *containerRecoverContext) error {
+	if err := loadContainerRecoverMeta(recoverCtx); err != nil {
+		return err
+	}
+	if err := loadContainerRecoverInspect(recoverCtx); err != nil {
+		return err
+	}
+	if recoverCtx.targetName == "" {
+		recoverCtx.targetName = strings.TrimPrefix(recoverCtx.inspectInfo.Name, "/")
+	}
+	if recoverCtx.targetName == "" {
+		recoverCtx.targetName = recoverCtx.meta.ContainerName
+	}
+	if recoverCtx.targetName == "" {
+		return fmt.Errorf("container name not found in recover request or backup file")
+	}
+	if recoverCtx.inspectInfo.Config == nil {
+		recoverCtx.inspectInfo.Config = recoverCtx.meta.Config
+	}
+	if recoverCtx.inspectInfo.HostConfig == nil {
+		recoverCtx.inspectInfo.HostConfig = recoverCtx.meta.HostConfig
+	}
+	if recoverCtx.inspectInfo.Config == nil {
+		return fmt.Errorf("container config not found in backup file")
+	}
+	if recoverCtx.inspectInfo.HostConfig == nil {
+		recoverCtx.inspectInfo.HostConfig = &container.HostConfig{}
+	}
+	recoverCtx.shouldStart = recoverCtx.inspectInfo.State != nil && recoverCtx.inspectInfo.State.Running
+	return nil
+}
+
+func loadContainerRecoverMeta(recoverCtx *containerRecoverContext) error {
+	metaPath := path.Join(recoverCtx.tmpDir, "meta.json")
+	if !recoverCtx.fileOp.Stat(metaPath) {
+		return nil
+	}
+	metaBytes, err := os.ReadFile(metaPath)
+	if err != nil {
+		return err
+	}
+	if err := json.Unmarshal(metaBytes, &recoverCtx.meta); err != nil {
+		return fmt.Errorf("unmarshal meta.json failed, err: %v", err)
+	}
+	return nil
+}
+
+func loadContainerRecoverInspect(recoverCtx *containerRecoverContext) error {
+	inspectPath := path.Join(recoverCtx.tmpDir, "inspect.json")
+	if !recoverCtx.fileOp.Stat(inspectPath) {
+		return fmt.Errorf("inspect.json not found in backup file")
+	}
+	inspectBytes, err := os.ReadFile(inspectPath)
+	if err != nil {
+		return err
+	}
+	if err := json.Unmarshal(inspectBytes, &recoverCtx.inspectInfo); err != nil {
+		return fmt.Errorf("unmarshal inspect.json failed, err: %v", err)
+	}
+	return nil
+}
+
+func stepRecreateContainer(recoverCtx *containerRecoverContext, taskItem *task.Task) error {
+	ctx := context.Background()
+	if err := ensureContainerRecoverNetworks(recoverCtx); err != nil {
+		return err
+	}
+	if err := ensureContainerRecoverVolumes(recoverCtx); err != nil {
+		return err
+	}
+
+	config := cloneContainerConfig(recoverCtx.inspectInfo.Config)
+	hostConfig := cloneContainerHostConfig(recoverCtx.inspectInfo.HostConfig)
+	if config.Image == "" {
+		config.Image = recoverCtx.meta.Image
+	}
+	if config.Image == "" {
+		return fmt.Errorf("container image not found in backup file")
+	}
+	if !checkImageExist(recoverCtx.client, config.Image) {
+		if err := pullImages(taskItem, recoverCtx.client, config.Image); err != nil {
+			return err
+		}
+	}
+
+	if _, err := recoverCtx.client.ContainerInspect(ctx, recoverCtx.targetName); err == nil {
+		if err := recoverCtx.client.ContainerRemove(ctx, recoverCtx.targetName, container.RemoveOptions{Force: true, RemoveVolumes: false}); err != nil {
+			return err
+		}
+	} else if !client.IsErrNotFound(err) {
+		return err
+	}
+
+	networkConfig, extraNetworks := buildContainerRecoverNetworkConfig(recoverCtx.inspectInfo.NetworkSettings, hostConfig)
+	removeBridgeDriverIPAM(recoverCtx.client, networkConfig, extraNetworks)
+	createRes, err := recoverCtx.client.ContainerCreate(ctx, config, hostConfig, networkConfig, nil, recoverCtx.targetName)
+	if err != nil {
+		return err
+	}
+	recoverCtx.createdContainerID = createRes.ID
+
+	extraNames := make([]string, 0, len(extraNetworks))
+	for name := range extraNetworks {
+		extraNames = append(extraNames, name)
+	}
+	sort.Strings(extraNames)
+	for _, item := range extraNames {
+		if err := recoverCtx.client.NetworkConnect(ctx, item, recoverCtx.createdContainerID, extraNetworks[item]); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func removeBridgeDriverIPAM(cli *client.Client, primary *network.NetworkingConfig, extras map[string]*network.EndpointSettings) {
+	if primary != nil {
+		removeBridgeDriverIPAMFromEndpoints(cli, primary.EndpointsConfig)
+	}
+	removeBridgeDriverIPAMFromEndpoints(cli, extras)
+}
+
+func removeBridgeDriverIPAMFromEndpoints(cli *client.Client, endpoints map[string]*network.EndpointSettings) {
+	for netName, endpoint := range endpoints {
+		if endpoint == nil || endpoint.IPAMConfig == nil {
+			continue
+		}
+		info, err := cli.NetworkInspect(context.Background(), netName, network.InspectOptions{})
+		if err != nil {
+			continue
+		}
+		if info.Driver == "bridge" {
+			endpoint.IPAMConfig = nil
+		}
+	}
+}
+
+func ensureContainerRecoverNetworks(recoverCtx *containerRecoverContext) error {
+	if recoverCtx.inspectInfo.NetworkSettings == nil {
+		return nil
+	}
+	for netName := range recoverCtx.inspectInfo.NetworkSettings.Networks {
+		if netName == "" || netName == "bridge" || netName == "host" || netName == "none" {
+			continue
+		}
+		if _, err := recoverCtx.client.NetworkInspect(context.Background(), netName, network.InspectOptions{}); err != nil {
+			if !client.IsErrNotFound(err) {
+				return err
+			}
+			if _, err := recoverCtx.client.NetworkCreate(context.Background(), netName, network.CreateOptions{Driver: "bridge"}); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func ensureContainerRecoverVolumes(recoverCtx *containerRecoverContext) error {
+	for _, item := range recoverCtx.meta.Mounts {
+		if item.Type != string(mount.TypeVolume) || item.Name == "" {
+			continue
+		}
+		if _, err := recoverCtx.client.VolumeInspect(context.Background(), item.Name); err == nil {
+			continue
+		} else if !client.IsErrNotFound(err) {
+			return err
+		}
+		createOptions := volume.CreateOptions{Name: item.Name}
+		if item.BackupPath != "" {
+			volumeMetaPath := path.Join(recoverCtx.tmpDir, path.Dir(item.BackupPath), "volume.json")
+			if recoverCtx.fileOp.Stat(volumeMetaPath) {
+				volumeBytes, readErr := os.ReadFile(volumeMetaPath)
+				if readErr != nil {
+					return readErr
+				}
+				var volumeInfo volume.Volume
+				if unmarshalErr := json.Unmarshal(volumeBytes, &volumeInfo); unmarshalErr != nil {
+					return unmarshalErr
+				}
+				if volumeInfo.Driver != "" {
+					createOptions.Driver = volumeInfo.Driver
+				}
+				if len(volumeInfo.Options) != 0 {
+					createOptions.DriverOpts = volumeInfo.Options
+				}
+				if len(volumeInfo.Labels) != 0 {
+					createOptions.Labels = volumeInfo.Labels
+				}
+			}
+		}
+		if _, err := recoverCtx.client.VolumeCreate(context.Background(), createOptions); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func buildContainerRecoverNetworkConfig(networkSettings *container.NetworkSettings, hostConfig *container.HostConfig) (*network.NetworkingConfig, map[string]*network.EndpointSettings) {
+	extraNetworks := make(map[string]*network.EndpointSettings)
+	if hostConfig != nil {
+		networkMode := string(hostConfig.NetworkMode)
+		if networkMode == "host" || networkMode == "none" {
+			return nil, extraNetworks
+		}
+	}
+	if networkSettings == nil || len(networkSettings.Networks) == 0 {
+		return nil, extraNetworks
+	}
+
+	primaryName := ""
+	if hostConfig != nil {
+		networkMode := string(hostConfig.NetworkMode)
+		if networkMode != "" && networkMode != "default" && networkMode != "bridge" {
+			if _, ok := networkSettings.Networks[networkMode]; ok {
+				primaryName = networkMode
+			}
+		}
+	}
+	if primaryName == "" {
+		if _, ok := networkSettings.Networks["bridge"]; ok {
+			primaryName = "bridge"
+		} else {
+			names := make([]string, 0, len(networkSettings.Networks))
+			for name := range networkSettings.Networks {
+				names = append(names, name)
+			}
+			sort.Strings(names)
+			if len(names) > 0 {
+				primaryName = names[0]
+			}
+		}
+	}
+
+	config := &network.NetworkingConfig{EndpointsConfig: make(map[string]*network.EndpointSettings)}
+	for name, endpoint := range networkSettings.Networks {
+		if name == "host" || name == "none" {
+			continue
+		}
+		endpointSetting := &network.EndpointSettings{Aliases: append([]string(nil), endpoint.Aliases...), MacAddress: endpoint.MacAddress}
+		if endpoint.IPAMConfig != nil {
+			endpointSetting.IPAMConfig = &network.EndpointIPAMConfig{
+				IPv4Address: endpoint.IPAMConfig.IPv4Address,
+				IPv6Address: endpoint.IPAMConfig.IPv6Address,
+			}
+		} else if endpoint.IPAddress != "" || endpoint.GlobalIPv6Address != "" {
+			endpointSetting.IPAMConfig = &network.EndpointIPAMConfig{
+				IPv4Address: endpoint.IPAddress,
+				IPv6Address: endpoint.GlobalIPv6Address,
+			}
+		}
+		if name == primaryName {
+			config.EndpointsConfig[name] = endpointSetting
+		} else {
+			extraNetworks[name] = endpointSetting
+		}
+	}
+	if len(config.EndpointsConfig) == 0 {
+		return nil, extraNetworks
+	}
+	return config, extraNetworks
+}
+
+func cloneContainerConfig(config *container.Config) *container.Config {
+	if config == nil {
+		return &container.Config{}
+	}
+	item := *config
+	if len(config.Env) != 0 {
+		item.Env = append([]string(nil), config.Env...)
+	}
+	if len(config.Cmd) != 0 {
+		item.Cmd = append([]string(nil), config.Cmd...)
+	}
+	if len(config.Entrypoint) != 0 {
+		item.Entrypoint = append([]string(nil), config.Entrypoint...)
+	}
+	if len(config.Labels) != 0 {
+		labels := make(map[string]string, len(config.Labels))
+		for key, val := range config.Labels {
+			labels[key] = val
+		}
+		item.Labels = labels
+	}
+	if len(config.Volumes) != 0 {
+		volumes := make(map[string]struct{}, len(config.Volumes))
+		for key, val := range config.Volumes {
+			volumes[key] = val
+		}
+		item.Volumes = volumes
+	}
+	return &item
+}
+
+func cloneContainerHostConfig(hostConfig *container.HostConfig) *container.HostConfig {
+	if hostConfig == nil {
+		return &container.HostConfig{}
+	}
+	item := *hostConfig
+	if len(hostConfig.Binds) != 0 {
+		item.Binds = append([]string(nil), hostConfig.Binds...)
+	}
+	if len(hostConfig.DNS) != 0 {
+		item.DNS = append([]string(nil), hostConfig.DNS...)
+	}
+	if len(hostConfig.ExtraHosts) != 0 {
+		item.ExtraHosts = append([]string(nil), hostConfig.ExtraHosts...)
+	}
+	if len(hostConfig.Mounts) != 0 {
+		item.Mounts = append([]mount.Mount(nil), hostConfig.Mounts...)
+	}
+	return &item
+}
+
+func stepRestoreContainerMounts(recoverCtx *containerRecoverContext) error {
+	currentContainer := recoverCtx.createdContainerID
+	if currentContainer == "" {
+		currentContainer = recoverCtx.targetName
+	}
+	currentInspect, err := recoverCtx.client.ContainerInspect(context.Background(), currentContainer)
+	if err != nil {
+		return err
+	}
+	currentMounts := make(map[string]container.MountPoint, len(currentInspect.Mounts))
+	for _, item := range currentInspect.Mounts {
+		currentMounts[item.Destination] = item
+	}
+
+	for _, item := range recoverCtx.meta.Mounts {
+		if item.Status != "backed_up" || item.BackupPath == "" || !item.RW {
+			continue
+		}
+		backupPath := path.Join(recoverCtx.tmpDir, item.BackupPath)
+		if !recoverCtx.fileOp.Stat(backupPath) {
+			continue
+		}
+		sourcePath := item.Source
+		if currentMount, ok := currentMounts[item.Destination]; ok {
+			if currentMount.Source != "" {
+				sourcePath = currentMount.Source
+			}
+			if item.Type == string(mount.TypeVolume) && item.Name == "" {
+				item.Name = currentMount.Name
+			}
+		}
+		if sourcePath == "" && item.Type == string(mount.TypeVolume) && item.Name != "" {
+			volumeInfo, volumeErr := recoverCtx.client.VolumeInspect(context.Background(), item.Name)
+			if volumeErr != nil {
+				return volumeErr
+			}
+			sourcePath = volumeInfo.Mountpoint
+		}
+		if sourcePath == "" {
+			continue
+		}
+		if err := restoreContainerMountData(recoverCtx.fileOp, backupPath, sourcePath); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func restoreContainerMountData(fileOp files.FileOp, backupPath, sourcePath string) error {
+	if sourcePath == "/" {
+		return fmt.Errorf("invalid mount source path /")
+	}
+	entries, err := os.ReadDir(backupPath)
+	if err != nil {
+		return err
+	}
+	if len(entries) == 1 && !entries[0].IsDir() && entries[0].Name() == path.Base(sourcePath) {
+		if err := os.MkdirAll(path.Dir(sourcePath), os.ModePerm); err != nil {
+			return err
+		}
+		_ = os.RemoveAll(sourcePath)
+		if err := fileOp.CopyFile(path.Join(backupPath, entries[0].Name()), path.Dir(sourcePath)); err != nil {
+			return err
+		}
+		return nil
+	}
+
+	_ = os.RemoveAll(sourcePath)
+	if err := os.MkdirAll(sourcePath, os.ModePerm); err != nil {
+		return err
+	}
+	if err := fileOp.CopyDirWithNewName(backupPath, sourcePath, "."); err != nil {
+		return err
+	}
+	return nil
+}
+
+func stepStartRecoveredContainer(recoverCtx *containerRecoverContext) error {
+	if !recoverCtx.shouldStart {
+		return nil
+	}
+	containerID := recoverCtx.createdContainerID
+	if containerID == "" {
+		containerID = recoverCtx.targetName
+	}
+	return recoverCtx.client.ContainerStart(context.Background(), containerID, container.StartOptions{})
+}
+
+func sanitizeContainerMountName(in string) string {
+	name := strings.TrimSpace(in)
+	name = strings.Trim(name, "/")
+	name = strings.ReplaceAll(name, "/", "_")
+	name = strings.ReplaceAll(name, ":", "_")
+	if name == "" {
+		return "root"
+	}
+	return name
+}

agent/app/service/backup_record.go

@@ -38,7 +38,7 @@ func NewIBackupRecordService() IBackupRecordService {
 func (u *BackupRecordService) SearchRecordsWithPage(search dto.RecordSearch) (int64, []dto.BackupRecords, error) {
 	total, records, err := backupRepo.PageRecord(
 		search.Page, search.PageSize,
-		repo.WithOrderBy("created_at desc"),
+		repo.WithOrderDesc("created_at"),
 		repo.WithByName(search.Name),
 		repo.WithByType(search.Type),
 		repo.WithByDetailName(search.DetailName),
@@ -69,7 +69,7 @@ func (u *BackupRecordService) SearchRecordsWithPage(search dto.RecordSearch) (in
 func (u *BackupRecordService) SearchRecordsByCronjobWithPage(search dto.RecordSearchByCronjob) (int64, []dto.BackupRecords, error) {
 	total, records, err := backupRepo.PageRecord(
 		search.Page, search.PageSize,
-		repo.WithOrderBy("created_at desc"),
+		repo.WithOrderDesc("created_at"),
 		backupRepo.WithByCronID(search.CronjobID),
 	)
 	if err != nil {
@@ -166,7 +166,7 @@ func (u *BackupRecordService) BatchDeleteRecord(ids []uint) error {
 
