chore: 统一本地服务器与远程仓库源码

- 合并 main 与 master 历史并以服务器结构为基线 - 保留迁移、数据保留、AWS 账单与部署安全能力 - 建立 SDD 规格和 CI 验证闭环
2026-08-05 20:03:25 +08:00
commit fd60361d93
@@ -11,6 +11,7 @@ import (
 	"strings"
 	"time"

+	"ezops/middleware"
 	"ezops/model"
 	ezredis "ezops/pkg/redis"

@@ -30,6 +31,24 @@ func NewAgentHandler(db *gorm.DB, cache ezredis.Cache, hub *MetricsHub) *AgentHa
 	return &AgentHandler{db: db, cache: cache, hubMetrics: hub}
 }

+// resolveAgentAsset 优先按上报主机名或内网 IP 关联现有资产，避免云实例名与系统 hostname 不一致。 // Logan.Li
+func (h *AgentHandler) resolveAgentAsset(hostname, reportIP, clientIP string) (model.Server, string, bool) {
+	matchIP := strings.TrimSpace(reportIP)
+	if matchIP == "" || matchIP == "unknown" {
+		matchIP = strings.TrimSpace(clientIP)
+	}
+
+	var server model.Server
+	query := h.db.Where("hostname = ?", hostname)
+	if matchIP != "" {
+		query = h.db.Where("hostname = ? OR ip = ?", hostname, matchIP)
+	}
+	if err := query.Take(&server).Error; err == nil {
+		return server, matchIP, true
+	}
+	return server, matchIP, false
+}
+
 // ReceiveReport 接收 Agent 上报的指标数据
 // POST /api/v1/agent/report
 func (h *AgentHandler) ReceiveReport(c *gin.Context) {
@@ -38,6 +57,9 @@ func (h *AgentHandler) ReceiveReport(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "请求格式错误: " + err.Error()})
 		return
 	}
+	if !middleware.RequireAgentHostname(c, req.Hostname) {
+		return
+	}

 	// 解析上报时间
 	reportTime := time.Now()
@@ -46,6 +68,14 @@ func (h *AgentHandler) ReceiveReport(c *gin.Context) {
 			reportTime = t
 		}
 	}
+	// Agent 上报时间统一存储为 UTC，避免 SQLite 按带时区文本比较时误判。 // Logan.Li
+	reportTime = reportTime.UTC()
+
+	matchedServer, matchIP, assetMatched := h.resolveAgentAsset(req.Hostname, req.IP, c.ClientIP())
+	canonicalHostname := req.Hostname
+	if assetMatched {
+		canonicalHostname = matchedServer.Hostname
+	}

 	// 序列化磁盘和端口信息
 	diskJSON, _ := json.Marshal(req.Disks)
@@ -61,8 +91,7 @@ func (h *AgentHandler) ReceiveReport(c *gin.Context) {

 	// 存储到数据库
 	report := model.AgentReport{
-		Hostname:     req.Hostname,
-		IP:           strings.TrimSpace(req.IP), // 使用 Agent 自报 IP，避免反向代理地址误关联。 // Logan.Li
+		Hostname:     canonicalHostname,
 		CPUUsage:     req.CPU.UsagePercent,
 		CPUIOwait:    req.CPU.IOWait,
 		CPUCores:     req.CPU.CoreCount,
@@ -104,86 +133,71 @@ func (h *AgentHandler) ReceiveReport(c *gin.Context) {
 	memMB := int64(memGB * 1024)           // GB → MB
 	diskGB := int64(totalDiskGB + 0.5)     // 39.99 → 40

-	clientIP := c.ClientIP()
-
-	// 三级匹配：优先用 Agent 上报的 IP，其次用请求源 IP，最后用报文的 hostname
-	matchIP := req.IP
-	if matchIP == "" {
-		matchIP = clientIP
-	}
-
-	// 直接 SQL 更新 asset_servers 监控字段
-	// 若 AgentVersion 非空则同步写入，否则保留数据库中已有版本号（防止旧版Agent空字段覆盖已设置的版本）
-	updateSQL := `UPDATE asset_servers SET 
-		cpu_usage = ?, cpu_iowait = ?, memory_usage = ?, disk_usage = ?,
-		cpu = ?, memory = ?, disk = ?,
-		status = ?, agent_status = ?` + func() string {
-		if req.AgentVersion != "" {
-			return `, agent_version = ?`
-		}
-		return ``
-	}() + `,
-		hostname = CASE WHEN hostname != ? AND ip = ? THEN ? ELSE hostname END,
-		updated_at = ?`
-	args := []interface{}{
-		req.CPU.UsagePercent, req.CPU.IOWait, req.Memory.UsagePercent, diskAvg,
-		req.CPU.CoreCount, memMB, diskGB,
-		"running", "online",
+	// 使用 map 按主键更新，避免可选系统字段导致原始 SQL 占位参数错位。 // Logan.Li
+	updates := map[string]interface{}{
+		"cpu_usage": req.CPU.UsagePercent, "memory_usage": req.Memory.UsagePercent,
+		"disk_usage": diskAvg,
+		"cpu":        req.CPU.CoreCount, "memory": memMB, "disk": diskGB,
+		"status": "running", "agent_status": "online", "updated_at": time.Now(),
 	}
 	if req.AgentVersion != "" {
-		args = append(args, req.AgentVersion)
+		updates["agent_version"] = req.AgentVersion
 	}
-	args = append(args,
-		// CASE WHEN hostname != ? AND ip = ? THEN ? ELSE hostname END
-		req.Hostname, matchIP, req.Hostname,
-	)
 	if req.System != nil {
 		if req.System.OSVersion != "" {
-			updateSQL += ", os = ?"
-			args = append(args, req.System.OSVersion)
+			updates["os"] = req.System.OSVersion
 		}
 		if req.System.Kernel != "" {
-			updateSQL += ", kernel = ?"
-			args = append(args, req.System.Kernel)
+			updates["kernel"] = req.System.Kernel
 		}
 		if req.System.Uptime > 0 {
-			updateSQL += ", uptime = ?"
-			args = append(args, req.System.Uptime)
+			updates["uptime"] = req.System.Uptime
 		}
 	}
-	args = append(args, time.Now())
-	updateSQL += " WHERE hostname = ? OR ip = ?"
-	args = append(args, req.Hostname, matchIP)
-
-	result := h.db.Exec(updateSQL, args...)
-
-	// 如果 hostname 和 IP 都没匹配到，尝试用 hostname 反向匹配 IP 字段
-	if result.RowsAffected == 0 && req.Hostname != matchIP {
-		updateSQL2 := updateSQL + " OR ip = ?"
-		args2 := append(args, req.Hostname)
-		result = h.db.Exec(updateSQL2, args2...)
+	// 兼容旧版 Agent：系统信息缺席时使用心跳中的运行时长补齐资产元数据。 // Logan.Li
+	if _, ok := updates["uptime"]; !ok && req.Heartbeat.UptimeSec > 0 {
+		updates["uptime"] = req.Heartbeat.UptimeSec
+	}
+	var result *gorm.DB
+	if assetMatched {
+		result = h.db.Model(&model.Server{}).Where("id = ?", matchedServer.ID).Updates(updates)
+	} else {
+		result = h.db.Model(&model.Server{}).Where("hostname = ? OR ip = ?", req.Hostname, matchIP).Updates(updates)
 	}

 	// 如果还是没匹配到 —— 按 hostname 显式查重后再注册 // Logan.Li
 	// asset_servers.hostname 无 UNIQUE 索引，OnConflict 不可靠，故先 First 查重，
 	// 避免 Agent 每次上报（10s）都新建记录导致资产越来越多。
-	if result.RowsAffected == 0 {
+	if result.Error == nil && result.RowsAffected == 0 {
 		osName := ""
+		kernel := ""
+		uptime := req.Heartbeat.UptimeSec
 		if req.System != nil {
 			osName = req.System.OSVersion
+			kernel = req.System.Kernel
+			if req.System.Uptime > 0 {
+				uptime = req.System.Uptime
+			}
 		}
 		var existing model.Server
-		if h.db.Where("hostname = ?", req.Hostname).First(&existing).Error == nil {
+		if h.db.Where("hostname = ?", req.Hostname).Take(&existing).Error == nil {
 			// 已自动注册过 → 仅更新实时指标，不重复创建
-			h.db.Model(&existing).Updates(map[string]interface{}{
+			existingUpdates := map[string]interface{}{
 				"ip": matchIP, "os": osName, "cpu": req.CPU.CoreCount,
 				"memory": memMB, "disk": diskGB, "status": "running",
 				"agent_status": "online", "agent_version": req.AgentVersion,
 				"cpu_usage": req.CPU.UsagePercent, "memory_usage": req.Memory.UsagePercent,
 				"disk_usage": diskAvg,
-			})
+			}
+			if kernel != "" {
+				existingUpdates["kernel"] = kernel
+			}
+			if uptime > 0 {
+				existingUpdates["uptime"] = uptime
+			}
+			h.db.Model(&existing).Updates(existingUpdates)
 		} else {
-			// 真正的新主机 → 注册（OnConflict 作为并发双保险）
+			// 真正的新主机 → 注册，hostname 无唯一索引时不使用 OnConflict。 // Logan.Li
 			newServer := model.Server{
 				Hostname:     req.Hostname,
 				IP:           matchIP,
@@ -197,19 +211,13 @@ func (h *AgentHandler) ReceiveReport(c *gin.Context) {
 				Status:       "running",
 				AgentStatus:  "online",
 				AgentVersion: req.AgentVersion,
+				Kernel:       kernel,
+				Uptime:       uptime,
 				CPUUsage:     req.CPU.UsagePercent,
 				MemoryUsage:  req.Memory.UsagePercent,
 				DiskUsage:    diskAvg,
 			}
-			if err := h.db.Clauses(clause.OnConflict{
-				Columns: []clause.Column{{Name: "hostname"}},
-				DoUpdates: clause.AssignmentColumns([]string{
-					"ip", "os", "cpu", "memory", "disk",
-					"status", "agent_status",
-					"cpu_usage", "memory_usage", "disk_usage",
-					"updated_at",
-				}),
-			}).Create(&newServer).Error; err != nil {
+			if err := h.db.Create(&newServer).Error; err != nil {
 				fmt.Printf("[agent] 自动注册主机 %q (IP: %s) 失败: %v\n", req.Hostname, matchIP, err)
 			} else {
 				fmt.Printf("[agent] 自动注册新主机: %q (IP: %s, CPU=%d核, 内存=%dMB, 磁盘=%dGB, OS=%q)\n",
@@ -222,7 +230,7 @@ func (h *AgentHandler) ReceiveReport(c *gin.Context) {
 	if h.hubMetrics != nil && result.RowsAffected > 0 {
 		h.hubMetrics.Broadcast(MetricsUpdate{
 			Type:           "metrics_update",
-			Hostname:       req.Hostname,
+			Hostname:       canonicalHostname,
 			CPU:            req.CPU.UsagePercent,
 			Memory:         req.Memory.UsagePercent,
 			Disk:           diskAvg,
@@ -240,13 +248,13 @@ func (h *AgentHandler) ReceiveReport(c *gin.Context) {
 	if h.cache != nil && h.cache.Capabilities().SortedSet {
 		timestamp := float64(reportTime.Unix())
 		ttl := 7 * 24 * time.Hour
-		h.writeHotMetric(c, "metrics:cpu:"+req.Hostname, req.CPU.UsagePercent, timestamp, ttl, reportTime)
-		h.writeHotMetric(c, "metrics:mem:"+req.Hostname, req.Memory.UsagePercent, timestamp, ttl, reportTime)
-		h.writeHotMetric(c, "metrics:load1:"+req.Hostname, req.CPU.Load1, timestamp, ttl, reportTime)
+		h.writeHotMetric(c, "metrics:cpu:"+canonicalHostname, req.CPU.UsagePercent, timestamp, ttl, reportTime)
+		h.writeHotMetric(c, "metrics:mem:"+canonicalHostname, req.Memory.UsagePercent, timestamp, ttl, reportTime)
+		h.writeHotMetric(c, "metrics:load1:"+canonicalHostname, req.CPU.Load1, timestamp, ttl, reportTime)
 	}

 	// 保存成功 — 响应中携带探针配置给 Agent
-	resp := h.makeProbeConfigResponse(req.Hostname, 200, "ok", req.ProbeResults)
+	resp := h.makeProbeConfigResponse(canonicalHostname, 200, "ok", req.ProbeResults)
 	c.JSON(http.StatusOK, resp)
 }

@@ -277,8 +285,9 @@ func (h *AgentHandler) writeHotMetric(c *gin.Context, key string, value float64,
 // GET /api/v1/agent/latest
 func (h *AgentHandler) GetLatestReports(c *gin.Context) {
 	var results []model.AgentLatestResponse
-	threeMinAgo := time.Now().UTC().Add(-3 * time.Minute) // SQLite 上报时间统一以 UTC 持久化。 // Logan.Li
-	// 以 servers 表为主，按资产名或 Agent 自报 IP 关联最近 3 分钟内的上报。 // Logan.Li
+	// 查询边界与 Agent 上报的 UTC 时间保持一致。 // Logan.Li
+	threeMinAgo := time.Now().UTC().Add(-3 * time.Minute)
+	// 以 servers 表为主，LEFT JOIN 最近 3 分钟内的 Agent 上报
 	// 未装 Agent 的主机也会显示（agent_status='not_installed'），打破"不显示→无法安装"的循环
 	h.db.Raw(`
 		SELECT
@@ -303,8 +312,7 @@ func (h *AgentHandler) GetLatestReports(c *gin.Context) {
 			a.report_time,
 			COALESCE(s.agent_version, '') as agent_version,
 			CASE
-				WHEN a.id IS NOT NULL THEN 'online'
-				WHEN COALESCE(s.agent_version, '') <> '' OR COALESCE(s.agent_status, '') = 'online' THEN 'offline'
+				WHEN a.hostname IS NOT NULL THEN COALESCE(s.agent_status, 'online')
 				ELSE 'not_installed'
 			END as agent_status,
 			COALESCE(s.os, '') as os,
@@ -314,13 +322,14 @@ func (h *AgentHandler) GetLatestReports(c *gin.Context) {
 			COALESCE(r.name, '') as region,
 			CASE WHEN s.password != '' OR s.ssh_key != '' THEN true ELSE false END as has_auth
 		FROM asset_servers s
-		LEFT JOIN monitor_agent_reports a ON a.id = (
-			SELECT ar.id FROM monitor_agent_reports ar
-			WHERE ar.report_time >= ?
-				AND (ar.hostname = s.hostname OR (ar.ip <> '' AND ar.ip = s.ip))
-			ORDER BY ar.report_time DESC, ar.id DESC
-			LIMIT 1
-		)
+		LEFT JOIN (
+			SELECT * FROM monitor_agent_reports
+			WHERE id IN (
+				SELECT MAX(id) FROM monitor_agent_reports
+				WHERE report_time >= ?
+				GROUP BY hostname
+			)
+		) a ON a.hostname = s.hostname
 		LEFT JOIN asset_regions r ON r.id = s.region_id
 		ORDER BY a.report_time DESC, s.id ASC
 	`, threeMinAgo).Scan(&results)
@@ -348,7 +357,7 @@ func parseFlexibleTime(s string) (time.Time, error) {
 	}
 	for _, layout := range layouts {
 		if t, err := time.ParseInLocation(layout, s, time.Local); err == nil {
-			return t.UTC(), nil // 历史报告使用 UTC 存储，避免自定义时间范围跨时区漏数。 // Logan.Li
+			return t, nil
 		}
 	}
 	return time.Time{}, fmt.Errorf("无法解析时间: %s", s)
@@ -356,7 +365,7 @@ func parseFlexibleTime(s string) (time.Time, error) {

 // resolveHostHistoryRange 解析历史查询时间范围（minutes / hours / start+end） // Logan.Li
 func resolveHostHistoryRange(c *gin.Context) (since, until time.Time, err error) {
-	until = time.Now().UTC() // 历史报告使用 UTC 存储，避免本地时区造成范围比较失效。 // Logan.Li
+	until = time.Now()
 	if startStr := strings.TrimSpace(c.Query("start")); startStr != "" {
 		endStr := strings.TrimSpace(c.Query("end"))
 		if endStr == "" {
@@ -410,16 +419,9 @@ func (h *AgentHandler) GetHostHistory(c *gin.Context) {
 		return
 	}

-	var server model.Server
-	serverIP := ""
-	if h.db.Where("hostname = ?", hostname).Take(&server).Error == nil {
-		serverIP = strings.TrimSpace(server.IP)
-	}
-
 	var reports []model.AgentReport
-	// 资产名可能与操作系统主机名不同，优先兼容 Agent 自报 IP。 // Logan.Li
-	h.db.Where("hostname = ? OR (ip <> '' AND ip = ?)", hostname, serverIP).
-		Where("report_time >= ? AND report_time <= ?", since, until).
+	// SQLite 会按时间文本比较，查询边界需统一转换为 UTC。 // Logan.Li
+	h.db.Where("hostname = ? AND report_time >= ? AND report_time <= ?", hostname, since.UTC(), until.UTC()).
 		Order("report_time ASC").
 		Find(&reports)

@@ -431,7 +433,7 @@ func (h *AgentHandler) GetHostHistory(c *gin.Context) {
 }

 // AggregateMetrics 聚合指标到 monitor_metrics_aggregate（Redis ZSet 或 DB 直读）// Logan.Li
-// POST /api/v1/agent/aggregate
+// POST /api/v1/agent/aggregate（需要控制台 JWT） // Logan.Li
 func (h *AgentHandler) AggregateMetrics(c *gin.Context) {
 	var req model.AggregateReq
 	if err := c.ShouldBindJSON(&req); err != nil {
@@ -504,7 +506,8 @@ func (h *AgentHandler) aggregateFromReports(req model.AggregateReq) (int64, erro

 	for _, iv := range intervals {
 		lookback := iv.duration * 200
-		since := time.Now().Add(-lookback)
+		// 本地 SQLite 模式下使用 UTC 边界查询 Agent 报告。 // Logan.Li
+		since := time.Now().UTC().Add(-lookback)
 		var reports []model.AgentReport
 		if err := h.db.Where("hostname = ? AND report_time >= ?", req.Hostname, since).
 			Order("report_time ASC").Find(&reports).Error; err != nil {
@@ -695,6 +698,9 @@ func avgDiskUsage(disks []model.DiskMetric) float64 {
 // GET /api/v1/agent/port-policy?hostname=xxx
 func (h *AgentHandler) GetPortPolicyForAgent(c *gin.Context) {
 	hostname := c.Query("hostname")
+	if !middleware.RequireAgentHostname(c, hostname) {
+		return
+	}
 	if hostname == "" {
 		c.JSON(http.StatusOK, model.Response{Code: 200, Message: "success", Data: model.AgentPortPolicyDTO{
 			PortFilterMode: "whitelist",
@@ -19,6 +19,7 @@ import (
 	"ezops/model"
 	"ezops/pkg/agentcli"
 	"ezops/pkg/agentcli/core"
+	"ezops/pkg/agentcli/guardrail"
 	"ezops/pkg/agentcli/llm"
 	"ezops/pkg/agentcli/safety"
 	"ezops/pkg/agentcli/tools"
@@ -36,21 +37,24 @@ func NewAgentCLIHandler(db *gorm.DB) *AgentCLIHandler { return &AgentCLIHandler{

 // wsEvent WebSocket 事件信封（后端→前端） // Logan.Li
 type wsEvent struct {
-	Type      string                 `json:"type"`
-	Round     int                    `json:"round,omitempty"`
-	SessionID uint                   `json:"session_id,omitempty"`
-	Thought   string                 `json:"thought,omitempty"`
-	ToolName  string                 `json:"tool_name,omitempty"`
-	ToolArgs  map[string]interface{} `json:"tool_args,omitempty"`
-	Risk      string                 `json:"risk,omitempty"`
-	Output    string                 `json:"output,omitempty"`
-	Success   bool                   `json:"success,omitempty"`
-	Duration  string                 `json:"duration,omitempty"`
-	Tokens    int                    `json:"tokens,omitempty"`
-	Answer    string                 `json:"answer,omitempty"`
-	Message   string                 `json:"message,omitempty"`
-	ConfirmID string                 `json:"confirm_id,omitempty"`
-	Command   string                 `json:"command,omitempty"`
+	Type       string                 `json:"type"`
+	Phase      string                 `json:"phase,omitempty"`
+	Summary    string                 `json:"summary,omitempty"`
+	Round      int                    `json:"round,omitempty"`
+	SessionID  uint                   `json:"session_id,omitempty"`
+	Thought    string                 `json:"thought,omitempty"`
+	ToolName   string                 `json:"tool_name,omitempty"`
+	ToolArgs   map[string]interface{} `json:"tool_args,omitempty"`
+	Risk       string                 `json:"risk,omitempty"`
+	Output     string                 `json:"output,omitempty"`
+	Success    bool                   `json:"success,omitempty"`
+	Duration   string                 `json:"duration,omitempty"`
+	OutputSize int                    `json:"output_size,omitempty"`
+	Tokens     int                    `json:"tokens,omitempty"`
+	Answer     string                 `json:"answer,omitempty"`
+	Message    string                 `json:"message,omitempty"`
+	ConfirmID  string                 `json:"confirm_id,omitempty"`
+	Command    string                 `json:"command,omitempty"`
 }

 // wsControl 前端→后端控制消息 // Logan.Li
@@ -83,7 +87,7 @@ type agentConn struct {
 	server        model.Server
 	sshCfg        remoteexec.SSHConfig
 	kubernetesCtx *kubernetesAgentContext
-	session       *model.AgentCLISession
+	session       *model.AIRun
 	taskCtx       context.Context
 	cancel        context.CancelFunc
 	totalTokens   int
@@ -94,6 +98,9 @@ type agentConn struct {
 	convHistory   []llm.Message
 	running       bool
 	runningMu     sync.Mutex
+	pendingSpans  map[string]string
+	seq           int
+	seqMu         sync.Mutex
 }

 // Run WebSocket 入口 // Logan.Li
@@ -141,7 +148,7 @@ func (h *AgentCLIHandler) runHostWS(c *gin.Context) {
 	ac := &agentConn{
 		conn: conn, db: h.db, mode: agentcli.RunModeHost,
 		userID: middleware.GetUserID(c), server: server, sshCfg: sshCfg,
-		taskCtx: context.Background(), confirms: make(map[string]chan bool),
+		taskCtx: context.Background(), confirms: make(map[string]chan bool), pendingSpans: make(map[string]string),
 	}
 	ac.write(wsEvent{Type: "session", SessionID: 0,
 		Message: fmt.Sprintf("已连接主机 %s（%s），LLM: %s。请描述要执行的任务。", server.Hostname, server.IP, llmCfg.Model)})
@@ -178,7 +185,7 @@ func (h *AgentCLIHandler) runKubernetesWS(c *gin.Context) {
 	ac := &agentConn{
 		conn: conn, db: h.db, mode: agentcli.RunModeKubernetes,
 		userID: middleware.GetUserID(c), kubernetesCtx: kCtx,
-		taskCtx: context.Background(), confirms: make(map[string]chan bool),
+		taskCtx: context.Background(), confirms: make(map[string]chan bool), pendingSpans: make(map[string]string),
 	}
 	target := buildKubernetesTargetInfo(kCtx)
 	ac.write(wsEvent{Type: "session", SessionID: 0,
@@ -191,7 +198,9 @@ func (ac *agentConn) wsReadLoop() {
 	for {
 		_, data, err := ac.conn.ReadMessage()
 		if err != nil {
-			ac.abort()
+			if ac.isRunning() {
+				ac.abort()
+			}
 			return
 		}
 		var ctrl wsControl
@@ -253,20 +262,27 @@ func (ac *agentConn) startTask(query, safetyMode string) {
 	if r := []rune(title); len(r) > 60 {
 		title = string(r[:60]) + "..."
 	}
-	sess := &model.AgentCLISession{
-		UserID: ac.userID, Mode: ac.mode, Title: title, Status: "running",
+	sess := &model.AIRun{
+		RunID: guardrail.NewTraceID(), UserID: ac.userID, Feature: "agent_cli",
+		Mode: ac.mode, Title: title, Status: "running",
 		Provider: llmCfg.Provider, Model: llmCfg.Model,
+		SafetyMode: safetyMode, StartedAt: time.Now(),
 	}
 	if ac.mode == agentcli.RunModeKubernetes && ac.kubernetesCtx != nil {
-		sess.ClusterID = ac.kubernetesCtx.cluster.ID
-		sess.ClusterName = ac.kubernetesCtx.cluster.Name
-		sess.Namespace = ac.kubernetesCtx.namespace
-		sess.PodName = ac.kubernetesCtx.podName
-		sess.Container = ac.kubernetesCtx.container
+		sess.SubjectType = "k8s_cluster"
+		if ac.kubernetesCtx.podName != "" {
+			sess.SubjectType = "pod"
+		} else if ac.kubernetesCtx.namespace != "" {
+			sess.SubjectType = "namespace"
+		}
+		sess.SubjectID = fmt.Sprintf("%d", ac.kubernetesCtx.cluster.ID)
+		sess.SubjectName = ac.kubernetesCtx.cluster.Name
+		sess.SubjectScope = ac.kubernetesCtx.namespace
 	} else {
-		sess.ServerID = ac.server.ID
-		sess.ServerName = ac.server.Hostname
-		sess.ServerHost = ac.server.IP
+		sess.SubjectType = "host"
+		sess.SubjectID = fmt.Sprintf("%d", ac.server.ID)
+		sess.SubjectName = ac.server.Hostname
+		sess.SubjectScope = ac.server.IP
 	}
 	if err := ac.db.Create(sess).Error; err != nil {
 		ac.write(wsEvent{Type: "error", Message: "创建会话失败: " + err.Error()})
@@ -284,15 +300,15 @@ func (ac *agentConn) resumeSession(sessionID uint) {
 		ac.write(wsEvent{Type: "error", Message: "任务进行中，请等待完成或停止"})
 		return
 	}
-	var sess model.AgentCLISession
+	var sess model.AIRun
 	q := ac.db.Where("user_id = ?", ac.userID)
 	if ac.mode == agentcli.RunModeKubernetes {
 		q = q.Where("mode IN ?", []string{agentcli.RunModeKubernetes, "k8s"})
 		if ac.kubernetesCtx != nil {
-			q = q.Where("cluster_id = ? AND namespace = ?", ac.kubernetesCtx.cluster.ID, ac.kubernetesCtx.namespace)
+			q = q.Where("subject_id = ? AND subject_scope = ?", fmt.Sprintf("%d", ac.kubernetesCtx.cluster.ID), ac.kubernetesCtx.namespace)
 		}
 	} else {
-		q = q.Where("mode = ? AND server_id = ?", ac.mode, ac.server.ID)
+		q = q.Where("mode = ? AND subject_type = ? AND subject_id = ?", ac.mode, "host", fmt.Sprintf("%d", ac.server.ID))
 	}
 	if err := q.First(&sess, sessionID).Error; err != nil {
 		ac.write(wsEvent{Type: "error", Message: "会话不存在或无权访问"})
@@ -302,8 +318,8 @@ func (ac *agentConn) resumeSession(sessionID uint) {
 		ac.write(wsEvent{Type: "error", Message: "该会话仍在执行中，无法恢复"})
 		return
 	}
-	var msgs []model.AgentCLIMessage
-	ac.db.Where("session_id = ?", sessionID).Order("id ASC").Find(&msgs)
+	var msgs []model.AIRunMessage
+	ac.db.Where("run_id = ?", sess.RunID).Order("seq ASC, id ASC").Find(&msgs)
 	ac.session = &sess
 	ac.convHistory = buildConvHistoryFromMessages(msgs)
 	ac.setTotalTokens(sess.TotalTokens)
@@ -337,7 +353,7 @@ func (ac *agentConn) continueTask(query, safetyMode string) {
 }

 // runTask 执行一轮 ReAct（新建或追问共用） // Logan.Li
-func (ac *agentConn) runTask(sess *model.AgentCLISession, query, safetyMode string, llmCfg model.LLMConfig, isContinue bool) {
+func (ac *agentConn) runTask(sess *model.AIRun, query, safetyMode string, llmCfg model.LLMConfig, isContinue bool) {
 	if ac.isRunning() {
 		ac.write(wsEvent{Type: "error", Message: "任务进行中，请等待完成或停止"})
 		return
@@ -390,9 +406,9 @@ func (ac *agentConn) runTask(sess *model.AgentCLISession, query, safetyMode stri
 	ac.taskCtx = ctx
 	ac.cancel = cancel
 	ac.setRunning(true)
-	ac.db.Model(sess).Update("status", "running")
+	ac.db.Model(sess).Updates(map[string]interface{}{"status": "running", "safety_mode": safetyMode})

-	ac.persistMsg(sess.ID, 0, "user", "user", query, "", "", "", "", false, "", 0)
+	ac.persistMsg(sess.RunID, 0, "user", "user", query, "", "", "", "", false, "", 0)

 	targetInfo := ac.buildTargetInfo()

@@ -454,11 +470,15 @@ func (ac *agentConn) onEvent(e core.Event) {
 	if e.Type == core.EventProgress && e.Tokens > 0 {
 		ac.setTotalTokens(e.Tokens)
 	}
+	if e.Type == core.EventDone || e.Type == core.EventError {
+		ac.setRunning(false)
+	}

 	ev := wsEvent{
-		Type: string(e.Type), Round: e.Round, Thought: e.Thought,
+		Type: string(e.Type), Phase: e.Phase, Summary: e.Summary,
+		Round: e.Round, Thought: e.Thought,
 		ToolName: e.ToolName, ToolArgs: e.ToolArgs, Risk: e.Risk,
-		Output: e.Output, Success: e.Success, Duration: e.Duration,
+		Output: e.Output, Success: e.Success, Duration: e.Duration, OutputSize: e.OutputSize,
 		Tokens: e.Tokens, Answer: e.Answer, Message: e.Message,
 	}
 	if ac.session != nil {
@@ -470,20 +490,25 @@ func (ac *agentConn) onEvent(e core.Event) {
 	if ac.session == nil {
 		return
 	}
-	sid := ac.session.ID
+	runID := ac.session.RunID
 	switch e.Type {
+	case core.EventStatus:
+		// status 事件不改 DB schema：duration 字段在 type=status 时复用为 phase。
+		ac.persistMsg(runID, e.Round, "status", "system", e.Summary, e.ToolName, "", "", e.Risk, e.Phase != core.PhaseError && e.Phase != core.PhaseBlocked, e.Phase, e.Tokens)
 	case core.EventThought:
-		ac.persistMsg(sid, e.Round, "thought", "assistant", e.Thought, "", "", "", "", false, "", 0)
+		ac.persistMsg(runID, e.Round, "thought", "assistant", e.Thought, "", "", "", "", false, "", 0)
 	case core.EventToolCall:
 		argsJSON, _ := json.Marshal(e.ToolArgs)
-		ac.persistMsg(sid, e.Round, "tool_call", "tool", "", e.ToolName, string(argsJSON), "", e.Risk, false, "", 0)
+		ac.persistMsg(runID, e.Round, "tool_call", "tool", string(argsJSON), e.ToolName, string(argsJSON), "", e.Risk, false, "", 0)
+		ac.startToolSpan(e, string(argsJSON))
 	case core.EventToolResult:
-		ac.persistMsg(sid, e.Round, "tool_result", "tool", e.Output, e.ToolName, "", "", "", e.Success, e.Duration, 0)
+		ac.persistMsg(runID, e.Round, "tool_result", "tool", e.Output, e.ToolName, "", "", "", e.Success, e.Duration, 0)
+		ac.finishToolSpan(e)
 	case core.EventDone:
 		ac.setTotalTokens(e.Tokens)
-		ac.persistMsg(sid, e.Round, "done", "assistant", e.Answer, "", "", "", "", true, "", e.Tokens)
+		ac.persistMsg(runID, e.Round, "done", "assistant", e.Answer, "", "", "", "", true, "", e.Tokens)
 	case core.EventError:
-		ac.persistMsg(sid, e.Round, "error", "assistant", e.Message, "", "", "", "", false, "", 0)
+		ac.persistMsg(runID, e.Round, "error", "assistant", e.Message, "", "", "", "", false, "", 0)
 	}
 }

@@ -503,7 +528,7 @@ func (ac *agentConn) confirmFn(toolName string, args map[string]interface{}, ris
 	if cmd == "" && (toolName == "kubernetes_action" || toolName == "k8s_action") {
 		cmd = fmt.Sprintf("%v %v", args["action"], args["name"])
 	}
-	ac.write(wsEvent{Type: "confirm", ConfirmID: confirmID, ToolName: toolName, Command: cmd, Risk: risk.Display(), ToolArgs: args})
+	ac.write(wsEvent{Type: "confirm", Phase: core.PhaseApproval, Summary: "等待用户确认", ConfirmID: confirmID, ToolName: toolName, Command: cmd, Risk: risk.Display(), ToolArgs: args})

 	ch := make(chan bool, 1)
 	ac.cfMu.Lock()
@@ -512,6 +537,7 @@ func (ac *agentConn) confirmFn(toolName string, args map[string]interface{}, ris

 	select {
 	case approved := <-ch:
+		ac.recordConfirmSpan(toolName, args, risk, approved)
 		return approved, nil
 	case <-ac.taskCtx.Done():
 		ac.delConfirm(confirmID)
@@ -522,6 +548,25 @@ func (ac *agentConn) confirmFn(toolName string, args map[string]interface{}, ris
 	}
 }

+func (ac *agentConn) recordConfirmSpan(toolName string, args map[string]interface{}, risk tools.RiskLevel, approved bool) {
+	if ac.session == nil {
+		return
+	}
+	decision := "rejected"
+	status := "skipped"
+	if approved {
+		decision = "approved"
+		status = "success"
+	}
+	argsJSON, _ := json.Marshal(args)
+	span := &model.AIRunSpan{
+		RunID: ac.session.RunID, SpanID: guardrail.NewSpanID(), Kind: "confirm", Name: toolName,
+		ToolSource: ac.toolSource(toolName), Input: guardrail.SanitizeJSON(string(argsJSON)),
+		Risk: risk.String(), Decision: decision, Status: status, StartedAt: time.Now(), CreatedAt: time.Now(),
+	}
+	_ = ac.db.Create(span).Error
+}
+
 // resolveConfirm 前端回传确认结果 // Logan.Li
 func (ac *agentConn) resolveConfirm(confirmID string, approved bool) {
 	ac.cfMu.Lock()
@@ -564,13 +609,13 @@ func (ac *agentConn) lastRound() int {
 		return 0
 	}
 	var maxRound int
-	ac.db.Model(&model.AgentCLIMessage{}).Where("session_id = ?", ac.session.ID).
+	ac.db.Model(&model.AIRunMessage{}).Where("run_id = ?", ac.session.RunID).
 		Select("COALESCE(MAX(round),0)").Scan(&maxRound)
 	return maxRound
 }

 // finish 结束本轮执行并更新会话 DB // Logan.Li
-func (ac *agentConn) finish(sess *model.AgentCLISession, status, errMsg string, rounds int, dur time.Duration) {
+func (ac *agentConn) finish(sess *model.AIRun, status, errMsg string, rounds int, dur time.Duration) {
 	ac.setRunning(false)
 	tokens := ac.getTotalTokens()
 	// done/error 已由引擎 onEvent 推送；此处仅 aborted 需补推 WS（引擎初始化失败在 runTask 内单独推送） // Logan.Li
@@ -581,6 +626,10 @@ func (ac *agentConn) finish(sess *model.AgentCLISession, status, errMsg string,
 		"status": status, "rounds": rounds, "duration": dur.Milliseconds(),
 		"total_tokens": tokens,
 	}
+	if status == "done" || status == "error" || status == "aborted" {
+		now := time.Now()
+		updates["finished_at"] = &now
+	}
 	if errMsg != "" {
 		updates["error"] = errMsg
 	}
@@ -595,15 +644,145 @@ func (ac *agentConn) write(ev wsEvent) {
 	_ = ac.conn.WriteMessage(websocket.TextMessage, b)
 }

-// persistMsg 持久化一条消息 // Logan.Li
-func (ac *agentConn) persistMsg(sid uint, round int, typ, role, content, toolName, args, output, risk string, success bool, dur string, tokens int) {
-	msg := &model.AgentCLIMessage{
-		SessionID: sid, Round: round, Type: typ, Role: role, Content: content,
-		ToolName: toolName, ToolArgs: args, ToolOutput: output, Risk: risk,
-		Success: success, Duration: dur, Tokens: tokens,
+// persistMsg 持久化一条 AI Run 回放消息。 // Logan.Li
+func (ac *agentConn) persistMsg(runID string, round int, typ, role, content, toolName, args, output, risk string, success bool, dur string, tokens int) {
+	content = guardrail.SanitizeText(content)
+	if typ == "tool_call" {
+		content = guardrail.SanitizeJSON(content)
+	}
+	msg := &model.AIRunMessage{
+		RunID: runID, Round: round, Seq: ac.nextSeq(),
+		Type: typ, Role: role, Content: content,
+		ToolName: toolName, Tokens: tokens,
 	}
 	if err := ac.db.Create(msg).Error; err != nil {
 		// 持久化失败不阻断主流程
 		_ = err
 	}
 }
+
+func (ac *agentConn) nextSeq() int {
+	ac.seqMu.Lock()
+	defer ac.seqMu.Unlock()
+	ac.seq++
+	return ac.seq
+}
+
+func (ac *agentConn) startToolSpan(e core.Event, argsJSON string) {
+	if ac.session == nil {
+		return
+	}
+	spanID := guardrail.NewSpanID()
+	key := ac.pendingSpanKey(e.Round, e.ToolName)
+	ac.runningMu.Lock()
+	ac.pendingSpans[key] = spanID
+	ac.runningMu.Unlock()
+	span := &model.AIRunSpan{
+		RunID: ac.session.RunID, SpanID: spanID, Kind: "tool", Name: e.ToolName,
+		ToolSource: ac.toolSource(e.ToolName), Input: guardrail.SanitizeJSON(argsJSON),
+		Risk: e.Risk, Decision: "auto", Status: "running",
+		StartedAt: time.Now(),
+	}
+	_ = ac.db.Create(span).Error
+}
+
+func (ac *agentConn) finishToolSpan(e core.Event) {
+	if ac.session == nil {
+		return
+	}
+	key := ac.pendingSpanKey(e.Round, e.ToolName)
+	ac.runningMu.Lock()
+	spanID := ac.pendingSpans[key]
+	delete(ac.pendingSpans, key)
+	ac.runningMu.Unlock()
+	if spanID == "" {
+		return
+	}
+	status := "success"
+	if !e.Success {
+		status = "error"
+	}
+	now := time.Now()
+	ac.db.Model(&model.AIRunSpan{}).Where("span_id = ?", spanID).Updates(map[string]interface{}{
+		"output": guardrail.SanitizeText(e.Output), "output_size": e.OutputSize,
+		"duration": parseDurationMillis(e.Duration), "status": status, "ended_at": &now,
+	})
+	ac.recordOpsCommand(e, spanID, status)
+}
+
+func (ac *agentConn) pendingSpanKey(round int, toolName string) string {
+	return fmt.Sprintf("%d:%s", round, toolName)
+}
+
+func (ac *agentConn) toolSource(toolName string) string {
+	switch toolName {
+	case "ssh_execute":
+		return "shell"
+	case "kubernetes_diagnose", "kubernetes_get", "pod_logs", "pod_execute", "kubernetes_action":
+		return "kubernetes"
+	case "aiops_asset_search", "aiops_alert_list", "aiops_metric_summary":
+		return "aiops"
+	default:
+		return "builtin"
+	}
+}
+
+func (ac *agentConn) recordOpsCommand(e core.Event, spanID, status string) {
+	if ac.session == nil {
+		return
+	}
+	command := e.ToolName
+	if e.ToolArgs != nil {
+		if cmd, ok := e.ToolArgs["command"].(string); ok && cmd != "" {
+			command = cmd
+		} else if action, ok := e.ToolArgs["action"]; ok {
+			command = fmt.Sprintf("%v %v", action, e.ToolArgs["name"])
+		}
+	}
+	targetType, targetID := ac.currentTarget()
+	cmd := &model.OpsCommand{
+		CommandID: guardrail.NewSpanID(), RunID: ac.session.RunID, SpanID: spanID,
+		UserID: ac.userID, ActorType: "ai", TargetType: targetType, TargetID: targetID,
+		CommandType: ac.commandType(e.ToolName), Command: guardrail.SanitizeText(command),
+		Risk: e.Risk, Decision: "auto", Status: status, OutputSize: e.OutputSize,
+		Duration: parseDurationMillis(e.Duration), ExecutedAt: time.Now(),
+	}
+	if !e.Success {
+		cmd.Error = guardrail.SanitizeText(e.Output)
+	}
+	_ = ac.db.Create(cmd).Error
+}
+
+func (ac *agentConn) currentTarget() (string, string) {
+	if ac.mode == agentcli.RunModeKubernetes && ac.kubernetesCtx != nil {
+		if ac.kubernetesCtx.podName != "" {
+			return "pod", fmt.Sprintf("%d/%s/%s", ac.kubernetesCtx.cluster.ID, ac.kubernetesCtx.namespace, ac.kubernetesCtx.podName)
+		}
+		return "k8s_cluster", fmt.Sprintf("%d", ac.kubernetesCtx.cluster.ID)
+	}
+	return "host", fmt.Sprintf("%d", ac.server.ID)
+}
+
+func (ac *agentConn) commandType(toolName string) string {
+	switch toolName {
+	case "ssh_execute", "pod_execute":
+		return "shell"
+	case "kubernetes_diagnose", "kubernetes_action", "kubernetes_get", "pod_logs":
+		return "kubernetes"
+	case "aiops_asset_search", "aiops_alert_list", "aiops_metric_summary":
+		return "api"
+	default:
+		return "tool"
+	}
+}
+
+func parseDurationMillis(raw string) int64 {
+	if raw == "" {
+		return 0
+	}
+	d, err := time.ParseDuration(raw)
+	if err != nil {
+		return 0
+	}
+	return d.Milliseconds()
+}
@@ -26,7 +26,7 @@ func (h *AgentCLIHandler) ListSessions(c *gin.Context) {
 		pageSize = 20
 	}

