feat: 工具配置增强、站点拨测与日志中心多项改进

- 工具配置：新增卸载 API/UI、Go 工具链、流水线构建自动安装依赖
- 修复 ListTools VerifyTool 递归栈溢出导致获取工具配置失败
- Node.js Alpine 安装改用 unofficial-builds musl 预编译包与 index.json 解析 LTS
- 站点拨测：详情页路由、告警自动恢复、并发拨测与默认可观测频率
- 日志中心：RBAC、查询构建器、ES/Loki 增强与审计 request/response 展示
- 发布配置：构建节点、流水线远程执行、Deploy RBAC 导航拆分

backend/controller/agent_install.go

@@ -58,9 +58,9 @@ func truncateAuditText(s string, n int) string {
 	return s
 }
 
-// recordAgentAudit 记录 Agent 安装/卸载/升级操作审计 // Logan.Li
-// status: 1=成功, 0=失败；errMsg 记录失败原因（SSH 错误、脚本输出等），用于追溯"安装过程遇到什么问题"
-func (h *AgentInstallHandler) recordAgentAudit(ac auditCtx, action, resource, resourceID string, status int, errMsg string) {
+// recordAgentAudit 记录 Agent 安装/卸载/升级操作审计（含命令输出与验证结果）// Logan.Li
+// status: 1=成功, 0=失败
+func (h *AgentInstallHandler) recordAgentAudit(ac auditCtx, action, resource, resourceID string, status int, reqDetail, respDetail, errMsg string) {
 	uid := ac.userID
 	h.db.Create(&model.AuditLog{
 		UserID:     &uid,
@@ -71,8 +71,10 @@ func (h *AgentInstallHandler) recordAgentAudit(ac auditCtx, action, resource, re
 		Action:     action,
 		Resource:   resource,
 		ResourceID: resourceID,
+		Request:    truncateAuditText(reqDetail, 2048),
+		Response:   truncateAuditText(respDetail, 8192),
 		Status:     status,
-		Error:      errMsg,
+		Error:      truncateAuditText(errMsg, 512),
 	})
 }
 
@@ -235,7 +237,7 @@ func (h *AgentInstallHandler) InstallAgent(c *gin.Context) {
 	client, err := sshDial(effectiveServer)
 	if err != nil {
 		log.Printf("[AgentInstall] SSH连接失败 %s: %v", server.IP, err)
-		h.recordAgentAudit(ac, "install", resource, resourceID, 0, "SSH连接失败: "+formatSSHError(err))
+		h.recordAgentAudit(ac, "install", resource, resourceID, 0, resource, "", "SSH连接失败: "+formatSSHError(err))
 		c.JSON(http.StatusOK, model.Response{
 			Code:    500,
 			Message: "SSH 连接失败: " + formatSSHError(err),
@@ -296,7 +298,8 @@ func (h *AgentInstallHandler) InstallAgent(c *gin.Context) {
 		} else if strings.Contains(lowerOut, "下载失败") || strings.Contains(lowerOut, "failed to connect") || strings.Contains(lowerOut, "connection refused") {
 			msg = "目标主机无法下载安装脚本，请检查后端地址 " + serverURL + " 是否可达"
 		}
-		h.recordAgentAudit(ac, "install", resource, resourceID, 0, msg+": "+truncateAuditText(installOut, 300))
+		h.recordAgentAudit(ac, "install", resource, resourceID, 0,
+			fmt.Sprintf("server=%s arch=%s", serverURL, arch), installOut, msg)
 		c.JSON(http.StatusOK, model.Response{
 			Code:    500,
 			Message: msg,
@@ -309,23 +312,30 @@ func (h *AgentInstallHandler) InstallAgent(c *gin.Context) {
 	verifyOut, _ := runSSHCommand(client, "systemctl is-active aiops-agent 2>/dev/null || echo 'not_found'")
 	installed := contains(verifyOut, "active") || contains(verifyOut, "running")
 
+	var agentVer string
 	if installed {
 		// 只更新在线状态；版本号仅在能读到真实版本时才写入，未上报时不写假版本（等 Agent 首次上报真实数据）// Logan.Li
 		updates := map[string]interface{}{
 			"agent_status":  "online",
 			"last_check_at": time.Now(),
 		}
-		if agentVersion := detectAgentVersion(client); agentVersion != "" {
-			updates["agent_version"] = agentVersion
+		agentVer = detectAgentVersion(client)
+		if agentVer != "" {
+			updates["agent_version"] = agentVer
 		}
 		h.db.Model(&server).Updates(updates)
 	}
 
 	// 审计：成功或"命令已执行但服务未运行"均记录，便于追溯 // Logan.Li
+	reqDetail := fmt.Sprintf("server=%s arch=%s", serverURL, arch)
+	respDetail := fmt.Sprintf("=== 安装输出 ===\n%s\n=== 服务状态 ===\n%s", installOut, verifyOut)
+	if agentVer != "" {
+		respDetail += "\n=== Agent版本 ===\n" + agentVer
+	}
 	if installed {
-		h.recordAgentAudit(ac, "install", resource, resourceID, 1, "")
+		h.recordAgentAudit(ac, "install", resource, resourceID, 1, reqDetail, respDetail, "")
 	} else {
-		h.recordAgentAudit(ac, "install", resource, resourceID, 0, "安装命令已执行但服务未检测到运行: "+truncateAuditText(verifyOut, 300))
+		h.recordAgentAudit(ac, "install", resource, resourceID, 0, reqDetail, respDetail, "安装命令已执行但服务未检测到运行")
 	}
 
 	c.JSON(http.StatusOK, model.Response{
@@ -434,20 +444,22 @@ func (h *AgentInstallHandler) BatchInstallAgent(c *gin.Context) {
 				}
 			}
 
-			installed, _, verifyOut, err := h.installOne(effectiveServer, serverURL, token)
+			installed, installOut, verifyOut, err := h.installOne(effectiveServer, serverURL, token)
 			res := server.Hostname + " (" + server.IP + ")"
 			rid := strconv.Itoa(int(server.ID))
+			reqDetail := fmt.Sprintf("server=%s host=%s", serverURL, res)
 			if err != nil {
 				log.Printf("[BatchInstall] %s (%s) 安装失败: %v", server.Hostname, server.IP, err)
-				h.recordAgentAudit(ac, "install", res, rid, 0, truncateAuditText(err.Error(), 500))
+				h.recordAgentAudit(ac, "install", res, rid, 0, reqDetail, installOut, truncateAuditText(err.Error(), 500))
 			} else {
 				successCount++
+				respDetail := fmt.Sprintf("=== 安装输出 ===\n%s\n=== 服务状态 ===\n%s", installOut, verifyOut)
 				if installed {
 					log.Printf("[BatchInstall] %s Agent 安装成功", server.Hostname)
-					h.recordAgentAudit(ac, "install", res, rid, 1, "")
+					h.recordAgentAudit(ac, "install", res, rid, 1, reqDetail, respDetail, "")
 				} else {
 					log.Printf("[BatchInstall] %s Agent 安装命令已执行但服务未检测到运行", server.Hostname)
-					h.recordAgentAudit(ac, "install", res, rid, 0, "服务未检测到运行: "+truncateAuditText(verifyOut, 300))
+					h.recordAgentAudit(ac, "install", res, rid, 0, reqDetail, respDetail, "服务未检测到运行")
 				}
 			}
 		}
@@ -498,14 +510,14 @@ func (h *AgentInstallHandler) UninstallAgent(c *gin.Context) {
 		h.db.Model(&server).Updates(map[string]interface{}{
 			"agent_status": "offline", "agent_version": "",
 		})
-		h.recordAgentAudit(ac, "uninstall", resource, resourceID, 1, "无SSH凭据，已标记离线")
+		h.recordAgentAudit(ac, "uninstall", resource, resourceID, 1, resource, "无SSH凭据，已标记离线", "")
 		c.JSON(http.StatusOK, model.Response{Code: 200, Message: "已标记为离线（该主机无SSH凭据，无法远程卸载，请手动执行 systemctl stop aiops-agent）"})
 		return
 	}
 
 	client, err := sshDial(server)
 	if err != nil {
-		h.recordAgentAudit(ac, "uninstall", resource, resourceID, 0, "SSH连接失败: "+formatSSHError(err))
+		h.recordAgentAudit(ac, "uninstall", resource, resourceID, 0, resource, "", "SSH连接失败: "+formatSSHError(err))
 		c.JSON(http.StatusOK, model.Response{Code: 500, Message: "SSH连接失败: " + formatSSHError(err)})
 		return
 	}
@@ -516,7 +528,7 @@ func (h *AgentInstallHandler) UninstallAgent(c *gin.Context) {
 	h.db.Model(&server).Updates(map[string]interface{}{
 		"agent_status": "offline", "agent_version": "",
 	})
-	h.recordAgentAudit(ac, "uninstall", resource, resourceID, 1, "")
+	h.recordAgentAudit(ac, "uninstall", resource, resourceID, 1, resource, "systemctl stop + rm binary", "")
 
 	c.JSON(http.StatusOK, model.Response{Code: 200, Message: fmt.Sprintf("已卸载 %s (%s) 的 Agent", server.Hostname, server.IP)})
 }
@@ -548,21 +560,21 @@ func (h *AgentInstallHandler) BatchUninstallAgent(c *gin.Context) {
 			if server.Username == "" || (server.Password == "" && server.SSHKey == "") {
 				h.db.Model(&server).Updates(map[string]interface{}{"agent_status": "offline", "agent_version": ""})
 				log.Printf("[BatchUninstall] %s 无SSH凭据，已标记离线", server.Hostname)
-				h.recordAgentAudit(ac, "uninstall", res, rid, 1, "无SSH凭据，已标记离线")
+				h.recordAgentAudit(ac, "uninstall", res, rid, 1, res, "无SSH凭据，已标记离线", "")
 				successCount++
 				continue
 			}
 			client, err := sshDial(server)
 			if err != nil {
 				log.Printf("[BatchUninstall] %s SSH失败: %v", server.Hostname, err)
-				h.recordAgentAudit(ac, "uninstall", res, rid, 0, "SSH连接失败: "+formatSSHError(err))
+				h.recordAgentAudit(ac, "uninstall", res, rid, 0, res, "", "SSH连接失败: "+formatSSHError(err))
 				continue
 			}
 			runSSHCommand(client, "systemctl stop aiops-agent 2>/dev/null; systemctl disable aiops-agent 2>/dev/null; rm -f /usr/local/bin/aiops-agent /etc/systemd/system/aiops-agent.service; systemctl daemon-reload 2>/dev/null")
 			client.Close()
 			h.db.Model(&server).Updates(map[string]interface{}{"agent_status": "offline", "agent_version": ""})
 			log.Printf("[BatchUninstall] %s Agent 已卸载", server.Hostname)
-			h.recordAgentAudit(ac, "uninstall", res, rid, 1, "")
+			h.recordAgentAudit(ac, "uninstall", res, rid, 1, res, "systemctl stop + rm binary", "")
 			successCount++
 		}
 		log.Printf("[BatchUninstall] 批量卸载完成: %d/%d 成功", successCount, len(req.ServerIDs))
@@ -610,7 +622,7 @@ func (h *AgentInstallHandler) BatchUpgradeAgent(c *gin.Context) {
 			client, err := sshDial(server)
 			if err != nil {
 				log.Printf("[BatchUpgrade] %s SSH连接失败: %v", server.Hostname, err)
-				h.recordAgentAudit(ac, "upgrade", res, rid, 0, "SSH连接失败: "+formatSSHError(err))
+				h.recordAgentAudit(ac, "upgrade", res, rid, 0, res, "", "SSH连接失败: "+formatSSHError(err))
 				continue
 			}
 
@@ -631,7 +643,8 @@ func (h *AgentInstallHandler) BatchUpgradeAgent(c *gin.Context) {
 
 			if err != nil || !contains(out, "UPGRADE_OK") {
 				log.Printf("[BatchUpgrade] %s 升级失败: output=%s err=%v", server.Hostname, out, err)
-				h.recordAgentAudit(ac, "upgrade", res, rid, 0, "升级失败: "+truncateAuditText(out, 300))
+				h.recordAgentAudit(ac, "upgrade", res, rid, 0,
+					fmt.Sprintf("server=%s binary=%s", serverURL, binaryFile), out, "升级失败")
 				continue
 			}
 
@@ -647,7 +660,8 @@ func (h *AgentInstallHandler) BatchUpgradeAgent(c *gin.Context) {
 				"last_check_at": time.Now(),
 			})
 			log.Printf("[BatchUpgrade] %s Agent 升级成功", server.Hostname)
-			h.recordAgentAudit(ac, "upgrade", res, rid, 1, "")
+			h.recordAgentAudit(ac, "upgrade", res, rid, 1,
+				fmt.Sprintf("server=%s binary=%s", serverURL, binaryFile), out, "")
 			successCount++
 		}
 		log.Printf("[BatchUpgrade] 批量升级完成: %d/%d 成功", successCount, len(req.ServerIDs))

backend/controller/alert_engine.go

@@ -67,7 +67,7 @@ func (e *AlertEngine) Check() {
 	e.checkMiddlewareAlerts()
 	e.checkSNMPAlerts()
 	e.checkSiteAlerts()
-	e.autoResolveSiteSslAlerts()
+	e.autoResolveSiteAlerts()
 	e.checkLogAlertRules()
 	e.autoResolveAlerts()
 	e.checkLogAlertRecovery()

backend/controller/alert_engine_monitor.go

@@ -192,6 +192,7 @@ func (e *AlertEngine) evalSiteRule(rule model.MonitorAlertRule, task model.SiteT
 	}
 
 	if !triggered {
+		e.resolveActiveSiteAlerts(task.ID, rule.Metric)
 		return
 	}
 
@@ -294,22 +295,79 @@ func extractHostMetricValue(report model.AgentReport, metric string) (float64, b
 	}
 }
 
-// autoResolveSiteSslAlerts 证书续期后自动恢复 SSL 过期告警 // Logan.Li
-func (e *AlertEngine) autoResolveSiteSslAlerts() {
+// resolveActiveSiteAlerts 指标恢复正常时关闭对应活跃告警 // Logan.Li
+func (e *AlertEngine) resolveActiveSiteAlerts(taskID uint, triggerType string) {
+	now := time.Now()
+	e.db.Model(&model.SiteAlert{}).
+		Where("task_id = ? AND status = ? AND trigger_type = ?", taskID, model.SiteAlertStatusActive, triggerType).
+		Updates(map[string]interface{}{
+			"status": model.SiteAlertStatusResolved, "resolved_at": now,
+		})
+}
+
+// siteRuleStillTriggered 判断任务是否仍满足告警规则 // Logan.Li
+func (e *AlertEngine) siteRuleStillTriggered(rule model.MonitorAlertRule, task model.SiteTask) bool {
+	switch rule.Metric {
+	case "probe_fail":
+		return task.LastResult == "fail" || task.LastResult == "timeout"
+	case "probe_timeout":
+		return task.LastResult == "timeout"
+	case "http_status_error":
+		return task.LastResult == "fail"
+	case "response_time":
+		return e.compareOperator(rule.Operator, task.AvgResponse, rule.Threshold)
+	case "availability":
+		return e.compareOperator(rule.Operator, task.SuccessRate, rule.Threshold)
+	case "ssl_expiry_days":
+		if !siteprobe.IsSSLProbeTask(task) {
+			return false
+		}
+		var result model.SiteResult
+		e.db.Where("task_id = ? AND ssl_cert_expiry IS NOT NULL", task.ID).
+			Order("checked_at DESC").First(&result)
+		if result.ID == 0 {
+			return false
+		}
+		return e.compareOperator(rule.Operator, float64(result.SSLDaysRemaining), rule.Threshold)
+	default:
+		return true
+	}
+}
+
+// autoResolveSiteAlerts 扫描活跃拨测告警，指标已恢复则自动关闭（含 SSL）// Logan.Li
+func (e *AlertEngine) autoResolveSiteAlerts() {
 	var alerts []model.SiteAlert
-	e.db.Where("status = ? AND trigger_type = ?", model.SiteAlertStatusActive, "ssl_expiry_days").Find(&alerts)
+	e.db.Where("status = ?", model.SiteAlertStatusActive).Find(&alerts)
 	if len(alerts) == 0 {
 		return
 	}
+	taskCache := map[uint]model.SiteTask{}
+	ruleCache := map[string]model.MonitorAlertRule{}
 	now := time.Now()
 	for _, alert := range alerts {
-		var result model.SiteResult
-		e.db.Where("task_id = ? AND ssl_cert_expiry IS NOT NULL", alert.TaskID).
-			Order("checked_at DESC").First(&result)
-		if result.ID == 0 {
-			continue
+		task, ok := taskCache[alert.TaskID]
+		if !ok {
+			var t model.SiteTask
+			if e.db.First(&t, alert.TaskID).Error != nil {
+				continue
+			}
+			task = t
+			taskCache[alert.TaskID] = task
 		}
-		if float64(result.SSLDaysRemaining) >= 30 {
+		rule, ok := ruleCache[alert.Title]
+		if !ok {
+			var r model.MonitorAlertRule
+			e.db.Where("category = ? AND name = ?", model.MonitorAlertSite, alert.Title).First(&r)
+			if r.ID == 0 {
+				r.Metric = alert.TriggerType
+			}
+			rule = r
+			ruleCache[alert.Title] = rule
+		}
+		if rule.Metric == "" {
+			rule.Metric = alert.TriggerType
+		}
+		if !e.siteRuleStillTriggered(rule, task) {
 			e.db.Model(&alert).Updates(map[string]interface{}{
 				"status": model.SiteAlertStatusResolved, "resolved_at": now,
 			})

backend/controller/build_node.go

@@ -0,0 +1,224 @@
+package controller
+
+import (
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"ezops/model"
+	"ezops/pkg/remoteexec"
+
+	"github.com/gin-gonic/gin"
+)
+
+// ListBuildNodes 构建节点列表 // Logan.Li
+func (h *PipelineHandler) ListBuildNodes(c *gin.Context) {
+	masterCfg := h.ensureBuildMasterConfig()
+	var nodes []model.BuildNode
+	h.db.Order("id ASC").Find(&nodes)
+
+	// 填充运行时负载与服务器信息
+	nodeMu.Lock()
+	for i := range nodes {
+		nodes[i].RunningCount = nodeRunningCount[nodes[i].ID]
+		var srv model.Server
+		if err := h.db.First(&srv, nodes[i].ServerID).Error; err == nil {
+			nodes[i].Hostname = srv.Hostname
+			nodes[i].IP = srv.IP
+		}
+	}
+	masterRunning := nodeRunningCount[0]
+	nodeMu.Unlock()
+
+	c.JSON(http.StatusOK, model.Response{
+		Code: 200,
+		Data: map[string]interface{}{
+			"list": nodes,
+			"total": len(nodes),
+			"master": map[string]interface{}{
+				"name":          "Master",
+				"max_executors": masterCfg.MaxExecutors,
+				"running_count": masterRunning,
+			},
+		},
+	})
+}
+
+// CreateBuildNode 创建构建节点 // Logan.Li
+func (h *PipelineHandler) CreateBuildNode(c *gin.Context) {
+	var req model.CreateBuildNodeRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "参数错误: " + err.Error()})
+		return
+	}
+	req.Name = strings.TrimSpace(req.Name)
+	if req.Name == "" {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "节点名称不能为空"})
+		return
+	}
+	var srv model.Server
+	if err := h.db.First(&srv, req.ServerID).Error; err != nil {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "关联服务器不存在"})
+		return
+	}
+	var dup int64
+	h.db.Model(&model.BuildNode{}).Where("name = ?", req.Name).Count(&dup)
+	if dup > 0 {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "节点名称已存在"})
+		return
+	}
+
+	node := model.BuildNode{
+		Name:          req.Name,
+		Description:   req.Description,
+		ServerID:      req.ServerID,
+		Labels:        req.Labels,
+		MaxExecutors:  req.MaxExecutors,
+		WorkspacePath: req.WorkspacePath,
+		Enabled:       true,
+	}
+	if node.MaxExecutors <= 0 {
+		node.MaxExecutors = 2
+	}
+	if strings.TrimSpace(node.WorkspacePath) == "" {
+		node.WorkspacePath = "/data/aiops-workspace"
+	}
+
+	if err := h.db.Create(&node).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "创建失败"})
+		return
+	}
+	node.Hostname = srv.Hostname
+	node.IP = srv.IP
+	c.JSON(http.StatusOK, model.Response{Code: 200, Message: "创建成功", Data: node})
+}
+
+// UpdateBuildNode 更新构建节点 // Logan.Li
+func (h *PipelineHandler) UpdateBuildNode(c *gin.Context) {
+	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
+	var node model.BuildNode
+	if err := h.db.First(&node, id).Error; err != nil {
+		c.JSON(http.StatusNotFound, model.Response{Code: 404, Message: "节点不存在"})
+		return
+	}
+	var req model.UpdateBuildNodeRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "参数错误"})
+		return
+	}
+	updates := map[string]interface{}{}
+	if req.Name != "" {
+		updates["name"] = strings.TrimSpace(req.Name)
+	}
+	if req.Description != "" {
+		updates["description"] = req.Description
+	}
+	if req.ServerID != nil {
+		var srv model.Server
+		if err := h.db.First(&srv, *req.ServerID).Error; err != nil {
+			c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "关联服务器不存在"})
+			return
+		}
+		updates["server_id"] = *req.ServerID
+	}
+	if req.Labels != "" {
+		updates["labels"] = req.Labels
+	}
+	if req.MaxExecutors > 0 {
+		updates["max_executors"] = req.MaxExecutors
+	}
+	if req.WorkspacePath != "" {
+		updates["workspace_path"] = req.WorkspacePath
+	}
+	if req.Enabled != nil {
+		updates["enabled"] = *req.Enabled
+	}
+	if len(updates) == 0 {
+		c.JSON(http.StatusOK, model.Response{Code: 200, Data: node})
+		return
+	}
+	if err := h.db.Model(&node).Updates(updates).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "更新失败"})
+		return
+	}
+	h.db.First(&node, id)
+	c.JSON(http.StatusOK, model.Response{Code: 200, Message: "更新成功", Data: node})
+}
+
+// DeleteBuildNode 删除构建节点 // Logan.Li
+func (h *PipelineHandler) DeleteBuildNode(c *gin.Context) {
+	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
+	var inUse int64
+	h.db.Model(&model.Pipeline{}).Where("build_node_id = ?", id).Count(&inUse)
+	if inUse > 0 {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "仍有流水线绑定此节点，请先解除关联"})
+		return
+	}
+	if err := h.db.Delete(&model.BuildNode{}, id).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "删除失败"})
+		return
+	}
+	c.JSON(http.StatusOK, model.Response{Code: 200, Message: "删除成功"})
+}
+
+// TestBuildNode 测试构建节点 SSH 连通性 // Logan.Li
+func (h *PipelineHandler) TestBuildNode(c *gin.Context) {
+	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
+	var node model.BuildNode
+	if err := h.db.First(&node, id).Error; err != nil {
+		c.JSON(http.StatusNotFound, model.Response{Code: 404, Message: "节点不存在"})
+		return
+	}
+	var srv model.Server
+	if err := h.db.First(&srv, node.ServerID).Error; err != nil {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "关联服务器不存在"})
+		return
+	}
+	cfg, err := buildSSHConfig(h.db, srv)
+	if err != nil {
+		c.JSON(http.StatusOK, model.Response{Code: 200, Data: map[string]interface{}{
+			"success": false, "message": err.Error(),
+		}})
+		return
+	}
+	result, err := remoteexec.Exec(cfg, "echo aiops-node-ok && uname -a", 15*time.Second)
+	if err != nil || !result.Success {
+		msg := ""
+		if result != nil {
+			msg = result.Error
+			if msg == "" {
+				msg = result.Output
+			}
+		}
+		if err != nil {
+			msg = err.Error()
+		}
+		c.JSON(http.StatusOK, model.Response{Code: 200, Data: map[string]interface{}{
+			"success": false, "message": msg,
+		}})
+		return
+	}
+	c.JSON(http.StatusOK, model.Response{Code: 200, Data: map[string]interface{}{
+		"success": true, "message": strings.TrimSpace(result.Output),
+	}})
+}
+
+// UpdateBuildMaster 更新 Master 内置节点最大并发（1=串行按触发顺序排队） // Logan.Li
+func (h *PipelineHandler) UpdateBuildMaster(c *gin.Context) {
+	var req model.UpdateBuildMasterRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "参数错误: " + err.Error()})
+		return
+	}
+	cfg := h.setMasterMaxExecutors(req.MaxExecutors)
+	nodeMu.Lock()
+	running := nodeRunningCount[masterNodeID]
+	nodeMu.Unlock()
+	c.JSON(http.StatusOK, model.Response{
+		Code: 200, Message: "已更新",
+		Data: map[string]interface{}{
+			"name": "Master", "max_executors": cfg.MaxExecutors, "running_count": running,
+		},
+	})
+}

backend/controller/log_datasource.go

@@ -5,13 +5,17 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"io"
 	"log"
 	"net/http"
+	"strconv"
 	"strings"
 	"time"
 
+	"ezops/middleware"
 	"ezops/model"
+	"ezops/pkg/logaccess"
 
 	"github.com/gin-gonic/gin"
 	"gorm.io/gorm"
@@ -40,6 +44,7 @@ func (h *LogDSHandler) List(c *gin.Context) {
 	if sources == nil {
 		sources = []model.LogDataSource{}
 	}
+	sources = logaccess.FilterDataSources(h.db, middleware.GetUserID(c), middleware.GetIsAdmin(c), sources)
 	// 按项目惯例返回 {list,total}，前端 listDatasources 取 .list // Logan.Li
 	c.JSON(200, model.Response{Code: 200, Data: model.ListResponse{List: sources, Total: int64(len(sources))}})
 }
@@ -268,6 +273,67 @@ func (h *LogDSHandler) ListIndices(c *gin.Context) {
 	c.JSON(200, model.Response{Code: 200, Data: indices})
 }
 
+// ListIndicesByID GET /api/v1/log-datasources/:id/indices — 按数据源 ID 拉取索引（查询面板用）// Logan.Li
+func (h *LogDSHandler) ListIndicesByID(c *gin.Context) {
+	ds, err := loadLogDS(h, parseUintParam(c.Param("id")))
+	if err != nil {
+		c.JSON(404, model.Response{Code: 404, Message: "数据源不存在"})
+		return
+	}
+	if ds.Type != "elasticsearch" {
+		c.JSON(400, model.Response{Code: 400, Message: "仅 Elasticsearch 数据源支持索引列表"})
+		return
+	}
+	filtered := logaccess.FilterDataSources(h.db, middleware.GetUserID(c), middleware.GetIsAdmin(c), []model.LogDataSource{*ds})
+	if len(filtered) == 0 {
+		c.JSON(403, model.Response{Code: 403, Message: "无权访问该数据源"})
+		return
+	}
+	indices, err := fetchESIndices(ds)
+	if err != nil {
+		c.JSON(502, model.Response{Code: 502, Message: err.Error()})
+		return
+	}
+	c.JSON(200, model.Response{Code: 200, Data: indices})
+}
+
+func fetchESIndices(ds *model.LogDataSource) ([]string, error) {
+	client := newLogHTTPClient(ds.SkipTLSVerify, 15*time.Second)
+	target := strings.TrimRight(ds.URL, "/") + "/_cat/indices?format=json&h=index"
+	httpReq, err := http.NewRequest(http.MethodGet, target, nil)
+	if err != nil {
+		return nil, err
+	}
+	applyLogDSAuthV2(httpReq, ds)
+	resp, err := client.Do(httpReq)
+	if err != nil {
+		return nil, fmt.Errorf("查询索引失败: %w", err)
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode >= 400 {
+		return nil, fmt.Errorf("ES 错误: %s", string(body))
+	}
+	var raw []map[string]interface{}
+	if err := json.Unmarshal(body, &raw); err != nil {
+		return nil, fmt.Errorf("解析索引列表失败")
+	}
+	indices := make([]string, 0, len(raw))
+	for _, entry := range raw {
+		idx, ok := entry["index"].(string)
+		if !ok || idx == "" || strings.HasPrefix(idx, ".") {
+			continue
+		}
+		indices = append(indices, idx)
+	}
+	return indices, nil
+}
+
+func parseUintParam(s string) uint {
+	n, _ := strconv.ParseUint(s, 10, 64)
+	return uint(n)
+}
+
 func testLogDSConnection(req model.TestLogDSReq) (bool, string) {
 	client := newLogHTTPClient(req.SkipTLSVerify, 10*time.Second)
 	url := strings.TrimRight(req.URL, "/")

backend/controller/log_proxy.go

@@ -11,21 +11,25 @@ import (
 	"strings"
 	"time"
 
+	"ezops/middleware"
 	"ezops/model"
+	"ezops/pkg/logaccess"
 
 	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
 )
 
 // LogProxyHandler Loki / ES 无状态查询代理
 // 实时转发请求并解析展示字段，不将日志写入 AIOps 数据库 // Logan.Li
 type LogProxyHandler struct {
 	ds *LogDSHandler
+	db *gorm.DB
 }
 
 const maxLogQueryLimit = 1000 // 单次查询返回日志行数硬上限（Loki limit / ES size 共用）// Logan.Li
 
-func NewLogProxyHandler(ds *LogDSHandler) *LogProxyHandler {
-	return &LogProxyHandler{ds: ds}
+func NewLogProxyHandler(ds *LogDSHandler, db *gorm.DB) *LogProxyHandler {
+	return &LogProxyHandler{ds: ds, db: db}
 }
 
 // QueryLoki POST /api/v1/logs/loki/query
@@ -37,11 +41,19 @@ func (h *LogProxyHandler) QueryLoki(c *gin.Context) {
 		Start        string `json:"start"`
 		End          string `json:"end"`
 		Direction    string `json:"direction"`
+		Cursor       string `json:"cursor"` // 纳秒时间戳，向后翻页时作为 end // Logan.Li
 	}
 	if err := c.ShouldBindJSON(&req); err != nil {
 		c.JSON(400, model.Response{Code: 400, Message: err.Error()})
 		return
 	}
+	allowed, denyMsg := logaccess.CanQuery(h.db, middleware.GetUserID(c), middleware.GetIsAdmin(c), logaccess.QueryContext{
+		Engine: "loki", DatasourceID: req.DatasourceID, Query: req.Query,
+	})
+	if !allowed {
+		c.JSON(403, model.Response{Code: 403, Message: denyMsg})
+		return
+	}
 	ds, err := loadLogDS(h.ds, req.DatasourceID)
 	if err != nil || ds.Type != "loki" {
 		c.JSON(400, model.Response{Code: 400, Message: "Loki 数据源无效"})
@@ -68,6 +80,11 @@ func (h *LogProxyHandler) QueryLoki(c *gin.Context) {
 			start = t
 		}
 	}
+	if req.Cursor != "" {
+		if n, err := strconv.ParseInt(strings.TrimSpace(req.Cursor), 10, 64); err == nil && n > 0 {
+			end = time.Unix(0, n)
+		}
+	}
 
 	params := url.Values{}
 	params.Set("query", req.Query)
@@ -94,8 +111,12 @@ func (h *LogProxyHandler) QueryLoki(c *gin.Context) {
 	var raw map[string]interface{}
 	_ = json.Unmarshal(body, &raw)
 	entries := flattenLokiStreams(raw)
+	nextCursor := ""
+	if len(entries) > 0 && len(entries) >= req.Limit {
+		nextCursor = lokiEntryCursor(entries[len(entries)-1].Timestamp)
+	}
 	c.JSON(200, model.Response{Code: 200, Data: gin.H{
-		"entries": entries, "total": len(entries),
+		"entries": entries, "total": len(entries), "has_more": nextCursor != "", "next_cursor": nextCursor,
 	}})
 }
 
@@ -109,23 +130,33 @@ func (h *LogProxyHandler) QueryES(c *gin.Context) {
 		Size         int                    `json:"size"`
 		Start        string                 `json:"start"`
 		End          string                 `json:"end"`
+		SearchAfter  []interface{}          `json:"search_after"` // ES 深分页游标 // Logan.Li
 	}
 	if err := c.ShouldBindJSON(&req); err != nil {
 		c.JSON(400, model.Response{Code: 400, Message: err.Error()})
 		return
 	}
+	index := req.Index
+	if index == "" {
+		if dsPreview, err := loadLogDS(h.ds, req.DatasourceID); err == nil {
+			index = dsPreview.DefaultIndex
+		}
+	}
+	if index == "" {
+		index = "*"
+	}
+	allowed, denyMsg := logaccess.CanQuery(h.db, middleware.GetUserID(c), middleware.GetIsAdmin(c), logaccess.QueryContext{
+		Engine: "elasticsearch", DatasourceID: req.DatasourceID, Index: index, Query: req.Query,
+	})
+	if !allowed {
+		c.JSON(403, model.Response{Code: 403, Message: denyMsg})
+		return
+	}
 	ds, err := loadLogDS(h.ds, req.DatasourceID)
 	if err != nil || ds.Type != "elasticsearch" {
 		c.JSON(400, model.Response{Code: 400, Message: "Elasticsearch 数据源无效"})
 		return
 	}
-	index := req.Index
-	if index == "" {
-		index = ds.DefaultIndex
-	}
-	if index == "" {
-		index = "*"
-	}
 	if req.Size <= 0 {
 		req.Size = 200
 	}
@@ -140,7 +171,8 @@ func (h *LogProxyHandler) QueryES(c *gin.Context) {
 			// ES 7+ 默认 track_total_hits 为 10000，必须显式开启才能返回真实命中总数 // Logan.Li
 			"track_total_hits": true,
 			"sort": []interface{}{
-				map[string]interface{}{"_score": map[string]string{"order": "desc"}},
+				map[string]interface{}{"@timestamp": map[string]string{"order": "desc", "unmapped_type": "date"}},
+				map[string]interface{}{"_id": map[string]string{"order": "desc"}},
 			},
 			"query": map[string]interface{}{
 				"bool": map[string]interface{}{
@@ -206,6 +238,9 @@ func (h *LogProxyHandler) QueryES(c *gin.Context) {
 			}
 		}
 	}
+	if len(req.SearchAfter) > 0 {
+		searchBody["search_after"] = req.SearchAfter
+	}
 
 	payload, _ := json.Marshal(searchBody)
 	client := newLogHTTPClient(ds.SkipTLSVerify, 60*time.Second)
@@ -226,10 +261,11 @@ func (h *LogProxyHandler) QueryES(c *gin.Context) {
 	}
 	var raw map[string]interface{}
 	_ = json.Unmarshal(body, &raw)
-	entries := flattenESEntries(raw)
+	entries, nextSearchAfter := flattenESEntries(raw)
 	total := esHitsTotal(raw)
+	hasMore := len(entries) >= req.Size && len(nextSearchAfter) > 0
 	c.JSON(200, model.Response{Code: 200, Data: gin.H{
-		"entries": entries, "total": total,
+		"entries": entries, "total": total, "has_more": hasMore, "search_after": nextSearchAfter,
 	}})
 }
 
@@ -258,6 +294,28 @@ func logProxyErrCategory(status int) string {
 	}
 }
 
+// formatLokiTimestamp 将 Loki 纳秒/秒级（含科学计数法）时间戳转为 RFC3339 // Logan.Li
+func formatLokiTimestamp(ts string) string {
+	ts = strings.TrimSpace(ts)
+	if f, err := strconv.ParseFloat(ts, 64); err == nil {
+		if strings.Contains(ts, ".") || strings.Contains(strings.ToLower(ts), "e") {
+			sec := int64(f)
+			nsec := int64((f - float64(sec)) * 1e9)
+			return time.Unix(sec, nsec).UTC().Format(time.RFC3339)
+		}
+	}
+	if n, err := strconv.ParseInt(ts, 10, 64); err == nil {
+		if n > 1e15 {
+			return time.Unix(0, n).UTC().Format(time.RFC3339Nano)
+		}
+		if n > 1e12 {
+			return time.UnixMilli(n).UTC().Format(time.RFC3339Nano)
+		}
+		return time.Unix(n, 0).UTC().Format(time.RFC3339)
+	}
+	return ts
+}
+
 func parseLogTime(s string) (time.Time, error) {
 	if n, err := strconv.ParseInt(s, 10, 64); err == nil {
 		if n > 1e15 {
@@ -301,7 +359,7 @@ func flattenLokiStreams(raw map[string]interface{}) []logEntryRow {
 			if len(pair) < 2 {
 				continue
 			}
-			ts := fmt.Sprintf("%v", pair[0])
+			ts := formatLokiTimestamp(fmt.Sprintf("%v", pair[0]))
 			msg := fmt.Sprintf("%v", pair[1])
 			out = append(out, logEntryRow{
 				Timestamp: ts,
@@ -315,18 +373,19 @@ func flattenLokiStreams(raw map[string]interface{}) []logEntryRow {
 	return out
 }
 
-func flattenESEntries(raw map[string]interface{}) []logEntryRow {
+func flattenESEntries(raw map[string]interface{}) ([]logEntryRow, []interface{}) {
 	out := []logEntryRow{}
+	var nextAfter []interface{}
 	hitsWrap, _ := raw["hits"].(map[string]interface{})
 	hits, _ := hitsWrap["hits"].([]interface{})
-	for _, h := range hits {
+	for i, h := range hits {
 		doc, _ := h.(map[string]interface{})
 		src, _ := doc["_source"].(map[string]interface{})
 		if src == nil {
 			continue
 		}
 		msg := pickESMessage(src)
-		level, _ := src["level"].(string)
+		level := pickESLevel(src)
 		ts, _ := src["@timestamp"].(string)
 		if ts == "" {
 			ts = fmt.Sprintf("%v", src["timestamp"])
@@ -336,10 +395,63 @@ func flattenESEntries(raw map[string]interface{}) []logEntryRow {
 			Timestamp: ts,
 			Level:     level,
 			Message:   msg,
+			Labels:    extractESLabels(src),
 			Raw:       string(rawBytes),
 		})
+		if i == len(hits)-1 {
+			if sortVals, ok := doc["sort"].([]interface{}); ok {
+				nextAfter = sortVals
+			}
+		}
 	}
-	return out
+	return out, nextAfter
+}
+
+// lokiEntryCursor 从 RFC3339 时间戳反推纳秒游标 // Logan.Li
+func lokiEntryCursor(ts string) string {
+	if t, err := time.Parse(time.RFC3339Nano, ts); err == nil {
+		return strconv.FormatInt(t.UnixNano(), 10)
+	}
+	if t, err := time.Parse(time.RFC3339, ts); err == nil {
+		return strconv.FormatInt(t.UnixNano(), 10)
+	}
+	return ""
+}
+
+// extractESLabels 从 _source 提取常用字段作为 labels（便于字段过滤）// Logan.Li
+func extractESLabels(src map[string]interface{}) map[string]string {
+	labels := map[string]string{}
+	for _, key := range []string{"app", "service", "service_name", "host.name", "kubernetes.namespace", "namespace", "container.name", "level"} {
+		if v := pickESField(src, key); v != "" {
+			labels[key] = v
+		}
+	}
+	if lv := pickESLevel(src); lv != "" {
+		labels["level"] = lv
+	}
+	return labels
+}
+
+func pickESField(src map[string]interface{}, key string) string {
+	if strings.Contains(key, ".") {
+		parts := strings.Split(key, ".")
+		cur := interface{}(src)
+		for _, p := range parts {
+			m, ok := cur.(map[string]interface{})
+			if !ok {
+				return ""
+			}
+			cur, ok = m[p]
+			if !ok {
+				return ""
+			}
+		}
+		return stringifyESField(cur)
+	}
+	if v, ok := src[key]; ok {
+		return stringifyESField(v)
+	}
+	return ""
 }
 
 // esHitsTotal 从 ES 响应中提取真实命中总数（兼容 ES 7+ total.value 与旧版 total）// Logan.Li
@@ -356,10 +468,58 @@ func esHitsTotal(raw map[string]interface{}) int64 {
 	return 0
 }
 
+// pickESLevel 提取日志级别（兼容顶层 level 与 ECS/Filebeat 的 log.level） // Logan.Li
+func pickESLevel(src map[string]interface{}) string {
+	if v, ok := src["level"].(string); ok && v != "" {
+		return v
+	}
+	if v, ok := src["log.level"].(string); ok && v != "" {
+		return v
+	}
+	if logObj, ok := src["log"].(map[string]interface{}); ok {
+		if v, ok := logObj["level"].(string); ok && v != "" {
+			return v
+		}
+	}
+	return ""
+}
+
+// stringifyESField 将 ES 字段值转为展示字符串 // Logan.Li
+func stringifyESField(v interface{}) string {
+	switch t := v.(type) {
+	case string:
+		return t
+	case float64:
+		return fmt.Sprintf("%v", t)
+	case bool:
+		return fmt.Sprintf("%t", t)
+	default:
+		return ""
+	}
+}
+
+// pickESMessage 提取日志正文（兼容 message / ECS log.original / event.original） // Logan.Li
 func pickESMessage(src map[string]interface{}) string {
-	for _, key := range []string{"message", "msg", "log", "content"} {
+	for _, key := range []string{"message", "msg", "content", "event.original"} {
 		if v, ok := src[key]; ok {
-			return fmt.Sprintf("%v", v)
+			if s := stringifyESField(v); s != "" {
+				return s
+			}
+		}
+	}
+	if logObj, ok := src["log"].(map[string]interface{}); ok {
+		for _, key := range []string{"original", "message"} {
+			if v, ok := logObj[key]; ok {
+				if s := stringifyESField(v); s != "" {
+					return s
+				}
+			}
+		}
+	}
+	// 顶层 log 为字符串时（部分旧索引）
+	if v, ok := src["log"]; ok {
+		if s := stringifyESField(v); s != "" {
+			return s
 		}
 	}
 	b, _ := json.Marshal(src)

backend/controller/log_proxy_explore.go

@@ -0,0 +1,480 @@
+package controller
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+	"time"
+
+	"ezops/middleware"
+	"ezops/model"
+	"ezops/pkg/logaccess"
+
+	"github.com/gin-gonic/gin"
+)
+
+// 探索类 API（标签浏览 / 直方图）与 log_proxy.go 查询代理拆分 // Logan.Li
+
+// ListLokiLabels GET /api/v1/logs/loki/labels?datasource_id=&start=&end=
+func (h *LogProxyHandler) ListLokiLabels(c *gin.Context) {
+	dsID, _ := strconv.ParseUint(c.Query("datasource_id"), 10, 64)
+	if dsID == 0 {
+		c.JSON(400, model.Response{Code: 400, Message: "datasource_id 必填"})
+		return
+	}
+	ds, err := loadLogDS(h.ds, uint(dsID))
+	if err != nil || ds.Type != "loki" {
+		c.JSON(400, model.Response{Code: 400, Message: "Loki 数据源无效"})
+		return
+	}
+	start, end := parseLogTimeRange(c.Query("start"), c.Query("end"))
+	params := url.Values{}
+	params.Set("start", fmt.Sprintf("%d", start.UnixNano()))
+	params.Set("end", fmt.Sprintf("%d", end.UnixNano()))
+	client := newLogHTTPClient(ds.SkipTLSVerify, 15*time.Second)
+	target := strings.TrimRight(ds.URL, "/") + "/loki/api/v1/labels?" + params.Encode()
+	httpReq, _ := http.NewRequest(http.MethodGet, target, nil)
+	applyLogDSAuthV2(httpReq, ds)
+	resp, err := client.Do(httpReq)
+	if err != nil {
+		c.JSON(502, model.Response{Code: 502, Message: "查询标签失败: " + err.Error()})
+		return
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode >= 400 {
+		c.JSON(logProxyErrStatus(resp.StatusCode), model.Response{Code: logProxyErrStatus(resp.StatusCode), Message: "Loki 错误: " + string(body)})
+		return
+	}
+	var raw map[string]interface{}
+	_ = json.Unmarshal(body, &raw)
+	labels := extractStringSlice(raw["data"])
+	c.JSON(200, model.Response{Code: 200, Data: labels})
+}
+
+// ListLokiLabelValues GET /api/v1/logs/loki/labels/:name/values
+func (h *LogProxyHandler) ListLokiLabelValues(c *gin.Context) {
+	name := c.Param("name")
+	dsID, _ := strconv.ParseUint(c.Query("datasource_id"), 10, 64)
+	if dsID == 0 || name == "" {
+		c.JSON(400, model.Response{Code: 400, Message: "datasource_id 与 label 名必填"})
+		return
+	}
+	ds, err := loadLogDS(h.ds, uint(dsID))
+	if err != nil || ds.Type != "loki" {
+		c.JSON(400, model.Response{Code: 400, Message: "Loki 数据源无效"})
+		return
+	}
+	start, end := parseLogTimeRange(c.Query("start"), c.Query("end"))
+	params := url.Values{}
+	params.Set("start", fmt.Sprintf("%d", start.UnixNano()))
+	params.Set("end", fmt.Sprintf("%d", end.UnixNano()))
+	if q := extractLokiStreamSelector(strings.TrimSpace(c.Query("query"))); q != "" {
+		params.Set("query", q)
+	}
+	client := newLogHTTPClient(ds.SkipTLSVerify, 15*time.Second)
+	target := fmt.Sprintf("%s/loki/api/v1/label/%s/values?%s", strings.TrimRight(ds.URL, "/"), url.PathEscape(name), params.Encode())
+	httpReq, _ := http.NewRequest(http.MethodGet, target, nil)
+	applyLogDSAuthV2(httpReq, ds)
+	resp, err := client.Do(httpReq)
+	if err != nil {
+		c.JSON(502, model.Response{Code: 502, Message: "查询标签值失败: " + err.Error()})
+		return
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode >= 400 {
+		c.JSON(logProxyErrStatus(resp.StatusCode), model.Response{Code: logProxyErrStatus(resp.StatusCode), Message: "Loki 错误: " + string(body)})
+		return
+	}
+	var raw map[string]interface{}
+	_ = json.Unmarshal(body, &raw)
+	values := extractStringSlice(raw["data"])
+	c.JSON(200, model.Response{Code: 200, Data: values})
+}
+
+// LokiHistogram POST /api/v1/logs/loki/histogram — 服务端日志量直方图 // Logan.Li
+func (h *LogProxyHandler) LokiHistogram(c *gin.Context) {
+	var req struct {
+		DatasourceID uint   `json:"datasource_id" binding:"required"`
+		Query        string `json:"query" binding:"required"`
+		Start        string `json:"start"`
+		End          string `json:"end"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(400, model.Response{Code: 400, Message: err.Error()})
+		return
+	}
+	allowed, denyMsg := logaccess.CanQuery(h.db, middleware.GetUserID(c), middleware.GetIsAdmin(c), logaccess.QueryContext{
+		Engine: "loki", DatasourceID: req.DatasourceID, Query: req.Query,
+	})
+	if !allowed {
+		c.JSON(403, model.Response{Code: 403, Message: denyMsg})
+		return
+	}
+	ds, err := loadLogDS(h.ds, req.DatasourceID)
+	if err != nil || ds.Type != "loki" {
+		c.JSON(400, model.Response{Code: 400, Message: "Loki 数据源无效"})
+		return
+	}
+	start, end := parseLogTimeRange(req.Start, req.End)
+	step := pickHistogramStep(end.Sub(start))
+	metricQuery := fmt.Sprintf("sum(count_over_time(%s[%s]))", req.Query, step)
+	params := url.Values{}
+	params.Set("query", metricQuery)
+	params.Set("start", fmt.Sprintf("%d", start.UnixNano()))
+	params.Set("end", fmt.Sprintf("%d", end.UnixNano()))
+	params.Set("step", step)
+	client := newLogHTTPClient(ds.SkipTLSVerify, 30*time.Second)
+	target := strings.TrimRight(ds.URL, "/") + "/loki/api/v1/query_range?" + params.Encode()
+	httpReq, _ := http.NewRequest(http.MethodGet, target, nil)
+	applyLogDSAuthV2(httpReq, ds)
+	resp, err := client.Do(httpReq)
+	if err != nil {
+		c.JSON(502, model.Response{Code: 502, Message: "直方图查询失败: " + err.Error()})
+		return
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode >= 400 {
+		c.JSON(logProxyErrStatus(resp.StatusCode), model.Response{Code: logProxyErrStatus(resp.StatusCode), Message: "Loki 错误: " + string(body)})
+		return
+	}
+	var raw map[string]interface{}
+	_ = json.Unmarshal(body, &raw)
+	buckets := flattenLokiMetricSeries(raw)
+	c.JSON(200, model.Response{Code: 200, Data: gin.H{"buckets": buckets}})
+}
+
+// ESHistogram POST /api/v1/logs/elasticsearch/histogram — ES date_histogram 聚合 // Logan.Li
+func (h *LogProxyHandler) ESHistogram(c *gin.Context) {
+	var req struct {
+		DatasourceID uint   `json:"datasource_id" binding:"required"`
+		Index        string `json:"index"`
+		Query        string `json:"query"`
+		Start        string `json:"start"`
+		End          string `json:"end"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(400, model.Response{Code: 400, Message: err.Error()})
+		return
+	}
+	index := req.Index
+	if index == "" {
+		if dsPreview, err := loadLogDS(h.ds, req.DatasourceID); err == nil {
+			index = dsPreview.DefaultIndex
+		}
+	}
+	if index == "" {
+		index = "*"
+	}
+	allowed, denyMsg := logaccess.CanQuery(h.db, middleware.GetUserID(c), middleware.GetIsAdmin(c), logaccess.QueryContext{
+		Engine: "elasticsearch", DatasourceID: req.DatasourceID, Index: index, Query: req.Query,
+	})
+	if !allowed {
+		c.JSON(403, model.Response{Code: 403, Message: denyMsg})
+		return
+	}
+	ds, err := loadLogDS(h.ds, req.DatasourceID)
+	if err != nil || ds.Type != "elasticsearch" {
+		c.JSON(400, model.Response{Code: 400, Message: "Elasticsearch 数据源无效"})
+		return
+	}
+	start, end := parseLogTimeRange(req.Start, req.End)
+	interval := pickHistogramStep(end.Sub(start))
+	searchBody := buildESHistogramBody(req.Query, start, end, interval)
+	payload, _ := json.Marshal(searchBody)
+	client := newLogHTTPClient(ds.SkipTLSVerify, 30*time.Second)
+	target := fmt.Sprintf("%s/%s/_search", strings.TrimRight(ds.URL, "/"), strings.Trim(index, "/"))
+	httpReq, _ := http.NewRequest(http.MethodPost, target, bytes.NewReader(payload))
+	httpReq.Header.Set("Content-Type", "application/json")
+	applyLogDSAuthV2(httpReq, ds)
+	resp, err := client.Do(httpReq)
+	if err != nil {
+		c.JSON(502, model.Response{Code: 502, Message: "直方图查询失败: " + err.Error()})
+		return
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode >= 400 {
+		c.JSON(logProxyErrStatus(resp.StatusCode), model.Response{Code: logProxyErrStatus(resp.StatusCode), Message: "ES 错误: " + string(body)})
+		return
+	}
+	var raw map[string]interface{}
+	_ = json.Unmarshal(body, &raw)
+	buckets := flattenESHistogram(raw)
+	c.JSON(200, model.Response{Code: 200, Data: gin.H{"buckets": buckets}})
+}
+
+func parseLogTimeRange(startStr, endStr string) (time.Time, time.Time) {
+	end := time.Now()
+	start := end.Add(-1 * time.Hour)
+	if endStr != "" {
+		if t, e := parseLogTime(endStr); e == nil {
+			end = t
+		}
+	}
+	if startStr != "" {
+		if t, e := parseLogTime(startStr); e == nil {
+			start = t
+		}
+	}
+	return start, end
+}
+
+func pickHistogramStep(d time.Duration) string {
+	switch {
+	case d <= 15*time.Minute:
+		return "30s"
+	case d <= time.Hour:
+		return "1m"
+	case d <= 6*time.Hour:
+		return "5m"
+	case d <= 24*time.Hour:
+		return "15m"
+	case d <= 7*24*time.Hour:
+		return "1h"
+	default:
+		return "6h"
+	}
+}
+
+func extractStringSlice(v interface{}) []string {
+	arr, _ := v.([]interface{})
+	out := make([]string, 0, len(arr))
+	for _, item := range arr {
+		out = append(out, fmt.Sprintf("%v", item))
+	}
+	return out
+}
+
+func flattenLokiMetricSeries(raw map[string]interface{}) []map[string]interface{} {
+	out := []map[string]interface{}{}
+	data, _ := raw["data"].(map[string]interface{})
+	result, _ := data["result"].([]interface{})
+	for _, item := range result {
+		series, _ := item.(map[string]interface{})
+		values, _ := series["values"].([]interface{})
+		for _, val := range values {
+			pair, _ := val.([]interface{})
+			if len(pair) < 2 {
+				continue
+			}
+			ts := formatLokiMetricTimestamp(pair[0])
+			cnt, _ := strconv.ParseFloat(fmt.Sprintf("%v", pair[1]), 64)
+			out = append(out, map[string]interface{}{
+				"timestamp": ts,
+				"count":     int64(cnt),
+			})
+		}
+	}
+	return out
+}
+
+func buildESHistogramBody(query string, start, end time.Time, interval string) map[string]interface{} {
+	body := map[string]interface{}{
+		"size": 0,
+		"query": map[string]interface{}{
+			"bool": map[string]interface{}{
+				"must": []interface{}{
+					map[string]interface{}{"query_string": map[string]interface{}{"query": defaultESQuery(query)}},
+				},
+			},
+		},
+		"aggs": map[string]interface{}{
+			"log_volume": map[string]interface{}{
+				"date_histogram": map[string]interface{}{
+					"field":          "@timestamp",
+					"fixed_interval": interval,
+					"min_doc_count":  0,
+				},
+			},
+		},
+	}
+	rangeCond := map[string]interface{}{
+		"bool": map[string]interface{}{
+			"should": []interface{}{
+				map[string]interface{}{"range": map[string]interface{}{"@timestamp": map[string]string{
+					"gte": start.UTC().Format(time.RFC3339Nano),
+					"lte": end.UTC().Format(time.RFC3339Nano),
+				}}},
+				map[string]interface{}{"range": map[string]interface{}{"timestamp": map[string]string{
+					"gte": start.UTC().Format(time.RFC3339Nano),
+					"lte": end.UTC().Format(time.RFC3339Nano),
+				}}},
+			},
+			"minimum_should_match": 1,
+		},
+	}
+	body["query"] = map[string]interface{}{
+		"bool": map[string]interface{}{
+			"must": []interface{}{body["query"], rangeCond},
+		},
+	}
+	return body
+}
+
+func flattenESHistogram(raw map[string]interface{}) []map[string]interface{} {
+	out := []map[string]interface{}{}
+	aggs, _ := raw["aggregations"].(map[string]interface{})
+	vol, _ := aggs["log_volume"].(map[string]interface{})
+	buckets, _ := vol["buckets"].([]interface{})
+	for _, b := range buckets {
+		bucket, _ := b.(map[string]interface{})
+		ts, _ := bucket["key_as_string"].(string)
+		if ts == "" {
+			if key, ok := bucket["key"].(float64); ok {
+				ts = time.UnixMilli(int64(key)).UTC().Format(time.RFC3339Nano)
+			}
+		}
+		cnt, _ := bucket["doc_count"].(float64)
+		out = append(out, map[string]interface{}{"timestamp": ts, "count": int64(cnt)})
+	}
+	return out
+}
+
+// ESMapping GET /api/v1/logs/elasticsearch/mapping?datasource_id=&index=
+func (h *LogProxyHandler) ESMapping(c *gin.Context) {
+	dsID, _ := strconv.ParseUint(c.Query("datasource_id"), 10, 64)
+	index := strings.TrimSpace(c.Query("index"))
+	if dsID == 0 {
+		c.JSON(400, model.Response{Code: 400, Message: "datasource_id 必填"})
+		return
+	}
+	if index == "" {
+		index = "*"
+	}
+	allowed, denyMsg := logaccess.CanQuery(h.db, middleware.GetUserID(c), middleware.GetIsAdmin(c), logaccess.QueryContext{
+		Engine: "elasticsearch", DatasourceID: uint(dsID), Index: index, Query: "*",
+	})
+	if !allowed {
+		c.JSON(403, model.Response{Code: 403, Message: denyMsg})
+		return
+	}
+	ds, err := loadLogDS(h.ds, uint(dsID))
+	if err != nil || ds.Type != "elasticsearch" {
+		c.JSON(400, model.Response{Code: 400, Message: "Elasticsearch 数据源无效"})
+		return
+	}
+	client := newLogHTTPClient(ds.SkipTLSVerify, 20*time.Second)
+	target := fmt.Sprintf("%s/%s/_mapping", strings.TrimRight(ds.URL, "/"), strings.Trim(index, "/"))
+	httpReq, _ := http.NewRequest(http.MethodGet, target, nil)
+	applyLogDSAuthV2(httpReq, ds)
+	resp, err := client.Do(httpReq)
+	if err != nil {
+		c.JSON(502, model.Response{Code: 502, Message: "获取 mapping 失败: " + err.Error()})
+		return
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode >= 400 {
+		c.JSON(logProxyErrStatus(resp.StatusCode), model.Response{Code: logProxyErrStatus(resp.StatusCode), Message: "ES 错误: " + string(body)})
+		return
+	}
+	var raw map[string]interface{}
+	_ = json.Unmarshal(body, &raw)
+	fields := flattenESMapping(raw)
+	c.JSON(200, model.Response{Code: 200, Data: fields})
+}
+
+func flattenESMapping(raw map[string]interface{}) []map[string]string {
+	out := []map[string]string{}
+	seen := map[string]bool{}
+	var walk func(prefix string, props map[string]interface{})
+	walk = func(prefix string, props map[string]interface{}) {
+		for name, node := range props {
+			full := name
+			if prefix != "" {
+				full = prefix + "." + name
+			}
+			m, _ := node.(map[string]interface{})
+			if m == nil {
+				continue
+			}
+			if sub, ok := m["properties"].(map[string]interface{}); ok {
+				walk(full, sub)
+				continue
+			}
+			if fields, ok := m["fields"].(map[string]interface{}); ok {
+				walk(full, fields)
+			}
+			typ, _ := m["type"].(string)
+			if typ == "" {
+				typ = "object"
+			}
+			if !seen[full] {
+				seen[full] = true
+				out = append(out, map[string]string{"name": full, "type": mapESFieldType(typ)})
+			}
+		}
+	}
+	for _, idxDef := range raw {
+		idxMap, _ := idxDef.(map[string]interface{})
+		mappings, _ := idxMap["mappings"].(map[string]interface{})
+		props, _ := mappings["properties"].(map[string]interface{})
+		if props != nil {
+			walk("", props)
+		}
+	}
+	return out
+}
+
+func mapESFieldType(esType string) string {
+	switch esType {
+	case "keyword", "text", "match_only_text":
+		return "keyword"
+	case "long", "integer", "short", "byte", "double", "float", "half_float", "scaled_float":
+		return "long"
+	case "date", "date_nanos":
+		return "date"
+	case "boolean":
+		return "boolean"
+	case "ip":
+		return "ip"
+	default:
+		return "text"
+	}
+}
+
+// extractLokiStreamSelector 从 LogQL 提取 {...} 选择器（Label API 仅接受 stream selector）// Logan.Li
+func extractLokiStreamSelector(query string) string {
+	query = strings.TrimSpace(query)
+	start := strings.Index(query, "{")
+	if start < 0 {
+		return ""
+	}
+	depth := 0
+	for i := start; i < len(query); i++ {
+		switch query[i] {
+		case '{':
+			depth++
+		case '}':
+			depth--
+			if depth == 0 {
+				return query[start : i+1]
+			}
+		}
+	}
+	return ""
+}
+
+// formatLokiMetricTimestamp 解析 Loki metric 序列时间戳（秒级 float / 科学计数法）// Logan.Li
+func formatLokiMetricTimestamp(v interface{}) string {
+	switch t := v.(type) {
+	case float64:
+		sec := int64(t)
+		nsec := int64((t - float64(sec)) * 1e9)
+		return time.Unix(sec, nsec).UTC().Format(time.RFC3339)
+	case json.Number:
+		if f, err := t.Float64(); err == nil {
+			sec := int64(f)
+			return time.Unix(sec, 0).UTC().Format(time.RFC3339)
+		}
+	}
+	return formatLokiTimestamp(fmt.Sprintf("%v", v))
+}

backend/controller/log_scope_role.go

@@ -0,0 +1,201 @@
+package controller
+
+import (
+	"errors"
+	"net/http"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"ezops/model"
+	"ezops/pkg/logaccess"
+
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+)
+
+// LogScopeRoleHandler 日志查询权限 // Logan.Li
+type LogScopeRoleHandler struct {
+	db *gorm.DB
+}
+
+func NewLogScopeRoleHandler(db *gorm.DB) *LogScopeRoleHandler {
+	return &LogScopeRoleHandler{db: db}
+}
+
+// ListLogScopeRoles GET /log-scope-roles
+func (h *LogScopeRoleHandler) ListLogScopeRoles(c *gin.Context) {
+	var roles []model.LogScopeRole
+	h.db.Order("created_at DESC").Find(&roles)
+	c.JSON(http.StatusOK, model.Response{Code: 200, Data: model.ListResponse{List: roles, Total: int64(len(roles))}})
+}
+
+// CreateLogScopeRole POST /log-scope-roles
+func (h *LogScopeRoleHandler) CreateLogScopeRole(c *gin.Context) {
+	var req model.CreateLogScopeRoleRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: err.Error()})
+		return
+	}
+	if _, err := regexp.Compile(req.Pattern); err != nil {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "正则表达式无效: " + err.Error()})
+		return
+	}
+	engine := strings.TrimSpace(req.Engine)
+	if engine == "" {
+		engine = "*"
+	}
+	role := req.Role
+	if role == "" {
+		role = "viewer"
+	}
+	var dup int64
+	h.db.Model(&model.LogScopeRole{}).Where("name = ? OR code = ?", req.Name, req.Code).Count(&dup)
+	if dup > 0 {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "名称或编码已存在"})
+		return
+	}
+	item := model.LogScopeRole{
+		Name: req.Name, Code: req.Code, Engine: engine, MatchField: req.MatchField,
+		Pattern: req.Pattern, DatasourceID: req.DatasourceID, Role: role,
+		Description: req.Description, Status: 1,
+	}
+	if err := h.db.Create(&item).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "创建失败"})
+		return
+	}
+	c.JSON(http.StatusOK, model.Response{Code: 200, Message: "创建成功", Data: item})
+}
+
+// UpdateLogScopeRole PUT /log-scope-roles/:id
+func (h *LogScopeRoleHandler) UpdateLogScopeRole(c *gin.Context) {
+	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
+	var item model.LogScopeRole
+	if err := h.db.First(&item, id).Error; err != nil {
+		c.JSON(http.StatusNotFound, model.Response{Code: 404, Message: "策略不存在"})
+		return
+	}
+	var req model.UpdateLogScopeRoleRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: err.Error()})
+		return
+	}
+	updates := map[string]interface{}{}
+	if req.Name != "" {
+		updates["name"] = req.Name
+	}
+	if req.Code != "" {
+		updates["code"] = req.Code
+	}
+	if req.Engine != "" {
+		updates["engine"] = req.Engine
+	}
+	if req.MatchField != "" {
+		updates["match_field"] = req.MatchField
+	}
+	if req.Pattern != "" {
+		if _, err := regexp.Compile(req.Pattern); err != nil {
+			c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "正则无效"})
+			return
+		}
+		updates["pattern"] = req.Pattern
+	}
+	if req.DatasourceID != nil {
+		updates["datasource_id"] = req.DatasourceID
+	}
+	if req.Role != "" {
+		updates["role"] = req.Role
+	}
+	if req.Description != "" {
+		updates["description"] = req.Description
+	}
+	if req.Status != nil {
+		updates["status"] = *req.Status
+	}
+	if len(updates) > 0 {
+		h.db.Model(&item).Updates(updates)
+	}
+	h.db.First(&item, id)
+	c.JSON(http.StatusOK, model.Response{Code: 200, Message: "更新成功", Data: item})
+}
+
+// DeleteLogScopeRole DELETE /log-scope-roles/:id
+func (h *LogScopeRoleHandler) DeleteLogScopeRole(c *gin.Context) {
+	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
+	h.db.Where("log_scope_role_id = ?", id).Delete(&model.UserLogScopeRole{})
+	if err := h.db.Delete(&model.LogScopeRole{}, id).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "删除失败"})
+		return
+	}
+	c.JSON(http.StatusOK, model.Response{Code: 200, Message: "删除成功"})
+}
+
+// ListUserLogScopeRoles GET /log-scope-roles/users/:id
+func (h *LogScopeRoleHandler) ListUserLogScopeRoles(c *gin.Context) {
+	uid, _ := strconv.ParseUint(c.Param("id"), 10, 64)
+	var rows []model.UserLogScopeRole
+	h.db.Preload("LogScopeRole").Where("user_id = ?", uid).Find(&rows)
+	c.JSON(http.StatusOK, model.Response{Code: 200, Data: model.ListResponse{List: rows, Total: int64(len(rows))}})
+}
+
+// AssignLogScopeRole POST /log-scope-roles/users/:id
+func (h *LogScopeRoleHandler) AssignLogScopeRole(c *gin.Context) {
+	uid, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil || uid == 0 {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "无效的用户 ID"})
+		return
+	}
+	var req model.AssignLogScopeRoleRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "请求参数错误: " + err.Error()})
+		return
+	}
+	var role model.LogScopeRole
+	if err := h.db.First(&role, req.LogScopeRoleID).Error; err != nil {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "策略不存在"})
+		return
+	}
+	var existing model.UserLogScopeRole
+	if err := h.db.Where("user_id = ? AND log_scope_role_id = ?", uid, req.LogScopeRoleID).Take(&existing).Error; err == nil {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "已分配该策略"})
+		return
+	} else if !errors.Is(err, gorm.ErrRecordNotFound) {
+		c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "查询失败: " + err.Error()})
+		return
+	}
+	row := model.UserLogScopeRole{UserID: uint(uid), LogScopeRoleID: req.LogScopeRoleID}
+	if err := h.db.Create(&row).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "分配失败: " + err.Error()})
+		return
+	}
+	h.db.Preload("LogScopeRole").Take(&row, row.ID)
+	c.JSON(http.StatusOK, model.Response{Code: 200, Message: "分配成功", Data: row})
+}
+
+// RemoveLogScopeRole DELETE /log-scope-roles/users/:userId/:assignId
+func (h *LogScopeRoleHandler) RemoveLogScopeRole(c *gin.Context) {
+	assignID, _ := strconv.ParseUint(c.Param("assignId"), 10, 64)
+	h.db.Delete(&model.UserLogScopeRole{}, assignID)
+	c.JSON(http.StatusOK, model.Response{Code: 200, Message: "已撤销"})
+}
+
+// PreviewLogScope POST /log-scope-roles/preview
+func (h *LogScopeRoleHandler) PreviewLogScope(c *gin.Context) {
+	var req model.PreviewLogScopeRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: err.Error()})
+		return
+	}
+	var roles []model.LogScopeRole
+	h.db.Where("status = 1").Find(&roles)
+	qc := logaccess.QueryContext{
+		Engine: req.Engine, DatasourceID: req.DatasourceID,
+		Index: req.Index, Query: req.Query,
+	}
+	matched := logaccess.MatchRolesForPreview(roles, qc, req.SampleValue)
+	c.JSON(http.StatusOK, model.Response{Code: 200, Data: gin.H{
+		"allowed": len(matched) > 0,
+		"matched": matched,
+		"total":   len(matched),
+	}})
+}

backend/controller/pipeline.go

@@ -61,7 +61,9 @@ type PipelineHandler struct {
 
 // NewPipelineHandler 创建流水线处理器
 func NewPipelineHandler(db *gorm.DB, cache ezredis.Cache, ti *toolinstaller.ToolInstaller) *PipelineHandler {
-	return &PipelineHandler{db: db, cache: cache, toolInstaller: ti}
+	h := &PipelineHandler{db: db, cache: cache, toolInstaller: ti}
+	h.ensureBuildMasterConfig()
+	return h
 }
 
