feat: change feishu channel logic (#12465)

Bumps [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) from 4.1.3 to 4.1.4.
- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Commits](https://github.com/go-jose/go-jose/compare/v4.1.3...v4.1.4)

---
updated-dependencies:
- dependency-name: github.com/go-jose/go-jose/v4
  dependency-version: 4.1.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/build-and-publish.yml

@@ -1,33 +1,43 @@
-name: Create Release And Upload Cloudflare R2
+name: Build And Publish (OSS + R2)
+
 on:
   push:
     tags:
       - 'v*'
+
 jobs:
   create-release:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4
+
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
-          node-version: '22.19.0'
+          node-version: '24.11.1'
+
       - name: Build Web
         run: |
           cd frontend && npm install && npm run build:pro
         env:
           NODE_OPTIONS: --max-old-space-size=8192
+
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.24'
+          go-version: '1.25'
+          cache-dependency-path: |
+            core/go.sum
+            agent/go.sum
+
       - name: Build Release
         uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser
           version: '~> v2'
           args: release --skip=publish --clean
+
       - name: Upload Assets
         uses: softprops/action-gh-release@v1
         if: startsWith(github.ref, 'refs/tags/')
@@ -36,10 +46,24 @@ jobs:
           files: |
             dist/*.tar.gz
             dist/checksums.txt
+
+      - name: Setup OSSUTIL
+        uses: yizhoumo/setup-ossutil@v2
+        with:
+          endpoint: ${{ secrets.OSS_ENDPOINT }}
+          access-key-id: ${{ secrets.OSS_ACCESS_KEY_ID }}
+          access-key-secret: ${{ secrets.OSS_ACCESS_KEY_SECRET }}
+          ossutil-version: '1.7.18'
+
+      - name: Upload Assets to OSS
+        run: |
+          ossutil cp -r dist/ oss://resource-fit2cloud-com/1panel/package/v2/stable/${{ github.ref_name }}/release/ --include "*.tar.gz" --include "checksums.txt" --only-current-dir --force
+
       - name: Setup Rclone
         uses: AnimMouse/setup-rclone@v1
         with:
           rclone_config: ${{ secrets.RCLONE_CONFIG }}
+
       - name: Upload to Cloudflare R2
         run: |
           rclone copy dist/ cloudflare_r2:package/v2/stable/${{ github.ref_name }}/release/ --include "*.tar.gz" --include "checksums.txt" --progress

.github/workflows/build-publish-to-oss.yml

@@ -1,47 +0,0 @@
-name: Create Release And Upload assets
-on:
-  push:
-    tags:
-      - 'v*'
-jobs:
-  create-release:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Code
-        uses: actions/checkout@v4
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: '22.19.0'
-      - name: Build Web
-        run: |
-          cd frontend && npm install && npm run build:pro
-        env:
-          NODE_OPTIONS: --max-old-space-size=8192
-      - name: Setup Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: '1.24'
-      - name: Build Release
-        uses: goreleaser/goreleaser-action@v6
-        with:
-          distribution: goreleaser
-          version: '~> v2'
-          args: release --skip=publish --clean
-      - name: Upload Assets
-        uses: softprops/action-gh-release@v1
-        if: startsWith(github.ref, 'refs/tags/')
-        with:
-          draft: true
-          files: |
-            dist/*.tar.gz
-            dist/checksums.txt
-      - name: Setup OSSUTIL
-        uses: yizhoumo/setup-ossutil@v2
-        with:
-          endpoint: ${{ secrets.OSS_ENDPOINT }}
-          access-key-id: ${{ secrets.OSS_ACCESS_KEY_ID }}
-          access-key-secret: ${{ secrets.OSS_ACCESS_KEY_SECRET }}
-          ossutil-version: '1.7.18'
-      - name: Upload Assets to OSS
-        run: ossutil cp -r dist/ oss://resource-fit2cloud-com/1panel/package/v2/stable/${{ github.ref_name }}/release/ --include "*.tar.gz" --include "checksums.txt" --only-current-dir --force

.gitignore

@@ -73,4 +73,6 @@ agent/.golangci.yml
 openspec
 CLAUDE.md
 AGENTS.md
-opencode.json
+opencode.json
+superpowers
+.worktrees/

README.md

@@ -1,16 +1,23 @@
 <p align="center"><a href="https://1panel.pro"><img src="https://resource.1panel.pro/img/1panel-logo.png" alt="1Panel" width="300" /></a></p>
+
+<h3 align="center">The open-source VPS control panel with native AI agent support</h3>
+
+<p align="center">
+  Trusted by <strong>2,000,000+</strong> self-hosters worldwide
+</p>
+
 <p align="center">
   <a href="https://trendshift.io/repositories/2462" target="_blank"><img src="https://trendshift.io/api/badge/repositories/2462" alt="1Panel-dev%2F1Panel | Trendshift" style="width: 240px; height: auto;" /></a>
 </p>
+
 <p align="center">
   <a href="https://www.gnu.org/licenses/gpl-3.0.html"><img src="https://shields.io/github/license/1Panel-dev/1Panel?color=%231890FF" alt="License: GPL v3"></a>
-  <a href="https://app.codacy.com/gh/1Panel-dev/1Panel?utm_source=github.com&utm_medium=referral&utm_content=1Panel-dev/1Panel&utm_campaign=Badge_Grade_Dashboard"><img src="https://app.codacy.com/project/badge/Grade/da67574fd82b473992781d1386b937ef" alt="Codacy"></a>
-  <a href="https://discord.gg/bUpUqWqdRr" target="_blank">
-        <img src="https://img.shields.io/discord/1318846410149335080?logo=discord&labelColor=%20%235462eb&logoColor=%20%23f5f5f5&color=%20%235462eb"
-            alt="chat on Discord"></a>
+  <a href="https://app.codacy.com/gh/1Panel-dev/1Panel"><img src="https://app.codacy.com/project/badge/Grade/da67574fd82b473992781d1386b937ef" alt="Codacy"></a>
+  <a href="https://discord.gg/bUpUqWqdRr"><img src="https://img.shields.io/discord/1318846410149335080?logo=discord&labelColor=%20%235462eb&logoColor=%20%23f5f5f5&color=%20%235462eb" alt="Discord"></a>
   <a href="https://github.com/1Panel-dev/1Panel/releases"><img src="https://img.shields.io/github/v/release/1Panel-dev/1Panel" alt="GitHub release"></a>
-  <a href="https://github.com/1Panel-dev/1Panel"><img src="https://img.shields.io/github/stars/1Panel-dev/1Panel?color=%231890FF&style=flat-square" alt="Stars"></a><br>
+  <a href="https://github.com/1Panel-dev/1Panel"><img src="https://img.shields.io/github/stars/1Panel-dev/1Panel?color=%231890FF&style=flat-square" alt="Stars"></a>
 </p>
+
 <p align="center">
   <a href="/README.md"><img alt="English" src="https://img.shields.io/badge/English-d9d9d9"></a>
   <a href="/docs/README.zh-Hans.md"><img alt="中文(简体)" src="https://img.shields.io/badge/中文(简体)-d9d9d9"></a>
@@ -18,69 +25,91 @@
   <a href="/docs/README.pt-br.md"><img alt="Português (Brasil)" src="https://img.shields.io/badge/Português (Brasil)-d9d9d9"></a>
   <a href="/docs/README.ar.md"><img alt="العربية" src="https://img.shields.io/badge/العربية-d9d9d9"></a>
   <a href="/docs/README.de.md"><img alt="Deutsch" src="https://img.shields.io/badge/Deutsch-d9d9d9"></a>
-  <a href="/docs/README.es.md"><img alt="Español" src="https://img.shields.io/badge/Español-d9d9d9"></a><br>
+  <a href="/docs/README.es.md"><img alt="Español" src="https://img.shields.io/badge/Español-d9d9d9"></a>
   <a href="/docs/README.fr.md"><img alt="français" src="https://img.shields.io/badge/français-d9d9d9"></a>
   <a href="/docs/README.ko.md"><img alt="한국어" src="https://img.shields.io/badge/한국어-d9d9d9"></a>
   <a href="/docs/README.id.md"><img alt="Bahasa Indonesia" src="https://img.shields.io/badge/Bahasa Indonesia-d9d9d9"></a>
   <a href="/docs/README.zh-Hant.md"><img alt="中文(繁體)" src="https://img.shields.io/badge/中文(繁體)-d9d9d9"></a>
   <a href="/docs/README.tr.md"><img alt="Türkçe" src="https://img.shields.io/badge/Türkçe-d9d9d9"></a>
-  <a href="/docs/README.ru.md"><img alt="Русский" src="https://img.shields.io/badge/%D0%A0%D1%83%D1%81%D1%81%D0%BA%D0%B8%D0%B9-d9d9d9"></a>
+  <a href="/docs/README.ru.md"><img alt="Русский" src="https://img.shields.io/badge/Русский-d9d9d9"></a>
   <a href="/docs/README.ms.md"><img alt="Bahasa Melayu" src="https://img.shields.io/badge/Bahasa Melayu-d9d9d9"></a>
 </p>
 
-------------------------------
-## What is 1Panel? 
+---
 
-1Panel is a modern, open-source Linux server management panel that streamlines administration through an intuitive, clean web interface.
+## What is 1Panel?
 
-## Key Features  
+1Panel is a modern, open-source VPS control panel — and the only one with **native AI agent support**. Run Ollama models, deploy OpenClaw agents, and manage your entire server stack from one clean web interface. No CLI memorization required.
 
-🔹 **AI Integration**  
-Seamlessly deploy OpenClaw agents, host local LLMs via Ollama, and monitor GPU utilization—all within a unified workspace engineered for efficient AI development and inference.  
+👉 Watch the [2-minute introduction](https://www.youtube.com/watch?v=Jl_wqp-XA08)
 
-🔹 **One-Click Website Deployment**  
-Launch production-ready websites instantly with automatic domain binding, SSL certificate provisioning, and configuration—zero manual setup required.  
+## Why 1Panel?
 
-🔹 **Curated App Marketplace**  
-Discover, install, and update trusted open-source applications (WordPress, MySQL, Redis, and more) with a single click.  
+| | 1Panel | cPanel / Plesk | aaPanel | Webmin |
+|--|--------|----------------|---------|--------|
+| Free & open source | ✅ | ❌ | Partial | ✅ |
+| Native AI agent runtime | ✅ | ❌ | ❌ | ❌ |
+| One-click app marketplace | ✅ 165+ apps | ❌ | ✅ | ❌ |
+| Modern UI (post-2020) | ✅ | ❌ | Partial | ❌ |
+| Docker / container management | ✅ | ❌ | ❌ | ❌ |
+| Active development | ✅ | ✅ | ✅ | Slow |
 
-🔹 **Centralized Server Management**  
-Monitor system resources and manage files, databases, containers, and services effortlessly through a unified, intuitive dashboard.  
+## Key Features
 
-🔹 **Enterprise-Grade Security**  
-Strengthen defenses with container isolation, firewall controls, audit logging, and secure deployment practices—ensuring compliance and peace of mind.  
-
-🔹 **Intelligent Backup & Restore**  
-Schedule automated backups or perform instant restores to local storage or leading cloud platforms (AWS S3, Cloudflare R2, and more), with flexible retention and destination options.
+- **AI Agent Runtime**: Deploy Ollama LLMs, spin up OpenClaw personal agents, and monitor GPU utilization — all from the dashboard. No separate AI stack to manage.
+- **One-Click Website Deployment**: Launch production-ready websites with automatic domain binding, SSL provisioning, and Nginx config — zero manual setup.
+- **App Marketplace**: 165+ trusted open-source apps (Nextcloud, Bitwarden, Umami, NocoBase, and more) installed and updated with a single click.
+- **Docker & Container Management**: Create, start, stop, and inspect containers, images, networks, and volumes through a visual UI — no CLI juggling.
+- **Security Out of the Box**: Firewall rules, fail2ban, container isolation, WAF, and audit logs — configured and running from day one.
+- **Backup & Restore**: Schedule automated backups to AWS S3, Cloudflare R2, or local storage. Restore any snapshot in one click.
 
 ## Quick Start
 
-Execute the script below and follow the prompts to install 1Panel:
+> **Requirements:** Linux VPS (Debian / Ubuntu / CentOS / Rocky), 1 GB RAM, internet access.  
+> Takes ~60 seconds.
 
 ```bash
-bash -c "$(curl -sSL https://resource.fit2cloud.com/1panel/package/v2/quick_start.sh)"
+bash -c "$(curl -sSL https://resource.1panel.pro/v2/quick_start.sh)"
 ```
 
+After installation, open `http://<your-server-ip>:<port>/<security-path>` in your browser.  
+Run `1pctl user-info` via SSH if you need to retrieve your access credentials.
+
 ## Screenshot
 
-![UI Display](https://resource.1panel.pro/img/1panel.png)
+![1Panel UI](https://resource.1panel.pro/img/overview_en_v2.png)
+
+## Pro Edition
+
+1Panel OSS is free forever. Pro adds features built for teams and production workloads:
+
+| Feature | OSS | Pro |
+|---------|:---:|:---:|
+| One-click app installs | ✅ | ✅ |
+| AI agents (OpenClaw) | 1 agent | Unlimited |
+| WAF & advanced security | Basic | ✅ |
+| Website tamper protection | ❌ | ✅ |
+| Website uptime monitoring | ❌ | ✅ |
+| Multi-node management | ❌ | ✅ |
+| Custom logo & theme | ❌ | ✅ |
+| Priority support | ❌ | ✅ |
+
+**From $80/year.** [Compare plans & start 30-day free trial →](https://1panel.pro/pricing)
 
 ## Star History
 
 [![Star History Chart](https://api.star-history.com/svg?repos=1Panel-dev/1Panel&type=Date)](https://star-history.com/#1Panel-dev/1Panel&Date)
 
-## Pro Edition
+## Community & Support
 
-Compared to the OSS Edition, 1Panel Pro Edition provides users with a wealth of enhanced features and technical support services. Enhanced features include WAF enhancement, website tamper protection, website monitoring, GPU monitoring, custom logo and theme color, etc. [Click to view the detailed introduction of the Pro Edition](https://1panel.pro/pricing).
+- **Discord** — [Join the community](https://discord.gg/bUpUqWqdRr) for help, feature requests, and show-and-tell
+- **Docs** — [1panel.pro/docs](https://1panel.pro/docs)
+- **Issues** — [GitHub Issues](https://github.com/1Panel-dev/1Panel/issues) for bug reports
 
-## Security Information
+## Security
 
-If you discover any security issues, please refer to [SECURITY.md](/SECURITY.md).
+Found a vulnerability? Please read [SECURITY.md](/SECURITY.md) before disclosing.
 
 ## License
 
-Licensed under The GNU General Public License version 3 (GPLv3)  (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
-
-<https://www.gnu.org/licenses/gpl-3.0.html>
-
-Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+Licensed under the [GNU General Public License v3.0](https://www.gnu.org/licenses/gpl-3.0.html).

agent/app/api/v2/agents.go

@@ -51,6 +51,27 @@ func (b *BaseApi) PageAgents(c *gin.Context) {
 	})
 }
 
+// @Tags AI
+// @Summary Delete check Agent
+// @Accept json
+// @Param request body dto.AgentIDReq true "request"
+// @Success 200 {array} dto.AppResource
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/delete/check [post]
+func (b *BaseApi) DeleteCheckAgent(c *gin.Context) {
+	var req dto.AgentIDReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	checkData, err := agentService.DeleteCheck(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, checkData)
+}
+
 // @Tags AI
 // @Summary Delete Agent
 // @Accept json
@@ -91,6 +112,67 @@ func (b *BaseApi) ResetAgentToken(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags AI
+// @Summary Update Agent remark
+// @Accept json
+// @Param request body dto.AgentRemarkUpdateReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/remark [post]
+func (b *BaseApi) UpdateAgentRemark(c *gin.Context) {
+	var req dto.AgentRemarkUpdateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.UpdateRemark(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Bind Agent website
+// @Accept json
+// @Param request body dto.AgentWebsiteBindReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/website/bind [post]
+func (b *BaseApi) BindAgentWebsite(c *gin.Context) {
+	var req dto.AgentWebsiteBindReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.BindWebsite(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Get Agent model config
+// @Accept json
+// @Param request body dto.AgentIDReq true "request"
+// @Success 200 {object} dto.AgentModelConfig
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/model/get [post]
+func (b *BaseApi) GetAgentModelConfig(c *gin.Context) {
+	var req dto.AgentIDReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	res, err := agentService.GetModelConfig(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, res)
+}
+
 // @Tags AI
 // @Summary Update Agent model config
 // @Accept json
@@ -111,9 +193,30 @@ func (b *BaseApi) UpdateAgentModelConfig(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags AI
+// @Summary Get Agent overview
+// @Accept json
+// @Param request body dto.AgentOverviewReq true "request"
+// @Success 200 {object} dto.AgentOverview
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/overview [post]
+func (b *BaseApi) GetAgentOverview(c *gin.Context) {
+	var req dto.AgentOverviewReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	res, err := agentService.GetOverview(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, res)
+}
+
 // @Tags AI
 // @Summary Get Providers
-// @Success 200 {object} []dto.ProviderInfo
+// @Success 200 {array} dto.ProviderInfo
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /ai/agents/providers [get]
@@ -190,6 +293,87 @@ func (b *BaseApi) PageAgentAccounts(c *gin.Context) {
 	})
 }
 
+// @Tags AI
+// @Summary List Agent account models
+// @Accept json
+// @Param request body dto.AgentAccountModelReq true "request"
+// @Success 200 {array} dto.AgentAccountModel
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/accounts/models [post]
+func (b *BaseApi) GetAgentAccountModels(c *gin.Context) {
+	var req dto.AgentAccountModelReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	list, err := agentService.GetAccountModels(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, list)
+}
+
+// @Tags AI
+// @Summary Create Agent account model
+// @Accept json
+// @Param request body dto.AgentAccountModelCreateReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/accounts/models/create [post]
+func (b *BaseApi) CreateAgentAccountModel(c *gin.Context) {
+	var req dto.AgentAccountModelCreateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.CreateAccountModel(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Update Agent account model
+// @Accept json
+// @Param request body dto.AgentAccountModelUpdateReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/accounts/models/update [post]
+func (b *BaseApi) UpdateAgentAccountModel(c *gin.Context) {
+	var req dto.AgentAccountModelUpdateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.UpdateAccountModel(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Delete Agent account model
+// @Accept json
+// @Param request body dto.AgentAccountModelDeleteReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/accounts/models/delete [post]
+func (b *BaseApi) DeleteAgentAccountModel(c *gin.Context) {
+	var req dto.AgentAccountModelDeleteReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.DeleteAccountModel(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags AI
 // @Summary Verify Agent account
 // @Accept json
@@ -230,6 +414,170 @@ func (b *BaseApi) DeleteAgentAccount(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags AI
+// @Summary Create Agent role
+// @Accept json
+// @Param request body dto.AgentRoleCreateReq true "request"
+// @Success 200 {object} dto.AgentRoleCreateResp
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/agent/create [post]
+func (b *BaseApi) CreateAgentRole(c *gin.Context) {
+	var req dto.AgentRoleCreateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := agentService.CreateRole(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Delete Agent role
+// @Accept json
+// @Param request body dto.AgentRoleDeleteReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/agent/delete [post]
+func (b *BaseApi) DeleteAgentRole(c *gin.Context) {
+	var req dto.AgentRoleDeleteReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.DeleteRole(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Bind Agent role channel
+// @Accept json
+// @Param request body dto.AgentRoleBindReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/agent/bind [post]
+func (b *BaseApi) BindAgentRole(c *gin.Context) {
+	var req dto.AgentRoleBindReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.BindRole(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Unbind Agent role channel
+// @Accept json
+// @Param request body dto.AgentRoleBindReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/agent/unbind [post]
+func (b *BaseApi) UnbindAgentRole(c *gin.Context) {
+	var req dto.AgentRoleBindReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.UnbindRole(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Get configured Agent roles from config file
+// @Accept json
+// @Param request body dto.AgentConfiguredAgentsReq true "request"
+// @Success 200 {array} dto.AgentConfiguredAgentItem
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/agent/list [post]
+func (b *BaseApi) GetConfiguredAgentRoles(c *gin.Context) {
+	var req dto.AgentConfiguredAgentsReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := agentService.GetConfiguredAgents(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Get Agent role channels from config file
+// @Accept json
+// @Param request body dto.AgentRoleChannelsReq true "request"
+// @Success 200 {array} dto.AgentRoleChannelItem
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/agent/channels [post]
+func (b *BaseApi) GetAgentRoleChannels(c *gin.Context) {
+	var req dto.AgentRoleChannelsReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := agentService.GetRoleChannels(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Get Agent role markdown files
+// @Accept json
+// @Param request body dto.AgentRoleMarkdownFilesReq true "request"
+// @Success 200 {array} dto.AgentRoleMarkdownFileItem
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/agent/md/list [post]
+func (b *BaseApi) GetAgentRoleMarkdownFiles(c *gin.Context) {
+	var req dto.AgentRoleMarkdownFilesReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := agentService.GetRoleMarkdownFiles(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Update Agent role markdown file
+// @Accept json
+// @Param request body dto.AgentRoleMarkdownFilesUpdateReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/agent/md/update [post]
+func (b *BaseApi) UpdateAgentRoleMarkdownFile(c *gin.Context) {
+	var req dto.AgentRoleMarkdownFilesUpdateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.UpdateRoleMarkdownFiles(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags AI
 // @Summary Get Agent Feishu channel config
 // @Accept json
@@ -272,19 +620,530 @@ func (b *BaseApi) UpdateAgentFeishuConfig(c *gin.Context) {
 }
 
 // @Tags AI
-// @Summary Approve Agent Feishu pairing code
+// @Summary Get Agent Telegram channel config
 // @Accept json
-// @Param request body dto.AgentFeishuPairingApproveReq true "request"
-// @Success 200
+// @Param request body dto.AgentTelegramConfigReq true "request"
+// @Success 200 {object} dto.AgentTelegramConfig
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /ai/agents/channel/feishu/approve [post]
-func (b *BaseApi) ApproveAgentFeishuPairing(c *gin.Context) {
-	var req dto.AgentFeishuPairingApproveReq
+// @Router /ai/agents/channel/telegram/get [post]
+func (b *BaseApi) GetAgentTelegramConfig(c *gin.Context) {
+	var req dto.AgentTelegramConfigReq
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
-	if err := agentService.ApproveFeishuPairing(req); err != nil {
+	data, err := agentService.GetTelegramConfig(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Update Agent Telegram channel config
+// @Accept json
+// @Param request body dto.AgentTelegramConfigUpdateReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/channel/telegram/update [post]
+func (b *BaseApi) UpdateAgentTelegramConfig(c *gin.Context) {
+	var req dto.AgentTelegramConfigUpdateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.UpdateTelegramConfig(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Get Agent Discord channel config
+// @Accept json
+// @Param request body dto.AgentIDReq true "request"
+// @Success 200 {object} dto.AgentDiscordConfig
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/channel/discord/get [post]
+func (b *BaseApi) GetAgentDiscordConfig(c *gin.Context) {
+	var req dto.AgentIDReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := agentService.GetDiscordConfig(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Update Agent Discord channel config
+// @Accept json
+// @Param request body dto.AgentDiscordConfigUpdateReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/channel/discord/update [post]
+func (b *BaseApi) UpdateAgentDiscordConfig(c *gin.Context) {
+	var req dto.AgentDiscordConfigUpdateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.UpdateDiscordConfig(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Get Agent QQ Bot channel config
+// @Accept json
+// @Param request body dto.AgentIDReq true "request"
+// @Success 200 {object} dto.AgentWecomConfig
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/channel/wecom/get [post]
+func (b *BaseApi) GetAgentWecomConfig(c *gin.Context) {
+	var req dto.AgentIDReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := agentService.GetWecomConfig(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Update Agent WeCom channel config
+// @Accept json
+// @Param request body dto.AgentWecomConfigUpdateReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/channel/wecom/update [post]
+func (b *BaseApi) UpdateAgentWecomConfig(c *gin.Context) {
+	var req dto.AgentWecomConfigUpdateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.UpdateWecomConfig(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Get Agent DingTalk channel config
+// @Accept json
+// @Param request body dto.AgentIDReq true "request"
+// @Success 200 {object} dto.AgentDingTalkConfig
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/channel/dingtalk/get [post]
+func (b *BaseApi) GetAgentDingTalkConfig(c *gin.Context) {
+	var req dto.AgentIDReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := agentService.GetDingTalkConfig(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Update Agent DingTalk channel config
+// @Accept json
+// @Param request body dto.AgentDingTalkConfigUpdateReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/channel/dingtalk/update [post]
+func (b *BaseApi) UpdateAgentDingTalkConfig(c *gin.Context) {
+	var req dto.AgentDingTalkConfigUpdateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.UpdateDingTalkConfig(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Get Agent QQ Bot channel config
+// @Accept json
+// @Param request body dto.AgentIDReq true "request"
+// @Success 200 {object} dto.AgentQQBotConfig
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/channel/qqbot/get [post]
+func (b *BaseApi) GetAgentQQBotConfig(c *gin.Context) {
+	var req dto.AgentIDReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := agentService.GetQQBotConfig(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Update Agent QQ Bot channel config
+// @Accept json
+// @Param request body dto.AgentQQBotConfigUpdateReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/channel/qqbot/update [post]
+func (b *BaseApi) UpdateAgentQQBotConfig(c *gin.Context) {
+	var req dto.AgentQQBotConfigUpdateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.UpdateQQBotConfig(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Install Agent plugin
+// @Accept json
+// @Param request body dto.AgentPluginInstallReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/plugin/install [post]
+func (b *BaseApi) InstallAgentPlugin(c *gin.Context) {
+	var req dto.AgentPluginInstallReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.InstallPlugin(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Upgrade Agent plugin
+// @Accept json
+// @Param request body dto.AgentPluginUpgradeReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/plugin/upgrade [post]
+func (b *BaseApi) UpgradeAgentPlugin(c *gin.Context) {
+	var req dto.AgentPluginUpgradeReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.UpgradePlugin(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Uninstall Agent plugin
+// @Accept json
+// @Param request body dto.AgentPluginUninstallReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/plugin/uninstall [post]
+func (b *BaseApi) UninstallAgentPlugin(c *gin.Context) {
+	var req dto.AgentPluginUninstallReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.UninstallPlugin(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Check Agent plugin installation status
+// @Accept json
+// @Param request body dto.AgentPluginCheckReq true "request"
+// @Success 200 {object} dto.AgentPluginStatus
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/plugin/check [post]
+func (b *BaseApi) CheckAgentPlugin(c *gin.Context) {
+	var req dto.AgentPluginCheckReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := agentService.CheckPlugin(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Get Agent Security config
+// @Accept json
+// @Param request body dto.AgentIDReq true "request"
+// @Success 200 {object} dto.AgentSecurityConfig
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/security/get [post]
+func (b *BaseApi) GetAgentSecurityConfig(c *gin.Context) {
+	var req dto.AgentIDReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := agentService.GetSecurityConfig(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Update Agent Security config
+// @Accept json
+// @Param request body dto.AgentSecurityConfigUpdateReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/security/update [post]
+func (b *BaseApi) UpdateAgentSecurityConfig(c *gin.Context) {
+	var req dto.AgentSecurityConfigUpdateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.UpdateSecurityConfig(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Get Agent Other config
+// @Accept json
+// @Param request body dto.AgentIDReq true "request"
+// @Success 200 {object} dto.AgentOtherConfig
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/other/get [post]
+func (b *BaseApi) GetAgentOtherConfig(c *gin.Context) {
+	var req dto.AgentIDReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := agentService.GetOtherConfig(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Update Agent Other config
+// @Accept json
+// @Param request body dto.AgentOtherConfigUpdateReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/other/update [post]
+func (b *BaseApi) UpdateAgentOtherConfig(c *gin.Context) {
+	var req dto.AgentOtherConfigUpdateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.UpdateOtherConfig(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Get Agent config file
+// @Accept json
+// @Param request body dto.AgentConfigFileReq true "request"
+// @Success 200 {object} dto.AgentConfigFile
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/config-file/get [post]
+func (b *BaseApi) GetAgentConfigFile(c *gin.Context) {
+	var req dto.AgentConfigFileReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := agentService.GetConfigFile(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Update Agent config file
+// @Accept json
+// @Param request body dto.AgentConfigFileUpdateReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/config-file/update [post]
+func (b *BaseApi) UpdateAgentConfigFile(c *gin.Context) {
+	var req dto.AgentConfigFileUpdateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.UpdateConfigFile(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary List Agent skills
+// @Accept json
+// @Param request body dto.AgentIDReq true "request"
+// @Success 200 {array} dto.AgentSkillItem
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/skills/list [post]
+func (b *BaseApi) ListAgentSkills(c *gin.Context) {
+	var req dto.AgentIDReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := agentService.ListSkills(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Search Agent skills
+// @Accept json
+// @Param request body dto.AgentSkillSearchReq true "request"
+// @Success 200 {array} dto.AgentSkillSearchItem
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/skills/search [post]
+func (b *BaseApi) SearchAgentSkills(c *gin.Context) {
+	var req dto.AgentSkillSearchReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := agentService.SearchSkills(req)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags AI
+// @Summary Update Agent skill status
+// @Accept json
+// @Param request body dto.AgentSkillUpdateReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/skills/update [post]
+func (b *BaseApi) UpdateAgentSkill(c *gin.Context) {
+	var req dto.AgentSkillUpdateReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.UpdateSkill(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Install Agent skill
+// @Accept json
+// @Param request body dto.AgentSkillInstallReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/skills/install [post]
+func (b *BaseApi) InstallAgentSkill(c *gin.Context) {
+	var req dto.AgentSkillInstallReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.InstallSkill(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Login Agent Weixin channel
+// @Accept json
+// @Param request body dto.AgentWeixinLoginReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/channel/weixin/login [post]
+func (b *BaseApi) LoginAgentWeixinChannel(c *gin.Context) {
+	var req dto.AgentWeixinLoginReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.LoginWeixinChannel(req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags AI
+// @Summary Approve Agent channel pairing code
+// @Accept json
+// @Param request body dto.AgentChannelPairingApproveReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /ai/agents/channel/pairing/approve [post]
+func (b *BaseApi) ApproveAgentChannelPairing(c *gin.Context) {
+	var req dto.AgentChannelPairingApproveReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := agentService.ApproveChannelPairing(req); err != nil {
 		helper.BadRequest(c, err)
 		return
 	}

agent/app/api/v2/app_install.go

@@ -109,7 +109,7 @@ func (b *BaseApi) LoadPort(c *gin.Context) {
 // @Success 200 {object} response.DatabaseConn
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /apps/installed/conninfo [POST]
+// @Router /apps/installed/conninfo [post]
 func (b *BaseApi) LoadConnInfo(c *gin.Context) {
 	var req dto.OperationWithNameAndType
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -349,3 +349,15 @@ func (b *BaseApi) GetAppInstallInfo(c *gin.Context) {
 	}
 	helper.SuccessWithData(c, info)
 }
+
+func (b *BaseApi) UpdateAppInstallSort(c *gin.Context) {
+	var req request.AppInstallSort
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := appInstallService.UpdateSort(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}

agent/app/api/v2/backup.go

@@ -430,6 +430,16 @@ func (b *BaseApi) Backup(c *gin.Context) {
 			helper.InternalServer(c, err)
 			return
 		}
+	case "container":
+		if err := backupService.ContainerBackup(req); err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
+	case "compose":
+		if err := backupService.ComposeBackup(req); err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
 	}
 	helper.Success(c)
 }
@@ -485,6 +495,16 @@ func (b *BaseApi) Recover(c *gin.Context) {
 			helper.InternalServer(c, err)
 			return
 		}
+	case "container":
+		if err := backupService.ContainerRecover(req); err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
+	case "compose":
+		if err := backupService.ComposeRecover(req); err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
 	}
 	helper.Success(c)
 }
@@ -525,6 +545,16 @@ func (b *BaseApi) RecoverByUpload(c *gin.Context) {
 			helper.InternalServer(c, err)
 			return
 		}
+	case "container":
+		if err := backupService.ContainerRecover(req); err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
+	case "compose":
+		if err := backupService.ComposeRecover(req); err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
 	}
 	helper.Success(c)
 }

agent/app/api/v2/container.go

@@ -1,6 +1,9 @@
 package v2
 
 import (
+	"net/http"
+	"net/url"
+	"path"
 	"strconv"
 
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
@@ -53,6 +56,162 @@ func (b *BaseApi) LoadContainerUsers(c *gin.Context) {
 	helper.SuccessWithData(c, containerService.LoadUsers(req))
 }
 
+// @Tags Container
+// @Summary List container files
+// @Accept json
+// @Param request body dto.ContainerFileReq true "request"
+// @Success 200 {array} dto.ContainerFileInfo
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /containers/files/search [post]
+func (b *BaseApi) ListContainerFiles(c *gin.Context) {
+	var req dto.ContainerFileReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	files, err := containerService.ListContainerFiles(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, files)
+}
+
+// @Tags Container
+// @Summary Upload container file
+// @Accept multipart/form-data
+// @Param containerID formData string true "containerID"
+// @Param path formData string true "path"
+// @Param file formData file true "file"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /containers/files/upload [post]
+// @x-panel-log {"bodyKeys":["containerID","path"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"容器 [containerID] 上传文件到 [path]","formatEN":"Upload file to [path] in container [containerID]"}
+func (b *BaseApi) UploadContainerFile(c *gin.Context) {
+	form, err := c.MultipartForm()
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	containerIDs := form.Value["containerID"]
+	paths := form.Value["path"]
+	uploadFiles := form.File["file"]
+	if len(containerIDs) == 0 || len(paths) == 0 || len(uploadFiles) == 0 {
+		helper.BadRequest(c, errors.New("invalid container file upload params"))
+		return
+	}
+	req := dto.ContainerFileReq{
+		ContainerID: containerIDs[0],
+		Path:        paths[0],
+	}
+	for _, uploadFile := range uploadFiles {
+		file, err := uploadFile.Open()
+		if err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
+		err = containerService.UploadContainerFile(req, path.Base(uploadFile.Filename), uploadFile.Size, file)
+		_ = file.Close()
+		if err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
+	}
+	helper.Success(c)
+}
+
+// @Tags Container
+// @Summary Get container file content
+// @Accept json
+// @Param request body dto.ContainerFileReq true "request"
+// @Success 200 {object} dto.ContainerFileContent
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /containers/files/content [post]
+func (b *BaseApi) GetContainerFileContent(c *gin.Context) {
+	var req dto.ContainerFileReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	content, err := containerService.GetContainerFileContent(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, content)
+}
+
+// @Tags Container
+// @Summary Get container file size
+// @Accept json
+// @Param request body dto.ContainerFileReq true "request"
+// @Success 200 {int} size
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /containers/files/size [post]
+func (b *BaseApi) GetContainerFileSize(c *gin.Context) {
+	var req dto.ContainerFileReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	size, err := containerService.GetContainerFileSize(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, size)
+}
+
+// @Tags Container
+// @Summary Delete container file
+// @Accept json
+// @Param request body dto.ContainerFileBatchDeleteReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /containers/files/del [post]
+// @x-panel-log {"bodyKeys":["containerID","paths"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"删除容器 [containerID] 文件 [paths]","formatEN":"Delete files [paths] in container [containerID]"}
+func (b *BaseApi) DeleteContainerFile(c *gin.Context) {
+	var req dto.ContainerFileBatchDeleteReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := containerService.DeleteContainerFile(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Container
+// @Summary Download container file
+// @Accept json
+// @Param request body dto.ContainerFileReq true "request"
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /containers/files/download [post]
+// @x-panel-log {"bodyKeys":["containerID","path"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"下载容器 [containerID] 文件 [path]","formatEN":"Download file [path] from container [containerID]"}
+func (b *BaseApi) DownloadContainerFile(c *gin.Context) {
+	var req dto.ContainerFileReq
+	if err := c.ShouldBindJSON(&req); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	if req.ContainerID == "" || req.Path == "" {
+		helper.BadRequest(c, errors.New("invalid container file download params"))
+		return
+	}
+	reader, fileName, contentType, err := containerService.DownloadContainerFile(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	defer reader.Close()
+	c.Header("Content-Disposition", "attachment; filename*=utf-8''"+url.PathEscape(fileName))
+	c.DataFromReader(http.StatusOK, -1, contentType, reader, nil)
+}
+
 // @Tags Container
 // @Summary List containers
 // @Accept json
@@ -306,27 +465,6 @@ func (b *BaseApi) ContainerCreate(c *gin.Context) {
 	helper.Success(c)
 }
 
-// @Tags Container
-// @Summary Create container by command
-// @Accept json
-// @Param request body dto.ContainerCreateByCommand true "request"
-// @Success 200
-// @Security ApiKeyAuth
-// @Security Timestamp
-// @Router /containers/command [post]
-func (b *BaseApi) ContainerCreateByCommand(c *gin.Context) {
-	var req dto.ContainerCreateByCommand
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
-		return
-	}
-
-	if err := containerService.ContainerCreateByCommand(req); err != nil {
-		helper.InternalServer(c, err)
-		return
-	}
-	helper.Success(c)
-}
-
 // @Tags Container
 // @Summary Upgrade container
 // @Accept json

agent/app/api/v2/docker.go

@@ -12,7 +12,7 @@ import (
 // @Tags Container Docker
 // @Summary Load docker status
 // @Produce json
-// @Success 200 {string} dto.DockerStatus
+// @Success 200 {object} dto.DockerStatus
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /containers/docker/status [get]
@@ -24,7 +24,7 @@ func (b *BaseApi) LoadDockerStatus(c *gin.Context) {
 // @Tags Container Docker
 // @Summary Load docker daemon.json
 // @Produce json
-// @Success 200 {object} string
+// @Success 200 {string} string
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /containers/daemonjson/file [get]

agent/app/api/v2/entry.go

@@ -36,12 +36,13 @@ var (
 
 	cronjobService = service.NewICronjobService()
 
-	fileService     = service.NewIFileService()
-	sshService      = service.NewISSHService()
-	firewallService = service.NewIFirewallService()
-	iptablesService = service.NewIIptablesService()
-	monitorService  = service.NewIMonitorService()
-	systemService   = service.NewISystemService()
+	fileService      = service.NewIFileService()
+	fileShareService = service.NewIFileShareService()
+	sshService       = service.NewISSHService()
+	firewallService  = service.NewIFirewallService()
+	iptablesService  = service.NewIIptablesService()
+	monitorService   = service.NewIMonitorService()
+	systemService    = service.NewISystemService()
 
 	deviceService   = service.NewIDeviceService()
 	fail2banService = service.NewIFail2BanService()
@@ -70,6 +71,7 @@ var (
 
 	recycleBinService = service.NewIRecycleBinService()
 	favoriteService   = service.NewIFavoriteService()
+	hostService       = service.NewIHostService()
 
 	websiteCAService = service.NewIWebsiteCAService()
 	taskService      = service.NewITaskService()

agent/app/api/v2/file.go

@@ -25,6 +25,7 @@ import (
 	websocket2 "github.com/1Panel-dev/1Panel/agent/utils/websocket"
 	"github.com/gin-gonic/gin"
 	"github.com/gorilla/websocket"
+	qrcode "github.com/skip2/go-qrcode"
 )
 
 // @Tags File
@@ -48,6 +49,31 @@ func (b *BaseApi) ListFiles(c *gin.Context) {
 	helper.SuccessWithData(c, fileList)
 }
 
+// @Tags File
+// @Summary File search: content grep + optional AI summary
+// @Description When file-management AI is enabled, returns mode=ai with summary and hits. When disabled, returns mode=grep with hits only. Scans file contents only. Supports match options, extension/size/time filters, and scan limits.
+// @Accept json
+// @Param request body request.FileAISearch true "request"
+// @Success 200 {object} response.FileAISearchResult
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/ai-search [post]
+func (b *BaseApi) FileAISearch(c *gin.Context) {
+	var req request.FileAISearch
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if strings.TrimSpace(req.ResponseLanguage) == "" {
+		req.ResponseLanguage = strings.TrimSpace(c.GetHeader("Accept-Language"))
+	}
+	res, err := fileService.AISearch(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, res)
+}
+
 // @Tags File
 // @Summary Page file
 // @Accept json
@@ -515,6 +541,29 @@ func (b *BaseApi) WgetFile(c *gin.Context) {
 	})
 }
 
+// @Tags File
+// @Summary Stop wget file download
+// @Accept json
+// @Param request body request.FileProcessReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/wget/stop [post]
+// @x-panel-log {"bodyKeys":["key"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"停止下载任务 [key]","formatEN":"Stop wget task [key]"}
+func (b *BaseApi) StopWget(c *gin.Context) {
+	var req request.FileProcessReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if strings.TrimSpace(req.Key) == "" {
+		helper.BadRequest(c, errors.New("key is required"))
+		return
+	}
+
+	files.CancelDownload(req.Key)
+	helper.Success(c)
+}
+
 // @Tags File
 // @Summary Move file
 // @Accept json
@@ -1015,3 +1064,244 @@ func (b *BaseApi) SetFileRemark(c *gin.Context) {
 	}
 	helper.Success(c)
 }
+
+// @Tags File
+// @Summary List file shares
+// @Accept json
+// @Param request body dto.PageInfo true "request"
+// @Success 200 {object} dto.PageResult
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/share/search [post]
+func (b *BaseApi) SearchFileShare(c *gin.Context) {
+	var req dto.PageInfo
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	total, list, err := fileShareService.Page(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, dto.PageResult{
+		Total: total,
+		Items: list,
+	})
+}
+
+// @Tags File
+// @Summary Get file share detail by path
+// @Accept json
+// @Param request body dto.FilePath true "request"
+// @Success 200 {object} response.FileShareInfo
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/share/detail [post]
+func (b *BaseApi) GetFileShareDetail(c *gin.Context) {
+	var req dto.FilePath
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	info, err := fileShareService.GetByPath(req.Path)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, info)
+}
+
+// @Tags File
+// @Summary Get file share detail by code (no login)
+// @Param code query string true "share code"
+// @Success 200 {object} response.FileSharePublicInfo
+// @Router /files/share/info [get]
+func (b *BaseApi) GetPublicFileShareInfo(c *gin.Context) {
+	code := strings.TrimSpace(c.Query("code"))
+	if code == "" {
+		helper.BadRequest(c, errors.New("code is required"))
+		return
+	}
+	info, err := fileShareService.GetPublicByCode(code)
+	if err != nil {
+		if be, ok := err.(buserr.BusinessError); ok {
+			helper.ErrorWithDetail(c, http.StatusBadRequest, be.Msg, be)
+			return
+		}
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, info)
+}
+
+func buildSharePublicURL(c *gin.Context, code, operateNode string) string {
+	scheme := strings.TrimSpace(c.GetHeader("X-Forwarded-Proto"))
+	if scheme == "" {
+		if c.Request.TLS != nil {
+			scheme = "https"
+		} else {
+			scheme = "http"
+		}
+	}
+	host := strings.TrimSpace(c.GetHeader("X-Forwarded-Host"))
+	if host == "" {
+		host = c.Request.Host
+	}
+	shareURL := url.URL{
+		Scheme: scheme,
+		Host:   host,
+		Path:   "/s/" + url.PathEscape(code),
+	}
+	query := shareURL.Query()
+	if strings.TrimSpace(operateNode) != "" {
+		query.Set("operateNode", operateNode)
+	}
+	shareURL.RawQuery = query.Encode()
+	return shareURL.String()
+}
+
+// @Tags File
+// @Summary Get file share QR code image
+// @Produce png
+// @Param code query string true "share code"
+// @Param operateNode query string false "operate node"
+// @Success 200 {file} file
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/share/qrcode [get]
+func (b *BaseApi) GetFileShareQRCode(c *gin.Context) {
+	code := strings.TrimSpace(c.Query("code"))
+	if code == "" {
+		helper.BadRequest(c, errors.New("code is required"))
+		return
+	}
+	if _, err := fileShareService.GetByCode(code); err != nil {
+		if be, ok := err.(buserr.BusinessError); ok {
+			helper.ErrorWithDetail(c, http.StatusBadRequest, be.Msg, be)
+			return
+		}
+		helper.InternalServer(c, err)
+		return
+	}
+
+	png, err := qrcode.Encode(buildSharePublicURL(c, code, c.Query("operateNode")), qrcode.Medium, 256)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	c.Header("Cache-Control", "private, max-age=300")
+	c.Data(http.StatusOK, "image/png", png)
+}
+
+// @Tags File
+// @Summary Create temporary file share link
+// @Accept json
+// @Param request body request.FileShareCreate true "request"
+// @Success 200 {object} response.FileShareInfo
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/share/create [post]
+// @x-panel-log {"bodyKeys":["path","expireMinutes"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"创建文件分享 [path]","formatEN":"Create file share [path]"}
+func (b *BaseApi) CreateFileShare(c *gin.Context) {
+	var req request.FileShareCreate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	res, err := fileShareService.Create(req)
+	if err != nil {
+		if be, ok := err.(buserr.BusinessError); ok {
+			helper.ErrorWithDetail(c, http.StatusInternalServerError, be.Msg, be.Err)
+			return
+		}
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, res)
+}
+
+// @Tags File
+// @Summary Delete file share by path
+// @Accept json
+// @Param request body dto.FilePath true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/share/del [post]
+// @x-panel-log {"bodyKeys":["path"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"关闭文件分享 [path]","formatEN":"Close file share [path]"}
+func (b *BaseApi) DeleteFileShare(c *gin.Context) {
+	var req dto.FilePath
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := fileShareService.DeleteByPath(req.Path); err != nil {
+		if be, ok := err.(buserr.BusinessError); ok {
+			helper.ErrorWithDetail(c, http.StatusInternalServerError, be.Msg, be.Err)
+			return
+		}
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags File
+// @Summary Check file share code (no login)
+// @Param code query string true "share code"
+// @Param password query string false "optional password"
+// @Success 200 {object} dto.Response
+// @Router /files/share/check [get]
+func (b *BaseApi) CheckFileShare(c *gin.Context) {
+	code := strings.TrimSpace(c.Query("code"))
+	password := c.Query("password")
+	if code == "" {
+		helper.BadRequest(c, errors.New("code is required"))
+		return
+	}
+	if err := fileShareService.Check(code, password); err != nil {
+		if be, ok := err.(buserr.BusinessError); ok {
+			helper.ErrorWithDetail(c, http.StatusBadRequest, be.Msg, be)
+			return
+		}
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags File
+// @Summary Download file by share code (no login)
+// @Produce octet-stream
+// @Param code query string true "share code"
+// @Param password query string false "optional password"
+// @Success 200 {file} file
+// @Router /files/share/download [get]
+func (b *BaseApi) DownloadFileShare(c *gin.Context) {
+	code := strings.TrimSpace(c.Query("code"))
+	password := c.Query("password")
+	if code == "" {
+		helper.BadRequest(c, errors.New("code is required"))
+		return
+	}
+	filePath, displayName, err := fileShareService.PrepareDownload(code, password)
+	if err != nil {
+		if be, ok := err.(buserr.BusinessError); ok {
+			helper.ErrorWithDetail(c, http.StatusBadRequest, be.Msg, be)
+			return
+		}
+		helper.InternalServer(c, err)
+		return
+	}
+	file, err := os.Open(filePath)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	defer file.Close()
+	info, err := file.Stat()
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	c.Header("Content-Length", strconv.FormatInt(info.Size(), 10))
+	c.Header("Content-Disposition", "attachment; filename*=utf-8''"+url.PathEscape(displayName))
+	http.ServeContent(c.Writer, c.Request, displayName, info.ModTime(), file)
+}

agent/app/api/v2/host.go

@@ -0,0 +1,167 @@
+package v2
+
+import (
+	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/utils/encrypt"
+	"github.com/gin-gonic/gin"
+)
+
+func (b *BaseApi) CreateHost(c *gin.Context) {
+	var req dto.HostOperate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	host, err := hostService.Create(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, host)
+}
+
+func (b *BaseApi) TestByInfo(c *gin.Context) {
+	var req dto.HostConnTest
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	helper.SuccessWithData(c, hostService.TestByInfo(req))
+}
+
+func (b *BaseApi) TestByID(c *gin.Context) {
+	var req dto.OperateByID
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	helper.SuccessWithData(c, hostService.TestLocalConn(req.ID))
+}
+
+func (b *BaseApi) HostTree(c *gin.Context) {
+	var req dto.SearchForTree
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	data, err := hostService.SearchForTree(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+func (b *BaseApi) SearchHost(c *gin.Context) {
+	var req dto.SearchPageWithGroup
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	total, list, err := hostService.SearchWithPage(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+
+	helper.SuccessWithData(c, dto.PageResult{Items: list, Total: total})
+}
+
+func (b *BaseApi) DeleteHost(c *gin.Context) {
+	var req dto.OperateByIDs
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	if err := hostService.Delete(req.IDs); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+func (b *BaseApi) UpdateHost(c *gin.Context) {
+	var req dto.HostOperate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	var err error
+	if len(req.Password) != 0 && req.AuthMode == "password" {
+		req.Password, err = hostService.EncryptHost(req.Password)
+		if err != nil {
+			helper.BadRequest(c, err)
+			return
+		}
+		req.PrivateKey = ""
+		req.PassPhrase = ""
+	}
+	if len(req.PrivateKey) != 0 && req.AuthMode == "key" {
+		req.PrivateKey, err = hostService.EncryptHost(req.PrivateKey)
+		if err != nil {
+			helper.BadRequest(c, err)
+			return
+		}
+		if len(req.PassPhrase) != 0 {
+			req.PassPhrase, err = encrypt.StringEncrypt(req.PassPhrase)
+			if err != nil {
+				helper.BadRequest(c, err)
+				return
+			}
+		}
+		req.Password = ""
+	}
+
+	upMap := map[string]interface{}{
+		"name":              req.Name,
+		"group_id":          req.GroupID,
+		"addr":              req.Addr,
+		"port":              req.Port,
+		"user":              req.User,
+		"auth_mode":         req.AuthMode,
+		"remember_password": req.RememberPassword,
+		"description":       req.Description,
+	}
+	if req.AuthMode == "password" {
+		upMap["password"] = req.Password
+		upMap["private_key"] = ""
+		upMap["pass_phrase"] = ""
+	} else {
+		upMap["password"] = ""
+		upMap["private_key"] = req.PrivateKey
+		upMap["pass_phrase"] = req.PassPhrase
+	}
+	hostItem, err := hostService.Update(req.ID, upMap)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, hostItem)
+}
+
+func (b *BaseApi) UpdateHostGroup(c *gin.Context) {
+	var req dto.ChangeGroup
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	if _, err := hostService.Update(req.ID, map[string]interface{}{"group_id": req.GroupID}); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+func (b *BaseApi) GetHostByID(c *gin.Context) {
+	var req dto.OperateByID
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	info, err := hostService.GetHostByID(req.ID)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, info)
+}

agent/app/api/v2/setting.go

@@ -27,6 +27,15 @@ func (b *BaseApi) GetSettingInfo(c *gin.Context) {
 	helper.SuccessWithData(c, setting)
 }
 
+func (b *BaseApi) GetTerminalAISettingInfo(c *gin.Context) {
+	setting, err := settingService.GetTerminalAIInfo()
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, setting)
+}
+
 // @Tags System Setting
 // @Summary Load system available status
 // @Success 200
@@ -59,6 +68,40 @@ func (b *BaseApi) UpdateSetting(c *gin.Context) {
 	helper.Success(c)
 }
 
+func (b *BaseApi) UpdateTerminalAISetting(c *gin.Context) {
+	var req dto.TerminalAIInfo
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+
+	if err := settingService.UpdateTerminalAI(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+func (b *BaseApi) GetFileManageAISettingInfo(c *gin.Context) {
+	setting, err := settingService.GetFileManageAIInfo()
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, setting)
+}
+
+func (b *BaseApi) UpdateFileManageAISetting(c *gin.Context) {
+	var req dto.FileManageAIInfo
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := settingService.UpdateFileManageAI(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags System Setting
 // @Summary Load local backup dir
 // @Success 200 {string} path

agent/app/api/v2/ssh.go

@@ -249,14 +249,14 @@ func (b *BaseApi) LoadSSHFile(c *gin.Context) {
 // @Tags SSH
 // @Summary Update host SSH setting by file
 // @Accept json
-// @Param request body dto.SSHConf true "request"
+// @Param request body dto.SSHConfUpdate true "request"
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /hosts/ssh/file/update [post]
 // @x-panel-log {"bodyKeys":["key"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"修改 SSH 配置文件 [key]","formatEN":"update SSH conf [key]"}
 func (b *BaseApi) UpdateSSHByFile(c *gin.Context) {
-	var req dto.SettingUpdate
+	var req dto.SSHConfUpdate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}

agent/app/api/v2/task.go

@@ -32,7 +32,7 @@ func (b *BaseApi) PageTasks(c *gin.Context) {
 
 // @Tags TaskLog
 // @Summary Get the number of executing tasks
-// @Success 200 {object} int64
+// @Success 200 {integer} int64
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /logs/tasks/executing/count [get]

agent/app/api/v2/terminal.go

@@ -9,8 +9,10 @@ import (
 	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/service"
 	"github.com/1Panel-dev/1Panel/agent/global"
 	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
+	"github.com/1Panel-dev/1Panel/agent/utils/ssh"
 	"github.com/1Panel-dev/1Panel/agent/utils/terminal"
 	"github.com/gin-gonic/gin"
 	"github.com/gorilla/websocket"
@@ -40,9 +42,33 @@ func (b *BaseApi) WsSSH(c *gin.Context) {
 		return
 	}
 
-	client, err := loadLocalConn()
-	if wshandleError(wsConn, errors.WithMessage(err, "failed to set up the connection. Please check the host information")) {
-		return
+	hostID, _ := strconv.Atoi(c.DefaultQuery("id", "0"))
+	var client *ssh.SSHClient
+	if hostID > 0 {
+		host, err := service.GetHostInfo(uint(hostID))
+		if wshandleError(wsConn, errors.WithMessage(err, "load host info by id failed")) {
+			return
+		}
+		connInfo := ssh.ConnInfo{
+			Addr:       host.Addr,
+			Port:       int(host.Port),
+			User:       host.User,
+			AuthMode:   host.AuthMode,
+			Password:   host.Password,
+			PrivateKey: []byte(host.PrivateKey),
+		}
+		if len(host.PassPhrase) != 0 {
+			connInfo.PassPhrase = []byte(host.PassPhrase)
+		}
+		client, err = ssh.NewClient(connInfo)
+		if wshandleError(wsConn, errors.WithMessage(err, "failed to set up the connection. Please check the host information")) {
+			return
+		}
+	} else {
+		client, err = loadLocalConn()
+		if wshandleError(wsConn, errors.WithMessage(err, "failed to set up the connection. Please check the host information")) {
+			return
+		}
 	}
 	defer client.Close()
 	command := c.DefaultQuery("command", "")

agent/app/api/v2/website.go

@@ -506,7 +506,7 @@ func (b *BaseApi) GetProxyConfig(c *gin.Context) {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /websites/proxies/update [post]
-// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"id","isList":false,"db":"websites","output_column":"primary_domain","output_value":"domain"}],"formatZH":"修改网站 [domain] 反向代理配置 ","formatEN":"Update domain [domain] proxy config"}
+// @x-panel-log {"bodyKeys":["id","name","operate"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"id","isList":false,"db":"websites","output_column":"primary_domain","output_value":"domain"}],"formatZH":"修改 [operate] 网站 [domain] 反向代理配置 [name] ","formatEN":"Update [operate] domain [domain] proxy config [name]"}
 func (b *BaseApi) UpdateProxyConfig(c *gin.Context) {
 	var req request.WebsiteProxyConfig
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
@@ -520,6 +520,50 @@ func (b *BaseApi) UpdateProxyConfig(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags Website
+// @Summary Delete proxy config
+// @Accept json
+// @Param request body request.WebsiteProxyDel true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/proxies/delete [post]
+// @x-panel-log {"bodyKeys":["id","name"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"id","isList":false,"db":"websites","output_column":"primary_domain","output_value":"domain"}],"formatZH":"删除网站 [domain] 反向代理配置 [name] ","formatEN":"Delete domain [domain] proxy config [name]"}
+func (b *BaseApi) DeleteProxyConfig(c *gin.Context) {
+	var req request.WebsiteProxyDel
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	err := websiteService.DeleteProxy(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Website
+// @Summary Update proxy config status
+// @Accept json
+// @Param request body request.WebsiteProxyStatusUpdate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/proxies/status [post]
+// @x-panel-log {"bodyKeys":["id","name","status"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"id","isList":false,"db":"websites","output_column":"primary_domain","output_value":"domain"}],"formatZH":"修改网站 [domain] 反向代理配置 [name] 状态 [status] ","formatEN":"Update domain [domain] proxy config [name] status [status]"}
+func (b *BaseApi) UpdateProxyConfigStatus(c *gin.Context) {
+	var req request.WebsiteProxyStatusUpdate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	err := websiteService.UpdateProxyStatus(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags Website
 // @Summary Update proxy file
 // @Accept json
@@ -528,7 +572,7 @@ func (b *BaseApi) UpdateProxyConfig(c *gin.Context) {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /websites/proxies/file [post]
-// @x-panel-log {"bodyKeys":["websiteID"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"websiteID","isList":false,"db":"websites","output_column":"primary_domain","output_value":"domain"}],"formatZH":"更新反向代理文件 [domain]","formatEN":"Nginx conf proxy file update [domain]"}
+// @x-panel-log {"bodyKeys":["websiteID","name"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"websiteID","isList":false,"db":"websites","output_column":"primary_domain","output_value":"domain"}],"formatZH":"修改网站 [domain] 反向代理配置文件 [name] ","formatEN":"Update domain [domain] proxy config file [name]"}
 func (b *BaseApi) UpdateProxyConfigFile(c *gin.Context) {
 	var req request.NginxProxyUpdate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {

agent/app/dto/agents.go

@@ -3,51 +3,59 @@ package dto
 import "time"
 
 type AgentCreateReq struct {
-	Name          string  `json:"name" validate:"required"`
-	AppVersion    string  `json:"appVersion" validate:"required"`
-	WebUIPort     int     `json:"webUIPort" validate:"required"`
-	BridgePort    int     `json:"bridgePort" validate:"required"`
-	Provider      string  `json:"provider" validate:"required"`
-	Model         string  `json:"model" validate:"required"`
-	AccountID     uint    `json:"accountId"`
-	APIKey        string  `json:"apiKey"`
-	BaseURL       string  `json:"baseURL"`
-	Token         string  `json:"token"`
-	TaskID        string  `json:"taskID"`
-	Advanced      bool    `json:"advanced"`
-	ContainerName string  `json:"containerName"`
-	AllowPort     bool    `json:"allowPort"`
-	SpecifyIP     string  `json:"specifyIP"`
-	RestartPolicy string  `json:"restartPolicy"`
-	CpuQuota      float64 `json:"cpuQuota"`
-	MemoryLimit   float64 `json:"memoryLimit"`
-	MemoryUnit    string  `json:"memoryUnit"`
-	PullImage     bool    `json:"pullImage"`
-	EditCompose   bool    `json:"editCompose"`
-	DockerCompose string  `json:"dockerCompose"`
+	Name           string   `json:"name" validate:"required"`
+	Remark         string   `json:"remark"`
+	AppVersion     string   `json:"appVersion" validate:"required"`
+	WebUIPort      int      `json:"webUIPort" validate:"required"`
+	BridgePort     int      `json:"bridgePort"`
+	AllowedOrigins []string `json:"allowedOrigins"`
+	AgentType      string   `json:"agentType" validate:"required,oneof=openclaw copaw"`
+	Model          string   `json:"model"`
+	AccountID      uint     `json:"accountId"`
+	Token          string   `json:"token"`
+	TaskID         string   `json:"taskID"`
+	Advanced       bool     `json:"advanced"`
+	ContainerName  string   `json:"containerName"`
+	AllowPort      bool     `json:"allowPort"`
+	SpecifyIP      string   `json:"specifyIP"`
+	RestartPolicy  string   `json:"restartPolicy"`
+	CpuQuota       float64  `json:"cpuQuota"`
+	MemoryLimit    float64  `json:"memoryLimit"`
+	MemoryUnit     string   `json:"memoryUnit"`
+	PullImage      bool     `json:"pullImage"`
+	EditCompose    bool     `json:"editCompose"`
+	DockerCompose  string   `json:"dockerCompose"`
 }
 
 type AgentItem struct {
-	ID           uint      `json:"id"`
-	Name         string    `json:"name"`
-	Provider     string    `json:"provider"`
-	ProviderName string    `json:"providerName"`
-	Model        string    `json:"model"`
-	BaseURL      string    `json:"baseUrl"`
-	APIKey       string    `json:"apiKey"`
-	Token        string    `json:"token"`
-	Status       string    `json:"status"`
-	Message      string    `json:"message"`
-	AppInstallID uint      `json:"appInstallId"`
-	AccountID    uint      `json:"accountId"`
-	AppVersion   string    `json:"appVersion"`
-	Container    string    `json:"containerName"`
-	WebUIPort    int       `json:"webUIPort"`
-	BridgePort   int       `json:"bridgePort"`
-	Path         string    `json:"path"`
-	ConfigPath   string    `json:"configPath"`
-	Upgradable   bool      `json:"upgradable"`
-	CreatedAt    time.Time `json:"createdAt"`
+	ID                   uint      `json:"id"`
+	Name                 string    `json:"name"`
+	Remark               string    `json:"remark"`
+	AgentType            string    `json:"agentType"`
+	Provider             string    `json:"provider"`
+	ProviderName         string    `json:"providerName"`
+	Model                string    `json:"model"`
+	APIType              string    `json:"apiType"`
+	MaxTokens            int       `json:"maxTokens"`
+	ContextWindow        int       `json:"contextWindow"`
+	BaseURL              string    `json:"baseUrl"`
+	APIKey               string    `json:"apiKey"`
+	Token                string    `json:"token"`
+	Status               string    `json:"status"`
+	Message              string    `json:"message"`
+	AppInstallID         uint      `json:"appInstallId"`
+	WebsiteID            uint      `json:"websiteId"`
+	WebsitePrimaryDomain string    `json:"websitePrimaryDomain"`
+	WebsiteProtocol      string    `json:"websiteProtocol"`
+	AccountID            uint      `json:"accountId"`
+	AppVersion           string    `json:"appVersion"`
+	Container            string    `json:"containerName"`
+	WebUIPort            int       `json:"webUIPort"`
+	BridgePort           int       `json:"bridgePort"`
+	Path                 string    `json:"path"`
+	ConfigPath           string    `json:"configPath"`
+	Upgradable           bool      `json:"upgradable"`
+	CreatedAt            time.Time `json:"createdAt"`
 }
 
 type AgentDeleteReq struct {
@@ -60,27 +68,173 @@ type AgentTokenResetReq struct {
 	ID uint `json:"id" validate:"required"`
 }
 