 func (u *BackupRecordService) ListAppRecords(name, detailName, fileName string) ([]model.BackupRecord, error) {
 	records, err := backupRepo.ListRecord(
-		repo.WithOrderBy("created_at asc"),
+		repo.WithOrderAsc("created_at"),
 		repo.WithByName(name),
 		repo.WithByType("app"),
 		backupRepo.WithFileNameStartWith(fileName),
@@ -221,7 +221,7 @@ func (u *BackupRecordService) LoadRecordSize(req dto.SearchForSize) ([]dto.Recor
 			list = append(list, backupSizeHelper{ID: item.ID, DownloadID: item.DownloadAccountID, FilePath: fmt.Sprintf("system_snapshot/%s.tar.gz", item.Name)})
 		}
 	case "cronjob":
-		_, records, err := backupRepo.PageRecord(req.Page, req.PageSize, repo.WithOrderBy("created_at desc"), backupRepo.WithByCronID(req.CronjobID))
+		_, records, err := backupRepo.PageRecord(req.Page, req.PageSize, repo.WithOrderDesc("created_at"), backupRepo.WithByCronID(req.CronjobID))
 		if err != nil {
 			return nil, err
 		}
@@ -231,7 +231,7 @@ func (u *BackupRecordService) LoadRecordSize(req dto.SearchForSize) ([]dto.Recor
 	default:
 		_, records, err := backupRepo.PageRecord(
 			req.Page, req.PageSize,
-			repo.WithOrderBy("created_at desc"),
+			repo.WithOrderDesc("created_at"),
 			repo.WithByName(req.Name),
 			repo.WithByType(req.Type),
 			repo.WithByDetailName(req.DetailName),

agent/app/service/clam.go

@@ -96,7 +96,7 @@ func (c *ClamService) LoadBaseInfo() (dto.ClamBaseInfo, error) {
 			}
 		}
 	} else {
-		_ = clam.StopAllClamJob(false, clamRepo)
+		_ = clam.CheckWithStopAll(false, clamRepo)
 	}
 	if baseInfo.FreshIsActive {
 		version, err := cmd.RunDefaultWithStdoutBashC("freshclam --version")
@@ -313,7 +313,7 @@ func (c *ClamService) Delete(req dto.ClamDelete) error {
 }
 
 func (c *ClamService) HandleOnce(id uint) error {
-	if active := clam.StopAllClamJob(true, clamRepo); !active {
+	if active := clam.CheckWithStopAll(true, clamRepo); !active {
 		return buserr.New("ErrClamdscanNotFound")
 	}
 	clamItem, _ := clamRepo.Get(repo.WithByID(id))
@@ -337,9 +337,9 @@ func (c *ClamService) HandleOnce(id uint) error {
 			clamRepo.EndRecords(record, constant.StatusFailed, err.Error())
 			return
 		}
-		handleAlert(record.InfectedFiles, clamItem.Name, clamItem.ID)
 		clam.AnalysisFromLog(taskItem.LogFile, &record)
 		clamRepo.EndRecords(record, constant.StatusDone, "")
+		handleAlert(record.InfectedFiles, clamItem.Name, clamItem.ID)
 	}()
 	return nil
 }

agent/app/service/container.go

@@ -1,7 +1,9 @@
 package service
 
 import (
+	"archive/tar"
 	"bufio"
+	"bytes"
 	"context"
 	"encoding/base64"
 	"encoding/json"
@@ -11,6 +13,7 @@ import (
 	"net/url"
 	"os"
 	"os/exec"
+	"path"
 	"path/filepath"
 	"sort"
 	"strconv"
@@ -40,10 +43,10 @@ import (
 	"github.com/docker/docker/api/types/registry"
 	"github.com/docker/docker/api/types/volume"
 	"github.com/docker/docker/client"
+	"github.com/docker/docker/pkg/stdcopy"
 	"github.com/docker/go-connections/nat"
 	"github.com/gin-gonic/gin"
 	v1 "github.com/opencontainers/image-spec/specs-go/v1"
-	"github.com/pkg/errors"
 	"github.com/shirou/gopsutil/v4/cpu"
 	"github.com/shirou/gopsutil/v4/mem"
 )
@@ -59,11 +62,16 @@ type IContainerService interface {
 	ListNetwork() ([]dto.Options, error)
 	PageVolume(req dto.SearchWithPage) (int64, interface{}, error)
 	ListVolume() ([]dto.Options, error)
+
 	PageCompose(req dto.SearchWithPage) (int64, interface{}, error)
+	LoadComposeEnv(name string) (string, error)
 	CreateCompose(req dto.ComposeCreate) error
 	ComposeOperation(req dto.ComposeOperation) error
+	TestCompose(req dto.ComposeCreate) (bool, error)
+	ComposeUpdate(req dto.ComposeUpdate) error
+	ComposeLogClean(req dto.ComposeLogClean) error
+
 	ContainerCreate(req dto.ContainerOperate, inThread bool) error
-	ContainerCreateByCommand(req dto.ContainerCreateByCommand) error
 	ContainerUpdate(req dto.ContainerOperate) error
 	ContainerUpgrade(req dto.ContainerUpgrade) error
 	ContainerInfo(req dto.OperationWithName) (*dto.ContainerOperate, error)
@@ -74,19 +82,23 @@ type IContainerService interface {
 	ContainerCommit(req dto.ContainerCommit) error
 	ContainerLogClean(req dto.OperationWithName) error
 	ContainerOperation(req dto.ContainerOperation) error
-	DownloadContainerLogs(containerType, container, since, tail string, c *gin.Context) error
+	DownloadContainerLogs(containerType, container, since, tail string, timestamp bool, c *gin.Context) error
 	ContainerStats(id string) (*dto.ContainerStats, error)
+
 	Inspect(req dto.InspectReq) (string, error)
 	DeleteNetwork(req dto.BatchDelete) error
 	CreateNetwork(req dto.NetworkCreate) error
 	DeleteVolume(req dto.BatchDelete) error
 	CreateVolume(req dto.VolumeCreate) error
-	TestCompose(req dto.ComposeCreate) (bool, error)
-	ComposeUpdate(req dto.ComposeUpdate) error
-	ComposeLogClean(req dto.ComposeLogClean) error
 	Prune(req dto.ContainerPrune) error
 
 	LoadUsers(req dto.OperationWithName) []string
+	ListContainerFiles(req dto.ContainerFileReq) ([]dto.ContainerFileInfo, error)
+	UploadContainerFile(req dto.ContainerFileReq, fileName string, fileSize int64, file io.Reader) error
+	GetContainerFileContent(req dto.ContainerFileReq) (*dto.ContainerFileContent, error)
+	GetContainerFileSize(req dto.ContainerFileReq) (int64, error)
+	DeleteContainerFile(req dto.ContainerFileBatchDeleteReq) error
+	DownloadContainerFile(req dto.ContainerFileReq) (io.ReadCloser, string, string, error)
 
 	StreamLogs(ctx *gin.Context, params dto.StreamLog)
 }
@@ -100,7 +112,7 @@ func (u *ContainerService) Page(req dto.PageContainer) (int64, interface{}, erro
 	if err != nil {
 		return 0, nil, err
 	}
-	defer client.Close()
+	defer func() { _ = client.Close() }()
 	options := container.ListOptions{All: true}
 	if len(req.Filters) != 0 {
 		options.Filters = filters.NewArgs()
@@ -298,42 +310,6 @@ func (u *ContainerService) ContainerListStats() ([]dto.ContainerListStats, error
 	return datas, nil
 }
 
-func (u *ContainerService) ContainerCreateByCommand(req dto.ContainerCreateByCommand) error {
-	if cmd.CheckIllegal(req.Command) {
-		return buserr.New("ErrCmdIllegal")
-	}
-	if !strings.HasPrefix(strings.TrimSpace(req.Command), "docker run ") {
-		return errors.New("error command format")
-	}
-	containerName := ""
-	commands := strings.Split(req.Command, " ")
-	for index, val := range commands {
-		if val == "--name" && len(commands) > index+1 {
-			containerName = commands[index+1]
-		}
-	}
-	if !strings.Contains(req.Command, " -d ") {
-		req.Command = strings.ReplaceAll(req.Command, "docker run", "docker run -d")
-	}
-	if len(containerName) == 0 {
-		containerName = fmt.Sprintf("1Panel-%s-%s", common.RandStr(5), common.RandStrAndNum(4))
-		req.Command += fmt.Sprintf(" --name %s", containerName)
-	}
-	taskItem, err := task.NewTaskWithOps(containerName, task.TaskCreate, task.TaskScopeContainer, req.TaskID, 1)
-	if err != nil {
-		global.LOG.Errorf("new task for create container failed, err: %v", err)
-		return err
-	}
-	go func() {
-		taskItem.AddSubTask(i18n.GetWithName("ContainerCreate", containerName), func(t *task.Task) error {
-			cmdMgr := cmd.NewCommandMgr(cmd.WithTask(*taskItem), cmd.WithTimeout(5*time.Minute))
-			return cmdMgr.RunBashC(req.Command)
-		}, nil)
-		_ = taskItem.Execute()
-	}()
-	return nil
-}
-
 func (u *ContainerService) Inspect(req dto.InspectReq) (string, error) {
 	client, err := docker.NewDockerClient()
 	if err != nil {
@@ -617,6 +593,16 @@ func (u *ContainerService) ContainerInfo(req dto.OperationWithName) (*dto.Contai
 	data.ExposedPorts = loadContainerPortForInfo(exposePorts)
 	data.Hostname = oldContainer.Config.Hostname
 	data.DNS = oldContainer.HostConfig.DNS
+	for _, item := range oldContainer.HostConfig.ExtraHosts {
+		parts := strings.SplitN(item, ":", 2)
+		if len(parts) != 2 || len(parts[0]) == 0 || len(parts[1]) == 0 {
+			continue
+		}
+		data.ExtraHosts = append(data.ExtraHosts, dto.ExtraHost{
+			Hostname: parts[0],
+			IP:       parts[1],
+		})
+	}
 	data.DomainName = oldContainer.Config.Domainname
 
 	data.Cmd = oldContainer.Config.Cmd
@@ -952,6 +938,9 @@ func collectLogs(done <-chan struct{}, params dto.StreamLog, messageChan chan<-
 	if params.Follow {
 		cmdArgs = append(cmdArgs, "-f")
 	}
+	if params.Timestamp {
+		cmdArgs = append(cmdArgs, "-t")
+	}
 	if params.Tail != "0" {
 		cmdArgs = append(cmdArgs, "--tail", params.Tail)
 	}
@@ -1048,7 +1037,7 @@ func collectLogs(done <-chan struct{}, params dto.StreamLog, messageChan chan<-
 	_ = dockerCmd.Wait()
 }
 
-func (u *ContainerService) DownloadContainerLogs(containerType, container, since, tail string, c *gin.Context) error {
+func (u *ContainerService) DownloadContainerLogs(containerType, container, since, tail string, timestamp bool, c *gin.Context) error {
 	if cmd.CheckIllegal(container, since, tail) {
 		return buserr.New("ErrCmdIllegal")
 	}
@@ -1076,6 +1065,9 @@ func (u *ContainerService) DownloadContainerLogs(containerType, container, since
 		commandArg = append(commandArg, "--since")
 		commandArg = append(commandArg, since)
 	}
+	if timestamp {
+		commandArg = append(commandArg, "-t")
+	}
 	var dockerCmd *exec.Cmd
 	if containerType == "compose" && dockerCommand == "docker-compose" {
 		dockerCmd = exec.Command("docker-compose", commandArg...)
@@ -1171,7 +1163,7 @@ func (u *ContainerService) ContainerStats(id string) (*dto.ContainerStats, error
 
 func (u *ContainerService) LoadUsers(req dto.OperationWithName) []string {
 	var users []string
-	std, err := cmd.RunDefaultWithStdoutBashCf("docker exec %s cat /etc/passwd", req.Name)
+	std, err := cmd.NewCommandMgr(cmd.WithTimeout(20*time.Second)).RunWithStdout("docker", "exec", req.Name, "cat", "/etc/passwd")
 	if err != nil {
 		return users
 	}
@@ -1184,6 +1176,444 @@ func (u *ContainerService) LoadUsers(req dto.OperationWithName) []string {
 	return users
 }
 
