diff --git a/AGENTS.md b/AGENTS.md
index bc1e7079f..e3e2a6484 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -49,6 +49,7 @@ ruff check .
 4. When committing, ensure to use conventional commits messages, such as `feat: add new agent for data analysis` or `fix: resolve bug in provider manager`.
 5. Use English for all new comments.
 6. For path handling, use `pathlib.Path` instead of string paths, and use `astrbot.core.utils.path_utils` to get the AstrBot data and temp directory.
+7. When backend API routes, request/response schemas, or OpenAPI definitions change, regenerate the frontend API client by running `cd dashboard && pnpm generate:api`.
 
 ### No Unnecessary Helpers
 
@@ -96,4 +97,4 @@ def calculate_metrics(user_id: int, force_refresh: bool = False) -> dict:
 1. Replace current version name to specific version name.
 2. Write changelog in `changelogs/`, you can refer to the full commit messages between the latest tag to the latest commit.
 3. Make and push a commit into master branch with message format like: `chore: bump version to 4.25.0`
-4. Create a tag and push the tag. For example: `git tag v4.25.0 && git push origin v4.25.0`
\ No newline at end of file
+4. Create a tag and push the tag. For example: `git tag v4.25.0 && git push origin v4.25.0`
diff --git a/astrbot/api/all.py b/astrbot/api/all.py
index df3e1170f..7fd5504ca 100644
--- a/astrbot/api/all.py
+++ b/astrbot/api/all.py
@@ -1,3 +1,4 @@
+# ruff: noqa: F401, F403, F811, I001
 from astrbot.core.config.astrbot_config import AstrBotConfig
 from astrbot import logger
 from astrbot.core import html_renderer
@@ -51,4 +52,4 @@ from astrbot.core.platform import (
 
 from astrbot.core.platform.register import register_platform_adapter
 
-from .message_components import *
\ No newline at end of file
+from .message_components import *
diff --git a/astrbot/api/web.py b/astrbot/api/web.py
new file mode 100644
index 000000000..6fb46e69d
--- /dev/null
+++ b/astrbot/api/web.py
@@ -0,0 +1,453 @@
+from __future__ import annotations
+
+import contextvars
+from collections.abc import Callable, KeysView
+from contextlib import contextmanager
+from pathlib import Path
+from typing import Any, Generic, TypeVar, overload
+
+from fastapi.encoders import jsonable_encoder
+from fastapi.responses import FileResponse, JSONResponse
+from starlette.datastructures import Headers
+from starlette.datastructures import UploadFile as StarletteUploadFile
+from starlette.responses import StreamingResponse
+
+ValueT = TypeVar("ValueT")
+DefaultT = TypeVar("DefaultT")
+ConvertedT = TypeVar("ConvertedT")
+
+
+class PluginMultiDict(Generic[ValueT]):
+    """Dictionary-like request values that preserves duplicate keys."""
+
+    def __init__(self, pairs: list[tuple[str, ValueT]]) -> None:
+        self._pairs = pairs
+
+    @overload
+    def get(self, key: str) -> ValueT | None: ...
+
+    @overload
+    def get(self, key: str, default: DefaultT) -> ValueT | DefaultT: ...
+
+    @overload
+    def get(
+        self,
+        key: str,
+        default: DefaultT,
+        type: Callable[[ValueT], ConvertedT],
+    ) -> ConvertedT | DefaultT: ...
+
+    def get(self, key: str, default: Any = None, type: Callable | None = None):
+        """Return the last value for a key.
+
+        Args:
+            key: Value key to read.
+            default: Value returned when the key is missing or conversion fails.
+            type: Optional callable used to convert the value.
+
+        Returns:
+            The matching value, converted value, or default.
+        """
+        for item_key, item_value in reversed(self._pairs):
+            if item_key != key:
+                continue
+            if type is None:
+                return item_value
+            try:
+                return type(item_value)
+            except (TypeError, ValueError):
+                return default
+        return default
+
+    def getlist(self, key: str) -> list[ValueT]:
+        """Return all values for a key.
+
+        Args:
+            key: Value key to read.
+
+        Returns:
+            Values in request order.
+        """
+        return [item_value for item_key, item_value in self._pairs if item_key == key]
+
+    def keys(self) -> KeysView[str]:
+        return dict.fromkeys(item_key for item_key, _ in self._pairs).keys()
+
+    def values(self) -> list[ValueT]:
+        return [self[key] for key in self.keys()]
+
+    def items(self) -> list[tuple[str, ValueT]]:
+        return [(key, self[key]) for key in self.keys()]
+
+    def __contains__(self, key: str) -> bool:
+        return any(item_key == key for item_key, _ in self._pairs)
+
+    def __getitem__(self, key: str) -> ValueT:
+        value = self.get(key)
+        if value is None and key not in self:
+            raise KeyError(key)
+        return value
+
+    def __bool__(self) -> bool:
+        return bool(self._pairs)
+
+
+class PluginUploadFile:
+    """Uploaded file wrapper exposed to plugin Web API handlers."""
+
+    def __init__(self, upload_file: StarletteUploadFile) -> None:
+        self._upload_file: StarletteUploadFile = upload_file
+        self.filename: str | None = upload_file.filename
+        self.content_type: str | None = upload_file.content_type
+        self.headers: Headers = upload_file.headers
+        self.content_length: int | None = self._resolve_content_length()
+
+    def _resolve_content_length(self) -> int | None:
+        try:
+            raw = self.headers.get("content-length")
+            return int(raw) if raw else None
+        except (TypeError, ValueError):
+            return None
+
+    async def save(self, destination: str | Path) -> None:
+        """Save the uploaded file to disk.
+
+        Args:
+            destination: Destination file path.
+        """
+        path = Path(destination)
+        try:
+            await self._upload_file.seek(0)
+        except Exception:
+            pass
+        with path.open("wb") as output:
+            while True:
+                chunk = await self._upload_file.read(1024 * 1024)
+                if not chunk:
+                    break
+                output.write(chunk)
+
+    async def read(self, size: int = -1) -> bytes:
+        """Read bytes from the uploaded file.
+
+        Args:
+            size: Maximum number of bytes to read. Use -1 to read all bytes.
+
+        Returns:
+            File bytes.
+        """
+        return await self._upload_file.read(size)
+
+    async def write(self, data: bytes) -> None:
+        """Write bytes to the uploaded file object.
+
+        Args:
+            data: Bytes to write.
+        """
+        await self._upload_file.write(data)
+
+    async def seek(self, offset: int) -> None:
+        """Move the uploaded file cursor.
+
+        Args:
+            offset: Absolute byte offset.
+        """
+        await self._upload_file.seek(offset)
+
+    async def close(self) -> None:
+        """Close the uploaded file."""
+        await self._upload_file.close()
+
+    def __getattr__(self, key: str) -> Any:
+        return getattr(self._upload_file, key)
+
+
+class PluginRequest:
+    """Request object exposed to plugin Web API handlers."""
+
+    def __init__(
+        self,
+        request_: Any,
+        *,
+        path_params: dict[str, Any] | None = None,
+        plugin_name: str | None = None,
+        username: str | None = None,
+    ) -> None:
+        self._request: Any = request_
+        self.method: str = request_.method
+        self.path: str = request_.url.path
+        self.headers: Headers = request_.headers
+        self.cookies: dict[str, str] = request_.cookies
+        self.content_type: str | None = request_.headers.get("content-type")
+        self.client_host: str | None = request_.client.host if request_.client else None
+        self.path_params: dict[str, Any] = path_params or {}
+        self.plugin_name: str | None = plugin_name
+        self.username: str | None = username
+        self.query: PluginMultiDict[str] = PluginMultiDict[str](
+            list(request_.query_params.multi_items())
+        )
+        self._form_cache: PluginMultiDict[str] | None = None
+        self._files_cache: PluginMultiDict[PluginUploadFile] | None = None
+
+    async def body(self) -> bytes:
+        """Read the raw request body.
+
+        Returns:
+            Raw request body bytes.
+        """
+        return await self._request.body()
+
+    async def json(self, default: DefaultT | None = None) -> Any | DefaultT | None:
+        """Read the JSON request body.
+
+        Args:
+            default: Value returned when the request body cannot be parsed as JSON.
+
+        Returns:
+            Parsed JSON data or default.
+        """
+        try:
+            return await self._request.json()
+        except Exception:
+            return default
+
+    async def _load_form_parts(self) -> None:
+        if self._form_cache is not None and self._files_cache is not None:
+            return
+        form = await self._request.form()
+        form_pairs: list[tuple[str, str]] = []
+        file_pairs: list[tuple[str, PluginUploadFile]] = []
+        for key, value in form.multi_items():
+            if isinstance(value, StarletteUploadFile):
+                file_pairs.append((key, PluginUploadFile(value)))
+            else:
+                form_pairs.append((key, value))
+        self._form_cache = PluginMultiDict(form_pairs)
+        self._files_cache = PluginMultiDict(file_pairs)
+
+    async def form(self) -> PluginMultiDict[str]:
+        """Read form fields from a multipart or form-urlencoded request.
+
+        Returns:
+            Form values without uploaded files.
+        """
+        await self._load_form_parts()
+        assert self._form_cache is not None
+        return self._form_cache
+
+    async def files(self) -> PluginMultiDict[PluginUploadFile]:
+        """Read uploaded files from a multipart request.
+
+        Returns:
+            Uploaded file values.
+        """
+        await self._load_form_parts()
+        assert self._files_cache is not None
+        return self._files_cache
+
+
+_request_var: contextvars.ContextVar[PluginRequest] = contextvars.ContextVar(
+    "astrbot_plugin_web_request"
+)
+
+
+class PluginRequestProxy:
+    """Typed proxy for the request bound to the current plugin Web handler."""
+
+    def _get_current(self) -> PluginRequest:
+        try:
+            return _request_var.get()
+        except LookupError as exc:
+            raise RuntimeError(
+                "astrbot.api.web.request is only available inside a plugin Web API "
+                "handler."
+            ) from exc
+
+    @property
+    def method(self) -> str:
+        return self._get_current().method
+
+    @property
+    def path(self) -> str:
+        return self._get_current().path
+
+    @property
+    def headers(self) -> Headers:
+        return self._get_current().headers
+
+    @property
+    def cookies(self) -> dict[str, str]:
+        return self._get_current().cookies
+
+    @property
+    def content_type(self) -> str | None:
+        return self._get_current().content_type
+
+    @property
+    def client_host(self) -> str | None:
+        return self._get_current().client_host
+
+    @property
+    def path_params(self) -> dict[str, Any]:
+        return self._get_current().path_params
+
+    @property
+    def plugin_name(self) -> str | None:
+        return self._get_current().plugin_name
+
+    @property
+    def username(self) -> str | None:
+        return self._get_current().username
+
+    @property
+    def query(self) -> PluginMultiDict[str]:
+        return self._get_current().query
+
+    async def body(self) -> bytes:
+        return await self._get_current().body()
+
+    async def json(self, default: DefaultT | None = None) -> Any | DefaultT | None:
+        return await self._get_current().json(default=default)
+
+    async def form(self) -> PluginMultiDict[str]:
+        return await self._get_current().form()
+
+    async def files(self) -> PluginMultiDict[PluginUploadFile]:
+        return await self._get_current().files()
+
+    def __getattr__(self, key: str) -> Any:
+        return getattr(self._get_current(), key)
+
+
+request: PluginRequestProxy = PluginRequestProxy()
+
+
+@contextmanager
+def bind_request_context(request_: PluginRequest):
+    """Bind a plugin Web request for the current async context.
+
+    Args:
+        request_: Request object exposed through the module-level request proxy.
+
+    Yields:
+        The bound request object.
+    """
+    token = _request_var.set(request_)
+    try:
+        yield request_
+    finally:
+        _request_var.reset(token)
+
+
+def json_response(
+    data: Any = None,
+    *,
+    status_code: int = 200,
+    headers: dict[str, str] | None = None,
+) -> JSONResponse:
+    """Build a JSON response for plugin Web API handlers.
+
+    Args:
+        data: JSON-serializable response body.
+        status_code: HTTP status code.
+        headers: Optional response headers.
+
+    Returns:
+        A Starlette/FastAPI JSON response.
+    """
+    return JSONResponse(
+        jsonable_encoder({} if data is None else data),
+        status_code=status_code,
+        headers=headers,
+    )
+
+
+def error_response(
+    message: str,
+    *,
+    status_code: int = 400,
+    data: Any = None,
+    headers: dict[str, str] | None = None,
+) -> JSONResponse:
+    """Build a standard error response for plugin bridge calls.
+
+    Args:
+        message: Public error message.
+        status_code: HTTP status code.
+        data: Optional error details that are safe to expose.
+        headers: Optional response headers.
+
+    Returns:
+        A JSON response with the AstrBot error envelope.
+    """
+    return json_response(
+        {"status": "error", "message": message, "data": data},
+        status_code=status_code,
+        headers=headers,
+    )
+
+
+def file_response(
+    path: str | Path,
+    *,
+    filename: str | None = None,
+    content_type: str | None = None,
+    headers: dict[str, str] | None = None,
+) -> FileResponse:
+    """Build a file download response for plugin Web API handlers.
+
+    Args:
+        path: File path to send.
+        filename: Optional download filename.
+        content_type: Optional response media type.
+        headers: Optional response headers.
+
+    Returns:
+        A Starlette/FastAPI file response.
+    """
+    return FileResponse(
+        path,
+        filename=filename,
+        media_type=content_type,
+        headers=headers,
+    )
+
+
+def stream_response(
+    content: Any,
+    *,
+    content_type: str = "text/event-stream",
+    status_code: int = 200,
+    headers: dict[str, str] | None = None,
+) -> StreamingResponse:
+    """Build a streaming response for plugin Web API handlers.
+
+    Args:
+        content: Sync or async iterable that yields response chunks.
+        content_type: Response media type.
+        status_code: HTTP status code.
+        headers: Optional response headers.
+
+    Returns:
+        A Starlette/FastAPI streaming response.
+    """
+    return StreamingResponse(
+        content,
+        media_type=content_type,
+        status_code=status_code,
+        headers=headers,
+    )
+
+
+__all__ = [
+    "PluginMultiDict",
+    "PluginRequest",
+    "PluginRequestProxy",
+    "PluginUploadFile",
+    "bind_request_context",
+    "error_response",
+    "file_response",
+    "json_response",
+    "request",
+    "stream_response",
+]
diff --git a/astrbot/cli/commands/cmd_conf.py b/astrbot/cli/commands/cmd_conf.py
index ac626e0d1..30dee6134 100644
--- a/astrbot/cli/commands/cmd_conf.py
+++ b/astrbot/cli/commands/cmd_conf.py
@@ -7,7 +7,7 @@ import click
 
 from astrbot.core.utils.auth_password import (
     hash_dashboard_password,
-    hash_legacy_dashboard_password,
+    hash_md5_dashboard_password,
     validate_dashboard_password,
 )
 
@@ -147,7 +147,7 @@ def _set_dashboard_password(config: dict[str, Any], raw_password: str) -> None:
     _set_nested_item(
         config,
         "dashboard.password",
-        hash_legacy_dashboard_password(raw_password),
+        hash_md5_dashboard_password(raw_password),
     )
     _set_nested_item(config, "dashboard.password_storage_upgraded", True)
     _set_nested_item(config, "dashboard.password_change_required", False)
diff --git a/astrbot/core/config/astrbot_config.py b/astrbot/core/config/astrbot_config.py
index 4d62becb5..c42088ba9 100644
--- a/astrbot/core/config/astrbot_config.py
+++ b/astrbot/core/config/astrbot_config.py
@@ -7,7 +7,7 @@ from astrbot.core.utils.astrbot_path import get_astrbot_data_path
 from astrbot.core.utils.auth_password import (
     generate_dashboard_password,
     hash_dashboard_password,
-    hash_legacy_dashboard_password,
+    hash_md5_dashboard_password,
     validate_dashboard_password,
 )
 
@@ -64,11 +64,11 @@ class AstrBotConfig(dict):
                 conf_str = conf_str[1:]
             conf = json.loads(conf_str)
         dashboard_conf = conf.get("dashboard")
-        legacy_dashboard_password_change_required = bool(
+        stored_dashboard_password_change_required = bool(
             isinstance(dashboard_conf, dict)
             and dashboard_conf.get("password_change_required", False)
         )
-        if legacy_dashboard_password_change_required:
+        if stored_dashboard_password_change_required:
             object.__setattr__(
                 self,
                 "_dashboard_password_change_required_from_config",
@@ -87,7 +87,7 @@ class AstrBotConfig(dict):
         elif (
             "dashboard" in conf
             and isinstance(conf["dashboard"], dict)
-            and legacy_dashboard_password_change_required
+            and stored_dashboard_password_change_required
             and conf["dashboard"].get("pbkdf2_password")
         ):
             self._reset_generated_dashboard_password(conf)
@@ -103,9 +103,7 @@ class AstrBotConfig(dict):
         conf["dashboard"]["pbkdf2_password"] = hash_dashboard_password(
             generated_password
         )
-        conf["dashboard"]["password"] = hash_legacy_dashboard_password(
-            generated_password
-        )
+        conf["dashboard"]["password"] = hash_md5_dashboard_password(generated_password)
         conf["dashboard"]["password_storage_upgraded"] = True
         conf["dashboard"]["password_change_required"] = True
         object.__setattr__(
diff --git a/astrbot/core/platform/platform.py b/astrbot/core/platform/platform.py
index b32891096..af2b1a0b5 100644
--- a/astrbot/core/platform/platform.py
+++ b/astrbot/core/platform/platform.py
@@ -157,7 +157,7 @@ class Platform(abc.ABC):
         当 Dashboard 收到 /api/platform/webhook/{uuid} 请求时，会调用此方法。
 
         Args:
-            request: Quart 请求对象
+            request: webhook 请求对象
 
         Returns:
             响应内容，格式取决于具体平台的要求
diff --git a/astrbot/core/platform/sources/lark/server.py b/astrbot/core/platform/sources/lark/server.py
index 52177ebb0..e83ab5a2f 100644
--- a/astrbot/core/platform/sources/lark/server.py
+++ b/astrbot/core/platform/sources/lark/server.py
@@ -132,7 +132,7 @@ class LarkWebhookServer:
         """处理 webhook 回调，可被统一 webhook 入口复用
 
         Args:
-            request: Quart 请求对象
+            request: webhook 请求对象
 
         Returns:
             响应数据
diff --git a/astrbot/core/platform/sources/qqofficial_webhook/qo_webhook_server.py b/astrbot/core/platform/sources/qqofficial_webhook/qo_webhook_server.py
index 275f01c72..2c9f6caba 100644
--- a/astrbot/core/platform/sources/qqofficial_webhook/qo_webhook_server.py
+++ b/astrbot/core/platform/sources/qqofficial_webhook/qo_webhook_server.py
@@ -5,12 +5,12 @@ import time
 from binascii import Error as BinasciiError
 from typing import cast
 
-import quart
 from botpy import BotAPI, BotHttp, BotWebSocket, Client, ConnectionSession, Token
 from cryptography.exceptions import InvalidSignature
 from cryptography.hazmat.primitives.asymmetric import ed25519
 
 from astrbot.api import logger
+from astrbot.core.platform.webhook_server import FastAPIWebhookServer
 
 # remove logger handler
 for handler in logging.root.handlers[:]:
@@ -90,7 +90,7 @@ class QQOfficialWebhook:
         self.api: BotAPI = BotAPI(http=self.http)
         self.token = Token(self.appid, self.secret)
 
-        self.server = quart.Quart(__name__)
+        self.server = FastAPIWebhookServer("qq-official-webhook")
         self.server.add_url_rule(
             "/astrbot-qo-webhook/callback",
             view_func=self.callback,
@@ -159,15 +159,15 @@ class QQOfficialWebhook:
         """Pop and return extra fields cached from the raw webhook payload for a given message ID."""
         return self._extra_data_cache.pop(message_id, {})
 
-    async def callback(self):
+    async def callback(self, request):
         """内部服务器的回调入口"""
-        return await self.handle_callback(quart.request)
+        return await self.handle_callback(request)
 
     async def handle_callback(self, request) -> dict:
         """处理 webhook 回调，可被统一 webhook 入口复用
 
         Args:
-            request: Quart 请求对象
+            request: FastAPI webhook request 对象
 
         Returns:
             响应数据
diff --git a/astrbot/core/platform/sources/slack/client.py b/astrbot/core/platform/sources/slack/client.py
index efd7a6f3d..97f5f26ae 100644
--- a/astrbot/core/platform/sources/slack/client.py
+++ b/astrbot/core/platform/sources/slack/client.py
@@ -2,11 +2,10 @@ import asyncio
 import hashlib
 import hmac
 import json
-import logging
 from collections.abc import Callable
 from typing import cast
 
-from quart import Quart, Response, request
+from fastapi.responses import Response
 from slack_sdk.socket_mode.aiohttp import SocketModeClient
 from slack_sdk.socket_mode.async_client import AsyncBaseSocketModeClient
 from slack_sdk.socket_mode.request import SocketModeRequest
@@ -14,10 +13,11 @@ from slack_sdk.socket_mode.response import SocketModeResponse
 from slack_sdk.web.async_client import AsyncWebClient
 
 from astrbot.api import logger
+from astrbot.core.platform.webhook_server import FastAPIWebhookServer
 
 
 class SlackWebhookClient:
-    """Slack Webhook 模式客户端，使用 Quart 作为 Web 服务器"""
+    """Slack Webhook 模式客户端，使用 FastAPI 作为 Web 服务器"""
 
     def __init__(
         self,
@@ -35,20 +35,16 @@ class SlackWebhookClient:
         self.path = path
         self.event_handler = event_handler
 
-        self.app = Quart(__name__)
+        self.app = FastAPIWebhookServer("slack-webhook")
         self._setup_routes()
 
-        # 禁用 Quart 的默认日志输出
-        logging.getLogger("quart.app").setLevel(logging.WARNING)
-        logging.getLogger("quart.serving").setLevel(logging.WARNING)
-
         self.shutdown_event = asyncio.Event()
 
     def _setup_routes(self) -> None:
         """设置路由"""
 
         @self.app.route(self.path, methods=["POST"])
-        async def slack_events():
+        async def slack_events(request):
             """内部服务器的 POST 回调入口"""
             return await self.handle_callback(request)
 
@@ -61,7 +57,7 @@ class SlackWebhookClient:
         """处理 Slack 回调请求，可被统一 webhook 入口复用
 
         Args:
-            req: Quart 请求对象
+            req: webhook 请求对象
 
         Returns:
             Response 对象或字典
@@ -75,7 +71,7 @@ class SlackWebhookClient:
             timestamp = req.headers.get("X-Slack-Request-Timestamp")
             signature = req.headers.get("X-Slack-Signature")
             if not timestamp or not signature:
-                return Response("Missing headers", status=400)
+                return Response("Missing headers", status_code=400)
             # Calculate the HMAC signature
             sig_basestring = f"v0:{timestamp}:{body.decode('utf-8')}"
             my_signature = (
@@ -89,7 +85,7 @@ class SlackWebhookClient:
             # Verify the signature
             if not hmac.compare_digest(my_signature, signature):
                 logger.warning("Slack request signature verification failed")
-                return Response("Invalid signature", status=400)
+                return Response("Invalid signature", status_code=400)
             logger.info(f"Received Slack event: {event_data}")
 
             # 处理 URL 验证事件
@@ -99,11 +95,11 @@ class SlackWebhookClient:
             if self.event_handler and event_data.get("type") == "event_callback":
                 await self.event_handler(event_data)
 
-            return Response("", status=200)
+            return Response("", status_code=200)
 
         except Exception as e:
             logger.error(f"处理 Slack 事件时出错: {e}")
-            return Response("Internal Server Error", status=500)
+            return Response("Internal Server Error", status_code=500)
 
     async def start(self) -> None:
         """启动 Webhook 服务器"""
diff --git a/astrbot/core/platform/sources/wecom/wecom_adapter.py b/astrbot/core/platform/sources/wecom/wecom_adapter.py
index 58ee927d2..fed71e37d 100644
--- a/astrbot/core/platform/sources/wecom/wecom_adapter.py
+++ b/astrbot/core/platform/sources/wecom/wecom_adapter.py
@@ -8,7 +8,6 @@ from pathlib import Path
 from typing import Any, cast
 from urllib.parse import unquote
 
-import quart
 from requests import Response
 from wechatpy.enterprise import WeChatClient, parse_message
 from wechatpy.enterprise.crypto import WeChatCrypto
@@ -28,6 +27,7 @@ from astrbot.api.platform import (
 )
 from astrbot.core import logger
 from astrbot.core.platform.astr_message_event import MessageSesion
+from astrbot.core.platform.webhook_server import FastAPIWebhookServer
 from astrbot.core.utils.astrbot_path import get_astrbot_temp_path
 from astrbot.core.utils.media_utils import MediaResolver
 from astrbot.core.utils.webhook_utils import log_webhook_info
@@ -65,7 +65,7 @@ def _extract_wecom_media_filename(disposition: str | None) -> str | None:
 
 class WecomServer:
     def __init__(self, event_queue: asyncio.Queue, config: dict) -> None:
-        self.server = quart.Quart(__name__)
+        self.server = FastAPIWebhookServer("wecom-webhook")
         self.port = int(cast(str, config.get("port")))
         self.callback_server_host = config.get("callback_server_host", "0.0.0.0")
         self.server.add_url_rule(
@@ -89,15 +89,15 @@ class WecomServer:
         self.callback: Callable[[BaseMessage], Awaitable[None]] | None = None
         self.shutdown_event = asyncio.Event()
 
-    async def verify(self):
+    async def verify(self, request):
         """内部服务器的 GET 验证入口"""
-        return await self.handle_verify(quart.request)
+        return await self.handle_verify(request)
 
     async def handle_verify(self, request) -> str:
         """处理验证请求，可被统一 webhook 入口复用
 
         Args:
-            request: Quart 请求对象
+            request: FastAPI webhook request 对象
 
         Returns:
             验证响应
@@ -117,15 +117,15 @@ class WecomServer:
             logger.error("验证请求有效性失败，签名异常，请检查配置。")
             raise
 
-    async def callback_command(self):
+    async def callback_command(self, request):
         """内部服务器的 POST 回调入口"""
-        return await self.handle_callback(quart.request)
+        return await self.handle_callback(request)
 
     async def handle_callback(self, request) -> str:
         """处理回调请求，可被统一 webhook 入口复用
 
         Args:
-            request: Quart 请求对象
+            request: FastAPI webhook request 对象
 
         Returns:
             响应内容
diff --git a/astrbot/core/platform/sources/wecom_ai_bot/wecomai_server.py b/astrbot/core/platform/sources/wecom_ai_bot/wecomai_server.py
index 80ec5179e..acf162b12 100644
--- a/astrbot/core/platform/sources/wecom_ai_bot/wecomai_server.py
+++ b/astrbot/core/platform/sources/wecom_ai_bot/wecomai_server.py
@@ -6,9 +6,8 @@ import asyncio
 from collections.abc import Callable
 from typing import Any
 
-import quart
-
 from astrbot.api import logger
+from astrbot.core.platform.webhook_server import FastAPIWebhookServer
 
 from .wecomai_api import WecomAIBotAPIClient
 from .wecomai_utils import WecomAIBotConstants
@@ -38,14 +37,13 @@ class WecomAIBotServer:
         self.api_client = api_client
         self.message_handler = message_handler
 
-        self.app = quart.Quart(__name__)
+        self.app = FastAPIWebhookServer("wecom-ai-bot-webhook")
         self._setup_routes()
 
         self.shutdown_event = asyncio.Event()
 
     def _setup_routes(self) -> None:
-        """设置 Quart 路由"""
-        # 使用 Quart 的 add_url_rule 方法添加路由
+        """设置 FastAPI 路由"""
         self.app.add_url_rule(
             "/webhook/wecom-ai-bot",
             view_func=self.verify_url,
@@ -58,15 +56,15 @@ class WecomAIBotServer:
             methods=["POST"],
         )
 
-    async def verify_url(self):
+    async def verify_url(self, request):
         """内部服务器的 GET 验证入口"""
-        return await self.handle_verify(quart.request)
+        return await self.handle_verify(request)
 
     async def handle_verify(self, request):
         """处理 URL 验证请求，可被统一 webhook 入口复用
 
         Args:
-            request: Quart 请求对象
+            request: FastAPI webhook request 对象
 
         Returns:
             验证响应元组 (content, status_code, headers)
@@ -91,15 +89,15 @@ class WecomAIBotServer:
         result = self.api_client.verify_url(msg_signature, timestamp, nonce, echostr)
         return result, 200, {"Content-Type": "text/plain"}
 
-    async def handle_message(self):
+    async def handle_message(self, request):
         """内部服务器的 POST 消息回调入口"""
-        return await self.handle_callback(quart.request)
+        return await self.handle_callback(request)
 
     async def handle_callback(self, request):
         """处理消息回调，可被统一 webhook 入口复用
 
         Args:
-            request: Quart 请求对象
+            request: FastAPI webhook request 对象
 
         Returns:
             响应元组 (content, status_code, headers)
@@ -186,5 +184,5 @@ class WecomAIBotServer:
         self.shutdown_event.set()
 
     def get_app(self):
-        """获取 Quart 应用实例"""
-        return self.app
+        """获取 FastAPI 应用实例"""
+        return self.app.app
diff --git a/astrbot/core/platform/sources/weixin_official_account/weixin_offacc_adapter.py b/astrbot/core/platform/sources/weixin_official_account/weixin_offacc_adapter.py
index ba459746e..865a9ac9b 100644
--- a/astrbot/core/platform/sources/weixin_official_account/weixin_offacc_adapter.py
+++ b/astrbot/core/platform/sources/weixin_official_account/weixin_offacc_adapter.py
@@ -5,7 +5,6 @@ import time
 from collections.abc import Callable, Coroutine
 from typing import Any, cast
 
-import quart
 from requests import Response
 from wechatpy import WeChatClient, create_reply, parse_message
 from wechatpy.crypto import WeChatCrypto
@@ -25,6 +24,7 @@ from astrbot.api.platform import (
 )
 from astrbot.core import logger
 from astrbot.core.platform.astr_message_event import MessageSesion
+from astrbot.core.platform.webhook_server import FastAPIWebhookServer
 from astrbot.core.utils.astrbot_path import get_astrbot_temp_path
 from astrbot.core.utils.media_utils import MediaResolver
 from astrbot.core.utils.webhook_utils import log_webhook_info
@@ -44,7 +44,7 @@ class WeixinOfficialAccountServer:
         config: dict,
         user_buffer: dict[Any, dict[str, Any]],
     ) -> None:
-        self.server = quart.Quart(__name__)
+        self.server = FastAPIWebhookServer("weixin-official-account-webhook")
         self.port = int(cast(int | str, config.get("port")))
         self.callback_server_host = config.get("callback_server_host", "0.0.0.0")
         self.token = config.get("token")
@@ -73,15 +73,15 @@ class WeixinOfficialAccountServer:
         self.user_buffer: dict[str, dict[str, Any]] = user_buffer  # from_user -> state
         self.active_send_mode = False  # 是否启用主动发送模式，启用后 callback 将直接返回回复内容，无需等待微信回调
 
-    async def verify(self):
+    async def verify(self, request):
         """内部服务器的 GET 验证入口"""
-        return await self.handle_verify(quart.request)
+        return await self.handle_verify(request)
 
     async def handle_verify(self, request) -> str:
         """处理验证请求，可被统一 webhook 入口复用
 
         Args:
-            request: Quart 请求对象
+            request: FastAPI webhook request 对象
 
         Returns:
             验证响应
@@ -105,9 +105,9 @@ class WeixinOfficialAccountServer:
             logger.error("验证请求有效性失败，签名异常，请检查配置。")
             return "err"
 
-    async def callback_command(self):
+    async def callback_command(self, request):
         """内部服务器的 POST 回调入口"""
-        return await self.handle_callback(quart.request)
+        return await self.handle_callback(request)
 
     def _maybe_encrypt(self, xml: str, nonce: str | None, timestamp: str | None) -> str:
         if xml and "<Encrypt>" not in xml and nonce and timestamp:
@@ -129,7 +129,7 @@ class WeixinOfficialAccountServer:
         """处理回调请求，可被统一 webhook 入口复用
 
         Args:
-            request: Quart 请求对象
+            request: FastAPI webhook request 对象
 
         Returns:
             响应内容
diff --git a/astrbot/core/platform/webhook_server.py b/astrbot/core/platform/webhook_server.py
new file mode 100644
index 000000000..57fe52dfc
--- /dev/null
+++ b/astrbot/core/platform/webhook_server.py
@@ -0,0 +1,109 @@
+from __future__ import annotations
+
+import inspect
+from collections.abc import Callable
+from typing import Any
+
+from fastapi import FastAPI, Request
+from fastapi.responses import JSONResponse, Response
+from hypercorn.asyncio import serve
+from hypercorn.config import Config as HyperConfig
+
+
+class WebhookRequest:
+    def __init__(self, request: Request) -> None:
+        self._request = request
+        self.args = request.query_params
+        self.headers = request.headers
+        self.method = request.method
+
+    @property
+    def json(self):
+        return self._request.json()
+
+    async def get_data(self) -> bytes:
+        return await self._request.body()
+
+    async def get_json(self, *, force: bool = False, silent: bool = False):
+        try:
+            return await self._request.json()
+        except Exception:
+            if silent:
+                return None
+            raise
+
+
+def _response_from_result(result: Any):
+    if isinstance(result, Response):
+        return result
+
+    if isinstance(result, tuple):
+        content = result[0] if result else ""
+        status_code = (
+            result[1] if len(result) > 1 and isinstance(result[1], int) else 200
+        )
+        headers = result[2] if len(result) > 2 and isinstance(result[2], dict) else None
+        if isinstance(content, dict | list):
+            return JSONResponse(content, status_code=status_code, headers=headers)
+        return Response(
+            content=content,
+            status_code=status_code,
+            headers=headers,
+            media_type=headers.get("Content-Type") if headers else None,
+        )
+
+    if isinstance(result, dict | list):
+        return JSONResponse(result)
+
+    return result
+
+
+class FastAPIWebhookServer:
+    def __init__(self, name: str) -> None:
+        self.app = FastAPI(title=name, docs_url=None, redoc_url=None, openapi_url=None)
+
+    def add_url_rule(
+        self,
+        path: str,
+        view_func: Callable,
+        methods: list[str] | None = None,
+    ) -> None:
+        has_params = bool(inspect.signature(view_func).parameters)
+
+        async def endpoint(request: Request):
+            if has_params:
+                result = view_func(WebhookRequest(request))
+            else:
+                result = view_func()
+            if inspect.isawaitable(result):
+                result = await result
+            return _response_from_result(result)
+
+        self.app.add_api_route(
+            path,
+            endpoint,
+            methods=methods or ["GET"],
+            include_in_schema=False,
+        )
+
+    def route(self, path: str, methods: list[str] | None = None):
+        def decorator(view_func: Callable):
+            self.add_url_rule(path, view_func, methods)
+            return view_func
+
+        return decorator
+
+    async def run_task(
+        self,
+        *,
+        host: str,
+        port: int,
+        shutdown_trigger: Callable | None = None,
+        **_kwargs,
+    ) -> None:
+        config = HyperConfig()
+        config.bind = [f"{host}:{port}"]
+        await serve(self.app, config, shutdown_trigger=shutdown_trigger)
+
+    async def shutdown(self) -> None:
+        return None
diff --git a/astrbot/core/star/star_manager.py b/astrbot/core/star/star_manager.py
index 98ffc8055..4ebf9a982 100644
--- a/astrbot/core/star/star_manager.py
+++ b/astrbot/core/star/star_manager.py
@@ -60,8 +60,8 @@ except ImportError:
         logger.warning("未安装 watchfiles，无法实现插件的热重载。")
 
 
-class PluginVersionIncompatibleError(Exception):
-    """Raised when plugin astrbot_version is incompatible with current AstrBot."""
+class PluginVersionUnsupportedError(Exception):
+    """Raised when plugin astrbot_version is not supported by current AstrBot."""
 
 
 class PluginDependencyInstallError(Exception):
@@ -1029,9 +1029,9 @@ class PluginManager:
                             )
                         )
                         if not is_valid:
-                            raise PluginVersionIncompatibleError(
+                            raise PluginVersionUnsupportedError(
                                 error_message
-                                or "The plugin is not compatible with the current AstrBot version."
+                                or "The plugin does not support the current AstrBot version."
                             )
 
                     logger.info(metadata)
@@ -1160,9 +1160,9 @@ class PluginManager:
                             )
                         )
                         if not is_valid:
-                            raise PluginVersionIncompatibleError(
+                            raise PluginVersionUnsupportedError(
                                 error_message
-                                or "The plugin is not compatible with the current AstrBot version."
+                                or "The plugin does not support the current AstrBot version."
                             )
 
                     metadata.star_cls = obj
diff --git a/astrbot/core/utils/auth_password.py b/astrbot/core/utils/auth_password.py
index bbb5ff046..e39e038e3 100644
--- a/astrbot/core/utils/auth_password.py
+++ b/astrbot/core/utils/auth_password.py
@@ -10,7 +10,7 @@ _PBKDF2_ITERATIONS = 600_000
 _PBKDF2_SALT_BYTES = 16
 _PBKDF2_ALGORITHM = "pbkdf2_sha256"
 _PBKDF2_FORMAT = f"{_PBKDF2_ALGORITHM}$"
-_LEGACY_MD5_LENGTH = 32
+_MD5_HASH_LENGTH = 32
 _DASHBOARD_PASSWORD_MIN_LENGTH = 8
 _GENERATED_DASHBOARD_PASSWORD_LENGTH = 24
 DEFAULT_DASHBOARD_PASSWORD = "astrbot"
@@ -47,8 +47,8 @@ def hash_dashboard_password(raw_password: str) -> str:
     return f"{_PBKDF2_FORMAT}{_PBKDF2_ITERATIONS}${salt}${digest}"
 
 
-def hash_legacy_dashboard_password(raw_password: str) -> str:
-    """Return legacy MD5 hash for downgrade compatibility only."""
+def hash_md5_dashboard_password(raw_password: str) -> str:
+    """Return the MD5 dashboard password hash kept for stored config fallback."""
     if not isinstance(raw_password, str) or raw_password == "":
         raise ValueError("Password cannot be empty")
     return hashlib.md5(raw_password.encode("utf-8")).hexdigest()
@@ -71,10 +71,10 @@ def validate_dashboard_password(raw_password: str) -> None:
         raise ValueError("Password must include at least one digit")
 
 
-def _is_legacy_md5_hash(stored: str) -> bool:
+def _is_md5_hash(stored: str) -> bool:
     return (
         isinstance(stored, str)
-        and len(stored) == _LEGACY_MD5_LENGTH
+        and len(stored) == _MD5_HASH_LENGTH
         and all(c in "0123456789abcdefABCDEF" for c in stored)
     )
 
@@ -84,13 +84,13 @@ def _is_pbkdf2_hash(stored: str) -> bool:
 
 
 def verify_dashboard_password(stored_hash: str, candidate_password: str) -> bool:
-    """Verify password against legacy md5 or new PBKDF2-SHA256 format."""
+    """Verify password against MD5 or PBKDF2-SHA256 storage."""
     if not isinstance(stored_hash, str) or not isinstance(candidate_password, str):
         return False
 
-    if _is_legacy_md5_hash(stored_hash):
-        # Keep compatibility with existing MD5-based deployments while requiring
-        # the real plaintext password, not the stored MD5 value itself.
+    if _is_md5_hash(stored_hash):
+        # Support existing MD5-based deployments while requiring the real
+        # plaintext password, not the stored MD5 value itself.
         candidate_md5 = hashlib.md5(candidate_password.encode("utf-8")).hexdigest()
         return hmac.compare_digest(stored_hash.lower(), candidate_md5.lower())
 
@@ -121,6 +121,6 @@ def is_default_dashboard_password(stored_hash: str) -> bool:
     return verify_dashboard_password(stored_hash, DEFAULT_DASHBOARD_PASSWORD)
 
 
-def is_legacy_dashboard_password(stored_hash: str) -> bool:
-    """Check whether the password is still stored with legacy MD5."""
-    return _is_legacy_md5_hash(stored_hash)
+def is_md5_dashboard_password(stored_hash: str) -> bool:
+    """Check whether the password is still stored as MD5."""
+    return _is_md5_hash(stored_hash)
diff --git a/astrbot/core/utils/t2i/local_strategy.py b/astrbot/core/utils/t2i/local_strategy.py
index 2fa235129..3d394dccc 100644
--- a/astrbot/core/utils/t2i/local_strategy.py
+++ b/astrbot/core/utils/t2i/local_strategy.py
@@ -1,17 +1,18 @@
-import re
 import os
-import aiohttp
+import re
 import ssl
-import certifi
-from io import BytesIO
-from typing import List, Tuple
 from abc import ABC, abstractmethod
+from io import BytesIO
+
+import aiohttp
+import certifi
+from PIL import Image, ImageDraw, ImageFont
+
 from astrbot.core.config import VERSION
+from astrbot.core.utils.astrbot_path import get_astrbot_data_path
+from astrbot.core.utils.io import save_temp_img
 
 from . import RenderStrategy
-from PIL import ImageFont, Image, ImageDraw
-from astrbot.core.utils.io import save_temp_img
-from astrbot.core.utils.astrbot_path import get_astrbot_data_path
 
 
 class FontManager:
@@ -20,7 +21,7 @@ class FontManager:
     _font_cache = {}
 
     @classmethod
-    def get_font(cls, size: int) -> ImageFont.FreeTypeFont|ImageFont.ImageFont:
+    def get_font(cls, size: int) -> ImageFont.FreeTypeFont | ImageFont.ImageFont:
         """获取指定大小的字体，优先从缓存获取"""
         if size in cls._font_cache:
             return cls._font_cache[size]
@@ -66,7 +67,9 @@ class TextMeasurer:
     """测量文本尺寸的工具类"""
 
     @staticmethod
-    def get_text_size(text: str, font: ImageFont.FreeTypeFont|ImageFont.ImageFont) -> tuple[int, int]:
+    def get_text_size(
+        text: str, font: ImageFont.FreeTypeFont | ImageFont.ImageFont
+    ) -> tuple[int, int]:
         """获取文本的尺寸"""
 
         # 依赖库Pillow>=11.2.1，不再需要考虑<9.0.0
@@ -75,7 +78,7 @@ class TextMeasurer:
 
     @staticmethod
     def split_text_to_fit_width(
-        text: str, font: ImageFont.FreeTypeFont|ImageFont.ImageFont, max_width: int
+        text: str, font: ImageFont.FreeTypeFont | ImageFont.ImageFont, max_width: int
     ) -> list[str]:
         """将文本拆分为多行，确保每行不超过指定宽度"""
         lines = []
@@ -293,7 +296,10 @@ class ItalicTextElement(MarkdownElement):
                     # 倾斜变换，使用仿射变换实现斜体效果
                     # 变换矩阵: [1, 0.2, 0, 0, 1, 0]
                     italic_img = text_img.transform(
-                        text_img.size, Image.Transform.AFFINE, (1, 0.2, 0, 0, 1, 0), Image.Resampling.BICUBIC
+                        text_img.size,
+                        Image.Transform.AFFINE,
+                        (1, 0.2, 0, 0, 1, 0),
+                        Image.Resampling.BICUBIC,
                     )
 