 // PipelineListItem 列表项（含最近一次运行摘要）// Logan.Li
@@ -221,9 +223,13 @@ func (h *PipelineHandler) CreatePipeline(c *gin.Context) {
 		Variables:    req.Variables,
 		DeployMode:   req.DeployMode,
 		DeployTarget: req.DeployTarget,
-		ServerIDs:    req.ServerIDs,
-		K8sClusterID: req.K8sClusterID,
-		K8sNamespace: req.K8sNamespace,
+		ServerIDs:        req.ServerIDs,
+		DeployRemotePath: req.DeployRemotePath,
+		DeployScript:     req.DeployScript,
+		K8sClusterID:     req.K8sClusterID,
+		K8sNamespace:     req.K8sNamespace,
+		K8sDeployment:    req.K8sDeployment,
+		K8sContainerName: req.K8sContainerName,
 		RepoID:       req.RepoID,
 		RegistryID:   req.RegistryID,
 		GitCredentialID:      req.GitCredentialID,
@@ -239,6 +245,7 @@ func (h *PipelineHandler) CreatePipeline(c *gin.Context) {
 		CachePaths: req.CachePaths,
 		// 并发控制
 		MaxExecutors: req.MaxExecutors,
+		BuildNodeID:  req.BuildNodeID,
 		Enabled:    true,
 	}
 
@@ -306,7 +313,11 @@ func (h *PipelineHandler) UpdatePipeline(c *gin.Context) {
 	if req.DeployMode != "" { updates["deploy_mode"] = req.DeployMode }
 	if req.DeployTarget != "" { updates["deploy_target"] = req.DeployTarget }
 	if req.ServerIDs != "" { updates["server_ids"] = req.ServerIDs }
+	if req.DeployRemotePath != "" { updates["deploy_remote_path"] = req.DeployRemotePath }
+	if req.DeployScript != "" { updates["deploy_script"] = req.DeployScript }
 	if req.K8sNamespace != "" { updates["k8s_namespace"] = req.K8sNamespace }
+	if req.K8sDeployment != "" { updates["k8s_deployment"] = req.K8sDeployment }
+	if req.K8sContainerName != "" { updates["k8s_container_name"] = req.K8sContainerName }
 	if req.K8sClusterID != nil { updates["k8s_cluster_id"] = req.K8sClusterID }
 	if req.RepoID != nil { updates["repo_id"] = req.RepoID }
 	if req.RegistryID != nil { updates["registry_id"] = req.RegistryID }
@@ -321,6 +332,7 @@ func (h *PipelineHandler) UpdatePipeline(c *gin.Context) {
 	if req.CachePaths != "" { updates["cache_paths"] = req.CachePaths }
 	if req.Enabled != nil { updates["enabled"] = req.Enabled }
 	if req.MaxExecutors > 0 { updates["max_executors"] = req.MaxExecutors }
+	if req.BuildNodeID != nil { updates["build_node_id"] = req.BuildNodeID }
 
 	if err := h.db.Model(&pipeline).Updates(updates).Error; err != nil {
 		c.JSON(http.StatusInternalServerError, model.Response{
@@ -543,7 +555,7 @@ func (h *PipelineHandler) WebhookTrigger(c *gin.Context) {
 		return
 	}
 
-	go h.executePipeline(pipeline, run)
+	go h.tryExecuteOrQueue(pipeline, run)
 
 	c.JSON(http.StatusOK, model.Response{
 		Code:    200,

backend/controller/pipeline_executor.go

@@ -6,11 +6,13 @@ import (
 	"fmt"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"strings"
 	"sync"
 	"time"
 
 	"ezops/model"
+	"ezops/pkg/remoteexec"
 
 	"go.uber.org/zap"
 )
@@ -38,8 +40,9 @@ func init() {
 	logger, _ = zap.NewProduction()
 }
 
-// executePipeline 后台执行流水线（goroutine）— V2 Redis 版
-func (h *PipelineHandler) executePipeline(pipeline model.Pipeline, run model.PipelineRun) {
+// executePipeline 后台执行流水线（goroutine）— V2 Redis 版，支持 Master/SSH 构建节点 // Logan.Li
+func (h *PipelineHandler) executePipeline(pipeline model.Pipeline, run model.PipelineRun, nodeID uint) {
+	defer h.releaseBuildNode(nodeID)
 	runID := run.ID
 	ctx := context.Background()
 	logKey := fmt.Sprintf("pipeline:run:%d:logs", runID)
@@ -129,15 +132,47 @@ func (h *PipelineHandler) executePipeline(pipeline model.Pipeline, run model.Pip
 	}
 	ts := time.Now()
 	tsDir := fmt.Sprintf("%d%02d%02d%02d%02d", ts.Year(), ts.Month(), ts.Day(), ts.Hour(), ts.Minute())
-	workspace := fmt.Sprintf("/app/workspace/%s-%s", repoName, pipeline.Code)
+	localWorkspace := fmt.Sprintf("/app/workspace/%s-%s", repoName, pipeline.Code)
+	workspace := localWorkspace
 
-	os.RemoveAll(workspace)
-	os.MkdirAll(workspace, 0755)
-	// 保存 workspace 路径到运行记录，方便终端查看
-	h.db.Model(&model.PipelineRun{}).Where("id = ?", runID).Update("workspace_path", workspace)
+	execCtx, err := h.buildExecCtx(nodeID, workspace)
+	if err != nil {
+		log("error", "init", fmt.Sprintf("构建执行上下文失败: %v", err))
+		updateStatus("failed", 0)
+		updatePipelineStats("failed")
+		h.dequeueNext(pipeline.ID)
+		h.flushLogsToDB(ctx, runID, logKey)
+		return
+	}
+	if nodeID > 0 {
+		var bn model.BuildNode
+		if h.db.First(&bn, nodeID).Error == nil {
+			workspace = remoteWorkspacePath(bn, repoName, pipeline.Code)
+		}
+	}
+	execCtx.Workspace = workspace
+
+	if err := h.prepareWorkspace(execCtx, log); err != nil {
+		log("error", "init", fmt.Sprintf("初始化工作区失败: %v", err))
+		updateStatus("failed", 0)
+		updatePipelineStats("failed")
+		h.dequeueNext(pipeline.ID)
+		h.flushLogsToDB(ctx, runID, logKey)
+		return
+	}
+
+	runUpdates := map[string]interface{}{
+		"workspace_path": workspace,
+		"build_node_name": execCtx.NodeName,
+	}
+	if nodeID > 0 {
+		runUpdates["build_node_id"] = nodeID
+	}
+	h.db.Model(&model.PipelineRun{}).Where("id = ?", runID).Updates(runUpdates)
 
 	imageTag := fmt.Sprintf("%s-%s", repoName, tsDir)
 
+	log("info", "init", fmt.Sprintf("执行节点: %s", execCtx.NodeName))
 	log("info", "init", fmt.Sprintf("触发方式: 手动 (admin)"))
 	log("info", "init", fmt.Sprintf("分支: %s | 镜像标签: %s", branch, imageTag))
 
@@ -159,17 +194,31 @@ func (h *PipelineHandler) executePipeline(pipeline model.Pipeline, run model.Pip
 		var err error
 		switch stage.Type {
 		case "checkout":
-			err = h.runCheckout(gitURL, branch, workspace, log)
+			err = h.runCheckout(execCtx, gitURL, branch, log)
 		case "build":
-			err = h.runBuild(workspace, pipeline.Dockerfile, log)
+			err = h.runBuild(execCtx, pipeline.Dockerfile, log)
 		case "test":
-			err = h.runTest(workspace, log)
+			err = h.runTest(execCtx, log)
 		case "image":
-			err = h.runDockerBuild(workspace, pipeline, imageTag, log)
+			err = h.runDockerBuild(execCtx, pipeline, imageTag, log)
 		case "deploy":
-			err = h.runDeploy(workspace, pipeline, imageTag, log)
+			deployWS := execCtx.Workspace
+			if execCtx.Remote {
+				if syncErr := h.syncRemoteWorkspaceToLocal(execCtx, localWorkspace, log); syncErr != nil {
+					err = syncErr
+				} else {
+					deployWS = localWorkspace
+				}
+			}
+			if err == nil {
+				err = h.runDeploy(deployWS, pipeline, imageTag, log)
+			}
 		case "verify":
-			err = h.runVerify(workspace, log)
+			verifyWS := execCtx.Workspace
+			if execCtx.Remote {
+				verifyWS = localWorkspace
+			}
+			err = h.runVerify(verifyWS, log)
 		default:
 			log("info", stage.Name, "跳过未知阶段类型: "+stage.Type)
 		}
@@ -214,25 +263,26 @@ func (h *PipelineHandler) flushLogsToDB(ctx context.Context, runID uint, logKey
 	h.cache.Del(ctx, logKey)
 }
 
-// runCheckout git clone
-func (h *PipelineHandler) runCheckout(url, branch, workspace string, logFn func(string, string, string)) error {
+// runCheckout git clone（Master 或远程构建节点） // Logan.Li
+func (h *PipelineHandler) runCheckout(execCtx *PipelineExecCtx, url, branch string, logFn func(string, string, string)) error {
 	if url == "" {
 		logFn("warn", "代码检出", "没有配置 Git URL，跳过代码检出")
 		return nil
 	}
 	logFn("info", "代码检出", "> Git 拉取 "+url+" (分支: "+branch+")")
 
-	// U4: 确保工具可用（slim 镜像模式下 git 为懒加载）// Logan.Li
-	if h.toolInstaller != nil {
+	if !execCtx.Remote && h.toolInstaller != nil {
 		if err := h.toolInstaller.EnsureAvailable("git"); err != nil {
 			return fmt.Errorf("git 不可用（安装失败）: %v", err)
 		}
 	}
 
-	cmd := exec.Command("git", "clone", "--depth", "1", "-b", branch, url, workspace)
-	output, err := cmd.CombinedOutput()
-	// 流式输出到日志
-	for _, line := range strings.Split(strings.TrimSpace(string(output)), "\n") {
+	cloneCmd := fmt.Sprintf(
+		"git clone --depth 1 -b %s %s %s",
+		shellQuotePath(branch), shellQuotePath(url), shellQuotePath(execCtx.Workspace),
+	)
+	output, err := h.execOnCtx(execCtx, "", cloneCmd, 15*time.Minute)
+	for _, line := range strings.Split(strings.TrimSpace(output), "\n") {
 		if line != "" {
 			logFn("info", "代码检出", line)
 		}
@@ -240,19 +290,19 @@ func (h *PipelineHandler) runCheckout(url, branch, workspace string, logFn func(
 	if err != nil {
 		return fmt.Errorf("git clone 失败: %v", err)
 	}
-	hashCmd := exec.Command("git", "-C", workspace, "rev-parse", "--short", "HEAD")
-	hashOut, _ := hashCmd.Output()
-	logFn("success", "代码检出", fmt.Sprintf("已拉取 commit: %s", strings.TrimSpace(string(hashOut))))
+	hashOut, _ := h.execOnCtx(execCtx, execCtx.Workspace, "git rev-parse --short HEAD", 30*time.Second)
+	logFn("success", "代码检出", fmt.Sprintf("已拉取 commit: %s", strings.TrimSpace(hashOut)))
 	return nil
 }
 
-// runBuild 构建（自动检测 Maven / npm / Go / Makefile）
-func (h *PipelineHandler) runBuild(workspace, dockerfile string, logFn func(string, string, string)) error {
+// runBuild 构建（自动检测 Maven / npm / Go / Makefile，支持远程节点） // Logan.Li
+func (h *PipelineHandler) runBuild(execCtx *PipelineExecCtx, dockerfile string, logFn func(string, string, string)) error {
+	workspace := execCtx.Workspace
 	buildDir := workspace
 	if dockerfile != "" {
 		if dir := dotdot(dockerfile); dir != "." && dir != "" {
 			testDir := workspace + "/" + dir
-			if _, err := os.Stat(testDir); err == nil {
+			if h.pathExists(execCtx, testDir) {
 				buildDir = testDir
 				logFn("info", "构建", ">>> 切换到构建目录: "+dir)
 			}
@@ -260,30 +310,48 @@ func (h *PipelineHandler) runBuild(workspace, dockerfile string, logFn func(stri
 	}
 
 	// 如果根目录没找到构建文件，扫描一级子目录
-	if !hasBuildFile(buildDir) {
+	if !h.hasBuildFileCtx(execCtx, buildDir) {
 		type subMatch struct {
 			dir  string
 			kind string // "maven", "npm", "go", "make"
 		}
 		var matches []subMatch
-		entries, err := os.ReadDir(buildDir)
-		if err == nil {
-			for _, e := range entries {
-				if !e.IsDir() || e.Name() == ".git" {
+		if execCtx.Remote {
+			out, _ := h.execOnCtx(execCtx, buildDir, `for d in */; do
+  [ "$d" = ".git/" ] && continue
+  [ -f "${d}pom.xml" ] && echo "maven:$d"
+  [ -f "${d}package.json" ] && echo "npm:$d"
+  [ -f "${d}go.mod" ] && echo "go:$d"
+  [ -f "${d}Makefile" ] && echo "make:$d"
+done`, 60*time.Second)
+			for _, line := range strings.Split(strings.TrimSpace(out), "\n") {
+				if line == "" || !strings.Contains(line, ":") {
 					continue
 				}
-				sub := buildDir + "/" + e.Name()
-				if _, err := os.Stat(sub + "/pom.xml"); err == nil {
-					matches = append(matches, subMatch{sub, "maven"})
-				}
-				if _, err := os.Stat(sub + "/package.json"); err == nil {
-					matches = append(matches, subMatch{sub, "npm"})
-				}
-				if _, err := os.Stat(sub + "/go.mod"); err == nil {
-					matches = append(matches, subMatch{sub, "go"})
-				}
-				if _, err := os.Stat(sub + "/Makefile"); err == nil {
-					matches = append(matches, subMatch{sub, "make"})
+				parts := strings.SplitN(line, ":", 2)
+				sub := strings.TrimSuffix(buildDir+"/"+strings.TrimSuffix(parts[1], "/"), "/")
+				matches = append(matches, subMatch{sub, parts[0]})
+			}
+		} else {
+			entries, err := os.ReadDir(buildDir)
+			if err == nil {
+				for _, e := range entries {
+					if !e.IsDir() || e.Name() == ".git" {
+						continue
+					}
+					sub := buildDir + "/" + e.Name()
+					if _, err := os.Stat(sub + "/pom.xml"); err == nil {
+						matches = append(matches, subMatch{sub, "maven"})
+					}
+					if _, err := os.Stat(sub + "/package.json"); err == nil {
+						matches = append(matches, subMatch{sub, "npm"})
+					}
+					if _, err := os.Stat(sub + "/go.mod"); err == nil {
+						matches = append(matches, subMatch{sub, "go"})
+					}
+					if _, err := os.Stat(sub + "/Makefile"); err == nil {
+						matches = append(matches, subMatch{sub, "make"})
+					}
 				}
 			}
 		}
@@ -304,13 +372,19 @@ func (h *PipelineHandler) runBuild(workspace, dockerfile string, logFn func(stri
 		}
 	}
 
-	if _, err := os.Stat(buildDir + "/pom.xml"); err == nil {
+	if h.pathExists(execCtx, buildDir+"/pom.xml") {
+		if !execCtx.Remote && h.toolInstaller != nil {
+			if err := h.toolInstaller.EnsureAvailable("jdk"); err != nil {
+				return fmt.Errorf("JDK 不可用（安装失败）: %v", err)
+			}
+			if err := h.toolInstaller.EnsureAvailable("maven"); err != nil {
+				return fmt.Errorf("Maven 不可用（安装失败）: %v", err)
+			}
+		}
 		logFn("info", "构建", ">>> Maven 构建 (mvn clean package -DskipTests)")
 		logFn("info", "构建", "🔨 正在下载依赖并编译...")
-		cmd := exec.Command("mvn", "clean", "package", "-DskipTests")
-		cmd.Dir = buildDir
-		out, err := cmd.CombinedOutput()
-		for _, line := range strings.Split(strings.TrimSpace(string(out)), "\n") {
+		out, err := h.execOnCtx(execCtx, buildDir, "mvn clean package -DskipTests", 30*time.Minute)
+		for _, line := range strings.Split(strings.TrimSpace(out), "\n") {
 			if line != "" {
 				logFn("info", "构建", line)
 			}
@@ -322,13 +396,16 @@ func (h *PipelineHandler) runBuild(workspace, dockerfile string, logFn func(stri
 		return nil
 	}
 
-	if _, err := os.Stat(buildDir + "/package.json"); err == nil {
+	if h.pathExists(execCtx, buildDir+"/package.json") {
+		if !execCtx.Remote && h.toolInstaller != nil {
+			if err := h.toolInstaller.EnsureAvailable("nodejs"); err != nil {
+				return fmt.Errorf("Node.js 不可用（安装失败）: %v", err)
+			}
+		}
 		logFn("info", "构建", ">>> npm 构建 (npm install && npm run build)")
 		logFn("info", "构建", "📦 正在安装依赖...")
-		installCmd := exec.Command("sh", "-c", "npm install --registry=https://registry.npmmirror.com --legacy-peer-deps 2>&1")
-		installCmd.Dir = buildDir
-		out, err := installCmd.CombinedOutput()
-		for _, line := range strings.Split(strings.TrimSpace(string(out)), "\n") {
+		out, err := h.execOnCtx(execCtx, buildDir, "npm install --registry=https://registry.npmmirror.com --legacy-peer-deps 2>&1", 30*time.Minute)
+		for _, line := range strings.Split(strings.TrimSpace(out), "\n") {
 			if line != "" {
 				logFn("info", "构建", line)
 			}
@@ -337,10 +414,8 @@ func (h *PipelineHandler) runBuild(workspace, dockerfile string, logFn func(stri
 			return fmt.Errorf("npm install 失败: %v", err)
 		}
 		logFn("info", "构建", "🏗️ 正在打包构建...")
-		buildCmd := exec.Command("sh", "-c", "npm run build 2>&1")
-		buildCmd.Dir = buildDir
-		out, err = buildCmd.CombinedOutput()
-		for _, line := range strings.Split(strings.TrimSpace(string(out)), "\n") {
+		out, err = h.execOnCtx(execCtx, buildDir, "npm run build 2>&1", 30*time.Minute)
+		for _, line := range strings.Split(strings.TrimSpace(out), "\n") {
 			if line != "" {
 				logFn("info", "构建", line)
 			}
@@ -352,12 +427,16 @@ func (h *PipelineHandler) runBuild(workspace, dockerfile string, logFn func(stri
 		return nil
 	}
 
-	if _, err := os.Stat(buildDir + "/go.mod"); err == nil {
+	if h.pathExists(execCtx, buildDir+"/go.mod") {
+		if !execCtx.Remote && h.toolInstaller != nil {
+			if err := h.toolInstaller.EnsureAvailable("golang"); err != nil {
+				return fmt.Errorf("Go 不可用（安装失败）: %v", err)
+			}
+		}
 		logFn("info", "构建", ">>> Go 构建 (go build ./...)")
-		cmd := exec.Command("go", "build", "./...")
-		cmd.Dir = buildDir
-		out, err := cmd.CombinedOutput()
-		for _, line := range strings.Split(strings.TrimSpace(string(out)), "\n") {
+		goEnv := "export GOROOT=/usr/local/go PATH=/usr/local/go/bin:$PATH GOPROXY=https://goproxy.cn,direct GOTOOLCHAIN=local && "
+		out, err := h.execOnCtx(execCtx, buildDir, goEnv+"go build ./...", 30*time.Minute)
+		for _, line := range strings.Split(strings.TrimSpace(out), "\n") {
 			if line != "" {
 				logFn("info", "构建", line)
 			}
@@ -383,14 +462,12 @@ func hasBuildFile(dir string) bool {
 	return false
 }
 
-// runTest 执行测试
-func (h *PipelineHandler) runTest(workspace string, logFn func(string, string, string)) error {
-	if _, err := os.Stat(workspace + "/pom.xml"); err == nil {
+// runTest 执行测试 // Logan.Li
+func (h *PipelineHandler) runTest(execCtx *PipelineExecCtx, logFn func(string, string, string)) error {
+	if h.pathExists(execCtx, execCtx.Workspace+"/pom.xml") {
 		logFn("info", "测试", ">>> Maven 测试 (mvn test)")
-		cmd := exec.Command("mvn", "test")
-		cmd.Dir = workspace
-		out, _ := cmd.CombinedOutput()
-		for _, line := range strings.Split(strings.TrimSpace(string(out)), "\n") {
+		out, _ := h.execOnCtx(execCtx, execCtx.Workspace, "mvn test", 30*time.Minute)
+		for _, line := range strings.Split(strings.TrimSpace(out), "\n") {
 			if line != "" {
 				logFn("info", "测试", line)
 			}
@@ -399,31 +476,15 @@ func (h *PipelineHandler) runTest(workspace string, logFn func(string, string, s
 	return nil
 }
 
-// runDockerBuild Docker 构建 & 推送
-func (h *PipelineHandler) runDockerBuild(workspace string, pipeline model.Pipeline, tag string, logFn func(string, string, string)) error {
+// runDockerBuild Docker 构建 & 推送（支持远程节点，需节点已安装 Docker） // Logan.Li
+func (h *PipelineHandler) runDockerBuild(execCtx *PipelineExecCtx, pipeline model.Pipeline, tag string, logFn func(string, string, string)) error {
+	workspace := execCtx.Workspace
 	dockerfile := pipeline.Dockerfile
 	if dockerfile == "" {
 		dockerfile = "Dockerfile"
 	}
 
-	var registryURL, imageName string
-	if pipeline.RegistryID != nil {
-		var reg model.PipelineRegistry
-		if err := h.db.First(&reg, *pipeline.RegistryID).Error; err == nil {
-			registryURL = reg.RegistryURL
-			if reg.Namespace != "" {
-				imageName = reg.Namespace + "/" + pipeline.Code
-			}
-		}
-	}
-	if imageName == "" {
-		imageName = pipeline.Code
-	}
-	if registryURL == "" {
-		registryURL = "registry.example.com"
-	}
-
-	fullImage := fmt.Sprintf("%s/%s:%s", registryURL, imageName, tag)
+	fullImage := h.resolvePipelineImage(pipeline, tag)
 	logFn("info", "镜像打包", fmt.Sprintf("镜像地址: %s", fullImage))
 
 	buildDir := workspace
@@ -437,17 +498,15 @@ func (h *PipelineHandler) runDockerBuild(workspace string, pipeline model.Pipeli
 
 	logFn("info", "镜像打包", fmt.Sprintf(">>> Docker 构建 (dockerfile: %s)", dfPath))
 
-	// U4: 确保 Docker CLI 可用（slim 镜像模式下 docker-cli 为懒加载）// Logan.Li
-	if h.toolInstaller != nil {
+	if !execCtx.Remote && h.toolInstaller != nil {
 		if err := h.toolInstaller.EnsureAvailable("docker-cli"); err != nil {
 			return fmt.Errorf("docker 不可用（安装失败）: %v", err)
 		}
 	}
 
-	cmd := exec.Command("docker", "build", "-t", fullImage, "-f", dfPath, ".")
-	cmd.Dir = buildDir
-	out, err := cmd.CombinedOutput()
-	for _, line := range strings.Split(strings.TrimSpace(string(out)), "\n") {
+	buildCmd := fmt.Sprintf("docker build -t %s -f %s .", shellQuotePath(fullImage), shellQuotePath(dfPath))
+	out, err := h.execOnCtx(execCtx, buildDir, buildCmd, 60*time.Minute)
+	for _, line := range strings.Split(strings.TrimSpace(out), "\n") {
 		if line != "" {
 			logFn("info", "镜像打包", line)
 		}
@@ -458,9 +517,8 @@ func (h *PipelineHandler) runDockerBuild(workspace string, pipeline model.Pipeli
 	logFn("success", "镜像打包", "Docker 构建成功")
 
 	logFn("info", "镜像打包", ">>> 推送镜像: "+fullImage)
-	pushCmd := exec.Command("docker", "push", fullImage)
-	pushOut, err := pushCmd.CombinedOutput()
-	for _, line := range strings.Split(strings.TrimSpace(string(pushOut)), "\n") {
+	pushOut, err := h.execOnCtx(execCtx, buildDir, "docker push "+shellQuotePath(fullImage), 60*time.Minute)
+	for _, line := range strings.Split(strings.TrimSpace(pushOut), "\n") {
 		if line != "" {
 			logFn("info", "镜像打包", line)
 		}
@@ -472,8 +530,165 @@ func (h *PipelineHandler) runDockerBuild(workspace string, pipeline model.Pipeli
 	return nil
 }
 
-// runDeploy 部署到 K8s / 服务器
+// runDeploy 部署：K8s 走 update-image CI；SSH 走 SCP + 远程命令 // Logan.Li
 func (h *PipelineHandler) runDeploy(workspace string, pipeline model.Pipeline, tag string, logFn func(string, string, string)) error {
+	switch pipeline.DeployTarget {
+	case "k8s":
+		return h.deployToK8s(pipeline, tag, logFn)
+	case "ssh":
+		return h.deployToSSH(workspace, pipeline, logFn)
+	default:
+		return h.deployViaYaml(workspace, logFn)
+	}
+}
+
+// resolvePipelineImage 解析流水线构建镜像全名（与镜像打包阶段一致） // Logan.Li
+func (h *PipelineHandler) resolvePipelineImage(pipeline model.Pipeline, tag string) string {
+	var registryURL, imageName string
+	if pipeline.RegistryID != nil {
+		var reg model.PipelineRegistry
+		if err := h.db.First(&reg, *pipeline.RegistryID).Error; err == nil {
+			registryURL = reg.RegistryURL
+			if reg.Namespace != "" {
+				imageName = reg.Namespace + "/"
+			}
+		}
+	}
+	appName := pipeline.Code
+	if pipeline.JobName != "" {
+		appName = pipeline.JobName
+	}
+	if imageName == "" {
+		imageName = appName
+	} else {
+		imageName += appName
+	}
+	if registryURL == "" {
+		registryURL = "registry.example.com"
+	}
+	return fmt.Sprintf("%s/%s:%s", registryURL, imageName, tag)
+}
+
+// deployToK8s 调用 K8s API 更新 Deployment 镜像（等同 curl CI update-image） // Logan.Li
+func (h *PipelineHandler) deployToK8s(pipeline model.Pipeline, tag string, logFn func(string, string, string)) error {
+	if pipeline.K8sDeployment == "" || pipeline.K8sNamespace == "" {
+		return fmt.Errorf("未配置 K8s Deployment")
+	}
+	if pipeline.K8sClusterID == nil {
+		return fmt.Errorf("未配置 K8s 集群")
+	}
+	var cluster model.KubernetesCluster
+	if err := h.db.First(&cluster, *pipeline.K8sClusterID).Error; err != nil {
+		return fmt.Errorf("集群不存在: %v", err)
+	}
+	client, err := buildK8sClient(&cluster)
+	if err != nil {
+		return err
+	}
+
+	fullImage := h.resolvePipelineImage(pipeline, tag)
+	logFn("info", "部署", fmt.Sprintf(">>> CI 更新镜像 %s/%s", pipeline.K8sNamespace, pipeline.K8sDeployment))
+	logFn("info", "部署", fmt.Sprintf("镜像: %s", fullImage))
+	logFn("info", "部署", fmt.Sprintf("API: POST /kubernetes/%s/namespace/%s/deployments/%s/update-image",
+		cluster.Code, pipeline.K8sNamespace, pipeline.K8sDeployment))
+
+	if err := client.UpdateDeploymentImage(pipeline.K8sNamespace, pipeline.K8sDeployment, pipeline.K8sContainerName, fullImage); err != nil {
+		return fmt.Errorf("更新 Deployment 镜像失败: %v", err)
+	}
+	logFn("success", "部署", "Deployment 镜像已更新，滚动发布已触发")
+	return nil
+}
+
+// deployToSSH 通过 SCP 上传构建产物并在关联服务器上执行部署命令 // Logan.Li
+func (h *PipelineHandler) deployToSSH(workspace string, pipeline model.Pipeline, logFn func(string, string, string)) error {
+	if pipeline.ServerIDs == "" {
+		return fmt.Errorf("未关联部署主机")
+	}
+	var serverIDs []uint
+	if err := json.Unmarshal([]byte(pipeline.ServerIDs), &serverIDs); err != nil || len(serverIDs) == 0 {
+		return fmt.Errorf("server_ids 解析失败")
+	}
+
+	var servers []model.Server
+	if err := h.db.Where("id IN ?", serverIDs).Find(&servers).Error; err != nil {
+		return fmt.Errorf("加载服务器失败: %v", err)
+	}
+	if len(servers) == 0 {
+		return fmt.Errorf("关联的服务器不存在")
+	}
+
+	artifact := findDeployArtifact(workspace)
+	if artifact == "" {
+		return fmt.Errorf("工作区未找到可部署产物（jar/tar.gz/zip）")
+	}
+
+	remoteDir := strings.TrimSpace(pipeline.DeployRemotePath)
+	if remoteDir == "" {
+		remoteDir = fmt.Sprintf("/opt/apps/%s", pipeline.Code)
+	}
+	remotePath := remoteDir + "/" + filepath.Base(artifact)
+
+	deployScript := strings.TrimSpace(pipeline.DeployScript)
+	if deployScript == "" {
+		deployScript = fmt.Sprintf(
+			"mkdir -p %s && cd %s && (test -x ./restart.sh && ./restart.sh) || (systemctl restart %s 2>/dev/null) || echo '部署完成，请配置 deploy_script'",
+			remoteDir, remoteDir, pipeline.Code,
+		)
+	}
+
+	configs := make([]remoteexec.SSHConfig, 0, len(servers))
+	hostnames := make([]string, 0, len(servers))
+	for _, srv := range servers {
+		cfg, err := buildSSHConfig(h.db, srv)
+		if err != nil {
+			logFn("error", "部署", fmt.Sprintf("%s: %v", srv.Hostname, err))
+			continue
+		}
+		configs = append(configs, cfg)
+		hostnames = append(hostnames, srv.Hostname)
+	}
+	if len(configs) == 0 {
+		return fmt.Errorf("无可用 SSH 配置，请检查服务器凭据")
+	}
+
+	logFn("info", "部署", fmt.Sprintf(">>> SCP %s → %s（%s）", filepath.Base(artifact), remotePath, strings.Join(hostnames, ", ")))
+	uploadResults := remoteexec.BatchUpload(configs, artifact, remotePath, 5)
+	for _, r := range uploadResults {
+		if r.Success {
+			logFn("success", "部署", fmt.Sprintf("✓ %s 上传成功", r.Host))
+		} else {
+			logFn("error", "部署", fmt.Sprintf("✗ %s 上传失败: %s", r.Host, r.Error))
+		}
+	}
+	for _, r := range uploadResults {
+		if !r.Success {
+			return fmt.Errorf("部分主机 SCP 上传失败")
+		}
+	}
+
+	logFn("info", "部署", ">>> 远程执行部署命令")
+	execResults := remoteexec.BatchExec(configs, deployScript, 5*time.Minute, 5)
+	for _, r := range execResults {
+		for _, line := range strings.Split(r.Output, "\n") {
+			if strings.TrimSpace(line) != "" {
+				logFn("info", "部署", fmt.Sprintf("[%s] %s", r.Host, line))
+			}
+		}
+		if !r.Success {
+			errMsg := r.Error
+			if errMsg == "" {
+				errMsg = fmt.Sprintf("exit=%d", r.ExitCode)
+			}
+			logFn("error", "部署", fmt.Sprintf("✗ %s 部署失败: %s", r.Host, errMsg))
+			return fmt.Errorf("主机 %s 部署失败", r.Host)
+		}
+		logFn("success", "部署", fmt.Sprintf("✓ %s 部署完成", r.Host))
+	}
+	return nil
+}
+
+// deployViaYaml 兜底：仓库内 K8s YAML kubectl apply // Logan.Li
+func (h *PipelineHandler) deployViaYaml(workspace string, logFn func(string, string, string)) error {
 	deployYamls := findFiles(workspace, ".yaml", ".yml")
 	var k8sFiles []string
 	for _, f := range deployYamls {
@@ -485,12 +700,10 @@ func (h *PipelineHandler) runDeploy(workspace string, pipeline model.Pipeline, t
 			k8sFiles = append(k8sFiles, f)
 		}
 	}
-
 	if len(k8sFiles) == 0 {
 		logFn("info", "部署", "未找到 K8s 部署文件，跳过部署")
 		return nil
 	}
-
 	for _, yamlFile := range k8sFiles {
 		logFn("info", "部署", ">>> kubectl apply -f "+yamlFile)
 		cmd := exec.Command("kubectl", "apply", "-f", yamlFile)
@@ -501,14 +714,65 @@ func (h *PipelineHandler) runDeploy(workspace string, pipeline model.Pipeline, t
 			}
 		}
 		if err != nil {
-			logFn("error", "部署", fmt.Sprintf("kubectl apply 失败: %v", err))
-			return fmt.Errorf("kubectl apply 失败")
+			return fmt.Errorf("kubectl apply 失败: %v", err)
 		}
 	}
 	logFn("success", "部署", "部署完成")
 	return nil
 }
 
+// findDeployArtifact 在工作区查找可 SCP 的构建产物 // Logan.Li
+func findDeployArtifact(workspace string) string {
+	priorityDirs := []string{"target", "build/libs", "dist", "bin"}
+	priorityExts := []string{".jar", ".tar.gz", ".tgz", ".zip", ".war"}
+
+	var bestPath string
+	var bestTime time.Time
+
+	checkFile := func(path string) {
+		info, err := os.Stat(path)
+		if err != nil || info.IsDir() {
+			return
+		}
+		if info.ModTime().After(bestTime) {
+			bestTime = info.ModTime()
+			bestPath = path
+		}
+	}
+
+	for _, dir := range priorityDirs {
+		fullDir := filepath.Join(workspace, dir)
+		entries, err := os.ReadDir(fullDir)
+		if err != nil {
+			continue
+		}
+		for _, e := range entries {
+			if e.IsDir() {
+				continue
+			}
+			name := e.Name()
+			for _, ext := range priorityExts {
+				if strings.HasSuffix(name, ext) {
+					checkFile(filepath.Join(fullDir, name))
+					break
+				}
+			}
+		}
+	}
+
+	if bestPath != "" {
+		return bestPath
+	}
+
+	// 根目录兜底扫描
+	for _, ext := range priorityExts {
+		for _, f := range findFiles(workspace, ext) {
+			checkFile(f)
+		}
+	}
+	return bestPath
+}
+
 // runVerify 部署后验证
 func (h *PipelineHandler) runVerify(workspace string, logFn func(string, string, string)) error {
 	logFn("info", "验证", ">>> 部署后健康检查")
@@ -578,27 +842,51 @@ var (
 	queueMu              sync.Mutex
 )
 
-// tryExecuteOrQueue 触发流水线时检查并发限制
-// 如果当前运行数 < maxExecutors → 立即执行
-// 否则 → 加入队列 (status=queued)
+// tryExecuteOrQueue 触发流水线时检查流水线并发 + 构建节点槽位 // Logan.Li
 func (h *PipelineHandler) tryExecuteOrQueue(pipeline model.Pipeline, run model.PipelineRun) {
 	max := pipeline.MaxExecutors
-	if max <= 0 { max = 2 }
+	if max <= 0 {
+		max = 2
+	}
 
 	queueMu.Lock()
 	running := pipelineRunningCount[pipeline.ID]
-	if running < max {
-		pipelineRunningCount[pipeline.ID] = running + 1
+	if running >= max {
+		pipelineQueues[pipeline.ID] = append(pipelineQueues[pipeline.ID], run.ID)
 		queueMu.Unlock()
-		// 立即执行
-		h.db.Model(&model.PipelineRun{}).Where("id = ?", run.ID).Update("status", "running")
-		go h.executePipeline(pipeline, run)
+		h.db.Model(&model.PipelineRun{}).Where("id = ?", run.ID).Update("status", "queued")
 		return
 	}
-	// 加入队列
-	pipelineQueues[pipeline.ID] = append(pipelineQueues[pipeline.ID], run.ID)
 	queueMu.Unlock()
-	h.db.Model(&model.PipelineRun{}).Where("id = ?", run.ID).Update("status", "queued")
+
+	nodeID, canNode := h.tryAcquireBuildNode(pipeline)
+	if !canNode {
+		queueMu.Lock()
+		pipelineQueues[pipeline.ID] = append(pipelineQueues[pipeline.ID], run.ID)
+		queueMu.Unlock()
+		h.db.Model(&model.PipelineRun{}).Where("id = ?", run.ID).Update("status", "queued")
+		return
+	}
+
+	queueMu.Lock()
+	pipelineRunningCount[pipeline.ID] = running + 1
+	queueMu.Unlock()
+
+	h.markRunStarting(run, nodeID)
+	go h.executePipeline(pipeline, run, nodeID)
+}
+
+// markRunStarting 标记运行开始并记录执行节点 // Logan.Li
+func (h *PipelineHandler) markRunStarting(run model.PipelineRun, nodeID uint) {
+	updates := map[string]interface{}{"status": "running", "build_node_name": "Master"}
+	if nodeID > 0 {
+		updates["build_node_id"] = nodeID
+		var node model.BuildNode
+		if h.db.First(&node, nodeID).Error == nil {
+			updates["build_node_name"] = node.Name
+		}
+	}
+	h.db.Model(&model.PipelineRun{}).Where("id = ?", run.ID).Updates(updates)
 }
 
 // dequeueNext 流水线运行结束后，从队列中取下一个执行
@@ -625,8 +913,19 @@ func (h *PipelineHandler) dequeueNext(pipelineID uint) {
 	var run model.PipelineRun
 	if err := h.db.First(&run, nextRunID).Error; err != nil { return }
 
-	h.db.Model(&run).Update("status", "running")
-	go h.executePipeline(pipeline, run)
+	nodeID, canNode := h.tryAcquireBuildNode(pipeline)
+	if !canNode {
+		queueMu.Lock()
+		pipelineQueues[pipelineID] = append([]uint{nextRunID}, pipelineQueues[pipelineID]...)
+		if pipelineRunningCount[pipelineID] > 0 {
+			pipelineRunningCount[pipelineID]--
+		}
+		queueMu.Unlock()
+		return
+	}
+
+	h.markRunStarting(run, nodeID)
+	go h.executePipeline(pipeline, run, nodeID)
 }
 
 // GetQueueStatus 查询流水线队列状态（供 API 使用）

backend/controller/pipeline_node.go

@@ -0,0 +1,263 @@
+package controller
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"ezops/model"
+	"ezops/pkg/remoteexec"
+)
+
+// Master 内置节点 ID（0 表示在本机执行） // Logan.Li
+const masterNodeID uint = 0
+
+var (
+	nodeRunningCount   = make(map[uint]int)
+	masterMaxExecutors = 2
+	nodeMu             sync.Mutex
+)
+
+// ensureBuildMasterConfig 确保 Master 配置行存在并加载到内存 // Logan.Li
+func (h *PipelineHandler) ensureBuildMasterConfig() model.BuildMasterConfig {
+	var cfg model.BuildMasterConfig
+	if err := h.db.First(&cfg).Error; err != nil {
+		cfg = model.BuildMasterConfig{MaxExecutors: 2}
+		h.db.Create(&cfg)
+	}
+	if cfg.MaxExecutors <= 0 {
+		cfg.MaxExecutors = 2
+	}
+	nodeMu.Lock()
+	masterMaxExecutors = cfg.MaxExecutors
+	nodeMu.Unlock()
+	return cfg
+}
+
+// setMasterMaxExecutors 更新 Master 并发上限（内存 + DB） // Logan.Li
+func (h *PipelineHandler) setMasterMaxExecutors(n int) model.BuildMasterConfig {
+	if n <= 0 {
+		n = 1
+	}
+	cfg := h.ensureBuildMasterConfig()
+	cfg.MaxExecutors = n
+	h.db.Model(&cfg).Update("max_executors", n)
+	nodeMu.Lock()
+	masterMaxExecutors = n
+	nodeMu.Unlock()
+	return cfg
+}
+
+// PipelineExecCtx 流水线执行上下文（Master 或远程 SSH 节点） // Logan.Li
+type PipelineExecCtx struct {
+	Remote    bool
+	SSHCfg    *remoteexec.SSHConfig
+	Workspace string
+	NodeID    uint
+	NodeName  string
+}
+
+// tryAcquireBuildNode 尝试占用构建节点执行槽位 // Logan.Li
+func (h *PipelineHandler) tryAcquireBuildNode(pipeline model.Pipeline) (uint, bool) {
+	nodeMu.Lock()
+	defer nodeMu.Unlock()
+
+	// 指定节点
+	if pipeline.BuildNodeID != nil && *pipeline.BuildNodeID > 0 {
+		id := *pipeline.BuildNodeID
+		var node model.BuildNode
+		if h.db.First(&node, id).Error != nil || !node.Enabled {
+			return h.acquireMasterLocked()
+		}
+		max := node.MaxExecutors
+		if max <= 0 {
+			max = 1
+		}
+		if nodeRunningCount[id] < max {
+			nodeRunningCount[id]++
+			return id, true
+		}
+		return id, false
+	}
+
+	// 自动调度：Master 优先，其次负载最低的远程节点
+	if id, ok := h.acquireMasterLocked(); ok {
+		return id, true
+	}
+
+	var nodes []model.BuildNode
+	h.db.Where("enabled = ?", true).Order("id ASC").Find(&nodes)
+	bestID := uint(0)
+	bestScore := 2.0
+	for _, n := range nodes {
+		max := n.MaxExecutors
+		if max <= 0 {
+			max = 1
+		}
+		score := float64(nodeRunningCount[n.ID]) / float64(max)
+		if score < 1.0 && score <= bestScore {
+			bestScore = score
+			bestID = n.ID
+		}
+	}
+	if bestID > 0 {
+		nodeRunningCount[bestID]++
+		return bestID, true
+	}
+	return 0, false
+}
+
+func (h *PipelineHandler) acquireMasterLocked() (uint, bool) {
+	if nodeRunningCount[masterNodeID] < masterMaxExecutors {
+		nodeRunningCount[masterNodeID]++
+		return masterNodeID, true
+	}
+	return masterNodeID, false
+}
+
+// releaseBuildNode 释放构建节点执行槽位 // Logan.Li
+func (h *PipelineHandler) releaseBuildNode(nodeID uint) {
+	nodeMu.Lock()
+	defer nodeMu.Unlock()
+	if nodeRunningCount[nodeID] > 0 {
+		nodeRunningCount[nodeID]--
+	}
+}
+
+// buildExecCtx 根据节点 ID 构建执行上下文 // Logan.Li
+func (h *PipelineHandler) buildExecCtx(nodeID uint, workspace string) (*PipelineExecCtx, error) {
+	ctx := &PipelineExecCtx{
+		Workspace: workspace,
+		NodeID:    nodeID,
+		NodeName:  "Master",
+	}
+	if nodeID == masterNodeID {
+		return ctx, nil
+	}
+	var node model.BuildNode
+	if err := h.db.First(&node, nodeID).Error; err != nil {
+		return nil, fmt.Errorf("构建节点不存在")
+	}
+	var srv model.Server
+	if err := h.db.First(&srv, node.ServerID).Error; err != nil {
+		return nil, fmt.Errorf("节点关联服务器不存在")
+	}
+	cfg, err := buildSSHConfig(h.db, srv)
+	if err != nil {
+		return nil, err
+	}
+	ctx.Remote = true
+	ctx.SSHCfg = &cfg
+	ctx.NodeName = node.Name
+	return ctx, nil
+}
+
+// remoteWorkspacePath 计算远程工作区路径 // Logan.Li
+func remoteWorkspacePath(node model.BuildNode, repoName, code string) string {
+	base := strings.TrimRight(node.WorkspacePath, "/")
+	if base == "" {
+		base = "/data/aiops-workspace"
+	}
+	return fmt.Sprintf("%s/%s-%s", base, repoName, code)
+}
+
+// execOnCtx 在 Master 或远程节点执行 shell 命令 // Logan.Li
+func (h *PipelineHandler) execOnCtx(ctx *PipelineExecCtx, workDir, command string, timeout time.Duration) (string, error) {
+	if timeout <= 0 {
+		timeout = 30 * time.Minute
+	}
+	if !ctx.Remote {
+		cmd := exec.Command("bash", "-c", command)
+		if workDir != "" {
+			cmd.Dir = workDir
+		}
+		out, err := cmd.CombinedOutput()
+		return string(out), err
+	}
+	fullCmd := command
+	if workDir != "" {
+		fullCmd = fmt.Sprintf("cd %s && %s", shellQuotePath(workDir), command)
+	}
+	result, err := remoteexec.Exec(*ctx.SSHCfg, fullCmd, timeout)
+	output := ""
+	if result != nil {
+		output = result.Output
+	}
+	if err != nil || (result != nil && !result.Success) {
+		if err != nil {
+			return output, err
+		}
+		if result.Error != "" {
+			return output, fmt.Errorf("%s", result.Error)
+		}
+		return output, fmt.Errorf("exit=%d", result.ExitCode)
+	}
+	return output, nil
+}
+
+// prepareWorkspace 初始化工作区（本地或远程） // Logan.Li
+func (h *PipelineHandler) prepareWorkspace(ctx *PipelineExecCtx, logFn func(string, string, string)) error {
+	if !ctx.Remote {
+		os.RemoveAll(ctx.Workspace)
+		return os.MkdirAll(ctx.Workspace, 0755)
+	}
+	parent := filepath.Dir(ctx.Workspace)
+	_, err := h.execOnCtx(ctx, "", fmt.Sprintf("rm -rf %s && mkdir -p %s", shellQuotePath(ctx.Workspace), shellQuotePath(parent)), 5*time.Minute)
+	return err
+}
+
+// syncRemoteWorkspaceToLocal 将远程工作区同步到 Master（部署阶段需要本地产物） // Logan.Li
+func (h *PipelineHandler) syncRemoteWorkspaceToLocal(ctx *PipelineExecCtx, localWS string, logFn func(string, string, string)) error {
+	if !ctx.Remote || ctx.SSHCfg == nil {
+		return nil
+	}
+	logFn("info", "同步", fmt.Sprintf(">>> 从节点 %s 回拉工作区", ctx.NodeName))
+	tmpTar := localWS + ".tar.gz"
+	os.RemoveAll(localWS)
+	os.MkdirAll(localWS, 0755)
+
+	if err := remoteexec.StreamRemoteTar(*ctx.SSHCfg, ctx.Workspace, tmpTar, 30*time.Minute); err != nil {
+		return fmt.Errorf("远程打包下载失败: %v", err)
+	}
+	defer os.Remove(tmpTar)
+
+	extract := exec.Command("tar", "xzf", tmpTar, "-C", localWS)
+	if out, err := extract.CombinedOutput(); err != nil {
+		return fmt.Errorf("解压工作区失败: %v, %s", err, string(out))
+	}
+	logFn("success", "同步", "工作区已同步到 Master")
+	return nil
+}
+
+// statOnCtx 检查远程/本地文件是否存在 // Logan.Li
+func (h *PipelineHandler) statOnCtx(ctx *PipelineExecCtx, path string) bool {
+	if !ctx.Remote {
+		_, err := os.Stat(path)
+		return err == nil
+	}
+	out, err := h.execOnCtx(ctx, "", fmt.Sprintf("test -e %s && echo yes", shellQuotePath(path)), 30*time.Second)
+	return err == nil && strings.Contains(out, "yes")
+}
+
+func shellQuotePath(s string) string {
+	return "'" + strings.ReplaceAll(s, "'", "'\\''") + "'"
+}
+
+// pathExists 检查 Master/远程路径是否存在 // Logan.Li
+func (h *PipelineHandler) pathExists(ctx *PipelineExecCtx, path string) bool {
+	return h.statOnCtx(ctx, path)
+}
+
+// hasBuildFileCtx 检查目录是否包含可识别的构建文件 // Logan.Li
+func (h *PipelineHandler) hasBuildFileCtx(ctx *PipelineExecCtx, dir string) bool {
+	for _, f := range []string{"pom.xml", "package.json", "go.mod", "Makefile"} {
+		if h.pathExists(ctx, dir+"/"+f) {
+			return true
+		}
+	}
+	return false
+}

backend/controller/site.go

@@ -71,9 +71,7 @@ func (h *SiteHandler) CreateTask(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "名称和地址不能为空"})
 		return
 	}
-	if task.Frequency < 10 {
-		task.Frequency = 60
-	}
+	task.Frequency = siteprobe.NormalizeProbeFrequency(string(task.TaskType), task.Frequency)
 	if task.Timeout <= 0 {
 		task.Timeout = 10
 	}
@@ -118,7 +116,11 @@ func (h *SiteHandler) UpdateTask(c *gin.Context) {
 		updates["task_type"] = t
 	}
 	if v, ok := raw["frequency_sec"].(float64); ok {
-		updates["frequency"] = int(v)
+		taskType := string(task.TaskType)
+		if tv, ok := updates["task_type"].(string); ok {
+			taskType = tv
+		}
+		updates["frequency"] = siteprobe.NormalizeProbeFrequency(taskType, int(v))
 	}
 	if v, ok := raw["timeout_sec"].(float64); ok {
 		updates["timeout"] = int(v)

backend/controller/site_view.go

@@ -70,6 +70,12 @@ func enrichSiteTaskViewsAlert(db *gorm.DB, views []SiteTaskView) {
 	if len(views) == 0 {
 		return
 	}
+	// 列表加载时清理已恢复任务的陈旧 active 告警（与 down_count 对齐）// Logan.Li
+	for _, v := range views {
+		if v.LastStatus == "up" {
+			siteprobe.ResolveRecoveredProbeAlerts(db, v.ID, "success")
+		}
+	}
 	ids := make([]uint, 0, len(views))
 	for _, v := range views {
 		ids = append(ids, v.ID)
@@ -87,9 +93,15 @@ func enrichSiteTaskViewsAlert(db *gorm.DB, views []SiteTaskView) {
 		alerting[r.TaskID] = true
 	}
 	for i := range views {
-		if alerting[views[i].ID] {
-			views[i].AlertStatus = "alerting"
+		if !alerting[views[i].ID] {
+			continue
 		}
+		// 最近一次拨测成功则显示正常（与 down_count 一致；SSL 证书预警走行内徽章）// Logan.Li
+		if views[i].LastStatus == "up" {
+			views[i].AlertStatus = "normal"
+			continue
+		}
+		views[i].AlertStatus = "alerting"
 	}
 }
 
@@ -195,7 +207,7 @@ func parseCreateTaskRequest(raw map[string]interface{}) model.SiteTask {
 		TaskType:       model.SiteTaskType(taskType),
 		Method:         model.SiteTaskMethodGET,
 		Timeout:        getInt(10, "timeout_sec", "timeout"),
-		Frequency:      getInt(60, "frequency_sec", "frequency"),
+		Frequency:      siteprobe.NormalizeProbeFrequency(taskType, getInt(0, "frequency_sec", "frequency")),
 		ExpectedStatus: getInt(200, "expected_status_code", "expected_status"),
 		FollowRedirect: true,
 		VerifySSL:      true,

backend/controller/tool_config.go

@@ -1,9 +1,11 @@
 package controller
 
 import (
+	"fmt"
 	"log"
 	"net/http"
-	"os/exec"
+	"strings"
+	"time"
 
 	"ezops/model"
 	"ezops/pkg/toolinstaller"
@@ -25,17 +27,69 @@ func NewToolConfigHandler(db *gorm.DB, ti *toolinstaller.ToolInstaller) *ToolCon
 	return &ToolConfigHandler{db: db, installer: ti}
 }
 
+// toolAuditCtx 工具安装审计上下文快照 // Logan.Li
+type toolAuditCtx struct {
+	userID    uint
+	username  string
+	ip        string
+	userAgent string
+}
+
+func newToolAuditCtx(c *gin.Context) toolAuditCtx {
+	uid, _ := c.Get("userID")
+	uname, _ := c.Get("username")
+	id, _ := uid.(uint)
+	name, _ := uname.(string)
+	return toolAuditCtx{
+		userID: id, username: name,
+		ip: c.ClientIP(), userAgent: c.Request.UserAgent(),
+	}
+}
+
+func truncateToolAuditText(s string, n int) string {
+	s = strings.TrimSpace(s)
+	if len(s) > n {
+		return s[:n] + "..."
+	}
+	return s
+}
+
+// recordToolAudit 记录工具安装/检测审计（含安装脚本输出与验证结果）// Logan.Li
+func (h *ToolConfigHandler) recordToolAudit(ac toolAuditCtx, action, toolName, version string, status int, reqDetail, respDetail, errMsg string) {
+	uid := ac.userID
+	h.db.Create(&model.AuditLog{
+		UserID:     &uid,
+		Username:   ac.username,
+		IP:         ac.ip,
+		UserAgent:  ac.userAgent,
+		Module:     "deploy_tool",
+		Action:     action,
+		Resource:   toolName,
+		ResourceID: version,
+		Request:    truncateToolAuditText(reqDetail, 2048),
+		Response:   truncateToolAuditText(respDetail, 8192),
+		Status:     status,
+		Error:      truncateToolAuditText(errMsg, 512),
+	})
+}
+
 // ListTools returns all configured tools
 func (h *ToolConfigHandler) ListTools(c *gin.Context) {
 	var tools []model.DeployTool
 	h.db.Order("sort_order ASC").Find(&tools)
+	// 列表加载时同步失败/安装中状态（磁盘已存在则自动纠正）// Logan.Li
+	for i := range tools {
+		if tools[i].Status == model.ToolFailed || tools[i].Status == model.ToolInstalling {
+			tools[i] = h.installer.SyncToolStatus(tools[i].ID)
+		}
+	}
 	c.JSON(http.StatusOK, model.Response{Code: 200, Data: model.ListResponse{List: tools, Total: int64(len(tools))}})
 }
 
 // GetTool returns a single tool
 func (h *ToolConfigHandler) GetTool(c *gin.Context) {
 	var tool model.DeployTool
-	if err := h.db.First(&tool, c.Param("id")); err.Error != nil {
+	if err := h.db.First(&tool, c.Param("id")).Error; err != nil {
 		c.JSON(http.StatusNotFound, model.Response{Code: 404, Message: "工具不存在"})
 		return
 	}
@@ -45,7 +99,7 @@ func (h *ToolConfigHandler) GetTool(c *gin.Context) {
 // UpdateTool updates a tool's configuration
 func (h *ToolConfigHandler) UpdateTool(c *gin.Context) {
 	var tool model.DeployTool
-	if err := h.db.First(&tool, c.Param("id")); err.Error != nil {
+	if err := h.db.First(&tool, c.Param("id")).Error; err != nil {
 		c.JSON(http.StatusNotFound, model.Response{Code: 404, Message: "工具不存在"})
 		return
 	}
@@ -92,7 +146,7 @@ func (h *ToolConfigHandler) UpdateTool(c *gin.Context) {
 // InstallTool triggers lazy installation with optional version override
 func (h *ToolConfigHandler) InstallTool(c *gin.Context) {
 	var tool model.DeployTool
-	if err := h.db.First(&tool, c.Param("id")); err.Error != nil {
+	if err := h.db.First(&tool, c.Param("id")).Error; err != nil {
 		c.JSON(http.StatusNotFound, model.Response{Code: 404, Message: "工具不存在"})
 		return
 	}
@@ -107,7 +161,6 @@ func (h *ToolConfigHandler) InstallTool(c *gin.Context) {
 		return
 	}
 
-	// Support version override via query param or JSON body
 	version := tool.DefaultVersion
 	if v := c.Query("version"); v != "" {
 		version = v
@@ -115,7 +168,6 @@ func (h *ToolConfigHandler) InstallTool(c *gin.Context) {
 	if v := c.PostForm("version"); v != "" {
 		version = v
 	}
-	// Also support JSON body
 	var req struct {
 		Version string `json:"version"`
 	}
@@ -123,62 +175,125 @@ func (h *ToolConfigHandler) InstallTool(c *gin.Context) {
 		version = req.Version
 	}
 
-	// Store the requested version for the installer
 	if version != "" && version != tool.DefaultVersion {
 		h.db.Model(&tool).Update("default_version", version)
 		tool.DefaultVersion = version
 	}
 
-	// Mark as installing immediately
-	h.db.Model(&tool).Update("status", model.ToolInstalling)
+	h.db.Model(&tool).Updates(map[string]interface{}{
+		"status": model.ToolInstalling, "error_msg": "",
+	})
 
-	// Background installation — actually call the installer
+	ac := newToolAuditCtx(c)
+	toolName := tool.Name
+	toolDisplay := tool.DisplayName
 	go func() {
-		log.Printf("[ToolConfig] Background install triggered for %s (version: %s)", tool.Name, version)
-		if err := h.installer.ForceInstall(tool.Name, version); err != nil {
-			log.Printf("[ToolConfig] ERROR installing %s: %v", tool.Name, err)
+		log.Printf("[ToolConfig] Background install triggered for %s (version: %s)", toolName, version)
+		reqDetail := fmt.Sprintf("tool=%s version=%s", toolName, version)
+		res := h.installer.ForceInstall(toolName, version)
+		var latest model.DeployTool
+		if h.db.Where("name = ?", toolName).First(&latest).Error == nil {
+			latest = h.installer.SyncToolStatus(latest.ID)
+		}
+		respDetail := res.Output
+		if res.VerifyOut != "" {
+			respDetail += "\n--- verify ---\n" + res.VerifyOut
+		}
+		if res.Installed && res.Version != "" {
+			respDetail += "\n--- version ---\n" + res.Version
+		}
+		if res.Err != nil {
+			log.Printf("[ToolConfig] ERROR installing %s: %v", toolName, res.Err)
+			h.recordToolAudit(ac, "install", toolDisplay, version, 0, reqDetail, respDetail, res.Err.Error())
+			return
+		}
+		success := res.Installed || latest.Status == model.ToolInstalled
+		log.Printf("[ToolConfig] %s installed successfully (status=%s installed=%v)", toolName, latest.Status, success)
+		if success {
+			h.recordToolAudit(ac, "install", toolDisplay, version, 1, reqDetail, respDetail, "")
 		} else {
-			log.Printf("[ToolConfig] %s installed successfully", tool.Name)
+			h.recordToolAudit(ac, "install", toolDisplay, version, 0, reqDetail, respDetail, latest.ErrorMsg)
 		}
 	}()
 
 	c.JSON(http.StatusOK, model.Response{Code: 200, Message: "安装已触发", Data: gin.H{"version": version}})
 }
 
-// CheckToolStatus re-checks a tool's installation status
-func (h *ToolConfigHandler) CheckToolStatus(c *gin.Context) {
+// UninstallTool 卸载工具（清理磁盘资源，可重新选择版本安装）// Logan.Li
+func (h *ToolConfigHandler) UninstallTool(c *gin.Context) {
 	var tool model.DeployTool
-	if err := h.db.First(&tool, c.Param("id")); err.Error != nil {
+	if err := h.db.First(&tool, c.Param("id")).Error; err != nil {
 		c.JSON(http.StatusNotFound, model.Response{Code: 404, Message: "工具不存在"})
 		return
 	}
 
-	available := false
-	version := ""
-	if tool.CheckCommand != "" {
-		cmd := exec.Command("sh", "-c", tool.CheckCommand)
-		out, err := cmd.Output()
-		if err == nil {
-			available = true
-			version = string(out)
-			if len(version) > 128 {
-				version = version[:128]
-			}
-		}
+	if tool.InstallMethod != model.ToolLazy {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "仅懒加载工具可手动卸载"})
+		return
 	}
 
-	status := model.ToolNotInstalled
+	if tool.Status != model.ToolInstalled && tool.Status != model.ToolFailed {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "当前状态不可卸载，请先检测或等待安装结束"})
+		return
+	}
+
+	ac := newToolAuditCtx(c)
+	toolName := tool.Name
+	toolDisplay := tool.DisplayName
+	installedVer := tool.InstalledVer
+	reqDetail := fmt.Sprintf("tool=%s installed_ver=%s", toolName, installedVer)
+
+	res := h.installer.Uninstall(toolName)
+	respDetail := res.Output
+	if res.Err != nil {
+		h.recordToolAudit(ac, "uninstall", toolDisplay, installedVer, 0, reqDetail, respDetail, res.Err.Error())
+		c.JSON(http.StatusOK, model.Response{Code: 500, Message: "卸载失败: " + res.Err.Error(), Data: gin.H{"output": respDetail}})
+		return
+	}
+
+	h.recordToolAudit(ac, "uninstall", toolDisplay, installedVer, 1, reqDetail, respDetail, "")
+	c.JSON(http.StatusOK, model.Response{Code: 200, Message: "卸载完成", Data: gin.H{"output": respDetail}})
+}
+
+// CheckToolStatus re-checks a tool's installation status
+func (h *ToolConfigHandler) CheckToolStatus(c *gin.Context) {
+	var tool model.DeployTool
+	if err := h.db.First(&tool, c.Param("id")).Error; err != nil {
+		c.JSON(http.StatusNotFound, model.Response{Code: 404, Message: "工具不存在"})
+		return
+	}
+
+	// 优先磁盘验证，纠正「审计成功但 DB 仍失败/安装中」// Logan.Li
+	available, version := h.installer.VerifyTool(tool)
+	now := time.Now()
+
 	if available {
-		status = model.ToolInstalled
+		h.db.Model(&tool).Updates(map[string]interface{}{
+			"status": model.ToolInstalled, "installed_ver": version,
+			"error_msg": "", "last_check": &now,
+		})
+		tool.Status = model.ToolInstalled
+		tool.InstalledVer = version
+		tool.ErrorMsg = ""
+		c.JSON(http.StatusOK, model.Response{Code: 200, Data: gin.H{
+			"available": true, "version": version, "tool": tool,
+		}})
+		return
+	}
+
+	// 安装中超时
+	if tool.Status == model.ToolInstalling && tool.LastCheck != nil && time.Since(*tool.LastCheck) > 10*time.Minute {
+		msg := "安装超时，请重试"
+		h.db.Model(&tool).Updates(map[string]interface{}{
+			"status": model.ToolFailed, "error_msg": msg, "last_check": &now,
+		})
+		tool.Status = model.ToolFailed
+		tool.ErrorMsg = msg
 	}
-	h.db.Model(&tool).Updates(map[string]interface{}{
-		"status":           status,
-		"installed_version": version,
-	})
 
 	c.JSON(http.StatusOK, model.Response{Code: 200, Data: gin.H{
-		"available": available,
-		"version":   version,
+		"available": false,
+		"version":   "",
 		"tool":      tool,
 	}})
 }
@@ -186,7 +301,7 @@ func (h *ToolConfigHandler) CheckToolStatus(c *gin.Context) {
 // GetToolVersions returns available versions for a tool (jdk/node/maven)
 func (h *ToolConfigHandler) GetToolVersions(c *gin.Context) {
 	var tool model.DeployTool
-	if err := h.db.First(&tool, c.Param("id")); err.Error != nil {
+	if err := h.db.First(&tool, c.Param("id")).Error; err != nil {
 		c.JSON(http.StatusNotFound, model.Response{Code: 404, Message: "工具不存在"})
 		return
 	}
@@ -212,9 +327,12 @@ func getPresetVersions(toolName string) []map[string]string {
 		}
 	case "nodejs":
 		return []map[string]string{
-			{"version": "v18.20.5", "label": "Node 18 (LTS)"},
-			{"version": "v20.18.1", "label": "Node 20 (LTS)"},
-			{"version": "v22.14.0", "label": "Node 22 (LTS) ★ 推荐"},
+			{"version": "lts", "label": "最新 LTS (nvm install --lts) ★ 推荐"},
+			{"version": "v24.18.0", "label": "Node 24.18.0 (LTS Krypton)"},
+			{"version": "v22.23.1", "label": "Node 22.23.1 (LTS Jod)"},
+			{"version": "v20.20.2", "label": "Node 20.20.2 (LTS Iron)"},
+			{"version": "v18.20.8", "label": "Node 18.20.8 (LTS Hydrogen)"},
+			{"version": "v16.20.2", "label": "Node 16.20.2 (LTS Gallium)"},
 		}
 	case "maven":
 		return []map[string]string{
@@ -222,6 +340,19 @@ func getPresetVersions(toolName string) []map[string]string {
 			{"version": "3.8.8", "label": "Maven 3.8.8"},
 			{"version": "3.6.3", "label": "Maven 3.6.3"},
 		}
+	case "golang":
+		return []map[string]string{
+			{"version": "1.24.0", "label": "Go 1.24.0 ★ 推荐（与平台后端一致）"},
+			{"version": "1.23.6", "label": "Go 1.23.6 (LTS)"},
+			{"version": "1.22.12", "label": "Go 1.22.12"},
+			{"version": "1.21.13", "label": "Go 1.21.13"},
+		}
+	case "nvm":
+		return []map[string]string{
+			{"version": "0.40.1", "label": "NVM 0.40.1 ★ 推荐"},
+			{"version": "0.39.7", "label": "NVM 0.39.7"},
+			{"version": "0.38.0", "label": "NVM 0.38.0"},
+		}
 	default:
 		return nil
 	}

backend/middleware/pipeline_access.go

@@ -76,7 +76,7 @@ func PipelineAccess(db *gorm.DB) gin.HandlerFunc {
 				func() uint { uid, _ := c.Get("userID"); return uid.(uint) }()).
 			Find(&itemRoles)
 		for _, ir := range itemRoles {
-			if matched, _ := regexp.MatchString(ir.Pattern, code); matched {
+			if pipelineMatchesItemRole(pipeline, ir.Pattern) {
 				c.Next()
 				return
 			}
@@ -122,7 +122,7 @@ func GetAccessiblePipelineIDs(db *gorm.DB, username string, userID uint) ([]uint
 		db.Find(&allPipelines)
 		for _, p := range allPipelines {
 			for _, ir := range itemRoles {
-				if matched, _ := regexp.MatchString(ir.Pattern, p.Code); matched {
+				if pipelineMatchesItemRole(p, ir.Pattern) {
 					idSet[p.ID] = true
 					break
 				}
@@ -137,3 +137,19 @@ func GetAccessiblePipelineIDs(db *gorm.DB, username string, userID uint) ([]uint
 
 	return ids, len(ids) > 0
 }
+
+// pipelineMatchesItemRole 正则匹配流水线 code 或 Job 名称（Webhook Job） // Logan.Li
+func pipelineMatchesItemRole(p model.Pipeline, pattern string) bool {
+	if pattern == "" {
+		return false
+	}
+	if matched, err := regexp.MatchString(pattern, p.Code); err == nil && matched {
+		return true
+	}
+	if p.JobName != "" {
+		if matched, err := regexp.MatchString(pattern, p.JobName); err == nil && matched {
+			return true
+		}
+	}
+	return false
+}

backend/model/build_node.go

@@ -0,0 +1,61 @@
+package model
+
+import "time"
+
+// BuildNode CI/CD 构建节点（Jenkins Agent 风格，基于 SSH 关联服务器资产） // Logan.Li
+type BuildNode struct {
+	ID            uint      `gorm:"primarykey" json:"id"`
+	Name          string    `gorm:"size:64;not null;uniqueIndex" json:"name"`
+	Description   string    `gorm:"size:255" json:"description"`
+	ServerID      uint      `gorm:"not null;index" json:"server_id"` // FK → servers
+	Labels        string    `gorm:"size:255;comment:标签(逗号分隔,用于调度匹配)" json:"labels,omitempty"`
+	MaxExecutors  int       `gorm:"default:2;comment:最大并发构建数" json:"max_executors"`
+	WorkspacePath string    `gorm:"size:255;default:/data/aiops-workspace;comment:远程工作区根目录" json:"workspace_path"`
+	Enabled       bool      `gorm:"default:true" json:"enabled"`
+	CreatedAt     time.Time `json:"created_at"`
+	UpdatedAt     time.Time `json:"updated_at"`
+
+	// 运行时统计（非持久化，由调度器填充）
+	RunningCount int    `gorm:"-" json:"running_count,omitempty"`
+	Hostname     string `gorm:"-" json:"hostname,omitempty"`
+	IP           string `gorm:"-" json:"ip,omitempty"`
+}
+
+func (BuildNode) TableName() string {
+	return "deploy_build_nodes"
+}
+
+// BuildMasterConfig Master 内置构建节点并发配置（单行） // Logan.Li
+type BuildMasterConfig struct {
+	ID           uint      `gorm:"primarykey" json:"id"`
+	MaxExecutors int       `gorm:"default:2;not null;comment:最大并发(1=串行排队)" json:"max_executors"`
+	UpdatedAt    time.Time `json:"updated_at"`
+}
+
+func (BuildMasterConfig) TableName() string { return "deploy_build_master_config" }
+
+// UpdateBuildMasterRequest 更新 Master 并发数 // Logan.Li
+type UpdateBuildMasterRequest struct {
+	MaxExecutors int `json:"max_executors" binding:"required,min=1,max=32"`
+}
+
+// CreateBuildNodeRequest 创建构建节点
+type CreateBuildNodeRequest struct {
+	Name          string `json:"name" binding:"required"`
+	Description   string `json:"description"`
+	ServerID      uint   `json:"server_id" binding:"required"`
+	Labels        string `json:"labels"`
+	MaxExecutors  int    `json:"max_executors"`
+	WorkspacePath string `json:"workspace_path"`
+}
+
+// UpdateBuildNodeRequest 更新构建节点
+type UpdateBuildNodeRequest struct {
+	Name          string `json:"name"`
+	Description   string `json:"description"`
+	ServerID      *uint  `json:"server_id"`
+	Labels        string `json:"labels"`
+	MaxExecutors  int    `json:"max_executors"`
+	WorkspacePath string `json:"workspace_path"`
+	Enabled       *bool  `json:"enabled"`
+}

backend/model/cicd.go

@@ -27,12 +27,19 @@ type Pipeline struct {
 	// 并发控制
 	MaxExecutors int `gorm:"default:2;comment:最大并发执行数(1=串行,默认2)" json:"max_executors"`
 