+type AgentRemarkUpdateReq struct {
+	ID     uint   `json:"id" validate:"required"`
+	Remark string `json:"remark"`
+}
+
+type AgentWebsiteBindReq struct {
+	AgentID   uint `json:"agentId" validate:"required"`
+	WebsiteID uint `json:"websiteId" validate:"required"`
+}
+
 type AgentModelConfigUpdateReq struct {
+	AgentID   uint     `json:"agentId" validate:"required"`
+	AccountID uint     `json:"accountId" validate:"required"`
+	Model     string   `json:"model" validate:"required"`
+	Fallbacks []string `json:"fallbacks"`
+}
+
+type AgentModelConfig struct {
+	AccountID uint     `json:"accountId"`
+	Model     string   `json:"model"`
+	Fallbacks []string `json:"fallbacks"`
+}
+
+type AgentOverviewReq struct {
+	AgentID uint `json:"agentId" validate:"required"`
+}
+
+type AgentIDReq struct {
+	AgentID uint `json:"agentId" validate:"required"`
+}
+
+type AgentOverview struct {
+	Snapshot AgentOverviewSnapshot `json:"snapshot"`
+}
+
+type AgentRoleBinding struct {
+	Channel   string `json:"channel" validate:"required"`
+	AccountID string `json:"accountId"`
+}
+
+type AgentRoleCreateReq struct {
+	AgentID  uint               `json:"agentId" validate:"required"`
+	Name     string             `json:"name" validate:"required"`
+	Model    string             `json:"model"`
+	Bindings []AgentRoleBinding `json:"bindings"`
+}
+
+type AgentRoleCreateResp struct {
+	Output string `json:"output"`
+}
+
+type AgentRoleDeleteReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	ID      string `json:"id" validate:"required"`
+}
+
+type AgentRoleBindReq struct {
 	AgentID   uint   `json:"agentId" validate:"required"`
-	AccountID uint   `json:"accountId" validate:"required"`
-	Model     string `json:"model" validate:"required"`
+	ID        string `json:"id" validate:"required"`
+	Channel   string `json:"channel" validate:"required"`
+	AccountID string `json:"accountId"`
+}
+
+type AgentConfiguredAgentsReq struct {
+	AgentID uint `json:"agentId" validate:"required"`
+}
+
+type AgentRoleChannelsReq struct {
+	AgentID uint `json:"agentId" validate:"required"`
+}
+
+type AgentRoleChannelItem struct {
+	Name       string   `json:"name"`
+	Bound      bool     `json:"bound"`
+	AccountIDs []string `json:"accountIds"`
+}
+
+type AgentRoleMarkdownFilesReq struct {
+	AgentID   uint   `json:"agentId" validate:"required"`
+	Workspace string `json:"workspace" validate:"required"`
+}
+
+type AgentConfiguredAgentItem struct {
+	ID        string             `json:"id"`
+	Name      string             `json:"name"`
+	Workspace string             `json:"workspace"`
+	Model     string             `json:"model"`
+	AgentDir  string             `json:"agentDir"`
+	Bindings  []AgentRoleBinding `json:"bindings"`
+}
+
+type AgentRoleMarkdownFileItem struct {
+	Name    string `json:"name"`
+	Content string `json:"content"`
+}
+
+type AgentRoleMarkdownFileUpdateItem struct {
+	Name    string `json:"name" validate:"required,oneof=AGENTS.md SOUL.md USER.md IDENTITY.md TOOLS.md HEARTBEAT.md BOOT.md BOOTSTRAP.md"`
+	Content string `json:"content"`
+}
+
+type AgentRoleMarkdownFilesUpdateReq struct {
+	AgentID   uint                              `json:"agentId" validate:"required"`
+	Workspace string                            `json:"workspace" validate:"required"`
+	Restart   bool                              `json:"restart"`
+	Files     []AgentRoleMarkdownFileUpdateItem `json:"files" validate:"required"`
+}
+
+type AgentOverviewSnapshot struct {
+	ContainerStatus string `json:"containerStatus"`
+	AppVersion      string `json:"appVersion"`
+	DefaultModel    string `json:"defaultModel"`
+	ChannelCount    int    `json:"channelCount"`
+	SkillCount      int    `json:"skillCount"`
+	JobCount        int    `json:"jobCount"`
+	SessionCount    int    `json:"sessionCount"`
+}
+
+type AgentAccountModel struct {
+	RecordID      uint     `json:"recordId"`
+	ID            string   `json:"id"`
+	Name          string   `json:"name"`
+	ContextWindow int      `json:"contextWindow"`
+	MaxTokens     int      `json:"maxTokens"`
+	Reasoning     bool     `json:"reasoning"`
+	Input         []string `json:"input"`
+}
+
+type AgentAccountModelReq struct {
+	AccountID uint `json:"accountId" validate:"required"`
+}
+
+type AgentAccountModelCreateReq struct {
+	AccountID uint              `json:"accountId" validate:"required"`
+	Model     AgentAccountModel `json:"model" validate:"required"`
+}
+
+type AgentAccountModelUpdateReq struct {
+	AccountID uint              `json:"accountId" validate:"required"`
+	Model     AgentAccountModel `json:"model" validate:"required"`
+}
+
+type AgentAccountModelDeleteReq struct {
+	AccountID uint `json:"accountId" validate:"required"`
+	RecordID  uint `json:"recordId" validate:"required"`
 }
 
 type AgentAccountCreateReq struct {
-	Provider string `json:"provider" validate:"required"`
-	Name     string `json:"name" validate:"required"`
-	APIKey   string `json:"apiKey" validate:"required"`
-	BaseURL  string `json:"baseURL"`
-	Remark   string `json:"remark"`
+	Provider       string              `json:"provider" validate:"required"`
+	Name           string              `json:"name" validate:"required"`
+	APIKey         string              `json:"apiKey" validate:"required"`
+	RememberAPIKey bool                `json:"rememberApiKey"`
+	BaseURL        string              `json:"baseURL"`
+	Models         []AgentAccountModel `json:"models"`
+	APIType        string              `json:"apiType" validate:"required"`
+	Remark         string              `json:"remark"`
 }
 
 type AgentAccountUpdateReq struct {
-	ID         uint   `json:"id" validate:"required"`
-	Name       string `json:"name" validate:"required"`
-	APIKey     string `json:"apiKey" validate:"required"`
-	BaseURL    string `json:"baseURL"`
-	Remark     string `json:"remark"`
-	SyncAgents bool   `json:"syncAgents"`
+	ID             uint   `json:"id" validate:"required"`
+	Name           string `json:"name" validate:"required"`
+	APIKey         string `json:"apiKey" validate:"required"`
+	RememberAPIKey bool   `json:"rememberApiKey"`
+	BaseURL        string `json:"baseURL"`
+	APIType        string `json:"apiType" validate:"required"`
+	Remark         string `json:"remark"`
+	SyncAgents     bool   `json:"syncAgents"`
 }
 
 type AgentAccountVerifyReq struct {
@@ -100,20 +254,27 @@ type AgentAccountSearch struct {
 }
 
 type AgentAccountInfo struct {
-	ID           uint      `json:"id"`
-	Provider     string    `json:"provider"`
-	ProviderName string    `json:"providerName"`
-	Name         string    `json:"name"`
-	APIKey       string    `json:"apiKey"`
-	BaseURL      string    `json:"baseUrl"`
-	Verified     bool      `json:"verified"`
-	Remark       string    `json:"remark"`
-	CreatedAt    time.Time `json:"createdAt"`
+	ID             uint                `json:"id"`
+	Provider       string              `json:"provider"`
+	ProviderName   string              `json:"providerName"`
+	Name           string              `json:"name"`
+	APIKey         string              `json:"apiKey"`
+	RememberAPIKey bool                `json:"rememberApiKey"`
+	BaseURL        string              `json:"baseUrl"`
+	Models         []AgentAccountModel `json:"models"`
+	APIType        string              `json:"apiType"`
+	Verified       bool                `json:"verified"`
+	Remark         string              `json:"remark"`
+	CreatedAt      time.Time           `json:"createdAt"`
 }
 
 type ProviderModelInfo struct {
-	ID   string `json:"id"`
-	Name string `json:"name"`
+	ID            string   `json:"id"`
+	Name          string   `json:"name"`
+	ContextWindow int      `json:"contextWindow"`
+	MaxTokens     int      `json:"maxTokens"`
+	Reasoning     bool     `json:"reasoning"`
+	Input         []string `json:"input"`
 }
 
 type ProviderInfo struct {
@@ -129,12 +290,15 @@ type AgentFeishuConfigReq struct {
 }
 
 type AgentFeishuConfigUpdateReq struct {
-	AgentID   uint   `json:"agentId" validate:"required"`
-	BotName   string `json:"botName" validate:"required"`
-	AppID     string `json:"appId" validate:"required"`
-	AppSecret string `json:"appSecret" validate:"required"`
-	Enabled   bool   `json:"enabled"`
-	DmPolicy  string `json:"dmPolicy" validate:"required"`
+	AgentID        uint             `json:"agentId" validate:"required"`
+	Enabled        bool             `json:"enabled"`
+	ThreadSession  bool             `json:"threadSession"`
+	ReplyMode      string           `json:"replyMode" validate:"required"`
+	Streaming      bool             `json:"streaming"`
+	RequireMention string           `json:"requireMention" validate:"required,oneof=true false open"`
+	GroupPolicy    string           `json:"groupPolicy" validate:"required,oneof=open allowlist disabled"`
+	GroupAllowFrom []string         `json:"groupAllowFrom"`
+	Bots           []AgentFeishuBot `json:"bots" validate:"required,min=1"`
 }
 
 type AgentFeishuPairingApproveReq struct {
@@ -143,9 +307,286 @@ type AgentFeishuPairingApproveReq struct {
 }
 
 type AgentFeishuConfig struct {
+	Enabled        bool             `json:"enabled"`
+	ThreadSession  bool             `json:"threadSession"`
+	ReplyMode      string           `json:"replyMode"`
+	Streaming      bool             `json:"streaming"`
+	RequireMention string           `json:"requireMention"`
+	GroupPolicy    string           `json:"groupPolicy"`
+	GroupAllowFrom []string         `json:"groupAllowFrom"`
+	Bots           []AgentFeishuBot `json:"bots"`
+	Installed      bool             `json:"installed"`
+}
+
+type AgentTelegramConfigReq struct {
+	AgentID uint `json:"agentId" validate:"required"`
+}
+
+type AgentTelegramConfigUpdateReq struct {
+	AgentID        uint               `json:"agentId" validate:"required"`
+	Enabled        bool               `json:"enabled"`
+	DmPolicy       string             `json:"dmPolicy" validate:"required,oneof=pairing open allowlist disabled"`
+	AllowFrom      []string           `json:"allowFrom"`
+	GroupPolicy    string             `json:"groupPolicy" validate:"required,oneof=open allowlist disabled"`
+	GroupAllowFrom []string           `json:"groupAllowFrom"`
+	Proxy          string             `json:"proxy"`
+	Streaming      string             `json:"streaming" validate:"required,oneof=off partial block progress"`
+	DefaultAccount string             `json:"defaultAccount" validate:"required"`
+	Bots           []AgentTelegramBot `json:"bots" validate:"required,min=1"`
+}
+
+type AgentTelegramConfig struct {
+	Enabled        bool               `json:"enabled"`
+	DmPolicy       string             `json:"dmPolicy"`
+	AllowFrom      []string           `json:"allowFrom"`
+	GroupPolicy    string             `json:"groupPolicy"`
+	GroupAllowFrom []string           `json:"groupAllowFrom"`
+	Proxy          string             `json:"proxy"`
+	Streaming      string             `json:"streaming"`
+	DefaultAccount string             `json:"defaultAccount"`
+	Bots           []AgentTelegramBot `json:"bots"`
+}
+
+type AgentChannelPairingApproveReq struct {
+	AgentID     uint   `json:"agentId" validate:"required"`
+	Type        string `json:"type" validate:"required,oneof=feishu telegram discord wecom"`
+	PairingCode string `json:"pairingCode" validate:"required"`
+	AccountID   string `json:"accountId"`
+}
+
+type AgentWecomConfigUpdateReq struct {
+	AgentID        uint     `json:"agentId" validate:"required"`
+	Enabled        bool     `json:"enabled"`
+	DmPolicy       string   `json:"dmPolicy" validate:"required,oneof=pairing open allowlist disabled"`
+	AllowFrom      []string `json:"allowFrom"`
+	GroupPolicy    string   `json:"groupPolicy" validate:"required,oneof=open allowlist disabled"`
+	GroupAllowFrom []string `json:"groupAllowFrom"`
+	BotID          string   `json:"botId" validate:"required"`
+	Secret         string   `json:"secret" validate:"required"`
+}
+
+type AgentWecomConfig struct {
+	Enabled        bool     `json:"enabled"`
+	DmPolicy       string   `json:"dmPolicy"`
+	AllowFrom      []string `json:"allowFrom"`
+	GroupPolicy    string   `json:"groupPolicy"`
+	GroupAllowFrom []string `json:"groupAllowFrom"`
+	BotID          string   `json:"botId"`
+	Secret         string   `json:"secret"`
+	Installed      bool     `json:"installed"`
+}
+
+type AgentDingTalkConfigUpdateReq struct {
+	AgentID                         uint               `json:"agentId" validate:"required"`
+	Enabled                         bool               `json:"enabled"`
+	DmPolicy                        string             `json:"dmPolicy" validate:"required,oneof=allowlist open disabled"`
+	AllowFrom                       []string           `json:"allowFrom"`
+	GroupPolicy                     string             `json:"groupPolicy" validate:"required,oneof=open allowlist disabled"`
+	GroupAllowFrom                  []string           `json:"groupAllowFrom"`
+	SeparateSessionByConversation   bool               `json:"separateSessionByConversation"`
+	GroupSessionScope               string             `json:"groupSessionScope" validate:"required,oneof=group group_sender"`
+	SharedMemoryAcrossConversations bool               `json:"sharedMemoryAcrossConversations"`
+	AsyncMode                       bool               `json:"asyncMode"`
+	AckText                         string             `json:"ackText"`
+	Bots                            []AgentDingTalkBot `json:"bots" validate:"required,min=1"`
+}
+
+type AgentDingTalkConfig struct {
+	Enabled                         bool               `json:"enabled"`
+	DmPolicy                        string             `json:"dmPolicy"`
+	AllowFrom                       []string           `json:"allowFrom"`
+	GroupPolicy                     string             `json:"groupPolicy"`
+	GroupAllowFrom                  []string           `json:"groupAllowFrom"`
+	SeparateSessionByConversation   bool               `json:"separateSessionByConversation"`
+	GroupSessionScope               string             `json:"groupSessionScope"`
+	SharedMemoryAcrossConversations bool               `json:"sharedMemoryAcrossConversations"`
+	AsyncMode                       bool               `json:"asyncMode"`
+	AckText                         string             `json:"ackText"`
+	Bots                            []AgentDingTalkBot `json:"bots"`
+	Installed                       bool               `json:"installed"`
+}
+
+type AgentWeixinLoginReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	TaskID  string `json:"taskID" validate:"required"`
+}
+
+type AgentQQBotConfigUpdateReq struct {
+	AgentID uint            `json:"agentId" validate:"required"`
+	Enabled bool            `json:"enabled"`
+	Bots    []AgentQQBotBot `json:"bots" validate:"required,min=1"`
+}
+
+type AgentQQBotConfig struct {
+	Enabled   bool            `json:"enabled"`
+	Bots      []AgentQQBotBot `json:"bots"`
+	Installed bool            `json:"installed"`
+}
+
+type AgentPluginInstallReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	Type    string `json:"type" validate:"required,oneof=feishu qqbot wecom dingtalk weixin"`
+	TaskID  string `json:"taskID" validate:"required"`
+}
+
+type AgentPluginUpgradeReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	Type    string `json:"type" validate:"required,oneof=feishu qqbot wecom dingtalk weixin"`
+	TaskID  string `json:"taskID" validate:"required"`
+}
+
+type AgentPluginUninstallReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	Type    string `json:"type" validate:"required,oneof=feishu qqbot wecom dingtalk weixin"`
+	TaskID  string `json:"taskID" validate:"required"`
+}
+
+type AgentPluginCheckReq struct {
+	AgentID     uint   `json:"agentId" validate:"required"`
+	Type        string `json:"type" validate:"required,oneof=feishu qqbot wecom dingtalk weixin"`
+	CheckLatest bool   `json:"checkLatest"`
+}
+
+type AgentPluginStatus struct {
+	Installed      bool   `json:"installed"`
+	CurrentVersion string `json:"currentVersion"`
+	LatestVersion  string `json:"latestVersion"`
+	Upgradable     bool   `json:"upgradable"`
+}
+
+type AgentDiscordConfigUpdateReq struct {
+	AgentID        uint              `json:"agentId" validate:"required"`
+	Enabled        bool              `json:"enabled"`
+	DmPolicy       string            `json:"dmPolicy" validate:"required"`
+	GroupPolicy    string            `json:"groupPolicy" validate:"required,oneof=open allowlist disabled"`
+	Proxy          string            `json:"proxy"`
+	DefaultAccount string            `json:"defaultAccount" validate:"required"`
+	Bots           []AgentDiscordBot `json:"bots" validate:"required,min=1"`
+}
+
+type AgentDiscordConfig struct {
+	Enabled        bool              `json:"enabled"`
+	DmPolicy       string            `json:"dmPolicy"`
+	GroupPolicy    string            `json:"groupPolicy"`
+	Proxy          string            `json:"proxy"`
+	DefaultAccount string            `json:"defaultAccount"`
+	Bots           []AgentDiscordBot `json:"bots"`
+}
+
+type AgentChannelBotBase struct {
+	AccountID string `json:"accountId"`
+	Name      string `json:"name"`
 	Enabled   bool   `json:"enabled"`
-	DmPolicy  string `json:"dmPolicy"`
-	BotName   string `json:"botName"`
-	AppID     string `json:"appId"`
-	AppSecret string `json:"appSecret"`
+	IsDefault bool   `json:"isDefault"`
+}
+
+func (b AgentChannelBotBase) IsEnabled() bool {
+	return b.Enabled
+}
+
+type AgentFeishuBot struct {
+	AgentChannelBotBase
+	AppID     string   `json:"appId"`
+	AppSecret string   `json:"appSecret"`
+	DmPolicy  string   `json:"dmPolicy"`
+	AllowFrom []string `json:"allowFrom"`
+}
+
+type AgentTelegramBot struct {
+	AgentChannelBotBase
+	BotToken    string `json:"botToken"`
+	DmPolicy    string `json:"dmPolicy"`
+	GroupPolicy string `json:"groupPolicy"`
+	Streaming   string `json:"streaming"`
+}
+
+type AgentDiscordBot struct {
+	AgentChannelBotBase
+	Token string `json:"token"`
+}
+
+type AgentQQBotBot struct {
+	AgentChannelBotBase
+	AppID        string   `json:"appId"`
+	ClientSecret string   `json:"clientSecret"`
+	AllowFrom    []string `json:"allowFrom"`
+	SystemPrompt string   `json:"systemPrompt"`
+}
+
+type AgentDingTalkBot struct {
+	AgentChannelBotBase
+	ClientID     string `json:"clientId"`
+	ClientSecret string `json:"clientSecret"`
+}
+
+type AgentSecurityConfigUpdateReq struct {
+	AgentID        uint     `json:"agentId" validate:"required"`
+	AllowedOrigins []string `json:"allowedOrigins"`
+}
+
+type AgentSecurityConfig struct {
+	AllowedOrigins []string `json:"allowedOrigins"`
+}
+
+type AgentOtherConfigUpdateReq struct {
+	AgentID        uint   `json:"agentId" validate:"required"`
+	UserTimezone   string `json:"userTimezone" validate:"required"`
+	BrowserEnabled bool   `json:"browserEnabled"`
+	NPMRegistry    string `json:"npmRegistry" validate:"required"`
+}
+
+type AgentOtherConfig struct {
+	UserTimezone   string `json:"userTimezone"`
+	BrowserEnabled bool   `json:"browserEnabled"`
+	NPMRegistry    string `json:"npmRegistry"`
+}
+
+type AgentConfigFileReq struct {
+	AgentID uint `json:"agentId" validate:"required"`
+}
+
+type AgentConfigFileUpdateReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	Content string `json:"content" validate:"required"`
+}
+
+type AgentConfigFile struct {
+	Content string `json:"content"`
+}
+
+type AgentSkillSearchReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	Source  string `json:"source" validate:"required,oneof=clawhub-global clawhub-cn skillhub"`
+	Keyword string `json:"keyword" validate:"required"`
+}
+
+type AgentSkillItem struct {
+	Name        string `json:"name"`
+	Description string `json:"description"`
+	Source      string `json:"source"`
+	Bundled     bool   `json:"bundled"`
+	Disabled    bool   `json:"disabled"`
+}
+
+type AgentSkillSearchItem struct {
+	Slug        string `json:"slug"`
+	Name        string `json:"name"`
+	Description string `json:"description"`
+	Summary     string `json:"summary"`
+	Version     string `json:"version"`
+	Source      string `json:"source"`
+	Score       string `json:"score"`
+}
+
+type AgentSkillUpdateReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	Name    string `json:"name" validate:"required"`
+	Enabled bool   `json:"enabled"`
+}
+
+type AgentSkillInstallReq struct {
+	AgentID uint   `json:"agentId" validate:"required"`
+	Source  string `json:"source" validate:"required,oneof=clawhub-global clawhub-cn skillhub"`
+	Slug    string `json:"slug" validate:"required"`
+	TaskID  string `json:"taskID" validate:"required"`
 }

agent/app/dto/backup.go

@@ -65,10 +65,11 @@ type UploadForRecover struct {
 }
 
 type CommonBackup struct {
-	Type       string   `json:"type" validate:"required,oneof=app mysql mariadb redis website postgresql mysql-cluster postgresql-cluster redis-cluster"`
+	Type       string   `json:"type" validate:"required,oneof=app mysql mariadb redis website postgresql mysql-cluster postgresql-cluster redis-cluster container compose"`
 	Name       string   `json:"name"`
 	DetailName string   `json:"detailName"`
 	Secret     string   `json:"secret"`
+	StopBefore bool     `json:"stopBefore"`
 	TaskID     string   `json:"taskID"`
 	FileName   string   `json:"fileName"`
 	Args       []string `json:"args"`
@@ -77,7 +78,7 @@ type CommonBackup struct {
 }
 type CommonRecover struct {
 	DownloadAccountID uint   `json:"downloadAccountID" validate:"required"`
-	Type              string `json:"type" validate:"required,oneof=app mysql mariadb redis website postgresql mysql-cluster postgresql-cluster redis-cluster"`
+	Type              string `json:"type" validate:"required,oneof=app mysql mariadb redis website postgresql mysql-cluster postgresql-cluster redis-cluster container compose"`
 	Name              string `json:"name"`
 	DetailName        string `json:"detailName"`
 	File              string `json:"file"`

agent/app/dto/common_req.go

@@ -11,6 +11,12 @@ type SearchPageWithType struct {
 	Type string `json:"type"`
 }
 
+type SearchPageWithGroup struct {
+	PageInfo
+	GroupID uint   `json:"groupID"`
+	Info    string `json:"info"`
+}
+
 type PageInfo struct {
 	Page     int `json:"page" validate:"required,number"`
 	PageSize int `json:"pageSize" validate:"required,number"`

agent/app/dto/container.go

@@ -48,6 +48,34 @@ type ContainerOptions struct {
 	State string `json:"state"`
 }
 
+type ContainerFileReq struct {
+	ContainerID string `json:"containerID" validate:"required"`
+	Path        string `json:"path" validate:"required"`
+}
+
+type ContainerFileBatchDeleteReq struct {
+	ContainerID string   `json:"containerID" validate:"required"`
+	Paths       []string `json:"paths" validate:"required,min=1,dive,required"`
+}
+
+type ContainerFileInfo struct {
+	Name    string `json:"name"`
+	Path    string `json:"path"`
+	IsDir   bool   `json:"isDir"`
+	IsLink  bool   `json:"isLink"`
+	LinkTo  string `json:"linkTo"`
+	Size    int64  `json:"size"`
+	Mode    string `json:"mode"`
+	ModTime string `json:"modTime"`
+}
+
+type ContainerFileContent struct {
+	Content   string `json:"content"`
+	Size      int64  `json:"size"`
+	Truncated bool   `json:"truncated"`
+	IsBinary  bool   `json:"isBinary"`
+}
+
 type ContainerStatus struct {
 	Created    int `json:"created"`
 	Running    int `json:"running"`
@@ -95,10 +123,16 @@ type ContainerOperate struct {
 	Privileged      bool           `json:"privileged"`
 	AutoRemove      bool           `json:"autoRemove"`
 	Volumes         []VolumeHelper `json:"volumes"`
+	ExtraHosts      []ExtraHost    `json:"extraHosts"`
 	Labels          []string       `json:"labels"`
 	Env             []string       `json:"env"`
 	RestartPolicy   string         `json:"restartPolicy"`
 }
+
+type ExtraHost struct {
+	Hostname string `json:"hostname"`
+	IP       string `json:"ip"`
+}
 type ContainerNetwork struct {
 	Network string `json:"network"`
 	Ipv4    string `json:"ipv4"`
@@ -253,16 +287,17 @@ type BatchDelete struct {
 }
 
 type ComposeInfo struct {
-	Name           string             `json:"name"`
-	CreatedAt      string             `json:"createdAt"`
-	CreatedBy      string             `json:"createdBy"`
-	ContainerCount int                `json:"containerCount"`
-	RunningCount   int                `json:"runningCount"`
-	ConfigFile     string             `json:"configFile"`
-	Workdir        string             `json:"workdir"`
-	Path           string             `json:"path"`
-	Containers     []ComposeContainer `json:"containers"`
-	Env            string             `json:"env"`
+	Name              string             `json:"name"`
+	CreatedAt         string             `json:"createdAt"`
+	CreatedBy         string             `json:"createdBy"`
+	ContainerCount    int                `json:"containerCount"`
+	RunningCount      int                `json:"runningCount"`
+	ConfigFile        string             `json:"configFile"`
+	Workdir           string             `json:"workdir"`
+	ComposeFileExists bool               `json:"composeFileExists"`
+	Path              string             `json:"path"`
+	Containers        []ComposeContainer `json:"containers"`
+	Env               string             `json:"env"`
 }
 type ComposeContainer struct {
 	ContainerID string   `json:"containerID"`

agent/app/dto/dashboard.go

@@ -4,6 +4,7 @@ import "time"
 
 type DashboardBase struct {
 	WebsiteNumber      int `json:"websiteNumber"`
+	AgentNumber        int `json:"agentNumber"`
 	DatabaseNumber     int `json:"databaseNumber"`
 	CronjobNumber      int `json:"cronjobNumber"`
 	AppInstalledNumber int `json:"appInstalledNumber"`

agent/app/dto/host.go

@@ -1,8 +1,6 @@
 package dto
 
-import (
-	"time"
-)
+import "time"
 
 type HostOperate struct {
 	ID               uint   `json:"id"`
@@ -34,11 +32,6 @@ type SearchForTree struct {
 	Info string `json:"info"`
 }
 
-type ChangeHostGroup struct {
-	ID      uint `json:"id" validate:"required"`
-	GroupID uint `json:"groupID" validate:"required"`
-}
-
 type HostInfo struct {
 	ID               uint      `json:"id"`
 	CreatedAt        time.Time `json:"createdAt"`

agent/app/dto/request/app.go

@@ -138,3 +138,12 @@ type AppUpdateVersion struct {
 	AppInstallID  uint   `json:"appInstallID" validate:"required"`
 	UpdateVersion string `json:"updateVersion"`
 }
+
+type AppInstallSortItem struct {
+	InstallID uint `json:"installID"`
+	SortOrder int  `json:"sortOrder"`
+}
+
+type AppInstallSort struct {
+	Items []AppInstallSortItem `json:"items" validate:"required"`
+}

agent/app/dto/request/file.go

@@ -9,6 +9,29 @@ type FileOption struct {
 	files.FileOption
 }
 
+type FileAISearch struct {
+	Path             string   `json:"path" validate:"required"`
+	Query            string   `json:"query" validate:"required"`
+	ResponseLanguage string   `json:"responseLanguage,omitempty"`
+	ContainSub       *bool    `json:"containSub,omitempty"`
+	MaxItems         int      `json:"maxItems" validate:"omitempty,min=1,max=2000"`
+	MatchCase        bool     `json:"matchCase"`
+	WholeWord        bool     `json:"wholeWord"`
+	UseRegex         bool     `json:"useRegex"`
+	Extensions       []string `json:"extensions,omitempty"`
+	MinSize          int64    `json:"minSize"`
+	MaxSize          int64    `json:"maxSize"`
+	ModifiedAfter    string   `json:"modifiedAfter,omitempty"`
+	ModifiedBefore   string   `json:"modifiedBefore,omitempty"`
+
+	MaxScanFiles              int   `json:"maxScanFiles"`
+	MaxFileBytes              int64 `json:"maxFileBytes"`
+	MaxHitsPerFile            int   `json:"maxHitsPerFile"`
+	MaxTotalHits              int   `json:"maxTotalHits"`
+	ContentHitsPromptMaxBytes int   `json:"contentHitsPromptMaxBytes"`
+	LlmMaxOutputTokens        int   `json:"llmMaxOutputTokens"`
+}
+
 type FileContentReq struct {
 	Path     string `json:"path" validate:"required"`
 	IsDetail bool   `json:"isDetail"`
@@ -172,3 +195,9 @@ type FileRemarkUpdate struct {
 	Path   string `json:"path" validate:"required"`
 	Remark string `json:"remark"`
 }
+
+type FileShareCreate struct {
+	Path          string  `json:"path" validate:"required"`
+	ExpireMinutes int     `json:"expireMinutes" validate:"min=0,max=10080"`
+	Password      *string `json:"password"`
+}

agent/app/dto/request/website.go

@@ -269,9 +269,21 @@ type WebsiteProxyConfig struct {
 	Replaces        map[string]string `json:"replaces"`
 	SNI             bool              `json:"sni"`
 	ProxySSLName    string            `json:"proxySSLName"`
+	SSLVerify       bool              `json:"sslVerify"`
 	CorsConfig
 }
 
+type WebsiteProxyDelete struct {
+	ID   uint   `json:"id" validate:"required"`
+	Name string `json:"name" validate:"required"`
+}
+
+type WebsiteProxyStatusUpdate struct {
+	ID     uint   `json:"id" validate:"required"`
+	Name   string `json:"name" validate:"required"`
+	Status string `json:"status" validate:"required"`
+}
+
 type CorsConfig struct {
 	Cors             bool   `json:"cors"`
 	AllowOrigins     string `json:"allowOrigins"`

agent/app/dto/request/website_ssl.go

@@ -6,8 +6,8 @@ type WebsiteSSLSearch struct {
 	dto.PageInfo
 	AcmeAccountID string `json:"acmeAccountID"`
 	Domain        string `json:"domain"`
-	OrderBy       string `json:"orderBy" validate:"required,oneof=expire_date"`
-	Order         string `json:"order" validate:"required,oneof=null ascending descending"`
+	OrderBy       string `json:"orderBy" validate:"omitempty,oneof=created_at expire_date"`
+	Order         string `json:"order" validate:"omitempty,oneof=null ascending descending"`
 }
 
 type WebsiteSSLListReq struct {
@@ -51,7 +51,6 @@ type WebsiteSSLApply struct {
 	ID           uint     `json:"ID" validate:"required"`
 	SkipDNSCheck bool     `json:"skipDNSCheck"`
 	Nameservers  []string `json:"nameservers"`
-	DisableLog   bool     `json:"disableLog"`
 }
 
 type WebsiteSSLObtain struct {

agent/app/dto/response/app.go

@@ -126,6 +126,7 @@ type AppInstallDTO struct {
 	WebUI         string    `json:"webUI"`
 	CreatedAt     time.Time `json:"createdAt"`
 	Favorite      bool      `json:"favorite"`
+	SortOrder     int       `json:"sortOrder"`
 	App           AppDetail `json:"app"`
 	Container     string    `json:"container"`
 	IsEdit        bool      `json:"isEdit"`

agent/app/dto/response/file.go

@@ -85,3 +85,41 @@ type FileConvertLog struct {
 type FileRemarksRes struct {
 	Remarks map[string]string `json:"remarks"`
 }
+
+type FileShareInfo struct {
+	Code        string `json:"code"`
+	Path        string `json:"path"`
+	FileName    string `json:"fileName"`
+	ExpiresAt   int64  `json:"expiresAt"`
+	Permanent   bool   `json:"permanent"`
+	HasPassword bool   `json:"hasPassword"`
+	Password    string `json:"password,omitempty"`
+}
+
+type FileSharePublicInfo struct {
+	FileName    string `json:"fileName"`
+	ExpiresAt   int64  `json:"expiresAt"`
+	Permanent   bool   `json:"permanent"`
+	HasPassword bool   `json:"hasPassword"`
+}
+
+type FileAIContentHit struct {
+	Path string `json:"path"`
+	Line int    `json:"line"`
+	Text string `json:"text"`
+}
+
+type FileAISearchResult struct {
+	Mode                 string             `json:"mode"`
+	Summary              string             `json:"summary"`
+	Hits                 []FileAIContentHit `json:"hits"`
+	ContentScannedFiles  int                `json:"contentScannedFiles"`
+	ContentHitsTruncated bool               `json:"contentHitsTruncated"`
+	Truncated            bool               `json:"truncated"`
+	PreFiltered          bool               `json:"preFiltered"`
+	ItemCount            int                `json:"itemCount"`
+	PromptTokens         int                `json:"promptTokens"`
+	CompletionTokens     int                `json:"completionTokens"`
+	TotalTokens          int                `json:"totalTokens"`
+	Duration             string             `json:"duration"`
+}

agent/app/dto/setting.go

@@ -55,6 +55,7 @@ type CleanTree struct {
 	Size        uint64 `json:"size"`
 	IsCheck     bool   `json:"isCheck"`
 	IsRecommend bool   `json:"isRecommend"`
+	CanDelete   bool   `json:"canDelete"`
 }
 
 type Clean struct {
@@ -87,6 +88,19 @@ type SystemProxy struct {
 	Password string `json:"password"`
 }
 
+type TerminalAIInfo struct {
+	AIStatus              string `json:"aiStatus"`
+	AIAccountID           string `json:"aiAccountId"`
+	AIPrefix              string `json:"aiPrefix" validate:"required,oneof=@ai #ai /ai"`
+	AIRiskCommands        string `json:"aiRiskCommands"`
+	AIRiskCommandsDefault string `json:"aiRiskCommandsDefault"`
+}
+
+type FileManageAIInfo struct {
+	AIStatus    string `json:"aiStatus"`
+	AIAccountID string `json:"aiAccountId"`
+}
+
 type CommonDescription struct {
 	ID          string `json:"id" validate:"required"`
 	Type        string `json:"type" validate:"required"`

agent/app/dto/ssh.go

@@ -4,7 +4,6 @@ import "time"
 
 type SSHUpdate struct {
 	Key      string `json:"key" validate:"required"`
-	OldValue string `json:"oldValue"`
 	NewValue string `json:"newValue"`
 }
 
@@ -50,6 +49,12 @@ type GenerateLoad struct {
 type SSHConf struct {
 	File string `json:"file"`
 }
+
+type SSHConfUpdate struct {
+	Key   string `json:"key" validate:"required"`
+	Path  string `json:"path"`
+	Value string `json:"value"`
+}
 type SearchSSHLog struct {
 	PageInfo
 	Info   string `json:"info"`

agent/app/model/agent.go

@@ -2,15 +2,21 @@ package model
 
 type Agent struct {
 	BaseModel
-	Name         string `json:"name" gorm:"not null;unique"`
-	Provider     string `json:"provider"`
-	Model        string `json:"model"`
-	BaseURL      string `json:"baseUrl"`
-	APIKey       string `json:"apiKey"`
-	Token        string `json:"token"`
-	Status       string `json:"status"`
-	Message      string `json:"message"`
-	AppInstallID uint   `json:"appInstallId"`
-	AccountID    uint   `json:"accountId"`
-	ConfigPath   string `json:"configPath"`
+	Name          string `json:"name" gorm:"not null;unique"`
+	Remark        string `json:"remark"`
+	AgentType     string `json:"agentType" gorm:"default:openclaw"`
+	Provider      string `json:"provider"`
+	Model         string `json:"model"`
+	APIType       string `json:"apiType"`
+	MaxTokens     int    `json:"maxTokens"`
+	ContextWindow int    `json:"contextWindow"`
+	BaseURL       string `json:"baseUrl"`
+	APIKey        string `json:"apiKey"`
+	Token         string `json:"token"`
+	Status        string `json:"status"`
+	Message       string `json:"message"`
+	AppInstallID  uint   `json:"appInstallId"`
+	WebsiteID     uint   `json:"websiteId"`
+	AccountID     uint   `json:"accountId"`
+	ConfigPath    string `json:"configPath"`
 }

agent/app/model/agent_account.go

@@ -2,12 +2,14 @@ package model
 
 type AgentAccount struct {
 	BaseModel
-	Provider string `json:"provider"`
-	Name     string `json:"name"`
-	APIKey   string `json:"apiKey"`
-	BaseURL  string `json:"baseUrl"`
-	Verified bool   `json:"verified"`
-	Remark   string `json:"remark"`
+	Provider       string `json:"provider"`
+	Name           string `json:"name"`
+	APIKey         string `json:"apiKey"`
+	BaseURL        string `json:"baseUrl"`
+	APIType        string `json:"apiType"`
+	RememberAPIKey bool   `json:"rememberApiKey"`
+	Verified       bool   `json:"verified"`
+	Remark         string `json:"remark"`
 }
 
 func (AgentAccount) TableName() string {

agent/app/model/agent_account_model.go

@@ -0,0 +1,17 @@
+package model
+
+type AgentAccountModel struct {
+	BaseModel
+	AccountID     uint   `json:"accountId" gorm:"index"`
+	Model         string `json:"model" gorm:"index"`
+	Name          string `json:"name"`
+	ContextWindow int    `json:"contextWindow"`
+	MaxTokens     int    `json:"maxTokens"`
+	Reasoning     bool   `json:"reasoning"`
+	Input         string `json:"input" gorm:"type:text"`
+	SortOrder     int    `json:"sortOrder" gorm:"index"`
+}
+
+func (AgentAccountModel) TableName() string {
+	return "agent_account_models"
+}

agent/app/model/app_install.go

@@ -26,6 +26,7 @@ type AppInstall struct {
 	HttpsPort     int    `json:"httpsPort"`
 	WebUI         string `json:"webUI"`
 	Favorite      bool   `json:"favorite"`
+	SortOrder     int    `json:"sortOrder" gorm:"default:0"`
 
 	App App `json:"app" gorm:"-:migration"`
 }

agent/app/model/file_share.go

@@ -0,0 +1,14 @@
+package model
+
+type FileShare struct {
+	BaseModel
+	Path          string `gorm:"not null;uniqueIndex" json:"path"`
+	Token         string `gorm:"not null;uniqueIndex" json:"token"`
+	FileName      string `gorm:"not null" json:"fileName"`
+	ExpiresUnix   int64  `json:"expiresUnix"`
+	PasswordEnc   string `json:"-"`
+	PasswordSalt  string `json:"passwordSalt"`
+	PasswordHash  string `json:"passwordHash"`
+	MaxDownloads  int    `json:"maxDownloads"`
+	DownloadCount int    `json:"downloadCount"`
+}

agent/app/provider/catalog.go

@@ -1,10 +1,23 @@
 package provider
 
-import "strings"
+import (
+	"strings"
+)
 
 type Model struct {
-	ID   string
-	Name string
+	ID            string
+	Name          string
+	ContextWindow int
+	MaxTokens     int
+	Reasoning     bool
+	Input         []string
+}
+
+type RuntimeDefault struct {
+	APIType       string
+	ContextWindow int
+	MaxTokens     int
+	Input         []string
 }
 
 type Meta struct {
@@ -13,138 +26,298 @@ type Meta struct {
 	Sort           uint
 	DefaultBaseURL string
 	EnvKey         string
+	Default        RuntimeDefault
 	Models         []Model
-	Enabled        bool
 }
 
 var catalog = map[string]Meta{
+	"custom": {
+		Key:            "custom",
+		DisplayName:    "Custom",
+		Sort:           10,
+		DefaultBaseURL: "",
+		EnvKey:         "CUSTOM_API_KEY",
+		Default: RuntimeDefault{
+			APIType:       "openai-completions",
+			ContextWindow: 128000,
+			MaxTokens:     8192,
+			Input:         []string{"text"},
+		},
+		Models: []Model{},
+	},
 	"ollama": {
 		Key:         "ollama",
 		DisplayName: "Ollama",
-		Sort:        1,
-		Enabled:     true,
+		Sort:        15,
+		Default: RuntimeDefault{
+			APIType:       "openai-responses",
+			ContextWindow: 160000,
+			MaxTokens:     8192,
+			Input:         []string{"text"},
+		},
+	},
+	"vllm": {
+		Key:            "vllm",
+		DisplayName:    "vLLM",
+		Sort:           20,
+		DefaultBaseURL: "",
+		EnvKey:         "VLLM_API_KEY",
+		Default: RuntimeDefault{
+			APIType:       "openai-completions",
+			ContextWindow: 128000,
+			MaxTokens:     8192,
+			Input:         []string{"text"},
+		},
+		Models: []Model{},
 	},
 	"deepseek": {
 		Key:            "deepseek",
 		DisplayName:    "DeepSeek",
-		Sort:           2,
+		Sort:           25,
 		DefaultBaseURL: "https://api.deepseek.com/v1",
 		EnvKey:         "DEEPSEEK_API_KEY",
-		Enabled:        true,
+		Default: RuntimeDefault{
+			APIType:       "openai-completions",
+			ContextWindow: 131072,
+			MaxTokens:     8192,
+			Input:         []string{"text"},
+		},
 		Models: []Model{
 			{ID: "deepseek/deepseek-chat", Name: "DeepSeek Chat"},
-			{ID: "deepseek/deepseek-reasoner", Name: "DeepSeek Reasoner"},
-			{ID: "deepseek/deepseek-r1:1.5b", Name: "DeepSeek R1 1.5B"},
+			{ID: "deepseek/deepseek-reasoner", Name: "DeepSeek Reasoner", MaxTokens: 65536, ContextWindow: 131072, Reasoning: true},
 		},
 	},
-	"openai": {
-		Key:            "openai",
-		DisplayName:    "OpenAI",
-		Sort:           3,
-		DefaultBaseURL: "https://api.openai.com/v1",
-		EnvKey:         "OPENAI_API_KEY",
-		Enabled:        true,
+	"bailian-coding-plan": {
+		Key:            "bailian-coding-plan",
+		DisplayName:    "阿里云百炼 Coding Plan",
+		Sort:           30,
+		DefaultBaseURL: "https://coding.dashscope.aliyuncs.com/v1",
+		EnvKey:         "QWEN_API_KEY",
+		Default: RuntimeDefault{
+			APIType:       "openai-completions",
+			ContextWindow: 256000,
+			MaxTokens:     8192,
+			Input:         []string{"text"},
+		},
 		Models: []Model{
-			{ID: "openai/codex-mini-latest", Name: "Codex Mini"},
-			{ID: "openai/gpt-4.1", Name: "GPT-4.1"},
-			{ID: "openai/gpt-4o", Name: "GPT-4o"},
-			{ID: "openai/gpt-4o-mini", Name: "GPT-4o Mini"},
-			{ID: "openai/gpt-5", Name: "GPT-5"},
-			{ID: "openai/gpt-5-mini", Name: "GPT-5 Mini"},
+			{ID: "bailian-coding-plan/qwen3.5-plus", Name: "Qwen3.5-Plus", Reasoning: true},
+			{ID: "bailian-coding-plan/qwen3-max", Name: "Qwen3-Max", Reasoning: true},
+			{ID: "bailian-coding-plan/qwen3-coder-next", Name: "Qwen3-Coder-Next", Reasoning: true},
+			{ID: "bailian-coding-plan/qwen3-coder-plus", Name: "Qwen3-Coder-Plus", Reasoning: true},
+			{ID: "bailian-coding-plan/minimax-m2.5", Name: "MiniMax M2.5", Reasoning: true},
+			{ID: "bailian-coding-plan/glm-5", Name: "GLM-5", Reasoning: true},
+			{ID: "bailian-coding-plan/kimi-k2.5", Name: "Kimi-k2.5", Reasoning: true},
+			{ID: "bailian-coding-plan/glm-4.7", Name: "GLM-4.7", Reasoning: true},
 		},
 	},
-	"anthropic": {
-		Key:            "anthropic",
-		DisplayName:    "Anthropic",
-		Sort:           4,
-		DefaultBaseURL: "https://api.anthropic.com",
-		EnvKey:         "ANTHROPIC_API_KEY",
-		Enabled:        true,
+	"ark-coding-plan": {
+		Key:            "ark-coding-plan",
+		DisplayName:    "方舟 Coding Plan",
+		Sort:           35,
+		DefaultBaseURL: "https://ark.cn-beijing.volces.com/api/coding/v3",
+		EnvKey:         "ARK_API_KEY",
+		Default: RuntimeDefault{
+			APIType:       "openai-completions",
+			ContextWindow: 256000,
+			MaxTokens:     4096,
+			Input:         []string{"text"},
+		},
 		Models: []Model{
-			{ID: "anthropic/claude-3-haiku-20240307", Name: "Claude 3 Haiku"},
-			{ID: "anthropic/claude-3-5-haiku-latest", Name: "Claude 3.5 Haiku"},
-			{ID: "anthropic/claude-3-5-sonnet-20241022", Name: "Claude 3.5 Sonnet"},
-			{ID: "anthropic/claude-3-7-sonnet-20250219", Name: "Claude 3.7 Sonnet"},
-			{ID: "anthropic/claude-opus-4-1", Name: "Claude Opus 4.1"},
+			{ID: "ark-coding-plan/ark-code-latest", Name: "Ark Coding Plan", ContextWindow: 256000, MaxTokens: 4096},
+			{ID: "ark-coding-plan/doubao-seed-code", Name: "Doubao Seed Code", ContextWindow: 256000, MaxTokens: 4096},
+			{ID: "ark-coding-plan/glm-4.7", Name: "GLM 4.7 Coding", ContextWindow: 200000, MaxTokens: 4096},
+			{ID: "ark-coding-plan/kimi-k2-thinking", Name: "Kimi K2 Thinking", ContextWindow: 256000, MaxTokens: 4096},
+			{ID: "ark-coding-plan/kimi-k2.5", Name: "Kimi K2.5 Coding", ContextWindow: 256000, MaxTokens: 4096},
+			{ID: "ark-coding-plan/doubao-seed-code-preview-251028", Name: "Doubao Seed Code Preview", ContextWindow: 256000, MaxTokens: 4096},
 		},
 	},
-	"gemini": {
-		Key:            "gemini",
-		DisplayName:    "Gemini",
-		Sort:           5,
-		DefaultBaseURL: "https://generativelanguage.googleapis.com",
-		EnvKey:         "GEMINI_API_KEY",
-		Enabled:        true,
+	"zai": {
+		Key:            "zai",
+		DisplayName:    "Z.ai",
+		Sort:           40,
+		DefaultBaseURL: "https://open.bigmodel.cn/api/paas/v4",
+		EnvKey:         "ZAI_API_KEY",
+		Default: RuntimeDefault{
+			APIType:       "openai-completions",
+			ContextWindow: 204800,
+			MaxTokens:     131072,
+			Input:         []string{"text"},
+		},
 		Models: []Model{
-			{ID: "google/gemini-1.5-flash", Name: "Gemini 1.5 Flash"},
-			{ID: "google/gemini-1.5-pro", Name: "Gemini 1.5 Pro"},
-			{ID: "google/gemini-2.0-flash", Name: "Gemini 2.0 Flash"},
-			{ID: "google/gemini-2.5-flash", Name: "Gemini 2.5 Flash"},
-			{ID: "google/gemini-2.5-pro", Name: "Gemini 2.5 Pro"},
-			{ID: "google/gemini-3-flash-preview", Name: "Gemini 3 Flash Preview"},
+			{ID: "zai/glm-5", Name: "GLM-5", Reasoning: true},
+			{ID: "zai/glm-4.7", Name: "GLM-4.7", Reasoning: true},
+			{ID: "zai/glm-4.7-flash", Name: "GLM-4.7-Flash", Reasoning: true},
+			{ID: "zai/glm-4.7-flashx", Name: "GLM-4.7-FlashX", Reasoning: true},
 		},
 	},
 	"minimax": {
 		Key:            "minimax",
 		DisplayName:    "MiniMax (CN)",
-		Sort:           6,
+		Sort:           45,
 		DefaultBaseURL: "https://api.minimaxi.com/anthropic",
 		EnvKey:         "MINIMAX_API_KEY",
-		Enabled:        true,
+		Default: RuntimeDefault{
+			APIType:       "anthropic-messages",
+			ContextWindow: 200000,
+			MaxTokens:     8192,
+			Input:         []string{"text"},
+		},
 		Models: []Model{
-			{ID: "minimax/MiniMax-M2.1", Name: "MiniMax M2.1"},
-			{ID: "minimax/MiniMax-M2.1-lightning", Name: "MiniMax M2.1 Lightning"},
+			{ID: "minimax/MiniMax-M2.7", Name: "MiniMax M2.7"},
+			{ID: "minimax/MiniMax-M2.7-highspeed", Name: "MiniMax M2.7 highspeed"},
+			{ID: "minimax/MiniMax-M2.5", Name: "MiniMax M2.5", Reasoning: true},
+			{ID: "minimax/MiniMax-M2.5-highspeed", Name: "MiniMax M2.5 highspeed"},
 		},
 	},
-	"moonshot": {
-		Key:            "moonshot",
-		DisplayName:    "Moonshot (Global)",
-		Sort:           7,
-		DefaultBaseURL: "https://api.moonshot.ai/v1",
-		EnvKey:         "MOONSHOT_API_KEY",
-		Enabled:        true,
+	"xiaomi": {
+		Key:            "xiaomi",
+		DisplayName:    "Xiaomi",
+		Sort:           46,
+		DefaultBaseURL: "https://api.xiaomimimo.com/v1",
+		EnvKey:         "XIAOMI_API_KEY",
+		Default: RuntimeDefault{
+			APIType:       "openai-completions",
+			ContextWindow: 262144,
+			MaxTokens:     8192,
+			Input:         []string{"text"},
+		},
 		Models: []Model{
-			{ID: "moonshot/kimi-k2.5", Name: "Kimi K2.5"},
-			{ID: "moonshot/kimi-k2-0905-preview", Name: "Kimi K2 0905 Preview"},
-			{ID: "moonshot/kimi-k2-thinking", Name: "Kimi K2 Thinking"},
+			{ID: "xiaomi/mimo-v2-flash", Name: "Xiaomi MiMo V2 Flash", ContextWindow: 262144, MaxTokens: 8192, Input: []string{"text"}},
+			{ID: "xiaomi/mimo-v2-pro", Name: "Xiaomi MiMo V2 Pro", ContextWindow: 1048576, MaxTokens: 32000, Reasoning: true, Input: []string{"text"}},
+			{ID: "xiaomi/mimo-v2-omni", Name: "Xiaomi MiMo V2 Omni", ContextWindow: 262144, MaxTokens: 32000, Reasoning: true, Input: []string{"text", "image"}},
 		},
 	},
 	"kimi": {
 		Key:            "kimi",
 		DisplayName:    "Kimi (CN)",
-		Sort:           8,
+		Sort:           50,
 		DefaultBaseURL: "https://api.moonshot.cn/v1",
 		EnvKey:         "KIMI_API_KEY",
-		Enabled:        true,
+		Default: RuntimeDefault{
+			APIType:       "openai-completions",
+			ContextWindow: 256000,
+			MaxTokens:     8192,
+			Input:         []string{"text", "image"},
+		},
 		Models: []Model{
-			{ID: "kimi/kimi-k2.5", Name: "Kimi K2.5"},
+			{ID: "kimi/kimi-k2.5", Name: "Kimi K2.5", Reasoning: true},
 			{ID: "kimi/kimi-k2-0905-preview", Name: "Kimi K2 0905 Preview"},
-			{ID: "kimi/kimi-k2-thinking", Name: "Kimi K2 Thinking"},
+			{ID: "kimi/kimi-k2-thinking", Name: "Kimi K2 Thinking", Reasoning: true},
 		},
 	},
 	"kimi-coding": {
 		Key:            "kimi-coding",
 		DisplayName:    "Kimi Coding",
-		Sort:           9,
-		DefaultBaseURL: "https://api.moonshot.cn/anthropic/v1",
+		Sort:           51,
+		DefaultBaseURL: "https://api.kimi.com/coding/",
 		EnvKey:         "KIMI_API_KEY",
-		Enabled:        true,
+		Default: RuntimeDefault{
+			APIType:       "anthropic-messages",
+			ContextWindow: 262144,
+			MaxTokens:     32768,
+			Input:         []string{"text", "image"},
+		},
 		Models: []Model{
-			{ID: "kimi-coding/k2p5", Name: "Kimi K2.5"},
+			{ID: "kimi-coding/kimi-code", Name: "Kimi Code", ContextWindow: 262144, MaxTokens: 32768, Reasoning: true, Input: []string{"text", "image"}},
+			{ID: "kimi-coding/k2p5", Name: "Kimi K2.5", ContextWindow: 262144, MaxTokens: 32768, Reasoning: true, Input: []string{"text", "image"}},
 		},
 	},
-	"qwen": {
-		Key:            "qwen",
-		DisplayName:    "Qwen",
-		Sort:           10,
-		DefaultBaseURL: "https://dashscope.aliyuncs.com/compatible-mode/v1",
-		EnvKey:         "QWEN_API_KEY",
-		Enabled:        false,
+	"openai": {
+		Key:            "openai",
+		DisplayName:    "OpenAI",
+		Sort:           55,
+		DefaultBaseURL: "https://api.openai.com/v1",
+		EnvKey:         "OPENAI_API_KEY",
+		Default: RuntimeDefault{
+			APIType:       "openai-responses",
+			ContextWindow: 272000,
+			MaxTokens:     128000,
+			Input:         []string{"text", "image"},
+		},
+		Models: []Model{
+			{ID: "openai/gpt-5.4", Name: "gpt-5.4", ContextWindow: 272000, MaxTokens: 128000, Reasoning: true, Input: []string{"text", "image"}},
+			{ID: "openai/gpt-5.4-pro", Name: "gpt-5.4-pro", ContextWindow: 1050000, MaxTokens: 128000, Reasoning: true, Input: []string{"text", "image"}},
+			{ID: "openai/gpt-5.4-mini", Name: "gpt-5.4-mini", ContextWindow: 400000, MaxTokens: 128000, Reasoning: true, Input: []string{"text", "image"}},
+			{ID: "openai/gpt-5.4-nano", Name: "gpt-5.4-nano", ContextWindow: 400000, MaxTokens: 128000, Reasoning: true, Input: []string{"text", "image"}},
+		},
+	},
+	"openrouter": {
+		Key:            "openrouter",
+		DisplayName:    "OpenRouter",
+		Sort:           56,
+		DefaultBaseURL: "https://openrouter.ai/api/v1",
+		EnvKey:         "OPENROUTER_API_KEY",
+		Default: RuntimeDefault{
+			APIType:       "openai-completions",
+			ContextWindow: 128000,
+			MaxTokens:     8192,
+			Input:         []string{"text"},
+		},
+		Models: []Model{
+			{ID: "openrouter/free", Name: "openrouter/free"},
+			{ID: "openrouter/auto", Name: "openrouter/auto"},
+		},
+	},
+	"anthropic": {
+		Key:            "anthropic",
+		DisplayName:    "Anthropic",
+		Sort:           60,
+		DefaultBaseURL: "https://api.anthropic.com",
+		EnvKey:         "ANTHROPIC_API_KEY",
+		Default: RuntimeDefault{
+			APIType:       "anthropic-messages",
+			ContextWindow: 256000,
+			MaxTokens:     8192,
+			Input:         []string{"text", "image"},
+		},
+		Models: []Model{
+			{ID: "anthropic/claude-sonnet-4-6", Name: "Claude Sonnet 4.6", Reasoning: true},
+			{ID: "anthropic/claude-opus-4-6", Name: "Claude Opus 4.6", Reasoning: true},
+			{ID: "anthropic/claude-opus-4-5", Name: "Claude Opus 4.5"},
+			{ID: "anthropic/claude-sonnet-4-5", Name: "Claude Sonnet 4.5"},
+			{ID: "anthropic/claude-haiku-4-5", Name: "Claude Haiku 4.5"},
+		},
+	},
+	"gemini": {
+		Key:            "gemini",
+		DisplayName:    "Gemini",
+		Sort:           65,
+		DefaultBaseURL: "https://generativelanguage.googleapis.com",
+		EnvKey:         "GEMINI_API_KEY",
+		Default: RuntimeDefault{
+			APIType:       "openai-completions",
+			ContextWindow: 256000,
+			MaxTokens:     8192,
+			Input:         []string{"text", "image"},
+		},
+		Models: []Model{
+			{ID: "google/gemini-3-flash-preview", Name: "Gemini 3 Flash Preview", Reasoning: true},
+			{ID: "google/gemini-flash-latest", Name: "Gemini Flash Latest"},
+			{ID: "google/gemini-3-pro-preview", Name: "Gemini 3 Pro Preview", Reasoning: true},
+		},
+	},
+	"moonshot": {
+		Key:            "moonshot",
+		DisplayName:    "Moonshot (Global)",
+		Sort:           70,
+		DefaultBaseURL: "https://api.moonshot.ai/v1",
+		EnvKey:         "MOONSHOT_API_KEY",
+		Default: RuntimeDefault{
+			APIType:       "openai-completions",
+			ContextWindow: 256000,
+			MaxTokens:     8192,
+			Input:         []string{"text"},
+		},
+		Models: []Model{
+			{ID: "moonshot/kimi-k2.5", Name: "Kimi K2.5", Reasoning: true},
+			{ID: "moonshot/kimi-k2-0905-preview", Name: "Kimi K2 0905 Preview"},
+			{ID: "moonshot/kimi-k2-thinking", Name: "Kimi K2 Thinking", Reasoning: true},
+		},
 	},
 }
 
 func Get(key string) (Meta, bool) {
-	meta, ok := catalog[strings.ToLower(strings.TrimSpace(key))]
+	meta, ok := catalog[key]
 	if !ok {
 		return Meta{}, false
 	}
@@ -159,13 +332,8 @@ func All() map[string]Meta {
 	return result
 }
 