-	q := h.db.Model(&model.AgentCLISession{}).Where("user_id = ?", uid)
+	q := h.db.Model(&model.AIRun{}).Where("user_id = ? AND feature = ?", uid, "agent_cli")
 	if mode := c.Query("mode"); mode != "" {
 		mode = agentcli.NormalizeRunMode(mode)
 		if mode == agentcli.RunModeKubernetes {
@@ -36,18 +36,18 @@ func (h *AgentCLIHandler) ListSessions(c *gin.Context) {
 		}
 	}
 	if sid := c.Query("server_id"); sid != "" {
-		q = q.Where("server_id = ?", sid)
+		q = q.Where("subject_type = ? AND subject_id = ?", "host", sid)
 	}
 	if cid := c.Query("cluster_id"); cid != "" {
-		q = q.Where("cluster_id = ?", cid)
+		q = q.Where("subject_id = ?", cid)
 	}
 	if ns := c.Query("namespace"); ns != "" {
-		q = q.Where("namespace = ?", ns)
+		q = q.Where("subject_scope = ?", ns)
 	}

 	var total int64
 	q.Count(&total)
-	var sessions []model.AgentCLISession
+	var sessions []model.AIRun
 	if err := q.Order("created_at DESC").Offset((page - 1) * pageSize).Limit(pageSize).Find(&sessions).Error; err != nil {
 		c.JSON(http.StatusOK, model.Response{Code: 500, Message: "查询失败: " + err.Error()})
 		return
@@ -60,13 +60,13 @@ func (h *AgentCLIHandler) ListSessions(c *gin.Context) {
 func (h *AgentCLIHandler) GetSession(c *gin.Context) {
 	uid := middleware.GetUserID(c)
 	id := c.Param("id")
-	var sess model.AgentCLISession
+	var sess model.AIRun
 	if err := h.db.Where("user_id = ?", uid).First(&sess, id).Error; err != nil {
 		c.JSON(http.StatusOK, model.Response{Code: 404, Message: "会话不存在"})
 		return
 	}
-	var msgs []model.AgentCLIMessage
-	h.db.Where("session_id = ?", id).Order("id ASC").Find(&msgs)
+	var msgs []model.AIRunMessage
+	h.db.Where("run_id = ?", sess.RunID).Order("seq ASC, id ASC").Find(&msgs)
 	c.JSON(http.StatusOK, model.Response{Code: 200, Data: gin.H{"session": sess, "messages": msgs}})
 }

@@ -75,16 +75,18 @@ func (h *AgentCLIHandler) GetSession(c *gin.Context) {
 func (h *AgentCLIHandler) DeleteSession(c *gin.Context) {
 	uid := middleware.GetUserID(c)
 	id := c.Param("id")
-	var sess model.AgentCLISession
+	var sess model.AIRun
 	if err := h.db.Where("user_id = ?", uid).First(&sess, id).Error; err != nil {
 		c.JSON(http.StatusOK, model.Response{Code: 404, Message: "会话不存在"})
 		return
 	}
-	if err := h.db.Where("session_id = ?", id).Delete(&model.AgentCLIMessage{}).Error; err != nil {
+	if err := h.db.Where("run_id = ?", sess.RunID).Delete(&model.AIRunMessage{}).Error; err != nil {
 		c.JSON(http.StatusOK, model.Response{Code: 500, Message: "删除消息失败: " + err.Error()})
 		return
 	}
-	if err := h.db.Delete(&model.AgentCLISession{}, id).Error; err != nil {
+	_ = h.db.Where("run_id = ?", sess.RunID).Delete(&model.AIRunSpan{}).Error
+	_ = h.db.Where("run_id = ?", sess.RunID).Delete(&model.OpsCommand{}).Error
+	if err := h.db.Delete(&model.AIRun{}, id).Error; err != nil {
 		c.JSON(http.StatusOK, model.Response{Code: 500, Message: "删除会话失败: " + err.Error()})
 		return
 	}
@@ -10,7 +10,7 @@ import (
 )

 // buildConvHistoryFromMessages 将 DB 消息重建为追问用的 prior 历史（不含 system） // Logan.Li
-func buildConvHistoryFromMessages(msgs []model.AgentCLIMessage) []llm.Message {
+func buildConvHistoryFromMessages(msgs []model.AIRunMessage) []llm.Message {
 	var out []llm.Message
 	var pendingThought string
 	var pendingToolCalls []llm.ToolCall
@@ -40,7 +40,7 @@ func buildConvHistoryFromMessages(msgs []model.AgentCLIMessage) []llm.Message {
 		case "thought":
 			pendingThought = m.Content
 		case "tool_call":
-			args := validateToolArgsJSON(m.ToolArgs)
+			args := validateToolArgsJSON(m.Content)
 			tcID := fmt.Sprintf("hist-%d", m.ID)
 			pendingToolCalls = append(pendingToolCalls, llm.ToolCall{
 				ID: tcID, Type: "function",
@@ -56,9 +56,6 @@ func buildConvHistoryFromMessages(msgs []model.AgentCLIMessage) []llm.Message {
 				pendingToolCallIDs = pendingToolCallIDs[1:]
 			}
 			content := m.Content
-			if content == "" {
-				content = m.ToolOutput
-			}
 			out = append(out, llm.Message{
 				Role: "tool", Name: m.ToolName, Content: content, ToolCallID: toolID,
 			})
@@ -86,4 +83,4 @@ func validateToolArgsJSON(raw string) string {
 		return "{}"
 	}
 	return raw
-}
+}
@@ -108,4 +108,4 @@ func kubernetesEvolveHostKey(ctx *kubernetesAgentContext) string {
 		return base + "/" + ctx.podName
 	}
 	return base
-}
+}
@@ -6,11 +6,13 @@ import (
 	"log"
 	"net"
 	"net/http"
+	"net/url"
 	"strconv"
 	"strings"
 	"time"

 	"ezops/model"
+	"ezops/pkg/agentauth"

 	"github.com/gin-gonic/gin"
 	"golang.org/x/crypto/ssh"
@@ -142,28 +144,70 @@ func runSSHCommandWithTimeout(client *ssh.Client, cmd string, timeout time.Durat
 	}
 }

-// installServerURL 根据请求构造后端可访问地址，兼容 Nginx 等反向代理 // Logan.Li
-func installServerURL(c *gin.Context) string {
+// installServerURL 解析 Agent 对外服务地址，优先使用前端提交的浏览器 origin。 // Logan.Li
+func installServerURL(c *gin.Context, preferred string) (string, error) {
+	if strings.TrimSpace(preferred) != "" {
+		return validateInstallServerURL(preferred)
+	}
 	scheme := "http"
 	if c.Request.TLS != nil {
 		scheme = "https"
 	}
 	if proto := c.GetHeader("X-Forwarded-Proto"); proto != "" {
-		scheme = proto
+		scheme = strings.TrimSpace(strings.Split(proto, ",")[0])
 	}
 	// 优先使用 X-Forwarded-Host（Nginx 暴露给客户端的真实域名），其次用 Host // Logan.Li
 	host := c.Request.Host
 	if fwd := c.GetHeader("X-Forwarded-Host"); fwd != "" {
-		host = fwd
+		host = strings.TrimSpace(strings.Split(fwd, ",")[0])
 	}
-	// 去掉 scheme 的默认端口，避免生成 http://example.com:80 这类无效地址 // Logan.Li
-	if scheme == "http" && strings.HasSuffix(host, ":80") {
-		host = strings.TrimSuffix(host, ":80")
+	return validateInstallServerURL(fmt.Sprintf("%s://%s", scheme, host))
+}
+
+// validateInstallServerURL 只允许无路径的 HTTP(S) origin，防止命令参数注入。 // Logan.Li
+func validateInstallServerURL(rawURL string) (string, error) {
+	parsed, err := url.Parse(strings.TrimSpace(rawURL))
+	if err != nil || (parsed.Scheme != "http" && parsed.Scheme != "https") || parsed.Hostname() == "" {
+		return "", fmt.Errorf("Agent 服务地址必须是有效的 HTTP(S) 地址")
 	}
-	if scheme == "https" && strings.HasSuffix(host, ":443") {
-		host = strings.TrimSuffix(host, ":443")
+	if parsed.User != nil || (parsed.Path != "" && parsed.Path != "/") || parsed.RawQuery != "" || parsed.Fragment != "" {
+		return "", fmt.Errorf("Agent 服务地址只能填写域名 origin，不允许包含路径、认证信息或查询参数")
+	}
+	return fmt.Sprintf("%s://%s", parsed.Scheme, parsed.Host), nil
+}
+
+// shellQuote 对 SSH 远程命令参数做单引号转义。 // Logan.Li
+func shellQuote(value string) string {
+	return "'" + strings.ReplaceAll(value, "'", "'\"'\"'") + "'"
+}
+
+// agentInstallCommand 将资产主机名显式传给 Agent，避免系统主机名与资产别名不一致。 // Logan.Li
+func agentInstallCommand(serverURL, token, hostname string) string {
+	scriptURL := shellQuote(serverURL + "/agent/install.sh")
+	serverArg := shellQuote(serverURL)
+	tokenArg := shellQuote(token)
+	hostnameArg := shellQuote(hostname)
+	return fmt.Sprintf(
+		`tmp=$(mktemp /tmp/aiops-agent-install.XXXXXX) && trap 'rm -f "$tmp"' EXIT && curl -fsSL -o "$tmp" %s && if [ "$(id -u)" -eq 0 ]; then bash "$tmp" --server %s --token %s --hostname %s; else sudo -n bash "$tmp" --server %s --token %s --hostname %s; fi`,
+		scriptURL, serverArg, tokenArg, hostnameArg, serverArg, tokenArg, hostnameArg,
+	)
+}
+
+// agentInstallErrorMessage 将常见安装失败转换为可操作的中文提示。 // Logan.Li
+func agentInstallErrorMessage(serverURL, output string) string {
+	lowerOutput := strings.ToLower(output)
+	switch {
+	case strings.Contains(lowerOutput, "403") || strings.Contains(lowerOutput, "forbidden"):
+		return "域名代理或 WAF 拒绝 Agent 下载（HTTP 403），请为 /agent/* 关闭人机验证或加入机器访问白名单"
+	case strings.Contains(lowerOutput, "sudo: a password is required") || strings.Contains(lowerOutput, "需要密码"):
+		return "目标主机 SSH 用户没有免密 sudo 权限，请使用 root 账号或配置 passwordless sudo"
+	case strings.Contains(lowerOutput, "curl") && (strings.Contains(lowerOutput, "not found") || strings.Contains(lowerOutput, "未找到")):
+		return "目标主机未安装 curl"
+	case strings.Contains(lowerOutput, "下载失败") || strings.Contains(lowerOutput, "failed to connect") || strings.Contains(lowerOutput, "connection refused"):
+		return "目标主机无法下载安装脚本，请检查后端地址 " + serverURL + " 是否可达"
+	default:
+		return "Agent 安装命令执行失败"
 	}
-	return fmt.Sprintf("%s://%s", scheme, host)
 }

 // detectAgentVersion SSH 到目标主机读取已安装 Agent 的真实版本号 // Logan.Li
@@ -187,11 +231,12 @@ func (h *AgentInstallHandler) InstallAgent(c *gin.Context) {
 	id, _ := strconv.Atoi(c.Param("id"))

 	var req struct {
-		Username string `json:"username"`
-		Password string `json:"password"`
-		SSHKey   string `json:"ssh_key"`
-		AuthType string `json:"auth_type"`
-		Token    string `json:"token"`
+		Username  string `json:"username"`
+		Password  string `json:"password"`
+		SSHKey    string `json:"ssh_key"`
+		AuthType  string `json:"auth_type"`
+		Token     string `json:"token"`
+		ServerURL string `json:"server_url"`
 	}
 	// 兼容旧调用方式：token 在 query，新方式在 body
 	c.ShouldBindJSON(&req)
@@ -273,31 +318,24 @@ func (h *AgentInstallHandler) InstallAgent(c *gin.Context) {
 	}

 	// 3. 构造安装命令（使用 Agent API 服务地址）
-	serverURL := installServerURL(c)
-	token := req.Token
-	if token == "" {
-		token = c.Query("token")
+	serverURL, urlErr := installServerURL(c, req.ServerURL)
+	if urlErr != nil {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: urlErr.Error()})
+		return
+	}
+	token, err := agentauth.Issue(h.db, server.Hostname, ac.username)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "签发 Agent 凭证失败"})
+		return
 	}

-	// 4. 构造安装命令：root 用户直接 bash，非 root 用 sudo -n（无密码才执行，避免挂死）// Logan.Li
-	installCmd := fmt.Sprintf(
-		`if [ "$(id -u)" -eq 0 ]; then curl -fsSL %s/agent/install.sh | bash -s -- --server %s --token %s; else curl -fsSL %s/agent/install.sh | sudo -n bash -s -- --server %s --token %s; fi`,
-		serverURL, serverURL, token,
-		serverURL, serverURL, token,
-	)
+	// 4. 先下载脚本再执行，curl/WAF 失败时不会被管道末端 bash 的退出码掩盖。 // Logan.Li
+	installCmd := agentInstallCommand(serverURL, token, server.Hostname)

 	// 5. 执行安装
 	installOut, err := runSSHCommand(client, installCmd)
 	if err != nil {
-		msg := "安装命令执行失败"
-		lowerOut := strings.ToLower(installOut)
-		if strings.Contains(lowerOut, "sudo: a password is required") || strings.Contains(lowerOut, "需要密码") {
-			msg = "目标主机 SSH 用户没有免密 sudo 权限，请使用 root 账号或配置 passwordless sudo"
-		} else if strings.Contains(lowerOut, "curl") && (strings.Contains(lowerOut, "not found") || strings.Contains(lowerOut, "未找到")) {
-			msg = "目标主机未安装 curl"
-		} else if strings.Contains(lowerOut, "下载失败") || strings.Contains(lowerOut, "failed to connect") || strings.Contains(lowerOut, "connection refused") {
-			msg = "目标主机无法下载安装脚本，请检查后端地址 " + serverURL + " 是否可达"
-		}
+		msg := agentInstallErrorMessage(serverURL, installOut)
 		h.recordAgentAudit(ac, "install", resource, resourceID, 0,
 			fmt.Sprintf("server=%s arch=%s", serverURL, arch), installOut, msg)
 		c.JSON(http.StatusOK, model.Response{
@@ -311,6 +349,13 @@ func (h *AgentInstallHandler) InstallAgent(c *gin.Context) {
 	// 5. 验证安装是否成功
 	verifyOut, _ := runSSHCommand(client, "systemctl is-active aiops-agent 2>/dev/null || echo 'not_found'")
 	installed := contains(verifyOut, "active") || contains(verifyOut, "running")
+	if !installed {
+		msg := "安装脚本已执行，但 Agent 服务未运行"
+		h.recordAgentAudit(ac, "install", resource, resourceID, 0,
+			fmt.Sprintf("server=%s arch=%s", serverURL, arch), installOut+"\n"+verifyOut, msg)
+		c.JSON(http.StatusOK, model.Response{Code: 500, Message: msg, Data: gin.H{"output": installOut, "verify": verifyOut}})
+		return
+	}

 	var agentVer string
 	if installed {
@@ -339,7 +384,7 @@ func (h *AgentInstallHandler) InstallAgent(c *gin.Context) {
 	}

 	c.JSON(http.StatusOK, model.Response{
-		Code:    200,
+		Code: 200,
 		Message: func() string {
 			if installed {
 				return "Agent 安装成功，已自动启动并设置开机自启"
@@ -365,11 +410,7 @@ func (h *AgentInstallHandler) installOne(server model.Server, serverURL, token s

 	// 不强制 server.Status==running：只要 SSH 可达即可安装（DB 状态可能滞后于实际开机状态） // Logan.Li

-	installCmd := fmt.Sprintf(
-		`if [ "$(id -u)" -eq 0 ]; then curl -fsSL %s/agent/install.sh | bash -s -- --server %s --token %s; else curl -fsSL %s/agent/install.sh | sudo -n bash -s -- --server %s --token %s; fi`,
-		serverURL, serverURL, token,
-		serverURL, serverURL, token,
-	)
+	installCmd := agentInstallCommand(serverURL, token, server.Hostname)

 	installOut, err := runSSHCommand(client, installCmd)
 	if err != nil {
@@ -378,6 +419,9 @@ func (h *AgentInstallHandler) installOne(server model.Server, serverURL, token s

 	verifyOut, _ := runSSHCommand(client, "systemctl is-active aiops-agent 2>/dev/null || echo 'not_found'")
 	installed := contains(verifyOut, "active") || contains(verifyOut, "running")
+	if !installed {
+		return false, installOut, verifyOut, fmt.Errorf("安装脚本已执行，但 Agent 服务未运行")
+	}

 	if installed {
 		// 只更新在线状态；版本号仅在能读到真实版本时才写入，未上报时不写假版本 // Logan.Li
@@ -400,6 +444,7 @@ func (h *AgentInstallHandler) installOne(server model.Server, serverURL, token s
 func (h *AgentInstallHandler) BatchInstallAgent(c *gin.Context) {
 	var req struct {
 		ServerIDs   []uint `json:"server_ids"`
+		ServerURL   string `json:"server_url"`
 		Credentials map[string]struct {
 			Username string `json:"username"`
 			Password string `json:"password"`
@@ -412,8 +457,11 @@ func (h *AgentInstallHandler) BatchInstallAgent(c *gin.Context) {
 		return
 	}

-	serverURL := installServerURL(c)
-	token := c.Query("token")
+	serverURL, urlErr := installServerURL(c, req.ServerURL)
+	if urlErr != nil {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: urlErr.Error()})
+		return
+	}
 	ac := newAuditCtx(c) // 提前快照上下文，goroutine 内不可再用 c // Logan.Li

 	// 异步执行：立即返回，后台 goroutine 逐台安装
@@ -444,13 +492,23 @@ func (h *AgentInstallHandler) BatchInstallAgent(c *gin.Context) {
 				}
 			}

+			token, tokenErr := agentauth.Issue(h.db, server.Hostname, ac.username)
+			if tokenErr != nil {
+				log.Printf("[BatchInstall] %s 签发 Agent 凭证失败: %v", server.Hostname, tokenErr)
+				continue
+			}
 			installed, installOut, verifyOut, err := h.installOne(effectiveServer, serverURL, token)
 			res := server.Hostname + " (" + server.IP + ")"
 			rid := strconv.Itoa(int(server.ID))
 			reqDetail := fmt.Sprintf("server=%s host=%s", serverURL, res)
 			if err != nil {
-				log.Printf("[BatchInstall] %s (%s) 安装失败: %v", server.Hostname, server.IP, err)
-				h.recordAgentAudit(ac, "install", res, rid, 0, reqDetail, installOut, truncateAuditText(err.Error(), 500))
+				errMessage := agentInstallErrorMessage(serverURL, installOut)
+				if errMessage == "Agent 安装命令执行失败" {
+					errMessage = err.Error()
+				}
+				log.Printf("[BatchInstall] %s (%s) 安装失败: %s", server.Hostname, server.IP, errMessage)
+				respDetail := fmt.Sprintf("=== 安装输出 ===\n%s\n=== 服务状态 ===\n%s", installOut, verifyOut)
+				h.recordAgentAudit(ac, "install", res, rid, 0, reqDetail, respDetail, truncateAuditText(errMessage, 500))
 			} else {
 				successCount++
 				respDetail := fmt.Sprintf("=== 安装输出 ===\n%s\n=== 服务状态 ===\n%s", installOut, verifyOut)
@@ -592,13 +650,18 @@ func (h *AgentInstallHandler) BatchUninstallAgent(c *gin.Context) {
 func (h *AgentInstallHandler) BatchUpgradeAgent(c *gin.Context) {
 	var req struct {
 		ServerIDs []uint `json:"server_ids"`
+		ServerURL string `json:"server_url"`
 	}
 	if err := c.ShouldBindJSON(&req); err != nil || len(req.ServerIDs) == 0 {
 		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "请提供要升级的服务器 ID 列表"})
 		return
 	}

-	serverURL := installServerURL(c)
+	serverURL, urlErr := installServerURL(c, req.ServerURL)
+	if urlErr != nil {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: urlErr.Error()})
+		return
+	}
 	ac := newAuditCtx(c) // 提前快照上下文，goroutine 内不可再用 c // Logan.Li

 	// 异步执行：立即返回，后台逐台升级
@@ -634,8 +697,8 @@ func (h *AgentInstallHandler) BatchUpgradeAgent(c *gin.Context) {

 			// 下载新二进制 + 获取版本号 + 重启服务
 			upgradeScript := fmt.Sprintf(
-				`curl -fsSL -o /tmp/aiops-agent %s/api/agent/bin/%s && chmod +x /tmp/aiops-agent && systemctl stop aiops-agent 2>/dev/null; mv /tmp/aiops-agent /usr/local/bin/aiops-agent && systemctl start aiops-agent; ver=$(/usr/local/bin/aiops-agent version 2>/dev/null | awk '/AIOps Agent/{print $3}'); echo "UPGRADE_OK ver=$ver"`,
-				serverURL, binaryFile,
+				`curl -fsSL -o /tmp/aiops-agent %s && chmod +x /tmp/aiops-agent && systemctl stop aiops-agent 2>/dev/null; mv /tmp/aiops-agent /usr/local/bin/aiops-agent && systemctl start aiops-agent; ver=$(/usr/local/bin/aiops-agent version 2>/dev/null | awk '/AIOps Agent/{print $3}'); echo "UPGRADE_OK ver=$ver"`,
+				shellQuote(serverURL+"/api/agent/bin/"+binaryFile),
 			)

 			out, err := runSSHCommand(client, upgradeScript)
@@ -0,0 +1,63 @@
+package controller
+
+import (
+	"strings"
+	"testing"
+)
+
+// TestValidateInstallServerURL 验证 Agent 公网地址仅接受安全的 HTTP(S) origin。 // Logan.Li
+func TestValidateInstallServerURL(t *testing.T) {
+	tests := []struct {
+		name    string
+		input   string
+		want    string
+		wantErr bool
+	}{
+		{name: "HTTP 域名", input: "http://aiops.example.com", want: "http://aiops.example.com"},
+		{name: "HTTPS 域名", input: "https://aiops.example.com/", want: "https://aiops.example.com"},
+		{name: "自定义端口", input: "https://aiops.example.com:8443", want: "https://aiops.example.com:8443"},
+		{name: "拒绝路径", input: "https://aiops.example.com/api", wantErr: true},
+		{name: "拒绝查询参数", input: "https://aiops.example.com?x=1", wantErr: true},
+		{name: "拒绝非 HTTP 协议", input: "file:///tmp/agent", wantErr: true},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			got, err := validateInstallServerURL(test.input)
+			if test.wantErr {
+				if err == nil {
+					t.Fatalf("期望校验失败，实际返回 %q", got)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("地址校验失败: %v", err)
+			}
+			if got != test.want {
+				t.Fatalf("期望 %q，实际 %q", test.want, got)
+			}
+		})
+	}
+}
+
+// TestAgentInstallCommand 验证下载失败不会被管道末端命令掩盖。 // Logan.Li
+func TestAgentInstallCommand(t *testing.T) {
+	command := agentInstallCommand("https://aiops.example.com", "token-value", "asset-host")
+	if strings.Contains(command, "| bash") {
+		t.Fatalf("安装命令不应继续使用 curl 管道: %s", command)
+	}
+	if !strings.Contains(command, "curl -fsSL -o") || !strings.Contains(command, "https://aiops.example.com/agent/install.sh") {
+		t.Fatalf("安装命令缺少脚本下载步骤: %s", command)
+	}
+	if !strings.Contains(command, "--hostname 'asset-host'") {
+		t.Fatalf("安装命令必须固定上报资产主机名: %s", command)
+	}
+}
+
+// TestAgentInstallErrorMessage 验证 WAF 拒绝能返回明确提示。 // Logan.Li
+func TestAgentInstallErrorMessage(t *testing.T) {
+	message := agentInstallErrorMessage("https://aiops.example.com", "curl: (22) The requested URL returned error: 403")
+	if !strings.Contains(message, "WAF") || !strings.Contains(message, "/agent/*") {
+		t.Fatalf("WAF 错误提示不完整: %s", message)
+	}
+}
@@ -0,0 +1,190 @@
+package controller
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"ezops/model"
+
+	"github.com/gin-gonic/gin"
+	"github.com/glebarez/sqlite"
+	"gorm.io/gorm"
+	gormlogger "gorm.io/gorm/logger"
+)
+
+func TestReceiveReportMatchesExistingAssetByIP(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	db, err := gorm.Open(sqlite.Open("file:agent_report_match?mode=memory&cache=shared"), &gorm.Config{
+		Logger: gormlogger.Default.LogMode(gormlogger.Silent),
+	})
+	if err != nil {
+		t.Fatalf("打开测试数据库失败: %v", err)
+	}
+	if err := db.AutoMigrate(&model.Server{}, &model.AgentReport{}, &model.HealthProbe{}); err != nil {
+		t.Fatalf("迁移测试表失败: %v", err)
+	}
+
+	server := model.Server{Hostname: "c-redis-cluster-3", IP: "172.19.16.59", Status: "running"}
+	if err := db.Create(&server).Error; err != nil {
+		t.Fatalf("创建测试资产失败: %v", err)
+	}
+
+	body := []byte(`{
+		"hostname":"VM-16-59-tencentos",
+		"ip":"172.19.16.59",
+		"agent_version":"v2.1.0",
+		"cpu":{"usage_percent":12.5,"iowait":0.5,"core_count":4},
+		"memory":{"total_gb":7.8,"used_gb":3.1,"available_gb":4.7,"usage_percent":39.7},
+		"disks":[{"mount":"/","total_gb":100,"used_gb":25,"usage_percent":25}],
+		"system":{"os_version":"TencentOS Server 4","kernel":"6.6.0","uptime":3600}
+	}`)
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/agent/report", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	recorder := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(recorder)
+	c.Request = req
+
+	NewAgentHandler(db, nil, nil).ReceiveReport(c)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("上报返回码 = %d, body=%s", recorder.Code, recorder.Body.String())
+	}
+
+	var gotServer model.Server
+	if err := db.Take(&gotServer, server.ID).Error; err != nil {
+		t.Fatalf("读取资产失败: %v", err)
+	}
+	if gotServer.Hostname != server.Hostname || gotServer.AgentStatus != "online" {
+		t.Fatalf("资产关联错误: hostname=%q status=%q", gotServer.Hostname, gotServer.AgentStatus)
+	}
+	if gotServer.OS != "TencentOS Server 4" || gotServer.Kernel != "6.6.0" || gotServer.Uptime != 3600 {
+		t.Fatalf("系统字段更新错误: os=%q kernel=%q uptime=%d", gotServer.OS, gotServer.Kernel, gotServer.Uptime)
+	}
+
+	var report model.AgentReport
+	if err := db.Order("id DESC").Take(&report).Error; err != nil {
+		t.Fatalf("读取 Agent 报告失败: %v", err)
+	}
+	if report.Hostname != server.Hostname {
+		t.Fatalf("报告主机名未归一: got=%q want=%q", report.Hostname, server.Hostname)
+	}
+
+	var serverCount int64
+	db.Model(&model.Server{}).Count(&serverCount)
+	if serverCount != 1 {
+		t.Fatalf("上报后产生重复资产: count=%d", serverCount)
+	}
+}
+
+func TestReceiveReportUsesHeartbeatUptimeWithoutSystemPayload(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	db, err := gorm.Open(sqlite.Open("file:agent_report_heartbeat_uptime?mode=memory&cache=shared"), &gorm.Config{
+		Logger: gormlogger.Default.LogMode(gormlogger.Silent),
+	})
+	if err != nil {
+		t.Fatalf("打开测试数据库失败: %v", err)
+	}
+	if err := db.AutoMigrate(&model.Server{}, &model.AgentReport{}, &model.HealthProbe{}); err != nil {
+		t.Fatalf("迁移测试表失败: %v", err)
+	}
+
+	server := model.Server{Hostname: "c-monitor", IP: "172.19.16.113", Status: "running"}
+	if err := db.Create(&server).Error; err != nil {
+		t.Fatalf("创建测试资产失败: %v", err)
+	}
+
+	body := []byte(`{
+		"hostname":"c-monitor",
+		"ip":"172.19.16.113",
+		"agent_version":"v2.1.0",
+		"cpu":{"usage_percent":1.5,"core_count":4},
+		"memory":{"total_gb":15.1,"used_gb":1.8,"available_gb":13.3,"usage_percent":11.9},
+		"heartbeat":{"uptime_sec":7200}
+	}`)
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/agent/report", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	recorder := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(recorder)
+	c.Request = req
+
+	NewAgentHandler(db, nil, nil).ReceiveReport(c)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("上报返回码 = %d, body=%s", recorder.Code, recorder.Body.String())
+	}
+
+	var gotServer model.Server
+	if err := db.Take(&gotServer, server.ID).Error; err != nil {
+		t.Fatalf("读取资产失败: %v", err)
+	}
+	if gotServer.Uptime != 7200 {
+		t.Fatalf("心跳运行时长未写入资产: got=%d want=7200", gotServer.Uptime)
+	}
+}
+
+func TestGetLatestReportsUsesUTCTimeBoundary(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	db, err := gorm.Open(sqlite.Open("file:agent_latest_utc?mode=memory&cache=shared"), &gorm.Config{
+		Logger: gormlogger.Default.LogMode(gormlogger.Silent),
+	})
+	if err != nil {
+		t.Fatalf("打开测试数据库失败: %v", err)
+	}
+	if err := db.AutoMigrate(&model.Server{}, &model.AgentReport{}); err != nil {
+		t.Fatalf("迁移测试表失败: %v", err)
+	}
+	if err := db.Exec("CREATE TABLE asset_regions (id INTEGER PRIMARY KEY, name TEXT)").Error; err != nil {
+		t.Fatalf("创建区域测试表失败: %v", err)
+	}
+
+	server := model.Server{
+		Hostname:     "c-redis-cluster-3",
+		IP:           "172.19.16.59",
+		AgentVersion: "v2.1.0",
+		AgentStatus:  "online",
+		DiskUsage:    5.56,
+	}
+	if err := db.Create(&server).Error; err != nil {
+		t.Fatalf("创建测试资产失败: %v", err)
+	}
+	// 模拟 Agent 以 UTC 上报，同时应用运行在 UTC+8 时区。 // Logan.Li
+	report := model.AgentReport{
+		Hostname:   server.Hostname,
+		CPUUsage:   12.5,
+		MemUsage:   39.7,
+		CPUCores:   4,
+		ReportTime: time.Now().UTC().Add(-time.Minute),
+	}
+	if err := db.Create(&report).Error; err != nil {
+		t.Fatalf("创建 Agent 报告失败: %v", err)
+	}
+
+	originalLocal := time.Local
+	time.Local = time.FixedZone("UTC+8", 8*60*60)
+	defer func() { time.Local = originalLocal }()
+
+	recorder := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(recorder)
+	c.Request = httptest.NewRequest(http.MethodGet, "/api/v1/agent/latest", nil)
+	NewAgentHandler(db, nil, nil).GetLatestReports(c)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("查询返回码 = %d, body=%s", recorder.Code, recorder.Body.String())
+	}
+
+	var response struct {
+		Code int                         `json:"code"`
+		Data []model.AgentLatestResponse `json:"data"`
+	}
+	if err := json.Unmarshal(recorder.Body.Bytes(), &response); err != nil {
+		t.Fatalf("解析响应失败: %v", err)
+	}
+	if len(response.Data) != 1 {
+		t.Fatalf("主机数量 = %d, body=%s", len(response.Data), recorder.Body.String())
+	}
+	got := response.Data[0]
+	if got.AgentStatus != "online" || got.CPUUsage != 12.5 || got.MemUsage != 39.7 {
+		t.Fatalf("最新指标未命中: status=%q cpu=%.1f mem=%.1f", got.AgentStatus, got.CPUUsage, got.MemUsage)
+	}
+}
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"time"

+	"ezops/middleware"
 	"ezops/model"

 	"github.com/gin-gonic/gin"
@@ -25,7 +26,7 @@ func NewAgentTaskHandler(db *gorm.DB) *AgentTaskHandler {
 func (h *AgentTaskHandler) CreateTask(c *gin.Context) {
 	var req struct {
 		Hostname string `json:"hostname"`
-		Type     string `json:"type"`    // command / script
+		Type     string `json:"type"` // command / script
 		Command  string `json:"command"`
 		Timeout  int    `json:"timeout"`
 	}
@@ -47,12 +48,12 @@ func (h *AgentTaskHandler) CreateTask(c *gin.Context) {
 	username, _ := c.Get("username")

 	task := model.AgentTask{
-		TaskID:   uuid.New().String(),
-		Hostname: req.Hostname,
-		Type:     req.Type,
-		Command:  req.Command,
-		Timeout:  req.Timeout,
-		Status:   "pending",
+		TaskID:    uuid.New().String(),
+		Hostname:  req.Hostname,
+		Type:      req.Type,
+		Command:   req.Command,
+		Timeout:   req.Timeout,
+		Status:    "pending",
 		CreatedBy: fmt.Sprintf("%v", username),
 	}

@@ -72,6 +73,9 @@ func (h *AgentTaskHandler) PollTasks(c *gin.Context) {
 		c.JSON(400, model.Response{Code: 400, Message: "hostname 不能为空"})
 		return
 	}
+	if !middleware.RequireAgentHostname(c, hostname) {
+		return
+	}

 	// 查找该主机 pending 的任务，按时间排序，最多取 5 个
 	var tasks []model.AgentTask
@@ -94,6 +98,14 @@ func (h *AgentTaskHandler) PollTasks(c *gin.Context) {
 // POST /api/v1/agent/tasks/:task_id/result
 func (h *AgentTaskHandler) SubmitResult(c *gin.Context) {
 	taskID := c.Param("task_id")
+	var task model.AgentTask
+	if err := h.db.Where("task_id = ?", taskID).Take(&task).Error; err != nil {
+		c.JSON(404, model.Response{Code: 404, Message: "任务不存在"})
+		return
+	}
+	if !middleware.RequireAgentHostname(c, task.Hostname) {
+		return
+	}

 	var req struct {
 		ExitCode int    `json:"exit_code"`
@@ -167,9 +179,9 @@ func (h *AgentTaskHandler) QuickSetupRules(c *gin.Context) {
 		Pluck("hostname", &onlineHosts)

 	if len(onlineHosts) == 0 {
-		// 如果没有在线主机，尝试从 agent_reports 中获取最近 3 分钟活跃的主机名
+		// 如果没有在线主机，使用 UTC 边界从 Agent 报告中查找最近 3 分钟活跃主机。 // Logan.Li
 		h.db.Model(&model.AgentReport{}).
-			Where("report_time >= ?", time.Now().Add(-3*time.Minute)).
+			Where("report_time >= ?", time.Now().UTC().Add(-3*time.Minute)).
 			Distinct("hostname").
 			Pluck("hostname", &onlineHosts)
 	}
@@ -180,11 +192,11 @@ func (h *AgentTaskHandler) QuickSetupRules(c *gin.Context) {
 	}

 	type ruleDef struct {
-		Name     string
-		Metric   string
-		Operator string
+		Name      string
+		Metric    string
+		Operator  string
 		Threshold float64
-		Duration int
+		Duration  int
 	}

 	defaultRules := []ruleDef{
@@ -4,7 +4,6 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"log"
 	"net/http"
 	"strconv"
 	"strings"
@@ -399,9 +398,7 @@ func (h *AIOpsAlertAnalysisHandler) saveAnalysisTrace(ctx context.Context, in an
 		Duration:         in.Duration,
 		Error:            in.Error,
 	}
-	if err := h.db.WithContext(ctx).Create(&row).Error; err != nil {
-		log.Printf("[AIOpsAnalysis] 保存告警分析结果失败 (alert_id=%d, provider=%s): %v", in.AlertID, in.Provider, err)
-	}
+	_ = h.db.WithContext(ctx).Create(&row).Error
 }

 func marshalTraceJSON(v interface{}) string {
@@ -473,5 +473,3 @@ func (h *AlertHandler) NotifyRecovery(ruleName, hostname, metric, message string
 		}
 	}
 }
-
-
@@ -60,11 +60,21 @@ func (h *AlertHandler) UpdateContact(c *gin.Context) {
 		return
 	}
 	updates := map[string]interface{}{}
-	if req.Name != "" { updates["name"] = req.Name }
-	if req.Phone != "" { updates["phone"] = req.Phone }
-	if req.Email != "" { updates["email"] = req.Email }
-	if req.ChannelType != "" { updates["channel_type"] = req.ChannelType }
-	if req.WebhookURL != "" { updates["webhook_url"] = req.WebhookURL }
+	if req.Name != "" {
+		updates["name"] = req.Name
+	}
+	if req.Phone != "" {
+		updates["phone"] = req.Phone
+	}
+	if req.Email != "" {
+		updates["email"] = req.Email
+	}
+	if req.ChannelType != "" {
+		updates["channel_type"] = req.ChannelType
+	}
+	if req.WebhookURL != "" {
+		updates["webhook_url"] = req.WebhookURL
+	}
 	h.db.Model(&contact).Updates(updates)
 	h.db.First(&contact, id)
 	c.JSON(http.StatusOK, model.Response{Code: 200, Message: "更新成功", Data: contact})
@@ -127,8 +137,12 @@ func (h *AlertHandler) UpdateContactGroup(c *gin.Context) {
 		return
 	}
 	updates := map[string]interface{}{}
-	if req.GroupName != "" { updates["group_name"] = req.GroupName }
-	if req.Notes != "" { updates["notes"] = req.Notes }
+	if req.GroupName != "" {
+		updates["group_name"] = req.GroupName
+	}
+	if req.Notes != "" {
+		updates["notes"] = req.Notes
+	}
 	if len(req.ContactIDs) > 0 {
 		idsJSON, _ := json.Marshal(req.ContactIDs)
 		updates["contact_ids"] = string(idsJSON)
@@ -227,7 +227,8 @@ func (e *AlertEngine) checkOfflineAlerts() {
 	e.db.Select("ip, hostname").Group("ip").Find(&servers)

 	// 收集所有 agent_reports 中活跃上报的主机名（最近 3 分钟内有上报）
-	threeMinAgo := time.Now().Add(-offlineThreshold)
+	// Agent 报告统一使用 UTC，避免 SQLite 时区文本比较导致误报离线。 // Logan.Li
+	threeMinAgo := time.Now().UTC().Add(-offlineThreshold)

 	var activeHostnames []string
 	e.db.Model(&model.AgentReport{}).
@@ -384,4 +384,4 @@ func isMiddlewareMetric(metric string) bool {
 		}
 	}
 	return false
-}
+}
@@ -181,4 +181,4 @@ func (e *AlertEngine) fireSNMPAlert(rule model.MonitorAlertRule, device model.SN
 // isSNMPMetric 判断 AgentAlert 是否属于 SNMP // Logan.Li
 func isSNMPMetric(metric string) bool {
 	return len(metric) >= 5 && metric[:5] == "snmp_"
-}
+}
@@ -104,4 +104,4 @@ var metricCatalog = []MetricCatalogCategory{
 // GET /api/v1/alerts/metric-catalog
 func (h *AlertHandler) GetMetricCatalog(c *gin.Context) {
 	c.JSON(http.StatusOK, model.Response{Code: 200, Data: gin.H{"categories": metricCatalog}})
-}
+}
@@ -178,4 +178,4 @@ func fallbackNotifyRecovery(db *gorm.DB, ruleName, hostname, metric, message str
 			fmt.Printf("[AlertNotify] 飞书恢复回退失败 (渠道:%s): %v\n", ch.Name, err)
 		}
 	}
-}
+}
@@ -79,16 +79,16 @@ func notifyTemplateVars(ruleName, hostname, metric, severity, message string, va
 		platform = defaultNotifyPlatformName
 	}
 	return map[string]string{
-		"time":            time.Now().Format("2006-01-02 15:04:05"),
-		"platform":        platform,
-		"rule_name":       ruleName,
-		"hostname":        hostname,
-		"metric":          metric,
-		"severity":        severity,
-		"severity_label":  sevLabel,
-		"message":         message,
-		"value":           fmt.Sprintf("%.2f", value),
-		"threshold":       fmt.Sprintf("%.2f", threshold),
+		"time":           time.Now().Format("2006-01-02 15:04:05"),
+		"platform":       platform,
+		"rule_name":      ruleName,
+		"hostname":       hostname,
+		"metric":         metric,
+		"severity":       severity,
+		"severity_label": sevLabel,
+		"message":        message,
+		"value":          fmt.Sprintf("%.2f", value),
+		"threshold":      fmt.Sprintf("%.2f", threshold),
 	}
 }