+	// 构建节点（nil=自动调度 Master 优先，非 nil=指定节点 ID） // Logan.Li
+	BuildNodeID *uint `json:"build_node_id,omitempty"`
+
 	// SSH 部署目标服务器 (JSON: [1,2,3])
-	ServerIDs string `gorm:"type:text;comment:SSH服务器ID列表(JSON)" json:"server_ids,omitempty"`
+	ServerIDs        string `gorm:"type:text;comment:SSH服务器ID列表(JSON)" json:"server_ids,omitempty"`
+	DeployRemotePath string `gorm:"size:255;comment:SSH部署远程目录" json:"deploy_remote_path,omitempty"`
+	DeployScript     string `gorm:"type:text;comment:SSH部署后执行命令" json:"deploy_script,omitempty"`
 
 	// K8s 部署目标
-	K8sClusterID *uint  `json:"k8s_cluster_id,omitempty"` // FK → kubernetes_clusters
-	K8sNamespace string `gorm:"size:128;comment:K8s部署命名空间" json:"k8s_namespace,omitempty"`
+	K8sClusterID     *uint  `json:"k8s_cluster_id,omitempty"` // FK → kubernetes_clusters
+	K8sNamespace     string `gorm:"size:128;comment:K8s部署命名空间" json:"k8s_namespace,omitempty"`
+	K8sDeployment    string `gorm:"size:128;comment:K8s Deployment 名称" json:"k8s_deployment,omitempty"`
+	K8sContainerName string `gorm:"size:128;comment:K8s更新镜像目标容器" json:"k8s_container_name,omitempty"`
 
 	// 仓库和镜像仓库关联（旧字段，待废弃）
 	RepoID     *uint `json:"repo_id"`     // FK → deploy_pipeline_repos
@@ -87,6 +94,8 @@ type PipelineRun struct {
 	ImageTag    string         `gorm:"size:255" json:"image_tag"`   // 构建产物镜像标签
 	ArtifactURL string         `gorm:"size:500" json:"artifact_url"` // 构建产物地址
 	WorkspacePath string      `gorm:"size:500" json:"workspace_path"` // 工作区路径
+	BuildNodeID   *uint        `json:"build_node_id,omitempty"`         // 实际执行节点（0/nil=Master）
+	BuildNodeName string       `gorm:"size:64" json:"build_node_name,omitempty"`
 	Duration    int            `json:"duration"` // 秒
 	Stages      string         `gorm:"type:text" json:"stages"` // JSON
 	Logs        string         `gorm:"type:longtext" json:"logs"`
@@ -153,9 +162,13 @@ type CreatePipelineRequest struct {
 	// 部署模式
 	DeployMode   string `json:"deploy_mode"`   // branch / tag
 	DeployTarget string `json:"deploy_target"` // ssh / k8s
-	ServerIDs    string `json:"server_ids"`    // SSH 服务器ID JSON [1,2,3]
-	K8sClusterID *uint  `json:"k8s_cluster_id"`
-	K8sNamespace string `json:"k8s_namespace"`
+	ServerIDs        string `json:"server_ids"` // SSH 服务器ID JSON [1,2,3]
+	DeployRemotePath string `json:"deploy_remote_path"`
+	DeployScript     string `json:"deploy_script"`
+	K8sClusterID     *uint  `json:"k8s_cluster_id"`
+	K8sNamespace     string `json:"k8s_namespace"`
+	K8sDeployment    string `json:"k8s_deployment"`
+	K8sContainerName string `json:"k8s_container_name"`
 
 	RepoID      *uint  `json:"repo_id"`
 	RegistryID  *uint  `json:"registry_id"`
@@ -176,6 +189,9 @@ type CreatePipelineRequest struct {
 
 	// 并发控制
 	MaxExecutors int `json:"max_executors"`
+
+	// 构建节点
+	BuildNodeID *uint `json:"build_node_id"`
 }
 
 // UpdatePipelineRequest 更新流水线请求
@@ -191,9 +207,13 @@ type UpdatePipelineRequest struct {
 	Variables   string `json:"variables"`
 	DeployMode   string `json:"deploy_mode"`
 	DeployTarget string `json:"deploy_target"`
-	ServerIDs    string `json:"server_ids"`
-	K8sClusterID *uint  `json:"k8s_cluster_id"`
-	K8sNamespace string `json:"k8s_namespace"`
+	ServerIDs        string `json:"server_ids"`
+	DeployRemotePath string `json:"deploy_remote_path"`
+	DeployScript     string `json:"deploy_script"`
+	K8sClusterID     *uint  `json:"k8s_cluster_id"`
+	K8sNamespace     string `json:"k8s_namespace"`
+	K8sDeployment    string `json:"k8s_deployment"`
+	K8sContainerName string `json:"k8s_container_name"`
 	RepoID      *uint  `json:"repo_id"`
 	RegistryID  *uint  `json:"registry_id"`
 	// 凭证关联
@@ -212,6 +232,9 @@ type UpdatePipelineRequest struct {
 
 	// 并发控制
 	MaxExecutors int `json:"max_executors"`
+
+	// 构建节点（传 null 清除绑定）
+	BuildNodeID *uint `json:"build_node_id"`
 }
 
 // TriggerPipelineRequest 触发流水线请求

backend/model/deploy_tool.go

@@ -74,26 +74,65 @@ func PredefinedTools() []DeployTool {
 			InstallMethod:  ToolLazy,
 			BinaryName:     "java",
 			InstallPath:    "/usr/local/bin/java",
-			CheckCommand:   "java -version 2>&1 | head -1",
+			CheckCommand:   "/usr/local/bin/java -version 2>&1 | head -1",
 			VersionURL:     "https://api.adoptium.net/v3/info/release_versions?heap_size=normal&image_type=jdk&page=0&page_size=1&project=jdk&release_type=ga&semver=false&sort_method=DEFAULT&sort_order=DESC&version=%5B17%2C99%5D",
 			DownloadURL:    "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-{version}/OpenJDK17U-jdk_x64_linux_hotspot_{version}.tar.gz",
 			DefaultVersion: "17.0.13+7",
 			InstallScript: `#!/bin/sh
-# JDK lazy install — Temurin OpenJDK
+# JDK lazy install — Alpine apk 优先，否则 Adoptium API 多镜像 // Logan.Li
 JDK_VERSION="${TOOL_VERSION:-17.0.13+7}"
 JDK_MAJOR=$(echo "$JDK_VERSION" | cut -d. -f1)
-JDK_URL="https://github.com/adoptium/temurin${JDK_MAJOR}-binaries/releases/download/jdk-${JDK_VERSION}/OpenJDK${JDK_MAJOR}U-jdk_x64_linux_hotspot_${JDK_VERSION}.tar.gz"
-echo "[JDK] Downloading ${JDK_VERSION}..."
-cd /tmp
-curl -sL "$JDK_URL" -o jdk.tar.gz
+JDK_FILE_VER=$(echo "$JDK_VERSION" | tr '+' '_')
+echo "[JDK] Installing ${JDK_VERSION} (major ${JDK_MAJOR})..."
+
+if command -v apk >/dev/null 2>&1; then
+  case "$JDK_MAJOR" in
+    11) APK_PKG="openjdk11-jdk" ;;
+    17) APK_PKG="openjdk17-jdk" ;;
+    21) APK_PKG="openjdk21-jdk" ;;
+    *) APK_PKG="" ;;
+  esac
+  if [ -n "$APK_PKG" ]; then
+    echo "[JDK] Trying apk: $APK_PKG"
+    if apk add --no-cache "$APK_PKG"; then
+      JAVA_BIN=$(command -v java 2>/dev/null || echo "/usr/lib/jvm/java-${JDK_MAJOR}-openjdk/bin/java")
+      mkdir -p /usr/local/bin /usr/local/share/jdk/bin
+      ln -sf "$JAVA_BIN" /usr/local/bin/java
+      ln -sf "$(dirname "$JAVA_BIN")/javac" /usr/local/bin/javac 2>/dev/null || true
+      ln -sf "$(dirname "$JAVA_BIN")/jar" /usr/local/bin/jar 2>/dev/null || true
+      echo "[JDK] Installed via apk: $(java -version 2>&1 | head -1)"
+      exit 0
+    fi
+  fi
+fi
+
+cd /tmp && rm -rf jdk.tar.gz jdk-install
+mkdir -p jdk-install && cd jdk-install
+DOWNLOADED=0
+for URL in \
+  "https://api.adoptium.net/v3/binary/version/${JDK_VERSION}/linux/x64/jdk/hotspot/normal/eclipse?project=jdk" \
+  "https://mirrors.tuna.tsinghua.edu.cn/Adoptium/${JDK_MAJOR}/jdk/${JDK_VERSION}/OpenJDK${JDK_MAJOR}U-jdk_x64_linux_hotspot_${JDK_FILE_VER}.tar.gz" \
+  "https://github.com/adoptium/temurin${JDK_MAJOR}-binaries/releases/download/jdk-${JDK_VERSION}/OpenJDK${JDK_MAJOR}U-jdk_x64_linux_hotspot_${JDK_FILE_VER}.tar.gz"
+do
+  echo "[JDK] Trying $URL"
+  if curl -fsSL -L -o jdk.tar.gz "$URL"; then
+    DOWNLOADED=1
+    break
+  fi
+  rm -f jdk.tar.gz
+done
+[ "$DOWNLOADED" -eq 1 ] || { echo "[JDK] all mirrors failed"; exit 1; }
 tar xzf jdk.tar.gz
+JDK_DIR=$(find . -maxdepth 1 -type d -name 'jdk-*' | head -1)
+[ -n "$JDK_DIR" ] || { echo "[JDK] extract dir not found"; exit 1; }
 mkdir -p /usr/local/share
-mv jdk-${JDK_VERSION} /usr/local/share/jdk
+rm -rf /usr/local/share/jdk
+mv "$JDK_DIR" /usr/local/share/jdk
 ln -sf /usr/local/share/jdk/bin/java /usr/local/bin/java
 ln -sf /usr/local/share/jdk/bin/javac /usr/local/bin/javac
 ln -sf /usr/local/share/jdk/bin/jar /usr/local/bin/jar
-rm -f jdk.tar.gz
-echo "[JDK] Installed: $(java -version 2>&1 | head -1)"
+cd /tmp && rm -rf jdk-install
+echo "[JDK] Installed: $(/usr/local/bin/java -version 2>&1 | head -1)"
 `,
 			SortOrder: 1,
 		},
@@ -106,26 +145,100 @@ echo "[JDK] Installed: $(java -version 2>&1 | head -1)"
 			InstallMethod:  ToolLazy,
 			BinaryName:     "mvn",
 			InstallPath:    "/usr/local/bin/mvn",
-			CheckCommand:   "mvn --version 2>/dev/null",
+			CheckCommand:   "/usr/local/bin/mvn --version 2>/dev/null | head -1",
 			DownloadURL:    "https://dlcdn.apache.org/maven/maven-3/{version}/binaries/apache-maven-{version}-bin.tar.gz",
 			VersionURL:     "https://dlcdn.apache.org/maven/maven-3/",
 			DefaultVersion: "3.9.9",
 			InstallScript: `#!/bin/sh
-# Maven lazy install — download & extract
+# Maven lazy install — 多镜像轮询 // Logan.Li
 MAVEN_VERSION="${TOOL_VERSION:-3.9.9}"
-MAVEN_URL="https://dlcdn.apache.org/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz"
 echo "[Maven] Downloading ${MAVEN_VERSION}..."
-cd /tmp
-curl -sL "$MAVEN_URL" -o maven.tar.gz
+cd /tmp && rm -rf maven.tar.gz maven-install
+mkdir -p maven-install && cd maven-install
+DOWNLOADED=0
+for URL in \
+  "https://mirrors.tuna.tsinghua.edu.cn/apache/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz" \
+  "https://repo.huaweicloud.com/apache/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz" \
+  "https://dlcdn.apache.org/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz" \
+  "https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz"
+do
+  echo "[Maven] Trying $URL"
+  if curl -fsSL -o maven.tar.gz "$URL"; then
+    DOWNLOADED=1
+    break
+  fi
+  rm -f maven.tar.gz
+done
+[ "$DOWNLOADED" -eq 1 ] || { echo "[Maven] all mirrors failed"; exit 1; }
 tar xzf maven.tar.gz
+MVN_DIR=$(find . -maxdepth 1 -type d -name 'apache-maven-*' | head -1)
+[ -n "$MVN_DIR" ] || { echo "[Maven] extract dir not found"; exit 1; }
 mkdir -p /usr/local/share
-mv apache-maven-${MAVEN_VERSION} /usr/local/share/maven
+rm -rf /usr/local/share/maven
+mv "$MVN_DIR" /usr/local/share/maven
 ln -sf /usr/local/share/maven/bin/mvn /usr/local/bin/mvn
-rm -f maven.tar.gz
-echo "[Maven] Installed: $(mvn --version 2>&1 | head -1)"
+cd /tmp && rm -rf maven-install
+echo "[Maven] Installed: $(/usr/local/bin/mvn --version 2>&1 | head -1)"
 `,
 			SortOrder: 2,
 		},
+		// ──── Go — 后端构建 // Logan.Li ────
+		{
+			Name:           "golang",
+			DisplayName:    "Go (Golang)",
+			Description:    "Go 语言工具链，流水线 go build/test 阶段使用",
+			Category:       "build",
+			InstallMethod:  ToolLazy,
+			BinaryName:     "go",
+			InstallPath:    "/usr/local/bin/go",
+			CheckCommand:   "/usr/local/bin/go version 2>/dev/null",
+			DownloadURL:    "https://go.dev/dl/go{version}.linux-amd64.tar.gz",
+			DefaultVersion: "1.24.0",
+			InstallScript: `#!/bin/sh
+# Go lazy install — 国内镜像优先 // Logan.Li
+GO_VERSION="${TOOL_VERSION:-1.24.0}"
+GO_VERSION="${GO_VERSION#go}"
+echo "[Go] Installing go${GO_VERSION}..."
+cd /tmp && rm -rf go.tar.gz go-install
+mkdir -p go-install && cd go-install
+DOWNLOADED=0
+for URL in \
+  "https://golang.google.cn/dl/go${GO_VERSION}.linux-amd64.tar.gz" \
+  "https://mirrors.aliyun.com/golang/go${GO_VERSION}.linux-amd64.tar.gz" \
+  "https://mirrors.ustc.edu.cn/golang/go${GO_VERSION}.linux-amd64.tar.gz" \
+  "https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz"
+do
+  echo "[Go] Trying $URL"
+  if curl -fsSL -L -o go.tar.gz "$URL"; then
+    DOWNLOADED=1
+    break
+  fi
+  rm -f go.tar.gz
+done
+[ "$DOWNLOADED" -eq 1 ] || { echo "[Go] all mirrors failed"; exit 1; }
+tar xzf go.tar.gz
+[ -d go ] || { echo "[Go] extract dir not found"; exit 1; }
+rm -rf /usr/local/go
+mv go /usr/local/go
+mkdir -p /usr/local/bin
+ln -sf /usr/local/go/bin/go /usr/local/bin/go
+ln -sf /usr/local/go/bin/gofmt /usr/local/bin/gofmt
+mkdir -p /etc/profile.d
+cat > /etc/profile.d/golang.sh << 'GO_PROFILE'
+export GOROOT=/usr/local/go
+export PATH=$GOROOT/bin:$PATH
+export GOPROXY=https://goproxy.cn,direct
+export GOTOOLCHAIN=local
+GO_PROFILE
+chmod +x /etc/profile.d/golang.sh
+export GOROOT=/usr/local/go
+export PATH=$GOROOT/bin:$PATH
+export GOPROXY=https://goproxy.cn,direct
+export GOTOOLCHAIN=local
+echo "[Go] Installed: $(/usr/local/bin/go version)"
+`,
+			SortOrder: 3,
+		},
 		// ──── NVM — Node Version Manager // Logan.Li ────
 		{
 			Name:           "nvm",
@@ -135,26 +248,30 @@ echo "[Maven] Installed: $(mvn --version 2>&1 | head -1)"
 			InstallMethod:  ToolLazy,
 			BinaryName:     "nvm",
 			InstallPath:    "/usr/local/share/nvm/nvm.sh",
-			CheckCommand:   "source /usr/local/share/nvm/nvm.sh 2>/dev/null && nvm --version 2>/dev/null",
+			CheckCommand:   ". /usr/local/share/nvm/nvm.sh 2>/dev/null && nvm --version 2>/dev/null",
 			VersionURL:     "https://api.github.com/repos/nvm-sh/nvm/releases/latest",
 			DefaultVersion: "0.40.1",
 			InstallScript: `#!/bin/sh
-# NVM lazy install
+# NVM lazy install — 使用 bash 执行官方脚本 // Logan.Li
 NVM_VERSION="${TOOL_VERSION:-0.40.1}"
 NVM_DIR="/usr/local/share/nvm"
-echo "[NVM] Downloading ${NVM_VERSION}..."
+echo "[NVM] Downloading v${NVM_VERSION}..."
 mkdir -p "$NVM_DIR"
-curl -sL "https://raw.githubusercontent.com/nvm-sh/nvm/v${NVM_VERSION}/install.sh" | NVM_DIR="$NVM_DIR" bash
-# Make available system-wide via profile.d
+curl -fsSL "https://raw.githubusercontent.com/nvm-sh/nvm/v${NVM_VERSION}/install.sh" -o /tmp/nvm-install.sh
+export NVM_DIR
+bash /tmp/nvm-install.sh
+rm -f /tmp/nvm-install.sh
+[ -s "$NVM_DIR/nvm.sh" ] || { echo "[NVM] nvm.sh not found"; exit 1; }
+mkdir -p /etc/profile.d
 cat > /etc/profile.d/nvm.sh << 'NVM_PROFILE'
 export NVM_DIR="/usr/local/share/nvm"
-[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
-[ -s "$NVM_DIR/bash_completion" ] && \. "$NVM_DIR/bash_completion"
+[ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"
 NVM_PROFILE
 chmod +x /etc/profile.d/nvm.sh
-echo "[NVM] Installed: v${NVM_VERSION}"
+. "$NVM_DIR/nvm.sh"
+echo "[NVM] Installed: $(nvm --version 2>/dev/null || echo v${NVM_VERSION})"
 `,
-			SortOrder: 3,
+			SortOrder: 4,
 		},
 		// ──── Node.js — 通过 NVM 安装 // Logan.Li ────
 		{
@@ -166,30 +283,74 @@ echo "[NVM] Installed: v${NVM_VERSION}"
 			BinaryName:     "node",
 			InstallPath:    "/usr/local/bin/node",
 			CheckCommand:   "node --version 2>/dev/null",
-			DefaultVersion: "v22.14.0",
+			DefaultVersion: "lts",
 			InstallScript: `#!/bin/sh
-# Node.js via NVM install
-NODE_VERSION="${TOOL_VERSION:-v22.14.0}"
-echo "[Node.js] Installing via NVM ${NODE_VERSION}..."
-export NVM_DIR="/usr/local/share/nvm"
-[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
-if ! command -v nvm >/dev/null 2>&1; then
-  # NVM not found — install it first
-  echo "[Node.js] NVM not found, installing NVM first..."
-  curl -sL "https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh" | NVM_DIR="$NVM_DIR" bash
-  \. "$NVM_DIR/nvm.sh"
-fi
-nvm install "${NODE_VERSION#v}"
-nvm alias default "${NODE_VERSION#v}"
-nvm use "${NODE_VERSION#v}"
-# Symlink for system-wide access
-ln -sf "$NVM_DIR/versions/node/$(nvm version)/bin/node" /usr/local/bin/node
-ln -sf "$NVM_DIR/versions/node/$(nvm version)/bin/npm" /usr/local/bin/npm
-ln -sf "$NVM_DIR/versions/node/$(nvm version)/bin/npx" /usr/local/bin/npx
-npm config set registry https://registry.npmmirror.com
-echo "[Node.js] Installed: $(node --version) / npm $(npm --version)"
+# Node.js 安装 — Alpine 用 unofficial-builds musl 包（官方已停 musl 预编译）// Logan.Li
+NODE_VERSION="${TOOL_VERSION:-lts}"
+NVM_DIR="/usr/local/share/nvm"
+NODE_MIRROR="${NODE_MIRROR:-https://npmmirror.com/mirrors/node}"
+echo "[Node.js] Installing (${NODE_VERSION})..."
+mkdir -p "$NVM_DIR/versions/node"
+export NVM_DIR
+
+resolve_version() {
+  case "$1" in
+    lts)
+      curl -fsSL "https://nodejs.org/dist/index.json" 2>/dev/null | python3 -c "import json,sys; d=json.load(sys.stdin); print(next(x['version'] for x in d if x.get('lts')))" 2>/dev/null || echo "v24.18.0"
+      ;;
+    latest|node)
+      curl -fsSL "https://nodejs.org/dist/index.json" 2>/dev/null | python3 -c "import json,sys; print(json.load(sys.stdin)[0]['version'])" 2>/dev/null || echo "v24.18.0"
+      ;;
+    *)
+      echo "v${1#v}"
+      ;;
+  esac
+}
+
+direct_install_binary() {
+  RESOLVED="$1"
+  DEST="$NVM_DIR/versions/node/${RESOLVED}"
+  TMP="/tmp/node-dl-$$"
+  rm -rf "$TMP" "$DEST"
+  mkdir -p "$TMP"
+  if [ -f /etc/alpine-release ]; then
+    # Node 官方仅 glibc；Alpine musl 走 unofficial-builds // Logan.Li
+    URLS="https://unofficial-builds.nodejs.org/download/release/${RESOLVED}/node-${RESOLVED}-linux-x64-musl.tar.xz"
+  else
+    URLS="${NODE_MIRROR}/${RESOLVED}/node-${RESOLVED}-linux-x64.tar.xz https://nodejs.org/dist/${RESOLVED}/node-${RESOLVED}-linux-x64.tar.xz"
+  fi
+  for URL in $URLS; do
+    echo "[Node.js] Downloading $URL"
+    rm -rf "$TMP"/* 2>/dev/null || true
+    if curl -fsSL -L "$URL" | tar -xJ -C "$TMP" 2>/dev/null; then
+      SUB=$(find "$TMP" -mindepth 1 -maxdepth 1 -type d | head -1)
+      if [ -n "$SUB" ] && [ -x "$SUB/bin/node" ]; then
+        mv "$SUB" "$DEST"
+        rm -rf "$TMP"
+        echo "[Node.js] Installed $RESOLVED"
+        return 0
+      fi
+    fi
+    echo "[Node.js] Failed: $URL"
+  done
+  rm -rf "$TMP"
+  return 1
+}
+
+RESOLVED=$(resolve_version "$NODE_VERSION")
+[ -n "$RESOLVED" ] || { echo "[Node.js] cannot resolve version for $NODE_VERSION"; exit 1; }
+echo "[Node.js] Target version: $RESOLVED"
+direct_install_binary "$RESOLVED" || { echo "[Node.js] binary install failed"; exit 1; }
+
+INST="$RESOLVED"
+mkdir -p /usr/local/bin
+ln -sf "$NVM_DIR/versions/node/${INST}/bin/node" /usr/local/bin/node
+ln -sf "$NVM_DIR/versions/node/${INST}/bin/npm" /usr/local/bin/npm
+ln -sf "$NVM_DIR/versions/node/${INST}/bin/npx" /usr/local/bin/npx
+"$NVM_DIR/versions/node/${INST}/bin/npm" config set registry https://registry.npmmirror.com
+echo "[Node.js] Installed: $(/usr/local/bin/node --version) / npm $("$NVM_DIR/versions/node/${INST}/bin/npm" --version)"
 `,
-			SortOrder: 4,
+			SortOrder: 5,
 		},
 		// ──── Git — 版本控制（懒加载, U4 镜像瘦身）// Logan.Li ────
 		{
@@ -202,7 +363,7 @@ echo "[Node.js] Installed: $(node --version) / npm $(npm --version)"
 			InstallPath:    "/usr/bin/git",
 			CheckCommand:   "git --version 2>/dev/null",
 			InstallScript: `apk add --no-cache git`,
-			SortOrder:      5,
+			SortOrder:      6,
 		},
 		// ──── Docker CLI — 容器构建（懒加载, U4 镜像瘦身）// Logan.Li ────
 		{
@@ -215,7 +376,7 @@ echo "[Node.js] Installed: $(node --version) / npm $(npm --version)"
 			InstallPath:    "/usr/bin/docker",
 			CheckCommand:   "docker --version 2>/dev/null",
 			InstallScript:  `apk add --no-cache docker-cli`,
-			SortOrder:      6,
+			SortOrder:      7,
 		},
 	}
 }

backend/model/log_scope_role.go

@@ -0,0 +1,72 @@
+package model
+
+import "time"
+
+// LogScopeRole 日志查询范围权限（正则匹配 ES 索引 / Loki label） // Logan.Li
+type LogScopeRole struct {
+	ID            uint      `gorm:"primarykey" json:"id"`
+	Name          string    `gorm:"size:64;not null" json:"name"`
+	Code          string    `gorm:"size:64;uniqueIndex;not null" json:"code"`
+	Engine        string    `gorm:"size:32;default:*;comment:引擎 loki/elasticsearch/*" json:"engine"`
+	MatchField    string    `gorm:"size:32;not null;comment:匹配维度 index/app/namespace/job" json:"match_field"`
+	Pattern       string    `gorm:"size:255;not null;comment:正则表达式" json:"pattern"`
+	DatasourceID  *uint     `json:"datasource_id,omitempty"`
+	Role          string    `gorm:"size:16;default:viewer;comment:viewer/analyst" json:"role"`
+	Description   string    `gorm:"size:255" json:"description"`
+	Status        int       `gorm:"default:1;comment:0禁用1启用" json:"status"`
+	CreatedAt     time.Time `json:"created_at"`
+	UpdatedAt     time.Time `json:"updated_at"`
+}
+
+func (LogScopeRole) TableName() string { return "monitor_log_scope_roles" }
+
+// UserLogScopeRole 用户 ↔ 日志范围权限 // Logan.Li
+type UserLogScopeRole struct {
+	ID             uint      `gorm:"primarykey" json:"id"`
+	UserID         uint      `gorm:"uniqueIndex:idx_user_log_scope;not null" json:"user_id"`
+	LogScopeRoleID uint      `gorm:"uniqueIndex:idx_user_log_scope;not null" json:"log_scope_role_id"`
+	CreatedAt      time.Time `json:"created_at"`
+
+	LogScopeRole *LogScopeRole `json:"log_scope_role,omitempty" gorm:"foreignKey:LogScopeRoleID"`
+}
+
+func (UserLogScopeRole) TableName() string { return "monitor_user_log_scope_roles" }
+
+// CreateLogScopeRoleRequest 创建日志权限策略 // Logan.Li
+type CreateLogScopeRoleRequest struct {
+	Name         string `json:"name" binding:"required,max=64"`
+	Code         string `json:"code" binding:"required,max=64"`
+	Engine       string `json:"engine" binding:"omitempty,oneof=loki elasticsearch *"`
+	MatchField   string `json:"match_field" binding:"required,oneof=index app namespace job"`
+	Pattern      string `json:"pattern" binding:"required,max=255"`
+	DatasourceID *uint  `json:"datasource_id"`
+	Role         string `json:"role" binding:"omitempty,oneof=viewer analyst"`
+	Description  string `json:"description"`
+}
+
+// UpdateLogScopeRoleRequest 更新日志权限策略 // Logan.Li
+type UpdateLogScopeRoleRequest struct {
+	Name         string `json:"name"`
+	Code         string `json:"code"`
+	Engine       string `json:"engine"`
+	MatchField   string `json:"match_field"`
+	Pattern      string `json:"pattern"`
+	DatasourceID *uint  `json:"datasource_id"`
+	Role         string `json:"role"`
+	Description  string `json:"description"`
+	Status       *int   `json:"status"`
+}
+
+// AssignLogScopeRoleRequest 用户授权（user_id 取自 URL 路径）// Logan.Li
+type AssignLogScopeRoleRequest struct {
+	LogScopeRoleID uint `json:"log_scope_role_id" binding:"required"`
+}
+
+// PreviewLogScopeRequest 命中预览 // Logan.Li
+type PreviewLogScopeRequest struct {
+	Engine        string `json:"engine" binding:"required,oneof=loki elasticsearch"`
+	DatasourceID  uint   `json:"datasource_id"`
+	Index         string `json:"index"`
+	Query         string `json:"query"`
+	SampleValue   string `json:"sample_value"`
+}

backend/pkg/database/database.go

@@ -99,6 +99,7 @@ func AutoMigrate(db *gorm.DB) error {
 		&model.MetricData{},
 		&model.Pipeline{},
 		&model.PipelineRun{},
+		&model.BuildNode{},
 		&model.AppRelease{},
 		&model.CronJob{},
 		&model.Script{},
@@ -157,6 +158,9 @@ func AutoMigrate(db *gorm.DB) error {
 		&model.DeployUserGroupMember{}, // 用户组成员 // Logan.Li
 		&model.ItemRole{},            // Jenkins-style Item Role (regex pipeline matching) // Logan.Li
 		&model.UserItemRole{},        // User ↔ ItemRole association // Logan.Li
+		&model.LogScopeRole{},        // 日志查询范围权限（正则匹配索引/Label）// Logan.Li
+		&model.UserLogScopeRole{},    // 用户 ↔ 日志范围权限 // Logan.Li
+		&model.BuildMasterConfig{},   // Master 构建节点并发配置 // Logan.Li
 		&model.DeployTool{},          // 工具配置（懒加载/预装/禁用） // Logan.Li
 		&model.AlertCondition{},        // 告警条件 // Logan.Li
 		&model.AlertNotifyTemplate{},   // 告警通知模板 // Logan.Li
@@ -216,4 +220,15 @@ func applySchemaPatches(db *gorm.DB) {
 	patchLogDSColumn("AuthType", "auth_type")
 	patchLogDSColumn("Token", "token")
 	patchLogDSColumn("Headers", "headers")
+
+	// 日志权限关联表：AutoMigrate 在 MySQL 索引冲突时可能只创建策略表未创建用户关联表 // Logan.Li
+	ensureTable := func(tbl interface{}, name string) {
+		if !m.HasTable(tbl) {
+			if err := db.AutoMigrate(tbl); err != nil {
+				log.Printf("[DB] 补表 %s 失败: %v", name, err)
+			}
+		}
+	}
+	ensureTable(&model.LogScopeRole{}, "monitor_log_scope_roles")
+	ensureTable(&model.UserLogScopeRole{}, "monitor_user_log_scope_roles")
 }

backend/pkg/logaccess/access.go

@@ -0,0 +1,227 @@
+package logaccess
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+
+	"ezops/model"
+
+	"gorm.io/gorm"
+)
+
+// QueryContext 日志查询授权上下文 // Logan.Li
+type QueryContext struct {
+	Engine       string
+	DatasourceID uint
+	Index        string
+	Query        string
+}
+
+var (
+	lokiSelectorRe = regexp.MustCompile(`\{([^}]*)\}`)
+	lokiLabelRe    = regexp.MustCompile(`([a-zA-Z_][\w.-]*)\s*(=|!=|=~|!~)\s*("([^"]*)"|'([^']*)'|([^\s,}]+))`)
+	esAppRe        = regexp.MustCompile(`(?i)\bapp:(\*|"[^"]+"|'[^']+'|[^\s)]+)`)
+)
+
+// GetUserLogScopeRoles 获取用户已启用的日志权限策略 // Logan.Li
+func GetUserLogScopeRoles(db *gorm.DB, userID uint) ([]model.LogScopeRole, error) {
+	var roles []model.LogScopeRole
+	err := db.Table("monitor_log_scope_roles").
+		Joins("JOIN monitor_user_log_scope_roles ON monitor_user_log_scope_roles.log_scope_role_id = monitor_log_scope_roles.id").
+		Where("monitor_user_log_scope_roles.user_id = ? AND monitor_log_scope_roles.status = 1", userID).
+		Find(&roles).Error
+	return roles, err
+}
+
+// UserHasAssignments 用户是否已分配日志权限（未分配则保持兼容：不拦截） // Logan.Li
+func UserHasAssignments(db *gorm.DB, userID uint) bool {
+	var n int64
+	db.Model(&model.UserLogScopeRole{}).Where("user_id = ?", userID).Count(&n)
+	return n > 0
+}
+
+// CanQuery 校验用户是否允许执行该日志查询 // Logan.Li
+func CanQuery(db *gorm.DB, userID uint, isAdmin bool, qc QueryContext) (bool, string) {
+	if isAdmin {
+		return true, ""
+	}
+	if !UserHasAssignments(db, userID) {
+		return true, ""
+	}
+	roles, err := GetUserLogScopeRoles(db, userID)
+	if err != nil || len(roles) == 0 {
+		return false, "未分配可用的日志查询权限，请联系管理员"
+	}
+	for _, r := range roles {
+		if roleAllowsQuery(r, qc) {
+			return true, ""
+		}
+	}
+	return false, "无权查询该日志范围（索引/Label 未命中授权策略）"
+}
+
+// FilterDataSources 按授权过滤可见数据源 // Logan.Li
+func FilterDataSources(db *gorm.DB, userID uint, isAdmin bool, sources []model.LogDataSource) []model.LogDataSource {
+	if isAdmin || !UserHasAssignments(db, userID) {
+		return sources
+	}
+	roles, _ := GetUserLogScopeRoles(db, userID)
+	if len(roles) == 0 {
+		return []model.LogDataSource{}
+	}
+	out := make([]model.LogDataSource, 0, len(sources))
+	for _, ds := range sources {
+		if datasourceAllowed(roles, ds) {
+			out = append(out, ds)
+		}
+	}
+	return out
+}
+
+// MatchRolesForPreview 返回命中预览的策略列表 // Logan.Li
+func MatchRolesForPreview(roles []model.LogScopeRole, qc QueryContext, sample string) []model.LogScopeRole {
+	matched := make([]model.LogScopeRole, 0)
+	for _, r := range roles {
+		if roleAllowsQuery(r, qc) {
+			matched = append(matched, r)
+			continue
+		}
+		if sample != "" && regexpMatch(r.Pattern, sample) && engineMatches(r.Engine, qc.Engine) {
+			if r.DatasourceID == nil || *r.DatasourceID == 0 || *r.DatasourceID == qc.DatasourceID {
+				if fieldMatchesEngine(r.MatchField, qc.Engine) {
+					matched = append(matched, r)
+				}
+			}
+		}
+	}
+	return matched
+}
+
+func datasourceAllowed(roles []model.LogScopeRole, ds model.LogDataSource) bool {
+	for _, r := range roles {
+		if !engineMatches(r.Engine, ds.Type) {
+			continue
+		}
+		if r.DatasourceID == nil || *r.DatasourceID == 0 || *r.DatasourceID == ds.ID {
+			return true
+		}
+	}
+	return false
+}
+
+func roleAllowsQuery(r model.LogScopeRole, qc QueryContext) bool {
+	if !engineMatches(r.Engine, qc.Engine) {
+		return false
+	}
+	if r.DatasourceID != nil && *r.DatasourceID > 0 && *r.DatasourceID != qc.DatasourceID {
+		return false
+	}
+	switch r.MatchField {
+	case "index":
+		if qc.Engine != "elasticsearch" {
+			return false
+		}
+		idx := strings.TrimSpace(qc.Index)
+		if idx == "" {
+			idx = "*"
+		}
+		return regexpMatch(r.Pattern, idx)
+	case "app", "namespace", "job":
+		values := extractFieldValues(qc.Engine, qc.Query, r.MatchField)
+		if len(values) == 0 {
+			return false
+		}
+		for _, v := range values {
+			if regexpMatch(r.Pattern, v) {
+				return true
+			}
+		}
+		return false
+	default:
+		return false
+	}
+}
+
+func engineMatches(roleEngine, queryEngine string) bool {
+	re := strings.ToLower(strings.TrimSpace(roleEngine))
+	qe := strings.ToLower(strings.TrimSpace(queryEngine))
+	if re == "" || re == "*" {
+		return true
+	}
+	return re == qe
+}
+
+func fieldMatchesEngine(field, engine string) bool {
+	if field == "index" {
+		return engine == "elasticsearch"
+	}
+	return engine == "loki"
+}
+
+func regexpMatch(pattern, value string) bool {
+	if pattern == "" || value == "" {
+		return false
+	}
+	matched, err := regexp.MatchString(pattern, value)
+	return err == nil && matched
+}
+
+func extractFieldValues(engine, query, field string) []string {
+	if engine == "loki" {
+		return extractLokiLabelValues(query, field)
+	}
+	if field == "app" {
+		return extractESAppValues(query)
+	}
+	return nil
+}
+
+func extractLokiLabelValues(query, field string) []string {
+	m := lokiSelectorRe.FindStringSubmatch(query)
+	if len(m) < 2 {
+		return nil
+	}
+	inner := m[1]
+	var values []string
+	for _, part := range lokiLabelRe.FindAllStringSubmatch(inner, -1) {
+		if len(part) < 7 || part[1] != field {
+			continue
+		}
+		op := part[2]
+		val := part[4]
+		if val == "" {
+			val = part[5]
+		}
+		if val == "" {
+			val = part[6]
+		}
+		if op == "=" || op == "=~" {
+			values = append(values, val)
+		}
+	}
+	return values
+}
+
+func extractESAppValues(query string) []string {
+	var values []string
+	for _, m := range esAppRe.FindAllStringSubmatch(query, -1) {
+		if len(m) < 2 {
+			continue
+		}
+		v := strings.Trim(m[1], `"'`)
+		if v != "" {
+			values = append(values, v)
+		}
+	}
+	return values
+}
+
+// DescribeRole 策略可读描述 // Logan.Li
+func DescribeRole(r model.LogScopeRole) string {
+	ds := "全部数据源"
+	if r.DatasourceID != nil && *r.DatasourceID > 0 {
+		ds = fmt.Sprintf("数据源#%d", *r.DatasourceID)
+	}
+	return fmt.Sprintf("%s · %s · %s=%s", r.Engine, ds, r.MatchField, r.Pattern)
+}

backend/pkg/remoteexec/executor.go

@@ -6,6 +6,7 @@ package remoteexec
 import (
 	"bytes"
 	"fmt"
+	"io"
 	"log"
 	"net"
 	"os"
@@ -191,6 +192,112 @@ func UploadFile(cfg SSHConfig, localPath, remotePath string) (*UploadResult, err
 	return result, nil
 }
 
+// DownloadFile 从远程主机下载文件到本地（二进制安全，供流水线回拉产物） // Logan.Li
+func DownloadFile(cfg SSHConfig, remotePath, localPath string) error {
+	client, err := connect(cfg)
+	if err != nil {
+		return err
+	}
+	defer client.Close()
+
+	session, err := client.NewSession()
+	if err != nil {
+		return fmt.Errorf("创建SSH会话失败: %v", err)
+	}
+	defer session.Close()
+
+	stdout, err := session.StdoutPipe()
+	if err != nil {
+		return fmt.Errorf("获取stdout失败: %v", err)
+	}
+
+	remoteDir := filepath.Dir(remotePath)
+	mkdirCmd := fmt.Sprintf("mkdir -p %s", remoteDir)
+	_, _ = execWithClient(client, cfg, mkdirCmd, 30*time.Second)
+
+	if err := session.Start(fmt.Sprintf("cat %s", shellQuote(remotePath))); err != nil {
+		return fmt.Errorf("启动远程读取失败: %v", err)
+	}
+
+	if err := os.MkdirAll(filepath.Dir(localPath), 0755); err != nil {
+		return err
+	}
+	f, err := os.Create(localPath)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	if _, err := io.Copy(f, stdout); err != nil {
+		return fmt.Errorf("写入本地文件失败: %v", err)
+	}
+	if err := session.Wait(); err != nil {
+		return fmt.Errorf("远程读取失败: %v", err)
+	}
+	return nil
+}
+
+// StreamRemoteTar 将远程目录打包为 tar.gz 流式写入本地文件 // Logan.Li
+func StreamRemoteTar(cfg SSHConfig, remoteDir, localTarPath string, timeout time.Duration) error {
+	if timeout <= 0 {
+		timeout = 30 * time.Minute
+	}
+	client, err := connect(cfg)
+	if err != nil {
+		return err
+	}
+	defer client.Close()
+
+	session, err := client.NewSession()
+	if err != nil {
+		return fmt.Errorf("创建SSH会话失败: %v", err)
+	}
+	defer session.Close()
+
+	stdout, err := session.StdoutPipe()
+	if err != nil {
+		return fmt.Errorf("获取stdout失败: %v", err)
+	}
+
+	cmd := fmt.Sprintf("tar czf - -C %s .", shellQuote(remoteDir))
+	if err := session.Start(cmd); err != nil {
+		return fmt.Errorf("启动远程打包失败: %v", err)
+	}
+
+	if err := os.MkdirAll(filepath.Dir(localTarPath), 0755); err != nil {
+		return err
+	}
+	f, err := os.Create(localTarPath)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	done := make(chan error, 1)
+	go func() {
+		_, copyErr := io.Copy(f, stdout)
+		done <- copyErr
+	}()
+
+	select {
+	case copyErr := <-done:
+		if copyErr != nil {
+			return fmt.Errorf("写入 tar 失败: %v", copyErr)
+		}
+	case <-time.After(timeout):
+		return fmt.Errorf("下载工作区超时")
+	}
+	if err := session.Wait(); err != nil {
+		return fmt.Errorf("远程打包失败: %v", err)
+	}
+	return nil
+}
+
+// shellQuote 简单 shell 路径转义 // Logan.Li
+func shellQuote(s string) string {
+	return "'" + strings.ReplaceAll(s, "'", "'\\''") + "'"
+}
+
 // BatchUpload 批量上传文件到多台服务器（并发）。
 func BatchUpload(servers []SSHConfig, localPath, remotePath string, maxConcurrency int) []UploadResult {
 	if maxConcurrency <= 0 {

backend/pkg/siteprobe/alert_resolve.go

@@ -0,0 +1,24 @@
+package siteprobe
+
+import (
+	"time"
+
+	"ezops/model"
+
+	"gorm.io/gorm"
+)
+
+// ResolveRecoveredProbeAlerts 拨测恢复后立即关闭探测类活跃告警 // Logan.Li
+func ResolveRecoveredProbeAlerts(db *gorm.DB, taskID uint, lastResult string) {
+	if lastResult != "success" {
+		return
+	}
+	now := time.Now()
+	db.Model(&model.SiteAlert{}).
+		Where("task_id = ? AND status = ? AND trigger_type IN ?",
+			taskID, model.SiteAlertStatusActive,
+			[]string{"probe_fail", "probe_timeout", "http_status_error"}).
+		Updates(map[string]interface{}{
+			"status": model.SiteAlertStatusResolved, "resolved_at": now,
+		})
+}

backend/pkg/siteprobe/defaults.go

@@ -0,0 +1,41 @@
+package siteprobe
+
+import "strings"
+
+// DefaultProbeFrequency 各协议推荐默认拨测间隔（秒）// Logan.Li
+func DefaultProbeFrequency(taskType string) int {
+	switch strings.ToLower(taskType) {
+	case "ssl":
+		return 3600 // 证书日级变化，1 小时足够
+	case "dns":
+		return 300 // 5 分钟
+	case "tcp", "ping":
+		return 120 // 2 分钟
+	default:
+		return 60 // HTTP 1 分钟
+	}
+}
+
+// MinProbeFrequency 各协议最小拨测间隔（秒），防止频率过高压垮平台 // Logan.Li
+func MinProbeFrequency(taskType string) int {
+	switch strings.ToLower(taskType) {
+	case "ssl":
+		return 600 // 最少 10 分钟
+	case "dns":
+		return 60
+	default:
+		return 30
+	}
+}
+
+// NormalizeProbeFrequency 规范化拨测频率 // Logan.Li
+func NormalizeProbeFrequency(taskType string, freq int) int {
+	if freq <= 0 {
+		return DefaultProbeFrequency(taskType)
+	}
+	min := MinProbeFrequency(taskType)
+	if freq < min {
+		return min
+	}
+	return freq
+}

backend/pkg/siteprobe/worker.go

@@ -67,15 +67,22 @@ func (w *Worker) runOnce() {
 	var tasks []model.SiteTask
 	w.db.Where("status = ?", model.SiteTaskStatusRunning).Find(&tasks)
 	now := time.Now()
+	sem := make(chan struct{}, 8) // 最多 8 路并发拨测，避免串行阻塞 // Logan.Li
+	var wg sync.WaitGroup
 	for _, task := range tasks {
-		if task.Frequency <= 0 {
-			task.Frequency = 60
-		}
+		task.Frequency = NormalizeProbeFrequency(string(task.TaskType), task.Frequency)
 		if task.LastCheckAt != nil && now.Sub(*task.LastCheckAt) < time.Duration(task.Frequency)*time.Second {
 			continue
 		}
-		w.probeTask(task)
+		wg.Add(1)
+		go func(t model.SiteTask) {
+			defer wg.Done()
+			sem <- struct{}{}
+			defer func() { <-sem }()
+			w.probeTask(t)
+		}(task)
 	}
+	wg.Wait()
 }
 
 func (w *Worker) probeTask(task model.SiteTask) {
@@ -110,9 +117,11 @@ func (w *Worker) probeTask(task model.SiteTask) {
 		avg = (task.AvgResponse + outcome.ResponseTime) / 2
 	}
 	w.db.Model(&model.SiteTask{}).Where("id = ?", task.ID).Updates(map[string]interface{}{
-		"task_type":    task.TaskType,
-		"last_result":  lastResult,
+		"task_type":     task.TaskType,
+		"last_result":   lastResult,
 		"last_check_at": now,
-		"avg_response": avg,
+		"avg_response":  avg,
 	})
+	// 拨测恢复后即时关闭探测类告警，与统计栏 down_count 同步 // Logan.Li
+	ResolveRecoveredProbeAlerts(w.db, task.ID, lastResult)
 }

backend/pkg/toolinstaller/installer.go

@@ -1,6 +1,7 @@
 package toolinstaller
 
 import (
+	"bytes"
 	"fmt"
 	"io"
 	"log"
@@ -45,15 +46,26 @@ func (ti *ToolInstaller) ensureOnce(name string) *sync.Once {
 	return o
 }
 
-// ForceInstall unconditionally installs a tool (bypasses sync.Once).
-// Used by the manual "安装" button in the tool config UI.
-// The version parameter overrides DefaultVersion if non-empty.
-func (ti *ToolInstaller) ForceInstall(toolName string, version string) error {
+// InstallResult 工具安装结果（含脚本输出，供审计日志）// Logan.Li
+type InstallResult struct {
+	Output      string
+	VerifyOut   string
+	Installed   bool
+	Version     string
+	Err         error
+}
+
+// ForceInstall unconditionally installs a tool（重置 Once，允许重复安装）// Logan.Li
+func (ti *ToolInstaller) ForceInstall(toolName string, version string) InstallResult {
 	var tool model.DeployTool
 	if err := ti.db.Where("name = ?", toolName).First(&tool).Error; err != nil {
-		return fmt.Errorf("tool %s not found in DB: %w", toolName, err)
+		return InstallResult{Err: fmt.Errorf("tool %s not found in DB: %w", toolName, err)}
 	}
 
+	ti.mu.Lock()
+	delete(ti.onces, toolName)
+	ti.mu.Unlock()
+
 	// Override version if specified
 	if version != "" && version != tool.DefaultVersion {
 		ti.db.Model(&tool).Update("default_version", version)
@@ -101,7 +113,8 @@ func (ti *ToolInstaller) EnsureAvailable(toolName string) error {
 		var installErr error
 		once := ti.ensureOnce(toolName)
 		once.Do(func() {
-			installErr = ti.installTool(&tool)
+			res := ti.installTool(&tool)
+			installErr = res.Err
 		})
 		// If install failed, reset the Once so next call can retry
 		if installErr != nil {
@@ -115,70 +128,206 @@ func (ti *ToolInstaller) EnsureAvailable(toolName string) error {
 	}
 }
 
-// checkInstalled runs the tool's check command and returns the version string.
-func (ti *ToolInstaller) checkInstalled(tool model.DeployTool) (string, error) {
-	// First try LookPath
-	if tool.BinaryName != "" {
+// VerifyTool 检测工具是否已安装（文件存在 + 可执行验证，不依赖 PATH）// Logan.Li
+func (ti *ToolInstaller) VerifyTool(tool model.DeployTool) (bool, string) {
+	switch tool.Name {
+	case "jdk":
+		for _, p := range []string{"/usr/local/bin/java", "/usr/local/share/jdk/bin/java"} {
+			if st, err := os.Stat(p); err == nil && !st.IsDir() {
+				cmd := exec.Command(p, "-version")
+				out, _ := cmd.CombinedOutput()
+				ver := strings.TrimSpace(strings.Split(string(out), "\n")[0])
+				if ver != "" {
+					return true, ver
+				}
+				return true, "installed"
+			}
+		}
+	case "maven":
+		for _, p := range []string{"/usr/local/bin/mvn", "/usr/local/share/maven/bin/mvn"} {
+			if st, err := os.Stat(p); err == nil && !st.IsDir() {
+				cmd := exec.Command(p, "--version")
+				out, err := cmd.Output()
+				if err == nil {
+					return true, strings.TrimSpace(strings.Split(string(out), "\n")[0])
+				}
+				return true, "installed"
+			}
+		}
+	case "nvm":
+		nvmSh := "/usr/local/share/nvm/nvm.sh"
+		if st, err := os.Stat(nvmSh); err == nil && !st.IsDir() {
+			cmd := exec.Command("bash", "-c", fmt.Sprintf(`. "%s" && nvm --version`, nvmSh))
+			out, err := cmd.Output()
+			if err == nil {
+				return true, strings.TrimSpace(string(out))
+			}
+			return true, tool.DefaultVersion
+		}
+	case "golang":
+		for _, p := range []string{"/usr/local/bin/go", "/usr/local/go/bin/go"} {
+			if st, err := os.Stat(p); err == nil && !st.IsDir() {
+				cmd := exec.Command(p, "version")
+				out, _ := cmd.CombinedOutput()
+				ver := strings.TrimSpace(string(out))
+				if ver != "" {
+					return true, ver
+				}
+				return true, "installed"
+			}
+		}
+	case "nodejs":
+		for _, p := range []string{"/usr/local/bin/node"} {
+			if st, err := os.Stat(p); err == nil && !st.IsDir() {
+				cmd := exec.Command(p, "--version")
+				out, _ := cmd.CombinedOutput()
+				ver := strings.TrimSpace(string(out))
+				if ver != "" {
+					return true, ver
+				}
+				return true, "installed"
+			}
+		}
+	default:
+		if ver, err := ti.runToolCheck(tool); err == nil {
+			return true, ver
+		}
+	}
+	return false, ""
+}
+
+// SyncToolStatus 根据磁盘实际状态刷新 DB（修复审计成功但页面仍失败/安装中）// Logan.Li
+func (ti *ToolInstaller) SyncToolStatus(toolID uint) model.DeployTool {
+	var tool model.DeployTool
+	if err := ti.db.First(&tool, toolID).Error; err != nil {
+		return tool
+	}
+	ok, ver := ti.VerifyTool(tool)
+	if ok {
+		ti.updateStatus(tool.ID, model.ToolInstalled, ver, "")
+		tool.Status = model.ToolInstalled
+		tool.InstalledVer = ver
+		tool.ErrorMsg = ""
+	} else if tool.Status == model.ToolInstalling {
+		// 保持安装中，由超时逻辑处理
+	} else if tool.Status == model.ToolInstalled {
+		// 已标记安装但文件不存在 — 降为未安装
+		ti.updateStatus(tool.ID, model.ToolNotInstalled, "", "")
+		tool.Status = model.ToolNotInstalled
+	}
+	ti.db.First(&tool, toolID)
+	return tool
+}
+
+// runToolCheck 执行 PATH/检测命令（不回调 VerifyTool，避免递归栈溢出）// Logan.Li
+func (ti *ToolInstaller) runToolCheck(tool model.DeployTool) (string, error) {
+	if tool.BinaryName != "" && tool.BinaryName != "nvm" {
 		if _, err := exec.LookPath(tool.BinaryName); err != nil {
 			return "", fmt.Errorf("binary %s not found", tool.BinaryName)
 		}
 	}
-
-	// Run check command if provided
 	if tool.CheckCommand != "" {
-		cmd := exec.Command("sh", "-c", tool.CheckCommand)
+		shell := "sh"
+		if tool.Name == "nvm" || tool.Name == "nodejs" {
+			shell = "bash"
+		}
+		cmd := exec.Command(shell, "-c", tool.CheckCommand)
 		out, err := cmd.Output()
 		if err != nil {
 			return "", err
 		}
-		return strings.TrimSpace(strings.Split(string(out), "\n")[0]), nil
+		lines := strings.Split(strings.TrimSpace(string(out)), "\n")
+		if len(lines) == 0 {
+			return "", fmt.Errorf("tool %s check empty output", tool.Name)
+		}
+		return strings.TrimSpace(lines[0]), nil
 	}
+	return "", fmt.Errorf("tool %s not available", tool.Name)
+}
 
-	return "unknown", nil
+// checkInstalled runs the tool's check command and returns the version string.
+func (ti *ToolInstaller) checkInstalled(tool model.DeployTool) (string, error) {
+	if ok, ver := ti.VerifyTool(tool); ok {
+		return ver, nil
+	}
+	return ti.runToolCheck(tool)
 }
 
 // installTool performs the actual installation.
-func (ti *ToolInstaller) installTool(tool *model.DeployTool) error {
+func (ti *ToolInstaller) installTool(tool *model.DeployTool) InstallResult {
 	log.Printf("[ToolInstaller] Installing %s (method=%s)...", tool.Name, tool.InstallMethod)
 
 	// Mark as installing
 	ti.updateStatus(tool.ID, model.ToolInstalling, "", "")
 
+	var installOut string
 	var err error
 	if tool.InstallScript != "" {
-		err = ti.runInstallScript(tool)
+		installOut, err = ti.runInstallScript(tool)
 	} else if tool.DownloadURL != "" {
-		err = ti.downloadBinary(tool)
+		installOut, err = ti.downloadBinary(tool)
 	} else {
 		err = fmt.Errorf("no install script or download URL configured for %s", tool.Name)
 	}
 
 	if err != nil {
 		errMsg := err.Error()
+		if installOut != "" {
+			errMsg = installOut + "\n---\n" + errMsg
+		}
 		log.Printf("[ToolInstaller] ERROR installing %s: %s", tool.Name, errMsg)
-		ti.updateStatus(tool.ID, model.ToolFailed, "", errMsg)
-		return fmt.Errorf("failed to install %s: %w", tool.Name, err)
+		ti.updateStatus(tool.ID, model.ToolFailed, "", truncateInstallLog(errMsg, 512))
+		return InstallResult{Output: installOut, Err: fmt.Errorf("failed to install %s: %w", tool.Name, err)}
 	}
 
-	// Verify installation
-	ver, checkErr := ti.checkInstalled(*tool)
-	if checkErr != nil {
-		log.Printf("[ToolInstaller] WARNING: %s installed but check failed: %v", tool.Name, checkErr)
-		ti.updateStatus(tool.ID, model.ToolInstalled, "unknown", "")
-	} else {
+	// 安装后验证（优先文件检测，避免 PATH/source 问题）// Logan.Li
+	verifyOut := ti.captureVerifyOutput(*tool)
+	if ok, ver := ti.VerifyTool(*tool); ok {
 		log.Printf("[ToolInstaller] %s installed successfully: %s", tool.Name, ver)
 		ti.updateStatus(tool.ID, model.ToolInstalled, ver, "")
+		return InstallResult{Output: installOut, VerifyOut: verifyOut, Installed: true, Version: ver}
 	}
+	log.Printf("[ToolInstaller] WARNING: %s script ok but verify failed", tool.Name)
+	failMsg := "安装脚本执行完成但验证未通过，请点击「测试」重新检测"
+	ti.updateStatus(tool.ID, model.ToolFailed, "", failMsg)
+	return InstallResult{
+		Output: installOut, VerifyOut: verifyOut,
+		Err: fmt.Errorf("verify failed after install %s", tool.Name),
+	}
+}
 
-	return nil
+// captureVerifyOutput 执行验证命令并捕获输出（供审计）// Logan.Li
+func (ti *ToolInstaller) captureVerifyOutput(tool model.DeployTool) string {
+	if tool.CheckCommand == "" {
+		return ""
+	}
+	shell := "sh"
+	if tool.Name == "nvm" || tool.Name == "nodejs" {
+		shell = "bash"
+	}
+	cmd := exec.Command(shell, "-c", tool.CheckCommand)
+	out, err := cmd.CombinedOutput()
+	text := strings.TrimSpace(string(out))
+	if err != nil && text == "" {
+		return err.Error()
+	}
+	return text
+}
+
+func truncateInstallLog(s string, n int) string {
+	s = strings.TrimSpace(s)
+	if len(s) > n {
+		return s[:n] + "..."
+	}
+	return s
 }
 
 // runInstallScript executes the tool's install script in a subshell.
-func (ti *ToolInstaller) runInstallScript(tool *model.DeployTool) error {
+func (ti *ToolInstaller) runInstallScript(tool *model.DeployTool) (string, error) {
 	// Write script to temp file
 	tmpFile, err := os.CreateTemp("", fmt.Sprintf("tool-install-%s-*.sh", tool.Name))
 	if err != nil {
-		return fmt.Errorf("cannot create temp script: %w", err)
+		return "", fmt.Errorf("cannot create temp script: %w", err)
 	}
 	defer os.Remove(tmpFile.Name())
 
@@ -189,21 +338,28 @@ func (ti *ToolInstaller) runInstallScript(tool *model.DeployTool) error {
 
 	script := fmt.Sprintf("#!/bin/sh\nset -e\nTOOL_VERSION=%s\n%s\n", version, tool.InstallScript)
 	if _, err := tmpFile.WriteString(script); err != nil {
-		return fmt.Errorf("cannot write temp script: %w", err)
+		return "", fmt.Errorf("cannot write temp script: %w", err)
 	}
 	tmpFile.Close()
 	os.Chmod(tmpFile.Name(), 0755)
 
-	cmd := exec.Command("sh", tmpFile.Name())
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-	return cmd.Run()
+	shell := "sh"
+	if tool.Name == "nvm" || tool.Name == "nodejs" {
+		shell = "bash"
+	}
+	cmd := exec.Command(shell, tmpFile.Name())
+	var buf bytes.Buffer
+	// 同时输出到容器日志便于排障 // Logan.Li
+	cmd.Stdout = io.MultiWriter(os.Stdout, &buf)
+	cmd.Stderr = io.MultiWriter(os.Stderr, &buf)
+	err = cmd.Run()
+	return buf.String(), err
 }
 
 // downloadBinary downloads a binary file to the install path.
 // Uses multi-mirror fallback: tries each mirror URL in order, with HEAD verification
 // to skip dead mirrors before attempting a full download.
-func (ti *ToolInstaller) downloadBinary(tool *model.DeployTool) error {
+func (ti *ToolInstaller) downloadBinary(tool *model.DeployTool) (string, error) {
 	version := tool.DefaultVersion
 	if version == "" {
 		// Try to get latest version
@@ -223,24 +379,28 @@ func (ti *ToolInstaller) downloadBinary(tool *model.DeployTool) error {
 	// Resolve mirror URLs — domestic mirrors prioritized when in China
 	mirrorURLs := GetMirrorsForTool(tool.Name, tool.DownloadURL)
 	if len(mirrorURLs) == 0 {
-		return fmt.Errorf("no download URLs configured for %s", tool.Name)
+		return "", fmt.Errorf("no download URLs configured for %s", tool.Name)
 	}
 
 	// Try each mirror in order
 	var lastErr error
+	var logBuf strings.Builder
 	for i, urlTemplate := range mirrorURLs {
 		url := strings.ReplaceAll(urlTemplate, "{version}", version)
 		log.Printf("[ToolInstaller] Downloading %s from mirror[%d]: %s", tool.Name, i, url)
+		logBuf.WriteString(fmt.Sprintf("[%d] %s\n", i, url))
 
 		err := ti.tryDownload(url, tool)
 		if err == nil {
-			return nil // success
+			logBuf.WriteString(fmt.Sprintf("OK: downloaded from mirror[%d]\n", i))
+			return logBuf.String(), nil
 		}
 		lastErr = err
+		logBuf.WriteString(fmt.Sprintf("FAIL mirror[%d]: %v\n", i, err))
 		log.Printf("[ToolInstaller] Mirror[%d] failed for %s: %v, trying next...", i, tool.Name, err)
 	}
 
-	return fmt.Errorf("all %d mirrors exhausted for %s, last error: %w", len(mirrorURLs), tool.Name, lastErr)
+	return logBuf.String(), fmt.Errorf("all %d mirrors exhausted for %s, last error: %w", len(mirrorURLs), tool.Name, lastErr)
 }
 
 // tryDownload attempts a single download from a URL.
@@ -314,10 +474,12 @@ func (ti *ToolInstaller) updateStatus(toolID uint, status model.ToolStatus, vers
 		"last_check": &now,
 	}
 	if version != "" {
-		updates["installed_version"] = version
+		updates["installed_ver"] = version // 与 GORM 列名一致 // Logan.Li
 	}
 	if errMsg != "" {
 		updates["error_msg"] = errMsg
+	} else if status == model.ToolInstalled {
+		updates["error_msg"] = ""
 	}
 	ti.db.Model(&model.DeployTool{}).Where("id = ?", toolID).Updates(updates)
 }
@@ -393,4 +555,49 @@ func (ti *ToolInstaller) UpgradeTools() {
 			"description":    up.description,
 		})
 	}
+
+	// 补全新增工具（如 golang）并校正排序 // Logan.Li
+	now := time.Now()
+	for _, def := range model.PredefinedTools() {
+		var existing model.DeployTool
+		if err := ti.db.Where("name = ?", def.Name).First(&existing).Error; err != nil {
+			def.CreatedAt = now
+			def.UpdatedAt = now
+			def.Status = model.ToolNotInstalled
+			if err := ti.db.Create(&def).Error; err != nil {
+				log.Printf("[ToolInstaller] Failed to seed missing tool %s: %v", def.Name, err)
+			} else {
+				log.Printf("[ToolInstaller] Added missing tool: %s", def.Name)
+			}
+		}
+	}
+	sortBumps := map[string]int{"jdk": 1, "maven": 2, "golang": 3, "nvm": 4, "nodejs": 5, "git": 6, "docker-cli": 7}
+	for name, order := range sortBumps {
+		ti.db.Model(&model.DeployTool{}).Where("name = ?", name).Update("sort_order", order)
+	}
+
+	// 同步 JDK/Maven/Go/NVM 安装脚本与检测命令修复 // Logan.Li
+	type toolPatch struct {
+		script string
+		check  string
+	}
+	patchSync := map[string]toolPatch{}
+	for _, t := range model.PredefinedTools() {
+		if t.Name == "jdk" || t.Name == "maven" || t.Name == "golang" || t.Name == "nvm" || t.Name == "nodejs" {
+			patchSync[t.Name] = toolPatch{script: t.InstallScript, check: t.CheckCommand}
+		}
+	}
+	for name, p := range patchSync {
+		updates := map[string]interface{}{
+			"install_script": p.script,
+			"check_command":  p.check,
+		}
+		if name == "nodejs" {
+			updates["default_version"] = "lts"
+		}
+		if name == "golang" {
+			updates["default_version"] = "1.24.0"
+		}
+		ti.db.Model(&model.DeployTool{}).Where("name = ?", name).Updates(updates)
+	}
 }

backend/pkg/toolinstaller/mirrors.go

@@ -46,6 +46,12 @@ var toolMirrors = map[string][]ToolMirror{
 		{Name: "Helm官方", URL: "https://get.helm.sh/helm-{version}-linux-amd64.tar.gz", Location: "global"},
 		{Name: "阿里云镜像", URL: "https://mirrors.aliyun.com/kubernetes/helm/{version}/helm-{version}-linux-amd64.tar.gz", Location: "domestic"},
 	},
+	"golang": {
+		{Name: "Go官方", URL: "https://go.dev/dl/go{version}.linux-amd64.tar.gz", Location: "global"},
+		{Name: "Google CN", URL: "https://golang.google.cn/dl/go{version}.linux-amd64.tar.gz", Location: "domestic"},
+		{Name: "阿里云镜像", URL: "https://mirrors.aliyun.com/golang/go{version}.linux-amd64.tar.gz", Location: "domestic"},
+		{Name: "中科大镜像", URL: "https://mirrors.ustc.edu.cn/golang/go{version}.linux-amd64.tar.gz", Location: "domestic"},
+	},
 }
 
