merge: preserve server-only production updates

# Conflicts:
#	app/(admin)/settings/admin-settings-client.tsx
#	app/canvas/[id]/CanvasEditorLegacyPageClient.tsx
#	playwright.helpers.config.ts

.env.example

@@ -9,6 +9,13 @@
 # Generate with: openssl rand -base64 32
 AUTH_SECRET=replace-with-random-secret
 
+# Stable pepper for user Access Key hashes. Generate independently from AUTH_SECRET.
+ACCESS_KEY_PEPPER=replace-with-random-secret
+
+# Authorizes trusted third-party services to provision user-scoped MCP keys.
+# Must contain at least 32 characters. Never expose it to end users or browsers.
+MCP_KEY_PROVISIONING_SECRET=replace-with-random-secret
+
 # Public application URL. Required for production and self-hosted Auth.js.
 AUTH_URL=https://your-domain.com
 NEXTAUTH_URL=https://your-domain.com
@@ -113,6 +120,9 @@ ZOO_BASE_URL=https://api.zoo.dev
 # /vendor/pascal-editor/index.html bundle.
 NEXT_PUBLIC_PASCAL_EDITOR_URL=
 PASCAL_EDITOR_URL=
+# Shared only by the main app, Nginx, and the private Pascal service. Generate a
+# long random value; never expose it through NEXT_PUBLIC_* variables.
+PASCAL_PROXY_SECRET=
 
 # RUXA / video callback.
 RUXA_CALLBACK_URL=

.gitignore

@@ -11,6 +11,8 @@ coverage
 
 # next.js
 .next/
+.next-build/
+.next-previous/
 out/
 build
 
@@ -87,8 +89,14 @@ checkpoints/
 # 第三方参考源码（不提交到git）
 reference-sources/
 
-# Local self-hosted Pascal Editor checkout.
+# Legacy external Pascal Editor checkout (the managed source is under services/).
 .pascal-editor/
 
+# Local self-hosted Zoo Design Studio checkout.
+.zoo-modeling-app/
+
+# Generated official Zoo Design Studio web bundle.
+public/vendor/zoo-modeling-app/
+
 # Drizzle migrations must be versioned (override the global *.sql ignore above)
 !lib/db/migrations/*.sql

SECURITY_IMPROVEMENTS_SUMMARY.md

@@ -144,18 +144,10 @@ log.error("Operation failed", error, { userId: "123" });
 #### 7. 修复 service 层错误吞没
 **风险等级**: 🟡 中等风险  
 **改动**:
-- `services/ai-cad/index.ts`: 完全重写，所有 catch 块现在记录错误
 - `services/canvas/index.ts`: 添加 logger 导入和辅助函数（未全部迁移）
 
 **潜在问题**:
 - `handleError(err, context, fallbackMessage)` 参数顺序与之前不同
-- 如果有其他代码依赖 ai-cad service 的错误格式，可能受影响
-
-**测试建议**:
-```bash
-# 触发一个 AI-CAD 错误（如无效的 workspace ID）
-# 检查日志是否包含完整错误堆栈
-```
 
 ---
 

app/(admin)/settings/_components/access-security-dashboard.tsx

@@ -0,0 +1,706 @@
+"use client";
+
+import {
+  Activity,
+  AlertTriangle,
+  Ban,
+  Clock3,
+  Globe2,
+  LogIn,
+  Plus,
+  RefreshCw,
+  Search,
+  ShieldAlert,
+  Unlock,
+  UserCheck,
+} from "lucide-react";
+import { useMemo, useState } from "react";
+import { toast } from "sonner";
+import useSWR from "swr";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+} from "@/components/ui/card";
+import { Input } from "@/components/ui/input";
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@/components/ui/select";
+import { cn, fetcher } from "@/lib/utils";
+
+type Severity = "info" | "watch" | "high" | "critical";
+
+type AccessLogEvent = {
+  id: string;
+  eventType: string;
+  ip: string;
+  userEmail: string | null;
+  userRole: string | null;
+  method: string | null;
+  path: string | null;
+  routeGroup: string | null;
+  statusCode: number | null;
+  outcome: string;
+  severity: Severity;
+  reasons: string[] | null;
+  userAgent: string | null;
+  createdAt: string;
+};
+
+type AccessLogTopIp = {
+  ip: string;
+  total: number;
+  uniqueUsers: number;
+  failureCount: number;
+  rateLimitedCount: number;
+  authFailureCount: number;
+  loginSuccessCount: number;
+  suspiciousCount: number;
+  firstSeen: string;
+  lastSeen: string;
+  severity: Severity;
+  failureRate: number;
+  reasons: string[];
+};
+
+type AccessLogResponse = {
+  overview: {
+    totalEvents: number;
+    uniqueIps: number;
+    abnormalEvents: number;
+    abnormalIps: number;
+    rateLimitedEvents: number;
+    manualBlockedEvents: number;
+    loginSuccessEvents: number;
+    unauthorizedEvents: number;
+  };
+  topIps: AccessLogTopIp[];
+  hourlyStats: Array<{
+    hour: string;
+    count: number;
+    abnormalCount: number;
+  }>;
+  pathStats: Array<{
+    path: string | null;
+    routeGroup: string | null;
+    count: number;
+    abnormalCount: number;
+  }>;
+  recentEvents: AccessLogEvent[];
+  rules: string[];
+};
+
+type AccessBlocklistEntry = {
+  id: string;
+  ip: string;
+  reason: string | null;
+  isActive: boolean;
+  expiresAt: string | null;
+  createdAt: string;
+  updatedAt: string;
+  createdByEmail: string | null;
+};
+
+const severityLabels: Record<Severity, string> = {
+  info: "正常",
+  watch: "关注",
+  high: "异常",
+  critical: "高危",
+};
+
+const severityClassNames: Record<Severity, string> = {
+  info:
+    "border-emerald-200 bg-emerald-50 text-emerald-700 dark:border-emerald-800/70 dark:bg-emerald-950/45 dark:text-emerald-300",
+  watch:
+    "border-amber-200 bg-amber-50 text-amber-700 dark:border-amber-800/70 dark:bg-amber-950/45 dark:text-amber-300",
+  high:
+    "border-orange-200 bg-orange-50 text-orange-700 dark:border-orange-800/70 dark:bg-orange-950/45 dark:text-orange-300",
+  critical:
+    "border-red-200 bg-red-50 text-red-700 dark:border-red-800/70 dark:bg-red-950/45 dark:text-red-300",
+};
+
+function formatNumber(value: number | null | undefined) {
+  return new Intl.NumberFormat("zh-CN").format(Number(value || 0));
+}
+
+function formatPercent(value: number | null | undefined) {
+  return `${Math.round(Number(value || 0) * 100)}%`;
+}
+
+function formatTime(value: string | null | undefined) {
+  if (!value) return "--";
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) return "--";
+  return new Intl.DateTimeFormat("zh-CN", {
+    month: "2-digit",
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+  }).format(date);
+}
+
+function getStatusClassName(statusCode: number | null) {
+  if (!statusCode) return "text-muted-foreground";
+  if (statusCode >= 500) return "text-red-700 dark:text-red-300";
+  if (statusCode >= 400) return "text-orange-700 dark:text-orange-300";
+  if (statusCode >= 300) return "text-sky-700 dark:text-sky-300";
+  return "text-emerald-700 dark:text-emerald-300";
+}
+
+function AccessSeverityBadge({ severity }: { severity: Severity }) {
+  return (
+    <Badge
+      className={cn("shrink-0 border px-2 py-0.5", severityClassNames[severity])}
+      variant="outline"
+    >
+      {severityLabels[severity]}
+    </Badge>
+  );
+}
+
+export function AccessSecurityDashboard() {
+  const [hours, setHours] = useState("24");
+  const [severity, setSeverity] = useState("all");
+  const [query, setQuery] = useState("");
+  const [blockIp, setBlockIp] = useState("");
+  const [blockReason, setBlockReason] = useState("");
+  const [isSavingBlock, setIsSavingBlock] = useState(false);
+
+  const accessLogUrl = useMemo(() => {
+    const params = new URLSearchParams({
+      hours,
+      severity,
+      limit: "160",
+    });
+    if (query.trim()) params.set("q", query.trim());
+    return `/api/admin/access-logs?${params.toString()}`;
+  }, [hours, query, severity]);
+
+  const { data, isLoading, mutate } = useSWR<AccessLogResponse>(
+    accessLogUrl,
+    fetcher,
+    { refreshInterval: 30_000 }
+  );
+  const { data: blocklistData, mutate: mutateBlocklist } = useSWR<{
+    entries: AccessBlocklistEntry[];
+  }>("/api/admin/access-blocklist", fetcher);
+
+  const activeBlocklistEntries = useMemo(
+    () => (blocklistData?.entries || []).filter((entry) => entry.isActive),
+    [blocklistData?.entries]
+  );
+  const blockedRules = useMemo(
+    () => new Set(activeBlocklistEntries.map((entry) => entry.ip.toLowerCase())),
+    [activeBlocklistEntries]
+  );
+
+  const saveBlockEntry = async (targetIp?: string, targetReason?: string) => {
+    const ip = String(targetIp || blockIp).trim();
+    const reason = String(targetReason ?? blockReason).trim();
+    if (!ip) {
+      toast.error("请输入要拉黑的 IP");
+      return;
+    }
+
+    setIsSavingBlock(true);
+    try {
+      const response = await fetch("/api/admin/access-blocklist", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ ip, reason }),
+      });
+      const payload = await response.json().catch(() => ({}));
+      if (!response.ok) {
+        throw new Error(payload?.message || payload?.error || "拉黑失败");
+      }
+
+      toast.success(`${ip} 已加入手动黑名单`);
+      setBlockIp("");
+      setBlockReason("");
+      await Promise.all([mutateBlocklist(), mutate()]);
+    } catch (error) {
+      toast.error(error instanceof Error ? error.message : "拉黑失败");
+    } finally {
+      setIsSavingBlock(false);
+    }
+  };
+
+  const updateBlockEntry = async (entry: AccessBlocklistEntry, isActive: boolean) => {
+    try {
+      const response = await fetch("/api/admin/access-blocklist", {
+        method: "PATCH",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          id: entry.id,
+          isActive,
+          reason: entry.reason || "",
+          expiresAt: entry.expiresAt || null,
+        }),
+      });
+      const payload = await response.json().catch(() => ({}));
+      if (!response.ok) {
+        throw new Error(payload?.message || payload?.error || "更新失败");
+      }
+
+      toast.success(isActive ? `${entry.ip} 已重新拉黑` : `${entry.ip} 已解除拉黑`);
+      await Promise.all([mutateBlocklist(), mutate()]);
+    } catch (error) {
+      toast.error(error instanceof Error ? error.message : "更新失败");
+    }
+  };
+
+  const overviewCards = [
+    {
+      key: "events",
+      label: "访问记录",
+      value: formatNumber(data?.overview.totalEvents),
+      note: `${hours} 小时窗口`,
+      icon: Activity,
+      className:
+        "border-slate-200 bg-slate-50 text-slate-900 dark:border-slate-700/70 dark:bg-slate-900/70 dark:text-slate-100",
+    },
+    {
+      key: "ips",
+      label: "独立 IP",
+      value: formatNumber(data?.overview.uniqueIps),
+      note: `${formatNumber(data?.overview.abnormalIps)} 个异常标注`,
+      icon: Globe2,
+      className:
+        "border-sky-200 bg-sky-50 text-sky-900 dark:border-sky-800/70 dark:bg-sky-950/45 dark:text-sky-100",
+    },
+    {
+      key: "abnormal",
+      label: "异常事件",
+      value: formatNumber(data?.overview.abnormalEvents),
+      note: `${formatNumber(data?.overview.manualBlockedEvents)} 次手动阻断`,
+      icon: ShieldAlert,
+      className:
+        "border-orange-200 bg-orange-50 text-orange-900 dark:border-orange-800/70 dark:bg-orange-950/45 dark:text-orange-100",
+    },
+    {
+      key: "login",
+      label: "成功登录",
+      value: formatNumber(data?.overview.loginSuccessEvents),
+      note: `${formatNumber(data?.overview.unauthorizedEvents)} 次未授权`,
+      icon: LogIn,
+      className:
+        "border-emerald-200 bg-emerald-50 text-emerald-900 dark:border-emerald-800/70 dark:bg-emerald-950/45 dark:text-emerald-100",
+    },
+  ];
+
+  const maxHourlyCount = Math.max(
+    1,
+    ...(data?.hourlyStats || []).map((item) => item.count)
+  );
+  const maxPathCount = Math.max(
+    1,
+    ...(data?.pathStats || []).map((item) => item.count)
+  );
+
+  return (
+    <div className="space-y-4">
+      <Card>
+        <CardHeader className="pb-4">
+          <div className="flex flex-col gap-3 lg:flex-row lg:items-end lg:justify-between">
+            <div>
+              <CardTitle className="text-xl">访问安全分析</CardTitle>
+              <CardDescription>
+                IP 访问记录、登录来源、异常标注与请求趋势
+              </CardDescription>
+            </div>
+            <div className="flex flex-col gap-2 sm:flex-row sm:items-center">
+              <div className="relative sm:w-[260px]">
+                <Search className="-translate-y-1/2 absolute left-3 top-1/2 h-4 w-4 text-muted-foreground" />
+                <Input
+                  className="h-9 pl-9"
+                  onChange={(event) => setQuery(event.target.value)}
+                  placeholder="搜索 IP、路径、用户"
+                  value={query}
+                />
+              </div>
+              <Select onValueChange={setHours} value={hours}>
+                <SelectTrigger className="h-9 sm:w-[132px]">
+                  <SelectValue />
+                </SelectTrigger>
+                <SelectContent>
+                  <SelectItem value="1">近 1 小时</SelectItem>
+                  <SelectItem value="6">近 6 小时</SelectItem>
+                  <SelectItem value="24">近 24 小时</SelectItem>
+                  <SelectItem value="72">近 3 天</SelectItem>
+                  <SelectItem value="168">近 7 天</SelectItem>
+                </SelectContent>
+              </Select>
+              <Select onValueChange={setSeverity} value={severity}>
+                <SelectTrigger className="h-9 sm:w-[132px]">
+                  <SelectValue />
+                </SelectTrigger>
+                <SelectContent>
+                  <SelectItem value="all">全部级别</SelectItem>
+                  <SelectItem value="abnormal">仅异常</SelectItem>
+                  <SelectItem value="watch">关注</SelectItem>
+                  <SelectItem value="high">异常</SelectItem>
+                  <SelectItem value="critical">高危</SelectItem>
+                </SelectContent>
+              </Select>
+              <Button
+                className="h-9 gap-2"
+                onClick={() => mutate()}
+                size="sm"
+                variant="outline"
+              >
+                <RefreshCw className={cn("h-4 w-4", isLoading && "animate-spin")} />
+                刷新
+              </Button>
+            </div>
+          </div>
+        </CardHeader>
+        <CardContent className="space-y-4">
+          <div className="grid gap-3 sm:grid-cols-2 xl:grid-cols-4">
+            {overviewCards.map((item) => {
+              const Icon = item.icon;
+              return (
+                <div
+                  className={cn("rounded-lg border p-4", item.className)}
+                  key={item.key}
+                >
+                  <div className="flex items-center justify-between gap-3">
+                    <div className="text-sm text-current/70">{item.label}</div>
+                    <Icon className="h-4 w-4" />
+                  </div>
+                  <div className="mt-3 font-semibold text-3xl tracking-tight">
+                    {item.value}
+                  </div>
+                  <div className="mt-1 text-current/65 text-xs">{item.note}</div>
+                </div>
+              );
+            })}
+          </div>
+
+          <div className="rounded-lg border bg-background p-4">
+            <div className="mb-3 flex items-center justify-between gap-3">
+              <div className="flex items-center gap-2 font-medium text-sm">
+                <Clock3 className="h-4 w-4" />
+                小时趋势
+              </div>
+              <div className="text-muted-foreground text-xs">
+                橙色表示异常事件占比
+              </div>
+            </div>
+            <div className="flex h-[180px] items-end gap-1">
+              {(data?.hourlyStats || []).map((item) => {
+                const height = Math.max(4, (item.count / maxHourlyCount) * 100);
+                const abnormalHeight =
+                  item.count > 0
+                    ? Math.max(0, (item.abnormalCount / item.count) * height)
+                    : 0;
+                return (
+                  <div
+                    className="group relative flex min-w-[10px] flex-1 items-end overflow-hidden rounded bg-slate-200 dark:bg-slate-800"
+                    key={item.hour}
+                    style={{ height: `${height}%` }}
+                  >
+                    <div
+                      className="w-full bg-orange-400"
+                      style={{ height: `${abnormalHeight}%` }}
+                    />
+                    <div className="-translate-x-1/2 pointer-events-none absolute bottom-full left-1/2 z-10 mb-2 hidden whitespace-nowrap rounded-md bg-zinc-950 px-2 py-1 text-white text-xs shadow-lg group-hover:block">
+                      {item.hour} · {formatNumber(item.count)} 次 · 异常{" "}
+                      {formatNumber(item.abnormalCount)}
+                    </div>
+                  </div>
+                );
+              })}
+              {(!data?.hourlyStats || data.hourlyStats.length === 0) && (
+                <div className="flex h-full w-full items-center justify-center rounded-lg border border-dashed text-muted-foreground text-sm">
+                  暂无访问记录
+                </div>
+              )}
+            </div>
+          </div>
+        </CardContent>
+      </Card>
+
+      <Card>
+        <CardHeader className="pb-4">
+          <CardTitle className="text-lg">手动 IP 黑名单</CardTitle>
+          <CardDescription>
+            管理员手动加入后，命中 IP 会被阻断并写入访问日志
+          </CardDescription>
+        </CardHeader>
+        <CardContent className="space-y-4">
+          <div className="grid gap-3 lg:grid-cols-[220px_minmax(240px,1fr)_auto]">
+            <Input
+              className="h-9"
+              onChange={(event) => setBlockIp(event.target.value)}
+              placeholder="IP 或 IPv4 CIDR"
+              value={blockIp}
+            />
+            <Input
+              className="h-9"
+              onChange={(event) => setBlockReason(event.target.value)}
+              placeholder="拉黑原因"
+              value={blockReason}
+            />
+            <Button
+              className="h-9 gap-2"
+              disabled={isSavingBlock}
+              onClick={() => saveBlockEntry()}
+              size="sm"
+            >
+              <Plus className="h-4 w-4" />
+              加入黑名单
+            </Button>
+          </div>
+
+          <div className="grid gap-2 md:grid-cols-2 xl:grid-cols-3">
+            {activeBlocklistEntries.map((entry) => (
+              <div
+                className="rounded-lg border border-red-100 bg-red-50/60 px-3 py-3 dark:border-red-900/60 dark:bg-red-950/30"
+                key={entry.id}
+              >
+                <div className="flex items-start justify-between gap-3">
+                  <div className="min-w-0">
+                    <div className="flex items-center gap-2">
+                      <Ban className="h-4 w-4 text-red-600 dark:text-red-400" />
+                      <span className="truncate font-mono font-semibold text-sm text-red-900 dark:text-red-200">
+                        {entry.ip}
+                      </span>
+                    </div>
+                    <div className="mt-1 line-clamp-2 text-red-800/75 text-xs dark:text-red-300/75">
+                      {entry.reason || "未填写原因"}
+                    </div>
+                    <div className="mt-2 text-red-700/70 text-xs dark:text-red-400/70">
+                      {formatTime(entry.updatedAt)}
+                    </div>
+                  </div>
+                  <Button
+                    className="h-8 shrink-0 gap-1 border-red-200 bg-white text-red-700 hover:bg-red-50 dark:border-red-800 dark:bg-red-950/30 dark:text-red-300 dark:hover:bg-red-950/60"
+                    onClick={() => updateBlockEntry(entry, false)}
+                    size="sm"
+                    variant="outline"
+                  >
+                    <Unlock className="h-3.5 w-3.5" />
+                    解除
+                  </Button>
+                </div>
+              </div>
+            ))}
+            {activeBlocklistEntries.length === 0 ? (
+              <div className="rounded-lg border border-dashed py-8 text-center text-muted-foreground text-sm md:col-span-2 xl:col-span-3">
+                暂无手动拉黑 IP
+              </div>
+            ) : null}
+          </div>
+        </CardContent>
+      </Card>
+
+      <div className="grid gap-4 xl:grid-cols-[minmax(0,1.3fr)_minmax(320px,0.7fr)]">
+        <Card>
+          <CardHeader className="pb-4">
+            <CardTitle className="text-lg">异常 IP 标注</CardTitle>
+            <CardDescription>
+              按限流、失败率、认证异常、敏感路径和请求量综合排序
+            </CardDescription>
+          </CardHeader>
+          <CardContent>
+            <div className="space-y-2">
+              {(data?.topIps || []).map((item) => (
+                <div
+                  className="rounded-lg border bg-background px-4 py-3"
+                  key={item.ip}
+                >
+                  <div className="flex flex-col gap-3 md:flex-row md:items-start md:justify-between">
+                    <div className="min-w-0">
+                      <div className="flex flex-wrap items-center gap-2">
+                        <span className="font-mono font-semibold text-sm">
+                          {item.ip}
+                        </span>
+                        <AccessSeverityBadge severity={item.severity} />
+                      </div>
+                      <div className="mt-2 flex flex-wrap gap-2 text-muted-foreground text-xs">
+                        <span>{formatNumber(item.total)} 次访问</span>
+                        <span>{formatNumber(item.uniqueUsers)} 个用户</span>
+                        <span>失败率 {formatPercent(item.failureRate)}</span>
+                        <span>最近 {formatTime(item.lastSeen)}</span>
+                      </div>
+                    </div>
+                    <div className="flex flex-wrap items-center gap-1 md:justify-end">
+                      {(item.reasons.length > 0 ? item.reasons : ["正常访问"]).map(
+                        (reason) => (
+                          <Badge
+                            className="border-zinc-200 bg-zinc-50 text-zinc-700 dark:border-zinc-700 dark:bg-zinc-900 dark:text-zinc-300"
+                            key={reason}
+                            variant="outline"
+                          >
+                            {reason}
+                          </Badge>
+                        )
+                      )}
+                      <Button
+                        className="h-7 gap-1 px-2 text-xs"
+                        disabled={blockedRules.has(item.ip.toLowerCase()) || isSavingBlock}
+                        onClick={() =>
+                          saveBlockEntry(
+                            item.ip,
+                            item.reasons.join("、") || "管理员从异常 IP 排行手动拉黑"
+                          )
+                        }
+                        size="sm"
+                        variant="outline"
+                      >
+                        <Ban className="h-3.5 w-3.5" />
+                        {blockedRules.has(item.ip.toLowerCase()) ? "已拉黑" : "拉黑"}
+                      </Button>
+                    </div>
+                  </div>
+                </div>
+              ))}
+              {(!data?.topIps || data.topIps.length === 0) && (
+                <div className="rounded-lg border border-dashed py-10 text-center text-muted-foreground text-sm">
+                  暂无 IP 聚合数据
+                </div>
+              )}
+            </div>
+          </CardContent>
+        </Card>
+
+        <Card>
+          <CardHeader className="pb-4">
+            <CardTitle className="text-lg">访问路径</CardTitle>
+            <CardDescription>按请求数量排序</CardDescription>
+          </CardHeader>
+          <CardContent>
+            <div className="space-y-3">
+              {(data?.pathStats || []).map((item) => {
+                const abnormalRate =
+                  item.count > 0 ? item.abnormalCount / item.count : 0;
+                return (
+                  <div key={`${item.routeGroup || "page"}-${item.path || "/"}`}>
+                    <div className="flex items-center justify-between gap-3 text-sm">
+                      <span className="min-w-0 truncate font-medium">
+                        {item.path || "/"}
+                      </span>
+                      <span className="shrink-0 text-muted-foreground text-xs">
+                        {formatNumber(item.count)}
+                      </span>
+                    </div>
+                    <div className="mt-2 h-2 overflow-hidden rounded-full bg-zinc-100 dark:bg-zinc-800">
+                      <div
+                        className="h-full rounded-full bg-zinc-900 dark:bg-zinc-200"
+                        style={{
+                          width: `${Math.max(4, (item.count / maxPathCount) * 100)}%`,
+                        }}
+                      />
+                      <div
+                        className="-mt-2 h-full rounded-full bg-orange-400"
+                        style={{
+                          width: `${Math.round(abnormalRate * 100)}%`,
+                        }}
+                      />
+                    </div>
+                  </div>
+                );
+              })}
+              {(!data?.pathStats || data.pathStats.length === 0) && (
+                <div className="rounded-lg border border-dashed py-10 text-center text-muted-foreground text-sm">
+                  暂无路径统计
+                </div>
+              )}
+            </div>
+          </CardContent>
+        </Card>
+      </div>
+
+      <Card>
+        <CardHeader className="pb-4">
+          <div className="flex flex-col gap-2 sm:flex-row sm:items-center sm:justify-between">
+            <div>
+              <CardTitle className="text-lg">访问日志列表</CardTitle>
+              <CardDescription>最近 {formatNumber(data?.recentEvents.length)} 条</CardDescription>
+            </div>
+            <div className="flex flex-wrap gap-2">
+              {(data?.rules || []).map((rule) => (
+                <Badge
+                  className="border-zinc-200 bg-zinc-50 text-zinc-600 dark:border-zinc-700 dark:bg-zinc-900 dark:text-zinc-300"
+                  key={rule}
+                  variant="outline"
+                >
+                  {rule}
+                </Badge>
+              ))}
+            </div>
+          </div>
+        </CardHeader>
+        <CardContent>
+          <div className="overflow-x-auto rounded-lg border">
+            <div className="min-w-[980px]">
+              <div className="grid grid-cols-[138px_132px_86px_minmax(220px,1fr)_140px_120px] border-b bg-zinc-50 px-4 py-2 font-medium text-muted-foreground text-xs dark:bg-zinc-900/70">
+                <div>时间</div>
+                <div>IP</div>
+                <div>状态</div>
+                <div>路径</div>
+                <div>用户</div>
+                <div>标注</div>
+              </div>
+              {(data?.recentEvents || []).map((event) => (
+                <div
+                  className="grid grid-cols-[138px_132px_86px_minmax(220px,1fr)_140px_120px] items-center border-b px-4 py-3 text-sm last:border-b-0"
+                  key={event.id}
+                >
+                  <div className="text-muted-foreground text-xs">
+                    {formatTime(event.createdAt)}
+                  </div>
+                  <div className="font-mono text-xs">{event.ip}</div>
+                  <div
+                    className={cn(
+                      "font-semibold text-xs",
+                      getStatusClassName(event.statusCode)
+                    )}
+                  >
+                    {event.statusCode || "--"}
+                  </div>
+                  <div className="min-w-0">
+                    <div className="truncate font-medium">
+                      {event.method || "GET"} {event.path || "/"}
+                    </div>
+                    <div className="mt-1 truncate text-muted-foreground text-xs">
+                      {event.reasons?.join("、") || event.outcome}
+                    </div>
+                  </div>
+                  <div className="min-w-0">
+                    <div className="truncate text-xs">
+                      {event.userEmail || "匿名"}
+                    </div>
+                    <div className="mt-1 flex items-center gap-1 text-muted-foreground text-xs">
+                      <UserCheck className="h-3 w-3" />
+                      {event.userRole || "unknown"}
+                    </div>
+                  </div>
+                  <div className="flex items-center gap-2">
+                    {event.severity === "high" || event.severity === "critical" ? (
+                      <AlertTriangle className="h-4 w-4 text-orange-500" />
+                    ) : null}
+                    <AccessSeverityBadge severity={event.severity} />
+                  </div>
+                </div>
+              ))}
+              {(!data?.recentEvents || data.recentEvents.length === 0) && (
+                <div className="py-10 text-center text-muted-foreground text-sm">
+                  暂无访问日志
+                </div>
+              )}
+            </div>
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

app/(admin)/settings/_components/admin-settings-navigation.tsx

@@ -11,11 +11,9 @@ import {
   SelectTrigger,
   SelectValue,
 } from "@/components/ui/select";
-import { ADMIN_SETTINGS_NAV_GROUPS } from "../_lib/settings-navigation";
+import { ADMIN_SETTINGS_NAV_ITEMS } from "../_lib/settings-navigation";
 import type { AdminSettingsNavItem } from "../_lib/types";
 
-const ALL_SETTINGS_ITEMS = ADMIN_SETTINGS_NAV_GROUPS.flatMap((group) => group.items);
-
 function SettingsQuickAction({
   activeTab,
   item,
@@ -33,8 +31,8 @@ function SettingsQuickAction({
       ? "border-foreground/10 bg-foreground text-background shadow-sm hover:!bg-foreground/90 hover:!text-background dark:border-white/20 dark:bg-white dark:text-black dark:hover:!bg-white/90 dark:hover:!text-black"
       : "border-transparent bg-transparent text-muted-foreground hover:!border-border/80 hover:!bg-zinc-100 hover:!text-foreground dark:hover:!bg-zinc-900/50";
   const layoutClassName = stretched
-    ? "h-10 w-full min-w-0 justify-center gap-2 rounded-2xl border px-4"
+    ? "h-8 w-full min-w-0 justify-center gap-1.5 rounded-md border px-2.5 text-xs"
-    : "h-9 shrink-0 gap-2 rounded-full border px-3.5";
+    : "h-8 shrink-0 gap-1.5 rounded-md border px-2.5 text-xs";
 
   if (item.href) {
     return (
@@ -45,7 +43,7 @@ function SettingsQuickAction({
         variant="ghost"
       >
         <Link href={item.href}>
-          <Icon className="h-4 w-4" />
+          <Icon className="h-3.5 w-3.5" />
           <span className={stretched ? "truncate" : ""}>{item.label}</span>
         </Link>
       </Button>
@@ -59,7 +57,7 @@ function SettingsQuickAction({
       size="sm"
       variant="ghost"
     >
-      <Icon className="h-4 w-4" />
+      <Icon className="h-3.5 w-3.5" />
       <span className={stretched ? "truncate" : ""}>{item.label}</span>
     </Button>
   );
@@ -73,9 +71,13 @@ export function AdminSettingsNavigation({
   onTabChange: (value: string) => void;
 }) {
   const router = useRouter();
-  const activeItem = ALL_SETTINGS_ITEMS.find((item) => item.value === activeTab);
+  const activeItem = ADMIN_SETTINGS_NAV_ITEMS.find(
+    (item) => item.value === activeTab
+  );
   const handleSelectChange = (value: string) => {
-    const nextItem = ALL_SETTINGS_ITEMS.find((item) => item.value === value);
+    const nextItem = ADMIN_SETTINGS_NAV_ITEMS.find(
+      (item) => item.value === value
+    );
     if (nextItem?.href) {
       router.push(nextItem.href);
       return;
@@ -84,15 +86,18 @@ export function AdminSettingsNavigation({
   };
 
   return (
-    <div className="rounded-2xl border bg-background px-4 py-3 shadow-sm">
+    <nav
-      <div className="flex flex-col gap-2 md:hidden">
+      aria-label="系统设置导航"
+      className="sticky top-2 z-30 rounded-lg border bg-background/95 p-2 shadow-sm backdrop-blur supports-[backdrop-filter]:bg-background/85"
+    >
+      <div className="md:hidden">
         <div className="flex items-center gap-2">
           <Select onValueChange={handleSelectChange} value={activeTab}>
-            <SelectTrigger className="h-9 flex-1 border-border/70 bg-background shadow-none">
+            <SelectTrigger className="h-8 flex-1 border-border/70 bg-background shadow-none">
               <SelectValue placeholder={activeItem?.label || "选择设置项"} />
             </SelectTrigger>
             <SelectContent>
-              {ALL_SETTINGS_ITEMS.map((item) => (
+              {ADMIN_SETTINGS_NAV_ITEMS.map((item) => (
                 <SelectItem key={item.value} value={item.value}>
                   {item.label}
                 </SelectItem>
@@ -102,7 +107,7 @@ export function AdminSettingsNavigation({
 
           <Button
             asChild
-            className="h-9 rounded-full border-border/70 px-3 text-[13px]"
+            className="h-8 rounded-md border-border/70 px-2.5 text-xs"
             size="sm"
             variant="outline"
           >
@@ -113,35 +118,22 @@ export function AdminSettingsNavigation({
           </Button>
         </div>
 
-        <div className="flex flex-wrap gap-1">
-          {ALL_SETTINGS_ITEMS.map((item) => (
-            <SettingsQuickAction
-              activeTab={activeTab}
-              item={item}
-              key={item.value}
-              onTabChange={onTabChange}
-            />
-          ))}
-        </div>
       </div>
 
-      <div className="hidden min-w-0 items-center gap-3 md:flex">
+      <div className="hidden min-w-0 grid-cols-7 gap-1 md:grid xl:grid-cols-[repeat(13,minmax(78px,1fr))_auto]">
-        <div className="flex min-w-0 flex-1 items-center gap-2 overflow-x-auto">
+        {ADMIN_SETTINGS_NAV_ITEMS.map((item) => (
-          {ALL_SETTINGS_ITEMS.map((item) => (
+          <SettingsQuickAction
-            <div className="min-w-[118px] flex-1" key={item.value}>
+            activeTab={activeTab}
-              <SettingsQuickAction
+            item={item}
-                activeTab={activeTab}
+            key={item.value}
-                item={item}
+            onTabChange={onTabChange}
-                onTabChange={onTabChange}
+            stretched
-                stretched
+          />
-              />
+        ))}
-            </div>
-          ))}
-        </div>
 
         <Button
           asChild
-          className="h-9 shrink-0 rounded-full border-border/70 px-3.5 text-[13px]"
+          className="h-8 min-w-0 rounded-md border-border/70 px-2.5 text-xs"
           size="sm"
           variant="outline"
         >
@@ -151,6 +143,6 @@ export function AdminSettingsNavigation({
           </Link>
         </Button>
       </div>
-    </div>
+    </nav>
   );
 }

app/(admin)/settings/_components/local-ai-command-center.tsx

@@ -26,22 +26,22 @@ export function LocalAiCommandCenter({
   onSetAllExpanded: (expanded: boolean) => void;
 }) {
   return (
-    <div className="overflow-hidden rounded-xl border bg-background">
+    <div className="overflow-hidden rounded-lg border bg-background">
-      <div className="border-b bg-muted/20 px-5 py-4">
+      <div className="border-b bg-muted/20 px-4 py-3">
-        <div className="flex flex-col gap-3 lg:flex-row lg:items-start lg:justify-between">
+        <div className="flex flex-col gap-2.5 lg:flex-row lg:items-start lg:justify-between">
-          <div className="space-y-1.5">
+          <div className="space-y-1">
-            <div className="font-semibold text-muted-foreground text-xs">
+            <div className="font-semibold text-[10px] text-muted-foreground">
               SYSTEM INTEGRATIONS
             </div>
-            <h2 className="font-semibold text-2xl tracking-normal">
+            <h2 className="font-semibold text-lg">
               高级能力与外部服务
             </h2>
-            <p className="max-w-3xl text-muted-foreground text-sm leading-6">
+            <p className="max-w-3xl text-muted-foreground text-xs leading-5">
               把商品策划、图像处理、3D/CAD、实时画布和开放 API
               按运维任务重新归类。折叠状态会保留，常用模块可以保持展开。
             </p>
           </div>
-          <div className="flex flex-wrap gap-2">
+          <div className="flex flex-wrap gap-1.5">
             <SettingStatusBadge tone="neutral">
               已展开 {openSectionCount} 个模块
             </SettingStatusBadge>
@@ -52,7 +52,7 @@ export function LocalAiCommandCenter({
               模型 {modelCount}
             </SettingStatusBadge>
             <Button
-              className="h-7 rounded-md px-2 text-xs"
+              className="h-6 rounded-md px-2 text-[11px]"
               onClick={() => onSetAllExpanded(true)}
               size="sm"
               type="button"
@@ -61,7 +61,7 @@ export function LocalAiCommandCenter({
               全部展开
             </Button>
             <Button
-              className="h-7 rounded-md px-2 text-xs"
+              className="h-6 rounded-md px-2 text-[11px]"
               onClick={() => onSetAllExpanded(false)}
               size="sm"
               type="button"
@@ -77,21 +77,21 @@ export function LocalAiCommandCenter({
           const Icon = item.icon;
           return (
             <button
-              className="group bg-background p-4 text-left transition-colors hover:bg-muted/30"
+              className="group bg-background p-3 text-left transition-colors hover:bg-muted/30"
               key={item.key}
               onClick={() => onFocusSection(item.key)}
               type="button"
             >
               <div className="flex items-start justify-between gap-3">
                 <div className="flex min-w-0 items-center gap-2">
-                  <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-md border bg-muted/30">
+                  <div className="flex h-7 w-7 shrink-0 items-center justify-center rounded-md border bg-muted/30">
-                    <Icon className="h-4 w-4 text-muted-foreground" />
+                    <Icon className="h-3.5 w-3.5 text-muted-foreground" />
                   </div>
                   <div className="min-w-0">
-                    <div className="truncate font-semibold text-sm">
+                    <div className="truncate font-semibold text-xs">
                       {item.title}
                     </div>
-                    <div className="mt-0.5 truncate text-muted-foreground text-xs">
+                    <div className="mt-0.5 truncate text-[11px] text-muted-foreground">
                       {item.description}
                     </div>
                   </div>
@@ -104,20 +104,20 @@ export function LocalAiCommandCenter({
           );
         })}
       </div>
-      <div className="border-t bg-muted/10 px-5 py-4">
+      <div className="border-t bg-muted/10 px-4 py-3">
-        <div className="grid gap-4 lg:grid-cols-4">
+        <div className="grid gap-3 lg:grid-cols-4">
           {LOCAL_AI_QUICK_LINK_GROUPS.map((group) => (
-            <div className="space-y-2" key={group}>
+            <div className="space-y-1.5" key={group}>
-              <div className="font-semibold text-muted-foreground text-xs">
+              <div className="font-semibold text-[11px] text-muted-foreground">
                 {group}
               </div>
-              <div className="flex flex-wrap gap-2">
+              <div className="flex flex-wrap gap-1.5">
                 {quickLinks
                   .filter((item) => item.group === group)
                   .map((item) => (
                     <button
                       className={cn(
-                        "inline-flex h-7 items-center gap-1.5 rounded-md border px-2 text-xs transition-colors hover:bg-background",
+                        "inline-flex h-6 items-center gap-1 rounded-md border px-2 text-[11px] transition-colors hover:bg-background",
                         isSectionExpanded(item.key)
                           ? "border-foreground/20 bg-background text-foreground"
                           : "border-border bg-transparent text-muted-foreground"

app/(admin)/settings/_components/local-ai-section-shell.tsx

@@ -24,13 +24,13 @@ export function LocalAiGroupHeading({
   description: string;
 }) {
   return (
-    <div className="rounded-lg border bg-muted/20 px-4 py-3">
+    <div className="rounded-lg border bg-muted/20 px-3 py-2.5">
-      <div className="font-semibold text-[11px] text-muted-foreground uppercase tracking-[0.16em]">
+      <div className="font-semibold text-[10px] text-muted-foreground uppercase">
         {eyebrow}
       </div>
       <div className="mt-1 flex flex-col gap-1 md:flex-row md:items-end md:justify-between">
-        <h3 className="font-semibold text-base text-foreground">{title}</h3>
+        <h3 className="font-semibold text-sm text-foreground">{title}</h3>
-        <p className="max-w-3xl text-muted-foreground text-sm">{description}</p>
+        <p className="max-w-3xl text-muted-foreground text-xs">{description}</p>
       </div>
     </div>
   );
@@ -45,7 +45,7 @@ export function LocalAiSectionSummary({
   }>;
 }) {
   return (
-    <div className="flex flex-wrap gap-2 pt-1">
+    <div className="flex flex-wrap gap-1.5 pt-1">
       {items.map((item) => (
         <SettingStatusBadge key={item.label} tone={item.tone || "neutral"}>
           {item.label}
@@ -65,16 +65,16 @@ export function LocalAiSectionToggleButton({
   return (
     <Button
       aria-expanded={expanded}
-      className="h-8 shrink-0 gap-1.5 rounded-md px-2.5 text-xs"
+      className="h-7 shrink-0 gap-1 rounded-md px-2 text-[11px]"
       onClick={onClick}
       size="sm"
       type="button"
       variant="outline"
     >
       {expanded ? (
-        <ArrowUp className="h-3.5 w-3.5" />
+        <ArrowUp className="h-3 w-3" />
       ) : (
-        <ArrowDown className="h-3.5 w-3.5" />
+        <ArrowDown className="h-3 w-3" />
       )}
       {expanded ? "收起配置" : "展开配置"}
     </Button>
@@ -100,9 +100,9 @@ export function LocalAiSectionShell({
 }) {
   return (
     <Card id={id}>
-      <CardHeader className="flex flex-col gap-4 space-y-0 md:flex-row md:items-start md:justify-between">
+      <CardHeader className="flex flex-col gap-3 space-y-0 md:flex-row md:items-start md:justify-between">
-        <div className="space-y-1.5">
+        <div className="space-y-1">
-          <CardTitle className="text-xl">{title}</CardTitle>
+          <CardTitle className="text-base">{title}</CardTitle>
           <CardDescription>{description}</CardDescription>
           {summary}
         </div>
@@ -110,7 +110,7 @@ export function LocalAiSectionShell({
       </CardHeader>
       <CardContent
         className={cn(
-          "local-ai-config-card-content space-y-6 pt-6",
+          "local-ai-config-card-content space-y-4 pt-4",
           !expanded && "hidden"
         )}
       >

app/(admin)/settings/_components/local-ai-sections/image-pipeline-sections.tsx

@@ -75,6 +75,8 @@ export function LocalAiImagePipelineSections({
   aiWashConfig,
   setAiWashConfig,
   aiWashModeIconUploading,
+  canvasLocalEditConfig,
+  setCanvasLocalEditConfig,
   extendConfig,
   setExtendConfig,
   watermarkRemoveConfig,
@@ -103,6 +105,7 @@ export function LocalAiImagePipelineSections({
   handleMoveEnhanceProPreset,
   handleAiWashModeIconUpload,
   handleSaveAiWashConfig,
+  handleSaveCanvasLocalEditConfig,
   handleSaveExtendConfig,
   handleSaveWatermarkRemoveConfig,
   handleSaveAngleEditConfig,
@@ -156,12 +159,15 @@ export function LocalAiImagePipelineSections({
               },
               {
                 label:
-                  rmbgConfig.apiKey ||
+                  rmbgConfig.provider === "vip98k"
+                    ? "服务商 Key 已配置"
+                    : rmbgConfig.apiKey ||
                   rmbgConfig.photoroomApiKey ||
                   rmbgConfig.aosApiKey
                     ? "Key 已配置"
                     : "Key 待配置",
                 tone:
+                  rmbgConfig.provider === "vip98k" ||
                   rmbgConfig.apiKey ||
                   rmbgConfig.photoroomApiKey ||
                   rmbgConfig.aosApiKey
@@ -176,7 +182,26 @@ export function LocalAiImagePipelineSections({
         {/* 服务提供商选择 */}
         <div className="space-y-3">
           <Label>抠图服务提供商</Label>
-          <div className="grid grid-cols-1 gap-4 md:grid-cols-3">
+          <div className="grid grid-cols-1 gap-4 md:grid-cols-4">
+            <div
+              className={`relative flex cursor-pointer items-center gap-3 rounded-lg border p-4 transition-all hover:bg-accent ${
+                rmbgConfig.provider === "vip98k"
+                  ? "border-primary bg-accent ring-1 ring-primary"
+                  : ""
+              }`}
+              onClick={() => setRmbgConfig({ ...rmbgConfig, provider: "vip98k" })}
+            >
+              <div
+                className={`flex h-4 w-4 shrink-0 items-center justify-center rounded-full border border-primary ${
+                  rmbgConfig.provider === "vip98k"
+                    ? "bg-primary text-primary-foreground"
+                    : "bg-transparent"
+                }`}
+              >
+                {rmbgConfig.provider === "vip98k" && <Check className="h-3 w-3" />}
+              </div>
+              <p className="font-medium text-sm leading-none">VIP98K 统一服务</p>
+            </div>
             <div
               className={`relative flex cursor-pointer items-center gap-3 rounded-lg border p-4 transition-all hover:bg-accent ${
                 rmbgConfig.provider === "rmbg"
@@ -263,6 +288,13 @@ export function LocalAiImagePipelineSections({
 
         <Separator />
 
+        {rmbgConfig.provider === "vip98k" && (
+          <div className="rounded-lg border bg-muted/40 p-4 text-sm">
+            使用 VIP98K 的 remove-background 模型。API Key 从“AI 模型设置”中的
+            VIP98K 服务商读取，不会在此重复保存。
+          </div>
+        )}
+
         {/* RMBG 配置 */}
         {rmbgConfig.provider === "rmbg" && (
           <>
@@ -468,7 +500,7 @@ export function LocalAiImagePipelineSections({
       <LocalAiSectionShell
         description={
           <>
-            配置图片变清晰API，用于画图标注功能中的图片增强处理。支持主API和备用API切换。
+            配置图片变清晰服务，用于画图标注功能中的图片增强处理。
           </>
         }
         expanded={isLocalAiSectionExpanded("enhance")}
@@ -478,17 +510,21 @@ export function LocalAiImagePipelineSections({
           <LocalAiSectionSummary
             items={[
               {
-                label: enhanceConfig.useBackupApi
+                label: enhanceConfig.provider === "vip98k"
+                  ? "VIP98K"
+                  : enhanceConfig.useBackupApi
                   ? "备用 Real-ESRGAN"
                   : "主 API",
                 tone: "neutral",
               },
               {
                 label:
+                  enhanceConfig.provider === "vip98k" ||
                   enhanceConfig.apiKey || enhanceConfig.backupApiKey
                     ? "Key 已配置"
                     : "Key 待配置",
                 tone:
+                  enhanceConfig.provider === "vip98k" ||
                   enhanceConfig.apiKey || enhanceConfig.backupApiKey
                     ? "enabled"
                     : "warning",
@@ -498,6 +534,13 @@ export function LocalAiImagePipelineSections({
         }
         title="变清晰API配置"
       >
+        {enhanceConfig.provider === "vip98k" ? (
+          <div className="rounded-lg border bg-muted/40 p-4 text-sm">
+            使用 VIP98K 的 enhance 模型，默认 4 倍增强。API Key 从“AI 模型设置”中的
+            VIP98K 服务商读取。
+          </div>
+        ) : (
+          <>
         {/* API切换开关 */}
         <div className="flex items-center justify-between rounded-lg border p-4">
           <div className="space-y-0.5">
@@ -746,6 +789,8 @@ export function LocalAiImagePipelineSections({
             </div>
           </>
         )}
+          </>
+        )}
 
         <Button onClick={handleSaveEnhanceConfig}>
           <Save className="mr-2 h-4 w-4" /> 保存配置
@@ -1421,6 +1466,112 @@ export function LocalAiImagePipelineSections({
       </Button>
       </LocalAiSectionShell>
 
+      <LocalAiSectionShell
+        description={
+          <>
+            配置无限画布图片“局部编辑”和“比例调整”后端优先使用的生图模型。为空时仍沿用旧的 AI详情默认模型或用户当前选择，避免影响已有流程。
+          </>
+        }
+        expanded={isLocalAiSectionExpanded("canvas-local-edit")}
+        id="local-ai-section-canvas-local-edit"
+        onToggle={() => toggleLocalAiSection("canvas-local-edit")}
+        summary={
+          <LocalAiSectionSummary
+            items={[
+              {
+                label: canvasLocalEditConfig.modelId
+                  ? "普通局部编辑已指定"
+                  : "普通局部编辑继承默认",
+                tone: canvasLocalEditConfig.modelId ? "enabled" : "neutral",
+              },
+              {
+                label: canvasLocalEditConfig.scaleAdjustModelId
+                  ? "比例调整已指定"
+                  : "比例调整兼容旧默认",
+                tone: canvasLocalEditConfig.scaleAdjustModelId
+                  ? "enabled"
+                  : "neutral",
+              },
+            ]}
+          />
+        }
+        title="局部编辑模型配置"
+      >
+        <div className="grid gap-4 md:grid-cols-2">
+          <div className="space-y-2">
+            <Label htmlFor="canvasLocalEditModel">普通局部编辑默认模型</Label>
+            <Select
+              onValueChange={(value) =>
+                setCanvasLocalEditConfig((prev) => ({
+                  ...prev,
+                  modelId: value === "__none__" ? "" : value,
+                }))
+              }
+              value={canvasLocalEditConfig.modelId || "__none__"}
+            >
+              <SelectTrigger id="canvasLocalEditModel">
+                <SelectValue placeholder="不指定时使用当前模型或系统默认" />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value="__none__">不指定，沿用当前模型/系统默认</SelectItem>
+                {availableImageModels.length > 0 ? (
+                  availableImageModels.map((model) => (
+                    <SelectItem key={model.id} value={model.modelId}>
+                      {formatAiWashModelOptionLabel(model)}
+                    </SelectItem>
+                  ))
+                ) : (
+                  <SelectItem disabled value="__empty__">
+                    暂无可用生图模型，请先到 AI 模型里启用
+                  </SelectItem>
+                )}
+              </SelectContent>
+            </Select>
+            <div className="text-muted-foreground text-xs">
+              适用于手动画框并填写提示词的局部编辑。
+            </div>
+          </div>
+
+          <div className="space-y-2">
+            <Label htmlFor="canvasScaleAdjustModel">比例调整/目标框模型</Label>
+            <Select
+              onValueChange={(value) =>
+                setCanvasLocalEditConfig((prev) => ({
+                  ...prev,
+                  scaleAdjustModelId: value === "__none__" ? "" : value,
+                }))
+              }
+              value={canvasLocalEditConfig.scaleAdjustModelId || "__none__"}
+            >
+              <SelectTrigger id="canvasScaleAdjustModel">
+                <SelectValue placeholder="不指定时兼容旧 AI详情默认模型" />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value="__none__">不指定，兼容旧 AI详情默认模型</SelectItem>
+                {availableImageModels.length > 0 ? (
+                  availableImageModels.map((model) => (
+                    <SelectItem key={model.id} value={model.modelId}>
+                      {formatAiWashModelOptionLabel(model)}
+                    </SelectItem>
+                  ))
+                ) : (
+                  <SelectItem disabled value="__empty__">
+                    暂无可用生图模型，请先到 AI 模型里启用
+                  </SelectItem>
+                )}
+              </SelectContent>
+            </Select>
+            <div className="text-muted-foreground text-xs">
+              适用于截图中“局部编辑/比例”按钮，把商品缩放到青色目标框的流程。
+            </div>
+          </div>
+        </div>
+
+        <Button onClick={handleSaveCanvasLocalEditConfig}>
+          <Save className="mr-2 h-4 w-4" /> 保存局部编辑模型配置
+        </Button>
+      </LocalAiSectionShell>
+
       <LocalAiSectionShell
         description={
           <>
@@ -2215,7 +2366,7 @@ export function LocalAiImagePipelineSections({
       <LocalAiSectionShell
         description={
           <>
-            配置阿里云Dashscope图像拓展API，用于画图标注功能中的图像智能扩展处理
+            配置图像拓展服务，用于画图标注功能中的图像智能扩展处理
           </>
         }
         expanded={isLocalAiSectionExpanded("extend")}
@@ -2225,8 +2376,14 @@ export function LocalAiImagePipelineSections({
           <LocalAiSectionSummary
             items={[
               {
-                label: extendConfig.apiKey ? "Key 已配置" : "Key 待配置",
+                label:
-                tone: extendConfig.apiKey ? "enabled" : "warning",
+                  extendConfig.provider === "vip98k" || extendConfig.apiKey
+                    ? "Key 已配置"
+                    : "Key 待配置",
+                tone:
+                  extendConfig.provider === "vip98k" || extendConfig.apiKey
+                    ? "enabled"
+                    : "warning",
               },
               {
                 label: `${extendConfig.xScale}x / ${extendConfig.yScale}x`,
@@ -2237,6 +2394,12 @@ export function LocalAiImagePipelineSections({
         }
         title="图像拓展API配置"
       >
+        {extendConfig.provider === "vip98k" ? (
+          <div className="rounded-lg border bg-muted/40 p-4 text-sm">
+            使用 VIP98K 的 image-expansion 模型。API Key 从“AI 模型设置”中的
+            VIP98K 服务商读取，仅在这里维护扩展比例。
+          </div>
+        ) : (
         <div className="space-y-2">
           <Label htmlFor="extendApiKey">API密钥 *</Label>
           <Input
@@ -2253,6 +2416,7 @@ export function LocalAiImagePipelineSections({
             sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
           </div>
         </div>
+        )}
         <div className="grid grid-cols-2 gap-4">
           <div className="space-y-2">
             <Label htmlFor="extendXScale">X轴放大倍数 *</Label>

app/(admin)/settings/_components/local-ai-sections/model3d-sections.tsx

@@ -916,8 +916,8 @@ export function LocalAiModel3dSections({
       <LocalAiSectionShell
         description={
           <>
-            配置 AI-CAD 页面后续接入的 KittyCAD / Zoo Text-to-CAD
+            配置官方 HiCAD 使用的 KittyCAD / Zoo 服务，保存后写入数据库 AI
-            服务，保存后写入数据库 AI 提供商配置。
+            提供商配置。
           </>
         }
         expanded={isLocalAiSectionExpanded("kittycad-cad")}
@@ -1003,7 +1003,7 @@ export function LocalAiModel3dSections({
           <div className="space-y-0.5">
             <Label className="text-sm">启用 KittyCAD CAD</Label>
             <div className="text-muted-foreground text-xs">
-              关闭后 AI-CAD 页面将无法切换到外部 CAD 服务
+              关闭后 HiCAD 将无法连接 Zoo 建模和 AI 助手服务
             </div>
           </div>
           <div className="flex items-center gap-2">

app/(admin)/settings/_components/local-ai-sections/planning-sections.tsx

@@ -590,7 +590,7 @@ export function LocalAiPlanningSections({
       <LocalAiSectionShell
         description={
           <>
-            为 AI详情生成 单独配置 Moonshot 官方 Kimi K2.6
+            为 AI详情生成 单独配置 Kimi Code 编程套餐
             模型。保存后会自动绑定到“AI详情生成 - Agent专用模型”。
           </>
         }
@@ -615,7 +615,7 @@ export function LocalAiPlanningSections({
             ]}
           />
         }
-        title={<>Moonshot 官方 Kimi K2.6 配置</>}
+        title={<>Kimi Code 编程套餐配置</>}
       >
         <div className="space-y-2">
           <Label htmlFor="moonshotProviderName">提供商名称</Label>
@@ -627,13 +627,13 @@ export function LocalAiPlanningSections({
                 providerName: e.target.value,
               }))
             }
-            placeholder="Moonshot AI (Official)"
+            placeholder="Kimi Code 编程套餐"
             value={moonshotDetailAgentConfig.providerName}
           />
         </div>
 
         <div className="space-y-2">
-          <Label htmlFor="moonshotBaseUrl">官方 API 地址</Label>
+          <Label htmlFor="moonshotBaseUrl">编程套餐专用 API 地址</Label>
           <Input
             id="moonshotBaseUrl"
             onChange={(e) =>
@@ -646,7 +646,7 @@ export function LocalAiPlanningSections({
             value={moonshotDetailAgentConfig.baseUrl}
           />
           <div className="text-muted-foreground text-xs">
-            根据 Moonshot 官方文档，OpenAI 兼容接口地址为 `
+            根据 Kimi Code 文档，编程套餐 OpenAI 兼容接口地址为 `
             {DETAIL_AGENT_LOCAL_MOONSHOT_BASE_URL}`
           </div>
         </div>
@@ -667,7 +667,7 @@ export function LocalAiPlanningSections({
             placeholder={
               moonshotDetailAgentConfig.providerId
                 ? "留空则不修改当前 Key"
-                : "请输入 Moonshot 官方 API Key"
+                : "请输入 Kimi Code 控制台 API Key"
             }
             type="password"
             value={moonshotDetailAgentConfig.apiKey}
@@ -675,7 +675,7 @@ export function LocalAiPlanningSections({
         </div>
 
         <div className="space-y-2">
-          <Label htmlFor="moonshotModelId">Kimi K2.6 API 模型 ID *</Label>
+          <Label htmlFor="moonshotModelId">Kimi Code API 模型 ID *</Label>
           <Input
             id="moonshotModelId"
             onChange={(e) =>
@@ -688,8 +688,8 @@ export function LocalAiPlanningSections({
             value={moonshotDetailAgentConfig.modelId}
           />
           <div className="text-muted-foreground text-xs">
-            已按你提供的 Moonshot 官方文档默认填写
+            Kimi Code 编程套餐专用接口固定使用
-            `kimi-k2.6`；保存后系统会自动创建/更新对应模型记录。
+            `kimi-for-coding`；保存后系统会自动创建/更新对应模型记录。
           </div>
         </div>
 