+func (u *ContainerService) ListContainerFiles(req dto.ContainerFileReq) ([]dto.ContainerFileInfo, error) {
+	if len(req.Path) == 0 {
+		req.Path = "/"
+	}
+	cli, err := docker.NewDockerClient()
+	if err != nil {
+		return nil, err
+	}
+	defer cli.Close()
+
+	ctx := context.Background()
+	stat, err := cli.ContainerStatPath(ctx, req.ContainerID, req.Path)
+	if err != nil {
+		return nil, err
+	}
+	isDir := stat.Mode.IsDir()
+	isLink := stat.Mode&os.ModeSymlink != 0
+	if isLink && !isDir {
+		linkDir, linkErr := isContainerDir(cli, req.ContainerID, req.Path)
+		if linkErr == nil {
+			isDir = linkDir
+		}
+	}
+	if !isDir {
+		return []dto.ContainerFileInfo{toContainerFileInfo(req.Path, stat, isDir)}, nil
+	}
+
+	output, err := runContainerCommand(cli, req.ContainerID, []string{"ls", "-1A", "--", req.Path})
+	if err != nil {
+		return nil, err
+	}
+	lines := strings.Split(strings.TrimSpace(output), "\n")
+	files := make([]dto.ContainerFileInfo, 0, len(lines))
+	for _, line := range lines {
+		name := strings.TrimSpace(line)
+		if len(name) == 0 || name == "." || name == ".." {
+			continue
+		}
+		childPath := req.Path
+		if childPath == "/" {
+			childPath = "/" + name
+		} else {
+			childPath = strings.TrimSuffix(childPath, "/") + "/" + name
+		}
+		childStat, statErr := cli.ContainerStatPath(ctx, req.ContainerID, childPath)
+		if statErr != nil {
+			continue
+		}
+		childIsDir := childStat.Mode.IsDir()
+		if childStat.Mode&os.ModeSymlink != 0 && !childIsDir {
+			linkDir, linkErr := isContainerDir(cli, req.ContainerID, childPath)
+			if linkErr == nil {
+				childIsDir = linkDir
+			}
+		}
+		files = append(files, toContainerFileInfo(childPath, childStat, childIsDir))
+	}
+	sort.Slice(files, func(i, j int) bool {
+		if files[i].IsDir != files[j].IsDir {
+			return files[i].IsDir
+		}
+		return strings.ToLower(files[i].Name) < strings.ToLower(files[j].Name)
+	})
+	return files, nil
+}
+
+func (u *ContainerService) DeleteContainerFile(req dto.ContainerFileBatchDeleteReq) error {
+	for _, item := range req.Paths {
+		if strings.TrimSpace(item) == "/" {
+			return buserr.New("ErrPathNotDelete")
+		}
+	}
+	cli, err := docker.NewDockerClient()
+	if err != nil {
+		return err
+	}
+	defer cli.Close()
+
+	command := []string{"rm", "-rf", "--"}
+	command = append(command, req.Paths...)
+	_, err = runContainerCommand(cli, req.ContainerID, command)
+	return err
+}
+
+func (u *ContainerService) UploadContainerFile(req dto.ContainerFileReq, fileName string, fileSize int64, file io.Reader) error {
+	if len(req.Path) == 0 {
+		req.Path = "/"
+	}
+	safeName := path.Base(fileName)
+	if safeName == "." || safeName == "/" || len(safeName) == 0 {
+		return buserr.New("ErrInvalidChar")
+	}
+
+	cli, err := docker.NewDockerClient()
+	if err != nil {
+		return err
+	}
+	defer cli.Close()
+
+	ctx := context.Background()
+	stat, err := cli.ContainerStatPath(ctx, req.ContainerID, req.Path)
+	if err != nil {
+		if _, mkErr := runContainerCommand(cli, req.ContainerID, []string{"mkdir", "-p", "--", req.Path}); mkErr != nil {
+			return mkErr
+		}
+		stat, err = cli.ContainerStatPath(ctx, req.ContainerID, req.Path)
+		if err != nil {
+			return err
+		}
+	}
+	if !stat.Mode.IsDir() {
+		return fmt.Errorf("path %s is not directory", req.Path)
+	}
+
+	pipeReader, pipeWriter := io.Pipe()
+	writeErr := make(chan error, 1)
+	go func() {
+		tw := tar.NewWriter(pipeWriter)
+		header := &tar.Header{
+			Name:    safeName,
+			Mode:    0644,
+			Size:    fileSize,
+			ModTime: time.Now(),
+		}
+		if err := tw.WriteHeader(header); err != nil {
+			_ = tw.Close()
+			_ = pipeWriter.CloseWithError(err)
+			writeErr <- err
+			return
+		}
+		if _, err := io.Copy(tw, file); err != nil {
+			_ = tw.Close()
+			_ = pipeWriter.CloseWithError(err)
+			writeErr <- err
+			return
+		}
+		if err := tw.Close(); err != nil {
+			_ = pipeWriter.CloseWithError(err)
+			writeErr <- err
+			return
+		}
+		_ = pipeWriter.Close()
+		writeErr <- nil
+	}()
+
+	err = cli.CopyToContainer(ctx, req.ContainerID, req.Path, pipeReader, container.CopyToContainerOptions{
+		CopyUIDGID: true,
+	})
+	if err != nil {
+		_ = pipeReader.CloseWithError(err)
+		_ = pipeWriter.CloseWithError(err)
+		<-writeErr
+		return err
+	}
+	if err := <-writeErr; err != nil {
+		return err
+	}
+	return nil
+}
+
+func (u *ContainerService) GetContainerFileContent(req dto.ContainerFileReq) (*dto.ContainerFileContent, error) {
+	if len(req.Path) == 0 {
+		return nil, buserr.New("ErrInvalidChar")
+	}
+	cli, err := docker.NewDockerClient()
+	if err != nil {
+		return nil, err
+	}
+	defer cli.Close()
+
+	stat, err := cli.ContainerStatPath(context.Background(), req.ContainerID, req.Path)
+	if err != nil {
+		return nil, err
+	}
+	if stat.Mode.IsDir() {
+		return nil, fmt.Errorf("path %s is directory", req.Path)
+	}
+
+	content := &dto.ContainerFileContent{Size: stat.Size}
+	headBytes, err := runContainerCommandRaw(cli, req.ContainerID, []string{"head", "-c", "4096", "--", req.Path})
+	if err != nil {
+		return nil, err
+	}
+	if bytes.IndexByte(headBytes, 0) >= 0 {
+		content.IsBinary = true
+		return content, nil
+	}
+
+	const inlinePreviewMax = 512 * 1024
+	if stat.Size <= inlinePreviewMax {
+		raw, err := runContainerCommandRaw(cli, req.ContainerID, []string{"cat", "--", req.Path})
+		if err != nil {
+			return nil, err
+		}
+		content.Content = string(raw)
+		return content, nil
+	}
+
+	raw, err := runContainerCommandRaw(cli, req.ContainerID, []string{"tail", "-n", "300", "--", req.Path})
+	if err != nil {
+		return nil, err
+	}
+	content.Content = string(raw)
+	content.Truncated = true
+	return content, nil
+}
+
+func (u *ContainerService) GetContainerFileSize(req dto.ContainerFileReq) (int64, error) {
+	if len(req.Path) == 0 {
+		return 0, buserr.New("ErrInvalidChar")
+	}
+	cli, err := docker.NewDockerClient()
+	if err != nil {
+		return 0, err
+	}
+	defer cli.Close()
+
+	stat, err := cli.ContainerStatPath(context.Background(), req.ContainerID, req.Path)
+	if err != nil {
+		return 0, err
+	}
+	if !stat.Mode.IsDir() {
+		return stat.Size, nil
+	}
+	output, err := runContainerCommand(cli, req.ContainerID, []string{"du", "-sb", "--", req.Path})
+	if err != nil {
+		return 0, err
+	}
+	parts := strings.Fields(output)
+	if len(parts) == 0 {
+		return 0, fmt.Errorf("invalid du output")
+	}
+	size, err := strconv.ParseInt(parts[0], 10, 64)
+	if err != nil {
+		return 0, err
+	}
+	return size, nil
+}
+
+func (u *ContainerService) DownloadContainerFile(req dto.ContainerFileReq) (io.ReadCloser, string, string, error) {
+	if len(req.Path) == 0 {
+		req.Path = "/"
+	}
+	cli, err := docker.NewDockerClient()
+	if err != nil {
+		return nil, "", "", err
+	}
+
+	ctx := context.Background()
+	stat, err := cli.ContainerStatPath(ctx, req.ContainerID, req.Path)
+	if err != nil {
+		_ = cli.Close()
+		return nil, "", "", err
+	}
+
+	fileName := stat.Name
+	if len(fileName) == 0 {
+		fileName = "container-file"
+	}
+	if stat.Mode.IsDir() {
+		if _, err := runContainerCommand(cli, req.ContainerID, []string{"sh", "-c", "command -v tar >/dev/null 2>&1"}); err != nil {
+			_ = cli.Close()
+			return nil, "", "", fmt.Errorf("tar command not found in container")
+		}
+
+		targetPath := path.Clean(req.Path)
+		parentPath := path.Dir(targetPath)
+		targetName := path.Base(targetPath)
+		if parentPath == "." || parentPath == "" {
+			parentPath = "/"
+		}
+		tarStream, err := runContainerCommandStream(cli, req.ContainerID, []string{
+			"tar", "-czf", "-", "-C", parentPath, "--", targetName,
+		})
+		if err != nil {
+			_ = cli.Close()
+			return nil, "", "", err
+		}
+		if !strings.HasSuffix(fileName, ".tar.gz") {
+			fileName += ".tar.gz"
+		}
+		return &closeHookReader{
+			ReadCloser: tarStream,
+			onClose:    cli.Close,
+		}, fileName, "application/gzip", nil
+	}
+
+	fileStream, err := runContainerCommandStream(cli, req.ContainerID, []string{"cat", "--", req.Path})
+	if err != nil {
+		_ = cli.Close()
+		return nil, "", "", err
+	}
+	return &closeHookReader{
+		ReadCloser: fileStream,
+		onClose:    cli.Close,
+	}, fileName, "application/octet-stream", nil
+}
+
+func runContainerCommand(cli *client.Client, containerID string, command []string) (string, error) {
+	raw, err := runContainerCommandRaw(cli, containerID, command)
+	if err != nil {
+		return "", err
+	}
+	return strings.TrimSpace(string(raw)), nil
+}
+
+type closeHookReader struct {
+	io.ReadCloser
+	onClose func() error
+}
+
+func (r *closeHookReader) Close() error {
+	var closeErr error
+	if r.ReadCloser != nil {
+		closeErr = r.ReadCloser.Close()
+	}
+	if r.onClose != nil {
+		if err := r.onClose(); err != nil && closeErr == nil {
+			closeErr = err
+		}
+	}
+	return closeErr
+}
+
+func runContainerCommandRaw(cli *client.Client, containerID string, command []string) ([]byte, error) {
+	ctx := context.Background()
+	resp, err := cli.ContainerExecCreate(ctx, containerID, container.ExecOptions{
+		Cmd:          command,
+		AttachStdout: true,
+		AttachStderr: true,
+	})
+	if err != nil {
+		return nil, err
+	}
+	hijack, err := cli.ContainerExecAttach(ctx, resp.ID, container.ExecAttachOptions{})
+	if err != nil {
+		return nil, err
+	}
+	defer hijack.Close()
+
+	raw, err := io.ReadAll(hijack.Reader)
+	if err != nil {
+		return nil, err
+	}
+	var stdout bytes.Buffer
+	var stderr bytes.Buffer
+	if _, err := stdcopy.StdCopy(&stdout, &stderr, bytes.NewReader(raw)); err != nil {
+		return nil, err
+	}
+	output := strings.TrimSpace(stdout.String())
+	errorOutput := strings.TrimSpace(stderr.String())
+	info, err := cli.ContainerExecInspect(ctx, resp.ID)
+	if err != nil {
+		return nil, err
+	}
+	if info.ExitCode != 0 {
+		if len(errorOutput) != 0 {
+			return nil, fmt.Errorf("%s", errorOutput)
+		}
+		if len(output) == 0 {
+			return nil, fmt.Errorf("container command failed with exit code %d", info.ExitCode)
+		}
+		return nil, fmt.Errorf("%s", output)
+	}
+	return stdout.Bytes(), nil
+}
+
+func runContainerCommandStream(cli *client.Client, containerID string, command []string) (io.ReadCloser, error) {
+	ctx := context.Background()
+	resp, err := cli.ContainerExecCreate(ctx, containerID, container.ExecOptions{
+		Cmd:          command,
+		AttachStdout: true,
+		AttachStderr: true,
+	})
+	if err != nil {
+		return nil, err
+	}
+	hijack, err := cli.ContainerExecAttach(ctx, resp.ID, container.ExecAttachOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	pipeReader, pipeWriter := io.Pipe()
+	go func() {
+		defer hijack.Close()
+		var stderr bytes.Buffer
+		_, copyErr := stdcopy.StdCopy(pipeWriter, &stderr, hijack.Reader)
+		if copyErr != nil {
+			_ = pipeWriter.CloseWithError(copyErr)
+			return
+		}
+		info, inspectErr := cli.ContainerExecInspect(ctx, resp.ID)
+		if inspectErr != nil {
+			_ = pipeWriter.CloseWithError(inspectErr)
+			return
+		}
+		if info.ExitCode != 0 {
+			msg := strings.TrimSpace(stderr.String())
+			if len(msg) == 0 {
+				msg = fmt.Sprintf("container command failed with exit code %d", info.ExitCode)
+			}
+			_ = pipeWriter.CloseWithError(fmt.Errorf("%s", msg))
+			return
+		}
+		_ = pipeWriter.Close()
+	}()
+	return pipeReader, nil
+}
+
+func toContainerFileInfo(filePath string, stat container.PathStat, isDir bool) dto.ContainerFileInfo {
+	name := stat.Name
+	if len(name) == 0 {
+		items := strings.Split(strings.TrimSuffix(filePath, "/"), "/")
+		name = items[len(items)-1]
+	}
+	isLink := stat.Mode&os.ModeSymlink != 0
+	return dto.ContainerFileInfo{
+		Name:    name,
+		Path:    filePath,
+		IsDir:   isDir,
+		IsLink:  isLink,
+		LinkTo:  stat.LinkTarget,
+		Size:    stat.Size,
+		Mode:    stat.Mode.String(),
+		ModTime: stat.Mtime.Format(constant.DateTimeLayout),
+	}
+}
+
+func isContainerDir(cli *client.Client, containerID, targetPath string) (bool, error) {
+	_, err := runContainerCommand(cli, containerID, []string{
+		"sh", "-c", "[ -d \"$1\" ]", "sh", targetPath,
+	})
+	if err != nil {
+		return false, err
+	}
+	return true, nil
+}
+
 func stringsToMap(list []string) map[string]string {
 	var labelMap = make(map[string]string)
 	for _, label := range list {
@@ -1478,6 +1908,13 @@ func loadConfigInfo(isCreate bool, req dto.ContainerOperate, oldContainer *conta
 	hostConf.Binds = []string{}
 	hostConf.Mounts = []mount.Mount{}
 	hostConf.DNS = req.DNS
+	hostConf.ExtraHosts = []string{}
+	for _, item := range req.ExtraHosts {
+		if len(item.Hostname) == 0 || len(item.IP) == 0 {
+			continue
+		}
+		hostConf.ExtraHosts = append(hostConf.ExtraHosts, fmt.Sprintf("%s:%s", item.Hostname, item.IP))
+	}
 	config.Volumes = make(map[string]struct{})
 	for _, volume := range req.Volumes {
 		item := mount.Mount{

agent/app/service/container_compose.go

@@ -205,7 +205,7 @@ func (u *ContainerService) CreateCompose(req dto.ComposeCreate) error {
 	}
 	go func() {
 		taskItem.AddSubTask(i18n.GetMsgByKey("ComposeCreate"), func(t *task.Task) error {
-			err := compose.UpWithTask(req.Path, t)
+			err := compose.UpWithTask(req.Path, t, req.ForcePull)
 			t.LogWithStatus(i18n.GetMsgByKey("ComposeCreate"), err)
 			if err != nil {
 				_, _ = compose.Down(req.Path)
@@ -258,31 +258,43 @@ func (u *ContainerService) ComposeUpdate(req dto.ComposeUpdate) error {
 	if cmd.CheckIllegal(req.Name, req.Path) {
 		return buserr.New("ErrCmdIllegal")
 	}
-	oldFile, err := os.ReadFile(req.DetailPath)
-	if err != nil {
-		return fmt.Errorf("load file with path %s failed, %v", req.DetailPath, err)
-	}
-	file, err := os.OpenFile(req.DetailPath, os.O_WRONLY|os.O_TRUNC, 0640)
+	taskItem, err := task.NewTaskWithOps(req.Name, task.TaskUpdate, task.TaskScopeCompose, req.TaskID, 1)
 	if err != nil {
+		global.LOG.Errorf("new task for update compose failed, err: %v", err)
 		return err
 	}
-	defer file.Close()
-	write := bufio.NewWriter(file)
-	_, _ = write.WriteString(req.Content)
-	write.Flush()
+	go func() {
+		taskItem.AddSubTask(i18n.GetMsgByKey("TaskUpdate"), func(t *task.Task) error {
+			oldFile, err := os.ReadFile(req.DetailPath)
+			if err != nil {
+				return fmt.Errorf("load file with path %s failed, %v", req.DetailPath, err)
+			}
+			file, err := os.OpenFile(req.DetailPath, os.O_WRONLY|os.O_TRUNC, 0640)
+			if err != nil {
+				return err
+			}
+			defer file.Close()
+			write := bufio.NewWriter(file)
+			_, _ = write.WriteString(req.Content)
+			write.Flush()
 
-	global.LOG.Infof("docker-compose.yml %s has been replaced, now start to docker-compose restart", req.DetailPath)
-	if err := newComposeEnv(req.DetailPath, req.Env); err != nil {
-		return err
-	}
+			global.LOG.Infof("docker-compose.yml %s has been replaced, now start to docker-compose restart", req.DetailPath)
+			if err := newComposeEnv(req.DetailPath, req.Env); err != nil {
+				return err
+			}
 
-	if stdout, err := compose.Up(req.Path); err != nil {
-		global.LOG.Errorf("update failed when handle compose up, std: %s, err: %s, now try to recreate the old compose file", stdout, err)
-		if err := recreateCompose(string(oldFile), req.Path); err != nil {
-			return fmt.Errorf("update failed and recreate old compose file also failed, err: %v", err)
-		}
-		return fmt.Errorf("update failed when handle compose up, std: %v, err: %s", stdout, err)
-	}
+			if err := compose.UpWithTask(req.Path, t, req.ForcePull); err != nil {
+				global.LOG.Errorf("update failed when handle compose up, err: %s, now try to recreate the old compose file", err)
+				if err := recreateCompose(string(oldFile), req.Path); err != nil {
+					return fmt.Errorf("update failed and recreate old compose file also failed, err: %v", err)
+				}
+				return fmt.Errorf("update failed when handle compose up, err: %s", err)
+			}
+
+			return nil
+		}, nil)
+		_ = taskItem.Execute()
+	}()
 
 	return nil
 }
@@ -338,6 +350,15 @@ func (u *ContainerService) ComposeLogClean(req dto.ComposeLogClean) error {
 	})
 }
 
+func (u *ContainerService) LoadComposeEnv(name string) (string, error) {
+	envFilePath := path.Join(path.Dir(name), ".env")
+	file, err := os.ReadFile(envFilePath)
+	if err != nil {
+		return "", err
+	}
+	return string(file), nil
+}
+
 func (u *ContainerService) loadPath(req *dto.ComposeCreate) error {
 	if req.From == "template" || req.From == "edit" {
 		dir := fmt.Sprintf("%s/docker/compose/%s", global.Dir.DataDir, req.Name)

agent/app/service/cronjob.go

@@ -765,7 +765,7 @@ func (u *CronjobService) UpdateStatus(id uint, status string) error {
 	)
 
 	if status == constant.StatusEnable {
-		entryIDs, err = u.StartJob(&cronjob, false)
+		entryIDs, err = u.StartJob(&cronjob, true)
 		if err != nil {
 			return err
 		}

agent/app/service/cronjob_helper.go

@@ -418,7 +418,7 @@ func (u *CronjobService) removeExpiredBackup(cronjob model.Cronjob, accountMap m
 	var opts []repo.DBOption
 	opts = append(opts, repo.WithByFrom("cronjob"))
 	opts = append(opts, backupRepo.WithByCronID(cronjob.ID))
-	opts = append(opts, repo.WithOrderBy("created_at desc"))
+	opts = append(opts, repo.WithOrderDesc("created_at"))
 	if record.ID != 0 {
 		opts = append(opts, repo.WithByType(record.Type))
 		opts = append(opts, repo.WithByName(record.Name))
@@ -461,7 +461,7 @@ func (u *CronjobService) removeExpiredBackup(cronjob model.Cronjob, accountMap m
 }
 
 func (u *CronjobService) removeExpiredLog(cronjob model.Cronjob) {
-	records, _ := cronjobRepo.ListRecord(cronjobRepo.WithByJobID(int(cronjob.ID)), repo.WithOrderBy("created_at desc"))
+	records, _ := cronjobRepo.ListRecord(cronjobRepo.WithByJobID(int(cronjob.ID)), repo.WithOrderDesc("created_at"))
 	if len(records) <= int(cronjob.RetainCopies) {
 		return
 	}

agent/app/service/dashboard.go

@@ -142,7 +142,7 @@ func (u *DashboardService) LoadCurrentInfoForNode() *dto.NodeCurrent {
 
 func (u *DashboardService) LoadBaseInfo(ioOption string, netOption string) (*dto.DashboardBase, error) {
 	var baseInfo dto.DashboardBase
-	hostInfo, err := psutil.HOST.GetHostInfo(false)
+	hostInfo, err := psutil.HOST.GetHostInfo(true)
 	if err != nil {
 		return nil, err
 	}
@@ -284,7 +284,7 @@ func (u *DashboardService) LoadAppLauncher(ctx *gin.Context) ([]dto.AppLauncher,
 		return data, err
 	}
 