@@ -134,4 +134,4 @@ func buildAlertContent(ruleName, hostname, metric, severity, message string, val
 		"**规则名称：** %s\\n**目标主机：** %s\\n**指标类型：** %s\\n**告警级别：** %s\\n**当前值：** %.2f\\n**阈值：** %.2f\\n**详细信息：** %s\\n**触发时间：** %s",
 		ruleName, hostname, metric, severity, value, threshold, message, time.Now().Format("2006-01-02 15:04:05"),
 	)
-}
+}
@@ -126,4 +126,4 @@ func isValidNotifyCategory(cat model.AlertNotifyCategory) bool {
 		}
 	}
 	return false
-}
+}
@@ -15,30 +15,30 @@ import (

 // CreateSilenceRequest 创建静默规则请求
 type CreateSilenceRequest struct {
-	Name        string   `json:"name" binding:"required"`
-	Description string   `json:"description"`
-	RuleIDs     []uint   `json:"rule_ids"`
-	TargetIDs   []uint   `json:"target_ids"`
+	Name        string                      `json:"name" binding:"required"`
+	Description string                      `json:"description"`
+	RuleIDs     []uint                      `json:"rule_ids"`
+	TargetIDs   []uint                      `json:"target_ids"`
 	Matchers    []model.AlertSilenceMatcher `json:"matchers"`
-	SilenceType string   `json:"silence_type"`
-	StartTime   string   `json:"start_time"`
-	EndTime     string   `json:"end_time" binding:"required"`
-	Weekdays    []int    `json:"weekdays"`
-	Status      *int     `json:"status"`
+	SilenceType string                      `json:"silence_type"`
+	StartTime   string                      `json:"start_time"`
+	EndTime     string                      `json:"end_time" binding:"required"`
+	Weekdays    []int                       `json:"weekdays"`
+	Status      *int                        `json:"status"`
 }

 // UpdateSilenceRequest 更新静默规则请求
 type UpdateSilenceRequest struct {
-	Name        string   `json:"name"`
-	Description string   `json:"description"`
-	RuleIDs     []uint   `json:"rule_ids"`
-	TargetIDs   []uint   `json:"target_ids"`
+	Name        string                      `json:"name"`
+	Description string                      `json:"description"`
+	RuleIDs     []uint                      `json:"rule_ids"`
+	TargetIDs   []uint                      `json:"target_ids"`
 	Matchers    []model.AlertSilenceMatcher `json:"matchers"`
-	SilenceType string   `json:"silence_type"`
-	StartTime   string   `json:"start_time"`
-	EndTime     string   `json:"end_time"`
-	Weekdays    []int    `json:"weekdays"`
-	Status      *int     `json:"status"`
+	SilenceType string                      `json:"silence_type"`
+	StartTime   string                      `json:"start_time"`
+	EndTime     string                      `json:"end_time"`
+	Weekdays    []int                       `json:"weekdays"`
+	Status      *int                        `json:"status"`
 }

 // ListSilences GET /alerts/silences
@@ -60,11 +60,11 @@ func (h *AlertHandler) ListSilences(c *gin.Context) {
 	// 解析 JSON 字段为前端友好的格式
 	type SilenceWithParsed struct {
 		model.AlertSilence
-		RuleIDList   []uint                        `json:"rule_id_list"`
-		TargetIDList []uint                        `json:"target_id_list"`
-		MatcherList  []model.AlertSilenceMatcher   `json:"matcher_list"`
-		WeekdayList  []int                         `json:"weekday_list"`
-		IsActive     bool                          `json:"is_active"`
+		RuleIDList   []uint                      `json:"rule_id_list"`
+		TargetIDList []uint                      `json:"target_id_list"`
+		MatcherList  []model.AlertSilenceMatcher `json:"matcher_list"`
+		WeekdayList  []int                       `json:"weekday_list"`
+		IsActive     bool                        `json:"is_active"`
 	}

 	var result []SilenceWithParsed
@@ -13,19 +13,19 @@ import (

 // UnifiedAlertItem 统一告警事件视图 // Logan.Li
 type UnifiedAlertItem struct {
-	ID          string  `json:"id"`
-	SourceType  string  `json:"source_type"`
-	RuleName    string  `json:"rule_name"`
-	Title       string  `json:"title"`
-	Message     string  `json:"message"`
-	Severity    string  `json:"severity"`
-	Status      string  `json:"status"`
-	Target      string  `json:"target"`
-	Metric      string  `json:"metric"`
-	Value       float64 `json:"value"`
-	Threshold   float64 `json:"threshold"`
-	StartedAt   string  `json:"started_at"`
-	ResolvedAt  *string `json:"resolved_at,omitempty"`
+	ID         string  `json:"id"`
+	SourceType string  `json:"source_type"`
+	RuleName   string  `json:"rule_name"`
+	Title      string  `json:"title"`
+	Message    string  `json:"message"`
+	Severity   string  `json:"severity"`
+	Status     string  `json:"status"`
+	Target     string  `json:"target"`
+	Metric     string  `json:"metric"`
+	Value      float64 `json:"value"`
+	Threshold  float64 `json:"threshold"`
+	StartedAt  string  `json:"started_at"`
+	ResolvedAt *string `json:"resolved_at,omitempty"`
 }

 // ListUnifiedAlerts 统一告警列表（主机 + 中间件 + 站点 + 日志）
@@ -212,4 +212,4 @@ func countSeverityStatus(items []UnifiedAlertItem, sev, status string) int {
 		}
 	}
 	return n
-}
+}
@@ -114,8 +114,8 @@ func (h *ApprovalHandler) CreateProcess(c *gin.Context) {
 	var workflowSteps []model.ApprovalWorkflowStep
 	stepCount := 1
 	var approvalSteps []struct {
-		name     string
-		stepType string
+		name        string
+		stepType    string
 		approverIDs []uint
 	}
 	if workflow.ID > 0 {
@@ -126,8 +126,8 @@ func (h *ApprovalHandler) CreateProcess(c *gin.Context) {
 			}
 			stepCount++
 			approvalSteps = append(approvalSteps, struct {
-				name     string
-				stepType string
+				name        string
+				stepType    string
 				approverIDs []uint
 			}{ws.Name, ws.StepType, ParseApproverIDs(ws.ApproverIDs)})
 		}
@@ -111,14 +111,14 @@ func (h *WorkflowHandler) CreateWorkflow(c *gin.Context) {

 	for _, s := range req.Steps {
 		step := model.ApprovalWorkflowStep{
-			WorkflowID:         workflow.ID,
-			StepNumber:         s.StepNumber,
-			Name:               s.Name,
-			StepType:           s.StepType,
-			ApproverIDs:        s.ApproverIDs,
-			IsRequired:         s.IsRequired,
-			TimeoutHours:       s.TimeoutHours,
-			AutoApprove: s.AutoApproveTimeout,
+			WorkflowID:   workflow.ID,
+			StepNumber:   s.StepNumber,
+			Name:         s.Name,
+			StepType:     s.StepType,
+			ApproverIDs:  s.ApproverIDs,
+			IsRequired:   s.IsRequired,
+			TimeoutHours: s.TimeoutHours,
+			AutoApprove:  s.AutoApproveTimeout,
 		}
 		if step.TimeoutHours == 0 {
 			step.TimeoutHours = 24
@@ -195,14 +195,14 @@ func (h *WorkflowHandler) UpdateWorkflow(c *gin.Context) {
 		tx.Where("workflow_id = ?", workflow.ID).Delete(&model.ApprovalWorkflowStep{})
 		for _, s := range req.Steps {
 			step := model.ApprovalWorkflowStep{
-				WorkflowID:         workflow.ID,
-				StepNumber:         s.StepNumber,
-				Name:               s.Name,
-				StepType:           s.StepType,
-				ApproverIDs:        s.ApproverIDs,
-				IsRequired:         s.IsRequired,
-				TimeoutHours:       s.TimeoutHours,
-				AutoApprove: s.AutoApproveTimeout,
+				WorkflowID:   workflow.ID,
+				StepNumber:   s.StepNumber,
+				Name:         s.Name,
+				StepType:     s.StepType,
+				ApproverIDs:  s.ApproverIDs,
+				IsRequired:   s.IsRequired,
+				TimeoutHours: s.TimeoutHours,
+				AutoApprove:  s.AutoApproveTimeout,
 			}
 			if step.TimeoutHours == 0 {
 				step.TimeoutHours = 24
@@ -4,8 +4,12 @@ import (
 	"fmt"
 	"net/http"
 	"sort"
+	"strings"
+	"sync"
 	"time"

+	"ezops/config"
+	"ezops/middleware"
 	"ezops/model"

 	"github.com/gin-gonic/gin"
@@ -14,11 +18,126 @@ import (

 // BillingHandler 云账单处理器
 type BillingHandler struct {
-	db *gorm.DB
+	db      *gorm.DB
+	billing *config.BillingConfig
+	rateMu  sync.RWMutex
 }

-func NewBillingHandler(db *gorm.DB) *BillingHandler {
-	return &BillingHandler{db: db}
+func NewBillingHandler(db *gorm.DB, configs ...*config.BillingConfig) *BillingHandler {
+	billingConfig := &config.BillingConfig{BaseCurrency: "CNY", ExchangeRates: map[string]float64{"CNY": 1, "USD": 7.2}}
+	if len(configs) > 0 && configs[0] != nil {
+		billingConfig = &config.BillingConfig{BaseCurrency: strings.ToUpper(configs[0].BaseCurrency), ExchangeRates: map[string]float64{}}
+		for currency, rate := range configs[0].ExchangeRates {
+			billingConfig.ExchangeRates[strings.ToUpper(currency)] = rate
+		}
+	}
+	if billingConfig.BaseCurrency == "" {
+		billingConfig.BaseCurrency = "CNY"
+	}
+	if len(billingConfig.ExchangeRates) == 0 {
+		billingConfig.ExchangeRates = map[string]float64{"CNY": 1, "USD": 7.2}
+	}
+	// 已完成迁移的环境优先使用页面保存的汇率。 // Logan.Li
+	if db != nil && db.Migrator().HasTable(&model.BillingSettings{}) {
+		var settings model.BillingSettings
+		if db.Take(&settings).Error == nil && settings.USDCNYRate > 0 {
+			billingConfig.ExchangeRates["USD"] = settings.USDCNYRate
+		}
+	}
+	return &BillingHandler{db: db, billing: billingConfig}
+}
+
+// GetBillingSettings 获取云账单换算设置。 // Logan.Li
+func (h *BillingHandler) GetBillingSettings(c *gin.Context) {
+	h.rateMu.RLock()
+	rate := h.billing.ExchangeRates["USD"]
+	h.rateMu.RUnlock()
+	var settings model.BillingSettings
+	if h.db.Migrator().HasTable(&model.BillingSettings{}) && h.db.Take(&settings).Error == nil && settings.USDCNYRate > 0 {
+		rate = settings.USDCNYRate
+	}
+	c.JSON(http.StatusOK, model.Response{Code: 200, Message: "success", Data: gin.H{
+		"base_currency": "CNY", "usd_cny_rate": rate, "updated_at": settings.UpdatedAt, "updated_by": settings.UpdatedBy,
+	}})
+}
+
+// SaveBillingSettings 保存 USD/CNY 汇率并立即应用。 // Logan.Li
+func (h *BillingHandler) SaveBillingSettings(c *gin.Context) {
+	var req struct {
+		USDCNYRate float64 `json:"usd_cny_rate" binding:"required"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil || req.USDCNYRate < 0.1 || req.USDCNYRate > 100 {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "USD/CNY 汇率必须在 0.1 到 100 之间"})
+		return
+	}
+	if !h.db.Migrator().HasTable(&model.BillingSettings{}) {
+		c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "云账单设置表尚未迁移"})
+		return
+	}
+	var settings model.BillingSettings
+	err := h.db.Take(&settings).Error
+	settings.USDCNYRate = mathRound(req.USDCNYRate, 6)
+	settings.UpdatedBy = middleware.GetUsername(c)
+	if err == gorm.ErrRecordNotFound {
+		err = h.db.Create(&settings).Error
+	} else if err == nil {
+		err = h.db.Save(&settings).Error
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "保存汇率失败"})
+		return
+	}
+	h.rateMu.Lock()
+	h.billing.ExchangeRates["CNY"] = 1
+	h.billing.ExchangeRates["USD"] = settings.USDCNYRate
+	h.rateMu.Unlock()
+	c.JSON(http.StatusOK, model.Response{Code: 200, Message: "汇率已保存", Data: gin.H{
+		"base_currency": "CNY", "usd_cny_rate": settings.USDCNYRate, "updated_at": settings.UpdatedAt, "updated_by": settings.UpdatedBy,
+	}})
+}
+
+// currencyExpression 返回将原始费用折算为目标报告币种的 SQL 表达式及参数。 // Logan.Li
+func (h *BillingHandler) currencyExpression(target string) (string, []interface{}, bool) {
+	h.rateMu.RLock()
+	defer h.rateMu.RUnlock()
+	target = strings.ToUpper(target)
+	targetRate := h.billing.ExchangeRates[target]
+	if targetRate <= 0 {
+		return "", nil, false
+	}
+	parts := make([]string, 0, len(h.billing.ExchangeRates))
+	args := make([]interface{}, 0, len(h.billing.ExchangeRates))
+	for currency, rate := range h.billing.ExchangeRates {
+		if rate <= 0 {
+			continue
+		}
+		parts = append(parts, "WHEN '"+strings.ToUpper(currency)+"' THEN cost * ?")
+		args = append(args, rate/targetRate)
+	}
+	return "CASE UPPER(currency) " + strings.Join(parts, " ") + " ELSE 0 END", args, true
+}
+
+// reportCurrencyMetadata 返回前端展示和审计换算口径所需的元数据。 // Logan.Li
+func (h *BillingHandler) reportCurrencyMetadata(target string) gin.H {
+	h.rateMu.RLock()
+	defer h.rateMu.RUnlock()
+	rates := map[string]float64{}
+	targetRate := h.billing.ExchangeRates[strings.ToUpper(target)]
+	for currency, rate := range h.billing.ExchangeRates {
+		if rate > 0 && targetRate > 0 {
+			rates[strings.ToUpper(currency)] = mathRound(rate/targetRate, 6)
+		}
+	}
+	return gin.H{"currency": strings.ToUpper(target), "exchange_rates": rates, "rate_source": "configured"}
+}
+
+// mathRound 按指定小数位返回稳定的汇率展示值。 // Logan.Li
+func mathRound(value float64, precision int) float64 {
+	factor := 1.0
+	for i := 0; i < precision; i++ {
+		factor *= 10
+	}
+	return float64(int64(value*factor+0.5)) / factor
 }

 // ListBillings 获取账单列表
@@ -37,9 +156,6 @@ func (h *BillingHandler) ListBillings(c *gin.Context) {
 	if accountID := c.Query("cloud_account_id"); accountID != "" {
 		query = query.Where("cloud_account_id = ?", accountID)
 	}
-	if currency := c.Query("currency"); currency != "" {
-		query = query.Where("currency = ?", currency)
-	}
 	if startDate := c.Query("start_date"); startDate != "" {
 		query = query.Where("billing_date >= ?", startDate)
 	}
@@ -102,6 +218,7 @@ func (h *BillingHandler) CreateBilling(c *gin.Context) {
 	if billing.Currency == "" {
 		billing.Currency = "CNY"
 	}
+	billing.Currency = strings.ToUpper(billing.Currency)

 	if err := h.db.Create(&billing).Error; err != nil {
 		c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "创建失败: " + err.Error()})
@@ -141,6 +258,7 @@ func (h *BillingHandler) BatchCreateBillings(c *gin.Context) {
 		if billing.Currency == "" {
 			billing.Currency = "CNY"
 		}
+		billing.Currency = strings.ToUpper(billing.Currency)
 		if err := h.db.Create(&billing).Error; err == nil {
 			created++
 		}
@@ -166,50 +284,62 @@ func (h *BillingHandler) DeleteBilling(c *gin.Context) {
 // GetBillingStats 获取账单统计
 func (h *BillingHandler) GetBillingStats(c *gin.Context) {
 	now := time.Now()
+	reportCurrency := strings.ToUpper(c.DefaultQuery("currency", h.billing.BaseCurrency))
+	costExpression, costArgs, ok := h.currencyExpression(reportCurrency)
+	if !ok {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "不支持的报告币种"})
+		return
+	}
 	today := now.Format("2006-01-02")
 	yesterday := now.AddDate(0, 0, -1).Format("2006-01-02")
 	monthStart := now.Format("2006-01") + "-01"
 	yearStart := fmt.Sprintf("%d-01-01", now.Year())
-	currency := c.DefaultQuery("currency", "CNY")

 	stats := model.BillingStats{
-		Currency:     currency,
-		MonthTrend:   []model.DailyCost{},
-		ProviderDist: []model.ProviderCost{},
-		Alerts:       []model.BillingAlert{},
+		MonthTrend:    []model.DailyCost{},
+		ProviderDist:  []model.ProviderCost{},
+		ProviderTrend: []model.ProviderDailyCost{},
+		TopServices:   []model.ServiceCost{},
+		Alerts:        []model.BillingAlert{},
+		Currency:      reportCurrency,
+		ExchangeRates: h.reportCurrencyMetadata(reportCurrency)["exchange_rates"].(map[string]float64),
+		RateSource:    "configured",
 	}

-	// 今日成本
-	h.db.Model(&model.CloudBilling{}).Where("billing_date = ? AND currency = ?", today, currency).
-		Select("COALESCE(SUM(cost), 0)").Scan(&stats.TodayCost)
+	// 所有统计统一按报告币种折算，避免不同原币种直接相加。 // Logan.Li
+	h.db.Model(&model.CloudBilling{}).Where("billing_date = ?", today).
+		Select("COALESCE(SUM("+costExpression+"), 0)", costArgs...).Scan(&stats.TodayCost)

 	// 昨日成本
-	h.db.Model(&model.CloudBilling{}).Where("billing_date = ? AND currency = ?", yesterday, currency).
-		Select("COALESCE(SUM(cost), 0)").Scan(&stats.YesterdayCost)
+	h.db.Model(&model.CloudBilling{}).Where("billing_date = ?", yesterday).
+		Select("COALESCE(SUM("+costExpression+"), 0)", costArgs...).Scan(&stats.YesterdayCost)

 	// 本月成本
-	h.db.Model(&model.CloudBilling{}).Where("billing_date >= ? AND currency = ?", monthStart, currency).
-		Select("COALESCE(SUM(cost), 0)").Scan(&stats.MonthCost)
+	h.db.Model(&model.CloudBilling{}).Where("billing_date >= ?", monthStart).
+		Select("COALESCE(SUM("+costExpression+"), 0)", costArgs...).Scan(&stats.MonthCost)

 	// 本年成本
-	h.db.Model(&model.CloudBilling{}).Where("billing_date >= ? AND currency = ?", yearStart, currency).
-		Select("COALESCE(SUM(cost), 0)").Scan(&stats.YearCost)
+	h.db.Model(&model.CloudBilling{}).Where("billing_date >= ?", yearStart).
+		Select("COALESCE(SUM("+costExpression+"), 0)", costArgs...).Scan(&stats.YearCost)

-	// 近30天趋势
+	// 本月日趋势与厂商日趋势来自同一聚合口径，供成本预测直接复用。 // Logan.Li
 	type dayCost struct {
 		BillingDate string
 		Total       float64
 	}
 	var trends []dayCost
 	h.db.Model(&model.CloudBilling{}).
-		Select("billing_date, SUM(cost) as total").
-		Where("billing_date >= ? AND currency = ?", now.AddDate(0, 0, -29).Format("2006-01-02"), currency).
+		Select("billing_date, SUM("+costExpression+") as total", costArgs...).
+		Where("billing_date >= ?", monthStart).
 		Group("billing_date").
 		Order("billing_date ASC").
 		Scan(&trends)

 	for _, t := range trends {
 		stats.MonthTrend = append(stats.MonthTrend, model.DailyCost{Date: t.BillingDate, Cost: t.Total})
+		if t.BillingDate > stats.DataThrough {
+			stats.DataThrough = t.BillingDate
+		}
 	}

 	// 本月厂商成本分布
@@ -219,8 +349,8 @@ func (h *BillingHandler) GetBillingStats(c *gin.Context) {
 	}
 	var provCosts []provCost
 	h.db.Model(&model.CloudBilling{}).
-		Select("provider, SUM(cost) as total").
-		Where("billing_date >= ? AND currency = ?", monthStart, currency).
+		Select("provider, SUM("+costExpression+") as total", costArgs...).
+		Where("billing_date >= ?", monthStart).
 		Group("provider").
 		Scan(&provCosts)

@@ -243,8 +373,39 @@ func (h *BillingHandler) GetBillingStats(c *gin.Context) {
 		return stats.ProviderDist[i].Cost > stats.ProviderDist[j].Cost
 	})

+	type providerDayCost struct {
+		Provider    string
+		BillingDate string
+		Total       float64
+	}
+	var providerTrends []providerDayCost
+	h.db.Model(&model.CloudBilling{}).
+		Select("provider, billing_date, SUM("+costExpression+") as total", costArgs...).
+		Where("billing_date >= ?", monthStart).
+		Group("provider, billing_date").Order("billing_date ASC").Scan(&providerTrends)
+	for _, item := range providerTrends {
+		stats.ProviderTrend = append(stats.ProviderTrend, model.ProviderDailyCost{Provider: item.Provider, Date: item.BillingDate, Cost: item.Total})
+	}
+
+	type serviceCost struct {
+		Service string
+		Total   float64
+	}
+	var services []serviceCost
+	h.db.Model(&model.CloudBilling{}).
+		Select("service, SUM("+costExpression+") as total", costArgs...).
+		Where("billing_date >= ?", monthStart).
+		Group("service").Order("total DESC").Limit(5).Scan(&services)
+	for _, item := range services {
+		name := item.Service
+		if name == "" {
+			name = "未分类"
+		}
+		stats.TopServices = append(stats.TopServices, model.ServiceCost{Service: name, Cost: item.Total})
+	}
+
 	// 检查预警规则
-	h.checkBillingAlerts(&stats, now)
+	h.checkBillingAlerts(&stats, now, costExpression, costArgs)

 	c.JSON(http.StatusOK, model.Response{
 		Code:    200,
@@ -254,7 +415,7 @@ func (h *BillingHandler) GetBillingStats(c *gin.Context) {
 }

 // checkBillingAlerts 检查预警规则是否触发
-func (h *BillingHandler) checkBillingAlerts(stats *model.BillingStats, now time.Time) {
+func (h *BillingHandler) checkBillingAlerts(stats *model.BillingStats, now time.Time, costExpression string, costArgs []interface{}) {
 	var rules []model.BillingAlertRule
 	h.db.Where("enabled = ?", true).Find(&rules)

@@ -263,24 +424,24 @@ func (h *BillingHandler) checkBillingAlerts(stats *model.BillingStats, now time.

 		if rule.Metric == "daily" {
 			// 查今日该厂商/账号的成本
-			q := h.db.Model(&model.CloudBilling{}).Where("billing_date = ? AND currency = ?", now.Format("2006-01-02"), stats.Currency)
+			q := h.db.Model(&model.CloudBilling{}).Where("billing_date = ?", now.Format("2006-01-02"))
 			if rule.Provider != "" {
 				q = q.Where("provider = ?", rule.Provider)
 			}
 			if rule.CloudAccountID != nil {
 				q = q.Where("cloud_account_id = ?", *rule.CloudAccountID)
 			}
-			q.Select("COALESCE(SUM(cost), 0)").Scan(&current)
+			q.Select("COALESCE(SUM("+costExpression+"), 0)", costArgs...).Scan(&current)
 		} else {
 			// monthly - 本月累计
-			q := h.db.Model(&model.CloudBilling{}).Where("billing_date >= ? AND currency = ?", now.Format("2006-01")+"-01", stats.Currency)
+			q := h.db.Model(&model.CloudBilling{}).Where("billing_date >= ?", now.Format("2006-01")+"-01")
 			if rule.Provider != "" {
 				q = q.Where("provider = ?", rule.Provider)
 			}
 			if rule.CloudAccountID != nil {
 				q = q.Where("cloud_account_id = ?", *rule.CloudAccountID)
 			}
-			q.Select("COALESCE(SUM(cost), 0)").Scan(&current)
+			q.Select("COALESCE(SUM("+costExpression+"), 0)", costArgs...).Scan(&current)
 		}

 		// 检查阈值
@@ -1,10 +1,10 @@
 package controller

 import (
-	"fmt"
 	"math"
 	"net/http"
 	"sort"
+	"strings"
 	"time"

 	"ezops/model"
@@ -12,133 +12,208 @@ import (
 	"github.com/gin-gonic/gin"
 )

-// billingMonthCost 表示月度费用汇总。 // Logan.Li
-type billingMonthCost struct {
-	Month string  `json:"month"`
-	Cost  float64 `json:"cost"`
+// billingAnalysisItem 表示单月一个费用分类的汇总值。 // Logan.Li
+type billingAnalysisItem struct {
+	Name    string  `json:"name"`
+	Cost    float64 `json:"cost"`
+	Percent float64 `json:"percent"`
 }

-// billingAttribution 表示可复核的费用变化归因。 // Logan.Li
+// billingAnalysisMonth 表示堆叠图和明细矩阵共用的月度数据。 // Logan.Li
+type billingAnalysisMonth struct {
+	Month string                `json:"month"`
+	Total float64               `json:"total"`
+	Items []billingAnalysisItem `json:"items"`
+}
+
+// billingAttribution 表示最近两个月可复核的费用变化归因。 // Logan.Li
 type billingAttribution struct {
-	Dimension    string  `json:"dimension"`
 	Name         string  `json:"name"`
-	BaselineCost float64 `json:"baseline_cost"`
+	PreviousCost float64 `json:"previous_cost"`
 	CurrentCost  float64 `json:"current_cost"`
 	Delta        float64 `json:"delta"`
 	Contribution float64 `json:"contribution"`
 }

-// GetBillingCostAnalysis 返回月度趋势和同期费用归因，AI 只负责解释确定性结果。 // Logan.Li
+// GetBillingCostAnalysis 返回多云费用堆叠趋势及同期归因。 // Logan.Li
 func (h *BillingHandler) GetBillingCostAnalysis(c *gin.Context) {
 	now := time.Now()
-	currentStart := time.Date(now.Year(), now.Month(), 1, 0, 0, 0, 0, now.Location())
-	baselineStart := currentStart.AddDate(0, -1, 0)
-	baselineEndDay := now.Day()
-	baselineLastDay := baselineStart.AddDate(0, 1, -1).Day()
-	if baselineEndDay > baselineLastDay {
-		baselineEndDay = baselineLastDay
+	endMonth := c.DefaultQuery("end_month", now.Format("2006-01"))
+	startMonth := c.DefaultQuery("start_month", now.AddDate(0, -5, 0).Format("2006-01"))
+	currency := strings.ToUpper(c.DefaultQuery("currency", h.billing.BaseCurrency))
+	costExpression, costArgs, currencyOK := h.currencyExpression(currency)
+	if !currencyOK {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "不支持的报告币种"})
+		return
+	}
+	dimension := c.DefaultQuery("dimension", "service")
+	dimensionColumns := map[string]string{
+		"service": "service", "provider": "provider", "account": "account_name", "region": "region",
+	}
+	column, ok := dimensionColumns[dimension]
+	if !ok {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "不支持的分析维度"})
+		return
+	}
+	start, startErr := time.ParseInLocation("2006-01", startMonth, now.Location())
+	end, endErr := time.ParseInLocation("2006-01", endMonth, now.Location())
+	if startErr != nil || endErr != nil || start.After(end) || end.After(start.AddDate(0, 23, 0)) {
+		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "月份范围无效，最多查询 24 个月"})
+		return
 	}
-	baselineEnd := time.Date(baselineStart.Year(), baselineStart.Month(), baselineEndDay, 23, 59, 59, 0, now.Location())
-	analysisStart := currentStart.AddDate(0, -5, 0)
-	currency := c.DefaultQuery("currency", "CNY")

-	query := h.db.Model(&model.CloudBilling{}).Where("billing_date >= ? AND currency = ?", analysisStart.Format("2006-01-02"), currency)
-	type monthRow struct {
+	type aggregateRow struct {
 		Month string
+		Name  string
 		Cost  float64
 	}
-	var monthRows []monthRow
-	query.Select("SUBSTR(billing_date, 1, 7) AS month, COALESCE(SUM(cost), 0) AS cost").
-		Group("SUBSTR(billing_date, 1, 7)").Order("month ASC").Scan(&monthRows)
-	months := make([]billingMonthCost, 0, len(monthRows))
-	for _, row := range monthRows {
-		months = append(months, billingMonthCost{Month: row.Month, Cost: roundBilling(row.Cost)})
+	var rows []aggregateRow
+	queryEnd := end.AddDate(0, 1, 0)
+	query := h.db.Model(&model.CloudBilling{}).
+		Select("SUBSTR(billing_date, 1, 7) AS month, "+column+" AS name, COALESCE(SUM("+costExpression+"), 0) AS cost", costArgs...).
+		Where("billing_date >= ? AND billing_date < ?", start.Format("2006-01-02"), queryEnd.Format("2006-01-02"))
+	if provider := c.Query("provider"); provider != "" {
+		query = query.Where("provider = ?", provider)
+	}
+	if accountID := c.Query("cloud_account_id"); accountID != "" {
+		query = query.Where("cloud_account_id = ?", accountID)
+	}
+	if err := query.Group("SUBSTR(billing_date, 1, 7), " + column).Scan(&rows).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "费用分析查询失败"})
+		return
 	}

-	baselineStartDate := baselineStart.Format("2006-01-02")
-	baselineEndDate := baselineEnd.Format("2006-01-02")
-	currentStartDate := currentStart.Format("2006-01-02")
-	currentEndDate := now.Format("2006-01-02")
-	baselineCost := h.sumBillingPeriod(baselineStartDate, baselineEndDate, currency)
-	currentCost := h.sumBillingPeriod(currentStartDate, currentEndDate, currency)
-	totalDelta := currentCost - baselineCost
+	monthCosts := map[string]map[string]float64{}
+	categoryTotals := map[string]float64{}
+	for _, row := range rows {
+		name := row.Name
+		if name == "" {
+			name = "未分类"
+		}
+		if monthCosts[row.Month] == nil {
+			monthCosts[row.Month] = map[string]float64{}
+		}
+		monthCosts[row.Month][name] += row.Cost
+		categoryTotals[name] += row.Cost
+	}
+	categories := topBillingCategories(categoryTotals, 8)
+	months := buildBillingAnalysisMonths(start, end, monthCosts, categories)

-	attributions := make([]billingAttribution, 0, 24)
-	for _, dimension := range []string{"provider", "account_name", "service", "region"} {
-		attributions = append(attributions, h.billingDimensionAttribution(
-			dimension, baselineStartDate, baselineEndDate, currentStartDate, currentEndDate, currency, totalDelta,
-		)...)
+	totalCost := 0.0
+	peakCost := 0.0
+	peakMonth := ""
+	for _, month := range months {
+		totalCost += month.Total
+		if month.Total > peakCost {
+			peakCost = month.Total
+			peakMonth = month.Month
+		}
 	}
-	sort.Slice(attributions, func(i, j int) bool {
-		return math.Abs(attributions[i].Delta) > math.Abs(attributions[j].Delta)
-	})
-	if len(attributions) > 20 {
-		attributions = attributions[:20]
+	averageCost := 0.0
+	if len(months) > 0 {
+		averageCost = totalCost / float64(len(months))
 	}
+	previousCost, currentCost := 0.0, 0.0
+	if len(months) >= 2 {
+		previousCost = months[len(months)-2].Total
+		currentCost = months[len(months)-1].Total
+	} else if len(months) == 1 {
+		currentCost = months[0].Total
+	}
+	momPercent := 0.0
+	if previousCost != 0 {
+		momPercent = (currentCost - previousCost) / previousCost * 100
+	}
+	attributions := buildBillingAttributions(monthCosts[end.AddDate(0, -1, 0).Format("2006-01")], monthCosts[endMonth])

 	var dataThrough string
-	h.db.Model(&model.CloudBilling{}).Where("currency = ?", currency).Select("COALESCE(MAX(billing_date), '')").Scan(&dataThrough)
+	dataThroughQuery := h.db.Model(&model.CloudBilling{})
+	if provider := c.Query("provider"); provider != "" {
+		dataThroughQuery = dataThroughQuery.Where("provider = ?", provider)
+	}
+	if accountID := c.Query("cloud_account_id"); accountID != "" {
+		dataThroughQuery = dataThroughQuery.Where("cloud_account_id = ?", accountID)
+	}
+	dataThroughQuery.Select("COALESCE(MAX(billing_date), '')").Scan(&dataThrough)
+	incompletePeriod := endMonth == now.Format("2006-01") && dataThrough < end.AddDate(0, 1, -1).Format("2006-01-02")
+	metadata := h.reportCurrencyMetadata(currency)
 	c.JSON(http.StatusOK, model.Response{Code: 200, Message: "success", Data: gin.H{
-		"analysis_start":       analysisStart.Format("2006-01-02"),
-		"analysis_end":         currentEndDate,
-		"data_through":         dataThrough,
-		"currency":             currency,
-		"incomplete_period":    true,
-		"months":               months,
-		"baseline_period":      fmt.Sprintf("%s - %s", baselineStartDate, baselineEndDate),
-		"comparison_period":    fmt.Sprintf("%s - %s", currentStartDate, currentEndDate),
-		"baseline_cost":        roundBilling(baselineCost),
-		"comparison_cost":      roundBilling(currentCost),
-		"total_delta":          roundBilling(totalDelta),
-		"attributions":         attributions,
-		"contribution_formula": "(当前期费用 - 基准期费用) / (当前期总费用 - 基准期总费用)",
+		"start_month": startMonth, "end_month": endMonth, "currency": currency, "dimension": dimension,
+		"exchange_rates": metadata["exchange_rates"], "rate_source": metadata["rate_source"],
+		"data_through": dataThrough, "incomplete_period": incompletePeriod, "categories": categories, "months": months,
+		"summary":      gin.H{"total_cost": roundBilling(totalCost), "average_cost": roundBilling(averageCost), "peak_cost": roundBilling(peakCost), "peak_month": peakMonth, "mom_percent": roundBilling(momPercent)},
+		"attributions": attributions,
 	}})
 }

-// sumBillingPeriod 汇总指定币种和日期范围费用。 // Logan.Li
-func (h *BillingHandler) sumBillingPeriod(startDate, endDate, currency string) float64 {
-	var total float64
-	h.db.Model(&model.CloudBilling{}).
-		Where("billing_date BETWEEN ? AND ? AND currency = ?", startDate, endDate, currency).
-		Select("COALESCE(SUM(cost), 0)").Scan(&total)
-	return total
+// topBillingCategories 按总费用选择 Top N 分类，其余合并为“其他”。 // Logan.Li
+func topBillingCategories(totals map[string]float64, limit int) []string {
+	names := make([]string, 0, len(totals))
+	for name := range totals {
+		names = append(names, name)
+	}
+	sort.Slice(names, func(i, j int) bool { return totals[names[i]] > totals[names[j]] })
+	if len(names) > limit {
+		return append(names[:limit], "其他")
+	}
+	return names
 }

-// billingDimensionAttribution 计算单一维度的同期费用变化贡献。 // Logan.Li
-func (h *BillingHandler) billingDimensionAttribution(dimension, baselineStart, baselineEnd, currentStart, currentEnd, currency string, totalDelta float64) []billingAttribution {
-	type dimensionRow struct {
-		Name string
-		Cost float64
-	}
-	load := func(startDate, endDate string) []dimensionRow {
-		var rows []dimensionRow
-		h.db.Model(&model.CloudBilling{}).
-			Select(dimension+" AS name, COALESCE(SUM(cost), 0) AS cost").
-			Where("billing_date BETWEEN ? AND ? AND currency = ?", startDate, endDate, currency).
-			Group(dimension).Scan(&rows)
-		return rows
-	}
-	baseline := map[string]float64{}
-	current := map[string]float64{}
-	for _, row := range load(baselineStart, baselineEnd) {
-		baseline[row.Name] = row.Cost
-	}
-	for _, row := range load(currentStart, currentEnd) {
-		current[row.Name] = row.Cost
-	}
-	for name := range baseline {
-		if _, ok := current[name]; !ok {
-			current[name] = 0
+// buildBillingAnalysisMonths 补齐空月份并将非 Top 分类合并。 // Logan.Li
+func buildBillingAnalysisMonths(start, end time.Time, costs map[string]map[string]float64, categories []string) []billingAnalysisMonth {
+	top := map[string]bool{}
+	for _, name := range categories {
+		if name != "其他" {
+			top[name] = true
 		}
 	}
-	result := make([]billingAttribution, 0, len(current))
-	for rawName, currentCost := range current {
+	months := make([]billingAnalysisMonth, 0)
+	for cursor := start; !cursor.After(end); cursor = cursor.AddDate(0, 1, 0) {
+		month := cursor.Format("2006-01")
+		grouped := map[string]float64{}
+		total := 0.0
+		for name, cost := range costs[month] {
+			key := name
+			if !top[name] {
+				key = "其他"
+			}
+			grouped[key] += cost
+			total += cost
+		}
+		items := make([]billingAnalysisItem, 0, len(categories))
+		for _, name := range categories {
+			cost := grouped[name]
+			percent := 0.0
+			if total != 0 {
+				percent = cost / total * 100
+			}
+			items = append(items, billingAnalysisItem{Name: name, Cost: roundBilling(cost), Percent: roundBilling(percent)})
+		}
+		months = append(months, billingAnalysisMonth{Month: month, Total: roundBilling(total), Items: items})
+	}
+	return months
+}
+
+// buildBillingAttributions 计算最近两个月各分类对总变化的贡献度。 // Logan.Li
+func buildBillingAttributions(previous, current map[string]float64) []billingAttribution {
+	names := map[string]bool{}
+	previousTotal, currentTotal := 0.0, 0.0
+	for name, cost := range previous {
+		names[name] = true
+		previousTotal += cost
+	}
+	for name, cost := range current {
+		names[name] = true
+		currentTotal += cost
+	}
+	totalDelta := currentTotal - previousTotal
+	items := make([]billingAttribution, 0, len(names))
+	for rawName := range names {
 		name := rawName
-		if rawName == "" {
+		if name == "" {
 			name = "未分类"
 		}
-		baselineCost := baseline[rawName]
-		delta := currentCost - baselineCost
+		delta := current[rawName] - previous[rawName]
 		if math.Abs(delta) < 0.01 {
 			continue
 		}
@@ -146,12 +221,13 @@ func (h *BillingHandler) billingDimensionAttribution(dimension, baselineStart, b
 		if math.Abs(totalDelta) >= 0.01 {
 			contribution = delta / totalDelta * 100
 		}
-		result = append(result, billingAttribution{
-			Dimension: dimension, Name: name, BaselineCost: roundBilling(baselineCost),
-			CurrentCost: roundBilling(currentCost), Delta: roundBilling(delta), Contribution: roundBilling(contribution),
-		})
+		items = append(items, billingAttribution{Name: name, PreviousCost: roundBilling(previous[rawName]), CurrentCost: roundBilling(current[rawName]), Delta: roundBilling(delta), Contribution: roundBilling(contribution)})
 	}
-	return result
+	sort.Slice(items, func(i, j int) bool { return math.Abs(items[i].Delta) > math.Abs(items[j].Delta) })
+	if len(items) > 10 {
+		items = items[:10]
+	}
+	return items
 }

 // roundBilling 统一费用和百分比精度。 // Logan.Li
@@ -1,45 +1,102 @@
 package controller

 import (
+	"encoding/json"
+	"net/http/httptest"
 	"testing"
+	"time"

+	"ezops/config"
 	"ezops/model"

+	"github.com/gin-gonic/gin"
 	"github.com/glebarez/sqlite"
 	"gorm.io/gorm"
 )