                     # 粘贴到原图像
diff --git a/astrbot/dashboard/__init__.py b/astrbot/dashboard/__init__.py
new file mode 100644
index 000000000..0fa6e0141
--- /dev/null
+++ b/astrbot/dashboard/__init__.py
@@ -0,0 +1 @@
+"""Dashboard HTTP API and service layer."""
diff --git a/astrbot/dashboard/api/__init__.py b/astrbot/dashboard/api/__init__.py
new file mode 100644
index 000000000..261bb9b65
--- /dev/null
+++ b/astrbot/dashboard/api/__init__.py
@@ -0,0 +1 @@
+"""Dashboard HTTP API package."""
diff --git a/astrbot/dashboard/api/api_keys.py b/astrbot/dashboard/api/api_keys.py
new file mode 100644
index 000000000..06b8e4bc9
--- /dev/null
+++ b/astrbot/dashboard/api/api_keys.py
@@ -0,0 +1,147 @@
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, Request
+
+from astrbot.dashboard.responses import ApiError, ok
+from astrbot.dashboard.schemas import ApiKeyCreateRequest, ApiKeyIdRequest
+from astrbot.dashboard.services.api_key_service import (
+    ApiKeyService,
+    ApiKeyServiceError,
+)
+
+from .auth import AuthContext, require_dashboard_user, require_scope
+
+router = APIRouter(tags=["API Keys"])
+legacy_router = APIRouter(
+    prefix="/api/apikey",
+    tags=["Dashboard API Keys"],
+    include_in_schema=False,
+)
+
+
+async def require_system_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "system")
+
+
+def get_service(request: Request) -> ApiKeyService:
+    return request.app.state.services.api_keys
+
+
+def _payload_dict(payload: ApiKeyCreateRequest) -> dict:
+    return payload.model_dump(exclude_none=True)
+
+
+def _raise_api_key_error(exc: ApiKeyServiceError) -> None:
+    raise ApiError(str(exc)) from exc
+
+
+async def _list_api_keys(service: ApiKeyService):
+    try:
+        return ok(await service.list_api_keys())
+    except ApiKeyServiceError as exc:
+        _raise_api_key_error(exc)
+
+
+async def _create_api_key(
+    payload: ApiKeyCreateRequest,
+    *,
+    created_by: str,
+    service: ApiKeyService,
+):
+    try:
+        return ok(
+            await service.create_api_key(
+                _payload_dict(payload),
+                created_by=created_by,
+            )
+        )
+    except ApiKeyServiceError as exc:
+        _raise_api_key_error(exc)
+
+
+async def _revoke_api_key(key_id: str, service: ApiKeyService):
+    try:
+        if not await service.revoke_api_key(key_id):
+            raise ApiKeyServiceError("API key not found")
+        return ok()
+    except ApiKeyServiceError as exc:
+        _raise_api_key_error(exc)
+
+
+async def _delete_api_key(key_id: str, service: ApiKeyService):
+    try:
+        if not await service.delete_api_key(key_id):
+            raise ApiKeyServiceError("API key not found")
+        return ok()
+    except ApiKeyServiceError as exc:
+        _raise_api_key_error(exc)
+
+
+@router.get("/api-keys")
+async def list_api_keys(
+    _auth: AuthContext = Depends(require_system_scope),
+    service: ApiKeyService = Depends(get_service),
+):
+    return await _list_api_keys(service)
+
+
+@router.post("/api-keys")
+async def create_api_key(
+    payload: ApiKeyCreateRequest,
+    auth: AuthContext = Depends(require_system_scope),
+    service: ApiKeyService = Depends(get_service),
+):
+    return await _create_api_key(payload, created_by=auth.username, service=service)
+
+
+@router.post("/api-keys/{key_id}/revoke")
+async def revoke_api_key(
+    key_id: str,
+    _auth: AuthContext = Depends(require_system_scope),
+    service: ApiKeyService = Depends(get_service),
+):
+    return await _revoke_api_key(key_id, service)
+
+
+@router.delete("/api-keys/{key_id}")
+async def delete_api_key(
+    key_id: str,
+    _auth: AuthContext = Depends(require_system_scope),
+    service: ApiKeyService = Depends(get_service),
+):
+    return await _delete_api_key(key_id, service)
+
+
+@legacy_router.get("/list")
+async def list_dashboard_api_keys(
+    _username: str = Depends(require_dashboard_user),
+    service: ApiKeyService = Depends(get_service),
+):
+    return await _list_api_keys(service)
+
+
+@legacy_router.post("/create")
+async def create_dashboard_api_key(
+    payload: ApiKeyCreateRequest,
+    username: str = Depends(require_dashboard_user),
+    service: ApiKeyService = Depends(get_service),
+):
+    return await _create_api_key(payload, created_by=username, service=service)
+
+
+@legacy_router.post("/revoke")
+async def revoke_dashboard_api_key(
+    payload: ApiKeyIdRequest,
+    _username: str = Depends(require_dashboard_user),
+    service: ApiKeyService = Depends(get_service),
+):
+    return await _revoke_api_key(payload.key_id, service)
+
+
+@legacy_router.post("/delete")
+async def delete_dashboard_api_key(
+    payload: ApiKeyIdRequest,
+    _username: str = Depends(require_dashboard_user),
+    service: ApiKeyService = Depends(get_service),
+):
+    return await _delete_api_key(payload.key_id, service)
diff --git a/astrbot/dashboard/api/app.py b/astrbot/dashboard/api/app.py
new file mode 100644
index 000000000..f0b35819a
--- /dev/null
+++ b/astrbot/dashboard/api/app.py
@@ -0,0 +1,195 @@
+from __future__ import annotations
+
+from types import SimpleNamespace
+
+from fastapi import FastAPI, HTTPException, Request
+from fastapi.responses import JSONResponse
+
+from astrbot.core import LogBroker
+from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
+from astrbot.core.db import BaseDatabase
+from astrbot.dashboard.responses import ApiError, error
+from astrbot.dashboard.services.api_key_service import ApiKeyService
+from astrbot.dashboard.services.auth_service import AuthService
+from astrbot.dashboard.services.backup_service import BackupService
+from astrbot.dashboard.services.chat_service import ChatService
+from astrbot.dashboard.services.chatui_project_service import ChatUIProjectService
+from astrbot.dashboard.services.command_service import CommandService
+from astrbot.dashboard.services.config_service import (
+    BotConfigService,
+    ConfigDisplayService,
+    ConfigFileService,
+    ConfigProfileService,
+    ConfigRoutingService,
+    ProviderConfigService,
+)
+from astrbot.dashboard.services.conversation_service import ConversationService
+from astrbot.dashboard.services.cron_service import CronService
+from astrbot.dashboard.services.file_service import FileService
+from astrbot.dashboard.services.knowledge_base_service import KnowledgeBaseService
+from astrbot.dashboard.services.live_chat_service import LiveChatService
+from astrbot.dashboard.services.log_service import LogService
+from astrbot.dashboard.services.open_api_service import OpenApiService
+from astrbot.dashboard.services.persona_service import PersonaService
+from astrbot.dashboard.services.platform_service import PlatformService
+from astrbot.dashboard.services.plugin_page_service import PluginPageService
+from astrbot.dashboard.services.plugin_service import PluginService
+from astrbot.dashboard.services.session_management_service import (
+    SessionManagementService,
+)
+from astrbot.dashboard.services.skills_service import SkillsService
+from astrbot.dashboard.services.stat_service import StatService
+from astrbot.dashboard.services.subagent_service import SubAgentService
+from astrbot.dashboard.services.t2i_service import T2iService
+from astrbot.dashboard.services.tools_service import ToolsService
+from astrbot.dashboard.services.update_service import (
+    DEMO_MODE,
+    UpdateService,
+    call_check_migration_needed_v4,
+    call_do_migration_v4,
+    call_download_dashboard,
+    call_get_dashboard_version,
+    call_pip_install,
+)
+
+from .api_keys import legacy_router as legacy_api_keys_router
+from .auth import legacy_router as legacy_auth_router
+from .backups import legacy_router as legacy_backups_router
+from .bots import legacy_router as legacy_bots_router
+from .chat import legacy_router as legacy_chat_router
+from .chat_projects import legacy_router as legacy_chat_projects_router
+from .config_profiles import legacy_router as legacy_config_profiles_router
+from .conversations import legacy_router as legacy_conversations_router
+from .cron import legacy_router as legacy_cron_router
+from .extensions import legacy_router as legacy_extensions_router
+from .files import legacy_router as legacy_files_router
+from .knowledge_bases import legacy_router as legacy_knowledge_bases_router
+from .live_chat import legacy_router as legacy_live_chat_router
+from .logs import legacy_router as legacy_logs_router
+from .personas import legacy_router as legacy_personas_router
+from .platform import legacy_router as legacy_platform_router
+from .plugins import legacy_router as legacy_plugins_router
+from .providers import legacy_router as legacy_providers_router
+from .router import API_V1_PREFIX, build_api_router
+from .sessions import legacy_router as legacy_sessions_router
+from .skills import legacy_router as legacy_skills_router
+from .static_files import router as static_files_router
+from .stats import legacy_router as legacy_stats_router
+from .subagents import legacy_router as legacy_subagents_router
+from .t2i import legacy_router as legacy_t2i_router
+from .tools import legacy_router as legacy_tools_router
+from .updates import legacy_router as legacy_updates_router
+
+CLEAR_SITE_DATA_HEADERS = {"Clear-Site-Data": '"cache"'}
+
+
+def create_dashboard_asgi_app(
+    *,
+    core_lifecycle: AstrBotCoreLifecycle,
+    db: BaseDatabase,
+    jwt_secret: str,
+    static_folder: str | None = None,
+) -> FastAPI:
+    app = FastAPI(
+        title="AstrBot OpenAPI",
+        version="1.0.0",
+        openapi_url=f"{API_V1_PREFIX}/openapi.json",
+        docs_url=f"{API_V1_PREFIX}/docs",
+        redoc_url=f"{API_V1_PREFIX}/redoc",
+    )
+    app.state.core_lifecycle = core_lifecycle
+    app.state.db = db
+    app.state.jwt_secret = jwt_secret
+    app.state.dashboard_static_folder = static_folder
+    log_broker = getattr(core_lifecycle, "log_broker", None) or LogBroker()
+    app.state.services = SimpleNamespace(
+        config_profiles=ConfigProfileService(core_lifecycle, db),
+        config_display=ConfigDisplayService(core_lifecycle),
+        config_files=ConfigFileService(core_lifecycle),
+        config_routes=ConfigRoutingService(core_lifecycle),
+        api_keys=ApiKeyService(db),
+        auth=AuthService(db, core_lifecycle.astrbot_config),
+        backups=BackupService(db, core_lifecycle),
+        chat=ChatService(db, core_lifecycle),
+        chat_projects=ChatUIProjectService(db),
+        commands=CommandService(core_lifecycle.astrbot_config, core_lifecycle),
+        conversations=ConversationService(db, core_lifecycle),
+        cron=CronService(core_lifecycle),
+        files=FileService(),
+        knowledge_bases=KnowledgeBaseService(core_lifecycle),
+        live_chat=LiveChatService(db, core_lifecycle),
+        logs=LogService(log_broker, core_lifecycle.astrbot_config),
+        bots=BotConfigService(core_lifecycle),
+        platforms=PlatformService(core_lifecycle),
+        providers=ProviderConfigService(core_lifecycle),
+        personas=PersonaService(core_lifecycle),
+        plugins=PluginService(core_lifecycle, core_lifecycle.plugin_manager),
+        plugin_pages=PluginPageService(
+            core_lifecycle.plugin_manager,
+            core_lifecycle=core_lifecycle,
+        ),
+        open_api=OpenApiService(db, core_lifecycle),
+        sessions=SessionManagementService(core_lifecycle, db),
+        skills=SkillsService(core_lifecycle),
+        stats=StatService(db, core_lifecycle, core_lifecycle.astrbot_config),
+        subagents=SubAgentService(core_lifecycle),
+        t2i=T2iService(core_lifecycle),
+        tools=ToolsService(core_lifecycle),
+        updates=UpdateService(
+            core_lifecycle.astrbot_updator,
+            core_lifecycle,
+            download_dashboard_func=call_download_dashboard,
+            get_dashboard_version_func=call_get_dashboard_version,
+            pip_install_func=call_pip_install,
+            check_migration_needed_func=call_check_migration_needed_v4,
+            do_migration_func=call_do_migration_v4,
+            demo_mode=DEMO_MODE,
+            clear_site_data_headers=CLEAR_SITE_DATA_HEADERS,
+        ),
+    )
+
+    @app.exception_handler(ApiError)
+    async def api_error_handler(_request: Request, exc: ApiError):
+        return JSONResponse(
+            error(exc.message, exc.data),
+            status_code=exc.status_code,
+        )
+
+    @app.exception_handler(ValueError)
+    async def value_error_handler(_request: Request, exc: ValueError):
+        return JSONResponse(error(str(exc)), status_code=400)
+
+    @app.exception_handler(HTTPException)
+    async def http_error_handler(_request: Request, exc: HTTPException):
+        detail = exc.detail if isinstance(exc.detail, str) else "Request failed"
+        return JSONResponse(error(detail), status_code=exc.status_code)
+
+    # Legacy dashboard routes keep old /api/* callers working without entering OpenAPI.
+    app.include_router(legacy_api_keys_router)
+    app.include_router(legacy_auth_router)
+    app.include_router(legacy_backups_router)
+    app.include_router(legacy_config_profiles_router)
+    app.include_router(legacy_bots_router)
+    app.include_router(legacy_providers_router)
+    app.include_router(legacy_chat_router)
+    app.include_router(legacy_chat_projects_router)
+    app.include_router(legacy_conversations_router)
+    app.include_router(legacy_cron_router)
+    app.include_router(legacy_extensions_router)
+    app.include_router(legacy_files_router)
+    app.include_router(legacy_knowledge_bases_router)
+    app.include_router(legacy_live_chat_router)
+    app.include_router(legacy_logs_router)
+    app.include_router(legacy_sessions_router)
+    app.include_router(legacy_skills_router)
+    app.include_router(legacy_stats_router)
+    app.include_router(legacy_subagents_router)
+    app.include_router(legacy_tools_router)
+    app.include_router(legacy_platform_router)
+    app.include_router(legacy_plugins_router)
+    app.include_router(legacy_t2i_router)
+    app.include_router(legacy_personas_router)
+    app.include_router(legacy_updates_router)
+    app.include_router(build_api_router())
+    app.include_router(static_files_router)
+    return app
diff --git a/astrbot/dashboard/api/auth.py b/astrbot/dashboard/api/auth.py
new file mode 100644
index 000000000..fda03f4a3
--- /dev/null
+++ b/astrbot/dashboard/api/auth.py
@@ -0,0 +1,493 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+import jwt
+from fastapi import APIRouter, Depends, Request
+from fastapi.responses import JSONResponse
+
+from astrbot.dashboard.responses import ApiError
+from astrbot.dashboard.schemas import (
+    AccountUpdateRequest,
+    AuthSetupRequest,
+    LoginRequest,
+    TotpSetupRequest,
+)
+from astrbot.dashboard.services.api_key_service import ApiKeyService
+from astrbot.dashboard.services.auth_service import (
+    ALL_OPEN_API_SCOPES,
+    DASHBOARD_JWT_COOKIE_MAX_AGE,
+    DASHBOARD_JWT_COOKIE_NAME,
+    OPEN_API_SCOPE_INCLUDES,
+    TOTP_TRUSTED_DEVICE_COOKIE_NAME,
+    TOTP_TRUSTED_DEVICE_MAX_AGE,
+    AuthService,
+    AuthServiceResult,
+)
+
+router = APIRouter(tags=["Auth"])
+legacy_router = APIRouter(
+    prefix="/api/auth",
+    tags=["Dashboard Auth"],
+    include_in_schema=False,
+)
+
+
+@dataclass(frozen=True)
+class AuthContext:
+    username: str
+    scopes: list[str]
+    api_key_id: str | None = None
+    via: str = "jwt"
+
+
+def _extract_raw_api_key(request: Request) -> str | None:
+    auth_header = request.headers.get("Authorization", "").strip()
+    if auth_header.startswith("Bearer "):
+        return None
+    if auth_header.startswith("ApiKey "):
+        return auth_header.removeprefix("ApiKey ").strip()
+    if key := request.query_params.get("api_key"):
+        return key.strip()
+    if key := request.query_params.get("key"):
+        return key.strip()
+    if key := request.headers.get("X-API-Key"):
+        return key.strip()
+    return None
+
+
+def _get_dashboard_state_username(request: Request) -> str | None:
+    dashboard_g = getattr(request.state, "dashboard_g", None)
+    if dashboard_g is None:
+        return None
+
+    username = getattr(dashboard_g, "username", None)
+    if username is None and hasattr(dashboard_g, "get"):
+        username = dashboard_g.get("username")
+    if isinstance(username, str) and username.strip():
+        return username
+    return None
+
+
+def _extract_dashboard_jwt(request: Request) -> str | None:
+    auth_header = request.headers.get("Authorization", "").strip()
+    if auth_header.startswith("Bearer "):
+        token = auth_header.removeprefix("Bearer ").strip()
+        if token:
+            return token
+
+    cookie_token = request.cookies.get(DASHBOARD_JWT_COOKIE_NAME, "").strip()
+    if cookie_token:
+        return cookie_token
+    return None
+
+
+async def require_dashboard_user(request: Request) -> str:
+    if username := _get_dashboard_state_username(request):
+        return username
+
+    token = _extract_dashboard_jwt(request)
+    if not token:
+        raise ApiError("未授权", status_code=401)
+
+    try:
+        payload = jwt.decode(
+            token,
+            request.app.state.jwt_secret,
+            algorithms=["HS256"],
+        )
+    except jwt.ExpiredSignatureError as exc:
+        raise ApiError("Token 过期", status_code=401) from exc
+    except jwt.InvalidTokenError as exc:
+        raise ApiError("Token 无效", status_code=401) from exc
+
+    username = payload.get("username")
+    if not isinstance(username, str) or not username.strip():
+        raise ApiError("Token 无效", status_code=401)
+    return username
+
+
+async def _require_api_key_scope(
+    request: Request,
+    raw_key: str,
+    scope: str,
+) -> AuthContext:
+    if scope not in ALL_OPEN_API_SCOPES:
+        raise ApiError("Insufficient API key scope", status_code=403)
+
+    key_hash = ApiKeyService.hash_key(raw_key)
+    api_key = await request.app.state.db.get_active_api_key_by_hash(key_hash)
+    if not api_key:
+        raise ApiError("Invalid API key", status_code=401)
+    scopes = (
+        [str(scope) for scope in api_key.scopes]
+        if isinstance(api_key.scopes, list)
+        else [str(scope) for scope in ALL_OPEN_API_SCOPES]
+    )
+    if (
+        "*" not in scopes
+        and scope not in scopes
+        and not any(
+            scope in OPEN_API_SCOPE_INCLUDES.get(api_key_scope, ())
+            for api_key_scope in scopes
+        )
+    ):
+        raise ApiError("Insufficient API key scope", status_code=403)
+    await request.app.state.db.touch_api_key(api_key.key_id)
+    return AuthContext(
+        username=f"api_key:{api_key.key_id}",
+        scopes=scopes,
+        api_key_id=api_key.key_id,
+        via="api_key",
+    )
+
+
+async def require_scope(request: Request, scope: str) -> AuthContext:
+    raw_key = _extract_raw_api_key(request)
+    if raw_key:
+        return await _require_api_key_scope(request, raw_key, scope)
+
+    token = _extract_dashboard_jwt(request)
+    if not token:
+        raise ApiError("Missing API key", status_code=401)
+    try:
+        payload = jwt.decode(
+            token,
+            request.app.state.jwt_secret,
+            algorithms=["HS256"],
+        )
+    except jwt.ExpiredSignatureError as exc:
+        raise ApiError("Token expired", status_code=401) from exc
+    except jwt.InvalidTokenError as exc:
+        auth_header = request.headers.get("Authorization", "").strip()
+        if auth_header.startswith("Bearer "):
+            try:
+                return await _require_api_key_scope(request, token, scope)
+            except ApiError as api_key_exc:
+                raise api_key_exc from exc
+        raise ApiError("Invalid token", status_code=401) from exc
+
+    username = payload.get("username")
+    if not isinstance(username, str) or not username.strip():
+        raise ApiError("Invalid token", status_code=401)
+    return AuthContext(username=username, scopes=["*"], via="jwt")
+
+
+def get_auth_service(request: Request) -> AuthService:
+    return request.app.state.services.auth
+
+
+def _payload(payload) -> dict:
+    return payload.model_dump(exclude_none=True)
+
+
+def _auth_result_payload(result: AuthServiceResult) -> dict:
+    data = result.data if result.data is not None else {}
+    payload = {
+        "status": result.status,
+        "message": result.message,
+        "data": data,
+    }
+    if result.status == "error" and result.data is None:
+        payload["data"] = None
+    return payload
+
+
+def _use_secure_dashboard_jwt_cookie(request: Request) -> bool:
+    adapter = getattr(request.app.state, "dashboard_app_adapter", None)
+    adapter_config = getattr(adapter, "config", {}) if adapter is not None else {}
+    default_secure = not bool(getattr(adapter, "debug", False)) and not bool(
+        getattr(adapter, "testing", False)
+    )
+    return bool(
+        adapter_config.get(
+            "DASHBOARD_JWT_COOKIE_SECURE",
+            default_secure,
+        )
+    )
+
+
+def _set_dashboard_jwt_cookie(
+    request: Request,
+    response: JSONResponse,
+    token: str,
+) -> None:
+    response.set_cookie(
+        DASHBOARD_JWT_COOKIE_NAME,
+        token,
+        max_age=DASHBOARD_JWT_COOKIE_MAX_AGE,
+        httponly=True,
+        samesite="strict",
+        secure=_use_secure_dashboard_jwt_cookie(request),
+        path="/",
+    )
+
+
+def _clear_dashboard_jwt_cookie(request: Request, response: JSONResponse) -> None:
+    response.delete_cookie(
+        DASHBOARD_JWT_COOKIE_NAME,
+        httponly=True,
+        samesite="strict",
+        secure=_use_secure_dashboard_jwt_cookie(request),
+        path="/",
+    )
+
+
+def _set_trusted_device_cookie(
+    request: Request,
+    response: JSONResponse,
+    token: str,
+) -> None:
+    response.set_cookie(
+        TOTP_TRUSTED_DEVICE_COOKIE_NAME,
+        token,
+        max_age=TOTP_TRUSTED_DEVICE_MAX_AGE,
+        httponly=True,
+        samesite="strict",
+        secure=_use_secure_dashboard_jwt_cookie(request),
+        path="/api/auth",
+    )
+
+
+def _auth_service_response(
+    request: Request,
+    result: AuthServiceResult,
+) -> JSONResponse:
+    response = JSONResponse(
+        _auth_result_payload(result),
+        status_code=result.status_code,
+    )
+    if result.jwt_token:
+        _set_dashboard_jwt_cookie(request, response, result.jwt_token)
+    if result.trusted_device_token:
+        _set_trusted_device_cookie(request, response, result.trusted_device_token)
+    return response
+
+
+def _has_auth_credentials(request: Request) -> bool:
+    auth_header = request.headers.get("Authorization", "")
+    return bool(
+        auth_header.startswith(("Bearer ", "ApiKey "))
+        or request.query_params.get("api_key")
+        or request.query_params.get("key")
+        or request.headers.get("X-API-Key")
+    )
+
+
+async def require_system_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "system")
+
+
+async def optional_system_auth(request: Request) -> AuthContext | None:
+    if not _has_auth_credentials(request):
+        return None
+    return await require_system_scope(request)
+
+
+async def _login(
+    request: Request,
+    payload: LoginRequest,
+    service: AuthService,
+):
+    result = await service.login(
+        _payload(payload),
+        trusted_device_cookie_token=request.cookies.get(
+            TOTP_TRUSTED_DEVICE_COOKIE_NAME,
+            "",
+        ).strip(),
+    )
+    return _auth_service_response(
+        request,
+        result,
+    )
+
+
+async def _setup_status(service: AuthService):
+    return _auth_service_response_from_result(await service.setup_status())
+
+
+def _auth_service_response_from_result(result: AuthServiceResult) -> JSONResponse:
+    return JSONResponse(
+        _auth_result_payload(result),
+        status_code=result.status_code,
+    )
+
+
+async def _setup(
+    request: Request,
+    payload: AuthSetupRequest,
+    service: AuthService,
+    auth: AuthContext | None,
+):
+    if auth is None:
+        result = await service.setup(_payload(payload))
+    else:
+        result = await service.setup_authenticated(_payload(payload), auth.username)
+    return _auth_service_response(
+        request,
+        result,
+    )
+
+
+async def _totp_setup(
+    request: Request,
+    payload: TotpSetupRequest,
+    service: AuthService,
+):
+    return _auth_service_response(
+        request,
+        await service.totp_setup(_payload(payload)),
+    )
+
+
+async def _totp_recovery(
+    request: Request,
+    service: AuthService,
+):
+    return _auth_service_response(request, await service.totp_recovery())
+
+
+async def _update_account(
+    request: Request,
+    payload: AccountUpdateRequest,
+    service: AuthService,
+):
+    return _auth_service_response(
+        request,
+        await service.edit_account(_payload(payload)),
+    )
+
+
+@router.post("/auth/login")
+async def login(
+    request: Request,
+    payload: LoginRequest,
+    service: AuthService = Depends(get_auth_service),
+):
+    return await _login(request, payload, service)
+
+
+@legacy_router.post("/login")
+async def dashboard_login(
+    request: Request,
+    payload: LoginRequest,
+    service: AuthService = Depends(get_auth_service),
+):
+    return await _login(request, payload, service)
+
+
+@router.post("/auth/logout")
+async def logout(request: Request):
+    response = JSONResponse(
+        {"status": "ok", "message": "已退出登录", "data": {}},
+        status_code=200,
+    )
+    _clear_dashboard_jwt_cookie(request, response)
+    return response
+
+
+@legacy_router.post("/logout")
+async def dashboard_logout(request: Request):
+    return await logout(request)
+
+
+@router.get("/auth/setup-status")
+async def setup_status(
+    service: AuthService = Depends(get_auth_service),
+):
+    return _auth_service_response_from_result(await service.setup_status())
+
+
+@legacy_router.get("/setup-status")
+async def dashboard_setup_status(
+    service: AuthService = Depends(get_auth_service),
+):
+    return _auth_service_response_from_result(await service.setup_status())
+
+
+@router.post("/auth/setup")
+async def setup(
+    request: Request,
+    payload: AuthSetupRequest,
+    auth: AuthContext | None = Depends(optional_system_auth),
+    service: AuthService = Depends(get_auth_service),
+):
+    return await _setup(request, payload, service, auth)
+
+
+@legacy_router.post("/setup")
+async def dashboard_setup(
+    request: Request,
+    payload: AuthSetupRequest,
+    service: AuthService = Depends(get_auth_service),
+):
+    return await _setup(request, payload, service, None)
+
+
+@legacy_router.post("/setup-authenticated")
+async def dashboard_setup_authenticated(
+    request: Request,
+    payload: AuthSetupRequest,
+    username: str = Depends(require_dashboard_user),
+    service: AuthService = Depends(get_auth_service),
+):
+    auth = AuthContext(username=username, scopes=["*"], via="jwt")
+    return await _setup(request, payload, service, auth)
+
+
+@router.post("/auth/totp/setup")
+async def totp_setup(
+    request: Request,
+    payload: TotpSetupRequest,
+    _auth: AuthContext = Depends(require_system_scope),
+    service: AuthService = Depends(get_auth_service),
+):
+    return await _totp_setup(request, payload, service)
+
+
+@legacy_router.post("/totp/setup")
+async def dashboard_totp_setup(
+    request: Request,
+    payload: TotpSetupRequest,
+    _username: str = Depends(require_dashboard_user),
+    service: AuthService = Depends(get_auth_service),
+):
+    return await _totp_setup(request, payload, service)
+
+
+@router.post("/auth/totp/recovery")
+async def totp_recovery(
+    request: Request,
+    _auth: AuthContext = Depends(require_system_scope),
+    service: AuthService = Depends(get_auth_service),
+):
+    return await _totp_recovery(request, service)
+
+
+@legacy_router.post("/totp/recovery")
+async def dashboard_totp_recovery(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: AuthService = Depends(get_auth_service),
+):
+    return await _totp_recovery(request, service)
+
+
+@router.patch("/auth/account")
+async def update_account(
+    request: Request,
+    payload: AccountUpdateRequest,
+    _auth: AuthContext = Depends(require_system_scope),
+    service: AuthService = Depends(get_auth_service),
+):
+    return await _update_account(request, payload, service)
+
+
+@legacy_router.post("/account/edit")
+async def dashboard_update_account(
+    request: Request,
+    payload: AccountUpdateRequest,
+    _username: str = Depends(require_dashboard_user),
+    service: AuthService = Depends(get_auth_service),
+):
+    return await _update_account(request, payload, service)
diff --git a/astrbot/dashboard/api/backups.py b/astrbot/dashboard/api/backups.py
new file mode 100644
index 000000000..c741359d3
--- /dev/null
+++ b/astrbot/dashboard/api/backups.py
@@ -0,0 +1,419 @@
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, File, Form, Query, Request, UploadFile
+from fastapi.responses import FileResponse
+
+from astrbot.core import logger
+from astrbot.dashboard.async_utils import run_maybe_async
+from astrbot.dashboard.responses import error, ok
+from astrbot.dashboard.schemas import (
+    BackupImportRequest,
+    BackupRenameRequest,
+    BackupUploadInitRequest,
+    BackupUploadSessionRequest,
+)
+from astrbot.dashboard.services.backup_service import (
+    BackupService,
+    BackupServiceError,
+)
+
+from .auth import AuthContext, require_dashboard_user, require_scope
+
+router = APIRouter(tags=["Backups"])
+legacy_router = APIRouter(
+    prefix="/api/backup",
+    tags=["Dashboard Backups"],
+    include_in_schema=False,
+)
+
+
+def get_service(request: Request) -> BackupService:
+    return request.app.state.services.backups
+
+
+async def require_system_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "system")
+
+
+def _model_dict(payload) -> dict:
+    return payload.model_dump(exclude_none=True)
+
+
+def _ok_result(result):
+    if isinstance(result, tuple):
+        data, message = result
+        return ok(data, message)
+    return ok(result)
+
+
+def _safe_backup_filename(filename: str | None) -> str:
+    if not filename:
+        raise BackupServiceError("缺少参数 filename")
+    if ".." in filename or "/" in filename or "\\" in filename:
+        raise BackupServiceError("文件名包含非法路径字符")
+    return filename
+
+
+async def _json_or_empty(request: Request) -> dict:
+    try:
+        data = await request.json()
+    except Exception:
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+async def _run(operation, *, prefix: str):
+    try:
+        result = await run_maybe_async(operation)
+        return _ok_result(result)
+    except BackupServiceError as exc:
+        return error(str(exc))
+    except Exception as exc:
+        logger.error("%s: %s", prefix, exc, exc_info=True)
+        return error(f"{prefix}: {exc!s}")
+
+
+def _download_response(download) -> FileResponse:
+    return FileResponse(
+        download.path,
+        filename=download.filename,
+        media_type="application/zip",
+    )
+
+
+def _download_backup(
+    *,
+    filename: str | None,
+    token: str | None,
+    service: BackupService,
+):
+    try:
+        filename = _safe_backup_filename(filename)
+        return _download_response(
+            service.prepare_download(
+                filename=filename,
+                token=token,
+                jwt_secret=service.config.get("dashboard", {}).get("jwt_secret"),
+            )
+        )
+    except BackupServiceError as exc:
+        return error(str(exc))
+    except Exception as exc:
+        logger.error("下载备份失败: %s", exc, exc_info=True)
+        return error(f"下载备份失败: {exc!s}")
+
+
+@router.get("/backups")
+async def list_backups(
+    page: int = Query(default=1),
+    page_size: int = Query(default=20),
+    _auth: AuthContext = Depends(require_system_scope),
+    service: BackupService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.list_backups(page=page, page_size=page_size),
+        prefix="获取备份列表失败",
+    )
+
+
+@legacy_router.get("/list")
+async def list_dashboard_backups(
+    page: int = Query(default=1),
+    page_size: int = Query(default=20),
+    _username: str = Depends(require_dashboard_user),
+    service: BackupService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.list_backups(page=page, page_size=page_size),
+        prefix="获取备份列表失败",
+    )
+
+
+@router.post("/backups")
+async def create_backup(
+    _auth: AuthContext = Depends(require_system_scope),
+    service: BackupService = Depends(get_service),
+):
+    return await _run(service.export_backup, prefix="创建备份失败")
+
+
+@legacy_router.post("/export")
+async def export_dashboard_backup(
+    _username: str = Depends(require_dashboard_user),
+    service: BackupService = Depends(get_service),
+):
+    return await _run(service.export_backup, prefix="创建备份失败")
+
+
+@router.post("/backups/upload")
+async def upload_backup(
+    file: UploadFile = File(...),
+    _auth: AuthContext = Depends(require_system_scope),
+    service: BackupService = Depends(get_service),
+):
+    return await _run(lambda: service.upload_backup(file), prefix="上传备份文件失败")
+
+
+@legacy_router.post("/upload")
+async def upload_dashboard_backup(
+    file: UploadFile = File(...),
+    _username: str = Depends(require_dashboard_user),
+    service: BackupService = Depends(get_service),
+):
+    return await _run(lambda: service.upload_backup(file), prefix="上传备份文件失败")
+
+
+@router.post("/backups/upload/init")
+async def init_backup_upload(
+    payload: BackupUploadInitRequest,
+    _auth: AuthContext = Depends(require_system_scope),
+    service: BackupService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.upload_init(_model_dict(payload)),
+        prefix="初始化分片上传失败",
+    )
+
+
+@legacy_router.post("/upload/init")
+async def init_dashboard_backup_upload(
+    payload: BackupUploadInitRequest,
+    _username: str = Depends(require_dashboard_user),
+    service: BackupService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.upload_init(_model_dict(payload)),
+        prefix="初始化分片上传失败",
+    )
+
+
+@router.post("/backups/upload/chunk")
+async def upload_backup_chunk(
+    upload_id: str = Form(...),
+    chunk_index: str = Form(...),
+    chunk: UploadFile = File(...),
+    _auth: AuthContext = Depends(require_system_scope),
+    service: BackupService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.upload_chunk(
+            upload_id=upload_id,
+            chunk_index_str=chunk_index,
+            chunk_file=chunk,
+        ),
+        prefix="上传分片失败",
+    )
+
+
+@legacy_router.post("/upload/chunk")
+async def upload_dashboard_backup_chunk(
+    upload_id: str = Form(...),
+    chunk_index: str = Form(...),
+    chunk: UploadFile = File(...),
+    _username: str = Depends(require_dashboard_user),
+    service: BackupService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.upload_chunk(
+            upload_id=upload_id,
+            chunk_index_str=chunk_index,
+            chunk_file=chunk,
+        ),
+        prefix="上传分片失败",
+    )
+
+
+@router.post("/backups/upload/complete")
+async def complete_backup_upload(
+    payload: BackupUploadSessionRequest,
+    _auth: AuthContext = Depends(require_system_scope),
+    service: BackupService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.upload_complete(_model_dict(payload)),
+        prefix="完成分片上传失败",
+    )
+
+
+@legacy_router.post("/upload/complete")
+async def complete_dashboard_backup_upload(
+    payload: BackupUploadSessionRequest,
+    _username: str = Depends(require_dashboard_user),
+    service: BackupService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.upload_complete(_model_dict(payload)),
+        prefix="完成分片上传失败",
+    )
+
+
+@router.post("/backups/upload/abort")
+async def abort_backup_upload(
+    payload: BackupUploadSessionRequest,
+    _auth: AuthContext = Depends(require_system_scope),
+    service: BackupService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.upload_abort(_model_dict(payload)),
+        prefix="取消上传失败",
+    )
+
+
+@legacy_router.post("/upload/abort")
+async def abort_dashboard_backup_upload(
+    payload: BackupUploadSessionRequest,
+    _username: str = Depends(require_dashboard_user),
+    service: BackupService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.upload_abort(_model_dict(payload)),
+        prefix="取消上传失败",
+    )
+
+
+@router.get("/backups/tasks/{task_id}")
+async def get_backup_progress(
+    task_id: str,
+    _auth: AuthContext = Depends(require_system_scope),
+    service: BackupService = Depends(get_service),
+):
+    return await _run(lambda: service.get_progress(task_id), prefix="获取任务进度失败")
+
+
+@legacy_router.get("/progress")
+async def get_dashboard_backup_progress(
+    task_id: str | None = Query(default=None),
+    _username: str = Depends(require_dashboard_user),
+    service: BackupService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.get_progress(task_id),
+        prefix="获取任务进度失败",
+    )
+
+
+@router.get("/backups/{filename:path}")
+async def download_backup(
+    filename: str,
+    token: str | None = Query(default=None),
+    service: BackupService = Depends(get_service),
+):
+    return _download_backup(filename=filename, token=token, service=service)
+
+
+@legacy_router.get("/download")
+async def download_dashboard_backup(
+    filename: str | None = Query(default=None),
+    token: str | None = Query(default=None),
+    service: BackupService = Depends(get_service),
+):
+    return _download_backup(filename=filename, token=token, service=service)
+
+
+@router.patch("/backups/{filename:path}")
+async def rename_backup(
+    filename: str,
+    payload: BackupRenameRequest,
+    _auth: AuthContext = Depends(require_system_scope),
+    service: BackupService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.rename_backup(
+            {"filename": _safe_backup_filename(filename), **_model_dict(payload)}
+        ),
+        prefix="重命名备份失败",
+    )
+
+
+@legacy_router.post("/rename")
+async def rename_dashboard_backup(
+    payload: BackupRenameRequest,
+    filename: str | None = Query(default=None),
+    _username: str = Depends(require_dashboard_user),
+    service: BackupService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.rename_backup({"filename": filename, **_model_dict(payload)}),
+        prefix="重命名备份失败",
+    )
+
+
+@router.delete("/backups/{filename:path}")
+async def delete_backup(
+    filename: str,
+    _auth: AuthContext = Depends(require_system_scope),
+    service: BackupService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.delete_backup({"filename": _safe_backup_filename(filename)}),
+        prefix="删除备份失败",
+    )
+
+
+@legacy_router.post("/delete")
+async def delete_dashboard_backup(
+    request: Request,
+    filename: str | None = Query(default=None),
+    _username: str = Depends(require_dashboard_user),
+    service: BackupService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(
+        lambda: service.delete_backup({"filename": filename, **body}),
+        prefix="删除备份失败",
+    )
+
+
+@router.post("/backups/{filename:path}/check")
+async def check_backup(
+    filename: str,
+    _auth: AuthContext = Depends(require_system_scope),
+    service: BackupService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.check_backup({"filename": _safe_backup_filename(filename)}),
+        prefix="预检查备份文件失败",
+    )
+
+
+@legacy_router.post("/check")
+async def check_dashboard_backup(
+    request: Request,
+    filename: str | None = Query(default=None),
+    _username: str = Depends(require_dashboard_user),
+    service: BackupService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(
+        lambda: service.check_backup({"filename": filename, **body}),
+        prefix="预检查备份文件失败",
+    )
+
+
+@router.post("/backups/{filename:path}/import")
+async def import_backup(
+    filename: str,
+    payload: BackupImportRequest,
+    _auth: AuthContext = Depends(require_system_scope),
+    service: BackupService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.import_backup(
+            {"filename": _safe_backup_filename(filename), **_model_dict(payload)}
+        ),
+        prefix="导入备份失败",
+    )
+
+
+@legacy_router.post("/import")
+async def import_dashboard_backup(
+    request: Request,
+    filename: str | None = Query(default=None),
+    _username: str = Depends(require_dashboard_user),
+    service: BackupService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(
+        lambda: service.import_backup({"filename": filename, **body}),
+        prefix="导入备份失败",
+    )
diff --git a/astrbot/dashboard/api/bots.py b/astrbot/dashboard/api/bots.py
new file mode 100644
index 000000000..b96c8f378
--- /dev/null
+++ b/astrbot/dashboard/api/bots.py
@@ -0,0 +1,253 @@
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, Query, Request
+
+from astrbot.dashboard.responses import error, ok
+from astrbot.dashboard.schemas import BotConfigRequest, EnabledPatch
+from astrbot.dashboard.services.config_service import BotConfigService
+
+from .auth import AuthContext, require_scope
+
+router = APIRouter(tags=["Bots"])
+legacy_router = APIRouter(
+    prefix="/api/config/platform",
+    tags=["Dashboard Bots"],
+    include_in_schema=False,
+)
+
+
+async def require_bot_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "bot")
+
+
+def get_service(request: Request) -> BotConfigService:
+    return request.app.state.services.bots
+
+
+async def _json_or_empty(request: Request) -> dict:
+    try:
+        data = await request.json()
+    except Exception:
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def _required_text(value: object, name: str) -> str:
+    text = str(value or "").strip()
+    if not text:
+        raise ValueError(f"Missing key: {name}")
+    return text
+
+
+def _config_from_body(body: dict) -> dict:
+    config = body.get("config")
+    if isinstance(config, dict):
+        return config
+    return {
+        key: value
+        for key, value in body.items()
+        if key not in {"bot_id", "config", "enabled"}
+    }
+
+
+def _alias_error(message: str):
+    return error(message)
+
+
+@router.get("/bot-types")
+async def list_bot_types(
+    _auth: AuthContext = Depends(require_bot_scope),
+    service: BotConfigService = Depends(get_service),
+):
+    return ok(service.list_bot_types())
+
+
+@router.get("/bots")
+async def list_bots(
+    enabled: bool | None = Query(default=None),
+    type_: str | None = Query(default=None, alias="type"),
+    _auth: AuthContext = Depends(require_bot_scope),
+    service: BotConfigService = Depends(get_service),
+):
+    return ok(service.list_bots(enabled=enabled, type_=type_))
+
+
+@router.post("/bots")
+async def create_bot(
+    payload: BotConfigRequest,
+    _auth: AuthContext = Depends(require_bot_scope),
+    service: BotConfigService = Depends(get_service),
+):
+    await service.create_bot(payload.to_dashboard_config())
+    return ok(message="新增平台配置成功~")
+
+
+@router.get("/bots/stats")
+async def list_bot_stats(
+    _auth: AuthContext = Depends(require_bot_scope),
+    service: BotConfigService = Depends(get_service),
+):
+    return ok(service.get_bot_stats())
+
+
+@router.get("/bots/by-id")
+async def get_bot_by_id(
+    bot_id: str = Query(...),
+    _auth: AuthContext = Depends(require_bot_scope),
+    service: BotConfigService = Depends(get_service),
+):
+    return ok(service.get_bot(bot_id))
+
+
+@router.put("/bots/by-id")
+async def update_bot_by_id(
+    payload: BotConfigRequest,
+    _auth: AuthContext = Depends(require_bot_scope),
+    service: BotConfigService = Depends(get_service),
+):
+    bot_id = _required_text(payload.bot_id, "bot_id")
+    await service.update_bot(
+        bot_id,
+        payload.to_dashboard_config(fallback_id=bot_id),
+    )
+    return ok(message="更新平台配置成功~")
+
+
+@router.delete("/bots/by-id")
+async def delete_bot_by_id(
+    bot_id: str = Query(...),
+    _auth: AuthContext = Depends(require_bot_scope),
+    service: BotConfigService = Depends(get_service),
+):
+    await service.delete_bot(bot_id)
+    return ok(message="删除平台配置成功~")
+
+
+@router.patch("/bots/enabled")
+async def set_bot_enabled_by_id(
+    payload: BotConfigRequest,
+    _auth: AuthContext = Depends(require_bot_scope),
+    service: BotConfigService = Depends(get_service),
+):
+    bot_id = _required_text(payload.bot_id, "bot_id")
+    await service.set_bot_enabled(bot_id, bool(payload.enabled))
+    return ok(message="更新平台配置成功~")
+
+
+@router.post("/bots/test")
+async def test_bot_by_id(
+    payload: BotConfigRequest,
+    _auth: AuthContext = Depends(require_bot_scope),
+):
+    bot_id = _required_text(payload.bot_id, "bot_id")
+    return ok({"id": bot_id, "status": "unsupported"})
+
+
+@router.patch("/bots/{bot_id:path}/enabled")
+async def set_bot_enabled(
+    bot_id: str,
+    payload: EnabledPatch,
+    _auth: AuthContext = Depends(require_bot_scope),
+    service: BotConfigService = Depends(get_service),
+):
+    await service.set_bot_enabled(bot_id, payload.enabled)
+    return ok(message="更新平台配置成功~")
+
+
+@router.post("/bots/{bot_id:path}/test")
+async def test_bot(
+    bot_id: str,
+    _auth: AuthContext = Depends(require_bot_scope),
+):
+    return ok({"id": bot_id, "status": "unsupported"})
+
+
+@router.get("/bots/{bot_id:path}")
+async def get_bot(
+    bot_id: str,
+    _auth: AuthContext = Depends(require_bot_scope),
+    service: BotConfigService = Depends(get_service),
+):
+    return ok(service.get_bot(bot_id))
+
+
+@router.put("/bots/{bot_id:path}")
+async def update_bot(
+    bot_id: str,
+    payload: BotConfigRequest,
+    _auth: AuthContext = Depends(require_bot_scope),
+    service: BotConfigService = Depends(get_service),
+):
+    await service.update_bot(bot_id, payload.to_dashboard_config(fallback_id=bot_id))
+    return ok(message="更新平台配置成功~")
+
+
+@router.delete("/bots/{bot_id:path}")
+async def delete_bot(
+    bot_id: str,
+    _auth: AuthContext = Depends(require_bot_scope),
+    service: BotConfigService = Depends(get_service),
+):
+    await service.delete_bot(bot_id)
+    return ok(message="删除平台配置成功~")
+
+
+@legacy_router.get("/list")
+async def list_dashboard_alias_platforms(
+    _auth: AuthContext = Depends(require_bot_scope),
+    service: BotConfigService = Depends(get_service),
+):
+    return ok({"platforms": service.list_bots()["bots"]})
+
+
+@legacy_router.post("/new")
+async def create_dashboard_alias_platform(
+    payload: BotConfigRequest,
+    _auth: AuthContext = Depends(require_bot_scope),
+    service: BotConfigService = Depends(get_service),
+):
+    try:
+        await service.create_bot(payload.to_dashboard_config())
+        return ok(message="新增平台配置成功~")
+    except ValueError as exc:
+        return _alias_error(str(exc))
+
+
+@legacy_router.post("/update")
+async def update_dashboard_alias_platform(
+    request: Request,
+    _auth: AuthContext = Depends(require_bot_scope),
+    service: BotConfigService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    bot_id = body.get("id")
+    config = body.get("config")
+    if not bot_id or not isinstance(config, dict):
+        return _alias_error("参数错误")
+    try:
+        await service.update_bot(
+            str(bot_id),
+            BotConfigRequest(config=config).to_dashboard_config(
+                fallback_id=str(bot_id)
+            ),
+        )
+        return ok(message="更新平台配置成功~")
+    except ValueError as exc:
+        return _alias_error(str(exc))
+
+
+@legacy_router.post("/delete")
+async def delete_dashboard_alias_platform(
+    request: Request,
+    _auth: AuthContext = Depends(require_bot_scope),
+    service: BotConfigService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    bot_id = body.get("id")
+    if not bot_id:
+        return _alias_error("缺少参数 id")
+    try:
+        await service.delete_bot(str(bot_id))
+        return ok(message="删除平台配置成功~")
+    except ValueError as exc:
+        return _alias_error(str(exc))
diff --git a/astrbot/dashboard/api/chat.py b/astrbot/dashboard/api/chat.py
new file mode 100644
index 000000000..15e17cece
--- /dev/null
+++ b/astrbot/dashboard/api/chat.py
@@ -0,0 +1,526 @@
+from __future__ import annotations
+
+from typing import Any
+
+from fastapi import APIRouter, Depends, Request
+from fastapi.responses import FileResponse, JSONResponse, StreamingResponse
+
+from astrbot.dashboard.async_utils import run_maybe_async
+from astrbot.dashboard.responses import error, ok
+from astrbot.dashboard.schemas import (
+    ChatMessagePatchRequest,
+    ChatMessageRegenerateRequest,
+    ChatSessionBatchDeleteRequest,
+    ChatSessionPatchRequest,
+    ChatThreadCreateRequest,
+    ChatThreadMessageRequest,
+)
+from astrbot.dashboard.services.chat_service import (
+    ChatService,
+    ChatServiceError,
+)
+
+from .auth import AuthContext, require_dashboard_user, require_scope
+from .multipart import single_upload
+
+router = APIRouter(tags=["Chat"])
+legacy_router = APIRouter(
+    prefix="/api/chat",
+    tags=["Dashboard Chat"],
+    include_in_schema=False,
+)
+
+
+def get_service(request: Request) -> ChatService:
+    return request.app.state.services.chat
+
+
+async def require_chat_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "chat")
+
+
+async def _json_or_empty(request: Request) -> dict[str, Any]:
+    try:
+        data = await request.json()
+    except Exception:
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+async def _json_or_none(request: Request) -> dict[str, Any] | None:
+    try:
+        data = await request.json()
+    except Exception:
+        return None
+    return data if isinstance(data, dict) else None
+
+
+async def _json_body(request: Request):
+    try:
+        return await request.json()
+    except Exception:
+        return None
+
+
+def _model_dict(payload) -> dict[str, Any]:
+    return payload.model_dump(exclude_unset=True, exclude_none=False)
+
+
+async def _run(operation):
+    try:
+        result = await run_maybe_async(operation)
+        return ok(result)
+    except ChatServiceError as exc:
+        return error(str(exc))
+
+
+def _file_response(file_path: str, mimetype: str | None):
+    if mimetype:
+        return FileResponse(file_path, media_type=mimetype)
+    return FileResponse(file_path)
+
+
+async def _send_chat(
+    *,
+    request: Request,
+    username: str,
+    service: ChatService,
+    payload: dict[str, Any] | None = None,
+):
+    post_data = payload if payload is not None else await _json_or_none(request)
+    if post_data is None:
+        return JSONResponse(error("Missing JSON body"))
+
+    try:
+        stream = await service.build_chat_stream(username, post_data)
+    except ChatServiceError as exc:
+        return JSONResponse(error(str(exc)))
+
+    return StreamingResponse(
+        stream,
+        media_type="text/event-stream",
+        headers={
+            "Cache-Control": "no-cache",
+            "Transfer-Encoding": "chunked",
+            "Connection": "keep-alive",
+        },
+    )
+
+
+@router.get("/chat/sessions/new")
+async def create_chat_session(
+    request: Request,
+    auth: AuthContext = Depends(require_chat_scope),
+    service: ChatService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.new_session(
+            auth.username,
+            request.query_params.get("platform_id") or "webchat",
+        )
+    )
+
+
+@router.post("/chat/sessions/batch-delete")
+async def batch_delete_chat_sessions(
+    payload: ChatSessionBatchDeleteRequest,
+    auth: AuthContext = Depends(require_chat_scope),
+    service: ChatService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.batch_delete_sessions_from_dashboard_payload(
+            auth.username,
+            _model_dict(payload),
+        )
+    )
+
+
+@router.get("/chat/sessions/{session_id}")
+async def get_chat_session(
+    session_id: str,
+    auth: AuthContext = Depends(require_chat_scope),
+    service: ChatService = Depends(get_service),
+):
+    return await _run(lambda: service.get_session(auth.username, session_id))
+
+
+@router.patch("/chat/sessions/{session_id}")
+async def update_chat_session(
+    session_id: str,
+    payload: ChatSessionPatchRequest,
+    auth: AuthContext = Depends(require_chat_scope),
+    service: ChatService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.update_session_display_name(
+            auth.username,
+            session_id,
+            payload.display_name,
+        )
+    )
+
+
+@router.delete("/chat/sessions/{session_id}")
+async def delete_chat_session(
+    session_id: str,
+    auth: AuthContext = Depends(require_chat_scope),
+    service: ChatService = Depends(get_service),
+):
+    return await _run(lambda: service.delete_webchat_session(auth.username, session_id))
+
+
+@router.post("/chat/sessions/{session_id}/stop")
+async def stop_chat_session(
+    session_id: str,
+    auth: AuthContext = Depends(require_chat_scope),
+    service: ChatService = Depends(get_service),
+):
+    return await _run(lambda: service.stop_session(auth.username, session_id))
+
+
+@router.patch("/chat/sessions/{session_id}/messages/{message_id}")
+async def update_chat_message(
+    session_id: str,
+    message_id: str,
+    payload: ChatMessagePatchRequest,
+    auth: AuthContext = Depends(require_chat_scope),
+    service: ChatService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.update_message(
+            auth.username,
+            {
+                "session_id": session_id,
+                "message_id": message_id,
+                **_model_dict(payload),
+            },
+        )
+    )
+
+
+@router.post("/chat/sessions/{session_id}/messages/{message_id}/regenerate")
+async def regenerate_chat_message(
+    session_id: str,
+    message_id: str,
+    request: Request,
+    payload: ChatMessageRegenerateRequest | None = None,
+    auth: AuthContext = Depends(require_chat_scope),
+    service: ChatService = Depends(get_service),
+):
+    body = _model_dict(payload) if payload is not None else {}
+    try:
+        chat_payload = await service.prepare_regenerate_message_payload(
+            auth.username,
+            {"session_id": session_id, "message_id": message_id, **body},
+        )
+    except ChatServiceError as exc:
+        return JSONResponse(error(str(exc)))
+    return await _send_chat(
+        request=request,
+        username=auth.username,
+        service=service,
+        payload=chat_payload,
+    )
+
+
+@router.get("/chat/configs")
+async def chat_configs(
+    request: Request,
+    _auth: AuthContext = Depends(require_chat_scope),
+):
+    return ok(request.app.state.services.config_profiles.list_profiles())
+
+
+@router.post("/chat/threads")
+async def create_chat_thread(
+    payload: ChatThreadCreateRequest,
+    auth: AuthContext = Depends(require_chat_scope),
+    service: ChatService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.create_thread(auth.username, _model_dict(payload))
+    )
+
+
+@router.get("/chat/threads/{thread_id}")
+async def get_chat_thread(
+    thread_id: str,
+    auth: AuthContext = Depends(require_chat_scope),
+    service: ChatService = Depends(get_service),
+):
+    return await _run(lambda: service.get_thread(auth.username, thread_id))
+
+
+@router.delete("/chat/threads/{thread_id}")
+async def delete_chat_thread(
+    thread_id: str,
+    auth: AuthContext = Depends(require_chat_scope),
+    service: ChatService = Depends(get_service),
+):
+    return await _run(lambda: service.delete_thread(auth.username, thread_id))
+
+
+@router.post("/chat/threads/{thread_id}/messages")
+async def send_chat_thread_message(
+    thread_id: str,
+    request: Request,
+    payload: ChatThreadMessageRequest,
+    auth: AuthContext = Depends(require_chat_scope),
+    service: ChatService = Depends(get_service),
+):
+    try:
+        chat_payload = await service.prepare_thread_chat_payload(
+            auth.username,
+            {"thread_id": thread_id, **_model_dict(payload)},
+        )
+    except ChatServiceError as exc:
+        return JSONResponse(error(str(exc)))
+    return await _send_chat(
+        request=request,
+        username=auth.username,
+        service=service,
+        payload=chat_payload,
+    )
+
+
+@legacy_router.post("/send")
+async def dashboard_send_chat(
+    request: Request,
+    username: str = Depends(require_dashboard_user),
+    service: ChatService = Depends(get_service),
+):
+    return await _send_chat(request=request, username=username, service=service)
+
+
+@legacy_router.get("/new_session")
+async def dashboard_new_session(
+    request: Request,
+    username: str = Depends(require_dashboard_user),
+    service: ChatService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.new_session(
+            username,
+            request.query_params.get("platform_id") or "webchat",
+        )
+    )
+
+
+@legacy_router.get("/sessions")
+async def dashboard_get_sessions(
+    request: Request,
+    username: str = Depends(require_dashboard_user),
+    service: ChatService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.get_sessions(username, request.query_params.get("platform_id"))
+    )
+
+
+@legacy_router.get("/get_session")
+async def dashboard_get_session(
+    request: Request,
+    username: str = Depends(require_dashboard_user),
+    service: ChatService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.get_session_from_dashboard_query(
+            username,
+            request.query_params.get("session_id"),
+        )
+    )
+
+
+@legacy_router.post("/stop")
+async def dashboard_stop_session(
+    request: Request,
+    username: str = Depends(require_dashboard_user),
+    service: ChatService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(
+        lambda: service.stop_session_from_dashboard_payload(username, body)
+    )
+
+
+@legacy_router.get("/delete_session")
+async def dashboard_delete_session(
+    request: Request,
+    username: str = Depends(require_dashboard_user),
+    service: ChatService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.delete_webchat_session_from_dashboard_query(
+            username,
+            request.query_params.get("session_id"),
+        )
+    )
+
+
+@legacy_router.post("/batch_delete_sessions")
+async def dashboard_batch_delete_sessions(
+    request: Request,
+    username: str = Depends(require_dashboard_user),
+    service: ChatService = Depends(get_service),
+):
+    body = await _json_body(request)
+    return await _run(
+        lambda: service.batch_delete_sessions_from_dashboard_payload(username, body)
+    )
+
+
+@legacy_router.post("/update_session_display_name")
+async def dashboard_update_session_display_name(
+    request: Request,
+    username: str = Depends(require_dashboard_user),
+    service: ChatService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(
+        lambda: service.update_session_display_name_from_dashboard_payload(
+            username,
+            body,
+        )
+    )
+
+
+@legacy_router.post("/message/edit")
+async def dashboard_update_message(
+    request: Request,
+    username: str = Depends(require_dashboard_user),
+    service: ChatService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.update_message(username, body))
+
+
+@legacy_router.post("/message/regenerate")
+async def dashboard_regenerate_message(
+    request: Request,
+    username: str = Depends(require_dashboard_user),
+    service: ChatService = Depends(get_service),
+):
+    try:
+        payload = (
+            await service.prepare_regenerate_message_payload_from_dashboard_payload(
+                username,
+                await _json_or_empty(request),
+            )
+        )
+    except ChatServiceError as exc:
+        return JSONResponse(error(str(exc)))
+    return await _send_chat(
+        request=request,
+        username=username,
+        service=service,
+        payload=payload,
+    )
+
+
+@legacy_router.post("/thread/create")
+async def dashboard_create_thread(
+    request: Request,
+    username: str = Depends(require_dashboard_user),
+    service: ChatService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.create_thread(username, body))
+
+
+@legacy_router.get("/thread/get")
+async def dashboard_get_thread(
+    request: Request,
+    username: str = Depends(require_dashboard_user),
+    service: ChatService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.get_thread_from_dashboard_query(
+            username,
+            request.query_params.get("thread_id"),
+        )
+    )
+
+
+@legacy_router.post("/thread/send")
+async def dashboard_send_thread_message(
+    request: Request,
+    username: str = Depends(require_dashboard_user),
+    service: ChatService = Depends(get_service),
+):
+    try:
+        payload = await service.prepare_thread_chat_payload_from_dashboard_payload(
+            username,
+            await _json_or_empty(request),
+        )
+    except ChatServiceError as exc:
+        return JSONResponse(error(str(exc)))
+    return await _send_chat(
+        request=request,
+        username=username,
+        service=service,
+        payload=payload,
+    )
+
+
+@legacy_router.post("/thread/delete")
+async def dashboard_delete_thread(
+    request: Request,
+    username: str = Depends(require_dashboard_user),
+    service: ChatService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(
+        lambda: service.delete_thread_from_dashboard_payload(username, body)
+    )
+
+
+@legacy_router.get("/get_file")
+async def dashboard_get_file(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: ChatService = Depends(get_service),
+):
+    try:
+        file_path, mimetype = await service.resolve_webchat_file_from_dashboard_query(
+            request.query_params.get("filename")
+        )
+        return _file_response(file_path, mimetype)
+    except ChatServiceError as exc:
+        return JSONResponse(error(str(exc)))
+    except (FileNotFoundError, OSError):
+        return JSONResponse(error("File access error"))
+
+
+@legacy_router.get("/get_attachment")
+async def dashboard_get_attachment(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: ChatService = Depends(get_service),
+):
+    try:
+        (
+            file_path,
+            mimetype,
+        ) = await service.resolve_attachment_file_from_dashboard_query(
+            request.query_params.get("attachment_id")
+        )
+        return _file_response(file_path, mimetype)
+    except ChatServiceError as exc:
+        return JSONResponse(error(str(exc)))
+    except (FileNotFoundError, OSError):
+        return JSONResponse(error("File access error"))
+
+
+@legacy_router.post("/post_file")
+async def dashboard_post_file(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: ChatService = Depends(get_service),
+):
+    try:
+        upload = await single_upload(request)
+        if upload is None:
+            raise ChatServiceError("Missing key: file")
+        return ok(await service.save_uploaded_file(upload))
+    except ChatServiceError as exc:
+        return error(str(exc))
diff --git a/astrbot/dashboard/api/chat_projects.py b/astrbot/dashboard/api/chat_projects.py
new file mode 100644
index 000000000..a8d4ba448
--- /dev/null
+++ b/astrbot/dashboard/api/chat_projects.py
@@ -0,0 +1,215 @@
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, Query, Request
+
+from astrbot.dashboard.async_utils import run_maybe_async
+from astrbot.dashboard.responses import error, ok
+from astrbot.dashboard.schemas import ChatProjectRequest
+from astrbot.dashboard.services.chatui_project_service import (
+    ChatUIProjectService,
+    ChatUIProjectServiceError,
+)
+
+from .auth import AuthContext, require_dashboard_user, require_scope
+
+router = APIRouter(tags=["Chat Projects"])
+legacy_router = APIRouter(
+    prefix="/api/chatui_project",
+    tags=["Dashboard Chat Projects"],
+    include_in_schema=False,
+)
+
+
+def get_service(request: Request) -> ChatUIProjectService:
+    return request.app.state.services.chat_projects
+
+
+async def require_chat_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "chat")
+
+
+async def _json_or_empty(request: Request) -> dict:
+    try:
+        data = await request.json()
+    except Exception:
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def _model_dict(payload) -> dict:
+    return payload.model_dump(exclude_none=True)
+
+
+async def _run(operation):
+    try:
+        result = await run_maybe_async(operation)
+        return ok(result)
+    except ChatUIProjectServiceError as exc:
+        return error(str(exc))
+
+
+@router.get("/chat/projects")
+async def list_chat_projects(
+    auth: AuthContext = Depends(require_chat_scope),
+    service: ChatUIProjectService = Depends(get_service),
+):
+    return await _run(lambda: service.list_projects(auth.username))
+
+
+@legacy_router.get("/list")
+async def list_dashboard_chat_projects(
+    username: str = Depends(require_dashboard_user),
+    service: ChatUIProjectService = Depends(get_service),
+):
+    return await _run(lambda: service.list_projects(username))
+
+
+@router.post("/chat/projects")
+async def create_chat_project(
+    payload: ChatProjectRequest,
+    auth: AuthContext = Depends(require_chat_scope),
+    service: ChatUIProjectService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.create_project(auth.username, _model_dict(payload))
+    )
+
+
+@legacy_router.post("/create")
+async def create_dashboard_chat_project(
+    request: Request,
+    username: str = Depends(require_dashboard_user),
+    service: ChatUIProjectService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.create_project(username, body))
+
+
+@router.get("/chat/projects/{project_id}")
+async def get_chat_project(
+    project_id: str,
+    auth: AuthContext = Depends(require_chat_scope),
+    service: ChatUIProjectService = Depends(get_service),
+):
+    return await _run(lambda: service.get_project(auth.username, project_id))
+
+
+@legacy_router.get("/get")
+async def get_dashboard_chat_project(
+    project_id: str | None = Query(default=None),
+    username: str = Depends(require_dashboard_user),
+    service: ChatUIProjectService = Depends(get_service),
+):
+    return await _run(lambda: service.get_project_from_query(username, project_id))
+
+
+@router.patch("/chat/projects/{project_id}")
+async def update_chat_project(
+    project_id: str,
+    payload: ChatProjectRequest,
+    auth: AuthContext = Depends(require_chat_scope),
+    service: ChatUIProjectService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.update_project(
+            auth.username,
+            {"project_id": project_id, **_model_dict(payload)},
+        )
+    )
+
+
+@legacy_router.post("/update")
+async def update_dashboard_chat_project(
+    request: Request,
+    username: str = Depends(require_dashboard_user),
+    service: ChatUIProjectService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.update_project(username, body))
+
+
+@router.delete("/chat/projects/{project_id}")
+async def delete_chat_project(
+    project_id: str,
+    auth: AuthContext = Depends(require_chat_scope),
+    service: ChatUIProjectService = Depends(get_service),
+):
+    return await _run(lambda: service.delete_project(auth.username, project_id))
+
+
+@legacy_router.get("/delete")
+async def delete_dashboard_chat_project(
+    project_id: str | None = Query(default=None),
+    username: str = Depends(require_dashboard_user),
+    service: ChatUIProjectService = Depends(get_service),
+):
+    return await _run(lambda: service.delete_project_from_query(username, project_id))
+
+
+@router.get("/chat/projects/{project_id}/sessions")
+async def list_chat_project_sessions(
+    project_id: str,
+    auth: AuthContext = Depends(require_chat_scope),
+    service: ChatUIProjectService = Depends(get_service),
+):
+    return await _run(lambda: service.get_project_sessions(auth.username, project_id))
+
+
+@legacy_router.get("/get_sessions")
+async def list_dashboard_chat_project_sessions(
+    project_id: str | None = Query(default=None),
+    username: str = Depends(require_dashboard_user),
+    service: ChatUIProjectService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.get_project_sessions_from_query(username, project_id)
+    )
+
+
+@router.post("/chat/projects/{project_id}/sessions/{session_id}")
+async def add_chat_project_session(
+    project_id: str,
+    session_id: str,
+    auth: AuthContext = Depends(require_chat_scope),
+    service: ChatUIProjectService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.add_session_to_project(
+            auth.username,
+            {"project_id": project_id, "session_id": session_id},
+        )
+    )
+
+
+@legacy_router.post("/add_session")
+async def add_dashboard_chat_project_session(
+    request: Request,
+    username: str = Depends(require_dashboard_user),
+    service: ChatUIProjectService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.add_session_to_project(username, body))
+
+
+@router.delete("/chat/projects/sessions/{session_id}")
+async def remove_chat_project_session(
+    session_id: str,
+    auth: AuthContext = Depends(require_chat_scope),
+    service: ChatUIProjectService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.remove_session_from_project(
+            auth.username,
+            {"session_id": session_id},
+        )
+    )
+
+
+@legacy_router.post("/remove_session")
+async def remove_dashboard_chat_project_session(
+    request: Request,
+    username: str = Depends(require_dashboard_user),
+    service: ChatUIProjectService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.remove_session_from_project(username, body))
diff --git a/astrbot/dashboard/api/config_profiles.py b/astrbot/dashboard/api/config_profiles.py
new file mode 100644
index 000000000..943cc7d7e
--- /dev/null
+++ b/astrbot/dashboard/api/config_profiles.py
@@ -0,0 +1,468 @@
+from __future__ import annotations
+
+from typing import Any
+
+from fastapi import APIRouter, Depends, Query, Request
+
+from astrbot.dashboard.responses import error, ok
+from astrbot.dashboard.schemas import (
+    ConfigContentRequest,
+    ConfigProfileCreateRequest,
+    ConfigRoutesReplaceRequest,
+    ConfigRouteUpsertRequest,
+    RenameRequest,
+)
+from astrbot.dashboard.services.config_service import (
+    ConfigDisplayService,
+    ConfigFileService,
+    ConfigProfileService,
+    ConfigRoutingService,
+)
+
+from .auth import AuthContext, require_scope
+from .multipart import multipart_parts
+
+router = APIRouter(tags=["Config Profiles"])
+legacy_router = APIRouter(
+    prefix="/api/config",
+    tags=["Dashboard Config"],
+    include_in_schema=False,
+)
+
+
+async def require_config_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "config")
+
+
+def get_service(request: Request) -> ConfigProfileService:
+    return request.app.state.services.config_profiles
+
+
+def get_routing_service(request: Request) -> ConfigRoutingService:
+    return request.app.state.services.config_routes
+
+
+def get_display_service(request: Request) -> ConfigDisplayService:
+    return request.app.state.services.config_display
+
+
+def get_file_service(request: Request) -> ConfigFileService:
+    return request.app.state.services.config_files
+
+
+async def _json_or_empty(request: Request) -> dict:
+    try:
+        data = await request.json()
+    except Exception:
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def _alias_error(message: str):
+    return error(message)
+
+
+def _model_dict(payload) -> dict[str, Any]:
+    return payload.model_dump(exclude_none=True)
+
+
+@router.get("/config-profiles/schema")
+async def get_config_profile_schema(
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigProfileService = Depends(get_service),
+):
+    return ok(service.get_profile_schema())
+
+
+@router.get("/config-profiles")
+async def list_config_profiles(
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigProfileService = Depends(get_service),
+):
+    return ok(service.list_profiles())
+
+
+@router.post("/config-profiles")
+async def create_config_profile(
+    payload: ConfigProfileCreateRequest,
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigProfileService = Depends(get_service),
+):
+    return ok(await service.create_profile(payload.name, payload.config), "创建成功")
+
+
+@router.get("/config-profiles/{config_id}")
+async def get_config_profile(
+    config_id: str,
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigProfileService = Depends(get_service),
+):
+    return ok(service.get_profile(config_id))
+
+
+@router.put("/config-profiles/{config_id}")
+async def update_config_profile(
+    config_id: str,
+    payload: ConfigContentRequest,
+    request: Request,
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigProfileService = Depends(get_service),
+):
+    message = await service.update_profile(
+        config_id,
+        _model_dict(payload),
+        two_factor_code=request.headers.get("X-2FA-Code"),
+    )
+    return ok(message=message or "保存成功")
+
+
+@router.patch("/config-profiles/{config_id}")
+async def rename_config_profile(
+    config_id: str,
+    payload: RenameRequest,
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigProfileService = Depends(get_service),
+):
+    service.rename_profile(config_id, payload.name)
+    return ok(message="更新成功")
+
+
+@router.delete("/config-profiles/{config_id}")
+async def delete_config_profile(
+    config_id: str,
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigProfileService = Depends(get_service),
+):
+    service.delete_profile(config_id)
+    return ok(message="删除成功")
+
+
+@router.get("/system-config/schema")
+async def get_system_config_schema(
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigProfileService = Depends(get_service),
+):
+    return ok(service.get_system_schema())
+
+
+@router.get("/system-config")
+async def get_system_config(
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigProfileService = Depends(get_service),
+):
+    return ok(service.get_system_config())
+
+
+@router.get("/system-config/runtime")
+async def get_system_config_runtime(
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigDisplayService = Depends(get_display_service),
+):
+    return ok(await service.get_configs())
+
+
+@router.put("/system-config")
+async def update_system_config(
+    payload: ConfigContentRequest,
+    request: Request,
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigProfileService = Depends(get_service),
+):
+    message = await service.update_profile(
+        "default",
+        _model_dict(payload),
+        two_factor_code=request.headers.get("X-2FA-Code"),
+    )
+    return ok(message=message or "保存成功")
+
+
+@router.get("/config-routes")
+async def list_config_routes(
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigRoutingService = Depends(get_routing_service),
+):
+    return ok(service.list_routes())
+
+
+@router.put("/config-routes")
+async def replace_config_routes(
+    payload: ConfigRoutesReplaceRequest,
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigRoutingService = Depends(get_routing_service),
+):
+    await service.replace_route_mapping(payload.routing)
+    return ok(message="更新成功")
+
+
+@router.put("/config-routes/{umo}")
+async def upsert_config_route(
+    umo: str,
+    payload: ConfigRouteUpsertRequest,
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigRoutingService = Depends(get_routing_service),
+):
+    await service.set_route(umo, payload.config_id)
+    return ok(message="更新成功")
+
+
+@router.delete("/config-routes/{umo}")
+async def delete_config_route(
+    umo: str,
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigRoutingService = Depends(get_routing_service),
+):
+    await service.delete_route_by_umo(umo)
+    return ok(message="删除成功")
+
+
+@legacy_router.get("/default")
+async def get_dashboard_alias_default_config(
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigProfileService = Depends(get_service),
+):
+    return ok(service.get_profile_schema())
+
+
+@legacy_router.get("/abconfs")
+async def list_dashboard_alias_config_profiles(
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigProfileService = Depends(get_service),
+):
+    return ok(service.list_profiles())
+
+
+@legacy_router.post("/abconf/new")
+async def create_dashboard_alias_config_profile(
+    request: Request,
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigProfileService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    try:
+        return ok(
+            await service.create_profile(
+                body.get("name"),
+                body.get("config"),
+            ),
+            "创建成功",
+        )
+    except ValueError as exc:
+        return _alias_error(str(exc))
+
+
+@legacy_router.get("/abconf")
+async def get_dashboard_alias_config_profile(
+    id: str | None = Query(default=None),
+    system_config: str = Query(default="0"),
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigProfileService = Depends(get_service),
+):
+    if system_config.lower() == "1":
+        return ok(service.get_system_schema())
+    if not id:
+        return _alias_error("缺少配置文件 ID")
+    try:
+        return ok(service.get_profile(id))
+    except ValueError as exc:
+        return _alias_error(str(exc))
+
+
+@legacy_router.post("/abconf/delete")
+async def delete_dashboard_alias_config_profile(
+    request: Request,
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigProfileService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    config_id = body.get("id")
+    if not config_id:
+        return _alias_error("缺少配置文件 ID")
+    try:
+        service.delete_profile(str(config_id))
+        return ok(message="删除成功")
+    except ValueError as exc:
+        return _alias_error(str(exc))
+
+
+@legacy_router.post("/abconf/update")
+async def rename_dashboard_alias_config_profile(
+    request: Request,
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigProfileService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    config_id = body.get("id")
+    if not config_id:
+        return _alias_error("缺少配置文件 ID")
+    try:
+        service.rename_profile(str(config_id), body.get("name"))
+        return ok(message="更新成功")
+    except ValueError as exc:
+        return _alias_error(str(exc))
+
+
+@legacy_router.post("/astrbot/update")
+async def update_dashboard_alias_astrbot_config(
+    request: Request,
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigProfileService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    config = body.get("config")
+    config_id = body.get("conf_id")
+    if not isinstance(config, dict):
+        return _alias_error("Invalid config payload")
+    if not config_id:
+        return _alias_error("Config file None does not exist")
+    try:
+        message = await service.update_profile(
+            str(config_id),
+            config,
+            two_factor_code=request.headers.get("X-2FA-Code"),
+        )
+        return ok(message=message or "保存成功~")
+    except ValueError as exc:
+        return _alias_error(str(exc))
+
+
+@legacy_router.get("/get")
+async def get_dashboard_alias_configs(
+    request: Request,
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigDisplayService = Depends(get_display_service),
+):
+    try:
+        return ok(await service.get_configs_from_dashboard_args(request.query_params))
+    except ValueError as exc:
+        return _alias_error(str(exc))
+
+
+@legacy_router.post("/plugin/update")
+async def update_dashboard_alias_plugin_configs(
+    request: Request,
+    plugin_name: str = Query(default="unknown"),
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigFileService = Depends(get_file_service),
+):
+    body = await _json_or_empty(request)
+    try:
+        message = await service.save_plugin_configs_from_dashboard_payload(
+            body,
+            plugin_name=plugin_name,
+        )
+        return ok(message=message)
+    except ValueError as exc:
+        return _alias_error(str(exc))
+
+
+@legacy_router.post("/file/upload")
+async def upload_dashboard_alias_config_file(
+    request: Request,
+    scope: str | None = Query(default=None),
+    name: str | None = Query(default=None),
+    key: str | None = Query(default=None),
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigFileService = Depends(get_file_service),
+):
+    _, files = await multipart_parts(request)
+    try:
+        return ok(
+            await service.upload_config_file(
+                scope=scope,
+                name=name,
+                key_path=key,
+                files=files,
+            )
+        )
+    except ValueError as exc:
+        return _alias_error(str(exc))
+
+
+@legacy_router.post("/file/delete")
+async def delete_dashboard_alias_config_file(
+    request: Request,
+    scope: str | None = Query(default=None),
+    name: str | None = Query(default=None),
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigFileService = Depends(get_file_service),
+):
+    body = await _json_or_empty(request)
+    try:
+        message = service.delete_config_file_from_dashboard_payload(
+            scope=scope or "plugin",
+            name=name,
+            payload=body,
+        )
+        return ok(message=message)
+    except ValueError as exc:
+        return _alias_error(str(exc))
+
+
+@legacy_router.get("/file/get")
+async def list_dashboard_alias_config_files(
+    scope: str | None = Query(default=None),
+    name: str | None = Query(default=None),
+    key: str | None = Query(default=None),
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigFileService = Depends(get_file_service),
+):
+    try:
+        return ok(
+            service.list_config_files(
+                scope=scope,
+                name=name,
+                key_path=key,
+            )
+        )
+    except ValueError as exc:
+        return _alias_error(str(exc))
+
+
+@legacy_router.get("/umo_abconf_routes")
+async def get_dashboard_alias_config_routes(
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigRoutingService = Depends(get_routing_service),
+):
+    return ok(service.list_routes())
+
+
+@legacy_router.post("/umo_abconf_route/update_all")
+async def update_dashboard_alias_config_routes(
+    request: Request,
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigRoutingService = Depends(get_routing_service),
+):
+    body = await _json_or_empty(request)
+    try:
+        await service.replace_routes(body)
+    except ValueError:
+        return _alias_error("缺少或错误的路由表数据")
+    return ok(message="更新成功")
+
+
+@legacy_router.post("/umo_abconf_route/update")
+async def upsert_dashboard_alias_config_route(
+    request: Request,
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigRoutingService = Depends(get_routing_service),
+):
+    body = await _json_or_empty(request)
+    try:
+        await service.upsert_route(body)
+    except ValueError:
+        return _alias_error("缺少 UMO 或配置文件 ID")
+    return ok(message="更新成功")
+
+
+@legacy_router.post("/umo_abconf_route/delete")
+async def delete_dashboard_alias_config_route(
+    request: Request,
+    _auth: AuthContext = Depends(require_config_scope),
+    service: ConfigRoutingService = Depends(get_routing_service),
+):
+    body = await _json_or_empty(request)
+    try:
+        await service.delete_route(body)
+    except ValueError:
+        return _alias_error("缺少 UMO")
+    return ok(message="删除成功")
diff --git a/astrbot/dashboard/api/conversations.py b/astrbot/dashboard/api/conversations.py
new file mode 100644
index 000000000..50edc5fc6
--- /dev/null
+++ b/astrbot/dashboard/api/conversations.py
@@ -0,0 +1,288 @@
+from __future__ import annotations
+
+from typing import Any
+
+from fastapi import APIRouter, Depends, Query, Request
+from fastapi.responses import StreamingResponse
+
+from astrbot.dashboard.async_utils import run_maybe_async
+from astrbot.dashboard.responses import ApiError, ok
+from astrbot.dashboard.schemas import (
+    ConversationBatchDeleteRequest,
+    ConversationExportRequest,
+    ConversationMessagesReplaceRequest,
+    ConversationPatchRequest,
+)
+from astrbot.dashboard.services.conversation_service import (
+    ConversationExport,
+    ConversationService,
+    ConversationServiceError,
+)
+
+from .auth import AuthContext, require_dashboard_user, require_scope
+
+router = APIRouter(tags=["Conversations"])
+legacy_router = APIRouter(
+    prefix="/api/conversation",
+    tags=["Dashboard Conversations"],
+    include_in_schema=False,
+)
+
+
+def get_service(request: Request) -> ConversationService:
+    return request.app.state.services.conversations
+
+
+async def require_data_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "data")
+
+
+async def _json_or_empty(request: Request) -> dict[str, Any]:
+    try:
+        data = await request.json()
+    except Exception:
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def _model_dict(payload) -> dict[str, Any]:
+    return payload.model_dump(exclude_none=True)
+
+
+def _raise_conversation_error(exc: ConversationServiceError) -> None:
+    raise ApiError(str(exc)) from exc
+
+
+async def _run(operation):
+    try:
+        result = await run_maybe_async(operation)
+        return ok(result)
+    except ConversationServiceError as exc:
+        _raise_conversation_error(exc)
+
+
+def _export_response(export: ConversationExport) -> StreamingResponse:
+    export.file_obj.seek(0)
+
+    def iter_file():
+        while chunk := export.file_obj.read(8192):
+            yield chunk
+
+    return StreamingResponse(
+        iter_file(),
+        media_type=export.mimetype,
+        headers={"Content-Disposition": f'attachment; filename="{export.filename}"'},
+    )
+
+
+async def _export_conversations(
+    payload: dict[str, Any],
+    service: ConversationService,
+):
+    try:
+        return _export_response(await service.export_conversations(payload))
+    except ConversationServiceError as exc:
+        _raise_conversation_error(exc)
+
+
+async def _list_conversations(
+    service: ConversationService,
+    *,
+    page: int,
+    page_size: int,
+    platforms: str,
+    message_types: str,
+    search: str,
+    exclude_ids: str,
+    exclude_platforms: str,
+):
+    return await _run(
+        lambda: service.list_conversations(
+            page=page,
+            page_size=page_size,
+            platforms=platforms,
+            message_types=message_types,
+            search_query=search,
+            exclude_ids=exclude_ids,
+            exclude_platforms=exclude_platforms,
+        )
+    )
+
+
+@router.get("/conversations")
+async def list_conversations(
+    page: int = Query(default=1),
+    page_size: int = Query(default=20),
+    platforms: str = Query(default=""),
+    message_types: str = Query(default=""),
+    search: str = Query(default=""),
+    exclude_ids: str = Query(default=""),
+    exclude_platforms: str = Query(default=""),
+    _auth: AuthContext = Depends(require_data_scope),
+    service: ConversationService = Depends(get_service),
+):
+    return await _list_conversations(
+        service,
+        page=page,
+        page_size=page_size,
+        platforms=platforms,
+        message_types=message_types,
+        search=search,
+        exclude_ids=exclude_ids,
+        exclude_platforms=exclude_platforms,
+    )
+
+
+@router.post("/conversations/export")
+async def export_conversations(
+    payload: ConversationExportRequest,
+    _auth: AuthContext = Depends(require_data_scope),
+    service: ConversationService = Depends(get_service),
+):
+    return await _export_conversations(_model_dict(payload), service)
+
+
+@router.post("/conversations/batch-delete")
+async def batch_delete_conversations(
+    payload: ConversationBatchDeleteRequest,
+    _auth: AuthContext = Depends(require_data_scope),
+    service: ConversationService = Depends(get_service),
+):
+    return await _run(lambda: service.delete_conversation(_model_dict(payload)))
+
+
+@router.put("/conversations/{conversation_id:path}/messages")
+async def replace_conversation_messages(
+    conversation_id: str,
+    payload: ConversationMessagesReplaceRequest,
+    user_id: str = Query(...),
+    _auth: AuthContext = Depends(require_data_scope),
+    service: ConversationService = Depends(get_service),
+):
+    body = _model_dict(payload)
+    body_user_id = body.pop("user_id", None) or user_id
+    if "messages" in body and "history" not in body:
+        body["history"] = body.pop("messages")
+    return await _run(
+        lambda: service.update_history(
+            {"user_id": body_user_id, "cid": conversation_id, **body}
+        )
+    )
+
+
+@router.get("/conversations/{conversation_id:path}")
+async def get_conversation(
+    conversation_id: str,
+    user_id: str = Query(...),
+    _auth: AuthContext = Depends(require_data_scope),
+    service: ConversationService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.get_conversation_detail(
+            {"user_id": user_id, "cid": conversation_id}
+        )
+    )
+
+
+@router.patch("/conversations/{conversation_id:path}")
+async def update_conversation(
+    conversation_id: str,
+    payload: ConversationPatchRequest,
+    user_id: str = Query(...),
+    _auth: AuthContext = Depends(require_data_scope),
+    service: ConversationService = Depends(get_service),
+):
+    body = _model_dict(payload)
+    body_user_id = body.pop("user_id", None) or user_id
+    return await _run(
+        lambda: service.update_conversation(
+            {"user_id": body_user_id, "cid": conversation_id, **body}
+        )
+    )
+
+
+@router.delete("/conversations/{conversation_id:path}")
+async def delete_conversation(
+    conversation_id: str,
+    user_id: str = Query(...),
+    _auth: AuthContext = Depends(require_data_scope),
+    service: ConversationService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.delete_conversation(
+            {"user_id": user_id, "cid": conversation_id}
+        )
+    )
+
+
+@legacy_router.get("/list")
+async def list_dashboard_conversations(
+    page: int = Query(default=1),
+    page_size: int = Query(default=20),
+    platforms: str = Query(default=""),
+    message_types: str = Query(default=""),
+    search: str = Query(default=""),
+    exclude_ids: str = Query(default=""),
+    exclude_platforms: str = Query(default=""),
+    _username: str = Depends(require_dashboard_user),
+    service: ConversationService = Depends(get_service),
+):
+    return await _list_conversations(
+        service,
+        page=page,
+        page_size=page_size,
+        platforms=platforms,
+        message_types=message_types,
+        search=search,
+        exclude_ids=exclude_ids,
+        exclude_platforms=exclude_platforms,
+    )
+
+
+@legacy_router.post("/detail")
+async def get_dashboard_conversation_detail(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: ConversationService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.get_conversation_detail(body))
+
+
+@legacy_router.post("/update")
+async def update_dashboard_conversation(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: ConversationService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.update_conversation(body))
+
+
+@legacy_router.post("/delete")
+async def delete_dashboard_conversation(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: ConversationService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.delete_conversation(body))
+
+
+@legacy_router.post("/update_history")
+async def update_dashboard_conversation_history(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: ConversationService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.update_history(body))
+
+
+@legacy_router.post("/export")
+async def export_dashboard_conversations(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: ConversationService = Depends(get_service),
+):
+    return await _export_conversations(await _json_or_empty(request), service)
diff --git a/astrbot/dashboard/api/cron.py b/astrbot/dashboard/api/cron.py
new file mode 100644
index 000000000..1b1f9cc43
--- /dev/null
+++ b/astrbot/dashboard/api/cron.py
@@ -0,0 +1,161 @@
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, Query, Request
+
+from astrbot.dashboard.responses import ApiError, ok
+from astrbot.dashboard.schemas import CronJobRequest
+from astrbot.dashboard.services.cron_service import CronService, CronServiceError
+
+from .auth import AuthContext, require_dashboard_user, require_scope
+
+router = APIRouter(tags=["Cron"])
+legacy_router = APIRouter(
+    prefix="/api/cron",
+    tags=["Dashboard Cron"],
+    include_in_schema=False,
+)
+
+
+async def require_system_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "system")
+
+
+def get_service(request: Request) -> CronService:
+    return request.app.state.services.cron
+
+
+def _payload_dict(payload: CronJobRequest) -> dict:
+    return payload.model_dump(exclude_none=True)
+
+
+def _raise_cron_error(exc: CronServiceError) -> None:
+    raise ApiError(str(exc)) from exc
+
+
+async def _list_jobs(job_type: str | None, service: CronService):
+    try:
+        return ok(await service.list_jobs(job_type))
+    except CronServiceError as exc:
+        _raise_cron_error(exc)
+
+
+async def _create_job(payload: CronJobRequest, service: CronService):
+    try:
+        return ok(await service.create_job(_payload_dict(payload)))
+    except CronServiceError as exc:
+        _raise_cron_error(exc)
+
+
+async def _update_job(job_id: str, payload: CronJobRequest, service: CronService):
+    try:
+        return ok(await service.update_job(job_id, _payload_dict(payload)))
+    except CronServiceError as exc:
+        _raise_cron_error(exc)
+
+
+async def _delete_job(job_id: str, service: CronService):
+    try:
+        await service.delete_job(job_id)
+        return ok(message="deleted")
+    except CronServiceError as exc:
+        _raise_cron_error(exc)
+
+
+async def _run_job(job_id: str, service: CronService):
+    try:
+        await service.run_job_now(job_id)
+        return ok(message="started")
+    except CronServiceError as exc:
+        _raise_cron_error(exc)
+
+
+@router.get("/cron/jobs")
+async def list_cron_jobs(
+    job_type: str | None = Query(default=None, alias="type"),
+    _auth: AuthContext = Depends(require_system_scope),
+    service: CronService = Depends(get_service),
+):
+    return await _list_jobs(job_type, service)
+
+
+@router.post("/cron/jobs")
+async def create_cron_job(
+    payload: CronJobRequest,
+    _auth: AuthContext = Depends(require_system_scope),
+    service: CronService = Depends(get_service),
+):
+    return await _create_job(payload, service)
+
+
+@router.patch("/cron/jobs/{job_id}")
+async def update_cron_job(
+    job_id: str,
+    payload: CronJobRequest,
+    _auth: AuthContext = Depends(require_system_scope),
+    service: CronService = Depends(get_service),
+):
+    return await _update_job(job_id, payload, service)
+
+
+@router.delete("/cron/jobs/{job_id}")
+async def delete_cron_job(
+    job_id: str,
+    _auth: AuthContext = Depends(require_system_scope),
+    service: CronService = Depends(get_service),
+):
+    return await _delete_job(job_id, service)
+
+
+@router.post("/cron/jobs/{job_id}/run")
+async def run_cron_job(
+    job_id: str,
+    _auth: AuthContext = Depends(require_system_scope),
+    service: CronService = Depends(get_service),
+):
+    return await _run_job(job_id, service)
+
+
+@legacy_router.get("/jobs")
+async def list_dashboard_cron_jobs(
+    job_type: str | None = Query(default=None, alias="type"),
+    _username: str = Depends(require_dashboard_user),
+    service: CronService = Depends(get_service),
+):
+    return await _list_jobs(job_type, service)
+
+
+@legacy_router.post("/jobs")
+async def create_dashboard_cron_job(
+    payload: CronJobRequest,
+    _username: str = Depends(require_dashboard_user),
+    service: CronService = Depends(get_service),
+):
+    return await _create_job(payload, service)
+
+
+@legacy_router.patch("/jobs/{job_id}")
+async def update_dashboard_cron_job(
+    job_id: str,
+    payload: CronJobRequest,
+    _username: str = Depends(require_dashboard_user),
+    service: CronService = Depends(get_service),
+):
+    return await _update_job(job_id, payload, service)
+
+
+@legacy_router.delete("/jobs/{job_id}")
+async def delete_dashboard_cron_job(
+    job_id: str,
+    _username: str = Depends(require_dashboard_user),
+    service: CronService = Depends(get_service),
+):
+    return await _delete_job(job_id, service)
+
+
+@legacy_router.post("/jobs/{job_id}/run")
+async def run_dashboard_cron_job(
+    job_id: str,
+    _username: str = Depends(require_dashboard_user),
+    service: CronService = Depends(get_service),
+):
+    return await _run_job(job_id, service)
diff --git a/astrbot/dashboard/api/extensions.py b/astrbot/dashboard/api/extensions.py
new file mode 100644
index 000000000..2c88a66cc
--- /dev/null
+++ b/astrbot/dashboard/api/extensions.py
@@ -0,0 +1,180 @@
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, Request
+
+from astrbot.dashboard.responses import ApiError, ok
+from astrbot.dashboard.schemas import (
+    CommandPermissionRequest,
+    CommandRenameRequest,
+    CommandToggleRequest,
+    CommandUpdateRequest,
+)
+from astrbot.dashboard.services.command_service import (
+    CommandService,
+    CommandServiceError,
+)
+
+from .auth import AuthContext, require_dashboard_user, require_scope
+
+router = APIRouter(tags=["Extension Components"])
+legacy_router = APIRouter(
+    prefix="/api",
+    tags=["Dashboard Extension Components"],
+    include_in_schema=False,
+)
+
+
+def get_command_service(request: Request) -> CommandService:
+    return request.app.state.services.commands
+
+
+async def require_tool_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "tool")
+
+
+def _raise_command_error(exc: CommandServiceError) -> None:
+    raise ApiError(str(exc)) from exc
+
+
+async def _list_commands(config_id: str | None, service: CommandService):
+    try:
+        return ok(await service.list_commands(config_id or ""))
+    except CommandServiceError as exc:
+        _raise_command_error(exc)
+
+
+async def _list_command_conflicts(service: CommandService):
+    try:
+        return ok(await service.list_conflicts())
+    except CommandServiceError as exc:
+        _raise_command_error(exc)
+
+
+async def _toggle_command(payload: CommandToggleRequest, service: CommandService):
+    try:
+        return ok(
+            await service.toggle_command(payload.handler_full_name, payload.enabled)
+        )
+    except CommandServiceError as exc:
+        _raise_command_error(exc)
+
+
+async def _rename_command(payload: CommandRenameRequest, service: CommandService):
+    try:
+        return ok(
+            await service.rename_command(
+                payload.handler_full_name,
+                payload.new_name,
+                aliases=payload.aliases,
+            )
+        )
+    except CommandServiceError as exc:
+        _raise_command_error(exc)
+
+
+async def _update_command_permission(
+    payload: CommandPermissionRequest,
+    service: CommandService,
+):
+    try:
+        return ok(
+            await service.update_permission(
+                payload.handler_full_name, payload.permission
+            )
+        )
+    except CommandServiceError as exc:
+        _raise_command_error(exc)
+
+
+@router.get("/commands")
+async def list_commands(
+    config_id: str | None = None,
+    _auth: AuthContext = Depends(require_tool_scope),
+    service: CommandService = Depends(get_command_service),
+):
+    return await _list_commands(config_id, service)
+
+
+@router.get("/commands/conflicts")
+async def list_command_conflicts(
+    _auth: AuthContext = Depends(require_tool_scope),
+    service: CommandService = Depends(get_command_service),
+):
+    return await _list_command_conflicts(service)
+
+
+@router.patch("/commands/{command_id:path}")
+async def update_command(
+    command_id: str,
+    payload: CommandUpdateRequest,
+    _auth: AuthContext = Depends(require_tool_scope),
+    service: CommandService = Depends(get_command_service),
+):
+    if payload.enabled is not None:
+        return await _toggle_command(
+            CommandToggleRequest(
+                handler_full_name=command_id,
+                enabled=payload.enabled,
+            ),
+            service,
+        )
+    if payload.alias is not None:
+        return await _rename_command(
+            CommandRenameRequest(
+                handler_full_name=command_id,
+                new_name=payload.alias,
+                aliases=payload.aliases,
+            ),
+            service,
+        )
+    return await _update_command_permission(
+        CommandPermissionRequest(
+            handler_full_name=command_id,
+            permission=payload.permission_group or "",
+        ),
+        service,
+    )
+
+
+@legacy_router.get("/commands")
+async def list_dashboard_commands(
+    config_id: str | None = None,
+    _username: str = Depends(require_dashboard_user),
+    service: CommandService = Depends(get_command_service),
+):
+    return await _list_commands(config_id, service)
+
+
+@legacy_router.get("/commands/conflicts")
+async def list_dashboard_command_conflicts(
+    _username: str = Depends(require_dashboard_user),
+    service: CommandService = Depends(get_command_service),
+):
+    return await _list_command_conflicts(service)
+
+
+@legacy_router.post("/commands/toggle")
+async def toggle_dashboard_command(
+    payload: CommandToggleRequest,
+    _username: str = Depends(require_dashboard_user),
+    service: CommandService = Depends(get_command_service),
+):
+    return await _toggle_command(payload, service)
+
+
+@legacy_router.post("/commands/rename")
+async def rename_dashboard_command(
+    payload: CommandRenameRequest,
+    _username: str = Depends(require_dashboard_user),
+    service: CommandService = Depends(get_command_service),
+):
+    return await _rename_command(payload, service)
+
+
+@legacy_router.post("/commands/permission")
+async def update_dashboard_command_permission(
+    payload: CommandPermissionRequest,
+    _username: str = Depends(require_dashboard_user),
+    service: CommandService = Depends(get_command_service),
+):
+    return await _update_command_permission(payload, service)
diff --git a/astrbot/dashboard/api/files.py b/astrbot/dashboard/api/files.py
new file mode 100644
index 000000000..46ae76a69
--- /dev/null
+++ b/astrbot/dashboard/api/files.py
@@ -0,0 +1,119 @@
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, File, HTTPException, Query, Request, UploadFile
+from fastapi.responses import FileResponse
+
+from astrbot.dashboard.async_utils import run_maybe_async
+from astrbot.dashboard.responses import error, ok
+from astrbot.dashboard.services.chat_service import ChatService, ChatServiceError
+from astrbot.dashboard.services.file_service import FileService, FileServiceError
+
+from .auth import AuthContext, require_scope
+from .multipart import UploadFileAdapter
+
+router = APIRouter(tags=["Files"])
+legacy_router = APIRouter(prefix="/api", include_in_schema=False)
+
+
+def get_service(request: Request) -> FileService:
+    return request.app.state.services.files
+
+
+def get_chat_service(request: Request) -> ChatService:
+    return request.app.state.services.chat
+
+
+async def require_file_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "file")
+
+
+async def _serve_token_file(file_token: str, service: FileService):
+    try:
+        return FileResponse(await service.resolve_token_file(file_token))
+    except FileServiceError as exc:
+        raise HTTPException(status_code=404) from exc
+
+
+def _file_response(file_path: str, mimetype: str | None = None) -> FileResponse:
+    if mimetype:
+        return FileResponse(file_path, media_type=mimetype)
+    return FileResponse(file_path)
+
+
+async def _run_file(operation, *, error_message: str = "File access error"):
+    try:
+        result = await run_maybe_async(operation)
+        return result
+    except ChatServiceError as exc:
+        return error(str(exc))
+    except (FileNotFoundError, OSError):
+        return error(error_message)
+
+
+async def _upload_file(file: UploadFile, service: ChatService):
+    result = await _run_file(
+        lambda: service.save_uploaded_file(UploadFileAdapter(file))
+    )
+    if isinstance(result, dict) and result.get("status") == "error":
+        return result
+    return ok(result)
+
+
+@router.get("/files/tokens/{file_token}")
+async def get_token_file(
+    file_token: str,
+    service: FileService = Depends(get_service),
+):
+    return await _serve_token_file(file_token, service)
+
+
+@router.post("/files")
+async def upload_file(
+    file: UploadFile = File(...),
+    _auth: AuthContext = Depends(require_file_scope),
+    service: ChatService = Depends(get_chat_service),
+):
+    return await _upload_file(file, service)
+
+
+@router.get("/files/content")
+async def get_file_by_name(
+    filename: str | None = Query(default=None),
+    _auth: AuthContext = Depends(require_file_scope),
+    service: ChatService = Depends(get_chat_service),
+):
+    result = await _run_file(lambda: service.resolve_webchat_file(filename))
+    if isinstance(result, dict) and result.get("status") == "error":
+        return result
+    file_path, mimetype = result
+    return _file_response(file_path, mimetype)
+
+
+@router.get("/files/{attachment_id}")
+@router.get("/files/{attachment_id}/content")
+async def get_file(
+    attachment_id: str,
+    _auth: AuthContext = Depends(require_file_scope),
+    service: ChatService = Depends(get_chat_service),
+):
+    result = await _run_file(lambda: service.resolve_attachment_file(attachment_id))
+    if isinstance(result, dict) and result.get("status") == "error":
+        return result
+    file_path, mimetype = result
+    return _file_response(file_path, mimetype)
+
+
+@router.delete("/files/{attachment_id}")
+async def delete_file(
+    attachment_id: str,
+    _auth: AuthContext = Depends(require_file_scope),
+):
+    return ok({"attachment_id": attachment_id})
+
+
+@legacy_router.get("/file/{file_token}")
+async def get_dashboard_token_file(
+    file_token: str,
+    service: FileService = Depends(get_service),
+):
+    return await _serve_token_file(file_token, service)
diff --git a/astrbot/dashboard/api/knowledge_bases.py b/astrbot/dashboard/api/knowledge_bases.py
new file mode 100644
index 000000000..c6f62235d
--- /dev/null
+++ b/astrbot/dashboard/api/knowledge_bases.py
@@ -0,0 +1,505 @@
+from __future__ import annotations
+
+from collections.abc import Callable
+from typing import Any
+
+from fastapi import APIRouter, Depends, Request
+
+from astrbot.core import logger
+from astrbot.dashboard.async_utils import run_maybe_async
+from astrbot.dashboard.responses import error, ok
+from astrbot.dashboard.schemas import (
+    KnowledgeBaseImportRequest,
+    KnowledgeBaseRequest,
+    KnowledgeBaseRetrieveRequest,
+    KnowledgeBaseUrlImportRequest,
+)
+from astrbot.dashboard.services.knowledge_base_service import (
+    KnowledgeBaseService,
+    KnowledgeBaseServiceError,
+)
+
+from .auth import AuthContext, require_dashboard_user, require_scope
+from .multipart import multipart_parts
+
+router = APIRouter(tags=["Knowledge Bases"])
+legacy_router = APIRouter(
+    prefix="/api/kb",
+    tags=["Dashboard Knowledge Bases"],
+    include_in_schema=False,
+)
+
+
+def get_service(request: Request) -> KnowledgeBaseService:
+    return request.app.state.services.knowledge_bases
+
+
+async def require_kb_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "kb")
+
+
+async def _json_or_empty(request: Request) -> dict[str, Any]:
+    try:
+        data = await request.json()
+    except Exception:
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def _to_int(value: Any, default: int) -> int:
+    try:
+        return int(value)
+    except (TypeError, ValueError):
+        return default
+
+
+def _model_dict(payload) -> dict[str, Any]:
+    if payload is None:
+        return {}
+    if hasattr(payload, "model_dump"):
+        return payload.model_dump(exclude_none=True)
+    return payload if isinstance(payload, dict) else {}
+
+
+async def _run(operation, *, prefix: str):
+    try:
+        result = await run_maybe_async(operation)
+        if isinstance(result, tuple):
+            data, message = result
+            return ok(data, message)
+        return ok(result)
+    except (KnowledgeBaseServiceError, ValueError) as exc:
+        return error(str(exc))
+    except Exception as exc:
+        logger.error("%s: %s", prefix, exc, exc_info=True)
+        return error(f"{prefix}: {exc!s}")
+
+
+async def _run_json(
+    request: Request,
+    operation: Callable[[dict[str, Any]], Any],
+    *,
+    prefix: str,
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: operation(body), prefix=prefix)
+
+
+@router.get("/knowledge-bases")
+async def list_knowledge_bases(
+    request: Request,
+    _auth: AuthContext = Depends(require_kb_scope),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.list_kbs(
+            page=_to_int(request.query_params.get("page"), 1),
+            page_size=_to_int(request.query_params.get("page_size"), 20),
+        ),
+        prefix="获取知识库列表失败",
+    )
+
+
+@router.post("/knowledge-bases")
+async def create_knowledge_base(
+    payload: KnowledgeBaseRequest,
+    _auth: AuthContext = Depends(require_kb_scope),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.create_kb(_model_dict(payload)),
+        prefix="创建知识库失败",
+    )
+
+
+@router.get("/knowledge-bases/tasks/{task_id}")
+async def get_knowledge_base_task(
+    task_id: str,
+    _auth: AuthContext = Depends(require_kb_scope),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.get_upload_progress(task_id),
+        prefix="获取上传进度失败",
+    )
+
+
+@router.get("/knowledge-bases/{kb_id}")
+async def get_knowledge_base(
+    kb_id: str,
+    _auth: AuthContext = Depends(require_kb_scope),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    return await _run(lambda: service.get_kb(kb_id), prefix="获取知识库详情失败")
+
+
+@router.put("/knowledge-bases/{kb_id}")
+async def update_knowledge_base(
+    kb_id: str,
+    payload: KnowledgeBaseRequest,
+    _auth: AuthContext = Depends(require_kb_scope),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    body = _model_dict(payload)
+    return await _run(
+        lambda: service.update_kb({"kb_id": kb_id, **body}),
+        prefix="更新知识库失败",
+    )
+
+
+@router.delete("/knowledge-bases/{kb_id}")
+async def delete_knowledge_base(
+    kb_id: str,
+    _auth: AuthContext = Depends(require_kb_scope),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.delete_kb({"kb_id": kb_id}), prefix="删除知识库失败"
+    )
+
+
+@router.get("/knowledge-bases/{kb_id}/stats")
+async def get_knowledge_base_stats(
+    kb_id: str,
+    _auth: AuthContext = Depends(require_kb_scope),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.get_kb_stats(kb_id),
+        prefix="获取知识库统计失败",
+    )
+
+
+@router.get("/knowledge-bases/{kb_id}/documents")
+async def list_knowledge_base_documents(
+    kb_id: str,
+    request: Request,
+    _auth: AuthContext = Depends(require_kb_scope),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.list_documents(
+            kb_id=kb_id,
+            page=_to_int(request.query_params.get("page"), 1),
+            page_size=_to_int(request.query_params.get("page_size"), 100),
+        ),
+        prefix="获取文档列表失败",
+    )
+
+
+@router.post("/knowledge-bases/{kb_id}/documents")
+async def upload_knowledge_base_document(
+    kb_id: str,
+    request: Request,
+    _auth: AuthContext = Depends(require_kb_scope),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    async def _operation():
+        form_data, files = await multipart_parts(request, extra_form={"kb_id": kb_id})
+        return await service.upload_document(
+            content_type=request.headers.get("content-type"),
+            form_data=form_data,
+            files=files,
+        )
+
+    return await _run(_operation, prefix="上传文档失败")
+
+
+@router.post("/knowledge-bases/{kb_id}/documents/import")
+async def import_knowledge_base_documents(
+    kb_id: str,
+    payload: KnowledgeBaseImportRequest,
+    _auth: AuthContext = Depends(require_kb_scope),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    body = _model_dict(payload)
+    return await _run(
+        lambda: service.import_documents({"kb_id": kb_id, **body}),
+        prefix="导入文档失败",
+    )
+
+
+@router.post("/knowledge-bases/{kb_id}/documents/import-url")
+async def import_knowledge_base_document_url(
+    kb_id: str,
+    payload: KnowledgeBaseUrlImportRequest,
+    _auth: AuthContext = Depends(require_kb_scope),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    body = _model_dict(payload)
+    return await _run(
+        lambda: service.upload_document_from_url({"kb_id": kb_id, **body}),
+        prefix="从URL上传文档失败",
+    )
+
+
+@router.get("/knowledge-bases/{kb_id}/documents/{document_id}")
+async def get_knowledge_base_document(
+    kb_id: str,
+    document_id: str,
+    _auth: AuthContext = Depends(require_kb_scope),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.get_document(kb_id=kb_id, doc_id=document_id),
+        prefix="获取文档详情失败",
+    )
+
+
+@router.delete("/knowledge-bases/{kb_id}/documents/{document_id}")
+async def delete_knowledge_base_document(
+    kb_id: str,
+    document_id: str,
+    _auth: AuthContext = Depends(require_kb_scope),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.delete_document({"kb_id": kb_id, "doc_id": document_id}),
+        prefix="删除文档失败",
+    )
+
+
+@router.get("/knowledge-bases/{kb_id}/chunks")
+async def list_knowledge_base_chunks(
+    kb_id: str,
+    request: Request,
+    _auth: AuthContext = Depends(require_kb_scope),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    document_id = request.query_params.get("document_id") or request.query_params.get(
+        "doc_id"
+    )
+    return await _run(
+        lambda: service.list_chunks(
+            kb_id=kb_id,
+            doc_id=document_id,
+            page=_to_int(request.query_params.get("page"), 1),
+            page_size=_to_int(request.query_params.get("page_size"), 100),
+        ),
+        prefix="获取块列表失败",
+    )
+
+
+@router.delete("/knowledge-bases/{kb_id}/chunks/{chunk_id}")
+async def delete_knowledge_base_chunk(
+    kb_id: str,
+    chunk_id: str,
+    request: Request,
+    _auth: AuthContext = Depends(require_kb_scope),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    document_id = request.query_params.get("document_id") or request.query_params.get(
+        "doc_id"
+    )
+    return await _run(
+        lambda: service.delete_chunk(
+            {"kb_id": kb_id, "chunk_id": chunk_id, "doc_id": document_id}
+        ),
+        prefix="删除文本块失败",
+    )
+
+
+@router.post("/knowledge-bases/{kb_id}/retrieve")
+async def retrieve_knowledge_base(
+    kb_id: str,
+    payload: KnowledgeBaseRetrieveRequest,
+    _auth: AuthContext = Depends(require_kb_scope),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    body = _model_dict(payload)
+    return await _run(
+        lambda: service.retrieve({"kb_id": kb_id, **body}),
+        prefix="检索失败",
+    )
+
+
+@legacy_router.get("/list")
+async def dashboard_list_kbs(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.list_kbs(
+            page=_to_int(request.query_params.get("page"), 1),
+            page_size=_to_int(request.query_params.get("page_size"), 20),
+        ),
+        prefix="获取知识库列表失败",
+    )
+
+
+@legacy_router.post("/create")
+async def dashboard_create_kb(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    return await _run_json(request, service.create_kb, prefix="创建知识库失败")
+
+
+@legacy_router.get("/get")
+async def dashboard_get_kb(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.get_kb(request.query_params.get("kb_id")),
+        prefix="获取知识库详情失败",
+    )
+
+
+@legacy_router.post("/update")
+async def dashboard_update_kb(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    return await _run_json(request, service.update_kb, prefix="更新知识库失败")
+
+
+@legacy_router.post("/delete")
+async def dashboard_delete_kb(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    return await _run_json(request, service.delete_kb, prefix="删除知识库失败")
+
+
+@legacy_router.get("/stats")
+async def dashboard_get_kb_stats(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.get_kb_stats(request.query_params.get("kb_id")),
+        prefix="获取知识库统计失败",
+    )
+
+
+@legacy_router.get("/document/list")
+async def dashboard_list_documents(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.list_documents(
+            kb_id=request.query_params.get("kb_id"),
+            page=_to_int(request.query_params.get("page"), 1),
+            page_size=_to_int(request.query_params.get("page_size"), 100),
+        ),
+        prefix="获取文档列表失败",
+    )
+
+
+@legacy_router.post("/document/upload")
+async def dashboard_upload_document(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    async def _operation():
+        form_data, files = await multipart_parts(request)
+        return await service.upload_document(
+            content_type=request.headers.get("content-type"),
+            form_data=form_data,
+            files=files,
+        )
+
+    return await _run(_operation, prefix="上传文档失败")
+
+
+@legacy_router.post("/document/import")
+async def dashboard_import_documents(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    return await _run_json(request, service.import_documents, prefix="导入文档失败")
+
+
+@legacy_router.post("/document/upload/url")
+async def dashboard_upload_document_from_url(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    return await _run_json(
+        request,
+        service.upload_document_from_url,
+        prefix="从URL上传文档失败",
+    )
+
+
+@legacy_router.get("/document/upload/progress")
+async def dashboard_get_upload_progress(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.get_upload_progress(request.query_params.get("task_id")),
+        prefix="获取上传进度失败",
+    )
+
+
+@legacy_router.get("/document/get")
+async def dashboard_get_document(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.get_document(
+            kb_id=request.query_params.get("kb_id"),
+            doc_id=request.query_params.get("doc_id"),
+        ),
+        prefix="获取文档详情失败",
+    )
+
+
+@legacy_router.post("/document/delete")
+async def dashboard_delete_document(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    return await _run_json(request, service.delete_document, prefix="删除文档失败")
+
+
+@legacy_router.get("/chunk/list")
+async def dashboard_list_chunks(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.list_chunks(
+            kb_id=request.query_params.get("kb_id"),
+            doc_id=request.query_params.get("doc_id"),
+            page=_to_int(request.query_params.get("page"), 1),
+            page_size=_to_int(request.query_params.get("page_size"), 100),
+        ),
+        prefix="获取块列表失败",
+    )
+
+
+@legacy_router.post("/chunk/delete")
+async def dashboard_delete_chunk(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    return await _run_json(request, service.delete_chunk, prefix="删除文本块失败")
+
+
+@legacy_router.post("/retrieve")
+async def dashboard_retrieve(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: KnowledgeBaseService = Depends(get_service),
+):
+    return await _run_json(request, service.retrieve, prefix="检索失败")
diff --git a/astrbot/dashboard/api/live_chat.py b/astrbot/dashboard/api/live_chat.py
new file mode 100644
index 000000000..470e6abf5
--- /dev/null
+++ b/astrbot/dashboard/api/live_chat.py
@@ -0,0 +1,52 @@
+from __future__ import annotations
+
+from fastapi import APIRouter, WebSocket
+
+from astrbot.dashboard.services.live_chat_service import LiveChatService
+
+router = APIRouter(tags=["Live Chat"])
+legacy_router = APIRouter(
+    prefix="/api",
+    tags=["Dashboard Live Chat"],
+    include_in_schema=False,
+)
+
+
+def get_service(websocket: WebSocket) -> LiveChatService:
+    return websocket.app.state.services.live_chat
+
+
+async def _run_live_chat_ws(
+    websocket: WebSocket,
+    *,
+    force_ct: str | None,
+) -> None:
+    await websocket.accept()
+    service = get_service(websocket)
+    await service.run_websocket_session(
+        token=websocket.query_params.get("token"),
+        force_ct=force_ct,
+        receive_json=websocket.receive_json,
+        send_json=websocket.send_json,
+        close=websocket.close,
+    )
+
+
+@router.websocket("/live-chat/ws")
+async def live_chat_ws(websocket: WebSocket) -> None:
+    await _run_live_chat_ws(websocket, force_ct="live")
+
+
+@router.websocket("/unified-chat/ws")
+async def unified_chat_ws(websocket: WebSocket) -> None:
+    await _run_live_chat_ws(websocket, force_ct=None)
+
+
+@legacy_router.websocket("/live_chat/ws")
+async def dashboard_live_chat_ws(websocket: WebSocket) -> None:
+    await _run_live_chat_ws(websocket, force_ct="live")
+
+
+@legacy_router.websocket("/unified_chat/ws")
+async def dashboard_unified_chat_ws(websocket: WebSocket) -> None:
+    await _run_live_chat_ws(websocket, force_ct=None)
diff --git a/astrbot/dashboard/api/logs.py b/astrbot/dashboard/api/logs.py
new file mode 100644
index 000000000..de5e6b572
--- /dev/null
+++ b/astrbot/dashboard/api/logs.py
@@ -0,0 +1,131 @@
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, Header, Request
+from fastapi.responses import StreamingResponse
+
+from astrbot.dashboard.responses import ApiError, ok
+from astrbot.dashboard.schemas import TraceSettingsRequest
+from astrbot.dashboard.services.log_service import LogService, LogServiceError
+
+from .auth import AuthContext, require_dashboard_user, require_scope
+
+router = APIRouter(tags=["Logs"])
+legacy_router = APIRouter(
+    prefix="/api",
+    tags=["Dashboard Logs"],
+    include_in_schema=False,
+)
+
+
+async def require_system_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "system")
+
+
+def get_service(request: Request) -> LogService:
+    return request.app.state.services.logs
+
+
+def _raise_log_error(exc: LogServiceError) -> None:
+    raise ApiError(str(exc)) from exc
+
+
+def _log_stream_response(last_event_id: str | None, service: LogService):
+    return StreamingResponse(
+        service.stream_log_events(last_event_id),
+        media_type="text/event-stream",
+        headers={
+            "Cache-Control": "no-cache",
+            "Connection": "keep-alive",
+            "Transfer-Encoding": "chunked",
+        },
+    )
+
+
+def _get_log_history(service: LogService):
+    try:
+        return ok(service.get_log_history())
+    except LogServiceError as exc:
+        _raise_log_error(exc)
+
+
+def _get_trace_settings(service: LogService):
+    try:
+        return ok(service.get_trace_settings())
+    except LogServiceError as exc:
+        _raise_log_error(exc)
+
+
+def _update_trace_settings(payload: TraceSettingsRequest, service: LogService):
+    try:
+        message = service.update_trace_settings(payload.model_dump(exclude_none=True))
+        return ok(message=message)
+    except LogServiceError as exc:
+        _raise_log_error(exc)
+
+
+@router.get("/logs/history")
+async def get_log_history(
+    _auth: AuthContext = Depends(require_system_scope),
+    service: LogService = Depends(get_service),
+):
+    return _get_log_history(service)
+
+
+@router.get("/logs/live")
+async def live_logs(
+    last_event_id: str | None = Header(default=None, alias="Last-Event-ID"),
+    _auth: AuthContext = Depends(require_system_scope),
+    service: LogService = Depends(get_service),
+):
+    return _log_stream_response(last_event_id, service)
+
+
+@router.get("/trace/settings")
+async def get_trace_settings(
+    _auth: AuthContext = Depends(require_system_scope),
+    service: LogService = Depends(get_service),
+):
+    return _get_trace_settings(service)
+
+
+@router.put("/trace/settings")
+async def update_trace_settings(
+    payload: TraceSettingsRequest,
+    _auth: AuthContext = Depends(require_system_scope),
+    service: LogService = Depends(get_service),
+):
+    return _update_trace_settings(payload, service)
+
+
+@legacy_router.get("/log-history")
+async def get_dashboard_log_history(
+    _username: str = Depends(require_dashboard_user),
+    service: LogService = Depends(get_service),
+):
+    return _get_log_history(service)
+
+
+@legacy_router.get("/live-log")
+async def get_dashboard_live_logs(
+    last_event_id: str | None = Header(default=None, alias="Last-Event-ID"),
+    _username: str = Depends(require_dashboard_user),
+    service: LogService = Depends(get_service),
+):
+    return _log_stream_response(last_event_id, service)
+
+
+@legacy_router.get("/trace/settings")
+async def get_dashboard_trace_settings(
+    _username: str = Depends(require_dashboard_user),
+    service: LogService = Depends(get_service),
+):
+    return _get_trace_settings(service)
+
+
+@legacy_router.post("/trace/settings")
+async def update_dashboard_trace_settings(
+    payload: TraceSettingsRequest,
+    _username: str = Depends(require_dashboard_user),
+    service: LogService = Depends(get_service),
+):
+    return _update_trace_settings(payload, service)
diff --git a/astrbot/dashboard/api/multipart.py b/astrbot/dashboard/api/multipart.py
new file mode 100644
index 000000000..4979ddfb9
--- /dev/null
+++ b/astrbot/dashboard/api/multipart.py
@@ -0,0 +1,107 @@
+from __future__ import annotations
+
+from collections.abc import Callable
+from pathlib import Path
+from typing import Any
+
+from fastapi import Request
+from starlette.datastructures import UploadFile as StarletteUploadFile
+
+
+class UploadFileAdapter:
+    def __init__(self, upload_file: StarletteUploadFile) -> None:
+        self._upload_file = upload_file
+        self.filename = upload_file.filename
+        self.content_type = upload_file.content_type
+        self.headers = upload_file.headers
+        self.content_length = self._resolve_content_length()
+
+    def _resolve_content_length(self) -> int | None:
+        try:
+            raw = self.headers.get("content-length")
+            return int(raw) if raw else None
+        except (TypeError, ValueError):
+            return None
+
+    async def save(self, destination: str | Path) -> None:
+        path = Path(destination)
+        try:
+            await self._upload_file.seek(0)
+        except Exception:
+            pass
+        with path.open("wb") as output:
+            while True:
+                chunk = await self._upload_file.read(1024 * 1024)
+                if not chunk:
+                    break
+                output.write(chunk)
+
+
+class MultiDict:
+    def __init__(self, pairs: list[tuple[str, Any]]) -> None:
+        self._pairs = pairs
+
+    def get(self, key: str, default: Any = None, type: Callable | None = None):
+        for item_key, item_value in reversed(self._pairs):
+            if item_key != key:
+                continue
+            if type is None:
+                return item_value
+            try:
+                return type(item_value)
+            except (TypeError, ValueError):
+                return default
+        return default
+
+    def getlist(self, key: str) -> list[Any]:
+        return [item_value for item_key, item_value in self._pairs if item_key == key]
+
+    def keys(self):
+        return dict.fromkeys(item_key for item_key, _ in self._pairs).keys()
+
+    def values(self):
+        return [self[key] for key in self.keys()]
+
+    def __contains__(self, key: str) -> bool:
+        return any(item_key == key for item_key, _ in self._pairs)
+
+    def __getitem__(self, key: str):
+        value = self.get(key)
+        if value is None and key not in self:
+            raise KeyError(key)
+        return value
+
+    def __bool__(self) -> bool:
+        return bool(self._pairs)
+
+
+async def multipart_parts(
+    request: Request,
+    *,
+    extra_form: dict[str, Any] | None = None,
+) -> tuple[MultiDict, MultiDict]:
+    form = await request.form()
+    form_pairs: list[tuple[str, Any]] = []
+    file_pairs: list[tuple[str, Any]] = []
+    for key, value in form.multi_items():
+        if isinstance(value, StarletteUploadFile):
+            file_pairs.append((key, UploadFileAdapter(value)))
+        else:
+            form_pairs.append((key, value))
+    form_data = MultiDict(form_pairs)
+    for key, value in (extra_form or {}).items():
+        if value is not None and key not in form_data:
+            form_pairs.append((key, value))
+    return MultiDict(form_pairs), MultiDict(file_pairs)
+
+
+async def single_upload(
+    request: Request,
+    *,
+    field_name: str = "file",
+) -> UploadFileAdapter | None:
+    _, files = await multipart_parts(request)
+    upload = files.get(field_name)
+    if isinstance(upload, UploadFileAdapter):
+        return upload
+    return None
diff --git a/astrbot/dashboard/api/open_api.py b/astrbot/dashboard/api/open_api.py
new file mode 100644
index 000000000..b6eb41cce
--- /dev/null
+++ b/astrbot/dashboard/api/open_api.py
@@ -0,0 +1,314 @@
+from __future__ import annotations
+
+from typing import Any
+
+from fastapi import APIRouter, Depends, Request, WebSocket
+from fastapi.responses import FileResponse, JSONResponse, StreamingResponse
+
+from astrbot.dashboard.responses import ApiError, error, ok
+from astrbot.dashboard.schemas import ImMessageRequest, OpenApiChatRequest
+from astrbot.dashboard.services.chat_service import (
+    ChatService,
+    ChatServiceError,
+    extract_web_search_refs,
+)
+from astrbot.dashboard.services.open_api_service import (
+    OpenApiService,
+    OpenApiServiceError,
+    OpenApiWebSocketChatBridge,
+)
+
+from .auth import AuthContext, require_scope
+from .multipart import single_upload
+
+router = APIRouter(tags=["Open API"])
+
+
+async def require_im_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "im")
+
+
+async def require_chat_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "chat")
+
+
+async def require_config_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "config")
+
+
+async def require_file_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "file")
+
+
+def get_service(request: Request) -> OpenApiService:
+    return request.app.state.services.open_api
+
+
+def get_chat_service(request: Request) -> ChatService:
+    return request.app.state.services.chat
+
+
+def _model_dict(payload) -> dict[str, Any]:
+    if payload is None:
+        return {}
+    if hasattr(payload, "model_dump"):
+        return payload.model_dump(exclude_unset=True, exclude_none=False)
+    return payload if isinstance(payload, dict) else {}
+
+
+def _open_api_error(message: str) -> JSONResponse:
+    return JSONResponse(error(message))
+
+
+def _get_chat_config_list(service: OpenApiService) -> list[dict]:
+    return service.get_chat_config_list()
+
+
+async def _build_streaming_chat_response(
+    chat_service: ChatService,
+    username: str,
+    post_data: dict[str, Any],
+) -> StreamingResponse | JSONResponse:
+    try:
+        stream = await chat_service.build_chat_stream(username, post_data)
+    except ChatServiceError as exc:
+        return _open_api_error(str(exc))
+
+    return StreamingResponse(
+        stream,
+        media_type="text/event-stream",
+        headers={
+            "Cache-Control": "no-cache",
+            "Transfer-Encoding": "chunked",
+            "Connection": "keep-alive",
+        },
+    )
+
+
+async def _open_api_chat_response(
+    post_data: dict[str, Any],
+    auth: AuthContext,
+    open_api_service: OpenApiService,
+    chat_service: ChatService,
+) -> StreamingResponse | JSONResponse:
+    if auth.via != "api_key":
+        return await _build_streaming_chat_response(
+            chat_service,
+            auth.username,
+            post_data,
+        )
+
+    try:
+        (
+            effective_username,
+            session_id,
+            config_id,
+        ) = await open_api_service.prepare_chat_send(
+            post_data,
+            _get_chat_config_list(open_api_service),
+        )
+    except OpenApiServiceError as exc:
+        return _open_api_error(str(exc))
+
+    config_err = await open_api_service.update_session_config_route(
+        username=effective_username,
+        session_id=session_id,
+        config_id=config_id,
+    )
+    if config_err:
+        return _open_api_error(config_err)
+
+    return await _build_streaming_chat_response(
+        chat_service,
+        effective_username,
+        post_data,
+    )
+
+
+async def _insert_webchat_user_message(
+    service: OpenApiService,
+    session_id: str,
+    effective_username: str,
+    message_parts: list,
+) -> None:
+    await service.insert_webchat_user_message(
+        session_id=session_id,
+        effective_username=effective_username,
+        message_parts=message_parts,
+    )
+
+
+def _build_chat_ws_bridge(
+    open_api_service: OpenApiService,
+    chat_service: ChatService,
+) -> OpenApiWebSocketChatBridge:
+    return OpenApiWebSocketChatBridge(
+        build_user_message_parts=lambda message: chat_service.build_user_message_parts(
+            message if isinstance(message, str | list) else str(message),
+        ),
+        create_attachment_from_file=chat_service.create_attachment_from_file,
+        extract_web_search_refs=extract_web_search_refs,
+        insert_user_message=lambda session_id, effective_username, message_parts: (
+            _insert_webchat_user_message(
+                open_api_service,
+                session_id,
+                effective_username,
+                message_parts,
+            )
+        ),
+        save_bot_message=chat_service.save_bot_message,
+    )
+
+
+def _extract_ws_api_key(websocket: WebSocket) -> str | None:
+    if key := websocket.query_params.get("api_key"):
+        return key.strip()
+    if key := websocket.query_params.get("key"):
+        return key.strip()
+    if key := websocket.headers.get("X-API-Key"):
+        return key.strip()
+
+    auth_header = websocket.headers.get("Authorization", "").strip()
+    if auth_header.startswith("Bearer "):
+        return auth_header.removeprefix("Bearer ").strip()
+    if auth_header.startswith("ApiKey "):
+        return auth_header.removeprefix("ApiKey ").strip()
+    return None
+
+
+@router.post("/chat")
+async def chat(
+    payload: OpenApiChatRequest,
+    auth: AuthContext = Depends(require_chat_scope),
+    service: OpenApiService = Depends(get_service),
+    chat_service: ChatService = Depends(get_chat_service),
+):
+    return await _open_api_chat_response(
+        _model_dict(payload),
+        auth,
+        service,
+        chat_service,
+    )
+
+
+@router.get("/chat/sessions")
+async def chat_sessions(
+    request: Request,
+    auth: AuthContext = Depends(require_chat_scope),
+    service: OpenApiService = Depends(get_service),
+    chat_service: ChatService = Depends(get_chat_service),
+):
+    if auth.via != "api_key":
+        try:
+            return ok(
+                await chat_service.get_sessions(
+                    auth.username,
+                    request.query_params.get("platform_id"),
+                )
+            )
+        except ChatServiceError as exc:
+            return error(str(exc))
+
+    try:
+        return ok(
+            await service.get_chat_sessions_from_dashboard_query(
+                username=request.query_params.get("username"),
+                page=request.query_params.get("page", 1),
+                page_size=request.query_params.get("page_size", 20),
+                platform_id=request.query_params.get("platform_id"),
+            )
+        )
+    except OpenApiServiceError as exc:
+        return error(str(exc))
+
+
+@router.get("/configs", include_in_schema=False)
+async def get_chat_configs(
+    _auth: AuthContext = Depends(require_config_scope),
+    service: OpenApiService = Depends(get_service),
+):
+    return ok(service.get_chat_configs())
+
+
+@router.post("/file", include_in_schema=False)
+async def upload_open_api_file(
+    request: Request,
+    _auth: AuthContext = Depends(require_file_scope),
+    chat_service: ChatService = Depends(get_chat_service),
+):
+    try:
+        upload = await single_upload(request)
+        if upload is None:
+            raise ChatServiceError("Missing key: file")
+        return ok(await chat_service.save_uploaded_file(upload))
+    except ChatServiceError as exc:
+        return error(str(exc))
+
+
+@router.get("/file", include_in_schema=False)
+async def get_open_api_file(
+    request: Request,
+    _auth: AuthContext = Depends(require_file_scope),
+    chat_service: ChatService = Depends(get_chat_service),
+):
+    try:
+        file_path, mimetype = await chat_service.resolve_attachment_file(
+            request.query_params.get("attachment_id")
+        )
+        return FileResponse(file_path, media_type=mimetype)
+    except ChatServiceError as exc:
+        return _open_api_error(str(exc))
+    except (FileNotFoundError, OSError):
+        return _open_api_error("File access error")
+
+
+@router.websocket("/chat/ws")
+async def chat_ws(websocket: WebSocket) -> None:
+    await websocket.accept()
+    service: OpenApiService = websocket.app.state.services.open_api
+    chat_service: ChatService = websocket.app.state.services.chat
+
+    async def close_ws(code: int, reason: str) -> None:
+        await websocket.close(code=code, reason=reason)
+
+    await service.run_chat_websocket(
+        raw_api_key=_extract_ws_api_key(websocket),
+        receive_json=websocket.receive_json,
+        send_json=websocket.send_json,
+        close=close_ws,
+        conf_list=_get_chat_config_list(service),
+        chat_bridge=_build_chat_ws_bridge(service, chat_service),
+    )
+
+
+@router.post("/im/messages")
+async def send_im_message(
+    payload: ImMessageRequest,
+    _auth: AuthContext = Depends(require_im_scope),
+    service: OpenApiService = Depends(get_service),
+):
+    body = _model_dict(payload)
+    try:
+        await service.send_message(body)
+    except OpenApiServiceError as exc:
+        raise ApiError(str(exc)) from exc
+
+    return ok()
+
+
+@router.post("/im/message", include_in_schema=False)
+async def send_im_message_alias(
+    payload: ImMessageRequest,
+    auth: AuthContext = Depends(require_im_scope),
+    service: OpenApiService = Depends(get_service),
+):
+    return await send_im_message(payload, auth, service)
+
+
+@router.get("/im/bots")
+async def list_im_bots(
+    _request: Request,
+    _auth: AuthContext = Depends(require_im_scope),
+    service: OpenApiService = Depends(get_service),
+):
+    return ok(service.get_bots())
diff --git a/astrbot/dashboard/api/personas.py b/astrbot/dashboard/api/personas.py
new file mode 100644
index 000000000..ae83e5452
--- /dev/null
+++ b/astrbot/dashboard/api/personas.py
@@ -0,0 +1,334 @@
+from __future__ import annotations
+
+from typing import Any
+
+from fastapi import APIRouter, Depends, Query, Request
+
+from astrbot.dashboard.async_utils import run_maybe_async
+from astrbot.dashboard.responses import ApiError, ok
+from astrbot.dashboard.schemas import (
+    PersonaByIdRequest,
+    PersonaFolderRequest,
+    PersonaMoveRequest,
+    PersonaReorderRequest,
+    PersonaRequest,
+)
+from astrbot.dashboard.services.persona_service import (
+    PersonaService,
+    PersonaServiceError,
+)
+
+from .auth import AuthContext, require_dashboard_user, require_scope
+
+router = APIRouter(tags=["Personas"])
+legacy_router = APIRouter(
+    prefix="/api/persona",
+    tags=["Dashboard Personas"],
+    include_in_schema=False,
+)
+
+
+def get_service(request: Request) -> PersonaService:
+    return request.app.state.services.personas
+
+
+async def require_persona_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "persona")
+
+
+async def _json_or_empty(request: Request) -> dict[str, Any]:
+    try:
+        data = await request.json()
+    except Exception:
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def _model_dict(payload) -> dict[str, Any]:
+    return payload.model_dump(exclude_none=True)
+
+
+def _raise_persona_error(exc: PersonaServiceError | ValueError) -> None:
+    raise ApiError(str(exc)) from exc
+
+
+async def _run(operation):
+    try:
+        result = await run_maybe_async(operation)
+        return ok(result)
+    except (PersonaServiceError, ValueError) as exc:
+        _raise_persona_error(exc)
+
+
+@router.get("/personas/tree")
+async def persona_tree(
+    _auth: AuthContext = Depends(require_persona_scope),
+    service: PersonaService = Depends(get_service),
+):
+    return await _run(service.get_folder_tree)
+
+
+@router.get("/personas")
+async def list_personas(
+    request: Request,
+    folder_id: str | None = Query(default=None),
+    _auth: AuthContext = Depends(require_persona_scope),
+    service: PersonaService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.list_personas(folder_id, "folder_id" in request.query_params)
+    )
+
+
+@router.post("/personas")
+async def create_persona(
+    payload: PersonaRequest,
+    _auth: AuthContext = Depends(require_persona_scope),
+    service: PersonaService = Depends(get_service),
+):
+    return await _run(lambda: service.create_persona(_model_dict(payload)))
+
+
+@router.get("/personas/by-id")
+async def get_persona_by_id(
+    persona_id: str = Query(...),
+    _auth: AuthContext = Depends(require_persona_scope),
+    service: PersonaService = Depends(get_service),
+):
+    return await _run(lambda: service.get_persona_detail({"persona_id": persona_id}))
+
+
+@router.put("/personas/by-id")
+async def update_persona_by_id(
+    payload: PersonaByIdRequest,
+    _auth: AuthContext = Depends(require_persona_scope),
+    service: PersonaService = Depends(get_service),
+):
+    return await _run(lambda: service.update_persona(_model_dict(payload)))
+
+
+@router.delete("/personas/by-id")
+async def delete_persona_by_id(
+    persona_id: str = Query(...),
+    _auth: AuthContext = Depends(require_persona_scope),
+    service: PersonaService = Depends(get_service),
+):
+    return await _run(lambda: service.delete_persona({"persona_id": persona_id}))
+
+
+@router.post("/personas/move")
+async def move_persona(
+    payload: PersonaMoveRequest,
+    _auth: AuthContext = Depends(require_persona_scope),
+    service: PersonaService = Depends(get_service),
+):
+    return await _run(lambda: service.move_persona(_model_dict(payload)))
+
+
+@router.post("/personas/reorder")
+async def reorder_personas(
+    payload: PersonaReorderRequest,
+    _auth: AuthContext = Depends(require_persona_scope),
+    service: PersonaService = Depends(get_service),
+):
+    return await _run(lambda: service.reorder_items(_model_dict(payload)))
+
+
+@router.get("/persona-folders")
+async def list_persona_folders(
+    parent_id: str | None = Query(default=None),
+    _auth: AuthContext = Depends(require_persona_scope),
+    service: PersonaService = Depends(get_service),
+):
+    return await _run(lambda: service.list_folders(parent_id))
+
+
+@router.post("/persona-folders")
+async def create_persona_folder(
+    payload: PersonaFolderRequest,
+    _auth: AuthContext = Depends(require_persona_scope),
+    service: PersonaService = Depends(get_service),
+):
+    return await _run(lambda: service.create_folder(_model_dict(payload)))
+
+
+@router.put("/persona-folders/{folder_id:path}")
+async def update_persona_folder(
+    folder_id: str,
+    payload: PersonaFolderRequest,
+    _auth: AuthContext = Depends(require_persona_scope),
+    service: PersonaService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.update_folder({"folder_id": folder_id, **_model_dict(payload)})
+    )
+
+
+@router.delete("/persona-folders/{folder_id:path}")
+async def delete_persona_folder(
+    folder_id: str,
+    _auth: AuthContext = Depends(require_persona_scope),
+    service: PersonaService = Depends(get_service),
+):
+    return await _run(lambda: service.delete_folder({"folder_id": folder_id}))
+
+
+@router.get("/personas/{persona_id:path}")
+async def get_persona(
+    persona_id: str,
+    _auth: AuthContext = Depends(require_persona_scope),
+    service: PersonaService = Depends(get_service),
+):
+    return await _run(lambda: service.get_persona_detail({"persona_id": persona_id}))
+
+
+@router.put("/personas/{persona_id:path}")
+async def update_persona(
+    persona_id: str,
+    payload: PersonaRequest,
+    _auth: AuthContext = Depends(require_persona_scope),
+    service: PersonaService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.update_persona(
+            {"persona_id": persona_id, **_model_dict(payload)}
+        )
+    )
+
+
+@router.delete("/personas/{persona_id:path}")
+async def delete_persona(
+    persona_id: str,
+    _auth: AuthContext = Depends(require_persona_scope),
+    service: PersonaService = Depends(get_service),
+):
+    return await _run(lambda: service.delete_persona({"persona_id": persona_id}))
+
+
+@legacy_router.get("/list")
+async def list_dashboard_personas(
+    request: Request,
+    folder_id: str | None = Query(default=None),
+    _username: str = Depends(require_dashboard_user),
+    service: PersonaService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.list_personas(folder_id, "folder_id" in request.query_params)
+    )
+
+
+@legacy_router.post("/detail")
+async def get_dashboard_persona_detail(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PersonaService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.get_persona_detail(body))
+
+
+@legacy_router.post("/create")
+async def create_dashboard_persona(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PersonaService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.create_persona(body))
+
+
+@legacy_router.post("/update")
+async def update_dashboard_persona(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PersonaService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.update_persona(body))
+
+
+@legacy_router.post("/delete")
+async def delete_dashboard_persona(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PersonaService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.delete_persona(body))
+
+
+@legacy_router.post("/move")
+async def move_dashboard_persona(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PersonaService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.move_persona(body))
+
+
+@legacy_router.post("/reorder")
+async def reorder_dashboard_personas(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PersonaService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.reorder_items(body))
+
+
+@legacy_router.get("/folder/list")
+async def list_dashboard_persona_folders(
+    parent_id: str | None = Query(default=None),
+    _username: str = Depends(require_dashboard_user),
+    service: PersonaService = Depends(get_service),
+):
+    return await _run(lambda: service.list_folders(parent_id))
+
+
+@legacy_router.get("/folder/tree")
+async def get_dashboard_persona_folder_tree(
+    _username: str = Depends(require_dashboard_user),
+    service: PersonaService = Depends(get_service),
+):
+    return await _run(service.get_folder_tree)
+
+
+@legacy_router.post("/folder/detail")
+async def get_dashboard_persona_folder_detail(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PersonaService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.get_folder_detail(body))
+
+
+@legacy_router.post("/folder/create")
+async def create_dashboard_persona_folder(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PersonaService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.create_folder(body))
+
+
+@legacy_router.post("/folder/update")
+async def update_dashboard_persona_folder(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PersonaService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.update_folder(body))
+
+
+@legacy_router.post("/folder/delete")
+async def delete_dashboard_persona_folder(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PersonaService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.delete_folder(body))
diff --git a/astrbot/dashboard/api/platform.py b/astrbot/dashboard/api/platform.py
new file mode 100644
index 000000000..c6a6f7f55
--- /dev/null
+++ b/astrbot/dashboard/api/platform.py
@@ -0,0 +1,121 @@
+from __future__ import annotations
+
+from typing import Any
+
+from fastapi import APIRouter, Depends, Request
+
+from astrbot.dashboard.asgi_runtime import DashboardRequest
+from astrbot.dashboard.async_utils import run_maybe_async
+from astrbot.dashboard.responses import ApiError, ok
+from astrbot.dashboard.schemas import BotRegistrationRequest
+from astrbot.dashboard.services.platform_service import (
+    PlatformService,
+    PlatformServiceError,
+)
+
+from .auth import AuthContext, require_dashboard_user, require_scope
+
+router = APIRouter(tags=["Platforms"])
+legacy_router = APIRouter(
+    prefix="/api/platform",
+    tags=["Dashboard Platforms"],
+    include_in_schema=False,
+)
+
+
+def get_service(request: Request) -> PlatformService:
+    return request.app.state.services.platforms
+
+
+async def require_config_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "config")
+
+
+async def _json_or_empty(request: Request) -> dict[str, Any]:
+    try:
+        data = await request.json()
+    except Exception:
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def _raise_platform_error(exc: PlatformServiceError) -> None:
+    raise ApiError(str(exc), status_code=exc.status_code) from exc
+
+
+def _model_dict(payload) -> dict[str, Any]:
+    return payload.model_dump(exclude_none=True)
+
+
+async def _run(operation):
+    try:
+        result = await run_maybe_async(operation)
+        return ok(result)
+    except PlatformServiceError as exc:
+        _raise_platform_error(exc)
+
+
+@router.post("/bot-types/{bot_type}/registration")
+async def register_bot_type(
+    bot_type: str,
+    payload: BotRegistrationRequest,
+    _auth: AuthContext = Depends(require_config_scope),
+    service: PlatformService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.handle_platform_registration(bot_type, _model_dict(payload))
+    )
+
+
+@router.get("/webhooks/platforms/{webhook_uuid}")
+async def verify_platform_webhook(
+    webhook_uuid: str,
+    request: Request,
+    service: PlatformService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.handle_webhook_callback(webhook_uuid, DashboardRequest(request))
+    )
+
+
+@router.post("/webhooks/platforms/{webhook_uuid}")
+async def receive_platform_webhook(
+    webhook_uuid: str,
+    request: Request,
+    service: PlatformService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.handle_webhook_callback(webhook_uuid, DashboardRequest(request))
+    )
+
+
+@legacy_router.api_route("/webhook/{webhook_uuid}", methods=["GET", "POST"])
+async def dashboard_platform_webhook(
+    webhook_uuid: str,
+    request: Request,
+    service: PlatformService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.handle_webhook_callback(webhook_uuid, DashboardRequest(request))
+    )
+
+
+@legacy_router.get("/stats")
+async def get_dashboard_platform_stats(
+    _username: str = Depends(require_dashboard_user),
+    service: PlatformService = Depends(get_service),
+):
+    return await _run(service.get_platform_stats)
+
+
+@legacy_router.post("/registration/{platform_type}")
+async def handle_dashboard_platform_registration(
+    platform_type: str,
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PlatformService = Depends(get_service),
+):
+    payload = await _json_or_empty(request)
+    return await _run(
+        lambda: service.handle_platform_registration(platform_type, payload)
+    )
diff --git a/astrbot/dashboard/api/plugins.py b/astrbot/dashboard/api/plugins.py
new file mode 100644
index 000000000..7c4dadaeb
--- /dev/null
+++ b/astrbot/dashboard/api/plugins.py
@@ -0,0 +1,1426 @@
+from __future__ import annotations
+
+import re
+from collections.abc import Callable
+from typing import Any
+from urllib.parse import quote
+
+from fastapi import APIRouter, Body, Depends, Query, Request
+from fastapi.responses import PlainTextResponse, Response
+
+from astrbot.api.web import PluginRequest, bind_request_context
+from astrbot.core import logger
+from astrbot.dashboard.asgi_runtime import (
+    DashboardRequestState,
+    call_request_view,
+)
+from astrbot.dashboard.async_utils import run_maybe_async
+from astrbot.dashboard.responses import ok
+from astrbot.dashboard.schemas import (
+    EnabledPatch,
+    PluginByIdRequest,
+    PluginConfigFileDeleteRequest,
+    PluginConfigPayload,
+    PluginConfigUpdateRequest,
+    PluginEnabledRequest,
+    PluginInstallRequest,
+    PluginSourceRequest,
+    PluginUninstallRequest,
+    PluginUpdateRequest,
+    PluginVersionSupportRequest,
+)
+from astrbot.dashboard.services.config_service import (
+    ConfigDisplayService,
+    ConfigFileService,
+)
+from astrbot.dashboard.services.plugin_page_service import (
+    PluginPageContentPayload,
+    PluginPageService,
+    PluginPageServiceError,
+)
+from astrbot.dashboard.services.plugin_service import (
+    PLUGIN_OPERATION_FAILED_MESSAGE,
+    PluginService,
+    PluginServiceError,
+    PluginServiceWarning,
+)
+
+from .auth import AuthContext, require_dashboard_user, require_scope
+from .multipart import multipart_parts
+
+router = APIRouter(tags=["Plugins"])
+legacy_router = APIRouter(tags=["Dashboard Plugins"], include_in_schema=False)
+
+
+async def require_plugin_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "plugin")
+
+
+def get_service(request: Request) -> PluginService:
+    return request.app.state.services.plugins
+
+
+def get_page_service(request: Request) -> PluginPageService:
+    return request.app.state.services.plugin_pages
+
+
+def get_config_display_service(request: Request) -> ConfigDisplayService:
+    return request.app.state.services.config_display
+
+
+def get_config_file_service(request: Request) -> ConfigFileService:
+    return request.app.state.services.config_files
+
+
+async def _json_or_empty(request: Request) -> dict[str, Any]:
+    try:
+        data = await request.json()
+    except Exception:
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def _required_text(value: object, name: str) -> str:
+    text = str(value or "").strip()
+    if not text:
+        raise ValueError(f"Missing key: {name}")
+    return text
+
+
+def _plugin_id_from_body(body: dict[str, Any]) -> str:
+    return _required_text(body.get("plugin_id"), "plugin_id")
+
+
+def _model_dict(payload) -> dict[str, Any]:
+    if payload is None:
+        return {}
+    if hasattr(payload, "model_dump"):
+        return payload.model_dump(exclude_none=True)
+    return payload if isinstance(payload, dict) else {}
+
+
+def _service_ok(result):
+    if isinstance(result, tuple):
+        data, message = result
+        return ok(data, message)
+    return ok(result)
+
+
+async def _run_service(operation, *, log_label: str | None = None):
+    try:
+        result = await run_maybe_async(operation)
+        return _service_ok(result)
+    except PluginServiceWarning as exc:
+        return {
+            "status": "warning",
+            "message": exc.public_message,
+            "data": exc.data,
+        }
+    except PluginServiceError as exc:
+        return {"status": "error", "message": exc.public_message, "data": {}}
+    except Exception:
+        if log_label:
+            logger.error("%s failed", log_label, exc_info=True)
+        else:
+            logger.error("Plugin service operation failed", exc_info=True)
+        return {
+            "status": "error",
+            "message": PLUGIN_OPERATION_FAILED_MESSAGE,
+            "data": {},
+        }
+
+
+async def _run_json(
+    request: Request,
+    operation: Callable[[dict[str, Any]], Any],
+    *,
+    log_label: str | None = None,
+):
+    body = await _json_or_empty(request)
+    return await _run_service(lambda: operation(body), log_label=log_label)
+
+
+def _normalize_plugin_api_route(route: str) -> str:
+    route = route.strip()
+    if not route.startswith("/"):
+        route = f"/{route}"
+    return route
+
+
+def _plugin_api_route_pattern(route: str) -> str:
+    normalized = _normalize_plugin_api_route(route)
+    chunks = []
+    pos = 0
+    for match in re.finditer(r"<(?:(path):)?([A-Za-z_][A-Za-z0-9_]*)>", normalized):
+        chunks.append(re.escape(normalized[pos : match.start()]))
+        name = match.group(2)
+        chunks.append(f"(?P<{name}>.*)" if match.group(1) else f"(?P<{name}>[^/]+)")
+        pos = match.end()
+    chunks.append(re.escape(normalized[pos:]))
+    return "".join(chunks)
+
+
+def _match_registered_web_api(registered_web_apis, subpath: str, method: str):
+    request_path = f"/{subpath.lstrip('/')}"
+    request_method = method.upper()
+
+    for route, view_handler, methods, _ in registered_web_apis:
+        allowed_methods = [item.upper() for item in methods]
+        if request_method not in allowed_methods:
+            continue
+
+        pattern = _plugin_api_route_pattern(route)
+        matched = re.fullmatch(pattern, request_path)
+        if matched:
+            return view_handler, matched.groupdict()
+    return None
+
+
+def _plugin_extension_legacy_path(plugin_path: str, request: Request) -> str:
+    encoded_path = quote(plugin_path.lstrip("/"), safe="/:@!$&'()*+,;=-._~")
+    path = f"/api/plug/{encoded_path}"
+    if request.url.query:
+        return f"{path}?{request.url.query}"
+    return path
+
+
+async def _call_plugin_extension(
+    plugin_path: str,
+    request: Request,
+    username: str,
+):
+    registered_web_apis = (
+        request.app.state.core_lifecycle.star_context.registered_web_apis
+    )
+    matched_api = _match_registered_web_api(
+        registered_web_apis,
+        plugin_path,
+        request.method,
+    )
+    if not matched_api:
+        return {"status": "error", "message": "未找到该路由", "data": {}}
+
+    view_handler, path_values = matched_api
+    plugin_name = plugin_path.strip("/").split("/", 1)[0].strip() or None
+    plugin_request = PluginRequest(
+        request,
+        path_params=path_values,
+        plugin_name=plugin_name,
+        username=username,
+    )
+    app_adapter = getattr(request.app.state, "dashboard_app_adapter", None)
+    if app_adapter is None:
+        with bind_request_context(plugin_request):
+            return await run_maybe_async(lambda: view_handler(**path_values))
+
+    g_obj = DashboardRequestState()
+    g_obj.username = username
+    with bind_request_context(plugin_request):
+        return await call_request_view(
+            request,
+            app_adapter,
+            view_handler,
+            path_values,
+            g_obj=g_obj,
+            quart_compat_path=_plugin_extension_legacy_path(plugin_path, request),
+        )
+
+
+def _get_request_locale(request: Request, default: str = "zh-CN") -> str:
+    raw_locale = request.headers.get("Accept-Language", "").strip()
+    locale = raw_locale.split(",", 1)[0].split(";", 1)[0].strip()
+    if not locale or len(locale) > 32:
+        return default
+    return locale
+
+
+def _get_request_theme(request: Request) -> str | None:
+    theme = request.query_params.get("theme", "").strip()
+    return theme if theme in ("dark", "light") else None
+
+
+def _plugin_page_error_response(status_code: int, message: str):
+    return PlainTextResponse(
+        message,
+        status_code=status_code,
+        headers={
+            "Cache-Control": "no-store",
+            "Referrer-Policy": "no-referrer",
+        },
+    )
+
+
+def _plugin_page_payload_response(payload: PluginPageContentPayload):
+    return Response(
+        content=payload.content,
+        media_type=payload.content_type,
+        headers=PluginPageService.build_security_headers(),
+    )
+
+
+async def _serve_plugin_page_content(
+    *,
+    request: Request,
+    page_service: PluginPageService,
+    username: str | None,
+    plugin_id: str,
+    page_name: str,
+    asset_path: str,
+):
+    try:
+        payload = await page_service.serve_page_content(
+            plugin_name=plugin_id,
+            page_name=page_name,
+            asset_path=asset_path,
+            asset_token=request.query_params.get("asset_token", "").strip(),
+            username=username,
+            locale=_get_request_locale(request),
+            theme=_get_request_theme(request),
+        )
+    except PluginPageServiceError as exc:
+        return _plugin_page_error_response(exc.status_code, exc.public_message)
+    return _plugin_page_payload_response(payload)
+
+
+async def _serve_plugin_page_bridge_sdk(
+    *,
+    request: Request,
+    page_service: PluginPageService,
+):
+    try:
+        payload = await page_service.serve_bridge_sdk(
+            asset_token=request.query_params.get("asset_token", "").strip(),
+            locale=_get_request_locale(request),
+            theme=_get_request_theme(request),
+        )
+    except PluginPageServiceError as exc:
+        return _plugin_page_error_response(exc.status_code, exc.public_message)
+    return _plugin_page_payload_response(payload)
+
+
+async def _get_plugin_page_entry_config(
+    *,
+    request: Request,
+    page_service: PluginPageService,
+    username: str | None,
+    plugin_id: str | None,
+    page_name: str | None,
+):
+    try:
+        return ok(
+            await page_service.get_plugin_page_entry_config(
+                plugin_name=plugin_id,
+                page_name=page_name,
+                username=username,
+                locale=_get_request_locale(request),
+            )
+        )
+    except PluginPageServiceError as exc:
+        return {"status": "error", "message": exc.public_message, "data": {}}
+
+
+async def _list_plugins(
+    *,
+    request: Request,
+    service: PluginService,
+    page_service: PluginPageService,
+):
+    return await _run_service(
+        service.list_plugins_from_dashboard_query(
+            plugin_name=request.query_params.get("name")
+            or request.query_params.get("plugin_id"),
+            logo_token_resolver=service.get_plugin_logo_token,
+            installed_at_resolver=service.get_plugin_installed_at,
+            discover_pages=page_service.discover_plugin_pages,
+        ),
+        log_label="/api/plugin/get",
+    )
+
+
+async def _get_plugin_detail(
+    *,
+    plugin_id: str | None,
+    service: PluginService,
+    page_service: PluginPageService,
+):
+    return await _run_service(
+        service.get_plugin_detail(
+            plugin_name=plugin_id,
+            logo_token_resolver=service.get_plugin_logo_token,
+            installed_at_resolver=service.get_plugin_installed_at,
+            serialize_pages=page_service.serialize_plugin_pages,
+        ),
+        log_label="/api/plugin/detail",
+    )
+
+
+async def _install_plugin_upload(
+    request: Request,
+    service: PluginService,
+    *,
+    log_label: str,
+):
+    async def operation():
+        form, files = await multipart_parts(request)
+        upload_file = files.get("file")
+        if upload_file is None:
+            raise PluginServiceError("缺少插件文件")
+        return await service.install_plugin_upload_from_dashboard_form(
+            upload_file=upload_file,
+            ignore_version_check=form.get("ignore_version_check", "false"),
+        )
+
+    return await _run_service(operation, log_label=log_label)
+
+
+@router.get("/plugins/extensions/{plugin_path:path}")
+async def get_plugin_extension_route(
+    plugin_path: str,
+    request: Request,
+    auth: AuthContext = Depends(require_plugin_scope),
+):
+    return await _call_plugin_extension(plugin_path, request, auth.username)
+
+
+@router.post("/plugins/extensions/{plugin_path:path}")
+async def post_plugin_extension_route(
+    plugin_path: str,
+    request: Request,
+    auth: AuthContext = Depends(require_plugin_scope),
+):
+    return await _call_plugin_extension(plugin_path, request, auth.username)
+
+
+@router.put("/plugins/extensions/{plugin_path:path}")
+async def put_plugin_extension_route(
+    plugin_path: str,
+    request: Request,
+    auth: AuthContext = Depends(require_plugin_scope),
+):
+    return await _call_plugin_extension(plugin_path, request, auth.username)
+
+
+@router.patch("/plugins/extensions/{plugin_path:path}")
+async def patch_plugin_extension_route(
+    plugin_path: str,
+    request: Request,
+    auth: AuthContext = Depends(require_plugin_scope),
+):
+    return await _call_plugin_extension(plugin_path, request, auth.username)
+
+
+@router.delete("/plugins/extensions/{plugin_path:path}")
+async def delete_plugin_extension_route(
+    plugin_path: str,
+    request: Request,
+    auth: AuthContext = Depends(require_plugin_scope),
+):
+    return await _call_plugin_extension(plugin_path, request, auth.username)
+
+
+@router.get("/plugins/failed")
+async def list_failed_plugins(
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+):
+    return await _run_service(service.get_failed_plugins)
+
+
+@router.post("/plugins/update")
+async def update_plugins(
+    payload: PluginUpdateRequest,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+):
+    body = _model_dict(payload)
+    if body.get("plugin_id"):
+        plugin_id = _plugin_id_from_body(body)
+        return await _run_service(
+            service.update_plugin(
+                {
+                    "name": plugin_id,
+                    **{key: value for key, value in body.items() if key != "plugin_id"},
+                }
+            ),
+            log_label="/api/plugin/update",
+        )
+    return await _run_service(
+        service.update_all_plugins(
+            {
+                **body,
+                "names": body.get("names") or body.get("plugin_ids") or [],
+            }
+        ),
+        log_label="/api/plugin/update-all",
+    )
+
+
+async def _check_plugin_version_support_payload(
+    payload: dict[str, Any],
+    service: PluginService,
+):
+    return await _run_service(
+        lambda: service.check_plugin_version_support(payload),
+        log_label="/api/plugin/version-support/check",
+    )
+
+
+async def _check_plugin_version_support_request(
+    request: Request,
+    service: PluginService,
+):
+    return await _check_plugin_version_support_payload(
+        await _json_or_empty(request),
+        service,
+    )
+
+
+@router.post("/plugins/version-support/check")
+async def check_plugin_version_support(
+    payload: PluginVersionSupportRequest,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+):
+    return await _check_plugin_version_support_payload(_model_dict(payload), service)
+
+
+@router.post("/plugins/install/github")
+async def install_plugin_from_github(
+    payload: PluginInstallRequest,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+):
+    body = _model_dict(payload)
+    repository = str(body.get("repository") or body.get("url") or "").strip()
+    if repository and not repository.startswith(("http://", "https://")):
+        repository = f"https://github.com/{repository}"
+    install_payload = {
+        "url": repository,
+        "proxy": body.get("proxy"),
+        "ignore_version_check": body.get("ignore_version_check", False),
+    }
+    if body.get("download_url"):
+        install_payload["download_url"] = body["download_url"]
+    return await _run_service(
+        service.install_plugin(install_payload),
+        log_label="/api/plugin/install",
+    )
+
+
+@router.post("/plugins/install/url")
+async def install_plugin_from_url(
+    payload: PluginInstallRequest | None = Body(default=None),
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+):
+    body = _model_dict(payload)
+    url = str(body.get("url") or body.get("repository") or "").strip()
+    download_url = str(body.get("download_url") or url).strip()
+    return await _run_service(
+        service.install_plugin(
+            {
+                "url": url or download_url,
+                "download_url": download_url,
+                "proxy": body.get("proxy"),
+                "ignore_version_check": body.get("ignore_version_check", False),
+            }
+        ),
+        log_label="/api/plugin/install",
+    )
+
+
+@router.post("/plugins/install/upload")
+async def install_plugin_from_upload(
+    request: Request,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+):
+    return await _install_plugin_upload(
+        request,
+        service,
+        log_label="/api/plugin/install-upload",
+    )
+
+
+@router.get("/plugins/market")
+async def list_plugin_market(
+    request: Request,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+):
+    return await _run_service(
+        service.get_online_plugins_from_dashboard_query(
+            custom_registry=request.query_params.get("custom_registry"),
+            force_refresh=request.query_params.get("force_refresh", "false"),
+        ),
+        log_label="/api/plugin/market_list",
+    )
+
+
+@router.get("/plugins/market/categories")
+async def list_plugin_market_categories(
+    _auth: AuthContext = Depends(require_plugin_scope),
+):
+    return ok({"categories": []})
+
+
+@router.get("/plugin-sources")
+async def list_plugin_sources(
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+):
+    return ok({"sources": await service.get_custom_sources()})
+
+
+@router.post("/plugin-sources")
+async def create_plugin_source(
+    payload: PluginSourceRequest,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+):
+    return ok(
+        {"sources": await service.create_custom_source(_model_dict(payload))},
+        message="保存成功",
+    )
+
+
+@router.put("/plugin-sources")
+async def replace_plugin_sources(
+    payload: PluginSourceRequest,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+):
+    return ok(
+        {"sources": await service.replace_custom_sources(_model_dict(payload))},
+        message="保存成功",
+    )
+
+
+@router.delete("/plugin-sources/by-id")
+async def delete_plugin_source_by_id(
+    source_id: str = Query(...),
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+):
+    return ok(
+        {"sources": await service.delete_custom_source(source_id)},
+        message="保存成功",
+    )
+
+
+@router.delete("/plugin-sources/{source_id}")
+async def delete_plugin_source(
+    source_id: str,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+):
+    return ok(
+        {"sources": await service.delete_custom_source(source_id)},
+        message="保存成功",
+    )
+
+
+@router.get("/plugins/page-bridge-sdk.js")
+async def get_plugin_page_bridge_sdk(
+    request: Request,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    page_service: PluginPageService = Depends(get_page_service),
+):
+    return await _serve_plugin_page_bridge_sdk(
+        request=request,
+        page_service=page_service,
+    )
+
+
+@router.get("/plugins")
+async def list_plugins(
+    request: Request,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+    page_service: PluginPageService = Depends(get_page_service),
+):
+    return await _list_plugins(
+        request=request,
+        service=service,
+        page_service=page_service,
+    )
+
+
+@router.get("/plugins/by-id")
+async def get_plugin_by_id(
+    plugin_id: str = Query(...),
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+    page_service: PluginPageService = Depends(get_page_service),
+):
+    return await _get_plugin_detail(
+        plugin_id=plugin_id,
+        service=service,
+        page_service=page_service,
+    )
+
+
+@router.delete("/plugins/by-id")
+async def uninstall_plugin_by_id(
+    payload: PluginUninstallRequest | None = None,
+    plugin_id: str = Query(...),
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+):
+    body = _model_dict(payload)
+    return await _run_service(
+        service.uninstall_plugin({"name": plugin_id, **body}),
+        log_label="/api/plugin/uninstall",
+    )
+
+
+@router.get("/plugins/config")
+async def get_plugin_config_by_id(
+    plugin_id: str = Query(...),
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: ConfigDisplayService = Depends(get_config_display_service),
+):
+    return ok({"plugin_name": plugin_id, **await service.get_configs(plugin_id)})
+
+
+@router.put("/plugins/config")
+async def update_plugin_config_by_id(
+    payload: PluginConfigUpdateRequest,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: ConfigFileService = Depends(get_config_file_service),
+):
+    body = _model_dict(payload)
+    plugin_id = _plugin_id_from_body(body)
+    config = body.get("config")
+    config = config if isinstance(config, dict) else {}
+    return ok(
+        message=await service.save_plugin_configs_from_dashboard_payload(
+            config,
+            plugin_name=plugin_id,
+        )
+    )
+
+
+@router.get("/plugins/config/schema")
+async def get_plugin_config_schema_by_id(
+    plugin_id: str = Query(...),
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: ConfigDisplayService = Depends(get_config_display_service),
+):
+    return ok({"plugin_name": plugin_id, **await service.get_configs(plugin_id)})
+
+
+@router.get("/plugins/config-files")
+async def list_plugin_config_files_by_id(
+    plugin_id: str = Query(...),
+    config_key: str = Query(...),
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: ConfigFileService = Depends(get_config_file_service),
+):
+    return ok(
+        service.list_config_files(
+            scope="plugin",
+            name=plugin_id,
+            key_path=config_key,
+        )
+    )
+
+
+@router.post("/plugins/config-files")
+async def upload_plugin_config_files_by_id(
+    request: Request,
+    plugin_id: str = Query(...),
+    config_key: str = Query(...),
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: ConfigFileService = Depends(get_config_file_service),
+):
+    _, files = await multipart_parts(request)
+    return ok(
+        await service.upload_config_file(
+            scope="plugin",
+            name=plugin_id,
+            key_path=config_key,
+            files=files,
+        )
+    )
+
+
+@router.delete("/plugins/config-files")
+async def delete_plugin_config_file_by_id(
+    payload: PluginConfigFileDeleteRequest | None = None,
+    plugin_id: str = Query(...),
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: ConfigFileService = Depends(get_config_file_service),
+):
+    return ok(
+        message=service.delete_config_file_from_dashboard_payload(
+            scope="plugin",
+            name=plugin_id,
+            payload=_model_dict(payload),
+        )
+    )
+
+
+@router.get("/plugins/readme")
+async def get_plugin_readme_by_id(
+    plugin_id: str = Query(...),
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+):
+    return await _run_service(
+        lambda: service.get_plugin_readme(plugin_id),
+        log_label="/api/plugin/readme",
+    )
+
+
+@router.get("/plugins/changelog")
+async def get_plugin_changelog_by_id(
+    plugin_id: str = Query(...),
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+):
+    return await _run_service(
+        lambda: service.get_plugin_changelog(plugin_id),
+        log_label="/api/plugin/changelog",
+    )
+
+
+@router.post("/plugins/reload")
+async def reload_plugin_by_id(
+    payload: PluginByIdRequest,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+):
+    plugin_id = _plugin_id_from_body(_model_dict(payload))
+    return await _run_service(
+        service.reload_plugin({"name": plugin_id}),
+        log_label="/api/plugin/reload",
+    )
+
+
+@router.patch("/plugins/enabled")
+async def set_plugin_enabled_by_id(
+    payload: PluginEnabledRequest,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+):
+    body = _model_dict(payload)
+    plugin_id = _plugin_id_from_body(body)
+    return await _run_service(
+        service.set_plugin_enabled(
+            {"name": plugin_id}, enabled=bool(body.get("enabled"))
+        ),
+        log_label="/api/plugin/on" if body.get("enabled") else "/api/plugin/off",
+    )
+
+
+@router.get("/plugins/pages")
+async def list_plugin_pages_by_id(
+    plugin_id: str = Query(...),
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+    page_service: PluginPageService = Depends(get_page_service),
+):
+    return await _get_plugin_detail(
+        plugin_id=plugin_id,
+        service=service,
+        page_service=page_service,
+    )
+
+
+@router.get("/plugins/page")
+async def get_plugin_page_by_id(
+    request: Request,
+    plugin_id: str = Query(...),
+    page_name: str = Query(...),
+    auth: AuthContext = Depends(require_plugin_scope),
+    page_service: PluginPageService = Depends(get_page_service),
+):
+    return await _get_plugin_page_entry_config(
+        request=request,
+        page_service=page_service,
+        username=auth.username,
+        plugin_id=plugin_id,
+        page_name=page_name,
+    )
+
+
+@router.get("/plugins/page/assets")
+async def get_plugin_page_asset_by_id(
+    request: Request,
+    plugin_id: str = Query(...),
+    page_name: str = Query(...),
+    asset_path: str = Query(...),
+    auth: AuthContext = Depends(require_plugin_scope),
+    page_service: PluginPageService = Depends(get_page_service),
+):
+    return await _serve_plugin_page_content(
+        request=request,
+        page_service=page_service,
+        username=auth.username,
+        plugin_id=plugin_id,
+        page_name=page_name,
+        asset_path=asset_path,
+    )
+
+
+@router.get("/plugins/{plugin_id}")
+async def get_plugin(
+    plugin_id: str,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+    page_service: PluginPageService = Depends(get_page_service),
+):
+    return await _get_plugin_detail(
+        plugin_id=plugin_id,
+        service=service,
+        page_service=page_service,
+    )
+
+
+@router.delete("/plugins/{plugin_id}")
+async def uninstall_plugin(
+    plugin_id: str,
+    payload: PluginUninstallRequest | None = None,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+):
+    body = _model_dict(payload)
+    return await _run_service(
+        service.uninstall_plugin({"name": plugin_id, **body}),
+        log_label="/api/plugin/uninstall",
+    )
+
+
+@router.delete("/plugins/failed/{plugin_id}")
+async def uninstall_failed_plugin(
+    plugin_id: str,
+    payload: PluginUninstallRequest | None = None,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+):
+    body = _model_dict(payload)
+    return await _run_service(
+        service.uninstall_failed_plugin({"dir_name": plugin_id, **body}),
+        log_label="/api/plugin/uninstall-failed",
+    )
+
+
+@router.post("/plugins/failed/{plugin_id}/reload")
+async def reload_failed_plugin(
+    plugin_id: str,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+):
+    return await _run_service(
+        service.reload_failed_plugin({"dir_name": plugin_id}),
+        log_label="/api/plugin/reload-failed",
+    )
+
+
+@router.get("/plugins/{plugin_id}/config")
+async def get_plugin_config(
+    plugin_id: str,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: ConfigDisplayService = Depends(get_config_display_service),
+):
+    return ok({"plugin_name": plugin_id, **await service.get_configs(plugin_id)})
+
+
+@router.put("/plugins/{plugin_id}/config")
+async def update_plugin_config(
+    plugin_id: str,
+    payload: PluginConfigPayload,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: ConfigFileService = Depends(get_config_file_service),
+):
+    body = _model_dict(payload)
+    config = body.get("config")
+    config = config if isinstance(config, dict) else body
+    return ok(
+        message=await service.save_plugin_configs_from_dashboard_payload(
+            config,
+            plugin_name=plugin_id,
+        )
+    )
+
+
+@router.get("/plugins/{plugin_id}/config/schema")
+async def get_plugin_config_schema(
+    plugin_id: str,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: ConfigDisplayService = Depends(get_config_display_service),
+):
+    return ok({"plugin_name": plugin_id, **await service.get_configs(plugin_id)})
+
+
+@router.get("/plugins/{plugin_id}/config-files/{config_key:path}")
+async def list_plugin_config_files(
+    plugin_id: str,
+    config_key: str,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: ConfigFileService = Depends(get_config_file_service),
+):
+    return ok(
+        service.list_config_files(
+            scope="plugin",
+            name=plugin_id,
+            key_path=config_key,
+        )
+    )
+
+
+@router.post("/plugins/{plugin_id}/config-files/{config_key:path}")
+async def upload_plugin_config_files(
+    plugin_id: str,
+    config_key: str,
+    request: Request,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: ConfigFileService = Depends(get_config_file_service),
+):
+    _, files = await multipart_parts(request)
+    return ok(
+        await service.upload_config_file(
+            scope="plugin",
+            name=plugin_id,
+            key_path=config_key,
+            files=files,
+        )
+    )
+
+
+@router.delete("/plugins/{plugin_id}/config-files")
+async def delete_plugin_config_file(
+    plugin_id: str,
+    payload: PluginConfigFileDeleteRequest | None = None,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: ConfigFileService = Depends(get_config_file_service),
+):
+    return ok(
+        message=service.delete_config_file_from_dashboard_payload(
+            scope="plugin",
+            name=plugin_id,
+            payload=_model_dict(payload),
+        )
+    )
+
+
+@router.get("/plugins/{plugin_id}/readme")
+async def get_plugin_readme(
+    plugin_id: str,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+):
+    return await _run_service(
+        lambda: service.get_plugin_readme(plugin_id),
+        log_label="/api/plugin/readme",
+    )
+
+
+@router.get("/plugins/{plugin_id}/changelog")
+async def get_plugin_changelog(
+    plugin_id: str,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+):
+    return await _run_service(
+        lambda: service.get_plugin_changelog(plugin_id),
+        log_label="/api/plugin/changelog",
+    )
+
+
+@router.post("/plugins/{plugin_id}/reload")
+async def reload_plugin(
+    plugin_id: str,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+):
+    return await _run_service(
+        service.reload_plugin({"name": plugin_id}),
+        log_label="/api/plugin/reload",
+    )
+
+
+@router.patch("/plugins/{plugin_id}/enabled")
+async def set_plugin_enabled(
+    plugin_id: str,
+    payload: EnabledPatch,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+):
+    return await _run_service(
+        service.set_plugin_enabled({"name": plugin_id}, enabled=payload.enabled),
+        log_label="/api/plugin/on" if payload.enabled else "/api/plugin/off",
+    )
+
+
+@router.post("/plugins/{plugin_id}/update")
+async def update_plugin(
+    plugin_id: str,
+    payload: PluginUpdateRequest | None = None,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+):
+    body = _model_dict(payload)
+    return await _run_service(
+        service.update_plugin({"name": plugin_id, **body}),
+        log_label="/api/plugin/update",
+    )
+
+
+@router.get("/plugins/{plugin_id}/pages")
+async def list_plugin_pages(
+    plugin_id: str,
+    _auth: AuthContext = Depends(require_plugin_scope),
+    service: PluginService = Depends(get_service),
+    page_service: PluginPageService = Depends(get_page_service),
+):
+    return await _get_plugin_detail(
+        plugin_id=plugin_id,
+        service=service,
+        page_service=page_service,
+    )
+
+
+@router.get("/plugins/{plugin_id}/pages/{page_name}")
+async def get_plugin_page(
+    plugin_id: str,
+    page_name: str,
+    request: Request,
+    auth: AuthContext = Depends(require_plugin_scope),
+    page_service: PluginPageService = Depends(get_page_service),
+):
+    return await _get_plugin_page_entry_config(
+        request=request,
+        page_service=page_service,
+        username=auth.username,
+        plugin_id=plugin_id,
+        page_name=page_name,
+    )
+
+
+@router.get("/plugins/{plugin_id}/pages/{page_name}/assets/{asset_path:path}")
+async def get_plugin_page_asset(
+    plugin_id: str,
+    page_name: str,
+    asset_path: str,
+    request: Request,
+    auth: AuthContext = Depends(require_plugin_scope),
+    page_service: PluginPageService = Depends(get_page_service),
+):
+    return await _serve_plugin_page_content(
+        request=request,
+        page_service=page_service,
+        username=auth.username,
+        plugin_id=plugin_id,
+        page_name=page_name,
+        asset_path=asset_path,
+    )
+
+
+@legacy_router.get("/api/plugin/get")
+async def dashboard_list_plugins(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PluginService = Depends(get_service),
+    page_service: PluginPageService = Depends(get_page_service),
+):
+    return await _list_plugins(
+        request=request,
+        service=service,
+        page_service=page_service,
+    )
+
+
+@legacy_router.get("/api/plugin/detail")
+async def dashboard_get_plugin_detail(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PluginService = Depends(get_service),
+    page_service: PluginPageService = Depends(get_page_service),
+):
+    return await _get_plugin_detail(
+        plugin_id=request.query_params.get("name"),
+        service=service,
+        page_service=page_service,
+    )
+
+
+@legacy_router.post("/api/plugin/check-compat")
+async def dashboard_check_plugin_version_support(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PluginService = Depends(get_service),
+):
+    return await _check_plugin_version_support_request(request, service)
+
+
+@legacy_router.get("/api/plugin/page/entry")
+async def dashboard_get_plugin_page_entry_config(
+    request: Request,
+    username: str = Depends(require_dashboard_user),
+    page_service: PluginPageService = Depends(get_page_service),
+):
+    return await _get_plugin_page_entry_config(
+        request=request,
+        page_service=page_service,
+        username=username,
+        plugin_id=request.query_params.get("name"),
+        page_name=request.query_params.get("page"),
+    )
+
+
+@legacy_router.post("/api/plugin/install")
+async def dashboard_install_plugin(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PluginService = Depends(get_service),
+):
+    return await _run_json(
+        request,
+        service.install_plugin,
+        log_label="/api/plugin/install",
+    )
+
+
+@legacy_router.post("/api/plugin/install-upload")
+async def dashboard_install_plugin_upload(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PluginService = Depends(get_service),
+):
+    return await _install_plugin_upload(
+        request,
+        service,
+        log_label="/api/plugin/install-upload",
+    )
+
+
+@legacy_router.post("/api/plugin/update")
+async def dashboard_update_plugin(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PluginService = Depends(get_service),
+):
+    return await _run_json(
+        request,
+        service.update_plugin,
+        log_label="/api/plugin/update",
+    )
+
+
+@legacy_router.post("/api/plugin/update-all")
+async def dashboard_update_all_plugins(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PluginService = Depends(get_service),
+):
+    return await _run_json(
+        request,
+        service.update_all_plugins,
+        log_label="/api/plugin/update-all",
+    )
+
+
+@legacy_router.post("/api/plugin/uninstall")
+async def dashboard_uninstall_plugin(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PluginService = Depends(get_service),
+):
+    return await _run_json(
+        request,
+        service.uninstall_plugin,
+        log_label="/api/plugin/uninstall",
+    )
+
+
+@legacy_router.post("/api/plugin/uninstall-failed")
+async def dashboard_uninstall_failed_plugin(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PluginService = Depends(get_service),
+):
+    return await _run_json(
+        request,
+        service.uninstall_failed_plugin,
+        log_label="/api/plugin/uninstall-failed",
+    )
+
+
+@legacy_router.get("/api/plugin/market_list")
+async def dashboard_list_plugin_market(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PluginService = Depends(get_service),
+):
+    return await _run_service(
+        service.get_online_plugins_from_dashboard_query(
+            custom_registry=request.query_params.get("custom_registry"),
+            force_refresh=request.query_params.get("force_refresh", "false"),
+        ),
+        log_label="/api/plugin/market_list",
+    )
+
+
+@legacy_router.post("/api/plugin/off")
+async def dashboard_disable_plugin(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PluginService = Depends(get_service),
+):
+    return await _run_json(
+        request,
+        lambda data: service.set_plugin_enabled(data, enabled=False),
+        log_label="/api/plugin/off",
+    )
+
+
+@legacy_router.post("/api/plugin/on")
+async def dashboard_enable_plugin(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PluginService = Depends(get_service),
+):
+    return await _run_json(
+        request,
+        lambda data: service.set_plugin_enabled(data, enabled=True),
+        log_label="/api/plugin/on",
+    )
+
+
+@legacy_router.post("/api/plugin/reload-failed")
+async def dashboard_reload_failed_plugin(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PluginService = Depends(get_service),
+):
+    return await _run_json(
+        request,
+        service.reload_failed_plugin,
+        log_label="/api/plugin/reload-failed",
+    )
+
+
+@legacy_router.post("/api/plugin/reload")
+async def dashboard_reload_plugin(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PluginService = Depends(get_service),
+):
+    return await _run_json(
+        request,
+        service.reload_plugin,
+        log_label="/api/plugin/reload",
+    )
+
+
+@legacy_router.get("/api/plugin/readme")
+async def dashboard_get_plugin_readme(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PluginService = Depends(get_service),
+):
+    return await _run_service(
+        lambda: service.get_plugin_readme(request.query_params.get("name")),
+        log_label="/api/plugin/readme",
+    )
+
+
+@legacy_router.get("/api/plugin/changelog")
+async def dashboard_get_plugin_changelog(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PluginService = Depends(get_service),
+):
+    return await _run_service(
+        lambda: service.get_plugin_changelog(request.query_params.get("name")),
+        log_label="/api/plugin/changelog",
+    )
+
+
+@legacy_router.get("/api/plugin/source/get")
+async def dashboard_get_custom_source(
+    _username: str = Depends(require_dashboard_user),
+    service: PluginService = Depends(get_service),
+):
+    return await _run_service(service.get_custom_sources)
+
+
+@legacy_router.post("/api/plugin/source/save")
+async def dashboard_save_custom_source(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: PluginService = Depends(get_service),
+):
+    return await _run_json(
+        request,
+        service.save_custom_sources,
+        log_label="/api/plugin/source/save",
+    )
+
+
+@legacy_router.get("/api/plugin/source/get-failed-plugins")
+async def dashboard_get_failed_plugins(
+    _username: str = Depends(require_dashboard_user),
+    service: PluginService = Depends(get_service),
+):
+    return await _run_service(service.get_failed_plugins)
+
+
+@legacy_router.get("/api/plugin/page/bridge-sdk.js")
+async def dashboard_get_plugin_page_bridge_sdk(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    page_service: PluginPageService = Depends(get_page_service),
+):
+    return await _serve_plugin_page_bridge_sdk(
+        request=request,
+        page_service=page_service,
+    )
+
+
+@legacy_router.get("/api/plugin/page/content/{plugin_id}/{page_name}/")
+async def dashboard_get_plugin_page_entry(
+    plugin_id: str,
+    page_name: str,
+    request: Request,
+    username: str = Depends(require_dashboard_user),
+    page_service: PluginPageService = Depends(get_page_service),
+):
+    return await _serve_plugin_page_content(
+        request=request,
+        page_service=page_service,
+        username=username,
+        plugin_id=plugin_id,
+        page_name=page_name,
+        asset_path="",
+    )
+
+
+@legacy_router.get("/api/plugin/page/content/{plugin_id}/{page_name}/{asset_path:path}")
+async def dashboard_get_plugin_page_asset(
+    plugin_id: str,
+    page_name: str,
+    asset_path: str,
+    request: Request,
+    username: str = Depends(require_dashboard_user),
+    page_service: PluginPageService = Depends(get_page_service),
+):
+    return await _serve_plugin_page_content(
+        request=request,
+        page_service=page_service,
+        username=username,
+        plugin_id=plugin_id,
+        page_name=page_name,
+        asset_path=asset_path,
+    )
+
+
+@legacy_router.api_route("/api/plug/{plugin_path:path}", methods=["GET", "POST"])
+async def dashboard_plugin_extension_route(
+    plugin_path: str,
+    request: Request,
+    username: str = Depends(require_dashboard_user),
+):
+    return await _call_plugin_extension(plugin_path, request, username)
diff --git a/astrbot/dashboard/api/providers.py b/astrbot/dashboard/api/providers.py
new file mode 100644
index 000000000..c47ab489c
--- /dev/null
+++ b/astrbot/dashboard/api/providers.py
@@ -0,0 +1,593 @@
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, Query, Request
+
+from astrbot.dashboard.responses import error, ok
+from astrbot.dashboard.schemas import (
+    EnabledPatch,
+    ProviderConfigRequest,
+    ProviderSourceRequest,
+)
+from astrbot.dashboard.services.config_service import ProviderConfigService
+
+from .auth import AuthContext, require_scope
+
+router = APIRouter(tags=["Providers"])
+legacy_router = APIRouter(
+    prefix="/api/config",
+    tags=["Dashboard Providers"],
+    include_in_schema=False,
+)
+
+
+async def require_provider_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "provider")
+
+
+def get_service(request: Request) -> ProviderConfigService:
+    return request.app.state.services.providers
+
+
+async def _json_or_empty(request: Request) -> dict:
+    try:
+        data = await request.json()
+    except Exception:
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def _required_text(value: object, name: str) -> str:
+    text = str(value or "").strip()
+    if not text:
+        raise ValueError(f"Missing key: {name}")
+    return text
+
+
+def _model_dict(payload) -> dict:
+    if payload is None:
+        return {}
+    if hasattr(payload, "model_dump"):
+        return payload.model_dump(exclude_none=True)
+    return payload if isinstance(payload, dict) else {}
+
+
+def _config_from_body(body: dict) -> dict:
+    config = body.get("config")
+    if isinstance(config, dict):
+        return config
+    return {
+        key: value
+        for key, value in body.items()
+        if key
+        not in {
+            "provider_id",
+            "source_id",
+            "config",
+            "enabled",
+            "provider_config",
+        }
+    }
+
+
+def _provider_config_for_dimension(
+    service: ProviderConfigService,
+    provider_id: str,
+    body: dict,
+) -> dict:
+    provider = service.get_provider(provider_id, merged=True)
+    base_config = provider.get("provider") if isinstance(provider, dict) else {}
+    if not isinstance(base_config, dict):
+        base_config = {}
+    provider_config = body.get("provider_config")
+    if isinstance(provider_config, dict):
+        return {**base_config, **provider_config}
+    return base_config
+
+
+def _alias_error(message: str):
+    return error(message)
+
+
+@router.get("/providers/schema")
+async def get_provider_schema(
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    return ok(service.get_provider_schema())
+
+
+@router.get("/provider-sources")
+async def list_provider_sources(
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    return ok(service.list_provider_sources())
+
+
+@router.post("/provider-sources")
+async def create_provider_source(
+    payload: ProviderSourceRequest,
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    config = payload.to_dashboard_config()
+    source_id = config.get("id")
+    if not source_id:
+        raise ValueError("Provider source config must have an 'id' field")
+    await service.upsert_provider_source(source_id, config)
+    return ok(message="更新 provider source 成功")
+
+
+@router.get("/provider-sources/by-id")
+async def get_provider_source_by_id(
+    source_id: str = Query(...),
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    return ok(service.get_provider_source(source_id))
+
+
+@router.put("/provider-sources/by-id")
+async def upsert_provider_source_by_id(
+    payload: ProviderSourceRequest,
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    source_id = _required_text(payload.source_id, "source_id")
+    await service.upsert_provider_source(
+        source_id,
+        payload.to_dashboard_config(fallback_id=source_id),
+    )
+    return ok(message="更新 provider source 成功")
+
+
+@router.delete("/provider-sources/by-id")
+async def delete_provider_source_by_id(
+    source_id: str = Query(...),
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    await service.delete_provider_source(source_id)
+    return ok(message="删除 provider source 成功")
+
+
+@router.get("/provider-sources/models")
+async def list_provider_source_models_by_id(
+    source_id: str = Query(...),
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    return ok(await service.list_provider_source_models(source_id))
+
+
+@router.get("/provider-sources/providers")
+async def list_providers_by_source_id(
+    source_id: str = Query(...),
+    capability: str | None = Query(default=None),
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    return ok(service.list_providers(capability=capability, source_id=source_id))
+
+
+@router.post("/provider-sources/providers")
+async def create_provider_in_source_by_id(
+    payload: ProviderConfigRequest,
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    source_id = _required_text(payload.source_id, "source_id")
+    await service.create_provider(
+        payload.to_dashboard_config(source_id=source_id),
+        source_id,
+    )
+    return ok(message="新增服务提供商配置成功")
+
+
+@router.get("/provider-sources/{source_id:path}/models")
+async def list_provider_source_models(
+    source_id: str,
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    return ok(await service.list_provider_source_models(source_id))
+
+
+@router.get("/provider-sources/{source_id:path}/providers")
+async def list_providers_by_source(
+    source_id: str,
+    capability: str | None = Query(default=None),
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    return ok(service.list_providers(capability=capability, source_id=source_id))
+
+
+@router.post("/provider-sources/{source_id:path}/providers")
+async def create_provider_in_source(
+    source_id: str,
+    payload: ProviderConfigRequest,
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    await service.create_provider(
+        payload.to_dashboard_config(source_id=source_id), source_id
+    )
+    return ok(message="新增服务提供商配置成功")
+
+
+@router.get("/provider-sources/{source_id:path}")
+async def get_provider_source(
+    source_id: str,
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    return ok(service.get_provider_source(source_id))
+
+
+@router.put("/provider-sources/{source_id:path}")
+async def upsert_provider_source(
+    source_id: str,
+    payload: ProviderSourceRequest,
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    await service.upsert_provider_source(
+        source_id,
+        payload.to_dashboard_config(),
+    )
+    return ok(message="更新 provider source 成功")
+
+
+@router.delete("/provider-sources/{source_id:path}")
+async def delete_provider_source(
+    source_id: str,
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    await service.delete_provider_source(source_id)
+    return ok(message="删除 provider source 成功")
+
+
+@router.get("/providers")
+async def list_providers(
+    capability: str | None = Query(default=None),
+    source_id: str | None = Query(default=None),
+    enabled: bool | None = Query(default=None),
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    return ok(
+        service.list_providers(
+            capability=capability,
+            source_id=source_id,
+            enabled=enabled,
+        )
+    )
+
+
+@router.post("/providers")
+async def create_provider(
+    payload: ProviderConfigRequest,
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    await service.create_provider(payload.to_dashboard_config())
+    return ok(message="新增服务提供商配置成功")
+
+
+@router.get("/providers/by-id")
+async def get_provider_by_id(
+    provider_id: str = Query(...),
+    merged: bool = Query(default=False),
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    return ok(service.get_provider(provider_id, merged=merged))
+
+
+@router.put("/providers/by-id")
+async def update_provider_by_id(
+    payload: ProviderConfigRequest,
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    provider_id = _required_text(payload.provider_id, "provider_id")
+    await service.update_provider(
+        provider_id,
+        payload.to_dashboard_config(fallback_id=provider_id),
+    )
+    return ok(message="更新成功，已经实时生效~")
+
+
+@router.delete("/providers/by-id")
+async def delete_provider_by_id(
+    provider_id: str = Query(...),
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    await service.delete_provider(provider_id)
+    return ok(message="删除成功，已经实时生效。")
+
+
+@router.patch("/providers/enabled")
+async def set_provider_enabled_by_id(
+    payload: ProviderConfigRequest,
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    provider_id = _required_text(payload.provider_id, "provider_id")
+    await service.set_provider_enabled(provider_id, bool(payload.enabled))
+    return ok(message="更新成功，已经实时生效~")
+
+
+@router.post("/providers/test")
+async def test_provider_by_id(
+    payload: ProviderConfigRequest,
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    provider_id = _required_text(payload.provider_id, "provider_id")
+    return ok(await service.test_provider(provider_id))
+
+
+@router.post("/providers/embedding-dimension")
+async def get_embedding_dimension_by_id(
+    payload: ProviderConfigRequest,
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    body = _model_dict(payload)
+    provider_id = _required_text(payload.provider_id, "provider_id")
+    return ok(
+        await service.get_embedding_dimension(
+            _provider_config_for_dimension(service, provider_id, body)
+        )
+    )
+
+
+@router.patch("/providers/{provider_id:path}/enabled")
+async def set_provider_enabled(
+    provider_id: str,
+    payload: EnabledPatch,
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    await service.set_provider_enabled(provider_id, payload.enabled)
+    return ok(message="更新成功，已经实时生效~")
+
+
+@router.post("/providers/{provider_id:path}/test")
+async def test_provider(
+    provider_id: str,
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    return ok(await service.test_provider(provider_id))
+
+
+@router.post("/providers/{provider_id:path}/embedding-dimension")
+async def get_embedding_dimension(
+    provider_id: str,
+    payload: ProviderConfigRequest | None = None,
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    body = _model_dict(payload)
+    return ok(
+        await service.get_embedding_dimension(
+            _provider_config_for_dimension(service, provider_id, body)
+        )
+    )
+
+
+@router.get("/providers/{provider_id:path}")
+async def get_provider(
+    provider_id: str,
+    merged: bool = Query(default=False),
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    return ok(service.get_provider(provider_id, merged=merged))
+
+
+@router.put("/providers/{provider_id:path}")
+async def update_provider(
+    provider_id: str,
+    payload: ProviderConfigRequest,
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    await service.update_provider(
+        provider_id,
+        payload.to_dashboard_config(fallback_id=provider_id),
+    )
+    return ok(message="更新成功，已经实时生效~")
+
+
+@router.delete("/providers/{provider_id:path}")
+async def delete_provider(
+    provider_id: str,
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    await service.delete_provider(provider_id)
+    return ok(message="删除成功，已经实时生效。")
+
+
+@legacy_router.get("/provider/template")
+async def get_dashboard_alias_provider_template(
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    return ok(service.get_provider_schema())
+
+
+@legacy_router.get("/provider/list")
+async def list_dashboard_alias_providers(
+    provider_type: str | None = Query(default=None),
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    if not provider_type:
+        return _alias_error("缺少参数 provider_type")
+    providers = []
+    seen_ids = set()
+    for item in provider_type.split(","):
+        for provider in service.list_providers(capability=item)["providers"]:
+            provider_id = provider.get("id")
+            if provider_id in seen_ids:
+                continue
+            seen_ids.add(provider_id)
+            providers.append(provider)
+    return ok(providers)
+
+
+@legacy_router.post("/provider/new")
+async def create_dashboard_alias_provider(
+    payload: ProviderConfigRequest,
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    try:
+        await service.create_provider(payload.to_dashboard_config())
+        return ok(message="新增服务提供商配置成功")
+    except ValueError as exc:
+        return _alias_error(str(exc))
+
+
+@legacy_router.post("/provider/update")
+async def update_dashboard_alias_provider(
+    request: Request,
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    provider_id = body.get("id")
+    config = body.get("config")
+    if not provider_id or not isinstance(config, dict):
+        return _alias_error("参数错误")
+    try:
+        await service.update_provider(
+            str(provider_id),
+            ProviderConfigRequest(config=config).to_dashboard_config(
+                fallback_id=str(provider_id),
+            ),
+        )
+        return ok(message="更新成功，已经实时生效~")
+    except ValueError as exc:
+        return _alias_error(str(exc))
+
+
+@legacy_router.post("/provider/delete")
+async def delete_dashboard_alias_provider(
+    request: Request,
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    provider_id = body.get("id")
+    if not provider_id:
+        return _alias_error("缺少参数 id")
+    try:
+        await service.delete_provider(str(provider_id))
+        return ok(message="删除成功，已经实时生效。")
+    except ValueError as exc:
+        return _alias_error(str(exc))
+
+
+@legacy_router.get("/provider/check_one")
+async def check_dashboard_alias_provider(
+    id: str | None = Query(default=None),
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    if not id:
+        return _alias_error("Missing provider_id parameter")
+    try:
+        return ok(await service.test_provider(id))
+    except ValueError as exc:
+        return _alias_error(str(exc))
+
+
+@legacy_router.get("/provider/model_list")
+async def list_dashboard_alias_provider_models(
+    provider_id: str | None = Query(default=None),
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    try:
+        return ok(await service.list_provider_models_for_dashboard(provider_id))
+    except ValueError as exc:
+        return _alias_error(str(exc))
+
+
+@legacy_router.post("/provider/get_embedding_dim")
+async def get_dashboard_alias_provider_embedding_dimension(
+    request: Request,
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    try:
+        return ok(await service.get_embedding_dimension_from_dashboard_payload(body))
+    except ValueError as exc:
+        return _alias_error(str(exc))
+
+
+@legacy_router.get("/provider_sources/models")
+async def list_dashboard_alias_provider_source_models(
+    source_id: str | None = Query(default=None),
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    if not source_id:
+        return _alias_error("缺少参数 source_id")
+    try:
+        data = await service.list_provider_source_models(source_id)
+        data.pop("provider_source_id", None)
+        return ok(data)
+    except ValueError as exc:
+        return _alias_error(str(exc))
+
+
+@legacy_router.post("/provider_sources/update")
+async def update_dashboard_alias_provider_source(
+    request: Request,
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    source_id = body.get("original_id")
+    config = body.get("config") or body
+    if not source_id:
+        return _alias_error("缺少 original_id")
+    if not isinstance(config, dict):
+        return _alias_error("缺少或错误的配置数据")
+    try:
+        await service.upsert_provider_source(
+            str(source_id),
+            ProviderSourceRequest(config=config).to_dashboard_config(
+                fallback_id=str(source_id),
+            ),
+        )
+        return ok(message="更新 provider source 成功")
+    except ValueError as exc:
+        return _alias_error(str(exc))
+
+
+@legacy_router.post("/provider_sources/delete")
+async def delete_dashboard_alias_provider_source(
+    request: Request,
+    _auth: AuthContext = Depends(require_provider_scope),
+    service: ProviderConfigService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    source_id = body.get("id")
+    if not source_id:
+        return _alias_error("缺少 provider_source_id")
+    try:
+        await service.delete_provider_source(str(source_id))
+        return ok(message="删除 provider source 成功")
+    except ValueError as exc:
+        return _alias_error(str(exc))
diff --git a/astrbot/dashboard/api/router.py b/astrbot/dashboard/api/router.py
new file mode 100644
index 000000000..b59ea6285
--- /dev/null
+++ b/astrbot/dashboard/api/router.py
@@ -0,0 +1,63 @@
+"""FastAPI HTTP API surface for the AstrBot dashboard."""
+
+from fastapi import APIRouter
+
+from .api_keys import router as api_keys_router
+from .auth import router as auth_router
+from .backups import router as backups_router
+from .bots import router as bots_router
+from .chat import router as chat_router
+from .chat_projects import router as chat_projects_router
+from .config_profiles import router as config_profiles_router
+from .conversations import router as conversations_router
+from .cron import router as cron_router
+from .extensions import router as extensions_router
+from .files import router as files_router
+from .knowledge_bases import router as knowledge_bases_router
+from .live_chat import router as live_chat_router
+from .logs import router as logs_router
+from .open_api import router as open_api_router
+from .personas import router as personas_router
+from .platform import router as platform_router
+from .plugins import router as plugins_router
+from .providers import router as providers_router
+from .sessions import router as sessions_router
+from .skills import router as skills_router
+from .stats import router as stats_router
+from .subagents import router as subagents_router
+from .t2i import router as t2i_router
+from .tools import router as tools_router
+from .updates import router as updates_router
+
+API_V1_PREFIX = "/api/v1"
+
+
+def build_api_router() -> APIRouter:
+    router = APIRouter(prefix=API_V1_PREFIX)
+    router.include_router(auth_router)
+    router.include_router(backups_router)
+    router.include_router(config_profiles_router)
+    router.include_router(api_keys_router)
+    router.include_router(bots_router)
+    router.include_router(providers_router)
+    router.include_router(plugins_router)
+    router.include_router(chat_router)
+    router.include_router(chat_projects_router)
+    router.include_router(conversations_router)
+    router.include_router(cron_router)
+    router.include_router(files_router)
+    router.include_router(knowledge_bases_router)
+    router.include_router(extensions_router)
+    router.include_router(skills_router)
+    router.include_router(sessions_router)
+    router.include_router(subagents_router)
+    router.include_router(logs_router)
+    router.include_router(stats_router)
+    router.include_router(tools_router)
+    router.include_router(platform_router)
+    router.include_router(t2i_router)
+    router.include_router(personas_router)
+    router.include_router(updates_router)
+    router.include_router(open_api_router)
+    router.include_router(live_chat_router)
+    return router
diff --git a/astrbot/dashboard/api/sessions.py b/astrbot/dashboard/api/sessions.py
new file mode 100644
index 000000000..42ede8ea5
--- /dev/null
+++ b/astrbot/dashboard/api/sessions.py
@@ -0,0 +1,414 @@
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, Query, Request
+
+from astrbot.core import logger
+from astrbot.dashboard.async_utils import run_maybe_async
+from astrbot.dashboard.responses import error, ok
+from astrbot.dashboard.schemas import (
+    BatchSessionProviderRequest,
+    BatchSessionServiceRequest,
+    SessionGroupRequest,
+    SessionRuleRequest,
+    UmoListRequest,
+)
+from astrbot.dashboard.services.session_management_service import (
+    SessionManagementService,
+    SessionManagementServiceError,
+)
+
+from .auth import AuthContext, require_dashboard_user, require_scope
+
+router = APIRouter(tags=["Sessions"])
+legacy_router = APIRouter(
+    prefix="/api/session",
+    tags=["Dashboard Sessions"],
+    include_in_schema=False,
+)
+
+
+def get_service(request: Request) -> SessionManagementService:
+    return request.app.state.services.sessions
+
+
+async def require_data_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "data")
+
+
+async def _json_or_empty(request: Request) -> dict:
+    try:
+        data = await request.json()
+    except Exception:
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def _service_error(exc: SessionManagementServiceError) -> dict:
+    return error(str(exc))
+
+
+def _unexpected_error(prefix: str, exc: Exception) -> dict:
+    logger.error(f"{prefix}: {exc!s}")
+    return error(f"{prefix}: {exc!s}")
+
+
+async def _run(operation, *, label: str) -> dict:
+    try:
+        result = await run_maybe_async(operation)
+        return ok(result)
+    except SessionManagementServiceError as exc:
+        return _service_error(exc)
+    except Exception as exc:
+        return _unexpected_error(label, exc)
+
+
+async def _run_dashboard_json(
+    request: Request,
+    operation,
+    *,
+    label: str,
+) -> dict:
+    body = await _json_or_empty(request)
+    return await _run(lambda: operation(body), label=label)
+
+
+@router.get("/sessions")
+async def list_sessions(
+    page: int = Query(1),
+    page_size: int = Query(20),
+    search: str = Query(""),
+    message_type: str = Query("all"),
+    platform: str = Query(""),
+    _auth: AuthContext = Depends(require_data_scope),
+    service: SessionManagementService = Depends(get_service),
+):
+    try:
+        return ok(
+            await service.list_all_umos_with_status(
+                page=page,
+                page_size=page_size,
+                search=search.strip(),
+                message_type=message_type,
+                platform=platform,
+            )
+        )
+    except SessionManagementServiceError as exc:
+        return _service_error(exc)
+    except Exception as exc:
+        return _unexpected_error("获取会话状态列表失败", exc)
+
+
+@router.get("/sessions/active-umos")
+async def list_active_umos(
+    _auth: AuthContext = Depends(require_data_scope),
+    service: SessionManagementService = Depends(get_service),
+):
+    try:
+        return ok(await service.list_active_umos())
+    except SessionManagementServiceError as exc:
+        return _service_error(exc)
+    except Exception as exc:
+        return _unexpected_error("获取 UMO 列表失败", exc)
+
+
+@router.get("/sessions/rules")
+async def list_session_rules(
+    page: int = Query(1),
+    page_size: int = Query(10),
+    search: str = Query(""),
+    _auth: AuthContext = Depends(require_data_scope),
+    service: SessionManagementService = Depends(get_service),
+):
+    try:
+        return ok(
+            await service.list_session_rules(
+                page=page,
+                page_size=page_size,
+                search=search.strip(),
+            )
+        )
+    except SessionManagementServiceError as exc:
+        return _service_error(exc)
+    except Exception as exc:
+        return _unexpected_error("获取规则列表失败", exc)
+
+
+@router.post("/sessions/rules")
+async def update_session_rule(
+    payload: SessionRuleRequest,
+    _auth: AuthContext = Depends(require_data_scope),
+    service: SessionManagementService = Depends(get_service),
+):
+    try:
+        return ok(
+            await service.update_session_rule(payload.model_dump(exclude_none=True))
+        )
+    except SessionManagementServiceError as exc:
+        return _service_error(exc)
+    except Exception as exc:
+        return _unexpected_error("更新会话规则失败", exc)
+
+
+@router.post("/sessions/rules/delete")
+async def delete_session_rule(
+    payload: UmoListRequest,
+    _auth: AuthContext = Depends(require_data_scope),
+    service: SessionManagementService = Depends(get_service),
+):
+    try:
+        return ok(
+            await service.delete_session_rules(payload.model_dump(exclude_none=True))
+        )
+    except SessionManagementServiceError as exc:
+        return _service_error(exc)
+    except Exception as exc:
+        return _unexpected_error("删除会话规则失败", exc)
+
+
+@router.patch("/sessions/provider")
+async def update_session_provider(
+    payload: BatchSessionProviderRequest,
+    _auth: AuthContext = Depends(require_data_scope),
+    service: SessionManagementService = Depends(get_service),
+):
+    try:
+        return ok(
+            await service.batch_update_provider(payload.model_dump(exclude_none=True))
+        )
+    except SessionManagementServiceError as exc:
+        return _service_error(exc)
+    except Exception as exc:
+        return _unexpected_error("批量更新 Provider 失败", exc)
+
+
+@router.patch("/sessions/service")
+async def update_session_service(
+    payload: BatchSessionServiceRequest,
+    _auth: AuthContext = Depends(require_data_scope),
+    service: SessionManagementService = Depends(get_service),
+):
+    try:
+        return ok(
+            await service.batch_update_service(payload.model_dump(exclude_none=True))
+        )
+    except SessionManagementServiceError as exc:
+        return _service_error(exc)
+    except Exception as exc:
+        return _unexpected_error("批量更新服务状态失败", exc)
+
+
+@router.get("/session-groups")
+async def list_session_groups(
+    _auth: AuthContext = Depends(require_data_scope),
+    service: SessionManagementService = Depends(get_service),
+):
+    try:
+        return ok(service.list_groups())
+    except SessionManagementServiceError as exc:
+        return _service_error(exc)
+    except Exception as exc:
+        return _unexpected_error("获取分组列表失败", exc)
+
+
+@router.post("/session-groups")
+async def create_session_group(
+    payload: SessionGroupRequest,
+    _auth: AuthContext = Depends(require_data_scope),
+    service: SessionManagementService = Depends(get_service),
+):
+    try:
+        return ok(service.create_group(payload.model_dump(exclude_none=True)))
+    except SessionManagementServiceError as exc:
+        return _service_error(exc)
+    except Exception as exc:
+        return _unexpected_error("创建分组失败", exc)
+
+
+@router.put("/session-groups/{group_id}")
+async def update_session_group(
+    group_id: str,
+    payload: SessionGroupRequest,
+    _auth: AuthContext = Depends(require_data_scope),
+    service: SessionManagementService = Depends(get_service),
+):
+    try:
+        body = payload.model_dump(exclude_none=True)
+        return ok(service.update_group({"group_id": group_id, **body}))
+    except SessionManagementServiceError as exc:
+        return _service_error(exc)
+    except Exception as exc:
+        return _unexpected_error("更新分组失败", exc)
+
+
+@router.delete("/session-groups/{group_id}")
+async def delete_session_group(
+    group_id: str,
+    _auth: AuthContext = Depends(require_data_scope),
+    service: SessionManagementService = Depends(get_service),
+):
+    try:
+        return ok(service.delete_group({"group_id": group_id}))
+    except SessionManagementServiceError as exc:
+        return _service_error(exc)
+    except Exception as exc:
+        return _unexpected_error("删除分组失败", exc)
+
+
+@legacy_router.get("/list-rule")
+async def list_dashboard_session_rules(
+    page: int = Query(1),
+    page_size: int = Query(10),
+    search: str = Query(""),
+    _username: str = Depends(require_dashboard_user),
+    service: SessionManagementService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.list_session_rules(
+            page=page,
+            page_size=page_size,
+            search=search.strip(),
+        ),
+        label="获取规则列表失败",
+    )
+
+
+@legacy_router.post("/update-rule")
+async def update_dashboard_session_rule(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: SessionManagementService = Depends(get_service),
+):
+    return await _run_dashboard_json(
+        request,
+        service.update_session_rule,
+        label="更新会话规则失败",
+    )
+
+
+@legacy_router.post("/delete-rule")
+async def delete_dashboard_session_rule(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: SessionManagementService = Depends(get_service),
+):
+    return await _run_dashboard_json(
+        request,
+        service.delete_session_rule,
+        label="删除会话规则失败",
+    )
+
+
+@legacy_router.post("/batch-delete-rule")
+async def batch_delete_dashboard_session_rule(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: SessionManagementService = Depends(get_service),
+):
+    return await _run_dashboard_json(
+        request,
+        service.batch_delete_session_rule,
+        label="批量删除会话规则失败",
+    )
+
+
+@legacy_router.get("/active-umos")
+async def list_dashboard_active_umos(
+    _username: str = Depends(require_dashboard_user),
+    service: SessionManagementService = Depends(get_service),
+):
+    return await _run(service.list_active_umos, label="获取 UMO 列表失败")
+
+
+@legacy_router.get("/list-all-with-status")
+async def list_dashboard_umos_with_status(
+    page: int = Query(1),
+    page_size: int = Query(20),
+    search: str = Query(""),
+    message_type: str = Query("all"),
+    platform: str = Query(""),
+    _username: str = Depends(require_dashboard_user),
+    service: SessionManagementService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.list_all_umos_with_status(
+            page=page,
+            page_size=page_size,
+            search=search.strip(),
+            message_type=message_type,
+            platform=platform,
+        ),
+        label="获取会话状态列表失败",
+    )
+
+
+@legacy_router.post("/batch-update-service")
+async def batch_update_dashboard_session_service(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: SessionManagementService = Depends(get_service),
+):
+    return await _run_dashboard_json(
+        request,
+        service.batch_update_service,
+        label="批量更新服务状态失败",
+    )
+
+
+@legacy_router.post("/batch-update-provider")
+async def batch_update_dashboard_session_provider(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: SessionManagementService = Depends(get_service),
+):
+    return await _run_dashboard_json(
+        request,
+        service.batch_update_provider,
+        label="批量更新 Provider 失败",
+    )
+
+
+@legacy_router.get("/groups")
+async def list_dashboard_session_groups(
+    _username: str = Depends(require_dashboard_user),
+    service: SessionManagementService = Depends(get_service),
+):
+    return await _run(service.list_groups, label="获取分组列表失败")
+
+
+@legacy_router.post("/group/create")
+async def create_dashboard_session_group(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: SessionManagementService = Depends(get_service),
+):
+    return await _run_dashboard_json(
+        request,
+        service.create_group,
+        label="创建分组失败",
+    )
+
+
+@legacy_router.post("/group/update")
+async def update_dashboard_session_group(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: SessionManagementService = Depends(get_service),
+):
+    return await _run_dashboard_json(
+        request,
+        service.update_group,
+        label="更新分组失败",
+    )
+
+
+@legacy_router.post("/group/delete")
+async def delete_dashboard_session_group(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: SessionManagementService = Depends(get_service),
+):
+    return await _run_dashboard_json(
+        request,
+        service.delete_group,
+        label="删除分组失败",
+    )
diff --git a/astrbot/dashboard/api/skills.py b/astrbot/dashboard/api/skills.py
new file mode 100644
index 000000000..c8925c8e4
--- /dev/null
+++ b/astrbot/dashboard/api/skills.py
@@ -0,0 +1,558 @@
+from __future__ import annotations
+
+from typing import Any
+
+from fastapi import APIRouter, Depends, Request
+from fastapi.responses import FileResponse
+
+from astrbot.core import logger
+from astrbot.dashboard.async_utils import run_maybe_async
+from astrbot.dashboard.responses import error, ok
+from astrbot.dashboard.schemas import (
+    SkillByNameUpdateRequest,
+    SkillFileUpdateRequest,
+    SkillNeoRequest,
+    SkillUpdateRequest,
+)
+from astrbot.dashboard.services.skills_service import (
+    SkillArchive,
+    SkillsOperationResult,
+    SkillsService,
+    SkillsServiceError,
+)
+
+from .auth import AuthContext, require_dashboard_user, require_scope
+from .multipart import multipart_parts, single_upload
+
+router = APIRouter(tags=["Skills"])
+legacy_router = APIRouter(
+    prefix="/api/skills",
+    tags=["Dashboard Skills"],
+    include_in_schema=False,
+)
+
+
+def get_service(request: Request) -> SkillsService:
+    return request.app.state.services.skills
+
+
+async def require_skill_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "skill")
+
+
+async def _json_or_empty(request: Request) -> dict[str, Any]:
+    try:
+        data = await request.json()
+    except Exception:
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def _required_text(value: object, name: str) -> str:
+    text = str(value or "").strip()
+    if not text:
+        raise ValueError(f"Missing key: {name}")
+    return text
+
+
+def _model_dict(payload) -> dict[str, Any]:
+    if payload is None:
+        return {}
+    if hasattr(payload, "model_dump"):
+        return payload.model_dump(exclude_none=True)
+    return payload if isinstance(payload, dict) else {}
+
+
+def _serialize_result(result: SkillsOperationResult):
+    if result.ok:
+        return ok(result.data, result.message)
+    return error(result.message or "", result.data)
+
+
+async def _run(operation, *, trace: bool = True):
+    try:
+        result = await run_maybe_async(operation)
+        if isinstance(result, SkillsOperationResult):
+            return _serialize_result(result)
+        return ok(result)
+    except SkillsServiceError as exc:
+        return error(str(exc))
+    except Exception as exc:
+        logger.error(str(exc), exc_info=trace)
+        return error(str(exc))
+
+
+def _archive_response(archive: SkillArchive):
+    return FileResponse(
+        archive.path,
+        filename=archive.filename,
+        media_type="application/zip",
+    )
+
+
+async def _download_skill(service: SkillsService, name: str):
+    try:
+        return _archive_response(service.prepare_skill_archive(name))
+    except SkillsServiceError as exc:
+        return error(str(exc))
+    except Exception as exc:
+        logger.error(str(exc), exc_info=True)
+        return error(str(exc))
+
+
+@router.get("/skills")
+async def list_skills(
+    _auth: AuthContext = Depends(require_skill_scope),
+    service: SkillsService = Depends(get_service),
+):
+    return await _run(service.get_skills)
+
+
+@router.post("/skills")
+async def upload_skill(
+    request: Request,
+    _auth: AuthContext = Depends(require_skill_scope),
+    service: SkillsService = Depends(get_service),
+):
+    async def _operation():
+        return await service.upload_skill(await single_upload(request))
+
+    return await _run(_operation)
+
+
+@router.post("/skills/batch")
+async def upload_skills_batch(
+    request: Request,
+    _auth: AuthContext = Depends(require_skill_scope),
+    service: SkillsService = Depends(get_service),
+):
+    async def _operation():
+        _, files = await multipart_parts(request)
+        return await service.batch_upload_skills(files.getlist("files"))
+
+    return await _run(_operation)
+
+
+@router.patch("/skills/by-name")
+async def update_skill_by_name(
+    payload: SkillByNameUpdateRequest,
+    _auth: AuthContext = Depends(require_skill_scope),
+    service: SkillsService = Depends(get_service),
+):
+    skill_name = _required_text(payload.skill_name, "skill_name")
+    return await _run(
+        lambda: service.update_skill(
+            {
+                "name": skill_name,
+                "active": payload.active_value(),
+            }
+        )
+    )
+
+
+@router.delete("/skills/by-name")
+async def delete_skill_by_name(
+    skill_name: str,
+    _auth: AuthContext = Depends(require_skill_scope),
+    service: SkillsService = Depends(get_service),
+):
+    return await _run(lambda: service.delete_skill({"name": skill_name}))
+
+
+@router.get("/skills/archive")
+async def download_skill_by_name(
+    skill_name: str,
+    _auth: AuthContext = Depends(require_skill_scope),
+    service: SkillsService = Depends(get_service),
+):
+    return await _download_skill(service, skill_name)
+
+
+@router.get("/skills/files")
+async def list_skill_files_by_name(
+    request: Request,
+    skill_name: str,
+    _auth: AuthContext = Depends(require_skill_scope),
+    service: SkillsService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.list_skill_files(
+            skill_name,
+            request.query_params.get("path", ""),
+        )
+    )
+
+
+@router.get("/skills/file")
+async def get_skill_file_by_name(
+    skill_name: str,
+    path: str,
+    _auth: AuthContext = Depends(require_skill_scope),
+    service: SkillsService = Depends(get_service),
+):
+    return await _run(lambda: service.get_skill_file(skill_name, path))
+
+
+@router.put("/skills/file")
+async def update_skill_file_by_name(
+    payload: SkillFileUpdateRequest,
+    _auth: AuthContext = Depends(require_skill_scope),
+    service: SkillsService = Depends(get_service),
+):
+    skill_name = _required_text(payload.skill_name, "skill_name")
+    path = _required_text(payload.path, "path")
+    return await _run(
+        lambda: service.update_skill_file(
+            {
+                "name": skill_name,
+                "path": path,
+                "content": payload.content,
+            }
+        )
+    )
+
+
+@router.get("/skills/{skill_name:path}/archive")
+async def download_skill(
+    skill_name: str,
+    _auth: AuthContext = Depends(require_skill_scope),
+    service: SkillsService = Depends(get_service),
+):
+    return await _download_skill(service, skill_name)
+
+
+@router.get("/skills/{skill_name:path}/files")
+async def list_skill_files(
+    skill_name: str,
+    request: Request,
+    _auth: AuthContext = Depends(require_skill_scope),
+    service: SkillsService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.list_skill_files(
+            skill_name,
+            request.query_params.get("path", ""),
+        )
+    )
+
+
+@router.get("/skills/{skill_name:path}/files/{file_path:path}")
+async def get_skill_file(
+    skill_name: str,
+    file_path: str,
+    _auth: AuthContext = Depends(require_skill_scope),
+    service: SkillsService = Depends(get_service),
+):
+    return await _run(lambda: service.get_skill_file(skill_name, file_path))
+
+
+@router.put("/skills/{skill_name:path}/files/{file_path:path}")
+async def update_skill_file(
+    skill_name: str,
+    file_path: str,
+    request: Request,
+    _auth: AuthContext = Depends(require_skill_scope),
+    service: SkillsService = Depends(get_service),
+):
+    content = (await request.body()).decode("utf-8")
+    return await _run(
+        lambda: service.update_skill_file(
+            {"name": skill_name, "path": file_path, "content": content}
+        )
+    )
+
+
+@router.patch("/skills/{skill_name:path}")
+async def update_skill(
+    skill_name: str,
+    payload: SkillUpdateRequest,
+    _auth: AuthContext = Depends(require_skill_scope),
+    service: SkillsService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.update_skill(
+            {
+                "name": skill_name,
+                "active": payload.active_value(),
+            }
+        )
+    )
+
+
+@router.delete("/skills/{skill_name:path}")
+async def delete_skill(
+    skill_name: str,
+    _auth: AuthContext = Depends(require_skill_scope),
+    service: SkillsService = Depends(get_service),
+):
+    return await _run(lambda: service.delete_skill({"name": skill_name}))
+
+
+@router.get("/skills/neo/candidates")
+async def list_neo_skill_candidates(
+    request: Request,
+    _auth: AuthContext = Depends(require_skill_scope),
+    service: SkillsService = Depends(get_service),
+):
+    return await _run(
+        service.get_neo_candidates(
+            dict(request.query_params),
+        )
+    )
+
+
+@router.get("/skills/neo/releases")
+async def list_neo_skill_releases(
+    request: Request,
+    _auth: AuthContext = Depends(require_skill_scope),
+    service: SkillsService = Depends(get_service),
+):
+    return await _run(
+        service.get_neo_releases(
+            dict(request.query_params),
+        )
+    )
+
+
+@router.get("/skills/neo/payload")
+async def get_neo_skill_payload(
+    request: Request,
+    _auth: AuthContext = Depends(require_skill_scope),
+    service: SkillsService = Depends(get_service),
+):
+    return await _run(service.get_neo_payload(dict(request.query_params)))
+
+
+@router.post("/skills/neo/evaluate")
+async def evaluate_neo_skill_candidate(
+    payload: SkillNeoRequest,
+    _auth: AuthContext = Depends(require_skill_scope),
+    service: SkillsService = Depends(get_service),
+):
+    return await _run(lambda: service.evaluate_neo_candidate(_model_dict(payload)))
+
+
+@router.post("/skills/neo/promote")
+async def promote_neo_skill_candidate(
+    payload: SkillNeoRequest,
+    _auth: AuthContext = Depends(require_skill_scope),
+    service: SkillsService = Depends(get_service),
+):
+    return await _run(lambda: service.promote_neo_candidate(_model_dict(payload)))
+
+
+@router.post("/skills/neo/rollback")
+async def rollback_neo_skill_release(
+    payload: SkillNeoRequest,
+    _auth: AuthContext = Depends(require_skill_scope),
+    service: SkillsService = Depends(get_service),
+):
+    return await _run(lambda: service.rollback_neo_release(_model_dict(payload)))
+
+
+@router.post("/skills/neo/sync")
+async def sync_neo_skill_release(
+    payload: SkillNeoRequest,
+    _auth: AuthContext = Depends(require_skill_scope),
+    service: SkillsService = Depends(get_service),
+):
+    return await _run(lambda: service.sync_neo_release(_model_dict(payload)))
+
+
+@router.post("/skills/neo/candidates/delete")
+async def delete_neo_skill_candidate(
+    payload: SkillNeoRequest,
+    _auth: AuthContext = Depends(require_skill_scope),
+    service: SkillsService = Depends(get_service),
+):
+    return await _run(lambda: service.delete_neo_candidate(_model_dict(payload)))
+
+
+@router.post("/skills/neo/releases/delete")
+async def delete_neo_skill_release(
+    payload: SkillNeoRequest,
+    _auth: AuthContext = Depends(require_skill_scope),
+    service: SkillsService = Depends(get_service),
+):
+    return await _run(lambda: service.delete_neo_release(_model_dict(payload)))
+
+
+@legacy_router.get("")
+async def list_dashboard_skills(
+    _username: str = Depends(require_dashboard_user),
+    service: SkillsService = Depends(get_service),
+):
+    return await _run(service.get_skills)
+
+
+@legacy_router.post("/upload")
+async def upload_dashboard_skill(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: SkillsService = Depends(get_service),
+):
+    async def _operation():
+        return await service.upload_skill(await single_upload(request))
+
+    return await _run(_operation)
+
+
+@legacy_router.post("/batch-upload")
+async def batch_upload_dashboard_skills(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: SkillsService = Depends(get_service),
+):
+    async def _operation():
+        _, files = await multipart_parts(request)
+        return await service.batch_upload_skills(files.getlist("files"))
+
+    return await _run(_operation)
+
+
+@legacy_router.get("/download")
+async def download_dashboard_skill(
+    name: str,
+    _username: str = Depends(require_dashboard_user),
+    service: SkillsService = Depends(get_service),
+):
+    return await _download_skill(service, name)
+
+
+@legacy_router.get("/files")
+async def list_dashboard_skill_files(
+    request: Request,
+    name: str,
+    _username: str = Depends(require_dashboard_user),
+    service: SkillsService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.list_skill_files(name, request.query_params.get("path", ""))
+    )
+
+
+@legacy_router.get("/file")
+async def get_dashboard_skill_file(
+    name: str,
+    path: str = "SKILL.md",
+    _username: str = Depends(require_dashboard_user),
+    service: SkillsService = Depends(get_service),
+):
+    return await _run(lambda: service.get_skill_file(name, path))
+
+
+@legacy_router.post("/file")
+async def update_dashboard_skill_file(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: SkillsService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.update_skill_file(body))
+
+
+@legacy_router.post("/update")
+async def update_dashboard_skill(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: SkillsService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.update_skill(body))
+
+
+@legacy_router.post("/delete")
+async def delete_dashboard_skill(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: SkillsService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.delete_skill(body))
+
+
+@legacy_router.get("/neo/candidates")
+async def list_dashboard_neo_skill_candidates(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: SkillsService = Depends(get_service),
+):
+    return await _run(service.get_neo_candidates(dict(request.query_params)))
+
+
+@legacy_router.get("/neo/releases")
+async def list_dashboard_neo_skill_releases(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: SkillsService = Depends(get_service),
+):
+    return await _run(service.get_neo_releases(dict(request.query_params)))
+
+
+@legacy_router.get("/neo/payload")
+async def get_dashboard_neo_skill_payload(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: SkillsService = Depends(get_service),
+):
+    return await _run(service.get_neo_payload(dict(request.query_params)))
+
+
+@legacy_router.post("/neo/evaluate")
+async def evaluate_dashboard_neo_skill_candidate(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: SkillsService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.evaluate_neo_candidate(body))
+
+
+@legacy_router.post("/neo/promote")
+async def promote_dashboard_neo_skill_candidate(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: SkillsService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.promote_neo_candidate(body))
+
+
+@legacy_router.post("/neo/rollback")
+async def rollback_dashboard_neo_skill_release(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: SkillsService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.rollback_neo_release(body))
+
+
+@legacy_router.post("/neo/sync")
+async def sync_dashboard_neo_skill_release(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: SkillsService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.sync_neo_release(body))
+
+
+@legacy_router.post("/neo/delete-candidate")
+async def delete_dashboard_neo_skill_candidate(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: SkillsService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.delete_neo_candidate(body))
+
+
+@legacy_router.post("/neo/delete-release")
+async def delete_dashboard_neo_skill_release(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: SkillsService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.delete_neo_release(body))
diff --git a/astrbot/dashboard/api/static_files.py b/astrbot/dashboard/api/static_files.py
new file mode 100644
index 000000000..02aaa3ca6
--- /dev/null
+++ b/astrbot/dashboard/api/static_files.py
@@ -0,0 +1,40 @@
+from __future__ import annotations
+
+from fastapi import APIRouter, HTTPException, Request
+from fastapi.responses import FileResponse, PlainTextResponse
+
+from astrbot.dashboard.services.static_file_service import StaticFileService
+
+router = APIRouter(include_in_schema=False)
+service = StaticFileService()
+
+
+def _static_folder(request: Request) -> str | None:
+    return getattr(request.app.state, "dashboard_static_folder", None)
+
+
+def _not_found_response() -> PlainTextResponse:
+    return PlainTextResponse(service.get_not_found_message(), status_code=404)
+
+
+async def serve_index(request: Request):
+    index_file = service.resolve_index_file(_static_folder(request))
+    if index_file is None:
+        return _not_found_response()
+    return FileResponse(index_file)
+
+
+async def serve_static_file(request: Request, static_path: str):
+    if request.url.path.startswith("/api"):
+        raise HTTPException(status_code=404)
+
+    file_path = service.resolve_static_file(_static_folder(request), static_path)
+    if file_path is None:
+        return _not_found_response()
+    return FileResponse(file_path)
+
+
+for index_route in service.list_index_routes():
+    router.add_api_route(index_route, serve_index, methods=["GET"])
+
+router.add_api_route("/{static_path:path}", serve_static_file, methods=["GET"])
diff --git a/astrbot/dashboard/api/stats.py b/astrbot/dashboard/api/stats.py
new file mode 100644
index 000000000..6bb87817b
--- /dev/null
+++ b/astrbot/dashboard/api/stats.py
@@ -0,0 +1,235 @@
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, Query, Request
+
+from astrbot.dashboard.async_utils import run_maybe_async
+from astrbot.dashboard.responses import ApiError, ok
+from astrbot.dashboard.schemas import GhProxyTestRequest, StorageCleanupRequest
+from astrbot.dashboard.services.stat_service import StatService, StatServiceError
+
+from .auth import AuthContext, require_dashboard_user, require_scope
+
+router = APIRouter(tags=["System Stats"])
+legacy_router = APIRouter(
+    prefix="/api/stat",
+    tags=["Dashboard System Stats"],
+    include_in_schema=False,
+)
+
+
+async def require_system_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "system")
+
+
+def get_service(request: Request) -> StatService:
+    return request.app.state.services.stats
+
+
+def _raise_stat_error(exc: StatServiceError) -> None:
+    raise ApiError(str(exc)) from exc
+
+
+async def _run(operation):
+    try:
+        result = await run_maybe_async(operation)
+        return ok(result)
+    except StatServiceError as exc:
+        _raise_stat_error(exc)
+
+
+def _parse_int(value: object, default: int, name: str) -> int:
+    if value is None:
+        return default
+    if not isinstance(value, int | float | str | bytes | bytearray):
+        raise ApiError(f"{name} must be an integer")
+    try:
+        return int(value)
+    except (TypeError, ValueError) as exc:
+        raise ApiError(f"{name} must be an integer") from exc
+
+
+@router.get("/stats")
+async def get_stats(
+    offset_sec: int = Query(default=86400),
+    _auth: AuthContext = Depends(require_system_scope),
+    service: StatService = Depends(get_service),
+):
+    return await _run(service.get_stat(offset_sec))
+
+
+@router.get("/stats/provider-tokens")
+async def get_provider_token_stats(
+    days: int = Query(default=1),
+    _auth: AuthContext = Depends(require_system_scope),
+    service: StatService = Depends(get_service),
+):
+    return await _run(service.get_provider_token_stats(days))
+
+
+@router.get("/stats/version")
+async def get_version(
+    _auth: AuthContext = Depends(require_system_scope),
+    service: StatService = Depends(get_service),
+):
+    return await _run(service.get_version())
+
+
+@router.get("/stats/first-notice")
+async def get_first_notice(
+    locale: str | None = None,
+    _auth: AuthContext = Depends(require_system_scope),
+    service: StatService = Depends(get_service),
+):
+    return await _run(lambda: service.get_first_notice(locale))
+
+
+@router.post("/stats/ghproxy/test")
+async def test_ghproxy_connection(
+    payload: GhProxyTestRequest,
+    _auth: AuthContext = Depends(require_system_scope),
+    service: StatService = Depends(get_service),
+):
+    return await _run(service.test_ghproxy_connection(payload.proxy_url))
+
+
+@router.get("/changelogs")
+async def list_changelog_versions(
+    _auth: AuthContext = Depends(require_system_scope),
+    service: StatService = Depends(get_service),
+):
+    return await _run(service.list_changelog_versions)
+
+
+@router.get("/changelogs/{version}")
+async def get_changelog(
+    version: str,
+    _auth: AuthContext = Depends(require_system_scope),
+    service: StatService = Depends(get_service),
+):
+    return await _run(lambda: service.get_changelog(version))
+
+
+@router.get("/stats/start-time")
+async def get_start_time(
+    service: StatService = Depends(get_service),
+):
+    return await _run(service.get_start_time)
+
+
+@router.get("/stats/storage")
+async def get_storage_status(
+    _auth: AuthContext = Depends(require_system_scope),
+    service: StatService = Depends(get_service),
+):
+    return await _run(service.get_storage_status())
+
+
+@router.post("/stats/storage/cleanup")
+async def cleanup_storage(
+    payload: StorageCleanupRequest,
+    _auth: AuthContext = Depends(require_system_scope),
+    service: StatService = Depends(get_service),
+):
+    return await _run(service.cleanup_storage(payload.target))
+
+
+@router.post("/system/restart")
+async def restart_system(
+    _auth: AuthContext = Depends(require_system_scope),
+    service: StatService = Depends(get_service),
+):
+    return await _run(service.restart_core())
+
+
+@legacy_router.get("/get")
+async def get_dashboard_stats(
+    offset_sec: int | None = Query(default=86400),
+    _username: str = Depends(require_dashboard_user),
+    service: StatService = Depends(get_service),
+):
+    return await _run(service.get_stat(_parse_int(offset_sec, 86400, "offset_sec")))
+
+
+@legacy_router.get("/provider-tokens")
+async def get_dashboard_provider_token_stats(
+    days: int | None = Query(default=1),
+    _username: str = Depends(require_dashboard_user),
+    service: StatService = Depends(get_service),
+):
+    return await _run(service.get_provider_token_stats(_parse_int(days, 1, "days")))
+
+
+@legacy_router.get("/version")
+async def get_dashboard_version(
+    _username: str = Depends(require_dashboard_user),
+    service: StatService = Depends(get_service),
+):
+    return await _run(service.get_version())
+
+
+@legacy_router.get("/start-time")
+async def get_dashboard_start_time(
+    service: StatService = Depends(get_service),
+):
+    return await _run(service.get_start_time)
+
+
+@legacy_router.post("/restart-core")
+async def restart_dashboard_core(
+    _username: str = Depends(require_dashboard_user),
+    service: StatService = Depends(get_service),
+):
+    return await _run(service.restart_core())
+
+
+@legacy_router.post("/test-ghproxy-connection")
+async def test_dashboard_ghproxy_connection(
+    payload: GhProxyTestRequest,
+    _username: str = Depends(require_dashboard_user),
+    service: StatService = Depends(get_service),
+):
+    return await _run(service.test_ghproxy_connection(payload.proxy_url))
+
+
+@legacy_router.get("/changelog")
+async def get_dashboard_changelog(
+    version: str | None = None,
+    _username: str = Depends(require_dashboard_user),
+    service: StatService = Depends(get_service),
+):
+    return await _run(lambda: service.get_changelog(version))
+
+
+@legacy_router.get("/changelog/list")
+async def list_dashboard_changelog_versions(
+    _username: str = Depends(require_dashboard_user),
+    service: StatService = Depends(get_service),
+):
+    return await _run(service.list_changelog_versions)
+
+
+@legacy_router.get("/first-notice")
+async def get_dashboard_first_notice(
+    locale: str | None = None,
+    _username: str = Depends(require_dashboard_user),
+    service: StatService = Depends(get_service),
+):
+    return await _run(lambda: service.get_first_notice(locale))
+
+
+@legacy_router.get("/storage")
+async def get_dashboard_storage_status(
+    _username: str = Depends(require_dashboard_user),
+    service: StatService = Depends(get_service),
+):
+    return await _run(service.get_storage_status())
+
+
+@legacy_router.post("/storage/cleanup")
+async def cleanup_dashboard_storage(
+    payload: StorageCleanupRequest | None = None,
+    _username: str = Depends(require_dashboard_user),
+    service: StatService = Depends(get_service),
+):
+    target = payload.target if payload is not None else "all"
+    return await _run(service.cleanup_storage(target))
diff --git a/astrbot/dashboard/api/subagents.py b/astrbot/dashboard/api/subagents.py
new file mode 100644
index 000000000..c26bf4ad5
--- /dev/null
+++ b/astrbot/dashboard/api/subagents.py
@@ -0,0 +1,107 @@
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, Request
+
+from astrbot.dashboard.responses import ApiError, ok
+from astrbot.dashboard.schemas import SubAgentConfigRequest
+from astrbot.dashboard.services.subagent_service import (
+    SubAgentService,
+    SubAgentServiceError,
+)
+
+from .auth import AuthContext, require_dashboard_user, require_scope
+
+router = APIRouter(tags=["Subagents"])
+legacy_router = APIRouter(
+    prefix="/api/subagent",
+    tags=["Dashboard Subagents"],
+    include_in_schema=False,
+)
+
+
+async def require_config_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "config")
+
+
+def get_service(request: Request) -> SubAgentService:
+    return request.app.state.services.subagents
+
+
+def _payload_dict(payload: SubAgentConfigRequest) -> dict:
+    return payload.model_dump(exclude_none=True)
+
+
+def _raise_subagent_error(exc: SubAgentServiceError) -> None:
+    raise ApiError(str(exc)) from exc
+
+
+async def _get_config(service: SubAgentService):
+    try:
+        return ok(service.get_config())
+    except SubAgentServiceError as exc:
+        _raise_subagent_error(exc)
+
+
+async def _update_config(payload: SubAgentConfigRequest, service: SubAgentService):
+    try:
+        await service.update_config(_payload_dict(payload))
+        return ok(message="保存成功")
+    except SubAgentServiceError as exc:
+        _raise_subagent_error(exc)
+
+
+async def _get_available_tools(service: SubAgentService):
+    try:
+        return ok(service.get_available_tools())
+    except SubAgentServiceError as exc:
+        _raise_subagent_error(exc)
+
+
+@router.get("/subagents/config")
+async def get_subagent_config(
+    _auth: AuthContext = Depends(require_config_scope),
+    service: SubAgentService = Depends(get_service),
+):
+    return await _get_config(service)
+
+
+@router.put("/subagents/config")
+async def update_subagent_config(
+    payload: SubAgentConfigRequest,
+    _auth: AuthContext = Depends(require_config_scope),
+    service: SubAgentService = Depends(get_service),
+):
+    return await _update_config(payload, service)
+
+
+@router.get("/subagents/available-tools")
+async def get_subagent_tools(
+    _auth: AuthContext = Depends(require_config_scope),
+    service: SubAgentService = Depends(get_service),
+):
+    return await _get_available_tools(service)
+
+
+@legacy_router.get("/config")
+async def get_dashboard_subagent_config(
+    _username: str = Depends(require_dashboard_user),
+    service: SubAgentService = Depends(get_service),
+):
+    return await _get_config(service)
+
+
+@legacy_router.post("/config")
+async def update_dashboard_subagent_config(
+    payload: SubAgentConfigRequest,
+    _username: str = Depends(require_dashboard_user),
+    service: SubAgentService = Depends(get_service),
+):
+    return await _update_config(payload, service)
+
+
+@legacy_router.get("/available-tools")
+async def get_dashboard_subagent_tools(
+    _username: str = Depends(require_dashboard_user),
+    service: SubAgentService = Depends(get_service),
+):
+    return await _get_available_tools(service)
diff --git a/astrbot/dashboard/api/t2i.py b/astrbot/dashboard/api/t2i.py
new file mode 100644
index 000000000..3edc66fd7
--- /dev/null
+++ b/astrbot/dashboard/api/t2i.py
@@ -0,0 +1,235 @@
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, Request
+from fastapi.responses import JSONResponse
+
+from astrbot.dashboard.async_utils import run_maybe_async
+from astrbot.dashboard.responses import ApiError, ok
+from astrbot.dashboard.schemas import T2iActiveTemplateRequest, T2iTemplateRequest
+from astrbot.dashboard.services.t2i_service import T2iService, T2iServiceError
+
+from .auth import AuthContext, require_dashboard_user, require_scope
+
+router = APIRouter(tags=["Text To Image"])
+legacy_router = APIRouter(
+    prefix="/api/t2i",
+    tags=["Dashboard Text To Image"],
+    include_in_schema=False,
+)
+
+
+def get_service(request: Request) -> T2iService:
+    return request.app.state.services.t2i
+
+
+async def require_config_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "config")
+
+
+async def _json_or_empty(request: Request) -> dict:
+    try:
+        data = await request.json()
+    except Exception:
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def _raise_t2i_error(exc: T2iServiceError) -> None:
+    raise ApiError(str(exc), status_code=exc.status_code) from exc
+
+
+def _response(
+    data=None,
+    *,
+    message: str | None = None,
+    status_code: int = 200,
+):
+    payload = ok(data, message)
+    if status_code == 200:
+        return payload
+    return JSONResponse(payload, status_code=status_code)
+
+
+async def _run(
+    operation,
+    *,
+    message: str | None = None,
+    status_code: int = 200,
+    result_as_message: bool = False,
+):
+    try:
+        result = await run_maybe_async(operation)
+        if isinstance(result, tuple):
+            payload, result_message = result
+            return _response(payload, message=result_message)
+        if result_as_message:
+            return _response(message=str(result), status_code=status_code)
+        return _response(result, message=message, status_code=status_code)
+    except T2iServiceError as exc:
+        _raise_t2i_error(exc)
+
+
+@router.get("/t2i/templates")
+async def list_t2i_templates(
+    _auth: AuthContext = Depends(require_config_scope),
+    service: T2iService = Depends(get_service),
+):
+    return await _run(service.list_templates)
+
+
+@router.post("/t2i/templates")
+async def create_t2i_template(
+    payload: T2iTemplateRequest,
+    _auth: AuthContext = Depends(require_config_scope),
+    service: T2iService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.create_template(payload.name, payload.content),
+        message="Template created successfully.",
+        status_code=201,
+    )
+
+
+@router.get("/t2i/templates/active")
+async def get_active_t2i_template(
+    _auth: AuthContext = Depends(require_config_scope),
+    service: T2iService = Depends(get_service),
+):
+    return await _run(service.get_active_template)
+
+
+@router.put("/t2i/templates/active")
+async def set_active_t2i_template(
+    payload: T2iActiveTemplateRequest,
+    _auth: AuthContext = Depends(require_config_scope),
+    service: T2iService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.set_active_template(payload.name),
+        result_as_message=True,
+    )
+
+
+@router.post("/t2i/templates/default/reset")
+async def reset_default_t2i_template(
+    _auth: AuthContext = Depends(require_config_scope),
+    service: T2iService = Depends(get_service),
+):
+    return await _run(
+        service.reset_default_template,
+        result_as_message=True,
+    )
+
+
+@router.get("/t2i/templates/{name:path}")
+async def get_t2i_template(
+    name: str,
+    _auth: AuthContext = Depends(require_config_scope),
+    service: T2iService = Depends(get_service),
+):
+    return await _run(lambda: service.get_template(name))
+
+
+@router.put("/t2i/templates/{name:path}")
+async def update_t2i_template(
+    name: str,
+    payload: T2iTemplateRequest,
+    _auth: AuthContext = Depends(require_config_scope),
+    service: T2iService = Depends(get_service),
+):
+    return await _run(lambda: service.update_template(name, payload.content))
+
+
+@router.delete("/t2i/templates/{name:path}")
+async def delete_t2i_template(
+    name: str,
+    _auth: AuthContext = Depends(require_config_scope),
+    service: T2iService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.delete_template(name),
+        message="Template deleted successfully.",
+    )
+
+
+@legacy_router.get("/templates")
+async def list_dashboard_t2i_templates(
+    _username: str = Depends(require_dashboard_user),
+    service: T2iService = Depends(get_service),
+):
+    return await _run(service.list_templates)
+
+
+@legacy_router.get("/templates/active")
+async def get_dashboard_active_t2i_template(
+    _username: str = Depends(require_dashboard_user),
+    service: T2iService = Depends(get_service),
+):
+    return await _run(service.get_active_template)
+
+
+@legacy_router.post("/templates/create")
+async def create_dashboard_t2i_template(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: T2iService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(
+        lambda: service.create_template(body.get("name"), body.get("content")),
+        message="Template created successfully.",
+        status_code=201,
+    )
+
+
+@legacy_router.post("/templates/reset_default")
+async def reset_dashboard_default_t2i_template(
+    _username: str = Depends(require_dashboard_user),
+    service: T2iService = Depends(get_service),
+):
+    return await _run(service.reset_default_template, result_as_message=True)
+
+
+@legacy_router.post("/templates/set_active")
+async def set_dashboard_active_t2i_template(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: T2iService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(
+        lambda: service.set_active_template(body.get("name")),
+        result_as_message=True,
+    )
+
+
+@legacy_router.get("/templates/{name:path}")
+async def get_dashboard_t2i_template(
+    name: str,
+    _username: str = Depends(require_dashboard_user),
+    service: T2iService = Depends(get_service),
+):
+    return await _run(lambda: service.get_template(name))
+
+
+@legacy_router.put("/templates/{name:path}")
+async def update_dashboard_t2i_template(
+    name: str,
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: T2iService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(lambda: service.update_template(name, body.get("content")))
+
+
+@legacy_router.delete("/templates/{name:path}")
+async def delete_dashboard_t2i_template(
+    name: str,
+    _username: str = Depends(require_dashboard_user),
+    service: T2iService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.delete_template(name),
+        message="Template deleted successfully.",
+    )
diff --git a/astrbot/dashboard/api/tools.py b/astrbot/dashboard/api/tools.py
new file mode 100644
index 000000000..2a253225d
--- /dev/null
+++ b/astrbot/dashboard/api/tools.py
@@ -0,0 +1,426 @@
+from __future__ import annotations
+
+from typing import Any
+
+from fastapi import APIRouter, Depends, Query, Request
+
+from astrbot.dashboard.async_utils import run_maybe_async
+from astrbot.dashboard.responses import ApiError, ok
+from astrbot.dashboard.schemas import (
+    McpServerByNameRequest,
+    McpServerRequest,
+    ModelScopeSyncRequest,
+    ToolEnabledRequest,
+    ToolPermissionRequest,
+)
+from astrbot.dashboard.services.tools_service import ToolsService, ToolsServiceError
+
+from .auth import AuthContext, require_dashboard_user, require_scope
+
+router = APIRouter(tags=["Extension Components"])
+legacy_router = APIRouter(
+    prefix="/api",
+    tags=["Dashboard Extension Components"],
+    include_in_schema=False,
+)
+
+
+def get_service(request: Request) -> ToolsService:
+    return request.app.state.services.tools
+
+
+async def require_tool_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "tool")
+
+
+async def require_mcp_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "mcp")
+
+
+async def _json_or_empty(request: Request) -> dict[str, Any]:
+    try:
+        data = await request.json()
+    except Exception:
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def _required_text(value: object, name: str) -> str:
+    text = str(value or "").strip()
+    if not text:
+        raise ApiError(f"Missing key: {name}")
+    return text
+
+
+def _model_dict(payload: McpServerRequest | McpServerByNameRequest) -> dict[str, Any]:
+    return payload.model_dump(exclude_none=True)
+
+
+def _normalize_server_config(body: dict[str, Any], id_key: str) -> dict[str, Any]:
+    config = body.get("config")
+    if isinstance(config, dict):
+        normalized = dict(config)
+    else:
+        normalized = {
+            key: value
+            for key, value in body.items()
+            if key not in {id_key, "config", "enabled", "mcp_server_config"}
+        }
+    if "enabled" in body and "active" not in normalized:
+        normalized["active"] = body["enabled"]
+    return normalized
+
+
+def _server_name_from_body(body: dict[str, Any]) -> str:
+    return _required_text(body.get("server_name") or body.get("name"), "server_name")
+
+
+def _test_config_body(
+    service: ToolsService,
+    server_name: str,
+    body: dict[str, Any],
+) -> dict[str, Any]:
+    config = body.get("mcp_server_config") or body.get("config")
+    if isinstance(config, dict):
+        return dict(config)
+
+    stored_config = service.get_mcp_server_config(server_name)
+    if stored_config is not None:
+        return stored_config
+
+    return {"name": server_name}
+
+
+def _raise_tools_error(exc: ToolsServiceError) -> None:
+    raise ApiError(str(exc)) from exc
+
+
+async def _run(
+    operation, *, result_as_message: bool = False, message: str | None = None
+):
+    try:
+        result = await run_maybe_async(operation)
+        if result_as_message:
+            return ok(None, str(result))
+        return ok(result, message)
+    except ToolsServiceError as exc:
+        _raise_tools_error(exc)
+
+
+async def _toggle_tool(
+    tool_id: str,
+    enabled: bool,
+    service: ToolsService,
+):
+    return await _run(
+        lambda: service.toggle_tool({"name": tool_id, "activate": enabled}),
+        result_as_message=True,
+    )
+
+
+async def _create_mcp_server(body: dict[str, Any], service: ToolsService):
+    if "enabled" in body and "active" not in body:
+        body["active"] = body.pop("enabled")
+    return await _run(
+        lambda: service.add_mcp_server(body),
+        result_as_message=True,
+    )
+
+
+async def _update_mcp_server(
+    server_name: str,
+    body: dict[str, Any],
+    service: ToolsService,
+):
+    config = _normalize_server_config(body, "server_name")
+    config.setdefault("name", server_name)
+    config.setdefault("oldName", server_name)
+    return await _run(
+        lambda: service.update_mcp_server(config),
+        result_as_message=True,
+    )
+
+
+async def _delete_mcp_server(server_name: str, service: ToolsService):
+    return await _run(
+        lambda: service.delete_mcp_server({"name": server_name}),
+        result_as_message=True,
+    )
+
+
+async def _test_mcp_server(
+    server_name: str,
+    body: dict[str, Any],
+    service: ToolsService,
+):
+    config = _test_config_body(service, server_name, body)
+    return await _run(
+        lambda: service.test_mcp_connection(
+            {"name": server_name, "mcp_server_config": config}
+        ),
+        message="🎉 MCP server is available!",
+    )
+
+
+async def _sync_modelscope_mcp_servers(
+    access_token: str,
+    service: ToolsService,
+):
+    return await _run(
+        lambda: service.sync_provider(
+            {
+                "name": "modelscope",
+                "access_token": access_token,
+            }
+        ),
+        result_as_message=True,
+    )
+
+
+@router.get("/tools")
+async def list_tools(
+    _auth: AuthContext = Depends(require_tool_scope),
+    service: ToolsService = Depends(get_service),
+):
+    return await _run(service.get_tool_list)
+
+
+@router.patch("/tools/{tool_id:path}/enabled")
+async def set_tool_enabled(
+    tool_id: str,
+    payload: ToolEnabledRequest,
+    _auth: AuthContext = Depends(require_tool_scope),
+    service: ToolsService = Depends(get_service),
+):
+    return await _toggle_tool(tool_id, payload.enabled, service)
+
+
+@router.patch("/tools/{tool_id:path}/permission")
+async def set_tool_permission(
+    tool_id: str,
+    payload: ToolPermissionRequest,
+    _auth: AuthContext = Depends(require_tool_scope),
+    service: ToolsService = Depends(get_service),
+):
+    return await _run(
+        lambda: service.update_tool_permission(
+            {"name": tool_id, "permission": payload.permission}
+        ),
+        result_as_message=True,
+    )
+
+
+@router.get("/mcp/servers")
+async def list_mcp_servers(
+    _auth: AuthContext = Depends(require_mcp_scope),
+    service: ToolsService = Depends(get_service),
+):
+    return await _run(service.get_mcp_servers)
+
+
+@router.post("/mcp/servers")
+async def create_mcp_server(
+    payload: McpServerRequest,
+    _auth: AuthContext = Depends(require_mcp_scope),
+    service: ToolsService = Depends(get_service),
+):
+    return await _create_mcp_server(_model_dict(payload), service)
+
+
+@router.put("/mcp/servers/by-name")
+async def update_mcp_server_by_name(
+    payload: McpServerByNameRequest,
+    _auth: AuthContext = Depends(require_mcp_scope),
+    service: ToolsService = Depends(get_service),
+):
+    body = _model_dict(payload)
+    return await _update_mcp_server(payload.server_name, body, service)
+
+
+@router.delete("/mcp/servers/by-name")
+async def delete_mcp_server_by_name(
+    server_name: str = Query(...),
+    _auth: AuthContext = Depends(require_mcp_scope),
+    service: ToolsService = Depends(get_service),
+):
+    return await _delete_mcp_server(server_name, service)
+
+
+@router.patch("/mcp/servers/enabled")
+async def set_mcp_server_enabled_by_name(
+    payload: McpServerByNameRequest,
+    _auth: AuthContext = Depends(require_mcp_scope),
+    service: ToolsService = Depends(get_service),
+):
+    body = _model_dict(payload)
+    return await _update_mcp_server(payload.server_name, body, service)
+
+
+@router.post("/mcp/servers/test")
+async def test_mcp_server_by_name(
+    payload: McpServerByNameRequest,
+    _auth: AuthContext = Depends(require_mcp_scope),
+    service: ToolsService = Depends(get_service),
+):
+    body = _model_dict(payload)
+    return await _test_mcp_server(payload.server_name, body, service)
+
+
+@router.patch("/mcp/servers/{server_name:path}/enabled")
+async def set_mcp_server_enabled(
+    server_name: str,
+    payload: ToolEnabledRequest,
+    _auth: AuthContext = Depends(require_mcp_scope),
+    service: ToolsService = Depends(get_service),
+):
+    return await _update_mcp_server(
+        server_name,
+        {"server_name": server_name, "enabled": payload.enabled},
+        service,
+    )
+
+
+@router.post("/mcp/servers/{server_name:path}/test")
+async def test_mcp_server(
+    server_name: str,
+    payload: McpServerRequest | None = None,
+    _auth: AuthContext = Depends(require_mcp_scope),
+    service: ToolsService = Depends(get_service),
+):
+    body = _model_dict(payload) if payload is not None else {}
+    return await _test_mcp_server(server_name, body, service)
+
+
+@router.put("/mcp/servers/{server_name:path}")
+async def update_mcp_server(
+    server_name: str,
+    payload: McpServerRequest,
+    _auth: AuthContext = Depends(require_mcp_scope),
+    service: ToolsService = Depends(get_service),
+):
+    body = _model_dict(payload)
+    return await _update_mcp_server(server_name, body, service)
+
+
+@router.delete("/mcp/servers/{server_name:path}")
+async def delete_mcp_server(
+    server_name: str,
+    _auth: AuthContext = Depends(require_mcp_scope),
+    service: ToolsService = Depends(get_service),
+):
+    return await _delete_mcp_server(server_name, service)
+
+
+@router.post("/mcp/providers/modelscope/sync")
+async def sync_modelscope_mcp_servers(
+    payload: ModelScopeSyncRequest | None = None,
+    _auth: AuthContext = Depends(require_mcp_scope),
+    service: ToolsService = Depends(get_service),
+):
+    access_token = payload.access_token if payload is not None else ""
+    return await _sync_modelscope_mcp_servers(access_token or "", service)
+
+
+@legacy_router.get("/tools/list")
+async def list_dashboard_tools(
+    _username: str = Depends(require_dashboard_user),
+    service: ToolsService = Depends(get_service),
+):
+    return await _run(service.get_tool_list)
+
+
+@legacy_router.post("/tools/toggle-tool")
+async def toggle_dashboard_tool(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: ToolsService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    tool_id = _required_text(body.get("name"), "name")
+    return await _toggle_tool(tool_id, bool(body.get("activate")), service)
+
+
+@legacy_router.post("/tools/permission")
+async def update_dashboard_tool_permission(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: ToolsService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    tool_id = _required_text(body.get("name"), "name")
+    return await _run(
+        lambda: service.update_tool_permission(
+            {"name": tool_id, "permission": body.get("permission")}
+        ),
+        result_as_message=True,
+    )
+
+
+@legacy_router.get("/tools/mcp/servers")
+async def list_dashboard_mcp_servers(
+    _username: str = Depends(require_dashboard_user),
+    service: ToolsService = Depends(get_service),
+):
+    return await _run(service.get_mcp_servers)
+
+
+@legacy_router.post("/tools/mcp/add")
+async def add_dashboard_mcp_server(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: ToolsService = Depends(get_service),
+):
+    return await _create_mcp_server(await _json_or_empty(request), service)
+
+
+@legacy_router.post("/tools/mcp/update")
+async def update_dashboard_mcp_server(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: ToolsService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _update_mcp_server(_server_name_from_body(body), body, service)
+
+
+@legacy_router.post("/tools/mcp/delete")
+async def delete_dashboard_mcp_server(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: ToolsService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _delete_mcp_server(_required_text(body.get("name"), "name"), service)
+
+
+@legacy_router.post("/tools/mcp/test")
+async def test_dashboard_mcp_connection(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: ToolsService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    server_name = str(body.get("name") or "")
+    config = body.get("mcp_server_config") or body.get("config") or body
+    return await _run(
+        lambda: service.test_mcp_connection(
+            {
+                "name": server_name,
+                "mcp_server_config": config,
+            }
+        ),
+        message="🎉 MCP server is available!",
+    )
+
+
+@legacy_router.post("/tools/mcp/sync-provider")
+async def sync_dashboard_mcp_provider(
+    request: Request,
+    _username: str = Depends(require_dashboard_user),
+    service: ToolsService = Depends(get_service),
+):
+    body = await _json_or_empty(request)
+    return await _run(
+        lambda: service.sync_provider(body),
+        result_as_message=True,
+    )
diff --git a/astrbot/dashboard/api/updates.py b/astrbot/dashboard/api/updates.py
new file mode 100644
index 000000000..1f2041a5b
--- /dev/null
+++ b/astrbot/dashboard/api/updates.py
@@ -0,0 +1,196 @@
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, Query, Request
+from fastapi.responses import JSONResponse
+
+from astrbot.core import logger
+from astrbot.dashboard.async_utils import run_maybe_async
+from astrbot.dashboard.schemas import MigrationRequest, PipInstallRequest, UpdateRequest
+from astrbot.dashboard.services.update_service import (
+    UpdateService,
+    UpdateServiceError,
+    UpdateServiceResult,
+)
+
+from .auth import AuthContext, require_dashboard_user, require_scope
+
+router = APIRouter(tags=["Updates"])
+legacy_router = APIRouter(
+    prefix="/api/update",
+    tags=["Dashboard Updates"],
+    include_in_schema=False,
+)
+
+
+def get_service(request: Request) -> UpdateService:
+    return request.app.state.services.updates
+
+
+async def require_system_scope(request: Request) -> AuthContext:
+    return await require_scope(request, "system")
+
+
+def _model_dict(payload) -> dict:
+    return payload.model_dump(exclude_none=True)
+
+
+def _result_payload(result: UpdateServiceResult) -> dict:
+    if result.status == "success":
+        return {
+            "status": "success",
+            "message": result.message,
+            "data": result.data,
+        }
+    return {
+        "status": "ok",
+        "message": result.message,
+        "data": {} if result.data is None else result.data,
+    }
+
+
+def _service_response(result: UpdateServiceResult) -> JSONResponse:
+    return JSONResponse(
+        _result_payload(result),
+        status_code=200,
+        headers=result.headers or None,
+    )
+
+
+def _service_error(exc: UpdateServiceError) -> JSONResponse:
+    logger.error(f"Dashboard update operation failed: {exc}", exc_info=True)
+    return JSONResponse(
+        {"status": "error", "message": "An internal error has occurred.", "data": None},
+        status_code=200,
+    )
+
+
+async def _run(operation) -> JSONResponse:
+    try:
+        result = await run_maybe_async(operation)
+        return _service_response(result)
+    except UpdateServiceError as exc:
+        return _service_error(exc)
+
+
+@router.get("/updates/check")
+async def check_updates(
+    update_type: str | None = Query(default=None, alias="type"),
+    _auth: AuthContext = Depends(require_system_scope),
+    service: UpdateService = Depends(get_service),
+):
+    return await _run(lambda: service.check_update(update_type))
+
+
+@legacy_router.get("/check")
+async def check_dashboard_updates(
+    update_type: str | None = Query(default=None, alias="type"),
+    _username: str = Depends(require_dashboard_user),
+    service: UpdateService = Depends(get_service),
+):
+    return await _run(lambda: service.check_update(update_type))
+
+
+@router.get("/updates/releases")
+async def update_releases(
+    _auth: AuthContext = Depends(require_system_scope),
+    service: UpdateService = Depends(get_service),
+):
+    return await _run(service.get_releases)
+
+
+@legacy_router.get("/releases")
+async def dashboard_update_releases(
+    _username: str = Depends(require_dashboard_user),
+    service: UpdateService = Depends(get_service),
+):
+    return await _run(service.get_releases)
+
+
+@router.get("/updates/progress/{task_id}")
+async def update_progress(
+    task_id: str,
+    _auth: AuthContext = Depends(require_system_scope),
+    service: UpdateService = Depends(get_service),
+):
+    return await _run(lambda: service.get_update_progress(task_id))
+
+
+@legacy_router.get("/progress")
+async def dashboard_update_progress(
+    progress_id: str | None = Query(default=None, alias="id"),
+    _username: str = Depends(require_dashboard_user),
+    service: UpdateService = Depends(get_service),
+):
+    return await _run(lambda: service.get_update_progress(progress_id or ""))
+
+
+@router.post("/updates/core")
+async def update_core(
+    payload: UpdateRequest,
+    _auth: AuthContext = Depends(require_system_scope),
+    service: UpdateService = Depends(get_service),
+):
+    return await _run(lambda: service.update_project(_model_dict(payload)))
+
+
+@legacy_router.post("/do")
+async def update_dashboard_core(
+    payload: UpdateRequest,
+    _username: str = Depends(require_dashboard_user),
+    service: UpdateService = Depends(get_service),
+):
+    return await _run(lambda: service.update_project(_model_dict(payload)))
+
+
+@router.post("/updates/dashboard")
+async def update_dashboard(
+    _auth: AuthContext = Depends(require_system_scope),
+    service: UpdateService = Depends(get_service),
+):
+    return await _run(service.update_dashboard)
+
+
+@legacy_router.post("/dashboard")
+async def update_dashboard_assets(
+    _username: str = Depends(require_dashboard_user),
+    service: UpdateService = Depends(get_service),
+):
+    return await _run(service.update_dashboard)
+
+
+@router.post("/pip/install")
+async def install_pip_package(
+    payload: PipInstallRequest,
+    _auth: AuthContext = Depends(require_system_scope),
+    service: UpdateService = Depends(get_service),
+):
+    return await _run(lambda: service.install_pip_package(_model_dict(payload)))
+
+
+@legacy_router.post("/pip-install")
+async def install_dashboard_pip_package(
+    payload: PipInstallRequest,
+    _username: str = Depends(require_dashboard_user),
+    service: UpdateService = Depends(get_service),
+):
+    return await _run(lambda: service.install_pip_package(_model_dict(payload)))
+
+
+@router.post("/migrations")
+async def run_migration(
+    payload: MigrationRequest | None = None,
+    _auth: AuthContext = Depends(require_system_scope),
+    service: UpdateService = Depends(get_service),
+):
+    body = _model_dict(payload) if payload is not None else {}
+    return await _run(lambda: service.do_migration_v4(body))
+
+
+@legacy_router.post("/migration")
+async def run_dashboard_migration(
+    payload: MigrationRequest | None = None,
+    _username: str = Depends(require_dashboard_user),
+    service: UpdateService = Depends(get_service),
+):
+    body = _model_dict(payload) if payload is not None else {}
+    return await _run(lambda: service.do_migration_v4(body))
diff --git a/astrbot/dashboard/asgi_runtime.py b/astrbot/dashboard/asgi_runtime.py
new file mode 100644
index 000000000..b2dbef020
--- /dev/null
+++ b/astrbot/dashboard/asgi_runtime.py
@@ -0,0 +1,711 @@
+from __future__ import annotations
+
+import contextvars
+import inspect
+import re
+from collections.abc import Callable, Iterable
+from contextlib import asynccontextmanager, contextmanager
+from pathlib import Path
+from typing import Any
+
+import httpx
+from fastapi import FastAPI, HTTPException, Request, WebSocket
+from fastapi.encoders import jsonable_encoder
+from fastapi.responses import FileResponse, JSONResponse, Response
+from starlette.datastructures import UploadFile as StarletteUploadFile
+from starlette.responses import StreamingResponse
+
+_request_var: contextvars.ContextVar[DashboardRequest] = contextvars.ContextVar(
+    "dashboard_request"
+)
+_websocket_var: contextvars.ContextVar[DashboardWebSocket] = contextvars.ContextVar(
+    "dashboard_websocket"
+)
+_g_var: contextvars.ContextVar[DashboardRequestState] = contextvars.ContextVar(
+    "dashboard_g"
+)
+_app_var: contextvars.ContextVar[FastAPIAppAdapter] = contextvars.ContextVar(
+    "dashboard_app"
+)
+
+
+class RequestArgs:
+    def __init__(self, values) -> None:
+        self._values = values
+
+    def get(self, key: str, default: Any = None, type: Callable | None = None):
+        value = self._values.get(key, default)
+        if value is default or type is None:
+            return value
+        try:
+            return type(value)
+        except (TypeError, ValueError):
+            return default
+
+
+class RequestMultiDict:
+    def __init__(self, pairs: list[tuple[str, Any]]) -> None:
+        self._pairs = pairs
+
+    def get(self, key: str, default: Any = None, type: Callable | None = None):
+        for item_key, item_value in reversed(self._pairs):
+            if item_key != key:
+                continue
+            if type is None:
+                return item_value
+            try:
+                return type(item_value)
+            except (TypeError, ValueError):
+                return default
+        return default
+
+    def getlist(self, key: str) -> list[Any]:
+        return [item_value for item_key, item_value in self._pairs if item_key == key]
+
+    def keys(self):
+        return dict.fromkeys(item_key for item_key, _ in self._pairs).keys()
+
+    def values(self):
+        return [self[key] for key in self.keys()]
+
+    def items(self):
+        return [(key, self[key]) for key in self.keys()]
+
+    def __contains__(self, key: str) -> bool:
+        return any(item_key == key for item_key, _ in self._pairs)
+
+    def __getitem__(self, key: str):
+        value = self.get(key)
+        if value is None and key not in self:
+            raise KeyError(key)
+        return value
+
+    def __bool__(self) -> bool:
+        return bool(self._pairs)
+
+
+class RequestUploadFile:
+    def __init__(self, upload_file: StarletteUploadFile) -> None:
+        self._upload_file = upload_file
+        self.filename = upload_file.filename
+        self.content_type = upload_file.content_type
+        self.headers = upload_file.headers
+        self.content_length = self._resolve_content_length()
+
+    def _resolve_content_length(self) -> int | None:
+        try:
+            raw = self.headers.get("content-length")
+            return int(raw) if raw else None
+        except (TypeError, ValueError):
+            return None
+
+    async def save(self, destination: str | Path) -> None:
+        path = Path(destination)
+        try:
+            await self._upload_file.seek(0)
+        except Exception:
+            pass
+        with path.open("wb") as output:
+            while True:
+                chunk = await self._upload_file.read(1024 * 1024)
+                if not chunk:
+                    break
+                output.write(chunk)
+
+    def __getattr__(self, key: str):
+        return getattr(self._upload_file, key)
+
+
+class DashboardRequestState:
+    def __init__(self) -> None:
+        self._values: dict[str, Any] = {}
+
+    def get(self, key: str, default: Any = None):
+        return self._values.get(key, default)
+
+    def __getattr__(self, key: str):
+        try:
+            return self._values[key]
+        except KeyError as exc:
+            raise AttributeError(key) from exc
+
+    def __setattr__(self, key: str, value: Any) -> None:
+        if key == "_values":
+            super().__setattr__(key, value)
+            return
+        self._values[key] = value
+
+
+class DashboardRequest:
+    def __init__(self, request: Request) -> None:
+        self._request = request
+        self.args = RequestArgs(request.query_params)
+        self.headers = request.headers
+        self.cookies = request.cookies
+        self.method = request.method
+        self.path = request.url.path
+        self.content_type = request.headers.get("content-type")
+        self.remote_addr = request.client.host if request.client else None
+        self._form_cache: RequestMultiDict | None = None
+        self._files_cache: RequestMultiDict | None = None
+
+    @property
+    def json(self):
+        return self.get_json()
+
+    @property
+    def files(self):
+        return self._load_files()
+
+    @property
+    def form(self):
+        return self._load_form()
+
+    async def get_json(self, silent: bool = False):
+        try:
+            return await self._request.json()
+        except Exception:
+            if silent:
+                return None
+            raise
+
+    async def _load_form_parts(self) -> None:
+        if self._form_cache is not None and self._files_cache is not None:
+            return
+        form = await self._request.form()
+        form_pairs: list[tuple[str, Any]] = []
+        file_pairs: list[tuple[str, Any]] = []
+        for key, value in form.multi_items():
+            if isinstance(value, StarletteUploadFile):
+                file_pairs.append((key, RequestUploadFile(value)))
+            else:
+                form_pairs.append((key, value))
+        self._form_cache = RequestMultiDict(form_pairs)
+        self._files_cache = RequestMultiDict(file_pairs)
+
+    async def _load_form(self) -> RequestMultiDict:
+        await self._load_form_parts()
+        assert self._form_cache is not None
+        return self._form_cache
+
+    async def _load_files(self) -> RequestMultiDict:
+        await self._load_form_parts()
+        assert self._files_cache is not None
+        return self._files_cache
+
+
+class DashboardWebSocket:
+    def __init__(self, websocket: WebSocket) -> None:
+        self._websocket = websocket
+        self.args = RequestArgs(websocket.query_params)
+        self.headers = websocket.headers
+
+    async def accept(self) -> None:
+        await self._websocket.accept()
+
+    async def receive_json(self):
+        return await self._websocket.receive_json()
+
+    async def send_json(self, payload: Any) -> None:
+        await self._websocket.send_json(payload)
+
+    async def close(self, code: int = 1000, reason: str | None = None) -> None:
+        await self._websocket.close(code=code, reason=reason or "")
+
+
+class AdapterTestHeaders:
+    def __init__(self, headers: httpx.Headers) -> None:
+        self._headers = headers
+
+    def getlist(self, key: str) -> list[str]:
+        values = self._headers.get_list(key)
+        if key.lower() == "set-cookie":
+            return [value.replace('=""', "=") for value in values]
+        return values
+
+    def get(self, key: str, default: Any = None):
+        value = self._headers.get(key, default)
+        if isinstance(value, str) and key.lower() == "set-cookie":
+            return value.replace('=""', "=")
+        return value
+
+    def __getitem__(self, key: str):
+        return self._headers[key]
+
+    def __contains__(self, key: str) -> bool:
+        return key in self._headers
+
+
+class AdapterTestResponse:
+    def __init__(self, response: httpx.Response) -> None:
+        self._response = response
+        self.status_code = response.status_code
+        self.headers = AdapterTestHeaders(response.headers)
+        self.data = response.content
+        self.content = response.content
+        self.text = response.text
+
+    async def get_json(self):
+        return self._response.json()
+
+    async def get_data(self):
+        return self._response.content
+
+
+class AdapterTestClient:
+    def __init__(self, app: FastAPI) -> None:
+        self._client = httpx.AsyncClient(
+            transport=httpx.ASGITransport(app=app),
+            base_url="http://testserver",
+        )
+
+    @staticmethod
+    def _is_file_storage(value: Any) -> bool:
+        return hasattr(value, "stream") and hasattr(value, "filename")
+
+    @classmethod
+    def _file_tuple(cls, value: Any):
+        stream = value.stream
+        if hasattr(stream, "seek"):
+            stream.seek(0)
+        content = stream.read()
+        filename = getattr(value, "filename", "upload.bin")
+        content_type = getattr(value, "content_type", None)
+        return filename, content, content_type
+
+    @classmethod
+    def _normalize_data(cls, data: Any):
+        if not isinstance(data, dict):
+            return data, None
+
+        form: dict[str, Any] = {}
+        files: list[tuple[str, tuple]] = []
+        for key, value in data.items():
+            if cls._is_file_storage(value):
+                files.append((key, cls._file_tuple(value)))
+                continue
+            if isinstance(value, Iterable) and not isinstance(
+                value, str | bytes | dict
+            ):
+                values = list(value)
+                if values and all(cls._is_file_storage(item) for item in values):
+                    files.extend((key, cls._file_tuple(item)) for item in values)
+                    continue
+            form[key] = value
+        return form, files or None
+
+    @classmethod
+    def _normalize_files(cls, files: Any):
+        if isinstance(files, dict):
+            items = files.items()
+        elif isinstance(files, Iterable) and not isinstance(files, str | bytes):
+            items = files
+        else:
+            return files
+
+        normalized_files: list[tuple[str, Any]] = []
+        for key, value in items:
+            if cls._is_file_storage(value):
+                normalized_files.append((key, cls._file_tuple(value)))
+                continue
+            if isinstance(value, Iterable) and not isinstance(
+                value, str | bytes | dict
+            ):
+                values = list(value)
+                if values and all(cls._is_file_storage(item) for item in values):
+                    normalized_files.extend(
+                        (key, cls._file_tuple(item)) for item in values
+                    )
+                    continue
+            normalized_files.append((key, value))
+        return normalized_files
+
+    async def request(self, method: str, url: str, **kwargs):
+        data = kwargs.pop("data", None)
+        if data is not None and "files" not in kwargs:
+            normalized_data, files = self._normalize_data(data)
+            kwargs["data"] = normalized_data
+            if files:
+                kwargs["files"] = files
+        elif data is not None:
+            kwargs["data"] = data
+        if "files" in kwargs:
+            kwargs["files"] = self._normalize_files(kwargs["files"])
+        response = await self._client.request(method, url, **kwargs)
+        return AdapterTestResponse(response)
+
+    async def get(self, url: str, **kwargs):
+        return await self.request("GET", url, **kwargs)
+
+    async def post(self, url: str, **kwargs):
+        return await self.request("POST", url, **kwargs)
+
+    async def put(self, url: str, **kwargs):
+        return await self.request("PUT", url, **kwargs)
+
+    async def patch(self, url: str, **kwargs):
+        return await self.request("PATCH", url, **kwargs)
+
+    async def delete(self, url: str, **kwargs):
+        return await self.request("DELETE", url, **kwargs)
+
+
+class _ContextProxy:
+    def __init__(self, var) -> None:
+        self._var = var
+
+    def __getattr__(self, key: str):
+        return getattr(self._var.get(), key)
+
+    def __setattr__(self, key: str, value: Any) -> None:
+        if key == "_var":
+            super().__setattr__(key, value)
+            return
+        setattr(self._var.get(), key, value)
+
+
+request = _ContextProxy(_request_var)
+websocket = _ContextProxy(_websocket_var)
+g = _ContextProxy(_g_var)
+current_app = _ContextProxy(_app_var)
+
+
+@contextmanager
+def bind_request_context(
+    request_: Request,
+    app: FastAPIAppAdapter,
+    g_obj: DashboardRequestState | None = None,
+):
+    token_request = _request_var.set(DashboardRequest(request_))
+    token_g = _g_var.set(
+        g_obj or getattr(request_.state, "dashboard_g", DashboardRequestState())
+    )
+    token_app = _app_var.set(app)
+    try:
+        yield _g_var.get()
+    finally:
+        _app_var.reset(token_app)
+        _g_var.reset(token_g)
+        _request_var.reset(token_request)
+
+
+@contextmanager
+def bind_websocket_context(
+    websocket_: WebSocket,
+    app: FastAPIAppAdapter,
+    g_obj: DashboardRequestState | None = None,
+):
+    token_websocket = _websocket_var.set(DashboardWebSocket(websocket_))
+    token_g = _g_var.set(
+        g_obj or getattr(websocket_.state, "dashboard_g", DashboardRequestState())
+    )
+    token_app = _app_var.set(app)
+    try:
+        yield
+    finally:
+        _app_var.reset(token_app)
+        _g_var.reset(token_g)
+        _websocket_var.reset(token_websocket)
+
+
+def jsonify(payload: Any = None):
+    return JSONResponse(payload if payload is not None else {})
+
+
+async def make_response(*args):
+    if not args:
+        return Response()
+    content = args[0]
+    status_code = args[1] if len(args) > 1 and isinstance(args[1], int) else None
+    headers = args[1] if len(args) > 1 and isinstance(args[1], dict) else None
+    if len(args) > 2 and isinstance(args[2], dict):
+        headers = args[2]
+    if isinstance(content, Response):
+        if status_code is not None:
+            content.status_code = status_code
+        if headers:
+            content.headers.update(headers)
+        return content
+    if hasattr(content, "__aiter__"):
+        return StreamingResponse(
+            content,
+            status_code=status_code or 200,
+            headers=headers,
+        )
+    return Response(
+        content=content,
+        status_code=status_code or 200,
+        headers=headers,
+    )
+
+
+async def send_file(path: str | Path, mimetype: str | None = None, **kwargs):
+    filename = kwargs.get("attachment_filename") or kwargs.get("download_name")
+    as_attachment = bool(kwargs.get("as_attachment"))
+    return FileResponse(
+        path,
+        media_type=mimetype,
+        filename=filename if as_attachment else None,
+    )
+
+
+def abort(status_code: int):
+    raise HTTPException(status_code=status_code)
+
+
+def _convert_rule(path: str) -> str:
+    converted = re.sub(r"<path:([A-Za-z_][A-Za-z0-9_]*)>", r"{\1:path}", path)
+    converted = re.sub(r"<([A-Za-z_][A-Za-z0-9_]*)>", r"{\1}", converted)
+    return converted
+
+
+async def _call_view(view_func: Callable, path_params: dict[str, Any]):
+    result = view_func(**path_params)
+    if inspect.isawaitable(result):
+        result = await result
+    return await _coerce_view_result(result)
+
+
+async def _coerce_view_result(result: Any):
+    if isinstance(result, Response):
+        return result
+    if _is_quart_response(result):
+        return await _quart_response_to_starlette(result)
+
+    if isinstance(result, tuple):
+        content = result[0] if result else None
+        status_code = next((item for item in result[1:] if isinstance(item, int)), 200)
+        headers = next(
+            (item for item in result[1:] if isinstance(item, dict)),
+            None,
+        )
+        if content is not None and isinstance(content, Response):
+            content.status_code = status_code
+            if headers:
+                content.headers.update(headers)
+            return content
+        if _is_quart_response(content):
+            return await _quart_response_to_starlette(
+                content,
+                status_code=status_code,
+                extra_headers=headers,
+            )
+        return _response_from_content(content, status_code=status_code, headers=headers)
+
+    if isinstance(result, dict | list):
+        return JSONResponse(jsonable_encoder(result))
+    return result
+
+
+def _response_from_content(
+    content: Any,
+    *,
+    status_code: int,
+    headers: dict[str, str] | None = None,
+):
+    if isinstance(content, dict | list):
+        return JSONResponse(
+            jsonable_encoder(content),
+            status_code=status_code,
+            headers=headers,
+        )
+    return Response(
+        content=content,
+        status_code=status_code,
+        headers=headers,
+    )
+
+
+def _is_quart_response(value: Any) -> bool:
+    return (
+        hasattr(value, "get_data")
+        and inspect.iscoroutinefunction(value.get_data)
+        and hasattr(value, "headers")
+        and hasattr(value, "status_code")
+    )
+
+
+def _response_header_pairs(headers: Any) -> list[tuple[str, str]]:
+    if headers is None:
+        return []
+    if hasattr(headers, "to_wsgi_list"):
+        return [(str(key), str(value)) for key, value in headers.to_wsgi_list()]
+    if hasattr(headers, "items"):
+        return [(str(key), str(value)) for key, value in headers.items()]
+    return [(str(key), str(value)) for key, value in headers]
+
+
+async def _quart_response_to_starlette(
+    quart_response: Any,
+    *,
+    status_code: int | None = None,
+    extra_headers: dict[str, str] | None = None,
+) -> Response:
+    content = await quart_response.get_data()
+    response = Response(
+        content=content,
+        status_code=status_code or int(quart_response.status_code),
+    )
+    pairs = _response_header_pairs(quart_response.headers)
+    if extra_headers:
+        pairs.extend((str(key), str(value)) for key, value in extra_headers.items())
+    response.raw_headers = [
+        (key.lower().encode("latin-1"), value.encode("latin-1")) for key, value in pairs
+    ]
+    return response
+
+
+@asynccontextmanager
+async def bind_quart_request_context(
+    request_: Request,
+    app: FastAPIAppAdapter,
+    *,
+    path: str | None = None,
+    g_obj: DashboardRequestState | None = None,
+):
+    try:
+        from quart import g as quart_g
+    except ImportError:
+        yield
+        return
+
+    quart_app = app.get_quart_compat_app()
+    headers = {
+        key.decode("latin-1"): value.decode("latin-1")
+        for key, value in request_.scope.get("headers", [])
+    }
+    body = await request_.body()
+    request_path = path or str(request_.url.path)
+    if "?" not in request_path and request_.url.query:
+        request_path = f"{request_path}?{request_.url.query}"
+
+    async with quart_app.test_request_context(
+        request_path,
+        method=request_.method,
+        headers=headers,
+        data=body,
+        scheme=request_.url.scheme,
+        root_path=request_.scope.get("root_path", ""),
+        scope_base={
+            "client": request_.scope.get("client"),
+            "server": request_.scope.get("server"),
+        },
+    ):
+        if g_obj is not None:
+            for key, value in getattr(g_obj, "_values", {}).items():
+                setattr(quart_g, key, value)
+        yield
+
+
+async def call_request_view(
+    request_: Request,
+    app: FastAPIAppAdapter,
+    view_func: Callable,
+    path_params: dict[str, Any] | None = None,
+    g_obj: DashboardRequestState | None = None,
+    quart_compat_path: str | None = None,
+):
+    with bind_request_context(request_, app, g_obj):
+        async with bind_quart_request_context(
+            request_,
+            app,
+            path=quart_compat_path,
+            g_obj=g_obj,
+        ):
+            return await _call_view(view_func, path_params or {})
+
+
+async def call_websocket_view(
+    websocket_: WebSocket,
+    app: FastAPIAppAdapter,
+    view_func: Callable,
+    path_params: dict[str, Any] | None = None,
+    *,
+    accept: bool = True,
+):
+    if accept:
+        await websocket_.accept()
+    with bind_websocket_context(websocket_, app):
+        return await _call_view(view_func, path_params or {})
+
+
+class FastAPIAppAdapter:
+    def __init__(self, app: FastAPI, static_folder: str | None = None) -> None:
+        self._app = app
+        app.state.dashboard_app_adapter = self
+        self.static_folder = static_folder
+        self._dashboard_server: Any | None = None
+        self.config: dict[str, Any] = {}
+        self.debug = False
+        self.testing = False
+        self.name = "dashboard"
+        self._quart_compat_app: Any | None = None
+
+    def get_quart_compat_app(self):
+        if self._quart_compat_app is None:
+            from quart import Quart
+
+            self._quart_compat_app = Quart("astrbot_dashboard_plugin_compat")
+            self._quart_compat_app.json.sort_keys = False
+        return self._quart_compat_app
+
+    def add_url_rule(
+        self,
+        path: str,
+        view_func: Callable,
+        methods: list[str] | None = None,
+        endpoint: str | None = None,
+    ) -> None:
+        route_path = _convert_rule(path)
+        methods = methods or ["GET"]
+
+        async def endpoint_func(request_: Request):
+            with bind_request_context(request_, self):
+                return await _call_view(view_func, dict(request_.path_params))
+
+        self._app.add_api_route(
+            route_path,
+            endpoint_func,
+            methods=methods,
+            name=endpoint,
+            include_in_schema=False,
+        )
+
+    def websocket(self, path: str):
+        route_path = _convert_rule(path)
+
+        def decorator(view_func: Callable):
+            async def endpoint_func(websocket_: WebSocket):
+                return await call_websocket_view(
+                    websocket_,
+                    self,
+                    view_func,
+                    dict(websocket_.path_params),
+                )
+
+            self._app.add_api_websocket_route(
+                route_path,
+                endpoint_func,
+                name=getattr(view_func, "__name__", None),
+            )
+            return view_func
+
+        return decorator
+
+    def errorhandler(self, _status_code: int):
+        def decorator(func: Callable):
+            return func
+
+        return decorator
+
+    async def send_static_file(self, filename: str):
+        if not self.static_folder:
+            raise HTTPException(status_code=404)
+        return FileResponse(Path(self.static_folder) / filename)
+
+    def test_client(self):
+        self.testing = True
+        return AdapterTestClient(self._app)
+
+
+AdapterResponse = Response
diff --git a/astrbot/dashboard/async_utils.py b/astrbot/dashboard/async_utils.py
new file mode 100644
index 000000000..fbad60c9c
--- /dev/null
+++ b/astrbot/dashboard/async_utils.py
@@ -0,0 +1,20 @@
+from __future__ import annotations
+
+import inspect
+from collections.abc import Awaitable, Callable
+from typing import Any, TypeVar, cast
+
+T = TypeVar("T")
+
+
+async def resolve_maybe_awaitable(value: T | Awaitable[T]) -> T:
+    while inspect.isawaitable(value):
+        value = await cast(Awaitable[T], value)
+    return cast(T, value)
+
+
+async def run_maybe_async(
+    operation: Callable[[], T | Awaitable[T]] | T | Awaitable[T],
+) -> T:
+    result: Any = operation() if callable(operation) else operation
+    return await resolve_maybe_awaitable(result)
diff --git a/astrbot/dashboard/password_state.py b/astrbot/dashboard/password_state.py
index b55c0866a..471780ef5 100644
--- a/astrbot/dashboard/password_state.py
+++ b/astrbot/dashboard/password_state.py
@@ -2,8 +2,8 @@ from astrbot.core.config.astrbot_config import AstrBotConfig
 from astrbot.core.db import BaseDatabase
 from astrbot.core.utils.auth_password import (
     hash_dashboard_password,
-    hash_legacy_dashboard_password,
-    is_legacy_dashboard_password,
+    hash_md5_dashboard_password,
+    is_md5_dashboard_password,
 )
 