-	showList, err := launcherRepo.ListName()
+	showList, _ := launcherRepo.ListName()
 	defaultList, err := appRepo.GetTopRecommend()
 	if err != nil {
 		return data, nil
@@ -361,6 +361,9 @@ func (u *DashboardService) LoadQuickOptions() []dto.QuickJump {
 		_ = copier.Copy(&item, &quick)
 		list = append(list, item)
 	}
+	sort.Slice(list, func(i, j int) bool {
+		return list[i].Recommend < list[j].Recommend
+	})
 	return list
 }
 func (u *DashboardService) ChangeQuick(req dto.ChangeQuicks) error {
@@ -612,6 +615,9 @@ func loadQuickJump(base *dto.DashboardBase) {
 	website, _ := websiteRepo.GetBy()
 	base.WebsiteNumber = len(website)
 
+	agents, _ := agentRepo.List()
+	base.AgentNumber = len(agents)
+
 	postgresqlDbs, _ := postgresqlRepo.List()
 	mysqlDbs, _ := mysqlRepo.List()
 	base.DatabaseNumber = len(mysqlDbs) + len(postgresqlDbs)
@@ -625,6 +631,8 @@ func loadQuickJump(base *dto.DashboardBase) {
 	quicks := launcherRepo.ListQuickJump(false)
 	for i := 0; i < len(quicks); i++ {
 		switch quicks[i].Name {
+		case "Agent":
+			quicks[i].Detail = fmt.Sprintf("%d", base.AgentNumber)
 		case "Website":
 			quicks[i].Detail = fmt.Sprintf("%d", base.WebsiteNumber)
 		case "Database":
@@ -638,7 +646,7 @@ func loadQuickJump(base *dto.DashboardBase) {
 		_ = copier.Copy(&item, quicks[i])
 		base.QuickJumps = append(base.QuickJumps, item)
 	}
-	sort.Slice(quicks, func(i, j int) bool {
-		return quicks[i].Recommend < quicks[j].Recommend
+	sort.Slice(base.QuickJumps, func(i, j int) bool {
+		return base.QuickJumps[i].Recommend < base.QuickJumps[j].Recommend
 	})
 }

agent/app/service/database_common.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"path"
+	"path/filepath"
 	"strings"
 
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
@@ -43,6 +44,10 @@ func (u *DBCommonService) LoadBaseInfo(req dto.OperationWithNameAndType) (*dto.D
 
 func (u *DBCommonService) LoadDatabaseFile(req dto.OperationWithNameAndType) (string, error) {
 	filePath := ""
+	safeName := filepath.Base(req.Name)
+	if safeName != req.Name || strings.Contains(safeName, "..") {
+		return "", buserr.New("ErrInvalidParams")
+	}
 	switch req.Type {
 	case "mysql-cluster-conf":
 		filePath = path.Join(global.Dir.DataDir, fmt.Sprintf("apps/mysql-cluster/%s/conf/my.cnf", req.Name))

agent/app/service/device.go

@@ -109,7 +109,7 @@ func (u *DeviceService) CheckDNS(key, value string) (bool, error) {
 	if err != nil {
 		return false, err
 	}
-	defer conn.Close()
+	defer func() { _ = conn.Close() }()
 
 	return true, nil
 }
@@ -132,7 +132,7 @@ func (u *DeviceService) Update(key, value string) error {
 		if cmd.CheckIllegal(value) {
 			return buserr.New("ErrCmdIllegal")
 		}
-		if err := cmd.RunDefaultBashCf("%s hostnamectl set-hostname %s", cmd.SudoHandleCmd(), value); err != nil {
+		if err := cmd.NewCommandMgr(cmd.WithTimeout(20*time.Second)).Run("hostnamectl", "set-hostname", value); err != nil {
 			return err
 		}
 		_, _ = psutil.HOST.GetHostInfo(true)
@@ -245,7 +245,7 @@ func (u *DeviceService) UpdateSwap(req dto.SwapHelper) error {
 		}
 		cmdMgr := cmd.NewCommandMgr(cmd.WithTask(*taskItem))
 		if !req.IsNew {
-			if err := cmdMgr.RunBashCf("%s swapoff %s", cmd.SudoHandleCmd(), req.Path); err != nil {
+			if err := cmdMgr.Run("swapoff", req.Path); err != nil {
 				return fmt.Errorf("handle swapoff %s failed, %v", req.Path, err)
 			}
 		}
@@ -256,22 +256,22 @@ func (u *DeviceService) UpdateSwap(req dto.SwapHelper) error {
 			return operateSwapWithFile(true, req)
 		}
 		taskItem.LogStart(i18n.GetMsgByKey("CreateSwap"))
-		if err := cmdMgr.RunBashCf("%s dd if=/dev/zero of=%s bs=1024 count=%d", cmd.SudoHandleCmd(), req.Path, req.Size); err != nil {
+		if err := cmdMgr.Run("dd", "if=/dev/zero", fmt.Sprintf("of=%s", req.Path), "bs=1024", fmt.Sprintf("count=%d", req.Size)); err != nil {
 			return fmt.Errorf("handle dd %s failed, %v", req.Path, err)
 		}
 
 		taskItem.Log("chmod 0600 " + req.Path)
-		if err := cmdMgr.RunBashCf("%s chmod 0600 %s", cmd.SudoHandleCmd(), req.Path); err != nil {
+		if err := cmdMgr.Run("chmod", "0600", req.Path); err != nil {
 			return fmt.Errorf("handle chmod 0600 %s failed, %v", req.Path, err)
 		}
 		taskItem.LogStart(i18n.GetMsgByKey("FormatSwap"))
-		if err := cmdMgr.RunBashCf("%s mkswap -f %s", cmd.SudoHandleCmd(), req.Path); err != nil {
+		if err := cmdMgr.Run("mkswap", "-f", req.Path); err != nil {
 			return fmt.Errorf("handle mkswap -f %s failed, %v", req.Path, err)
 		}
 
 		taskItem.LogStart(i18n.GetMsgByKey("EnableSwap"))
-		if err := cmdMgr.RunBashCf("%s swapon %s", cmd.SudoHandleCmd(), req.Path); err != nil {
-			_ = cmdMgr.RunBashCf("%s swapoff %s", cmd.SudoHandleCmd(), req.Path)
+		if err := cmdMgr.Run("swapon", req.Path); err != nil {
+			_ = cmdMgr.Run("swapoff", req.Path)
 			return fmt.Errorf("handle swapoff %s failed, %v", req.Path, err)
 		}
 		return operateSwapWithFile(false, req)

agent/app/service/disk.go

@@ -2,13 +2,14 @@ package service
 
 import (
 	"fmt"
+	"os"
+	"strings"
+	"time"
+
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/buserr"
 	"github.com/1Panel-dev/1Panel/agent/global"
 	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
-	"os"
-	"strings"
-	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/response"
@@ -50,6 +51,9 @@ func (s *DiskService) GetCompleteDiskInfo() (*response.CompleteDiskInfo, error)
 }
 
 func (s *DiskService) PartitionDisk(req request.DiskPartitionRequest) (string, error) {
+	if cmd.CheckIllegal(req.Device, req.Filesystem, req.MountPoint, req.Label) {
+		return "", buserr.New("ErrCmdIllegal")
+	}
 	if !strings.HasPrefix("/dev", req.Device) {
 		req.Device = "/dev/" + req.Device
 	}
@@ -62,19 +66,19 @@ func (s *DiskService) PartitionDisk(req request.DiskPartitionRequest) (string, e
 	}
 
 	cmdMgr := cmd.NewCommandMgr(cmd.WithTimeout(10 * time.Second))
-	if err := cmdMgr.RunBashC(fmt.Sprintf("partprobe %s", req.Device)); err != nil {
+	if err := cmdMgr.Run("partprobe", req.Device); err != nil {
 		return "", buserr.WithErr("PartitionDiskErr", err)
 	}
 
-	if err := cmdMgr.RunBashC(fmt.Sprintf("parted -s %s mklabel gpt", req.Device)); err != nil {
+	if err := cmdMgr.Run("parted", "-s", req.Device, "mklabel", "gpt"); err != nil {
 		return "", buserr.WithErr("PartitionDiskErr", err)
 	}
 
-	if err := cmdMgr.RunBashC(fmt.Sprintf("parted -s %s mkpart primary 1MiB 100%%", req.Device)); err != nil {
+	if err := cmdMgr.Run("parted", "-s", req.Device, "mkpart", "primary", "1MiB", "100%"); err != nil {
 		return "", buserr.WithErr("PartitionDiskErr", err)
 	}
 
-	if err := cmdMgr.RunBashC(fmt.Sprintf("partprobe %s", req.Device)); err != nil {
+	if err := cmdMgr.Run("partprobe", req.Device); err != nil {
 		return "", buserr.WithErr("PartitionDiskErr", err)
 	}
 	partition := req.Device + "1"
@@ -104,6 +108,9 @@ func (s *DiskService) PartitionDisk(req request.DiskPartitionRequest) (string, e
 }
 
 func (s *DiskService) MountDisk(req request.DiskMountRequest) error {
+	if cmd.CheckIllegal(req.Device, req.MountPoint, req.Filesystem) {
+		return buserr.New("ErrCmdIllegal")
+	}
 	if !deviceExists(req.Device) {
 		return buserr.WithName("DeviceNotFound", req.Device)
 	}
@@ -127,7 +134,7 @@ func (s *DiskService) MountDisk(req request.DiskMountRequest) error {
 	}
 
 	cmdMgr := cmd.NewCommandMgr(cmd.WithTimeout(1 * time.Minute))
-	if err := cmdMgr.RunBashC(fmt.Sprintf("mount  -t %s %s %s", req.Filesystem, req.Device, req.MountPoint)); err != nil {
+	if err := cmdMgr.Run("mount", "-t", req.Filesystem, req.Device, req.MountPoint); err != nil {
 		return buserr.WithErr("MountDiskErr", err)
 	}
 	if req.AutoMount {
@@ -144,10 +151,13 @@ func (s *DiskService) MountDisk(req request.DiskMountRequest) error {
 }
 
 func (s *DiskService) UnmountDisk(req request.DiskUnmountRequest) error {
+	if cmd.CheckIllegal(req.MountPoint) {
+		return buserr.New("ErrCmdIllegal")
+	}
 	if !isPointMounted(req.MountPoint) {
 		return buserr.New("MountDiskErr")
 	}
-	if err := cmd.RunDefaultBashC(fmt.Sprintf("umount -f  %s", req.MountPoint)); err != nil {
+	if err := cmd.NewCommandMgr(cmd.WithTimeout(20*time.Second)).Run("umount", "-f", req.MountPoint); err != nil {
 		return buserr.WithErr("MountDiskErr", err)
 	}
 	if err := removeFromFstab(req.MountPoint); err != nil {

agent/app/service/entry.go

@@ -12,9 +12,11 @@ var (
 	appInstallResourceRepo = repo.NewIAppInstallResourceRpo()
 	appIgnoreUpgradeRepo   = repo.NewIAppIgnoreUpgradeRepo()
 
-	aiRepo          = repo.NewIAiRepo()
-	mcpServerRepo   = repo.NewIMcpServerRepo()
-	tensorrtLLMRepo = repo.NewITensorRTLLMRepo()
+	aiRepo           = repo.NewIAiRepo()
+	mcpServerRepo    = repo.NewIMcpServerRepo()
+	tensorrtLLMRepo  = repo.NewITensorRTLLMRepo()
+	agentRepo        = repo.NewIAgentRepo()
+	agentAccountRepo = repo.NewIAgentAccountRepo()
 
 	mysqlRepo      = repo.NewIMysqlRepo()
 	postgresqlRepo = repo.NewIPostgresqlRepo()

agent/app/service/file.go

@@ -3,6 +3,7 @@ package service
 import (
 	"bufio"
 	"context"
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -75,12 +76,19 @@ type IFileService interface {
 	GetUsersAndGroups() (*response.UserGroupResponse, error)
 	Convert(req request.FileConvertRequest)
 	ConvertLog(req dto.PageInfo) (int64, []response.FileConvertLog, error)
+	BatchGetRemarks(req request.FileRemarkBatch) map[string]string
+	SetRemark(req request.FileRemarkUpdate) error
 }
 
 var filteredPaths = []string{
 	"/.1panel_clash",
 }
 
+const (
+	fileRemarkXattr         = "user.1panel.remark"
+	fileRemarkEncodedMaxLen = 256
+)
+
 func NewIFileService() IFileService {
 	return &FileService{}
 }
@@ -255,7 +263,7 @@ func (f *FileService) Create(op request.FileCreate) error {
 func (f *FileService) Delete(op request.FileDelete) error {
 	if op.IsDir {
 		excludeDir := global.Dir.DataDir
-		if filepath.Base(op.Path) == ".1panel_clash" || op.Path == excludeDir {
+		if path.Base(op.Path) == ".1panel_clash" || op.Path == excludeDir {
 			return buserr.New("ErrPathNotDelete")
 		}
 	}
@@ -307,19 +315,18 @@ func (f *FileService) ChangeMode(op request.FileCreate) error {
 
 func (f *FileService) BatchChangeModeAndOwner(op request.FileRoleReq) error {
 	fo := files.NewFileOp()
-	for _, path := range op.Paths {
-		if !fo.Stat(path) {
+	for _, p := range op.Paths {
+		if !fo.Stat(p) {
 			return buserr.New("ErrPathNotFound")
 		}
-		if err := fo.ChownR(path, op.User, op.Group, op.Sub); err != nil {
-			return err
-		}
-		if err := fo.ChmodR(path, op.Mode, op.Sub); err != nil {
-			return err
-		}
+	}
+	if err := fo.ChownRPaths(op.Paths, op.User, op.Group, op.Sub); err != nil {
+		return err
+	}
+	if err := fo.ChmodRPaths(op.Paths, op.Mode, op.Sub); err != nil {
+		return err
 	}
 	return nil
-
 }
 
 func (f *FileService) ChangeOwner(req request.FileRoleUpdate) error {
@@ -585,6 +592,12 @@ func (f *FileService) DepthDirSize(req request.DirSizeReq) ([]response.DepthDirS
 func (f *FileService) ReadLogByLine(req request.FileReadByLineReq) (*response.FileLineContent, error) {
 	logFilePath := ""
 	taskStatus := ""
+	if len(req.Name) != 0 {
+		safeName := path.Base(req.Name)
+		if safeName != req.Name || strings.Contains(safeName, "..") {
+			return nil, buserr.New("ErrInvalidParams")
+		}
+	}
 	switch req.Type {
 	case constant.TypeWebsite:
 		website, err := websiteRepo.GetFirst(repo.WithByID(req.ID))
@@ -642,9 +655,9 @@ func (f *FileService) ReadLogByLine(req request.FileReadByLineReq) (*response.Fi
 		logFilePath = taskModel.LogFile
 		taskStatus = taskModel.Status
 	case "mysql-slow-logs":
-		logFilePath = path.Join(global.Dir.DataDir, fmt.Sprintf("apps/mysql/%s/data/1Panel-slow.log", req.Name))
+		logFilePath = path.Join(global.Dir.DataDir, "apps", "mysql", req.Name, "data", "1Panel-slow.log")
 	case "mariadb-slow-logs":
-		logFilePath = path.Join(global.Dir.DataDir, fmt.Sprintf("apps/mariadb/%s/db/data/1Panel-slow.log", req.Name))
+		logFilePath = path.Join(global.Dir.DataDir, "apps", "mariadb", req.Name, "db", "data", "1Panel-slow.log")
 	case "php-fpm-slow-logs":
 		php, err := runtimeRepo.GetFirst(context.Background(), repo.WithByID(req.ID))
 		if err != nil {
@@ -659,8 +672,7 @@ func (f *FileService) ReadLogByLine(req request.FileReadByLineReq) (*response.Fi
 		}
 		logFilePath, _ = ini_conf.GetIniValue(configPath, "supervisord", "logfile")
 	case constant.Supervisor:
-		logDir := path.Join(global.Dir.DataDir, "tools", "supervisord", "log")
-		logFilePath = path.Join(logDir, req.Name)
+		logFilePath = path.Join(global.Dir.DataDir, "tools", "supervisord", "log", req.Name)
 	}
 
 	file, err := os.Open(logFilePath)
@@ -679,7 +691,7 @@ func (f *FileService) ReadLogByLine(req request.FileReadByLineReq) (*response.Fi
 		logFileRes  *dto.LogFileRes
 	)
 	if stat.Size() > files.MaxReadFileSize {
-		lines, err = files.TailFromEnd(logFilePath, req.PageSize)
+		lines, _ = files.TailFromEnd(logFilePath, req.PageSize)
 		isEndOfFile = true
 		scope = "tail"
 	} else {
@@ -760,6 +772,52 @@ func (f *FileService) GetUsersAndGroups() (*response.UserGroupResponse, error) {
 	}, nil
 }
 