-// TestBillingDimensionAttribution 验证费用变化额和贡献度使用数据库完整数据计算。 // Logan.Li
-func TestBillingDimensionAttribution(t *testing.T) {
-	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
-	if err != nil {
-		t.Fatalf("打开测试数据库失败: %v", err)
+// TestCurrencyExpression 验证 CNY 与 USD 报告币种使用同一组可逆汇率。 // Logan.Li
+func TestCurrencyExpression(t *testing.T) {
+	handler := NewBillingHandler(nil, &config.BillingConfig{
+		BaseCurrency:  "CNY",
+		ExchangeRates: map[string]float64{"cny": 1, "usd": 7.2},
+	})
+	_, cnyArgs, ok := handler.currencyExpression("CNY")
+	if !ok || len(cnyArgs) != 2 {
+		t.Fatalf("CNY 汇率表达式无效: ok=%v args=%v", ok, cnyArgs)
 	}
-	if err = db.AutoMigrate(&model.CloudBilling{}); err != nil {
-		t.Fatalf("迁移账单表失败: %v", err)
+	metadata := handler.reportCurrencyMetadata("USD")
+	rates := metadata["exchange_rates"].(map[string]float64)
+	if rates["USD"] != 1 || rates["CNY"] != 0.138889 {
+		t.Fatalf("USD 折算汇率错误: %+v", rates)
 	}
+	if _, _, supported := handler.currencyExpression("EUR"); supported {
+		t.Fatal("未配置币种不应被接受")
+	}
+}
+
+// TestBillingCurrencyConversionAPI 验证统计接口不会直接混加不同原币金额。 // Logan.Li
+func TestBillingCurrencyConversionAPI(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := db.AutoMigrate(&model.CloudBilling{}, &model.BillingAlertRule{}); err != nil {
+		t.Fatal(err)
+	}
+	today := time.Now().Format("2006-01-02")
 	records := []model.CloudBilling{
-		{BillingDate: "2026-06-01", Provider: "tencent", Service: "CVM", Region: "广州", AccountName: "预发", Currency: "CNY", Cost: 100},
-		{BillingDate: "2026-07-01", Provider: "tencent", Service: "CVM", Region: "广州", AccountName: "预发", Currency: "CNY", Cost: 180},
-		{BillingDate: "2026-07-01", Provider: "tencent", Service: "COS", Region: "广州", AccountName: "预发", Currency: "CNY", Cost: 20},
+		{Provider: "tencent", BillingDate: today, Cost: 100, Currency: "CNY", Service: "CVM"},
+		{Provider: "aws", BillingDate: today, Cost: 10, Currency: "USD", Service: "EC2"},
 	}
-	if err = db.Create(&records).Error; err != nil {
-		t.Fatalf("写入测试账单失败: %v", err)
+	if err := db.Create(&records).Error; err != nil {
+		t.Fatal(err)
 	}
+	handler := NewBillingHandler(db, &config.BillingConfig{BaseCurrency: "CNY", ExchangeRates: map[string]float64{"CNY": 1, "USD": 7.2}})

-	handler := NewBillingHandler(db)
-	items := handler.billingDimensionAttribution("service", "2026-06-01", "2026-06-30", "2026-07-01", "2026-07-31", "CNY", 100)
-	if len(items) != 2 {
-		t.Fatalf("归因项数量错误: got=%d want=2", len(items))
+	assertMonthCost := func(currency string, expected float64) {
+		t.Helper()
+		recorder := httptest.NewRecorder()
+		context, _ := gin.CreateTestContext(recorder)
+		context.Request = httptest.NewRequest("GET", "/?currency="+currency, nil)
+		handler.GetBillingStats(context)
+		var response struct {
+			Code int `json:"code"`
+			Data struct {
+				MonthCost float64 `json:"month_cost"`
+			} `json:"data"`
+		}
+		if err := json.Unmarshal(recorder.Body.Bytes(), &response); err != nil {
+			t.Fatal(err)
+		}
+		if response.Code != 200 || mathRound(response.Data.MonthCost, 2) != expected {
+			t.Fatalf("%s 月费用错误: code=%d cost=%f", currency, response.Code, response.Data.MonthCost)
+		}
 	}
-	result := map[string]billingAttribution{}
-	for _, item := range items {
-		result[item.Name] = item
+	assertMonthCost("CNY", 172)
+	assertMonthCost("USD", 23.89)
+}
+
+// TestBuildBillingAnalysisMonths 验证空月份补齐和非 Top 分类合并。 // Logan.Li
+func TestBuildBillingAnalysisMonths(t *testing.T) {
+	start, _ := time.Parse("2006-01", "2026-03")
+	end, _ := time.Parse("2006-01", "2026-04")
+	costs := map[string]map[string]float64{
+		"2026-03": {"CVM": 100, "TCR": 20},
+	}
+	months := buildBillingAnalysisMonths(start, end, costs, []string{"CVM", "其他"})
+	if len(months) != 2 || months[0].Total != 120 || months[0].Items[1].Cost != 20 {
+		t.Fatalf("月度聚合错误: %+v", months)
 	}
-	if result["CVM"].Delta != 80 || result["CVM"].Contribution != 80 {
-		t.Fatalf("CVM 归因错误: %+v", result["CVM"])
+	if months[1].Month != "2026-04" || months[1].Total != 0 {
+		t.Fatalf("空月份未正确补齐: %+v", months[1])
 	}
-	if result["COS"].Delta != 20 || result["COS"].Contribution != 20 {
-		t.Fatalf("COS 归因错误: %+v", result["COS"])
+}
+
+// TestBuildBillingAttributions 验证归因变化额与贡献度。 // Logan.Li
+func TestBuildBillingAttributions(t *testing.T) {
+	items := buildBillingAttributions(map[string]float64{"CVM": 100}, map[string]float64{"CVM": 180, "TCR": 20})
+	if len(items) != 2 || items[0].Name != "CVM" || items[0].Delta != 80 || items[0].Contribution != 80 {
+		t.Fatalf("费用归因错误: %+v", items)
 	}
 }
@@ -82,4 +82,4 @@ func (h *BillingHandler) SyncAccountBilling(c *gin.Context) {
 	}

 	c.JSON(http.StatusOK, model.Response{Code: 200, Message: msg, Data: result})
-}
+}
@@ -34,7 +34,7 @@ func (h *PipelineHandler) ListBuildNodes(c *gin.Context) {
 	c.JSON(http.StatusOK, model.Response{
 		Code: 200,
 		Data: map[string]interface{}{
-			"list": nodes,
+			"list":  nodes,
 			"total": len(nodes),
 			"master": map[string]interface{}{
 				"name":          "Master",
@@ -221,4 +221,4 @@ func (h *PipelineHandler) UpdateBuildMaster(c *gin.Context) {
 			"name": "Master", "max_executors": cfg.MaxExecutors, "running_count": running,
 		},
 	})
-}
+}
@@ -1,7 +1,6 @@
 package controller

 import (
-	"fmt"
 	"net/http"
 	"strconv"
 	"strings"
@@ -81,10 +80,6 @@ func (h *CloudAccountHandler) CreateCloudAccount(c *gin.Context) {
 		})
 		return
 	}
-	if err := validateCloudAccountCredentials(req.Provider, req.AccessKey, req.SecretKey); err != nil {
-		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: err.Error()})
-		return
-	}

 	status := strings.TrimSpace(req.Status)
 	if status == "" {
@@ -163,10 +158,6 @@ func (h *CloudAccountHandler) UpdateCloudAccount(c *gin.Context) {
 		account.Status = strings.TrimSpace(req.Status)
 	}
 	account.MonthlyCost = req.MonthlyCost
-	if err := validateCloudAccountCredentials(account.Provider, account.AccessKey, account.SecretKey); err != nil {
-		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: err.Error()})
-		return
-	}

 	if err := h.db.Save(&account).Error; err != nil {
 		c.JSON(http.StatusInternalServerError, model.Response{
@@ -183,20 +174,6 @@ func (h *CloudAccountHandler) UpdateCloudAccount(c *gin.Context) {
 	})
 }

-// validateCloudAccountCredentials 校验各云厂商调用 API 所需的凭据格式。 // Logan.Li
-func validateCloudAccountCredentials(provider, accessKey, secretKey string) error {
-	if strings.TrimSpace(accessKey) == "" || strings.TrimSpace(secretKey) == "" {
-		return fmt.Errorf("AccessKey 和 SecretKey 不能为空")
-	}
-	if provider == "azure" {
-		parts := strings.Split(accessKey, ":")
-		if len(parts) != 3 || strings.TrimSpace(parts[0]) == "" || strings.TrimSpace(parts[1]) == "" || strings.TrimSpace(parts[2]) == "" {
-			return fmt.Errorf("Azure AccessKey 格式应为 租户ID:订阅ID:客户端ID")
-		}
-	}
-	return nil
-}
-
 // DeleteCloudAccount 删除云账号
 // @Summary 删除云账号
 // @Description 删除指定云账号
@@ -7,6 +7,7 @@ import (
 	"time"

 	"ezops/model"
+	"ezops/pkg/siteprobe"

 	"github.com/gin-gonic/gin"
 	"gorm.io/gorm"
@@ -228,3 +229,39 @@ func (h *DomainHandler) UpdateDomain(c *gin.Context) {
 	})
 }

+// CheckDomainSSL 复用站点拨测 TLS 能力检测并回写域名证书到期日。 // Logan.Li
+func (h *DomainHandler) CheckDomainSSL(c *gin.Context) {
+	var domain model.Domain
+	if err := h.db.Take(&domain, c.Param("id")).Error; err != nil {
+		c.JSON(http.StatusNotFound, model.Response{Code: 404, Message: "域名不存在"})
+		return
+	}
+	outcome := siteprobe.Execute(c.Request.Context(), model.SiteTask{
+		Name:      "域名证书检测",
+		URL:       domain.Name,
+		TaskType:  model.SiteTaskTypeSSL,
+		Timeout:   10,
+		VerifySSL: false,
+	})
+	if outcome.Status != model.SiteResultSuccess || outcome.SSLCertExpiry == nil {
+		message := outcome.ErrorMessage
+		if message == "" {
+			message = "未获取到证书"
+		}
+		c.JSON(http.StatusBadGateway, model.Response{Code: 502, Message: message})
+		return
+	}
+	if err := h.db.Model(&domain).Updates(map[string]interface{}{
+		"ssl_enabled":     true,
+		"ssl_expire_date": outcome.SSLCertExpiry,
+	}).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "保存证书信息失败"})
+		return
+	}
+	domain.SSLEnabled = true
+	domain.SSLExpireDate = outcome.SSLCertExpiry
+	c.JSON(http.StatusOK, model.Response{Code: 200, Message: "证书检测完成", Data: gin.H{
+		"domain": domain, "ssl_expire_date": outcome.SSLCertExpiry, "ssl_days_remaining": outcome.SSLDaysRemaining,
+		"ssl_issuer": outcome.SSLCertIssuer, "ssl_subject": outcome.SSLCertSubject,
+	}})
+}
@@ -129,4 +129,3 @@ func (h *PlatformHandler) DeletePlatform(c *gin.Context) {
 	}
 	c.JSON(http.StatusOK, model.Response{Code: 200, Message: "删除成功"})
 }
-
@@ -3,7 +3,6 @@ package controller
 import (
 	"net/http"
 	"strconv"
-	"sync"
 	"time"

 	"ezops/cloud"
@@ -74,60 +73,22 @@ func (h *CloudSyncHandler) SyncRegions(c *gin.Context) {
 		}
 	}

-	// 并发统计所有可用区域实例数，卡片展示云账号真实资源量。 // Logan.Li
-	serverCount, countedRegions := countCloudInstances(provider, cloudRegions)
-	updates := map[string]interface{}{
+	// 更新账号的 region_count 和 last_sync_at
+	h.db.Model(&account).Updates(map[string]interface{}{
 		"region_count": len(cloudRegions),
 		"last_sync_at": time.Now(),
-	}
-	if countedRegions > 0 {
-		updates["server_count"] = serverCount
-	}
-	// 更新账号区域、实例数量和同步时间。 // Logan.Li
-	h.db.Model(&account).Updates(updates)
+	})

 	c.JSON(http.StatusOK, model.Response{
 		Code:    200,
 		Message: "同步成功",
 		Data: gin.H{
-			"synced":       synced,
-			"total":        len(cloudRegions),
-			"server_count": serverCount,
+			"synced": synced,
+			"total":  len(cloudRegions),
 		},
 	})
 }

-// countCloudInstances 以固定并发统计各区域实例数量，避免串行请求过慢。 // Logan.Li
-func countCloudInstances(provider cloud.Provider, regions []cloud.CloudRegion) (total int, succeeded int) {
-	type countResult struct {
-		count int
-		ok    bool
-	}
-	results := make(chan countResult, len(regions))
-	semaphore := make(chan struct{}, 4)
-	var waitGroup sync.WaitGroup
-	for _, region := range regions {
-		regionID := region.RegionID
-		waitGroup.Add(1)
-		go func() {
-			defer waitGroup.Done()
-			semaphore <- struct{}{}
-			defer func() { <-semaphore }()
-			instances, err := provider.ListInstances(regionID)
-			results <- countResult{count: len(instances), ok: err == nil}
-		}()
-	}
-	waitGroup.Wait()
-	close(results)
-	for result := range results {
-		if result.ok {
-			total += result.count
-			succeeded++
-		}
-	}
-	return total, succeeded
-}
-
 // GetAccountRegions 获取指定云账号的区域列表（按 provider 过滤）
 // GET /cloud-accounts/:id/regions
 func (h *CloudSyncHandler) GetAccountRegions(c *gin.Context) {
@@ -266,12 +227,28 @@ func (h *CloudSyncHandler) ImportInstances(c *gin.Context) {
 			ip = inst.InstanceID
 		}

-		// 重复资产补齐来源账号关联，保证服务器数统计准确。 // Logan.Li
+		hostname := cloudImportHostname(inst)
+		alias := cloudImportAlias(inst)
+
+		// 检查是否已存在（优先实例 ID，其次 IP/hostname），重复导入只补空别名，避免覆盖人工命名。 // Logan.Li
 		var existing model.Server
-		if err := h.db.Where("ip = ? OR hostname = ?", ip, inst.Hostname).Take(&existing).Error; err == nil {
-			if existing.CloudAccountID == nil {
-				h.db.Model(&existing).Update("cloud_account_id", account.ID)
+		existingQuery := h.db.Where("ip = ? OR hostname = ?", ip, hostname)
+		if inst.InstanceID != "" {
+			existingQuery = h.db.Where("cloud_instance_id = ? OR ip = ? OR hostname = ?", inst.InstanceID, ip, hostname)
+		}
+		if err := existingQuery.Take(&existing).Error; err == nil {
+			updates := map[string]interface{}{
+				"cloud_instance_name": inst.InstanceName,
+				"cloud_instance_id":   inst.InstanceID,
+				"description":         "从 " + account.Provider + " 导入 (" + inst.InstanceID + ")",
 			}
+			if existing.Alias == "" && alias != "" {
+				updates["alias"] = alias
+			}
+			h.db.Model(&existing).Updates(updates)
+			skipped++
+			continue
+		} else if err != gorm.ErrRecordNotFound {
 			skipped++
 			continue
 		}
@@ -305,34 +282,28 @@ func (h *CloudSyncHandler) ImportInstances(c *gin.Context) {
 		if ipAddr == "" {
 			ipAddr = inst.InstanceID
 		}
-		hostname := inst.Hostname
-		if hostname == "" {
-			hostname = inst.InstanceName
-		}
-		if hostname == "" {
-			hostname = inst.InstanceID
-		}
-
 		// 注意：servers 表的 cloud_id 外键引用的是 clouds 表(非 cloud_accounts)，
 		// region_id 外键引用 regions 表。未找到关联时设为 NULL 避免外键约束失败。
 		server := model.Server{
-			Hostname:       hostname,
-			IP:             ipAddr,
-			PublicIP:       inst.PublicIP,
-			Port:           defaultPort,
-			Username:       username,
-			AuthType:       "password",
-			OSType:         osType,
-			Protocol:       protocol,
-			RDPPort:        3389,
-			OS:             osName,
-			CPU:            inst.CPU,
-			Memory:         int64(inst.Memory),
-			Status:         status,
-			RegionID:       regionID, // nil = NULL
-			CloudAccountID: &account.ID,
-			Description:    "从 " + account.Provider + " 导入 (" + inst.InstanceID + ")",
-			AgentStatus:    "offline",
+			Hostname:          hostname,
+			Alias:             alias,
+			CloudInstanceName: inst.InstanceName,
+			CloudInstanceID:   inst.InstanceID,
+			IP:                ipAddr,
+			PublicIP:          inst.PublicIP,
+			Port:              defaultPort,
+			Username:          username,
+			AuthType:          "password",
+			OSType:            osType,
+			Protocol:          protocol,
+			RDPPort:           3389,
+			OS:                osName,
+			CPU:               inst.CPU,
+			Memory:            int64(inst.Memory),
+			Status:            status,
+			RegionID:          regionID, // nil = NULL
+			Description:       "从 " + account.Provider + " 导入 (" + inst.InstanceID + ")",
+			AgentStatus:       "offline",
 		}
 		if protocol == "rdp" && hasRDPCred {
 			applyCredential(rdpCred, rdpPlain, &server)
@@ -347,6 +318,9 @@ func (h *CloudSyncHandler) ImportInstances(c *gin.Context) {
 		}
 	}

+	// 更新账号的 server_count
+	h.db.Model(&account).UpdateColumn("server_count", imported)
+
 	c.JSON(http.StatusOK, model.Response{
 		Code:    200,
 		Message: "导入完成",
@@ -356,3 +330,31 @@ func (h *CloudSyncHandler) ImportInstances(c *gin.Context) {
 		},
 	})
 }
+
+func cloudImportHostname(inst cloud.CloudInstance) string {
+	// hostname 保留技术主机名；展示友好名称写入 alias/cloud_instance_name。 // Logan.Li
+	if inst.Hostname != "" && inst.Hostname != inst.InstanceID {
+		return inst.Hostname
+	}
+	if inst.InstanceName != "" && inst.InstanceName != inst.InstanceID {
+		return inst.InstanceName
+	}
+	if inst.PrivateIP != "" {
+		return inst.PrivateIP
+	}
+	if inst.PublicIP != "" {
+		return inst.PublicIP
+	}
+	if inst.InstanceName != "" {
+		return inst.InstanceName
+	}
+	return inst.InstanceID
+}
+
+func cloudImportAlias(inst cloud.CloudInstance) string {
+	// 云导入初始别名优先使用控制台实例名称，后续人工别名不被同步覆盖。 // Logan.Li
+	if inst.InstanceName != "" && inst.InstanceName != inst.InstanceID {
+		return inst.InstanceName
+	}
+	return ""
+}
@@ -1,52 +0,0 @@
-package controller
-
-import (
-	"errors"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"ezops/cloud"
-)
-
-type countInstancesProvider struct {
-	counts      map[string]int
-	failures    map[string]bool
-	activeCalls atomic.Int32
-	maxCalls    atomic.Int32
-}
-
-func (p *countInstancesProvider) Name() string { return "fake" }
-
-func (p *countInstancesProvider) ListRegions() ([]cloud.CloudRegion, error) { return nil, nil }
-
-func (p *countInstancesProvider) ListInstances(regionID string) ([]cloud.CloudInstance, error) {
-	active := p.activeCalls.Add(1)
-	defer p.activeCalls.Add(-1)
-	for {
-		maximum := p.maxCalls.Load()
-		if active <= maximum || p.maxCalls.CompareAndSwap(maximum, active) {
-			break
-		}
-	}
-	time.Sleep(5 * time.Millisecond)
-	if p.failures[regionID] {
-		return nil, errors.New("区域请求失败")
-	}
-	return make([]cloud.CloudInstance, p.counts[regionID]), nil
-}
-
-func TestCountCloudInstances(t *testing.T) {
-	provider := &countInstancesProvider{
-		counts:   map[string]int{"a": 2, "b": 3, "c": 4, "d": 5, "e": 6},
-		failures: map[string]bool{"c": true},
-	}
-	regions := []cloud.CloudRegion{{RegionID: "a"}, {RegionID: "b"}, {RegionID: "c"}, {RegionID: "d"}, {RegionID: "e"}}
-	total, succeeded := countCloudInstances(provider, regions)
-	if total != 16 || succeeded != 4 {
-		t.Fatalf("实例统计错误: total=%d succeeded=%d", total, succeeded)
-	}
-	if maximum := provider.maxCalls.Load(); maximum > 4 {
-		t.Fatalf("并发数超过限制: %d", maximum)
-	}
-}
@@ -1,258 +0,0 @@
-package controller
-
-import (
-	"encoding/json"
-	"net/http"
-	"strconv"
-
-	ezops "ezops/model"
-
-	"github.com/gin-gonic/gin"
-	"gorm.io/gorm"
-)
-
-// CustomDashboardHandler 自定义监控仪表盘 handler // Logan.Li
-type CustomDashboardHandler struct {
-	db *gorm.DB
-}
-
-// NewCustomDashboardHandler 创建 handler
-func NewCustomDashboardHandler(db *gorm.DB) *CustomDashboardHandler {
-	return &CustomDashboardHandler{db: db}
-}
-
-// ============================================
-// DTO
-// ============================================
-
-type CreateDashboardReq struct {
-	Name          string `json:"name" binding:"required"`
-	Description   string `json:"description"`
-	Datasource    string `json:"datasource"`
-	DatasourceURL string `json:"datasource_url"`
-	Panels        string `json:"panels"` // JSON string
-	IsDefault     bool   `json:"is_default"`
-}
-
-type UpdateDashboardReq struct {
-	Name          *string `json:"name"`
-	Description   *string `json:"description"`
-	Datasource    *string `json:"datasource"`
-	DatasourceURL *string `json:"datasource_url"`
-	Panels        *string `json:"panels"`
-	IsDefault     *bool   `json:"is_default"`
-	IsFavorite    *bool   `json:"is_favorite"`
-}
-
-// ============================================
-// CRUD
-// ============================================
-
-// List 仪表盘列表
-// GET /api/v1/custom-dashboards
-func (h *CustomDashboardHandler) List(c *gin.Context) {
-	var dashboards []ezops.CustomDashboard
-	if err := h.db.Order("is_default DESC, updated_at DESC").Find(&dashboards).Error; err != nil {
-		c.JSON(http.StatusInternalServerError, ezops.Response{Code: 500, Message: "查询失败: " + err.Error()})
-		return
-	}
-
-	// 转换为前端期望的格式（id 转为 string，panels JSON 解析为数组）
-	result := make([]gin.H, 0, len(dashboards))
-	for _, d := range dashboards {
-		item := gin.H{
-			"id":             strconv.Itoa(int(d.ID)),
-			"name":           d.Name,
-			"description":    d.Description,
-			"datasource":     d.Datasource,
-			"datasourceUrl":  d.DatasourceURL,
-			"datasource_url": d.DatasourceURL,
-			"createdAt":      d.CreatedAt,
-			"updatedAt":      d.UpdatedAt,
-			"createdBy":      d.CreatedBy,
-			"isDefault":      d.IsDefault,
-			"is_default":     d.IsDefault,
-		}
-		// 解析 panels JSON
-		var panels []interface{}
-		if d.Panels != "" {
-			if err := json.Unmarshal([]byte(d.Panels), &panels); err == nil {
-				item["panels"] = panels
-			} else {
-				item["panels"] = []interface{}{}
-			}
-		} else {
-			item["panels"] = []interface{}{}
-		}
-		result = append(result, item)
-	}
-
-	c.JSON(http.StatusOK, ezops.Response{Code: 200, Data: gin.H{
-		"list":  result,
-		"total": len(result),
-	}})
-}
-
-// Get 获取单个仪表盘
-// GET /api/v1/custom-dashboards/:id
-func (h *CustomDashboardHandler) Get(c *gin.Context) {
-	id := c.Param("id")
-	var d ezops.CustomDashboard
-	if err := h.db.First(&d, id).Error; err != nil {
-		c.JSON(http.StatusNotFound, ezops.Response{Code: 404, Message: "仪表盘不存在"})
-		return
-	}
-
-	var panels []interface{}
-	if d.Panels != "" {
-		json.Unmarshal([]byte(d.Panels), &panels)
-	}
-	if panels == nil {
-		panels = []interface{}{}
-	}
-
-	c.JSON(http.StatusOK, ezops.Response{Code: 200, Data: gin.H{
-		"id":             strconv.Itoa(int(d.ID)),
-		"name":           d.Name,
-		"description":    d.Description,
-		"datasource":     d.Datasource,
-		"datasourceUrl":  d.DatasourceURL,
-		"datasource_url": d.DatasourceURL,
-		"panels":         panels,
-		"createdAt":      d.CreatedAt,
-		"updatedAt":      d.UpdatedAt,
-		"createdBy":      d.CreatedBy,
-		"isDefault":      d.IsDefault,
-		"is_default":     d.IsDefault,
-	}})
-}
-
-// Create 创建仪表盘
-// POST /api/v1/custom-dashboards
-func (h *CustomDashboardHandler) Create(c *gin.Context) {
-	var req CreateDashboardReq
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, ezops.Response{Code: 400, Message: "参数错误: " + err.Error()})
-		return
-	}
-
-	if req.Datasource == "" {
-		req.Datasource = "prometheus"
-	}
-	if req.Panels == "" {
-		req.Panels = "[]"
-	}
-
-	// 如果设为默认，先清除其他默认
-	if req.IsDefault {
-		h.db.Model(&ezops.CustomDashboard{}).Where("is_default = ?", true).Update("is_default", false)
-	}
-
-	// 从 JWT 获取用户名
-	username := "admin"
-	if u, exists := c.Get("username"); exists {
-		if s, ok := u.(string); ok {
-			username = s
-		}
-	}
-
-	d := ezops.CustomDashboard{
-		Name:          req.Name,
-		Description:   req.Description,
-		Datasource:    req.Datasource,
-		DatasourceURL: req.DatasourceURL,
-		Panels:        req.Panels,
-		CreatedBy:     username,
-		IsDefault:     req.IsDefault,
-	}
-
-	if err := h.db.Create(&d).Error; err != nil {
-		c.JSON(http.StatusInternalServerError, ezops.Response{Code: 500, Message: "创建失败: " + err.Error()})
-		return
-	}
-
-	c.JSON(http.StatusOK, ezops.Response{Code: 200, Message: "创建成功", Data: gin.H{
-		"success": true,
-		"id":      strconv.Itoa(int(d.ID)),
-	}})
-}
-
-// Update 更新仪表盘
-// PUT /api/v1/custom-dashboards/:id
-func (h *CustomDashboardHandler) Update(c *gin.Context) {
-	id := c.Param("id")
-	var d ezops.CustomDashboard
-	if err := h.db.First(&d, id).Error; err != nil {
-		c.JSON(http.StatusNotFound, ezops.Response{Code: 404, Message: "仪表盘不存在"})
-		return
-	}
-
-	var req UpdateDashboardReq
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, ezops.Response{Code: 400, Message: "参数错误: " + err.Error()})
-		return
-	}
-
-	updates := map[string]interface{}{}
-	if req.Name != nil {
-		updates["name"] = *req.Name
-	}
-	if req.Description != nil {
-		updates["description"] = *req.Description
-	}
-	if req.Datasource != nil {
-		updates["datasource"] = *req.Datasource
-	}
-	if req.DatasourceURL != nil {
-		updates["datasource_url"] = *req.DatasourceURL
-	}
-	if req.Panels != nil {
-		updates["panels"] = *req.Panels
-	}
-	if req.IsFavorite != nil {
-		updates["is_favorite"] = *req.IsFavorite
-	}
-	if req.IsDefault != nil && *req.IsDefault {
-		// 设为默认前先清除其他默认
-		h.db.Model(&ezops.CustomDashboard{}).Where("is_default = ? AND id != ?", true, d.ID).Update("is_default", false)
-		updates["is_default"] = true
-	}
-
-	if len(updates) > 0 {
-		if err := h.db.Model(&d).Updates(updates).Error; err != nil {
-			c.JSON(http.StatusInternalServerError, ezops.Response{Code: 500, Message: "更新失败: " + err.Error()})
-			return
-		}
-	}
-
-	c.JSON(http.StatusOK, ezops.Response{Code: 200, Message: "更新成功", Data: gin.H{"success": true}})
-}
-
-// Delete 删除仪表盘
-// DELETE /api/v1/custom-dashboards/:id
-func (h *CustomDashboardHandler) Delete(c *gin.Context) {
-	id := c.Param("id")
-	if err := h.db.Delete(&ezops.CustomDashboard{}, id).Error; err != nil {
-		c.JSON(http.StatusInternalServerError, ezops.Response{Code: 500, Message: "删除失败: " + err.Error()})
-		return
-	}
-	c.JSON(http.StatusOK, ezops.Response{Code: 200, Message: "删除成功", Data: gin.H{"success": true}})
-}
-
-// SetDefault 设为默认仪表盘
-// POST /api/v1/custom-dashboards/:id/default
-func (h *CustomDashboardHandler) SetDefault(c *gin.Context) {
-	id := c.Param("id")
-	var d ezops.CustomDashboard
-	if err := h.db.First(&d, id).Error; err != nil {
-		c.JSON(http.StatusNotFound, ezops.Response{Code: 404, Message: "仪表盘不存在"})
-		return
-	}
-
-	// 清除其他默认
-	h.db.Model(&ezops.CustomDashboard{}).Where("is_default = ? AND id != ?", true, d.ID).Update("is_default", false)
-	// 设置当前为默认
-	h.db.Model(&d).Update("is_default", true)
-
-	c.JSON(http.StatusOK, ezops.Response{Code: 200, Message: "设置成功", Data: gin.H{"success": true}})
-}
@@ -359,15 +359,15 @@ func (h *DashboardHandler) GetRecentReleases(c *gin.Context) {
 // @Success 200 {object} model.Response{data=[]model.MetricData}
 // @Router /dashboard/metrics [get]
 func (h *DashboardHandler) GetMetrics(c *gin.Context) {
-	hours := 6  // 默认6小时，减少扫描行数
+	hours := 6 // 默认6小时，减少扫描行数
 	if hv := c.Query("hours"); hv != "" {
 		if parsed, err := strconv.Atoi(hv); err == nil && parsed > 0 && parsed <= 168 {
 			hours = parsed
 		}
 	}

-	// 从 agent_reports 表查最近 N 小时的真实数据（整数分组，可用索引）
-	since := time.Now().Add(-time.Duration(hours) * time.Hour)
+	// 从 agent_reports 表按 UTC 边界查最近 N 小时的真实数据。 // Logan.Li
+	since := time.Now().UTC().Add(-time.Duration(hours) * time.Hour)
 	type avgPoint struct {
 		BucketTS int64
 		AvgCPU   float64
@@ -1,164 +0,0 @@
-package controller
-
-import (
-	"net/http"
-
-	"ezops/model"
-
-	"github.com/gin-gonic/gin"
-	"gorm.io/gorm"
-)
-
-// DeployHandler 发布系统处理器
-type DeployHandler struct {
-	db *gorm.DB
-}
-
-func NewDeployHandler(db *gorm.DB) *DeployHandler {
-	return &DeployHandler{db: db}
-}
-
-// ==================== Git 仓库认证 ====================
-
-func (h *DeployHandler) ListRepos(c *gin.Context) {
-	var items []model.PipelineRepo
-	h.db.Order("updated_at DESC").Find(&items)
-	c.JSON(http.StatusOK, model.Response{Code: 200, Data: model.ListResponse{List: items, Total: int64(len(items))}})
-}
-
-func (h *DeployHandler) GetRepo(c *gin.Context) {
-	var item model.PipelineRepo
-	if err := h.db.First(&item, c.Param("id")); err.Error != nil {
-		c.JSON(http.StatusNotFound, model.Response{Code: 404, Message: "不存在"})
-		return
-	}
-	c.JSON(http.StatusOK, model.Response{Code: 200, Data: item})
-}
-
-func (h *DeployHandler) CreateRepo(c *gin.Context) {
-	var req struct {
-		Name         string             `json:"name" binding:"required"`
-		Description  string             `json:"description"`
-		URL          string             `json:"url" binding:"required"`
-		AuthType     model.RepoAuthType `json:"auth_type"`
-		CredentialID *uint              `json:"credential_id"`
-	}
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: err.Error()})
-		return
-	}
-	if req.AuthType == "" { req.AuthType = model.RepoAuthToken }
-	item := model.PipelineRepo{
-		Name: req.Name, Description: req.Description, URL: req.URL,
-		AuthType: req.AuthType, CredentialID: req.CredentialID,
-		CreatedBy: c.GetString("username"),
-	}
-	h.db.Create(&item)
-	c.JSON(http.StatusOK, model.Response{Code: 200, Data: item})
-}
-
-func (h *DeployHandler) UpdateRepo(c *gin.Context) {
-	var item model.PipelineRepo
-	if err := h.db.First(&item, c.Param("id")); err.Error != nil {
-		c.JSON(http.StatusNotFound, model.Response{Code: 404, Message: "不存在"})
-		return
-	}
-	var req struct {
-		Name         *string             `json:"name"`
-		Description  *string             `json:"description"`
-		URL          *string             `json:"url"`
-		AuthType     *model.RepoAuthType `json:"auth_type"`
-		CredentialID *uint               `json:"credential_id"`
-		Enabled      *bool               `json:"enabled"`
-	}
-	c.ShouldBindJSON(&req)
-	updates := map[string]interface{}{}
-	if req.Name != nil { updates["name"] = *req.Name }
-	if req.Description != nil { updates["description"] = *req.Description }
-	if req.URL != nil { updates["url"] = *req.URL }
-	if req.AuthType != nil { updates["auth_type"] = *req.AuthType }
-	if req.Enabled != nil { updates["enabled"] = *req.Enabled }
-	if req.CredentialID != nil { updates["credential_id"] = req.CredentialID }
-	h.db.Model(&item).Updates(updates)
-	h.db.First(&item, item.ID)
-	c.JSON(http.StatusOK, model.Response{Code: 200, Data: item})
-}
-
-func (h *DeployHandler) DeleteRepo(c *gin.Context) {
-	h.db.Delete(&model.PipelineRepo{}, c.Param("id"))
-	c.JSON(http.StatusOK, model.Response{Code: 200, Message: "已删除"})
-}
-
-// ==================== 镜像仓库认证 ====================
-
-func (h *DeployHandler) ListRegistries(c *gin.Context) {
-	var items []model.PipelineRegistry
-	h.db.Order("updated_at DESC").Find(&items)
-	c.JSON(http.StatusOK, model.Response{Code: 200, Data: model.ListResponse{List: items, Total: int64(len(items))}})
-}
-
-func (h *DeployHandler) GetRegistry(c *gin.Context) {
-	var item model.PipelineRegistry
-	if err := h.db.First(&item, c.Param("id")); err.Error != nil {
-		c.JSON(http.StatusNotFound, model.Response{Code: 404, Message: "不存在"})
-		return
-	}
-	c.JSON(http.StatusOK, model.Response{Code: 200, Data: item})
-}
-
-func (h *DeployHandler) CreateRegistry(c *gin.Context) {
-	var req struct {
-		Name         string                  `json:"name" binding:"required"`
-		Description  string                  `json:"description"`
-		RegistryURL  string                  `json:"registry_url" binding:"required"`
-		Namespace    string                  `json:"namespace"`
-		AuthType     model.RegistryAuthType `json:"auth_type"`
-		CredentialID *uint                   `json:"credential_id"`
-	}
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: err.Error()})
-		return
-	}
-	if req.AuthType == "" { req.AuthType = model.RegistryAuthPassword }
-	item := model.PipelineRegistry{
-		Name: req.Name, Description: req.Description, RegistryURL: req.RegistryURL,
-		Namespace: req.Namespace, AuthType: req.AuthType, CredentialID: req.CredentialID,
-		CreatedBy: c.GetString("username"),
-	}
-	h.db.Create(&item)
-	c.JSON(http.StatusOK, model.Response{Code: 200, Data: item})
-}
-
-func (h *DeployHandler) UpdateRegistry(c *gin.Context) {
-	var item model.PipelineRegistry
-	if err := h.db.First(&item, c.Param("id")); err.Error != nil {
-		c.JSON(http.StatusNotFound, model.Response{Code: 404, Message: "不存在"})
-		return
-	}
-	var req struct {
-		Name         *string                   `json:"name"`
-		Description  *string                   `json:"description"`
-		RegistryURL  *string                   `json:"registry_url"`
-		Namespace    *string                   `json:"namespace"`
-		AuthType     *model.RegistryAuthType  `json:"auth_type"`
-		CredentialID *uint                     `json:"credential_id"`
-		Enabled      *bool                     `json:"enabled"`
-	}
-	c.ShouldBindJSON(&req)
-	updates := map[string]interface{}{}
-	if req.Name != nil { updates["name"] = *req.Name }
-	if req.Description != nil { updates["description"] = *req.Description }
-	if req.RegistryURL != nil { updates["registry_url"] = *req.RegistryURL }
-	if req.Namespace != nil { updates["namespace"] = *req.Namespace }
-	if req.AuthType != nil { updates["auth_type"] = *req.AuthType }
-	if req.Enabled != nil { updates["enabled"] = *req.Enabled }
-	if req.CredentialID != nil { updates["credential_id"] = req.CredentialID }
-	h.db.Model(&item).Updates(updates)
-	h.db.First(&item, item.ID)
-	c.JSON(http.StatusOK, model.Response{Code: 200, Data: item})
-}
-
-func (h *DeployHandler) DeleteRegistry(c *gin.Context) {
-	h.db.Delete(&model.PipelineRegistry{}, c.Param("id"))
-	c.JSON(http.StatusOK, model.Response{Code: 200, Message: "已删除"})
-}
@@ -35,7 +35,9 @@ func (h *PipelineHandler) CreateEnvironment(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: err.Error()})
 		return
 	}
-	if req.Color == "" { req.Color = typeDefaultColor(req.Type) }
+	if req.Color == "" {
+		req.Color = typeDefaultColor(req.Type)
+	}
 	item := model.DeployEnvironment{
 		Name: req.Name, DisplayName: req.DisplayName,
 		Type: model.EnvironmentType(req.Type), Color: req.Color,
@@ -67,13 +69,27 @@ func (h *PipelineHandler) UpdateEnvironment(c *gin.Context) {
 	}
 	c.ShouldBindJSON(&req)
 	updates := map[string]interface{}{}
-	if req.Name != nil { updates["name"] = *req.Name }
-	if req.DisplayName != nil { updates["display_name"] = *req.DisplayName }
-	if req.Type != nil { updates["type"] = *req.Type }
-	if req.Color != nil { updates["color"] = *req.Color }
-	if req.SortOrder != nil { updates["sort_order"] = *req.SortOrder }
-	if req.Description != nil { updates["description"] = *req.Description }
-	if req.Enabled != nil { updates["enabled"] = *req.Enabled }
+	if req.Name != nil {
+		updates["name"] = *req.Name
+	}
+	if req.DisplayName != nil {
+		updates["display_name"] = *req.DisplayName
+	}
+	if req.Type != nil {
+		updates["type"] = *req.Type
+	}
+	if req.Color != nil {
+		updates["color"] = *req.Color
+	}
+	if req.SortOrder != nil {
+		updates["sort_order"] = *req.SortOrder
+	}
+	if req.Description != nil {
+		updates["description"] = *req.Description
+	}
+	if req.Enabled != nil {
+		updates["enabled"] = *req.Enabled
+	}
 	h.db.Model(&item).Updates(updates)
 	h.db.First(&item, id)
 	c.JSON(http.StatusOK, model.Response{Code: 200, Data: item})
@@ -87,10 +103,14 @@ func (h *PipelineHandler) DeleteEnvironment(c *gin.Context) {

 func typeDefaultColor(t string) string {
 	switch t {
-	case "production": return "#EF4444"
-	case "staging": return "#F59E0B"
-	case "testing": return "#10B981"
-	default: return "#3B82F6" // development
+	case "production":
+		return "#EF4444"
+	case "staging":
+		return "#F59E0B"
+	case "testing":
+		return "#10B981"
+	default:
+		return "#3B82F6" // development
 	}
 }

@@ -212,8 +232,8 @@ func (h *PipelineHandler) GetRunLog(c *gin.Context) {
 	}

 	c.JSON(http.StatusOK, model.Response{Code: 200, Data: gin.H{
-		"run":    run,
-		"logs":   logs,
+		"run":  run,
+		"logs": logs,
 	}})
 }

@@ -53,8 +53,12 @@ func (h *PipelineHandler) UpdateGroup(c *gin.Context) {
 	}
 	c.ShouldBindJSON(&req)
 	updates := map[string]interface{}{}
-	if req.Name != nil { updates["name"] = *req.Name }
-	if req.Description != nil { updates["description"] = *req.Description }
+	if req.Name != nil {
+		updates["name"] = *req.Name
+	}
+	if req.Description != nil {
+		updates["description"] = *req.Description
+	}
 	h.db.Model(&group).Updates(updates)
 	h.db.First(&group, id)
 	c.JSON(http.StatusOK, model.Response{Code: 200, Data: group})
@@ -5,6 +5,7 @@ import (
 	"strconv"
 	"time"