 // GetMirrorsForTool 返回工具的镜像源列表（按网络环境排序）。

backend/pkg/toolinstaller/uninstall.go

@@ -0,0 +1,193 @@
+package toolinstaller
+
+import (
+	"bytes"
+	"fmt"
+	"log"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"ezops/model"
+)
+
+// UninstallResult 工具卸载结果（含脚本输出，供审计日志）// Logan.Li
+type UninstallResult struct {
+	Output string
+	Err    error
+}
+
+// Uninstall 卸载指定工具并重置 DB 状态（允许重新安装）// Logan.Li
+func (ti *ToolInstaller) Uninstall(toolName string) UninstallResult {
+	var tool model.DeployTool
+	if err := ti.db.Where("name = ?", toolName).First(&tool).Error; err != nil {
+		return UninstallResult{Err: fmt.Errorf("tool %s not found in DB: %w", toolName, err)}
+	}
+
+	ti.mu.Lock()
+	delete(ti.onces, toolName)
+	ti.mu.Unlock()
+
+	var buf bytes.Buffer
+	if err := ti.uninstallTool(&tool, &buf); err != nil {
+		out := strings.TrimSpace(buf.String())
+		log.Printf("[ToolInstaller] ERROR uninstalling %s: %v", toolName, err)
+		ti.resetUninstallStatus(tool.ID, out+": "+err.Error())
+		return UninstallResult{Output: out, Err: err}
+	}
+
+	ti.resetUninstallStatus(tool.ID, "")
+	out := strings.TrimSpace(buf.String())
+	log.Printf("[ToolInstaller] %s uninstalled successfully", toolName)
+	return UninstallResult{Output: out}
+}
+
+func (ti *ToolInstaller) resetUninstallStatus(toolID uint, errMsg string) {
+	now := time.Now()
+	updates := map[string]interface{}{
+		"status":        model.ToolNotInstalled,
+		"installed_ver": "",
+		"last_check":    &now,
+	}
+	if errMsg != "" {
+		updates["error_msg"] = errMsg
+	} else {
+		updates["error_msg"] = ""
+	}
+	ti.updateStatusMap(toolID, updates)
+}
+
+func (ti *ToolInstaller) updateStatusMap(toolID uint, updates map[string]interface{}) {
+	ti.db.Model(&model.DeployTool{}).Where("id = ?", toolID).Updates(updates)
+}
+
+func (ti *ToolInstaller) uninstallTool(tool *model.DeployTool, buf *bytes.Buffer) error {
+	switch tool.Name {
+	case "jdk":
+		return ti.uninstallJDK(buf)
+	case "maven":
+		return ti.uninstallMaven(buf)
+	case "golang":
+		return ti.uninstallGolang(buf)
+	case "nvm":
+		return ti.uninstallNVM(buf)
+	case "nodejs":
+		return ti.uninstallNodeJS(buf)
+	case "git":
+		return ti.uninstallApkPackage(buf, "git", "git")
+	case "docker-cli":
+		return ti.uninstallApkPackage(buf, "docker-cli", "docker")
+	default:
+		return ti.uninstallBinary(tool, buf)
+	}
+}
+
+func (ti *ToolInstaller) uninstallJDK(buf *bytes.Buffer) error {
+	buf.WriteString("[JDK] Removing symlinks and /usr/local/share/jdk\n")
+	removeIfExists(buf, "/usr/local/bin/java", "/usr/local/bin/javac", "/usr/local/bin/jar")
+	removeDirIfExists(buf, "/usr/local/share/jdk")
+	return nil
+}
+
+func (ti *ToolInstaller) uninstallMaven(buf *bytes.Buffer) error {
+	buf.WriteString("[Maven] Removing symlinks and /usr/local/share/maven\n")
+	removeIfExists(buf, "/usr/local/bin/mvn")
+	removeDirIfExists(buf, "/usr/local/share/maven")
+	return nil
+}
+
+func (ti *ToolInstaller) uninstallGolang(buf *bytes.Buffer) error {
+	buf.WriteString("[Go] Removing GOROOT and symlinks\n")
+	removeIfExists(buf, "/usr/local/bin/go", "/usr/local/bin/gofmt", "/etc/profile.d/golang.sh")
+	removeDirIfExists(buf, "/usr/local/go")
+	return nil
+}
+
+func (ti *ToolInstaller) uninstallNVM(buf *bytes.Buffer) error {
+	buf.WriteString("[NVM] Removing NVM and Node versions\n")
+	removeIfExists(buf, "/usr/local/bin/node", "/usr/local/bin/npm", "/usr/local/bin/npx", "/etc/profile.d/nvm.sh")
+	removeDirIfExists(buf, "/usr/local/share/nvm")
+	return nil
+}
+
+func (ti *ToolInstaller) uninstallNodeJS(buf *bytes.Buffer) error {
+	buf.WriteString("[Node.js] Removing symlinks and NVM node versions\n")
+	removeIfExists(buf, "/usr/local/bin/node", "/usr/local/bin/npm", "/usr/local/bin/npx")
+
+	nvmSh := "/usr/local/share/nvm/nvm.sh"
+	if st, err := os.Stat(nvmSh); err == nil && !st.IsDir() {
+		script := fmt.Sprintf(`export NVM_DIR="/usr/local/share/nvm"
+. "%s"
+CUR=$(nvm current 2>/dev/null || true)
+if [ -n "$CUR" ] && [ "$CUR" != "none" ] && [ "$CUR" != "system" ]; then
+  nvm uninstall "$CUR" 2>/dev/null || true
+fi
+rm -rf "$NVM_DIR/versions/node"
+`, nvmSh)
+		cmd := exec.Command("bash", "-c", script)
+		out, err := cmd.CombinedOutput()
+		if len(out) > 0 {
+			buf.Write(out)
+		}
+		if err != nil {
+			buf.WriteString(fmt.Sprintf("[Node.js] nvm cleanup warning: %v\n", err))
+		}
+	}
+	removeDirIfExists(buf, "/usr/local/share/nvm/versions/node")
+	return nil
+}
+
+func (ti *ToolInstaller) uninstallApkPackage(buf *bytes.Buffer, pkg, binary string) error {
+	buf.WriteString(fmt.Sprintf("[%s] Trying apk del %s\n", binary, pkg))
+	if _, err := exec.LookPath("apk"); err != nil {
+		buf.WriteString(fmt.Sprintf("[%s] apk not found, skip package removal\n", binary))
+		return nil
+	}
+	cmd := exec.Command("apk", "del", "--no-cache", pkg)
+	out, err := cmd.CombinedOutput()
+	if len(out) > 0 {
+		buf.Write(out)
+	}
+	if err != nil {
+		// 可能未通过 apk 安装，仅标记卸载完成 // Logan.Li
+		buf.WriteString(fmt.Sprintf("[%s] apk del skipped: %v\n", binary, err))
+	}
+	return nil
+}
+
+func (ti *ToolInstaller) uninstallBinary(tool *model.DeployTool, buf *bytes.Buffer) error {
+	path := tool.InstallPath
+	if path == "" && tool.BinaryName != "" {
+		path = filepath.Join("/usr/local/bin", tool.BinaryName)
+	}
+	if path == "" {
+		return fmt.Errorf("no install path configured for %s", tool.Name)
+	}
+	buf.WriteString(fmt.Sprintf("[%s] Removing %s\n", tool.Name, path))
+	removeIfExists(buf, path)
+	return nil
+}
+
+func removeIfExists(buf *bytes.Buffer, paths ...string) {
+	for _, p := range paths {
+		if err := os.Remove(p); err != nil {
+			if !os.IsNotExist(err) {
+				buf.WriteString(fmt.Sprintf("remove %s: %v\n", p, err))
+			}
+		} else {
+			buf.WriteString(fmt.Sprintf("removed %s\n", p))
+		}
+	}
+}
+
+func removeDirIfExists(buf *bytes.Buffer, dir string) {
+	if err := os.RemoveAll(dir); err != nil {
+		if !os.IsNotExist(err) {
+			buf.WriteString(fmt.Sprintf("remove dir %s: %v\n", dir, err))
+		}
+	} else {
+		buf.WriteString(fmt.Sprintf("removed dir %s\n", dir))
+	}
+}

backend/router/routes.go

@@ -215,6 +215,17 @@ func Register(r *gin.Engine, db *gorm.DB, log *zap.Logger, cfg *config.Config, c
 		admin.POST("/users/:id/item-roles", itemRoleHandler.AssignItemRole)
 		admin.DELETE("/users/:id/item-roles/:roleId", itemRoleHandler.RemoveItemRole)
 
+		// 日志查询范围权限（正则匹配 ES 索引 / Loki Label）// Logan.Li
+		logScopeRoleHandler := controller.NewLogScopeRoleHandler(db)
+		admin.GET("/log-scope-roles", logScopeRoleHandler.ListLogScopeRoles)
+		admin.POST("/log-scope-roles", logScopeRoleHandler.CreateLogScopeRole)
+		admin.PUT("/log-scope-roles/:id", logScopeRoleHandler.UpdateLogScopeRole)
+		admin.DELETE("/log-scope-roles/:id", logScopeRoleHandler.DeleteLogScopeRole)
+		admin.GET("/log-scope-roles/users/:id", logScopeRoleHandler.ListUserLogScopeRoles)
+		admin.POST("/log-scope-roles/users/:id", logScopeRoleHandler.AssignLogScopeRole)
+		admin.DELETE("/log-scope-roles/users/:userId/:assignId", logScopeRoleHandler.RemoveLogScopeRole)
+		admin.POST("/log-scope-roles/preview", logScopeRoleHandler.PreviewLogScope)
+
 		// 审计策略（保留天数 + 立即清理） // Logan.Li
 		auditSettingsHandler := controller.NewAuditSettingsHandler(db)
 		admin.GET("/audit-settings", auditSettingsHandler.GetAuditSettings)
@@ -653,6 +664,17 @@ func Register(r *gin.Engine, db *gorm.DB, log *zap.Logger, cfg *config.Config, c
 		environments.DELETE("/:id", pipelineHandler.DeleteEnvironment)
 	}
 
+	// 构建节点路由（Jenkins Agent 风格 SSH 节点） // Logan.Li
+	buildNodes := authorized.Group("/deploy/build-nodes")
+	{
+		buildNodes.GET("", pipelineHandler.ListBuildNodes)
+		buildNodes.PUT("/master", pipelineHandler.UpdateBuildMaster)
+		buildNodes.POST("", pipelineHandler.CreateBuildNode)
+		buildNodes.PUT("/:id", pipelineHandler.UpdateBuildNode)
+		buildNodes.DELETE("/:id", pipelineHandler.DeleteBuildNode)
+		buildNodes.POST("/:id/test", pipelineHandler.TestBuildNode)
+	}
+
 	// 应用发布路由
 	releases := authorized.Group("/releases")
 	{
@@ -690,6 +712,7 @@ func Register(r *gin.Engine, db *gorm.DB, log *zap.Logger, cfg *config.Config, c
 		tools.GET("/:id", toolConfigHandler.GetTool)
 		tools.PUT("/:id", toolConfigHandler.UpdateTool)
 		tools.POST("/:id/install", toolConfigHandler.InstallTool)
+		tools.POST("/:id/uninstall", toolConfigHandler.UninstallTool)
 		tools.POST("/:id/check", toolConfigHandler.CheckToolStatus)
 		tools.GET("/:id/versions", toolConfigHandler.GetToolVersions)
 	}
@@ -745,7 +768,7 @@ func Register(r *gin.Engine, db *gorm.DB, log *zap.Logger, cfg *config.Config, c
 
 	// 日志监控路由 // Logan.Li
 	logHandler := controller.NewLogHandler(db)
-	logProxyHandler := controller.NewLogProxyHandler(logDSHandler)
+	logProxyHandler := controller.NewLogProxyHandler(logDSHandler, db)
 	logs := authorized.Group("/logs")
 	{
 		logs.GET("", logHandler.QueryLogs)
@@ -754,11 +777,17 @@ func Register(r *gin.Engine, db *gorm.DB, log *zap.Logger, cfg *config.Config, c
 		logs.DELETE("/sources/:id", logHandler.DeleteSource)
 		logs.POST("/loki/query", logProxyHandler.QueryLoki)
 		logs.POST("/elasticsearch/query", logProxyHandler.QueryES)
+		logs.GET("/loki/labels", logProxyHandler.ListLokiLabels)
+		logs.GET("/loki/labels/:name/values", logProxyHandler.ListLokiLabelValues)
+		logs.POST("/loki/histogram", logProxyHandler.LokiHistogram)
+		logs.POST("/elasticsearch/histogram", logProxyHandler.ESHistogram)
+		logs.GET("/elasticsearch/mapping", logProxyHandler.ESMapping)
 	}
 	logDSGroup := authorized.Group("/log-datasources")
 	{
 		logDSGroup.GET("", logDSHandler.List)
 		logDSGroup.GET("/indices", logDSHandler.ListIndices)
+		logDSGroup.GET("/:id/indices", logDSHandler.ListIndicesByID)
 		logDSGroup.GET("/:id", logDSHandler.Get)
 		logDSGroup.POST("", logDSHandler.Create)
 		logDSGroup.PUT("/:id", logDSHandler.Update)

frontend/src/App.tsx

@@ -50,7 +50,7 @@ const DeployCredentials = lazy(() => import('@/components/deploy/DeployCredentia
 const PipelineEditor = lazy(() => import('@/components/deploy/PipelineEditor').then(m => ({ default: m.default })));
 const PipelineRunDetail = lazy(() => import('@/components/deploy/PipelineRunDetail').then(m => ({ default: m.default })));
 const DeployRBAC = lazy(() => import('@/components/deploy/DeployRBAC').then(m => ({ default: m.default })));
-const UserGroupsManager = lazy(() => import('@/components/deploy/UserGroupsManager').then(m => ({ default: m.default })));
+
 const CronJobManager = lazy(() => import('@/components/task/CronJobManager').then(m => ({ default: m.CronJobManager })));
 const RemoteExecPage = lazy(() => import('@/components/task/RemoteExecPage').then(m => ({ default: m.RemoteExecPage })));
 const AIOpsAssistant = lazy(() => import('@/components/aiops/AIOpsAssistant').then(m => ({ default: m.AIOpsAssistant })));
@@ -172,8 +172,9 @@ function App() {
                 <Route path="pipelines/:code" element={<LazyPage><PipelineEditor /></LazyPage>} />
                 <Route path="pipelines/:code/runs" element={<LazyPage><PipelineRunDetail /></LazyPage>} />
                 <Route path="pipelines/:code/edit" element={<LazyPage><PipelineEditor /></LazyPage>} />
+                <Route path="deploy/build-nodes" element={<Navigate to="/deploy/configureTools?tab=build-nodes" replace />} />
                 <Route path="deploy/configureTools" element={<LazyPage><DeployCredentials /></LazyPage>} />
-                <Route path="deploy/groups" element={<LazyPage><UserGroupsManager /></LazyPage>} />
+                <Route path="deploy/groups" element={<Navigate to="/deploy/rbac?tab=groups" replace />} />
                 <Route path="deploy/rbac" element={<LazyPage><DeployRBAC /></LazyPage>} />
 
                 {/* Monitor */}

frontend/src/api/deploy/build-nodes.ts

@@ -0,0 +1,34 @@
+// 构建节点 API（Jenkins Agent 风格） // Logan.Li
+
+import { http } from '@/utils/request';
+
+export interface BuildNode {
+  id: number;
+  name: string;
+  description?: string;
+  server_id: number;
+  labels?: string;
+  max_executors: number;
+  workspace_path: string;
+  enabled: boolean;
+  running_count?: number;
+  hostname?: string;
+  ip?: string;
+}
+
+export interface MasterNodeInfo {
+  name: string;
+  max_executors: number;
+  running_count: number;
+}
+
+export const buildNodeApi = {
+  list: () => http.get<{ list: BuildNode[]; total: number; master: MasterNodeInfo }>('/deploy/build-nodes'),
+  updateMaster: (data: { max_executors: number }) =>
+    http.put<MasterNodeInfo>('/deploy/build-nodes/master', data),
+  create: (data: Partial<BuildNode>) => http.post<BuildNode>('/deploy/build-nodes', data),
+  update: (id: number, data: Partial<BuildNode> & { enabled?: boolean }) =>
+    http.put<BuildNode>(`/deploy/build-nodes/${id}`, data),
+  delete: (id: number) => http.delete(`/deploy/build-nodes/${id}`),
+  test: (id: number) => http.post<{ success: boolean; message: string }>(`/deploy/build-nodes/${id}/test`, {}),
+};

frontend/src/api/deploy/config.ts

@@ -42,6 +42,7 @@ export const deployApi = {
   updateTool: (id: number | string, data: Record<string, unknown>) => http.put(`/deploy/tools/${id}`, data),
   installTool: (id: number | string, version?: string) =>
     http.post(`/deploy/tools/${id}/install`, version ? { version } : {}),
+  uninstallTool: (id: number | string) => http.post(`/deploy/tools/${id}/uninstall`),
   checkTool: (id: number | string) => http.post(`/deploy/tools/${id}/check`),
   getToolVersions: (id: number | string) => http.get(`/deploy/tools/${id}/versions`),
 };

frontend/src/api/deploy/index.ts

@@ -1,6 +1,7 @@
 // CI/CD API 聚合出口 // Logan.Li
 
 export { pipelineApi } from './pipeline';
+export { buildNodeApi, type BuildNode } from './build-nodes';
 export { releaseApi } from './release';
 export { deployApi } from './config';
 export { credentialApi, serverCredentialApi } from './credential';

frontend/src/api/log/index.ts

@@ -4,5 +4,15 @@ export {
   logCenterApi,
   type LogDataSource,
   type LogQueryEntry,
+  type LogQueryResult,
+  type HistogramBucket,
+  type ESMappingField,
   type TestConnectionResult,
 } from './log-center';
+
+export {
+  logRbacApi,
+  type LogScopeRole,
+  type UserLogScopeRole,
+  type PreviewLogScopeResult,
+} from './log-rbac';

frontend/src/api/log/log-center.ts

@@ -43,9 +43,22 @@ export const logCenterApi = {
   deleteDatasource: (id: number | string) => http.delete(`/log-datasources/${id}`),
   setDefaultDatasource: (id: number | string) => http.post(`/log-datasources/${id}/default`),
   testDatasource: (data: Record<string, unknown>) => http.post<TestConnectionResult>('/log-datasources/test', data),
-  /** 通过代理查询 ES 集群索引列表 // Logan.Li */
+  /** 通过代理查询 ES 集群索引列表（配置弹窗用，传 url）// Logan.Li */
   listIndices: (params: Record<string, string>) =>
     http.get<string[]>('/log-datasources/indices', params),
+  /** 按数据源 ID 拉取索引列表（查询面板用）// Logan.Li */
+  listIndicesByDatasource: (id: number | string) =>
+    http.get<string[]>(`/log-datasources/${id}/indices`),
+  listLokiLabels: (datasourceId: number | string, params?: { start?: string; end?: string }) =>
+    http.get<string[]>('/logs/loki/labels', { datasource_id: String(datasourceId), ...params }),
+  listLokiLabelValues: (
+    datasourceId: number | string,
+    label: string,
+    params?: { start?: string; end?: string; query?: string },
+  ) => http.get<string[]>(`/logs/loki/labels/${encodeURIComponent(label)}/values`, {
+    datasource_id: String(datasourceId),
+    ...params,
+  }),
   queryLoki: (data: {
     datasource_id: number;
     query: string;
@@ -53,7 +66,8 @@ export const logCenterApi = {
     start?: string;
     end?: string;
     direction?: string;
-  }) => http.post<{ entries: LogQueryEntry[]; total: number }>('/logs/loki/query', data),
+    cursor?: string;
+  }) => http.post<LogQueryResult>('/logs/loki/query', data),
   queryElasticsearch: (data: {
     datasource_id: number;
     index?: string;
@@ -62,5 +76,43 @@ export const logCenterApi = {
     size?: number;
     start?: string;
     end?: string;
-  }) => http.post<{ entries: LogQueryEntry[]; total: number }>('/logs/elasticsearch/query', data),
+    search_after?: unknown[];
+  }) => http.post<LogQueryResult>('/logs/elasticsearch/query', data),
+  lokiHistogram: (data: {
+    datasource_id: number;
+    query: string;
+    start?: string;
+    end?: string;
+  }) => http.post<{ buckets: HistogramBucket[] }>('/logs/loki/histogram', data),
+  esHistogram: (data: {
+    datasource_id: number;
+    index?: string;
+    query?: string;
+    start?: string;
+    end?: string;
+  }) => http.post<{ buckets: HistogramBucket[] }>('/logs/elasticsearch/histogram', data),
+  /** ES 索引 mapping 字段列表（Kibana 风格侧栏）// Logan.Li */
+  esMapping: (params: { datasource_id: number | string; index?: string }) =>
+    http.get<ESMappingField[]>('/logs/elasticsearch/mapping', {
+      datasource_id: String(params.datasource_id),
+      ...(params.index ? { index: params.index } : {}),
+    }),
 };
+
+export interface ESMappingField {
+  name: string;
+  type: string;
+}
+
+export interface HistogramBucket {
+  timestamp: string;
+  count: number;
+}
+
+export interface LogQueryResult {
+  entries: LogQueryEntry[];
+  total: number;
+  has_more?: boolean;
+  next_cursor?: string;
+  search_after?: unknown[];
+}

frontend/src/api/log/log-rbac.ts

@@ -0,0 +1,49 @@
+// 日志查询范围权限 API — 正则匹配 ES 索引 / Loki Label // Logan.Li
+
+import { http, type ListResponse } from '@/utils/request';
+
+export interface LogScopeRole {
+  id: number;
+  name: string;
+  code: string;
+  engine: 'loki' | 'elasticsearch' | '*';
+  match_field: 'index' | 'app' | 'namespace' | 'job';
+  pattern: string;
+  datasource_id?: number;
+  role: 'viewer' | 'analyst';
+  description: string;
+  status: number;
+  created_at: string;
+}
+
+export interface UserLogScopeRole {
+  id: number;
+  user_id: number;
+  log_scope_role_id: number;
+  log_scope_role?: LogScopeRole;
+}
+
+export interface PreviewLogScopeResult {
+  allowed: boolean;
+  matched: LogScopeRole[];
+  total: number;
+}
+
+export const logRbacApi = {
+  getRoles: () => http.get<ListResponse<LogScopeRole>>('/admin/log-scope-roles'),
+  createRole: (data: Record<string, unknown>) => http.post('/admin/log-scope-roles', data),
+  updateRole: (id: number | string, data: Record<string, unknown>) => http.put(`/admin/log-scope-roles/${id}`, data),
+  deleteRole: (id: number | string) => http.delete(`/admin/log-scope-roles/${id}`),
+  getUserRoles: (userId: number | string) => http.get<ListResponse<UserLogScopeRole>>(`/admin/log-scope-roles/users/${userId}`),
+  assignRole: (userId: number | string, data: { log_scope_role_id: number }) =>
+    http.post(`/admin/log-scope-roles/users/${userId}`, data),
+  removeRole: (userId: number | string, assignId: number | string) =>
+    http.delete(`/admin/log-scope-roles/users/${userId}/${assignId}`),
+  preview: (data: {
+    engine: 'loki' | 'elasticsearch';
+    datasource_id?: number;
+    index?: string;
+    query?: string;
+    sample_value?: string;
+  }) => http.post<PreviewLogScopeResult>('/admin/log-scope-roles/preview', data),
+};

frontend/src/components/dashboard/Dashboard.tsx

@@ -160,7 +160,7 @@ export function Dashboard() {
         />
       </div>
 
-      {/* 运维概览 → K8s 集群 → Top5 资源使用 */}
+      {/* 运维概览 → K8s 集群 → 发布历史 */}
       <div className="grid grid-cols-1 lg:grid-cols-3 gap-6 animate-fade-in-delay-2">
         <OpsOverviewCard
           automation={automationStats}
@@ -170,13 +170,13 @@ export function Dashboard() {
           firingAlerts={alertStats?.firing}
         />
         <KubernetesClusterCard clusters={clusters} />
-        <TopResourceUsageCard topUsage={stats?.top_resource_usage} />
+        <ReleaseHistoryCard releases={releases} />
       </div>
 
-      {/* 费用概览 & 发布历史 */}
+      {/* 费用概览 & Top5 资源使用 */}
       <div className="grid grid-cols-1 lg:grid-cols-2 gap-6 animate-fade-in-delay-3">
         <CostOverviewCard costStats={costStats} />
-        <ReleaseHistoryCard releases={releases} />
+        <TopResourceUsageCard topUsage={stats?.top_resource_usage} />
       </div>
 
       {/* 告警消息 & 证书到期提醒 — 置底 */}

frontend/src/components/dashboard/DashboardCharts.tsx

@@ -1,7 +1,9 @@
+import { useNavigate } from 'react-router-dom';
 import { useTranslation } from 'react-i18next';
 import i18n from '@/i18n';
 import { Card, CardContent, CardHeader, CardTitle, CardDescription } from '@/components/ui/card';
 import { Badge } from '@/components/ui/badge';
+import { Button } from '@/components/ui/button';
 import {
   AreaChart,
   Area,
@@ -16,7 +18,7 @@ import {
   BarChart,
   Bar,
 } from 'recharts';
-import { Cpu, HardDrive, Activity, MemoryStick, Database } from 'lucide-react';
+import { Cpu, HardDrive, Activity, MemoryStick, Database, ArrowRight } from 'lucide-react';
 import { cn } from '@/lib/utils';
 import type { JsonData } from '@/types/common';
 
@@ -207,6 +209,7 @@ export function CostOverviewCard({ costStats }: { costStats: JsonData }) {
 
 export function TopResourceUsageCard({ topUsage }: { topUsage: JsonData}) {
   const { t } = useTranslation();
+  const navigate = useNavigate();
   const topCpuServers = (topUsage?.cpu ?? []).slice(0, 5);
   const topMemoryServers = (topUsage?.memory ?? []).slice(0, 5);
   const topDiskServers = (topUsage?.disk ?? []).slice(0, 5);
@@ -260,9 +263,20 @@ export function TopResourceUsageCard({ topUsage }: { topUsage: JsonData}) {
   return (
     <Card className="dg-card dg-card-hover">
       <CardHeader className="pb-2">
-        <div>
-          <CardTitle className="text-[var(--dg-text-primary)]">{t('dashboard.topUsage.title')}</CardTitle>
-          <CardDescription className="text-[var(--dg-text-muted)]">{t('dashboard.topUsage.description')}</CardDescription>
+        <div className="flex items-center justify-between">
+          <div>
+            <CardTitle className="text-[var(--dg-text-primary)]">{t('dashboard.topUsage.title')}</CardTitle>
+            <CardDescription className="text-[var(--dg-text-muted)]">{t('dashboard.topUsage.description')}</CardDescription>
+          </div>
+          <Button
+            variant="ghost"
+            size="sm"
+            className="dg-btn-ghost text-xs"
+            onClick={() => navigate('/dashboards')}
+          >
+            {t('dashboard.ops.monitorScreen')}
+            <ArrowRight className="h-3.5 w-3.5 ml-1" />
+          </Button>
         </div>
       </CardHeader>
       <CardContent>

frontend/src/components/dashboard/DashboardRecent.tsx

@@ -391,8 +391,8 @@ export function OpsOverviewCard({
             <CardTitle className="text-[var(--dg-text-primary)]">{t('dashboard.ops.title')}</CardTitle>
             <CardDescription className="text-[var(--dg-text-muted)]">{t('dashboard.ops.description')}</CardDescription>
           </div>
-          <Button variant="ghost" size="sm" className="dg-btn-ghost text-xs" onClick={() => navigate('/dashboards')}>
-            {t('dashboard.ops.monitorScreen')}
+          <Button variant="ghost" size="sm" className="dg-btn-ghost text-xs" onClick={() => navigate('/ai-agent-cli')}>
+            {t('menu.aiAgentCli')}
             <ArrowRight className="h-3.5 w-3.5 ml-1" />
           </Button>
         </div>

frontend/src/components/deploy/BuildNodesManager.tsx

@@ -0,0 +1,350 @@
+import { useState, useEffect, useCallback } from 'react';
+import { Plus, Pencil, Trash2, RefreshCw, Server, Cpu } from 'lucide-react';
+import { Button } from '@/components/ui/button';
+import { Input } from '@/components/ui/input';
+import { Badge } from '@/components/ui/badge';
+import { PageShell } from '@/components/layout/PageShell';
+import { ContentPanel } from '@/components/layout/ContentPanel';
+import { PageEmpty } from '@/components/layout/PageEmpty';
+
+
+import { Label } from '@/components/ui/label';
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select';
+import { Dialog, DialogContent, DialogDescription, DialogHeader, DialogTitle } from '@/components/ui/dialog';
+import { toast } from 'sonner';
+import { useConfirm } from '@/components/ui/confirm-dialog';
+import { buildNodeApi, serverApi, type BuildNode } from '@/api';
+
+interface ServerItem {
+  id: number;
+  hostname: string;
+  ip: string;
+}
+
+// 构建节点管理（Jenkins Agent 风格 SSH 节点） // Logan.Li
+export default function BuildNodesManager({ embedded = false }: { embedded?: boolean }) {
+  const confirm = useConfirm();
+  const [nodes, setNodes] = useState<BuildNode[]>([]);
+  const [master, setMaster] = useState({ name: 'Master', max_executors: 2, running_count: 0 });
+  const [servers, setServers] = useState<ServerItem[]>([]);
+  const [loading, setLoading] = useState(false);
+  const [dialogOpen, setDialogOpen] = useState(false);
+  const [editNode, setEditNode] = useState<BuildNode | null>(null);
+  const [testingId, setTestingId] = useState<number | null>(null);
+  const [masterMax, setMasterMax] = useState('2');
+  const [savingMaster, setSavingMaster] = useState(false);
+
+  const [name, setName] = useState('');
+  const [description, setDescription] = useState('');
+  const [serverId, setServerId] = useState('');
+  const [labels, setLabels] = useState('');
+  const [maxExecutors, setMaxExecutors] = useState('2');
+  const [workspacePath, setWorkspacePath] = useState('/data/aiops-workspace');
+  const [submitting, setSubmitting] = useState(false);
+
+  const load = useCallback(async () => {
+    setLoading(true);
+    try {
+      const [nodeRes, srvRes] = await Promise.all([
+        buildNodeApi.list(),
+        serverApi.getServers({ page_size: 200 }).catch(() => ({ list: [] })),
+      ]);
+      const data = nodeRes as { list?: BuildNode[]; master?: typeof master };
+      setNodes(Array.isArray(data?.list) ? data.list : []);
+      if (data?.master) {
+        setMaster(data.master);
+        setMasterMax(String(data.master.max_executors || 2));
+      }
+      const srvList = (srvRes as { list?: ServerItem[] })?.list || [];
+      setServers(srvList);
+    } catch {
+      toast.error('加载构建节点失败');
+    } finally {
+      setLoading(false);
+    }
+  }, []);
+
+  useEffect(() => { load(); }, [load]);
+
+  const openCreate = () => {
+    setEditNode(null);
+    setName('');
+    setDescription('');
+    setServerId('');
+    setLabels('');
+    setMaxExecutors('2');
+    setWorkspacePath('/data/aiops-workspace');
+    setDialogOpen(true);
+  };
+
+  const openEdit = (node: BuildNode) => {
+    setEditNode(node);
+    setName(node.name);
+    setDescription(node.description || '');
+    setServerId(String(node.server_id));
+    setLabels(node.labels || '');
+    setMaxExecutors(String(node.max_executors || 2));
+    setWorkspacePath(node.workspace_path || '/data/aiops-workspace');
+    setDialogOpen(true);
+  };
+
+  const handleSubmit = async () => {
+    if (!name.trim() || !serverId) {
+      toast.error('请填写名称并选择服务器');
+      return;
+    }
+    setSubmitting(true);
+    try {
+      const payload = {
+        name: name.trim(),
+        description,
+        server_id: Number(serverId),
+        labels,
+        max_executors: Number(maxExecutors) || 2,
+        workspace_path: workspacePath || '/data/aiops-workspace',
+      };
+      if (editNode) {
+        await buildNodeApi.update(editNode.id, payload);
+        toast.success('已更新');
+      } else {
+        await buildNodeApi.create(payload);
+        toast.success('已创建');
+      }
+      setDialogOpen(false);
+      load();
+    } catch {
+      toast.error('操作失败');
+    } finally {
+      setSubmitting(false);
+    }
+  };
+
+  const handleDelete = async (node: BuildNode) => {
+    const ok = await confirm({ title: '删除节点', description: `确定删除构建节点「${node.name}」？` });
+    if (!ok) return;
+    try {
+      await buildNodeApi.delete(node.id);
+      toast.success('已删除');
+      load();
+    } catch {
+      toast.error('删除失败，请确认无流水线绑定');
+    }
+  };
+
+  const handleTest = async (node: BuildNode) => {
+    setTestingId(node.id);
+    try {
+      const res = await buildNodeApi.test(node.id) as { success?: boolean; message?: string };
+      if (res?.success) {
+        toast.success(`连通成功: ${res.message || ''}`);
+      } else {
+        toast.error(res?.message || '连接失败');
+      }
+    } catch {
+      toast.error('测试失败');
+    } finally {
+      setTestingId(null);
+    }
+  };
+
+  const handleToggle = async (node: BuildNode) => {
+    try {
+      await buildNodeApi.update(node.id, { enabled: !node.enabled });
+      load();
+    } catch {
+      toast.error('更新失败');
+    }
+  };
+
+  const handleSaveMaster = async () => {
+    const n = Number(masterMax);
+    if (!n || n < 1) {
+      toast.error('并发数至少为 1');
+      return;
+    }
+    setSavingMaster(true);
+    try {
+      const res = await buildNodeApi.updateMaster({ max_executors: n });
+      const m = res as { max_executors?: number; running_count?: number };
+      setMaster((prev) => ({
+        ...prev,
+        max_executors: m?.max_executors ?? n,
+        running_count: m?.running_count ?? prev.running_count,
+      }));
+      toast.success('Master 并发已更新');
+    } catch {
+      toast.error('更新失败');
+    } finally {
+      setSavingMaster(false);
+    }
+  };
+
+  const panel = (
+    <div className={embedded ? 'space-y-4' : 'mt-4 space-y-4'}>
+        <ContentPanel
+          toolbar={(
+            <div className="flex items-center justify-between w-full">
+              <span className="text-sm font-medium text-[var(--dg-text-primary)]">构建节点</span>
+              <div className="flex gap-2">
+                <Button variant="ghost" size="sm" onClick={load} disabled={loading}>
+                  <RefreshCw className={`h-3.5 w-3.5 mr-1${loading ? ' animate-spin' : ''}`} />刷新
+                </Button>
+                <Button size="sm" onClick={openCreate}>
+                  <Plus className="h-3.5 w-3.5 mr-1" />添加
+                </Button>
+              </div>
+            </div>
+          )}
+        >
+          <div className="mb-3 p-3 rounded-lg border border-[var(--dg-border)] bg-[var(--dg-bg-secondary)]">
+            <div className="flex flex-wrap items-center justify-between gap-3">
+              <div className="flex items-center gap-2">
+                <Cpu className="h-4 w-4 text-[var(--dg-text-muted)]" />
+                <span className="text-sm font-medium text-[var(--dg-text-primary)]">Master（内置）</span>
+                <Badge variant="outline" className="text-[10px]">默认调度</Badge>
+                <span className="text-xs text-[var(--dg-text-muted)]">
+                  占用 {master.running_count}/{master.max_executors}
+                </span>
+              </div>
+              <div className="flex items-center gap-2">
+                <Label className="text-xs text-[var(--dg-text-muted)] shrink-0">最大并发</Label>
+                <Input
+                  type="number"
+                  min={1}
+                  max={32}
+                  value={masterMax}
+                  onChange={(e) => setMasterMax(e.target.value)}
+                  className="h-7 w-16 text-xs dg-input"
+                />
+                <Button size="sm" className="h-7 text-xs" onClick={handleSaveMaster} disabled={savingMaster}>
+                  {savingMaster ? '保存中' : '保存'}
+                </Button>
+              </div>
+            </div>
+            <p className="text-[11px] text-[var(--dg-text-muted)] mt-2">
+              未指定节点时优先在 Master 执行；并发设为 1 时按触发顺序串行排队；满载后自动调度到空闲远程节点
+            </p>
+          </div>
+
+          {nodes.length === 0 ? (
+            <PageEmpty
+              title="暂无远程构建节点"
+              description="关联服务器资产添加 SSH 节点，将重型构建任务调度到高性能机器"
+              action={<Button size="sm" onClick={openCreate}><Plus className="h-3.5 w-3.5 mr-1" />添加节点</Button>}
+            />
+          ) : (
+            <div className="space-y-2">
+              {nodes.map((node) => (
+                <div
+                  key={node.id}
+                  className="flex items-center justify-between gap-3 p-3 rounded-lg border border-[var(--dg-border)] hover:bg-[var(--dg-bg-secondary)]/50"
+                >
+                  <div className="min-w-0 flex-1">
+                    <div className="flex items-center gap-2 flex-wrap">
+                      <span className="font-medium text-sm text-[var(--dg-text-primary)]">{node.name}</span>
+                      <Badge variant={node.enabled ? 'default' : 'secondary'} className="text-[10px]">
+                        {node.enabled ? '启用' : '禁用'}
+                      </Badge>
+                      <span className="text-[10px] text-[var(--dg-text-muted)] font-mono">
+                        {node.hostname || node.ip || `server#${node.server_id}`}
+                      </span>
+                    </div>
+                    <div className="flex items-center gap-3 mt-1 text-[11px] text-[var(--dg-text-muted)]">
+                      <span>执行器 {node.running_count || 0}/{node.max_executors}</span>
+                      {node.labels && <span>标签 {node.labels}</span>}
+                      <span className="truncate">{node.workspace_path}</span>
+                    </div>
+                  </div>
+                  <div className="flex items-center gap-1 shrink-0">
+                    <Button variant="ghost" size="sm" className="h-7 text-xs" disabled={testingId === node.id} onClick={() => handleTest(node)}>
+                      {testingId === node.id ? '测试中' : '测试'}
+                    </Button>
+                    <Button variant="ghost" size="sm" className="h-7 text-xs" onClick={() => handleToggle(node)}>
+                      {node.enabled ? '禁用' : '启用'}
+                    </Button>
+                    <Button variant="ghost" size="icon" className="h-7 w-7" onClick={() => openEdit(node)}>
+                      <Pencil className="h-3.5 w-3.5" />
+                    </Button>
+                    <Button variant="ghost" size="icon" className="h-7 w-7" onClick={() => handleDelete(node)}>
+                      <Trash2 className="h-3.5 w-3.5 text-[var(--dg-red)]" />
+                    </Button>
+                  </div>
+                </div>
+              ))}
+            </div>
+          )}
+        </ContentPanel>
+    </div>
+  );
+
+  const dialog = (
+      <Dialog open={dialogOpen} onOpenChange={setDialogOpen}>
+        <DialogContent className="max-w-md bg-[var(--dg-bg-primary)] border-[var(--dg-border)]">
+          <DialogHeader>
+            <DialogTitle>{editNode ? '编辑节点' : '添加节点'}</DialogTitle>
+            <DialogDescription className="text-[var(--dg-text-muted)]">
+              基于服务器 SSH 凭据注册构建 Agent，流水线可绑定或自动调度
+            </DialogDescription>
+          </DialogHeader>
+          <div className="space-y-3">
+            <div className="space-y-1">
+              <Label className="text-xs">节点名称</Label>
+              <Input value={name} onChange={(e) => setName(e.target.value)} className="h-8 text-xs dg-input" placeholder="build-node-01" />
+            </div>
+            <div className="space-y-1">
+              <Label className="text-xs">关联服务器</Label>
+              <Select value={serverId || '__none'} onValueChange={(v) => setServerId(v === '__none' ? '' : v)}>
+                <SelectTrigger className="h-8 text-xs dg-input"><SelectValue placeholder="选择服务器" /></SelectTrigger>
+                <SelectContent>
+                  <SelectItem value="__none">请选择</SelectItem>
+                  {servers.map((s) => (
+                    <SelectItem key={s.id} value={String(s.id)}>
+                      {s.hostname} ({s.ip})
+                    </SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+            </div>
+            <div className="grid grid-cols-2 gap-2">
+              <div className="space-y-1">
+                <Label className="text-xs">最大并发</Label>
+                <Input value={maxExecutors} onChange={(e) => setMaxExecutors(e.target.value)} type="number" min={1} className="h-8 text-xs dg-input" />
+              </div>
+              <div className="space-y-1">
+                <Label className="text-xs">工作区路径</Label>
+                <Input value={workspacePath} onChange={(e) => setWorkspacePath(e.target.value)} className="h-8 text-xs font-mono dg-input" />
+              </div>
+            </div>
+            <div className="space-y-1">
+              <Label className="text-xs">标签 <span className="text-[var(--dg-text-muted)]">(可选)</span></Label>
+              <Input value={labels} onChange={(e) => setLabels(e.target.value)} className="h-8 text-xs dg-input" placeholder="linux,docker,high-mem" />
+            </div>
+            <div className="space-y-1">
+              <Label className="text-xs">描述</Label>
+              <Input value={description} onChange={(e) => setDescription(e.target.value)} className="h-8 text-xs dg-input" />
+            </div>
+            <div className="flex justify-end gap-2 pt-2">
+              <Button variant="outline" onClick={() => setDialogOpen(false)}>取消</Button>
+              <Button onClick={handleSubmit} disabled={submitting}>{submitting ? '保存中' : '保存'}</Button>
+            </div>
+          </div>
+        </DialogContent>
+      </Dialog>
+  );
+
+  if (embedded) {
+    return (
+      <>
+        {panel}
+        {dialog}
+      </>
+    );
+  }
+
+  return (
+    <PageShell title="构建节点" subtitle="Master 与远程 SSH 构建节点">
+      {panel}
+      {dialog}
+    </PageShell>
+  );
+}

frontend/src/components/deploy/DeployCredentials.tsx

@@ -6,7 +6,9 @@ import { Badge } from '@/components/ui/badge';
 import { PageShell } from '@/components/layout/PageShell';
 import { ContentPanel } from '@/components/layout/ContentPanel';
 import { PageEmpty } from '@/components/layout/PageEmpty';
-import { StatStrip } from '@/components/ui/stat-strip';
+
+import { useSearchParams } from 'react-router-dom';
+import BuildNodesManager from './BuildNodesManager';
 import { Label } from '@/components/ui/label';
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select';
 import { Dialog, DialogContent, DialogHeader, DialogTitle } from '@/components/ui/dialog';
@@ -98,8 +100,12 @@ function EnvFormDialog({ open, onClose, onSaved, editData }: { open: boolean; on
   );
 }
 
+const CONFIG_TABS = ['repos', 'registries', 'environments', 'tools', 'build-nodes'] as const;
+
 export default function DeployCredentials() {
   const _confirm = useConfirm();
+  const [searchParams] = useSearchParams();
+  const tabFromUrl = searchParams.get('tab');
   const [repos, setRepos] = useState<Repo[]>([]);
   const [registries, setRegistries] = useState<Registry[]>([]);
   const [environments, setEnvironments] = useState<Environment[]>([]);
@@ -109,7 +115,9 @@ export default function DeployCredentials() {
   const [editingId, setEditingId] = useState<number | null>(null);
   const [envDialogOpen, setEnvDialogOpen] = useState(false);
   const [editEnv, setEditEnv] = useState<Environment | null>(null);
-  const [activeTab, setActiveTab] = useState('repos');
+  const [activeTab, setActiveTab] = useState(
+    tabFromUrl && (CONFIG_TABS as readonly string[]).includes(tabFromUrl) ? tabFromUrl : 'repos',
+  );
 
   const fetchAll = async () => {
     setLoading(true);
@@ -142,29 +150,21 @@ export default function DeployCredentials() {
     { id: 'repos', label: 'Git 仓库', badge: repos.length || undefined },
     { id: 'registries', label: '镜像仓库', badge: registries.length || undefined },
     { id: 'environments', label: '环境管理', badge: environments.length || undefined },
+    { id: 'build-nodes', label: '构建节点' },
     { id: 'tools', label: '工具配置' },
   ];
 
   return (
     <PageShell
       variant="list"
-      title="发布配置管理"
-      subtitle="Git 仓库、镜像仓库、环境与工具配置"
+      title="发布配置"
+      subtitle="Git 仓库、镜像仓库、环境与工具"
       icon={<Settings2 className="h-5 w-5" />}
       loading={loading}
       tabs={pageTabs}
       activeTab={activeTab}
       onTabChange={setActiveTab}
-      metrics={(
-        <StatStrip
-          items={[
-            { label: 'Git 仓库', value: repos.length, color: 'blue' },
-            { label: '镜像仓库', value: registries.length, color: 'cyan' },
-            { label: '环境', value: environments.length, color: 'purple' },
-          ]}
-        />
-      )}
-      actions={(
+      actions={activeTab === 'build-nodes' ? undefined : (
         <>
           <Button variant="outline" size="sm" className="dg-btn-secondary" onClick={fetchAll}>
             <RefreshCw className="w-4 h-4 mr-1" />刷新
@@ -177,6 +177,7 @@ export default function DeployCredentials() {
           </Button>
         </>
       )}
+      contentClassName="space-y-4"
     >
       {activeTab === 'repos' && (
         repos.length === 0 ? (
@@ -325,6 +326,8 @@ export default function DeployCredentials() {
         </>
       )}
 
+      {activeTab === 'build-nodes' && <BuildNodesManager embedded />}
+
       {activeTab === 'tools' && <ToolConfigTab />}
 
       <CredentialFormDialog

frontend/src/components/deploy/DeployNav.tsx

@@ -0,0 +1,37 @@
+import { NavLink } from 'react-router-dom';
+import { GitBranch, Settings2, Shield, Users, Server } from 'lucide-react';
+import { cn } from '@/lib/utils';
+
+const NAV_ITEMS = [
+  { path: '/pipelines', label: '流水线', icon: GitBranch },
+  { path: '/deploy/build-nodes', label: '构建节点', icon: Server },
+  { path: '/deploy/configureTools', label: '发布配置', icon: Settings2 },
+  { path: '/deploy/rbac', label: 'Job 权限', icon: Shield },
+  { path: '/deploy/groups', label: '用户组', icon: Users },
+];
+
+// 应用发布模块二级导航 // Logan.Li
+export function DeployNav() {
+  return (
+    <nav className="flex items-center gap-1 p-1 rounded-lg bg-[var(--dg-bg-secondary)] border border-[var(--dg-border)] w-fit flex-wrap">
+      {NAV_ITEMS.map((item) => {
+        const Icon = item.icon;
+        return (
+          <NavLink
+            key={item.path}
+            to={item.path}
+            className={({ isActive }) => cn(
+              'flex items-center gap-1.5 px-3 py-1.5 rounded-md text-xs font-medium transition-colors',
+              isActive
+                ? 'bg-[var(--dg-bg-primary)] text-[var(--dg-text-primary)] border border-[var(--dg-border)] shadow-sm'
+                : 'text-[var(--dg-text-muted)] hover:text-[var(--dg-text-primary)]',
+            )}
+          >
+            <Icon className="h-3.5 w-3.5" />
+            {item.label}
+          </NavLink>
+        );
+      })}
+    </nav>
+  );
+}

frontend/src/components/deploy/DeployRBAC.tsx

@@ -1,5 +1,5 @@
 import { useState, useEffect, useMemo } from 'react';
-import { Shield, Plus, Trash2, Save, Loader2, Users, Regex, Check, X, GitBranch, UserPlus} from 'lucide-react';
+import { Shield, Plus, Trash2, Save, Loader2, Users, GitBranch, UserPlus, Check, X } from 'lucide-react';
 import { Card, CardContent } from '@/components/ui/card';
 import { Button } from '@/components/ui/button';
 import { Input } from '@/components/ui/input';
@@ -11,45 +11,62 @@ import { deployApi, userApi, pipelineApi } from '@/api';
 import { useConfirm } from '@/components/ui/confirm-dialog';
 import { PageShell } from '@/components/layout/PageShell';
 import { PageEmpty } from '@/components/layout/PageEmpty';
-import { StatStrip } from '@/components/ui/stat-strip';
+
+import { useSearchParams } from 'react-router-dom';
+import UserGroupsManager from './UserGroupsManager';
+import { JobRoleCreateDialog } from './deploy-rbac/JobRoleCreateDialog';
+import { matchPipelines, pipelineDisplayLabel, type PipelineMatchItem } from './deploy-rbac/matchPipeline';
 import type { JsonData } from '@/types/common';
 
 interface ItemRole {
-  id: number; name: string; code: string; pattern: string; role: string;
-  description: string; status: number; created_at: string;
+  id: number;
+  name: string;
+  code: string;
+  pattern: string;
+  role: string;
+  description: string;
+  status: number;
+  created_at: string;
 }
 
 interface AssignedUser {
-  id: number; user_id: number; item_role_id: number;
-  user?: { id: number; username: string; real_name: string };
+  id: number;
+  user_id: number;
+  item_role_id: number;
   item_role?: ItemRole;
 }
 
+const ROLE_LABEL: Record<string, string> = {
+  owner: '拥有者',
+  editor: '编辑者',
+  viewer: '查看者',
+};
+
+const RBAC_TABS = ['roles', 'users', 'preview', 'groups'] as const;
+
+// 发布 Job 权限 — 正则匹配 code / job_name，Jenkins Role Strategy 风格 // Logan.Li
 export default function DeployRBAC() {
+  const [searchParams] = useSearchParams();
+  const tabFromUrl = searchParams.get('tab');
   const [roles, setRoles] = useState<ItemRole[]>([]);
   const [loading, setLoading] = useState(true);
   const [saving, setSaving] = useState(false);
-
-  // Pipeline list for live preview
-  const [pipelines, setPipelines] = useState<JsonData[]>([]);
+  const [activeTab, setActiveTab] = useState(
+    tabFromUrl && (RBAC_TABS as readonly string[]).includes(tabFromUrl) ? tabFromUrl : 'roles',
+  );
+  const [pipelines, setPipelines] = useState<PipelineMatchItem[]>([]);
   const [previewRoleId, setPreviewRoleId] = useState<number | null>(null);
-
-  // User assignment
   const [users, setUsers] = useState<JsonData[]>([]);
   const [assignments, setAssignments] = useState<AssignedUser[]>([]);
-  const [selectedUserId, setSelectedUserId] = useState<string>('');
-  const [assignRoleId, setAssignRoleId] = useState<string>('');
+  const [selectedUserId, setSelectedUserId] = useState('');
+  const [assignRoleId, setAssignRoleId] = useState('');
   const [assignLoading, setAssignLoading] = useState(false);
-
-  // Create
-  const [showCreate, setShowCreate] = useState(false);
+  const [createOpen, setCreateOpen] = useState(false);
   const [newName, setNewName] = useState('');
   const [newCode, setNewCode] = useState('');
   const [newPattern, setNewPattern] = useState('');
   const [newRole, setNewRole] = useState('editor');
   const [newDesc, setNewDesc] = useState('');
-
-  // Edit
   const [editing, setEditing] = useState<number | null>(null);
   const [editPattern, setEditPattern] = useState('');
   const [editRole, setEditRole] = useState('');
@@ -64,11 +81,10 @@ export default function DeployRBAC() {
         pipelineApi.getPipelines({ page_size: 200 }),
         userApi.getUsers({ page_size: 500 }),
       ]);
-      setRoles(Array.isArray(rolesRes) ? rolesRes : (rolesRes as JsonData)?.list || (rolesRes as JsonData)?.data || []);
-      setPipelines(Array.isArray(pipesRes) ? pipesRes : (pipesRes as JsonData)?.list || (pipesRes as JsonData)?.data || []);
-      const uList = Array.isArray(usersRes) ? usersRes : (usersRes as JsonData)?.list || (usersRes as JsonData)?.data || [];
-      setUsers(uList);
-    } catch { /* */ }
+      setRoles(Array.isArray(rolesRes) ? rolesRes : (rolesRes as JsonData)?.list || []);
+      setPipelines(Array.isArray(pipesRes) ? pipesRes : (pipesRes as JsonData)?.list || []);
+      setUsers(Array.isArray(usersRes) ? usersRes : (usersRes as JsonData)?.list || []);
+    } catch { /* silent */ }
     finally { setLoading(false); }
   };
 
@@ -78,40 +94,40 @@ export default function DeployRBAC() {
     if (!selectedUserId) { setAssignments([]); return; }
     try {
       const res: JsonData = await deployApi.getUserItemRoles(Number(selectedUserId));
-      setAssignments(Array.isArray(res) ? res : res?.data || res?.list || []);
+      setAssignments(Array.isArray(res) ? res : res?.list || []);
     } catch { setAssignments([]); }
   };
 
   useEffect(() => { loadAssignments(); }, [selectedUserId]);
 
-  // Compute matched pipeline codes for each role
   const matchCount = useMemo(() => {
-    const map: Record<number, string[]> = {};
-    roles.forEach(r => {
-      try {
-        const re = new RegExp(r.pattern);
-        map[r.id] = pipelines.filter(p => re.test(p.code)).map(p => p.code);
-      } catch { map[r.id] = []; }
-    });
+    const map: Record<number, PipelineMatchItem[]> = {};
+    roles.forEach((r) => { map[r.id] = matchPipelines(r.pattern, pipelines); });
     return map;
   }, [roles, pipelines]);
 
-  const previewRole = previewRoleId ? roles.find(r => r.id === previewRoleId) : null;
-  const previewMatches = previewRole ? (matchCount[previewRoleId!] || []) : [];
+  const previewMatches = previewRoleId ? (matchCount[previewRoleId] || []) : pipelines;
 
   const handleCreate = async () => {
     if (!newName.trim() || !newCode.trim() || !newPattern.trim()) {
-      toast.error('名称、代码、正则表达式不能为空'); return;
+      toast.error('请填写名称、标识与正则'); return;
     }
     setSaving(true);
     try {
-      await deployApi.createItemRole({ name: newName.trim(), code: newCode.trim(), pattern: newPattern.trim(), role: newRole, description: newDesc });
+      await deployApi.createItemRole({
+        name: newName.trim(),
+        code: newCode.trim(),
+        pattern: newPattern.trim(),
+        role: newRole,
+        description: newDesc,
+      });
       toast.success('已创建');
-      setShowCreate(false);
+      setCreateOpen(false);
       setNewName(''); setNewCode(''); setNewPattern(''); setNewRole('editor'); setNewDesc('');
       loadData();
-    } catch (e) { toast.error(e?.message || '创建失败'); }
-    finally { setSaving(false); }
+    } catch (e: unknown) {
+      toast.error((e as Error)?.message || '创建失败');
+    } finally { setSaving(false); }
   };
 
   const handleUpdate = async (id: number) => {
@@ -122,12 +138,17 @@ export default function DeployRBAC() {
       toast.success('已更新');
       setEditing(null);
       loadData();
-    } catch (e) { toast.error(e?.message || '更新失败'); }
-    finally { setSaving(false); }
+    } catch (e: unknown) {
+      toast.error((e as Error)?.message || '更新失败');
+    } finally { setSaving(false); }
   };
 
   const handleDelete = async (role: ItemRole) => {
-    const ok = await _confirm({ title: '删除角色', description: `确定删除「${role.name}」？匹配 ${matchCount[role.id]?.length || 0} 条流水线`, variant: 'destructive' });
+    const ok = await _confirm({
+      title: '删除权限',
+      description: `确定删除「${role.name}」？将影响 ${matchCount[role.id]?.length || 0} 个发布任务`,
+      variant: 'destructive',
+    });
     if (!ok) return;
     try { await deployApi.deleteItemRole(role.id); toast.success('已删除'); loadData(); }
     catch { toast.error('删除失败'); }
@@ -142,15 +163,19 @@ export default function DeployRBAC() {
   };
 
   const handleAssign = async () => {
-    if (!selectedUserId || !assignRoleId) { toast.error('请选择用户和角色'); return; }
+    if (!selectedUserId || !assignRoleId) { toast.error('请选择用户和权限'); return; }
     setAssignLoading(true);
     try {
-      await deployApi.assignItemRole(Number(selectedUserId), { user_id: Number(selectedUserId), item_role_id: Number(assignRoleId) });
+      await deployApi.assignItemRole(Number(selectedUserId), {
+        user_id: Number(selectedUserId),
+        item_role_id: Number(assignRoleId),
+      });
       toast.success('已分配');
       setAssignRoleId('');
       loadAssignments();
-    } catch (e) { toast.error(e?.message || '分配失败'); }
-    finally { setAssignLoading(false); }
+    } catch (e: unknown) {
+      toast.error((e as Error)?.message || '分配失败');
+    } finally { setAssignLoading(false); }
   };
 
   const handleRevoke = async (id: number) => {
@@ -161,257 +186,211 @@ export default function DeployRBAC() {
     } catch { toast.error('撤销失败'); }
   };
 
-  const roleBadgeClass = (role: string) =>
-    role === 'owner' ? 'bg-amber-500/20 dg-text-yellow border-amber-500/30' :
-    role === 'editor' ? 'bg-blue-500/20 dg-text-blue border-blue-500/30' :
-    'bg-[var(--dg-bg-active)]/20 dg-text-secondary border-[var(--dg-border)]';
-
-  const selectedUser = users.find(u => String(u.id) === selectedUserId);
-
-  const activeRoles = roles.filter(r => r.status === 1).length;
+  const selectedUser = users.find((u) => String(u.id) === selectedUserId);
+  const pageTabs = [
+    { id: 'roles', label: '权限策略', badge: roles.length || undefined },
+    { id: 'users', label: '用户授权' },
+    { id: 'groups', label: '用户组' },
+    { id: 'preview', label: '命中预览' },
+  ];
 
   return (
     <PageShell
       variant="list"
-      title="发布权限"
-      subtitle="Jenkins-style Role Strategy — 按流水线 code 正则匹配分配角色"
+      title="Job 权限"
+      subtitle="按流水线 code / Job 名称正则分配发布权限"
       icon={<Shield className="h-5 w-5" />}
       loading={loading}
-      metrics={(
-        <StatStrip
-          items={[
-            { label: 'Item Role', value: roles.length, color: 'purple' },
-            { label: '已启用', value: activeRoles, color: 'emerald' },
-            { label: '流水线', value: pipelines.length, color: 'blue' },
-          ]}
-        />
-      )}
-      actions={(
-        <Button className="dg-btn-primary" onClick={() => setShowCreate(true)} disabled={showCreate}>
-          <Plus className="w-4 h-4 mr-1" />新建角色
+      tabs={pageTabs}
+      activeTab={activeTab}
+      onTabChange={setActiveTab}
+      actions={activeTab === 'groups' ? undefined : (
+        <Button className="dg-btn-primary" onClick={() => setCreateOpen(true)}>
+          <Plus className="w-4 h-4 mr-1" />新建权限
         </Button>
       )}
+      contentClassName="space-y-4"
     >
-      {/* ====== Pipeline Preview ====== */}
-      <Card className="bg-[var(--dg-bg-secondary)] border-[var(--dg-border)]">
-        <CardContent className="p-4">
-          <div className="flex items-center gap-2 mb-3">
-            <GitBranch className="w-4 h-4 dg-text-blue" />
-            <span className="text-sm font-medium text-[var(--dg-text-primary)]">流水线命中预览</span>
-            <span className="text-xs text-[var(--dg-text-muted)]">— 选择一个角色查看哪些流水线会被匹配</span>
-          </div>
-          <div className="flex gap-2 mb-3 flex-wrap">
-            <Button variant={previewRoleId === null ? 'secondary' : 'ghost'} size="sm" onClick={() => setPreviewRoleId(null)}>全部 ({pipelines.length})</Button>
-            {roles.map(r => (
-              <Button key={r.id} variant={previewRoleId === r.id ? 'secondary' : 'ghost'} size="sm" onClick={() => setPreviewRoleId(r.id)}
-                className={r.status === 0 ? 'opacity-40' : ''}>
-                {r.name} ({matchCount[r.id]?.length || 0})
-              </Button>
+      {activeTab === 'roles' && (
+        roles.length === 0 ? (
+          <PageEmpty
+            icon={<Shield className="h-10 w-10" />}
+            title="暂无 Job 权限策略"
+            description="创建策略后，用户将按正则自动获得匹配流水线的访问权限"
+            action={<Button onClick={() => setCreateOpen(true)}><Plus className="h-4 w-4 mr-1" />新建权限</Button>}
+          />
+        ) : (
+          <div className="space-y-2">
+            {roles.map((role) => (
+              <Card key={role.id} className={`dg-card ${role.status === 0 ? 'opacity-50' : ''}`}>
+                <CardContent className="p-3">
+                  <div className="flex items-center justify-between gap-3">
+                    <div className="min-w-0 flex-1">
+                      <div className="flex items-center gap-2 flex-wrap">
+                        <span className="text-sm font-medium text-[var(--dg-text-primary)]">{role.name}</span>
+                        <Badge variant="outline" className="text-[10px] border-[var(--dg-border)]">
+                          {ROLE_LABEL[role.role] || role.role}
+                        </Badge>
+                        {role.status === 0 && <Badge variant="outline" className="text-[10px]">已禁用</Badge>}
+                        <Badge
+                          variant="outline"
+                          className="text-[10px] cursor-pointer border-[var(--dg-border)]"
+                          onClick={() => { setActiveTab('preview'); setPreviewRoleId(role.id); }}
+                        >
+                          {matchCount[role.id]?.length || 0} 个 Job
+                        </Badge>
+                      </div>
+                      <p className="text-xs text-[var(--dg-text-muted)] mt-1 font-mono truncate">
+                        {role.pattern}
+                        {role.description ? ` · ${role.description}` : ''}
+                      </p>
+                    </div>
+                    <div className="flex items-center gap-1 shrink-0">
+                      {editing === role.id ? (
+                        <>
+                          <Input value={editPattern} onChange={(e) => setEditPattern(e.target.value)} className="h-7 w-32 text-xs font-mono dg-input" />
+                          <Select value={editRole} onValueChange={setEditRole}>
+                            <SelectTrigger className="h-7 w-20 text-xs"><SelectValue /></SelectTrigger>
+                            <SelectContent>
+                              <SelectItem value="owner">拥有者</SelectItem>
+                              <SelectItem value="editor">编辑者</SelectItem>
+                              <SelectItem value="viewer">查看者</SelectItem>
+                            </SelectContent>
+                          </Select>
+                          <Button size="icon" variant="ghost" className="h-7 w-7" onClick={() => handleUpdate(role.id)}><Check className="w-3.5 h-3.5" /></Button>
+                          <Button size="icon" variant="ghost" className="h-7 w-7" onClick={() => setEditing(null)}><X className="w-3.5 h-3.5" /></Button>
+                        </>
+                      ) : (
+                        <>
+                          <Button variant="ghost" size="sm" className="h-7 text-xs" onClick={() => { setEditing(role.id); setEditPattern(role.pattern); setEditRole(role.role); }}>编辑</Button>
+                          <Button variant="ghost" size="sm" className="h-7 text-xs" onClick={() => handleToggleStatus(role)}>{role.status ? '禁用' : '启用'}</Button>
+                          <Button variant="ghost" size="icon" className="h-7 w-7 text-[var(--dg-red)]" onClick={() => handleDelete(role)}><Trash2 className="w-3.5 h-3.5" /></Button>
+                        </>
+                      )}
+                    </div>
+                  </div>
+                </CardContent>
+              </Card>
             ))}
           </div>
-          <div className="flex flex-wrap gap-1.5 max-h-32 overflow-y-auto">
-            {previewRoleId === null
-              ? pipelines.map(p => <Badge key={p.id} variant="secondary" className="text-xs"><GitBranch className="w-3 h-3 mr-0.5" />{p.code}</Badge>)
-              : pipelines.map(p => {
-                  const matched = previewMatches.includes(p.code);
-                  return (
-                    <Badge key={p.id} variant={matched ? 'default' : 'secondary'}
-                      className={`text-xs ${matched ? 'bg-purple-500/20 text-purple-300 border-purple-500/30' : 'opacity-30'}`}>
-                      <GitBranch className="w-3 h-3 mr-0.5" />{p.code}
-                    </Badge>
-                  );
-                })
-            }
-            {previewRoleId !== null && previewMatches.length === 0 && (
-              <span className="text-xs dg-text-red">无匹配 — 请调整正则表达式</span>
-            )}
-          </div>
-        </CardContent>
-      </Card>
+        )
+      )}
 