@@ -745,7 +745,7 @@ export function LocalAiPlanningSections({
         <div className="flex justify-end">
           <Button onClick={handleSaveMoonshotDetailAgentConfig}>
             <Save className="mr-2 h-4 w-4" />
-            保存 Moonshot Kimi K2.6 配置
+            保存 Kimi Code 编程套餐配置
           </Button>
         </div>
       </LocalAiSectionShell>

app/(admin)/settings/_components/setting-status-badge.tsx

@@ -15,7 +15,7 @@ export function SettingStatusBadge({
   return (
     <Badge
       className={cn(
-        "h-6 rounded-md border px-2 font-medium text-[11px]",
+        "h-5 rounded-md border px-1.5 font-medium text-[10px]",
         tone === "enabled" &&
           "border-emerald-200 bg-emerald-50 text-emerald-700",
         tone === "disabled" && "border-zinc-200 bg-zinc-50 text-zinc-500",

app/(admin)/settings/_lib/local-ai-sections.ts

@@ -12,6 +12,7 @@ export const DEFAULT_LOCAL_AI_EXPANDED_SECTIONS: Record<string, boolean> = {
   rmbg: false,
   enhance: false,
   "enhance-pro": false,
+  "canvas-local-edit": false,
   "ai-wash": false,
   extend: false,
   "watermark-remove": false,

app/(admin)/settings/_lib/settings-navigation.ts

@@ -9,6 +9,7 @@ import {
   MessageSquare,
   Scissors,
   Settings,
+  ShieldAlert,
   Sparkles,
   User,
 } from "lucide-react";
@@ -37,6 +38,12 @@ export const ADMIN_SETTINGS_NAV_GROUPS: AdminSettingsNavGroup[] = [
         description: "用量、趋势与运营指标",
         icon: BarChart3,
       },
+      {
+        value: "access-security",
+        label: "访问安全",
+        description: "访问 IP、异常标注与登录来源",
+        icon: ShieldAlert,
+      },
     ],
   },
   {
@@ -107,3 +114,7 @@ export const ADMIN_SETTINGS_NAV_GROUPS: AdminSettingsNavGroup[] = [
     ],
   },
 ];
+
+export const ADMIN_SETTINGS_NAV_ITEMS = ADMIN_SETTINGS_NAV_GROUPS.flatMap(
+  (group) => group.items
+);

app/(admin)/settings/_lib/types.ts

@@ -1,6 +1,7 @@
 import type { LucideIcon } from "lucide-react";
 import type { Dispatch, DragEvent, ReactNode, SetStateAction } from "react";
 import type { CanvasImageTaskQueueConfig } from "@/lib/canvas/image-task-config";
+import type { CanvasLocalEditConfig } from "@/lib/canvas/local-edit-config";
 import type { AiWashConfig } from "@/lib/ai-wash/config";
 import type {
   EnhanceProKreaConfig,
@@ -88,6 +89,10 @@ export type AdminAiProvider = {
     | "fal-image"
     | "snapgen-image"
     | "openai-image"
+    | "bananaimage"
+    | "visionary"
+    | "atlascloud"
+    | "vip98k"
     | "stepfun-image"
     | "midjourney"
     | "fal-video"
@@ -244,7 +249,7 @@ export type EnhanceProKeyRow = {
 };
 
 export type RmbgConfig = {
-  provider: "rmbg" | "photoroom" | "aoscdn";
+  provider: "vip98k" | "rmbg" | "photoroom" | "aoscdn";
   apiUrl: string;
   apiKey: string;
   photoroomApiKey: string;
@@ -256,6 +261,7 @@ export type RmbgConfig = {
 };
 
 export type EnhanceConfig = {
+  provider: "vip98k" | "legacy";
   apiUrl: string;
   apiKey: string;
   type: string;
@@ -268,6 +274,7 @@ export type EnhanceConfig = {
 };
 
 export type ExtendConfig = {
+  provider: "vip98k" | "dashscope";
   apiKey: string;
   xScale: string;
   yScale: string;
@@ -327,6 +334,8 @@ export type LocalAiImagePipelineSectionsProps = LocalAiSectionControlProps & {
   aiWashConfig: AiWashConfig;
   setAiWashConfig: Dispatch<SetStateAction<AiWashConfig>>;
   aiWashModeIconUploading: boolean;
+  canvasLocalEditConfig: CanvasLocalEditConfig;
+  setCanvasLocalEditConfig: Dispatch<SetStateAction<CanvasLocalEditConfig>>;
   extendConfig: ExtendConfig;
   setExtendConfig: Dispatch<SetStateAction<ExtendConfig>>;
   watermarkRemoveConfig: WatermarkRemoveConfig;
@@ -369,6 +378,7 @@ export type LocalAiImagePipelineSectionsProps = LocalAiSectionControlProps & {
   handleMoveEnhanceProPreset: (fromIndex: number, toIndex: number) => void;
   handleAiWashModeIconUpload: (file: File) => Promise<void>;
   handleSaveAiWashConfig: AsyncAction;
+  handleSaveCanvasLocalEditConfig: AsyncAction;
   handleSaveExtendConfig: AsyncAction;
   handleSaveWatermarkRemoveConfig: AsyncAction;
   handleSaveAngleEditConfig: AsyncAction;

app/(admin)/settings/agent-workflow/agent-workflow-settings-client.tsx

@@ -5933,7 +5933,7 @@ export function AgentWorkflowSettingsClient({
 
   if (isLoading) {
     return (
-      <div className="container mx-auto p-6">
+      <div className="settings-workspace container mx-auto p-4">
         <div className="flex h-[60vh] items-center justify-center">
           <div className="flex items-center gap-3 text-muted-foreground">
             <Loader2 className="h-5 w-5 animate-spin" />
@@ -5945,18 +5945,18 @@ export function AgentWorkflowSettingsClient({
   }
 
   return (
-    <div className="min-h-screen bg-gradient-to-b from-background to-muted/20">
+    <div className="settings-workspace min-h-screen bg-muted/10">
       {/* Header */}
       <header className="sticky top-0 z-30 border-b bg-background/95 backdrop-blur supports-[backdrop-filter]:bg-background/60">
-        <div className="container mx-auto px-6 py-4">
+        <div className="container mx-auto px-4 py-3 sm:px-5">
-          <div className="flex flex-wrap items-center justify-between gap-4">
+          <div className="flex flex-wrap items-center justify-between gap-3">
-            <div className="flex items-center gap-4">
+            <div className="flex items-center gap-3">
-              <div className="flex h-10 w-10 items-center justify-center rounded-xl bg-gradient-to-br from-violet-500 to-purple-600 shadow-lg shadow-violet-500/20">
+              <div className="flex h-8 w-8 items-center justify-center rounded-lg bg-foreground">
-                <Sparkles className="h-5 w-5 text-white" />
+                <Sparkles className="h-4 w-4 text-background" />
               </div>
               <div>
-                <h1 className="text-xl font-semibold tracking-tight">风格化工作流配置</h1>
+                <h1 className="text-base font-semibold">风格化工作流配置</h1>
-                <p className="text-sm text-muted-foreground">
+                <p className="text-xs text-muted-foreground">
                   配置风格化页面的视频海报、素材搜索、品牌模特及工作流步骤
                 </p>
               </div>
@@ -6006,7 +6006,6 @@ export function AgentWorkflowSettingsClient({
                 onClick={handleSave} 
                 disabled={isSaving}
                 size="sm"
-                className="bg-gradient-to-r from-violet-600 to-purple-600 hover:from-violet-500 hover:to-purple-500"
               >
                 {isSaving ? (
                   <Loader2 className="mr-2 h-4 w-4 animate-spin" />
@@ -6142,8 +6141,8 @@ export function AgentWorkflowSettingsClient({
 
       {/* Stats Bar */}
       <div className="border-b bg-muted/30">
-        <div className="container mx-auto px-6 py-3">
+        <div className="container mx-auto px-4 py-2.5 sm:px-5">
-          <div className="flex flex-wrap items-center gap-6">
+          <div className="flex flex-wrap items-center gap-3">
             <div className="flex items-center gap-2">
               <Badge variant="secondary" className="font-mono">
                 {enabledStepsCount}
@@ -6197,8 +6196,8 @@ export function AgentWorkflowSettingsClient({
       </div>
 
       {/* Main Content */}
-      <main className="container mx-auto p-6">
+      <main className="container mx-auto p-4 sm:px-5">
-        <Tabs value={activeTab} onValueChange={setActiveTab} className="space-y-6">
+        <Tabs value={activeTab} onValueChange={setActiveTab} className="space-y-4">
           <TabsList className="grid w-full grid-cols-5 lg:w-fit">
             <TabsTrigger value="showcase" className="gap-2">
               <MonitorPlay className="h-4 w-4" />

app/(admin)/settings/agent-workflow/psd-templates/psd-templates-settings-client.tsx

@@ -2430,17 +2430,17 @@ export function PsdTemplatesSettingsClient({
   );
 
   return (
-    <div className="min-h-screen bg-gradient-to-b from-background to-muted/20">
+    <div className="settings-workspace min-h-screen bg-muted/10">
       <header className="sticky top-0 z-30 border-b bg-background/95 backdrop-blur supports-[backdrop-filter]:bg-background/60">
-        <div className="container mx-auto px-6 py-4">
+        <div className="container mx-auto px-4 py-3 sm:px-5">
-          <div className="flex flex-wrap items-center justify-between gap-4">
+          <div className="flex flex-wrap items-center justify-between gap-3">
-            <div className="flex items-center gap-4">
+            <div className="flex items-center gap-3">
-              <div className="flex h-10 w-10 items-center justify-center rounded-xl bg-gradient-to-br from-orange-500 to-rose-600 shadow-lg shadow-orange-500/20">
+              <div className="flex h-8 w-8 items-center justify-center rounded-lg bg-foreground">
-                <Sparkles className="h-5 w-5 text-white" />
+                <Sparkles className="h-4 w-4 text-background" />
               </div>
               <div>
-                <h1 className="text-xl font-semibold tracking-tight">PSD 模板配置</h1>
+                <h1 className="text-base font-semibold">PSD 模板配置</h1>
-                <p className="text-sm text-muted-foreground">
+                <p className="text-xs text-muted-foreground">
                   上传 PSD 模板、管理字体库、配置图片和文字槽位，并在风格化结果区直接套版导出
                 </p>
               </div>
@@ -2457,7 +2457,6 @@ export function PsdTemplatesSettingsClient({
                 onClick={handleSaveTemplate}
                 disabled={!draftTemplate || isSaving}
                 size="sm"
-                className="bg-gradient-to-r from-orange-600 to-rose-600 hover:from-orange-500 hover:to-rose-500"
               >
                 {isSaving ? (
                   <Loader2 className="mr-2 h-4 w-4 animate-spin" />
@@ -2472,8 +2471,8 @@ export function PsdTemplatesSettingsClient({
       </header>
 
       <div className="border-b bg-muted/30">
-        <div className="container mx-auto px-6 py-3">
+        <div className="container mx-auto px-4 py-2.5 sm:px-5">
-          <div className="flex flex-wrap items-center gap-4">
+          <div className="flex flex-wrap items-center gap-3">
             <Badge variant="secondary" className="font-mono">
               {templates.length}
             </Badge>
@@ -2509,8 +2508,8 @@ export function PsdTemplatesSettingsClient({
         </div>
       </div>
 
-      <div className="container mx-auto px-6 py-6">
+      <div className="container mx-auto px-4 py-4 sm:px-5">
-        <div className="space-y-6">
+        <div className="space-y-4">
           <Card>
             <CardHeader>
               <CardTitle className="text-base">品类标签</CardTitle>

app/(admin)/settings/style-pro/style-pro-settings-client.tsx

@@ -1,7 +1,7 @@
 "use client";
 
-import Link from "next/link";
+import { Plus, Save, Trash2, Wand2 } from "lucide-react";
-import { ArrowLeft, Plus, Save, Trash2, Wand2 } from "lucide-react";
+import { useRouter } from "next/navigation";
 import { useEffect, useMemo, useState } from "react";
 import useSWR from "swr";
 import { toast } from "sonner";
@@ -25,6 +25,7 @@ import {
 import { Switch } from "@/components/ui/switch";
 import { Textarea } from "@/components/ui/textarea";
 import { fetcher } from "@/lib/utils";
+import { AdminSettingsNavigation } from "../_components/admin-settings-navigation";
 import {
   STYLE_PRO_CONFIG_KEY,
   defaultStyleProConfig,
@@ -322,6 +323,7 @@ function CustomFieldEditor({
 }
 
 export function StyleProSettingsClient() {
+  const router = useRouter();
   const { data, mutate } = useSWR<SettingsResponse>(
     `/api/admin/settings?key=${STYLE_PRO_CONFIG_KEY}`,
     fetcher
@@ -561,19 +563,17 @@ export function StyleProSettingsClient() {
   };
 
   return (
-    <main className="mx-auto flex w-full max-w-7xl flex-col gap-6 px-6 py-8">
+    <div className="settings-workspace w-full px-3 py-3 sm:px-4 xl:px-5">
-      <div className="flex flex-col gap-4 md:flex-row md:items-start md:justify-between">
+      <AdminSettingsNavigation
+        activeTab="style-pro"
+        onTabChange={(value) => router.push(`/settings?tab=${value}`)}
+      />
+
+      <main className="mt-6 flex w-full flex-col gap-4">
+        <div className="flex flex-col gap-3 md:flex-row md:items-start md:justify-between">
         <div>
-          <div className="mb-3">
+          <h1 className="font-semibold text-xl">风格化 PRO 设置</h1>
-            <Button asChild variant="outline">
+          <p className="mt-1 max-w-2xl text-muted-foreground text-xs leading-5">
-              <Link href="/settings">
-                <ArrowLeft className="mr-2 h-4 w-4" />
-                返回设置
-              </Link>
-            </Button>
-          </div>
-          <h1 className="font-semibold text-3xl tracking-tight">风格化 PRO 设置</h1>
-          <p className="mt-2 max-w-2xl text-muted-foreground">
             配置无限画布里的风格化 PRO 子页面。用户只看到分类和按钮名称，隐藏提示词和模型只在服务端生成时使用。
           </p>
         </div>
@@ -592,7 +592,7 @@ export function StyleProSettingsClient() {
             {saving ? "保存中" : "保存配置"}
           </Button>
         </div>
-      </div>
+        </div>
 
       <Card>
         <CardHeader>
@@ -1193,6 +1193,7 @@ export function StyleProSettingsClient() {
           ))}
         </CardContent>
       </Card>
-    </main>
+      </main>
+    </div>
   );
 }

app/(auth)/auth.ts

@@ -17,6 +17,7 @@ import {
   requiresSingleActiveSession,
   revokeSingleActiveSession,
 } from "@/lib/auth/session-control";
+import { recordAccessIpEventFromHeaders } from "@/lib/security/access-log";
 
 export type UserType = "guest" | "regular" | "admin" | "agent_admin";
 
@@ -200,7 +201,10 @@ async function resolveRuntimeAuthUrl(settingsAuthUrl?: string | null) {
 }
 
 const nextAuth = NextAuth(async () => {
-  const runtimeAuthSettings = await getAuthSettings().catch(() => null as any);
+  const runtimeAuthSettings =
+    process.env.CANVAS_E2E_LOCAL === "true"
+      ? null
+      : await getAuthSettings().catch(() => null as any);
   const resolvedAuthUrl =
     (await resolveRuntimeAuthUrl(runtimeAuthSettings?.authUrl)) || undefined;
   const googleClientId =
@@ -283,6 +287,32 @@ const nextAuth = NextAuth(async () => {
           delete token.sessionKey;
         }
 
+        if (account && resolvedUserId) {
+          await recordAccessIpEventFromHeaders({
+            eventType: "login_success",
+            userId: resolvedUserId,
+            userEmail:
+              typeof token.email === "string"
+                ? token.email
+                : typeof user?.email === "string"
+                  ? user.email
+                  : null,
+            userRole: resolvedUserType || "regular",
+            method: "POST",
+            path: `/api/auth/${account.provider}`,
+            routeGroup: "auth",
+            statusCode: 200,
+            outcome: "login_success",
+            severity: "info",
+            reasons: ["登录成功"],
+            metadata: {
+              provider: account.provider,
+            },
+          }).catch((error) => {
+            console.warn("[Auth] Failed to record login access event:", error);
+          });
+        }
+
         return token;
       },
       session({ session, token }) {

app/(chat)/ai-cad/page.tsx

@@ -1,7 +1,44 @@
-import { AiCadWorkbench } from "@/components/ai-cad/ai-cad-workbench";
+import { existsSync } from "node:fs";
+import path from "node:path";
+import type { Metadata } from "next";
+import { redirect } from "next/navigation";
+import { auth } from "@/app/(auth)/auth";
+
+const ZOO_MODELING_APP_SRC =
+  "/vendor/zoo-modeling-app/index.html?v=f2b345db-eng1";
 
 export const dynamic = "force-dynamic";
+export const metadata: Metadata = {
+  title: "HiCAD",
+};
+export const runtime = "nodejs";
 
-export default function AiCadPage() {
+export default async function AiCadPage() {
-  return <AiCadWorkbench />;
+  const session = await auth();
+  if (!session?.user?.id) {
+    redirect("/login?callbackUrl=%2Fai-cad");
+  }
+
+  const isReady = existsSync(
+    path.join(process.cwd(), "public/vendor/zoo-modeling-app/index.html")
+  );
+
+  if (isReady) {
+    redirect(ZOO_MODELING_APP_SRC);
+  }
+
+  return (
+    <main className="flex h-svh w-full items-center justify-center bg-[#10100e] p-6 text-[#f8f6ef]">
+      <section className="w-full max-w-xl rounded-lg border border-[#3a352c] bg-[#171510] p-6 shadow-2xl">
+        <h1 className="font-semibold text-lg">HiCAD 官方前端尚未构建</h1>
+        <p className="mt-2 text-[#d3cabb] text-sm leading-6">
+          请运行
+          <code className="mx-1 rounded bg-white/10 px-1.5 py-0.5">
+            pnpm zoo-modeling-app:vendor
+          </code>
+          生成官方前端，然后刷新本页。
+        </p>
+      </section>
+    </main>
+  );
 }

app/(chat)/api/chat/_lib/image-failover.ts

@@ -15,6 +15,10 @@ export const IMAGE_FAILOVER_PROVIDER_ALLOWLIST = new Set([
   "fal-image",
   "snapgen-image",
   "openai-image",
+  "bananaimage",
+  "visionary",
+  "atlascloud",
+  "vip98k",
   "stepfun-image",
   "runway",
   "krea",
@@ -243,6 +247,10 @@ export function getImageFailoverConvertProvider(providerType?: string | null) {
     case "fal-image":
     case "snapgen-image":
     case "openai-image":
+    case "bananaimage":
+    case "visionary":
+    case "atlascloud":
+    case "vip98k":
     case "stepfun-image":
     case "midjourney":
     case "runway":

app/(chat)/api/chat/_lib/image-media.ts

@@ -524,6 +524,10 @@ export async function convertMessagesWithImages(
     normalizedProviderType === "fal-image" ||
     normalizedProviderType === "snapgen-image" ||
     normalizedProviderType === "openai-image" ||
+    normalizedProviderType === "bananaimage" ||
+    normalizedProviderType === "visionary" ||
+    normalizedProviderType === "atlascloud" ||
+    normalizedProviderType === "vip98k" ||
     normalizedProviderType === "stepfun-image" ||
     normalizedProviderType === "midjourney" ||
     normalizedProviderType === "runway" ||

app/(chat)/api/chat/_lib/stream.ts

@@ -7,6 +7,7 @@ import type {
   ResolvedTargetAssets,
 } from "@/lib/ai/context-memory/types";
 import type { CanvasViewOperationPlan } from "@/types/canvas/agent-protocol";
+import type { CanvasCapabilityClientCommand } from "@/lib/canvas/capabilities/client-command";
 import { generateUUID } from "@/lib/utils";
 
 const chatApiLogger = createLogger("chat.stream");
@@ -187,6 +188,10 @@ function normalizeImageLoadingProviderType(providerType?: string | null): string
     normalized === "fal-image" ||
     normalized === "snapgen-image" ||
     normalized === "openai-image" ||
+    normalized === "bananaimage" ||
+    normalized === "visionary" ||
+    normalized === "atlascloud" ||
+    normalized === "vip98k" ||
     normalized === "stepfun-image" ||
     normalized === "midjourney" ||
     normalized === "runway" ||
@@ -421,6 +426,19 @@ export function writeCanvasViewOperationChunk(
   );
 }
 
+export function writeCanvasCapabilityCommandChunk(
+  writer: StreamWriter,
+  command: CanvasCapabilityClientCommand,
+  label: string
+) {
+  writeStructuredDataChunk(
+    writer,
+    "data-canvasCapabilityCommand",
+    command,
+    label
+  );
+}
+
 type AgentTargetLockRefPreview = {
   url: string;
   title?: string;

app/(chat)/api/chat/route.ts

@@ -90,6 +90,10 @@ import {
   hasCanvasAgentPanViewIntent,
 } from "@/lib/canvas/agent-view-pan";
 import { buildCanvasAgentDirectWritebackPlan } from "@/lib/canvas/agent-direct-writeback";
+import {
+  createCanvasCapabilityTools,
+  getCanvasCapabilityToolNames,
+} from "@/lib/canvas/capabilities/ai-sdk-tools";
 import {
   getCanvasAgentOperationErrorMessage,
   normalizeCanvasAgentOperationErrorCode,
@@ -289,6 +293,7 @@ import {
 } from "@/lib/video-agent/task-store";
 import type { StoryboardModelCandidate } from "@/lib/video-agent/types";
 import type { ChatMessage } from "@/lib/types";
+import { collectMessageImageAttachments } from "@/lib/chat/message-image-attachments";
 import type { AppUsage } from "@/lib/usage";
 import { convertToUIMessages, generateUUID } from "@/lib/utils";
 import { isAiModelAgentAuto } from "@/lib/db/ai-model-flags";
@@ -391,6 +396,7 @@ import {
   writeAgentTargetLockChunk,
   writeAssistantTextChunk,
   writeCanvasMediaChunk,
+  writeCanvasCapabilityCommandChunk,
   writeCanvasOperationChunk,
   writeCanvasViewOperationChunk,
   writeImageGenerationStatusChunk,
@@ -1306,7 +1312,7 @@ export async function POST(request: Request) {
                 chatId: id,
                 role: "user",
                 parts: message.parts as any,
-                attachments: [],
+                attachments: collectMessageImageAttachments({ parts: message.parts }),
                 createdAt: new Date(),
                 videoStorageStatus: null,
                 temporaryVideoUrl: null,
@@ -2889,7 +2895,7 @@ export async function POST(request: Request) {
         id: message.id,
         role: "user",
         parts: message.parts as any,
-        attachments: [],
+        attachments: collectMessageImageAttachments({ parts: message.parts }),
         createdAt: new Date(),
         videoStorageStatus: null,
         temporaryVideoUrl: null,
@@ -5739,44 +5745,53 @@ export async function POST(request: Request) {
             );
             const assistantMessageId = generateUUID();
 
-            await saveMessages({
+            try {
-              messages: [
+              await saveMessages({
-                {
+                messages: [
-                  id: assistantMessageId,
+                  {
-                  chatId: id,
+                    id: assistantMessageId,
-                  role: "assistant",
+                    chatId: id,
-                  parts: [{ type: "text", text: assistantText }],
+                    role: "assistant",
-                  attachments: [],
+                    parts: [{ type: "text", text: assistantText }],
-                  createdAt: new Date(),
+                    attachments: [],
-                  videoStorageStatus: null,
+                    createdAt: new Date(),
-                  temporaryVideoUrl: null,
+                    videoStorageStatus: null,
-                  permanentVideoUrl: null,
+                    temporaryVideoUrl: null,
-                  archivedAt: null,
+                    permanentVideoUrl: null,
-                  videoMetadata: null,
+                    archivedAt: null,
-                },
+                    videoMetadata: null,
-              ],
+                  },
-            });
+                ],
+              });
 
-            await saveGeneratedImages(
+              await saveGeneratedImages(
-              assistantText,
+                assistantText,
-              session.user.id,
+                session.user.id,
-              id,
+                id,
-              assistantMessageId,
+                assistantMessageId,
-              params.promptForPersistence || baseReplacementPrompt,
+                params.promptForPersistence || baseReplacementPrompt,
-              resolvedModelRef,
+                resolvedModelRef,
-              {
+                {
-                sourceAssetIds,
+                  sourceAssetIds,
-                sourceImageUrls: params.sourceImageUrls,
+                  sourceImageUrls: params.sourceImageUrls,
-                relationType: "edited_from",
+                  relationType: "edited_from",
-                sourceType: "detail_replacement",
+                  sourceType: "detail_replacement",
-                projectId: contextPayload?.projectId || null,
+                  projectId: contextPayload?.projectId || null,
-                userPrompt: requestTextContent,
+                  userPrompt: requestTextContent,
-                optimizedPrompt: params.promptForPersistence || baseReplacementPrompt,
+                  optimizedPrompt: params.promptForPersistence || baseReplacementPrompt,
-                requestedImageCount: 1,
+                  requestedImageCount: 1,
-                aspectRatio: resolvedAspectRatio,
+                  aspectRatio: resolvedAspectRatio,
-                imageSize: persistedImageSize,
+                  imageSize: persistedImageSize,
-              },
+                },
-            );
+              );
+            } catch (persistError) {
+              chatApiLogger.warn("[Chat API] Failed to persist direct detail replacement result; streaming response anyway:", {
+                chatId: id,
+                referenceId: params.reference.id,
+                referenceLabel: params.reference.label,
+                error: persistError,
+              });
+            }
 
             writeAssistantTextChunk(
               writer,
@@ -5804,6 +5819,7 @@ export async function POST(request: Request) {
               Array.from(replacementReferences.entries()),
               AGENT_REPLACEMENT_PARALLEL_WORKER_COUNT,
               async ([referenceIndex, reference]) => {
+              const itemStartedAt = Date.now();
               if (reference.passthrough === true) {
                 const referenceSourceImageUrls = Array.from(
                   new Set([
@@ -5824,9 +5840,29 @@ export async function POST(request: Request) {
                   streamLabel: "agent-mode:image:detail-replacement:item-passthrough",
                 });
                 successCount += 1;
+                chatApiLogger.info("[Chat API] Direct detail replacement item passthrough completed:", {
+                  referenceIndex: referenceIndex + 1,
+                  totalReferences: replacementReferences.length,
+                  referenceLabel: reference.label,
+                  elapsedMs: Date.now() - itemStartedAt,
+                });
                 return;
               }
 
+              const fallbackSourceImageUrls = Array.from(
+                new Set([
+                  ...productInputImageUrls,
+                  ...(modelInputImageUrl ? [modelInputImageUrl] : []),
+                  ...(reference.rerunReferenceImages || [])
+                    .map((image) => String(image.url || "").trim())
+                    .filter((url) => /^https?:\/\//i.test(url))
+                    .slice(0, 6),
+                  reference.imageUrl,
+                ]),
+              );
+
+              try {
+              const planningStartedAt = Date.now();
               const replacementExecutionPlan = await analyzeReplacementExecutionPlan({
                 modeType: "detail_replacement",
                 replacementStrategy: detailReplacementStrategy,
@@ -5841,10 +5877,12 @@ export async function POST(request: Request) {
                 planningRuntime: replacementScenePlanningRuntime,
                 models: replacementVisionModels,
               });
+              const planningElapsedMs = Date.now() - planningStartedAt;
               chatApiLogger.info("[Chat API] Direct detail replacement reference decision:", {
                 referenceIndex: referenceIndex + 1,
                 totalReferences: replacementReferences.length,
                 referenceLabel: reference.label,
+                planningElapsedMs,
                 shouldReplace: replacementExecutionPlan.shouldReplace,
                 reason: replacementExecutionPlan.reason,
                 detectionSource: replacementExecutionPlan.detectionSource,
@@ -5954,7 +5992,12 @@ export async function POST(request: Request) {
                 hasPromptPackBlock: replacementPrompt.includes("【必须生效的前置场景词包】"),
               });
 
+              let generationStartedAt = 0;
+              let generationElapsedMs: number | null = null;
+              let normalizeStartedAt = 0;
+              let normalizeElapsedMs: number | null = null;
               try {
+                generationStartedAt = Date.now();
                 const result = await generateCanvasImage({
                   prompt: replacementPrompt,
                   negativePrompt: effectiveImageParams?.negativePrompt,
@@ -5994,6 +6037,7 @@ export async function POST(request: Request) {
                         }
                       : undefined,
                 });
+                generationElapsedMs = Date.now() - generationStartedAt;
                 resolvedModelDisplayName = result.model || resolvedModelDisplayName;
                 const firstImage = result.images[0];
                 if (!firstImage) {
@@ -6003,6 +6047,7 @@ export async function POST(request: Request) {
                 let finalImage = firstImage;
                 let finalImageSizeLabel: string = resolvedImageSize;
                 try {
+                  normalizeStartedAt = Date.now();
                   const normalizedImage = await normalizeReplacementResultImage({
                     generatedImageUrl: firstImage.originalUrl,
                     generatedThumbnailUrl: firstImage.thumbnailUrl,
@@ -6016,7 +6061,11 @@ export async function POST(request: Request) {
                     thumbnailUrl: normalizedImage.thumbnailUrl || normalizedImage.originalUrl,
                   };
                   finalImageSizeLabel = normalizedImage.imageSize;
+                  normalizeElapsedMs = Date.now() - normalizeStartedAt;
                 } catch (normalizeError) {
+                  if (normalizeStartedAt > 0 && normalizeElapsedMs === null) {
+                    normalizeElapsedMs = Date.now() - normalizeStartedAt;
+                  }
                   chatApiLogger.warn("[Chat API] Failed to normalize direct detail replacement output:", {
                       referenceLabel: reference.label,
                       referenceImageUrl: reference.imageUrl,
@@ -6034,6 +6083,22 @@ export async function POST(request: Request) {
                   }
                 }
 
+                chatApiLogger.info("[Chat API] Direct detail replacement image generation completed:", {
+                  referenceIndex: referenceIndex + 1,
+                  totalReferences: replacementReferences.length,
+                  referenceLabel: reference.label,
+                  modelDisplayName: resolvedModelDisplayName,
+                  resultImageSize: finalImageSizeLabel,
+                  sourceImageCount: sourceImageUrls.length,
+                  generationAspectRatio,
+                  pageKind: replacementExecutionPlan.scenePlan.pageKind,
+                  generationRoute: replacementExecutionPlan.scenePlan.generationRoute,
+                  promptPackPolicy: replacementExecutionPlan.scenePlan.promptPackPolicy,
+                  elapsedMs: Date.now() - itemStartedAt,
+                  planningElapsedMs,
+                  generationElapsedMs,
+                  normalizeElapsedMs,
+                });
                 await emitReplacementResultMessage({
                   reference,
                   image: finalImage,
@@ -6045,9 +6110,16 @@ export async function POST(request: Request) {
                 });
                 successCount += 1;
               } catch (replacementItemError) {
+                if (generationStartedAt > 0 && generationElapsedMs === null) {
+                  generationElapsedMs = Date.now() - generationStartedAt;
+                }
                 chatApiLogger.error("[Chat API] Direct detail replacement item failed:", {
                   referenceIndex,
                   referenceLabel: reference.label,
+                  elapsedMs: Date.now() - itemStartedAt,
+                  planningElapsedMs,
+                  generationElapsedMs,
+                  normalizeElapsedMs,
                   error: replacementItemError,
                 });
                 await emitReplacementResultMessage({
@@ -6067,6 +6139,30 @@ export async function POST(request: Request) {
                 });
                 successCount += 1;
               }
+              } catch (replacementPlanError) {
+                chatApiLogger.error("[Chat API] Direct detail replacement item failed before generation:", {
+                  referenceIndex,
+                  referenceLabel: reference.label,
+                  elapsedMs: Date.now() - itemStartedAt,
+                  error: replacementPlanError,
+                });
+                await emitReplacementResultMessage({
+                  reference,
+                  bodyText: `生成失败，当前先沿用参考图：${
+                    replacementPlanError instanceof Error
+                      ? replacementPlanError.message
+                      : "请稍后重试"
+                  }`,
+                  image: {
+                    originalUrl: reference.imageUrl,
+                    thumbnailUrl: reference.imageUrl,
+                  },
+                  modelDisplayName: null,
+                  sourceImageUrls: fallbackSourceImageUrls,
+                  streamLabel: "agent-mode:image:detail-replacement:item-fallback",
+                });
+                successCount += 1;
+              }
             });
           } finally {
             stopKeepalive();
@@ -7715,6 +7811,17 @@ export async function POST(request: Request) {
     const directAgentExecution = directAgentToolContext?.execution || null;
     const directAgentToolTargetImageUrls = directAgentToolContext?.targetImageUrls || [];
     const directAgentToolTargetImageUrl = directAgentToolContext?.targetImageUrl || null;
+    const selectedCanvasImageNodeIds = (
+      requestCanvasAgentContext?.selectedNodes || []
+    )
+      .filter((node) => node.type === "image")
+      .map((node) => node.nodeId)
+      .filter(Boolean);
+    const shouldUseCanvasCapabilityToolLoop = Boolean(
+      contextPayload?.source === "canvas" &&
+        contextPayload.projectId &&
+        selectedCanvasImageNodeIds.length > 0
+    );
 
     if (
       shouldRunAgentConversation &&
@@ -8264,6 +8371,7 @@ export async function POST(request: Request) {
       shouldRunAgentConversation &&
       !smartAutoNeedsClarification &&
       directAgentExecution &&
+      !shouldUseCanvasCapabilityToolLoop &&
       isDirectAgentImageEditToolName(directAgentExecution.toolName)
     ) {
       const directAgentToolCapability = directAgentExecution.capability;
@@ -8710,6 +8818,14 @@ export async function POST(request: Request) {
       agentIdentityInstruction,
       recentDialogueSystemContext,
       baseConversationSystemPrompt,
+      shouldUseCanvasCapabilityToolLoop
+        ? [
+            "当前请求来自无限画布，且用户已明确选中图片节点。",
+            "涉及选中图片的识别、编辑、生成、3D、改名、批注或删除时，必须调用已提供的画布能力工具，不得只用文字声称完成。",
+            "可以连续调用多个工具；下一步要处理上一步结果时，把上一步返回的 createdNodeIds 作为 nodeIds。",
+            "只有工具返回成功后才能告诉用户已完成；若工具返回 interactive，说明已在画布打开对应交互界面并等待用户操作。",
+          ].join("\n")
+        : "",
     ]
       .filter(Boolean)
       .join("\n\n");
@@ -9103,6 +9219,10 @@ export async function POST(request: Request) {
                   "fal-image": 4,
                   "snapgen-image": 5,
                   "openai-image": 6,
+                  bananaimage: 7,
+                  visionary: 7,
+                  atlascloud: 7,
+                  vip98k: 7,
                   "stepfun-image": 7,
                   "grsai-gpt-image": 8,
                   runway: 9,
@@ -9494,6 +9614,10 @@ export async function POST(request: Request) {
         "fal-image",
         "snapgen-image",
         "openai-image",
+        "bananaimage",
+        "visionary",
+        "atlascloud",
+        "vip98k",
         "stepfun-image",
         "midjourney",
         "runway",
@@ -9716,6 +9840,14 @@ export async function POST(request: Request) {
                       ? "snapgen-image"
                     : (languageModel as any).provider === "openai-image"
                       ? "openai-image"
+                    : (languageModel as any).provider === "bananaimage"
+                      ? "bananaimage"
+                    : (languageModel as any).provider === "visionary"
+                      ? "visionary"
+                    : (languageModel as any).provider === "atlascloud"
+                      ? "atlascloud"
+                    : (languageModel as any).provider === "vip98k"
+                      ? "vip98k"
                     : (languageModel as any).provider === "stepfun-image"
                       ? "stepfun-image"
                       : (languageModel as any).provider === "midjourney"
@@ -9819,6 +9951,10 @@ export async function POST(request: Request) {
                   "fal-image": 4,
                   "snapgen-image": 5,
                   "openai-image": 6,
+                  bananaimage: 7,
+                  visionary: 7,
+                  atlascloud: 7,
+                  vip98k: 7,
                   "stepfun-image": 7,
                   runway: 8,
                   krea: 9,
@@ -9862,6 +9998,14 @@ export async function POST(request: Request) {
                             ? "snapgen-image"
                           : candidate.provider.type === "openai-image"
                             ? "openai-image"
+                          : candidate.provider.type === "bananaimage"
+                            ? "bananaimage"
+                          : candidate.provider.type === "visionary"
+                            ? "visionary"
+                          : candidate.provider.type === "atlascloud"
+                            ? "atlascloud"
+                          : candidate.provider.type === "vip98k"
+                            ? "vip98k"
                           : candidate.provider.type === "stepfun-image"
                             ? "stepfun-image"
                             : candidate.provider.type === "midjourney"
@@ -10248,6 +10392,10 @@ export async function POST(request: Request) {
                   "fal-image": 3,
                   "snapgen-image": 4,
                   "openai-image": 5,
+                  bananaimage: 6,
+                  visionary: 6,
+                  atlascloud: 6,
+                  vip98k: 6,
                   "stepfun-image": 6,
                   runway: 7,
                   krea: 8,
@@ -10292,6 +10440,14 @@ export async function POST(request: Request) {
                             ? "snapgen-image"
                           : candidate.provider.type === "openai-image"
                             ? "openai-image"
+                          : candidate.provider.type === "bananaimage"
+                            ? "bananaimage"
+                          : candidate.provider.type === "visionary"
+                            ? "visionary"
+                          : candidate.provider.type === "atlascloud"
+                            ? "atlascloud"
+                          : candidate.provider.type === "vip98k"
+                            ? "vip98k"
                           : candidate.provider.type === "stepfun-image"
                             ? "stepfun-image"
                             : candidate.provider.type === "midjourney"
@@ -10505,7 +10661,7 @@ export async function POST(request: Request) {
 
     // ========== 千问/FAL/RUXA 视频生成独立处理 ==========
     if (
-      ["qianwen-video", "fal-video", "ruxa-video", "runway", "krea", "bltcy-video"].includes((languageModel as any).provider) &&
+      ["qianwen-video", "fal-video", "ruxa-video", "runway", "krea", "bltcy-video", "vip98k"].includes((languageModel as any).provider) &&
       typeof (languageModel as any).doGenerate === "function"
     ) {
       const currentVideoProvider = (languageModel as any).provider as
@@ -10514,7 +10670,8 @@ export async function POST(request: Request) {
         | "ruxa-video"
         | "runway"
         | "krea"
-        | "bltcy-video";
+        | "bltcy-video"
+        | "vip98k";
       chatApiLogger.info(`[Chat API] Using ${currentVideoProvider} video generation`);
       
       const videoGenerationStream = createUIMessageStream({
@@ -10937,6 +11094,52 @@ export async function POST(request: Request) {
           chatApiLogger.info("[Smart Auto Mode] 🚫 generateVideo tool disabled (manual video mode not selected)");
         }
 
+        if (
+          contextPayload?.source === "canvas" &&
+          contextPayload.projectId &&
+          selectedCanvasImageNodeIds.length > 0
+        ) {
+          const canvasCapabilityTools = await createCanvasCapabilityTools({
+            projectId: contextPayload.projectId,
+            selectedNodeIds: selectedCanvasImageNodeIds,
+            userId: session.user.id,
+            requestHeaders: request.headers,
+            requestUrl: request.url,
+            defaultModelId: finalModelId,
+            destructiveConfirmed: isCanvasOperationConfirmText(requestTextContent),
+            callbacks: {
+              onClientCommand: (command, capability) => {
+                writeCanvasCapabilityCommandChunk(
+                  dataStream as unknown as StreamWriter,
+                  command,
+                  `canvas-capability:${capability.id}:client-command`
+                );
+              },
+              onResult: (runtimeResult, capability) => {
+                if (!runtimeResult.operation) return;
+                writeCanvasOperationChunk(
+                  dataStream as unknown as StreamWriter,
+                  {
+                    projectId: contextPayload.projectId!,
+                    operationId: runtimeResult.task.requestId,
+                    operation: capability.id,
+                    status: "applied",
+                    createdNodeIds: runtimeResult.operation.createdNodeIds,
+                    createdNodeIdsByMediaItemId:
+                      runtimeResult.operation.createdNodeIdsByMediaItemId,
+                    updatedNodeIds: runtimeResult.operation.updatedNodeIds,
+                    canvasRevision: runtimeResult.operation.canvasRevision,
+                    message: `${capability.title}已完成`,
+                  },
+                  `canvas-capability:${capability.id}:operation`
+                );
+              },
+            },
+          });
+          Object.assign(tools, canvasCapabilityTools);
+          activeTools.push(...getCanvasCapabilityToolNames(canvasCapabilityTools));
+        }
+
         chatApiLogger.info("[Chat API] Calling streamText with model:", (languageModel as any).modelId, (languageModel as any).provider); // 调试日志
         chatApiLogger.info("[Chat API] Provider type:", (languageModel as any).provider); // 调试日志
 
@@ -11121,6 +11324,10 @@ export async function POST(request: Request) {
                   "fal-image": 4,
                   "snapgen-image": 5,
                   "openai-image": 6,
+                  bananaimage: 7,
+                  visionary: 7,
+                  atlascloud: 7,
+                  vip98k: 7,
                   "stepfun-image": 7,
                   runway: 8,
                   krea: 9,
@@ -11167,6 +11374,14 @@ export async function POST(request: Request) {
                             ? "snapgen-image"
                           : candidate.provider.type === "openai-image"
                             ? "openai-image"
+                          : candidate.provider.type === "bananaimage"
+                            ? "bananaimage"
+                          : candidate.provider.type === "visionary"
+                            ? "visionary"
+                          : candidate.provider.type === "atlascloud"
+                            ? "atlascloud"
+                          : candidate.provider.type === "vip98k"
+                            ? "vip98k"
                           : candidate.provider.type === "stepfun-image"
                             ? "stepfun-image"
                             : candidate.provider.type === "midjourney"
@@ -11924,9 +12139,13 @@ export async function POST(request: Request) {
           model: languageModel,
           system: effectiveConversationSystemPrompt,
           messages: convertedMessages,
-          stopWhen: stepCountIs(5),
+          stopWhen: stepCountIs(shouldUseCanvasCapabilityToolLoop ? 8 : 5),
           experimental_activeTools:
-            finalModelId === "chat-model-reasoning" || isVolcanoVideoModel ? [] : activeTools,
+            (finalModelId === "chat-model-reasoning" &&
+              !shouldUseCanvasCapabilityToolLoop) ||
+            isVolcanoVideoModel
+              ? []
+              : activeTools,
           experimental_transform: shouldDisableSmoothStream
             ? undefined
             : smoothStream({ chunking: "word" }),

app/(chat)/api/chat/schema.ts

@@ -48,6 +48,7 @@ const imageParamsSchema = z.object({
   aspectRatio: z.string().optional(),
   imageSize: z.preprocess(normalizeImageSizeInput, z.enum(imageSizeValues).optional()),
   imageCount: z.number().min(1).max(10).optional(),
+  quality: z.enum(["auto", "low", "medium", "high"]).optional(),
   // 阿里生图专用参数
   size: z.string().optional(),           // 自定义分辨率，如 "1024*1024"
   negativePrompt: z.string().optional(), // 反向提示词

app/(chat)/api/files/direct-upload/route.ts

@@ -3,6 +3,7 @@ import {
   CompleteMultipartUploadCommand,
   CreateMultipartUploadCommand,
   HeadObjectCommand,
+  ListPartsCommand,
   PutObjectCommand,
   UploadPartCommand,
 } from "@aws-sdk/client-s3";
@@ -21,12 +22,22 @@ import {
   maybeEnqueueStorageMigrationTask,
   resolveS3UploadTarget,
 } from "@/lib/storage/service";
+import {
+  getOpenClawChatFileContentType,
+  isOpenClawChatFolderFileAllowed,
+  OPENCLAW_CHAT_FILE_MAX_BYTES,
+  OPENCLAW_CHAT_FILE_UPLOAD_PURPOSE,
+  OPENCLAW_CHAT_FOLDER_UPLOAD_PURPOSE,
+  OPENCLAW_CHAT_VIDEO_MAX_BYTES,
+  OPENCLAW_CHAT_VIDEO_UPLOAD_PURPOSE,
+} from "@/lib/openclaw-chat/media-attachments";
 
 const logger = createLogger("direct-upload-api");
-const DIRECT_UPLOAD_MAX_BYTES = 500 * 1024 * 1024;
+const DIRECT_UPLOAD_MAX_BYTES = OPENCLAW_CHAT_FILE_MAX_BYTES;
+const DIRECT_UPLOAD_MEDIA_MAX_BYTES = 500 * 1024 * 1024;
 const MULTIPART_THRESHOLD_BYTES = 50 * 1024 * 1024;
 const DEFAULT_PART_SIZE_BYTES = 8 * 1024 * 1024;
-const PRESIGNED_URL_EXPIRES_SECONDS = 15 * 60;
+const PRESIGNED_URL_EXPIRES_SECONDS = 6 * 60 * 60;
 const DIRECT_UPLOAD_PREFIX = "uploads/direct";
 
 function elapsedMs(startedAt: number) {
@@ -39,6 +50,13 @@ const allowedDirectUploadTypes = new Set([
   "image/png",
   "image/webp",
 ]);
+const allowedOpenClawVideoUploadTypes = new Set([
+  "video/mp4",
+  "video/quicktime",
+  "video/webm",
+  "video/x-m4v",
+  "video/x-matroska",
+]);
 
 const InitiateSchema = z.object({
   action: z.literal("initiate"),
@@ -68,6 +86,18 @@ const CompleteSchema = z.object({
   clientUploadId: z.string().max(128).optional(),
 });
 
+const ResumeSchema = z.object({
+  action: z.literal("resume"),
+  key: z.string().min(1).max(512),
+  uploadId: z.string().min(1).max(512),
+  filename: z.string().min(1).max(256),
+  contentType: z.string().min(1).max(128),
+  size: z.number().int().positive().max(DIRECT_UPLOAD_MAX_BYTES),
+  partSize: z.number().int().min(5 * 1024 * 1024).max(128 * 1024 * 1024),
+  purpose: z.string().max(64).optional(),
+  clientUploadId: z.string().max(128).optional(),
+});
+
 const AbortSchema = z.object({
   action: z.literal("abort"),
   key: z.string().min(1).max(512),
@@ -77,6 +107,7 @@ const AbortSchema = z.object({
 
 const RequestSchema = z.discriminatedUnion("action", [
   InitiateSchema,
+  ResumeSchema,
   CompleteSchema,
   AbortSchema,
 ]);
@@ -104,19 +135,49 @@ function assertUserOwnedKey(key: string, userId: string) {
   const normalized = String(key || "").replace(/^\/+/, "");
   const prefix = `${userUploadPrefix(userId)}/`;
   if (!normalized.startsWith(prefix)) {
-    throw new Error("Invalid upload object key");
+    const error = new Error("Invalid upload object key");
+    error.name = "InvalidUploadObjectKeyError";
+    throw error;
   }
   return normalized;
 }
 
-function isAllowedDirectUpload(contentType: string) {
+function isAllowedDirectUpload(
-  return allowedDirectUploadTypes.has(contentType);
+  contentType: string,
+  purpose: string | undefined,
+  filename: string
+) {
+  return (
+    allowedDirectUploadTypes.has(contentType) ||
+    (purpose === OPENCLAW_CHAT_VIDEO_UPLOAD_PURPOSE &&
+      allowedOpenClawVideoUploadTypes.has(contentType)) ||
+    (purpose === OPENCLAW_CHAT_FILE_UPLOAD_PURPOSE &&
+      Boolean(
+        getOpenClawChatFileContentType({ name: filename, type: contentType })
+      )) ||
+    (purpose === OPENCLAW_CHAT_FOLDER_UPLOAD_PURPOSE &&
+      isOpenClawChatFolderFileAllowed({ name: filename, type: contentType }))
+  );
+}
+
+function getPurposeMaxBytes(purpose?: string) {
+  if (purpose === OPENCLAW_CHAT_VIDEO_UPLOAD_PURPOSE) {
+    return OPENCLAW_CHAT_VIDEO_MAX_BYTES;
+  }
+  if (
+    purpose === OPENCLAW_CHAT_FILE_UPLOAD_PURPOSE ||
+    purpose === OPENCLAW_CHAT_FOLDER_UPLOAD_PURPOSE
+  ) {
+    return DIRECT_UPLOAD_MAX_BYTES;
+  }
+  return DIRECT_UPLOAD_MEDIA_MAX_BYTES;
 }
 
 function computePartSize(size: number) {
   if (size <= 100 * 1024 * 1024) return DEFAULT_PART_SIZE_BYTES;
-  if (size <= 300 * 1024 * 1024) return 12 * 1024 * 1024;
+  if (size <= 500 * 1024 * 1024) return 16 * 1024 * 1024;
-  return 16 * 1024 * 1024;
+  if (size <= 1024 * 1024 * 1024) return 32 * 1024 * 1024;
+  return 64 * 1024 * 1024;
 }
 
 async function createPartUrls(params: {
@@ -124,24 +185,24 @@ async function createPartUrls(params: {
   bucket: string;
   key: string;
   uploadId: string;
-  partCount: number;
+  partNumbers: number[];
 }) {
-  const urls = [];
+  return Promise.all(
-  for (let partNumber = 1; partNumber <= params.partCount; partNumber += 1) {
+    params.partNumbers.map(async (partNumber) => {
-    const command = new UploadPartCommand({
+      const command = new UploadPartCommand({
-      Bucket: params.bucket,
+        Bucket: params.bucket,
-      Key: params.key,
+        Key: params.key,
-      UploadId: params.uploadId,
+        UploadId: params.uploadId,
-      PartNumber: partNumber,
+        PartNumber: partNumber,
-    });
+      });
-    urls.push({
+      return {
-      partNumber,
+        partNumber,
-      url: await getSignedUrl(params.client, command, {
+        url: await getSignedUrl(params.client, command, {
-        expiresIn: PRESIGNED_URL_EXPIRES_SECONDS,
+          expiresIn: PRESIGNED_URL_EXPIRES_SECONDS,
-      }),
+        }),
-    });
+      };
-  }
+    })
-  return urls;
+  );
 }
 
 export async function POST(request: Request) {
@@ -204,7 +265,7 @@ export async function POST(request: Request) {
         payload.filename
       );
 
-      if (!isAllowedDirectUpload(contentType)) {
+      if (!isAllowedDirectUpload(contentType, payload.purpose, payload.filename)) {
         logger.warn("unsupported_direct_upload_type", {
           contentType,
           filenameExtension: payload.filename.toLowerCase().split(".").pop() || null,
@@ -213,10 +274,19 @@ export async function POST(request: Request) {
           clientUploadId: payload.clientUploadId || null,
         });
         return NextResponse.json(
-          { error: "Direct upload only supports JPG, PNG and WebP images" },
+          {
+            error:
+              "直传仅支持图片、Claw 视频、压缩包、表格和文件夹清单",
+          },
           { status: 400 }
         );
       }
+      if (payload.size > getPurposeMaxBytes(payload.purpose)) {
+        return NextResponse.json(
+          { error: `文件不能超过 ${getPurposeMaxBytes(payload.purpose) / 1024 / 1024}MB` },
+          { status: 413 }
+        );
+      }
 
       const displayName = sanitizeDisplayName(payload.filename);
       const key = buildStorageObjectKey(
@@ -224,7 +294,13 @@ export async function POST(request: Request) {
         userUploadPrefix(session.user.id)
       );
 
-      if (payload.size < MULTIPART_THRESHOLD_BYTES) {
+      const multipartThreshold =
+        payload.purpose === OPENCLAW_CHAT_FILE_UPLOAD_PURPOSE ||
+        payload.purpose === OPENCLAW_CHAT_VIDEO_UPLOAD_PURPOSE ||
+        payload.purpose === OPENCLAW_CHAT_FOLDER_UPLOAD_PURPOSE
+          ? DEFAULT_PART_SIZE_BYTES
+          : MULTIPART_THRESHOLD_BYTES;
+      if (payload.size < multipartThreshold) {
         const presignStartedAt = Date.now();
         const command = new PutObjectCommand({
           Bucket: bucket,
@@ -243,7 +319,6 @@ export async function POST(request: Request) {
           contentType,
           clientUploadId: payload.clientUploadId || null,
         });
-
         const headers: Record<string, string> = {
           "Content-Type": contentType,
           "Cache-Control": "public, max-age=31536000, immutable",
@@ -285,7 +360,7 @@ export async function POST(request: Request) {
         bucket,
         key,
         uploadId,
-        partCount,
+        partNumbers: Array.from({ length: partCount }, (_, index) => index + 1),
       });
       logger.info("direct_upload_multipart_prepared", {
         elapsedMs: elapsedMs(multipartStartedAt),
@@ -309,6 +384,98 @@ export async function POST(request: Request) {
       });
     }
 
+    if (payload.action === "resume") {
+      const key = assertUserOwnedKey(payload.key, session.user.id);
+      const contentType = normalizeContentType(payload.contentType, payload.filename);
+      if (!isAllowedDirectUpload(contentType, payload.purpose, payload.filename)) {
+        return NextResponse.json({ error: "不支持续传该文件类型" }, { status: 400 });
+      }
+      if (payload.size > getPurposeMaxBytes(payload.purpose)) {
+        return NextResponse.json({ error: "文件超过允许的上传大小" }, { status: 413 });
+      }
+      const expectedPartSize = computePartSize(payload.size);
+      if (payload.partSize !== expectedPartSize) {
+        return NextResponse.json(
+          { error: "续传分片参数已失效，请重新开始上传", code: "RESUME_SESSION_EXPIRED" },
+          { status: 409 }
+        );
+      }
+
+      try {
+        const listed = await client.send(
+          new ListPartsCommand({
+            Bucket: bucket,
+            Key: key,
+            UploadId: payload.uploadId,
+            MaxParts: 1000,
+          })
+        );
+        const uploadedParts = (listed.Parts || []).flatMap((part) => {
+          if (!part.ETag || typeof part.PartNumber !== "number") return [];
+          return [
+            {
+              ETag: part.ETag,
+              PartNumber: part.PartNumber,
+              size: Number(part.Size || 0),
+            },
+          ];
+        });
+        const uploadedPartNumbers = new Set(
+          uploadedParts.map((part) => part.PartNumber)
+        );
+        const partCount = Math.ceil(payload.size / expectedPartSize);
+        const missingPartNumbers = Array.from(
+          { length: partCount },
+          (_, index) => index + 1
+        ).filter((partNumber) => !uploadedPartNumbers.has(partNumber));
+        const parts = await createPartUrls({
+          client,
+          bucket,
+          key,
+          uploadId: payload.uploadId,
+          partNumbers: missingPartNumbers,
+        });
+
+        logger.info("direct_upload_multipart_resumed", {
+          totalElapsedMs: elapsedMs(requestStartedAt),
+          size: payload.size,
+          uploadedPartCount: uploadedParts.length,
+          missingPartCount: missingPartNumbers.length,
+          clientUploadId: payload.clientUploadId || null,
+        });
+        return NextResponse.json({
+          mode: "multipart",
+          key,
+          uploadId: payload.uploadId,
+          partSize: expectedPartSize,
+          partCount,
+          parts,
+          uploadedParts,
+          resumed: true,
+          expiresIn: PRESIGNED_URL_EXPIRES_SECONDS,
+          clientUploadId: payload.clientUploadId || null,
+        });
+      } catch (error) {
+        const head = await client
+          .send(new HeadObjectCommand({ Bucket: bucket, Key: key }))
+          .catch(() => null);
+        if (head?.ContentLength === payload.size) {
+          return NextResponse.json({
+            mode: "completed",
+            key,
+            clientUploadId: payload.clientUploadId || null,
+          });
+        }
+        logger.warn("direct_upload_resume_session_missing", error, {
+          clientUploadId: payload.clientUploadId || null,
+        });
+        return NextResponse.json(
+          { error: "续传会话已失效，请重新开始上传", code: "RESUME_SESSION_EXPIRED" },
+          { status: 409 }
+        );
+      }
+    }
+
     if (payload.action === "abort") {
       const key = assertUserOwnedKey(payload.key, session.user.id);
       const abortStartedAt = Date.now();
@@ -329,12 +496,18 @@ export async function POST(request: Request) {
 
     const key = assertUserOwnedKey(payload.key, session.user.id);
     const contentType = normalizeContentType(payload.contentType, payload.filename);
-    if (!isAllowedDirectUpload(contentType)) {
+    if (!isAllowedDirectUpload(contentType, payload.purpose, payload.filename)) {
       return NextResponse.json(
-        { error: "Direct upload only supports JPG, PNG and WebP images" },
+        {
+          error:
+            "直传仅支持图片、Claw 视频、压缩包、表格和文件夹清单",
+        },
         { status: 400 }
       );
     }
+    if (payload.size > getPurposeMaxBytes(payload.purpose)) {
+      return NextResponse.json({ error: "文件超过允许的上传大小" }, { status: 413 });
+    }
 
     if (payload.uploadId) {
       const completeMultipartStartedAt = Date.now();
@@ -380,8 +553,10 @@ export async function POST(request: Request) {
 
     const actualSize =
       typeof head.ContentLength === "number" ? head.ContentLength : null;
-    if (actualSize !== null && actualSize <= 0) {
+    if (actualSize !== null && actualSize !== payload.size) {
-      throw new Error("Uploaded object is empty");
+      throw new Error(
+        `Uploaded object size mismatch: expected ${payload.size}, received ${actualSize}`
+      );
     }
 
     const url = buildS3PublicUrl(target.config, key);
@@ -390,15 +565,43 @@ export async function POST(request: Request) {
     const assetStartedAt = Date.now();
     const asset = await upsertMediaAsset({
       userId: session.user.id,
-      mediaType: "image",
+      mediaType:
-      sourceType: "upload",
+        payload.purpose === OPENCLAW_CHAT_FILE_UPLOAD_PURPOSE ||
+        payload.purpose === OPENCLAW_CHAT_FOLDER_UPLOAD_PURPOSE
+          ? "file"
+          : resolvedContentType.startsWith("video/")
+            ? "video"
+            : "image",
+      sourceType:
+        payload.purpose === OPENCLAW_CHAT_VIDEO_UPLOAD_PURPOSE
+          ? "openclaw_chat_video_upload"
+          : payload.purpose === OPENCLAW_CHAT_FILE_UPLOAD_PURPOSE
+            ? "openclaw_chat_file_upload"
+            : payload.purpose === OPENCLAW_CHAT_FOLDER_UPLOAD_PURPOSE
+              ? "openclaw_chat_folder_file_upload"
+            : "upload",
       status: "ready",
       originalUrl: url,
-      previewUrl: url,
+      previewUrl:
-      thumbnailUrl: url,
+        payload.purpose === OPENCLAW_CHAT_FILE_UPLOAD_PURPOSE ||
+        payload.purpose === OPENCLAW_CHAT_FOLDER_UPLOAD_PURPOSE
+          ? null
+          : url,
+      thumbnailUrl:
+        payload.purpose === OPENCLAW_CHAT_FILE_UPLOAD_PURPOSE ||
+        payload.purpose === OPENCLAW_CHAT_FOLDER_UPLOAD_PURPOSE
+          ? null
+          : url,
       mimeType: resolvedContentType,
       displayName: payload.filename,
-      sourceTable: "direct_upload",
+      sourceTable:
+        payload.purpose === OPENCLAW_CHAT_VIDEO_UPLOAD_PURPOSE
+          ? "openclaw_chat_video_upload"
+          : payload.purpose === OPENCLAW_CHAT_FILE_UPLOAD_PURPOSE
+            ? "openclaw_chat_file_upload"
+            : payload.purpose === OPENCLAW_CHAT_FOLDER_UPLOAD_PURPOSE
+              ? "openclaw_chat_folder_file_upload"
+            : "direct_upload",
       metadata: {
         pathname: key,
         size: actualSize ?? payload.size,
@@ -445,7 +648,13 @@ export async function POST(request: Request) {
         error: "Direct upload failed",
         details: error instanceof Error ? error.message : String(error),
       },
-      { status: 500 }
+      {
+        status:
+          error instanceof Error &&
+          error.name === "InvalidUploadObjectKeyError"
+            ? 403
+            : 500,
+      }
     );
   }
 }

app/(chat)/api/files/upload/route.ts

@@ -7,6 +7,7 @@ import { upsertMediaAsset } from "@/lib/db/queries";
 import { isSiteAdminType } from "@/lib/middleware/admin";
 import { getContentType, uploadFile } from "@/lib/storage/service";
 import { createLogger } from "@/lib/observability/logger";
+import { OPENCLAW_CHAT_VIDEO_UPLOAD_PURPOSE } from "@/lib/openclaw-chat/media-attachments";
 
 const logger = createLogger("upload-api");
 const ALLOWED_UPLOAD_IMAGE_TYPES = new Set([
@@ -14,12 +15,32 @@ const ALLOWED_UPLOAD_IMAGE_TYPES = new Set([
   "image/jpg",
   "image/png",
   "image/webp",
+  "image/avif",
+  "image/tiff",
+  "image/x-tiff",
   "image/svg+xml",
   "image/heic",
   "image/heif",
 ]);
+const ALLOWED_ATLASCLOUD_VIDEO_TYPES = new Set([
+  "video/mp4",
+  "video/quicktime",
+  "video/webm",
+]);
+const ALLOWED_OPENCLAW_VIDEO_TYPES = new Set([
+  "video/mp4",
+  "video/quicktime",
+  "video/webm",
+  "video/x-m4v",
+  "video/x-matroska",
+]);
 
 const HEIC_UPLOAD_TYPES = new Set(["image/heic", "image/heif"]);
+const SHARP_COMPATIBILITY_UPLOAD_TYPES = new Set([
+  "image/avif",
+  "image/tiff",
+  "image/x-tiff",
+]);
 
 function normalizeUploadContentType(contentType: string, filename: string) {
   const normalized = contentType.trim().toLowerCase();
@@ -35,8 +56,16 @@ function createUnsupportedImageTypeMessage(contentType: string, filename: string
   if (contentType === "image/heic" || contentType === "image/heif" || extension === "heic" || extension === "heif") {
     return "HEIC/HEIF 图片转码失败，请在手机相册中导出为 JPG/PNG 后再上传。";
   }
+  if (
+    SHARP_COMPATIBILITY_UPLOAD_TYPES.has(contentType) ||
+    extension === "avif" ||
+    extension === "tif" ||
+    extension === "tiff"
+  ) {
+    return "AVIF/TIFF 图片转码失败，请导出为 JPG/PNG 后再上传。";
+  }
 