 PASSWORD_STORAGE_UPGRADED_KEY = "password_storage_upgraded"
@@ -83,12 +83,12 @@ def get_dashboard_password_hash(config: AstrBotConfig, *, upgraded: bool) -> str
     if upgraded and _has_usable_pbkdf2_password(config):
         return config["dashboard"].get("pbkdf2_password", "")
 
-    legacy_password = config["dashboard"].get("password", "")
-    if upgraded and not is_legacy_dashboard_password(legacy_password):
+    md5_password = config["dashboard"].get("password", "")
+    if upgraded and not is_md5_dashboard_password(md5_password):
         return ""
-    return legacy_password
+    return md5_password
 
 
 def set_dashboard_password_hashes(config: AstrBotConfig, raw_password: str) -> None:
     config["dashboard"]["pbkdf2_password"] = hash_dashboard_password(raw_password)
-    config["dashboard"]["password"] = hash_legacy_dashboard_password(raw_password)
+    config["dashboard"]["password"] = hash_md5_dashboard_password(raw_password)
diff --git a/astrbot/dashboard/plugin_page_auth.py b/astrbot/dashboard/plugin_page_auth.py
index f2571b3ee..cb60df1a9 100644
--- a/astrbot/dashboard/plugin_page_auth.py
+++ b/astrbot/dashboard/plugin_page_auth.py
@@ -1,7 +1,5 @@
 from urllib.parse import unquote
 
-from quart import request
-
 PLUGIN_PAGE_CONTENT_PREFIX = "/api/plugin/page/content/"
 PLUGIN_PAGE_BRIDGE_PATH = "/api/plugin/page/bridge-sdk.js"
 PLUGIN_PAGE_TOKEN_TYPE = "plugin_page_asset"
@@ -19,8 +17,8 @@ class PluginPageAuth:
         return payload.get("token_type") == PLUGIN_PAGE_TOKEN_TYPE
 
     @staticmethod
-    def extract_asset_token() -> str | None:
-        query_asset_token = request.args.get("asset_token", "").strip()
+    def extract_asset_token(query_params) -> str | None:
+        query_asset_token = query_params.get("asset_token", "").strip()
         return query_asset_token or None
 
     @staticmethod
diff --git a/astrbot/dashboard/plugin_page_bridge.js b/astrbot/dashboard/plugin_page_bridge.js
index 650e30e44..f1ecc198d 100644
--- a/astrbot/dashboard/plugin_page_bridge.js
+++ b/astrbot/dashboard/plugin_page_bridge.js
@@ -40,7 +40,7 @@
     return origin === SELF_ORIGIN;
   }
 
-  function send(kind, payload) {
+  function send(kind, payload, transfer) {
     window.parent.postMessage(
       {
         channel: CHANNEL,
@@ -48,19 +48,24 @@
         ...(payload || {}),
       },
       getTargetOrigin(),
+      transfer || [],
     );
   }
 
-  function makeRequest(action, payload) {
+  function makeRequest(action, payload, transfer) {
     return new Promise((resolve, reject) => {
       requestCounter += 1;
       const requestId = `plugin_req_${requestCounter}`;
       pendingRequests.set(requestId, { resolve, reject });
-      send("request", {
-        requestId,
-        action,
-        ...(payload || {}),
-      });
+      send(
+        "request",
+        {
+          requestId,
+          action,
+          ...(payload || {}),
+        },
+        transfer,
+      );
     });
   }
 