+	"ezops/middleware"
 	"ezops/model"

 	"github.com/gin-gonic/gin"
@@ -190,6 +191,9 @@ func (h *AgentHandler) GetHealthProbesForAgent(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "hostname 不能为空"})
 		return
 	}
+	if !middleware.RequireAgentHostname(c, hostname) {
+		return
+	}

 	var probes []model.HealthProbe
 	h.db.Where("hostname = ? AND enabled = ?", hostname, true).
@@ -216,28 +216,28 @@ func (h *KubernetesHandler) GetClusterDetail(c *gin.Context) {
 		Code:    200,
 		Message: "success",
 		Data: map[string]interface{}{
-			"id":              cluster.ID,
-			"name":            cluster.Name,
-			"code":            cluster.Code,
-			"version":         cluster.Version,
-			"status":          cluster.Status,
-			"config_type":     cluster.ConfigType,
-			"api_server":      cluster.APIServer,
-			"api_endpoint":    cluster.APIEndpoint,
-			"description":     cluster.Description,
-			"has_token":       cluster.Token != "",
-			"has_kube_config": cluster.KubeConfig != "",
+			"id":               cluster.ID,
+			"name":             cluster.Name,
+			"code":             cluster.Code,
+			"version":          cluster.Version,
+			"status":           cluster.Status,
+			"config_type":      cluster.ConfigType,
+			"api_server":       cluster.APIServer,
+			"api_endpoint":     cluster.APIEndpoint,
+			"description":      cluster.Description,
+			"has_token":        cluster.Token != "",
+			"has_kube_config":  cluster.KubeConfig != "",
 			"node_count":       cluster.NodeCount,
 			"pod_count":        cluster.PodCount,
 			"service_count":    cluster.ServiceCount,
 			"deployment_count": cluster.DeploymentCount,
 			"ingress_count":    cluster.IngressCount,
-			"cpu_usage":       cluster.CPUUsage,
-			"memory_usage":    cluster.MemoryUsage,
-			"labels":          cluster.Labels,
-			"last_sync_at":    cluster.LastSyncAt,
-			"created_at":      cluster.CreatedAt,
-			"updated_at":      cluster.UpdatedAt,
+			"cpu_usage":        cluster.CPUUsage,
+			"memory_usage":     cluster.MemoryUsage,
+			"labels":           cluster.Labels,
+			"last_sync_at":     cluster.LastSyncAt,
+			"created_at":       cluster.CreatedAt,
+			"updated_at":       cluster.UpdatedAt,
 		},
 	})
 }
@@ -320,7 +320,7 @@ func (h *KubernetesHandler) SyncCluster(c *gin.Context) {
 	// Sync nodes
 	if nodes, err := client.ListNodes(); err == nil {
 		// Use raw SQL for reliability (avoid GORM soft-delete / auto-timestamp issues)
-		h.db.Exec("DELETE FROM kubernetes_nodes WHERE cluster_id = ?", cluster.ID)
+		h.db.Exec("DELETE FROM k8s_nodes WHERE cluster_id = ?", cluster.ID)
 		for _, n := range nodes.Items {
 			role := "worker"
 			if _, ok := n.Metadata.Labels["node-role.kubernetes.io/master"]; ok {
@@ -358,7 +358,7 @@ func (h *KubernetesHandler) SyncCluster(c *gin.Context) {
 					memUsagePct = float64(memMi) / float64(memMB) * 100
 				}
 			}
-			err2 := h.db.Exec(`INSERT INTO kubernetes_nodes (cluster_id, name, ip, role, status, os, kubelet_version, cpu, memory, max_pods, cpu_usage, memory_usage, labels, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+			err2 := h.db.Exec(`INSERT INTO k8s_nodes (cluster_id, name, ip, role, status, os, kubelet_version, cpu, memory, max_pods, cpu_usage, memory_usage, labels, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
 				cluster.ID, n.Metadata.Name, ip, role, nodeStatus, n.Status.NodeInfo.OSImage, n.Status.NodeInfo.KubeletVersion,
 				parseIntResource(n.Status.Capacity["cpu"]), parseMemResource(n.Status.Capacity["memory"]), parseIntResource(n.Status.Capacity["pods"]),
 				cpuUsagePct, memUsagePct, string(labelsJSON), now, now).Error
@@ -508,7 +508,7 @@ func (h *KubernetesHandler) SyncCluster(c *gin.Context) {
 	c.JSON(http.StatusOK, model.Response{
 		Code:    200,
 		Message: msg,
-		Data: result,
+		Data:    result,
 	})
 }

@@ -14,27 +14,27 @@ func (h *KubernetesHandler) GetMultiClusterComparison(c *gin.Context) {
 	h.db.Find(&clusters)

 	type ClusterComparison struct {
-		ID             uint    `json:"id"`
-		Name           string  `json:"name"`
-		Code           string  `json:"code"`
-		Status         string  `json:"status"`
-		Version        string  `json:"version"`
-		NodeCount      int     `json:"node_count"`
-		PodCount       int     `json:"pod_count"`
-		DeploymentCount int    `json:"deployment_count"`
-		ServiceCount   int     `json:"service_count"`
-		CPUUsage       float64 `json:"cpu_usage"`
-		MemoryUsage    float64 `json:"memory_usage"`
-		APIServer      string  `json:"api_server"`
-		LastSyncAt     *time.Time `json:"last_sync_at"`
+		ID              uint       `json:"id"`
+		Name            string     `json:"name"`
+		Code            string     `json:"code"`
+		Status          string     `json:"status"`
+		Version         string     `json:"version"`
+		NodeCount       int        `json:"node_count"`
+		PodCount        int        `json:"pod_count"`
+		DeploymentCount int        `json:"deployment_count"`
+		ServiceCount    int        `json:"service_count"`
+		CPUUsage        float64    `json:"cpu_usage"`
+		MemoryUsage     float64    `json:"memory_usage"`
+		APIServer       string     `json:"api_server"`
+		LastSyncAt      *time.Time `json:"last_sync_at"`

-		// Node-level aggregated data from kubernetes_nodes table
-		TotalCPUCores  int     `json:"total_cpu_cores"`
-		TotalMemoryMB  int64   `json:"total_memory_mb"`
-		MasterCount    int     `json:"master_count"`
-		WorkerCount    int     `json:"worker_count"`
-		HealthyNodes   int     `json:"healthy_nodes"`
-		UnhealthyNodes int     `json:"unhealthy_nodes"`
+		// Node-level aggregated data from k8s_nodes table
+		TotalCPUCores  int   `json:"total_cpu_cores"`
+		TotalMemoryMB  int64 `json:"total_memory_mb"`
+		MasterCount    int   `json:"master_count"`
+		WorkerCount    int   `json:"worker_count"`
+		HealthyNodes   int   `json:"healthy_nodes"`
+		UnhealthyNodes int   `json:"unhealthy_nodes"`
 	}

 	// 2. 获取所有节点的聚合数据（按 cluster_id 分组）
@@ -64,8 +64,16 @@ func (h *KubernetesHandler) GetMultiClusterComparison(c *gin.Context) {
 			agg.TotalCPU += n.CPU
 			agg.TotalMemory += n.Memory
 			if n.CPUUsage > 0 || n.MemoryUsage > 0 {
-				if agg.AvgCPUUsage == 0 { agg.AvgCPUUsage = n.CPUUsage } else { agg.AvgCPUUsage = (agg.AvgCPUUsage*float64(agg.NodeCount-1) + n.CPUUsage) / float64(agg.NodeCount) }
-				if agg.AvgMemUsage == 0 { agg.AvgMemUsage = n.MemoryUsage } else { agg.AvgMemUsage = (agg.AvgMemUsage*float64(agg.NodeCount-1) + n.MemoryUsage) / float64(agg.NodeCount) }
+				if agg.AvgCPUUsage == 0 {
+					agg.AvgCPUUsage = n.CPUUsage
+				} else {
+					agg.AvgCPUUsage = (agg.AvgCPUUsage*float64(agg.NodeCount-1) + n.CPUUsage) / float64(agg.NodeCount)
+				}
+				if agg.AvgMemUsage == 0 {
+					agg.AvgMemUsage = n.MemoryUsage
+				} else {
+					agg.AvgMemUsage = (agg.AvgMemUsage*float64(agg.NodeCount-1) + n.MemoryUsage) / float64(agg.NodeCount)
+				}
 			}
 			if n.Role == "master" {
 				agg.MasterCount++
@@ -14,14 +14,23 @@ import (

 func (h *KubernetesHandler) ListEvents(c *gin.Context) {
 	clusterID := h.resolveClusterCode(c.Param("clusterCode"))
-	if clusterID == 0 { c.JSON(500, model.Response{Code: 500, Message: "cluster not found"}); return }
+	if clusterID == 0 {
+		c.JSON(500, model.Response{Code: 500, Message: "cluster not found"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}

 	ns := c.Query("namespace")
 	eventType := c.Query("type") // Normal or Warning
 	events, err := client.ListEvents(ns)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()})
+		return
+	}

 	type EventSummary struct {
 		Namespace  string `json:"namespace"`
@@ -40,7 +49,9 @@ func (h *KubernetesHandler) ListEvents(c *gin.Context) {
 	}
 	result := []EventSummary{}
 	for _, e := range events.Items {
-		if eventType != "" && e.Type != eventType { continue }
+		if eventType != "" && e.Type != eventType {
+			continue
+		}
 		objectKind := e.InvolvedObject.Kind
 		objectName := e.InvolvedObject.Name
 		object := fmt.Sprintf("%s/%s", objectKind, objectName)
@@ -246,30 +246,45 @@ func (h *KubernetesHandler) DeleteCronJobNS(c *gin.Context) {
 }
 func (h *KubernetesHandler) listHPAsWithNS(c *gin.Context, ns string) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	hpas, err := client.ListHPAs()
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()})
+		return
+	}
 	type HPASummary struct {
-		Namespace    string `json:"namespace"`
-		Name         string `json:"name"`
-		TargetKind   string `json:"target_kind"`
-		TargetName   string `json:"target_name"`
-		MinReplicas  int    `json:"min_replicas"`
-		MaxReplicas  int    `json:"max_replicas"`
-		CPUPercent   int    `json:"cpu_percent"`
-		MemPercent   int    `json:"mem_percent"`
+		Namespace       string `json:"namespace"`
+		Name            string `json:"name"`
+		TargetKind      string `json:"target_kind"`
+		TargetName      string `json:"target_name"`
+		MinReplicas     int    `json:"min_replicas"`
+		MaxReplicas     int    `json:"max_replicas"`
+		CPUPercent      int    `json:"cpu_percent"`
+		MemPercent      int    `json:"mem_percent"`
 		CurrentReplicas int    `json:"current_replicas"`
 	}
 	result := []HPASummary{}
 	for _, h := range hpas.Items {
-		if h.Metadata.Namespace != ns { continue }
-		cpu := 0; mem := 0
+		if h.Metadata.Namespace != ns {
+			continue
+		}
+		cpu := 0
+		mem := 0
 		for _, m := range h.Spec.Metrics {
 			if m.Resource != nil {
-				if m.Resource.Name == "cpu" { cpu = m.Resource.Target.AverageUtilization }
-				if m.Resource.Name == "memory" { mem = m.Resource.Target.AverageUtilization }
+				if m.Resource.Name == "cpu" {
+					cpu = m.Resource.Target.AverageUtilization
+				}
+				if m.Resource.Name == "memory" {
+					mem = m.Resource.Target.AverageUtilization
+				}
 			}
 		}
 		result = append(result, HPASummary{
@@ -288,80 +303,165 @@ func (h *KubernetesHandler) listHPAsWithNS(c *gin.Context, ns string) {
 }
 func (h *KubernetesHandler) createHPAWithNS(c *gin.Context, ns string) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
 	var req k8sclient.CreateHPARequest
-	if err := c.ShouldBindJSON(&req); err != nil { c.JSON(400, model.Response{Code: 400, Message: "参数错误"}); return }
-	if req.Namespace == "" { req.Namespace = ns }
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(400, model.Response{Code: 400, Message: "参数错误"})
+		return
+	}
+	if req.Namespace == "" {
+		req.Namespace = ns
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	hpa, err := client.CreateHPA(req)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "创建失败: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "创建失败: " + err.Error()})
+		return
+	}
 	c.JSON(200, model.Response{Code: 200, Data: hpa})
 }
 func (h *KubernetesHandler) deleteHPAWithNS(c *gin.Context, ns string) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
-	if err := client.DeleteHPA(ns, c.Param("name")); err != nil { c.JSON(500, model.Response{Code: 500, Message: "删除失败: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
+	if err := client.DeleteHPA(ns, c.Param("name")); err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "删除失败: " + err.Error()})
+		return
+	}
 	c.JSON(200, model.Response{Code: 200, Message: "已删除"})
 }
 func (h *KubernetesHandler) listCronJobsWithNS(c *gin.Context, ns string) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	cjs, err := client.ListCronJobs()
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()})
+		return
+	}
 	filtered := []k8sclient.CronJobItem{}
-	for _, cj := range cjs.Items { if cj.Metadata.Namespace == ns { filtered = append(filtered, cj) } }
+	for _, cj := range cjs.Items {
+		if cj.Metadata.Namespace == ns {
+			filtered = append(filtered, cj)
+		}
+	}
 	c.JSON(200, model.Response{Code: 200, Data: filtered})
 }
 func (h *KubernetesHandler) createCronJobWithNS(c *gin.Context, ns string) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
 	var req k8sclient.CreateCronJobRequest
-	if err := c.ShouldBindJSON(&req); err != nil { c.JSON(400, model.Response{Code: 400, Message: "参数错误"}); return }
-	if req.Namespace == "" { req.Namespace = ns }
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(400, model.Response{Code: 400, Message: "参数错误"})
+		return
+	}
+	if req.Namespace == "" {
+		req.Namespace = ns
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	cj, err := client.CreateCronJob(req)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "创建失败: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "创建失败: " + err.Error()})
+		return
+	}
 	c.JSON(200, model.Response{Code: 200, Data: cj})
 }
 func (h *KubernetesHandler) suspendCronJobWithNS(c *gin.Context, ns string) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
-	var req struct { Suspend bool `json:"suspend"` }; c.ShouldBindJSON(&req)
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
+	var req struct {
+		Suspend bool `json:"suspend"`
+	}
+	c.ShouldBindJSON(&req)
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
-	if err := client.SuspendCronJob(ns, c.Param("name"), req.Suspend); err != nil { c.JSON(500, model.Response{Code: 500, Message: "操作失败: " + err.Error()}); return }
-	action := "恢复"; if req.Suspend { action = "暂停" }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
+	if err := client.SuspendCronJob(ns, c.Param("name"), req.Suspend); err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "操作失败: " + err.Error()})
+		return
+	}
+	action := "恢复"
+	if req.Suspend {
+		action = "暂停"
+	}
 	c.JSON(200, model.Response{Code: 200, Message: "CronJob 已" + action})
 }
 func (h *KubernetesHandler) triggerCronJobWithNS(c *gin.Context, ns string) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
-	if err := client.TriggerCronJob(ns, c.Param("name")); err != nil { c.JSON(500, model.Response{Code: 500, Message: "触发失败: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
+	if err := client.TriggerCronJob(ns, c.Param("name")); err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "触发失败: " + err.Error()})
+		return
+	}
 	c.JSON(200, model.Response{Code: 200, Message: "手动触发成功"})
 }
 func (h *KubernetesHandler) deleteCronJobWithNS(c *gin.Context, ns string) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
-	if err := client.DeleteCronJob(ns, c.Param("name")); err != nil { c.JSON(500, model.Response{Code: 500, Message: "删除失败: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
+	if err := client.DeleteCronJob(ns, c.Param("name")); err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "删除失败: " + err.Error()})
+		return
+	}
 	c.JSON(200, model.Response{Code: 200, Message: "已删除"})
 }
 func (h *KubernetesHandler) ListHPAsAllNS(c *gin.Context) {
 	clusterID := h.resolveClusterCode(c.Param("clusterCode"))
-	if clusterID == 0 { c.JSON(500, model.Response{Code: 500, Message: "cluster not found"}); return }
+	if clusterID == 0 {
+		c.JSON(500, model.Response{Code: 500, Message: "cluster not found"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	hpas, err := client.ListHPAs()
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()})
+		return
+	}
 	type HPASummary struct {
 		Namespace       string `json:"namespace"`
 		Name            string `json:"name"`
@@ -375,11 +475,16 @@ func (h *KubernetesHandler) ListHPAsAllNS(c *gin.Context) {
 	}
 	result := []HPASummary{}
 	for _, h := range hpas.Items {
-		cpu := 0; mem := 0
+		cpu := 0
+		mem := 0
 		for _, m := range h.Spec.Metrics {
 			if m.Resource != nil {
-				if m.Resource.Name == "cpu" { cpu = m.Resource.Target.AverageUtilization }
-				if m.Resource.Name == "memory" { mem = m.Resource.Target.AverageUtilization }
+				if m.Resource.Name == "cpu" {
+					cpu = m.Resource.Target.AverageUtilization
+				}
+				if m.Resource.Name == "memory" {
+					mem = m.Resource.Target.AverageUtilization
+				}
 			}
 		}
 		result = append(result, HPASummary{
@@ -38,16 +38,16 @@ func (h *KubernetesHandler) ListNamespaces(c *gin.Context) {

 // NamespaceDetail is the enriched namespace info for the management page
 type NamespaceDetail struct {
-	Name              string                 `json:"name"`
-	Status            string                 `json:"status"`
-	Age               string                 `json:"age"`
-	Labels            map[string]string      `json:"labels"`
-	Annotations       map[string]string      `json:"annotations,omitempty"`
-	ResourceCounts    map[string]int         `json:"resource_counts"`
-	HasResourceQuota  bool                   `json:"has_resource_quota"`
-	HasLimitRange     bool                   `json:"has_limit_range"`
-	ResourceQuotas    []k8sclient.ResourceQuotaItem `json:"resource_quotas,omitempty"`
-	LimitRanges       []k8sclient.LimitRangeItem    `json:"limit_ranges,omitempty"`
+	Name             string                        `json:"name"`
+	Status           string                        `json:"status"`
+	Age              string                        `json:"age"`
+	Labels           map[string]string             `json:"labels"`
+	Annotations      map[string]string             `json:"annotations,omitempty"`
+	ResourceCounts   map[string]int                `json:"resource_counts"`
+	HasResourceQuota bool                          `json:"has_resource_quota"`
+	HasLimitRange    bool                          `json:"has_limit_range"`
+	ResourceQuotas   []k8sclient.ResourceQuotaItem `json:"resource_quotas,omitempty"`
+	LimitRanges      []k8sclient.LimitRangeItem    `json:"limit_ranges,omitempty"`
 }

 // GetNamespacesDetail returns all namespaces with metadata, resource counts and quota info
@@ -110,11 +110,11 @@ func (h *KubernetesHandler) GetNamespacesDetail(c *gin.Context) {
 	for _, ns := range nsList.Items {
 		name := ns.Metadata.Name
 		nd := NamespaceDetail{
-			Name:           name,
-			Status:         ns.Status.Phase,
-			Age:            formatAge(ns.Metadata.CreationTimestamp),
-			Labels:         ns.Metadata.Labels,
-			Annotations:    ns.Metadata.Annotations,
+			Name:        name,
+			Status:      ns.Status.Phase,
+			Age:         formatAge(ns.Metadata.CreationTimestamp),
+			Labels:      ns.Metadata.Labels,
+			Annotations: ns.Metadata.Annotations,
 			ResourceCounts: map[string]int{
 				"deployments": depCounts[name],
 				"pods":        podCounts[name],
@@ -181,21 +181,27 @@ func (h *KubernetesHandler) GetNamespaceDetailHandler(c *gin.Context) {
 	if deps, err := client.ListDeployments(); err == nil {
 		count := 0
 		for _, d := range deps.Items {
-			if d.Metadata.Namespace == nsName { count++ }
+			if d.Metadata.Namespace == nsName {
+				count++
+			}
 		}
 		nd.ResourceCounts["deployments"] = count
 	}
 	if pods, err := client.ListPods(); err == nil {
 		count := 0
 		for _, p := range pods.Items {
-			if p.Metadata.Namespace == nsName { count++ }
+			if p.Metadata.Namespace == nsName {
+				count++
+			}
 		}
 		nd.ResourceCounts["pods"] = count
 	}
 	if svcs, err := client.ListServices(); err == nil {
 		count := 0
 		for _, s := range svcs.Items {
-			if s.Metadata.Namespace == nsName { count++ }
+			if s.Metadata.Namespace == nsName {
+				count++
+			}
 		}
 		nd.ResourceCounts["services"] = count
 	}
@@ -305,20 +305,20 @@ func (h *KubernetesHandler) GetNodeDetail(c *gin.Context) {
 	}

 	detail := map[string]interface{}{
-		"name":             node.Metadata.Name,
-		"role":             role,
-		"status":           nodeStatus,
-		"creation_time":    node.Metadata.CreationTimestamp,
-		"internal_ip":      internalIP,
-		"external_ip":      externalIP,
-		"hostname":         hostname,
-		"pod_cidr":         node.Spec.PodCIDR,
+		"name":              node.Metadata.Name,
+		"role":              role,
+		"status":            nodeStatus,
+		"creation_time":     node.Metadata.CreationTimestamp,
+		"internal_ip":       internalIP,
+		"external_ip":       externalIP,
+		"hostname":          hostname,
+		"pod_cidr":          node.Spec.PodCIDR,
 		"container_runtime": node.Status.NodeInfo.ContainerRuntimeVersion,
-		"kubelet_version":  node.Status.NodeInfo.KubeletVersion,
-		"os_image":         node.Status.NodeInfo.OSImage,
-		"kernel_version":   node.Status.NodeInfo.KernelVersion,
-		"architecture":     node.Status.NodeInfo.Architecture,
-		"operating_system": node.Status.NodeInfo.OperatingSystem,
+		"kubelet_version":   node.Status.NodeInfo.KubeletVersion,
+		"os_image":          node.Status.NodeInfo.OSImage,
+		"kernel_version":    node.Status.NodeInfo.KernelVersion,
+		"architecture":      node.Status.NodeInfo.Architecture,
+		"operating_system":  node.Status.NodeInfo.OperatingSystem,
 		// Capacity & Allocatable
 		"capacity":    node.Status.Capacity,
 		"allocatable": node.Status.Allocatable,
@@ -326,18 +326,18 @@ func (h *KubernetesHandler) GetNodeDetail(c *gin.Context) {
 		"cpu_usage_m":  cpuUsageM,
 		"mem_usage_mi": memUsageMi,
 		// Allocation
-		"pod_count":         podCount,
-		"cpu_request_m":     totalCPURequestM,
-		"mem_request_mi":    totalMemRequestMi,
-		"cpu_alloc_pct":     cpuAllocPct,
-		"mem_alloc_pct":     memAllocPct,
-		"pod_alloc_pct":     podAllocPct,
-		"cpu_capacity":      capCPU,
-		"cpu_allocatable":   allocCPU,
-		"mem_capacity_mb":   capMem,
+		"pod_count":          podCount,
+		"cpu_request_m":      totalCPURequestM,
+		"mem_request_mi":     totalMemRequestMi,
+		"cpu_alloc_pct":      cpuAllocPct,
+		"mem_alloc_pct":      memAllocPct,
+		"pod_alloc_pct":      podAllocPct,
+		"cpu_capacity":       capCPU,
+		"cpu_allocatable":    allocCPU,
+		"mem_capacity_mb":    capMem,
 		"mem_allocatable_mb": allocMem,
-		"pod_capacity":      capPods,
-		"pod_allocatable":   allocPods,
+		"pod_capacity":       capPods,
+		"pod_allocatable":    allocPods,
 		// Lists
 		"conditions": conditions,
 		"taints":     taints,
@@ -397,20 +397,29 @@ func parseMemToMi(val string) int64 {
 // @Router /kubernetes-clusters/{id}/pods [get]
 func (h *KubernetesHandler) GetCapacityAnalysis(c *gin.Context) {
 	clusterID := h.resolveClusterCode(c.Param("clusterCode"))
-	if clusterID == 0 { c.JSON(500, model.Response{Code: 500, Message: "cluster not found"}); return }
+	if clusterID == 0 {
+		c.JSON(500, model.Response{Code: 500, Message: "cluster not found"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}

 	ns := c.Query("namespace")
 	deps, err := client.ListDeployments()
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()})
+		return
+	}

 	type ContainerResource struct {
-		Name    string `json:"name"`
-		CPUReq  string `json:"cpu_request"`
-		CPULim  string `json:"cpu_limit"`
-		MemReq  string `json:"mem_request"`
-		MemLim  string `json:"mem_limit"`
+		Name   string `json:"name"`
+		CPUReq string `json:"cpu_request"`
+		CPULim string `json:"cpu_limit"`
+		MemReq string `json:"mem_request"`
+		MemLim string `json:"mem_limit"`
 	}
 	type CapacityRow struct {
 		Namespace  string              `json:"namespace"`
@@ -420,7 +429,9 @@ func (h *KubernetesHandler) GetCapacityAnalysis(c *gin.Context) {
 	}
 	result := []CapacityRow{}
 	for _, d := range deps.Items {
-		if ns != "" && d.Metadata.Namespace != ns { continue }
+		if ns != "" && d.Metadata.Namespace != ns {
+			continue
+		}
 		containers := []ContainerResource{}
 		for _, c := range d.Spec.Template.Spec.Containers {
 			cpuReq := c.Resources.Requests["cpu"]
@@ -198,8 +198,8 @@ func (h *KubernetesHandler) ExecTerminal(c *gin.Context) {

 	// Dial K8s API server via WebSocket with channel protocol subprotocol
 	k8sDialer := &websocket.Dialer{
-		TLSClientConfig: client.TLSConfig,
-		Subprotocols:    []string{"v4.channel.k8s.io", "v3.channel.k8s.io", "v5.channel.k8s.io"},
+		TLSClientConfig:  client.TLSConfig,
+		Subprotocols:     []string{"v4.channel.k8s.io", "v3.channel.k8s.io", "v5.channel.k8s.io"},
 		HandshakeTimeout: 10 * time.Second,
 	}
 	k8sHeader := http.Header{}
@@ -354,30 +354,46 @@ func (h *KubernetesHandler) ExecInPodNS(c *gin.Context) {
 // Internal helpers that resolve clusterCode and inject namespace
 func (h *KubernetesHandler) listPodsWithNS(c *gin.Context, ns string) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	pods, err := client.ListPods()
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()})
+		return
+	}
 	// M2: inject pod metrics (best-effort) // Logan.Li
 	podMetrics := buildPodMetricsMap(client, ns)
 	type PodSummary struct {
-		Namespace    string `json:"namespace"`
-		Name         string `json:"name"`
-		Status       string `json:"status"`
-		NodeName     string `json:"node_name"`
-		IP           string `json:"ip"`
-		RestartCount int    `json:"restart_count"`
-		Image        string `json:"image"`
-		CPUUsageM    string `json:"cpu_usage_m,omitempty"`
-		MemUsageMi   string `json:"mem_usage_mi,omitempty"`
+		Namespace    string                   `json:"namespace"`
+		Name         string                   `json:"name"`
+		Status       string                   `json:"status"`
+		NodeName     string                   `json:"node_name"`
+		IP           string                   `json:"ip"`
+		RestartCount int                      `json:"restart_count"`
+		Image        string                   `json:"image"`
+		CPUUsageM    string                   `json:"cpu_usage_m,omitempty"`
+		MemUsageMi   string                   `json:"mem_usage_mi,omitempty"`
 		Conditions   []k8sclient.PodCondition `json:"conditions,omitempty"`
 	}
 	result := []PodSummary{}
 	for _, p := range pods.Items {
-		if p.Metadata.Namespace != ns { continue }
-		image := ""; if len(p.Spec.Containers) > 0 { image = p.Spec.Containers[0].Image }
-		restarts := 0; if len(p.Status.ContainerStatuses) > 0 { restarts = p.Status.ContainerStatuses[0].RestartCount }
+		if p.Metadata.Namespace != ns {
+			continue
+		}
+		image := ""
+		if len(p.Spec.Containers) > 0 {
+			image = p.Spec.Containers[0].Image
+		}
+		restarts := 0
+		if len(p.Status.ContainerStatuses) > 0 {
+			restarts = p.Status.ContainerStatuses[0].RestartCount
+		}
 		ps := PodSummary{
 			Namespace:    p.Metadata.Namespace,
 			Name:         p.Metadata.Name,
@@ -398,7 +414,9 @@ func (h *KubernetesHandler) listPodsWithNS(c *gin.Context, ns string) {
 }
 func (h *KubernetesHandler) getPodLogsWithNS(c *gin.Context, ns string) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
 	podName := c.Param("podName")
 	stream := c.Query("stream") == "true"
 	// 日志增强参数：container / sinceTime / previous / tailLines(兼容 tail) // Logan.Li
@@ -416,34 +434,61 @@ func (h *KubernetesHandler) getPodLogsWithNS(c *gin.Context, ns string) {
 		Previous:  c.Query("previous") == "true",
 	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	if stream {
 		body, err := client.GetPodLogsStreamWithOptions(ns, podName, opts)
-		if err != nil { c.JSON(500, model.Response{Code: 500, Message: "获取日志流失败: " + err.Error()}); return }
+		if err != nil {
+			c.JSON(500, model.Response{Code: 500, Message: "获取日志流失败: " + err.Error()})
+			return
+		}
 		defer body.Close()
 		c.Header("Content-Type", "text/plain; charset=utf-8")
 		c.Header("Cache-Control", "no-cache")
 		c.Stream(func(w io.Writer) bool {
-			buf := make([]byte, 4096); n, err := body.Read(buf)
-			if n > 0 { w.Write(buf[:n]); return true }
+			buf := make([]byte, 4096)
+			n, err := body.Read(buf)
+			if n > 0 {
+				w.Write(buf[:n])
+				return true
+			}
 			return err == nil
 		})
 		return
 	}
 	logs, err := client.GetPodLogsWithOptions(ns, podName, opts)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "获取日志失败: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "获取日志失败: " + err.Error()})
+		return
+	}
 	c.JSON(200, model.Response{Code: 200, Message: "success", Data: gin.H{"logs": logs, "pod": podName, "namespace": ns}})
 }
 func (h *KubernetesHandler) execInPodWithNS(c *gin.Context, ns string) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
 	podName := c.Param("podName")
-	var req struct { Command []string `json:"command"`; Container string `json:"container"` }
-	if err := c.ShouldBindJSON(&req); err != nil { c.JSON(400, model.Response{Code: 400, Message: "参数错误"}); return }
+	var req struct {
+		Command   []string `json:"command"`
+		Container string   `json:"container"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(400, model.Response{Code: 400, Message: "参数错误"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	result, err := client.ExecInPod(ns, podName, req.Container, req.Command)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "执行失败: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "执行失败: " + err.Error()})
+		return
+	}
 	c.JSON(200, model.Response{Code: 200, Data: result})
 }

@@ -454,11 +499,20 @@ func (h *KubernetesHandler) execInPodWithNS(c *gin.Context, ns string) {
 // ListDeploymentsAllNS lists all deployments across all namespaces using clusterCode.
 func (h *KubernetesHandler) ListPodsAllNS(c *gin.Context) {
 	clusterID := h.resolveClusterCode(c.Param("clusterCode"))
-	if clusterID == 0 { c.JSON(500, model.Response{Code: 500, Message: "cluster not found"}); return }
+	if clusterID == 0 {
+		c.JSON(500, model.Response{Code: 500, Message: "cluster not found"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	pods, err := client.ListPods()
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()})
+		return
+	}
 	// M2: inject pod metrics (best-effort) // Logan.Li
 	podMetrics := buildPodMetricsMap(client, "")
 	type PodSummary struct {
@@ -474,8 +528,14 @@ func (h *KubernetesHandler) ListPodsAllNS(c *gin.Context) {
 	}
 	result := []PodSummary{}
 	for _, p := range pods.Items {
-		image := ""; if len(p.Spec.Containers) > 0 { image = p.Spec.Containers[0].Image }
-		restarts := 0; if len(p.Status.ContainerStatuses) > 0 { restarts = p.Status.ContainerStatuses[0].RestartCount }
+		image := ""
+		if len(p.Spec.Containers) > 0 {
+			image = p.Spec.Containers[0].Image
+		}
+		restarts := 0
+		if len(p.Status.ContainerStatuses) > 0 {
+			restarts = p.Status.ContainerStatuses[0].RestartCount
+		}
 		ps := PodSummary{
 			Namespace:    p.Metadata.Namespace,
 			Name:         p.Metadata.Name,
@@ -559,58 +619,80 @@ func parseMemResource(val string) int64 {

 // formatCpuFromNano converts K8s metrics CPU (nanocores "80410173n") to millicores "80m"
 func formatCpuFromNano(raw string) string {
-	if raw == "" { return "" }
+	if raw == "" {
+		return ""
+	}
 	val := raw
 	val = strings.TrimSuffix(val, "n")
 	var nano int64
 	fmt.Sscanf(val, "%d", &nano)
 	milli := nano / 1000000
-	if milli < 1 { milli = 1 }
+	if milli < 1 {
+		milli = 1
+	}
 	return fmt.Sprintf("%dm", milli)
 }

 // parseCpuNanoToMilli converts K8s metrics CPU (nanocores "100354992n") to millicores (int) // Logan.Li
 func parseCpuNanoToMilli(raw string) int {
-	if raw == "" { return 0 }
+	if raw == "" {
+		return 0
+	}
 	val := strings.TrimSuffix(raw, "n")
 	var nano int64
 	fmt.Sscanf(val, "%d", &nano)
 	milli := nano / 1000000
-	if milli < 1 { milli = 1 }
+	if milli < 1 {
+		milli = 1
+	}
 	return int(milli)
 }

 // formatMemFromKi converts K8s metrics memory (Ki "2154292Ki") to Mi "2105Mi"
 func formatMemFromKi(raw string) string {
-	if raw == "" { return "" }
+	if raw == "" {
+		return ""
+	}
 	val := strings.TrimSuffix(raw, "Ki")
 	var ki int64
 	fmt.Sscanf(val, "%d", &ki)
 	mi := ki / 1024
-	if mi < 1 { mi = 1 }
+	if mi < 1 {
+		mi = 1
+	}
 	return fmt.Sprintf("%dMi", mi)
 }

 // parseMemKiToMi converts K8s metrics memory (Ki "2154292Ki") to Mi (int) // Logan.Li
 func parseMemKiToMi(raw string) int {
-	if raw == "" { return 0 }
+	if raw == "" {
+		return 0
+	}
 	val := strings.TrimSuffix(raw, "Ki")
 	var ki int64
 	fmt.Sscanf(val, "%d", &ki)
 	return int(ki / 1024)
 }

-
 // GetResourceYAMLNS returns the YAML of a K8s resource
 func (h *KubernetesHandler) GetPodMetrics(c *gin.Context) {
 	clusterID := h.resolveClusterCode(c.Param("clusterCode"))
-	if clusterID == 0 { c.JSON(500, model.Response{Code: 500, Message: "cluster not found"}); return }
+	if clusterID == 0 {
+		c.JSON(500, model.Response{Code: 500, Message: "cluster not found"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}

 	ns := c.Query("namespace")
 	metrics, err := client.ListPodMetrics(ns)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "metrics API error: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "metrics API error: " + err.Error()})
+		return
+	}

 	type ContainerMetric struct {
 		Name   string `json:"name"`
@@ -643,13 +725,22 @@ func (h *KubernetesHandler) DeletePodNS(c *gin.Context) {
 }
 func (h *KubernetesHandler) deletePodWithNS(c *gin.Context, ns string) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
 	podName := c.Param("podName")
-	if podName == "" { c.JSON(400, model.Response{Code: 400, Message: "缺少 podName"}); return }
+	if podName == "" {
+		c.JSON(400, model.Response{Code: 400, Message: "缺少 podName"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	if err := client.DeletePod(ns, podName); err != nil {
-		c.JSON(500, model.Response{Code: 500, Message: "删除 Pod 失败: " + err.Error()}); return
+		c.JSON(500, model.Response{Code: 500, Message: "删除 Pod 失败: " + err.Error()})
+		return
 	}
 	c.JSON(200, model.Response{Code: 200, Message: fmt.Sprintf("Pod %s 已删除", podName)})
 }
@@ -19,20 +19,33 @@ func (h *KubernetesHandler) ListPodFilesNS(c *gin.Context) {
 }
 func (h *KubernetesHandler) listPodFilesWithNS(c *gin.Context, ns string) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
 	podName := c.Param("podName")
 	var req struct {
 		Path      string `json:"path"`
 		Container string `json:"container"`
 	}
-	if err := c.ShouldBindJSON(&req); err != nil { c.JSON(400, model.Response{Code: 400, Message: "参数错误: " + err.Error()}); return }
-	if req.Path == "" { req.Path = "/" }
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(400, model.Response{Code: 400, Message: "参数错误: " + err.Error()})
+		return
+	}
+	if req.Path == "" {
+		req.Path = "/"
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	// ls -la — BusyBox ignores --time-style, use default "Mon DD HH:MM" format
 	cmd := []string{"ls", "-la", req.Path}
 	result, err := client.ExecInPod(ns, podName, req.Container, cmd)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "执行 ls 失败: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "执行 ls 失败: " + err.Error()})
+		return
+	}

 	type FileInfo struct {
 		Name    string `json:"name"`
@@ -45,11 +58,17 @@ func (h *KubernetesHandler) listPodFilesWithNS(c *gin.Context, ns string) {
 	output := result.Stdout // WebSocket output is already clean text
 	for _, line := range strings.Split(output, "\n") {
 		line = strings.TrimSpace(line)
-		if line == "" || strings.HasPrefix(line, "total ") { continue }
+		if line == "" || strings.HasPrefix(line, "total ") {
+			continue
+		}
 		fields := strings.Fields(line)
-		if len(fields) < 7 { continue }
+		if len(fields) < 7 {
+			continue
+		}
 		mode := fields[0]
-		if len(mode) == 0 || (mode[0] != 'd' && mode[0] != '-' && mode[0] != 'l') { continue }
+		if len(mode) == 0 || (mode[0] != 'd' && mode[0] != '-' && mode[0] != 'l') {
+			continue
+		}
 		size := fields[4]
 		// BusyBox ls date format: "Jun 23 02:17" (3 fields: month day time)
 		// GNU ls --time-style: "2026-06-23T02:17:00" (1 field)
@@ -64,7 +83,9 @@ func (h *KubernetesHandler) listPodFilesWithNS(c *gin.Context, ns string) {
 			modTime = strings.Join(fields[5:8], " ")
 			name = strings.Join(fields[8:], " ")
 		}
-		if name == "" || name == "." || name == ".." { continue }
+		if name == "" || name == "." || name == ".." {
+			continue
+		}
 		files = append(files, FileInfo{
 			Name:    name,
 			Size:    size,
@@ -82,16 +103,27 @@ func (h *KubernetesHandler) DownloadPodFileNS(c *gin.Context) {
 }
 func (h *KubernetesHandler) downloadPodFileWithNS(c *gin.Context, ns string) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
 	podName := c.Param("podName")
 	filePath := c.Query("path")
 	container := c.Query("container")
-	if filePath == "" { c.JSON(400, model.Response{Code: 400, Message: "path 参数不能为空"}); return }
+	if filePath == "" {
+		c.JSON(400, model.Response{Code: 400, Message: "path 参数不能为空"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	cmd := []string{"cat", filePath}
 	result, err := client.ExecInPod(ns, podName, container, cmd)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "读取文件失败: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "读取文件失败: " + err.Error()})
+		return
+	}
 	content := result.Stdout
 	fileName := path.Base(filePath)
 	c.Header("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s\"", fileName))
@@ -223,7 +223,6 @@ func (h *KubernetesHandler) SaveTopology(c *gin.Context) {
 	c.JSON(http.StatusOK, model.Response{Code: 200, Message: "保存成功"})
 }