-  return "File type should be JPEG, PNG, WebP or SVG";
+  return "图片格式不支持，请上传 JPG、PNG、WebP、HEIC、AVIF 或 TIFF 图片。";
 }
 
 function isHeicUpload(contentType: string, filename: string) {
@@ -48,10 +77,20 @@ function isHeicUpload(contentType: string, filename: string) {
   );
 }
 
+function isSharpCompatibilityUpload(contentType: string, filename: string) {
+  const extension = filename.toLowerCase().split(".").pop() || "";
+  return (
+    SHARP_COMPATIBILITY_UPLOAD_TYPES.has(contentType) ||
+    extension === "avif" ||
+    extension === "tif" ||
+    extension === "tiff"
+  );
+}
+
 function toJpegFilename(filename: string) {
   const trimmed = filename.trim() || `upload-${Date.now()}`;
-  if (/\.(heic|heif)$/i.test(trimmed)) {
+  if (/\.(avif|heic|heif|tif|tiff)$/i.test(trimmed)) {
-    return trimmed.replace(/\.(heic|heif)$/i, ".jpg");
+    return trimmed.replace(/\.(avif|heic|heif|tif|tiff)$/i, ".jpg");
   }
   if (/\.[a-z0-9]+$/i.test(trimmed)) {
     return trimmed.replace(/\.[a-z0-9]+$/i, ".jpg");
@@ -71,6 +110,21 @@ async function convertHeicToJpeg(buffer: Buffer): Promise<Buffer> {
   }
   return Buffer.from(output);
 }
+
+async function convertSharpCompatibilityImageToJpeg(
+  buffer: Buffer
+): Promise<Buffer> {
+  const sharp = (await import("sharp")).default;
+  return sharp(buffer, { animated: false, failOn: "none" })
+    .rotate()
+    .flatten({ background: "#ffffff" })
+    .jpeg({
+      quality: 92,
+      mozjpeg: true,
+      progressive: true,
+    })
+    .toBuffer();
+}
 /**
  * 使用Sharp智能优化图片（保持原格式）
  * 策略：避免双重压缩，只在需要时优化
@@ -197,6 +251,12 @@ export async function POST(request: Request) {
     let filename = originalFilename;
     let contentType = originalContentType;
     const uploadPurpose = String(formData.get("purpose") || "");
+    const isAtlasCloudReferenceVideo =
+      uploadPurpose === "canvas-video-process" &&
+      ALLOWED_ATLASCLOUD_VIDEO_TYPES.has(contentType);
+    const isOpenClawChatVideoUpload =
+      uploadPurpose === OPENCLAW_CHAT_VIDEO_UPLOAD_PURPOSE &&
+      ALLOWED_OPENCLAW_VIDEO_TYPES.has(contentType);
     const clientUploadId =
       String(formData.get("clientUploadId") || "").trim() || null;
     const isSvgUpload = contentType === "image/svg+xml";
@@ -227,7 +287,11 @@ export async function POST(request: Request) {
       return NextResponse.json({ error: errorMessage }, { status: 400 });
     }
 
-    if (!ALLOWED_UPLOAD_IMAGE_TYPES.has(contentType)) {
+    if (
+      !ALLOWED_UPLOAD_IMAGE_TYPES.has(contentType) &&
+      !isAtlasCloudReferenceVideo &&
+      !isOpenClawChatVideoUpload
+    ) {
       const errorMessage = createUnsupportedImageTypeMessage(contentType, filename);
       logger.warn("[Upload API] Unsupported upload content type", {
         contentType,
@@ -277,6 +341,38 @@ export async function POST(request: Request) {
             { status: 400 }
           );
         }
+      } else if (isSharpCompatibilityUpload(contentType, filename)) {
+        try {
+          const convertedBuffer =
+            await convertSharpCompatibilityImageToJpeg(uploadBuffer);
+          logger.info("[Upload API] Compatibility image converted to JPEG", {
+            clientUploadId,
+            originalContentType: contentType,
+            originalSize: uploadBuffer.length,
+            convertedSize: convertedBuffer.length,
+          });
+          uploadBuffer = convertedBuffer;
+          filename = toJpegFilename(filename);
+          convertedFrom = contentType;
+          contentType = "image/jpeg";
+        } catch (conversionError) {
+          logger.warn("[Upload API] Compatibility image conversion failed", {
+            clientUploadId,
+            contentType,
+            size: uploadBuffer.length,
+            error:
+              conversionError instanceof Error
+                ? conversionError.message
+                : String(conversionError),
+          });
+          return NextResponse.json(
+            {
+              error: createUnsupportedImageTypeMessage(contentType, filename),
+              clientUploadId,
+            },
+            { status: 400 }
+          );
+        }
       }
 
       if (uploadPurpose === "agent-workflow-preview" && contentType !== "image/svg+xml") {
@@ -361,18 +457,32 @@ export async function POST(request: Request) {
       try {
         const asset = await upsertMediaAsset({
           userId: session.user.id,
-          mediaType: "image",
+          mediaType:
-          sourceType: "upload",
+            isAtlasCloudReferenceVideo || isOpenClawChatVideoUpload
+              ? "video"
+              : "image",
+          sourceType: isOpenClawChatVideoUpload
+            ? "openclaw_chat_video_upload"
+            : "upload",
           status: "ready",
           originalUrl: data.url,
-          previewUrl: data.url,
+          previewUrl:
-          thumbnailUrl: data.url,
+            isAtlasCloudReferenceVideo || isOpenClawChatVideoUpload
+              ? null
+              : data.url,
+          thumbnailUrl:
+            isAtlasCloudReferenceVideo || isOpenClawChatVideoUpload
+              ? null
+              : data.url,
           mimeType: data.contentType || contentType || null,
           displayName: filename,
-          sourceTable: "upload",
+          sourceTable: isOpenClawChatVideoUpload
+            ? "openclaw_chat_video_upload"
+            : "upload",
           metadata: {
             pathname: data.pathname,
             size: optimizedBuffer.length,
+            purpose: uploadPurpose || null,
             clientUploadId,
             convertedFrom,
           },

app/(chat)/api/models/route.ts

@@ -72,6 +72,73 @@ function isWorkflowImageGenerationModel(model: {
 // 获取前端可用的 AI 模型列表（需要登录但不需要管理员权限）
 export async function GET(request: Request) {
   try {
+    const isLocalCanvasE2E = process.env.CANVAS_E2E_LOCAL === "true";
+
+    if (isLocalCanvasE2E) {
+      const models = [
+        {
+          id: "local-e2e-image-model",
+          modelId: "nano-banana-pro-local",
+          displayName: "Nano Banana Pro",
+          avatarUrl: null,
+          description: "本地视频画布测试图片模型",
+          supportsVision: true,
+          supportsImageGen: true,
+          isMultimodal: true,
+          isDefault: true,
+          providerName: "Local E2E",
+          providerType: "local",
+          isSubModel: false,
+          parentModelId: null,
+          capabilities: { image: true },
+          videoToolCapability: null,
+          imageGenConfig: {
+            creditCostPerImage: 1,
+            creditCostPerVideo: 20,
+            videoDurationOptions: [5, 10],
+          },
+          sortOrder: 0,
+          selectable: true,
+        },
+        {
+          id: "local-e2e-video-model",
+          modelId: "kling-3-local",
+          displayName: "可灵 3.0",
+          avatarUrl: null,
+          description: "本地视频画布测试视频模型",
+          supportsVision: true,
+          supportsImageGen: false,
+          isMultimodal: true,
+          isDefault: false,
+          providerName: "Local E2E",
+          providerType: "local",
+          isSubModel: false,
+          parentModelId: null,
+          capabilities: { video: true },
+          videoToolCapability: {
+            supported: true,
+            durations: [5, 10],
+            resolutions: ["720p", "1080p"],
+          },
+          imageGenConfig: {
+            creditCostPerVideo: 20,
+            videoDurationOptions: [5, 10],
+          },
+          sortOrder: 1,
+          selectable: true,
+        },
+      ];
+
+      return Response.json({
+        models,
+        defaultModelId: models[0].id,
+        agentWorkflowConfiguredDefaultModelId: null,
+        agentWorkflowDefaultModelId: null,
+        agentWorkflowConfiguredModels: [],
+        agentModel: null,
+      });
+    }
+
     const session = await auth();
 
     if (!session?.user) {

app/api/admin/access-blocklist/route.ts

@@ -0,0 +1,207 @@
+import { desc, eq, sql } from "drizzle-orm";
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { db } from "@/lib/db";
+import { accessIpBlocklist, user } from "@/lib/db/schema";
+import { ChatSDKError } from "@/lib/errors";
+import { requireAdmin } from "@/lib/middleware/admin";
+import { recordAccessIpEventFromHeaders } from "@/lib/security/access-log";
+import { normalizeManualBlockIp } from "@/lib/security/manual-ip-blocklist";
+
+export const runtime = "nodejs";
+export const maxDuration = 10;
+
+const createSchema = z.object({
+  ip: z.string().trim().min(1).max(128),
+  reason: z.string().trim().max(500).optional().nullable(),
+  expiresAt: z.string().trim().optional().nullable(),
+});
+
+const patchSchema = z.object({
+  id: z.string().uuid(),
+  isActive: z.boolean(),
+  reason: z.string().trim().max(500).optional().nullable(),
+  expiresAt: z.string().trim().optional().nullable(),
+});
+
+function normalizeOptionalDate(value?: string | null) {
+  const normalized = String(value || "").trim();
+  if (!normalized) return null;
+  const date = new Date(normalized);
+  return Number.isNaN(date.getTime()) ? null : date;
+}
+
+export async function GET() {
+  try {
+    await requireAdmin();
+
+    const entries = await db
+      .select({
+        id: accessIpBlocklist.id,
+        ip: accessIpBlocklist.ip,
+        reason: accessIpBlocklist.reason,
+        isActive: accessIpBlocklist.isActive,
+        expiresAt: accessIpBlocklist.expiresAt,
+        createdAt: accessIpBlocklist.createdAt,
+        updatedAt: accessIpBlocklist.updatedAt,
+        createdBy: accessIpBlocklist.createdBy,
+        createdByEmail: user.email,
+      })
+      .from(accessIpBlocklist)
+      .leftJoin(user, eq(accessIpBlocklist.createdBy, user.id))
+      .orderBy(desc(accessIpBlocklist.isActive), desc(accessIpBlocklist.updatedAt))
+      .limit(300);
+
+    return NextResponse.json({ entries });
+  } catch (error) {
+    if (error instanceof ChatSDKError) {
+      return error.toResponse();
+    }
+    console.error("[AccessIpBlocklist] failed to list entries", error);
+    return new ChatSDKError("offline:admin").toResponse();
+  }
+}
+
+export async function POST(request: Request) {
+  try {
+    const session = await requireAdmin();
+    const body = createSchema.parse(await request.json());
+    const normalizedIp = normalizeManualBlockIp(body.ip);
+
+    if (!normalizedIp) {
+      return new ChatSDKError(
+        "bad_request:api",
+        "请输入有效的 IP 地址或 IPv4 CIDR，例如 1.2.3.4 或 1.2.3.0/24"
+      ).toResponse();
+    }
+
+    const now = new Date();
+    const expiresAt = normalizeOptionalDate(body.expiresAt);
+    const reason = body.reason?.trim() || null;
+
+    const [existing] = await db
+      .select({ id: accessIpBlocklist.id })
+      .from(accessIpBlocklist)
+      .where(sql`lower(${accessIpBlocklist.ip}) = lower(${normalizedIp})`)
+      .limit(1);
+
+    const [entry] = existing
+      ? await db
+          .update(accessIpBlocklist)
+          .set({
+            reason,
+            isActive: true,
+            expiresAt,
+            updatedBy: session.user.id,
+            updatedAt: now,
+          })
+          .where(eq(accessIpBlocklist.id, existing.id))
+          .returning()
+      : await db
+          .insert(accessIpBlocklist)
+          .values({
+            ip: normalizedIp,
+            reason,
+            isActive: true,
+            expiresAt,
+            createdBy: session.user.id,
+            updatedBy: session.user.id,
+            createdAt: now,
+            updatedAt: now,
+          })
+          .returning();
+
+    await recordAccessIpEventFromHeaders({
+      eventType: "manual_block_added",
+      userId: session.user.id,
+      userEmail: session.user.email || null,
+      userRole: session.user.type,
+      method: "POST",
+      path: "/api/admin/access-blocklist",
+      routeGroup: "admin-api",
+      statusCode: 200,
+      outcome: "manual_block_added",
+      severity: "high",
+      reasons: ["管理员手动拉黑 IP"],
+      metadata: {
+        targetIp: normalizedIp,
+        reason,
+      },
+    }).catch((error) => {
+      console.warn("[AccessIpBlocklist] failed to record block action", error);
+    });
+
+    return NextResponse.json({ entry });
+  } catch (error) {
+    if (error instanceof ChatSDKError) {
+      return error.toResponse();
+    }
+    if (error instanceof z.ZodError) {
+      return new ChatSDKError("bad_request:api", error.message).toResponse();
+    }
+    console.error("[AccessIpBlocklist] failed to create entry", error);
+    return new ChatSDKError("offline:admin").toResponse();
+  }
+}
+
+export async function PATCH(request: Request) {
+  try {
+    const session = await requireAdmin();
+    const body = patchSchema.parse(await request.json());
+    const now = new Date();
+    const expiresAt = normalizeOptionalDate(body.expiresAt);
+
+    const [existing] = await db
+      .select({ ip: accessIpBlocklist.ip })
+      .from(accessIpBlocklist)
+      .where(eq(accessIpBlocklist.id, body.id))
+      .limit(1);
+
+    if (!existing) {
+      return new ChatSDKError("bad_request:api", "IP 黑名单记录不存在").toResponse();
+    }
+
+    const [entry] = await db
+      .update(accessIpBlocklist)
+      .set({
+        isActive: body.isActive,
+        reason: body.reason?.trim() || undefined,
+        expiresAt,
+        updatedBy: session.user.id,
+        updatedAt: now,
+      })
+      .where(eq(accessIpBlocklist.id, body.id))
+      .returning();
+
+    await recordAccessIpEventFromHeaders({
+      eventType: body.isActive ? "manual_block_enabled" : "manual_block_released",
+      userId: session.user.id,
+      userEmail: session.user.email || null,
+      userRole: session.user.type,
+      method: "PATCH",
+      path: "/api/admin/access-blocklist",
+      routeGroup: "admin-api",
+      statusCode: 200,
+      outcome: body.isActive ? "manual_block_enabled" : "manual_block_released",
+      severity: body.isActive ? "high" : "watch",
+      reasons: [body.isActive ? "管理员启用 IP 拉黑" : "管理员解除 IP 拉黑"],
+      metadata: {
+        targetIp: existing.ip,
+        blocklistId: body.id,
+      },
+    }).catch((error) => {
+      console.warn("[AccessIpBlocklist] failed to record update action", error);
+    });
+
+    return NextResponse.json({ entry });
+  } catch (error) {
+    if (error instanceof ChatSDKError) {
+      return error.toResponse();
+    }
+    if (error instanceof z.ZodError) {
+      return new ChatSDKError("bad_request:api", error.message).toResponse();
+    }
+    console.error("[AccessIpBlocklist] failed to update entry", error);
+    return new ChatSDKError("offline:admin").toResponse();
+  }
+}

app/api/admin/access-logs/route.ts

@@ -0,0 +1,271 @@
+import { and, desc, gte, sql, type SQL } from "drizzle-orm";
+import { NextResponse } from "next/server";
+import { db } from "@/lib/db";
+import { accessIpEvent } from "@/lib/db/schema";
+import { ChatSDKError } from "@/lib/errors";
+import { requireAdmin } from "@/lib/middleware/admin";
+
+export const runtime = "nodejs";
+export const maxDuration = 10;
+
+type Severity = "info" | "watch" | "high" | "critical";
+
+const severityByRank: Record<number, Severity> = {
+  0: "info",
+  1: "watch",
+  2: "high",
+  3: "critical",
+};
+
+function clampInt(value: string | null, fallback: number, min: number, max: number) {
+  const parsed = Number.parseInt(value || "", 10);
+  if (!Number.isFinite(parsed)) return fallback;
+  return Math.min(Math.max(parsed, min), max);
+}
+
+function normalizeSearch(value: string | null) {
+  return String(value || "").trim().slice(0, 120);
+}
+
+function buildSeverityFromAggregate(params: {
+  eventSeverityRank: number;
+  total: number;
+  failureCount: number;
+  rateLimitedCount: number;
+  authFailureCount: number;
+  suspiciousCount: number;
+}) {
+  let severity = severityByRank[params.eventSeverityRank] || "info";
+  const failureRate =
+    params.total > 0 ? params.failureCount / Math.max(params.total, 1) : 0;
+
+  if (params.rateLimitedCount > 0 || params.suspiciousCount > 0) {
+    severity = "high";
+  } else if (params.authFailureCount >= 5 || params.total >= 250) {
+    severity = severity === "critical" ? severity : "high";
+  } else if (
+    params.failureCount >= 20 ||
+    (params.total >= 10 && failureRate >= 0.45)
+  ) {
+    severity = severity === "critical" ? severity : "high";
+  } else if (params.authFailureCount > 0 || params.failureCount > 0) {
+    severity = severity === "info" ? "watch" : severity;
+  }
+
+  return severity;
+}
+
+function buildAggregateReasons(params: {
+  total: number;
+  failureCount: number;
+  rateLimitedCount: number;
+  authFailureCount: number;
+  suspiciousCount: number;
+  loginSuccessCount: number;
+}) {
+  const reasons: string[] = [];
+  const failureRate =
+    params.total > 0 ? params.failureCount / Math.max(params.total, 1) : 0;
+
+  if (params.rateLimitedCount > 0) reasons.push("触发限流");
+  if (params.authFailureCount >= 5) reasons.push("认证失败偏多");
+  if (params.suspiciousCount > 0) reasons.push("命中异常规则");
+  if (params.total >= 250) reasons.push("请求量偏高");
+  if (params.failureCount >= 20 || (params.total >= 10 && failureRate >= 0.45)) {
+    reasons.push("失败率偏高");
+  }
+  if (params.loginSuccessCount > 0 && reasons.length === 0) {
+    reasons.push("有成功登录记录");
+  }
+
+  return reasons;
+}
+
+export async function GET(request: Request) {
+  try {
+    await requireAdmin();
+
+    const { searchParams } = new URL(request.url);
+    const hours = clampInt(searchParams.get("hours"), 24, 1, 168);
+    const limit = clampInt(searchParams.get("limit"), 120, 25, 500);
+    const severityFilter = searchParams.get("severity") || "all";
+    const search = normalizeSearch(searchParams.get("q"));
+    const since = new Date(Date.now() - hours * 60 * 60 * 1000);
+    const whereParts: SQL[] = [gte(accessIpEvent.createdAt, since)];
+
+    if (severityFilter === "abnormal") {
+      whereParts.push(sql`${accessIpEvent.severity} <> 'info'`);
+    } else if (["info", "watch", "high", "critical"].includes(severityFilter)) {
+      whereParts.push(sql`${accessIpEvent.severity} = ${severityFilter}`);
+    }
+
+    if (search) {
+      const pattern = `%${search}%`;
+      whereParts.push(sql`(
+        ${accessIpEvent.ip} ILIKE ${pattern}
+        OR ${accessIpEvent.path} ILIKE ${pattern}
+        OR ${accessIpEvent.userEmail} ILIKE ${pattern}
+        OR ${accessIpEvent.userAgent} ILIKE ${pattern}
+      )`);
+    }
+
+    const whereClause = and(...whereParts);
+
+    const [overview] = await db
+      .select({
+        totalEvents: sql<number>`count(*)::int`,
+        uniqueIps: sql<number>`count(distinct ${accessIpEvent.ip})::int`,
+        abnormalEvents: sql<number>`count(*) filter (where ${accessIpEvent.severity} <> 'info')::int`,
+        abnormalIps: sql<number>`count(distinct ${accessIpEvent.ip}) filter (where ${accessIpEvent.severity} <> 'info')::int`,
+        rateLimitedEvents: sql<number>`count(*) filter (where ${accessIpEvent.outcome} = 'rate_limited' or ${accessIpEvent.statusCode} = 429)::int`,
+        manualBlockedEvents: sql<number>`count(*) filter (where ${accessIpEvent.outcome} = 'manual_blocked')::int`,
+        loginSuccessEvents: sql<number>`count(*) filter (where ${accessIpEvent.outcome} = 'login_success')::int`,
+        unauthorizedEvents: sql<number>`count(*) filter (where ${accessIpEvent.outcome} = 'unauthorized' or ${accessIpEvent.statusCode} in (401, 403))::int`,
+      })
+      .from(accessIpEvent)
+      .where(whereClause);
+
+    const recentEvents = await db
+      .select({
+        id: accessIpEvent.id,
+        eventType: accessIpEvent.eventType,
+        ip: accessIpEvent.ip,
+        userId: accessIpEvent.userId,
+        userEmail: accessIpEvent.userEmail,
+        userRole: accessIpEvent.userRole,
+        method: accessIpEvent.method,
+        path: accessIpEvent.path,
+        routeGroup: accessIpEvent.routeGroup,
+        statusCode: accessIpEvent.statusCode,
+        outcome: accessIpEvent.outcome,
+        severity: accessIpEvent.severity,
+        reasons: accessIpEvent.reasons,
+        userAgent: accessIpEvent.userAgent,
+        referer: accessIpEvent.referer,
+        occurredAt: accessIpEvent.occurredAt,
+        createdAt: accessIpEvent.createdAt,
+      })
+      .from(accessIpEvent)
+      .where(whereClause)
+      .orderBy(desc(accessIpEvent.createdAt))
+      .limit(limit);
+
+    const topIpRows = await db
+      .select({
+        ip: accessIpEvent.ip,
+        total: sql<number>`count(*)::int`,
+        uniqueUsers: sql<number>`count(distinct ${accessIpEvent.userId}) filter (where ${accessIpEvent.userId} is not null)::int`,
+        failureCount: sql<number>`count(*) filter (where ${accessIpEvent.statusCode} >= 400)::int`,
+        rateLimitedCount: sql<number>`count(*) filter (where ${accessIpEvent.outcome} = 'rate_limited' or ${accessIpEvent.statusCode} = 429)::int`,
+        authFailureCount: sql<number>`count(*) filter (where ${accessIpEvent.path} like '/api/auth%' and ${accessIpEvent.statusCode} >= 400)::int`,
+        loginSuccessCount: sql<number>`count(*) filter (where ${accessIpEvent.outcome} = 'login_success')::int`,
+        suspiciousCount: sql<number>`count(*) filter (where ${accessIpEvent.severity} in ('watch', 'high', 'critical'))::int`,
+        firstSeen: sql<string>`min(${accessIpEvent.createdAt})::text`,
+        lastSeen: sql<string>`max(${accessIpEvent.createdAt})::text`,
+        eventSeverityRank: sql<number>`max(case ${accessIpEvent.severity}
+          when 'critical' then 3
+          when 'high' then 2
+          when 'watch' then 1
+          else 0
+        end)::int`,
+      })
+      .from(accessIpEvent)
+      .where(whereClause)
+      .groupBy(accessIpEvent.ip)
+      .orderBy(
+        desc(sql`(
+          count(*) filter (where ${accessIpEvent.severity} in ('watch', 'high', 'critical')) * 8
+          + count(*) filter (where ${accessIpEvent.outcome} = 'rate_limited' or ${accessIpEvent.statusCode} = 429) * 12
+          + count(*) filter (where ${accessIpEvent.statusCode} >= 400) * 3
+          + count(*)
+        )`)
+      )
+      .limit(24);
+
+    const topIps = topIpRows.map((row) => {
+      const severity = buildSeverityFromAggregate({
+        eventSeverityRank: Number(row.eventSeverityRank || 0),
+        total: Number(row.total || 0),
+        failureCount: Number(row.failureCount || 0),
+        rateLimitedCount: Number(row.rateLimitedCount || 0),
+        authFailureCount: Number(row.authFailureCount || 0),
+        suspiciousCount: Number(row.suspiciousCount || 0),
+      });
+
+      return {
+        ...row,
+        severity,
+        failureRate:
+          Number(row.total || 0) > 0
+            ? Number(row.failureCount || 0) / Number(row.total || 1)
+            : 0,
+        reasons: buildAggregateReasons({
+          total: Number(row.total || 0),
+          failureCount: Number(row.failureCount || 0),
+          rateLimitedCount: Number(row.rateLimitedCount || 0),
+          authFailureCount: Number(row.authFailureCount || 0),
+          suspiciousCount: Number(row.suspiciousCount || 0),
+          loginSuccessCount: Number(row.loginSuccessCount || 0),
+        }),
+      };
+    });
+
+    const hourlyStats = await db
+      .select({
+        hour: sql<string>`to_char(date_trunc('hour', ${accessIpEvent.createdAt}), 'MM-DD HH24:00')`,
+        count: sql<number>`count(*)::int`,
+        abnormalCount: sql<number>`count(*) filter (where ${accessIpEvent.severity} <> 'info')::int`,
+      })
+      .from(accessIpEvent)
+      .where(whereClause)
+      .groupBy(sql`date_trunc('hour', ${accessIpEvent.createdAt})`)
+      .orderBy(sql`date_trunc('hour', ${accessIpEvent.createdAt})`);
+
+    const pathStats = await db
+      .select({
+        path: accessIpEvent.path,
+        routeGroup: accessIpEvent.routeGroup,
+        count: sql<number>`count(*)::int`,
+        abnormalCount: sql<number>`count(*) filter (where ${accessIpEvent.severity} <> 'info')::int`,
+      })
+      .from(accessIpEvent)
+      .where(whereClause)
+      .groupBy(accessIpEvent.path, accessIpEvent.routeGroup)
+      .orderBy(desc(sql`count(*)`))
+      .limit(12);
+
+    return NextResponse.json({
+      window: {
+        hours,
+        since: since.toISOString(),
+      },
+      overview: {
+        totalEvents: overview?.totalEvents || 0,
+        uniqueIps: overview?.uniqueIps || 0,
+        abnormalEvents: overview?.abnormalEvents || 0,
+        abnormalIps: overview?.abnormalIps || 0,
+        rateLimitedEvents: overview?.rateLimitedEvents || 0,
+        manualBlockedEvents: overview?.manualBlockedEvents || 0,
+        loginSuccessEvents: overview?.loginSuccessEvents || 0,
+        unauthorizedEvents: overview?.unauthorizedEvents || 0,
+      },
+      topIps,
+      hourlyStats,
+      pathStats,
+      recentEvents,
+      rules: [
+        "短时间请求量偏高",
+        "4xx/5xx 或失败率偏高",
+        "认证失败偏多",
+        "触发限流",
+        "命中敏感路径或异常 User-Agent",
+      ],
+    });
+  } catch (error) {
+    if (error instanceof ChatSDKError) {
+      return error.toResponse();
+    }
+    console.error("[AccessIpEvent] failed to load admin analytics", error);
+    return new ChatSDKError("offline:admin").toResponse();
+  }
+}

app/api/admin/ai-models/route.ts

@@ -33,6 +33,11 @@ const imageGenConfigSchema = z.object({
   supportsNegativePrompt: z.boolean().optional(),
   supportsWatermark: z.boolean().optional(),
   supportsSeed: z.boolean().optional(),
+  supportsQuality: z.boolean().optional(),
+  supportedAspectRatios: z.array(z.string().min(1).max(32)).max(32).optional(),
+  supportedImageSizes: z.array(z.string().min(1).max(32)).max(32).optional(),
+  maxReferenceImages: z.number().min(0).max(64).optional(),
+  maxVideoReferences: z.number().min(0).max(16).optional(),
   ruxaTaskInputMode: z
     .enum(["size-image", "resolution-based"])
     .optional(),
@@ -45,6 +50,7 @@ const imageGenConfigSchema = z.object({
   creditCostPerVideoByResolution: z.record(z.string(), z.number().min(0).max(100000)).optional(),
   enableLoadingPlaceholder: z.boolean().optional(),
   loadingColor: z.string().optional(),
+  vip98k: z.record(z.string(), z.unknown()).optional(),
 }).optional();
 
 const capabilitiesSchema = z.record(z.string(), z.unknown()).nullable().optional();

app/api/admin/ai-providers/route.ts

@@ -9,6 +9,7 @@ import {
 } from "@/lib/db/queries";
 import { ChatSDKError } from "@/lib/errors";
 import { BLTCY_VIDEO_BASE_URL, isBltcyVideoBaseUrl } from "@/lib/ai/bltcy-video-models";
+import { VIP98K_BASE_URL } from "@/lib/ai/vip98k-models";
 import { clearScopedSiteSettingsCache } from "@/lib/site-settings/public-cache";
 
 const providerTypes = [
@@ -32,6 +33,10 @@ const providerTypes = [
   "fal-image",
   "snapgen-image",
   "openai-image",
+  "bananaimage",
+  "visionary",
+  "atlascloud",
+  "vip98k",
   "stepfun-image",
   "midjourney",
   "fal-video",
@@ -73,11 +78,15 @@ const RUXA_VIDEO_BASE_URL = "https://api.ruxa.ai";
 const RUXA_IMAGE_BASE_URL = "https://api.ruxa.ai";
 const SNAPGEN_IMAGE_BASE_URL = "https://api.snapgen.ai";
 const OPENAI_IMAGE_BASE_URL = "https://api.openai.com/v1";
+const BANANAIMAGE_BASE_URL = "https://bananaimage.aigenmedia.art";
+const VISIONARY_BASE_URL = "https://api.visionary.beer";
+const ATLASCLOUD_BASE_URL = "https://api.atlascloud.ai";
+const VIP98K_PROVIDER_BASE_URL = VIP98K_BASE_URL;
 const STEPFUN_IMAGE_BASE_URL = "https://api.stepfun.com";
 const BFL_IMAGE_BASE_URL = "https://api.bfl.ai";
 const MIDJOURNEY_BASE_URL = "https://your-midjourney-api.example.com";
 const TRIPO_3D_BASE_URL = "https://api.tripo3d.ai/v2/openapi";
-const WORLDLABS_3D_BASE_URL = "https://api.worldlabs.ai";
+const WORLDLABS_3D_BASE_URL = "https://api.vip98k.com";
 const KITTYCAD_CAD_BASE_URL = "https://api.zoo.dev";
 const RUNWAY_BASE_URL = "https://api.dev.runwayml.com";
 const KREA_BASE_URL = "https://api.krea.ai";
@@ -237,6 +246,14 @@ export async function POST(request: Request) {
               ? data.baseUrl || SNAPGEN_IMAGE_BASE_URL
             : data.type === "openai-image"
               ? data.baseUrl || OPENAI_IMAGE_BASE_URL
+            : data.type === "bananaimage"
+              ? data.baseUrl || BANANAIMAGE_BASE_URL
+            : data.type === "visionary"
+              ? data.baseUrl || VISIONARY_BASE_URL
+            : data.type === "atlascloud"
+              ? data.baseUrl || ATLASCLOUD_BASE_URL
+            : data.type === "vip98k"
+              ? data.baseUrl || VIP98K_PROVIDER_BASE_URL
             : data.type === "stepfun-image"
               ? data.baseUrl || STEPFUN_IMAGE_BASE_URL
             : data.type === "midjourney"
@@ -299,6 +316,12 @@ export async function PUT(request: Request) {
       ...data,
       apiKey: normalizedApiKey,
       type: normalizeProviderTypeForStorage(data.type),
+      baseUrl:
+        data.baseUrl !== undefined
+          ? data.baseUrl
+          : data.type === "vip98k"
+            ? VIP98K_PROVIDER_BASE_URL
+            : undefined,
       updatedBy: session.user.id,
     });
 

app/api/admin/atlascloud-models/route.ts

@@ -0,0 +1,182 @@
+import { and, eq } from "drizzle-orm";
+import { NextResponse } from "next/server";
+import {
+  fetchAtlasCloudModelPresets,
+  resolveAtlasCloudDisplayName,
+  shouldInsertMissingAtlasCloudPreset,
+} from "@/lib/ai/atlascloud-models";
+import { db } from "@/lib/db";
+import { getAiProviderById } from "@/lib/db/queries";
+import { type AiModel, aiModel } from "@/lib/db/schema";
+import { requireAdmin } from "@/lib/middleware/admin";
+
+export const runtime = "nodejs";
+export const maxDuration = 300;
+
+export async function GET() {
+  try {
+    await requireAdmin();
+    const result = await fetchAtlasCloudModelPresets();
+    return NextResponse.json({
+      presets: result.presets,
+      errors: result.errors.length > 0 ? result.errors : undefined,
+      counts: {
+        total: result.catalogCount,
+        available: result.presets.length,
+        failed: result.errors.length,
+      },
+    });
+  } catch (error) {
+    console.error("[Atlas Cloud Models API] GET error:", error);
+    return NextResponse.json(
+      {
+        error:
+          error instanceof Error
+            ? error.message
+            : "Failed to fetch Atlas Cloud models",
+      },
+      { status: 500 }
+    );
+  }
+}
+
+export async function POST(request: Request) {
+  try {
+    await requireAdmin();
+    const body = await request.json();
+    const providerId = String(body?.providerId || "").trim();
+    const requestedModelIds = Array.isArray(body?.modelIds)
+      ? new Set(
+          body.modelIds.map((item: unknown) => String(item || "").trim()).filter(Boolean)
+        )
+      : null;
+    if (!providerId) {
+      return NextResponse.json({ error: "Provider ID is required" }, { status: 400 });
+    }
+
+    const provider = await getAiProviderById({ id: providerId });
+    if (!provider || provider.type !== "atlascloud") {
+      return NextResponse.json(
+        { error: "Provider must be an Atlas Cloud provider" },
+        { status: 400 }
+      );
+    }
+
+    const catalog = await fetchAtlasCloudModelPresets();
+    const presets = requestedModelIds
+      ? catalog.presets.filter((preset) => requestedModelIds.has(preset.modelId))
+      : catalog.presets;
+    const addedModels: AiModel[] = [];
+    const updatedModels: AiModel[] = [];
+    const errors = [...catalog.errors];
+    const providerModels = await db.query.aiModel.findMany({
+      where: eq(aiModel.providerId, providerId),
+    });
+    const existingByModelId = new Map(
+      providerModels.map((model) => [model.modelId, model])
+    );
+    const existingMediaKinds = new Set(
+      providerModels.map((model) => {
+        const capabilities = model.capabilities as Record<string, unknown> | null;
+        return String(capabilities?.mediaType || "image");
+      })
+    );
+    let preservedDeletedCount = 0;
+
+    for (const preset of presets) {
+      try {
+        const existing = existingByModelId.get(preset.modelId);
+        const presetCapabilities = preset.capabilities as Record<string, unknown>;
+        const mediaKind = String(presetCapabilities.mediaType || "image");
+        if (
+          !existing &&
+          !shouldInsertMissingAtlasCloudPreset(existingMediaKinds, mediaKind)
+        ) {
+          preservedDeletedCount += 1;
+          continue;
+        }
+        const values = {
+          displayName: resolveAtlasCloudDisplayName(
+            existing?.displayName,
+            preset.displayName,
+            preset.modelId
+          ),
+          avatarUrl: preset.avatarUrl || null,
+          description: preset.description,
+          supportsVision: preset.supportsVision,
+          supportsImageGen: preset.supportsImageGen,
+          sortOrder: existing?.sortOrder ?? preset.sortOrder,
+          capabilities: preset.capabilities,
+          defaultParams: preset.defaultParams,
+          imageGenConfig: preset.imageGenConfig,
+          updatedAt: new Date(),
+        };
+
+        if (existing) {
+          const [updated] = await db
+            .update(aiModel)
+            .set(values)
+            .where(
+              and(
+                eq(aiModel.providerId, providerId),
+                eq(aiModel.modelId, preset.modelId)
+              )
+            )
+            .returning();
+          if (updated) updatedModels.push(updated);
+        } else {
+          const [created] = await db
+            .insert(aiModel)
+            .values({
+              providerId,
+              modelId: preset.modelId,
+              ...values,
+              isEnabled: true,
+              isHidden: false,
+              isDefault: false,
+              isSubModel: false,
+              parentModelId: null,
+            })
+            .returning();
+          if (created) addedModels.push(created);
+        }
+      } catch (error) {
+        console.error(
+          `[Atlas Cloud Models API] Failed to sync ${preset.modelId}:`,
+          error
+        );
+        errors.push({
+          modelId: preset.modelId,
+          error: error instanceof Error ? error.message : "Sync failed",
+        });
+      }
+    }
+
+    return NextResponse.json({
+      success: true,
+      addedCount: addedModels.length,
+      updatedCount: updatedModels.length,
+      addedModels,
+      updatedModels,
+      errors: errors.length > 0 ? errors : undefined,
+      counts: {
+        requested: presets.length,
+        total: catalog.catalogCount,
+        available: catalog.presets.length,
+        skippedUnsupported: catalog.skipped.length,
+        preservedDeleted: preservedDeletedCount,
+      },
+    });
+  } catch (error) {
+    console.error("[Atlas Cloud Models API] POST error:", error);
+    return NextResponse.json(
+      {
+        error:
+          error instanceof Error
+            ? error.message
+            : "Failed to sync Atlas Cloud models",
+      },
+      { status: 500 }
+    );
+  }
+}

app/api/admin/bananaimage-models/route.ts

@@ -0,0 +1,128 @@
+import { and, eq } from "drizzle-orm";
+import { NextResponse } from "next/server";
+import { BANANAIMAGE_MODEL_PRESETS } from "@/lib/ai/bananaimage-models";
+import { db } from "@/lib/db";
+import { getAiProviderById } from "@/lib/db/queries";
+import { type AiModel, aiModel } from "@/lib/db/schema";
+import { requireAdmin } from "@/lib/middleware/admin";
+
+export async function GET() {
+  try {
+    await requireAdmin();
+    return NextResponse.json({
+      presets: BANANAIMAGE_MODEL_PRESETS,
+      counts: { total: BANANAIMAGE_MODEL_PRESETS.length },
+    });
+  } catch (error: any) {
+    console.error("[BananaImage Models API] GET error:", error);
+    return NextResponse.json(
+      { error: error.message || "Failed to fetch BananaImage model presets" },
+      { status: 500 }
+    );
+  }
+}
+
+export async function POST(request: Request) {
+  try {
+    await requireAdmin();
+    const body = await request.json();
+    const providerId = String(body?.providerId || "").trim();
+    const modelIds = Array.isArray(body?.modelIds)
+      ? body.modelIds
+          .map((item: unknown) => String(item || "").trim())
+          .filter(Boolean)
+      : null;
+
+    if (!providerId) {
+      return NextResponse.json({ error: "Provider ID is required" }, { status: 400 });
+    }
+
+    const provider = await getAiProviderById({ id: providerId });
+    if (!provider || provider.type !== "bananaimage") {
+      return NextResponse.json(
+        { error: "Provider must be a BananaImage provider" },
+        { status: 400 }
+      );
+    }
+
+    const presets = modelIds
+      ? BANANAIMAGE_MODEL_PRESETS.filter((preset) => modelIds.includes(preset.modelId))
+      : BANANAIMAGE_MODEL_PRESETS;
+    const addedModels: AiModel[] = [];
+    const updatedModels: AiModel[] = [];
+    const errors: { modelId: string; error: string }[] = [];
+
+    for (const preset of presets) {
+      try {
+        const existing = await db.query.aiModel.findFirst({
+          where: and(
+            eq(aiModel.providerId, providerId),
+            eq(aiModel.modelId, preset.modelId)
+          ),
+        });
+        const values = {
+          displayName: preset.displayName,
+          description: preset.description,
+          supportsVision: preset.supportsVision,
+          supportsImageGen: preset.supportsImageGen,
+          isEnabled: true,
+          isHidden: false,
+          sortOrder: preset.sortOrder,
+          capabilities: preset.capabilities || null,
+          defaultParams: preset.defaultParams || null,
+          imageGenConfig: preset.imageGenConfig || null,
+        };
+
+        if (existing) {
+          const [updated] = await db
+            .update(aiModel)
+            .set(values)
+            .where(
+              and(
+                eq(aiModel.providerId, providerId),
+                eq(aiModel.modelId, preset.modelId)
+              )
+            )
+            .returning();
+          if (updated) updatedModels.push(updated);
+          continue;
+        }
+
+        const [created] = await db
+          .insert(aiModel)
+          .values({
+            providerId,
+            modelId: preset.modelId,
+            ...values,
+            isDefault: false,
+            isSubModel: false,
+            parentModelId: null,
+          })
+          .returning();
+        if (created) addedModels.push(created);
+      } catch (error: any) {
+        console.error(`[BananaImage Models API] Failed to sync ${preset.modelId}:`, error);
+        errors.push({
+          modelId: preset.modelId,
+          error: error.message || "Sync failed",
+        });
+      }
+    }
+
+    return NextResponse.json({
+      success: true,
+      addedCount: addedModels.length,
+      updatedCount: updatedModels.length,
+      addedModels,
+      updatedModels,
+      errors: errors.length > 0 ? errors : undefined,
+      counts: { requested: presets.length, total: BANANAIMAGE_MODEL_PRESETS.length },
+    });
+  } catch (error: any) {
+    console.error("[BananaImage Models API] POST error:", error);
+    return NextResponse.json(
+      { error: error.message || "Failed to sync BananaImage models" },
+      { status: 500 }
+    );
+  }
+}

app/api/admin/settings/route.ts

@@ -18,6 +18,8 @@ import {
   DETAIL_AGENT_LOCAL_MOONSHOT_DISPLAY_NAME,
   DETAIL_AGENT_LOCAL_MOONSHOT_MODEL_ID,
   DETAIL_AGENT_LOCAL_MOONSHOT_SETTING_KEY,
+  isDetailAgentLocalMoonshotBaseUrl,
+  normalizeDetailAgentLocalMoonshotBaseUrl,
 } from "@/lib/ai/detail-agent-model-config";
 import {
   normalizeProductPlanningApiConfig,
@@ -51,6 +53,10 @@ import {
   CANVAS_IMAGE_TASK_QUEUE_CONFIG_KEY,
   normalizeCanvasImageTaskQueueConfig,
 } from "@/lib/canvas/image-task-config";
+import {
+  CANVAS_LOCAL_EDIT_CONFIG_KEY,
+  normalizeCanvasLocalEditConfig,
+} from "@/lib/canvas/local-edit-config";
 import {
   DINGTALK_ROBOT_NOTIFICATION_CONFIG_KEY,
   normalizeDingTalkRobotNotificationConfig,
@@ -95,7 +101,7 @@ const moonshotDetailAgentConfigSchema = z.object({
 const MOONSHOT_OFFICIAL_BASE_URL = DETAIL_AGENT_LOCAL_MOONSHOT_BASE_URL;
 
 function isMoonshotOfficialBaseUrl(value: string) {
-  return String(value || "").trim().replace(/\/+$/, "") === MOONSHOT_OFFICIAL_BASE_URL;
+  return isDetailAgentLocalMoonshotBaseUrl(value);
 }
 
 function isObjectLike(value: unknown): value is Record<string, unknown> {
@@ -124,6 +130,12 @@ export async function GET(request: Request) {
           setting: setting ? { ...setting, value } : { key, value },
         });
       }
+      if (key === CANVAS_LOCAL_EDIT_CONFIG_KEY) {
+        const value = normalizeCanvasLocalEditConfig(setting?.value);
+        return Response.json({
+          setting: setting ? { ...setting, value } : { key, value },
+        });
+      }
       if (key === DINGTALK_ROBOT_NOTIFICATION_CONFIG_KEY) {
         const value = normalizeDingTalkRobotNotificationConfig(setting?.value);
         return Response.json({
@@ -191,19 +203,27 @@ export async function POST(request: Request) {
           ? (existingSetting.value as Record<string, unknown>)
           : {};
       const config = moonshotDetailAgentConfigSchema.parse(value || {});
-      const normalizedBaseUrl = String(config.baseUrl || "").trim() || MOONSHOT_OFFICIAL_BASE_URL;
+      const normalizedBaseUrl = normalizeDetailAgentLocalMoonshotBaseUrl(config.baseUrl);
       const rawModelId = String(config.modelId || "").trim();
       const rawDisplayName = String(config.displayName || "").trim();
       const normalizedModelId =
-        !rawModelId || rawModelId === "kimi-k2.5"
+        !rawModelId ||
+        rawModelId === "kimi-k2.5" ||
+        rawModelId === "kimi-k2.6" ||
+        rawModelId === "kimi-k2.7-code" ||
+        rawModelId === "kimi-k2.7-code-highspeed"
           ? DETAIL_AGENT_LOCAL_MOONSHOT_MODEL_ID
           : rawModelId;
       const normalizedDisplayName =
-        !rawDisplayName || rawDisplayName === "官方 Kimi K2.5"
+        !rawDisplayName ||
+        rawDisplayName === "官方 Kimi K2.5" ||
+        rawDisplayName === "官方 Kimi K2.6" ||
+        rawDisplayName === "官方 Kimi K2.7 Code Highspeed" ||
+        rawDisplayName === "Kimi Code 编程套餐 K2.7 Highspeed"
           ? DETAIL_AGENT_LOCAL_MOONSHOT_DISPLAY_NAME
           : rawDisplayName;
       const normalizedProviderName =
-        String(config.providerName || "").trim() || "Moonshot AI (Official)";
+        String(config.providerName || "").trim() || "Kimi Code 编程套餐";
       const normalizedApiKey =
         String(config.apiKey || "").trim() ||
         String(existingValue.apiKey || "").trim();
@@ -212,12 +232,12 @@ export async function POST(request: Request) {
       if (!isMoonshotOfficialBaseUrl(normalizedBaseUrl)) {
         return new ChatSDKError(
           "bad_request:api",
-          `Moonshot 官方地址必须为 ${MOONSHOT_OFFICIAL_BASE_URL}`,
+          `Kimi Code 编程套餐专用地址必须为 ${MOONSHOT_OFFICIAL_BASE_URL}`,
         ).toResponse();
       }
 
       if (!normalizedApiKey) {
-        return new ChatSDKError("bad_request:api", "缺少 Moonshot 官方 API Key").toResponse();
+        return new ChatSDKError("bad_request:api", "缺少 Kimi Code 控制台 API Key").toResponse();
       }
 
       const saved = await upsertSystemSetting({
@@ -359,6 +379,10 @@ export async function POST(request: Request) {
       nextValue = normalizeCanvasImageTaskQueueConfig(value);
     }
 
+    if (key === CANVAS_LOCAL_EDIT_CONFIG_KEY) {
+      nextValue = normalizeCanvasLocalEditConfig(value);
+    }
+
     if (key === DINGTALK_ROBOT_NOTIFICATION_CONFIG_KEY) {
       nextValue = normalizeDingTalkRobotNotificationConfig(value);
     }

app/api/admin/vip98k-models/route.ts

@@ -0,0 +1,213 @@
+import { and, eq } from "drizzle-orm";
+import { NextResponse } from "next/server";
+import {
+  fetchVip98kModelPresets,
+  type Vip98kModelPreset,
+} from "@/lib/ai/vip98k-models";
+import { db } from "@/lib/db";
+import { getAiProviderById } from "@/lib/db/queries";
+import { aiModel, type AiModel } from "@/lib/db/schema";
+import { requireAdmin } from "@/lib/middleware/admin";
+
+export const runtime = "nodejs";
+export const maxDuration = 300;
+
+function summarizeByType(presets: Vip98kModelPreset[]) {
+  return presets.reduce<Record<string, number>>((acc, preset) => {
+    const type = String(preset.type || "model");
+    acc[type] = (acc[type] || 0) + 1;
+    return acc;
+  }, {});
+}
+
+export async function GET(request: Request) {
+  try {
+    await requireAdmin();
+    const { searchParams } = new URL(request.url);
+    const providerId = String(searchParams.get("providerId") || "").trim();
+    if (!providerId) {
+      return NextResponse.json(
+        { error: "Provider ID is required to fetch VIP98K catalog" },
+        { status: 400 },
+      );
+    }
+
+    const provider = await getAiProviderById({ id: providerId });
+    if (!provider || provider.type !== "vip98k") {
+      return NextResponse.json(
+        { error: "Provider must be a VIP98K provider" },
+        { status: 400 },
+      );
+    }
+
+    const presets = await fetchVip98kModelPresets({
+      baseURL: provider.baseUrl,
+      apiKey: provider.apiKey,
+    });
+    return NextResponse.json({
+      presets,
+      counts: {
+        total: presets.length,
+        byType: summarizeByType(presets),
+      },
+    });
+  } catch (error) {
+    console.error("[VIP98K Models API] GET error:", error);
+    return NextResponse.json(
+      {
+        error:
+          error instanceof Error
+            ? error.message
+            : "Failed to fetch VIP98K models",
+      },
+      { status: 500 },
+    );
+  }
+}
+
+export async function POST(request: Request) {
+  try {
+    await requireAdmin();
+    const body = await request.json();
+    const providerId = String(body?.providerId || "").trim();
+    const requestedModelIds = Array.isArray(body?.modelIds)
+      ? new Set(
+          body.modelIds.map((item: unknown) => String(item || "").trim()).filter(Boolean),
+        )
+      : null;
+    const preserveDeletedModels = body?.preserveDeletedModels !== false;
+    if (!providerId) {
+      return NextResponse.json({ error: "Provider ID is required" }, { status: 400 });
+    }
+
+    const provider = await getAiProviderById({ id: providerId });
+    if (!provider || provider.type !== "vip98k") {
+      return NextResponse.json(
+        { error: "Provider must be a VIP98K provider" },
+        { status: 400 },
+      );
+    }
+
+    const catalogPresets = await fetchVip98kModelPresets({
+      baseURL: provider.baseUrl,
+      apiKey: provider.apiKey,
+    });
+    const existingModels = await db.query.aiModel.findMany({
+      where: eq(aiModel.providerId, providerId),
+    });
+    const existingModelIds = new Set(existingModels.map((model) => model.modelId));
+    const preserveExistingCatalog =
+      requestedModelIds === null &&
+      preserveDeletedModels &&
+      existingModels.length > 0;
+    const presets = requestedModelIds
+      ? catalogPresets.filter((preset) => requestedModelIds.has(preset.modelId))
+      : preserveExistingCatalog
+        ? catalogPresets.filter((preset) => existingModelIds.has(preset.modelId))
+        : catalogPresets;
+
+    const addedModels: AiModel[] = [];
+    const updatedModels: AiModel[] = [];
+    const disabledModels: AiModel[] = [];
+    const errors: Array<{ modelId: string; error: string }> = [];
+
+    if (requestedModelIds === null) {
+      const catalogModelIds = new Set(catalogPresets.map((preset) => preset.modelId));
+      for (const existing of existingModels) {
+        if (catalogModelIds.has(existing.modelId)) continue;
+        const [disabled] = await db
+          .update(aiModel)
+          .set({ isEnabled: false, isHidden: true, updatedAt: new Date() })
+          .where(eq(aiModel.id, existing.id))
+          .returning();
+        if (disabled) disabledModels.push(disabled);
+      }
+    }
+
+    for (const preset of presets) {
+      try {
+        const existing = await db.query.aiModel.findFirst({
+          where: and(
+            eq(aiModel.providerId, providerId),
+            eq(aiModel.modelId, preset.modelId),
+          ),
+        });
+        const values = {
+          displayName: preset.displayName,
+          avatarUrl: null,
+          description: preset.description,
+          supportsVision: preset.supportsVision,
+          supportsImageGen: preset.supportsImageGen,
+          isEnabled:
+            requestedModelIds !== null ? true : (existing?.isEnabled ?? true),
+          isHidden: preset.isHidden,
+          sortOrder: preset.sortOrder,
+          capabilities: preset.capabilities,
+          defaultParams: preset.defaultParams,
+          imageGenConfig: preset.imageGenConfig,
+          updatedAt: new Date(),
+        };
+
+        if (existing) {
+          const [updated] = await db
+            .update(aiModel)
+            .set(values)
+            .where(
+              and(
+                eq(aiModel.providerId, providerId),
+                eq(aiModel.modelId, preset.modelId),
+              ),
+            )
+            .returning();
+          if (updated) updatedModels.push(updated);
+        } else {
+          const [created] = await db
+            .insert(aiModel)
+            .values({
+              providerId,
+              modelId: preset.modelId,
+              ...values,
+              isDefault: false,
+              isSubModel: false,
+              parentModelId: null,
+            })
+            .returning();
+          if (created) addedModels.push(created);
+        }
+      } catch (error) {
+        console.error(`[VIP98K Models API] Failed to sync ${preset.modelId}:`, error);
+        errors.push({
+          modelId: preset.modelId,
+          error: error instanceof Error ? error.message : "Sync failed",
+        });
+      }
+    }
+
+    return NextResponse.json({
+      success: true,
+      addedCount: addedModels.length,
+      updatedCount: updatedModels.length,
+      disabledCount: disabledModels.length,
+      addedModels,
+      updatedModels,
+      disabledModelIds: disabledModels.map((model) => model.modelId),
+      errors: errors.length > 0 ? errors : undefined,
+      counts: {
+        requested: presets.length,
+        total: catalogPresets.length,
+        byType: summarizeByType(catalogPresets),
+      },
+    });
+  } catch (error) {
+    console.error("[VIP98K Models API] POST error:", error);
+    return NextResponse.json(
+      {
+        error:
+          error instanceof Error
+            ? error.message
+            : "Failed to sync VIP98K models",
+      },
+      { status: 500 },
+    );
+  }
+}

app/api/admin/visionary-models/route.ts

@@ -0,0 +1,139 @@
+import { and, eq } from "drizzle-orm";
+import { NextResponse } from "next/server";
+import { VISIONARY_MODEL_PRESETS } from "@/lib/ai/visionary-models";
+import { db } from "@/lib/db";
+import { getAiProviderById } from "@/lib/db/queries";
+import { type AiModel, aiModel } from "@/lib/db/schema";
+import { requireAdmin } from "@/lib/middleware/admin";
+
+export async function GET() {
+  try {
+    await requireAdmin();
+    return NextResponse.json({
+      presets: VISIONARY_MODEL_PRESETS,
+      counts: { total: VISIONARY_MODEL_PRESETS.length },
+    });
+  } catch (error: any) {
+    console.error("[Visionary Models API] GET error:", error);
+    return NextResponse.json(
+      { error: error.message || "Failed to fetch Visionary model presets" },
+      { status: 500 }
+    );
+  }
+}
+
+export async function POST(request: Request) {
+  try {
+    await requireAdmin();
+    const body = await request.json();
+    const providerId = String(body?.providerId || "").trim();
+    const modelIds = Array.isArray(body?.modelIds)
+      ? body.modelIds
+          .map((item: unknown) => String(item || "").trim())
+          .filter(Boolean)
+      : null;
+
+    if (!providerId) {
+      return NextResponse.json(
+        { error: "Provider ID is required" },
+        { status: 400 }
+      );
+    }
+
+    const provider = await getAiProviderById({ id: providerId });
+    if (!provider || provider.type !== "visionary") {
+      return NextResponse.json(
+        { error: "Provider must be a Visionary provider" },
+        { status: 400 }
+      );
+    }
+
+    const presets = modelIds
+      ? VISIONARY_MODEL_PRESETS.filter((preset) =>
+          modelIds.includes(preset.modelId)
+        )
+      : VISIONARY_MODEL_PRESETS;
+    const addedModels: AiModel[] = [];
+    const updatedModels: AiModel[] = [];
+    const errors: { modelId: string; error: string }[] = [];
+
+    for (const preset of presets) {
+      try {
+        const existing = await db.query.aiModel.findFirst({
+          where: and(
+            eq(aiModel.providerId, providerId),
+            eq(aiModel.modelId, preset.modelId)
+          ),
+        });
+        const values = {
+          displayName: preset.displayName,
+          description: preset.description,
+          supportsVision: preset.supportsVision,
+          supportsImageGen: preset.supportsImageGen,
+          isEnabled: true,
+          isHidden: false,
+          sortOrder: preset.sortOrder,
+          capabilities: preset.capabilities || null,
+          defaultParams: preset.defaultParams || null,
+          imageGenConfig: preset.imageGenConfig || null,
+        };
+
+        if (existing) {
+          const [updated] = await db
+            .update(aiModel)
+            .set(values)
+            .where(
+              and(
+                eq(aiModel.providerId, providerId),
+                eq(aiModel.modelId, preset.modelId)
+              )
+            )
+            .returning();
+          if (updated) updatedModels.push(updated);
+          continue;
+        }
+
+        const [created] = await db
+          .insert(aiModel)
+          .values({
+            providerId,
+            modelId: preset.modelId,
+            ...values,
+            isDefault: false,
+            isSubModel: false,
+            parentModelId: null,
+          })
+          .returning();
+        if (created) addedModels.push(created);
+      } catch (error: any) {
+        console.error(
+          `[Visionary Models API] Failed to sync ${preset.modelId}:`,
+          error
+        );
+        errors.push({
+          modelId: preset.modelId,
+          error: error.message || "Sync failed",
+        });
+      }
+    }
+
+    return NextResponse.json({
+      success: true,
+      addedCount: addedModels.length,
+      updatedCount: updatedModels.length,
+      addedModels,
+      updatedModels,
+      errors: errors.length > 0 ? errors : undefined,
+      counts: {
+        requested: presets.length,
+        total: VISIONARY_MODEL_PRESETS.length,
+      },
+    });
+  } catch (error: any) {
+    console.error("[Visionary Models API] POST error:", error);
+    return NextResponse.json(
+      { error: error.message || "Failed to sync Visionary models" },
+      { status: 500 }
+    );
+  }
+}

app/api/ai-cad/modeling/command/route.ts

@@ -1,122 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { NextResponse } from "next/server";
-import { auth } from "@/app/(auth)/auth";
-import {
-  getKittyCadModelingCommandError,
-  isKittyCadModelingCommandSuccessful,
-  sendKittyCadModelingCommand,
-  takeKittyCadModelingSnapshot,
-} from "@/lib/kittycad/modeling-session";
-
-export const runtime = "nodejs";
-export const maxDuration = 60;
-
-type ModelingCommandRequest = {
-  captureSnapshot?: boolean;
-  cmd?: Record<string, unknown>;
-  cmdId?: string;
-  sessionId?: string;
-  snapshotFormat?: "jpeg" | "png";
-};
-
-function readOptionalRecord(value: unknown) {
-  return value && typeof value === "object" && !Array.isArray(value)
-    ? (value as Record<string, unknown>)
-    : null;
-}
-
-export async function POST(request: Request) {
-  try {
-    const session = await auth();
-    if (!session?.user?.id) {
-      return NextResponse.json(
-        { success: false, error: "未登录" },
-        { status: 401 }
-      );
-    }
-
-    const body = (await request.json()) as ModelingCommandRequest;
-    const sessionId = String(body.sessionId || "").trim();
-    if (!sessionId) {
-      return NextResponse.json(
-        { success: false, error: "缺少官方建模会话 ID" },
-        { status: 400 }
-      );
-    }
-
-    const cmd = readOptionalRecord(body.cmd);
-    const cmdType = String(cmd?.type || "").trim();
-    if (!cmd || !cmdType) {
-      return NextResponse.json(
-        { success: false, error: "缺少有效的官方建模命令" },
-        { status: 400 }
-      );
-    }
-
-    const cmdId = String(body.cmdId || "").trim() || randomUUID();
-    const response = await sendKittyCadModelingCommand({
-      cmd: {
-        ...cmd,
-        type: cmdType,
-      },
-      cmdId,
-      sessionId,
-    });
-
-    if (!isKittyCadModelingCommandSuccessful(response)) {
-      return NextResponse.json(
-        {
-          success: false,
-          error: getKittyCadModelingCommandError(response),
-          payload: response.errors || null,
-        },
-        { status: 400 }
-      );
-    }
-
-    let snapshotUrl: string | null = null;
-    let snapshotError: string | null = null;
-
-    const shouldCaptureSnapshot =
-      body.captureSnapshot === true && cmdType !== "take_snapshot";
-
-    if (cmdType === "take_snapshot") {
-      const contents = String(response.resp?.data?.contents || "").trim();
-      const snapshotFormat = body.snapshotFormat || "png";
-      snapshotUrl = contents
-        ? `data:${snapshotFormat === "jpeg" ? "image/jpeg" : "image/png"};base64,${contents}`
-        : null;
-    } else if (shouldCaptureSnapshot) {
-      try {
-        const snapshot = await takeKittyCadModelingSnapshot({
-          format: body.snapshotFormat || "png",
-          sessionId,
-        });
-        snapshotUrl = snapshot.snapshotUrl;
-      } catch (error) {
-        snapshotError =
-          error instanceof Error ? error.message : "获取官方建模快照失败";
-      }
-    }
-
-    return NextResponse.json({
-      success: true,
-      data: {
-        raw: response,
-        requestId: response.request_id || cmdId,
-        responseData: response.resp?.data || null,
-        responseType: response.resp?.type || cmdType,
-        snapshotError,
-        snapshotUrl,
-      },
-    });
-  } catch (error) {
-    return NextResponse.json(
-      {
-        success: false,
-        error: error instanceof Error ? error.message : "发送官方建模命令失败",
-      },
-      { status: 500 }
-    );
-  }
-}