+func (f *FileService) BatchGetRemarks(req request.FileRemarkBatch) map[string]string {
+	remarks := make(map[string]string)
+	for _, filePath := range req.Paths {
+		remark, err := getFileRemark(filePath)
+		if err != nil {
+			if isXattrNotSupported(err) {
+				return map[string]string{}
+			}
+			continue
+		}
+		if remark == "" {
+			continue
+		}
+		remarks[filePath] = remark
+	}
+
+	return remarks
+}
+
+func (f *FileService) SetRemark(req request.FileRemarkUpdate) error {
+	if req.Remark == "" {
+		if err := unix.Lremovexattr(req.Path, fileRemarkXattr); err != nil {
+			if isXattrNotFound(err) {
+				return nil
+			}
+			if isXattrNotSupported(err) {
+				return buserr.WithDetail("ErrInvalidParams", "xattr not supported", err)
+			}
+			return err
+		}
+		return nil
+	}
+
+	encoded := base64.StdEncoding.EncodeToString([]byte(req.Remark))
+	if len(encoded) >= fileRemarkEncodedMaxLen {
+		return buserr.WithDetail("ErrInvalidParams", "remark length must be less than 256", nil)
+	}
+	if err := unix.Lsetxattr(req.Path, fileRemarkXattr, []byte(encoded), 0); err != nil {
+		if isXattrNotSupported(err) {
+			return buserr.WithDetail("ErrInvalidParams", "xattr not supported", err)
+		}
+		return err
+	}
+	return nil
+}
+
 func getValidGroups() (map[string]bool, error) {
 	groupFile, err := os.Open("/etc/group")
 	if err != nil {
@@ -786,6 +844,37 @@ func getValidGroups() (map[string]bool, error) {
 	return groupMap, nil
 }
 
+func getFileRemark(filePath string) (string, error) {
+	size, err := unix.Lgetxattr(filePath, fileRemarkXattr, nil)
+	if err != nil {
+		if isXattrNotFound(err) {
+			return "", nil
+		}
+		return "", err
+	}
+	if size == 0 {
+		return "", nil
+	}
+	buf := make([]byte, size)
+	n, err := unix.Lgetxattr(filePath, fileRemarkXattr, buf)
+	if err != nil {
+		return "", err
+	}
+	decoded, err := base64.StdEncoding.DecodeString(string(buf[:n]))
+	if err != nil {
+		return "", err
+	}
+	return string(decoded), nil
+}
+
+func isXattrNotSupported(err error) bool {
+	return errors.Is(err, unix.ENOTSUP) || errors.Is(err, unix.EOPNOTSUPP)
+}
+
+func isXattrNotFound(err error) bool {
+	return errors.Is(err, unix.ENODATA)
+}
+
 func getValidUsers(validGroups map[string]bool) ([]response.UserInfo, map[string]struct{}, error) {
 	passwdFile, err := os.Open("/etc/passwd")
 	if err != nil {

agent/app/service/firewall.go

@@ -112,29 +112,15 @@ func (u *FirewallService) SearchWithPage(req dto.RuleSearch) (int64, interface{}
 		}
 	}
 
-	var datasFilterStatus []fireClient.FireInfo
-	if len(req.Status) != 0 {
-		for _, data := range datas {
-			if req.Status == "free" && len(data.UsedStatus) == 0 {
-				datasFilterStatus = append(datasFilterStatus, data)
-			}
-			if req.Status == "used" && len(data.UsedStatus) != 0 {
-				datasFilterStatus = append(datasFilterStatus, data)
-			}
-		}
-	} else {
-		datasFilterStatus = datas
-	}
-
 	var datasFilterStrategy []fireClient.FireInfo
 	if len(req.Strategy) != 0 {
-		for _, data := range datasFilterStatus {
+		for _, data := range datas {
 			if req.Strategy == data.Strategy {
 				datasFilterStrategy = append(datasFilterStrategy, data)
 			}
 		}
 	} else {
-		datasFilterStrategy = datasFilterStatus
+		datasFilterStrategy = datas
 	}
 
 	total, start, end := len(datasFilterStrategy), (req.Page-1)*req.PageSize, req.Page*req.PageSize
@@ -720,16 +706,9 @@ func checkPortUsed(ports, proto string, apps []portOfApp) string {
 
 	for _, app := range apps {
 		if app.HttpPort == ports || app.HttpsPort == ports {
-			return fmt.Sprintf("(%s)", app.AppName)
+			return app.AppName
 		}
 	}
-	port, err := strconv.Atoi(ports)
-	if err != nil {
-		global.LOG.Errorf(" convert string %v to int failed, err: %v", port, err)
-		return ""
-	}
-	if common.ScanPortWithProto(port, proto) {
-		return "inUsed"
-	}
+
 	return ""
 }

agent/app/service/ftp.go

@@ -76,7 +76,7 @@ func (u *FtpService) Operate(operation string) error {
 }
 
 func (f *FtpService) SearchWithPage(req dto.SearchWithPage) (int64, interface{}, error) {
-	total, lists, err := ftpRepo.Page(req.Page, req.PageSize, ftpRepo.WithLikeUser(req.Info), repo.WithOrderBy("created_at desc"))
+	total, lists, err := ftpRepo.Page(req.Page, req.PageSize, ftpRepo.WithLikeUser(req.Info), repo.WithOrderDesc("created_at"))
 	if err != nil {
 		return 0, nil, err
 	}

agent/app/service/group.go

@@ -24,8 +24,8 @@ func NewIGroupService() IGroupService {
 
 func (u *GroupService) List(req dto.OperateByType) ([]dto.GroupInfo, error) {
 	options := []repo.DBOption{
-		repo.WithOrderBy("is_default desc"),
-		repo.WithOrderBy("created_at desc"),
+		repo.WithOrderDesc("is_default"),
+		repo.WithOrderDesc("created_at"),
 	}
 	if len(req.Type) != 0 {
 		options = append(options, repo.WithByType(req.Type))

agent/app/service/host_tool.go

@@ -278,6 +278,10 @@ func (h *HostToolService) OperateSupervisorProcess(req request.SupervisorProcess
 }
 
 func handleProcess(supervisordDir string, req request.SupervisorProcessConfig, containerName string) error {
+	safeName := path.Base(req.Name)
+	if safeName != req.Name || strings.Contains(safeName, "..") {
+		return buserr.New("ErrInvalidParams")
+	}
 	var (
 		fileOp     = files.NewFileOp()
 		logDir     = path.Join(supervisordDir, "log")

agent/app/service/image.go

@@ -321,36 +321,44 @@ func (u *ImageService) ImagePull(req dto.ImagePull) error {
 }
 
 func (u *ImageService) ImageLoad(req dto.ImageLoad) error {
-	taskItem, err := task.NewTaskWithOps(req.Path, task.TaskImport, task.TaskScopeImage, req.TaskID, 1)
+	taskItem, err := task.NewTaskWithOps(strings.Join(req.Paths, ","), task.TaskImport, task.TaskScopeImage, req.TaskID, 1)
 	if err != nil {
 		return fmt.Errorf("new task for image import failed, err: %v", err)
 	}
-	taskItem.AddSubTask(i18n.GetWithName("TaskImport", req.Path), func(t *task.Task) error {
-		file, err := os.Open(req.Path)
-		if err != nil {
-			return err
-		}
-		defer file.Close()
+
+	go func() {
 		client, err := docker.NewDockerClient()
 		if err != nil {
-			return err
+			taskItem.Log("Failed to create Docker client: " + err.Error())
+			return
 		}
 		defer client.Close()
-		res, err := client.ImageLoad(context.TODO(), file)
-		if err != nil {
-			return err
+
+		for _, itemPath := range req.Paths {
+			currentPath := itemPath
+			itemName := path.Base(currentPath)
+			taskItem.AddSubTask(i18n.GetWithName("TaskImport", itemName), func(t *task.Task) error {
+				taskItem.Logf("----------------- %s -----------------", itemName)
+				file, err := os.Open(currentPath)
+				if err != nil {
+					return err
+				}
+				defer file.Close()
+				res, err := client.ImageLoad(context.TODO(), file)
+				if err != nil {
+					return err
+				}
+				defer res.Body.Close()
+				content, err := io.ReadAll(res.Body)
+				if err != nil {
+					return err
+				}
+				if strings.Contains(string(content), "Error") {
+					return errors.New(string(content))
+				}
+				return nil
+			}, nil)
 		}
-		defer res.Body.Close()
-		content, err := io.ReadAll(res.Body)
-		if err != nil {
-			return err
-		}
-		if strings.Contains(string(content), "Error") {
-			return errors.New(string(content))
-		}
-		return nil
-	}, nil)
-	go func() {
 		_ = taskItem.Execute()
 	}()
 	return nil

agent/app/service/image_repo.go

@@ -37,7 +37,7 @@ func NewIImageRepoService() IImageRepoService {
 }
 
 func (u *ImageRepoService) Page(req dto.SearchWithPage) (int64, interface{}, error) {
-	total, ops, err := imageRepoRepo.Page(req.Page, req.PageSize, repo.WithByLikeName(req.Info), repo.WithOrderBy("created_at desc"))
+	total, ops, err := imageRepoRepo.Page(req.Page, req.PageSize, repo.WithByLikeName(req.Info), repo.WithOrderDesc("created_at"))
 	var dtoOps []dto.ImageRepoInfo
 	for _, op := range ops {
 		var item dto.ImageRepoInfo
@@ -65,7 +65,7 @@ func (u *ImageRepoService) Login(req dto.OperateByID) error {
 }
 
 func (u *ImageRepoService) List() ([]dto.ImageRepoOption, error) {
-	ops, err := imageRepoRepo.List(repo.WithOrderBy("created_at desc"))
+	ops, err := imageRepoRepo.List(repo.WithOrderDesc("created_at"))
 	var dtoOps []dto.ImageRepoOption
 	for _, op := range ops {
 		if op.Status == constant.StatusSuccess {

agent/app/service/iptables.go

@@ -289,11 +289,11 @@ func (s *IptablesService) LoadChainStatus(req dto.OperationWithName) dto.Iptable
 	}
 	switch req.Name {
 	case iptables.Chain1PanelBasic:
-		data.IsBind, err = iptables.CheckChainBind(iptables.FilterTab, iptables.ChainInput, req.Name)
+		data.IsBind, _ = iptables.CheckChainBind(iptables.FilterTab, iptables.ChainInput, req.Name)
 	case iptables.Chain1PanelInput:
-		data.IsBind, err = iptables.CheckChainBind(iptables.FilterTab, iptables.ChainInput, req.Name)
+		data.IsBind, _ = iptables.CheckChainBind(iptables.FilterTab, iptables.ChainInput, req.Name)
 	case iptables.Chain1PanelOutput:
-		data.IsBind, err = iptables.CheckChainBind(iptables.FilterTab, iptables.ChainOutput, req.Name)
+		data.IsBind, _ = iptables.CheckChainBind(iptables.FilterTab, iptables.ChainOutput, req.Name)
 	}
 	return data
 }

agent/app/service/mcp_server.go

@@ -4,6 +4,10 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"path"
+	"strconv"
+	"strings"
+
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/response"
@@ -23,9 +27,6 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/utils/nginx/parser"
 	"github.com/subosito/gotenv"
 	"gopkg.in/yaml.v3"
-	"path"
-	"strconv"
-	"strings"
 )
 
 type McpServerService struct{}

agent/app/service/nginx.go

@@ -18,7 +18,6 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/buserr"
 	"github.com/1Panel-dev/1Panel/agent/global"
 	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
-	cmd2 "github.com/1Panel-dev/1Panel/agent/utils/cmd"
 	"github.com/subosito/gotenv"
 
 	"github.com/1Panel-dev/1Panel/agent/utils/compose"
@@ -241,7 +240,7 @@ func (n NginxService) Build(req request.NginxBuildReq) error {
 		return err
 	}
 	buildTask.AddSubTaskWithOps("", func(t *task.Task) error {
-		cmdMgr := cmd2.NewCommandMgr(cmd.WithTask(*buildTask), cmd.WithTimeout(120*time.Minute))
+		cmdMgr := cmd.NewCommandMgr(cmd.WithTask(*buildTask), cmd.WithTimeout(120*time.Minute))
 		if err = cmdMgr.RunBashCf("docker compose -f %s build", nginxInstall.GetComposePath()); err != nil {
 			return err
 		}

agent/app/service/process.go

@@ -2,15 +2,19 @@ package service
 
 import (
 	"bufio"
+	"context"
 	"fmt"
-	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
-	"github.com/1Panel-dev/1Panel/agent/utils/common"
-	"github.com/1Panel-dev/1Panel/agent/utils/websocket"
-	"github.com/shirou/gopsutil/v4/process"
 	"os"
 	"strconv"
 	"strings"
+	"syscall"
 	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
+	"github.com/1Panel-dev/1Panel/agent/utils/common"
+	"github.com/1Panel-dev/1Panel/agent/utils/websocket"
+	"github.com/shirou/gopsutil/v4/net"
+	"github.com/shirou/gopsutil/v4/process"
 )
 
 type ProcessService struct{}
@@ -18,6 +22,7 @@ type ProcessService struct{}
 type IProcessService interface {
 	StopProcess(req request.ProcessReq) error
 	GetProcessInfoByPID(pid int32) (*websocket.PsProcessData, error)
+	GetListeningProcess(c context.Context) ([]ListeningProcess, error)
 }
 
 func NewIProcessService() IProcessService {
@@ -35,6 +40,55 @@ func (ps *ProcessService) StopProcess(req request.ProcessReq) error {
 	return nil
 }
 
+type ListeningProcess struct {
+	PID      int32
+	Port     map[uint32]struct{}
+	Protocol uint32
+	Name     string
+}
+
+func (ps *ProcessService) GetListeningProcess(c context.Context) ([]ListeningProcess, error) {
+	conn, err := net.ConnectionsMaxWithContext(c, "inet", 32768)
+	if err != nil {
+		return nil, err
+	}
+	procCache := make(map[int32]ListeningProcess, 64)
+
+	for _, conn := range conn {
+		if conn.Pid == 0 {
+			continue
+		}
+
+		if (conn.Status == "LISTEN" && conn.Type == syscall.SOCK_STREAM) || (conn.Type == syscall.SOCK_DGRAM && conn.Raddr.Port == 0) {
+			if _, exists := procCache[conn.Pid]; !exists {
+				proc, err := process.NewProcess(conn.Pid)
+				if err != nil {
+					continue
+				}
+				procData := ListeningProcess{
+					PID: conn.Pid,
+				}
+				procData.Name, _ = proc.Name()
+				procData.Port = make(map[uint32]struct{})
+				procData.Port[conn.Laddr.Port] = struct{}{}
+				procData.Protocol = conn.Type
+				procCache[conn.Pid] = procData
+			} else {
+				p := procCache[conn.Pid]
+				p.Port[conn.Laddr.Port] = struct{}{}
+				procCache[conn.Pid] = p
+			}
+		}
+	}
+
+	procs := make([]ListeningProcess, 0, len(procCache))
+	for _, proc := range procCache {
+		procs = append(procs, proc)
+	}
+
+	return procs, nil
+}
+
 func (ps *ProcessService) GetProcessInfoByPID(pid int32) (*websocket.PsProcessData, error) {
 	p, err := process.NewProcess(pid)
 	if err != nil {

agent/app/service/runtime.go

@@ -677,7 +677,7 @@ func (r *RuntimeService) GetPHPExtensions(runtimeID uint) (response.PHPExtension
 		return res, err
 	}
 	cmdMgr := cmd.NewCommandMgr(cmd.WithTimeout(20 * time.Second))
-	out, err := cmdMgr.RunWithStdoutBashCf("docker exec -i %s php -m", runtime.ContainerName)
+	out, err := cmdMgr.RunWithStdout("docker", "exec", "-i", runtime.ContainerName, "php", "-m")
 	if err != nil {
 		return res, err
 	}
@@ -722,7 +722,7 @@ func (r *RuntimeService) InstallPHPExtension(req request.PHPExtensionInstallReq)
 	}
 	installTask.AddSubTask("", func(t *task.Task) error {
 		err = cmd.NewCommandMgr(cmd.WithTask(*installTask), cmd.WithTimeout(20*time.Minute)).
-			RunBashCf("docker exec -i %s install-ext %s", runtime.ContainerName, req.Name)
+			Run("docker", "exec", "-i", runtime.ContainerName, "install-ext", req.Name)
 		if err != nil {
 			return err
 		}
@@ -736,7 +736,7 @@ func (r *RuntimeService) InstallPHPExtension(req request.PHPExtensionInstallReq)
 			return err
 		}
 		err = cmd.NewCommandMgr(cmd.WithTask(*installTask), cmd.WithTimeout(15*time.Minute)).
-			RunBashCf("docker commit %s %s", runtime.ContainerName, runtime.Image)
+			Run("docker", "commit", runtime.ContainerName, runtime.Image)
 		if err != nil {
 			return err
 		}