-func IsEnabled(key string) bool {
-	meta, ok := catalog[strings.ToLower(strings.TrimSpace(key))]
-	return ok && meta.Enabled
-}
-
 func DefaultBaseURL(key string) (string, bool) {
-	meta, ok := catalog[strings.ToLower(strings.TrimSpace(key))]
+	meta, ok := catalog[key]
 	if !ok || strings.TrimSpace(meta.DefaultBaseURL) == "" {
 		return "", false
 	}
@@ -173,7 +341,7 @@ func DefaultBaseURL(key string) (string, bool) {
 }
 
 func EnvKey(key string) string {
-	meta, ok := catalog[strings.ToLower(strings.TrimSpace(key))]
+	meta, ok := catalog[key]
 	if !ok {
 		return ""
 	}
@@ -181,7 +349,7 @@ func EnvKey(key string) string {
 }
 
 func DisplayName(key string) string {
-	meta, ok := catalog[strings.ToLower(strings.TrimSpace(key))]
+	meta, ok := catalog[key]
 	if !ok {
 		return key
 	}
@@ -191,11 +359,80 @@ func DisplayName(key string) string {
 	return meta.DisplayName
 }
 
+func FindModel(key, modelID string) (Model, bool) {
+	meta, ok := Get(key)
+	if !ok {
+		return Model{}, false
+	}
+	for _, item := range meta.Models {
+		if item.ID == modelID {
+			return item, true
+		}
+	}
+	return Model{}, false
+}
+
 func cloneMeta(meta Meta) Meta {
 	clone := meta
+	if len(meta.Default.Input) > 0 {
+		clone.Default.Input = make([]string, len(meta.Default.Input))
+		copy(clone.Default.Input, meta.Default.Input)
+	}
 	if len(meta.Models) > 0 {
 		clone.Models = make([]Model, len(meta.Models))
-		copy(clone.Models, meta.Models)
+		for i, item := range meta.Models {
+			clone.Models[i] = normalizeModel(meta, item)
+		}
 	}
 	return clone
 }
+
+func normalizeModel(meta Meta, model Model) Model {
+	clone := model
+	clone.ID = strings.TrimSpace(clone.ID)
+	clone.Name = strings.TrimSpace(clone.Name)
+	if clone.Name == "" {
+		clone.Name = clone.ID
+	}
+	if clone.MaxTokens <= 0 {
+		clone.MaxTokens = meta.Default.MaxTokens
+	}
+	if clone.ContextWindow <= 0 {
+		clone.ContextWindow = meta.Default.ContextWindow
+	}
+	if len(clone.Input) == 0 && len(meta.Default.Input) > 0 {
+		clone.Input = make([]string, len(meta.Default.Input))
+		copy(clone.Input, meta.Default.Input)
+	}
+	return clone
+}
+
+func ResolveRuntimeParams(provider, apiType string, maxTokens, contextWindow int) (string, int, int) {
+	defaultAPIType := "openai-completions"
+	defaultMaxTokens := 8192
+	defaultContextWindow := 256000
+	if meta, ok := Get(provider); ok {
+		if meta.Default.APIType != "" {
+			defaultAPIType = meta.Default.APIType
+		}
+		if meta.Default.MaxTokens > 0 {
+			defaultMaxTokens = meta.Default.MaxTokens
+		}
+		if meta.Default.ContextWindow > 0 {
+			defaultContextWindow = meta.Default.ContextWindow
+		}
+	}
+	resolvedAPI := apiType
+	if strings.TrimSpace(apiType) == "" {
+		resolvedAPI = defaultAPIType
+	}
+	resolvedMaxTokens := defaultMaxTokens
+	resolvedContextWindow := defaultContextWindow
+	if maxTokens > 0 {
+		resolvedMaxTokens = maxTokens
+	}
+	if contextWindow > 0 {
+		resolvedContextWindow = contextWindow
+	}
+	return resolvedAPI, resolvedMaxTokens, resolvedContextWindow
+}

agent/app/provider/openclaw.go

@@ -0,0 +1,176 @@
+package provider
+
+import (
+	"fmt"
+	"strings"
+)
+
+type OpenClawPatch struct {
+	PrimaryModel string
+	Models       map[string]interface{}
+}
+
+type OpenClawProviderPatch struct {
+	PrimaryModel string
+	ProviderKey  string
+	ModelID      string
+	APIKey       string
+	BaseURL      string
+	APIType      string
+	AuthHeader   bool
+}
+
+func BuildOpenClawPatch(provider, modelName, apiType string, reasoning bool, maxTokens, contextWindow int, baseURL, apiKey string) (*OpenClawPatch, error) {
+	providerPatch, err := BuildOpenClawProviderPatch(provider, modelName, apiType, baseURL, apiKey)
+	if err != nil {
+		return nil, err
+	}
+	_, maxTokens, contextWindow = ResolveRuntimeParams(provider, apiType, maxTokens, contextWindow)
+	return newOpenClawPatch(
+		providerPatch,
+		resolveOpenClawModelName(provider, providerPatch.ModelID),
+		resolveOpenClawModelInput(provider, providerPatch.ModelID),
+		reasoning,
+		contextWindow,
+		maxTokens,
+	), nil
+}
+
+func BuildOpenClawProviderPatch(provider, modelName, apiType, baseURL, apiKey string) (*OpenClawProviderPatch, error) {
+	modelName = strings.TrimSpace(modelName)
+	if modelName == "" {
+		return nil, fmt.Errorf("model is required")
+	}
+	resolvedAPIType, _, _ := ResolveRuntimeParams(provider, apiType, 0, 0)
+	modelID := resolveOpenClawModelID(provider, modelName)
+	switch provider {
+	case "deepseek":
+		return newOpenClawProviderPatch(modelName, "deepseek", modelID, strings.TrimSpace(apiKey), baseURL, "openai-completions", false), nil
+	case "gemini":
+		return newOpenClawProviderPatch("google/"+modelID, "google", modelID, strings.TrimSpace(apiKey), baseURL, resolvedAPIType, false), nil
+	case "moonshot", "kimi":
+		return buildMoonshotProviderPatch(provider, modelName, modelID, baseURL, apiKey), nil
+	case "bailian-coding-plan":
+		return newOpenClawProviderPatch("bailian-coding-plan/"+modelID, "bailian-coding-plan", modelID, strings.TrimSpace(apiKey), baseURL, "openai-completions", false), nil
+	case "ark-coding-plan":
+		return newOpenClawProviderPatch("ark-coding-plan/"+modelID, "ark-coding-plan", modelID, strings.TrimSpace(apiKey), baseURL, "openai-completions", false), nil
+	case "minimax":
+		return newOpenClawProviderPatch("minimax/"+modelID, "minimax", modelID, strings.TrimSpace(apiKey), baseURL, "anthropic-messages", true), nil
+	case "xiaomi":
+		return newOpenClawProviderPatch("xiaomi/"+modelID, "xiaomi", modelID, strings.TrimSpace(apiKey), baseURL, "openai-completions", false), nil
+	case "custom", "vllm":
+		return newOpenClawProviderPatch(provider+"/"+modelID, provider, modelID, strings.TrimSpace(apiKey), strings.TrimSpace(baseURL), resolvedAPIType, false), nil
+	case "ollama":
+		return newOpenClawProviderPatch(modelName, "ollama", modelID, "ollama", strings.TrimSpace(baseURL), resolvedAPIType, false), nil
+	case "kimi-coding":
+		return newOpenClawProviderPatch(modelName, "kimi-coding", modelID, strings.TrimSpace(apiKey), baseURL, "anthropic-messages", false), nil
+	case "zai":
+		return newOpenClawProviderPatch("zai/"+modelID, "zai", modelID, strings.TrimSpace(apiKey), baseURL, "openai-completions", false), nil
+	default:
+		return newOpenClawProviderPatch(modelName, provider, modelID, strings.TrimSpace(apiKey), baseURL, resolvedAPIType, false), nil
+	}
+}
+
+func buildMoonshotProviderPatch(provider, modelName, modelID, baseURL, apiKey string) *OpenClawProviderPatch {
+	providerKey := provider
+	primaryModel := modelName
+	if provider == "kimi" {
+		providerKey = "moonshot"
+		primaryModel = "moonshot/" + modelID
+	}
+	return newOpenClawProviderPatch(primaryModel, providerKey, modelID, strings.TrimSpace(apiKey), baseURL, "openai-completions", false)
+}
+
+func newOpenClawProviderPatch(primaryModel, providerKey, modelID, apiKey, baseURL, apiType string, authHeader bool) *OpenClawProviderPatch {
+	return &OpenClawProviderPatch{
+		PrimaryModel: primaryModel,
+		ProviderKey:  providerKey,
+		ModelID:      modelID,
+		APIKey:       apiKey,
+		BaseURL:      baseURL,
+		APIType:      apiType,
+		AuthHeader:   authHeader,
+	}
+}
+
+func newOpenClawPatch(providerPatch *OpenClawProviderPatch, modelName string, input []string, reasoning bool, contextWindow, maxTokens int) *OpenClawPatch {
+	model := map[string]interface{}{
+		"id":            providerPatch.ModelID,
+		"name":          modelName,
+		"reasoning":     reasoning,
+		"input":         input,
+		"contextWindow": contextWindow,
+		"maxTokens":     maxTokens,
+		"cost":          map[string]interface{}{},
+	}
+	providerConfig := map[string]interface{}{
+		"apiKey":  providerPatch.APIKey,
+		"baseUrl": providerPatch.BaseURL,
+		"api":     providerPatch.APIType,
+		"models":  []map[string]interface{}{model},
+	}
+	if providerPatch.AuthHeader {
+		providerConfig["authHeader"] = true
+	}
+	return &OpenClawPatch{
+		PrimaryModel: providerPatch.PrimaryModel,
+		Models: map[string]interface{}{
+			"mode": "merge",
+			"providers": map[string]interface{}{
+				providerPatch.ProviderKey: providerConfig,
+			},
+		},
+	}
+}
+
+func resolveOpenClawModelID(provider, modelName string) string {
+	if provider == "custom" || provider == "vllm" {
+		return normalizeCustomModel(modelName)
+	}
+	if parts := strings.SplitN(modelName, "/", 2); len(parts) == 2 {
+		return parts[1]
+	}
+	return modelName
+}
+
+func resolveOpenClawModelName(provider, modelID string) string {
+	if item, ok := resolveOpenClawCatalogModel(provider, modelID); ok {
+		return item.Name
+	}
+	if provider == "kimi-coding" {
+		return "Kimi for Coding"
+	}
+	return modelID
+}
+
+func resolveOpenClawModelInput(provider, modelID string) []string {
+	if item, ok := resolveOpenClawCatalogModel(provider, modelID); ok && len(item.Input) > 0 {
+		return item.Input
+	}
+	if provider == "kimi-coding" {
+		return []string{"text", "image"}
+	}
+	return []string{"text"}
+}
+
+func resolveOpenClawCatalogModel(provider, modelID string) (Model, bool) {
+	candidates := []string{provider + "/" + modelID}
+	if provider == "gemini" {
+		candidates = append(candidates, "google/"+modelID)
+	}
+	for _, candidate := range candidates {
+		if item, ok := FindModel(provider, candidate); ok {
+			return item, true
+		}
+	}
+	return Model{}, false
+}
+
+func normalizeCustomModel(modelName string) string {
+	trim := strings.TrimSpace(modelName)
+	trim = strings.TrimLeft(trim, "/")
+	if parts := strings.SplitN(trim, "/", 2); len(parts) == 2 && strings.EqualFold(parts[0], "custom") {
+		return strings.TrimLeft(strings.TrimSpace(parts[1]), "/")
+	}
+	return trim
+}

agent/app/provider/verify.go

@@ -0,0 +1,181 @@
+package provider
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+)
+
+type VerifyRequest struct {
+	Method  string
+	URL     string
+	Headers map[string]string
+	Body    []byte
+}
+
+const (
+	defaultVerifyTimeout = 30 * time.Second
+)
+
+func SkipVerification(key string) bool {
+	switch key {
+	case "custom", "vllm", "ollama", "kimi-coding":
+		return true
+	default:
+		return false
+	}
+}
+
+func VerifyAccount(provider, baseURL, apiKey string) error {
+	req := BuildVerifyRequest(provider, baseURL, apiKey)
+	var body *bytes.Buffer
+	if len(req.Body) > 0 {
+		body = bytes.NewBuffer(req.Body)
+	} else {
+		body = bytes.NewBuffer(nil)
+	}
+	httpReq, err := http.NewRequest(req.Method, req.URL, body)
+	if err != nil {
+		return err
+	}
+	for key, value := range req.Headers {
+		httpReq.Header.Set(key, value)
+	}
+	resp, err := (&http.Client{Timeout: verifyTimeout()}).Do(httpReq)
+	if err != nil {
+		return buserr.WithErr("ErrAgentAccountUnavailable", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 400 {
+		return buserr.WithErr("ErrAgentAccountUnavailable", fmt.Errorf("verify failed: %s", resp.Status))
+	}
+	return nil
+}
+
+func verifyTimeout() time.Duration {
+	return defaultVerifyTimeout
+}
+
+func BuildVerifyRequest(provider, baseURL, apiKey string) VerifyRequest {
+	base := strings.TrimRight(strings.TrimSpace(baseURL), "/")
+	headers := map[string]string{}
+	request := VerifyRequest{Method: http.MethodGet, Headers: headers}
+
+	switch provider {
+	case "anthropic", "kimi-coding":
+		headers["x-api-key"] = apiKey
+		headers["anthropic-version"] = "2023-06-01"
+		if strings.Contains(base, "/v1") {
+			request.URL = base + "/models"
+		} else {
+			request.URL = base + "/v1/models"
+		}
+	case "gemini":
+		request.Method = http.MethodPost
+		if strings.Contains(base, "/v1beta") {
+			request.URL = base + "/models/gemini-3-flash-preview:generateContent"
+		} else {
+			request.URL = base + "/v1beta/models/gemini-3-flash-preview:generateContent"
+		}
+		headers["x-goog-api-key"] = apiKey
+		headers["Content-Type"] = "application/json"
+		request.Body = mustJSON(map[string]interface{}{
+			"contents": []map[string]interface{}{{
+				"parts": []map[string]string{{
+					"text": "Explain how AI works in a few words",
+				}},
+			}},
+		})
+	case "zai":
+		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
+		request.URL = base + "/models"
+	case "bailian-coding-plan":
+		request.Method = http.MethodPost
+		if !strings.Contains(base, "/v1") {
+			base = base + "/v1"
+		}
+		request.URL = base + "/chat/completions"
+		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
+		headers["Content-Type"] = "application/json"
+		request.Body = mustJSON(map[string]interface{}{
+			"model":      "qwen3.5-plus",
+			"messages":   []map[string]string{{"role": "user", "content": "test"}},
+			"max_tokens": 1,
+		})
+	case "ark-coding-plan":
+		request.Method = http.MethodPost
+		if !strings.Contains(base, "/api/coding/v3") {
+			base = "https://ark.cn-beijing.volces.com/api/coding/v3"
+		}
+		request.URL = base + "/chat/completions"
+		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
+		headers["Content-Type"] = "application/json"
+		request.Body = mustJSON(map[string]interface{}{
+			"model":      "ark-code-latest",
+			"messages":   []map[string]string{{"role": "user", "content": "test"}},
+			"max_tokens": 1,
+		})
+	case "minimax":
+		request.Method = http.MethodPost
+		headers["x-api-key"] = apiKey
+		headers["anthropic-version"] = "2023-06-01"
+		headers["Content-Type"] = "application/json"
+		if strings.Contains(base, "/v1") {
+			request.URL = base + "/messages"
+		} else {
+			request.URL = base + "/v1/messages"
+		}
+		request.Body = mustJSON(map[string]interface{}{
+			"model":      "MiniMax-M2.5",
+			"max_tokens": 1,
+			"messages": []map[string]interface{}{{
+				"role": "user",
+				"content": []map[string]string{{
+					"type": "text",
+					"text": "test",
+				}},
+			}},
+		})
+	case "xiaomi":
+		request.Method = http.MethodPost
+		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
+		headers["Content-Type"] = "application/json"
+		if !strings.Contains(base, "/v1") {
+			base = base + "/v1"
+		}
+		request.URL = base + "/chat/completions"
+		request.Body = mustJSON(map[string]interface{}{
+			"model":      "mimo-v2-flash",
+			"max_tokens": 1,
+			"messages":   []map[string]string{{"role": "user", "content": "test"}},
+		})
+	case "openrouter":
+		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
+		if strings.Contains(base, "/v1") {
+			request.URL = base + "/key"
+		} else {
+			request.URL = base + "/v1/key"
+		}
+	default:
+		headers["Authorization"] = fmt.Sprintf("Bearer %s", apiKey)
+		if strings.Contains(base, "/v1") {
+			request.URL = base + "/models"
+		} else {
+			request.URL = base + "/v1/models"
+		}
+	}
+	return request
+}
+
+func mustJSON(value interface{}) []byte {
+	payload, err := json.Marshal(value)
+	if err != nil {
+		return []byte("{}")
+	}
+	return payload
+}

agent/app/repo/agent.go

@@ -16,6 +16,7 @@ type IAgentRepo interface {
 	DeleteByID(id uint) error
 	DeleteByAppInstallID(appInstallID uint) error
 	DeleteByAppInstallIDWithCtx(ctx context.Context, appInstallID uint) error
+	ClearWebsiteIDByWebsiteIDWithCtx(ctx context.Context, websiteID uint) error
 	List(opts ...DBOption) ([]model.Agent, error)
 }
 
@@ -66,6 +67,13 @@ func (a AgentRepo) DeleteByAppInstallIDWithCtx(ctx context.Context, appInstallID
 	return getTx(ctx).Where("app_install_id = ?", appInstallID).Delete(&model.Agent{}).Error
 }
 
+func (a AgentRepo) ClearWebsiteIDByWebsiteIDWithCtx(ctx context.Context, websiteID uint) error {
+	if websiteID == 0 {
+		return nil
+	}
+	return getTx(ctx).Model(&model.Agent{}).Where("website_id = ?", websiteID).Update("website_id", 0).Error
+}
+
 func (a AgentRepo) List(opts ...DBOption) ([]model.Agent, error) {
 	var agents []model.Agent
 	if err := getDb(opts...).Find(&agents).Error; err != nil {

agent/app/repo/agent_account_model.go

@@ -0,0 +1,50 @@
+package repo
+
+import "github.com/1Panel-dev/1Panel/agent/app/model"
+
+type AgentAccountModelRepo struct{}
+
+type IAgentAccountModelRepo interface {
+	List(opts ...DBOption) ([]model.AgentAccountModel, error)
+	GetFirst(opts ...DBOption) (*model.AgentAccountModel, error)
+	Create(item *model.AgentAccountModel) error
+	Save(item *model.AgentAccountModel) error
+	DeleteByID(id uint) error
+	Delete(opts ...DBOption) error
+}
+
+func NewIAgentAccountModelRepo() IAgentAccountModelRepo {
+	return &AgentAccountModelRepo{}
+}
+
+func (a AgentAccountModelRepo) List(opts ...DBOption) ([]model.AgentAccountModel, error) {
+	var list []model.AgentAccountModel
+	if err := getDb(opts...).Find(&list).Error; err != nil {
+		return nil, err
+	}
+	return list, nil
+}
+
+func (a AgentAccountModelRepo) GetFirst(opts ...DBOption) (*model.AgentAccountModel, error) {
+	var item model.AgentAccountModel
+	if err := getDb(opts...).First(&item).Error; err != nil {
+		return nil, err
+	}
+	return &item, nil
+}
+
+func (a AgentAccountModelRepo) Create(item *model.AgentAccountModel) error {
+	return getDb().Create(item).Error
+}
+
+func (a AgentAccountModelRepo) Save(item *model.AgentAccountModel) error {
+	return getDb().Save(item).Error
+}
+
+func (a AgentAccountModelRepo) DeleteByID(id uint) error {
+	return getDb().Delete(&model.AgentAccountModel{}, id).Error
+}
+
+func (a AgentAccountModelRepo) Delete(opts ...DBOption) error {
+	return getDb(opts...).Delete(&model.AgentAccountModel{}).Error
+}

agent/app/repo/app_launcher.go

@@ -80,9 +80,10 @@ func (u *LauncherRepo) ListQuickJump(withAll bool) []model.QuickJump {
 	}
 	if !withAll && len(quicks) == 0 {
 		return []model.QuickJump{
+			{Name: "Agent", Title: "aiTools.agents.agent", Recommend: 1, IsShow: true, Router: "/ai/agents/agent"},
 			{Name: "Website", Title: "menu.website", Recommend: 10, IsShow: true, Router: "/websites"},
 			{Name: "Database", Title: "menu.database", Recommend: 30, IsShow: true, Router: "/databases"},
-			{Name: "Cronjob", Title: "menu.cronjob", Recommend: 50, IsShow: true, Router: "/cronjobs"},
+			{Name: "Cronjob", Title: "menu.cronjob", Recommend: 50, IsShow: false, Router: "/cronjobs"},
 			{Name: "AppInstalled", Title: "home.appInstalled", Recommend: 70, IsShow: true, Router: "/apps/installed"},
 		}
 	}

agent/app/repo/common.go

@@ -19,6 +19,12 @@ func WithByID(id uint) DBOption {
 	}
 }
 
+func WithByGroupID(id uint) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		return g.Where("group_id = ?", id)
+	}
+}
+
 func WithByNOTID(id uint) DBOption {
 	return func(g *gorm.DB) *gorm.DB {
 		return g.Where("id != ?", id)
@@ -43,6 +49,12 @@ func WithByName(name string) DBOption {
 	}
 }
 
+func WithByAddr(addr string) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		return g.Where("addr = ?", addr)
+	}
+}
+
 func WithByKey(key string) DBOption {
 	return func(g *gorm.DB) *gorm.DB {
 		return g.Where("key = ?", key)
@@ -100,6 +112,24 @@ func WithByAccountID(accountID uint) DBOption {
 	}
 }
 
+func WithByWebsiteID(websiteID uint) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		if websiteID == 0 {
+			return g
+		}
+		return g.Where("website_id = ?", websiteID)
+	}
+}
+
+func WithByAppInstallID(appInstallID uint) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		if appInstallID == 0 {
+			return g
+		}
+		return g.Where("app_install_id = ?", appInstallID)
+	}
+}
+
 func WithByType(tp string) DBOption {
 	return func(g *gorm.DB) *gorm.DB {
 		return g.Where("`type` = ?", tp)

agent/app/repo/file_share.go

@@ -0,0 +1,77 @@
+package repo
+
+import (
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"gorm.io/gorm"
+)
+
+type FileShareRepo struct{}
+
+type IFileShareRepo interface {
+	Page(page, size int, opts ...DBOption) (int64, []model.FileShare, error)
+	Create(fileShare *model.FileShare) error
+	Save(fileShare *model.FileShare) error
+	Delete(opts ...DBOption) error
+	GetFirst(opts ...DBOption) (model.FileShare, error)
+	All() ([]model.FileShare, error)
+	WithByPath(path string) DBOption
+	WithByCode(code string) DBOption
+}
+
+func NewIFileShareRepo() IFileShareRepo {
+	return &FileShareRepo{}
+}
+
+func (r *FileShareRepo) WithByPath(path string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("path = ?", path)
+	}
+}
+
+func (r *FileShareRepo) WithByCode(code string) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		return db.Where("token = ?", code)
+	}
+}
+
+func (r *FileShareRepo) Page(page, size int, opts ...DBOption) (int64, []model.FileShare, error) {
+	var (
+		items []model.FileShare
+		count int64
+	)
+	db := getDb(opts...).Model(&model.FileShare{})
+	db = db.Count(&count)
+	err := db.Order("path asc").Limit(size).Offset(size * (page - 1)).Find(&items).Error
+	return count, items, err
+}
+
+func (r *FileShareRepo) Create(fileShare *model.FileShare) error {
+	return global.DB.Create(fileShare).Error
+}
+
+func (r *FileShareRepo) Save(fileShare *model.FileShare) error {
+	return global.DB.Save(fileShare).Error
+}
+
+func (r *FileShareRepo) GetFirst(opts ...DBOption) (model.FileShare, error) {
+	var item model.FileShare
+	db := getDb(opts...).Model(&model.FileShare{})
+	if err := db.First(&item).Error; err != nil {
+		return item, err
+	}
+	return item, nil
+}
+
+func (r *FileShareRepo) Delete(opts ...DBOption) error {
+	db := getDb(opts...).Model(&model.FileShare{})
+	return db.Delete(&model.FileShare{}).Error
+}
+
+func (r *FileShareRepo) All() ([]model.FileShare, error) {
+	var items []model.FileShare
+	if err := getDb().Order("path asc").Find(&items).Error; err != nil {
+		return nil, err
+	}
+	return items, nil
+}

agent/app/repo/host.go

@@ -10,6 +10,18 @@ import (
 type HostRepo struct{}
 
 type IHostRepo interface {
+	Get(opts ...DBOption) (model.Host, error)
+	GetList(opts ...DBOption) ([]model.Host, error)
+	Page(limit, offset int, opts ...DBOption) (int64, []model.Host, error)
+	Create(host *model.Host) error
+	Update(id uint, vars map[string]interface{}) error
+	UpdateGroup(group, newGroup uint) error
+	Delete(opts ...DBOption) error
+
+	WithByInfo(info string) DBOption
+	WithByPort(port uint) DBOption
+	WithByUser(user string) DBOption
+
 	GetFirewallRecord(opts ...DBOption) (model.Firewall, error)
 	ListFirewallRecord(opts ...DBOption) ([]model.Firewall, error)
 	SaveFirewallRecord(firewall *model.Firewall) error
@@ -30,6 +42,80 @@ func NewIHostRepo() IHostRepo {
 	return &HostRepo{}
 }
 
+func (h *HostRepo) Get(opts ...DBOption) (model.Host, error) {
+	var host model.Host
+	db := global.DB
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	err := db.First(&host).Error
+	return host, err
+}
+
+func (h *HostRepo) GetList(opts ...DBOption) ([]model.Host, error) {
+	var hosts []model.Host
+	db := global.DB.Model(&model.Host{})
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	err := db.Find(&hosts).Error
+	return hosts, err
+}
+
+func (h *HostRepo) Page(page, size int, opts ...DBOption) (int64, []model.Host, error) {
+	var hosts []model.Host
+	db := global.DB.Model(&model.Host{})
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	count := int64(0)
+	db = db.Count(&count)
+	err := db.Limit(size).Offset(size * (page - 1)).Find(&hosts).Error
+	return count, hosts, err
+}
+
+func (h *HostRepo) WithByInfo(info string) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		if len(info) == 0 {
+			return g
+		}
+		infoStr := "%" + info + "%"
+		return g.Where("name LIKE ? OR addr LIKE ?", infoStr, infoStr)
+	}
+}
+
+func (h *HostRepo) WithByPort(port uint) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		return g.Where("port = ?", port)
+	}
+}
+
+func (h *HostRepo) WithByUser(user string) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		return g.Where("user = ?", user)
+	}
+}
+
+func (h *HostRepo) Create(host *model.Host) error {
+	return global.DB.Create(host).Error
+}
+
+func (h *HostRepo) Update(id uint, vars map[string]interface{}) error {
+	return global.DB.Model(&model.Host{}).Where("id = ?", id).Updates(vars).Error
+}
+
+func (h *HostRepo) UpdateGroup(group, newGroup uint) error {
+	return global.DB.Model(&model.Host{}).Where("group_id = ?", group).Updates(map[string]interface{}{"group_id": newGroup}).Error
+}
+
+func (h *HostRepo) Delete(opts ...DBOption) error {
+	db := global.DB
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	return db.Delete(&model.Host{}).Error
+}
+
 func (h *HostRepo) GetFirewallRecord(opts ...DBOption) (model.Firewall, error) {
 	var firewall model.Firewall
 	db := global.DB

agent/app/repo/website.go

@@ -10,6 +10,7 @@ import (
 
 type IWebsiteRepo interface {
 	WithAppInstallId(appInstallId uint) DBOption
+	WithAppInstallIds(appInstallIds []uint) DBOption
 	WithDomain(domain string) DBOption
 	WithAlias(alias string) DBOption
 	WithWebsiteSSLID(sslId uint) DBOption
@@ -48,6 +49,15 @@ func (w *WebsiteRepo) WithAppInstallId(appInstallID uint) DBOption {
 	}
 }
 
+func (w *WebsiteRepo) WithAppInstallIds(appInstallIDs []uint) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		if len(appInstallIDs) == 0 {
+			return db
+		}
+		return db.Where("app_install_id in (?)", appInstallIDs)
+	}
+}
+
 func (w *WebsiteRepo) WithRuntimeID(runtimeID uint) DBOption {
 	return func(db *gorm.DB) *gorm.DB {
 		return db.Where("runtime_id = ?", runtimeID)

agent/app/repo/website_domain.go

@@ -13,6 +13,7 @@ type WebsiteDomainRepo struct {
 
 type IWebsiteDomainRepo interface {
 	WithWebsiteId(websiteId uint) DBOption
+	WithWebsiteIds(websiteIds []uint) DBOption
 	WithPort(port int) DBOption
 	WithDomain(domain string) DBOption
 	WithDomainLike(domain string) DBOption
@@ -36,6 +37,15 @@ func (w WebsiteDomainRepo) WithWebsiteId(websiteId uint) DBOption {
 	}
 }
 
+func (w WebsiteDomainRepo) WithWebsiteIds(websiteIds []uint) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		if len(websiteIds) == 0 {
+			return db
+		}
+		return db.Where("website_id in (?)", websiteIds)
+	}
+}
+
 func (w WebsiteDomainRepo) WithPort(port int) DBOption {
 	return func(db *gorm.DB) *gorm.DB {
 		return db.Where("port = ?", port)

agent/app/service/agents_agents.go

@@ -0,0 +1,533 @@
+package service
+
+import (
+	"os"
+	"path"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
+)
+
+var agentMarkdownFileNames = []string{"AGENTS.md", "SOUL.md", "USER.md", "IDENTITY.md", "TOOLS.md", "HEARTBEAT.md", "BOOT.md", "BOOTSTRAP.md"}
+
+func (a AgentService) CreateRole(req dto.AgentRoleCreateReq) (*dto.AgentRoleCreateResp, error) {
+	_, install, err := a.loadAgentAndInstall(req.AgentID)
+	if err != nil {
+		return nil, err
+	}
+
+	args := []string{"exec", install.ContainerName, "openclaw", "agents", "add", req.Name}
+	workspace := "/home/node/.openclaw/workspace-agent_" + req.Name
+	agentDir := "/home/node/.openclaw/agents/" + req.Name
+	args = append(args, "--workspace", workspace)
+	if model := strings.TrimSpace(req.Model); model != "" {
+		args = append(args, "--model", model)
+	}
+	for _, binding := range req.Bindings {
+		channel := binding.Channel
+		if channel == "" {
+			continue
+		}
+		if accountID := binding.AccountID; accountID != "" {
+			channel = channel + ":" + accountID
+		}
+		args = append(args, "--bind", channel)
+	}
+	args = append(args, "--agent-dir", agentDir)
+	args = append(args, "--non-interactive", "--json")
+
+	mgr := cmd.NewCommandMgr(cmd.WithTimeout(5 * time.Minute))
+	output, err := mgr.RunWithStdout("docker", args...)
+	if err != nil {
+		return nil, err
+	}
+	return &dto.AgentRoleCreateResp{Output: strings.TrimSpace(output)}, nil
+}
+
+func (a AgentService) GetConfiguredAgents(req dto.AgentConfiguredAgentsReq) ([]dto.AgentConfiguredAgentItem, error) {
+	agent, _, conf, err := a.loadAgentConfig(req.AgentID)
+	if err != nil {
+		return nil, err
+	}
+	agents, ok := conf["agents"].(map[string]interface{})
+	if !ok {
+		return []dto.AgentConfiguredAgentItem{}, nil
+	}
+	rawList, ok := agents["list"].([]interface{})
+	if !ok {
+		return []dto.AgentConfiguredAgentItem{}, nil
+	}
+	result := make([]dto.AgentConfiguredAgentItem, 0, len(rawList))
+	baseDir := path.Join(global.Dir.AppInstallDir, agent.AgentType, agent.Name, "data")
+	for _, item := range rawList {
+		record, ok := item.(map[string]interface{})
+		if !ok {
+			continue
+		}
+		configured := extractConfiguredAgentItem(baseDir, record)
+		if strings.EqualFold(configured.ID, "main") {
+			continue
+		}
+		result = append(result, configured)
+	}
+	applyConfiguredAgentBindings(result, conf["bindings"])
+	return result, nil
+}
+
+func (a AgentService) GetRoleChannels(req dto.AgentRoleChannelsReq) ([]dto.AgentRoleChannelItem, error) {
+	_, _, conf, err := a.loadAgentConfig(req.AgentID)
+	if err != nil {
+		return nil, err
+	}
+	channels, ok := conf["channels"].(map[string]interface{})
+	if !ok || len(channels) == 0 {
+		return []dto.AgentRoleChannelItem{}, nil
+	}
+	boundBindings := loadBoundChannelBindings(conf["bindings"])
+	result := make([]dto.AgentRoleChannelItem, 0, len(channels))
+	for key := range channels {
+		if key == "" {
+			continue
+		}
+		accountIDs := extractRoleChannelAccountIDs(conf, key)
+		availableAccountIDs := filterAvailableChannelAccountIDs(boundBindings, key, accountIDs)
+		result = append(result, dto.AgentRoleChannelItem{
+			Name:       key,
+			Bound:      isRoleChannelFullyBound(boundBindings, key, accountIDs, availableAccountIDs),
+			AccountIDs: availableAccountIDs,
+		})
+	}
+	sort.Slice(result, func(i, j int) bool {
+		return result[i].Name < result[j].Name
+	})
+	return result, nil
+}
+
+func (a AgentService) DeleteRole(req dto.AgentRoleDeleteReq) error {
+	agent, install, conf, err := a.loadAgentConfig(req.AgentID)
+	if err != nil {
+		return err
+	}
+
+	baseDir := path.Join(global.Dir.AppInstallDir, agent.AgentType, agent.Name, "data")
+	if req.ID == "" {
+		return buserr.New("ErrRecordNotFound")
+	}
+	target, ok := findConfiguredAgentByID(baseDir, conf, req.ID)
+	if !ok {
+		return buserr.New("ErrRecordNotFound")
+	}
+
+	args := []string{"exec", install.ContainerName, "openclaw", "agents", "delete", req.ID, "--force"}
+
+	mgr := cmd.NewCommandMgr(cmd.WithTimeout(5 * time.Minute))
+	if _, err = mgr.RunWithStdout("docker", args...); err != nil {
+		return err
+	}
+	if target.Workspace != "" {
+		if err := os.RemoveAll(target.Workspace); err != nil {
+			return err
+		}
+	}
+	if target.AgentDir != "" {
+		if err := os.RemoveAll(target.AgentDir); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (a AgentService) BindRole(req dto.AgentRoleBindReq) error {
+	return a.operateRoleBinding(req, "bind")
+}
+
+func (a AgentService) UnbindRole(req dto.AgentRoleBindReq) error {
+	return a.operateRoleBinding(req, "unbind")
+}
+
+func (a AgentService) operateRoleBinding(req dto.AgentRoleBindReq, action string) error {
+	agent, install, conf, err := a.loadAgentConfig(req.AgentID)
+	if err != nil {
+		return err
+	}
+
+	baseDir := path.Join(global.Dir.AppInstallDir, agent.AgentType, agent.Name, "data")
+	if req.ID == "" {
+		return buserr.New("ErrRecordNotFound")
+	}
+	if _, ok := findConfiguredAgentByID(baseDir, conf, req.ID); !ok {
+		return buserr.New("ErrRecordNotFound")
+	}
+
+	binding := formatRoleBinding(req.Channel, req.AccountID)
+	if binding == "" {
+		return buserr.New("ErrInvalidParams")
+	}
+	args := []string{
+		"exec",
+		install.ContainerName,
+		"openclaw",
+		"agents",
+		action,
+		"--agent",
+		req.ID,
+		"--bind",
+		binding,
+	}
+	args = append(args, "--json")
+	mgr := cmd.NewCommandMgr(cmd.WithTimeout(5 * time.Minute))
+	_, err = mgr.RunWithStdout("docker", args...)
+	return err
+}
+
+func (a AgentService) GetRoleMarkdownFiles(req dto.AgentRoleMarkdownFilesReq) ([]dto.AgentRoleMarkdownFileItem, error) {
+	agent, err := loadOpenclawAgentByID(req.AgentID)
+	if err != nil {
+		return nil, err
+	}
+
+	baseDir := path.Join(global.Dir.AppInstallDir, agent.AgentType, agent.Name, "data")
+	workspaceDir, err := resolveMarkdownWorkspaceDir(baseDir, req.Workspace)
+	if err != nil {
+		return nil, err
+	}
+
+	items := make([]dto.AgentRoleMarkdownFileItem, 0, len(agentMarkdownFileNames))
+	for _, name := range agentMarkdownFileNames {
+		item := dto.AgentRoleMarkdownFileItem{
+			Name: name,
+		}
+		content, readErr := os.ReadFile(path.Join(workspaceDir, name))
+		if readErr == nil {
+			item.Content = string(content)
+		} else if !os.IsNotExist(readErr) {
+			return nil, readErr
+		}
+		items = append(items, item)
+	}
+	return items, nil
+}
+
+func (a AgentService) UpdateRoleMarkdownFiles(req dto.AgentRoleMarkdownFilesUpdateReq) error {
+	agent, install, err := a.loadOpenclawAgentAndInstall(req.AgentID)
+	if err != nil {
+		return err
+	}
+
+	baseDir := path.Join(global.Dir.AppInstallDir, agent.AgentType, agent.Name, "data")
+	dirPath, err := resolveMarkdownWorkspaceDir(baseDir, req.Workspace)
+	if err != nil {
+		return err
+	}
+	if err = os.MkdirAll(dirPath, 0755); err != nil {
+		return err
+	}
+	for _, item := range req.Files {
+		file := path.Join(dirPath, item.Name)
+		if err = os.WriteFile(file, []byte(item.Content), 0644); err != nil {
+			return err
+		}
+	}
+	if req.Restart {
+		return NewIAppInstalledService().Operate(request.AppInstalledOperate{
+			InstallId: install.ID,
+			Operate:   constant.Restart,
+		})
+	}
+	return nil
+}
+
+func extractConfiguredAgentItem(installDir string, record map[string]interface{}) dto.AgentConfiguredAgentItem {
+	item := dto.AgentConfiguredAgentItem{Bindings: []dto.AgentRoleBinding{}}
+	if id, ok := record["id"].(string); ok {
+		item.ID = id
+	} else if id, ok := record["agentId"].(string); ok {
+		item.ID = id
+	}
+	if name, ok := record["name"].(string); ok {
+		item.Name = name
+	}
+	if workspace, ok := record["workspace"].(string); ok {
+		item.Workspace = resolveRoleDir(installDir, workspace)
+	}
+	if model, ok := record["model"].(string); ok {
+		item.Model = model
+	}
+	if agentDir, ok := record["agentDir"].(string); ok {
+		item.AgentDir = agentDir
+	} else if agentDir, ok := record["agent_dir"].(string); ok {
+		item.AgentDir = agentDir
+	}
+	item.AgentDir = resolveRoleDir(installDir, item.AgentDir)
+	return item
+}
+
+func findConfiguredAgentByID(baseDir string, conf map[string]interface{}, id string) (dto.AgentConfiguredAgentItem, bool) {
+	agents, ok := conf["agents"].(map[string]interface{})
+	if !ok {
+		return dto.AgentConfiguredAgentItem{}, false
+	}
+	rawList, ok := agents["list"].([]interface{})
+	if !ok {
+		return dto.AgentConfiguredAgentItem{}, false
+	}
+	for _, item := range rawList {
+		record, ok := item.(map[string]interface{})
+		if !ok {
+			continue
+		}
+		configured := extractConfiguredAgentItem(baseDir, record)
+		if strings.EqualFold(configured.ID, id) {
+			return configured, true
+		}
+	}
+	return dto.AgentConfiguredAgentItem{}, false
+}
+
+func formatRoleBinding(channel, accountID string) string {
+	if channel == "" {
+		return ""
+	}
+	if accountID == "" {
+		return channel
+	}
+	return channel + ":" + accountID
+}
+
+func applyConfiguredAgentBindings(agents []dto.AgentConfiguredAgentItem, value interface{}) {
+	bindings, ok := value.([]interface{})
+	if !ok || len(agents) == 0 {
+		return
+	}
+	indexByID := make(map[string]int, len(agents))
+	indexByName := make(map[string]int, len(agents))
+	for i, agent := range agents {
+		if agent.ID != "" {
+			indexByID[agent.ID] = i
+		}
+		if agent.Name != "" {
+			indexByName[agent.Name] = i
+		}
+	}
+	for _, binding := range bindings {
+		record, ok := binding.(map[string]interface{})
+		if !ok {
+			continue
+		}
+		if bindingType, _ := record["type"].(string); !strings.EqualFold(bindingType, "route") {
+			continue
+		}
+		targetID, _ := record["agentId"].(string)
+		if targetID == "" {
+			continue
+		}
+		match, ok := record["match"].(map[string]interface{})
+		if !ok {
+			continue
+		}
+		channel, _ := match["channel"].(string)
+		if channel == "" {
+			continue
+		}
+		index, ok := indexByID[targetID]
+		if !ok {
+			index, ok = indexByName[targetID]
+		}
+		if !ok {
+			continue
+		}
+		accountID, _ := match["accountId"].(string)
+		if accountID == "" {
+			accountID, _ = record["accountId"].(string)
+		}
+		agents[index].Bindings = append(agents[index].Bindings, dto.AgentRoleBinding{
+			Channel:   channel,
+			AccountID: accountID,
+		})
+	}
+}
+
+func loadBoundChannelBindings(value interface{}) map[string]map[string]struct{} {
+	result := make(map[string]map[string]struct{})
+	bindings, ok := value.([]interface{})
+	if !ok {
+		return result
+	}
+	for _, binding := range bindings {
+		record, ok := binding.(map[string]interface{})
+		if !ok {
+			continue
+		}
+		if bindingType, _ := record["type"].(string); !strings.EqualFold(bindingType, "route") {
+			continue
+		}
+		match, ok := record["match"].(map[string]interface{})
+		if !ok {
+			continue
+		}
+		channel, _ := match["channel"].(string)
+		if channel == "" {
+			continue
+		}
+		accountID, _ := match["accountId"].(string)
+		if accountID == "" {
+			accountID, _ = record["accountId"].(string)
+		}
+		if _, ok := result[channel]; !ok {
+			result[channel] = make(map[string]struct{})
+		}
+		result[channel][accountID] = struct{}{}
+	}
+	return result
+}
+
+func extractRoleChannelAccountIDs(conf map[string]interface{}, channel string) []string {
+	switch channel {
+	case "feishu":
+		config := extractFeishuConfig(conf)
+		accountIDs := make([]string, 0, len(config.Bots))
+		for _, item := range config.Bots {
+			if accountID := item.AccountID; accountID != "" {
+				accountIDs = append(accountIDs, accountID)
+			}
+		}
+		sort.Strings(accountIDs)
+		return accountIDs
+	case "telegram":
+		config := extractTelegramConfig(conf)
+		accountIDs := make([]string, 0, len(config.Bots))
+		for _, item := range config.Bots {
+			if accountID := item.AccountID; accountID != "" {
+				accountIDs = append(accountIDs, accountID)
+			}
+		}
+		sort.Strings(accountIDs)
+		return accountIDs
+	case "discord":
+		config := extractDiscordConfig(conf)
+		accountIDs := make([]string, 0, len(config.Bots))
+		for _, item := range config.Bots {
+			if accountID := item.AccountID; accountID != "" {
+				accountIDs = append(accountIDs, accountID)
+			}
+		}
+		sort.Strings(accountIDs)
+		return accountIDs
+	case "qqbot":
+		config := extractQQBotConfig(conf)
+		accountIDs := make([]string, 0, len(config.Bots))
+		for _, item := range config.Bots {
+			if accountID := item.AccountID; accountID != "" {
+				accountIDs = append(accountIDs, accountID)
+			}
+		}
+		sort.Strings(accountIDs)
+		return accountIDs
+	case "dingtalk-connector":
+		config := extractDingTalkConfig(conf)
+		accountIDs := make([]string, 0, len(config.Bots))
+		for _, item := range config.Bots {
+			if accountID := item.AccountID; accountID != "" {
+				accountIDs = append(accountIDs, accountID)
+			}
+		}
+		sort.Strings(accountIDs)
+		return accountIDs
+	case "wecom":
+		return []string{}
+	default:
+		return extractRawChannelAccountIDs(getChannelConfig(conf, channel))
+	}
+}
+
+func filterAvailableChannelAccountIDs(bindings map[string]map[string]struct{}, channel string, accountIDs []string) []string {
+	channelBindings, ok := bindings[channel]
+	if !ok || len(channelBindings) == 0 {
+		return append([]string(nil), accountIDs...)
+	}
+	if _, ok := channelBindings[""]; ok {
+		return []string{}
+	}
+	result := make([]string, 0, len(accountIDs))
+	for _, accountID := range accountIDs {
+		if _, ok := channelBindings[accountID]; ok {
+			continue
+		}
+		result = append(result, accountID)
+	}
+	return result
+}
+
+func isRoleChannelFullyBound(bindings map[string]map[string]struct{}, channel string, allAccountIDs, availableAccountIDs []string) bool {
+	channelBindings, ok := bindings[channel]
+	if !ok || len(channelBindings) == 0 {
+		return false
+	}
+	if _, ok := channelBindings[""]; ok {
+		return true
+	}
+	if len(allAccountIDs) == 0 {
+		return true
+	}
+	return len(availableAccountIDs) == 0
+}
+
+func extractRawChannelAccountIDs(channel map[string]interface{}) []string {
+	if len(channel) == 0 {
+		return []string{}
+	}
+	accounts, ok := channel["accounts"].(map[string]interface{})
+	if !ok || len(accounts) == 0 {
+		return []string{}
+	}
+	result := make([]string, 0, len(accounts))
+	for key := range accounts {
+		if key == "" {
+			continue
+		}
+		result = append(result, key)
+	}
+	sort.Strings(result)
+	return result
+}
+
+func resolveRoleDir(installDir, workspace string) string {
+	if workspace == "" {
+		return ""
+	}
+	if strings.HasPrefix(workspace, "/home/node/.openclaw/workspace/") {
+		return strings.ReplaceAll(workspace, "/home/node/.openclaw", installDir)
+	}
+	return strings.ReplaceAll(workspace, "/home/node/.openclaw", path.Join(installDir, "conf"))
+}
+
+func resolveMarkdownWorkspaceDir(installDir, workspace string) (string, error) {
+	if workspace == "" {
+		return "", buserr.New("ErrRecordNotFound")
+	}
+
+	confDir := path.Join(installDir, "conf")
+	allowedOpenclawPrefixes := []string{
+		"/home/node/.openclaw/workspace/",
+		"/home/node/.openclaw/workspace-agent_",
+	}
+	for _, prefix := range allowedOpenclawPrefixes {
+		if strings.HasPrefix(workspace, prefix) {
+			return resolveRoleDir(installDir, workspace), nil
+		}
+	}
+
+	cleanWorkspace := path.Clean(workspace)
+	cleanConfDir := path.Clean(confDir)
+	if cleanWorkspace == cleanConfDir || strings.HasPrefix(cleanWorkspace, cleanConfDir+"/") {
+		return cleanWorkspace, nil
+	}
+	return "", buserr.New("ErrRecordNotFound")
+}

agent/app/service/agents_overview.go

@@ -0,0 +1,239 @@
+package service
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+)
+
+const (
+	openclawCronJobsRelativePath     = "data/conf/cron/jobs.json"
+	openclawSessionStoreRelativeGlob = "data/conf/agents/*/sessions/sessions.json"
+	openclawSessionFilesRelativeGlob = "data/conf/agents/*/sessions/*.jsonl"
+)
+
+func (a AgentService) GetOverview(req dto.AgentOverviewReq) (*dto.AgentOverview, error) {
+	agent, install, conf, err := a.loadOpenclawAgentConfig(req.AgentID)
+	if err != nil {
+		return nil, err
+	}
+
+	overview := &dto.AgentOverview{
+		Snapshot: dto.AgentOverviewSnapshot{
+			ContainerStatus: install.Status,
+			AppVersion:      install.Version,
+			DefaultModel:    extractOpenclawDefaultModel(conf),
+			ChannelCount:    countOpenclawConfiguredChannels(conf),
+		},
+	}
+	if overview.Snapshot.DefaultModel == "" {
+		overview.Snapshot.DefaultModel = agent.Model
+	}
+	if install.Status != constant.StatusRunning {
+		return overview, nil
+	}
+
+	var wg sync.WaitGroup
+	wg.Add(3)
+	go func() {
+		defer wg.Done()
+		skillCount, err := loadOpenclawOverviewSkillStats(install.ContainerName)
+		if err == nil {
+			overview.Snapshot.SkillCount = skillCount
+		}
+	}()
+	go func() {
+		defer wg.Done()
+		sessionCount, err := loadOpenclawOverviewSessionCount(install.GetPath())
+		if err == nil {
+			overview.Snapshot.SessionCount = sessionCount
+		}
+	}()
+	go func() {
+		defer wg.Done()
+		jobCount, err := loadOpenclawOverviewJobCount(install.GetPath())
+		if err == nil {
+			overview.Snapshot.JobCount = jobCount
+		}
+	}()
+	wg.Wait()
+
+	return overview, nil
+}
+
+func extractOpenclawDefaultModel(conf map[string]interface{}) string {
+	agents, ok := conf["agents"].(map[string]interface{})
+	if !ok {
+		return ""
+	}
+	defaults, ok := agents["defaults"].(map[string]interface{})
+	if !ok {
+		return ""
+	}
+	model, ok := defaults["model"].(map[string]interface{})
+	if !ok {
+		return ""
+	}
+	primary, _ := model["primary"].(string)
+	return strings.TrimSpace(primary)
+}
+
+func countOpenclawConfiguredChannels(conf map[string]interface{}) int {
+	channels, ok := conf["channels"].(map[string]interface{})
+	if !ok {
+		return 0
+	}
+	count := 0
+	for _, value := range channels {
+		channel, ok := value.(map[string]interface{})
+		if !ok || len(channel) == 0 {
+			continue
+		}
+		count++
+	}
+	return count
+}
+
+func loadOpenclawOverviewSkillStats(containerName string) (int, error) {
+	output, err := runDockerExecWithStdout(5*time.Minute, containerName, "sh", "-c", "openclaw skills list --json 2>&1")
+	if err != nil {
+		return 0, err
+	}
+	if strings.TrimSpace(output) == "" {
+		return 0, nil
+	}
+	skills, err := parseOpenclawSkillsList(output)
+	if err != nil {
+		return 0, err
+	}
+	return len(skills), nil
+}
+
+func loadOpenclawOverviewSessionCount(installPath string) (int, error) {
+	sessionStorePaths, err := filepath.Glob(filepath.Join(installPath, openclawSessionStoreRelativeGlob))
+	if err != nil {
+		return 0, err
+	}
+	total := 0
+	for _, sessionStorePath := range sessionStorePaths {
+		count, err := loadOpenclawSessionCountFromFile(sessionStorePath)
+		if err != nil {
+			continue
+		}
+		total += count
+	}
+	if total > 0 {
+		return total, nil
+	}
+	sessionFiles, err := filepath.Glob(filepath.Join(installPath, openclawSessionFilesRelativeGlob))
+	if err != nil {
+		return 0, err
+	}
+	return len(sessionFiles), nil
+}
+
+func loadOpenclawSessionCountFromFile(sessionStorePath string) (int, error) {
+	content, err := os.ReadFile(sessionStorePath)
+	if err != nil {
+		return 0, err
+	}
+	return parseOpenclawSessionCount(string(content))
+}
+
+func loadOpenclawOverviewJobCount(installPath string) (int, error) {
+	content, err := os.ReadFile(filepath.Join(installPath, openclawCronJobsRelativePath))
+	if err != nil {
+		if os.IsNotExist(err) {
+			return 0, nil
+		}
+		return 0, err
+	}
+	return parseOpenclawCronCount(string(content))
+}
+
+func parseOpenclawSessionCount(output string) (int, error) {
+	if strings.TrimSpace(output) == "" {
+		return 0, nil
+	}
+	var payload interface{}
+	if err := json.Unmarshal([]byte(strings.TrimSpace(output)), &payload); err != nil {
+		return 0, err
+	}
+	return countOpenclawSessions(payload), nil
+}
+
+func parseOpenclawCronCount(output string) (int, error) {
+	if strings.TrimSpace(output) == "" {
+		return 0, nil
+	}
+	var payload interface{}
+	if err := json.Unmarshal([]byte(strings.TrimSpace(output)), &payload); err != nil {
+		return 0, err
+	}
+	switch value := payload.(type) {
+	case []interface{}:
+		return len(value), nil
+	case map[string]interface{}:
+		if total, ok := value["total"].(float64); ok {
+			return int(total), nil
+		}
+		if jobs, ok := value["jobs"].([]interface{}); ok {
+			return len(jobs), nil
+		}
+		return len(value), nil
+	default:
+		return 0, nil
+	}
+}
+
+func countOpenclawSessions(payload interface{}) int {
+	switch value := payload.(type) {
+	case []interface{}:
+		return len(value)
+	case map[string]interface{}:
+		if count, ok := value["count"].(float64); ok {
+			return int(count)
+		}
+		if sessions, ok := value["sessions"]; ok {
+			return countOpenclawSessions(sessions)
+		}
+		count := 0
+		for _, item := range value {
+			switch typed := item.(type) {
+			case map[string]interface{}:
+				if looksLikeOpenclawSession(typed) {
+					count++
+				}
+			case string:
+				if strings.HasSuffix(strings.TrimSpace(typed), ".jsonl") {
+					count++
+				}
+			}
+		}
+		return count
+	default:
+		return 0
+	}
+}
+
+func looksLikeOpenclawSession(item map[string]interface{}) bool {
+	if _, ok := item["sessionFile"]; ok {
+		return true
+	}
+	if _, ok := item["agentId"]; ok {
+		return true
+	}
+	if _, ok := item["lastActivityTs"]; ok {
+		return true
+	}
+	if _, ok := item["updatedAt"]; ok {
+		return true
+	}
+	return false
+}