-
 // SyncCluster 同步集群资源（连接真实K8s API拉取数据）
 func (h *KubernetesHandler) ListConfigMaps(c *gin.Context) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
@@ -313,11 +312,19 @@ func (h *KubernetesHandler) ListIngressesNS(c *gin.Context) {
 }
 func (h *KubernetesHandler) listServicesWithNS(c *gin.Context, ns string) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	svcs, err := client.ListServices()
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()})
+		return
+	}
 	type SvcPortDetail struct {
 		Name       string      `json:"name,omitempty"`
 		Port       int         `json:"port"`
@@ -326,17 +333,19 @@ func (h *KubernetesHandler) listServicesWithNS(c *gin.Context, ns string) {
 		Protocol   string      `json:"protocol,omitempty"`
 	}
 	type SvcSummary struct {
-		Namespace  string            `json:"namespace"`
-		Name       string            `json:"name"`
-		Type       string            `json:"type"`
-		ClusterIP  string            `json:"cluster_ip"`
-		Ports      int               `json:"ports"`
-		PortList   []SvcPortDetail   `json:"portList,omitempty"`
-		Selector   map[string]string `json:"selector,omitempty"`
+		Namespace string            `json:"namespace"`
+		Name      string            `json:"name"`
+		Type      string            `json:"type"`
+		ClusterIP string            `json:"cluster_ip"`
+		Ports     int               `json:"ports"`
+		PortList  []SvcPortDetail   `json:"portList,omitempty"`
+		Selector  map[string]string `json:"selector,omitempty"`
 	}
 	result := []SvcSummary{}
 	for _, s := range svcs.Items {
-		if s.Metadata.Namespace != ns { continue }
+		if s.Metadata.Namespace != ns {
+			continue
+		}
 		ports := []SvcPortDetail{}
 		for _, p := range s.Spec.Ports {
 			ports = append(ports, SvcPortDetail{
@@ -345,28 +354,36 @@ func (h *KubernetesHandler) listServicesWithNS(c *gin.Context, ns string) {
 			})
 		}
 		result = append(result, SvcSummary{
-			Namespace:  s.Metadata.Namespace,
-			Name:       s.Metadata.Name,
-			Type:       s.Spec.Type,
-			ClusterIP:  s.Spec.ClusterIP,
-			Ports:      len(s.Spec.Ports),
-			PortList:   ports,
-			Selector:   s.Spec.Selector,
+			Namespace: s.Metadata.Namespace,
+			Name:      s.Metadata.Name,
+			Type:      s.Spec.Type,
+			ClusterIP: s.Spec.ClusterIP,
+			Ports:     len(s.Spec.Ports),
+			PortList:  ports,
+			Selector:  s.Spec.Selector,
 		})
 	}
 	c.JSON(200, model.Response{Code: 200, Data: result})
 }
 func (h *KubernetesHandler) listIngressesWithNS(c *gin.Context, ns string) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	ings, err := client.ListIngresses()
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()})
+		return
+	}
 	type PathDetail struct {
-		Path       string `json:"path"`
-		PathType   string `json:"pathType,omitempty"`
-		BackendSvc string `json:"backendService,omitempty"`
+		Path        string `json:"path"`
+		PathType    string `json:"pathType,omitempty"`
+		BackendSvc  string `json:"backendService,omitempty"`
 		BackendPort string `json:"backendPort,omitempty"`
 	}
 	type RuleDetail struct {
@@ -374,20 +391,24 @@ func (h *KubernetesHandler) listIngressesWithNS(c *gin.Context, ns string) {
 		Paths []PathDetail `json:"paths"`
 	}
 	type IngSummary struct {
-		Namespace      string      `json:"namespace"`
-		Name           string      `json:"name"`
-		Hosts          []string    `json:"hosts"`
-		TLS            bool        `json:"tls"`
-		IngressClass   string      `json:"ingressClass,omitempty"`
-		Rules          []RuleDetail `json:"rules,omitempty"`
+		Namespace    string       `json:"namespace"`
+		Name         string       `json:"name"`
+		Hosts        []string     `json:"hosts"`
+		TLS          bool         `json:"tls"`
+		IngressClass string       `json:"ingressClass,omitempty"`
+		Rules        []RuleDetail `json:"rules,omitempty"`
 	}
 	result := []IngSummary{}
 	for _, ing := range ings.Items {
-		if ing.Metadata.Namespace != ns { continue }
+		if ing.Metadata.Namespace != ns {
+			continue
+		}
 		hosts := []string{}
 		rules := []RuleDetail{}
 		for _, rule := range ing.Spec.Rules {
-			if rule.Host != "" { hosts = append(hosts, rule.Host) }
+			if rule.Host != "" {
+				hosts = append(hosts, rule.Host)
+			}
 			rd := RuleDetail{Host: rule.Host, Paths: []PathDetail{}}
 			if rule.HTTP != nil {
 				for _, p := range rule.HTTP.Paths {
@@ -453,12 +474,21 @@ func (h *KubernetesHandler) ListIngressClasses(c *gin.Context) {

 func (h *KubernetesHandler) ListPVCsNS(c *gin.Context) {
 	clusterID := h.resolveClusterCode(c.Param("clusterCode"))
-	if clusterID == 0 { c.JSON(500, model.Response{Code: 500, Message: "cluster not found"}); return }
+	if clusterID == 0 {
+		c.JSON(500, model.Response{Code: 500, Message: "cluster not found"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	ns := c.Param("namespace")
 	pvcs, err := client.ListPVCs(ns)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()})
+		return
+	}
 	type PVCSummary struct {
 		Namespace    string `json:"namespace"`
 		Name         string `json:"name"`
@@ -470,14 +500,16 @@ func (h *KubernetesHandler) ListPVCsNS(c *gin.Context) {
 	for _, p := range pvcs.Items {
 		size := ""
 		if p.Status.Capacity != nil {
-			if s, ok := p.Status.Capacity["storage"]; ok { size = s }
+			if s, ok := p.Status.Capacity["storage"]; ok {
+				size = s
+			}
 		}
 		result = append(result, PVCSummary{
-			Namespace:     p.Metadata.Namespace,
-			Name:          p.Metadata.Name,
-			Phase:         p.Status.Phase,
-			Size:          size,
-			StorageClass:  p.Spec.StorageClassName,
+			Namespace:    p.Metadata.Namespace,
+			Name:         p.Metadata.Name,
+			Phase:        p.Status.Phase,
+			Size:         size,
+			StorageClass: p.Spec.StorageClassName,
 		})
 	}
 	c.JSON(200, model.Response{Code: 200, Data: result})
@@ -486,11 +518,18 @@ func (h *KubernetesHandler) ListPVCsNS(c *gin.Context) {
 // DeletePVCNS deletes a PVC (code-based)
 func (h *KubernetesHandler) DeletePVCNS(c *gin.Context) {
 	clusterID := h.resolveClusterCode(c.Param("clusterCode"))
-	if clusterID == 0 { c.JSON(500, model.Response{Code: 500, Message: "cluster not found"}); return }
+	if clusterID == 0 {
+		c.JSON(500, model.Response{Code: 500, Message: "cluster not found"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	if err := client.DeletePVC(c.Param("namespace"), c.Param("name")); err != nil {
-		c.JSON(500, model.Response{Code: 500, Message: "删除失败: " + err.Error()}); return
+		c.JSON(500, model.Response{Code: 500, Message: "删除失败: " + err.Error()})
+		return
 	}
 	c.JSON(200, model.Response{Code: 200, Message: "已删除"})
 }
@@ -208,15 +208,25 @@ func (h *KubernetesHandler) GetDeploymentNS(c *gin.Context) {
 	ns := c.Param("namespace")
 	name := c.Param("name")
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	deps, err := client.ListDeployments()
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()})
+		return
+	}
 	for _, d := range deps.Items {
 		if d.Metadata.Namespace == ns && d.Metadata.Name == name {
 			image := ""
-			if len(d.Spec.Template.Spec.Containers) > 0 { image = d.Spec.Template.Spec.Containers[0].Image }
+			if len(d.Spec.Template.Spec.Containers) > 0 {
+				image = d.Spec.Template.Spec.Containers[0].Image
+			}
 			c.JSON(200, model.Response{Code: 200, Data: map[string]interface{}{
 				"namespace":          d.Metadata.Namespace,
 				"name":               d.Metadata.Name,
@@ -248,11 +258,19 @@ func (h *KubernetesHandler) ResumeDeploymentNS(c *gin.Context) {
 }
 func (h *KubernetesHandler) listDeploymentsWithNS(c *gin.Context, ns string) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	deps, err := client.ListDeployments()
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()})
+		return
+	}
 	type DepSummary struct {
 		Namespace         string            `json:"namespace"`
 		Name              string            `json:"name"`
@@ -265,8 +283,13 @@ func (h *KubernetesHandler) listDeploymentsWithNS(c *gin.Context, ns string) {
 	}
 	result := []DepSummary{}
 	for _, d := range deps.Items {
-		if d.Metadata.Namespace != ns { continue }
-		image := ""; if len(d.Spec.Template.Spec.Containers) > 0 { image = d.Spec.Template.Spec.Containers[0].Image }
+		if d.Metadata.Namespace != ns {
+			continue
+		}
+		image := ""
+		if len(d.Spec.Template.Spec.Containers) > 0 {
+			image = d.Spec.Template.Spec.Containers[0].Image
+		}
 		result = append(result, DepSummary{
 			Namespace:         d.Metadata.Namespace,
 			Name:              d.Metadata.Name,
@@ -275,63 +298,131 @@ func (h *KubernetesHandler) listDeploymentsWithNS(c *gin.Context, ns string) {
 			ReadyReplicas:     d.Status.ReadyReplicas,
 			Image:             image,
 			Paused:            d.Spec.Paused,
-			Selector:          func() map[string]string { if d.Spec.Selector != nil { return d.Spec.Selector.MatchLabels }; return nil }(),
+			Selector: func() map[string]string {
+				if d.Spec.Selector != nil {
+					return d.Spec.Selector.MatchLabels
+				}
+				return nil
+			}(),
 		})
 	}
 	c.JSON(200, model.Response{Code: 200, Data: result})
 }
 func (h *KubernetesHandler) scaleDeploymentWithNS(c *gin.Context, ns string) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
-	var req struct { Replicas int `json:"replicas"` }
-	if err := c.ShouldBindJSON(&req); err != nil { c.JSON(400, model.Response{Code: 400, Message: "参数错误"}); return }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
+	var req struct {
+		Replicas int `json:"replicas"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(400, model.Response{Code: 400, Message: "参数错误"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
-	if err := client.ScaleDeployment(ns, c.Param("name"), req.Replicas); err != nil { c.JSON(500, model.Response{Code: 500, Message: "扩缩容失败: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
+	if err := client.ScaleDeployment(ns, c.Param("name"), req.Replicas); err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "扩缩容失败: " + err.Error()})
+		return
+	}
 	c.JSON(200, model.Response{Code: 200, Message: fmt.Sprintf("已设置为 %d 副本", req.Replicas)})
 }
 func (h *KubernetesHandler) restartDeploymentWithNS(c *gin.Context, ns string) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
-	if err := client.RestartDeployment(ns, c.Param("name")); err != nil { c.JSON(500, model.Response{Code: 500, Message: "重启失败: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
+	if err := client.RestartDeployment(ns, c.Param("name")); err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "重启失败: " + err.Error()})
+		return
+	}
 	c.JSON(200, model.Response{Code: 200, Message: "重启指令已下发"})
 }
 func (h *KubernetesHandler) updateDeploymentImageWithNS(c *gin.Context, ns string) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
-	var req struct { Image string `json:"image"`; ContainerName string `json:"container_name"` }
-	if err := c.ShouldBindJSON(&req); err != nil { c.JSON(400, model.Response{Code: 400, Message: "参数错误"}); return }
-	if strings.TrimSpace(req.Image) == "" { c.JSON(400, model.Response{Code: 400, Message: "image 不能为空"}); return }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
+	var req struct {
+		Image         string `json:"image"`
+		ContainerName string `json:"container_name"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(400, model.Response{Code: 400, Message: "参数错误"})
+		return
+	}
+	if strings.TrimSpace(req.Image) == "" {
+		c.JSON(400, model.Response{Code: 400, Message: "image 不能为空"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
-	if err := client.UpdateDeploymentImage(ns, c.Param("name"), req.ContainerName, req.Image); err != nil { c.JSON(500, model.Response{Code: 500, Message: "更新镜像失败: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
+	if err := client.UpdateDeploymentImage(ns, c.Param("name"), req.ContainerName, req.Image); err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "更新镜像失败: " + err.Error()})
+		return
+	}
 	c.JSON(200, model.Response{Code: 200, Message: fmt.Sprintf("镜像已更新为 %s", req.Image)})
 }
 func (h *KubernetesHandler) pauseDeploymentWithNS(c *gin.Context, ns string) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
-	if err := client.PauseDeployment(ns, c.Param("name")); err != nil { c.JSON(500, model.Response{Code: 500, Message: "暂停更新失败: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
+	if err := client.PauseDeployment(ns, c.Param("name")); err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "暂停更新失败: " + err.Error()})
+		return
+	}
 	c.JSON(200, model.Response{Code: 200, Message: "已暂停滚动更新"})
 }
 func (h *KubernetesHandler) resumeDeploymentWithNS(c *gin.Context, ns string) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
-	if err := client.ResumeDeployment(ns, c.Param("name")); err != nil { c.JSON(500, model.Response{Code: 500, Message: "恢复更新失败: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
+	if err := client.ResumeDeployment(ns, c.Param("name")); err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "恢复更新失败: " + err.Error()})
+		return
+	}
 	c.JSON(200, model.Response{Code: 200, Message: "已恢复滚动更新"})
 }
 func (h *KubernetesHandler) ListDeploymentsAllNS(c *gin.Context) {
 	clusterID := h.resolveClusterCode(c.Param("clusterCode"))
-	if clusterID == 0 { c.JSON(500, model.Response{Code: 500, Message: "cluster not found"}); return }
+	if clusterID == 0 {
+		c.JSON(500, model.Response{Code: 500, Message: "cluster not found"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	deps, err := client.ListDeployments()
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()})
+		return
+	}
 	type DepSummary struct {
 		Namespace         string `json:"namespace"`
 		Name              string `json:"name"`
@@ -342,7 +433,10 @@ func (h *KubernetesHandler) ListDeploymentsAllNS(c *gin.Context) {
 	}
 	result := []DepSummary{}
 	for _, d := range deps.Items {
-		image := ""; if len(d.Spec.Template.Spec.Containers) > 0 { image = d.Spec.Template.Spec.Containers[0].Image }
+		image := ""
+		if len(d.Spec.Template.Spec.Containers) > 0 {
+			image = d.Spec.Template.Spec.Containers[0].Image
+		}
 		result = append(result, DepSummary{
 			Namespace:         d.Metadata.Namespace,
 			Name:              d.Metadata.Name,
@@ -358,11 +452,20 @@ func (h *KubernetesHandler) ListDeploymentsAllNS(c *gin.Context) {
 // ListPodsAllNS lists all pods across all namespaces using clusterCode.
 func (h *KubernetesHandler) ListStatefulSetsNS(c *gin.Context) {
 	clusterID := h.resolveClusterCode(c.Param("clusterCode"))
-	if clusterID == 0 { c.JSON(500, model.Response{Code: 500, Message: "cluster not found"}); return }
+	if clusterID == 0 {
+		c.JSON(500, model.Response{Code: 500, Message: "cluster not found"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	sts, err := client.ListStatefulSets()
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()})
+		return
+	}
 	ns := c.Param("namespace")
 	type StsSummary struct {
 		Namespace string `json:"namespace"`
@@ -373,8 +476,13 @@ func (h *KubernetesHandler) ListStatefulSetsNS(c *gin.Context) {
 	}
 	result := []StsSummary{}
 	for _, s := range sts.Items {
-		if s.Metadata.Namespace != ns { continue }
-		image := ""; if len(s.Spec.Template.Spec.Containers) > 0 { image = s.Spec.Template.Spec.Containers[0].Image }
+		if s.Metadata.Namespace != ns {
+			continue
+		}
+		image := ""
+		if len(s.Spec.Template.Spec.Containers) > 0 {
+			image = s.Spec.Template.Spec.Containers[0].Image
+		}
 		result = append(result, StsSummary{
 			Namespace: s.Metadata.Namespace,
 			Name:      s.Metadata.Name,
@@ -389,11 +497,20 @@ func (h *KubernetesHandler) ListStatefulSetsNS(c *gin.Context) {
 // ListDaemonSetsNS lists DaemonSets in a namespace
 func (h *KubernetesHandler) ListDaemonSetsNS(c *gin.Context) {
 	clusterID := h.resolveClusterCode(c.Param("clusterCode"))
-	if clusterID == 0 { c.JSON(500, model.Response{Code: 500, Message: "cluster not found"}); return }
+	if clusterID == 0 {
+		c.JSON(500, model.Response{Code: 500, Message: "cluster not found"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	ds, err := client.ListDaemonSets()
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()})
+		return
+	}
 	ns := c.Param("namespace")
 	type DsSummary struct {
 		Namespace string `json:"namespace"`
@@ -405,8 +522,13 @@ func (h *KubernetesHandler) ListDaemonSetsNS(c *gin.Context) {
 	}
 	result := []DsSummary{}
 	for _, d := range ds.Items {
-		if d.Metadata.Namespace != ns { continue }
-		image := ""; if len(d.Spec.Template.Spec.Containers) > 0 { image = d.Spec.Template.Spec.Containers[0].Image }
+		if d.Metadata.Namespace != ns {
+			continue
+		}
+		image := ""
+		if len(d.Spec.Template.Spec.Containers) > 0 {
+			image = d.Spec.Template.Spec.Containers[0].Image
+		}
 		result = append(result, DsSummary{
 			Namespace: d.Metadata.Namespace,
 			Name:      d.Metadata.Name,
@@ -418,18 +540,31 @@ func (h *KubernetesHandler) ListDaemonSetsNS(c *gin.Context) {
 	}
 	c.JSON(200, model.Response{Code: 200, Data: result})
 }
+
 // ScaleStatefulSetNS scales a StatefulSet (Kuboard code route)
 func (h *KubernetesHandler) ScaleStatefulSetNS(c *gin.Context) {
 	clusterID := h.resolveClusterCode(c.Param("clusterCode"))
-	if clusterID == 0 { c.JSON(500, model.Response{Code: 500, Message: "cluster not found"}); return }
+	if clusterID == 0 {
+		c.JSON(500, model.Response{Code: 500, Message: "cluster not found"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	ns := c.Param("namespace")
 	name := c.Param("name")
-	var req struct{ Replicas int `json:"replicas"` }
-	if err := c.ShouldBindJSON(&req); err != nil { c.JSON(400, model.Response{Code: 400, Message: "参数错误"}); return }
+	var req struct {
+		Replicas int `json:"replicas"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(400, model.Response{Code: 400, Message: "参数错误"})
+		return
+	}
 	if err := client.ScaleStatefulSet(ns, name, req.Replicas); err != nil {
-		c.JSON(500, model.Response{Code: 500, Message: "扩缩容失败: " + err.Error()}); return
+		c.JSON(500, model.Response{Code: 500, Message: "扩缩容失败: " + err.Error()})
+		return
 	}
 	c.JSON(200, model.Response{Code: 200, Message: "StatefulSet 副本数已更新为 " + strconv.Itoa(req.Replicas)})
 }
@@ -437,16 +572,30 @@ func (h *KubernetesHandler) ScaleStatefulSetNS(c *gin.Context) {
 // ScaleStatefulSet scales a StatefulSet (ID route)
 func (h *KubernetesHandler) ScaleStatefulSet(c *gin.Context) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
-	if clusterID == 0 { c.JSON(500, model.Response{Code: 500, Message: "cluster not found"}); return }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
+	if clusterID == 0 {
+		c.JSON(500, model.Response{Code: 500, Message: "cluster not found"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	ns := c.Param("namespace")
 	name := c.Param("name")
-	var req struct{ Replicas int `json:"replicas"` }
-	if err := c.ShouldBindJSON(&req); err != nil { c.JSON(400, model.Response{Code: 400, Message: "参数错误"}); return }
+	var req struct {
+		Replicas int `json:"replicas"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(400, model.Response{Code: 400, Message: "参数错误"})
+		return
+	}
 	if err := client.ScaleStatefulSet(ns, name, req.Replicas); err != nil {
-		c.JSON(500, model.Response{Code: 500, Message: "扩缩容失败: " + err.Error()}); return
+		c.JSON(500, model.Response{Code: 500, Message: "扩缩容失败: " + err.Error()})
+		return
 	}
 	c.JSON(200, model.Response{Code: 200, Message: "StatefulSet 副本数已更新为 " + strconv.Itoa(req.Replicas)})
 }
@@ -454,13 +603,20 @@ func (h *KubernetesHandler) ScaleStatefulSet(c *gin.Context) {
 // RestartStatefulSetNS restarts a StatefulSet (Kuboard code route)
 func (h *KubernetesHandler) RestartStatefulSetNS(c *gin.Context) {
 	clusterID := h.resolveClusterCode(c.Param("clusterCode"))
-	if clusterID == 0 { c.JSON(500, model.Response{Code: 500, Message: "cluster not found"}); return }
+	if clusterID == 0 {
+		c.JSON(500, model.Response{Code: 500, Message: "cluster not found"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	ns := c.Param("namespace")
 	name := c.Param("name")
 	if err := client.RestartStatefulSet(ns, name); err != nil {
-		c.JSON(500, model.Response{Code: 500, Message: "重启失败: " + err.Error()}); return
+		c.JSON(500, model.Response{Code: 500, Message: "重启失败: " + err.Error()})
+		return
 	}
 	c.JSON(200, model.Response{Code: 200, Message: "StatefulSet 滚动重启已触发"})
 }
@@ -468,14 +624,23 @@ func (h *KubernetesHandler) RestartStatefulSetNS(c *gin.Context) {
 // RestartStatefulSet restarts a StatefulSet (ID route)
 func (h *KubernetesHandler) RestartStatefulSet(c *gin.Context) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
-	if clusterID == 0 { c.JSON(500, model.Response{Code: 500, Message: "cluster not found"}); return }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
+	if clusterID == 0 {
+		c.JSON(500, model.Response{Code: 500, Message: "cluster not found"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	ns := c.Param("namespace")
 	name := c.Param("name")
 	if err := client.RestartStatefulSet(ns, name); err != nil {
-		c.JSON(500, model.Response{Code: 500, Message: "重启失败: " + err.Error()}); return
+		c.JSON(500, model.Response{Code: 500, Message: "重启失败: " + err.Error()})
+		return
 	}
 	c.JSON(200, model.Response{Code: 200, Message: "StatefulSet 滚动重启已触发"})
 }
@@ -483,13 +648,20 @@ func (h *KubernetesHandler) RestartStatefulSet(c *gin.Context) {
 // RestartDaemonSetNS restarts a DaemonSet (Kuboard code route)
 func (h *KubernetesHandler) RestartDaemonSetNS(c *gin.Context) {
 	clusterID := h.resolveClusterCode(c.Param("clusterCode"))
-	if clusterID == 0 { c.JSON(500, model.Response{Code: 500, Message: "cluster not found"}); return }
+	if clusterID == 0 {
+		c.JSON(500, model.Response{Code: 500, Message: "cluster not found"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	ns := c.Param("namespace")
 	name := c.Param("name")
 	if err := client.RestartDaemonSet(ns, name); err != nil {
-		c.JSON(500, model.Response{Code: 500, Message: "重启失败: " + err.Error()}); return
+		c.JSON(500, model.Response{Code: 500, Message: "重启失败: " + err.Error()})
+		return
 	}
 	c.JSON(200, model.Response{Code: 200, Message: "DaemonSet 滚动重启已触发"})
 }
@@ -497,14 +669,23 @@ func (h *KubernetesHandler) RestartDaemonSetNS(c *gin.Context) {
 // RestartDaemonSet restarts a DaemonSet (ID route)
 func (h *KubernetesHandler) RestartDaemonSet(c *gin.Context) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
-	if clusterID == 0 { c.JSON(500, model.Response{Code: 500, Message: "cluster not found"}); return }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
+	if clusterID == 0 {
+		c.JSON(500, model.Response{Code: 500, Message: "cluster not found"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	ns := c.Param("namespace")
 	name := c.Param("name")
 	if err := client.RestartDaemonSet(ns, name); err != nil {
-		c.JSON(500, model.Response{Code: 500, Message: "重启失败: " + err.Error()}); return
+		c.JSON(500, model.Response{Code: 500, Message: "重启失败: " + err.Error()})
+		return
 	}
 	c.JSON(200, model.Response{Code: 200, Message: "DaemonSet 滚动重启已触发"})
 }
@@ -512,26 +693,44 @@ func (h *KubernetesHandler) RestartDaemonSet(c *gin.Context) {
 // GetStatefulSetDetailNS returns a single StatefulSet detail (Kuboard code route)
 func (h *KubernetesHandler) GetStatefulSetDetailNS(c *gin.Context) {
 	clusterID := h.resolveClusterCode(c.Param("clusterCode"))
-	if clusterID == 0 { c.JSON(500, model.Response{Code: 500, Message: "cluster not found"}); return }
+	if clusterID == 0 {
+		c.JSON(500, model.Response{Code: 500, Message: "cluster not found"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	ns := c.Param("namespace")
 	name := c.Param("name")
 	sts, err := client.GetStatefulSet(ns, name)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()})
+		return
+	}
 	c.JSON(200, model.Response{Code: 200, Data: sts})
 }

 // GetDaemonSetDetailNS returns a single DaemonSet detail (Kuboard code route)
 func (h *KubernetesHandler) GetDaemonSetDetailNS(c *gin.Context) {
 	clusterID := h.resolveClusterCode(c.Param("clusterCode"))
-	if clusterID == 0 { c.JSON(500, model.Response{Code: 500, Message: "cluster not found"}); return }
+	if clusterID == 0 {
+		c.JSON(500, model.Response{Code: 500, Message: "cluster not found"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	ns := c.Param("namespace")
 	name := c.Param("name")
 	ds, err := client.GetDaemonSet(ns, name)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()})
+		return
+	}
 	c.JSON(200, model.Response{Code: 200, Data: ds})
 }

@@ -545,11 +744,19 @@ func (h *KubernetesHandler) ListReplicaSetsNS(c *gin.Context) {
 }
 func (h *KubernetesHandler) listReplicaSetsWithNS(c *gin.Context, ns string) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	items, err := client.ListReplicaSetsRaw(ns)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()})
+		return
+	}
 	type RSSummary struct {
 		Namespace         string `json:"namespace"`
 		Name              string `json:"name"`
@@ -564,11 +771,16 @@ func (h *KubernetesHandler) listReplicaSetsWithNS(c *gin.Context, ns string) {
 	result := []RSSummary{}
 	for _, rs := range items {
 		image := ""
-		if len(rs.Spec.Template.Spec.Containers) > 0 { image = rs.Spec.Template.Spec.Containers[0].Image }
+		if len(rs.Spec.Template.Spec.Containers) > 0 {
+			image = rs.Spec.Template.Spec.Containers[0].Image
+		}
 		revision := rs.Metadata.Annotations["deployment.kubernetes.io/revision"]
 		owner := ""
 		for _, o := range rs.Metadata.OwnerReferences {
-			if o.Kind == "Deployment" { owner = o.Name; break }
+			if o.Kind == "Deployment" {
+				owner = o.Name
+				break
+			}
 		}
 		result = append(result, RSSummary{
 			Namespace:         rs.Metadata.Namespace,
@@ -591,13 +803,24 @@ func (h *KubernetesHandler) ListDeploymentRevisionsNS(c *gin.Context) {
 }
 func (h *KubernetesHandler) listDeploymentRevisionsWithNS(c *gin.Context, ns string) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
 	deploymentName := c.Param("name")
-	if deploymentName == "" { c.JSON(400, model.Response{Code: 400, Message: "缺少 deployment name"}); return }
+	if deploymentName == "" {
+		c.JSON(400, model.Response{Code: 400, Message: "缺少 deployment name"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	items, err := client.ListReplicaSetsRaw(ns)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "K8s API error: " + err.Error()})
+		return
+	}
 	type Revision struct {
 		Revision   string `json:"revision"`
 		ReplicaSet string `json:"replica_set"`
@@ -610,11 +833,18 @@ func (h *KubernetesHandler) listDeploymentRevisionsWithNS(c *gin.Context, ns str
 	for _, rs := range items {
 		isOwner := false
 		for _, o := range rs.Metadata.OwnerReferences {
-			if o.Kind == "Deployment" && o.Name == deploymentName { isOwner = true; break }
+			if o.Kind == "Deployment" && o.Name == deploymentName {
+				isOwner = true
+				break
+			}
+		}
+		if !isOwner {
+			continue
 		}
-		if !isOwner { continue }
 		image := ""
-		if len(rs.Spec.Template.Spec.Containers) > 0 { image = rs.Spec.Template.Spec.Containers[0].Image }
+		if len(rs.Spec.Template.Spec.Containers) > 0 {
+			image = rs.Spec.Template.Spec.Containers[0].Image
+		}
 		result = append(result, Revision{
 			Revision:   rs.Metadata.Annotations["deployment.kubernetes.io/revision"],
 			ReplicaSet: rs.Metadata.Name,
@@ -639,28 +869,44 @@ func (h *KubernetesHandler) RollbackDeploymentNS(c *gin.Context) {
 }
 func (h *KubernetesHandler) rollbackDeploymentWithNS(c *gin.Context, ns string) {
 	clusterID, _ := strconv.Atoi(c.Param("id"))
-	if clusterID == 0 { clusterID = h.resolveClusterCode(c.Param("clusterCode")) }
+	if clusterID == 0 {
+		clusterID = h.resolveClusterCode(c.Param("clusterCode"))
+	}
 	deploymentName := c.Param("name")
-	if deploymentName == "" { c.JSON(400, model.Response{Code: 400, Message: "缺少 deployment name"}); return }
+	if deploymentName == "" {
+		c.JSON(400, model.Response{Code: 400, Message: "缺少 deployment name"})
+		return
+	}
 	var req struct {
 		Revision   int    `json:"revision"`
 		ReplicaSet string `json:"replicaSet"`
 	}
 	_ = c.ShouldBindJSON(&req) // 允许空 body（但下面会校验）
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}

 	targetRS := req.ReplicaSet
 	// 通过 revision 定位 ReplicaSet
 	if targetRS == "" && req.Revision > 0 {
 		items, err := client.ListReplicaSetsRaw(ns)
-		if err != nil { c.JSON(500, model.Response{Code: 500, Message: "获取 ReplicaSet 列表失败: " + err.Error()}); return }
+		if err != nil {
+			c.JSON(500, model.Response{Code: 500, Message: "获取 ReplicaSet 列表失败: " + err.Error()})
+			return
+		}
 		for _, rs := range items {
 			isOwner := false
 			for _, o := range rs.Metadata.OwnerReferences {
-				if o.Kind == "Deployment" && o.Name == deploymentName { isOwner = true; break }
+				if o.Kind == "Deployment" && o.Name == deploymentName {
+					isOwner = true
+					break
+				}
+			}
+			if !isOwner {
+				continue
 			}
-			if !isOwner { continue }
 			if rs.Metadata.Annotations["deployment.kubernetes.io/revision"] == strconv.Itoa(req.Revision) {
 				targetRS = rs.Metadata.Name
 				break
@@ -671,18 +917,31 @@ func (h *KubernetesHandler) rollbackDeploymentWithNS(c *gin.Context, ns string)
 			return
 		}
 	}
-	if targetRS == "" { c.JSON(400, model.Response{Code: 400, Message: "需要 revision 或 replicaSet 参数"}); return }
+	if targetRS == "" {
+		c.JSON(400, model.Response{Code: 400, Message: "需要 revision 或 replicaSet 参数"})
+		return
+	}

 	// 取 ReplicaSet 的 template，patch 到 Deployment.spec.template 实现回滚
 	rsJSON, err := client.GetReplicaSet(ns, targetRS)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "获取 ReplicaSet 失败: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "获取 ReplicaSet 失败: " + err.Error()})
+		return
+	}
 	specMap, ok := rsJSON["spec"].(map[string]interface{})
-	if !ok { c.JSON(500, model.Response{Code: 500, Message: "ReplicaSet 缺少 spec"}); return }
+	if !ok {
+		c.JSON(500, model.Response{Code: 500, Message: "ReplicaSet 缺少 spec"})
+		return
+	}
 	template, ok := specMap["template"].(map[string]interface{})
-	if !ok { c.JSON(500, model.Response{Code: 500, Message: "ReplicaSet 缺少 template"}); return }
+	if !ok {
+		c.JSON(500, model.Response{Code: 500, Message: "ReplicaSet 缺少 template"})
+		return
+	}

 	if err := client.PatchDeploymentSpecTemplate(ns, deploymentName, template); err != nil {
-		c.JSON(500, model.Response{Code: 500, Message: "回滚失败: " + err.Error()}); return
+		c.JSON(500, model.Response{Code: 500, Message: "回滚失败: " + err.Error()})
+		return
 	}
 	c.JSON(200, model.Response{
 		Code:    200,
@@ -12,9 +12,15 @@ import (

 func (h *KubernetesHandler) GetResourceYAMLNS(c *gin.Context) {
 	clusterID := h.resolveClusterCode(c.Param("clusterCode"))
-	if clusterID == 0 { c.JSON(500, model.Response{Code: 500, Message: "cluster not found"}); return }
+	if clusterID == 0 {
+		c.JSON(500, model.Response{Code: 500, Message: "cluster not found"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	ns := c.Param("namespace")
 	resource := c.Param("resource")
 	// Fallback: specific routes (statefulsets/:name/yaml, daemonsets/:name/yaml) have no :resource param
@@ -62,10 +68,14 @@ func (h *KubernetesHandler) GetResourceYAMLNS(c *gin.Context) {
 	case "rolebindings", "rolebinding":
 		apiPath = fmt.Sprintf("/apis/rbac.authorization.k8s.io/v1/namespaces/%s/rolebindings/%s", ns, name)
 	default:
-		c.JSON(400, model.Response{Code: 400, Message: "unsupported resource type: " + resource}); return
+		c.JSON(400, model.Response{Code: 400, Message: "unsupported resource type: " + resource})
+		return
 	}
 	yamlBytes, err := client.GetResourceYAML(apiPath)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "获取YAML失败: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "获取YAML失败: " + err.Error()})
+		return
+	}
 	c.Header("Content-Type", "application/yaml")
 	c.String(200, string(yamlBytes))
 }
@@ -73,9 +83,15 @@ func (h *KubernetesHandler) GetResourceYAMLNS(c *gin.Context) {
 // UpdateResourceYAMLNS applies YAML to update a K8s resource
 func (h *KubernetesHandler) UpdateResourceYAMLNS(c *gin.Context) {
 	clusterID := h.resolveClusterCode(c.Param("clusterCode"))
-	if clusterID == 0 { c.JSON(500, model.Response{Code: 500, Message: "cluster not found"}); return }
+	if clusterID == 0 {
+		c.JSON(500, model.Response{Code: 500, Message: "cluster not found"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	ns := c.Param("namespace")
 	resource := c.Param("resource")
 	// Fallback: specific routes (statefulsets/:name/yaml, daemonsets/:name/yaml) have no :resource param
@@ -90,7 +106,10 @@ func (h *KubernetesHandler) UpdateResourceYAMLNS(c *gin.Context) {
 	}
 	name := c.Param("name")
 	yamlData, err := io.ReadAll(c.Request.Body)
-	if err != nil { c.JSON(400, model.Response{Code: 400, Message: "读取body失败"}); return }
+	if err != nil {
+		c.JSON(400, model.Response{Code: 400, Message: "读取body失败"})
+		return
+	}
 	var apiPath string
 	switch resource {
 	case "deployments", "deployment":
@@ -124,10 +143,12 @@ func (h *KubernetesHandler) UpdateResourceYAMLNS(c *gin.Context) {
 	case "rolebindings", "rolebinding":
 		apiPath = fmt.Sprintf("/apis/rbac.authorization.k8s.io/v1/namespaces/%s/rolebindings/%s", ns, name)
 	default:
-		c.JSON(400, model.Response{Code: 400, Message: "unsupported resource type: " + resource}); return
+		c.JSON(400, model.Response{Code: 400, Message: "unsupported resource type: " + resource})
+		return
 	}
 	if err := client.UpdateResourceYAML(apiPath, yamlData); err != nil {
-		c.JSON(500, model.Response{Code: 500, Message: "更新失败: " + err.Error()}); return
+		c.JSON(500, model.Response{Code: 500, Message: "更新失败: " + err.Error()})
+		return
 	}
 	c.JSON(200, model.Response{Code: 200, Message: "YAML已应用"})
 }
@@ -173,16 +194,26 @@ func resourceAPIPath(ns, resource, name string) (string, error) {
 // DeleteResourceYAMLNS deletes a K8s resource (Service/Ingress/ConfigMap etc.)
 func (h *KubernetesHandler) DeleteResourceYAMLNS(c *gin.Context) {
 	clusterID := h.resolveClusterCode(c.Param("clusterCode"))
-	if clusterID == 0 { c.JSON(500, model.Response{Code: 500, Message: "cluster not found"}); return }
+	if clusterID == 0 {
+		c.JSON(500, model.Response{Code: 500, Message: "cluster not found"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}
 	ns := c.Param("namespace")
 	resource := c.Param("resource")
 	name := c.Param("name")
 	apiPath, err := resourceAPIPath(ns, resource, name)
-	if err != nil { c.JSON(400, model.Response{Code: 400, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(400, model.Response{Code: 400, Message: err.Error()})
+		return
+	}
 	if err := client.DeleteResource(apiPath); err != nil {
-		c.JSON(500, model.Response{Code: 500, Message: "删除失败: " + err.Error()}); return
+		c.JSON(500, model.Response{Code: 500, Message: "删除失败: " + err.Error()})
+		return
 	}
 	c.JSON(200, model.Response{Code: 200, Message: "资源已删除"})
 }
@@ -190,18 +221,33 @@ func (h *KubernetesHandler) DeleteResourceYAMLNS(c *gin.Context) {
 // getK8sClient builds a K8s API client from cluster's stored kubeconfig
 func (h *KubernetesHandler) ApplyYAML(c *gin.Context) {
 	clusterID := h.resolveClusterCode(c.Param("clusterCode"))
-	if clusterID == 0 { c.JSON(500, model.Response{Code: 500, Message: "cluster not found"}); return }
+	if clusterID == 0 {
+		c.JSON(500, model.Response{Code: 500, Message: "cluster not found"})
+		return
+	}
 	client, _, err := h.getK8sClient(clusterID)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: err.Error()})
+		return
+	}

 	var req struct {
 		YAML string `json:"yaml"`
 	}
-	if err := c.ShouldBindJSON(&req); err != nil { c.JSON(400, model.Response{Code: 400, Message: "参数错误: " + err.Error()}); return }
-	if req.YAML == "" { c.JSON(400, model.Response{Code: 400, Message: "YAML 内容不能为空"}); return }
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(400, model.Response{Code: 400, Message: "参数错误: " + err.Error()})
+		return
+	}
+	if req.YAML == "" {
+		c.JSON(400, model.Response{Code: 400, Message: "YAML 内容不能为空"})
+		return
+	}

 	result, err := client.ApplyYAML(req.YAML)
-	if err != nil { c.JSON(500, model.Response{Code: 500, Message: "Apply 失败: " + err.Error()}); return }
+	if err != nil {
+		c.JSON(500, model.Response{Code: 500, Message: "Apply 失败: " + err.Error()})
+		return
+	}

 	c.JSON(200, model.Response{Code: 200, Message: "资源已应用", Data: result})
 }
@@ -151,4 +151,4 @@ func ldapAddADUser(conn *ldap.Conn, userDN, username, displayName, email, passwo
 	modEnable := ldap.NewModifyRequest(userDN, nil)
 	modEnable.Replace("userAccountControl", []string{"512"})
 	return conn.Modify(modEnable)
-}
+}
@@ -34,20 +34,10 @@ func maskAPIKey(key string) string {
 	return strings.Repeat("*", len(key)-4) + key[len(key)-4:]
 }