app/api/ai-cad/modeling/session/[sessionId]/route.ts

@@ -1,48 +0,0 @@
-import { NextResponse } from "next/server";
-import { auth } from "@/app/(auth)/auth";
-import { closeKittyCadModelingSession } from "@/lib/kittycad/modeling-session";
-
-export const runtime = "nodejs";
-export const maxDuration = 60;
-
-type RouteParams = {
-  params: Promise<{
-    sessionId: string;
-  }>;
-};
-
-export async function DELETE(_request: Request, { params }: RouteParams) {
-  try {
-    const session = await auth();
-    if (!session?.user?.id) {
-      return NextResponse.json(
-        { success: false, error: "未登录" },
-        { status: 401 }
-      );
-    }
-
-    const { sessionId } = await params;
-    const normalizedSessionId = String(sessionId || "").trim();
-    if (!normalizedSessionId) {
-      return NextResponse.json(
-        { success: false, error: "缺少 sessionId" },
-        { status: 400 }
-      );
-    }
-
-    const result = await closeKittyCadModelingSession(normalizedSessionId);
-
-    return NextResponse.json({
-      success: true,
-      data: result,
-    });
-  } catch (error) {
-    return NextResponse.json(
-      {
-        success: false,
-        error: error instanceof Error ? error.message : "关闭官方建模会话失败",
-      },
-      { status: 500 }
-    );
-  }
-}

app/api/ai-cad/modeling/session/route.ts

@@ -1,33 +0,0 @@
-import { NextResponse } from "next/server";
-import { auth } from "@/app/(auth)/auth";
-import { createKittyCadModelingSession } from "@/lib/kittycad/modeling-session";
-
-export const runtime = "nodejs";
-export const maxDuration = 60;
-
-export async function POST() {
-  try {
-    const session = await auth();
-    if (!session?.user?.id) {
-      return NextResponse.json(
-        { success: false, error: "未登录" },
-        { status: 401 }
-      );
-    }
-
-    const modelingSession = await createKittyCadModelingSession();
-
-    return NextResponse.json({
-      success: true,
-      data: modelingSession,
-    });
-  } catch (error) {
-    return NextResponse.json(
-      {
-        success: false,
-        error: error instanceof Error ? error.message : "创建官方建模会话失败",
-      },
-      { status: 500 }
-    );
-  }
-}

app/api/ai-cad/provider/route.ts

@@ -1,27 +0,0 @@
-import { NextResponse } from "next/server";
-import { auth } from "@/app/(auth)/auth";
-import { findKittyCadProviderConfig } from "@/lib/kittycad/server";
-
-export const runtime = "nodejs";
-
-export async function GET() {
-  const session = await auth();
-  if (!session?.user?.id) {
-    return NextResponse.json(
-      { success: false, error: "未登录" },
-      { status: 401 }
-    );
-  }
-
-  const config = await findKittyCadProviderConfig();
-
-  return NextResponse.json({
-    success: true,
-    data: {
-      configured: Boolean(config),
-      source: config?.source || "none",
-      providerName: config?.providerName || null,
-      baseUrl: config?.baseUrl || null,
-    },
-  });
-}

app/api/ai-cad/tasks/[taskId]/route.ts

@@ -1,391 +0,0 @@
-import { NextResponse } from "next/server";
-import { auth } from "@/app/(auth)/auth";
-import { KittyCadApiError, kittyCadRequest } from "@/lib/kittycad/client";
-import { getKittyCadProviderConfig } from "@/lib/kittycad/server";
-import { uploadFile } from "@/lib/storage/service";
-
-export const runtime = "nodejs";
-export const maxDuration = 60;
-
-type KittyCadTaskResponse = {
-  id?: string;
-  status?: string;
-  outputs?: Record<string, string> | null;
-  error?: string | null;
-  code?: string | null;
-  prompt?: string | null;
-  conversation_id?: string | null;
-  model_version?: string | null;
-  output_format?: string | null;
-};
-
-type ArchivedFile = {
-  sourceHash: string;
-  archivedUrl: string;
-};
-
-type RouteParams = {
-  params: Promise<{ taskId: string }>;
-};
-
-function getArchiveCache() {
-  const globalState = globalThis as Record<string, unknown>;
-  if (!globalState.__kittyCadAssetArchiveCache) {
-    globalState.__kittyCadAssetArchiveCache = new Map<string, ArchivedFile>();
-  }
-  return globalState.__kittyCadAssetArchiveCache as Map<string, ArchivedFile>;
-}
-
-function getArchiveInflight() {
-  const globalState = globalThis as Record<string, unknown>;
-  if (!globalState.__kittyCadAssetArchiveInflight) {
-    globalState.__kittyCadAssetArchiveInflight = new Map<
-      string,
-      Promise<string | null>
-    >();
-  }
-  return globalState.__kittyCadAssetArchiveInflight as Map<
-    string,
-    Promise<string | null>
-  >;
-}
-
-function mapKittyCadStatus(status: unknown) {
-  const normalized = String(status || "")
-    .trim()
-    .toLowerCase();
-  if (!normalized) {
-    return "queued" as const;
-  }
-  if (
-    normalized === "queued" ||
-    normalized === "pending" ||
-    normalized === "created" ||
-    normalized === "submitted"
-  ) {
-    return "queued" as const;
-  }
-  if (
-    normalized === "running" ||
-    normalized === "processing" ||
-    normalized === "in_progress" ||
-    normalized === "working" ||
-    normalized === "generating"
-  ) {
-    return "running" as const;
-  }
-  if (
-    normalized === "completed" ||
-    normalized === "success" ||
-    normalized === "succeeded" ||
-    normalized === "done" ||
-    normalized === "finished"
-  ) {
-    return "success" as const;
-  }
-  if (normalized === "cancelled" || normalized === "canceled") {
-    return "cancelled" as const;
-  }
-  if (normalized === "expired" || normalized === "timed_out") {
-    return "expired" as const;
-  }
-  if (normalized === "banned" || normalized === "blocked") {
-    return "banned" as const;
-  }
-  if (
-    normalized === "failed" ||
-    normalized === "error" ||
-    normalized === "errored"
-  ) {
-    return "failed" as const;
-  }
-  return "unknown" as const;
-}
-
-function getFileExtension(filename: string) {
-  const normalized = String(filename || "")
-    .trim()
-    .toLowerCase();
-  const cleanName = normalized.split("?")[0]?.split("#")[0] || normalized;
-  const segments = cleanName.split(".");
-  return segments.length > 1 ? segments.at(-1) || "" : "";
-}
-
-function isImageExtension(extension: string) {
-  return ["png", "jpg", "jpeg", "webp", "gif"].includes(extension);
-}
-
-function pickPreferredModelFile(files: Array<{ name: string; url: string }>) {
-  const preferredOrder = ["glb", "gltf", "obj", "stl", "step", "stp"];
-  for (const extension of preferredOrder) {
-    const matched = files.find(
-      (item) => getFileExtension(item.name) === extension
-    );
-    if (matched) {
-      return matched;
-    }
-  }
-  return null;
-}
-
-function pickPreviewImageFile(files: Array<{ name: string; url: string }>) {
-  return (
-    files.find((item) => isImageExtension(getFileExtension(item.name))) || null
-  );
-}
-
-async function archiveOutputIfNeeded(params: {
-  taskId: string;
-  filename: string;
-  base64: string;
-}) {
-  const normalizedFilename = String(params.filename || "").trim();
-  const normalizedBase64 = String(params.base64 || "").trim();
-  if (!normalizedFilename || !normalizedBase64) {
-    return null;
-  }
-
-  const cacheKey = `${params.taskId}:${normalizedFilename}`;
-  const cache = getArchiveCache();
-  const cached = cache.get(cacheKey);
-  if (cached && cached.sourceHash === normalizedBase64) {
-    return cached.archivedUrl;
-  }
-
-  const inflight = getArchiveInflight();
-  const existingTask = inflight.get(cacheKey);
-  if (existingTask) {
-    return (await existingTask) || null;
-  }
-
-  const archiveTask = (async () => {
-    try {
-      const binary = Buffer.from(normalizedBase64, "base64");
-      if (binary.byteLength <= 0) {
-        throw new Error("KittyCAD 输出文件为空");
-      }
-      const arrayBuffer = Uint8Array.from(binary).buffer;
-
-      const safeFilename =
-        normalizedFilename.replace(/[^\w.-]+/g, "-") || "kittycad-output.bin";
-      const uploaded = await uploadFile(
-        `kittycad-${params.taskId}-${safeFilename}`,
-        arrayBuffer
-      );
-      cache.set(cacheKey, {
-        sourceHash: normalizedBase64,
-        archivedUrl: uploaded.url,
-      });
-      return uploaded.url;
-    } catch (error) {
-      console.error("[KittyCADArchive] failed", {
-        taskId: params.taskId,
-        filename: normalizedFilename,
-        error: error instanceof Error ? error.message : String(error),
-      });
-      return null;
-    } finally {
-      inflight.delete(cacheKey);
-    }
-  })();
-
-  inflight.set(cacheKey, archiveTask);
-  return await archiveTask;
-}
-
-async function archiveTextOutputIfNeeded(params: {
-  taskId: string;
-  filename: string;
-  content: string;
-}) {
-  const normalizedFilename = String(params.filename || "").trim();
-  const normalizedContent = String(params.content || "");
-  if (!normalizedFilename || !normalizedContent.trim()) {
-    return null;
-  }
-
-  const cacheKey = `${params.taskId}:${normalizedFilename}`;
-  const cache = getArchiveCache();
-  const cached = cache.get(cacheKey);
-  if (cached && cached.sourceHash === normalizedContent) {
-    return cached.archivedUrl;
-  }
-
-  const inflight = getArchiveInflight();
-  const existingTask = inflight.get(cacheKey);
-  if (existingTask) {
-    return (await existingTask) || null;
-  }
-
-  const archiveTask = (async () => {
-    try {
-      const arrayBuffer = Uint8Array.from(
-        new TextEncoder().encode(normalizedContent)
-      ).buffer;
-      const safeFilename =
-        normalizedFilename.replace(/[^\w.-]+/g, "-") || "kittycad-output.kcl";
-      const uploaded = await uploadFile(
-        `kittycad-${params.taskId}-${safeFilename}`,
-        arrayBuffer
-      );
-      cache.set(cacheKey, {
-        sourceHash: normalizedContent,
-        archivedUrl: uploaded.url,
-      });
-      return uploaded.url;
-    } catch (error) {
-      console.error("[KittyCADArchive:text] failed", {
-        taskId: params.taskId,
-        filename: normalizedFilename,
-        error: error instanceof Error ? error.message : String(error),
-      });
-      return null;
-    } finally {
-      inflight.delete(cacheKey);
-    }
-  })();
-
-  inflight.set(cacheKey, archiveTask);
-  return await archiveTask;
-}
-
-export async function GET(_request: Request, { params }: RouteParams) {
-  try {
-    const session = await auth();
-    if (!session?.user?.id) {
-      return NextResponse.json(
-        { success: false, error: "未登录" },
-        { status: 401 }
-      );
-    }
-
-    const { taskId } = await params;
-    const normalizedTaskId = String(taskId || "").trim();
-    if (!normalizedTaskId) {
-      return NextResponse.json(
-        { success: false, error: "缺少 taskId" },
-        { status: 400 }
-      );
-    }
-
-    const config = await getKittyCadProviderConfig();
-    const result = await kittyCadRequest<KittyCadTaskResponse>(config, {
-      method: "GET",
-      path: `/user/text-to-cad/${encodeURIComponent(normalizedTaskId)}`,
-    });
-
-    const status = mapKittyCadStatus(result.status);
-    if (status !== "success") {
-      return NextResponse.json({
-        success: true,
-        data: {
-          taskId: normalizedTaskId,
-          type: "cad",
-          status,
-          progress: status === "running" ? 65 : null,
-          errorMessage: result.error || null,
-          conversationId: result.conversation_id || null,
-          modelVersion: result.model_version || null,
-          outputFormat: result.output_format || null,
-          output: result,
-        },
-      });
-    }
-
-    const outputEntries = Object.entries(result.outputs || {}).filter(
-      (entry): entry is [string, string] =>
-        typeof entry[0] === "string" &&
-        entry[0].trim().length > 0 &&
-        typeof entry[1] === "string" &&
-        entry[1].trim().length > 0
-    );
-
-    const archivedEntries = await Promise.all(
-      outputEntries.map(async ([name, base64]) => {
-        const archivedUrl = await archiveOutputIfNeeded({
-          taskId: normalizedTaskId,
-          filename: name,
-          base64,
-        });
-        return archivedUrl ? { name, url: archivedUrl } : null;
-      })
-    );
-
-    const archivedFiles = archivedEntries.filter(
-      (item): item is { name: string; url: string } =>
-        Boolean(item?.name && item?.url)
-    );
-
-    const hasArchivedKclFile = archivedFiles.some(
-      (item) => getFileExtension(item.name) === "kcl"
-    );
-    if (
-      !hasArchivedKclFile &&
-      typeof result.code === "string" &&
-      result.code.trim()
-    ) {
-      const archivedCodeUrl = await archiveTextOutputIfNeeded({
-        taskId: normalizedTaskId,
-        filename: "main.kcl",
-        content: result.code,
-      });
-      if (archivedCodeUrl) {
-        archivedFiles.push({
-          name: "main.kcl",
-          url: archivedCodeUrl,
-        });
-      }
-    }
-
-    const modelFile = pickPreferredModelFile(archivedFiles);
-    const previewImageFile = pickPreviewImageFile(archivedFiles);
-    const downloadUrls = Object.fromEntries(
-      archivedFiles.map((item) => [item.name, item.url])
-    );
-    const codeFile =
-      archivedFiles.find((item) => getFileExtension(item.name) === "kcl") ||
-      null;
-
-    return NextResponse.json({
-      success: true,
-      data: {
-        taskId: normalizedTaskId,
-        type: "cad",
-        status: "success",
-        progress: 100,
-        modelUrl:
-          modelFile &&
-          ["glb", "gltf"].includes(getFileExtension(modelFile.name))
-            ? modelFile.url
-            : null,
-        previewImageUrl: previewImageFile?.url || null,
-        errorMessage: result.error || null,
-        conversationId: result.conversation_id || null,
-        modelVersion: result.model_version || null,
-        outputFormat: result.output_format || null,
-        codeUrl: codeFile?.url || null,
-        downloadUrls,
-        output: result,
-      },
-    });
-  } catch (error) {
-    if (error instanceof KittyCadApiError) {
-      return NextResponse.json(
-        {
-          success: false,
-          error: error.message,
-          payload: error.payload,
-        },
-        { status: error.httpStatus || 502 }
-      );
-    }
-
-    return NextResponse.json(
-      {
-        success: false,
-        error: error instanceof Error ? error.message : "查询 AI-CAD 任务失败",
-      },
-      { status: 500 }
-    );
-  }
-}

app/api/ai-cad/tasks/route.ts

@@ -1,331 +0,0 @@
-import { NextResponse } from "next/server";
-import { auth } from "@/app/(auth)/auth";
-import {
-  consumeUserPoints,
-  getPointsSystemConfig,
-  getUserById,
-} from "@/lib/db/queries";
-import { KittyCadApiError, kittyCadRequest } from "@/lib/kittycad/client";
-import { getKittyCadProviderConfig } from "@/lib/kittycad/server";
-
-export const runtime = "nodejs";
-export const maxDuration = 60;
-
-type CreateAiCadTaskRequest = {
-  prompt?: string;
-  outputFormat?: string;
-  projectName?: string;
-  iterationSourceTaskId?: string;
-  sourceCode?: string;
-  sourceRanges?: Record<string, unknown>[];
-};
-
-type KittyCadCreateResponse = {
-  id?: string;
-  status?: string;
-  conversation_id?: string | null;
-  model_version?: string | null;
-  output_format?: string | null;
-};
-
-type KittyCadSourceTaskResponse = {
-  code?: string | null;
-  outputs?: Record<string, string> | null;
-};
-
-type KittyCadIterationResponse = {
-  id?: string;
-  status?: string;
-  conversation_id?: string | null;
-  model_version?: string | null;
-  output_format?: string | null;
-};
-
-function getFileExtension(filename: string) {
-  const normalized = String(filename || "")
-    .trim()
-    .toLowerCase();
-  const cleanName = normalized.split("?")[0]?.split("#")[0] || normalized;
-  const segments = cleanName.split(".");
-  return segments.length > 1 ? segments.at(-1) || "" : "";
-}
-
-function decodeBase64Text(value: unknown) {
-  const normalized = String(value || "").trim();
-  if (!normalized) {
-    return null;
-  }
-
-  try {
-    const decoded = Buffer.from(normalized, "base64").toString("utf8").trim();
-    return decoded || null;
-  } catch (_error) {
-    return null;
-  }
-}
-
-function extractSourceCodeFromTask(task: KittyCadSourceTaskResponse) {
-  const directCode = String(task.code || "").trim();
-  if (directCode) {
-    return directCode;
-  }
-
-  const kclOutputEntry = Object.entries(task.outputs || {}).find(
-    (entry): entry is [string, string] =>
-      typeof entry[0] === "string" &&
-      entry[0].trim().length > 0 &&
-      getFileExtension(entry[0]) === "kcl" &&
-      typeof entry[1] === "string" &&
-      entry[1].trim().length > 0
-  );
-
-  if (!kclOutputEntry) {
-    return null;
-  }
-
-  return decodeBase64Text(kclOutputEntry[1]);
-}
-
-function mapKittyCadStatus(status: unknown) {
-  const normalized = String(status || "")
-    .trim()
-    .toLowerCase();
-  if (!normalized) {
-    return "queued" as const;
-  }
-  if (
-    normalized === "queued" ||
-    normalized === "pending" ||
-    normalized === "created" ||
-    normalized === "submitted"
-  ) {
-    return "queued" as const;
-  }
-  if (
-    normalized === "running" ||
-    normalized === "processing" ||
-    normalized === "in_progress" ||
-    normalized === "working" ||
-    normalized === "generating"
-  ) {
-    return "running" as const;
-  }
-  if (
-    normalized === "completed" ||
-    normalized === "success" ||
-    normalized === "succeeded" ||
-    normalized === "done" ||
-    normalized === "finished"
-  ) {
-    return "success" as const;
-  }
-  if (normalized === "cancelled" || normalized === "canceled") {
-    return "cancelled" as const;
-  }
-  if (normalized === "expired" || normalized === "timed_out") {
-    return "expired" as const;
-  }
-  if (normalized === "banned" || normalized === "blocked") {
-    return "banned" as const;
-  }
-  if (
-    normalized === "failed" ||
-    normalized === "error" ||
-    normalized === "errored"
-  ) {
-    return "failed" as const;
-  }
-  return "unknown" as const;
-}
-
-export async function POST(request: Request) {
-  try {
-    const session = await auth();
-    if (!session?.user?.id) {
-      return NextResponse.json(
-        { success: false, error: "未登录" },
-        { status: 401 }
-      );
-    }
-
-    const body = (await request.json()) as CreateAiCadTaskRequest;
-    const prompt = String(body.prompt || "").trim();
-
-    const pointsConfig = await getPointsSystemConfig();
-    const unitCost = Number.isFinite(Number(pointsConfig.creditCostPer3DModel))
-      ? Math.max(0, Math.round(Number(pointsConfig.creditCostPer3DModel)))
-      : 0;
-
-    if (
-      pointsConfig.enabled &&
-      unitCost > 0 &&
-      pointsConfig.blockOnInsufficient !== false
-    ) {
-      const userData = await getUserById({ id: session.user.id });
-      if (!userData?.isHighVip) {
-        const currentBalance = Math.max(
-          0,
-          Number(userData?.pointsBalance || 0)
-        );
-        if (currentBalance < unitCost) {
-          return NextResponse.json(
-            {
-              success: false,
-              error: "积分不足",
-              code: "insufficient_points",
-              message: `积分不足，当前余额 ${currentBalance}，本次预计消耗 ${unitCost}。`,
-              balance: currentBalance,
-              expectedCost: unitCost,
-              unitCost,
-            },
-            { status: 402 }
-          );
-        }
-      }
-    }
-
-    const outputFormat =
-      String(body.outputFormat || "glb")
-        .trim()
-        .toLowerCase() || "glb";
-    const normalizedProjectName = String(body.projectName || "").trim();
-    const iterationSourceTaskId = String(
-      body.iterationSourceTaskId || ""
-    ).trim();
-    const sourceCode = String(body.sourceCode || "");
-    const normalizedSourceCode = sourceCode.trim();
-    const sourceRanges = Array.isArray(body.sourceRanges)
-      ? body.sourceRanges.filter(
-          (item): item is Record<string, unknown> =>
-            Boolean(item) && typeof item === "object" && !Array.isArray(item)
-        )
-      : [];
-    const config = await getKittyCadProviderConfig();
-    const generationMode =
-      iterationSourceTaskId || normalizedSourceCode ? "iterate" : "create";
-
-    if (generationMode === "create" && !prompt) {
-      return NextResponse.json(
-        { success: false, error: "请输入 CAD 描述" },
-        { status: 400 }
-      );
-    }
-
-    const iterationPrompt =
-      prompt || "Apply the edited KCL source and rebuild the CAD model.";
-    const result =
-      generationMode === "iterate"
-        ? await (async () => {
-            const originalSourceCode =
-              normalizedSourceCode ||
-              (await (async () => {
-                if (!iterationSourceTaskId) {
-                  return null;
-                }
-
-                const sourceTask =
-                  await kittyCadRequest<KittyCadSourceTaskResponse>(config, {
-                    method: "GET",
-                    path: `/user/text-to-cad/${encodeURIComponent(iterationSourceTaskId)}`,
-                  });
-                return extractSourceCodeFromTask(sourceTask);
-              })());
-
-            if (!originalSourceCode) {
-              throw new KittyCadApiError({
-                message:
-                  "当前参考版本缺少可继续编辑的 KCL 源码，请先等待该版本完成，或重新选择一个 KittyCAD 版本。",
-                httpStatus: 409,
-              });
-            }
-
-            return kittyCadRequest<KittyCadIterationResponse>(config, {
-              method: "POST",
-              path: "/ml/text-to-cad/iteration",
-              json: {
-                original_source_code: originalSourceCode,
-                prompt: iterationPrompt,
-                source_ranges: sourceRanges,
-                ...(normalizedProjectName
-                  ? { project_name: normalizedProjectName }
-                  : {}),
-              },
-            });
-          })()
-        : await kittyCadRequest<KittyCadCreateResponse>(config, {
-            method: "POST",
-            path: `/ai/text-to-cad/${encodeURIComponent(outputFormat)}?kcl=true`,
-            json: {
-              prompt,
-              ...(normalizedProjectName
-                ? { project_name: normalizedProjectName }
-                : {}),
-            },
-          });
-
-    const taskId = String(result.id || "").trim();
-    if (!taskId) {
-      return NextResponse.json(
-        {
-          success: false,
-          error: "KittyCAD 返回缺少任务 ID",
-          raw: result,
-        },
-        { status: 502 }
-      );
-    }
-
-    if (pointsConfig.enabled && unitCost > 0) {
-      try {
-        await consumeUserPoints({
-          userId: session.user.id,
-          amount: unitCost,
-          reason: "model3d_generation",
-          modelId: "kittycad-cad",
-          note:
-            generationMode === "iterate"
-              ? "AI-CAD 连续迭代消耗积分"
-              : "AI-CAD 生成消耗积分",
-        });
-      } catch (error) {
-        console.error("[Points] Failed to consume AI-CAD points:", error);
-      }
-    }
-
-    return NextResponse.json({
-      success: true,
-      data: {
-        taskId,
-        status: mapKittyCadStatus(result.status),
-        conversationId: result.conversation_id || null,
-        modelVersion: result.model_version || null,
-        outputFormat:
-          generationMode === "iterate"
-            ? result.output_format || null
-            : result.output_format || outputFormat,
-        generationMode,
-        sourceTaskId: iterationSourceTaskId || null,
-        raw: result,
-      },
-    });
-  } catch (error) {
-    if (error instanceof KittyCadApiError) {
-      return NextResponse.json(
-        {
-          success: false,
-          error: error.message,
-          payload: error.payload,
-        },
-        { status: error.httpStatus || 502 }
-      );
-    }
-
-    return NextResponse.json(
-      {
-        success: false,
-        error: error instanceof Error ? error.message : "创建 AI-CAD 任务失败",
-      },
-      { status: 500 }
-    );
-  }
-}

app/api/ai-cad/workspace-utils.ts

@@ -1,195 +0,0 @@
-import type { AiCadWorkspace } from "@/lib/db/schema";
-
-type CadGenerationProvider = "kittycad-cad" | "tripo-3d";
-
-const FINAL_TASK_STATUS = new Set([
-  "success",
-  "failed",
-  "banned",
-  "expired",
-  "cancelled",
-  "unknown",
-]);
-
-const DEFAULT_VIEWER_SETTINGS = {
-  cameraPreset: "iso",
-  envPreset: "studio",
-  lightIntensity: 1.1,
-  autoRotate: true,
-  showGrid: true,
-  wireframe: false,
-} as const;
-
-type WorkspaceVersionLike = {
-  status?: unknown;
-  prompt?: unknown;
-};
-
-export type UpdateAiCadWorkspaceRequest = {
-  name?: string;
-  prompt?: string;
-  generationProvider?: string;
-  modelVersion?: string;
-  viewerSettings?: unknown;
-  messages?: unknown;
-  versions?: unknown;
-  activeVersionId?: string | null;
-};
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null;
-}
-
-function getWorkspaceVersions(value: unknown): WorkspaceVersionLike[] {
-  if (!Array.isArray(value)) {
-    return [];
-  }
-
-  return value.filter((item): item is WorkspaceVersionLike => isRecord(item));
-}
-
-export function normalizeViewerSettings(
-  value: unknown
-): Record<string, unknown> {
-  if (!isRecord(value)) {
-    return { ...DEFAULT_VIEWER_SETTINGS };
-  }
-
-  return {
-    cameraPreset:
-      value.cameraPreset === "top" ||
-      value.cameraPreset === "front" ||
-      value.cameraPreset === "right" ||
-      value.cameraPreset === "iso"
-        ? value.cameraPreset
-        : DEFAULT_VIEWER_SETTINGS.cameraPreset,
-    envPreset:
-      typeof value.envPreset === "string" && value.envPreset.trim()
-        ? value.envPreset
-        : DEFAULT_VIEWER_SETTINGS.envPreset,
-    lightIntensity:
-      typeof value.lightIntensity === "number" &&
-      Number.isFinite(value.lightIntensity)
-        ? value.lightIntensity
-        : DEFAULT_VIEWER_SETTINGS.lightIntensity,
-    autoRotate:
-      typeof value.autoRotate === "boolean"
-        ? value.autoRotate
-        : DEFAULT_VIEWER_SETTINGS.autoRotate,
-    showGrid:
-      typeof value.showGrid === "boolean"
-        ? value.showGrid
-        : DEFAULT_VIEWER_SETTINGS.showGrid,
-    wireframe:
-      typeof value.wireframe === "boolean"
-        ? value.wireframe
-        : DEFAULT_VIEWER_SETTINGS.wireframe,
-  };
-}
-
-export function normalizeJsonRecordArray(
-  value: unknown
-): Record<string, unknown>[] {
-  if (!Array.isArray(value)) {
-    return [];
-  }
-
-  return value.filter((item): item is Record<string, unknown> =>
-    isRecord(item)
-  );
-}
-
-export function normalizeWorkspaceName(
-  value: unknown,
-  fallbackName = "AI-CAD 工作台"
-) {
-  return typeof value === "string" && value.trim()
-    ? value.trim()
-    : fallbackName;
-}
-
-export function normalizeWorkspacePayload(body: UpdateAiCadWorkspaceRequest): {
-  name?: string;
-  prompt: string;
-  generationProvider: CadGenerationProvider;
-  modelVersion: string;
-  viewerSettings: Record<string, unknown>;
-  messages: Record<string, unknown>[];
-  versions: Record<string, unknown>[];
-  activeVersionId: string | null;
-} {
-  return {
-    ...(typeof body.name === "string" && body.name.trim()
-      ? { name: body.name.trim() }
-      : {}),
-    prompt: String(body.prompt || ""),
-    generationProvider:
-      body.generationProvider === "tripo-3d" ? "tripo-3d" : "kittycad-cad",
-    modelVersion:
-      typeof body.modelVersion === "string" && body.modelVersion.trim()
-        ? body.modelVersion
-        : "Turbo-v1.0-20250506",
-    viewerSettings: normalizeViewerSettings(body.viewerSettings),
-    messages: normalizeJsonRecordArray(body.messages),
-    versions: normalizeJsonRecordArray(body.versions),
-    activeVersionId:
-      typeof body.activeVersionId === "string" && body.activeVersionId.trim()
-        ? body.activeVersionId
-        : null,
-  };
-}
-
-export function buildDefaultWorkspaceName(index: number) {
-  return index > 1 ? `AI-CAD 工作台 ${index}` : "AI-CAD 工作台";
-}
-
-export function createWorkspaceSummary(workspace: AiCadWorkspace) {
-  const versions = getWorkspaceVersions(workspace.versions);
-  const versionCount = versions.length;
-  const completedCount = versions.filter(
-    (version) => version.status === "success"
-  ).length;
-  const hasPendingTasks = versions.some(
-    (version) =>
-      typeof version.status !== "string" ||
-      !FINAL_TASK_STATUS.has(version.status)
-  );
-  const latestPrompt =
-    typeof workspace.prompt === "string" && workspace.prompt.trim()
-      ? workspace.prompt.trim()
-      : versions.find(
-          (version) =>
-            typeof version.prompt === "string" && version.prompt.trim()
-        )?.prompt || null;
-
-  return {
-    id: workspace.id,
-    name: workspace.name,
-    generationProvider: workspace.generationProvider,
-    versionCount,
-    completedCount,
-    hasPendingTasks,
-    latestPrompt:
-      typeof latestPrompt === "string" && latestPrompt.trim()
-        ? latestPrompt.trim()
-        : null,
-    createdAt: workspace.createdAt?.toISOString() || null,
-    updatedAt: workspace.updatedAt?.toISOString() || null,
-  };
-}
-
-export function createWorkspaceDocument(workspace: AiCadWorkspace) {
-  return {
-    id: workspace.id,
-    name: workspace.name,
-    prompt: workspace.prompt,
-    generationProvider: workspace.generationProvider,
-    modelVersion: workspace.modelVersion,
-    viewerSettings: workspace.viewerSettings,
-    messages: workspace.messages,
-    versions: workspace.versions,
-    activeVersionId: workspace.activeVersionId,
-    createdAt: workspace.createdAt?.toISOString() || null,
-    updatedAt: workspace.updatedAt?.toISOString() || null,
-  };
-}

app/api/ai-cad/workspace/route.ts

@@ -1,89 +0,0 @@
-import { NextResponse } from "next/server";
-import { auth } from "@/app/(auth)/auth";
-import {
-  createWorkspaceDocument,
-  normalizeWorkspacePayload,
-  type UpdateAiCadWorkspaceRequest,
-} from "@/app/api/ai-cad/workspace-utils";
-import {
-  createAiCadWorkspace,
-  listAiCadWorkspacesByUserId,
-  updateAiCadWorkspace,
-} from "@/lib/db/queries";
-
-export const runtime = "nodejs";
-
-export async function GET() {
-  const session = await auth();
-  if (!session?.user?.id) {
-    return NextResponse.json(
-      { success: false, error: "未登录" },
-      { status: 401 }
-    );
-  }
-
-  const workspaces = await listAiCadWorkspacesByUserId({
-    userId: session.user.id,
-  });
-  const workspace = workspaces[0] ?? null;
-
-  if (!workspace) {
-    return NextResponse.json({
-      success: true,
-      data: null,
-    });
-  }
-
-  return NextResponse.json({
-    success: true,
-    data: createWorkspaceDocument(workspace),
-  });
-}
-
-export async function PUT(request: Request) {
-  const session = await auth();
-  if (!session?.user?.id) {
-    return NextResponse.json(
-      { success: false, error: "未登录" },
-      { status: 401 }
-    );
-  }
-
-  const body = (await request.json()) as UpdateAiCadWorkspaceRequest;
-  const existingWorkspaces = await listAiCadWorkspacesByUserId({
-    userId: session.user.id,
-  });
-  const targetWorkspace =
-    existingWorkspaces[0] ??
-    (await createAiCadWorkspace({
-      userId: session.user.id,
-      name: "AI-CAD 工作台",
-    }));
-
-  if (!targetWorkspace) {
-    return NextResponse.json(
-      { success: false, error: "初始化 AI-CAD 工作台失败" },
-      { status: 500 }
-    );
-  }
-
-  const savedWorkspace = await updateAiCadWorkspace({
-    workspaceId: targetWorkspace.id,
-    userId: session.user.id,
-    ...normalizeWorkspacePayload(body),
-  });
-
-  if (!savedWorkspace) {
-    return NextResponse.json(
-      { success: false, error: "保存 AI-CAD 工作台失败" },
-      { status: 500 }
-    );
-  }
-
-  return NextResponse.json({
-    success: true,
-    data: {
-      updatedAt: savedWorkspace.updatedAt?.toISOString() || null,
-    },
-  });
-}

app/api/ai-cad/workspaces/[workspaceId]/route.ts

@@ -1,114 +0,0 @@
-import { NextResponse } from "next/server";
-import { auth } from "@/app/(auth)/auth";
-import {
-  createWorkspaceDocument,
-  createWorkspaceSummary,
-  normalizeWorkspacePayload,
-  type UpdateAiCadWorkspaceRequest,
-} from "@/app/api/ai-cad/workspace-utils";
-import {
-  deleteAiCadWorkspaceById,
-  getAiCadWorkspaceById,
-  updateAiCadWorkspace,
-} from "@/lib/db/queries";
-
-export const runtime = "nodejs";
-
-type RouteContext = {
-  params: Promise<{
-    workspaceId: string;
-  }>;
-};
-
-export async function GET(_request: Request, context: RouteContext) {
-  const session = await auth();
-  if (!session?.user?.id) {
-    return NextResponse.json(
-      { success: false, error: "未登录" },
-      { status: 401 }
-    );
-  }
-
-  const { workspaceId } = await context.params;
-  const workspace = await getAiCadWorkspaceById({
-    userId: session.user.id,
-    workspaceId,
-  });
-
-  if (!workspace) {
-    return NextResponse.json(
-      { success: false, error: "AI-CAD 工作台不存在" },
-      { status: 404 }
-    );
-  }
-
-  return NextResponse.json({
-    success: true,
-    data: createWorkspaceDocument(workspace),
-  });
-}
-
-export async function PUT(request: Request, context: RouteContext) {
-  const session = await auth();
-  if (!session?.user?.id) {
-    return NextResponse.json(
-      { success: false, error: "未登录" },
-      { status: 401 }
-    );
-  }
-
-  const { workspaceId } = await context.params;
-  const body = (await request.json()) as UpdateAiCadWorkspaceRequest;
-  const savedWorkspace = await updateAiCadWorkspace({
-    workspaceId,
-    userId: session.user.id,
-    ...normalizeWorkspacePayload(body),
-  });
-
-  if (!savedWorkspace) {
-    return NextResponse.json(
-      { success: false, error: "AI-CAD 工作台不存在或保存失败" },
-      { status: 404 }
-    );
-  }
-
-  return NextResponse.json({
-    success: true,
-    data: {
-      id: savedWorkspace.id,
-      name: savedWorkspace.name,
-      updatedAt: savedWorkspace.updatedAt?.toISOString() || null,
-      summary: createWorkspaceSummary(savedWorkspace),
-    },
-  });
-}
-
-export async function DELETE(_request: Request, context: RouteContext) {
-  const session = await auth();
-  if (!session?.user?.id) {
-    return NextResponse.json(
-      { success: false, error: "未登录" },
-      { status: 401 }
-    );
-  }
-
-  const { workspaceId } = await context.params;
-  const deletedWorkspace = await deleteAiCadWorkspaceById({
-    workspaceId,
-    userId: session.user.id,
-  });
-
-  if (!deletedWorkspace) {
-    return NextResponse.json(
-      { success: false, error: "AI-CAD 工作台不存在" },
-      { status: 404 }
-    );
-  }
-
-  return NextResponse.json({
-    success: true,
-    data: {
-      id: deletedWorkspace.id,
-    },
-  });
-}

app/api/ai-cad/workspaces/route.ts

@@ -1,69 +0,0 @@
-import { NextResponse } from "next/server";
-import { auth } from "@/app/(auth)/auth";
-import {
-  buildDefaultWorkspaceName,
-  createWorkspaceSummary,
-  normalizeWorkspaceName,
-} from "@/app/api/ai-cad/workspace-utils";
-import {
-  createAiCadWorkspace,
-  listAiCadWorkspacesByUserId,
-} from "@/lib/db/queries";
-
-export const runtime = "nodejs";
-
-export async function GET() {
-  const session = await auth();
-  if (!session?.user?.id) {
-    return NextResponse.json(
-      { success: false, error: "未登录" },
-      { status: 401 }
-    );
-  }
-
-  const workspaces = await listAiCadWorkspacesByUserId({
-    userId: session.user.id,
-  });
-
-  return NextResponse.json({
-    success: true,
-    data: workspaces.map(createWorkspaceSummary),
-  });
-}
-
-export async function POST(request: Request) {
-  const session = await auth();
-  if (!session?.user?.id) {
-    return NextResponse.json(
-      { success: false, error: "未登录" },
-      { status: 401 }
-    );
-  }
-
-  const body = (await request.json().catch(() => ({}))) as { name?: unknown };
-  const existingWorkspaces = await listAiCadWorkspacesByUserId({
-    userId: session.user.id,
-  });
-  const workspace = await createAiCadWorkspace({
-    userId: session.user.id,
-    name: normalizeWorkspaceName(
-      body.name,
-      buildDefaultWorkspaceName(existingWorkspaces.length + 1)
-    ),
-  });
-
-  if (!workspace) {
-    return NextResponse.json(
-      { success: false, error: "创建 AI-CAD 工作台失败" },
-      { status: 500 }
-    );
-  }
-
-  return NextResponse.json(
-    {
-      success: true,
-      data: createWorkspaceSummary(workspace),
-    },
-    { status: 201 }
-  );
-}

app/api/ai-cad/zoo-ws-authorize/route.ts

@@ -0,0 +1,66 @@
+import { timingSafeEqual } from "node:crypto";
+import { NextResponse } from "next/server";
+import { auth } from "@/app/(auth)/auth";
+import { getKittyCadProviderConfig } from "@/lib/kittycad/server";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+const ALLOWED_WEBSOCKET_PATHS = new Set([
+  "/api/ai-cad/zoo-ws/ml/copilot",
+  "/api/ai-cad/zoo-ws/modeling/commands",
+]);
+
+function hasValidInternalSecret(request: Request) {
+  const expected = String(process.env.AI_CAD_WS_PROXY_SECRET || "").trim();
+  const received = String(
+    request.headers.get("x-hicad-ws-proxy-secret") || ""
+  ).trim();
+  if (!expected || !received) {
+    return false;
+  }
+
+  const expectedBuffer = Buffer.from(expected);
+  const receivedBuffer = Buffer.from(received);
+  return (
+    expectedBuffer.length === receivedBuffer.length &&
+    timingSafeEqual(expectedBuffer, receivedBuffer)
+  );
+}
+
+export async function GET(request: Request) {
+  if (!hasValidInternalSecret(request)) {
+    return NextResponse.json({ error: "禁止访问" }, { status: 403 });
+  }
+
+  const originalUri = String(
+    request.headers.get("x-hicad-original-uri") || ""
+  ).split("?", 1)[0];
+  if (!ALLOWED_WEBSOCKET_PATHS.has(originalUri)) {
+    return NextResponse.json({ error: "不支持的 Zoo WebSocket" }, { status: 403 });
+  }
+
+  const session = await auth();
+  if (!session?.user?.id) {
+    return NextResponse.json({ error: "未登录" }, { status: 401 });
+  }
+
+  try {
+    const config = await getKittyCadProviderConfig();
+    return new Response(null, {
+      headers: {
+        "Cache-Control": "private, no-store",
+        "X-Zoo-Authorization": `Bearer ${config.apiKey}`,
+      },
+      status: 204,
+    });
+  } catch (error) {
+    return NextResponse.json(
+      {
+        error:
+          error instanceof Error ? error.message : "Zoo WebSocket 鉴权失败",
+      },
+      { status: 503 }
+    );
+  }
+}

app/api/ai-cad/zoo/[...path]/route.ts

@@ -0,0 +1,140 @@
+import { NextResponse } from "next/server";
+import { auth } from "@/app/(auth)/auth";
+import { getKittyCadProviderConfig } from "@/lib/kittycad/server";
+
+export const dynamic = "force-dynamic";
+export const maxDuration = 60;
+export const runtime = "nodejs";
+
+const HOP_BY_HOP_HEADERS = new Set([
+  "connection",
+  "content-length",
+  "host",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade",
+]);
+
+const BLOCKED_PATH_PREFIXES = [
+  "/admin",
+  "/internal",
+  "/logout",
+  "/oauth2",
+  "/org/api-tokens",
+  "/user/api-tokens",
+  "/users",
+];
+
+type RouteContext = {
+  params: Promise<{ path: string[] }>;
+};
+
+function isBlockedPath(pathname: string) {
+  return BLOCKED_PATH_PREFIXES.some(
+    (prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`)
+  );
+}
+
+function copyRequestHeaders(request: Request, apiKey: string) {
+  const headers = new Headers();
+
+  for (const [name, value] of request.headers.entries()) {
+    const normalizedName = name.toLowerCase();
+    if (
+      HOP_BY_HOP_HEADERS.has(normalizedName) ||
+      normalizedName === "authorization" ||
+      normalizedName === "cookie" ||
+      normalizedName === "origin" ||
+      normalizedName === "referer" ||
+      normalizedName.startsWith("x-forwarded-") ||
+      normalizedName === "x-hicad-ws-proxy-secret"
+    ) {
+      continue;
+    }
+    headers.set(name, value);
+  }
+
+  headers.set("Authorization", `Bearer ${apiKey}`);
+  headers.set("Accept", request.headers.get("accept") || "application/json");
+  return headers;
+}
+
+function copyResponseHeaders(upstream: Response) {
+  const headers = new Headers();
+
+  for (const [name, value] of upstream.headers.entries()) {
+    const normalizedName = name.toLowerCase();
+    if (
+      HOP_BY_HOP_HEADERS.has(normalizedName) ||
+      normalizedName === "content-encoding" ||
+      normalizedName === "set-cookie"
+    ) {
+      continue;
+    }
+    headers.set(name, value);
+  }
+
+  headers.set("Cache-Control", "private, no-store");
+  return headers;
+}
+
+async function proxyZooRequest(request: Request, context: RouteContext) {
+  const session = await auth();
+  if (!session?.user?.id) {
+    return NextResponse.json({ error: "未登录" }, { status: 401 });
+  }
+
+  const { path } = await context.params;
+  const pathname = `/${path.map(encodeURIComponent).join("/")}`;
+  if (isBlockedPath(pathname)) {
+    return NextResponse.json(
+      { error: "该 Zoo API 不允许通过 HiCAD 代理访问" },
+      { status: 403 }
+    );
+  }
+
+  try {
+    const config = await getKittyCadProviderConfig();
+    const incomingUrl = new URL(request.url);
+    const baseUrl = config.baseUrl.replace(/\/+$/, "");
+    const upstreamUrl = `${baseUrl}${pathname}${incomingUrl.search}`;
+    const method = request.method.toUpperCase();
+    const hasBody = method !== "GET" && method !== "HEAD";
+    const init: RequestInit & { duplex?: "half" } = {
+      body: hasBody ? request.body : undefined,
+      cache: "no-store",
+      duplex: hasBody ? "half" : undefined,
+      headers: copyRequestHeaders(request, config.apiKey),
+      method,
+      redirect: "manual",
+      signal: request.signal,
+    };
+    const upstream = await fetch(upstreamUrl, init);
+
+    return new Response(upstream.body, {
+      headers: copyResponseHeaders(upstream),
+      status: upstream.status,
+      statusText: upstream.statusText,
+    });
+  } catch (error) {
+    return NextResponse.json(
+      {
+        error:
+          error instanceof Error ? error.message : "Zoo API 代理请求失败",
+      },
+      { status: 502 }
+    );
+  }
+}
+
+export const DELETE = proxyZooRequest;
+export const GET = proxyZooRequest;
+export const HEAD = proxyZooRequest;
+export const OPTIONS = proxyZooRequest;
+export const PATCH = proxyZooRequest;
+export const POST = proxyZooRequest;
+export const PUT = proxyZooRequest;

app/api/ai-wash/generate/route.ts

@@ -13,6 +13,7 @@ import {
   findStyleProImageModelByRef,
   getStyleProImageModelEntries,
 } from "@/lib/style-pro/model-options";
+import { getAiModelFrontendAvailability } from "@/lib/ai/model-frontend-availability";
 
 const requestSchema = z.object({
   prompt: z.string().min(1).max(5000),
@@ -52,6 +53,16 @@ export async function POST(request: Request) {
         { status: 400 }
       );
     }
+    const availability = getAiModelFrontendAvailability(selectedModel.model);
+    if (availability.selectable === false) {
+      return NextResponse.json(
+        {
+          success: false,
+          error: availability.disabledReason || "所选 AI洗图 生图模型当前不可用",
+        },
+        { status: 400 }
+      );
+    }
 
     const imageSize = body.imageSize?.trim() || "2K";
     const unitCost = getModelGenerationCreditCost(selectedModel.model as any, "image", {

app/api/canvas-skill-tags/route.ts

@@ -7,9 +7,9 @@ import {
   CANVAS_SKILL_TAG_ORDER_SETTING_KEY_PREFIX,
   CANVAS_SKILL_TAGS_CONFIG_VERSION,
   CANVAS_SKILL_TAGS_SETTING_KEY,
-  type CanvasSkillTag,
   normalizeCanvasSkillTagSettings,
 } from "@/lib/canvas-skill-tags";
+import { applyCanvasSkillTagOrder } from "@/lib/canvas-skill-tag-order";
 
 function getUserSkillTagOrderKey(userId: string) {
   return `${CANVAS_SKILL_TAG_ORDER_SETTING_KEY_PREFIX}${userId}`;
@@ -32,18 +32,6 @@ function normalizeSkillTagOrder(value: unknown) {
     });
 }
 
-function applySkillTagOrder(tags: CanvasSkillTag[], order: string[]) {
-  if (tags.length < 2 || order.length === 0) return tags;
-
-  const tagById = new Map(tags.map((tag) => [tag.id, tag]));
-  const ordered = order
-    .map((id) => tagById.get(id))
-    .filter((tag): tag is CanvasSkillTag => Boolean(tag));
-  const orderedIds = new Set(ordered.map((tag) => tag.id));
-  const remaining = tags.filter((tag) => !orderedIds.has(tag.id));
-  return [...ordered, ...remaining];
-}
-
 export async function GET() {
   try {
     const session = await auth().catch(() => null);
@@ -71,7 +59,7 @@ export async function GET() {
     const userOrder = normalizeSkillTagOrder(userOrderSetting?.value);
     return NextResponse.json({
       ...settings,
-      tags: applySkillTagOrder(settings.tags, userOrder),
+      tags: applyCanvasSkillTagOrder(settings.tags, userOrder),
       userOrder,
     });
   } catch (error) {
@@ -133,7 +121,7 @@ export async function PATCH(request: NextRequest) {
     return NextResponse.json({
       success: true,
       userOrder: tagIds,
-      tags: applySkillTagOrder(settings.tags, tagIds),
+      tags: applyCanvasSkillTagOrder(settings.tags, tagIds),
     });
   } catch (error) {
     console.error("[CanvasSkillTags API] Save order error:", error);
@@ -152,10 +140,12 @@ export async function PUT(request: NextRequest) {
     const normalized = normalizeCanvasSkillTagSettings(body);
     const enabled = normalized.enabled;
     const title = normalized.title;
+    const categories = normalized.categories;
     const tags = normalized.tags;
     const nextValue = {
       enabled,
       title,
+      categories,
       tags,
       version: CANVAS_SKILL_TAGS_CONFIG_VERSION,
     };
@@ -183,7 +173,7 @@ export async function PUT(request: NextRequest) {
       });
     }
 
-    return NextResponse.json({ success: true, enabled, title, tags });
+    return NextResponse.json({ success: true, enabled, title, categories, tags });
   } catch (error) {
     console.error("[CanvasSkillTags API] Update error:", error);
     return NextResponse.json({ error: "Failed to update" }, { status: 500 });

app/api/canvas/[id]/capabilities/route.ts

@@ -0,0 +1,91 @@
+import { NextResponse } from "next/server";
+import { ZodError } from "zod";
+
+import { auth } from "@/app/(auth)/auth";
+import { canvasCapabilityClientCommandSchema } from "@/lib/canvas/capabilities/client-command";
+import { CanvasCapabilityRuntimeError } from "@/lib/canvas/capabilities/context";
+import { getCanvasCapabilityManifest } from "@/lib/canvas/capabilities/registry";
+import { executeCanvasCapabilityRuntime } from "@/lib/canvas/capabilities/runtime";
+import { getCanvasCapabilityTask } from "@/lib/canvas/capabilities/task-store";
+import { CanvasAgentMutationError } from "@/lib/canvas/agent-mutations";
+
+export const dynamic = "force-dynamic";
+export const maxDuration = 600;
+
+export async function GET(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const session = await auth();
+  if (!session?.user?.id) {
+    return NextResponse.json({ success: false, error: "未登录" }, { status: 401 });
+  }
+  const { id } = await params;
+  const requestId = new URL(request.url).searchParams.get("requestId");
+  if (!requestId) {
+    return NextResponse.json({
+      success: true,
+      capabilities: getCanvasCapabilityManifest(),
+    });
+  }
+  const task = await getCanvasCapabilityTask({
+    requestId,
+    userId: session.user.id,
+    projectId: id,
+  });
+  if (!task) {
+    return NextResponse.json(
+      { success: false, error: "能力任务不存在" },
+      { status: 404 }
+    );
+  }
+  return NextResponse.json({ success: true, task });
+}
+
+export async function POST(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const session = await auth();
+  if (!session?.user?.id) {
+    return NextResponse.json({ success: false, error: "未登录" }, { status: 401 });
+  }
+
+  try {
+    const { id } = await params;
+    const command = canvasCapabilityClientCommandSchema.parse(await request.json());
+    const result = await executeCanvasCapabilityRuntime({
+      command,
+      projectId: id,
+      requestHeaders: request.headers,
+      requestUrl: request.url,
+      userId: session.user.id,
+    });
+    return NextResponse.json({ success: true, ...result });
+  } catch (error) {
+    if (
+      error instanceof CanvasCapabilityRuntimeError ||
+      error instanceof CanvasAgentMutationError
+    ) {
+      return NextResponse.json(
+        { success: false, error: error.message, code: error.code },
+        { status: error.status }
+      );
+    }
+    if (error instanceof ZodError) {
+      return NextResponse.json(
+        {
+          success: false,
+          error: "画布能力参数无效",
+          issues: error.issues,
+        },
+        { status: 400 }
+      );
+    }
+    const message = error instanceof Error ? error.message : "执行画布能力失败";
+    return NextResponse.json(
+      { success: false, error: message },
+      { status: 500 }
+    );
+  }
+}

app/api/canvas/[id]/revision/route.ts

@@ -0,0 +1,53 @@
+import { and, eq } from "drizzle-orm";
+import { z } from "zod";
+import { auth } from "@/app/(auth)/auth";
+import { db } from "@/lib/db";
+import { canvasProject } from "@/lib/db/schema";
+
+const canvasIdSchema = z.string().uuid();
+
+export async function GET(
+  _request: Request,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const session = await auth();
+  if (!session?.user?.id) {
+    return Response.json(
+      { success: false, error: "未登录" },
+      { status: 401 }
+    );
+  }
+
+  const { id: rawId } = await params;
+  const parsedId = canvasIdSchema.safeParse(rawId);
+  if (!parsedId.success) {
+    return Response.json(
+      { success: false, error: "画布 ID 无效" },
+      { status: 400 }
+    );
+  }
+
+  const id = parsedId.data;
+  const [project] = await db
+    .select({ updatedAt: canvasProject.updatedAt })
+    .from(canvasProject)
+    .where(
+      and(
+        eq(canvasProject.id, id),
+        eq(canvasProject.userId, session.user.id)
+      )
+    )
+    .limit(1);
+
+  if (!project) {
+    return Response.json(
+      { success: false, error: "画布不存在" },
+      { status: 404 }
+    );
+  }
+
+  return Response.json(
+    { success: true, data: { updatedAt: project.updatedAt.toISOString() } },
+    { headers: { "Cache-Control": "no-store" } }
+  );
+}

app/api/canvas/[id]/route.ts

@@ -17,19 +17,67 @@ function getDefaultWorkspaceTitle(workspaceType: ReturnType<typeof resolveWorksp
   return workspaceType === "video" ? "未命名视频画布" : "未命名画布";
 }
 
+function shouldUseLocalCanvasE2E(request: NextRequest) {
+  const hostname = request.nextUrl.hostname;
+  return (
+    process.env.CANVAS_E2E_LOCAL === "true" &&
+    (hostname === "127.0.0.1" || hostname === "localhost" || hostname === "::1")
+  );
+}
+
+function createLocalCanvasProject(
+  id: string,
+  input: {
+    canvasData?: unknown;
+    description?: unknown;
+    thumbnail?: unknown;
+    title?: unknown;
+    workspaceType?: unknown;
+  } = {}
+) {
+  const now = new Date().toISOString();
+  const workspaceType = resolveWorkspaceType(input.workspaceType || "video");
+  return {
+    id,
+    userId: "local-video-canvas-e2e-user",
+    title: String(input.title || getDefaultWorkspaceTitle(workspaceType)),
+    description: typeof input.description === "string" ? input.description : null,
+    thumbnail: typeof input.thumbnail === "string" ? input.thumbnail : null,
+    workspaceType,
+    canvasData:
+      input.canvasData && typeof input.canvasData === "object"
+        ? input.canvasData
+        : {
+            nodes: [],
+            edges: [],
+            selectedNodeIds: [],
+            viewport: { x: 0, y: 0, zoom: 1 },
+            tool: "select",
+          },
+    createdAt: now,
+    updatedAt: now,
+  };
+}
+
 // 获取单个画布
 export async function GET(
   request: NextRequest,
   { params }: { params: Promise<{ id: string }> }
 ) {
   try {
+    const { id } = await params;
+    if (shouldUseLocalCanvasE2E(request)) {
+      return NextResponse.json({
+        success: true,
+        data: createLocalCanvasProject(id),
+      });
+    }
+
     const session = await auth();
     if (!session?.user?.id) {
       return NextResponse.json({ success: false, error: '未登录' }, { status: 401 });
     }
 
-    const { id } = await params;
-
     const [project] = await db
       .select()
       .from(canvasProject)
@@ -57,13 +105,20 @@ export async function PUT(
   { params }: { params: Promise<{ id: string }> }
 ) {
   try {
+    const { id } = await params;
+    const body = await request.json();
+    if (shouldUseLocalCanvasE2E(request)) {
+      return NextResponse.json({
+        success: true,
+        data: createLocalCanvasProject(id, body),
+      });
+    }
+
     const session = await auth();
     if (!session?.user?.id) {
       return NextResponse.json({ success: false, error: '未登录' }, { status: 401 });
     }
 
-    const { id } = await params;
-    const body = await request.json();
     const { title, description, thumbnail, canvasData } = body;
     const baseCanvasRevision = body?.baseCanvasUpdatedAt || body?.baseCanvasRevision;
     const workspaceType =
@@ -137,23 +192,53 @@ export async function PUT(
             })
           : undefined;
 
-      // 创建新画布（使用指定 ID）
+      const nextWorkspaceType = workspaceType || "canvas";
+      const nextCanvasData = syncedCanvasData || {
+        nodes: [],
+        edges: [],
+        viewport: { x: 0, y: 0, zoom: 1 },
+      };
+      const nextTitle = title || getDefaultWorkspaceTitle(nextWorkspaceType);
+      const insertData: any = {
+        id, // 使用指定的 ID
+        userId: session.user.id,
+        title: nextTitle,
+        workspaceType: nextWorkspaceType,
+        canvasData: nextCanvasData,
+      };
+      const conflictUpdateData: any = {
+        title: nextTitle,
+        workspaceType: nextWorkspaceType,
+        canvasData: nextCanvasData,
+        updatedAt: new Date(),
+      };
+      if (description !== undefined) {
+        insertData.description = description;
+        conflictUpdateData.description = description;
+      }
+      if (thumbnail !== undefined) {
+        insertData.thumbnail = thumbnail;
+        conflictUpdateData.thumbnail = thumbnail;
+      }
+
+      // 创建新画布（使用指定 ID），并兼容同一用户并发创建同一画布的场景。
       const [newProject] = await db
         .insert(canvasProject)
-        .values({
+        .values(insertData)
-          id, // 使用指定的 ID
+        .onConflictDoUpdate({
-          userId: session.user.id,
+          target: canvasProject.id,
-          title: title || getDefaultWorkspaceTitle(workspaceType || "canvas"),
+          set: conflictUpdateData,
-          description,
+          where: eq(canvasProject.userId, session.user.id),
-          workspaceType: workspaceType || "canvas",
-          canvasData: syncedCanvasData || {
-            nodes: [],
-            edges: [],
-            viewport: { x: 0, y: 0, zoom: 1 },
-          },
         })
         .returning();
 