agent/app/service/agents_skills.go

@@ -0,0 +1,286 @@
+package service
+
+import (
+	"encoding/json"
+	"fmt"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/task"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
+)
+
+const clawhubGlobalRegistry = "https://clawhub.com"
+const clawhubChinaRegistry = "https://mirror-cn.clawhub.com"
+
+type openclawSkillsList struct {
+	Skills []openclawSkillListItem `json:"skills"`
+}
+
+type openclawSkillListItem struct {
+	Name        string `json:"name"`
+	Description string `json:"description"`
+	Source      string `json:"source"`
+	Bundled     bool   `json:"bundled"`
+	Disabled    bool   `json:"disabled"`
+}
+
+type openclawSkillInfo struct {
+	SkillKey string `json:"skillKey"`
+}
+
+type skillhubSearchPayload struct {
+	Skills  []dto.AgentSkillSearchItem `json:"skills"`
+	Results []dto.AgentSkillSearchItem `json:"results"`
+}
+
+var clawhubSearchLinePattern = regexp.MustCompile(`^(\S+)\s+(.+?)\s+\(([\d.]+)\)$`)
+var ansiEscapePattern = regexp.MustCompile(`\x1b\[[0-9;?]*[ -/]*[@-~]`)
+
+func (a AgentService) ListSkills(req dto.AgentIDReq) ([]dto.AgentSkillItem, error) {
+	_, install, err := a.loadOpenclawAgentAndInstall(req.AgentID)
+	if err != nil {
+		return nil, err
+	}
+	if err := ensureContainerRunning(install.ContainerName); err != nil {
+		return nil, err
+	}
+	output, err := runDockerExecWithStdout(5*time.Minute, install.ContainerName, "sh", "-c", "openclaw skills list --json 2>&1")
+	if err != nil {
+		return nil, err
+	}
+	if len(output) == 0 {
+		return nil, nil
+	}
+	return parseOpenclawSkillsList(output)
+}
+
+func (a AgentService) SearchSkills(req dto.AgentSkillSearchReq) ([]dto.AgentSkillSearchItem, error) {
+	_, install, err := a.loadOpenclawAgentAndInstall(req.AgentID)
+	if err != nil {
+		return nil, err
+	}
+	if err := ensureContainerRunning(install.ContainerName); err != nil {
+		return nil, err
+	}
+	output, err := loadOpenclawSkillSearchOutput(install.ContainerName, req.Source, req.Keyword)
+	if err != nil {
+		return nil, err
+	}
+	if len(output) == 0 {
+		return nil, nil
+	}
+	switch req.Source {
+	case "skillhub":
+		return parseSkillhubSearchResult(output)
+	default:
+		return parseClawhubSearchResult(output, req.Source), nil
+	}
+}
+
+func (a AgentService) UpdateSkill(req dto.AgentSkillUpdateReq) error {
+	agent, install, err := a.loadOpenclawAgentAndInstall(req.AgentID)
+	if err != nil {
+		return err
+	}
+	if err := ensureContainerRunning(install.ContainerName); err != nil {
+		return err
+	}
+	conf, err := readOpenclawConfig(agent.ConfigPath)
+	if err != nil {
+		return err
+	}
+	skillKey, err := getOpenclawSkillKey(install.ContainerName, req.Name)
+	if err != nil {
+		return err
+	}
+	setOpenclawSkillEnabled(conf, skillKey, req.Enabled)
+	return writeOpenclawConfigRaw(agent.ConfigPath, conf)
+}
+
+func (a AgentService) InstallSkill(req dto.AgentSkillInstallReq) error {
+	_, install, err := a.loadOpenclawAgentAndInstall(req.AgentID)
+	if err != nil {
+		return err
+	}
+	if err := ensureContainerRunning(install.ContainerName); err != nil {
+		return err
+	}
+	installTask, err := task.NewTaskWithOps(req.Slug, task.TaskInstall, task.TaskScopeAI, req.TaskID, req.AgentID)
+	if err != nil {
+		return err
+	}
+	installTask.AddSubTask("Install OpenClaw skill", func(t *task.Task) error {
+		mgr := cmd.NewCommandMgr(cmd.WithTask(*t), cmd.WithContext(t.TaskCtx), cmd.WithTimeout(20*time.Minute))
+		return mgr.Run("docker", "exec", install.ContainerName, "sh", "-c", buildOpenclawSkillInstallCommand(req.Source, req.Slug))
+	}, nil)
+	go func() {
+		if err := installTask.Execute(); err != nil {
+			global.LOG.Errorf("install openclaw skill failed: %v", err)
+		}
+	}()
+	return nil
+}
+
+func parseOpenclawSkillsList(output string) ([]dto.AgentSkillItem, error) {
+	payloadBytes, err := extractEmbeddedJSON(output)
+	if err != nil {
+		return nil, err
+	}
+	if len(payloadBytes) == 0 {
+		return nil, nil
+	}
+	var payload openclawSkillsList
+	if err := json.Unmarshal(payloadBytes, &payload); err != nil {
+		return nil, err
+	}
+	items := make([]dto.AgentSkillItem, 0, len(payload.Skills))
+	for _, item := range payload.Skills {
+		items = append(items, dto.AgentSkillItem{
+			Name:        item.Name,
+			Description: item.Description,
+			Source:      item.Source,
+			Bundled:     item.Bundled,
+			Disabled:    item.Disabled,
+		})
+	}
+	return items, nil
+}
+
+func loadOpenclawSkillSearchOutput(containerName, source, keyword string) (string, error) {
+	switch source {
+	case "skillhub":
+		return runDockerExecWithStdout(2*time.Minute, containerName, "skillhub", "search", keyword, "--json")
+	default:
+		return runDockerExecWithStdout(
+			2*time.Minute,
+			containerName,
+			"sh",
+			"-c",
+			fmt.Sprintf("CLAWHUB_REGISTRY=%q clawhub search %q", resolveClawhubRegistry(source), keyword),
+		)
+	}
+}
+
+func parseSkillhubSearchResult(output string) ([]dto.AgentSkillSearchItem, error) {
+	trimmed := strings.TrimSpace(output)
+	if trimmed == "" {
+		return nil, nil
+	}
+	var list []dto.AgentSkillSearchItem
+	if err := json.Unmarshal([]byte(trimmed), &list); err == nil {
+		for i := range list {
+			list[i].Source = "skillhub"
+		}
+		return list, nil
+	}
+	var payload skillhubSearchPayload
+	if err := json.Unmarshal([]byte(trimmed), &payload); err != nil {
+		return nil, err
+	}
+	items := payload.Skills
+	if len(items) == 0 {
+		items = payload.Results
+	}
+	for i := range items {
+		items[i].Source = "skillhub"
+	}
+	return items, nil
+}
+
+func parseClawhubSearchResult(output, source string) []dto.AgentSkillSearchItem {
+	lines := strings.Split(strings.TrimSpace(output), "\n")
+	items := make([]dto.AgentSkillSearchItem, 0, len(lines))
+	for _, line := range lines {
+		matches := clawhubSearchLinePattern.FindStringSubmatch(strings.TrimSpace(line))
+		if len(matches) != 4 {
+			continue
+		}
+		items = append(items, dto.AgentSkillSearchItem{
+			Slug:   matches[1],
+			Name:   matches[2],
+			Score:  matches[3],
+			Source: source,
+		})
+	}
+	return items
+}
+
+func buildOpenclawSkillInstallCommand(source, slug string) string {
+	switch source {
+	case "clawhub-global", "clawhub-cn":
+		return fmt.Sprintf(
+			"mkdir -p %s && CLAWHUB_REGISTRY=%q clawhub --workdir /home/node/.openclaw --dir skills install %q",
+			openclawManagedSkillsDir,
+			resolveClawhubRegistry(source),
+			slug,
+		)
+	default:
+		return fmt.Sprintf(
+			"mkdir -p %s && skillhub --dir %s install %q",
+			openclawManagedSkillsDir,
+			openclawManagedSkillsDir,
+			slug,
+		)
+	}
+}
+
+func resolveClawhubRegistry(source string) string {
+	switch source {
+	case "clawhub-cn":
+		return clawhubChinaRegistry
+	default:
+		return clawhubGlobalRegistry
+	}
+}
+
+func getOpenclawSkillKey(containerName, name string) (string, error) {
+	output, err := runDockerExecWithStdout(2*time.Minute, containerName, "sh", "-c", fmt.Sprintf("openclaw skills info %q --json 2>&1", name))
+	if err != nil {
+		return "", err
+	}
+	return parseOpenclawSkillKey(name, output)
+}
+
+func parseOpenclawSkillKey(name, output string) (string, error) {
+	payloadBytes, err := extractEmbeddedJSON(output)
+	if err != nil {
+		return "", err
+	}
+	var payload openclawSkillInfo
+	if err := json.Unmarshal(payloadBytes, &payload); err != nil {
+		return "", err
+	}
+	if payload.SkillKey == "" {
+		return "", fmt.Errorf("skill %s does not have a skillKey", name)
+	}
+	return payload.SkillKey, nil
+}
+
+func extractEmbeddedJSON(output string) ([]byte, error) {
+	trimmed := strings.TrimSpace(ansiEscapePattern.ReplaceAllString(output, ""))
+	if trimmed == "" {
+		return nil, nil
+	}
+	for i := 0; i < len(trimmed); i++ {
+		if trimmed[i] != '{' && trimmed[i] != '[' {
+			continue
+		}
+		decoder := json.NewDecoder(strings.NewReader(trimmed[i:]))
+		var raw json.RawMessage
+		if err := decoder.Decode(&raw); err == nil {
+			return raw, nil
+		}
+	}
+	return nil, fmt.Errorf("json payload not found")
+}
+
+func setOpenclawSkillEnabled(conf map[string]interface{}, skillKey string, enabled bool) {
+	skills := ensureChildMap(conf, "skills")
+	entries := ensureChildMap(skills, "entries")
+	entry := ensureChildMap(entries, skillKey)
+	entry["enabled"] = enabled
+}

agent/app/service/agents_website.go

@@ -0,0 +1,315 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"sort"
+	"strings"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/app/repo"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"gorm.io/gorm"
+)
+
+func (a AgentService) BindWebsite(req dto.AgentWebsiteBindReq) error {
+	agent, err := agentRepo.GetFirst(repo.WithByID(req.AgentID))
+	if err != nil {
+		return err
+	}
+	if agent.WebsiteID != 0 {
+		return buserr.New("ErrAgentWebsiteBound")
+	}
+
+	website, err := websiteRepo.GetFirst(repo.WithByID(req.WebsiteID))
+	if err != nil {
+		return err
+	}
+	if !isBindableAgentWebsiteType(website.Type) {
+		return buserr.New("ErrAgentWebsiteTypeUnsupported")
+	}
+
+	boundAgent, err := agentRepo.GetFirst(repo.WithByWebsiteID(req.WebsiteID))
+	if err == nil && boundAgent.ID > 0 {
+		return buserr.New("ErrAgentWebsiteInUse")
+	}
+	if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
+		return err
+	}
+
+	agent.WebsiteID = req.WebsiteID
+	if err := agentRepo.Save(agent); err != nil {
+		return err
+	}
+	return ensureOpenclawWebsiteAllowedOrigin(agent, &website)
+}
+
+func hydrateAgentWebsiteItems(items []dto.AgentItem) error {
+	explicitWebsiteMap, err := loadAgentWebsiteMapByID(items)
+	if err != nil {
+		return err
+	}
+	websiteDomainMap, err := loadAgentWebsiteDomainMapByWebsiteID(items)
+	if err != nil {
+		return err
+	}
+	fillAgentWebsiteItems(items, explicitWebsiteMap, websiteDomainMap)
+	return nil
+}
+
+func loadAgentWebsiteMapByID(items []dto.AgentItem) (map[uint]model.Website, error) {
+	websiteIDs := make([]uint, 0, len(items))
+	for _, item := range items {
+		if item.WebsiteID > 0 {
+			websiteIDs = append(websiteIDs, item.WebsiteID)
+		}
+	}
+	if len(websiteIDs) == 0 {
+		return map[uint]model.Website{}, nil
+	}
+	websites, err := websiteRepo.GetBy(repo.WithByIDs(uniqueUintList(websiteIDs)))
+	if err != nil {
+		return nil, err
+	}
+	websiteMap := make(map[uint]model.Website, len(websites))
+	for _, website := range websites {
+		websiteMap[website.ID] = website
+	}
+	return websiteMap, nil
+}
+
+func loadAgentWebsiteDomainMapByWebsiteID(items []dto.AgentItem) (map[uint][]model.WebsiteDomain, error) {
+	websiteIDs := make([]uint, 0, len(items))
+	for _, item := range items {
+		if item.WebsiteID > 0 {
+			websiteIDs = append(websiteIDs, item.WebsiteID)
+		}
+	}
+	if len(websiteIDs) == 0 {
+		return map[uint][]model.WebsiteDomain{}, nil
+	}
+	websiteDomains, err := websiteDomainRepo.GetBy(websiteDomainRepo.WithWebsiteIds(uniqueUintList(websiteIDs)), repo.WithOrderAsc("id"))
+	if err != nil {
+		return nil, err
+	}
+	websiteDomainMap := make(map[uint][]model.WebsiteDomain, len(websiteDomains))
+	for _, websiteDomain := range websiteDomains {
+		websiteDomainMap[websiteDomain.WebsiteID] = append(websiteDomainMap[websiteDomain.WebsiteID], websiteDomain)
+	}
+	return websiteDomainMap, nil
+}
+
+func loadAgentWebsiteResourceName(website model.Website) (string, error) {
+	websiteDomains, err := websiteDomainRepo.GetBy(websiteDomainRepo.WithWebsiteId(website.ID), repo.WithOrderAsc("id"))
+	if err != nil {
+		return "", err
+	}
+	if len(websiteDomains) > 0 {
+		return websiteDomains[0].Domain, nil
+	}
+	if website.PrimaryDomain != "" {
+		return website.PrimaryDomain, nil
+	}
+	return fmt.Sprintf("%d", website.ID), nil
+}
+
+func fillAgentWebsiteItems(items []dto.AgentItem, explicitWebsiteMap map[uint]model.Website, websiteDomainMap map[uint][]model.WebsiteDomain) {
+	for index := range items {
+		if items[index].WebsiteID == 0 {
+			continue
+		}
+		website, ok := explicitWebsiteMap[items[index].WebsiteID]
+		if !ok {
+			items[index].WebsiteID = 0
+			items[index].WebsitePrimaryDomain = ""
+			items[index].WebsiteProtocol = ""
+			continue
+		}
+		items[index].WebsiteProtocol = website.Protocol
+		websiteDomains := websiteDomainMap[items[index].WebsiteID]
+		if len(websiteDomains) == 0 {
+			items[index].WebsitePrimaryDomain = ""
+			continue
+		}
+		items[index].WebsitePrimaryDomain = websiteDomains[0].Domain
+	}
+}
+
+func uniqueDeploymentWebsiteMapByAppInstall(websites []model.Website) map[uint]model.Website {
+	websiteMap := make(map[uint]model.Website)
+	duplicateAppInstallIDs := make(map[uint]struct{})
+	for _, website := range websites {
+		if website.AppInstallID == 0 {
+			continue
+		}
+		if _, duplicated := duplicateAppInstallIDs[website.AppInstallID]; duplicated {
+			continue
+		}
+		if _, exists := websiteMap[website.AppInstallID]; exists {
+			delete(websiteMap, website.AppInstallID)
+			duplicateAppInstallIDs[website.AppInstallID] = struct{}{}
+			continue
+		}
+		websiteMap[website.AppInstallID] = website
+	}
+	return websiteMap
+}
+
+func UniqueDeploymentWebsiteMapForMigration(websites []model.Website) map[uint]model.Website {
+	return uniqueDeploymentWebsiteMapByAppInstall(websites)
+}
+
+func uniqueUintList(items []uint) []uint {
+	itemMap := make(map[uint]struct{}, len(items))
+	uniq := make([]uint, 0, len(items))
+	for _, item := range items {
+		if item == 0 {
+			continue
+		}
+		if _, exists := itemMap[item]; exists {
+			continue
+		}
+		itemMap[item] = struct{}{}
+		uniq = append(uniq, item)
+	}
+	return uniq
+}
+
+func isBindableAgentWebsiteType(websiteType string) bool {
+	return websiteType == constant.Proxy || websiteType == constant.Static
+}
+
+func bindDeploymentWebsiteToAgentByAppInstall(website *model.Website) error {
+	if website.ID == 0 || website.Type != constant.Deployment || website.AppInstallID == 0 {
+		return nil
+	}
+
+	appInstall, err := appInstallRepo.GetFirst(repo.WithByID(website.AppInstallID))
+	if err != nil {
+		return err
+	}
+	if appInstall.App.Key != constant.AppOpenclaw && appInstall.App.Key != constant.AppCopaw {
+		return nil
+	}
+
+	agent, err := agentRepo.GetFirst(repo.WithByAppInstallID(website.AppInstallID))
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	if agent.WebsiteID != 0 {
+		return nil
+	}
+
+	agent.WebsiteID = website.ID
+	if err := agentRepo.Save(agent); err != nil {
+		return err
+	}
+	return ensureOpenclawWebsiteAllowedOrigin(agent, website)
+}
+
+func ensureOpenclawWebsiteAllowedOrigin(agent *model.Agent, website *model.Website) error {
+	if agent == nil || website == nil || agent.AgentType == constant.AppCopaw {
+		return nil
+	}
+
+	origins, err := buildWebsiteAllowedOrigins(website)
+	if err != nil {
+		return err
+	}
+	if len(origins) == 0 {
+		return nil
+	}
+
+	install, err := appInstallRepo.GetFirst(repo.WithByID(agent.AppInstallID))
+	if err != nil {
+		return err
+	}
+	conf, err := readOpenclawConfig(agent.ConfigPath)
+	if err != nil {
+		return err
+	}
+
+	allowedOrigins := extractSecurityConfig(conf).AllowedOrigins
+	allowedOrigins, err = normalizeAllowedOrigins(append(allowedOrigins, origins...))
+	if err != nil {
+		return err
+	}
+	setSecurityConfig(conf, dto.AgentSecurityConfig{AllowedOrigins: allowedOrigins})
+	if err := writeOpenclawConfigRaw(agent.ConfigPath, conf); err != nil {
+		return err
+	}
+	if err := syncOpenclawAllowedOriginEnv(&install, allowedOrigins); err != nil {
+		return err
+	}
+	return appInstallRepo.Save(context.Background(), &install)
+}
+
+func buildWebsiteAllowedOrigins(website *model.Website) ([]string, error) {
+	websiteDomains, err := websiteDomainRepo.GetBy(websiteDomainRepo.WithWebsiteId(website.ID), repo.WithOrderAsc("id"))
+	if err != nil {
+		return nil, err
+	}
+	if len(websiteDomains) == 0 {
+		return nil, nil
+	}
+	defaultHTTPSPort := 443
+	if strings.EqualFold(website.Protocol, "https") {
+		nginxInstall, err := getAppInstallByKey(constant.AppOpenresty)
+		if err == nil && nginxInstall.HttpsPort > 0 {
+			defaultHTTPSPort = nginxInstall.HttpsPort
+		}
+	}
+	return buildWebsiteAllowedOriginsFromDomains(website, websiteDomains, defaultHTTPSPort)
+}
+
+func buildWebsiteAllowedOriginsFromDomains(website *model.Website, websiteDomains []model.WebsiteDomain, defaultHTTPSPort int) ([]string, error) {
+	if len(websiteDomains) == 0 {
+		return nil, nil
+	}
+	sort.Slice(websiteDomains, func(i, j int) bool {
+		return websiteDomains[i].ID < websiteDomains[j].ID
+	})
+	origins := make([]string, 0, len(websiteDomains))
+	for _, websiteDomain := range websiteDomains {
+		origin, err := buildWebsiteDomainOrigin(website.Protocol, websiteDomain, defaultHTTPSPort)
+		if err != nil {
+			return nil, err
+		}
+		origins = append(origins, origin)
+	}
+	return origins, nil
+}
+
+func buildWebsiteDomainOrigin(protocol string, websiteDomain model.WebsiteDomain, defaultHTTPSPort int) (string, error) {
+	origin := strings.ToLower(strings.TrimSpace(protocol)) + "://" + formatWebsiteDomainHost(websiteDomain.Domain)
+	switch strings.ToLower(strings.TrimSpace(protocol)) {
+	case "http":
+		if websiteDomain.Port > 0 && websiteDomain.Port != 80 {
+			origin = fmt.Sprintf("%s:%d", origin, websiteDomain.Port)
+		}
+	case "https":
+		port := websiteDomain.Port
+		if !websiteDomain.SSL {
+			port = defaultHTTPSPort
+		}
+		if port > 0 && port != 443 {
+			origin = fmt.Sprintf("%s:%d", origin, port)
+		}
+	}
+	return normalizeAllowedOrigin(origin)
+}
+
+func formatWebsiteDomainHost(domain string) string {
+	host := strings.Trim(strings.TrimSpace(domain), "[]")
+	if ip := net.ParseIP(host); ip != nil && strings.Contains(host, ":") {
+		return "[" + host + "]"
+	}
+	return host
+}

agent/app/service/ai.go

@@ -1,11 +1,14 @@
 package service
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"os"
+	"os/exec"
 	"path"
 	"strings"
+	"syscall"
 	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
@@ -19,6 +22,7 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/i18n"
 	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
 	"github.com/1Panel-dev/1Panel/agent/utils/common"
+	"github.com/1Panel-dev/1Panel/agent/utils/re"
 	"github.com/jinzhu/copier"
 )
 
@@ -107,8 +111,7 @@ func (u *AIToolService) Create(req dto.OllamaModelName) error {
 	}
 	go func() {
 		taskItem.AddSubTask(i18n.GetWithName("OllamaModelPull", req.Name), func(t *task.Task) error {
-			cmdMgr := cmd.NewCommandMgr(cmd.WithTask(*taskItem), cmd.WithTimeout(time.Hour))
-			return cmdMgr.Run("docker", "exec", containerName, "ollama", "pull", info.Name)
+			return runOllamaPullWithProcess(t, containerName, info.Name)
 		}, nil)
 		taskItem.AddSubTask(i18n.GetWithName("OllamaModelSize", req.Name), func(t *task.Task) error {
 			itemSize, err := loadModelSize(info.Name, containerName)
@@ -162,8 +165,7 @@ func (u *AIToolService) Recreate(req dto.OllamaModelName) error {
 	}
 	go func() {
 		taskItem.AddSubTask(i18n.GetWithName("OllamaModelPull", req.Name), func(t *task.Task) error {
-			cmdMgr := cmd.NewCommandMgr(cmd.WithTask(*taskItem), cmd.WithTimeout(time.Hour))
-			return cmdMgr.Run("docker", "exec", containerName, "ollama", "pull", req.Name)
+			return runOllamaPullWithProcess(t, containerName, req.Name)
 		}, nil)
 		taskItem.AddSubTask(i18n.GetWithName("OllamaModelSize", req.Name), func(t *task.Task) error {
 			itemSize, err := loadModelSize(modelInfo.Name, containerName)
@@ -394,3 +396,127 @@ func loadModelSize(name string, containerName string) (string, error) {
 	}
 	return "", fmt.Errorf("no such model %s in ollama list, std: %s", name, stdout)
 }
+
+func runOllamaPullWithProcess(taskItem *task.Task, containerName, modelName string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), time.Hour)
+	defer cancel()
+
+	cmdItem := exec.CommandContext(ctx, "docker", "exec", containerName, "ollama", "pull", modelName)
+	cmdItem.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+	writer := &ollamaPullLogWriter{taskItem: taskItem}
+	cmdItem.Stdout = writer
+	cmdItem.Stderr = writer
+
+	if err := cmdItem.Start(); err != nil {
+		return fmt.Errorf("failed to start ollama pull %s: %w", modelName, err)
+	}
+	waitErr := cmdItem.Wait()
+	writer.Flush()
+	if ctx.Err() == context.DeadlineExceeded {
+		if cmdItem.Process != nil && cmdItem.Process.Pid > 0 {
+			_ = syscall.Kill(-cmdItem.Process.Pid, syscall.SIGKILL)
+		}
+		return buserr.New("ErrCmdTimeout")
+	}
+	if waitErr == nil {
+		return nil
+	}
+	if len(strings.TrimSpace(writer.errBuf.String())) > 0 {
+		return fmt.Errorf("%s", strings.TrimSpace(writer.errBuf.String()))
+	}
+	return waitErr
+}
+
+type ollamaPullLogWriter struct {
+	taskItem *task.Task
+	errBuf   bytes.Buffer
+}
+
+func (w *ollamaPullLogWriter) Write(p []byte) (n int, err error) {
+	w.errBuf.Write(p)
+	for _, segment := range splitOllamaPullSegments(string(p)) {
+		w.logLine(segment)
+	}
+	return len(p), nil
+}
+
+func (w *ollamaPullLogWriter) Flush() {}
+
+func (w *ollamaPullLogWriter) logLine(line string) {
+	if w == nil || w.taskItem == nil {
+		return
+	}
+	line = sanitizeOllamaPullLine(line)
+	if line == "" {
+		return
+	}
+	if prefix := resolveOllamaPullLogPrefix(line); prefix != "" {
+		_ = replaceOllamaPullLogLine(prefix, line, w.taskItem)
+		return
+	}
+	w.taskItem.Log(line)
+}
+
+func sanitizeOllamaPullLine(line string) string {
+	line = re.StripAnsiControlSeq(line)
+	line = strings.TrimSpace(line)
+	if strings.HasPrefix(line, "pulling manifes") {
+		return ""
+	}
+	return line
+}
+
+func splitOllamaPullSegments(chunk string) []string {
+	if chunk == "" {
+		return nil
+	}
+	chunk = strings.ReplaceAll(chunk, "\r", "\n")
+	parts := strings.Split(chunk, "\x1b[1G")
+	segments := make([]string, 0, len(parts))
+	for _, part := range parts {
+		for _, line := range strings.Split(part, "\n") {
+			line = strings.TrimSpace(line)
+			if line == "" {
+				continue
+			}
+			segments = append(segments, line)
+		}
+	}
+	return segments
+}
+
+func resolveOllamaPullLogPrefix(line string) string {
+	if strings.HasPrefix(line, "pulling ") {
+		if idx := strings.Index(line, ":"); idx > 0 {
+			return strings.TrimSpace(line[:idx])
+		}
+		fields := strings.Fields(line)
+		if len(fields) >= 2 {
+			return strings.TrimSpace(fields[0] + " " + fields[1])
+		}
+	}
+	return ""
+}
+
+func replaceOllamaPullLogLine(prefix, newLine string, taskItem *task.Task) error {
+	if taskItem == nil || taskItem.Task == nil {
+		return nil
+	}
+	data, err := os.ReadFile(taskItem.Task.LogFile)
+	if err != nil {
+		return err
+	}
+	lines := strings.Split(string(data), "\n")
+	for idx, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		if trimmed == "" {
+			continue
+		}
+		if strings.Contains(trimmed, prefix) {
+			lines[idx] = time.Now().Format("2006/01/02 15:04:05") + " " + newLine
+			return os.WriteFile(taskItem.Task.LogFile, []byte(strings.Join(lines, "\n")), os.ModePerm)
+		}
+	}
+	taskItem.Log(newLine)
+	return nil
+}

agent/app/service/alert.go

@@ -15,6 +15,7 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/utils/email"
 	"github.com/1Panel-dev/1Panel/agent/utils/xpack"
 	"github.com/shirou/gopsutil/v4/disk"
+	"mime"
 	"sort"
 	"strings"
 	"sync"
@@ -483,13 +484,14 @@ func (a AlertService) TestAlertConfig(req dto.AlertConfigTest) (bool, error) {
 	if username == "" {
 		username = req.Sender
 	}
+	encodedDisplayName := mime.BEncoding.Encode("UTF-8", req.DisplayName)
 	cfg := email.SMTPConfig{
 		Host:       req.Host,
 		Port:       req.Port,
 		Sender:     req.Sender,
 		Username:   username,
 		Password:   req.Password,
-		From:       fmt.Sprintf(`"%s" <%s>`, req.DisplayName, req.Sender),
+		From:       fmt.Sprintf(`"%s" <%s>`, encodedDisplayName, req.Sender),
 		Encryption: req.Encryption,
 		Recipient:  req.Recipient,
 	}

agent/app/service/alert_helper.go

@@ -3,6 +3,12 @@ package service
 import (
 	"encoding/json"
 	"fmt"
+	"math"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/model"
 	"github.com/1Panel-dev/1Panel/agent/app/repo"
@@ -18,11 +24,6 @@ import (
 	"github.com/shirou/gopsutil/v4/load"
 	"github.com/shirou/gopsutil/v4/mem"
 	"github.com/shirou/gopsutil/v4/net"
-	"math"
-	"sort"
-	"strconv"
-	"strings"
-	"time"
 )
 
 const (
@@ -423,25 +424,19 @@ func loadDiskUsage(alert dto.AlertDTO) {
 	}
 	if isAlertDue(newDate) {
 		if strings.Contains(alert.Project, "all") {
-			err = processAllDisks(alert)
+			_ = processAllDisks(alert)
 		} else {
-			err = processSingleDisk(alert)
+			_ = processSingleDisk(alert)
 		}
 	}
 }
 
 func loadPanelLogin(alert dto.AlertDTO) {
 	count, isAlert, err := alertUtil.CountRecentFailedLoginLogs(alert.Cycle, alert.Count)
-	alertType := alert.Type
-	quota := strconv.Itoa(count)
-	quotaType := strconv.Itoa(int(alert.Cycle))
 	if err != nil {
 		global.LOG.Errorf("Failed to count recent failed login logs: %v", err)
 	}
 	if isAlert {
-		alertType = "panelLogin"
-		quota = strconv.Itoa(count)
-		quotaType = "panelLogin"
 		params := []dto.Param{
 			{
 				Index: "1",
@@ -454,7 +449,7 @@ func loadPanelLogin(alert dto.AlertDTO) {
 				Value: "",
 			},
 		}
-		sendAlerts(alert, alertType, quota, quotaType, params)
+		sendAlerts(alert, "panelLogin", strconv.Itoa(count), "panelLogin", params)
 	}
 
 	whitelist := strings.Split(strings.TrimSpace(alert.AdvancedParams), "\n")
@@ -463,15 +458,13 @@ func loadPanelLogin(alert dto.AlertDTO) {
 		global.LOG.Errorf("Failed to check recent failed ip login logs: %v", err)
 	}
 	if len(records) > 0 {
-		quota = strings.Join(func() []string {
+		quota := strings.Join(func() []string {
 			var ips []string
 			for _, r := range records {
 				ips = append(ips, r.IP)
 			}
 			return ips
 		}(), "\n")
-		alertType = "panelIpLogin"
-		quotaType = "panelIpLogin"
 		params := []dto.Param{
 			{
 				Index: "1",
@@ -484,22 +477,16 @@ func loadPanelLogin(alert dto.AlertDTO) {
 				Value: " IP ",
 			},
 		}
-		sendAlerts(alert, alertType, quota, quotaType, params)
+		sendAlerts(alert, "panelIpLogin", quota, "panelIpLogin", params)
 	}
 }
 
 func loadSSHLogin(alert dto.AlertDTO) {
 	count, isAlert, err := alertUtil.CountRecentFailedSSHLog(alert.Cycle, alert.Count)
-	alertType := alert.Type
-	quota := strconv.Itoa(count)
-	quotaType := strconv.Itoa(int(alert.Cycle))
 	if err != nil {
 		global.LOG.Errorf("Failed to count recent failed ssh login logs: %v", err)
 	}
 	if isAlert {
-		alertType = "sshLogin"
-		quota = strconv.Itoa(count)
-		quotaType = "sshLogin"
 		params := []dto.Param{
 			{
 				Index: "1",
@@ -512,7 +499,7 @@ func loadSSHLogin(alert dto.AlertDTO) {
 				Value: "",
 			},
 		}
-		sendAlerts(alert, alertType, quota, quotaType, params)
+		sendAlerts(alert, "sshLogin", strconv.Itoa(count), "sshLogin", params)
 	}
 	whitelist := strings.Split(strings.TrimSpace(alert.AdvancedParams), "\n")
 	records, err := alertUtil.FindRecentSuccessLoginNotInWhitelist(30, whitelist)
@@ -520,9 +507,7 @@ func loadSSHLogin(alert dto.AlertDTO) {
 		global.LOG.Errorf("Failed to check recent failed ip ssh login logs: %v", err)
 	}
 	if len(records) > 0 {
-		quota = strings.Join(records, "\n")
-		alertType = "sshIpLogin"
-		quotaType = "sshIpLogin"
+		quota := strings.Join(records, "\n")
 		params := []dto.Param{
 			{
 				Index: "1",
@@ -535,7 +520,7 @@ func loadSSHLogin(alert dto.AlertDTO) {
 				Value: " IP ",
 			},
 		}
-		sendAlerts(alert, alertType, quota, quotaType, params)
+		sendAlerts(alert, "sshIpLogin", quota, "sshIpLogin", params)
 	}
 }
 
@@ -665,6 +650,28 @@ func sendAlerts(alert dto.AlertDTO, alertType, quota, quotaType string, params [
 					continue
 				}
 				alertUtil.CreateNewAlertTask(quota, alertType, quotaType, m)
+			case constant.Bark:
+				todayCount, isValid := canSendAlertToday(alertType, quotaType, alert.SendCount, m)
+				if !isValid {
+					continue
+				}
+				var create = dto.AlertLogCreate{
+					Type:    alertUtil.GetCronJobType(alert.Type),
+					AlertId: alert.ID,
+					Count:   todayCount + 1,
+				}
+				alertInfo := alert
+				alertInfo.Type = alertType
+				create.AlertRule = alertUtil.ProcessAlertRule(alert)
+				create.AlertDetail = alertUtil.ProcessAlertDetail(alertInfo, quotaType, params, m)
+				transport := xpack.LoadRequestTransport()
+				agentInfo, _ := xpack.GetAgentInfo()
+				alertErr := alertUtil.CreateBarkAlertLog(create, alertInfo, params, transport, agentInfo)
+				if alertErr != nil {
+					global.LOG.Infof("%s alert %s push failed, err: %v", alertType, m, alertErr.Error())
+					continue
+				}
+				alertUtil.CreateNewAlertTask(quota, alertType, quotaType, m)
 			default:
 			}
 		}
@@ -894,7 +901,7 @@ func processAllDisks(alert dto.AlertDTO) error {
 		if err != nil {
 			errMsg := fmt.Sprintf("disk path %s process failed: %v", item.Path, err)
 			errMsgs = append(errMsgs, errMsg)
-			global.LOG.Errorf(errMsg)
+			global.LOG.Errorf("%s", errMsg)
 			continue
 		}
 	}
@@ -907,7 +914,7 @@ func processAllDisks(alert dto.AlertDTO) error {
 func processSingleDisk(alert dto.AlertDTO) error {
 	err := checkAndCreateDiskAlert(alert, alert.Project)
 	if err != nil {
-		global.LOG.Errorf(err.Error())
+		global.LOG.Errorf("%s", err.Error())
 		return err
 	}
 	return nil

agent/app/service/alert_sender.go

@@ -30,6 +30,8 @@ func (s *AlertSender) Send(quota string, params []dto.Param) {
 			s.sendSMS(quota, params)
 		case constant.Email:
 			s.sendEmail(quota, params)
+		case constant.Bark:
+			s.sendBark(quota, params)
 		case constant.WeCom, constant.DingTalk, constant.FeiShu:
 			s.sendWebhook(quota, params, method)
 		}
@@ -45,6 +47,8 @@ func (s *AlertSender) ResourceSend(quota string, params []dto.Param) {
 			s.sendResourceSMS(quota, params)
 		case constant.Email:
 			s.sendResourceEmail(quota, params)
+		case constant.Bark:
+			s.sendResourceBark(quota, params)
 		case constant.WeCom, constant.DingTalk, constant.FeiShu:
 			s.sendResourceWebhook(quota, params, method)
 		}
@@ -101,6 +105,31 @@ func (s *AlertSender) sendEmail(quota string, params []dto.Param) {
 	alertUtil.CreateNewAlertTask(quota, s.alert.Type, s.quotaType, constant.Email)
 }
 
+func (s *AlertSender) sendBark(quota string, params []dto.Param) {
+	totalCount, isValid := s.canSendAlert(constant.Bark)
+	if !isValid {
+		return
+	}
+
+	create := dto.AlertLogCreate{
+		Status:      constant.AlertSuccess,
+		Count:       totalCount + 1,
+		AlertId:     s.alert.ID,
+		Type:        s.alert.Type,
+		AlertRule:   alertUtil.ProcessAlertRule(s.alert),
+		AlertDetail: alertUtil.ProcessAlertDetail(s.alert, quota, params, constant.Bark),
+	}
+
+	transport := xpack.LoadRequestTransport()
+	agentInfo, _ := xpack.GetAgentInfo()
+	err := alertUtil.CreateBarkAlertLog(create, s.alert, params, transport, agentInfo)
+	if err != nil {
+		global.LOG.Errorf("%s alert bark push failed: %v", s.alert.Type, err)
+		return
+	}
+	alertUtil.CreateNewAlertTask(quota, s.alert.Type, s.quotaType, constant.Bark)
+}
+
 func (s *AlertSender) sendWebhook(quota string, params []dto.Param, method string) {
 	totalCount, isValid := s.canSendAlert(method)
 	if !isValid {
@@ -171,6 +200,30 @@ func (s *AlertSender) sendResourceEmail(quota string, params []dto.Param) {
 	alertUtil.CreateNewAlertTask(quota, s.alert.Type, s.quotaType, constant.Email)
 }
 
+func (s *AlertSender) sendResourceBark(quota string, params []dto.Param) {
+	todayCount, isValid := s.canResourceSendAlert(constant.Bark)
+	if !isValid {
+		return
+	}
+
+	create := dto.AlertLogCreate{
+		Status:      constant.AlertSuccess,
+		Count:       todayCount + 1,
+		AlertId:     s.alert.ID,
+		Type:        s.alert.Type,
+		AlertRule:   alertUtil.ProcessAlertRule(s.alert),
+		AlertDetail: alertUtil.ProcessAlertDetail(s.alert, quota, params, constant.Bark),
+	}
+
+	transport := xpack.LoadRequestTransport()
+	agentInfo, _ := xpack.GetAgentInfo()
+	if err := alertUtil.CreateBarkAlertLog(create, s.alert, params, transport, agentInfo); err != nil {
+		global.LOG.Errorf("failed to send Bark alert: %v", err)
+		return
+	}
+	alertUtil.CreateNewAlertTask(quota, s.alert.Type, s.quotaType, constant.Bark)
+}
+
 func (s *AlertSender) sendResourceWebhook(quota string, params []dto.Param, method string) {
 	todayCount, isValid := s.canResourceSendAlert(method)
 	if !isValid {

agent/app/service/app.go

@@ -57,6 +57,10 @@ type IAppService interface {
 	GetAppDetailByKey(appKey, version string) (response.AppDetailSimpleDTO, error)
 }
 
+type appInstallHooks struct {
+	AfterCopyData func(appInstall *model.AppInstall) error
+}
+
 func NewIAppService() IAppService {
 	return &AppService{}
 }
@@ -340,6 +344,10 @@ func (a AppService) GetAppDetailByID(id uint) (*response.AppDetailDTO, error) {
 }
 
 func (a AppService) Install(req request.AppInstallCreate, executeScript bool) (appInstall *model.AppInstall, err error) {
+	return a.installWithHooks(req, executeScript, nil)
+}
+
+func (a AppService) installWithHooks(req request.AppInstallCreate, executeScript bool, hooks *appInstallHooks) (appInstall *model.AppInstall, err error) {
 	if err = docker.CreateDefaultDockerNetwork(); err != nil {
 		err = buserr.WithDetail("Err1PanelNetworkFailed", err.Error(), nil)
 		return
@@ -416,7 +424,7 @@ func (a AppService) Install(req request.AppInstallCreate, executeScript bool) (a
 		}
 	} else {
 		if appDetail.DockerCompose == "" {
-			dockerComposeUrl := fmt.Sprintf("%s/%s/1panel/%s/%s/docker-compose.yml", global.CONF.RemoteURL.AppRepo, global.CONF.Base.Mode, app.Key, appDetail.Version)
+			dockerComposeUrl := fmt.Sprintf("%s/%s/1panel/%s/%s/docker-compose.yml", global.AppRepoURL(), global.CONF.Base.Mode, app.Key, appDetail.Version)
 			_, composeRes, err = req_helper.HandleRequest(dockerComposeUrl, http.MethodGet, constant.TimeOut20s)
 			if err != nil {
 				return
@@ -516,6 +524,10 @@ func (a AppService) Install(req request.AppInstallCreate, executeScript bool) (a
 	}
 	appInstall.Env = string(paramByte)
 
+	var maxSort int
+	global.DB.Model(&model.AppInstall{}).Where("favorite = ?", false).Select("COALESCE(MAX(sort_order),0)").Scan(&maxSort)
+	appInstall.SortOrder = maxSort + 1
+
 	if err = appInstallRepo.Create(context.Background(), appInstall); err != nil {
 		return
 	}
@@ -533,6 +545,11 @@ func (a AppService) Install(req request.AppInstallCreate, executeScript bool) (a
 		if err = copyData(t, app, appDetail, appInstall, req); err != nil {
 			return err
 		}
+		if hooks != nil && hooks.AfterCopyData != nil {
+			if err = hooks.AfterCopyData(appInstall); err != nil {
+				return err
+			}
+		}
 		if executeScript {
 			if err = runScript(t, appInstall, "init"); err != nil {
 				return err
@@ -817,7 +834,7 @@ func (a AppService) GetAppUpdate() (*response.AppUpdateRes, error) {
 		return res, nil
 	}
 
-	versionUrl := fmt.Sprintf("%s/%s/1panel.json.version.txt", global.CONF.RemoteURL.AppRepo, global.CONF.Base.Mode)
+	versionUrl := fmt.Sprintf("%s/%s/1panel.json.version.txt", global.AppRepoURL(), global.CONF.Base.Mode)
 	_, versionRes, err := req_helper.HandleRequest(versionUrl, http.MethodGet, constant.TimeOut20s)
 	if err != nil {
 		return nil, err
@@ -889,7 +906,7 @@ func getAppFromRepo(downloadPath string) error {
 
 func getAppList() (*dto.AppList, error) {
 	list := &dto.AppList{}
-	if err := getAppFromRepo(fmt.Sprintf("%s/%s/1panel.json.zip", global.CONF.RemoteURL.AppRepo, global.CONF.Base.Mode)); err != nil {
+	if err := getAppFromRepo(fmt.Sprintf("%s/%s/1panel.json.zip", global.AppRepoURL(), global.CONF.Base.Mode)); err != nil {
 		return nil, err
 	}
 	listFile := filepath.Join(global.Dir.ResourceDir, "1panel.json")

agent/app/service/app_install.go

@@ -57,6 +57,7 @@ type IAppInstallService interface {
 	UpdateAppConfig(req request.AppConfigUpdate) error
 	GetInstallList() ([]dto.AppInstallInfo, error)
 	GetAppInstallInfo(appInstallID uint) (*response.AppInstallInfo, error)
+	UpdateSort(req request.AppInstallSort) error
 }
 
 func NewIAppInstalledService() IAppInstallService {
@@ -83,6 +84,7 @@ func (a *AppInstallService) Page(req request.AppInstalledSearch) (int64, []respo
 		err      error
 	)
 	opts = append(opts, repo.WithOrderRuleBy("favorite", "descending"))
+	opts = append(opts, repo.WithOrderRuleBy("sort_order", "ascending"))
 
 	if req.Name != "" {
 		opts = append(opts, repo.WithByLikeName(req.Name))
@@ -300,6 +302,9 @@ func (a *AppInstallService) Operate(req request.AppInstalledOperate) error {
 		return opNginx(install.ContainerName, constant.NginxReload)
 	case constant.Favorite:
 		install.Favorite = req.Favorite
+		var maxSort int
+		global.DB.Model(&model.AppInstall{}).Where("favorite = ?", req.Favorite).Select("COALESCE(MAX(sort_order),0)").Scan(&maxSort)
+		install.SortOrder = maxSort + 1
 		return appInstallRepo.Save(context.Background(), &install)
 	default:
 		return errors.New("operate not support")
@@ -318,17 +323,25 @@ func (a *AppInstallService) UpdateAppConfig(req request.AppConfigUpdate) error {
 	return appInstallRepo.Save(context.Background(), &installed)
 }
 
+func (a *AppInstallService) UpdateSort(req request.AppInstallSort) error {
+	for _, item := range req.Items {
+		if err := appInstallRepo.BatchUpdateBy(map[string]interface{}{"sort_order": item.SortOrder}, repo.WithByID(item.InstallID)); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 func (a *AppInstallService) Update(req request.AppInstalledUpdate) error {
 	installed, err := appInstallRepo.GetFirst(repo.WithByID(req.InstallId))
 	if err != nil {
 		return err
 	}
-	changePort := false
+	oldInstalled := installed
 	port, ok := req.Params["PANEL_APP_PORT_HTTP"]
 	if ok {
 		portN := int(math.Ceil(port.(float64)))
 		if portN != installed.HttpPort {
-			changePort = true
 			httpPort, err := checkPort("PANEL_APP_PORT_HTTP", req.Params)
 			if err != nil {
 				return err
@@ -414,9 +427,17 @@ func (a *AppInstallService) Update(req request.AppInstalledUpdate) error {
 	installed.Status = constant.StatusRunning
 	_ = appInstallRepo.Save(context.Background(), &installed)
 
+	proxyChanged := hasAppInstallProxyPassChanged(&oldInstalled, &installed)
+	currentProxy, currentProxyErr := getAppInstallProxyPass(&installed)
 	website, _ := websiteRepo.GetFirst(websiteRepo.WithAppInstallId(installed.ID))
-	if changePort && website.ID != 0 && website.Status == constant.StatusRunning {
-		go func() {
+	if proxyChanged && website.ID != 0 && currentProxyErr == nil {
+		website.Proxy = currentProxy
+		if err := websiteRepo.SaveWithoutCtx(&website); err != nil {
+			global.LOG.Error(buserr.WithErr("ErrUpdateBuWebsite", err).Error())
+		}
+	}
+	if proxyChanged && website.ID != 0 && website.Status == constant.StatusRunning && currentProxyErr == nil {
+		go func(website model.Website, proxy string) {
 			nginxInstall, err := getNginxFull(&website)
 			if err != nil {
 				global.LOG.Error(buserr.WithErr("ErrUpdateBuWebsite", err).Error())
@@ -429,7 +450,6 @@ func (a *AppInstallService) Update(req request.AppInstalledUpdate) error {
 				return
 			}
 			server := servers[0]
-			proxy := fmt.Sprintf("http://127.0.0.1:%d", installed.HttpPort)
 			server.UpdateRootProxy([]string{proxy})
 
 			if err := nginx.WriteConfig(config, nginx.IndentedStyle); err != nil {
@@ -440,7 +460,10 @@ func (a *AppInstallService) Update(req request.AppInstalledUpdate) error {
 				global.LOG.Error(buserr.WithErr("ErrUpdateBuWebsite", err).Error())
 				return
 			}
-		}()
+		}(website, currentProxy)
+	}
+	if proxyChanged && website.ID != 0 && currentProxyErr != nil {
+		global.LOG.Error(buserr.WithErr("ErrUpdateBuWebsite", currentProxyErr).Error())
 	}
 	return nil
 }
@@ -830,6 +853,10 @@ func syncAppInstallStatus(appInstall *model.AppInstall, force bool) error {
 	return nil
 }
 
+func SyncAppInstallStatus(appInstall *model.AppInstall, force bool) error {
+	return syncAppInstallStatus(appInstall, force)
+}
+
 func updateInstallInfoInDB(appKey, appName, param string, value interface{}) error {
 	if param != "password" && param != "port" && param != "user-password" {
 		return nil

agent/app/service/app_sync_task.go

@@ -7,6 +7,8 @@ import (
 	"net/http"
 	"strconv"
 	"strings"
+	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
@@ -81,7 +83,7 @@ func (a AppService) createSyncAppStoreTask(sharedCtx **appSyncContext) func(t *t
 		ctx := &appSyncContext{
 			task:           t,
 			httpClient:     http.Client{Timeout: time.Duration(constant.TimeOut20s) * time.Second, Transport: xpack.LoadRequestTransport()},
-			baseRemoteUrl:  fmt.Sprintf("%s/%s/1panel", global.CONF.RemoteURL.AppRepo, global.CONF.Base.Mode),
+			baseRemoteUrl:  fmt.Sprintf("%s/%s/1panel", global.AppRepoURL(), global.CONF.Base.Mode),
 			systemVersion:  setting.SystemVersion,
 			settingService: settingService,
 			list:           list,
@@ -127,90 +129,197 @@ func (a AppService) createSyncAppStoreTask(sharedCtx **appSyncContext) func(t *t
 	}
 }
 
+type appWorkItem struct {
+	appDef  dto.AppDefine
+	app     model.App
+	iconUrl string
+	hadIcon bool
+}
+
+type appWorkResult struct {
+	appKey     string
+	app        model.App
+	iconStatus int
+	hadIcon    bool
+	httpFailed bool
+}
+
+func (c *appSyncContext) processOneApp(item appWorkItem) appWorkResult {
+	app := item.app
+	l := item.appDef
+	result := appWorkResult{
+		appKey:  l.AppProperty.Key,
+		hadIcon: item.hadIcon,
+	}
+
+	if item.hadIcon {
+		status, iconField := c.downloadAppIcon(item.iconUrl, l.AppProperty.Key, app.Icon)
+		result.iconStatus = status
+		switch status {
+		case http.StatusOK:
+			app.Icon = iconField
+		case http.StatusNotModified:
+		default:
+			result.httpFailed = true
+		}
+	}
+
+	app.TagsKey = l.AppProperty.Tags
+	if l.AppProperty.Recommend > 0 {
+		app.Recommend = l.AppProperty.Recommend
+	} else {
+		app.Recommend = 9999
+	}
+	app.ReadMe = l.ReadMe
+	app.LastModified = l.LastModified
+
+	versions := l.Versions
+	detailsMap := getAppDetails(app.Details, versions)
+	for _, v := range versions {
+		version := v.Name
+		detail := detailsMap[version]
+		versionUrl := fmt.Sprintf("%s/%s/%s", c.baseRemoteUrl, app.Key, version)
+
+		paramByte, _ := json.Marshal(v.AppForm)
+		var appForm dto.AppForm
+		_ = json.Unmarshal(paramByte, &appForm)
+
+		if appForm.SupportVersion > 0 && common.CompareVersion(strconv.FormatFloat(appForm.SupportVersion, 'f', -1, 64), c.systemVersion) {
+			delete(detailsMap, version)
+			continue
+		}
+
+		if _, ok := InitTypes[app.Type]; ok {
+			dockerComposeUrl := fmt.Sprintf("%s/%s", versionUrl, "docker-compose.yml")
+			_, composeRes, err := req_helper.HandleRequestWithClient(&c.httpClient, dockerComposeUrl, http.MethodGet, constant.TimeOut20s)
+			if err == nil {
+				detail.DockerCompose = string(composeRes)
+			} else {
+				result.httpFailed = true
+			}
+		} else {
+			detail.DockerCompose = ""
+		}
+
+		detail.Params = string(paramByte)
+		detail.DownloadUrl = fmt.Sprintf("%s/%s", versionUrl, app.Key+"-"+version+".tar.gz")
+		detail.DownloadCallBackUrl = v.DownloadCallBackUrl
+		detail.Update = true
+		detail.LastModified = v.LastModified
+		detailsMap[version] = detail
+	}
+
+	newDetails := make([]model.AppDetail, 0, len(detailsMap))
+	for _, detail := range detailsMap {
+		newDetails = append(newDetails, detail)
+	}
+	app.Details = newDetails
+
+	result.app = app
+	return result
+}
+
 func (c *appSyncContext) syncAppIconsAndDetails() error {
 	total := len(c.list.Apps)
 	global.LOG.Infof("[AppStore] sync app detail start, total apps: %d", total)
 
-	var (
-		icon200Count  = 0
-		icon304Count  = 0
-		iconFailCount = 0
-	)
-
-	for i, l := range c.list.Apps {
-		if (i+1)%10 == 0 {
-			c.task.LogWithProgress(i18n.GetMsgByKey("SyncAppDetail"), i+1, total)
-		}
-
+	workItems := make([]appWorkItem, 0, total)
+	for _, l := range c.list.Apps {
 		app, ok := c.appsMap[l.AppProperty.Key]
 		if !ok {
 			continue
 		}
-
 		iconUrl, hasPending := c.pendingIcons[l.AppProperty.Key]
-		if hasPending {
-			status, iconField := c.downloadAppIcon(iconUrl, l.AppProperty.Key, app.Icon)
-			switch status {
+		workItems = append(workItems, appWorkItem{
+			appDef:  l,
+			app:     app,
+			iconUrl: iconUrl,
+			hadIcon: hasPending,
+		})
+	}
+
+	totalWork := len(workItems)
+	if totalWork == 0 {
+		return nil
+	}
+
+	const maxWorkers = 4
+	var (
+		failFlag atomic.Bool
+		workCh   = make(chan int, maxWorkers)
+		resultCh = make(chan appWorkResult, maxWorkers)
+		wg       sync.WaitGroup
+	)
+
+	wg.Add(maxWorkers)
+	for range maxWorkers {
+		go func() {
+			defer wg.Done()
+			for idx := range workCh {
+				result := c.processOneApp(workItems[idx])
+				resultCh <- result
+				if result.httpFailed {
+					failFlag.Store(true)
+				}
+			}
+		}()
+	}
+	go func() { wg.Wait(); close(resultCh) }()
+
+	var fed atomic.Int32
+	go func() {
+		for i := range workItems {
+			if failFlag.Load() {
+				break
+			}
+			workCh <- i
+			fed.Store(int32(i + 1))
+		}
+		close(workCh)
+	}()
+
+	var (
+		completed    int
+		icon200Count int
+		icon304Count int
+		iconFailCount int
+	)
+	milestones := [4]int{totalWork / 4, totalWork / 2, totalWork * 3 / 4, totalWork}
+	nextMS := 0
+	checkProgress := func() {
+		if nextMS < len(milestones) && completed >= milestones[nextMS] {
+			c.task.LogWithProgress(i18n.GetMsgByKey("SyncAppDetail"), completed, totalWork)
+			nextMS++
+		}
+	}
+
+	applyResult := func(result appWorkResult) {
+		c.appsMap[result.appKey] = result.app
+		if result.hadIcon {
+			switch result.iconStatus {
 			case http.StatusOK:
-				app.Icon = iconField
 				icon200Count++
 			case http.StatusNotModified:
 				icon304Count++
 			default:
-				global.LOG.Warnf("[AppStore] download icon failed url=%s, appKey=%s", iconUrl, l.AppProperty.Key)
 				iconFailCount++
 			}
 		}
+		completed++
+		checkProgress()
+	}
 
-		app.TagsKey = l.AppProperty.Tags
-		if l.AppProperty.Recommend > 0 {
-			app.Recommend = l.AppProperty.Recommend
-		} else {
-			app.Recommend = 9999
+	for result := range resultCh {
+		applyResult(result)
+	}
+
+	fedCount := int(fed.Load())
+	if failFlag.Load() && fedCount < len(workItems) {
+		global.LOG.Warnf("[AppStore] HTTP failure detected, falling back to serial for remaining %d apps", len(workItems)-fedCount)
+		for i := fedCount; i < len(workItems); i++ {
+			result := c.processOneApp(workItems[i])
+			applyResult(result)
 		}
-		app.ReadMe = l.ReadMe
-		app.LastModified = l.LastModified
-
-		versions := l.Versions
-		detailsMap := getAppDetails(app.Details, versions)
-		for _, v := range versions {
-			version := v.Name
-			detail := detailsMap[version]
-			versionUrl := fmt.Sprintf("%s/%s/%s", c.baseRemoteUrl, app.Key, version)
-
-			paramByte, _ := json.Marshal(v.AppForm)
-			var appForm dto.AppForm
-			_ = json.Unmarshal(paramByte, &appForm)
-
-			if appForm.SupportVersion > 0 && common.CompareVersion(strconv.FormatFloat(appForm.SupportVersion, 'f', -1, 64), c.systemVersion) {
-				delete(detailsMap, version)
-				continue
-			}
-
-			if _, ok := InitTypes[app.Type]; ok {
-				dockerComposeUrl := fmt.Sprintf("%s/%s", versionUrl, "docker-compose.yml")
-				_, composeRes, err := req_helper.HandleRequestWithClient(&c.httpClient, dockerComposeUrl, http.MethodGet, constant.TimeOut20s)
-				if err == nil {
-					detail.DockerCompose = string(composeRes)
-				}
-			} else {
-				detail.DockerCompose = ""
-			}
-
-			detail.Params = string(paramByte)
-			detail.DownloadUrl = fmt.Sprintf("%s/%s", versionUrl, app.Key+"-"+version+".tar.gz")
-			detail.DownloadCallBackUrl = v.DownloadCallBackUrl
-			detail.Update = true
-			detail.LastModified = v.LastModified
-			detailsMap[version] = detail
-		}
-
-		var newDetails []model.AppDetail
-		for _, detail := range detailsMap {
-			newDetails = append(newDetails, detail)
-		}
-		app.Details = newDetails
-		c.appsMap[l.AppProperty.Key] = app
 	}
 
 	global.LOG.Infof("[AppStore] icon download completed - total: %d, success(200): %d, cached(304): %d, failed: %d",

agent/app/service/app_utils.go

@@ -33,7 +33,6 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/utils/common"
 	"github.com/1Panel-dev/1Panel/agent/utils/compose"
 	"github.com/1Panel-dev/1Panel/agent/utils/docker"
-	composeV2 "github.com/1Panel-dev/1Panel/agent/utils/docker"
 	"github.com/1Panel-dev/1Panel/agent/utils/env"
 	"github.com/1Panel-dev/1Panel/agent/utils/files"
 	"github.com/1Panel-dev/1Panel/agent/utils/nginx"
@@ -363,7 +362,7 @@ func deleteAppInstall(deleteReq request.AppInstallDelete) error {
 				if err != nil {
 					return err
 				}
-				images, err := composeV2.GetImagesFromDockerCompose(content, []byte(install.DockerCompose))
+				images, err := docker.GetImagesFromDockerCompose(content, []byte(install.DockerCompose))
 				if err != nil {
 					return err
 				}
@@ -393,7 +392,7 @@ func deleteAppInstall(deleteReq request.AppInstallDelete) error {
 			return err
 		}
 		appKey := install.App.Key
-		if appKey == constant.AppOpenclaw {
+		if appKey == constant.AppOpenclaw || appKey == constant.AppCopaw {
 			_ = agentRepo.DeleteByAppInstallIDWithCtx(ctx, install.ID)
 		}
 
@@ -676,6 +675,7 @@ func upgradeInstall(req request.AppInstallUpgrade) error {
 	if err != nil {
 		return err
 	}
+	oldVersion := install.Version
 	detail, err := appDetailRepo.GetFirst(repo.WithByID(req.DetailID))
 	if err != nil {
 		return err
@@ -752,7 +752,7 @@ func upgradeInstall(req request.AppInstallUpgrade) error {
 			if req.DockerCompose != "" {
 				composeContent = []byte(req.DockerCompose)
 			}
-			images, err := composeV2.GetImagesFromDockerCompose(content, composeContent)
+			images, err := docker.GetImagesFromDockerCompose(content, composeContent)
 			if err != nil {
 				return err
 			}
@@ -802,6 +802,9 @@ func upgradeInstall(req request.AppInstallUpgrade) error {
 		}
 
 		var newCompose string
+		if err = migrateOpenclawProtocolUpgrade(&install, oldVersion, detail.Version); err != nil {
+			return err
+		}
 		if req.DockerCompose == "" {
 			newCompose, err = getUpgradeCompose(install, detail)
 			if err != nil {
@@ -911,7 +914,7 @@ func getContainerNames(install model.AppInstall) ([]string, error) {
 	if err != nil {
 		return nil, err
 	}
-	project, err := composeV2.GetComposeProject(install.Name, install.GetPath(), []byte(install.DockerCompose), []byte(envStr), true)
+	project, err := docker.GetComposeProject(install.Name, install.GetPath(), []byte(install.DockerCompose), []byte(envStr), true)
 	if err != nil {
 		return nil, err
 	}
@@ -1133,7 +1136,7 @@ func runScript(task *task.Task, appInstall *model.AppInstall, operate string) er
 }
 
 func checkContainerNameIsExist(containerName, appDir string) (bool, error) {
-	client, err := composeV2.NewDockerClient()
+	client, err := docker.NewDockerClient()
 	if err != nil {
 		return false, err
 	}
@@ -1169,7 +1172,7 @@ func upApp(task *task.Task, appInstall *model.AppInstall, pullImages bool) error
 			if err != nil {
 				return err
 			}
-			images, err := composeV2.GetImagesFromDockerCompose(envByte, []byte(appInstall.DockerCompose))
+			images, err := docker.GetImagesFromDockerCompose(envByte, []byte(appInstall.DockerCompose))
 			if err != nil {
 				return err
 			}
@@ -1613,6 +1616,7 @@ func handleInstalled(appInstallList []model.AppInstall, updated, sync, checkUpda
 				Document: installed.App.Document,
 			},
 			Favorite:    installed.Favorite,
+			SortOrder:   installed.SortOrder,
 			Container:   installed.ContainerName,
 			ServiceName: strings.ToLower(installed.ServiceName),
 		}

agent/app/service/backup.go

@@ -57,6 +57,11 @@ type IBackupService interface {
 
 	AppBackup(db dto.CommonBackup) (*model.BackupRecord, error)
 	AppRecover(req dto.CommonRecover) error
+
+	ContainerBackup(req dto.CommonBackup) error
+	ContainerRecover(req dto.CommonRecover) error
+	ComposeBackup(req dto.CommonBackup) error
+	ComposeRecover(req dto.CommonRecover) error
 }
 
 func NewIBackupService() IBackupService {

agent/app/service/backup_app.go

@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/app/repo"
+	"github.com/subosito/gotenv"
 