-      {/* Create form */}
-      {showCreate && (
-        <Card className="bg-[var(--dg-bg-secondary)] border-purple-500/20">
-          <CardContent className="p-4 space-y-3">
-            <div className="flex items-center justify-between">
-              <span className="text-sm font-medium text-[var(--dg-text-primary)] flex items-center gap-2"><Plus className="w-4 h-4" />新建 Item Role</span>
-              <Button variant="ghost" size="sm" onClick={() => setShowCreate(false)}>取消</Button>
-            </div>
-            <div className="grid grid-cols-2 gap-3">
-              <div className="space-y-1"><Label className="text-xs">名称</Label><Input value={newName} onChange={e => setNewName(e.target.value)} placeholder="如: backend" className="h-8 text-sm" /></div>
-              <div className="space-y-1"><Label className="text-xs">代码 (唯一标识)</Label><Input value={newCode} onChange={e => setNewCode(e.target.value)} placeholder="如: backend" className="h-8 text-sm font-mono" /></div>
-            </div>
-            <div className="grid grid-cols-2 gap-3">
-              <div className="space-y-1">
-                <Label className="text-xs flex items-center gap-1"><Regex className="w-3 h-3" />正则匹配 Pattern</Label>
-                <Input value={newPattern} onChange={e => { setNewPattern(e.target.value); }} placeholder='如: ^cex-.*' className="h-8 text-sm font-mono" />
-                {newPattern && (
-                  <p className="text-xs text-[var(--dg-text-muted)]">
-                    实时匹配: {(() => { try { const n = pipelines.filter(p => new RegExp(newPattern).test(p.code)).length; return n > 0 ? `✅ 命中 ${n} 条流水线` : '⚠️ 无匹配'; } catch { return '❌ 正则语法错误'; } })()}
-                  </p>
-                )}
-              </div>
-              <div className="space-y-1">
-                <Label className="text-xs">角色</Label>
-                <Select value={newRole} onValueChange={setNewRole}>
-                  <SelectTrigger className="h-8 text-sm"><SelectValue /></SelectTrigger>
-                  <SelectContent>
-                    <SelectItem value="owner">拥有者 (owner)</SelectItem>
-                    <SelectItem value="editor">编辑者 (editor)</SelectItem>
-                    <SelectItem value="viewer">查看者 (viewer)</SelectItem>
+      {activeTab === 'users' && (
+        <Card className="dg-card">
+          <CardContent className="p-4 space-y-4">
+            <div className="flex flex-wrap gap-3 items-end">
+              <div className="space-y-1 flex-1 min-w-[200px]">
+                <Label className="text-xs">用户</Label>
+                <Select value={selectedUserId} onValueChange={setSelectedUserId}>
+                  <SelectTrigger className="h-8 text-sm dg-input"><SelectValue placeholder="选择用户" /></SelectTrigger>
+                  <SelectContent className="max-h-60">
+                    {users.map((u) => (
+                      <SelectItem key={u.id as number} value={String(u.id)}>
+                        {(u.real_name as string) || (u.username as string)} ({u.username as string})
+                      </SelectItem>
+                    ))}
                   </SelectContent>
                 </Select>
               </div>
-            </div>
-            <div className="space-y-1"><Label className="text-xs">描述 (可选)</Label><Input value={newDesc} onChange={e => setNewDesc(e.target.value)} placeholder="简要说明此角色的用途" className="h-8 text-sm" /></div>
-            <Button onClick={handleCreate} disabled={saving} className="w-full">
-              {saving ? <Loader2 className="w-4 h-4 mr-1 animate-spin" /> : <Save className="w-4 h-4 mr-1" />}
-              {saving ? '创建中...' : '创建'}
-            </Button>
-          </CardContent>
-        </Card>
-      )}
-
-      {/* Role list */}
-      {roles.length === 0 ? (
-        <PageEmpty icon={<Shield className="h-10 w-10" />} title="暂无 Item Role" description="创建角色后按正则匹配流水线并分配给用户" />
-      ) : (
-        <div className="space-y-2">
-          {roles.map(role => (
-            <Card key={role.id} className={`bg-[var(--dg-bg-secondary)] border-[var(--dg-border)] ${role.status === 0 ? 'opacity-50' : ''}`}>
-              <CardContent className="p-3">
-                <div className="flex items-center justify-between">
-                  <div className="flex items-center gap-3 flex-1 min-w-0">
-                    <div className="w-9 h-9 rounded-lg bg-purple-500/20 flex items-center justify-center shrink-0">
-                      <Regex className="w-4 h-4 dg-text-purple" />
-                    </div>
-                    <div className="min-w-0">
-                      <div className="flex items-center gap-1.5 flex-wrap">
-                        <span className="text-sm font-semibold text-[var(--dg-text-primary)]">{role.name}</span>
-                        <Badge className={`text-xs border ${roleBadgeClass(role.role)}`}>{role.role === 'owner' ? '拥有者' : role.role === 'editor' ? '编辑者' : '查看者'}</Badge>
-                        {role.status === 0 && <Badge variant="secondary" className="text-xs dg-text-red">已禁用</Badge>}
-                        <Badge variant="secondary" className="text-xs cursor-pointer" onClick={() => setPreviewRoleId(previewRoleId === role.id ? null : role.id)}>
-                          <GitBranch className="w-3 h-3 mr-0.5" />{matchCount[role.id]?.length || 0} 条
-                        </Badge>
-                      </div>
-                      <div className="text-xs text-[var(--dg-text-secondary)] mt-0.5 truncate">
-                        <code className="font-mono dg-text-purple bg-purple-500/10 px-1 rounded">{role.code}</code>
-                        <span className="mx-1">→</span>
-                        <code className="font-mono dg-text-blue bg-blue-500/10 px-1 rounded">{role.pattern}</code>
-                        {role.description && <span className="ml-2 opacity-60">{role.description}</span>}
-                      </div>
-                    </div>
-                  </div>
-                  <div className="flex items-center gap-1 shrink-0">
-                    {editing === role.id ? (
-                      <>
-                        <Input value={editPattern} onChange={e => setEditPattern(e.target.value)} className="h-7 w-36 text-xs font-mono" placeholder="正则表达式" />
-                        <Select value={editRole} onValueChange={setEditRole}>
-                          <SelectTrigger className="h-7 w-20 text-xs"><SelectValue /></SelectTrigger>
-                          <SelectContent>
-                            <SelectItem value="owner">拥有者</SelectItem>
-                            <SelectItem value="editor">编辑者</SelectItem>
-                            <SelectItem value="viewer">查看者</SelectItem>
-                          </SelectContent>
-                        </Select>
-                        <Button size="icon" variant="ghost" className="h-7 w-7 dg-text-green" onClick={() => handleUpdate(role.id)}><Check className="w-3.5 h-3.5" /></Button>
-                        <Button size="icon" variant="ghost" className="h-7 w-7 dg-text-red" onClick={() => setEditing(null)}><X className="w-3.5 h-3.5" /></Button>
-                      </>
-                    ) : (
-                      <>
-                        <Button variant="ghost" size="sm" className="h-7 text-xs" onClick={() => { setEditing(role.id); setEditPattern(role.pattern); setEditRole(role.role); }}><Save className="w-3 h-3 mr-1" />编辑</Button>
-                        <Button variant="ghost" size="sm" className="h-7 text-xs" onClick={() => handleToggleStatus(role)}>{role.status ? '禁用' : '启用'}</Button>
-                        <Button variant="ghost" size="icon" className="h-7 w-7 text-red-500" onClick={() => handleDelete(role)}><Trash2 className="w-3.5 h-3.5" /></Button>
-                      </>
-                    )}
-                  </div>
-                </div>
-              </CardContent>
-            </Card>
-          ))}
-        </div>
-      )}
-
-      {/* ====== User Assignment ====== */}
-      <Card className="bg-[var(--dg-bg-secondary)] border-[var(--dg-border)]">
-        <CardContent className="p-4">
-          <div className="flex items-center gap-2 mb-3">
-            <UserPlus className="w-4 h-4 dg-text-yellow" />
-            <span className="text-sm font-medium text-[var(--dg-text-primary)]">分配角色给用户</span>
-          </div>
-          <div className="flex gap-3 items-end mb-4">
-            <div className="space-y-1 flex-1">
-              <Label className="text-xs">选择用户</Label>
-              <Select value={selectedUserId} onValueChange={setSelectedUserId}>
-                <SelectTrigger className="h-8 text-sm"><SelectValue placeholder="选择用户..." /></SelectTrigger>
-                <SelectContent className="max-h-60">
-                  <div className="px-2 py-1.5 sticky top-0 bg-popover z-10"><Input placeholder="搜索用户..." className="h-7 text-xs" /></div>
-                  {users.map(u => (
-                    <SelectItem key={u.id} value={String(u.id)}>
-                      {u.real_name || u.username} ({u.username})
-                      {assignments.some(a => a.user_id === u.id) && <span className="ml-2 text-xs dg-text-purple">已分配</span>}
-                    </SelectItem>
-                  ))}
-                </SelectContent>
-              </Select>
-            </div>
-            <div className="space-y-1 w-48">
-              <Label className="text-xs">Item Role</Label>
-              <Select value={assignRoleId} onValueChange={setAssignRoleId}>
-                <SelectTrigger className="h-8 text-sm"><SelectValue placeholder="选择角色" /></SelectTrigger>
-                <SelectContent>
-                  {roles.filter(r => r.status === 1).map(r => (
-                    <SelectItem key={r.id} value={String(r.id)}>{r.name} ({r.role})</SelectItem>
-                  ))}
-                </SelectContent>
-              </Select>
-            </div>
-            <Button className="h-8" onClick={handleAssign} disabled={assignLoading || !selectedUserId || !assignRoleId}>
-              {assignLoading ? <Loader2 className="w-3.5 h-3.5 mr-1 animate-spin" /> : <UserPlus className="w-3.5 h-3.5 mr-1" />}
-              分配
-            </Button>
-          </div>
-
-          {/* Assigned roles for selected user */}
-          {selectedUser && (
-            <div>
-              <div className="flex items-center gap-2 mb-2">
-                <Badge variant="secondary" className="text-xs">
-                  <Users className="w-3 h-3 mr-1" />{selectedUser.real_name || selectedUser.username}
-                </Badge>
-                <span className="text-xs text-[var(--dg-text-muted)]">已分配角色:</span>
+              <div className="space-y-1 w-48">
+                <Label className="text-xs">权限策略</Label>
+                <Select value={assignRoleId} onValueChange={setAssignRoleId}>
+                  <SelectTrigger className="h-8 text-sm dg-input"><SelectValue placeholder="选择策略" /></SelectTrigger>
+                  <SelectContent>
+                    {roles.filter((r) => r.status === 1).map((r) => (
+                      <SelectItem key={r.id} value={String(r.id)}>{r.name} ({ROLE_LABEL[r.role]})</SelectItem>
+                    ))}
+                  </SelectContent>
+                </Select>
               </div>
-              {assignments.length === 0 ? (
-                <p className="text-xs text-[var(--dg-text-muted)] py-2">该用户尚未分配任何 Item Role</p>
+              <Button className="h-8" onClick={handleAssign} disabled={assignLoading || !selectedUserId || !assignRoleId}>
+                {assignLoading ? <Loader2 className="w-3.5 h-3.5 mr-1 animate-spin" /> : <UserPlus className="w-3.5 h-3.5 mr-1" />}
+                分配
+              </Button>
+            </div>
+            {selectedUser ? (
+              assignments.length === 0 ? (
+                <p className="text-xs text-[var(--dg-text-muted)]">该用户尚未分配 Job 权限</p>
               ) : (
-                <div className="space-y-1">
-                  {assignments.map(a => {
-                    const roleInfo = a.item_role || roles.find(r => r.id === a.item_role_id);
+                <div className="space-y-1.5">
+                  {assignments.map((a) => {
+                    const roleInfo = a.item_role || roles.find((r) => r.id === a.item_role_id);
                     return (
-                      <div key={a.id} className="flex items-center justify-between py-1.5 px-2 rounded bg-[var(--dg-bg-tertiary)] text-xs">
-                        <div className="flex items-center gap-2">
-                          <Badge className={`text-xs border ${roleBadgeClass(roleInfo?.role || 'viewer')}`}>
-                            {roleInfo?.role === 'owner' ? '拥有者' : roleInfo?.role === 'editor' ? '编辑者' : '查看者'}
-                          </Badge>
-                          <span className="text-[var(--dg-text-primary)]">{roleInfo?.name || `#${a.item_role_id}`}</span>
-                          {roleInfo && (
-                            <code className="font-mono text-[var(--dg-text-muted)] bg-[var(--dg-bg-primary)] px-1 rounded text-xs">
-                              {roleInfo.pattern}
-                            </code>
-                          )}
+                      <div key={a.id} className="flex items-center justify-between py-2 px-2.5 rounded-md bg-[var(--dg-bg-tertiary)] text-xs">
+                        <div className="flex items-center gap-2 min-w-0">
+                          <Badge variant="outline" className="text-[10px] shrink-0">{ROLE_LABEL[roleInfo?.role || ''] || roleInfo?.role}</Badge>
+                          <span className="text-[var(--dg-text-primary)]">{roleInfo?.name}</span>
+                          <code className="text-[var(--dg-text-muted)] truncate">{roleInfo?.pattern}</code>
                         </div>
-                        <Button variant="ghost" size="icon" className="h-6 w-6 dg-text-red" onClick={() => handleRevoke(a.id)}>
+                        <Button variant="ghost" size="icon" className="h-6 w-6 shrink-0" onClick={() => handleRevoke(a.id)}>
                           <X className="w-3 h-3" />
                         </Button>
                       </div>
                     );
                   })}
                 </div>
+              )
+            ) : (
+              <p className="text-xs text-[var(--dg-text-muted)] flex items-center gap-1"><Users className="w-3.5 h-3.5" />选择用户后查看已分配权限</p>
+            )}
+          </CardContent>
+        </Card>
+      )}
+
+      {activeTab === 'groups' && <UserGroupsManager embedded />}
+
+      {activeTab === 'preview' && (
+        <Card className="dg-card">
+          <CardContent className="p-4 space-y-3">
+            <div className="flex flex-wrap gap-1.5">
+              <Button variant={previewRoleId === null ? 'secondary' : 'ghost'} size="sm" onClick={() => setPreviewRoleId(null)}>
+                全部 ({pipelines.length})
+              </Button>
+              {roles.map((r) => (
+                <Button
+                  key={r.id}
+                  variant={previewRoleId === r.id ? 'secondary' : 'ghost'}
+                  size="sm"
+                  className={r.status === 0 ? 'opacity-40' : ''}
+                  onClick={() => setPreviewRoleId(r.id)}
+                >
+                  {r.name} ({matchCount[r.id]?.length || 0})
+                </Button>
+              ))}
+            </div>
+            <div className="flex flex-wrap gap-1.5 max-h-48 overflow-y-auto">
+              {previewMatches.map((p) => (
+                <Badge key={p.id as number} variant="outline" className="text-xs font-mono border-[var(--dg-border)]">
+                  <GitBranch className="w-3 h-3 mr-0.5" />
+                  {pipelineDisplayLabel(p)}
+                </Badge>
+              ))}
+              {previewRoleId !== null && previewMatches.length === 0 && (
+                <span className="text-xs text-[var(--dg-text-muted)]">无匹配 — 请调整正则</span>
               )}
             </div>
-          )}
-        </CardContent>
-      </Card>
+          </CardContent>
+        </Card>
+      )}
+
+      <JobRoleCreateDialog
+        open={createOpen}
+        onOpenChange={setCreateOpen}
+        pipelines={pipelines}
+        saving={saving}
+        name={newName}
+        code={newCode}
+        pattern={newPattern}
+        role={newRole}
+        description={newDesc}
+        onNameChange={setNewName}
+        onCodeChange={setNewCode}
+        onPatternChange={setNewPattern}
+        onRoleChange={setNewRole}
+        onDescriptionChange={setNewDesc}
+        onSubmit={handleCreate}
+      />
     </PageShell>
   );
 }

frontend/src/components/deploy/PipelineEditor.tsx

@@ -42,7 +42,7 @@ import { Switch } from '@/components/ui/switch';
 import { Label } from '@/components/ui/label';
 import { Dialog, DialogContent, DialogHeader, DialogTitle } from '@/components/ui/dialog';
 import { toast } from 'sonner';
-import { pipelineApi, deployApi } from '@/api';
+import { pipelineApi, deployApi, buildNodeApi, type BuildNode } from '@/api';
 import { useConfirm } from '@/components/ui/confirm-dialog';
 import { PageShell } from '@/components/layout/PageShell';
 import { PageEmpty } from '@/components/layout/PageEmpty';
@@ -182,6 +182,8 @@ export default function PipelineEditor() {
   const [webhookToken, setWebhookToken] = useState('');
   const [variables, setVariables] = useState<[string, string][]>([]);
   const [environmentId, setEnvironmentId] = useState<number | string>('');
+  const [buildNodes, setBuildNodes] = useState<BuildNode[]>([]);
+  const [buildNodeId, setBuildNodeId] = useState('');
 
   // member add dialog
   const [newMemberUser, setNewMemberUser] = useState('');
@@ -230,6 +232,7 @@ export default function PipelineEditor() {
         setCronExpr(p.cron_expr || '');
         setWebhookToken(p.webhook_token || '');
         setEnvironmentId(p.environment_id || '');
+        setBuildNodeId(p.build_node_id ? String(p.build_node_id) : '');
         try {
           const parsed = p.variables ? JSON.parse(p.variables) : {};
           setVariables(Object.entries(parsed).map(([k, v]) => [k, String(v)]));
@@ -249,6 +252,10 @@ export default function PipelineEditor() {
     loadEnvironments();
     loadMembers();
     loadRuns();
+    buildNodeApi.list().then((res) => {
+      const data = res as { list?: BuildNode[] };
+      setBuildNodes(Array.isArray(data?.list) ? data.list.filter((n) => n.enabled) : []);
+    }).catch(() => { /* silent */ });
   }, [pipelineCode, loadEnvironments, loadMembers, loadRuns]);
 
   const selectedTask = stages.flatMap(s => s.tasks).find(t => t.id === selectedTaskId) || null;
@@ -273,6 +280,7 @@ export default function PipelineEditor() {
         webhook_token: webhookToken,
         environment_id: environmentId ? Number(environmentId) : null,
         variables: JSON.stringify(Object.fromEntries(variables.filter(([k]) => k.trim()))),
+        build_node_id: buildNodeId ? Number(buildNodeId) : null,
       });
       toast.success('已保存');
     } catch { toast.error('保存失败'); }
@@ -386,7 +394,20 @@ export default function PipelineEditor() {
               ))}
             </SelectContent>
           </Select>
-          <span className="text-xs text-[var(--dg-text-secondary)] opacity-70">选择后流水线执行记录会关联到对应环境</span>
+          <Server className="w-4 h-4 text-[var(--dg-text-secondary)] ml-2" />
+          <span className="text-sm text-[var(--dg-text-secondary)]">构建节点:</span>
+          <Select value={buildNodeId || '__auto'} onValueChange={v => setBuildNodeId(v === '__auto' ? '' : v)}>
+            <SelectTrigger className="w-48 h-8 text-sm"><SelectValue placeholder="自动调度" /></SelectTrigger>
+            <SelectContent>
+              <SelectItem value="__auto">自动调度（Master 优先）</SelectItem>
+              {buildNodes.map(n => (
+                <SelectItem key={n.id} value={String(n.id)}>
+                  {n.name} ({n.running_count || 0}/{n.max_executors})
+                </SelectItem>
+              ))}
+            </SelectContent>
+          </Select>
+          <span className="text-xs text-[var(--dg-text-secondary)] opacity-70">Master 满载时自动调度到空闲远程节点</span>
         </CardContent>
       </Card>
 
@@ -491,6 +512,7 @@ export default function PipelineEditor() {
                     <th className="px-3 py-2 text-left text-[var(--dg-text-secondary)]">状态</th>
                     <th className="px-3 py-2 text-left text-[var(--dg-text-secondary)]">触发方式</th>
                     <th className="px-3 py-2 text-left text-[var(--dg-text-secondary)]">触发人</th>
+                    <th className="px-3 py-2 text-left text-[var(--dg-text-secondary)]">节点</th>
                     <th className="px-3 py-2 text-left text-[var(--dg-text-secondary)]">分支</th>
                     <th className="px-3 py-2 text-left text-[var(--dg-text-secondary)]">耗时</th>
                     <th className="px-3 py-2 text-left text-[var(--dg-text-secondary)]">时间</th>
@@ -516,6 +538,7 @@ export default function PipelineEditor() {
                         {!r.trigger_mode && (r.triggered_by || '手动')}
                       </td>
                       <td className="px-3 py-2 text-[var(--dg-text-secondary)] text-xs">{r.triggered_by || 'admin'}</td>
+                      <td className="px-3 py-2 text-[var(--dg-text-secondary)] text-xs">{r.build_node_name || 'Master'}</td>
                       <td className="px-3 py-2 text-[var(--dg-text-secondary)] font-mono text-xs">{r.branch || '-'}</td>
                       <td className="px-3 py-2 text-[var(--dg-text-secondary)]">{fmtDuration(r.duration)}</td>
                       <td className="px-3 py-2 text-[var(--dg-text-secondary)] text-xs">{r.created_at ? new Date(r.created_at).toLocaleString('zh-CN') : '-'}</td>

frontend/src/components/deploy/PipelineManager.tsx

@@ -5,21 +5,13 @@ import { Input } from '@/components/ui/input';
 import {
   Plus,
   Search,
-  GitBranch,
   Clock,
-  CheckCircle,
-  Rocket,
-  Container,
-  ArrowRight,
   Layers,
-  ShieldCheck,
-  Globe,
-  Code,
   Workflow,
   Server,
   Network,
 } from 'lucide-react';
-import { pipelineApi } from '@/api';
+import { pipelineApi, deployApi } from '@/api';
 import { usePipelines, usePipelineMutations } from '@/hooks/api';
 import { useConfirm } from '@/components/ui/confirm-dialog';
 import { toast } from 'sonner';
@@ -27,7 +19,16 @@ import { PipelineCard } from './pipeline-manager/PipelineCard';
 import { PipelineCreateDialog } from './pipeline-manager/PipelineCreateDialog';
 import { PageShell } from '@/components/layout/PageShell';
 import { PageEmpty } from '@/components/layout/PageEmpty';
-import { StatStrip } from '@/components/ui/stat-strip';
+import type { JsonData } from '@/types/common';
+
+interface DeployEnvironment {
+  id: number;
+  name: string;
+  display_name: string;
+  type: string;
+  color: string;
+  enabled: boolean;
+}
 
 // 流水线列表页编排器 // Logan.Li
 export function PipelineManager() {
@@ -39,18 +40,20 @@ export function PipelineManager() {
   const [runs, setRuns] = useState<Record<number, Record<string, unknown>[]>>({});
   const [loadingRuns, setLoadingRuns] = useState<Record<number, boolean>>({});
   const [envFilter, setEnvFilter] = useState<string>('all');
+  const [environments, setEnvironments] = useState<DeployEnvironment[]>([]);
   const [runningRunMap, setRunningRunMap] = useState<Record<number, Record<string, unknown>>>({});
   const [newOpen, setNewOpen] = useState(false);
 
   const confirm = useConfirm();
 
-  const ENV_TYPES = [
-    { key: 'all', label: t('deploy.env.all'), icon: Layers, color: '#6B7280' },
-    { key: 'production', label: t('deploy.env.production'), icon: ShieldCheck, color: '#EF4444' },
-    { key: 'testing', label: t('deploy.env.testing'), icon: CheckCircle, color: '#F59E0B' },
-    { key: 'staging', label: t('deploy.env.staging'), icon: Globe, color: '#8B5CF6' },
-    { key: 'development', label: t('deploy.env.development'), icon: Code, color: '#3B82F6' },
-  ];
+  useEffect(() => {
+    deployApi.getEnvironments()
+      .then((res) => {
+        const list = ((res as JsonData)?.list || []) as DeployEnvironment[];
+        setEnvironments(list.filter((e) => e.enabled !== false));
+      })
+      .catch(() => { /* 环境列表加载失败时仅显示「全部」 */ });
+  }, []);
 
   // 同步运行中的任务 ID // Logan.Li
   useEffect(() => {
@@ -152,12 +155,19 @@ export function PipelineManager() {
   const filtered = pipelines.filter((p) => {
     const matchSearch = String(p.name || '').toLowerCase().includes(searchQuery.toLowerCase()) ||
       String(p.description || '').toLowerCase().includes(searchQuery.toLowerCase());
-    const env = p.environment as Record<string, unknown> | undefined;
-    const matchEnv = envFilter === 'all' || (env?.type || '') === envFilter;
+    const envId = p.environment_id as number | undefined;
+    const matchEnv = envFilter === 'all' || String(envId || '') === envFilter;
     return matchSearch && matchEnv;
   });
 
-  const runningCount = pipelines.filter(p => p.last_status === 'running').length;
+  const envTabs = [
+    { key: 'all', label: t('deploy.env.all'), color: undefined as string | undefined },
+    ...environments.map((e) => ({
+      key: String(e.id),
+      label: e.display_name || e.name,
+      color: e.color,
+    })),
+  ];
 
   const toolbar = (
     <div className="flex items-center gap-4 flex-wrap">
@@ -170,92 +180,67 @@ export function PipelineManager() {
           className="pl-10 dg-input"
         />
       </div>
-      <div className="flex items-center gap-1 bg-[var(--dg-bg-secondary)] rounded-lg p-1 border border-[var(--dg-border)]">
-        {ENV_TYPES.map((et) => {
-          const active = envFilter === et.key;
-          const Icon = et.icon;
-          return (
-            <button
-              key={et.key}
-              onClick={() => setEnvFilter(et.key)}
-              className={`flex items-center gap-1.5 px-3 py-1.5 rounded-md text-xs font-medium transition-all ${
-                active ? 'text-white shadow-sm' : 'text-[var(--dg-text-secondary)] hover:text-[var(--dg-text-primary)]'
-              }`}
-              style={active ? { backgroundColor: et.color } : {}}
-            >
-              <Icon className="h-3.5 w-3.5" />{et.label}
-            </button>
-          );
-        })}
-      </div>
+      {envTabs.length > 1 && (
+        <div className="flex items-center gap-1 bg-[var(--dg-bg-secondary)] rounded-lg p-1 border border-[var(--dg-border)] flex-wrap">
+          {envTabs.map((et) => {
+            const active = envFilter === et.key;
+            return (
+              <button
+                key={et.key}
+                onClick={() => setEnvFilter(et.key)}
+                className={`flex items-center gap-1.5 px-3 py-1.5 rounded-md text-xs font-medium transition-colors ${
+                  active
+                    ? 'bg-[var(--dg-bg-primary)] text-[var(--dg-text-primary)] border border-[var(--dg-border)] shadow-sm'
+                    : 'text-[var(--dg-text-muted)] hover:text-[var(--dg-text-primary)]'
+                }`}
+              >
+                {et.key === 'all' ? (
+                  <Layers className="h-3.5 w-3.5" />
+                ) : (
+                  <span
+                    className="w-2 h-2 rounded-full shrink-0"
+                    style={{ backgroundColor: et.color || 'var(--dg-text-muted)' }}
+                  />
+                )}
+                {et.label}
+              </button>
+            );
+          })}
+        </div>
+      )}
     </div>
   );
 
   return (
     <PageShell
       variant="list"
-      title={t('deploy.pipeline.title')}
-      subtitle={t('deploy.pipeline.subtitle')}
+      title="流水线"
+      subtitle="CI/CD 构建、镜像打包与双通道部署"
       icon={<Workflow className="h-5 w-5" />}
       loading={loading}
-      metrics={(
-        <StatStrip
-          items={[
-            { label: t('deploy.pipeline.title'), value: pipelines.length, color: 'blue' },
-            { label: t('common.running'), value: runningCount, color: 'amber' },
-            { label: t('deploy.env.all'), value: filtered.length, color: 'muted' },
-          ]}
-        />
-      )}
       toolbar={toolbar}
       actions={(
         <>
           <Button variant="outline" className="dg-btn-secondary" onClick={() => refetchPipelines()} disabled={isFetching}>
-            <Clock className={`h-4 w-4 mr-2 ${isFetching ? 'animate-spin' : ''}`} />{t('common.refresh')}
+            <Clock className="h-4 w-4 mr-2" />{t('common.refresh')}
           </Button>
           <Button className="dg-btn-primary" onClick={() => setNewOpen(true)}>
             <Plus className="h-4 w-4 mr-2" />{t('deploy.pipeline.newPipeline')}
           </Button>
         </>
       )}
+      contentClassName="space-y-4"
     >
-      {/* 全流程可视化横幅 — 双路径 // Logan.Li */}
-      <div className="flex items-stretch gap-3 px-4 py-3 rounded-lg bg-[var(--dg-bg-secondary)] border border-[var(--dg-border)]">
-        <div className="flex-1 space-y-1.5">
-          <div className="flex items-center gap-1.5">
-            <GitBranch className="h-3 w-3 text-indigo-400" />
-            <span className="text-[10px] font-semibold text-indigo-400">{t('deploy.banner.build')}</span>
-            <ArrowRight className="h-2.5 w-2.5 text-[var(--dg-text-secondary)] opacity-30" />
-            <Rocket className="h-3 w-3 dg-text-red" />
-            <span className="text-[10px] font-semibold dg-text-red">{t('deploy.banner.deploy')}</span>
-            <ArrowRight className="h-2.5 w-2.5 text-[var(--dg-text-secondary)] opacity-30" />
-            <div className="flex items-center gap-1 px-2 py-0.5 rounded bg-blue-400/10 border border-blue-400/20">
-              <Server className="h-3 w-3 dg-text-blue" />
-              <span className="text-[10px] font-medium dg-text-blue">{t('deploy.banner.sshHost')}</span>
-            </div>
-          </div>
-          <p className="text-[9px] text-[var(--dg-text-secondary)] opacity-40 pl-1">{t('deploy.banner.sshDesc')}</p>
-        </div>
-        <div className="w-px bg-[var(--dg-border)]" />
-        <div className="flex-1 space-y-1.5">
-          <div className="flex items-center gap-1.5">
-            <GitBranch className="h-3 w-3 text-indigo-400" />
-            <span className="text-[10px] font-semibold text-indigo-400">{t('deploy.banner.build')}</span>
-            <ArrowRight className="h-2.5 w-2.5 text-[var(--dg-text-secondary)] opacity-30" />
-            <Container className="h-3 w-3 dg-text-cyan" />
-            <span className="text-[10px] font-semibold dg-text-cyan">{t('deploy.banner.imageRegistry')}</span>
-            <ArrowRight className="h-2.5 w-2.5 text-[var(--dg-text-secondary)] opacity-30" />
-            <Rocket className="h-3 w-3 dg-text-red" />
-            <span className="text-[10px] font-semibold dg-text-red">{t('deploy.banner.deploy')}</span>
-            <ArrowRight className="h-2.5 w-2.5 text-[var(--dg-text-secondary)] opacity-30" />
-            <div className="flex items-center gap-1 px-2 py-0.5 rounded bg-emerald-400/10 border border-emerald-400/20">
-              <Network className="h-3 w-3 dg-text-green" />
-              <span className="text-[10px] font-medium dg-text-green">{t('deploy.banner.kubernetes')}</span>
-            </div>
-          </div>
-          <p className="text-[9px] text-[var(--dg-text-secondary)] opacity-40 pl-1">{t('deploy.banner.k8sDesc')}</p>
-        </div>
-        <span className="self-center ml-2 text-[10px] text-[var(--dg-text-secondary)] opacity-30 tracking-wide whitespace-nowrap">{t('deploy.banner.fullFlow')}</span>
+      <div className="flex flex-wrap items-center gap-x-4 gap-y-1 px-4 py-2.5 rounded-lg bg-[var(--dg-bg-secondary)] border border-[var(--dg-border)] text-xs text-[var(--dg-text-muted)]">
+        <span className="flex items-center gap-1.5">
+          <Server className="h-3.5 w-3.5" />
+          主机发布：构建 → SSH 关联主机
+        </span>
+        <span className="hidden sm:inline text-[var(--dg-border)]">|</span>
+        <span className="flex items-center gap-1.5">
+          <Network className="h-3.5 w-3.5" />
+          Kubernetes 发布：构建 → 镜像 → 关联 Deployment 滚动更新
+        </span>
       </div>
 
       {!loading && filtered.length === 0 ? (

frontend/src/components/deploy/ToolConfigTab.tsx

@@ -1,9 +1,10 @@
 import { useState, useEffect } from 'react';
-import { RefreshCw, Loader2, Download, CheckCircle, XCircle, Clock, Settings2, ChevronDown} from 'lucide-react';
+import { RefreshCw, Loader2, Download, CheckCircle, XCircle, Clock, Settings2, ChevronDown, Trash2 } from 'lucide-react';
 import { Button } from '@/components/ui/button';
 import { Badge } from '@/components/ui/badge';
-import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select';
+
 import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogDescription } from '@/components/ui/dialog';
+import { useConfirm } from '@/components/ui/confirm-dialog';
 import { toast } from 'sonner';
 import { deployApi } from '@/api';
 import type { JsonData } from '@/types/common';
@@ -29,22 +30,15 @@ const categoryColor: Record<string, string> = {
   automation: 'bg-purple-500/20 dg-text-purple border-purple-500/30',
   other: 'bg-[var(--dg-bg-active)]/20 dg-text-secondary border-[var(--dg-border)]',
 };
-const _methodLabel: Record<string, string> = {
-  preinstall: '预装', lazy: '懒加载', disabled: '禁用',
-};
-const _methodColor: Record<string, string> = {
-  preinstall: 'bg-emerald-500/20 dg-text-green border-emerald-500/30',
-  lazy: 'bg-violet-500/20 dg-text-purple border-violet-500/30',
-  disabled: 'bg-[var(--dg-bg-active)]/20 dg-text-secondary border-[var(--dg-border)]',
-};
-
-// Tools that support version selection
-const VERSIONED_TOOLS = ['jdk', 'nodejs', 'maven'];
+// 支持版本选择的工具 // Logan.Li
+const VERSIONED_TOOLS = ['jdk', 'golang', 'nodejs', 'maven', 'nvm'];
 
 export default function ToolConfigTab() {
+  const confirm = useConfirm();
   const [tools, setTools] = useState<ToolConfig[]>([]);
   const [loading, setLoading] = useState(false);
   const [installing, setInstalling] = useState<number | null>(null);
+  const [uninstalling, setUninstalling] = useState<number | null>(null);
 
   // Version dialog state
   const [versionDialog, setVersionDialog] = useState<{ tool: ToolConfig; versions: VersionOption[] } | null>(null);
@@ -64,6 +58,14 @@ export default function ToolConfigTab() {
 
   useEffect(() => { fetchTools(); }, []);
 
+  // 安装中/失败状态轮询，与磁盘实际状态同步 // Logan.Li
+  useEffect(() => {
+    const pending = tools.filter((t) => t.status === 'installing' || t.status === 'failed');
+    if (pending.length === 0) return undefined;
+    const timer = setInterval(() => { void fetchTools(); }, 4000);
+    return () => clearInterval(timer);
+  }, [tools]);
+
   const openVersionDialog = async (tool: ToolConfig) => {
     try {
       const res: JsonData = await deployApi.getToolVersions(tool.id);
@@ -74,7 +76,12 @@ export default function ToolConfigTab() {
         return;
       }
       setVersionDialog({ tool, versions });
-      setSelectedVersion(tool.default_version || versions[0]?.version || '');
+      const preferred = versions.find((v) => v.version === 'lts')?.version
+        || versions.find((v) => v.label.includes('推荐'))?.version
+        || tool.default_version
+        || versions[0]?.version
+        || '';
+      setSelectedVersion(preferred);
     } catch {
       // Fallback: install with default version
       handleInstall(tool);
@@ -86,18 +93,37 @@ export default function ToolConfigTab() {
     try {
       const v = version || tool.default_version;
       await deployApi.installTool(tool.id, v);
-      toast.success(`${tool.display_name}${v ? ` (${v})` : ''} 安装已触发`);
+      toast.success(`${tool.display_name}${v ? ` (${v})` : ''} 安装已触发，可在审计日志查看结果`);
       setVersionDialog(null);
-      setTimeout(async () => {
-        try { await deployApi.checkTool(tool.id); fetchTools(); } catch { /* ignore */ }
-        setInstalling(null);
-      }, 3000);
+      setInstalling(null);
+      void fetchTools();
     } catch {
       toast.error('触发安装失败');
       setInstalling(null);
     }
   };
 
+  const handleUninstall = async (tool: ToolConfig) => {
+    const ok = await confirm({
+      title: '卸载工具',
+      description: `确定卸载 ${tool.display_name}？卸载后可重新选择版本安装。`,
+      confirmText: '卸载',
+      variant: 'destructive',
+    });
+    if (!ok) return;
+
+    setUninstalling(tool.id);
+    try {
+      await deployApi.uninstallTool(tool.id);
+      toast.success(`${tool.display_name} 已卸载，可重新安装`);
+      void fetchTools();
+    } catch {
+      toast.error('卸载失败');
+    } finally {
+      setUninstalling(null);
+    }
+  };
+
   const handleCheckStatus = async (tool: ToolConfig) => {
     try {
       const res: JsonData = await deployApi.checkTool(tool.id);
@@ -106,30 +132,22 @@ export default function ToolConfigTab() {
     } catch { toast.error('检测失败'); }
   };
 
-  const handleMethodChange = async (tool: ToolConfig, method: 'preinstall' | 'lazy' | 'disabled') => {
-    try {
-      await deployApi.updateTool(tool.id, { install_method: method });
-      toast.success('已更新');
-      fetchTools();
-    } catch { toast.error('更新失败'); }
-  };
-
-  // Download speed test
+  // 检测工具安装状态（磁盘验证）// Logan.Li
   const handleTestDownload = async (tool: ToolConfig) => {
     setTesting(tool.id);
     const start = Date.now();
     try {
-      // Simulate a quick reachability test by fetching the version URL
-      const res: JsonData = await deployApi.getToolVersions(tool.id);
+      const res: JsonData = await deployApi.checkTool(tool.id);
       const elapsed = ((Date.now() - start) / 1000).toFixed(1);
-      const available = (res as JsonData)?.versions?.length > 0;
-      if (available) {
-        toast.success(`${tool.display_name} 镜像可访问 (${elapsed}s)`);
+      if (res?.available) {
+        toast.success(`${tool.display_name} 已就绪${res.version ? ` (${res.version})` : ''} (${elapsed}s)`);
       } else {
-        toast(`${tool.display_name} 无法获取版本列表`, { description: '请检查网络连接' });
+        const errMsg = (res?.tool as ToolConfig | undefined)?.error_msg;
+        toast(`${tool.display_name} 未安装或不可用`, { description: errMsg || '可点击「安装」触发懒加载' });
       }
+      fetchTools();
     } catch {
-      toast.error(`${tool.display_name} 网络不可达`);
+      toast.error(`${tool.display_name} 检测失败`);
     }
     setTesting(null);
   };
@@ -160,7 +178,6 @@ export default function ToolConfigTab() {
               <tr>
                 <th className="px-3 py-2 text-left font-medium text-[var(--dg-text-secondary)]">工具</th>
                 <th className="px-3 py-2 text-left font-medium text-[var(--dg-text-secondary)] hidden sm:table-cell">分类</th>
-                <th className="px-3 py-2 text-left font-medium text-[var(--dg-text-secondary)]">安装方式</th>
                 <th className="px-3 py-2 text-left font-medium text-[var(--dg-text-secondary)]">状态</th>
                 <th className="px-3 py-2 text-right font-medium text-[var(--dg-text-secondary)]">操作</th>
               </tr>
@@ -188,21 +205,6 @@ export default function ToolConfigTab() {
                         {categoryLabel[tool.category] || tool.category}
                       </Badge>
                     </td>
-                    <td className="px-3 py-2">
-                      <Select
-                        value={tool.install_method}
-                        onValueChange={(v) => handleMethodChange(tool, v as 'preinstall' | 'lazy' | 'disabled')}
-                      >
-                        <SelectTrigger className="h-7 w-[90px] text-xs">
-                          <SelectValue />
-                        </SelectTrigger>
-                        <SelectContent>
-                          <SelectItem value="preinstall">预装</SelectItem>
-                          <SelectItem value="lazy">懒加载</SelectItem>
-                          <SelectItem value="disabled">禁用</SelectItem>
-                        </SelectContent>
-                      </Select>
-                    </td>
                     <td className="px-3 py-2">
                       {tool.status === 'installed' ? (
                         <Badge className="bg-emerald-500/20 dg-text-green border-emerald-500/30 text-xs gap-1">
@@ -224,7 +226,21 @@ export default function ToolConfigTab() {
                     </td>
                     <td className="px-3 py-2 text-right">
                       <div className="flex justify-end gap-1">
-                        {tool.install_method === 'lazy' && tool.status !== 'installed' && (
+                        {tool.install_method === 'lazy' && (tool.status === 'installed' || tool.status === 'failed') && (
+                          <Button
+                            variant="outline" size="sm" className="h-7 text-xs text-red-400 border-red-500/30 hover:bg-red-500/10"
+                            onClick={() => handleUninstall(tool)}
+                            disabled={uninstalling === tool.id}
+                          >
+                            {uninstalling === tool.id ? (
+                              <Loader2 className="w-3 h-3 animate-spin mr-1" />
+                            ) : (
+                              <Trash2 className="w-3 h-3 mr-1" />
+                            )}
+                            卸载
+                          </Button>
+                        )}
+                        {tool.install_method === 'lazy' && tool.status !== 'installed' && tool.status !== 'installing' && (
                           hasVersions ? (
                             <Button
                               variant="outline" size="sm" className="h-7 text-xs"
@@ -287,6 +303,7 @@ export default function ToolConfigTab() {
             <DialogTitle>选择安装版本</DialogTitle>
             <DialogDescription>
               {versionDialog?.tool.display_name} — 请选择要安装的版本
+              {versionDialog?.tool.name === 'nodejs' && '（推荐「最新 LTS」由 nvm 自动解析当前 LTS 线）'}
             </DialogDescription>
           </DialogHeader>
           <div className="space-y-4 py-2">

frontend/src/components/deploy/UserGroupsManager.tsx

@@ -4,6 +4,7 @@ import { Button } from '@/components/ui/button';
 import { PageShell } from '@/components/layout/PageShell';
 import { PageEmpty } from '@/components/layout/PageEmpty';
 import { StatStrip } from '@/components/ui/stat-strip';
+
 import { Input } from '@/components/ui/input';
 import { Badge } from '@/components/ui/badge';
 import { Dialog, DialogContent, DialogHeader, DialogTitle } from '@/components/ui/dialog';
@@ -21,7 +22,7 @@ interface GroupMember {
   id: number; group_id: number; username: string; created_at: string;
 }
 
-export default function UserGroupsManager() {
+export default function UserGroupsManager({ embedded = false }: { embedded?: boolean }) {
   const _confirm = useConfirm();
   const [groups, setGroups] = useState<Group[]>([]);
   const [loading, setLoading] = useState(true);
@@ -83,33 +84,18 @@ export default function UserGroupsManager() {
 
   const memberCount = groups.reduce((sum, g) => sum + (g.members || []).length, 0);
 
-  return (
-    <PageShell
-      variant="list"
-      title="用户组管理"
-      subtitle="创建用户组，将组授权给流水线，组内成员自动获得流水线权限"
-      icon={<Users className="h-5 w-5" />}
-      loading={loading}
-      metrics={(
-        <StatStrip
-          items={[
-            { label: '用户组', value: groups.length, color: 'blue' },
-            { label: '成员总数', value: memberCount, color: 'purple' },
-          ]}
-        />
-      )}
-      actions={(
-        <>
-          <Button variant="outline" size="sm" className="dg-btn-secondary" onClick={loadGroups}>
-            <RefreshCw className="w-4 h-4 mr-1" />刷新
-          </Button>
-          <Button size="sm" className="dg-btn-primary" onClick={() => { setEditId(null); setFormName(''); setFormDesc(''); setFormOpen(true); }}>
-            <Plus className="w-4 h-4 mr-1" />新建用户组
-          </Button>
-        </>
-      )}
-    >
-      {!loading && groups.length === 0 ? (
+  const toolbar = embedded ? (
+    <div className="flex items-center justify-end gap-2 mb-3">
+      <Button variant="outline" size="sm" className="dg-btn-secondary" onClick={loadGroups}>
+        <RefreshCw className="w-4 h-4 mr-1" />刷新
+      </Button>
+      <Button size="sm" className="dg-btn-primary" onClick={() => { setEditId(null); setFormName(''); setFormDesc(''); setFormOpen(true); }}>
+        <Plus className="w-4 h-4 mr-1" />新建用户组
+      </Button>
+    </div>
+  ) : null;
+
+  const listBody = !loading && groups.length === 0 ? (
         <PageEmpty
           icon={<Users className="h-10 w-10" />}
           title="暂无用户组"
@@ -171,9 +157,9 @@ export default function UserGroupsManager() {
             </div>
           ))}
         </div>
-      )}
+      );
 
-      {/* Form Dialog */}
+  const formDialog = (
       <Dialog open={formOpen} onOpenChange={setFormOpen}>
         <DialogContent>
           <DialogHeader><DialogTitle>{editId ? '编辑用户组' : '新建用户组'}</DialogTitle></DialogHeader>
@@ -187,6 +173,47 @@ export default function UserGroupsManager() {
           </div>
         </DialogContent>
       </Dialog>
+  );
+
+  if (embedded) {
+    return (
+      <>
+        {toolbar}
+        {listBody}
+        {formDialog}
+      </>
+    );
+  }
+
+  return (
+    <PageShell
+      variant="list"
+      title="应用发布"
+      subtitle="用户组 — 批量授权流水线访问权限"
+      icon={<Users className="h-5 w-5" />}
+      loading={loading}
+      metrics={(
+        <StatStrip
+          items={[
+            { label: '用户组', value: groups.length, color: 'blue' },
+            { label: '成员总数', value: memberCount, color: 'purple' },
+          ]}
+        />
+      )}
+      actions={(
+        <>
+          <Button variant="outline" size="sm" className="dg-btn-secondary" onClick={loadGroups}>
+            <RefreshCw className="w-4 h-4 mr-1" />刷新
+          </Button>
+          <Button size="sm" className="dg-btn-primary" onClick={() => { setEditId(null); setFormName(''); setFormDesc(''); setFormOpen(true); }}>
+            <Plus className="w-4 h-4 mr-1" />新建用户组
+          </Button>
+        </>
+      )}
+      contentClassName="space-y-4"
+    >
+      {listBody}
+      {formDialog}
     </PageShell>
   );
 }

frontend/src/components/deploy/deploy-rbac/JobRoleCreateDialog.tsx

@@ -0,0 +1,121 @@
+import { useMemo } from 'react';
+import { Button } from '@/components/ui/button';
+import { Input } from '@/components/ui/input';
+import { Label } from '@/components/ui/label';
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog';
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select';
+import { Loader2, Save } from 'lucide-react';
+import { matchPipelines, type PipelineMatchItem } from './matchPipeline';
+
+interface JobRoleCreateDialogProps {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  pipelines: PipelineMatchItem[];
+  saving: boolean;
+  name: string;
+  code: string;
+  pattern: string;
+  role: string;
+  description: string;
+  onNameChange: (v: string) => void;
+  onCodeChange: (v: string) => void;
+  onPatternChange: (v: string) => void;
+  onRoleChange: (v: string) => void;
+  onDescriptionChange: (v: string) => void;
+  onSubmit: () => void;
+}
+
+// 新建 Job 权限角色弹窗 // Logan.Li
+export function JobRoleCreateDialog({
+  open,
+  onOpenChange,
+  pipelines,
+  saving,
+  name,
+  code,
+  pattern,
+  role,
+  description,
+  onNameChange,
+  onCodeChange,
+  onPatternChange,
+  onRoleChange,
+  onDescriptionChange,
+  onSubmit,
+}: JobRoleCreateDialogProps) {
+  const preview = useMemo(() => matchPipelines(pattern, pipelines), [pattern, pipelines]);
+  const patternHint = useMemo(() => {
+    if (!pattern.trim()) return '输入正则，匹配流水线 code 或 Job 名称';
+    try {
+      // eslint-disable-next-line no-new
+      new RegExp(pattern);
+      return preview.length > 0 ? `命中 ${preview.length} 个发布任务` : '无匹配任务';
+    } catch {
+      return '正则语法错误';
+    }
+  }, [pattern, preview.length]);
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="max-w-md bg-[var(--dg-bg-primary)] border-[var(--dg-border)]">
+        <DialogHeader>
+          <DialogTitle>新建 Job 权限</DialogTitle>
+          <DialogDescription className="text-[var(--dg-text-muted)]">
+            按正则匹配流水线 code 或 Job 名称，分配 owner / editor / viewer 权限
+          </DialogDescription>
+        </DialogHeader>
+        <div className="space-y-3">
+          <div className="grid grid-cols-2 gap-2">
+            <div className="space-y-1">
+              <Label className="text-xs">名称</Label>
+              <Input value={name} onChange={(e) => onNameChange(e.target.value)} placeholder="后端发布" className="h-8 text-sm dg-input" />
+            </div>
+            <div className="space-y-1">
+              <Label className="text-xs">标识</Label>
+              <Input value={code} onChange={(e) => onCodeChange(e.target.value)} placeholder="backend-jobs" className="h-8 text-sm font-mono dg-input" />
+            </div>
+          </div>
+          <div className="space-y-1">
+            <Label className="text-xs">匹配正则</Label>
+            <Input
+              value={pattern}
+              onChange={(e) => onPatternChange(e.target.value)}
+              placeholder="^cex-.* 或 ^api-server$"
+              className="h-8 text-sm font-mono dg-input"
+            />
+            <p className="text-[10px] text-[var(--dg-text-muted)]">{patternHint}</p>
+          </div>
+          <div className="space-y-1">
+            <Label className="text-xs">权限级别</Label>
+            <Select value={role} onValueChange={onRoleChange}>
+              <SelectTrigger className="h-8 text-sm dg-input"><SelectValue /></SelectTrigger>
+              <SelectContent>
+                <SelectItem value="owner">拥有者 — 配置 + 执行 + 授权</SelectItem>
+                <SelectItem value="editor">编辑者 — 配置 + 执行</SelectItem>
+                <SelectItem value="viewer">查看者 — 只读</SelectItem>
+              </SelectContent>
+            </Select>
+          </div>
+          <div className="space-y-1">
+            <Label className="text-xs">说明</Label>
+            <Input value={description} onChange={(e) => onDescriptionChange(e.target.value)} placeholder="可选" className="h-8 text-sm dg-input" />
+          </div>
+        </div>
+        <DialogFooter>
+          <Button variant="outline" onClick={() => onOpenChange(false)}>取消</Button>
+          <Button onClick={onSubmit} disabled={saving}>
+            {saving ? <Loader2 className="h-4 w-4 animate-spin mr-1" /> : <Save className="h-4 w-4 mr-1" />}
+            创建
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+}

frontend/src/components/deploy/deploy-rbac/matchPipeline.ts

@@ -0,0 +1,29 @@
+// 流水线 / Job 正则命中工具（code + job_name） // Logan.Li
+
+export interface PipelineMatchItem {
+  id: number | string;
+  code?: string;
+  job_name?: string;
+  name?: string;
+}
+
+export function pipelineMatchesPattern(pattern: string, pipeline: PipelineMatchItem): boolean {
+  try {
+    const re = new RegExp(pattern);
+    if (pipeline.code && re.test(String(pipeline.code))) return true;
+    if (pipeline.job_name && re.test(String(pipeline.job_name))) return true;
+    return false;
+  } catch {
+    return false;
+  }
+}
+
+export function matchPipelines(pattern: string, pipelines: PipelineMatchItem[]): PipelineMatchItem[] {
+  if (!pattern.trim()) return [];
+  return pipelines.filter((p) => pipelineMatchesPattern(pattern, p));
+}
+
+export function pipelineDisplayLabel(p: PipelineMatchItem): string {
+  if (p.job_name) return `${p.code} · ${p.job_name}`;
+  return String(p.code || p.name || p.id);
+}

frontend/src/components/deploy/pipeline-manager/DeployTargetFields.tsx

@@ -0,0 +1,373 @@
+import { useState, useEffect, useCallback, useMemo } from 'react';
+import { Input } from '@/components/ui/input';
+import { Label } from '@/components/ui/label';
+import { Badge } from '@/components/ui/badge';
+import { ScrollArea } from '@/components/ui/scroll-area';
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select';
+import { Search, Server, Network, Loader2, Check } from 'lucide-react';
+import { cn } from '@/lib/utils';
+import { serverApi, kubernetesApi } from '@/api';
+import { getPublicApiBase } from '@/utils/request';
+
+export interface DeployTargetValue {
+  deployTarget: 'ssh' | 'k8s';
+  serverIds: number[];
+  deployRemotePath: string;
+  deployScript: string;
+  k8sClusterId: number | '';
+  k8sNamespace: string;
+  k8sDeployment: string;
+  k8sContainerName: string;
+}
+
+interface DeployTargetFieldsProps {
+  value: DeployTargetValue;
+  onChange: (patch: Partial<DeployTargetValue>) => void;
+  requireTarget?: boolean;
+}
+
+interface ServerItem {
+  id: number;
+  hostname: string;
+  ip?: string;
+  status?: string;
+}
+
+interface ClusterItem {
+  id: number;
+  name: string;
+  code: string;
+}
+
+interface DeploymentItem {
+  namespace: string;
+  name: string;
+  image?: string;
+  ready_replicas?: number;
+  replicas?: number;
+}
+
+// 发布目标选择：SSH 关联主机 / K8s 关联 Deployment // Logan.Li
+export function DeployTargetFields({ value, onChange, requireTarget = true }: DeployTargetFieldsProps) {
+  const [servers, setServers] = useState<ServerItem[]>([]);
+  const [clusters, setClusters] = useState<ClusterItem[]>([]);
+  const [deployments, setDeployments] = useState<DeploymentItem[]>([]);
+  const [serverSearch, setServerSearch] = useState('');
+  const [depSearch, setDepSearch] = useState('');
+  const [loadingServers, setLoadingServers] = useState(false);
+  const [loadingDeps, setLoadingDeps] = useState(false);
+
+  const loadServers = useCallback(async () => {
+    setLoadingServers(true);
+    try {
+      const res = await serverApi.getServers({ page_size: 200 });
+      const list = (res?.list ?? []) as ServerItem[];
+      setServers(list);
+    } catch {
+      setServers([]);
+    } finally {
+      setLoadingServers(false);
+    }
+  }, []);
+
+  const loadClusters = useCallback(async () => {
+    try {
+      const res = await kubernetesApi.getClusters();
+      setClusters((res?.list ?? []) as ClusterItem[]);
+    } catch {
+      setClusters([]);
+    }
+  }, []);
+
+  const loadDeployments = useCallback(async (clusterId: number | '') => {
+    if (!clusterId) {
+      setDeployments([]);
+      return;
+    }
+    const cluster = clusters.find((c) => c.id === clusterId);
+    if (!cluster?.code) {
+      setDeployments([]);
+      return;
+    }
+    setLoadingDeps(true);
+    try {
+      const res = await kubernetesApi.getAllDeployments(cluster.code);
+      const list = Array.isArray(res) ? res : [];
+      setDeployments(list as DeploymentItem[]);
+    } catch {
+      setDeployments([]);
+    } finally {
+      setLoadingDeps(false);
+    }
+  }, [clusters]);
+
+  useEffect(() => {
+    loadServers();
+    loadClusters();
+  }, [loadServers, loadClusters]);
+
+  useEffect(() => {
+    if (value.deployTarget === 'k8s' && value.k8sClusterId) {
+      loadDeployments(value.k8sClusterId);
+    }
+  }, [value.deployTarget, value.k8sClusterId, loadDeployments]);
+
+  const filteredServers = useMemo(() => {
+    const q = serverSearch.trim().toLowerCase();
+    if (!q) return servers;
+    return servers.filter(
+      (s) => s.hostname?.toLowerCase().includes(q) || s.ip?.toLowerCase().includes(q),
+    );
+  }, [servers, serverSearch]);
+
+  const filteredDeployments = useMemo(() => {
+    const q = depSearch.trim().toLowerCase();
+    if (!q) return deployments;
+    return deployments.filter(
+      (d) => d.name.toLowerCase().includes(q) || d.namespace.toLowerCase().includes(q),
+    );
+  }, [deployments, depSearch]);
+
+  const toggleServer = (id: number) => {
+    const next = value.serverIds.includes(id)
+      ? value.serverIds.filter((x) => x !== id)
+      : [...value.serverIds, id];
+    onChange({ serverIds: next });
+  };
+
+  const selectDeployment = (dep: DeploymentItem) => {
+    onChange({
+      k8sNamespace: dep.namespace,
+      k8sDeployment: dep.name,
+    });
+  };
+
+  const selectedCluster = clusters.find((c) => c.id === value.k8sClusterId);
+
+  return (
+    <div className="space-y-3">
+      <div className="flex gap-1 p-1 rounded-lg bg-[var(--dg-bg-secondary)] border border-[var(--dg-border)]">
+        {([
+          { key: 'ssh' as const, label: '主机发布', icon: Server },
+          { key: 'k8s' as const, label: 'Kubernetes 发布', icon: Network },
+        ]).map((item) => {
+          const active = value.deployTarget === item.key;
+          const Icon = item.icon;
+          return (
+            <button
+              key={item.key}
+              type="button"
+              onClick={() => onChange({
+                deployTarget: item.key,
+                serverIds: item.key === 'ssh' ? value.serverIds : [],
+                deployRemotePath: item.key === 'ssh' ? value.deployRemotePath : '',
+                deployScript: item.key === 'ssh' ? value.deployScript : '',
+                k8sClusterId: item.key === 'k8s' ? value.k8sClusterId : '',
+                k8sNamespace: item.key === 'k8s' ? value.k8sNamespace : '',
+                k8sDeployment: item.key === 'k8s' ? value.k8sDeployment : '',
+                k8sContainerName: item.key === 'k8s' ? value.k8sContainerName : '',
+              })}
+              className={cn(
+                'flex-1 flex items-center justify-center gap-1.5 px-3 py-2 rounded-md text-xs font-medium transition-colors',
+                active
+                  ? 'bg-[var(--dg-bg-primary)] text-[var(--dg-text-primary)] border border-[var(--dg-border)] shadow-sm'
+                  : 'text-[var(--dg-text-muted)] hover:text-[var(--dg-text-primary)]',
+              )}
+            >
+              <Icon className="h-3.5 w-3.5" />
+              {item.label}
+            </button>
+          );
+        })}
+      </div>
+
+      {value.deployTarget === 'ssh' ? (
+        <div className="space-y-2">
+          <div className="flex items-center justify-between">
+            <Label className="text-xs">
+              关联主机
+              {requireTarget && <span className="text-[var(--dg-red)] ml-0.5">*</span>}
+            </Label>
+            {value.serverIds.length > 0 && (
+              <Badge variant="outline" className="text-[10px] border-[var(--dg-border)]">
+                已选 {value.serverIds.length} 台
+              </Badge>
+            )}
+          </div>
+          <div className="relative">
+            <Search className="absolute left-2.5 top-1/2 -translate-y-1/2 h-3.5 w-3.5 text-[var(--dg-text-muted)]" />
+            <Input
+              value={serverSearch}
+              onChange={(e) => setServerSearch(e.target.value)}
+              placeholder="搜索主机名或 IP"
+              className="pl-8 h-8 text-xs dg-input"
+            />
+          </div>
+          <ScrollArea className="h-[140px] rounded-lg border border-[var(--dg-border)] bg-[var(--dg-bg-secondary)]">
+            {loadingServers ? (
+              <div className="flex items-center justify-center py-8 text-xs text-[var(--dg-text-muted)]">
+                <Loader2 className="h-4 w-4 animate-spin mr-1.5" />加载中
+              </div>
+            ) : filteredServers.length === 0 ? (
+              <p className="text-xs text-[var(--dg-text-muted)] text-center py-8">暂无可用主机</p>
+            ) : (
+              <div className="p-1.5 space-y-1">
+                {filteredServers.map((srv) => {
+                  const selected = value.serverIds.includes(srv.id);
+                  return (
+                    <button
+                      key={srv.id}
+                      type="button"
+                      onClick={() => toggleServer(srv.id)}
+                      className={cn(
+                        'w-full flex items-center gap-2 px-2.5 py-2 rounded-md text-left text-xs transition-colors',
+                        selected
+                          ? 'bg-[var(--dg-bg-hover)] border border-[var(--dg-border)]'
+                          : 'hover:bg-[var(--dg-bg-hover)]/60',
+                      )}
+                    >
+                      <span className={cn(
+                        'w-4 h-4 rounded border flex items-center justify-center shrink-0',
+                        selected ? 'bg-[var(--dg-blue)] border-[var(--dg-blue)]' : 'border-[var(--dg-border)]',
+                      )}>
+                        {selected && <Check className="h-2.5 w-2.5 text-white" />}
+                      </span>
+                      <Server className="h-3.5 w-3.5 text-[var(--dg-text-muted)] shrink-0" />
+                      <span className="font-medium text-[var(--dg-text-primary)] truncate">{srv.hostname}</span>
+                      {srv.ip && <span className="text-[var(--dg-text-muted)] ml-auto shrink-0">{srv.ip}</span>}
+                    </button>
+                  );
+                })}
+              </div>
+            )}
+          </ScrollArea>
+          <p className="text-[10px] text-[var(--dg-text-muted)]">构建完成后 SCP 上传 jar/tar.gz 到远程目录并执行部署命令</p>
+          <div className="grid grid-cols-2 gap-2">
+            <div className="space-y-1">
+              <Label className="text-xs">远程目录</Label>
+              <Input
+                value={value.deployRemotePath}
+                onChange={(e) => onChange({ deployRemotePath: e.target.value })}
+                placeholder="/opt/apps/my-app"
+                className="h-8 text-xs font-mono dg-input"
+              />
+            </div>
+            <div className="space-y-1">
+              <Label className="text-xs">部署命令</Label>
+              <Input
+                value={value.deployScript}
+                onChange={(e) => onChange({ deployScript: e.target.value })}
+                placeholder="./restart.sh"
+                className="h-8 text-xs font-mono dg-input"
+              />
+            </div>
+          </div>
+        </div>
+      ) : (
+        <div className="space-y-2">
+          <div className="grid grid-cols-2 gap-2">
+            <div className="space-y-1">
+              <Label className="text-xs">
+                Kubernetes 集群
+                {requireTarget && <span className="text-[var(--dg-red)] ml-0.5">*</span>}
+              </Label>
+              <Select
+                value={value.k8sClusterId ? String(value.k8sClusterId) : '__none'}
+                onValueChange={(v) => onChange({
+                  k8sClusterId: v === '__none' ? '' : Number(v),
+                  k8sNamespace: '',
+                  k8sDeployment: '',
+                })}
+              >
+                <SelectTrigger className="h-8 text-xs dg-input">
+                  <SelectValue placeholder="选择集群" />
+                </SelectTrigger>
+                <SelectContent>
+                  <SelectItem value="__none">请选择</SelectItem>
+                  {clusters.map((c) => (
+                    <SelectItem key={c.id} value={String(c.id)}>{c.name}</SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+            </div>
+            <div className="space-y-1">
+              <Label className="text-xs">已选 Deployment</Label>
+              <Input
+                readOnly
+                value={value.k8sDeployment ? `${value.k8sNamespace}/${value.k8sDeployment}` : ''}
+                placeholder="从下方列表选择"
+                className="h-8 text-xs dg-input font-mono"
+              />
+            </div>
+          </div>
+          {selectedCluster && (
+            <>
+              <div className="relative">
+                <Search className="absolute left-2.5 top-1/2 -translate-y-1/2 h-3.5 w-3.5 text-[var(--dg-text-muted)]" />
+                <Input
+                  value={depSearch}
+                  onChange={(e) => setDepSearch(e.target.value)}
+                  placeholder="搜索 Deployment 或命名空间"
+                  className="pl-8 h-8 text-xs dg-input"
+                />
+              </div>
+              <ScrollArea className="h-[140px] rounded-lg border border-[var(--dg-border)] bg-[var(--dg-bg-secondary)]">
+                {loadingDeps ? (
+                  <div className="flex items-center justify-center py-8 text-xs text-[var(--dg-text-muted)]">
+                    <Loader2 className="h-4 w-4 animate-spin mr-1.5" />加载 Deployment
+                  </div>
+                ) : filteredDeployments.length === 0 ? (
+                  <p className="text-xs text-[var(--dg-text-muted)] text-center py-8">暂无 Deployment</p>
+                ) : (
+                  <div className="p-1.5 space-y-1">
+                    {filteredDeployments.map((dep) => {
+                      const selected = value.k8sDeployment === dep.name && value.k8sNamespace === dep.namespace;
+                      return (
+                        <button
+                          key={`${dep.namespace}/${dep.name}`}
+                          type="button"
+                          onClick={() => selectDeployment(dep)}
+                          className={cn(
+                            'w-full flex items-center gap-2 px-2.5 py-2 rounded-md text-left text-xs transition-colors',
+                            selected
+                              ? 'bg-[var(--dg-bg-hover)] border border-[var(--dg-border)]'
+                              : 'hover:bg-[var(--dg-bg-hover)]/60',
+                          )}
+                        >
+                          <Network className="h-3.5 w-3.5 text-[var(--dg-text-muted)] shrink-0" />
+                          <span className="font-mono text-[var(--dg-text-primary)] truncate">
+                            {dep.namespace}/{dep.name}
+                          </span>
+                          <span className="text-[var(--dg-text-muted)] ml-auto shrink-0">
+                            {dep.ready_replicas ?? 0}/{dep.replicas ?? 0}
+                          </span>
+                        </button>
+                      );
+                    })}
+                  </div>
+                )}
+              </ScrollArea>
+              <div className="space-y-1">
+                <Label className="text-xs">容器名 <span className="text-[var(--dg-text-muted)]">(多容器时填写)</span></Label>
+                <Input
+                  value={value.k8sContainerName}
+                  onChange={(e) => onChange({ k8sContainerName: e.target.value })}
+                  placeholder="默认首个容器"
+                  className="h-8 text-xs font-mono dg-input"
+                />
+              </div>
+              {value.k8sDeployment && selectedCluster && (
+                <p className="text-[10px] text-[var(--dg-text-muted)] leading-relaxed">
+                  流水线部署将调用 CI 接口：
+                  <code className="text-[var(--dg-text-secondary)] break-all">
+                    POST {getPublicApiBase()}/kubernetes/{selectedCluster.code}/namespace/{value.k8sNamespace}/deployments/{value.k8sDeployment}/update-image
+                  </code>
+                </p>
+              )}
+            </>
+          )}
+        </div>
+      )}
+    </div>
+  );
+}

frontend/src/components/deploy/pipeline-manager/PipelineCard.tsx

@@ -56,6 +56,14 @@ export function PipelineCard({
   const registry = pipeline.registry as Record<string, unknown> | undefined;
   const environment = pipeline.environment as Record<string, unknown> | undefined;
   const code = (pipeline.code || pipeline.id) as string;
+  const deployTarget = String(pipeline.deploy_target || 'ssh');
+  let serverCount = 0;
+  try {
+    const ids = pipeline.server_ids ? JSON.parse(String(pipeline.server_ids)) : [];
+    serverCount = Array.isArray(ids) ? ids.length : 0;
+  } catch { /* ignore */ }
+  const k8sDep = pipeline.k8s_deployment ? String(pipeline.k8s_deployment) : '';
+  const k8sNs = pipeline.k8s_namespace ? String(pipeline.k8s_namespace) : '';
 
   return (
     <Card className="bg-[var(--dg-bg-secondary)] border-[var(--dg-border)] overflow-hidden">
@@ -82,6 +90,11 @@ export function PipelineCard({
                 {pipeline.job_name && (
                   <Badge variant="secondary" className="text-xs font-mono opacity-60">{String(pipeline.job_name)}</Badge>
                 )}
+                {pipeline.build_node_id && (
+                  <Badge variant="outline" className="text-[10px] gap-1">
+                    <Server className="h-3 w-3" />指定节点
+                  </Badge>
+                )}
               </div>
               <p className="text-xs text-[var(--dg-text-secondary)] mt-1 line-clamp-1">
                 {String(pipeline.description || '暂无描述')}
@@ -124,10 +137,16 @@ export function PipelineCard({
                   {pipeline.deploy_mode === 'tag' ? 'Tag发版' : String(pipeline.branch || 'main')}
                 </span>
                 <span className="flex items-center gap-1">
-                  {(pipeline.deploy_target || 'ssh') === 'k8s' ? (
-                    <><Network className="h-3 w-3" />Kubernetes</>
+                  {deployTarget === 'k8s' ? (
+                    <>
+                      <Network className="h-3 w-3" />
+                      {k8sDep ? `${k8sNs}/${k8sDep}` : 'Kubernetes Deployment'}
+                    </>
                   ) : (
-                    <><Server className="h-3 w-3" />SSH 主机</>
+                    <>
+                      <Server className="h-3 w-3" />
+                      {serverCount > 0 ? `${serverCount} 台主机` : 'SSH 主机'}
+                    </>
                   )}
                 </span>
                 {repo && <span className="flex items-center gap-1"><Globe className="h-3 w-3" />{String(repo.name)}</span>}
@@ -180,8 +199,20 @@ export function PipelineCard({
                 const isSuccess = runStatus === 'success' || runStatus === 'completed';
                 const isRunning = runStatus === 'running' || runStatus === 'in_progress';
                 const isFailed = runStatus === 'failed' || runStatus === 'error';
-                const color = isFailed ? '#EF4444' : isRunning ? '#3B82F6' : isSuccess ? '#10B981' : '#6B7280';
-                const bgColor = isFailed ? '#EF444428' : isRunning ? '#3B82F628' : isSuccess ? '#10B98128' : '#6B728018';
+                const color = isFailed
+                  ? 'var(--dg-red)'
+                  : isRunning
+                    ? 'var(--dg-blue)'
+                    : isSuccess
+                      ? 'var(--dg-green)'
+                      : 'var(--dg-text-muted)';
+                const bgColor = isFailed
+                  ? 'color-mix(in srgb, var(--dg-red) 12%, transparent)'
+                  : isRunning
+                    ? 'color-mix(in srgb, var(--dg-blue) 12%, transparent)'
+                    : isSuccess
+                      ? 'color-mix(in srgb, var(--dg-green) 12%, transparent)'
+                      : 'var(--dg-bg-tertiary)';
                 const icon = isFailed ? (
                   <XCircle className="h-3 w-3" />
                 ) : isRunning ? (
@@ -197,7 +228,7 @@ export function PipelineCard({
                       className="flex items-center gap-1.5 px-2.5 py-1.5 text-[11px] font-semibold border shadow-sm"
                       style={{
                         backgroundColor: bgColor,
-                        borderColor: `${color}70`,
+                        borderColor: 'var(--dg-border)',
                         color,
                         borderRadius: i === 0 ? '8px 0 0 8px' : i === stages.length - 1 ? '0 8px 8px 0' : '0',
                       }}

frontend/src/components/deploy/pipeline-manager/PipelineCreateDialog.tsx

@@ -1,28 +1,36 @@
 import { useState, useEffect, useCallback } from 'react';
+import { useTranslation } from 'react-i18next';
 import { Button } from '@/components/ui/button';
 import { Input } from '@/components/ui/input';
 import { Badge } from '@/components/ui/badge';
-import { Dialog, DialogContent, DialogHeader, DialogTitle } from '@/components/ui/dialog';
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog';
 import { Textarea } from '@/components/ui/textarea';
 import { Label } from '@/components/ui/label';
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select';
+import { Collapsible, CollapsibleContent, CollapsibleTrigger } from '@/components/ui/collapsible';
 import {
   Rocket,
   Plus,
   GitBranch,
-  Tag,
-  Server,
-  Network,
   Globe,
   Container,
   Loader2,
   Trash2,
-  ChevronRight as ChevronRightSmall,
+  ChevronDown,
+  Settings2,
 } from 'lucide-react';
-import { credentialApi, deployApi, pipelineApi } from '@/api';
+import { buildNodeApi, credentialApi, deployApi, pipelineApi, type BuildNode } from '@/api';
 import { toast } from 'sonner';
+import { cn } from '@/lib/utils';
 import { nameToCode } from '../pipeline-helpers';
 import { STAGE_DEFS } from './constants';
+import { DeployTargetFields, type DeployTargetValue } from './DeployTargetFields';
 
 interface PipelineCreateDialogProps {
   open: boolean;
@@ -30,45 +38,79 @@ interface PipelineCreateDialogProps {
   onCreated: () => void;
 }
 