@@ -181,6 +186,7 @@
         handlers.onMessage({
           raw: message.data,
           parsed: parseMaybeJson(message.data),
+          eventType: message.eventType || "message",
           lastEventId: message.lastEventId,
         });
       }
@@ -235,12 +241,23 @@
     apiPost(endpoint, body) {
       return makeRequest("api:post", { endpoint, body });
     },
-    upload(endpoint, file) {
-      return makeRequest("files:upload", {
-        endpoint,
-        file,
-        fileName: file?.name || "upload.bin",
-      });
+    async upload(endpoint, file) {
+      if (!file || typeof file.arrayBuffer !== "function") {
+        throw new Error("Missing uploaded file payload.");
+      }
+      const fileBuffer = await file.arrayBuffer();
+      return makeRequest(
+        "files:upload",
+        {
+          endpoint,
+          fileName: file?.name || "upload.bin",
+          fileType: file?.type || "application/octet-stream",
+          fileLastModified:
+            typeof file?.lastModified === "number" ? file.lastModified : null,
+          fileBuffer,
+        },
+        [fileBuffer],
+      );
     },
     download(endpoint, params, filename) {
       return makeRequest("files:download", { endpoint, params, filename });
diff --git a/astrbot/dashboard/responses.py b/astrbot/dashboard/responses.py
new file mode 100644
index 000000000..7eea77383
--- /dev/null
+++ b/astrbot/dashboard/responses.py
@@ -0,0 +1,22 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any
+
+
+@dataclass
+class ApiError(Exception):
+    message: str
+    status_code: int = 400
+    data: Any = None
+
+
+def ok(data: Any = None, message: str | None = None) -> dict[str, Any]:
+    return {"status": "ok", "message": message, "data": {} if data is None else data}
+
+
+def error(message: str, data: Any = None) -> dict[str, Any]:
+    payload: dict[str, Any] = {"status": "error", "message": message}
+    if data is not None:
+        payload["data"] = data
+    return payload
diff --git a/astrbot/dashboard/routes/__init__.py b/astrbot/dashboard/routes/__init__.py
deleted file mode 100644
index fbbd0c7a0..000000000
--- a/astrbot/dashboard/routes/__init__.py
+++ /dev/null
@@ -1,49 +0,0 @@
-from .api_key import ApiKeyRoute
-from .auth import AuthRoute
-from .backup import BackupRoute
-from .chat import ChatRoute
-from .chatui_project import ChatUIProjectRoute
-from .command import CommandRoute
-from .config import ConfigRoute
-from .conversation import ConversationRoute
-from .cron import CronRoute
-from .file import FileRoute
-from .knowledge_base import KnowledgeBaseRoute
-from .log import LogRoute
-from .open_api import OpenApiRoute
-from .persona import PersonaRoute
-from .platform import PlatformRoute
-from .plugin import PluginRoute
-from .session_management import SessionManagementRoute
-from .skills import SkillsRoute
-from .stat import StatRoute
-from .static_file import StaticFileRoute
-from .subagent import SubAgentRoute
-from .tools import ToolsRoute
-from .update import UpdateRoute
-
-__all__ = [
-    "ApiKeyRoute",
-    "AuthRoute",
-    "BackupRoute",
-    "ChatRoute",
-    "ChatUIProjectRoute",
-    "CommandRoute",
-    "ConfigRoute",
-    "ConversationRoute",
-    "CronRoute",
-    "FileRoute",
-    "KnowledgeBaseRoute",
-    "LogRoute",
-    "OpenApiRoute",
-    "PersonaRoute",
-    "PlatformRoute",
-    "PluginRoute",
-    "SessionManagementRoute",
-    "StatRoute",
-    "StaticFileRoute",
-    "SubAgentRoute",
-    "ToolsRoute",
-    "SkillsRoute",
-    "UpdateRoute",
-]
diff --git a/astrbot/dashboard/routes/api_key.py b/astrbot/dashboard/routes/api_key.py
deleted file mode 100644
index 4b957fe8e..000000000
--- a/astrbot/dashboard/routes/api_key.py
+++ /dev/null
@@ -1,143 +0,0 @@
-import hashlib
-import secrets
-from datetime import datetime, timedelta, timezone
-
-from quart import g, request
-
-from astrbot.core.db import BaseDatabase
-from astrbot.core.utils.datetime_utils import normalize_datetime_utc
-
-from .route import Response, Route, RouteContext
-
-ALL_OPEN_API_SCOPES = ("chat", "config", "file", "im")
-
-
-class ApiKeyRoute(Route):
-    def __init__(self, context: RouteContext, db: BaseDatabase) -> None:
-        super().__init__(context)
-        self.db = db
-        self.routes = {
-            "/apikey/list": ("GET", self.list_api_keys),
-            "/apikey/create": ("POST", self.create_api_key),
-            "/apikey/revoke": ("POST", self.revoke_api_key),
-            "/apikey/delete": ("POST", self.delete_api_key),
-        }
-        self.register_routes()
-
-    @staticmethod
-    def _normalize_utc(dt: datetime | None) -> datetime | None:
-        return normalize_datetime_utc(dt)
-
-    @classmethod
-    def _serialize_datetime(cls, dt: datetime | None) -> str | None:
-        normalized = cls._normalize_utc(dt)
-        if normalized is None:
-            return None
-        return normalized.astimezone().isoformat()
-
-    @staticmethod
-    def _hash_key(raw_key: str) -> str:
-        return hashlib.pbkdf2_hmac(
-            "sha256",
-            raw_key.encode("utf-8"),
-            b"astrbot_api_key",
-            100_000,
-        ).hex()
-
-    @staticmethod
-    def _serialize_api_key(key) -> dict:
-        expires_at = ApiKeyRoute._normalize_utc(key.expires_at)
-        return {
-            "key_id": key.key_id,
-            "name": key.name,
-            "key_prefix": key.key_prefix,
-            "scopes": key.scopes or [],
-            "created_by": key.created_by,
-            "created_at": ApiKeyRoute._serialize_datetime(key.created_at),
-            "updated_at": ApiKeyRoute._serialize_datetime(key.updated_at),
-            "last_used_at": ApiKeyRoute._serialize_datetime(key.last_used_at),
-            "expires_at": ApiKeyRoute._serialize_datetime(key.expires_at),
-            "revoked_at": ApiKeyRoute._serialize_datetime(key.revoked_at),
-            "is_revoked": key.revoked_at is not None,
-            "is_expired": bool(expires_at and expires_at < datetime.now(timezone.utc)),
-        }
-
-    async def list_api_keys(self):
-        keys = await self.db.list_api_keys()
-        return (
-            Response().ok(data=[self._serialize_api_key(key) for key in keys]).__dict__
-        )
-
-    async def create_api_key(self):
-        post_data = await request.json or {}
-
-        name = str(post_data.get("name", "")).strip() or "Untitled API Key"
-        scopes = post_data.get("scopes")
-        if scopes is None:
-            normalized_scopes = list(ALL_OPEN_API_SCOPES)
-        elif isinstance(scopes, list):
-            normalized_scopes = [
-                scope
-                for scope in scopes
-                if isinstance(scope, str) and scope in ALL_OPEN_API_SCOPES
-            ]
-            normalized_scopes = list(dict.fromkeys(normalized_scopes))
-            if not normalized_scopes:
-                return Response().error("At least one valid scope is required").__dict__
-        else:
-            return Response().error("Invalid scopes").__dict__
-
-        expires_at = None
-        expires_in_days = post_data.get("expires_in_days")
-        if expires_in_days is not None:
-            try:
-                expires_in_days_int = int(expires_in_days)
-            except (TypeError, ValueError):
-                return Response().error("expires_in_days must be an integer").__dict__
-            if expires_in_days_int <= 0:
-                return (
-                    Response().error("expires_in_days must be greater than 0").__dict__
-                )
-            expires_at = datetime.now(timezone.utc) + timedelta(
-                days=expires_in_days_int
-            )
-
-        raw_key = f"abk_{secrets.token_urlsafe(32)}"
-        key_hash = self._hash_key(raw_key)
-        key_prefix = raw_key[:12]
-        created_by = g.get("username", "unknown")
-
-        api_key = await self.db.create_api_key(
-            name=name,
-            key_hash=key_hash,
-            key_prefix=key_prefix,
-            scopes=normalized_scopes,  # type: ignore
-            created_by=created_by,
-            expires_at=expires_at,
-        )
-
-        payload = self._serialize_api_key(api_key)
-        payload["api_key"] = raw_key
-        return Response().ok(data=payload).__dict__
-
-    async def revoke_api_key(self):
-        post_data = await request.json or {}
-        key_id = post_data.get("key_id")
-        if not key_id:
-            return Response().error("Missing key: key_id").__dict__
-
-        success = await self.db.revoke_api_key(key_id)
-        if not success:
-            return Response().error("API key not found").__dict__
-        return Response().ok().__dict__
-
-    async def delete_api_key(self):
-        post_data = await request.json or {}
-        key_id = post_data.get("key_id")
-        if not key_id:
-            return Response().error("Missing key: key_id").__dict__
-
-        success = await self.db.delete_api_key(key_id)
-        if not success:
-            return Response().error("API key not found").__dict__
-        return Response().ok().__dict__
diff --git a/astrbot/dashboard/routes/backup.py b/astrbot/dashboard/routes/backup.py
deleted file mode 100644
index ecc5dbfc8..000000000
--- a/astrbot/dashboard/routes/backup.py
+++ /dev/null
@@ -1,1106 +0,0 @@
-"""备份管理 API 路由"""
-
-import asyncio
-import json
-import os
-import re
-import shutil
-import time
-import traceback
-import uuid
-import zipfile
-from datetime import datetime
-from pathlib import Path
-
-import jwt
-from quart import request, send_file
-
-from astrbot.core import logger
-from astrbot.core.backup.exporter import AstrBotExporter
-from astrbot.core.backup.importer import AstrBotImporter
-from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
-from astrbot.core.db import BaseDatabase
-from astrbot.core.utils.astrbot_path import (
-    get_astrbot_backups_path,
-    get_astrbot_data_path,
-)
-
-from .route import Response, Route, RouteContext
-
-# 分片上传常量
-CHUNK_SIZE = 1024 * 1024  # 1MB
-UPLOAD_EXPIRE_SECONDS = 3600  # 上传会话过期时间（1小时）
-
-
-def secure_filename(filename: str) -> str:
-    """清洗文件名，移除路径遍历字符和危险字符
-
-    Args:
-        filename: 原始文件名
-
-    Returns:
-        安全的文件名
-    """
-    # 跨平台处理：先将反斜杠替换为正斜杠，再取文件名
-    filename = filename.replace("\\", "/")
-    # 仅保留文件名部分，移除路径
-    filename = os.path.basename(filename)
-
-    # 替换路径遍历字符
-    filename = filename.replace("..", "_")
-
-    # 仅保留字母、数字、下划线、连字符、点
-    filename = re.sub(r"[^\w\-.]", "_", filename)
-
-    # 移除前导点（隐藏文件）和尾部点
-    filename = filename.strip(".")
-
-    # 如果文件名为空或只包含下划线，生成一个默认名称
-    if not filename or filename.replace("_", "") == "":
-        filename = "backup"
-
-    return filename
-
-
-def generate_unique_filename(original_filename: str) -> str:
-    """生成唯一的文件名，在原文件名后添加时间戳后缀避免重名
-
-    Args:
-        original_filename: 原始文件名（已清洗）
-
-    Returns:
-        添加了时间戳后缀的唯一文件名，格式为 {原文件名}_{YYYYMMDD_HHMMSS}.{扩展名}
-    """
-    name, ext = os.path.splitext(original_filename)
-    timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
-    return f"{name}_{timestamp}{ext}"
-
-
-class BackupRoute(Route):
-    """备份管理路由
-
-    提供备份导出、导入、列表等 API 接口
-    """
-
-    def __init__(
-        self,
-        context: RouteContext,
-        db: BaseDatabase,
-        core_lifecycle: AstrBotCoreLifecycle,
-    ) -> None:
-        super().__init__(context)
-        self.db = db
-        self.core_lifecycle = core_lifecycle
-        self.backup_dir = get_astrbot_backups_path()
-        self.data_dir = get_astrbot_data_path()
-        self.chunks_dir = os.path.join(self.backup_dir, ".chunks")
-
-        # 任务状态跟踪
-        self.backup_tasks: dict[str, dict] = {}
-        self.backup_progress: dict[str, dict] = {}
-
-        # 分片上传会话跟踪
-        # upload_id -> {filename, total_chunks, received_chunks, last_activity, chunk_dir}
-        self.upload_sessions: dict[str, dict] = {}
-
-        # 后台清理任务句柄
-        self._cleanup_task: asyncio.Task | None = None
-
-        # 注册路由
-        self.routes = {
-            "/backup/list": ("GET", self.list_backups),
-            "/backup/export": ("POST", self.export_backup),
-            "/backup/upload": ("POST", self.upload_backup),  # 上传文件（兼容小文件）
-            "/backup/upload/init": ("POST", self.upload_init),  # 分片上传初始化
-            "/backup/upload/chunk": ("POST", self.upload_chunk),  # 上传分片
-            "/backup/upload/complete": ("POST", self.upload_complete),  # 完成分片上传
-            "/backup/upload/abort": ("POST", self.upload_abort),  # 取消上传
-            "/backup/check": ("POST", self.check_backup),  # 预检查
-            "/backup/import": ("POST", self.import_backup),  # 确认导入
-            "/backup/progress": ("GET", self.get_progress),
-            "/backup/download": ("GET", self.download_backup),
-            "/backup/delete": ("POST", self.delete_backup),
-            "/backup/rename": ("POST", self.rename_backup),  # 重命名备份
-        }
-        self.register_routes()
-
-    def _init_task(self, task_id: str, task_type: str, status: str = "pending") -> None:
-        """初始化任务状态"""
-        self.backup_tasks[task_id] = {
-            "type": task_type,
-            "status": status,
-            "result": None,
-            "error": None,
-        }
-        self.backup_progress[task_id] = {
-            "status": status,
-            "stage": "waiting",
-            "current": 0,
-            "total": 100,
-            "message": "",
-        }
-
-    def _set_task_result(
-        self,
-        task_id: str,
-        status: str,
-        result: dict | None = None,
-        error: str | None = None,
-    ) -> None:
-        """设置任务结果"""
-        if task_id in self.backup_tasks:
-            self.backup_tasks[task_id]["status"] = status
-            self.backup_tasks[task_id]["result"] = result
-            self.backup_tasks[task_id]["error"] = error
-        if task_id in self.backup_progress:
-            self.backup_progress[task_id]["status"] = status
-
-    def _update_progress(
-        self,
-        task_id: str,
-        *,
-        status: str | None = None,
-        stage: str | None = None,
-        current: int | None = None,
-        total: int | None = None,
-        message: str | None = None,
-    ) -> None:
-        """更新任务进度"""
-        if task_id not in self.backup_progress:
-            return
-        p = self.backup_progress[task_id]
-        if status is not None:
-            p["status"] = status
-        if stage is not None:
-            p["stage"] = stage
-        if current is not None:
-            p["current"] = current
-        if total is not None:
-            p["total"] = total
-        if message is not None:
-            p["message"] = message
-
-    def _make_progress_callback(self, task_id: str):
-        """创建进度回调函数"""
-
-        async def _callback(
-            stage: str, current: int, total: int, message: str = ""
-        ) -> None:
-            self._update_progress(
-                task_id,
-                status="processing",
-                stage=stage,
-                current=current,
-                total=total,
-                message=message,
-            )
-
-        return _callback
-
-    def _ensure_cleanup_task_started(self) -> None:
-        """确保后台清理任务已启动（在异步上下文中延迟启动）"""
-        if self._cleanup_task is None or self._cleanup_task.done():
-            try:
-                self._cleanup_task = asyncio.create_task(
-                    self._cleanup_expired_uploads()
-                )
-            except RuntimeError:
-                # 如果没有运行中的事件循环，跳过（等待下次异步调用时启动）
-                pass
-
-    async def _cleanup_expired_uploads(self) -> None:
-        """定期清理过期的上传会话
-
-        基于 last_activity 字段判断过期，避免清理活跃的上传会话。
-        """
-        while True:
-            try:
-                await asyncio.sleep(300)  # 每5分钟检查一次
-                current_time = time.time()
-                expired_sessions = []
-
-                for upload_id, session in self.upload_sessions.items():
-                    # 使用 last_activity 判断过期，而非 created_at
-                    last_activity = session.get("last_activity", session["created_at"])
-                    if current_time - last_activity > UPLOAD_EXPIRE_SECONDS:
-                        expired_sessions.append(upload_id)
-
-                for upload_id in expired_sessions:
-                    await self._cleanup_upload_session(upload_id)
-                    logger.info(f"清理过期的上传会话: {upload_id}")
-
-            except asyncio.CancelledError:
-                # 任务被取消，正常退出
-                break
-            except Exception as e:
-                logger.error(f"清理过期上传会话失败: {e}")
-
-    async def _cleanup_upload_session(self, upload_id: str) -> None:
-        """清理上传会话"""
-        if upload_id in self.upload_sessions:
-            session = self.upload_sessions[upload_id]
-            chunk_dir = session.get("chunk_dir")
-            if chunk_dir and os.path.exists(chunk_dir):
-                try:
-                    shutil.rmtree(chunk_dir)
-                except Exception as e:
-                    logger.warning(f"清理分片目录失败: {e}")
-            del self.upload_sessions[upload_id]
-
-    def _get_backup_manifest(self, zip_path: str) -> dict | None:
-        """从备份文件读取 manifest.json
-
-        Args:
-            zip_path: ZIP 文件路径
-
-        Returns:
-            dict | None: manifest 内容，如果不是有效备份则返回 None
-        """
-        try:
-            with zipfile.ZipFile(zip_path, "r") as zf:
-                if "manifest.json" in zf.namelist():
-                    manifest_data = zf.read("manifest.json")
-                    return json.loads(manifest_data.decode("utf-8"))
-                else:
-                    # 没有 manifest.json，不是有效的 AstrBot 备份
-                    return None
-        except Exception as e:
-            logger.debug(f"读取备份 manifest 失败: {e}")
-        return None  # 无法读取，不是有效备份
-
-    async def list_backups(self):
-        # 确保后台清理任务已启动
-        self._ensure_cleanup_task_started()
-
-        """获取备份列表
-
-        Query 参数:
-        - page: 页码 (默认 1)
-        - page_size: 每页数量 (默认 20)
-        """
-        try:
-            page = request.args.get("page", 1, type=int)
-            page_size = request.args.get("page_size", 20, type=int)
-
-            # 确保备份目录存在
-            Path(self.backup_dir).mkdir(parents=True, exist_ok=True)
-
-            # 获取所有备份文件
-            backup_files = []
-            for filename in os.listdir(self.backup_dir):
-                # 只处理 .zip 文件，排除隐藏文件和目录
-                if not filename.endswith(".zip") or filename.startswith("."):
-                    continue
-
-                file_path = os.path.join(self.backup_dir, filename)
-                if not os.path.isfile(file_path):
-                    continue
-
-                # 读取 manifest.json 获取备份信息
-                # 如果返回 None，说明不是有效的 AstrBot 备份，跳过
-                manifest = self._get_backup_manifest(file_path)
-                if manifest is None:
-                    logger.debug(f"跳过无效备份文件: {filename}")
-                    continue
-
-                stat = os.stat(file_path)
-                backup_files.append(
-                    {
-                        "filename": filename,
-                        "size": stat.st_size,
-                        "created_at": stat.st_mtime,
-                        "type": manifest.get(
-                            "origin", "exported"
-                        ),  # 老版本没有 origin 默认为 exported
-                        "astrbot_version": manifest.get("astrbot_version", "未知"),
-                        "exported_at": manifest.get("exported_at"),
-                    }
-                )
-
-            # 按创建时间倒序排序
-            backup_files.sort(key=lambda x: x["created_at"], reverse=True)
-
-            # 分页
-            start = (page - 1) * page_size
-            end = start + page_size
-            items = backup_files[start:end]
-
-            return (
-                Response()
-                .ok(
-                    {
-                        "items": items,
-                        "total": len(backup_files),
-                        "page": page,
-                        "page_size": page_size,
-                    }
-                )
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(f"获取备份列表失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"获取备份列表失败: {e!s}").__dict__
-
-    async def export_backup(self):
-        """创建备份
-
-        返回:
-        - task_id: 任务ID，用于查询导出进度
-        """
-        try:
-            # 生成任务ID
-            task_id = str(uuid.uuid4())
-
-            # 初始化任务状态
-            self._init_task(task_id, "export", "pending")
-
-            # 启动后台导出任务
-            asyncio.create_task(self._background_export_task(task_id))
-
-            return (
-                Response()
-                .ok(
-                    {
-                        "task_id": task_id,
-                        "message": "export task created, processing in background",
-                    }
-                )
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(f"创建备份失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"创建备份失败: {e!s}").__dict__
-
-    async def _background_export_task(self, task_id: str) -> None:
-        """后台导出任务"""
-        try:
-            self._update_progress(task_id, status="processing", message="正在初始化...")
-
-            # 获取知识库管理器
-            kb_manager = getattr(self.core_lifecycle, "kb_manager", None)
-
-            exporter = AstrBotExporter(
-                main_db=self.db,
-                kb_manager=kb_manager,
-                config_path=os.path.join(self.data_dir, "cmd_config.json"),
-            )
-
-            # 创建进度回调
-            progress_callback = self._make_progress_callback(task_id)
-
-            # 执行导出
-            zip_path = await exporter.export_all(
-                output_dir=self.backup_dir,
-                progress_callback=progress_callback,
-            )
-
-            # 设置成功结果
-            self._set_task_result(
-                task_id,
-                "completed",
-                result={
-                    "filename": os.path.basename(zip_path),
-                    "path": zip_path,
-                    "size": os.path.getsize(zip_path),
-                },
-            )
-        except Exception as e:
-            logger.error(f"后台导出任务 {task_id} 失败: {e}")
-            logger.error(traceback.format_exc())
-            self._set_task_result(task_id, "failed", error=str(e))
-
-    async def upload_backup(self):
-        """上传备份文件
-
-        将备份文件上传到服务器，返回保存的文件名。
-        上传后应调用 check_backup 进行预检查。
-
-        Form Data:
-        - file: 备份文件 (.zip)
-
-        返回:
-        - filename: 保存的文件名
-        """
-        try:
-            files = await request.files
-            if "file" not in files:
-                return Response().error("缺少备份文件").__dict__
-
-            file = files["file"]
-            if not file.filename or not file.filename.endswith(".zip"):
-                return Response().error("请上传 ZIP 格式的备份文件").__dict__
-
-            # 清洗文件名并生成唯一名称，防止路径遍历和覆盖
-            safe_filename = secure_filename(file.filename)
-            unique_filename = generate_unique_filename(safe_filename)
-
-            # 保存上传的文件
-            Path(self.backup_dir).mkdir(parents=True, exist_ok=True)
-            zip_path = os.path.join(self.backup_dir, unique_filename)
-            await file.save(zip_path)
-
-            logger.info(
-                f"上传的备份文件已保存: {unique_filename} (原始名称: {file.filename})"
-            )
-
-            return (
-                Response()
-                .ok(
-                    {
-                        "filename": unique_filename,
-                        "original_filename": file.filename,
-                        "size": os.path.getsize(zip_path),
-                    }
-                )
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(f"上传备份文件失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"上传备份文件失败: {e!s}").__dict__
-
-    async def upload_init(self):
-        """初始化分片上传
-
-        创建一个上传会话，返回 upload_id 供后续分片上传使用。
-
-        JSON Body:
-        - filename: 原始文件名
-        - total_size: 文件总大小（字节）
-
-        返回:
-        - upload_id: 上传会话 ID
-        - chunk_size: 分片大小（由后端决定）
-        - total_chunks: 分片总数（由后端根据 total_size 和 chunk_size 计算）
-        """
-        try:
-            data = await request.json
-            filename = data.get("filename")
-            total_size = data.get("total_size", 0)
-
-            if not filename:
-                return Response().error("缺少 filename 参数").__dict__
-
-            if not filename.endswith(".zip"):
-                return Response().error("请上传 ZIP 格式的备份文件").__dict__
-
-            if total_size <= 0:
-                return Response().error("无效的文件大小").__dict__
-
-            # 由后端计算分片总数，确保前后端一致
-            import math
-
-            total_chunks = math.ceil(total_size / CHUNK_SIZE)
-
-            # 生成上传 ID
-            upload_id = str(uuid.uuid4())
-
-            # 创建分片存储目录
-            chunk_dir = os.path.join(self.chunks_dir, upload_id)
-            Path(chunk_dir).mkdir(parents=True, exist_ok=True)
-
-            # 清洗文件名
-            safe_filename = secure_filename(filename)
-            unique_filename = generate_unique_filename(safe_filename)
-
-            # 创建上传会话
-            current_time = time.time()
-            self.upload_sessions[upload_id] = {
-                "filename": unique_filename,
-                "original_filename": filename,
-                "total_size": total_size,
-                "total_chunks": total_chunks,
-                "received_chunks": set(),
-                "created_at": current_time,
-                "last_activity": current_time,  # 用于判断会话是否活跃
-                "chunk_dir": chunk_dir,
-            }
-
-            logger.info(
-                f"初始化分片上传: upload_id={upload_id}, "
-                f"filename={unique_filename}, total_chunks={total_chunks}"
-            )
-
-            return (
-                Response()
-                .ok(
-                    {
-                        "upload_id": upload_id,
-                        "chunk_size": CHUNK_SIZE,
-                        "total_chunks": total_chunks,
-                        "filename": unique_filename,
-                    }
-                )
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(f"初始化分片上传失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"初始化分片上传失败: {e!s}").__dict__
-
-    async def upload_chunk(self):
-        """上传分片
-
-        上传单个分片数据。
-
-        Form Data:
-        - upload_id: 上传会话 ID
-        - chunk_index: 分片索引（从 0 开始）
-        - chunk: 分片数据
-
-        返回:
-        - received: 已接收的分片数量
-        - total: 分片总数
-        """
-        try:
-            form = await request.form
-            files = await request.files
-
-            upload_id = form.get("upload_id")
-            chunk_index_str = form.get("chunk_index")
-
-            if not upload_id or chunk_index_str is None:
-                return Response().error("缺少必要参数").__dict__
-
-            try:
-                chunk_index = int(chunk_index_str)
-            except ValueError:
-                return Response().error("无效的分片索引").__dict__
-
-            if "chunk" not in files:
-                return Response().error("缺少分片数据").__dict__
-
-            # 验证上传会话
-            if upload_id not in self.upload_sessions:
-                return Response().error("上传会话不存在或已过期").__dict__
-
-            session = self.upload_sessions[upload_id]
-
-            # 验证分片索引
-            if chunk_index < 0 or chunk_index >= session["total_chunks"]:
-                return Response().error("分片索引超出范围").__dict__
-
-            # 保存分片
-            chunk_file = files["chunk"]
-            chunk_path = os.path.join(session["chunk_dir"], f"{chunk_index}.part")
-            await chunk_file.save(chunk_path)
-
-            # 记录已接收的分片，并更新最后活动时间
-            session["received_chunks"].add(chunk_index)
-            session["last_activity"] = time.time()  # 刷新活动时间，防止活跃上传被清理
-
-            received_count = len(session["received_chunks"])
-            total_chunks = session["total_chunks"]
-
-            logger.debug(
-                f"接收分片: upload_id={upload_id}, "
-                f"chunk={chunk_index + 1}/{total_chunks}"
-            )
-
-            return (
-                Response()
-                .ok(
-                    {
-                        "received": received_count,
-                        "total": total_chunks,
-                        "chunk_index": chunk_index,
-                    }
-                )
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(f"上传分片失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"上传分片失败: {e!s}").__dict__
-
-    def _mark_backup_as_uploaded(self, zip_path: str) -> None:
-        """修改备份文件的 manifest.json，将 origin 设置为 uploaded
-
-        使用 zipfile 的 append 模式添加新的 manifest.json，
-        ZIP 规范中后添加的同名文件会覆盖先前的文件。
-
-        Args:
-            zip_path: ZIP 文件路径
-        """
-        try:
-            # 读取原有 manifest
-            manifest = {"origin": "uploaded", "uploaded_at": datetime.now().isoformat()}
-            with zipfile.ZipFile(zip_path, "r") as zf:
-                if "manifest.json" in zf.namelist():
-                    manifest_data = zf.read("manifest.json")
-                    manifest = json.loads(manifest_data.decode("utf-8"))
-                    manifest["origin"] = "uploaded"
-                    manifest["uploaded_at"] = datetime.now().isoformat()
-
-            # 使用 append 模式添加新的 manifest.json
-            # ZIP 规范中，后添加的同名文件会覆盖先前的
-            with zipfile.ZipFile(zip_path, "a") as zf:
-                new_manifest = json.dumps(manifest, ensure_ascii=False, indent=2)
-                zf.writestr("manifest.json", new_manifest)
-
-            logger.debug(f"已标记备份为上传来源: {zip_path}")
-        except Exception as e:
-            logger.warning(f"标记备份来源失败: {e}")
-
-    async def upload_complete(self):
-        """完成分片上传
-
-        合并所有分片为完整文件。
-
-        JSON Body:
-        - upload_id: 上传会话 ID
-
-        返回:
-        - filename: 合并后的文件名
-        - size: 文件大小
-        """
-        try:
-            data = await request.json
-            upload_id = data.get("upload_id")
-
-            if not upload_id:
-                return Response().error("缺少 upload_id 参数").__dict__
-
-            # 验证上传会话
-            if upload_id not in self.upload_sessions:
-                return Response().error("上传会话不存在或已过期").__dict__
-
-            session = self.upload_sessions[upload_id]
-
-            # 检查是否所有分片都已接收
-            received = session["received_chunks"]
-            total = session["total_chunks"]
-
-            if len(received) != total:
-                missing = set(range(total)) - received
-                return (
-                    Response()
-                    .error(f"分片不完整，缺少: {sorted(missing)[:10]}...")
-                    .__dict__
-                )
-
-            # 合并分片
-            chunk_dir = session["chunk_dir"]
-            filename = session["filename"]
-
-            Path(self.backup_dir).mkdir(parents=True, exist_ok=True)
-            output_path = os.path.join(self.backup_dir, filename)
-
-            try:
-                with open(output_path, "wb") as outfile:
-                    for i in range(total):
-                        chunk_path = os.path.join(chunk_dir, f"{i}.part")
-                        with open(chunk_path, "rb") as chunk_file:
-                            # 分块读取，避免内存溢出
-                            while True:
-                                data_block = chunk_file.read(8192)
-                                if not data_block:
-                                    break
-                                outfile.write(data_block)
-
-                file_size = os.path.getsize(output_path)
-
-                # 标记备份为上传来源（修改 manifest.json 中的 origin 字段）
-                self._mark_backup_as_uploaded(output_path)
-
-                logger.info(
-                    f"分片上传完成: {filename}, size={file_size}, chunks={total}"
-                )
-
-                # 清理分片目录
-                await self._cleanup_upload_session(upload_id)
-
-                return (
-                    Response()
-                    .ok(
-                        {
-                            "filename": filename,
-                            "original_filename": session["original_filename"],
-                            "size": file_size,
-                        }
-                    )
-                    .__dict__
-                )
-            except Exception as e:
-                # 如果合并失败，删除不完整的文件
-                if os.path.exists(output_path):
-                    os.remove(output_path)
-                raise e
-
-        except Exception as e:
-            logger.error(f"完成分片上传失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"完成分片上传失败: {e!s}").__dict__
-
-    async def upload_abort(self):
-        """取消分片上传
-
-        取消上传并清理已上传的分片。
-
-        JSON Body:
-        - upload_id: 上传会话 ID
-        """
-        try:
-            data = await request.json
-            upload_id = data.get("upload_id")
-
-            if not upload_id:
-                return Response().error("缺少 upload_id 参数").__dict__
-
-            if upload_id not in self.upload_sessions:
-                # 会话已不存在，可能已过期或已完成
-                return Response().ok(message="上传已取消").__dict__
-
-            # 清理会话
-            await self._cleanup_upload_session(upload_id)
-
-            logger.info(f"取消分片上传: {upload_id}")
-
-            return Response().ok(message="上传已取消").__dict__
-        except Exception as e:
-            logger.error(f"取消上传失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"取消上传失败: {e!s}").__dict__
-
-    async def check_backup(self):
-        """预检查备份文件
-
-        检查备份文件的版本兼容性，返回确认信息。
-        用户确认后调用 import_backup 执行导入。
-
-        JSON Body:
-        - filename: 已上传的备份文件名
-
-        返回:
-        - ImportPreCheckResult: 预检查结果
-        """
-        try:
-            data = await request.json
-            filename = data.get("filename")
-            if not filename:
-                return Response().error("缺少 filename 参数").__dict__
-
-            # 安全检查 - 防止路径遍历
-            if ".." in filename or "/" in filename or "\\" in filename:
-                return Response().error("无效的文件名").__dict__
-
-            zip_path = os.path.join(self.backup_dir, filename)
-            if not os.path.exists(zip_path):
-                return Response().error(f"备份文件不存在: {filename}").__dict__
-
-            # 获取知识库管理器（用于构造 importer）
-            kb_manager = getattr(self.core_lifecycle, "kb_manager", None)
-
-            importer = AstrBotImporter(
-                main_db=self.db,
-                kb_manager=kb_manager,
-                config_path=os.path.join(self.data_dir, "cmd_config.json"),
-            )
-
-            # 执行预检查
-            check_result = importer.pre_check(zip_path)
-
-            return Response().ok(check_result.to_dict()).__dict__
-        except Exception as e:
-            logger.error(f"预检查备份文件失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"预检查备份文件失败: {e!s}").__dict__
-
-    async def import_backup(self):
-        """执行备份导入
-
-        在用户确认后执行实际的导入操作。
-        需要先调用 upload_backup 上传文件，再调用 check_backup 预检查。
-
-        JSON Body:
-        - filename: 已上传的备份文件名（必填）
-        - confirmed: 用户已确认（必填，必须为 true）
-
-        返回:
-        - task_id: 任务ID，用于查询导入进度
-        """
-        try:
-            data = await request.json
-            filename = data.get("filename")
-            confirmed = data.get("confirmed", False)
-
-            if not filename:
-                return Response().error("缺少 filename 参数").__dict__
-
-            if not confirmed:
-                return (
-                    Response()
-                    .error("请先确认导入。导入将会清空并覆盖现有数据，此操作不可撤销。")
-                    .__dict__
-                )
-
-            # 安全检查 - 防止路径遍历
-            if ".." in filename or "/" in filename or "\\" in filename:
-                return Response().error("无效的文件名").__dict__
-
-            zip_path = os.path.join(self.backup_dir, filename)
-            if not os.path.exists(zip_path):
-                return Response().error(f"备份文件不存在: {filename}").__dict__
-
-            # 生成任务ID
-            task_id = str(uuid.uuid4())
-
-            # 初始化任务状态
-            self._init_task(task_id, "import", "pending")
-
-            # 启动后台导入任务
-            asyncio.create_task(self._background_import_task(task_id, zip_path))
-
-            return (
-                Response()
-                .ok(
-                    {
-                        "task_id": task_id,
-                        "message": "import task created, processing in background",
-                    }
-                )
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(f"导入备份失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"导入备份失败: {e!s}").__dict__
-
-    async def _background_import_task(self, task_id: str, zip_path: str) -> None:
-        """后台导入任务"""
-        try:
-            self._update_progress(task_id, status="processing", message="正在初始化...")
-
-            # 获取知识库管理器
-            kb_manager = getattr(self.core_lifecycle, "kb_manager", None)
-
-            importer = AstrBotImporter(
-                main_db=self.db,
-                kb_manager=kb_manager,
-                config_path=os.path.join(self.data_dir, "cmd_config.json"),
-            )
-
-            # 创建进度回调
-            progress_callback = self._make_progress_callback(task_id)
-
-            # 执行导入
-            result = await importer.import_all(
-                zip_path=zip_path,
-                mode="replace",
-                progress_callback=progress_callback,
-            )
-
-            # 设置结果
-            if result.success:
-                self._set_task_result(
-                    task_id,
-                    "completed",
-                    result=result.to_dict(),
-                )
-            else:
-                self._set_task_result(
-                    task_id,
-                    "failed",
-                    error="; ".join(result.errors),
-                )
-        except Exception as e:
-            logger.error(f"后台导入任务 {task_id} 失败: {e}")
-            logger.error(traceback.format_exc())
-            self._set_task_result(task_id, "failed", error=str(e))
-
-    async def get_progress(self):
-        """获取任务进度
-
-        Query 参数:
-        - task_id: 任务 ID (必填)
-        """
-        try:
-            task_id = request.args.get("task_id")
-            if not task_id:
-                return Response().error("缺少参数 task_id").__dict__
-
-            if task_id not in self.backup_tasks:
-                return Response().error("找不到该任务").__dict__
-
-            task_info = self.backup_tasks[task_id]
-            status = task_info["status"]
-
-            response_data = {
-                "task_id": task_id,
-                "type": task_info["type"],
-                "status": status,
-            }
-
-            # 如果任务正在处理，返回进度信息
-            if status == "processing" and task_id in self.backup_progress:
-                response_data["progress"] = self.backup_progress[task_id]
-
-            # 如果任务完成，返回结果
-            if status == "completed":
-                response_data["result"] = task_info["result"]
-
-            # 如果任务失败，返回错误信息
-            if status == "failed":
-                response_data["error"] = task_info["error"]
-
-            return Response().ok(response_data).__dict__
-        except Exception as e:
-            logger.error(f"获取任务进度失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"获取任务进度失败: {e!s}").__dict__
-
-    async def download_backup(self):
-        """下载备份文件
-
-        Query 参数:
-        - filename: 备份文件名 (必填)
-        - token: JWT token (必填，用于浏览器原生下载鉴权)
-
-        注意: 此路由已被添加到 auth_middleware 白名单中，
-              使用 URL 参数中的 token 进行鉴权，以支持浏览器原生下载。
-        """
-        try:
-            filename = request.args.get("filename")
-            token = request.args.get("token")
-
-            if not filename:
-                return Response().error("缺少参数 filename").__dict__
-
-            if not token:
-                return Response().error("缺少参数 token").__dict__
-
-            # 验证 JWT token
-            try:
-                jwt_secret = self.config.get("dashboard", {}).get("jwt_secret")
-                if not jwt_secret:
-                    return Response().error("服务器配置错误").__dict__
-
-                # Verify JWT token with strict security options
-                jwt.decode(
-                    token,
-                    jwt_secret,
-                    algorithms=["HS256"],
-                    options={
-                        "require": ["exp"],  # Require expiration claim
-                        "verify_signature": True,  # Explicitly verify signature
-                        "verify_exp": True,  # Verify expiration
-                    },
-                )
-            except jwt.ExpiredSignatureError:
-                return Response().error("Token 已过期，请刷新页面后重试").__dict__
-            except jwt.InvalidTokenError:
-                return Response().error("Token 无效").__dict__
-
-            # 安全检查 - 防止路径遍历
-            if ".." in filename or "/" in filename or "\\" in filename:
-                return Response().error("无效的文件名").__dict__
-
-            file_path = os.path.join(self.backup_dir, filename)
-            if not os.path.exists(file_path):
-                return Response().error("备份文件不存在").__dict__
-
-            return await send_file(
-                file_path,
-                as_attachment=True,
-                attachment_filename=filename,
-                conditional=True,  # 启用 Range 请求支持（断点续传）
-            )
-        except Exception as e:
-            logger.error(f"下载备份失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"下载备份失败: {e!s}").__dict__
-
-    async def delete_backup(self):
-        """删除备份文件
-
-        Body:
-        - filename: 备份文件名 (必填)
-        """
-        try:
-            data = await request.json
-            filename = data.get("filename")
-            if not filename:
-                return Response().error("缺少参数 filename").__dict__
-
-            # 安全检查 - 防止路径遍历
-            if ".." in filename or "/" in filename or "\\" in filename:
-                return Response().error("无效的文件名").__dict__
-
-            file_path = os.path.join(self.backup_dir, filename)
-            if not os.path.exists(file_path):
-                return Response().error("备份文件不存在").__dict__
-
-            os.remove(file_path)
-            return Response().ok(message="删除备份成功").__dict__
-        except Exception as e:
-            logger.error(f"删除备份失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"删除备份失败: {e!s}").__dict__
-
-    async def rename_backup(self):
-        """重命名备份文件
-
-        Body:
-        - filename: 当前文件名 (必填)
-        - new_name: 新文件名 (必填，不含扩展名)
-        """
-        try:
-            data = await request.json
-            filename = data.get("filename")
-            new_name = data.get("new_name")
-
-            if not filename:
-                return Response().error("缺少参数 filename").__dict__
-
-            if not new_name:
-                return Response().error("缺少参数 new_name").__dict__
-
-            # 安全检查 - 防止路径遍历
-            if ".." in filename or "/" in filename or "\\" in filename:
-                return Response().error("无效的文件名").__dict__
-
-            # 清洗新文件名（移除路径和危险字符）
-            new_name = secure_filename(new_name)
-
-            # 移除新文件名中的扩展名（如果有的话）
-            if new_name.endswith(".zip"):
-                new_name = new_name[:-4]
-
-            # 验证新文件名不为空
-            if not new_name or new_name.replace("_", "") == "":
-                return Response().error("新文件名无效").__dict__
-
-            # 强制使用 .zip 扩展名
-            new_filename = f"{new_name}.zip"
-
-            # 检查原文件是否存在
-            old_path = os.path.join(self.backup_dir, filename)
-            if not os.path.exists(old_path):
-                return Response().error("备份文件不存在").__dict__
-
-            # 检查新文件名是否已存在
-            new_path = os.path.join(self.backup_dir, new_filename)
-            if os.path.exists(new_path):
-                return Response().error(f"文件名 '{new_filename}' 已存在").__dict__
-
-            # 执行重命名
-            os.rename(old_path, new_path)
-
-            logger.info(f"备份文件重命名: {filename} -> {new_filename}")
-
-            return (
-                Response()
-                .ok(
-                    {
-                        "old_filename": filename,
-                        "new_filename": new_filename,
-                    }
-                )
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(f"重命名备份失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"重命名备份失败: {e!s}").__dict__
diff --git a/astrbot/dashboard/routes/chatui_project.py b/astrbot/dashboard/routes/chatui_project.py
deleted file mode 100644
index 6ba570f55..000000000
--- a/astrbot/dashboard/routes/chatui_project.py
+++ /dev/null
@@ -1,246 +0,0 @@
-from quart import g, request
-
-from astrbot.core.db import BaseDatabase
-from astrbot.core.utils.datetime_utils import to_utc_isoformat
-
-from .route import Response, Route, RouteContext
-
-
-class ChatUIProjectRoute(Route):
-    def __init__(self, context: RouteContext, db: BaseDatabase) -> None:
-        super().__init__(context)
-        self.routes = {
-            "/chatui_project/create": ("POST", self.create_project),
-            "/chatui_project/list": ("GET", self.list_projects),
-            "/chatui_project/get": ("GET", self.get_project),
-            "/chatui_project/update": ("POST", self.update_chatui_project),
-            "/chatui_project/delete": ("GET", self.delete_project),
-            "/chatui_project/add_session": ("POST", self.add_session_to_project),
-            "/chatui_project/remove_session": (
-                "POST",
-                self.remove_session_from_project,
-            ),
-            "/chatui_project/get_sessions": ("GET", self.get_project_sessions),
-        }
-        self.db = db
-        self.register_routes()
-
-    async def create_project(self):
-        """Create a new ChatUI project."""
-        username = g.get("username", "guest")
-        post_data = await request.json
-
-        title = post_data.get("title")
-        emoji = post_data.get("emoji", "📁")
-        description = post_data.get("description")
-
-        if not title:
-            return Response().error("Missing key: title").__dict__
-
-        project = await self.db.create_chatui_project(
-            creator=username,
-            title=title,
-            emoji=emoji,
-            description=description,
-        )
-
-        return (
-            Response()
-            .ok(
-                data={
-                    "project_id": project.project_id,
-                    "title": project.title,
-                    "emoji": project.emoji,
-                    "description": project.description,
-                    "created_at": to_utc_isoformat(project.created_at),
-                    "updated_at": to_utc_isoformat(project.updated_at),
-                }
-            )
-            .__dict__
-        )
-
-    async def list_projects(self):
-        """Get all ChatUI projects for the current user."""
-        username = g.get("username", "guest")
-
-        projects = await self.db.get_chatui_projects_by_creator(creator=username)
-
-        projects_data = [
-            {
-                "project_id": project.project_id,
-                "title": project.title,
-                "emoji": project.emoji,
-                "description": project.description,
-                "created_at": to_utc_isoformat(project.created_at),
-                "updated_at": to_utc_isoformat(project.updated_at),
-            }
-            for project in projects
-        ]
-
-        return Response().ok(data=projects_data).__dict__
-
-    async def get_project(self):
-        """Get a specific ChatUI project."""
-        project_id = request.args.get("project_id")
-        if not project_id:
-            return Response().error("Missing key: project_id").__dict__
-
-        username = g.get("username", "guest")
-
-        project = await self.db.get_chatui_project_by_id(project_id)
-        if not project:
-            return Response().error(f"Project {project_id} not found").__dict__
-
-        # Verify ownership
-        if project.creator != username:
-            return Response().error("Permission denied").__dict__
-
-        return (
-            Response()
-            .ok(
-                data={
-                    "project_id": project.project_id,
-                    "title": project.title,
-                    "emoji": project.emoji,
-                    "description": project.description,
-                    "created_at": to_utc_isoformat(project.created_at),
-                    "updated_at": to_utc_isoformat(project.updated_at),
-                }
-            )
-            .__dict__
-        )
-
-    async def update_chatui_project(self):
-        """Update a ChatUI project."""
-        post_data = await request.json
-
-        project_id = post_data.get("project_id")
-        title = post_data.get("title")
-        emoji = post_data.get("emoji")
-        description = post_data.get("description")
-
-        if not project_id:
-            return Response().error("Missing key: project_id").__dict__
-
-        username = g.get("username", "guest")
-
-        # Verify ownership
-        project = await self.db.get_chatui_project_by_id(project_id)
-        if not project:
-            return Response().error(f"Project {project_id} not found").__dict__
-        if project.creator != username:
-            return Response().error("Permission denied").__dict__
-
-        await self.db.update_chatui_project(
-            project_id=project_id,
-            title=title,
-            emoji=emoji,
-            description=description,
-        )
-
-        return Response().ok().__dict__
-
-    async def delete_project(self):
-        """Delete a ChatUI project."""
-        project_id = request.args.get("project_id")
-        if not project_id:
-            return Response().error("Missing key: project_id").__dict__
-
-        username = g.get("username", "guest")
-
-        # Verify ownership
-        project = await self.db.get_chatui_project_by_id(project_id)
-        if not project:
-            return Response().error(f"Project {project_id} not found").__dict__
-        if project.creator != username:
-            return Response().error("Permission denied").__dict__
-
-        await self.db.delete_chatui_project(project_id)
-
-        return Response().ok().__dict__
-
-    async def add_session_to_project(self):
-        """Add a session to a project."""
-        post_data = await request.json
-
-        session_id = post_data.get("session_id")
-        project_id = post_data.get("project_id")
-
-        if not session_id:
-            return Response().error("Missing key: session_id").__dict__
-        if not project_id:
-            return Response().error("Missing key: project_id").__dict__
-
-        username = g.get("username", "guest")
-
-        # Verify project ownership
-        project = await self.db.get_chatui_project_by_id(project_id)
-        if not project:
-            return Response().error(f"Project {project_id} not found").__dict__
-        if project.creator != username:
-            return Response().error("Permission denied").__dict__
-
-        # Verify session ownership
-        session = await self.db.get_platform_session_by_id(session_id)
-        if not session:
-            return Response().error(f"Session {session_id} not found").__dict__
-        if session.creator != username:
-            return Response().error("Permission denied").__dict__
-
-        await self.db.add_session_to_project(session_id, project_id)
-
-        return Response().ok().__dict__
-
-    async def remove_session_from_project(self):
-        """Remove a session from its project."""
-        post_data = await request.json
-
-        session_id = post_data.get("session_id")
-
-        if not session_id:
-            return Response().error("Missing key: session_id").__dict__
-
-        username = g.get("username", "guest")
-
-        # Verify session ownership
-        session = await self.db.get_platform_session_by_id(session_id)
-        if not session:
-            return Response().error(f"Session {session_id} not found").__dict__
-        if session.creator != username:
-            return Response().error("Permission denied").__dict__
-
-        await self.db.remove_session_from_project(session_id)
-
-        return Response().ok().__dict__
-
-    async def get_project_sessions(self):
-        """Get all sessions in a project."""
-        project_id = request.args.get("project_id")
-        if not project_id:
-            return Response().error("Missing key: project_id").__dict__
-
-        username = g.get("username", "guest")
-
-        # Verify project ownership
-        project = await self.db.get_chatui_project_by_id(project_id)
-        if not project:
-            return Response().error(f"Project {project_id} not found").__dict__
-        if project.creator != username:
-            return Response().error("Permission denied").__dict__
-
-        sessions = await self.db.get_project_sessions(project_id)
-
-        sessions_data = [
-            {
-                "session_id": session.session_id,
-                "platform_id": session.platform_id,
-                "creator": session.creator,
-                "display_name": session.display_name,
-                "is_group": session.is_group,
-                "created_at": to_utc_isoformat(session.created_at),
-                "updated_at": to_utc_isoformat(session.updated_at),
-            }
-            for session in sessions
-        ]
-
-        return Response().ok(data=sessions_data).__dict__
diff --git a/astrbot/dashboard/routes/command.py b/astrbot/dashboard/routes/command.py
deleted file mode 100644
index 1921fa4a4..000000000
--- a/astrbot/dashboard/routes/command.py
+++ /dev/null
@@ -1,117 +0,0 @@
-from quart import request
-
-from astrbot.core.star.command_management import (
-    list_command_conflicts,
-    list_commands,
-)
-from astrbot.core.star.command_management import (
-    rename_command as rename_command_service,
-)
-from astrbot.core.star.command_management import (
-    toggle_command as toggle_command_service,
-)
-from astrbot.core.star.command_management import (
-    update_command_permission as update_command_permission_service,
-)
-
-from .route import Response, Route, RouteContext
-
-
-class CommandRoute(Route):
-    def __init__(self, context: RouteContext, core_lifecycle=None) -> None:
-        super().__init__(context)
-        self.core_lifecycle = core_lifecycle
-        self.routes = {
-            "/commands": ("GET", self.get_commands),
-            "/commands/conflicts": ("GET", self.get_conflicts),
-            "/commands/toggle": ("POST", self.toggle_command),
-            "/commands/rename": ("POST", self.rename_command),
-            "/commands/permission": ("POST", self.update_permission),
-        }
-        self.register_routes()
-
-    async def get_commands(self):
-        commands = await list_commands()
-        summary = {
-            "total": len(commands),
-            "disabled": len([cmd for cmd in commands if not cmd["enabled"]]),
-            "conflicts": len([cmd for cmd in commands if cmd.get("has_conflict")]),
-        }
-        # 优先从指定 config_id 的配置中读取唤醒词，否则使用默认配置
-        config_id = request.args.get("config_id", "").strip()
-        wake_prefix = self.config.get("wake_prefix", ["/"])
-        if config_id and self.core_lifecycle:
-            acm = getattr(self.core_lifecycle, "astrbot_config_mgr", None)
-            if acm and config_id in acm.confs:
-                wake_prefix = acm.confs[config_id].get("wake_prefix", wake_prefix)
-        return (
-            Response()
-            .ok({"items": commands, "summary": summary, "wake_prefix": wake_prefix})
-            .__dict__
-        )
-
-    async def get_conflicts(self):
-        conflicts = await list_command_conflicts()
-        return Response().ok(conflicts).__dict__
-
-    async def toggle_command(self):
-        data = await request.get_json()
-        handler_full_name = data.get("handler_full_name")
-        enabled = data.get("enabled")
-
-        if handler_full_name is None or enabled is None:
-            return Response().error("handler_full_name 与 enabled 均为必填。").__dict__
-
-        if isinstance(enabled, str):
-            enabled = enabled.lower() in ("1", "true", "yes", "on")
-
-        try:
-            await toggle_command_service(handler_full_name, bool(enabled))
-        except ValueError as exc:
-            return Response().error(str(exc)).__dict__
-
-        payload = await _get_command_payload(handler_full_name)
-        return Response().ok(payload).__dict__
-
-    async def rename_command(self):
-        data = await request.get_json()
-        handler_full_name = data.get("handler_full_name")
-        new_name = data.get("new_name")
-        aliases = data.get("aliases")
-
-        if not handler_full_name or not new_name:
-            return Response().error("handler_full_name 与 new_name 均为必填。").__dict__
-
-        try:
-            await rename_command_service(handler_full_name, new_name, aliases=aliases)
-        except ValueError as exc:
-            return Response().error(str(exc)).__dict__
-
-        payload = await _get_command_payload(handler_full_name)
-        return Response().ok(payload).__dict__
-
-    async def update_permission(self):
-        data = await request.get_json()
-        handler_full_name = data.get("handler_full_name")
-        permission = data.get("permission")
-
-        if not handler_full_name or not permission:
-            return (
-                Response().error("handler_full_name 与 permission 均为必填。").__dict__
-            )
-
-        try:
-            await update_command_permission_service(handler_full_name, permission)
-        except ValueError as exc:
-            return Response().error(str(exc)).__dict__
-
-        payload = await _get_command_payload(handler_full_name)
-        return Response().ok(payload).__dict__
-
-
-async def _get_command_payload(handler_full_name: str):
-    commands = await list_commands()
-    for cmd in commands:
-        if cmd["handler_full_name"] == handler_full_name:
-            return cmd
-    return {}
diff --git a/astrbot/dashboard/routes/config.py b/astrbot/dashboard/routes/config.py
deleted file mode 100644
index aebe26047..000000000
--- a/astrbot/dashboard/routes/config.py
+++ /dev/null
@@ -1,1657 +0,0 @@
-import asyncio
-import copy
-import inspect
-import os
-import traceback
-from pathlib import Path
-from typing import Any
-
-from quart import jsonify, make_response, request
-
-from astrbot.core import astrbot_config, file_token_service, logger
-from astrbot.core.config.astrbot_config import AstrBotConfig
-from astrbot.core.config.default import (
-    CONFIG_METADATA_2,
-    CONFIG_METADATA_3,
-    CONFIG_METADATA_3_SYSTEM,
-    DEFAULT_CONFIG,
-    DEFAULT_VALUE_MAP,
-)
-from astrbot.core.config.i18n_utils import ConfigMetadataI18n
-from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
-from astrbot.core.platform.register import platform_cls_map, platform_registry
-from astrbot.core.provider import Provider
-from astrbot.core.provider.register import provider_registry
-from astrbot.core.star.star import StarMetadata, star_registry
-from astrbot.core.utils.astrbot_path import (
-    get_astrbot_plugin_data_path,
-)
-from astrbot.core.utils.llm_metadata import LLM_METADATAS
-from astrbot.core.utils.totp import (
-    TwoFactorCodeType,
-    is_totp_enabled,
-    revoke_user_trusted_devices,
-    set_pending_totp_secret,
-    verify_configured_2fa_code,
-)
-from astrbot.core.utils.webhook_utils import ensure_platform_webhook_config
-
-from .route import Response, Route, RouteContext
-from .util import (
-    config_key_to_folder,
-    get_schema_item,
-    normalize_rel_path,
-    sanitize_filename,
-)
-
-MAX_FILE_BYTES = 500 * 1024 * 1024
-PROTECTED_2FA_CONFIG_PATHS = (
-    ("dashboard", "totp", "enable"),
-    ("dashboard", "totp", "secret"),
-    ("dashboard", "totp", "recovery_code_hash"),
-)
-TWO_FACTOR_CODE_HEADER = "X-2FA-Code"
-
-
-def try_cast(value: Any, type_: str):
-    if type_ == "int":
-        try:
-            return int(value)
-        except (ValueError, TypeError):
-            return None
-    elif (
-        type_ == "float"
-        and isinstance(value, str)
-        and value.replace(".", "", 1).isdigit()
-    ) or (type_ == "float" and isinstance(value, int)):
-        return float(value)
-    elif type_ == "float":
-        try:
-            return float(value)
-        except (ValueError, TypeError):
-            return None
-
-
-def _expect_type(value, expected_type, path_key, errors, expected_name=None) -> bool:
-    if not isinstance(value, expected_type):
-        errors.append(
-            f"错误的类型 {path_key}: 期望是 {expected_name or expected_type.__name__}, "
-            f"得到了 {type(value).__name__}"
-        )
-        return False
-    return True
-
-
-def _validate_template_list(value, meta, path_key, errors, validate_fn) -> None:
-    if not _expect_type(value, list, path_key, errors, "list"):
-        return
-
-    templates = meta.get("templates")
-    if not isinstance(templates, dict):
-        templates = {}
-
-    for idx, item in enumerate(value):
-        item_path = f"{path_key}[{idx}]"
-        if not _expect_type(item, dict, item_path, errors, "dict"):
-            continue
-
-        template_key = item.get("__template_key") or item.get("template")
-        if not template_key:
-            errors.append(f"缺少模板选择 {item_path}: 需要 __template_key")
-            continue
-
-        template_meta = templates.get(template_key)
-        if not template_meta:
-            errors.append(f"未知模板 {item_path}: {template_key}")
-            continue
-
-        validate_fn(
-            item,
-            template_meta.get("items", {}),
-            path=f"{path_key}.templates.{template_key}.",
-        )
-
-
-def validate_config(data, schema: dict, is_core: bool) -> tuple[list[str], dict]:
-    errors = []
-
-    def validate(data: dict, metadata: dict = schema, path="") -> None:
-        for key, value in data.items():
-            if key not in metadata:
-                continue
-            meta = metadata[key]
-            if "type" not in meta:
-                logger.debug(f"配置项 {path}{key} 没有类型定义, 跳过校验")
-                continue
-            # null 转换
-            if value is None:
-                data[key] = DEFAULT_VALUE_MAP[meta["type"]]
-                continue
-
-            if meta["type"] == "template_list":
-                _validate_template_list(value, meta, f"{path}{key}", errors, validate)
-                continue
-
-            if meta["type"] == "file":
-                if not _expect_type(value, list, f"{path}{key}", errors, "list"):
-                    continue
-                for idx, item in enumerate(value):
-                    if not isinstance(item, str):
-                        errors.append(
-                            f"Invalid type {path}{key}[{idx}]: expected string, got {type(item).__name__}",
-                        )
-                        continue
-                    normalized = normalize_rel_path(item)
-                    if not normalized or not normalized.startswith("files/"):
-                        errors.append(
-                            f"Invalid file path {path}{key}[{idx}]: {item}",
-                        )
-                        continue
-                    key_path = f"{path}{key}"
-                    expected_folder = config_key_to_folder(key_path)
-                    expected_prefix = f"files/{expected_folder}/"
-                    if not normalized.startswith(expected_prefix):
-                        errors.append(
-                            f"Invalid file path {path}{key}[{idx}]: {item}",
-                        )
-                        continue
-                    value[idx] = normalized
-                continue
-
-            if meta["type"] == "list" and not isinstance(value, list):
-                errors.append(
-                    f"错误的类型 {path}{key}: 期望是 list, 得到了 {type(value).__name__}",
-                )
-            elif (
-                meta["type"] == "list"
-                and isinstance(value, list)
-                and value
-                and "items" in meta
-                and isinstance(value[0], dict)
-            ):
-                # 当前仅针对 list[dict] 的情况进行类型校验，以适配 AstrBot 中 platform、provider 的配置
-                for item in value:
-                    validate(item, meta["items"], path=f"{path}{key}.")
-            elif meta["type"] == "object" and isinstance(value, dict):
-                validate(value, meta["items"], path=f"{path}{key}.")
-
-            if meta["type"] == "int" and not isinstance(value, int):
-                casted = try_cast(value, "int")
-                if casted is None:
-                    errors.append(
-                        f"错误的类型 {path}{key}: 期望是 int, 得到了 {type(value).__name__}",
-                    )
-                data[key] = casted
-            elif meta["type"] == "float" and not isinstance(value, float):
-                casted = try_cast(value, "float")
-                if casted is None:
-                    errors.append(
-                        f"错误的类型 {path}{key}: 期望是 float, 得到了 {type(value).__name__}",
-                    )
-                data[key] = casted
-            elif meta["type"] == "bool" and not isinstance(value, bool):
-                errors.append(
-                    f"错误的类型 {path}{key}: 期望是 bool, 得到了 {type(value).__name__}",
-                )
-            elif meta["type"] in ["string", "text"] and not isinstance(value, str):
-                errors.append(
-                    f"错误的类型 {path}{key}: 期望是 string, 得到了 {type(value).__name__}",
-                )
-            elif meta["type"] == "list" and not isinstance(value, list):
-                errors.append(
-                    f"错误的类型 {path}{key}: 期望是 list, 得到了 {type(value).__name__}",
-                )
-            elif meta["type"] == "object" and not isinstance(value, dict):
-                errors.append(
-                    f"错误的类型 {path}{key}: 期望是 dict, 得到了 {type(value).__name__}",
-                )
-
-    if is_core:
-        meta_all = {
-            **schema["platform_group"]["metadata"],
-            **schema["provider_group"]["metadata"],
-            **schema["misc_config_group"]["metadata"],
-        }
-        validate(data, meta_all)
-    else:
-        validate(data, schema)
-
-    return errors, data
-
-
-def _log_computer_config_changes(old_config: dict, new_config: dict) -> None:
-    """Compare and log Computer/sandbox configuration changes."""
-    old_ps = old_config.get("provider_settings", {})
-    new_ps = new_config.get("provider_settings", {})
-
-    # Check computer_use_runtime
-    old_runtime = old_ps.get("computer_use_runtime", "none")
-    new_runtime = new_ps.get("computer_use_runtime", "none")
-    if old_runtime != new_runtime:
-        logger.info(
-            "[Computer] Config changed: computer_use_runtime %s -> %s",
-            old_runtime,
-            new_runtime,
-        )
-
-    # Check sandbox sub-keys
-    old_sandbox = old_ps.get("sandbox", {})
-    new_sandbox = new_ps.get("sandbox", {})
-    all_keys = set(old_sandbox.keys()) | set(new_sandbox.keys())
-    for key in sorted(all_keys):
-        old_val = old_sandbox.get(key)
-        new_val = new_sandbox.get(key)
-        if old_val != new_val:
-            # Mask tokens/secrets in log output
-            if "token" in key or "secret" in key:
-                old_display = "***" if old_val else "(empty)"
-                new_display = "***" if new_val else "(empty)"
-            else:
-                old_display = old_val
-                new_display = new_val
-            logger.info(
-                "[Computer] Config changed: sandbox.%s %s -> %s",
-                key,
-                old_display,
-                new_display,
-            )
-
-
-def _get_nested_value(data: dict, path: tuple[str, ...]) -> Any:
-    current = data
-    for key in path:
-        if not isinstance(current, dict) or key not in current:
-            return None
-        current = current[key]
-    return current
-
-
-def _set_nested_value(data: dict, path: tuple[str, ...], value: Any) -> None:
-    current = data
-    for key in path[:-1]:
-        next_value = current.get(key)
-        if not isinstance(next_value, dict):
-            next_value = {}
-            current[key] = next_value
-        current = next_value
-    current[path[-1]] = value
-
-
-def _protected_2fa_config_changed(old_config: dict, new_config: dict) -> bool:
-    return any(
-        _get_nested_value(old_config, path) != _get_nested_value(new_config, path)
-        for path in PROTECTED_2FA_CONFIG_PATHS
-    )
-
-
-async def _validate_neo_connectivity(
-    post_config: dict,
-) -> str | None:
-    """Check if Bay is reachable when Shipyard Neo sandbox is configured.
-
-    Returns a warning message string if Bay isn't reachable, or None if
-    everything looks fine (or Neo isn't configured).
-    """
-    ps = post_config.get("provider_settings", {})
-    runtime = ps.get("computer_use_runtime", "none")
-    sandbox = ps.get("sandbox", {})
-    booter = sandbox.get("booter", "")
-
-    # Only check when sandbox mode + shipyard_neo is selected
-    if runtime != "sandbox" or booter != "shipyard_neo":
-        return None
-
-    endpoint = sandbox.get("shipyard_neo_endpoint", "").rstrip("/")
-    if not endpoint:
-        return "⚠️ Shipyard Neo endpoint 未设置"
-
-    access_token = sandbox.get("shipyard_neo_access_token", "")
-    if not access_token:
-        # Try auto-discovery
-        from astrbot.core.computer.computer_client import _discover_bay_credentials
-
-        access_token = _discover_bay_credentials(endpoint)
-
-    if not access_token:
-        return (
-            "⚠️ 未找到 Bay API Key。请填写访问令牌，"
-            "或确保 Bay 的 credentials.json 可被自动发现。"
-        )
-
-    # Connectivity check
-    import aiohttp
-
-    health_url = f"{endpoint}/health"
-    try:
-        async with aiohttp.ClientSession() as session:
-            async with session.get(
-                health_url,
-                timeout=aiohttp.ClientTimeout(total=5),
-            ) as resp:
-                if resp.status != 200:
-                    return (
-                        f"⚠️ Bay 健康检查失败 (HTTP {resp.status})，"
-                        f"请确认 Bay 正在运行: {endpoint}"
-                    )
-    except Exception:
-        return f"⚠️ 无法连接 Bay ({endpoint})，请确认 Bay 已启动。"
-
-    return None
-
-
-def save_config(
-    post_config: dict, config: AstrBotConfig, is_core: bool = False
-) -> None:
-    """验证并保存配置"""
-    errors = None
-
-    # Snapshot old Computer config for change detection
-    if is_core:
-        _log_computer_config_changes(dict(config), post_config)
-
-    try:
-        if is_core:
-            errors, post_config = validate_config(
-                post_config,
-                CONFIG_METADATA_2,
-                is_core,
-            )
-        else:
-            errors, post_config = validate_config(
-                post_config, getattr(config, "schema", {}), is_core
-            )
-    except BaseException as e:
-        logger.error(traceback.format_exc())
-        logger.warning(f"验证配置时出现异常: {e}")
-        raise ValueError(f"验证配置时出现异常: {e}")
-    if errors:
-        raise ValueError(f"格式校验未通过: {errors}")
-
-    config.save_config(post_config)
-
-
-class ConfigRoute(Route):
-    def __init__(
-        self,
-        context: RouteContext,
-        core_lifecycle: AstrBotCoreLifecycle,
-    ) -> None:
-        super().__init__(context)
-        self.core_lifecycle = core_lifecycle
-        self.config: AstrBotConfig = core_lifecycle.astrbot_config
-        self.db = core_lifecycle.db
-        self._logo_token_cache = {}  # 缓存logo token，避免重复注册
-        self.acm = core_lifecycle.astrbot_config_mgr
-        self.ucr = core_lifecycle.umop_config_router
-        self.routes = {
-            "/config/abconf/new": ("POST", self.create_abconf),
-            "/config/abconf": ("GET", self.get_abconf),
-            "/config/abconfs": ("GET", self.get_abconf_list),
-            "/config/abconf/delete": ("POST", self.delete_abconf),
-            "/config/abconf/update": ("POST", self.update_abconf),
-            "/config/umo_abconf_routes": ("GET", self.get_uc_table),
-            "/config/umo_abconf_route/update_all": ("POST", self.update_ucr_all),
-            "/config/umo_abconf_route/update": ("POST", self.update_ucr),
-            "/config/umo_abconf_route/delete": ("POST", self.delete_ucr),
-            "/config/get": ("GET", self.get_configs),
-            "/config/default": ("GET", self.get_default_config),
-            "/config/astrbot/update": ("POST", self.post_astrbot_configs),
-            "/config/plugin/update": ("POST", self.post_plugin_configs),
-            "/config/file/upload": ("POST", self.upload_config_file),
-            "/config/file/delete": ("POST", self.delete_config_file),
-            "/config/file/get": ("GET", self.get_config_file_list),
-            "/config/platform/new": ("POST", self.post_new_platform),
-            "/config/platform/update": ("POST", self.post_update_platform),
-            "/config/platform/delete": ("POST", self.post_delete_platform),
-            "/config/platform/list": ("GET", self.get_platform_list),
-            "/config/provider/new": ("POST", self.post_new_provider),
-            "/config/provider/update": ("POST", self.post_update_provider),
-            "/config/provider/delete": ("POST", self.post_delete_provider),
-            "/config/provider/template": ("GET", self.get_provider_template),
-            "/config/provider/check_one": ("GET", self.check_one_provider_status),
-            "/config/provider/list": ("GET", self.get_provider_config_list),
-            "/config/provider/model_list": ("GET", self.get_provider_model_list),
-            "/config/provider/get_embedding_dim": ("POST", self.get_embedding_dim),
-            "/config/provider_sources/models": (
-                "GET",
-                self.get_provider_source_models,
-            ),
-            "/config/provider_sources/update": (
-                "POST",
-                self.update_provider_source,
-            ),
-            "/config/provider_sources/delete": (
-                "POST",
-                self.delete_provider_source,
-            ),
-        }
-        self.register_routes()
-
-    async def delete_provider_source(self):
-        """删除 provider_source，并更新关联的 providers"""
-        post_data = await request.json
-        if not post_data:
-            return Response().error("缺少配置数据").__dict__
-
-        provider_source_id = post_data.get("id")
-        if not provider_source_id:
-            return Response().error("缺少 provider_source_id").__dict__
-
-        provider_sources = self.config.get("provider_sources", [])
-        target_idx = next(
-            (
-                i
-                for i, ps in enumerate(provider_sources)
-                if ps.get("id") == provider_source_id
-            ),
-            -1,
-        )
-
-        if target_idx == -1:
-            return Response().error("未找到对应的 provider source").__dict__
-
-        # 删除 provider_source
-        del provider_sources[target_idx]
-
-        # 写回配置
-        self.config["provider_sources"] = provider_sources
-
-        # 删除引用了该 provider_source 的 providers
-        await self.core_lifecycle.provider_manager.delete_provider(
-            provider_source_id=provider_source_id
-        )
-
-        try:
-            save_config(self.config, self.config, is_core=True)
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(str(e)).__dict__
-
-        return Response().ok(message="删除 provider source 成功").__dict__
-
-    async def update_provider_source(self):
-        """更新或新增 provider_source，并重载关联的 providers"""
-        post_data = await request.json
-        if not post_data:
-            return Response().error("缺少配置数据").__dict__
-
-        new_source_config = post_data.get("config") or post_data
-        original_id = post_data.get("original_id")
-        if not original_id:
-            return Response().error("缺少 original_id").__dict__
-
-        if not isinstance(new_source_config, dict):
-            return Response().error("缺少或错误的配置数据").__dict__
-
-        # 确保配置中有 id 字段
-        if not new_source_config.get("id"):
-            new_source_config["id"] = original_id
-
-        provider_sources = self.config.get("provider_sources", [])
-
-        for ps in provider_sources:
-            if ps.get("id") == new_source_config["id"] and ps.get("id") != original_id:
-                return (
-                    Response()
-                    .error(
-                        f"Provider source ID '{new_source_config['id']}' exists already, please try another ID.",
-                    )
-                    .__dict__
-                )
-
-        # 查找旧的 provider_source，若不存在则追加为新配置
-        target_idx = next(
-            (i for i, ps in enumerate(provider_sources) if ps.get("id") == original_id),
-            -1,
-        )
-
-        old_id = original_id
-        if target_idx == -1:
-            provider_sources.append(new_source_config)
-        else:
-            old_id = provider_sources[target_idx].get("id")
-            provider_sources[target_idx] = new_source_config
-
-        # 更新引用了该 provider_source 的 providers
-        affected_providers = []
-        for provider in self.config.get("provider", []):
-            if provider.get("provider_source_id") == old_id:
-                provider["provider_source_id"] = new_source_config["id"]
-                affected_providers.append(provider)
-
-        # 写回配置
-        self.config["provider_sources"] = provider_sources
-
-        try:
-            save_config(self.config, self.config, is_core=True)
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(str(e)).__dict__
-
-        # 重载受影响的 providers，使新的 source 配置生效
-        reload_errors = []
-        prov_mgr = self.core_lifecycle.provider_manager
-        for provider in affected_providers:
-            try:
-                await prov_mgr.reload(provider)
-            except Exception as e:
-                logger.error(traceback.format_exc())
-                reload_errors.append(f"{provider.get('id')}: {e}")
-
-        if reload_errors:
-            return (
-                Response()
-                .error("更新成功，但部分提供商重载失败: " + ", ".join(reload_errors))
-                .__dict__
-            )
-
-        return Response().ok(message="更新 provider source 成功").__dict__
-
-    async def get_provider_template(self):
-        provider_metadata = ConfigMetadataI18n.convert_to_i18n_keys(
-            {
-                "provider_group": {
-                    "metadata": {
-                        "provider": CONFIG_METADATA_2["provider_group"]["metadata"][
-                            "provider"
-                        ]
-                    }
-                }
-            }
-        )
-        config_schema = {
-            "provider": provider_metadata["provider_group"]["metadata"]["provider"]
-        }
-        data = {
-            "config_schema": config_schema,
-            "providers": astrbot_config["provider"],
-            "provider_sources": astrbot_config["provider_sources"],
-        }
-        return Response().ok(data=data).__dict__
-
-    async def get_uc_table(self):
-        """获取 UMOP 配置路由表"""
-        return Response().ok({"routing": self.ucr.umop_to_conf_id}).__dict__
-
-    async def update_ucr_all(self):
-        """更新 UMOP 配置路由表的全部内容"""
-        post_data = await request.json
-        if not post_data:
-            return Response().error("缺少配置数据").__dict__
-
-        new_routing = post_data.get("routing", None)
-
-        if not new_routing or not isinstance(new_routing, dict):
-            return Response().error("缺少或错误的路由表数据").__dict__
-
-        try:
-            await self.ucr.update_routing_data(new_routing)
-            return Response().ok(message="更新成功").__dict__
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(f"更新路由表失败: {e!s}").__dict__
-
-    async def update_ucr(self):
-        """更新 UMOP 配置路由表"""
-        post_data = await request.json
-        if not post_data:
-            return Response().error("缺少配置数据").__dict__
-
-        umo = post_data.get("umo", None)
-        conf_id = post_data.get("conf_id", None)
-
-        if not umo or not conf_id:
-            return Response().error("缺少 UMO 或配置文件 ID").__dict__
-
-        try:
-            await self.ucr.update_route(umo, conf_id)
-            return Response().ok(message="更新成功").__dict__
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(f"更新路由表失败: {e!s}").__dict__
-
-    async def delete_ucr(self):
-        """删除 UMOP 配置路由表中的一项"""
-        post_data = await request.json
-        if not post_data:
-            return Response().error("缺少配置数据").__dict__
-
-        umo = post_data.get("umo", None)
-
-        if not umo:
-            return Response().error("缺少 UMO").__dict__
-
-        try:
-            if umo in self.ucr.umop_to_conf_id:
-                del self.ucr.umop_to_conf_id[umo]
-                await self.ucr.update_routing_data(self.ucr.umop_to_conf_id)
-            return Response().ok(message="删除成功").__dict__
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(f"删除路由表项失败: {e!s}").__dict__
-
-    async def get_default_config(self):
-        """获取默认配置文件"""
-        metadata = ConfigMetadataI18n.convert_to_i18n_keys(CONFIG_METADATA_3)
-        return Response().ok({"config": DEFAULT_CONFIG, "metadata": metadata}).__dict__
-
-    async def get_abconf_list(self):
-        """获取所有 AstrBot 配置文件的列表"""
-        abconf_list = self.acm.get_conf_list()
-        return Response().ok({"info_list": abconf_list}).__dict__
-
-    async def create_abconf(self):
-        """创建新的 AstrBot 配置文件"""
-        post_data = await request.json
-        if not post_data:
-            return Response().error("缺少配置数据").__dict__
-        name = post_data.get("name", None)
-        config = post_data.get("config", DEFAULT_CONFIG)
-
-        try:
-            conf_id = self.acm.create_conf(name=name, config=config)
-            await self.core_lifecycle.reload_pipeline_scheduler(conf_id)
-            return Response().ok(message="创建成功", data={"conf_id": conf_id}).__dict__
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-
-    async def get_abconf(self):
-        """获取指定 AstrBot 配置文件"""
-        abconf_id = request.args.get("id")
-        system_config = request.args.get("system_config", "0").lower() == "1"
-        if not abconf_id and not system_config:
-            return Response().error("缺少配置文件 ID").__dict__
-
-        try:
-            if system_config:
-                abconf = self.acm.confs["default"]
-                metadata = ConfigMetadataI18n.convert_to_i18n_keys(
-                    CONFIG_METADATA_3_SYSTEM
-                )
-                return Response().ok({"config": abconf, "metadata": metadata}).__dict__
-            if abconf_id is None:
-                raise ValueError("abconf_id cannot be None")
-            abconf = self.acm.confs[abconf_id]
-            metadata = ConfigMetadataI18n.convert_to_i18n_keys(CONFIG_METADATA_3)
-            return Response().ok({"config": abconf, "metadata": metadata}).__dict__
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-
-    async def delete_abconf(self):
-        """删除指定 AstrBot 配置文件"""
-        post_data = await request.json
-        if not post_data:
-            return Response().error("缺少配置数据").__dict__
-
-        conf_id = post_data.get("id")
-        if not conf_id:
-            return Response().error("缺少配置文件 ID").__dict__
-
-        try:
-            success = self.acm.delete_conf(conf_id)
-            if success:
-                self.core_lifecycle.pipeline_scheduler_mapping.pop(conf_id, None)
-                return Response().ok(message="删除成功").__dict__
-            return Response().error("删除失败").__dict__
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(f"删除配置文件失败: {e!s}").__dict__
-
-    async def update_abconf(self):
-        """更新指定 AstrBot 配置文件信息"""
-        post_data = await request.json
-        if not post_data:
-            return Response().error("缺少配置数据").__dict__
-
-        conf_id = post_data.get("id")
-        if not conf_id:
-            return Response().error("缺少配置文件 ID").__dict__
-
-        name = post_data.get("name")
-
-        try:
-            success = self.acm.update_conf_info(conf_id, name=name)
-            if success:
-                return Response().ok(message="更新成功").__dict__
-            return Response().error("更新失败").__dict__
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(f"更新配置文件失败: {e!s}").__dict__
-
-    async def _test_single_provider(self, provider):
-        """辅助函数：测试单个 provider 的可用性"""
-        meta = provider.meta()
-        provider_name = provider.provider_config.get("id", "Unknown Provider")
-        provider_capability_type = meta.provider_type
-
-        status_info = {
-            "id": getattr(meta, "id", "Unknown ID"),
-            "model": getattr(meta, "model", "Unknown Model"),
-            "type": provider_capability_type.value,
-            "name": provider_name,
-            "status": "unavailable",  # 默认为不可用
-            "error": None,
-        }
-        logger.debug(
-            f"Attempting to check provider: {status_info['name']} (ID: {status_info['id']}, Type: {status_info['type']}, Model: {status_info['model']})",
-        )
-
-        try:
-            await provider.test()
-            status_info["status"] = "available"
-            logger.info(
-                f"Provider {status_info['name']} (ID: {status_info['id']}) is available.",
-            )
-        except Exception as e:
-            error_message = str(e)
-            status_info["error"] = error_message
-            logger.warning(
-                f"Provider {status_info['name']} (ID: {status_info['id']}) is unavailable. Error: {error_message}",
-            )
-            logger.debug(
-                f"Traceback for {status_info['name']}:\n{traceback.format_exc()}",
-            )
-
-        return status_info
-
-    def _error_response(
-        self,
-        message: str,
-        status_code: int = 500,
-        log_fn=logger.error,
-    ):
-        log_fn(message)
-        # 记录更详细的traceback信息，但只在是严重错误时
-        if status_code == 500:
-            log_fn(traceback.format_exc())
-        return Response().error(message).__dict__
-
-    async def check_one_provider_status(self):
-        """API: check a single LLM Provider's status by id"""
-        provider_id = request.args.get("id")
-        if not provider_id:
-            return self._error_response(
-                "Missing provider_id parameter",
-                400,
-                logger.warning,
-            )
-
-        logger.info(f"API call: /config/provider/check_one id={provider_id}")
-        try:
-            prov_mgr = self.core_lifecycle.provider_manager
-            target = prov_mgr.inst_map.get(provider_id)
-
-            if not target:
-                logger.warning(
-                    f"Provider with id '{provider_id}' not found in provider_manager.",
-                )
-                return (
-                    Response()
-                    .error(f"Provider with id '{provider_id}' not found")
-                    .__dict__
-                )
-
-            result = await self._test_single_provider(target)
-            return Response().ok(result).__dict__
-
-        except Exception as e:
-            return self._error_response(
-                f"Critical error checking provider {provider_id}: {e}",
-                500,
-            )
-
-    async def get_configs(self):
-        # plugin_name 为空时返回 AstrBot 配置
-        # 否则返回指定 plugin_name 的插件配置
-        plugin_name = request.args.get("plugin_name", None)
-        if not plugin_name:
-            return Response().ok(await self._get_astrbot_config()).__dict__
-        return Response().ok(await self._get_plugin_config(plugin_name)).__dict__
-
-    async def get_provider_config_list(self):
-        provider_type = request.args.get("provider_type", None)
-        if not provider_type:
-            return Response().error("缺少参数 provider_type").__dict__
-        provider_type_ls = provider_type.split(",")
-        provider_list = []
-        ps = self.core_lifecycle.provider_manager.providers_config
-        p_source_pt = {
-            psrc["id"]: psrc.get("provider_type", "chat_completion")
-            for psrc in self.core_lifecycle.provider_manager.provider_sources_config
-        }
-        for provider in ps:
-            ps_id = provider.get("provider_source_id", None)
-            if (
-                ps_id
-                and ps_id in p_source_pt
-                and p_source_pt[ps_id] in provider_type_ls
-            ):
-                # chat
-                prov = self.core_lifecycle.provider_manager.get_merged_provider_config(
-                    provider
-                )
-                provider_list.append(prov)
-            elif not ps_id and provider.get("provider_type", "") in provider_type_ls:
-                # agent runner, embedding, etc
-                provider_list.append(provider)
-        return Response().ok(provider_list).__dict__
-
-    async def get_provider_model_list(self):
-        """获取指定提供商的模型列表"""
-        provider_id = request.args.get("provider_id", None)
-        if not provider_id:
-            return Response().error("缺少参数 provider_id").__dict__
-
-        prov_mgr = self.core_lifecycle.provider_manager
-        provider = prov_mgr.inst_map.get(provider_id, None)
-        if not provider:
-            return Response().error(f"未找到 ID 为 {provider_id} 的提供商").__dict__
-        if not isinstance(provider, Provider):
-            return (
-                Response()
-                .error(f"提供商 {provider_id} 类型不支持获取模型列表")
-                .__dict__
-            )
-
-        try:
-            models = await provider.get_models()
-            models = models or []
-
-            metadata_map = {}
-            for model_id in models:
-                meta = LLM_METADATAS.get(model_id)
-                if meta:
-                    metadata_map[model_id] = meta
-
-            ret = {
-                "models": models,
-                "provider_id": provider_id,
-                "model_metadata": metadata_map,
-            }
-            return Response().ok(ret).__dict__
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(str(e)).__dict__
-
-    async def get_embedding_dim(self):
-        """获取嵌入模型的维度"""
-        post_data = await request.json
-        provider_config = post_data.get("provider_config", None)
-        if not provider_config:
-            return Response().error("缺少参数 provider_config").__dict__
-
-        try:
-            # 动态导入 EmbeddingProvider
-            from astrbot.core.provider.provider import EmbeddingProvider
-            from astrbot.core.provider.register import provider_cls_map
-
-            # 获取 provider 类型
-            provider_type = provider_config.get("type", None)
-            if not provider_type:
-                return Response().error("provider_config 缺少 type 字段").__dict__
-
-            # 首次添加某类提供商时，provider_cls_map 可能尚未注册该适配器
-            if provider_type not in provider_cls_map:
-                try:
-                    self.core_lifecycle.provider_manager.dynamic_import_provider(
-                        provider_type,
-                    )
-                except ImportError:
-                    logger.error(traceback.format_exc())
-                    return (
-                        Response()
-                        .error(
-                            "提供商适配器加载失败，请检查提供商类型配置或查看服务端日志"
-                        )
-                        .__dict__
-                    )
-
-            # 获取对应的 provider 类
-            if provider_type not in provider_cls_map:
-                return (
-                    Response()
-                    .error(f"未找到适用于 {provider_type} 的提供商适配器")
-                    .__dict__
-                )
-
-            provider_metadata = provider_cls_map[provider_type]
-            cls_type = provider_metadata.cls_type
-
-            if not cls_type:
-                return Response().error(f"无法找到 {provider_type} 的类").__dict__
-
-            # 实例化 provider
-            inst = cls_type(provider_config, {})
-
-            # 检查是否是 EmbeddingProvider
-            if not isinstance(inst, EmbeddingProvider):
-                return Response().error("提供商不是 EmbeddingProvider 类型").__dict__
-
-            init_fn = getattr(inst, "initialize", None)
-            if inspect.iscoroutinefunction(init_fn):
-                await init_fn()
-
-            # 通过实际请求验证当前 embedding_dimensions 是否可用
-            vec = await inst.get_embedding("echo")
-            dim = len(vec)
-
-            logger.info(
-                f"检测到 {provider_config.get('id', 'unknown')} 的嵌入向量维度为 {dim}",
-            )
-
-            return Response().ok({"embedding_dimensions": dim}).__dict__
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(f"获取嵌入维度失败: {e!s}").__dict__
-
-    async def get_provider_source_models(self):
-        """获取指定 provider_source 支持的模型列表
-
-        本质上会临时初始化一个 Provider 实例，调用 get_models() 获取模型列表，然后销毁实例
-        """
-        provider_source_id = request.args.get("source_id")
-        if not provider_source_id:
-            return Response().error("缺少参数 source_id").__dict__
-
-        try:
-            from astrbot.core.provider.register import provider_cls_map
-
-            # 从配置中查找对应的 provider_source
-            provider_sources = self.config.get("provider_sources", [])
-            provider_source = None
-            for ps in provider_sources:
-                if ps.get("id") == provider_source_id:
-                    provider_source = ps
-                    break
-
-            if not provider_source:
-                return (
-                    Response()
-                    .error(f"未找到 ID 为 {provider_source_id} 的 provider_source")
-                    .__dict__
-                )
-
-            # 获取 provider 类型
-            provider_type = provider_source.get("type", None)
-            if not provider_type:
-                return Response().error("provider_source 缺少 type 字段").__dict__
-
-            try:
-                self.core_lifecycle.provider_manager.dynamic_import_provider(
-                    provider_type
-                )
-            except ImportError as e:
-                logger.error(traceback.format_exc())
-                return Response().error(f"动态导入提供商适配器失败: {e!s}").__dict__
-
-            # 获取对应的 provider 类
-            if provider_type not in provider_cls_map:
-                return (
-                    Response()
-                    .error(f"未找到适用于 {provider_type} 的提供商适配器")
-                    .__dict__
-                )
-
-            provider_metadata = provider_cls_map[provider_type]
-            cls_type = provider_metadata.cls_type
-
-            if not cls_type:
-                return Response().error(f"无法找到 {provider_type} 的类").__dict__
-
-            # 检查是否是 Provider 类型
-            if not issubclass(cls_type, Provider):
-                return (
-                    Response()
-                    .error(f"提供商 {provider_type} 不支持获取模型列表")
-                    .__dict__
-                )
-
-            # 临时实例化 provider
-            inst = cls_type(provider_source, {})
-
-            # 如果有 initialize 方法，调用它
-            init_fn = getattr(inst, "initialize", None)
-            if inspect.iscoroutinefunction(init_fn):
-                await init_fn()
-
-            # 获取模型列表
-            models = await inst.get_models()
-            models = models or []
-
-            metadata_map = {}
-            for model_id in models:
-                meta = LLM_METADATAS.get(model_id)
-                if meta:
-                    metadata_map[model_id] = meta
-
-            # 销毁实例（如果有 terminate 方法）
-            terminate_fn = getattr(inst, "terminate", None)
-            if inspect.iscoroutinefunction(terminate_fn):
-                await terminate_fn()
-
-            return (
-                Response()
-                .ok({"models": models, "model_metadata": metadata_map})
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(f"获取模型列表失败: {e!s}").__dict__
-
-    async def get_platform_list(self):
-        """获取所有平台的列表"""
-        platform_list = []
-        for platform in self.config["platform"]:
-            platform_list.append(platform)
-        return Response().ok({"platforms": platform_list}).__dict__
-
-    async def post_astrbot_configs(self):
-        data = await request.json
-        if not isinstance(data, dict):
-            return Response().error("Invalid request payload").__dict__
-        config = data.get("config", None)
-        conf_id = data.get("conf_id", None)
-
-        try:
-            if not isinstance(config, dict):
-                return Response().error("Invalid config payload").__dict__
-
-            if conf_id not in self.acm.confs:
-                raise ValueError(f"Config file {conf_id} does not exist")
-
-            # 不更新 provider_sources, provider, platform
-            # 这些配置有单独的接口进行更新
-            if conf_id == "default":
-                no_update_keys = ["provider_sources", "provider", "platform"]
-                for key in no_update_keys:
-                    config[key] = self.acm.default_conf[key]
-
-            current_config = self.acm.confs[conf_id]
-            protected_2fa_changed = _protected_2fa_config_changed(
-                current_config, config
-            )
-            verified_2fa = None
-            if await self._requires_config_2fa(current_config, protected_2fa_changed):
-                verified_2fa = await self._verify_config_2fa(current_config)
-                if not verified_2fa:
-                    return await self._config_2fa_required_response()
-
-            if not _get_nested_value(config, ("dashboard", "totp", "enable")):
-                _set_nested_value(config, ("dashboard", "totp", "secret"), "")
-                _set_nested_value(
-                    config, ("dashboard", "totp", "recovery_code_hash"), ""
-                )
-
-            set_pending_totp_secret(None)
-            await self._save_astrbot_configs(config, conf_id)
-            if protected_2fa_changed:
-                await revoke_user_trusted_devices(self.db)
-            await self.core_lifecycle.reload_pipeline_scheduler(conf_id)
-
-            # Non-blocking Bay connectivity check
-            warning = await _validate_neo_connectivity(config)
-            if warning:
-                return Response().ok(None, f"保存成功。{warning}").__dict__
-            return Response().ok(None, "保存成功~").__dict__
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(str(e)).__dict__
-
-    async def _requires_config_2fa(
-        self, current_config: dict, protected_2fa_changed: bool
-    ) -> bool:
-        if not is_totp_enabled(current_config):
-            return False
-        if not protected_2fa_changed:
-            return False
-        return True
-
-    async def _verify_config_2fa(
-        self, current_config: dict
-    ) -> TwoFactorCodeType | None:
-        code = request.headers.get(TWO_FACTOR_CODE_HEADER, "").strip()
-        if not code:
-            return None
-
-        return await verify_configured_2fa_code(
-            current_config, code, include_pending=True, allow_recovery=False
-        )
-
-    async def _config_2fa_required_response(self):
-        response = await make_response(
-            jsonify(
-                {
-                    "status": "error",
-                    "data": {
-                        "totp_required": True,
-                    },
-                }
-            )
-        )
-        response.status_code = 401
-        return response
-
-    async def post_plugin_configs(self):
-        post_configs = await request.json
-        plugin_name = request.args.get("plugin_name", "unknown")
-        try:
-            await self._save_plugin_configs(post_configs, plugin_name)
-            await self.core_lifecycle.plugin_manager.reload(plugin_name)
-            return (
-                Response()
-                .ok(None, f"保存插件 {plugin_name} 成功~ 机器人正在热重载插件。")
-                .__dict__
-            )
-        except Exception as e:
-            return Response().error(str(e)).__dict__
-
-    def _get_plugin_metadata_by_name(self, plugin_name: str) -> StarMetadata | None:
-        for plugin_md in star_registry:
-            if plugin_md.name == plugin_name:
-                return plugin_md
-        return None
-
-    def _resolve_config_file_scope(
-        self,
-    ) -> tuple[str, str, str, StarMetadata, AstrBotConfig]:
-        """将请求参数解析为一个明确的配置作用域。
-
-        当前支持的 scope：
-        - scope=plugin：name=<plugin_name>，key=<config_key_path>
-        """
-
-        scope = request.args.get("scope") or "plugin"
-        name = request.args.get("name")
-        key_path = request.args.get("key")
-
-        if scope != "plugin":
-            raise ValueError(f"Unsupported scope: {scope}")
-        if not name or not key_path:
-            raise ValueError("Missing name or key parameter")
-
-        md = self._get_plugin_metadata_by_name(name)
-        if not md or not md.config:
-            raise ValueError(f"Plugin {name} not found or has no config")
-
-        return scope, name, key_path, md, md.config
-
-    async def upload_config_file(self):
-        """上传文件到插件数据目录（用于某个 file 类型配置项）。"""
-
-        try:
-            scope, name, key_path, md, config = self._resolve_config_file_scope()
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-
-        meta = get_schema_item(getattr(config, "schema", None), key_path)
-        if not meta or meta.get("type") != "file":
-            return Response().error("Config item not found or not file type").__dict__
-
-        file_types = meta.get("file_types")
-        allowed_exts: list[str] = []
-        if isinstance(file_types, list):
-            allowed_exts = [
-                str(ext).lstrip(".").lower() for ext in file_types if str(ext).strip()
-            ]
-
-        files = await request.files
-        if not files:
-            return Response().error("No files uploaded").__dict__
-
-        storage_root_path = Path(get_astrbot_plugin_data_path()).resolve(strict=False)
-        plugin_root_path = (storage_root_path / name).resolve(strict=False)
-        try:
-            plugin_root_path.relative_to(storage_root_path)
-        except ValueError:
-            return Response().error("Invalid name parameter").__dict__
-        plugin_root_path.mkdir(parents=True, exist_ok=True)
-
-        uploaded: list[str] = []
-        folder = config_key_to_folder(key_path)
-        errors: list[str] = []
-        for file in files.values():
-            filename = sanitize_filename(file.filename or "")
-            if not filename:
-                errors.append("Invalid filename")
-                continue
-
-            file_size = getattr(file, "content_length", None)
-            if isinstance(file_size, int) and file_size > MAX_FILE_BYTES:
-                errors.append(f"File too large: {filename}")
-                continue
-
-            ext = os.path.splitext(filename)[1].lstrip(".").lower()
-            if allowed_exts and ext not in allowed_exts:
-                errors.append(f"Unsupported file type: {filename}")
-                continue
-
-            rel_path = f"files/{folder}/{filename}"
-            save_path = (plugin_root_path / rel_path).resolve(strict=False)
-            try:
-                save_path.relative_to(plugin_root_path)
-            except ValueError:
-                errors.append(f"Invalid path: {filename}")
-                continue
-
-            save_path.parent.mkdir(parents=True, exist_ok=True)
-            await file.save(str(save_path))
-            if save_path.is_file() and save_path.stat().st_size > MAX_FILE_BYTES:
-                save_path.unlink()
-                errors.append(f"File too large: {filename}")
-                continue
-            uploaded.append(rel_path)
-
-        if not uploaded:
-            return (
-                Response()
-                .error(
-                    "Upload failed: " + ", ".join(errors)
-                    if errors
-                    else "Upload failed",
-                )
-                .__dict__
-            )
-
-        return Response().ok({"uploaded": uploaded, "errors": errors}).__dict__
-
-    async def delete_config_file(self):
-        """删除插件数据目录中的文件。"""
-
-        scope = request.args.get("scope") or "plugin"
-        name = request.args.get("name")
-        if not name:
-            return Response().error("Missing name parameter").__dict__
-        if scope != "plugin":
-            return Response().error(f"Unsupported scope: {scope}").__dict__
-
-        data = await request.get_json()
-        rel_path = data.get("path") if isinstance(data, dict) else None
-        rel_path = normalize_rel_path(rel_path)
-        if not rel_path or not rel_path.startswith("files/"):
-            return Response().error("Invalid path parameter").__dict__
-
-        md = self._get_plugin_metadata_by_name(name)
-        if not md:
-            return Response().error(f"Plugin {name} not found").__dict__
-
-        storage_root_path = Path(get_astrbot_plugin_data_path()).resolve(strict=False)
-        plugin_root_path = (storage_root_path / name).resolve(strict=False)
-        try:
-            plugin_root_path.relative_to(storage_root_path)
-        except ValueError:
-            return Response().error("Invalid name parameter").__dict__
-        target_path = (plugin_root_path / rel_path).resolve(strict=False)
-        try:
-            target_path.relative_to(plugin_root_path)
-        except ValueError:
-            return Response().error("Invalid path parameter").__dict__
-        if target_path.is_file():
-            target_path.unlink()
-
-        return Response().ok(None, "Deleted").__dict__
-
-    async def get_config_file_list(self):
-        """获取配置项对应目录下的文件列表。"""
-
-        try:
-            _, name, key_path, _, config = self._resolve_config_file_scope()
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-
-        meta = get_schema_item(getattr(config, "schema", None), key_path)
-        if not meta or meta.get("type") != "file":
-            return Response().error("Config item not found or not file type").__dict__
-
-        storage_root_path = Path(get_astrbot_plugin_data_path()).resolve(strict=False)
-        plugin_root_path = (storage_root_path / name).resolve(strict=False)
-        try:
-            plugin_root_path.relative_to(storage_root_path)
-        except ValueError:
-            return Response().error("Invalid name parameter").__dict__
-
-        folder = config_key_to_folder(key_path)
-        target_dir = (plugin_root_path / "files" / folder).resolve(strict=False)
-        try:
-            target_dir.relative_to(plugin_root_path)
-        except ValueError:
-            return Response().error("Invalid path parameter").__dict__
-
-        if not target_dir.exists() or not target_dir.is_dir():
-            return Response().ok({"files": []}).__dict__
-
-        files: list[str] = []
-        for path in target_dir.rglob("*"):
-            if not path.is_file():
-                continue
-            try:
-                rel_path = path.relative_to(plugin_root_path).as_posix()
-            except ValueError:
-                continue
-            if rel_path.startswith("files/"):
-                files.append(rel_path)
-
-        return Response().ok({"files": files}).__dict__
-
-    async def post_new_platform(self):
-        new_platform_config = await request.json
-
-        # 如果是支持统一 webhook 模式的平台，生成 webhook_uuid
-        ensure_platform_webhook_config(new_platform_config)
-
-        self.config["platform"].append(new_platform_config)
-        try:
-            save_config(self.config, self.config, is_core=True)
-            await self.core_lifecycle.platform_manager.load_platform(
-                new_platform_config,
-            )
-        except Exception as e:
-            return Response().error(str(e)).__dict__
-        return Response().ok(None, "新增平台配置成功~").__dict__
-
-    async def post_new_provider(self):
-        new_provider_config = await request.json
-
-        try:
-            await self.core_lifecycle.provider_manager.create_provider(
-                new_provider_config
-            )
-        except Exception as e:
-            return Response().error(str(e)).__dict__
-        return Response().ok(None, "新增服务提供商配置成功").__dict__
-
-    async def post_update_platform(self):
-        update_platform_config = await request.json
-        origin_platform_id = update_platform_config.get("id", None)
-        new_config = update_platform_config.get("config", None)
-        if not origin_platform_id or not new_config:
-            return Response().error("参数错误").__dict__
-
-        if origin_platform_id != new_config.get("id", None):
-            return Response().error("机器人名称不允许修改").__dict__
-
-        # 如果是支持统一 webhook 模式的平台，且启用了统一 webhook 模式，确保有 webhook_uuid
-        ensure_platform_webhook_config(new_config)
-
-        for i, platform in enumerate(self.config["platform"]):
-            if platform["id"] == origin_platform_id:
-                self.config["platform"][i] = new_config
-                break
-        else:
-            return Response().error("未找到对应平台").__dict__
-
-        try:
-            save_config(self.config, self.config, is_core=True)
-            await self.core_lifecycle.platform_manager.reload(new_config)
-        except Exception as e:
-            return Response().error(str(e)).__dict__
-        return Response().ok(None, "更新平台配置成功~").__dict__
-
-    async def post_update_provider(self):
-        update_provider_config = await request.json
-        origin_provider_id = update_provider_config.get("id", None)
-        new_config = update_provider_config.get("config", None)
-        if not origin_provider_id or not new_config:
-            return Response().error("参数错误").__dict__
-
-        try:
-            await self.core_lifecycle.provider_manager.update_provider(
-                origin_provider_id, new_config
-            )
-        except Exception as e:
-            return Response().error(str(e)).__dict__
-        return Response().ok(None, "更新成功，已经实时生效~").__dict__
-
-    async def post_delete_platform(self):
-        platform_id = await request.json
-        platform_id = platform_id.get("id")
-        for i, platform in enumerate(self.config["platform"]):
-            if platform["id"] == platform_id:
-                del self.config["platform"][i]
-                break
-        else:
-            return Response().error("未找到对应平台").__dict__
-        try:
-            save_config(self.config, self.config, is_core=True)
-            await self.core_lifecycle.platform_manager.terminate_platform(platform_id)
-        except Exception as e:
-            return Response().error(str(e)).__dict__
-        return Response().ok(None, "删除平台配置成功~").__dict__
-
-    async def post_delete_provider(self):
-        provider_id = await request.json
-        provider_id = provider_id.get("id", "")
-        if not provider_id:
-            return Response().error("缺少参数 id").__dict__
-
-        try:
-            await self.core_lifecycle.provider_manager.delete_provider(
-                provider_id=provider_id
-            )
-        except Exception as e:
-            return Response().error(str(e)).__dict__
-        return Response().ok(None, "删除成功，已经实时生效。").__dict__
-
-    async def get_llm_tools(self):
-        """获取函数调用工具。包含了本地加载的以及 MCP 服务的工具"""
-        tool_mgr = self.core_lifecycle.provider_manager.llm_tools
-        tools = tool_mgr.get_func_desc_openai_style()
-        return Response().ok(tools).__dict__
-
-    async def _register_platform_logo(self, platform, platform_default_tmpl) -> None:
-        """注册平台logo文件并生成访问令牌"""
-        if not platform.logo_path:
-            return
-
-        try:
-            # 检查缓存
-            cache_key = f"{platform.name}:{platform.logo_path}"
-            if cache_key in self._logo_token_cache:
-                cached_token = self._logo_token_cache[cache_key]
-                # 确保platform_default_tmpl[platform.name]存在且为字典
-                if platform.name not in platform_default_tmpl or not isinstance(
-                    platform_default_tmpl[platform.name], dict
-                ):
-                    platform_default_tmpl[platform.name] = {}
-                platform_default_tmpl[platform.name]["logo_token"] = cached_token
-                logger.debug(f"Using cached logo token for platform {platform.name}")
-                return
-
-            # 获取平台适配器类
-            platform_cls = platform_cls_map.get(platform.name)
-            if not platform_cls:
-                logger.warning(f"Platform class not found for {platform.name}")
-                return
-
-            # 获取插件目录路径
-            module_file = inspect.getfile(platform_cls)
-            plugin_dir = os.path.dirname(module_file)
-
-            # 解析logo文件路径
-            logo_file_path = os.path.join(plugin_dir, platform.logo_path)
-
-            # 检查文件是否存在并注册令牌
-            if os.path.exists(logo_file_path):
-                logo_token = await file_token_service.register_file(
-                    logo_file_path,
-                    timeout=3600,
-                )
-
-                # 确保platform_default_tmpl[platform.name]存在且为字典
-                if platform.name not in platform_default_tmpl or not isinstance(
-                    platform_default_tmpl[platform.name], dict
-                ):
-                    platform_default_tmpl[platform.name] = {}
-
-                platform_default_tmpl[platform.name]["logo_token"] = logo_token
-
-                # 缓存token
-                self._logo_token_cache[cache_key] = logo_token
-
-                logger.debug(f"Logo token registered for platform {platform.name}")
-            else:
-                logger.warning(
-                    f"Platform {platform.name} logo file not found: {logo_file_path}",
-                )
-
-        except (ImportError, AttributeError) as e:
-            logger.warning(
-                f"Failed to import required modules for platform {platform.name}: {e}",
-            )
-        except OSError as e:
-            logger.warning(f"File system error for platform {platform.name} logo: {e}")
-        except Exception as e:
-            logger.warning(
-                f"Unexpected error registering logo for platform {platform.name}: {e}",
-            )
-
-    def _inject_platform_metadata_with_i18n(
-        self, platform, metadata, platform_i18n_translations: dict
-    ):
-        """将配置元数据注入到 metadata 中并处理国际化键转换。"""
-        metadata["platform_group"]["metadata"]["platform"].setdefault("items", {})
-        platform_items_to_inject = copy.deepcopy(platform.config_metadata)
-
-        if platform.i18n_resources:
-            i18n_prefix = f"platform_group.platform.{platform.name}"
-
-            for lang, lang_data in platform.i18n_resources.items():
-                platform_i18n_translations.setdefault(lang, {}).setdefault(
-                    "platform_group", {}
-                ).setdefault("platform", {})[platform.name] = lang_data
-
-            for field_key, field_value in platform_items_to_inject.items():
-                for key in ("description", "hint", "labels"):
-                    if key in field_value:
-                        field_value[key] = f"{i18n_prefix}.{field_key}.{key}"
-
-        metadata["platform_group"]["metadata"]["platform"]["items"].update(
-            platform_items_to_inject
-        )
-
-    async def _get_astrbot_config(self):
-        config = self.config
-        metadata = copy.deepcopy(CONFIG_METADATA_2)
-        platform_i18n = ConfigMetadataI18n.convert_to_i18n_keys(
-            {
-                "platform_group": {
-                    "metadata": {
-                        "platform": metadata["platform_group"]["metadata"]["platform"]
-                    }
-                }
-            }
-        )
-        metadata["platform_group"]["metadata"]["platform"] = platform_i18n[
-            "platform_group"
-        ]["metadata"]["platform"]
-
-        # 平台适配器的默认配置模板注入
-        platform_default_tmpl = metadata["platform_group"]["metadata"]["platform"][
-            "config_template"
-        ]
-
-        # 收集平台的 i18n 翻译数据
-        platform_i18n_translations = {}
-
-        # 收集需要注册logo的平台
-        logo_registration_tasks = []
-        for platform in platform_registry:
-            if platform.default_config_tmpl:
-                platform_default_tmpl[platform.name] = copy.deepcopy(
-                    platform.default_config_tmpl
-                )
-
-                # 注入配置元数据（在 convert_to_i18n_keys 之后，使用国际化键）
-                if platform.config_metadata:
-                    self._inject_platform_metadata_with_i18n(
-                        platform, metadata, platform_i18n_translations
-                    )
-
-                # 收集logo注册任务
-                if platform.logo_path:
-                    logo_registration_tasks.append(
-                        self._register_platform_logo(platform, platform_default_tmpl),
-                    )
-
-        # 并行执行logo注册
-        if logo_registration_tasks:
-            await asyncio.gather(*logo_registration_tasks, return_exceptions=True)
-
-        # 服务提供商的默认配置模板注入
-        provider_default_tmpl = metadata["provider_group"]["metadata"]["provider"][
-            "config_template"
-        ]
-        for provider in provider_registry:
-            if provider.default_config_tmpl:
-                provider_default_tmpl[provider.type] = provider.default_config_tmpl
-
-        return {
-            "metadata": metadata,
-            "config": config,
-            "platform_i18n_translations": platform_i18n_translations,
-        }
-
-    async def _get_plugin_config(self, plugin_name: str):
-        ret: dict = {"metadata": None, "config": None, "i18n": {}}
-
-        for plugin_md in star_registry:
-            if plugin_md.name == plugin_name:
-                if not plugin_md.config:
-                    break
-                ret["config"] = (
-                    plugin_md.config
-                )  # 这是自定义的 Dict 类（AstrBotConfig）
-                ret["metadata"] = {
-                    plugin_name: {
-                        "description": f"{plugin_name} 配置",
-                        "type": "object",
-                        "items": plugin_md.config.schema,  # 初始化时通过 __setattr__ 存入了 schema
-                    },
-                }
-                ret["i18n"] = plugin_md.i18n
-                break
-
-        return ret
-
-    async def _save_astrbot_configs(
-        self, post_configs: dict, conf_id: str | None = None
-    ) -> None:
-        try:
-            if conf_id not in self.acm.confs:
-                raise ValueError(f"配置文件 {conf_id} 不存在")
-            astrbot_config = self.acm.confs[conf_id]
-
-            # 保留服务端的 t2i_active_template 值
-            if "t2i_active_template" in astrbot_config:
-                post_configs["t2i_active_template"] = astrbot_config[
-                    "t2i_active_template"
-                ]
-
-            save_config(post_configs, astrbot_config, is_core=True)
-        except Exception as e:
-            raise e
-
-    async def _save_plugin_configs(self, post_configs: dict, plugin_name: str) -> None:
-        md = None
-        for plugin_md in star_registry:
-            if plugin_md.name == plugin_name:
-                md = plugin_md
-
-        if not md:
-            raise ValueError(f"插件 {plugin_name} 不存在")
-        if not md.config:
-            raise ValueError(f"插件 {plugin_name} 没有注册配置")
-        assert md.config is not None
-
-        try:
-            errors, post_configs = validate_config(
-                post_configs, getattr(md.config, "schema", {}), is_core=False
-            )
-            if errors:
-                raise ValueError(f"格式校验未通过: {errors}")
-            md.config.save_config(post_configs)
-        except Exception as e:
-            raise e
diff --git a/astrbot/dashboard/routes/conversation.py b/astrbot/dashboard/routes/conversation.py
deleted file mode 100644
index e15837fd8..000000000
--- a/astrbot/dashboard/routes/conversation.py
+++ /dev/null
@@ -1,402 +0,0 @@
-import json
-import traceback
-from dataclasses import asdict
-from datetime import datetime
-from io import BytesIO
-
-from quart import request, send_file
-
-from astrbot.core import logger
-from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
-from astrbot.core.db import BaseDatabase
-from astrbot.core.umo_alias import build_umo_alias_map, parse_umo, serialize_umo_alias
-
-from .route import Response, Route, RouteContext
-
-
-class ConversationRoute(Route):
-    def __init__(
-        self,
-        context: RouteContext,
-        db_helper: BaseDatabase,
-        core_lifecycle: AstrBotCoreLifecycle,
-    ) -> None:
-        super().__init__(context)
-        self.routes = {
-            "/conversation/list": ("GET", self.list_conversations),
-            "/conversation/detail": (
-                "POST",
-                self.get_conv_detail,
-            ),
-            "/conversation/update": ("POST", self.upd_conv),
-            "/conversation/delete": ("POST", self.del_conv),
-            "/conversation/update_history": (
-                "POST",
-                self.update_history,
-            ),
-            "/conversation/export": ("POST", self.export_conversations),
-        }
-        self.db_helper = db_helper
-        self.conv_mgr = core_lifecycle.conversation_manager
-        self.core_lifecycle = core_lifecycle
-        self.register_routes()
-
-    def _build_umo_info(self, umo: str | None, alias_map: dict) -> dict:
-        umo_str = umo or ""
-        return {
-            "umo": umo_str,
-            **parse_umo(umo_str),
-            **serialize_umo_alias(alias_map.get(umo_str), umo_str),
-        }
-
-    def _serialize_conversation(self, conversation, alias_map: dict) -> dict:
-        return {
-            **asdict(conversation),
-            "umo_info": self._build_umo_info(conversation.user_id, alias_map),
-        }
-
-    async def list_conversations(self):
-        """获取对话列表，支持分页、排序和筛选"""
-        try:
-            # 获取分页参数
-            page = request.args.get("page", 1, type=int)
-            page_size = request.args.get("page_size", 20, type=int)
-
-            # 获取筛选参数
-            platforms = request.args.get("platforms", "")
-            message_types = request.args.get("message_types", "")
-            search_query = request.args.get("search", "")
-            exclude_ids = request.args.get("exclude_ids", "")
-            exclude_platforms = request.args.get("exclude_platforms", "")
-
-            # 转换为列表
-            platform_list = platforms.split(",") if platforms else []
-            message_type_list = message_types.split(",") if message_types else []
-            exclude_id_list = exclude_ids.split(",") if exclude_ids else []
-            exclude_platform_list = (
-                exclude_platforms.split(",") if exclude_platforms else []
-            )
-
-            page = max(page, 1)
-            if page_size < 1:
-                page_size = 20
-            page_size = min(page_size, 100)
-
-            try:
-                (
-                    conversations,
-                    total_count,
-                ) = await self.conv_mgr.get_filtered_conversations(
-                    page=page,
-                    page_size=page_size,
-                    platforms=platform_list,
-                    message_types=message_type_list,
-                    search_query=search_query,
-                    exclude_ids=exclude_id_list,
-                    exclude_platforms=exclude_platform_list,
-                )
-            except Exception as e:
-                logger.error(f"数据库查询出错: {e!s}\n{traceback.format_exc()}")
-                return Response().error(f"数据库查询出错: {e!s}").__dict__
-
-            # 计算总页数
-            total_pages = (
-                (total_count + page_size - 1) // page_size if total_count > 0 else 1
-            )
-            umos = sorted({conv.user_id for conv in conversations if conv.user_id})
-            alias_map = build_umo_alias_map(await self.db_helper.get_umo_aliases(umos))
-
-            result = {
-                "conversations": [
-                    self._serialize_conversation(conversation, alias_map)
-                    for conversation in conversations
-                ],
-                "pagination": {
-                    "page": page,
-                    "page_size": page_size,
-                    "total": total_count,
-                    "total_pages": total_pages,
-                },
-            }
-            return Response().ok(result).__dict__
-
-        except Exception as e:
-            error_msg = f"获取对话列表失败: {e!s}\n{traceback.format_exc()}"
-            logger.error(error_msg)
-            return Response().error(f"获取对话列表失败: {e!s}").__dict__
-
-    async def get_conv_detail(self):
-        """获取指定对话详情（通过POST请求）"""
-        try:
-            data = await request.get_json()
-            user_id = data.get("user_id")
-            cid = data.get("cid")
-
-            if not user_id or not cid:
-                return Response().error("缺少必要参数: user_id 和 cid").__dict__
-
-            conversation = await self.conv_mgr.get_conversation(
-                unified_msg_origin=user_id,
-                conversation_id=cid,
-            )
-            if not conversation:
-                return Response().error("对话不存在").__dict__
-
-            alias_map = build_umo_alias_map(
-                await self.db_helper.get_umo_aliases([user_id])
-            )
-            return (
-                Response()
-                .ok(
-                    {
-                        "user_id": user_id,
-                        "cid": cid,
-                        "title": conversation.title,
-                        "persona_id": conversation.persona_id,
-                        "history": conversation.history,
-                        "created_at": conversation.created_at,
-                        "updated_at": conversation.updated_at,
-                        "umo_info": self._build_umo_info(user_id, alias_map),
-                    },
-                )
-                .__dict__
-            )
-
-        except Exception as e:
-            logger.error(f"获取对话详情失败: {e!s}\n{traceback.format_exc()}")
-            return Response().error(f"获取对话详情失败: {e!s}").__dict__
-
-    async def upd_conv(self):
-        """更新对话信息(标题和角色ID)"""
-        try:
-            data = await request.get_json()
-            user_id = data.get("user_id")
-            cid = data.get("cid")
-            title = data.get("title")
-
-            if not user_id or not cid:
-                return Response().error("缺少必要参数: user_id 和 cid").__dict__
-            conversation = await self.conv_mgr.get_conversation(
-                unified_msg_origin=user_id,
-                conversation_id=cid,
-            )
-            if not conversation:
-                return Response().error("对话不存在").__dict__
-
-            persona_id = data.get("persona_id", conversation.persona_id)
-
-            if title is not None or persona_id is not None:
-                await self.conv_mgr.update_conversation(
-                    unified_msg_origin=user_id,
-                    conversation_id=cid,
-                    title=title,
-                    persona_id=persona_id,
-                )
-            return Response().ok({"message": "对话信息更新成功"}).__dict__
-
-        except Exception as e:
-            logger.error(f"更新对话信息失败: {e!s}\n{traceback.format_exc()}")
-            return Response().error(f"更新对话信息失败: {e!s}").__dict__
-
-    async def del_conv(self):
-        """删除对话"""
-        try:
-            data = await request.get_json()
-
-            # 检查是否是批量删除
-            if "conversations" in data:
-                # 批量删除
-                conversations = data.get("conversations", [])
-                if not conversations:
-                    return (
-                        Response().error("批量删除时conversations参数不能为空").__dict__
-                    )
-
-                deleted_count = 0
-                failed_items = []
-
-                for conv in conversations:
-                    user_id = conv.get("user_id")
-                    cid = conv.get("cid")
-
-                    if not user_id or not cid:
-                        failed_items.append(
-                            f"user_id:{user_id}, cid:{cid} - 缺少必要参数",
-                        )
-                        continue
-
-                    try:
-                        await self.core_lifecycle.conversation_manager.delete_conversation(
-                            unified_msg_origin=user_id,
-                            conversation_id=cid,
-                        )
-                        deleted_count += 1
-                    except Exception as e:
-                        failed_items.append(f"user_id:{user_id}, cid:{cid} - {e!s}")
-
-                message = f"成功删除 {deleted_count} 个对话"
-                if failed_items:
-                    message += f"，失败 {len(failed_items)} 个"
-
-                return (
-                    Response()
-                    .ok(
-                        {
-                            "message": message,
-                            "deleted_count": deleted_count,
-                            "failed_count": len(failed_items),
-                            "failed_items": failed_items,
-                        },
-                    )
-                    .__dict__
-                )
-            # 单个删除
-            user_id = data.get("user_id")
-            cid = data.get("cid")
-
-            if not user_id or not cid:
-                return Response().error("缺少必要参数: user_id 和 cid").__dict__
-
-            await self.core_lifecycle.conversation_manager.delete_conversation(
-                unified_msg_origin=user_id,
-                conversation_id=cid,
-            )
-            return Response().ok({"message": "对话删除成功"}).__dict__
-
-        except Exception as e:
-            logger.error(f"删除对话失败: {e!s}\n{traceback.format_exc()}")
-            return Response().error(f"删除对话失败: {e!s}").__dict__
-
-    async def update_history(self):
-        """更新对话历史内容"""
-        try:
-            data = await request.get_json()
-            user_id = data.get("user_id")
-            cid = data.get("cid")
-            history = data.get("history")
-
-            if not user_id or not cid:
-                return Response().error("缺少必要参数: user_id 和 cid").__dict__
-
-            if history is None:
-                return Response().error("缺少必要参数: history").__dict__
-
-            # 历史记录必须是合法的 JSON 字符串
-            try:
-                if isinstance(history, list):
-                    history = json.dumps(history)
-                else:
-                    # 验证是否为有效的 JSON 字符串
-                    json.loads(history)
-            except json.JSONDecodeError:
-                return (
-                    Response().error("history 必须是有效的 JSON 字符串或数组").__dict__
-                )
-
-            conversation = await self.conv_mgr.get_conversation(
-                unified_msg_origin=user_id,
-                conversation_id=cid,
-            )
-            if not conversation:
-                return Response().error("对话不存在").__dict__
-
-            history = json.loads(history) if isinstance(history, str) else history
-
-            await self.conv_mgr.update_conversation(
-                unified_msg_origin=user_id,
-                conversation_id=cid,
-                history=history,
-            )
-
-            return Response().ok({"message": "对话历史更新成功"}).__dict__
-
-        except Exception as e:
-            logger.error(f"更新对话历史失败: {e!s}\n{traceback.format_exc()}")
-            return Response().error(f"更新对话历史失败: {e!s}").__dict__
-
-    async def export_conversations(self):
-        """批量导出对话为 JSONL 格式"""
-        try:
-            data = await request.get_json()
-            conversations_to_export = data.get("conversations", [])
-
-            if not conversations_to_export:
-                return Response().error("导出列表不能为空").__dict__
-
-            # 收集所有对话的内容
-            jsonl_lines = []
-            exported_count = 0
-            failed_items = []
-
-            for conv_info in conversations_to_export:
-                user_id = conv_info.get("user_id")
-                cid = conv_info.get("cid")
-
-                if not user_id or not cid:
-                    failed_items.append(
-                        f"user_id:{user_id}, cid:{cid} - 缺少必要参数",
-                    )
-                    continue
-
-                try:
-                    conversation = await self.conv_mgr.get_conversation(
-                        unified_msg_origin=user_id,
-                        conversation_id=cid,
-                    )
-
-                    if not conversation:
-                        failed_items.append(
-                            f"user_id:{user_id}, cid:{cid} - 对话不存在"
-                        )
-                        continue
-
-                    # 解析对话内容 (history is always a JSON string from _convert_conv_from_v2_to_v1)
-                    content = json.loads(conversation.history)
-
-                    # 创建导出记录
-                    export_record = {
-                        "cid": cid,
-                        "user_id": user_id,
-                        "platform_id": conversation.platform_id,
-                        "title": conversation.title,
-                        "persona_id": conversation.persona_id,
-                        "created_at": conversation.created_at,
-                        "updated_at": conversation.updated_at,
-                        "content": content,
-                    }
-
-                    # 将记录转换为 JSON 字符串并添加到 JSONL
-                    jsonl_lines.append(json.dumps(export_record, ensure_ascii=False))
-                    exported_count += 1
-
-                except Exception as e:
-                    failed_items.append(f"user_id:{user_id}, cid:{cid} - {e!s}")
-                    logger.error(
-                        f"导出对话失败: user_id={user_id}, cid={cid}, error={e!s}"
-                    )
-
-            if exported_count == 0:
-                return Response().error("没有成功导出任何对话").__dict__
-
-            # 创建 JSONL 内容
-            jsonl_content = "\n".join(jsonl_lines)
-
-            # 创建一个内存文件对象
-            file_obj = BytesIO(jsonl_content.encode("utf-8"))
-            file_obj.seek(0)
-
-            # 生成文件名
-            timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
-            filename = f"astrbot_conversations_export_{timestamp}.jsonl"
-
-            # 返回文件流
-            return await send_file(
-                file_obj,
-                mimetype="application/jsonl",
-                as_attachment=True,
-                attachment_filename=filename,
-            )
-
-        except Exception as e:
-            logger.error(f"批量导出对话失败: {e!s}\n{traceback.format_exc()}")
-            return Response().error(f"批量导出对话失败: {e!s}").__dict__
diff --git a/astrbot/dashboard/routes/cron.py b/astrbot/dashboard/routes/cron.py
deleted file mode 100644
index 85dbc2509..000000000
--- a/astrbot/dashboard/routes/cron.py
+++ /dev/null
@@ -1,301 +0,0 @@
-import asyncio
-import traceback
-from datetime import datetime, timezone
-
-from quart import jsonify, request
-
-from astrbot.core import logger
-from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
-
-from .route import Response, Route, RouteContext
-
-
-class CronRoute(Route):
-    def __init__(
-        self, context: RouteContext, core_lifecycle: AstrBotCoreLifecycle
-    ) -> None:
-        super().__init__(context)
-        self.core_lifecycle = core_lifecycle
-        self._background_tasks: set[asyncio.Task] = set()
-        self.routes = [
-            ("/cron/jobs", ("GET", self.list_jobs)),
-            ("/cron/jobs", ("POST", self.create_job)),
-            ("/cron/jobs/<job_id>", ("PATCH", self.update_job)),
-            ("/cron/jobs/<job_id>", ("DELETE", self.delete_job)),
-            ("/cron/jobs/<job_id>/run", ("POST", self.run_job_now)),
-        ]
-        self.register_routes()
-
-    def _serialize_job(self, job) -> dict:
-        data = job.model_dump() if hasattr(job, "model_dump") else job.__dict__
-        for k in ["created_at", "updated_at", "last_run_at", "next_run_time"]:
-            v = data.get(k)
-            if isinstance(v, datetime):
-                # Attach UTC
-                if v.tzinfo is None:
-                    v = v.replace(tzinfo=timezone.utc)
-                data[k] = v.isoformat()
-        # expose note explicitly for UI (prefer payload.note then description)
-        payload = data.get("payload") or {}
-        data["note"] = payload.get("note") or data.get("description") or ""
-        data["run_at"] = payload.get("run_at")
-        data["run_once"] = data.get("run_once", False)
-        # status is internal; hide to avoid implying one-time completion for recurring jobs
-        data.pop("status", None)
-        return data
-
-    async def list_jobs(self):
-        try:
-            cron_mgr = self.core_lifecycle.cron_manager
-            if cron_mgr is None:
-                return jsonify(
-                    Response().error("Cron manager not initialized").__dict__
-                )
-            job_type = request.args.get("type")
-            jobs = await cron_mgr.list_jobs(job_type)
-            data = [self._serialize_job(j) for j in jobs]
-            return jsonify(Response().ok(data=data).__dict__)
-        except Exception as e:  # noqa: BLE001
-            logger.error(traceback.format_exc())
-            return jsonify(Response().error(f"Failed to list jobs: {e!s}").__dict__)
-
-    async def create_job(self):
-        try:
-            cron_mgr = self.core_lifecycle.cron_manager
-            if cron_mgr is None:
-                return jsonify(
-                    Response().error("Cron manager not initialized").__dict__
-                )
-
-            payload = await request.json
-            if not isinstance(payload, dict):
-                return jsonify(Response().error("Invalid payload").__dict__)
-
-            name = payload.get("name") or "active_agent_task"
-            cron_expression = payload.get("cron_expression")
-            note = payload.get("note") or payload.get("description") or name
-            session = str(payload.get("session") or "").strip()
-            persona_id = payload.get("persona_id")
-            provider_id = payload.get("provider_id")
-            timezone = payload.get("timezone")
-            enabled = bool(payload.get("enabled", True))
-            run_once = bool(payload.get("run_once", False))
-            run_at = payload.get("run_at")
-
-            if run_once and not run_at:
-                return jsonify(
-                    Response().error("run_at is required when run_once=true").__dict__
-                )
-            if (not run_once) and not cron_expression:
-                return jsonify(
-                    Response()
-                    .error("cron_expression is required when run_once=false")
-                    .__dict__
-                )
-            if run_once and cron_expression:
-                cron_expression = None  # ignore cron when run_once specified
-            run_at_dt = None
-            if run_at:
-                try:
-                    run_at_dt = datetime.fromisoformat(str(run_at))
-                except Exception:
-                    return jsonify(
-                        Response().error("run_at must be ISO datetime").__dict__
-                    )
-
-            job_payload = {
-                "session": session,
-                "note": note,
-                "persona_id": persona_id,
-                "provider_id": provider_id,
-                "run_at": run_at,
-                "origin": "api",
-            }
-
-            job = await cron_mgr.add_active_job(
-                name=name,
-                cron_expression=cron_expression,
-                payload=job_payload,
-                description=note,
-                timezone=timezone,
-                enabled=enabled,
-                run_once=run_once,
-                run_at=run_at_dt,
-            )
-
-            return jsonify(Response().ok(data=self._serialize_job(job)).__dict__)
-        except Exception as e:  # noqa: BLE001
-            logger.error(traceback.format_exc())
-            return jsonify(Response().error(f"Failed to create job: {e!s}").__dict__)
-
-    async def update_job(self, job_id: str):
-        try:
-            cron_mgr = self.core_lifecycle.cron_manager
-            if cron_mgr is None:
-                return jsonify(
-                    Response().error("Cron manager not initialized").__dict__
-                )
-
-            payload = await request.json
-            if not isinstance(payload, dict):
-                return jsonify(Response().error("Invalid payload").__dict__)
-
-            job = await cron_mgr.db.get_cron_job(job_id)
-            if not job:
-                return jsonify(Response().error("Job not found").__dict__)
-
-            updates = {}
-            if "name" in payload:
-                name = str(payload.get("name") or "").strip()
-                if not name:
-                    return jsonify(Response().error("name cannot be empty").__dict__)
-                updates["name"] = name
-
-            if "enabled" in payload:
-                updates["enabled"] = bool(payload.get("enabled"))
-
-            if "timezone" in payload:
-                timezone = payload.get("timezone")
-                updates["timezone"] = str(timezone).strip() or None
-
-            next_run_once = (
-                bool(payload.get("run_once"))
-                if "run_once" in payload
-                else bool(job.run_once)
-            )
-
-            if job.job_type == "active_agent":
-                merged_payload = (
-                    dict(job.payload) if isinstance(job.payload, dict) else {}
-                )
-                if "payload" in payload and isinstance(payload.get("payload"), dict):
-                    merged_payload.update(payload["payload"])
-
-                if "session" in payload:
-                    session = str(payload.get("session") or "").strip()
-                    if session:
-                        merged_payload["session"] = session
-                    else:
-                        merged_payload.pop("session", None)
-
-                note_updated = False
-                if "note" in payload:
-                    note = str(payload.get("note") or "").strip()
-                    if not note:
-                        return jsonify(
-                            Response().error("note cannot be empty").__dict__
-                        )
-                    merged_payload["note"] = note
-                    updates["description"] = note
-                    note_updated = True
-                elif "description" in payload:
-                    description = str(payload.get("description") or "").strip()
-                    if not description:
-                        return jsonify(
-                            Response().error("description cannot be empty").__dict__
-                        )
-                    updates["description"] = description
-                    merged_payload["note"] = description
-                    note_updated = True
-
-                if not note_updated and updates.get("description") is None:
-                    existing_note = str(
-                        merged_payload.get("note") or job.description or ""
-                    ).strip()
-                    if existing_note:
-                        merged_payload["note"] = existing_note
-
-                next_cron_expression = (
-                    payload.get("cron_expression")
-                    if "cron_expression" in payload
-                    else job.cron_expression
-                )
-                if next_cron_expression is not None:
-                    next_cron_expression = str(next_cron_expression).strip() or None
-
-                run_at_raw = (
-                    payload.get("run_at")
-                    if "run_at" in payload
-                    else merged_payload.get("run_at")
-                )
-                run_at_iso = None
-                if run_at_raw:
-                    try:
-                        run_at_iso = datetime.fromisoformat(str(run_at_raw)).isoformat()
-                    except Exception:
-                        return jsonify(
-                            Response().error("run_at must be ISO datetime").__dict__
-                        )
-
-                if next_run_once:
-                    if not run_at_iso:
-                        return jsonify(
-                            Response()
-                            .error("run_at is required when run_once=true")
-                            .__dict__
-                        )
-                    next_cron_expression = None
-                    merged_payload["run_at"] = run_at_iso
-                else:
-                    if not next_cron_expression:
-                        return jsonify(
-                            Response()
-                            .error("cron_expression is required when run_once=false")
-                            .__dict__
-                        )
-                    merged_payload.pop("run_at", None)
-
-                updates["run_once"] = next_run_once
-                updates["cron_expression"] = next_cron_expression
-                updates["payload"] = merged_payload
-            else:
-                if "cron_expression" in payload:
-                    cron_expression = str(payload.get("cron_expression") or "").strip()
-                    if not cron_expression:
-                        return jsonify(
-                            Response().error("cron_expression cannot be empty").__dict__
-                        )
-                    updates["cron_expression"] = cron_expression
-
-                if "description" in payload:
-                    description = str(payload.get("description") or "").strip()
-                    updates["description"] = description or None
-
-            job = await cron_mgr.update_job(job_id, **updates)
-            if not job:
-                return jsonify(Response().error("Job not found").__dict__)
-            return jsonify(Response().ok(data=self._serialize_job(job)).__dict__)
-        except Exception as e:  # noqa: BLE001
-            logger.error(traceback.format_exc())
-            return jsonify(Response().error(f"Failed to update job: {e!s}").__dict__)
-
-    async def delete_job(self, job_id: str):
-        try:
-            cron_mgr = self.core_lifecycle.cron_manager
-            if cron_mgr is None:
-                return jsonify(
-                    Response().error("Cron manager not initialized").__dict__
-                )
-            await cron_mgr.delete_job(job_id)
-            return jsonify(Response().ok(message="deleted").__dict__)
-        except Exception as e:  # noqa: BLE001
-            logger.error(traceback.format_exc())
-            return jsonify(Response().error(f"Failed to delete job: {e!s}").__dict__)
-
-    async def run_job_now(self, job_id: str):
-        try:
-            cron_mgr = self.core_lifecycle.cron_manager
-            if cron_mgr is None:
-                return jsonify(
-                    Response().error("Cron manager not initialized").__dict__
-                )
-            job = await cron_mgr.db.get_cron_job(job_id)
-            if not job:
-                return jsonify(Response().error("Job not found").__dict__)
-            task = asyncio.create_task(cron_mgr.run_job_now(job_id))
-            self._background_tasks.add(task)
-            task.add_done_callback(self._background_tasks.discard)
-            return jsonify(Response().ok(message="started").__dict__)
-        except Exception as e:  # noqa: BLE001
-            logger.error(traceback.format_exc())
-            return jsonify(Response().error(f"Failed to run job: {e!s}").__dict__)
diff --git a/astrbot/dashboard/routes/file.py b/astrbot/dashboard/routes/file.py
deleted file mode 100644
index 1880150bf..000000000
--- a/astrbot/dashboard/routes/file.py
+++ /dev/null
@@ -1,24 +0,0 @@
-from quart import abort, send_file
-
-from astrbot.core import file_token_service
-
-from .route import Route, RouteContext
-
-
-class FileRoute(Route):
-    def __init__(
-        self,
-        context: RouteContext,
-    ) -> None:
-        super().__init__(context)
-        self.routes = {
-            "/file/<file_token>": ("GET", self.serve_file),
-        }
-        self.register_routes()
-
-    async def serve_file(self, file_token: str):
-        try:
-            file_path = await file_token_service.handle_file(file_token)
-            return await send_file(file_path)
-        except (FileNotFoundError, KeyError):
-            return abort(404)
diff --git a/astrbot/dashboard/routes/knowledge_base.py b/astrbot/dashboard/routes/knowledge_base.py
deleted file mode 100644
index 1b6f7a435..000000000
--- a/astrbot/dashboard/routes/knowledge_base.py
+++ /dev/null
@@ -1,1288 +0,0 @@
-"""知识库管理 API 路由"""
-
-import asyncio
-import os
-import traceback
-import uuid
-from typing import Any
-
-import aiofiles
-from quart import request
-
-from astrbot.core import logger
-from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
-from astrbot.core.provider.provider import EmbeddingProvider, RerankProvider
-from astrbot.core.utils.astrbot_path import get_astrbot_temp_path
-
-from ..utils import generate_tsne_visualization
-from .route import Response, Route, RouteContext
-
-
-class KnowledgeBaseRoute(Route):
-    """知识库管理路由
-
-    提供知识库、文档、检索、会话配置等 API 接口
-    """
-
-    def __init__(
-        self,
-        context: RouteContext,
-        core_lifecycle: AstrBotCoreLifecycle,
-    ) -> None:
-        super().__init__(context)
-        self.core_lifecycle = core_lifecycle
-        self.kb_manager = None  # 延迟初始化
-        self.kb_db = None
-        self.session_config_db = None  # 会话配置数据库
-        self.retrieval_manager = None
-        self.upload_progress = {}  # 存储上传进度 {task_id: {status, file_index, file_total, stage, current, total}}
-        self.upload_tasks = {}  # 存储后台上传任务 {task_id: {"status", "result", "error"}}
-
-        # 注册路由
-        self.routes = {
-            # 知识库管理
-            "/kb/list": ("GET", self.list_kbs),
-            "/kb/create": ("POST", self.create_kb),
-            "/kb/get": ("GET", self.get_kb),
-            "/kb/update": ("POST", self.update_kb),
-            "/kb/delete": ("POST", self.delete_kb),
-            "/kb/stats": ("GET", self.get_kb_stats),
-            # 文档管理
-            "/kb/document/list": ("GET", self.list_documents),
-            "/kb/document/upload": ("POST", self.upload_document),
-            "/kb/document/import": ("POST", self.import_documents),
-            "/kb/document/upload/url": ("POST", self.upload_document_from_url),
-            "/kb/document/upload/progress": ("GET", self.get_upload_progress),
-            "/kb/document/get": ("GET", self.get_document),
-            "/kb/document/delete": ("POST", self.delete_document),
-            # # 块管理
-            "/kb/chunk/list": ("GET", self.list_chunks),
-            "/kb/chunk/delete": ("POST", self.delete_chunk),
-            # # 多媒体管理
-            # "/kb/media/list": ("GET", self.list_media),
-            # "/kb/media/delete": ("POST", self.delete_media),
-            # 检索
-            "/kb/retrieve": ("POST", self.retrieve),
-        }
-        self.register_routes()
-
-    def _get_kb_manager(self):
-        return self.core_lifecycle.kb_manager
-
-    def _init_task(self, task_id: str, status: str = "pending") -> None:
-        self.upload_tasks[task_id] = {
-            "status": status,
-            "result": None,
-            "error": None,
-        }
-
-    def _set_task_result(
-        self, task_id: str, status: str, result: Any = None, error: str | None = None
-    ) -> None:
-        self.upload_tasks[task_id] = {
-            "status": status,
-            "result": result,
-            "error": error,
-        }
-        if task_id in self.upload_progress:
-            self.upload_progress[task_id]["status"] = status
-
-    def _update_progress(
-        self,
-        task_id: str,
-        *,
-        status: str | None = None,
-        file_index: int | None = None,
-        file_name: str | None = None,
-        stage: str | None = None,
-        current: int | None = None,
-        total: int | None = None,
-    ) -> None:
-        if task_id not in self.upload_progress:
-            return
-        p = self.upload_progress[task_id]
-        if status is not None:
-            p["status"] = status
-        if file_index is not None:
-            p["file_index"] = file_index
-        if file_name is not None:
-            p["file_name"] = file_name
-        if stage is not None:
-            p["stage"] = stage
-        if current is not None:
-            p["current"] = current
-        if total is not None:
-            p["total"] = total
-
-    def _make_progress_callback(self, task_id: str, file_idx: int, file_name: str):
-        async def _callback(stage: str, current: int, total: int) -> None:
-            self._update_progress(
-                task_id,
-                status="processing",
-                file_index=file_idx,
-                file_name=file_name,
-                stage=stage,
-                current=current,
-                total=total,
-            )
-
-        return _callback
-
-    @staticmethod
-    def _format_failed_doc_error(file_name: str, error: Exception) -> str:
-        message = str(error).strip() or "上传失败：发生未知错误。"
-        if message.startswith(file_name):
-            return message
-        return f"{file_name}: {message}"
-
-    async def _background_upload_task(
-        self,
-        task_id: str,
-        kb_helper,
-        files_to_upload: list,
-        chunk_size: int,
-        chunk_overlap: int,
-        batch_size: int,
-        tasks_limit: int,
-        max_retries: int,
-    ) -> None:
-        """后台上传任务"""
-        try:
-            # 初始化任务状态
-            self._init_task(task_id, status="processing")
-            self.upload_progress[task_id] = {
-                "status": "processing",
-                "file_index": 0,
-                "file_total": len(files_to_upload),
-                "stage": "waiting",
-                "current": 0,
-                "total": 100,
-            }
-
-            uploaded_docs = []
-            failed_docs = []
-
-            for file_idx, file_info in enumerate(files_to_upload):
-                try:
-                    # 更新整体进度
-                    self._update_progress(
-                        task_id,
-                        status="processing",
-                        file_index=file_idx,
-                        file_name=file_info["file_name"],
-                        stage="parsing",
-                        current=0,
-                        total=100,
-                    )
-
-                    # 创建进度回调函数
-                    progress_callback = self._make_progress_callback(
-                        task_id, file_idx, file_info["file_name"]
-                    )
-
-                    doc = await kb_helper.upload_document(
-                        file_name=file_info["file_name"],
-                        file_content=file_info["file_content"],
-                        file_type=file_info["file_type"],
-                        chunk_size=chunk_size,
-                        chunk_overlap=chunk_overlap,
-                        batch_size=batch_size,
-                        tasks_limit=tasks_limit,
-                        max_retries=max_retries,
-                        progress_callback=progress_callback,
-                    )
-
-                    uploaded_docs.append(doc.model_dump())
-                except Exception as e:
-                    logger.error(f"上传文档 {file_info['file_name']} 失败: {e}")
-                    failed_docs.append(
-                        {
-                            "file_name": file_info["file_name"],
-                            "error": self._format_failed_doc_error(
-                                file_info["file_name"], e
-                            ),
-                        },
-                    )
-
-            # 更新任务完成状态
-            result = {
-                "task_id": task_id,
-                "uploaded": uploaded_docs,
-                "failed": failed_docs,
-                "total": len(files_to_upload),
-                "success_count": len(uploaded_docs),
-                "failed_count": len(failed_docs),
-            }
-
-            self._set_task_result(task_id, "completed", result=result)
-
-        except Exception as e:
-            logger.error(f"后台上传任务 {task_id} 失败: {e}")
-            logger.error(traceback.format_exc())
-            self._set_task_result(task_id, "failed", error=str(e))
-
-    async def _background_import_task(
-        self,
-        task_id: str,
-        kb_helper,
-        documents: list,
-        batch_size: int,
-        tasks_limit: int,
-        max_retries: int,
-    ) -> None:
-        """后台导入预切片文档任务"""
-        try:
-            # 初始化任务状态
-            self._init_task(task_id, status="processing")
-            self.upload_progress[task_id] = {
-                "status": "processing",
-                "file_index": 0,
-                "file_total": len(documents),
-                "stage": "waiting",
-                "current": 0,
-                "total": 100,
-            }
-
-            uploaded_docs = []
-            failed_docs = []
-
-            for file_idx, doc_info in enumerate(documents):
-                file_name = doc_info.get("file_name", f"imported_doc_{file_idx}")
-                chunks = doc_info.get("chunks", [])
-
-                try:
-                    # 更新整体进度
-                    self._update_progress(
-                        task_id,
-                        status="processing",
-                        file_index=file_idx,
-                        file_name=file_name,
-                        stage="importing",
-                        current=0,
-                        total=100,
-                    )
-
-                    # 创建进度回调函数
-                    progress_callback = self._make_progress_callback(
-                        task_id, file_idx, file_name
-                    )
-
-                    # 调用 upload_document，传入 pre_chunked_text
-                    doc = await kb_helper.upload_document(
-                        file_name=file_name,
-                        file_content=None,  # 预切片模式下不需要原始内容
-                        file_type=doc_info.get("file_type")
-                        or (
-                            file_name.rsplit(".", 1)[-1].lower()
-                            if "." in file_name
-                            else "txt"
-                        ),
-                        batch_size=batch_size,
-                        tasks_limit=tasks_limit,
-                        max_retries=max_retries,
-                        progress_callback=progress_callback,
-                        pre_chunked_text=chunks,
-                    )
-
-                    uploaded_docs.append(doc.model_dump())
-                except Exception as e:
-                    logger.error(f"导入文档 {file_name} 失败: {e}")
-                    failed_docs.append(
-                        {
-                            "file_name": file_name,
-                            "error": self._format_failed_doc_error(file_name, e),
-                        },
-                    )
-
-            # 更新任务完成状态
-            result = {
-                "task_id": task_id,
-                "uploaded": uploaded_docs,
-                "failed": failed_docs,
-                "total": len(documents),
-                "success_count": len(uploaded_docs),
-                "failed_count": len(failed_docs),
-            }
-
-            self._set_task_result(task_id, "completed", result=result)
-
-        except Exception as e:
-            logger.error(f"后台导入任务 {task_id} 失败: {e}")
-            logger.error(traceback.format_exc())
-            self._set_task_result(task_id, "failed", error=str(e))
-
-    async def list_kbs(self):
-        """获取知识库列表
-
-        Query 参数:
-        - page: 页码 (默认 1)
-        - page_size: 每页数量 (默认 20)
-        - refresh_stats: 是否刷新统计信息 (默认 false，首次加载时可设为 true)
-        """
-        try:
-            kb_manager = self._get_kb_manager()
-            page = request.args.get("page", 1, type=int)
-            page_size = request.args.get("page_size", 20, type=int)
-
-            kbs = await kb_manager.list_kbs()
-
-            # 转换为字典列表
-            kb_list = []
-            for kb in kbs:
-                kb_dict = kb.model_dump()
-                # include init_error from KBHelper if present
-                kb_helper = await kb_manager.get_kb(kb.kb_id)
-                if kb_helper and kb_helper.init_error:
-                    kb_dict["init_error"] = kb_helper.init_error
-                kb_list.append(kb_dict)
-
-            return (
-                Response()
-                .ok({"items": kb_list, "page": page, "page_size": page_size})
-                .__dict__
-            )
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-        except Exception as e:
-            logger.error(f"获取知识库列表失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"获取知识库列表失败: {e!s}").__dict__
-
-    async def create_kb(self):
-        """创建知识库
-
-        Body:
-        - kb_name: 知识库名称 (必填)
-        - description: 描述 (可选)
-        - emoji: 图标 (可选)
-        - embedding_provider_id: 嵌入模型提供商ID (可选)
-        - rerank_provider_id: 重排序模型提供商ID (可选)
-        - chunk_size: 分块大小 (可选, 默认512)
-        - chunk_overlap: 块重叠大小 (可选, 默认50)
-        - top_k_dense: 密集检索数量 (可选, 默认50)
-        - top_k_sparse: 稀疏检索数量 (可选, 默认50)
-        - top_m_final: 最终返回数量 (可选, 默认5)
-        """
-        try:
-            kb_manager = self._get_kb_manager()
-            data = await request.json
-            kb_name = data.get("kb_name")
-            if not kb_name:
-                return Response().error("知识库名称不能为空").__dict__
-
-            description = data.get("description")
-            emoji = data.get("emoji")
-            embedding_provider_id = data.get("embedding_provider_id")
-            rerank_provider_id = data.get("rerank_provider_id")
-            chunk_size = data.get("chunk_size")
-            chunk_overlap = data.get("chunk_overlap")
-            top_k_dense = data.get("top_k_dense")
-            top_k_sparse = data.get("top_k_sparse")
-            top_m_final = data.get("top_m_final")
-
-            # pre-check embedding dim
-            if not embedding_provider_id:
-                return Response().error("缺少参数 embedding_provider_id").__dict__
-            prv = await kb_manager.provider_manager.get_provider_by_id(
-                embedding_provider_id,
-            )  # type: ignore
-            if not prv or not isinstance(prv, EmbeddingProvider):
-                return (
-                    Response().error(f"嵌入模型不存在或类型错误({type(prv)})").__dict__
-                )
-            try:
-                vec = await prv.get_embedding("astrbot")
-                if len(vec) != prv.get_dim():
-                    raise ValueError(
-                        f"嵌入向量维度不匹配，实际是 {len(vec)}，然而配置是 {prv.get_dim()}",
-                    )
-            except Exception as e:
-                return Response().error(f"测试嵌入模型失败: {e!s}").__dict__
-            # pre-check rerank
-            if rerank_provider_id:
-                rerank_prv: RerankProvider = (
-                    await kb_manager.provider_manager.get_provider_by_id(
-                        rerank_provider_id,
-                    )
-                )  # type: ignore
-                if not rerank_prv:
-                    return Response().error("重排序模型不存在").__dict__
-                # 检查重排序模型可用性
-                try:
-                    res = await rerank_prv.rerank(
-                        query="astrbot",
-                        documents=["astrbot knowledge base"],
-                    )
-                    if not res:
-                        raise ValueError("重排序模型返回结果异常")
-                except Exception as e:
-                    return (
-                        Response()
-                        .error(f"测试重排序模型失败: {e!s}，请检查平台日志输出。")
-                        .__dict__
-                    )
-
-            kb_helper = await kb_manager.create_kb(
-                kb_name=kb_name,
-                description=description,
-                emoji=emoji,
-                embedding_provider_id=embedding_provider_id,
-                rerank_provider_id=rerank_provider_id,
-                chunk_size=chunk_size,
-                chunk_overlap=chunk_overlap,
-                top_k_dense=top_k_dense,
-                top_k_sparse=top_k_sparse,
-                top_m_final=top_m_final,
-            )
-            kb = kb_helper.kb
-
-            return Response().ok(kb.model_dump(), "创建知识库成功").__dict__
-
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-        except Exception as e:
-            logger.error(f"创建知识库失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"创建知识库失败: {e!s}").__dict__
-
-    async def get_kb(self):
-        """获取知识库详情
-
-        Query 参数:
-        - kb_id: 知识库 ID (必填)
-        """
-        try:
-            kb_manager = self._get_kb_manager()
-            kb_id = request.args.get("kb_id")
-            if not kb_id:
-                return Response().error("缺少参数 kb_id").__dict__
-
-            kb_helper = await kb_manager.get_kb(kb_id)
-            if not kb_helper:
-                return Response().error("知识库不存在").__dict__
-            kb = kb_helper.kb
-
-            return Response().ok(kb.model_dump()).__dict__
-
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-        except Exception as e:
-            logger.error(f"获取知识库详情失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"获取知识库详情失败: {e!s}").__dict__
-
-    async def update_kb(self):
-        """更新知识库
-
-        Body:
-        - kb_id: 知识库 ID (必填)
-        - kb_name: 新的知识库名称 (可选)
-        - description: 新的描述 (可选)
-        - emoji: 新的图标 (可选)
-        - embedding_provider_id: 新的嵌入模型提供商ID (可选)
-        - rerank_provider_id: 新的重排序模型提供商ID (可选)
-        - chunk_size: 分块大小 (可选)
-        - chunk_overlap: 块重叠大小 (可选)
-        - top_k_dense: 密集检索数量 (可选)
-        - top_k_sparse: 稀疏检索数量 (可选)
-        - top_m_final: 最终返回数量 (可选)
-        """
-        try:
-            kb_manager = self._get_kb_manager()
-            data = await request.json
-
-            kb_id = data.get("kb_id")
-            if not kb_id:
-                return Response().error("缺少参数 kb_id").__dict__
-
-            kb_name = data.get("kb_name")
-            description = data.get("description")
-            emoji = data.get("emoji")
-            embedding_provider_id = data.get("embedding_provider_id")
-            rerank_provider_id = data.get("rerank_provider_id")
-            chunk_size = data.get("chunk_size")
-            chunk_overlap = data.get("chunk_overlap")
-            top_k_dense = data.get("top_k_dense")
-            top_k_sparse = data.get("top_k_sparse")
-            top_m_final = data.get("top_m_final")
-
-            # 检查是否至少提供了一个更新字段
-            if all(
-                v is None
-                for v in [
-                    kb_name,
-                    description,
-                    emoji,
-                    embedding_provider_id,
-                    rerank_provider_id,
-                    chunk_size,
-                    chunk_overlap,
-                    top_k_dense,
-                    top_k_sparse,
-                    top_m_final,
-                ]
-            ):
-                return Response().error("至少需要提供一个更新字段").__dict__
-
-            kb_helper = await kb_manager.update_kb(
-                kb_id=kb_id,
-                kb_name=kb_name,
-                description=description,
-                emoji=emoji,
-                embedding_provider_id=embedding_provider_id,
-                rerank_provider_id=rerank_provider_id,
-                chunk_size=chunk_size,
-                chunk_overlap=chunk_overlap,
-                top_k_dense=top_k_dense,
-                top_k_sparse=top_k_sparse,
-                top_m_final=top_m_final,
-            )
-
-            if not kb_helper:
-                return Response().error("知识库不存在").__dict__
-
-            kb = kb_helper.kb
-            return Response().ok(kb.model_dump(), "更新知识库成功").__dict__
-
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-        except Exception as e:
-            logger.error(f"更新知识库失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"更新知识库失败: {e!s}").__dict__
-
-    async def delete_kb(self):
-        """删除知识库
-
-        Body:
-        - kb_id: 知识库 ID (必填)
-        """
-        try:
-            kb_manager = self._get_kb_manager()
-            data = await request.json
-
-            kb_id = data.get("kb_id")
-            if not kb_id:
-                return Response().error("缺少参数 kb_id").__dict__
-
-            success = await kb_manager.delete_kb(kb_id)
-            if not success:
-                return Response().error("知识库不存在").__dict__
-
-            return Response().ok(message="删除知识库成功").__dict__
-
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-        except Exception as e:
-            logger.error(f"删除知识库失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"删除知识库失败: {e!s}").__dict__
-
-    async def get_kb_stats(self):
-        """获取知识库统计信息
-
-        Query 参数:
-        - kb_id: 知识库 ID (必填)
-        """
-        try:
-            kb_manager = self._get_kb_manager()
-            kb_id = request.args.get("kb_id")
-            if not kb_id:
-                return Response().error("缺少参数 kb_id").__dict__
-
-            kb_helper = await kb_manager.get_kb(kb_id)
-            if not kb_helper:
-                return Response().error("知识库不存在").__dict__
-            kb = kb_helper.kb
-
-            stats = {
-                "kb_id": kb.kb_id,
-                "kb_name": kb.kb_name,
-                "doc_count": kb.doc_count,
-                "chunk_count": kb.chunk_count,
-                "created_at": kb.created_at.isoformat(),
-                "updated_at": kb.updated_at.isoformat(),
-            }
-
-            return Response().ok(stats).__dict__
-
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-        except Exception as e:
-            logger.error(f"获取知识库统计失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"获取知识库统计失败: {e!s}").__dict__
-
-    # ===== 文档管理 API =====
-
-    async def list_documents(self):
-        """获取文档列表
-
-        Query 参数:
-        - kb_id: 知识库 ID (必填)
-        - page: 页码 (默认 1)
-        - page_size: 每页数量 (默认 20)
-        """
-        try:
-            kb_manager = self._get_kb_manager()
-            kb_id = request.args.get("kb_id")
-            if not kb_id:
-                return Response().error("缺少参数 kb_id").__dict__
-            kb_helper = await kb_manager.get_kb(kb_id)
-            if not kb_helper:
-                return Response().error("知识库不存在").__dict__
-
-            page = request.args.get("page", 1, type=int)
-            page_size = request.args.get("page_size", 100, type=int)
-
-            offset = (page - 1) * page_size
-            limit = page_size
-
-            doc_list = await kb_helper.list_documents(offset=offset, limit=limit)
-
-            doc_list = [doc.model_dump() for doc in doc_list]
-
-            return (
-                Response()
-                .ok({"items": doc_list, "page": page, "page_size": page_size})
-                .__dict__
-            )
-
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-        except Exception as e:
-            logger.error(f"获取文档列表失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"获取文档列表失败: {e!s}").__dict__
-
-    async def upload_document(self):
-        """上传文档
-
-        支持两种方式:
-        1. multipart/form-data 文件上传（支持多文件，最多10个）
-        2. JSON 格式 base64 编码上传（支持多文件，最多10个）
-
-        Form Data (multipart/form-data):
-        - kb_id: 知识库 ID (必填)
-        - file: 文件对象 (必填，可多个，字段名为 file, file1, file2, ... 或 files[])
-
-        JSON Body (application/json):
-        - kb_id: 知识库 ID (必填)
-        - files: 文件数组 (必填)
-          - file_name: 文件名 (必填)
-          - file_content: base64 编码的文件内容 (必填)
-
-        返回:
-        - task_id: 任务ID，用于查询上传进度和结果
-        """
-        try:
-            kb_manager = self._get_kb_manager()
-
-            # 检查 Content-Type
-            content_type = request.content_type
-            kb_id = None
-            chunk_size = None
-            chunk_overlap = None
-            batch_size = 32
-            tasks_limit = 3
-            max_retries = 3
-            files_to_upload = []  # 存储待上传的文件信息列表
-
-            if content_type and "multipart/form-data" not in content_type:
-                return (
-                    Response().error("Content-Type 须为 multipart/form-data").__dict__
-                )
-            form_data = await request.form
-            files = await request.files
-
-            kb_id = form_data.get("kb_id")
-            chunk_size = int(form_data.get("chunk_size", 512))
-            chunk_overlap = int(form_data.get("chunk_overlap", 50))
-            batch_size = int(form_data.get("batch_size", 32))
-            tasks_limit = int(form_data.get("tasks_limit", 3))
-            max_retries = int(form_data.get("max_retries", 3))
-            if not kb_id:
-                return Response().error("缺少参数 kb_id").__dict__
-
-            # 收集所有文件
-            file_list = []
-            # 支持 file, file1, file2, ... 或 files[] 格式
-            for key in files.keys():
-                if key == "file" or key.startswith("file") or key == "files[]":
-                    file_items = files.getlist(key)
-                    file_list.extend(file_items)
-
-            if not file_list:
-                return Response().error("缺少文件").__dict__
-
-            # 限制文件数量
-            if len(file_list) > 10:
-                return Response().error("最多只能上传10个文件").__dict__
-
-            # 处理每个文件
-            for file in file_list:
-                file_name = file.filename
-
-                # 保存到临时文件
-                temp_file_path = os.path.join(
-                    get_astrbot_temp_path(),
-                    f"kb_upload_{uuid.uuid4()}_{file_name}",
-                )
-                await file.save(temp_file_path)
-
-                try:
-                    # 异步读取文件内容
-                    async with aiofiles.open(temp_file_path, "rb") as f:
-                        file_content = await f.read()
-
-                    # 提取文件类型
-                    file_type = (
-                        file_name.rsplit(".", 1)[-1].lower() if "." in file_name else ""
-                    )
-
-                    files_to_upload.append(
-                        {
-                            "file_name": file_name,
-                            "file_content": file_content,
-                            "file_type": file_type,
-                        },
-                    )
-                finally:
-                    # 清理临时文件
-                    if os.path.exists(temp_file_path):
-                        os.remove(temp_file_path)
-
-            # 获取知识库
-            kb_helper = await kb_manager.get_kb(kb_id)
-            if not kb_helper:
-                return Response().error("知识库不存在").__dict__
-
-            # 生成任务ID
-            task_id = str(uuid.uuid4())
-
-            # 初始化任务状态
-            self._init_task(task_id, status="pending")
-
-            # 启动后台任务
-            asyncio.create_task(
-                self._background_upload_task(
-                    task_id=task_id,
-                    kb_helper=kb_helper,
-                    files_to_upload=files_to_upload,
-                    chunk_size=chunk_size,
-                    chunk_overlap=chunk_overlap,
-                    batch_size=batch_size,
-                    tasks_limit=tasks_limit,
-                    max_retries=max_retries,
-                ),
-            )
-
-            return (
-                Response()
-                .ok(
-                    {
-                        "task_id": task_id,
-                        "file_count": len(files_to_upload),
-                        "message": "task created, processing in background",
-                    },
-                )
-                .__dict__
-            )
-
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-        except Exception as e:
-            logger.error(f"上传文档失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"上传文档失败: {e!s}").__dict__
-
-    def _validate_import_request(self, data: dict):
-        kb_id = data.get("kb_id")
-        if not kb_id:
-            raise ValueError("缺少参数 kb_id")
-
-        documents = data.get("documents")
-        if not documents or not isinstance(documents, list):
-            raise ValueError("缺少参数 documents 或格式错误")
-
-        for doc in documents:
-            if "file_name" not in doc or "chunks" not in doc:
-                raise ValueError("文档格式错误，必须包含 file_name 和 chunks")
-            if not isinstance(doc["chunks"], list):
-                raise ValueError("chunks 必须是列表")
-            if not all(
-                isinstance(chunk, str) and chunk.strip() for chunk in doc["chunks"]
-            ):
-                raise ValueError("chunks 必须是非空字符串列表")
-
-        batch_size = data.get("batch_size", 32)
-        tasks_limit = data.get("tasks_limit", 3)
-        max_retries = data.get("max_retries", 3)
-        return kb_id, documents, batch_size, tasks_limit, max_retries
-
-    async def import_documents(self):
-        """导入预切片文档
-
-        Body:
-        - kb_id: 知识库 ID (必填)
-        - documents: 文档列表 (必填)
-            - file_name: 文件名 (必填)
-            - chunks: 切片列表 (必填, list[str])
-            - file_type: 文件类型 (可选, 默认从文件名推断或为 txt)
-        - batch_size: 批处理大小 (可选, 默认32)
-        - tasks_limit: 并发任务限制 (可选, 默认3)
-        - max_retries: 最大重试次数 (可选, 默认3)
-        """
-        try:
-            kb_manager = self._get_kb_manager()
-            data = await request.json
-
-            kb_id, documents, batch_size, tasks_limit, max_retries = (
-                self._validate_import_request(data)
-            )
-
-            # 获取知识库
-            kb_helper = await kb_manager.get_kb(kb_id)
-            if not kb_helper:
-                return Response().error("知识库不存在").__dict__
-
-            # 生成任务ID
-            task_id = str(uuid.uuid4())
-
-            # 初始化任务状态
-            self._init_task(task_id, status="pending")
-
-            # 启动后台任务
-            asyncio.create_task(
-                self._background_import_task(
-                    task_id=task_id,
-                    kb_helper=kb_helper,
-                    documents=documents,
-                    batch_size=batch_size,
-                    tasks_limit=tasks_limit,
-                    max_retries=max_retries,
-                ),
-            )
-
-            return (
-                Response()
-                .ok(
-                    {
-                        "task_id": task_id,
-                        "doc_count": len(documents),
-                        "message": "import task created, processing in background",
-                    },
-                )
-                .__dict__
-            )
-
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-        except Exception as e:
-            logger.error(f"导入文档失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"导入文档失败: {e!s}").__dict__
-
-    async def get_upload_progress(self):
-        """获取上传进度和结果
-
-        Query 参数:
-        - task_id: 任务 ID (必填)
-
-        返回状态:
-        - pending: 任务待处理
-        - processing: 任务处理中
-        - completed: 任务完成
-        - failed: 任务失败
-        """
-        try:
-            task_id = request.args.get("task_id")
-            if not task_id:
-                return Response().error("缺少参数 task_id").__dict__
-
-            # 检查任务是否存在
-            if task_id not in self.upload_tasks:
-                return Response().error("找不到该任务").__dict__
-
-            task_info = self.upload_tasks[task_id]
-            status = task_info["status"]
-
-            # 构建返回数据
-            response_data = {
-                "task_id": task_id,
-                "status": status,
-            }
-
-            # 如果任务正在处理，返回进度信息
-            if status == "processing" and task_id in self.upload_progress:
-                response_data["progress"] = self.upload_progress[task_id]
-
-            # 如果任务完成，返回结果
-            if status == "completed":
-                response_data["result"] = task_info["result"]
-                # 清理已完成的任务
-                # del self.upload_tasks[task_id]
-                # if task_id in self.upload_progress:
-                #     del self.upload_progress[task_id]
-
-            # 如果任务失败，返回错误信息
-            if status == "failed":
-                response_data["error"] = task_info["error"]
-
-            return Response().ok(response_data).__dict__
-
-        except Exception as e:
-            logger.error(f"获取上传进度失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"获取上传进度失败: {e!s}").__dict__
-
-    async def get_document(self):
-        """获取文档详情
-
-        Query 参数:
-        - doc_id: 文档 ID (必填)
-        """
-        try:
-            kb_manager = self._get_kb_manager()
-            kb_id = request.args.get("kb_id")
-            if not kb_id:
-                return Response().error("缺少参数 kb_id").__dict__
-            doc_id = request.args.get("doc_id")
-            if not doc_id:
-                return Response().error("缺少参数 doc_id").__dict__
-            kb_helper = await kb_manager.get_kb(kb_id)
-            if not kb_helper:
-                return Response().error("知识库不存在").__dict__
-
-            doc = await kb_helper.get_document(doc_id)
-            if not doc:
-                return Response().error("文档不存在").__dict__
-
-            return Response().ok(doc.model_dump()).__dict__
-
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-        except Exception as e:
-            logger.error(f"获取文档详情失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"获取文档详情失败: {e!s}").__dict__
-
-    async def delete_document(self):
-        """删除文档
-
-        Body:
-        - kb_id: 知识库 ID (必填)
-        - doc_id: 文档 ID (必填)
-        """
-        try:
-            kb_manager = self._get_kb_manager()
-            data = await request.json
-
-            kb_id = data.get("kb_id")
-            if not kb_id:
-                return Response().error("缺少参数 kb_id").__dict__
-            doc_id = data.get("doc_id")
-            if not doc_id:
-                return Response().error("缺少参数 doc_id").__dict__
-
-            kb_helper = await kb_manager.get_kb(kb_id)
-            if not kb_helper:
-                return Response().error("知识库不存在").__dict__
-
-            await kb_helper.delete_document(doc_id)
-            return Response().ok(message="删除文档成功").__dict__
-
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-        except Exception as e:
-            logger.error(f"删除文档失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"删除文档失败: {e!s}").__dict__
-
-    async def delete_chunk(self):
-        """删除文本块
-
-        Body:
-        - kb_id: 知识库 ID (必填)
-        - chunk_id: 块 ID (必填)
-        """
-        try:
-            kb_manager = self._get_kb_manager()
-            data = await request.json
-
-            kb_id = data.get("kb_id")
-            if not kb_id:
-                return Response().error("缺少参数 kb_id").__dict__
-            chunk_id = data.get("chunk_id")
-            if not chunk_id:
-                return Response().error("缺少参数 chunk_id").__dict__
-            doc_id = data.get("doc_id")
-            if not doc_id:
-                return Response().error("缺少参数 doc_id").__dict__
-
-            kb_helper = await kb_manager.get_kb(kb_id)
-            if not kb_helper:
-                return Response().error("知识库不存在").__dict__
-
-            await kb_helper.delete_chunk(chunk_id, doc_id)
-            return Response().ok(message="删除文本块成功").__dict__
-
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-        except Exception as e:
-            logger.error(f"删除文本块失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"删除文本块失败: {e!s}").__dict__
-
-    async def list_chunks(self):
-        """获取块列表
-
-        Query 参数:
-        - kb_id: 知识库 ID (必填)
-        - page: 页码 (默认 1)
-        - page_size: 每页数量 (默认 20)
-        """
-        try:
-            kb_manager = self._get_kb_manager()
-            kb_id = request.args.get("kb_id")
-            doc_id = request.args.get("doc_id")
-            page = request.args.get("page", 1, type=int)
-            page_size = request.args.get("page_size", 100, type=int)
-            if not kb_id:
-                return Response().error("缺少参数 kb_id").__dict__
-            if not doc_id:
-                return Response().error("缺少参数 doc_id").__dict__
-            kb_helper = await kb_manager.get_kb(kb_id)
-            offset = (page - 1) * page_size
-            limit = page_size
-            if not kb_helper:
-                return Response().error("知识库不存在").__dict__
-            chunk_list = await kb_helper.get_chunks_by_doc_id(
-                doc_id=doc_id,
-                offset=offset,
-                limit=limit,
-            )
-            return (
-                Response()
-                .ok(
-                    data={
-                        "items": chunk_list,
-                        "page": page,
-                        "page_size": page_size,
-                        "total": await kb_helper.get_chunk_count_by_doc_id(doc_id),
-                    },
-                )
-                .__dict__
-            )
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-        except Exception as e:
-            logger.error(f"获取块列表失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"获取块列表失败: {e!s}").__dict__
-
-    # ===== 检索 API =====
-
-    async def retrieve(self):
-        """检索知识库
-
-        Body:
-        - query: 查询文本 (必填)
-        - kb_ids: 知识库 ID 列表 (必填)
-        - top_k: 返回结果数量 (可选, 默认 5)
-        - debug: 是否启用调试模式，返回 t-SNE 可视化图片 (可选, 默认 False)
-        """
-        try:
-            kb_manager = self._get_kb_manager()
-            data = await request.json
-
-            query = data.get("query")
-            kb_names = data.get("kb_names")
-            debug = data.get("debug", False)
-
-            if not query:
-                return Response().error("缺少参数 query").__dict__
-            if not kb_names or not isinstance(kb_names, list):
-                return Response().error("缺少参数 kb_names 或格式错误").__dict__
-
-            top_k = data.get("top_k", 5)
-
-            results = await kb_manager.retrieve(
-                query=query,
-                kb_names=kb_names,
-                top_m_final=top_k,
-            )
-            result_list = []
-            if results:
-                result_list = results["results"]
-
-            response_data = {
-                "results": result_list,
-                "total": len(result_list),
-                "query": query,
-            }
-
-            # Debug 模式：生成 t-SNE 可视化
-            if debug:
-                try:
-                    img_base64 = await generate_tsne_visualization(
-                        query,
-                        kb_names,
-                        kb_manager,
-                    )
-                    if img_base64:
-                        response_data["visualization"] = img_base64
-                except Exception as e:
-                    logger.error(f"生成 t-SNE 可视化失败: {e}")
-                    logger.error(traceback.format_exc())
-                    response_data["visualization_error"] = str(e)
-
-            return Response().ok(response_data).__dict__
-
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-        except Exception as e:
-            logger.error(f"检索失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"检索失败: {e!s}").__dict__
-
-    async def upload_document_from_url(self):
-        """从 URL 上传文档
-
-        Body:
-        - kb_id: 知识库 ID (必填)
-        - url: 要提取内容的网页 URL (必填)
-        - chunk_size: 分块大小 (可选, 默认512)
-        - chunk_overlap: 块重叠大小 (可选, 默认50)
-        - batch_size: 批处理大小 (可选, 默认32)
-        - tasks_limit: 并发任务限制 (可选, 默认3)
-        - max_retries: 最大重试次数 (可选, 默认3)
-
-        返回:
-        - task_id: 任务ID，用于查询上传进度和结果
-        """
-        try:
-            kb_manager = self._get_kb_manager()
-            data = await request.json
-
-            kb_id = data.get("kb_id")
-            if not kb_id:
-                return Response().error("缺少参数 kb_id").__dict__
-
-            url = data.get("url")
-            if not url:
-                return Response().error("缺少参数 url").__dict__
-
-            chunk_size = data.get("chunk_size", 512)
-            chunk_overlap = data.get("chunk_overlap", 50)
-            batch_size = data.get("batch_size", 32)
-            tasks_limit = data.get("tasks_limit", 3)
-            max_retries = data.get("max_retries", 3)
-            enable_cleaning = data.get("enable_cleaning", False)
-            cleaning_provider_id = data.get("cleaning_provider_id")
-
-            # 获取知识库
-            kb_helper = await kb_manager.get_kb(kb_id)
-            if not kb_helper:
-                return Response().error("知识库不存在").__dict__
-
-            # 生成任务ID
-            task_id = str(uuid.uuid4())
-
-            # 初始化任务状态
-            self._init_task(task_id, status="pending")
-
-            # 启动后台任务
-            asyncio.create_task(
-                self._background_upload_from_url_task(
-                    task_id=task_id,
-                    kb_helper=kb_helper,
-                    url=url,
-                    chunk_size=chunk_size,
-                    chunk_overlap=chunk_overlap,
-                    batch_size=batch_size,
-                    tasks_limit=tasks_limit,
-                    max_retries=max_retries,
-                    enable_cleaning=enable_cleaning,
-                    cleaning_provider_id=cleaning_provider_id,
-                ),
-            )
-
-            return (
-                Response()
-                .ok(
-                    {
-                        "task_id": task_id,
-                        "url": url,
-                        "message": "URL upload task created, processing in background",
-                    },
-                )
-                .__dict__
-            )
-
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-        except Exception as e:
-            logger.error(f"从URL上传文档失败: {e}")
-            logger.error(traceback.format_exc())
-            return Response().error(f"从URL上传文档失败: {e!s}").__dict__
-
-    async def _background_upload_from_url_task(
-        self,
-        task_id: str,
-        kb_helper,
-        url: str,
-        chunk_size: int,
-        chunk_overlap: int,
-        batch_size: int,
-        tasks_limit: int,
-        max_retries: int,
-        enable_cleaning: bool,
-        cleaning_provider_id: str | None,
-    ) -> None:
-        """后台上传URL任务"""
-        try:
-            # 初始化任务状态
-            self._init_task(task_id, status="processing")
-            self.upload_progress[task_id] = {
-                "status": "processing",
-                "file_index": 0,
-                "file_total": 1,
-                "file_name": f"URL: {url}",
-                "stage": "extracting",
-                "current": 0,
-                "total": 100,
-            }
-
-            # 创建进度回调函数
-            progress_callback = self._make_progress_callback(task_id, 0, f"URL: {url}")
-
-            # 上传文档
-            doc = await kb_helper.upload_from_url(
-                url=url,
-                chunk_size=chunk_size,
-                chunk_overlap=chunk_overlap,
-                batch_size=batch_size,
-                tasks_limit=tasks_limit,
-                max_retries=max_retries,
-                progress_callback=progress_callback,
-                enable_cleaning=enable_cleaning,
-                cleaning_provider_id=cleaning_provider_id,
-            )
-
-            # 更新任务完成状态
-            result = {
-                "task_id": task_id,
-                "uploaded": [doc.model_dump()],
-                "failed": [],
-                "total": 1,
-                "success_count": 1,
-                "failed_count": 0,
-            }
-
-            self._set_task_result(task_id, "completed", result=result)
-
-        except Exception as e:
-            logger.error(f"后台上传URL任务 {task_id} 失败: {e}")
-            logger.error(traceback.format_exc())
-            self._set_task_result(task_id, "failed", error=str(e))
diff --git a/astrbot/dashboard/routes/log.py b/astrbot/dashboard/routes/log.py
deleted file mode 100644
index e7eebef6e..000000000
--- a/astrbot/dashboard/routes/log.py
+++ /dev/null
@@ -1,144 +0,0 @@
-import asyncio
-import json
-import time
-from collections.abc import AsyncGenerator
-from typing import cast
-
-from quart import Response as QuartResponse
-from quart import make_response, request
-
-from astrbot.core import LogBroker, logger
-
-from .route import Response, Route, RouteContext
-
-
-def _format_log_sse(log: dict, ts: float) -> str:
-    """辅助函数：格式化 SSE 消息"""
-    payload = {
-        "type": "log",
-        **log,
-    }
-    return f"id: {ts}\ndata: {json.dumps(payload, ensure_ascii=False)}\n\n"
-
-
-class LogRoute(Route):
-    def __init__(self, context: RouteContext, log_broker: LogBroker) -> None:
-        super().__init__(context)
-        self.log_broker = log_broker
-        self.app.add_url_rule("/api/live-log", view_func=self.log, methods=["GET"])
-        self.app.add_url_rule(
-            "/api/log-history",
-            view_func=self.log_history,
-            methods=["GET"],
-        )
-        self.app.add_url_rule(
-            "/api/trace/settings",
-            view_func=self.get_trace_settings,
-            methods=["GET"],
-        )
-        self.app.add_url_rule(
-            "/api/trace/settings",
-            view_func=self.update_trace_settings,
-            methods=["POST"],
-        )
-
-    async def _replay_cached_logs(
-        self, last_event_id: str
-    ) -> AsyncGenerator[str, None]:
-        """辅助生成器：重放缓存的日志"""
-        try:
-            last_ts = float(last_event_id)
-            cached_logs = list(self.log_broker.log_cache)
-
-            for log_item in cached_logs:
-                log_ts = float(log_item.get("time", 0))
-
-                if log_ts > last_ts:
-                    yield _format_log_sse(log_item, log_ts)
-
-        except ValueError:
-            pass
-        except Exception as e:
-            logger.error(f"Log SSE 补发历史错误: {e}")
-
-    async def log(self) -> QuartResponse:
-        last_event_id = request.headers.get("Last-Event-ID")
-
-        async def stream():
-            queue = None
-            try:
-                if last_event_id:
-                    async for event in self._replay_cached_logs(last_event_id):
-                        yield event
-
-                queue = self.log_broker.register()
-                while True:
-                    message = await queue.get()
-                    current_ts = message.get("time", time.time())
-                    yield _format_log_sse(message, current_ts)
-
-            except asyncio.CancelledError:
-                pass
-            except Exception as e:
-                logger.error(f"Log SSE 连接错误: {e}")
-            finally:
-                if queue:
-                    self.log_broker.unregister(queue)
-
-        response = cast(
-            QuartResponse,
-            await make_response(
-                stream(),
-                {
-                    "Content-Type": "text/event-stream",
-                    "Cache-Control": "no-cache",
-                    "Connection": "keep-alive",
-                    "Transfer-Encoding": "chunked",
-                },
-            ),
-        )
-        response.timeout = None  # type: ignore
-        return response
-
-    async def log_history(self):
-        """获取日志历史"""
-        try:
-            logs = list(self.log_broker.log_cache)
-            return (
-                Response()
-                .ok(
-                    data={
-                        "logs": logs,
-                    },
-                )
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(f"获取日志历史失败: {e}")
-            return Response().error(f"获取日志历史失败: {e}").__dict__
-
-    async def get_trace_settings(self):
-        """获取 Trace 设置"""
-        try:
-            trace_enable = self.config.get("trace_enable", True)
-            return Response().ok(data={"trace_enable": trace_enable}).__dict__
-        except Exception as e:
-            logger.error(f"获取 Trace 设置失败: {e}")
-            return Response().error(f"获取 Trace 设置失败: {e}").__dict__
-
-    async def update_trace_settings(self):
-        """更新 Trace 设置"""
-        try:
-            data = await request.json
-            if data is None:
-                return Response().error("请求数据为空").__dict__
-
-            trace_enable = data.get("trace_enable")
-            if trace_enable is not None:
-                self.config["trace_enable"] = bool(trace_enable)
-                self.config.save_config()
-
-            return Response().ok(message="Trace 设置已更新").__dict__
-        except Exception as e:
-            logger.error(f"更新 Trace 设置失败: {e}")
-            return Response().error(f"更新 Trace 设置失败: {e}").__dict__
diff --git a/astrbot/dashboard/routes/persona.py b/astrbot/dashboard/routes/persona.py
deleted file mode 100644
index 8a805d432..000000000
--- a/astrbot/dashboard/routes/persona.py
+++ /dev/null
@@ -1,497 +0,0 @@
-import traceback
-
-from quart import request
-
-from astrbot.core import logger
-from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
-from astrbot.core.db import BaseDatabase
-from astrbot.core.sentinels import NOT_GIVEN
-
-from .route import Response, Route, RouteContext
-
-
-class PersonaRoute(Route):
-    def __init__(
-        self,
-        context: RouteContext,
-        db_helper: BaseDatabase,
-        core_lifecycle: AstrBotCoreLifecycle,
-    ) -> None:
-        super().__init__(context)
-        self.routes = {
-            "/persona/list": ("GET", self.list_personas),
-            "/persona/detail": ("POST", self.get_persona_detail),
-            "/persona/create": ("POST", self.create_persona),
-            "/persona/update": ("POST", self.update_persona),
-            "/persona/delete": ("POST", self.delete_persona),
-            "/persona/move": ("POST", self.move_persona),
-            "/persona/reorder": ("POST", self.reorder_items),
-            # Folder routes
-            "/persona/folder/list": ("GET", self.list_folders),
-            "/persona/folder/tree": ("GET", self.get_folder_tree),
-            "/persona/folder/detail": ("POST", self.get_folder_detail),
-            "/persona/folder/create": ("POST", self.create_folder),
-            "/persona/folder/update": ("POST", self.update_folder),
-            "/persona/folder/delete": ("POST", self.delete_folder),
-        }
-        self.db_helper = db_helper
-        self.persona_mgr = core_lifecycle.persona_mgr
-        self.register_routes()
-
-    async def list_personas(self):
-        """获取所有人格列表"""
-        try:
-            # 支持按文件夹筛选
-            folder_id = request.args.get("folder_id")
-            if folder_id is not None:
-                personas = await self.persona_mgr.get_personas_by_folder(
-                    folder_id if folder_id else None
-                )
-            else:
-                personas = await self.persona_mgr.get_all_personas()
-            return (
-                Response()
-                .ok(
-                    [
-                        {
-                            "persona_id": persona.persona_id,
-                            "system_prompt": persona.system_prompt,
-                            "begin_dialogs": persona.begin_dialogs or [],
-                            "tools": persona.tools,
-                            "skills": persona.skills,
-                            "custom_error_message": persona.custom_error_message,
-                            "folder_id": persona.folder_id,
-                            "sort_order": persona.sort_order,
-                            "created_at": persona.created_at.isoformat()
-                            if persona.created_at
-                            else None,
-                            "updated_at": persona.updated_at.isoformat()
-                            if persona.updated_at
-                            else None,
-                        }
-                        for persona in personas
-                    ],
-                )
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(f"获取人格列表失败: {e!s}\n{traceback.format_exc()}")
-            return Response().error(f"获取人格列表失败: {e!s}").__dict__
-
-    async def get_persona_detail(self):
-        """获取指定人格的详细信息"""
-        try:
-            data = await request.get_json()
-            persona_id = data.get("persona_id")
-
-            if not persona_id:
-                return Response().error("缺少必要参数: persona_id").__dict__
-
-            persona = await self.persona_mgr.get_persona(persona_id)
-            if not persona:
-                return Response().error("人格不存在").__dict__
-
-            return (
-                Response()
-                .ok(
-                    {
-                        "persona_id": persona.persona_id,
-                        "system_prompt": persona.system_prompt,
-                        "begin_dialogs": persona.begin_dialogs or [],
-                        "tools": persona.tools,
-                        "skills": persona.skills,
-                        "custom_error_message": persona.custom_error_message,
-                        "folder_id": persona.folder_id,
-                        "sort_order": persona.sort_order,
-                        "created_at": persona.created_at.isoformat()
-                        if persona.created_at
-                        else None,
-                        "updated_at": persona.updated_at.isoformat()
-                        if persona.updated_at
-                        else None,
-                    },
-                )
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(f"获取人格详情失败: {e!s}\n{traceback.format_exc()}")
-            return Response().error(f"获取人格详情失败: {e!s}").__dict__
-
-    async def create_persona(self):
-        """创建新人格"""
-        try:
-            data = await request.get_json()
-            persona_id = data.get("persona_id", "").strip()
-            system_prompt = data.get("system_prompt", "").strip()
-            begin_dialogs = data.get("begin_dialogs", [])
-            tools = data.get("tools")
-            skills = data.get("skills")
-            custom_error_message = data.get("custom_error_message")
-            folder_id = data.get("folder_id")  # None 表示根目录
-            sort_order = data.get("sort_order", 0)
-
-            if not persona_id:
-                return Response().error("人格ID不能为空").__dict__
-
-            if not system_prompt:
-                return Response().error("系统提示词不能为空").__dict__
-
-            if custom_error_message is not None:
-                if not isinstance(custom_error_message, str):
-                    return Response().error("自定义报错回复信息必须是字符串").__dict__
-                custom_error_message = custom_error_message.strip() or None
-
-            # 验证 begin_dialogs 格式
-            if begin_dialogs and len(begin_dialogs) % 2 != 0:
-                return (
-                    Response()
-                    .error("预设对话数量必须为偶数（用户和助手轮流对话）")
-                    .__dict__
-                )
-
-            persona = await self.persona_mgr.create_persona(
-                persona_id=persona_id,
-                system_prompt=system_prompt,
-                begin_dialogs=begin_dialogs if begin_dialogs else None,
-                tools=tools if tools else None,
-                skills=skills if skills else None,
-                custom_error_message=custom_error_message,
-                folder_id=folder_id,
-                sort_order=sort_order,
-            )
-
-            return (
-                Response()
-                .ok(
-                    {
-                        "message": "人格创建成功",
-                        "persona": {
-                            "persona_id": persona.persona_id,
-                            "system_prompt": persona.system_prompt,
-                            "begin_dialogs": persona.begin_dialogs or [],
-                            "tools": persona.tools or [],
-                            "skills": persona.skills or [],
-                            "custom_error_message": persona.custom_error_message,
-                            "folder_id": persona.folder_id,
-                            "sort_order": persona.sort_order,
-                            "created_at": persona.created_at.isoformat()
-                            if persona.created_at
-                            else None,
-                            "updated_at": persona.updated_at.isoformat()
-                            if persona.updated_at
-                            else None,
-                        },
-                    },
-                )
-                .__dict__
-            )
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-        except Exception as e:
-            logger.error(f"创建人格失败: {e!s}\n{traceback.format_exc()}")
-            return Response().error(f"创建人格失败: {e!s}").__dict__
-
-    async def update_persona(self):
-        """更新人格信息"""
-        try:
-            data = await request.get_json()
-            persona_id = data.get("persona_id")
-            system_prompt = data.get("system_prompt")
-            begin_dialogs = data.get("begin_dialogs")
-            has_tools = "tools" in data
-            tools = data.get("tools")
-            has_skills = "skills" in data
-            skills = data.get("skills")
-            has_custom_error_message = "custom_error_message" in data
-            custom_error_message = data.get("custom_error_message")
-
-            if not persona_id:
-                return Response().error("缺少必要参数: persona_id").__dict__
-
-            if has_custom_error_message:
-                if custom_error_message is not None and not isinstance(
-                    custom_error_message, str
-                ):
-                    return Response().error("自定义报错回复信息必须是字符串").__dict__
-                if isinstance(custom_error_message, str):
-                    custom_error_message = custom_error_message.strip() or None
-
-            # 验证 begin_dialogs 格式
-            if begin_dialogs is not None and len(begin_dialogs) % 2 != 0:
-                return (
-                    Response()
-                    .error("预设对话数量必须为偶数（用户和助手轮流对话）")
-                    .__dict__
-                )
-
-            update_kwargs = {
-                "persona_id": persona_id,
-                "system_prompt": system_prompt,
-                "begin_dialogs": begin_dialogs,
-            }
-            if has_tools:
-                update_kwargs["tools"] = tools
-            if has_skills:
-                update_kwargs["skills"] = skills
-            if has_custom_error_message:
-                update_kwargs["custom_error_message"] = custom_error_message
-
-            await self.persona_mgr.update_persona(**update_kwargs)
-
-            return Response().ok({"message": "人格更新成功"}).__dict__
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-        except Exception as e:
-            logger.error(f"更新人格失败: {e!s}\n{traceback.format_exc()}")
-            return Response().error(f"更新人格失败: {e!s}").__dict__
-
-    async def delete_persona(self):
-        """删除人格"""
-        try:
-            data = await request.get_json()
-            persona_id = data.get("persona_id")
-
-            if not persona_id:
-                return Response().error("缺少必要参数: persona_id").__dict__
-
-            await self.persona_mgr.delete_persona(persona_id)
-
-            return Response().ok({"message": "人格删除成功"}).__dict__
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-        except Exception as e:
-            logger.error(f"删除人格失败: {e!s}\n{traceback.format_exc()}")
-            return Response().error(f"删除人格失败: {e!s}").__dict__
-
-    async def move_persona(self):
-        """移动人格到指定文件夹"""
-        try:
-            data = await request.get_json()
-            persona_id = data.get("persona_id")
-            folder_id = data.get("folder_id")  # None 表示移动到根目录
-
-            if not persona_id:
-                return Response().error("缺少必要参数: persona_id").__dict__
-
-            await self.persona_mgr.move_persona_to_folder(persona_id, folder_id)
-
-            return Response().ok({"message": "人格移动成功"}).__dict__
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-        except Exception as e:
-            logger.error(f"移动人格失败: {e!s}\n{traceback.format_exc()}")
-            return Response().error(f"移动人格失败: {e!s}").__dict__
-
-    # ====
-    # Folder Routes
-    # ====
-
-    async def list_folders(self):
-        """获取文件夹列表"""
-        try:
-            parent_id = request.args.get("parent_id")
-            # 空字符串视为 None（根目录）
-            if parent_id == "":
-                parent_id = None
-            folders = await self.persona_mgr.get_folders(parent_id)
-            return (
-                Response()
-                .ok(
-                    [
-                        {
-                            "folder_id": folder.folder_id,
-                            "name": folder.name,
-                            "parent_id": folder.parent_id,
-                            "description": folder.description,
-                            "sort_order": folder.sort_order,
-                            "created_at": folder.created_at.isoformat()
-                            if folder.created_at
-                            else None,
-                            "updated_at": folder.updated_at.isoformat()
-                            if folder.updated_at
-                            else None,
-                        }
-                        for folder in folders
-                    ],
-                )
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(f"获取文件夹列表失败: {e!s}\n{traceback.format_exc()}")
-            return Response().error(f"获取文件夹列表失败: {e!s}").__dict__
-
-    async def get_folder_tree(self):
-        """获取文件夹树形结构"""
-        try:
-            tree = await self.persona_mgr.get_folder_tree()
-            return Response().ok(tree).__dict__
-        except Exception as e:
-            logger.error(f"获取文件夹树失败: {e!s}\n{traceback.format_exc()}")
-            return Response().error(f"获取文件夹树失败: {e!s}").__dict__
-
-    async def get_folder_detail(self):
-        """获取指定文件夹的详细信息"""
-        try:
-            data = await request.get_json()
-            folder_id = data.get("folder_id")
-
-            if not folder_id:
-                return Response().error("缺少必要参数: folder_id").__dict__
-
-            folder = await self.persona_mgr.get_folder(folder_id)
-            if not folder:
-                return Response().error("文件夹不存在").__dict__
-
-            return (
-                Response()
-                .ok(
-                    {
-                        "folder_id": folder.folder_id,
-                        "name": folder.name,
-                        "parent_id": folder.parent_id,
-                        "description": folder.description,
-                        "sort_order": folder.sort_order,
-                        "created_at": folder.created_at.isoformat()
-                        if folder.created_at
-                        else None,
-                        "updated_at": folder.updated_at.isoformat()
-                        if folder.updated_at
-                        else None,
-                    },
-                )
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(f"获取文件夹详情失败: {e!s}\n{traceback.format_exc()}")
-            return Response().error(f"获取文件夹详情失败: {e!s}").__dict__
-
-    async def create_folder(self):
-        """创建文件夹"""
-        try:
-            data = await request.get_json()
-            name = data.get("name", "").strip()
-            parent_id = data.get("parent_id")
-            description = data.get("description")
-            sort_order = data.get("sort_order", 0)
-
-            if not name:
-                return Response().error("文件夹名称不能为空").__dict__
-
-            folder = await self.persona_mgr.create_folder(
-                name=name,
-                parent_id=parent_id,
-                description=description,
-                sort_order=sort_order,
-            )
-
-            return (
-                Response()
-                .ok(
-                    {
-                        "message": "文件夹创建成功",
-                        "folder": {
-                            "folder_id": folder.folder_id,
-                            "name": folder.name,
-                            "parent_id": folder.parent_id,
-                            "description": folder.description,
-                            "sort_order": folder.sort_order,
-                            "created_at": folder.created_at.isoformat()
-                            if folder.created_at
-                            else None,
-                            "updated_at": folder.updated_at.isoformat()
-                            if folder.updated_at
-                            else None,
-                        },
-                    },
-                )
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(f"创建文件夹失败: {e!s}\n{traceback.format_exc()}")
-            return Response().error(f"创建文件夹失败: {e!s}").__dict__
-
-    async def update_folder(self):
-        """更新文件夹信息"""
-        try:
-            data = await request.get_json()
-            folder_id = data.get("folder_id")
-            name = data.get("name")
-            parent_id = data.get("parent_id") if "parent_id" in data else NOT_GIVEN
-            description = (
-                data.get("description") if "description" in data else NOT_GIVEN
-            )
-            sort_order = data.get("sort_order")
-
-            if not folder_id:
-                return Response().error("缺少必要参数: folder_id").__dict__
-
-            await self.persona_mgr.update_folder(
-                folder_id=folder_id,
-                name=name,
-                parent_id=parent_id,
-                description=description,
-                sort_order=sort_order,
-            )
-
-            return Response().ok({"message": "文件夹更新成功"}).__dict__
-        except Exception as e:
-            logger.error(f"更新文件夹失败: {e!s}\n{traceback.format_exc()}")
-            return Response().error(f"更新文件夹失败: {e!s}").__dict__
-
-    async def delete_folder(self):
-        """删除文件夹"""
-        try:
-            data = await request.get_json()
-            folder_id = data.get("folder_id")
-
-            if not folder_id:
-                return Response().error("缺少必要参数: folder_id").__dict__
-
-            await self.persona_mgr.delete_folder(folder_id)
-
-            return Response().ok({"message": "文件夹删除成功"}).__dict__
-        except Exception as e:
-            logger.error(f"删除文件夹失败: {e!s}\n{traceback.format_exc()}")
-            return Response().error(f"删除文件夹失败: {e!s}").__dict__
-
-    async def reorder_items(self):
-        """批量更新排序顺序
-
-        请求体格式:
-        {
-            "items": [
-                {"id": "persona_id_1", "type": "persona", "sort_order": 0},
-                {"id": "persona_id_2", "type": "persona", "sort_order": 1},
-                {"id": "folder_id_1", "type": "folder", "sort_order": 0},
-                ...
-            ]
-        }
-        """
-        try:
-            data = await request.get_json()
-            items = data.get("items", [])
-
-            if not items:
-                return Response().error("items 不能为空").__dict__
-
-            # 验证每个 item 的格式
-            for item in items:
-                if not all(k in item for k in ("id", "type", "sort_order")):
-                    return (
-                        Response()
-                        .error("每个 item 必须包含 id, type, sort_order 字段")
-                        .__dict__
-                    )
-                if item["type"] not in ("persona", "folder"):
-                    return (
-                        Response()
-                        .error("type 字段必须是 'persona' 或 'folder'")
-                        .__dict__
-                    )
-
-            await self.persona_mgr.batch_update_sort_order(items)
-
-            return Response().ok({"message": "排序更新成功"}).__dict__
-        except Exception as e:
-            logger.error(f"更新排序失败: {e!s}\n{traceback.format_exc()}")
-            return Response().error(f"更新排序失败: {e!s}").__dict__
diff --git a/astrbot/dashboard/routes/platform.py b/astrbot/dashboard/routes/platform.py
deleted file mode 100644
index e30265858..000000000
--- a/astrbot/dashboard/routes/platform.py
+++ /dev/null
@@ -1,285 +0,0 @@
-"""统一 Webhook 路由
-
-提供统一的 webhook 回调入口，支持多个平台使用同一端口接收回调。
-"""
-
-import secrets
-import string
-
-from quart import request
-
-from astrbot.core import logger
-from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
-from astrbot.core.platform import Platform
-from astrbot.core.platform.sources.dingtalk.app_registration import (
-    poll_dingtalk_app_registration_once,
-    request_dingtalk_app_registration,
-)
-from astrbot.core.platform.sources.lark.app_registration import (
-    poll_app_registration_once,
-    request_app_registration,
-)
-from astrbot.core.platform.sources.lark.bot_info import request_lark_bot_info
-from astrbot.core.platform.sources.weixin_oc.login_registration import (
-    poll_weixin_oc_login_once,
-    request_weixin_oc_login_qr,
-)
-
-from .route import Response, Route, RouteContext
-
-
-def _random_platform_id_suffix() -> str:
-    return "_" + "".join(secrets.choice(string.ascii_lowercase) for _ in range(4))
-
-
-class PlatformRoute(Route):
-    """统一 Webhook 路由"""
-
-    def __init__(
-        self,
-        context: RouteContext,
-        core_lifecycle: AstrBotCoreLifecycle,
-    ) -> None:
-        super().__init__(context)
-        self.core_lifecycle = core_lifecycle
-        self.platform_manager = core_lifecycle.platform_manager
-
-        self._register_webhook_routes()
-
-    def _register_webhook_routes(self) -> None:
-        """注册 webhook 路由"""
-        # 统一 webhook 入口，支持 GET 和 POST
-        self.app.add_url_rule(
-            "/api/platform/webhook/<webhook_uuid>",
-            view_func=self.unified_webhook_callback,
-            methods=["GET", "POST"],
-        )
-
-        # 平台统计信息接口
-        self.app.add_url_rule(
-            "/api/platform/stats",
-            view_func=self.get_platform_stats,
-            methods=["GET"],
-        )
-
-        self.app.add_url_rule(
-            "/api/platform/registration/<platform_type>",
-            view_func=self.handle_platform_registration,
-            methods=["POST"],
-        )
-
-    async def unified_webhook_callback(self, webhook_uuid: str):
-        """统一 webhook 回调入口
-
-        Args:
-            webhook_uuid: 平台配置中的 webhook_uuid
-
-        Returns:
-            根据平台适配器返回相应的响应
-        """
-        # 根据 webhook_uuid 查找对应的平台
-        platform_adapter = self._find_platform_by_uuid(webhook_uuid)
-
-        if not platform_adapter:
-            logger.warning(f"未找到 webhook_uuid 为 {webhook_uuid} 的平台")
-            return Response().error("未找到对应平台").__dict__, 404
-
-        # 调用平台适配器的 webhook_callback 方法
-        try:
-            result = await platform_adapter.webhook_callback(request)
-            return result
-        except NotImplementedError:
-            logger.error(
-                f"平台 {platform_adapter.meta().name} 未实现 webhook_callback 方法"
-            )
-            return Response().error("平台未支持统一 Webhook 模式").__dict__, 500
-        except Exception as e:
-            logger.error(f"处理 webhook 回调时发生错误: {e}", exc_info=True)
-            return Response().error("处理回调失败").__dict__, 500
-
-    def _find_platform_by_uuid(self, webhook_uuid: str) -> Platform | None:
-        """根据 webhook_uuid 查找对应的平台适配器
-
-        Args:
-            webhook_uuid: webhook UUID
-
-        Returns:
-            平台适配器实例，未找到则返回 None
-        """
-        for platform in self.platform_manager.platform_insts:
-            if platform.config.get("webhook_uuid") == webhook_uuid:
-                if platform.unified_webhook():
-                    return platform
-        return None
-
-    async def get_platform_stats(self):
-        """获取所有平台的统计信息
-
-        Returns:
-            包含平台统计信息的响应
-        """
-        try:
-            stats = self.platform_manager.get_all_stats()
-            return Response().ok(stats).__dict__
-        except Exception as e:
-            logger.error(f"获取平台统计信息失败: {e}", exc_info=True)
-            return Response().error(f"获取统计信息失败: {e}").__dict__, 500
-
-    async def handle_platform_registration(self, platform_type: str):
-        """Handle dashboard one-click platform registration actions."""
-        try:
-            payload = await request.get_json(silent=True) or {}
-            action = str(payload.get("action", "")).strip().lower()
-            if not action:
-                return Response().error("Missing action").__dict__, 400
-
-            platform_config = payload.get("platform_config")
-            if not isinstance(platform_config, dict):
-                platform_config = {}
-
-            if platform_type == "lark":
-                return await self._handle_lark_registration(
-                    action,
-                    payload,
-                    platform_config,
-                )
-            if platform_type == "weixin_oc":
-                return await self._handle_weixin_oc_registration(
-                    action,
-                    payload,
-                    platform_config,
-                )
-            if platform_type == "dingtalk":
-                return await self._handle_dingtalk_registration(action, payload)
-
-            return Response().error(
-                f"Unsupported platform registration: {platform_type}"
-            ).__dict__, 404
-        except Exception as e:
-            logger.error(f"处理平台一键创建请求失败: {e}", exc_info=True)
-            return Response().error(str(e)).__dict__, 500
-
-    async def _handle_lark_registration(
-        self,
-        action: str,
-        payload: dict,
-        platform_config: dict,
-    ):
-        domain = str(platform_config.get("domain") or "").strip()
-
-        if action == "start":
-            registration = await request_app_registration(domain)
-            return (
-                Response()
-                .ok(
-                    {
-                        "status": "pending",
-                        "device_code": registration.device_code,
-                        "registration_code": registration.device_code,
-                        "user_code": registration.user_code,
-                        "verification_uri": registration.verification_uri,
-                        "verification_uri_complete": registration.verification_uri_complete,
-                        "expires_in": registration.expires_in,
-                        "interval": registration.interval,
-                    }
-                )
-                .__dict__
-            )
-
-        if action == "poll":
-            device_code = str(
-                payload.get("device_code") or payload.get("registration_code") or ""
-            ).strip()
-            if not device_code:
-                return Response().error("Missing device_code").__dict__, 400
-            result = await poll_app_registration_once(
-                domain=domain,
-                device_code=device_code,
-            )
-            if result.get("status") == "created":
-                try:
-                    bot_info = await request_lark_bot_info(
-                        domain=str(result.get("domain") or domain),
-                        app_id=str(result.get("app_id") or ""),
-                        app_secret=str(result.get("app_secret") or ""),
-                    )
-                    if bot_info.app_name:
-                        result["bot_name"] = bot_info.app_name
-                    if bot_info.open_id:
-                        result["bot_open_id"] = bot_info.open_id
-                except Exception as e:
-                    logger.error(f"获取飞书机器人信息失败: {e}", exc_info=True)
-            return Response().ok(result).__dict__
-
-        return Response().error(f"Unsupported action: {action}").__dict__, 400
-
-    async def _handle_dingtalk_registration(self, action: str, payload: dict):
-        if action == "start":
-            registration = await request_dingtalk_app_registration()
-            return (
-                Response()
-                .ok(
-                    {
-                        "status": "pending",
-                        "device_code": registration.device_code,
-                        "registration_code": registration.device_code,
-                        "user_code": registration.user_code,
-                        "verification_uri": registration.verification_uri,
-                        "verification_uri_complete": registration.verification_uri_complete,
-                        "expires_in": registration.expires_in,
-                        "interval": registration.interval,
-                    }
-                )
-                .__dict__
-            )
-
-        if action == "poll":
-            device_code = str(
-                payload.get("device_code") or payload.get("registration_code") or ""
-            ).strip()
-            if not device_code:
-                return Response().error("Missing device_code").__dict__, 400
-            result = await poll_dingtalk_app_registration_once(device_code)
-            if result.get("status") == "created":
-                result["platform_id_suffix"] = _random_platform_id_suffix()
-            return Response().ok(result).__dict__
-
-        return Response().error(f"Unsupported action: {action}").__dict__, 400
-
-    async def _handle_weixin_oc_registration(
-        self,
-        action: str,
-        payload: dict,
-        platform_config: dict,
-    ):
-        if action == "start":
-            registration = await request_weixin_oc_login_qr(platform_config)
-            return (
-                Response()
-                .ok(
-                    {
-                        "status": "pending",