agent/app/service/snapshot_recover.go

@@ -133,7 +133,7 @@ func (u *SnapshotService) SnapshotRecover(req dto.SnapshotRecover) error {
 
 		var snapJson SnapshotJson
 		taskItem.AddSubTaskWithAliasAndOps(
-			"Readjson",
+			"ReadJson",
 			func(t *task.Task) error {
 				snapJson, err = readFromJson(path.Join(rootDir, snap.Name), &itemHelper)
 				return err
@@ -156,14 +156,6 @@ func (u *SnapshotService) SnapshotRecover(req dto.SnapshotRecover) error {
 			)
 			req.IsNew = true
 		}
-		if req.IsNew || snap.InterruptStep == "RecoverDBData" {
-			taskItem.AddSubTaskWithAliasAndOps(
-				"RecoverDBData",
-				func(t *task.Task) error { return recoverDBData(path.Join(rootDir, snap.Name, "db"), &itemHelper) },
-				nil, 0, 90*time.Minute,
-			)
-			req.IsNew = true
-		}
 		if req.IsNew || snap.InterruptStep == "RecoverBackups" {
 			taskItem.AddSubTaskWithAliasAndOps(
 				"RecoverBackups",
@@ -222,13 +214,24 @@ func (u *SnapshotService) SnapshotRecover(req dto.SnapshotRecover) error {
 			)
 			req.IsNew = true
 		}
-		taskItem.AddSubTaskWithAliasAndOps(
-			"RecoverDBData",
-			func(t *task.Task) error {
-				return restartCompose(path.Join(snapJson.BaseDir, "1panel/docker/compose"), &itemHelper)
-			},
-			nil, 0, 90*time.Minute,
-		)
+		if req.IsNew || snap.InterruptStep == "RecoverCompose" {
+			taskItem.AddSubTaskWithAliasAndOps(
+				"RecoverCompose",
+				func(t *task.Task) error {
+					return restartCompose(path.Join(snapJson.BaseDir, "1panel/docker/compose"), &itemHelper)
+				},
+				nil, 0, 90*time.Minute,
+			)
+			req.IsNew = true
+		}
+		if req.IsNew || snap.InterruptStep == "RecoverDBData" {
+			taskItem.AddSubTaskWithAliasAndOps(
+				"RecoverDBData",
+				func(t *task.Task) error { return recoverDBData(path.Join(rootDir, snap.Name, "db"), &itemHelper) },
+				nil, 0, 90*time.Minute,
+			)
+			req.IsNew = true
+		}
 
 		if err := taskItem.Execute(); err != nil {
 			_ = settingRepo.Update("SystemStatus", "Free")
@@ -343,22 +346,22 @@ func backupBeforeRecover(name string, itemHelper *snapRecoverHelper) error {
 
 func readFromJson(rootDir string, itemHelper *snapRecoverHelper) (SnapshotJson, error) {
 	itemHelper.Task.Log("---------------------- 4 / 11 ----------------------")
-	itemHelper.Task.LogStart(i18n.GetMsgByKey("Readjson"))
+	itemHelper.Task.LogStart(i18n.GetMsgByKey("ReadJson"))
 
 	snapJsonPath := path.Join(rootDir, "base/snapshot.json")
 	var snap SnapshotJson
 	_, err := os.Stat(snapJsonPath)
-	itemHelper.Task.LogWithStatus(i18n.GetMsgByKey("ReadjsonPath"), err)
+	itemHelper.Task.LogWithStatus(i18n.GetMsgByKey("ReadJsonPath"), err)
 	if err != nil {
 		return snap, err
 	}
 	fileByte, err := os.ReadFile(snapJsonPath)
-	itemHelper.Task.LogWithStatus(i18n.GetMsgByKey("ReadjsonContent"), err)
+	itemHelper.Task.LogWithStatus(i18n.GetMsgByKey("ReadJsonContent"), err)
 	if err != nil {
 		return snap, err
 	}
 	err = json.Unmarshal(fileByte, &snap)
-	itemHelper.Task.LogWithStatus(i18n.GetMsgByKey("ReadjsonMarshal"), err)
+	itemHelper.Task.LogWithStatus(i18n.GetMsgByKey("ReadJsonMarshal"), err)
 	if err != nil {
 		return snap, err
 	}
@@ -439,17 +442,8 @@ func recoverBaseData(src string, itemHelper *snapRecoverHelper) error {
 	return nil
 }
 
-func recoverDBData(src string, itemHelper *snapRecoverHelper) error {
-	itemHelper.Task.Log("---------------------- 7 / 11 ----------------------")
-	itemHelper.Task.LogStart(i18n.GetMsgByKey("RecoverDBData"))
-	err := itemHelper.FileOp.CopyDirWithExclude(src, global.Dir.DataDir, nil)
-
-	itemHelper.Task.LogWithStatus(i18n.GetMsgByKey("RecoverDBData"), err)
-	return err
-}
-
 func restartCompose(composePath string, itemHelper *snapRecoverHelper) error {
-	itemHelper.Task.Log("---------------------- 11 / 11 ----------------------")
+	itemHelper.Task.Log("---------------------- 7 / 11 ----------------------")
 	itemHelper.Task.LogStart(i18n.GetMsgByKey("RecoverCompose"))
 
 	composes, err := composeRepo.ListRecord()
@@ -472,3 +466,64 @@ func restartCompose(composePath string, itemHelper *snapRecoverHelper) error {
 	}
 	return nil
 }
+
+func recoverDBData(src string, itemHelper *snapRecoverHelper) error {
+	itemHelper.Task.Log("---------------------- 11 / 11 ----------------------")
+	itemHelper.Task.LogStart(i18n.GetMsgByKey("RecoverDBData"))
+	dbDir := path.Join(global.Dir.DataDir, "db")
+	if err := os.RemoveAll(dbDir); err != nil {
+		itemHelper.Task.LogWithStatus(i18n.GetMsgByKey("RecoverDBData"), err)
+		return err
+	}
+
+	err := itemHelper.FileOp.CopyDirWithExclude(src, global.Dir.DataDir, nil)
+	if err != nil {
+		itemHelper.Task.LogWithStatus(i18n.GetMsgByKey("RecoverDBData"), err)
+		return err
+	}
+	if cleanErr := cleanOrphanSQLiteSidecars(dbDir); cleanErr != nil {
+		itemHelper.Task.LogWithStatus(i18n.GetMsgByKey("RecoverDBData"), cleanErr)
+		return cleanErr
+	}
+
+	itemHelper.Task.LogWithStatus(i18n.GetMsgByKey("RecoverDBData"), nil)
+	return nil
+}
+
+func cleanOrphanSQLiteSidecars(dbDir string) error {
+	entries, err := os.ReadDir(dbDir)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+
+	for _, entry := range entries {
+		if entry.IsDir() {
+			continue
+		}
+
+		name := entry.Name()
+		var mainDB string
+		switch {
+		case strings.HasSuffix(name, ".db-wal"):
+			mainDB = strings.TrimSuffix(name, "-wal")
+		case strings.HasSuffix(name, ".db-shm"):
+			mainDB = strings.TrimSuffix(name, "-shm")
+		default:
+			continue
+		}
+
+		if _, statErr := os.Stat(path.Join(dbDir, mainDB)); statErr != nil {
+			if !os.IsNotExist(statErr) {
+				return statErr
+			}
+			if removeErr := os.Remove(path.Join(dbDir, name)); removeErr != nil && !os.IsNotExist(removeErr) {
+				return removeErr
+			}
+		}
+	}
+
+	return nil
+}

agent/app/service/ssh.go

@@ -269,16 +269,26 @@ func (u *SSHService) CreateRootCert(req dto.RootCertOperate) error {
 	publicPath := fmt.Sprintf("%s/.ssh/%s.pub", currentUser.HomeDir, req.Name)
 	authFilePath := currentUser.HomeDir + "/.ssh/authorized_keys"
 
-	authFileItem, _ := os.ReadFile(authFilePath)
-	authFile := string(authFileItem)
-	if authFile != "" && !strings.HasSuffix(authFile, "\n") {
-		file, err := os.OpenFile(authFilePath, os.O_APPEND|os.O_WRONLY|os.O_CREATE, 0644)
+	if info, err := os.Stat(authFilePath); err == nil && info.Size() > 0 {
+		f, err := os.Open(authFilePath)
 		if err != nil {
 			return err
 		}
-		defer file.Close()
-		if _, err := file.WriteString("\n"); err != nil {
-			return err
+		defer func() { _ = f.Close() }()
+
+		if _, err := f.Seek(-1, 2); err == nil {
+			buf := make([]byte, 1)
+			if _, err := f.Read(buf); err == nil && buf[0] != '\n' {
+				appendFile, err := os.OpenFile(authFilePath, os.O_APPEND|os.O_WRONLY, 0600)
+				if err != nil {
+					return err
+				}
+				if _, err := appendFile.Write([]byte("\n")); err != nil {
+					_ = appendFile.Close()
+					return err
+				}
+				_ = appendFile.Close()
+			}
 		}
 	}
 
@@ -290,17 +300,43 @@ func (u *SSHService) CreateRootCert(req dto.RootCertOperate) error {
 			return err
 		}
 	} else {
-		command := fmt.Sprintf("ssh-keygen -t %s -f %s/.ssh/%s -N ''", req.EncryptionMode, currentUser.HomeDir, req.Name)
-		if len(req.PassPhrase) != 0 {
-			command = fmt.Sprintf("ssh-keygen -t %s -P %s -f %s/.ssh/%s | echo y", req.EncryptionMode, req.PassPhrase, currentUser.HomeDir, req.Name)
+		tmpPrivatePath := privatePath + ".tmp"
+		tmpPublicPath := privatePath + ".tmp.pub"
+		cmdMgr := cmd.NewCommandMgr(cmd.WithTimeout(2 * time.Minute))
+		args := []string{
+			"-t", req.EncryptionMode,
+			"-f", tmpPrivatePath,
+			"-N", req.PassPhrase,
+			"-q",
 		}
-		if err := cmd.RunDefaultBashC(command); err != nil {
+
+		if err := cmdMgr.Run("ssh-keygen", args...); err != nil {
+			_ = os.Remove(tmpPrivatePath)
+			_ = os.Remove(tmpPublicPath)
 			return fmt.Errorf("generate failed, %v", err)
 		}
+		if err := os.Rename(tmpPrivatePath, privatePath); err != nil {
+			return fmt.Errorf("replace private key failed, %v", err)
+		}
+		if err := os.Rename(tmpPublicPath, publicPath); err != nil {
+			return fmt.Errorf("replace public key failed, %v", err)
+		}
 	}
 
-	if err := cmd.RunDefaultBashCf("cat %s >> %s", publicPath, authFilePath); err != nil {
-		return fmt.Errorf("generate failed, %v", err)
+	publicKeyBytes, err := os.ReadFile(publicPath)
+	if err != nil {
+		return fmt.Errorf("read public key failed, %v", err)
+	}
+
+	cleanKey := strings.TrimRight(string(publicKeyBytes), "\n") + "\n"
+	authFile, err := os.OpenFile(authFilePath, os.O_APPEND|os.O_WRONLY|os.O_CREATE, 0600)
+	if err != nil {
+		return fmt.Errorf("open authorized_keys failed, %v", err)
+	}
+	defer func() { _ = authFile.Close() }()
+
+	if _, err := authFile.Write([]byte(cleanKey)); err != nil {
+		return fmt.Errorf("append authorized_keys failed, %v", err)
 	}
 
 	cert.PrivateKeyPath = privatePath
@@ -465,6 +501,9 @@ func (u *SSHService) LoadLog(ctx *gin.Context, req dto.SearchSSHLog) (int64, []d
 
 	command := ""
 	if len(req.Info) != 0 {
+		if cmd.CheckIllegal(req.Info) {
+			return 0, data, buserr.New("ErrCmdIllegal")
+		}
 		command = fmt.Sprintf(" | grep '%s'", req.Info)
 	}
 

agent/app/service/task.go

@@ -19,7 +19,7 @@ func NewITaskService() ITaskLogService {
 
 func (u *TaskLogService) Page(req dto.SearchTaskLogReq) (int64, []dto.TaskDTO, error) {
 	opts := []repo.DBOption{
-		repo.WithOrderBy("created_at desc"),
+		repo.WithOrderDesc("created_at"),
 	}
 	if req.Status != "" {
 		opts = append(opts, repo.WithByStatus(req.Status))

agent/app/service/website.go

@@ -110,6 +110,7 @@ type IWebsiteService interface {
 	GetProxyCache(id uint) (res response.NginxProxyCache, err error)
 	ClearProxyCache(req request.NginxCommonReq) error
 	DeleteProxy(req request.WebsiteProxyDel) (err error)
+	UpdateProxyStatus(req request.WebsiteProxyStatusUpdate) (err error)
 
 	CreateWebsiteDomain(create request.WebsiteDomainCreate) ([]model.WebsiteDomain, error)
 	GetWebsiteDomain(websiteId uint) ([]model.WebsiteDomain, error)
@@ -173,11 +174,10 @@ func (w WebsiteService) PageWebsite(req request.WebsiteSearch) (int64, []respons
 		switch web.Type {
 		case constant.Deployment:
 			appInstall, err := appInstallRepo.GetFirst(repo.WithByID(web.AppInstallID))
-			if err != nil {
-				return 0, nil, err
+			if err == nil {
+				appName = appInstall.Name
+				appInstallID = appInstall.ID
 			}
-			appName = appInstall.Name
-			appInstallID = appInstall.ID
 		case constant.Runtime:
 			runtime, _ := runtimeRepo.GetFirst(context.Background(), repo.WithByID(web.RuntimeID))
 			if runtime != nil {
@@ -208,6 +208,13 @@ func (w WebsiteService) PageWebsite(req request.WebsiteSearch) (int64, []respons
 			IPV6:          web.IPV6,
 		}
 