-// canReuseMaskedAPIKey 仅允许原提供商与原 Endpoint 继续使用数据库中的密钥。 // Logan.Li
-func canReuseMaskedAPIKey(provider, endpoint string, saved model.LLMConfig) bool {
-	if saved.ID == 0 || saved.Provider != provider {
-		return false
-	}
-	requestedEndpoint := resolveEndpoint(provider, strings.TrimSpace(endpoint))
-	savedEndpoint := resolveEndpoint(saved.Provider, strings.TrimSpace(saved.Endpoint))
-	return requestedEndpoint != "" && requestedEndpoint == savedEndpoint
-}
-
 // getActiveConfig 读取启用的配置（脱敏后） // Logan.Li
 func (h *LLMHandler) getActiveConfig(maskKey bool) (model.LLMConfig, error) {
 	var cfg model.LLMConfig
-	if err := h.db.Take(&cfg).Error; err != nil {
+	if err := h.db.First(&cfg).Error; err != nil {
 		return cfg, err
 	}
 	if maskKey {
@@ -93,13 +83,9 @@ func (h *LLMHandler) SaveLLMConfig(c *gin.Context) {
 		return
 	}
 	var cfg model.LLMConfig
-	h.db.Take(&cfg)
-	// 脱敏密钥只能在提供商和 Endpoint 均未改变时复用，避免凭证被转发到其他地址。 // Logan.Li
-	if strings.Contains(req.APIKey, "****") {
-		if !canReuseMaskedAPIKey(req.Provider, req.Endpoint, cfg) {
-			c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "提供商或 Endpoint 已变化，请重新填写 API Key"})
-			return
-		}
+	h.db.First(&cfg)
+	// 若前端回传脱敏值（含 ****），保留原 Key
+	if strings.Contains(req.APIKey, "****") && cfg.ID != 0 {
 		req.APIKey = cfg.APIKey
 	}
 	cfg.Provider = req.Provider
@@ -151,18 +137,12 @@ func resolveEndpoint(provider, endpoint string) string {
 		return "https://open.bigmodel.cn/api/paas/v4"
 	case "qwen":
 		return "https://dashscope.aliyuncs.com/compatible-mode/v1"
-	case "hunyuan": // 腾讯混元 OpenAI 兼容端点 // Logan.Li
-		return "https://tokenhub.tencentmaas.com/v1"
-	case "volcengine": // 火山引擎方舟 OpenAI 兼容端点 // Logan.Li
-		return "https://ark.cn-beijing.volces.com/api/v3"
-	case "baidu": // 百度千帆 v2 OpenAI 兼容端点 // Logan.Li
-		return "https://qianfan.baidubce.com/v2"
 	case "moonshot":
 		return "https://api.moonshot.cn/v1"
 	case "kimi": // Kimi 编码套餐 OpenAI 兼容端点（注意：该端点有客户端白名单，通用调用可能被拒） // Logan.Li
 		return "https://api.kimi.com/coding/v1"
 	case "mimo": // 小米 MiMo OpenAI 兼容端点 // Logan.Li
-		return "https://api.xiaomimimo.com/v1"
+		return "https://api.mimo.mi.com/v1"
 	case "anthropic": // Anthropic 官方 Messages 协议（anthropic.go 客户端拼 /v1/messages） // Logan.Li
 		return "https://api.anthropic.com"
 	case "glm-coding": // 智谱 GLM 编码套餐 Anthropic 协议端点（模型 GLM-5.2） // Logan.Li
@@ -173,43 +153,20 @@ func resolveEndpoint(provider, endpoint string) string {
 		return "https://api.minimaxi.com/anthropic"
 	case "openai": // OpenAI 官方端点 // Logan.Li
 		return "https://api.openai.com/v1"
-	case "google": // Gemini OpenAI 兼容端点 // Logan.Li
-		return "https://generativelanguage.googleapis.com/v1beta/openai"
-	case "xai": // xAI OpenAI 兼容端点 // Logan.Li
-		return "https://api.x.ai/v1"
-	case "mistral": // Mistral OpenAI 兼容端点 // Logan.Li
-		return "https://api.mistral.ai/v1"
-	case "groq": // Groq OpenAI 兼容端点 // Logan.Li
-		return "https://api.groq.com/openai/v1"
-	case "openrouter": // OpenRouter OpenAI 兼容端点 // Logan.Li
-		return "https://openrouter.ai/api/v1"
-	case "together": // Together AI OpenAI 兼容端点 // Logan.Li
-		return "https://api.together.ai/v1"
-	case "cerebras": // Cerebras OpenAI 兼容端点 // Logan.Li
-		return "https://api.cerebras.ai/v1"
 	case "siliconflow": // 硅基流动 OpenAI 兼容端点 // Logan.Li
 		return "https://api.siliconflow.cn/v1"
 	case "ollama":
 		return "http://localhost:11434/v1"
 	case "vllm": // vLLM OpenAI 兼容端点 // Logan.Li
 		return "http://localhost:8000/v1"
-	case "lmstudio": // LM Studio OpenAI 兼容端点 // Logan.Li
-		return "http://localhost:1234/v1"
-	case "new-api", "custom": // 网关地址必须由用户明确填写 // Logan.Li
-		return ""
-	default: // 未知的历史供应商保持 OpenAI 默认兼容 // Logan.Li
+	default: // openai / custom
 		return "https://api.openai.com/v1"
 	}
 }

 // isLocalLLMProvider 本地/自建模型，API Key 可选 // Logan.Li
 func isLocalLLMProvider(provider string) bool {
-	return provider == "ollama" || provider == "vllm" || provider == "lmstudio" || provider == "custom"
-}
-
-// requiresExplicitEndpoint 判断是否必须手动填写网关地址。 // Logan.Li
-func requiresExplicitEndpoint(provider string) bool {
-	return provider == "new-api" || provider == "custom"
+	return provider == "ollama" || provider == "vllm" || provider == "custom"
 }

 // resolveProtocol 根据提供商推断接入协议（决定走 OpenAI 还是 Anthropic 客户端） // Logan.Li
@@ -195,11 +195,10 @@ func (h *LLMHandler) llmConfigFromTestRequest(req model.SaveLLMConfigRequest) (m
 	}
 	if strings.Contains(req.APIKey, "****") {
 		var saved model.LLMConfig
-		if err := h.db.Take(&saved).Error; err != nil || !canReuseMaskedAPIKey(req.Provider, req.Endpoint, saved) {
+		if err := h.db.First(&saved).Error; err != nil {
 			if !isLocalLLMProvider(req.Provider) {
-				return cfg, "提供商或 Endpoint 已变化，请重新填写 API Key"
+				return cfg, "请填写 API Key"
 			}
-			cfg.APIKey = ""
 		} else {
 			cfg.APIKey = saved.APIKey
 		}
@@ -210,9 +209,6 @@ func (h *LLMHandler) llmConfigFromTestRequest(req model.SaveLLMConfigRequest) (m
 	if cfg.Model == "" {
 		return cfg, "请填写模型名"
 	}
-	if requiresExplicitEndpoint(cfg.Provider) && strings.TrimSpace(cfg.Endpoint) == "" {
-		return cfg, "请填写 Endpoint"
-	}
 	if cfg.APIKey == "" && !isLocalLLMProvider(cfg.Provider) {
 		return cfg, "请填写 API Key"
 	}
@@ -230,7 +226,7 @@ func (h *LLMHandler) TestLLMConnection(c *gin.Context) {
 	if req.Provider != "" {
 		cfg, errMsg = h.llmConfigFromTestRequest(req)
 	} else {
-		if err := h.db.Take(&cfg).Error; err != nil {
+		if err := h.db.First(&cfg).Error; err != nil {
 			c.JSON(http.StatusOK, model.Response{Code: 400, Message: "请先填写配置并测试连接"})
 			return
 		}
@@ -23,4 +23,4 @@ func buildLLMConfigFromModel(cfg model.LLMConfig) llm.Config {
 // buildLLMClientFromConfig 从 model.LLMConfig 构造 LLM 客户端（OpenAI/Anthropic 自动路由） // Logan.Li
 func buildLLMClientFromConfig(cfg model.LLMConfig) llm.Client {
 	return llm.NewClient(buildLLMConfigFromModel(cfg))
-}
+}
@@ -1,181 +0,0 @@
-package controller
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"net/url"
-	"sort"
-	"strings"
-	"time"
-
-	"ezops/model"
-
-	"github.com/gin-gonic/gin"
-)
-
-const maxLLMModelListBytes = 2 << 20
-
-type llmModelListItem struct {
-	ID    string `json:"id"`
-	Name  string `json:"name"`
-	Model string `json:"model"`
-}
-
-// resolveModelListCredential 解析草稿配置，并在前端回传脱敏值时复用已保存密钥。 // Logan.Li
-func (h *LLMHandler) resolveModelListCredential(req model.SaveLLMConfigRequest) (string, string, string) {
-	provider := strings.TrimSpace(req.Provider)
-	if provider == "" {
-		return "", "", "请选择提供商"
-	}
-	endpoint := resolveEndpoint(provider, strings.TrimSpace(req.Endpoint))
-	if endpoint == "" {
-		return "", "", "请填写 Endpoint"
-	}
-	apiKey := strings.TrimSpace(req.APIKey)
-	if strings.Contains(apiKey, "****") {
-		var saved model.LLMConfig
-		if err := h.db.Take(&saved).Error; err != nil || !canReuseMaskedAPIKey(provider, req.Endpoint, saved) {
-			return "", "", "提供商或 Endpoint 已变化，请重新填写 API Key"
-		}
-		apiKey = saved.APIKey
-	}
-	if apiKey == "" && !isLocalLLMProvider(provider) {
-		return "", "", "请填写 API Key"
-	}
-	return endpoint, apiKey, ""
-}
-
-// buildLLMModelListURL 将基础地址转换为兼容协议的模型列表地址。 // Logan.Li
-func buildLLMModelListURL(provider, endpoint string) (string, error) {
-	base := strings.TrimRight(strings.TrimSpace(endpoint), "/")
-	if resolveProtocol(provider) == "anthropic" && !strings.HasSuffix(base, "/v1") {
-		base += "/v1"
-	}
-	parsed, err := url.Parse(base + "/models")
-	if err != nil || parsed.Host == "" || (parsed.Scheme != "http" && parsed.Scheme != "https") {
-		return "", fmt.Errorf("Endpoint 必须是有效的 HTTP 或 HTTPS 地址")
-	}
-	return parsed.String(), nil
-}
-
-// decodeLLMModelItems 兼容 OpenAI/New API 的 data 数组及部分本地服务的 models 数组。 // Logan.Li
-func decodeLLMModelItems(raw json.RawMessage) []string {
-	var items []llmModelListItem
-	if err := json.Unmarshal(raw, &items); err == nil {
-		models := make([]string, 0, len(items))
-		for _, item := range items {
-			name := strings.TrimSpace(item.ID)
-			if name == "" {
-				name = strings.TrimSpace(item.Name)
-			}
-			if name == "" {
-				name = strings.TrimSpace(item.Model)
-			}
-			if name != "" {
-				models = append(models, name)
-			}
-		}
-		return models
-	}
-	var names []string
-	_ = json.Unmarshal(raw, &names)
-	return names
-}
-
-// parseLLMModelList 提取、去重并排序上游返回的模型 ID。 // Logan.Li
-func parseLLMModelList(raw []byte) ([]string, error) {
-	var payload map[string]json.RawMessage
-	if err := json.Unmarshal(raw, &payload); err != nil {
-		return nil, fmt.Errorf("解析模型列表失败: %w", err)
-	}
-	models := decodeLLMModelItems(payload["data"])
-	models = append(models, decodeLLMModelItems(payload["models"])...)
-	unique := make(map[string]struct{}, len(models))
-	result := make([]string, 0, len(models))
-	for _, item := range models {
-		name := strings.TrimSpace(item)
-		if name == "" {
-			continue
-		}
-		if _, exists := unique[name]; exists {
-			continue
-		}
-		unique[name] = struct{}{}
-		result = append(result, name)
-	}
-	sort.Strings(result)
-	return result, nil
-}
-
-// requestLLMModelList 请求上游模型目录，禁止跨域重定向以免凭证被转发。 // Logan.Li
-func requestLLMModelList(ctx context.Context, provider, endpoint, apiKey string) ([]string, error) {
-	requestURL, err := buildLLMModelListURL(provider, endpoint)
-	if err != nil {
-		return nil, err
-	}
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, requestURL, nil)
-	if err != nil {
-		return nil, fmt.Errorf("构造模型列表请求失败: %w", err)
-	}
-	req.Header.Set("Accept", "application/json")
-	if apiKey != "" {
-		req.Header.Set("Authorization", "Bearer "+apiKey)
-	}
-	if resolveProtocol(provider) == "anthropic" {
-		req.Header.Set("x-api-key", apiKey)
-		req.Header.Set("anthropic-version", "2023-06-01")
-	}
-	client := &http.Client{
-		Timeout: 20 * time.Second,
-		CheckRedirect: func(_ *http.Request, _ []*http.Request) error {
-			return http.ErrUseLastResponse
-		},
-	}
-	resp, err := client.Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("读取模型列表失败: %w", err)
-	}
-	defer resp.Body.Close()
-	raw, err := io.ReadAll(io.LimitReader(resp.Body, maxLLMModelListBytes+1))
-	if err != nil {
-		return nil, fmt.Errorf("读取模型列表响应失败: %w", err)
-	}
-	if len(raw) > maxLLMModelListBytes {
-		return nil, fmt.Errorf("模型列表响应超过 2 MiB 限制")
-	}
-	if resp.StatusCode < http.StatusOK || resp.StatusCode >= http.StatusMultipleChoices {
-		message := []rune(strings.TrimSpace(string(raw)))
-		if len(message) > 1000 {
-			message = message[:1000]
-		}
-		return nil, fmt.Errorf("模型服务返回 HTTP %d: %s", resp.StatusCode, string(message))
-	}
-	return parseLLMModelList(raw)
-}
-
-// ListLLMModels 从当前草稿 Endpoint 读取可用模型，便于 New API/One API 和本地服务配置。 // Logan.Li
-// POST /api/v1/aiops/llm-config/models // Logan.Li
-func (h *LLMHandler) ListLLMModels(c *gin.Context) {
-	var req model.SaveLLMConfigRequest
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "请求参数错误: " + err.Error()})
-		return
-	}
-	endpoint, apiKey, errMsg := h.resolveModelListCredential(req)
-	if errMsg != "" {
-		c.JSON(http.StatusOK, model.Response{Code: 400, Message: errMsg})
-		return
-	}
-	models, err := requestLLMModelList(c.Request.Context(), req.Provider, endpoint, apiKey)
-	if err != nil {
-		c.JSON(http.StatusOK, model.Response{Code: 502, Message: err.Error()})
-		return
-	}
-	c.JSON(http.StatusOK, model.Response{Code: 200, Data: gin.H{
-		"models": models,
-		"total":  len(models),
-	}})
-}
@@ -1,96 +0,0 @@
-package controller
-
-import (
-	"context"
-	"net/http"
-	"net/http/httptest"
-	"reflect"
-	"testing"
-
-	"ezops/model"
-
-	"github.com/glebarez/sqlite"
-	"gorm.io/gorm"
-)
-
-func TestParseLLMModelList(t *testing.T) {
-	raw := []byte(`{"data":[{"id":"model-b"},{"id":"model-a"},{"id":"model-b"}],"models":[{"name":"model-c"}]}`)
-	got, err := parseLLMModelList(raw)
-	if err != nil {
-		t.Fatalf("parseLLMModelList() error = %v", err)
-	}
-	want := []string{"model-a", "model-b", "model-c"}
-	if !reflect.DeepEqual(got, want) {
-		t.Fatalf("parseLLMModelList() = %#v, want %#v", got, want)
-	}
-}
-
-func TestRequestLLMModelListForOpenAICompatibleGateway(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != "/v1/models" {
-			t.Errorf("request path = %q, want /v1/models", r.URL.Path)
-		}
-		if got := r.Header.Get("Authorization"); got != "Bearer test-key" {
-			t.Errorf("Authorization = %q", got)
-		}
-		w.Header().Set("Content-Type", "application/json")
-		_, _ = w.Write([]byte(`{"data":[{"id":"gpt-test"}]}`))
-	}))
-	defer server.Close()
-
-	models, err := requestLLMModelList(context.Background(), "new-api", server.URL+"/v1", "test-key")
-	if err != nil {
-		t.Fatalf("requestLLMModelList() error = %v", err)
-	}
-	if !reflect.DeepEqual(models, []string{"gpt-test"}) {
-		t.Fatalf("requestLLMModelList() = %#v", models)
-	}
-}
-
-func TestRequestLLMModelListForAnthropic(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != "/v1/models" {
-			t.Errorf("request path = %q, want /v1/models", r.URL.Path)
-		}
-		if got := r.Header.Get("x-api-key"); got != "anthropic-key" {
-			t.Errorf("x-api-key = %q", got)
-		}
-		if got := r.Header.Get("anthropic-version"); got != "2023-06-01" {
-			t.Errorf("anthropic-version = %q", got)
-		}
-		w.Header().Set("Content-Type", "application/json")
-		_, _ = w.Write([]byte(`{"data":[{"id":"claude-test"}]}`))
-	}))
-	defer server.Close()
-
-	models, err := requestLLMModelList(context.Background(), "anthropic", server.URL, "anthropic-key")
-	if err != nil {
-		t.Fatalf("requestLLMModelList() error = %v", err)
-	}
-	if !reflect.DeepEqual(models, []string{"claude-test"}) {
-		t.Fatalf("requestLLMModelList() = %#v", models)
-	}
-}
-
-func TestResolveModelListCredentialDoesNotReuseKeyAcrossProviders(t *testing.T) {
-	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
-	if err != nil {
-		t.Fatalf("open database: %v", err)
-	}
-	if err := db.AutoMigrate(&model.LLMConfig{}); err != nil {
-		t.Fatalf("migrate database: %v", err)
-	}
-	if err := db.Create(&model.LLMConfig{Provider: "deepseek", APIKey: "deepseek-secret"}).Error; err != nil {
-		t.Fatalf("create config: %v", err)
-	}
-
-	handler := NewLLMHandler(db)
-	_, _, errMsg := handler.resolveModelListCredential(model.SaveLLMConfigRequest{
-		Provider: "new-api",
-		Endpoint: "https://new-api.example.com/v1",
-		APIKey:   "****cret",
-	})
-	if errMsg != "提供商或 Endpoint 已变化，请重新填写 API Key" {
-		t.Fatalf("provider mismatch error = %q", errMsg)
-	}
-}
@@ -1,70 +0,0 @@
-package controller
-
-import (
-	"testing"
-
-	"ezops/model"
-)
-
-func TestResolveEndpoint(t *testing.T) {
-	tests := []struct {
-		provider string
-		endpoint string
-		want     string
-	}{
-		{provider: "google", want: "https://generativelanguage.googleapis.com/v1beta/openai"},
-		{provider: "openrouter", want: "https://openrouter.ai/api/v1"},
-		{provider: "hunyuan", want: "https://tokenhub.tencentmaas.com/v1"},
-		{provider: "mimo", want: "https://api.xiaomimimo.com/v1"},
-		{provider: "together", want: "https://api.together.ai/v1"},
-		{provider: "lmstudio", want: "http://localhost:1234/v1"},
-		{provider: "new-api", want: ""},
-		{provider: "new-api", endpoint: "https://llm.example.com/v1/", want: "https://llm.example.com/v1"},
-	}
-
-	for _, test := range tests {
-		t.Run(test.provider+test.endpoint, func(t *testing.T) {
-			if got := resolveEndpoint(test.provider, test.endpoint); got != test.want {
-				t.Fatalf("resolveEndpoint() = %q, want %q", got, test.want)
-			}
-		})
-	}
-}
-
-func TestResolveProtocol(t *testing.T) {
-	for _, provider := range []string{"anthropic", "glm-coding", "minimax-coding"} {
-		if got := resolveProtocol(provider); got != "anthropic" {
-			t.Fatalf("resolveProtocol(%q) = %q, want anthropic", provider, got)
-		}
-	}
-	for _, provider := range []string{"openai", "google", "openrouter", "new-api"} {
-		if got := resolveProtocol(provider); got != "openai" {
-			t.Fatalf("resolveProtocol(%q) = %q, want openai", provider, got)
-		}
-	}
-}
-
-func TestProviderRequirements(t *testing.T) {
-	if !isLocalLLMProvider("lmstudio") {
-		t.Fatal("LM Studio should allow an empty API key")
-	}
-	if isLocalLLMProvider("new-api") {
-		t.Fatal("New API should require an API key")
-	}
-	if !requiresExplicitEndpoint("new-api") || !requiresExplicitEndpoint("custom") {
-		t.Fatal("API gateway providers should require an explicit endpoint")
-	}
-}
-
-func TestCanReuseMaskedAPIKey(t *testing.T) {
-	saved := model.LLMConfig{ID: 1, Provider: "openai", Endpoint: "https://api.openai.com/v1"}
-	if !canReuseMaskedAPIKey("openai", "https://api.openai.com/v1/", saved) {
-		t.Fatal("same provider and endpoint should reuse the saved key")
-	}
-	if canReuseMaskedAPIKey("openai", "https://gateway.example.com/v1", saved) {
-		t.Fatal("changed endpoint must not reuse the saved key")
-	}
-	if canReuseMaskedAPIKey("new-api", saved.Endpoint, saved) {
-		t.Fatal("changed provider must not reuse the saved key")
-	}
-}
@@ -74,10 +74,10 @@ func (h *LogHandler) CreateSource(c *gin.Context) {
 	configJSON, _ := json.Marshal(req.Config)
 	now := time.Now()
 	item := model.LogSource{
-		Name:   req.Name,
-		Type:   req.Type,
-		Status: "active",
-		Config: string(configJSON),
+		Name:     req.Name,
+		Type:     req.Type,
+		Status:   "active",
+		Config:   string(configJSON),
 		LastSeen: &now,
 	}
 	h.db.Create(&item)
@@ -76,7 +76,7 @@ func (h *LogDSHandler) Create(c *gin.Context) {
 	}
 	ds := model.LogDataSource{
 		Name: req.Name, Type: req.Type, URL: strings.TrimRight(req.URL, "/"),
-		AuthType: normalizeLogDSAuthType(req.AuthType),
+		AuthType:  normalizeLogDSAuthType(req.AuthType),
 		BasicAuth: req.BasicAuth, BasicAuthUser: req.BasicAuthUser, BasicAuthPass: req.BasicAuthPass,
 		Token: req.Token, Headers: req.Headers,
 		SkipTLSVerify: req.SkipTLSVerify, DefaultIndex: req.DefaultIndex,
@@ -439,4 +439,4 @@ func normalizeLogDSAuthType(t string) string {
 	default:
 		return "none"
 	}
-}
+}
@@ -477,4 +477,4 @@ func formatLokiMetricTimestamp(v interface{}) string {
 		}
 	}
 	return formatLokiTimestamp(fmt.Sprintf("%v", v))
-}
+}
@@ -198,4 +198,4 @@ func (h *LogScopeRoleHandler) PreviewLogScope(c *gin.Context) {
 		"matched": matched,
 		"total":   len(matched),
 	}})
-}
+}
@@ -134,15 +134,15 @@ func (h *MetricsHandler) TopHosts(c *gin.Context) {
 	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "5"))

 	type HostRank struct {
-		Hostname string  `json:"hostname"`
-		IP       string  `json:"ip"`
-		CPUUsage float64 `json:"cpu_usage"`
-		MemUsage float64 `json:"memory_usage"`
+		Hostname  string  `json:"hostname"`
+		IP        string  `json:"ip"`
+		CPUUsage  float64 `json:"cpu_usage"`
+		MemUsage  float64 `json:"memory_usage"`
 		DiskUsage float64 `json:"disk_usage"`
-		CPUCores int    `json:"cpu_cores"`
-		MemMB    int64  `json:"memory_mb"`
-		DiskGB   int64  `json:"disk_gb"`
-		Status   string `json:"status"`
+		CPUCores  int     `json:"cpu_cores"`
+		MemMB     int64   `json:"memory_mb"`
+		DiskGB    int64   `json:"disk_gb"`
+		Status    string  `json:"status"`
 	}

 	var servers []model.Server
@@ -166,15 +166,15 @@ func (h *MetricsHandler) TopHosts(c *gin.Context) {
 	result := make([]HostRank, len(servers))
 	for i, s := range servers {
 		result[i] = HostRank{
-			Hostname: s.Hostname,
-			IP:       s.IP,
-			CPUUsage: s.CPUUsage,
-			MemUsage: s.MemoryUsage,
+			Hostname:  s.Hostname,
+			IP:        s.IP,
+			CPUUsage:  s.CPUUsage,
+			MemUsage:  s.MemoryUsage,
 			DiskUsage: s.DiskUsage,
-			CPUCores: s.CPU,
-			MemMB:    s.Memory,
-			DiskGB:   s.Disk,
-			Status:   s.Status,
+			CPUCores:  s.CPU,
+			MemMB:     s.Memory,
+			DiskGB:    s.Disk,
+			Status:    s.Status,
 		}
 	}
 	if result == nil {
@@ -14,7 +14,7 @@ import (

 // MetricsUpdate 单个主机的指标更新 // Logan.Li
 type MetricsUpdate struct {
-	Type           string  `json:"type"`    // "metrics_update"
+	Type           string  `json:"type"` // "metrics_update"
 	Hostname       string  `json:"hostname"`
 	CPU            float64 `json:"cpu_usage"`
 	Memory         float64 `json:"memory_usage"`
@@ -15,8 +15,8 @@ import (
 	"ezops/model"
 	"ezops/pkg/systask"

-	_ "github.com/go-sql-driver/mysql"
 	"github.com/gin-gonic/gin"
+	_ "github.com/go-sql-driver/mysql"
 	"gorm.io/gorm"
 )

@@ -28,8 +28,8 @@ import (
 // MiddlewareConfig 存储在 MonitorTarget.Config JSON 字段中
 type MiddlewareConfig struct {
 	Password  string `json:"password,omitempty"`
-	Username  string `json:"username,omitempty"`  // MySQL 专用
-	Database  string `json:"database,omitempty"`  // MySQL 专用
+	Username  string `json:"username,omitempty"`   // MySQL 专用
+	Database  string `json:"database,omitempty"`   // MySQL 专用
 	RedisMode string `json:"redis_mode,omitempty"` // Redis: standalone / cluster
 }

@@ -98,4 +98,4 @@ func buildRedisMetrics(info string, dbSize int64, clusterInfo, mode string) map[
 	}

 	return result
-}
+}
@@ -14,12 +14,12 @@ import (

 // middlewareSeedResult 种子创建结果 // Logan.Li
 type middlewareSeedResult struct {
-	Created  int      `json:"created"`
-	Skipped  []string `json:"skipped"`
-	Failed   []string `json:"failed"`
-	Total    int64    `json:"total"`
-	Message  string   `json:"message"`
-	Success  bool     `json:"success"`
+	Created int      `json:"created"`
+	Skipped []string `json:"skipped"`
+	Failed  []string `json:"failed"`
+	Total   int64    `json:"total"`
+	Message string   `json:"message"`
+	Success bool     `json:"success"`
 }

 // SeedDefaultMiddlewareTargets 首次启动时创建平台默认 Redis/MySQL 监控目标 // Logan.Li
@@ -117,4 +117,4 @@ func seedDefaultMiddlewareTargets(db *gorm.DB) middlewareSeedResult {
 		result.Message = "未创建任何默认目标"
 	}
 	return result
-}
+}
@@ -282,4 +282,4 @@ func (h *AlertHandler) ResolveUnifiedAlert(c *gin.Context) {
 		return
 	}
 	c.JSON(http.StatusOK, model.Response{Code: 200, Message: "已恢复"})
-}
+}
@@ -6,8 +6,9 @@ import (
 	"strconv"
 	"time"

-	"ezops/model"
 	"ezops/middleware"
+	"ezops/model"
+	"ezops/pkg/crypto"
 	ezredis "ezops/pkg/redis"
 	"ezops/pkg/toolinstaller"

@@ -57,11 +58,12 @@ type PipelineHandler struct {
 	db            *gorm.DB
 	cache         ezredis.Cache
 	toolInstaller *toolinstaller.ToolInstaller
+	crypt         *crypto.SecretBox
 }

 // NewPipelineHandler 创建流水线处理器
-func NewPipelineHandler(db *gorm.DB, cache ezredis.Cache, ti *toolinstaller.ToolInstaller) *PipelineHandler {
-	h := &PipelineHandler{db: db, cache: cache, toolInstaller: ti}
+func NewPipelineHandler(db *gorm.DB, cache ezredis.Cache, ti *toolinstaller.ToolInstaller, masterKey string) *PipelineHandler {
+	h := &PipelineHandler{db: db, cache: cache, toolInstaller: ti, crypt: crypto.NewSecretBox(masterKey)}
 	h.ensureBuildMasterConfig()
 	return h
 }
@@ -69,7 +71,7 @@ func NewPipelineHandler(db *gorm.DB, cache ezredis.Cache, ti *toolinstaller.Tool
 // PipelineListItem 列表项（含最近一次运行摘要）// Logan.Li
 type PipelineListItem struct {
 	model.Pipeline
-	LastRunStages   string `json:"last_run_stages,omitempty"`   // JSON: [{name,status}]
+	LastRunStages   string `json:"last_run_stages,omitempty"` // JSON: [{name,status}]
 	LastImageTag    string `json:"last_image_tag,omitempty"`
 	LastCommitID    string `json:"last_commit_id,omitempty"`
 	LastRunDuration int    `json:"last_duration,omitempty"`
@@ -112,7 +114,11 @@ func (h *PipelineHandler) ListPipelines(c *gin.Context) {
 	db.Count(&total)

 	var pipelines []model.Pipeline
-	db.Preload("Environment").Offset(query.GetOffset()).Limit(query.GetLimit()).Order("updated_at DESC").Find(&pipelines)
+	db.Preload("Environment").
+		Offset(query.GetOffset()).
+		Limit(query.GetLimit()).
+		Order("CASE WHEN last_run_at IS NULL THEN 1 ELSE 0 END ASC, last_run_at DESC, updated_at DESC").
+		Find(&pipelines)

 	// 批量获取每个流水线最近一次运行的摘要（阶段状态 + 镜像 + 耗时）// Logan.Li
 	items := make([]PipelineListItem, len(pipelines))
@@ -123,7 +129,7 @@ func (h *PipelineHandler) ListPipelines(c *gin.Context) {
 		}
 		// 子查询：每个 pipeline_id 的最新 run id
 		var latestRuns []model.PipelineRun
-		h.db.Where("id IN (SELECT MAX(id) FROM ops_pipeline_runs WHERE pipeline_id IN ? AND status IN ('success','failed','running','pending') GROUP BY pipeline_id)", pids).
+		h.db.Where("id IN (SELECT MAX(id) FROM deploy_pipeline_runs WHERE pipeline_id IN ? AND status IN ('success','failed','running','pending') GROUP BY pipeline_id)", pids).
 			Find(&latestRuns)
 		runMap := map[uint]*model.PipelineRun{}
 		for i := range latestRuns {
@@ -147,8 +153,8 @@ func (h *PipelineHandler) ListPipelines(c *gin.Context) {
 	}

 	c.JSON(http.StatusOK, model.Response{
-		Code:    200,
-		Data:    model.ListResponse{List: items, Total: total},
+		Code: 200,
+		Data: model.ListResponse{List: items, Total: total},
 	})
 }

@@ -211,30 +217,29 @@ func (h *PipelineHandler) CreatePipeline(c *gin.Context) {
 	}

 	pipeline := model.Pipeline{
-		Name:         req.Name,
-		Code:         req.Code,
-		JobName:      req.JobName,
-		Description:  req.Description,
-		Type:         req.Type,
-		Source:       req.Source,
-		Branch:       req.Branch,
-		Dockerfile:   req.Dockerfile,
-		Stages:       req.Stages,
-		Variables:    req.Variables,
-		DeployMode:   req.DeployMode,
-		DeployTarget: req.DeployTarget,
-		ServerIDs:        req.ServerIDs,
-		DeployRemotePath: req.DeployRemotePath,
-		DeployScript:     req.DeployScript,
-		K8sClusterID:     req.K8sClusterID,
-		K8sNamespace:     req.K8sNamespace,
-		K8sDeployment:    req.K8sDeployment,
-		K8sContainerName: req.K8sContainerName,
-		RepoID:       req.RepoID,
-		RegistryID:   req.RegistryID,
+		Name:                 req.Name,
+		Code:                 req.Code,
+		JobName:              req.JobName,
+		Description:          req.Description,
+		Type:                 req.Type,
+		CIProvider:           normalizeCIProvider(req.CIProvider),
+		Source:               req.Source,
+		Branch:               req.Branch,
+		Dockerfile:           req.Dockerfile,
+		Stages:               req.Stages,
+		Variables:            req.Variables,
+		DeployMode:           req.DeployMode,
+		DeployTarget:         req.DeployTarget,
+		ServerIDs:            req.ServerIDs,
+		DeployRemotePath:     req.DeployRemotePath,
+		DeployScript:         req.DeployScript,
+		K8sClusterID:         req.K8sClusterID,
+		K8sNamespace:         req.K8sNamespace,
+		K8sDeployment:        req.K8sDeployment,
+		K8sContainerName:     req.K8sContainerName,
 		GitCredentialID:      req.GitCredentialID,
 		RegistryCredentialID: req.RegistryCredentialID,
-		EnvironmentID: req.EnvironmentID,
+		EnvironmentID:        req.EnvironmentID,
 		// 触发配置
 		TriggerMode:   req.TriggerMode,
 		WatchBranches: req.WatchBranches,
@@ -242,11 +247,13 @@ func (h *PipelineHandler) CreatePipeline(c *gin.Context) {
 		CronExpr:      req.CronExpr,
 		WebhookToken:  req.WebhookToken,
 		// 缓存
-		CachePaths: req.CachePaths,
+		CachePaths:     req.CachePaths,
+		JenkinsJobName: req.JenkinsJobName,
+		JenkinsJobURL:  req.JenkinsJobURL,
 		// 并发控制
 		MaxExecutors: req.MaxExecutors,
 		BuildNodeID:  req.BuildNodeID,
-		Enabled:    true,
+		Enabled:      true,
 	}

 	if err := h.db.Create(&pipeline).Error; err != nil {
@@ -301,38 +308,105 @@ func (h *PipelineHandler) UpdatePipeline(c *gin.Context) {
 	}

 	updates := map[string]interface{}{}
-	if req.Name != "" { updates["name"] = req.Name }
-	if req.JobName != "" { updates["job_name"] = req.JobName }
-	if req.Description != "" { updates["description"] = req.Description }
-	if req.Type != "" { updates["type"] = req.Type }
-	if req.Source != "" { updates["source"] = req.Source }
-	if req.Branch != "" { updates["branch"] = req.Branch }
-	if req.Dockerfile != "" { updates["dockerfile"] = req.Dockerfile }
-	if req.Stages != "" { updates["stages"] = req.Stages }
-	if req.Variables != "" { updates["variables"] = req.Variables }
-	if req.DeployMode != "" { updates["deploy_mode"] = req.DeployMode }
-	if req.DeployTarget != "" { updates["deploy_target"] = req.DeployTarget }
-	if req.ServerIDs != "" { updates["server_ids"] = req.ServerIDs }
-	if req.DeployRemotePath != "" { updates["deploy_remote_path"] = req.DeployRemotePath }
-	if req.DeployScript != "" { updates["deploy_script"] = req.DeployScript }
-	if req.K8sNamespace != "" { updates["k8s_namespace"] = req.K8sNamespace }
-	if req.K8sDeployment != "" { updates["k8s_deployment"] = req.K8sDeployment }
-	if req.K8sContainerName != "" { updates["k8s_container_name"] = req.K8sContainerName }
-	if req.K8sClusterID != nil { updates["k8s_cluster_id"] = req.K8sClusterID }
-	if req.RepoID != nil { updates["repo_id"] = req.RepoID }
-	if req.RegistryID != nil { updates["registry_id"] = req.RegistryID }
-	if req.GitCredentialID != nil { updates["git_credential_id"] = req.GitCredentialID }
-	if req.RegistryCredentialID != nil { updates["registry_credential_id"] = req.RegistryCredentialID }
-	if req.EnvironmentID != nil { updates["environment_id"] = req.EnvironmentID }
-	if req.TriggerMode != "" { updates["trigger_mode"] = req.TriggerMode }
-	if req.WatchBranches != "" { updates["watch_branches"] = req.WatchBranches }
-	if req.ExcludeBranch != "" { updates["exclude_branch"] = req.ExcludeBranch }
-	if req.CronExpr != "" { updates["cron_expr"] = req.CronExpr }
-	if req.WebhookToken != "" { updates["webhook_token"] = req.WebhookToken }
-	if req.CachePaths != "" { updates["cache_paths"] = req.CachePaths }
-	if req.Enabled != nil { updates["enabled"] = req.Enabled }
-	if req.MaxExecutors > 0 { updates["max_executors"] = req.MaxExecutors }
-	if req.BuildNodeID != nil { updates["build_node_id"] = req.BuildNodeID }
+	if req.Name != "" {
+		updates["name"] = req.Name
+	}
+	if req.JobName != "" {
+		updates["job_name"] = req.JobName
+	}
+	if req.Description != "" {
+		updates["description"] = req.Description
+	}
+	if req.Type != "" {
+		updates["type"] = req.Type
+	}
+	if req.CIProvider != "" {
+		updates["ci_provider"] = normalizeCIProvider(req.CIProvider)
+	}
+	if req.Source != "" {
+		updates["source"] = req.Source
+	}
+	if req.Branch != "" {
+		updates["branch"] = req.Branch
+	}
+	if req.Dockerfile != "" {
+		updates["dockerfile"] = req.Dockerfile
+	}
+	if req.Stages != "" {
+		updates["stages"] = req.Stages
+	}
+	if req.Variables != "" {
+		updates["variables"] = req.Variables
+	}
+	if req.DeployMode != "" {
+		updates["deploy_mode"] = req.DeployMode
+	}
+	if req.DeployTarget != "" {
+		updates["deploy_target"] = req.DeployTarget
+	}
+	if req.ServerIDs != "" {
+		updates["server_ids"] = req.ServerIDs
+	}
+	if req.DeployRemotePath != "" {
+		updates["deploy_remote_path"] = req.DeployRemotePath
+	}
+	if req.DeployScript != "" {
+		updates["deploy_script"] = req.DeployScript
+	}
+	if req.K8sNamespace != "" {
+		updates["k8s_namespace"] = req.K8sNamespace
+	}
+	if req.K8sDeployment != "" {
+		updates["k8s_deployment"] = req.K8sDeployment
+	}
+	if req.K8sContainerName != "" {
+		updates["k8s_container_name"] = req.K8sContainerName
+	}
+	if req.K8sClusterID != nil {
+		updates["k8s_cluster_id"] = req.K8sClusterID
+	}
+	if req.GitCredentialID != nil {
+		updates["git_credential_id"] = req.GitCredentialID
+	}
+	if req.RegistryCredentialID != nil {
+		updates["registry_credential_id"] = req.RegistryCredentialID
+	}
+	if req.EnvironmentID != nil {
+		updates["environment_id"] = req.EnvironmentID
+	}
+	if req.TriggerMode != "" {
+		updates["trigger_mode"] = req.TriggerMode
+	}
+	if req.WatchBranches != "" {
+		updates["watch_branches"] = req.WatchBranches
+	}
+	if req.ExcludeBranch != "" {
+		updates["exclude_branch"] = req.ExcludeBranch
+	}
+	if req.CronExpr != "" {
+		updates["cron_expr"] = req.CronExpr
+	}
+	if req.WebhookToken != "" {
+		updates["webhook_token"] = req.WebhookToken
+	}
+	if req.CachePaths != "" {
+		updates["cache_paths"] = req.CachePaths
+	}
+	if req.JenkinsJobName != "" {
+		updates["jenkins_job_name"] = req.JenkinsJobName
+	}
+	if req.JenkinsJobURL != "" {
+		updates["jenkins_job_url"] = req.JenkinsJobURL
+	}
+	if req.Enabled != nil {
+		updates["enabled"] = req.Enabled
+	}
+	if req.MaxExecutors > 0 {
+		updates["max_executors"] = req.MaxExecutors
+	}
+	if req.BuildNodeID != nil {
+		updates["build_node_id"] = req.BuildNodeID
+	}

 	if err := h.db.Model(&pipeline).Updates(updates).Error; err != nil {
 		c.JSON(http.StatusInternalServerError, model.Response{
@@ -404,6 +478,11 @@ func (h *PipelineHandler) TriggerPipeline(c *gin.Context) {
 	var req model.TriggerPipelineRequest
 	c.ShouldBindJSON(&req)

+	if pipeline.CIProvider == "jenkins" {
+		h.triggerJenkinsPipeline(c, pipeline, req)
+		return
+	}
+
 	var maxBuildNumber int
 	h.db.Model(&model.PipelineRun{}).Where("pipeline_id = ?", id).
 		Select("COALESCE(MAX(build_number), 0)").Scan(&maxBuildNumber)
@@ -162,7 +162,7 @@ func (h *PipelineHandler) executePipeline(pipeline model.Pipeline, run model.Pip
 	}

 	runUpdates := map[string]interface{}{
-		"workspace_path": workspace,
+		"workspace_path":  workspace,
 		"build_node_name": execCtx.NodeName,
 	}
 	if nodeID > 0 {
@@ -545,13 +545,10 @@ func (h *PipelineHandler) runDeploy(workspace string, pipeline model.Pipeline, t
 // resolvePipelineImage 解析流水线构建镜像全名（与镜像打包阶段一致） // Logan.Li
 func (h *PipelineHandler) resolvePipelineImage(pipeline model.Pipeline, tag string) string {
 	var registryURL, imageName string
-	if pipeline.RegistryID != nil {
-		var reg model.PipelineRegistry
-		if err := h.db.First(&reg, *pipeline.RegistryID).Error; err == nil {
-			registryURL = reg.RegistryURL
-			if reg.Namespace != "" {
-				imageName = reg.Namespace + "/"
-			}
+	if pipeline.RegistryCredentialID != nil {
+		var credential model.Credential
+		if err := h.db.Take(&credential, *pipeline.RegistryCredentialID).Error; err == nil {
+			registryURL = credential.Summary
 		}
 	}
 	appName := pipeline.Code
@@ -838,7 +835,7 @@ func cleanOldWorkspaces(baseDir string, maxAge time.Duration) {

 var (
 	pipelineRunningCount = make(map[uint]int)    // pipelineID → 当前运行数
-	pipelineQueues       = make(map[uint][]uint)  // pipelineID → 排队 runID 列表
+	pipelineQueues       = make(map[uint][]uint) // pipelineID → 排队 runID 列表
 	queueMu              sync.Mutex
 )