-                        "registration_code": registration.qrcode,
-                        "qrcode": registration.qrcode,
-                        "qrcode_img_content": registration.qrcode_img_content,
-                        "interval": registration.interval,
-                    }
-                )
-                .__dict__
-            )
-
-        if action == "poll":
-            qrcode = str(
-                payload.get("qrcode") or payload.get("registration_code") or ""
-            ).strip()
-            if not qrcode:
-                return Response().error("Missing qrcode").__dict__, 400
-            result = await poll_weixin_oc_login_once(
-                platform_config=platform_config,
-                qrcode=qrcode,
-            )
-            if result.get("status") == "created":
-                result["platform_id_suffix"] = _random_platform_id_suffix()
-            return Response().ok(result).__dict__
-
-        return Response().error(f"Unsupported action: {action}").__dict__, 400
diff --git a/astrbot/dashboard/routes/plugin.py b/astrbot/dashboard/routes/plugin.py
deleted file mode 100644
index ff785a037..000000000
--- a/astrbot/dashboard/routes/plugin.py
+++ /dev/null
@@ -1,2132 +0,0 @@
-import asyncio
-import hashlib
-import json
-import mimetypes
-import os
-import posixpath
-import re
-import ssl
-import traceback
-from dataclasses import dataclass
-from datetime import datetime, timedelta, timezone
-from pathlib import Path
-from typing import cast
-from urllib.parse import parse_qsl, quote, urlencode, urlsplit, urlunsplit
-
-import aiofiles
-import aiohttp
-import certifi
-import jwt
-from aiofiles import ospath as aio_ospath
-from quart import Response as QuartResponse
-from quart import g, make_response, request
-
-from astrbot.api import sp
-from astrbot.core import DEMO_MODE, file_token_service, logger
-from astrbot.core.computer.computer_client import sync_skills_to_active_sandboxes
-from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
-from astrbot.core.skills.skill_manager import SkillManager
-from astrbot.core.star.filter.command import CommandFilter
-from astrbot.core.star.filter.command_group import CommandGroupFilter
-from astrbot.core.star.filter.permission import PermissionTypeFilter
-from astrbot.core.star.filter.regex import RegexFilter
-from astrbot.core.star.star import StarMetadata
-from astrbot.core.star.star_handler import EventType, star_handlers_registry
-from astrbot.core.star.star_manager import (
-    PluginManager,
-    PluginVersionIncompatibleError,
-)
-from astrbot.core.utils.astrbot_path import (
-    get_astrbot_data_path,
-    get_astrbot_temp_path,
-)
-
-from .route import Response, Route, RouteContext
-
-PLUGIN_UPDATE_CONCURRENCY = (
-    3  # limit concurrent updates to avoid overwhelming plugin sources
-)
-_PLUGIN_PAGE_BRIDGE_FILE = (
-    Path(__file__).resolve().parent.parent / "plugin_page_bridge.js"
-)
-_HTML_ASSET_ATTR_RE = re.compile(
-    r"(?P<attr>src|href)=(?P<quote>[\"\'])(?P<url>.*?)(?P=quote)",
-    re.IGNORECASE,
-)
-_CSS_URL_RE = re.compile(
-    r"url\(\s*(?P<quote>[\"\']?)(?P<url>.*?)(?P=quote)\s*\)",
-    re.IGNORECASE,
-)
-_JS_DYNAMIC_IMPORT_RE = re.compile(
-    r"(?P<prefix>\bimport\s*\(\s*)(?P<quote>[\"\'])(?P<url>.*?)(?P=quote)(?P<suffix>\s*\))",
-    re.IGNORECASE,
-)
-_JS_MODULE_FROM_RE = re.compile(
-    r"(?P<prefix>\b(?:import|export)\s+(?:[^;]*?\s+from\s+))(?P<quote>[\"\'])(?P<url>.*?)(?P=quote)",
-    re.IGNORECASE | re.DOTALL,
-)
-_JS_SIDE_EFFECT_IMPORT_RE = re.compile(
-    r"(?P<prefix>\bimport\s+)(?P<quote>[\"\'])(?P<url>[^\"'\r\n]+)(?P=quote)",
-    re.IGNORECASE,
-)
-_PLUGIN_PAGE_ASSET_TOKEN_TYPE = "plugin_page_asset"
-_PLUGIN_PAGE_ASSET_TOKEN_TTL_SECONDS = 60
-_PLUGIN_PAGE_ROOT_DIR_NAME = "pages"
-_PLUGIN_PAGE_ENTRY_FILE_NAME = "index.html"
-
-
-def _normalize_plugin_page_asset_path(asset_path: str) -> str:
-    return PluginRoute._normalize_plugin_page_path(asset_path, allow_empty=True)
-
-
-PLUGIN_COMPONENT_TYPE_ORDER = {
-    "page": 0,
-    "skill": 1,
-    "command": 2,
-    "llm_tool": 3,
-    "listener": 4,
-    "hook": 5,
-}
-
-
-@dataclass
-class PluginPage:
-    name: str
-    title: str
-    entry_file: str = _PLUGIN_PAGE_ENTRY_FILE_NAME
-
-
-@dataclass
-class RegistrySource:
-    urls: list[str]
-    cache_file: str
-    md5_url: str | None  # None means "no remote MD5, always treat cache as stale"
-
-
-class PluginRoute(Route):
-    def __init__(
-        self,
-        context: RouteContext,
-        core_lifecycle: AstrBotCoreLifecycle,
-        plugin_manager: PluginManager,
-    ) -> None:
-        super().__init__(context)
-        self.routes = {
-            "/plugin/get": ("GET", self.get_plugins),
-            "/plugin/detail": ("GET", self.get_plugin_detail),
-            "/plugin/check-compat": ("POST", self.check_plugin_compatibility),
-            "/plugin/page/entry": ("GET", self.get_plugin_page_entry_config),
-            "/plugin/install": ("POST", self.install_plugin),
-            "/plugin/install-upload": ("POST", self.install_plugin_upload),
-            "/plugin/update": ("POST", self.update_plugin),
-            "/plugin/update-all": ("POST", self.update_all_plugins),
-            "/plugin/uninstall": ("POST", self.uninstall_plugin),
-            "/plugin/uninstall-failed": ("POST", self.uninstall_failed_plugin),
-            "/plugin/market_list": ("GET", self.get_online_plugins),
-            "/plugin/off": ("POST", self.off_plugin),
-            "/plugin/on": ("POST", self.on_plugin),
-            "/plugin/reload-failed": ("POST", self.reload_failed_plugins),
-            "/plugin/reload": ("POST", self.reload_plugins),
-            "/plugin/readme": ("GET", self.get_plugin_readme),
-            "/plugin/changelog": ("GET", self.get_plugin_changelog),
-            "/plugin/source/get": ("GET", self.get_custom_source),
-            "/plugin/source/save": ("POST", self.save_custom_source),
-            "/plugin/source/get-failed-plugins": ("GET", self.get_failed_plugins),
-        }
-        self.core_lifecycle = core_lifecycle
-        self.plugin_manager = plugin_manager
-        self.register_routes()
-        self.app.add_url_rule(
-            "/api/plugin/page/content/<plugin_name>/<page_name>/",
-            endpoint="plugin_page_content_entry",
-            view_func=self.get_plugin_page_entry,
-            methods=["GET"],
-        )
-        self.app.add_url_rule(
-            "/api/plugin/page/content/<plugin_name>/<page_name>/<path:asset_path>",
-            endpoint="plugin_page_content_asset",
-            view_func=self.get_plugin_page_asset,
-            methods=["GET"],
-        )
-        self.app.add_url_rule(
-            "/api/plugin/page/bridge-sdk.js",
-            endpoint="plugin_page_bridge_sdk",
-            view_func=self.get_plugin_page_bridge_sdk,
-            methods=["GET"],
-        )
-
-        self.translated_event_type = {
-            EventType.AdapterMessageEvent: "平台消息下发时",
-            EventType.OnLLMRequestEvent: "LLM 请求时",
-            EventType.OnLLMResponseEvent: "LLM 响应后",
-            EventType.OnAgentBeginEvent: "Agent 开始运行时",
-            EventType.OnAgentDoneEvent: "Agent 运行完成后",
-            EventType.OnDecoratingResultEvent: "回复消息前",
-            EventType.OnCallingFuncToolEvent: "函数工具",
-            EventType.OnAfterMessageSentEvent: "发送消息后",
-            EventType.OnPluginErrorEvent: "插件报错时",
-        }
-
-        self._logo_cache = {}
-
-    async def get_plugin_page_entry(self, plugin_name: str, page_name: str):
-        return await self._serve_plugin_page_content(plugin_name, page_name, "")
-
-    async def get_plugin_page_asset(
-        self,
-        plugin_name: str,
-        page_name: str,
-        asset_path: str,
-    ):
-        return await self._serve_plugin_page_content(
-            plugin_name,
-            page_name,
-            asset_path,
-        )
-
-    async def get_plugin_page_bridge_sdk(self):
-        if not await aio_ospath.isfile(str(_PLUGIN_PAGE_BRIDGE_FILE)):
-            return await self._plugin_page_error_response(
-                404, "Plugin Page bridge SDK not found"
-            )
-        bridge_js = await self._read_plugin_page_text(_PLUGIN_PAGE_BRIDGE_FILE)
-        initial_context = self._get_plugin_page_initial_context()
-        if initial_context:
-            context_json = json.dumps(initial_context, ensure_ascii=False)
-            bridge_js += (
-                f"\n;window.AstrBotPluginPage?.__setInitialContext({context_json});\n"
-            )
-        response = cast(
-            QuartResponse,
-            await make_response(
-                bridge_js, {"Content-Type": "application/javascript; charset=utf-8"}
-            ),
-        )
-        return self._apply_plugin_page_security_headers(response)
-
-    def _get_plugin_metadata_by_name(self, plugin_name: str) -> StarMetadata | None:
-        for plugin in self.plugin_manager.context.get_all_stars():
-            if plugin.name == plugin_name:
-                return plugin
-        return None
-
-    @staticmethod
-    def _get_by_path(source: dict | None, key: str):
-        if not isinstance(source, dict) or not key:
-            return None
-        current = source
-        for part in key.split("."):
-            if not isinstance(current, dict) or part not in current:
-                return None
-            current = current[part]
-        return current
-
-    @staticmethod
-    def _get_request_locale(default: str = "zh-CN") -> str:
-        raw_locale = request.headers.get("Accept-Language", "").strip()
-        locale = raw_locale.split(",", 1)[0].split(";", 1)[0].strip()
-        if not locale or len(locale) > 32:
-            return default
-        return locale
-
-    @staticmethod
-    def _get_request_theme() -> str | None:
-        theme = request.args.get("theme", "").strip()
-        return theme if theme in ("dark", "light") else None
-
-    @staticmethod
-    def _apply_theme_to_html(html: str, theme: str) -> str:
-        def _replace_html_tag(m: re.Match) -> str:
-            attrs = m.group(1) or ""
-            attrs = re.sub(
-                r'\s+data-theme\s*=\s*["\'][^"\']*["\']',
-                "",
-                attrs,
-                flags=re.IGNORECASE,
-            )
-            return f'<html{attrs} data-theme="{theme}">'
-
-        html = re.sub(
-            r"<html(\b[^>]*)>",
-            _replace_html_tag,
-            html,
-            count=1,
-            flags=re.IGNORECASE,
-        )
-
-        meta_tag = f'<meta name="color-scheme" content="{theme}">'
-
-        html = re.sub(
-            r'<meta\s[^>]*name\s*=\s*["\']color-scheme["\'][^>]*>',
-            "",
-            html,
-            flags=re.IGNORECASE,
-        )
-
-        head_match = re.search(r"<head\b[^>]*>", html, re.IGNORECASE)
-        if head_match:
-            html = html.replace(
-                head_match.group(0), f"{head_match.group(0)}{meta_tag}", 1
-            )
-        else:
-            html = re.sub(
-                r"(<html\b[^>]*>)",
-                rf"\1<head>{meta_tag}</head>",
-                html,
-                count=1,
-                flags=re.IGNORECASE,
-            )
-        return html
-
-    def _get_plugin_page_initial_context(self) -> dict | None:
-        asset_token = request.args.get("asset_token", "").strip()
-        if not asset_token:
-            return None
-        jwt_secret = self.config.get("dashboard", {}).get("jwt_secret")
-        if not isinstance(jwt_secret, str) or not jwt_secret.strip():
-            return None
-
-        try:
-            payload = jwt.decode(asset_token, jwt_secret, algorithms=["HS256"])
-        except jwt.InvalidTokenError:
-            return None
-        if payload.get("token_type") != _PLUGIN_PAGE_ASSET_TOKEN_TYPE:
-            return None
-
-        plugin_name = payload.get("plugin_name")
-        page_name = payload.get("page_name")
-        if not isinstance(plugin_name, str) or not isinstance(page_name, str):
-            return None
-
-        plugin = self._get_plugin_metadata_by_name(plugin_name)
-        if not plugin:
-            return None
-
-        locale = (
-            payload.get("locale")
-            if isinstance(payload.get("locale"), str)
-            else self._get_request_locale()
-        )
-        plugin_i18n = plugin.i18n or {}
-        try:
-            plugin_root = self._get_plugin_root_dir(plugin)
-            fresh_i18n = PluginManager._load_plugin_i18n(str(plugin_root))
-            if fresh_i18n:
-                plugin_i18n = fresh_i18n
-        except (OSError, ValueError):
-            pass
-
-        locale_data = plugin_i18n.get(locale)
-        display_name = (
-            self._get_by_path(locale_data, "metadata.display_name")
-            or plugin.display_name
-            or plugin.name
-        )
-        page_title = (
-            self._get_by_path(locale_data, f"pages.{page_name}.title") or page_name
-        )
-
-        theme = self._get_request_theme()
-
-        return {
-            "pluginName": plugin.name,
-            "displayName": display_name,
-            "pageName": page_name,
-            "pageTitle": page_title,
-            "locale": locale,
-            "i18n": plugin_i18n,
-            "isDark": theme == "dark",
-        }
-
-    @staticmethod
-    def _normalize_plugin_page_path(
-        raw_path: str,
-        *,
-        base_dir: str | None = None,
-        allow_empty: bool = False,
-    ) -> str:
-        path = raw_path.replace("\\", "/").strip()
-        if base_dir:
-            path = posixpath.join(base_dir, path)
-        normalized = posixpath.normpath(path)
-        if normalized in {"", "."}:
-            if allow_empty:
-                return ""
-            raise ValueError("Invalid plugin Page asset path")
-        if (
-            normalized.startswith("../")
-            or normalized == ".."
-            or normalized.startswith("/")
-        ):
-            raise ValueError("Invalid plugin Page asset path")
-        return normalized
-
-    @staticmethod
-    def _normalize_plugin_page_name(raw_name: str) -> str:
-        page_name = raw_name.strip()
-        if not page_name:
-            raise ValueError("Invalid plugin Page name")
-        normalized = posixpath.normpath(page_name.replace("\\", "/"))
-        if (
-            normalized != page_name
-            or normalized in {".", ".."}
-            or normalized.startswith(".")
-            or "/" in page_name
-            or "\\" in page_name
-        ):
-            raise ValueError("Invalid plugin Page name")
-        return page_name
-
-    def _get_plugin_root_dir(self, plugin: StarMetadata) -> Path:
-        if not plugin.root_dir_name:
-            raise FileNotFoundError("Plugin directory metadata is missing")
-
-        base_dir = Path(
-            self.plugin_manager.reserved_plugin_path
-            if plugin.reserved
-            else self.plugin_manager.plugin_store_path
-        ).resolve(strict=False)
-        plugin_root = (base_dir / plugin.root_dir_name).resolve(strict=False)
-        plugin_root.relative_to(base_dir)
-        return plugin_root
-
-    async def _resolve_plugin_pages_root(
-        self,
-        plugin: StarMetadata,
-    ) -> Path:
-        plugin_root = self._get_plugin_root_dir(plugin)
-        pages_root = (plugin_root / _PLUGIN_PAGE_ROOT_DIR_NAME).resolve(strict=False)
-        pages_root.relative_to(plugin_root)
-        if pages_root == plugin_root:
-            raise FileNotFoundError("Plugin Pages root directory is invalid")
-        if not await aio_ospath.isdir(str(pages_root)):
-            raise FileNotFoundError("Plugin Pages root directory does not exist")
-        return pages_root
-
-    async def _discover_plugin_pages(self, plugin: StarMetadata) -> list[PluginPage]:
-        try:
-            pages_root = await self._resolve_plugin_pages_root(plugin)
-        except (FileNotFoundError, ValueError):
-            return []
-
-        pages: list[PluginPage] = []
-        try:
-            page_dirs = sorted(
-                (item for item in pages_root.iterdir() if item.is_dir()),
-                key=lambda item: item.name.lower(),
-            )
-        except OSError:
-            return []
-
-        for page_dir in page_dirs:
-            try:
-                page_name = self._normalize_plugin_page_name(page_dir.name)
-            except ValueError:
-                continue
-            entry_path = page_dir / _PLUGIN_PAGE_ENTRY_FILE_NAME
-            if not await aio_ospath.isfile(str(entry_path)):
-                continue
-            pages.append(
-                PluginPage(
-                    name=page_name,
-                    title=page_name,
-                    entry_file=_PLUGIN_PAGE_ENTRY_FILE_NAME,
-                )
-            )
-        return pages
-
-    async def _get_plugin_page(
-        self,
-        plugin: StarMetadata,
-        page_name: str,
-    ) -> PluginPage:
-        normalized_name = self._normalize_plugin_page_name(page_name)
-        for page in await self._discover_plugin_pages(plugin):
-            if page.name == normalized_name:
-                return page
-        raise FileNotFoundError("Plugin Page entry not found")
-
-    async def _resolve_plugin_page_root(
-        self,
-        plugin: StarMetadata,
-        page_name: str,
-    ) -> Path:
-        normalized_name = self._normalize_plugin_page_name(page_name)
-        pages_root = await self._resolve_plugin_pages_root(plugin)
-        page_root = (pages_root / normalized_name).resolve(strict=False)
-        page_root.relative_to(pages_root)
-        if not await aio_ospath.isdir(str(page_root)):
-            raise FileNotFoundError("Plugin Page root directory does not exist")
-        return page_root
-
-    async def _resolve_plugin_page_file(
-        self,
-        plugin: StarMetadata,
-        page_name: str,
-        asset_path: str,
-    ) -> Path:
-        page = await self._get_plugin_page(plugin, page_name)
-        page_root = await self._resolve_plugin_page_root(plugin, page.name)
-        target_name = _normalize_plugin_page_asset_path(asset_path) or page.entry_file
-        target_path = (page_root / target_name).resolve(strict=False)
-        target_path.relative_to(page_root)
-        if not await aio_ospath.isfile(str(target_path)):
-            raise FileNotFoundError("Plugin Page asset not found")
-        return target_path
-
-    @staticmethod
-    def _is_rewritable_asset_url(raw_url: str) -> bool:
-        value = raw_url.strip()
-        lower = value.lower()
-        if not value:
-            return False
-        if value.startswith(("#", "/#")):
-            return False
-        if lower.startswith(
-            (
-                "http://",
-                "https://",
-                "//",
-                "data:",
-                "javascript:",
-                "mailto:",
-                "tel:",
-                "blob:",
-            )
-        ):
-            return False
-        return True
-
-    @staticmethod
-    def _resolve_referenced_asset_path(
-        base_asset_path: str,
-        referenced_url: str,
-    ) -> str:
-        parts = urlsplit(referenced_url)
-        referenced_path = parts.path.strip()
-        if not referenced_path:
-            raise ValueError("Plugin Page referenced asset path is empty")
-        base_dir = posixpath.dirname(base_asset_path) if base_asset_path else ""
-        normalized = PluginRoute._normalize_plugin_page_path(
-            referenced_path,
-            base_dir=base_dir,
-        )
-        if not normalized:
-            raise ValueError("Plugin Page referenced asset path is invalid")
-        return normalized
-
-    def _build_plugin_page_asset_url(
-        self,
-        plugin_name: str,
-        page_name: str,
-        asset_path: str,
-        original_query: str = "",
-        original_fragment: str = "",
-        extra_query_params: dict[str, str] | None = None,
-    ) -> str:
-        path = self._build_plugin_page_content_path(plugin_name, page_name, asset_path)
-        query_dict = dict(parse_qsl(original_query, keep_blank_values=True))
-        if extra_query_params:
-            for key, value in extra_query_params.items():
-                if value:
-                    query_dict[key] = value
-        query = urlencode(query_dict)
-        return urlunsplit(
-            (
-                "",
-                "",
-                path,
-                query,
-                original_fragment,
-            )
-        )
-
-    @staticmethod
-    def _build_plugin_page_content_path(
-        plugin_name: str,
-        page_name: str,
-        asset_path: str = "",
-    ) -> str:
-        encoded_plugin_name = quote(plugin_name, safe="")
-        encoded_page_name = quote(
-            PluginRoute._normalize_plugin_page_name(page_name),
-            safe="",
-        )
-        if not asset_path:
-            return (
-                f"/api/plugin/page/content/{encoded_plugin_name}/{encoded_page_name}/"
-            )
-        safe_asset_path = _normalize_plugin_page_asset_path(asset_path)
-        encoded_path = "/".join(
-            quote(part, safe="") for part in safe_asset_path.split("/")
-        )
-        return (
-            f"/api/plugin/page/content/{encoded_plugin_name}/"
-            f"{encoded_page_name}/{encoded_path}"
-        )
-
-    @staticmethod
-    def _get_plugin_page_bridge_sdk_url(
-        extra_query_params: dict[str, str] | None = None,
-    ) -> str:
-        query = urlencode(extra_query_params or {})
-        return urlunsplit(
-            (
-                "",
-                "",
-                "/api/plugin/page/bridge-sdk.js",
-                query,
-                "",
-            )
-        )
-
-    @staticmethod
-    def _is_js_relative_module_specifier(raw_url: str) -> bool:
-        value = raw_url.strip()
-        return value.startswith(("./", "../", "/"))
-
-    def _rewrite_relative_asset_url(
-        self,
-        raw_url: str,
-        base_asset_path: str,
-        plugin_name: str,
-        page_name: str,
-        extra_query_params: dict[str, str] | None = None,
-    ) -> str | None:
-        candidate = raw_url.strip()
-        if not self._is_rewritable_asset_url(candidate):
-            return None
-        parts = urlsplit(candidate)
-        asset_path = self._resolve_referenced_asset_path(base_asset_path, candidate)
-        return self._build_plugin_page_asset_url(
-            plugin_name,
-            page_name,
-            asset_path,
-            original_query=parts.query,
-            original_fragment=parts.fragment,
-            extra_query_params=extra_query_params,
-        )
-
-    def _rewrite_plugin_page_html(
-        self,
-        html_text: str,
-        plugin_name: str,
-        page_name: str,
-        entry_asset_path: str,
-        extra_query_params: dict[str, str] | None = None,
-    ) -> str:
-        def replace_attr(match: re.Match[str]) -> str:
-            raw_url = match.group("url")
-            attr = match.group("attr")
-            quote_char = match.group("quote")
-
-            if raw_url.strip() == "/api/plugin/page/bridge-sdk.js":
-                url = self._get_plugin_page_bridge_sdk_url(extra_query_params)
-                return f"{attr}={quote_char}{url}{quote_char}"
-
-            if not self._is_rewritable_asset_url(raw_url):
-                return match.group(0)
-
-            try:
-                rewritten_url = self._rewrite_relative_asset_url(
-                    raw_url,
-                    entry_asset_path,
-                    plugin_name,
-                    page_name,
-                    extra_query_params=extra_query_params,
-                )
-                if not rewritten_url:
-                    return match.group(0)
-                return f"{attr}={quote_char}{rewritten_url}{quote_char}"
-            except ValueError:
-                return match.group(0)
-
-        rewritten_html = _HTML_ASSET_ATTR_RE.sub(replace_attr, html_text)
-        theme = self._get_request_theme()
-        if theme:
-            rewritten_html = self._apply_theme_to_html(rewritten_html, theme)
-        if "/api/plugin/page/bridge-sdk.js" not in rewritten_html:
-            bridge_tag = f'<script src="{self._get_plugin_page_bridge_sdk_url(extra_query_params)}"></script>'
-            if "</body>" in rewritten_html:
-                rewritten_html = rewritten_html.replace(
-                    "</body>", f"{bridge_tag}</body>", 1
-                )
-            else:
-                rewritten_html += bridge_tag
-        return rewritten_html
-
-    def _rewrite_plugin_page_css(
-        self,
-        css_text: str,
-        plugin_name: str,
-        page_name: str,
-        css_asset_path: str,
-        extra_query_params: dict[str, str] | None = None,
-    ) -> str:
-        def replace_url(match: re.Match[str]) -> str:
-            raw_url = match.group("url").strip()
-            quote_char = match.group("quote") or ""
-            try:
-                rewritten_url = self._rewrite_relative_asset_url(
-                    raw_url,
-                    css_asset_path,
-                    plugin_name,
-                    page_name,
-                    extra_query_params=extra_query_params,
-                )
-                if not rewritten_url:
-                    return match.group(0)
-                return f"url({quote_char}{rewritten_url}{quote_char})"
-            except ValueError:
-                return match.group(0)
-
-        return _CSS_URL_RE.sub(replace_url, css_text)
-
-    def _rewrite_plugin_page_js(
-        self,
-        js_text: str,
-        plugin_name: str,
-        page_name: str,
-        js_asset_path: str,
-        extra_query_params: dict[str, str] | None = None,
-    ) -> str:
-        def rewrite_specifier(raw_url: str) -> str:
-            if not self._is_js_relative_module_specifier(raw_url):
-                return raw_url
-            if not self._is_rewritable_asset_url(raw_url):
-                return raw_url
-            rewritten = self._rewrite_relative_asset_url(
-                raw_url,
-                js_asset_path,
-                plugin_name,
-                page_name,
-                extra_query_params=extra_query_params,
-            )
-            return rewritten or raw_url
-
-        def replace_dynamic(match: re.Match[str]) -> str:
-            raw_url = match.group("url")
-            try:
-                rewritten = rewrite_specifier(raw_url)
-            except ValueError:
-                return match.group(0)
-            return (
-                f"{match.group('prefix')}{match.group('quote')}{rewritten}"
-                f"{match.group('quote')}{match.group('suffix')}"
-            )
-
-        def replace_from(match: re.Match[str]) -> str:
-            raw_url = match.group("url")
-            try:
-                rewritten = rewrite_specifier(raw_url)
-            except ValueError:
-                return match.group(0)
-            return f"{match.group('prefix')}{match.group('quote')}{rewritten}{match.group('quote')}"
-
-        rewritten_js = _JS_DYNAMIC_IMPORT_RE.sub(replace_dynamic, js_text)
-        rewritten_js = _JS_MODULE_FROM_RE.sub(replace_from, rewritten_js)
-
-        def replace_side_effect(match: re.Match[str]) -> str:
-            raw_url = match.group("url")
-            if raw_url.startswith(("{", "*")):
-                return match.group(0)
-            try:
-                rewritten = rewrite_specifier(raw_url)
-            except ValueError:
-                return match.group(0)
-            return f"{match.group('prefix')}{match.group('quote')}{rewritten}{match.group('quote')}"
-
-        return _JS_SIDE_EFFECT_IMPORT_RE.sub(replace_side_effect, rewritten_js)
-
-    @staticmethod
-    async def _read_plugin_page_text(file_path: Path) -> str:
-        async with aiofiles.open(file_path, encoding="utf-8") as file:
-            return await file.read()
-
-    @staticmethod
-    async def _read_plugin_page_binary(file_path: Path) -> bytes:
-        async with aiofiles.open(file_path, mode="rb") as file:
-            return await file.read()
-
-    @staticmethod
-    def _guess_plugin_page_mime_type(file_path: Path) -> str:
-        return mimetypes.guess_type(file_path.name)[0] or "application/octet-stream"
-
-    async def _serialize_plugin_page(
-        self,
-        plugin: StarMetadata,
-        page_name: str,
-        *,
-        include_content_path: bool = False,
-    ) -> dict | None:
-        plugin_name = plugin.name.strip() if isinstance(plugin.name, str) else ""
-        if not plugin_name:
-            return None
-        try:
-            page = await self._get_plugin_page(plugin, page_name)
-            await self._resolve_plugin_page_file(plugin, page.name, "")
-        except (FileNotFoundError, ValueError):
-            return None
-
-        page_data = {
-            "name": page.name,
-            "title": page.title,
-            "i18n_key": f"pages.{page.name}",
-        }
-        if include_content_path:
-            asset_token = (
-                self._issue_plugin_page_asset_token(plugin_name, page.name) or ""
-            )
-            extra_query_params = {"asset_token": asset_token} if asset_token else None
-            page_data["content_path"] = self._build_plugin_page_asset_url(
-                plugin_name,
-                page.name,
-                "",
-                extra_query_params=extra_query_params,
-            )
-        return page_data
-
-    async def _serialize_plugin_pages(self, plugin: StarMetadata) -> list[dict]:
-        pages = []
-        for page in await self._discover_plugin_pages(plugin):
-            page_data = await self._serialize_plugin_page(plugin, page.name)
-            if page_data:
-                pages.append(page_data)
-        return pages
-
-    def _issue_plugin_page_asset_token(
-        self,
-        plugin_name: str,
-        page_name: str,
-    ) -> str | None:
-        jwt_secret = self.config.get("dashboard", {}).get("jwt_secret")
-        if not isinstance(jwt_secret, str) or not jwt_secret.strip():
-            return None
-
-        username = getattr(g, "username", None)
-        if not isinstance(username, str) or not username.strip():
-            return None
-
-        now = datetime.now(timezone.utc)
-        payload = {
-            "username": username,
-            "token_type": _PLUGIN_PAGE_ASSET_TOKEN_TYPE,
-            "plugin_name": plugin_name,
-            "page_name": page_name,
-            "locale": self._get_request_locale(),
-            "iat": now,
-            "exp": now + timedelta(seconds=_PLUGIN_PAGE_ASSET_TOKEN_TTL_SECONDS),
-        }
-        return cast(str, jwt.encode(payload, jwt_secret, algorithm="HS256"))
-
-    def _prepare_plugin_page_query_params(
-        self,
-        plugin_name: str,
-        page_name: str,
-    ) -> dict[str, str] | None:
-        asset_token = request.args.get("asset_token", "").strip()
-        if not asset_token:
-            asset_token = (
-                self._issue_plugin_page_asset_token(plugin_name, page_name) or ""
-            )
-        theme = self._get_request_theme()
-
-        if not asset_token and not theme:
-            return None
-
-        params: dict[str, str] = {}
-        if asset_token:
-            params["asset_token"] = asset_token
-        if theme:
-            params["theme"] = theme
-        return params
-
-    @staticmethod
-    async def _plugin_page_error_response(status_code: int, message: str):
-        response = await make_response(message, status_code)
-        response.headers["Cache-Control"] = "no-store"
-        response.headers["Content-Type"] = "text/plain; charset=utf-8"
-        response.headers["Referrer-Policy"] = "no-referrer"
-        return response
-
-    @staticmethod
-    def _apply_plugin_page_security_headers(response: QuartResponse) -> QuartResponse:
-        response.headers["Cache-Control"] = "no-store"
-        response.headers["Referrer-Policy"] = "no-referrer"
-        response.headers["X-Content-Type-Options"] = "nosniff"
-        response.headers["Cross-Origin-Resource-Policy"] = "cross-origin"
-        # Sandboxed iframes without allow-same-origin load ES modules with Origin: null.
-        # CORS read access is allowed here; JWT/asset_token still protects the assets.
-        response.headers["Access-Control-Allow-Origin"] = "*"
-
-        # When running under the AstrBot Launcher the dashboard is embedded in a
-        # cross-origin iframe (the Tauri webview).  Since frame-ancestors and
-        # X-Frame-Options inspect the *entire* ancestor chain, enforcing them here
-        # would block plugin pages from loading inside the nested iframe.
-        csp = "object-src 'none'; base-uri 'self'"
-        if os.environ.get("ASTRBOT_LAUNCHER") not in ("1", "true"):
-            response.headers["X-Frame-Options"] = "SAMEORIGIN"
-            csp = f"frame-ancestors 'self'; {csp}"
-        response.headers["Content-Security-Policy"] = csp
-
-        return response
-
-    async def _serve_plugin_page_html_asset(
-        self,
-        file_path: Path,
-        plugin_name: str,
-        page_name: str,
-        asset_path: str,
-        extra_query_params: dict[str, str] | None,
-    ):
-        html_text = await self._read_plugin_page_text(file_path)
-        rewritten_html = self._rewrite_plugin_page_html(
-            html_text,
-            plugin_name,
-            page_name,
-            asset_path,
-            extra_query_params=extra_query_params,
-        )
-        response = cast(
-            QuartResponse,
-            await make_response(
-                rewritten_html, {"Content-Type": "text/html; charset=utf-8"}
-            ),
-        )
-        return self._apply_plugin_page_security_headers(response)
-
-    async def _serve_plugin_page_css_asset(
-        self,
-        file_path: Path,
-        plugin_name: str,
-        page_name: str,
-        asset_path: str,
-        extra_query_params: dict[str, str] | None,
-    ):
-        css_text = await self._read_plugin_page_text(file_path)
-        rewritten_css = self._rewrite_plugin_page_css(
-            css_text,
-            plugin_name,
-            page_name,
-            asset_path,
-            extra_query_params=extra_query_params,
-        )
-        response = cast(
-            QuartResponse,
-            await make_response(
-                rewritten_css, {"Content-Type": "text/css; charset=utf-8"}
-            ),
-        )
-        return self._apply_plugin_page_security_headers(response)
-
-    async def _serve_plugin_page_js_asset(
-        self,
-        file_path: Path,
-        plugin_name: str,
-        page_name: str,
-        asset_path: str,
-        extra_query_params: dict[str, str] | None,
-    ):
-        js_text = await self._read_plugin_page_text(file_path)
-        rewritten_js = self._rewrite_plugin_page_js(
-            js_text,
-            plugin_name,
-            page_name,
-            asset_path,
-            extra_query_params=extra_query_params,
-        )
-        response = cast(
-            QuartResponse,
-            await make_response(
-                rewritten_js,
-                {"Content-Type": "application/javascript; charset=utf-8"},
-            ),
-        )
-        return self._apply_plugin_page_security_headers(response)
-
-    async def _serve_plugin_page_static_asset(self, file_path: Path):
-        raw_bytes = await self._read_plugin_page_binary(file_path)
-        response = cast(
-            QuartResponse,
-            await make_response(
-                raw_bytes,
-                {"Content-Type": self._guess_plugin_page_mime_type(file_path)},
-            ),
-        )
-        return self._apply_plugin_page_security_headers(response)
-
-    async def _serve_plugin_page_content(
-        self,
-        plugin_name: str,
-        page_name: str,
-        asset_path: str,
-    ):
-        plugin = self._get_plugin_metadata_by_name(plugin_name)
-        if not plugin:
-            return await self._plugin_page_error_response(404, "Plugin not found")
-        if not plugin.activated:
-            return await self._plugin_page_error_response(403, "Plugin is disabled")
-
-        try:
-            page = await self._get_plugin_page(plugin, page_name)
-            file_path = await self._resolve_plugin_page_file(
-                plugin,
-                page.name,
-                asset_path,
-            )
-        except (FileNotFoundError, ValueError):
-            return await self._plugin_page_error_response(
-                404, "Plugin Page asset not found"
-            )
-
-        extra_query_params = self._prepare_plugin_page_query_params(
-            plugin_name,
-            page.name,
-        )
-        served_asset_path = asset_path or page.entry_file
-        suffix = file_path.suffix.lower()
-        handlers = {
-            ".html": self._serve_plugin_page_html_asset,
-            ".css": self._serve_plugin_page_css_asset,
-            ".js": self._serve_plugin_page_js_asset,
-            ".mjs": self._serve_plugin_page_js_asset,
-        }
-        handler = handlers.get(suffix)
-        if handler:
-            return await handler(
-                file_path,
-                plugin_name,
-                page.name,
-                served_asset_path,
-                extra_query_params,
-            )
-        return await self._serve_plugin_page_static_asset(file_path)
-
-    async def _sync_skills_after_plugin_change(self) -> None:
-        try:
-            await sync_skills_to_active_sandboxes()
-        except Exception:
-            logger.warning("Failed to sync plugin-provided skills to active sandboxes.")
-
-    async def check_plugin_compatibility(self):
-        try:
-            data = await request.get_json()
-            version_spec = data.get("astrbot_version", "")
-            is_valid, message = self.plugin_manager._validate_astrbot_version_specifier(
-                version_spec
-            )
-            return (
-                Response()
-                .ok(
-                    {
-                        "compatible": is_valid,
-                        "message": message,
-                        "astrbot_version": version_spec,
-                    }
-                )
-                .__dict__
-            )
-        except Exception as e:
-            return Response().error(str(e)).__dict__
-
-    async def get_plugin_page_entry_config(self):
-        plugin_name = request.args.get("name")
-        if not plugin_name:
-            return Response().error("缺少插件名").__dict__
-        page_name = request.args.get("page")
-        if not page_name:
-            return Response().error("缺少 Page 名称").__dict__
-
-        for plugin in self.plugin_manager.context.get_all_stars():
-            if plugin.name != plugin_name:
-                continue
-            if not plugin.activated:
-                return Response().error("插件未启用").__dict__
-
-            page = await self._serialize_plugin_page(
-                plugin,
-                page_name,
-                include_content_path=True,
-            )
-            if not page:
-                return Response().error("插件 Page 不存在").__dict__
-            return Response().ok(page).__dict__
-
-        return Response().error("插件不存在").__dict__
-
-    async def reload_failed_plugins(self):
-        if DEMO_MODE:
-            return (
-                Response()
-                .error("You are not permitted to do this operation in demo mode")
-                .__dict__
-            )
-        try:
-            data = await request.get_json()
-            dir_name = data.get("dir_name")  # 这里拿的是目录名，不是插件名
-
-            if not dir_name:
-                return Response().error("缺少插件目录名").__dict__
-
-            # 调用 star_manager.py 中的函数
-            # 注意：传入的是目录名
-            success, err = await self.plugin_manager.reload_failed_plugin(dir_name)
-
-            if success:
-                await self._sync_skills_after_plugin_change()
-                return Response().ok(None, f"插件 {dir_name} 重载成功。").__dict__
-            else:
-                return Response().error(f"重载失败: {err}").__dict__
-
-        except Exception as e:
-            logger.error(f"/api/plugin/reload-failed: {traceback.format_exc()}")
-            return Response().error(str(e)).__dict__
-
-    async def reload_plugins(self):
-        if DEMO_MODE:
-            return (
-                Response()
-                .error("You are not permitted to do this operation in demo mode")
-                .__dict__
-            )
-
-        data = await request.get_json()
-        plugin_name = data.get("name", None)
-        try:
-            success, message = await self.plugin_manager.reload(plugin_name)
-            if not success:
-                return Response().error(message or "插件重载失败").__dict__
-            await self._sync_skills_after_plugin_change()
-            return Response().ok(None, "重载成功。").__dict__
-        except Exception as e:
-            logger.error(f"/api/plugin/reload: {traceback.format_exc()}")
-            return Response().error(str(e)).__dict__
-
-    async def get_online_plugins(self):
-        custom = request.args.get("custom_registry")
-        force_refresh = request.args.get("force_refresh", "false").lower() == "true"
-
-        # 构建注册表源信息
-        source = self._build_registry_source(custom)
-
-        # 如果不是强制刷新，先检查缓存是否有效
-        cached_data = None
-        if not force_refresh:
-            # 先检查MD5是否匹配，如果匹配则使用缓存
-            if await self._is_cache_valid(source):
-                cached_data = self._load_plugin_cache(source.cache_file)
-                if cached_data:
-                    logger.debug("缓存MD5匹配，使用缓存的插件市场数据")
-                    return Response().ok(cached_data).__dict__
-
-        # 尝试获取远程数据
-        remote_data = None
-        ssl_context = ssl.create_default_context(cafile=certifi.where())
-        connector = aiohttp.TCPConnector(ssl=ssl_context)
-
-        for url in source.urls:
-            try:
-                async with (
-                    aiohttp.ClientSession(
-                        trust_env=True,
-                        connector=connector,
-                    ) as session,
-                    session.get(url) as response,
-                ):
-                    if response.status == 200:
-                        try:
-                            remote_data = await response.json()
-                        except aiohttp.ContentTypeError:
-                            remote_text = await response.text()
-                            remote_data = json.loads(remote_text)
-
-                        # 检查远程数据是否为空
-                        if not remote_data or (
-                            isinstance(remote_data, dict) and len(remote_data) == 0
-                        ):
-                            logger.warning(f"远程插件市场数据为空: {url}")
-                            continue  # 继续尝试其他URL或使用缓存
-
-                        logger.info(
-                            f"成功获取远程插件市场数据，包含 {len(remote_data)} 个插件"
-                        )
-                        # 获取最新的MD5并保存到缓存
-                        current_md5 = await self._fetch_remote_md5(source.md5_url)
-                        self._save_plugin_cache(
-                            source.cache_file,
-                            remote_data,
-                            current_md5,
-                        )
-                        return Response().ok(remote_data).__dict__
-                    logger.error(f"请求 {url} 失败，状态码：{response.status}")
-            except Exception as e:
-                logger.error(f"请求 {url} 失败，错误：{e}")
-
-        # 如果远程获取失败，尝试使用缓存数据
-        if not cached_data:
-            cached_data = self._load_plugin_cache(source.cache_file)
-
-        if cached_data:
-            logger.warning("远程插件市场数据获取失败，使用缓存数据")
-            return Response().ok(cached_data, "使用缓存数据，可能不是最新版本").__dict__
-
-        return Response().error("获取插件列表失败，且没有可用的缓存数据").__dict__
-
-    def _build_registry_source(self, custom_url: str | None) -> RegistrySource:
-        """构建注册表源信息"""
-        data_dir = get_astrbot_data_path()
-        if custom_url:
-            # 对自定义URL生成一个安全的文件名
-            url_hash = hashlib.md5(custom_url.encode()).hexdigest()[:8]
-            cache_file = os.path.join(data_dir, f"plugins_custom_{url_hash}.json")
-
-            # 更安全的后缀处理方式
-            if custom_url.endswith(".json"):
-                md5_url = custom_url[:-5] + "-md5.json"
-            else:
-                md5_url = custom_url + "-md5.json"
-
-            urls = [custom_url]
-        else:
-            cache_file = os.path.join(data_dir, "plugins.json")
-            md5_url = "https://api.soulter.top/astrbot/plugins-md5"
-            urls = [
-                "https://api.soulter.top/astrbot/plugins",
-                "https://github.com/AstrBotDevs/AstrBot_Plugins_Collection/raw/refs/heads/main/plugin_cache_original.json",
-            ]
-        return RegistrySource(urls=urls, cache_file=cache_file, md5_url=md5_url)
-
-    def _load_cached_md5(self, cache_file: str) -> str | None:
-        """从缓存文件中加载MD5"""
-        if not os.path.exists(cache_file):
-            return None
-
-        try:
-            with open(cache_file, encoding="utf-8") as f:
-                cache_data = json.load(f)
-            return cache_data.get("md5")
-        except Exception as e:
-            logger.warning(f"Failed to load cached MD5: {e}")
-            return None
-
-    async def _fetch_remote_md5(self, md5_url: str | None) -> str | None:
-        """获取远程MD5"""
-        if not md5_url:
-            return None
-
-        try:
-            ssl_context = ssl.create_default_context(cafile=certifi.where())
-            connector = aiohttp.TCPConnector(ssl=ssl_context)
-
-            async with (
-                aiohttp.ClientSession(
-                    trust_env=True,
-                    connector=connector,
-                ) as session,
-                session.get(md5_url) as response,
-            ):
-                if response.status == 200:
-                    data = await response.json()
-                    return data.get("md5", "")
-        except Exception as e:
-            logger.debug(f"Failed to fetch remote MD5: {e}")
-        return None
-
-    async def _is_cache_valid(self, source: RegistrySource) -> bool:
-        """检查缓存是否有效（基于MD5）"""
-        try:
-            cached_md5 = self._load_cached_md5(source.cache_file)
-            if not cached_md5:
-                logger.debug("MD5 not found in cache, treating cache as invalid")
-                return False
-
-            remote_md5 = await self._fetch_remote_md5(source.md5_url)
-            if remote_md5 is None:
-                logger.warning(
-                    "Cannot fetch remote MD5, using cache without validation"
-                )
-                return True  # 如果无法获取远程MD5，认为缓存有效
-
-            is_valid = cached_md5 == remote_md5
-            logger.debug(
-                f"Plugin cache: local={cached_md5}, remote={remote_md5}, effective={is_valid}",
-            )
-            return is_valid
-
-        except Exception as e:
-            logger.warning(f"检查缓存有效性失败: {e}")
-            return False
-
-    def _load_plugin_cache(self, cache_file: str):
-        """加载本地缓存的插件市场数据"""
-        try:
-            if os.path.exists(cache_file):
-                with open(cache_file, encoding="utf-8") as f:
-                    cache_data = json.load(f)
-                    # 检查缓存是否有效
-                    if "data" in cache_data and "timestamp" in cache_data:
-                        logger.debug(
-                            f"Loading cached file: {cache_file}, Cache time: {cache_data['timestamp']}",
-                        )
-                        return cache_data["data"]
-        except Exception as e:
-            logger.warning(f"Failed to load plugin market cache: {e}")
-        return None
-
-    def _save_plugin_cache(self, cache_file: str, data, md5: str | None = None) -> None:
-        """保存插件市场数据到本地缓存"""
-        try:
-            # 确保目录存在
-            os.makedirs(os.path.dirname(cache_file), exist_ok=True)
-
-            cache_data = {
-                "timestamp": datetime.now().isoformat(),
-                "data": data,
-                "md5": md5 or "",
-            }
-
-            with open(cache_file, "w", encoding="utf-8") as f:
-                json.dump(cache_data, f, ensure_ascii=False, indent=2)
-            logger.debug(f"Cached plugin market data: {cache_file}, MD5: {md5}")
-        except Exception as e:
-            logger.warning(f"Failed to save plugin market cache: {e}")
-
-    async def get_plugin_logo_token(self, logo_path: str):
-        try:
-            if token := self._logo_cache.get(logo_path):
-                if not await file_token_service.check_token_expired(token):
-                    return self._logo_cache[logo_path]
-            token = await file_token_service.register_file(logo_path, timeout=300)
-            self._logo_cache[logo_path] = token
-            return token
-        except Exception as e:
-            logger.warning(f"获取插件 Logo 失败: {e}")
-            return None
-
-    def _resolve_plugin_dir(self, plugin) -> Path | None:
-        if not plugin.root_dir_name:
-            return None
-
-        base_dir = Path(
-            self.plugin_manager.reserved_plugin_path
-            if plugin.reserved
-            else self.plugin_manager.plugin_store_path
-        )
-        plugin_dir = base_dir / plugin.root_dir_name
-        if not plugin_dir.is_dir():
-            return None
-        return plugin_dir
-
-    def _get_plugin_installed_at(self, plugin) -> str | None:
-        plugin_dir = self._resolve_plugin_dir(plugin)
-        if plugin_dir is None:
-            return None
-
-        try:
-            return datetime.fromtimestamp(
-                plugin_dir.stat().st_mtime,
-                timezone.utc,
-            ).isoformat()
-        except OSError as exc:
-            logger.warning(f"获取插件安装时间失败 {plugin.name}: {exc!s}")
-            return None
-
-    async def get_plugins(self):
-        _plugin_resp = []
-        plugin_name = request.args.get("name")
-
-        plugins = [
-            p
-            for p in self.plugin_manager.context.get_all_stars()
-            if not (plugin_name and p.name != plugin_name)
-        ]
-
-        async def process_plugin(plugin):
-            logo_url = None
-            if plugin.logo_path:
-                logo_url = await self.get_plugin_logo_token(plugin.logo_path)
-            pages = await self._discover_plugin_pages(plugin)
-            return plugin, logo_url, pages
-
-        results = await asyncio.gather(*(process_plugin(p) for p in plugins))
-
-        for plugin, logo_url, pages in results:
-            _t = {
-                "name": plugin.name,
-                "marketplace_name": (plugin.name or "").replace("_", "-"),
-                "repo": "" if plugin.repo is None else str(plugin.repo),
-                "author": plugin.author,
-                "desc": plugin.desc,
-                "version": plugin.version,
-                "reserved": plugin.reserved,
-                "activated": plugin.activated,
-                "online_vesion": "",
-                "display_name": plugin.display_name,
-                "logo": f"/api/file/{logo_url}" if logo_url else None,
-                "support_platforms": plugin.support_platforms,
-                "astrbot_version": plugin.astrbot_version,
-                "installed_at": self._get_plugin_installed_at(plugin),
-                "i18n": plugin.i18n,
-                "pages": [p.name for p in pages],
-            }
-            # 检查是否为全空的幽灵插件
-            if not any(
-                [
-                    plugin.name,
-                    plugin.author,
-                    plugin.desc,
-                    plugin.version,
-                    plugin.display_name,
-                ]
-            ):
-                continue
-            _plugin_resp.append(_t)
-        return (
-            Response()
-            .ok(_plugin_resp, message=self.plugin_manager.failed_plugin_info)
-            .__dict__
-        )
-
-    async def get_plugin_detail(self):
-        plugin_name = request.args.get("name")
-        if not plugin_name:
-            return Response().error("缺少插件名").__dict__
-
-        for plugin in self.plugin_manager.context.get_all_stars():
-            if plugin.name != plugin_name:
-                continue
-
-            logo_url = None
-            if plugin.logo_path:
-                logo_url = await self.get_plugin_logo_token(plugin.logo_path)
-
-            return (
-                Response()
-                .ok(
-                    {
-                        "name": plugin.name,
-                        "marketplace_name": (plugin.name or "").replace("_", "-"),
-                        "repo": "" if plugin.repo is None else str(plugin.repo),
-                        "author": plugin.author,
-                        "desc": plugin.desc,
-                        "version": plugin.version,
-                        "reserved": plugin.reserved,
-                        "activated": plugin.activated,
-                        "online_vesion": "",
-                        "components": await self.get_plugin_components_info(plugin),
-                        "display_name": plugin.display_name,
-                        "logo": f"/api/file/{logo_url}" if logo_url else None,
-                        "support_platforms": plugin.support_platforms,
-                        "astrbot_version": plugin.astrbot_version,
-                        "installed_at": self._get_plugin_installed_at(plugin),
-                        "i18n": plugin.i18n,
-                    }
-                )
-                .__dict__
-            )
-
-        return Response().error("插件不存在").__dict__
-
-    async def get_failed_plugins(self):
-        """专门获取加载失败的插件列表(字典格式)"""
-        return Response().ok(self.plugin_manager.failed_plugin_dict).__dict__
-
-    async def get_plugin_components_info(self, plugin):
-        """Build plugin components for the dashboard."""
-        page_components = await self.get_plugin_page_components(plugin)
-        handler_components = await self.get_plugin_handler_components(
-            plugin.star_handler_full_names,
-        )
-        components = [
-            *page_components,
-            *self.get_plugin_skill_components(plugin),
-            *handler_components,
-        ]
-        return sorted(
-            components,
-            key=lambda item: PLUGIN_COMPONENT_TYPE_ORDER.get(item["type"], 99),
-        )
-
-    async def get_plugin_page_components(self, plugin) -> list[dict]:
-        pages = await self._serialize_plugin_pages(plugin)
-        return [
-            {
-                "type": "page",
-                "name": page["title"],
-                "title": page["title"],
-                "page_name": page["name"],
-                "i18n_key": page["i18n_key"],
-                "description": "Plugin Page entry",
-                "plugin_name": plugin.name,
-                "plugin_marketplace_name": (plugin.name or "").replace("_", "-"),
-            }
-            for page in pages
-        ]
-
-    async def get_plugin_handler_components(self, handler_full_names: list[str]):
-        """Build behavior components from registered handlers."""
-        components = []
-
-        for handler_full_name in handler_full_names:
-            info = {}
-            handler = star_handlers_registry.star_handlers_map.get(
-                handler_full_name,
-                None,
-            )
-            if handler is None:
-                continue
-            info["event_type"] = handler.event_type.name
-            info["event_type_h"] = self.translated_event_type.get(
-                handler.event_type,
-                handler.event_type.name,
-            )
-            info["handler_full_name"] = handler.handler_full_name
-            info["description"] = handler.desc or "无描述"
-            info["handler_name"] = handler.handler_name
-
-            component_type = "hook"
-            component = None
-            if handler.event_type == EventType.AdapterMessageEvent:
-                # 处理平台适配器消息事件
-                has_admin = False
-                for event_filter in (
-                    handler.event_filters
-                ):  # 正常handler就只有 1~2 个 filter，因此这里时间复杂度不会太高
-                    if isinstance(event_filter, CommandFilter):
-                        component_type = "command"
-                        info["display_type"] = "指令"
-                        info["cmd"] = self._get_command_filter_display_name(
-                            event_filter
-                        )
-                        component = self._build_command_filter_component(
-                            event_filter,
-                            handler.desc,
-                        )
-                    elif isinstance(event_filter, CommandGroupFilter):
-                        component_type = "command"
-                        info["display_type"] = "指令组"
-                        info["cmd"] = event_filter.get_complete_command_names()[0]
-                        info["cmd"] = info["cmd"].strip()
-                        component = self._build_command_group_component(
-                            event_filter,
-                            handler.desc,
-                        )
-                    elif isinstance(event_filter, RegexFilter):
-                        component_type = "command"
-                        info["display_type"] = "正则匹配"
-                        info["cmd"] = event_filter.regex_str
-                        component = {
-                            "type": "command",
-                            "name": event_filter.regex_str,
-                            "description": handler.desc or "无描述",
-                            "match": "regex",
-                        }
-                    elif isinstance(event_filter, PermissionTypeFilter):
-                        has_admin = True
-                info["has_admin"] = has_admin
-                if "cmd" not in info:
-                    info["cmd"] = "未知"
-                if "display_type" not in info:
-                    info["display_type"] = "事件监听器"
-                    component_type = "listener"
-            else:
-                info["cmd"] = "自动触发"
-                info["display_type"] = "无"
-                if handler.event_type == EventType.OnCallingFuncToolEvent:
-                    component_type = "llm_tool"
-
-            if component is None:
-                component = {
-                    "type": component_type,
-                    "name": handler.handler_name or handler.event_type.name,
-                    "description": handler.desc or "无描述",
-                }
-            else:
-                component["type"] = component_type
-
-            if component_type == "command":
-                component["event_type"] = info["event_type"]
-                component["event_type_h"] = info["event_type_h"]
-                component["handler_name"] = info["handler_name"]
-                component["has_admin"] = info.get("has_admin", False)
-                if "display_type" in info:
-                    component["display_type"] = info["display_type"]
-                if "cmd" in info:
-                    component["command"] = info["cmd"]
-            else:
-                component.update(info)
-            components.append(component)
-
-        return self._merge_command_components(components)
-
-    def get_plugin_skill_components(self, plugin):
-        """Build skill components provided by this plugin."""
-        plugin_names = {
-            str(name)
-            for name in (plugin.root_dir_name, plugin.name)
-            if str(name or "").strip()
-        }
-        if not plugin_names:
-            return []
-
-        try:
-            skills = SkillManager().list_skills(
-                active_only=False,
-                runtime="local",
-                show_sandbox_path=False,
-            )
-        except Exception as exc:
-            logger.warning(f"获取插件 Skills 失败 {plugin.name}: {exc!s}")
-            return []
-
-        components = []
-        for skill in skills:
-            if skill.source_type != "plugin" or skill.plugin_name not in plugin_names:
-                continue
-            components.append(
-                {
-                    "type": "skill",
-                    "name": skill.name,
-                    "description": skill.description or "无描述",
-                    "path": skill.path,
-                }
-            )
-        return components
-
-    def _get_command_filter_display_name(self, command_filter: CommandFilter) -> str:
-        return command_filter.get_complete_command_names()[0].strip()
-
-    def _get_command_description(
-        self,
-        command_filter: CommandFilter | CommandGroupFilter,
-        fallback: str = "",
-    ) -> str:
-        handler_md = getattr(command_filter, "handler_md", None)
-        desc = getattr(handler_md, "desc", "") if handler_md else ""
-        return desc or fallback or "无描述"
-
-    def _build_command_filter_component(
-        self,
-        command_filter: CommandFilter,
-        fallback_desc: str = "",
-    ) -> dict:
-        parts = self._get_command_filter_display_name(command_filter).split()
-        if not parts:
-            parts = [command_filter.command_name]
-        component = {
-            "type": "command",
-            "name": parts[-1],
-            "description": self._get_command_description(
-                command_filter,
-                fallback_desc,
-            ),
-        }
-        return self._wrap_command_component(parts[:-1], component)
-
-    def _build_command_group_component(
-        self,
-        command_group_filter: CommandGroupFilter,
-        fallback_desc: str = "",
-    ) -> dict:
-        parts = command_group_filter.get_complete_command_names()[0].strip().split()
-        if not parts:
-            parts = [command_group_filter.group_name]
-        subcommands = [
-            self._build_command_group_child(sub_filter)
-            for sub_filter in command_group_filter.sub_command_filters
-        ]
-        component = {
-            "type": "command",
-            "name": parts[-1],
-            "description": self._get_command_description(
-                command_group_filter,
-                fallback_desc,
-            ),
-        }
-        if subcommands:
-            component["subcommands"] = subcommands
-        return self._wrap_command_component(parts[:-1], component)
-
-    def _build_command_group_child(
-        self,
-        command_filter: CommandFilter | CommandGroupFilter,
-    ) -> dict:
-        if isinstance(command_filter, CommandGroupFilter):
-            component = {
-                "name": command_filter.group_name,
-                "description": self._get_command_description(command_filter),
-            }
-            subcommands = [
-                self._build_command_group_child(sub_filter)
-                for sub_filter in command_filter.sub_command_filters
-            ]
-            if subcommands:
-                component["subcommands"] = subcommands
-            return component
-
-        return {
-            "name": command_filter.command_name,
-            "description": self._get_command_description(command_filter),
-        }
-
-    def _wrap_command_component(self, parent_names: list[str], component: dict) -> dict:
-        for parent_name in reversed(parent_names):
-            component = {
-                "type": "command",
-                "name": parent_name,
-                "description": "无描述",
-                "subcommands": [component],
-            }
-        return component
-
-    def _merge_command_components(self, components: list[dict]) -> list[dict]:
-        merged: list[dict] = []
-        for component in components:
-            if component.get("type") != "command":
-                merged.append(component)
-                continue
-            existing = next(
-                (
-                    item
-                    for item in merged
-                    if item.get("type") == "command"
-                    and item.get("name") == component.get("name")
-                    and item.get("match") == component.get("match")
-                ),
-                None,
-            )
-            if existing is None:
-                merged.append(component)
-                continue
-            self._merge_command_component(existing, component)
-        return merged
-
-    def _merge_command_component(self, target: dict, source: dict) -> None:
-        if target.get("description") == "无描述" and source.get("description"):
-            target["description"] = source["description"]
-        for key, value in source.items():
-            if key in {"subcommands", "description"}:
-                continue
-            target.setdefault(key, value)
-
-        source_subcommands = source.get("subcommands")
-        if not isinstance(source_subcommands, list):
-            return
-        target_subcommands = target.setdefault("subcommands", [])
-        for source_subcommand in source_subcommands:
-            if not isinstance(source_subcommand, dict):
-                continue
-            existing = next(
-                (
-                    item
-                    for item in target_subcommands
-                    if isinstance(item, dict)
-                    and item.get("name") == source_subcommand.get("name")
-                ),
-                None,
-            )
-            if existing is None:
-                target_subcommands.append(source_subcommand)
-                continue
-            self._merge_command_component(existing, source_subcommand)
-
-    async def install_plugin(self):
-        if DEMO_MODE:
-            return (
-                Response()
-                .error("You are not permitted to do this operation in demo mode")
-                .__dict__
-            )
-
-        post_data = await request.get_json()
-        repo_url = post_data["url"]
-        download_url = str(post_data.get("download_url") or "").strip()
-        ignore_version_check = bool(post_data.get("ignore_version_check", False))
-
-        proxy: str = post_data.get("proxy", None)
-        if proxy:
-            proxy = proxy.removesuffix("/")
-
-        try:
-            logger.info(f"正在安装插件 {repo_url}")
-            plugin_info = await self.plugin_manager.install_plugin(
-                repo_url,
-                proxy,
-                ignore_version_check=ignore_version_check,
-                download_url=download_url,
-            )
-            # self.core_lifecycle.restart()
-            await self._sync_skills_after_plugin_change()
-            logger.info(f"安装插件 {repo_url} 成功。")
-            return Response().ok(plugin_info, "安装成功。").__dict__
-        except PluginVersionIncompatibleError as e:
-            return {
-                "status": "warning",
-                "message": str(e),
-                "data": {
-                    "warning_type": "astrbot_version_incompatible",
-                    "can_ignore": True,
-                },
-            }
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(str(e)).__dict__
-
-    async def install_plugin_upload(self):
-        if DEMO_MODE:
-            return (
-                Response()
-                .error("You are not permitted to do this operation in demo mode")
-                .__dict__
-            )
-
-        try:
-            file = await request.files
-            file = file["file"]
-            form_data = await request.form
-            ignore_version_check = (
-                str(form_data.get("ignore_version_check", "false")).lower() == "true"
-            )
-            logger.info(f"正在安装用户上传的插件 {file.filename}")
-            file_path = os.path.join(
-                get_astrbot_temp_path(),
-                f"plugin_upload_{file.filename}",
-            )
-            await file.save(file_path)
-            plugin_info = await self.plugin_manager.install_plugin_from_file(
-                file_path,
-                ignore_version_check=ignore_version_check,
-            )
-            # self.core_lifecycle.restart()
-            await self._sync_skills_after_plugin_change()
-            logger.info(f"安装插件 {file.filename} 成功")
-            return Response().ok(plugin_info, "安装成功。").__dict__
-        except PluginVersionIncompatibleError as e:
-            return {
-                "status": "warning",
-                "message": str(e),
-                "data": {
-                    "warning_type": "astrbot_version_incompatible",
-                    "can_ignore": True,
-                },
-            }
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(str(e)).__dict__
-
-    async def uninstall_plugin(self):
-        if DEMO_MODE:
-            return (
-                Response()
-                .error("You are not permitted to do this operation in demo mode")
-                .__dict__
-            )
-
-        post_data = await request.get_json()
-        plugin_name = post_data["name"]
-        delete_config = post_data.get("delete_config", False)
-        delete_data = post_data.get("delete_data", False)
-        try:
-            logger.info(f"正在卸载插件 {plugin_name}")
-            await self.plugin_manager.uninstall_plugin(
-                plugin_name,
-                delete_config=delete_config,
-                delete_data=delete_data,
-            )
-            await self._sync_skills_after_plugin_change()
-            logger.info(f"卸载插件 {plugin_name} 成功")
-            return Response().ok(None, "卸载成功").__dict__
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(str(e)).__dict__
-
-    async def uninstall_failed_plugin(self):
-        if DEMO_MODE:
-            return (
-                Response()
-                .error("You are not permitted to do this operation in demo mode")
-                .__dict__
-            )
-
-        post_data = await request.get_json()
-        dir_name = post_data.get("dir_name", "")
-        delete_config = post_data.get("delete_config", False)
-        delete_data = post_data.get("delete_data", False)
-        if not dir_name:
-            return Response().error("缺少失败插件目录名").__dict__
-
-        try:
-            logger.info(f"正在卸载失败插件 {dir_name}")
-            await self.plugin_manager.uninstall_failed_plugin(
-                dir_name,
-                delete_config=delete_config,
-                delete_data=delete_data,
-            )
-            await self._sync_skills_after_plugin_change()
-            logger.info(f"卸载失败插件 {dir_name} 成功")
-            return Response().ok(None, "卸载成功").__dict__
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(str(e)).__dict__
-
-    async def update_plugin(self):
-        if DEMO_MODE:
-            return (
-                Response()
-                .error("You are not permitted to do this operation in demo mode")
-                .__dict__
-            )
-
-        post_data = await request.get_json()
-        plugin_name = post_data["name"]
-        proxy: str = post_data.get("proxy", None)
-        download_url = str(post_data.get("download_url") or "").strip()
-        try:
-            logger.info(f"正在更新插件 {plugin_name}")
-            await self.plugin_manager.update_plugin(
-                plugin_name, proxy, download_url=download_url
-            )
-            # self.core_lifecycle.restart()
-            await self.plugin_manager.reload(plugin_name)
-            await self._sync_skills_after_plugin_change()
-            logger.info(f"更新插件 {plugin_name} 成功。")
-            return Response().ok(None, "更新成功。").__dict__
-        except Exception as e:
-            logger.error(f"/api/plugin/update: {traceback.format_exc()}")
-            return Response().error(str(e)).__dict__
-
-    async def update_all_plugins(self):
-        if DEMO_MODE:
-            return (
-                Response()
-                .error("You are not permitted to do this operation in demo mode")
-                .__dict__
-            )
-
-        post_data = await request.get_json()
-        plugin_names: list[str] = post_data.get("names") or []
-        proxy: str = post_data.get("proxy", "")
-        download_urls: dict[str, str] = post_data.get("download_urls") or {}
-
-        if not isinstance(plugin_names, list) or not plugin_names:
-            return Response().error("插件列表不能为空").__dict__
-        if not isinstance(download_urls, dict):
-            download_urls = {}
-
-        results = []
-        sem = asyncio.Semaphore(PLUGIN_UPDATE_CONCURRENCY)
-
-        async def _update_one(name: str):
-            async with sem:
-                try:
-                    logger.info(f"批量更新插件 {name}")
-                    download_url = str(download_urls.get(name) or "").strip()
-                    await self.plugin_manager.update_plugin(
-                        name, proxy, download_url=download_url
-                    )
-                    return {"name": name, "status": "ok", "message": "更新成功"}
-                except Exception as e:
-                    logger.error(
-                        f"/api/plugin/update-all: 更新插件 {name} 失败: {traceback.format_exc()}",
-                    )
-                    return {"name": name, "status": "error", "message": str(e)}
-
-        raw_results = await asyncio.gather(
-            *(_update_one(name) for name in plugin_names),
-            return_exceptions=True,
-        )
-        for name, result in zip(plugin_names, raw_results):
-            if isinstance(result, asyncio.CancelledError):
-                raise result
-            if isinstance(result, BaseException):
-                results.append(
-                    {"name": name, "status": "error", "message": str(result)}
-                )
-            else:
-                results.append(result)
-
-        failed = [r for r in results if r["status"] == "error"]
-        if len(failed) < len(results):
-            await self._sync_skills_after_plugin_change()
-        message = (
-            "批量更新完成，全部成功。"
-            if not failed
-            else f"批量更新完成，其中 {len(failed)}/{len(results)} 个插件失败。"
-        )
-
-        return Response().ok({"results": results}, message).__dict__
-
-    async def off_plugin(self):
-        if DEMO_MODE:
-            return (
-                Response()
-                .error("You are not permitted to do this operation in demo mode")
-                .__dict__
-            )
-
-        post_data = await request.get_json()
-        plugin_name = post_data["name"]
-        try:
-            await self.plugin_manager.turn_off_plugin(plugin_name)
-            await self._sync_skills_after_plugin_change()
-            logger.info(f"停用插件 {plugin_name} 。")
-            return Response().ok(None, "停用成功。").__dict__
-        except Exception as e:
-            logger.error(f"/api/plugin/off: {traceback.format_exc()}")
-            return Response().error(str(e)).__dict__
-
-    async def on_plugin(self):
-        if DEMO_MODE:
-            return (
-                Response()
-                .error("You are not permitted to do this operation in demo mode")
-                .__dict__
-            )
-
-        post_data = await request.get_json()
-        plugin_name = post_data["name"]
-        try:
-            await self.plugin_manager.turn_on_plugin(plugin_name)
-            await self._sync_skills_after_plugin_change()
-            logger.info(f"启用插件 {plugin_name} 。")
-            return Response().ok(None, "启用成功。").__dict__
-        except Exception as e:
-            logger.error(f"/api/plugin/on: {traceback.format_exc()}")
-            return Response().error(str(e)).__dict__
-
-    async def get_plugin_readme(self):
-        plugin_name = request.args.get("name")
-
-        if not plugin_name:
-            logger.warning("插件名称为空")
-            return Response().error("插件名称不能为空").__dict__
-
-        plugin_obj = None
-        for plugin in self.plugin_manager.context.get_all_stars():
-            if plugin.name == plugin_name:
-                plugin_obj = plugin
-                break
-
-        if not plugin_obj:
-            logger.warning(f"插件 {plugin_name} 不存在")
-            return Response().error(f"插件 {plugin_name} 不存在").__dict__
-
-        if not plugin_obj.root_dir_name:
-            logger.warning(f"插件 {plugin_name} 目录不存在")
-            return Response().error(f"插件 {plugin_name} 目录不存在").__dict__
-
-        if plugin_obj.reserved:
-            plugin_dir = os.path.join(
-                self.plugin_manager.reserved_plugin_path,
-                plugin_obj.root_dir_name,
-            )
-        else:
-            plugin_dir = os.path.join(
-                self.plugin_manager.plugin_store_path,
-                plugin_obj.root_dir_name,
-            )
-
-        if not os.path.isdir(plugin_dir):
-            logger.warning(f"无法找到插件目录: {plugin_dir}")
-            return Response().error(f"无法找到插件 {plugin_name} 的目录").__dict__
-
-        readme_path = os.path.join(plugin_dir, "README.md")
-
-        if not os.path.isfile(readme_path):
-            logger.warning(f"插件 {plugin_name} 没有README文件")
-            return Response().error(f"插件 {plugin_name} 没有README文件").__dict__
-
-        try:
-            with open(readme_path, encoding="utf-8") as f:
-                readme_content = f.read()
-
-            return (
-                Response()
-                .ok({"content": readme_content}, "成功获取README内容")
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(f"/api/plugin/readme: {traceback.format_exc()}")
-            return Response().error(f"读取README文件失败: {e!s}").__dict__
-
-    async def get_plugin_changelog(self):
-        """获取插件更新日志
-
-        读取插件目录下的 CHANGELOG.md 文件内容。
-        """
-        plugin_name = request.args.get("name")
-        logger.debug(f"正在获取插件 {plugin_name} 的更新日志")
-
-        if not plugin_name:
-            logger.warning("插件名称为空")
-            return Response().error("插件名称不能为空").__dict__
-
-        # 查找插件
-        plugin_obj = None
-        for plugin in self.plugin_manager.context.get_all_stars():
-            if plugin.name == plugin_name:
-                plugin_obj = plugin
-                break
-
-        if not plugin_obj:
-            logger.warning(f"插件 {plugin_name} 不存在")
-            return Response().error(f"插件 {plugin_name} 不存在").__dict__
-
-        if not plugin_obj.root_dir_name:
-            logger.warning(f"插件 {plugin_name} 目录不存在")
-            return Response().error(f"插件 {plugin_name} 目录不存在").__dict__
-
-        if plugin_obj.reserved:
-            plugin_dir = os.path.join(
-                self.plugin_manager.reserved_plugin_path,
-                plugin_obj.root_dir_name,
-            )
-        else:
-            plugin_dir = os.path.join(
-                self.plugin_manager.plugin_store_path,
-                plugin_obj.root_dir_name,
-            )
-
-        if not os.path.isdir(plugin_dir):
-            logger.warning(f"无法找到插件目录: {plugin_dir}")
-            return Response().error(f"无法找到插件 {plugin_name} 的目录").__dict__
-
-        # 尝试多种可能的文件名
-        changelog_names = ["CHANGELOG.md", "changelog.md", "CHANGELOG", "changelog"]
-        for name in changelog_names:
-            changelog_path = os.path.join(plugin_dir, name)
-            if os.path.isfile(changelog_path):
-                try:
-                    with open(changelog_path, encoding="utf-8") as f:
-                        changelog_content = f.read()
-                    return (
-                        Response()
-                        .ok({"content": changelog_content}, "成功获取更新日志")
-                        .__dict__
-                    )
-                except Exception as e:
-                    logger.error(f"/api/plugin/changelog: {traceback.format_exc()}")
-                    return Response().error(f"读取更新日志失败: {e!s}").__dict__
-
-        # 没有找到 changelog 文件，返回 ok 但 content 为 null
-        logger.warning(f"插件 {plugin_name} 没有更新日志文件")
-        return Response().ok({"content": None}, "该插件没有更新日志文件").__dict__
-
-    async def get_custom_source(self):
-        """获取自定义插件源"""
-        sources = await sp.global_get("custom_plugin_sources", [])
-        return Response().ok(sources).__dict__
-
-    async def save_custom_source(self):
-        """保存自定义插件源"""
-        try:
-            data = await request.get_json()
-            sources = data.get("sources", [])
-            if not isinstance(sources, list):
-                return Response().error("sources fields must be a list").__dict__
-
-            await sp.global_put("custom_plugin_sources", sources)
-            return Response().ok(None, "保存成功").__dict__
-        except Exception as e:
-            logger.error(f"/api/plugin/source/save: {traceback.format_exc()}")
-            return Response().error(str(e)).__dict__
diff --git a/astrbot/dashboard/routes/route.py b/astrbot/dashboard/routes/route.py
deleted file mode 100644
index 53c623443..000000000
--- a/astrbot/dashboard/routes/route.py
+++ /dev/null
@@ -1,59 +0,0 @@
-from dataclasses import dataclass
-
-from quart import Quart
-
-from astrbot.core.config.astrbot_config import AstrBotConfig
-
-
-@dataclass
-class RouteContext:
-    config: AstrBotConfig
-    app: Quart
-
-
-class Route:
-    routes: list | dict
-
-    def __init__(self, context: RouteContext) -> None:
-        self.app = context.app
-        self.config = context.config
-
-    def register_routes(self) -> None:
-        def _add_rule(path, method, func) -> None:
-            # 统一添加 /api 前缀
-            full_path = f"/api{path}"
-            self.app.add_url_rule(full_path, view_func=func, methods=[method])
-
-        # 兼容字典和列表两种格式
-        routes_to_register = (
-            self.routes.items() if isinstance(self.routes, dict) else self.routes
-        )
-
-        for route, definition in routes_to_register:
-            # 兼容一个路由多个方法
-            if isinstance(definition, list):
-                for method, func in definition:
-                    _add_rule(route, method, func)
-            else:
-                method, func = definition
-                _add_rule(route, method, func)
-
-
-@dataclass
-class Response:
-    status: str | None = None
-    message: str | None = None
-    data: dict | list | None = None
-
-    def error(self, message: str):
-        self.status = "error"
-        self.message = message
-        return self
-
-    def ok(self, data: dict | list | None = None, message: str | None = None):
-        self.status = "ok"
-        if data is None:
-            data = {}
-        self.data = data
-        self.message = message
-        return self
diff --git a/astrbot/dashboard/routes/session_management.py b/astrbot/dashboard/routes/session_management.py
deleted file mode 100644
index 688515f4e..000000000
--- a/astrbot/dashboard/routes/session_management.py
+++ /dev/null
@@ -1,965 +0,0 @@
-from quart import request
-from sqlalchemy.ext.asyncio import AsyncSession
-from sqlmodel import col, select
-
-from astrbot.core import logger, sp
-from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
-from astrbot.core.db import BaseDatabase
-from astrbot.core.db.po import ConversationV2, Preference
-from astrbot.core.provider.entities import ProviderType
-from astrbot.core.umo_alias import build_umo_alias_map, parse_umo, serialize_umo_alias
-
-from .route import Response, Route, RouteContext
-
-AVAILABLE_SESSION_RULE_KEYS = [
-    "session_service_config",
-    "session_plugin_config",
-    "kb_config",
-    f"provider_perf_{ProviderType.CHAT_COMPLETION.value}",
-    f"provider_perf_{ProviderType.SPEECH_TO_TEXT.value}",
-    f"provider_perf_{ProviderType.TEXT_TO_SPEECH.value}",
-]
-
-
-class SessionManagementRoute(Route):
-    def __init__(
-        self,
-        context: RouteContext,
-        db_helper: BaseDatabase,
-        core_lifecycle: AstrBotCoreLifecycle,
-    ) -> None:
-        super().__init__(context)
-        self.db_helper = db_helper
-        self.routes = {
-            "/session/list-rule": ("GET", self.list_session_rule),
-            "/session/update-rule": ("POST", self.update_session_rule),
-            "/session/delete-rule": ("POST", self.delete_session_rule),
-            "/session/batch-delete-rule": ("POST", self.batch_delete_session_rule),
-            "/session/active-umos": ("GET", self.list_umos),
-            "/session/list-all-with-status": ("GET", self.list_all_umos_with_status),
-            "/session/batch-update-service": ("POST", self.batch_update_service),
-            "/session/batch-update-provider": ("POST", self.batch_update_provider),
-            # 分组管理 API
-            "/session/groups": ("GET", self.list_groups),
-            "/session/group/create": ("POST", self.create_group),
-            "/session/group/update": ("POST", self.update_group),
-            "/session/group/delete": ("POST", self.delete_group),
-        }
-        self.conv_mgr = core_lifecycle.conversation_manager
-        self.core_lifecycle = core_lifecycle
-        self.register_routes()
-
-    @staticmethod
-    def _is_group_umo(umo: str) -> bool:
-        umo_lower = umo.lower()
-        return ":group:" in umo_lower or ":groupmessage:" in umo_lower
-
-    @staticmethod
-    def _is_private_umo(umo: str) -> bool:
-        umo_lower = umo.lower()
-        return (
-            ":private:" in umo_lower
-            or ":friend:" in umo_lower
-            or ":friendmessage:" in umo_lower
-        )
-
-    async def _list_known_umos(self) -> list[str]:
-        async with self.db_helper.get_db() as session:
-            session: AsyncSession
-            result = await session.execute(select(ConversationV2.user_id).distinct())
-            umos = {str(row[0]) for row in result.fetchall() if row[0]}
-
-        aliases = await self.db_helper.get_umo_aliases()
-        umos.update(str(alias.umo) for alias in aliases if alias.umo)
-        return sorted(umos)
-
-    async def _get_umo_alias_map(self, umos: list[str]) -> dict:
-        return build_umo_alias_map(await self.db_helper.get_umo_aliases(umos))
-
-    def _build_umo_info(self, umo: str | None, alias_map: dict) -> dict:
-        umo_str = umo or ""
-        return {
-            "umo": umo_str,
-            **parse_umo(umo_str),
-            **serialize_umo_alias(alias_map.get(umo_str), umo_str),
-        }
-
-    async def _get_umos_by_scope(
-        self,
-        scope: str,
-        group_id: str = "",
-    ) -> list[str]:
-        if scope == "custom_group":
-            if not group_id:
-                raise ValueError("请指定分组 ID")
-            groups = self._get_groups()
-            if group_id not in groups:
-                raise ValueError(f"分组 '{group_id}' 不存在")
-            return groups[group_id].get("umos", [])
-
-        all_umos = await self._list_known_umos()
-        if scope == "group":
-            return [umo for umo in all_umos if self._is_group_umo(umo)]
-        if scope == "private":
-            return [umo for umo in all_umos if self._is_private_umo(umo)]
-        if scope == "all":
-            return all_umos
-        return []
-
-    async def _get_umo_rules(
-        self, page: int = 1, page_size: int = 10, search: str = ""
-    ) -> tuple[dict, int]:
-        """获取所有带有自定义规则的 umo 及其规则内容（支持分页和搜索）。
-
-        如果某个 umo 在 preference 中有以下字段，则表示有自定义规则：
-
-        1. session_service_config (包含了 是否启用这个umo, 这个umo是否启用 llm, 这个umo是否启用tts, umo自定义名称。)
-        2. session_plugin_config (包含了 这个 umo 的 plugin set)
-        3. provider_perf_{ProviderType.value} (包含了这个 umo 所选择使用的 provider 信息)
-        4. kb_config (包含了这个 umo 的知识库相关配置)
-
-        Args:
-            page: 页码，从 1 开始
-            page_size: 每页数量
-            search: 搜索关键词，匹配 umo 或 custom_name
-
-        Returns:
-            tuple[dict, int]: (umo_rules, total) - 分页后的 umo 规则和总数
-        """
-        umo_rules = {}
-        async with self.db_helper.get_db() as session:
-            session: AsyncSession
-            result = await session.execute(
-                select(Preference).where(
-                    col(Preference.scope) == "umo",
-                    col(Preference.key).in_(AVAILABLE_SESSION_RULE_KEYS),
-                )
-            )
-            prefs = result.scalars().all()
-            for pref in prefs:
-                umo_id = pref.scope_id
-                if umo_id not in umo_rules:
-                    umo_rules[umo_id] = {}
-                if pref.key == "session_plugin_config" and umo_id in pref.value["val"]:
-                    umo_rules[umo_id][pref.key] = pref.value["val"][umo_id]
-                else:
-                    umo_rules[umo_id][pref.key] = pref.value["val"]
-
-        alias_map = await self._get_umo_alias_map(list(umo_rules.keys()))
-
-        # 搜索过滤
-        if search:
-            search_lower = search.lower()
-            filtered_rules = {}
-            for umo_id, rules in umo_rules.items():
-                # 匹配 umo
-                if search_lower in umo_id.lower():
-                    filtered_rules[umo_id] = rules
-                    continue
-                # 匹配 custom_name
-                svc_config = rules.get("session_service_config", {})
-                custom_name = svc_config.get("custom_name", "") if svc_config else ""
-                if custom_name and search_lower in custom_name.lower():
-                    filtered_rules[umo_id] = rules
-                    continue
-
-                alias_info = serialize_umo_alias(alias_map.get(umo_id), umo_id)
-                if any(
-                    search_lower in alias_info[key].lower()
-                    for key in ("auto_name", "user_alias", "display_name")
-                    if alias_info.get(key)
-                ):
-                    filtered_rules[umo_id] = rules
-            umo_rules = filtered_rules
-
-        # 获取总数
-        total = len(umo_rules)
-
-        # 分页处理
-        all_umo_ids = list(umo_rules.keys())
-        start_idx = (page - 1) * page_size
-        end_idx = start_idx + page_size
-        paginated_umo_ids = all_umo_ids[start_idx:end_idx]
-
-        # 只返回分页后的数据
-        paginated_rules = {umo_id: umo_rules[umo_id] for umo_id in paginated_umo_ids}
-
-        return paginated_rules, total
-
-    async def list_session_rule(self):
-        """获取所有自定义的规则（支持分页和搜索）
-
-        返回已配置规则的 umo 列表及其规则内容，以及可用的 personas 和 providers
-
-        Query 参数:
-            page: 页码，默认为 1
-            page_size: 每页数量，默认为 10
-            search: 搜索关键词，匹配 umo 或 custom_name
-        """
-        try:
-            # 获取分页和搜索参数
-            page = request.args.get("page", 1, type=int)
-            page_size = request.args.get("page_size", 10, type=int)
-            search = request.args.get("search", "", type=str).strip()
-
-            # 参数校验
-            if page < 1:
-                page = 1
-            if page_size < 1:
-                page_size = 10
-            if page_size > 100:
-                page_size = 100
-
-            umo_rules, total = await self._get_umo_rules(
-                page=page, page_size=page_size, search=search
-            )
-
-            # 构建规则列表
-            rules_list = []
-            alias_map = await self._get_umo_alias_map(list(umo_rules.keys()))
-            for umo, rules in umo_rules.items():
-                rule_info = {
-                    "rules": rules,
-                    **self._build_umo_info(umo, alias_map),
-                }
-                rules_list.append(rule_info)
-
-            # 获取可用的 providers 和 personas
-            provider_manager = self.core_lifecycle.provider_manager
-            persona_mgr = self.core_lifecycle.persona_mgr
-
-            available_personas = [
-                {"name": p["name"], "prompt": p.get("prompt", "")}
-                for p in persona_mgr.personas_v3
-            ]
-
-            available_chat_providers = [
-                {
-                    "id": p.meta().id,
-                    "name": p.meta().id,
-                    "model": p.meta().model,
-                }
-                for p in provider_manager.provider_insts
-            ]
-
-            available_stt_providers = [
-                {
-                    "id": p.meta().id,
-                    "name": p.meta().id,
-                    "model": p.meta().model,
-                }
-                for p in provider_manager.stt_provider_insts
-            ]
-
-            available_tts_providers = [
-                {
-                    "id": p.meta().id,
-                    "name": p.meta().id,
-                    "model": p.meta().model,
-                }
-                for p in provider_manager.tts_provider_insts
-            ]
-
-            # 获取可用的插件列表（排除 reserved 的系统插件）
-            plugin_manager = self.core_lifecycle.plugin_manager
-            available_plugins = [
-                {
-                    "name": p.name,
-                    "display_name": p.display_name or p.name,
-                    "desc": p.desc,
-                }
-                for p in plugin_manager.context.get_all_stars()
-                if not p.reserved and p.name
-            ]
-
-            # 获取可用的知识库列表
-            available_kbs = []
-            kb_manager = self.core_lifecycle.kb_manager
-            if kb_manager:
-                try:
-                    kbs = await kb_manager.list_kbs()
-                    available_kbs = [
-                        {
-                            "kb_id": kb.kb_id,
-                            "kb_name": kb.kb_name,
-                            "emoji": kb.emoji,
-                        }
-                        for kb in kbs
-                    ]
-                except Exception as e:
-                    logger.warning(f"获取知识库列表失败: {e!s}")
-
-            return (
-                Response()
-                .ok(
-                    {
-                        "rules": rules_list,
-                        "total": total,
-                        "page": page,
-                        "page_size": page_size,
-                        "available_personas": available_personas,
-                        "available_chat_providers": available_chat_providers,
-                        "available_stt_providers": available_stt_providers,
-                        "available_tts_providers": available_tts_providers,
-                        "available_plugins": available_plugins,
-                        "available_kbs": available_kbs,
-                        "available_rule_keys": AVAILABLE_SESSION_RULE_KEYS,
-                    }
-                )
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(f"获取规则列表失败: {e!s}")
-            return Response().error(f"获取规则列表失败: {e!s}").__dict__
-
-    async def update_session_rule(self):
-        """更新某个 umo 的自定义规则
-
-        请求体:
-        {
-            "umo": "平台:消息类型:会话ID",
-            "rule_key": "session_service_config" | "session_plugin_config" | "kb_config" | "provider_perf_xxx",
-            "rule_value": {...}  // 规则值，具体结构根据 rule_key 不同而不同
-        }
-        """
-        try:
-            data = await request.get_json()
-            umo = data.get("umo")
-            rule_key = data.get("rule_key")
-            rule_value = data.get("rule_value")
-
-            if not umo:
-                return Response().error("缺少必要参数: umo").__dict__
-            if not rule_key:
-                return Response().error("缺少必要参数: rule_key").__dict__
-            if rule_key not in AVAILABLE_SESSION_RULE_KEYS:
-                return Response().error(f"不支持的规则键: {rule_key}").__dict__
-
-            if rule_key == "session_plugin_config":
-                rule_value = {
-                    umo: rule_value,
-                }
-
-            # 使用 shared preferences 更新规则
-            await sp.session_put(umo, rule_key, rule_value)
-
-            return (
-                Response()
-                .ok({"message": f"规则 {rule_key} 已更新", "umo": umo})
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(f"更新会话规则失败: {e!s}")
-            return Response().error(f"更新会话规则失败: {e!s}").__dict__
-
-    async def delete_session_rule(self):
-        """删除某个 umo 的自定义规则
-
-        请求体:
-        {
-            "umo": "平台:消息类型:会话ID",
-            "rule_key": "session_service_config" | "session_plugin_config" | ... (可选，不传则删除所有规则)
-        }
-        """
-        try:
-            data = await request.get_json()
-            umo = data.get("umo")
-            rule_key = data.get("rule_key")
-
-            if not umo:
-                return Response().error("缺少必要参数: umo").__dict__
-
-            if rule_key:
-                # 删除单个规则
-                if rule_key not in AVAILABLE_SESSION_RULE_KEYS:
-                    return Response().error(f"不支持的规则键: {rule_key}").__dict__
-                await sp.session_remove(umo, rule_key)
-                return (
-                    Response()
-                    .ok({"message": f"规则 {rule_key} 已删除", "umo": umo})
-                    .__dict__
-                )
-            else:
-                # 删除该 umo 的所有规则
-                await sp.clear_async("umo", umo)
-                return Response().ok({"message": "所有规则已删除", "umo": umo}).__dict__
-        except Exception as e:
-            logger.error(f"删除会话规则失败: {e!s}")
-            return Response().error(f"删除会话规则失败: {e!s}").__dict__
-
-    async def batch_delete_session_rule(self):
-        """批量删除多个 umo 的自定义规则
-
-        请求体:
-        {
-            "umos": ["平台:消息类型:会话ID", ...],  // 可选
-            "scope": "all" | "group" | "private" | "custom_group",  // 可选，批量范围
-            "group_id": "分组ID",  // 当 scope 为 custom_group 时必填
-            "rule_key": "session_service_config" | ... (可选，不传则删除所有规则)
-        }
-        """
-
-        try:
-            data = await request.get_json()
-            umos = data.get("umos", [])
-            scope = data.get("scope", "")
-            group_id = data.get("group_id", "")
-            rule_key = data.get("rule_key")
-
-            # 如果指定了 scope，获取符合条件的所有 umo
-            if scope and not umos:
-                try:
-                    umos = await self._get_umos_by_scope(scope, group_id)
-                except ValueError as e:
-                    return Response().error(str(e)).__dict__
-
-            if not umos:
-                return Response().error("缺少必要参数: umos 或有效的 scope").__dict__
-
-            if not isinstance(umos, list):
-                return Response().error("参数 umos 必须是数组").__dict__
-
-            if rule_key and rule_key not in AVAILABLE_SESSION_RULE_KEYS:
-                return Response().error(f"不支持的规则键: {rule_key}").__dict__
-
-            # 批量删除
-            success_count = 0
-            failed_umos = []
-            for umo in umos:
-                try:
-                    if rule_key:
-                        await sp.session_remove(umo, rule_key)
-                    else:
-                        await sp.clear_async("umo", umo)
-                    success_count += 1
-                except Exception as e:
-                    logger.error(f"删除 umo {umo} 的规则失败: {e!s}")
-                    failed_umos.append(umo)
-
-            message = f"已删除 {success_count} 条规则"
-            if rule_key:
-                message = f"已删除 {success_count} 条 {rule_key} 规则"
-
-            if failed_umos:
-                return (
-                    Response()
-                    .ok(
-                        {
-                            "message": f"{message}，{len(failed_umos)} 条删除失败",
-                            "success_count": success_count,
-                            "failed_umos": failed_umos,
-                        }
-                    )
-                    .__dict__
-                )
-            else:
-                return (
-                    Response()
-                    .ok(
-                        {
-                            "message": message,
-                            "success_count": success_count,
-                        }
-                    )
-                    .__dict__
-                )
-        except Exception as e:
-            logger.error(f"批量删除会话规则失败: {e!s}")
-            return Response().error(f"批量删除会话规则失败: {e!s}").__dict__
-
-    async def list_umos(self):
-        """List known UMOs from conversations and alias records.
-
-        Returns both the legacy string list and structured display metadata.
-        """
-        try:
-            umos = await self._list_known_umos()
-            alias_map = await self._get_umo_alias_map(umos)
-            umo_infos = [self._build_umo_info(umo, alias_map) for umo in umos]
-
-            return Response().ok({"umos": umos, "umo_infos": umo_infos}).__dict__
-        except Exception as e:
-            logger.error(f"获取 UMO 列表失败: {e!s}")
-            return Response().error(f"获取 UMO 列表失败: {e!s}").__dict__
-
-    async def list_all_umos_with_status(self):
-        """获取所有有对话记录的 UMO 及其服务状态（支持分页、搜索、筛选）
-
-        Query 参数:
-            page: 页码，默认为 1
-            page_size: 每页数量，默认为 20
-            search: 搜索关键词
-            message_type: 筛选消息类型 (group/private/all)
-            platform: 筛选平台
-        """
-        try:
-            page = request.args.get("page", 1, type=int)
-            page_size = request.args.get("page_size", 20, type=int)
-            search = request.args.get("search", "", type=str).strip()
-            message_type = request.args.get("message_type", "all", type=str)
-            platform = request.args.get("platform", "", type=str)
-
-            if page < 1:
-                page = 1
-            if page_size < 1:
-                page_size = 20
-            if page_size > 100:
-                page_size = 100
-
-            all_umos = await self._list_known_umos()
-            alias_map = await self._get_umo_alias_map(all_umos)
-
-            # 获取所有 umo 的规则配置
-            umo_rules, _ = await self._get_umo_rules(page=1, page_size=99999, search="")
-
-            # 构建带状态的 umo 列表
-            umos_with_status = []
-            for umo in all_umos:
-                umo_info = self._build_umo_info(umo, alias_map)
-                umo_platform = umo_info["platform"]
-                umo_message_type = umo_info["message_type"]
-
-                # 筛选消息类型
-                if message_type != "all":
-                    if message_type == "group" and umo_message_type not in [
-                        "group",
-                        "GroupMessage",
-                    ]:
-                        continue
-                    if message_type == "private" and umo_message_type not in [
-                        "private",
-                        "FriendMessage",
-                        "friend",
-                    ]:
-                        continue
-
-                # 筛选平台
-                if platform and umo_platform != platform:
-                    continue
-
-                # 获取服务配置
-                rules = umo_rules.get(umo, {})
-                svc_config = rules.get("session_service_config", {})
-
-                custom_name = svc_config.get("custom_name", "") if svc_config else ""
-                session_enabled = (
-                    svc_config.get("session_enabled", True) if svc_config else True
-                )
-                llm_enabled = (
-                    svc_config.get("llm_enabled", True) if svc_config else True
-                )
-                tts_enabled = (
-                    svc_config.get("tts_enabled", True) if svc_config else True
-                )
-
-                # 搜索过滤
-                if search:
-                    search_lower = search.lower()
-                    search_targets = [
-                        umo,
-                        custom_name,
-                        umo_info["auto_name"],
-                        umo_info["user_alias"],
-                        umo_info["display_name"],
-                    ]
-                    if not any(
-                        search_lower in target.lower()
-                        for target in search_targets
-                        if target
-                    ):
-                        continue
-
-                # 获取 provider 配置
-                chat_provider_key = (
-                    f"provider_perf_{ProviderType.CHAT_COMPLETION.value}"
-                )
-                tts_provider_key = f"provider_perf_{ProviderType.TEXT_TO_SPEECH.value}"
-                stt_provider_key = f"provider_perf_{ProviderType.SPEECH_TO_TEXT.value}"
-
-                umos_with_status.append(
-                    {
-                        **umo_info,
-                        "custom_name": custom_name,
-                        "session_enabled": session_enabled,
-                        "llm_enabled": llm_enabled,
-                        "tts_enabled": tts_enabled,
-                        "has_rules": umo in umo_rules,
-                        "chat_provider": rules.get(chat_provider_key),
-                        "tts_provider": rules.get(tts_provider_key),
-                        "stt_provider": rules.get(stt_provider_key),
-                    }
-                )
-
-            # 分页
-            total = len(umos_with_status)
-            start_idx = (page - 1) * page_size
-            end_idx = start_idx + page_size
-            paginated = umos_with_status[start_idx:end_idx]
-
-            # 获取可用的平台列表
-            platforms = list({u["platform"] for u in umos_with_status})
-
-            # 获取可用的 providers
-            provider_manager = self.core_lifecycle.provider_manager
-            available_chat_providers = [
-                {"id": p.meta().id, "name": p.meta().id, "model": p.meta().model}
-                for p in provider_manager.provider_insts
-            ]
-            available_tts_providers = [
-                {"id": p.meta().id, "name": p.meta().id, "model": p.meta().model}
-                for p in provider_manager.tts_provider_insts
-            ]
-            available_stt_providers = [
-                {"id": p.meta().id, "name": p.meta().id, "model": p.meta().model}
-                for p in provider_manager.stt_provider_insts
-            ]
-
-            return (
-                Response()
-                .ok(
-                    {
-                        "sessions": paginated,
-                        "total": total,
-                        "page": page,
-                        "page_size": page_size,
-                        "platforms": platforms,
-                        "available_chat_providers": available_chat_providers,
-                        "available_tts_providers": available_tts_providers,
-                        "available_stt_providers": available_stt_providers,
-                    }
-                )
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(f"获取会话状态列表失败: {e!s}")
-            return Response().error(f"获取会话状态列表失败: {e!s}").__dict__
-
-    async def batch_update_service(self):
-        """批量更新多个 UMO 的服务状态 (LLM/TTS/Session)
-
-        请求体:
-        {
-            "umos": ["平台:消息类型:会话ID", ...],  // 可选，如果不传则根据 scope 筛选
-            "scope": "all" | "group" | "private" | "custom_group",  // 可选，批量范围
-            "group_id": "分组ID",  // 当 scope 为 custom_group 时必填
-            "llm_enabled": true/false/null,  // 可选，null表示不修改
-            "tts_enabled": true/false/null,  // 可选
-            "session_enabled": true/false/null  // 可选
-        }
-        """
-        try:
-            data = await request.get_json()
-            umos = data.get("umos", [])
-            scope = data.get("scope", "")
-            group_id = data.get("group_id", "")
-            llm_enabled = data.get("llm_enabled")
-            tts_enabled = data.get("tts_enabled")
-            session_enabled = data.get("session_enabled")
-
-            # 如果没有任何修改
-            if llm_enabled is None and tts_enabled is None and session_enabled is None:
-                return Response().error("至少需要指定一个要修改的状态").__dict__
-
-            # 如果指定了 scope，获取符合条件的所有 umo
-            if scope and not umos:
-                try:
-                    umos = await self._get_umos_by_scope(scope, group_id)
-                except ValueError as e:
-                    return Response().error(str(e)).__dict__
-
-            if not umos:
-                return Response().error("没有找到符合条件的会话").__dict__
-
-            # 批量更新
-            success_count = 0
-            failed_umos = []
-
-            for umo in umos:
-                try:
-                    # 获取现有配置
-                    session_config = (
-                        sp.get("session_service_config", {}, scope="umo", scope_id=umo)
-                        or {}
-                    )
-
-                    # 更新状态
-                    if llm_enabled is not None:
-                        session_config["llm_enabled"] = llm_enabled
-                    if tts_enabled is not None:
-                        session_config["tts_enabled"] = tts_enabled
-                    if session_enabled is not None:
-                        session_config["session_enabled"] = session_enabled
-
-                    # 保存
-                    sp.put(
-                        "session_service_config",
-                        session_config,
-                        scope="umo",
-                        scope_id=umo,
-                    )
-                    success_count += 1
-                except Exception as e:
-                    logger.error(f"更新 {umo} 服务状态失败: {e!s}")
-                    failed_umos.append(umo)
-
-            status_changes = []
-            if llm_enabled is not None:
-                status_changes.append(f"LLM={'启用' if llm_enabled else '禁用'}")
-            if tts_enabled is not None:
-                status_changes.append(f"TTS={'启用' if tts_enabled else '禁用'}")
-            if session_enabled is not None:
-                status_changes.append(f"会话={'启用' if session_enabled else '禁用'}")
-
-            return (
-                Response()
-                .ok(
-                    {
-                        "message": f"已更新 {success_count} 个会话 ({', '.join(status_changes)})",
-                        "success_count": success_count,
-                        "failed_count": len(failed_umos),
-                        "failed_umos": failed_umos,
-                    }
-                )
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(f"批量更新服务状态失败: {e!s}")
-            return Response().error(f"批量更新服务状态失败: {e!s}").__dict__
-
-    async def batch_update_provider(self):
-        """批量更新多个 UMO 的 Provider 配置
-
-        请求体:
-        {
-            "umos": ["平台:消息类型:会话ID", ...],  // 可选
-            "scope": "all" | "group" | "private",  // 可选
-            "provider_type": "chat_completion" | "text_to_speech" | "speech_to_text",
-            "provider_id": "provider_id"
-        }
-        """
-        try:
-            data = await request.get_json()
-            umos = data.get("umos", [])
-            scope = data.get("scope", "")
-            provider_type = data.get("provider_type")
-            provider_id = data.get("provider_id")
-
-            if not provider_type or not provider_id:
-                return (
-                    Response()
-                    .error("缺少必要参数: provider_type, provider_id")
-                    .__dict__
-                )
-
-            # 转换 provider_type
-            provider_type_map = {
-                "chat_completion": ProviderType.CHAT_COMPLETION,
-                "text_to_speech": ProviderType.TEXT_TO_SPEECH,
-                "speech_to_text": ProviderType.SPEECH_TO_TEXT,
-            }
-            if provider_type not in provider_type_map:
-                return (
-                    Response()
-                    .error(f"不支持的 provider_type: {provider_type}")
-                    .__dict__
-                )
-
-            provider_type_enum = provider_type_map[provider_type]
-
-            # 如果指定了 scope，获取符合条件的所有 umo
-            group_id = data.get("group_id", "")
-            if scope and not umos:
-                try:
-                    umos = await self._get_umos_by_scope(scope, group_id)
-                except ValueError as e:
-                    return Response().error(str(e)).__dict__
-
-            if not umos:
-                return Response().error("没有找到符合条件的会话").__dict__
-
-            # 批量更新
-            success_count = 0
-            failed_umos = []
-            provider_manager = self.core_lifecycle.provider_manager
-
-            for umo in umos:
-                try:
-                    await provider_manager.set_provider(
-                        provider_id=provider_id,
-                        provider_type=provider_type_enum,
-                        umo=umo,
-                    )
-                    success_count += 1
-                except Exception as e:
-                    logger.error(f"更新 {umo} Provider 失败: {e!s}")
-                    failed_umos.append(umo)
-
-            return (
-                Response()
-                .ok(
-                    {
-                        "message": f"已更新 {success_count} 个会话的 {provider_type} 为 {provider_id}",
-                        "success_count": success_count,
-                        "failed_count": len(failed_umos),
-                        "failed_umos": failed_umos,
-                    }
-                )
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(f"批量更新 Provider 失败: {e!s}")
-            return Response().error(f"批量更新 Provider 失败: {e!s}").__dict__
-
-    # ==================== 分组管理 API ====================
-
-    def _get_groups(self) -> dict:
-        """获取所有分组"""
-        return sp.get("session_groups", {})
-
-    def _save_groups(self, groups: dict) -> None:
-        """保存分组"""
-        sp.put("session_groups", groups)
-
-    async def list_groups(self):
-        """获取所有分组列表"""
-        try:
-            groups = self._get_groups()
-            # 转换为列表格式，方便前端使用
-            groups_list = []
-            for group_id, group_data in groups.items():
-                groups_list.append(
-                    {
-                        "id": group_id,
-                        "name": group_data.get("name", ""),
-                        "umos": group_data.get("umos", []),
-                        "umo_count": len(group_data.get("umos", [])),
-                    }
-                )
-            return Response().ok({"groups": groups_list}).__dict__
-        except Exception as e:
-            logger.error(f"获取分组列表失败: {e!s}")
-            return Response().error(f"获取分组列表失败: {e!s}").__dict__
-
-    async def create_group(self):
-        """创建新分组"""
-        try:
-            data = await request.json
-            name = data.get("name", "").strip()
-            umos = data.get("umos", [])
-
-            if not name:
-                return Response().error("分组名称不能为空").__dict__
-
-            groups = self._get_groups()
-
-            # 生成唯一 ID
-            import uuid
-
-            group_id = str(uuid.uuid4())[:8]
-
-            groups[group_id] = {
-                "name": name,
-                "umos": umos,
-            }
-
-            self._save_groups(groups)
-
-            return (
-                Response()
-                .ok(
-                    {
-                        "message": f"分组 '{name}' 创建成功",
-                        "group": {
-                            "id": group_id,
-                            "name": name,
-                            "umos": umos,
-                            "umo_count": len(umos),
-                        },
-                    }
-                )
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(f"创建分组失败: {e!s}")
-            return Response().error(f"创建分组失败: {e!s}").__dict__
-
-    async def update_group(self):
-        """更新分组（改名、增删成员）"""
-        try:
-            data = await request.json
-            group_id = data.get("id")
-            name = data.get("name")
-            umos = data.get("umos")
-            add_umos = data.get("add_umos", [])
-            remove_umos = data.get("remove_umos", [])
-
-            if not group_id:
-                return Response().error("分组 ID 不能为空").__dict__
-
-            groups = self._get_groups()
-
-            if group_id not in groups:
-                return Response().error(f"分组 '{group_id}' 不存在").__dict__
-
-            group = groups[group_id]
-
-            # 更新名称
-            if name is not None:
-                group["name"] = name.strip()
-
-            # 直接设置 umos 列表
-            if umos is not None:
-                group["umos"] = umos
-            else:
-                # 增量更新
-                current_umos = set(group.get("umos", []))
-                if add_umos:
-                    current_umos.update(add_umos)
-                if remove_umos:
-                    current_umos.difference_update(remove_umos)
-                group["umos"] = list(current_umos)
-
-            self._save_groups(groups)
-
-            return (
-                Response()
-                .ok(
-                    {
-                        "message": f"分组 '{group['name']}' 更新成功",
-                        "group": {
-                            "id": group_id,
-                            "name": group["name"],
-                            "umos": group["umos"],
-                            "umo_count": len(group["umos"]),
-                        },
-                    }
-                )
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(f"更新分组失败: {e!s}")
-            return Response().error(f"更新分组失败: {e!s}").__dict__
-
-    async def delete_group(self):
-        """删除分组"""
-        try:
-            data = await request.json
-            group_id = data.get("id")
-
-            if not group_id:
-                return Response().error("分组 ID 不能为空").__dict__
-
-            groups = self._get_groups()
-
-            if group_id not in groups:
-                return Response().error(f"分组 '{group_id}' 不存在").__dict__
-
-            group_name = groups[group_id].get("name", group_id)
-            del groups[group_id]
-
-            self._save_groups(groups)
-
-            return Response().ok({"message": f"分组 '{group_name}' 已删除"}).__dict__
-        except Exception as e:
-            logger.error(f"删除分组失败: {e!s}")
-            return Response().error(f"删除分组失败: {e!s}").__dict__
diff --git a/astrbot/dashboard/routes/skills.py b/astrbot/dashboard/routes/skills.py
deleted file mode 100644
index c86598212..000000000
--- a/astrbot/dashboard/routes/skills.py
+++ /dev/null
@@ -1,960 +0,0 @@
-import os
-import re
-import shutil
-import traceback
-from collections.abc import Awaitable, Callable
-from pathlib import Path
-from typing import Any
-
-from quart import request, send_file
-
-from astrbot.core import DEMO_MODE, logger
-from astrbot.core.computer.computer_client import (
-    _discover_bay_credentials,
-    sync_skills_to_active_sandboxes,
-)
-from astrbot.core.skills.neo_skill_sync import NeoSkillSyncManager
-from astrbot.core.skills.skill_manager import SkillManager
-from astrbot.core.utils.astrbot_path import get_astrbot_temp_path
-
-from .route import Response, Route, RouteContext
-
-
-def _to_jsonable(value: Any) -> Any:
-    if isinstance(value, dict):
-        return {k: _to_jsonable(v) for k, v in value.items()}
-    if isinstance(value, list):
-        return [_to_jsonable(v) for v in value]
-    if hasattr(value, "model_dump"):
-        return _to_jsonable(value.model_dump())
-    return value
-
-
-def _to_bool(value: Any, default: bool = False) -> bool:
-    if value is None:
-        return default
-    if isinstance(value, bool):
-        return value
-    if isinstance(value, str):
-        return value.strip().lower() in {"1", "true", "yes", "y", "on"}
-    return bool(value)
-
-
-_SKILL_NAME_RE = re.compile(r"^[A-Za-z0-9._-]+$")
-_SKILL_FILE_MAX_BYTES = 512 * 1024
-_EDITABLE_SKILL_FILE_SUFFIXES = {
-    ".css",
-    ".html",
-    ".ini",
-    ".js",
-    ".json",
-    ".md",
-    ".py",
-    ".sh",
-    ".toml",
-    ".ts",
-    ".txt",
-    ".yaml",
-    ".yml",
-}
-_EDITABLE_SKILL_FILENAMES = {"Dockerfile", "Makefile"}
-
-
-def _next_available_temp_path(temp_dir: str, filename: str) -> str:
-    stem = Path(filename).stem
-    suffix = Path(filename).suffix
-    candidate = filename
-    index = 1
-    while os.path.exists(os.path.join(temp_dir, candidate)):
-        candidate = f"{stem}_{index}{suffix}"
-        index += 1
-    return os.path.join(temp_dir, candidate)
-
-
-class SkillsRoute(Route):
-    def __init__(self, context: RouteContext, core_lifecycle) -> None:
-        super().__init__(context)
-        self.core_lifecycle = core_lifecycle
-        self.routes = {
-            "/skills": ("GET", self.get_skills),
-            "/skills/upload": ("POST", self.upload_skill),
-            "/skills/batch-upload": ("POST", self.batch_upload_skills),
-            "/skills/download": ("GET", self.download_skill),
-            "/skills/files": ("GET", self.list_skill_files),
-            "/skills/file": [
-                ("GET", self.get_skill_file),
-                ("POST", self.update_skill_file),
-            ],
-            "/skills/update": ("POST", self.update_skill),
-            "/skills/delete": ("POST", self.delete_skill),
-            "/skills/neo/candidates": ("GET", self.get_neo_candidates),
-            "/skills/neo/releases": ("GET", self.get_neo_releases),
-            "/skills/neo/payload": ("GET", self.get_neo_payload),
-            "/skills/neo/evaluate": ("POST", self.evaluate_neo_candidate),
-            "/skills/neo/promote": ("POST", self.promote_neo_candidate),
-            "/skills/neo/rollback": ("POST", self.rollback_neo_release),
-            "/skills/neo/sync": ("POST", self.sync_neo_release),
-            "/skills/neo/delete-candidate": ("POST", self.delete_neo_candidate),
-            "/skills/neo/delete-release": ("POST", self.delete_neo_release),
-        }
-        self.register_routes()
-
-    def _resolve_local_skill_dir(self, name: str) -> Path:
-        skill_name = str(name or "").strip()
-        if not skill_name:
-            raise ValueError("Missing skill name")
-        if not _SKILL_NAME_RE.match(skill_name):
-            raise ValueError("Invalid skill name")
-
-        skill_mgr = SkillManager()
-        if skill_mgr.is_sandbox_only_skill(skill_name):
-            raise PermissionError(
-                "Sandbox preset skill cannot be opened from local skill files."
-            )
-
-        plugin_skill_dir = skill_mgr._get_plugin_skill_dir(skill_name)
-        if plugin_skill_dir is not None:
-            return plugin_skill_dir.resolve(strict=True)
-
-        skills_root = Path(skill_mgr.skills_root).resolve(strict=True)
-        skill_dir = (skills_root / skill_name).resolve(strict=True)
-        if not skill_dir.is_relative_to(skills_root):
-            raise PermissionError("Invalid skill path")
-        if not skill_dir.is_dir() or not (skill_dir / "SKILL.md").exists():
-            raise FileNotFoundError("Local skill not found")
-        return skill_dir
-
-    def _resolve_skill_relative_path(
-        self,
-        skill_dir: Path,
-        relative_path: str | None,
-        *,
-        expect_file: bool,
-    ) -> Path:
-        raw_path = str(relative_path or ".").strip() or "."
-        normalized = Path(raw_path.replace("\\", "/"))
-        if normalized.is_absolute() or ".." in normalized.parts:
-            raise ValueError("Invalid relative path")
-
-        target = (skill_dir / normalized).resolve(strict=True)
-        if not target.is_relative_to(skill_dir):
-            raise PermissionError("Path escapes skill directory")
-        if expect_file and not target.is_file():
-            raise FileNotFoundError("Skill file not found")
-        if not expect_file and not target.is_dir():
-            raise FileNotFoundError("Skill directory not found")
-        return target
-
-    @staticmethod
-    def _skill_relative_path(skill_dir: Path, target: Path) -> str:
-        rel = target.relative_to(skill_dir).as_posix()
-        return "" if rel == "." else rel
-
-    @staticmethod
-    def _is_editable_skill_file(path: Path) -> bool:
-        return (
-            path.name in _EDITABLE_SKILL_FILENAMES
-            or path.suffix.lower() in _EDITABLE_SKILL_FILE_SUFFIXES
-        )
-
-    def _serialize_skill_file_entry(
-        self,
-        skill_dir: Path,
-        path: Path,
-        *,
-        readonly: bool = False,
-    ) -> dict:
-        stat = path.stat()
-        is_dir = path.is_dir()
-        return {
-            "name": path.name,
-            "path": self._skill_relative_path(skill_dir, path),
-            "type": "directory" if is_dir else "file",
-            "size": 0 if is_dir else stat.st_size,
-            "editable": (
-                not readonly
-                and (not is_dir)
-                and self._is_editable_skill_file(path)
-                and stat.st_size <= _SKILL_FILE_MAX_BYTES
-            ),
-        }
-
-    def _get_neo_client_config(self) -> tuple[str, str]:
-        provider_settings = self.core_lifecycle.astrbot_config.get(
-            "provider_settings",
-            {},
-        )
-        sandbox = provider_settings.get("sandbox", {})
-        endpoint = sandbox.get("shipyard_neo_endpoint", "")
-        access_token = sandbox.get("shipyard_neo_access_token", "")
-
-        # Auto-discover token from Bay's credentials.json if not configured
-        if not access_token and endpoint:
-            access_token = _discover_bay_credentials(endpoint)
-
-        if not endpoint or not access_token:
-            raise ValueError(
-                "Shipyard Neo endpoint or access token not configured. "
-                "Set them in Dashboard or ensure Bay's credentials.json is accessible."
-            )
-        return endpoint, access_token
-
-    async def _delete_neo_release(
-        self, client: Any, release_id: str, reason: str | None
-    ):
-        return await client.skills.delete_release(release_id, reason=reason)
-
-    async def _delete_neo_candidate(
-        self, client: Any, candidate_id: str, reason: str | None
-    ):
-        return await client.skills.delete_candidate(candidate_id, reason=reason)
-
-    async def _with_neo_client(
-        self,
-        operation: Callable[[Any], Awaitable[dict]],
-    ) -> dict:
-        try:
-            endpoint, access_token = self._get_neo_client_config()
-
-            from shipyard_neo import BayClient
-
-            async with BayClient(
-                endpoint_url=endpoint,
-                access_token=access_token,
-            ) as client:
-                return await operation(client)
-        except ValueError as e:
-            # Config not ready — expected when Neo isn't set up yet
-            logger.debug("[Neo] %s", e)
-            return Response().error(str(e)).__dict__
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(str(e)).__dict__
-
-    async def get_skills(self):
-        try:
-            provider_settings = self.core_lifecycle.astrbot_config.get(
-                "provider_settings", {}
-            )
-            runtime = provider_settings.get("computer_use_runtime", "local")
-            skill_mgr = SkillManager()
-            skills = skill_mgr.list_skills(
-                active_only=False, runtime=runtime, show_sandbox_path=False
-            )
-            return (
-                Response()
-                .ok(
-                    {
-                        "skills": [skill.__dict__ for skill in skills],
-                        "runtime": runtime,
-                        "sandbox_cache": skill_mgr.get_sandbox_skills_cache_status(),
-                    }
-                )
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(str(e)).__dict__
-
-    async def upload_skill(self):
-        if DEMO_MODE:
-            return (
-                Response()
-                .error("You are not permitted to do this operation in demo mode")
-                .__dict__
-            )
-
-        temp_path = None
-        try:
-            files = await request.files
-            file = files.get("file")
-            if not file:
-                return Response().error("Missing file").__dict__
-            filename = os.path.basename(file.filename or "skill.zip")
-            if not filename.lower().endswith(".zip"):
-                return Response().error("Only .zip files are supported").__dict__
-
-            temp_dir = get_astrbot_temp_path()
-            os.makedirs(temp_dir, exist_ok=True)
-            skill_mgr = SkillManager()
-            temp_path = _next_available_temp_path(temp_dir, filename)
-            await file.save(temp_path)
-
-            try:
-                try:
-                    skill_name = skill_mgr.install_skill_from_zip(
-                        temp_path, overwrite=False, skill_name_hint=Path(filename).stem
-                    )
-                except TypeError:
-                    # Backward compatibility for callers that do not accept skill_name_hint
-                    skill_name = skill_mgr.install_skill_from_zip(
-                        temp_path, overwrite=False
-                    )
-            except Exception:
-                # Keep behavior consistent with previous implementation
-                # and bubble up install errors (including duplicates).
-                raise
-
-            try:
-                await sync_skills_to_active_sandboxes()
-            except Exception:
-                logger.warning("Failed to sync uploaded skills to active sandboxes.")
-
-            return (
-                Response()
-                .ok({"name": skill_name}, "Skill uploaded successfully.")
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(str(e)).__dict__
-        finally:
-            if temp_path and os.path.exists(temp_path):
-                try:
-                    os.remove(temp_path)
-                except Exception:
-                    logger.warning(f"Failed to remove temp skill file: {temp_path}")
-
-    async def batch_upload_skills(self):
-        """批量上传多个 skill ZIP 文件"""
-        if DEMO_MODE:
-            return (
-                Response()
-                .error("You are not permitted to do this operation in demo mode")
-                .__dict__
-            )
-
-        try:
-            files = await request.files
-            file_list = files.getlist("files")
-
-            if not file_list:
-                return Response().error("No files provided").__dict__
-
-            succeeded = []
-            failed = []
-            skipped = []
-            skill_mgr = SkillManager()
-            temp_dir = get_astrbot_temp_path()
-            os.makedirs(temp_dir, exist_ok=True)
-
-            for file in file_list:
-                filename = os.path.basename(file.filename or "unknown.zip")
-                temp_path = None
-
-                try:
-                    if not filename.lower().endswith(".zip"):
-                        failed.append(
-                            {
-                                "filename": filename,
-                                "error": "Only .zip files are supported",
-                            }
-                        )
-                        continue
-
-                    temp_path = _next_available_temp_path(temp_dir, filename)
-                    await file.save(temp_path)
-
-                    try:
-                        skill_name = skill_mgr.install_skill_from_zip(
-                            temp_path,
-                            overwrite=False,
-                            skill_name_hint=Path(filename).stem,
-                        )
-                    except TypeError:
-                        # Backward compatibility for monkeypatched implementations in tests
-                        try:
-                            skill_name = skill_mgr.install_skill_from_zip(
-                                temp_path, overwrite=False
-                            )
-                        except FileExistsError:
-                            skipped.append(
-                                {
-                                    "filename": filename,
-                                    "name": Path(filename).stem,
-                                    "error": "Skill already exists.",
-                                }
-                            )
-                            skill_name = None
-                    except FileExistsError:
-                        skipped.append(
-                            {
-                                "filename": filename,
-                                "name": Path(filename).stem,
-                                "error": "Skill already exists.",
-                            }
-                        )
-                        skill_name = None
-
-                    if skill_name is None:
-                        continue
-                    succeeded.append({"filename": filename, "name": skill_name})
-
-                except Exception as e:
-                    failed.append({"filename": filename, "error": str(e)})
-                finally:
-                    if temp_path and os.path.exists(temp_path):
-                        try:
-                            os.remove(temp_path)
-                        except Exception:
-                            pass
-
-            if succeeded:
-                try:
-                    await sync_skills_to_active_sandboxes()
-                except Exception:
-                    logger.warning(
-                        "Failed to sync uploaded skills to active sandboxes."
-                    )
-
-            total = len(file_list)
-            success_count = len(succeeded)
-            skipped_count = len(skipped)
-            failed_count = len(failed)
-
-            if failed_count == 0 and success_count == total:
-                message = f"All {total} skill(s) uploaded successfully."
-                return (
-                    Response()
-                    .ok(
-                        {
-                            "total": total,
-                            "succeeded": succeeded,
-                            "failed": failed,
-                            "skipped": skipped,
-                        },
-                        message,
-                    )
-                    .__dict__
-                )
-            if failed_count == 0 and success_count == 0:
-                message = f"All {total} file(s) were skipped."
-                return (
-                    Response()
-                    .ok(
-                        {
-                            "total": total,
-                            "succeeded": succeeded,
-                            "failed": failed,
-                            "skipped": skipped,
-                        },
-                        message,
-                    )
-                    .__dict__
-                )
-            if success_count == 0 and skipped_count == 0:
-                message = f"Upload failed for all {total} file(s)."
-                resp = Response().error(message)
-                resp.data = {
-                    "total": total,
-                    "succeeded": succeeded,
-                    "failed": failed,
-                    "skipped": skipped,
-                }
-                return resp.__dict__
-
-            message = f"Partial success: {success_count}/{total} skill(s) uploaded."
-            return (
-                Response()
-                .ok(
-                    {
-                        "total": total,
-                        "succeeded": succeeded,
-                        "failed": failed,
-                        "skipped": skipped,
-                    },
-                    message,
-                )
-                .__dict__
-            )
-
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(str(e)).__dict__
-
-    async def download_skill(self):
-        try:
-            name = str(request.args.get("name") or "").strip()
-            if not name:
-                return Response().error("Missing skill name").__dict__
-            if not _SKILL_NAME_RE.match(name):
-                return Response().error("Invalid skill name").__dict__
-
-            skill_mgr = SkillManager()
-            if skill_mgr.is_sandbox_only_skill(name):
-                return (
-                    Response()
-                    .error(
-                        "Sandbox preset skill cannot be downloaded from local skill files."
-                    )
-                    .__dict__
-                )
-            if skill_mgr.is_plugin_skill(name):
-                return (
-                    Response()
-                    .error(
-                        "Plugin-provided skill cannot be downloaded from local skill files."
-                    )
-                    .__dict__
-                )
-
-            skill_dir = Path(skill_mgr.skills_root) / name
-            skill_md = skill_dir / "SKILL.md"
-            if not skill_dir.is_dir() or not skill_md.exists():
-                return Response().error("Local skill not found").__dict__
-
-            export_dir = Path(get_astrbot_temp_path()) / "skill_exports"
-            export_dir.mkdir(parents=True, exist_ok=True)
-            zip_base = export_dir / name
-            zip_path = zip_base.with_suffix(".zip")
-            if zip_path.exists():
-                zip_path.unlink()
-
-            shutil.make_archive(
-                str(zip_base),
-                "zip",
-                root_dir=str(skill_mgr.skills_root),
-                base_dir=name,
-            )
-
-            return await send_file(
-                str(zip_path),
-                as_attachment=True,
-                attachment_filename=f"{name}.zip",
-                conditional=True,
-            )
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(str(e)).__dict__
-
-    async def list_skill_files(self):
-        try:
-            name = str(request.args.get("name") or "").strip()
-            relative_path = request.args.get("path", "")
-            readonly = SkillManager().is_plugin_skill(name)
-            skill_dir = self._resolve_local_skill_dir(name)
-            target_dir = self._resolve_skill_relative_path(
-                skill_dir,
-                relative_path,
-                expect_file=False,
-            )
-
-            entries = []
-            for entry in sorted(
-                target_dir.iterdir(),
-                key=lambda item: (not item.is_dir(), item.name.lower()),
-            ):
-                try:
-                    resolved = entry.resolve(strict=True)
-                except OSError:
-                    continue
-                if not resolved.is_relative_to(skill_dir):
-                    continue
-                if not resolved.is_dir() and not resolved.is_file():
-                    continue
-                entries.append(
-                    self._serialize_skill_file_entry(
-                        skill_dir,
-                        resolved,
-                        readonly=readonly,
-                    )
-                )
-
-            return (
-                Response()
-                .ok(
-                    {
-                        "name": name,
-                        "path": self._skill_relative_path(skill_dir, target_dir),
-                        "entries": entries,
-                    }
-                )
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(str(e)).__dict__
-
-    async def get_skill_file(self):
-        try:
-            name = str(request.args.get("name") or "").strip()
-            relative_path = request.args.get("path", "SKILL.md")
-            skill_dir = self._resolve_local_skill_dir(name)
-            target_file = self._resolve_skill_relative_path(
-                skill_dir,
-                relative_path,
-                expect_file=True,
-            )
-            if not self._is_editable_skill_file(target_file):
-                return Response().error("Unsupported file type").__dict__
-
-            size = target_file.stat().st_size
-            if size > _SKILL_FILE_MAX_BYTES:
-                return Response().error("File is too large").__dict__
-
-            try:
-                content = target_file.read_text(encoding="utf-8")
-            except UnicodeDecodeError:
-                return Response().error("File is not valid UTF-8 text").__dict__
-
-            return (
-                Response()
-                .ok(
-                    {
-                        "name": name,
-                        "path": self._skill_relative_path(skill_dir, target_file),
-                        "content": content,
-                        "size": size,
-                        "editable": not SkillManager().is_plugin_skill(name),
-                    }
-                )
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(str(e)).__dict__
-
-    async def update_skill_file(self):
-        if DEMO_MODE:
-            return (
-                Response()
-                .error("You are not permitted to do this operation in demo mode")
-                .__dict__
-            )
-
-        try:
-            data = await request.get_json()
-            name = str(data.get("name") or "").strip()
-            relative_path = data.get("path", "SKILL.md")
-            content = data.get("content")
-            if not isinstance(content, str):
-                return Response().error("Missing file content").__dict__
-
-            encoded = content.encode("utf-8")
-            if len(encoded) > _SKILL_FILE_MAX_BYTES:
-                return Response().error("File content is too large").__dict__
-
-            skill_dir = self._resolve_local_skill_dir(name)
-            if SkillManager().is_plugin_skill(name):
-                return Response().error("Plugin-provided skill is read-only.").__dict__
-            target_file = self._resolve_skill_relative_path(
-                skill_dir,
-                relative_path,
-                expect_file=True,
-            )
-            if not self._is_editable_skill_file(target_file):
-                return Response().error("Unsupported file type").__dict__
-
-            target_file.write_text(content, encoding="utf-8")
-
-            try:
-                await sync_skills_to_active_sandboxes()
-            except Exception:
-                logger.warning("Failed to sync edited skills to active sandboxes.")
-
-            return (
-                Response()
-                .ok(
-                    {
-                        "name": name,
-                        "path": self._skill_relative_path(skill_dir, target_file),
-                        "size": len(encoded),
-                    }
-                )
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(str(e)).__dict__
-
-    async def update_skill(self):
-        if DEMO_MODE:
-            return (
-                Response()
-                .error("You are not permitted to do this operation in demo mode")
-                .__dict__
-            )
-        try:
-            data = await request.get_json()
-            name = data.get("name")
-            active = data.get("active", True)
-            if not name:
-                return Response().error("Missing skill name").__dict__
-            SkillManager().set_skill_active(name, bool(active))
-            return Response().ok({"name": name, "active": bool(active)}).__dict__
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(str(e)).__dict__
-
-    async def delete_skill(self):
-        if DEMO_MODE:
-            return (
-                Response()
-                .error("You are not permitted to do this operation in demo mode")
-                .__dict__
-            )
-        try:
-            data = await request.get_json()
-            name = data.get("name")
-            if not name:
-                return Response().error("Missing skill name").__dict__
-            SkillManager().delete_skill(name)
-            try:
-                await sync_skills_to_active_sandboxes()
-            except Exception:
-                logger.warning("Failed to sync deleted skills to active sandboxes.")
-            return Response().ok({"name": name}).__dict__
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(str(e)).__dict__
-
-    async def get_neo_candidates(self):
-        logger.info("[Neo] GET /skills/neo/candidates requested.")
-        status = request.args.get("status")
-        skill_key = request.args.get("skill_key")
-        limit = int(request.args.get("limit", 100))
-        offset = int(request.args.get("offset", 0))
-
-        async def _do(client):
-            candidates = await client.skills.list_candidates(
-                status=status,
-                skill_key=skill_key,
-                limit=limit,
-                offset=offset,
-            )
-            result = _to_jsonable(candidates)
-            total = result.get("total", "?") if isinstance(result, dict) else "?"
-            logger.info(f"[Neo] Candidates fetched: total={total}")
-            return Response().ok(result).__dict__
-
-        return await self._with_neo_client(_do)
-
-    async def get_neo_releases(self):
-        logger.info("[Neo] GET /skills/neo/releases requested.")
-        skill_key = request.args.get("skill_key")
-        stage = request.args.get("stage")
-        active_only = _to_bool(request.args.get("active_only"), False)
-        limit = int(request.args.get("limit", 100))
-        offset = int(request.args.get("offset", 0))
-
-        async def _do(client):
-            releases = await client.skills.list_releases(
-                skill_key=skill_key,
-                active_only=active_only,
-                stage=stage,
-                limit=limit,
-                offset=offset,
-            )
-            result = _to_jsonable(releases)
-            total = result.get("total", "?") if isinstance(result, dict) else "?"
-            logger.info(f"[Neo] Releases fetched: total={total}")
-            return Response().ok(result).__dict__
-
-        return await self._with_neo_client(_do)
-
-    async def get_neo_payload(self):
-        logger.info("[Neo] GET /skills/neo/payload requested.")
-        payload_ref = request.args.get("payload_ref", "")
-        if not payload_ref:
-            return Response().error("Missing payload_ref").__dict__
-
-        async def _do(client):
-            payload = await client.skills.get_payload(payload_ref)
-            logger.info(f"[Neo] Payload fetched: ref={payload_ref}")
-            return Response().ok(_to_jsonable(payload)).__dict__
-
-        return await self._with_neo_client(_do)
-
-    async def evaluate_neo_candidate(self):
-        if DEMO_MODE:
-            return (
-                Response()
-                .error("You are not permitted to do this operation in demo mode")
-                .__dict__
-            )
-        logger.info("[Neo] POST /skills/neo/evaluate requested.")
-        data = await request.get_json()
-        candidate_id = data.get("candidate_id")
-        passed_value = data.get("passed")
-        if not candidate_id or passed_value is None:
-            return Response().error("Missing candidate_id or passed").__dict__
-        passed = _to_bool(passed_value, False)
-
-        async def _do(client):
-            result = await client.skills.evaluate_candidate(
-                candidate_id,
-                passed=passed,
-                score=data.get("score"),
-                benchmark_id=data.get("benchmark_id"),
-                report=data.get("report"),
-            )
-            logger.info(
-                f"[Neo] Candidate evaluated: id={candidate_id}, passed={passed}"
-            )
-            return Response().ok(_to_jsonable(result)).__dict__
-
-        return await self._with_neo_client(_do)
-
-    async def promote_neo_candidate(self):
-        if DEMO_MODE:
-            return (
-                Response()
-                .error("You are not permitted to do this operation in demo mode")
-                .__dict__
-            )
-        logger.info("[Neo] POST /skills/neo/promote requested.")
-        data = await request.get_json()
-        candidate_id = data.get("candidate_id")
-        stage = data.get("stage", "canary")
-        sync_to_local = _to_bool(data.get("sync_to_local"), True)
-        if not candidate_id:
-            return Response().error("Missing candidate_id").__dict__
-        if stage not in {"canary", "stable"}:
-            return Response().error("Invalid stage, must be canary/stable").__dict__
-
-        async def _do(client):
-            sync_mgr = NeoSkillSyncManager()
-            result = await sync_mgr.promote_with_optional_sync(
-                client,
-                candidate_id=candidate_id,
-                stage=stage,
-                sync_to_local=sync_to_local,
-            )
-            release_json = result.get("release")
-            logger.info(f"[Neo] Candidate promoted: id={candidate_id}, stage={stage}")
-
-            sync_json = result.get("sync")
-            did_sync_to_local = bool(sync_json)
-            if did_sync_to_local:
-                logger.info(
-                    f"[Neo] Stable release synced to local: skill={sync_json.get('local_skill_name', '')}"
-                )
-
-            if result.get("sync_error"):
-                resp = Response().error(
-                    "Stable promote synced failed and has been rolled back. "
-                    f"sync_error={result['sync_error']}"
-                )
-                resp.data = {
-                    "release": release_json,
-                    "rollback": result.get("rollback"),
-                }
-                return resp.__dict__
-
-            # Try to push latest local skills to all active sandboxes.
-            if not did_sync_to_local:
-                try:
-                    await sync_skills_to_active_sandboxes()
-                except Exception:
-                    logger.warning("Failed to sync skills to active sandboxes.")
-
-            return Response().ok({"release": release_json, "sync": sync_json}).__dict__
-
-        return await self._with_neo_client(_do)
-
-    async def rollback_neo_release(self):
-        if DEMO_MODE:
-            return (
-                Response()
-                .error("You are not permitted to do this operation in demo mode")
-                .__dict__
-            )
-        logger.info("[Neo] POST /skills/neo/rollback requested.")
-        data = await request.get_json()
-        release_id = data.get("release_id")
-        if not release_id:
-            return Response().error("Missing release_id").__dict__
-
-        async def _do(client):
-            result = await client.skills.rollback_release(release_id)
-            logger.info(f"[Neo] Release rolled back: id={release_id}")
-            return Response().ok(_to_jsonable(result)).__dict__
-
-        return await self._with_neo_client(_do)
-
-    async def sync_neo_release(self):
-        if DEMO_MODE:
-            return (
-                Response()
-                .error("You are not permitted to do this operation in demo mode")
-                .__dict__
-            )
-        logger.info("[Neo] POST /skills/neo/sync requested.")
-        data = await request.get_json()
-        release_id = data.get("release_id")
-        skill_key = data.get("skill_key")
-        require_stable = _to_bool(data.get("require_stable"), True)
-        if not release_id and not skill_key:
-            return Response().error("Missing release_id or skill_key").__dict__
-
-        async def _do(client):
-            sync_mgr = NeoSkillSyncManager()
-            result = await sync_mgr.sync_release(
-                client,
-                release_id=release_id,
-                skill_key=skill_key,
-                require_stable=require_stable,
-            )
-            logger.info(
-                f"[Neo] Release synced to local: skill={result.local_skill_name}, "
-                f"release_id={result.release_id}"
-            )
-            return (
-                Response()
-                .ok(
-                    {
-                        "skill_key": result.skill_key,
-                        "local_skill_name": result.local_skill_name,
-                        "release_id": result.release_id,
-                        "candidate_id": result.candidate_id,
-                        "payload_ref": result.payload_ref,
-                        "map_path": result.map_path,
-                        "synced_at": result.synced_at,
-                    }
-                )
-                .__dict__
-            )
-
-        return await self._with_neo_client(_do)
-
-    async def delete_neo_candidate(self):
-        if DEMO_MODE:
-            return (
-                Response()
-                .error("You are not permitted to do this operation in demo mode")
-                .__dict__
-            )
-        logger.info("[Neo] POST /skills/neo/delete-candidate requested.")
-        data = await request.get_json()
-        candidate_id = data.get("candidate_id")
-        reason = data.get("reason")
-        if not candidate_id:
-            return Response().error("Missing candidate_id").__dict__
-
-        async def _do(client):
-            result = await self._delete_neo_candidate(client, candidate_id, reason)
-            logger.info(f"[Neo] Candidate deleted: id={candidate_id}")
-            return Response().ok(_to_jsonable(result)).__dict__
-
-        return await self._with_neo_client(_do)
-
-    async def delete_neo_release(self):
-        if DEMO_MODE:
-            return (
-                Response()
-                .error("You are not permitted to do this operation in demo mode")
-                .__dict__
-            )
-        logger.info("[Neo] POST /skills/neo/delete-release requested.")
-        data = await request.get_json()
-        release_id = data.get("release_id")
-        reason = data.get("reason")
-        if not release_id:
-            return Response().error("Missing release_id").__dict__
-
-        async def _do(client):
-            result = await self._delete_neo_release(client, release_id, reason)
-            logger.info(f"[Neo] Release deleted: id={release_id}")
-            return Response().ok(_to_jsonable(result)).__dict__
-
-        return await self._with_neo_client(_do)
diff --git a/astrbot/dashboard/routes/static_file.py b/astrbot/dashboard/routes/static_file.py
deleted file mode 100644
index 3a18cf82f..000000000
--- a/astrbot/dashboard/routes/static_file.py
+++ /dev/null
@@ -1,37 +0,0 @@
-from .route import Route, RouteContext
-
-
-class StaticFileRoute(Route):
-    def __init__(self, context: RouteContext) -> None:
-        super().__init__(context)
-
-        index_ = [
-            "/",
-            "/auth/login",
-            "/config",
-            "/logs",
-            "/extension",
-            "/dashboard/default",
-            "/alkaid",
-            "/alkaid/knowledge-base",
-            "/alkaid/long-term-memory",
-            "/alkaid/other",
-            "/console",
-            "/chat",
-            "/settings",
-            "/platforms",
-            "/providers",
-            "/about",
-            "/extension-marketplace",
-            "/conversation",
-            "/tool-use",
-        ]
-        for i in index_:
-            self.app.add_url_rule(i, view_func=self.index)
-
-        @self.app.errorhandler(404)
-        async def page_not_found(e) -> str:
-            return "404 Not found。如果你初次使用打开面板发现 404, 请参考文档: https://docs.astrbot.app/faq.html。如果你正在测试回调地址可达性，显示这段文字说明测试成功了。"
-
-    async def index(self):
-        return await self.app.send_static_file("index.html")
diff --git a/astrbot/dashboard/routes/subagent.py b/astrbot/dashboard/routes/subagent.py
deleted file mode 100644
index e3d77f73a..000000000
--- a/astrbot/dashboard/routes/subagent.py
+++ /dev/null
@@ -1,117 +0,0 @@
-import traceback
-
-from quart import jsonify, request
-
-from astrbot.core import logger
-from astrbot.core.agent.handoff import HandoffTool
-from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
-
-from .route import Response, Route, RouteContext
-
-
-class SubAgentRoute(Route):
-    def __init__(
-        self,
-        context: RouteContext,
-        core_lifecycle: AstrBotCoreLifecycle,
-    ) -> None:
-        super().__init__(context)
-        self.core_lifecycle = core_lifecycle
-        # NOTE: dict cannot hold duplicate keys; use list form to register multiple
-        # methods for the same path.
-        self.routes = [
-            ("/subagent/config", ("GET", self.get_config)),
-            ("/subagent/config", ("POST", self.update_config)),
-            ("/subagent/available-tools", ("GET", self.get_available_tools)),
-        ]
-        self.register_routes()
-
-    async def get_config(self):
-        try:
-            cfg = self.core_lifecycle.astrbot_config
-            data = cfg.get("subagent_orchestrator")
-
-            # First-time access: return a sane default instead of erroring.
-            if not isinstance(data, dict):
-                data = {
-                    "main_enable": False,
-                    "remove_main_duplicate_tools": False,
-                    "agents": [],
-                }
-
-            # Backward compatibility: older config used `enable`.
-            if (
-                isinstance(data, dict)
-                and "main_enable" not in data
-                and "enable" in data
-            ):
-                data["main_enable"] = bool(data.get("enable", False))
-
-            # Ensure required keys exist.
-            data.setdefault("main_enable", False)
-            data.setdefault("remove_main_duplicate_tools", False)
-            data.setdefault("agents", [])
-
-            # Backward/forward compatibility: ensure each agent contains provider_id.
-            # None means follow global/default provider settings.
-            if isinstance(data.get("agents"), list):
-                for a in data["agents"]:
-                    if isinstance(a, dict):
-                        a.setdefault("provider_id", None)
-                        a.setdefault("persona_id", None)
-            return jsonify(Response().ok(data=data).__dict__)
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return jsonify(Response().error(f"获取 subagent 配置失败: {e!s}").__dict__)
-
-    async def update_config(self):
-        try:
-            data = await request.json
-            if not isinstance(data, dict):
-                return jsonify(Response().error("配置必须为 JSON 对象").__dict__)
-
-            cfg = self.core_lifecycle.astrbot_config
-            cfg["subagent_orchestrator"] = data
-
-            # Persist to cmd_config.json
-            # AstrBotConfigManager does not expose a `save()` method; persist via AstrBotConfig.
-            cfg.save_config()
-
-            # Reload dynamic handoff tools if orchestrator exists
-            orch = getattr(self.core_lifecycle, "subagent_orchestrator", None)
-            if orch is not None:
-                await orch.reload_from_config(data)
-
-            return jsonify(Response().ok(message="保存成功").__dict__)
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return jsonify(Response().error(f"保存 subagent 配置失败: {e!s}").__dict__)
-
-    async def get_available_tools(self):
-        """Return all registered tools (name/description/parameters/active/origin).
-
-        UI can use this to build a multi-select list for subagent tool assignment.
-        """
-        try:
-            tool_mgr = self.core_lifecycle.provider_manager.llm_tools
-            tools_dict = []
-            for tool in tool_mgr.func_list:
-                # Prevent recursive routing: subagents should not be able to select
-                # the handoff (transfer_to_*) tools as their own mounted tools.
-                if isinstance(tool, HandoffTool):
-                    continue
-                if tool.handler_module_path == "core.subagent_orchestrator":
-                    continue
-                tools_dict.append(
-                    {
-                        "name": tool.name,
-                        "description": tool.description,
-                        "parameters": tool.parameters,
-                        "active": tool.active,
-                        "handler_module_path": tool.handler_module_path,
-                    }
-                )
-            return jsonify(Response().ok(data=tools_dict).__dict__)
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return jsonify(Response().error(f"获取可用工具失败: {e!s}").__dict__)
diff --git a/astrbot/dashboard/routes/t2i.py b/astrbot/dashboard/routes/t2i.py
deleted file mode 100644
index 634828e95..000000000
--- a/astrbot/dashboard/routes/t2i.py
+++ /dev/null
@@ -1,237 +0,0 @@
-# astrbot/dashboard/routes/t2i.py
-
-from dataclasses import asdict
-
-from quart import jsonify, request
-
-from astrbot.core import logger
-from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
-from astrbot.core.utils.t2i.template_manager import TemplateManager
-
-from .route import Response, Route, RouteContext
-
-
-class T2iRoute(Route):
-    def __init__(
-        self, context: RouteContext, core_lifecycle: AstrBotCoreLifecycle
-    ) -> None:
-        super().__init__(context)
-        self.core_lifecycle = core_lifecycle
-        self.config = core_lifecycle.astrbot_config
-        self.manager = TemplateManager()
-        # 使用列表保证路由注册顺序，避免 /<name> 路由优先匹配 /reset_default
-        self.routes = [
-            ("/t2i/templates", ("GET", self.list_templates)),
-            ("/t2i/templates/active", ("GET", self.get_active_template)),
-            ("/t2i/templates/create", ("POST", self.create_template)),
-            ("/t2i/templates/reset_default", ("POST", self.reset_default_template)),
-            ("/t2i/templates/set_active", ("POST", self.set_active_template)),
-            # 动态路由应该在静态路由之后注册
-            (
-                "/t2i/templates/<name>",
-                [
-                    ("GET", self.get_template),
-                    ("PUT", self.update_template),
-                    ("DELETE", self.delete_template),
-                ],
-            ),
-        ]
-        self.register_routes()
-
-    async def _reload_all_pipeline_schedulers(self) -> None:
-        """热重载所有配置对应的 pipeline scheduler。"""
-        for conf_id in self.core_lifecycle.astrbot_config_mgr.confs:
-            await self.core_lifecycle.reload_pipeline_scheduler(conf_id)
-
-    async def _sync_active_template_to_all_configs(self, name: str) -> None:
-        """同步当前激活模板到所有配置文件，并热重载对应流水线。"""
-        for config in self.core_lifecycle.astrbot_config_mgr.confs.values():
-            config["t2i_active_template"] = name
-            config.save_config()
-        await self._reload_all_pipeline_schedulers()
-
-    async def list_templates(self):
-        """获取所有T2I模板列表"""
-        try:
-            templates = self.manager.list_templates()
-            return jsonify(asdict(Response().ok(data=templates)))
-        except Exception as e:
-            response = jsonify(asdict(Response().error(str(e))))
-            response.status_code = 500
-            return response
-
-    async def get_active_template(self):
-        """获取当前激活的T2I模板"""
-        try:
-            active_template = self.config.get("t2i_active_template", "base")
-            return jsonify(
-                asdict(Response().ok(data={"active_template": active_template})),
-            )
-        except Exception as e:
-            logger.error("Error in get_active_template", exc_info=True)
-            response = jsonify(asdict(Response().error(str(e))))
-            response.status_code = 500
-            return response
-
-    async def get_template(self, name: str):
-        """获取指定名称的T2I模板内容"""
-        try:
-            content = self.manager.get_template(name)
-            return jsonify(
-                asdict(Response().ok(data={"name": name, "content": content})),
-            )
-        except FileNotFoundError:
-            response = jsonify(asdict(Response().error("Template not found")))
-            response.status_code = 404
-            return response
-        except Exception as e:
-            response = jsonify(asdict(Response().error(str(e))))
-            response.status_code = 500
-            return response
-
-    async def create_template(self):
-        """创建一个新的T2I模板"""
-        try:
-            data = await request.json
-            name = data.get("name")
-            content = data.get("content")
-            if not name or not content:
-                response = jsonify(
-                    asdict(Response().error("Name and content are required.")),
-                )
-                response.status_code = 400
-                return response
-            name = name.strip()
-
-            self.manager.create_template(name, content)
-            response = jsonify(
-                asdict(
-                    Response().ok(
-                        data={"name": name},
-                        message="Template created successfully.",
-                    ),
-                ),
-            )
-            response.status_code = 201
-            return response
-        except FileExistsError:
-            response = jsonify(
-                asdict(Response().error("Template with this name already exists.")),
-            )
-            response.status_code = 409
-            return response
-        except ValueError as e:
-            response = jsonify(asdict(Response().error(str(e))))
-            response.status_code = 400
-            return response
-        except Exception as e:
-            response = jsonify(asdict(Response().error(str(e))))
-            response.status_code = 500
-            return response
-
-    async def update_template(self, name: str):
-        """更新一个已存在的T2I模板"""
-        try:
-            name = name.strip()
-            data = await request.json
-            content = data.get("content")
-            if content is None:
-                response = jsonify(asdict(Response().error("Content is required.")))
-                response.status_code = 400
-                return response
-
-            self.manager.update_template(name, content)
-
-            # 检查更新的是否为当前激活的模板，如果是，则热重载
-            active_template = self.config.get("t2i_active_template", "base")
-            if name == active_template:
-                await self._reload_all_pipeline_schedulers()
-                message = f"模板 '{name}' 已更新并重新加载。"
-            else:
-                message = f"模板 '{name}' 已更新。"
-
-            return jsonify(asdict(Response().ok(data={"name": name}, message=message)))
-        except ValueError as e:
-            response = jsonify(asdict(Response().error(str(e))))
-            response.status_code = 400
-            return response
-        except Exception as e:
-            response = jsonify(asdict(Response().error(str(e))))
-            response.status_code = 500
-            return response
-
-    async def delete_template(self, name: str):
-        """删除一个T2I模板"""
-        try:
-            name = name.strip()
-            self.manager.delete_template(name)
-            return jsonify(
-                asdict(Response().ok(message="Template deleted successfully.")),
-            )
-        except FileNotFoundError:
-            response = jsonify(asdict(Response().error("Template not found.")))
-            response.status_code = 404
-            return response
-        except ValueError as e:
-            response = jsonify(asdict(Response().error(str(e))))
-            response.status_code = 400
-            return response
-        except Exception as e:
-            response = jsonify(asdict(Response().error(str(e))))
-            response.status_code = 500
-            return response
-
-    async def set_active_template(self):
-        """设置当前活动的T2I模板"""
-        try:
-            data = await request.json
-            name = data.get("name")
-            if not name:
-                response = jsonify(asdict(Response().error("模板名称(name)不能为空。")))
-                response.status_code = 400
-                return response
-
-            # 验证模板文件是否存在
-            self.manager.get_template(name)
-
-            # 更新所有配置并热重载以应用更改
-            await self._sync_active_template_to_all_configs(name)
-
-            return jsonify(asdict(Response().ok(message=f"模板 '{name}' 已成功应用。")))
-
-        except FileNotFoundError:
-            response = jsonify(
-                asdict(Response().error(f"模板 '{name}' 不存在，无法应用。")),
-            )
-            response.status_code = 404
-            return response
-        except Exception as e:
-            logger.error("Error in set_active_template", exc_info=True)
-            response = jsonify(asdict(Response().error(str(e))))
-            response.status_code = 500
-            return response
-
-    async def reset_default_template(self):
-        """重置默认的'base'模板"""
-        try:
-            self.manager.reset_default_template()
-
-            # 更新所有配置，将激活模板也重置为'base'
-            await self._sync_active_template_to_all_configs("base")
-
-            return jsonify(
-                asdict(
-                    Response().ok(
-                        message="Default template has been reset and activated.",
-                    ),
-                ),
-            )
-        except FileNotFoundError as e:
-            response = jsonify(asdict(Response().error(str(e))))
-            response.status_code = 404
-            return response
-        except Exception as e:
-            logger.error("Error in reset_default_template", exc_info=True)
-            response = jsonify(asdict(Response().error(str(e))))
-            response.status_code = 500
-            return response
diff --git a/astrbot/dashboard/routes/tools.py b/astrbot/dashboard/routes/tools.py
deleted file mode 100644
index 2ad80687e..000000000
--- a/astrbot/dashboard/routes/tools.py
+++ /dev/null
@@ -1,644 +0,0 @@
-import traceback
-
-from quart import request
-
-from astrbot.core import logger, sp
-from astrbot.core.agent.mcp_client import MCPTool, validate_mcp_stdio_config
-from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
-from astrbot.core.star import star_map
-from astrbot.core.tools.registry import get_builtin_tool_config_statuses
-
-from .route import Response, Route, RouteContext
-
-DEFAULT_MCP_CONFIG = {"mcpServers": {}}
-
-
-class EmptyMcpServersError(ValueError):
-    """Raised when mcpServers is empty."""
-
-    pass
-
-
-def _extract_mcp_server_config(mcp_servers_value: object) -> dict:
-    """Extract server configuration from user-submitted mcpServers field.
-
-    Raises:
-        ValueError: Invalid configuration
-    """
-    if not isinstance(mcp_servers_value, dict):
-        raise ValueError("mcpServers must be a JSON object")
-    if not mcp_servers_value:
-        raise EmptyMcpServersError("mcpServers configuration cannot be empty")
-    key_0 = next(iter(mcp_servers_value))
-    extracted = mcp_servers_value[key_0]
-    if not isinstance(extracted, dict):
-        raise ValueError(
-            "Invalid mcpServers format. Ensure each key in mcpServers is a server name, "
-            "and each value is an object containing fields like command/url."
-        )
-    return extracted
-
-
-class ToolsRoute(Route):
-    def __init__(
-        self,
-        context: RouteContext,
-        core_lifecycle: AstrBotCoreLifecycle,
-    ) -> None:
-        super().__init__(context)
-        self.core_lifecycle = core_lifecycle
-        self.routes = {
-            "/tools/mcp/servers": ("GET", self.get_mcp_servers),
-            "/tools/mcp/add": ("POST", self.add_mcp_server),
-            "/tools/mcp/update": ("POST", self.update_mcp_server),
-            "/tools/mcp/delete": ("POST", self.delete_mcp_server),
-            "/tools/mcp/test": ("POST", self.test_mcp_connection),
-            "/tools/list": ("GET", self.get_tool_list),
-            "/tools/toggle-tool": ("POST", self.toggle_tool),
-            "/tools/permission": ("POST", self.update_tool_permission),
-            "/tools/mcp/sync-provider": ("POST", self.sync_provider),
-        }
-        self.register_routes()
-        self.tool_mgr = self.core_lifecycle.provider_manager.llm_tools
-
-    @staticmethod
-    def _get_tool_permission(tool_name: str) -> tuple[str, bool]:
-        """Return (effective_permission, configured) for a tool.
-
-        ``configured`` is True when the permission was explicitly set via the
-        dashboard rather than being a fallback default.
-        """
-        perms_store = sp.get("tool_permissions", {}, scope="global", scope_id="global")
-        defaults = (
-            perms_store.get("_default", {}) if isinstance(perms_store, dict) else {}
-        )
-        if tool_name in defaults:
-            return defaults[tool_name], True
-        return "member", False
-
-    def _rollback_mcp_server(self, name: str) -> bool:
-        try:
-            rollback_config = self.tool_mgr.load_mcp_config()
-            if name in rollback_config["mcpServers"]:
-                rollback_config["mcpServers"].pop(name)
-                return self.tool_mgr.save_mcp_config(rollback_config)
-            return True
-        except Exception:
-            logger.error(traceback.format_exc())
-            return False
-
-    async def get_mcp_servers(self):
-        try:
-            config = self.tool_mgr.load_mcp_config()
-            servers = []
-            mcp_servers = config.get("mcpServers", {})
-
-            if not isinstance(mcp_servers, dict):
-                logger.warning(
-                    f"Invalid MCP server config type: {type(mcp_servers).__name__}. Expected object/dict; skipped all MCP servers."
-                )
-                mcp_servers = {}
-
-            # 获取所有服务器并添加它们的工具列表
-            for name, server_config in mcp_servers.items():
-                if not isinstance(server_config, dict):
-                    logger.warning(
-                        f"Invalid config for MCP server '{name}' (type: {type(server_config).__name__}); skipped."
-                    )
-                    continue
-
-                server_info = {
-                    "name": name,
-                    "active": server_config.get("active", True),
-                }
-
-                # 复制所有配置字段
-                for key, value in server_config.items():
-                    if key != "active":  # active 已经处理
-                        server_info[key] = value
-
-                # 如果MCP客户端已初始化，从客户端获取工具名称
-                for name_key, runtime in self.tool_mgr.mcp_server_runtime_view.items():
-                    if name_key == name:
-                        mcp_client = runtime.client
-                        server_info["tools"] = [tool.name for tool in mcp_client.tools]
-                        server_info["errlogs"] = mcp_client.server_errlogs
-                        break
-                else:
-                    server_info["tools"] = []
-
-                servers.append(server_info)
-
-            return Response().ok(servers).__dict__
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(f"Failed to get MCP server list: {e!s}").__dict__
-
-    async def add_mcp_server(self):
-        try:
-            server_data = await request.json
-
-            name = server_data.get("name", "")
-
-            # 检查必填字段
-            if not name:
-                return Response().error("Server name cannot be empty").__dict__
-
-            # 移除特殊字段并检查配置是否有效
-            has_valid_config = False
-            server_config = {"active": server_data.get("active", True)}
-
-            # 复制所有配置字段
-            for key, value in server_data.items():
-                if key not in ["name", "active", "tools", "errlogs"]:  # 排除特殊字段
-                    if key == "mcpServers":
-                        try:
-                            server_config = _extract_mcp_server_config(
-                                server_data["mcpServers"]
-                            )
-                        except ValueError as e:
-                            return Response().error(f"{e!s}").__dict__
-                    else:
-                        server_config[key] = value
-                    has_valid_config = True
-
-            if not has_valid_config:
-                return (
-                    Response()
-                    .error("A valid server configuration is required")
-                    .__dict__
-                )
-
-            try:
-                validate_mcp_stdio_config(server_config)
-            except ValueError as e:
-                return Response().error(f"{e!s}").__dict__
-
-            config = self.tool_mgr.load_mcp_config()
-
-            if name in config["mcpServers"]:
-                return Response().error(f"Server {name} already exists").__dict__
-
-            try:
-                await self.tool_mgr.test_mcp_server_connection(server_config)
-            except Exception as e:
-                logger.error(traceback.format_exc())
-                return Response().error(f"MCP connection test failed: {e!s}").__dict__
-
-            config["mcpServers"][name] = server_config
-
-            if self.tool_mgr.save_mcp_config(config):
-                try:
-                    await self.tool_mgr.enable_mcp_server(
-                        name,
-                        server_config,
-                        timeout=30,
-                    )
-                except TimeoutError:
-                    rollback_ok = self._rollback_mcp_server(name)
-                    err_msg = f"Timed out while enabling MCP server {name}."
-                    if not rollback_ok:
-                        err_msg += " Configuration rollback failed. Please check the config manually."
-                    return Response().error(err_msg).__dict__
-                except Exception as e:
-                    logger.error(traceback.format_exc())
-                    rollback_ok = self._rollback_mcp_server(name)
-                    err_msg = f"Failed to enable MCP server {name}: {e!s}"
-                    if not rollback_ok:
-                        err_msg += " Configuration rollback failed. Please check the config manually."
-                    return Response().error(err_msg).__dict__
-                return (
-                    Response()
-                    .ok(None, f"Successfully added MCP server {name}")
-                    .__dict__
-                )
-            return Response().error("Failed to save configuration").__dict__
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(f"Failed to add MCP server: {e!s}").__dict__
-
-    async def update_mcp_server(self):
-        try:
-            server_data = await request.json
-
-            name = server_data.get("name", "")
-            old_name = server_data.get("oldName") or name
-
-            if not name:
-                return Response().error("Server name cannot be empty").__dict__
-
-            config = self.tool_mgr.load_mcp_config()
-
-            if old_name not in config["mcpServers"]:
-                return Response().error(f"Server {old_name} does not exist").__dict__
-
-            is_rename = name != old_name
-
-            if name in config["mcpServers"] and is_rename:
-                return Response().error(f"Server {name} already exists").__dict__
-
-            # 获取活动状态
-            old_config = config["mcpServers"][old_name]
-            if isinstance(old_config, dict):
-                old_active = old_config.get("active", True)
-            else:
-                old_active = True
-            active = server_data.get("active", old_active)
-
-            # 创建新的配置对象
-            server_config = {"active": active}
-
-            # 仅更新活动状态的特殊处理
-            only_update_active = True
-
-            # 复制所有配置字段
-            for key, value in server_data.items():
-                if key not in [
-                    "name",
-                    "active",
-                    "tools",
-                    "errlogs",
-                    "oldName",
-                ]:  # 排除特殊字段
-                    if key == "mcpServers":
-                        try:
-                            server_config = _extract_mcp_server_config(
-                                server_data["mcpServers"]
-                            )
-                        except ValueError as e:
-                            return Response().error(f"{e!s}").__dict__
-                    else:
-                        server_config[key] = value
-                    only_update_active = False
-
-            # 如果只更新活动状态，保留原始配置
-            if only_update_active and isinstance(old_config, dict):
-                for key, value in old_config.items():
-                    if key != "active":  # 除了active之外的所有字段都保留
-                        server_config[key] = value
-
-            try:
-                validate_mcp_stdio_config(server_config)
-            except ValueError as e:
-                return Response().error(f"{e!s}").__dict__
-
-            # config["mcpServers"][name] = server_config
-            if is_rename:
-                config["mcpServers"].pop(old_name)
-                config["mcpServers"][name] = server_config
-            else:
-                config["mcpServers"][name] = server_config
-
-            if self.tool_mgr.save_mcp_config(config):
-                # 处理MCP客户端状态变化
-                if active:
-                    if (
-                        old_name in self.tool_mgr.mcp_server_runtime_view
-                        or not only_update_active
-                        or is_rename
-                    ):
-                        try:
-                            await self.tool_mgr.disable_mcp_server(old_name, timeout=10)
-                        except TimeoutError as e:
-                            return (
-                                Response()
-                                .error(
-                                    f"Timed out while disabling MCP server {old_name} before enabling: {e!s}"
-                                )
-                                .__dict__
-                            )
-                        except Exception as e:
-                            logger.error(traceback.format_exc())
-                            return (
-                                Response()
-                                .error(
-                                    f"Failed to disable MCP server {old_name} before enabling: {e!s}"
-                                )
-                                .__dict__
-                            )
-                    try:
-                        await self.tool_mgr.enable_mcp_server(
-                            name,
-                            config["mcpServers"][name],
-                            timeout=30,
-                        )
-                    except TimeoutError:
-                        return (
-                            Response()
-                            .error(f"Timed out while enabling MCP server {name}.")
-                            .__dict__
-                        )
-                    except Exception as e:
-                        logger.error(traceback.format_exc())
-                        return (
-                            Response()
-                            .error(f"Failed to enable MCP server {name}: {e!s}")
-                            .__dict__
-                        )
-                # 如果要停用服务器
-                elif old_name in self.tool_mgr.mcp_server_runtime_view:
-                    try:
-                        await self.tool_mgr.disable_mcp_server(old_name, timeout=10)
-                    except TimeoutError:
-                        return (
-                            Response()
-                            .error(f"Timed out while disabling MCP server {old_name}.")
-                            .__dict__
-                        )
-                    except Exception as e:
-                        logger.error(traceback.format_exc())
-                        return (
-                            Response()
-                            .error(f"Failed to disable MCP server {old_name}: {e!s}")
-                            .__dict__
-                        )
-
-                return (
-                    Response()
-                    .ok(None, f"Successfully updated MCP server {name}")
-                    .__dict__
-                )
-            return Response().error("Failed to save configuration").__dict__
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(f"Failed to update MCP server: {e!s}").__dict__
-
-    async def delete_mcp_server(self):
-        try:
-            server_data = await request.json
-            name = server_data.get("name", "")
-
-            if not name:
-                return Response().error("Server name cannot be empty").__dict__
-
-            config = self.tool_mgr.load_mcp_config()
-
-            if name not in config["mcpServers"]:
-                return Response().error(f"Server {name} does not exist").__dict__
-
-            del config["mcpServers"][name]
-
-            if self.tool_mgr.save_mcp_config(config):
-                if name in self.tool_mgr.mcp_server_runtime_view:
-                    try:
-                        await self.tool_mgr.disable_mcp_server(name, timeout=10)
-                    except TimeoutError:
-                        return (
-                            Response()
-                            .error(f"Timed out while disabling MCP server {name}.")
-                            .__dict__
-                        )
-                    except Exception as e:
-                        logger.error(traceback.format_exc())
-                        return (
-                            Response()
-                            .error(f"Failed to disable MCP server {name}: {e!s}")
-                            .__dict__
-                        )
-                return (
-                    Response()
-                    .ok(None, f"Successfully deleted MCP server {name}")
-                    .__dict__
-                )
-            return Response().error("Failed to save configuration").__dict__
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(f"Failed to delete MCP server: {e!s}").__dict__
-
-    async def test_mcp_connection(self):
-        """Test MCP server connection."""
-        try:
-            server_data = await request.json
-            config = server_data.get("mcp_server_config", None)
-
-            if not isinstance(config, dict) or not config:
-                return Response().error("Invalid MCP server configuration").__dict__
-
-            if "mcpServers" in config:
-                mcp_servers = config["mcpServers"]
-                if isinstance(mcp_servers, dict) and len(mcp_servers) > 1:
-                    return (
-                        Response()
-                        .error(
-                            "Only one MCP server configuration can be tested at a time"
-                        )
-                        .__dict__
-                    )
-                try:
-                    config = _extract_mcp_server_config(mcp_servers)
-                except EmptyMcpServersError:
-                    return (
-                        Response()
-                        .error("MCP server configuration cannot be empty")
-                        .__dict__
-                    )
-                except ValueError as e:
-                    return Response().error(f"{e!s}").__dict__
-            elif not config:
-                return (
-                    Response()
-                    .error("MCP server configuration cannot be empty")
-                    .__dict__
-                )
-
-            try:
-                validate_mcp_stdio_config(config)
-            except ValueError as e:
-                return Response().error(f"{e!s}").__dict__
-
-            tools_name = await self.tool_mgr.test_mcp_server_connection(config)
-            return (
-                Response()
-                .ok(data=tools_name, message="🎉 MCP server is available!")
-                .__dict__
-            )
-
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(f"Failed to test MCP connection: {e!s}").__dict__
-
-    async def get_tool_list(self):
-        """Get all registered tools."""
-        try:
-            tools = list(self.tool_mgr.func_list)
-            existing_names = {tool.name for tool in tools}
-            for tool in self.tool_mgr.iter_builtin_tools():
-                if tool.name not in existing_names:
-                    tools.append(tool)
-
-            conf_list = self.core_lifecycle.astrbot_config_mgr.get_conf_list()
-            conf_name_map = {conf["id"]: conf["name"] for conf in conf_list}
-            config_entries = []
-            for conf_id, conf in self.core_lifecycle.astrbot_config_mgr.confs.items():
-                config_entries.append(
-                    {
-                        "conf_id": conf_id,
-                        "conf_name": conf_name_map.get(conf_id, conf_id),
-                        "config": conf,
-                    }
-                )
-
-            tools_dict = []
-            for tool in tools:
-                readonly = False
-                builtin_config_statuses = []
-                builtin_config_tags = []
-                if self.tool_mgr.is_builtin_tool(tool.name):
-                    origin = "builtin"
-                    origin_name = "AstrBot Core"
-                    readonly = True
-                    builtin_config_statuses = get_builtin_tool_config_statuses(
-                        tool.name,
-                        config_entries,
-                    )
-                    builtin_config_tags = [
-                        status
-                        for status in builtin_config_statuses
-                        if status["enabled"]
-                    ]
-                elif isinstance(tool, MCPTool):
-                    origin = "mcp"
-                    origin_name = tool.mcp_server_name
-                elif tool.handler_module_path and star_map.get(
-                    tool.handler_module_path
-                ):
-                    star = star_map[tool.handler_module_path]
-                    origin = "plugin"
-                    origin_name = star.name
-                else:
-                    origin = "unknown"
-                    origin_name = "unknown"
-
-                tool_info = {
-                    "name": tool.name,
-                    "description": tool.description,
-                    "parameters": tool.parameters,
-                    "active": tool.active,
-                    "origin": origin,
-                    "origin_name": origin_name,
-                    "readonly": readonly,
-                    "builtin_config_statuses": builtin_config_statuses,
-                    "builtin_config_tags": builtin_config_tags,
-                }
-                if not readonly:
-                    perm, configured = self._get_tool_permission(tool.name)
-                    tool_info["permission"] = perm
-                    tool_info["permission_configured"] = configured
-                tools_dict.append(tool_info)
-            return Response().ok(data=tools_dict).__dict__
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(f"Failed to get tool list: {e!s}").__dict__
-
-    async def toggle_tool(self):
-        """Activate or deactivate a specified tool."""
-        try:
-            data = await request.json
-            tool_name = data.get("name")
-            action = data.get("activate")  # True or False
-
-            if not tool_name or action is None:
-                return (
-                    Response()
-                    .error("Missing required parameters: name or activate")
-                    .__dict__
-                )
-
-            if self.tool_mgr.is_builtin_tool(tool_name):
-                return (
-                    Response()
-                    .error("Builtin tools are read-only and cannot be toggled.")
-                    .__dict__
-                )
-
-            if action:
-                try:
-                    ok = self.tool_mgr.activate_llm_tool(tool_name, star_map=star_map)
-                except ValueError as e:
-                    return Response().error(f"Failed to activate tool: {e!s}").__dict__
-            else:
-                ok = self.tool_mgr.deactivate_llm_tool(tool_name)
-
-            if ok:
-                return Response().ok(None, "Operation successful.").__dict__
-            return (
-                Response()
-                .error(f"Tool {tool_name} does not exist or the operation failed.")
-                .__dict__
-            )
-
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(f"Failed to operate tool: {e!s}").__dict__
-
-    async def sync_provider(self):
-        """Sync MCP provider configuration."""
-        try:
-            data = await request.json
-            provider_name = data.get("name")  # modelscope, or others
-            match provider_name:
-                case "modelscope":
-                    access_token = data.get("access_token", "")
-                    await self.tool_mgr.sync_modelscope_mcp_servers(access_token)
-                case _:
-                    return (
-                        Response().error(f"Unknown provider: {provider_name}").__dict__
-                    )
-
-            return Response().ok(message="Sync completed").__dict__
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(f"Sync failed: {e!s}").__dict__
-
-    async def update_tool_permission(self):
-        """Set or remove the permission level of a registered tool."""
-        try:
-            data = await request.json
-            tool_name = data.get("name")
-            permission = data.get("permission")  # "admin" | "member"
-
-            if not tool_name or permission not in ("admin", "member"):
-                return (
-                    Response()
-                    .error("name and permission (admin or member) are required")
-                    .__dict__
-                )
-
-            if self.tool_mgr.is_builtin_tool(tool_name):
-                return (
-                    Response()
-                    .error(
-                        "Builtin tools do not support per-tool permission configuration."
-                    )
-                    .__dict__
-                )
-
-            # Verify the tool is known
-            if not any(t.name == tool_name for t in self.tool_mgr.func_list):
-                return Response().error(f"Tool '{tool_name}' not found").__dict__
-
-            perms_store = sp.get(
-                "tool_permissions", {}, scope="global", scope_id="global"
-            )
-            if not isinstance(perms_store, dict):
-                perms_store = {}
-            defaults = perms_store.get("_default", {})
-            if not isinstance(defaults, dict):
-                defaults = {}
-            defaults[tool_name] = permission
-            perms_store["_default"] = defaults
-            sp.put(
-                "tool_permissions",
-                perms_store,
-                scope="global",
-                scope_id="global",
-            )
-
-            return (
-                Response()
-                .ok(None, f"Tool '{tool_name}' permission set to {permission}")
-                .__dict__
-            )
-        except Exception as e:
-            logger.error(traceback.format_exc())
-            return Response().error(f"Failed to update tool permission: {e!s}").__dict__
diff --git a/astrbot/dashboard/routes/update.py b/astrbot/dashboard/routes/update.py
deleted file mode 100644
index 210eb2100..000000000
--- a/astrbot/dashboard/routes/update.py
+++ /dev/null
@@ -1,354 +0,0 @@
-import traceback
-import uuid
-
-from quart import request
-
-from astrbot.core import DEMO_MODE, logger, pip_installer
-from astrbot.core.config.default import VERSION
-from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
-from astrbot.core.db.migration.helper import check_migration_needed_v4, do_migration_v4
-from astrbot.core.updator import AstrBotUpdator
-from astrbot.core.utils.io import download_dashboard, get_dashboard_version
-
-from .route import Response, Route, RouteContext
-
-CLEAR_SITE_DATA_HEADERS = {"Clear-Site-Data": '"cache"'}
-
-
-class UpdateRoute(Route):
-    def __init__(
-        self,
-        context: RouteContext,
-        astrbot_updator: AstrBotUpdator,
-        core_lifecycle: AstrBotCoreLifecycle,
-    ) -> None:
-        super().__init__(context)
-        self.routes = {
-            "/update/check": ("GET", self.check_update),
-            "/update/progress": ("GET", self.get_update_progress),
-            "/update/releases": ("GET", self.get_releases),
-            "/update/do": ("POST", self.update_project),
-            "/update/dashboard": ("POST", self.update_dashboard),
-            "/update/pip-install": ("POST", self.install_pip_package),
-            "/update/migration": ("POST", self.do_migration),
-        }
-        self.astrbot_updator = astrbot_updator
-        self.core_lifecycle = core_lifecycle
-        self.update_progress: dict[str, dict] = {}
-        self.register_routes()
-
-    def _init_update_progress(self, progress_id: str, version: str) -> None:
-        self.update_progress[progress_id] = {
-            "id": progress_id,
-            "status": "running",
-            "stage": "preparing",
-            "version": version or "latest",
-            "message": "正在准备更新...",
-            "overall_percent": 0,
-            "stages": {
-                "dashboard": self._empty_stage("pending"),
-                "core": self._empty_stage("pending"),
-            },
-        }
-
-    @staticmethod
-    def _empty_stage(status: str = "pending") -> dict:
-        return {
-            "status": status,
-            "downloaded": 0,
-            "total": 0,
-            "percent": 0,
-            "speed": 0,
-        }
-
-    def _set_update_stage(
-        self,
-        progress_id: str,
-        stage: str,
-        status: str,
-        message: str,
-        overall_percent: int | None = None,
-    ) -> None:
-        progress = self.update_progress.get(progress_id)
-        if not progress:
-            return
-        progress["stage"] = stage
-        progress["message"] = message
-        progress["stages"].setdefault(stage, self._empty_stage())
-        progress["stages"][stage]["status"] = status
-        if overall_percent is not None:
-            progress["overall_percent"] = overall_percent
-
-    @staticmethod
-    def _normalize_percent(value) -> int:
-        try:
-            percent = float(value or 0)
-        except (TypeError, ValueError):
-            return 0
-        if percent <= 1:
-            percent *= 100
-        return max(0, min(100, int(percent)))
-
-    def _make_progress_callback(
-        self,
-        progress_id: str,
-        stage: str,
-        stage_start: int,
-        stage_weight: int,
-    ):
-        def _callback(payload: dict) -> None:
-            progress = self.update_progress.get(progress_id)
-            if not progress:
-                return
-            stage_percent = self._normalize_percent(payload.get("percent"))
-            progress["stage"] = stage
-            progress["stages"][stage] = {
-                "status": "running" if stage_percent < 100 else "done",
-                "downloaded": payload.get("downloaded", 0),
-                "total": payload.get("total", 0),
-                "percent": stage_percent,
-                "speed": payload.get("speed", 0),
-            }
-            progress["overall_percent"] = min(
-                99,
-                stage_start + int(stage_percent * stage_weight / 100),
-            )
-
-        return _callback
-
-    async def get_update_progress(self):
-        progress_id = request.args.get("id", "")
-        if not progress_id:
-            return Response().error("缺少参数 id。").__dict__
-        progress = self.update_progress.get(progress_id)
-        if not progress:
-            return (
-                Response()
-                .ok(
-                    {"id": progress_id, "status": "idle"},
-                    "没有正在进行的更新。",
-                )
-                .__dict__
-            )
-        return Response().ok(progress).__dict__
-
-    async def do_migration(self):
-        need_migration = await check_migration_needed_v4(self.core_lifecycle.db)
-        if not need_migration:
-            return Response().ok(None, "不需要进行迁移。").__dict__
-        try:
-            data = await request.json
-            pim = data.get("platform_id_map", {})
-            await do_migration_v4(
-                self.core_lifecycle.db,
-                pim,
-                self.core_lifecycle.astrbot_config,
-            )
-            return Response().ok(None, "迁移成功。").__dict__
-        except Exception as e:
-            logger.error(f"迁移失败: {traceback.format_exc()}")
-            return Response().error(f"迁移失败: {e!s}").__dict__
-
-    async def check_update(self):
-        type_ = request.args.get("type", None)
-
-        try:
-            dv = await get_dashboard_version()
-            if type_ == "dashboard":
-                return (
-                    Response()
-                    .ok({"has_new_version": dv != f"v{VERSION}", "current_version": dv})
-                    .__dict__
-                )
-            ret = await self.astrbot_updator.check_update(None, None, False)
-            return Response(
-                status="success",
-                message=str(ret) if ret is not None else "已经是最新版本了。",
-                data={
-                    "version": f"v{VERSION}",
-                    "has_new_version": ret is not None,
-                    "dashboard_version": dv,
-                    "dashboard_has_new_version": bool(dv and dv != f"v{VERSION}"),
-                },
-            ).__dict__
-        except Exception as e:
-            logger.warning(f"检查更新失败: {e!s} (不影响除项目更新外的正常使用)")
-            return Response().error(e.__str__()).__dict__
-
-    async def get_releases(self):
-        try:
-            ret = await self.astrbot_updator.get_releases()
-            return Response().ok(ret).__dict__
-        except Exception as e:
-            logger.error(f"/api/update/releases: {traceback.format_exc()}")
-            return Response().error(e.__str__()).__dict__
-
-    async def update_project(self):
-        data = await request.json
-        version = data.get("version", "")
-        reboot = data.get("reboot", True)
-        progress_id = data.get("progress_id") or uuid.uuid4().hex
-        if version == "" or version == "latest":
-            latest = True
-            version = ""
-        else:
-            latest = False
-
-        proxy: str = data.get("proxy", None)
-        if proxy:
-            proxy = proxy.removesuffix("/")
-
-        self._init_update_progress(progress_id, version)
-        try:
-            self._set_update_stage(
-                progress_id,
-                "dashboard",
-                "running",
-                "正在下载 WebUI...",
-                0,
-            )
-            await download_dashboard(
-                latest=latest,
-                version=version,
-                proxy=proxy,
-                progress_callback=self._make_progress_callback(
-                    progress_id,
-                    "dashboard",
-                    0,
-                    45,
-                ),
-            )
-            self._set_update_stage(
-                progress_id,
-                "dashboard",
-                "done",
-                "WebUI 下载完成。",
-                45,
-            )
-
-            self._set_update_stage(
-                progress_id,
-                "core",
-                "running",
-                "正在下载 AstrBot 项目代码...",
-                45,
-            )
-            await self.astrbot_updator.update(
-                latest=latest,
-                version=version,
-                proxy=proxy,
-                progress_callback=self._make_progress_callback(
-                    progress_id,
-                    "core",
-                    45,
-                    45,
-                ),
-            )
-            self._set_update_stage(
-                progress_id,
-                "core",
-                "done",
-                "项目代码下载完成。",
-                90,
-            )
-
-            # pip 更新依赖
-            self._set_update_stage(
-                progress_id,
-                "dependencies",
-                "running",
-                "正在更新依赖...",
-                92,
-            )
-            logger.info("更新依赖中...")
-            try:
-                await pip_installer.install(requirements_path="requirements.txt")
-            except Exception as e:
-                logger.error(f"更新依赖失败: {e}")
-            self._set_update_stage(
-                progress_id,
-                "dependencies",
-                "done",
-                "依赖更新完成。",
-                96,
-            )
-
-            if reboot:
-                self._set_update_stage(
-                    progress_id,
-                    "restart",
-                    "running",
-                    "更新成功，正在准备重启...",
-                    98,
-                )
-                await self.core_lifecycle.restart()
-                self.update_progress[progress_id].update(
-                    {
-                        "status": "success",
-                        "stage": "done",
-                        "message": "更新成功，AstrBot 将在 2 秒内全量重启以应用新的代码。",
-                        "overall_percent": 100,
-                    },
-                )
-                ret = (
-                    Response()
-                    .ok(None, "更新成功，AstrBot 将在 2 秒内全量重启以应用新的代码。")
-                    .__dict__
-                )
-                return ret, 200, CLEAR_SITE_DATA_HEADERS
-            self.update_progress[progress_id].update(
-                {
-                    "status": "success",
-                    "stage": "done",
-                    "message": "更新成功，AstrBot 将在下次启动时应用新的代码。",
-                    "overall_percent": 100,
-                },
-            )
-            ret = (
-                Response()
-                .ok(None, "更新成功，AstrBot 将在下次启动时应用新的代码。")
-                .__dict__
-            )
-            return ret, 200, CLEAR_SITE_DATA_HEADERS
-        except Exception as e:
-            self.update_progress[progress_id].update(
-                {
-                    "status": "error",
-                    "message": e.__str__(),
-                },
-            )
-            logger.error(f"/api/update_project: {traceback.format_exc()}")
-            return Response().error(e.__str__()).__dict__
-
-    async def update_dashboard(self):
-        try:
-            try:
-                await download_dashboard(version=f"v{VERSION}", latest=False)
-            except Exception as e:
-                logger.error(f"下载管理面板文件失败: {e}。")
-                return Response().error(f"下载管理面板文件失败: {e}").__dict__
-            ret = Response().ok(None, "更新成功。刷新页面即可应用新版本面板。").__dict__
-            return ret, 200, CLEAR_SITE_DATA_HEADERS
-        except Exception as e:
-            logger.error(f"/api/update_dashboard: {traceback.format_exc()}")
-            return Response().error(e.__str__()).__dict__
-
-    async def install_pip_package(self):
-        if DEMO_MODE:
-            return (
-                Response()
-                .error("You are not permitted to do this operation in demo mode")
-                .__dict__
-            )
-
-        data = await request.json
-        package = data.get("package", "")
-        mirror = data.get("mirror", None)
-        if not package:
-            return Response().error("缺少参数 package 或不合法。").__dict__
-        try:
-            await pip_installer.install(package, mirror=mirror)
-            return Response().ok(None, "安装成功。").__dict__
-        except Exception as e:
-            logger.error(f"/api/update_pip: {traceback.format_exc()}")
-            return Response().error(e.__str__()).__dict__
diff --git a/astrbot/dashboard/routes/util.py b/astrbot/dashboard/routes/util.py
deleted file mode 100644
index d08af03ee..000000000
--- a/astrbot/dashboard/routes/util.py
+++ /dev/null
@@ -1,117 +0,0 @@
-"""Dashboard 路由工具集。
-
-这里放一些 dashboard routes 可复用的小工具函数。
-
-目前主要用于「配置文件上传（file 类型配置项）」功能：
-- 清洗/规范化用户可控的文件名与相对路径
-- 将配置 key 映射到配置项独立子目录
-"""
-
-import os
-
-
-def get_schema_item(schema: dict | None, key_path: str) -> dict | None:
-    """按 dot-path 获取 schema 的节点。
-
-    同时支持：
-    - 扁平 schema（直接 key 命中）
-    - 嵌套 object schema（{type: "object", items: {...}}）
-    - template_list schema（<field>.templates.<template>.items）
-    """
-
-    if not isinstance(schema, dict) or not key_path:
-        return None
-    if key_path in schema:
-        return schema.get(key_path)
-
-    parts = key_path.split(".")
-    current = schema
-    idx = 0
-    while idx < len(parts):
-        part = parts[idx]
-        if part not in current:
-            return None
-        meta = current.get(part)
-        if idx == len(parts) - 1:
-            return meta
-        if not isinstance(meta, dict) or meta.get("type") != "object":
-            if not isinstance(meta, dict) or meta.get("type") != "template_list":
-                return None
-            if idx + 2 >= len(parts) or parts[idx + 1] != "templates":
-                return None
-            template_meta = meta.get("templates", {}).get(parts[idx + 2])
-            if not isinstance(template_meta, dict):
-                return None
-            if idx + 2 == len(parts) - 1:
-                return template_meta
-            current = template_meta.get("items", {})
-            idx += 3
-            continue
-        current = meta.get("items", {})
-        idx += 1
-    return None
-
-
-def sanitize_filename(name: str) -> str:
-    """清洗上传文件名，避免路径穿越与非法名称。
-
-    - 丢弃目录部分，仅保留 basename
-    - 将路径分隔符替换为下划线
-    - 拒绝空字符串 / "." / ".."
-    """
-
-    cleaned = os.path.basename(name).strip()
-    if not cleaned or cleaned in {".", ".."}:
-        return ""
-    for sep in (os.sep, os.altsep):
-        if sep:
-            cleaned = cleaned.replace(sep, "_")
-    return cleaned
-
-
-def sanitize_path_segment(segment: str) -> str:
-    """清洗目录片段（URL/path 安全，避免穿越）。
-
-    仅保留 [A-Za-z0-9_-]，其余替换为 "_"
-    """
-
-    cleaned = []
-    for ch in segment:
-        if (
-            ("a" <= ch <= "z")
-            or ("A" <= ch <= "Z")
-            or ch.isdigit()
-            or ch
-            in {
-                "-",
-                "_",
-            }
-        ):
-            cleaned.append(ch)
-        else:
-            cleaned.append("_")
-    result = "".join(cleaned).strip("_")
-    return result or "_"
-
-
-def config_key_to_folder(key_path: str) -> str:
-    """将 dot-path 的配置 key 转成稳定的文件夹路径。"""
-
-    parts = [sanitize_path_segment(p) for p in key_path.split(".") if p]
-    return "/".join(parts) if parts else "_"
-
-
-def normalize_rel_path(rel_path: str | None) -> str | None:
-    """规范化用户传入的相对路径，并阻止路径穿越。"""
-
-    if not isinstance(rel_path, str):
-        return None
-    rel = rel_path.replace("\\", "/").lstrip("/")
-    if not rel:
-        return None
-    parts = [p for p in rel.split("/") if p]
-    if any(part in {".", ".."} for part in parts):
-        return None
-    if rel.startswith("../") or "/../" in rel:
-        return None
-    return "/".join(parts)
diff --git a/astrbot/dashboard/schemas.py b/astrbot/dashboard/schemas.py
new file mode 100644
index 000000000..eddabbbcd
--- /dev/null
+++ b/astrbot/dashboard/schemas.py
@@ -0,0 +1,593 @@
+from __future__ import annotations
+
+from typing import Any, Literal
+
+from pydantic import BaseModel, ConfigDict, Field
+
+
+class OpenModel(BaseModel):
+    model_config = ConfigDict(extra="allow")
+
+
+class ConfigProfileCreateRequest(BaseModel):
+    name: str | None = None
+    config: dict[str, Any] | None = None
+
+
+class ConfigContentRequest(OpenModel):
+    pass
+
+
+class RenameRequest(BaseModel):
+    name: str | None = None
+
+
+class EnabledPatch(BaseModel):
+    enabled: bool
+
+
+class ApiKeyCreateRequest(OpenModel):
+    name: str | None = None
+    scopes: list[str] | None = None
+    expires_in_days: int | None = None
+
+
+class ApiKeyIdRequest(BaseModel):
+    key_id: str
+
+
+class LoginRequest(OpenModel):
+    username: str | None = None
+    password: str | None = None
+    code: str | None = None
+    trust_device_flag: bool | None = None
+
+
+class AuthSetupRequest(OpenModel):
+    username: str | None = None
+    password: str | None = None
+    confirm_password: str | None = None
+
+
+class TotpSetupRequest(OpenModel):
+    secret: str | None = None
+    code: str | None = None
+
+
+class AccountUpdateRequest(OpenModel):
+    password: str | None = None
+    new_password: str | None = None
+    confirm_password: str | None = None
+    new_username: str | None = None
+
+
+class BackupUploadInitRequest(OpenModel):
+    filename: str | None = None
+    total_size: int | None = None
+
+
+class BackupUploadSessionRequest(OpenModel):
+    upload_id: str | None = None
+
+
+class BackupImportRequest(OpenModel):
+    confirmed: bool | None = None
+
+
+class BackupRenameRequest(OpenModel):
+    new_name: str | None = None
+
+
+class UpdateRequest(OpenModel):
+    version: str | None = None
+    proxy: str | None = None
+    reboot: bool | None = None
+    progress_id: str | None = None
+
+
+class PipInstallRequest(OpenModel):
+    package: str | None = None
+    mirror: str | None = None
+
+
+class MigrationRequest(OpenModel):
+    platform_id_map: dict[str, Any] | None = None
+
+
+class ChatProjectRequest(OpenModel):
+    project_id: str | None = None
+    title: str | None = None
+    emoji: str | None = None
+    description: str | None = None
+
+
+class ChatProjectSessionRequest(OpenModel):
+    project_id: str | None = None
+    session_id: str | None = None
+
+
+class ChatSessionBatchDeleteRequest(OpenModel):
+    session_ids: list[str]
+
+
+class ChatSessionPatchRequest(OpenModel):
+    display_name: str | None = None
+
+
+class ChatMessagePatchRequest(OpenModel):
+    content: dict[str, Any]
+
+
+class ChatMessageRegenerateRequest(OpenModel):
+    selected_provider: str | None = None
+    selected_model: str | None = None
+    enable_streaming: bool | None = None
+
+
+class ChatThreadCreateRequest(OpenModel):
+    session_id: str
+    parent_message_id: str | int
+    selected_text: str
+
+
+class ChatThreadMessageRequest(OpenModel):
+    message: Any
+    selected_provider: str | None = None
+    selected_model: str | None = None
+    enable_streaming: bool | None = None
+
+
+class CronJobRequest(OpenModel):
+    pass
+
+
+class CommandUpdateRequest(BaseModel):
+    enabled: bool | None = None
+    alias: str | None = None
+    aliases: list[str] | None = None
+    permission_group: str | None = None
+
+
+class CommandToggleRequest(BaseModel):
+    handler_full_name: str
+    enabled: bool
+
+
+class CommandRenameRequest(BaseModel):
+    handler_full_name: str
+    new_name: str
+    aliases: list[str] | None = None
+
+
+class CommandPermissionRequest(BaseModel):
+    handler_full_name: str
+    permission: str
+
+
+class SubAgentConfigRequest(OpenModel):
+    main_enable: bool | None = None
+    enable: bool | None = None
+    remove_main_duplicate_tools: bool | None = None
+    agents: list[dict[str, Any]] | None = None
+
+
+class TraceSettingsRequest(BaseModel):
+    trace_enable: bool | None = None
+
+
+class StorageCleanupRequest(BaseModel):
+    target: str = "all"
+
+
+class GhProxyTestRequest(BaseModel):
+    proxy_url: str | None = None
+
+
+class OpenApiChatRequest(OpenModel):
+    message: Any = None
+    session_id: str | None = None
+    conversation_id: str | None = None
+    username: str | None = None
+    config_id: str | None = None
+    config_name: str | None = None
+    platform_id: str | None = None
+    enable_streaming: bool | None = None
+
+
+class ImMessageRequest(OpenModel):
+    umo: str | None = None
+    message: Any = None
+    type: str | None = None
+
+
+class KnowledgeBaseRequest(OpenModel):
+    kb_id: str | None = None
+    name: str | None = None
+    description: str | None = None
+    embedding_provider_id: str | None = None
+    rerank_provider_id: str | None = None
+    chunk_size: int | None = None
+    chunk_overlap: int | None = None
+
+
+class KnowledgeBaseImportRequest(OpenModel):
+    documents: list[dict[str, Any]] | None = None
+    batch_size: int | None = None
+    tasks_limit: int | None = None
+    max_retries: int | None = None
+
+
+class KnowledgeBaseUrlImportRequest(OpenModel):
+    url: str | None = None
+    urls: list[str] | None = None
+    chunk_size: int | None = None
+    chunk_overlap: int | None = None
+    batch_size: int | None = None
+    tasks_limit: int | None = None
+    max_retries: int | None = None
+
+
+class KnowledgeBaseRetrieveRequest(OpenModel):
+    query: str | None = None
+    top_k: int | None = None
+    threshold: float | None = None
+    rerank: bool | None = None
+
+
+class ToolEnabledRequest(BaseModel):
+    enabled: bool
+
+
+class ToolPermissionRequest(BaseModel):
+    permission: Literal["admin", "member"]
+
+
+class McpServerRequest(OpenModel):
+    name: str | None = None
+    oldName: str | None = None
+    active: bool | None = None
+    enabled: bool | None = None
+    config: dict[str, Any] | None = None
+    mcpServers: dict[str, Any] | None = None
+
+
+class McpServerByNameRequest(OpenModel):
+    server_name: str
+    config: dict[str, Any] | None = None
+    mcp_server_config: dict[str, Any] | None = None
+    enabled: bool | None = None
+
+
+class ModelScopeSyncRequest(BaseModel):
+    access_token: str | None = None
+
+
+class T2iTemplateRequest(BaseModel):
+    name: str | None = None
+    content: str | None = None
+
+
+class T2iActiveTemplateRequest(BaseModel):
+    name: str
+
+
+class PersonaRequest(OpenModel):
+    persona_id: str | None = None
+    system_prompt: str | None = None
+    begin_dialogs: list[Any] | None = None
+    tools: list[str] | None = None
+    skills: list[str] | None = None
+    custom_error_message: str | None = None
+    folder_id: str | None = None
+    sort_order: int | None = None
+
+
+class PersonaByIdRequest(OpenModel):
+    persona_id: str
+
+
+class PersonaMoveRequest(BaseModel):
+    persona_id: str
+    folder_id: str | None = None
+
+
+class PersonaReorderItem(BaseModel):
+    id: str
+    type: Literal["persona", "folder"]
+    sort_order: int
+
+
+class PersonaReorderRequest(BaseModel):
+    items: list[PersonaReorderItem]
+
+
+class PersonaFolderRequest(OpenModel):
+    folder_id: str | None = None
+    name: str | None = None
+    parent_id: str | None = None
+    description: str | None = None
+    sort_order: int | None = None
+
+
+class SkillUpdateRequest(OpenModel):
+    enabled: bool | None = None
+    active: bool | None = None
+
+    def active_value(self) -> bool:
+        if self.enabled is not None:
+            return self.enabled
+        if self.active is not None:
+            return self.active
+        return True
+
+
+class SkillByNameUpdateRequest(SkillUpdateRequest):
+    skill_name: str
+
+
+class SkillFileUpdateRequest(OpenModel):
+    skill_name: str
+    path: str
+    content: str = ""
+
+
+class SkillNeoRequest(OpenModel):
+    skill_name: str | None = None
+    name: str | None = None
+    candidate_id: str | None = None
+    release_id: str | None = None
+    profile_id: str | None = None
+    payload: dict[str, Any] | None = None
+
+
+class ConversationRef(BaseModel):
+    user_id: str
+    cid: str
+
+
+class ConversationPatchRequest(OpenModel):
+    user_id: str | None = None
+    title: str | None = None
+    persona_id: str | None = None
+
+
+class ConversationMessagesReplaceRequest(OpenModel):
+    user_id: str | None = None
+    history: list[Any] | str | None = None
+    messages: list[Any] | str | None = None
+
+
+class ConversationBatchDeleteRequest(BaseModel):
+    conversations: list[ConversationRef]
+
+
+class ConversationExportRequest(BaseModel):
+    conversations: list[ConversationRef]
+
+
+class BotConfigRequest(OpenModel):
+    bot_id: str | None = None
+    id: str | None = None
+    name: str | None = None
+    type: str | None = None
+    enabled: bool | None = None
+    enable: bool | None = None
+    config: dict[str, Any] | None = None
+
+    def to_dashboard_config(self, *, fallback_id: str | None = None) -> dict[str, Any]:
+        config = dict(
+            self.config
+            or self.model_dump(
+                exclude={"bot_id", "config", "enabled"},
+                exclude_none=True,
+            )
+        )
+        if fallback_id and "id" not in config:
+            config["id"] = fallback_id
+        if self.type and "type" not in config:
+            config["type"] = self.type
+        if self.id and "id" not in config:
+            config["id"] = self.id
+        if self.enabled is not None:
+            config["enable"] = self.enabled
+        elif self.enable is not None:
+            config["enable"] = self.enable
+        elif "enable" not in config:
+            config["enable"] = True
+        return config
+
+
+class BotRegistrationRequest(OpenModel):
+    action: Literal["start", "poll"] | str | None = None
+    platform_config: dict[str, Any] | None = None
+    registration_code: str | None = None
+    device_code: str | None = None
+
+
+class ProviderSourceRequest(OpenModel):
+    source_id: str | None = None
+    id: str | None = None
+    config: dict[str, Any] | None = None
+
+    def to_dashboard_config(self, *, fallback_id: str | None = None) -> dict[str, Any]:
+        config = dict(
+            self.config
+            or self.model_dump(exclude={"source_id", "config"}, exclude_none=True)
+        )
+        if fallback_id:
+            config["id"] = fallback_id
+        elif self.id and "id" not in config:
+            config["id"] = self.id
+        return config
+
+
+class ProviderConfigRequest(OpenModel):
+    provider_id: str | None = None
+    source_id: str | None = None
+    id: str | None = None
+    provider_source_id: str | None = None
+    provider_config: dict[str, Any] | None = None
+    capability: str | None = None
+    enabled: bool | None = None
+    enable: bool | None = None
+    config: dict[str, Any] | None = None
+
+    def to_dashboard_config(
+        self,
+        *,
+        fallback_id: str | None = None,
+        source_id: str | None = None,
+    ) -> dict[str, Any]:
+        config = dict(
+            self.config
+            or self.model_dump(
+                exclude={
+                    "provider_id",
+                    "source_id",
+                    "provider_config",
+                    "config",
+                    "capability",
+                    "enabled",
+                },
+                exclude_none=True,
+            )
+        )
+        if fallback_id and "id" not in config:
+            config["id"] = fallback_id
+        if self.id and "id" not in config:
+            config["id"] = self.id
+        if source_id:
+            config["provider_source_id"] = source_id
+        elif self.provider_source_id and "provider_source_id" not in config:
+            config["provider_source_id"] = self.provider_source_id
+        if self.enabled is not None:
+            config["enable"] = self.enabled
+        elif self.enable is not None:
+            config["enable"] = self.enable
+        elif "enable" not in config:
+            config["enable"] = True
+        if self.capability and "provider_type" not in config:
+            capability_map = {
+                "chat": "chat_completion",
+                "agent": "agent_runner",
+                "stt": "speech_to_text",
+                "tts": "text_to_speech",
+                "embedding": "embedding",
+                "rerank": "rerank",
+            }
+            config["provider_type"] = capability_map.get(
+                self.capability, self.capability
+            )
+        return config
+
+
+class ProviderListQuery(BaseModel):
+    capability: str | None = None
+    source_id: str | None = None
+    enabled: bool | None = None
+
+
+class PluginVersionSupportRequest(OpenModel):
+    astrbot_version: str | None = None
+    plugin_ids: list[str] | None = None
+
+
+class PluginInstallRequest(OpenModel):
+    repository: str | None = None
+    url: str | None = None
+    download_url: str | None = None
+    proxy: str | None = None
+    ignore_version_check: bool | None = None
+
+
+class PluginUpdateRequest(OpenModel):
+    plugin_id: str | None = None
+    plugin_ids: list[str] | None = None
+    name: str | None = None
+    names: list[str] | None = None
+    proxy: str | None = None
+    download_url: str | None = None
+    download_urls: dict[str, str] | None = None
+
+
+class PluginByIdRequest(OpenModel):
+    plugin_id: str
+
+
+class PluginEnabledRequest(PluginByIdRequest):
+    enabled: bool
+
+
+class PluginConfigUpdateRequest(PluginByIdRequest):
+    config: dict[str, Any] | None = None
+
+
+class PluginConfigPayload(OpenModel):
+    config: dict[str, Any] | None = None
+
+
+class PluginSourceRequest(OpenModel):
+    id: str | None = None
+    name: str | None = None
+    url: str | None = None
+    sources: list[Any] | None = None
+
+
+class PluginUninstallRequest(OpenModel):
+    delete_config: bool | None = None
+    delete_data: bool | None = None
+
+
+class PluginConfigFileDeleteRequest(OpenModel):
+    path: str | None = None
+    file: str | None = None
+    filename: str | None = None
+    key: str | None = None
+
+
+class ConfigRoutesReplaceRequest(BaseModel):
+    routing: dict[str, str]
+
+
+class ConfigRouteUpsertRequest(BaseModel):
+    config_id: str = Field(..., min_length=1)
+
+
+class SessionRuleRequest(OpenModel):
+    umo: str | None = None
+    rule_key: str | None = None
+    rule_value: Any = None
+
+
+class UmoListRequest(OpenModel):
+    umo: str | None = None
+    umos: list[str] | None = None
+    scope: Literal["all", "group", "private", "custom_group"] | None = None
+    group_id: str | None = None
+    rule_key: str | None = None
+
+
+class BatchSessionProviderRequest(UmoListRequest):
+    provider_id: str | None = None
+    provider_type: (
+        Literal[
+            "chat_completion",
+            "speech_to_text",
+            "text_to_speech",
+        ]
+        | None
+    ) = None
+
+
+class BatchSessionServiceRequest(UmoListRequest):
+    session_enabled: bool | None = None
+    llm_enabled: bool | None = None
+    tts_enabled: bool | None = None
+
+
+class SessionGroupRequest(OpenModel):
+    id: str | None = None
+    name: str | None = None
+    umos: list[str] | None = None
+    add_umos: list[str] | None = None
+    remove_umos: list[str] | None = None
diff --git a/astrbot/dashboard/server.py b/astrbot/dashboard/server.py
index 9888da8f5..f00511da4 100644
--- a/astrbot/dashboard/server.py
+++ b/astrbot/dashboard/server.py
@@ -1,55 +1,47 @@
 import asyncio
-import hashlib
 import ipaddress
-import logging
 import os
 import socket
 import time
-from datetime import datetime
 from pathlib import Path
-from typing import Protocol, cast
+from typing import Any, Protocol, cast
 