+		if siteDTO.Type == constant.Subsite {
+			parentWeb, _ := websiteRepo.GetFirst(repo.WithByID(web.ParentWebsiteID))
+			if parentWeb.ID != 0 {
+				siteDTO.ParentSite = parentWeb.PrimaryDomain
+			}
+		}
+
 		sites, _ := websiteRepo.List(websiteRepo.WithParentID(web.ID))
 		if len(sites) > 0 {
 			for _, site := range sites {
@@ -376,7 +383,7 @@ func (w WebsiteService) CreateWebsite(create request.WebsiteCreate) (err error)
 			req.AppDetailId = create.AppInstall.AppDetailId
 			req.Params = create.AppInstall.Params
 			req.AppContainerConfig = create.AppInstall.AppContainerConfig
-			install, err = NewIAppService().Install(req)
+			install, err = NewIAppService().Install(req, true)
 			if err != nil {
 				return err
 			}
@@ -1318,7 +1325,7 @@ func (w WebsiteService) UpdateSitePermission(req request.WebsiteUpdateDirPermiss
 	}
 	absoluteIndexPath := GetSitePath(website, SiteIndexDir)
 	cmdMgr := cmd.NewCommandMgr(cmd.WithTimeout(10 * time.Second))
-	if err := cmdMgr.RunBashCf("%s chown -R %s:%s %s", cmd.SudoHandleCmd(), req.User, req.Group, absoluteIndexPath); err != nil {
+	if err := cmdMgr.Run("chown", "-R", fmt.Sprintf("%s:%s", req.User, req.Group), absoluteIndexPath); err != nil {
 		return err
 	}
 	website.User = req.User
@@ -1780,7 +1787,7 @@ func (w WebsiteService) GetRedirect(id uint) (res []response.NginxRedirectConfig
 			continue
 		}
 		fileName := entry.Name()
-		if !strings.HasSuffix(fileName, ".conf") && !strings.HasSuffix(fileName, ".conf.bak") {
+		if !strings.HasSuffix(fileName, ".conf") && !strings.HasSuffix(fileName, ".bak") {
 			continue
 		}
 		redirectConfig := response.NginxRedirectConfig{
@@ -1899,6 +1906,10 @@ func (w WebsiteService) UpdateRedirectFile(req request.NginxRedirectUpdate) (err
 	if err != nil {
 		return err
 	}
+	safeName := path.Base(req.Name)
+	if safeName != req.Name || strings.Contains(safeName, "..") {
+		return buserr.New("ErrInvalidParams")
+	}
 	absolutePath := path.Join(GetSitePath(website, SiteRedirectDir), req.Name+".conf")
 	fileOp := files.NewFileOp()
 	oldRewriteContent, err = fileOp.GetContent(absolutePath)
@@ -1936,25 +1947,40 @@ func (w WebsiteService) LoadWebsiteDirConfig(req request.WebsiteCommonReq) (*res
 		return nil, err
 	}
 	res.Dirs = []string{"/"}
-	for _, file := range indexFiles {
-		if !file.IsDir() || file.Name() == "node_modules" || file.Name() == "vendor" {
-			continue
-		}
-		res.Dirs = append(res.Dirs, fmt.Sprintf("/%s", file.Name()))
-		fileInfo, _ := file.Info()
-		if fileInfo.Sys().(*syscall.Stat_t).Uid != 1000 || fileInfo.Sys().(*syscall.Stat_t).Gid != 1000 {
-			res.Msg = i18n.GetMsgByKey("ErrPathPermission")
-		}
-		childFiles, _ := os.ReadDir(absoluteIndexPath + "/" + file.Name())
-		for _, childFile := range childFiles {
-			if !childFile.IsDir() {
+	checkAndAppendDirs := func(relPath string, entries []os.DirEntry) {
+		for _, entry := range entries {
+			if !entry.IsDir() || entry.Name() == "node_modules" || entry.Name() == "vendor" {
 				continue
 			}
-			childInfo, _ := childFile.Info()
-			if childInfo.Sys().(*syscall.Stat_t).Uid != 1000 || childInfo.Sys().(*syscall.Stat_t).Gid != 1000 {
-				res.Msg = i18n.GetMsgByKey("ErrPathPermission")
+			nextRelPath := path.Join(relPath, entry.Name())
+			res.Dirs = append(res.Dirs, "/"+strings.TrimPrefix(nextRelPath, "/"))
+			entryInfo, _ := entry.Info()
+			if entryInfo != nil {
+				if stat, ok := entryInfo.Sys().(*syscall.Stat_t); ok {
+					if stat.Uid != 1000 || stat.Gid != 1000 {
+						res.Msg = i18n.GetMsgByKey("ErrPathPermission")
+					}
+				}
 			}
-			res.Dirs = append(res.Dirs, fmt.Sprintf("/%s/%s", file.Name(), childFile.Name()))
+		}
+	}
+
+	checkAndAppendDirs("", indexFiles)
+	for _, firstDir := range indexFiles {
+		if !firstDir.IsDir() || firstDir.Name() == "node_modules" || firstDir.Name() == "vendor" {
+			continue
+		}
+		secondLevelPath := path.Join(absoluteIndexPath, firstDir.Name())
+		secondLevelDirs, _ := os.ReadDir(secondLevelPath)
+		checkAndAppendDirs(firstDir.Name(), secondLevelDirs)
+
+		for _, secondDir := range secondLevelDirs {
+			if !secondDir.IsDir() || secondDir.Name() == "node_modules" || secondDir.Name() == "vendor" {
+				continue
+			}
+			thirdLevelPath := path.Join(secondLevelPath, secondDir.Name())
+			thirdLevelDirs, _ := os.ReadDir(thirdLevelPath)
+			checkAndAppendDirs(path.Join(firstDir.Name(), secondDir.Name()), thirdLevelDirs)
 		}
 	}
 
@@ -2275,6 +2301,9 @@ func (w WebsiteService) OperateCrossSiteAccess(req request.CrossSiteAccessOp) er
 }
 
 func (w WebsiteService) ExecComposer(req request.ExecComposerReq) error {
+	if cmd.CheckIllegal(req.User, req.Mirror, req.Command, req.ExtCommand) {
+		return buserr.New("ErrCmdIllegal")
+	}
 	website, err := websiteRepo.GetFirst(repo.WithByID(req.WebsiteID))
 	if err != nil {
 		return err
@@ -2308,9 +2337,25 @@ func (w WebsiteService) ExecComposer(req request.ExecComposerReq) error {
 	siteDir, _ := settingRepo.Get(settingRepo.WithByKey("WEBSITE_DIR"))
 	execDir := strings.ReplaceAll(req.Dir, siteDir.Value, "/www")
 	composerTask.AddSubTask("", func(t *task.Task) error {
-		cmdStr := fmt.Sprintf("docker exec -u %s %s sh -c 'composer config -g repo.packagist composer %s && composer %s --working-dir=%s'", req.User, runtime.ContainerName, req.Mirror, command, execDir)
-		err = cmdMgr.RunBashC(cmdStr)
-		if err != nil {
+		if err := cmdMgr.Run("docker", "exec",
+			"-u", req.User,
+			runtime.ContainerName,
+			"composer",
+			"config", "-g",
+			"repo.packagist",
+			"composer",
+			req.Mirror,
+		); err != nil {
+			return err
+		}
+
+		if err := cmdMgr.Run("docker", "exec",
+			"-u", req.User,
+			runtime.ContainerName,
+			"composer",
+			command,
+			"--working-dir="+execDir,
+		); err != nil {
 			return err
 		}
 		return nil

agent/app/service/website_acme_account.go

@@ -25,7 +25,7 @@ func NewIWebsiteAcmeAccountService() IWebsiteAcmeAccountService {
 }
 
 func (w WebsiteAcmeAccountService) Page(search dto.PageInfo) (int64, []response.WebsiteAcmeAccountDTO, error) {
-	total, accounts, err := websiteAcmeRepo.Page(search.Page, search.PageSize, repo.WithOrderBy("created_at desc"))
+	total, accounts, err := websiteAcmeRepo.Page(search.Page, search.PageSize, repo.WithOrderDesc("created_at"))
 	var accountDTOs []response.WebsiteAcmeAccountDTO
 	for _, account := range accounts {
 		accountDTOs = append(accountDTOs, response.WebsiteAcmeAccountDTO{
@@ -45,9 +45,10 @@ func (w WebsiteAcmeAccountService) Create(create request.WebsiteAcmeAccountCreat
 		Type:     create.Type,
 		KeyType:  create.KeyType,
 		UseProxy: create.UseProxy,
+		UseEAB:   create.UseEAB,
 	}
 
-	if create.Type == "google" || create.Type == "freessl" {
+	if create.Type == "google" || create.Type == "freessl" || (create.Type == "custom" && create.UseEAB) {
 		if create.EabKid == "" || create.EabHmacKey == "" {
 			return nil, buserr.New("ErrEabKidOrEabHmacKeyCannotBlank")
 		}

agent/app/service/website_auth_basic.go

@@ -3,6 +3,10 @@ package service
 import (
 	"bufio"
 	"fmt"
+	"os"
+	"path"
+	"strings"
+
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/response"
@@ -16,9 +20,6 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/utils/nginx/components"
 	"github.com/1Panel-dev/1Panel/agent/utils/nginx/parser"
 	"golang.org/x/crypto/bcrypt"
-	"os"
-	"path"
-	"strings"
 )
 
 func (w WebsiteService) GetAuthBasics(req request.NginxAuthReq) (res response.NginxAuthRes, err error) {
@@ -260,6 +261,10 @@ func (w WebsiteService) UpdatePathAuthBasic(req request.NginxPathAuthUpdate) err
 	if !fileOp.Stat(passDir) {
 		_ = fileOp.CreateDir(passDir, constant.DirPerm)
 	}
+	safeName := path.Base(req.Name)
+	if safeName != req.Name || strings.Contains(safeName, "..") {
+		return buserr.New("ErrInvalidParams")
+	}
 	confPath := path.Join(authDir, fmt.Sprintf("%s.conf", req.Name))
 	passPath := path.Join(passDir, fmt.Sprintf("%s.pass", req.Name))
 	var config *components.Config
@@ -306,7 +311,7 @@ func (w WebsiteService) UpdatePathAuthBasic(req request.NginxPathAuthUpdate) err
 	}
 	nginxInclude := fmt.Sprintf("/www/sites/%s/path_auth/*.conf", website.Alias)
 	if err = updateNginxConfig(constant.NginxScopeServer, []dto.NginxParam{{Name: "include", Params: []string{nginxInclude}}}, &website); err != nil {
-		return nil
+		return err
 	}
 	return nil
 }

agent/app/service/website_ca.go

@@ -51,7 +51,7 @@ func NewIWebsiteCAService() IWebsiteCAService {
 }
 
 func (w WebsiteCAService) Page(search request.WebsiteCASearch) (int64, []response.WebsiteCADTO, error) {
-	total, cas, err := websiteCARepo.Page(search.Page, search.PageSize, repo.WithOrderBy("created_at desc"))
+	total, cas, err := websiteCARepo.Page(search.Page, search.PageSize, repo.WithOrderDesc("created_at"))
 	if err != nil {
 		return 0, nil, err
 	}

agent/app/service/website_dns_account.go

@@ -27,7 +27,7 @@ func NewIWebsiteDnsAccountService() IWebsiteDnsAccountService {
 }
 
 func (w WebsiteDnsAccountService) Page(search dto.PageInfo) (int64, []response.WebsiteDnsAccountDTO, error) {
-	total, accounts, err := websiteDnsRepo.Page(search.Page, search.PageSize, repo.WithOrderBy("created_at desc"))
+	total, accounts, err := websiteDnsRepo.Page(search.Page, search.PageSize, repo.WithOrderDesc("created_at"))
 	var accountDTOs []response.WebsiteDnsAccountDTO
 	for _, account := range accounts {
 		auth := make(map[string]string)

agent/app/service/website_lb.go

@@ -3,6 +3,10 @@ package service
 import (
 	"bytes"
 	"fmt"
+	"os"
+	"path"
+	"strings"
+
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
 	"github.com/1Panel-dev/1Panel/agent/app/repo"
@@ -13,9 +17,6 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/utils/nginx"
 	"github.com/1Panel-dev/1Panel/agent/utils/nginx/components"
 	"github.com/1Panel-dev/1Panel/agent/utils/nginx/parser"
-	"os"
-	"path"
-	"strings"
 )
 
 func (w WebsiteService) GetLoadBalances(id uint) ([]dto.NginxUpstream, error) {
@@ -87,6 +88,10 @@ func (w WebsiteService) CreateLoadBalance(req request.WebsiteLBCreate) error {
 	if !fileOp.Stat(includeDir) {
 		_ = fileOp.CreateDir(includeDir, constant.DirPerm)
 	}
+	safeName := path.Base(req.Name)
+	if safeName != req.Name || strings.Contains(safeName, "..") {
+		return buserr.New("ErrInvalidParams")
+	}
 	filePath := path.Join(includeDir, fmt.Sprintf("%s.conf", req.Name))
 	if fileOp.Stat(filePath) {
 		return buserr.New("ErrNameIsExist")
@@ -133,6 +138,10 @@ func (w WebsiteService) UpdateLoadBalance(req request.WebsiteLBUpdate) error {
 	}
 	includeDir := GetSitePath(website, SiteUpstreamDir)
 	fileOp := files.NewFileOp()
+	safeName := path.Base(req.Name)
+	if safeName != req.Name || strings.Contains(safeName, "..") {
+		return buserr.New("ErrInvalidParams")
+	}
 	filePath := path.Join(includeDir, fmt.Sprintf("%s.conf", req.Name))
 	if !fileOp.Stat(filePath) {
 		return nil
@@ -191,6 +200,10 @@ func (w WebsiteService) DeleteLoadBalance(req request.WebsiteLBDelete) error {
 
 	includeDir := GetSitePath(website, SiteUpstreamDir)
 	fileOp := files.NewFileOp()
+	safeName := path.Base(req.Name)
+	if safeName != req.Name || strings.Contains(safeName, "..") {
+		return buserr.New("ErrInvalidParams")
+	}
 	filePath := path.Join(includeDir, fmt.Sprintf("%s.conf", req.Name))
 	if !fileOp.Stat(filePath) {
 		return nil
@@ -211,6 +224,10 @@ func (w WebsiteService) UpdateLoadBalanceFile(req request.WebsiteLBUpdateFile) e
 		return err
 	}
 	includeDir := GetSitePath(website, SiteUpstreamDir)
+	safeName := path.Base(req.Name)
+	if safeName != req.Name || strings.Contains(safeName, "..") {
+		return buserr.New("ErrInvalidParams")
+	}
 	filePath := path.Join(includeDir, fmt.Sprintf("%s.conf", req.Name))
 	fileOp := files.NewFileOp()
 	oldContent, err := fileOp.GetContent(filePath)

agent/app/service/website_proxy.go

@@ -4,6 +4,10 @@ import (
 	"bytes"
 	"errors"
 	"fmt"
+	"path"
+	"strconv"
+	"strings"
+
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/response"
@@ -17,12 +21,24 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/utils/nginx/components"
 	"github.com/1Panel-dev/1Panel/agent/utils/nginx/parser"
 	"github.com/1Panel-dev/1Panel/agent/utils/re"
-	"path"
-	"strconv"
-	"strings"
 )
 
 func (w WebsiteService) OperateProxy(req request.WebsiteProxyConfig) (err error) {
+	switch req.Operate {
+	case "delete":
+		return w.DeleteProxy(request.WebsiteProxyDel{
+			ID:   req.ID,
+			Name: req.Name,
+		})
+	case "disable":
+		fallthrough
+	case "enable":
+		return w.UpdateProxyStatus(request.WebsiteProxyStatusUpdate{
+			ID:     req.ID,
+			Name:   req.Name,
+			Status: req.Operate,
+		})
+	}
 	var (
 		website    model.Website
 		par        *parser.Parser
@@ -80,16 +96,8 @@ func (w WebsiteService) OperateProxy(req request.WebsiteProxyConfig) (err error)
 		if err != nil {
 			return
 		}
-	case "delete":
-		_ = fileOp.DeleteFile(includePath)
-		_ = fileOp.DeleteFile(backPath)
-		return updateNginxConfig(constant.NginxScopeServer, nil, &website)
-	case "disable":
-		_ = fileOp.Rename(includePath, backPath)
-		return updateNginxConfig(constant.NginxScopeServer, nil, &website)
-	case "enable":
-		_ = fileOp.Rename(backPath, includePath)
-		return updateNginxConfig(constant.NginxScopeServer, nil, &website)
+	default:
+		return errors.New("unknown operate")
 	}
 
 	config.FilePath = includePath
@@ -106,7 +114,7 @@ func (w WebsiteService) OperateProxy(req request.WebsiteProxyConfig) (err error)
 		err = errors.New("invalid proxy config, no location found")
 		return
 	}
-	location.UpdateDirective("proxy_pass", []string{req.ProxyPass})
+	applyLocationProxyPass(location, req.ProxyPass, &req.SNI, req.ProxySSLName)
 	location.UpdateDirective("proxy_set_header", []string{"Host", req.ProxyHost})
 	location.ChangePath(req.Modifier, req.Match)
 	// Server Cache Settings
@@ -119,8 +127,13 @@ func (w WebsiteService) OperateProxy(req request.WebsiteProxyConfig) (err error)
 		location.RemoveServerCache(fmt.Sprintf("proxy_cache_zone_of_%s", website.Alias))
 	}
 	// Browser Cache Settings
-	if req.CacheTime != 0 {
+	// cacheTime > 0: enable expires;
+	// cacheTime == 0: use upstream cache-control, remove self-set;
+	// cacheTime < 0: force no-cache
+	if req.CacheTime > 0 {
 		location.AddBrowserCache(req.CacheTime, req.CacheUnit)
+	} else if req.CacheTime < 0 {
+		location.AddBroswerNoCache()
 	} else {
 		location.RemoveBrowserCache()
 	}
@@ -130,15 +143,7 @@ func (w WebsiteService) OperateProxy(req request.WebsiteProxyConfig) (err error)
 	} else {
 		location.RemoveSubFilter()
 	}
-	// SSL Settings
-	if req.SNI {
-		location.UpdateDirective("proxy_ssl_server_name", []string{"on"})
-		if req.ProxySSLName != "" {
-			location.UpdateDirective("proxy_ssl_name", []string{req.ProxySSLName})
-		}
-	} else {
-		location.UpdateDirective("proxy_ssl_server_name", []string{"off"})
-	}
+	// Explicit SNI configuration still takes precedence over the automatic HTTPS upstream default.
 	// CORS Settings
 	if req.Cors {
 		location.UpdateDirective("add_header", []string{"Access-Control-Allow-Origin", req.AllowOrigins, "always"})
@@ -385,24 +390,47 @@ func (w WebsiteService) ClearProxyCache(req request.NginxCommonReq) error {
 }
 