-// 新建流水线对话框（含表单状态） // Logan.Li
+const PRESETS = [
+  {
+    key: 'ssh',
+    label: '主机发布',
+    desc: 'SCP 上传构建产物到关联主机',
+    stages: ['checkout', 'build', 'deploy'],
+    deployTarget: 'ssh' as const,
+  },
+  {
+    key: 'k8s',
+    label: 'Kubernetes 发布',
+    desc: '镜像打包后 CI 更新 Deployment',
+    stages: ['checkout', 'build', 'image', 'deploy'],
+    deployTarget: 'k8s' as const,
+  },
+];
+
+const DEFAULT_TARGET: DeployTargetValue = {
+  deployTarget: 'ssh',
+  serverIds: [],
+  deployRemotePath: '',
+  deployScript: '',
+  k8sClusterId: '',
+  k8sNamespace: '',
+  k8sDeployment: '',
+  k8sContainerName: '',
+};
+
+// 新建流水线对话框 — 精简分步 + 双发布目标 // Logan.Li
 export function PipelineCreateDialog({ open, onOpenChange, onCreated }: PipelineCreateDialogProps) {
+  const { t } = useTranslation();
+  const [step, setStep] = useState<1 | 2>(1);
+  const [preset, setPreset] = useState('ssh');
   const [newName, setNewName] = useState('');
-  const [newJobName, setNewJobName] = useState('');
   const [newDesc, setNewDesc] = useState('');
   const [newSource, setNewSource] = useState('');
   const [newBranch, setNewBranch] = useState('main');
   const [newDockerfile, setNewDockerfile] = useState('');
-  const [selectedStages, setSelectedStages] = useState<string[]>(['checkout', 'build', 'image', 'deploy']);
-  const [newDeployMode, setNewDeployMode] = useState('branch');
-  const [newDeployTarget, setNewDeployTarget] = useState('ssh');
+  const [selectedStages, setSelectedStages] = useState<string[]>(['checkout', 'build', 'deploy']);
+  const [deployTarget, setDeployTarget] = useState<DeployTargetValue>(DEFAULT_TARGET);
   const [newEnvironmentId, setNewEnvironmentId] = useState<number | string>('');
   const [saving, setSaving] = useState(false);
+  const [advancedOpen, setAdvancedOpen] = useState(false);
 
   const [gitCredentials, setGitCredentials] = useState<Record<string, unknown>[]>([]);
   const [dockerCredentials, setDockerCredentials] = useState<Record<string, unknown>[]>([]);
   const [newGitCredentialId, setNewGitCredentialId] = useState<number | string>('');
   const [newRegistryCredentialId, setNewRegistryCredentialId] = useState<number | string>('');
 
+  const [newJobName, setNewJobName] = useState('');
   const [newTriggerMode, setNewTriggerMode] = useState('manual');
   const [newWatchBranches, setNewWatchBranches] = useState('');
-  const [newExcludeBranch, setNewExcludeBranch] = useState('');
   const [newCronExpr, setNewCronExpr] = useState('');
-  const [newWebhookToken, setNewWebhookToken] = useState('');
-  const [newEnvVars, setNewEnvVars] = useState<{ key: string; value: string; desc: string }[]>([]);
-  const [newCachePaths, setNewCachePaths] = useState('');
-  const [newMaxExecutors, setNewMaxExecutors] = useState(2);
+  const [newEnvVars, setNewEnvVars] = useState<{ key: string; value: string }[]>([]);
   const [environments, setEnvironments] = useState<Record<string, unknown>[]>([]);
+  const [buildNodes, setBuildNodes] = useState<BuildNode[]>([]);
+  const [buildNodeId, setBuildNodeId] = useState('');
 
   const loadRefs = useCallback(async () => {
     try {
-      const [rEnv, rCred] = await Promise.all([
+      const [rEnv, rCred, rNodes] = await Promise.all([
         deployApi.getEnvironments().catch(() => ({ list: [] })),
         credentialApi.list({ page_size: 100 }).catch(() => ({ list: [] })),
+        buildNodeApi.list().catch(() => ({ list: [] })),
       ] as const);
-      setEnvironments(Array.isArray((rEnv as Record<string, unknown>)?.list) ? (rEnv as Record<string, unknown>).list as Record<string, unknown>[] : []);
+      setEnvironments(Array.isArray((rEnv as Record<string, unknown>)?.list)
+        ? (rEnv as Record<string, unknown>).list as Record<string, unknown>[]
+        : []);
       const allCreds: Record<string, unknown>[] = (rCred as Record<string, unknown>)?.list as Record<string, unknown>[] || [];
       setGitCredentials(allCreds.filter((c) => c.secret_type === 'api'));
       setDockerCredentials(allCreds.filter((c) => c.secret_type === 'docker'));
+      const nodeData = rNodes as { list?: BuildNode[] };
+      setBuildNodes(Array.isArray(nodeData?.list) ? nodeData.list.filter((n) => n.enabled) : []);
     } catch { /* silent */ }
   }, []);
 
@@ -76,33 +118,71 @@ export function PipelineCreateDialog({ open, onOpenChange, onCreated }: Pipeline
     if (open) loadRefs();
   }, [open, loadRefs]);
 
+  const applyPreset = (key: string) => {
+    const p = PRESETS.find((x) => x.key === key);
+    if (!p) return;
+    setPreset(key);
+    setSelectedStages(p.stages);
+    setDeployTarget({
+      ...DEFAULT_TARGET,
+      deployTarget: p.deployTarget,
+    });
+  };
+
   const resetForm = () => {
+    setStep(1);
+    setPreset('ssh');
     setNewName('');
-    setNewJobName('');
     setNewDesc('');
     setNewSource('');
     setNewBranch('main');
     setNewDockerfile('');
-    setSelectedStages(['checkout', 'build', 'image', 'deploy']);
-    setNewDeployMode('branch');
-    setNewDeployTarget('ssh');
+    setSelectedStages(['checkout', 'build', 'deploy']);
+    setDeployTarget(DEFAULT_TARGET);
     setNewEnvironmentId('');
     setNewGitCredentialId('');
     setNewRegistryCredentialId('');
+    setNewJobName('');
     setNewTriggerMode('manual');
     setNewWatchBranches('');
-    setNewExcludeBranch('');
     setNewCronExpr('');
-    setNewWebhookToken('');
     setNewEnvVars([]);
-    setNewCachePaths('');
-    setNewMaxExecutors(2);
+    setAdvancedOpen(false);
+    setBuildNodeId('');
+  };
+
+  const validateStep1 = () => {
+    if (!newName.trim()) {
+      toast.error('请输入流水线名称');
+      return false;
+    }
+    return true;
+  };
+
+  const validateStep2 = () => {
+    if (selectedStages.includes('checkout') && !newSource.trim()) {
+      toast.error(t('deploy.stage.checkoutNeedGit'));
+      return false;
+    }
+    if (selectedStages.includes('image') && !newRegistryCredentialId) {
+      toast.error(t('deploy.stage.imageNeedDocker'));
+      return false;
+    }
+    if (selectedStages.includes('deploy')) {
+      if (deployTarget.deployTarget === 'ssh' && deployTarget.serverIds.length === 0) {
+        toast.error('主机发布需至少关联一台主机');
+        return false;
+      }
+      if (deployTarget.deployTarget === 'k8s' && (!deployTarget.k8sClusterId || !deployTarget.k8sDeployment)) {
+        toast.error('Kubernetes 发布需选择集群与 Deployment');
+        return false;
+      }
+    }
+    return true;
   };
 
   const handleCreate = async () => {
-    if (!newName.trim()) { toast.error('请输入流水线名称'); return; }
-    if (selectedStages.includes('checkout') && !newSource.trim()) { toast.error('代码检出阶段需要填写 Git URL'); return; }
-    if (selectedStages.includes('image') && !newRegistryCredentialId) { toast.error('镜像打包阶段需要关联 Docker 凭证'); return; }
+    if (!validateStep1() || !validateStep2()) return;
     setSaving(true);
     try {
       const stageNames = selectedStages.map((k) => STAGE_DEFS.find((s) => s.key === k)?.label || k);
@@ -122,381 +202,358 @@ export function PipelineCreateDialog({ open, onOpenChange, onCreated }: Pipeline
         dockerfile: newDockerfile,
         type: 'deploy',
         stages,
-        deploy_mode: newDeployMode,
-        deploy_target: newDeployTarget,
+        deploy_mode: 'branch',
+        deploy_target: deployTarget.deployTarget,
+        server_ids: deployTarget.serverIds.length > 0 ? JSON.stringify(deployTarget.serverIds) : undefined,
+        deploy_remote_path: deployTarget.deployRemotePath || undefined,
+        deploy_script: deployTarget.deployScript || undefined,
+        k8s_cluster_id: deployTarget.k8sClusterId ? Number(deployTarget.k8sClusterId) : null,
+        k8s_namespace: deployTarget.k8sNamespace || undefined,
+        k8s_deployment: deployTarget.k8sDeployment || undefined,
+        k8s_container_name: deployTarget.k8sContainerName || undefined,
         environment_id: newEnvironmentId ? Number(newEnvironmentId) : null,
-        repo_id: null,
-        registry_id: null,
         git_credential_id: newGitCredentialId ? Number(newGitCredentialId) : null,
         registry_credential_id: newRegistryCredentialId ? Number(newRegistryCredentialId) : null,
         trigger_mode: newTriggerMode,
         watch_branches: newWatchBranches || undefined,
-        exclude_branch: newExcludeBranch || undefined,
         cron_expr: newCronExpr || undefined,
-        webhook_token: newWebhookToken || undefined,
         variables: newEnvVars.length > 0 ? JSON.stringify(newEnvVars) : undefined,
-        cache_paths: newCachePaths || undefined,
-        max_executors: newMaxExecutors,
+        build_node_id: buildNodeId ? Number(buildNodeId) : null,
       });
-      toast.success('流水线已创建');
+      toast.success(t('deploy.pipeline.created'));
       onOpenChange(false);
       resetForm();
       onCreated();
     } catch {
-      toast.error('创建失败');
+      toast.error(t('deploy.pipeline.createFailed'));
     } finally {
       setSaving(false);
     }
   };
 
-  return (
-    <Dialog open={open} onOpenChange={onOpenChange}>
-      <DialogContent className="max-w-2xl max-h-[85vh] overflow-y-auto bg-[var(--dg-bg-primary)] border-[var(--dg-border)] text-[var(--dg-text-primary)]">
-        <DialogHeader>
-          <DialogTitle className="flex items-center gap-2"><Rocket className="h-5 w-5" />新建流水线</DialogTitle>
-        </DialogHeader>
-        <div className="space-y-4">
-          <div className="grid grid-cols-2 gap-3">
-            <div className="space-y-1">
-              <Label>名称 <span className="dg-text-red">*</span></Label>
-              <Input value={newName} onChange={(e) => setNewName(e.target.value)} placeholder="例如: demo-jar 后端部署" className="bg-[var(--dg-bg-secondary)] border-[var(--dg-border)] h-9" />
-            </div>
-            <div className="space-y-1">
-              <Label>Job 名称 <span className="text-xs text-[var(--dg-text-secondary)]">(Webhook URL)</span></Label>
-              <Input value={newJobName} onChange={(e) => setNewJobName(e.target.value)} placeholder="cex-admin-server" className="bg-[var(--dg-bg-secondary)] border-[var(--dg-border)] h-9 font-mono text-sm" />
-              {newJobName && <p className="text-[10px] text-[var(--dg-text-secondary)] opacity-60">Webhook: POST .../webhook/job/<b>{newJobName}</b></p>}
-            </div>
-          </div>
-          <div className="space-y-1">
-            <Label>描述</Label>
-            <Textarea value={newDesc} onChange={(e) => setNewDesc(e.target.value)} placeholder="流水线描述..." rows={2} className="bg-[var(--dg-bg-secondary)] border-[var(--dg-border)]" />
-          </div>
+  const toggleStage = (key: string) => {
+    setSelectedStages((prev) => (
+      prev.includes(key) ? prev.filter((k) => k !== key) : [...prev, key]
+    ));
+  };
 
-          <div className="grid grid-cols-3 gap-3">
-            <div className="space-y-1">
-              <Label>部署模式</Label>
-              <div className="flex gap-1 bg-[var(--dg-bg-secondary)] rounded-lg p-1 border border-[var(--dg-border)]">
-                {[
-                  { key: 'branch', label: '分支', icon: GitBranch },
-                  { key: 'tag', label: 'Tag 发版', icon: Tag },
-                ].map((m) => {
-                  const active = newDeployMode === m.key;
-                  return (
-                    <button
-                      key={m.key}
-                      onClick={() => setNewDeployMode(m.key)}
-                      className={`flex-1 flex items-center justify-center gap-1 px-2 py-1.5 rounded-md text-xs font-medium transition-all ${
-                        active ? 'bg-blue-500 text-white' : 'text-[var(--dg-text-secondary)] hover:text-[var(--dg-text-primary)]'
-                      }`}
-                    >
-                      <m.icon className="h-3.5 w-3.5" />{m.label}
-                    </button>
-                  );
-                })}
-              </div>
+  return (
+    <Dialog open={open} onOpenChange={(v) => { if (!v) resetForm(); onOpenChange(v); }}>
+      <DialogContent className="max-w-lg max-h-[88vh] overflow-y-auto bg-[var(--dg-bg-primary)] border-[var(--dg-border)]">
+        <DialogHeader>
+          <DialogTitle className="text-[var(--dg-text-primary)]">新建流水线</DialogTitle>
+          <DialogDescription className="text-[var(--dg-text-muted)]">
+            选择发布方式，关联主机或 Kubernetes Deployment，创建后可继续编辑阶段脚本
+          </DialogDescription>
+        </DialogHeader>
+
+        {/* 步骤指示 */}
+        <div className="flex items-center gap-2 text-xs">
+          <button
+            type="button"
+            onClick={() => setStep(1)}
+            className={cn(
+              'px-2.5 py-1 rounded-md transition-colors',
+              step === 1 ? 'bg-[var(--dg-bg-hover)] text-[var(--dg-text-primary)]' : 'text-[var(--dg-text-muted)]',
+            )}
+          >
+            1. 基础
+          </button>
+          <span className="text-[var(--dg-border)]">/</span>
+          <button
+            type="button"
+            onClick={() => { if (validateStep1()) setStep(2); }}
+            className={cn(
+              'px-2.5 py-1 rounded-md transition-colors',
+              step === 2 ? 'bg-[var(--dg-bg-hover)] text-[var(--dg-text-primary)]' : 'text-[var(--dg-text-muted)]',
+            )}
+          >
+            2. 代码与发布
+          </button>
+        </div>
+
+        {step === 1 ? (
+          <div className="space-y-4">
+            <div className="grid grid-cols-2 gap-2">
+              {PRESETS.map((p) => (
+                <button
+                  key={p.key}
+                  type="button"
+                  onClick={() => applyPreset(p.key)}
+                  className={cn(
+                    'p-3 rounded-lg border text-left transition-colors',
+                    preset === p.key
+                      ? 'border-[var(--dg-blue)] bg-[color-mix(in_srgb,var(--dg-blue)_8%,transparent)]'
+                      : 'border-[var(--dg-border)] hover:bg-[var(--dg-bg-hover)]',
+                  )}
+                >
+                  <div className="text-sm font-medium text-[var(--dg-text-primary)]">{p.label}</div>
+                  <div className="text-[11px] text-[var(--dg-text-muted)] mt-0.5">{p.desc}</div>
+                </button>
+              ))}
             </div>
-            <div className="space-y-1">
-              <Label>部署目标</Label>
-              <div className="flex gap-1 bg-[var(--dg-bg-secondary)] rounded-lg p-1 border border-[var(--dg-border)]">
-                {[
-                  { key: 'ssh', label: 'SSH 主机', icon: Server },
-                  { key: 'k8s', label: 'Kubernetes 集群', icon: Network },
-                ].map((t) => {
-                  const active = newDeployTarget === t.key;
-                  return (
-                    <button
-                      key={t.key}
-                      onClick={() => setNewDeployTarget(t.key)}
-                      className={`flex-1 flex items-center justify-center gap-1 px-2 py-1.5 rounded-md text-xs font-medium transition-all ${
-                        active ? 'bg-green-500 text-white' : 'text-[var(--dg-text-secondary)] hover:text-[var(--dg-text-primary)]'
-                      }`}
-                    >
-                      <t.icon className="h-3.5 w-3.5" />{t.label}
-                    </button>
-                  );
-                })}
-              </div>
+
+            <div className="space-y-1.5">
+              <Label className="text-xs">名称 <span className="text-[var(--dg-red)]">*</span></Label>
+              <Input
+                value={newName}
+                onChange={(e) => setNewName(e.target.value)}
+                placeholder="例如 demo-api"
+                className="h-9 dg-input"
+              />
             </div>
-            <div className="space-y-1">
-              <Label>环境分组</Label>
-              <Select value={String(newEnvironmentId)} onValueChange={(v) => setNewEnvironmentId(v === '__none' ? '' : v)}>
-                <SelectTrigger className="bg-[var(--dg-bg-secondary)] border-[var(--dg-border)] h-9"><SelectValue placeholder="选择环境" /></SelectTrigger>
+
+            <div className="space-y-1.5">
+              <Label className="text-xs">描述</Label>
+              <Textarea
+                value={newDesc}
+                onChange={(e) => setNewDesc(e.target.value)}
+                placeholder="可选"
+                rows={2}
+                className="dg-input text-sm"
+              />
+            </div>
+
+            <div className="space-y-1.5">
+              <Label className="text-xs">环境分组</Label>
+              <Select
+                value={String(newEnvironmentId)}
+                onValueChange={(v) => setNewEnvironmentId(v === '__none' ? '' : v)}
+              >
+                <SelectTrigger className="h-9 dg-input"><SelectValue placeholder="选择环境" /></SelectTrigger>
                 <SelectContent>
                   <SelectItem value="__none">不指定</SelectItem>
                   {environments.map((env) => (
                     <SelectItem key={env.id as number} value={String(env.id)}>
-                      <span className="flex items-center gap-1.5">
-                        <span className="w-2 h-2 rounded-full inline-block" style={{ backgroundColor: env.color as string }} />
-                        {String(env.display_name)}
-                      </span>
+                      {String(env.display_name)}
                     </SelectItem>
                   ))}
                 </SelectContent>
               </Select>
             </div>
-          </div>
 
-          <div className="grid grid-cols-2 gap-3">
-            <div className="space-y-1">
-              <Label>Git URL {selectedStages.includes('checkout') && <span className="dg-text-red">*</span>}</Label>
-              <Input value={newSource} onChange={(e) => setNewSource(e.target.value)} placeholder="https://gitee.com/user/repo.git" className="bg-[var(--dg-bg-secondary)] border-[var(--dg-border)] h-9 font-mono text-xs" />
-            </div>
-            <div className="space-y-1">
-              <Label>分支 / Tag</Label>
-              <Input value={newBranch} onChange={(e) => setNewBranch(e.target.value)} placeholder={newDeployMode === 'tag' ? 'v1.0.0' : 'main'} className="bg-[var(--dg-bg-secondary)] border-[var(--dg-border)] h-9" />
-            </div>
-            <div className="space-y-1">
-              <Label>Git 凭证 <span className="text-xs text-[var(--dg-text-secondary)] opacity-60">(API Token)</span></Label>
-              <Select value={String(newGitCredentialId)} onValueChange={(v) => setNewGitCredentialId(v === '__none' ? '' : v)}>
-                <SelectTrigger className="bg-[var(--dg-bg-secondary)] border-[var(--dg-border)] h-9"><SelectValue placeholder="选择凭证" /></SelectTrigger>
-                <SelectContent>
-                  <SelectItem value="__none">不关联</SelectItem>
-                  {gitCredentials.map((c) => (
-                    <SelectItem key={c.id as number} value={String(c.id)}>
-                      <span className="flex items-center gap-1.5">
-                        <Globe className="h-3 w-3 opacity-60" />{String(c.name)} {c.summary && <span className="text-[10px] opacity-50">({String(c.summary)})</span>}
-                      </span>
-                    </SelectItem>
-                  ))}
-                </SelectContent>
-              </Select>
-              {!newGitCredentialId && selectedStages.includes('checkout') && <p className="text-xs dg-text-yellow">建议关联凭证</p>}
-            </div>
-            <div className="space-y-1">
-              <Label>镜像仓库凭证 {selectedStages.includes('image') && <span className="dg-text-red">*</span>}</Label>
-              <Select value={String(newRegistryCredentialId)} onValueChange={(v) => setNewRegistryCredentialId(v === '__none' ? '' : v)}>
-                <SelectTrigger className="bg-[var(--dg-bg-secondary)] border-[var(--dg-border)] h-9"><SelectValue placeholder="选择 Docker 凭证" /></SelectTrigger>
-                <SelectContent>
-                  <SelectItem value="__none">不关联</SelectItem>
-                  {dockerCredentials.map((c) => (
-                    <SelectItem key={c.id as number} value={String(c.id)}>
-                      <span className="flex items-center gap-1.5">
-                        <Container className="h-3 w-3 opacity-60" />{String(c.name)} {c.summary && <span className="text-[10px] opacity-50">({String(c.summary)})</span>}
-                      </span>
-                    </SelectItem>
-                  ))}
-                </SelectContent>
-              </Select>
-              {!newRegistryCredentialId && selectedStages.includes('image') && <p className="text-xs dg-text-yellow">需要关联 Docker 凭证</p>}
+            <div className="flex justify-end gap-2 pt-2">
+              <Button variant="outline" onClick={() => onOpenChange(false)}>取消</Button>
+              <Button onClick={() => { if (validateStep1()) setStep(2); }}>下一步</Button>
             </div>
           </div>
+        ) : (
+          <div className="space-y-4">
+            <DeployTargetFields
+              value={deployTarget}
+              onChange={(patch) => setDeployTarget((prev) => ({ ...prev, ...patch }))}
+              requireTarget={selectedStages.includes('deploy')}
+            />
 
-          {newRegistryCredentialId && newJobName && (
-            <div className="p-2.5 rounded-md bg-blue-500/5 border border-blue-500/20 text-xs text-[var(--dg-text-secondary)]">
-              <span className="dg-text-blue">镜像命名：</span>
-              <code className="text-[var(--dg-text-primary)]">{'{registry}'}/{'{namespace}'}/{'{'}{'{JOB_BASE_NAME}'}{'}'}:{'{'}{'{tag}'}{'}'}</code>
-              <span className="ml-2 opacity-60">例：</span>
-              <code className="opacity-60">harbor.ast1001.com/test/{newJobName}:latest</code>
+            <div className="grid grid-cols-2 gap-2">
+              <div className="space-y-1.5">
+                <Label className="text-xs">
+                  Git 仓库 {selectedStages.includes('checkout') && <span className="text-[var(--dg-red)]">*</span>}
+                </Label>
+                <Input
+                  value={newSource}
+                  onChange={(e) => setNewSource(e.target.value)}
+                  placeholder="https://gitee.com/user/repo.git"
+                  className="h-8 text-xs font-mono dg-input"
+                />
+              </div>
+              <div className="space-y-1.5">
+                <Label className="text-xs">分支</Label>
+                <Input value={newBranch} onChange={(e) => setNewBranch(e.target.value)} className="h-8 text-xs dg-input" />
+              </div>
             </div>
-          )}
-          <div className="space-y-1">
-            <Label>Dockerfile 路径</Label>
-            <Input value={newDockerfile} onChange={(e) => setNewDockerfile(e.target.value)} placeholder="jar/Dockerfile" className="bg-[var(--dg-bg-secondary)] border-[var(--dg-border)] h-9 font-mono text-xs" />
-          </div>
 
-          <div className="space-y-2">
-            <Label>发布流程 <span className="text-xs text-[var(--dg-text-secondary)] opacity-70 ml-1">按顺序选择阶段</span></Label>
-            <div className="flex flex-wrap gap-2">
-              {STAGE_DEFS.map((def) => {
-                const active = selectedStages.includes(def.key);
-                return (
-                  <Badge
-                    key={def.key}
-                    className={`cursor-pointer transition-all text-xs px-3 py-1.5 ${active ? 'border-current' : 'border-[var(--dg-border)] opacity-50 hover:opacity-80'}`}
-                    style={active ? { backgroundColor: `${def.color}20`, color: def.color, borderColor: def.color } : {}}
-                    onClick={() => setSelectedStages(active ? selectedStages.filter((t) => t !== def.key) : [...selectedStages, def.key])}
-                    title={def.desc}
-                  >
-                    <def.icon className="h-3 w-3 mr-1" />{def.label} {def.needs.includes('repo') ? '🔗' : ''}{def.needs.includes('registry') ? '📦' : ''}
-                  </Badge>
-                );
-              })}
+            <div className="grid grid-cols-2 gap-2">
+              <div className="space-y-1.5">
+                <Label className="text-xs">Git 凭证</Label>
+                <Select value={String(newGitCredentialId)} onValueChange={(v) => setNewGitCredentialId(v === '__none' ? '' : v)}>
+                  <SelectTrigger className="h-8 text-xs dg-input"><SelectValue placeholder="选择凭证" /></SelectTrigger>
+                  <SelectContent>
+                    <SelectItem value="__none">不关联</SelectItem>
+                    {gitCredentials.map((c) => (
+                      <SelectItem key={c.id as number} value={String(c.id)}>
+                        <span className="flex items-center gap-1"><Globe className="h-3 w-3" />{String(c.name)}</span>
+                      </SelectItem>
+                    ))}
+                  </SelectContent>
+                </Select>
+              </div>
+              {selectedStages.includes('image') && (
+                <div className="space-y-1.5">
+                  <Label className="text-xs">镜像凭证 <span className="text-[var(--dg-red)]">*</span></Label>
+                  <Select value={String(newRegistryCredentialId)} onValueChange={(v) => setNewRegistryCredentialId(v === '__none' ? '' : v)}>
+                    <SelectTrigger className="h-8 text-xs dg-input"><SelectValue placeholder="Docker 凭证" /></SelectTrigger>
+                    <SelectContent>
+                      <SelectItem value="__none">不关联</SelectItem>
+                      {dockerCredentials.map((c) => (
+                        <SelectItem key={c.id as number} value={String(c.id)}>
+                          <span className="flex items-center gap-1"><Container className="h-3 w-3" />{String(c.name)}</span>
+                        </SelectItem>
+                      ))}
+                    </SelectContent>
+                  </Select>
+                </div>
+              )}
             </div>
-            {selectedStages.length > 0 && (
-              <div className="flex items-center mt-2">
-                {selectedStages.map((key, i) => {
-                  const def = STAGE_DEFS.find((t) => t.key === key)!;
+
+            {deployTarget.deployTarget === 'k8s' && (
+              <div className="space-y-1.5">
+                <Label className="text-xs">Dockerfile 路径</Label>
+                <Input
+                  value={newDockerfile}
+                  onChange={(e) => setNewDockerfile(e.target.value)}
+                  placeholder="Dockerfile"
+                  className="h-8 text-xs font-mono dg-input"
+                />
+              </div>
+            )}
+
+            <div className="space-y-1.5">
+              <Label className="text-xs">CI 阶段</Label>
+              <div className="flex flex-wrap gap-1.5">
+                {STAGE_DEFS.map((def) => {
+                  const active = selectedStages.includes(def.key);
                   return (
-                    <div key={i} className="flex items-center">
-                      <div
-                        className="flex items-center gap-1 px-2 py-1 text-[11px] font-medium border"
-                        style={{
-                          backgroundColor: `${def.color}20`,
-                          borderColor: `${def.color}40`,
-                          color: def.color,
-                          borderRadius: i === 0 ? '6px 0 0 6px' : i === selectedStages.length - 1 ? '0 6px 6px 0' : '0',
-                        }}
-                      >
-                        <def.icon className="h-3 w-3" />{def.label}
-                      </div>
-                      {i < selectedStages.length - 1 && (
-                        <div className="flex items-center justify-center w-4 h-5 -mx-px z-10">
-                          <ChevronRightSmall className="h-3 w-3" style={{ color: def.color }} />
-                        </div>
-                      )}
-                    </div>
+                    <Badge
+                      key={def.key}
+                      variant={active ? 'default' : 'outline'}
+                      className={cn('cursor-pointer text-xs', !active && 'opacity-50')}
+                      onClick={() => toggleStage(def.key)}
+                    >
+                      <def.icon className="h-3 w-3 mr-1" />
+                      {def.label}
+                    </Badge>
                   );
                 })}
               </div>
-            )}
-          </div>
-
-          <div className="border-t border-[var(--dg-border)] pt-4">
-            <Label className="mb-2 block">触发方式</Label>
-            <div className="flex gap-1 bg-[var(--dg-bg-secondary)] rounded-lg p-1 border border-[var(--dg-border)]">
-              {[
-                { key: 'manual', label: '手动', desc: '手动触发执行' },
-                { key: 'git_push', label: '代码推送', desc: 'Git Push 自动触发' },
-                { key: 'cron', label: '定时', desc: 'Cron 定时执行' },
-                { key: 'webhook', label: 'Webhook', desc: '外部 Webhook 调用' },
-              ].map((t) => {
-                const active = newTriggerMode === t.key;
-                return (
-                  <button
-                    key={t.key}
-                    onClick={() => setNewTriggerMode(t.key)}
-                    className={`flex-1 flex flex-col items-center gap-0.5 px-2 py-2 rounded-md text-xs font-medium transition-all ${
-                      active ? 'bg-blue-500 text-white' : 'text-[var(--dg-text-secondary)] hover:text-[var(--dg-text-primary)]'
-                    }`}
-                    title={t.desc}
-                  >
-                    {t.label}
-                  </button>
-                );
-              })}
-            </div>
-
-            {newTriggerMode === 'git_push' && (
-              <div className="mt-3 space-y-2 p-3 rounded-md bg-[var(--dg-bg-secondary)] border border-[var(--dg-border)]">
-                <div className="space-y-1">
-                  <Label className="text-xs">监听分支 <span className="text-[var(--dg-text-secondary)] opacity-60">(逗号分隔，支持 * 通配)</span></Label>
-                  <Input value={newWatchBranches} onChange={(e) => setNewWatchBranches(e.target.value)} placeholder="release/*, main" className="bg-[var(--dg-bg-tertiary)] border-[var(--dg-border)] h-8 font-mono text-xs" />
-                </div>
-                <div className="space-y-1">
-                  <Label className="text-xs">排除分支 <span className="text-[var(--dg-text-secondary)] opacity-60">(不触发构建)</span></Label>
-                  <Input value={newExcludeBranch} onChange={(e) => setNewExcludeBranch(e.target.value)} placeholder="wip/*, draft/*" className="bg-[var(--dg-bg-tertiary)] border-[var(--dg-border)] h-8 font-mono text-xs" />
-                </div>
-              </div>
-            )}
-
-            {newTriggerMode === 'cron' && (
-              <div className="mt-3 space-y-2 p-3 rounded-md bg-[var(--dg-bg-secondary)] border border-[var(--dg-border)]">
-                <div className="space-y-1">
-                  <Label className="text-xs">Cron 表达式 <span className="text-[var(--dg-text-secondary)] opacity-60">(标准 5 位)</span></Label>
-                  <Input value={newCronExpr} onChange={(e) => setNewCronExpr(e.target.value)} placeholder="0 2 * * *" className="bg-[var(--dg-bg-tertiary)] border-[var(--dg-border)] h-8 font-mono text-xs" />
-                </div>
-                <div className="flex flex-wrap gap-1.5">
-                  {[
-                    { expr: '*/5 * * * *', label: '每5分钟' },
-                    { expr: '0 * * * *', label: '每小时' },
-                    { expr: '0 2 * * *', label: '每天2点' },
-                    { expr: '0 0 * * 0', label: '每周日' },
-                  ].map((c) => (
-                    <Badge key={c.expr} variant="outline" className="cursor-pointer text-[10px] hover:bg-blue-500/10" onClick={() => setNewCronExpr(c.expr)}>
-                      {c.label}
-                    </Badge>
-                  ))}
-                </div>
-              </div>
-            )}
-
-            {newTriggerMode === 'webhook' && (
-              <div className="mt-3 space-y-2 p-3 rounded-md bg-[var(--dg-bg-secondary)] border border-[var(--dg-border)]">
-                <div className="space-y-1">
-                  <Label className="text-xs">Webhook Token <span className="text-[var(--dg-text-secondary)] opacity-60">(签名验证，可选)</span></Label>
-                  <Input value={newWebhookToken} onChange={(e) => setNewWebhookToken(e.target.value)} placeholder="随机字符串" className="bg-[var(--dg-bg-tertiary)] border-[var(--dg-border)] h-8 font-mono text-xs" />
-                </div>
-                <p className="text-[10px] text-[var(--dg-text-secondary)] opacity-60">
-                  Webhook URL: <code className="text-[var(--dg-blue)]">POST /api/v1/webhook/pipeline/{'{code}'}</code>
+              {selectedStages.length > 0 && (
+                <p className="text-[10px] text-[var(--dg-text-muted)] flex items-center gap-1 flex-wrap">
+                  <GitBranch className="h-3 w-3" />
+                  {selectedStages.map((k) => STAGE_DEFS.find((d) => d.key === k)?.label || k).join(' → ')}
                 </p>
-              </div>
-            )}
-          </div>
-
-          <div className="border-t border-[var(--dg-border)] pt-4">
-            <div className="flex items-center justify-between mb-2">
-              <Label>环境变量 <span className="text-xs text-[var(--dg-text-secondary)] opacity-60">(${'{VAR_NAME}'} 引用)</span></Label>
-              <Button variant="ghost" size="sm" className="h-7 text-xs" onClick={() => setNewEnvVars([...newEnvVars, { key: '', value: '', desc: '' }])}>
-                <Plus className="h-3 w-3 mr-1" />添加变量
-              </Button>
+              )}
             </div>
-            {newEnvVars.length === 0 ? (
-              <p className="text-xs text-[var(--dg-text-muted)] py-2">暂无变量，点击&quot;添加变量&quot;新增</p>
-            ) : (
-              <div className="space-y-2">
-                {newEnvVars.map((v, i) => (
-                  <div key={i} className="grid grid-cols-12 gap-2 items-start p-2 rounded-md bg-[var(--dg-bg-secondary)] border border-[var(--dg-border)]">
-                    <Input
-                      value={v.key}
-                      onChange={(e) => {
-                        const nv = [...newEnvVars];
-                        nv[i] = { ...nv[i], key: e.target.value };
-                        setNewEnvVars(nv);
-                      }}
-                      placeholder="变量名"
-                      className="col-span-3 h-8 text-xs font-mono bg-[var(--dg-bg-tertiary)] border-[var(--dg-border)]"
-                    />
-                    <Input
-                      value={v.value}
-                      onChange={(e) => {
-                        const nv = [...newEnvVars];
-                        nv[i] = { ...nv[i], value: e.target.value };
-                        setNewEnvVars(nv);
-                      }}
-                      placeholder="变量值"
-                      className="col-span-4 h-8 text-xs font-mono bg-[var(--dg-bg-tertiary)] border-[var(--dg-border)]"
-                    />
-                    <Input
-                      value={v.desc}
-                      onChange={(e) => {
-                        const nv = [...newEnvVars];
-                        nv[i] = { ...nv[i], desc: e.target.value };
-                        setNewEnvVars(nv);
-                      }}
-                      placeholder="说明"
-                      className="col-span-4 h-8 text-xs bg-[var(--dg-bg-tertiary)] border-[var(--dg-border)]"
-                    />
-                    <Button variant="ghost" size="icon" className="col-span-1 h-8 w-8 dg-text-red" onClick={() => setNewEnvVars(newEnvVars.filter((_, idx) => idx !== i))}>
-                      <Trash2 className="h-3.5 w-3.5" />
+
+            <Collapsible open={advancedOpen} onOpenChange={setAdvancedOpen}>
+              <CollapsibleTrigger asChild>
+                <button
+                  type="button"
+                  className="flex items-center gap-1.5 text-xs text-[var(--dg-text-muted)] hover:text-[var(--dg-text-primary)]"
+                >
+                  <Settings2 className="h-3.5 w-3.5" />
+                  高级设置
+                  <ChevronDown className={cn('h-3.5 w-3.5 transition-transform', advancedOpen && 'rotate-180')} />
+                </button>
+              </CollapsibleTrigger>
+              <CollapsibleContent className="mt-3 space-y-3 pt-3 border-t border-[var(--dg-border)]">
+                <div className="space-y-1.5">
+                  <Label className="text-xs">构建节点</Label>
+                  <Select value={buildNodeId || '__auto'} onValueChange={(v) => setBuildNodeId(v === '__auto' ? '' : v)}>
+                    <SelectTrigger className="h-8 text-xs dg-input"><SelectValue /></SelectTrigger>
+                    <SelectContent>
+                      <SelectItem value="__auto">自动调度（Master 优先）</SelectItem>
+                      {buildNodes.map((n) => (
+                        <SelectItem key={n.id} value={String(n.id)}>
+                          {n.name} ({n.running_count || 0}/{n.max_executors})
+                        </SelectItem>
+                      ))}
+                    </SelectContent>
+                  </Select>
+                </div>
+                <div className="space-y-1.5">
+                  <Label className="text-xs">Job 名称 <span className="text-[var(--dg-text-muted)]">(Webhook)</span></Label>
+                  <Input value={newJobName} onChange={(e) => setNewJobName(e.target.value)} className="h-8 text-xs font-mono dg-input" />
+                </div>
+                <div className="space-y-1.5">
+                  <Label className="text-xs">触发方式</Label>
+                  <Select value={newTriggerMode} onValueChange={setNewTriggerMode}>
+                    <SelectTrigger className="h-8 text-xs dg-input"><SelectValue /></SelectTrigger>
+                    <SelectContent>
+                      <SelectItem value="manual">手动</SelectItem>
+                      <SelectItem value="git_push">代码推送</SelectItem>
+                      <SelectItem value="cron">定时</SelectItem>
+                      <SelectItem value="webhook">Webhook</SelectItem>
+                    </SelectContent>
+                  </Select>
+                </div>
+                {newTriggerMode === 'git_push' && (
+                  <Input
+                    value={newWatchBranches}
+                    onChange={(e) => setNewWatchBranches(e.target.value)}
+                    placeholder="监听分支，如 main, release/*"
+                    className="h-8 text-xs font-mono dg-input"
+                  />
+                )}
+                {newTriggerMode === 'cron' && (
+                  <Input
+                    value={newCronExpr}
+                    onChange={(e) => setNewCronExpr(e.target.value)}
+                    placeholder="0 2 * * *"
+                    className="h-8 text-xs font-mono dg-input"
+                  />
+                )}
+                <div className="space-y-1.5">
+                  <div className="flex items-center justify-between">
+                    <Label className="text-xs">环境变量</Label>
+                    <Button
+                      type="button"
+                      variant="ghost"
+                      size="sm"
+                      className="h-6 text-[10px]"
+                      onClick={() => setNewEnvVars([...newEnvVars, { key: '', value: '' }])}
+                    >
+                      <Plus className="h-3 w-3 mr-0.5" />添加
                     </Button>
                   </div>
-                ))}
+                  {newEnvVars.map((v, i) => (
+                    <div key={i} className="flex gap-1.5">
+                      <Input
+                        value={v.key}
+                        onChange={(e) => {
+                          const nv = [...newEnvVars];
+                          nv[i] = { ...nv[i], key: e.target.value };
+                          setNewEnvVars(nv);
+                        }}
+                        placeholder="KEY"
+                        className="h-7 text-xs font-mono dg-input flex-1"
+                      />
+                      <Input
+                        value={v.value}
+                        onChange={(e) => {
+                          const nv = [...newEnvVars];
+                          nv[i] = { ...nv[i], value: e.target.value };
+                          setNewEnvVars(nv);
+                        }}
+                        placeholder="value"
+                        className="h-7 text-xs font-mono dg-input flex-[2]"
+                      />
+                      <Button
+                        type="button"
+                        variant="ghost"
+                        size="icon"
+                        className="h-7 w-7 shrink-0"
+                        onClick={() => setNewEnvVars(newEnvVars.filter((_, idx) => idx !== i))}
+                      >
+                        <Trash2 className="h-3.5 w-3.5 text-[var(--dg-red)]" />
+                      </Button>
+                    </div>
+                  ))}
+                </div>
+              </CollapsibleContent>
+            </Collapsible>
+
+            <div className="flex justify-between gap-2 pt-2 border-t border-[var(--dg-border)]">
+              <Button variant="ghost" onClick={() => setStep(1)}>上一步</Button>
+              <div className="flex gap-2">
+                <Button variant="outline" onClick={() => onOpenChange(false)}>取消</Button>
+                <Button onClick={handleCreate} disabled={saving}>
+                  {saving ? <Loader2 className="h-4 w-4 animate-spin mr-1" /> : <Rocket className="h-4 w-4 mr-1" />}
+                  {saving ? '创建中' : '创建'}
+                </Button>
               </div>
-            )}
-          </div>
-
-          <div className="border-t border-[var(--dg-border)] pt-4">
-            <Label className="mb-2 block">构建缓存 <span className="text-xs text-[var(--dg-text-secondary)] opacity-60">(加速后续构建)</span></Label>
-            <Input value={newCachePaths} onChange={(e) => setNewCachePaths(e.target.value)} placeholder="node_modules, .m2, target" className="bg-[var(--dg-bg-secondary)] border-[var(--dg-border)] h-8 text-xs font-mono" />
-            <p className="text-[10px] text-[var(--dg-text-secondary)] opacity-50 mt-1">多个路径用逗号分隔，相同的 Key 会命中已有缓存</p>
-          </div>
-
-          <div className="border-t border-[var(--dg-border)] pt-4">
-            <Label className="mb-2 block">并发执行数 <span className="text-xs text-[var(--dg-text-secondary)] opacity-60">(Number of executors)</span></Label>
-            <div className="flex items-center gap-2">
-              <Select value={String(newMaxExecutors)} onValueChange={(v) => setNewMaxExecutors(Number(v))}>
-                <SelectTrigger className="w-32 h-8 text-xs bg-[var(--dg-bg-secondary)] border-[var(--dg-border)]">
-                  <SelectValue />
-                </SelectTrigger>
-                <SelectContent>
-                  <SelectItem value="1">1 — 串行</SelectItem>
-                  <SelectItem value="2">2</SelectItem>
-                  <SelectItem value="3">3</SelectItem>
-                  <SelectItem value="4">4</SelectItem>
-                  <SelectItem value="5">5</SelectItem>
-                </SelectContent>
-              </Select>
             </div>
-            <p className="text-[10px] text-[var(--dg-text-secondary)] opacity-50 mt-1">设为 1 则按顺序串行执行，默认 2 可并发构建</p>
           </div>
-        </div>
-        <div className="flex justify-end gap-2 mt-4 pt-4 border-t border-[var(--dg-border)]">
-          <Button variant="outline" onClick={() => onOpenChange(false)}>取消</Button>
-          <Button onClick={handleCreate} disabled={saving}>
-            {saving ? <Loader2 className="h-4 w-4 animate-spin mr-1" /> : <Rocket className="h-4 w-4 mr-1" />}
-            {saving ? '创建中...' : '创建流水线'}
-          </Button>
-        </div>
+        )}
       </DialogContent>
     </Dialog>
   );

frontend/src/components/layout/Sidebar.tsx

@@ -111,7 +111,7 @@ const menuItems: MenuItem[] = [
     children: [
       { id: 'pipelines', name: '流水线', labelKey: 'menu.pipelines', icon: GitBranch, path: '/pipelines', permission: 'deploy:pipeline' },
       { id: 'deploy-credentials', name: '发布配置', labelKey: 'menu.deployConfig', icon: Key, path: '/deploy/configureTools', permission: 'deploy:release' },
-      { id: 'deploy-rbac', name: '发布权限', labelKey: 'menu.deployRbac', icon: Shield, path: '/deploy/rbac', permission: 'deploy:release' },
+      { id: 'deploy-rbac', name: 'Job 权限', labelKey: 'menu.deployRbac', icon: Shield, path: '/deploy/rbac', permission: 'deploy:release' },
     ],
   },
   {
@@ -132,6 +132,7 @@ const menuItems: MenuItem[] = [
       { id: 'log-es', name: 'ES查询', labelKey: 'menu.esQuery', icon: Database, path: '/log-center/es', permission: 'monitor:alert' },
       { id: 'log-datasources', name: '日志库', labelKey: 'menu.logLibrary', icon: HardDrive, path: '/log-center/datasources', permission: 'monitor:alert' },
       { id: 'log-alerts', name: '日志告警', labelKey: 'menu.logAlerts', icon: AlertTriangle, path: '/log-center/alerts', permission: 'monitor:alert' },
+      { id: 'log-rbac', name: '日志权限', labelKey: 'menu.logRbac', icon: Shield, path: '/log-center/rbac', permission: 'monitor:alert' },
     ],
   },
   {

frontend/src/components/monitor/log-center/EnhancedLogResults.tsx

@@ -1,6 +1,9 @@
 // EnhancedLogResults.tsx — Grafana 风格日志结果展示 // Logan.Li
 import { useState, useMemo } from 'react';
 import { ChevronDown, ChevronRight, BarChart3, Plus, Search, Copy, Check } from 'lucide-react';
+import { useToast } from '@/hooks/use-toast';
+import { copyToClipboard } from '@/utils/clipboard';
+import { buildLogCopyText, detectLogFields, formatLogPreview, formatLogTimestamp } from './log-format';
 import type { LogEntry, ViewMode } from './types-v3';
 type ViewDensity = 'compact' | 'comfortable' | 'loose';
 
@@ -81,25 +84,11 @@ export function extractCommonLabels(entries: LogEntry[]): Record<string, string>
   return Object.keys(common).length > 0 ? common : null;
 }
 
-// ===== 检测结构化字段（从消息中解析）=====
-function detectFields(raw: string): { name: string; value: string }[] {
-  const fields: { name: string; value: string }[] = [];
-  try {
-    const parsed = JSON.parse(raw);
-    if (typeof parsed === 'object' && parsed !== null) {
-      for (const [k, v] of Object.entries(parsed)) {
-        fields.push({ name: k, value: String(v) });
-      }
-    }
-  } catch {
-    // 非 JSON，尝试 key=value 模式
-    const regex = /(\w+)=([^,\s]+)/g;
-    let m;
-    while ((m = regex.exec(raw)) !== null) {
-      fields.push({ name: m[1], value: m[2] });
-    }
-  }
-  return fields;
+// 日志行 CSS：截断关闭时用横向滚动而非省略号，避免看不到后半段 // Logan.Li
+function messageLineClass(wrap: boolean, trunc: boolean): string {
+  if (wrap) return 'whitespace-pre-wrap break-all';
+  if (trunc) return 'truncate';
+  return 'whitespace-nowrap overflow-x-auto';
 }
 
 // ===== 原始日志视图（Grafana 风格）=====
@@ -109,15 +98,25 @@ function RawLogView({
   entry: LogEntry; wrap: boolean; trunc: boolean;
   showTime: boolean; onLabelFilter?: (k: string, v: string, op: 'include' | 'exclude') => void;
 }) {
+  const { toast } = useToast();
   const [expanded, setExpanded] = useState(false);
   const [copied, setCopied] = useState(false);
   const labels = entry.labels || {};
-  const detected = useMemo(() => detectFields(entry.raw || entry.message), [entry]);
+  const fullText = entry.raw || entry.message || '';
+  const detected = useMemo(() => detectLogFields(fullText), [fullText]);
+  const displayTs = formatLogTimestamp(entry.timestamp);
+  const preview = expanded ? fullText : formatLogPreview(fullText, trunc);
 
-  const copyRaw = () => {
-    navigator.clipboard.writeText(entry.raw || entry.message).then(() => {
-      setCopied(true); setTimeout(() => setCopied(false), 1500);
-    });
+  const copyRaw = async () => {
+    const text = buildLogCopyText(entry);
+    const ok = await copyToClipboard(text);
+    if (ok) {
+      setCopied(true);
+      toast({ title: '已复制完整日志' });
+      setTimeout(() => setCopied(false), 1500);
+    } else {
+      toast({ title: '复制失败', description: '请展开后手动选中复制', variant: 'destructive' });
+    }
   };
 
   return (
@@ -135,8 +134,8 @@ function RawLogView({
 
         {/* 时间戳 */}
         {showTime && (
-          <span className="text-[11px] font-mono flex-shrink-0 w-[140px] mt-0.5" style={{ color: 'var(--dg-text-muted)' }}>
-            {entry.timestamp}
+          <span className="text-[11px] font-mono flex-shrink-0 w-[180px] mt-0.5" style={{ color: 'var(--dg-text-muted)' }} title={entry.timestamp}>
+            {displayTs}
           </span>
         )}
 
@@ -147,24 +146,50 @@ function RawLogView({
           </span>
         )}
 
-        {/* 日志内容 */}
-        <span className={`text-xs flex-1 min-w-0 ${wrap ? 'whitespace-pre-wrap break-all' : 'truncate'}`} style={{ color: 'var(--dg-text-secondary)' }}>
-          {trunc && entry.message.length > 300 && !expanded ? entry.message.slice(0, 300) + '...' : entry.message}
+        {/* 日志内容（折叠预览） */}
+        <span
+          className={`text-xs font-mono flex-1 min-w-0 ${messageLineClass(wrap, trunc && !expanded)}`}
+          style={{ color: 'var(--dg-text-secondary)' }}
+          title={!expanded && fullText.length > 120 ? fullText : undefined}
+        >
+          {preview}
         </span>
 
-        {/* 复制按钮（hover 显示）*/}
+        {/* 复制按钮（hover 显示，复制完整原文） */}
         <button
-          onClick={e => { e.stopPropagation(); copyRaw(); }}
+          onClick={e => { e.stopPropagation(); void copyRaw(); }}
           className="flex-shrink-0 opacity-0 group-hover:opacity-100 transition-opacity mt-0.5"
           style={{ color: 'var(--dg-text-muted)' }}
+          title="复制完整日志"
         >
           {copied ? <Check className="h-3 w-3 dg-text-green" /> : <Copy className="h-3 w-3" />}
         </button>
       </div>
 
-      {/* 展开详情：Log labels + Detected fields */}
+      {/* 展开详情：完整日志 + labels + fields */}
       {expanded && (
         <div className="animate-fade-in" style={{ background: 'var(--dg-bg-secondary)', padding: '8px 12px 12px 36px' }}>
+          {/* 完整日志正文 */}
+          <div className="mb-3">
+            <div className="flex items-center justify-between mb-1.5">
+              <p className="text-[10px] font-medium" style={{ color: 'var(--dg-text-muted)' }}>完整日志</p>
+              <button
+                type="button"
+                onClick={e => { e.stopPropagation(); void copyRaw(); }}
+                className="text-[10px] px-2 py-0.5 rounded border"
+                style={{ borderColor: 'var(--dg-border)', color: 'var(--dg-text-secondary)' }}
+              >
+                {copied ? '已复制' : '复制全文'}
+              </button>
+            </div>
+            <pre
+              className="text-[11px] font-mono whitespace-pre-wrap break-all p-2 rounded max-h-[320px] overflow-y-auto"
+              style={{ background: 'var(--dg-bg-tertiary)', color: 'var(--dg-text-primary)', border: '1px solid var(--dg-border)' }}
+            >
+              {fullText}
+            </pre>
+          </div>
+
           {/* Log labels */}
           {Object.keys(labels).length > 0 && (
             <div className="mb-3">
@@ -181,8 +206,8 @@ function RawLogView({
                     >
                       <Plus className="h-3 w-3" />
                     </button>
-                    <span className="text-[11px] font-mono w-[160px] truncate flex-shrink-0" style={{ color: 'var(--dg-text-primary)' }}>{k}</span>
-                    <span className="text-[11px] font-mono flex-1 truncate" style={{ color: 'var(--dg-text-secondary)' }}>{v}</span>
+                    <span className="text-[11px] font-mono w-[160px] flex-shrink-0" style={{ color: 'var(--dg-text-primary)' }}>{k}</span>
+                    <span className="text-[11px] font-mono flex-1 break-all" style={{ color: 'var(--dg-text-secondary)' }}>{v}</span>
                   </div>
                 ))}
               </div>
@@ -249,12 +274,12 @@ function FieldView({ entries, wrap, trunc, search }: { entries: LogEntry[]; wrap
             <tr key={i} className="hover:opacity-80 transition-colors" style={{ borderBottom: '1px solid var(--dg-border)' }}>
               {columns.map(col => {
                 let val: string;
-                if (col === 'timestamp') val = e.timestamp;
-                else if (col === 'message') val = e.message;
+                if (col === 'timestamp') val = formatLogTimestamp(e.timestamp);
+                else if (col === 'message') val = e.raw || e.message;
                 else val = e.labels?.[col] || '—';
                 return (
-                  <td key={col} className={`px-2 py-1.5 max-w-[300px] ${!wrap ? 'truncate' : 'break-all'}`} style={{ color: 'var(--dg-text-secondary)' }}>
-                    {trunc && val.length > 100 ? val.slice(0, 100) + '...' : val}
+                  <td key={col} className={`px-2 py-1.5 max-w-[400px] ${wrap ? 'break-all whitespace-pre-wrap' : trunc ? 'truncate' : 'break-all'}`} style={{ color: 'var(--dg-text-secondary)' }} title={val}>
+                    {trunc ? formatLogPreview(val, true, 200) : val}
                   </td>
                 );
               })}
@@ -281,12 +306,12 @@ function TableView({ entries, wrap, trunc }: { entries: LogEntry[]; wrap: boolea
         <tbody>
           {entries.map((e, i) => (
             <tr key={i} className="hover:opacity-80 transition-colors" style={{ borderBottom: '1px solid var(--dg-border)' }}>
-              <td className="px-3 py-2 font-mono text-[11px] whitespace-nowrap" style={{ color: 'var(--dg-text-muted)' }}>{e.timestamp}</td>
+              <td className="px-3 py-2 font-mono text-[11px] whitespace-nowrap" style={{ color: 'var(--dg-text-muted)' }}>{formatLogTimestamp(e.timestamp)}</td>
               <td className="px-3 py-2">
                 {e.level ? <span className={`text-[10px] px-1.5 py-0.5 rounded border ${levelBadge(e.level)}`}>{e.level}</span> : '—'}
               </td>
-              <td className={`px-3 py-2 ${wrap ? 'whitespace-pre-wrap break-all' : 'truncate'} max-w-[600px]`} style={{ color: 'var(--dg-text-secondary)' }}>
-                {trunc && e.message.length > 200 ? e.message.slice(0, 200) + '...' : e.message}
+              <td className={`px-3 py-2 ${messageLineClass(wrap, trunc)} max-w-[800px]`} style={{ color: 'var(--dg-text-secondary)' }} title={e.raw || e.message}>
+                {trunc ? formatLogPreview(e.raw || e.message, true, 300) : (e.raw || e.message)}
               </td>
             </tr>
           ))}

frontend/src/components/monitor/log-center/EsIndexPicker.tsx

@@ -0,0 +1,99 @@
+import { useState, useEffect, useMemo } from 'react';
+import { ChevronDown, Loader2, Search } from 'lucide-react';
+import { logCenterApi } from '@/api/log/log-center';
+
+interface Props {
+  datasourceId?: number;
+  value: string;
+  onChange: (index: string) => void;
+}
+
+// ES 索引选择器 — 可搜索下拉，对接数据源索引列表 // Logan.Li
+export function EsIndexPicker({ datasourceId, value, onChange }: Props) {
+  const [open, setOpen] = useState(false);
+  const [loading, setLoading] = useState(false);
+  const [indices, setIndices] = useState<string[]>([]);
+  const [search, setSearch] = useState('');
+
+  useEffect(() => {
+    if (!datasourceId) {
+      setIndices([]);
+      return;
+    }
+    setLoading(true);
+    logCenterApi.listIndicesByDatasource(datasourceId)
+      .then((res) => setIndices(Array.isArray(res) ? res : []))
+      .catch(() => setIndices([]))
+      .finally(() => setLoading(false));
+  }, [datasourceId]);
+
+  const filtered = useMemo(() => {
+    const q = search.trim().toLowerCase();
+    if (!q) return indices.slice(0, 80);
+    return indices.filter((i) => i.toLowerCase().includes(q)).slice(0, 80);
+  }, [indices, search]);
+
+  return (
+    <div className="relative flex-shrink-0">
+      <button
+        type="button"
+        onClick={() => setOpen(!open)}
+        className="h-10 px-2 text-xs rounded flex items-center gap-1 font-mono min-w-[150px] max-w-[220px]"
+        style={{ background: 'var(--dg-bg-tertiary)', border: '1px solid var(--dg-border)', color: 'var(--dg-text-primary)' }}
+        title="选择或搜索 ES 索引"
+      >
+        <span className="truncate flex-1 text-left">{value || '选择索引'}</span>
+        {loading ? <Loader2 className="h-3 w-3 animate-spin shrink-0" /> : <ChevronDown className="h-3 w-3 shrink-0" />}
+      </button>
+      {open && (
+        <>
+          <div className="fixed inset-0 z-40" onClick={() => setOpen(false)} />
+          <div
+            className="absolute left-0 top-full mt-1 z-50 w-72 rounded-lg border shadow-xl overflow-hidden"
+            style={{ background: 'var(--dg-bg-secondary)', borderColor: 'var(--dg-border)' }}
+          >
+            <div className="p-2 border-b" style={{ borderColor: 'var(--dg-border)' }}>
+              <div className="flex items-center gap-1.5 px-2 h-8 rounded" style={{ background: 'var(--dg-bg-tertiary)', border: '1px solid var(--dg-border)' }}>
+                <Search className="h-3.5 w-3.5 text-[var(--dg-text-muted)]" />
+                <input
+                  value={search}
+                  onChange={(e) => setSearch(e.target.value)}
+                  placeholder="搜索索引..."
+                  className="flex-1 bg-transparent text-xs outline-none font-mono"
+                  style={{ color: 'var(--dg-text-primary)' }}
+                />
+              </div>
+            </div>
+            <div className="max-h-56 overflow-y-auto p-1">
+              <button
+                type="button"
+                onClick={() => { onChange(''); setOpen(false); }}
+                className="w-full text-left px-2 py-1.5 text-xs rounded hover:opacity-80 font-mono"
+                style={{ color: 'var(--dg-text-muted)' }}
+              >
+                使用数据源默认
+              </button>
+              {filtered.map((idx) => (
+                <button
+                  key={idx}
+                  type="button"
+                  onClick={() => { onChange(idx); setOpen(false); }}
+                  className="w-full text-left px-2 py-1.5 text-xs rounded hover:opacity-80 font-mono truncate"
+                  style={{
+                    color: value === idx ? 'var(--dg-blue)' : 'var(--dg-text-secondary)',
+                    background: value === idx ? 'var(--dg-bg-tertiary)' : 'transparent',
+                  }}
+                >
+                  {idx}
+                </button>
+              ))}
+              {!loading && filtered.length === 0 && (
+                <p className="text-xs px-2 py-3 text-center" style={{ color: 'var(--dg-text-muted)' }}>无匹配索引</p>
+              )}
+            </div>
+          </div>
+        </>
+      )}
+    </div>
+  );
+}

frontend/src/components/monitor/log-center/LogCenter.tsx

@@ -7,6 +7,7 @@ import { LogQueryProvider } from './LogQueryContext';
 import { UnifiedQueryPanel } from './UnifiedQueryPanel';
 import { LogDatasourcePage } from './LogDatasourcePage';
 import { LogAlertsPanel } from './LogAlertsPanel';
+import LogRBAC from './LogRBAC';
 import type { LogEngine } from './types-v3';
 
 const SECTION_META: Record<string, { title: string; description: string; engine?: LogEngine }> = {
@@ -14,9 +15,10 @@ const SECTION_META: Record<string, { title: string; description: string; engine?
   es: { title: 'ES 查询', description: '对接自建 Elasticsearch · 索引日志检索', engine: 'elasticsearch' },
   datasources: { title: '日志库', description: '管理日志数据源连接（Loki / Elasticsearch）' },
   alerts: { title: '日志告警', description: '基于查询条件的日志告警策略' },
+  rbac: { title: '日志权限', description: '按 ES 索引 / Loki Label 正则限制查询范围' },
 };
 
-const VALID_TABS = ['loki', 'es', 'datasources', 'alerts'];
+const VALID_TABS = ['loki', 'es', 'datasources', 'alerts', 'rbac'];
 
 export default function LogCenter() {
   const { section } = useParams<{ section: string }>();
@@ -25,6 +27,8 @@ export default function LogCenter() {
 
   if (!tab) return <Navigate to="/log-center/loki" replace />;
 
+  if (tab === 'rbac') return <LogRBAC />;
+
   const meta = SECTION_META[tab];
 
   return (

frontend/src/components/monitor/log-center/LogFieldSidebar.tsx

@@ -32,7 +32,7 @@ export function LogFieldSidebar({
 }: LogFieldSidebarProps) {
   const [search, setSearch] = useState('');
   const [showDisplay, setShowDisplay] = useState(true);
-  const [showIndexed, setShowIndexed] = useState(false);
+  const [showIndexed, setShowIndexed] = useState((indexedFields?.length || 0) > 0);
 
   const filteredFields = useMemo(() => {
     if (!search) return fields;

frontend/src/components/monitor/log-center/LogNav.tsx

@@ -0,0 +1,37 @@
+import { NavLink } from 'react-router-dom';
+import { FileSearch, Database, HardDrive, AlertTriangle, Shield } from 'lucide-react';
+import { cn } from '@/lib/utils';
+
+const NAV_ITEMS = [
+  { path: '/log-center/loki', label: 'Loki 查询', icon: FileSearch },
+  { path: '/log-center/es', label: 'ES 查询', icon: Database },
+  { path: '/log-center/datasources', label: '日志库', icon: HardDrive },
+  { path: '/log-center/alerts', label: '日志告警', icon: AlertTriangle },
+  { path: '/log-center/rbac', label: '日志权限', icon: Shield },
+];
+
+// 日志中心二级导航 // Logan.Li
+export function LogNav() {
+  return (
+    <nav className="flex items-center gap-1 p-1 rounded-lg bg-[var(--dg-bg-secondary)] border border-[var(--dg-border)] w-fit flex-wrap">
+      {NAV_ITEMS.map((item) => {
+        const Icon = item.icon;
+        return (
+          <NavLink
+            key={item.path}
+            to={item.path}
+            className={({ isActive }) => cn(
+              'flex items-center gap-1.5 px-3 py-1.5 rounded-md text-xs font-medium transition-colors',
+              isActive
+                ? 'bg-[var(--dg-bg-primary)] text-[var(--dg-text-primary)] border border-[var(--dg-border)] shadow-sm'
+                : 'text-[var(--dg-text-muted)] hover:text-[var(--dg-text-primary)]',
+            )}
+          >
+            <Icon className="h-3.5 w-3.5" />
+            {item.label}
+          </NavLink>
+        );
+      })}
+    </nav>
+  );
+}

frontend/src/components/monitor/log-center/LogQueryToolbar.tsx

@@ -1,5 +1,5 @@
 // LogQueryToolbar.tsx — 查询工具栏（统计条 + 分页 + 操作）// Logan.Li
-import { ArrowUpDown, Bell, Download, Copy, ChevronLeft, ChevronRight } from 'lucide-react';
+import { ArrowUpDown, Bell, Download, Copy, ChevronLeft, ChevronRight, ChevronsDown } from 'lucide-react';
 import { useState } from 'react';
 
 interface Props {
@@ -17,6 +17,9 @@ interface Props {
   onCopy?: () => void;
   onBellClick?: () => void;
   hasAlertRule?: boolean;
+  hasMore?: boolean;
+  loadingMore?: boolean;
+  onLoadMore?: () => void;
 }
 
 const STATUS_LABEL: Record<string, { text: string; color: string }> = {
@@ -28,7 +31,7 @@ const STATUS_LABEL: Record<string, { text: string; color: string }> = {
 export function LogQueryToolbar({
   total, queryTime, status = 'precise', perPage, onPerPageChange,
   page, totalPages, onPageChange, sortDirection, onSortToggle,
-  onExport, onCopy, onBellClick, hasAlertRule,
+  onExport, onCopy, onBellClick, hasAlertRule, hasMore, loadingMore, onLoadMore,
 }: Props) {
   const [jumpPage, setJumpPage] = useState('');
   const st = STATUS_LABEL[status] || STATUS_LABEL.precise;
@@ -131,6 +134,18 @@ export function LogQueryToolbar({
         </div>
       </div>
 