 import jwt
 import psutil
-from flask.json.provider import DefaultJSONProvider
+from fastapi import Request
+from fastapi.responses import JSONResponse
 from hypercorn.asyncio import serve
 from hypercorn.config import Config as HyperConfig
 from hypercorn.logging import AccessLogAtoms
 from hypercorn.logging import Logger as HypercornLogger
-from quart import Quart, g, jsonify, request
-from quart.logging import default_handler
-from werkzeug.exceptions import MethodNotAllowed, NotFound
-from werkzeug.routing import Map, Rule
 
 from astrbot.core import logger
 from astrbot.core.config.default import VERSION
 from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
 from astrbot.core.db import BaseDatabase
 from astrbot.core.utils.astrbot_path import get_astrbot_data_path
-from astrbot.core.utils.datetime_utils import to_utc_isoformat
 from astrbot.core.utils.io import (
     get_bundled_dashboard_dist_path,
     get_local_ip_addresses,
     should_use_bundled_dashboard_dist,
 )
+from astrbot.dashboard.asgi_runtime import (
+    DashboardRequestState,
+    FastAPIAppAdapter,
+)
+from astrbot.dashboard.responses import error
 
+from .api.app import create_dashboard_asgi_app
 from .plugin_page_auth import PluginPageAuth
-from .routes import *
-from .routes.api_key import ALL_OPEN_API_SCOPES
-from .routes.auth import DASHBOARD_JWT_COOKIE_NAME
-from .routes.backup import BackupRoute
-from .routes.live_chat import LiveChatRoute
-from .routes.platform import PlatformRoute
-from .routes.route import Response, RouteContext
-from .routes.session_management import SessionManagementRoute
-from .routes.subagent import SubAgentRoute
-from .routes.t2i import T2iRoute
+from .services.auth_service import DASHBOARD_JWT_COOKIE_NAME
 
 _RATE_LIMITED_ENDPOINTS: frozenset = frozenset(
     {
         "/api/config/astrbot/update",
         "/api/auth/totp/setup",
+        "/api/v1/auth/totp/setup",
         "/api/auth/login",
+        "/api/v1/auth/login",
     }
 )
 
@@ -120,44 +112,7 @@ class _AddrWithPort(Protocol):
     port: int
 
 
-APP: Quart
-
-
-def _normalize_plugin_api_route(route: str) -> str:
-    route = route.strip()
-    if not route.startswith("/"):
-        route = f"/{route}"
-    return route
-
-
-def _match_registered_web_api(registered_web_apis, subpath: str, method: str):
-    request_path = f"/{subpath.lstrip('/')}"
-    request_method = method.upper()
-
-    for route, view_handler, methods, _ in registered_web_apis:
-        allowed_methods = [item.upper() for item in methods]
-        if request_method not in allowed_methods:
-            continue
-
-        url_map = Map(
-            [
-                Rule(
-                    _normalize_plugin_api_route(route),
-                    endpoint="plugin_api",
-                    methods=allowed_methods,
-                ),
-            ]
-        )
-        try:
-            _, path_values = url_map.bind("").match(
-                request_path,
-                method=request_method,
-            )
-        except (MethodNotAllowed, NotFound):
-            continue
-        return view_handler, path_values
-
-    return None
+APP: FastAPIAppAdapter | None = None
 
 
 def _parse_env_bool(value: str | None, default: bool) -> bool:
@@ -213,13 +168,6 @@ class _ProxyAwareHypercornLogger(HypercornLogger):
         return atoms
 
 
-class AstrBotJSONProvider(DefaultJSONProvider):
-    def default(self, obj):
-        if isinstance(obj, datetime):
-            return to_utc_isoformat(obj)
-        return super().default(obj)
-
-
 class AstrBotDashboard:
     def __init__(
         self,
@@ -254,123 +202,100 @@ class AstrBotDashboard:
                 self.data_path = os.path.abspath(user_dist)
 
         self._rate_limiter_registry = _RateLimiterRegistry()
-        self.app = Quart("dashboard", static_folder=self.data_path, static_url_path="/")
-        APP = self.app  # noqa
+        self._init_jwt_secret()
+        self.asgi_app = create_dashboard_asgi_app(
+            core_lifecycle=core_lifecycle,
+            db=db,
+            jwt_secret=self._jwt_secret,
+            static_folder=self.data_path,
+        )
+        self.app = FastAPIAppAdapter(self.asgi_app, static_folder=self.data_path)
+        self.asgi_app.state.dashboard_app_adapter = self.app
+        self.app._dashboard_server = self
+        global APP
+        APP = self.app
         self.app.config["MAX_CONTENT_LENGTH"] = (
             128 * 1024 * 1024
         )  # 将 Flask 允许的最大上传文件体大小设置为 128 MB
-        self.app.json = AstrBotJSONProvider(self.app)
-        self.app.json.sort_keys = False
-        self.app.before_request(self.auth_middleware)
-        # token 用于验证请求
-        logging.getLogger(self.app.name).removeHandler(default_handler)
-        self.context = RouteContext(self.config, self.app)
-        self.ur = UpdateRoute(
-            self.context,
-            core_lifecycle.astrbot_updator,
-            core_lifecycle,
-        )
-        self.sr = StatRoute(self.context, db, core_lifecycle)
-        self.pr = PluginRoute(
-            self.context,
-            core_lifecycle,
-            core_lifecycle.plugin_manager,
-        )
-        self.command_route = CommandRoute(self.context, core_lifecycle)
-        self.cr = ConfigRoute(self.context, core_lifecycle)
-        self.lr = LogRoute(self.context, core_lifecycle.log_broker)
-        self.sfr = StaticFileRoute(self.context)
-        self.ar = AuthRoute(self.context, db)
-        self.api_key_route = ApiKeyRoute(self.context, db)
-        self.chat_route = ChatRoute(self.context, db, core_lifecycle)
-        self.open_api_route = OpenApiRoute(
-            self.context,
-            db,
-            core_lifecycle,
-            self.chat_route,
-        )
-        self.chatui_project_route = ChatUIProjectRoute(self.context, db)
-        self.tools_root = ToolsRoute(self.context, core_lifecycle)
-        self.subagent_route = SubAgentRoute(self.context, core_lifecycle)
-        self.skills_route = SkillsRoute(self.context, core_lifecycle)
-        self.conversation_route = ConversationRoute(self.context, db, core_lifecycle)
-        self.file_route = FileRoute(self.context)
-        self.session_management_route = SessionManagementRoute(
-            self.context,
-            db,
-            core_lifecycle,
-        )
-        self.persona_route = PersonaRoute(self.context, db, core_lifecycle)
-        self.cron_route = CronRoute(self.context, core_lifecycle)
-        self.t2i_route = T2iRoute(self.context, core_lifecycle)
-        self.kb_route = KnowledgeBaseRoute(self.context, core_lifecycle)
-        self.platform_route = PlatformRoute(self.context, core_lifecycle)
-        self.backup_route = BackupRoute(self.context, db, core_lifecycle)
-        self.live_chat_route = LiveChatRoute(self.context, db, core_lifecycle)
 
-        self.app.add_url_rule(
-            "/api/plug/<path:subpath>",
-            view_func=self.srv_plug_route,
-            methods=["GET", "POST"],
-        )
+        @self.asgi_app.middleware("http")
+        async def dashboard_auth_middleware(request_, call_next):
+            request_.state.dashboard_g = DashboardRequestState()
+            auth_response = await self.auth_middleware(request_)
+            if auth_response is not None:
+                return auth_response
+            return await call_next(request_)
 
         self.shutdown_event = shutdown_event
 
-        self._init_jwt_secret()
-
-    async def srv_plug_route(self, subpath, *args, **kwargs):
-        """插件路由"""
-        registered_web_apis = self.core_lifecycle.star_context.registered_web_apis
-        matched_api = _match_registered_web_api(
-            registered_web_apis,
-            subpath,
-            request.method,
-        )
-        if matched_api:
-            view_handler, path_values = matched_api
-            return await view_handler(*args, **{**kwargs, **path_values})
-        return jsonify(Response().error("未找到该路由").__dict__)
-
-    async def auth_middleware(self):
-        if not request.path.startswith("/api"):
+    async def auth_middleware(self, current_request: Request):
+        path = current_request.url.path
+        if not path.startswith("/api"):
             return None
-        if request.path.startswith("/api/v1"):
-            raw_key = self._extract_raw_api_key()
-            if not raw_key:
-                r = jsonify(Response().error("Missing API key").__dict__)
-                r.status_code = 401
-                return r
-            key_hash = hashlib.pbkdf2_hmac(
-                "sha256",
-                raw_key.encode("utf-8"),
-                b"astrbot_api_key",
-                100_000,
-            ).hex()
-            api_key = await self.db.get_active_api_key_by_hash(key_hash)
-            if not api_key:
-                r = jsonify(Response().error("Invalid API key").__dict__)
+        rate_limit_response = await self._apply_auth_rate_limit(current_request, path)
+        if rate_limit_response is not None:
+            return rate_limit_response
+        if path.startswith("/api/v1"):
+            return None
+
+        allowed_exact_endpoints = {
+            "/api/auth/login",
+            "/api/auth/logout",
+            "/api/auth/setup-status",
+            "/api/auth/setup",
+        }
+        allowed_endpoint_prefixes = [
+            "/api/file",
+            "/api/v1/files/tokens",
+            "/api/platform/webhook",
+            "/api/stat/start-time",
+            "/api/backup/download",  # 备份下载使用 URL 参数传递 token
+        ]
+        if path in allowed_exact_endpoints or any(
+            path.startswith(prefix) for prefix in allowed_endpoint_prefixes
+        ):
+            return None
+        is_plugin_page_path = PluginPageAuth.is_protected_path(path)
+        token = self._extract_dashboard_jwt(current_request)
+        if not token and is_plugin_page_path:
+            token = PluginPageAuth.extract_asset_token(current_request.query_params)
+        if not token:
+            r = JSONResponse(error("未授权"))
+            r.status_code = 401
+            return r
+        try:
+            payload = jwt.decode(token, self._jwt_secret, algorithms=["HS256"])
+            if PluginPageAuth.is_asset_token(
+                payload
+            ) and not PluginPageAuth.is_scope_valid(
+                payload,
+                path,
+            ):
+                r = JSONResponse(error("Token 无效"))
                 r.status_code = 401
                 return r
 
-            if isinstance(api_key.scopes, list):
-                scopes = api_key.scopes
-            else:
-                scopes = list(ALL_OPEN_API_SCOPES)
-            required_scope = self._get_required_open_api_scope(request.path)
-            if required_scope and "*" not in scopes and required_scope not in scopes:
-                r = jsonify(Response().error("Insufficient API key scope").__dict__)
-                r.status_code = 403
-                return r
-
-            g.api_key_id = api_key.key_id
-            g.api_key_scopes = scopes
-            g.username = f"api_key:{api_key.key_id}"
-            await self.db.touch_api_key(api_key.key_id)
-            return None
+            username = payload.get("username")
+            if not isinstance(username, str) or not username.strip():
+                raise jwt.InvalidTokenError("missing username in token payload")
+            current_request.state.dashboard_g.username = username
+        except jwt.ExpiredSignatureError:
+            r = JSONResponse(error("Token 过期"))
+            r.status_code = 401
+            return r
+        except jwt.InvalidTokenError:
+            r = JSONResponse(error("Token 无效"))
+            r.status_code = 401
+            return r
 
+    async def _apply_auth_rate_limit(
+        self,
+        current_request: Request,
+        path: str,
+    ) -> JSONResponse | None:
         if (
             os.environ.get("ASTRBOT_TEST_MODE") != "true"
-            and request.path in _RATE_LIMITED_ENDPOINTS
+            and path in _RATE_LIMITED_ENDPOINTS
         ):
             rl_config = self.config.get("dashboard", {}).get("auth_rate_limit", {})
             rl_enabled = rl_config.get("enable", True)
@@ -382,67 +307,17 @@ class AstrBotDashboard:
                 if max_burst <= 0:
                     max_burst = 3
                 refill_rate = 1.0 / average_interval
-                client_ip = self._get_request_client_ip(request)
+                client_ip = self._get_request_client_ip(current_request)
                 limiter = self._rate_limiter_registry.get_or_create(
                     client_ip, capacity=max_burst, refill_rate=refill_rate
                 )
                 if not await limiter.acquire():
-                    r = jsonify(
-                        Response()
-                        .error("验证尝试过于频繁，系统可能正在遭受暴力破解")
-                        .__dict__
+                    r = JSONResponse(
+                        error("验证尝试过于频繁，系统可能正在遭受暴力破解")
                     )
                     r.status_code = 429
                     return r
-
-        allowed_exact_endpoints = {
-            "/api/auth/login",
-            "/api/auth/logout",
-            "/api/auth/setup-status",
-            "/api/auth/setup",
-        }
-        allowed_endpoint_prefixes = [
-            "/api/file",
-            "/api/platform/webhook",
-            "/api/stat/start-time",
-            "/api/backup/download",  # 备份下载使用 URL 参数传递 token
-        ]
-        if request.path in allowed_exact_endpoints or any(
-            request.path.startswith(prefix) for prefix in allowed_endpoint_prefixes
-        ):
-            return None
-        is_plugin_page_path = PluginPageAuth.is_protected_path(request.path)
-        token = self._extract_dashboard_jwt()
-        if not token and is_plugin_page_path:
-            token = PluginPageAuth.extract_asset_token()
-        if not token:
-            r = jsonify(Response().error("未授权").__dict__)
-            r.status_code = 401
-            return r
-        try:
-            payload = jwt.decode(token, self._jwt_secret, algorithms=["HS256"])
-            if PluginPageAuth.is_asset_token(
-                payload
-            ) and not PluginPageAuth.is_scope_valid(
-                payload,
-                request.path,
-            ):
-                r = jsonify(Response().error("Token 无效").__dict__)
-                r.status_code = 401
-                return r
-
-            username = payload.get("username")
-            if not isinstance(username, str) or not username.strip():
-                raise jwt.InvalidTokenError("missing username in token payload")
-            g.username = username
-        except jwt.ExpiredSignatureError:
-            r = jsonify(Response().error("Token 过期").__dict__)
-            r.status_code = 401
-            return r
-        except jwt.InvalidTokenError:
-            r = jsonify(Response().error("Token 无效").__dict__)
-            r.status_code = 401
-            return r
+        return None
 
     def _get_request_client_ip(self, current_request) -> str:
         if bool(self.config.get("dashboard", {}).get("trust_proxy_headers", False)):
@@ -464,7 +339,11 @@ class AstrBotDashboard:
                 except ValueError:
                     pass
 
-        remote_addr = str(current_request.remote_addr or "").strip()
+        remote_addr = (
+            str(current_request.client.host).strip()
+            if current_request.client is not None
+            else ""
+        )
         if remote_addr:
             try:
                 return str(ipaddress.ip_address(remote_addr))
@@ -474,46 +353,21 @@ class AstrBotDashboard:
         return "unknown"
 
     @staticmethod
-    def _extract_dashboard_jwt() -> str | None:
-        auth_header = request.headers.get("Authorization", "").strip()
+    def _extract_dashboard_jwt(current_request: Request) -> str | None:
+        auth_header = current_request.headers.get("Authorization", "").strip()
         if auth_header.startswith("Bearer "):
             token = auth_header.removeprefix("Bearer ").strip()
             if token:
                 return token
 
-        cookie_token = request.cookies.get(DASHBOARD_JWT_COOKIE_NAME, "").strip()
+        cookie_token = current_request.cookies.get(
+            DASHBOARD_JWT_COOKIE_NAME,
+            "",
+        ).strip()
         if cookie_token:
             return cookie_token
         return None
 
-    @staticmethod
-    def _extract_raw_api_key() -> str | None:
-        if key := request.args.get("api_key"):
-            return key.strip()
-        if key := request.args.get("key"):
-            return key.strip()
-        if key := request.headers.get("X-API-Key"):
-            return key.strip()
-        auth_header = request.headers.get("Authorization", "").strip()
-        if auth_header.startswith("Bearer "):
-            return auth_header.removeprefix("Bearer ").strip()
-        if auth_header.startswith("ApiKey "):
-            return auth_header.removeprefix("ApiKey ").strip()
-        return None
-
-    @staticmethod
-    def _get_required_open_api_scope(path: str) -> str | None:
-        scope_map = {
-            "/api/v1/chat": "chat",
-            "/api/v1/chat/ws": "chat",
-            "/api/v1/chat/sessions": "chat",
-            "/api/v1/configs": "config",
-            "/api/v1/file": "file",
-            "/api/v1/im/message": "im",
-            "/api/v1/im/bots": "im",
-        }
-        return scope_map.get(path)
-
     def check_port_in_use(self, port: int) -> bool:
         """跨平台检测端口是否被占用"""
         try:
@@ -725,7 +579,9 @@ class AstrBotDashboard:
             config.accesslog = "-"
             config.access_log_format = "%(h)s %(r)s %(s)s %(b)s %(D)s"
 
-        return serve(self.app, config, shutdown_trigger=self.shutdown_trigger)
+        return serve(
+            cast(Any, self.asgi_app), config, shutdown_trigger=self.shutdown_trigger
+        )
 
     async def shutdown_trigger(self) -> None:
         await self.shutdown_event.wait()
diff --git a/astrbot/dashboard/services/__init__.py b/astrbot/dashboard/services/__init__.py
new file mode 100644
index 000000000..bc80eac28
--- /dev/null
+++ b/astrbot/dashboard/services/__init__.py
@@ -0,0 +1 @@
+"""Application services for dashboard HTTP APIs."""
diff --git a/astrbot/dashboard/services/api_key_service.py b/astrbot/dashboard/services/api_key_service.py
new file mode 100644
index 000000000..3a8a8968b
--- /dev/null
+++ b/astrbot/dashboard/services/api_key_service.py
@@ -0,0 +1,126 @@
+from __future__ import annotations
+
+import hashlib
+import secrets
+from datetime import datetime, timedelta, timezone
+from typing import Any
+
+from astrbot.core.db import BaseDatabase
+from astrbot.core.utils.datetime_utils import normalize_datetime_utc
+
+from .auth_service import ALL_OPEN_API_SCOPES, OPEN_API_SCOPE_INCLUDES
+
+
+class ApiKeyServiceError(Exception):
+    pass
+
+
+class ApiKeyService:
+    def __init__(self, db: BaseDatabase) -> None:
+        self.db = db
+
+    @staticmethod
+    def hash_key(raw_key: str) -> str:
+        return hashlib.pbkdf2_hmac(
+            "sha256",
+            raw_key.encode("utf-8"),
+            b"astrbot_api_key",
+            100_000,
+        ).hex()
+
+    @staticmethod
+    def _normalize_utc(dt: datetime | None) -> datetime | None:
+        return normalize_datetime_utc(dt)
+
+    @classmethod
+    def _serialize_datetime(cls, dt: datetime | None) -> str | None:
+        normalized = cls._normalize_utc(dt)
+        if normalized is None:
+            return None
+        return normalized.astimezone().isoformat()
+
+    @classmethod
+    def serialize_api_key(cls, key) -> dict:
+        expires_at = cls._normalize_utc(key.expires_at)
+        return {
+            "key_id": key.key_id,
+            "name": key.name,
+            "key_prefix": key.key_prefix,
+            "scopes": key.scopes or [],
+            "created_by": key.created_by,
+            "created_at": cls._serialize_datetime(key.created_at),
+            "updated_at": cls._serialize_datetime(key.updated_at),
+            "last_used_at": cls._serialize_datetime(key.last_used_at),
+            "expires_at": cls._serialize_datetime(key.expires_at),
+            "revoked_at": cls._serialize_datetime(key.revoked_at),
+            "is_revoked": key.revoked_at is not None,
+            "is_expired": bool(expires_at and expires_at < datetime.now(timezone.utc)),
+        }
+
+    @staticmethod
+    def _normalize_scopes(raw_scopes: Any) -> list[str]:
+        if raw_scopes is None:
+            return list(ALL_OPEN_API_SCOPES)
+        if not isinstance(raw_scopes, list):
+            raise ApiKeyServiceError("Invalid scopes")
+
+        scopes = []
+        invalid_scopes = []
+        for scope in raw_scopes:
+            if isinstance(scope, str) and scope in ALL_OPEN_API_SCOPES:
+                scopes.append(scope)
+            else:
+                invalid_scopes.append(str(scope))
+        if invalid_scopes:
+            raise ApiKeyServiceError(f"Invalid scopes: {', '.join(invalid_scopes)}")
+        for scope in tuple(scopes):
+            scopes.extend(OPEN_API_SCOPE_INCLUDES.get(scope, ()))
+        normalized_scopes = list(dict.fromkeys(scopes))
+        if not normalized_scopes:
+            raise ApiKeyServiceError("At least one valid scope is required")
+        return normalized_scopes
+
+    @staticmethod
+    def _resolve_expires_at(expires_in_days: Any) -> datetime | None:
+        if expires_in_days is None:
+            return None
+        try:
+            expires_in_days_int = int(expires_in_days)
+        except (TypeError, ValueError) as exc:
+            raise ApiKeyServiceError("expires_in_days must be an integer") from exc
+        if expires_in_days_int <= 0:
+            raise ApiKeyServiceError("expires_in_days must be greater than 0")
+        return datetime.now(timezone.utc) + timedelta(days=expires_in_days_int)
+
+    async def list_api_keys(self) -> list[dict]:
+        keys = await self.db.list_api_keys()
+        return [self.serialize_api_key(key) for key in keys]
+
+    async def create_api_key(self, payload: dict, *, created_by: str) -> dict:
+        name = str(payload.get("name", "")).strip() or "Untitled API Key"
+        scopes = self._normalize_scopes(payload.get("scopes"))
+        expires_at = self._resolve_expires_at(payload.get("expires_in_days"))
+
+        raw_key = f"abk_{secrets.token_urlsafe(32)}"
+        api_key = await self.db.create_api_key(
+            name=name,
+            key_hash=self.hash_key(raw_key),
+            key_prefix=raw_key[:12],
+            scopes=scopes,  # type: ignore
+            created_by=created_by,
+            expires_at=expires_at,
+        )
+
+        result = self.serialize_api_key(api_key)
+        result["api_key"] = raw_key
+        return result
+
+    async def revoke_api_key(self, key_id: str | None) -> bool:
+        if not key_id:
+            raise ApiKeyServiceError("Missing key: key_id")
+        return await self.db.revoke_api_key(key_id)
+
+    async def delete_api_key(self, key_id: str | None) -> bool:
+        if not key_id:
+            raise ApiKeyServiceError("Missing key: key_id")
+        return await self.db.delete_api_key(key_id)
diff --git a/astrbot/dashboard/routes/auth.py b/astrbot/dashboard/services/auth_service.py
similarity index 50%
rename from astrbot/dashboard/routes/auth.py
rename to astrbot/dashboard/services/auth_service.py
index 70747a8a2..d02b602ad 100644
--- a/astrbot/dashboard/routes/auth.py
+++ b/astrbot/dashboard/services/auth_service.py
@@ -1,22 +1,30 @@
+from __future__ import annotations
+
 import asyncio
 import datetime
 import os
+from dataclasses import dataclass
 
 import jwt
 import pyotp
-from quart import current_app, g, jsonify, make_response, request
 
 from astrbot import logger
 from astrbot.core import DEMO_MODE
+from astrbot.core.config.astrbot_config import AstrBotConfig
+from astrbot.core.db import BaseDatabase
 from astrbot.core.utils.auth_password import (
     is_default_dashboard_password,
-    is_legacy_dashboard_password,
+    is_md5_dashboard_password,
     validate_dashboard_password,
     verify_dashboard_password,
 )
 from astrbot.core.utils.totp import (
-    TOTP_TRUSTED_DEVICE_COOKIE_NAME,
-    TOTP_TRUSTED_DEVICE_MAX_AGE,
+    TOTP_TRUSTED_DEVICE_COOKIE_NAME as _TOTP_TRUSTED_DEVICE_COOKIE_NAME,
+)
+from astrbot.core.utils.totp import (
+    TOTP_TRUSTED_DEVICE_MAX_AGE as _TOTP_TRUSTED_DEVICE_MAX_AGE,
+)
+from astrbot.core.utils.totp import (
     TwoFactorCodeType,
     consume_configured_totp_code,
     consume_rotation_verified,
@@ -39,12 +47,26 @@ from astrbot.dashboard.password_state import (
     set_password_storage_upgraded,
 )
 
-from .route import Response, Route, RouteContext
+ALL_OPEN_API_SCOPES = (
+    "bot",
+    "provider",
+    "persona",
+    "im",
+    "config",
+    "chat",
+    "plugin",
+    "mcp",
+    "skill",
+)
+
+OPEN_API_SCOPE_INCLUDES = {
+    "config": ("bot", "provider"),
+}
 
 DASHBOARD_JWT_COOKIE_NAME = "astrbot_dashboard_jwt"
 DASHBOARD_JWT_COOKIE_MAX_AGE = 7 * 24 * 60 * 60
 SKIP_DEFAULT_PASSWORD_AUTH_ENV = "ASTRBOT_DASHBOARD_SKIP_DEFAULT_PASSWORD_AUTH"
-SKIP_DEFAULT_PASSWORD_AUTH_ENV_LEGACY = "DASHBOARD_SKIP_DEFAULT_PASSWORD_AUTH"
+SKIP_DEFAULT_PASSWORD_AUTH_ENV_OLD = "DASHBOARD_SKIP_DEFAULT_PASSWORD_AUTH"
 LOCAL_DASHBOARD_HOSTS = {"127.0.0.1", "localhost", "::1"}
 DEFAULT_PASSWORD_LOGIN_FAILURE_MESSAGE = (
     "Login failed. If this is your first time using AstrBot, the old default "
@@ -55,81 +77,79 @@ DEFAULT_PASSWORD_LOGIN_FAILURE_MESSAGE = (
     "随机强密码。请使用日志中提供的的初始密码来登录。了解更多："
     "https://docs.astrbot.app/faq.html"
 )
-LEGACY_PASSWORD_LOGIN_FAILURE_MESSAGE = (
+MD5_PASSWORD_LOGIN_FAILURE_MESSAGE = (
     "Incorrect username or password. If you cannot log in after upgrading "
     "AstrBot even though the password is correct, see "
     "https://docs.astrbot.app/en/faq.html\n\n"
     "用户名或密码错误。如果你在升级 AstrBot 后遇到了密码正确但无法登录的情况，"
     "请参考 https://docs.astrbot.app/faq.html"
 )
+TOTP_TRUSTED_DEVICE_COOKIE_NAME = _TOTP_TRUSTED_DEVICE_COOKIE_NAME
+TOTP_TRUSTED_DEVICE_MAX_AGE = _TOTP_TRUSTED_DEVICE_MAX_AGE
 
 
-class AuthRoute(Route):
-    def __init__(self, context: RouteContext, db) -> None:
-        super().__init__(context)
+@dataclass
+class AuthServiceResult:
+    status: str = "ok"
+    data: dict | None = None
+    message: str | None = None
+    status_code: int = 200
+    jwt_token: str | None = None
+    trusted_device_token: str | None = None
+
+
+class AuthService:
+    def __init__(
+        self,
+        db: BaseDatabase,
+        config: AstrBotConfig,
+        *,
+        demo_mode: bool = DEMO_MODE,
+    ) -> None:
         self.db = db
-        self.routes = {
-            "/auth/login": ("POST", self.login),
-            "/auth/logout": ("POST", self.logout),
-            "/auth/setup-status": ("GET", self.setup_status),
-            "/auth/setup": ("POST", self.setup),
-            "/auth/setup-authenticated": ("POST", self.setup_authenticated),
-            "/auth/totp/setup": ("POST", self.totp_setup),
-            "/auth/totp/recovery": ("POST", self.totp_recovery),
-            "/auth/account/edit": ("POST", self.edit_account),
-        }
-        self.register_routes()
+        self.config = config
+        self.demo_mode = demo_mode
 
-    async def setup_status(self):
-        return (
-            Response()
-            .ok(
-                {
-                    "setup_required": await self._is_setup_required(),
-                    "skip_default_password_auth": self._can_skip_default_password_auth(),
-                    "password_upgrade_required": not await is_password_storage_upgraded(
-                        self.db,
-                        self.config,
-                    ),
-                }
-            )
-            .__dict__
+    async def setup_status(self) -> AuthServiceResult:
+        return AuthServiceResult(
+            data={
+                "setup_required": await self.is_setup_required(),
+                "skip_default_password_auth": self.can_skip_default_password_auth(),
+                "password_upgrade_required": not await is_password_storage_upgraded(
+                    self.db,
+                    self.config,
+                ),
+            }
         )
 
-    async def totp_setup(self):
-        post_data = await request.json
-
+    async def totp_setup(self, post_data: object) -> AuthServiceResult:
         if isinstance(post_data, dict) and post_data.get("secret"):
             secret = post_data["secret"]
             code = post_data.get("code")
             if not isinstance(secret, str) or not secret.strip():
-                return Response().error("Invalid request payload").__dict__
+                return self.error("Invalid request payload")
 
             if not isinstance(code, str) or not code.strip():
-                return Response().error("TOTP 验证码是必需的").__dict__
+                return self.error("TOTP 验证码是必需的")
             if not await consume_totp_code(secret, code):
-                return Response().error("TOTP 验证码无效").__dict__
+                return self.error("TOTP 验证码无效")
 
             if is_totp_enabled(self.config) and not consume_rotation_verified():
-                return Response().error("需要先验证当前 TOTP").__dict__
+                return self.error("需要先验证当前 TOTP")
 
             set_pending_totp_secret(secret)
             recovery_code, recovery_code_hash = generate_recovery_code()
-            return (
-                Response()
-                .ok(
-                    {
-                        "recovery_code": recovery_code,
-                        "recovery_code_hash": recovery_code_hash,
-                    },
-                    "TOTP verified",
-                )
-                .__dict__
+            return AuthServiceResult(
+                data={
+                    "recovery_code": recovery_code,
+                    "recovery_code_hash": recovery_code_hash,
+                },
+                message="TOTP verified",
             )
 
         if is_totp_enabled(self.config):
             if not isinstance(post_data, dict):
-                return Response().error("Invalid request payload").__dict__
+                return self.error("Invalid request payload")
 
             set_rotation_verified(False)
 
@@ -137,62 +157,60 @@ class AuthRoute(Route):
             if isinstance(code, str) and code.strip():
                 if await consume_configured_totp_code(self.config, code):
                     set_rotation_verified(True)
-                    return Response().ok({"secret": pyotp.random_base32()}).__dict__
-                return Response().error("当前 TOTP 验证码无效").__dict__
+                    return AuthServiceResult(data={"secret": pyotp.random_base32()})
+                return self.error("当前 TOTP 验证码无效")
 
-            return Response().error("需要提供 TOTP 验证码或新密钥").__dict__
+            return self.error("需要提供 TOTP 验证码或新密钥")
 
-        return Response().ok({"secret": pyotp.random_base32()}).__dict__
+        return AuthServiceResult(data={"secret": pyotp.random_base32()})
 
-    async def totp_recovery(self):
-        # This endpoint MUST NOT persist the recovery code.
+    async def totp_recovery(self) -> AuthServiceResult:
         recovery_code, recovery_code_hash = generate_recovery_code()
-        return (
-            Response()
-            .ok(
-                {
-                    "recovery_code": recovery_code,
-                    "recovery_code_hash": recovery_code_hash,
-                }
-            )
-            .__dict__
+        return AuthServiceResult(
+            data={
+                "recovery_code": recovery_code,
+                "recovery_code_hash": recovery_code_hash,
+            }
         )
 
-    async def setup(self):
-        if not self._can_skip_default_password_auth():
-            return Response().error("Setup without password is not enabled").__dict__
-        if not await self._is_setup_required():
-            return Response().error("Setup is not required").__dict__
+    async def setup(self, post_data: object) -> AuthServiceResult:
+        if not self.can_skip_default_password_auth():
+            return self.error("Setup without password is not enabled")
+        if not await self.is_setup_required():
+            return self.error("Setup is not required")
 
-        return await self._complete_setup()
+        return await self.complete_setup(post_data)
 
-    async def setup_authenticated(self):
-        if not await self._is_setup_required():
-            return Response().error("Setup is not required").__dict__
-        if not isinstance(getattr(g, "username", None), str):
-            return Response().error("未授权").__dict__
+    async def setup_authenticated(
+        self,
+        post_data: object,
+        authenticated_username,
+    ) -> AuthServiceResult:
+        if not await self.is_setup_required():
+            return self.error("Setup is not required")
+        if not isinstance(authenticated_username, str):
+            return self.error("未授权")
 
-        return await self._complete_setup()
+        return await self.complete_setup(post_data)
 