+      if (!newProject) {
+        return NextResponse.json(
+          { success: false, error: '画布ID已被占用' },
+          { status: 409 }
+        );
+      }
+
       return NextResponse.json({ success: true, data: newProject });
     }
   } catch (error) {

app/api/canvas/clawd-chat/cancel/route.ts

@@ -1,11 +1,27 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { auth } from "@/app/(auth)/auth";
-import { getChatById } from "@/lib/db/queries";
+import { getChatById, getSystemSetting } from "@/lib/db/queries";
 import {
   buildClawdCancelKey,
   cancelClawdRequest,
 } from "@/lib/openclaw-chat/cancel-registry";
+import {
+  OPENCLAW_AUTH_REQUIRED_CODE,
+  OPENCLAW_AUTH_REQUIRED_MESSAGE,
+} from "@/lib/openclaw-chat/errors";
+import {
+  normalizeOpenClawChatConfig,
+  OPENCLAW_CHAT_CONFIG_KEY,
+} from "@/lib/openclaw-chat/config";
+import {
+  deletePersistedClawdTask,
+  getPersistedClawdTask,
+} from "@/lib/openclaw-chat/task-store";
+import {
+  getPersistedUpstreamTaskState,
+  stopOpenClawDurableTask,
+} from "@/lib/openclaw-chat/upstream-task-client";
 
 const cancelSchema = z.object({
   id: z.string().uuid(),
@@ -15,7 +31,13 @@ const cancelSchema = z.object({
 export async function POST(request: Request) {
   const session = await auth().catch(() => null);
   if (!session?.user?.id) {
-    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    return NextResponse.json(
+      {
+        error: OPENCLAW_AUTH_REQUIRED_MESSAGE,
+        code: OPENCLAW_AUTH_REQUIRED_CODE,
+      },
+      { status: 401 }
+    );
   }
 
   const parsed = cancelSchema.safeParse(await request.json().catch(() => null));
@@ -28,13 +50,43 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: "Forbidden" }, { status: 403 });
   }
 
-  const active = cancelClawdRequest(
+  const cancelKey = buildClawdCancelKey({
-    buildClawdCancelKey({
+    userId: session.user.id,
-      userId: session.user.id,
+    chatId: parsed.data.id,
-      chatId: parsed.data.id,
+    userMessageId: parsed.data.userMessageId,
-      userMessageId: parsed.data.userMessageId,
+  });
-    })
+  const task = await getPersistedClawdTask({
-  );
+    chatId: parsed.data.id,
+    userMessageId: parsed.data.userMessageId,
+  }).catch(() => null);
+  const active = cancelClawdRequest(cancelKey);
+  const upstreamTask = task
+    ? getPersistedUpstreamTaskState(task.metadata)
+    : null;
+  if (upstreamTask) {
+    const setting = await getSystemSetting({
+      key: OPENCLAW_CHAT_CONFIG_KEY,
+    }).catch(() => null);
+    const config = normalizeOpenClawChatConfig(setting?.value);
+    if (config.enabled && config.baseUrl && config.token) {
+      await stopOpenClawDurableTask({ config, upstreamTask }).catch((error) => {
+        console.warn("[ClawdChat Cancel] Upstream stop deferred:", {
+          chatId: parsed.data.id,
+          taskId: upstreamTask.taskId,
+          error,
+        });
+      });
+    }
+  }
 
-  return NextResponse.json({ canceled: true, active });
+  const deleted = await deletePersistedClawdTask({
+    chatId: parsed.data.id,
+    userMessageId: parsed.data.userMessageId,
+  }).catch(() => []);
+
+  return NextResponse.json({
+    canceled: true,
+    active,
+    deleted: deleted.length > 0,
+  });
 }

app/api/canvas/clawd-chat/folder-upload/route.ts

@@ -0,0 +1,141 @@
+import JSZip from "jszip";
+import { NextResponse } from "next/server";
+import { auth } from "@/app/(auth)/auth";
+import { getAllStorageConfigs } from "@/lib/db/queries";
+import {
+  countOpenClawArchiveRootFolders,
+  sanitizeOpenClawArchiveEntryPath,
+  sanitizeOpenClawArchiveName,
+} from "@/lib/openclaw-chat/folder-archive";
+import {
+  OPENCLAW_CHAT_FOLDER_MAX_FILES,
+} from "@/lib/openclaw-chat/media-attachments";
+import { createLogger } from "@/lib/observability/logger";
+import {
+  toDbS3UploadConfig,
+  uploadFileWithS3Config,
+} from "@/lib/storage/service";
+
+export const runtime = "nodejs";
+export const maxDuration = 600;
+
+const logger = createLogger("openclaw-folder-upload");
+const LEGACY_FOLDER_UPLOAD_MAX_BYTES = 300 * 1024 * 1024;
+
+function isUploadedFile(value: FormDataEntryValue): value is File {
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    "arrayBuffer" in value &&
+    "name" in value &&
+    "size" in value
+  );
+}
+
+function toArrayBuffer(buffer: Buffer) {
+  return buffer.buffer.slice(
+    buffer.byteOffset,
+    buffer.byteOffset + buffer.byteLength
+  ) as ArrayBuffer;
+}
+
+export async function POST(request: Request) {
+  const session = await auth();
+  if (!session?.user?.id) {
+    return NextResponse.json({ error: "请先登录" }, { status: 401 });
+  }
+
+  try {
+    const formData = await request.formData();
+    const files = formData
+      .getAll("files")
+      .filter((entry): entry is File => isUploadedFile(entry));
+    const relativePaths = formData
+      .getAll("relativePaths")
+      .map((entry) => (typeof entry === "string" ? entry : ""));
+
+    if (files.length === 0) {
+      return NextResponse.json(
+        { error: "所选文件夹中没有可上传文件" },
+        { status: 400 }
+      );
+    }
+    if (files.length > OPENCLAW_CHAT_FOLDER_MAX_FILES) {
+      return NextResponse.json(
+        { error: `单次最多打包 ${OPENCLAW_CHAT_FOLDER_MAX_FILES} 个文件` },
+        { status: 413 }
+      );
+    }
+
+    const originalSize = files.reduce((sum, file) => sum + file.size, 0);
+    if (originalSize > LEGACY_FOLDER_UPLOAD_MAX_BYTES) {
+      return NextResponse.json(
+        { error: "请刷新页面后使用支持 2GB 和断点续传的新文件夹上传方式" },
+        { status: 413 }
+      );
+    }
+
+    const archivePaths = files.map((file, index) =>
+      sanitizeOpenClawArchiveEntryPath(
+        relativePaths[index] || file.name,
+        file.name,
+        index
+      )
+    );
+    const zip = new JSZip();
+    for (const [index, file] of files.entries()) {
+      zip.file(archivePaths[index], await file.arrayBuffer(), {
+        date: new Date(file.lastModified || Date.now()),
+      });
+    }
+
+    const archiveBaseName = sanitizeOpenClawArchiveName(
+      String(formData.get("archiveName") || archivePaths[0]?.split("/")[0] || "")
+    );
+    const archiveName = `${archiveBaseName.replace(/\.zip$/i, "")}.zip`;
+    const archiveBuffer = await zip.generateAsync({
+      type: "nodebuffer",
+      compression: "DEFLATE",
+      compressionOptions: { level: 6 },
+      platform: "UNIX",
+    });
+
+    const storageConfigs = await getAllStorageConfigs();
+    const qiniuStorage = storageConfigs
+      .filter((config) => config.type === "qiniu-kodo" && config.isEnabled)
+      .sort((left, right) => Number(right.isDefault) - Number(left.isDefault))
+      .find((config) => toDbS3UploadConfig(config));
+    const qiniuConfig = toDbS3UploadConfig(qiniuStorage);
+    if (!qiniuConfig) {
+      return NextResponse.json(
+        { error: "系统尚未配置可用的七牛云储存桶" },
+        { status: 503 }
+      );
+    }
+
+    const uploaded = await uploadFileWithS3Config(
+      archiveName,
+      toArrayBuffer(archiveBuffer),
+      qiniuConfig
+    );
+    if (!/^https?:\/\//i.test(uploaded.url)) {
+      throw new Error("七牛云未返回可访问的公网地址");
+    }
+
+    return NextResponse.json({
+      url: uploaded.url,
+      name: archiveName,
+      contentType: "application/zip",
+      size: archiveBuffer.byteLength,
+      originalSize,
+      fileCount: files.length,
+      folderCount: countOpenClawArchiveRootFolders(archivePaths),
+    });
+  } catch (error) {
+    logger.error("Failed to package and upload Claw folders", error);
+    return NextResponse.json(
+      { error: error instanceof Error ? error.message : "文件夹上传失败" },
+      { status: 500 }
+    );
+  }
+}

app/api/canvas/clawd-chat/history/route.ts

@@ -1,6 +1,10 @@
 import { NextResponse } from "next/server";
 import { auth } from "@/app/(auth)/auth";
 import { getClawdChatsByUserId } from "@/lib/db/queries";
+import {
+  OPENCLAW_AUTH_REQUIRED_CODE,
+  OPENCLAW_AUTH_REQUIRED_MESSAGE,
+} from "@/lib/openclaw-chat/errors";
 
 export const dynamic = "force-dynamic";
 export const revalidate = 0;
@@ -9,7 +13,13 @@ export async function GET(request: Request) {
   const session = await auth().catch(() => null);
 
   if (!session?.user?.id) {
-    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    return NextResponse.json(
+      {
+        error: OPENCLAW_AUTH_REQUIRED_MESSAGE,
+        code: OPENCLAW_AUTH_REQUIRED_CODE,
+      },
+      { status: 401 }
+    );
   }
 
   const url = new URL(request.url);

app/api/canvas/clawd-chat/route.ts

@@ -1,34 +1,59 @@
-import { NextResponse } from "next/server";
+import { after, NextResponse } from "next/server";
 import { z } from "zod";
 import { auth } from "@/app/(auth)/auth";
 import {
   getChatById,
-  getMessagesByChatId,
   getSystemSetting,
   getUserById,
   saveChat,
-  saveMessages,
 } from "@/lib/db/queries";
-import {
-  normalizeOpenClawChatConfig,
-  OPENCLAW_CHAT_CONFIG_KEY,
-} from "@/lib/openclaw-chat/config";
 import {
   buildClawdCancelKey,
-  cancelClawdRequest,
   clearClawdRequestCancellation,
   isClawdRequestCanceled,
   registerActiveClawdRequest,
   unregisterActiveClawdRequest,
 } from "@/lib/openclaw-chat/cancel-registry";
+import {
+  normalizeOpenClawChatConfig,
+  OPENCLAW_CHAT_CONFIG_KEY,
+} from "@/lib/openclaw-chat/config";
+import {
+  getOpenClawTaskFailureMessage,
+  OPENCLAW_AUTH_REQUIRED_CODE,
+  OPENCLAW_AUTH_REQUIRED_MESSAGE,
+  OPENCLAW_UPGRADE_RETRY_MESSAGE,
+} from "@/lib/openclaw-chat/errors";
+import {
+  normalizeOpenClawChatMediaAttachments,
+  OPENCLAW_CHAT_MEDIA_MAX_ATTACHMENTS,
+  type OpenClawChatMediaAttachment,
+} from "@/lib/openclaw-chat/media-attachments";
 import {
   buildOpenClawDisplayMessage,
   buildOpenClawMessageWithSpreadsheetMarkdown,
   buildOpenClawSpreadsheetMarkdown,
 } from "@/lib/openclaw-chat/spreadsheet-markdown";
+import {
+  appendPersistedClawdTaskProgress,
+  getPersistedClawdTask,
+  markClawdTaskCanceled,
+  markClawdTaskCompleted,
+  markClawdTaskFailed,
+  markClawdTaskRunning,
+  persistPendingClawdTask,
+} from "@/lib/openclaw-chat/task-store";
+import {
+  OpenClawTaskDetachedError,
+  submitOpenClawDurableTask,
+  waitForOpenClawDurableTask,
+} from "@/lib/openclaw-chat/upstream-task-client";
 import { generateUUID } from "@/lib/utils";
 
-const CLAW_UPGRADE_RETRY_MESSAGE = "claw正在升级更新稍等5分钟再试";
+const DEFAULT_PROCESSING_HINT =
+  "已收到，这个任务稍微繁重一些，处理时间可能会长一点，请耐心等候。";
+
+export const maxDuration = 1800;
 
 const requestSchema = z.object({
   id: z.string().uuid(),
@@ -36,12 +61,63 @@ const requestSchema = z.object({
   displayMessage: z.string().trim().max(8000).optional(),
   userMessageId: z.string().uuid().optional(),
   metadata: z.record(z.unknown()).optional(),
+  sensitiveInput: z
+    .discriminatedUnion("type", [
+      z.object({
+        type: z.literal("taobao_credentials"),
+        username: z.string().min(1).max(160),
+        password: z.string().min(1).max(256),
+      }),
+      z.object({
+        type: z.literal("taobao_verification"),
+        verification_code: z.string().min(4).max(12),
+      }),
+    ])
+    .optional(),
+  attachments: z
+    .array(z.unknown())
+    .max(OPENCLAW_CHAT_MEDIA_MAX_ATTACHMENTS)
+    .optional()
+    .default([]),
 });
 
-type ParsedClawdChatRequest = z.infer<typeof requestSchema> & {
+type ParsedClawdChatRequest = Omit<
+  z.infer<typeof requestSchema>,
+  "attachments"
+> & {
+  attachments: OpenClawChatMediaAttachment[];
   tableFiles: File[];
 };
 
+type ClawdSpreadsheetAttachment = {
+  name: string;
+  size: number;
+  contentType: string;
+  sheetCount: number;
+  rowCount: number;
+  truncated: boolean;
+};
+
+type ExecuteClawdTaskParams = {
+  assistantMessageId: string;
+  cancelKey: string;
+  chatId: string;
+  config: { baseUrl: string; token: string; timeoutMs: number };
+  conversationId: string;
+  departmentName: string;
+  metadata: Record<string, unknown> | undefined;
+  sensitiveInput?: z.infer<typeof requestSchema>["sensitiveInput"];
+  mediaAttachments: OpenClawChatMediaAttachment[];
+  skillTagId: string;
+  skillTagName: string;
+  spreadsheetFiles: unknown[];
+  spreadsheetMarkdownTruncated: boolean;
+  upstreamMessage: string;
+  userId: string;
+  userMessageId: string;
+  userName: string;
+};
+
 function buildChatTitle(message: string) {
   const normalized = message.replace(/\s+/g, " ").trim();
   if (!normalized) return "Claw 对话";
@@ -57,17 +133,15 @@ function getOpenClawUserName(user: {
   name?: string | null;
   email?: string | null;
 }) {
-  const name = String(user.name || "").trim();
+  return String(user.name || user.email || user.id).trim();
-  if (name) return name;
-
-  const email = String(user.email || "").trim();
-  if (email) return email;
-
-  return user.id;
 }
 
-function getOpenClawDepartmentName(department?: string | null) {
+function getMetadataString(
-  return String(department || "").trim();
+  metadata: Record<string, unknown> | undefined,
+  key: string
+) {
+  const value = metadata?.[key];
+  return typeof value === "string" ? value.trim() : "";
 }
 
 function isRequestFile(value: FormDataEntryValue): value is File {
@@ -86,25 +160,39 @@ async function parseClawdChatRequest(
   const contentType = request.headers.get("content-type") || "";
   if (!contentType.includes("multipart/form-data")) {
     const parsed = requestSchema.safeParse(await request.json().catch(() => null));
-    return parsed.success ? { ...parsed.data, tableFiles: [] } : null;
+    if (!parsed.success) return null;
+    const attachments = normalizeOpenClawChatMediaAttachments(
+      parsed.data.attachments
+    );
+    if (attachments.length !== parsed.data.attachments.length) return null;
+    return { ...parsed.data, attachments, tableFiles: [] };
   }
 
   const formData = await request.formData().catch(() => null);
   if (!formData) return null;
 
-  const metadataValue = formData.get("metadata");
   let metadata: Record<string, unknown> | undefined;
-  if (typeof metadataValue === "string" && metadataValue.trim()) {
+  let attachments: unknown[] = [];
-    try {
+  let sensitiveInput: unknown;
+  const metadataValue = formData.get("metadata");
+  const attachmentsValue = formData.get("attachments");
+  const sensitiveInputValue = formData.get("sensitiveInput");
+  try {
+    if (typeof metadataValue === "string" && metadataValue.trim()) {
       const parsedMetadata = JSON.parse(metadataValue);
-      if (parsedMetadata && typeof parsedMetadata === "object") {
+      if (!parsedMetadata || typeof parsedMetadata !== "object") return null;
-        metadata = parsedMetadata as Record<string, unknown>;
+      metadata = parsedMetadata as Record<string, unknown>;
-      } else {
-        return null;
-      }
-    } catch {
-      return null;
     }
+    if (typeof attachmentsValue === "string" && attachmentsValue.trim()) {
+      const parsedAttachments = JSON.parse(attachmentsValue);
+      if (!Array.isArray(parsedAttachments)) return null;
+      attachments = parsedAttachments;
+    }
+    if (typeof sensitiveInputValue === "string" && sensitiveInputValue.trim()) {
+      sensitiveInput = JSON.parse(sensitiveInputValue);
+    }
+  } catch {
+    return null;
   }
 
   const parsed = requestSchema.safeParse({
@@ -113,68 +201,275 @@ async function parseClawdChatRequest(
     displayMessage: formData.get("displayMessage") || undefined,
     userMessageId: formData.get("userMessageId") || undefined,
     metadata,
+    attachments,
+    sensitiveInput,
   });
   if (!parsed.success) return null;
+  const normalizedAttachments = normalizeOpenClawChatMediaAttachments(
+    parsed.data.attachments
+  );
+  if (normalizedAttachments.length !== parsed.data.attachments.length) {
+    return null;
+  }
 
-  const tableFiles = formData
+  return {
-    .getAll("tableFiles")
+    ...parsed.data,
-    .filter((entry): entry is File => isRequestFile(entry) && entry.size > 0);
+    attachments: normalizedAttachments,
-
+    tableFiles: formData
-  return { ...parsed.data, tableFiles };
+      .getAll("tableFiles")
+      .filter((entry): entry is File => isRequestFile(entry) && entry.size > 0),
+  };
 }
 
 async function readOpenClawConfig() {
-  const setting = await getSystemSetting({ key: OPENCLAW_CHAT_CONFIG_KEY }).catch(
+  const setting = await getSystemSetting({
-    () => null
+    key: OPENCLAW_CHAT_CONFIG_KEY,
-  );
+  }).catch(() => null);
   return normalizeOpenClawChatConfig(setting?.value);
 }
 
-function getOpenClawErrorCode(payload: unknown) {
+function getAnswer(payload: unknown) {
-  if (!payload || typeof payload !== "object") return "";
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
-  const raw = payload as Record<string, unknown>;
+    return "";
-  const nestedError =
+  }
-    raw.error && typeof raw.error === "object"
+  return String((payload as Record<string, unknown>).answer || "").trim();
-      ? (raw.error as Record<string, unknown>)
-      : null;
-  const code = nestedError?.code || raw.code;
-  return typeof code === "string" ? code.trim() : "";
 }
 
-function getMetadataString(
+function getRequestId(payload: unknown) {
-  metadata: Record<string, unknown> | undefined,
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
-  key: string
+    return null;
-) {
+  }
-  const value = metadata?.[key];
+  const value = (payload as Record<string, unknown>).request_id;
-  return typeof value === "string" ? value.trim() : "";
+  return value ? String(value) : null;
 }
 
-function createCanceledResponse() {
+async function executeClawdTask(params: ExecuteClawdTaskParams) {
-  return NextResponse.json({ canceled: true }, { status: 499 });
+  const controller = new AbortController();
+  registerActiveClawdRequest(
+    params.cancelKey,
+    controller,
+    Math.max(params.config.timeoutMs, 10 * 60 * 1000)
+  );
+
+  try {
+    if (isClawdRequestCanceled(params.cancelKey)) return;
+    await markClawdTaskRunning({
+      chatId: params.chatId,
+      assistantMessageId: params.assistantMessageId,
+    });
+
+    const upstreamBody: Record<string, unknown> = {
+      conversation_id: params.conversationId,
+      user_id: params.userId,
+      user_name: params.userName,
+      username: params.userName,
+      department: params.departmentName,
+      department_name: params.departmentName,
+      user_department: params.departmentName,
+      skill_tag_id: params.skillTagId || undefined,
+      skill_tag_name: params.skillTagName || undefined,
+      message: params.upstreamMessage,
+      attachments:
+        params.mediaAttachments.length > 0
+          ? params.mediaAttachments
+          : undefined,
+      metadata: {
+        source: "ai_chatbot_canvas",
+        page: "/canvas",
+        tenant: "default",
+        chat_id: params.chatId,
+        user_id: params.userId,
+        user_name: params.userName,
+        username: params.userName,
+        department: params.departmentName,
+        department_name: params.departmentName,
+        user_department: params.departmentName,
+        skill_tag_id: params.skillTagId || undefined,
+        skill_tag_name: params.skillTagName || undefined,
+        media_attachments:
+          params.mediaAttachments.length > 0
+            ? params.mediaAttachments
+            : undefined,
+        spreadsheet_files:
+          params.spreadsheetFiles.length > 0
+            ? params.spreadsheetFiles
+            : undefined,
+        spreadsheet_markdown_truncated:
+          params.spreadsheetMarkdownTruncated || undefined,
+        ...params.metadata,
+      },
+      stream_progress: false,
+      sensitive_input: params.sensitiveInput,
+    };
+
+    if (params.sensitiveInput) {
+      const timeout = setTimeout(
+        () =>
+          controller.abort(
+            new DOMException("OpenClaw request timed out", "TimeoutError")
+          ),
+        params.config.timeoutMs
+      );
+      try {
+        const response = await fetch(`${params.config.baseUrl}/api/chat`, {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${params.config.token}`,
+            "Content-Type": "application/json",
+            Accept: "application/json",
+          },
+          body: JSON.stringify(upstreamBody),
+          signal: controller.signal,
+          cache: "no-store",
+        });
+        const payload = (await response.json().catch(() => null)) as Record<
+          string,
+          unknown
+        > | null;
+        if (!response.ok) {
+          throw new Error(`OpenClaw request failed: ${response.status}`);
+        }
+        if (!payload) throw new Error("OpenClaw returned an invalid response");
+        const answer = getAnswer(payload);
+        if (!answer) throw new Error("OpenClaw returned an empty answer");
+        await markClawdTaskCompleted({
+          chatId: params.chatId,
+          assistantMessageId: params.assistantMessageId,
+          answer,
+          requestId: getRequestId(payload),
+        });
+        clearClawdRequestCancellation(params.cancelKey);
+        return;
+      } finally {
+        clearTimeout(timeout);
+      }
+    }
+
+    const target = {
+      chatId: params.chatId,
+      assistantMessageId: params.assistantMessageId,
+    };
+    const upstreamTask = await submitOpenClawDurableTask({
+      config: params.config,
+      body: upstreamBody,
+      idempotencyKey: `${params.userId}:${params.chatId}:${params.userMessageId}`,
+      target,
+      signal: controller.signal,
+    });
+    const outcome = await waitForOpenClawDurableTask({
+      config: params.config,
+      upstreamTask,
+      target,
+      deadlineAt: Date.now() + params.config.timeoutMs,
+      signal: controller.signal,
+    });
+
+    if (isClawdRequestCanceled(params.cancelKey)) return;
+    if (outcome.status === "completed") {
+      await markClawdTaskCompleted({
+        ...target,
+        answer: outcome.answer,
+        requestId: outcome.requestId,
+      });
+    } else if (outcome.status === "canceled") {
+      await markClawdTaskCanceled({
+        ...target,
+        message: outcome.error,
+      });
+    } else if (outcome.status === "failed") {
+      await markClawdTaskFailed({
+        ...target,
+        error: outcome.error,
+      });
+    }
+    clearClawdRequestCancellation(params.cancelKey);
+  } catch (error) {
+    if (isClawdRequestCanceled(params.cancelKey)) return;
+    if (error instanceof OpenClawTaskDetachedError) {
+      await appendPersistedClawdTaskProgress({
+        chatId: params.chatId,
+        assistantMessageId: params.assistantMessageId,
+        progress: {
+          step_code: "task.detached",
+          step_state: "waiting",
+          message: "任务仍在 OpenClaw 后台执行，打开原对话后会自动续接结果",
+          display: "任务仍在 OpenClaw 后台执行，打开原对话后会自动续接结果",
+        },
+      }).catch(() => null);
+      return;
+    }
+    console.error("[ClawdChat API] Durable task failed:", error);
+    await markClawdTaskFailed({
+      chatId: params.chatId,
+      assistantMessageId: params.assistantMessageId,
+      error: getOpenClawTaskFailureMessage(error),
+    }).catch(() => null);
+  } finally {
+    if (params.sensitiveInput?.type === "taobao_credentials") {
+      params.sensitiveInput.username = "";
+      params.sensitiveInput.password = "";
+    } else if (params.sensitiveInput?.type === "taobao_verification") {
+      params.sensitiveInput.verification_code = "";
+    }
+    params.sensitiveInput = undefined;
+    unregisterActiveClawdRequest(params.cancelKey);
+  }
+}
+
+function buildTaskResponse(params: {
+  chatId: string;
+  userMessageId: string;
+  assistantMessageId: string;
+  status: string;
+  processingHint: string;
+}) {
+  const statusUrl = `/api/canvas/clawd-chat/status?id=${encodeURIComponent(
+    params.chatId
+  )}&userMessageId=${encodeURIComponent(params.userMessageId)}`;
+  return {
+    accepted: true,
+    task: {
+      chatId: params.chatId,
+      userMessageId: params.userMessageId,
+      assistantMessageId: params.assistantMessageId,
+      status: params.status,
+      processingHint: params.processingHint,
+      statusUrl,
+    },
+  };
 }
 
 export async function POST(request: Request) {
   const session = await auth().catch(() => null);
-
   if (!session?.user?.id) {
-    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    return NextResponse.json(
+      {
+        error: OPENCLAW_AUTH_REQUIRED_MESSAGE,
+        code: OPENCLAW_AUTH_REQUIRED_CODE,
+      },
+      { status: 401 }
+    );
   }
 
   const parsed = await parseClawdChatRequest(request);
   if (!parsed) {
     return NextResponse.json({ error: "请求参数不正确" }, { status: 400 });
   }
-  if (!parsed.message && parsed.tableFiles.length === 0) {
+  if (
-    return NextResponse.json({ error: "请输入问题或上传表格" }, { status: 400 });
+    !parsed.message &&
+    parsed.tableFiles.length === 0 &&
+    parsed.attachments.length === 0
+  ) {
+    return NextResponse.json(
+      { error: "请输入问题或上传附件" },
+      { status: 400 }
+    );
   }
 
   const config = await readOpenClawConfig();
-  if (!config.enabled) {
+  if (!config.enabled || !config.baseUrl || !config.token) {
-    return NextResponse.json({ error: CLAW_UPGRADE_RETRY_MESSAGE }, { status: 503 });
-  }
-  if (!config.baseUrl || !config.token) {
     return NextResponse.json(
-      { error: CLAW_UPGRADE_RETRY_MESSAGE },
+      { error: OPENCLAW_UPGRADE_RETRY_MESSAGE },
       { status: 503 }
     );
   }
@@ -185,13 +480,22 @@ export async function POST(request: Request) {
   }
 
   const userMessageId = parsed.userMessageId || generateUUID();
-  const cancelKey = buildClawdCancelKey({
+  const existingTask = await getPersistedClawdTask({
-    userId: session.user.id,
     chatId: parsed.id,
     userMessageId,
-  });
+  }).catch(() => null);
-  if (isClawdRequestCanceled(cancelKey)) {
+  if (existingTask) {
-    return createCanceledResponse();
+    return NextResponse.json(
+      buildTaskResponse({
+        chatId: parsed.id,
+        userMessageId,
+        assistantMessageId: existingTask.metadata.assistantMessageId,
+        status: existingTask.metadata.status,
+        processingHint:
+          existingTask.metadata.processingHint || DEFAULT_PROCESSING_HINT,
+      }),
+      { status: 202, headers: { "Retry-After": "2" } }
+    );
   }
 
   let spreadsheetMarkdownResult: Awaited<
@@ -221,10 +525,23 @@ export async function POST(request: Request) {
     message: parsed.message,
     spreadsheetMarkdown: spreadsheetMarkdownResult?.markdown || "",
   });
-
+  const spreadsheetAttachments: ClawdSpreadsheetAttachment[] = (
-  if (isClawdRequestCanceled(cancelKey)) {
+    spreadsheetMarkdownResult?.files || []
-    return createCanceledResponse();
+  ).map((summary, index) => {
-  }
+    const sourceFile = parsed.tableFiles[index];
+    return {
+      name: summary.fileName,
+      size: sourceFile?.size || 0,
+      contentType:
+        sourceFile?.type ||
+        (summary.fileName.toLowerCase().endsWith(".xlsx")
+          ? "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
+          : "text/csv"),
+      sheetCount: summary.sheetCount,
+      rowCount: summary.rowCount,
+      truncated: summary.truncated,
+    };
+  });
 
   if (!existingChat) {
     await saveChat({
@@ -236,220 +553,91 @@ export async function POST(request: Request) {
   }
 
   const assistantMessageId = generateUUID();
-  const conversationId = createConversationId(session.user.id, parsed.id);
+  const skillTagId = getMetadataString(parsed.metadata, "skillTagId");
-  const userProfile = await getUserById({ id: session.user.id }).catch(() => null);
+  const skillTagName = getMetadataString(parsed.metadata, "skillTagName");
-  const openClawUserName = getOpenClawUserName({
+  const processingHint =
+    getMetadataString(parsed.metadata, "processingHint") ||
+    DEFAULT_PROCESSING_HINT;
+  const messageAttachments = parsed.attachments.map((attachment) => ({
+    name:
+      attachment.name ||
+      (attachment.type === "video"
+        ? "视频附件"
+        : attachment.type === "file"
+          ? "文件附件"
+          : "图片附件"),
+    url: attachment.url,
+    contentType:
+      attachment.content_type ||
+      (attachment.type === "video"
+        ? "video/mp4"
+        : attachment.type === "file"
+          ? "application/octet-stream"
+          : "image/jpeg"),
+  }));
+
+  await persistPendingClawdTask({
+    chatId: parsed.id,
+    userMessageId,
+    assistantMessageId,
+    displayMessage,
+    attachments: messageAttachments,
+    spreadsheetAttachments,
+    skillTagId,
+    skillTagName,
+    processingHint,
+  });
+
+  const userProfile = await getUserById({ id: session.user.id }).catch(
+    () => null
+  );
+  const userName = getOpenClawUserName({
     id: session.user.id,
     name: userProfile?.name ?? session.user.name,
     email: userProfile?.email ?? session.user.email,
   });
-  const openClawDepartmentName = getOpenClawDepartmentName(userProfile?.department);
+  const cancelKey = buildClawdCancelKey({
-  const skillTagId = getMetadataString(parsed.metadata, "skillTagId");
+    userId: session.user.id,
-  const skillTagName = getMetadataString(parsed.metadata, "skillTagName");
+    chatId: parsed.id,
-  const endpoint = `${config.baseUrl}/api/chat`;
+    userMessageId,
+  });
 
-  let upstreamPayload: unknown = null;
+  after(async () => {
-  let upstreamStatus = 502;
+    await executeClawdTask({
-
+      assistantMessageId,
-  if (isClawdRequestCanceled(cancelKey)) {
+      cancelKey,
-    return createCanceledResponse();
+      chatId: parsed.id,
-  }
+      config,
-
+      conversationId: createConversationId(session.user.id, parsed.id),
-  try {
+      departmentName: String(userProfile?.department || "").trim(),
-    const controller = new AbortController();
+      metadata: parsed.metadata,
-    registerActiveClawdRequest(cancelKey, controller, config.timeoutMs);
+      sensitiveInput: parsed.sensitiveInput,
-    const timeout = setTimeout(() => controller.abort(), config.timeoutMs);
+      mediaAttachments: parsed.attachments,
-    const handleRequestAbort = () => {
+      skillTagId,
-      cancelClawdRequest(cancelKey);
+      skillTagName,
-    };
+      spreadsheetFiles: spreadsheetMarkdownResult?.files || [],
-    request.signal.addEventListener("abort", handleRequestAbort, { once: true });
+      spreadsheetMarkdownTruncated:
-    const response = await fetch(endpoint, {
+        spreadsheetMarkdownResult?.truncated || false,
-      method: "POST",
+      upstreamMessage,
-      headers: {
+      userId: session.user.id,
-        Authorization: `Bearer ${config.token}`,
+      userMessageId,
-        "Content-Type": "application/json",
+      userName,
-      },
-      body: JSON.stringify({
-        conversation_id: conversationId,
-        user_id: session.user.id,
-        user_name: openClawUserName,
-        username: openClawUserName,
-        department: openClawDepartmentName,
-        department_name: openClawDepartmentName,
-        user_department: openClawDepartmentName,
-        skill_tag_id: skillTagId || undefined,
-        skill_tag_name: skillTagName || undefined,
-        message: upstreamMessage,
-        metadata: {
-          source: "ai_chatbot_canvas",
-          page: "/canvas",
-          tenant: "default",
-          chat_id: parsed.id,
-          user_id: session.user.id,
-          user_name: openClawUserName,
-          username: openClawUserName,
-          department: openClawDepartmentName,
-          department_name: openClawDepartmentName,
-          user_department: openClawDepartmentName,
-          skill_tag_id: skillTagId || undefined,
-          skill_tag_name: skillTagName || undefined,
-          spreadsheet_files: spreadsheetMarkdownResult?.files || undefined,
-          spreadsheet_markdown_truncated:
-            spreadsheetMarkdownResult?.truncated || undefined,
-          ...parsed.metadata,
-        },
-      }),
-      signal: controller.signal,
-    }).finally(() => {
-      clearTimeout(timeout);
-      request.signal.removeEventListener("abort", handleRequestAbort);
-      unregisterActiveClawdRequest(cancelKey);
     });
+  });
 
-    upstreamStatus = response.status;
+  const responseBody = buildTaskResponse({
-    upstreamPayload = await response.json().catch(() => null);
-
-    if (!response.ok) {
-      const errorCode = getOpenClawErrorCode(upstreamPayload);
-      console.error("[ClawdChat API] OpenClaw upstream error:", {
-        status: response.status,
-        code: errorCode || undefined,
-        payload: upstreamPayload,
-      });
-      return NextResponse.json(
-        {
-          error: CLAW_UPGRADE_RETRY_MESSAGE,
-          code: errorCode || undefined,
-        },
-        { status: response.status }
-      );
-    }
-  } catch (error) {
-    unregisterActiveClawdRequest(cancelKey);
-    const errorName =
-      error && typeof error === "object" && "name" in error
-        ? String((error as { name?: unknown }).name || "")
-        : "";
-    const isAbortError = errorName === "AbortError";
-    if (isClawdRequestCanceled(cancelKey)) {
-      console.info("[ClawdChat API] OpenClaw request canceled:", {
-        chatId: parsed.id,
-        userMessageId,
-      });
-      return createCanceledResponse();
-    }
-    console.error("[ClawdChat API] OpenClaw request failed:", error);
-    return NextResponse.json(
-      {
-        error: CLAW_UPGRADE_RETRY_MESSAGE,
-      },
-      { status: isAbortError ? 504 : upstreamStatus }
-    );
-  }
-
-  const answer =
-    upstreamPayload && typeof upstreamPayload === "object"
-      ? String((upstreamPayload as Record<string, unknown>).answer || "").trim()
-      : "";
-
-  if (!answer) {
-    console.error("[ClawdChat API] OpenClaw empty answer:", upstreamPayload);
-    return NextResponse.json(
-      { error: CLAW_UPGRADE_RETRY_MESSAGE },
-      { status: 502 }
-    );
-  }
-
-  if (isClawdRequestCanceled(cancelKey)) {
-    return createCanceledResponse();
-  }
-
-  const existingMessages = await getMessagesByChatId({ id: parsed.id }).catch(
-    () => []
-  );
-  const latestMessageTimestamp = existingMessages.reduce((latest, item) => {
-    const timestamp =
-      item.createdAt instanceof Date
-        ? item.createdAt.getTime()
-        : Date.parse(String(item.createdAt || ""));
-    return Number.isFinite(timestamp) ? Math.max(latest, timestamp) : latest;
-  }, 0);
-  const userCreatedAt = new Date(
-    Math.max(Date.now(), latestMessageTimestamp + 1)
-  );
-  const assistantCreatedAt = new Date(userCreatedAt.getTime() + 1);
-
-  const userMessage = {
-    id: userMessageId,
     chatId: parsed.id,
-    role: "user",
+    userMessageId,
-    parts: [{ type: "text", text: displayMessage }],
+    assistantMessageId,
-    attachments: [],
+    status: "queued",
-    createdAt: userCreatedAt,
+    processingHint,
-    videoStorageStatus: null,
+  });
-    temporaryVideoUrl: null,
+  return NextResponse.json(responseBody, {
-    permanentVideoUrl: null,
+    status: 202,
-    archivedAt: null,
+    headers: {
-    videoMetadata: {
+      "Cache-Control": "no-store, max-age=0",
-      composerMode: "clawd",
+      Location: responseBody.task.statusUrl,
-      source: "openclaw",
+      "Retry-After": "2",
-      skillTagId: skillTagId || null,
-      skillTagName: skillTagName || null,
     },
-  };
-  const assistantMessage = {
-    id: assistantMessageId,
-    chatId: parsed.id,
-    role: "assistant",
-    parts: [{ type: "text", text: answer }],
-    attachments: [],
-    createdAt: assistantCreatedAt,
-    videoStorageStatus: null,
-    temporaryVideoUrl: null,
-    permanentVideoUrl: null,
-    archivedAt: null,
-    videoMetadata: {
-      composerMode: "clawd",
-      source: "openclaw",
-      requestId:
-        upstreamPayload && typeof upstreamPayload === "object"
-          ? (upstreamPayload as Record<string, unknown>).request_id || null
-          : null,
-    },
-  };
-
-  await saveMessages({ messages: [userMessage, assistantMessage] });
-  clearClawdRequestCancellation(cancelKey);
-
-  return NextResponse.json({
-    conversationId,
-    requestId:
-      upstreamPayload && typeof upstreamPayload === "object"
-        ? (upstreamPayload as Record<string, unknown>).request_id || null
-        : null,
-    messages: [
-      {
-        id: userMessage.id,
-        role: "user",
-        parts: userMessage.parts,
-        createdAt: userMessage.createdAt.toISOString(),
-        metadata: {
-          createdAt: userMessage.createdAt.toISOString(),
-          composerMode: "clawd",
-        },
-        videoMetadata: userMessage.videoMetadata,
-      },
-      {
-        id: assistantMessage.id,
-        role: "assistant",
-        parts: assistantMessage.parts,
-        createdAt: assistantMessage.createdAt.toISOString(),
-        metadata: {
-          createdAt: assistantMessage.createdAt.toISOString(),
-          composerMode: "clawd",
-        },
-        videoMetadata: assistantMessage.videoMetadata,
-      },
-    ],
   });
 }

app/api/canvas/clawd-chat/status/route.ts

@@ -0,0 +1,190 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { auth } from "@/app/(auth)/auth";
+import { getChatById, getSystemSetting } from "@/lib/db/queries";
+import {
+  buildClawdCancelKey,
+  hasActiveClawdRequest,
+  registerActiveClawdRequest,
+  unregisterActiveClawdRequest,
+} from "@/lib/openclaw-chat/cancel-registry";
+import {
+  normalizeOpenClawChatConfig,
+  OPENCLAW_CHAT_CONFIG_KEY,
+} from "@/lib/openclaw-chat/config";
+import {
+  OPENCLAW_AUTH_REQUIRED_CODE,
+  OPENCLAW_AUTH_REQUIRED_MESSAGE,
+} from "@/lib/openclaw-chat/errors";
+import {
+  getPersistedClawdTask,
+  markClawdTaskCanceled,
+  markClawdTaskCompleted,
+  markClawdTaskFailed,
+} from "@/lib/openclaw-chat/task-store";
+import { isPendingClawdTaskStatus } from "@/lib/openclaw-chat/task-state";
+import {
+  getPersistedUpstreamTaskState,
+  refreshOpenClawDurableTask,
+} from "@/lib/openclaw-chat/upstream-task-client";
+
+const statusSchema = z.object({
+  id: z.string().uuid(),
+  userMessageId: z.string().uuid().optional(),
+});
+
+export const dynamic = "force-dynamic";
+export const revalidate = 0;
+export const maxDuration = 60;
+
+async function reconcileDetachedOpenClawTask(params: {
+  chatId: string;
+  userId: string;
+  task: NonNullable<Awaited<ReturnType<typeof getPersistedClawdTask>>>;
+}) {
+  if (!isPendingClawdTaskStatus(params.task.metadata.status)) return;
+  const upstreamTask = getPersistedUpstreamTaskState(params.task.metadata);
+  if (!upstreamTask) return;
+  const cancelKey = buildClawdCancelKey({
+    userId: params.userId,
+    chatId: params.chatId,
+    userMessageId: params.task.metadata.userMessageId,
+  });
+  if (hasActiveClawdRequest(cancelKey)) return;
+
+  const controller = new AbortController();
+  registerActiveClawdRequest(cancelKey, controller, 30_000);
+  const target = {
+    chatId: params.chatId,
+    assistantMessageId: params.task.metadata.assistantMessageId,
+  };
+  try {
+    const setting = await getSystemSetting({
+      key: OPENCLAW_CHAT_CONFIG_KEY,
+    }).catch(() => null);
+    const config = normalizeOpenClawChatConfig(setting?.value);
+    if (!config.enabled || !config.baseUrl || !config.token) return;
+    const outcome = await refreshOpenClawDurableTask({
+      config,
+      upstreamTask,
+      target,
+      signal: controller.signal,
+    });
+    if (outcome.status === "completed") {
+      await markClawdTaskCompleted({
+        ...target,
+        answer: outcome.answer,
+        requestId: outcome.requestId,
+      });
+    } else if (outcome.status === "failed") {
+      await markClawdTaskFailed({ ...target, error: outcome.error });
+    } else if (outcome.status === "canceled") {
+      await markClawdTaskCanceled({ ...target, message: outcome.error });
+    }
+  } catch (error) {
+    if (!controller.signal.aborted) {
+      console.warn("[ClawdChat Status] Upstream reconciliation deferred:", {
+        chatId: params.chatId,
+        taskId: upstreamTask.taskId,
+        error,
+      });
+    }
+  } finally {
+    unregisterActiveClawdRequest(cancelKey);
+  }
+}
+
+export async function GET(request: Request) {
+  const session = await auth().catch(() => null);
+  if (!session?.user?.id) {
+    return NextResponse.json(
+      {
+        error: OPENCLAW_AUTH_REQUIRED_MESSAGE,
+        code: OPENCLAW_AUTH_REQUIRED_CODE,
+      },
+      { status: 401 }
+    );
+  }
+
+  const url = new URL(request.url);
+  const parsed = statusSchema.safeParse({
+    id: url.searchParams.get("id"),
+    userMessageId: url.searchParams.get("userMessageId") || undefined,
+  });
+  if (!parsed.success) {
+    return NextResponse.json({ error: "请求参数不正确" }, { status: 400 });
+  }
+
+  const chat = await getChatById({ id: parsed.data.id }).catch(() => null);
+  if (!chat) {
+    return NextResponse.json({ task: null }, { status: 404 });
+  }
+  if (chat.userId !== session.user.id) {
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+  }
+
+  let task = await getPersistedClawdTask({
+    chatId: parsed.data.id,
+    userMessageId: parsed.data.userMessageId,
+  });
+  if (!task) {
+    return NextResponse.json(
+      { task: null },
+      { headers: { "Cache-Control": "no-store, max-age=0" } }
+    );
+  }
+
+  await reconcileDetachedOpenClawTask({
+    chatId: parsed.data.id,
+    userId: session.user.id,
+    task,
+  });
+  task =
+    (await getPersistedClawdTask({
+      chatId: parsed.data.id,
+      userMessageId: parsed.data.userMessageId,
+    })) || task;
+
+  const userTextPart = Array.isArray(task.userMessage?.parts)
+    ? task.userMessage.parts.find(
+        (part) =>
+          part &&
+          typeof part === "object" &&
+          !Array.isArray(part) &&
+          (part as { type?: unknown }).type === "text"
+      )
+    : null;
+  const userText =
+    userTextPart && typeof userTextPart === "object"
+      ? String((userTextPart as { text?: unknown }).text || "")
+      : "";
+
+  return NextResponse.json(
+    {
+      task: {
+        chatId: parsed.data.id,
+        userMessageId: task.metadata.userMessageId,
+        assistantMessageId: task.metadata.assistantMessageId,
+        status: task.metadata.status,
+        processingHint: task.metadata.processingHint,
+        progressEvents: task.metadata.progressEvents,
+        skillTagId: task.metadata.skillTagId || null,
+        skillTagName: task.metadata.skillTagName || null,
+        requestId: task.metadata.requestId || null,
+        error: task.metadata.error || null,
+        createdAt: task.metadata.createdAt,
+        updatedAt: task.metadata.updatedAt,
+        userMessage: {
+          text: userText,
+          attachments: task.userMessage?.attachments || [],
+        },
+      },
+    },
+    {
+      headers: {
+        "Cache-Control": "no-store, max-age=0",
+        "Retry-After": "2",
+      },
+    }
+  );
+}

app/api/canvas/detail-plan/route.ts

@@ -1956,7 +1956,7 @@ export async function POST(request: Request) {
       (item) =>
         !item.model.isSubModel &&
         item.model.isEnabled &&
-        ["zhipu", "alibaba", "openai", "custom", "local"].includes(item.provider.type),
+        ["zhipu", "alibaba", "openai", "custom", "local", "vip98k"].includes(item.provider.type),
     );
     const configuredDetailAgentConfig =
       currentSiteSettings?.canvasDetailAgentModelId &&

app/api/canvas/detail-review/route.ts

@@ -204,7 +204,7 @@ export async function POST(request: Request) {
       (item) =>
         !item.model.isSubModel &&
         item.model.isEnabled &&
-        ["zhipu", "alibaba", "openai", "custom", "local"].includes(item.provider.type),
+        ["zhipu", "alibaba", "openai", "custom", "local", "vip98k"].includes(item.provider.type),
     );
     const configuredDetailAgentConfig =
       currentSiteSettings?.canvasDetailAgentModelId &&

app/api/canvas/text-edit/route.ts

@@ -11,6 +11,10 @@ import { resolveModelRuntimeId } from "@/lib/ai/model-runtime";
 import { createFalImage } from "@/lib/ai/providers/fal-image";
 import { createSnapgenImage } from "@/lib/ai/providers/snapgen-image";
 import { createOpenAIImage } from "@/lib/ai/providers/openai-image";
+import { createBananaImage } from "@/lib/ai/providers/bananaimage";
+import { createVisionary } from "@/lib/ai/providers/visionary";
+import { createAtlasCloud } from "@/lib/ai/providers/atlascloud";
+import { createVip98k } from "@/lib/ai/providers/vip98k";
 import { createStepfunImage } from "@/lib/ai/providers/stepfun-image";
 import { createMidjourney } from "@/lib/ai/providers/midjourney";
 import { createRunway } from "@/lib/ai/providers/runway";
@@ -51,6 +55,10 @@ const SUPPORTED_TEXT_EDIT_PROVIDER_TYPES = new Set([
   "fal-image",
   "snapgen-image",
   "openai-image",
+  "bananaimage",
+  "visionary",
+  "atlascloud",
+  "vip98k",
   "stepfun-image",
   "midjourney",
   "runway",
@@ -115,6 +123,14 @@ function createTextEditProvider(
       return createSnapgenImage({ baseURL, apiKey });
     case "openai-image":
       return createOpenAIImage({ baseURL, apiKey });
+    case "bananaimage":
+      return createBananaImage({ baseURL, apiKey });
+    case "visionary":
+      return createVisionary({ baseURL, apiKey });
+    case "atlascloud":
+      return createAtlasCloud({ baseURL, apiKey });
+    case "vip98k":
+      return createVip98k({ baseURL, apiKey });
     case "stepfun-image":
       return createStepfunImage({ baseURL, apiKey });
     case "midjourney":
@@ -467,7 +483,7 @@ async function generateTextEditImageWithFailover(params: {
       const runtimeModelId = resolveModelRuntimeId(selected.model, {
         providerType: selected.provider.type,
       });
-      const result = await provider.chat(runtimeModelId).doGenerate({
+      const generationOptions: any = {
         messages: [
           {
             role: "user",
@@ -480,7 +496,18 @@ async function generateTextEditImageWithFailover(params: {
         imageParams: {
           imageCount: 1,
         },
-      });
+      };
+      if (selected.provider.type === "atlascloud" || selected.provider.type === "vip98k") {
+        generationOptions.imageGenConfig = selected.model.imageGenConfig || null;
+      }
+      const modelInstance =
+        selected.provider.type === "vip98k"
+          ? (provider as any).chat(runtimeModelId, {
+              capabilities: selected.model.capabilities || null,
+              imageGenConfig: selected.model.imageGenConfig || null,
+            })
+          : provider.chat(runtimeModelId);
+      const result = await modelInstance.doGenerate(generationOptions);
 
       const resultText = String(result?.text || "").trim();
       const finishReason = String(result?.finishReason || "").toLowerCase();

app/api/canvas/workflow/analyze/route.ts

@@ -70,6 +70,14 @@ function normalizeText(value: unknown) {
   return String(value || "").trim();
 }
 
+function shouldUseLocalWorkflowE2E(request: Request) {
+  const hostname = new URL(request.url).hostname;
+  return (
+    process.env.CANVAS_E2E_LOCAL === "true" &&
+    (hostname === "127.0.0.1" || hostname === "localhost" || hostname === "::1")
+  );
+}
+
 function normalizeStringList(value: unknown, limit = 8) {
   if (!Array.isArray(value)) return [];
   return Array.from(

app/api/canvas/world/tasks/[taskId]/route.ts

@@ -7,9 +7,16 @@ import { resolveThreeDModelAliasId } from "@/lib/model3d/model-alias-config";
 import { getThreeDModelAliasConfigForRuntime } from "@/lib/model3d/model-alias-config-server";
 import { createLogger } from "@/lib/observability/logger";
 import { uploadFile } from "@/lib/storage/service";
-import { WorldLabsApiError, worldLabsRequest } from "@/lib/worldlabs/client";
+import {
+  isWorldLabsExternalTaskApi,
+  WORLDLABS_EXTERNAL_TASK_MODEL,
+  WorldLabsApiError,
+  worldLabsRequest,
+} from "@/lib/worldlabs/client";
 import { getWorldLabsProviderConfig } from "@/lib/worldlabs/server";
 import type {
+  WorldLabsExternalTaskResponse,
+  WorldLabsExternalTaskResultData,
   WorldLabsOperation,
   WorldLabsWorld,
   WorldLabsWorldAssets,
@@ -419,6 +426,214 @@ function buildAssetPayload(
   };
 }
 
+function unwrapExternalTaskData<T extends Record<string, unknown>>(payload: unknown) {
+  const root = getObjectValue(payload);
+  const data = getObjectValue(root?.data);
+  return (data || root || {}) as T;
+}
+
+function normalizeExternalTaskStatus(status?: string | null, done?: boolean) {
+  const normalized = String(status || "").trim().toLowerCase();
+  if (done === true || ["succeeded", "success", "completed", "done"].includes(normalized)) {
+    return "success" as const;
+  }
+  if (["failed", "failure", "error", "cancelled", "canceled"].includes(normalized)) {
+    return "failed" as const;
+  }
+  return "running" as const;
+}
+
+function readStringRecord(value: unknown) {
+  const record = getObjectValue(value);
+  if (!record) return null;
+  const entries = Object.entries(record).filter(
+    (entry): entry is [string, string] =>
+      Boolean(entry[0]) && typeof entry[1] === "string" && entry[1].trim().length > 0
+  );
+  return entries.length > 0 ? Object.fromEntries(entries) : null;
+}
+
+function findNestedString(
+  value: unknown,
+  keys: string[],
+  depth = 0
+): string | null {
+  if (depth > 8) return null;
+  const record = getObjectValue(value);
+  if (!record) return null;
+
+  for (const key of keys) {
+    const directValue = getStringValue(record[key]);
+    if (directValue) return directValue;
+  }
+
+  for (const child of Object.values(record)) {
+    const found = findNestedString(child, keys, depth + 1);
+    if (found) return found;
+  }
+  return null;
+}
+
+function findNestedObject(
+  value: unknown,
+  keys: string[],
+  depth = 0
+): Record<string, unknown> | null {
+  if (depth > 8) return null;
+  const record = getObjectValue(value);
+  if (!record) return null;
+
+  for (const key of keys) {
+    const directValue = getObjectValue(record[key]);
+    if (directValue) return directValue;
+  }
+
+  for (const child of Object.values(record)) {
+    const found = findNestedObject(child, keys, depth + 1);
+    if (found) return found;
+  }
+  return null;
+}
+
+function findNestedStringRecord(
+  value: unknown,
+  keys: string[],
+  depth = 0
+): Record<string, string> | null {
+  if (depth > 8) return null;
+  const record = getObjectValue(value);
+  if (!record) return null;
+
+  for (const key of keys) {
+    const directValue = readStringRecord(record[key]);
+    if (directValue) return directValue;
+  }
+
+  for (const child of Object.values(record)) {
+    const found = findNestedStringRecord(child, keys, depth + 1);
+    if (found) return found;
+  }
+  return null;
+}
+
+function extractExternalTaskErrorMessage(
+  data: WorldLabsExternalTaskResultData,
+  payload: WorldLabsExternalTaskResponse<WorldLabsExternalTaskResultData>
+) {
+  const dataError = getObjectValue(data.error);
+  const payloadError = getObjectValue(payload.error);
+  return (
+    getStringValue(
+      data.errorMessage,
+      data.message,
+      dataError?.message,
+      payload.message,
+      payloadError?.message,
+      payload.error
+    ) || "World Labs 外部任务失败"
+  );
+}
+
+function extractExternalWorldAssetPayload(data: WorldLabsExternalTaskResultData) {
+  const root = getObjectValue(data) || {};
+  const resultRoot =
+    getObjectValue(root.result) ||
+    getObjectValue(root.output) ||
+    getObjectValue(root.world) ||
+    root;
+  const assets = findNestedObject(resultRoot, ["assets"]);
+  const worldAssets = assets as Partial<WorldLabsWorldAssets> | null;
+  const splats = getObjectValue(worldAssets?.splats);
+
+  return {
+    worldId: getStringValue(
+      findNestedString(resultRoot, ["worldId", "world_id"]),
+      findNestedString(root, ["worldId", "world_id"])
+    ),
+    worldUrl: getStringValue(
+      findNestedString(resultRoot, [
+        "worldUrl",
+        "world_marble_url",
+        "sourceWorldUrl",
+        "viewerUrl",
+        "marbleUrl",
+      ]),
+      findNestedString(root, [
+        "worldUrl",
+        "world_marble_url",
+        "sourceWorldUrl",
+        "viewerUrl",
+        "marbleUrl",
+      ])
+    ),
+    displayName: getStringValue(
+      findNestedString(resultRoot, ["displayName", "display_name"]),
+      findNestedString(root, ["displayName", "display_name"])
+    ),
+    model:
+      getStringValue(
+        findNestedString(resultRoot, ["model", "modelId", "model_id"]),
+        findNestedString(root, ["model", "modelId", "model_id"])
+      ) || WORLDLABS_EXTERNAL_TASK_MODEL,
+    caption: getStringValue(
+      worldAssets?.caption,
+      findNestedString(resultRoot, ["caption"]),
+      findNestedString(root, ["caption"])
+    ),
+    thumbnailUrl: getStringValue(
+      worldAssets?.thumbnail_url,
+      findNestedString(resultRoot, [
+        "thumbnailUrl",
+        "thumbnail_url",
+        "previewImageUrl",
+        "preview_image_url",
+      ]),
+      findNestedString(root, [
+        "thumbnailUrl",
+        "thumbnail_url",
+        "previewImageUrl",
+        "preview_image_url",
+      ])
+    ),
+    panoUrl: getStringValue(
+      worldAssets?.imagery?.pano_url,
+      findNestedString(resultRoot, ["panoUrl", "pano_url", "panoramaUrl", "panorama_url"]),
+      findNestedString(root, ["panoUrl", "pano_url", "panoramaUrl", "panorama_url"])
+    ),
+    meshUrl: getStringValue(
+      worldAssets?.mesh?.collider_mesh_url,
+      findNestedString(resultRoot, [
+        "meshUrl",
+        "mesh_url",
+        "modelUrl",
+        "model_url",
+        "glbUrl",
+        "glb_url",
+        "colliderMeshUrl",
+        "collider_mesh_url",
+      ]),
+      findNestedString(root, [
+        "meshUrl",
+        "mesh_url",
+        "modelUrl",
+        "model_url",
+        "glbUrl",
+        "glb_url",
+        "colliderMeshUrl",
+        "collider_mesh_url",
+      ])
+    ),
+    spzUrls:
+      readStringRecord(splats?.spz_urls) ||
+      findNestedStringRecord(resultRoot, ["spzUrls", "spz_urls"]) ||
+      findNestedStringRecord(root, ["spzUrls", "spz_urls"]),
+    semanticsMetadata:
+      getObjectValue(splats?.semantics_metadata) ||
+      findNestedObject(resultRoot, ["semanticsMetadata", "semantics_metadata"]) ||
+      findNestedObject(root, ["semanticsMetadata", "semantics_metadata"]),
+  };
+}
+
 interface RouteParams {
   params: Promise<{ taskId: string }>;
 }
@@ -452,6 +667,187 @@ export async function GET(request: Request, { params }: RouteParams) {
     });
     providerForLog = config.providerId || null;
     const modelAliasConfig = await getThreeDModelAliasConfigForRuntime();
+    const persistedAssetPayload =
+      getObjectValue(persistedWorldAsset?.assetPayload) || {};
+    const shouldUseExternalTaskResultApi =
+      isWorldLabsExternalTaskApi(config.baseUrl) &&
+      persistedAssetPayload.externalTaskApi !== false &&
+      persistedAssetPayload.marbleApi !== true;
+    if (shouldUseExternalTaskResultApi) {
+      const externalPayload = await worldLabsRequest<
+        WorldLabsExternalTaskResponse<WorldLabsExternalTaskResultData>
+      >(config, {
+        method: "GET",
+        path: `/api/external/task/result?taskId=${encodeURIComponent(normalizedTaskId)}`,
+        timeoutMs: resolveWorldLabsStatusTimeoutMs(),
+      });
+      const externalData =
+        unwrapExternalTaskData<WorldLabsExternalTaskResultData>(externalPayload);
+      const externalStatusText = getStringValue(externalData.status) || "running";
+      const externalStatus = normalizeExternalTaskStatus(
+        externalStatusText,
+        externalData.done === true
+      );
+      const externalAssetPayloadBase = {
+        ...persistedAssetPayload,
+        providerId: config.providerId || null,
+        providerName: config.providerName || null,
+        externalTaskApi: true,
+        externalTaskStatus: externalStatusText,
+        requestId: getStringValue(externalPayload.requestId, externalPayload.request_id),
+      };
+
+      if (externalStatus === "running") {
+        return NextResponse.json({
+          success: true,
+          data: {
+            taskId: normalizedTaskId,
+            type: "world",
+            status: "running",
+            progress: null,
+            output: externalData,
+            assetPayload: externalAssetPayloadBase,
+          },
+        });
+      }
+
+      if (externalStatus === "failed") {
+        const errorMessage = extractExternalTaskErrorMessage(
+          externalData,
+          externalPayload
+        );
+        await updatePersistedWorldAsset({
+          id: persistedWorldAsset?.id,
+          status: "failed",
+          progress: null,
+          error: errorMessage,
+          assetPayload: externalAssetPayloadBase,
+        });
+        logger.warn("external task failed status", {
+          elapsedMs: Date.now() - startedAt,
+          taskIdLength: normalizedTaskId.length,
+          providerId: config.providerId || null,
+          error: errorMessage,
+        });
+        return NextResponse.json({
+          success: true,
+          data: {
+            taskId: normalizedTaskId,
+            type: "world",
+            status: "failed",
+            progress: null,
+            errorMessage,
+            output: externalData,
+            assetPayload: externalAssetPayloadBase,
+          },
+        });
+      }
+
+      const extractedAssetPayload = extractExternalWorldAssetPayload(externalData);
+      const rawMeshUrl = extractedAssetPayload.meshUrl;
+      const rawThumbnailUrl = extractedAssetPayload.thumbnailUrl;
+      const rawPanoUrl = extractedAssetPayload.panoUrl;
+      const stableWorldUrl: string | null = null;
+      const stableModelUrl = await archiveRemoteAssetIfNeeded({
+        cacheKey: `worldlabs:${normalizedTaskId}:mesh`,
+        sourceUrl: rawMeshUrl,
+        filenamePrefix: `worldlabs-mesh-${normalizedTaskId}`,
+        fallbackExtension: "glb",
+        validateAs: "glb",
+      });
+      const stableThumbnailUrl = await archiveRemoteAssetIfNeeded({
+        cacheKey: `worldlabs:${normalizedTaskId}:thumb`,
+        sourceUrl: rawThumbnailUrl,
+        filenamePrefix: `worldlabs-thumb-${normalizedTaskId}`,
+        fallbackExtension: "jpg",
+      });
+      const stablePanoUrl = await archiveRemoteAssetIfNeeded({
+        cacheKey: `worldlabs:${normalizedTaskId}:pano`,
+        sourceUrl: rawPanoUrl,
+        filenamePrefix: `worldlabs-pano-${normalizedTaskId}`,
+        fallbackExtension: "jpg",
+      });
+      const stableSpzUrls = await archiveRemoteAssetMapIfNeeded({
+        cacheKeyPrefix: `worldlabs:${normalizedTaskId}:spz`,
+        sourceMap: extractedAssetPayload.spzUrls,
+        filenamePrefix: `worldlabs-splat-${normalizedTaskId}`,
+        fallbackExtension: "spz",
+        validateAs: "spz",
+      });
+      const assetPayload = {
+        ...externalAssetPayloadBase,
+        worldId: extractedAssetPayload.worldId,
+        worldUrl: stableWorldUrl,
+        displayName: extractedAssetPayload.displayName,
+        model: resolveThreeDModelAliasId(
+          extractedAssetPayload.model,
+          modelAliasConfig.worldModels
+        ),
+        caption: extractedAssetPayload.caption,
+        thumbnailUrl: stableThumbnailUrl || extractedAssetPayload.thumbnailUrl,
+        panoUrl: stablePanoUrl || extractedAssetPayload.panoUrl,
+        meshUrl: stableModelUrl,
+        spzUrls: stableSpzUrls,
+        semanticsMetadata: extractedAssetPayload.semanticsMetadata,
+        storageArchivedAt: new Date().toISOString(),
+        sourceWorldUrl: extractedAssetPayload.worldUrl || null,
+        sourceMeshUrl:
+          rawMeshUrl && stableModelUrl && rawMeshUrl !== stableModelUrl
+            ? rawMeshUrl
+            : null,
+        sourceThumbnailUrl:
+          rawThumbnailUrl && stableThumbnailUrl && rawThumbnailUrl !== stableThumbnailUrl
+            ? rawThumbnailUrl
+            : null,
+        sourcePanoUrl:
+          rawPanoUrl && stablePanoUrl && rawPanoUrl !== stablePanoUrl
+            ? rawPanoUrl
+            : null,
+        sourceSpzUrls:
+          extractedAssetPayload.spzUrls && stableSpzUrls !== extractedAssetPayload.spzUrls
+            ? extractedAssetPayload.spzUrls
+            : null,
+      };
+
+      await updatePersistedWorldAsset({
+        id: persistedWorldAsset?.id,
+        status: "success",
+        progress: 100,
+        modelUrl: stableModelUrl,
+        previewImageUrl: stableThumbnailUrl || stablePanoUrl || null,
+        error: null,
+        assetPayload,
+      });
+
+      logger.info("external task success status", {
+        elapsedMs: Date.now() - startedAt,
+        taskIdLength: normalizedTaskId.length,
+        providerId: config.providerId || null,
+        hasMesh: Boolean(stableModelUrl),
+        hasPano: Boolean(stablePanoUrl),
+        hasThumbnail: Boolean(stableThumbnailUrl),
+        hasSplat: Boolean(stableSpzUrls && Object.keys(stableSpzUrls).length > 0),
+      });
+
+      return NextResponse.json({
+        success: true,
+        data: {
+          taskId: normalizedTaskId,
+          type: "world",
+          status: "success",
+          progress: 100,
+          output: externalData,
+          modelUrl: stableModelUrl,
+          previewImageUrl: stableThumbnailUrl || stablePanoUrl || null,
+          worldId: assetPayload.worldId,
+          worldUrl: stableWorldUrl,
+          panoUrl: stablePanoUrl,
+          caption: assetPayload.caption,
+          assetPayload,
+        },
+      });
+    }
+
     const operation = await worldLabsRequest<WorldLabsOperation>(config, {
       method: "GET",
       path: `/marble/v1/operations/${encodeURIComponent(normalizedTaskId)}`,

app/api/canvas/world/tasks/route.ts

@@ -12,13 +12,23 @@ import {
 import { getThreeDModelAliasConfigForRuntime } from "@/lib/model3d/model-alias-config-server";
 import { createLogger } from "@/lib/observability/logger";
 import { get3DWorldCreditCost } from "@/lib/points/config";
-import { WorldLabsApiError, worldLabsRequest } from "@/lib/worldlabs/client";
+import {
+  isWorldLabsExternalTaskApi,
+  WORLDLABS_EXTERNAL_TASK_MODEL,
+  WorldLabsApiError,
+  worldLabsRequest,
+} from "@/lib/worldlabs/client";
 import {
   getWorldLabsProviderConfig,
   getWorldLabsProviderConfigs,
   reportWorldLabsProviderRuntimeFailure,
 } from "@/lib/worldlabs/server";
-import type { WorldLabsModel, WorldLabsOperation } from "@/lib/worldlabs/types";
+import type {
+  WorldLabsExternalTaskCreateData,
+  WorldLabsExternalTaskResponse,
+  WorldLabsModel,
+  WorldLabsOperation,
+} from "@/lib/worldlabs/types";
 
 export const runtime = "nodejs";
 export const maxDuration = 180;
@@ -47,8 +57,10 @@ type CreateWorldTaskRequest = {
   makePublic?: boolean;
   reconstructImages?: boolean;
   mediaAssetId?: string;
+  sourceUrl?: string;
   mediaAssets?: Array<{
     mediaAssetId?: string;
+    sourceUrl?: string;
     azimuth?: number | null;
   }>;
 };
@@ -58,10 +70,89 @@ function readOptionalTrimmedText(input: unknown) {
   return value || null;
 }
 