+      {hasMore && onLoadMore && (
+        <button
+          onClick={onLoadMore}
+          disabled={loadingMore}
+          className="h-7 px-2.5 text-[11px] rounded border flex items-center gap-1 disabled:opacity-40"
+          style={{ borderColor: 'var(--dg-border)', color: 'var(--dg-blue)', background: 'var(--dg-bg-tertiary)' }}
+        >
+          <ChevronsDown className={`h-3.5 w-3.5 ${loadingMore ? 'animate-bounce' : ''}`} />
+          加载更多
+        </button>
+      )}
+
       {/* 右侧操作 */}
       <div className="flex items-center gap-1">
         <button

frontend/src/components/monitor/log-center/LogRBAC.tsx

@@ -0,0 +1,406 @@
+import { useState, useEffect, useMemo } from 'react';
+import { Shield, Plus, Trash2, Loader2, Users, UserPlus, Check, X, ScrollText } from 'lucide-react';
+import { Card, CardContent } from '@/components/ui/card';
+import { Button } from '@/components/ui/button';
+import { Input } from '@/components/ui/input';
+import { Badge } from '@/components/ui/badge';
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select';
+import { Label } from '@/components/ui/label';
+import { toast } from 'sonner';
+import { userApi } from '@/api';
+import { logCenterApi } from '@/api/log/log-center';
+import { logRbacApi, type LogScopeRole, type UserLogScopeRole } from '@/api/log/log-rbac';
+import { useConfirm } from '@/components/ui/confirm-dialog';
+import { PageShell } from '@/components/layout/PageShell';
+import { PageEmpty } from '@/components/layout/PageEmpty';
+
+import { LogRoleCreateDialog } from './log-rbac/LogRoleCreateDialog';
+import { matchSampleScopes, SAMPLE_SCOPES, scopeDisplayLabel } from './log-rbac/matchLogScope';
+import type { LogDataSource } from '@/api/log/log-center';
+import type { JsonData } from '@/types/common';
+
+const ROLE_LABEL: Record<string, string> = {
+  viewer: '查看者',
+  analyst: '分析者',
+};
+
+const ENGINE_LABEL: Record<string, string> = {
+  '*': '全部',
+  loki: 'Loki',
+  elasticsearch: 'ES',
+};
+
+const FIELD_LABEL: Record<string, string> = {
+  index: '索引',
+  app: 'app',
+  namespace: 'namespace',
+  job: 'job',
+};
+
+// 日志查询范围权限 — 正则匹配 ES 索引 / Loki Label // Logan.Li
+export default function LogRBAC() {
+  const [roles, setRoles] = useState<LogScopeRole[]>([]);
+  const [datasources, setDatasources] = useState<LogDataSource[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [saving, setSaving] = useState(false);
+  const [activeTab, setActiveTab] = useState('roles');
+  const [previewRoleId, setPreviewRoleId] = useState<number | null>(null);
+  const [users, setUsers] = useState<JsonData[]>([]);
+  const [assignments, setAssignments] = useState<UserLogScopeRole[]>([]);
+  const [selectedUserId, setSelectedUserId] = useState('');
+  const [assignRoleId, setAssignRoleId] = useState('');
+  const [assignLoading, setAssignLoading] = useState(false);
+  const [createOpen, setCreateOpen] = useState(false);
+  const [newName, setNewName] = useState('');
+  const [newCode, setNewCode] = useState('');
+  const [newEngine, setNewEngine] = useState('*');
+  const [newMatchField, setNewMatchField] = useState('app');
+  const [newPattern, setNewPattern] = useState('');
+  const [newRole, setNewRole] = useState('viewer');
+  const [newDatasourceId, setNewDatasourceId] = useState('');
+  const [newDesc, setNewDesc] = useState('');
+  const [editing, setEditing] = useState<number | null>(null);
+  const [editPattern, setEditPattern] = useState('');
+  const [editRole, setEditRole] = useState('');
+
+  const _confirm = useConfirm();
+
+  const loadData = async () => {
+    setLoading(true);
+    try {
+      const [rolesRes, dsRes, usersRes] = await Promise.all([
+        logRbacApi.getRoles(),
+        logCenterApi.listDatasources(),
+        userApi.getUsers({ page_size: 500 }),
+      ]);
+      setRoles(Array.isArray(rolesRes) ? rolesRes : (rolesRes as JsonData)?.list || []);
+      setDatasources(Array.isArray(dsRes) ? dsRes : (dsRes as JsonData)?.list || []);
+      setUsers(Array.isArray(usersRes) ? usersRes : (usersRes as JsonData)?.list || []);
+    } catch { /* silent */ }
+    finally { setLoading(false); }
+  };
+
+  useEffect(() => { loadData(); }, []);
+
+  const loadAssignments = async () => {
+    if (!selectedUserId) { setAssignments([]); return; }
+    try {
+      const res = await logRbacApi.getUserRoles(Number(selectedUserId));
+      setAssignments(Array.isArray(res) ? res : (res as JsonData)?.list || []);
+    } catch { setAssignments([]); }
+  };
+
+  useEffect(() => { loadAssignments(); }, [selectedUserId]);
+
+  const matchCount = useMemo(() => {
+    const map: Record<number, typeof SAMPLE_SCOPES> = {};
+    roles.forEach((r) => {
+      map[r.id] = matchSampleScopes(r.pattern, r.match_field, r.engine);
+    });
+    return map;
+  }, [roles]);
+
+  const previewMatches = previewRoleId
+    ? (matchCount[previewRoleId] || [])
+    : SAMPLE_SCOPES;
+
+  const handleCreate = async () => {
+    if (!newName.trim() || !newCode.trim() || !newPattern.trim()) {
+      toast.error('请填写名称、标识与正则'); return;
+    }
+    setSaving(true);
+    try {
+      await logRbacApi.createRole({
+        name: newName.trim(),
+        code: newCode.trim(),
+        engine: newEngine,
+        match_field: newMatchField,
+        pattern: newPattern.trim(),
+        role: newRole,
+        description: newDesc,
+        ...(newDatasourceId ? { datasource_id: Number(newDatasourceId) } : {}),
+      });
+      toast.success('已创建');
+      setCreateOpen(false);
+      setNewName(''); setNewCode(''); setNewEngine('*'); setNewMatchField('app');
+      setNewPattern(''); setNewRole('viewer'); setNewDatasourceId(''); setNewDesc('');
+      loadData();
+    } catch (e: unknown) {
+      toast.error((e as Error)?.message || '创建失败');
+    } finally { setSaving(false); }
+  };
+
+  const handleUpdate = async (id: number) => {
+    if (!editPattern.trim()) { toast.error('正则不能为空'); return; }
+    setSaving(true);
+    try {
+      await logRbacApi.updateRole(id, { pattern: editPattern, role: editRole });
+      toast.success('已更新');
+      setEditing(null);
+      loadData();
+    } catch (e: unknown) {
+      toast.error((e as Error)?.message || '更新失败');
+    } finally { setSaving(false); }
+  };
+
+  const handleDelete = async (role: LogScopeRole) => {
+    const ok = await _confirm({
+      title: '删除权限',
+      description: `确定删除「${role.name}」？将影响 ${matchCount[role.id]?.length || 0} 个示例范围`,
+      variant: 'destructive',
+    });
+    if (!ok) return;
+    try { await logRbacApi.deleteRole(role.id); toast.success('已删除'); loadData(); }
+    catch { toast.error('删除失败'); }
+  };
+
+  const handleToggleStatus = async (role: LogScopeRole) => {
+    try {
+      await logRbacApi.updateRole(role.id, { status: role.status ? 0 : 1 });
+      toast.success(role.status ? '已禁用' : '已启用');
+      loadData();
+    } catch { toast.error('操作失败'); }
+  };
+
+  const handleAssign = async () => {
+    if (!selectedUserId || !assignRoleId) { toast.error('请选择用户和权限'); return; }
+    setAssignLoading(true);
+    try {
+      await logRbacApi.assignRole(Number(selectedUserId), {
+        log_scope_role_id: Number(assignRoleId),
+      });
+      toast.success('已分配');
+      setAssignRoleId('');
+      loadAssignments();
+    } catch (e: unknown) {
+      toast.error((e as Error)?.message || '分配失败');
+    } finally { setAssignLoading(false); }
+  };
+
+  const handleRevoke = async (id: number) => {
+    try {
+      await logRbacApi.removeRole(Number(selectedUserId), id);
+      toast.success('已撤销');
+      loadAssignments();
+    } catch { toast.error('撤销失败'); }
+  };
+
+  const selectedUser = users.find((u) => String(u.id) === selectedUserId);
+  const pageTabs = [
+    { id: 'roles', label: '权限策略', badge: roles.length || undefined },
+    { id: 'users', label: '用户授权' },
+    { id: 'preview', label: '命中预览' },
+  ];
+
+  return (
+    <PageShell
+      variant="list"
+      title="日志权限"
+      subtitle="按 ES 索引 / Loki Label 正则限制查询范围"
+      icon={<ScrollText className="h-5 w-5" />}
+      loading={loading}
+      tabs={pageTabs}
+      activeTab={activeTab}
+      onTabChange={setActiveTab}
+      actions={(
+        <Button className="dg-btn-primary" onClick={() => setCreateOpen(true)}>
+          <Plus className="w-4 h-4 mr-1" />新建权限
+        </Button>
+      )}
+      contentClassName="space-y-4"
+    >
+      {activeTab === 'roles' && (
+        roles.length === 0 ? (
+          <PageEmpty
+            icon={<Shield className="h-10 w-10" />}
+            title="暂无日志权限策略"
+            description="创建策略并分配给用户后，将按正则限制可查询的索引与 Label 范围"
+            action={<Button onClick={() => setCreateOpen(true)}><Plus className="h-4 w-4 mr-1" />新建权限</Button>}
+          />
+        ) : (
+          <div className="space-y-2">
+            {roles.map((role) => (
+              <Card key={role.id} className={`dg-card ${role.status === 0 ? 'opacity-50' : ''}`}>
+                <CardContent className="p-3">
+                  <div className="flex items-center justify-between gap-3">
+                    <div className="min-w-0 flex-1">
+                      <div className="flex items-center gap-2 flex-wrap">
+                        <span className="text-sm font-medium text-[var(--dg-text-primary)]">{role.name}</span>
+                        <Badge variant="outline" className="text-[10px] border-[var(--dg-border)]">
+                          {ROLE_LABEL[role.role] || role.role}
+                        </Badge>
+                        <Badge variant="outline" className="text-[10px] border-[var(--dg-border)]">
+                          {ENGINE_LABEL[role.engine] || role.engine}
+                        </Badge>
+                        <Badge variant="outline" className="text-[10px] border-[var(--dg-border)]">
+                          {FIELD_LABEL[role.match_field] || role.match_field}
+                        </Badge>
+                        {role.status === 0 && <Badge variant="outline" className="text-[10px]">已禁用</Badge>}
+                        <Badge
+                          variant="outline"
+                          className="text-[10px] cursor-pointer border-[var(--dg-border)]"
+                          onClick={() => { setActiveTab('preview'); setPreviewRoleId(role.id); }}
+                        >
+                          {matchCount[role.id]?.length || 0} 个范围
+                        </Badge>
+                      </div>
+                      <p className="text-xs text-[var(--dg-text-muted)] mt-1 font-mono truncate">
+                        {role.pattern}
+                        {role.description ? ` · ${role.description}` : ''}
+                      </p>
+                    </div>
+                    <div className="flex items-center gap-1 shrink-0">
+                      {editing === role.id ? (
+                        <>
+                          <Input value={editPattern} onChange={(e) => setEditPattern(e.target.value)} className="h-7 w-32 text-xs font-mono dg-input" />
+                          <Select value={editRole} onValueChange={setEditRole}>
+                            <SelectTrigger className="h-7 w-20 text-xs"><SelectValue /></SelectTrigger>
+                            <SelectContent>
+                              <SelectItem value="viewer">查看者</SelectItem>
+                              <SelectItem value="analyst">分析者</SelectItem>
+                            </SelectContent>
+                          </Select>
+                          <Button size="icon" variant="ghost" className="h-7 w-7" onClick={() => handleUpdate(role.id)}><Check className="w-3.5 h-3.5" /></Button>
+                          <Button size="icon" variant="ghost" className="h-7 w-7" onClick={() => setEditing(null)}><X className="w-3.5 h-3.5" /></Button>
+                        </>
+                      ) : (
+                        <>
+                          <Button variant="ghost" size="sm" className="h-7 text-xs" onClick={() => { setEditing(role.id); setEditPattern(role.pattern); setEditRole(role.role); }}>编辑</Button>
+                          <Button variant="ghost" size="sm" className="h-7 text-xs" onClick={() => handleToggleStatus(role)}>{role.status ? '禁用' : '启用'}</Button>
+                          <Button variant="ghost" size="icon" className="h-7 w-7 text-[var(--dg-red)]" onClick={() => handleDelete(role)}><Trash2 className="w-3.5 h-3.5" /></Button>
+                        </>
+                      )}
+                    </div>
+                  </div>
+                </CardContent>
+              </Card>
+            ))}
+          </div>
+        )
+      )}
+
+      {activeTab === 'users' && (
+        <Card className="dg-card">
+          <CardContent className="p-4 space-y-4">
+            <p className="text-xs text-[var(--dg-text-muted)]">
+              用户未分配任何策略时不拦截（向后兼容）；分配后仅允许命中策略的查询。
+            </p>
+            <div className="flex flex-wrap gap-3 items-end">
+              <div className="space-y-1 flex-1 min-w-[200px]">
+                <Label className="text-xs">用户</Label>
+                <Select value={selectedUserId} onValueChange={setSelectedUserId}>
+                  <SelectTrigger className="h-8 text-sm dg-input"><SelectValue placeholder="选择用户" /></SelectTrigger>
+                  <SelectContent className="max-h-60">
+                    {users.map((u) => (
+                      <SelectItem key={u.id as number} value={String(u.id)}>
+                        {(u.real_name as string) || (u.username as string)} ({u.username as string})
+                      </SelectItem>
+                    ))}
+                  </SelectContent>
+                </Select>
+              </div>
+              <div className="space-y-1 w-48">
+                <Label className="text-xs">权限策略</Label>
+                <Select value={assignRoleId} onValueChange={setAssignRoleId}>
+                  <SelectTrigger className="h-8 text-sm dg-input"><SelectValue placeholder="选择策略" /></SelectTrigger>
+                  <SelectContent>
+                    {roles.filter((r) => r.status === 1).map((r) => (
+                      <SelectItem key={r.id} value={String(r.id)}>{r.name} ({ROLE_LABEL[r.role]})</SelectItem>
+                    ))}
+                  </SelectContent>
+                </Select>
+              </div>
+              <Button className="h-8" onClick={handleAssign} disabled={assignLoading || !selectedUserId || !assignRoleId}>
+                {assignLoading ? <Loader2 className="w-3.5 h-3.5 mr-1 animate-spin" /> : <UserPlus className="w-3.5 h-3.5 mr-1" />}
+                分配
+              </Button>
+            </div>
+            {selectedUser ? (
+              assignments.length === 0 ? (
+                <p className="text-xs text-[var(--dg-text-muted)]">该用户尚未分配日志权限</p>
+              ) : (
+                <div className="space-y-1.5">
+                  {assignments.map((a) => {
+                    const roleInfo = a.log_scope_role || roles.find((r) => r.id === a.log_scope_role_id);
+                    return (
+                      <div key={a.id} className="flex items-center justify-between py-2 px-2.5 rounded-md bg-[var(--dg-bg-tertiary)] text-xs">
+                        <div className="flex items-center gap-2 min-w-0">
+                          <Badge variant="outline" className="text-[10px] shrink-0">{ROLE_LABEL[roleInfo?.role || ''] || roleInfo?.role}</Badge>
+                          <span className="text-[var(--dg-text-primary)]">{roleInfo?.name}</span>
+                          <code className="text-[var(--dg-text-muted)] truncate">{roleInfo?.pattern}</code>
+                        </div>
+                        <Button variant="ghost" size="icon" className="h-6 w-6 shrink-0" onClick={() => handleRevoke(a.id)}>
+                          <X className="w-3 h-3" />
+                        </Button>
+                      </div>
+                    );
+                  })}
+                </div>
+              )
+            ) : (
+              <p className="text-xs text-[var(--dg-text-muted)] flex items-center gap-1"><Users className="w-3.5 h-3.5" />选择用户后查看已分配权限</p>
+            )}
+          </CardContent>
+        </Card>
+      )}
+
+      {activeTab === 'preview' && (
+        <Card className="dg-card">
+          <CardContent className="p-4 space-y-3">
+            <div className="flex flex-wrap gap-1.5">
+              <Button variant={previewRoleId === null ? 'secondary' : 'ghost'} size="sm" onClick={() => setPreviewRoleId(null)}>
+                全部 ({SAMPLE_SCOPES.length})
+              </Button>
+              {roles.map((r) => (
+                <Button
+                  key={r.id}
+                  variant={previewRoleId === r.id ? 'secondary' : 'ghost'}
+                  size="sm"
+                  className={r.status === 0 ? 'opacity-40' : ''}
+                  onClick={() => setPreviewRoleId(r.id)}
+                >
+                  {r.name} ({matchCount[r.id]?.length || 0})
+                </Button>
+              ))}
+            </div>
+            <div className="flex flex-wrap gap-1.5 max-h-48 overflow-y-auto">
+              {previewMatches.map((s) => (
+                <Badge key={s.label} variant="outline" className="text-xs font-mono border-[var(--dg-border)]">
+                  <Shield className="w-3 h-3 mr-0.5" />
+                  {scopeDisplayLabel(s)}
+                </Badge>
+              ))}
+              {previewRoleId !== null && previewMatches.length === 0 && (
+                <span className="text-xs text-[var(--dg-text-muted)]">无匹配 — 请调整正则</span>
+              )}
+            </div>
+          </CardContent>
+        </Card>
+      )}
+
+      <LogRoleCreateDialog
+        open={createOpen}
+        onOpenChange={setCreateOpen}
+        datasources={datasources}
+        saving={saving}
+        name={newName}
+        code={newCode}
+        engine={newEngine}
+        matchField={newMatchField}
+        pattern={newPattern}
+        role={newRole}
+        datasourceId={newDatasourceId}
+        description={newDesc}
+        onNameChange={setNewName}
+        onCodeChange={setNewCode}
+        onEngineChange={setNewEngine}
+        onMatchFieldChange={setNewMatchField}
+        onPatternChange={setNewPattern}
+        onRoleChange={setNewRole}
+        onDatasourceIdChange={setNewDatasourceId}
+        onDescriptionChange={setNewDesc}
+        onSubmit={handleCreate}
+      />
+    </PageShell>
+  );
+}

frontend/src/components/monitor/log-center/LokiLabelBrowser.tsx

@@ -0,0 +1,119 @@
+import { useState, useEffect, useCallback } from 'react';
+import { ChevronDown, ChevronRight, Loader2, Tags } from 'lucide-react';
+import { logCenterApi } from '@/api/log/log-center';
+import { extractLokiSelector, mergeLokiSelector } from './query-builder';
+import type { TimeRange } from './types-v3';
+
+interface Props {
+  datasourceId?: number;
+  query: string;
+  timeRange: TimeRange;
+  onQueryChange: (q: string) => void;
+}
+
+// Loki Label 浏览器 — 标签名 → 标签值 → 注入 LogQL 选择器 // Logan.Li
+export function LokiLabelBrowser({ datasourceId, query, timeRange, onQueryChange }: Props) {
+  const [open, setOpen] = useState(false);
+  const [labels, setLabels] = useState<string[]>([]);
+  const [activeLabel, setActiveLabel] = useState('');
+  const [values, setValues] = useState<string[]>([]);
+  const [loadingLabels, setLoadingLabels] = useState(false);
+  const [loadingValues, setLoadingValues] = useState(false);
+  const [selected, setSelected] = useState<Record<string, string>>({});
+
+  const timeParams = useCallback(() => ({
+    start: timeRange.start.replace(' ', 'T'),
+    end: timeRange.end.replace(' ', 'T'),
+  }), [timeRange]);
+
+  useEffect(() => {
+    if (!open || !datasourceId) return;
+    setLoadingLabels(true);
+    logCenterApi.listLokiLabels(datasourceId, timeParams())
+      .then((res) => setLabels(Array.isArray(res) ? res : []))
+      .catch(() => setLabels([]))
+      .finally(() => setLoadingLabels(false));
+  }, [open, datasourceId, timeParams]);
+
+  useEffect(() => {
+    if (!activeLabel || !datasourceId) {
+      setValues([]);
+      return;
+    }
+    setLoadingValues(true);
+    const selector = extractLokiSelector(query);
+    logCenterApi.listLokiLabelValues(datasourceId, activeLabel, {
+      ...timeParams(),
+      ...(selector ? { query: selector } : {}),
+    })
+      .then((res) => setValues(Array.isArray(res) ? res : []))
+      .catch(() => setValues([]))
+      .finally(() => setLoadingValues(false));
+  }, [activeLabel, datasourceId, query, timeParams]);
+
+  const applySelection = (label: string, value: string) => {
+    const next = { ...selected, [label]: value };
+    setSelected(next);
+    onQueryChange(mergeLokiSelector(query, next));
+  };
+
+  return (
+    <div className="rounded-lg border" style={{ borderColor: 'var(--dg-border)', background: 'var(--dg-bg-secondary)' }}>
+      <button
+        type="button"
+        onClick={() => setOpen(!open)}
+        className="w-full flex items-center gap-2 px-3 py-2 text-xs font-medium"
+        style={{ color: 'var(--dg-text-secondary)' }}
+      >
+        {open ? <ChevronDown className="h-3.5 w-3.5" /> : <ChevronRight className="h-3.5 w-3.5" />}
+        <Tags className="h-3.5 w-3.5" style={{ color: '#06b6d4' }} />
+        Label 浏览器
+        {Object.keys(selected).length > 0 && (
+          <span className="text-[10px] px-1.5 py-0.5 rounded" style={{ background: 'var(--dg-bg-tertiary)', color: 'var(--dg-text-muted)' }}>
+            已选 {Object.keys(selected).length}
+          </span>
+        )}
+      </button>
+      {open && (
+        <div className="flex border-t min-h-[140px]" style={{ borderColor: 'var(--dg-border)' }}>
+          <div className="w-36 border-r overflow-y-auto max-h-48" style={{ borderColor: 'var(--dg-border)' }}>
+            {loadingLabels ? (
+              <div className="flex justify-center py-6"><Loader2 className="h-4 w-4 animate-spin text-[var(--dg-text-muted)]" /></div>
+            ) : labels.map((lb) => (
+              <button
+                key={lb}
+                type="button"
+                onClick={() => setActiveLabel(lb)}
+                className="w-full text-left px-2 py-1.5 text-[11px] font-mono truncate"
+                style={{
+                  color: activeLabel === lb ? '#06b6d4' : 'var(--dg-text-secondary)',
+                  background: activeLabel === lb ? 'var(--dg-bg-tertiary)' : 'transparent',
+                }}
+              >
+                {lb}
+              </button>
+            ))}
+          </div>
+          <div className="flex-1 overflow-y-auto max-h-48 p-1">
+            {!activeLabel && <p className="text-[11px] px-2 py-4 text-center" style={{ color: 'var(--dg-text-muted)' }}>选择左侧标签</p>}
+            {loadingValues && <div className="flex justify-center py-6"><Loader2 className="h-4 w-4 animate-spin" /></div>}
+            {!loadingValues && activeLabel && values.map((v) => (
+              <button
+                key={v}
+                type="button"
+                onClick={() => applySelection(activeLabel, v)}
+                className="w-full text-left px-2 py-1 text-[11px] font-mono truncate rounded hover:opacity-80"
+                style={{
+                  color: selected[activeLabel] === v ? '#22c55e' : 'var(--dg-text-primary)',
+                  background: selected[activeLabel] === v ? 'rgba(34,197,94,0.1)' : 'transparent',
+                }}
+              >
+                {v}
+              </button>
+            ))}
+          </div>
+        </div>
+      )}
+    </div>
+  );
+}

frontend/src/components/monitor/log-center/QueryAutocompleteInput.tsx

@@ -0,0 +1,176 @@
+import { useState, useMemo, useCallback, useRef, useEffect } from 'react';
+import { highlightSyntax } from './query-syntax';
+import {
+  detectAutocompleteContext,
+  filterSuggestions,
+  applySuggestion,
+  type AutocompleteContext,
+} from './query-autocomplete';
+
+interface Props {
+  value: string;
+  onChange: (v: string) => void;
+  engine: 'loki' | 'elasticsearch';
+  placeholder?: string;
+  labelNames?: string[];
+  labelValues?: string[];
+  mappingFields?: string[];
+  onRequestLabelValues?: (label: string) => void;
+}
+
+// 语法高亮 + 自动补全查询输入框 // Logan.Li
+export function QueryAutocompleteInput({
+  value,
+  onChange,
+  engine,
+  placeholder,
+  labelNames = [],
+  labelValues = [],
+  mappingFields = [],
+  onRequestLabelValues,
+}: Props) {
+  const taRef = useRef<HTMLTextAreaElement>(null);
+  const preRef = useRef<HTMLPreElement>(null);
+  const [ctx, setCtx] = useState<AutocompleteContext | null>(null);
+  const [activeIdx, setActiveIdx] = useState(0);
+  const [open, setOpen] = useState(false);
+
+  const sync = useCallback(() => {
+    if (preRef.current && taRef.current) {
+      preRef.current.scrollLeft = taRef.current.scrollLeft;
+      preRef.current.scrollTop = taRef.current.scrollTop;
+    }
+  }, []);
+
+  const suggestions = useMemo(() => {
+    if (!ctx) return [];
+    return filterSuggestions(ctx, labelNames, labelValues, mappingFields);
+  }, [ctx, labelNames, labelValues, mappingFields]);
+
+  const updateContext = useCallback(() => {
+    const el = taRef.current;
+    if (!el) return;
+    const next = detectAutocompleteContext(value, el.selectionStart, engine);
+    setCtx(next);
+    setOpen(!!next);
+    setActiveIdx(0);
+    if (next?.kind === 'value' && next.labelName) {
+      onRequestLabelValues?.(next.labelName);
+    }
+  }, [value, engine, onRequestLabelValues]);
+
+  const pickSuggestion = useCallback((s: string) => {
+    if (!ctx) return;
+    const { text, cursor } = applySuggestion(value, ctx, s);
+    onChange(text);
+    setOpen(false);
+    setCtx(null);
+    requestAnimationFrame(() => {
+      const el = taRef.current;
+      if (el) {
+        el.focus();
+        el.selectionStart = el.selectionEnd = cursor;
+      }
+    });
+  }, [ctx, value, onChange]);
+
+  const onKeyDown = (e: React.KeyboardEvent<HTMLTextAreaElement>) => {
+    if (open && suggestions.length > 0) {
+      if (e.key === 'ArrowDown') {
+        e.preventDefault();
+        setActiveIdx((i) => Math.min(i + 1, suggestions.length - 1));
+        return;
+      }
+      if (e.key === 'ArrowUp') {
+        e.preventDefault();
+        setActiveIdx((i) => Math.max(i - 1, 0));
+        return;
+      }
+      if (e.key === 'Enter' || e.key === 'Tab') {
+        e.preventDefault();
+        pickSuggestion(suggestions[activeIdx]);
+        return;
+      }
+      if (e.key === 'Escape') {
+        setOpen(false);
+        return;
+      }
+    }
+    if (e.key === 'Tab' && !open) {
+      e.preventDefault();
+      const t = e.currentTarget;
+      const s = t.selectionStart;
+      const ed = t.selectionEnd;
+      onChange(value.slice(0, s) + '  ' + value.slice(ed));
+      requestAnimationFrame(() => { t.selectionStart = t.selectionEnd = s + 2; });
+    }
+    if (e.key === ' ' && e.ctrlKey) {
+      e.preventDefault();
+      updateContext();
+    }
+  };
+
+  useEffect(() => {
+    if (!open) return;
+    updateContext();
+  }, [value, open, updateContext]);
+
+  const html = useMemo(() => highlightSyntax(value, engine), [value, engine]);
+
+  return (
+    <div className="relative flex-1 min-w-[120px]">
+      <div
+        className="relative"
+        style={{ height: '40px', background: 'var(--dg-bg-tertiary)', border: '1px solid var(--dg-border)', borderRadius: '0.25rem' }}
+      >
+        <textarea
+          ref={taRef}
+          value={value}
+          onChange={(e) => { onChange(e.target.value); updateContext(); }}
+          onScroll={sync}
+          onKeyDown={onKeyDown}
+          onClick={updateContext}
+          onFocus={updateContext}
+          spellCheck={false}
+          autoComplete="off"
+          rows={1}
+          className="absolute inset-0 w-full h-full font-mono text-xs rounded resize-none outline-none overflow-auto whitespace-pre-wrap break-all px-3 py-2.5"
+          style={{ background: 'transparent', color: 'transparent', caretColor: 'var(--dg-text-primary)', lineHeight: '20px', zIndex: 1 }}
+          placeholder={placeholder}
+        />
+        <pre
+          ref={preRef}
+          className="absolute inset-0 m-0 font-mono text-xs rounded pointer-events-none overflow-hidden whitespace-pre-wrap break-all px-3 py-2.5"
+          style={{ background: 'transparent', lineHeight: '20px', color: 'var(--dg-text-primary)', zIndex: 2 }}
+          dangerouslySetInnerHTML={{ __html: html }}
+        />
+        {!value && (
+          <div className="absolute inset-0 flex items-center px-3 pointer-events-none" style={{ zIndex: 3 }}>
+            <span className="text-xs font-mono" style={{ color: 'var(--dg-text-muted)' }}>{placeholder}</span>
+          </div>
+        )}
+      </div>
+      {open && suggestions.length > 0 && (
+        <div
+          className="absolute left-0 right-0 top-full mt-1 z-50 max-h-40 overflow-y-auto rounded border shadow-lg"
+          style={{ background: 'var(--dg-bg-secondary)', borderColor: 'var(--dg-border)' }}
+        >
+          {suggestions.map((s, i) => (
+            <button
+              key={`${s}-${i}`}
+              type="button"
+              onMouseDown={(e) => { e.preventDefault(); pickSuggestion(s); }}
+              className="w-full text-left px-3 py-1.5 text-xs font-mono truncate"
+              style={{
+                color: i === activeIdx ? 'var(--dg-blue)' : 'var(--dg-text-secondary)',
+                background: i === activeIdx ? 'var(--dg-bg-tertiary)' : 'transparent',
+              }}
+            >
+              {s}
+            </button>
+          ))}
+        </div>
+      )}
+    </div>
+  );
+}

frontend/src/components/monitor/log-center/QuickQueryBar.tsx

@@ -0,0 +1,65 @@
+import { useState } from 'react';
+import { ChevronDown } from 'lucide-react';
+
+const ALL_TEMPLATES: Record<'loki' | 'elasticsearch', { label: string; query: string }[]> = {
+  loki: [
+    { label: 'Nginx 错误', query: '{job="nginx"} |= "error"' },
+    { label: 'JSON 过滤', query: '{namespace="prod"} | json | level="warn"' },
+    { label: '超时搜索', query: '{app="api"} |= "timeout"' },
+    { label: '级别统计', query: 'sum by(level) (count_over_time({job="app"}[5m]))' },
+    { label: '正则多级别', query: '{container="frontend"} |~ "ERROR|WARN|FATAL"' },
+    { label: '慢请求>1s', query: '{job="api"} | json | response_time > 1000' },
+    { label: '错误率统计', query: 'sum by(level) (count_over_time({app="cex-admin-api"} |= "error" [5m]))' },
+    { label: '追踪ID查询', query: '{app="cex-admin-api"} |= "trace_id" | json' },
+    { label: '服务聚合', query: 'sum by(service_name) (count_over_time({namespace="astralx"}[5m]))' },
+    { label: '高延迟筛选', query: '{app="cex-admin-api"} | json | response_time > 500' },
+    { label: '异常堆栈', query: '{app="cex-admin-api"} |= "Exception"' },
+    { label: '日志趋势', query: 'sum(count_over_time({app="cex-admin-api"}[1h]))' },
+    { label: '正则提取', query: '{app="cex-admin-api"} | regexp "(?P<method>[A-Za-z0-9_]+) (?P<path>[^ ]+)"' },
+    { label: '格式输出', query: '{app="cex-admin-api"} | json | line_format "{{.level}} {{.message}}"' },
+  ],
+  elasticsearch: [
+    { label: 'API 5xx', query: 'status:500 AND path:"/api/*"' },
+    { label: '错误超时', query: '(level:error OR log.level:error) AND message:*timeout*' },
+    { label: '排除调试', query: 'host.name:server-* AND NOT level:debug' },
+    { label: '慢请求', query: 'response_time:>1000 AND method:POST' },
+    { label: '严重错误', query: '@timestamp:[now-1h TO now] AND (level:critical OR log.level:critical)' },
+    { label: '服务错误', query: 'service:nginx AND (level:(error OR fatal) OR log.level:(error OR fatal))' },
+    { label: '组合查询', query: 'app:cex-admin-api AND (level:(error OR warn) OR log.level:(error OR warn))' },
+    { label: '模糊匹配', query: 'message:*timeout* AND app:cex-admin-api' },
+    { label: '范围查询', query: 'response_time:[1000 TO *] AND method:POST' },
+    { label: '排除路径', query: 'app:cex-admin-api AND NOT path:/health' },
+    { label: '时间过滤', query: '@timestamp:[now-1h TO now] AND level:error' },
+    { label: 'IP段过滤', query: 'client_ip:172.36.* AND app:cex-admin-api' },
+    { label: '多级别筛选', query: 'app:cex-admin-api AND (level:(error OR warn OR info) OR log.level:(error OR warn OR info))' },
+    { label: '嵌套字段', query: 'labels.orgId:10001 AND app:cex-admin-api' },
+  ],
+};
+
+// 快捷查询模板条 // Logan.Li
+export function QuickQueryBar({ engine, onSelect }: { engine: 'loki' | 'elasticsearch'; onSelect: (q: string) => void }) {
+  const [open, setOpen] = useState(false);
+  const templates = ALL_TEMPLATES[engine];
+  const labels: Record<'loki' | 'elasticsearch', string> = { loki: 'LogQL', elasticsearch: 'Lucene' };
+  return (
+    <div>
+      <button onClick={() => setOpen(!open)} className="flex items-center gap-1 text-[11px] px-2 py-1 rounded transition-colors" style={{ color: 'var(--dg-blue)', background: open ? 'var(--dg-bg-tertiary)' : 'transparent' }}>
+        <span className="w-1.5 h-1.5 rounded-full" style={{ background: 'var(--dg-blue)' }} />
+        {labels[engine]} 快捷查询模板
+        <ChevronDown className="h-3 w-3" style={{ transform: open ? 'rotate(0deg)' : 'rotate(-90deg)', transition: 'transform 0.2s' }} />
+      </button>
+      {open && (
+        <div className="mt-1.5 p-2.5 rounded-lg border" style={{ background: 'var(--dg-bg-secondary)', borderColor: 'var(--dg-border)' }}>
+          <div className="grid grid-cols-3 lg:grid-cols-4 gap-1.5">
+            {templates.map((t) => (
+              <button key={t.label} onClick={() => { onSelect(t.query); setOpen(false); }} className="text-left px-2 py-1.5 rounded border text-[11px] transition-all hover:opacity-80" style={{ background: 'var(--dg-bg-tertiary)', borderColor: 'var(--dg-border)', color: 'var(--dg-text-secondary)' }} title={t.query}>
+                <span className="font-medium block truncate" style={{ color: 'var(--dg-text-primary)' }}>{t.label}</span>
+                <span className="block truncate opacity-60 font-mono mt-0.5 text-[10px]">{t.query}</span>
+              </button>
+            ))}
+          </div>
+        </div>
+      )}
+    </div>
+  );
+}

frontend/src/components/monitor/log-center/SaveQueryDialog.tsx

@@ -4,7 +4,7 @@ import { X, Save, BellRing, Loader2 } from 'lucide-react';
 import { alertApi } from '@/api';
 import { useToast } from '@/hooks/use-toast';
 import type { LogEngine, TimeRange } from './types-v3';
-import { ENGINE_META } from './types-v3';
+import { ENGINE_META, savedQueryStorage } from './types-v3';
 
 interface SaveQueryProps {
   open: boolean;
@@ -12,11 +12,12 @@ interface SaveQueryProps {
   engine: LogEngine;
   query: string;
   timeRange: TimeRange;
+  datasourceId?: number;
   datasourceName?: string;
   onSave?: (name: string) => void;
 }
 
-export function SaveQueryDialog({ open, onClose, engine, query, timeRange, datasourceName, onSave }: SaveQueryProps) {
+export function SaveQueryDialog({ open, onClose, engine, query, timeRange, datasourceId, datasourceName, onSave }: SaveQueryProps) {
   const [name, setName] = useState('');
   const [saving, setSaving] = useState(false);
   const [saved, setSaved] = useState(false);
@@ -24,9 +25,20 @@ export function SaveQueryDialog({ open, onClose, engine, query, timeRange, datas
   if (!open) return null;
 
   const handleSave = () => {
-    if (!name.trim()) return;
+    if (!name.trim() || !datasourceId) return;
     setSaving(true);
-    setTimeout(() => { setSaving(false); setSaved(true); onSave?.(name); setTimeout(() => { setSaved(false); onClose(); }, 800); }, 500);
+    savedQueryStorage.add({
+      name: name.trim(),
+      engine,
+      datasourceId,
+      query,
+      queryType: 'logs',
+      timeRangeLabel: timeRange.label,
+    });
+    setSaving(false);
+    setSaved(true);
+    onSave?.(name.trim());
+    setTimeout(() => { setSaved(false); setName(''); onClose(); }, 600);
   };
 
   return (

frontend/src/components/monitor/log-center/SavedQueriesPanel.tsx

@@ -0,0 +1,88 @@
+import { useState, useEffect } from 'react';
+import { X, Trash2, Play, Bookmark, Clock } from 'lucide-react';
+import type { SavedQuery } from './types-v3';
+import { savedQueryStorage } from './types-v3';
+import { ENGINE_META } from './types-v3';
+
+interface Props {
+  visible: boolean;
+  onClose: () => void;
+  onSelect: (item: SavedQuery) => void;
+}
+
+// 已保存查询面板（localStorage）// Logan.Li
+export function SavedQueriesPanel({ visible, onClose, onSelect }: Props) {
+  const [items, setItems] = useState<SavedQuery[]>([]);
+
+  useEffect(() => {
+    if (visible) setItems(savedQueryStorage.getAll());
+  }, [visible]);
+
+  if (!visible) return null;
+
+  return (
+    <>
+      <div className="fixed inset-0 z-40" style={{ background: 'rgba(0,0,0,0.3)' }} onClick={onClose} />
+      <div
+        className="fixed right-0 top-0 h-full z-50 border-l flex flex-col"
+        style={{ width: '380px', background: 'var(--dg-bg-secondary)', borderColor: 'var(--dg-border)' }}
+      >
+        <div className="flex items-center justify-between px-4 py-3 border-b" style={{ borderColor: 'var(--dg-border)' }}>
+          <div className="flex items-center gap-2">
+            <Bookmark className="h-4 w-4" style={{ color: 'var(--dg-blue)' }} />
+            <span className="text-sm font-medium" style={{ color: 'var(--dg-text-primary)' }}>已保存查询</span>
+            <span className="text-[10px] px-1.5 py-0.5 rounded" style={{ background: 'var(--dg-bg-tertiary)', color: 'var(--dg-text-muted)' }}>
+              {items.length}
+            </span>
+          </div>
+          <button onClick={onClose} className="h-7 w-7 flex items-center justify-center" style={{ color: 'var(--dg-text-muted)' }}>
+            <X className="h-4 w-4" />
+          </button>
+        </div>
+        <div className="flex-1 overflow-y-auto p-3 space-y-2">
+          {items.length === 0 ? (
+            <p className="text-xs text-center py-8" style={{ color: 'var(--dg-text-muted)' }}>暂无保存的查询</p>
+          ) : items.map((item) => (
+            <div
+              key={item.id}
+              className="p-3 rounded-lg border group"
+              style={{ background: 'var(--dg-bg-tertiary)', borderColor: 'var(--dg-border)' }}
+            >
+              <div className="flex items-start justify-between gap-2">
+                <div className="min-w-0 flex-1">
+                  <p className="text-sm font-medium truncate" style={{ color: 'var(--dg-text-primary)' }}>{item.name}</p>
+                  <p className="text-[10px] mt-0.5" style={{ color: ENGINE_META[item.engine]?.color || 'var(--dg-text-muted)' }}>
+                    {ENGINE_META[item.engine]?.name} · {item.timeRangeLabel}
+                  </p>
+                  <p className="text-[11px] font-mono mt-1 truncate" style={{ color: 'var(--dg-text-secondary)' }}>{item.query}</p>
+                  <p className="text-[10px] mt-1 flex items-center gap-1" style={{ color: 'var(--dg-text-muted)' }}>
+                    <Clock className="h-3 w-3" />
+                    {new Date(item.createdAt).toLocaleString()}
+                  </p>
+                </div>
+                <div className="flex flex-col gap-1 opacity-80 group-hover:opacity-100">
+                  <button
+                    onClick={() => { onSelect(item); onClose(); }}
+                    className="h-7 w-7 flex items-center justify-center rounded border"
+                    style={{ borderColor: 'var(--dg-border)', color: '#22c55e' }}
+                    title="应用"
+                  >
+                    <Play className="h-3.5 w-3.5" />
+                  </button>
+                  <button
+                    onClick={() => { savedQueryStorage.remove(item.id); setItems(savedQueryStorage.getAll()); }}
+                    className="h-7 w-7 flex items-center justify-center rounded border"
+                    style={{ borderColor: 'var(--dg-border)', color: 'var(--dg-text-muted)' }}
+                    title="删除"
+                  >
+                    <Trash2 className="h-3.5 w-3.5" />
+                  </button>
+                </div>
+              </div>
+            </div>
+          ))}
+        </div>
+      </div>
+    </>
+  );
+}

frontend/src/components/monitor/log-center/UnifiedQueryPanel.tsx

@@ -1,6 +1,7 @@
 // UnifiedQueryPanel.tsx — 统一查询面板（接入真实 API）// Logan.Li
 import { useState, useMemo, useCallback, useRef, useEffect } from 'react';
-import { Play, Loader2, Clock, Save, ChevronDown, Bell } from 'lucide-react';
+import { useSearchParams, useLocation } from 'react-router-dom';
+import { Play, Loader2, Clock, Save, ChevronDown, Bell, Link2, Bookmark, Radio } from 'lucide-react';
 import { AreaChart, Area, XAxis, YAxis, CartesianGrid, Tooltip, ResponsiveContainer } from 'recharts';
 import { TimeRangePicker } from './TimeRangePicker';
 import { LogFieldSidebar } from './LogFieldSidebar';
@@ -10,9 +11,18 @@ import { StatChartPanel } from './StatChartPanel';
 import { LogClusterPanel } from './LogClusterPanel';
 import { SaveQueryDialog, SaveAlertDialog } from './SaveQueryDialog';
 import { QueryHistoryPanel } from './QueryHistoryPanel';
+import { SavedQueriesPanel } from './SavedQueriesPanel';
 import { LogAlertFromQueryDialog } from './LogAlertFromQueryDialog';
-import { logCenterApi, type LogDataSource } from '@/api';
-import type { LogEngine, TimeRange, ResultTab, ViewMode, LogEntry, StatTable, LogCluster, QueryHistoryItem } from './types-v3';
+import { QueryAutocompleteInput } from './QueryAutocompleteInput';
+import { QuickQueryBar } from './QuickQueryBar';
+import { parseLogQueryUrl, buildLogQueryParams, buildShareUrl } from './query-url-state';
+import { logCenterApi, type LogDataSource, type LogQueryEntry } from '@/api';
+import { copyToClipboard } from '@/utils/clipboard';
+import { buildLogCopyText, formatHistogramCount, formatHistogramTick, formatLogTimestamp } from './log-format';
+import { EsIndexPicker } from './EsIndexPicker';
+import { LokiLabelBrowser } from './LokiLabelBrowser';
+import { applyESFieldFilter, applyLokiLabelFilter, extractLokiSelector } from './query-builder';
+import type { LogEngine, TimeRange, ResultTab, ViewMode, LogEntry, LogField, StatTable, LogCluster, QueryHistoryItem, SavedQuery } from './types-v3';
 import { ENGINE_META, buildStatTableFromEntries, buildClustersFromEntries, extractFields, generateHistogramData, historyStorage } from './types-v3';
 import { useToast } from '@/hooks/use-toast';
 
@@ -37,104 +47,14 @@ const ENGINE_BADGE: Record<'loki' | 'elasticsearch', { label: string; dotColor:
   elasticsearch: { label: 'Lucene', dotColor: '#22c55e' },
 };
 
-// 增强快捷查询模板（14+ 条/引擎） // Logan.Li
-const ALL_TEMPLATES: Record<'loki' | 'elasticsearch', { label: string; query: string }[]> = {
-  loki: [
-    { label: 'Nginx 错误', query: '{job="nginx"} |= "error"' },
-    { label: 'JSON 过滤', query: '{namespace="prod"} | json | level="warn"' },
-    { label: '超时搜索', query: '{app="api"} |= "timeout"' },
-    { label: '级别统计', query: 'sum by(level) (count_over_time({job="app"}[5m]))' },
-    { label: '正则多级别', query: '{container="frontend"} |~ "ERROR|WARN|FATAL"' },
-    { label: '慢请求>1s', query: '{job="api"} | json | response_time > 1000' },
-    { label: '错误率统计', query: 'sum by(level) (count_over_time({app="cex-admin-api"} |= "error" [5m]))' },
-    { label: '追踪ID查询', query: '{app="cex-admin-api"} |= "trace_id" | json' },
-    { label: '服务聚合', query: 'sum by(service_name) (count_over_time({namespace="astralx"}[5m]))' },
-    { label: '高延迟筛选', query: '{app="cex-admin-api"} | json | response_time > 500' },
-    { label: '异常堆栈', query: '{app="cex-admin-api"} |= "Exception"' },
-    { label: '日志趋势', query: 'sum(count_over_time({app="cex-admin-api"}[1h]))' },
-    { label: '正则提取', query: '{app="cex-admin-api"} | regexp "(?P<method>[A-Za-z0-9_]+) (?P<path>[^ ]+)"' }, // LogQL regexp 用 RE2，不支持 \w \S 等 Perl 简写，须用显式字符类，否则 Loki 返回 400 invalid char escape // Logan.Li
-    { label: '格式输出', query: '{app="cex-admin-api"} | json | line_format "{{.level}} {{.message}}"' },
-  ],
-  elasticsearch: [
-    { label: 'API 5xx', query: 'status:500 AND path:"/api/*"' },
-    { label: '错误超时', query: 'level:error AND message:*timeout*' },
-    { label: '排除调试', query: 'host.name:server-* AND NOT level:debug' },
-    { label: '慢请求', query: 'response_time:>1000 AND method:POST' },
-    { label: '严重错误', query: '@timestamp:[now-1h TO now] AND level:critical' },
-    { label: '服务错误', query: 'service:nginx AND (level:error OR level:fatal)' },
-    { label: '组合查询', query: 'app:cex-admin-api AND (level:error OR level:warn)' },
-    { label: '模糊匹配', query: 'message:*timeout* AND app:cex-admin-api' },
-    { label: '范围查询', query: 'response_time:[1000 TO *] AND method:POST' },
-    { label: '排除路径', query: 'app:cex-admin-api AND NOT path:/health' },
-    { label: '时间过滤', query: '@timestamp:[now-1h TO now] AND level:error' },
-    { label: 'IP段过滤', query: 'client_ip:172.36.* AND app:cex-admin-api' },
-    { label: '聚合统计', query: 'app:cex-admin-api | STATS count(*) by level' },
-    { label: '嵌套字段', query: 'labels.orgId:10001 AND app:cex-admin-api' },
-  ],
-};
-
-// LogQL / Lucene 语法高亮 → HTML // Logan.Li
-function highlightSyntax(query: string, engine: 'loki' | 'elasticsearch'): string {
-  if (!query) return '<span style="color:transparent">.</span>';
-  // 先转义 HTML 特殊字符，避免查询语句中的 < > & 破坏标签结构 // Logan.Li
-  const esc = query.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
-  const span = (color: string, text: string) => `<span style="color:${color}">${text}</span>`;
-  if (engine === 'loki') {
-    // 单正则 + 回调：一次匹配，避免链式 replace 对已生成颜色值的二次匹配 // Logan.Li
-    return esc.replace(
-      /("(?:[^"\\]|\\.)*")|([a-zA-Z_][\w-]*)(?==)|(\|json|\|regexp|\|line_format|\|unwrap|\|pattern|\|label_format)|\b(count_over_time|sum|rate|avg|max|min|count|by|over)\b|([{}])|(\|=|\!=|=~|!~|=)/g,
-      (m, str, ident, pipe, fn, brace, op) => {
-        if (str) return span('#22c55e', str);
-        if (ident) return span('#f59e0b', ident);
-        if (pipe) return span('#8b5cf6', pipe);
-        if (fn) return span('#06b6d4', fn);
-        if (brace) return span('#f59e0b', brace);
-        if (op) return span('#f43f5e', op);
-        return m;
-      },
-    ) + '<span style="color:transparent">.</span>';
-  }
-  return esc.replace(
-    /("(?:[^"\\]|\\.)*")|\b(AND|OR|NOT)\b|([a-zA-Z_@][\w.-]*)(?=:)|([*?~^[\]()])/g,
-    (m, str, kw, field, punct) => {
-      if (str) return span('#22c55e', str);
-      if (kw) return span('#f43f5e', kw);
-      if (field) return span('#f59e0b', field);
-      if (punct) return span('#8b5cf6', punct);
-      return m;
-    },
-  ) + '<span style="color:transparent">.</span>';
-}
-
-// 语法高亮输入框：底层高亮 + 上层透明输入 // Logan.Li
-function SyntaxHighlightInput({ value, onChange, engine, placeholder }: {
-  value: string; onChange: (v: string) => void; engine: 'loki' | 'elasticsearch'; placeholder?: string;
-}) {
-  const taRef = useRef<HTMLTextAreaElement>(null);
-  const preRef = useRef<HTMLPreElement>(null);
-  const sync = useCallback(() => {
-    if (preRef.current && taRef.current) { preRef.current.scrollLeft = taRef.current.scrollLeft; preRef.current.scrollTop = taRef.current.scrollTop; }
-  }, []);
-  const onKey = (e: React.KeyboardEvent<HTMLTextAreaElement>) => {
-    if (e.key === 'Tab') { e.preventDefault(); const t = e.currentTarget, s = t.selectionStart, ed = t.selectionEnd; onChange(value.slice(0, s) + '  ' + value.slice(ed)); requestAnimationFrame(() => { t.selectionStart = t.selectionEnd = s + 2; }); }
-  };
-  const html = useMemo(() => highlightSyntax(value, engine), [value, engine]);
-  return (
-    <div className="relative flex-1 min-w-[120px]" style={{ height: '40px', background: 'var(--dg-bg-tertiary)', border: '1px solid var(--dg-border)', borderRadius: '0.25rem' }}>
-      <textarea ref={taRef} value={value} onChange={e => onChange(e.target.value)} onScroll={sync} onKeyDown={onKey} spellCheck={false} autoComplete="off" rows={1}
-        className="absolute inset-0 w-full h-full font-mono text-xs rounded resize-none outline-none overflow-auto whitespace-pre-wrap break-all px-3 py-2.5"
-        style={{ background: 'transparent', color: 'transparent', caretColor: 'var(--dg-text-primary)', lineHeight: '20px', zIndex: 1 }}
-        placeholder={placeholder} />
-      <pre ref={preRef} className="absolute inset-0 m-0 font-mono text-xs rounded pointer-events-none overflow-hidden whitespace-pre-wrap break-all px-3 py-2.5" style={{ background: 'transparent', lineHeight: '20px', color: 'var(--dg-text-primary)', zIndex: 2 }} dangerouslySetInnerHTML={{ __html: html }} />
-      {!value && <div className="absolute inset-0 flex items-center px-3 pointer-events-none" style={{ zIndex: 3 }}><span className="text-xs font-mono" style={{ color: 'var(--dg-text-muted)' }}>{placeholder}</span></div>}
-    </div>
-  );
-}
-
 interface Props { engine: LogEngine; onRuleCreated: () => void; }
 
 export function UnifiedQueryPanel({ engine, onRuleCreated }: Props) {
   const { toast } = useToast();
+  const location = useLocation();
+  const [searchParams, setSearchParams] = useSearchParams();
+  const urlBootstrapped = useRef(false);
+  const autoRunDone = useRef(false);
   const effEngine: 'loki' | 'elasticsearch' = engine === 'sls' ? 'loki' : engine;
   const meta = ENGINE_META[effEngine];
   const badge = ENGINE_BADGE[effEngine];
@@ -164,8 +84,8 @@ export function UnifiedQueryPanel({ engine, onRuleCreated }: Props) {
   const [queryTime, setQueryTime] = useState(0);
   const [resultTab, setResultTab] = useState<ResultTab>('logs');
   const [viewMode, setViewMode] = useState<ViewMode>('raw');
-  const [wrapLines, setWrapLines] = useState(false);
-  const [truncate, setTruncate] = useState(true);
+  const [wrapLines, setWrapLines] = useState(true);
+  const [truncate, setTruncate] = useState(false);
   const [selectedFields, setSelectedFields] = useState<string[]>([]);
   const [page, setPage] = useState(1);
   const [perPage, setPerPage] = useState(20);
@@ -176,17 +96,74 @@ export function UnifiedQueryPanel({ engine, onRuleCreated }: Props) {
   const [alertDialogOpen, setAlertDialogOpen] = useState(false);
   const [saveMenuOpen, setSaveMenuOpen] = useState(false);
   const [hasQueried, setHasQueried] = useState(false);
+  const [hasMore, setHasMore] = useState(false);
+  const [nextCursor, setNextCursor] = useState('');
+  const [searchAfter, setSearchAfter] = useState<unknown[] | undefined>();
+  const [loadingMore, setLoadingMore] = useState(false);
+  const [liveTail, setLiveTail] = useState(false);
+  const [savedPanelOpen, setSavedPanelOpen] = useState(false);
+  const [labelNames, setLabelNames] = useState<string[]>([]);
+  const [labelValues, setLabelValues] = useState<string[]>([]);
+  const [indexedFields, setIndexedFields] = useState<LogField[]>([]);
 
-  // 数据源加载后选中默认或首个（无源时保持空），并同步 ES 默认索引 // Logan.Li
+  const timeIsoParams = useCallback(() => ({
+    start: timeRange.start.replace(' ', 'T'),
+    end: timeRange.end.replace(' ', 'T'),
+  }), [timeRange]);
+
+  const currentSource = sources.find((s) => String(s.id) === dsId);
+
+  // 数据源加载后选中默认或首个；首次从 URL 恢复查询状态 // Logan.Li
   useEffect(() => {
-    if (sources.length > 0) {
-      const def = sources.find(s => s.is_default) || sources[0];
+    if (sources.length === 0) return;
+    if (!urlBootstrapped.current) {
+      const parsed = parseLogQueryUrl(searchParams);
+      const def = sources.find((s) => String(s.id) === parsed.datasourceId)
+        || sources.find((s) => s.is_default) || sources[0];
       setDsId(String(def.id));
-      setEsIndex(def.default_index || '');
+      setEsIndex(parsed.index || def.default_index || '');
+      if (parsed.query) setQuery(parsed.query);
+      if (parsed.timeRange) setTimeRange(parsed.timeRange);
+      urlBootstrapped.current = true;
+      return;
     }
-  }, [sources]);
+    const def = sources.find((s) => String(s.id) === dsId) || sources.find((s) => s.is_default) || sources[0];
+    if (!dsId && def) setDsId(String(def.id));
+  }, [sources, searchParams, dsId]);
 
-  const currentSource = sources.find(s => String(s.id) === dsId);
+  // 查询状态同步到 URL（可分享）// Logan.Li
+  useEffect(() => {
+    if (!urlBootstrapped.current) return;
+    const p = buildLogQueryParams({
+      query,
+      datasourceId: dsId || undefined,
+      index: esIndex || undefined,
+      timeRange,
+    });
+    setSearchParams(p, { replace: true });
+  }, [query, dsId, esIndex, timeRange, setSearchParams]);
+
+  // Loki 标签名（自动补全）// Logan.Li
+  useEffect(() => {
+    if (effEngine !== 'loki' || !currentSource?.id) return;
+    logCenterApi.listLokiLabels(currentSource.id, timeIsoParams())
+      .then((res) => setLabelNames(Array.isArray(res) ? res : []))
+      .catch(() => setLabelNames([]));
+  }, [effEngine, currentSource?.id, timeIsoParams]);
+
+  // ES mapping 索引字段（Kibana 风格侧栏）// Logan.Li
+  useEffect(() => {
+    if (effEngine !== 'elasticsearch' || !currentSource?.id) return;
+    logCenterApi.esMapping({ datasource_id: currentSource.id, index: esIndex || undefined })
+      .then((res) => {
+        const list = Array.isArray(res) ? res : [];
+        setIndexedFields(list.map((f) => ({
+          name: f.name,
+          type: (['keyword', 'long', 'date', 'boolean', 'ip'].includes(f.type) ? f.type : 'text') as LogField['type'],
+        })));
+      })
+      .catch(() => setIndexedFields([]));
+  }, [effEngine, currentSource?.id, esIndex]);
 
   const fields = useMemo(() => extractFields(entries), [entries]);
   const commonLabels = useMemo(() => extractCommonLabels(entries), [entries]);
@@ -194,55 +171,92 @@ export function UnifiedQueryPanel({ engine, onRuleCreated }: Props) {
   const totalPages = Math.max(1, Math.ceil(sortedEntries.length / perPage));
   const pagedEntries = useMemo(() => { const s = (page - 1) * perPage; return sortedEntries.slice(s, s + perPage); }, [sortedEntries, page, perPage]);
 
+  const mapRawEntries = useCallback((rawEntries: LogQueryEntry[]): LogEntry[] => rawEntries.map((e) => {
+    const raw = String(e.raw || e.message || '');
+    let level = String(e.level || e.labels?.detected_level || e.labels?.level || '');
+    if (!level && effEngine === 'elasticsearch' && raw) {
+      try {
+        const parsed = JSON.parse(raw) as Record<string, unknown>;
+        level = String(parsed.level || parsed['log.level'] || (parsed.log as Record<string, unknown>)?.level || '');
+      } catch { /* 非 JSON */ }
+    }
+    if (!level) {
+      const levelMatch = raw.match(/\s(INFO|WARN|WARNING|ERROR|DEBUG|TRACE|FATAL)\s/i);
+      if (levelMatch) level = levelMatch[1].toLowerCase();
+    }
+    const labels = e.labels || {};
+    return {
+      timestamp: formatLogTimestamp(e.timestamp || ''),
+      level,
+      message: String(e.message || raw),
+      labels,
+      raw,
+      source: labels.app || labels.service_name || '',
+    };
+  }), [effEngine]);
+
+  const fetchHistogram = useCallback(async (dsIdNum: number, startISO: string, endISO: string) => {
+    try {
+      if (effEngine === 'loki') {
+        const res = await logCenterApi.lokiHistogram({ datasource_id: dsIdNum, query, start: startISO, end: endISO });
+        const buckets = res?.buckets || [];
+        if (buckets.length > 0) {
+          setHistogramData(buckets.map((b) => ({
+            timestamp: formatLogTimestamp(b.timestamp),
+            count: b.count,
+          })));
+          return;
+        }
+      } else {
+        const res = await logCenterApi.esHistogram({
+          datasource_id: dsIdNum, query, index: esIndex || undefined, start: startISO, end: endISO,
+        });
+        const buckets = res?.buckets || [];
+        if (buckets.length > 0) {
+          setHistogramData(buckets.map((b) => ({
+            timestamp: formatLogTimestamp(b.timestamp),
+            count: b.count,
+          })));
+          return;
+        }
+      }
+    } catch { /* 直方图失败时回退客户端聚合 */ }
+  }, [effEngine, query, esIndex]);
+
   // 执行查询 — 接入真实 API（无 mock）// Logan.Li
   const handleRun = useCallback(async () => {
     // 空查询兜底：后端 Query 字段 required，空值会 400，这里提前拦截 // Logan.Li
     if (!currentSource || !query.trim()) return;
     const dsIdNum = currentSource.id;
     setLoading(true);
+    setHasMore(false);
+    setNextCursor('');
+    setSearchAfter(undefined);
     const t0 = performance.now();
 
     try {
       const startISO = (timeRange.start + (timeRange.start.includes('T') ? '' : '.000Z')).replace(' ', 'T');
       const endISO = (timeRange.end + (timeRange.end.includes('T') ? '' : '.000Z')).replace(' ', 'T');
-      let result: any;
 
-      if (effEngine === 'loki') {
-        result = await logCenterApi.queryLoki({
-          datasource_id: dsIdNum,
-          query,
-          limit: queryLimit,
-          start: startISO,
-          end: endISO,
-          direction: 'backward',
+      const data = effEngine === 'loki'
+        ? await logCenterApi.queryLoki({
+          datasource_id: dsIdNum, query, limit: queryLimit, start: startISO, end: endISO, direction: 'backward',
+        })
+        : await logCenterApi.queryElasticsearch({
+          datasource_id: dsIdNum, index: esIndex || undefined, query, size: queryLimit, start: startISO, end: endISO,
         });
-      } else {
-        result = await logCenterApi.queryElasticsearch({
-          datasource_id: dsIdNum,
-          index: esIndex || undefined,
-          query,
-          size: queryLimit,
-          start: startISO,
-          end: endISO,
-        });
-      }
 
-      const data = (result as any)?.data || result;
-      const rawEntries: any[] = data?.entries || [];
-      const mapped: LogEntry[] = rawEntries.map((e: any) => ({
-        timestamp: e.timestamp || '',
-        level: e.level || '',
-        message: e.message || '',
-        labels: e.labels || {},
-        raw: e.raw || e.message || '',
-        source: e.labels?.app || e.labels?.service_name || '',
-      }));
+      const rawEntries = data?.entries || [];
+      const mapped = mapRawEntries(rawEntries);
 
       setEntries(mapped);
+      void fetchHistogram(dsIdNum, startISO, endISO);
       setHistogramData(generateHistogramData(mapped));
-      setTotalCount(data?.total || mapped.length);
+      setTotalCount(data?.total ?? mapped.length);
+      setHasMore(!!data?.has_more);
+      setNextCursor(data?.next_cursor || '');
+      setSearchAfter(data?.search_after);
       setQueryTime(Math.round(performance.now() - t0));
-      // 统计图表 / 聚类基于真实返回条目聚合（无 mock）// Logan.Li
       setStatTable(buildStatTableFromEntries(mapped));
       setClusters(buildClustersFromEntries(mapped));
       setPage(1);
@@ -259,7 +273,139 @@ export function UnifiedQueryPanel({ engine, onRuleCreated }: Props) {
     } finally {
       setLoading(false);
     }
-  }, [effEngine, query, currentSource, timeRange, toast, queryLimit, esIndex]);
+  }, [effEngine, query, currentSource, timeRange, toast, queryLimit, esIndex, mapRawEntries, fetchHistogram]);
+
+  const handleLoadMore = useCallback(async () => {
+    if (!currentSource || !hasMore || loadingMore) return;
+    setLoadingMore(true);
+    try {
+      const startISO = (timeRange.start + (timeRange.start.includes('T') ? '' : '.000Z')).replace(' ', 'T');
+      const endISO = (timeRange.end + (timeRange.end.includes('T') ? '' : '.000Z')).replace(' ', 'T');
+      const dsIdNum = currentSource.id;
+      const data = effEngine === 'loki'
+        ? await logCenterApi.queryLoki({
+          datasource_id: dsIdNum, query, limit: queryLimit, start: startISO, end: endISO,
+          direction: 'backward', cursor: nextCursor,
+        })
+        : await logCenterApi.queryElasticsearch({
+          datasource_id: dsIdNum, index: esIndex || undefined, query, size: queryLimit,
+          start: startISO, end: endISO, search_after: searchAfter,
+        });
+      const more = mapRawEntries(data?.entries || []);
+      setEntries((prev) => {
+        const merged = [...prev, ...more];
+        setStatTable(buildStatTableFromEntries(merged));
+        setClusters(buildClustersFromEntries(merged));
+        return merged;
+      });
+      setHasMore(!!data?.has_more);
+      setNextCursor(data?.next_cursor || '');
+      setSearchAfter(data?.search_after);
+    } catch (e: unknown) {
+      toast({ title: '加载更多失败', description: (e as Error)?.message, variant: 'destructive' });
+    } finally {
+      setLoadingMore(false);
+    }
+  }, [currentSource, hasMore, loadingMore, effEngine, query, queryLimit, timeRange, esIndex, nextCursor, searchAfter, mapRawEntries, toast]);
+
+  const handleLabelFilter = useCallback((key: string, value: string, op: 'include' | 'exclude') => {
+    if (effEngine === 'loki') {
+      setQuery((q) => applyLokiLabelFilter(q, key, value, op));
+    } else {
+      setQuery((q) => applyESFieldFilter(q, key, value, op));
+    }
+  }, [effEngine]);
+
+  const handleRequestLabelValues = useCallback((label: string) => {
+    if (!currentSource?.id) return;
+    const selector = extractLokiSelector(query);
+    logCenterApi.listLokiLabelValues(currentSource.id, label, {
+      ...timeIsoParams(),
+      ...(selector ? { query: selector } : {}),
+    })
+      .then((res) => setLabelValues(Array.isArray(res) ? res : []))
+      .catch(() => setLabelValues([]));
+  }, [currentSource?.id, timeIsoParams, query]);
+
+  const handleFieldClick = useCallback((field: string) => {
+    if (effEngine === 'elasticsearch') {
+      setQuery((q) => applyESFieldFilter(q, field, '*', 'include'));
+    } else {
+      setQuery((q) => `${q} ${field}=""`.trim());
+    }
+  }, [effEngine]);
+
+  const handleShareLink = useCallback(async () => {
+    const url = buildShareUrl(location.pathname, {
+      query, datasourceId: dsId, index: esIndex || undefined, timeRange,
+    }, true);
+    const full = `${window.location.origin}${url}`;
+    const ok = await copyToClipboard(full);
+    toast({
+      title: ok ? '分享链接已复制' : '复制失败',
+      description: ok ? '收件人打开链接将自动执行查询' : undefined,
+      variant: ok ? 'default' : 'destructive',
+    });
+  }, [location.pathname, query, dsId, esIndex, timeRange, toast]);
+
+  const runLiveTailTick = useCallback(async () => {
+    if (!currentSource || !query.trim()) return;
+    const now = new Date();
+    const start = new Date(now.getTime() - 5 * 60000);
+    const tr: TimeRange = {
+      start: start.toISOString().replace('T', ' ').substring(0, 19),
+      end: now.toISOString().replace('T', ' ').substring(0, 19),
+      label: 'Live',
+      type: 'relative',
+    };
+    setTimeRange(tr);
+    const startISO = tr.start.replace(' ', 'T');
+    const endISO = tr.end.replace(' ', 'T');
+    try {
+      const data = effEngine === 'loki'
+        ? await logCenterApi.queryLoki({
+          datasource_id: currentSource.id, query, limit: 200, start: startISO, end: endISO, direction: 'backward',
+        })
+        : await logCenterApi.queryElasticsearch({
+          datasource_id: currentSource.id, index: esIndex || undefined, query, size: 200, start: startISO, end: endISO,
+        });
+      const mapped = mapRawEntries(data?.entries || []);
+      setEntries((prev) => {
+        const keys = new Set(prev.map((e) => `${e.timestamp}|${e.message}`));
+        const fresh = mapped.filter((e) => !keys.has(`${e.timestamp}|${e.message}`));
+        if (fresh.length === 0) return prev;
+        const merged = [...fresh, ...prev].slice(0, 2000);
+        setStatTable(buildStatTableFromEntries(merged));
+        setClusters(buildClustersFromEntries(merged));
+        setTotalCount(merged.length);
+        setHasQueried(true);
+        return merged;
+      });
+    } catch { /* Live tail 静默失败 */ }
+  }, [currentSource, query, effEngine, esIndex, mapRawEntries]);
+
+  useEffect(() => {
+    if (!liveTail) return undefined;
+    void runLiveTailTick();
+    const id = setInterval(() => { void runLiveTailTick(); }, 3000);
+    return () => clearInterval(id);
+  }, [liveTail, runLiveTailTick]);
+
+  const handleRunRef = useRef(handleRun);
+  handleRunRef.current = handleRun;
+  useEffect(() => {
+    if (!urlBootstrapped.current || autoRunDone.current) return;
+    if (searchParams.get('run') !== '1' || !currentSource || !query.trim()) return;
+    autoRunDone.current = true;
+    void handleRunRef.current();
+  }, [currentSource, query, searchParams]);
+
+  const handleSavedQuerySelect = useCallback((item: SavedQuery) => {
+    setQuery(item.query);
+    if (String(item.datasourceId) !== dsId) setDsId(String(item.datasourceId));
+  }, [dsId]);
+
+  const mappingFieldNames = useMemo(() => indexedFields.map((f) => f.name), [indexedFields]);
 
   const toggleField = useCallback((n: string) => setSelectedFields(p => p.includes(n) ? p.filter(f => f !== n) : [...p, n]), []);
   const handleSaveMenu = (a: 'query' | 'alert') => { setSaveMenuOpen(false); a === 'query' ? setSaveQueryOpen(true) : setSaveAlertOpen(true); };
@@ -272,6 +418,30 @@ export function UnifiedQueryPanel({ engine, onRuleCreated }: Props) {
     setTimeRange(p => ({ ...p, start: histogramData[sIdx].timestamp, end: histogramData[eIdx].timestamp, label: '自定义', type: 'absolute' as const }));
   }, [histogramData]);
 
+  const formatEntryLine = useCallback((e: LogEntry) => buildLogCopyText(e), []);
+
+  const handleExportLogs = useCallback(() => {
+    const t = sortedEntries.map(formatEntryLine).join('\n');
+    const b = new Blob([t], { type: 'text/plain;charset=utf-8' });
+    const u = URL.createObjectURL(b);
+    const a = document.createElement('a');
+    a.href = u;
+    a.download = `${effEngine}-logs-${Date.now()}.txt`;
+    a.click();
+    URL.revokeObjectURL(u);
+    toast({ title: '已导出', description: `${sortedEntries.length} 条日志` });
+  }, [sortedEntries, effEngine, formatEntryLine, toast]);
+
+  const handleCopyLogs = useCallback(async () => {
+    const text = pagedEntries.map(formatEntryLine).join('\n');
+    const ok = await copyToClipboard(text);
+    if (ok) {
+      toast({ title: '已复制', description: `当前页 ${pagedEntries.length} 条完整日志` });
+    } else {
+      toast({ title: '复制失败', description: '请使用导出或展开单条复制', variant: 'destructive' });
+    }
+  }, [pagedEntries, formatEntryLine, toast]);
+
   return (
     <div className="space-y-3">
       {/* ===== 查询控制行 ===== */}
@@ -281,10 +451,32 @@ export function UnifiedQueryPanel({ engine, onRuleCreated }: Props) {
             <span className="w-2 h-2 rounded-full" style={{ background: badge.dotColor }} />
             <span className="text-[11px] font-semibold" style={{ color: badge.dotColor }}>{badge.label}</span>
           </div>
-          <SyntaxHighlightInput value={query} onChange={setQuery} engine={effEngine} placeholder={meta.queryPlaceholder} />
-          <button onClick={handleRun} disabled={loading || !currentSource || !query.trim()} className="h-10 px-4 rounded text-xs font-medium text-white flex items-center gap-1.5 flex-shrink-0 transition-opacity hover:opacity-90 disabled:opacity-40 disabled:cursor-not-allowed" style={{ background: '#22c55e' }}>
+          <QueryAutocompleteInput
+            value={query}
+            onChange={setQuery}
+            engine={effEngine}
+            placeholder={meta.queryPlaceholder}
+            labelNames={labelNames}
+            labelValues={labelValues}
+            mappingFields={mappingFieldNames}
+            onRequestLabelValues={handleRequestLabelValues}
+          />
+          <button onClick={() => { setLiveTail(false); void handleRun(); }} disabled={loading || liveTail || !currentSource || !query.trim()} className="h-10 px-4 rounded text-xs font-medium text-white flex items-center gap-1.5 flex-shrink-0 transition-opacity hover:opacity-90 disabled:opacity-40 disabled:cursor-not-allowed" style={{ background: '#22c55e' }}>
             {loading ? <Loader2 className="h-4 w-4 animate-spin" /> : <Play className="h-4 w-4" />} 查询
           </button>
+          <button
+            onClick={() => setLiveTail((v) => !v)}
+            disabled={!currentSource || !query.trim()}
+            className="h-10 px-3 rounded text-xs flex items-center gap-1 flex-shrink-0"
+            style={{
+              border: `1px solid ${liveTail ? '#ef4444' : 'var(--dg-border)'}`,
+              color: liveTail ? '#ef4444' : 'var(--dg-text-secondary)',
+              background: liveTail ? 'rgba(239,68,68,0.1)' : 'var(--dg-bg-tertiary)',
+            }}
+            title="Live Tail — 每 3 秒刷新最近 5 分钟日志"
+          >
+            <Radio className={`h-3.5 w-3.5 ${liveTail ? 'animate-pulse' : ''}`} /> Tail
+          </button>
         </div>
       </div>
       {/* 次级控件行（时间 / 数据源 / 索引 / 上限 / 另存为 / 历史）// Logan.Li */}
@@ -297,13 +489,10 @@ export function UnifiedQueryPanel({ engine, onRuleCreated }: Props) {
         </select>
 