-    async def _complete_setup(self):
-        post_data = await request.json
+    async def complete_setup(self, post_data: object) -> AuthServiceResult:
         if not isinstance(post_data, dict):
-            return Response().error("Invalid request payload").__dict__
+            return self.error("Invalid request payload")
 
         new_username = post_data.get("username")
         new_password = post_data.get("password")
         confirm_password = post_data.get("confirm_password")
         if not isinstance(new_username, str) or len(new_username.strip()) < 3:
-            return Response().error("用户名长度至少3位").__dict__
+            return self.error("用户名长度至少3位")
         if not isinstance(new_password, str):
-            return Response().error("新密码无效").__dict__
+            return self.error("新密码无效")
         if not isinstance(confirm_password, str) or confirm_password != new_password:
-            return Response().error("两次输入的新密码不一致").__dict__
+            return self.error("两次输入的新密码不一致")
 
         try:
             validate_dashboard_password(new_password)
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
+        except ValueError as exc:
+            return self.error(str(exc))
 
         username = new_username.strip()
         self.config["dashboard"]["username"] = username
@@ -202,25 +220,27 @@ class AuthRoute(Route):
         self.config.save_config()
 
         token = self.generate_jwt(username)
-        payload = Response().ok(
-            {
+        return AuthServiceResult(
+            data={
                 "token": token,
                 "username": username,
                 "change_pwd_hint": False,
-                "legacy_pwd_hint": False,
+                "md5_pwd_hint": False,
                 "password_upgrade_required": False,
             },
-            "Setup completed successfully",
+            message="Setup completed successfully",
+            jwt_token=token,
         )
-        response = await make_response(jsonify(payload.__dict__))
-        self._set_dashboard_jwt_cookie(response, token)
-        return response
 
-    async def login(self):
+    async def login(
+        self,
+        post_data: object,
+        *,
+        trusted_device_cookie_token: str,
+    ) -> AuthServiceResult:
         username = self.config["dashboard"]["username"]
         storage_upgraded = await is_password_storage_upgraded(self.db, self.config)
         password = get_dashboard_password_hash(self.config, upgraded=storage_upgraded)
-        post_data = await request.json
 
         req_username = (
             post_data.get("username") if isinstance(post_data, dict) else None
@@ -235,46 +255,39 @@ class AuthRoute(Route):
             else False
         )
         if not isinstance(req_username, str) or not isinstance(req_password, str):
-            return Response().error("Invalid request payload").__dict__
+            return self.error("Invalid request payload")
 
         login_verified = req_username == username and verify_dashboard_password(
-            password, req_password
+            password,
+            req_password,
         )
 
         if not login_verified:
             await asyncio.sleep(3)
             if req_password == "astrbot":
-                return Response().error(DEFAULT_PASSWORD_LOGIN_FAILURE_MESSAGE).__dict__
-            if is_legacy_dashboard_password(password):
-                return Response().error(LEGACY_PASSWORD_LOGIN_FAILURE_MESSAGE).__dict__
-            return await self._error_response(
-                "用户名或密码错误",
-                401,
-            )
+                return self.error(DEFAULT_PASSWORD_LOGIN_FAILURE_MESSAGE)
+            if is_md5_dashboard_password(password):
+                return self.error(MD5_PASSWORD_LOGIN_FAILURE_MESSAGE)
+            return self.error("用户名或密码错误", status_code=401)
 
         totp_verified = False
 
         if is_totp_enabled(self.config):
-            cookie_token = request.cookies.get(
-                TOTP_TRUSTED_DEVICE_COOKIE_NAME, ""
-            ).strip()
             if not await is_totp_trusted_device_valid(
-                self.config, self.db, cookie_token
+                self.config,
+                self.db,
+                trusted_device_cookie_token,
             ):
                 if not isinstance(totp_code, str) or not totp_code.strip():
-                    response = await make_response(
-                        jsonify(
-                            {
-                                "status": "error",
-                                "message": "需要 TOTP 验证",
-                                "data": {"totp_required": True},
-                            }
-                        )
+                    return self.error(
+                        "需要 TOTP 验证",
+                        data={"totp_required": True},
+                        status_code=401,
                     )
-                    response.status_code = 401
-                    return response
                 verified_type = await verify_configured_2fa_code(
-                    self.config, totp_code, allow_recovery=True
+                    self.config,
+                    totp_code,
+                    allow_recovery=True,
                 )
                 if verified_type is TwoFactorCodeType.TOTP:
                     totp_verified = True
@@ -287,12 +300,12 @@ class AuthRoute(Route):
                     await revoke_user_trusted_devices(self.db)
                     self.config.save_config()
                 elif len(totp_code) == 6 and totp_code.isdigit():
-                    return await self._error_response("TOTP 验证码无效", 401)
+                    return self.error("TOTP 验证码无效", status_code=401)
                 else:
-                    return await self._error_response("恢复码无效", 401)
+                    return self.error("恢复码无效", status_code=401)
 
         change_pwd_hint = False
-        legacy_pwd_hint = is_legacy_dashboard_password(password)
+        md5_pwd_hint = is_md5_dashboard_password(password)
         password_change_required = await is_password_change_required(
             self.db,
             self.config,
@@ -301,66 +314,47 @@ class AuthRoute(Route):
             storage_upgraded
             and username == "astrbot"
             and is_default_dashboard_password(password)
-            and not DEMO_MODE
+            and not self.demo_mode
         ):
             change_pwd_hint = True
-            legacy_pwd_hint = True
+            md5_pwd_hint = True
             logger.warning("为了保证安全，请尽快修改默认密码。")
-        if password_change_required and not DEMO_MODE:
+        if password_change_required and not self.demo_mode:
             change_pwd_hint = True
         token = self.generate_jwt(username)
-        login_data = {
-            "token": token,
-            "username": username,
-            "change_pwd_hint": change_pwd_hint,
-            "legacy_pwd_hint": legacy_pwd_hint,
-            "password_upgrade_required": not storage_upgraded,
-        }
-        payload = Response().ok(login_data)
-        response = await make_response(jsonify(payload.__dict__))
-        self._set_dashboard_jwt_cookie(response, token)
+        result = AuthServiceResult(
+            data={
+                "token": token,
+                "username": username,
+                "change_pwd_hint": change_pwd_hint,
+                "md5_pwd_hint": md5_pwd_hint,
+                "password_upgrade_required": not storage_upgraded,
+            },
+            jwt_token=token,
+        )
 
         if totp_verified and trust_device_flag:
-            raw_token = await issue_totp_trusted_device(self.config, self.db)
-            if raw_token:
-                response.set_cookie(
-                    TOTP_TRUSTED_DEVICE_COOKIE_NAME,
-                    raw_token,
-                    max_age=TOTP_TRUSTED_DEVICE_MAX_AGE,
-                    httponly=True,
-                    samesite="Strict",
-                    secure=AuthRoute._use_secure_dashboard_jwt_cookie(),
-                    path="/api/auth",
-                )
-        return response
-
-    async def logout(self):
-        response = await make_response(
-            jsonify(Response().ok(None, "已退出登录").__dict__)
-        )
-        self._clear_dashboard_jwt_cookie(response)
-        return response
-
-    async def edit_account(self):
-        if DEMO_MODE:
-            return (
-                Response()
-                .error("You are not permitted to do this operation in demo mode")
-                .__dict__
+            result.trusted_device_token = await issue_totp_trusted_device(
+                self.config,
+                self.db,
             )
+        return result
+
+    async def edit_account(self, post_data: object) -> AuthServiceResult:
+        if self.demo_mode:
+            return self.error("You are not permitted to do this operation in demo mode")
 
         storage_upgraded = await is_password_storage_upgraded(self.db, self.config)
         password = get_dashboard_password_hash(self.config, upgraded=storage_upgraded)
-        post_data = await request.json
         if not isinstance(post_data, dict):
-            return Response().error("Invalid request payload").__dict__
+            return self.error("Invalid request payload")
 
         req_password = post_data.get("password")
         if not isinstance(req_password, str):
-            return Response().error("Invalid request payload").__dict__
+            return self.error("Invalid request payload")
 
         if not verify_dashboard_password(password, req_password):
-            return Response().error("原密码错误").__dict__
+            return self.error("原密码错误")
 
         new_pwd = post_data.get("new_password", None)
         new_username = post_data.get("new_username", None)
@@ -369,21 +363,20 @@ class AuthRoute(Route):
             self.config,
         )
         if (not storage_upgraded or password_change_required) and not new_pwd:
-            return Response().error("请设置新密码以完成安全升级").__dict__
+            return self.error("请设置新密码以完成安全升级")
         if not new_pwd and not new_username:
-            return Response().error("新用户名和新密码不能同时为空").__dict__
+            return self.error("新用户名和新密码不能同时为空")
 
-        # Verify password confirmation
         if new_pwd:
             if not isinstance(new_pwd, str):
-                return Response().error("新密码无效").__dict__
+                return self.error("新密码无效")
             confirm_pwd = post_data.get("confirm_password", None)
             if not isinstance(confirm_pwd, str) or confirm_pwd != new_pwd:
-                return Response().error("两次输入的新密码不一致").__dict__
+                return self.error("两次输入的新密码不一致")
             try:
                 validate_dashboard_password(new_pwd)
-            except ValueError as e:
-                return Response().error(str(e)).__dict__
+            except ValueError as exc:
+                return self.error(str(exc))
             set_dashboard_password_hashes(self.config, new_pwd)
             await set_password_storage_upgraded(self.db, self.config, True)
             await set_password_change_required(self.db, self.config, False)
@@ -394,9 +387,9 @@ class AuthRoute(Route):
 
         self.config.save_config()
 
-        return Response().ok(None, "Updated account successfully").__dict__
+        return AuthServiceResult(message="Updated account successfully")
 
-    def generate_jwt(self, username):
+    def generate_jwt(self, username: str):
         payload = {
             "username": username,
             "exp": datetime.datetime.now(datetime.timezone.utc)
@@ -405,11 +398,10 @@ class AuthRoute(Route):
         jwt_token = self.config["dashboard"].get("jwt_secret", None)
         if not jwt_token:
             raise ValueError("JWT secret is not set in the cmd_config.")
-        token = jwt.encode(payload, jwt_token, algorithm="HS256")
-        return token
+        return jwt.encode(payload, jwt_token, algorithm="HS256")
 
-    async def _is_setup_required(self) -> bool:
-        if DEMO_MODE:
+    async def is_setup_required(self) -> bool:
+        if self.demo_mode:
             return False
 
         dashboard_config = self.config["dashboard"]
@@ -430,14 +422,8 @@ class AuthRoute(Route):
             dashboard_config.get("pbkdf2_password", "")
         )
 
-    @staticmethod
-    async def _error_response(message: str, status_code: int):
-        response = await make_response(jsonify(Response().error(message).__dict__))
-        response.status_code = status_code
-        return response
-
-    def _can_skip_default_password_auth(self) -> bool:
-        if not self._env_flag_enabled(SKIP_DEFAULT_PASSWORD_AUTH_ENV):
+    def can_skip_default_password_auth(self) -> bool:
+        if not self.env_flag_enabled(SKIP_DEFAULT_PASSWORD_AUTH_ENV):
             return False
         host = (
             os.environ.get("DASHBOARD_HOST")
@@ -447,39 +433,22 @@ class AuthRoute(Route):
         return str(host).strip().lower() in LOCAL_DASHBOARD_HOSTS
 
     @staticmethod
-    def _env_flag_enabled(name: str) -> bool:
+    def env_flag_enabled(name: str) -> bool:
         value = os.environ.get(name)
         if value is None and name == SKIP_DEFAULT_PASSWORD_AUTH_ENV:
-            value = os.environ.get(SKIP_DEFAULT_PASSWORD_AUTH_ENV_LEGACY)
+            value = os.environ.get(SKIP_DEFAULT_PASSWORD_AUTH_ENV_OLD)
         return str(value or "").strip().lower() in {"1", "true", "yes", "on"}
 
     @staticmethod
-    def _use_secure_dashboard_jwt_cookie() -> bool:
-        return bool(
-            current_app.config.get(
-                "DASHBOARD_JWT_COOKIE_SECURE",
-                not current_app.debug and not current_app.testing,
-            )
-        )
-
-    @staticmethod
-    def _set_dashboard_jwt_cookie(response, token: str) -> None:
-        response.set_cookie(
-            DASHBOARD_JWT_COOKIE_NAME,
-            token,
-            max_age=DASHBOARD_JWT_COOKIE_MAX_AGE,
-            httponly=True,
-            samesite="Strict",
-            secure=AuthRoute._use_secure_dashboard_jwt_cookie(),
-            path="/",
-        )
-
-    @staticmethod
-    def _clear_dashboard_jwt_cookie(response) -> None:
-        response.delete_cookie(
-            DASHBOARD_JWT_COOKIE_NAME,
-            httponly=True,
-            samesite="Strict",
-            secure=AuthRoute._use_secure_dashboard_jwt_cookie(),
-            path="/",
+    def error(
+        message: str,
+        *,
+        data: dict | None = None,
+        status_code: int = 200,
+    ) -> AuthServiceResult:
+        return AuthServiceResult(
+            status="error",
+            data=data,
+            message=message,
+            status_code=status_code,
         )
diff --git a/astrbot/dashboard/services/backup_service.py b/astrbot/dashboard/services/backup_service.py
new file mode 100644
index 000000000..fd5353dab
--- /dev/null
+++ b/astrbot/dashboard/services/backup_service.py
@@ -0,0 +1,665 @@
+from __future__ import annotations
+
+import asyncio
+import json
+import math
+import os
+import re
+import shutil
+import time
+import traceback
+import uuid
+import zipfile
+from dataclasses import dataclass
+from datetime import datetime
+from pathlib import Path
+from typing import Any
+
+import jwt
+
+from astrbot.core import logger
+from astrbot.core.backup.exporter import AstrBotExporter
+from astrbot.core.backup.importer import AstrBotImporter
+from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
+from astrbot.core.db import BaseDatabase
+from astrbot.core.utils.astrbot_path import (
+    get_astrbot_backups_path,
+    get_astrbot_data_path,
+)
+
+CHUNK_SIZE = 1024 * 1024
+UPLOAD_EXPIRE_SECONDS = 3600
+
+
+class BackupServiceError(Exception):
+    pass
+
+
+@dataclass
+class BackupDownload:
+    path: str
+    filename: str
+
+
+def secure_filename(filename: str) -> str:
+    filename = filename.replace("\\", "/")
+    filename = os.path.basename(filename)
+    filename = filename.replace("..", "_")
+    filename = re.sub(r"[^\w\-.]", "_", filename)
+    filename = filename.strip(".")
+    if not filename or filename.replace("_", "") == "":
+        filename = "backup"
+    return filename
+
+
+def generate_unique_filename(original_filename: str) -> str:
+    name, ext = os.path.splitext(original_filename)
+    timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
+    return f"{name}_{timestamp}{ext}"
+
+
+class BackupService:
+    def __init__(
+        self,
+        db: BaseDatabase,
+        core_lifecycle: AstrBotCoreLifecycle,
+    ) -> None:
+        self.db = db
+        self.core_lifecycle = core_lifecycle
+        self.config = core_lifecycle.astrbot_config
+        self.backup_dir = get_astrbot_backups_path()
+        self.data_dir = get_astrbot_data_path()
+        self.chunks_dir = os.path.join(self.backup_dir, ".chunks")
+        self.backup_tasks: dict[str, dict] = {}
+        self.backup_progress: dict[str, dict] = {}
+        self.upload_sessions: dict[str, dict] = {}
+        self._cleanup_task: asyncio.Task | None = None
+
+    @staticmethod
+    def _payload(data: object) -> dict[str, Any]:
+        return data if isinstance(data, dict) else {}
+
+    @staticmethod
+    async def _save_upload(file: Any, target_path: str) -> None:
+        if hasattr(file, "save"):
+            result = file.save(target_path)
+            if hasattr(result, "__await__"):
+                await result
+            return
+
+        if hasattr(file, "read"):
+            data = file.read()
+            if hasattr(data, "__await__"):
+                data = await data
+            Path(target_path).write_bytes(data)
+            return
+
+        raise BackupServiceError("无效的上传文件")
+
+    @staticmethod
+    def _validate_backup_filename(filename: str | None, *, missing: str) -> str:
+        if not filename:
+            raise BackupServiceError(missing)
+        if ".." in filename or "/" in filename or "\\" in filename:
+            raise BackupServiceError("无效的文件名")
+        return filename
+
+    def _init_task(self, task_id: str, task_type: str, status: str = "pending") -> None:
+        self.backup_tasks[task_id] = {
+            "type": task_type,
+            "status": status,
+            "result": None,
+            "error": None,
+        }
+        self.backup_progress[task_id] = {
+            "status": status,
+            "stage": "waiting",
+            "current": 0,
+            "total": 100,
+            "message": "",
+        }
+
+    def _set_task_result(
+        self,
+        task_id: str,
+        status: str,
+        result: dict | None = None,
+        error: str | None = None,
+    ) -> None:
+        if task_id in self.backup_tasks:
+            self.backup_tasks[task_id]["status"] = status
+            self.backup_tasks[task_id]["result"] = result
+            self.backup_tasks[task_id]["error"] = error
+        if task_id in self.backup_progress:
+            self.backup_progress[task_id]["status"] = status
+
+    def _update_progress(
+        self,
+        task_id: str,
+        *,
+        status: str | None = None,
+        stage: str | None = None,
+        current: int | None = None,
+        total: int | None = None,
+        message: str | None = None,
+    ) -> None:
+        if task_id not in self.backup_progress:
+            return
+        progress = self.backup_progress[task_id]
+        if status is not None:
+            progress["status"] = status
+        if stage is not None:
+            progress["stage"] = stage
+        if current is not None:
+            progress["current"] = current
+        if total is not None:
+            progress["total"] = total
+        if message is not None:
+            progress["message"] = message
+
+    def _make_progress_callback(self, task_id: str):
+        async def _callback(
+            stage: str,
+            current: int,
+            total: int,
+            message: str = "",
+        ) -> None:
+            self._update_progress(
+                task_id,
+                status="processing",
+                stage=stage,
+                current=current,
+                total=total,
+                message=message,
+            )
+
+        return _callback
+
+    def ensure_cleanup_task_started(self) -> None:
+        if self._cleanup_task is None or self._cleanup_task.done():
+            try:
+                self._cleanup_task = asyncio.create_task(
+                    self._cleanup_expired_uploads()
+                )
+            except RuntimeError:
+                pass
+
+    async def _cleanup_expired_uploads(self) -> None:
+        while True:
+            try:
+                await asyncio.sleep(300)
+                current_time = time.time()
+                expired_sessions = []
+
+                for upload_id, session in self.upload_sessions.items():
+                    last_activity = session.get("last_activity", session["created_at"])
+                    if current_time - last_activity > UPLOAD_EXPIRE_SECONDS:
+                        expired_sessions.append(upload_id)
+
+                for upload_id in expired_sessions:
+                    await self.cleanup_upload_session(upload_id)
+                    logger.info(f"清理过期的上传会话: {upload_id}")
+
+            except asyncio.CancelledError:
+                break
+            except Exception as exc:
+                logger.error(f"清理过期上传会话失败: {exc}")
+
+    async def cleanup_upload_session(self, upload_id: str) -> None:
+        if upload_id in self.upload_sessions:
+            session = self.upload_sessions[upload_id]
+            chunk_dir = session.get("chunk_dir")
+            if chunk_dir and os.path.exists(chunk_dir):
+                try:
+                    shutil.rmtree(chunk_dir)
+                except Exception as exc:
+                    logger.warning(f"清理分片目录失败: {exc}")
+            del self.upload_sessions[upload_id]
+
+    def get_backup_manifest(self, zip_path: str) -> dict | None:
+        try:
+            with zipfile.ZipFile(zip_path, "r") as zf:
+                if "manifest.json" in zf.namelist():
+                    manifest_data = zf.read("manifest.json")
+                    return json.loads(manifest_data.decode("utf-8"))
+                return None
+        except Exception as exc:
+            logger.debug(f"读取备份 manifest 失败: {exc}")
+        return None
+
+    def list_backups(self, *, page: int, page_size: int) -> dict:
+        self.ensure_cleanup_task_started()
+        Path(self.backup_dir).mkdir(parents=True, exist_ok=True)
+
+        backup_files = []
+        for filename in os.listdir(self.backup_dir):
+            if not filename.endswith(".zip") or filename.startswith("."):
+                continue
+
+            file_path = os.path.join(self.backup_dir, filename)
+            if not os.path.isfile(file_path):
+                continue
+
+            manifest = self.get_backup_manifest(file_path)
+            if manifest is None:
+                logger.debug(f"跳过无效备份文件: {filename}")
+                continue
+
+            stat = os.stat(file_path)
+            backup_files.append(
+                {
+                    "filename": filename,
+                    "size": stat.st_size,
+                    "created_at": stat.st_mtime,
+                    "type": manifest.get("origin", "exported"),
+                    "astrbot_version": manifest.get("astrbot_version", "未知"),
+                    "exported_at": manifest.get("exported_at"),
+                }
+            )
+
+        backup_files.sort(key=lambda x: x["created_at"], reverse=True)
+        start = (page - 1) * page_size
+        end = start + page_size
+
+        return {
+            "items": backup_files[start:end],
+            "total": len(backup_files),
+            "page": page,
+            "page_size": page_size,
+        }
+
+    def export_backup(self) -> dict:
+        task_id = str(uuid.uuid4())
+        self._init_task(task_id, "export", "pending")
+        asyncio.create_task(self.background_export_task(task_id))
+        return {
+            "task_id": task_id,
+            "message": "export task created, processing in background",
+        }
+
+    async def background_export_task(self, task_id: str) -> None:
+        try:
+            self._update_progress(task_id, status="processing", message="正在初始化...")
+            kb_manager = getattr(self.core_lifecycle, "kb_manager", None)
+            exporter = AstrBotExporter(
+                main_db=self.db,
+                kb_manager=kb_manager,
+                config_path=os.path.join(self.data_dir, "cmd_config.json"),
+            )
+            zip_path = await exporter.export_all(
+                output_dir=self.backup_dir,
+                progress_callback=self._make_progress_callback(task_id),
+            )
+            self._set_task_result(
+                task_id,
+                "completed",
+                result={
+                    "filename": os.path.basename(zip_path),
+                    "path": zip_path,
+                    "size": os.path.getsize(zip_path),
+                },
+            )
+        except Exception as exc:
+            logger.error(f"后台导出任务 {task_id} 失败: {exc}")
+            logger.error(traceback.format_exc())
+            self._set_task_result(task_id, "failed", error=str(exc))
+
+    async def upload_backup(self, file: Any | None) -> dict:
+        if not file:
+            raise BackupServiceError("缺少备份文件")
+        if not file.filename or not file.filename.endswith(".zip"):
+            raise BackupServiceError("请上传 ZIP 格式的备份文件")
+
+        safe_filename = secure_filename(file.filename)
+        unique_filename = generate_unique_filename(safe_filename)
+
+        Path(self.backup_dir).mkdir(parents=True, exist_ok=True)
+        zip_path = os.path.join(self.backup_dir, unique_filename)
+        await self._save_upload(file, zip_path)
+
+        logger.info(
+            f"上传的备份文件已保存: {unique_filename} (原始名称: {file.filename})"
+        )
+        return {
+            "filename": unique_filename,
+            "original_filename": file.filename,
+            "size": os.path.getsize(zip_path),
+        }
+
+    def upload_init(self, data: object) -> dict:
+        payload = self._payload(data)
+        filename = payload.get("filename")
+        total_size = payload.get("total_size", 0)
+
+        if not filename:
+            raise BackupServiceError("缺少 filename 参数")
+        if not filename.endswith(".zip"):
+            raise BackupServiceError("请上传 ZIP 格式的备份文件")
+        if total_size <= 0:
+            raise BackupServiceError("无效的文件大小")
+
+        total_chunks = math.ceil(total_size / CHUNK_SIZE)
+        upload_id = str(uuid.uuid4())
+        chunk_dir = os.path.join(self.chunks_dir, upload_id)
+        Path(chunk_dir).mkdir(parents=True, exist_ok=True)
+
+        safe_filename = secure_filename(filename)
+        unique_filename = generate_unique_filename(safe_filename)
+        current_time = time.time()
+        self.upload_sessions[upload_id] = {
+            "filename": unique_filename,
+            "original_filename": filename,
+            "total_size": total_size,
+            "total_chunks": total_chunks,
+            "received_chunks": set(),
+            "created_at": current_time,
+            "last_activity": current_time,
+            "chunk_dir": chunk_dir,
+        }
+
+        logger.info(
+            f"初始化分片上传: upload_id={upload_id}, "
+            f"filename={unique_filename}, total_chunks={total_chunks}"
+        )
+
+        return {
+            "upload_id": upload_id,
+            "chunk_size": CHUNK_SIZE,
+            "total_chunks": total_chunks,
+            "filename": unique_filename,
+        }
+
+    async def upload_chunk(
+        self,
+        *,
+        upload_id: str | None,
+        chunk_index_str: str | None,
+        chunk_file: Any | None,
+    ) -> dict:
+        if not upload_id or chunk_index_str is None:
+            raise BackupServiceError("缺少必要参数")
+
+        try:
+            chunk_index = int(chunk_index_str)
+        except ValueError as exc:
+            raise BackupServiceError("无效的分片索引") from exc
+
+        if not chunk_file:
+            raise BackupServiceError("缺少分片数据")
+        if upload_id not in self.upload_sessions:
+            raise BackupServiceError("上传会话不存在或已过期")
+
+        session = self.upload_sessions[upload_id]
+        if chunk_index < 0 or chunk_index >= session["total_chunks"]:
+            raise BackupServiceError("分片索引超出范围")
+
+        chunk_path = os.path.join(session["chunk_dir"], f"{chunk_index}.part")
+        await self._save_upload(chunk_file, chunk_path)
+        session["received_chunks"].add(chunk_index)
+        session["last_activity"] = time.time()
+
+        received_count = len(session["received_chunks"])
+        total_chunks = session["total_chunks"]
+        logger.debug(
+            f"接收分片: upload_id={upload_id}, chunk={chunk_index + 1}/{total_chunks}"
+        )
+
+        return {
+            "received": received_count,
+            "total": total_chunks,
+            "chunk_index": chunk_index,
+        }
+
+    def mark_backup_as_uploaded(self, zip_path: str) -> None:
+        try:
+            manifest = {"origin": "uploaded", "uploaded_at": datetime.now().isoformat()}
+            with zipfile.ZipFile(zip_path, "r") as zf:
+                if "manifest.json" in zf.namelist():
+                    manifest_data = zf.read("manifest.json")
+                    manifest = json.loads(manifest_data.decode("utf-8"))
+                    manifest["origin"] = "uploaded"
+                    manifest["uploaded_at"] = datetime.now().isoformat()
+
+            with zipfile.ZipFile(zip_path, "a") as zf:
+                new_manifest = json.dumps(manifest, ensure_ascii=False, indent=2)
+                zf.writestr("manifest.json", new_manifest)
+
+            logger.debug(f"已标记备份为上传来源: {zip_path}")
+        except Exception as exc:
+            logger.warning(f"标记备份来源失败: {exc}")
+
+    async def upload_complete(self, data: object) -> dict:
+        payload = self._payload(data)
+        upload_id = payload.get("upload_id")
+
+        if not upload_id:
+            raise BackupServiceError("缺少 upload_id 参数")
+        if upload_id not in self.upload_sessions:
+            raise BackupServiceError("上传会话不存在或已过期")
+
+        session = self.upload_sessions[upload_id]
+        received = session["received_chunks"]
+        total = session["total_chunks"]
+
+        if len(received) != total:
+            missing = set(range(total)) - received
+            raise BackupServiceError(f"分片不完整，缺少: {sorted(missing)[:10]}...")
+
+        chunk_dir = session["chunk_dir"]
+        filename = session["filename"]
+
+        Path(self.backup_dir).mkdir(parents=True, exist_ok=True)
+        output_path = os.path.join(self.backup_dir, filename)
+
+        try:
+            with open(output_path, "wb") as outfile:
+                for i in range(total):
+                    chunk_path = os.path.join(chunk_dir, f"{i}.part")
+                    with open(chunk_path, "rb") as chunk_file:
+                        while True:
+                            data_block = chunk_file.read(8192)
+                            if not data_block:
+                                break
+                            outfile.write(data_block)
+
+            file_size = os.path.getsize(output_path)
+            self.mark_backup_as_uploaded(output_path)
+            logger.info(f"分片上传完成: {filename}, size={file_size}, chunks={total}")
+            await self.cleanup_upload_session(upload_id)
+
+            return {
+                "filename": filename,
+                "original_filename": session["original_filename"],
+                "size": file_size,
+            }
+        except Exception:
+            if os.path.exists(output_path):
+                os.remove(output_path)
+            raise
+
+    async def upload_abort(self, data: object) -> tuple[dict | None, str | None]:
+        payload = self._payload(data)
+        upload_id = payload.get("upload_id")
+        if not upload_id:
+            raise BackupServiceError("缺少 upload_id 参数")
+
+        if upload_id in self.upload_sessions:
+            await self.cleanup_upload_session(upload_id)
+            logger.info(f"取消分片上传: {upload_id}")
+
+        return None, "上传已取消"
+
+    def check_backup(self, data: object) -> dict:
+        payload = self._payload(data)
+        filename = self._validate_backup_filename(
+            payload.get("filename"),
+            missing="缺少 filename 参数",
+        )
+        zip_path = os.path.join(self.backup_dir, filename)
+        if not os.path.exists(zip_path):
+            raise BackupServiceError(f"备份文件不存在: {filename}")
+
+        kb_manager = getattr(self.core_lifecycle, "kb_manager", None)
+        importer = AstrBotImporter(
+            main_db=self.db,
+            kb_manager=kb_manager,
+            config_path=os.path.join(self.data_dir, "cmd_config.json"),
+        )
+        return importer.pre_check(zip_path).to_dict()
+
+    def import_backup(self, data: object) -> dict:
+        payload = self._payload(data)
+        filename = self._validate_backup_filename(
+            payload.get("filename"),
+            missing="缺少 filename 参数",
+        )
+        confirmed = payload.get("confirmed", False)
+        if not confirmed:
+            raise BackupServiceError(
+                "请先确认导入。导入将会清空并覆盖现有数据，此操作不可撤销。"
+            )
+
+        zip_path = os.path.join(self.backup_dir, filename)
+        if not os.path.exists(zip_path):
+            raise BackupServiceError(f"备份文件不存在: {filename}")
+
+        task_id = str(uuid.uuid4())
+        self._init_task(task_id, "import", "pending")
+        asyncio.create_task(self.background_import_task(task_id, zip_path))
+
+        return {
+            "task_id": task_id,
+            "message": "import task created, processing in background",
+        }
+
+    async def background_import_task(self, task_id: str, zip_path: str) -> None:
+        try:
+            self._update_progress(task_id, status="processing", message="正在初始化...")
+            kb_manager = getattr(self.core_lifecycle, "kb_manager", None)
+            importer = AstrBotImporter(
+                main_db=self.db,
+                kb_manager=kb_manager,
+                config_path=os.path.join(self.data_dir, "cmd_config.json"),
+            )
+            result = await importer.import_all(
+                zip_path=zip_path,
+                mode="replace",
+                progress_callback=self._make_progress_callback(task_id),
+            )
+
+            if result.success:
+                self._set_task_result(task_id, "completed", result=result.to_dict())
+            else:
+                self._set_task_result(
+                    task_id,
+                    "failed",
+                    error="; ".join(result.errors),
+                )
+        except Exception as exc:
+            logger.error(f"后台导入任务 {task_id} 失败: {exc}")
+            logger.error(traceback.format_exc())
+            self._set_task_result(task_id, "failed", error=str(exc))
+
+    def get_progress(self, task_id: str | None) -> dict:
+        if not task_id:
+            raise BackupServiceError("缺少参数 task_id")
+        if task_id not in self.backup_tasks:
+            raise BackupServiceError("找不到该任务")
+
+        task_info = self.backup_tasks[task_id]
+        status = task_info["status"]
+        response_data = {
+            "task_id": task_id,
+            "type": task_info["type"],
+            "status": status,
+        }
+
+        if status == "processing" and task_id in self.backup_progress:
+            response_data["progress"] = self.backup_progress[task_id]
+        if status == "completed":
+            response_data["result"] = task_info["result"]
+        if status == "failed":
+            response_data["error"] = task_info["error"]
+
+        return response_data
+
+    def prepare_download(
+        self,
+        *,
+        filename: str | None,
+        token: str | None,
+        jwt_secret: str | None,
+    ) -> BackupDownload:
+        if not filename:
+            raise BackupServiceError("缺少参数 filename")
+        if not token:
+            raise BackupServiceError("缺少参数 token")
+        if not jwt_secret:
+            raise BackupServiceError("服务器配置错误")
+
+        try:
+            jwt.decode(
+                token,
+                jwt_secret,
+                algorithms=["HS256"],
+                options={
+                    "require": ["exp"],
+                    "verify_signature": True,
+                    "verify_exp": True,
+                },
+            )
+        except jwt.ExpiredSignatureError as exc:
+            raise BackupServiceError("Token 已过期，请刷新页面后重试") from exc
+        except jwt.InvalidTokenError as exc:
+            raise BackupServiceError("Token 无效") from exc
+
+        filename = self._validate_backup_filename(filename, missing="缺少参数 filename")
+        file_path = os.path.join(self.backup_dir, filename)
+        if not os.path.exists(file_path):
+            raise BackupServiceError("备份文件不存在")
+        return BackupDownload(path=file_path, filename=filename)
+
+    def delete_backup(self, data: object) -> tuple[dict | None, str | None]:
+        payload = self._payload(data)
+        filename = self._validate_backup_filename(
+            payload.get("filename"),
+            missing="缺少参数 filename",
+        )
+        file_path = os.path.join(self.backup_dir, filename)
+        if not os.path.exists(file_path):
+            raise BackupServiceError("备份文件不存在")
+
+        os.remove(file_path)
+        return None, "删除备份成功"
+
+    def rename_backup(self, data: object) -> dict:
+        payload = self._payload(data)
+        filename = self._validate_backup_filename(
+            payload.get("filename"),
+            missing="缺少参数 filename",
+        )
+        new_name = payload.get("new_name")
+        if not new_name:
+            raise BackupServiceError("缺少参数 new_name")
+
+        new_name = secure_filename(new_name)
+        if new_name.endswith(".zip"):
+            new_name = new_name[:-4]
+        if not new_name or new_name.replace("_", "") == "":
+            raise BackupServiceError("新文件名无效")
+
+        new_filename = f"{new_name}.zip"
+        old_path = os.path.join(self.backup_dir, filename)
+        if not os.path.exists(old_path):
+            raise BackupServiceError("备份文件不存在")
+
+        new_path = os.path.join(self.backup_dir, new_filename)
+        if os.path.exists(new_path):
+            raise BackupServiceError(f"文件名 '{new_filename}' 已存在")
+
+        os.rename(old_path, new_path)
+        logger.info(f"备份文件重命名: {filename} -> {new_filename}")
+        return {
+            "old_filename": filename,
+            "new_filename": new_filename,
+        }
diff --git a/astrbot/dashboard/routes/chat.py b/astrbot/dashboard/services/chat_service.py
similarity index 51%
rename from astrbot/dashboard/routes/chat.py
rename to astrbot/dashboard/services/chat_service.py
index 5ff1913b9..80bf6bbf3 100644
--- a/astrbot/dashboard/routes/chat.py
+++ b/astrbot/dashboard/services/chat_service.py
@@ -1,15 +1,15 @@
+from __future__ import annotations
+
 import asyncio
 import json
 import os
 import re
 import uuid
+from collections.abc import AsyncIterator
 from contextlib import asynccontextmanager
 from copy import deepcopy
 from pathlib import Path, PurePosixPath
-from typing import Any, cast
-
-from quart import Response as QuartResponse
-from quart import g, make_response, request, send_file
+from typing import Any
 
 from astrbot.core import logger, sp
 from astrbot.core.agent.message import get_checkpoint_id, is_checkpoint_message
@@ -27,13 +27,10 @@ from astrbot.core.utils.active_event_registry import active_event_registry
 from astrbot.core.utils.astrbot_path import get_astrbot_data_path
 from astrbot.core.utils.datetime_utils import to_utc_isoformat
 
-from .route import Response, Route, RouteContext
-
-# SSE heartbeat message to keep the connection alive during long-running operations
 SSE_HEARTBEAT = ": heartbeat\n\n"
 
 
-def _sanitize_upload_filename(filename: str | None) -> str:
+def sanitize_upload_filename(filename: str | None) -> str:
     if not filename:
         return f"{uuid.uuid4()!s}"
     normalized = filename.replace("\\", "/")
@@ -52,13 +49,10 @@ async def track_conversation(convs: dict, conv_id: str):
         convs.pop(conv_id, None)
 
 
-async def _poll_webchat_stream_result(back_queue, username: str):
+async def poll_webchat_stream_result(back_queue, username: str):
     try:
         result = await asyncio.wait_for(back_queue.get(), timeout=1)
     except asyncio.TimeoutError:
-        # Return a sentinel so the caller can send an SSE heartbeat to
-        # keep the connection alive during long-running operations (e.g.
-        # context compression with reasoning models).  See #6938.
         return None, False
     except asyncio.CancelledError:
         logger.debug(f"[WebChat] 用户 {username} 断开聊天长连接。")
@@ -69,7 +63,7 @@ async def _poll_webchat_stream_result(back_queue, username: str):
     return result, False
 
 
-def normalize_legacy_reasoning_message_parts(
+def normalize_reasoning_message_parts(
     message_parts: list[dict] | None,
     reasoning: str = "",
 ) -> list[dict]:
@@ -113,14 +107,12 @@ def build_bot_history_content(
     *,
     agent_stats: dict | None = None,
     refs: dict | None = None,
-    include_legacy_reasoning_field: bool = True,
+    include_reasoning_field: bool = True,
 ) -> dict[str, Any]:
-    normalized_parts = normalize_legacy_reasoning_message_parts(message_parts)
+    normalized_parts = normalize_reasoning_message_parts(message_parts)
     content: dict[str, Any] = {"type": "bot", "message": normalized_parts}
     reasoning = extract_reasoning_from_message_parts(normalized_parts)
-    if reasoning and include_legacy_reasoning_field:
-        # Keep the legacy field for old clients while the canonical structure
-        # moves to message parts.
+    if reasoning and include_reasoning_field:
         content["reasoning"] = reasoning
     if agent_stats:
         content["agent_stats"] = agent_stats
@@ -242,112 +234,341 @@ class BotMessageAccumulator:
         return parsed if isinstance(parsed, dict) else None
 
 
-class ChatRoute(Route):
+def extract_web_search_refs(accumulated_text: str, accumulated_parts: list) -> dict:
+    supported = [
+        "web_search_baidu",
+        "web_search_tavily",
+        "web_search_bocha",
+        "web_search_brave",
+    ]
+    web_search_results = {}
+    tool_call_parts = [
+        p
+        for p in accumulated_parts
+        if p.get("type") == "tool_call" and p.get("tool_calls")
+    ]
+
+    for part in tool_call_parts:
+        for tool_call in part["tool_calls"]:
+            if tool_call.get("name") not in supported or not tool_call.get("result"):
+                continue
+            try:
+                result_data = json.loads(tool_call["result"])
+                for item in result_data.get("results", []):
+                    if idx := item.get("index"):
+                        web_search_results[idx] = {
+                            "url": item.get("url"),
+                            "title": item.get("title"),
+                            "snippet": item.get("snippet"),
+                        }
+            except (json.JSONDecodeError, KeyError):
+                pass
+
+    if not web_search_results:
+        return {}
+
+    ref_indices = {m.strip() for m in re.findall(r"<ref>(.*?)</ref>", accumulated_text)}
+    used_refs = []
+    for ref_index in ref_indices:
+        if ref_index not in web_search_results:
+            continue
+        payload = {"index": ref_index, **web_search_results[ref_index]}
+        if favicon := sp.temporary_cache.get("_ws_favicon", {}).get(payload["url"]):
+            payload["favicon"] = favicon
+        used_refs.append(payload)
+
+    return {"used": used_refs} if used_refs else {}
+
+
+def sanitize_message_content(content: dict) -> dict:
+    if not isinstance(content, dict):
+        raise ValueError("Missing key: content")
+
+    normalized = deepcopy(content)
+    message_type = normalized.get("type")
+    if message_type not in {"user", "bot"}:
+        raise ValueError("Invalid key: content.type")
+
+    message_parts = normalized.get("message")
+    if not isinstance(message_parts, list):
+        raise ValueError("Missing key: content.message")
+    normalized["message"] = strip_message_parts_path_fields(message_parts)
+    return normalized
+
+
+def extract_platform_message_text(content: dict | None) -> str:
+    if not isinstance(content, dict):
+        return ""
+    message_parts = content.get("message")
+    if not isinstance(message_parts, list):
+        return ""
+    texts: list[str] = []
+    for part in message_parts:
+        if isinstance(part, dict) and part.get("type") == "plain":
+            text = part.get("text")
+            if isinstance(text, str):
+                texts.append(text)
+    return "".join(texts)
+
+
+def build_webchat_unified_msg_origin(session) -> str:
+    message_type = (
+        MessageType.GROUP_MESSAGE.value
+        if session.is_group
+        else MessageType.FRIEND_MESSAGE.value
+    )
+    return (
+        f"{session.platform_id}:{message_type}:"
+        f"{session.platform_id}!{session.creator}!{session.session_id}"
+    )
+
+
+def build_thread_unified_msg_origin(creator: str, thread_id: str) -> str:
+    return f"webchat:{MessageType.FRIEND_MESSAGE.value}:webchat!{creator}!{thread_id}"
+
+
+def serialize_thread(thread) -> dict:
+    from astrbot.core.utils.datetime_utils import to_utc_isoformat
+
+    return {
+        "thread_id": thread.thread_id,
+        "parent_session_id": thread.parent_session_id,
+        "parent_message_id": thread.parent_message_id,
+        "base_checkpoint_id": thread.base_checkpoint_id,
+        "selected_text": thread.selected_text,
+        "created_at": to_utc_isoformat(thread.created_at),
+        "updated_at": to_utc_isoformat(thread.updated_at),
+    }
+
+
+def find_checkpoint_index(history: list[dict], checkpoint_id: str) -> int | None:
+    for index, message in enumerate(history):
+        if get_checkpoint_id(message) == checkpoint_id:
+            return index
+    return None
+
+
+def find_turn_range(history: list[dict], checkpoint_id: str) -> tuple[int, int] | None:
+    checkpoint_index = find_checkpoint_index(history, checkpoint_id)
+    if checkpoint_index is None:
+        return None
+
+    start = 0
+    for index in range(checkpoint_index - 1, -1, -1):
+        if is_checkpoint_message(history[index]):
+            start = index + 1
+            break
+    return start, checkpoint_index
+
+
+def is_latest_checkpoint(history: list[dict], checkpoint_id: str) -> bool:
+    for message in reversed(history):
+        current_checkpoint_id = get_checkpoint_id(message)
+        if current_checkpoint_id:
+            return current_checkpoint_id == checkpoint_id
+    return False
+
+
+def replace_user_conversation_content(original_content, edited_text: str):
+    if isinstance(original_content, str):
+        return edited_text
+    if not isinstance(original_content, list):
+        return edited_text
+
+    result: list[dict] = []
+    inserted_text = False
+    for part in original_content:
+        if not isinstance(part, dict):
+            result.append(part)
+            continue
+        if part.get("type") != "text":
+            result.append(part)
+            continue
+        text = part.get("text")
+        if isinstance(text, str) and text.startswith("<system_reminder>"):
+            result.append(part)
+            continue
+        if not inserted_text and edited_text:
+            result.append({"type": "text", "text": edited_text})
+            inserted_text = True
+
+    if not inserted_text and edited_text:
+        result.insert(0, {"type": "text", "text": edited_text})
+    return result
+
+
+def replace_assistant_conversation_content(
+    original_content,
+    edited_text: str,
+    reasoning: str,
+):
+    if isinstance(original_content, str):
+        return edited_text
+    if not isinstance(original_content, list):
+        return [{"type": "text", "text": edited_text}] if edited_text else []
+
+    result: list[dict] = []
+    inserted_text = False
+    inserted_think = False
+    for part in original_content:
+        if not isinstance(part, dict):
+            result.append(part)
+            continue
+        if part.get("type") == "text":
+            if not inserted_text and edited_text:
+                result.append({"type": "text", "text": edited_text})
+                inserted_text = True
+            continue
+        if part.get("type") == "think":
+            if not inserted_think and reasoning:
+                result.append({"type": "think", "think": reasoning})
+                inserted_think = True
+            continue
+        result.append(part)
+
+    if reasoning and not inserted_think:
+        result.insert(0, {"type": "think", "think": reasoning})
+    if edited_text and not inserted_text:
+        result.append({"type": "text", "text": edited_text})
+    return result
+
+
+def find_turn_user_index(history: list[dict], start: int, end: int) -> int | None:
+    for index in range(start, end):
+        message = history[index]
+        if isinstance(message, dict) and message.get("role") == "user":
+            return index
+    return None
+
+
+def find_turn_final_assistant_index(
+    history: list[dict], start: int, end: int
+) -> int | None:
+    for index in range(end - 1, start - 1, -1):
+        message = history[index]
+        if not isinstance(message, dict) or message.get("role") != "assistant":
+            continue
+        if message.get("tool_calls") and not message.get("content"):
+            continue
+        return index
+    return None
+
+
+def extract_attachment_ids(history_list) -> list[str]:
+    attachment_ids = []
+    for history in history_list:
+        content = history.content
+        if not content or "message" not in content:
+            continue
+        message_parts = content.get("message", [])
+        for part in message_parts:
+            if isinstance(part, dict) and "attachment_id" in part:
+                attachment_ids.append(part["attachment_id"])
+    return attachment_ids
+
+
+class ChatServiceError(Exception):
+    pass
+
+
+class ChatService:
     def __init__(
         self,
-        context: RouteContext,
         db: BaseDatabase,
         core_lifecycle: AstrBotCoreLifecycle,
     ) -> None:
-        super().__init__(context)
-        self.routes = {
-            "/chat/send": ("POST", self.chat),
-            "/chat/new_session": ("GET", self.new_session),
-            "/chat/sessions": ("GET", self.get_sessions),
-            "/chat/get_session": ("GET", self.get_session),
-            "/chat/stop": ("POST", self.stop_session),
-            "/chat/delete_session": ("GET", self.delete_webchat_session),
-            "/chat/batch_delete_sessions": ("POST", self.batch_delete_sessions),
-            "/chat/update_session_display_name": (
-                "POST",
-                self.update_session_display_name,
-            ),
-            "/chat/message/edit": ("POST", self.update_message),
-            "/chat/message/regenerate": ("POST", self.regenerate_message),
-            "/chat/thread/create": ("POST", self.create_thread),
-            "/chat/thread/get": ("GET", self.get_thread),
-            "/chat/thread/send": ("POST", self.send_thread_message),
-            "/chat/thread/delete": ("POST", self.delete_thread),
-            "/chat/get_file": ("GET", self.get_file),
-            "/chat/get_attachment": ("GET", self.get_attachment),
-            "/chat/post_file": ("POST", self.post_file),
-        }
+        self.db = db
         self.core_lifecycle = core_lifecycle
-        self.register_routes()
         self.attachments_dir = os.path.join(get_astrbot_data_path(), "attachments")
-        self.legacy_img_dir = os.path.join(get_astrbot_data_path(), "webchat", "imgs")
+        self.webchat_img_dir = os.path.join(get_astrbot_data_path(), "webchat", "imgs")
         os.makedirs(self.attachments_dir, exist_ok=True)
 
         self.supported_imgs = ["jpg", "jpeg", "png", "gif", "webp"]
         self.conv_mgr = core_lifecycle.conversation_manager
         self.platform_history_mgr = core_lifecycle.platform_message_history_manager
-        self.db = db
         self.umop_config_router = core_lifecycle.umop_config_router
-
         self.running_convs: dict[str, bool] = {}
 
-    async def get_file(self):
-        filename = request.args.get("filename")
+    async def build_user_message_parts(self, message: str | list) -> list[dict]:
+        return await build_webchat_message_parts(
+            message,
+            get_attachment_by_id=self.db.get_attachment_by_id,
+            strict=False,
+        )
+
+    async def create_attachment_from_file(
+        self, filename: str, attach_type: str
+    ) -> dict | None:
+        return await create_attachment_part_from_existing_file(
+            filename,
+            attach_type=attach_type,
+            insert_attachment=self.db.insert_attachment,
+            attachments_dir=self.attachments_dir,
+            fallback_dirs=[self.webchat_img_dir],
+        )
+
+    async def resolve_webchat_file(
+        self, filename: str | None
+    ) -> tuple[str, str | None]:
         if not filename:
-            return Response().error("Missing key: filename").__dict__
+            raise ChatServiceError("Missing key: filename")
 
-        try:
-            file_path = os.path.join(self.attachments_dir, os.path.basename(filename))
-            real_file_path = os.path.realpath(file_path)
-            real_imgs_dir = os.path.realpath(self.attachments_dir)
+        safe_name = os.path.basename(filename)
+        attachments_dir = Path(self.attachments_dir).resolve(strict=False)
+        file_path = (attachments_dir / safe_name).resolve(strict=False)
+        file_root = attachments_dir
 
-            if not os.path.exists(real_file_path):
-                # try legacy
-                file_path = os.path.join(
-                    self.legacy_img_dir, os.path.basename(filename)
-                )
-                if os.path.exists(file_path):
-                    real_file_path = os.path.realpath(file_path)
-                    real_imgs_dir = os.path.realpath(self.legacy_img_dir)
+        if not file_path.exists():
+            webchat_img_dir = Path(self.webchat_img_dir).resolve(strict=False)
+            webchat_file_path = (webchat_img_dir / safe_name).resolve(strict=False)
+            if webchat_file_path.exists():
+                file_path = webchat_file_path
+                file_root = webchat_img_dir
 
-            if not real_file_path.startswith(real_imgs_dir):
-                return Response().error("Invalid file path").__dict__
+        if not file_path.is_relative_to(file_root):
+            raise ChatServiceError("Invalid file path")
+        if not file_path.exists():
+            raise ChatServiceError("File access error")
 
-            filename_ext = os.path.splitext(filename)[1].lower()
-            if filename_ext == ".wav":
-                return await send_file(real_file_path, mimetype="audio/wav")
-            if filename_ext[1:] in self.supported_imgs:
-                return await send_file(real_file_path, mimetype="image/jpeg")
-            return await send_file(real_file_path)
+        filename_ext = file_path.suffix.lower()
+        if filename_ext == ".wav":
+            return str(file_path), "audio/wav"
+        if filename_ext[1:] in self.supported_imgs:
+            return str(file_path), "image/jpeg"
+        return str(file_path), None
 
-        except (FileNotFoundError, OSError):
-            return Response().error("File access error").__dict__
+    async def resolve_webchat_file_from_dashboard_query(
+        self,
+        filename: str | None,
+    ) -> tuple[str, str | None]:
+        return await self.resolve_webchat_file(filename)
 
-    async def get_attachment(self):
-        """Get attachment file by attachment_id."""
-        attachment_id = request.args.get("attachment_id")
+    async def resolve_attachment_file(
+        self,
+        attachment_id: str | None,
+    ) -> tuple[str, str | None]:
         if not attachment_id:
-            return Response().error("Missing key: attachment_id").__dict__
+            raise ChatServiceError("Missing key: attachment_id")
 
-        try:
-            attachment = await self.db.get_attachment_by_id(attachment_id)
-            if not attachment:
-                return Response().error("Attachment not found").__dict__
+        attachment = await self.db.get_attachment_by_id(attachment_id)
+        if not attachment:
+            raise ChatServiceError("Attachment not found")
 
-            file_path = attachment.path
-            real_file_path = os.path.realpath(file_path)
+        file_path = Path(attachment.path).resolve(strict=False)
+        if not file_path.exists():
+            raise ChatServiceError("File access error")
+        return str(file_path), attachment.mime_type
 
-            return await send_file(real_file_path, mimetype=attachment.mime_type)
+    async def resolve_attachment_file_from_dashboard_query(
+        self,
+        attachment_id: str | None,
+    ) -> tuple[str, str | None]:
+        return await self.resolve_attachment_file(attachment_id)
 
-        except (FileNotFoundError, OSError):
-            return Response().error("File access error").__dict__
-
-    async def post_file(self):
-        """Upload a file and create an attachment record, return attachment_id."""
-        post_data = await request.files
-        if "file" not in post_data:
-            return Response().error("Missing key: file").__dict__
-
-        file = post_data["file"]
-        filename = _sanitize_upload_filename(file.filename)
+    async def save_uploaded_file(self, file) -> dict:
+        filename = sanitize_upload_filename(file.filename)
         content_type = file.content_type or "application/octet-stream"
 
-        # 根据 content_type 判断文件类型并添加扩展名
         if content_type.startswith("image"):
             attach_type = "image"
         elif content_type.startswith("audio"):
@@ -360,11 +581,9 @@ class ChatRoute(Route):
         attachments_dir = Path(self.attachments_dir).resolve(strict=False)
         file_path = (attachments_dir / filename).resolve(strict=False)
         if not file_path.is_relative_to(attachments_dir):
-            return Response().error("Invalid filename").__dict__
+            raise ChatServiceError("Invalid filename")
 
         await file.save(str(file_path))
-
-        # 创建 attachment 记录
         attachment = await self.db.insert_attachment(
             path=str(file_path),
             type=attach_type,
@@ -372,168 +591,22 @@ class ChatRoute(Route):
         )
 
         if not attachment:
-            return Response().error("Failed to create attachment").__dict__
+            raise ChatServiceError("Failed to create attachment")
 
-        filename = os.path.basename(attachment.path)
-
-        return (
-            Response()
-            .ok(
-                data={
-                    "attachment_id": attachment.attachment_id,
-                    "filename": filename,
-                    "type": attach_type,
-                }
-            )
-            .__dict__
-        )
-
-    async def _build_user_message_parts(self, message: str | list) -> list[dict]:
-        """构建用户消息的部分列表。"""
-        return await build_webchat_message_parts(
-            message,
-            get_attachment_by_id=self.db.get_attachment_by_id,
-            strict=False,
-        )
-
-    async def _create_attachment_from_file(
-        self, filename: str, attach_type: str
-    ) -> dict | None:
-        """从本地文件创建 attachment 并返回消息部分。"""
-        return await create_attachment_part_from_existing_file(
-            filename,
-            attach_type=attach_type,
-            insert_attachment=self.db.insert_attachment,
-            attachments_dir=self.attachments_dir,
-            fallback_dirs=[self.legacy_img_dir],
-        )
-
-    def _extract_web_search_refs(
-        self, accumulated_text: str, accumulated_parts: list
-    ) -> dict:
-        """从消息中提取 web_search_tavily 的引用
-
-        Args:
-            accumulated_text: 累积的文本内容
-            accumulated_parts: 累积的消息部分列表
-
-        Returns:
-            包含 used 列表的字典，记录被引用的搜索结果
-        """
-        supported = [
-            "web_search_baidu",
-            "web_search_tavily",
-            "web_search_bocha",
-            "web_search_brave",
-        ]
-        # 从 accumulated_parts 中找到所有 web_search_tavily 的工具调用结果
-        web_search_results = {}
-        tool_call_parts = [
-            p
-            for p in accumulated_parts
-            if p.get("type") == "tool_call" and p.get("tool_calls")
-        ]
-
-        for part in tool_call_parts:
-            for tool_call in part["tool_calls"]:
-                if tool_call.get("name") not in supported or not tool_call.get(
-                    "result"
-                ):
-                    continue
-                try:
-                    result_data = json.loads(tool_call["result"])
-                    for item in result_data.get("results", []):
-                        if idx := item.get("index"):
-                            web_search_results[idx] = {
-                                "url": item.get("url"),
-                                "title": item.get("title"),
-                                "snippet": item.get("snippet"),
-                            }
-                except (json.JSONDecodeError, KeyError):
-                    pass
-
-        if not web_search_results:
-            return {}
-
-        # 从文本中提取所有 <ref>xxx</ref> 标签并去重
-        ref_indices = {
-            m.strip() for m in re.findall(r"<ref>(.*?)</ref>", accumulated_text)
-        }
-
-        # 构建被引用的结果列表
-        used_refs = []
-        for ref_index in ref_indices:
-            if ref_index not in web_search_results:
-                continue
-            payload = {"index": ref_index, **web_search_results[ref_index]}
-            if favicon := sp.temporary_cache.get("_ws_favicon", {}).get(payload["url"]):
-                payload["favicon"] = favicon
-            used_refs.append(payload)
-
-        return {"used": used_refs} if used_refs else {}
-
-    def _sanitize_message_content(self, content: dict) -> dict:
-        """Normalize editable WebChat message content before persisting."""
-        if not isinstance(content, dict):
-            raise ValueError("Missing key: content")
-
-        normalized = deepcopy(content)
-        message_type = normalized.get("type")
-        if message_type not in {"user", "bot"}:
-            raise ValueError("Invalid key: content.type")
-
-        message_parts = normalized.get("message")
-        if not isinstance(message_parts, list):
-            raise ValueError("Missing key: content.message")
-        normalized["message"] = strip_message_parts_path_fields(message_parts)
-        return normalized
-
-    def _extract_platform_message_text(self, content: dict | None) -> str:
-        if not isinstance(content, dict):
-            return ""
-        message_parts = content.get("message")
-        if not isinstance(message_parts, list):
-            return ""
-        texts: list[str] = []
-        for part in message_parts:
-            if isinstance(part, dict) and part.get("type") == "plain":
-                text = part.get("text")
-                if isinstance(text, str):
-                    texts.append(text)
-        return "".join(texts)
-
-    def _build_webchat_unified_msg_origin(self, session) -> str:
-        message_type = (
-            MessageType.GROUP_MESSAGE.value
-            if session.is_group
-            else MessageType.FRIEND_MESSAGE.value
-        )
-        return (
-            f"{session.platform_id}:{message_type}:"
-            f"{session.platform_id}!{session.creator}!{session.session_id}"
-        )
-
-    def _build_thread_unified_msg_origin(self, creator: str, thread_id: str) -> str:
-        return (
-            f"webchat:{MessageType.FRIEND_MESSAGE.value}:webchat!{creator}!{thread_id}"
-        )
-
-    def _serialize_thread(self, thread) -> dict:
         return {
-            "thread_id": thread.thread_id,
-            "parent_session_id": thread.parent_session_id,
-            "parent_message_id": thread.parent_message_id,
-            "base_checkpoint_id": thread.base_checkpoint_id,
-            "selected_text": thread.selected_text,
-            "created_at": to_utc_isoformat(thread.created_at),
-            "updated_at": to_utc_isoformat(thread.updated_at),
+            "attachment_id": attachment.attachment_id,
+            "filename": os.path.basename(attachment.path),
+            "type": attach_type,
         }
 
-    async def _delete_threads_by_ids(self, thread_ids: list[str], creator: str) -> None:
+    async def save_uploaded_file_from_dashboard_files(self, files) -> dict:
+        if "file" not in files:
+            raise ChatServiceError("Missing key: file")
+        return await self.save_uploaded_file(files["file"])
+
+    async def delete_threads_by_ids(self, thread_ids: list[str], creator: str) -> None:
         for thread_id in thread_ids:
-            unified_msg_origin = self._build_thread_unified_msg_origin(
-                creator, thread_id
-            )
+            unified_msg_origin = build_thread_unified_msg_origin(creator, thread_id)
             active_event_registry.request_agent_stop_all(unified_msg_origin)
             await self.conv_mgr.delete_conversations_by_user_id(unified_msg_origin)
             await self.platform_history_mgr.delete(
@@ -544,8 +617,8 @@ class ChatRoute(Route):
             webchat_queue_mgr.remove_queues(thread_id)
             self.running_convs.pop(thread_id, None)
 
-    async def _load_current_conversation_history(self, session) -> tuple[str, list]:
-        unified_msg_origin = self._build_webchat_unified_msg_origin(session)
+    async def load_current_conversation_history(self, session) -> tuple[str, list]:
+        unified_msg_origin = build_webchat_unified_msg_origin(session)
         conversation_id = await self.conv_mgr.get_curr_conversation_id(
             unified_msg_origin
         )
@@ -565,120 +638,7 @@ class ChatRoute(Route):
             return "", []
         return conversation_id, history if isinstance(history, list) else []
 
-    def _find_checkpoint_index(
-        self, history: list[dict], checkpoint_id: str
-    ) -> int | None:
-        for index, message in enumerate(history):
-            if get_checkpoint_id(message) == checkpoint_id:
-                return index
-        return None
-
-    def _find_turn_range(
-        self, history: list[dict], checkpoint_id: str
-    ) -> tuple[int, int] | None:
-        checkpoint_index = self._find_checkpoint_index(history, checkpoint_id)
-        if checkpoint_index is None:
-            return None
-
-        start = 0
-        for index in range(checkpoint_index - 1, -1, -1):
-            if is_checkpoint_message(history[index]):
-                start = index + 1
-                break
-        return start, checkpoint_index
-
-    def _is_latest_checkpoint(self, history: list[dict], checkpoint_id: str) -> bool:
-        for message in reversed(history):
-            current_checkpoint_id = get_checkpoint_id(message)
-            if current_checkpoint_id:
-                return current_checkpoint_id == checkpoint_id
-        return False
-
-    def _replace_user_conversation_content(self, original_content, edited_text: str):
-        if isinstance(original_content, str):
-            return edited_text
-        if not isinstance(original_content, list):
-            return edited_text
-
-        result: list[dict] = []
-        inserted_text = False
-        for part in original_content:
-            if not isinstance(part, dict):
-                result.append(part)
-                continue
-            if part.get("type") != "text":
-                result.append(part)
-                continue
-            text = part.get("text")
-            if isinstance(text, str) and text.startswith("<system_reminder>"):
-                result.append(part)
-                continue
-            if not inserted_text and edited_text:
-                result.append({"type": "text", "text": edited_text})
-                inserted_text = True
-
-        if not inserted_text and edited_text:
-            result.insert(0, {"type": "text", "text": edited_text})
-        return result
-
-    def _replace_assistant_conversation_content(
-        self,
-        original_content,
-        edited_text: str,
-        reasoning: str,
-    ):
-        if isinstance(original_content, str):
-            return edited_text
-        if not isinstance(original_content, list):
-            return [{"type": "text", "text": edited_text}] if edited_text else []
-
-        result: list[dict] = []
-        inserted_text = False
-        inserted_think = False
-        for part in original_content:
-            if not isinstance(part, dict):
-                result.append(part)
-                continue
-            if part.get("type") == "text":
-                if not inserted_text and edited_text:
-                    result.append({"type": "text", "text": edited_text})
-                    inserted_text = True
-                continue
-            if part.get("type") == "think":
-                if not inserted_think and reasoning:
-                    result.append({"type": "think", "think": reasoning})
-                    inserted_think = True
-                continue
-            result.append(part)
-
-        if reasoning and not inserted_think:
-            result.insert(0, {"type": "think", "think": reasoning})
-        if edited_text and not inserted_text:
-            result.append({"type": "text", "text": edited_text})
-        return result
-
-    def _find_turn_user_index(
-        self, history: list[dict], start: int, end: int
-    ) -> int | None:
-        for index in range(start, end):
-            message = history[index]
-            if isinstance(message, dict) and message.get("role") == "user":
-                return index
-        return None
-
-    def _find_turn_final_assistant_index(
-        self, history: list[dict], start: int, end: int
-    ) -> int | None:
-        for index in range(end - 1, start - 1, -1):
-            message = history[index]
-            if not isinstance(message, dict) or message.get("role") != "assistant":
-                continue
-            if message.get("tool_calls") and not message.get("content"):
-                continue
-            return index
-        return None
-
-    async def _get_sorted_platform_history(self, session) -> list:
+    async def get_sorted_platform_history(self, session) -> list:
         history_list = await self.platform_history_mgr.get(
             platform_id=session.platform_id,
             user_id=session.session_id,
@@ -688,10 +648,10 @@ class ChatRoute(Route):
         history_list.sort(key=lambda item: (item.created_at, item.id))
         return history_list
 
-    async def _delete_platform_history_after(
+    async def delete_platform_history_after(
         self, session, message_id: int
     ) -> list[int]:
-        history_list = await self._get_sorted_platform_history(session)
+        history_list = await self.get_sorted_platform_history(session)
         should_delete = False
         deleted_ids: list[int] = []
         for item in history_list:
@@ -704,7 +664,7 @@ class ChatRoute(Route):
                 should_delete = True
         return deleted_ids
 
-    async def _save_bot_message(
+    async def save_bot_message(
         self,
         webchat_conv_id: str,
         message_parts: list[dict],
@@ -713,39 +673,30 @@ class ChatRoute(Route):
         llm_checkpoint_id: str | None = None,
         platform_history_id: str = "webchat",
     ):
-        """保存 bot 消息到历史记录，返回保存的记录"""
-        new_his = build_bot_history_content(
-            message_parts,
-            agent_stats=agent_stats,
-            refs=refs,
-        )
-
-        record = await self.platform_history_mgr.insert(
+        return await self.platform_history_mgr.insert(
             platform_id=platform_history_id,
             user_id=webchat_conv_id,
-            content=new_his,
+            content=build_bot_history_content(
+                message_parts,
+                agent_stats=agent_stats,
+                refs=refs,
+            ),
             sender_id="bot",
             sender_name="bot",
             llm_checkpoint_id=llm_checkpoint_id,
         )
-        return record
 
-    async def chat(self, post_data: dict | None = None):
-        username = g.get("username", "guest")
-
-        if post_data is None:
-            post_data = await request.json
-        if post_data is None:
-            return Response().error("Missing JSON body").__dict__
+    async def build_chat_stream(
+        self,
+        username: str,
+        post_data: dict,
+    ) -> AsyncIterator[str]:
         if "message" not in post_data and "files" not in post_data:
-            return Response().error("Missing key: message or files").__dict__
-
+            raise ChatServiceError("Missing key: message or files")
         if "session_id" not in post_data and "conversation_id" not in post_data:
-            return (
-                Response().error("Missing key: session_id or conversation_id").__dict__
-            )
+            raise ChatServiceError("Missing key: session_id or conversation_id")
 
-        message = post_data["message"]
+        message = post_data.get("message", post_data.get("files", []))
         session_id = post_data.get("session_id", post_data.get("conversation_id"))
         selected_provider = post_data.get("selected_provider")
         selected_model = post_data.get("selected_model")
@@ -754,17 +705,13 @@ class ChatRoute(Route):
         thread_selected_text = post_data.get("_thread_selected_text")
 
         if not session_id:
-            return Response().error("session_id is empty").__dict__
+            raise ChatServiceError("session_id is empty")
 
         webchat_conv_id = session_id
-
-        # 构建用户消息段（包含 path 用于传递给 adapter）
-        message_parts = await self._build_user_message_parts(message)
+        message_parts = await self.build_user_message_parts(message)
         if not webchat_message_parts_have_content(message_parts):
-            return (
-                Response()
-                .error("Message content is empty (reply only is not allowed)")
-                .__dict__
+            raise ChatServiceError(
+                "Message content is empty (reply only is not allowed)"
             )
 
         message_id = str(uuid.uuid4())
@@ -795,7 +742,7 @@ class ChatRoute(Route):
                 )
 
                 try:
-                    extracted_refs = self._extract_web_search_refs(
+                    extracted_refs = extract_web_search_refs(
                         plain_text,
                         message_parts_to_save,
                     )
@@ -806,7 +753,7 @@ class ChatRoute(Route):
                     )
                     extracted_refs = refs
 
-                saved_record = await self._save_bot_message(
+                saved_record = await self.save_bot_message(
                     webchat_conv_id,
                     message_parts_to_save,
                     agent_stats,
@@ -833,7 +780,6 @@ class ChatRoute(Route):
                 return f"data: {json.dumps(payload, ensure_ascii=False)}\n\n"
 
             try:
-                # Emit session_id first so clients can bind the stream immediately.
                 session_info = {
                     "type": "session_id",
                     "data": None,
@@ -855,16 +801,13 @@ class ChatRoute(Route):
 
                 async with track_conversation(self.running_convs, webchat_conv_id):
                     while True:
-                        result, should_break = await _poll_webchat_stream_result(
+                        result, should_break = await poll_webchat_stream_result(
                             back_queue, username
                         )
                         if should_break:
                             client_disconnected = True
                             break
                         if not result:
-                            # Send an SSE comment as keep-alive so the client
-                            # doesn't time out during slow backend ops like
-                            # context compression with reasoning models (#6938).
                             if not client_disconnected:
                                 yield SSE_HEARTBEAT
                             continue
@@ -890,7 +833,6 @@ class ChatRoute(Route):
                             agent_stats = stats_info["data"]
                             continue
 
-                        # 发送 SSE 数据
                         try:
                             if not client_disconnected:
                                 yield f"data: {json.dumps(result, ensure_ascii=False)}\n\n"
@@ -908,7 +850,6 @@ class ChatRoute(Route):
                             logger.debug(f"[WebChat] 用户 {username} 断开聊天长连接。")
                             client_disconnected = True
 
-                        # 累积消息部分
                         if msg_type == "plain":
                             message_accumulator.add_plain(
                                 result_text,
@@ -917,7 +858,7 @@ class ChatRoute(Route):
                             )
                         elif msg_type == "image":
                             filename = result_text.replace("[IMAGE]", "")
-                            part = await self._create_attachment_from_file(
+                            part = await self.create_attachment_from_file(
                                 filename, "image"
                             )
                             message_accumulator.add_attachment(part)
@@ -927,7 +868,7 @@ class ChatRoute(Route):
                                 yield attachment_saved_event
                         elif msg_type == "record":
                             filename = result_text.replace("[RECORD]", "")
-                            part = await self._create_attachment_from_file(
+                            part = await self.create_attachment_from_file(
                                 filename, "record"
                             )
                             message_accumulator.add_attachment(part)
@@ -936,9 +877,8 @@ class ChatRoute(Route):
                             ):
                                 yield attachment_saved_event
                         elif msg_type == "file":
-                            # 格式: [FILE]filename
                             filename = result_text.replace("[FILE]", "")
-                            part = await self._create_attachment_from_file(
+                            part = await self.create_attachment_from_file(
                                 filename, "file"
                             )
                             message_accumulator.add_attachment(part)
@@ -948,7 +888,7 @@ class ChatRoute(Route):
                                 yield attachment_saved_event
                         elif msg_type == "video":
                             filename = result_text.replace("[VIDEO]", "")
-                            part = await self._create_attachment_from_file(
+                            part = await self.create_attachment_from_file(
                                 filename, "video"
                             )
                             message_accumulator.add_attachment(part)
@@ -968,7 +908,6 @@ class ChatRoute(Route):
 
                         if should_save:
                             saved_record = await flush_pending_bot_message()
-                            # 发送保存的消息信息给前端
                             if saved_record and not client_disconnected:
                                 saved_info = {
                                     "type": "message_saved",
@@ -998,7 +937,6 @@ class ChatRoute(Route):
                     )
                 webchat_queue_mgr.remove_back_queue(message_id)
 
-        # 将消息放入会话特定的队列
         chat_queue = webchat_queue_mgr.get_or_create_queue(webchat_conv_id)
         await chat_queue.put(
             (
@@ -1017,7 +955,6 @@ class ChatRoute(Route):
         )
 
         message_parts_for_storage = strip_message_parts_path_fields(message_parts)
-
         if not skip_user_history:
             saved_user_record = await self.platform_history_mgr.insert(
                 platform_id=platform_history_id,
@@ -1028,81 +965,57 @@ class ChatRoute(Route):
                 llm_checkpoint_id=llm_checkpoint_id,
             )
 
-        response = cast(
-            QuartResponse,
-            await make_response(
-                stream(),
-                {
-                    "Content-Type": "text/event-stream",
-                    "Cache-Control": "no-cache",
-                    "Transfer-Encoding": "chunked",
-                    "Connection": "keep-alive",
-                },
-            ),
-        )
-        response.timeout = None  # fix SSE auto disconnect issue
-        return response
+        return stream()
 
-    async def stop_session(self):
-        """Stop active agent runs for a session."""
-        post_data = await request.json
-        if post_data is None:
-            return Response().error("Missing JSON body").__dict__
-
-        session_id = post_data.get("session_id")
-        if not session_id:
-            return Response().error("Missing key: session_id").__dict__
-
-        username = g.get("username", "guest")
+    async def stop_session(self, username: str, session_id: str) -> dict:
         session = await self.db.get_platform_session_by_id(session_id)
         if not session:
-            return Response().error(f"Session {session_id} not found").__dict__
+            raise ChatServiceError(f"Session {session_id} not found")
         if session.creator != username:
-            return Response().error("Permission denied").__dict__
+            raise ChatServiceError("Permission denied")
 
-        message_type = (
-            MessageType.GROUP_MESSAGE.value
-            if session.is_group
-            else MessageType.FRIEND_MESSAGE.value
-        )
-        umo = (
+        unified_msg_origin = build_webchat_unified_msg_origin(session)
+        stopped_count = active_event_registry.request_agent_stop_all(unified_msg_origin)
+        return {"stopped_count": stopped_count}
+
+    async def stop_session_from_dashboard_payload(
+        self,
+        username: str,
+        payload: object,
+    ) -> dict:
+        data = self._dashboard_payload(payload)
+        session_id = data.get("session_id")
+        if not session_id:
+            raise ChatServiceError("Missing key: session_id")
+        return await self.stop_session(username, session_id)
+
+    async def delete_session_internal(self, session, username: str) -> None:
+        session_id = session.session_id
+        message_type = "GroupMessage" if session.is_group else "FriendMessage"
+        unified_msg_origin = (
             f"{session.platform_id}:{message_type}:"
             f"{session.platform_id}!{username}!{session_id}"
         )
-        stopped_count = active_event_registry.request_agent_stop_all(umo)
-
-        return Response().ok(data={"stopped_count": stopped_count}).__dict__
-
-    async def _delete_session_internal(self, session, username: str) -> None:
-        """Delete a single session and all its related data."""
-        session_id = session.session_id
-
-        # 删除该会话下的所有对话
-        message_type = "GroupMessage" if session.is_group else "FriendMessage"
-        unified_msg_origin = f"{session.platform_id}:{message_type}:{session.platform_id}!{username}!{session_id}"
         await self.conv_mgr.delete_conversations_by_user_id(unified_msg_origin)
 
-        # 获取消息历史中的所有附件 ID 并删除附件
         history_list = await self.platform_history_mgr.get(
             platform_id=session.platform_id,
             user_id=session_id,
             page=1,
-            page_size=100000,  # 获取足够多的记录
+            page_size=100000,
         )
-        attachment_ids = self._extract_attachment_ids(history_list)
+        attachment_ids = extract_attachment_ids(history_list)
         if attachment_ids:
-            await self._delete_attachments(attachment_ids)
+            await self.delete_attachments(attachment_ids)
 
-        # 删除消息历史
         await self.platform_history_mgr.delete(
             platform_id=session.platform_id,
             user_id=session_id,
             offset_sec=99999999,
         )
         thread_ids = await self.db.delete_webchat_threads_by_parent_session(session_id)
-        await self._delete_threads_by_ids(thread_ids, username)
+        await self.delete_threads_by_ids(thread_ids, username)
 
-        # 删除与会话关联的配置路由
         try:
             await self.umop_config_router.delete_route(unified_msg_origin)
         except ValueError as exc:
@@ -1112,92 +1025,80 @@ class ChatRoute(Route):
                 exc,
             )
 
-        # 清理队列（仅对 webchat）
         if session.platform_id == "webchat":
             webchat_queue_mgr.remove_queues(session_id)
 
-        # 删除会话
         await self.db.delete_platform_session(session_id)
 
-    async def delete_webchat_session(self):
-        """Delete a Platform session and all its related data."""
-        session_id = request.args.get("session_id")
-        if not session_id:
-            return Response().error("Missing key: session_id").__dict__
-        username = g.get("username", "guest")
-
+    async def delete_webchat_session(self, username: str, session_id: str) -> None:
         session = await self.db.get_platform_session_by_id(session_id)
         if not session:
-            return Response().error(f"Session {session_id} not found").__dict__
+            raise ChatServiceError(f"Session {session_id} not found")
         if session.creator != username:
-            return Response().error("Permission denied").__dict__
+            raise ChatServiceError("Permission denied")
+        await self.delete_session_internal(session, username)
 
-        await self._delete_session_internal(session, username)
+    async def delete_webchat_session_from_dashboard_query(
+        self,
+        username: str,
+        session_id: str | None,
+    ) -> None:
+        if not session_id:
+            raise ChatServiceError("Missing key: session_id")
+        await self.delete_webchat_session(username, session_id)
 
-        return Response().ok().__dict__
-
-    async def batch_delete_sessions(self):
-        """Batch delete multiple Platform sessions."""
-        post_data = await request.json
-        if post_data is None:
-            return Response().error("Missing JSON body").__dict__
-        if not isinstance(post_data, dict):
-            return Response().error("Invalid JSON body: expected object").__dict__
-
-        session_ids = post_data.get("session_ids")
-        if not session_ids or not isinstance(session_ids, list):
-            return Response().error("Missing or invalid key: session_ids").__dict__
-
-        username = g.get("username", "guest")
+    async def batch_delete_sessions(
+        self,
+        username: str,
+        session_ids: list,
+        delete_session=None,
+    ) -> dict:
+        delete_session = delete_session or self.delete_session_internal
         sessions = await self.db.get_platform_sessions_by_ids(session_ids)
         sessions_by_id = {session.session_id: session for session in sessions}
         deleted_count = 0
         failed_items = []
 
-        for sid in session_ids:
-            session = sessions_by_id.get(sid)
+        for session_id in session_ids:
+            session = sessions_by_id.get(session_id)
             if not session:
-                failed_items.append({"session_id": sid, "reason": "not found"})
+                failed_items.append({"session_id": session_id, "reason": "not found"})
                 continue
             if session.creator != username:
-                failed_items.append({"session_id": sid, "reason": "permission denied"})
+                failed_items.append(
+                    {"session_id": session_id, "reason": "permission denied"}
+                )
                 continue
 
             try:
-                await self._delete_session_internal(session, username)
+                await delete_session(session, username)
                 deleted_count += 1
-                sessions_by_id.pop(sid, None)
+                sessions_by_id.pop(session_id, None)
             except Exception:
-                logger.warning("Failed to delete session %s", sid)
-                failed_items.append({"session_id": sid, "reason": "internal_error"})
+                logger.warning("Failed to delete session %s", session_id)
+                failed_items.append(
+                    {"session_id": session_id, "reason": "internal_error"}
+                )
 
-        return (
-            Response()
-            .ok(
-                data={
-                    "deleted_count": deleted_count,
-                    "failed_count": len(failed_items),
-                    "failed_items": failed_items,
-                }
-            )
-            .__dict__
-        )
+        return {
+            "deleted_count": deleted_count,
+            "failed_count": len(failed_items),
+            "failed_items": failed_items,
+        }
 
-    def _extract_attachment_ids(self, history_list) -> list[str]:
-        """从消息历史中提取所有 attachment_id"""
-        attachment_ids = []
-        for history in history_list:
-            content = history.content
-            if not content or "message" not in content:
-                continue
-            message_parts = content.get("message", [])
-            for part in message_parts:
-                if isinstance(part, dict) and "attachment_id" in part:
-                    attachment_ids.append(part["attachment_id"])
-        return attachment_ids
+    async def batch_delete_sessions_from_dashboard_payload(
+        self,
+        username: str,
+        payload: object,
+        delete_session=None,
+    ) -> dict:
+        data = self._dashboard_payload(payload)
+        session_ids = data.get("session_ids")
+        if not session_ids or not isinstance(session_ids, list):
+            raise ChatServiceError("Missing or invalid key: session_ids")
+        return await self.batch_delete_sessions(username, session_ids, delete_session)
 
-    async def _delete_attachments(self, attachment_ids: list[str]) -> None:
-        """删除附件（包括数据库记录和磁盘文件）"""
+    async def delete_attachments(self, attachment_ids: list[str]) -> None:
         try:
             attachments = await self.db.get_attachments(attachment_ids)
             for attachment in attachments:
@@ -1212,57 +1113,41 @@ class ChatRoute(Route):
         except Exception as e:
             logger.warning(f"Failed to get attachments: {e}")
 
-        # 批量删除数据库记录
         try:
             await self.db.delete_attachments(attachment_ids)
         except Exception as e:
             logger.warning(f"Failed to delete attachments: {e}")
 
-    async def new_session(self):
-        """Create a new Platform session (default: webchat)."""
-        username = g.get("username", "guest")
-
-        # 获取可选的 platform_id 参数，默认为 webchat
-        platform_id = request.args.get("platform_id", "webchat")
-
-        # 创建新会话
+    async def new_session(self, username: str, platform_id: str) -> dict:
         session = await self.db.create_platform_session(
             creator=username,
             platform_id=platform_id,
             is_group=0,
         )
+        return {
+            "session_id": session.session_id,
+            "platform_id": session.platform_id,
+        }
 
-        return (
-            Response()
-            .ok(
-                data={
-                    "session_id": session.session_id,
-                    "platform_id": session.platform_id,
-                }
-            )
-            .__dict__
-        )
-
-    async def get_sessions(self):
-        """Get all Platform sessions for the current user."""
-        username = g.get("username", "guest")
-
-        # 获取可选的 platform_id 参数
-        platform_id = request.args.get("platform_id")
+    async def new_session_from_dashboard_query(
+        self,
+        username: str,
+        platform_id: str | None,
+    ) -> dict:
+        return await self.new_session(username, platform_id or "webchat")
 
+    async def get_sessions(self, username: str, platform_id: str | None) -> list[dict]:
         sessions, _ = await self.db.get_platform_sessions_by_creator_paginated(
             creator=username,
             platform_id=platform_id,
             page=1,
-            page_size=100,  # 暂时返回前100个
+            page_size=100,
             exclude_project_sessions=True,
         )
 
-        # 转换为字典格式
         sessions_data = []
         for item in sessions:
             session = item["session"]
-
             sessions_data.append(
                 {
                     "session_id": session.session_id,
@@ -1274,82 +1159,76 @@ class ChatRoute(Route):
                     "updated_at": to_utc_isoformat(session.updated_at),
                 }
             )
+        return sessions_data
 
-        return Response().ok(data=sessions_data).__dict__
+    async def get_sessions_from_dashboard_query(
+        self,
+        username: str,
+        platform_id: str | None,
+    ) -> list[dict]:
+        return await self.get_sessions(username, platform_id)
 
-    async def get_session(self):
-        """Get session information and message history by session_id."""
-        session_id = request.args.get("session_id")
-        if not session_id:
-            return Response().error("Missing key: session_id").__dict__
-
-        # 获取会话信息以确定 platform_id
+    async def get_session(self, username: str, session_id: str) -> dict:
         session = await self.db.get_platform_session_by_id(session_id)
         platform_id = session.platform_id if session else "webchat"
 
-        # 获取项目信息（如果会话属于某个项目）
-        username = g.get("username", "guest")
         project_info = await self.db.get_project_by_session(
             session_id=session_id, creator=username
         )
-
-        # Get platform message history using session_id
         history_ls = await self.platform_history_mgr.get(
             platform_id=platform_id,
             user_id=session_id,
             page=1,
             page_size=1000,
         )
-
-        history_res = [history.model_dump() for history in history_ls]
         threads = await self.db.get_webchat_threads_by_parent_session(
             parent_session_id=session_id,
             creator=username,
         )
 
         response_data = {
-            "history": history_res,
-            "threads": [self._serialize_thread(thread) for thread in threads],
+            "history": [history.model_dump() for history in history_ls],
+            "threads": [serialize_thread(thread) for thread in threads],
             "is_running": self.running_convs.get(session_id, False),
         }
-
-        # 如果会话属于项目，添加项目信息
         if project_info:
             response_data["project"] = {
                 "project_id": project_info.project_id,
                 "title": project_info.title,
                 "emoji": project_info.emoji,
             }
+        return response_data
 
-        return Response().ok(data=response_data).__dict__
-
-    async def create_thread(self):
-        """Create or reuse a side thread from a selected assistant message."""
-        post_data = await request.json
-        if post_data is None:
-            return Response().error("Missing JSON body").__dict__
-
-        session_id = post_data.get("session_id")
-        parent_message_id = post_data.get("parent_message_id")
-        selected_text = str(post_data.get("selected_text") or "").strip()
+    async def get_session_from_dashboard_query(
+        self,
+        username: str,
+        session_id: str | None,
+    ) -> dict:
         if not session_id:
-            return Response().error("Missing key: session_id").__dict__
+            raise ChatServiceError("Missing key: session_id")
+        return await self.get_session(username, session_id)
+
+    async def create_thread(self, username: str, data: dict) -> dict:
+        session_id = data.get("session_id")
+        parent_message_id = data.get("parent_message_id")
+        selected_text = str(data.get("selected_text") or "").strip()
+        if not session_id:
+            raise ChatServiceError("Missing key: session_id")
         if parent_message_id is None:
-            return Response().error("Missing key: parent_message_id").__dict__
+            raise ChatServiceError("Missing key: parent_message_id")
         if not selected_text:
-            return Response().error("Missing key: selected_text").__dict__
+            raise ChatServiceError("Missing key: selected_text")
 
         try:
             parent_message_id = int(parent_message_id)
-        except (TypeError, ValueError):
-            return Response().error("Invalid key: parent_message_id").__dict__
+        except (TypeError, ValueError) as exc:
+            raise ChatServiceError("Invalid key: parent_message_id") from exc
 
-        username = g.get("username", "guest")
         session = await self.db.get_platform_session_by_id(session_id)
         if not session:
-            return Response().error(f"Session {session_id} not found").__dict__
+            raise ChatServiceError(f"Session {session_id} not found")
         if session.creator != username:
-            return Response().error("Permission denied").__dict__
+            raise ChatServiceError("Permission denied")
 
         parent_record = await self.db.get_platform_message_history_by_id(
             parent_message_id
@@ -1359,17 +1238,15 @@ class ChatRoute(Route):
             or parent_record.platform_id != session.platform_id
             or parent_record.user_id != session_id
         ):
-            return Response().error("Parent message not found").__dict__
+            raise ChatServiceError("Parent message not found")
         if not isinstance(parent_record.content, dict):
-            return Response().error("Invalid parent message content").__dict__
+            raise ChatServiceError("Invalid parent message content")
         if parent_record.content.get("type") != "bot":
-            return Response().error("Only bot messages can create threads").__dict__
+            raise ChatServiceError("Only bot messages can create threads")
 
         checkpoint_id = parent_record.llm_checkpoint_id
         if not checkpoint_id:
-            return (
-                Response().error("Parent message is not linked to LLM history").__dict__
-            )
+            raise ChatServiceError("Parent message is not linked to LLM history")
 
         existing = await self.db.get_webchat_thread_by_parent_message_and_text(
             parent_session_id=session_id,
@@ -1378,14 +1255,12 @@ class ChatRoute(Route):
             creator=username,
         )
         if existing:
-            return Response().ok(data=self._serialize_thread(existing)).__dict__
+            return serialize_thread(existing)
 
-        conversation_id, history = await self._load_current_conversation_history(
-            session
-        )
-        turn_range = self._find_turn_range(history, checkpoint_id)
+        conversation_id, history = await self.load_current_conversation_history(session)
+        turn_range = find_turn_range(history, checkpoint_id)
         if not conversation_id or not turn_range:
-            return Response().error("Linked checkpoint not found").__dict__
+            raise ChatServiceError("Linked checkpoint not found")
 
         _start, end = turn_range
         base_history = history[: end + 1]
@@ -1397,27 +1272,28 @@ class ChatRoute(Route):
             selected_text=selected_text,
         )
         await self.conv_mgr.new_conversation(
-            unified_msg_origin=self._build_thread_unified_msg_origin(
+            unified_msg_origin=build_thread_unified_msg_origin(
                 username,
                 thread.thread_id,
             ),
             platform_id="webchat",
             content=base_history,
         )
-        return Response().ok(data=self._serialize_thread(thread)).__dict__
+        return serialize_thread(thread)
 
-    async def get_thread(self):
-        """Get a side thread and its message history."""
-        thread_id = request.args.get("thread_id")
-        if not thread_id:
-            return Response().error("Missing key: thread_id").__dict__
+    async def create_thread_from_dashboard_payload(
+        self,
+        username: str,
+        payload: object,
+    ) -> dict:
+        return await self.create_thread(username, self._dashboard_payload(payload))
 
-        username = g.get("username", "guest")
+    async def get_thread(self, username: str, thread_id: str) -> dict:
         thread = await self.db.get_webchat_thread_by_id(thread_id)
         if not thread:
-            return Response().error(f"Thread {thread_id} not found").__dict__
+            raise ChatServiceError(f"Thread {thread_id} not found")
         if thread.creator != username:
-            return Response().error("Permission denied").__dict__
+            raise ChatServiceError("Permission denied")
 
         history_ls = await self.platform_history_mgr.get(
             platform_id="webchat_thread",
@@ -1425,108 +1301,110 @@ class ChatRoute(Route):
             page=1,
             page_size=1000,
         )
-        return (
-            Response()
-            .ok(
-                data={
-                    "thread": self._serialize_thread(thread),
-                    "history": [history.model_dump() for history in history_ls],
-                    "is_running": self.running_convs.get(thread_id, False),
-                }
-            )
-            .__dict__
-        )
+        return {
+            "thread": serialize_thread(thread),
+            "history": [history.model_dump() for history in history_ls],
+            "is_running": self.running_convs.get(thread_id, False),
+        }
 
-    async def send_thread_message(self):
-        """Send a message inside a WebChat side thread."""
-        post_data = await request.json
-        if post_data is None:
-            return Response().error("Missing JSON body").__dict__
-
-        thread_id = post_data.get("thread_id")
+    async def get_thread_from_dashboard_query(
+        self,
+        username: str,
+        thread_id: str | None,
+    ) -> dict:
         if not thread_id:
-            return Response().error("Missing key: thread_id").__dict__
+            raise ChatServiceError("Missing key: thread_id")
+        return await self.get_thread(username, thread_id)
+
+    async def prepare_thread_chat_payload(self, username: str, data: dict) -> dict:
+        thread_id = data.get("thread_id")
+        if not thread_id:
+            raise ChatServiceError("Missing key: thread_id")
 
-        username = g.get("username", "guest")
         thread = await self.db.get_webchat_thread_by_id(thread_id)
         if not thread:
-            return Response().error(f"Thread {thread_id} not found").__dict__
+            raise ChatServiceError(f"Thread {thread_id} not found")
         if thread.creator != username:
-            return Response().error("Permission denied").__dict__
+            raise ChatServiceError("Permission denied")
 
-        return await self.chat(
-            {
-                "session_id": thread.thread_id,
-                "message": post_data.get("message", []),
-                "enable_streaming": post_data.get("enable_streaming", True),
-                "selected_provider": post_data.get("selected_provider"),
-                "selected_model": post_data.get("selected_model"),
-                "_platform_history_id": "webchat_thread",
-                "_thread_selected_text": thread.selected_text,
-            }
+        return {
+            "session_id": thread.thread_id,
+            "message": data.get("message", []),
+            "enable_streaming": data.get("enable_streaming", True),
+            "selected_provider": data.get("selected_provider"),
+            "selected_model": data.get("selected_model"),
+            "_platform_history_id": "webchat_thread",
+            "_thread_selected_text": thread.selected_text,
+        }
+
+    async def prepare_thread_chat_payload_from_dashboard_payload(
+        self,
+        username: str,
+        payload: object,
+    ) -> dict:
+        return await self.prepare_thread_chat_payload(
+            username,
+            self._dashboard_payload(payload),
         )
 
-    async def delete_thread(self):
-        """Delete a WebChat side thread and its isolated history."""
-        post_data = await request.json
-        if post_data is None:
-            return Response().error("Missing JSON body").__dict__
-
-        thread_id = post_data.get("thread_id")
-        if not thread_id:
-            return Response().error("Missing key: thread_id").__dict__
-
-        username = g.get("username", "guest")
+    async def delete_thread(self, username: str, thread_id: str) -> dict:
         thread = await self.db.get_webchat_thread_by_id(thread_id)
         if not thread:
-            return Response().error(f"Thread {thread_id} not found").__dict__
+            raise ChatServiceError(f"Thread {thread_id} not found")
         if thread.creator != username:
-            return Response().error("Permission denied").__dict__
+            raise ChatServiceError("Permission denied")
 
         await self.db.delete_webchat_thread(thread_id)
-        await self._delete_threads_by_ids([thread_id], username)
-        return Response().ok(data={"thread_id": thread_id}).__dict__
+        await self.delete_threads_by_ids([thread_id], username)
+        return {"thread_id": thread_id}
 
-    async def update_message(self):
-        """Update a persisted WebChat message and its linked LLM turn."""
-        post_data = await request.json
-        if post_data is None:
-            return Response().error("Missing JSON body").__dict__
+    async def delete_thread_from_dashboard_payload(
+        self,
+        username: str,
+        payload: object,
+    ) -> dict:
+        data = self._dashboard_payload(payload)
+        thread_id = data.get("thread_id")
+        if not thread_id:
+            raise ChatServiceError("Missing key: thread_id")
+        return await self.delete_thread(username, thread_id)
 
-        session_id = post_data.get("session_id")
-        message_id = post_data.get("message_id")
-        content = post_data.get("content")
+    async def update_message(self, username: str, data: dict) -> dict:
+        session_id = data.get("session_id")
+        message_id = data.get("message_id")
+        content = data.get("content")
         if not session_id:
-            return Response().error("Missing key: session_id").__dict__
+            raise ChatServiceError("Missing key: session_id")
         if message_id is None:
-            return Response().error("Missing key: message_id").__dict__
+            raise ChatServiceError("Missing key: message_id")
 
         try:
             message_id = int(message_id)
-            content = self._sanitize_message_content(content)
+            if not isinstance(content, dict):
+                raise ValueError("Missing key: content")
+            content = sanitize_message_content(content)
         except (TypeError, ValueError) as exc:
-            return Response().error(str(exc)).__dict__
+            raise ChatServiceError(str(exc)) from exc
 
-        username = g.get("username", "guest")
         session = await self.db.get_platform_session_by_id(session_id)
         if not session:
-            return Response().error(f"Session {session_id} not found").__dict__
+            raise ChatServiceError(f"Session {session_id} not found")
         if session.creator != username:
-            return Response().error("Permission denied").__dict__
+            raise ChatServiceError("Permission denied")
 
         record = await self.db.get_platform_message_history_by_id(message_id)
         if not record:
-            return Response().error(f"Message {message_id} not found").__dict__
+            raise ChatServiceError(f"Message {message_id} not found")
         if record.platform_id != session.platform_id or record.user_id != session_id:
-            return Response().error("Message does not belong to the session").__dict__
+            raise ChatServiceError("Message does not belong to the session")
         if not isinstance(record.content, dict):
-            return Response().error("Invalid message content").__dict__
+            raise ChatServiceError("Invalid message content")
         if record.content.get("type") != content.get("type"):
-            return Response().error("Message type cannot be changed").__dict__
+            raise ChatServiceError("Message type cannot be changed")
         if content.get("type") != "user":
-            return Response().error("Only user messages can be edited").__dict__
+            raise ChatServiceError("Only user messages can be edited")
 
-        platform_history = await self._get_sorted_platform_history(session)
+        platform_history = await self.get_sorted_platform_history(session)
         latest_user_record = next(
             (
                 item
@@ -1536,32 +1414,25 @@ class ChatRoute(Route):
             None,
         )
         if not latest_user_record or latest_user_record.id != message_id:
-            return (
-                Response().error("Only the latest user message can be edited").__dict__
-            )
+            raise ChatServiceError("Only the latest user message can be edited")
 
         checkpoint_id = record.llm_checkpoint_id
         if not checkpoint_id:
-            return (
-                Response()
-                .error("This message is not linked to LLM history and cannot be edited")
-                .__dict__
+            raise ChatServiceError(
+                "This message is not linked to LLM history and cannot be edited"
             )
 
-        conversation_id, history = await self._load_current_conversation_history(
-            session
-        )
-        turn_range = self._find_turn_range(history, checkpoint_id)
+        conversation_id, history = await self.load_current_conversation_history(session)
+        turn_range = find_turn_range(history, checkpoint_id)
         if not conversation_id or not turn_range:
-            return Response().error("Linked checkpoint not found").__dict__
-        if not self._is_latest_checkpoint(history, checkpoint_id):
-            return Response().error("Only the latest turn can be edited").__dict__
+            raise ChatServiceError("Linked checkpoint not found")
+        if not is_latest_checkpoint(history, checkpoint_id):
+            raise ChatServiceError("Only the latest turn can be edited")
 
-        start, _end = turn_range
-
-        target_index = self._find_turn_user_index(history, start, _end)
+        start, end = turn_range
+        target_index = find_turn_user_index(history, start, end)
         if target_index is None:
-            return Response().error("Linked user message not found").__dict__
+            raise ChatServiceError("Linked user message not found")
 
         new_checkpoint_id = str(uuid.uuid4())
         truncated_history = history[:start]
@@ -1570,92 +1441,87 @@ class ChatRoute(Route):
             content=content,
             llm_checkpoint_id=new_checkpoint_id,
         )
-        deleted_message_ids = await self._delete_platform_history_after(
+        deleted_message_ids = await self.delete_platform_history_after(
             session, message_id
         )
         thread_ids = await self.db.delete_webchat_threads_by_parent_message_ids(
             session_id,
             deleted_message_ids,
         )
-        await self._delete_threads_by_ids(thread_ids, username)
+        await self.delete_threads_by_ids(thread_ids, username)
         await self.conv_mgr.update_conversation(
-            unified_msg_origin=self._build_webchat_unified_msg_origin(session),
+            unified_msg_origin=build_webchat_unified_msg_origin(session),
             conversation_id=conversation_id,
             history=truncated_history,
         )
         await self.db.update_platform_session(session_id=session_id)
         updated = await self.db.get_platform_message_history_by_id(message_id)
-        return (
-            Response()
-            .ok(
-                data={
-                    "message": updated.model_dump() if updated else None,
-                    "needs_regenerate": True,
-                    "truncated_after_message": True,
-                }
-            )
-            .__dict__
-        )
+        return {
+            "message": updated.model_dump() if updated else None,
+            "needs_regenerate": True,
+            "truncated_after_message": True,
+        }
 
-    async def regenerate_message(self):
-        """Regenerate the latest bot message linked to an LLM checkpoint."""
-        post_data = await request.json
-        if post_data is None:
-            return Response().error("Missing JSON body").__dict__
+    async def update_message_from_dashboard_payload(
+        self,
+        username: str,
+        payload: object,
+    ) -> dict:
+        return await self.update_message(username, self._dashboard_payload(payload))
 
-        session_id = post_data.get("session_id")
-        message_id = post_data.get("message_id")
+    async def prepare_regenerate_message_payload(
+        self,
+        username: str,
+        data: dict,
+    ) -> dict:
+        session_id = data.get("session_id")
+        message_id = data.get("message_id")
         if not session_id:
-            return Response().error("Missing key: session_id").__dict__
+            raise ChatServiceError("Missing key: session_id")
         if message_id is None:
-            return Response().error("Missing key: message_id").__dict__
+            raise ChatServiceError("Missing key: message_id")
 
         try:
             message_id = int(message_id)
-        except (TypeError, ValueError):
-            return Response().error("Invalid key: message_id").__dict__
+        except (TypeError, ValueError) as exc:
+            raise ChatServiceError("Invalid key: message_id") from exc
 
-        username = g.get("username", "guest")
         session = await self.db.get_platform_session_by_id(session_id)
         if not session:
-            return Response().error(f"Session {session_id} not found").__dict__
+            raise ChatServiceError(f"Session {session_id} not found")
         if session.creator != username:
-            return Response().error("Permission denied").__dict__
+            raise ChatServiceError("Permission denied")
 
         target_record = await self.db.get_platform_message_history_by_id(message_id)
         if not target_record:
-            return Response().error(f"Message {message_id} not found").__dict__
+            raise ChatServiceError(f"Message {message_id} not found")
         if (
             target_record.platform_id != session.platform_id
             or target_record.user_id != session_id
         ):
-            return Response().error("Message does not belong to the session").__dict__
+            raise ChatServiceError("Message does not belong to the session")
         if not isinstance(target_record.content, dict):
-            return Response().error("Invalid message content").__dict__
+            raise ChatServiceError("Invalid message content")
         if target_record.content.get("type") != "bot":
-            return Response().error("Only bot messages can be regenerated").__dict__
+            raise ChatServiceError("Only bot messages can be regenerated")
 
         checkpoint_id = target_record.llm_checkpoint_id
         if not checkpoint_id:
-            return Response().error("Message is not linked to LLM history").__dict__
+            raise ChatServiceError("Message is not linked to LLM history")
 
-        conversation_id, history = await self._load_current_conversation_history(
-            session
-        )
-        turn_range = self._find_turn_range(history, checkpoint_id)
+        conversation_id, history = await self.load_current_conversation_history(session)
+        turn_range = find_turn_range(history, checkpoint_id)
         if not conversation_id or not turn_range:
-            return Response().error("Linked checkpoint not found").__dict__
-        if not self._is_latest_checkpoint(history, checkpoint_id):
-            return (
-                Response().error("Regenerating older turns requires branching").__dict__
-            )
+            raise ChatServiceError("Linked checkpoint not found")
+        if not is_latest_checkpoint(history, checkpoint_id):
+            raise ChatServiceError("Regenerating older turns requires branching")
 
         start, end = turn_range
-        user_index = self._find_turn_user_index(history, start, end)
+        user_index = find_turn_user_index(history, start, end)
         if user_index is None:
-            return Response().error("Linked user message not found").__dict__
+            raise ChatServiceError("Linked user message not found")
 
-        platform_history = await self._get_sorted_platform_history(session)
+        platform_history = await self.get_sorted_platform_history(session)
         source_user_record = next(
             (
                 item
@@ -1667,7 +1533,7 @@ class ChatRoute(Route):
             None,
         )
         if not source_user_record:
-            return Response().error("Linked user display message not found").__dict__
+            raise ChatServiceError("Linked user display message not found")
 
         old_bot_record_ids = [
             item.id
@@ -1678,14 +1544,12 @@ class ChatRoute(Route):
             and item.content.get("type") == "bot"
         ]
         if not old_bot_record_ids:
-            return Response().error("Linked bot display message not found").__dict__
+            raise ChatServiceError("Linked bot display message not found")
 
         new_checkpoint_id = str(uuid.uuid4())
-        # The WebChat send path adds the current user message from the prompt.
-        # Remove the whole old turn here to avoid duplicating that user message.
         new_history = history[:start] + history[end + 1 :]
         await self.conv_mgr.update_conversation(
-            unified_msg_origin=self._build_webchat_unified_msg_origin(session),
+            unified_msg_origin=build_webchat_unified_msg_origin(session),
             conversation_id=conversation_id,
             history=new_history,
         )
@@ -1693,7 +1557,7 @@ class ChatRoute(Route):
             session_id,
             old_bot_record_ids,
         )
-        await self._delete_threads_by_ids(thread_ids, username)
+        await self.delete_threads_by_ids(thread_ids, username)
         for old_bot_record_id in old_bot_record_ids:
             await self.platform_history_mgr.delete_by_id(old_bot_record_id)
         await self.platform_history_mgr.update(
@@ -1701,43 +1565,64 @@ class ChatRoute(Route):
             llm_checkpoint_id=new_checkpoint_id,
         )
 
-        return await self.chat(
-            {
-                "session_id": session_id,
-                "message": source_user_record.content.get("message", []),
-                "enable_streaming": post_data.get("enable_streaming", True),
-                "selected_provider": post_data.get("selected_provider"),
-                "selected_model": post_data.get("selected_model"),
-                "_skip_user_history": True,
-                "_llm_checkpoint_id": new_checkpoint_id,
-            }
+        return {
+            "session_id": session_id,
+            "message": source_user_record.content.get("message", []),
+            "enable_streaming": data.get("enable_streaming", True),
+            "selected_provider": data.get("selected_provider"),
+            "selected_model": data.get("selected_model"),
+            "_skip_user_history": True,
+            "_llm_checkpoint_id": new_checkpoint_id,
+        }
+
+    async def prepare_regenerate_message_payload_from_dashboard_payload(
+        self,
+        username: str,
+        payload: object,
+    ) -> dict:
+        return await self.prepare_regenerate_message_payload(
+            username,
+            self._dashboard_payload(payload),
         )
 
-    async def update_session_display_name(self):
-        """Update a Platform session's display name."""
-        post_data = await request.json
-
-        session_id = post_data.get("session_id")
-        display_name = post_data.get("display_name")
-
-        if not session_id:
-            return Response().error("Missing key: session_id").__dict__
-        if display_name is None:
-            return Response().error("Missing key: display_name").__dict__
-
-        username = g.get("username", "guest")
-
-        # 验证会话是否存在且属于当前用户
+    async def update_session_display_name(
+        self,
+        username: str,
+        session_id: str,
+        display_name,
+    ) -> dict:
         session = await self.db.get_platform_session_by_id(session_id)
         if not session:
-            return Response().error(f"Session {session_id} not found").__dict__
+            raise ChatServiceError(f"Session {session_id} not found")
         if session.creator != username:
-            return Response().error("Permission denied").__dict__
+            raise ChatServiceError("Permission denied")
 
-        # 更新 display_name
         await self.db.update_platform_session(
             session_id=session_id,
             display_name=display_name,
         )
+        return {}
 