+function readOptionalHttpUrl(input: unknown) {
+  const value = readOptionalTrimmedText(input);
+  if (!value) return null;
+  try {
+    const parsed = new URL(value);
+    return parsed.protocol === "http:" || parsed.protocol === "https:"
+      ? parsed.toString()
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+function getObjectValue(value: unknown) {
+  return value && typeof value === "object" ? (value as Record<string, unknown>) : null;
+}
+
+function unwrapExternalTaskData<T extends Record<string, unknown>>(payload: unknown) {
+  const root = getObjectValue(payload);
+  const data = getObjectValue(root?.data);
+  return (data || root || {}) as T;
+}
+
+function normalizeExternalTaskStatus(status?: string | null, done?: boolean) {
+  const normalized = String(status || "").trim().toLowerCase();
+  if (done === true || ["succeeded", "success", "completed", "done"].includes(normalized)) {
+    return "success" as const;
+  }
+  if (["failed", "failure", "error", "cancelled", "canceled"].includes(normalized)) {
+    return "failed" as const;
+  }
+  return "running" as const;
+}
+
+function normalizeExternalTaskCreateOperation(
+  payload: WorldLabsExternalTaskResponse<WorldLabsExternalTaskCreateData>
+): WorldLabsOperation {
+  const data = unwrapExternalTaskData<WorldLabsExternalTaskCreateData>(payload);
+  const taskId = readOptionalTrimmedText(data.taskId || data.task_id || data.id);
+  const status = readOptionalTrimmedText(data.status) || "accepted";
+  const normalizedStatus = normalizeExternalTaskStatus(status, data.done === true);
+  return {
+    operation_id: taskId || undefined,
+    done: normalizedStatus === "success",
+    error:
+      normalizedStatus === "failed"
+        ? {
+            message:
+              readOptionalTrimmedText(
+                (payload as Record<string, unknown>)?.message ||
+                  (payload as Record<string, unknown>)?.error
+              ) || "World Labs 外部任务创建失败",
+          }
+        : null,
+    metadata: {
+      externalTaskApi: true,
+      status,
+      resultPath: readOptionalTrimmedText(data.resultPath || data.result_path),
+      requestId: readOptionalTrimmedText(payload.requestId || payload.request_id),
+    },
+    response: data,
+  };
+}
+
 function shouldCharge3DPoints(mode: WorldTaskMode) {
   return mode === "text" || mode === "image" || mode === "multi-image" || mode === "video";
 }
 
+function shouldUseExternalTaskCreateApi(
+  config: Awaited<ReturnType<typeof getWorldLabsProviderConfig>>,
+  mode: WorldTaskMode
+) {
+  return isWorldLabsExternalTaskApi(config.baseUrl) && mode === "text";
+}
+
+function resolveOfficialMarbleModel(model?: string | null) {
+  const normalized = readOptionalTrimmedText(model);
+  if (!normalized || normalized === WORLDLABS_EXTERNAL_TASK_MODEL) {
+    return "marble-1.1";
+  }
+  return normalized;
+}
+
 function buildWorldPrompt(body: CreateWorldTaskRequest, mode: WorldTaskMode) {
   const textPrompt = readOptionalTrimmedText(body.prompt);
 
@@ -80,15 +171,21 @@ function buildWorldPrompt(body: CreateWorldTaskRequest, mode: WorldTaskMode) {
 
   if (mode === "image") {
     const mediaAssetId = readOptionalTrimmedText(body.mediaAssetId);
-    if (!mediaAssetId) {
+    const sourceUrl = readOptionalHttpUrl(body.sourceUrl);
-      throw new Error("图生世界缺少 mediaAssetId");
+    if (!mediaAssetId && !sourceUrl) {
+      throw new Error("图生世界缺少 mediaAssetId 或 sourceUrl");
     }
     return {
       type: "image",
-      image_prompt: {
+      image_prompt: mediaAssetId
-        source: "media_asset",
+        ? {
-        media_asset_id: mediaAssetId,
+            source: "media_asset",
-      },
+            media_asset_id: mediaAssetId,
+          }
+        : {
+            source: "uri",
+            uri: sourceUrl,
+          },
       ...(textPrompt ? { text_prompt: textPrompt } : {}),
       ...(body.disableRecaption !== undefined
         ? { disable_recaption: body.disableRecaption }
@@ -102,7 +199,8 @@ function buildWorldPrompt(body: CreateWorldTaskRequest, mode: WorldTaskMode) {
     const multiImagePrompt = mediaAssets
       .map((item) => {
         const mediaAssetId = readOptionalTrimmedText(item?.mediaAssetId);
-        if (!mediaAssetId) return null;
+        const sourceUrl = readOptionalHttpUrl(item?.sourceUrl);
+        if (!mediaAssetId && !sourceUrl) return null;
         const azimuth =
           item?.azimuth === null || item?.azimuth === undefined
             ? null
@@ -111,10 +209,15 @@ function buildWorldPrompt(body: CreateWorldTaskRequest, mode: WorldTaskMode) {
               : null;
         return {
           ...(azimuth === null ? {} : { azimuth }),
-          content: {
+          content: mediaAssetId
-            source: "media_asset",
+            ? {
-            media_asset_id: mediaAssetId,
+                source: "media_asset",
-          },
+                media_asset_id: mediaAssetId,
+              }
+            : {
+                source: "uri",
+                uri: sourceUrl,
+              },
         };
       })
       .filter(Boolean);
@@ -137,16 +240,22 @@ function buildWorldPrompt(body: CreateWorldTaskRequest, mode: WorldTaskMode) {
   }
 
   const mediaAssetId = readOptionalTrimmedText(body.mediaAssetId);
-  if (!mediaAssetId) {
+  const sourceUrl = readOptionalHttpUrl(body.sourceUrl);
-    throw new Error("视频生成世界缺少 mediaAssetId");
+  if (!mediaAssetId && !sourceUrl) {
+    throw new Error("视频生成世界缺少 mediaAssetId 或 sourceUrl");
   }
 
   return {
     type: "video",
-    video_prompt: {
+    video_prompt: mediaAssetId
-      source: "media_asset",
+      ? {
-      media_asset_id: mediaAssetId,
+          source: "media_asset",
-    },
+          media_asset_id: mediaAssetId,
+        }
+      : {
+          source: "uri",
+          uri: sourceUrl,
+        },
     ...(textPrompt ? { text_prompt: textPrompt } : {}),
   };
 }
@@ -187,12 +296,29 @@ export async function POST(request: Request) {
     );
     modelForLog = resolvedWorldModel || "marble-1.1";
 
+    const preferredProviderId = readOptionalTrimmedText(body.providerId);
+    const displayName =
+      readOptionalTrimmedText(body.displayName) ||
+      readOptionalTrimmedText(body.prompt) ||
+      `World ${new Date().toLocaleString("zh-CN")}`;
+    const worldPrompt = buildWorldPrompt(body, mode);
+
+    const candidates = preferredProviderId
+      ? [await getWorldLabsProviderConfig(preferredProviderId)]
+      : await getWorldLabsProviderConfigs();
+    if (candidates.length === 0) {
+      throw new Error("未找到可用的 World Labs Key");
+    }
+
+    const officialMarbleModel = resolveOfficialMarbleModel(resolvedWorldModel);
+    const predictedBillingModel = candidates.some((candidate) =>
+      shouldUseExternalTaskCreateApi(candidate, mode)
+    )
+      ? WORLDLABS_EXTERNAL_TASK_MODEL
+      : officialMarbleModel;
     const pointsConfig = await getPointsSystemConfig();
     const shouldChargePoints = shouldCharge3DPoints(mode);
-    const unitCost = get3DWorldCreditCost(
+    const unitCost = get3DWorldCreditCost(pointsConfig, predictedBillingModel);
-      pointsConfig,
-      resolvedWorldModel || "marble-1.1",
-    );
 
     if (
       shouldChargePoints &&
@@ -220,42 +346,51 @@ export async function POST(request: Request) {
       }
     }
 
-    const preferredProviderId = readOptionalTrimmedText(body.providerId);
-    const displayName =
-      readOptionalTrimmedText(body.displayName) ||
-      readOptionalTrimmedText(body.prompt) ||
-      `World ${new Date().toLocaleString("zh-CN")}`;
-    const worldPrompt = buildWorldPrompt(body, mode);
-
-    const candidates = preferredProviderId
-      ? [await getWorldLabsProviderConfig(preferredProviderId)]
-      : await getWorldLabsProviderConfigs();
-    if (candidates.length === 0) {
-      throw new Error("未找到可用的 World Labs Key");
-    }
-
     let result: WorldLabsOperation | null = null;
     let usedProvider = null as Awaited<
       ReturnType<typeof getWorldLabsProviderConfig>
     > | null;
+    let usedExternalTaskApi = false;
     let lastError: unknown = null;
 
     for (const candidate of candidates) {
       try {
-        result = await worldLabsRequest<WorldLabsOperation>(candidate, {
+        const useExternalTaskApi = shouldUseExternalTaskCreateApi(candidate, mode);
-          method: "POST",
+        if (useExternalTaskApi) {
-          path: "/marble/v1/worlds:generate",
+          const prompt = readOptionalTrimmedText(body.prompt);
-          timeoutMs: resolveWorldLabsCreateTimeoutMs(),
+          if (!prompt) {
-          json: {
+            throw new Error("请输入世界描述");
-            display_name: displayName,
+          }
-            model: resolvedWorldModel || "marble-1.1",
+          const externalResult = await worldLabsRequest<
-            permission: {
+            WorldLabsExternalTaskResponse<WorldLabsExternalTaskCreateData>
-              public: body.makePublic === true,
+          >(candidate, {
+            method: "POST",
+            path: "/api/external/task/generate",
+            timeoutMs: resolveWorldLabsCreateTimeoutMs(),
+            json: {
+              model: WORLDLABS_EXTERNAL_TASK_MODEL,
+              displayName,
+              prompt,
             },
-            world_prompt: worldPrompt,
+          });
-          },
+          result = normalizeExternalTaskCreateOperation(externalResult);
-        });
+        } else {
+          result = await worldLabsRequest<WorldLabsOperation>(candidate, {
+            method: "POST",
+            path: "/marble/v1/worlds:generate",
+            timeoutMs: resolveWorldLabsCreateTimeoutMs(),
+            json: {
+              display_name: displayName,
+              model: officialMarbleModel,
+              permission: {
+                public: body.makePublic === true,
+              },
+              world_prompt: worldPrompt,
+            },
+          });
+        }
         usedProvider = candidate;
+        usedExternalTaskApi = useExternalTaskApi;
         providerForLog = candidate.providerId || null;
         break;
       } catch (error) {
@@ -292,12 +427,18 @@ export async function POST(request: Request) {
 
     if (shouldChargePoints && pointsConfig.enabled && unitCost > 0) {
       try {
+        const usedBillingModel = usedExternalTaskApi
+          ? WORLDLABS_EXTERNAL_TASK_MODEL
+          : officialMarbleModel;
+        const usedBillingDisplayName = usedBillingModel === WORLDLABS_EXTERNAL_TASK_MODEL
+          ? WORLDLABS_EXTERNAL_TASK_MODEL
+          : worldModelDisplayName;
         await consumeUserPoints({
           userId: session.user.id,
           amount: unitCost,
           reason: "world3d_generation",
-          modelId: `worldlabs-3d:${resolvedWorldModel || "marble-1.1"}`,
+          modelId: `worldlabs-3d:${usedBillingModel}`,
-          note: `3D世界生成消耗积分（${worldModelDisplayName}）`,
+          note: `3D世界生成消耗积分（${usedBillingDisplayName}）`,
         });
       } catch (error) {
         logger.error("points consume failed", error, {
@@ -313,10 +454,13 @@ export async function POST(request: Request) {
       elapsedMs: Date.now() - startedAt,
       taskIdLength: taskId.length,
       mode,
-      model: resolvedWorldModel || "marble-1.1",
+      model: usedExternalTaskApi
+        ? WORLDLABS_EXTERNAL_TASK_MODEL
+        : officialMarbleModel,
       providerId: usedProvider.providerId || null,
       status: result.done ? "success" : "running",
       unitCost,
+      externalTaskApi: usedExternalTaskApi,
     });
 
     return NextResponse.json({
@@ -327,6 +471,8 @@ export async function POST(request: Request) {
         assetPayload: {
           providerId: usedProvider.providerId || null,
           providerName: usedProvider.providerName || null,
+          externalTaskApi: usedExternalTaskApi,
+          marbleApi: !usedExternalTaskApi,
         },
         raw: result,
       },

app/api/canvas/world/upload/route.ts

@@ -1,7 +1,11 @@
 import { NextResponse } from "next/server";
 import { auth } from "@/app/(auth)/auth";
 import { createLogger } from "@/lib/observability/logger";
-import { WorldLabsApiError, worldLabsRequest } from "@/lib/worldlabs/client";
+import { uploadFile } from "@/lib/storage/service";
+import {
+  WorldLabsApiError,
+  worldLabsRequest,
+} from "@/lib/worldlabs/client";
 import {
   getWorldLabsProviderConfig,
   getWorldLabsProviderConfigs,
@@ -112,6 +116,81 @@ function normalizeMediaAssetId(data: WorldLabsPrepareUploadResponse) {
   return String(data.media_asset?.media_asset_id || data.media_asset?.id || "").trim();
 }
 
+function readOptionalString(value: unknown) {
+  const text = String(value || "").trim();
+  return text || null;
+}
+
+function extractUploadInfoFromCurlExample(curlExample: unknown) {
+  const curl = String(curlExample || "");
+  const uploadUrl =
+    [...curl.matchAll(/https?:\/\/[^\s'"\\]+/g)]
+      .map((match) => match[0])
+      .find(Boolean) || null;
+  const requiredHeaders: Record<string, string> = {};
+  const headerPattern = /(?:-H|--header)\s+(?:"([^"]+)"|'([^']+)'|([^\s]+))/g;
+  let headerMatch: RegExpExecArray | null;
+
+  while ((headerMatch = headerPattern.exec(curl))) {
+    const header = String(
+      headerMatch[1] || headerMatch[2] || headerMatch[3] || ""
+    ).trim();
+    const colonIndex = header.indexOf(":");
+    if (colonIndex <= 0) continue;
+    const name = header.slice(0, colonIndex).trim();
+    const value = header.slice(colonIndex + 1).trim();
+    if (name && value) {
+      requiredHeaders[name] = value;
+    }
+  }
+
+  return { uploadUrl, requiredHeaders };
+}
+
+function resolvePrepareUploadDetails(data: WorldLabsPrepareUploadResponse) {
+  const uploadInfo = data.upload_info || {};
+  const uploadInfoRecord = uploadInfo as Record<string, unknown>;
+  const curlDetails = extractUploadInfoFromCurlExample(uploadInfo.curl_example);
+  const explicitHeaders =
+    uploadInfo.required_headers && typeof uploadInfo.required_headers === "object"
+      ? uploadInfo.required_headers
+      : {};
+
+  return {
+    uploadUrl:
+      readOptionalString(uploadInfo.upload_url) ||
+      readOptionalString(uploadInfoRecord.uploadUrl) ||
+      readOptionalString(uploadInfoRecord.url) ||
+      curlDetails.uploadUrl,
+    uploadMethod:
+      readOptionalString(uploadInfo.upload_method) ||
+      readOptionalString(uploadInfoRecord.method) ||
+      "PUT",
+    requiredHeaders: {
+      ...curlDetails.requiredHeaders,
+      ...explicitHeaders,
+    },
+  };
+}
+
+function isSignedUploadFailure(error: unknown) {
+  const message = error instanceof Error ? error.message : String(error || "");
+  return (
+    message.includes("SignatureDoesNotMatch") ||
+    message.includes("Access denied") ||
+    message.includes("Google secret key") ||
+    message.includes("签名")
+  );
+}
+
+async function uploadWorldLabsInputToStorage(file: File, extension: string) {
+  const buffer = await file.arrayBuffer();
+  const safeExtension = extension && extension !== "bin" ? extension : "bin";
+  const filename = `worldlabs-input-${Date.now()}-${crypto.randomUUID()}.${safeExtension}`;
+  const uploaded = await uploadFile(filename, buffer);
+  return uploaded.url;
+}
+
 function isCredentialOrBillingProviderError(error: unknown) {
   return (
     error instanceof WorldLabsApiError &&
@@ -202,24 +281,24 @@ export async function POST(request: Request) {
         );
 
         const mediaAssetId = normalizeMediaAssetId(prepareUpload);
-        const uploadUrl = String(prepareUpload.upload_info?.upload_url || "").trim();
+        const { uploadUrl, uploadMethod, requiredHeaders } =
+          resolvePrepareUploadDetails(prepareUpload);
         if (!mediaAssetId || !uploadUrl) {
           throw new Error("World Labs 返回的上传信息不完整");
         }
 
         const uploadHeaders = new Headers();
-        uploadHeaders.set("Content-Type", file.type || "application/octet-stream");
-        const requiredHeaders = prepareUpload.upload_info?.required_headers || {};
         for (const [headerName, headerValue] of Object.entries(requiredHeaders)) {
           if (!headerName || headerValue === undefined || headerValue === null) continue;
           uploadHeaders.set(headerName, String(headerValue));
         }
+        if (!uploadHeaders.has("Content-Type") && !prepareUpload.upload_info?.curl_example) {
+          uploadHeaders.set("Content-Type", file.type || "application/octet-stream");
+        }
 
-        const uploadMethod = String(
+        const normalizedUploadMethod = uploadMethod.toUpperCase();
-          prepareUpload.upload_info?.upload_method || "PUT"
-        ).toUpperCase();
         const uploadResponse = await fetch(uploadUrl, {
-          method: uploadMethod === "PUT" ? "PUT" : uploadMethod,
+          method: normalizedUploadMethod === "PUT" ? "PUT" : normalizedUploadMethod,
           headers: uploadHeaders,
           body: file,
           cache: "no-store",
@@ -252,6 +331,28 @@ export async function POST(request: Request) {
         });
       } catch (error) {
         lastError = error;
+        if (isSignedUploadFailure(error)) {
+          try {
+            const sourceUrl = await uploadWorldLabsInputToStorage(file, extension);
+            logger.warn("worldlabs signed upload failed; using storage source url", {
+              elapsedMs: Date.now() - startedAt,
+              providerId: config.providerId || null,
+              kind: isImage ? "image" : "video",
+              size: file.size,
+            });
+            return NextResponse.json({
+              success: true,
+              data: {
+                sourceUrl,
+                providerId: config.providerId || null,
+                providerName: config.providerName || null,
+                uploadFallback: "storage-source-url",
+              },
+            });
+          } catch (fallbackError) {
+            lastError = fallbackError;
+          }
+        }
         if (isCredentialOrBillingProviderError(error)) {
           await reportWorldLabsProviderRuntimeFailure(
             config.providerId,

app/api/client-performance/agent-style/route.ts

@@ -2,6 +2,7 @@ import { sql } from "drizzle-orm";
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { auth } from "@/app/(auth)/auth";
+import { isAgentModeScopedChatId } from "@/lib/chat/messages-route-access";
 import { db } from "@/lib/db";
 import { clientPerformanceEvent } from "@/lib/db/schema";
 
@@ -167,9 +168,12 @@ export async function POST(request: Request) {
       console.warn("[ClientPerformance] prune failed", error);
     });
 
+    const persistedChatId =
+      event.chatId && !isAgentModeScopedChatId(event.chatId) ? event.chatId : null;
+
     await db.insert(clientPerformanceEvent).values({
       userId: session?.user?.id || null,
-      chatId: event.chatId || null,
+      chatId: persistedChatId,
       projectId: clampText(event.projectId, 64),
       eventType: clampText(event.eventType, 64) || "unknown",
       section: event.section || "unknown",

app/api/enhance/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import {
   createMediaAssetRelation,
+  getAiProvidersByType,
   getMediaAssetsByUserAndUrls,
   getSystemSetting,
   upsertMediaAsset,
@@ -9,9 +10,12 @@ import { auth } from "@/app/(auth)/auth";
 import { uploadFile } from "@/lib/storage/service";
 import { db } from "@/lib/db";
 import { generatedImage } from "@/lib/db/schema";
+import { executeConfiguredVip98kTask } from "@/lib/ai/vip98k-runtime";
+import { createFalClient } from "@fal-ai/client";
 
 // 变清晰API配置类型
 type EnhanceApiConfig = {
+  provider?: "vip98k" | "aoscdn";
   apiUrl?: string;
   apiKey?: string;
   type?: string; // "clean" | "face"
@@ -317,6 +321,155 @@ async function processWithRealESRGANBase64(
   };
 }
 
+async function processWithFalEsrgan(
+  imageBase64: string,
+  requestedScaleFactor: number,
+): Promise<{ imageBase64: string; processingTime: number }> {
+  const providers = await getAiProvidersByType({
+    type: "fal-image",
+    enabledOnly: true,
+  });
+  const provider = providers.find((item) => item.apiKey?.trim());
+  if (!provider?.apiKey) {
+    throw new Error("未配置可用的 FAL 专用高清服务");
+  }
+
+  const scale = Math.max(2, Math.min(8, requestedScaleFactor || 4));
+  const model = scale <= 2 ? "RealESRGAN_x2plus" : "RealESRGAN_x4plus";
+  const credentials = provider.apiKey
+    .trim()
+    .replace(/^(?:Key|Bearer)\s+/i, "");
+  const fal = createFalClient({ credentials });
+  const startedAt = Date.now();
+  const result: any = await fal.subscribe("fal-ai/esrgan", {
+    input: {
+      image_url: `data:image/jpeg;base64,${imageBase64}`,
+      scale,
+      model,
+      output_format: "png",
+    },
+    logs: true,
+    timeout: 180_000,
+  });
+  const outputUrl = result?.data?.image?.url || result?.image?.url;
+  if (!outputUrl) {
+    throw new Error("FAL ESRGAN 专用高清服务未返回图片");
+  }
+
+  const outputResponse = await fetch(outputUrl, {
+    cache: "no-store",
+    signal: AbortSignal.timeout(120_000),
+  });
+  if (!outputResponse.ok) {
+    throw new Error(
+      `FAL ESRGAN 高清结果下载失败（HTTP ${outputResponse.status}）`,
+    );
+  }
+
+  return {
+    imageBase64: Buffer.from(await outputResponse.arrayBuffer()).toString(
+      "base64",
+    ),
+    processingTime: (Date.now() - startedAt) / 1000,
+  };
+}
+
+async function processWithVip98kEnhance(params: {
+  userId: string;
+  imageBase64: string;
+  prompt: string;
+  chatId: string | null;
+  messageId: string | null;
+  sourceImageUrl: string | null;
+  scaleFactor: number;
+}) {
+  const startedAt = Date.now();
+  const result = await executeConfiguredVip98kTask({
+    modelId: "enhance",
+    kind: "image-tool",
+    prompt: `${params.prompt || "Enhance image clarity"}. Upscale ${params.scaleFactor}x while preserving composition, color and texture.`,
+    imageUrls: [`data:image/jpeg;base64,${params.imageBase64}`],
+    imageParams: { scaleFactor: params.scaleFactor },
+  });
+  const outputUrl = result.outputUrls[0];
+  if (!outputUrl) throw new Error("VIP98K 变清晰未返回图片");
+
+  const response = await fetch(outputUrl, {
+    cache: "no-store",
+    signal: AbortSignal.timeout(120_000),
+  });
+  if (!response.ok) {
+    throw new Error(`VIP98K 变清晰结果下载失败（HTTP ${response.status}）`);
+  }
+  const outputBuffer = Buffer.from(await response.arrayBuffer());
+  const outputBase64 = outputBuffer.toString("base64");
+  const uploaded = await uploadBase64ToS3(outputBase64, "image/png");
+  const [savedImage] = await db
+    .insert(generatedImage)
+    .values({
+      userId: params.userId,
+      chatId: params.chatId,
+      messageId: params.messageId,
+      thumbnailUrl: uploaded.thumbnail,
+      originalUrl: uploaded.original,
+      imageSize: `${params.scaleFactor}x放大`,
+      prompt: params.prompt,
+      modelId: "enhance",
+    })
+    .returning();
+
+  try {
+    const sourceAssets = params.sourceImageUrl
+      ? await getMediaAssetsByUserAndUrls({
+          userId: params.userId,
+          urls: [params.sourceImageUrl],
+        })
+      : [];
+    const media = await upsertMediaAsset({
+      userId: params.userId,
+      chatId: params.chatId,
+      mediaType: "image",
+      sourceType: "edited",
+      status: "ready",
+      originalUrl: uploaded.original,
+      previewUrl: uploaded.original,
+      thumbnailUrl: uploaded.thumbnail,
+      displayName: params.prompt.slice(0, 80),
+      prompt: params.prompt,
+      modelId: "enhance",
+      sourceMessageId: params.messageId,
+      sourceTable: "GeneratedImage",
+      sourceRowId: savedImage?.id || null,
+      primaryParentAssetId: sourceAssets[0]?.id ?? null,
+      metadata: { provider: "vip98k", scaleFactor: params.scaleFactor },
+    });
+    if (media) {
+      for (const sourceAsset of sourceAssets) {
+        await createMediaAssetRelation({
+          userId: params.userId,
+          chatId: params.chatId,
+          fromAssetId: sourceAsset.id,
+          toAssetId: media.id,
+          relationType: "edited_from",
+          sourceMessageId: params.messageId,
+          metadata: { prompt: params.prompt, provider: "vip98k" },
+        });
+      }
+    }
+  } catch (error) {
+    console.warn("[Enhance-VIP98K] MediaAsset registration failed", error);
+  }
+
+  return {
+    success: true,
+    image_base64: outputBase64,
+    thumbnail_url: uploaded.thumbnail,
+    original_url: uploaded.original,
+    processing_time: (Date.now() - startedAt) / 1000,
+    api_type: "vip98k",
+  };
+}
+
 /**
  * 轮询获取任务结果（根据官方示例）
  */
@@ -536,6 +689,42 @@ async function finalizeEnhanceTaskResult(params: {
   };
 }
 
+async function executeFalEsrganFallback(params: {
+  userId: string;
+  imageBase64: string;
+  prompt: string;
+  chatId: string | null;
+  messageId: string | null;
+  sourceImageUrl: string | null;
+  requestedScaleFactor?: number;
+  reason: string;
+}) {
+  const scaleFactor = params.requestedScaleFactor || 4;
+  console.warn("[Enhance-FAL-ESRGAN] 启用专用高清备用链路", {
+    reason: params.reason.slice(0, 500),
+    scaleFactor,
+  });
+  const result = await processWithFalEsrgan(params.imageBase64, scaleFactor);
+  const payload = await finalizeEnhanceTaskResult({
+    userId: params.userId,
+    taskResult: {
+      status: 200,
+      data: { image_base64: result.imageBase64 },
+    },
+    prompt: params.prompt || "图片变清晰处理",
+    chatId: params.chatId,
+    messageId: params.messageId,
+    sourceImageUrls: params.sourceImageUrl
+      ? [params.sourceImageUrl]
+      : undefined,
+  });
+  return {
+    ...payload,
+    processing_time: result.processingTime,
+    api_type: "fal-esrgan",
+  };
+}
+
 export async function GET(request: NextRequest) {
   try {
     const session = await auth();
@@ -563,6 +752,12 @@ export async function GET(request: NextRequest) {
     }
 
     const config = enhanceConfig.value as EnhanceApiConfig;
+    if (config.provider === "vip98k") {
+      return NextResponse.json(
+        { error: "VIP98K 变清晰任务在 POST 请求内完成，无需 taskId 轮询" },
+        { status: 400 }
+      );
+    }
     if (config.useBackupApi) {
       return NextResponse.json(
         { error: "当前启用了Real-ESRGAN备用模式，不支持 taskId 轮询" },
@@ -651,12 +846,15 @@ export async function POST(request: NextRequest) {
     }
 
     const config = enhanceConfig.value as EnhanceApiConfig;
+    const useVip98k = config.provider === "vip98k";
 
     // 检查是否使用备用API
-    const useBackupApi = config.useBackupApi === true;
+    const useBackupApi = !useVip98k && config.useBackupApi === true;
     console.log(`[Enhance API] 使用${useBackupApi ? "备用API (Real-ESRGAN)" : "主API"}`);
 
-    if (useBackupApi) {
+    if (useVip98k) {
+      // VIP98K 密钥只从 AiProvider 读取。
+    } else if (useBackupApi) {
       // 验证备用API配置
       if (!config.backupApiUrl || !config.backupApiKey) {
         return NextResponse.json(
@@ -757,6 +955,31 @@ export async function POST(request: NextRequest) {
       );
     }
 
+    if (useVip98k) {
+      try {
+        const scaleFactor = requestedScaleFactor || 4;
+        const payload = await processWithVip98kEnhance({
+          userId,
+          imageBase64,
+          prompt: prompt || "图片变清晰处理",
+          chatId,
+          messageId,
+          sourceImageUrl,
+          scaleFactor,
+        });
+        return NextResponse.json(payload);
+      } catch (error) {
+        console.error("[Enhance-VIP98K] Processing failed", error);
+        return NextResponse.json(
+          {
+            error: "VIP98K 变清晰处理失败",
+            detail: error instanceof Error ? error.message : "未知错误",
+          },
+          { status: 500 }
+        );
+      }
+    }
+
     // ========== 备用API处理路径 (Real-ESRGAN) ==========
     if (useBackupApi) {
       console.log("[Enhance API] 使用Real-ESRGAN备用API处理（URL方式）...");
@@ -894,6 +1117,21 @@ export async function POST(request: NextRequest) {
         
       } catch (error) {
         console.error("[Enhance-RealESRGAN] ❌ 处理失败:", error);
+        try {
+          const fallbackPayload = await executeFalEsrganFallback({
+            userId,
+            imageBase64,
+            prompt,
+            chatId,
+            messageId,
+            sourceImageUrl,
+            requestedScaleFactor,
+            reason: error instanceof Error ? error.message : "RealESRGAN 备用服务失败",
+          });
+          return NextResponse.json(fallbackPayload);
+        } catch (falError) {
+          console.error("[Enhance-FAL-ESRGAN] 专用高清备用链路失败:", falError);
+        }
         return NextResponse.json(
           { 
             error: "Real-ESRGAN变清晰处理失败",
@@ -1049,6 +1287,22 @@ export async function POST(request: NextRequest) {
         processingTime,
       });
 
+      try {
+        const fallbackPayload = await executeFalEsrganFallback({
+          userId,
+          imageBase64,
+          prompt,
+          chatId,
+          messageId,
+          sourceImageUrl,
+          requestedScaleFactor,
+          reason: fetchError instanceof Error ? fetchError.message : "AOS 高清任务创建失败",
+        });
+        return NextResponse.json(fallbackPayload);
+      } catch (falError) {
+        console.error("[Enhance-FAL-ESRGAN] 专用高清备用链路失败:", falError);
+      }
+      
       // 检查是否是网络连接错误
       if (fetchError instanceof Error) {
         if (fetchError.name === "AbortError") {
@@ -1114,6 +1368,21 @@ export async function POST(request: NextRequest) {
           return buildEnhanceTaskPendingResponse(taskId);
         }
         const detail = pollError instanceof Error ? pollError.message : "轮询失败";
+        try {
+          const fallbackPayload = await executeFalEsrganFallback({
+            userId,
+            imageBase64,
+            prompt,
+            chatId,
+            messageId,
+            sourceImageUrl,
+            requestedScaleFactor,
+            reason: detail,
+          });
+          return NextResponse.json(fallbackPayload);
+        } catch (falError) {
+          console.error("[Enhance-FAL-ESRGAN] 专用高清备用链路失败:", falError);
+        }
         const friendlyMessage = getAosFriendlyErrorMessage(detail);
         return NextResponse.json(
           { error: "变清晰处理失败", detail: friendlyMessage || detail },

app/api/external/image/generate/route.ts

@@ -21,103 +21,6 @@ import {
 export const runtime = "nodejs";
 export const maxDuration = 1200;
 
-const EXTERNAL_IMAGE_API_LIMITER_KEY = "__external_image_api_limiter__";
-const DEFAULT_EXTERNAL_IMAGE_API_MAX_CONCURRENT = 2;
-const DEFAULT_EXTERNAL_IMAGE_API_MAX_QUEUE = 8;
-const DEFAULT_EXTERNAL_IMAGE_API_QUEUE_TIMEOUT_MS = 15_000;
-
-class ExternalImageApiBusyError extends Error {
-  readonly retryAfterSeconds: number;
-
-  constructor(message: string, retryAfterSeconds = 15) {
-    super(message);
-    this.name = "ExternalImageApiBusyError";
-    this.retryAfterSeconds = retryAfterSeconds;
-  }
-}
-
-type ExternalImageApiWaiter = {
-  resolve: (release: () => void) => void;
-  reject: (error: Error) => void;
-  timer: ReturnType<typeof setTimeout>;
-};
-
-type ExternalImageApiLimiterState = {
-  running: number;
-  queue: ExternalImageApiWaiter[];
-};
-
-function parsePositiveInteger(value: unknown, fallback: number) {
-  const parsed = Number.parseInt(String(value || ""), 10);
-  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
-}
-
-function getExternalImageApiLimiterState(): ExternalImageApiLimiterState {
-  const globalState = globalThis as typeof globalThis & {
-    [EXTERNAL_IMAGE_API_LIMITER_KEY]?: ExternalImageApiLimiterState;
-  };
-
-  if (!globalState[EXTERNAL_IMAGE_API_LIMITER_KEY]) {
-    globalState[EXTERNAL_IMAGE_API_LIMITER_KEY] = {
-      running: 0,
-      queue: [],
-    };
-  }
-
-  return globalState[EXTERNAL_IMAGE_API_LIMITER_KEY]!;
-}
-
-function acquireExternalImageApiSlot(): Promise<() => void> {
-  const state = getExternalImageApiLimiterState();
-  const maxConcurrent = parsePositiveInteger(
-    process.env.EXTERNAL_IMAGE_API_MAX_CONCURRENT,
-    DEFAULT_EXTERNAL_IMAGE_API_MAX_CONCURRENT,
-  );
-  const maxQueue = parsePositiveInteger(
-    process.env.EXTERNAL_IMAGE_API_MAX_QUEUE,
-    DEFAULT_EXTERNAL_IMAGE_API_MAX_QUEUE,
-  );
-  const queueTimeoutMs = parsePositiveInteger(
-    process.env.EXTERNAL_IMAGE_API_QUEUE_TIMEOUT_MS,
-    DEFAULT_EXTERNAL_IMAGE_API_QUEUE_TIMEOUT_MS,
-  );
-
-  const release = () => {
-    state.running = Math.max(0, state.running - 1);
-    const next = state.queue.shift();
-    if (!next) return;
-    clearTimeout(next.timer);
-    state.running += 1;
-    next.resolve(release);
-  };
-
-  if (state.running < maxConcurrent) {
-    state.running += 1;
-    return Promise.resolve(release);
-  }
-
-  if (state.queue.length >= maxQueue) {
-    return Promise.reject(
-      new ExternalImageApiBusyError("图片生成服务繁忙，请稍后重试"),
-    );
-  }
-
-  return new Promise((resolve, reject) => {
-    const waiter: ExternalImageApiWaiter = {
-      resolve,
-      reject,
-      timer: setTimeout(() => {
-        const index = state.queue.indexOf(waiter);
-        if (index >= 0) {
-          state.queue.splice(index, 1);
-        }
-        reject(new ExternalImageApiBusyError("图片生成排队超时，请稍后重试"));
-      }, queueTimeoutMs),
-    };
-    state.queue.push(waiter);
-  });
-}
-
 const requestSchema = z.object({
   prompt: z.string().trim().min(1, "prompt 不能为空"),
   negativePrompt: z.string().trim().optional(),
@@ -294,10 +197,8 @@ export async function POST(request: Request) {
 
   const startedAt = Date.now();
   let logId: string | null = null;
-  let releaseExternalImageApiSlot: (() => void) | null = null;
 
   try {
-    releaseExternalImageApiSlot = await acquireExternalImageApiSlot();
     const payload = await parseRequestPayload(request);
     const imageSize = normalizeExternalImageApiImageSize(payload.imageSize);
     const candidateModels = await buildExternalImageApiModelCandidates({
@@ -344,6 +245,7 @@ export async function POST(request: Request) {
 
     const generationResult = await generateImagesWithFailover({
       candidates: candidateModels,
+      ownerKey: `external-image-api:${authResult.accessKey.id}`,
       prompt: payload.prompt,
       negativePrompt: payload.negativePrompt || null,
       imageCount: payload.imageCount || 1,
@@ -467,21 +369,6 @@ export async function POST(request: Request) {
         .where(eq(externalImageApiRequestLog.id, logId));
     }
 
-    if (error instanceof ExternalImageApiBusyError) {
-      return NextResponse.json(
-        {
-          success: false,
-          error: error.message,
-        },
-        {
-          status: 429,
-          headers: {
-            "Retry-After": String(error.retryAfterSeconds),
-          },
-        },
-      );
-    }
-
     return NextResponse.json(
       {
         success: false,
@@ -489,9 +376,5 @@ export async function POST(request: Request) {
       },
       { status: 500 },
     );
-  } finally {
-    if (releaseExternalImageApiSlot) {
-      releaseExternalImageApiSlot();
-    }
   }
 }

app/api/favicon/route.ts

@@ -83,6 +83,10 @@ async function readLocalFallbackFavicon() {
 export async function GET(request: Request) {
   try {
     const requestUrl = new URL(request.url);
+    if (process.env.CANVAS_E2E_LOCAL === "true") {
+      return await readLocalFallbackFavicon();
+    }
+
     const preferDark = requestUrl.searchParams.get("theme") === "dark";
     const settings = await getSiteSettings();
     const configuredFavicon = String(settings?.favicon || "").trim();

app/api/internal/access-log/route.ts

@@ -0,0 +1,147 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import {
+  type AccessLogSeverity,
+  recordAccessIpEvent,
+} from "@/lib/security/access-log";
+
+export const runtime = "nodejs";
+export const maxDuration = 10;
+
+const payloadSchema = z.object({
+  eventType: z.string().trim().max(32).optional(),
+  ip: z.string().trim().max(128).optional().nullable(),
+  userId: z.string().trim().uuid().optional().nullable(),
+  userEmail: z.string().trim().max(128).optional().nullable(),
+  userRole: z.string().trim().max(32).optional().nullable(),
+  method: z.string().trim().max(12).optional().nullable(),
+  path: z.string().trim().max(256).optional().nullable(),
+  routeGroup: z.string().trim().max(64).optional().nullable(),
+  statusCode: z.coerce.number().int().min(100).max(599).optional().nullable(),
+  outcome: z.string().trim().max(32).optional().nullable(),
+  severity: z.enum(["info", "watch", "high", "critical"]).optional(),
+  reasons: z.array(z.string().trim().max(80)).max(12).optional(),
+  userAgent: z.string().trim().max(512).optional().nullable(),
+  referer: z.string().trim().max(512).optional().nullable(),
+  metadata: z.record(z.unknown()).optional().nullable(),
+  occurredAt: z.union([z.string(), z.number(), z.date()]).optional(),
+});
+
+const suspiciousPathPatterns = [
+  /\.env/i,
+  /\/\.git/i,
+  /\/wp-admin/i,
+  /\/phpmyadmin/i,
+  /\/actuator/i,
+  /\/vendor\/phpunit/i,
+  /\/eval-stdin\.php/i,
+  /\/containers\/json/i,
+  /\/index\.php/i,
+];
+
+const suspiciousUserAgentPatterns = [
+  /libredtail|masscan|zgrab|sqlmap|nikto|acunetix|nessus/i,
+  /wget|curl|python-requests|go-http-client/i,
+  /nuclei|crawlergo|httpx/i,
+];
+
+function pushReason(reasons: string[], reason: string) {
+  if (!reasons.includes(reason)) reasons.push(reason);
+}
+
+function rankSeverity(value: AccessLogSeverity) {
+  return { info: 0, watch: 1, high: 2, critical: 3 }[value];
+}
+
+function maxSeverity(
+  current: AccessLogSeverity,
+  next: AccessLogSeverity
+): AccessLogSeverity {
+  return rankSeverity(next) > rankSeverity(current) ? next : current;
+}
+
+function classifyPayload(
+  payload: z.infer<typeof payloadSchema>
+): { severity: AccessLogSeverity; reasons: string[] } {
+  let severity: AccessLogSeverity = payload.severity || "info";
+  const reasons = [...(payload.reasons || [])];
+  const path = payload.path || "";
+  const userAgent = payload.userAgent || "";
+  const statusCode = payload.statusCode || 0;
+  const outcome = payload.outcome || "allowed";
+
+  if (outcome === "rate_limited") {
+    severity = maxSeverity(severity, "high");
+    pushReason(reasons, "触发访问频率限制");
+  }
+
+  if (outcome === "unauthorized" || statusCode === 401 || statusCode === 403) {
+    severity = maxSeverity(severity, "watch");
+    pushReason(reasons, "出现未授权访问");
+  }
+
+  if (statusCode === 429) {
+    severity = maxSeverity(severity, "high");
+    pushReason(reasons, "返回 429 限流");
+  } else if (statusCode >= 500) {
+    severity = maxSeverity(severity, "high");
+    pushReason(reasons, "触发服务端错误");
+  } else if (statusCode >= 400) {
+    severity = maxSeverity(severity, "watch");
+    pushReason(reasons, "返回 4xx 异常状态");
+  }
+
+  if (path.startsWith("/api/auth") && statusCode >= 400) {
+    severity = maxSeverity(severity, "high");
+    pushReason(reasons, "认证接口失败");
+  }
+
+  if (suspiciousPathPatterns.some((pattern) => pattern.test(path))) {
+    severity = maxSeverity(severity, "high");
+    pushReason(reasons, "命中敏感探测路径");
+  }
+
+  if (suspiciousUserAgentPatterns.some((pattern) => pattern.test(userAgent))) {
+    severity = maxSeverity(severity, "watch");
+    pushReason(reasons, "User-Agent 异常");
+  }
+
+  if (reasons.includes("静态黑名单命中但未封禁")) {
+    severity = maxSeverity(severity, "high");
+  }
+
+  return {
+    severity,
+    reasons: Array.from(new Set(reasons)).slice(0, 8),
+  };
+}
+
+function getExpectedSecret() {
+  return process.env.ACCESS_LOG_INTERNAL_TOKEN || process.env.AUTH_SECRET || "";
+}
+
+export async function POST(request: Request) {
+  const expectedSecret = getExpectedSecret();
+  const providedSecret = request.headers.get("x-access-log-internal-secret") || "";
+
+  if (!expectedSecret || providedSecret !== expectedSecret) {
+    return new NextResponse("Not found", { status: 404 });
+  }
+
+  const raw = await request.json().catch(() => null);
+  const parsed = payloadSchema.safeParse(raw);
+  if (!parsed.success) {
+    return NextResponse.json({ ok: true });
+  }
+
+  const classification = classifyPayload(parsed.data);
+  await recordAccessIpEvent({
+    ...parsed.data,
+    severity: classification.severity,
+    reasons: classification.reasons,
+  }).catch((error) => {
+    console.warn("[AccessIpEvent] failed to record access event", error);
+  });
+
+  return NextResponse.json({ ok: true });
+}

app/api/internal/ip-blocklist/check/route.ts

@@ -0,0 +1,140 @@
+import { and, eq, gt, isNull, or } from "drizzle-orm";
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { db } from "@/lib/db";
+import { accessIpBlocklist } from "@/lib/db/schema";
+import { matchManualIpBlock } from "@/lib/security/manual-ip-blocklist";
+
+export const runtime = "nodejs";
+export const maxDuration = 5;
+
+const payloadSchema = z.object({
+  ip: z.string().trim().max(128).optional().nullable(),
+});
+
+const BLOCKLIST_UNAVAILABLE_CACHE_MS = 5 * 60 * 1000;
+
+let blocklistUnavailableUntil = 0;
+let blocklistMissingTableWarned = false;
+
+function getExpectedSecret() {
+  return process.env.ACCESS_LOG_INTERNAL_TOKEN || process.env.AUTH_SECRET || "";
+}
+
+function getErrorCode(error: unknown) {
+  const directCode =
+    error && typeof error === "object"
+      ? (error as { code?: unknown }).code
+      : null;
+  if (typeof directCode === "string") return directCode;
+
+  const cause =
+    error && typeof error === "object"
+      ? (error as { cause?: unknown }).cause
+      : null;
+  const causeCode =
+    cause && typeof cause === "object"
+      ? (cause as { code?: unknown }).code
+      : null;
+  return typeof causeCode === "string" ? causeCode : null;
+}
+
+function getErrorMessage(error: unknown) {
+  const messages: string[] = [];
+  if (error instanceof Error) messages.push(error.message);
+
+  const cause =
+    error && typeof error === "object"
+      ? (error as { cause?: unknown }).cause
+      : null;
+  if (cause instanceof Error) messages.push(cause.message);
+
+  if (!messages.length) messages.push(String(error));
+  return messages.join("\n");
+}
+
+function isMissingAccessIpBlocklistTableError(error: unknown) {
+  if (getErrorCode(error) === "42P01") return true;
+
+  const message = getErrorMessage(error);
+  return (
+    message.includes('relation "AccessIpBlocklist" does not exist') ||
+    (message.includes("AccessIpBlocklist") && message.includes("does not exist"))
+  );
+}
+
+function markBlocklistUnavailable(error: unknown) {
+  blocklistUnavailableUntil = Date.now() + BLOCKLIST_UNAVAILABLE_CACHE_MS;
+  if (blocklistMissingTableWarned) return;
+
+  blocklistMissingTableWarned = true;
+  console.warn(
+    "[AccessIpBlocklist] table is unavailable; manual IP block checks will be skipped temporarily",
+    getErrorMessage(error)
+  );
+}
+
+export async function POST(request: Request) {
+  const expectedSecret = getExpectedSecret();
+  const providedSecret = request.headers.get("x-access-log-internal-secret") || "";
+
+  if (!expectedSecret || providedSecret !== expectedSecret) {
+    return new NextResponse("Not found", { status: 404 });
+  }
+
+  const parsed = payloadSchema.safeParse(await request.json().catch(() => null));
+  if (!parsed.success || !parsed.data.ip) {
+    return NextResponse.json({ blocked: false });
+  }
+
+  if (
+    process.env.MANUAL_IP_BLOCKLIST_ENABLED === "false" ||
+    Date.now() < blocklistUnavailableUntil
+  ) {
+    return NextResponse.json({ blocked: false });
+  }
+
+  try {
+    const now = new Date();
+    const entries = await db
+      .select({
+        id: accessIpBlocklist.id,
+        ip: accessIpBlocklist.ip,
+        reason: accessIpBlocklist.reason,
+        expiresAt: accessIpBlocklist.expiresAt,
+      })
+      .from(accessIpBlocklist)
+      .where(
+        and(
+          eq(accessIpBlocklist.isActive, true),
+          or(
+            isNull(accessIpBlocklist.expiresAt),
+            gt(accessIpBlocklist.expiresAt, now)
+          )
+        )
+      )
+      .limit(1000);
+
+    const activeEntries = entries.filter((entry) => entry.ip && entry.id);
+    const matched = matchManualIpBlock(parsed.data.ip, activeEntries);
+
+    return NextResponse.json({
+      blocked: Boolean(matched),
+      entry: matched
+        ? {
+            id: matched.id,
+            ip: matched.ip,
+            reason: matched.reason || null,
+            expiresAt: matched.expiresAt || null,
+          }
+        : null,
+    });
+  } catch (error) {
+    if (isMissingAccessIpBlocklistTableError(error)) {
+      markBlocklistUnavailable(error);
+      return NextResponse.json({ blocked: false });
+    }
+    console.warn("[AccessIpBlocklist] internal check failed", error);
+    return NextResponse.json({ blocked: false });
+  }
+}

app/api/internal/pascal-agent/v1/chat/completions/route.ts

@@ -0,0 +1,138 @@
+import { NextResponse } from "next/server";
+import { getProviderDefaultBaseUrl } from "@/lib/ai/provider-defaults";
+import { resolveModelRuntimeId } from "@/lib/ai/model-runtime";
+import { getMultimodalAiModelsWithProvider } from "@/lib/db/queries";
+import { createLogger } from "@/lib/observability/logger";
+import { isPascalInternalRequest } from "@/lib/pascal/internal-auth";
+
+export const dynamic = "force-dynamic";
+export const maxDuration = 600;
+export const runtime = "nodejs";
+
+const logger = createLogger("pascal-model-gateway");
+const OPENAI_COMPATIBLE_PROVIDER_TYPES = new Set([
+  "alibaba",
+  "custom",
+  "openai",
+  "zhipu",
+]);
+
+function upstreamChatUrl(baseUrl: string) {
+  const normalized = baseUrl.replace(/\/+$/, "");
+  return normalized.endsWith("/chat/completions")
+    ? normalized
+    : `${normalized}/chat/completions`;
+}
+
+function openAiError(message: string, status: number) {
+  return NextResponse.json(
+    { error: { message, type: "pascal_gateway_error" } },
+    { status }
+  );
+}
+
+async function getConfiguredMultimodalModel() {
+  const candidates = await getMultimodalAiModelsWithProvider();
+  return candidates.find(({ provider }) =>
+    OPENAI_COMPATIBLE_PROVIDER_TYPES.has(provider.type)
+  );
+}
+
+export async function GET(request: Request) {
+  if (!isPascalInternalRequest(request)) {
+    return NextResponse.json({ error: "not_found" }, { status: 404 });
+  }
+
+  const configured = await getConfiguredMultimodalModel();
+  if (!configured) {
+    return NextResponse.json({ configured: false, selection: "multimodal" });
+  }
+
+  return NextResponse.json({
+    configured: true,
+    compatible: OPENAI_COMPATIBLE_PROVIDER_TYPES.has(configured.provider.type),
+    model: configured.model.displayName || configured.model.modelId,
+    provider: configured.provider.name,
+    providerType: configured.provider.type,
+    selection: "multimodal",
+  });
+}
+
+export async function POST(request: Request) {
+  if (!isPascalInternalRequest(request)) {
+    return NextResponse.json({ error: "not_found" }, { status: 404 });
+  }
+
+  let body: Record<string, unknown>;
+  try {
+    const parsed = await request.json();
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return openAiError("Invalid request body.", 400);
+    }
+    body = parsed as Record<string, unknown>;
+  } catch {
+    return openAiError("Invalid JSON body.", 400);
+  }
+
+  const configured = await getConfiguredMultimodalModel();
+  if (!configured) {
+    return openAiError("No enabled multimodal model is configured.", 503);
+  }
+
+  const { model, provider } = configured;
+  if (!OPENAI_COMPATIBLE_PROVIDER_TYPES.has(provider.type)) {
+    return openAiError(
+      `The configured multimodal provider type '${provider.type}' is not OpenAI-compatible.`,
+      503
+    );
+  }
+
+  const baseUrl =
+    provider.baseUrl?.trim() || getProviderDefaultBaseUrl(provider.type) || "";
+  const runtimeModelId = resolveModelRuntimeId(model, {
+    providerType: provider.type,
+  });
+  if (!baseUrl || !runtimeModelId || !provider.apiKey) {
+    return openAiError("The configured multimodal model is incomplete.", 503);
+  }
+
+  const startedAt = Date.now();
+  try {
+    const upstream = await fetch(upstreamChatUrl(baseUrl), {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${provider.apiKey}`,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({ ...body, model: runtimeModelId }),
+      cache: "no-store",
+      signal: request.signal,
+    });
+
+    logger.info("upstream completed", {
+      elapsedMs: Date.now() - startedAt,
+      modelId: model.id,
+      providerId: provider.id,
+      status: upstream.status,
+    });
+
+    const headers = new Headers({
+      "Cache-Control": "no-cache, no-transform",
+      "Content-Type":
+        upstream.headers.get("content-type") || "application/json; charset=utf-8",
+      "X-Accel-Buffering": "no",
+    });
+    return new Response(upstream.body, { status: upstream.status, headers });
+  } catch (error) {
+    logger.error("upstream failed", {
+      elapsedMs: Date.now() - startedAt,
+      error: error instanceof Error ? error.message : String(error),
+      modelId: model.id,
+      providerId: provider.id,
+    });
+    return openAiError(
+      "The configured multimodal model is temporarily unavailable.",
+      502
+    );
+  }
+}

app/api/internal/pascal/access/route.ts

@@ -0,0 +1,26 @@
+import { NextResponse } from "next/server";
+import { auth } from "@/app/(auth)/auth";
+import { isPascalInternalRequest } from "@/lib/pascal/internal-auth";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export async function GET(request: Request) {
+  if (!isPascalInternalRequest(request)) {
+    return NextResponse.json({ error: "not_found" }, { status: 404 });
+  }
+
+  const session = await auth();
+  const userId = session?.user?.id?.trim();
+  if (!userId) {
+    return NextResponse.json({ error: "unauthorized" }, { status: 401 });
+  }
+
+  return new NextResponse(null, {
+    status: 204,
+    headers: {
+      "Cache-Control": "no-store",
+      "X-Pascal-User-Id": userId,
+    },
+  });
+}

app/api/mcp/canvas/[id]/route.ts

@@ -0,0 +1,38 @@
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+import { NextResponse } from "next/server";
+
+import { auth } from "@/app/(auth)/auth";
+import { createCanvasCapabilityMcpServer } from "@/lib/canvas/capabilities/mcp-server";
+
+export const dynamic = "force-dynamic";
+export const maxDuration = 600;
+
+async function handleMcpRequest(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const session = await auth();
+  if (!session?.user?.id) {
+    return NextResponse.json(
+      { error: "未登录，无法访问画布 MCP 服务" },
+      { status: 401 }
+    );
+  }
+
+  const { id: projectId } = await params;
+  const transport = new WebStandardStreamableHTTPServerTransport({
+    enableJsonResponse: true,
+  });
+  const server = await createCanvasCapabilityMcpServer({
+    projectId,
+    requestHeaders: request.headers,
+    requestUrl: request.url,
+    userId: session.user.id,
+  });
+  await server.connect(transport);
+  return transport.handleRequest(request);
+}
+
+export const POST = handleMcpRequest;
+export const GET = handleMcpRequest;
+export const DELETE = handleMcpRequest;

app/api/messages/route.ts

@@ -32,6 +32,15 @@ const FAL_IMAGE_TASK_POLL_INTERVAL_MS = 2_000;
 const falTaskLastPolledAt = new Map<string, number>();
 const falTaskSyncInFlight = new Set<string>();
 