 	"github.com/1Panel-dev/1Panel/agent/app/task"
 	"github.com/1Panel-dev/1Panel/agent/i18n"
@@ -179,6 +180,9 @@ func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverF
 			return err
 		}
 		tmpPath := strings.ReplaceAll(recoverFile, ".tar.gz", "")
+		if err := fileOp.TarGzExtractPro(tmpPath+"/app.tar.gz", tmpPath, ""); err != nil {
+			return err
+		}
 		defer func() {
 			_, _ = compose.Up(install.GetComposePath())
 			_ = os.RemoveAll(strings.ReplaceAll(recoverFile, ".tar.gz", ""))
@@ -187,19 +191,26 @@ func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverF
 		if !fileOp.Stat(tmpPath+"/app.json") || !fileOp.Stat(tmpPath+"/app.tar.gz") {
 			return errors.New(i18n.GetMsgByKey("AppBackupFileIncomplete"))
 		}
-		var oldInstall model.AppInstall
+		var backupInstall model.AppInstall
 		appJson, err := os.ReadFile(tmpPath + "/app.json")
 		if err != nil {
 			return err
 		}
-		if err := json.Unmarshal(appJson, &oldInstall); err != nil {
+		if err := json.Unmarshal(appJson, &backupInstall); err != nil {
 			return fmt.Errorf("unmarshal app.json failed, err: %v", err)
 		}
-		if oldInstall.App.Key != install.App.Key || oldInstall.Name != install.Name {
+		if backupInstall.App.Key != install.App.Key || backupInstall.Name != install.Name {
 			return errors.New(i18n.GetMsgByKey("AppAttributesNotMatch"))
 		}
-
-		newEnvFile := ""
+		backupEnvMap, err := getEnvMapByPath(path.Join(tmpPath, install.Name, ".env"))
+		if err != nil {
+			return err
+		}
+		installedEnvMap, err := getEnvMapByPath(install.GetEnvPath())
+		if err != nil {
+			return err
+		}
+		var mergedEnvContent string
 		resources, _ := appInstallResourceRepo.GetBy(appInstallResourceRepo.WithAppInstallId(install.ID))
 		for _, resource := range resources {
 			var database model.Database
@@ -225,11 +236,20 @@ func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverF
 				if err != nil {
 					return err
 				}
+				newDB, err := reCreatePostgresqlDB(db.ID, database, backupEnvMap)
+				if err != nil {
+					return err
+				}
+				backupInstall.Env, mergedEnvContent, err = buildRecoverEnv(backupInstall.Env, backupEnvMap, installedEnvMap)
+				if err != nil {
+					return err
+				}
+				_ = appInstallResourceRepo.BatchUpdateBy(map[string]interface{}{"resource_id": newDB.ID}, repo.WithByID(resource.ID))
 				taskName := task.GetTaskName(db.Name, task.TaskRecover, task.TaskScopeDatabase)
 				t.LogStart(taskName)
 				if err := handlePostgresqlRecover(dto.CommonRecover{
-					Name:       database.Name,
-					DetailName: db.Name,
+					Name:       newDB.PostgresqlName,
+					DetailName: newDB.Name,
 					File:       fmt.Sprintf("%s/%s.sql.gz", tmpPath, install.Name),
 				}, parentTask, true); err != nil {
 					t.LogFailedWithErr(taskName, err)
@@ -241,15 +261,11 @@ func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverF
 				if err != nil {
 					return err
 				}
-				newDB, envMap, err := reCreateDB(db.ID, database, oldInstall.Env)
+				newDB, err := reCreateDB(db.ID, database, backupEnvMap)
 				if err != nil {
 					return err
 				}
-				oldHost := fmt.Sprintf("\"PANEL_DB_HOST\":\"%v\"", envMap["PANEL_DB_HOST"].(string))
-				newHost := fmt.Sprintf("\"PANEL_DB_HOST\":\"%v\"", database.Address)
-				oldInstall.Env = strings.ReplaceAll(oldInstall.Env, oldHost, newHost)
-				envMap["PANEL_DB_HOST"] = database.Address
-				newEnvFile, err = coverEnvJsonToStr(oldInstall.Env)
+				backupInstall.Env, mergedEnvContent, err = buildRecoverEnv(backupInstall.Env, backupEnvMap, installedEnvMap)
 				if err != nil {
 					return err
 				}
@@ -284,22 +300,22 @@ func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverF
 		t.LogSuccess(deCompressName)
 		_ = fileOp.DeleteDir(backPath)
 
-		if len(newEnvFile) != 0 {
+		if len(mergedEnvContent) != 0 {
 			envPath := fmt.Sprintf("%s/%s/.env", install.GetAppPath(), install.Name)
 			file, err := os.OpenFile(envPath, os.O_WRONLY|os.O_TRUNC, 0640)
 			if err != nil {
 				return err
 			}
 			defer file.Close()
-			_, _ = file.WriteString(newEnvFile)
+			_, _ = file.WriteString(mergedEnvContent)
 		}
 
-		oldInstall.ID = install.ID
-		oldInstall.Status = constant.StatusRunning
-		oldInstall.AppId = install.AppId
-		oldInstall.AppDetailId = install.AppDetailId
-		oldInstall.App.ID = install.AppId
-		if err := appInstallRepo.Save(context.Background(), &oldInstall); err != nil {
+		backupInstall.ID = install.ID
+		backupInstall.Status = constant.StatusRunning
+		backupInstall.AppId = install.AppId
+		backupInstall.AppDetailId = install.AppDetailId
+		backupInstall.App.ID = install.AppId
+		if err := appInstallRepo.Save(context.Background(), &backupInstall); err != nil {
 			global.LOG.Errorf("save db app install failed, err: %v", err)
 			return err
 		}
@@ -373,33 +389,131 @@ func doAppBackup(install *model.AppInstall, parentTask *task.Task, backupDir, fi
 	return nil
 }
 
-func reCreateDB(dbID uint, database model.Database, oldEnv string) (*model.DatabaseMysql, map[string]interface{}, error) {
+func reCreateDB(dbID uint, database model.Database, envMap map[string]interface{}) (*model.DatabaseMysql, error) {
 	mysqlService := NewIMysqlService()
 	ctx := context.Background()
 	_ = mysqlService.Delete(ctx, dto.MysqlDBDelete{ID: dbID, Database: database.Name, Type: database.Type, DeleteBackup: false, ForceDelete: true})
 
-	envMap := make(map[string]interface{})
-	if err := json.Unmarshal([]byte(oldEnv), &envMap); err != nil {
-		return nil, envMap, err
-	}
-	oldName, _ := envMap["PANEL_DB_NAME"].(string)
-	oldUser, _ := envMap["PANEL_DB_USER"].(string)
-	oldPassword, _ := envMap["PANEL_DB_USER_PASSWORD"].(string)
+	dbInfo := getDBCreateInfoFromEnv(envMap, "utf8mb4")
 	createDB, err := mysqlService.Create(context.Background(), dto.MysqlDBCreate{
-		Name:       oldName,
+		Name:       dbInfo.Name,
 		From:       database.From,
 		Database:   database.Name,
-		Format:     "utf8mb4",
-		Username:   oldUser,
-		Password:   oldPassword,
+		Format:     dbInfo.Format,
+		Username:   dbInfo.User,
+		Password:   dbInfo.Password,
 		Permission: "%",
 	})
-	cronjobs, _ := cronjobRepo.List(cronjobRepo.WithByDbName(fmt.Sprintf("%v", dbID)))
-	for _, job := range cronjobs {
-		_ = cronjobRepo.Update(job.ID, map[string]interface{}{"db_name": fmt.Sprintf("%v", createDB.ID)})
-	}
 	if err != nil {
-		return nil, envMap, err
+		return nil, err
 	}
-	return createDB, envMap, nil
+	updateCronjobsDBRef(dbID, createDB.ID)
+	return createDB, nil
+}
+
+func reCreatePostgresqlDB(dbID uint, database model.Database, envMap map[string]interface{}) (*model.DatabasePostgresql, error) {
+	postgresqlService := NewIPostgresqlService()
+	_ = postgresqlService.Delete(context.Background(), dto.PostgresqlDBDelete{
+		ID:           dbID,
+		Type:         database.Type,
+		Database:     database.Name,
+		DeleteBackup: false,
+		ForceDelete:  true,
+	})
+
+	dbInfo := getDBCreateInfoFromEnv(envMap, "UTF8")
+	createDB, err := postgresqlService.Create(context.Background(), dto.PostgresqlDBCreate{
+		Name:      dbInfo.Name,
+		From:      database.From,
+		Database:  database.Name,
+		Format:    dbInfo.Format,
+		Username:  dbInfo.User,
+		Password:  dbInfo.Password,
+		SuperUser: true,
+	})
+	if err != nil {
+		return nil, err
+	}
+	updateCronjobsDBRef(dbID, createDB.ID)
+	return createDB, nil
+}
+
+type dbRecreateInfo struct {
+	Name     string
+	User     string
+	Password string
+	Format   string
+}
+
+func getDBCreateInfoFromEnv(envMap map[string]interface{}, defaultFormat string) dbRecreateInfo {
+	name, _ := envMap["PANEL_DB_NAME"].(string)
+	user, _ := envMap["PANEL_DB_USER"].(string)
+	password, _ := envMap["PANEL_DB_USER_PASSWORD"].(string)
+	format, _ := envMap["format"].(string)
+	if len(format) == 0 {
+		format = defaultFormat
+	}
+	return dbRecreateInfo{
+		Name:     name,
+		User:     user,
+		Password: password,
+		Format:   format,
+	}
+}
+
+func updateCronjobsDBRef(oldDBID, newDBID uint) {
+	cronjobs, _ := cronjobRepo.List(cronjobRepo.WithByDbName(fmt.Sprintf("%v", oldDBID)))
+	for _, job := range cronjobs {
+		_ = cronjobRepo.Update(job.ID, map[string]interface{}{"db_name": fmt.Sprintf("%v", newDBID)})
+	}
+}
+
+func buildRecoverEnv(appEnv string, backupEnvMap, installedEnvMap map[string]interface{}) (string, string, error) {
+	currentHostVal, hasCurrentHost := installedEnvMap["PANEL_DB_HOST"]
+	if hasCurrentHost && fmt.Sprintf("%v", currentHostVal) != "" {
+		backupHost := fmt.Sprintf("\"PANEL_DB_HOST\":\"%v\"", backupEnvMap["PANEL_DB_HOST"])
+		currentHost := fmt.Sprintf("\"PANEL_DB_HOST\":\"%v\"", currentHostVal)
+		appEnv = strings.ReplaceAll(appEnv, backupHost, currentHost)
+		if _, ok := backupEnvMap["CASDOOR_DATASOURCE_NAME"]; ok {
+			backupEnvMap["CASDOOR_DATASOURCE_NAME"] = strings.ReplaceAll(
+				fmt.Sprintf("%v", backupEnvMap["CASDOOR_DATASOURCE_NAME"]),
+				fmt.Sprintf("%v", backupEnvMap["PANEL_DB_HOST"]),
+				fmt.Sprintf("%v", currentHostVal),
+			)
+		}
+		backupEnvMap["PANEL_DB_HOST"] = currentHostVal
+	}
+	newEnvMap := make(map[string]string, len(backupEnvMap))
+	handleMap(backupEnvMap, newEnvMap)
+	mergedEnvContent, err := gotenv.Marshal(newEnvMap)
+	if err != nil {
+		return appEnv, "", err
+	}
+	return appEnv, mergedEnvContent, nil
+}
+
+func getEnvMapByPath(envPath string) (map[string]interface{}, error) {
+	envMap := make(map[string]interface{})
+	envFile, err := os.ReadFile(envPath)
+	if err != nil {
+		return envMap, err
+	}
+	lines := strings.Split(string(envFile), "\n")
+	for _, line := range lines {
+		line = strings.TrimSpace(line)
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		parts := strings.SplitN(line, "=", 2)
+		if len(parts) == 2 {
+			value := strings.TrimSpace(parts[1])
+			if len(value) >= 2 {
+				if (value[0] == '"' && value[len(value)-1] == '"') || (value[0] == '\'' && value[len(value)-1] == '\'') {
+					value = value[1 : len(value)-1]
+				}
+			}
+			envMap[parts[0]] = value
+		}
+	}
+	return envMap, nil
 }

agent/app/service/backup_compose.go

@@ -0,0 +1,707 @@
+package service
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io/fs"
+	"os"
+	"path"
+	"path/filepath"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/app/repo"
+	"github.com/1Panel-dev/1Panel/agent/app/task"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/i18n"
+	"github.com/1Panel-dev/1Panel/agent/utils/common"
+	"github.com/1Panel-dev/1Panel/agent/utils/compose"
+	dockerUtils "github.com/1Panel-dev/1Panel/agent/utils/docker"
+	"github.com/1Panel-dev/1Panel/agent/utils/files"
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/filters"
+	"github.com/docker/docker/client"
+)
+
+type composeBackupFile struct {
+	OriginalPath string `json:"originalPath"`
+	FileName     string `json:"fileName"`
+	RelativePath string `json:"relativePath,omitempty"`
+	BackupPath   string `json:"backupPath"`
+}
+
+type composeBackupMeta struct {
+	ComposeName string              `json:"composeName"`
+	ComposePath string              `json:"composePath"`
+	CreatedAt   string              `json:"createdAt"`
+	Files       []composeBackupFile `json:"files"`
+	Containers  []string            `json:"containers"`
+}
+
+type composeBackupContext struct {
+	req          dto.CommonBackup
+	composeName  string
+	composePath  string
+	composeFiles []string
+	composeDir   string
+	fileOp       files.FileOp
+	dockerClient *client.Client
+	stopped      bool
+	backupDir    string
+	fileName     string
+	filePath     string
+	tmpDir       string
+	meta         composeBackupMeta
+}
+
+type composeRecoverContext struct {
+	req         dto.CommonRecover
+	fileOp      files.FileOp
+	tmpDir      string
+	meta        composeBackupMeta
+	composeName string
+	targetDir   string
+	composePath string
+	enqueued    bool
+}
+
+func (u *BackupService) ComposeBackup(req dto.CommonBackup) error {
+	timeNow := time.Now().Format(constant.DateTimeSlimLayout) + common.RandStrAndNum(5)
+	fileName := req.FileName
+	if fileName == "" {
+		fileName = fmt.Sprintf("%s_%s.tar.gz", req.Name, timeNow)
+	}
+	if !strings.HasSuffix(fileName, ".tar.gz") {
+		fileName += ".tar.gz"
+	}
+	itemDir := fmt.Sprintf("compose/%s", req.Name)
+	backupDir := path.Join(global.Dir.LocalBackupDir, itemDir)
+	record := &model.BackupRecord{
+		Type:              req.Type,
+		Name:              req.Name,
+		SourceAccountIDs:  "1",
+		DownloadAccountID: 1,
+		FileDir:           itemDir,
+		FileName:          fileName,
+		TaskID:            req.TaskID,
+		Status:            constant.StatusWaiting,
+		Description:       req.Description,
+	}
+	if err := backupRepo.CreateRecord(record); err != nil {
+		global.LOG.Errorf("save compose backup record failed, err: %v", err)
+		return err
+	}
+	if err := handleComposeBackup(req, nil, record.ID, backupDir, fileName); err != nil {
+		backupRepo.UpdateRecordByMap(record.ID, map[string]interface{}{"status": constant.StatusFailed, "message": err.Error()})
+		return err
+	}
+	return nil
+}
+
+func (u *BackupService) ComposeRecover(req dto.CommonRecover) error {
+	return handleComposeRecover(req, nil)
+}
+
+func handleComposeBackup(req dto.CommonBackup, parentTask *task.Task, recordID uint, backupDir, fileName string) error {
+	composeCtx, err := newComposeBackupContext(req, backupDir, fileName)
+	if err != nil {
+		return err
+	}
+	containerNames, err := loadComposeContainerNames(composeCtx)
+	if err != nil {
+		composeCtx.close()
+		return err
+	}
+
+	backupTask := parentTask
+	if backupTask == nil {
+		backupTask, err = task.NewTaskWithOps(composeCtx.composeName, task.TaskBackup, task.TaskScopeBackup, req.TaskID, 1)
+		if err != nil {
+			return err
+		}
+	}
+	if req.StopBefore {
+		backupTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeBackupStop"), func(t *task.Task) error {
+			return stepStopComposeForBackup(composeCtx)
+		}, func(t *task.Task) {
+			_ = stepStartComposeAfterBackup(composeCtx)
+		}, 3, time.Hour)
+	}
+	backupTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeBackupPrepare"), func(t *task.Task) error { return stepPrepareComposeBackup(composeCtx) }, nil, 3, time.Hour)
+	backupTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeBackupFiles"), func(t *task.Task) error { return stepBackupComposeFiles(composeCtx) }, nil, 3, time.Hour)
+	backupTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeBackupContainers"), func(t *task.Task) error { return nil }, nil, 3, time.Hour)
+	for _, containerName := range containerNames {
+		backupFileName := fmt.Sprintf("%s.tar.gz", sanitizeComposeFileName(containerName))
+		backupFile := path.Join(composeCtx.tmpDir, "containers", backupFileName)
+		if err := handleContainerBackup(containerName, backupTask, 0, path.Dir(backupFile), path.Base(backupFile), "", "", false); err != nil {
+			return err
+		}
+		composeCtx.meta.Containers = append(composeCtx.meta.Containers, path.Join("containers", backupFileName))
+	}
+	backupTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeBackupMeta"), func(t *task.Task) error { return stepWriteComposeBackupMeta(composeCtx) }, nil, 3, time.Hour)
+	backupTask.AddSubTaskWithOps(task.GetTaskName(composeCtx.composeName, task.TaskBackup, task.TaskScopeBackup), func(t *task.Task) error {
+		return stepPackComposeBackup(composeCtx)
+	}, nil, 3, time.Hour)
+	if req.StopBefore {
+		backupTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeBackupStart"), func(t *task.Task) error {
+			return stepStartComposeAfterBackup(composeCtx)
+		}, nil, 3, time.Hour)
+	}
+	backupTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeBackupCleanup"), func(t *task.Task) error {
+		composeCtx.close()
+		return nil
+	}, nil, 0, time.Hour)
+	if parentTask != nil {
+		return nil
+	}
+	go func() {
+		defer composeCtx.close()
+		if err := backupTask.Execute(); err != nil {
+			backupRepo.UpdateRecordByMap(recordID, map[string]interface{}{"status": constant.StatusFailed, "message": err.Error()})
+			return
+		}
+		backupRepo.UpdateRecordByMap(recordID, map[string]interface{}{"status": constant.StatusSuccess})
+	}()
+	return nil
+}
+
+func loadComposeContainerNames(composeCtx *composeBackupContext) ([]string, error) {
+	options := container.ListOptions{All: true}
+	options.Filters = filters.NewArgs(filters.Arg("label", composeProjectLabel+"="+composeCtx.composeName))
+	containers, err := composeCtx.dockerClient.ContainerList(context.Background(), options)
+	if err != nil {
+		return nil, err
+	}
+	names := make([]string, 0, len(containers))
+	for _, item := range containers {
+		if len(item.Names) == 0 {
+			continue
+		}
+		names = append(names, strings.TrimPrefix(item.Names[0], "/"))
+	}
+	sort.Strings(names)
+	return names, nil
+}
+
+func handleComposeRecover(req dto.CommonRecover, parentTask *task.Task) error {
+	var recoverCtx *composeRecoverContext
+
+	recoverTask := parentTask
+	var err error
+	if recoverTask == nil {
+		if isImportRecover(req) {
+			taskName := i18n.GetMsgByKey("TaskImport") + i18n.GetMsgByKey("Compose")
+			recoverTask, err = task.NewTask(taskName, task.TaskImport, task.TaskScopeBackup, req.TaskID, 1)
+			if err != nil {
+				return err
+			}
+		} else {
+			taskName := req.Name
+			if taskName == "" {
+				taskName = "compose"
+			}
+			recoverTask, err = task.NewTaskWithOps(taskName, task.TaskRecover, task.TaskScopeBackup, req.TaskID, 1)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	timeout := loadRecoverTimeout(req.Timeout)
+	recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeRecoverPrepare"), func(t *task.Task) error {
+		ctx, err := newComposeRecoverContext(req)
+		if err != nil {
+			return err
+		}
+		recoverCtx = ctx
+		if err := stepPrepareComposeRecover(recoverCtx); err != nil {
+			recoverCtx.close()
+			recoverCtx = nil
+			return err
+		}
+		return nil
+	}, func(t *task.Task) {
+		if recoverCtx != nil {
+			recoverCtx.close()
+			recoverCtx = nil
+		}
+	}, 3, timeout)
+	recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeRecoverExtract"), func(t *task.Task) error { return stepExtractComposeRecover(recoverCtx) }, nil, 3, timeout)
+	recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeRecoverMeta"), func(t *task.Task) error {
+		if err := stepLoadComposeRecoverMeta(recoverCtx); err != nil {
+			return err
+		}
+		t.Log(i18n.GetMsgWithMap("ComposeRecoverMetaLogName", map[string]interface{}{
+			"name": recoverCtx.composeName,
+		}))
+		t.Log(i18n.GetMsgWithMap("ComposeRecoverMetaLogPath", map[string]interface{}{
+			"backupPath": recoverCtx.meta.ComposePath,
+			"targetDir":  recoverCtx.targetDir,
+		}))
+		t.Log(i18n.GetMsgWithMap("ComposeRecoverMetaLogCount", map[string]interface{}{
+			"files":      len(recoverCtx.meta.Files),
+			"containers": len(recoverCtx.meta.Containers),
+		}))
+		return nil
+	}, nil, 3, timeout)
+	recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeRecoverFiles"), func(t *task.Task) error { return stepRestoreComposeFiles(recoverCtx) }, nil, 3, timeout)
+	recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeRecoverContainers"), func(t *task.Task) error {
+		if recoverCtx.enqueued {
+			return nil
+		}
+		containerItems := make([]string, 0, len(recoverCtx.meta.Containers))
+		for _, item := range recoverCtx.meta.Containers {
+			backupItem := item
+			filePath, err := safeJoinWithinBase(recoverCtx.tmpDir, backupItem)
+			if err != nil {
+				return fmt.Errorf("invalid container backup path %q, err: %v", backupItem, err)
+			}
+			if !recoverCtx.fileOp.Stat(filePath) {
+				return fmt.Errorf("container backup file not found: %s", backupItem)
+			}
+			containerItems = append(containerItems, backupItem)
+		}
+		for _, backupItem := range containerItems {
+			filePath, err := safeJoinWithinBase(recoverCtx.tmpDir, backupItem)
+			if err != nil {
+				return fmt.Errorf("invalid container backup path %q, err: %v", backupItem, err)
+			}
+			containerLabel := strings.TrimSuffix(path.Base(backupItem), ".tar.gz")
+			containerReq := recoverCtx.req
+			containerReq.Type = "container"
+			containerReq.Name = containerLabel
+			containerReq.DetailName = ""
+			containerReq.File = filePath
+			containerReq.Secret = ""
+			if err := handleContainerRecover(containerReq, recoverTask); err != nil {
+				return err
+			}
+		}
+		recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeRecoverRecord"), func(t *task.Task) error {
+			return stepSaveComposeRecord(recoverCtx)
+		}, nil, 3, timeout)
+		recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ComposeRecoverCleanup"), func(t *task.Task) error {
+			if recoverCtx != nil {
+				recoverCtx.close()
+				recoverCtx = nil
+			}
+			return nil
+		}, nil, 0, timeout)
+		recoverCtx.enqueued = true
+		return nil
+	}, nil, 3, timeout)
+	if parentTask != nil {
+		return nil
+	}
+	go func() {
+		_ = recoverTask.Execute()
+	}()
+	return nil
+}
+
+func newComposeBackupContext(req dto.CommonBackup, backupDir, fileName string) (*composeBackupContext, error) {
+	if req.Name == "" {
+		return nil, fmt.Errorf("compose name is required")
+	}
+	dockerClient, err := dockerUtils.NewDockerClient()
+	if err != nil {
+		return nil, err
+	}
+	composePath, composeFiles, err := loadComposePathAndFiles(req.Name, dockerClient)
+	if err != nil {
+		_ = dockerClient.Close()
+		return nil, err
+	}
+	filePath := path.Join(backupDir, fileName)
+	tmpDir := path.Join(path.Dir(filePath), strings.TrimSuffix(path.Base(filePath), ".tar.gz"))
+	ctx := &composeBackupContext{
+		req:          req,
+		composeName:  req.Name,
+		composePath:  composePath,
+		composeFiles: composeFiles,
+		composeDir:   path.Dir(composeFiles[0]),
+		fileOp:       files.NewFileOp(),
+		dockerClient: dockerClient,
+		backupDir:    backupDir,
+		fileName:     fileName,
+		filePath:     filePath,
+		tmpDir:       tmpDir,
+		meta: composeBackupMeta{
+			ComposeName: req.Name,
+			ComposePath: composePath,
+			CreatedAt:   time.Now().Format(constant.DateTimeLayout),
+			Files:       make([]composeBackupFile, 0),
+			Containers:  make([]string, 0),
+		},
+	}
+	return ctx, nil
+}
+
+func loadComposePathAndFiles(composeName string, dockerClient *client.Client) (string, []string, error) {
+	composeRecord, _ := composeRepo.GetRecord(repo.WithByName(composeName))
+	if composeRecord.ID == 0 {
+		composeRecord, _ = composeRepo.GetRecord(repo.WithByName(strings.ToLower(composeName)))
+	}
+	composePath := composeRecord.Path
+	if composePath == "" {
+		options := container.ListOptions{All: true}
+		options.Filters = filters.NewArgs(filters.Arg("label", composeProjectLabel))
+		list, err := dockerClient.ContainerList(context.Background(), options)
+		if err != nil {
+			return "", nil, err
+		}
+		if len(list) == 0 {
+			return "", nil, fmt.Errorf("compose %s not found", composeName)
+		}
+		var targetContainer *container.Summary
+		for i := range list {
+			if strings.EqualFold(list[i].Labels[composeProjectLabel], composeName) {
+				targetContainer = &list[i]
+				break
+			}
+		}
+		if targetContainer == nil {
+			return "", nil, fmt.Errorf("compose %s not found", composeName)
+		}
+		config := targetContainer.Labels[composeConfigLabel]
+		workdir := targetContainer.Labels[composeWorkdirLabel]
+		if len(config) != 0 && len(workdir) != 0 && strings.Contains(config, workdir) {
+			composePath = config
+		} else {
+			composePath = workdir
+		}
+	}
+	composeFiles := normalizeComposeFiles(composePath)
+	if len(composeFiles) == 0 {
+		return "", nil, fmt.Errorf("compose file not found for %s", composeName)
+	}
+	return composePath, composeFiles, nil
+}
+
+func normalizeComposeFiles(composePath string) []string {
+	items := strings.Split(composePath, ",")
+	result := make([]string, 0)
+	seen := make(map[string]struct{})
+	for _, item := range items {
+		item = strings.TrimSpace(item)
+		if item == "" {
+			continue
+		}
+		stat, err := os.Stat(item)
+		if err == nil && stat.IsDir() {
+			item = path.Join(item, "docker-compose.yml")
+		}
+		if _, err := os.Stat(item); err != nil {
+			continue
+		}
+		if _, ok := seen[item]; ok {
+			continue
+		}
+		seen[item] = struct{}{}
+		result = append(result, item)
+	}
+	sort.Strings(result)
+	return result
+}
+
+func (c *composeBackupContext) close() {
+	if c.dockerClient != nil {
+		_ = c.dockerClient.Close()
+		c.dockerClient = nil
+	}
+	if c.tmpDir != "" {
+		_ = os.RemoveAll(c.tmpDir)
+		c.tmpDir = ""
+	}
+}
+
+func stepPrepareComposeBackup(composeCtx *composeBackupContext) error {
+	if err := os.MkdirAll(composeCtx.backupDir, os.ModePerm); err != nil {
+		return fmt.Errorf("mkdir %s failed, err: %v", composeCtx.backupDir, err)
+	}
+	_ = os.RemoveAll(composeCtx.tmpDir)
+	if err := os.MkdirAll(path.Join(composeCtx.tmpDir, "compose_files"), os.ModePerm); err != nil {
+		return err
+	}
+	if err := os.MkdirAll(path.Join(composeCtx.tmpDir, "containers"), os.ModePerm); err != nil {
+		return err
+	}
+	return nil
+}
+
+func stepStopComposeForBackup(composeCtx *composeBackupContext) error {
+	if composeCtx.stopped {
+		return nil
+	}
+	options := container.ListOptions{All: false}
+	options.Filters = filters.NewArgs(filters.Arg("label", composeProjectLabel+"="+composeCtx.composeName))
+	runningList, err := composeCtx.dockerClient.ContainerList(context.Background(), options)
+	if err != nil {
+		return err
+	}
+	if len(runningList) == 0 {
+		return nil
+	}
+	if stdout, err := compose.Operate(composeCtx.composePath, "stop"); err != nil {
+		return fmt.Errorf("docker-compose stop failed, std: %s, err: %v", stdout, err)
+	}
+	composeCtx.stopped = true
+	return nil
+}
+
+func stepStartComposeAfterBackup(composeCtx *composeBackupContext) error {
+	if !composeCtx.stopped {
+		return nil
+	}
+	if stdout, err := compose.Up(composeCtx.composePath); err != nil {
+		return fmt.Errorf("docker-compose up failed, std: %s, err: %v", stdout, err)
+	}
+	composeCtx.stopped = false
+	return nil
+}
+
+func stepBackupComposeFiles(composeCtx *composeBackupContext) error {
+	for i, filePath := range composeCtx.composeFiles {
+		backupName := fmt.Sprintf("%02d_%s", i, path.Base(filePath))
+		backupPath := path.Join(composeCtx.tmpDir, "compose_files", backupName)
+		content, err := os.ReadFile(filePath)
+		if err != nil {
+			return err
+		}
+		if err := composeCtx.fileOp.SaveFile(backupPath, string(content), fs.ModePerm); err != nil {
+			return err
+		}
+		relativePath := path.Base(filePath)
+		if composeCtx.composeDir != "" {
+			rel, relErr := filepath.Rel(composeCtx.composeDir, filePath)
+			if relErr == nil {
+				rel = filepath.ToSlash(rel)
+				if rel != "" && rel != "." && !strings.HasPrefix(rel, "../") {
+					relativePath = rel
+				}
+			}
+		}
+		composeCtx.meta.Files = append(composeCtx.meta.Files, composeBackupFile{
+			OriginalPath: filePath,
+			FileName:     path.Base(filePath),
+			RelativePath: relativePath,
+			BackupPath:   path.Join("compose_files", backupName),
+		})
+	}
+	if len(composeCtx.composeFiles) != 0 {
+		envPath := path.Join(path.Dir(composeCtx.composeFiles[0]), ".env")
+		if composeCtx.fileOp.Stat(envPath) {
+			envContent, err := os.ReadFile(envPath)
+			if err != nil {
+				return err
+			}
+			if err := composeCtx.fileOp.SaveFile(path.Join(composeCtx.tmpDir, "compose_files", ".env"), string(envContent), fs.ModePerm); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func stepWriteComposeBackupMeta(composeCtx *composeBackupContext) error {
+	metaBytes, err := json.MarshalIndent(composeCtx.meta, "", "  ")
+	if err != nil {
+		return err
+	}
+	return composeCtx.fileOp.SaveFile(path.Join(composeCtx.tmpDir, "compose_meta.json"), string(metaBytes), fs.ModePerm)
+}
+
+func stepPackComposeBackup(composeCtx *composeBackupContext) error {
+	return composeCtx.fileOp.TarGzCompressPro(true, composeCtx.tmpDir, composeCtx.filePath, composeCtx.req.Secret, "")
+}
+
+func newComposeRecoverContext(req dto.CommonRecover) (*composeRecoverContext, error) {
+	tmpDir := path.Join(path.Dir(req.File), strings.TrimSuffix(path.Base(req.File), ".tar.gz"))
+	ctx := &composeRecoverContext{
+		req:    req,
+		fileOp: files.NewFileOp(),
+		tmpDir: tmpDir,
+		meta: composeBackupMeta{
+			Files:      make([]composeBackupFile, 0),
+			Containers: make([]string, 0),
+		},
+	}
+	return ctx, nil
+}
+
+func (c *composeRecoverContext) close() {
+	if c.tmpDir != "" {
+		_ = os.RemoveAll(c.tmpDir)
+	}
+}
+
+func stepPrepareComposeRecover(recoverCtx *composeRecoverContext) error {
+	if !recoverCtx.fileOp.Stat(recoverCtx.req.File) {
+		return buserr.WithName("ErrFileNotFound", recoverCtx.req.File)
+	}
+	_ = os.RemoveAll(recoverCtx.tmpDir)
+	return nil
+}
+
+func stepExtractComposeRecover(recoverCtx *composeRecoverContext) error {
+	return recoverCtx.fileOp.TarGzExtractPro(recoverCtx.req.File, path.Dir(recoverCtx.req.File), recoverCtx.req.Secret)
+}
+
+func stepLoadComposeRecoverMeta(recoverCtx *composeRecoverContext) error {
+	metaPath := path.Join(recoverCtx.tmpDir, "compose_meta.json")
+	if !recoverCtx.fileOp.Stat(metaPath) {
+		return fmt.Errorf("compose_meta.json not found in backup file")
+	}
+	metaBytes, err := os.ReadFile(metaPath)
+	if err != nil {
+		return err
+	}
+	if err := json.Unmarshal(metaBytes, &recoverCtx.meta); err != nil {
+		return fmt.Errorf("unmarshal compose_meta.json failed, err: %v", err)
+	}
+	recoverCtx.composeName = strings.TrimSpace(recoverCtx.req.Name)
+	if recoverCtx.composeName == "" {
+		recoverCtx.composeName = strings.TrimSpace(recoverCtx.meta.ComposeName)
+	}
+	if recoverCtx.composeName == "" {
+		return fmt.Errorf("compose name not found in recover request or backup file")
+	}
+	recoverCtx.targetDir = resolveComposeRecoverTargetDir(recoverCtx.meta, recoverCtx.composeName)
+	return nil
+}
+
+func resolveComposeRecoverTargetDir(meta composeBackupMeta, composeName string) string {
+	composePath := strings.TrimSpace(meta.ComposePath)
+	if composePath != "" {
+		items := strings.Split(composePath, ",")
+		for _, item := range items {
+			p := strings.TrimSpace(item)
+			if p == "" {
+				continue
+			}
+			ext := strings.ToLower(path.Ext(p))
+			if ext == ".yml" || ext == ".yaml" {
+				return path.Dir(p)
+			}
+			return p
+		}
+	}
+	return path.Join(global.Dir.DataDir, "docker/compose", composeName)
+}
+
+func safeJoinWithinBase(baseDir, name string) (string, error) {
+	base := filepath.Clean(baseDir)
+	candidate := strings.TrimSpace(name)
+	candidate = strings.ReplaceAll(candidate, "\\", "/")
+	candidate = filepath.Clean(filepath.FromSlash(candidate))
+	if candidate == "" || candidate == "." {
+		return "", fmt.Errorf("invalid path: empty")
+	}
+	if filepath.IsAbs(candidate) {
+		return "", fmt.Errorf("invalid path %q: absolute path is not allowed", name)
+	}
+	if candidate == ".." || strings.HasPrefix(candidate, ".."+string(filepath.Separator)) {
+		return "", fmt.Errorf("invalid path %q: path escapes base directory", name)
+	}
+	resolved := filepath.Clean(filepath.Join(base, candidate))
+	rel, err := filepath.Rel(base, resolved)
+	if err != nil {
+		return "", fmt.Errorf("resolve path %q failed, err: %v", name, err)
+	}
+	if rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
+		return "", fmt.Errorf("invalid path %q: path escapes base directory", name)
+	}
+	return resolved, nil
+}
+
+func stepRestoreComposeFiles(recoverCtx *composeRecoverContext) error {
+	if recoverCtx.targetDir != "" {
+		_ = os.RemoveAll(recoverCtx.targetDir)
+	}
+	if err := os.MkdirAll(recoverCtx.targetDir, os.ModePerm); err != nil {
+		return err
+	}
+	restored := make([]string, 0, len(recoverCtx.meta.Files))
+	for _, item := range recoverCtx.meta.Files {
+		backupPath, err := safeJoinWithinBase(recoverCtx.tmpDir, item.BackupPath)
+		if err != nil {
+			return fmt.Errorf("invalid compose backup path %q, err: %v", item.BackupPath, err)
+		}
+		if !recoverCtx.fileOp.Stat(backupPath) {
+			continue
+		}
+		targetName := item.FileName
+		if item.RelativePath != "" {
+			targetName = item.RelativePath
+		}
+		if targetName == "" {
+			targetName = path.Base(item.OriginalPath)
+		}
+		if targetName == "" {
+			targetName = "docker-compose.yml"
+		}
+		targetPath, err := safeJoinWithinBase(recoverCtx.targetDir, targetName)
+		if err != nil {
+			return fmt.Errorf("invalid compose target path %q, err: %v", targetName, err)
+		}
+		if err := os.MkdirAll(path.Dir(targetPath), os.ModePerm); err != nil {
+			return err
+		}
+		content, err := os.ReadFile(backupPath)
+		if err != nil {
+			return err
+		}
+		if err := recoverCtx.fileOp.SaveFile(targetPath, string(content), fs.ModePerm); err != nil {
+			return err
+		}
+		restored = append(restored, targetPath)
+	}
+	envPath := path.Join(recoverCtx.tmpDir, "compose_files", ".env")
+	if recoverCtx.fileOp.Stat(envPath) {
+		envContent, err := os.ReadFile(envPath)
+		if err != nil {
+			return err
+		}
+		if err := recoverCtx.fileOp.SaveFile(path.Join(recoverCtx.targetDir, ".env"), string(envContent), fs.ModePerm); err != nil {
+			return err
+		}
+	}
+	if len(restored) == 0 {
+		defaultPath := path.Join(recoverCtx.targetDir, "docker-compose.yml")
+		if !recoverCtx.fileOp.Stat(defaultPath) {
+			return fmt.Errorf("compose file not found in backup data")
+		}
+		restored = append(restored, defaultPath)
+	}
+	sort.Strings(restored)
+	recoverCtx.composePath = strings.Join(restored, ",")
+	return nil
+}
+
+func stepSaveComposeRecord(recoverCtx *composeRecoverContext) error {
+	if recoverCtx.composePath == "" {
+		recoverCtx.composePath = path.Join(recoverCtx.targetDir, "docker-compose.yml")
+	}
+	recordName := strings.ToLower(recoverCtx.composeName)
+	record, _ := composeRepo.GetRecord(repo.WithByName(recordName))
+	if record.ID == 0 {
+		return composeRepo.CreateRecord(&model.Compose{Name: recordName, Path: recoverCtx.composePath})
+	}
+	return composeRepo.UpdateRecord(recordName, map[string]interface{}{"path": recoverCtx.composePath})
+}
+
+func sanitizeComposeFileName(in string) string {
+	name := strings.TrimSpace(in)
+	name = strings.ReplaceAll(name, "/", "_")
+	name = strings.ReplaceAll(name, ":", "_")
+	if name == "" {
+		return "container"
+	}
+	return name
+}

agent/app/service/backup_container.go

@@ -0,0 +1,914 @@
+package service
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io/fs"
+	"os"
+	"path"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/app/task"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/i18n"
+	"github.com/1Panel-dev/1Panel/agent/utils/common"
+	dockerUtils "github.com/1Panel-dev/1Panel/agent/utils/docker"
+	"github.com/1Panel-dev/1Panel/agent/utils/files"
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/mount"
+	"github.com/docker/docker/api/types/network"
+	"github.com/docker/docker/api/types/volume"
+	"github.com/docker/docker/client"
+)
+
+type containerBackupMeta struct {
+	ContainerName string                 `json:"containerName"`
+	ContainerID   string                 `json:"containerID"`
+	CreatedAt     string                 `json:"createdAt"`
+	Image         string                 `json:"image"`
+	HostConfig    *container.HostConfig  `json:"hostConfig,omitempty"`
+	Config        *container.Config      `json:"config,omitempty"`
+	Mounts        []containerMountBackup `json:"mounts"`
+}
+
+type containerMountBackup struct {
+	Type        string `json:"type"`
+	Name        string `json:"name,omitempty"`
+	Source      string `json:"source,omitempty"`
+	Destination string `json:"destination"`
+	Mode        string `json:"mode,omitempty"`
+	RW          bool   `json:"rw"`
+	Propagation string `json:"propagation,omitempty"`
+	BackupPath  string `json:"backupPath,omitempty"`
+	Status      string `json:"status"`
+	Message     string `json:"message,omitempty"`
+}
+
+type containerBackupContext struct {
+	containerName string
+	backupDir     string
+	fileName      string
+	secret        string
+	filePath      string
+	tmpDir        string
+	mountRoot     string
+	wasRunning    bool
+	stopped       bool
+	fileOp        files.FileOp
+	inspectInfo   container.InspectResponse
+	meta          containerBackupMeta
+}
+
+type containerRecoverContext struct {
+	req                dto.CommonRecover
+	targetName         string
+	fileOp             files.FileOp
+	client             *client.Client
+	tmpDir             string
+	meta               containerBackupMeta
+	inspectInfo        container.InspectResponse
+	shouldStart        bool
+	createdContainerID string
+}
+
+func (u *BackupService) ContainerBackup(req dto.CommonBackup) error {
+	timeNow := time.Now().Format(constant.DateTimeSlimLayout) + common.RandStrAndNum(5)
+	fileName := req.FileName
+	if fileName == "" {
+		fileName = fmt.Sprintf("%s_%s.tar.gz", req.Name, timeNow)
+	}
+	if !strings.HasSuffix(fileName, ".tar.gz") {
+		fileName += ".tar.gz"
+	}
+	itemDir := fmt.Sprintf("container/%s", req.Name)
+	backupDir := path.Join(global.Dir.LocalBackupDir, itemDir)
+	record := &model.BackupRecord{
+		Type:              req.Type,
+		Name:              req.Name,
+		SourceAccountIDs:  "1",
+		DownloadAccountID: 1,
+		FileDir:           itemDir,
+		FileName:          fileName,
+		TaskID:            req.TaskID,
+		Status:            constant.StatusWaiting,
+		Description:       req.Description,
+	}
+	if err := backupRepo.CreateRecord(record); err != nil {
+		global.LOG.Errorf("save backup record failed, err: %v", err)
+		return err
+	}
+	if err := handleContainerBackup(req.Name, nil, record.ID, backupDir, fileName, req.TaskID, req.Secret, req.StopBefore); err != nil {
+		backupRepo.UpdateRecordByMap(record.ID, map[string]interface{}{"status": constant.StatusFailed, "message": err.Error()})
+		return err
+	}
+	return nil
+}
+
+func (u *BackupService) ContainerRecover(req dto.CommonRecover) error {
+	return handleContainerRecover(req, nil)
+}
+
+func handleContainerBackup(containerName string, parentTask *task.Task, recordID uint, backupDir, fileName, taskID, secret string, stopBefore bool) error {
+	var (
+		err        error
+		backupTask *task.Task
+	)
+	backupCtx, err := newContainerBackupContext(containerName, backupDir, fileName, secret)
+	if err != nil {
+		return err
+	}
+	backupTask = parentTask
+	if backupTask == nil {
+		backupTask, err = task.NewTaskWithOps(containerName, task.TaskBackup, task.TaskScopeBackup, taskID, 1)
+		if err != nil {
+			return err
+		}
+	}
+	if stopBefore {
+		backupTask.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerBackupStop"), func(t *task.Task) error {
+			return stepStopContainerForBackup(backupCtx)
+		}, func(t *task.Task) {
+			_ = stepStartContainerAfterBackup(backupCtx)
+		}, 3, time.Hour)
+	}
+	backupTask.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerBackupPrepare"), func(t *task.Task) error {
+		t.Logf("------------------ %s ------------------", containerName)
+		return stepPrepareContainerBackup(backupCtx)
+	}, nil, 3, time.Hour)
+	backupTask.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerBackupInspect"), func(t *task.Task) error { return stepBackupContainerInspect(backupCtx) }, nil, 3, time.Hour)
+	backupTask.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerBackupMounts"), func(t *task.Task) error { return stepBackupContainerMounts(backupCtx) }, nil, 3, time.Hour)
+	backupTask.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerBackupMeta"), func(t *task.Task) error { return stepWriteContainerMeta(backupCtx) }, nil, 3, time.Hour)
+	backupTask.AddSubTaskWithOps(task.GetTaskName(containerName, task.TaskBackup, task.TaskScopeBackup), func(t *task.Task) error { return stepPackContainerBackup(backupCtx) }, nil, 3, time.Hour)
+	if stopBefore {
+		backupTask.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerBackupStart"), func(t *task.Task) error {
+			return stepStartContainerAfterBackup(backupCtx)
+		}, nil, 3, time.Hour)
+	}
+	if parentTask != nil {
+		return nil
+	}
+	go func() {
+		defer backupCtx.close()
+		if err := backupTask.Execute(); err != nil {
+			backupRepo.UpdateRecordByMap(recordID, map[string]interface{}{"status": constant.StatusFailed, "message": err.Error()})
+			return
+		}
+		backupRepo.UpdateRecordByMap(recordID, map[string]interface{}{"status": constant.StatusSuccess})
+	}()
+	return nil
+}
+
+func handleContainerRecover(req dto.CommonRecover, parentTask *task.Task) error {
+	var (
+		err         error
+		recoverTask *task.Task
+		recoverCtx  *containerRecoverContext
+	)
+	recoverTask = parentTask
+	if recoverTask == nil {
+		if isImportRecover(req) {
+			taskName := i18n.GetMsgByKey("TaskImport") + i18n.GetMsgByKey("Container")
+			recoverTask, err = task.NewTask(taskName, task.TaskImport, task.TaskScopeBackup, req.TaskID, 1)
+			if err != nil {
+				return err
+			}
+		} else {
+			recoverTask, err = task.NewTaskWithOps("container", task.TaskRecover, task.TaskScopeBackup, req.TaskID, 1)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	timeout := loadRecoverTimeout(req.Timeout)
+	logName := strings.TrimSpace(req.Name)
+	if logName == "" && req.File != "" {
+		logName = strings.TrimSuffix(path.Base(req.File), ".tar.gz")
+	}
+	if logName == "" {
+		logName = "container"
+	}
+	recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerRecoverPrepare"), func(t *task.Task) error {
+		ctx, err := newContainerRecoverContext(req)
+		if err != nil {
+			return err
+		}
+		recoverCtx = ctx
+		t.Logf("------------------ %s ------------------", logName)
+		if err := stepPrepareContainerRecover(recoverCtx); err != nil {
+			recoverCtx.close()
+			recoverCtx = nil
+			return err
+		}
+		return nil
+	}, func(t *task.Task) {
+		if recoverCtx != nil {
+			recoverCtx.close()
+			recoverCtx = nil
+		}
+	}, 3, timeout)
+	recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerRecoverExtract"), func(t *task.Task) error { return stepExtractContainerRecover(recoverCtx) }, nil, 3, timeout)
+	recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerRecoverParse"), func(t *task.Task) error { return stepLoadContainerRecoverData(recoverCtx) }, nil, 3, timeout)
+	recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerRecoverCreate"), func(t *task.Task) error { return stepRecreateContainer(recoverCtx, t) }, nil, 3, timeout)
+	recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerRecoverMounts"), func(t *task.Task) error { return stepRestoreContainerMounts(recoverCtx) }, nil, 3, timeout)
+	recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerRecoverStart"), func(t *task.Task) error { return stepStartRecoveredContainer(recoverCtx) }, nil, 3, timeout)
+	recoverTask.AddSubTaskWithOps(i18n.GetMsgByKey("ContainerRecoverCleanup"), func(t *task.Task) error {
+		if recoverCtx != nil {
+			recoverCtx.close()
+			recoverCtx = nil
+		}
+		return nil
+	}, nil, 0, timeout)
+	if parentTask != nil {
+		return nil
+	}
+	go func() {
+		_ = recoverTask.Execute()
+	}()
+	return nil
+}
+
+func loadRecoverTimeout(timeout int) time.Duration {
+	switch timeout {
+	case -1:
+		return 0
+	case 0:
+		return 3 * time.Hour
+	default:
+		return time.Duration(timeout) * time.Second
+	}
+}
+
+func isImportRecover(req dto.CommonRecover) bool {
+	return req.BackupRecordID == 0
+}
+
+func newContainerBackupContext(containerName, backupDir, fileName, secret string) (*containerBackupContext, error) {
+	dockerClient, err := dockerUtils.NewDockerClient()
+	if err != nil {
+		return nil, err
+	}
+	defer func() {
+		_ = dockerClient.Close()
+	}()
+	inspectInfo, err := dockerClient.ContainerInspect(context.Background(), containerName)
+	if err != nil {
+		return nil, err
+	}
+	filePath := path.Join(backupDir, fileName)
+	tmpDir := path.Join(path.Dir(filePath), strings.TrimSuffix(path.Base(filePath), ".tar.gz"))
+	backupCtx := &containerBackupContext{
+		containerName: containerName,
+		backupDir:     backupDir,
+		fileName:      fileName,
+		secret:        secret,
+		filePath:      filePath,
+		tmpDir:        tmpDir,
+		mountRoot:     path.Join(tmpDir, "mounts"),
+		wasRunning:    inspectInfo.State != nil && inspectInfo.State.Running,
+		fileOp:        files.NewFileOp(),
+		inspectInfo:   inspectInfo,
+		meta: containerBackupMeta{
+			ContainerName: containerName,
+			ContainerID:   inspectInfo.ID,
+			CreatedAt:     time.Now().Format(constant.DateTimeLayout),
+			Image:         inspectInfo.Config.Image,
+			HostConfig:    inspectInfo.HostConfig,
+			Config:        inspectInfo.Config,
+			Mounts:        make([]containerMountBackup, 0),
+		},
+	}
+	return backupCtx, nil
+}
+
+func newContainerRecoverContext(req dto.CommonRecover) (*containerRecoverContext, error) {
+	dockerClient, err := dockerUtils.NewDockerClient()
+	if err != nil {
+		return nil, err
+	}
+	tmpDir := path.Join(path.Dir(req.File), strings.TrimSuffix(path.Base(req.File), ".tar.gz"))
+	ctx := &containerRecoverContext{
+		req:        req,
+		targetName: req.Name,
+		fileOp:     files.NewFileOp(),
+		client:     dockerClient,
+		tmpDir:     tmpDir,
+		meta: containerBackupMeta{
+			Mounts: make([]containerMountBackup, 0),
+		},
+	}
+	return ctx, nil
+}
+
+func (c *containerBackupContext) close() {
+	if c.tmpDir != "" {
+		_ = os.RemoveAll(c.tmpDir)
+	}
+}
+
+func (c *containerRecoverContext) close() {
+	if c.client != nil {
+		_ = c.client.Close()
+	}
+	if c.tmpDir != "" {
+		_ = os.RemoveAll(c.tmpDir)
+	}
+}
+
+func stepPrepareContainerBackup(backupCtx *containerBackupContext) error {
+	if err := os.MkdirAll(backupCtx.backupDir, os.ModePerm); err != nil {
+		return fmt.Errorf("mkdir %s failed, err: %v", backupCtx.backupDir, err)
+	}
+	_ = os.RemoveAll(backupCtx.tmpDir)
+	if err := os.MkdirAll(backupCtx.mountRoot, os.ModePerm); err != nil {
+		return err
+	}
+	return nil
+}
+
+func stepStopContainerForBackup(backupCtx *containerBackupContext) error {
+	if !backupCtx.wasRunning || backupCtx.stopped {
+		return nil
+	}
+	dockerClient, err := dockerUtils.NewDockerClient()
+	if err != nil {
+		return err
+	}
+	defer func() {
+		_ = dockerClient.Close()
+	}()
+	if err := dockerClient.ContainerStop(context.Background(), backupCtx.inspectInfo.ID, container.StopOptions{}); err != nil {
+		return err
+	}
+	backupCtx.stopped = true
+	return nil
+}
+
+func stepStartContainerAfterBackup(backupCtx *containerBackupContext) error {
+	if !backupCtx.stopped {
+		return nil
+	}
+	dockerClient, err := dockerUtils.NewDockerClient()
+	if err != nil {
+		return err
+	}
+	defer func() {
+		_ = dockerClient.Close()
+	}()
+	if err := dockerClient.ContainerStart(context.Background(), backupCtx.inspectInfo.ID, container.StartOptions{}); err != nil {
+		return err
+	}
+	backupCtx.stopped = false
+	return nil
+}
+
+func stepBackupContainerInspect(backupCtx *containerBackupContext) error {
+	inspectBytes, err := json.MarshalIndent(backupCtx.inspectInfo, "", "  ")
+	if err != nil {
+		return err
+	}
+	if err := backupCtx.fileOp.SaveFile(path.Join(backupCtx.tmpDir, "inspect.json"), string(inspectBytes), fs.ModePerm); err != nil {
+		return err
+	}
+	if backupCtx.inspectInfo.NetworkSettings != nil {
+		networkBytes, err := json.MarshalIndent(backupCtx.inspectInfo.NetworkSettings, "", "  ")
+		if err != nil {
+			return err
+		}
+		if err := backupCtx.fileOp.SaveFile(path.Join(backupCtx.tmpDir, "network.json"), string(networkBytes), fs.ModePerm); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func stepBackupContainerMounts(backupCtx *containerBackupContext) error {
+	var (
+		dockerClient *client.Client
+		clientErr    error
+	)
+	ensureClient := func() (*client.Client, error) {
+		if dockerClient != nil || clientErr != nil {
+			return dockerClient, clientErr
+		}
+		dockerClient, clientErr = dockerUtils.NewDockerClient()
+		return dockerClient, clientErr
+	}
+	defer func() {
+		if dockerClient != nil {
+			_ = dockerClient.Close()
+		}
+	}()
+
+	for i, item := range backupCtx.inspectInfo.Mounts {
+		mountMeta := containerMountBackup{
+			Type:        string(item.Type),
+			Name:        item.Name,
+			Source:      item.Source,
+			Destination: item.Destination,
+			Mode:        item.Mode,
+			RW:          item.RW,
+			Propagation: string(item.Propagation),
+			Status:      "skipped",
+		}
+
+		mountDirName := fmt.Sprintf("%02d_%s", i, sanitizeContainerMountName(item.Destination))
+		mountDir := path.Join(backupCtx.mountRoot, mountDirName)
+		mountMeta.BackupPath = path.Join("mounts", mountDirName, "data")
+
+		switch item.Type {
+		case mount.TypeBind, mount.TypeVolume:
+			if item.Source == "" {
+				mountMeta.Message = "empty source"
+				backupCtx.meta.Mounts = append(backupCtx.meta.Mounts, mountMeta)
+				continue
+			}
+			sourceInfo, statErr := os.Stat(item.Source)
+			if statErr != nil {
+				mountMeta.Message = statErr.Error()
+				backupCtx.meta.Mounts = append(backupCtx.meta.Mounts, mountMeta)
+				continue
+			}
+			dataDir := path.Join(mountDir, "data")
+			if err := os.MkdirAll(dataDir, os.ModePerm); err != nil {
+				return err
+			}
+			if sourceInfo.IsDir() {
+				if err := backupCtx.fileOp.CopyDirWithNewName(item.Source, dataDir, "."); err != nil {
+					return err
+				}
+			} else {
+				if err := backupCtx.fileOp.CopyFile(item.Source, dataDir); err != nil {
+					return err
+				}
+			}
+
+			if item.Type == mount.TypeVolume && item.Name != "" {
+				cli, err := ensureClient()
+				if err != nil {
+					return err
+				}
+				volumeInfo, volumeErr := cli.VolumeInspect(context.Background(), item.Name)
+				if volumeErr == nil {
+					volumeBytes, volumeMarshalErr := json.MarshalIndent(volumeInfo, "", "  ")
+					if volumeMarshalErr == nil {
+						_ = backupCtx.fileOp.SaveFile(path.Join(mountDir, "volume.json"), string(volumeBytes), fs.ModePerm)
+					}
+				}
+			}
+			mountMeta.Status = "backed_up"
+		default:
+			mountMeta.Message = "mount type not supported for data backup"
+		}
+		backupCtx.meta.Mounts = append(backupCtx.meta.Mounts, mountMeta)
+	}
+	return nil
+}
+
+func stepWriteContainerMeta(backupCtx *containerBackupContext) error {
+	metaBytes, err := json.MarshalIndent(backupCtx.meta, "", "  ")
+	if err != nil {
+		return err
+	}
+	if err := backupCtx.fileOp.SaveFile(path.Join(backupCtx.tmpDir, "meta.json"), string(metaBytes), fs.ModePerm); err != nil {
+		return err
+	}
+	return nil
+}
+
+func stepPackContainerBackup(backupCtx *containerBackupContext) error {
+	if err := backupCtx.fileOp.TarGzCompressPro(true, backupCtx.tmpDir, backupCtx.filePath, backupCtx.secret, ""); err != nil {
+		return err
+	}
+	return nil
+}
+
+func stepPrepareContainerRecover(recoverCtx *containerRecoverContext) error {
+	if !recoverCtx.fileOp.Stat(recoverCtx.req.File) {
+		return buserr.WithName("ErrFileNotFound", recoverCtx.req.File)
+	}
+	_ = os.RemoveAll(recoverCtx.tmpDir)
+	return nil
+}
+
+func stepExtractContainerRecover(recoverCtx *containerRecoverContext) error {
+	return recoverCtx.fileOp.TarGzExtractPro(recoverCtx.req.File, path.Dir(recoverCtx.req.File), recoverCtx.req.Secret)
+}
+
+func stepLoadContainerRecoverData(recoverCtx *containerRecoverContext) error {
+	if err := loadContainerRecoverMeta(recoverCtx); err != nil {
+		return err
+	}
+	if err := loadContainerRecoverInspect(recoverCtx); err != nil {
+		return err
+	}
+	if recoverCtx.targetName == "" {
+		recoverCtx.targetName = strings.TrimPrefix(recoverCtx.inspectInfo.Name, "/")
+	}
+	if recoverCtx.targetName == "" {
+		recoverCtx.targetName = recoverCtx.meta.ContainerName
+	}
+	if recoverCtx.targetName == "" {
+		return fmt.Errorf("container name not found in recover request or backup file")
+	}
+	if recoverCtx.inspectInfo.Config == nil {
+		recoverCtx.inspectInfo.Config = recoverCtx.meta.Config
+	}
+	if recoverCtx.inspectInfo.HostConfig == nil {
+		recoverCtx.inspectInfo.HostConfig = recoverCtx.meta.HostConfig
+	}
+	if recoverCtx.inspectInfo.Config == nil {
+		return fmt.Errorf("container config not found in backup file")
+	}
+	if recoverCtx.inspectInfo.HostConfig == nil {
+		recoverCtx.inspectInfo.HostConfig = &container.HostConfig{}
+	}
+	recoverCtx.shouldStart = recoverCtx.inspectInfo.State != nil && recoverCtx.inspectInfo.State.Running
+	return nil
+}
+
+func loadContainerRecoverMeta(recoverCtx *containerRecoverContext) error {
+	metaPath := path.Join(recoverCtx.tmpDir, "meta.json")
+	if !recoverCtx.fileOp.Stat(metaPath) {
+		return nil
+	}
+	metaBytes, err := os.ReadFile(metaPath)
+	if err != nil {
+		return err
+	}
+	if err := json.Unmarshal(metaBytes, &recoverCtx.meta); err != nil {
+		return fmt.Errorf("unmarshal meta.json failed, err: %v", err)
+	}
+	return nil
+}
+
+func loadContainerRecoverInspect(recoverCtx *containerRecoverContext) error {
+	inspectPath := path.Join(recoverCtx.tmpDir, "inspect.json")
+	if !recoverCtx.fileOp.Stat(inspectPath) {
+		return fmt.Errorf("inspect.json not found in backup file")
+	}
+	inspectBytes, err := os.ReadFile(inspectPath)
+	if err != nil {
+		return err
+	}
+	if err := json.Unmarshal(inspectBytes, &recoverCtx.inspectInfo); err != nil {
+		return fmt.Errorf("unmarshal inspect.json failed, err: %v", err)
+	}
+	return nil
+}
+
+func stepRecreateContainer(recoverCtx *containerRecoverContext, taskItem *task.Task) error {
+	ctx := context.Background()
+	if err := ensureContainerRecoverNetworks(recoverCtx); err != nil {
+		return err
+	}
+	if err := ensureContainerRecoverVolumes(recoverCtx); err != nil {
+		return err
+	}
+
+	config := cloneContainerConfig(recoverCtx.inspectInfo.Config)
+	hostConfig := cloneContainerHostConfig(recoverCtx.inspectInfo.HostConfig)
+	if config.Image == "" {
+		config.Image = recoverCtx.meta.Image
+	}
+	if config.Image == "" {
+		return fmt.Errorf("container image not found in backup file")
+	}
+	if !checkImageExist(recoverCtx.client, config.Image) {
+		if err := pullImages(taskItem, recoverCtx.client, config.Image); err != nil {
+			return err
+		}
+	}
+
+	if _, err := recoverCtx.client.ContainerInspect(ctx, recoverCtx.targetName); err == nil {
+		if err := recoverCtx.client.ContainerRemove(ctx, recoverCtx.targetName, container.RemoveOptions{Force: true, RemoveVolumes: false}); err != nil {
+			return err
+		}
+	} else if !client.IsErrNotFound(err) {
+		return err
+	}
+
+	networkConfig, extraNetworks := buildContainerRecoverNetworkConfig(recoverCtx.inspectInfo.NetworkSettings, hostConfig)
+	removeBridgeDriverIPAM(recoverCtx.client, networkConfig, extraNetworks)
+	createRes, err := recoverCtx.client.ContainerCreate(ctx, config, hostConfig, networkConfig, nil, recoverCtx.targetName)
+	if err != nil {
+		return err
+	}
+	recoverCtx.createdContainerID = createRes.ID
+
+	extraNames := make([]string, 0, len(extraNetworks))
+	for name := range extraNetworks {
+		extraNames = append(extraNames, name)
+	}
+	sort.Strings(extraNames)
+	for _, item := range extraNames {
+		if err := recoverCtx.client.NetworkConnect(ctx, item, recoverCtx.createdContainerID, extraNetworks[item]); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func removeBridgeDriverIPAM(cli *client.Client, primary *network.NetworkingConfig, extras map[string]*network.EndpointSettings) {
+	if primary != nil {
+		removeBridgeDriverIPAMFromEndpoints(cli, primary.EndpointsConfig)
+	}
+	removeBridgeDriverIPAMFromEndpoints(cli, extras)
+}
+
+func removeBridgeDriverIPAMFromEndpoints(cli *client.Client, endpoints map[string]*network.EndpointSettings) {
+	for netName, endpoint := range endpoints {
+		if endpoint == nil || endpoint.IPAMConfig == nil {
+			continue
+		}
+		info, err := cli.NetworkInspect(context.Background(), netName, network.InspectOptions{})
+		if err != nil {
+			continue
+		}
+		if info.Driver == "bridge" {
+			endpoint.IPAMConfig = nil
+		}
+	}
+}
+
+func ensureContainerRecoverNetworks(recoverCtx *containerRecoverContext) error {
+	if recoverCtx.inspectInfo.NetworkSettings == nil {
+		return nil
+	}
+	for netName := range recoverCtx.inspectInfo.NetworkSettings.Networks {
+		if netName == "" || netName == "bridge" || netName == "host" || netName == "none" {
+			continue
+		}
+		if _, err := recoverCtx.client.NetworkInspect(context.Background(), netName, network.InspectOptions{}); err != nil {
+			if !client.IsErrNotFound(err) {
+				return err
+			}
+			if _, err := recoverCtx.client.NetworkCreate(context.Background(), netName, network.CreateOptions{Driver: "bridge"}); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func ensureContainerRecoverVolumes(recoverCtx *containerRecoverContext) error {
+	for _, item := range recoverCtx.meta.Mounts {
+		if item.Type != string(mount.TypeVolume) || item.Name == "" {
+			continue
+		}
+		if _, err := recoverCtx.client.VolumeInspect(context.Background(), item.Name); err == nil {
+			continue
+		} else if !client.IsErrNotFound(err) {
+			return err
+		}
+		createOptions := volume.CreateOptions{Name: item.Name}
+		if item.BackupPath != "" {
+			volumeMetaPath := path.Join(recoverCtx.tmpDir, path.Dir(item.BackupPath), "volume.json")
+			if recoverCtx.fileOp.Stat(volumeMetaPath) {
+				volumeBytes, readErr := os.ReadFile(volumeMetaPath)
+				if readErr != nil {
+					return readErr
+				}
+				var volumeInfo volume.Volume
+				if unmarshalErr := json.Unmarshal(volumeBytes, &volumeInfo); unmarshalErr != nil {
+					return unmarshalErr
+				}
+				if volumeInfo.Driver != "" {
+					createOptions.Driver = volumeInfo.Driver
+				}
+				if len(volumeInfo.Options) != 0 {
+					createOptions.DriverOpts = volumeInfo.Options
+				}
+				if len(volumeInfo.Labels) != 0 {
+					createOptions.Labels = volumeInfo.Labels
+				}
+			}
+		}
+		if _, err := recoverCtx.client.VolumeCreate(context.Background(), createOptions); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func buildContainerRecoverNetworkConfig(networkSettings *container.NetworkSettings, hostConfig *container.HostConfig) (*network.NetworkingConfig, map[string]*network.EndpointSettings) {
+	extraNetworks := make(map[string]*network.EndpointSettings)
+	if hostConfig != nil {
+		networkMode := string(hostConfig.NetworkMode)
+		if networkMode == "host" || networkMode == "none" {
+			return nil, extraNetworks
+		}
+	}
+	if networkSettings == nil || len(networkSettings.Networks) == 0 {
+		return nil, extraNetworks
+	}
+
+	primaryName := ""
+	if hostConfig != nil {
+		networkMode := string(hostConfig.NetworkMode)
+		if networkMode != "" && networkMode != "default" && networkMode != "bridge" {
+			if _, ok := networkSettings.Networks[networkMode]; ok {
+				primaryName = networkMode
+			}
+		}
+	}
+	if primaryName == "" {
+		if _, ok := networkSettings.Networks["bridge"]; ok {
+			primaryName = "bridge"
+		} else {
+			names := make([]string, 0, len(networkSettings.Networks))
+			for name := range networkSettings.Networks {
+				names = append(names, name)
+			}
+			sort.Strings(names)
+			if len(names) > 0 {
+				primaryName = names[0]
+			}
+		}
+	}
+
+	config := &network.NetworkingConfig{EndpointsConfig: make(map[string]*network.EndpointSettings)}
+	for name, endpoint := range networkSettings.Networks {
+		if name == "host" || name == "none" {
+			continue
+		}
+		endpointSetting := &network.EndpointSettings{Aliases: append([]string(nil), endpoint.Aliases...), MacAddress: endpoint.MacAddress}
+		if endpoint.IPAMConfig != nil {
+			endpointSetting.IPAMConfig = &network.EndpointIPAMConfig{
+				IPv4Address: endpoint.IPAMConfig.IPv4Address,
+				IPv6Address: endpoint.IPAMConfig.IPv6Address,
+			}
+		} else if endpoint.IPAddress != "" || endpoint.GlobalIPv6Address != "" {
+			endpointSetting.IPAMConfig = &network.EndpointIPAMConfig{
+				IPv4Address: endpoint.IPAddress,
+				IPv6Address: endpoint.GlobalIPv6Address,
+			}
+		}
+		if name == primaryName {
+			config.EndpointsConfig[name] = endpointSetting
+		} else {
+			extraNetworks[name] = endpointSetting
+		}
+	}
+	if len(config.EndpointsConfig) == 0 {
+		return nil, extraNetworks
+	}
+	return config, extraNetworks
+}
+
+func cloneContainerConfig(config *container.Config) *container.Config {
+	if config == nil {
+		return &container.Config{}
+	}
+	item := *config
+	if len(config.Env) != 0 {
+		item.Env = append([]string(nil), config.Env...)
+	}
+	if len(config.Cmd) != 0 {
+		item.Cmd = append([]string(nil), config.Cmd...)
+	}
+	if len(config.Entrypoint) != 0 {
+		item.Entrypoint = append([]string(nil), config.Entrypoint...)
+	}
+	if len(config.Labels) != 0 {
+		labels := make(map[string]string, len(config.Labels))
+		for key, val := range config.Labels {
+			labels[key] = val
+		}
+		item.Labels = labels
+	}
+	if len(config.Volumes) != 0 {
+		volumes := make(map[string]struct{}, len(config.Volumes))
+		for key, val := range config.Volumes {
+			volumes[key] = val
+		}
+		item.Volumes = volumes
+	}
+	return &item
+}
+
+func cloneContainerHostConfig(hostConfig *container.HostConfig) *container.HostConfig {
+	if hostConfig == nil {
+		return &container.HostConfig{}
+	}
+	item := *hostConfig
+	if len(hostConfig.Binds) != 0 {
+		item.Binds = append([]string(nil), hostConfig.Binds...)
+	}
+	if len(hostConfig.DNS) != 0 {
+		item.DNS = append([]string(nil), hostConfig.DNS...)
+	}
+	if len(hostConfig.ExtraHosts) != 0 {
+		item.ExtraHosts = append([]string(nil), hostConfig.ExtraHosts...)
+	}
+	if len(hostConfig.Mounts) != 0 {
+		item.Mounts = append([]mount.Mount(nil), hostConfig.Mounts...)
+	}
+	return &item
+}
+
+func stepRestoreContainerMounts(recoverCtx *containerRecoverContext) error {
+	currentContainer := recoverCtx.createdContainerID
+	if currentContainer == "" {
+		currentContainer = recoverCtx.targetName
+	}
+	currentInspect, err := recoverCtx.client.ContainerInspect(context.Background(), currentContainer)
+	if err != nil {
+		return err
+	}
+	currentMounts := make(map[string]container.MountPoint, len(currentInspect.Mounts))
+	for _, item := range currentInspect.Mounts {
+		currentMounts[item.Destination] = item
+	}
+
+	for _, item := range recoverCtx.meta.Mounts {
+		if item.Status != "backed_up" || item.BackupPath == "" || !item.RW {
+			continue
+		}
+		backupPath := path.Join(recoverCtx.tmpDir, item.BackupPath)
+		if !recoverCtx.fileOp.Stat(backupPath) {
+			continue
+		}
+		sourcePath := item.Source
+		if currentMount, ok := currentMounts[item.Destination]; ok {
+			if currentMount.Source != "" {
+				sourcePath = currentMount.Source
+			}
+			if item.Type == string(mount.TypeVolume) && item.Name == "" {
+				item.Name = currentMount.Name
+			}
+		}
+		if sourcePath == "" && item.Type == string(mount.TypeVolume) && item.Name != "" {
+			volumeInfo, volumeErr := recoverCtx.client.VolumeInspect(context.Background(), item.Name)
+			if volumeErr != nil {
+				return volumeErr
+			}
+			sourcePath = volumeInfo.Mountpoint
+		}
+		if sourcePath == "" {
+			continue
+		}
+		if err := restoreContainerMountData(recoverCtx.fileOp, backupPath, sourcePath); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func restoreContainerMountData(fileOp files.FileOp, backupPath, sourcePath string) error {
+	if sourcePath == "/" {
+		return fmt.Errorf("invalid mount source path /")
+	}
+	entries, err := os.ReadDir(backupPath)
+	if err != nil {
+		return err
+	}
+	if len(entries) == 1 && !entries[0].IsDir() && entries[0].Name() == path.Base(sourcePath) {
+		if err := os.MkdirAll(path.Dir(sourcePath), os.ModePerm); err != nil {
+			return err
+		}
+		_ = os.RemoveAll(sourcePath)
+		if err := fileOp.CopyFile(path.Join(backupPath, entries[0].Name()), path.Dir(sourcePath)); err != nil {
+			return err
+		}
+		return nil
+	}
+
+	_ = os.RemoveAll(sourcePath)
+	if err := os.MkdirAll(sourcePath, os.ModePerm); err != nil {
+		return err
+	}
+	if err := fileOp.CopyDirWithNewName(backupPath, sourcePath, "."); err != nil {
+		return err
+	}
+	return nil
+}
+
+func stepStartRecoveredContainer(recoverCtx *containerRecoverContext) error {
+	if !recoverCtx.shouldStart {
+		return nil
+	}
+	containerID := recoverCtx.createdContainerID
+	if containerID == "" {
+		containerID = recoverCtx.targetName
+	}
+	return recoverCtx.client.ContainerStart(context.Background(), containerID, container.StartOptions{})
+}
+
+func sanitizeContainerMountName(in string) string {
+	name := strings.TrimSpace(in)
+	name = strings.Trim(name, "/")
+	name = strings.ReplaceAll(name, "/", "_")
+	name = strings.ReplaceAll(name, ":", "_")
+	if name == "" {
+		return "root"
+	}
+	return name
+}