@@ -909,9 +906,13 @@ func (h *PipelineHandler) dequeueNext(pipelineID uint) {

 	// 加载 pipeline + run
 	var pipeline model.Pipeline
-	if err := h.db.First(&pipeline, pipelineID).Error; err != nil { return }
+	if err := h.db.First(&pipeline, pipelineID).Error; err != nil {
+		return
+	}
 	var run model.PipelineRun
-	if err := h.db.First(&run, nextRunID).Error; err != nil { return }
+	if err := h.db.First(&run, nextRunID).Error; err != nil {
+		return
+	}

 	nodeID, canNode := h.tryAcquireBuildNode(pipeline)
 	if !canNode {
@@ -935,8 +936,8 @@ func (h *PipelineHandler) GetQueueStatus(pipelineID uint) map[string]interface{}
 	running := pipelineRunningCount[pipelineID]
 	queued := pipelineQueues[pipelineID]
 	return map[string]interface{}{
-		"running": running,
-		"queued":  len(queued),
+		"running":   running,
+		"queued":    len(queued),
 		"queue_ids": queued,
 	}
 }
@@ -260,4 +260,4 @@ func (h *PipelineHandler) hasBuildFileCtx(ctx *PipelineExecCtx, dir string) bool
 		}
 	}
 	return false
-}
+}
@@ -266,9 +266,7 @@ func (h *RDPHandler) Serve(c *gin.Context) {
 		if errMsg != "" {
 			updates["error"] = errMsg
 		}
-		if err := h.db.Model(&model.RDPSession{}).Where("id = ?", session.ID).Updates(updates).Error; err != nil {
-			log.Printf("[RDP] 更新会话结束状态失败 (session_id=%d, status=%s): %v", session.ID, status, err)
-		}
+		_ = h.db.Model(&model.RDPSession{}).Where("id = ?", session.ID).Updates(updates).Error
 	}()

 	audit := newRDPOperationRecorder(h.db, session, userIDPtr, username)
@@ -288,6 +286,9 @@ func (h *RDPHandler) Serve(c *gin.Context) {
 				continue
 			}
 			modifiers.Apply(&event)
+			if event.Type == "clipboard" {
+				log.Printf("[RDP] ws clipboard local→remote session=%d len=%d", session.ID, len(event.Text))
+			}
 			audit.Record(event)
 			enqueueRDPEvent(events, event)
 		}
@@ -530,9 +531,7 @@ func (r *rdpOperationRecorder) create(command string) {
 		Command:     command,
 		Timestamp:   time.Now(),
 	}
-	if err := r.db.Create(&cmd).Error; err != nil {
-		log.Printf("[RDPAudit] 记录 RDP 操作命令失败 (session_id=%d, user=%s, cmd=%q): %v", r.session.ID, r.username, command, err)
-	}
+	_ = r.db.Create(&cmd).Error
 }

 func (h *RDPHandler) loadRDPCredential(server model.Server) (model.RDPSecretContent, error) {
@@ -662,7 +661,7 @@ func isMostlyBlackRGBA(img *image.RGBA, threshold float64) bool {
 func writeRDPFrame(mgr *wshub.WSManager, conn *websocket.Conn, frame rdpengine.ServerFrame) error {
 	mgr.SetWriteDeadline(conn)
 	if frame.Type == "bitmap" && len(frame.RGBA) > 0 {
-		return conn.WriteMessage(websocket.BinaryMessage, encodeRDPBitmapBinary(frame))
+		return writeCompressedRDPBitmap(conn, frame)
 	}
 	return conn.WriteJSON(frame)
 }
@@ -32,4 +32,4 @@ func loadRDPCredential(crypt *crypto.SecretBox, server model.Server) (model.RDPS
 		return cred, errors.New("RDP 凭据缺少用户名或密码")
 	}
 	return cred, nil
-}
+}
@@ -0,0 +1,48 @@
+package controller
+
+import (
+	"bytes"
+	"encoding/base64"
+	"fmt"
+	"image"
+	"image/png"
+
+	rdpengine "ezops/pkg/rdp"
+
+	"github.com/gorilla/websocket"
+)
+
+// encodeRDPBitmapPNG 将实时 RGBA 脏矩形压缩为 PNG，避免原始整帧占满低带宽 WebSocket。 // Logan.Li
+func encodeRDPBitmapPNG(frame rdpengine.ServerFrame) (rdpengine.ServerFrame, error) {
+	if frame.Type != "bitmap" || len(frame.RGBA) == 0 {
+		return frame, nil
+	}
+	if frame.Width <= 0 || frame.Height <= 0 {
+		return rdpengine.ServerFrame{}, fmt.Errorf("RDP 位图尺寸无效: %dx%d", frame.Width, frame.Height)
+	}
+	required := frame.Width * frame.Height * 4
+	if len(frame.RGBA) < required {
+		return rdpengine.ServerFrame{}, fmt.Errorf("RDP 位图数据不足: got=%d want=%d", len(frame.RGBA), required)
+	}
+
+	img := image.NewRGBA(image.Rect(0, 0, frame.Width, frame.Height))
+	copy(img.Pix, frame.RGBA[:required])
+	var buf bytes.Buffer
+	encoder := png.Encoder{CompressionLevel: png.BestSpeed}
+	if err := encoder.Encode(&buf, img); err != nil {
+		return rdpengine.ServerFrame{}, fmt.Errorf("压缩 RDP 位图失败: %w", err)
+	}
+
+	frame.Image = "data:image/png;base64," + base64.StdEncoding.EncodeToString(buf.Bytes())
+	frame.RGBA = nil
+	return frame, nil
+}
+
+// writeCompressedRDPBitmap 发送浏览器已支持的 JSON PNG 帧，兼容现有前端绘制逻辑。 // Logan.Li
+func writeCompressedRDPBitmap(conn *websocket.Conn, frame rdpengine.ServerFrame) error {
+	encoded, err := encodeRDPBitmapPNG(frame)
+	if err != nil {
+		return err
+	}
+	return conn.WriteJSON(encoded)
+}
@@ -0,0 +1,66 @@
+package controller
+
+import (
+	"bytes"
+	"encoding/base64"
+	"image/png"
+	"strings"
+	"testing"
+
+	rdpengine "ezops/pkg/rdp"
+)
+
+func TestEncodeRDPBitmapPNGCompressesFrame(t *testing.T) {
+	const width = 900
+	const height = 540
+	rgba := make([]byte, width*height*4)
+	for i := 0; i < len(rgba); i += 4 {
+		rgba[i+3] = 255
+	}
+
+	encoded, err := encodeRDPBitmapPNG(rdpengine.ServerFrame{
+		Type:   "bitmap",
+		X:      12,
+		Y:      34,
+		Width:  width,
+		Height: height,
+		RGBA:   rgba,
+	})
+	if err != nil {
+		t.Fatalf("压缩 RDP 位图失败: %v", err)
+	}
+	if len(encoded.RGBA) != 0 {
+		t.Fatalf("压缩后仍携带原始 RGBA: %d", len(encoded.RGBA))
+	}
+	const prefix = "data:image/png;base64,"
+	if !strings.HasPrefix(encoded.Image, prefix) {
+		t.Fatalf("压缩帧格式错误: %q", encoded.Image[:min(len(encoded.Image), len(prefix))])
+	}
+	pngData, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(encoded.Image, prefix))
+	if err != nil {
+		t.Fatalf("解码 PNG 数据失败: %v", err)
+	}
+	img, err := png.Decode(bytes.NewReader(pngData))
+	if err != nil {
+		t.Fatalf("解析 PNG 数据失败: %v", err)
+	}
+	if img.Bounds().Dx() != width || img.Bounds().Dy() != height {
+		t.Fatalf("PNG 尺寸错误: got=%dx%d", img.Bounds().Dx(), img.Bounds().Dy())
+	}
+	if len(encoded.Image) >= len(rgba)/4 {
+		t.Fatalf("PNG 压缩率不足: encoded=%d raw=%d", len(encoded.Image), len(rgba))
+	}
+	t.Logf("RDP 帧压缩: raw=%d encoded=%d", len(rgba), len(encoded.Image))
+}
+
+func TestEncodeRDPBitmapPNGRejectsShortPayload(t *testing.T) {
+	_, err := encodeRDPBitmapPNG(rdpengine.ServerFrame{
+		Type:   "bitmap",
+		Width:  10,
+		Height: 10,
+		RGBA:   make([]byte, 8),
+	})
+	if err == nil {
+		t.Fatal("短位图数据应返回错误")
+	}
+}
@@ -2,7 +2,6 @@ package controller

 import (
 	"fmt"
-	"log"
 	"net/http"
 	"strconv"
 	"strings"
@@ -128,9 +127,7 @@ func (h *RDPSessionHandler) KillRDPSession(c *gin.Context) {
 		return
 	}
 	duration := int(now.Sub(session.StartTime).Seconds())
-	if err := h.db.Model(&session).Updates(map[string]interface{}{"status": "closed", "end_time": now, "duration": duration}).Error; err != nil {
-		log.Printf("[RDPSession] 终止会话更新状态失败 (session_id=%d): %v", id, err)
-	}
+	_ = h.db.Model(&session).Updates(map[string]interface{}{"status": "closed", "end_time": now, "duration": duration}).Error
 	c.JSON(http.StatusOK, model.Response{Code: 200, Message: "已终止"})
 }

@@ -163,7 +160,7 @@ func (h *RDPSessionHandler) LogRDPReplayView(c *gin.Context) {
 		return
 	}
 	uid := middleware.GetUserID(c)
-	auditLog := model.AuditLog{
+	log := model.AuditLog{
 		UserID:     &uid,
 		Username:   middleware.GetUsername(c),
 		IP:         c.ClientIP(),
@@ -175,8 +172,6 @@ func (h *RDPSessionHandler) LogRDPReplayView(c *gin.Context) {
 		Request:    fmt.Sprintf("回放 Windows RDP 会话 #%d（%s → %s/%s）", id, session.Username, session.ServerName, session.ServerIP),
 		Status:     200,
 	}
-	if err := h.db.Create(&auditLog).Error; err != nil {
-		log.Printf("[RDPAudit] 记录回放审计日志失败 (session_id=%d, user=%s): %v", id, session.Username, err)
-	}
+	_ = h.db.Create(&log).Error
 	c.JSON(http.StatusOK, model.Response{Code: 200, Message: "ok"})
 }
@@ -84,8 +84,8 @@ func (h *RemoteExecHandler) BatchExec(c *gin.Context) {

 // BatchUploadRequest 批量上传请求
 type BatchUploadRequest struct {
-	ServerIDs  []uint `json:"server_ids" binding:"required"` // 目标服务器 ID 列表
-	LocalPath  string `json:"local_path" binding:"required"` // AIOps 主机上的文件路径
+	ServerIDs  []uint `json:"server_ids" binding:"required"`  // 目标服务器 ID 列表
+	LocalPath  string `json:"local_path" binding:"required"`  // AIOps 主机上的文件路径
 	RemotePath string `json:"remote_path" binding:"required"` // 远程目标路径
 }

@@ -94,8 +94,8 @@ func (h *ServerHandler) ListServers(c *gin.Context) {

 	// 关键词搜索
 	if query.Keyword != "" {
-		db = db.Where("hostname LIKE ? OR ip LIKE ? OR public_ip LIKE ?",
-			"%"+query.Keyword+"%", "%"+query.Keyword+"%", "%"+query.Keyword+"%")
+		db = db.Where("alias LIKE ? OR cloud_instance_name LIKE ? OR hostname LIKE ? OR ip LIKE ? OR public_ip LIKE ? OR cloud_instance_id LIKE ?",
+			"%"+query.Keyword+"%", "%"+query.Keyword+"%", "%"+query.Keyword+"%", "%"+query.Keyword+"%", "%"+query.Keyword+"%", "%"+query.Keyword+"%")
 	}

 	// 状态过滤
@@ -194,23 +194,26 @@ func (h *ServerHandler) CreateServer(c *gin.Context) {
 	}

 	server := model.Server{
-		Hostname:    req.Hostname,
-		IP:          req.IP,
-		PublicIP:    req.PublicIP,
-		Port:        req.Port,
-		Username:    req.Username,
-		Password:    req.Password,
-		SSHKey:      req.SSHKey,
-		AuthType:    req.AuthType,
-		OS:          req.OS,
-		CPU:         req.CPU,
-		Memory:      req.Memory,
-		Disk:        req.Disk,
-		RegionID:    req.RegionID,
-		CloudID:     req.CloudID,
-		Tags:        req.Tags,
-		Description: req.Description,
-		Status:      "stopped",
+		Hostname:          req.Hostname,
+		Alias:             req.Alias,
+		CloudInstanceName: req.CloudInstanceName,
+		CloudInstanceID:   req.CloudInstanceID,
+		IP:                req.IP,
+		PublicIP:          req.PublicIP,
+		Port:              req.Port,
+		Username:          req.Username,
+		Password:          req.Password,
+		SSHKey:            req.SSHKey,
+		AuthType:          req.AuthType,
+		OS:                req.OS,
+		CPU:               req.CPU,
+		Memory:            req.Memory,
+		Disk:              req.Disk,
+		RegionID:          req.RegionID,
+		CloudID:           req.CloudID,
+		Tags:              req.Tags,
+		Description:       req.Description,
+		Status:            "stopped",
 	}

 	if req.Status != "" {
@@ -295,6 +298,15 @@ func (h *ServerHandler) UpdateServer(c *gin.Context) {
 	if req.Hostname != "" {
 		updates["hostname"] = req.Hostname
 	}
+	if req.Alias != nil {
+		updates["alias"] = *req.Alias
+	}
+	if req.CloudInstanceName != "" {
+		updates["cloud_instance_name"] = req.CloudInstanceName
+	}
+	if req.CloudInstanceID != "" {
+		updates["cloud_instance_id"] = req.CloudInstanceID
+	}
 	if req.IP != "" {
 		updates["ip"] = req.IP
 	}
@@ -1,26 +0,0 @@
-package controller
-
-import (
-	"net/http/httptest"
-	"testing"
-
-	"ezops/model"
-
-	"github.com/gin-gonic/gin"
-)
-
-// TestServerPageQueryBinding 验证服务器列表能绑定排序查询参数。 // Logan.Li
-func TestServerPageQueryBinding(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	request := httptest.NewRequest("GET", "/servers?page=1&page_size=10&sort=hostname&order=asc", nil)
-	context, _ := gin.CreateTestContext(httptest.NewRecorder())
-	context.Request = request
-
-	var query model.PageQuery
-	if err := context.ShouldBindQuery(&query); err != nil {
-		t.Fatalf("ShouldBindQuery() error = %v", err)
-	}
-	if query.Sort != "hostname" || query.Order != "asc" {
-		t.Fatalf("排序参数绑定结果为 sort=%q order=%q", query.Sort, query.Order)
-	}
-}
@@ -57,9 +57,7 @@ func (h *ServerHandlerV2) ListServers(c *gin.Context) {
 	status := c.Query("status")
 	regionID := c.Query("region_id")

-	list, total, err := h.svc.ListServers(
-		query.Keyword, status, regionID, query.Sort, query.Order, query.Page, query.PageSize,
-	)
+	list, total, err := h.svc.ListServers(query.Keyword, status, regionID, query.Page, query.PageSize)
 	if err != nil {
 		utils.InternalError(c, "查询失败")
 		return
@@ -67,7 +67,7 @@ func (h *SessionCommandHandler) ListSessionCommands(c *gin.Context) {

 	// 联表带出会话录制大小，前端可判断能否回放 // Logan.Li
 	var items []model.SessionCommandItem
-	listQuery := h.db.Table("sys_session_commands AS sc").
+	listQuery := h.db.Table("audit_session_commands AS sc").
 		Select("sc.*, COALESCE(ts.record_size, rs.record_size, 0) AS session_record_size").
 		Joins("LEFT JOIN sys_terminal_sessions AS ts ON ts.id = sc.session_id AND COALESCE(sc.session_type, 'terminal') = 'terminal'").
 		Joins("LEFT JOIN sys_rdp_sessions AS rs ON rs.id = sc.session_id AND sc.session_type = 'rdp'")
@@ -35,8 +35,8 @@ func (h *SFTPHandler) sftpClient(serverID uint) (*sftp.Client, *ssh.Client, erro
 	}

 	sshConfig := &ssh.ClientConfig{
-		User:    server.Username,
-		Timeout: 10 * time.Second,
+		User:            server.Username,
+		Timeout:         10 * time.Second,
 		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
 	}

@@ -267,4 +267,4 @@ func (h *SiteHandler) GetSiteStats(c *gin.Context) {
 		"availability":  availability,
 		"probe_count":   totalRecent,
 	}})
-}
+}
@@ -12,23 +12,23 @@ import (

 // SiteTaskView 前端拨测任务视图（字段与前端对齐）// Logan.Li
 type SiteTaskView struct {
-	ID                   uint    `json:"id"`
-	Name                 string  `json:"name"`
-	URL                  string  `json:"url"`
-	Type                 string  `json:"type"`
-	FrequencySec         int     `json:"frequency_sec"`
-	TimeoutSec           int     `json:"timeout_sec"`
-	ExpectedStatusCode   int     `json:"expected_status_code"`
-	Enabled              bool    `json:"enabled"`
-	LastStatus           string  `json:"last_status,omitempty"`
-	LastResponseTimeMs   float64 `json:"last_response_time_ms,omitempty"`
-	LastCheckedAt        *string `json:"last_checked_at,omitempty"`
-	SuccessRate          float64 `json:"success_rate"`
-	AlertStatus          string  `json:"alert_status"`
-	Status               string  `json:"status"`
-	CreatedAt            string  `json:"created_at"`
-	SSLDaysRemaining     *int    `json:"ssl_days_remaining,omitempty"`
-	SSLCertExpiry        *string `json:"ssl_cert_expiry,omitempty"`
+	ID                 uint    `json:"id"`
+	Name               string  `json:"name"`
+	URL                string  `json:"url"`
+	Type               string  `json:"type"`
+	FrequencySec       int     `json:"frequency_sec"`
+	TimeoutSec         int     `json:"timeout_sec"`
+	ExpectedStatusCode int     `json:"expected_status_code"`
+	Enabled            bool    `json:"enabled"`
+	LastStatus         string  `json:"last_status,omitempty"`
+	LastResponseTimeMs float64 `json:"last_response_time_ms,omitempty"`
+	LastCheckedAt      *string `json:"last_checked_at,omitempty"`
+	SuccessRate        float64 `json:"success_rate"`
+	AlertStatus        string  `json:"alert_status"`
+	Status             string  `json:"status"`
+	CreatedAt          string  `json:"created_at"`
+	SSLDaysRemaining   *int    `json:"ssl_days_remaining,omitempty"`
+	SSLCertExpiry      *string `json:"ssl_cert_expiry,omitempty"`
 }

 func toSiteTaskView(task model.SiteTask) SiteTaskView {
@@ -220,4 +220,4 @@ func parseCreateTaskRequest(raw map[string]interface{}) model.SiteTask {
 		task.DNSResolver = strings.TrimSpace(v)
 	}
 	return task
-}
+}
@@ -50,16 +50,16 @@ func (h *SNMPHandler) ListDevices(c *gin.Context) {
 // POST /api/v1/snmp/devices
 func (h *SNMPHandler) CreateDevice(c *gin.Context) {
 	var req struct {
-		Name         string `json:"name" binding:"required"`
-		IP           string `json:"ip" binding:"required"`
-		Port         int    `json:"port"`
-		SnmpVersion  string `json:"snmp_version"`
-		Version      string `json:"version"`
-		Community    string `json:"community"`
-		TemplateID   uint   `json:"template_id"`
-		DeviceType   string `json:"device_type"`
-		Vendor       string `json:"vendor"`
-		Description  string `json:"description"`
+		Name        string `json:"name" binding:"required"`
+		IP          string `json:"ip" binding:"required"`
+		Port        int    `json:"port"`
+		SnmpVersion string `json:"snmp_version"`
+		Version     string `json:"version"`
+		Community   string `json:"community"`
+		TemplateID  uint   `json:"template_id"`
+		DeviceType  string `json:"device_type"`
+		Vendor      string `json:"vendor"`
+		Description string `json:"description"`
 	}
 	if err := c.ShouldBindJSON(&req); err != nil {
 		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: err.Error()})
@@ -172,8 +172,8 @@ func (h *SNMPHandler) GetSNMPStats(c *gin.Context) {
 	h.db.Model(&model.SNMPDevice{}).Where("status = ?", "online").Count(&online)

 	c.JSON(http.StatusOK, model.Response{Code: 200, Data: gin.H{
-		"total":  total,
-		"online": online,
+		"total":    total,
+		"online":   online,
 		"abnormal": total - online,
 	}})
 }
@@ -198,4 +198,4 @@ func (h *SNMPHandler) ListDeviceMetrics(c *gin.Context) {
 func (h *SNMPHandler) StopCollector() {
 	close(h.stopCh)
 	h.wg.Wait()
-}
+}
@@ -260,7 +260,7 @@ func snmpMetricLabel(name, index string) string {
 		"h3c_fan_speed": "H3C 风扇", "hw_fan_speed": "华为 风扇",
 		"ruijie_fan_speed": "锐捷 风扇", "dell_fan_speed": "Dell 风扇", "inspur_fan_speed": "浪潮 风扇",
 		"ent_sensor_value": "实体传感器",
-		"if_in_octets": "入方向流量", "if_out_octets": "出方向流量",
+		"if_in_octets":     "入方向流量", "if_out_octets": "出方向流量",
 	}
 	label := labels[name]
 	if label == "" {
@@ -270,4 +270,4 @@ func snmpMetricLabel(name, index string) string {
 		label += " #" + index
 	}
 	return label
-}
+}
@@ -32,7 +32,7 @@ func (h *SystemTaskHandler) ListSystemTasks(c *gin.Context) {
 	c.JSON(http.StatusOK, model.Response{
 		Code:    200,
 		Message: "success",
-		Data: model.ListResponse{List: list, Total: int64(len(list))},
+		Data:    model.ListResponse{List: list, Total: int64(len(list))},
 	})
 }

@@ -50,4 +50,4 @@ func (h *SystemTaskHandler) RunSystemTask(c *gin.Context) {
 		Message: "执行完成",
 		Data:    item,
 	})
-}
+}
@@ -2,7 +2,6 @@ package controller

 import (
 	"fmt"
-	"log"
 	"net/http"
 	"strconv"
 	"strings"
@@ -265,7 +264,7 @@ func (h *TerminalSessionHandler) LogReplayView(c *gin.Context) {
 		return
 	}
 	uid := middleware.GetUserID(c)
-	auditLog := model.AuditLog{
+	log := model.AuditLog{
 		UserID:     &uid,
 		Username:   middleware.GetUsername(c),
 		IP:         c.ClientIP(),
@@ -277,9 +276,7 @@ func (h *TerminalSessionHandler) LogReplayView(c *gin.Context) {
 		Request:    fmt.Sprintf("回放终端会话 #%d（%s → %s/%s）", id, session.Username, session.ServerName, session.ServerIP),
 		Status:     200,
 	}
-	if err := h.db.Create(&auditLog).Error; err != nil {
-		log.Printf("[TerminalAudit] 记录回放审计日志失败 (session_id=%d, user=%s): %v", id, session.Username, err)
-	}
+	_ = h.db.Create(&log).Error // 落库失败不阻断回放
 	c.JSON(http.StatusOK, model.Response{Code: 200, Message: "ok"})
 }

@@ -105,11 +105,11 @@ func (h *ToolConfigHandler) UpdateTool(c *gin.Context) {
 	}

 	var req struct {
-		DisplayName   *string                   `json:"display_name"`
-		Description   *string                   `json:"description"`
+		DisplayName   *string                  `json:"display_name"`
+		Description   *string                  `json:"description"`
 		InstallMethod *model.ToolInstallMethod `json:"install_method"`
-		Enabled       *bool                     `json:"enabled"`
-		SortOrder     *int                      `json:"sort_order"`
+		Enabled       *bool                    `json:"enabled"`
+		SortOrder     *int                     `json:"sort_order"`
 	}
 	if err := c.ShouldBindJSON(&req); err != nil {
 		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: err.Error()})
@@ -356,4 +356,4 @@ func getPresetVersions(toolName string) []map[string]string {
 	default:
 		return nil
 	}
-}
+}
@@ -34,37 +34,37 @@ type jaegerServicesResp struct {
 }

 type jaegerTraceResp struct {
-	Data []jaegerTrace `json:"data"`
-	Total int          `json:"total"`
+	Data  []jaegerTrace `json:"data"`
+	Total int           `json:"total"`
 }

 type jaegerTrace struct {
-	TraceID  string                 `json:"traceID"`
-	Spans    []jaegerSpan           `json:"spans"`
+	TraceID   string                `json:"traceID"`
+	Spans     []jaegerSpan          `json:"spans"`
 	Processes map[string]jaegerProc `json:"processes"`
 }

 type jaegerSpan struct {
-	TraceID       string            `json:"traceID"`
-	SpanID        string            `json:"spanID"`
-	OperationName string            `json:"operationName"`
-	References    []jaegerRef       `json:"references"`
-	StartTime     int64             `json:"startTime"` // microseconds
-	Duration      int64             `json:"duration"`  // microseconds
-	Tags          []jaegerTag       `json:"tags"`
-	ProcessID     string            `json:"processID"`
-	Logs          []jaegerLog       `json:"logs"`
+	TraceID       string      `json:"traceID"`
+	SpanID        string      `json:"spanID"`
+	OperationName string      `json:"operationName"`
+	References    []jaegerRef `json:"references"`
+	StartTime     int64       `json:"startTime"` // microseconds
+	Duration      int64       `json:"duration"`  // microseconds
+	Tags          []jaegerTag `json:"tags"`
+	ProcessID     string      `json:"processID"`
+	Logs          []jaegerLog `json:"logs"`
 }

 type jaegerRef struct {
-	RefType  string `json:"refType"`
-	TraceID  string `json:"traceID"`
-	SpanID   string `json:"spanID"`
+	RefType string `json:"refType"`
+	TraceID string `json:"traceID"`
+	SpanID  string `json:"spanID"`
 }

 type jaegerProc struct {
-	ServiceName string       `json:"serviceName"`
-	Tags        []jaegerTag  `json:"tags"`
+	ServiceName string      `json:"serviceName"`
+	Tags        []jaegerTag `json:"tags"`
 }

 type jaegerTag struct {
@@ -74,8 +74,8 @@ type jaegerTag struct {
 }

 type jaegerLog struct {
-	Timestamp int64         `json:"timestamp"`
-	Fields    []jaegerTag   `json:"fields"`
+	Timestamp int64       `json:"timestamp"`
+	Fields    []jaegerTag `json:"fields"`
 }

 // ---- 前端期望的格式 ----
@@ -115,7 +115,7 @@ type serviceMetric struct {
 	ServiceName  string  `json:"serviceName"`
 	RequestCount int     `json:"requestCount"`
 	ErrorRate    float64 `json:"errorRate"`
-	AvgDuration  float64 `json:"avgDuration"`  // ms
+	AvgDuration  float64 `json:"avgDuration"` // ms
 	P95Duration  float64 `json:"p95Duration"`
 	P99Duration  float64 `json:"p99Duration"`
 }
@@ -4,8 +4,8 @@ import (
 	"net/http"
 	"time"

-	"ezops/middleware"
 	"ezops/config"
+	"ezops/middleware"
 	"ezops/model"

 	"github.com/gin-gonic/gin"
@@ -62,20 +62,31 @@ func parseUserAgent(ua string) (browser, os string) {
 	}
 	// Browser
 	switch {
-	case containsAny(ua, "Edg/"): browser = "Edge"
-	case containsAny(ua, "Chrome"): browser = "Chrome"
-	case containsAny(ua, "Safari") && !containsAny(ua, "Chrome"): browser = "Safari"
-	case containsAny(ua, "Firefox"): browser = "Firefox"
-	case containsAny(ua, "curl"): browser = "curl"
-	case containsAny(ua, "Python"): browser = "Python"
+	case containsAny(ua, "Edg/"):
+		browser = "Edge"
+	case containsAny(ua, "Chrome"):
+		browser = "Chrome"
+	case containsAny(ua, "Safari") && !containsAny(ua, "Chrome"):
+		browser = "Safari"
+	case containsAny(ua, "Firefox"):
+		browser = "Firefox"
+	case containsAny(ua, "curl"):
+		browser = "curl"
+	case containsAny(ua, "Python"):
+		browser = "Python"
 	}
 	// OS
 	switch {
-	case containsAny(ua, "Windows"): os = "Windows"
-	case containsAny(ua, "Mac OS"): os = "macOS"
-	case containsAny(ua, "Linux") || containsAny(ua, "X11"): os = "Linux"
-	case containsAny(ua, "Android"): os = "Android"
-	case containsAny(ua, "iPhone") || containsAny(ua, "iPad"): os = "iOS"
+	case containsAny(ua, "Windows"):
+		os = "Windows"
+	case containsAny(ua, "Mac OS"):
+		os = "macOS"
+	case containsAny(ua, "Linux") || containsAny(ua, "X11"):
+		os = "Linux"
+	case containsAny(ua, "Android"):
+		os = "Android"
+	case containsAny(ua, "iPhone") || containsAny(ua, "iPad"):
+		os = "iOS"
 	}
 	return
 }
@@ -363,7 +374,7 @@ func collectUserPermissionCodes(db *gorm.DB, userID uint, isAdmin bool) []string
 	if isAdmin {
 		return []string{"*"}
 	}
-	// raw SQL: user → iam_user_roles → iam_roles → role_permissions → iam_permissions
+	// raw SQL: user → iam_user_roles → iam_roles → iam_role_permissions → iam_permissions
 	// 逐层 JOIN，任一层缺失自然返回空
 	type permRow struct {
 		Code string
@@ -373,7 +384,7 @@ func collectUserPermissionCodes(db *gorm.DB, userID uint, isAdmin bool) []string
 		SELECT DISTINCT p.code
 		FROM iam_user_roles ur
 		JOIN iam_roles r ON r.id = ur.role_id AND r.status = 1
-		JOIN role_permissions rp ON rp.role_id = r.id
+		JOIN iam_role_permissions rp ON rp.role_id = r.id
 		JOIN iam_permissions p ON p.id = rp.permission_id AND p.status = 1
 		WHERE ur.user_id = ?
 	`, userID).Scan(&rows).Error
@@ -396,6 +396,7 @@ func (h *UserHandler) ListRoles(c *gin.Context) {
 		Code: 200, Data: model.ListResponse{List: roles, Total: int64(len(roles))},
 	})
 }
+
 // GET /api/v1/admin/users/import-template
 func (h *UserHandler) ImportTemplate(c *gin.Context) {
 	// UTF-8 BOM for Excel compatibility
@@ -3,7 +3,6 @@ package controller
 import (
 	"crypto/rand"
 	"fmt"
-	"log"
 	"math/big"
 	"net/http"
 	"time"
@@ -137,9 +136,7 @@ func (h *UserHandler) ensureAPIKeyMeta(user *model.User) {
 		user.ApiAccessKeyDurationMonths = defaultAPIKeyMonths
 	}
 	if len(patches) > 0 {
-		if err := h.db.Model(&model.User{}).Where("id = ?", user.ID).Updates(patches).Error; err != nil {
-			log.Printf("[UserApiKey] 补全 API 密钥默认值失败 (user_id=%d): %v", user.ID, err)
-		}
+		_ = h.db.Model(&model.User{}).Where("id = ?", user.ID).Updates(patches).Error
 	}
 }

@@ -276,7 +273,9 @@ func (h *UserHandler) UpdateApiAccessKey(c *gin.Context) {
 // ExtendApiAccessKey 延长有效期（兼容旧接口）// Logan.Li
 func (h *UserHandler) ExtendApiAccessKey(c *gin.Context) {
 	userID := middleware.GetUserID(c)
-	var req struct{ DurationMonths int `json:"duration_months"` }
+	var req struct {
+		DurationMonths int `json:"duration_months"`
+	}
 	if err := c.ShouldBindJSON(&req); err != nil {
 		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "参数错误"})
 		return
@@ -314,4 +313,4 @@ func (h *UserHandler) RevokeApiAccessKey(c *gin.Context) {
 		return
 	}
 	c.JSON(http.StatusOK, model.Response{Code: 200, Message: "访问密钥已删除"})
-}
+}
@@ -60,10 +60,10 @@ func newAsciicastRecorder() *asciicastRecorder {

 func (r *asciicastRecorder) writeHeader() {
 	h, _ := json.Marshal(map[string]interface{}{
-		"version":   2,
-		"width":     80,
-		"height":    24,
-		"timestamp": r.startTime.Unix(),
+		"version":              2,
+		"width":                80,
+		"height":               24,
+		"timestamp":            r.startTime.Unix(),
 		"aiops_input_recorded": false,
 		"env": map[string]string{
 			"SHELL": "/bin/bash",
@@ -9,8 +9,8 @@ import (
 	"time"

 	"ezops/middleware"
-	"ezops/pkg/wshub"
 	ezredis "ezops/pkg/redis"
+	"ezops/pkg/wshub"

 	"github.com/gin-gonic/gin"
 	"github.com/gorilla/websocket"
@@ -53,12 +53,16 @@ func (h *WSPipelineLogHandler) StreamLog(c *gin.Context) {

 	// 首次发送：已有日志
 	raw, _ := h.cache.Get(ctx, logKey)
+	lastLen := 0
 	if raw != "" {
 		ws.WriteJSON(map[string]interface{}{"type": "init", "logs": raw})
+		var entries []LogEntry
+		if err := json.Unmarshal([]byte(raw), &entries); err == nil {
+			lastLen = len(entries)
+		}
 	}

 	// 轮询新日志（500ms 间隔）
-	lastLen := 0
 	ticker := time.NewTicker(500 * time.Millisecond)
 	defer ticker.Stop()

@@ -125,7 +129,7 @@ func (h *WSPipelineLogHandler) GetLogHistory(c *gin.Context) {
 	// 先查 Redis（执行中）
 	logKey := fmt.Sprintf("pipeline:run:%d:logs", uint(runID))
 	ctx := c.Request.Context()
-	
+
 	raw, _ := h.cache.Get(ctx, logKey)
 	if raw != "" && !strings.HasPrefix(raw, "[") {
 		raw = "[]"
@@ -137,7 +141,7 @@ func (h *WSPipelineLogHandler) GetLogHistory(c *gin.Context) {

 	// 查 DB（已完成）
 	var logs string
-	h.db.Table("ops_pipeline_runs").Where("id = ?", uint(runID)).Select("logs").Scan(&logs)
+	h.db.Table("deploy_pipeline_runs").Where("id = ?", uint(runID)).Select("logs").Scan(&logs)
 	if logs == "" {
 		logs = "[]"
 	}
@@ -113,24 +113,48 @@ func (h *ZabbixDSHandler) Update(c *gin.Context) {
 	}

 	updates := map[string]interface{}{}
-	if req.Name != nil { updates["name"] = *req.Name }
-	if req.URL != nil { updates["url"] = *req.URL }
-	if req.Username != nil { updates["username"] = *req.Username }
-	if req.Password != nil && *req.Password != "" { updates["password"] = *req.Password }
-	if req.TrendsAfter != nil { updates["trends_after"] = *req.TrendsAfter }
-	if req.TrendsRange != nil { updates["trends_range"] = *req.TrendsRange }
-	if req.TrendsCacheTTL != nil { updates["trends_cache_ttl"] = *req.TrendsCacheTTL }
-	if req.TrendsTimeout != nil { updates["trends_timeout"] = *req.TrendsTimeout }
-	if req.DirectDB != nil { updates["direct_db"] = *req.DirectDB }
-	if req.DisableAcknowledges != nil { updates["disable_acknowledges"] = *req.DisableAcknowledges }
-	if req.DisableDataAlignment != nil { updates["disable_data_alignment"] = *req.DisableDataAlignment }
+	if req.Name != nil {
+		updates["name"] = *req.Name
+	}
+	if req.URL != nil {
+		updates["url"] = *req.URL
+	}
+	if req.Username != nil {
+		updates["username"] = *req.Username
+	}
+	if req.Password != nil && *req.Password != "" {
+		updates["password"] = *req.Password
+	}
+	if req.TrendsAfter != nil {
+		updates["trends_after"] = *req.TrendsAfter
+	}
+	if req.TrendsRange != nil {
+		updates["trends_range"] = *req.TrendsRange
+	}
+	if req.TrendsCacheTTL != nil {
+		updates["trends_cache_ttl"] = *req.TrendsCacheTTL
+	}
+	if req.TrendsTimeout != nil {
+		updates["trends_timeout"] = *req.TrendsTimeout
+	}
+	if req.DirectDB != nil {
+		updates["direct_db"] = *req.DirectDB
+	}
+	if req.DisableAcknowledges != nil {
+		updates["disable_acknowledges"] = *req.DisableAcknowledges
+	}
+	if req.DisableDataAlignment != nil {
+		updates["disable_data_alignment"] = *req.DisableDataAlignment
+	}
 	if req.IsDefault != nil {
 		updates["is_default"] = *req.IsDefault
 		if *req.IsDefault {
 			h.db.Model(&model.ZabbixDataSource{}).Where("is_default = ? AND id != ?", true, id).Update("is_default", false)
 		}
 	}
-	if req.Status != nil { updates["status"] = *req.Status }
+	if req.Status != nil {
+		updates["status"] = *req.Status
+	}

 	if len(updates) > 0 {
 		if err := h.db.Model(&ds).Updates(updates).Error; err != nil {
@@ -28,7 +28,7 @@ type ZabbixHostSummary struct {
 	Hostname     string  `json:"hostname"`
 	Name         string  `json:"name"`
 	IP           string  `json:"ip"`
-	Available    string  `json:"available"`     // 0=未知 1=可用 2=不可用
+	Available    string  `json:"available"` // 0=未知 1=可用 2=不可用
 	CPUUsage     float64 `json:"cpu_usage"`
 	MemoryUsage  float64 `json:"memory_usage"`
 	DiskUsage    float64 `json:"disk_usage"`
@@ -71,7 +71,7 @@ func (h *ZabbixProxyHandler) Connect(c *gin.Context) {

 	// 获取主机列表（含接口和组信息）
 	hosts, err := client.GetHosts(ctx, &zabbix.GetHostsParams{
-		Status: 0, // 只获取被监控的主机
+		Status:           0, // 只获取被监控的主机
 		SelectInterfaces: []string{"interfaceid", "hostid", "main", "type", "useip", "ip", "dns", "port"},
 		SelectGroups:     []string{"groupid", "name"},
 		Output:           []string{"hostid", "host", "name", "status", "available", "description"},
@@ -85,17 +85,17 @@ func (h *ZabbixProxyHandler) Connect(c *gin.Context) {
 	// 为每台主机查询监控项
 	var summaries []ZabbixHostSummary
 	itemKeys := []string{
-		"system.cpu.util[,idle]",      // CPU 空闲率
-		"system.cpu.util",             // CPU 使用率（备用）
-		"vm.memory.size[total]",       // 总内存 bytes
-		"vm.memory.size[available]",   // 可用内存 bytes
-		"vfs.fs.size[/,total]",        // 总磁盘 bytes
-		"vfs.fs.size[/,used]",         // 已用磁盘 bytes
-		"system.cpu.load[all,avg5]",   // 5分钟负载
-		"net.if.in[ens18]",            // 网络流入
-		"net.if.out[ens18]",           // 网络流出
-		"system.cpu.num",              // CPU 数量
-		"system.uptime",               // 运行时间
+		"system.cpu.util[,idle]",    // CPU 空闲率
+		"system.cpu.util",           // CPU 使用率（备用）
+		"vm.memory.size[total]",     // 总内存 bytes
+		"vm.memory.size[available]", // 可用内存 bytes
+		"vfs.fs.size[/,total]",      // 总磁盘 bytes
+		"vfs.fs.size[/,used]",       // 已用磁盘 bytes
+		"system.cpu.load[all,avg5]", // 5分钟负载
+		"net.if.in[ens18]",          // 网络流入
+		"net.if.out[ens18]",         // 网络流出
+		"system.cpu.num",            // CPU 数量
+		"system.uptime",             // 运行时间
 	}

 	for _, host := range hosts {
@@ -185,9 +185,9 @@ func (h *ZabbixProxyHandler) Connect(c *gin.Context) {
 		Code:    200,
 		Message: "success",
 		Data: gin.H{
-			"version":  version,
-			"hosts":    summaries,
-			"total":    len(summaries),
+			"version": version,
+			"hosts":   summaries,
+			"total":   len(summaries),
 		},
 	})
 }