+function toPublicVideoMetadata(value: DBMessage["videoMetadata"]) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return value;
+  const metadata = value as Record<string, unknown>;
+  if (metadata.taskKind !== "clawd_chat") return value;
+  const publicMetadata = { ...metadata };
+  delete publicMetadata.upstreamTaskKey;
+  return publicMetadata;
+}
+
 function createEmptyMessagesResponse() {
   return NextResponse.json(
     { messages: [] },
@@ -277,7 +286,7 @@ export async function GET(request: NextRequest) {
         createdAt: msg.createdAt,
         parts: parts,
         attachments: msg.attachments || [],
-        videoMetadata: msg.videoMetadata || null,
+        videoMetadata: toPublicVideoMetadata(msg.videoMetadata) || null,
       };
     });
 

app/api/openapi/v1/access-keys/provision/route.ts

@@ -0,0 +1,148 @@
+import { and, eq, isNotNull } from "drizzle-orm";
+import { z } from "zod";
+import {
+  createUserAccessKey,
+  listUserAccessKeys,
+} from "@/lib/access-keys/service";
+import {
+  MIN_PROVISIONING_SECRET_LENGTH,
+  parseProvisioningBearerSecret,
+  verifyProvisioningSecret,
+} from "@/lib/access-keys/provisioning-secret";
+import { db } from "@/lib/db";
+import { user } from "@/lib/db/schema";
+
+const provisionAccessKeySchema = z.object({
+  dingTalkUsername: z.string().trim().min(1).max(100),
+  dingTalkUserId: z.string().trim().min(1).max(128).optional(),
+  keyName: z.string().trim().min(1).max(100).optional(),
+  scopes: z
+    .array(z.enum(["canvas:read", "canvas:write"]))
+    .min(1)
+    .optional(),
+  expiresInDays: z.number().int().min(1).max(365).optional(),
+});
+
+function jsonError(error: string, code: string, status: number) {
+  return Response.json(
+    { success: false, error, code },
+    { status, headers: { "Cache-Control": "no-store" } }
+  );
+}
+
+export async function POST(request: Request) {
+  const expectedSecret = String(
+    process.env.MCP_KEY_PROVISIONING_SECRET || ""
+  ).trim();
+  if (expectedSecret.length < MIN_PROVISIONING_SECRET_LENGTH) {
+    return jsonError(
+      "Access Key provisioning is not configured",
+      "PROVISIONING_NOT_CONFIGURED",
+      503
+    );
+  }
+
+  const providedSecret = parseProvisioningBearerSecret(
+    request.headers.get("authorization")
+  );
+  if (!verifyProvisioningSecret(providedSecret, expectedSecret)) {
+    return jsonError(
+      "Missing or invalid provisioning credential",
+      "PROVISIONING_UNAUTHORIZED",
+      401
+    );
+  }
+
+  const parsedBody = provisionAccessKeySchema.safeParse(
+    await request.json().catch(() => null)
+  );
+  if (!parsedBody.success) {
+    return jsonError(
+      "Invalid provisioning request",
+      "PROVISIONING_REQUEST_INVALID",
+      400
+    );
+  }
+
+  const body = parsedBody.data;
+  const conditions = [
+    eq(user.name, body.dingTalkUsername),
+    eq(user.isActive, true),
+    isNotNull(user.dingtalkUserId),
+  ];
+  if (body.dingTalkUserId) {
+    conditions.push(eq(user.dingtalkUserId, body.dingTalkUserId));
+  }
+
+  const matches = await db
+    .select({
+      id: user.id,
+      name: user.name,
+      dingtalkUserId: user.dingtalkUserId,
+    })
+    .from(user)
+    .where(and(...conditions))
+    .limit(2);
+
+  if (matches.length === 0) {
+    return jsonError(
+      "No active DingTalk user matched the supplied identity",
+      "DINGTALK_USER_NOT_FOUND",
+      404
+    );
+  }
+  if (matches.length > 1) {
+    return jsonError(
+      "DingTalk username is not unique; provide dingTalkUserId",
+      "DINGTALK_USERNAME_AMBIGUOUS",
+      409
+    );
+  }
+
+  const matchedUser = matches[0];
+  const existingKeys = await listUserAccessKeys(matchedUser.id);
+  const activeKeyCount = existingKeys.filter(
+    (item) =>
+      !item.revokedAt &&
+      (!item.expiresAt || new Date(item.expiresAt).getTime() > Date.now())
+  ).length;
+  if (activeKeyCount >= 10) {
+    return jsonError(
+      "The user already has 10 active Access Keys",
+      "ACCESS_KEY_LIMIT_REACHED",
+      409
+    );
+  }
+
+  try {
+    const accessKey = await createUserAccessKey({
+      userId: matchedUser.id,
+      name: body.keyName || "第三方 OpenClaw",
+      scopes: body.scopes,
+      expiresInDays: body.expiresInDays,
+    });
+
+    return Response.json(
+      {
+        success: true,
+        data: {
+          user: matchedUser,
+          accessKey,
+        },
+      },
+      {
+        status: 201,
+        headers: {
+          "Cache-Control": "no-store",
+          Pragma: "no-cache",
+        },
+      }
+    );
+  } catch {
+    return jsonError(
+      "Failed to provision Access Key",
+      "ACCESS_KEY_PROVISION_FAILED",
+      500
+    );
+  }
+}

app/api/openapi/v1/canvases/[id]/operations/route.ts

@@ -0,0 +1,48 @@
+import { getCanvasAgentFeatureFlagsFromSystemSettings } from "@/lib/canvas/agent-feature-settings";
+import { applyCanvasOperationPlan } from "@/lib/canvas/agent-mutations";
+import { handleCanvasAgentOperationRouteRequest } from "@/lib/canvas/agent-operation-route";
+import { z } from "zod";
+import {
+  openApiErrorResponse,
+  requireOpenApiPrincipal,
+} from "@/lib/access-keys/openapi-auth";
+
+const canvasIdSchema = z.string().uuid();
+
+export async function POST(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  try {
+    const principal = await requireOpenApiPrincipal(request, "canvas:write");
+    const { id: rawId } = await params;
+    const parsedId = canvasIdSchema.safeParse(rawId);
+    if (!parsedId.success) {
+      return Response.json(
+        {
+          success: false,
+          error: "Invalid canvas ID",
+          code: "INVALID_CANVAS_ID",
+        },
+        { status: 400 }
+      );
+    }
+
+    const id = parsedId.data;
+    const response = await handleCanvasAgentOperationRouteRequest({
+      userId: principal.userId,
+      projectId: id,
+      readBody: () => request.json(),
+      features: await getCanvasAgentFeatureFlagsFromSystemSettings(),
+      applyOperation: applyCanvasOperationPlan,
+      logger: console,
+    });
+
+    return Response.json(response.body, {
+      status: response.status,
+      headers: { "Cache-Control": "no-store" },
+    });
+  } catch (error) {
+    return openApiErrorResponse(error);
+  }
+}

app/api/openapi/v1/canvases/[id]/route.ts

@@ -0,0 +1,57 @@
+import { and, eq } from "drizzle-orm";
+import { z } from "zod";
+import { db } from "@/lib/db";
+import { canvasProject } from "@/lib/db/schema";
+import {
+  openApiErrorResponse,
+  requireOpenApiPrincipal,
+} from "@/lib/access-keys/openapi-auth";
+
+const canvasIdSchema = z.string().uuid();
+
+export async function GET(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  try {
+    const principal = await requireOpenApiPrincipal(request, "canvas:read");
+    const { id: rawId } = await params;
+    const parsedId = canvasIdSchema.safeParse(rawId);
+    if (!parsedId.success) {
+      return Response.json(
+        {
+          success: false,
+          error: "Invalid canvas ID",
+          code: "INVALID_CANVAS_ID",
+        },
+        { status: 400 }
+      );
+    }
+
+    const id = parsedId.data;
+    const [project] = await db
+      .select()
+      .from(canvasProject)
+      .where(
+        and(
+          eq(canvasProject.id, id),
+          eq(canvasProject.userId, principal.userId)
+        )
+      )
+      .limit(1);
+
+    if (!project) {
+      return Response.json(
+        { success: false, error: "Canvas not found", code: "CANVAS_NOT_FOUND" },
+        { status: 404 }
+      );
+    }
+
+    return Response.json(
+      { success: true, data: project },
+      { headers: { "Cache-Control": "no-store" } }
+    );
+  } catch (error) {
+    return openApiErrorResponse(error);
+  }
+}

app/api/openapi/v1/canvases/route.ts

@@ -0,0 +1,52 @@
+import { and, desc, eq } from "drizzle-orm";
+import { db } from "@/lib/db";
+import { canvasProject } from "@/lib/db/schema";
+import {
+  openApiErrorResponse,
+  requireOpenApiPrincipal,
+} from "@/lib/access-keys/openapi-auth";
+
+function normalizeWorkspaceType(value: string | null) {
+  return value === "agent" || value === "video" ? value : "canvas";
+}
+
+export async function GET(request: Request) {
+  try {
+    const principal = await requireOpenApiPrincipal(request, "canvas:read");
+    const url = new URL(request.url);
+    const workspaceType = normalizeWorkspaceType(
+      url.searchParams.get("workspaceType")
+    );
+    const requestedLimit = Number(url.searchParams.get("limit") || 24);
+    const limit = Number.isFinite(requestedLimit)
+      ? Math.min(50, Math.max(1, Math.round(requestedLimit)))
+      : 24;
+
+    const projects = await db
+      .select({
+        id: canvasProject.id,
+        title: canvasProject.title,
+        description: canvasProject.description,
+        thumbnail: canvasProject.thumbnail,
+        workspaceType: canvasProject.workspaceType,
+        createdAt: canvasProject.createdAt,
+        updatedAt: canvasProject.updatedAt,
+      })
+      .from(canvasProject)
+      .where(
+        and(
+          eq(canvasProject.userId, principal.userId),
+          eq(canvasProject.workspaceType, workspaceType)
+        )
+      )
+      .orderBy(desc(canvasProject.updatedAt))
+      .limit(limit);
+
+    return Response.json(
+      { success: true, data: projects },
+      { headers: { "Cache-Control": "no-store" } }
+    );
+  } catch (error) {
+    return openApiErrorResponse(error);
+  }
+}

app/api/openapi/v1/me/route.ts

@@ -0,0 +1,41 @@
+import { eq } from "drizzle-orm";
+import { db } from "@/lib/db";
+import { user } from "@/lib/db/schema";
+import {
+  openApiErrorResponse,
+  requireOpenApiPrincipal,
+} from "@/lib/access-keys/openapi-auth";
+
+export async function GET(request: Request) {
+  try {
+    const principal = await requireOpenApiPrincipal(request, "canvas:read");
+    const [currentUser] = await db
+      .select({
+        id: user.id,
+        email: user.email,
+        name: user.name,
+        department: user.department,
+        role: user.role,
+      })
+      .from(user)
+      .where(eq(user.id, principal.userId))
+      .limit(1);
+
+    return Response.json(
+      {
+        success: true,
+        data: {
+          user: currentUser,
+          accessKey: {
+            id: principal.accessKeyId,
+            name: principal.accessKeyName,
+            scopes: principal.scopes,
+          },
+        },
+      },
+      { headers: { "Cache-Control": "no-store" } }
+    );
+  } catch (error) {
+    return openApiErrorResponse(error);
+  }
+}

app/api/pick-object/route.ts

@@ -1,8 +1,14 @@
 import { NextResponse } from "next/server";
 import { auth } from "@/app/(auth)/auth";
 import { callQwen3Vl } from "@/lib/ai/qwen3-vl";
+import { getSystemSetting } from "@/lib/db/queries";
 import { createLogger } from "@/lib/observability/logger";
 import { uploadFile } from "@/lib/storage/service";
+import {
+  VIDEO_CANVAS_FUNCTION_CONFIG_KEY,
+  defaultVideoCanvasFunctionConfig,
+  normalizeVideoCanvasFunctionConfig,
+} from "@/lib/video-canvas/config";
 import sharp from "sharp";
 
 export const runtime = "nodejs";
@@ -21,10 +27,12 @@ interface PickObjectRequest {
   imageData: string;        // 带红色标记的图片 base64
   clickX: number;           // 点击位置 X (0-1)
   clickY: number;           // 点击位置 Y (0-1)
+  mode?: "object" | "video-canvas-mark";
 }
 
 interface PickObjectResult {
   name: string;
+  labels?: string[];
   position: string;
   confidence: number;
   boundingBox: {
@@ -119,7 +127,51 @@ async function uploadVisionAnalysisImage(buffer: Buffer, filenamePrefix: string)
   return uploaded.url;
 }
 
-async function normalizeImageInput(imageData: string): Promise<string> {
+async function prepareMarkedVisionAnalysisImage(
+  buffer: Buffer,
+  clickX: number,
+  clickY: number
+) {
+  const prepared = await downscaleImageForVision(buffer);
+  const metadata = await sharp(prepared.buffer, { failOn: "none" }).metadata();
+  const width = Math.max(1, metadata.width || prepared.width || MAX_VISION_SIDE);
+  const height = Math.max(1, metadata.height || prepared.height || MAX_VISION_SIDE);
+  const markerX = Math.max(0, Math.min(width, clickX * width));
+  const markerY = Math.max(0, Math.min(height, clickY * height));
+  const radius = Math.max(10, Math.min(width, height) * 0.025);
+  const overlay = Buffer.from(`
+    <svg width="${width}" height="${height}" xmlns="http://www.w3.org/2000/svg">
+      <circle cx="${markerX}" cy="${markerY}" r="${radius + 3}" fill="#fff" />
+      <circle cx="${markerX}" cy="${markerY}" r="${radius}" fill="#f00" />
+      <g stroke="#f00" stroke-width="2">
+        <line x1="${markerX - radius * 2}" y1="${markerY}" x2="${markerX - radius - 2}" y2="${markerY}" />
+        <line x1="${markerX + radius + 2}" y1="${markerY}" x2="${markerX + radius * 2}" y2="${markerY}" />
+        <line x1="${markerX}" y1="${markerY - radius * 2}" x2="${markerX}" y2="${markerY - radius - 2}" />
+        <line x1="${markerX}" y1="${markerY + radius + 2}" x2="${markerX}" y2="${markerY + radius * 2}" />
+      </g>
+    </svg>
+  `);
+  const composited = sharp(prepared.buffer, { failOn: "none" }).composite([
+    { input: overlay, left: 0, top: 0 },
+  ]);
+  const markedBuffer =
+    prepared.ext === "png"
+      ? await composited.png({ compressionLevel: 9 }).toBuffer()
+      : await composited.jpeg({ quality: 84, mozjpeg: true }).toBuffer();
+  logger.info("marked vision image prepared", {
+    clickX,
+    clickY,
+    outputBytes: markedBuffer.length,
+    outputExt: prepared.ext,
+  });
+  const mimeType = prepared.ext === "png" ? "image/png" : "image/jpeg";
+  return `data:${mimeType};base64,${markedBuffer.toString("base64")}`;
+}
+
+async function normalizeImageInput(
+  imageData: string,
+  options?: { clickX: number; clickY: number; markPoint: boolean }
+): Promise<string> {
   const raw = String(imageData || "").trim();
   if (!raw) throw new Error("缺少图片数据");
 
@@ -145,7 +197,10 @@ async function normalizeImageInput(imageData: string): Promise<string> {
       }
       const arrayBuffer = await response.arrayBuffer();
       ensureImageSizeAllowed(arrayBuffer.byteLength);
-      return uploadVisionAnalysisImage(Buffer.from(arrayBuffer), "pick-object-url");
+      const buffer = Buffer.from(arrayBuffer);
+      return options?.markPoint
+        ? prepareMarkedVisionAnalysisImage(buffer, options.clickX, options.clickY)
+        : uploadVisionAnalysisImage(buffer, "pick-object-url");
     } finally {
       clearTimeout(timeout);
     }
@@ -160,7 +215,9 @@ async function normalizeImageInput(imageData: string): Promise<string> {
   ensureImageSizeAllowed(Math.ceil((base64Body.length * 3) / 4));
   const buffer = Buffer.from(base64Body, "base64");
   ensureImageSizeAllowed(buffer.byteLength);
-  return uploadVisionAnalysisImage(buffer, "pick-object-base64");
+  return options?.markPoint
+    ? prepareMarkedVisionAnalysisImage(buffer, options.clickX, options.clickY)
+    : uploadVisionAnalysisImage(buffer, "pick-object-base64");
 }
 
 export async function POST(request: Request) {
@@ -174,7 +231,7 @@ export async function POST(request: Request) {
     }
 
     const body: PickObjectRequest = await request.json();
-    const { imageData, clickX, clickY } = body;
+    const { imageData, clickX, clickY, mode = "object" } = body;
     
     logger.info("request received", {
       imageDataLength: imageData?.length,
@@ -204,12 +261,34 @@ export async function POST(request: Request) {
       }, { status: 400 });
     }
     
-    const normalizedImage = await normalizeImageInput(imageData);
+    const normalizedImage = await normalizeImageInput(imageData, {
+      clickX,
+      clickY,
+      markPoint: mode === "video-canvas-mark",
+    });
 
     logger.info("vision model selected", { model: "qwen3-vl" });
     
-    // 构建 prompt - AI 通过红色标记来识别用户选择的物品
+    const videoCanvasConfig =
-    const prompt = `
+      mode === "video-canvas-mark"
+        ? normalizeVideoCanvasFunctionConfig(
+            (
+              await getSystemSetting({ key: VIDEO_CANVAS_FUNCTION_CONFIG_KEY }).catch(
+                () => null
+              )
+            )?.value || defaultVideoCanvasFunctionConfig
+          )
+        : null;
+    const elementMarkDefinition = videoCanvasConfig?.functions["element-mark"];
+    if (mode === "video-canvas-mark" && elementMarkDefinition?.enabled === false) {
+      return NextResponse.json(
+        { success: false, error: "视频元素标记功能当前未启用" },
+        { status: 403 }
+      );
+    }
+
+    // AI 通过红色标记识别用户点中的主体；视频画布规则来自系统设置。
+    const defaultObjectPrompt = `
 图片中有一个红色圆形标记（带十字线），请识别这个红色标记所指向的具体物品。
 
 【重要】
@@ -232,12 +311,24 @@ export async function POST(request: Request) {
 【position 格式】固定4字，从以下选择：
 ${POSITION_OPTIONS.join('、')}
 `.trim();
+    const prompt =
+      mode === "video-canvas-mark"
+        ? String(
+            elementMarkDefinition?.prompt ||
+              defaultVideoCanvasFunctionConfig.functions["element-mark"]?.prompt ||
+              defaultObjectPrompt
+          ).replaceAll("{{positionOptions}}", POSITION_OPTIONS.join("、"))
+        : defaultObjectPrompt;
 
     logger.info("vision model call started");
 
     // 调用视觉模型，发送带红色标记的图片
     const { text: responseText, model } = await callQwen3Vl({
       imageUrl: normalizedImage,
+      model:
+        mode === "video-canvas-mark"
+          ? elementMarkDefinition?.model || videoCanvasConfig?.defaultMultimodalModel
+          : undefined,
       prompt,
       temperature: 0.1,
       maxTokens: 300,
@@ -266,7 +357,17 @@ ${POSITION_OPTIONS.join('、')}
       const parsed = JSON.parse(jsonMatch[0]);
       
       // 验证和修正名称
-      let name = parsed.name || '物品';
+      const labels =
+        mode === "video-canvas-mark" && Array.isArray(parsed.labels)
+          ? Array.from(
+              new Set(
+                parsed.labels
+                  .map((item: unknown) => String(item || "").trim().slice(0, 8))
+                  .filter(Boolean)
+              )
+            ).slice(0, 4)
+          : [];
+      let name = labels[0] || parsed.name || '物品';
       if (name.length > 8) {
         name = name.substring(0, 6);
       }
@@ -292,6 +393,7 @@ ${POSITION_OPTIONS.join('、')}
       
       result = {
         name,
+        labels: mode === "video-canvas-mark" ? (labels.length ? labels : [name]) : undefined,
         position,
         confidence,
         boundingBox: { x: clickX, y: clickY, width: 0, height: 0 }, // 不再使用，保持兼容
@@ -312,6 +414,7 @@ ${POSITION_OPTIONS.join('、')}
       
       result = {
         name: '物品',
+        labels: mode === "video-canvas-mark" ? ['物品'] : undefined,
         position,
         confidence: 0.5,
         boundingBox: { x: clickX, y: clickY, width: 0, height: 0 },

app/api/scene-fusion/route.ts

@@ -25,6 +25,10 @@ import { createRuxaImage } from "@/lib/ai/providers/ruxa-image";
 import { createFalImage } from "@/lib/ai/providers/fal-image";
 import { createSnapgenImage } from "@/lib/ai/providers/snapgen-image";
 import { createOpenAIImage } from "@/lib/ai/providers/openai-image";
+import { createBananaImage } from "@/lib/ai/providers/bananaimage";
+import { createVisionary } from "@/lib/ai/providers/visionary";
+import { createAtlasCloud } from "@/lib/ai/providers/atlascloud";
+import { createVip98k } from "@/lib/ai/providers/vip98k";
 import { callQwen3Vl } from "@/lib/ai/qwen3-vl";
 import {
   canProcessSceneFusionProviderType,
@@ -1475,7 +1479,8 @@ async function processSceneWithProvider(
   modelId: string,
   runtimeModelId: string,
   aspectRatio?: string,
-  imageSize?: string
+  imageSize?: string,
+  imageGenConfig?: Record<string, any> | null
 ): Promise<{ thumbnail: string; original: string; prompt: string }> {
   // 构建智能提示词
   const prompt = buildPrompt(
@@ -1527,6 +1532,52 @@ async function processSceneWithProvider(
     case "openai-image":
       return processWithOpenAIImage(productImageUrl, sceneImageUrl, prompt, provider, modelId, aspectRatio, imageSize);
 
+    case "bananaimage":
+      return processWithBananaImage(
+        productImageUrl,
+        sceneImageUrl,
+        prompt,
+        provider,
+        runtimeModelId || modelId,
+        aspectRatio,
+        imageSize,
+      );
+
+    case "visionary":
+      return processWithVisionary(
+        productImageUrl,
+        sceneImageUrl,
+        prompt,
+        provider,
+        runtimeModelId || modelId,
+        aspectRatio,
+        imageSize,
+      );
+
+    case "atlascloud":
+      return processWithAtlasCloud(
+        productImageUrl,
+        sceneImageUrl,
+        prompt,
+        provider,
+        runtimeModelId || modelId,
+        aspectRatio,
+        imageSize,
+        imageGenConfig,
+      );
+
+    case "vip98k":
+      return processWithVip98k(
+        productImageUrl,
+        sceneImageUrl,
+        prompt,
+        provider,
+        runtimeModelId || modelId,
+        aspectRatio,
+        imageSize,
+        imageGenConfig,
+      );
+
     case "gemini":
     case "gemini-image":
       return processWithGemini(productImageUrl, sceneImageUrl, prompt, provider, modelId, aspectRatio, imageSize);
@@ -1782,6 +1833,158 @@ async function processWithOpenAIImage(
   return { thumbnail, original, prompt };
 }
 
+async function processWithBananaImage(
+  productImageUrl: string,
+  sceneImageUrl: string,
+  prompt: string,
+  provider: { baseUrl: string; apiKey: string },
+  modelId: string,
+  aspectRatio?: string,
+  imageSize?: string
+): Promise<{ thumbnail: string; original: string; prompt: string }> {
+  logger.info("provider_processing", { providerType: "bananaimage", modelId });
+
+  const bananaImageProvider = createBananaImage({
+    baseURL: provider.baseUrl,
+    apiKey: provider.apiKey,
+  });
+  const result = await bananaImageProvider.chat(modelId).doGenerate({
+    messages: [
+      {
+        role: "user",
+        content: [
+          { type: "image_url", image_url: { url: productImageUrl } },
+          { type: "image_url", image_url: { url: sceneImageUrl } },
+          { type: "text", text: prompt },
+        ],
+      },
+    ],
+    imageParams: {
+      aspectRatio: aspectRatio || "auto",
+      imageSize: imageSize || "2K",
+      imageCount: 1,
+    },
+  });
+
+  const { thumbnail, original } = parseImageFromMarkdown(result.text);
+  return { thumbnail, original, prompt };
+}
+
+async function processWithVisionary(
+  productImageUrl: string,
+  sceneImageUrl: string,
+  prompt: string,
+  provider: { baseUrl: string; apiKey: string },
+  modelId: string,
+  aspectRatio?: string,
+  imageSize?: string
+): Promise<{ thumbnail: string; original: string; prompt: string }> {
+  logger.info("provider_processing", { providerType: "visionary", modelId });
+
+  const visionaryProvider = createVisionary({
+    baseURL: provider.baseUrl,
+    apiKey: provider.apiKey,
+  });
+  const result = await visionaryProvider.chat(modelId).doGenerate({
+    messages: [
+      {
+        role: "user",
+        content: [
+          { type: "image_url", image_url: { url: productImageUrl } },
+          { type: "image_url", image_url: { url: sceneImageUrl } },
+          { type: "text", text: prompt },
+        ],
+      },
+    ],
+    imageParams: {
+      aspectRatio: aspectRatio || "auto",
+      imageSize: imageSize || "2K",
+      imageCount: 1,
+    },
+  });
+
+  const { thumbnail, original } = parseImageFromMarkdown(result.text);
+  return { thumbnail, original, prompt };
+}
+
+async function processWithAtlasCloud(
+  productImageUrl: string,
+  sceneImageUrl: string,
+  prompt: string,
+  provider: { baseUrl: string; apiKey: string },
+  modelId: string,
+  aspectRatio?: string,
+  imageSize?: string,
+  imageGenConfig?: Record<string, any> | null
+): Promise<{ thumbnail: string; original: string; prompt: string }> {
+  logger.info("provider_processing", { providerType: "atlascloud", modelId });
+
+  const atlasCloudProvider = createAtlasCloud({
+    baseURL: provider.baseUrl,
+    apiKey: provider.apiKey,
+  });
+  const result = await atlasCloudProvider.chat(modelId).doGenerate({
+    messages: [
+      {
+        role: "user",
+        content: [
+          { type: "image_url", image_url: { url: productImageUrl } },
+          { type: "image_url", image_url: { url: sceneImageUrl } },
+          { type: "text", text: prompt },
+        ],
+      },
+    ],
+    imageParams: {
+      aspectRatio: aspectRatio || "auto",
+      imageSize: imageSize || "2K",
+      imageCount: 1,
+    },
+    imageGenConfig,
+  });
+
+  const { thumbnail, original } = parseImageFromMarkdown(result.text);
+  return { thumbnail, original, prompt };
+}
+
+async function processWithVip98k(
+  productImageUrl: string,
+  sceneImageUrl: string,
+  prompt: string,
+  provider: { baseUrl: string; apiKey: string },
+  modelId: string,
+  aspectRatio?: string,
+  imageSize?: string,
+  imageGenConfig?: Record<string, any> | null
+): Promise<{ thumbnail: string; original: string; prompt: string }> {
+  logger.info("provider_processing", { providerType: "vip98k", modelId });
+
+  const vip98kProvider = createVip98k({
+    baseURL: provider.baseUrl,
+    apiKey: provider.apiKey,
+  });
+  const result = await vip98kProvider.chat(modelId, imageGenConfig || null).doGenerate({
+    messages: [
+      {
+        role: "user",
+        content: [
+          { type: "image_url", image_url: { url: productImageUrl } },
+          { type: "image_url", image_url: { url: sceneImageUrl } },
+          { type: "text", text: prompt },
+        ],
+      },
+    ],
+    imageParams: {
+      aspectRatio: aspectRatio || "auto",
+      imageSize: imageSize || "2K",
+      imageCount: 1,
+    },
+    imageGenConfig,
+  });
+
+  const { thumbnail, original } = parseImageFromMarkdown(result.text);
+  return { thumbnail, original, prompt };
+}
+
 /**
  * 使用既梦/火山模型处理
  */
@@ -2037,7 +2240,8 @@ async function processSceneWithDiversity(
           candidate.model.modelId,
           runtimeModelId,
           normalizedOutputParams.aspectRatio,
-          normalizedOutputParams.imageSize
+          normalizedOutputParams.imageSize,
+          (candidate.model.imageGenConfig as Record<string, any> | null) || null
         );
       } finally {
         await modelSlot.release();

app/api/site-settings/route.ts

@@ -579,6 +579,10 @@ const HOME_SITE_SETTINGS_FALLBACK: Record<string, unknown> = {
   favicon: null,
   lovartPromoText: "现在升级，立享 Kling 3.0 与 Nano Banana Pro，最高 5 折优惠",
   lovartPromoActionText: "立即升级",
+  bannerEnabled: true,
+  bannerText: "限时特惠：升级会员最高立享 45% OFF!",
+  bannerLink: null,
+  bannerActionText: "立即查看",
   lovartHeroTitle: "由壹点AI 让设计更简单",
   lovartHeroSubtitle: "懂你的设计代理，帮你搞定一切",
   surpriseCategories: ["全部", "精选"],
@@ -897,6 +901,7 @@ async function getScopedPublicSiteSettings(
       bannerText:
         typedSettings?.bannerText || "限时特惠：升级会员最高立享 45% OFF!",
       bannerLink: typedSettings?.bannerLink || null,
+      bannerActionText: typedSettings?.bannerActionText || "立即查看",
       lovartComposerPrefix: normalizeLovartComposerPrefix(
         valueByKey.get(LOVART_COMPOSER_PREFIX_KEY)
       ),
@@ -939,6 +944,11 @@ async function getScopedPublicSiteSettings(
 
   return createScopedSiteSettingsResponse(scope, {
     ...createBrandingSettings(typedSettings),
+    bannerEnabled: typedSettings?.bannerEnabled ?? true,
+    bannerText:
+      typedSettings?.bannerText || "限时特惠：升级会员最高立享 45% OFF!",
+    bannerLink: typedSettings?.bannerLink || null,
+    bannerActionText: typedSettings?.bannerActionText || "立即查看",
     lovartPromoText:
       typedSettings?.lovartPromoText ||
       "现在升级，立享 Kling 3.0 与 Nano Banana Pro，最高 5 折优惠",
@@ -1010,6 +1020,32 @@ export async function GET(request: NextRequest) {
   try {
     const startedAt = Date.now();
     const scope = request.nextUrl.searchParams.get("scope") || "";
+    const isLocalCanvasE2E = process.env.CANVAS_E2E_LOCAL === "true";
+
+    if (
+      isLocalCanvasE2E &&
+      PUBLIC_SITE_SETTINGS_SCOPES.has(scope)
+    ) {
+      const scopedScope = scope as PublicSiteSettingsScope;
+      const data =
+        scopedScope === "branding"
+          ? createBrandingSettings(undefined)
+          : {
+              ...HOME_SITE_SETTINGS_FALLBACK,
+              canvasEnabled: true,
+              realtimeCanvasEnabled: true,
+              videoCanvasEnabled: true,
+            };
+
+      return createScopedSiteSettingsResponse(
+        scopedScope,
+        data,
+        "FALLBACK",
+        `local-e2e:${scopedScope}`,
+        { fallback: true, startedAt }
+      );
+    }
+
     if (PUBLIC_SITE_SETTINGS_SCOPES.has(scope)) {
       const scopedScope = scope as PublicSiteSettingsScope;
       const brandName =
@@ -1444,6 +1480,7 @@ export async function GET(request: NextRequest) {
         bannerEnabled: true,
         bannerText: "限时特惠：升级会员最高立享 45% OFF!",
         bannerLink: null,
+        bannerActionText: "立即查看",
         toolbox1Name: "工具箱",
         toolbox1Enabled: true,
         toolbox2Name: "工具箱2",
@@ -1625,6 +1662,7 @@ const updateSchema = z.object({
   bannerEnabled: z.boolean().optional(),
   bannerText: z.string().optional(),
   bannerLink: z.string().nullable().optional(),
+  bannerActionText: z.string().max(32).optional(),
   toolbox1Name: z.string().max(64).optional(),
   toolbox1Enabled: z.boolean().optional(),
   toolbox2Name: z.string().max(64).optional(),
@@ -3085,6 +3123,7 @@ export async function PUT(request: NextRequest) {
           bannerEnabled: siteSettingsPayload.bannerEnabled ?? true,
           bannerText: siteSettingsPayload.bannerText ?? "限时特惠：升级会员最高立享 45% OFF!",
           bannerLink: siteSettingsPayload.bannerLink,
+          bannerActionText: siteSettingsPayload.bannerActionText ?? "立即查看",
           toolbox1Name: siteSettingsPayload.toolbox1Name ?? "工具箱",
           toolbox1Enabled: siteSettingsPayload.toolbox1Enabled ?? true,
           toolbox2Name: siteSettingsPayload.toolbox2Name ?? "工具箱2",

app/api/style-pro/model-options/route.ts

@@ -1,7 +1,7 @@
 import { NextResponse } from "next/server";
 import { auth } from "@/app/(auth)/auth";
 import { getModelGenerationCreditCost } from "@/lib/ai/image-model-pricing";
-import { getSystemSetting } from "@/lib/db/queries";
+import { getSystemSetting, getUserById } from "@/lib/db/queries";
 import {
   findStyleProImageModelByRef,
   getStyleProImageModelDisplayEntries,
@@ -26,10 +26,16 @@ export async function GET() {
       );
     }
 
+    const currentUser = await getUserById({ id: session.user.id });
+    const allowHiddenModels =
+      session.user.type === "admin" || Boolean(currentUser?.isHighVip);
+
     const [displayEntries, entries, realisticModelEntries, setting] =
       await Promise.all([
-        getStyleProImageModelDisplayEntries({ includeHidden: false }),
+        getStyleProImageModelDisplayEntries({
-        getStyleProImageModelEntries({ includeHidden: false }),
+          includeHidden: allowHiddenModels,
+        }),
+        getStyleProImageModelEntries({ includeHidden: allowHiddenModels }),
         getStyleProImageModelEntries({ includeHidden: true }),
         getSystemSetting({ key: STYLE_PRO_CONFIG_KEY }).catch(() => null),
       ]);

app/api/user/access-keys/[id]/route.ts

@@ -0,0 +1,40 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { auth } from "@/app/(auth)/auth";
+import { revokeUserAccessKey } from "@/lib/access-keys/service";
+
+const idSchema = z.string().uuid();
+
+export async function DELETE(
+  _request: Request,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const session = await auth();
+  if (!session?.user?.id || session.user.type === "guest") {
+    return NextResponse.json(
+      { success: false, error: "请先登录正式账号" },
+      { status: 401 }
+    );
+  }
+
+  const parsedId = idSchema.safeParse((await params).id);
+  if (!parsedId.success) {
+    return NextResponse.json(
+      { success: false, error: "Access Key ID 无效" },
+      { status: 400 }
+    );
+  }
+
+  const revoked = await revokeUserAccessKey({
+    userId: session.user.id,
+    accessKeyId: parsedId.data,
+  });
+  if (!revoked) {
+    return NextResponse.json(
+      { success: false, error: "Access Key 不存在" },
+      { status: 404 }
+    );
+  }
+
+  return NextResponse.json({ success: true });
+}

app/api/user/access-keys/route.ts

@@ -0,0 +1,76 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { auth } from "@/app/(auth)/auth";
+import {
+  createUserAccessKey,
+  listUserAccessKeys,
+} from "@/lib/access-keys/service";
+
+const createAccessKeySchema = z.object({
+  name: z.string().trim().min(1).max(100).optional(),
+  scopes: z
+    .array(z.enum(["canvas:read", "canvas:write"]))
+    .min(1)
+    .optional(),
+  expiresInDays: z.number().int().min(1).max(365).optional(),
+});
+
+export async function GET() {
+  const session = await auth();
+  if (!session?.user?.id || session.user.type === "guest") {
+    return NextResponse.json(
+      { success: false, error: "请先登录正式账号" },
+      { status: 401 }
+    );
+  }
+
+  const keys = await listUserAccessKeys(session.user.id);
+  return NextResponse.json(
+    { success: true, data: keys },
+    { headers: { "Cache-Control": "no-store" } }
+  );
+}
+
+export async function POST(request: Request) {
+  const session = await auth();
+  if (!session?.user?.id || session.user.type === "guest") {
+    return NextResponse.json(
+      { success: false, error: "请先登录正式账号" },
+      { status: 401 }
+    );
+  }
+
+  const existingKeys = await listUserAccessKeys(session.user.id);
+  const activeKeyCount = existingKeys.filter(
+    (item) =>
+      !item.revokedAt &&
+      (!item.expiresAt || new Date(item.expiresAt).getTime() > Date.now())
+  ).length;
+  if (activeKeyCount >= 10) {
+    return NextResponse.json(
+      { success: false, error: "最多保留 10 个有效 Access Key" },
+      { status: 409 }
+    );
+  }
+
+  try {
+    const body = createAccessKeySchema.parse(
+      await request.json().catch(() => ({}))
+    );
+    const created = await createUserAccessKey({
+      userId: session.user.id,
+      name: body?.name,
+      scopes: body?.scopes,
+      expiresInDays: body?.expiresInDays,
+    });
+    return NextResponse.json({ success: true, data: created }, { status: 201 });
+  } catch (error) {
+    return NextResponse.json(
+      {
+        success: false,
+        error: error instanceof Error ? error.message : "创建 Access Key 失败",
+      },
+      { status: 400 }
+    );
+  }
+}

app/api/user/membership-summary/route.ts

@@ -17,12 +17,35 @@ import {
   normalizeMembershipUserOverrides,
   resolveMembershipPlanIdForUser,
 } from "@/lib/membership/config";
+import { defaultPointsSystemConfig } from "@/lib/points/config";
 
 const MEMBERSHIP_CONFIG_KEY = "membership_config";
 const MEMBERSHIP_USER_OVERRIDES_KEY = "membership_user_plan_overrides";
 
 export async function GET() {
   try {
+    const isLocalCanvasE2E = process.env.CANVAS_E2E_LOCAL === "true";
+
+    if (isLocalCanvasE2E) {
+      const currentPlan = getMembershipPlanById(defaultMembershipConfig, "pro");
+      return NextResponse.json({
+        config: defaultMembershipConfig,
+        pointsSystemConfig: defaultPointsSystemConfig,
+        isHighVip: true,
+        currentPlanId: currentPlan.id,
+        currentPlan,
+        summary: {
+          currentCredits: currentPlan.monthlyCredits,
+          dailyFreeCredits: currentPlan.dailyFreeCredits,
+          usedThisMonth: 0,
+          monthlyLimit: currentPlan.monthlyCredits,
+          remainingThisMonth: currentPlan.monthlyCredits,
+          totalImages: 0,
+        },
+        updatedAt: new Date().toISOString(),
+      });
+    }
+
     const session = await auth();
 
     if (!session?.user?.id) {

app/api/video-canvas/config/route.ts

@@ -8,6 +8,10 @@ import {
 export const dynamic = "force-dynamic";
 
 export async function GET() {
+  if (process.env.CANVAS_E2E_LOCAL === "true") {
+    return Response.json({ config: defaultVideoCanvasFunctionConfig });
+  }
+
   const setting = await getSystemSetting({ key: VIDEO_CANVAS_FUNCTION_CONFIG_KEY }).catch(() => null);
   const config = setting?.value
     ? normalizeVideoCanvasFunctionConfig(setting.value)

app/api/watermark-remove/route.ts

@@ -12,6 +12,10 @@ import {
 } from "@/lib/db/queries";
 import { prepareFeaturePointsCharge } from "@/lib/points/feature-charge";
 import { getImageToolCreditCost } from "@/lib/points/config";
+import { generateCanvasImage } from "@/lib/canvas/generate-image";
+import { FAL_NANO_BANANA_2_EDIT_MODEL_ID } from "@/lib/ai/fal-image-models";
+
+export const maxDuration = 600;
 
 // PicWish API 需要公网可访问的 HTTP/HTTPS URL
 const WATERMARK_SYNC_WAIT_TIMEOUT_MS = 20_000;
@@ -115,11 +119,10 @@ function buildWatermarkTaskPendingResponse(taskId: string) {
   );
 }
 
-async function finalizeWatermarkTaskResult(params: {
+async function persistWatermarkResult(params: {
-  taskId: string;
+  processedImageUrl: string;
   userId: string;
   startedAt?: number;
-  apiKey: string;
   sourceImageUrls?: string[];
 }): Promise<{
   success: boolean;
@@ -127,17 +130,8 @@ async function finalizeWatermarkTaskResult(params: {
   thumbnail_url: string;
   processing_time?: number;
 }> {
-  const pollResult = await pollForResult(params.taskId, params.apiKey, WATERMARK_SYNC_WAIT_TIMEOUT_MS);
-  if (pollResult.pending) {
-    throw new Error("WATERMARK_TASK_PENDING");
-  }
-  if (!pollResult.success || !pollResult.imageUrl) {
-    throw new Error(pollResult.error || "去水印处理失败");
-  }
-
-  const processedImageUrl = pollResult.imageUrl;
   try {
-    const imageResponse = await fetch(processedImageUrl);
+    const imageResponse = await fetch(params.processedImageUrl);
     if (!imageResponse.ok) {
       throw new Error("下载处理后的图片失败");
     }
@@ -217,7 +211,7 @@ async function finalizeWatermarkTaskResult(params: {
           }
         }
       } catch (assetError) {
-        console.error("[WatermarkRemove] ⚠️ MediaAsset 注册失败:", assetError);
+        console.error("[WatermarkRemove] MediaAsset 注册失败:", assetError);
       }
     }
 
@@ -232,14 +226,85 @@ async function finalizeWatermarkTaskResult(params: {
     console.error("[WatermarkRemove] 上传结果失败，回退原始URL:", uploadError);
     return {
       success: true,
-      original_url: processedImageUrl,
+      original_url: params.processedImageUrl,
-      thumbnail_url: processedImageUrl,
+      thumbnail_url: params.processedImageUrl,
       processing_time:
         typeof params.startedAt === "number" ? (Date.now() - params.startedAt) / 1000 : undefined,
     };
   }
 }
 
+function shouldUseFalWatermarkFallback(status: number, detail: string) {
+  return (
+    status === 401 ||
+    status === 402 ||
+    status === 403 ||
+    status === 429 ||
+    status >= 500 ||
+    /quota|credit|balance|exceed|expired|invalid|unauthor/i.test(detail)
+  );
+}
+
+async function removeWatermarkWithFal(params: {
+  imageUrl: string;
+  userId: string;
+  startedAt: number;
+  sourceImageUrls?: string[];
+}) {
+  console.warn("[WatermarkRemove] AOS unavailable; using FAL Nano Banana 2 edit fallback");
+  const result = await generateCanvasImage({
+    prompt: [
+      "仅移除图片中后期叠加的水印、平台角标和覆盖式文字标记。",
+      "必须完整保留原图主体、商品、背景、构图、尺寸、颜色、光影和清晰度。",
+      "用周围真实纹理自然补全被遮挡区域，不得新增文字、标志或其他物体。",
+    ].join(""),
+    model: FAL_NANO_BANANA_2_EDIT_MODEL_ID,
+    aspectRatio: "auto",
+    imageSize: "2K",
+    imageCount: 1,
+    referenceImages: [params.imageUrl],
+    allowFailover: false,
+    debugLabel: "watermark-remove-fal-fallback",
+  });
+  const processedImageUrl = result.images[0]?.originalUrl;
+  if (!processedImageUrl) {
+    throw new Error("FAL 去水印未返回可用图片");
+  }
+  return persistWatermarkResult({
+    processedImageUrl,
+    userId: params.userId,
+    startedAt: params.startedAt,
+    sourceImageUrls: params.sourceImageUrls,
+  });
+}
+
+async function finalizeWatermarkTaskResult(params: {
+  taskId: string;
+  userId: string;
+  startedAt?: number;
+  apiKey: string;
+  sourceImageUrls?: string[];
+}): Promise<{
+  success: boolean;
+  original_url: string;
+  thumbnail_url: string;
+  processing_time?: number;
+}> {
+  const pollResult = await pollForResult(params.taskId, params.apiKey, WATERMARK_SYNC_WAIT_TIMEOUT_MS);
+  if (pollResult.pending) {
+    throw new Error("WATERMARK_TASK_PENDING");
+  }
+  if (!pollResult.success || !pollResult.imageUrl) {
+    throw new Error(pollResult.error || "去水印处理失败");
+  }
+  return persistWatermarkResult({
+    processedImageUrl: pollResult.imageUrl,
+    userId: params.userId,
+    startedAt: params.startedAt,
+    sourceImageUrls: params.sourceImageUrls,
+  });
+}
+
 export async function GET(request: NextRequest) {
   try {
     const session = await auth();
@@ -306,13 +371,6 @@ export async function POST(request: NextRequest) {
 
     // 获取API配置
     const config = await getWatermarkRemoveConfig();
-    if (!config?.apiKey) {
-      return NextResponse.json(
-        { error: "去水印服务未配置，请联系管理员在系统设置中配置API密钥" },
-        { status: 500 }
-      );
-    }
-
     console.log("[WatermarkRemove] 使用原图URL:", image_url.substring(0, 100) + "...");
 
     // 处理图片URL，确保获取公网可访问的URL
@@ -396,6 +454,24 @@ export async function POST(request: NextRequest) {
       return NextResponse.json(pointsCharge.payload, { status: pointsCharge.status });
     }
 
+    const sourceImageUrls =
+      typeof image_url === "string" && /^https?:\/\//i.test(image_url)
+        ? [image_url]
+        : undefined;
+
+    if (!config?.apiKey) {
+      const fallbackResult = await removeWatermarkWithFal({
+        imageUrl: publicImageUrl,
+        userId: session.user.id,
+        startedAt: startTime,
+        sourceImageUrls,
+      });
+      if (pointsCharge.chargeable) {
+        await pointsCharge.consume({ note: "FAL 去水印备用链路消耗积分" });
+      }
+      return NextResponse.json(fallbackResult);
+    }
+
     // 创建去水印任务
     const formData = new FormData();
     formData.append("sync", "0");
@@ -415,8 +491,24 @@ export async function POST(request: NextRequest) {
     if (!createResponse.ok) {
       const errorText = await createResponse.text();
       console.error("[WatermarkRemove] 创建任务失败:", errorText);
+      if (shouldUseFalWatermarkFallback(createResponse.status, errorText)) {
+        try {
+          const fallbackResult = await removeWatermarkWithFal({
+            imageUrl: publicImageUrl,
+            userId: session.user.id,
+            startedAt: startTime,
+            sourceImageUrls,
+          });
+          if (pointsCharge.chargeable) {
+            await pointsCharge.consume({ note: "FAL 去水印备用链路消耗积分" });
+          }
+          return NextResponse.json(fallbackResult);
+        } catch (fallbackError) {
+          console.error("[WatermarkRemove] FAL 备用链路失败:", fallbackError);
+        }
+      }
       return NextResponse.json(
-        { error: "创建去水印任务失败" },
+        { error: "去水印服务暂时不可用，请稍后重试" },
         { status: 500 }
       );
     }
@@ -448,10 +540,7 @@ export async function POST(request: NextRequest) {
         userId: session.user.id,
         startedAt: startTime,
         apiKey: config.apiKey,
-        sourceImageUrls:
+        sourceImageUrls,
-          typeof image_url === "string" && /^https?:\/\//i.test(image_url)
-            ? [image_url]
-            : undefined,
       });
       return NextResponse.json(result);
     } catch (error) {

app/canvas/[id]/CanvasEditorLegacyPageClient.tsx

@@ -141,6 +141,7 @@ import {
   createEmptyAgentGenerationProjectWorkspaceState,
   createEmptyAgentWorkflowPersistedState,
   normalizeAgentGenerationProjectPersistedState,
+  normalizeAgentGenerationProjectReplacementResultState,
 } from "@/lib/agents/generation-project-state";
 import {
   createEmptyAgentModeWorkspaceState,
@@ -191,6 +192,11 @@ import {
   getAgentWorkflowPageFeatureSettings,
   sanitizeAgentWorkflowSelections,
 } from "@/lib/agents/workflow-ui-config";
+import {
+  loadCanvasChatPanelModule,
+  preloadCanvasChatPanel,
+} from "@/components/canvas/canvas-chat-panel-loader";
+import { preloadCanvasChatData } from "@/lib/client/canvas-chat-preload";
 import { cn, fetcher } from "@/lib/utils";
 import {
   buildVideoWorkflowCanvasNode,
@@ -227,6 +233,7 @@ import { canvasSelectors, useCanvasStore } from "@/store/canvas";
 import type {
   AgentGenerationProject,
   AgentGenerationProjectPersistedState,
+  AgentGenerationProjectReplacementResultState,
   AgentGenerationProjectResultCollections,
   AgentGenerationProjectWorkspaceAttachment,
   AgentGenerationProjectWorkspaceState,
@@ -311,7 +318,7 @@ const CanvasWorkspace = dynamic(
 
 const CanvasChatPanel = dynamic(
   () =>
-    import("@/components/canvas/CanvasChatPanel").then(
+    loadCanvasChatPanelModule().then(
       (module) => module.CanvasChatPanel
     ),
   {
@@ -1540,6 +1547,57 @@ function normalizeResultCollectionUrls(urls: string[] | undefined | null) {
   );
 }
 
+function areReplacementResultStatesEqual(
+  left: AgentGenerationProjectReplacementResultState | undefined | null,
+  right: AgentGenerationProjectReplacementResultState | undefined | null
+) {
+  return (
+    JSON.stringify(normalizeAgentGenerationProjectReplacementResultState(left)) ===
+    JSON.stringify(normalizeAgentGenerationProjectReplacementResultState(right))
+  );
+}
+
+function getReplacementResultUrlCount(
+  state: AgentGenerationProjectPersistedState | undefined | null
+) {
+  const normalized = normalizeAgentGenerationProjectReplacementResultState(
+    state?.replacementResultState
+  );
+  return (
+    Object.values(normalized.detail_replacement || {}).filter((record) =>
+      Boolean(record.url)
+    ).length +
+    Object.values(normalized.sku_replacement || {}).filter((record) =>
+      Boolean(record.url)
+    ).length
+  );
+}
+
+function hasReplacementResultCollectionMismatch(
+  state: AgentGenerationProjectPersistedState | undefined | null
+) {
+  const normalized = normalizeAgentGenerationProjectReplacementResultState(
+    state?.replacementResultState
+  );
+  const resultCollections = state?.resultCollections || {};
+  const countModeRecords = (
+    modeType: "detail_replacement" | "sku_replacement"
+  ) =>
+    Object.values(normalized[modeType] || {}).filter((record) =>
+      Boolean(record.url)
+    ).length;
+  const countModeCollection = (
+    modeType: "detail_replacement" | "sku_replacement"
+  ) => normalizeResultCollectionUrls(resultCollections[modeType]).length;
+
+  return (["detail_replacement", "sku_replacement"] as const).some(
+    (modeType) => {
+      const recordCount = countModeRecords(modeType);
+      return recordCount > 0 && countModeCollection(modeType) !== recordCount;
+    }
+  );
+}
+
 const AGENT_PROJECT_DRAFT_STORAGE_KEY_PREFIX = "agent-project-draft:";
 
 function getAgentProjectDraftStorageKey(projectId: string) {
@@ -1976,7 +2034,7 @@ export default function CanvasEditorLegacyPage({
   );
   const [activeWorkflowExecutionTaskKey, setActiveWorkflowExecutionTaskKey] =
     useState<string | null>(null);
-  const [isPanelOpen, setIsPanelOpen] = useState(() => !isVideoMode);
+  const [isPanelOpen, setIsPanelOpen] = useState(true);
   const [floatingPanelWidth, setFloatingPanelWidth] =
     useState(FLOATING_PANEL_WIDTH);
   const [
@@ -2009,6 +2067,7 @@ export default function CanvasEditorLegacyPage({
     useState(false);
   // 面板模式: 'chat' 聊天面板, 'fileList' 文件列表
   const [panelMode, setPanelMode] = useState<"chat" | "fileList">("chat");
+  const chatPanelCanvasIdRef = useRef<string | null>(null);
   const [viewportWidth, setViewportWidth] = useState(0);
   const [horizontalFloatingToolbarWidth, setHorizontalFloatingToolbarWidth] =
     useState(0);
@@ -2032,6 +2091,16 @@ export default function CanvasEditorLegacyPage({
     Partial<Record<AgentWorkflowStepKey, string>>
   >({});
 
+  useLayoutEffect(() => {
+    if (!id || isVideoMode || chatPanelCanvasIdRef.current === id) {
+      return;
+    }
+
+    chatPanelCanvasIdRef.current = id;
+    setPanelMode("chat");
+    setIsPanelOpen(true);
+  }, [id, isVideoMode]);
+
   useEffect(() => {
     if (!isVideoMode) {
       setVideoCanvasInsertMenu(null);
@@ -2077,6 +2146,10 @@ export default function CanvasEditorLegacyPage({
     agentProjectDeletedResultCollections,
     setAgentProjectDeletedResultCollections,
   ] = useState<AgentGenerationProjectResultCollections>({});
+  const [
+    agentProjectReplacementResultState,
+    setAgentProjectReplacementResultState,
+  ] = useState<AgentGenerationProjectReplacementResultState>({});
   const [isAgentProjectLoading, setIsAgentProjectLoading] = useState(false);
   const [loadedAgentProjectId, setLoadedAgentProjectId] = useState<
     string | null
@@ -2167,6 +2240,9 @@ export default function CanvasEditorLegacyPage({
   const [aspectRatio, setAspectRatio] = useState("auto");
   const [imageCount, setImageCount] = useState(1);
   const previousNodeIdsRef = useRef<Set<string>>(new Set());
+  const lastLocalCanvasMutationAtRef = useRef(0);
+  const externalCanvasConflictRef = useRef(false);
+  const externalCanvasConflictNotifiedRef = useRef(false);
   const previousBrandForModelRef = useRef("");
   const autoSelectedBrandModelBrandRef = useRef("");
   const autoTitleAttemptedRef = useRef<Set<string>>(new Set());
@@ -3279,6 +3355,15 @@ export default function CanvasEditorLegacyPage({
     };
   }, [checkCanvasAuthSession]);
 
+  useEffect(() => {
+    preloadCanvasChatPanel();
+    preloadCanvasChatData(id);
+
+    return scheduleCanvasIdleTask(() => {
+      void import("@/components/canvas/CanvasFileListPanel");
+    }, 700);
+  }, [id]);
+
   useEffect(() => {
     const timeoutId = window.setTimeout(() => {
       setAreSecondaryPanelsReady(true);
@@ -3288,6 +3373,8 @@ export default function CanvasEditorLegacyPage({
 
   const hydrateCanvasProject = useCallback(
     (project: CanvasInitialProject) => {
+      externalCanvasConflictRef.current = false;
+      externalCanvasConflictNotifiedRef.current = false;
       useCanvasStore.getState().setProject(id, project.title);
       const projectUpdatedAt = String(project.updatedAt || "");
       useCanvasStore
@@ -3449,6 +3536,7 @@ export default function CanvasEditorLegacyPage({
         setAgentProjectThumbnail(null);
         setAgentProjectResultCollections({});
         setAgentProjectDeletedResultCollections({});
+        setAgentProjectReplacementResultState({});
         setLoadedAgentProjectId(null);
       }
 
@@ -3940,8 +4028,15 @@ export default function CanvasEditorLegacyPage({
           ...resultCollections.sku_replacement,
         ])
       ),
+      replacementResultState: normalizeAgentGenerationProjectReplacementResultState(
+        agentProjectReplacementResultState
+      ),
     };
-  }, [agentProjectDeletedResultCollections, agentProjectResultCollections]);
+  }, [
+    agentProjectDeletedResultCollections,
+    agentProjectReplacementResultState,
+    agentProjectResultCollections,
+  ]);
 
   const buildPersistedAgentProjectState = useCallback(() => {
     const persistedMaterials = appearanceRecognitionEnabled
@@ -4126,6 +4221,9 @@ export default function CanvasEditorLegacyPage({
       setAgentProjectDeletedResultCollections(
         persistedState.deletedResultCollections || {}
       );
+      setAgentProjectReplacementResultState(
+        persistedState.replacementResultState || {}
+      );
       setLoadedAgentProjectId(params.projectId);
     },
     []
@@ -4300,7 +4398,9 @@ export default function CanvasEditorLegacyPage({
       const result = await agentProjectService.updateProject(agentProjectId, {
         title: nextTitle,
         thumbnail: agentProjectThumbnail,
-        projectState: buildPersistedAgentProjectState(),
+        projectState:
+          persistedAgentProjectStateRef.current ||
+          buildPersistedAgentProjectState(),
       });
 
       if (!result.success) {
@@ -4366,9 +4466,27 @@ export default function CanvasEditorLegacyPage({
 
         const serverUpdatedAt =
           Number(new Date(result.data.updatedAt).getTime()) || 0;
+        const serverReplacementResultCount = getReplacementResultUrlCount(
+          result.data.projectState
+        );
+        const localReplacementResultCount = getReplacementResultUrlCount(
+          localDraft?.projectState
+        );
+        const localDraftMissesServerReplacementResults =
+          serverReplacementResultCount > 0 && localReplacementResultCount === 0;
+        const localDraftReplacementResultsDifferFromServer =
+          serverReplacementResultCount > 0 &&
+          localReplacementResultCount > 0 &&
+          localReplacementResultCount !== serverReplacementResultCount;
+        const localDraftHasStaleReplacementCollections =
+          serverReplacementResultCount > 0 &&
+          hasReplacementResultCollectionMismatch(localDraft?.projectState);
         const shouldUseLocalDraft =
           Boolean(localDraft?.projectState) &&
-          Number(localDraft?.savedAt || 0) > serverUpdatedAt;
+          Number(localDraft?.savedAt || 0) > serverUpdatedAt &&
+          !localDraftMissesServerReplacementResults &&
+          !localDraftReplacementResultsDifferFromServer &&
+          !localDraftHasStaleReplacementCollections;
 
         if (shouldUseLocalDraft && localDraft?.projectState) {
           hydrateAgentProjectSnapshot({
@@ -4470,6 +4588,7 @@ export default function CanvasEditorLegacyPage({
   }, [
     agentModeState,
     agentProjectId,
+    agentProjectReplacementResultState,
     agentProjectResultCollections,
     agentProjectThumbnail,
     agentProjectTitle,
@@ -4760,36 +4879,70 @@ export default function CanvasEditorLegacyPage({
   const handleAgentResultPreviewUrlsChange = useCallback(
     (modeType: AgentGenerationResultModeType, urls: string[]) => {
       const normalizedUrls = normalizeResultCollectionUrls(urls);
-      setAgentProjectResultCollections((current) => {
+      const currentProjectState =
-        const nextCollections: AgentGenerationProjectResultCollections = {
+        persistedAgentProjectStateRef.current ||
-          ...current,
+        createEmptyAgentGenerationProjectPersistedState();
-          [modeType]: normalizedUrls,
+      const currentCollections = currentProjectState.resultCollections || {};
-        };
+      const nextCollections: AgentGenerationProjectResultCollections = {
-
+        ...currentCollections,
-        if (areResultCollectionsEqual(current, nextCollections)) {
+        [modeType]: normalizedUrls,
-          return current;
+      };
-        }
 