agent/app/service/container.go

@@ -1,7 +1,9 @@
 package service
 
 import (
+	"archive/tar"
 	"bufio"
+	"bytes"
 	"context"
 	"encoding/base64"
 	"encoding/json"
@@ -11,6 +13,7 @@ import (
 	"net/url"
 	"os"
 	"os/exec"
+	"path"
 	"path/filepath"
 	"sort"
 	"strconv"
@@ -40,10 +43,10 @@ import (
 	"github.com/docker/docker/api/types/registry"
 	"github.com/docker/docker/api/types/volume"
 	"github.com/docker/docker/client"
+	"github.com/docker/docker/pkg/stdcopy"
 	"github.com/docker/go-connections/nat"
 	"github.com/gin-gonic/gin"
 	v1 "github.com/opencontainers/image-spec/specs-go/v1"
-	"github.com/pkg/errors"
 	"github.com/shirou/gopsutil/v4/cpu"
 	"github.com/shirou/gopsutil/v4/mem"
 )
@@ -69,7 +72,6 @@ type IContainerService interface {
 	ComposeLogClean(req dto.ComposeLogClean) error
 
 	ContainerCreate(req dto.ContainerOperate, inThread bool) error
-	ContainerCreateByCommand(req dto.ContainerCreateByCommand) error
 	ContainerUpdate(req dto.ContainerOperate) error
 	ContainerUpgrade(req dto.ContainerUpgrade) error
 	ContainerInfo(req dto.OperationWithName) (*dto.ContainerOperate, error)
@@ -91,6 +93,12 @@ type IContainerService interface {
 	Prune(req dto.ContainerPrune) error
 
 	LoadUsers(req dto.OperationWithName) []string
+	ListContainerFiles(req dto.ContainerFileReq) ([]dto.ContainerFileInfo, error)
+	UploadContainerFile(req dto.ContainerFileReq, fileName string, fileSize int64, file io.Reader) error
+	GetContainerFileContent(req dto.ContainerFileReq) (*dto.ContainerFileContent, error)
+	GetContainerFileSize(req dto.ContainerFileReq) (int64, error)
+	DeleteContainerFile(req dto.ContainerFileBatchDeleteReq) error
+	DownloadContainerFile(req dto.ContainerFileReq) (io.ReadCloser, string, string, error)
 
 	StreamLogs(ctx *gin.Context, params dto.StreamLog)
 }
@@ -104,7 +112,7 @@ func (u *ContainerService) Page(req dto.PageContainer) (int64, interface{}, erro
 	if err != nil {
 		return 0, nil, err
 	}
-	defer client.Close()
+	defer func() { _ = client.Close() }()
 	options := container.ListOptions{All: true}
 	if len(req.Filters) != 0 {
 		options.Filters = filters.NewArgs()
@@ -302,42 +310,6 @@ func (u *ContainerService) ContainerListStats() ([]dto.ContainerListStats, error
 	return datas, nil
 }
 
-func (u *ContainerService) ContainerCreateByCommand(req dto.ContainerCreateByCommand) error {
-	if cmd.CheckIllegal(req.Command) {
-		return buserr.New("ErrCmdIllegal")
-	}
-	if !strings.HasPrefix(strings.TrimSpace(req.Command), "docker run ") {
-		return errors.New("error command format")
-	}
-	containerName := ""
-	commands := strings.Split(req.Command, " ")
-	for index, val := range commands {
-		if val == "--name" && len(commands) > index+1 {
-			containerName = commands[index+1]
-		}
-	}
-	if !strings.Contains(req.Command, " -d ") {
-		req.Command = strings.ReplaceAll(req.Command, "docker run", "docker run -d")
-	}
-	if len(containerName) == 0 {
-		containerName = fmt.Sprintf("1Panel-%s-%s", common.RandStr(5), common.RandStrAndNum(4))
-		req.Command += fmt.Sprintf(" --name %s", containerName)
-	}
-	taskItem, err := task.NewTaskWithOps(containerName, task.TaskCreate, task.TaskScopeContainer, req.TaskID, 1)
-	if err != nil {
-		global.LOG.Errorf("new task for create container failed, err: %v", err)
-		return err
-	}
-	go func() {
-		taskItem.AddSubTask(i18n.GetWithName("ContainerCreate", containerName), func(t *task.Task) error {
-			cmdMgr := cmd.NewCommandMgr(cmd.WithTask(*taskItem), cmd.WithTimeout(5*time.Minute))
-			return cmdMgr.RunBashC(req.Command)
-		}, nil)
-		_ = taskItem.Execute()
-	}()
-	return nil
-}
-
 func (u *ContainerService) Inspect(req dto.InspectReq) (string, error) {
 	client, err := docker.NewDockerClient()
 	if err != nil {
@@ -621,6 +593,16 @@ func (u *ContainerService) ContainerInfo(req dto.OperationWithName) (*dto.Contai
 	data.ExposedPorts = loadContainerPortForInfo(exposePorts)
 	data.Hostname = oldContainer.Config.Hostname
 	data.DNS = oldContainer.HostConfig.DNS
+	for _, item := range oldContainer.HostConfig.ExtraHosts {
+		parts := strings.SplitN(item, ":", 2)
+		if len(parts) != 2 || len(parts[0]) == 0 || len(parts[1]) == 0 {
+			continue
+		}
+		data.ExtraHosts = append(data.ExtraHosts, dto.ExtraHost{
+			Hostname: parts[0],
+			IP:       parts[1],
+		})
+	}
 	data.DomainName = oldContainer.Config.Domainname
 
 	data.Cmd = oldContainer.Config.Cmd
@@ -1181,7 +1163,7 @@ func (u *ContainerService) ContainerStats(id string) (*dto.ContainerStats, error
 
 func (u *ContainerService) LoadUsers(req dto.OperationWithName) []string {
 	var users []string
-	std, err := cmd.RunDefaultWithStdoutBashCf("docker exec %s cat /etc/passwd", req.Name)
+	std, err := cmd.NewCommandMgr(cmd.WithTimeout(20*time.Second)).RunWithStdout("docker", "exec", req.Name, "cat", "/etc/passwd")
 	if err != nil {
 		return users
 	}
@@ -1194,6 +1176,455 @@ func (u *ContainerService) LoadUsers(req dto.OperationWithName) []string {
 	return users
 }
 
+func (u *ContainerService) ListContainerFiles(req dto.ContainerFileReq) ([]dto.ContainerFileInfo, error) {
+	if len(req.Path) == 0 {
+		req.Path = "/"
+	}
+	cli, err := docker.NewDockerClient()
+	if err != nil {
+		return nil, err
+	}
+	defer cli.Close()
+
+	ctx := context.Background()
+	stat, err := cli.ContainerStatPath(ctx, req.ContainerID, req.Path)
+	if err != nil {
+		return nil, normalizeContainerFileError(err)
+	}
+	isDir := stat.Mode.IsDir()
+	isLink := stat.Mode&os.ModeSymlink != 0
+	if isLink && !isDir {
+		linkDir, linkErr := isContainerDir(cli, req.ContainerID, req.Path)
+		if linkErr == nil {
+			isDir = linkDir
+		}
+	}
+	if !isDir {
+		return []dto.ContainerFileInfo{toContainerFileInfo(req.Path, stat, isDir)}, nil
+	}
+
+	output, err := runContainerCommand(cli, req.ContainerID, []string{"ls", "-1A", "--", req.Path})
+	if err != nil {
+		return nil, normalizeContainerFileError(err)
+	}
+	lines := strings.Split(strings.TrimSpace(output), "\n")
+	files := make([]dto.ContainerFileInfo, 0, len(lines))
+	for _, line := range lines {
+		name := strings.TrimSpace(line)
+		if len(name) == 0 || name == "." || name == ".." {
+			continue
+		}
+		childPath := req.Path
+		if childPath == "/" {
+			childPath = "/" + name
+		} else {
+			childPath = strings.TrimSuffix(childPath, "/") + "/" + name
+		}
+		childStat, statErr := cli.ContainerStatPath(ctx, req.ContainerID, childPath)
+		if statErr != nil {
+			continue
+		}
+		childIsDir := childStat.Mode.IsDir()
+		if childStat.Mode&os.ModeSymlink != 0 && !childIsDir {
+			linkDir, linkErr := isContainerDir(cli, req.ContainerID, childPath)
+			if linkErr == nil {
+				childIsDir = linkDir
+			}
+		}
+		files = append(files, toContainerFileInfo(childPath, childStat, childIsDir))
+	}
+	sort.Slice(files, func(i, j int) bool {
+		if files[i].IsDir != files[j].IsDir {
+			return files[i].IsDir
+		}
+		return strings.ToLower(files[i].Name) < strings.ToLower(files[j].Name)
+	})
+	return files, nil
+}
+
+func (u *ContainerService) DeleteContainerFile(req dto.ContainerFileBatchDeleteReq) error {
+	for _, item := range req.Paths {
+		if strings.TrimSpace(item) == "/" {
+			return buserr.New("ErrPathNotDelete")
+		}
+	}
+	cli, err := docker.NewDockerClient()
+	if err != nil {
+		return err
+	}
+	defer cli.Close()
+
+	command := []string{"rm", "-rf", "--"}
+	command = append(command, req.Paths...)
+	_, err = runContainerCommand(cli, req.ContainerID, command)
+	return err
+}
+
+func (u *ContainerService) UploadContainerFile(req dto.ContainerFileReq, fileName string, fileSize int64, file io.Reader) error {
+	if len(req.Path) == 0 {
+		req.Path = "/"
+	}
+	safeName := path.Base(fileName)
+	if safeName == "." || safeName == "/" || len(safeName) == 0 {
+		return buserr.New("ErrInvalidChar")
+	}
+
+	cli, err := docker.NewDockerClient()
+	if err != nil {
+		return err
+	}
+	defer cli.Close()
+
+	ctx := context.Background()
+	stat, err := cli.ContainerStatPath(ctx, req.ContainerID, req.Path)
+	if err != nil {
+		if _, mkErr := runContainerCommand(cli, req.ContainerID, []string{"mkdir", "-p", "--", req.Path}); mkErr != nil {
+			return mkErr
+		}
+		stat, err = cli.ContainerStatPath(ctx, req.ContainerID, req.Path)
+		if err != nil {
+			return err
+		}
+	}
+	if !stat.Mode.IsDir() {
+		return fmt.Errorf("path %s is not directory", req.Path)
+	}
+
+	pipeReader, pipeWriter := io.Pipe()
+	writeErr := make(chan error, 1)
+	go func() {
+		tw := tar.NewWriter(pipeWriter)
+		header := &tar.Header{
+			Name:    safeName,
+			Mode:    0644,
+			Size:    fileSize,
+			ModTime: time.Now(),
+		}
+		if err := tw.WriteHeader(header); err != nil {
+			_ = tw.Close()
+			_ = pipeWriter.CloseWithError(err)
+			writeErr <- err
+			return
+		}
+		if _, err := io.Copy(tw, file); err != nil {
+			_ = tw.Close()
+			_ = pipeWriter.CloseWithError(err)
+			writeErr <- err
+			return
+		}
+		if err := tw.Close(); err != nil {
+			_ = pipeWriter.CloseWithError(err)
+			writeErr <- err
+			return
+		}
+		_ = pipeWriter.Close()
+		writeErr <- nil
+	}()
+
+	err = cli.CopyToContainer(ctx, req.ContainerID, req.Path, pipeReader, container.CopyToContainerOptions{
+		CopyUIDGID: true,
+	})
+	if err != nil {
+		_ = pipeReader.CloseWithError(err)
+		_ = pipeWriter.CloseWithError(err)
+		<-writeErr
+		return err
+	}
+	if err := <-writeErr; err != nil {
+		return err
+	}
+	return nil
+}
+
+func (u *ContainerService) GetContainerFileContent(req dto.ContainerFileReq) (*dto.ContainerFileContent, error) {
+	if len(req.Path) == 0 {
+		return nil, buserr.New("ErrInvalidChar")
+	}
+	cli, err := docker.NewDockerClient()
+	if err != nil {
+		return nil, err
+	}
+	defer cli.Close()
+
+	stat, err := cli.ContainerStatPath(context.Background(), req.ContainerID, req.Path)
+	if err != nil {
+		return nil, normalizeContainerFileError(err)
+	}
+	if stat.Mode.IsDir() {
+		return nil, fmt.Errorf("path %s is directory", req.Path)
+	}
+
+	content := &dto.ContainerFileContent{Size: stat.Size}
+	headBytes, err := runContainerCommandRaw(cli, req.ContainerID, []string{"head", "-c", "4096", "--", req.Path})
+	if err != nil {
+		return nil, err
+	}
+	if bytes.IndexByte(headBytes, 0) >= 0 {
+		content.IsBinary = true
+		return content, nil
+	}
+
+	const inlinePreviewMax = 512 * 1024
+	if stat.Size <= inlinePreviewMax {
+		raw, err := runContainerCommandRaw(cli, req.ContainerID, []string{"cat", "--", req.Path})
+		if err != nil {
+			return nil, err
+		}
+		content.Content = string(raw)
+		return content, nil
+	}
+
+	raw, err := runContainerCommandRaw(cli, req.ContainerID, []string{"tail", "-n", "300", "--", req.Path})
+	if err != nil {
+		return nil, err
+	}
+	content.Content = string(raw)
+	content.Truncated = true
+	return content, nil
+}
+
+func (u *ContainerService) GetContainerFileSize(req dto.ContainerFileReq) (int64, error) {
+	if len(req.Path) == 0 {
+		return 0, buserr.New("ErrInvalidChar")
+	}
+	cli, err := docker.NewDockerClient()
+	if err != nil {
+		return 0, err
+	}
+	defer cli.Close()
+
+	stat, err := cli.ContainerStatPath(context.Background(), req.ContainerID, req.Path)
+	if err != nil {
+		return 0, normalizeContainerFileError(err)
+	}
+	if !stat.Mode.IsDir() {
+		return stat.Size, nil
+	}
+	output, err := runContainerCommand(cli, req.ContainerID, []string{"du", "-sb", "--", req.Path})
+	if err != nil {
+		return 0, err
+	}
+	parts := strings.Fields(output)
+	if len(parts) == 0 {
+		return 0, fmt.Errorf("invalid du output")
+	}
+	size, err := strconv.ParseInt(parts[0], 10, 64)
+	if err != nil {
+		return 0, err
+	}
+	return size, nil
+}
+
+func (u *ContainerService) DownloadContainerFile(req dto.ContainerFileReq) (io.ReadCloser, string, string, error) {
+	if len(req.Path) == 0 {
+		req.Path = "/"
+	}
+	cli, err := docker.NewDockerClient()
+	if err != nil {
+		return nil, "", "", err
+	}
+
+	ctx := context.Background()
+	stat, err := cli.ContainerStatPath(ctx, req.ContainerID, req.Path)
+	if err != nil {
+		_ = cli.Close()
+		return nil, "", "", normalizeContainerFileError(err)
+	}
+
+	fileName := stat.Name
+	if len(fileName) == 0 {
+		fileName = "container-file"
+	}
+	if stat.Mode.IsDir() {
+		if _, err := runContainerCommand(cli, req.ContainerID, []string{"sh", "-c", "command -v tar >/dev/null 2>&1"}); err != nil {
+			_ = cli.Close()
+			return nil, "", "", fmt.Errorf("tar command not found in container")
+		}
+
+		targetPath := path.Clean(req.Path)
+		parentPath := path.Dir(targetPath)
+		targetName := path.Base(targetPath)
+		if parentPath == "." || parentPath == "" {
+			parentPath = "/"
+		}
+		tarStream, err := runContainerCommandStream(cli, req.ContainerID, []string{
+			"tar", "-czf", "-", "-C", parentPath, "--", targetName,
+		})
+		if err != nil {
+			_ = cli.Close()
+			return nil, "", "", err
+		}
+		if !strings.HasSuffix(fileName, ".tar.gz") {
+			fileName += ".tar.gz"
+		}
+		return &closeHookReader{
+			ReadCloser: tarStream,
+			onClose:    cli.Close,
+		}, fileName, "application/gzip", nil
+	}
+
+	fileStream, err := runContainerCommandStream(cli, req.ContainerID, []string{"cat", "--", req.Path})
+	if err != nil {
+		_ = cli.Close()
+		return nil, "", "", err
+	}
+	return &closeHookReader{
+		ReadCloser: fileStream,
+		onClose:    cli.Close,
+	}, fileName, "application/octet-stream", nil
+}
+
+func normalizeContainerFileError(err error) error {
+	if err == nil {
+		return nil
+	}
+	message := strings.ToLower(err.Error())
+	if strings.Contains(message, "no such file or directory") || strings.Contains(message, "not found") {
+		return buserr.New("ErrPathNotFound")
+	}
+	return err
+}
+
+func runContainerCommand(cli *client.Client, containerID string, command []string) (string, error) {
+	raw, err := runContainerCommandRaw(cli, containerID, command)
+	if err != nil {
+		return "", err
+	}
+	return strings.TrimSpace(string(raw)), nil
+}
+
+type closeHookReader struct {
+	io.ReadCloser
+	onClose func() error
+}
+
+func (r *closeHookReader) Close() error {
+	var closeErr error
+	if r.ReadCloser != nil {
+		closeErr = r.ReadCloser.Close()
+	}
+	if r.onClose != nil {
+		if err := r.onClose(); err != nil && closeErr == nil {
+			closeErr = err
+		}
+	}
+	return closeErr
+}
+
+func runContainerCommandRaw(cli *client.Client, containerID string, command []string) ([]byte, error) {
+	ctx := context.Background()
+	resp, err := cli.ContainerExecCreate(ctx, containerID, container.ExecOptions{
+		Cmd:          command,
+		AttachStdout: true,
+		AttachStderr: true,
+	})
+	if err != nil {
+		return nil, err
+	}
+	hijack, err := cli.ContainerExecAttach(ctx, resp.ID, container.ExecAttachOptions{})
+	if err != nil {
+		return nil, err
+	}
+	defer hijack.Close()
+
+	raw, err := io.ReadAll(hijack.Reader)
+	if err != nil {
+		return nil, err
+	}
+	var stdout bytes.Buffer
+	var stderr bytes.Buffer
+	if _, err := stdcopy.StdCopy(&stdout, &stderr, bytes.NewReader(raw)); err != nil {
+		return nil, err
+	}
+	output := strings.TrimSpace(stdout.String())
+	errorOutput := strings.TrimSpace(stderr.String())
+	info, err := cli.ContainerExecInspect(ctx, resp.ID)
+	if err != nil {
+		return nil, err
+	}
+	if info.ExitCode != 0 {
+		if len(errorOutput) != 0 {
+			return nil, fmt.Errorf("%s", errorOutput)
+		}
+		if len(output) == 0 {
+			return nil, fmt.Errorf("container command failed with exit code %d", info.ExitCode)
+		}
+		return nil, fmt.Errorf("%s", output)
+	}
+	return stdout.Bytes(), nil
+}
+
+func runContainerCommandStream(cli *client.Client, containerID string, command []string) (io.ReadCloser, error) {
+	ctx := context.Background()
+	resp, err := cli.ContainerExecCreate(ctx, containerID, container.ExecOptions{
+		Cmd:          command,
+		AttachStdout: true,
+		AttachStderr: true,
+	})
+	if err != nil {
+		return nil, err
+	}
+	hijack, err := cli.ContainerExecAttach(ctx, resp.ID, container.ExecAttachOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	pipeReader, pipeWriter := io.Pipe()
+	go func() {
+		defer hijack.Close()
+		var stderr bytes.Buffer
+		_, copyErr := stdcopy.StdCopy(pipeWriter, &stderr, hijack.Reader)
+		if copyErr != nil {
+			_ = pipeWriter.CloseWithError(copyErr)
+			return
+		}
+		info, inspectErr := cli.ContainerExecInspect(ctx, resp.ID)
+		if inspectErr != nil {
+			_ = pipeWriter.CloseWithError(inspectErr)
+			return
+		}
+		if info.ExitCode != 0 {
+			msg := strings.TrimSpace(stderr.String())
+			if len(msg) == 0 {
+				msg = fmt.Sprintf("container command failed with exit code %d", info.ExitCode)
+			}
+			_ = pipeWriter.CloseWithError(fmt.Errorf("%s", msg))
+			return
+		}
+		_ = pipeWriter.Close()
+	}()
+	return pipeReader, nil
+}
+
+func toContainerFileInfo(filePath string, stat container.PathStat, isDir bool) dto.ContainerFileInfo {
+	name := stat.Name
+	if len(name) == 0 {
+		items := strings.Split(strings.TrimSuffix(filePath, "/"), "/")
+		name = items[len(items)-1]
+	}
+	isLink := stat.Mode&os.ModeSymlink != 0
+	return dto.ContainerFileInfo{
+		Name:    name,
+		Path:    filePath,
+		IsDir:   isDir,
+		IsLink:  isLink,
+		LinkTo:  stat.LinkTarget,
+		Size:    stat.Size,
+		Mode:    stat.Mode.String(),
+		ModTime: stat.Mtime.Format(constant.DateTimeLayout),
+	}
+}
+
+func isContainerDir(cli *client.Client, containerID, targetPath string) (bool, error) {
+	_, err := runContainerCommand(cli, containerID, []string{
+		"sh", "-c", "[ -d \"$1\" ]", "sh", targetPath,
+	})
+	if err != nil {
+		return false, err
+	}
+	return true, nil
+}
+
 func stringsToMap(list []string) map[string]string {
 	var labelMap = make(map[string]string)
 	for _, label := range list {
@@ -1488,6 +1919,13 @@ func loadConfigInfo(isCreate bool, req dto.ContainerOperate, oldContainer *conta
 	hostConf.Binds = []string{}
 	hostConf.Mounts = []mount.Mount{}
 	hostConf.DNS = req.DNS
+	hostConf.ExtraHosts = []string{}
+	for _, item := range req.ExtraHosts {
+		if len(item.Hostname) == 0 || len(item.IP) == 0 {
+			continue
+		}
+		hostConf.ExtraHosts = append(hostConf.ExtraHosts, fmt.Sprintf("%s:%s", item.Hostname, item.IP))
+	}
 	config.Volumes = make(map[string]struct{})
 	for _, volume := range req.Volumes {
 		item := mount.Mount{

agent/app/service/container_compose.go

@@ -135,6 +135,7 @@ func (u *ContainerService) PageCompose(req dto.SearchWithPage) (int64, interface
 
 	for key, value := range mergedMap {
 		value.Name = key
+		value.ComposeFileExists = composeFileExists(value.Workdir, value.ConfigFile)
 		records = append(records, value)
 	}
 	if len(req.Info) != 0 {
@@ -164,6 +165,29 @@ func (u *ContainerService) PageCompose(req dto.SearchWithPage) (int64, interface
 	return int64(total), listItem, nil
 }
 
+func composeFileExists(workdir, configFile string) bool {
+	workdir = strings.TrimSpace(workdir)
+	configFile = strings.TrimSpace(configFile)
+	if configFile == "" {
+		return false
+	}
+	for _, item := range strings.Split(configFile, ",") {
+		file := strings.TrimSpace(item)
+		if file == "" {
+			continue
+		}
+		if !filepath.IsAbs(file) && workdir != "" {
+			file = filepath.Join(workdir, file)
+		}
+		file = filepath.Clean(file)
+		info, err := os.Stat(file)
+		if err == nil && !info.IsDir() {
+			return true
+		}
+	}
+	return false
+}
+
 func (u *ContainerService) TestCompose(req dto.ComposeCreate) (bool, error) {
 	if cmd.CheckIllegal(req.Path) {
 		return false, buserr.New("ErrCmdIllegal")
@@ -383,8 +407,11 @@ func (u *ContainerService) loadPath(req *dto.ComposeCreate) error {
 }
 
 func removeContainerForCompose(composeName, composePath string) error {
-	if stdout, err := compose.Operate(composePath, "down"); err != nil {
-		return errors.New(stdout)
+	if _, err := os.Stat(composePath); err == nil {
+		if stdout, err := compose.Operate(composePath, "down"); err != nil {
+			return errors.New(stdout)
+		}
+		return nil
 	}
 	var options container.ListOptions
 	options.All = true

agent/app/service/dashboard.go

@@ -284,7 +284,7 @@ func (u *DashboardService) LoadAppLauncher(ctx *gin.Context) ([]dto.AppLauncher,
 		return data, err
 	}
 
-	showList, err := launcherRepo.ListName()
+	showList, _ := launcherRepo.ListName()
 	defaultList, err := appRepo.GetTopRecommend()
 	if err != nil {
 		return data, nil
@@ -361,6 +361,9 @@ func (u *DashboardService) LoadQuickOptions() []dto.QuickJump {
 		_ = copier.Copy(&item, &quick)
 		list = append(list, item)
 	}
+	sort.Slice(list, func(i, j int) bool {
+		return list[i].Recommend < list[j].Recommend
+	})
 	return list
 }
 func (u *DashboardService) ChangeQuick(req dto.ChangeQuicks) error {
@@ -612,6 +615,9 @@ func loadQuickJump(base *dto.DashboardBase) {
 	website, _ := websiteRepo.GetBy()
 	base.WebsiteNumber = len(website)
 
+	agents, _ := agentRepo.List()
+	base.AgentNumber = len(agents)
+
 	postgresqlDbs, _ := postgresqlRepo.List()
 	mysqlDbs, _ := mysqlRepo.List()
 	base.DatabaseNumber = len(mysqlDbs) + len(postgresqlDbs)
@@ -625,6 +631,8 @@ func loadQuickJump(base *dto.DashboardBase) {
 	quicks := launcherRepo.ListQuickJump(false)
 	for i := 0; i < len(quicks); i++ {
 		switch quicks[i].Name {
+		case "Agent":
+			quicks[i].Detail = fmt.Sprintf("%d", base.AgentNumber)
 		case "Website":
 			quicks[i].Detail = fmt.Sprintf("%d", base.WebsiteNumber)
 		case "Database":
@@ -638,7 +646,7 @@ func loadQuickJump(base *dto.DashboardBase) {
 		_ = copier.Copy(&item, quicks[i])
 		base.QuickJumps = append(base.QuickJumps, item)
 	}
-	sort.Slice(quicks, func(i, j int) bool {
-		return quicks[i].Recommend < quicks[j].Recommend
+	sort.Slice(base.QuickJumps, func(i, j int) bool {
+		return base.QuickJumps[i].Recommend < base.QuickJumps[j].Recommend
 	})
 }

agent/app/service/database_common.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"path"
+	"path/filepath"
 	"strings"
 
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
@@ -43,6 +44,10 @@ func (u *DBCommonService) LoadBaseInfo(req dto.OperationWithNameAndType) (*dto.D
 
 func (u *DBCommonService) LoadDatabaseFile(req dto.OperationWithNameAndType) (string, error) {
 	filePath := ""
+	safeName := filepath.Base(req.Name)
+	if safeName != req.Name || strings.Contains(safeName, "..") {
+		return "", buserr.New("ErrInvalidParams")
+	}
 	switch req.Type {
 	case "mysql-cluster-conf":
 		filePath = path.Join(global.Dir.DataDir, fmt.Sprintf("apps/mysql-cluster/%s/conf/my.cnf", req.Name))

agent/app/service/device.go

@@ -109,7 +109,7 @@ func (u *DeviceService) CheckDNS(key, value string) (bool, error) {
 	if err != nil {
 		return false, err
 	}
-	defer conn.Close()
+	defer func() { _ = conn.Close() }()
 
 	return true, nil
 }
@@ -132,7 +132,7 @@ func (u *DeviceService) Update(key, value string) error {
 		if cmd.CheckIllegal(value) {
 			return buserr.New("ErrCmdIllegal")
 		}
-		if err := cmd.RunDefaultBashCf("%s hostnamectl set-hostname %s", cmd.SudoHandleCmd(), value); err != nil {
+		if err := cmd.NewCommandMgr(cmd.WithTimeout(20*time.Second)).Run("hostnamectl", "set-hostname", value); err != nil {
 			return err
 		}
 		_, _ = psutil.HOST.GetHostInfo(true)
@@ -245,7 +245,7 @@ func (u *DeviceService) UpdateSwap(req dto.SwapHelper) error {
 		}
 		cmdMgr := cmd.NewCommandMgr(cmd.WithTask(*taskItem))
 		if !req.IsNew {
-			if err := cmdMgr.RunBashCf("%s swapoff %s", cmd.SudoHandleCmd(), req.Path); err != nil {
+			if err := cmdMgr.Run("swapoff", req.Path); err != nil {
 				return fmt.Errorf("handle swapoff %s failed, %v", req.Path, err)
 			}
 		}
@@ -256,22 +256,22 @@ func (u *DeviceService) UpdateSwap(req dto.SwapHelper) error {
 			return operateSwapWithFile(true, req)
 		}
 		taskItem.LogStart(i18n.GetMsgByKey("CreateSwap"))
-		if err := cmdMgr.RunBashCf("%s dd if=/dev/zero of=%s bs=1024 count=%d", cmd.SudoHandleCmd(), req.Path, req.Size); err != nil {
+		if err := cmdMgr.Run("dd", "if=/dev/zero", fmt.Sprintf("of=%s", req.Path), "bs=1024", fmt.Sprintf("count=%d", req.Size)); err != nil {
 			return fmt.Errorf("handle dd %s failed, %v", req.Path, err)
 		}
 
 		taskItem.Log("chmod 0600 " + req.Path)
-		if err := cmdMgr.RunBashCf("%s chmod 0600 %s", cmd.SudoHandleCmd(), req.Path); err != nil {
+		if err := cmdMgr.Run("chmod", "0600", req.Path); err != nil {
 			return fmt.Errorf("handle chmod 0600 %s failed, %v", req.Path, err)
 		}
 		taskItem.LogStart(i18n.GetMsgByKey("FormatSwap"))
-		if err := cmdMgr.RunBashCf("%s mkswap -f %s", cmd.SudoHandleCmd(), req.Path); err != nil {
+		if err := cmdMgr.Run("mkswap", "-f", req.Path); err != nil {
 			return fmt.Errorf("handle mkswap -f %s failed, %v", req.Path, err)
 		}
 
 		taskItem.LogStart(i18n.GetMsgByKey("EnableSwap"))
-		if err := cmdMgr.RunBashCf("%s swapon %s", cmd.SudoHandleCmd(), req.Path); err != nil {
-			_ = cmdMgr.RunBashCf("%s swapoff %s", cmd.SudoHandleCmd(), req.Path)
+		if err := cmdMgr.Run("swapon", req.Path); err != nil {
+			_ = cmdMgr.Run("swapoff", req.Path)
 			return fmt.Errorf("handle swapoff %s failed, %v", req.Path, err)
 		}
 		return operateSwapWithFile(false, req)

agent/app/service/device_clean.go

@@ -49,6 +49,7 @@ func (u *DeviceService) Scan() dto.CleanData {
 		Size:        uint64(originalSize),
 		IsCheck:     originalSize > 0,
 		IsRecommend: true,
+		CanDelete:   false,
 		Type:        "1panel_original",
 		Children:    loadTreeWithDir(true, "1panel_original", originalPath, fileOp),
 	})
@@ -68,6 +69,7 @@ func (u *DeviceService) Scan() dto.CleanData {
 		Size:        rollbackSize,
 		IsCheck:     rollbackSize > 0,
 		IsRecommend: true,
+		CanDelete:   false,
 		Type:        "rollback",
 		Children:    rollBackTree,
 	})
@@ -105,11 +107,7 @@ func (u *DeviceService) Clean(req []dto.Clean) {
 		case "tmp_backup":
 			dropFileOrDir(path.Join(global.Dir.LocalBackupDir, "tmp"))
 		case "unknown_backup":
-			if strings.HasPrefix(item.Name, path.Join(global.Dir.LocalBackupDir, "log/website")) {
-				dropFileOrDir(item.Name)
-			} else {
-				dropFile(item.Name)
-			}
+			dropFileOrDir(item.Name)
 
 		case "rollback":
 			dropFileOrDir(path.Join(global.Dir.BaseDir, rollbackPath, "app"))
@@ -269,6 +267,7 @@ func loadUpgradeTree(fileOp fileUtils.FileOp) dto.CleanTree {
 		Size:        uint64(upgradeSize),
 		IsCheck:     false,
 		IsRecommend: true,
+		CanDelete:   false,
 		Type:        "upgrade",
 		Children:    loadTreeWithDir(true, "upgrade", upgradePath, fileOp),
 	}
@@ -302,6 +301,7 @@ func loadAgentPackage(fileOp fileUtils.FileOp) dto.CleanTree {
 		Label:       "agent_packages",
 		IsCheck:     false,
 		IsRecommend: true,
+		CanDelete:   false,
 		Type:        "agent",
 	}
 	files, _ := os.ReadDir(pathItem)
@@ -316,6 +316,7 @@ func loadAgentPackage(fileOp fileUtils.FileOp) dto.CleanTree {
 				Size:        uint64(itemSize),
 				IsCheck:     true,
 				IsRecommend: true,
+				CanDelete:   true,
 				Type:        "agent",
 			})
 		} else {
@@ -333,6 +334,7 @@ func loadAgentPackage(fileOp fileUtils.FileOp) dto.CleanTree {
 				Size:        uint64(itemSize.Size()),
 				IsCheck:     !isCurrentVersion,
 				IsRecommend: true,
+				CanDelete:   true,
 				Type:        "agent",
 			})
 		}
@@ -353,6 +355,7 @@ func loadBackupTree(fileOp fileUtils.FileOp) []dto.CleanTree {
 		Size:        uint64(tmpSize),
 		IsCheck:     tmpSize != 0,
 		IsRecommend: true,
+		CanDelete:   true,
 		Type:        "tmp_backup",
 	})
 	backupRecords, _ := backupRepo.ListRecord()
@@ -391,6 +394,7 @@ func loadUnknownApps(fileOp fileUtils.FileOp, recordMap map[string][]string) dto
 		Label:       "unknown_app",
 		IsCheck:     false,
 		IsRecommend: false,
+		CanDelete:   false,
 		Name:        backupPath,
 		Type:        "unknown_backup",
 	}
@@ -419,6 +423,7 @@ func loadUnknownDbs(fileOp fileUtils.FileOp, recordMap map[string][]string) dto.
 		Name:        backupPath,
 		IsCheck:     false,
 		IsRecommend: false,
+		CanDelete:   false,
 		Type:        "unknown_backup",
 	}
 	_ = loadFileOrDirWithExclude(fileOp, 0, backupPath, &treeData, excludePaths)
@@ -442,6 +447,7 @@ func loadUnknownWebsites(fileOp fileUtils.FileOp, recordMap map[string][]string)
 		Name:        backupPath,
 		IsCheck:     false,
 		IsRecommend: false,
+		CanDelete:   false,
 		Type:        "unknown_backup",
 	}
 	_ = loadFileOrDirWithExclude(fileOp, 0, backupPath, &treeData, excludePaths)
@@ -460,6 +466,7 @@ func loadUnknownSnapshot(fileOp fileUtils.FileOp) dto.CleanTree {
 		Name:        backupPath,
 		IsCheck:     false,
 		IsRecommend: false,
+		CanDelete:   false,
 		Type:        "unknown_backup",
 	}
 	entries, _ := os.ReadDir(backupPath)
@@ -473,6 +480,7 @@ func loadUnknownSnapshot(fileOp fileUtils.FileOp) dto.CleanTree {
 			Label:       entry.Name(),
 			IsCheck:     false,
 			IsRecommend: false,
+			CanDelete:   true,
 			Name:        childPath,
 			Type:        "unknown_backup",
 		}
@@ -499,6 +507,7 @@ func loadUnknownWebsiteLog(fileOp fileUtils.FileOp) dto.CleanTree {
 		Label:       "unknown_website_log",
 		IsCheck:     false,
 		IsRecommend: true,
+		CanDelete:   false,
 		Type:        "unknown_backup",
 	}
 	dir := path.Join(global.Dir.LocalBackupDir, "log/website")
@@ -522,6 +531,7 @@ func loadUnknownWebsiteLog(fileOp fileUtils.FileOp) dto.CleanTree {
 				Label:       dirName,
 				IsCheck:     true,
 				IsRecommend: true,
+				CanDelete:   true,
 				Name:        dirPath,
 				Type:        "unknown_backup",
 				Size:        uint64(itemSize),
@@ -552,6 +562,7 @@ func loadFileOrDirWithExclude(fileOp fileUtils.FileOp, index uint, dir string, r
 			Label:       entry.Name(),
 			IsCheck:     false,
 			IsRecommend: false,
+			CanDelete:   true,
 			Name:        childPath,
 			Type:        "unknown_backup",
 		}
@@ -564,18 +575,19 @@ func loadFileOrDirWithExclude(fileOp fileUtils.FileOp, index uint, dir string, r
 				for _, child := range childNode.Children {
 					childNode.Size += child.Size
 				}
-				rootTree.Size += childNode.Size
 			} else {
 				itemSize, _ := fileOp.GetDirSize(childPath)
 				childNode.Size = uint64(itemSize)
-				rootTree.Size += childNode.Size
+			}
+			if childNode.Size == 0 {
+				continue
 			}
 		} else {
 			info, _ := entry.Info()
 			childNode.Size = uint64(info.Size())
-			rootTree.Size += childNode.Size
 		}
 
+		rootTree.Size += childNode.Size
 		rootTree.Children = append(rootTree.Children, childNode)
 	}
 	return nil
@@ -633,6 +645,7 @@ func loadDownloadTree(fileOp fileUtils.FileOp) []dto.CleanTree {
 			Label:       "app_tmp_download",
 			IsCheck:     true,
 			IsRecommend: true,
+			CanDelete:   false,
 			Type:        "app_tmp_download",
 			Name:        "apps",
 		}
@@ -653,19 +666,19 @@ func loadLogTree(fileOp fileUtils.FileOp) []dto.CleanTree {
 	for _, file := range list1 {
 		size += file.Size
 	}
-	treeData = append(treeData, dto.CleanTree{ID: uuid.NewString(), Label: "system_log", Size: size, Children: list1, Type: "system_log", IsRecommend: true})
+	treeData = append(treeData, dto.CleanTree{ID: uuid.NewString(), Label: "system_log", Size: size, Children: list1, Type: "system_log", IsRecommend: true, CanDelete: false})
 
 	path2 := path.Join(global.Dir.TaskDir)
 	list2 := loadTreeWithDir(false, "task_log", path2, fileOp)
 	size2, _ := fileOp.GetDirSize(path2)
-	treeData = append(treeData, dto.CleanTree{ID: uuid.NewString(), Label: "task_log", Size: uint64(size2), Children: list2, Type: "task_log"})
+	treeData = append(treeData, dto.CleanTree{ID: uuid.NewString(), Label: "task_log", Size: uint64(size2), Children: list2, Type: "task_log", CanDelete: false})
 
 	websiteLogList := loadWebsiteLogTree(fileOp)
 	logTotalSize := uint64(0)
 	for _, websiteLog := range websiteLogList {
 		logTotalSize += websiteLog.Size
 	}
-	treeData = append(treeData, dto.CleanTree{ID: uuid.NewString(), Label: "website_log", Size: logTotalSize, Children: websiteLogList, Type: "website_log", IsRecommend: false})
+	treeData = append(treeData, dto.CleanTree{ID: uuid.NewString(), Label: "website_log", Size: logTotalSize, Children: websiteLogList, Type: "website_log", IsRecommend: false, CanDelete: false})
 
 	return treeData
 }
@@ -679,11 +692,12 @@ func loadWebsiteLogTree(fileOp fileUtils.FileOp) []dto.CleanTree {
 	for _, website := range websites {
 		size3, _ := fileOp.GetDirSize(path.Join(GetSiteDir(website.Alias), "log"))
 		res = append(res, dto.CleanTree{
-			ID:    uuid.NewString(),
-			Label: website.PrimaryDomain,
-			Size:  uint64(size3),
-			Type:  "website_log",
-			Name:  website.Alias,
+			ID:        uuid.NewString(),
+			Label:     website.PrimaryDomain,
+			Size:      uint64(size3),
+			Type:      "website_log",
+			Name:      website.Alias,
+			CanDelete: true,
 		})
 	}
 	return res
@@ -733,6 +747,7 @@ func loadAppTmpDownloadTree(fileOp fileUtils.FileOp) []dto.CleanTree {
 			appTree.Name = appKey
 			appTree.IsRecommend = true
 			appTree.IsCheck = true
+			appTree.CanDelete = false
 			for _, version := range missingVersions {
 				versionPath := filepath.Join(appPath, version)
 				size, _ := fileOp.GetDirSize(versionPath)
@@ -743,6 +758,7 @@ func loadAppTmpDownloadTree(fileOp fileUtils.FileOp) []dto.CleanTree {
 					Size:        uint64(size),
 					IsCheck:     true,
 					IsRecommend: true,
+					CanDelete:   true,
 					Type:        "app_tmp_download_version",
 					Name:        path.Join(appKey, version),
 				})
@@ -770,7 +786,7 @@ func loadContainerTree() []dto.CleanTree {
 			imageSize += uint64(file.Size)
 		}
 	}
-	treeData = append(treeData, dto.CleanTree{ID: uuid.NewString(), Label: "container_images", Size: imageSize, Children: nil, Type: "images", IsRecommend: true})
+	treeData = append(treeData, dto.CleanTree{ID: uuid.NewString(), Label: "container_images", Size: imageSize, Children: nil, Type: "images", IsRecommend: true, CanDelete: true})
 
 	containerSize := uint64(0)
 	for _, file := range diskUsage.Containers {
@@ -778,7 +794,7 @@ func loadContainerTree() []dto.CleanTree {
 			containerSize += uint64(file.SizeRw)
 		}
 	}
-	treeData = append(treeData, dto.CleanTree{ID: uuid.NewString(), Label: "container_containers", Size: containerSize, Children: nil, Type: "containers", IsRecommend: true})
+	treeData = append(treeData, dto.CleanTree{ID: uuid.NewString(), Label: "container_containers", Size: containerSize, Children: nil, Type: "containers", IsRecommend: true, CanDelete: true})
 
 	volumeSize := uint64(0)
 	for _, file := range diskUsage.Volumes {
@@ -786,7 +802,7 @@ func loadContainerTree() []dto.CleanTree {
 			volumeSize += uint64(file.UsageData.Size)
 		}
 	}
-	treeData = append(treeData, dto.CleanTree{ID: uuid.NewString(), Label: "container_volumes", Size: volumeSize, IsCheck: volumeSize > 0, Children: nil, Type: "volumes", IsRecommend: true})
+	treeData = append(treeData, dto.CleanTree{ID: uuid.NewString(), Label: "container_volumes", Size: volumeSize, IsCheck: volumeSize > 0, Children: nil, Type: "volumes", IsRecommend: true, CanDelete: true})
 
 	var buildCacheTotalSize int64
 	for _, cache := range diskUsage.BuildCache {
@@ -794,7 +810,7 @@ func loadContainerTree() []dto.CleanTree {
 			buildCacheTotalSize += cache.Size
 		}
 	}
-	treeData = append(treeData, dto.CleanTree{ID: uuid.NewString(), Label: "build_cache", Size: uint64(buildCacheTotalSize), IsCheck: buildCacheTotalSize > 0, Type: "build_cache", IsRecommend: true})
+	treeData = append(treeData, dto.CleanTree{ID: uuid.NewString(), Label: "build_cache", Size: uint64(buildCacheTotalSize), IsCheck: buildCacheTotalSize > 0, Type: "build_cache", IsRecommend: true, CanDelete: true})
 	return treeData
 }
 
@@ -804,7 +820,7 @@ func loadTreeWithCheck(treeData []dto.CleanTree, pathItem, treeType string, file
 		return treeData
 	}
 	list := loadTreeWithAllFile(true, pathItem, treeType, pathItem, fileOp)
-	treeData = append(treeData, dto.CleanTree{ID: uuid.NewString(), Label: treeType, Size: uint64(size), IsCheck: size > 0, Children: list, Type: treeType, IsRecommend: true})
+	treeData = append(treeData, dto.CleanTree{ID: uuid.NewString(), Label: treeType, Size: uint64(size), IsCheck: size > 0, Children: list, Type: treeType, IsRecommend: true, CanDelete: false})
 	return treeData
 }
 
@@ -831,6 +847,7 @@ func loadTreeWithDir(isCheck bool, treeType, pathItem string, fileOp fileUtils.F
 				Name:        strings.TrimPrefix(file.Name(), "/"),
 				IsCheck:     isCheck,
 				IsRecommend: isCheck,
+				CanDelete:   true,
 			}
 			lists = append(lists, item)
 		}
@@ -878,6 +895,7 @@ func loadTreeWithAllFile(isCheck bool, originalPath, treeType, pathItem string,
 			Name:        name,
 			IsCheck:     isCheck,
 			IsRecommend: isCheck,
+			CanDelete:   true,
 		}
 		if file.IsDir() {
 			item.Children = loadTreeWithAllFile(isCheck, originalPath, treeType, path.Join(pathItem, file.Name()), fileOp)

agent/app/service/disk.go

@@ -2,13 +2,14 @@ package service
 
 import (
 	"fmt"
+	"os"
+	"strings"
+	"time"
+
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/buserr"
 	"github.com/1Panel-dev/1Panel/agent/global"
 	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
-	"os"
-	"strings"
-	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/response"
@@ -65,19 +66,19 @@ func (s *DiskService) PartitionDisk(req request.DiskPartitionRequest) (string, e
 	}
 
 	cmdMgr := cmd.NewCommandMgr(cmd.WithTimeout(10 * time.Second))
-	if err := cmdMgr.RunBashC(fmt.Sprintf("partprobe %s", req.Device)); err != nil {
+	if err := cmdMgr.Run("partprobe", req.Device); err != nil {
 		return "", buserr.WithErr("PartitionDiskErr", err)
 	}
 
-	if err := cmdMgr.RunBashC(fmt.Sprintf("parted -s %s mklabel gpt", req.Device)); err != nil {
+	if err := cmdMgr.Run("parted", "-s", req.Device, "mklabel", "gpt"); err != nil {
 		return "", buserr.WithErr("PartitionDiskErr", err)
 	}
 
-	if err := cmdMgr.RunBashC(fmt.Sprintf("parted -s %s mkpart primary 1MiB 100%%", req.Device)); err != nil {
+	if err := cmdMgr.Run("parted", "-s", req.Device, "mkpart", "primary", "1MiB", "100%"); err != nil {
 		return "", buserr.WithErr("PartitionDiskErr", err)
 	}
 
-	if err := cmdMgr.RunBashC(fmt.Sprintf("partprobe %s", req.Device)); err != nil {
+	if err := cmdMgr.Run("partprobe", req.Device); err != nil {
 		return "", buserr.WithErr("PartitionDiskErr", err)
 	}
 	partition := req.Device + "1"
@@ -133,7 +134,7 @@ func (s *DiskService) MountDisk(req request.DiskMountRequest) error {
 	}
 
 	cmdMgr := cmd.NewCommandMgr(cmd.WithTimeout(1 * time.Minute))
-	if err := cmdMgr.RunBashC(fmt.Sprintf("mount  -t %s %s %s", req.Filesystem, req.Device, req.MountPoint)); err != nil {
+	if err := cmdMgr.Run("mount", "-t", req.Filesystem, req.Device, req.MountPoint); err != nil {
 		return buserr.WithErr("MountDiskErr", err)
 	}
 	if req.AutoMount {
@@ -156,7 +157,7 @@ func (s *DiskService) UnmountDisk(req request.DiskUnmountRequest) error {
 	if !isPointMounted(req.MountPoint) {
 		return buserr.New("MountDiskErr")
 	}
-	if err := cmd.RunDefaultBashC(fmt.Sprintf("umount -f  %s", req.MountPoint)); err != nil {
+	if err := cmd.NewCommandMgr(cmd.WithTimeout(20*time.Second)).Run("umount", "-f", req.MountPoint); err != nil {
 		return buserr.WithErr("MountDiskErr", err)
 	}
 	if err := removeFromFstab(req.MountPoint); err != nil {

agent/app/service/entry.go

@@ -12,11 +12,12 @@ var (
 	appInstallResourceRepo = repo.NewIAppInstallResourceRpo()
 	appIgnoreUpgradeRepo   = repo.NewIAppIgnoreUpgradeRepo()
 