         {effEngine === 'elasticsearch' && (
-          <input
+          <EsIndexPicker
+            datasourceId={currentSource?.id}
             value={esIndex}
-            onChange={e => setEsIndex(e.target.value)}
-            placeholder="索引通配符"
-            title="临时覆盖数据源默认索引，留空使用数据源配置"
-            className="h-10 px-2 text-xs rounded flex-shrink-0 font-mono"
-            style={{ width: '150px', background: 'var(--dg-bg-tertiary)', border: '1px solid var(--dg-border)', color: 'var(--dg-text-primary)' }}
+            onChange={setEsIndex}
           />
         )}
 
@@ -336,6 +525,12 @@ export function UnifiedQueryPanel({ engine, onRuleCreated }: Props) {
           </>)}
         </div>
 
+        <button onClick={() => { void handleShareLink(); }} className="h-10 px-2.5 flex items-center gap-1 rounded flex-shrink-0 text-xs" style={{ border: '1px solid var(--dg-border)', color: 'var(--dg-text-muted)', background: 'var(--dg-bg-tertiary)' }} title="复制分享链接">
+          <Link2 className="h-3.5 w-3.5" /> 分享
+        </button>
+        <button onClick={() => setSavedPanelOpen(true)} className="h-10 w-10 flex items-center justify-center rounded flex-shrink-0" style={{ border: '1px solid var(--dg-border)', color: 'var(--dg-text-muted)', background: 'var(--dg-bg-tertiary)' }} title="已保存查询">
+          <Bookmark className="h-4 w-4" />
+        </button>
         <button onClick={() => setHistoryPanelOpen(true)} className="h-10 w-10 flex items-center justify-center rounded flex-shrink-0" style={{ border: '1px solid var(--dg-border)', color: 'var(--dg-text-muted)', background: 'var(--dg-bg-tertiary)' }} title="查询历史">
           <Clock className="h-4 w-4" />
         </button>
@@ -349,11 +544,20 @@ export function UnifiedQueryPanel({ engine, onRuleCreated }: Props) {
       )}
 
       {/* 快捷查询助手 */}
-      <QuickQueryBar engine={effEngine} templates={ALL_TEMPLATES[effEngine]} onSelect={setQuery} />
+      <QuickQueryBar engine={effEngine} onSelect={setQuery} />
+
+      {effEngine === 'loki' && currentSource && (
+        <LokiLabelBrowser
+          datasourceId={currentSource.id}
+          query={query}
+          timeRange={timeRange}
+          onQueryChange={setQuery}
+        />
+      )}
 
       {/* 统计条 + 工具栏 */}
       {entries.length > 0 && !loading && (
-        <LogQueryToolbar total={totalCount} queryTime={queryTime} perPage={perPage} onPerPageChange={n => { setPerPage(n); setPage(1); }} page={page} totalPages={totalPages} onPageChange={setPage} sortDirection={sortDirection} onSortToggle={() => setSortDirection(d => d === 'desc' ? 'asc' : 'desc')} onExport={() => { const t = sortedEntries.map(e => `${e.timestamp}\t${e.level || ''}\t${e.message}`).join('\n'); const b = new Blob([t], { type: 'text/plain' }); const u = URL.createObjectURL(b); const a = document.createElement('a'); a.href = u; a.download = `${effEngine}-logs-${Date.now()}.txt`; a.click(); URL.revokeObjectURL(u); }} onCopy={() => navigator.clipboard.writeText(pagedEntries.map(e => `${e.timestamp}\t${e.level || ''}\t${e.message}`).join('\n'))} onBellClick={() => setAlertDialogOpen(true)} />
+        <LogQueryToolbar total={totalCount} queryTime={queryTime} perPage={perPage} onPerPageChange={n => { setPerPage(n); setPage(1); }} page={page} totalPages={totalPages} onPageChange={setPage} sortDirection={sortDirection} onSortToggle={() => setSortDirection(d => d === 'desc' ? 'asc' : 'desc')} onExport={handleExportLogs} onCopy={() => { void handleCopyLogs(); }} onBellClick={() => setAlertDialogOpen(true)} hasMore={hasMore} loadingMore={loadingMore} onLoadMore={() => { void handleLoadMore(); }} />
       )}
 
       {/* Log Volume 面积图 */}
@@ -368,8 +572,8 @@ export function UnifiedQueryPanel({ engine, onRuleCreated }: Props) {
                 </linearGradient>
               </defs>
               <CartesianGrid strokeDasharray="3 3" stroke="var(--dg-border)" vertical={false} />
-              <XAxis dataKey="timestamp" tick={{ fontSize: 9, fill: 'var(--dg-text-muted)' }} axisLine={{ stroke: 'var(--dg-border)' }} tickLine={false} tickFormatter={(v: string) => v.slice(-5)} interval="preserveStartEnd" />
-              <YAxis tick={{ fontSize: 9, fill: 'var(--dg-text-muted)' }} axisLine={false} tickLine={false} width={30} />
+              <XAxis dataKey="timestamp" tick={{ fontSize: 9, fill: 'var(--dg-text-muted)' }} axisLine={{ stroke: 'var(--dg-border)' }} tickLine={false} tickFormatter={formatHistogramTick} interval="preserveStartEnd" />
+              <YAxis tick={{ fontSize: 9, fill: 'var(--dg-text-muted)' }} axisLine={false} tickLine={false} width={36} tickFormatter={formatHistogramCount} />
               <Tooltip contentStyle={{ background: 'var(--dg-bg-secondary)', border: '1px solid var(--dg-border)', borderRadius: '6px', fontSize: '11px', color: 'var(--dg-text-primary)' }} formatter={(v: number) => [`${v} 条日志`, '数量']} labelFormatter={(l: string) => `时间: ${l}`} />
               <Area type="monotone" dataKey="count" stroke={meta.color} fill={`url(#vol-${effEngine})`} strokeWidth={1.5} dot={false} activeDot={{ r: 4, stroke: meta.color, strokeWidth: 2, fill: 'var(--dg-bg-secondary)' }} />
             </AreaChart>
@@ -395,9 +599,9 @@ export function UnifiedQueryPanel({ engine, onRuleCreated }: Props) {
           <div className="p-2">
             {resultTab === 'logs' && (<>
               <div className="flex gap-3">
-                <LogFieldSidebar fields={fields} selectedFields={selectedFields} onFieldClick={n => setQuery(p => `${p} ${n}=""`)} onToggleDisplayField={toggleField} loading={loading} />
+                <LogFieldSidebar fields={fields} indexedFields={indexedFields} selectedFields={selectedFields} onFieldClick={handleFieldClick} onToggleDisplayField={toggleField} loading={loading} />
                 <div className="flex-1 min-w-0">
-                  <EnhancedLogResults entries={pagedEntries} loading={loading} viewMode={viewMode} wrapLines={wrapLines} truncate={truncate} commonLabels={commonLabels || undefined} />
+                  <EnhancedLogResults entries={pagedEntries} loading={loading} viewMode={viewMode} wrapLines={wrapLines} truncate={truncate} commonLabels={commonLabels || undefined} onLabelFilter={handleLabelFilter} />
                 </div>
               </div>
               <div className="flex items-center gap-3 py-2 px-1">
@@ -408,8 +612,8 @@ export function UnifiedQueryPanel({ engine, onRuleCreated }: Props) {
                     </button>
                   ))}
                 </div>
-                <label className="flex items-center gap-1.5 text-[11px] cursor-pointer" style={{ color: 'var(--dg-text-muted)' }}><input type="checkbox" checked={truncate} onChange={e => setTruncate(e.target.checked)} className="h-3.5 w-3.5 rounded" /> 截断</label>
-                <label className="flex items-center gap-1.5 text-[11px] cursor-pointer" style={{ color: 'var(--dg-text-muted)' }}><input type="checkbox" checked={wrapLines} onChange={e => setWrapLines(e.target.checked)} className="h-3.5 w-3.5 rounded" /> 换行</label>
+                <label className="flex items-center gap-1.5 text-[11px] cursor-pointer" style={{ color: 'var(--dg-text-muted)' }} title="开启后折叠行仅显示前 500 字预览"><input type="checkbox" checked={truncate} onChange={e => setTruncate(e.target.checked)} className="h-3.5 w-3.5 rounded" /> 截断预览</label>
+                <label className="flex items-center gap-1.5 text-[11px] cursor-pointer" style={{ color: 'var(--dg-text-muted)' }} title="长日志自动换行显示"><input type="checkbox" checked={wrapLines} onChange={e => setWrapLines(e.target.checked)} className="h-3.5 w-3.5 rounded" /> 换行</label>
               </div>
             </>)}
             {resultTab === 'stats' && <StatChartPanel statTable={statTable} engine={effEngine as LogEngine} query={query} onSaveAsAlert={() => setSaveAlertOpen(true)} onSaveAsQuery={() => setSaveQueryOpen(true)} />}
@@ -452,37 +656,11 @@ export function UnifiedQueryPanel({ engine, onRuleCreated }: Props) {
       )}
 
       {/* 对话框 */}
-      <SaveQueryDialog open={saveQueryOpen} onClose={() => setSaveQueryOpen(false)} engine={effEngine as LogEngine} query={query} timeRange={timeRange} datasourceName={currentSource?.name} />
+      <SaveQueryDialog open={saveQueryOpen} onClose={() => setSaveQueryOpen(false)} engine={effEngine as LogEngine} query={query} timeRange={timeRange} datasourceId={currentSource?.id} datasourceName={currentSource?.name} />
+      <SavedQueriesPanel visible={savedPanelOpen} onClose={() => setSavedPanelOpen(false)} onSelect={handleSavedQuerySelect} />
       <SaveAlertDialog open={saveAlertOpen} onClose={() => setSaveAlertOpen(false)} engine={effEngine as LogEngine} query={query} datasourceId={currentSource?.id} datasourceName={currentSource?.name} />
       <QueryHistoryPanel visible={historyPanelOpen} onClose={() => setHistoryPanelOpen(false)} onSelect={(it: QueryHistoryItem) => { setQuery(it.query); setHistoryPanelOpen(false); }} onCreateAlert={() => { setSaveAlertOpen(true); setHistoryPanelOpen(false); }} />
       <LogAlertFromQueryDialog open={alertDialogOpen} onOpenChange={setAlertDialogOpen} ctx={{ engine: effEngine as LogEngine, datasourceId: currentSource?.id, datasourceName: currentSource?.name, query, timeRange: timeRange.label }} onSaved={onRuleCreated} />
     </div>
   );
 }
-
-// 内联紧凑版快捷查询助手
-function QuickQueryBar({ engine, templates, onSelect }: { engine: 'loki' | 'elasticsearch'; templates: { label: string; query: string }[]; onSelect: (q: string) => void; }) {
-  const [open, setOpen] = useState(false);
-  const labels: Record<'loki' | 'elasticsearch', string> = { loki: 'LogQL', elasticsearch: 'Lucene' };
-  return (
-    <div>
-      <button onClick={() => setOpen(!open)} className="flex items-center gap-1 text-[11px] px-2 py-1 rounded transition-colors" style={{ color: 'var(--dg-blue)', background: open ? 'var(--dg-bg-tertiary)' : 'transparent' }}>
-        <span className="w-1.5 h-1.5 rounded-full" style={{ background: 'var(--dg-blue)' }} />
-        {labels[engine]} 快捷查询模板
-        <ChevronDown className="h-3 w-3" style={{ transform: open ? 'rotate(0deg)' : 'rotate(-90deg)', transition: 'transform 0.2s' }} />
-      </button>
-      {open && (
-        <div className="mt-1.5 p-2.5 rounded-lg border" style={{ background: 'var(--dg-bg-secondary)', borderColor: 'var(--dg-border)' }}>
-          <div className="grid grid-cols-3 lg:grid-cols-4 gap-1.5">
-            {templates.map((t, i) => (
-              <button key={i} onClick={() => { onSelect(t.query); setOpen(false); }} className="text-left px-2 py-1.5 rounded border text-[11px] transition-all hover:opacity-80" style={{ background: 'var(--dg-bg-tertiary)', borderColor: 'var(--dg-border)', color: 'var(--dg-text-secondary)' }} title={t.query}>
-                <span className="font-medium block truncate" style={{ color: 'var(--dg-text-primary)' }}>{t.label}</span>
-                <span className="block truncate opacity-60 font-mono mt-0.5 text-[10px]">{t.query}</span>
-              </button>
-            ))}
-          </div>
-        </div>
-      )}
-    </div>
-  );
-}

frontend/src/components/monitor/log-center/log-center-types.ts

@@ -1,6 +1,6 @@
 // log-center-types.ts — 日志中心类型（无状态：仅存连接与告警策略）// Logan.Li
 
-export type LogCenterTab = 'loki' | 'es' | 'datasources' | 'alerts';
+export type LogCenterTab = 'loki' | 'es' | 'datasources' | 'alerts' | 'rbac';
 
 export type LogEngine = 'loki' | 'elasticsearch';
 

frontend/src/components/monitor/log-center/log-format.ts

@@ -0,0 +1,90 @@
+// log-format.ts — 日志时间戳格式化与展示辅助 // Logan.Li
+
+/** 将 Loki 纳秒时间戳或 epoch 转为可读 ISO 时间 */
+export function formatLogTimestamp(ts: string): string {
+  if (!ts) return '';
+  const trimmed = ts.trim();
+  // 已是 ISO / 可读格式
+  if (/[-T:]/.test(trimmed) && !/^\d+$/.test(trimmed)) {
+    return trimmed;
+  }
+  const n = Number(trimmed);
+  if (!Number.isFinite(n)) return trimmed;
+
+  let ms: number;
+  if (n > 1e18) ms = Math.floor(n / 1e6);       // 纳秒
+  else if (n > 1e15) ms = Math.floor(n / 1e6);   // 纳秒（Loki 常见）
+  else if (n > 1e12) ms = Math.floor(n);         // 毫秒
+  else ms = Math.floor(n * 1000);                 // 秒
+
+  const d = new Date(ms);
+  if (Number.isNaN(d.getTime())) return trimmed;
+  return d.toISOString();
+}
+
+/** 直方图 X 轴时间刻度（避免科学计数法原样显示）// Logan.Li */
+export function formatHistogramTick(ts: string | number): string {
+  const raw = String(ts).trim();
+  if (!raw) return '';
+  if (/^[\d.eE+-]+$/.test(raw)) {
+    const n = Number(raw);
+    if (Number.isFinite(n)) {
+      const ms = n > 1e12 ? n : n * 1000;
+      const d = new Date(ms);
+      if (!Number.isNaN(d.getTime())) {
+        return d.toLocaleTimeString('zh-CN', { hour: '2-digit', minute: '2-digit', second: '2-digit' });
+      }
+    }
+  }
+  const iso = formatLogTimestamp(raw);
+  const d = new Date(iso);
+  if (!Number.isNaN(d.getTime())) {
+    return d.toLocaleTimeString('zh-CN', { hour: '2-digit', minute: '2-digit', second: '2-digit' });
+  }
+  return raw.length > 8 ? raw.slice(11, 19) : raw;
+}
+
+/** 直方图 Y 轴条数刻度 // Logan.Li */
+export function formatHistogramCount(v: number): string {
+  if (!Number.isFinite(v)) return String(v);
+  if (v >= 1e6) return `${(v / 1e6).toFixed(1)}M`;
+  if (v >= 1e4) return `${Math.round(v / 1000)}k`;
+  return String(Math.round(v));
+}
+
+/** 日志行展示文本（截断仅影响折叠预览，展开始终全文） */
+export function formatLogPreview(text: string, trunc: boolean, maxLen = 500): string {
+  if (!trunc || text.length <= maxLen) return text;
+  return `${text.slice(0, maxLen)}…`;
+}
+
+/** 从 Spring / key=value 日志中提取结构化字段 */
+export function detectLogFields(raw: string): { name: string; value: string }[] {
+  const fields: { name: string; value: string }[] = [];
+  if (!raw) return fields;
+
+  try {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed === 'object' && parsed !== null) {
+      for (const [k, v] of Object.entries(parsed)) {
+        fields.push({ name: k, value: String(v) });
+      }
+      return fields;
+    }
+  } catch { /* 非 JSON */ }
+
+  const kvRegex = /(\w+)=([^,\s]+)/g;
+  let m: RegExpExecArray | null;
+  while ((m = kvRegex.exec(raw)) !== null) {
+    fields.push({ name: m[1], value: m[2] });
+  }
+  return fields;
+}
+
+/** 组装复制用完整日志行 */
+export function buildLogCopyText(entry: { timestamp?: string; level?: string; raw?: string; message: string }): string {
+  const body = entry.raw || entry.message || '';
+  const ts = formatLogTimestamp(entry.timestamp || '');
+  const level = entry.level ? ` ${entry.level.toUpperCase()}` : '';
+  return ts ? `${ts}${level} ${body}` : body;
+}

frontend/src/components/monitor/log-center/log-rbac/LogRoleCreateDialog.tsx

@@ -0,0 +1,192 @@
+import { useMemo } from 'react';
+import { Button } from '@/components/ui/button';
+import { Input } from '@/components/ui/input';
+import { Label } from '@/components/ui/label';
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog';
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select';
+import { Loader2, Save } from 'lucide-react';
+import { matchSampleScopes, SAMPLE_SCOPES, type SampleScopeItem } from './matchLogScope';
+import type { LogDataSource } from '@/api/log/log-center';
+
+interface LogRoleCreateDialogProps {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  datasources: LogDataSource[];
+  saving: boolean;
+  name: string;
+  code: string;
+  engine: string;
+  matchField: string;
+  pattern: string;
+  role: string;
+  datasourceId: string;
+  description: string;
+  onNameChange: (v: string) => void;
+  onCodeChange: (v: string) => void;
+  onEngineChange: (v: string) => void;
+  onMatchFieldChange: (v: string) => void;
+  onPatternChange: (v: string) => void;
+  onRoleChange: (v: string) => void;
+  onDatasourceIdChange: (v: string) => void;
+  onDescriptionChange: (v: string) => void;
+  onSubmit: () => void;
+}
+
+// 新建日志范围权限弹窗 // Logan.Li
+export function LogRoleCreateDialog({
+  open,
+  onOpenChange,
+  datasources,
+  saving,
+  name,
+  code,
+  engine,
+  matchField,
+  pattern,
+  role,
+  datasourceId,
+  description,
+  onNameChange,
+  onCodeChange,
+  onEngineChange,
+  onMatchFieldChange,
+  onPatternChange,
+  onRoleChange,
+  onDatasourceIdChange,
+  onDescriptionChange,
+  onSubmit,
+}: LogRoleCreateDialogProps) {
+  const preview = useMemo(
+    () => matchSampleScopes(pattern, matchField, engine, SAMPLE_SCOPES),
+    [pattern, matchField, engine],
+  );
+
+  const patternHint = useMemo(() => {
+    if (!pattern.trim()) {
+      return matchField === 'index' ? '输入正则，匹配 ES 索引名' : `输入正则，匹配 Loki ${matchField} Label`;
+    }
+    try {
+      // eslint-disable-next-line no-new
+      new RegExp(pattern);
+      return preview.length > 0 ? `命中 ${preview.length} 个示例范围` : '无匹配示例';
+    } catch {
+      return '正则语法错误';
+    }
+  }, [pattern, matchField, preview.length]);
+
+  const filteredDS = datasources.filter((ds) => {
+    if (engine === '*') return true;
+    return ds.type === engine;
+  });
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="max-w-md bg-[var(--dg-bg-primary)] border-[var(--dg-border)]">
+        <DialogHeader>
+          <DialogTitle>新建日志权限</DialogTitle>
+          <DialogDescription className="text-[var(--dg-text-muted)]">
+            按正则匹配 ES 索引或 Loki Label，限制用户可查询的日志范围
+          </DialogDescription>
+        </DialogHeader>
+        <div className="space-y-3">
+          <div className="grid grid-cols-2 gap-2">
+            <div className="space-y-1">
+              <Label className="text-xs">名称</Label>
+              <Input value={name} onChange={(e) => onNameChange(e.target.value)} placeholder="后端日志" className="h-8 text-sm dg-input" />
+            </div>
+            <div className="space-y-1">
+              <Label className="text-xs">标识</Label>
+              <Input value={code} onChange={(e) => onCodeChange(e.target.value)} placeholder="backend-logs" className="h-8 text-sm font-mono dg-input" />
+            </div>
+          </div>
+          <div className="grid grid-cols-2 gap-2">
+            <div className="space-y-1">
+              <Label className="text-xs">引擎</Label>
+              <Select value={engine} onValueChange={onEngineChange}>
+                <SelectTrigger className="h-8 text-sm dg-input"><SelectValue /></SelectTrigger>
+                <SelectContent>
+                  <SelectItem value="*">全部引擎</SelectItem>
+                  <SelectItem value="loki">Loki</SelectItem>
+                  <SelectItem value="elasticsearch">Elasticsearch</SelectItem>
+                </SelectContent>
+              </Select>
+            </div>
+            <div className="space-y-1">
+              <Label className="text-xs">匹配维度</Label>
+              <Select value={matchField} onValueChange={onMatchFieldChange}>
+                <SelectTrigger className="h-8 text-sm dg-input"><SelectValue /></SelectTrigger>
+                <SelectContent>
+                  <SelectItem value="index">ES 索引</SelectItem>
+                  <SelectItem value="app">Loki app</SelectItem>
+                  <SelectItem value="namespace">Loki namespace</SelectItem>
+                  <SelectItem value="job">Loki job</SelectItem>
+                </SelectContent>
+              </Select>
+            </div>
+          </div>
+          <div className="space-y-1">
+            <Label className="text-xs">匹配正则</Label>
+            <Input
+              value={pattern}
+              onChange={(e) => onPatternChange(e.target.value)}
+              placeholder={matchField === 'index' ? 'logstash-.*' : '^cex-.*'}
+              className="h-8 text-sm font-mono dg-input"
+            />
+            <p className="text-[10px] text-[var(--dg-text-muted)]">{patternHint}</p>
+          </div>
+          <div className="grid grid-cols-2 gap-2">
+            <div className="space-y-1">
+              <Label className="text-xs">数据源（可选）</Label>
+              <Select value={datasourceId || '__all'} onValueChange={(v) => onDatasourceIdChange(v === '__all' ? '' : v)}>
+                <SelectTrigger className="h-8 text-sm dg-input"><SelectValue placeholder="全部数据源" /></SelectTrigger>
+                <SelectContent>
+                  <SelectItem value="__all">全部数据源</SelectItem>
+                  {filteredDS.map((ds) => (
+                    <SelectItem key={ds.id} value={String(ds.id)}>{ds.name} ({ds.type})</SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+            </div>
+            <div className="space-y-1">
+              <Label className="text-xs">权限级别</Label>
+              <Select value={role} onValueChange={onRoleChange}>
+                <SelectTrigger className="h-8 text-sm dg-input"><SelectValue /></SelectTrigger>
+                <SelectContent>
+                  <SelectItem value="viewer">查看者 — 只读查询</SelectItem>
+                  <SelectItem value="analyst">分析者 — 查询 + 告警</SelectItem>
+                </SelectContent>
+              </Select>
+            </div>
+          </div>
+          <div className="space-y-1">
+            <Label className="text-xs">说明</Label>
+            <Input value={description} onChange={(e) => onDescriptionChange(e.target.value)} placeholder="可选" className="h-8 text-sm dg-input" />
+          </div>
+          {preview.length > 0 && (
+            <div className="flex flex-wrap gap-1">
+              {preview.map((s: SampleScopeItem) => (
+                <span key={s.label} className="text-[10px] px-1.5 py-0.5 rounded bg-[var(--dg-bg-tertiary)] text-[var(--dg-text-muted)] font-mono">
+                  {s.label}
+                </span>
+              ))}
+            </div>
+          )}
+        </div>
+        <DialogFooter>
+          <Button variant="outline" onClick={() => onOpenChange(false)}>取消</Button>
+          <Button onClick={onSubmit} disabled={saving}>
+            {saving ? <Loader2 className="h-4 w-4 animate-spin mr-1" /> : <Save className="h-4 w-4 mr-1" />}
+            创建
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+}

frontend/src/components/monitor/log-center/log-rbac/matchLogScope.ts

@@ -0,0 +1,46 @@
+// 日志范围正则命中工具（ES 索引 / Loki Label）// Logan.Li
+
+export interface SampleScopeItem {
+  label: string;
+  value: string;
+  engine: 'loki' | 'elasticsearch';
+  field: 'index' | 'app' | 'namespace' | 'job';
+}
+
+export const SAMPLE_SCOPES: SampleScopeItem[] = [
+  { label: 'logstash-2026.07', value: 'logstash-2026.07', engine: 'elasticsearch', field: 'index' },
+  { label: 'logstash-2026.06', value: 'logstash-2026.06', engine: 'elasticsearch', field: 'index' },
+  { label: 'app=cex-admin-api', value: 'cex-admin-api', engine: 'loki', field: 'app' },
+  { label: 'app=api-gateway', value: 'api-gateway', engine: 'loki', field: 'app' },
+  { label: 'ns=astralx', value: 'astralx', engine: 'loki', field: 'namespace' },
+  { label: 'job=promtail', value: 'promtail', engine: 'loki', field: 'job' },
+];
+
+export function engineMatches(roleEngine: string, targetEngine: string): boolean {
+  const re = (roleEngine || '*').toLowerCase();
+  if (re === '*' || re === '') return true;
+  return re === targetEngine.toLowerCase();
+}
+
+export function matchSampleScopes(
+  pattern: string,
+  matchField: string,
+  engine: string,
+  samples: SampleScopeItem[] = SAMPLE_SCOPES,
+): SampleScopeItem[] {
+  if (!pattern.trim()) return [];
+  try {
+    const re = new RegExp(pattern);
+    return samples.filter((s) => {
+      if (s.field !== matchField) return false;
+      if (!engineMatches(engine, s.engine)) return false;
+      return re.test(s.value);
+    });
+  } catch {
+    return [];
+  }
+}
+
+export function scopeDisplayLabel(s: SampleScopeItem): string {
+  return s.label;
+}

frontend/src/components/monitor/log-center/query-autocomplete.ts

@@ -0,0 +1,114 @@
+// 查询输入自动补全上下文检测 // Logan.Li
+
+import { COMMON_ES_FIELDS, ES_KEYWORD_SUGGESTIONS, LOKI_PIPE_SUGGESTIONS } from './query-syntax';
+
+export interface AutocompleteContext {
+  prefix: string;
+  replaceStart: number;
+  replaceEnd: number;
+  kind: 'label' | 'value' | 'pipe' | 'field' | 'keyword';
+  labelName?: string;
+}
+
+const LOKI_SELECTOR_RE = /\{([^}]*)\}/g;
+
+export function detectAutocompleteContext(
+  query: string,
+  cursor: number,
+  engine: 'loki' | 'elasticsearch',
+): AutocompleteContext | null {
+  const before = query.slice(0, cursor);
+  if (engine === 'loki') {
+    if (before.endsWith('|') || before.endsWith('| ')) {
+      return { prefix: '', replaceStart: cursor, replaceEnd: cursor, kind: 'pipe' };
+    }
+    const selectorMatch = [...query.matchAll(LOKI_SELECTOR_RE)].find((m) => {
+      const start = m.index ?? 0;
+      const end = start + m[0].length;
+      return cursor >= start && cursor <= end;
+    });
+    if (!selectorMatch) return null;
+    const inner = selectorMatch[1];
+    const innerStart = (selectorMatch.index ?? 0) + 1;
+    const rel = cursor - innerStart;
+    const innerBefore = inner.slice(0, rel);
+    const valueMatch = innerBefore.match(/([a-zA-Z_][\w.-]*)\s*(=~|!~|=|!=)\s*"?([^"]*)$/);
+    if (valueMatch) {
+      const labelName = valueMatch[1];
+      const valStart = innerStart + innerBefore.length - (valueMatch[3]?.length || 0);
+      return {
+        prefix: valueMatch[3] || '',
+        replaceStart: valStart,
+        replaceEnd: cursor,
+        kind: 'value',
+        labelName,
+      };
+    }
+    const labelMatch = innerBefore.match(/(?:^|,)\s*([a-zA-Z_][\w.-]*)?$/);
+    if (labelMatch) {
+      const partial = labelMatch[1] || '';
+      return {
+        prefix: partial,
+        replaceStart: cursor - partial.length,
+        replaceEnd: cursor,
+        kind: 'label',
+      };
+    }
+    return null;
+  }
+
+  const fieldMatch = before.match(/(?:^|\s)([a-zA-Z_@][\w.-]*)$/);
+  if (fieldMatch) {
+    const partial = fieldMatch[1];
+    return {
+      prefix: partial,
+      replaceStart: cursor - partial.length,
+      replaceEnd: cursor,
+      kind: 'field',
+    };
+  }
+  if (/\b(AND|OR|NOT)\s*$/i.test(before) || before.endsWith(' ')) {
+    return { prefix: '', replaceStart: cursor, replaceEnd: cursor, kind: 'keyword' };
+  }
+  return null;
+}
+
+export function filterSuggestions(
+  ctx: AutocompleteContext,
+  labels: string[],
+  labelValues: string[],
+  mappingFields: string[],
+): string[] {
+  const p = ctx.prefix.toLowerCase();
+  const match = (items: string[]) => items.filter((s) => s.toLowerCase().startsWith(p)).slice(0, 20);
+
+  switch (ctx.kind) {
+    case 'label':
+      return match(labels);
+    case 'value':
+      return match(labelValues);
+    case 'pipe':
+      return LOKI_PIPE_SUGGESTIONS;
+    case 'field':
+      return match([...new Set([...mappingFields, ...COMMON_ES_FIELDS])]);
+    case 'keyword':
+      return ES_KEYWORD_SUGGESTIONS;
+    default:
+      return [];
+  }
+}
+
+export function applySuggestion(query: string, ctx: AutocompleteContext, suggestion: string): { text: string; cursor: number } {
+  const left = query.slice(0, ctx.replaceStart);
+  const right = query.slice(ctx.replaceEnd);
+  let insert = suggestion;
+  if (ctx.kind === 'value') {
+    insert = suggestion.includes(' ') ? `"${suggestion}"` : suggestion;
+  } else if (ctx.kind === 'label') {
+    insert = `${suggestion}=`;
+  } else if (ctx.kind === 'field') {
+    insert = `${suggestion}:`;
+  }
+  const text = left + insert + right;
+  return { text, cursor: left.length + insert.length };
+}

frontend/src/components/monitor/log-center/query-builder.ts

@@ -0,0 +1,64 @@
+// LogQL / Lucene 查询构建辅助（标签点击过滤）// Logan.Li
+
+const LOKI_SELECTOR_RE = /\{([^}]*)\}/;
+
+export function applyLokiLabelFilter(
+  query: string,
+  key: string,
+  value: string,
+  op: 'include' | 'exclude',
+): string {
+  const trimmed = query.trim();
+  const match = trimmed.match(LOKI_SELECTOR_RE);
+  const clause = op === 'include' ? `${key}="${value}"` : `${key}!="${value}"`;
+  if (match) {
+    const inner = match[1].trim();
+    const withoutKey = inner
+      .split(',')
+      .map((s) => s.trim())
+      .filter((s) => s && !s.startsWith(`${key}=`) && !s.startsWith(`${key}!=`))
+      .join(', ');
+    const nextInner = withoutKey ? `${withoutKey}, ${clause}` : clause;
+    return trimmed.replace(LOKI_SELECTOR_RE, `{${nextInner}}`);
+  }
+  const pipeline = trimmed.startsWith('{') ? '' : trimmed;
+  return pipeline ? `{${clause}} ${pipeline}` : `{${clause}}`;
+}
+
+export function applyESFieldFilter(
+  query: string,
+  key: string,
+  value: string,
+  op: 'include' | 'exclude',
+): string {
+  const token = value.includes(' ') || value.includes(':')
+    ? `${key}:"${value.replace(/"/g, '\\"')}"`
+    : `${key}:${value}`;
+  const base = query.trim();
+  if (op === 'exclude') {
+    const neg = `NOT ${token}`;
+    return base ? `${base} AND ${neg}` : neg;
+  }
+  return base ? `${base} AND ${token}` : token;
+}
+
+/** 从 LogQL 提取 stream selector（Label API 仅接受 {...} 部分）// Logan.Li */
+export function extractLokiSelector(query: string): string {
+  const trimmed = query.trim();
+  const match = trimmed.match(LOKI_SELECTOR_RE);
+  return match ? `{${match[1]}}` : '';
+}
+
+export function buildLokiSelector(labels: Record<string, string>): string {
+  const parts = Object.entries(labels).map(([k, v]) => `${k}="${v}"`);
+  return `{${parts.join(', ')}}`;
+}
+
+export function mergeLokiSelector(query: string, labels: Record<string, string>): string {
+  let q = query.trim();
+  const selector = buildLokiSelector(labels);
+  if (LOKI_SELECTOR_RE.test(q)) {
+    return q.replace(LOKI_SELECTOR_RE, selector);
+  }
+  return `${selector} ${q}`.trim();
+}

frontend/src/components/monitor/log-center/query-syntax.ts

@@ -0,0 +1,40 @@
+// LogQL / Lucene 语法高亮 // Logan.Li
+
+export function highlightSyntax(query: string, engine: 'loki' | 'elasticsearch'): string {
+  if (!query) return '<span style="color:transparent">.</span>';
+  const esc = query.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+  const span = (color: string, text: string) => `<span style="color:${color}">${text}</span>`;
+  if (engine === 'loki') {
+    return esc.replace(
+      /("(?:[^"\\]|\\.)*")|([a-zA-Z_][\w-]*)(?==)|(\|json|\|regexp|\|line_format|\|unwrap|\|pattern|\|label_format)|\b(count_over_time|sum|rate|avg|max|min|count|by|over)\b|([{}])|(\|=|\!=|=~|!~|=)/g,
+      (m, str, ident, pipe, fn, brace, op) => {
+        if (str) return span('#22c55e', str);
+        if (ident) return span('#f59e0b', ident);
+        if (pipe) return span('#8b5cf6', pipe);
+        if (fn) return span('#06b6d4', fn);
+        if (brace) return span('#f59e0b', brace);
+        if (op) return span('#f43f5e', op);
+        return m;
+      },
+    ) + '<span style="color:transparent">.</span>';
+  }
+  return esc.replace(
+    /("(?:[^"\\]|\\.)*")|\b(AND|OR|NOT)\b|([a-zA-Z_@][\w.-]*)(?=:)|([*?~^[\]()])/g,
+    (m, str, kw, field, punct) => {
+      if (str) return span('#22c55e', str);
+      if (kw) return span('#f43f5e', kw);
+      if (field) return span('#f59e0b', field);
+      if (punct) return span('#8b5cf6', punct);
+      return m;
+    },
+  ) + '<span style="color:transparent">.</span>';
+}
+
+export const LOKI_PIPE_SUGGESTIONS = ['|= ', '!= ', '|~ ', '!~ ', '| json', '| regexp ', '| line_format ', '| unwrap ', '| pattern '];
+
+export const ES_KEYWORD_SUGGESTIONS = ['AND ', 'OR ', 'NOT '];
+
+export const COMMON_ES_FIELDS = [
+  'message', 'level', 'log.level', 'app', 'service', 'host.name', '@timestamp',
+  'kubernetes.namespace', 'trace_id', 'status', 'method', 'path',
+];

frontend/src/components/monitor/log-center/query-url-state.ts

@@ -0,0 +1,52 @@
+// 日志查询 URL 状态编解码 — 可分享链接 // Logan.Li
+
+import type { TimeRange } from './types-v3';
+
+export interface LogQueryUrlState {
+  query?: string;
+  datasourceId?: string;
+  index?: string;
+  timeRange?: TimeRange;
+  autoRun?: boolean;
+}
+
+export function parseLogQueryUrl(params: URLSearchParams): LogQueryUrlState {
+  const query = params.get('q') || undefined;
+  const datasourceId = params.get('ds') || undefined;
+  const index = params.get('index') || undefined;
+  const start = params.get('from') || undefined;
+  const end = params.get('to') || undefined;
+  const timeLabel = params.get('tr') || '自定义';
+  const autoRun = params.get('run') === '1';
+  const state: LogQueryUrlState = { query, datasourceId, index, autoRun };
+  if (start && end) {
+    state.timeRange = {
+      start: decodeURIComponent(start),
+      end: decodeURIComponent(end),
+      label: decodeURIComponent(timeLabel),
+      type: params.get('trt') === 'relative' ? 'relative' : 'absolute',
+    };
+  }
+  return state;
+}
+
+export function buildLogQueryParams(state: LogQueryUrlState): URLSearchParams {
+  const p = new URLSearchParams();
+  if (state.query) p.set('q', state.query);
+  if (state.datasourceId) p.set('ds', state.datasourceId);
+  if (state.index) p.set('index', state.index);
+  if (state.timeRange) {
+    p.set('from', state.timeRange.start);
+    p.set('to', state.timeRange.end);
+    p.set('tr', state.timeRange.label);
+    p.set('trt', state.timeRange.type);
+  }
+  return p;
+}
+
+export function buildShareUrl(pathname: string, state: LogQueryUrlState, autoRun = false): string {
+  const p = buildLogQueryParams(state);
+  if (autoRun) p.set('run', '1');
+  const qs = p.toString();
+  return qs ? `${pathname}?${qs}` : pathname;
+}

frontend/src/components/monitor/log-center/types-v3.ts

@@ -257,11 +257,11 @@ export const QUICK_TEMPLATES: Record<LogEngine, { label: string; query: string }
   ],
   elasticsearch: [
     { label: 'API 5xx 错误', query: 'status:500 AND path:"/api/*"' },
-    { label: '错误超时日志', query: 'level:error AND message:*timeout*' },
-    { label: '排除调试日志', query: 'host.name:server-* AND NOT level:debug' },
+    { label: '错误超时日志', query: '(level:error OR log.level:error) AND message:*timeout*' },
+    { label: '排除调试日志', query: 'host.name:server-* AND NOT level:debug AND NOT log.level:debug' },
     { label: '慢请求检测', query: 'response_time:>1000 AND method:POST' },
-    { label: '最近1小时严重错误', query: '@timestamp:[now-1h TO now] AND level:critical' },
-    { label: '特定服务错误', query: 'service:nginx AND (level:error OR level:fatal)' },
+    { label: '最近1小时严重错误', query: '@timestamp:[now-1h TO now] AND (level:critical OR log.level:critical)' },
+    { label: '特定服务错误', query: 'service:nginx AND (level:(error OR fatal) OR log.level:(error OR fatal))' },
   ],
   sls: [
     { label: '错误日志筛选', query: "* | select * where level = 'error'" },

frontend/src/pages/audit/AuditOperationsTab.tsx

@@ -26,6 +26,13 @@ import type { OperationLog, OptionItem } from '@/types';
 
 // Normalize backend log to frontend type
 function normalizeLog(raw: Record<string, unknown>): OperationLog {
+  const status = raw.status as number | undefined;
+  const result: OperationLog['result'] =
+    status === 0 ? 'failure' : status === 1 ? 'success' : raw.result === 'failure' ? 'failure' : 'success';
+  const request = String(raw.request ?? '');
+  const response = String(raw.response ?? '');
+  const error = String(raw.error ?? '');
+  const message = error || response || request || String(raw.message ?? raw.detail ?? '');
   return {
     id: String(raw.id ?? ''),
     userId: String(raw.user_id ?? raw.userId ?? ''),
@@ -35,8 +42,11 @@ function normalizeLog(raw: Record<string, unknown>): OperationLog {
     resource: String(raw.resource ?? ''),
     ip: String(raw.ip ?? ''),
     userAgent: String(raw.user_agent ?? raw.userAgent ?? ''),
-    result: raw.result === 'failure' ? 'failure' : 'success',
-    message: String(raw.message ?? raw.detail ?? ''),
+    result,
+    message,
+    request,
+    response,
+    error,
     createdAt: String(raw.createdAt ?? raw.created_at ?? ''),
   };
 }
@@ -338,7 +348,7 @@ function LogDetailDialog({ log, onClose }: { log: OperationLog | null; onClose:
   return (
     <div className="fixed inset-0 z-50 flex items-center justify-center">
       <div className="absolute inset-0 bg-black/60" onClick={onClose} />
-      <div className="relative dg-card rounded-lg p-6 max-w-lg w-full mx-4 shadow-2xl">
+      <div className="relative dg-card rounded-lg p-6 max-w-2xl w-full mx-4 shadow-2xl max-h-[85vh] overflow-y-auto">
         <div className="flex items-center justify-between mb-4">
           <h3 className="text-lg font-semibold text-[var(--dg-text-primary)]">{t('audit.operations.detailTitle')}</h3>
           <Button
@@ -376,7 +386,12 @@ function LogDetailDialog({ log, onClose }: { log: OperationLog | null; onClose:
               </Badge>
             }
           />
-          {log.message && <DetailRow label={t('audit.operations.detailCol.message')} value={log.message} mono />}
+          {log.request && <DetailRow label={t('audit.operations.detailCol.request', { defaultValue: '请求参数' })} value={log.request} mono />}
+          {log.response && <DetailRow label={t('audit.operations.detailCol.response', { defaultValue: '执行输出' })} value={log.response} mono />}
+          {log.error && <DetailRow label={t('audit.operations.detailCol.error', { defaultValue: '错误信息' })} value={log.error} mono />}
+          {!log.request && !log.response && log.message && (
+            <DetailRow label={t('audit.operations.detailCol.message')} value={log.message} mono />
+          )}
         </div>
 
         <div className="mt-5 flex justify-end">

frontend/src/pages/monitor/SiteMonitor.tsx

@@ -1,5 +1,6 @@
-// 站点拨测 — 任务列表 + 详情可观测 // Logan.Li
+// 站点拨测 — 任务列表 + 详情页可观测 // Logan.Li
 import { useState, useEffect, useCallback, useMemo } from 'react';
+import { useSearchParams } from 'react-router-dom';
 import { Card, CardContent } from '@/components/ui/card';
 import { Button } from '@/components/ui/button';
 import { Input } from '@/components/ui/input';
@@ -14,17 +15,18 @@ import {
   Table, TableBody, TableCell, TableHead, TableHeader, TableRow,
 } from '@/components/ui/table';
 import {
-  Plus, Trash2, Pencil, Loader2, RefreshCw, Activity, ShieldAlert, ChevronRight,
+  Plus, Trash2, Pencil, Loader2, RefreshCw, Activity, ShieldAlert, LineChart,
 } from 'lucide-react';
 import { toast } from 'sonner';
 import { siteApi } from '@/api';
 import { useConfirm } from '@/components/ui/confirm-dialog';
 import type { JsonData } from '@/types/common';
 import { SiteProtocolPieChart } from './site-monitor/SiteProtocolPieChart';
-import { SiteTaskDetailDialog } from './site-monitor/SiteTaskDetailDialog';
+import { SiteTaskDetailPage } from './site-monitor/SiteTaskDetailPage';
 import {
   PROBE_TYPE_OPTIONS, type ProbeType, type SiteStats, type SiteTask,
-  probeTypeMeta, fmtAvailResponse, fmtFrequency, isSslProbeTask, isSslExpiringSoon, normalizeProbeType,
+  probeTypeMeta, probeFrequencyHint, defaultProbeFrequency, MIN_PROBE_FREQUENCY, fmtAvailResponse, fmtFrequency,
+  isSslProbeTask, isSslExpiringSoon, normalizeProbeType,
 } from './site-monitor/helpers';
 
 interface CreateTaskForm {
@@ -34,7 +36,7 @@ interface CreateTaskForm {
 
 const emptyForm: CreateTaskForm = {
   name: '', url: '', type: 'HTTP',
-  frequency_sec: 60, timeout_sec: 10, expected_status_code: 200,
+  frequency_sec: defaultProbeFrequency('HTTP'), timeout_sec: 10, expected_status_code: 200,
 };
 
 const FILTER_TYPES: Array<ProbeType | 'ALL'> = ['ALL', ...PROBE_TYPE_OPTIONS];
@@ -47,6 +49,8 @@ function alertStatusBadge(status?: string) {
 }
 
 export function SiteMonitor() {
+  const [searchParams, setSearchParams] = useSearchParams();
+  const taskIdParam = searchParams.get('task');
   const [stats, setStats] = useState<SiteStats | null>(null);
   const [tasks, setTasks] = useState<SiteTask[]>([]);
   const [initialLoading, setInitialLoading] = useState(true);
@@ -56,10 +60,15 @@ export function SiteMonitor() {
   const [form, setForm] = useState<CreateTaskForm>({ ...emptyForm });
   const [saving, setSaving] = useState(false);
   const [selectedType, setSelectedType] = useState<ProbeType | 'ALL'>('ALL');
-  const [detailTask, setDetailTask] = useState<SiteTask | null>(null);
-  const [detailOpen, setDetailOpen] = useState(false);
   const _confirm = useConfirm();
 
+  const detailTask = useMemo(() => {
+    if (!taskIdParam) return null;
+    const id = Number(taskIdParam);
+    if (!Number.isFinite(id)) return null;
+    return tasks.find((t) => t.id === id) || null;
+  }, [taskIdParam, tasks]);
+
   const loadStats = useCallback(async () => {
     try { setStats(await siteApi.getStats() as SiteStats); } catch { /* ignore */ }
   }, []);
@@ -70,10 +79,6 @@ export function SiteMonitor() {
       const data = await siteApi.getTasks();
       const list = (data as JsonData)?.list as SiteTask[] || [];
       setTasks(list);
-      setDetailTask((prev) => {
-        if (!prev) return null;
-        return list.find((t) => t.id === prev.id) || null;
-      });
     } catch { /* ignore */ } finally {
       setRefreshing(false);
       setInitialLoading(false);
@@ -105,7 +110,8 @@ export function SiteMonitor() {
 
   const openCreate = (type?: ProbeType) => {
     setEditingTaskId(null);
-    setForm({ ...emptyForm, type: type || (selectedType !== 'ALL' ? selectedType : 'HTTP') });
+    const t = type || (selectedType !== 'ALL' ? selectedType : 'HTTP');
+    setForm({ ...emptyForm, type: t, frequency_sec: defaultProbeFrequency(t) });
     setFormOpen(true);
   };
 
@@ -122,8 +128,11 @@ export function SiteMonitor() {
   };
 
   const openDetail = (task: SiteTask) => {
-    setDetailTask(task);
-    setDetailOpen(true);
+    setSearchParams({ tab: 'site', task: String(task.id) });
+  };
+
+  const closeDetail = () => {
+    setSearchParams({ tab: 'site' });
   };
 
   const handleSave = async () => {
@@ -150,9 +159,8 @@ export function SiteMonitor() {
     if (!ok) return;
     try {
       await siteApi.deleteTask(task.id);
-      if (detailTask?.id === task.id) {
-        setDetailTask(null);
-        setDetailOpen(false);
+      if (taskIdParam === String(task.id)) {
+        closeDetail();
       }
       toast.success('任务已删除');
       loadTasks(); loadStats();
@@ -179,6 +187,24 @@ export function SiteMonitor() {
     );
   }
 
+  if (taskIdParam) {
+    if (!detailTask) {
+      return (
+        <div className="space-y-4 text-center py-16">
+          <p className="text-sm text-[var(--dg-text-muted)]">拨测任务不存在或已删除</p>
+          <Button variant="outline" size="sm" onClick={closeDetail}>返回列表</Button>
+        </div>
+      );
+    }
+    return (
+      <SiteTaskDetailPage
+        task={detailTask}
+        onBack={closeDetail}
+        onProbed={() => { loadTasks(); loadStats(); }}
+      />
+    );
+  }
+
   return (
     <div className="space-y-4">
       <div className="flex items-center justify-between flex-wrap gap-2">
@@ -219,7 +245,7 @@ export function SiteMonitor() {
                 <div className="flex items-center gap-2">
                   <Activity className="h-4 w-4 text-[var(--dg-text-muted)]" />
                   <h3 className="text-sm font-medium">拨测任务</h3>
-                  <span className="text-[10px] text-[var(--dg-text-muted)]">点击行查看详情</span>
+                  <span className="text-[10px] text-[var(--dg-text-muted)]">点击可观测进入详情页</span>
                 </div>
                 <div className="flex flex-wrap gap-1">
                   {FILTER_TYPES.map((type) => {
@@ -265,8 +291,7 @@ export function SiteMonitor() {
                       {filteredTasks.map((task) => (
                         <TableRow
                           key={task.id}
-                          className="border-[var(--dg-border)] cursor-pointer hover:bg-[var(--dg-bg-tertiary)]/60"
-                          onClick={() => openDetail(task)}
+                          className="border-[var(--dg-border)] hover:bg-[var(--dg-bg-tertiary)]/60"
                         >
                           <TableCell className="py-2">
                             <div className="min-w-0">
@@ -290,11 +315,13 @@ export function SiteMonitor() {
                           <TableCell className="py-2" onClick={(e) => e.stopPropagation()}>
                             <Switch checked={task.enabled} onCheckedChange={() => handleToggle(task)} />
                           </TableCell>
-                          <TableCell className="py-2" onClick={(e) => e.stopPropagation()}>
-                            <div className="flex items-center gap-0.5">
+                          <TableCell className="py-2">
+                            <div className="flex items-center justify-end gap-0.5">
+                              <Button variant="outline" size="sm" className="h-7 text-xs" onClick={() => openDetail(task)}>
+                                <LineChart className="h-3 w-3 mr-1" />可观测
+                              </Button>
                               <Button variant="ghost" size="icon-sm" onClick={() => openEdit(task)}><Pencil className="h-3.5 w-3.5" /></Button>
                               <Button variant="ghost" size="icon-sm" className="dg-text-red" onClick={() => handleDelete(task)}><Trash2 className="h-3.5 w-3.5" /></Button>
-                              <ChevronRight className="h-3.5 w-3.5 text-[var(--dg-text-muted)]" />
                             </div>
                           </TableCell>
                         </TableRow>
@@ -312,13 +339,6 @@ export function SiteMonitor() {
         </div>
       </div>
 
-      <SiteTaskDetailDialog
-        task={detailTask}
-        open={detailOpen}
-        onOpenChange={setDetailOpen}
-        onProbed={() => { loadTasks(); loadStats(); }}
-      />
-
       <Dialog open={formOpen} onOpenChange={(open) => { setFormOpen(open); if (!open) setEditingTaskId(null); }}>
         <DialogContent className="sm:max-w-md bg-[var(--dg-bg-secondary)] border-[var(--dg-border)]">
           <DialogHeader>
@@ -332,7 +352,10 @@ export function SiteMonitor() {
             </div>
             <div className="grid gap-1.5">
               <Label>协议类型</Label>
-              <Select value={form.type} onValueChange={(v) => setForm({ ...form, type: v as ProbeType })}>
+              <Select value={form.type} onValueChange={(v) => {
+                const t = v as ProbeType;
+                setForm({ ...form, type: t, frequency_sec: editingTaskId ? form.frequency_sec : defaultProbeFrequency(t) });
+              }}>
                 <SelectTrigger><SelectValue /></SelectTrigger>
                 <SelectContent>
                   {PROBE_TYPE_OPTIONS.map((t) => <SelectItem key={t} value={t}>{t}</SelectItem>)}
@@ -347,8 +370,9 @@ export function SiteMonitor() {
             <div className="grid grid-cols-2 gap-3">
               <div className="grid gap-1.5">
                 <Label>检测间隔 (秒)</Label>
-                <Input type="number" min={10} max={86400} value={form.frequency_sec}
-                  onChange={(e) => setForm({ ...form, frequency_sec: Number(e.target.value) || 60 })} />
+                <Input type="number" min={MIN_PROBE_FREQUENCY[form.type]} max={86400} value={form.frequency_sec}
+                  onChange={(e) => setForm({ ...form, frequency_sec: Number(e.target.value) || defaultProbeFrequency(form.type) })} />
+                <p className="text-[10px] text-[var(--dg-text-muted)]">{probeFrequencyHint(form.type)}</p>
               </div>
               <div className="grid gap-1.5">
                 <Label>超时 (秒)</Label>

frontend/src/pages/monitor/site-monitor/SiteChartCard.tsx

@@ -0,0 +1,32 @@
+// 站点拨测图表容器 — 详情页全宽展示，无放大弹框 // Logan.Li
+import type { ReactNode } from 'react';
+
+interface Props {
+  title: string;
+  icon?: ReactNode;
+  height?: number;
+  empty?: boolean;
+  children: (height: number) => ReactNode;
+}
+
+export function SiteChartCard({
+  title,
+  icon,
+  height = 260,
+  empty = false,
+  children,
+}: Props) {
+  return (
+    <div className="rounded-lg bg-[var(--dg-bg-tertiary)] p-3">
+      <div className="flex items-center gap-2 mb-2 min-w-0">
+        {icon}
+        <span className="text-xs text-[var(--dg-text-muted)] truncate">{title}</span>
+      </div>
+      {empty ? (
+        <p className="text-xs text-center py-12 text-[var(--dg-text-muted)]">暂无数据</p>
+      ) : (
+        children(height)
+      )}
+    </div>
+  );
+}

frontend/src/pages/monitor/site-monitor/SiteResultsPanel.tsx

@@ -23,8 +23,8 @@ import { SiteProtocolObs } from './observability/SiteProtocolObs';
 interface Props {
   task: SiteTask | null;
   onProbed: () => void;
-  /** 嵌入详情弹框时去掉外层 Card // Logan.Li */
-  embedded?: boolean;
+  /** 详情页全宽模式 // Logan.Li */
+  fullPage?: boolean;
 }
 
 function statusBadge(status: string) {
@@ -46,7 +46,7 @@ function httpCodeBadge(code?: number, expected = 200) {
   return <span className={`font-mono text-xs font-medium ${tone}`}>{code}</span>;
 }
 
-export function SiteResultsPanel({ task, onProbed, embedded = false }: Props) {
+export function SiteResultsPanel({ task, onProbed, fullPage = false }: Props) {
   const [results, setResults] = useState<SiteResult[]>([]);
   const [loading, setLoading] = useState(false);
   const [probing, setProbing] = useState(false);
@@ -98,7 +98,7 @@ export function SiteResultsPanel({ task, onProbed, embedded = false }: Props) {
         选择任务查看协议专属可观测指标
       </div>
     );
-    return embedded ? empty : (
+    return (
       <Card className="bg-[var(--dg-bg-secondary)] border-[var(--dg-border)]">
         <CardContent>{empty}</CardContent>
       </Card>
@@ -207,7 +207,7 @@ export function SiteResultsPanel({ task, onProbed, embedded = false }: Props) {
     <>
       <div className="flex items-center justify-between mb-4 flex-wrap gap-2">
         <div className="flex items-center gap-2 min-w-0">
-          {!embedded && (
+          {!fullPage && (
             <>
               <Activity className="h-4 w-4 text-[var(--dg-text-muted)] shrink-0" />
               <h3 className="text-sm font-medium text-[var(--dg-text-primary)] truncate">可观测 · {task.name}</h3>
@@ -256,7 +256,7 @@ export function SiteResultsPanel({ task, onProbed, embedded = false }: Props) {
       ) : (
         <>
           <SiteProtocolObs task={task} results={results} rangeLabel={rangeLabel} />
-          <div className="mt-4 overflow-x-auto max-h-56">
+          <div className={`mt-4 overflow-x-auto ${fullPage ? 'max-h-80' : 'max-h-56'}`}>
             {results.length === 0 ? (
               <p className="text-center py-6 text-sm text-[var(--dg-text-muted)]">该时段暂无拨测记录</p>
             ) : (
@@ -271,13 +271,9 @@ export function SiteResultsPanel({ task, onProbed, embedded = false }: Props) {
     </>
   );
 
-  if (embedded) {
-    return <div className="p-1">{body}</div>;
-  }
-
   return (
     <Card className="bg-[var(--dg-bg-secondary)] border-[var(--dg-border)]">
-      <CardContent className="p-4">{body}</CardContent>
+      <CardContent className={fullPage ? 'p-5' : 'p-4'}>{body}</CardContent>
     </Card>
   );
 }

frontend/src/pages/monitor/site-monitor/SiteTaskDetailDialog.tsx

@@ -1,42 +0,0 @@
-// 拨测任务详情弹框 — 可观测指标与历史记录 // Logan.Li
-import {
-  Dialog, DialogContent, DialogDescription, DialogHeader, DialogTitle,
-} from '@/components/ui/dialog';
-import { Badge } from '@/components/ui/badge';
-import type { SiteTask } from './helpers';
-import { fmtFrequency, normalizeProbeType } from './helpers';
-import { SiteResultsPanel } from './SiteResultsPanel';
-
-const dialogClass =
-  '!max-w-[min(96vw,88rem)] sm:!max-w-[min(96vw,88rem)] w-[min(96vw,88rem)] max-h-[92vh] flex flex-col gap-2 p-4 sm:p-5 bg-[var(--dg-bg-primary)] border-[var(--dg-border)] overflow-hidden';
-
-interface Props {
-  task: SiteTask | null;
-  open: boolean;
-  onOpenChange: (open: boolean) => void;
-  onProbed: () => void;
-}
-
-export function SiteTaskDetailDialog({ task, open, onOpenChange, onProbed }: Props) {
-  if (!task) return null;
-
-  const probeType = normalizeProbeType(task.type);
-
-  return (
-    <Dialog open={open} onOpenChange={onOpenChange}>
-      <DialogContent className={dialogClass}>
-        <DialogHeader className="shrink-0 space-y-1 pr-8">
-          <DialogTitle className="text-base truncate">{task.name}</DialogTitle>
-          <DialogDescription className="flex flex-wrap items-center gap-2 text-xs">
-            <span className="truncate max-w-full font-mono text-[var(--dg-text-muted)]">{task.url}</span>
-            <Badge variant="outline" className="text-[10px]">{probeType}</Badge>
-            <span className="text-[var(--dg-text-muted)]">频率 {fmtFrequency(task.frequency_sec)}</span>
-          </DialogDescription>
-        </DialogHeader>
-        <div className="flex-1 min-h-0 overflow-y-auto">
-          <SiteResultsPanel task={task} onProbed={onProbed} embedded />
-        </div>
-      </DialogContent>
-    </Dialog>
-  );
-}

frontend/src/pages/monitor/site-monitor/SiteTaskDetailPage.tsx

@@ -0,0 +1,37 @@
+// 拨测任务详情页 — 可观测指标与历史记录（非弹框）// Logan.Li
+import { ArrowLeft } from 'lucide-react';
+import { Button } from '@/components/ui/button';
+import { Badge } from '@/components/ui/badge';
+import type { SiteTask } from './helpers';
+import { fmtFrequency, normalizeProbeType } from './helpers';
+import { SiteResultsPanel } from './SiteResultsPanel';
+
+interface Props {
+  task: SiteTask;
+  onBack: () => void;
+  onProbed: () => void;
+}
+
+export function SiteTaskDetailPage({ task, onBack, onProbed }: Props) {
+  const probeType = normalizeProbeType(task.type);
+
+  return (
+    <div className="space-y-4">
+      <div className="flex items-start gap-3 flex-wrap">
+        <Button variant="outline" size="sm" className="h-8 shrink-0" onClick={onBack}>
+          <ArrowLeft className="h-3.5 w-3.5 mr-1" />返回列表
+        </Button>
+        <div className="min-w-0 flex-1">
+          <div className="flex items-center gap-2 flex-wrap">
+            <h2 className="text-lg font-semibold text-[var(--dg-text-primary)] truncate">{task.name}</h2>
+            <Badge variant="outline" className="text-[10px] shrink-0">{probeType}</Badge>
+            <span className="text-[10px] text-[var(--dg-text-muted)] shrink-0">频率 {fmtFrequency(task.frequency_sec)}</span>
+          </div>
+          <p className="text-xs font-mono text-[var(--dg-text-muted)] truncate mt-0.5">{task.url}</p>
+        </div>
+      </div>
+
+      <SiteResultsPanel task={task} onProbed={onProbed} fullPage />
+    </div>
+  );
+}

frontend/src/pages/monitor/site-monitor/helpers.ts

@@ -62,14 +62,41 @@ export const SITE_TIME_RANGE_LABELS: Record<SiteTimeRange, string> = {
   '7d': '近 7 天',
 };
 
+/** 各协议推荐默认拨测间隔（秒）// Logan.Li */
+export const DEFAULT_PROBE_FREQUENCY: Record<ProbeType, number> = {
+  HTTP: 60,
+  SSL: 3600,
+  TCP: 120,
+  DNS: 300,
+  PING: 120,
+};
+
+/** 各协议最小拨测间隔（秒）// Logan.Li */
+export const MIN_PROBE_FREQUENCY: Record<ProbeType, number> = {
+  HTTP: 30,
+  SSL: 600,
+  TCP: 30,
+  DNS: 60,
+  PING: 30,
+};
+
+export function defaultProbeFrequency(type: ProbeType): number {
+  return DEFAULT_PROBE_FREQUENCY[type] ?? 60;
+}
+
 export const probeTypeMeta: Record<ProbeType, { label: string; placeholder: string; hint: string }> = {
   HTTP: { label: '目标 URL', placeholder: 'https://example.com/health', hint: 'Web 请求（支持 http/https），检测状态码与响应时间' },
   SSL: { label: 'SSL 地址', placeholder: 'example.com:443 或 https://example.com', hint: 'TLS 握手检测证书（支持 host:port / https:// 域名，不发起 HTTP 请求）' },
   TCP: { label: '主机:端口', placeholder: '192.168.1.1:8080 或 example.com:443', hint: 'TCP 端口连通性' },
   DNS: { label: '域名', placeholder: 'example.com', hint: 'DNS 解析延迟与结果' },
-  PING: { label: '主机地址', placeholder: '192.168.1.1 或 example.com', hint: 'ICMP 连通性与延迟' },
+  PING: { label: '主机地址', placeholder: '192.168.1.1 或 example.com', hint: 'ICMP 连通性与延迟（默认 2 分钟/次）' },
 };
 
+export function probeFrequencyHint(type: ProbeType): string {
+  const sec = defaultProbeFrequency(type);
+  return `推荐 ${fmtFrequency(sec)}，最小 ${fmtFrequency(MIN_PROBE_FREQUENCY[type])}`;
+}
+
 /** 拨测频率展示 // Logan.Li */
 export function fmtFrequency(sec?: number): string {
   if (!sec) return '--';

frontend/src/pages/monitor/site-monitor/observability/SiteProtocolObs.tsx

@@ -11,7 +11,7 @@ import {
   analyzeSslResults, analyzeTcpResults,
 } from './analytics';
 import { SiteEventTimeline } from './SiteEventTimeline';
-import { ChartExpandShell } from '../../shared/ChartExpandShell';
+import { SiteChartCard } from '../SiteChartCard';
 import { MonitorRangeChartFrame } from '../../shared/MonitorRangeChartFrame';
 import { MonitorChartTooltip, MONITOR_CHART_GRID, MONITOR_CHART_TICK } from '../../shared/monitorChartTheme';
 
@@ -52,7 +52,7 @@ function HttpObs({ task, results, rangeLabel = '近 6 小时' }: Props) {
           </div>
         ))}
       </div>
-      <ChartExpandShell
+      <SiteChartCard
         icon={<Globe className="h-3.5 w-3.5 text-[var(--dg-text-muted)]" />}
         title={`HTTP 状态码时序（${rangeLabel}）`}
         empty={s.chart.length === 0}
@@ -76,7 +76,7 @@ function HttpObs({ task, results, rangeLabel = '近 6 小时' }: Props) {
             )}
           </MonitorRangeChartFrame>
         )}
-      </ChartExpandShell>
+      </SiteChartCard>
       <SiteEventTimeline title="4xx / 5xx / 超时事件" events={s.events} />
     </div>
   );
@@ -100,10 +100,10 @@ function SslObs({ task, results }: Props) {
           </div>
         ))}
       </div>
-      <ChartExpandShell
+      <SiteChartCard
         icon={<Shield className="h-3.5 w-3.5 text-[var(--dg-text-muted)]" />}
         title="证书剩余天数趋势"
-        compactHeight={160}
+        height={220}
         empty={s.chart.length === 0}
       >
         {(h) => (
@@ -122,7 +122,7 @@ function SslObs({ task, results }: Props) {
             )}
           </MonitorRangeChartFrame>
         )}
-      </ChartExpandShell>
+      </SiteChartCard>
       <SiteEventTimeline title="证书 / 握手异常" events={s.events} />
     </div>
   );
@@ -148,7 +148,7 @@ function LatencyObs({ results, mode, rangeLabel = '近 6 小时' }: Props & { mo
           </div>
         ))}
       </div>
-      <ChartExpandShell
+      <SiteChartCard
         icon={<Icon className="h-3.5 w-3.5 text-[var(--dg-text-muted)]" />}
         title={`${label}（${rangeLabel}）`}
         empty={s.chart.length === 0}
@@ -168,7 +168,7 @@ function LatencyObs({ results, mode, rangeLabel = '近 6 小时' }: Props & { mo
             )}
           </MonitorRangeChartFrame>
         )}
-      </ChartExpandShell>
+      </SiteChartCard>
       <SiteEventTimeline title="延迟尖峰 / 失败事件" events={s.events} />
     </div>
   );
@@ -190,10 +190,10 @@ function TcpObs({ results, rangeLabel = '近 6 小时' }: Props) {
           </div>
         ))}
       </div>
-      <ChartExpandShell
+      <SiteChartCard
         icon={<Network className="h-3.5 w-3.5 text-[var(--dg-text-muted)]" />}
         title="TCP 连通状态时序"
-        compactHeight={120}
+        height={200}
         empty={s.chart.length === 0}
       >
         {(h) => (
@@ -209,7 +209,7 @@ function TcpObs({ results, rangeLabel = '近 6 小时' }: Props) {
             )}
           </MonitorRangeChartFrame>
         )}
-      </ChartExpandShell>
+      </SiteChartCard>
       <SiteEventTimeline title="TCP 不通时间点" events={s.events} emptyText="近期 TCP 均连通" />
     </div>
   );

frontend/src/types/index.ts

@@ -209,6 +209,9 @@ export interface OperationLog {
   userAgent: string;
   result: 'success' | 'failure';
   message?: string;
+  request?: string;
+  response?: string;
+  error?: string;
   createdAt: string;
 }