+      if (!areResultCollectionsEqual(currentCollections, nextCollections)) {
         const nextProjectState: AgentGenerationProjectPersistedState = {
-          ...persistedAgentProjectStateRef.current,
+          ...currentProjectState,
           resultCollections: nextCollections,
           resultImageUrls: getAllResultUrlsFromCollections(nextCollections),
         };
         persistedAgentProjectStateRef.current = nextProjectState;
         writeAgentProjectDraftSnapshot(nextProjectState);
+      }
 
-        setAgentProjectThumbnail((currentThumbnail) => {
+      setAgentProjectResultCollections((current) =>
-          const nextThumbnail =
+        areResultCollectionsEqual(current, nextCollections)
-            normalizedUrls[0] || getFirstResultUrlFromCollections(nextCollections);
+          ? current
-          return currentThumbnail === nextThumbnail ? currentThumbnail : nextThumbnail;
+          : nextCollections
-        });
+      );
-
+      setAgentProjectThumbnail((currentThumbnail) => {
-        return nextCollections;
+        const nextThumbnail =
+          normalizedUrls[0] || getFirstResultUrlFromCollections(nextCollections);
+        return currentThumbnail === nextThumbnail ? currentThumbnail : nextThumbnail;
       });
     },
     [writeAgentProjectDraftSnapshot]
   );
 
+  const handleAgentReplacementResultStateChange = useCallback(
+    (nextState: AgentGenerationProjectReplacementResultState) => {
+      const normalizedState =
+        normalizeAgentGenerationProjectReplacementResultState(nextState);
+
+      const currentProjectState =
+        persistedAgentProjectStateRef.current ||
+        createEmptyAgentGenerationProjectPersistedState();
+      if (
+        !areReplacementResultStatesEqual(
+          currentProjectState.replacementResultState,
+          normalizedState
+        )
+      ) {
+        const nextProjectState: AgentGenerationProjectPersistedState = {
+          ...currentProjectState,
+          replacementResultState: normalizedState,
+        };
+        persistedAgentProjectStateRef.current = nextProjectState;
+        writeAgentProjectDraftSnapshot(nextProjectState);
+      }
+
+      setAgentProjectReplacementResultState((current) =>
+        areReplacementResultStatesEqual(current, normalizedState)
+          ? current
+          : normalizedState
+      );
+    },
+    [writeAgentProjectDraftSnapshot]
+  );
+
   const handleAgentResultImageDelete = useCallback(
     (modeType: AgentGenerationResultModeType, imageUrl: string) => {
       const normalizedUrl = String(imageUrl || "").trim();
@@ -4823,6 +4976,33 @@ export default function CanvasEditorLegacyPage({
           ? current
           : nextDeletedCollections
       );
+      if (modeType === "detail_replacement" || modeType === "sku_replacement") {
+        setAgentProjectReplacementResultState((current) => {
+          const normalizedState =
+            normalizeAgentGenerationProjectReplacementResultState(current);
+          const currentModeState = normalizedState[modeType] || {};
+          const nextModeState = Object.fromEntries(
+            Object.entries(currentModeState).filter(
+              ([, record]) => record.url !== normalizedUrl
+            )
+          );
+          const nextState: AgentGenerationProjectReplacementResultState = {
+            ...normalizedState,
+            [modeType]: nextModeState,
+          };
+          if (areReplacementResultStatesEqual(normalizedState, nextState)) {
+            return current;
+          }
+
+          const nextProjectState: AgentGenerationProjectPersistedState = {
+            ...persistedAgentProjectStateRef.current,
+            replacementResultState: nextState,
+          };
+          persistedAgentProjectStateRef.current = nextProjectState;
+          writeAgentProjectDraftSnapshot(nextProjectState);
+          return nextState;
+        });
+      }
       setAgentProjectThumbnail((current) => {
         const nextThumbnail =
           current === normalizedUrl
@@ -4831,7 +5011,11 @@ export default function CanvasEditorLegacyPage({
         return current === nextThumbnail ? current : nextThumbnail;
       });
     },
-    [agentProjectDeletedResultCollections, agentProjectResultCollections]
+    [
+      agentProjectDeletedResultCollections,
+      agentProjectResultCollections,
+      writeAgentProjectDraftSnapshot,
+    ]
   );
 
   useEffect(() => {
@@ -4904,12 +5088,19 @@ export default function CanvasEditorLegacyPage({
       if (!result.success) {
         console.error(`[Canvas] ${reason} save failed:`, result.error);
         if (result.status === 409) {
+          externalCanvasConflictRef.current = true;
           console.warn("[Canvas] stale save revision handled without user prompt", {
             reason,
             canvasUpdatedAt: result.canvasUpdatedAt,
           });
+          if (!externalCanvasConflictNotifiedRef.current) {
+            externalCanvasConflictNotifiedRef.current = true;
+            toast.warning("画布已被外部操作更新，本地改动未覆盖远端；请刷新后继续编辑");
+          }
         }
       } else if (result.data?.updatedAt) {
+        externalCanvasConflictRef.current = false;
+        externalCanvasConflictNotifiedRef.current = false;
         useCanvasStore
           .getState()
           .setCanvasRevision(String(result.data.updatedAt), String(result.data.updatedAt));
@@ -4936,6 +5127,70 @@ export default function CanvasEditorLegacyPage({
     return () => clearTimeout(saveTimer);
   }, [isAgentMode, isAgentOperationRefreshActive, nodes, isLoading, persistCanvasState]);
 
+  useEffect(() => {
+    if (isLoading || isAgentOperationRefreshActive()) return;
+    lastLocalCanvasMutationAtRef.current = Date.now();
+  }, [isLoading, isAgentOperationRefreshActive, nodes]);
+
+  useEffect(() => {
+    if (isLoading || isAgentMode) return;
+
+    let cancelled = false;
+    const refreshIfExternallyUpdated = async () => {
+      if (
+        cancelled ||
+        document.visibilityState !== "visible" ||
+        isSaving ||
+        externalCanvasConflictRef.current ||
+        Date.now() - lastLocalCanvasMutationAtRef.current < 5000
+      ) {
+        return;
+      }
+
+      try {
+        const revisionResponse = await fetch(`/api/canvas/${id}/revision`, {
+          cache: "no-store",
+        });
+        const revisionPayload = await revisionResponse.json().catch(() => ({}));
+        const remoteRevision = String(
+          revisionPayload?.data?.updatedAt || ""
+        ).trim();
+        const localRevision = String(
+          useCanvasStore.getState().canvasRevision || ""
+        ).trim();
+        if (
+          cancelled ||
+          !revisionResponse.ok ||
+          !remoteRevision ||
+          remoteRevision === localRevision
+        ) {
+          return;
+        }
+
+        const result = await canvasService.getProject(id);
+        if (cancelled || !result.success || !result.data) return;
+        useCanvasStore.getState().markAgentOperationRefresh();
+        hydrateCanvasProject(result.data);
+        lastLocalCanvasMutationAtRef.current = Date.now();
+        toast.success("已同步 OpenClaw 的画布操作");
+      } catch (error) {
+        console.error("[Canvas] external operation refresh failed:", error);
+      }
+    };
+
+    const intervalId = window.setInterval(() => {
+      void refreshIfExternallyUpdated();
+    }, 4000);
+    const handleFocus = () => void refreshIfExternallyUpdated();
+    window.addEventListener("focus", handleFocus);
+
+    return () => {
+      cancelled = true;
+      window.clearInterval(intervalId);
+      window.removeEventListener("focus", handleFocus);
+    };
+  }, [hydrateCanvasProject, id, isAgentMode, isLoading, isSaving]);
+
   // 删除节点时立即保存（按节点ID差集检测），避免删除后快速刷新被回滚
   useEffect(() => {
     if (isLoading || isAgentMode || isAgentOperationRefreshActive()) {
@@ -6734,6 +6989,7 @@ export default function CanvasEditorLegacyPage({
         deletedResultCollections:
           existingPersistedState.deletedResultCollections || {},
         resultImageUrls: existingPersistedState.resultImageUrls || [],
+        replacementResultState: existingPersistedState.replacementResultState || {},
       };
 
       const payload = {
@@ -10020,10 +10276,13 @@ export default function CanvasEditorLegacyPage({
               mode: null,
             });
           }}
+          onPersistProject={() => persistAgentProject("manual")}
+          onReplacementResultStateChange={handleAgentReplacementResultStateChange}
           onResultPreviewUrlsChange={handleAgentResultPreviewUrlsChange}
           onWorkspaceStateChange={setAgentWorkspaceState}
           projectId={agentProjectId}
           key={agentProjectId}
+          replacementResultState={agentProjectReplacementResultState}
           resultCollections={agentProjectResultCollections}
           selectedAgentPresetId={
             isAgentWorkspaceEnabled ? effectiveSelectedAgentPresetId : null
@@ -10851,6 +11110,7 @@ export default function CanvasEditorLegacyPage({
                     chatScope="canvas"
                     onClose={() => setIsPanelOpen(false)}
                     onOpenFileList={() => setPanelMode("fileList")}
+                    onRequireLogin={openLoginDialog}
                     selectedAgentPresetId={
                       isCanvasAgentModeEnabled ? selectedAgentPresetId : null
                     }

app/canvas/[id]/CanvasPageClientRouter.tsx

@@ -5,8 +5,9 @@ import { useParams, useSearchParams } from "next/navigation";
 import { createContext, type ReactNode, useContext, useMemo } from "react";
 import { CanvasLogoLoadingView } from "@/components/canvas/canvas-logo-loading";
 import type { CanvasInitialProject } from "@/types/canvas";
+import { loadCanvasEditorModule } from "./canvas-editor-loader";
 
-const CanvasEditorLegacyPage = dynamic(() => import("./CanvasEditorLegacyPageClient"), {
+const CanvasEditorLegacyPage = dynamic(loadCanvasEditorModule, {
   loading: () => <CanvasRouteLoader label="正在加载画布..." />,
   ssr: false,
 });
@@ -66,7 +67,7 @@ export function CanvasPageClientRouter({
   if (isVideoMode) {
     return (
       <CanvasLoadingBrandProvider value={loadingBrand}>
-        <LiblibVideoCanvasReplica canvasId={id} />
+        <LiblibVideoCanvasReplica canvasId={id} initialProject={initialProject} />
       </CanvasLoadingBrandProvider>
     );
   }

app/canvas/[id]/canvas-editor-loader.ts

@@ -0,0 +1,12 @@
+type CanvasEditorModule = typeof import("./CanvasEditorLegacyPageClient");
+
+let canvasEditorModulePromise: Promise<CanvasEditorModule> | null = null;
+
+export function loadCanvasEditorModule() {
+  canvasEditorModulePromise ??= import("./CanvasEditorLegacyPageClient");
+  return canvasEditorModulePromise;
+}
+
+export function preloadCanvasEditor() {
+  void loadCanvasEditorModule();
+}

app/canvas/[id]/model3d/page.tsx

@@ -1970,15 +1970,18 @@ export default function CanvasModel3DPage() {
           worldImageFile as File,
           "image"
         );
-        if (!uploadResult.success || !uploadResult.data?.mediaAssetId) {
+        const uploadData = uploadResult.data || null;
+        const mediaAssetId = uploadData?.mediaAssetId || null;
+        const sourceUrl = uploadData?.sourceUrl || null;
+        if (!uploadResult.success || !uploadData || (!mediaAssetId && !sourceUrl)) {
           throw new Error(uploadResult.error || "上传世界参考图失败");
         }
         await submitTask({
           provider: "worldlabs-3d",
           payload: {
             mode: "image",
-            mediaAssetId: uploadResult.data.mediaAssetId,
+            ...(mediaAssetId ? { mediaAssetId } : { sourceUrl }),
-            providerId: uploadResult.data.providerId,
+            providerId: uploadData.providerId,
             prompt: normalizedPrompt || undefined,
             displayName: worldDisplayName.trim() || undefined,
             model: worldModel,
@@ -2000,15 +2003,18 @@ export default function CanvasModel3DPage() {
           worldVideoFile as File,
           "video"
         );
-        if (!uploadResult.success || !uploadResult.data?.mediaAssetId) {
+        const uploadData = uploadResult.data || null;
+        const mediaAssetId = uploadData?.mediaAssetId || null;
+        const sourceUrl = uploadData?.sourceUrl || null;
+        if (!uploadResult.success || !uploadData || (!mediaAssetId && !sourceUrl)) {
           throw new Error(uploadResult.error || "上传世界视频失败");
         }
         await submitTask({
           provider: "worldlabs-3d",
           payload: {
             mode: "video",
-            mediaAssetId: uploadResult.data.mediaAssetId,
+            ...(mediaAssetId ? { mediaAssetId } : { sourceUrl }),
-            providerId: uploadResult.data.providerId,
+            providerId: uploadData.providerId,
             prompt: normalizedPrompt || undefined,
             displayName: worldDisplayName.trim() || undefined,
             model: worldModel,
@@ -2043,11 +2049,13 @@ export default function CanvasModel3DPage() {
       }
 
       const mediaAssets = uploads.map(({ slot, result }) => {
-        if (!result.success || !result.data?.mediaAssetId) {
+        const mediaAssetId = result.data?.mediaAssetId || null;
+        const sourceUrl = result.data?.sourceUrl || null;
+        if (!result.success || (!mediaAssetId && !sourceUrl)) {
           throw new Error(result.error || "上传多图世界图片失败");
         }
         return {
-          mediaAssetId: result.data.mediaAssetId,
+          ...(mediaAssetId ? { mediaAssetId } : { sourceUrl }),
           azimuth: slot.azimuth,
         };
       });
@@ -2790,9 +2798,9 @@ export default function CanvasModel3DPage() {
   ]);
 
   useEffect(() => {
-    if (workspaceMode !== "world" || worldViewportMode !== "splat") {
+    setWorldFirstPerson(
-      setWorldFirstPerson(false);
+      workspaceMode === "world" && worldViewportMode === "splat"
-    }
+    );
   }, [workspaceMode, worldViewportMode]);
 
   return (
@@ -4000,6 +4008,7 @@ export default function CanvasModel3DPage() {
               previewImageUrl={currentPreviewImage}
               resetViewToken={viewerResetToken}
               semanticsMetadata={currentWorldAsset?.semanticsMetadata}
+              showInfoOverlay={false}
               showMovementControls={
                 worldViewportMode === "splat" || worldViewportMode === "mesh"
               }

app/canvas/[id]/page.tsx

@@ -50,10 +50,13 @@ export default async function CanvasEditorPage({
 }: CanvasEditorPageProps) {
   const { id } = await params;
   const resolvedSearchParams = searchParams ? await searchParams : {};
-  const [siteSettings, initialProject] = await Promise.all([
+  const bypassLocalDatabase = process.env.CANVAS_E2E_LOCAL === "true";
-    getSiteSettings().catch(() => null),
+  const [siteSettings, initialProject] = bypassLocalDatabase
-    getInitialCanvasProject(id).catch(() => null),
+    ? [null, null]
-  ]);
+    : await Promise.all([
+        getSiteSettings().catch(() => null),
+        getInitialCanvasProject(id).catch(() => null),
+      ]);
   const loadingBrand = {
     siteLogo: siteSettings?.siteLogo,
     siteLogoDark: siteSettings?.siteLogoDark,

app/globals.css

@@ -3,6 +3,7 @@
 
 /* include utility classes in streamdown */
 @source '../node_modules/streamdown/dist/index.js';
+@source not '../services/pascal-editor';
 
 /* custom variant for setting dark mode programmatically */
 @custom-variant dark (&:is(.dark, .dark *));
@@ -92,6 +93,15 @@
   --sidebar-ring: hsl(217.2 91.2% 59.8%);
   /* border radius unit */
   --radius: 0.5rem;
+  --ui-control-sm: 2rem;
+  --ui-control-md: 2.25rem;
+  --ui-control-lg: 2.5rem;
+  --ui-icon-sm: 0.875rem;
+  --ui-icon-md: 1rem;
+  --ui-radius-control: 0.4375rem;
+  --ui-radius-panel: 0.75rem;
+  --ui-motion-fast: 120ms;
+  --ui-motion-panel: 160ms;
   --sidebar: hsl(0 0% 98%);
   --chat-user-bubble-bg: hsl(214 100% 50%);
   --chat-user-bubble-foreground: hsl(0 0% 100%);
@@ -257,6 +267,29 @@
     font-family: var(--font-jetbrains-mono);
   }
 
+  body {
+    font-size: 14px;
+    line-height: 1.5;
+  }
+
+  button,
+  a,
+  [role="button"] {
+    touch-action: manipulation;
+    -webkit-tap-highlight-color: transparent;
+  }
+
+  button:not(:disabled):active,
+  [role="button"]:not([aria-disabled="true"]):active {
+    opacity: 0.82;
+  }
+
+  @media (width >= 768px) {
+    html {
+      font-size: 15px;
+    }
+  }
+
   .drawnix,
   .drawnix *,
   .drawnix-tutorial,
@@ -370,3 +403,107 @@
     background-size: 40px 40px;
   }
 }
+
+/* Dense, shared system-settings language. Scoped so canvas tools keep their own scale. */
+.settings-workspace {
+  font-size: 13px;
+  line-height: 1.45;
+  letter-spacing: 0;
+}
+
+.settings-workspace [class*="tracking-"] {
+  letter-spacing: 0;
+}
+
+.settings-workspace [data-slot="card"] {
+  border-radius: 8px;
+  box-shadow: 0 1px 2px rgb(15 23 42 / 5%);
+}
+
+.settings-workspace [data-slot="card-header"] {
+  row-gap: 4px;
+  padding: 14px 16px 10px;
+}
+
+.settings-workspace [data-slot="card-title"] {
+  font-size: 15px;
+  line-height: 1.4;
+  letter-spacing: 0;
+}
+
+.settings-workspace [data-slot="card-description"] {
+  font-size: 12px;
+  line-height: 1.5;
+}
+
+.settings-workspace [data-slot="card-content"] {
+  padding: 0 16px 16px;
+}
+
+.settings-workspace [data-slot="card-footer"] {
+  padding: 0 16px 16px;
+}
+
+.settings-workspace [data-slot="label"] {
+  font-size: 12px;
+  line-height: 1.35;
+}
+
+.settings-workspace .text-3xl {
+  font-size: 20px;
+  line-height: 1.3;
+}
+
+.settings-workspace .text-2xl {
+  font-size: 18px;
+  line-height: 1.35;
+}
+
+.settings-workspace .text-xl {
+  font-size: 16px;
+  line-height: 1.4;
+}
+
+.settings-workspace .text-lg {
+  font-size: 15px;
+  line-height: 1.4;
+}
+
+.settings-workspace .rounded-2xl,
+.settings-workspace .rounded-xl {
+  border-radius: 8px;
+}
+
+.settings-workspace .gap-6 {
+  gap: 16px;
+}
+
+.settings-workspace .space-y-6 > :not([hidden]) ~ :not([hidden]) {
+  margin-top: 16px;
+}
+
+.settings-workspace button .lucide,
+.settings-workspace a .lucide {
+  width: 14px;
+  height: 14px;
+}
+
+.settings-workspace button,
+.settings-workspace a,
+.settings-workspace [role="button"] {
+  transition-duration: 120ms;
+}
+
+@media (width < 640px) {
+  .settings-workspace [data-slot="card-header"] {
+    padding: 12px 12px 8px;
+  }
+
+  .settings-workspace [data-slot="card-content"] {
+    padding: 0 12px 12px;
+  }
+
+  .settings-workspace [data-slot="card-footer"] {
+    padding: 0 12px 12px;
+  }
+}

biome.jsonc

@@ -13,6 +13,7 @@
       "!lib/db/migrations/meta",
       "!public/vendor",
       "!public/three",
+      "!services/pascal-editor",
       "!vercel.json"
     ]
   },

components/agents/AgentExecutionSnapshotDialog.tsx

@@ -52,30 +52,30 @@ export function AgentExecutionSnapshotDialog({
               <Loader2 className="h-5 w-5 animate-spin text-muted-foreground" />
             </div>
           ) : !snapshot ? (
-            <div className="rounded-xl border border-dashed p-6 text-sm text-muted-foreground">
+            <div className="rounded-[var(--ui-radius-control)] border border-dashed p-5 text-[13px] text-muted-foreground">
               暂无快照详情
             </div>
           ) : (
-            <div className="space-y-5">
+            <div className="space-y-4">
               <div className="grid grid-cols-1 gap-3 md:grid-cols-2">
-                <div className="rounded-xl border p-3">
+                <div className="rounded-[var(--ui-radius-control)] border p-3">
-                  <div className="text-xs text-muted-foreground">风格化</div>
+                  <div className="text-[11px] text-muted-foreground">风格化</div>
                   <div className="mt-1 font-medium">{snapshot.presetName}</div>
-                  <div className="mt-1 text-sm text-muted-foreground">
+                  <div className="mt-1 text-[13px] text-muted-foreground">
                     类型：{snapshot.presetType === "video" ? "视频" : "生图"}
                   </div>
                   <div className="text-sm text-muted-foreground">
                     分类：{snapshot.categoryName || "未分类"}
                   </div>
                 </div>
-                <div className="rounded-xl border p-3">
+                <div className="rounded-[var(--ui-radius-control)] border p-3">
-                  <div className="text-xs text-muted-foreground">模型</div>
+                  <div className="text-[11px] text-muted-foreground">模型</div>
                   <div className="mt-1 font-medium">
                     {snapshot.resolvedModel?.displayName ||
                       snapshot.defaultModel?.displayName ||
                       "未记录"}
                   </div>
-                  <div className="mt-1 text-sm text-muted-foreground">
+                  <div className="mt-1 text-[13px] text-muted-foreground">
                     槽位：{snapshot.slotCount} 个
                   </div>
                   <div className="text-sm text-muted-foreground">
@@ -84,8 +84,8 @@ export function AgentExecutionSnapshotDialog({
                 </div>
               </div>
 
-              <div className="rounded-xl border p-3">
+              <div className="rounded-[var(--ui-radius-control)] border p-3">
-                <div className="mb-2 text-sm font-medium">本次使用的 3 张素材图</div>
+                <div className="mb-2 text-[13px] font-medium">本次使用的 3 张素材图</div>
                 {uploadedImageUrls.length > 0 ? (
                   <div className="flex flex-wrap gap-3">
                     {uploadedImageUrls.map((url, index) => (
@@ -107,18 +107,18 @@ export function AgentExecutionSnapshotDialog({
               </div>
 
               {snapshot.userInputText ? (
-                <div className="rounded-xl border p-3">
+                <div className="rounded-[var(--ui-radius-control)] border p-3">
-                  <div className="mb-2 text-sm font-medium">用户补充提示</div>
+                  <div className="mb-2 text-[13px] font-medium">用户补充提示</div>
-                  <div className="whitespace-pre-wrap text-sm text-muted-foreground">
+                  <div className="whitespace-pre-wrap text-[13px] text-muted-foreground">
                     {snapshot.userInputText}
                   </div>
                 </div>
               ) : null}
 
               <div className="space-y-3">
-                <div className="text-sm font-medium">槽位详情</div>
+                <div className="text-[13px] font-medium">槽位详情</div>
                 {snapshot.slots.map((slot, index) => (
-                  <div key={`snapshot-slot-${slot.slotIndex}-${index}`} className="rounded-xl border p-3">
+                  <div key={`snapshot-slot-${slot.slotIndex}-${index}`} className="rounded-[var(--ui-radius-control)] border p-3">
                     <div className="mb-2 flex items-center justify-between">
                       <div className="font-medium">
                         {slot.title || slot.uploadLabel || `槽位 ${slot.slotIndex + 1}`}

components/agents/AgentGenerationWorkspaceDarkV2.tsx

@@ -82,6 +82,7 @@ import {
   LOCAL_EDIT_MAX_REGIONS,
   createLocalEditReferenceImageId,
   createLocalEditRegionId,
+  hasScaleAdjustTargetChanged,
   reindexLocalEditRegions,
   type LocalEditReferenceImage,
   type LocalEditRegion,
@@ -122,6 +123,8 @@ import type {
   AgentDetailBriefForm,
   AgentDetailGenerationProgressState,
   AgentDetailReplacementStrategy,
+  AgentGenerationProjectReplacementResultState,
+  AgentGenerationReplacementResultRecord,
   AgentGenerationProjectWorkspaceState,
   AgentGenerationProjectResultCollections,
   AgentGenerationResultModeType,
@@ -146,6 +149,7 @@ import {
 import {
   createEmptyAgentGenerationProjectWorkspaceState,
   normalizeAgentGenerationProjectPersistedState,
+  normalizeAgentGenerationProjectReplacementResultState,
 } from "@/lib/agents/generation-project-state";
 
 export interface AgentGenerationWorkspaceDarkV2Props {
@@ -173,6 +177,10 @@ export interface AgentGenerationWorkspaceDarkV2Props {
   onWorkspaceStateChange?: (next: AgentGenerationProjectWorkspaceState) => void;
   resultCollections?: AgentGenerationProjectResultCollections | null;
   deletedResultCollections?: AgentGenerationProjectResultCollections | null;
+  replacementResultState?: AgentGenerationProjectReplacementResultState | null;
+  onReplacementResultStateChange?: (
+    next: AgentGenerationProjectReplacementResultState
+  ) => void;
   onResultPreviewUrlsChange?: (
     modeType: AgentGenerationResultModeType,
     urls: string[]
@@ -181,6 +189,7 @@ export interface AgentGenerationWorkspaceDarkV2Props {
     modeType: AgentGenerationResultModeType,
     imageUrl: string
   ) => void;
+  onPersistProject?: () => Promise<boolean> | boolean;
   topNavRightSlot?: ReactNode;
   showcaseConfig?: AgentWorkflowShowcaseConfig | null;
   workflowStylePanel?: ReactNode;
@@ -247,6 +256,8 @@ type DetailResultLocalEditTarget = {
 
 type DetailResultLocalEditMode = "local_edit" | "scale_adjust";
 
+type DetailResultLocalEditImageSize = "1K" | "2K";
+
 type DetailResultLocalEditRect = {
   x: number;
   y: number;
@@ -269,6 +280,7 @@ type DetailResultLocalEditRegionInteraction = {
 
 type DetailResultLocalEditSubmitParams = {
   imageUrl: string;
+  imageSize: DetailResultLocalEditImageSize;
   mode: DetailResultLocalEditMode;
   title: string;
   regions: LocalEditRegion[];
@@ -469,6 +481,15 @@ function normalizeResultCollectionUrls(urls?: string[] | null) {
   );
 }
 
+function areResultUrlListsEqual(left?: string[] | null, right?: string[] | null) {
+  const normalizedLeft = normalizeResultCollectionUrls(left);
+  const normalizedRight = normalizeResultCollectionUrls(right);
+  return (
+    normalizedLeft.length === normalizedRight.length &&
+    normalizedLeft.every((url, index) => normalizedRight[index] === url)
+  );
+}
+
 function excludeDeletedResultUrls(
   urls: string[] | undefined | null,
   deletedUrls: string[] | undefined | null
@@ -894,6 +915,7 @@ function DetailResultLocalEditDialog({
   const [uploadingRegionId, setUploadingRegionId] = useState<string | null>(null);
   const [drawingTargetRegionId, setDrawingTargetRegionId] = useState<string | null>(null);
   const [mode, setMode] = useState<DetailResultLocalEditMode>("local_edit");
+  const [imageSize, setImageSize] = useState<DetailResultLocalEditImageSize>("1K");
   const dragStartRef = useRef<{ x: number; y: number } | null>(null);
   const editSurfaceRef = useRef<HTMLDivElement | null>(null);
   const isScaleAdjustMode = mode === "scale_adjust";
@@ -918,6 +940,7 @@ function DetailResultLocalEditDialog({
     setRegionInteraction(null);
     setUploadingRegionId(null);
     setDrawingTargetRegionId(null);
+    setImageSize("1K");
     dragStartRef.current = null;
   }, [target?.cardId, target?.imageUrl, target?.mode]);
 
@@ -1211,11 +1234,11 @@ function DetailResultLocalEditDialog({
         return;
       }
       const unchangedRegion = validRegions.find(
-        (region) => deriveDetailScalePercentFromRects(region.rect, region.targetRect) === 0
+        (region) => !hasScaleAdjustTargetChanged(region.rect, region.targetRect)
       );
       if (unchangedRegion) {
         setActiveRegionId(unchangedRegion.id);
-        toast.error(`区域 ${unchangedRegion.index} 的目标框大小变化不明显，请重新框选`);
+        toast.error(`区域 ${unchangedRegion.index} 的目标框大小和位置均未变化`);
         return;
       }
     } else {
@@ -1228,11 +1251,12 @@ function DetailResultLocalEditDialog({
     }
     onSubmit({
       imageUrl: target.imageUrl,
+      imageSize,
       mode,
       title: target.title,
       regions: validRegions,
     });
-  }, [isScaleAdjustMode, mode, onSubmit, regions, target, uploadingRegionId]);
+  }, [imageSize, isScaleAdjustMode, mode, onSubmit, regions, target, uploadingRegionId]);
 
   const completeDraftRegion = useCallback(
     (event: React.PointerEvent<HTMLDivElement>) => {
@@ -1817,6 +1841,36 @@ function DetailResultLocalEditDialog({
 	                ? `先框主体，再框目标大小和位置。最多 ${LOCAL_EDIT_MAX_REGIONS} 个区域。${completionCopy}`
 	                : `框选要局部修改的位置，填写提示词；可为每个区域添加参考图。最多 ${LOCAL_EDIT_MAX_REGIONS} 个区域。${completionCopy}`}
 	            </div>
+            {!activePreviewResult ? (
+              <div className="rounded-2xl border border-white/10 bg-white/[0.035] p-3">
+                <div className="mb-2 text-xs font-semibold uppercase tracking-[0.18em] text-white/38">
+                  输出尺寸
+                </div>
+                <div className="grid grid-cols-2 gap-2">
+                  {(
+                    [
+                      { label: "快速 1K", value: "1K" },
+                      { label: "高清 2K", value: "2K" },
+                    ] as const
+                  ).map((option) => (
+                    <button
+                      className={cn(
+                        "h-9 rounded-xl border px-3 text-sm font-semibold transition",
+                        imageSize === option.value
+                          ? "border-white bg-white text-black"
+                          : "border-white/10 bg-black/20 text-white/58 hover:bg-white/[0.08] hover:text-white"
+                      )}
+                      disabled={submitting}
+                      key={option.value}
+                      onClick={() => setImageSize(option.value)}
+                      type="button"
+                    >
+                      {option.label}
+                    </button>
+                  ))}
+                </div>
+              </div>
+            ) : null}
 	            {!activePreviewResult && isScaleAdjustMode ? (
 	              <div className="rounded-2xl border border-white/10 bg-white/[0.035] p-3 text-sm text-white/58">
 	                <div className="mb-2 text-xs font-semibold uppercase tracking-[0.18em] text-white/38">
@@ -2352,13 +2406,7 @@ type ReplacementModeType = Extract<
   "detail_replacement" | "sku_replacement"
 >;
 
-interface ReplacementResultRecord {
+interface ReplacementResultRecord extends AgentGenerationReplacementResultRecord {}
-  url: string | null;
-  text: string;
-  status: Extract<ReplacementCardStatus, "completed" | "passthrough" | "fallback">;
-  updatedAt: number;
-  compareSourceUrl?: string | null;
-}
 
 interface ReplacementExecutionContext {
   modeType: ReplacementModeType;
@@ -2405,13 +2453,26 @@ type ReplacementResultState = Record<
 const MANUAL_PASSTHROUGH_RESULT_TEXT =
   "已按人工标记沿用参考图，直接应用当前切片，不参与继续生成。";
 
-function createEmptyReplacementResultState(): ReplacementResultState {
+function normalizeReplacementResultStateForWorkspace(
+  value: AgentGenerationProjectReplacementResultState | null | undefined
+): ReplacementResultState {
+  const normalized = normalizeAgentGenerationProjectReplacementResultState(value);
   return {
-    detail_replacement: {},
+    detail_replacement: { ...(normalized.detail_replacement || {}) },
-    sku_replacement: {},
+    sku_replacement: { ...(normalized.sku_replacement || {}) },
   };
 }
 
+function areReplacementResultStatesEqual(
+  left: ReplacementResultState,
+  right: ReplacementResultState
+) {
+  return (
+    JSON.stringify(normalizeAgentGenerationProjectReplacementResultState(left)) ===
+    JSON.stringify(normalizeAgentGenerationProjectReplacementResultState(right))
+  );
+}
+
 function inferReplacementCardStatusFromText(text: string | null | undefined): ReplacementCardStatus | null {
   const normalized = normalizeAssistantText(String(text || ""))
     .replace(/\s+/g, " ")
@@ -3059,9 +3120,12 @@ export function AgentGenerationWorkspaceDarkV2({
   workspaceState = null,
   resultCollections = null,
   deletedResultCollections = null,
+  replacementResultState: persistedReplacementResultState = null,
   onWorkspaceStateChange,
+  onReplacementResultStateChange,
   onResultPreviewUrlsChange,
   onDeleteResultImage,
+  onPersistProject,
   topNavRightSlot,
   showcaseConfig,
   workflowStylePanel,
@@ -3213,7 +3277,7 @@ export function AgentGenerationWorkspaceDarkV2({
     Record<string, string>
   >({});
   const [replacementResultState, setReplacementResultState] = useState<ReplacementResultState>(
-    () => createEmptyReplacementResultState()
+    () => normalizeReplacementResultStateForWorkspace(persistedReplacementResultState)
   );
   const [replacementExecutionContext, setReplacementExecutionContext] =
     useState<ReplacementExecutionContext | null>(null);
@@ -3229,6 +3293,7 @@ export function AgentGenerationWorkspaceDarkV2({
   const [detailWatermarkRemoveCardIds, setDetailWatermarkRemoveCardIds] =
     useState<Set<string>>(() => new Set());
   const processedResultHintTimerRef = useRef<Record<string, number>>({});
+  const transportGenerationStartedAtRef = useRef<number | null>(null);
   const closePsdTemplateDialog = useCallback(() => {
     setIsPsdTemplateDialogOpen(false);
     setPsdTemplateDialogSourceUrl(null);
@@ -3262,6 +3327,22 @@ export function AgentGenerationWorkspaceDarkV2({
     },
     [activeResultModeType, isPsdTemplateEnabled]
   );
+
+  useEffect(() => {
+    const nextState = normalizeReplacementResultStateForWorkspace(
+      persistedReplacementResultState
+    );
+    setReplacementResultState((current) =>
+      areReplacementResultStatesEqual(current, nextState) ? current : nextState
+    );
+  }, [persistedReplacementResultState]);
+
+  useEffect(() => {
+    onReplacementResultStateChange?.(
+      normalizeAgentGenerationProjectReplacementResultState(replacementResultState)
+    );
+  }, [onReplacementResultStateChange, replacementResultState]);
+
   const normalizedDeletedResultCollections = useMemo(
     () => ({
       scene_generation: normalizeResultCollectionUrls(
@@ -4037,7 +4118,15 @@ export function AgentGenerationWorkspaceDarkV2({
           ? "agent-anchor-materials"
           : "agent-anchor-generate";
 
-  const { messages, setMessages, sendMessage, status, stop } = useChat<ChatMessage>({
+  const {
+    messages,
+    setMessages,
+    sendMessage,
+    status,
+    stop,
+    error: chatError,
+    clearError,
+  } = useChat<ChatMessage>({
     id: chatId,
     messages: historyMessages,
     experimental_throttle: 100,
@@ -4502,63 +4591,48 @@ export function AgentGenerationWorkspaceDarkV2({
     skuReplacementReferenceCards,
   ]);
   useEffect(() => {
+    if (latestReplacementResults.length === 0) {
+      return;
+    }
+
+    const detailReferenceCardById = new Map(
+      detailReplacementReferenceCards.map((card) => [card.id, card])
+    );
+    const skuReferenceCardById = new Map(
+      skuReplacementReferenceCards.map((card) => [card.id, card])
+    );
+    const fallbackModeType: ReplacementModeType | null =
+      currentResultModeType === "detail_replacement" || currentResultModeType === "sku_replacement"
+        ? currentResultModeType
+        : null;
+
     setReplacementResultState((current) => {
-      const detailCardIds = new Set(detailReplacementReferenceCards.map((card) => card.id));
+      const nextState: ReplacementResultState = {
-      const skuCardIds = new Set(skuReplacementReferenceCards.map((card) => card.id));
+        detail_replacement: { ...current.detail_replacement },
-      let changed = false;
+        sku_replacement: { ...current.sku_replacement },
-
-      const nextDetail = Object.fromEntries(
-        Object.entries(current.detail_replacement).filter(([cardId]) => detailCardIds.has(cardId))
-      );
-      if (Object.keys(nextDetail).length !== Object.keys(current.detail_replacement).length) {
-        changed = true;
-      }
-
-      const nextSku = Object.fromEntries(
-        Object.entries(current.sku_replacement).filter(([cardId]) => skuCardIds.has(cardId))
-      );
-      if (Object.keys(nextSku).length !== Object.keys(current.sku_replacement).length) {
-        changed = true;
-      }
-
-      if (!changed) {
-        return current;
-      }
-
-      return {
-        detail_replacement: nextDetail,
-        sku_replacement: nextSku,
       };
-    });
-  }, [detailReplacementReferenceCards, skuReplacementReferenceCards]);
-  useEffect(() => {
-    if (
-      (currentResultModeType !== "detail_replacement" && currentResultModeType !== "sku_replacement") ||
-      latestReplacementResults.length === 0
-    ) {
-      return;
-    }
-
-    const cardIds = currentReplacementExecutionCardIds;
-    if (cardIds.length === 0) {
-      return;
-    }
-
-    setReplacementResultState((current) => {
-      const nextModeState = { ...current[currentResultModeType] };
       let changed = false;
 
-      latestReplacementResults.forEach((result, index) => {
+      const applyResult = (
-        const cardId = result.replacementCardId || cardIds[index];
+        modeType: ReplacementModeType,
+        cardId: string | null | undefined,
+        result: {
+          url: string | null;
+          text: string;
+          replacementCardId: string | null;
+        },
+        referenceCard?: {
+          imageUrl?: string | null;
+          label?: string | null;
+          previewUrl?: string | null;
+        } | null
+      ) => {
         if (!cardId) {
           return;
         }
         const inferredStatus = inferReplacementCardStatusFromText(result.text);
+        const nextModeState = nextState[modeType];
         const previousRecord = nextModeState[cardId];
-        const referenceCard =
-          currentResultModeType === "detail_replacement"
-            ? detailReplacementReferenceCards.find((card) => card.id === cardId)
-            : skuReplacementReferenceCards.find((card) => card.id === cardId);
         const resultUrl = result.url || null;
         const previousUrl =
           previousRecord?.url && previousRecord.url !== resultUrl
@@ -4578,27 +4652,59 @@ export function AgentGenerationWorkspaceDarkV2({
             resultUrl,
             previousUrl || referenceSourceUrl || previousRecord?.compareSourceUrl || null
           ),
+          referenceImageUrl: referenceCard?.imageUrl || previousRecord?.referenceImageUrl || null,
+          referencePreviewUrl:
+            referenceCard?.previewUrl || previousRecord?.referencePreviewUrl || null,
+          label: referenceCard?.label || previousRecord?.label || null,
         };
         if (
           previousRecord?.url === nextRecord.url &&
           previousRecord?.text === nextRecord.text &&
           previousRecord?.status === nextRecord.status &&
-          previousRecord?.compareSourceUrl === nextRecord.compareSourceUrl
+          previousRecord?.compareSourceUrl === nextRecord.compareSourceUrl &&
+          previousRecord?.referenceImageUrl === nextRecord.referenceImageUrl &&
+          previousRecord?.referencePreviewUrl === nextRecord.referencePreviewUrl &&
+          previousRecord?.label === nextRecord.label
         ) {
           return;
         }
         nextModeState[cardId] = nextRecord;
         changed = true;
+      };
+
+      latestReplacementResults.forEach((result, index) => {
+        const explicitCardId = result.replacementCardId || null;
+        if (explicitCardId) {
+          const detailReferenceCard = detailReferenceCardById.get(explicitCardId);
+          if (detailReferenceCard) {
+            applyResult("detail_replacement", explicitCardId, result, detailReferenceCard);
+            return;
+          }
+
+          const skuReferenceCard = skuReferenceCardById.get(explicitCardId);
+          if (skuReferenceCard) {
+            applyResult("sku_replacement", explicitCardId, result, skuReferenceCard);
+            return;
+          }
+        }
+
+        if (!fallbackModeType) {
+          return;
+        }
+
+        const fallbackCardId = currentReplacementExecutionCardIds[index];
+        const fallbackReferenceCard =
+          fallbackModeType === "detail_replacement"
+            ? detailReferenceCardById.get(fallbackCardId)
+            : skuReferenceCardById.get(fallbackCardId);
+        applyResult(fallbackModeType, fallbackCardId, result, fallbackReferenceCard);
       });
 
       if (!changed) {
         return current;
       }
 
-      return {
+      return nextState;
-        ...current,
-        [currentResultModeType]: nextModeState,
-      };
     });
   }, [
     currentReplacementExecutionCardIds,
@@ -4608,8 +4714,8 @@ export function AgentGenerationWorkspaceDarkV2({
     skuReplacementReferenceCards,
   ]);
   const detailReplacementResultUrls = useMemo(
-    () =>
+    () => {
-      detailReplacementReferenceCards
+      const urlsFromCards = detailReplacementReferenceCards
         .map((card) => {
           const recordUrl = replacementResultState.detail_replacement[card.id]?.url || null;
           const fallbackUrl = !recordUrl && card.passthrough ? card.imageUrl || null : null;
@@ -4619,7 +4725,15 @@ export function AgentGenerationWorkspaceDarkV2({
             ? nextUrl
             : null;
         })
-        .filter((url): url is string => Boolean(url)),
+        .filter((url): url is string => Boolean(url));
+      const urlsFromRecords = Object.values(replacementResultState.detail_replacement)
+        .map((record) => record.url)
+        .filter((url): url is string => Boolean(url))
+        .filter(
+          (url) => !normalizedDeletedResultCollections.detail_replacement.includes(url)
+        );
+      return Array.from(new Set([...urlsFromCards, ...urlsFromRecords]));
+    },
     [
       detailReplacementReferenceCards,
       normalizedDeletedResultCollections.detail_replacement,
@@ -4627,15 +4741,21 @@ export function AgentGenerationWorkspaceDarkV2({
     ]
   );
   const skuReplacementResultUrls = useMemo(
-    () =>
+    () => {
-      skuReplacementReferenceCards
+      const urlsFromCards = skuReplacementReferenceCards
         .map((card) => {
           const nextUrl = replacementResultState.sku_replacement[card.id]?.url || null;
           return nextUrl && !normalizedDeletedResultCollections.sku_replacement.includes(nextUrl)
             ? nextUrl
             : null;
         })
-        .filter((url): url is string => Boolean(url)),
+        .filter((url): url is string => Boolean(url));
+      const urlsFromRecords = Object.values(replacementResultState.sku_replacement)
+        .map((record) => record.url)
+        .filter((url): url is string => Boolean(url))
+        .filter((url) => !normalizedDeletedResultCollections.sku_replacement.includes(url));
+      return Array.from(new Set([...urlsFromCards, ...urlsFromRecords]));
+    },
     [
       normalizedDeletedResultCollections.sku_replacement,
       replacementResultState.sku_replacement,
@@ -4726,24 +4846,20 @@ export function AgentGenerationWorkspaceDarkV2({
           resultCollections?.detail_generation,
           normalizedDeletedResultCollections.detail_generation
         ),
-        detail_replacement: Array.from(
+        detail_replacement:
-          new Set([
+          detailReplacementResultUrls.length > 0
-            ...detailReplacementResultUrls,
+            ? detailReplacementResultUrls
-            ...excludeDeletedResultUrls(
+            : excludeDeletedResultUrls(
-              resultCollections?.detail_replacement,
+                resultCollections?.detail_replacement,
-              normalizedDeletedResultCollections.detail_replacement
+                normalizedDeletedResultCollections.detail_replacement
-            ),
+              ),
-          ])
+        sku_replacement:
-        ),
+          skuReplacementResultUrls.length > 0
-        sku_replacement: Array.from(
+            ? skuReplacementResultUrls
-          new Set([
+            : excludeDeletedResultUrls(
-            ...skuReplacementResultUrls,
+                resultCollections?.sku_replacement,
-            ...excludeDeletedResultUrls(
+                normalizedDeletedResultCollections.sku_replacement
-              resultCollections?.sku_replacement,
+              ),
-              normalizedDeletedResultCollections.sku_replacement
-            ),
-          ])
-        ),
       };
 
       return {
@@ -4949,6 +5065,52 @@ export function AgentGenerationWorkspaceDarkV2({
     skuReplacementBatchDownloadUrls.length > 0
       ? skuReplacementBatchDownloadUrls
       : mergedResultCollections.sku_replacement;
+  const syncReplacementResultCollectionsToParent = useCallback(
+    (targetModeType?: ReplacementModeType) => {
+      if (!onResultPreviewUrlsChange) {
+        return;
+      }
+
+      const syncMode = (modeType: ReplacementModeType, liveUrls: string[]) => {
+        if (targetModeType && targetModeType !== modeType) {
+          return;
+        }
+        const normalizedLiveUrls = normalizeResultCollectionUrls(liveUrls);
+        if (normalizedLiveUrls.length === 0) {
+          return;
+        }
+
+        const deletedUrlSet = new Set(
+          normalizedDeletedResultCollections[modeType]
+        );
+        const nextUrls = Array.from(
+          new Set(normalizedLiveUrls.filter((url) => !deletedUrlSet.has(url)))
+        );
+
+        if (!areResultUrlListsEqual(resultCollections?.[modeType], nextUrls)) {
+          onResultPreviewUrlsChange(modeType, nextUrls);
+        }
+      };
+
+      onReplacementResultStateChange?.(
+        normalizeAgentGenerationProjectReplacementResultState(
+          replacementResultState
+        )
+      );
+      syncMode("detail_replacement", detailReplacementResultUrls);
+      syncMode("sku_replacement", skuReplacementResultUrls);
+    },
+    [
+      detailReplacementResultUrls,
+      normalizedDeletedResultCollections,
+      onReplacementResultStateChange,
+      onResultPreviewUrlsChange,
+      replacementResultState,
+      resultCollections,
+      skuReplacementResultUrls,
+    ]
+  );
+
   const detailRemainingCount = useMemo(
     () =>
       detailResultCards.filter(
@@ -5236,6 +5398,115 @@ export function AgentGenerationWorkspaceDarkV2({
     }
   }, [pendingGeneration, pendingGenerationProgressCount]);
 
+  useEffect(() => {
+    if (!pendingGeneration || !chatError) {
+      return;
+    }
+
+    generationRequestSnapshotRef.current = {
+      hiddenPrompt: null,
+      replacementExecutionCardIds: null,
+      replacementRerunReferenceImages: null,
+    };
+    setPendingGeneration(null);
+    toast.error(chatError.message || "生成请求失败，请稍后重试");
+    clearError();
+  }, [chatError, clearError, pendingGeneration]);
+
+  useEffect(() => {
+    if (!pendingGeneration) {
+      return;
+    }
+
+    const elapsedMs = Date.now() - pendingGeneration.timestamp;
+    const remainingMs = AGENT_PENDING_GENERATION_EXPIRY_MS - elapsedMs;
+    const clearStalePendingGeneration = () => {
+      generationRequestSnapshotRef.current = {
+        hiddenPrompt: null,
+        replacementExecutionCardIds: null,
+        replacementRerunReferenceImages: null,
+      };
+      try {
+        stop();
+      } catch (error) {
+        console.warn(
+          "[AgentGenerationWorkspaceDarkV2] Failed to stop stale generation transport:",
+          error
+        );
+      }
+      transportGenerationStartedAtRef.current = null;
+      setPendingGeneration((current) => {
+        if (
+          !current ||
+          current.chatId !== pendingGeneration.chatId ||
+          current.timestamp !== pendingGeneration.timestamp
+        ) {
+          return current;
+        }
+        return null;
+      });
+      toast.warning("生成请求超过 30 分钟未回传，已结束处理中状态，可重新生成未回传结果。");
+    };
+
+    if (remainingMs <= 0) {
+      clearStalePendingGeneration();
+      return;
+    }
+
+    const timerId = window.setTimeout(clearStalePendingGeneration, remainingMs);
+    return () => window.clearTimeout(timerId);
+  }, [pendingGeneration, stop]);
+
+  useEffect(() => {
+    if (!transportIsGenerating) {
+      transportGenerationStartedAtRef.current = null;
+      return;
+    }
+
+    if (transportGenerationStartedAtRef.current === null) {
+      transportGenerationStartedAtRef.current =
+        pendingGeneration?.timestamp || Date.now();
+    }
+
+    const startedAt = transportGenerationStartedAtRef.current;
+    const elapsedMs = Date.now() - startedAt;
+    const remainingMs = AGENT_PENDING_GENERATION_EXPIRY_MS - elapsedMs;
+    const abortStaleTransport = () => {
+      const currentStartedAt = transportGenerationStartedAtRef.current;
+      if (
+        currentStartedAt === null ||
+        Date.now() - currentStartedAt < AGENT_PENDING_GENERATION_EXPIRY_MS
+      ) {
+        return;
+      }
+
+      generationRequestSnapshotRef.current = {
+        hiddenPrompt: null,
+        replacementExecutionCardIds: null,
+        replacementRerunReferenceImages: null,
+      };
+      try {
+        stop();
+      } catch (error) {
+        console.warn(
+          "[AgentGenerationWorkspaceDarkV2] Failed to abort stale generation transport:",
+          error
+        );
+      }
+      transportGenerationStartedAtRef.current = null;
+      setPendingGeneration(null);
+      toast.warning("生成请求超过 30 分钟未回传，已中断卡住连接，可重新生成未回传结果。");
+    };
+
+    if (remainingMs <= 0) {
+      abortStaleTransport();
+      return;
+    }
+
+    const timerId = window.setTimeout(abortStaleTransport, remainingMs);
+    return () => window.clearTimeout(timerId);
+  }, [pendingGeneration?.timestamp, stop, transportIsGenerating]);
+
   useEffect(() => {
     if (!pendingGeneration || transportIsGenerating) {
       return;
@@ -5273,11 +5544,19 @@ export function AgentGenerationWorkspaceDarkV2({
   ]);
 
   useEffect(() => {
-    onResultPreviewUrlsChange?.(
+    if (!onResultPreviewUrlsChange) {
-      currentResultModeType,
+      return;
-      mergedResultCollections[currentResultModeType] || []
+    }
-    );
+
-  }, [currentResultModeType, mergedResultCollections, onResultPreviewUrlsChange]);
+    ([
+      "scene_generation",
+      "detail_generation",
+      "detail_replacement",
+      "sku_replacement",
+    ] as AgentGenerationResultModeType[]).forEach((modeType) => {
+      onResultPreviewUrlsChange(modeType, mergedResultCollections[modeType] || []);
+    });
+  }, [mergedResultCollections, onResultPreviewUrlsChange]);
 
   useEffect(() => {
     if (activeResultModeUrls.length === 0) {
@@ -5419,6 +5698,7 @@ export function AgentGenerationWorkspaceDarkV2({
     imageUrls: string[];
     zipName: string;
     scope: BatchDownloadScope;
+    modeType?: AgentGenerationResultModeType;
   }) => {
     const normalizedUrls = (params.imageUrls || [])
       .map((item) => String(item || "").trim())
@@ -5428,6 +5708,19 @@ export function AgentGenerationWorkspaceDarkV2({
       return;
     }
 
+    if (
+      params.modeType === "detail_replacement" ||
+      params.modeType === "sku_replacement"
+    ) {
+      syncReplacementResultCollectionsToParent(params.modeType);
+    }
+    const persisted = await Promise.resolve(onPersistProject?.() ?? true).catch(
+      () => false
+    );
+    if (!persisted) {
+      toast.info("结果已保留在当前页面，项目同步稍后会自动重试");
+    }
+
     setBatchDownloadState(params.scope);
     setBatchDownloadDialog({
       scope: params.scope,
@@ -5507,7 +5800,7 @@ export function AgentGenerationWorkspaceDarkV2({
       }));
       toast.error(message);
     }
-  }, []);
+  }, [onPersistProject, syncReplacementResultCollectionsToParent]);
 
   useEffect(() => {
     const taskId = batchDownloadDialog?.taskId;
@@ -5606,6 +5899,9 @@ export function AgentGenerationWorkspaceDarkV2({
     const link = document.createElement("a");
     link.href = batchDownloadDialog.downloadUrl;
     link.download = `${batchDownloadDialog.zipName || "batch-results"}.zip`;
+    link.target = "_blank";
+    link.rel = "noopener noreferrer";
+    link.style.display = "none";
     document.body.appendChild(link);
     link.click();
     link.remove();
@@ -5671,6 +5967,10 @@ export function AgentGenerationWorkspaceDarkV2({
     setReplacementResultState((current) => {
       const currentModeState = current[params.modeType];
       const previousRecord = currentModeState[params.cardId];
+      const referenceCard =
+        params.modeType === "detail_replacement"
+          ? detailReplacementReferenceCards.find((card) => card.id === params.cardId)
+          : skuReplacementReferenceCards.find((card) => card.id === params.cardId);
       const inferredStatus = inferReplacementCardStatusFromText(params.text);
       const explicitCompareSourceUrl =
         params.compareSourceUrl === undefined
@@ -5691,13 +5991,20 @@ export function AgentGenerationWorkspaceDarkV2({
           explicitCompareSourceUrl === undefined
             ? previousRecord?.compareSourceUrl || null
             : explicitCompareSourceUrl,
+        referenceImageUrl: referenceCard?.imageUrl || previousRecord?.referenceImageUrl || null,
+        referencePreviewUrl:
+          referenceCard?.previewUrl || previousRecord?.referencePreviewUrl || null,
+        label: referenceCard?.label || previousRecord?.label || null,
       };
 
       if (
         previousRecord?.url === nextRecord.url &&
         previousRecord?.text === nextRecord.text &&
         previousRecord?.status === nextRecord.status &&
-        previousRecord?.compareSourceUrl === nextRecord.compareSourceUrl
+        previousRecord?.compareSourceUrl === nextRecord.compareSourceUrl &&
+        previousRecord?.referenceImageUrl === nextRecord.referenceImageUrl &&
+        previousRecord?.referencePreviewUrl === nextRecord.referencePreviewUrl &&
+        previousRecord?.label === nextRecord.label
       ) {
         return current;
       }
@@ -5710,7 +6017,7 @@ export function AgentGenerationWorkspaceDarkV2({
         },
       };
     });
-  }, []);
+  }, [detailReplacementReferenceCards, skuReplacementReferenceCards]);
   const handleOpenReplacementTextEdit = useCallback((params: {
     modeType: ReplacementModeType;
     cardId: string;
@@ -6059,7 +6366,15 @@ export function AgentGenerationWorkspaceDarkV2({
       toast.success(`继续处理剩余 ${replacementExecutionCards.length} 张结果图`);
     }
     try {
-      sendMessage({ role: "user", parts });
+      void Promise.resolve(sendMessage({ role: "user", parts })).catch((error) => {
+        generationRequestSnapshotRef.current = {
+          hiddenPrompt: null,
+          replacementExecutionCardIds: null,
+          replacementRerunReferenceImages: null,
+        };
+        setPendingGeneration(null);
+        toast.error(error instanceof Error ? error.message : "发送生成请求失败");
+      });
       if (selectedAgentPreset?.type !== "image") {
         setInput("");
       }
@@ -6646,15 +6961,19 @@ export function AgentGenerationWorkspaceDarkV2({
         : selectedModelId !== "auto"
           ? selectedModelId
           : effectiveDefaultModelId || undefined;
+      const requestedImageSize: DetailResultLocalEditImageSize =
+        params.imageSize === "2K" ? "2K" : "1K";
 
       setDetailLocalEditSubmittingId(cardId);
       setDetailLocalEditSubmittingMode(editMode);
-      toast.info(isScaleAdjust ? "正在提交比例调整..." : "正在提交局部编辑...");
+      toast.info(
+        `${isScaleAdjust ? "正在提交比例调整" : "正在提交局部编辑"}（${requestedImageSize}）...`
+      );
 
       try {
         const submitResult = await imageGenerationService.localEdit({
           aspectRatio: "auto",
-          imageSize: "2K",
+          imageSize: requestedImageSize,
           model:
             resolvedLocalEditModelId && resolvedLocalEditModelId !== "auto"
               ? resolvedLocalEditModelId
@@ -6872,6 +7191,23 @@ export function AgentGenerationWorkspaceDarkV2({
         delete next[normalizedUrl];
         return next;
       });
+      if (modeType === "detail_replacement" || modeType === "sku_replacement") {
+        setReplacementResultState((current) => {
+          const currentModeState = current[modeType];
+          const nextModeState = Object.fromEntries(
+            Object.entries(currentModeState).filter(
+              ([, record]) => record.url !== normalizedUrl
+            )
+          );
+          if (Object.keys(nextModeState).length === Object.keys(currentModeState).length) {
+            return current;
+          }
+          return {
+            ...current,
+            [modeType]: nextModeState,
+          };
+        });
+      }
 
       onDeleteResultImage(modeType, normalizedUrl);
       toast.success("结果图已删除");
@@ -9350,6 +9686,7 @@ export function AgentGenerationWorkspaceDarkV2({
                         imageUrls: detailReplacementOrderedDownloadUrls,
                         zipName: `${selectedAgentPreset?.name || "detail-replacement"}-results`,
                         scope: "detail",
+                        modeType: "detail_replacement",
                       })
                     }
                     disabled={batchDownloadState === "detail"}
@@ -9367,6 +9704,7 @@ export function AgentGenerationWorkspaceDarkV2({
                         imageUrls: mergedResultCollections.detail_generation,
                         zipName: `${selectedAgentPreset?.name || "ai-detail"}-results`,
                         scope: "detail",
+                        modeType: "detail_generation",
                       })
                     }
                     disabled={batchDownloadState === "detail"}
@@ -9384,6 +9722,7 @@ export function AgentGenerationWorkspaceDarkV2({
                         imageUrls: skuReplacementOrderedDownloadUrls,
                         zipName: `${selectedAgentPreset?.name || "sku-replacement"}-results`,
                         scope: "sku",
+                        modeType: "sku_replacement",
                       })
                     }
                     disabled={batchDownloadState === "sku"}
@@ -9400,6 +9739,7 @@ export function AgentGenerationWorkspaceDarkV2({
                         imageUrls: activeResultModeUrls,
                         zipName: `${selectedAgentPreset?.name || "scene-generation"}-results`,
                         scope: "scene",
+                        modeType: "scene_generation",
                       })
                     }
                     disabled={batchDownloadState === "scene"}