-	aiRepo           = repo.NewIAiRepo()
-	mcpServerRepo    = repo.NewIMcpServerRepo()
-	tensorrtLLMRepo  = repo.NewITensorRTLLMRepo()
-	agentRepo        = repo.NewIAgentRepo()
-	agentAccountRepo = repo.NewIAgentAccountRepo()
+	aiRepo                = repo.NewIAiRepo()
+	mcpServerRepo         = repo.NewIMcpServerRepo()
+	tensorrtLLMRepo       = repo.NewITensorRTLLMRepo()
+	agentRepo             = repo.NewIAgentRepo()
+	agentAccountRepo      = repo.NewIAgentAccountRepo()
+	agentAccountModelRepo = repo.NewIAgentAccountModelRepo()
 
 	mysqlRepo      = repo.NewIMysqlRepo()
 	postgresqlRepo = repo.NewIPostgresqlRepo()
@@ -48,7 +49,8 @@ var (
 	runtimeRepo       = repo.NewIRunTimeRepo()
 	phpExtensionsRepo = repo.NewIPHPExtensionsRepo()
 
-	favoriteRepo = repo.NewIFavoriteRepo()
+	favoriteRepo  = repo.NewIFavoriteRepo()
+	fileShareRepo = repo.NewIFileShareRepo()
 
 	taskRepo = repo.NewITaskRepo()
 

agent/app/service/file.go

@@ -41,6 +41,7 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/global"
 	"github.com/1Panel-dev/1Panel/agent/utils/common"
 	"github.com/1Panel-dev/1Panel/agent/utils/files"
+	terminalai "github.com/1Panel-dev/1Panel/agent/utils/terminal/ai"
 	"github.com/pkg/errors"
 )
 
@@ -78,10 +79,7 @@ type IFileService interface {
 	ConvertLog(req dto.PageInfo) (int64, []response.FileConvertLog, error)
 	BatchGetRemarks(req request.FileRemarkBatch) map[string]string
 	SetRemark(req request.FileRemarkUpdate) error
-}
-
-var filteredPaths = []string{
-	"/.1panel_clash",
+	AISearch(req request.FileAISearch) (*response.FileAISearchResult, error)
 }
 
 const (
@@ -106,10 +104,29 @@ func (f *FileService) GetFileList(op request.FileOption) (response.FileInfo, err
 	if err != nil {
 		return fileInfo, err
 	}
+	shareMap, err := NewIFileShareService().SharePathCodeMap()
+	if err != nil {
+		return fileInfo, err
+	}
+	applyFileShares(info, shareMap)
 	fileInfo.FileInfo = *info
 	return fileInfo, nil
 }
 
+func applyFileShares(info *files.FileInfo, shareMap map[string]string) {
+	if info == nil {
+		return
+	}
+	if code, ok := shareMap[info.Path]; ok {
+		info.ShareCode = code
+	} else {
+		info.ShareCode = ""
+	}
+	for _, item := range info.Items {
+		applyFileShares(item, shareMap)
+	}
+}
+
 func (f *FileService) SearchUploadWithPage(req request.SearchUploadWithPage) (int64, interface{}, error) {
 	var (
 		files    []response.UploadInfo
@@ -170,14 +187,7 @@ func (f *FileService) GetFileTree(op request.FileOption) ([]response.FileTree, e
 }
 
 func shouldFilterPath(path string) bool {
-	cleanedPath := filepath.Clean(path)
-	for _, filteredPath := range filteredPaths {
-		cleanedFilteredPath := filepath.Clean(filteredPath)
-		if cleanedFilteredPath == cleanedPath || strings.HasPrefix(cleanedPath, cleanedFilteredPath+"/") {
-			return true
-		}
-	}
-	return false
+	return files.ShouldFilterSensitivePath(path)
 }
 
 func (f *FileService) buildFileTree(node *response.FileTree, items []*files.FileInfo, op request.FileOption, level int) error {
@@ -263,7 +273,7 @@ func (f *FileService) Create(op request.FileCreate) error {
 func (f *FileService) Delete(op request.FileDelete) error {
 	if op.IsDir {
 		excludeDir := global.Dir.DataDir
-		if filepath.Base(op.Path) == ".1panel_clash" || op.Path == excludeDir {
+		if path.Base(op.Path) == ".1panel_clash" || op.Path == excludeDir {
 			return buserr.New("ErrPathNotDelete")
 		}
 	}
@@ -592,6 +602,12 @@ func (f *FileService) DepthDirSize(req request.DirSizeReq) ([]response.DepthDirS
 func (f *FileService) ReadLogByLine(req request.FileReadByLineReq) (*response.FileLineContent, error) {
 	logFilePath := ""
 	taskStatus := ""
+	if len(req.Name) != 0 {
+		safeName := path.Base(req.Name)
+		if safeName != req.Name || strings.Contains(safeName, "..") {
+			return nil, buserr.New("ErrInvalidParams")
+		}
+	}
 	switch req.Type {
 	case constant.TypeWebsite:
 		website, err := websiteRepo.GetFirst(repo.WithByID(req.ID))
@@ -649,9 +665,9 @@ func (f *FileService) ReadLogByLine(req request.FileReadByLineReq) (*response.Fi
 		logFilePath = taskModel.LogFile
 		taskStatus = taskModel.Status
 	case "mysql-slow-logs":
-		logFilePath = path.Join(global.Dir.DataDir, fmt.Sprintf("apps/mysql/%s/data/1Panel-slow.log", req.Name))
+		logFilePath = path.Join(global.Dir.DataDir, "apps", "mysql", req.Name, "data", "1Panel-slow.log")
 	case "mariadb-slow-logs":
-		logFilePath = path.Join(global.Dir.DataDir, fmt.Sprintf("apps/mariadb/%s/db/data/1Panel-slow.log", req.Name))
+		logFilePath = path.Join(global.Dir.DataDir, "apps", "mariadb", req.Name, "db", "data", "1Panel-slow.log")
 	case "php-fpm-slow-logs":
 		php, err := runtimeRepo.GetFirst(context.Background(), repo.WithByID(req.ID))
 		if err != nil {
@@ -666,8 +682,7 @@ func (f *FileService) ReadLogByLine(req request.FileReadByLineReq) (*response.Fi
 		}
 		logFilePath, _ = ini_conf.GetIniValue(configPath, "supervisord", "logfile")
 	case constant.Supervisor:
-		logDir := path.Join(global.Dir.DataDir, "tools", "supervisord", "log")
-		logFilePath = path.Join(logDir, req.Name)
+		logFilePath = path.Join(global.Dir.DataDir, "tools", "supervisord", "log", req.Name)
 	}
 
 	file, err := os.Open(logFilePath)
@@ -686,7 +701,7 @@ func (f *FileService) ReadLogByLine(req request.FileReadByLineReq) (*response.Fi
 		logFileRes  *dto.LogFileRes
 	)
 	if stat.Size() > files.MaxReadFileSize {
-		lines, err = files.TailFromEnd(logFilePath, req.PageSize)
+		lines, _ = files.TailFromEnd(logFilePath, req.PageSize)
 		isEndOfFile = true
 		scope = "tail"
 	} else {
@@ -1014,3 +1029,161 @@ func (f *FileService) ConvertLog(req dto.PageInfo) (total int64, data []response
 
 	return total, data, nil
 }
+
+func (f *FileService) AISearch(req request.FileAISearch) (*response.FileAISearchResult, error) {
+	root := filepath.Clean(strings.TrimSpace(req.Path))
+	if root == "" {
+		return nil, buserr.WithDetail("ErrInvalidParams", "path is required", nil)
+	}
+	query := strings.TrimSpace(req.Query)
+	if query == "" {
+		return nil, buserr.WithDetail("ErrInvalidParams", "query is required", nil)
+	}
+	st, err := os.Stat(root)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, buserr.New("ErrPathNotFound")
+		}
+		return nil, err
+	}
+	if !st.IsDir() {
+		return nil, buserr.New("ErrPathNotFound")
+	}
+
+	maxItems := req.MaxItems
+	if maxItems <= 0 {
+		maxItems = files.DefaultFileAIMaxItems
+	}
+	if maxItems > 2000 {
+		maxItems = 2000
+	}
+
+	containSub := true
+	if req.ContainSub != nil {
+		containSub = *req.ContainSub
+	}
+
+	searchOpts, err := files.MergeContentSearchOptions(
+		req.MatchCase, req.WholeWord, req.UseRegex,
+		req.Extensions,
+		req.MinSize, req.MaxSize,
+		req.ModifiedAfter, req.ModifiedBefore,
+		req.MaxScanFiles,
+		req.MaxFileBytes,
+		req.MaxHitsPerFile, req.MaxTotalHits,
+		req.ContentHitsPromptMaxBytes,
+		req.LlmMaxOutputTokens,
+	)
+	if err != nil {
+		return nil, buserr.WithDetail("ErrInvalidParams", err.Error(), nil)
+	}
+
+	matchFn, err := files.NewContentLineMatcher(query, searchOpts)
+	if err != nil {
+		return nil, buserr.WithDetail("ErrFileAISearchBadPattern", err.Error(), nil)
+	}
+
+	cfg, timeout, err := terminalai.LoadFileAIRuntimeConfig()
+	aiEnabled := err == nil
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		return nil, err
+	}
+
+	items, truncated, err := files.CollectDirInventory(root, containSub, maxItems)
+	if err != nil {
+		return nil, err
+	}
+
+	preFiltered := false
+	llmItems := items
+	qLower := strings.ToLower(query)
+	if len(llmItems) > 0 && query != "" {
+		filtered := make([]files.AISearchInventoryItem, 0, len(llmItems))
+		for _, it := range llmItems {
+			rel := strings.TrimSpace(it.RelPath)
+			if rel == "" {
+				continue
+			}
+			if !req.UseRegex && !req.MatchCase && !req.WholeWord && strings.Contains(strings.ToLower(rel), qLower) {
+				filtered = append(filtered, it)
+			}
+		}
+		if len(filtered) >= 8 {
+			llmItems = filtered
+			preFiltered = true
+		}
+	}
+
+	start := time.Now()
+	contentHits, scannedFiles, hitsTrunc := files.SearchFileAIContentHits(root, llmItems, searchOpts, matchFn)
+	hitsDTO := make([]response.FileAIContentHit, 0, len(contentHits))
+	for _, h := range contentHits {
+		hitsDTO = append(hitsDTO, response.FileAIContentHit{Path: h.Path, Line: h.Line, Text: h.Text})
+	}
+
+	matchDesc := searchOpts.ContentMatchDescription()
+	result := &response.FileAISearchResult{
+		Hits:                 hitsDTO,
+		ContentScannedFiles:  scannedFiles,
+		ContentHitsTruncated: hitsTrunc,
+		Truncated:            truncated,
+		PreFiltered:          preFiltered,
+		ItemCount:            len(llmItems),
+	}
+
+	if len(llmItems) == 0 {
+		if aiEnabled {
+			result.Mode = "ai"
+			result.Summary = i18n.GetMsgByKey("FileAISearchEmptyDir")
+			if result.Summary == "" || result.Summary == "FileAISearchEmptyDir" {
+				result.Summary = "No files or directories found under this path (or all entries were filtered)."
+			}
+		} else {
+			result.Mode = "grep"
+			result.Summary = ""
+		}
+		result.Duration = time.Since(start).Round(time.Millisecond).String()
+		return result, nil
+	}
+
+	if !aiEnabled {
+		result.Mode = "grep"
+		result.Summary = ""
+		result.Duration = time.Since(start).Round(time.Millisecond).String()
+		return result, nil
+	}
+
+	result.Mode = "ai"
+
+	clientTimeout := timeout
+	if clientTimeout < 30*time.Second {
+		clientTimeout = 90 * time.Second
+	}
+	if clientTimeout > 5*time.Minute {
+		clientTimeout = 5 * time.Minute
+	}
+
+	runCtx, cancel := context.WithTimeout(context.Background(), timeout+time.Minute)
+	defer cancel()
+
+	llmMaxOut := searchOpts.LlmMaxOutputTokens
+	summary, usage, err := files.RunFileAISearchLLM(runCtx, cfg, clientTimeout, root, query, req.ResponseLanguage, llmItems, truncated, preFiltered, contentHits, scannedFiles, hitsTrunc, matchDesc, searchOpts.ContentHitsPromptMaxBytes, llmMaxOut)
+	if err != nil {
+		result.Mode = "grep"
+		result.Summary = ""
+		result.Duration = time.Since(start).Round(time.Millisecond).String()
+		if errors.Is(err, context.DeadlineExceeded) || strings.Contains(strings.ToLower(err.Error()), "timeout") {
+			return result, nil
+		}
+		return result, nil
+	}
+	result.Summary = summary
+	result.PromptTokens = usage.PromptTokens
+	result.CompletionTokens = usage.CompletionTokens
+	result.TotalTokens = usage.TotalTokens
+	if result.TotalTokens == 0 {
+		result.TotalTokens = usage.PromptTokens + usage.CompletionTokens
+	}
+	result.Duration = time.Since(start).Round(time.Millisecond).String()
+	return result, nil
+}

agent/app/service/file_share.go

@@ -0,0 +1,381 @@
+package service
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/subtle"
+	"encoding/hex"
+	"errors"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
+	"github.com/1Panel-dev/1Panel/agent/app/dto/response"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/app/repo"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/utils/encrypt"
+	"gorm.io/gorm"
+)
+
+type FileShareService struct{}
+
+const (
+	fileShareCodeMinLength     = 10
+	fileShareCodeMaxLength     = 16
+	fileShareCodeDefaultLength = 13
+	fileShareCharset           = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
+)
+
+var fileShareCodeRegexp = regexp.MustCompile(`^[A-Za-z0-9]{10,16}$`)
+
+type IFileShareService interface {
+	Create(req request.FileShareCreate) (*response.FileShareInfo, error)
+	Page(req dto.PageInfo) (int64, []response.FileShareInfo, error)
+	GetByPath(path string) (*response.FileShareInfo, error)
+	GetByCode(code string) (*response.FileShareInfo, error)
+	GetPublicByCode(code string) (*response.FileSharePublicInfo, error)
+	DeleteByPath(path string) error
+	SharePathCodeMap() (map[string]string, error)
+	Check(code, password string) error
+	PrepareDownload(code, password string) (filePath, fileName string, err error)
+}
+
+func NewIFileShareService() IFileShareService {
+	return &FileShareService{}
+}
+
+func randomShareCode(length int) (string, error) {
+	if length < fileShareCodeMinLength || length > fileShareCodeMaxLength {
+		length = fileShareCodeDefaultLength
+	}
+	b := make([]byte, length)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	buf := make([]byte, length)
+	for i := range b {
+		buf[i] = fileShareCharset[int(b[i])%len(fileShareCharset)]
+	}
+	return string(buf), nil
+}
+
+func randomSalt() (string, error) {
+	b := make([]byte, 16)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(b), nil
+}
+
+func hashPassword(salt, password string) string {
+	sum := sha256.Sum256([]byte(salt + ":" + password))
+	return hex.EncodeToString(sum[:])
+}
+
+func shareModelToInfo(item model.FileShare) response.FileShareInfo {
+	return response.FileShareInfo{
+		Code:        item.Token,
+		Path:        item.Path,
+		FileName:    item.FileName,
+		ExpiresAt:   item.ExpiresUnix,
+		Permanent:   item.ExpiresUnix == 0,
+		HasPassword: item.PasswordHash != "",
+	}
+}
+
+func fillSharePassword(info *response.FileShareInfo, item model.FileShare) {
+	if info == nil || item.PasswordEnc == "" {
+		return
+	}
+	password, err := encrypt.StringDecrypt(item.PasswordEnc)
+	if err != nil {
+		return
+	}
+	info.Password = password
+}
+
+func shareModelToPublicInfo(item model.FileShare) response.FileSharePublicInfo {
+	return response.FileSharePublicInfo{
+		FileName:    item.FileName,
+		ExpiresAt:   item.ExpiresUnix,
+		Permanent:   item.ExpiresUnix == 0,
+		HasPassword: item.PasswordHash != "",
+	}
+}
+
+func (s *FileShareService) generateUniqueCode() (string, error) {
+	for i := 0; i < 8; i++ {
+		code, err := randomShareCode(fileShareCodeDefaultLength)
+		if err != nil {
+			return "", err
+		}
+		_, err = fileShareRepo.GetFirst(fileShareRepo.WithByCode(code))
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return code, nil
+		}
+		if err != nil {
+			return "", err
+		}
+	}
+	return "", errors.New("failed to generate unique file share code")
+}
+
+func (s *FileShareService) Create(req request.FileShareCreate) (*response.FileShareInfo, error) {
+	path := strings.TrimSpace(req.Path)
+	if path == "" || strings.Contains(path, "..") {
+		return nil, buserr.New("ErrFileSharePath")
+	}
+	info, err := os.Stat(path)
+	if err != nil || info.IsDir() {
+		return nil, buserr.New("ErrFileSharePath")
+	}
+
+	item, err := fileShareRepo.GetFirst(fileShareRepo.WithByPath(path))
+	if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, err
+	}
+
+	isNew := errors.Is(err, gorm.ErrRecordNotFound)
+	if isNew {
+		code, err := s.generateUniqueCode()
+		if err != nil {
+			return nil, err
+		}
+		item = model.FileShare{
+			Path:     path,
+			Token:    code,
+			FileName: filepath.Base(path),
+		}
+	} else if !fileShareCodeRegexp.MatchString(item.Token) {
+		code, err := s.generateUniqueCode()
+		if err != nil {
+			return nil, err
+		}
+		item.Token = code
+	}
+
+	item.FileName = filepath.Base(path)
+	item.MaxDownloads = 0
+	item.DownloadCount = 0
+	item.ExpiresUnix = 0
+	if req.ExpireMinutes > 0 {
+		item.ExpiresUnix = time.Now().Add(time.Duration(req.ExpireMinutes) * time.Minute).Unix()
+	}
+
+	if req.Password != nil {
+		pw := strings.TrimSpace(*req.Password)
+		if pw == "" {
+			item.PasswordEnc = ""
+			item.PasswordSalt = ""
+			item.PasswordHash = ""
+		} else {
+			pwLen := utf8.RuneCountInString(pw)
+			if pwLen < 4 || pwLen > 256 {
+				return nil, buserr.New("ErrFileSharePasswordPolicy")
+			}
+			enc, err := encrypt.StringEncrypt(pw)
+			if err != nil {
+				return nil, err
+			}
+			item.PasswordEnc = enc
+			salt, err := randomSalt()
+			if err != nil {
+				return nil, err
+			}
+			item.PasswordSalt = salt
+			item.PasswordHash = hashPassword(salt, pw)
+		}
+	}
+
+	if isNew {
+		if err := fileShareRepo.Create(&item); err != nil {
+			return nil, err
+		}
+	} else {
+		if err := fileShareRepo.Save(&item); err != nil {
+			return nil, err
+		}
+	}
+
+	res := shareModelToInfo(item)
+	fillSharePassword(&res, item)
+	return &res, nil
+}
+
+func (s *FileShareService) Page(req dto.PageInfo) (int64, []response.FileShareInfo, error) {
+	items, err := fileShareRepo.All()
+	if err != nil {
+		return 0, nil, err
+	}
+	result := make([]response.FileShareInfo, 0, len(items))
+	for _, item := range items {
+		if err := s.pruneInvalidShare(item); err != nil {
+			return 0, nil, err
+		}
+		if item.ExpiresUnix > 0 && time.Now().Unix() > item.ExpiresUnix {
+			continue
+		}
+		result = append(result, shareModelToInfo(item))
+	}
+	total := len(result)
+	start := (req.Page - 1) * req.PageSize
+	if start >= total {
+		return int64(total), []response.FileShareInfo{}, nil
+	}
+	end := start + req.PageSize
+	if end > total {
+		end = total
+	}
+	return int64(total), result[start:end], nil
+}
+
+func (s *FileShareService) GetByPath(path string) (*response.FileShareInfo, error) {
+	item, err := fileShareRepo.GetFirst(fileShareRepo.WithByPath(strings.TrimSpace(path)))
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	if err := s.pruneInvalidShare(item); err != nil {
+		return nil, err
+	}
+	if item.ExpiresUnix > 0 && time.Now().Unix() > item.ExpiresUnix {
+		return nil, nil
+	}
+	info := shareModelToInfo(item)
+	fillSharePassword(&info, item)
+	return &info, nil
+}
+
+func (s *FileShareService) GetByCode(code string) (*response.FileShareInfo, error) {
+	item, err := fileShareRepo.GetFirst(fileShareRepo.WithByCode(strings.TrimSpace(code)))
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, buserr.New("ErrFileShareInvalid")
+		}
+		return nil, err
+	}
+	if err := s.pruneInvalidShare(item); err != nil {
+		return nil, err
+	}
+	if item.ExpiresUnix > 0 && time.Now().Unix() > item.ExpiresUnix {
+		return nil, buserr.New("ErrFileShareExpired")
+	}
+	info := shareModelToInfo(item)
+	return &info, nil
+}
+
+func (s *FileShareService) GetPublicByCode(code string) (*response.FileSharePublicInfo, error) {
+	item, err := fileShareRepo.GetFirst(fileShareRepo.WithByCode(strings.TrimSpace(code)))
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, buserr.New("ErrFileShareInvalid")
+		}
+		return nil, err
+	}
+	if err := s.pruneInvalidShare(item); err != nil {
+		return nil, err
+	}
+	if item.ExpiresUnix > 0 && time.Now().Unix() > item.ExpiresUnix {
+		return nil, buserr.New("ErrFileShareExpired")
+	}
+	info := shareModelToPublicInfo(item)
+	return &info, nil
+}
+
+func (s *FileShareService) DeleteByPath(path string) error {
+	item, err := fileShareRepo.GetFirst(fileShareRepo.WithByPath(strings.TrimSpace(path)))
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return buserr.New("ErrFileShareInvalid")
+		}
+		return err
+	}
+	return fileShareRepo.Delete(repo.WithByID(item.ID))
+}
+
+func (s *FileShareService) SharePathCodeMap() (map[string]string, error) {
+	items, err := fileShareRepo.All()
+	if err != nil {
+		return nil, err
+	}
+	result := make(map[string]string, len(items))
+	now := time.Now().Unix()
+	for _, item := range items {
+		if item.ExpiresUnix > 0 && now > item.ExpiresUnix {
+			continue
+		}
+		if _, err := os.Stat(item.Path); err != nil {
+			continue
+		}
+		result[item.Path] = item.Token
+	}
+	return result, nil
+}
+
+func (s *FileShareService) Check(code, password string) error {
+	_, err := s.check(code, password)
+	return err
+}
+
+func (s *FileShareService) PrepareDownload(code, password string) (string, string, error) {
+	item, err := s.check(code, password)
+	if err != nil {
+		return "", "", err
+	}
+	return item.Path, item.FileName, nil
+}
+
+func (s *FileShareService) pruneInvalidShare(item model.FileShare) error {
+	now := time.Now().Unix()
+	if item.ExpiresUnix > 0 && now > item.ExpiresUnix {
+		return fileShareRepo.Delete(repo.WithByID(item.ID))
+	}
+	info, err := os.Stat(item.Path)
+	if err != nil || info.IsDir() {
+		return fileShareRepo.Delete(repo.WithByID(item.ID))
+	}
+	return nil
+}
+
+func (s *FileShareService) check(code, password string) (*model.FileShare, error) {
+	code = strings.TrimSpace(code)
+	password = strings.TrimSpace(password)
+	if code == "" {
+		return nil, buserr.New("ErrFileShareInvalid")
+	}
+
+	item, err := fileShareRepo.GetFirst(fileShareRepo.WithByCode(code))
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, buserr.New("ErrFileShareInvalid")
+		}
+		return nil, err
+	}
+
+	now := time.Now().Unix()
+	if item.ExpiresUnix > 0 && now > item.ExpiresUnix {
+		_ = fileShareRepo.Delete(repo.WithByID(item.ID))
+		return nil, buserr.New("ErrFileShareExpired")
+	}
+	if item.PasswordHash != "" {
+		if subtle.ConstantTimeCompare([]byte(hashPassword(item.PasswordSalt, password)), []byte(item.PasswordHash)) != 1 {
+			return nil, buserr.New("ErrFileSharePassword")
+		}
+	}
+
+	info, err := os.Stat(item.Path)
+	if err != nil || info.IsDir() {
+		_ = fileShareRepo.Delete(repo.WithByID(item.ID))
+		return nil, buserr.New("ErrFileSharePath")
+	}
+
+	return &item, nil
+}

agent/app/service/host.go

@@ -4,13 +4,12 @@ import (
 	"encoding/base64"
 	"fmt"
 
-	"github.com/1Panel-dev/1Panel/core/app/dto"
-	"github.com/1Panel-dev/1Panel/core/app/model"
-	"github.com/1Panel-dev/1Panel/core/app/repo"
-	"github.com/1Panel-dev/1Panel/core/buserr"
-	"github.com/1Panel-dev/1Panel/core/global"
-	"github.com/1Panel-dev/1Panel/core/utils/encrypt"
-	"github.com/1Panel-dev/1Panel/core/utils/ssh"
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/app/repo"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/utils/encrypt"
+	"github.com/1Panel-dev/1Panel/agent/utils/ssh"
 	"github.com/jinzhu/copier"
 	"github.com/pkg/errors"
 )
@@ -75,11 +74,7 @@ func (u *HostService) TestByInfo(req dto.HostConnTest) bool {
 }
 
 func (u *HostService) TestLocalConn(id uint) bool {
-	var (
-		host model.Host
-		err  error
-	)
-	host, err = hostRepo.Get(repo.WithByID(id))
+	host, err := hostRepo.Get(repo.WithByID(id))
 	if err != nil {
 		return false
 	}
@@ -113,12 +108,11 @@ func (u *HostService) TestLocalConn(id uint) bool {
 		return false
 	}
 	defer client.Close()
-
 	return true
 }
 
 func (u *HostService) SearchWithPage(req dto.SearchPageWithGroup) (int64, interface{}, error) {
-	var options []global.DBOption
+	var options []repo.DBOption
 	if len(req.Info) != 0 {
 		options = append(options, hostRepo.WithByInfo(req.Info))
 	}
@@ -198,8 +192,7 @@ func (u *HostService) SearchForTree(search dto.SearchForTree) ([]dto.HostTree, e
 
 func (u *HostService) GetHostByID(id uint) (*dto.HostInfo, error) {
 	var item dto.HostInfo
-	var host model.Host
-	host, _ = hostRepo.Get(repo.WithByID(id))
+	host, _ := hostRepo.Get(repo.WithByID(id))
 	if host.ID == 0 {
 		return nil, buserr.New("ErrRecordNotFound")
 	}
@@ -336,7 +329,6 @@ func GetHostInfo(id uint) (*model.Host, error) {
 			return nil, err
 		}
 	}
-
 	if len(host.PassPhrase) != 0 {
 		host.PassPhrase, err = encrypt.StringDecrypt(host.PassPhrase)
 		if err != nil {

agent/app/service/host_tool.go

@@ -278,6 +278,10 @@ func (h *HostToolService) OperateSupervisorProcess(req request.SupervisorProcess
 }
 
 func handleProcess(supervisordDir string, req request.SupervisorProcessConfig, containerName string) error {
+	safeName := path.Base(req.Name)
+	if safeName != req.Name || strings.Contains(safeName, "..") {
+		return buserr.New("ErrInvalidParams")
+	}
 	var (
 		fileOp     = files.NewFileOp()
 		logDir     = path.Join(supervisordDir, "log")

agent/app/service/iptables.go

@@ -289,11 +289,11 @@ func (s *IptablesService) LoadChainStatus(req dto.OperationWithName) dto.Iptable
 	}
 	switch req.Name {
 	case iptables.Chain1PanelBasic:
-		data.IsBind, err = iptables.CheckChainBind(iptables.FilterTab, iptables.ChainInput, req.Name)
+		data.IsBind, _ = iptables.CheckChainBind(iptables.FilterTab, iptables.ChainInput, req.Name)
 	case iptables.Chain1PanelInput:
-		data.IsBind, err = iptables.CheckChainBind(iptables.FilterTab, iptables.ChainInput, req.Name)
+		data.IsBind, _ = iptables.CheckChainBind(iptables.FilterTab, iptables.ChainInput, req.Name)
 	case iptables.Chain1PanelOutput:
-		data.IsBind, err = iptables.CheckChainBind(iptables.FilterTab, iptables.ChainOutput, req.Name)
+		data.IsBind, _ = iptables.CheckChainBind(iptables.FilterTab, iptables.ChainOutput, req.Name)
 	}
 	return data
 }

agent/app/service/mcp_server.go

@@ -4,6 +4,10 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"path"
+	"strconv"
+	"strings"
+
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/response"
@@ -23,9 +27,6 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/utils/nginx/parser"
 	"github.com/subosito/gotenv"
 	"gopkg.in/yaml.v3"
-	"path"
-	"strconv"
-	"strings"
 )
 
 type McpServerService struct{}

agent/app/service/nginx.go

@@ -18,7 +18,6 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/buserr"
 	"github.com/1Panel-dev/1Panel/agent/global"
 	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
-	cmd2 "github.com/1Panel-dev/1Panel/agent/utils/cmd"
 	"github.com/subosito/gotenv"
 
 	"github.com/1Panel-dev/1Panel/agent/utils/compose"
@@ -241,7 +240,7 @@ func (n NginxService) Build(req request.NginxBuildReq) error {
 		return err
 	}
 	buildTask.AddSubTaskWithOps("", func(t *task.Task) error {
-		cmdMgr := cmd2.NewCommandMgr(cmd.WithTask(*buildTask), cmd.WithTimeout(120*time.Minute))
+		cmdMgr := cmd.NewCommandMgr(cmd.WithTask(*buildTask), cmd.WithTimeout(120*time.Minute))
 		if err = cmdMgr.RunBashCf("docker compose -f %s build", nginxInstall.GetComposePath()); err != nil {
 			return err
 		}

agent/app/service/runtime.go

@@ -677,7 +677,7 @@ func (r *RuntimeService) GetPHPExtensions(runtimeID uint) (response.PHPExtension
 		return res, err
 	}
 	cmdMgr := cmd.NewCommandMgr(cmd.WithTimeout(20 * time.Second))
-	out, err := cmdMgr.RunWithStdoutBashCf("docker exec -i %s php -m", runtime.ContainerName)
+	out, err := cmdMgr.RunWithStdout("docker", "exec", "-i", runtime.ContainerName, "php", "-m")
 	if err != nil {
 		return res, err
 	}
@@ -722,7 +722,7 @@ func (r *RuntimeService) InstallPHPExtension(req request.PHPExtensionInstallReq)
 	}
 	installTask.AddSubTask("", func(t *task.Task) error {
 		err = cmd.NewCommandMgr(cmd.WithTask(*installTask), cmd.WithTimeout(20*time.Minute)).
-			RunBashCf("docker exec -i %s install-ext %s", runtime.ContainerName, req.Name)
+			Run("docker", "exec", "-i", runtime.ContainerName, "install-ext", req.Name)
 		if err != nil {
 			return err
 		}
@@ -736,7 +736,7 @@ func (r *RuntimeService) InstallPHPExtension(req request.PHPExtensionInstallReq)
 			return err
 		}
 		err = cmd.NewCommandMgr(cmd.WithTask(*installTask), cmd.WithTimeout(15*time.Minute)).
-			RunBashCf("docker commit %s %s", runtime.ContainerName, runtime.Image)
+			Run("docker", "commit", runtime.ContainerName, runtime.Image)
 		if err != nil {
 			return err
 		}

agent/app/service/setting.go

@@ -3,6 +3,8 @@ package service
 import (
 	"encoding/base64"
 	"encoding/json"
+	"strconv"
+	"strings"
 	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
@@ -12,6 +14,7 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/utils/encrypt"
 	"github.com/1Panel-dev/1Panel/agent/utils/ssh"
+	terminalai "github.com/1Panel-dev/1Panel/agent/utils/terminal/ai"
 	"github.com/jinzhu/copier"
 )
 
@@ -19,7 +22,11 @@ type SettingService struct{}
 
 type ISettingService interface {
 	GetSettingInfo() (*dto.SettingInfo, error)
+	GetTerminalAIInfo() (*dto.TerminalAIInfo, error)
+	GetFileManageAIInfo() (*dto.FileManageAIInfo, error)
 	Update(key, value string) error
+	UpdateTerminalAI(req dto.TerminalAIInfo) error
+	UpdateFileManageAI(req dto.FileManageAIInfo) error
 
 	TestConnByInfo(req dto.SSHConnData) bool
 	SaveConnInfo(req dto.SSHConnData) error
@@ -57,10 +64,111 @@ func (u *SettingService) GetSettingInfo() (*dto.SettingInfo, error) {
 	return &info, err
 }
 
+func (u *SettingService) GetTerminalAIInfo() (*dto.TerminalAIInfo, error) {
+	info := &dto.TerminalAIInfo{
+		AIStatus:              constant.StatusDisable,
+		AIAccountID:           "",
+		AIPrefix:              constant.DefaultTerminalAIPrefix,
+		AIRiskCommands:        "[]",
+		AIRiskCommandsDefault: constant.DefaultTerminalAIRiskCommands,
+	}
+
+	if value, err := settingRepo.GetValueByKey("AIStatus"); err == nil && value != "" {
+		info.AIStatus = value
+	}
+	if value, err := settingRepo.GetValueByKey("AIAccountID"); err == nil {
+		info.AIAccountID = value
+	}
+	if value, err := settingRepo.GetValueByKey("AIPrefix"); err == nil {
+		info.AIPrefix = value
+	}
+	if value, err := settingRepo.GetValueByKey("AIRiskCommands"); err == nil && value != "" {
+		info.AIRiskCommands = value
+	}
+
+	return info, nil
+}
+
+func (u *SettingService) GetFileManageAIInfo() (*dto.FileManageAIInfo, error) {
+	info := &dto.FileManageAIInfo{
+		AIStatus:    constant.StatusDisable,
+		AIAccountID: "",
+	}
+	if value, err := settingRepo.GetValueByKey("FileAIStatus"); err == nil && value != "" {
+		info.AIStatus = value
+	}
+	if value, err := settingRepo.GetValueByKey("FileAIAccountID"); err == nil {
+		info.AIAccountID = value
+	}
+	return info, nil
+}
+
 func (u *SettingService) Update(key, value string) error {
 	return settingRepo.UpdateOrCreate(key, value)
 }
 
+func (u *SettingService) UpdateTerminalAI(req dto.TerminalAIInfo) error {
+	if strings.EqualFold(strings.TrimSpace(req.AIStatus), constant.StatusEnable) {
+		accountID, err := strconv.ParseUint(strings.TrimSpace(req.AIAccountID), 10, 64)
+		if err != nil || accountID == 0 {
+			return buserr.New("ErrAgentAccountIDRequired")
+		}
+		currentStatus, _ := settingRepo.GetValueByKey("AIStatus")
+		currentAccountID, _ := settingRepo.GetValueByKey("AIAccountID")
+		needValidate := !strings.EqualFold(strings.TrimSpace(currentStatus), constant.StatusEnable) ||
+			strings.TrimSpace(currentAccountID) != strings.TrimSpace(req.AIAccountID)
+		if needValidate {
+			if err := terminalai.ValidateTerminalAccount(uint(accountID)); err != nil {
+				return buserr.WithErr("ErrAgentAccountUnavailable", err)
+			}
+		}
+	}
+	if err := settingRepo.UpdateOrCreate("AIStatus", req.AIStatus); err != nil {
+		return err
+	}
+	if err := settingRepo.UpdateOrCreate("AIAccountID", req.AIAccountID); err != nil {
+		return err
+	}
+	if err := settingRepo.UpdateOrCreate("AIPrefix", req.AIPrefix); err != nil {
+		return err
+	}
+	if err := settingRepo.UpdateOrCreate("AIRiskCommands", req.AIRiskCommands); err != nil {
+		return err
+	}
+	terminalai.InvalidateTerminalRuntimeCache()
+	return nil
+}
+
+func (u *SettingService) UpdateFileManageAI(req dto.FileManageAIInfo) error {
+	if strings.EqualFold(strings.TrimSpace(req.AIStatus), constant.StatusEnable) {
+		accountID, err := strconv.ParseUint(strings.TrimSpace(req.AIAccountID), 10, 64)
+		if err != nil || accountID == 0 {
+			return buserr.New("ErrAgentAccountIDRequired")
+		}
+		currentStatus, _ := settingRepo.GetValueByKey("FileAIStatus")
+		currentAccountID, _ := settingRepo.GetValueByKey("FileAIAccountID")
+		needValidate := !strings.EqualFold(strings.TrimSpace(currentStatus), constant.StatusEnable) ||
+			strings.TrimSpace(currentAccountID) != strings.TrimSpace(req.AIAccountID)
+		if needValidate {
+			if err := terminalai.ValidateTerminalAccount(uint(accountID)); err != nil {
+				return buserr.WithErr("ErrAgentAccountUnavailable", err)
+			}
+		}
+	}
+	accountVal := strings.TrimSpace(req.AIAccountID)
+	if !strings.EqualFold(strings.TrimSpace(req.AIStatus), constant.StatusEnable) {
+		accountVal = ""
+	}
+	if err := settingRepo.UpdateOrCreate("FileAIStatus", req.AIStatus); err != nil {
+		return err
+	}
+	if err := settingRepo.UpdateOrCreate("FileAIAccountID", accountVal); err != nil {
+		return err
+	}
+	terminalai.InvalidateFileAIRuntimeCache()
+	return nil
+}
+
 func (u *SettingService) TestConnByInfo(req dto.SSHConnData) bool {
 	if req.AuthMode == "password" && len(req.Password) != 0 {
 		password, err := base64.StdEncoding.DecodeString(req.Password)

agent/app/service/snapshot_recover.go

@@ -133,7 +133,7 @@ func (u *SnapshotService) SnapshotRecover(req dto.SnapshotRecover) error {
 
 		var snapJson SnapshotJson
 		taskItem.AddSubTaskWithAliasAndOps(
-			"Readjson",
+			"ReadJson",
 			func(t *task.Task) error {
 				snapJson, err = readFromJson(path.Join(rootDir, snap.Name), &itemHelper)
 				return err
@@ -156,14 +156,6 @@ func (u *SnapshotService) SnapshotRecover(req dto.SnapshotRecover) error {
 			)
 			req.IsNew = true
 		}
-		if req.IsNew || snap.InterruptStep == "RecoverDBData" {
-			taskItem.AddSubTaskWithAliasAndOps(
-				"RecoverDBData",
-				func(t *task.Task) error { return recoverDBData(path.Join(rootDir, snap.Name, "db"), &itemHelper) },
-				nil, 0, 90*time.Minute,
-			)
-			req.IsNew = true
-		}
 		if req.IsNew || snap.InterruptStep == "RecoverBackups" {
 			taskItem.AddSubTaskWithAliasAndOps(
 				"RecoverBackups",
@@ -222,13 +214,24 @@ func (u *SnapshotService) SnapshotRecover(req dto.SnapshotRecover) error {
 			)
 			req.IsNew = true
 		}
-		taskItem.AddSubTaskWithAliasAndOps(
-			"RecoverDBData",
-			func(t *task.Task) error {
-				return restartCompose(path.Join(snapJson.BaseDir, "1panel/docker/compose"), &itemHelper)
-			},
-			nil, 0, 90*time.Minute,
-		)
+		if req.IsNew || snap.InterruptStep == "RecoverCompose" {
+			taskItem.AddSubTaskWithAliasAndOps(
+				"RecoverCompose",
+				func(t *task.Task) error {
+					return restartCompose(path.Join(snapJson.BaseDir, "1panel/docker/compose"), &itemHelper)
+				},
+				nil, 0, 90*time.Minute,
+			)
+			req.IsNew = true
+		}
+		if req.IsNew || snap.InterruptStep == "RecoverDBData" {
+			taskItem.AddSubTaskWithAliasAndOps(
+				"RecoverDBData",
+				func(t *task.Task) error { return recoverDBData(path.Join(rootDir, snap.Name, "db"), &itemHelper) },
+				nil, 0, 90*time.Minute,
+			)
+			req.IsNew = true
+		}
 
 		if err := taskItem.Execute(); err != nil {
 			_ = settingRepo.Update("SystemStatus", "Free")
@@ -343,22 +346,22 @@ func backupBeforeRecover(name string, itemHelper *snapRecoverHelper) error {
 
 func readFromJson(rootDir string, itemHelper *snapRecoverHelper) (SnapshotJson, error) {
 	itemHelper.Task.Log("---------------------- 4 / 11 ----------------------")
-	itemHelper.Task.LogStart(i18n.GetMsgByKey("Readjson"))
+	itemHelper.Task.LogStart(i18n.GetMsgByKey("ReadJson"))
 
 	snapJsonPath := path.Join(rootDir, "base/snapshot.json")
 	var snap SnapshotJson
 	_, err := os.Stat(snapJsonPath)
-	itemHelper.Task.LogWithStatus(i18n.GetMsgByKey("ReadjsonPath"), err)
+	itemHelper.Task.LogWithStatus(i18n.GetMsgByKey("ReadJsonPath"), err)
 	if err != nil {
 		return snap, err
 	}
 	fileByte, err := os.ReadFile(snapJsonPath)
-	itemHelper.Task.LogWithStatus(i18n.GetMsgByKey("ReadjsonContent"), err)
+	itemHelper.Task.LogWithStatus(i18n.GetMsgByKey("ReadJsonContent"), err)
 	if err != nil {
 		return snap, err
 	}
 	err = json.Unmarshal(fileByte, &snap)
-	itemHelper.Task.LogWithStatus(i18n.GetMsgByKey("ReadjsonMarshal"), err)
+	itemHelper.Task.LogWithStatus(i18n.GetMsgByKey("ReadJsonMarshal"), err)
 	if err != nil {
 		return snap, err
 	}
@@ -439,17 +442,8 @@ func recoverBaseData(src string, itemHelper *snapRecoverHelper) error {
 	return nil
 }
 
-func recoverDBData(src string, itemHelper *snapRecoverHelper) error {
-	itemHelper.Task.Log("---------------------- 7 / 11 ----------------------")
-	itemHelper.Task.LogStart(i18n.GetMsgByKey("RecoverDBData"))
-	err := itemHelper.FileOp.CopyDirWithExclude(src, global.Dir.DataDir, nil)
-
-	itemHelper.Task.LogWithStatus(i18n.GetMsgByKey("RecoverDBData"), err)
-	return err
-}
-
 func restartCompose(composePath string, itemHelper *snapRecoverHelper) error {
-	itemHelper.Task.Log("---------------------- 11 / 11 ----------------------")
+	itemHelper.Task.Log("---------------------- 7 / 11 ----------------------")
 	itemHelper.Task.LogStart(i18n.GetMsgByKey("RecoverCompose"))
 
 	composes, err := composeRepo.ListRecord()
@@ -472,3 +466,64 @@ func restartCompose(composePath string, itemHelper *snapRecoverHelper) error {
 	}
 	return nil
 }
+
+func recoverDBData(src string, itemHelper *snapRecoverHelper) error {
+	itemHelper.Task.Log("---------------------- 11 / 11 ----------------------")
+	itemHelper.Task.LogStart(i18n.GetMsgByKey("RecoverDBData"))
+	dbDir := path.Join(global.Dir.DataDir, "db")
+	if err := os.RemoveAll(dbDir); err != nil {
+		itemHelper.Task.LogWithStatus(i18n.GetMsgByKey("RecoverDBData"), err)
+		return err
+	}
+
+	err := itemHelper.FileOp.CopyDirWithExclude(src, global.Dir.DataDir, nil)
+	if err != nil {
+		itemHelper.Task.LogWithStatus(i18n.GetMsgByKey("RecoverDBData"), err)
+		return err
+	}
+	if cleanErr := cleanOrphanSQLiteSidecars(dbDir); cleanErr != nil {
+		itemHelper.Task.LogWithStatus(i18n.GetMsgByKey("RecoverDBData"), cleanErr)
+		return cleanErr
+	}
+
+	itemHelper.Task.LogWithStatus(i18n.GetMsgByKey("RecoverDBData"), nil)
+	return nil
+}
+
+func cleanOrphanSQLiteSidecars(dbDir string) error {
+	entries, err := os.ReadDir(dbDir)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+
+	for _, entry := range entries {
+		if entry.IsDir() {
+			continue
+		}
+
+		name := entry.Name()
+		var mainDB string
+		switch {
+		case strings.HasSuffix(name, ".db-wal"):
+			mainDB = strings.TrimSuffix(name, "-wal")
+		case strings.HasSuffix(name, ".db-shm"):
+			mainDB = strings.TrimSuffix(name, "-shm")
+		default:
+			continue
+		}
+
+		if _, statErr := os.Stat(path.Join(dbDir, mainDB)); statErr != nil {
+			if !os.IsNotExist(statErr) {
+				return statErr
+			}
+			if removeErr := os.Remove(path.Join(dbDir, name)); removeErr != nil && !os.IsNotExist(removeErr) {
+				return removeErr
+			}
+		}
+	}
+
+	return nil
+}

agent/app/service/ssh.go

@@ -9,6 +9,7 @@ import (
 	"os"
 	"os/user"
 	"path"
+	"path/filepath"
 	"sort"
 	"strconv"
 	"strings"
@@ -33,6 +34,8 @@ import (
 )
 
 const sshPath = "/etc/ssh/sshd_config"
+const defaultSSHPort = "22"
+const sshManagedMarker = "# config by 1panel"
 
 type SSHService struct{}
 
@@ -41,7 +44,7 @@ type ISSHService interface {
 	OperateSSH(operation string) error
 	Update(req dto.SSHUpdate) error
 	LoadSSHFile(name string) (string, error)
-	UpdateByFile(req dto.SettingUpdate) error
+	UpdateByFile(req dto.SSHConfUpdate) error
 
 	LoadLog(ctx *gin.Context, req dto.SearchSSHLog) (int64, []dto.SSHHistory, error)
 	ExportLog(ctx *gin.Context, req dto.SearchSSHLog) (string, error)
@@ -57,6 +60,28 @@ func NewISSHService() ISSHService {
 	return &SSHService{}
 }
 
+type sshDirective struct {
+	Key     string
+	Value   string
+	File    string
+	Line    int
+	InMatch bool
+}
+
+type sshConfigFile struct {
+	Path     string `json:"path"`
+	Priority int    `json:"priority"`
+}
+
+type sshManagedBlock struct {
+	Start int
+	End   int
+}
+
+func (b sshManagedBlock) contains(line int) bool {
+	return line >= b.Start && line < b.End
+}
+
 func (u *SSHService) GetSSHInfo() (*dto.SSHInfo, error) {
 	data := dto.SSHInfo{
 		AutoStart:              true,
@@ -70,64 +95,9 @@ func (u *SSHService) GetSSHInfo() (*dto.SSHInfo, error) {
 		PermitRootLogin:        "yes",
 		UseDNS:                 "yes",
 	}
-	serviceName, err := loadServiceName()
-	if err != nil {
-		data.IsExist = false
-		data.Message = err.Error()
-	} else {
-		active, err := controller.CheckActive(serviceName)
-		data.IsActive = active
-		if !active && err != nil {
-			data.Message = err.Error()
-		}
-	}
-
-	enable, err := controller.CheckEnable(serviceName)
-	if err != nil {
-		data.AutoStart = false
-	} else {
-		data.AutoStart = enable
-	}
-
-	sshConf, err := os.ReadFile(sshPath)
-	if err != nil {
-		data.Message = err.Error()
-		data.IsActive = false
-	}
-	lines := strings.Split(string(sshConf), "\n")
-	for _, line := range lines {
-		if strings.HasPrefix(line, "Port ") {
-			data.Port = strings.ReplaceAll(line, "Port ", "")
-		}
-		if strings.HasPrefix(line, "ListenAddress ") {
-			itemAddr := strings.ReplaceAll(line, "ListenAddress ", "")
-			if len(data.ListenAddress) != 0 {
-				data.ListenAddress += ("," + itemAddr)
-			} else {
-				data.ListenAddress = itemAddr
-			}
-		}
-		if strings.HasPrefix(line, "PasswordAuthentication ") {
-			data.PasswordAuthentication = strings.ReplaceAll(line, "PasswordAuthentication ", "")
-		}
-		if strings.HasPrefix(line, "PubkeyAuthentication ") {
-			data.PubkeyAuthentication = strings.ReplaceAll(line, "PubkeyAuthentication ", "")
-		}
-		if strings.HasPrefix(line, "PermitRootLogin ") {
-			data.PermitRootLogin = strings.ReplaceAll(strings.ReplaceAll(line, "PermitRootLogin ", ""), "prohibit-password", "without-password")
-		}
-		if strings.HasPrefix(line, "UseDNS ") {
-			data.UseDNS = strings.ReplaceAll(line, "UseDNS ", "")
-		}
-	}
-
-	currentUser, err := user.Current()
-	if err != nil || len(currentUser.Name) == 0 {
-		data.CurrentUser = "root"
-	} else {
-		data.CurrentUser = currentUser.Name
-	}
-
+	loadSSHServiceStatus(&data)
+	loadSSHConfigInfo(&data)
+	data.CurrentUser = loadCurrentUserName()
 	return &data, nil
 }
 
@@ -160,58 +130,175 @@ func (u *SSHService) Update(req dto.SSHUpdate) error {
 		return err
 	}
 
-	sshConf, err := os.ReadFile(sshPath)
+	directives, _, err := parseSSHConfigTree(sshPath)
 	if err != nil {
 		return err
 	}
-	lines := strings.Split(string(sshConf), "\n")
-	newFiles := updateSSHConf(lines, req.Key, req.NewValue)
-	file, err := os.OpenFile(sshPath, os.O_WRONLY|os.O_TRUNC, constant.FilePerm)
-	if err != nil {
+	oldPortValue := strings.Join(loadSSHPortValues(directives), ",")
+	if err := updateSSHDirectiveValue(req.Key, req.NewValue, directives); err != nil {
 		return err
 	}
-	defer file.Close()
-	if _, err = file.WriteString(strings.Join(newFiles, "\n")); err != nil {
-		return err
-	}
-	sudo := cmd.SudoHandleCmd()
 	if req.Key == "Port" {
-		stdout, _ := cmd.RunDefaultWithStdoutBashCf("%s getenforce", sudo)
-		if stdout == "Enforcing\n" {
-			_ = cmd.RunDefaultBashCf("%s semanage port -a -t ssh_port_t -p tcp %s", sudo, req.NewValue)
-		}
-
-		ruleItem := dto.PortRuleUpdate{
-			OldRule: dto.PortRuleOperate{
-				Operation: "remove",
-				Port:      req.OldValue,
-				Protocol:  "tcp",
-				Strategy:  "accept",
-			},
-			NewRule: dto.PortRuleOperate{
-				Operation: "add",
-				Port:      req.NewValue,
-				Protocol:  "tcp",
-				Strategy:  "accept",
-			},
-		}
-		if err := NewIFirewallService().UpdatePortRule(ruleItem); err != nil {
-			global.LOG.Errorf("reset firewall rules %s -> %s failed, err: %v", req.OldValue, req.NewValue, err)
-		}
-		newPort, _ := strconv.Atoi(req.NewValue)
-		if err := updateLocalConn(uint(newPort)); err != nil {
-			global.LOG.Errorf("update local conn for terminal failed, err: %v", err)
-		}
-
-		if err := updateSSHSocketFile(req.NewValue); err != nil {
-			global.LOG.Errorf("update port for ssh.socket failed, err: %v", err)
-		}
+		handleSSHPortUpdate(oldPortValue, req.NewValue)
 	}
 
 	_ = controller.HandleRestart(serviceName)
 	return nil
 }
 
+func loadSSHServiceStatus(data *dto.SSHInfo) {
+	serviceName, err := loadServiceName()
+	if err != nil {
+		data.IsExist = false
+		data.Message = err.Error()
+		return
+	}
+
+	active, err := controller.CheckActive(serviceName)
+	data.IsActive = active
+	if !active && err != nil {
+		data.Message = err.Error()
+	}
+
+	enable, err := controller.CheckEnable(serviceName)
+	if err != nil {
+		data.AutoStart = false
+		return
+	}
+	data.AutoStart = enable
+}
+
+func loadSSHConfigInfo(data *dto.SSHInfo) {
+	directives, _, err := parseSSHConfigTree(sshPath)
+	if err != nil {
+		data.Message = err.Error()
+		data.IsActive = false
+		return
+	}
+
+	if port := strings.Join(loadSSHPortValues(directives), ","); port != "" {
+		data.Port = port
+	}
+	data.ListenAddress = strings.Join(loadSSHDirectiveValues(directives, "ListenAddress"), ",")
+	if value, ok := loadFirstSSHDirectiveValue(directives, "PasswordAuthentication"); ok {
+		data.PasswordAuthentication = value
+	}
+	if value, ok := loadFirstSSHDirectiveValue(directives, "PubkeyAuthentication"); ok {
+		data.PubkeyAuthentication = value
+	}
+	if value, ok := loadFirstSSHDirectiveValue(directives, "PermitRootLogin"); ok {
+		data.PermitRootLogin = strings.ReplaceAll(value, "prohibit-password", "without-password")
+	}
+	if value, ok := loadFirstSSHDirectiveValue(directives, "UseDNS"); ok {
+		data.UseDNS = value
+	}
+}
+
+func loadCurrentUserName() string {
+	currentUser, err := user.Current()
+	if err != nil || currentUser.Name == "" {
+		return "root"
+	}
+	return currentUser.Name
+}
+
+func handleSSHPortUpdate(oldValue, newValue string) {
+	sudo := cmd.SudoHandleCmd()
+	newPorts := splitSSHPorts(newValue)
+	oldPorts := splitSSHPorts(oldValue)
+
+	stdout, _ := runWithOptionalSudo(sudo, "getenforce")
+	if stdout == "Enforcing\n" {
+		for _, port := range diffSSHPorts(oldPorts, newPorts) {
+			if _, err := runWithOptionalSudo(sudo, "semanage", "port", "-d", "-t", "ssh_port_t", "-p", "tcp", port); err != nil {
+				global.LOG.Warnf("remove selinux ssh port %s failed, err: %v", port, err)
+			}
+		}
+		for _, port := range newPorts {
+			_, _ = runWithOptionalSudo(sudo, "semanage", "port", "-a", "-t", "ssh_port_t", "-p", "tcp", port)
+		}
+	}
+
+	removedPorts, err := parseSSHPortsToInts(diffSSHPorts(oldPorts, newPorts))
+	if err != nil {
+		global.LOG.Errorf("parse removed ssh ports failed, err: %v", err)
+	} else {
+		addedPorts, err := parseSSHPortsToInts(diffSSHPorts(newPorts, oldPorts))
+		if err != nil {
+			global.LOG.Errorf("parse added ssh ports failed, err: %v", err)
+		} else if err := OperateFirewallPort(removedPorts, addedPorts); err != nil {
+			global.LOG.Errorf("reset firewall rules %s -> %s failed, err: %v", oldValue, newValue, err)
+		}
+	}
+
+	primaryPort, err := loadPrimarySSHPort(newValue)
+	if err != nil {
+		global.LOG.Errorf("load primary ssh port from %s failed, err: %v", newValue, err)
+		return
+	}
+	if err := updateLocalConn(uint(primaryPort)); err != nil {
+		global.LOG.Errorf("update local conn for terminal failed, err: %v", err)
+	}
+	if err := updateSSHSocketFile(strconv.Itoa(primaryPort)); err != nil {
+		global.LOG.Errorf("update port for ssh.socket failed, err: %v", err)
+	}
+}
+
+func splitSSHPorts(value string) []string {
+	var ports []string
+	for _, item := range strings.Split(value, ",") {
+		port := strings.TrimSpace(item)
+		if port != "" {
+			ports = append(ports, port)
+		}
+	}
+	return ports
+}
+
+func diffSSHPorts(left, right []string) []string {
+	rightSet := make(map[string]struct{}, len(right))
+	for _, item := range right {
+		rightSet[item] = struct{}{}
+	}
+	var diff []string
+	for _, item := range left {
+		if _, ok := rightSet[item]; ok {
+			continue
+		}
+		diff = append(diff, item)
+	}
+	return diff
+}
+
+func loadPrimarySSHPort(value string) (int, error) {
+	ports := splitSSHPorts(value)
+	if len(ports) == 0 {
+		return 0, fmt.Errorf("ssh port is empty")
+	}
+	return strconv.Atoi(ports[0])
+}
+
+func parseSSHPortsToInts(ports []string) ([]int, error) {
+	var values []int
+	for _, port := range ports {
+		value, err := strconv.Atoi(port)
+		if err != nil {
+			return nil, err
+		}
+		values = append(values, value)
+	}
+	return values, nil
+}
+
+func runWithOptionalSudo(sudo, name string, args ...string) (string, error) {
+	cmdMgr := cmd.NewCommandMgr(cmd.WithTimeout(20 * time.Second))
+	if sudo != "" {
+		commandArgs := append([]string{name}, args...)
+		return cmdMgr.RunWithStdout("sudo", commandArgs...)
+	}
+	return cmdMgr.RunWithStdout(name, args...)
+}
+
 func (u *SSHService) SyncRootCert() error {
 	currentUser, err := user.Current()
 	if err != nil {
@@ -269,16 +356,26 @@ func (u *SSHService) CreateRootCert(req dto.RootCertOperate) error {
 	publicPath := fmt.Sprintf("%s/.ssh/%s.pub", currentUser.HomeDir, req.Name)
 	authFilePath := currentUser.HomeDir + "/.ssh/authorized_keys"
 
-	authFileItem, _ := os.ReadFile(authFilePath)
-	authFile := string(authFileItem)
-	if authFile != "" && !strings.HasSuffix(authFile, "\n") {
-		file, err := os.OpenFile(authFilePath, os.O_APPEND|os.O_WRONLY|os.O_CREATE, 0644)
+	if info, err := os.Stat(authFilePath); err == nil && info.Size() > 0 {
+		f, err := os.Open(authFilePath)
 		if err != nil {
 			return err
 		}
-		defer file.Close()
-		if _, err := file.WriteString("\n"); err != nil {
-			return err
+		defer func() { _ = f.Close() }()
+
+		if _, err := f.Seek(-1, 2); err == nil {
+			buf := make([]byte, 1)
+			if _, err := f.Read(buf); err == nil && buf[0] != '\n' {
+				appendFile, err := os.OpenFile(authFilePath, os.O_APPEND|os.O_WRONLY, 0600)
+				if err != nil {
+					return err
+				}
+				if _, err := appendFile.Write([]byte("\n")); err != nil {
+					_ = appendFile.Close()
+					return err
+				}
+				_ = appendFile.Close()
+			}
 		}
 	}
 