 func (w WebsiteService) DeleteProxy(req request.WebsiteProxyDel) (err error) {
-	fileOp := files.NewFileOp()
 	website, err := websiteRepo.GetFirst(repo.WithByID(req.ID))
 	if err != nil {
 		return
 	}
-	nginxInstall, err := getAppInstallByKey(constant.AppOpenresty)
-	if err != nil {
-		return
-	}
-	includeDir := path.Join(nginxInstall.GetPath(), "www", "sites", website.Alias, "proxy")
+	includeDir := GetSitePath(website, SiteProxyDir)
+	fileOp := files.NewFileOp()
 	if !fileOp.Stat(includeDir) {
-		_ = fileOp.CreateDir(includeDir, 0755)
+		return
 	}
 	fileName := fmt.Sprintf("%s.conf", req.Name)
 	includePath := path.Join(includeDir, fileName)
 	backName := fmt.Sprintf("%s.bak", req.Name)
 	backPath := path.Join(includeDir, backName)
+
 	_ = fileOp.DeleteFile(includePath)
 	_ = fileOp.DeleteFile(backPath)
 	return updateNginxConfig(constant.NginxScopeServer, nil, &website)
 }
+
+func (w WebsiteService) UpdateProxyStatus(req request.WebsiteProxyStatusUpdate) (err error) {
+	website, err := websiteRepo.GetFirst(repo.WithByID(req.ID))
+	if err != nil {
+		return
+	}
+	includeDir := GetSitePath(website, SiteProxyDir)
+	fileOp := files.NewFileOp()
+	if !fileOp.Stat(includeDir) {
+		return
+	}
+	fileName := fmt.Sprintf("%s.conf", req.Name)
+	includePath := path.Join(includeDir, fileName)
+	backName := fmt.Sprintf("%s.bak", req.Name)
+	backPath := path.Join(includeDir, backName)
+
+	switch req.Status {
+	case "disable":
+		_ = fileOp.Rename(includePath, backPath)
+		return updateNginxConfig(constant.NginxScopeServer, nil, &website)
+	case "enable":
+		_ = fileOp.Rename(backPath, includePath)
+		return updateNginxConfig(constant.NginxScopeServer, nil, &website)
+	}
+	return errors.New("unknown status")
+}

agent/app/service/website_rewrite.go

@@ -4,6 +4,10 @@ import (
 	"bytes"
 	"context"
 	"fmt"
+	"os"
+	"path"
+	"strings"
+
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/response"
@@ -12,9 +16,6 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/cmd/server/nginx_conf"
 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/utils/files"
-	"os"
-	"path"
-	"strings"
 )
 
 func (w WebsiteService) UpdateRewriteConfig(req request.NginxRewriteUpdate) error {
@@ -73,6 +74,10 @@ func (w WebsiteService) GetRewriteConfig(req request.NginxRewriteReq) (*response
 		contentByte, _ = nginx_conf.Rewrites.ReadFile(rewriteFile)
 		if contentByte == nil {
 			customRewriteDir := GetOpenrestyDir(DefaultRewriteDir)
+			safeName := path.Base(req.Name)
+			if safeName != req.Name || strings.Contains(safeName, "..") {
+				return nil, buserr.New("ErrInvalidParams")
+			}
 			customRewriteFile := path.Join(customRewriteDir, fmt.Sprintf("%s.conf", strings.ToLower(req.Name)))
 			contentByte, err = files.NewFileOp().GetContent(customRewriteFile)
 		}
@@ -90,6 +95,10 @@ func (w WebsiteService) OperateCustomRewrite(req request.CustomRewriteOperate) e
 			return err
 		}
 	}
+	safeName := path.Base(req.Name)
+	if safeName != req.Name || strings.Contains(safeName, "..") {
+		return buserr.New("ErrInvalidParams")
+	}
 	rewriteFile := path.Join(rewriteDir, fmt.Sprintf("%s.conf", req.Name))
 	switch req.Operate {
 	case "create":

agent/app/service/website_ssl.go

@@ -37,7 +37,7 @@ type WebsiteSSLService struct {
 type IWebsiteSSLService interface {
 	Page(search request.WebsiteSSLSearch) (int64, []response.WebsiteSSLDTO, error)
 	GetSSL(id uint) (*response.WebsiteSSLDTO, error)
-	Search(req request.WebsiteSSLSearch) ([]response.WebsiteSSLDTO, error)
+	Search(req request.WebsiteSSLListReq) ([]response.WebsiteSSLDTO, error)
 	Create(create request.WebsiteSSLCreate) (request.WebsiteSSLCreate, error)
 	GetDNSResolve(req request.WebsiteDNSReq) ([]response.WebsiteDNSRes, error)
 	GetWebsiteSSL(websiteId uint) (response.WebsiteSSLDTO, error)
@@ -62,7 +62,7 @@ func (w WebsiteSSLService) Page(search request.WebsiteSSLSearch) (int64, []respo
 	if search.OrderBy != "" && search.Order != "null" {
 		opts = append(opts, repo.WithOrderRuleBy(search.OrderBy, search.Order))
 	} else {
-		opts = append(opts, repo.WithOrderBy("created_at desc"))
+		opts = append(opts, repo.WithOrderDesc("created_at"))
 	}
 	if search.Domain != "" {
 		opts = append(opts, websiteSSLRepo.WithByDomain(search.Domain))
@@ -90,12 +90,12 @@ func (w WebsiteSSLService) GetSSL(id uint) (*response.WebsiteSSLDTO, error) {
 	return &res, nil
 }
 
-func (w WebsiteSSLService) Search(search request.WebsiteSSLSearch) ([]response.WebsiteSSLDTO, error) {
+func (w WebsiteSSLService) Search(search request.WebsiteSSLListReq) ([]response.WebsiteSSLDTO, error) {
 	var (
 		opts   []repo.DBOption
 		result []response.WebsiteSSLDTO
 	)
-	opts = append(opts, repo.WithOrderBy("created_at desc"))
+	opts = append(opts, repo.WithOrderDesc("created_at"))
 	if search.AcmeAccountID != "" {
 		acmeAccountID, err := strconv.ParseUint(search.AcmeAccountID, 10, 64)
 		if err != nil {

agent/app/service/website_utils.go

@@ -47,6 +47,30 @@ func handleChineseDomain(domain string) (string, error) {
 	return domain, nil
 }
 
+func isHTTPSProxyPass(proxyPass string) bool {
+	return strings.HasPrefix(strings.ToLower(strings.TrimSpace(proxyPass)), "https://")
+}
+
+func applyLocationProxyPass(location *components.Location, proxyPass string, sni *bool, proxySSLName string) {
+	location.UpdateDirective("proxy_pass", []string{proxyPass})
+
+	enableSNI := isHTTPSProxyPass(proxyPass)
+	if sni != nil {
+		enableSNI = enableSNI && *sni
+	}
+	if enableSNI {
+		location.UpdateDirective("proxy_ssl_server_name", []string{"on"})
+	} else {
+		location.UpdateDirective("proxy_ssl_server_name", []string{"off"})
+	}
+
+	sslName := "$proxy_host"
+	if proxySSLName != "" {
+		sslName = proxySSLName
+	}
+	location.UpdateDirective("proxy_ssl_name", []string{sslName})
+}
+
 func createIndexFile(website *model.Website, runtime *model.Runtime) error {
 	var (
 		indexPath      string
@@ -122,7 +146,7 @@ func createProxyFile(website *model.Website) error {
 		return errors.New("error")
 	}
 	location.ChangePath("^~", "/")
-	location.UpdateDirective("proxy_pass", []string{website.Proxy})
+	applyLocationProxyPass(location, website.Proxy, nil, "")
 	location.UpdateDirective("proxy_set_header", []string{"Host", "$host"})
 	if err := nginx.WriteConfig(config, nginx.IndentedStyle); err != nil {
 		return buserr.WithErr("ErrUpdateBuWebsite", err)
@@ -849,6 +873,17 @@ func applySSL(website *model.Website, websiteSSL model.WebsiteSSL, req request.W
 				nginxParams[i].Params = []string{"ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:!aNULL:!eNULL:!EXPORT:!DSS:!DES:!RC4:!3DES:!MD5:!PSK:!KRB5:!SRP:!CAMELLIA:!SEED"}
 			}
 		}
+		if param.Name == "error_page" {
+			if len(param.Params) < 2 {
+				continue
+			}
+			code := param.Params[0]
+			if code == "497" {
+				if sslPort != 443 && param.Params[1] == "https://$host$request_uri" {
+					param.Params[1] = fmt.Sprintf("https://$host:%d$request_uri", sslPort)
+				}
+			}
+		}
 	}
 	if req.Hsts {
 		var hstsValue string
@@ -966,6 +1001,8 @@ func opWebsite(website *model.Website, operate string) error {
 		server.RemoveDirective("include", []string{proxyInclude})
 		rewriteInclude := fmt.Sprintf("/www/sites/%s/rewrite/%s.conf", website.Alias, website.Alias)
 		server.RemoveDirective("include", []string{rewriteInclude})
+		redirectInclude := fmt.Sprintf("/www/sites/%s/redirect/%s.conf", website.Alias, website.Alias)
+		server.RemoveDirective("include", []string{redirectInclude})
 
 		switch website.Type {
 		case constant.Deployment:
@@ -996,6 +1033,11 @@ func opWebsite(website *model.Website, operate string) error {
 		if fileOp.Stat(absoluteRewritePath) {
 			server.UpdateDirective("include", []string{rewriteInclude})
 		}
+		redirectInclude := fmt.Sprintf("/www/sites/%s/redirect/%s.conf", website.Alias, website.Alias)
+		absoluteRedirectPath := GetSitePath(*website, SiteRedirectDir)
+		if fileOp.Stat(absoluteRedirectPath) {
+			server.UpdateDirective("include", []string{redirectInclude})
+		}
 		rootIndex := path.Join("/www/sites", website.Alias, "index")
 		if website.SiteDir != "/" {
 			rootIndex = path.Join(rootIndex, website.SiteDir)
@@ -1030,6 +1072,31 @@ func opWebsite(website *model.Website, operate string) error {
 				proxy := fmt.Sprintf("http://%s", website.Proxy)
 				server.UpdateRootProxy([]string{proxy})
 			}
+		case constant.Subsite:
+			parentWebsite, err := websiteRepo.GetFirst(repo.WithByID(website.ParentWebsiteID))
+			if err != nil {
+				return err
+			}
+			website.Proxy = parentWebsite.Proxy
+			rootIndex = path.Join("/www/sites", parentWebsite.Alias, "index", website.SiteDir)
+			if parentWebsite.Type == constant.Runtime {
+				parentRuntime, err := runtimeRepo.GetFirst(context.Background(), repo.WithByID(parentWebsite.RuntimeID))
+				if err != nil {
+					return err
+				}
+				website.RuntimeID = parentRuntime.ID
+				if parentRuntime.Type == constant.RuntimePHP {
+					server.UpdateRoot(rootIndex)
+					localPath := ""
+					if parentRuntime.Resource == constant.ResourceLocal {
+						localPath = path.Join(rootIndex, "index.php")
+					}
+					server.UpdatePHPProxy([]string{website.Proxy}, localPath)
+				}
+			}
+			if parentWebsite.Type == constant.Static {
+				server.UpdateRoot(rootIndex)
+			}
 		}
 		website.Status = constant.WebRunning
 		now := time.Now()
@@ -1115,7 +1182,7 @@ func getWebsiteDomains(domains []request.WebsiteDomain, defaultHTTPPort, default
 		if domain.Domain == "" {
 			continue
 		}
-		if !common.IsValidNginxServerName(domain.Domain) {
+		if !(common.IsValidNginxServerName(domain.Domain) || common.IsValidIP(domain.Domain)) {
 			err = buserr.WithName("ErrDomainFormat", domain.Domain)
 			return
 		}
@@ -1226,7 +1293,7 @@ func saveCertificateFile(websiteSSL *model.WebsiteSSL, logger *log.Logger) {
 func GetSystemSSL() (bool, uint) {
 	var sslSetting model.Setting
 	_ = global.CoreDB.Model(&model.Setting{}).Where("key = ?", "SSL").First(&sslSetting).Error
-	if sslSetting.Value == "Enable" {
+	if sslSetting.Value == "Enable" || sslSetting.Value == "Mux" {
 		var sslIDSetting model.Setting
 		_ = global.CoreDB.Model(&model.Setting{}).Where("key = ?", "SSLID").First(&sslIDSetting).Error
 		idValue, _ := strconv.Atoi(sslIDSetting.Value)

agent/app/task/task.go

@@ -7,6 +7,7 @@ import (
 	"os"
 	"path"
 	"strconv"
+	"strings"
 	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/buserr"
@@ -274,7 +275,8 @@ func (t *Task) Execute() error {
 	}
 	var err error
 	t.Log(i18n.GetWithName("TaskStart", t.Name))
-	for _, subTask := range t.SubTasks {
+	for i := 0; i < len(t.SubTasks); i++ {
+		subTask := t.SubTasks[i]
 		t.Task.CurrentStep = subTask.StepAlias
 		t.updateTask(t.Task)
 		if err = subTask.Execute(); err == nil {
@@ -353,7 +355,20 @@ func (t *Task) LogSuccessWithOps(operate, msg string) {
 }
 
 func (t *Task) LogFailedWithOps(operate, msg string, err error) {
-	t.Logger.Printf("%s%s%s : %s ", i18n.GetMsgByKey(operate), msg, i18n.GetMsgByKey("Failed"), err.Error())
+	t.Logger.Printf("%s%s : %s ", msg, i18n.GetMsgByKey("Failed"), err.Error())
+}
+
+func (t *Task) LogWithProgress(msg string, current int, total int) {
+	const barWidth = 10
+	filled := int(float64(current) / float64(total) * 100 / 10)
+	if filled > barWidth {
+		filled = barWidth
+	}
+	if filled < 0 {
+		filled = 0
+	}
+	bar := strings.Repeat("=", filled) + strings.Repeat("-", barWidth-filled)
+	t.Logger.Printf("%s [%s] %.2f%%", msg, bar, float64(current)/float64(total)*100)
 }
 
 type SimpleFormatter struct{}

agent/cmd/server/conf/app.yaml

@@ -4,11 +4,6 @@ base:
   is_demo: false
   is_offline: false
 
-remote_url:
-  app_repo: https://apps-assets.fit2cloud.com
-  repo_url: https://resource.fit2cloud.com/1panel/package/v2
-  resource_url: https://resource.fit2cloud.com/1panel/resource/v2
-
 log:
   level: debug
   time_zone: Asia/Shanghai

agent/cmd/server/docs/swagger.go

@@ -0,0 +1,6 @@
+package docs
+
+import _ "embed"
+
+//go:embed x-log.json
+var XLogJson []byte

agent/cmd/server/nginx_conf/nginx_conf.go

@@ -2,7 +2,6 @@ package nginx_conf
 
 import (
 	"embed"
-	_ "embed"
 	"io"
 )
 

agent/constant/alert.go

@@ -24,4 +24,5 @@ const (
 	WeCom    = "weCom"
 	DingTalk = "dingTalk"
 	FeiShu   = "feiShu"
+	Custom   = "custom"
 )

agent/constant/app.go

@@ -7,6 +7,8 @@ const (
 	AppTakeDown = "TakeDown"
 
 	AppOpenresty         = "openresty"
+	AppOpenclaw          = "openclaw"
+	AppCopaw             = "copaw"
 	AppMysql             = "mysql"
 	AppMariaDB           = "mariadb"
 	AppPostgresql        = "postgresql"

agent/constant/status.go

@@ -40,4 +40,6 @@ const (
 
 	OrderDesc = "descending"
 	OrderAsc  = "ascending"
+	Desc      = "desc"
+	Asc       = "asc"
 )

agent/cron/cron.go

@@ -1,8 +1,9 @@
 package cron
 
 import (
+	"crypto/rand"
 	"fmt"
-	mathRand "math/rand"
+	"math/big"
 	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/app/model"
@@ -43,7 +44,17 @@ func Run() {
 	if _, err := global.Cron.AddJob("@daily", job.NewSSLJob()); err != nil {
 		global.LOG.Errorf("can not add  ssl corn job: %s", err.Error())
 	}
-	if _, err := global.Cron.AddJob(fmt.Sprintf("%v %v * * *", mathRand.Intn(60), mathRand.Intn(3)), job.NewAppStoreJob()); err != nil {
+	minuteRand, err := rand.Int(rand.Reader, big.NewInt(60))
+	if err != nil {
+		global.LOG.Errorf("generate random minute failed: %v", err)
+		minuteRand = big.NewInt(0)
+	}
+	hourRand, err := rand.Int(rand.Reader, big.NewInt(3))
+	if err != nil {
+		global.LOG.Errorf("generate random hour failed: %v", err)
+		hourRand = big.NewInt(0)
+	}
+	if _, err := global.Cron.AddJob(fmt.Sprintf("%v %v * * *", minuteRand.Int64(), hourRand.Int64()), job.NewAppStoreJob()); err != nil {
 		global.LOG.Errorf("can not add  appstore corn job: %s", err.Error())
 	}
 	if _, err := global.Cron.AddJob("0 3 */31 * *", job.NewBackupJob()); err != nil {