@@ -290,17 +387,43 @@ func (u *SSHService) CreateRootCert(req dto.RootCertOperate) error {
 			return err
 		}
 	} else {
-		command := fmt.Sprintf("ssh-keygen -t %s -f %s/.ssh/%s -N ''", req.EncryptionMode, currentUser.HomeDir, req.Name)
-		if len(req.PassPhrase) != 0 {
-			command = fmt.Sprintf("ssh-keygen -t %s -P %s -f %s/.ssh/%s | echo y", req.EncryptionMode, req.PassPhrase, currentUser.HomeDir, req.Name)
+		tmpPrivatePath := privatePath + ".tmp"
+		tmpPublicPath := privatePath + ".tmp.pub"
+		cmdMgr := cmd.NewCommandMgr(cmd.WithTimeout(2 * time.Minute))
+		args := []string{
+			"-t", req.EncryptionMode,
+			"-f", tmpPrivatePath,
+			"-N", req.PassPhrase,
+			"-q",
 		}
-		if err := cmd.RunDefaultBashC(command); err != nil {
+
+		if err := cmdMgr.Run("ssh-keygen", args...); err != nil {
+			_ = os.Remove(tmpPrivatePath)
+			_ = os.Remove(tmpPublicPath)
 			return fmt.Errorf("generate failed, %v", err)
 		}
+		if err := os.Rename(tmpPrivatePath, privatePath); err != nil {
+			return fmt.Errorf("replace private key failed, %v", err)
+		}
+		if err := os.Rename(tmpPublicPath, publicPath); err != nil {
+			return fmt.Errorf("replace public key failed, %v", err)
+		}
 	}
 
-	if err := cmd.RunDefaultBashCf("cat %s >> %s", publicPath, authFilePath); err != nil {
-		return fmt.Errorf("generate failed, %v", err)
+	publicKeyBytes, err := os.ReadFile(publicPath)
+	if err != nil {
+		return fmt.Errorf("read public key failed, %v", err)
+	}
+
+	cleanKey := strings.TrimRight(string(publicKeyBytes), "\n") + "\n"
+	authFile, err := os.OpenFile(authFilePath, os.O_APPEND|os.O_WRONLY|os.O_CREATE, 0600)
+	if err != nil {
+		return fmt.Errorf("open authorized_keys failed, %v", err)
+	}
+	defer func() { _ = authFile.Close() }()
+
+	if _, err := authFile.Write([]byte(cleanKey)); err != nil {
+		return fmt.Errorf("append authorized_keys failed, %v", err)
 	}
 
 	cert.PrivateKeyPath = privatePath
@@ -546,8 +669,25 @@ func (u *SSHService) LoadSSHFile(name string) (string, error) {
 		fileName = currentUser.HomeDir + "/.ssh/authorized_keys"
 	case "sshdConf":
 		fileName = "/etc/ssh/sshd_config"
+	case "sshdConfOptions":
+		_, fileList, err := parseSSHConfigTree(sshPath)
+		if err != nil {
+			return "", err
+		}
+		content, err := json.Marshal(fileList)
+		if err != nil {
+			return "", err
+		}
+		return string(content), nil
 	default:
-		return "", buserr.WithName("ErrNotSupportType", name)
+		if strings.HasPrefix(name, "sshdConfPath:") {
+			fileName = strings.TrimPrefix(name, "sshdConfPath:")
+			if !isSSHConfigPathAllowed(fileName) {
+				return "", buserr.WithName("ErrNotSupportType", name)
+			}
+		} else {
+			return "", buserr.WithName("ErrNotSupportType", name)
+		}
 	}
 	if _, err := os.Stat(fileName); err != nil {
 		return "", buserr.WithErr("ErrHttpReqNotFound", err)
@@ -559,7 +699,7 @@ func (u *SSHService) LoadSSHFile(name string) (string, error) {
 	return string(content), nil
 }
 
-func (u *SSHService) UpdateByFile(req dto.SettingUpdate) error {
+func (u *SSHService) UpdateByFile(req dto.SSHConfUpdate) error {
 	var fileName string
 	switch req.Key {
 	case "authKeys":
@@ -570,6 +710,11 @@ func (u *SSHService) UpdateByFile(req dto.SettingUpdate) error {
 		fileName = currentUser.HomeDir + "/.ssh/authorized_keys"
 	case "sshdConf":
 		fileName = "/etc/ssh/sshd_config"
+	case "sshdConfPath":
+		fileName = req.Path
+		if !isSSHConfigPathAllowed(fileName) {
+			return buserr.WithName("ErrNotSupportType", req.Key)
+		}
 	default:
 		return buserr.WithName("ErrNotSupportType", req.Key)
 	}
@@ -611,35 +756,372 @@ func sortFileList(fileNames []sshFileItem) []sshFileItem {
 	return fileNames
 }
 
-func updateSSHConf(oldFiles []string, param string, value string) []string {
-	var valueItems []string
-	if param != "ListenAddress" {
-		valueItems = append(valueItems, value)
-	} else {
-		if value != "" {
-			valueItems = strings.Split(value, ",")
-		}
+func parseSSHConfigTree(root string) ([]sshDirective, []sshConfigFile, error) {
+	rootPath, err := filepath.Abs(root)
+	if err != nil {
+		return nil, nil, err
 	}
-	var newFiles []string
-	for _, line := range oldFiles {
-		lineItem := strings.TrimSpace(line)
-		if (strings.HasPrefix(lineItem, param) || strings.HasPrefix(lineItem, fmt.Sprintf("#%s", param))) && len(valueItems) != 0 {
-			newFiles = append(newFiles, fmt.Sprintf("%s %s", param, valueItems[0]))
-			valueItems = valueItems[1:]
+	var (
+		directives []sshDirective
+		fileList   []sshConfigFile
+		order      int
+		priority   int
+	)
+	visited := make(map[string]bool)
+	if err := parseSSHConfigFile(rootPath, false, visited, &directives, &fileList, &order, &priority); err != nil {
+		return nil, nil, err
+	}
+	return directives, fileList, nil
+}
+
+func parseSSHConfigFile(
+	fileName string,
+	inMatch bool,
+	visited map[string]bool,
+	directives *[]sshDirective,
+	fileList *[]sshConfigFile,
+	order *int,
+	priority *int,
+) error {
+	absolutePath, err := filepath.Abs(fileName)
+	if err != nil {
+		return err
+	}
+	if visited[absolutePath] {
+		return nil
+	}
+	visited[absolutePath] = true
+
+	content, err := os.ReadFile(absolutePath)
+	if err != nil {
+		return err
+	}
+
+	lines := strings.Split(string(content), "\n")
+	currentMatch := inMatch
+	fileRegistered := false
+	for index, rawLine := range lines {
+		line := strings.TrimSpace(rawLine)
+		if line == "" || strings.HasPrefix(line, "#") {
 			continue
 		}
-		if strings.HasPrefix(lineItem, param) && len(valueItems) == 0 {
-			newFiles = append(newFiles, fmt.Sprintf("#%s", line))
+		key, value, ok := parseSSHConfigLine(line)
+		if !ok {
 			continue
 		}
-		newFiles = append(newFiles, line)
+		if strings.EqualFold(key, "Match") {
+			currentMatch = true
+			continue
+		}
+		if strings.EqualFold(key, "Include") {
+			for _, includePath := range expandSSHIncludePaths(absolutePath, value) {
+				if err := parseSSHConfigFile(includePath, currentMatch, visited, directives, fileList, order, priority); err != nil {
+					global.LOG.Warnf("parse ssh include %s failed, err: %v", includePath, err)
+				}
+			}
+			continue
+		}
+		if !fileRegistered {
+			registerSSHConfigFile(absolutePath, fileList, priority)
+			fileRegistered = true
+		}
+		*order++
+		*directives = append(*directives, sshDirective{
+			Key:     key,
+			Value:   normalizeSSHDirectiveValue(key, value),
+			File:    absolutePath,
+			Line:    index,
+			InMatch: currentMatch,
+		})
 	}
-	if len(valueItems) != 0 {
-		for _, item := range valueItems {
-			newFiles = append(newFiles, fmt.Sprintf("%s %s", param, item))
+	if !fileRegistered {
+		registerSSHConfigFile(absolutePath, fileList, priority)
+	}
+	return nil
+}
+
+func registerSSHConfigFile(fileName string, fileList *[]sshConfigFile, priority *int) {
+	for _, item := range *fileList {
+		if item.Path == fileName {
+			return
 		}
 	}
-	return newFiles
+	*priority++
+	*fileList = append(*fileList, sshConfigFile{Path: fileName, Priority: *priority})
+}
+
+func parseSSHConfigLine(line string) (string, string, bool) {
+	line = trimSSHInlineComment(line)
+	fields := strings.Fields(line)
+	if len(fields) < 2 {
+		return "", "", false
+	}
+	return fields[0], strings.Join(fields[1:], " "), true
+}
+
+func trimSSHInlineComment(line string) string {
+	inQuote := false
+	for i := 0; i < len(line); i++ {
+		switch line[i] {
+		case '"':
+			inQuote = !inQuote
+		case '#':
+			if !inQuote && (i == 0 || line[i-1] == ' ' || line[i-1] == '\t') {
+				return strings.TrimSpace(line[:i])
+			}
+		}
+	}
+	return strings.TrimSpace(line)
+}
+
+func expandSSHIncludePaths(baseFile, value string) []string {
+	var includeFiles []string
+	for _, item := range strings.Fields(strings.ReplaceAll(value, "\"", "")) {
+		pattern := item
+		if !filepath.IsAbs(pattern) {
+			pattern = filepath.Join(filepath.Dir(baseFile), pattern)
+		}
+		matches, err := filepath.Glob(pattern)
+		if err != nil {
+			continue
+		}
+		sort.Strings(matches)
+		includeFiles = append(includeFiles, matches...)
+	}
+	return includeFiles
+}
+
+func normalizeSSHDirectiveValue(key, value string) string {
+	if strings.EqualFold(key, "PermitRootLogin") && value == "prohibit-password" {
+		return "without-password"
+	}
+	return value
+}
+
+func loadFirstSSHDirectiveValue(directives []sshDirective, key string) (string, bool) {
+	for _, item := range directives {
+		if item.InMatch || !strings.EqualFold(item.Key, key) {
+			continue
+		}
+		return item.Value, true
+	}
+	return "", false
+}
+
+func loadSSHDirectiveValues(directives []sshDirective, key string) []string {
+	var values []string
+	for _, item := range directives {
+		if item.InMatch || !strings.EqualFold(item.Key, key) {
+			continue
+		}
+		values = append(values, item.Value)
+	}
+	return values
+}
+
+func loadSSHPortValues(directives []sshDirective) []string {
+	values := loadSSHDirectiveValues(directives, "Port")
+	if len(values) == 0 {
+		return []string{defaultSSHPort}
+	}
+	return values
+}
+
+func updateSSHDirectiveValue(key, value string, directives []sshDirective) error {
+	if key == "Port" || key == "ListenAddress" {
+		return rewriteSSHMultiValueDirective(key, value, directives)
+	}
+	return updateSSHSingleDirectiveValue(key, value, directives)
+}
+
+func updateSSHSingleDirectiveValue(key, value string, directives []sshDirective) error {
+	block, err := loadSSHManagedBlockFromFile(sshPath)
+	if err != nil {
+		return err
+	}
+	for _, item := range directives {
+		if item.InMatch || !strings.EqualFold(item.Key, key) {
+			continue
+		}
+		if item.File == sshPath && block.contains(item.Line) {
+			continue
+		}
+		if err := commentSSHConfigLines(item.File, []int{item.Line}); err != nil {
+			return err
+		}
+	}
+	return rewriteSSHManagedDirectives(sshPath, key, []string{fmt.Sprintf("%s %s", key, value)})
+}
+
+func rewriteSSHMultiValueDirective(key, value string, directives []sshDirective) error {
+	block, err := loadSSHManagedBlockFromFile(sshPath)
+	if err != nil {
+		return err
+	}
+	targetFiles := make(map[string][]int)
+	for _, item := range directives {
+		if item.InMatch || !strings.EqualFold(item.Key, key) {
+			continue
+		}
+		if item.File == sshPath && block.contains(item.Line) {
+			continue
+		}
+		targetFiles[item.File] = append(targetFiles[item.File], item.Line)
+	}
+	for fileName, lines := range targetFiles {
+		if err := commentSSHConfigLines(fileName, lines); err != nil {
+			return err
+		}
+	}
+
+	return rewriteSSHManagedDirectives(sshPath, key, buildSSHDirectiveLines(key, value))
+}
+
+func buildSSHDirectiveLines(key, value string) []string {
+	var directives []string
+	for _, item := range strings.Split(value, ",") {
+		if item != "" {
+			directives = append(directives, fmt.Sprintf("%s %s", key, item))
+		}
+	}
+	return directives
+}
+
+func rewriteSSHManagedDirectives(fileName, key string, newDirectives []string) error {
+	content, err := os.ReadFile(fileName)
+	if err != nil {
+		return err
+	}
+	lines := strings.Split(string(content), "\n")
+	lines, insertAt := ensureSSHManagedMarker(lines)
+
+	block, ok := loadSSHManagedBlock(lines)
+	if ok {
+		var filtered []string
+		for index := block.Start; index < block.End; index++ {
+			line := strings.TrimSpace(lines[index])
+			if line == "" || strings.HasPrefix(line, "#") {
+				filtered = append(filtered, lines[index])
+				continue
+			}
+			itemKey, _, ok := parseSSHConfigLine(line)
+			if ok && strings.EqualFold(itemKey, key) {
+				continue
+			}
+			filtered = append(filtered, lines[index])
+		}
+		lines = append(append(lines[:block.Start], filtered...), lines[block.End:]...)
+		insertAt = block.Start
+	}
+
+	if len(newDirectives) != 0 {
+		lines = insertSSHDirectivesAt(lines, insertAt, newDirectives)
+	}
+	return os.WriteFile(fileName, []byte(strings.Join(lines, "\n")), constant.FilePerm)
+}
+
+func commentSSHConfigLines(fileName string, targetLines []int) error {
+	content, err := os.ReadFile(fileName)
+	if err != nil {
+		return err
+	}
+	lines := strings.Split(string(content), "\n")
+	targetSet := make(map[int]struct{}, len(targetLines))
+	for _, line := range targetLines {
+		targetSet[line] = struct{}{}
+	}
+	for index := range lines {
+		if _, ok := targetSet[index]; !ok {
+			continue
+		}
+		trimmed := strings.TrimSpace(lines[index])
+		if trimmed == "" || strings.HasPrefix(trimmed, "#") {
+			continue
+		}
+		lines[index] = "#" + lines[index]
+	}
+	return os.WriteFile(fileName, []byte(strings.Join(lines, "\n")), constant.FilePerm)
+}
+
+func loadSSHInsertIndex(lines []string) int {
+	for index, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		if strings.HasPrefix(strings.ToLower(trimmed), "match ") {
+			return index
+		}
+	}
+	return len(lines)
+}
+
+func ensureSSHManagedMarker(lines []string) ([]string, int) {
+	for index, line := range lines {
+		if strings.TrimSpace(line) == sshManagedMarker {
+			return lines, index + 1
+		}
+	}
+	insertAt := loadSSHInsertIndex(lines)
+	lines = insertSSHDirectivesAt(lines, insertAt, []string{sshManagedMarker})
+	return lines, insertAt + 1
+}
+
+func loadSSHManagedBlock(lines []string) (sshManagedBlock, bool) {
+	for index, line := range lines {
+		if strings.TrimSpace(line) != sshManagedMarker {
+			continue
+		}
+		end := len(lines)
+		for next := index + 1; next < len(lines); next++ {
+			if strings.HasPrefix(strings.ToLower(strings.TrimSpace(lines[next])), "match ") {
+				end = next
+				break
+			}
+		}
+		return sshManagedBlock{Start: index + 1, End: end}, true
+	}
+	return sshManagedBlock{}, false
+}
+
+func loadSSHManagedBlockFromFile(fileName string) (sshManagedBlock, error) {
+	content, err := os.ReadFile(fileName)
+	if err != nil {
+		return sshManagedBlock{}, err
+	}
+	block, ok := loadSSHManagedBlock(strings.Split(string(content), "\n"))
+	if !ok {
+		return sshManagedBlock{}, nil
+	}
+	return block, nil
+}
+
+func insertSSHDirectivesAt(lines []string, insertAt int, directives []string) []string {
+	newLines := make([]string, 0, len(lines)+len(directives))
+	newLines = append(newLines, lines[:insertAt]...)
+	newLines = append(newLines, directives...)
+	newLines = append(newLines, lines[insertAt:]...)
+	return newLines
+}
+
+func isSSHConfigPathAllowed(fileName string) bool {
+	if fileName == "" {
+		return false
+	}
+	absolutePath, err := filepath.Abs(fileName)
+	if err != nil {
+		return false
+	}
+	if absolutePath == sshPath {
+		return true
+	}
+	_, fileList, err := parseSSHConfigTree(sshPath)
+	if err != nil {
+		return false
+	}
+	for _, item := range fileList {
+		if item.Path == absolutePath {
+			return true
+		}
+	}
+	return false
 }
 
 func loadSSHData(ctx *gin.Context, command string, showCountFrom, showCountTo, currentYear int, nyc *time.Location) ([]dto.SSHHistory, int, int) {
@@ -768,7 +1250,8 @@ func checkIsStandard(item dto.SSHHistory) bool {
 }
 
 func handleGunzip(path string) error {
-	if err := cmd.RunDefaultBashCf("gunzip %s", path); err != nil {
+	cmdMgr := cmd.NewCommandMgr()
+	if err := cmdMgr.Run("gunzip", path); err != nil {
 		return err
 	}
 	return nil

agent/app/service/website.go

@@ -110,6 +110,7 @@ type IWebsiteService interface {
 	GetProxyCache(id uint) (res response.NginxProxyCache, err error)
 	ClearProxyCache(req request.NginxCommonReq) error
 	DeleteProxy(req request.WebsiteProxyDel) (err error)
+	UpdateProxyStatus(req request.WebsiteProxyStatusUpdate) (err error)
 
 	CreateWebsiteDomain(create request.WebsiteDomainCreate) ([]model.WebsiteDomain, error)
 	GetWebsiteDomain(websiteId uint) ([]model.WebsiteDomain, error)
@@ -173,11 +174,10 @@ func (w WebsiteService) PageWebsite(req request.WebsiteSearch) (int64, []respons
 		switch web.Type {
 		case constant.Deployment:
 			appInstall, err := appInstallRepo.GetFirst(repo.WithByID(web.AppInstallID))
-			if err != nil {
-				return 0, nil, err
+			if err == nil {
+				appName = appInstall.Name
+				appInstallID = appInstall.ID
 			}
-			appName = appInstall.Name
-			appInstallID = appInstall.ID
 		case constant.Runtime:
 			runtime, _ := runtimeRepo.GetFirst(context.Background(), repo.WithByID(web.RuntimeID))
 			if runtime != nil {
@@ -389,7 +389,10 @@ func (w WebsiteService) CreateWebsite(create request.WebsiteCreate) (err error)
 			}
 			appInstall = install
 			website.AppInstallID = install.ID
-			website.Proxy = fmt.Sprintf("127.0.0.1:%d", appInstall.HttpPort)
+			website.Proxy, err = getAppInstallProxyPass(appInstall)
+			if err != nil {
+				return err
+			}
 		} else {
 			var install model.AppInstall
 			install, err = appInstallRepo.GetFirst(repo.WithByID(create.AppInstallID))
@@ -399,7 +402,10 @@ func (w WebsiteService) CreateWebsite(create request.WebsiteCreate) (err error)
 			configApp := func(t *task.Task) error {
 				appInstall = &install
 				website.AppInstallID = appInstall.ID
-				website.Proxy = fmt.Sprintf("127.0.0.1:%d", appInstall.HttpPort)
+				website.Proxy, err = getAppInstallProxyPass(appInstall)
+				if err != nil {
+					return err
+				}
 				return nil
 			}
 			createTask.AddSubTask(i18n.GetMsgByKey("ConfigApp"), configApp, nil)
@@ -532,7 +538,13 @@ func (w WebsiteService) CreateWebsite(create request.WebsiteCreate) (err error)
 		createTask.AddSubTaskWithIgnoreErr(i18n.GetWithName("ConfigFTP", create.FtpUser), createFtpUser)
 	}
 
-	return createTask.Execute()
+	if err := createTask.Execute(); err != nil {
+		return err
+	}
+	if err := bindDeploymentWebsiteToAgentByAppInstall(website); err != nil {
+		global.LOG.Errorf("bind deployment website to agent failed: %v", err)
+	}
+	return nil
 }
 
 func (w WebsiteService) OpWebsite(req request.WebsiteOp) error {
@@ -727,6 +739,9 @@ func (w WebsiteService) DeleteWebsite(req request.WebsiteDelete) error {
 	if err := websiteRepo.DeleteBy(ctx, repo.WithByID(req.ID)); err != nil {
 		return err
 	}
+	if err := agentRepo.ClearWebsiteIDByWebsiteIDWithCtx(ctx, req.ID); err != nil {
+		return err
+	}
 	if err := websiteDomainRepo.DeleteBy(ctx, websiteDomainRepo.WithWebsiteId(req.ID)); err != nil {
 		return err
 	}
@@ -1325,7 +1340,7 @@ func (w WebsiteService) UpdateSitePermission(req request.WebsiteUpdateDirPermiss
 	}
 	absoluteIndexPath := GetSitePath(website, SiteIndexDir)
 	cmdMgr := cmd.NewCommandMgr(cmd.WithTimeout(10 * time.Second))
-	if err := cmdMgr.RunBashCf("%s chown -R %s:%s %s", cmd.SudoHandleCmd(), req.User, req.Group, absoluteIndexPath); err != nil {
+	if err := cmdMgr.Run("chown", "-R", fmt.Sprintf("%s:%s", req.User, req.Group), absoluteIndexPath); err != nil {
 		return err
 	}
 	website.User = req.User
@@ -1488,23 +1503,11 @@ func (w WebsiteService) UpdateAntiLeech(req request.NginxAntiLeechUpdate) (err e
 			newBlock.AppendDirectives(ifDir)
 		}
 		if website.Type == constant.Deployment {
-			newBlock.AppendDirectives(
-				&components.Directive{
-					Name:       "proxy_set_header",
-					Parameters: []string{"Host", "$host"},
-				},
-				&components.Directive{
-					Name:       "proxy_set_header",
-					Parameters: []string{"X-Real-IP", "$remote_addr"},
-				},
-				&components.Directive{
-					Name:       "proxy_set_header",
-					Parameters: []string{"X-Forwarded-For", "$proxy_add_x_forwarded_for"},
-				},
-				&components.Directive{
-					Name:       "proxy_pass",
-					Parameters: []string{fmt.Sprintf("http://%s", website.Proxy)},
-				})
+			proxyDirectives := getRootProxyDirectives(website.Proxy)
+			if len(proxyDirectives) == 0 {
+				return errors.New("failed to build deployment proxy directives")
+			}
+			newBlock.AppendDirectives(proxyDirectives...)
 		}
 		newDirective.Block = newBlock
 		index := -1
@@ -1750,7 +1753,7 @@ func (w WebsiteService) OperateRedirect(req request.NginxRedirectReq) (err error
 		return buserr.WithErr("ErrUpdateBuWebsite", err)
 	}
 
-	nginxInclude := fmt.Sprintf("/www/sites/%s/redirect/*.conf", website.Alias)
+	nginxInclude := getWebsiteRedirectInclude(website)
 	if err = updateNginxConfig(constant.NginxScopeServer, []dto.NginxParam{{Name: "include", Params: []string{nginxInclude}}}, &website); err != nil {
 		return
 	}
@@ -1906,6 +1909,10 @@ func (w WebsiteService) UpdateRedirectFile(req request.NginxRedirectUpdate) (err
 	if err != nil {
 		return err
 	}
+	safeName := path.Base(req.Name)
+	if safeName != req.Name || strings.Contains(safeName, "..") {
+		return buserr.New("ErrInvalidParams")
+	}
 	absolutePath := path.Join(GetSitePath(website, SiteRedirectDir), req.Name+".conf")
 	fileOp := files.NewFileOp()
 	oldRewriteContent, err = fileOp.GetContent(absolutePath)
@@ -2324,6 +2331,7 @@ func (w WebsiteService) ExecComposer(req request.ExecComposerReq) error {
 	} else {
 		command = req.ExtCommand
 	}
+	command = strings.TrimSpace(command)
 	resourceName := fmt.Sprintf("composer %s", command)
 	composerTask, err := task.NewTaskWithOps(resourceName, task.TaskExec, req.Command, req.TaskID, website.ID)
 	if err != nil {
@@ -2333,9 +2341,25 @@ func (w WebsiteService) ExecComposer(req request.ExecComposerReq) error {
 	siteDir, _ := settingRepo.Get(settingRepo.WithByKey("WEBSITE_DIR"))
 	execDir := strings.ReplaceAll(req.Dir, siteDir.Value, "/www")
 	composerTask.AddSubTask("", func(t *task.Task) error {
-		cmdStr := fmt.Sprintf("docker exec -u %s %s sh -c 'composer config -g repo.packagist composer %s && composer %s --working-dir=%s'", req.User, runtime.ContainerName, req.Mirror, command, execDir)
-		err = cmdMgr.RunBashC(cmdStr)
-		if err != nil {
+		if err := cmdMgr.Run("docker", "exec",
+			"-u", req.User,
+			runtime.ContainerName,
+			"composer",
+			"config", "-g",
+			"repo.packagist",
+			"composer",
+			req.Mirror,
+		); err != nil {
+			return err
+		}
+
+		if err := cmdMgr.Run("docker", "exec",
+			"-u", req.User,
+			runtime.ContainerName,
+			"composer",
+			command,
+			"--working-dir="+execDir,
+		); err != nil {
 			return err
 		}
 		return nil

agent/app/service/website_auth_basic.go

@@ -3,6 +3,10 @@ package service
 import (
 	"bufio"
 	"fmt"
+	"os"
+	"path"
+	"strings"
+
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/response"
@@ -16,9 +20,6 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/utils/nginx/components"
 	"github.com/1Panel-dev/1Panel/agent/utils/nginx/parser"
 	"golang.org/x/crypto/bcrypt"
-	"os"
-	"path"
-	"strings"
 )
 
 func (w WebsiteService) GetAuthBasics(req request.NginxAuthReq) (res response.NginxAuthRes, err error) {
@@ -260,6 +261,10 @@ func (w WebsiteService) UpdatePathAuthBasic(req request.NginxPathAuthUpdate) err
 	if !fileOp.Stat(passDir) {
 		_ = fileOp.CreateDir(passDir, constant.DirPerm)
 	}
+	safeName := path.Base(req.Name)
+	if safeName != req.Name || strings.Contains(safeName, "..") {
+		return buserr.New("ErrInvalidParams")
+	}
 	confPath := path.Join(authDir, fmt.Sprintf("%s.conf", req.Name))
 	passPath := path.Join(passDir, fmt.Sprintf("%s.pass", req.Name))
 	var config *components.Config
@@ -306,7 +311,7 @@ func (w WebsiteService) UpdatePathAuthBasic(req request.NginxPathAuthUpdate) err
 	}
 	nginxInclude := fmt.Sprintf("/www/sites/%s/path_auth/*.conf", website.Alias)
 	if err = updateNginxConfig(constant.NginxScopeServer, []dto.NginxParam{{Name: "include", Params: []string{nginxInclude}}}, &website); err != nil {
-		return nil
+		return err
 	}
 	return nil
 }

agent/app/service/website_lb.go

@@ -3,6 +3,10 @@ package service
 import (
 	"bytes"
 	"fmt"
+	"os"
+	"path"
+	"strings"
+
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
 	"github.com/1Panel-dev/1Panel/agent/app/repo"
@@ -13,9 +17,6 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/utils/nginx"
 	"github.com/1Panel-dev/1Panel/agent/utils/nginx/components"
 	"github.com/1Panel-dev/1Panel/agent/utils/nginx/parser"
-	"os"
-	"path"
-	"strings"
 )
 
 func (w WebsiteService) GetLoadBalances(id uint) ([]dto.NginxUpstream, error) {
@@ -87,6 +88,10 @@ func (w WebsiteService) CreateLoadBalance(req request.WebsiteLBCreate) error {
 	if !fileOp.Stat(includeDir) {
 		_ = fileOp.CreateDir(includeDir, constant.DirPerm)
 	}
+	safeName := path.Base(req.Name)
+	if safeName != req.Name || strings.Contains(safeName, "..") {
+		return buserr.New("ErrInvalidParams")
+	}
 	filePath := path.Join(includeDir, fmt.Sprintf("%s.conf", req.Name))
 	if fileOp.Stat(filePath) {
 		return buserr.New("ErrNameIsExist")
@@ -133,6 +138,10 @@ func (w WebsiteService) UpdateLoadBalance(req request.WebsiteLBUpdate) error {
 	}
 	includeDir := GetSitePath(website, SiteUpstreamDir)
 	fileOp := files.NewFileOp()
+	safeName := path.Base(req.Name)
+	if safeName != req.Name || strings.Contains(safeName, "..") {
+		return buserr.New("ErrInvalidParams")
+	}
 	filePath := path.Join(includeDir, fmt.Sprintf("%s.conf", req.Name))
 	if !fileOp.Stat(filePath) {
 		return nil
@@ -191,6 +200,10 @@ func (w WebsiteService) DeleteLoadBalance(req request.WebsiteLBDelete) error {
 
 	includeDir := GetSitePath(website, SiteUpstreamDir)
 	fileOp := files.NewFileOp()
+	safeName := path.Base(req.Name)
+	if safeName != req.Name || strings.Contains(safeName, "..") {
+		return buserr.New("ErrInvalidParams")
+	}
 	filePath := path.Join(includeDir, fmt.Sprintf("%s.conf", req.Name))
 	if !fileOp.Stat(filePath) {
 		return nil
@@ -211,6 +224,10 @@ func (w WebsiteService) UpdateLoadBalanceFile(req request.WebsiteLBUpdateFile) e
 		return err
 	}
 	includeDir := GetSitePath(website, SiteUpstreamDir)
+	safeName := path.Base(req.Name)
+	if safeName != req.Name || strings.Contains(safeName, "..") {
+		return buserr.New("ErrInvalidParams")
+	}
 	filePath := path.Join(includeDir, fmt.Sprintf("%s.conf", req.Name))
 	fileOp := files.NewFileOp()
 	oldContent, err := fileOp.GetContent(filePath)

agent/app/service/website_proxy.go

@@ -24,6 +24,21 @@ import (
 )
 
 func (w WebsiteService) OperateProxy(req request.WebsiteProxyConfig) (err error) {
+	switch req.Operate {
+	case "delete":
+		return w.DeleteProxy(request.WebsiteProxyDel{
+			ID:   req.ID,
+			Name: req.Name,
+		})
+	case "disable":
+		fallthrough
+	case "enable":
+		return w.UpdateProxyStatus(request.WebsiteProxyStatusUpdate{
+			ID:     req.ID,
+			Name:   req.Name,
+			Status: req.Operate,
+		})
+	}
 	var (
 		website    model.Website
 		par        *parser.Parser
@@ -81,16 +96,8 @@ func (w WebsiteService) OperateProxy(req request.WebsiteProxyConfig) (err error)
 		if err != nil {
 			return
 		}
-	case "delete":
-		_ = fileOp.DeleteFile(includePath)
-		_ = fileOp.DeleteFile(backPath)
-		return updateNginxConfig(constant.NginxScopeServer, nil, &website)
-	case "disable":
-		_ = fileOp.Rename(includePath, backPath)
-		return updateNginxConfig(constant.NginxScopeServer, nil, &website)
-	case "enable":
-		_ = fileOp.Rename(backPath, includePath)
-		return updateNginxConfig(constant.NginxScopeServer, nil, &website)
+	default:
+		return errors.New("unknown operate")
 	}
 
 	config.FilePath = includePath
@@ -107,7 +114,14 @@ func (w WebsiteService) OperateProxy(req request.WebsiteProxyConfig) (err error)
 		err = errors.New("invalid proxy config, no location found")
 		return
 	}
-	location.UpdateDirective("proxy_pass", []string{req.ProxyPass})
+	applyLocationProxyPass(location, req.ProxyPass, &req.SNI, req.ProxySSLName)
+	if isHTTPSProxyPass(req.ProxyPass) && req.SSLVerify {
+		location.UpdateDirective("proxy_ssl_verify", []string{"on"})
+		location.UpdateDirective("proxy_ssl_trusted_certificate", []string{"/etc/ssl/certs/ca-certificates.crt"})
+	} else {
+		location.RemoveDirective("proxy_ssl_verify", []string{})
+		location.RemoveDirective("proxy_ssl_trusted_certificate", []string{})
+	}
 	location.UpdateDirective("proxy_set_header", []string{"Host", req.ProxyHost})
 	location.ChangePath(req.Modifier, req.Match)
 	// Server Cache Settings
@@ -136,15 +150,7 @@ func (w WebsiteService) OperateProxy(req request.WebsiteProxyConfig) (err error)
 	} else {
 		location.RemoveSubFilter()
 	}
-	// SSL Settings
-	if req.SNI {
-		location.UpdateDirective("proxy_ssl_server_name", []string{"on"})
-		if req.ProxySSLName != "" {
-			location.UpdateDirective("proxy_ssl_name", []string{req.ProxySSLName})
-		}
-	} else {
-		location.UpdateDirective("proxy_ssl_server_name", []string{"off"})
-	}
+	// Explicit SNI configuration still takes precedence over the automatic HTTPS upstream default.
 	// CORS Settings
 	if req.Cors {
 		location.UpdateDirective("add_header", []string{"Access-Control-Allow-Origin", req.AllowOrigins, "always"})
@@ -330,6 +336,9 @@ func (w WebsiteService) GetProxies(id uint) (res []request.WebsiteProxyConfig, e
 			if directive.GetName() == "proxy_ssl_name" && len(directive.GetParameters()) > 0 {
 				proxyConfig.ProxySSLName = directive.GetParameters()[0]
 			}
+			if directive.GetName() == "proxy_ssl_verify" {
+				proxyConfig.SSLVerify = len(directive.GetParameters()) > 0 && directive.GetParameters()[0] == "on"
+			}
 		}
 		proxyConfig.Cors = location.Cors
 		proxyConfig.AllowCredentials = location.AllowCredentials
@@ -391,24 +400,47 @@ func (w WebsiteService) ClearProxyCache(req request.NginxCommonReq) error {
 }
 
 func (w WebsiteService) DeleteProxy(req request.WebsiteProxyDel) (err error) {
-	fileOp := files.NewFileOp()
 	website, err := websiteRepo.GetFirst(repo.WithByID(req.ID))
 	if err != nil {
 		return
 	}
-	nginxInstall, err := getAppInstallByKey(constant.AppOpenresty)
-	if err != nil {
-		return
-	}
-	includeDir := path.Join(nginxInstall.GetPath(), "www", "sites", website.Alias, "proxy")
+	includeDir := GetSitePath(website, SiteProxyDir)
+	fileOp := files.NewFileOp()
 	if !fileOp.Stat(includeDir) {
-		_ = fileOp.CreateDir(includeDir, 0755)
+		return
 	}
 	fileName := fmt.Sprintf("%s.conf", req.Name)
 	includePath := path.Join(includeDir, fileName)
 	backName := fmt.Sprintf("%s.bak", req.Name)
 	backPath := path.Join(includeDir, backName)
+
 	_ = fileOp.DeleteFile(includePath)
 	_ = fileOp.DeleteFile(backPath)
 	return updateNginxConfig(constant.NginxScopeServer, nil, &website)
 }
+
+func (w WebsiteService) UpdateProxyStatus(req request.WebsiteProxyStatusUpdate) (err error) {
+	website, err := websiteRepo.GetFirst(repo.WithByID(req.ID))
+	if err != nil {
+		return
+	}
+	includeDir := GetSitePath(website, SiteProxyDir)
+	fileOp := files.NewFileOp()
+	if !fileOp.Stat(includeDir) {
+		return
+	}
+	fileName := fmt.Sprintf("%s.conf", req.Name)
+	includePath := path.Join(includeDir, fileName)
+	backName := fmt.Sprintf("%s.bak", req.Name)
+	backPath := path.Join(includeDir, backName)
+
+	switch req.Status {
+	case "disable":
+		_ = fileOp.Rename(includePath, backPath)
+		return updateNginxConfig(constant.NginxScopeServer, nil, &website)
+	case "enable":
+		_ = fileOp.Rename(backPath, includePath)
+		return updateNginxConfig(constant.NginxScopeServer, nil, &website)
+	}
+	return errors.New("unknown status")
+}

agent/app/service/website_rewrite.go

@@ -4,6 +4,10 @@ import (
 	"bytes"
 	"context"
 	"fmt"
+	"os"
+	"path"
+	"strings"
+
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/response"
@@ -12,9 +16,6 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/cmd/server/nginx_conf"
 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/utils/files"
-	"os"
-	"path"
-	"strings"
 )
 
 func (w WebsiteService) UpdateRewriteConfig(req request.NginxRewriteUpdate) error {
@@ -73,6 +74,10 @@ func (w WebsiteService) GetRewriteConfig(req request.NginxRewriteReq) (*response
 		contentByte, _ = nginx_conf.Rewrites.ReadFile(rewriteFile)
 		if contentByte == nil {
 			customRewriteDir := GetOpenrestyDir(DefaultRewriteDir)
+			safeName := path.Base(req.Name)
+			if safeName != req.Name || strings.Contains(safeName, "..") {
+				return nil, buserr.New("ErrInvalidParams")
+			}
 			customRewriteFile := path.Join(customRewriteDir, fmt.Sprintf("%s.conf", strings.ToLower(req.Name)))
 			contentByte, err = files.NewFileOp().GetContent(customRewriteFile)
 		}
@@ -90,6 +95,10 @@ func (w WebsiteService) OperateCustomRewrite(req request.CustomRewriteOperate) e
 			return err
 		}
 	}
+	safeName := path.Base(req.Name)
+	if safeName != req.Name || strings.Contains(safeName, "..") {
+		return buserr.New("ErrInvalidParams")
+	}
 	rewriteFile := path.Join(rewriteDir, fmt.Sprintf("%s.conf", req.Name))
 	switch req.Operate {
 	case "create":

agent/app/service/website_ssl.go

@@ -5,8 +5,7 @@ import (
 	"crypto/x509"
 	"encoding/pem"
 	"fmt"
-	"github.com/1Panel-dev/1Panel/agent/utils/xpack"
-	"github.com/go-acme/lego/v4/certificate"
+	"io"
 	"log"
 	"os"
 	"path"
@@ -14,6 +13,10 @@ import (
 	"strings"
 	"time"
 
+	"github.com/go-acme/lego/v4/certificate"
+	legoLogger "github.com/go-acme/lego/v4/log"
+	"github.com/jinzhu/gorm"
+
 	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/response"
 	"github.com/1Panel-dev/1Panel/agent/app/model"
@@ -27,8 +30,7 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/utils/files"
 	"github.com/1Panel-dev/1Panel/agent/utils/req_helper"
 	"github.com/1Panel-dev/1Panel/agent/utils/ssl"
-	legoLogger "github.com/go-acme/lego/v4/log"
-	"github.com/jinzhu/gorm"
+	"github.com/1Panel-dev/1Panel/agent/utils/xpack"
 )
 
 type WebsiteSSLService struct {
@@ -45,6 +47,7 @@ type IWebsiteSSLService interface {
 	Update(update request.WebsiteSSLUpdate) error
 	Upload(req request.WebsiteSSLUpload) error
 	ObtainSSL(apply request.WebsiteSSLApply) error
+	AutoRenewSSL(id uint) error
 	SyncForRestart() error
 	DownloadFile(id uint) (*os.File, error)
 	ImportMasterSSL(create model.WebsiteSSL) error
@@ -210,13 +213,35 @@ func (w WebsiteSSLService) Create(create request.WebsiteSSLCreate) (request.Webs
 	return create, nil
 }
 
-func printSSLLog(logger *log.Logger, msgKey string, params map[string]interface{}, disableLog bool) {
-	if disableLog {
+func printSSLLog(logger *log.Logger, msgKey string, params map[string]interface{}) {
+	if logger == nil {
 		return
 	}
 	logger.Println(i18n.GetMsgWithMap(msgKey, params))
 }
 
+func newWebsiteSSLLogger(websiteSSL *model.WebsiteSSL, autoRenew bool) (*os.File, *log.Logger) {
+	flags := os.O_CREATE | os.O_WRONLY | os.O_TRUNC
+	if autoRenew {
+		flags = os.O_CREATE | os.O_WRONLY | os.O_APPEND
+	}
+
+	logFile, err := os.OpenFile(websiteSSL.GetLogPath(), flags, constant.FilePerm)
+	if err != nil {
+		global.LOG.Errorf("open ssl log file failed, domain: %s, err: %v", websiteSSL.PrimaryDomain, err)
+		return nil, log.New(io.Discard, "", log.LstdFlags)
+	}
+
+	if autoRenew {
+		if info, statErr := logFile.Stat(); statErr == nil && info.Size() > 0 {
+			_, _ = logFile.WriteString("\n")
+		}
+		_, _ = logFile.WriteString(fmt.Sprintf("========== [%s] auto renew attempt ==========\n", time.Now().Format(constant.DateTimeLayout)))
+	}
+
+	return logFile, log.New(logFile, "", log.LstdFlags)
+}
+
 func reloadSystemSSL(websiteSSL *model.WebsiteSSL, logger *log.Logger) {
 	if !global.IsMaster {
 		return
@@ -226,7 +251,7 @@ func reloadSystemSSL(websiteSSL *model.WebsiteSSL, logger *log.Logger) {
 		fileOp := files.NewFileOp()
 		certPath := path.Join(global.Dir.DataDir, "secret/server.crt")
 		keyPath := path.Join(global.Dir.DataDir, "secret/server.key")
-		printSSLLog(logger, "StartUpdateSystemSSL", nil, logger == nil)
+		printSSLLog(logger, "StartUpdateSystemSSL", nil)
 		if err := fileOp.WriteFile(certPath, strings.NewReader(websiteSSL.Pem), 0600); err != nil {
 			logger.Printf("Failed to update the SSL certificate File for 1Panel System domain [%s] , err:%s", websiteSSL.PrimaryDomain, err.Error())
 			return
@@ -239,11 +264,19 @@ func reloadSystemSSL(websiteSSL *model.WebsiteSSL, logger *log.Logger) {
 			logger.Printf("Failed to update the SSL certificate for 1Panel System domain [%s] , err:%s", websiteSSL.PrimaryDomain, err.Error())
 			return
 		}
-		printSSLLog(logger, "UpdateSystemSSLSuccess", nil, logger == nil)
+		printSSLLog(logger, "UpdateSystemSSLSuccess", nil)
 	}
 }
 
 func (w WebsiteSSLService) ObtainSSL(apply request.WebsiteSSLApply) error {
+	return w.obtainSSL(apply.ID, false)
+}
+
+func (w WebsiteSSLService) AutoRenewSSL(id uint) error {
+	return w.obtainSSL(id, true)
+}
+
+func (w WebsiteSSLService) obtainSSL(id uint, autoRenew bool) error {
 	var (
 		err          error
 		websiteSSL   *model.WebsiteSSL
@@ -254,7 +287,7 @@ func (w WebsiteSSLService) ObtainSSL(apply request.WebsiteSSLApply) error {
 		resource     certificate.Resource
 	)
 
-	websiteSSL, err = websiteSSLRepo.GetFirst(repo.WithByID(apply.ID))
+	websiteSSL, err = websiteSSLRepo.GetFirst(repo.WithByID(id))
 	if err != nil {
 		return err
 	}
@@ -306,17 +339,16 @@ func (w WebsiteSSLService) ObtainSSL(apply request.WebsiteSSLApply) error {
 	}
 
 	go func() {
-		logFile, _ := os.OpenFile(path.Join(global.Dir.SSLLogDir, fmt.Sprintf("%s-ssl-%d.log", websiteSSL.PrimaryDomain, websiteSSL.ID)), os.O_CREATE|os.O_WRONLY|os.O_TRUNC, constant.FilePerm)
-		defer logFile.Close()
-		logger := log.New(logFile, "", log.LstdFlags)
-		legoLogger.Logger = logger
-		if !apply.DisableLog {
-			startMsg := i18n.GetMsgWithMap("ApplySSLStart", map[string]interface{}{"domain": strings.Join(domains, ","), "type": i18n.GetMsgByKey(websiteSSL.Provider)})
-			if websiteSSL.Provider == constant.DNSAccount {
-				startMsg = startMsg + i18n.GetMsgWithMap("DNSAccountName", map[string]interface{}{"name": dnsAccount.Name, "type": dnsAccount.Type})
-			}
-			logger.Println(startMsg)
+		logFile, logger := newWebsiteSSLLogger(websiteSSL, autoRenew)
+		if logFile != nil {
+			defer logFile.Close()
 		}
+		legoLogger.Logger = logger
+		startMsg := i18n.GetMsgWithMap("ApplySSLStart", map[string]interface{}{"domain": strings.Join(domains, ","), "type": i18n.GetMsgByKey(websiteSSL.Provider)})
+		if websiteSSL.Provider == constant.DNSAccount {
+			startMsg = startMsg + i18n.GetMsgWithMap("DNSAccountName", map[string]interface{}{"name": dnsAccount.Name, "type": dnsAccount.Type})
+		}
+		logger.Println(startMsg)
 		if websiteSSL.Provider != constant.DnsManual {
 			privateKey, err := ssl.GetPrivateKeyByType(websiteSSL.KeyType, websiteSSL.PrivateKey)
 			if err != nil {
@@ -361,7 +393,7 @@ func (w WebsiteSSLService) ObtainSSL(apply request.WebsiteSSLApply) error {
 			websiteSSL.Organization = cert.Issuer.Organization[0]
 		}
 		websiteSSL.Status = constant.SSLReady
-		printSSLLog(logger, "ApplySSLSuccess", map[string]interface{}{"domain": strings.Join(domains, ",")}, apply.DisableLog)
+		printSSLLog(logger, "ApplySSLSuccess", map[string]interface{}{"domain": strings.Join(domains, ",")})
 		saveCertificateFile(websiteSSL, logger)
 
 		if websiteSSL.ExecShell {
@@ -369,12 +401,12 @@ func (w WebsiteSSLService) ObtainSSL(apply request.WebsiteSSLApply) error {
 			if websiteSSL.PushDir {
 				workDir = websiteSSL.Dir
 			}
-			printSSLLog(logger, "ExecShellStart", nil, apply.DisableLog)
+			printSSLLog(logger, "ExecShellStart", nil)
 			cmdMgr := cmd.NewCommandMgr(cmd.WithTimeout(30*time.Minute), cmd.WithLogger(logger), cmd.WithWorkDir(workDir))
 			if err = cmdMgr.RunBashC(websiteSSL.Shell); err != nil {
-				printSSLLog(logger, "ErrExecShell", map[string]interface{}{"err": err.Error()}, apply.DisableLog)
+				printSSLLog(logger, "ErrExecShell", map[string]interface{}{"err": err.Error()})
 			} else {
-				printSSLLog(logger, "ExecShellSuccess", nil, apply.DisableLog)
+				printSSLLog(logger, "ExecShellSuccess", nil)
 			}
 		}
 
@@ -386,9 +418,9 @@ func (w WebsiteSSLService) ObtainSSL(apply request.WebsiteSSLApply) error {
 		websites, _ := websiteRepo.GetBy(websiteRepo.WithWebsiteSSLID(websiteSSL.ID))
 		if len(websites) > 0 {
 			for _, website := range websites {
-				printSSLLog(logger, "ApplyWebSiteSSLLog", map[string]interface{}{"name": website.PrimaryDomain}, apply.DisableLog)
+				printSSLLog(logger, "ApplyWebSiteSSLLog", map[string]interface{}{"name": website.PrimaryDomain})
 				if err := createPemFile(website, *websiteSSL); err != nil {
-					printSSLLog(logger, "ErrUpdateWebsiteSSL", map[string]interface{}{"name": website.PrimaryDomain, "err": err.Error()}, apply.DisableLog)
+					printSSLLog(logger, "ErrUpdateWebsiteSSL", map[string]interface{}{"name": website.PrimaryDomain, "err": err.Error()})
 				}
 			}
 			nginxInstall, err := getAppInstallByKey(constant.AppOpenresty)
@@ -396,19 +428,19 @@ func (w WebsiteSSLService) ObtainSSL(apply request.WebsiteSSLApply) error {
 				return
 			}
 			if err := opNginx(nginxInstall.ContainerName, constant.NginxReload); err != nil {
-				printSSLLog(logger, "ErrSSLApply", nil, apply.DisableLog)
+				printSSLLog(logger, "ErrSSLApply", nil)
 				return
 			}
-			printSSLLog(logger, "ApplyWebSiteSSLSuccess", nil, apply.DisableLog)
+			printSSLLog(logger, "ApplyWebSiteSSLSuccess", nil)
 		}
 		reloadSystemSSL(websiteSSL, logger)
 		if websiteSSL.PushNode {
-			printSSLLog(logger, "StartPushSSLToNode", nil, apply.DisableLog)
+			printSSLLog(logger, "StartPushSSLToNode", nil)
 			if err = xpack.PushSSLToNode(websiteSSL); err != nil {
-				printSSLLog(logger, "PushSSLToNodeFailed", map[string]interface{}{"err": err.Error()}, apply.DisableLog)
+				printSSLLog(logger, "PushSSLToNodeFailed", map[string]interface{}{"err": err.Error()})
 				return
 			}
-			printSSLLog(logger, "PushSSLToNodeSuccess", nil, apply.DisableLog)
+			printSSLLog(logger, "PushSSLToNodeSuccess", nil)
 		}
 	}()
 

agent/app/service/website_utils.go

@@ -47,6 +47,82 @@ func handleChineseDomain(domain string) (string, error) {
 	return domain, nil
 }
 
+func isHTTPSProxyPass(proxyPass string) bool {
+	return strings.HasPrefix(strings.ToLower(strings.TrimSpace(proxyPass)), "https://")
+}
+
+func normalizeProxyPass(proxyPass string) string {
+	proxyPass = strings.TrimSpace(proxyPass)
+	if proxyPass == "" {
+		return ""
+	}
+	if strings.Contains(proxyPass, "://") || strings.HasPrefix(proxyPass, "unix:") {
+		return proxyPass
+	}
+	return fmt.Sprintf("http://%s", proxyPass)
+}
+
+func getAppInstallProxyPass(appInstall *model.AppInstall) (string, error) {
+	if appInstall == nil {
+		return "", errors.New("app install is nil")
+	}
+	if appInstall.HttpPort > 0 {
+		return fmt.Sprintf("http://127.0.0.1:%d", appInstall.HttpPort), nil
+	}
+	if appInstall.HttpsPort > 0 {
+		return fmt.Sprintf("https://127.0.0.1:%d", appInstall.HttpsPort), nil
+	}
+	return "", fmt.Errorf("app %s has no available http or https port", appInstall.Name)
+}
+
+func getAppInstallProxyPassOrEmpty(appInstall *model.AppInstall) string {
+	proxyPass, err := getAppInstallProxyPass(appInstall)
+	if err != nil {
+		return ""
+	}
+	return proxyPass
+}
+
+func hasAppInstallProxyPassChanged(before *model.AppInstall, after *model.AppInstall) bool {
+	return getAppInstallProxyPassOrEmpty(before) != getAppInstallProxyPassOrEmpty(after)
+}
+
+func getRootProxyDirectives(proxyPass string) []components.IDirective {
+	server := &components.Server{}
+	server.UpdateRootProxy([]string{normalizeProxyPass(proxyPass)})
+
+	locations := server.FindDirectives("location")
+	if len(locations) == 0 || locations[0].GetBlock() == nil {
+		return nil
+	}
+
+	return append([]components.IDirective(nil), locations[0].GetBlock().GetDirectives()...)
+}
+
+func getWebsiteRedirectInclude(website model.Website) string {
+	return fmt.Sprintf("/www/sites/%s/redirect/*.conf", website.Alias)
+}
+
+func applyLocationProxyPass(location *components.Location, proxyPass string, sni *bool, proxySSLName string) {
+	location.UpdateDirective("proxy_pass", []string{proxyPass})
+
+	enableSNI := isHTTPSProxyPass(proxyPass)
+	if sni != nil {
+		enableSNI = enableSNI && *sni
+	}
+	if enableSNI {
+		location.UpdateDirective("proxy_ssl_server_name", []string{"on"})
+	} else {
+		location.UpdateDirective("proxy_ssl_server_name", []string{"off"})
+	}
+
+	sslName := "$proxy_host"
+	if proxySSLName != "" {
+		sslName = proxySSLName
+	}
+	location.UpdateDirective("proxy_ssl_name", []string{sslName})
+}
+
 func createIndexFile(website *model.Website, runtime *model.Runtime) error {
 	var (
 		indexPath      string
@@ -122,7 +198,7 @@ func createProxyFile(website *model.Website) error {
 		return errors.New("error")
 	}
 	location.ChangePath("^~", "/")
-	location.UpdateDirective("proxy_pass", []string{website.Proxy})
+	applyLocationProxyPass(location, website.Proxy, nil, "")
 	location.UpdateDirective("proxy_set_header", []string{"Host", "$host"})
 	if err := nginx.WriteConfig(config, nginx.IndentedStyle); err != nil {
 		return buserr.WithErr("ErrUpdateBuWebsite", err)
@@ -257,7 +333,10 @@ func configDefaultNginx(website *model.Website, domains []model.WebsiteDomain, a
 		rootIndex := path.Join("/www/sites", website.Alias, "index")
 		switch website.Type {
 		case constant.Deployment:
-			proxy := fmt.Sprintf("http://127.0.0.1:%d", appInstall.HttpPort)
+			proxy, err := getAppInstallProxyPass(appInstall)
+			if err != nil {
+				return err
+			}
 			server.UpdateRootProxy([]string{proxy})
 		case constant.Static:
 			server.UpdateRoot(rootIndex)
@@ -279,7 +358,7 @@ func configDefaultNginx(website *model.Website, domains []model.WebsiteDomain, a
 					server.UpdatePHPProxy([]string{website.Proxy}, "")
 				}
 			case constant.RuntimeNode, constant.RuntimeJava, constant.RuntimeGo, constant.RuntimePython, constant.RuntimeDotNet:
-				server.UpdateRootProxy([]string{fmt.Sprintf("http://%s", website.Proxy)})
+				server.UpdateRootProxy([]string{normalizeProxyPass(website.Proxy)})
 			}
 		case constant.Subsite:
 			parentWebsite, err := websiteRepo.GetFirst(repo.WithByID(website.ParentWebsiteID))
@@ -977,7 +1056,7 @@ func opWebsite(website *model.Website, operate string) error {
 		server.RemoveDirective("include", []string{proxyInclude})
 		rewriteInclude := fmt.Sprintf("/www/sites/%s/rewrite/%s.conf", website.Alias, website.Alias)
 		server.RemoveDirective("include", []string{rewriteInclude})
-		redirectInclude := fmt.Sprintf("/www/sites/%s/redirect/%s.conf", website.Alias, website.Alias)
+		redirectInclude := getWebsiteRedirectInclude(*website)
 		server.RemoveDirective("include", []string{redirectInclude})
 
 		switch website.Type {
@@ -1009,7 +1088,7 @@ func opWebsite(website *model.Website, operate string) error {
 		if fileOp.Stat(absoluteRewritePath) {
 			server.UpdateDirective("include", []string{rewriteInclude})
 		}
-		redirectInclude := fmt.Sprintf("/www/sites/%s/redirect/%s.conf", website.Alias, website.Alias)
+		redirectInclude := getWebsiteRedirectInclude(*website)
 		absoluteRedirectPath := GetSitePath(*website, SiteRedirectDir)
 		if fileOp.Stat(absoluteRedirectPath) {
 			server.UpdateDirective("include", []string{redirectInclude})
@@ -1025,7 +1104,10 @@ func opWebsite(website *model.Website, operate string) error {
 			if err != nil {
 				return err
 			}
-			proxy := fmt.Sprintf("http://127.0.0.1:%d", appInstall.HttpPort)
+			proxy, err := getAppInstallProxyPass(&appInstall)
+			if err != nil {
+				return err
+			}
 			server.UpdateRootProxy([]string{proxy})
 		case constant.Static:
 			server.UpdateRoot(rootIndex)
@@ -1045,9 +1127,34 @@ func opWebsite(website *model.Website, operate string) error {
 				}
 				server.UpdatePHPProxy([]string{website.Proxy}, localPath)
 			} else {
-				proxy := fmt.Sprintf("http://%s", website.Proxy)
+				proxy := normalizeProxyPass(website.Proxy)
 				server.UpdateRootProxy([]string{proxy})
 			}
+		case constant.Subsite:
+			parentWebsite, err := websiteRepo.GetFirst(repo.WithByID(website.ParentWebsiteID))
+			if err != nil {
+				return err
+			}
+			website.Proxy = parentWebsite.Proxy
+			rootIndex = path.Join("/www/sites", parentWebsite.Alias, "index", website.SiteDir)
+			if parentWebsite.Type == constant.Runtime {
+				parentRuntime, err := runtimeRepo.GetFirst(context.Background(), repo.WithByID(parentWebsite.RuntimeID))
+				if err != nil {
+					return err
+				}
+				website.RuntimeID = parentRuntime.ID
+				if parentRuntime.Type == constant.RuntimePHP {
+					server.UpdateRoot(rootIndex)
+					localPath := ""
+					if parentRuntime.Resource == constant.ResourceLocal {
+						localPath = path.Join(rootIndex, "index.php")
+					}
+					server.UpdatePHPProxy([]string{website.Proxy}, localPath)
+				}
+			}
+			if parentWebsite.Type == constant.Static {
+				server.UpdateRoot(rootIndex)
+			}
 		}
 		website.Status = constant.WebRunning
 		now := time.Now()

agent/app/task/task.go

@@ -127,6 +127,19 @@ func CheckResourceTaskIsExecuting(operate, scope string, resourceID uint) bool {
 	return task.ID != ""
 }
 
+func CheckScopeTaskIsExecuting(scope string, resourceID uint) error {
+	taskRepo := repo.NewITaskRepo()
+	task, _ := taskRepo.GetFirst(
+		taskRepo.WithByStatus(constant.StatusExecuting),
+		taskRepo.WithResourceID(resourceID),
+		repo.WithByType(scope),
+	)
+	if task.ID != "" {
+		return buserr.New("TaskIsExecuting")
+	}
+	return nil
+}
+
 func NewTask(name, operate, taskScope, taskID string, resourceID uint) (*Task, error) {
 	if taskID == "" {
 		taskID = uuid.New().String()
@@ -275,7 +288,8 @@ func (t *Task) Execute() error {
 	}
 	var err error
 	t.Log(i18n.GetWithName("TaskStart", t.Name))
-	for _, subTask := range t.SubTasks {
+	for i := 0; i < len(t.SubTasks); i++ {
+		subTask := t.SubTasks[i]
 		t.Task.CurrentStep = subTask.StepAlias
 		t.updateTask(t.Task)
 		if err = subTask.Execute(); err == nil {

agent/cmd/server/conf/app.yaml

@@ -4,11 +4,6 @@ base:
   is_demo: false
   is_offline: false
 
-remote_url:
-  app_repo: https://apps-assets.fit2cloud.com
-  repo_url: https://resource.fit2cloud.com/1panel/package/v2
-  resource_url: https://resource.fit2cloud.com/1panel/resource/v2
-
 log:
   level: debug
   time_zone: Asia/Shanghai

agent/cmd/server/docs/swagger.go

@@ -0,0 +1,6 @@
+package docs
+
+import _ "embed"
+
+//go:embed x-log.json
+var XLogJson []byte

agent/cmd/server/nginx_conf/nginx_conf.go

@@ -2,7 +2,6 @@ package nginx_conf
 
 import (
 	"embed"
-	_ "embed"
 	"io"
 )
 

agent/constant/alert.go

@@ -25,4 +25,5 @@ const (
 	DingTalk = "dingTalk"
 	FeiShu   = "feiShu"
 	Custom   = "custom"
+	Bark     = "bark"
 )

agent/constant/app.go

@@ -8,6 +8,7 @@ const (
 
 	AppOpenresty         = "openresty"
 	AppOpenclaw          = "openclaw"
+	AppCopaw             = "copaw"
 	AppMysql             = "mysql"
 	AppMariaDB           = "mariadb"
 	AppPostgresql        = "postgresql"