-        return Response().ok().__dict__
+    async def update_session_display_name_from_dashboard_payload(
+        self,
+        username: str,
+        payload: object,
+    ) -> dict:
+        data = self._dashboard_payload(payload)
+        session_id = data.get("session_id")
+        display_name = data.get("display_name")
+        if not session_id:
+            raise ChatServiceError("Missing key: session_id")
+        if display_name is None:
+            raise ChatServiceError("Missing key: display_name")
+        return await self.update_session_display_name(
+            username, session_id, display_name
+        )
+
+    @staticmethod
+    def _dashboard_payload(payload: object) -> dict:
+        if payload is None:
+            raise ChatServiceError("Missing JSON body")
+        if not isinstance(payload, dict):
+            raise ChatServiceError("Invalid JSON body: expected object")
+        return payload
diff --git a/astrbot/dashboard/services/chatui_project_service.py b/astrbot/dashboard/services/chatui_project_service.py
new file mode 100644
index 000000000..4a928751e
--- /dev/null
+++ b/astrbot/dashboard/services/chatui_project_service.py
@@ -0,0 +1,162 @@
+from __future__ import annotations
+
+from astrbot.core.db import BaseDatabase
+from astrbot.core.utils.datetime_utils import to_utc_isoformat
+
+
+class ChatUIProjectServiceError(Exception):
+    pass
+
+
+class ChatUIProjectService:
+    def __init__(self, db: BaseDatabase) -> None:
+        self.db = db
+
+    async def create_project(self, username: str, data: object) -> dict:
+        payload = self._as_payload(data)
+        title = payload.get("title")
+        emoji = payload.get("emoji", "📁")
+        description = payload.get("description")
+
+        if not title:
+            raise ChatUIProjectServiceError("Missing key: title")
+
+        project = await self.db.create_chatui_project(
+            creator=username,
+            title=title,
+            emoji=emoji,
+            description=description,
+        )
+        return self._serialize_project(project)
+
+    async def list_projects(self, username: str) -> list[dict]:
+        projects = await self.db.get_chatui_projects_by_creator(creator=username)
+        return [self._serialize_project(project) for project in projects]
+
+    async def get_project(self, username: str, project_id: str | None) -> dict:
+        if not project_id:
+            raise ChatUIProjectServiceError("Missing key: project_id")
+
+        project = await self._get_owned_project(username, project_id)
+        return self._serialize_project(project)
+
+    async def get_project_from_query(
+        self,
+        username: str,
+        project_id: str | None,
+    ) -> dict:
+        return await self.get_project(username, project_id)
+
+    async def update_project(self, username: str, data: object) -> None:
+        payload = self._as_payload(data)
+        project_id = payload.get("project_id")
+        if not project_id:
+            raise ChatUIProjectServiceError("Missing key: project_id")
+
+        await self._get_owned_project(username, project_id)
+        await self.db.update_chatui_project(
+            project_id=project_id,
+            title=payload.get("title"),
+            emoji=payload.get("emoji"),
+            description=payload.get("description"),
+        )
+
+    async def delete_project(self, username: str, project_id: str | None) -> None:
+        if not project_id:
+            raise ChatUIProjectServiceError("Missing key: project_id")
+
+        await self._get_owned_project(username, project_id)
+        await self.db.delete_chatui_project(project_id)
+
+    async def delete_project_from_query(
+        self,
+        username: str,
+        project_id: str | None,
+    ) -> None:
+        await self.delete_project(username, project_id)
+
+    async def add_session_to_project(self, username: str, data: object) -> None:
+        payload = self._as_payload(data)
+        session_id = payload.get("session_id")
+        project_id = payload.get("project_id")
+
+        if not session_id:
+            raise ChatUIProjectServiceError("Missing key: session_id")
+        if not project_id:
+            raise ChatUIProjectServiceError("Missing key: project_id")
+
+        await self._get_owned_project(username, project_id)
+        await self._get_owned_session(username, session_id)
+        await self.db.add_session_to_project(session_id, project_id)
+
+    async def remove_session_from_project(self, username: str, data: object) -> None:
+        payload = self._as_payload(data)
+        session_id = payload.get("session_id")
+
+        if not session_id:
+            raise ChatUIProjectServiceError("Missing key: session_id")
+
+        await self._get_owned_session(username, session_id)
+        await self.db.remove_session_from_project(session_id)
+
+    async def get_project_sessions(
+        self,
+        username: str,
+        project_id: str | None,
+    ) -> list[dict]:
+        if not project_id:
+            raise ChatUIProjectServiceError("Missing key: project_id")
+
+        await self._get_owned_project(username, project_id)
+        sessions = await self.db.get_project_sessions(project_id)
+        return [self._serialize_session(session) for session in sessions]
+
+    async def get_project_sessions_from_query(
+        self,
+        username: str,
+        project_id: str | None,
+    ) -> list[dict]:
+        return await self.get_project_sessions(username, project_id)
+
+    async def _get_owned_project(self, username: str, project_id: str):
+        project = await self.db.get_chatui_project_by_id(project_id)
+        if not project:
+            raise ChatUIProjectServiceError(f"Project {project_id} not found")
+        if project.creator != username:
+            raise ChatUIProjectServiceError("Permission denied")
+        return project
+
+    async def _get_owned_session(self, username: str, session_id: str):
+        session = await self.db.get_platform_session_by_id(session_id)
+        if not session:
+            raise ChatUIProjectServiceError(f"Session {session_id} not found")
+        if session.creator != username:
+            raise ChatUIProjectServiceError("Permission denied")
+        return session
+
+    @staticmethod
+    def _serialize_project(project) -> dict:
+        return {
+            "project_id": project.project_id,
+            "title": project.title,
+            "emoji": project.emoji,
+            "description": project.description,
+            "created_at": to_utc_isoformat(project.created_at),
+            "updated_at": to_utc_isoformat(project.updated_at),
+        }
+
+    @staticmethod
+    def _serialize_session(session) -> dict:
+        return {
+            "session_id": session.session_id,
+            "platform_id": session.platform_id,
+            "creator": session.creator,
+            "display_name": session.display_name,
+            "is_group": session.is_group,
+            "created_at": to_utc_isoformat(session.created_at),
+            "updated_at": to_utc_isoformat(session.updated_at),
+        }
+
+    @staticmethod
+    def _as_payload(data: object) -> dict:
+        return data if isinstance(data, dict) else {}
diff --git a/astrbot/dashboard/services/command_service.py b/astrbot/dashboard/services/command_service.py
new file mode 100644
index 000000000..a978d3ad4
--- /dev/null
+++ b/astrbot/dashboard/services/command_service.py
@@ -0,0 +1,104 @@
+from __future__ import annotations
+
+from astrbot.core.config.astrbot_config import AstrBotConfig
+from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
+from astrbot.core.star.command_management import (
+    list_command_conflicts,
+    list_commands,
+    rename_command,
+    toggle_command,
+    update_command_permission,
+)
+
+
+class CommandServiceError(Exception):
+    pass
+
+
+class CommandService:
+    def __init__(
+        self,
+        config: AstrBotConfig,
+        core_lifecycle: AstrBotCoreLifecycle | None = None,
+    ) -> None:
+        self.config = config
+        self.core_lifecycle = core_lifecycle
+
+    async def list_commands(self, config_id: str = "") -> dict:
+        commands = await list_commands()
+        summary = {
+            "total": len(commands),
+            "disabled": len([cmd for cmd in commands if not cmd["enabled"]]),
+            "conflicts": len([cmd for cmd in commands if cmd.get("has_conflict")]),
+        }
+        wake_prefix = self._get_wake_prefix(config_id)
+        return {
+            "items": commands,
+            "summary": summary,
+            "wake_prefix": wake_prefix,
+        }
+
+    async def list_conflicts(self):
+        return await list_command_conflicts()
+
+    async def toggle_command(self, handler_full_name: str | None, enabled) -> dict:
+        if handler_full_name is None or enabled is None:
+            raise CommandServiceError("handler_full_name 与 enabled 均为必填。")
+
+        if isinstance(enabled, str):
+            enabled = enabled.lower() in ("1", "true", "yes", "on")
+
+        try:
+            await toggle_command(handler_full_name, bool(enabled))
+        except ValueError as exc:
+            raise CommandServiceError(str(exc)) from exc
+
+        return await self._get_command_payload(handler_full_name)
+
+    async def rename_command(
+        self,
+        handler_full_name: str | None,
+        new_name: str | None,
+        aliases=None,
+    ) -> dict:
+        if not handler_full_name or not new_name:
+            raise CommandServiceError("handler_full_name 与 new_name 均为必填。")
+
+        try:
+            await rename_command(handler_full_name, new_name, aliases=aliases)
+        except ValueError as exc:
+            raise CommandServiceError(str(exc)) from exc
+
+        return await self._get_command_payload(handler_full_name)
+
+    async def update_permission(
+        self,
+        handler_full_name: str | None,
+        permission: str | None,
+    ) -> dict:
+        if not handler_full_name or not permission:
+            raise CommandServiceError("handler_full_name 与 permission 均为必填。")
+
+        try:
+            await update_command_permission(handler_full_name, permission)
+        except ValueError as exc:
+            raise CommandServiceError(str(exc)) from exc
+
+        return await self._get_command_payload(handler_full_name)
+
+    def _get_wake_prefix(self, config_id: str) -> list:
+        wake_prefix = self.config.get("wake_prefix", ["/"])
+        config_id = config_id.strip()
+        if config_id and self.core_lifecycle:
+            config_mgr = getattr(self.core_lifecycle, "astrbot_config_mgr", None)
+            if config_mgr and config_id in config_mgr.confs:
+                return config_mgr.confs[config_id].get("wake_prefix", wake_prefix)
+        return wake_prefix
+
+    @staticmethod
+    async def _get_command_payload(handler_full_name: str) -> dict:
+        commands = await list_commands()
+        for cmd in commands:
+            if cmd["handler_full_name"] == handler_full_name:
+                return cmd
+        return {}
diff --git a/astrbot/dashboard/services/config_service.py b/astrbot/dashboard/services/config_service.py
new file mode 100644
index 000000000..f7c06ce25
--- /dev/null
+++ b/astrbot/dashboard/services/config_service.py
@@ -0,0 +1,1713 @@
+from __future__ import annotations
+
+import asyncio
+import copy
+import inspect
+import os
+import traceback
+from pathlib import Path
+from typing import Any
+
+from astrbot.core import file_token_service, logger
+from astrbot.core.config.astrbot_config import AstrBotConfig
+from astrbot.core.config.default import (
+    CONFIG_METADATA_2,
+    CONFIG_METADATA_3,
+    CONFIG_METADATA_3_SYSTEM,
+    DEFAULT_CONFIG,
+    DEFAULT_VALUE_MAP,
+)
+from astrbot.core.config.i18n_utils import ConfigMetadataI18n
+from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
+from astrbot.core.db import BaseDatabase
+from astrbot.core.platform.register import platform_cls_map, platform_registry
+from astrbot.core.provider.register import provider_registry
+from astrbot.core.star.star import star_registry
+from astrbot.core.utils.astrbot_path import get_astrbot_plugin_data_path
+from astrbot.core.utils.totp import (
+    is_totp_enabled,
+    revoke_user_trusted_devices,
+    set_pending_totp_secret,
+    verify_configured_2fa_code,
+)
+from astrbot.core.utils.webhook_utils import ensure_platform_webhook_config
+from astrbot.dashboard.async_utils import run_maybe_async
+from astrbot.dashboard.responses import ApiError
+
+PROTECTED_2FA_CONFIG_PATHS = (
+    ("dashboard", "totp", "enable"),
+    ("dashboard", "totp", "secret"),
+    ("dashboard", "totp", "recovery_code_hash"),
+)
+MAX_FILE_BYTES = 500 * 1024 * 1024
+
+
+def try_cast(value: Any, type_: str):
+    if type_ == "int":
+        try:
+            return int(value)
+        except (ValueError, TypeError):
+            return None
+    elif (
+        type_ == "float"
+        and isinstance(value, str)
+        and value.replace(".", "", 1).isdigit()
+    ) or (type_ == "float" and isinstance(value, int)):
+        return float(value)
+    elif type_ == "float":
+        try:
+            return float(value)
+        except (ValueError, TypeError):
+            return None
+
+
+def _expect_type(value, expected_type, path_key, errors, expected_name=None) -> bool:
+    if not isinstance(value, expected_type):
+        errors.append(
+            f"错误的类型 {path_key}: 期望是 {expected_name or expected_type.__name__}, "
+            f"得到了 {type(value).__name__}"
+        )
+        return False
+    return True
+
+
+def _validate_template_list(value, meta, path_key, errors, validate_fn) -> None:
+    if not _expect_type(value, list, path_key, errors, "list"):
+        return
+
+    templates = meta.get("templates")
+    if not isinstance(templates, dict):
+        templates = {}
+
+    for idx, item in enumerate(value):
+        item_path = f"{path_key}[{idx}]"
+        if not _expect_type(item, dict, item_path, errors, "dict"):
+            continue
+
+        template_key = item.get("__template_key") or item.get("template")
+        if not template_key:
+            errors.append(f"缺少模板选择 {item_path}: 需要 __template_key")
+            continue
+
+        template_meta = templates.get(template_key)
+        if not template_meta:
+            errors.append(f"未知模板 {item_path}: {template_key}")
+            continue
+
+        validate_fn(
+            item,
+            template_meta.get("items", {}),
+            path=f"{path_key}.templates.{template_key}.",
+        )
+
+
+def sanitize_path_segment(segment: str) -> str:
+    cleaned = []
+    for ch in segment:
+        if (
+            ("a" <= ch <= "z")
+            or ("A" <= ch <= "Z")
+            or ch.isdigit()
+            or ch
+            in {
+                "-",
+                "_",
+            }
+        ):
+            cleaned.append(ch)
+        else:
+            cleaned.append("_")
+    result = "".join(cleaned).strip("_")
+    return result or "_"
+
+
+def _config_key_to_folder(key_path: str) -> str:
+    parts = [sanitize_path_segment(part) for part in key_path.split(".") if part]
+    return "/".join(parts) if parts else "_"
+
+
+def config_key_to_folder(key_path: str) -> str:
+    return _config_key_to_folder(key_path)
+
+
+def _normalize_rel_path(path: object) -> str | None:
+    if not isinstance(path, str):
+        return None
+    rel = path.replace("\\", "/").lstrip("/")
+    if not rel:
+        return None
+    parts = [part for part in rel.split("/") if part]
+    if any(part in {".", ".."} for part in parts):
+        return None
+    if rel.startswith("../") or "/../" in rel:
+        return None
+    return "/".join(parts)
+
+
+def normalize_rel_path(path: str | None) -> str | None:
+    return _normalize_rel_path(path)
+
+
+def _get_schema_item(schema: dict | None, key_path: str) -> dict | None:
+    if not isinstance(schema, dict) or not key_path:
+        return None
+    if key_path in schema:
+        return schema.get(key_path)
+
+    parts = key_path.split(".")
+    current = schema
+    idx = 0
+    while idx < len(parts):
+        part = parts[idx]
+        if part not in current:
+            return None
+        meta = current.get(part)
+        if idx == len(parts) - 1:
+            return meta
+        if not isinstance(meta, dict) or meta.get("type") != "object":
+            if not isinstance(meta, dict) or meta.get("type") != "template_list":
+                return None
+            if idx + 2 >= len(parts) or parts[idx + 1] != "templates":
+                return None
+            template_meta = meta.get("templates", {}).get(parts[idx + 2])
+            if not isinstance(template_meta, dict):
+                return None
+            if idx + 2 == len(parts) - 1:
+                return template_meta
+            current = template_meta.get("items", {})
+            idx += 3
+            continue
+        current = meta.get("items", {})
+        idx += 1
+    return None
+
+
+def get_schema_item(schema: dict | None, key_path: str) -> dict | None:
+    return _get_schema_item(schema, key_path)
+
+
+def _sanitize_filename(name: str) -> str:
+    cleaned = os.path.basename(name).strip()
+    if not cleaned or cleaned in {".", ".."}:
+        return ""
+    for sep in (os.sep, os.altsep):
+        if sep:
+            cleaned = cleaned.replace(sep, "_")
+    return cleaned
+
+
+def sanitize_filename(name: str) -> str:
+    return _sanitize_filename(name)
+
+
+def validate_config(data, schema: dict, is_core: bool) -> tuple[list[str], dict]:
+    errors = []
+
+    def validate(data: dict, metadata: dict = schema, path="") -> None:
+        for key, value in data.items():
+            if key not in metadata:
+                continue
+            meta = metadata[key]
+            if "type" not in meta:
+                logger.debug(f"配置项 {path}{key} 没有类型定义, 跳过校验")
+                continue
+            if value is None:
+                data[key] = DEFAULT_VALUE_MAP[meta["type"]]
+                continue
+
+            if meta["type"] == "template_list":
+                _validate_template_list(value, meta, f"{path}{key}", errors, validate)
+                continue
+
+            if meta["type"] == "file":
+                if not _expect_type(value, list, f"{path}{key}", errors, "list"):
+                    continue
+                for idx, item in enumerate(value):
+                    if not isinstance(item, str):
+                        errors.append(
+                            f"Invalid type {path}{key}[{idx}]: expected string, got {type(item).__name__}",
+                        )
+                        continue
+                    normalized = _normalize_rel_path(item)
+                    if not normalized or not normalized.startswith("files/"):
+                        errors.append(
+                            f"Invalid file path {path}{key}[{idx}]: {item}",
+                        )
+                        continue
+                    key_path = f"{path}{key}"
+                    expected_folder = _config_key_to_folder(key_path)
+                    expected_prefix = f"files/{expected_folder}/"
+                    if not normalized.startswith(expected_prefix):
+                        errors.append(
+                            f"Invalid file path {path}{key}[{idx}]: {item}",
+                        )
+                        continue
+                    value[idx] = normalized
+                continue
+
+            if meta["type"] == "list" and not isinstance(value, list):
+                errors.append(
+                    f"错误的类型 {path}{key}: 期望是 list, 得到了 {type(value).__name__}",
+                )
+            elif (
+                meta["type"] == "list"
+                and isinstance(value, list)
+                and value
+                and "items" in meta
+                and isinstance(value[0], dict)
+            ):
+                for item in value:
+                    validate(item, meta["items"], path=f"{path}{key}.")
+            elif meta["type"] == "object" and isinstance(value, dict):
+                validate(value, meta["items"], path=f"{path}{key}.")
+
+            if meta["type"] == "int" and not isinstance(value, int):
+                casted = try_cast(value, "int")
+                if casted is None:
+                    errors.append(
+                        f"错误的类型 {path}{key}: 期望是 int, 得到了 {type(value).__name__}",
+                    )
+                data[key] = casted
+            elif meta["type"] == "float" and not isinstance(value, float):
+                casted = try_cast(value, "float")
+                if casted is None:
+                    errors.append(
+                        f"错误的类型 {path}{key}: 期望是 float, 得到了 {type(value).__name__}",
+                    )
+                data[key] = casted
+            elif meta["type"] == "bool" and not isinstance(value, bool):
+                errors.append(
+                    f"错误的类型 {path}{key}: 期望是 bool, 得到了 {type(value).__name__}",
+                )
+            elif meta["type"] in ["string", "text"] and not isinstance(value, str):
+                errors.append(
+                    f"错误的类型 {path}{key}: 期望是 string, 得到了 {type(value).__name__}",
+                )
+            elif meta["type"] == "list" and not isinstance(value, list):
+                errors.append(
+                    f"错误的类型 {path}{key}: 期望是 list, 得到了 {type(value).__name__}",
+                )
+            elif meta["type"] == "object" and not isinstance(value, dict):
+                errors.append(
+                    f"错误的类型 {path}{key}: 期望是 dict, 得到了 {type(value).__name__}",
+                )
+
+    if is_core:
+        meta_all = {
+            **schema["platform_group"]["metadata"],
+            **schema["provider_group"]["metadata"],
+            **schema["misc_config_group"]["metadata"],
+        }
+        validate(data, meta_all)
+    else:
+        validate(data, schema)
+
+    return errors, data
+
+
+def _log_computer_config_changes(
+    old_config: dict,
+    new_config: dict,
+    *,
+    log_info=None,
+) -> None:
+    log_info = log_info or logger.info
+    old_ps = old_config.get("provider_settings", {})
+    new_ps = new_config.get("provider_settings", {})
+
+    old_runtime = old_ps.get("computer_use_runtime", "none")
+    new_runtime = new_ps.get("computer_use_runtime", "none")
+    if old_runtime != new_runtime:
+        log_info(
+            "[Computer] Config changed: computer_use_runtime %s -> %s",
+            old_runtime,
+            new_runtime,
+        )
+
+    old_sandbox = old_ps.get("sandbox", {})
+    new_sandbox = new_ps.get("sandbox", {})
+    all_keys = set(old_sandbox.keys()) | set(new_sandbox.keys())
+    for key in sorted(all_keys):
+        old_val = old_sandbox.get(key)
+        new_val = new_sandbox.get(key)
+        if old_val == new_val:
+            continue
+        if "token" in key or "secret" in key:
+            old_display = "***" if old_val else "(empty)"
+            new_display = "***" if new_val else "(empty)"
+        else:
+            old_display = old_val
+            new_display = new_val
+        log_info(
+            "[Computer] Config changed: sandbox.%s %s -> %s",
+            key,
+            old_display,
+            new_display,
+        )
+
+
+def _get_nested_value(data: dict, path: tuple[str, ...]) -> Any:
+    current = data
+    for key in path:
+        if not isinstance(current, dict) or key not in current:
+            return None
+        current = current[key]
+    return current
+
+
+def _set_nested_value(data: dict, path: tuple[str, ...], value: Any) -> None:
+    current = data
+    for key in path[:-1]:
+        next_value = current.get(key)
+        if not isinstance(next_value, dict):
+            next_value = {}
+            current[key] = next_value
+        current = next_value
+    current[path[-1]] = value
+
+
+def _protected_2fa_config_changed(old_config: dict, new_config: dict) -> bool:
+    return any(
+        _get_nested_value(old_config, path) != _get_nested_value(new_config, path)
+        for path in PROTECTED_2FA_CONFIG_PATHS
+    )
+
+
+async def _validate_neo_connectivity(post_config: dict) -> str | None:
+    ps = post_config.get("provider_settings", {})
+    runtime = ps.get("computer_use_runtime", "none")
+    sandbox = ps.get("sandbox", {})
+    booter = sandbox.get("booter", "")
+
+    if runtime != "sandbox" or booter != "shipyard_neo":
+        return None
+
+    endpoint = sandbox.get("shipyard_neo_endpoint", "").rstrip("/")
+    if not endpoint:
+        return "⚠️ Shipyard Neo endpoint 未设置"
+
+    access_token = sandbox.get("shipyard_neo_access_token", "")
+    if not access_token:
+        from astrbot.core.computer.computer_client import _discover_bay_credentials
+
+        access_token = _discover_bay_credentials(endpoint)
+
+    if not access_token:
+        return (
+            "⚠️ 未找到 Bay API Key。请填写访问令牌，"
+            "或确保 Bay 的 credentials.json 可被自动发现。"
+        )
+
+    import aiohttp
+
+    health_url = f"{endpoint}/health"
+    try:
+        async with aiohttp.ClientSession() as session:
+            async with session.get(
+                health_url,
+                timeout=aiohttp.ClientTimeout(total=5),
+            ) as resp:
+                if resp.status != 200:
+                    return (
+                        f"⚠️ Bay 健康检查失败 (HTTP {resp.status})，"
+                        f"请确认 Bay 正在运行: {endpoint}"
+                    )
+    except Exception:
+        return f"⚠️ 无法连接 Bay ({endpoint})，请确认 Bay 已启动。"
+
+    return None
+
+
+def save_config(
+    post_config: dict,
+    config: AstrBotConfig,
+    is_core: bool = False,
+) -> None:
+    if is_core:
+        _log_computer_config_changes(dict(config), post_config)
+
+    try:
+        if is_core:
+            errors, post_config = validate_config(
+                post_config,
+                CONFIG_METADATA_2,
+                is_core,
+            )
+        else:
+            errors, post_config = validate_config(
+                post_config,
+                getattr(config, "schema", {}),
+                is_core,
+            )
+    except BaseException as exc:
+        logger.error(traceback.format_exc())
+        logger.warning(f"验证配置时出现异常: {exc}")
+        raise ValueError(f"验证配置时出现异常: {exc}")
+    if errors:
+        raise ValueError(f"格式校验未通过: {errors}")
+
+    config.save_config(post_config)
+
+
+class ConfigProfileService:
+    def __init__(
+        self,
+        core_lifecycle: AstrBotCoreLifecycle,
+        db: BaseDatabase | None = None,
+    ) -> None:
+        self.core_lifecycle = core_lifecycle
+        self.acm = core_lifecycle.astrbot_config_mgr
+        self.db = db
+
+    def get_profile_schema(self) -> dict:
+        return {
+            "config": DEFAULT_CONFIG,
+            "metadata": ConfigMetadataI18n.convert_to_i18n_keys(CONFIG_METADATA_3),
+        }
+
+    def get_system_schema(self) -> dict:
+        return {
+            "config": self.acm.confs["default"],
+            "metadata": ConfigMetadataI18n.convert_to_i18n_keys(
+                CONFIG_METADATA_3_SYSTEM
+            ),
+        }
+
+    def get_system_config(self) -> dict:
+        return self.get_system_schema()
+
+    def list_profiles(self) -> dict:
+        return {"info_list": self.acm.get_conf_list()}
+
+    async def create_profile(self, name: str | None, config: dict | None) -> dict:
+        conf_id = self.acm.create_conf(name=name, config=config or DEFAULT_CONFIG)
+        await self.core_lifecycle.reload_pipeline_scheduler(conf_id)
+        return {"conf_id": conf_id}
+
+    async def create_profile_from_dashboard_payload(
+        self,
+        payload: object,
+    ) -> dict:
+        data = payload if isinstance(payload, dict) else {}
+        if not data:
+            raise ValueError("缺少配置数据")
+        return await self.create_profile(data.get("name"), data.get("config"))
+
+    def get_profile(self, config_id: str) -> dict:
+        if config_id not in self.acm.confs:
+            raise ValueError(f"Config file {config_id} does not exist")
+        return {
+            "config": self.acm.confs[config_id],
+            "metadata": ConfigMetadataI18n.convert_to_i18n_keys(CONFIG_METADATA_3),
+        }
+
+    def get_profile_from_dashboard_query(
+        self,
+        *,
+        config_id: str | None,
+        system_config: bool,
+    ) -> dict:
+        if not config_id and not system_config:
+            raise ValueError("缺少配置文件 ID")
+        if system_config:
+            return self.get_system_schema()
+        if config_id is None:
+            raise ValueError("abconf_id cannot be None")
+        return self.get_profile(config_id)
+
+    def get_profile_from_dashboard_args(self, args) -> dict:
+        system_config = str(args.get("system_config", "0")).lower() == "1"
+        return self.get_profile_from_dashboard_query(
+            config_id=args.get("id"),
+            system_config=system_config,
+        )
+
+    async def update_profile(
+        self,
+        config_id: str,
+        config: dict,
+        *,
+        two_factor_code: str | None = None,
+    ) -> str | None:
+        if config_id not in self.acm.confs:
+            raise ValueError(f"Config file {config_id} does not exist")
+        config = copy.deepcopy(config)
+        if config_id == "default":
+            default_conf = getattr(self.acm, "default_conf", self.acm.confs["default"])
+            for key in ("provider_sources", "provider", "platform"):
+                config[key] = default_conf.get(key, [])
+
+        current_config = self.acm.confs[config_id]
+        protected_2fa_changed = _protected_2fa_config_changed(current_config, config)
+        if (
+            is_totp_enabled(current_config)
+            and protected_2fa_changed
+            and not await self._verify_config_2fa(current_config, two_factor_code)
+        ):
+            raise ApiError(
+                "需要 TOTP 验证",
+                status_code=401,
+                data={"totp_required": True},
+            )
+
+        if not _get_nested_value(config, ("dashboard", "totp", "enable")):
+            _set_nested_value(config, ("dashboard", "totp", "secret"), "")
+            _set_nested_value(config, ("dashboard", "totp", "recovery_code_hash"), "")
+
+        set_pending_totp_secret(None)
+        save_config(config, self.acm.confs[config_id], is_core=True)
+        if protected_2fa_changed and self.db is not None:
+            await revoke_user_trusted_devices(self.db)
+        await self.core_lifecycle.reload_pipeline_scheduler(config_id)
+        warning = await _validate_neo_connectivity(config)
+        if warning:
+            return f"保存成功。{warning}"
+        return "保存成功~"
+
+    async def update_profile_from_dashboard_payload(
+        self,
+        payload: object,
+        *,
+        two_factor_code: str | None = None,
+    ) -> str | None:
+        data = payload if isinstance(payload, dict) else {}
+        if not isinstance(payload, dict):
+            raise ValueError("Invalid request payload")
+        config = data.get("config")
+        conf_id = data.get("conf_id")
+        if not isinstance(config, dict):
+            raise ValueError("Invalid config payload")
+        return await self.update_profile(
+            str(conf_id),
+            config,
+            two_factor_code=two_factor_code,
+        )
+
+    @staticmethod
+    async def _verify_config_2fa(
+        current_config: dict,
+        two_factor_code: str | None,
+    ) -> bool:
+        code = (two_factor_code or "").strip()
+        if not code:
+            return False
+        return bool(
+            await verify_configured_2fa_code(
+                current_config,
+                code,
+                include_pending=True,
+                allow_recovery=False,
+            )
+        )
+
+    def rename_profile(self, config_id: str, name: str | None) -> None:
+        if not self.acm.update_conf_info(config_id, name=name):
+            raise ValueError("Failed to update config profile")
+
+    def rename_profile_from_dashboard_payload(self, payload: object) -> str:
+        data = payload if isinstance(payload, dict) else {}
+        if not data:
+            raise ValueError("缺少配置数据")
+        conf_id = data.get("id")
+        if not conf_id:
+            raise ValueError("缺少配置文件 ID")
+        self.rename_profile(str(conf_id), name=data.get("name"))
+        return "更新成功"
+
+    def delete_profile(self, config_id: str) -> None:
+        if not self.acm.delete_conf(config_id):
+            raise ValueError("Failed to delete config profile")
+        self.core_lifecycle.pipeline_scheduler_mapping.pop(config_id, None)
+
+    def delete_profile_from_dashboard_payload(self, payload: object) -> str:
+        data = payload if isinstance(payload, dict) else {}
+        if not data:
+            raise ValueError("缺少配置数据")
+        conf_id = data.get("id")
+        if not conf_id:
+            raise ValueError("缺少配置文件 ID")
+        self.delete_profile(str(conf_id))
+        return "删除成功"
+
+
+class ConfigRoutingService:
+    def __init__(self, core_lifecycle: AstrBotCoreLifecycle) -> None:
+        self.ucr = core_lifecycle.umop_config_router
+
+    def list_routes(self) -> dict:
+        return {"routing": self.ucr.umop_to_conf_id}
+
+    async def replace_route_mapping(self, routing: dict[str, str]) -> None:
+        await self.ucr.update_routing_data(routing)
+
+    async def replace_routes(self, data: object) -> None:
+        payload = data if isinstance(data, dict) else {}
+        new_routing = payload.get("routing")
+        if not isinstance(new_routing, dict):
+            raise ValueError("缺少或错误的路由表数据")
+        await self.replace_route_mapping(new_routing)
+
+    async def replace_routes_from_dashboard_payload(self, payload: object) -> str:
+        if not isinstance(payload, dict) or not payload:
+            raise ValueError("缺少配置数据")
+        await self.replace_routes(payload)
+        return "更新成功"
+
+    async def upsert_route(self, data: object) -> None:
+        payload = data if isinstance(data, dict) else {}
+        umo = payload.get("umo")
+        conf_id = payload.get("conf_id")
+        if not umo or not conf_id:
+            raise ValueError("缺少 UMO 或配置文件 ID")
+        await self.set_route(str(umo), str(conf_id))
+
+    async def set_route(self, umo: str, config_id: str) -> None:
+        if config_id == "default":
+            await self.delete_route_by_umo(umo)
+            return
+        await self.ucr.update_route(umo, config_id)
+
+    async def upsert_route_from_dashboard_payload(self, payload: object) -> str:
+        if not isinstance(payload, dict) or not payload:
+            raise ValueError("缺少配置数据")
+        await self.upsert_route(payload)
+        return "更新成功"
+
+    async def delete_route(self, data: object) -> None:
+        payload = data if isinstance(data, dict) else {}
+        umo = payload.get("umo")
+        if not umo:
+            raise ValueError("缺少 UMO")
+        await self.delete_route_by_umo(str(umo))
+
+    async def delete_route_by_umo(self, umo: str) -> None:
+        if umo in self.ucr.umop_to_conf_id:
+            del self.ucr.umop_to_conf_id[umo]
+            await self.ucr.update_routing_data(self.ucr.umop_to_conf_id)
+
+    async def delete_route_from_dashboard_payload(self, payload: object) -> str:
+        if not isinstance(payload, dict) or not payload:
+            raise ValueError("缺少配置数据")
+        await self.delete_route(payload)
+        return "删除成功"
+
+
+class ConfigDisplayService:
+    def __init__(self, core_lifecycle: AstrBotCoreLifecycle) -> None:
+        self.core_lifecycle = core_lifecycle
+        self.config = core_lifecycle.astrbot_config
+        self._logo_token_cache: dict[str, str] = {}
+
+    async def get_configs(self, plugin_name: str | None = None) -> dict:
+        if not plugin_name:
+            return await self.get_astrbot_config()
+        return self.get_plugin_config(plugin_name)
+
+    async def get_configs_from_dashboard_args(self, args) -> dict:
+        return await self.get_configs(args.get("plugin_name", None))
+
+    async def get_astrbot_config(self) -> dict:
+        metadata = copy.deepcopy(CONFIG_METADATA_2)
+        platform_i18n = ConfigMetadataI18n.convert_to_i18n_keys(
+            {
+                "platform_group": {
+                    "metadata": {
+                        "platform": metadata["platform_group"]["metadata"]["platform"]
+                    }
+                }
+            }
+        )
+        metadata["platform_group"]["metadata"]["platform"] = platform_i18n[
+            "platform_group"
+        ]["metadata"]["platform"]
+
+        platform_default_tmpl = metadata["platform_group"]["metadata"]["platform"][
+            "config_template"
+        ]
+        platform_i18n_translations = {}
+        logo_registration_tasks = []
+
+        for platform in platform_registry:
+            if not platform.default_config_tmpl:
+                continue
+
+            platform_default_tmpl[platform.name] = copy.deepcopy(
+                platform.default_config_tmpl
+            )
+            if platform.config_metadata:
+                self.inject_platform_metadata_with_i18n(
+                    platform,
+                    metadata,
+                    platform_i18n_translations,
+                )
+            if platform.logo_path:
+                logo_registration_tasks.append(
+                    self.register_platform_logo(platform, platform_default_tmpl),
+                )
+
+        if logo_registration_tasks:
+            await asyncio.gather(*logo_registration_tasks, return_exceptions=True)
+
+        provider_default_tmpl = metadata["provider_group"]["metadata"]["provider"][
+            "config_template"
+        ]
+        for provider in provider_registry:
+            if provider.default_config_tmpl:
+                provider_default_tmpl[provider.type] = provider.default_config_tmpl
+
+        return {
+            "metadata": metadata,
+            "config": self.config,
+            "platform_i18n_translations": platform_i18n_translations,
+        }
+
+    def get_plugin_config(self, plugin_name: str) -> dict:
+        result: dict = {"metadata": None, "config": None, "i18n": {}}
+
+        for plugin_md in star_registry:
+            if plugin_md.name != plugin_name:
+                continue
+            if not plugin_md.config:
+                break
+            result["config"] = plugin_md.config
+            result["metadata"] = {
+                plugin_name: {
+                    "description": f"{plugin_name} 配置",
+                    "type": "object",
+                    "items": plugin_md.config.schema,
+                },
+            }
+            result["i18n"] = plugin_md.i18n
+            break
+
+        return result
+
+    async def register_platform_logo(self, platform, platform_default_tmpl) -> None:
+        if not platform.logo_path:
+            return
+
+        try:
+            cache_key = f"{platform.name}:{platform.logo_path}"
+            if cache_key in self._logo_token_cache:
+                self._set_platform_logo_token(
+                    platform_default_tmpl,
+                    platform.name,
+                    self._logo_token_cache[cache_key],
+                )
+                logger.debug(f"Using cached logo token for platform {platform.name}")
+                return
+
+            platform_cls = platform_cls_map.get(platform.name)
+            if not platform_cls:
+                logger.warning(f"Platform class not found for {platform.name}")
+                return
+
+            module_file = inspect.getfile(platform_cls)
+            plugin_dir = os.path.dirname(module_file)
+            logo_file_path = os.path.join(plugin_dir, platform.logo_path)
+
+            if not os.path.exists(logo_file_path):
+                logger.warning(
+                    f"Platform {platform.name} logo file not found: {logo_file_path}",
+                )
+                return
+
+            logo_token = await file_token_service.register_file(
+                logo_file_path,
+                timeout=3600,
+            )
+            self._set_platform_logo_token(
+                platform_default_tmpl,
+                platform.name,
+                logo_token,
+            )
+            self._logo_token_cache[cache_key] = logo_token
+            logger.debug(f"Logo token registered for platform {platform.name}")
+
+        except (ImportError, AttributeError) as exc:
+            logger.warning(
+                f"Failed to import required modules for platform {platform.name}: {exc}",
+            )
+        except OSError as exc:
+            logger.warning(
+                f"File system error for platform {platform.name} logo: {exc}"
+            )
+        except Exception as exc:
+            logger.warning(
+                f"Unexpected error registering logo for platform {platform.name}: {exc}",
+            )
+
+    @staticmethod
+    def _set_platform_logo_token(
+        platform_default_tmpl: dict,
+        platform_name: str,
+        logo_token: str,
+    ) -> None:
+        if platform_name not in platform_default_tmpl or not isinstance(
+            platform_default_tmpl[platform_name],
+            dict,
+        ):
+            platform_default_tmpl[platform_name] = {}
+        platform_default_tmpl[platform_name]["logo_token"] = logo_token
+
+    @staticmethod
+    def inject_platform_metadata_with_i18n(
+        platform,
+        metadata,
+        platform_i18n_translations: dict,
+    ) -> None:
+        metadata["platform_group"]["metadata"]["platform"].setdefault("items", {})
+        platform_items_to_inject = copy.deepcopy(platform.config_metadata)
+
+        if platform.i18n_resources:
+            i18n_prefix = f"platform_group.platform.{platform.name}"
+
+            for lang, lang_data in platform.i18n_resources.items():
+                platform_i18n_translations.setdefault(lang, {}).setdefault(
+                    "platform_group", {}
+                ).setdefault("platform", {})[platform.name] = lang_data
+
+            for field_key, field_value in platform_items_to_inject.items():
+                for key in ("description", "hint", "labels"):
+                    if key in field_value:
+                        field_value[key] = f"{i18n_prefix}.{field_key}.{key}"
+
+        metadata["platform_group"]["metadata"]["platform"]["items"].update(
+            platform_items_to_inject
+        )
+
+
+class ConfigFileService:
+    def __init__(self, core_lifecycle: AstrBotCoreLifecycle) -> None:
+        self.core_lifecycle = core_lifecycle
+
+    def get_plugin_metadata_by_name(self, plugin_name: str):
+        for plugin_md in star_registry:
+            if plugin_md.name == plugin_name:
+                return plugin_md
+        return None
+
+    def resolve_config_file_scope(
+        self,
+        *,
+        scope: str | None,
+        name: str | None,
+        key_path: str | None,
+    ):
+        scope = scope or "plugin"
+        if scope != "plugin":
+            raise ValueError(f"Unsupported scope: {scope}")
+        if not name or not key_path:
+            raise ValueError("Missing name or key parameter")
+
+        metadata = self.get_plugin_metadata_by_name(name)
+        if not metadata or not metadata.config:
+            raise ValueError(f"Plugin {name} not found or has no config")
+
+        return scope, name, key_path, metadata, metadata.config
+
+    async def save_plugin_configs(
+        self,
+        post_configs: dict,
+        plugin_name: str,
+    ) -> None:
+        metadata = self.get_plugin_metadata_by_name(plugin_name)
+        if not metadata:
+            raise ValueError(f"插件 {plugin_name} 不存在")
+        if not metadata.config:
+            raise ValueError(f"插件 {plugin_name} 没有注册配置")
+
+        errors, post_configs = validate_config(
+            post_configs,
+            getattr(metadata.config, "schema", {}),
+            is_core=False,
+        )
+        if errors:
+            raise ValueError(f"格式校验未通过: {errors}")
+        metadata.config.save_config(post_configs)
+        await self.core_lifecycle.plugin_manager.reload(plugin_name)
+
+    async def save_plugin_configs_from_dashboard_payload(
+        self,
+        payload: object,
+        *,
+        plugin_name: str,
+    ) -> str:
+        post_configs = payload if isinstance(payload, dict) else {}
+        await self.save_plugin_configs(post_configs, plugin_name)
+        return f"保存插件 {plugin_name} 成功~ 机器人正在热重载插件。"
+
+    async def upload_config_file(
+        self,
+        *,
+        scope: str | None,
+        name: str | None,
+        key_path: str | None,
+        files,
+    ) -> dict:
+        _, name, key_path, _, config = self.resolve_config_file_scope(
+            scope=scope,
+            name=name,
+            key_path=key_path,
+        )
+        meta = _get_schema_item(getattr(config, "schema", None), key_path)
+        if not meta or meta.get("type") != "file":
+            raise ValueError("Config item not found or not file type")
+        if not files:
+            raise ValueError("No files uploaded")
+
+        allowed_exts = self._allowed_file_extensions(meta)
+        plugin_root_path = self._plugin_root_path(name)
+        plugin_root_path.mkdir(parents=True, exist_ok=True)
+
+        uploaded: list[str] = []
+        errors: list[str] = []
+        folder = _config_key_to_folder(key_path)
+
+        for file in files.values():
+            filename = _sanitize_filename(file.filename or "")
+            if not filename:
+                errors.append("Invalid filename")
+                continue
+
+            file_size = getattr(file, "content_length", None)
+            if isinstance(file_size, int) and file_size > MAX_FILE_BYTES:
+                errors.append(f"File too large: {filename}")
+                continue
+
+            ext = os.path.splitext(filename)[1].lstrip(".").lower()
+            if allowed_exts and ext not in allowed_exts:
+                errors.append(f"Unsupported file type: {filename}")
+                continue
+
+            rel_path = f"files/{folder}/{filename}"
+            save_path = self._safe_plugin_path(plugin_root_path, rel_path)
+            if save_path is None:
+                errors.append(f"Invalid path: {filename}")
+                continue
+
+            save_path.parent.mkdir(parents=True, exist_ok=True)
+            await file.save(str(save_path))
+            if save_path.is_file() and save_path.stat().st_size > MAX_FILE_BYTES:
+                save_path.unlink()
+                errors.append(f"File too large: {filename}")
+                continue
+            uploaded.append(rel_path)
+
+        if not uploaded:
+            raise ValueError(
+                "Upload failed: " + ", ".join(errors) if errors else "Upload failed"
+            )
+
+        return {"uploaded": uploaded, "errors": errors}
+
+    async def upload_config_file_from_dashboard_request(self, args, files) -> dict:
+        return await self.upload_config_file(
+            scope=args.get("scope"),
+            name=args.get("name"),
+            key_path=args.get("key"),
+            files=files,
+        )
+
+    def delete_config_file(
+        self,
+        *,
+        scope: str | None,
+        name: str | None,
+        rel_path: str | None,
+    ) -> None:
+        if not name:
+            raise ValueError("Missing name parameter")
+        if (scope or "plugin") != "plugin":
+            raise ValueError(f"Unsupported scope: {scope}")
+
+        rel_path = _normalize_rel_path(rel_path)
+        if not rel_path or not rel_path.startswith("files/"):
+            raise ValueError("Invalid path parameter")
+
+        metadata = self.get_plugin_metadata_by_name(name)
+        if not metadata:
+            raise ValueError(f"Plugin {name} not found")
+
+        plugin_root_path = self._plugin_root_path(name)
+        target_path = self._safe_plugin_path(plugin_root_path, rel_path)
+        if target_path is None:
+            raise ValueError("Invalid path parameter")
+        if target_path.is_file():
+            target_path.unlink()
+
+    def delete_config_file_from_dashboard_payload(
+        self,
+        *,
+        scope: str | None,
+        name: str | None,
+        payload: object,
+    ) -> str:
+        data = payload if isinstance(payload, dict) else {}
+        self.delete_config_file(
+            scope=scope,
+            name=name,
+            rel_path=data.get("path"),
+        )
+        return "Deleted"
+
+    def delete_config_file_from_dashboard_request(
+        self,
+        args,
+        payload: object,
+    ) -> str:
+        return self.delete_config_file_from_dashboard_payload(
+            scope=args.get("scope") or "plugin",
+            name=args.get("name"),
+            payload=payload,
+        )
+
+    def list_config_files(
+        self,
+        *,
+        scope: str | None,
+        name: str | None,
+        key_path: str | None,
+    ) -> dict:
+        _, name, key_path, _, config = self.resolve_config_file_scope(
+            scope=scope,
+            name=name,
+            key_path=key_path,
+        )
+        meta = _get_schema_item(getattr(config, "schema", None), key_path)
+        if not meta or meta.get("type") != "file":
+            raise ValueError("Config item not found or not file type")
+
+        plugin_root_path = self._plugin_root_path(name)
+        target_dir = self._safe_plugin_path(
+            plugin_root_path,
+            f"files/{_config_key_to_folder(key_path)}",
+        )
+        if target_dir is None:
+            raise ValueError("Invalid path parameter")
+        if not target_dir.exists() or not target_dir.is_dir():
+            return {"files": []}
+
+        files: list[str] = []
+        for path in target_dir.rglob("*"):
+            if not path.is_file():
+                continue
+            try:
+                rel_path = path.relative_to(plugin_root_path).as_posix()
+            except ValueError:
+                continue
+            if rel_path.startswith("files/"):
+                files.append(rel_path)
+        return {"files": files}
+
+    def list_config_files_from_dashboard_args(self, args) -> dict:
+        return self.list_config_files(
+            scope=args.get("scope"),
+            name=args.get("name"),
+            key_path=args.get("key"),
+        )
+
+    @staticmethod
+    def _allowed_file_extensions(meta: dict) -> list[str]:
+        file_types = meta.get("file_types")
+        if not isinstance(file_types, list):
+            return []
+        return [str(ext).lstrip(".").lower() for ext in file_types if str(ext).strip()]
+
+    @staticmethod
+    def _plugin_root_path(name: str) -> Path:
+        storage_root_path = Path(get_astrbot_plugin_data_path()).resolve(strict=False)
+        plugin_root_path = (storage_root_path / name).resolve(strict=False)
+        try:
+            plugin_root_path.relative_to(storage_root_path)
+        except ValueError as exc:
+            raise ValueError("Invalid name parameter") from exc
+        return plugin_root_path
+
+    @staticmethod
+    def _safe_plugin_path(plugin_root_path: Path, rel_path: str) -> Path | None:
+        target_path = (plugin_root_path / rel_path).resolve(strict=False)
+        try:
+            target_path.relative_to(plugin_root_path)
+        except ValueError:
+            return None
+        return target_path
+
+
+class BotConfigService:
+    def __init__(self, core_lifecycle: AstrBotCoreLifecycle) -> None:
+        self.core_lifecycle = core_lifecycle
+        self.config = core_lifecycle.astrbot_config
+
+    def list_bot_types(self) -> dict:
+        bot_types = []
+        for platform in platform_registry:
+            bot_types.append(
+                {
+                    "type": platform.name,
+                    "id": platform.id,
+                    "description": platform.description,
+                    "display_name": platform.adapter_display_name or platform.name,
+                    "default_config": copy.deepcopy(platform.default_config_tmpl),
+                    "schema": copy.deepcopy(platform.config_metadata or {}),
+                    "support_streaming_message": platform.support_streaming_message,
+                    "support_proactive_message": platform.support_proactive_message,
+                }
+            )
+        return {"bot_types": bot_types}
+
+    def list_bots(
+        self, *, enabled: bool | None = None, type_: str | None = None
+    ) -> dict:
+        bots = []
+        for bot in self.config.get("platform", []):
+            if enabled is not None and bool(bot.get("enable", False)) != enabled:
+                continue
+            if type_ and bot.get("type") != type_:
+                continue
+            bots.append(copy.deepcopy(bot))
+        return {"bots": bots}
+
+    def get_bot(self, bot_id: str) -> dict:
+        bot = self._find_bot(bot_id)
+        if bot is None:
+            raise ValueError(f"Bot {bot_id} not found")
+        return {"bot": copy.deepcopy(bot)}
+
+    def get_bot_stats(self) -> dict:
+        return self.core_lifecycle.platform_manager.get_all_stats()
+
+    async def create_bot(self, config: dict) -> None:
+        bot_id = config.get("id")
+        if not bot_id:
+            raise ValueError("Bot config must have an 'id' field")
+        if self._find_bot(bot_id) is not None:
+            raise ValueError(f"Bot {bot_id} already exists")
+        ensure_platform_webhook_config(config)
+        self.config["platform"].append(config)
+        save_config(self.config, self.config, is_core=True)
+        await self.core_lifecycle.platform_manager.load_platform(config)
+
+    async def update_bot(self, bot_id: str, config: dict) -> None:
+        if config.get("id") != bot_id:
+            raise ValueError("Bot id cannot be changed")
+        ensure_platform_webhook_config(config)
+        for idx, bot in enumerate(self.config.get("platform", [])):
+            if bot.get("id") == bot_id:
+                self.config["platform"][idx] = config
+                save_config(self.config, self.config, is_core=True)
+                await self.core_lifecycle.platform_manager.reload(config)
+                return
+        raise ValueError(f"Bot {bot_id} not found")
+
+    async def set_bot_enabled(self, bot_id: str, enabled: bool) -> None:
+        bot = self._find_bot(bot_id)
+        if bot is None:
+            raise ValueError(f"Bot {bot_id} not found")
+        new_config = copy.deepcopy(bot)
+        new_config["enable"] = enabled
+        await self.update_bot(bot_id, new_config)
+
+    async def delete_bot(self, bot_id: str) -> None:
+        for idx, bot in enumerate(self.config.get("platform", [])):
+            if bot.get("id") == bot_id:
+                del self.config["platform"][idx]
+                save_config(self.config, self.config, is_core=True)
+                await self.core_lifecycle.platform_manager.terminate_platform(bot_id)
+                return
+        raise ValueError(f"Bot {bot_id} not found")
+
+    def list_platforms_for_dashboard(self) -> dict:
+        return {"platforms": self.list_bots()["bots"]}
+
+    async def create_bot_from_dashboard_payload(self, payload: object) -> str:
+        if not isinstance(payload, dict):
+            raise ValueError("参数错误")
+        await self.create_bot(payload)
+        return "新增平台配置成功~"
+
+    async def update_bot_from_dashboard_payload(self, payload: object) -> str:
+        data = payload if isinstance(payload, dict) else {}
+        origin_platform_id = data.get("id")
+        new_config = data.get("config")
+        if not origin_platform_id or not isinstance(new_config, dict):
+            raise ValueError("参数错误")
+        if origin_platform_id != new_config.get("id"):
+            raise ValueError("机器人名称不允许修改")
+
+        try:
+            await self.update_bot(origin_platform_id, new_config)
+        except ValueError as exc:
+            if "not found" in str(exc):
+                raise ValueError("未找到对应平台") from exc
+            raise
+        return "更新平台配置成功~"
+
+    async def delete_bot_from_dashboard_payload(self, payload: object) -> str:
+        data = payload if isinstance(payload, dict) else {}
+        platform_id = data.get("id")
+        if not platform_id:
+            raise ValueError("缺少平台 ID")
+        try:
+            await self.delete_bot(str(platform_id))
+        except ValueError as exc:
+            if "not found" in str(exc):
+                raise ValueError("未找到对应平台") from exc
+            raise
+        return "删除平台配置成功~"
+
+    def _find_bot(self, bot_id: str) -> dict | None:
+        for bot in self.config.get("platform", []):
+            if bot.get("id") == bot_id:
+                return bot
+        return None
+
+
+class ProviderConfigService:
+    CAPABILITY_TO_PROVIDER_TYPE = {
+        "chat": "chat_completion",
+        "agent": "agent_runner",
+        "stt": "speech_to_text",
+        "tts": "text_to_speech",
+        "embedding": "embedding",
+        "rerank": "rerank",
+    }
+
+    def __init__(self, core_lifecycle: AstrBotCoreLifecycle) -> None:
+        self.core_lifecycle = core_lifecycle
+        self.config = core_lifecycle.astrbot_config
+        self.provider_manager = core_lifecycle.provider_manager
+
+    def get_provider_schema(self) -> dict:
+        provider_metadata = ConfigMetadataI18n.convert_to_i18n_keys(
+            {
+                "provider_group": {
+                    "metadata": {
+                        "provider": CONFIG_METADATA_2["provider_group"]["metadata"][
+                            "provider"
+                        ]
+                    }
+                }
+            }
+        )
+        config_schema = {
+            "provider": provider_metadata["provider_group"]["metadata"]["provider"]
+        }
+        provider_default_tmpl = config_schema["provider"]["config_template"]
+        for provider in provider_registry:
+            if provider.default_config_tmpl:
+                provider_default_tmpl[provider.type] = provider.default_config_tmpl
+        return {
+            "config_schema": config_schema,
+            "providers": self.config.get("provider", []),
+            "provider_sources": self.config.get("provider_sources", []),
+        }
+
+    def list_provider_sources(self) -> dict:
+        return {
+            "provider_sources": copy.deepcopy(self.config.get("provider_sources", []))
+        }
+
+    def get_provider_source(self, source_id: str) -> dict:
+        source = self._find_provider_source(source_id)
+        if source is None:
+            raise ValueError(f"Provider source {source_id} not found")
+        return {"provider_source": copy.deepcopy(source)}
+
+    async def upsert_provider_source(self, source_id: str, config: dict) -> None:
+        config = copy.deepcopy(config)
+        next_source_id = str(config.get("id") or source_id).strip()
+        if not next_source_id:
+            raise ValueError("Provider source config must have an 'id' field")
+        config["id"] = next_source_id
+        sources = self.config.setdefault("provider_sources", [])
+
+        for source in sources:
+            if source.get("id") == next_source_id and next_source_id != source_id:
+                raise ValueError(
+                    f"Provider source ID '{next_source_id}' exists already, please try another ID."
+                )
+
+        for idx, source in enumerate(sources):
+            if source.get("id") == source_id:
+                old_source_id = source.get("id") or source_id
+                sources[idx] = config
+                affected_providers = self._move_providers_to_source(
+                    old_source_id,
+                    next_source_id,
+                )
+                save_config(self.config, self.config, is_core=True)
+                self.provider_manager.provider_sources_config = sources
+                await self._reload_providers(affected_providers)
+                return
+
+        sources.append(config)
+        save_config(self.config, self.config, is_core=True)
+        self.provider_manager.provider_sources_config = sources
+
+    async def delete_provider_source(self, source_id: str) -> None:
+        sources = self.config.get("provider_sources", [])
+        next_sources = [source for source in sources if source.get("id") != source_id]
+        if len(next_sources) == len(sources):
+            raise ValueError(f"Provider source {source_id} not found")
+        self.config["provider_sources"] = next_sources
+        await self.provider_manager.delete_provider(provider_source_id=source_id)
+        save_config(self.config, self.config, is_core=True)
+        self.provider_manager.provider_sources_config = next_sources
+
+    async def upsert_provider_source_from_dashboard_payload(
+        self, payload: object
+    ) -> str:
+        if not isinstance(payload, dict) or not payload:
+            raise ValueError("缺少配置数据")
+
+        new_source_config = payload.get("config") or payload
+        original_id = payload.get("original_id")
+        if not original_id:
+            raise ValueError("缺少 original_id")
+        if not isinstance(new_source_config, dict):
+            raise ValueError("缺少或错误的配置数据")
+        if not new_source_config.get("id"):
+            new_source_config["id"] = original_id
+
+        await self.upsert_provider_source(str(original_id), new_source_config)
+        return "更新 provider source 成功"
+
+    async def delete_provider_source_from_dashboard_payload(
+        self, payload: object
+    ) -> str:
+        if not isinstance(payload, dict) or not payload:
+            raise ValueError("缺少配置数据")
+
+        provider_source_id = payload.get("id")
+        if not provider_source_id:
+            raise ValueError("缺少 provider_source_id")
+
+        try:
+            await self.delete_provider_source(str(provider_source_id))
+        except ValueError as exc:
+            if "not found" in str(exc):
+                raise ValueError("未找到对应的 provider source") from exc
+            raise
+        return "删除 provider source 成功"
+
+    async def list_provider_source_models(self, source_id: str) -> dict:
+        source = self._find_provider_source(source_id)
+        if source is None:
+            raise ValueError(f"Provider source {source_id} not found")
+
+        from astrbot.core.provider import Provider
+        from astrbot.core.provider.register import provider_cls_map
+        from astrbot.core.utils.llm_metadata import LLM_METADATAS
+
+        provider_type = source.get("type")
+        if not provider_type:
+            raise ValueError("Provider source missing type")
+        try:
+            self.provider_manager.dynamic_import_provider(provider_type)
+        except ImportError as exc:
+            raise ValueError(f"动态导入提供商适配器失败: {exc!s}") from exc
+        provider_metadata = provider_cls_map.get(provider_type)
+        cls_type = provider_metadata.cls_type if provider_metadata else None
+        if cls_type is None or not issubclass(cls_type, Provider):
+            raise ValueError(f"Provider source {source_id} does not support model list")
+
+        inst = cls_type(source, {})
+        init_fn = getattr(inst, "initialize", None)
+        if callable(init_fn):
+            await run_maybe_async(init_fn)
+        try:
+            models = await inst.get_models()
+            models = models or []
+            return {
+                "models": models,
+                "provider_source_id": source_id,
+                "model_metadata": {
+                    model_id: LLM_METADATAS[model_id]
+                    for model_id in models
+                    if model_id in LLM_METADATAS
+                },
+            }
+        finally:
+            terminate_fn = getattr(inst, "terminate", None)
+            if callable(terminate_fn):
+                await run_maybe_async(terminate_fn)
+
+    async def list_provider_source_models_for_dashboard(
+        self,
+        source_id: str | None,
+    ) -> dict:
+        if not source_id:
+            raise ValueError("缺少参数 source_id")
+        data = await self.list_provider_source_models(source_id)
+        data.pop("provider_source_id", None)
+        return data
+
+    async def list_provider_models(self, provider_id: str) -> dict:
+        from astrbot.core.provider import Provider
+        from astrbot.core.utils.llm_metadata import LLM_METADATAS
+
+        provider = self.provider_manager.inst_map.get(provider_id)
+        if not provider:
+            raise ValueError(f"未找到 ID 为 {provider_id} 的提供商")
+        if not isinstance(provider, Provider):
+            raise ValueError(f"提供商 {provider_id} 类型不支持获取模型列表")
+
+        models = await provider.get_models()
+        models = models or []
+        return {
+            "models": models,
+            "provider_id": provider_id,
+            "model_metadata": {
+                model_id: LLM_METADATAS[model_id]
+                for model_id in models
+                if model_id in LLM_METADATAS
+            },
+        }
+
+    async def list_provider_models_for_dashboard(
+        self,
+        provider_id: str | None,
+    ) -> dict:
+        if not provider_id:
+            raise ValueError("缺少参数 provider_id")
+        return await self.list_provider_models(provider_id)
+
+    async def list_provider_models_from_dashboard_args(self, args) -> dict:
+        return await self.list_provider_models_for_dashboard(
+            args.get("provider_id", None)
+        )
+
+    async def get_embedding_dimension(self, provider_config: dict | None) -> dict:
+        if not provider_config:
+            raise ValueError("缺少参数 provider_config")
+
+        from astrbot.core.provider.provider import EmbeddingProvider
+        from astrbot.core.provider.register import provider_cls_map
+
+        provider_type = provider_config.get("type")
+        if not provider_type:
+            raise ValueError("provider_config 缺少 type 字段")
+
+        if provider_type not in provider_cls_map:
+            try:
+                dynamic_import_provider = getattr(
+                    self.provider_manager,
+                    "dynamic_import_provider",
+                    None,
+                )
+                if not callable(dynamic_import_provider):
+                    raise ImportError(provider_type)
+                dynamic_import_provider(provider_type)
+            except ImportError as exc:
+                raise ValueError(
+                    "提供商适配器加载失败，请检查提供商类型配置或查看服务端日志"
+                ) from exc
+
+        provider_metadata = provider_cls_map.get(provider_type)
+        cls_type = provider_metadata.cls_type if provider_metadata else None
+        if not cls_type:
+            raise ValueError(f"无法找到 {provider_type} 的类")
+
+        inst = cls_type(provider_config, {})
+        try:
+            init_fn = getattr(inst, "initialize", None)
+            if callable(init_fn):
+                await run_maybe_async(init_fn)
+
+            if not isinstance(inst, EmbeddingProvider):
+                raise ValueError("提供商不是 EmbeddingProvider 类型")
+
+            vec = await inst.get_embedding("echo")
+            dim = len(vec)
+            logger.info(
+                f"检测到 {provider_config.get('id', 'unknown')} 的嵌入向量维度为 {dim}",
+            )
+            return {"embedding_dimensions": dim}
+        finally:
+            terminate_fn = getattr(inst, "terminate", None)
+            if callable(terminate_fn):
+                await run_maybe_async(terminate_fn)
+
+    async def get_embedding_dimension_from_dashboard_payload(
+        self,
+        payload: object,
+    ) -> dict:
+        data = payload if isinstance(payload, dict) else {}
+        return await self.get_embedding_dimension(data.get("provider_config"))
+
+    def list_providers(
+        self,
+        *,
+        capability: str | None = None,
+        source_id: str | None = None,
+        enabled: bool | None = None,
+    ) -> dict:
+        provider_type = self._resolve_provider_type(capability)
+        providers = []
+        source_provider_type = {
+            source["id"]: source.get("provider_type", "chat_completion")
+            for source in self.provider_manager.provider_sources_config
+        }
+        for provider in self.provider_manager.providers_config:
+            if source_id and provider.get("provider_source_id") != source_id:
+                continue
+            if enabled is not None and bool(provider.get("enable", False)) != enabled:
+                continue
+            effective_type = provider.get("provider_type")
+            if not effective_type and provider.get("provider_source_id"):
+                effective_type = source_provider_type.get(
+                    provider.get("provider_source_id"), "chat_completion"
+                )
+            if provider_type and effective_type != provider_type:
+                continue
+            if provider.get("provider_source_id"):
+                providers.append(
+                    self.provider_manager.get_merged_provider_config(provider)
+                )
+            else:
+                providers.append(copy.deepcopy(provider))
+        return {"providers": providers}
+
+    def list_providers_for_dashboard_types(
+        self, provider_type: str | None
+    ) -> list[dict]:
+        if not provider_type:
+            raise ValueError("缺少参数 provider_type")
+
+        provider_list = []
+        seen_ids = set()
+        for item in provider_type.split(","):
+            providers = self.list_providers(capability=item)["providers"]
+            for provider in providers:
+                provider_id = provider.get("id")
+                if provider_id in seen_ids:
+                    continue
+                seen_ids.add(provider_id)
+                provider_list.append(provider)
+        return provider_list
+
+    def list_providers_from_dashboard_args(self, args) -> list[dict]:
+        return self.list_providers_for_dashboard_types(args.get("provider_type", None))
+
+    def get_provider(self, provider_id: str, *, merged: bool = False) -> dict:
+        provider = self.provider_manager.get_provider_config_by_id(
+            provider_id,
+            merged=merged,
+        )
+        if provider is None:
+            raise ValueError(f"Provider {provider_id} not found")
+        return {"provider": provider}
+
+    async def create_provider(self, config: dict, source_id: str | None = None) -> None:
+        config = copy.deepcopy(config)
+        if source_id:
+            config["provider_source_id"] = source_id
+        await self.provider_manager.create_provider(config)
+
+    async def update_provider(self, provider_id: str, config: dict) -> None:
+        if not config.get("id"):
+            config["id"] = provider_id
+        await self.provider_manager.update_provider(provider_id, config)
+
+    async def set_provider_enabled(self, provider_id: str, enabled: bool) -> None:
+        provider = self.provider_manager.get_provider_config_by_id(provider_id)
+        if provider is None:
+            raise ValueError(f"Provider {provider_id} not found")
+        provider["enable"] = enabled
+        await self.provider_manager.update_provider(provider_id, provider)
+
+    async def delete_provider(self, provider_id: str) -> None:
+        await self.provider_manager.delete_provider(provider_id=provider_id)
+
+    async def create_provider_from_dashboard_payload(self, payload: object) -> str:
+        if not isinstance(payload, dict):
+            raise ValueError("参数错误")
+        await self.create_provider(payload)
+        return "新增服务提供商配置成功"
+
+    async def update_provider_from_dashboard_payload(self, payload: object) -> str:
+        data = payload if isinstance(payload, dict) else {}
+        origin_provider_id = data.get("id")
+        new_config = data.get("config")
+        if not origin_provider_id or not isinstance(new_config, dict):
+            raise ValueError("参数错误")
+
+        await self.update_provider(origin_provider_id, new_config)
+        return "更新成功，已经实时生效~"
+
+    async def delete_provider_from_dashboard_payload(self, payload: object) -> str:
+        data = payload if isinstance(payload, dict) else {}
+        provider_id = data.get("id", "")
+        if not provider_id:
+            raise ValueError("缺少参数 id")
+
+        await self.delete_provider(provider_id)
+        return "删除成功，已经实时生效。"
+
+    async def test_provider(self, provider_id: str) -> dict:
+        target = self.provider_manager.inst_map.get(provider_id)
+        if not target:
+            raise ValueError(f"Provider {provider_id} not found")
+        meta = target.meta()
+        provider_type = getattr(meta, "provider_type", None)
+        result = {
+            "id": getattr(meta, "id", provider_id),
+            "model": getattr(meta, "model", None),
+            "type": getattr(provider_type, "value", None),
+            "name": provider_id,
+            "status": "unavailable",
+            "error": None,
+        }
+        try:
+            await target.test()
+            result["status"] = "available"
+        except Exception as exc:
+            result["error"] = str(exc)
+        return result
+
+    async def test_provider_from_dashboard_args(self, args) -> dict:
+        provider_id = args.get("id")
+        if not provider_id:
+            raise ValueError("Missing provider_id parameter")
+        logger.info(f"API call: /config/provider/check_one id={provider_id}")
+        return await self.test_provider(provider_id)
+
+    def _find_provider_source(self, source_id: str) -> dict | None:
+        for source in self.config.get("provider_sources", []):
+            if source.get("id") == source_id:
+                return source
+        return None
+
+    def _resolve_provider_type(self, capability: str | None) -> str | None:
+        if not capability:
+            return None
+        return self.CAPABILITY_TO_PROVIDER_TYPE.get(capability, capability)
+
+    async def _reload_providers_for_source(self, source_id: str) -> None:
+        await self._reload_providers(
+            [
+                provider
+                for provider in list(self.config.get("provider", []))
+                if provider.get("provider_source_id") == source_id
+            ]
+        )
+
+    def _move_providers_to_source(
+        self,
+        old_source_id: str,
+        next_source_id: str,
+    ) -> list[dict]:
+        affected_providers = []
+        for provider in self.config.get("provider", []):
+            if provider.get("provider_source_id") == old_source_id:
+                provider["provider_source_id"] = next_source_id
+                affected_providers.append(provider)
+        return affected_providers
+
+    async def _reload_providers(self, providers: list[dict]) -> None:
+        reload_fn = getattr(self.provider_manager, "reload", None)
+        if not callable(reload_fn):
+            return
+        for provider in providers:
+            await run_maybe_async(lambda provider=provider: reload_fn(provider))
diff --git a/astrbot/dashboard/services/conversation_service.py b/astrbot/dashboard/services/conversation_service.py
new file mode 100644
index 000000000..b73b12098
--- /dev/null
+++ b/astrbot/dashboard/services/conversation_service.py
@@ -0,0 +1,312 @@
+from __future__ import annotations
+
+import json
+import traceback
+from dataclasses import asdict, dataclass
+from datetime import datetime
+from io import BytesIO
+
+from astrbot.core import logger
+from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
+from astrbot.core.db import BaseDatabase
+from astrbot.core.umo_alias import build_umo_alias_map, parse_umo, serialize_umo_alias
+
+
+class ConversationServiceError(Exception):
+    pass
+
+
+@dataclass
+class ConversationExport:
+    file_obj: BytesIO
+    filename: str
+    mimetype: str = "application/jsonl"
+
+
+class ConversationService:
+    def __init__(
+        self,
+        db_helper: BaseDatabase,
+        core_lifecycle: AstrBotCoreLifecycle,
+    ) -> None:
+        self.db_helper = db_helper
+        self.conv_mgr = core_lifecycle.conversation_manager
+
+    async def list_conversations(
+        self,
+        *,
+        page: int,
+        page_size: int,
+        platforms: str,
+        message_types: str,
+        search_query: str,
+        exclude_ids: str,
+        exclude_platforms: str,
+    ) -> dict:
+        platform_list = platforms.split(",") if platforms else []
+        message_type_list = message_types.split(",") if message_types else []
+        exclude_id_list = exclude_ids.split(",") if exclude_ids else []
+        exclude_platform_list = (
+            exclude_platforms.split(",") if exclude_platforms else []
+        )
+
+        page = max(page, 1)
+        if page_size < 1:
+            page_size = 20
+        page_size = min(page_size, 100)
+
+        try:
+            conversations, total_count = await self.conv_mgr.get_filtered_conversations(
+                page=page,
+                page_size=page_size,
+                platforms=platform_list,
+                message_types=message_type_list,
+                search_query=search_query,
+                exclude_ids=exclude_id_list,
+                exclude_platforms=exclude_platform_list,
+            )
+        except Exception as exc:
+            logger.error(f"数据库查询出错: {exc!s}\n{traceback.format_exc()}")
+            raise ConversationServiceError(f"数据库查询出错: {exc!s}") from exc
+
+        total_pages = (
+            (total_count + page_size - 1) // page_size if total_count > 0 else 1
+        )
+        umos = sorted({conv.user_id for conv in conversations if conv.user_id})
+        alias_map = build_umo_alias_map(await self.db_helper.get_umo_aliases(umos))
+
+        return {
+            "conversations": [
+                self._serialize_conversation(conversation, alias_map)
+                for conversation in conversations
+            ],
+            "pagination": {
+                "page": page,
+                "page_size": page_size,
+                "total": total_count,
+                "total_pages": total_pages,
+            },
+        }
+
+    async def get_conversation_detail(self, data: object) -> dict:
+        payload = self._payload(data)
+        user_id, cid = self._require_user_and_cid(payload)
+
+        conversation = await self.conv_mgr.get_conversation(
+            unified_msg_origin=user_id,
+            conversation_id=cid,
+        )
+        if not conversation:
+            raise ConversationServiceError("对话不存在")
+
+        alias_map = build_umo_alias_map(await self.db_helper.get_umo_aliases([user_id]))
+        return {
+            "user_id": user_id,
+            "cid": cid,
+            "title": conversation.title,
+            "persona_id": conversation.persona_id,
+            "history": conversation.history,
+            "created_at": conversation.created_at,
+            "updated_at": conversation.updated_at,
+            "umo_info": self._build_umo_info(user_id, alias_map),
+        }
+
+    async def update_conversation(self, data: object) -> dict:
+        payload = self._payload(data)
+        user_id, cid = self._require_user_and_cid(payload)
+        title = payload.get("title")
+
+        conversation = await self.conv_mgr.get_conversation(
+            unified_msg_origin=user_id,
+            conversation_id=cid,
+        )
+        if not conversation:
+            raise ConversationServiceError("对话不存在")
+
+        persona_id = payload.get("persona_id", conversation.persona_id)
+
+        if title is not None or persona_id is not None:
+            await self.conv_mgr.update_conversation(
+                unified_msg_origin=user_id,
+                conversation_id=cid,
+                title=title,
+                persona_id=persona_id,
+            )
+        return {"message": "对话信息更新成功"}
+
+    async def delete_conversation(self, data: object) -> dict:
+        payload = self._payload(data)
+        if "conversations" in payload:
+            return await self._delete_conversations(payload.get("conversations", []))
+
+        user_id, cid = self._require_user_and_cid(payload)
+        await self.conv_mgr.delete_conversation(
+            unified_msg_origin=user_id,
+            conversation_id=cid,
+        )
+        return {"message": "对话删除成功"}
+
+    async def update_history(self, data: object) -> dict:
+        payload = self._payload(data)
+        user_id, cid = self._require_user_and_cid(payload)
+        history = payload.get("history")
+
+        if history is None:
+            raise ConversationServiceError("缺少必要参数: history")
+
+        history = self._normalize_history(history)
+
+        conversation = await self.conv_mgr.get_conversation(
+            unified_msg_origin=user_id,
+            conversation_id=cid,
+        )
+        if not conversation:
+            raise ConversationServiceError("对话不存在")
+
+        await self.conv_mgr.update_conversation(
+            unified_msg_origin=user_id,
+            conversation_id=cid,
+            history=history,
+        )
+
+        return {"message": "对话历史更新成功"}
+
+    async def export_conversations(self, data: object) -> ConversationExport:
+        payload = self._payload(data)
+        conversations_to_export = payload.get("conversations", [])
+
+        if not conversations_to_export:
+            raise ConversationServiceError("导出列表不能为空")
+
+        jsonl_lines = []
+        exported_count = 0
+        failed_items = []
+
+        for conv_info in conversations_to_export:
+            user_id = conv_info.get("user_id")
+            cid = conv_info.get("cid")
+
+            if not user_id or not cid:
+                failed_items.append(f"user_id:{user_id}, cid:{cid} - 缺少必要参数")
+                continue
+
+            try:
+                conversation = await self.conv_mgr.get_conversation(
+                    unified_msg_origin=user_id,
+                    conversation_id=cid,
+                )
+
+                if not conversation:
+                    failed_items.append(f"user_id:{user_id}, cid:{cid} - 对话不存在")
+                    continue
+
+                content = json.loads(conversation.history)
+                export_record = {
+                    "cid": cid,
+                    "user_id": user_id,
+                    "platform_id": conversation.platform_id,
+                    "title": conversation.title,
+                    "persona_id": conversation.persona_id,
+                    "created_at": conversation.created_at,
+                    "updated_at": conversation.updated_at,
+                    "content": content,
+                }
+                jsonl_lines.append(json.dumps(export_record, ensure_ascii=False))
+                exported_count += 1
+            except Exception as exc:
+                failed_items.append(f"user_id:{user_id}, cid:{cid} - {exc!s}")
+                logger.error(
+                    f"导出对话失败: user_id={user_id}, cid={cid}, error={exc!s}"
+                )
+
+        if exported_count == 0:
+            raise ConversationServiceError("没有成功导出任何对话")
+
+        jsonl_content = "\n".join(jsonl_lines)
+        file_obj = BytesIO(jsonl_content.encode("utf-8"))
+        file_obj.seek(0)
+
+        timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
+        return ConversationExport(
+            file_obj=file_obj,
+            filename=f"astrbot_conversations_export_{timestamp}.jsonl",
+        )
+
+    async def _delete_conversations(self, conversations: object) -> dict:
+        if not isinstance(conversations, list) or not conversations:
+            raise ConversationServiceError("批量删除时conversations参数不能为空")
+
+        deleted_count = 0
+        failed_items = []
+
+        for conv in conversations:
+            if not isinstance(conv, dict):
+                failed_items.append(f"{conv!r} - 格式错误")
+                continue
+            user_id = conv.get("user_id")
+            cid = conv.get("cid")
+
+            if not user_id or not cid:
+                failed_items.append(f"user_id:{user_id}, cid:{cid} - 缺少必要参数")
+                continue
+
+            try:
+                await self.conv_mgr.delete_conversation(
+                    unified_msg_origin=user_id,
+                    conversation_id=cid,
+                )
+                deleted_count += 1
+            except Exception as exc:
+                failed_items.append(f"user_id:{user_id}, cid:{cid} - {exc!s}")
+
+        message = f"成功删除 {deleted_count} 个对话"
+        if failed_items:
+            message += f"，失败 {len(failed_items)} 个"
+
+        return {
+            "message": message,
+            "deleted_count": deleted_count,
+            "failed_count": len(failed_items),
+            "failed_items": failed_items,
+        }
+
+    def _serialize_conversation(self, conversation, alias_map: dict) -> dict:
+        return {
+            **asdict(conversation),
+            "umo_info": self._build_umo_info(conversation.user_id, alias_map),
+        }
+
+    @staticmethod
+    def _build_umo_info(umo: str | None, alias_map: dict) -> dict:
+        umo_str = umo or ""
+        return {
+            "umo": umo_str,
+            **parse_umo(umo_str),
+            **serialize_umo_alias(alias_map.get(umo_str), umo_str),
+        }
+
+    @staticmethod
+    def _require_user_and_cid(payload: dict) -> tuple[str, str]:
+        user_id = payload.get("user_id")
+        cid = payload.get("cid")
+        if not user_id or not cid:
+            raise ConversationServiceError("缺少必要参数: user_id 和 cid")
+        return user_id, cid
+
+    @staticmethod
+    def _normalize_history(history):
+        try:
+            if isinstance(history, list):
+                history = json.dumps(history)
+            else:
+                json.loads(history)
+        except json.JSONDecodeError as exc:
+            raise ConversationServiceError(
+                "history 必须是有效的 JSON 字符串或数组"
+            ) from exc
+
+        return json.loads(history) if isinstance(history, str) else history
+
+    @staticmethod
+    def _payload(data: object) -> dict:
+        return data if isinstance(data, dict) else {}
diff --git a/astrbot/dashboard/services/cron_service.py b/astrbot/dashboard/services/cron_service.py
new file mode 100644
index 000000000..2c21551ce
--- /dev/null
+++ b/astrbot/dashboard/services/cron_service.py
@@ -0,0 +1,279 @@
+from __future__ import annotations
+
+import asyncio
+import traceback
+from datetime import datetime, timezone
+
+from astrbot.core import logger
+from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
+
+
+class CronServiceError(Exception):
+    pass
+
+
+class CronService:
+    def __init__(self, core_lifecycle: AstrBotCoreLifecycle) -> None:
+        self.core_lifecycle = core_lifecycle
+        self._background_tasks: set[asyncio.Task] = set()
+
+    def _get_cron_manager(self):
+        cron_mgr = self.core_lifecycle.cron_manager
+        if cron_mgr is None:
+            raise CronServiceError("Cron manager not initialized")
+        return cron_mgr
+
+    @staticmethod
+    def serialize_job(job) -> dict:
+        data = job.model_dump() if hasattr(job, "model_dump") else job.__dict__
+        for key in ["created_at", "updated_at", "last_run_at", "next_run_time"]:
+            value = data.get(key)
+            if isinstance(value, datetime):
+                if value.tzinfo is None:
+                    value = value.replace(tzinfo=timezone.utc)
+                data[key] = value.isoformat()
+
+        payload = data.get("payload") or {}
+        data["note"] = payload.get("note") or data.get("description") or ""
+        data["run_at"] = payload.get("run_at")
+        data["run_once"] = data.get("run_once", False)
+        data.pop("status", None)
+        return data
+
+    async def list_jobs(self, job_type: str | None = None) -> list[dict]:
+        try:
+            cron_mgr = self._get_cron_manager()
+            jobs = await cron_mgr.list_jobs(job_type)
+            return [self.serialize_job(job) for job in jobs]
+        except CronServiceError:
+            raise
+        except Exception as exc:
+            logger.error(traceback.format_exc())
+            raise CronServiceError(f"Failed to list jobs: {exc!s}") from exc
+
+    async def create_job(self, payload: object) -> dict:
+        try:
+            cron_mgr = self._get_cron_manager()
+            if not isinstance(payload, dict):
+                raise CronServiceError("Invalid payload")
+
+            name = payload.get("name") or "active_agent_task"
+            cron_expression = payload.get("cron_expression")
+            note = payload.get("note") or payload.get("description") or name
+            session = str(payload.get("session") or "").strip()
+            persona_id = payload.get("persona_id")
+            provider_id = payload.get("provider_id")
+            timezone_name = payload.get("timezone")
+            enabled = bool(payload.get("enabled", True))
+            run_once = bool(payload.get("run_once", False))
+            run_at = payload.get("run_at")
+
+            if run_once and not run_at:
+                raise CronServiceError("run_at is required when run_once=true")
+            if (not run_once) and not cron_expression:
+                raise CronServiceError(
+                    "cron_expression is required when run_once=false"
+                )
+            if run_once and cron_expression:
+                cron_expression = None
+
+            run_at_dt = self._parse_optional_run_at(run_at)
+            job_payload = {
+                "session": session,
+                "note": note,
+                "persona_id": persona_id,
+                "provider_id": provider_id,
+                "run_at": run_at,
+                "origin": "api",
+            }
+
+            job = await cron_mgr.add_active_job(
+                name=name,
+                cron_expression=cron_expression,
+                payload=job_payload,
+                description=note,
+                timezone=timezone_name,
+                enabled=enabled,
+                run_once=run_once,
+                run_at=run_at_dt,
+            )
+            return self.serialize_job(job)
+        except CronServiceError:
+            raise
+        except Exception as exc:
+            logger.error(traceback.format_exc())
+            raise CronServiceError(f"Failed to create job: {exc!s}") from exc
+
+    async def update_job(self, job_id: str, payload: object) -> dict:
+        try:
+            cron_mgr = self._get_cron_manager()
+            if not isinstance(payload, dict):
+                raise CronServiceError("Invalid payload")
+
+            job = await cron_mgr.db.get_cron_job(job_id)
+            if not job:
+                raise CronServiceError("Job not found")
+
+            updates = {}
+            if "name" in payload:
+                name = str(payload.get("name") or "").strip()
+                if not name:
+                    raise CronServiceError("name cannot be empty")
+                updates["name"] = name
+
+            if "enabled" in payload:
+                updates["enabled"] = bool(payload.get("enabled"))
+
+            if "timezone" in payload:
+                timezone_name = payload.get("timezone")
+                updates["timezone"] = str(timezone_name).strip() or None
+
+            if job.job_type == "active_agent":
+                self._merge_active_agent_updates(job, payload, updates)
+            else:
+                self._merge_generic_updates(payload, updates)
+
+            updated_job = await cron_mgr.update_job(job_id, **updates)
+            if not updated_job:
+                raise CronServiceError("Job not found")
+            return self.serialize_job(updated_job)
+        except CronServiceError:
+            raise
+        except Exception as exc:
+            logger.error(traceback.format_exc())
+            raise CronServiceError(f"Failed to update job: {exc!s}") from exc
+
+    async def delete_job(self, job_id: str) -> None:
+        try:
+            cron_mgr = self._get_cron_manager()
+            await cron_mgr.delete_job(job_id)
+        except CronServiceError:
+            raise
+        except Exception as exc:
+            logger.error(traceback.format_exc())
+            raise CronServiceError(f"Failed to delete job: {exc!s}") from exc
+
+    async def run_job_now(self, job_id: str) -> None:
+        try:
+            cron_mgr = self._get_cron_manager()
+            job = await cron_mgr.db.get_cron_job(job_id)
+            if not job:
+                raise CronServiceError("Job not found")
+            task = asyncio.create_task(cron_mgr.run_job_now(job_id))
+            self._background_tasks.add(task)
+            task.add_done_callback(self._background_tasks.discard)
+        except CronServiceError:
+            raise
+        except Exception as exc:
+            logger.error(traceback.format_exc())
+            raise CronServiceError(f"Failed to run job: {exc!s}") from exc
+
+    @staticmethod
+    def _parse_optional_run_at(run_at: object) -> datetime | None:
+        if not run_at:
+            return None
+        try:
+            return datetime.fromisoformat(str(run_at))
+        except Exception as exc:
+            raise CronServiceError("run_at must be ISO datetime") from exc
+
+    @staticmethod
+    def _normalize_run_at_iso(run_at: object) -> str | None:
+        if not run_at:
+            return None
+        try:
+            return datetime.fromisoformat(str(run_at)).isoformat()
+        except Exception as exc:
+            raise CronServiceError("run_at must be ISO datetime") from exc
+
+    def _merge_active_agent_updates(self, job, payload: dict, updates: dict) -> None:
+        merged_payload = dict(job.payload) if isinstance(job.payload, dict) else {}
+        if "payload" in payload and isinstance(payload.get("payload"), dict):
+            merged_payload.update(payload["payload"])
+
+        if "session" in payload:
+            session = str(payload.get("session") or "").strip()
+            if session:
+                merged_payload["session"] = session
+            else:
+                merged_payload.pop("session", None)
+
+        self._merge_note(payload, job, merged_payload, updates)
+
+        next_run_once = (
+            bool(payload.get("run_once"))
+            if "run_once" in payload
+            else bool(job.run_once)
+        )
+        next_cron_expression = (
+            payload.get("cron_expression")
+            if "cron_expression" in payload
+            else job.cron_expression
+        )
+        if next_cron_expression is not None:
+            next_cron_expression = str(next_cron_expression).strip() or None
+
+        run_at_raw = (
+            payload.get("run_at")
+            if "run_at" in payload
+            else merged_payload.get("run_at")
+        )
+        run_at_iso = self._normalize_run_at_iso(run_at_raw)
+
+        if next_run_once:
+            if not run_at_iso:
+                raise CronServiceError("run_at is required when run_once=true")
+            next_cron_expression = None
+            merged_payload["run_at"] = run_at_iso
+        else:
+            if not next_cron_expression:
+                raise CronServiceError(
+                    "cron_expression is required when run_once=false"
+                )
+            merged_payload.pop("run_at", None)
+
+        updates["run_once"] = next_run_once
+        updates["cron_expression"] = next_cron_expression
+        updates["payload"] = merged_payload
+
+    @staticmethod
+    def _merge_note(
+        payload: dict,
+        job,
+        merged_payload: dict,
+        updates: dict,
+    ) -> None:
+        note_updated = False
+        if "note" in payload:
+            note = str(payload.get("note") or "").strip()
+            if not note:
+                raise CronServiceError("note cannot be empty")
+            merged_payload["note"] = note
+            updates["description"] = note
+            note_updated = True
+        elif "description" in payload:
+            description = str(payload.get("description") or "").strip()
+            if not description:
+                raise CronServiceError("description cannot be empty")
+            updates["description"] = description
+            merged_payload["note"] = description
+            note_updated = True
+
+        if not note_updated and updates.get("description") is None:
+            existing_note = str(
+                merged_payload.get("note") or job.description or ""
+            ).strip()
+            if existing_note:
+                merged_payload["note"] = existing_note
+
+    @staticmethod
+    def _merge_generic_updates(payload: dict, updates: dict) -> None:
+        if "cron_expression" in payload:
+            cron_expression = str(payload.get("cron_expression") or "").strip()
+            if not cron_expression:
+                raise CronServiceError("cron_expression cannot be empty")
+            updates["cron_expression"] = cron_expression
+
+        if "description" in payload:
+            description = str(payload.get("description") or "").strip()
+            updates["description"] = description or None
diff --git a/astrbot/dashboard/services/file_service.py b/astrbot/dashboard/services/file_service.py
new file mode 100644
index 000000000..31cc5e549
--- /dev/null
+++ b/astrbot/dashboard/services/file_service.py
@@ -0,0 +1,15 @@
+from __future__ import annotations
+
+from astrbot.core import file_token_service
+
+
+class FileServiceError(Exception):
+    pass
+
+
+class FileService:
+    async def resolve_token_file(self, file_token: str) -> str:
+        try:
+            return await file_token_service.handle_file(file_token)
+        except (FileNotFoundError, KeyError) as exc:
+            raise FileServiceError(str(exc)) from exc
diff --git a/astrbot/dashboard/services/knowledge_base_service.py b/astrbot/dashboard/services/knowledge_base_service.py
new file mode 100644
index 000000000..ad2121c9a
--- /dev/null
+++ b/astrbot/dashboard/services/knowledge_base_service.py
@@ -0,0 +1,868 @@
+from __future__ import annotations
+
+import asyncio
+import traceback
+import uuid
+from pathlib import Path
+from typing import Any
+
+import aiofiles
+
+from astrbot.core import logger
+from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
+from astrbot.core.provider.provider import EmbeddingProvider, RerankProvider
+from astrbot.core.utils.astrbot_path import get_astrbot_temp_path
+from astrbot.dashboard.utils import generate_tsne_visualization
+
+
+class KnowledgeBaseServiceError(Exception):
+    pass
+
+
+class KnowledgeBaseService:
+    def __init__(self, core_lifecycle: AstrBotCoreLifecycle) -> None:
+        self.core_lifecycle = core_lifecycle
+        self.upload_progress: dict[str, dict[str, Any]] = {}
+        self.upload_tasks: dict[str, dict[str, Any]] = {}
+
+    @staticmethod
+    def _payload(data: object) -> dict[str, Any]:
+        return data if isinstance(data, dict) else {}
+
+    def get_kb_manager(self):
+        return self.core_lifecycle.kb_manager
+
+    def init_task(self, task_id: str, status: str = "pending") -> None:
+        self.upload_tasks[task_id] = {
+            "status": status,
+            "result": None,
+            "error": None,
+        }
+
+    def set_task_result(
+        self,
+        task_id: str,
+        status: str,
+        result: Any = None,
+        error: str | None = None,
+    ) -> None:
+        self.upload_tasks[task_id] = {
+            "status": status,
+            "result": result,
+            "error": error,
+        }
+        if task_id in self.upload_progress:
+            self.upload_progress[task_id]["status"] = status
+
+    def update_progress(
+        self,
+        task_id: str,
+        *,
+        status: str | None = None,
+        file_index: int | None = None,
+        file_name: str | None = None,
+        stage: str | None = None,
+        current: int | None = None,
+        total: int | None = None,
+    ) -> None:
+        if task_id not in self.upload_progress:
+            return
+        progress = self.upload_progress[task_id]
+        if status is not None:
+            progress["status"] = status
+        if file_index is not None:
+            progress["file_index"] = file_index
+        if file_name is not None:
+            progress["file_name"] = file_name
+        if stage is not None:
+            progress["stage"] = stage
+        if current is not None:
+            progress["current"] = current
+        if total is not None:
+            progress["total"] = total
+
+    def make_progress_callback(self, task_id: str, file_idx: int, file_name: str):
+        async def _callback(stage: str, current: int, total: int) -> None:
+            self.update_progress(
+                task_id,
+                status="processing",
+                file_index=file_idx,
+                file_name=file_name,
+                stage=stage,
+                current=current,
+                total=total,
+            )
+
+        return _callback
+
+    @staticmethod
+    def format_failed_doc_error(file_name: str, error: Exception) -> str:
+        message = str(error).strip() or "上传失败：发生未知错误。"
+        if message.startswith(file_name):
+            return message
+        return f"{file_name}: {message}"
+
+    async def background_upload_task(
+        self,
+        task_id: str,
+        kb_helper,
+        files_to_upload: list[dict[str, Any]],
+        chunk_size: int,
+        chunk_overlap: int,
+        batch_size: int,
+        tasks_limit: int,
+        max_retries: int,
+    ) -> None:
+        try:
+            self.init_task(task_id, status="processing")
+            self.upload_progress[task_id] = {
+                "status": "processing",
+                "file_index": 0,
+                "file_total": len(files_to_upload),
+                "stage": "waiting",
+                "current": 0,
+                "total": 100,
+            }
+
+            uploaded_docs = []
+            failed_docs = []
+
+            for file_idx, file_info in enumerate(files_to_upload):
+                try:
+                    self.update_progress(
+                        task_id,
+                        status="processing",
+                        file_index=file_idx,
+                        file_name=file_info["file_name"],
+                        stage="parsing",
+                        current=0,
+                        total=100,
+                    )
+                    progress_callback = self.make_progress_callback(
+                        task_id, file_idx, file_info["file_name"]
+                    )
+                    doc = await kb_helper.upload_document(
+                        file_name=file_info["file_name"],
+                        file_content=file_info["file_content"],
+                        file_type=file_info["file_type"],
+                        chunk_size=chunk_size,
+                        chunk_overlap=chunk_overlap,
+                        batch_size=batch_size,
+                        tasks_limit=tasks_limit,
+                        max_retries=max_retries,
+                        progress_callback=progress_callback,
+                    )
+                    uploaded_docs.append(doc.model_dump())
+                except Exception as exc:
+                    logger.error(f"上传文档 {file_info['file_name']} 失败: {exc}")
+                    failed_docs.append(
+                        {
+                            "file_name": file_info["file_name"],
+                            "error": self.format_failed_doc_error(
+                                file_info["file_name"], exc
+                            ),
+                        },
+                    )
+
+            self.set_task_result(
+                task_id,
+                "completed",
+                result={
+                    "task_id": task_id,
+                    "uploaded": uploaded_docs,
+                    "failed": failed_docs,
+                    "total": len(files_to_upload),
+                    "success_count": len(uploaded_docs),
+                    "failed_count": len(failed_docs),
+                },
+            )
+        except Exception as exc:
+            logger.error(f"后台上传任务 {task_id} 失败: {exc}")
+            logger.error(traceback.format_exc())
+            self.set_task_result(task_id, "failed", error=str(exc))
+
+    async def background_import_task(
+        self,
+        task_id: str,
+        kb_helper,
+        documents: list[dict[str, Any]],
+        batch_size: int,
+        tasks_limit: int,
+        max_retries: int,
+    ) -> None:
+        try:
+            self.init_task(task_id, status="processing")
+            self.upload_progress[task_id] = {
+                "status": "processing",
+                "file_index": 0,
+                "file_total": len(documents),
+                "stage": "waiting",
+                "current": 0,
+                "total": 100,
+            }
+
+            uploaded_docs = []
+            failed_docs = []
+
+            for file_idx, doc_info in enumerate(documents):
+                file_name = doc_info.get("file_name", f"imported_doc_{file_idx}")
+                chunks = doc_info.get("chunks", [])
+
+                try:
+                    self.update_progress(
+                        task_id,
+                        status="processing",
+                        file_index=file_idx,
+                        file_name=file_name,
+                        stage="importing",
+                        current=0,
+                        total=100,
+                    )
+                    progress_callback = self.make_progress_callback(
+                        task_id, file_idx, file_name
+                    )
+                    doc = await kb_helper.upload_document(
+                        file_name=file_name,
+                        file_content=None,
+                        file_type=doc_info.get("file_type")
+                        or (
+                            file_name.rsplit(".", 1)[-1].lower()
+                            if "." in file_name
+                            else "txt"
+                        ),
+                        batch_size=batch_size,
+                        tasks_limit=tasks_limit,
+                        max_retries=max_retries,
+                        progress_callback=progress_callback,
+                        pre_chunked_text=chunks,
+                    )
+                    uploaded_docs.append(doc.model_dump())
+                except Exception as exc:
+                    logger.error(f"导入文档 {file_name} 失败: {exc}")
+                    failed_docs.append(
+                        {
+                            "file_name": file_name,
+                            "error": self.format_failed_doc_error(file_name, exc),
+                        },
+                    )
+
+            self.set_task_result(
+                task_id,
+                "completed",
+                result={
+                    "task_id": task_id,
+                    "uploaded": uploaded_docs,
+                    "failed": failed_docs,
+                    "total": len(documents),
+                    "success_count": len(uploaded_docs),
+                    "failed_count": len(failed_docs),
+                },
+            )
+        except Exception as exc:
+            logger.error(f"后台导入任务 {task_id} 失败: {exc}")
+            logger.error(traceback.format_exc())
+            self.set_task_result(task_id, "failed", error=str(exc))
+
+    async def list_kbs(self, *, page: int, page_size: int) -> dict[str, Any]:
+        kb_manager = self.get_kb_manager()
+        kbs = await kb_manager.list_kbs()
+
+        kb_list = []
+        for kb in kbs:
+            kb_dict = kb.model_dump()
+            kb_helper = await kb_manager.get_kb(kb.kb_id)
+            if kb_helper and kb_helper.init_error:
+                kb_dict["init_error"] = kb_helper.init_error
+            kb_list.append(kb_dict)
+
+        return {"items": kb_list, "page": page, "page_size": page_size}
+
+    async def list_kbs_from_dashboard_query(self, *, page, page_size) -> dict[str, Any]:
+        return await self.list_kbs(
+            page=self._to_int(page, 1),
+            page_size=self._to_int(page_size, 20),
+        )
+
+    async def create_kb(self, data: object) -> tuple[dict[str, Any], str]:
+        kb_manager = self.get_kb_manager()
+        payload = self._payload(data)
+        kb_name = payload.get("kb_name")
+        if not kb_name:
+            raise KnowledgeBaseServiceError("知识库名称不能为空")
+
+        embedding_provider_id = payload.get("embedding_provider_id")
+        rerank_provider_id = payload.get("rerank_provider_id")
+
+        if not embedding_provider_id:
+            raise KnowledgeBaseServiceError("缺少参数 embedding_provider_id")
+        provider = await kb_manager.provider_manager.get_provider_by_id(
+            embedding_provider_id,
+        )
+        if not provider or not isinstance(provider, EmbeddingProvider):
+            raise KnowledgeBaseServiceError(
+                f"嵌入模型不存在或类型错误({type(provider)})"
+            )
+        try:
+            vec = await provider.get_embedding("astrbot")
+            if len(vec) != provider.get_dim():
+                raise ValueError(
+                    f"嵌入向量维度不匹配，实际是 {len(vec)}，然而配置是 {provider.get_dim()}",
+                )
+        except Exception as exc:
+            raise KnowledgeBaseServiceError(f"测试嵌入模型失败: {exc!s}") from exc
+
+        if rerank_provider_id:
+            rerank_provider = await kb_manager.provider_manager.get_provider_by_id(
+                rerank_provider_id,
+            )
+            if not isinstance(rerank_provider, RerankProvider):
+                raise KnowledgeBaseServiceError("重排序模型不存在")
+            try:
+                result = await rerank_provider.rerank(
+                    query="astrbot",
+                    documents=["astrbot knowledge base"],
+                )
+                if not result:
+                    raise ValueError("重排序模型返回结果异常")
+            except Exception as exc:
+                raise KnowledgeBaseServiceError(
+                    f"测试重排序模型失败: {exc!s}，请检查平台日志输出。"
+                ) from exc
+
+        kb_helper = await kb_manager.create_kb(
+            kb_name=kb_name,
+            description=payload.get("description"),
+            emoji=payload.get("emoji"),
+            embedding_provider_id=embedding_provider_id,
+            rerank_provider_id=rerank_provider_id,
+            chunk_size=payload.get("chunk_size"),
+            chunk_overlap=payload.get("chunk_overlap"),
+            top_k_dense=payload.get("top_k_dense"),
+            top_k_sparse=payload.get("top_k_sparse"),
+            top_m_final=payload.get("top_m_final"),
+        )
+        return kb_helper.kb.model_dump(), "创建知识库成功"
+
+    async def get_kb(self, kb_id: str | None) -> dict[str, Any]:
+        if not kb_id:
+            raise KnowledgeBaseServiceError("缺少参数 kb_id")
+        kb_helper = await self.get_kb_manager().get_kb(kb_id)
+        if not kb_helper:
+            raise KnowledgeBaseServiceError("知识库不存在")
+        return kb_helper.kb.model_dump()
+
+    async def get_kb_from_dashboard_query(self, kb_id: str | None) -> dict[str, Any]:
+        return await self.get_kb(kb_id)
+
+    async def update_kb(self, data: object) -> tuple[dict[str, Any], str]:
+        payload = self._payload(data)
+        kb_id = payload.get("kb_id")
+        if not kb_id:
+            raise KnowledgeBaseServiceError("缺少参数 kb_id")
+
+        update_keys = [
+            "kb_name",
+            "description",
+            "emoji",
+            "embedding_provider_id",
+            "rerank_provider_id",
+            "chunk_size",
+            "chunk_overlap",
+            "top_k_dense",
+            "top_k_sparse",
+            "top_m_final",
+        ]
+        if all(payload.get(key) is None for key in update_keys):
+            raise KnowledgeBaseServiceError("至少需要提供一个更新字段")
+
+        current_kb = await self.get_kb_manager().get_kb(kb_id)
+        kb_name = payload.get("kb_name")
+        if kb_name is None:
+            if not current_kb:
+                raise KnowledgeBaseServiceError("知识库不存在")
+            kb_name = current_kb.kb.kb_name
+
+        kb_helper = await self.get_kb_manager().update_kb(
+            kb_id=kb_id,
+            kb_name=kb_name,
+            description=payload.get("description"),
+            emoji=payload.get("emoji"),
+            embedding_provider_id=payload.get("embedding_provider_id"),
+            rerank_provider_id=payload.get("rerank_provider_id"),
+            chunk_size=payload.get("chunk_size"),
+            chunk_overlap=payload.get("chunk_overlap"),
+            top_k_dense=payload.get("top_k_dense"),
+            top_k_sparse=payload.get("top_k_sparse"),
+            top_m_final=payload.get("top_m_final"),
+        )
+        if not kb_helper:
+            raise KnowledgeBaseServiceError("知识库不存在")
+        return kb_helper.kb.model_dump(), "更新知识库成功"
+
+    async def delete_kb(self, data: object) -> tuple[None, str]:
+        payload = self._payload(data)
+        kb_id = payload.get("kb_id")
+        if not kb_id:
+            raise KnowledgeBaseServiceError("缺少参数 kb_id")
+        success = await self.get_kb_manager().delete_kb(kb_id)
+        if not success:
+            raise KnowledgeBaseServiceError("知识库不存在")
+        return None, "删除知识库成功"
+
+    async def get_kb_stats(self, kb_id: str | None) -> dict[str, Any]:
+        if not kb_id:
+            raise KnowledgeBaseServiceError("缺少参数 kb_id")
+        kb_helper = await self.get_kb_manager().get_kb(kb_id)
+        if not kb_helper:
+            raise KnowledgeBaseServiceError("知识库不存在")
+        kb = kb_helper.kb
+        return {
+            "kb_id": kb.kb_id,
+            "kb_name": kb.kb_name,
+            "doc_count": kb.doc_count,
+            "chunk_count": kb.chunk_count,
+            "created_at": kb.created_at.isoformat(),
+            "updated_at": kb.updated_at.isoformat(),
+        }
+
+    async def get_kb_stats_from_dashboard_query(
+        self,
+        kb_id: str | None,
+    ) -> dict[str, Any]:
+        return await self.get_kb_stats(kb_id)
+
+    async def list_documents(
+        self,
+        *,
+        kb_id: str | None,
+        page: int,
+        page_size: int,
+    ) -> dict[str, Any]:
+        if not kb_id:
+            raise KnowledgeBaseServiceError("缺少参数 kb_id")
+        kb_helper = await self.get_kb_manager().get_kb(kb_id)
+        if not kb_helper:
+            raise KnowledgeBaseServiceError("知识库不存在")
+
+        offset = (page - 1) * page_size
+        doc_list = await kb_helper.list_documents(offset=offset, limit=page_size)
+        return {
+            "items": [doc.model_dump() for doc in doc_list],
+            "page": page,
+            "page_size": page_size,
+        }
+
+    async def list_documents_from_dashboard_query(
+        self,
+        *,
+        kb_id: str | None,
+        page,
+        page_size,
+    ) -> dict[str, Any]:
+        return await self.list_documents(
+            kb_id=kb_id,
+            page=self._to_int(page, 1),
+            page_size=self._to_int(page_size, 100),
+        )
+
+    async def upload_document(
+        self,
+        *,
+        content_type: str | None,
+        form_data,
+        files,
+    ) -> dict[str, Any]:
+        if content_type and "multipart/form-data" not in content_type:
+            raise KnowledgeBaseServiceError("Content-Type 须为 multipart/form-data")
+
+        kb_id = form_data.get("kb_id")
+        chunk_size = int(form_data.get("chunk_size", 512))
+        chunk_overlap = int(form_data.get("chunk_overlap", 50))
+        batch_size = int(form_data.get("batch_size", 32))
+        tasks_limit = int(form_data.get("tasks_limit", 3))
+        max_retries = int(form_data.get("max_retries", 3))
+        if not kb_id:
+            raise KnowledgeBaseServiceError("缺少参数 kb_id")
+
+        file_list = []
+        for key in files.keys():
+            if key == "file" or key.startswith("file") or key == "files[]":
+                file_list.extend(files.getlist(key))
+        if not file_list:
+            raise KnowledgeBaseServiceError("缺少文件")
+        if len(file_list) > 10:
+            raise KnowledgeBaseServiceError("最多只能上传10个文件")
+
+        files_to_upload = []
+        for file in file_list:
+            file_name = file.filename
+            temp_file_path = (
+                Path(get_astrbot_temp_path()) / f"kb_upload_{uuid.uuid4()}_{file_name}"
+            )
+            await file.save(temp_file_path)
+            try:
+                async with aiofiles.open(temp_file_path, "rb") as file_obj:
+                    file_content = await file_obj.read()
+                file_type = (
+                    file_name.rsplit(".", 1)[-1].lower() if "." in file_name else ""
+                )
+                files_to_upload.append(
+                    {
+                        "file_name": file_name,
+                        "file_content": file_content,
+                        "file_type": file_type,
+                    },
+                )
+            finally:
+                temp_file_path.unlink(missing_ok=True)
+
+        kb_helper = await self.get_kb_manager().get_kb(kb_id)
+        if not kb_helper:
+            raise KnowledgeBaseServiceError("知识库不存在")
+
+        task_id = str(uuid.uuid4())
+        self.init_task(task_id, status="pending")
+        asyncio.create_task(
+            self.background_upload_task(
+                task_id=task_id,
+                kb_helper=kb_helper,
+                files_to_upload=files_to_upload,
+                chunk_size=chunk_size,
+                chunk_overlap=chunk_overlap,
+                batch_size=batch_size,
+                tasks_limit=tasks_limit,
+                max_retries=max_retries,
+            ),
+        )
+        return {
+            "task_id": task_id,
+            "file_count": len(files_to_upload),
+            "message": "task created, processing in background",
+        }
+
+    @staticmethod
+    def validate_import_request(data: dict[str, Any]):
+        kb_id = data.get("kb_id")
+        if not kb_id:
+            raise KnowledgeBaseServiceError("缺少参数 kb_id")
+
+        documents = data.get("documents")
+        if not documents or not isinstance(documents, list):
+            raise KnowledgeBaseServiceError("缺少参数 documents 或格式错误")
+
+        for doc in documents:
+            if (
+                not isinstance(doc, dict)
+                or "file_name" not in doc
+                or "chunks" not in doc
+            ):
+                raise KnowledgeBaseServiceError(
+                    "文档格式错误，必须包含 file_name 和 chunks"
+                )
+            if not isinstance(doc["chunks"], list):
+                raise KnowledgeBaseServiceError("chunks 必须是列表")
+            if not all(
+                isinstance(chunk, str) and chunk.strip() for chunk in doc["chunks"]
+            ):
+                raise KnowledgeBaseServiceError("chunks 必须是非空字符串列表")
+
+        return (
+            kb_id,
+            documents,
+            data.get("batch_size", 32),
+            data.get("tasks_limit", 3),
+            data.get("max_retries", 3),
+        )
+
+    async def import_documents(self, data: object) -> dict[str, Any]:
+        payload = self._payload(data)
+        kb_id, documents, batch_size, tasks_limit, max_retries = (
+            self.validate_import_request(payload)
+        )
+
+        kb_helper = await self.get_kb_manager().get_kb(kb_id)
+        if not kb_helper:
+            raise KnowledgeBaseServiceError("知识库不存在")
+
+        task_id = str(uuid.uuid4())
+        self.init_task(task_id, status="pending")
+        asyncio.create_task(
+            self.background_import_task(
+                task_id=task_id,
+                kb_helper=kb_helper,
+                documents=documents,
+                batch_size=batch_size,
+                tasks_limit=tasks_limit,
+                max_retries=max_retries,
+            ),
+        )
+        return {
+            "task_id": task_id,
+            "doc_count": len(documents),
+            "message": "import task created, processing in background",
+        }
+
+    def get_upload_progress(self, task_id: str | None) -> dict[str, Any]:
+        if not task_id:
+            raise KnowledgeBaseServiceError("缺少参数 task_id")
+        if task_id not in self.upload_tasks:
+            raise KnowledgeBaseServiceError("找不到该任务")
+
+        task_info = self.upload_tasks[task_id]
+        status = task_info["status"]
+        response_data = {
+            "task_id": task_id,
+            "status": status,
+        }
+        if status == "processing" and task_id in self.upload_progress:
+            response_data["progress"] = self.upload_progress[task_id]
+        if status == "completed":
+            response_data["result"] = task_info["result"]
+        if status == "failed":
+            response_data["error"] = task_info["error"]
+        return response_data
+
+    def get_upload_progress_from_dashboard_query(
+        self,
+        task_id: str | None,
+    ) -> dict[str, Any]:
+        return self.get_upload_progress(task_id)
+
+    async def get_document(
+        self,
+        *,
+        kb_id: str | None,
+        doc_id: str | None,
+    ) -> dict[str, Any]:
+        if not kb_id:
+            raise KnowledgeBaseServiceError("缺少参数 kb_id")
+        if not doc_id:
+            raise KnowledgeBaseServiceError("缺少参数 doc_id")
+        kb_helper = await self.get_kb_manager().get_kb(kb_id)
+        if not kb_helper:
+            raise KnowledgeBaseServiceError("知识库不存在")
+        doc = await kb_helper.get_document(doc_id)
+        if not doc:
+            raise KnowledgeBaseServiceError("文档不存在")
+        return doc.model_dump()
+
+    async def get_document_from_dashboard_query(
+        self,
+        *,
+        kb_id: str | None,
+        doc_id: str | None,
+    ) -> dict[str, Any]:
+        return await self.get_document(kb_id=kb_id, doc_id=doc_id)
+
+    async def delete_document(self, data: object) -> tuple[None, str]:
+        payload = self._payload(data)
+        kb_id = payload.get("kb_id")
+        doc_id = payload.get("doc_id")
+        if not kb_id:
+            raise KnowledgeBaseServiceError("缺少参数 kb_id")
+        if not doc_id:
+            raise KnowledgeBaseServiceError("缺少参数 doc_id")
+        kb_helper = await self.get_kb_manager().get_kb(kb_id)
+        if not kb_helper:
+            raise KnowledgeBaseServiceError("知识库不存在")
+        await kb_helper.delete_document(doc_id)
+        return None, "删除文档成功"
+
+    async def delete_chunk(self, data: object) -> tuple[None, str]:
+        payload = self._payload(data)
+        kb_id = payload.get("kb_id")
+        chunk_id = payload.get("chunk_id")
+        doc_id = payload.get("doc_id")
+        if not kb_id:
+            raise KnowledgeBaseServiceError("缺少参数 kb_id")
+        if not chunk_id:
+            raise KnowledgeBaseServiceError("缺少参数 chunk_id")
+        if not doc_id:
+            raise KnowledgeBaseServiceError("缺少参数 doc_id")
+        kb_helper = await self.get_kb_manager().get_kb(kb_id)
+        if not kb_helper:
+            raise KnowledgeBaseServiceError("知识库不存在")
+        await kb_helper.delete_chunk(chunk_id, doc_id)
+        return None, "删除文本块成功"
+
+    async def list_chunks(
+        self,
+        *,
+        kb_id: str | None,
+        doc_id: str | None,
+        page: int,
+        page_size: int,
+    ) -> dict[str, Any]:
+        if not kb_id:
+            raise KnowledgeBaseServiceError("缺少参数 kb_id")
+        if not doc_id:
+            raise KnowledgeBaseServiceError("缺少参数 doc_id")
+        kb_helper = await self.get_kb_manager().get_kb(kb_id)
+        if not kb_helper:
+            raise KnowledgeBaseServiceError("知识库不存在")
+
+        offset = (page - 1) * page_size
+        return {
+            "items": await kb_helper.get_chunks_by_doc_id(
+                doc_id=doc_id,
+                offset=offset,
+                limit=page_size,
+            ),
+            "page": page,
+            "page_size": page_size,
+            "total": await kb_helper.get_chunk_count_by_doc_id(doc_id),
+        }
+
+    async def list_chunks_from_dashboard_query(
+        self,
+        *,
+        kb_id: str | None,
+        doc_id: str | None,
+        page,
+        page_size,
+    ) -> dict[str, Any]:
+        return await self.list_chunks(
+            kb_id=kb_id,
+            doc_id=doc_id,
+            page=self._to_int(page, 1),
+            page_size=self._to_int(page_size, 100),
+        )
+
+    async def retrieve(self, data: object) -> dict[str, Any]:
+        payload = self._payload(data)
+        query = payload.get("query")
+        kb_names = payload.get("kb_names")
+        debug = payload.get("debug", False)
+
+        if not query:
+            raise KnowledgeBaseServiceError("缺少参数 query")
+        if not kb_names or not isinstance(kb_names, list):
+            raise KnowledgeBaseServiceError("缺少参数 kb_names 或格式错误")
+
+        top_k = payload.get("top_k", 5)
+        kb_manager = self.get_kb_manager()
+        results = await kb_manager.retrieve(
+            query=query,
+            kb_names=kb_names,
+            top_m_final=top_k,
+        )
+        result_list = results["results"] if results else []
+        response_data = {
+            "results": result_list,
+            "total": len(result_list),
+            "query": query,
+        }
+
+        if debug:
+            try:
+                img_base64 = await generate_tsne_visualization(
+                    query,
+                    kb_names,
+                    kb_manager,
+                )
+                if img_base64:
+                    response_data["visualization"] = img_base64
+            except Exception as exc:
+                logger.error(f"生成 t-SNE 可视化失败: {exc}")
+                logger.error(traceback.format_exc())
+                response_data["visualization_error"] = str(exc)
+
+        return response_data
+
+    async def upload_document_from_url(self, data: object) -> dict[str, Any]:
+        payload = self._payload(data)
+        kb_id = payload.get("kb_id")
+        if not kb_id:
+            raise KnowledgeBaseServiceError("缺少参数 kb_id")
+        url = payload.get("url")
+        if not url:
+            raise KnowledgeBaseServiceError("缺少参数 url")
+
+        kb_helper = await self.get_kb_manager().get_kb(kb_id)
+        if not kb_helper:
+            raise KnowledgeBaseServiceError("知识库不存在")
+
+        task_id = str(uuid.uuid4())
+        self.init_task(task_id, status="pending")
+        asyncio.create_task(
+            self.background_upload_from_url_task(
+                task_id=task_id,
+                kb_helper=kb_helper,
+                url=url,
+                chunk_size=payload.get("chunk_size", 512),
+                chunk_overlap=payload.get("chunk_overlap", 50),
+                batch_size=payload.get("batch_size", 32),
+                tasks_limit=payload.get("tasks_limit", 3),
+                max_retries=payload.get("max_retries", 3),
+                enable_cleaning=payload.get("enable_cleaning", False),
+                cleaning_provider_id=payload.get("cleaning_provider_id"),
+            ),
+        )
+        return {
+            "task_id": task_id,
+            "url": url,
+            "message": "URL upload task created, processing in background",
+        }
+
+    async def background_upload_from_url_task(
+        self,
+        task_id: str,
+        kb_helper,
+        url: str,
+        chunk_size: int,
+        chunk_overlap: int,
+        batch_size: int,
+        tasks_limit: int,
+        max_retries: int,
+        enable_cleaning: bool,
+        cleaning_provider_id: str | None,
+    ) -> None:
+        try:
+            self.init_task(task_id, status="processing")
+            self.upload_progress[task_id] = {
+                "status": "processing",
+                "file_index": 0,
+                "file_total": 1,
+                "file_name": f"URL: {url}",
+                "stage": "extracting",
+                "current": 0,
+                "total": 100,
+            }
+            progress_callback = self.make_progress_callback(task_id, 0, f"URL: {url}")
+            doc = await kb_helper.upload_from_url(
+                url=url,
+                chunk_size=chunk_size,
+                chunk_overlap=chunk_overlap,
+                batch_size=batch_size,
+                tasks_limit=tasks_limit,
+                max_retries=max_retries,
+                progress_callback=progress_callback,
+                enable_cleaning=enable_cleaning,
+                cleaning_provider_id=cleaning_provider_id,
+            )
+            self.set_task_result(
+                task_id,
+                "completed",
+                result={
+                    "task_id": task_id,
+                    "uploaded": [doc.model_dump()],
+                    "failed": [],
+                    "total": 1,
+                    "success_count": 1,
+                    "failed_count": 0,
+                },
+            )
+        except Exception as exc:
+            logger.error(f"后台上传URL任务 {task_id} 失败: {exc}")
+            logger.error(traceback.format_exc())
+            self.set_task_result(task_id, "failed", error=str(exc))
+
+    @staticmethod
+    def _to_int(value, default: int) -> int:
+        try:
+            return int(value)
+        except (TypeError, ValueError):
+            return default
+
+
+__all__ = ["KnowledgeBaseService", "KnowledgeBaseServiceError"]
diff --git a/astrbot/dashboard/routes/live_chat.py b/astrbot/dashboard/services/live_chat_service.py
similarity index 74%
rename from astrbot/dashboard/routes/live_chat.py
rename to astrbot/dashboard/services/live_chat_service.py
index d7705882d..d336ed127 100644
--- a/astrbot/dashboard/routes/live_chat.py
+++ b/astrbot/dashboard/services/live_chat_service.py
@@ -1,14 +1,18 @@
+from __future__ import annotations
+
 import asyncio
+import base64
 import json
 import os
 import re
 import time
 import uuid
 import wave
+from collections.abc import Awaitable, Callable
 from typing import Any
 
 import jwt
-from quart import websocket
+from starlette.websockets import WebSocketDisconnect
 
 from astrbot import logger
 from astrbot.core import sp
@@ -22,13 +26,19 @@ from astrbot.core.platform.sources.webchat.message_parts_helper import (
 from astrbot.core.platform.sources.webchat.webchat_queue_mgr import webchat_queue_mgr
 from astrbot.core.utils.astrbot_path import get_astrbot_data_path, get_astrbot_temp_path
 from astrbot.core.utils.datetime_utils import to_utc_isoformat
-
-from .chat import (
+from astrbot.dashboard.services.chat_service import (
     BotMessageAccumulator,
     build_bot_history_content,
     collect_plain_text_from_message_parts,
 )
-from .route import Route, RouteContext
+
+SendJson = Callable[[dict], Awaitable[None]]
+ReceiveJson = Callable[[], Awaitable[dict]]
+CloseWebSocket = Callable[[int, str], Awaitable[None]]
+
+
+class LiveChatAuthError(Exception):
+    pass
 
 
 class LiveChatSession:
@@ -49,19 +59,16 @@ class LiveChatSession:
         self.ws_send_lock = asyncio.Lock()
 
     def start_speaking(self, stamp: str) -> None:
-        """开始说话"""
         self.is_speaking = True
         self.current_stamp = stamp
         self.audio_frames = []
         logger.debug(f"[Live Chat] {self.username} 开始说话 stamp={stamp}")
 
     def add_audio_frame(self, data: bytes) -> None:
-        """添加音频帧"""
         if self.is_speaking:
             self.audio_frames.append(data)
 
     async def end_speaking(self, stamp: str) -> tuple[str | None, float]:
-        """结束说话，返回组装的 WAV 文件路径和耗时"""
         start_time = time.time()
         if not self.is_speaking or stamp != self.current_stamp:
             logger.warning(
@@ -75,17 +82,15 @@ class LiveChatSession:
             logger.warning("[Live Chat] 没有音频帧数据")
             return None, 0.0
 
-        # 组装 WAV 文件
         try:
             temp_dir = get_astrbot_temp_path()
             os.makedirs(temp_dir, exist_ok=True)
             audio_path = os.path.join(temp_dir, f"live_audio_{uuid.uuid4()}.wav")
 
-            # 假设前端发送的是 PCM 数据，采样率 16000Hz，单声道，16位
             with wave.open(audio_path, "wb") as wav_file:
-                wav_file.setnchannels(1)  # 单声道
-                wav_file.setsampwidth(2)  # 16位 = 2字节
-                wav_file.setframerate(16000)  # 采样率 16000Hz
+                wav_file.setnchannels(1)
+                wav_file.setsampwidth(2)
+                wav_file.setframerate(16000)
                 for frame in self.audio_frames:
                     wav_file.writeframes(frame)
 
@@ -95,114 +100,123 @@ class LiveChatSession:
             )
             return audio_path, time.time() - start_time
 
-        except Exception as e:
-            logger.error(f"[Live Chat] 组装 WAV 文件失败: {e}", exc_info=True)
+        except Exception as exc:
+            logger.error(f"[Live Chat] 组装 WAV 文件失败: {exc}", exc_info=True)
             return None, 0.0
 
     def cleanup(self) -> None:
-        """清理临时文件"""
         if self.temp_audio_path and os.path.exists(self.temp_audio_path):
             try:
                 os.remove(self.temp_audio_path)
                 logger.debug(f"[Live Chat] 已删除临时文件: {self.temp_audio_path}")
-            except Exception as e:
-                logger.warning(f"[Live Chat] 删除临时文件失败: {e}")
+            except Exception as exc:
+                logger.warning(f"[Live Chat] 删除临时文件失败: {exc}")
         self.temp_audio_path = None
 
 
-class LiveChatRoute(Route):
-    """Live Chat WebSocket 路由"""
-
+class LiveChatService:
     def __init__(
         self,
-        context: RouteContext,
         db: Any,
         core_lifecycle: AstrBotCoreLifecycle,
     ) -> None:
-        super().__init__(context)
-        self.core_lifecycle = core_lifecycle
         self.db = db
+        self.core_lifecycle = core_lifecycle
+        self.config = core_lifecycle.astrbot_config
         self.plugin_manager = core_lifecycle.plugin_manager
         self.platform_history_mgr = core_lifecycle.platform_message_history_manager
         self.sessions: dict[str, LiveChatSession] = {}
         self.attachments_dir = os.path.join(get_astrbot_data_path(), "attachments")
-        self.legacy_img_dir = os.path.join(get_astrbot_data_path(), "webchat", "imgs")
+        self.webchat_img_dir = os.path.join(get_astrbot_data_path(), "webchat", "imgs")
         os.makedirs(self.attachments_dir, exist_ok=True)
 
-        # 注册 WebSocket 路由
-        self.app.websocket("/api/live_chat/ws")(self.live_chat_ws)
-        self.app.websocket("/api/unified_chat/ws")(self.unified_chat_ws)
-
-    async def live_chat_ws(self) -> None:
-        """Legacy Live Chat WebSocket 处理器（默认 ct=live）"""
-        await self._unified_ws_loop(force_ct="live")
-
-    async def unified_chat_ws(self) -> None:
-        """Unified Chat WebSocket 处理器（支持 ct=live/chat）"""
-        await self._unified_ws_loop(force_ct=None)
-
-    async def _unified_ws_loop(self, force_ct: str | None = None) -> None:
-        """统一 WebSocket 循环"""
-        # WebSocket 不能通过 header 传递 token，需要从 query 参数获取
-        # 注意：WebSocket 上下文使用 websocket.args 而不是 request.args
-        token = websocket.args.get("token")
+    def authenticate_token(
+        self,
+        token: str | None,
+        jwt_secret: str | None = None,
+    ) -> str:
         if not token:
-            await websocket.close(1008, "Missing authentication token")
-            return
-
+            raise LiveChatAuthError("Missing authentication token")
+        jwt_secret = jwt_secret or self.config["dashboard"].get("jwt_secret")
         try:
-            jwt_secret = self.config["dashboard"].get("jwt_secret")
             payload = jwt.decode(token, jwt_secret, algorithms=["HS256"])
-            username = payload["username"]
-        except jwt.ExpiredSignatureError:
-            await websocket.close(1008, "Token expired")
-            return
-        except jwt.InvalidTokenError:
-            await websocket.close(1008, "Invalid token")
-            return
+            return payload["username"]
+        except jwt.ExpiredSignatureError as exc:
+            raise LiveChatAuthError("Token expired") from exc
+        except jwt.InvalidTokenError as exc:
+            raise LiveChatAuthError("Invalid token") from exc
 
+    def create_session(self, username: str) -> LiveChatSession:
         session_id = f"webchat_live!{username}!{uuid.uuid4()}"
-        live_session = LiveChatSession(session_id, username)
-        self.sessions[session_id] = live_session
+        session = LiveChatSession(session_id, username)
+        self.sessions[session_id] = session
+        return session
 
+    async def cleanup_session(self, session: LiveChatSession) -> None:
+        if session.session_id in self.sessions:
+            await self.cleanup_chat_subscriptions(session)
+            session.cleanup()
+            del self.sessions[session.session_id]
+
+    async def run_websocket_session(
+        self,
+        *,
+        token: str | None,
+        force_ct: str | None,
+        receive_json: ReceiveJson,
+        send_json: SendJson,
+        close: CloseWebSocket,
+    ) -> None:
+        try:
+            username = self.authenticate_token(token)
+        except LiveChatAuthError as exc:
+            await close(1008, str(exc))
+            return
+
+        live_session = self.create_session(username)
         logger.info(f"[Live Chat] WebSocket 连接建立: {username}")
 
         try:
             while True:
-                message = await websocket.receive_json()
+                message = await receive_json()
                 ct = force_ct or message.get("ct", "live")
                 if ct == "chat":
-                    await self._handle_chat_message(live_session, message)
+                    await self.handle_chat_message(
+                        live_session,
+                        message,
+                        send_json,
+                    )
                 else:
-                    await self._handle_message(live_session, message)
+                    await self.handle_live_message(
+                        live_session,
+                        message,
+                        send_json,
+                    )
 
-        except Exception as e:
-            logger.error(f"[Live Chat] WebSocket 错误: {e}", exc_info=True)
+        except WebSocketDisconnect as exc:
+            logger.debug(
+                f"[Live Chat] WebSocket disconnected: {username}, code={exc.code}"
+            )
+        except Exception as exc:
+            logger.error(f"[Live Chat] WebSocket 错误: {exc}", exc_info=True)
 
         finally:
-            # 清理会话
-            if session_id in self.sessions:
-                await self._cleanup_chat_subscriptions(live_session)
-                live_session.cleanup()
-                del self.sessions[session_id]
+            await self.cleanup_session(live_session)
             logger.info(f"[Live Chat] WebSocket 连接关闭: {username}")
 
-    async def _create_attachment_from_file(
+    async def create_attachment_from_file(
         self, filename: str, attach_type: str
     ) -> dict | None:
-        """从本地文件创建 attachment 并返回消息部分。"""
         return await create_attachment_part_from_existing_file(
             filename,
             attach_type=attach_type,
             insert_attachment=self.db.insert_attachment,
             attachments_dir=self.attachments_dir,
-            fallback_dirs=[self.legacy_img_dir],
+            fallback_dirs=[self.webchat_img_dir],
         )
 
-    def _extract_web_search_refs(
-        self, accumulated_text: str, accumulated_parts: list
-    ) -> dict:
-        """从消息中提取 web_search 引用。"""
+    @staticmethod
+    def extract_web_search_refs(accumulated_text: str, accumulated_parts: list) -> dict:
         supported = [
             "web_search_baidu",
             "web_search_tavily",
@@ -238,7 +252,7 @@ class LiveChatRoute(Route):
             return {}
 
         ref_indices = {
-            m.strip() for m in re.findall(r"<ref>(.*?)</ref>", accumulated_text)
+            match.strip() for match in re.findall(r"<ref>(.*?)</ref>", accumulated_text)
         }
 
         used_refs = []
@@ -252,7 +266,7 @@ class LiveChatRoute(Route):
 
         return {"used": used_refs} if used_refs else {}
 
-    async def _save_bot_message(
+    async def save_bot_message(
         self,
         webchat_conv_id: str,
         message_parts: list[dict],
@@ -260,7 +274,6 @@ class LiveChatRoute(Route):
         refs: dict,
         llm_checkpoint_id: str | None = None,
     ):
-        """保存 bot 消息到历史记录。"""
         new_his = build_bot_history_content(
             message_parts,
             agent_stats=agent_stats,
@@ -276,15 +289,21 @@ class LiveChatRoute(Route):
             llm_checkpoint_id=llm_checkpoint_id,
         )
 
-    async def _send_chat_payload(self, session: LiveChatSession, payload: dict) -> None:
+    async def send_chat_payload(
+        self,
+        session: LiveChatSession,
+        payload: dict,
+        send_json: SendJson,
+    ) -> None:
         async with session.ws_send_lock:
-            await websocket.send_json(payload)
+            await send_json(payload)
 
-    async def _forward_chat_subscription(
+    async def forward_chat_subscription(
         self,
         session: LiveChatSession,
         chat_session_id: str,
         request_id: str,
+        send_json: SendJson,
     ) -> None:
         back_queue = webchat_queue_mgr.get_or_create_back_queue(
             request_id, chat_session_id
@@ -294,12 +313,14 @@ class LiveChatRoute(Route):
                 result = await back_queue.get()
                 if not result:
                     continue
-                await self._send_chat_payload(session, {"ct": "chat", **result})
+                await self.send_chat_payload(
+                    session, {"ct": "chat", **result}, send_json
+                )
         except asyncio.CancelledError:
             pass
-        except Exception as e:
+        except Exception as exc:
             logger.error(
-                f"[Live Chat] chat subscription forward failed ({chat_session_id}): {e}",
+                f"[Live Chat] chat subscription forward failed ({chat_session_id}): {exc}",
                 exc_info=True,
             )
         finally:
@@ -308,10 +329,11 @@ class LiveChatRoute(Route):
                 session.chat_subscriptions.pop(chat_session_id, None)
             session.chat_subscription_tasks.pop(chat_session_id, None)
 
-    async def _ensure_chat_subscription(
+    async def ensure_chat_subscription(
         self,
         session: LiveChatSession,
         chat_session_id: str,
+        send_json: SendJson,
     ) -> str:
         existing_request_id = session.chat_subscriptions.get(chat_session_id)
         existing_task = session.chat_subscription_tasks.get(chat_session_id)
@@ -321,13 +343,18 @@ class LiveChatRoute(Route):
         request_id = f"ws_sub_{uuid.uuid4().hex}"
         session.chat_subscriptions[chat_session_id] = request_id
         task = asyncio.create_task(
-            self._forward_chat_subscription(session, chat_session_id, request_id),
+            self.forward_chat_subscription(
+                session,
+                chat_session_id,
+                request_id,
+                send_json,
+            ),
             name=f"chat_ws_sub_{chat_session_id}",
         )
         session.chat_subscription_tasks[chat_session_id] = task
         return request_id
 
-    async def _cleanup_chat_subscriptions(self, session: LiveChatSession) -> None:
+    async def cleanup_chat_subscriptions(self, session: LiveChatSession) -> None:
         tasks = list(session.chat_subscription_tasks.values())
         for task in tasks:
             task.cancel()
@@ -339,16 +366,18 @@ class LiveChatRoute(Route):
         session.chat_subscriptions.clear()
         session.chat_subscription_tasks.clear()
 
-    async def _handle_chat_message(
-        self, session: LiveChatSession, message: dict
+    async def handle_chat_message(
+        self,
+        session: LiveChatSession,
+        message: dict,
+        send_json: SendJson,
     ) -> None:
-        """处理 Chat Mode 消息（ct=chat）"""
         msg_type = message.get("t")
 
         if msg_type == "bind":
             chat_session_id = message.get("session_id")
             if not isinstance(chat_session_id, str) or not chat_session_id:
-                await self._send_chat_payload(
+                await self.send_chat_payload(
                     session,
                     {
                         "ct": "chat",
@@ -356,11 +385,14 @@ class LiveChatRoute(Route):
                         "data": "session_id is required",
                         "code": "INVALID_MESSAGE_FORMAT",
                     },
+                    send_json,
                 )
                 return
 
-            request_id = await self._ensure_chat_subscription(session, chat_session_id)
-            await self._send_chat_payload(
+            request_id = await self.ensure_chat_subscription(
+                session, chat_session_id, send_json
+            )
+            await self.send_chat_payload(
                 session,
                 {
                     "ct": "chat",
@@ -368,12 +400,13 @@ class LiveChatRoute(Route):
                     "session_id": chat_session_id,
                     "message_id": request_id,
                 },
+                send_json,
             )
             return
 
         if msg_type == "interrupt":
             session.should_interrupt = True
-            await self._send_chat_payload(
+            await self.send_chat_payload(
                 session,
                 {
                     "ct": "chat",
@@ -381,11 +414,12 @@ class LiveChatRoute(Route):
                     "data": "INTERRUPTED",
                     "code": "INTERRUPTED",
                 },
+                send_json,
             )
             return
 
         if msg_type != "send":
-            await self._send_chat_payload(
+            await self.send_chat_payload(
                 session,
                 {
                     "ct": "chat",
@@ -393,11 +427,12 @@ class LiveChatRoute(Route):
                     "data": f"Unsupported message type: {msg_type}",
                     "code": "INVALID_MESSAGE_FORMAT",
                 },
+                send_json,
             )
             return
 
         if session.is_processing:
-            await self._send_chat_payload(
+            await self.send_chat_payload(
                 session,
                 {
                     "ct": "chat",
@@ -405,6 +440,7 @@ class LiveChatRoute(Route):
                     "data": "Session is busy",
                     "code": "PROCESSING_ERROR",
                 },
+                send_json,
             )
             return
 
@@ -420,7 +456,7 @@ class LiveChatRoute(Route):
         enable_streaming = message.get("enable_streaming", True)
 
         if not isinstance(payload, list):
-            await self._send_chat_payload(
+            await self.send_chat_payload(
                 session,
                 {
                     "ct": "chat",
@@ -428,13 +464,14 @@ class LiveChatRoute(Route):
                     "data": "message must be list",
                     "code": "INVALID_MESSAGE_FORMAT",
                 },
+                send_json,
             )
             return
 
-        message_parts = await self._build_chat_message_parts(payload)
+        message_parts = await self.build_chat_message_parts(payload)
         has_content = webchat_message_parts_have_content(message_parts)
         if not has_content:
-            await self._send_chat_payload(
+            await self.send_chat_payload(
                 session,
                 {
                     "ct": "chat",
@@ -442,18 +479,19 @@ class LiveChatRoute(Route):
                     "data": "Message content is empty",
                     "code": "INVALID_MESSAGE_FORMAT",
                 },
+                send_json,
             )
             return
 
-        await self._ensure_chat_subscription(session, session_id)
+        await self.ensure_chat_subscription(session, session_id, send_json)
 
         session.is_processing = True
         session.should_interrupt = False
         back_queue = webchat_queue_mgr.get_or_create_back_queue(message_id, session_id)
         llm_checkpoint_id = str(uuid.uuid4())
 
+        pending_bot_message_flusher = None
         try:
-            pending_bot_message_flusher = None
             chat_queue = webchat_queue_mgr.get_or_create_queue(session_id)
             await chat_queue.put(
                 (
@@ -483,7 +521,7 @@ class LiveChatRoute(Route):
                 sender_name=session.username,
                 llm_checkpoint_id=llm_checkpoint_id,
             )
-            await self._send_chat_payload(
+            await self.send_chat_payload(
                 session,
                 {
                     "ct": "chat",
@@ -494,6 +532,7 @@ class LiveChatRoute(Route):
                         "llm_checkpoint_id": llm_checkpoint_id,
                     },
                 },
+                send_json,
             )
 
             message_accumulator = BotMessageAccumulator()
@@ -512,18 +551,18 @@ class LiveChatRoute(Route):
                     message_parts_to_save
                 )
                 try:
-                    extracted_refs = self._extract_web_search_refs(
+                    extracted_refs = self.extract_web_search_refs(
                         plain_text,
                         message_parts_to_save,
                     )
-                except Exception as e:
+                except Exception as exc:
                     logger.exception(
-                        f"[Live Chat] Failed to extract web search refs: {e}",
+                        f"[Live Chat] Failed to extract web search refs: {exc}",
                         exc_info=True,
                     )
                     extracted_refs = refs
 
-                saved_record = await self._save_bot_message(
+                saved_record = await self.save_bot_message(
                     session_id,
                     message_parts_to_save,
                     agent_stats,
@@ -541,7 +580,7 @@ class LiveChatRoute(Route):
                 if not part or not part.get("attachment_id") or not part.get("type"):
                     return
 
-                await self._send_chat_payload(
+                await self.send_chat_payload(
                     session,
                     {
                         "ct": "chat",
@@ -551,6 +590,7 @@ class LiveChatRoute(Route):
                             "type": part["type"],
                         },
                     },
+                    send_json,
                 )
 
             while True:
@@ -570,61 +610,62 @@ class LiveChatRoute(Route):
                     continue
 
                 result_text = result.get("data", "")
-                msg_type = result.get("type")
+                result_type = result.get("type")
                 streaming = result.get("streaming", False)
                 chain_type = result.get("chain_type")
                 if chain_type == "agent_stats":
                     try:
                         parsed_agent_stats = json.loads(result_text)
                         agent_stats = parsed_agent_stats
-                        await self._send_chat_payload(
+                        await self.send_chat_payload(
                             session,
                             {
                                 "ct": "chat",
                                 "type": "agent_stats",
                                 "data": parsed_agent_stats,
                             },
+                            send_json,
                         )
                     except Exception:
                         pass
                     continue
 
                 outgoing = {"ct": "chat", **result}
-                await self._send_chat_payload(session, outgoing)
+                await self.send_chat_payload(session, outgoing, send_json)
 
-                if msg_type == "plain":
+                if result_type == "plain":
                     message_accumulator.add_plain(
                         result_text,
                         chain_type=chain_type,
                         streaming=streaming,
                     )
-                elif msg_type == "image":
+                elif result_type == "image":
                     filename = str(result_text).replace("[IMAGE]", "")
-                    part = await self._create_attachment_from_file(filename, "image")
+                    part = await self.create_attachment_from_file(filename, "image")
                     message_accumulator.add_attachment(part)
                     await send_attachment_saved_event(part)
-                elif msg_type == "record":
+                elif result_type == "record":
                     filename = str(result_text).replace("[RECORD]", "")
-                    part = await self._create_attachment_from_file(filename, "record")
+                    part = await self.create_attachment_from_file(filename, "record")
                     message_accumulator.add_attachment(part)
                     await send_attachment_saved_event(part)
-                elif msg_type == "file":
+                elif result_type == "file":
                     filename = str(result_text).replace("[FILE]", "").split("|", 1)[0]
-                    part = await self._create_attachment_from_file(filename, "file")
+                    part = await self.create_attachment_from_file(filename, "file")
                     message_accumulator.add_attachment(part)
                     await send_attachment_saved_event(part)
-                elif msg_type == "video":
+                elif result_type == "video":
                     filename = str(result_text).replace("[VIDEO]", "").split("|", 1)[0]
-                    part = await self._create_attachment_from_file(filename, "video")
+                    part = await self.create_attachment_from_file(filename, "video")
                     message_accumulator.add_attachment(part)
                     await send_attachment_saved_event(part)
 
                 should_save = False
-                if msg_type == "end":
+                if result_type == "end":
                     should_save = bool(
                         message_accumulator.has_content() or refs or agent_stats
                     )
-                elif (streaming and msg_type == "complete") or not streaming:
+                elif (streaming and result_type == "complete") or not streaming:
                     if chain_type not in (
                         "tool_call",
                         "tool_call_result",
@@ -635,7 +676,7 @@ class LiveChatRoute(Route):
                 if should_save:
                     saved_record = await flush_pending_bot_message()
                     if saved_record:
-                        await self._send_chat_payload(
+                        await self.send_chat_payload(
                             session,
                             {
                                 "ct": "chat",
@@ -648,71 +689,71 @@ class LiveChatRoute(Route):
                                     "llm_checkpoint_id": llm_checkpoint_id,
                                 },
                             },
+                            send_json,
                         )
 
-                if msg_type == "end":
+                if result_type == "end":
                     break
 
-        except Exception as e:
-            logger.error(f"[Live Chat] 处理 chat 消息失败: {e}", exc_info=True)
-            await self._send_chat_payload(
+        except Exception as exc:
+            logger.error(f"[Live Chat] 处理 chat 消息失败: {exc}", exc_info=True)
+            await self.send_chat_payload(
                 session,
                 {
                     "ct": "chat",
                     "t": "error",
-                    "data": f"处理失败: {str(e)}",
+                    "data": f"处理失败: {str(exc)}",
                     "code": "PROCESSING_ERROR",
                 },
+                send_json,
             )
         finally:
             try:
                 if pending_bot_message_flusher is not None:
                     await pending_bot_message_flusher()
-            except Exception as e:
+            except Exception as exc:
                 logger.exception(
-                    f"[Live Chat] Failed to persist pending chat message: {e}",
+                    f"[Live Chat] Failed to persist pending chat message: {exc}",
                     exc_info=True,
                 )
             session.is_processing = False
             webchat_queue_mgr.remove_back_queue(message_id)
 
-    async def _build_chat_message_parts(self, message: list[dict]) -> list[dict]:
-        """构建 chat websocket 用户消息段（复用 webchat 逻辑）"""
+    async def build_chat_message_parts(self, message: list[dict]) -> list[dict]:
         return await build_webchat_message_parts(
             message,
             get_attachment_by_id=self.db.get_attachment_by_id,
             strict=False,
         )
 
-    async def _handle_message(self, session: LiveChatSession, message: dict) -> None:
-        """处理 WebSocket 消息"""
-        msg_type = message.get("t")  # 使用 t 代替 type
+    async def handle_live_message(
+        self,
+        session: LiveChatSession,
+        message: dict,
+        send_json: SendJson,
+    ) -> None:
+        msg_type = message.get("t")
 
         if msg_type == "start_speaking":
-            # 开始说话
             stamp = message.get("stamp")
             if not stamp:
                 logger.warning("[Live Chat] start_speaking 缺少 stamp")
                 return
             session.start_speaking(stamp)
+            return
 
-        elif msg_type == "speaking_part":
-            # 音频片段
+        if msg_type == "speaking_part":
             audio_data_b64 = message.get("data")
             if not audio_data_b64:
                 return
-
-            # 解码 base64
-            import base64
-
             try:
                 audio_data = base64.b64decode(audio_data_b64)
                 session.add_audio_frame(audio_data)
-            except Exception as e:
-                logger.error(f"[Live Chat] 解码音频数据失败: {e}")
+            except Exception as exc:
+                logger.error(f"[Live Chat] 解码音频数据失败: {exc}")
+            return
 
-        elif msg_type == "end_speaking":
-            # 结束说话
+        if msg_type == "end_speaking":
             stamp = message.get("stamp")
             if not stamp:
                 logger.warning("[Live Chat] end_speaking 缺少 stamp")
@@ -720,24 +761,25 @@ class LiveChatRoute(Route):
 
             audio_path, assemble_duration = await session.end_speaking(stamp)
             if not audio_path:
-                await websocket.send_json({"t": "error", "data": "音频组装失败"})
+                await send_json({"t": "error", "data": "音频组装失败"})
                 return
 
-            # 处理音频：STT -> LLM -> TTS
-            await self._process_audio(session, audio_path, assemble_duration)
+            await self.process_audio(session, audio_path, assemble_duration, send_json)
+            return
 
-        elif msg_type == "interrupt":
-            # 用户打断
+        if msg_type == "interrupt":
             session.should_interrupt = True
             logger.info(f"[Live Chat] 用户打断: {session.username}")
 
-    async def _process_audio(
-        self, session: LiveChatSession, audio_path: str, assemble_duration: float
+    async def process_audio(
+        self,
+        session: LiveChatSession,
+        audio_path: str,
+        assemble_duration: float,
+        send_json: SendJson,
     ) -> None:
-        """处理音频：STT -> LLM -> 流式 TTS"""
         try:
-            # 发送 WAV 组装耗时
-            await websocket.send_json(
+            await send_json(
                 {"t": "metrics", "data": {"wav_assemble_time": assemble_duration}}
             )
             wav_assembly_finish_time = time.time()
@@ -745,18 +787,15 @@ class LiveChatRoute(Route):
             session.is_processing = True
             session.should_interrupt = False
 
-            # 1. STT - 语音转文字
             ctx = self.plugin_manager.context
             stt_provider = ctx.provider_manager.stt_provider_insts[0]
 
             if not stt_provider:
                 logger.error("[Live Chat] STT Provider 未配置")
-                await websocket.send_json({"t": "error", "data": "语音识别服务未配置"})
+                await send_json({"t": "error", "data": "语音识别服务未配置"})
                 return
 
-            await websocket.send_json(
-                {"t": "metrics", "data": {"stt": stt_provider.meta().type}}
-            )
+            await send_json({"t": "metrics", "data": {"stt": stt_provider.meta().type}})
 
             user_text = await stt_provider.get_text(audio_path)
             if not user_text:
@@ -765,30 +804,27 @@ class LiveChatRoute(Route):
 
             logger.info(f"[Live Chat] STT 结果: {user_text}")
 
-            await websocket.send_json(
+            await send_json(
                 {
                     "t": "user_msg",
                     "data": {"text": user_text, "ts": int(time.time() * 1000)},
                 }
             )
 
-            # 2. 构造消息事件并发送到 pipeline
-            # 使用 webchat queue 机制
-            cid = session.conversation_id
-            queue = webchat_queue_mgr.get_or_create_queue(cid)
+            conversation_id = session.conversation_id
+            queue = webchat_queue_mgr.get_or_create_queue(conversation_id)
 
             message_id = str(uuid.uuid4())
             payload = {
                 "message_id": message_id,
-                "message": [{"type": "plain", "text": user_text}],  # 直接发送文本
-                "action_type": "live",  # 标记为 live mode
+                "message": [{"type": "plain", "text": user_text}],
+                "action_type": "live",
             }
 
-            # 将消息放入队列
-            await queue.put((session.username, cid, payload))
-
-            # 3. 等待响应并流式发送 TTS 音频
-            back_queue = webchat_queue_mgr.get_or_create_back_queue(message_id, cid)
+            await queue.put((session.username, conversation_id, payload))
+            back_queue = webchat_queue_mgr.get_or_create_back_queue(
+                message_id, conversation_id
+            )
 
             bot_text = ""
             audio_playing = False
@@ -796,14 +832,11 @@ class LiveChatRoute(Route):
             try:
                 while True:
                     if session.should_interrupt:
-                        # 用户打断，停止处理
                         logger.info("[Live Chat] 检测到用户打断")
-                        await websocket.send_json({"t": "stop_play"})
-                        # 保存消息并标记为被打断
-                        await self._save_interrupted_message(
+                        await send_json({"t": "stop_play"})
+                        await self.save_interrupted_message(
                             session, user_text, bot_text
                         )
-                        # 清空队列中未处理的消息
                         while not back_queue.empty():
                             try:
                                 back_queue.get_nowait()
@@ -833,7 +866,7 @@ class LiveChatRoute(Route):
                     if result_chain_type == "agent_stats":
                         try:
                             stats = json.loads(data)
-                            await websocket.send_json(
+                            await send_json(
                                 {
                                     "t": "metrics",
                                     "data": {
@@ -843,38 +876,35 @@ class LiveChatRoute(Route):
                                     },
                                 }
                             )
-                        except Exception as e:
-                            logger.error(f"[Live Chat] 解析 AgentStats 失败: {e}")
+                        except Exception as exc:
+                            logger.error(f"[Live Chat] 解析 AgentStats 失败: {exc}")
                         continue
 
                     if result_chain_type == "tts_stats":
                         try:
                             stats = json.loads(data)
-                            await websocket.send_json(
+                            await send_json(
                                 {
                                     "t": "metrics",
                                     "data": stats,
                                 }
                             )
-                        except Exception as e:
-                            logger.error(f"[Live Chat] 解析 TTSStats 失败: {e}")
+                        except Exception as exc:
+                            logger.error(f"[Live Chat] 解析 TTSStats 失败: {exc}")
                         continue
 
                     if result_type == "plain":
-                        # 普通文本消息
                         bot_text += data
 
                     elif result_type == "audio_chunk":
-                        # 流式音频数据
                         if not audio_playing:
                             audio_playing = True
                             logger.debug("[Live Chat] 开始播放音频流")
 
-                            # Calculate latency from wav assembly finish to first audio chunk
                             speak_to_first_frame_latency = (
                                 time.time() - wav_assembly_finish_time
                             )
-                            await websocket.send_json(
+                            await send_json(
                                 {
                                     "t": "metrics",
                                     "data": {
@@ -885,28 +915,25 @@ class LiveChatRoute(Route):
 
                         text = result.get("text")
                         if text:
-                            await websocket.send_json(
+                            await send_json(
                                 {
                                     "t": "bot_text_chunk",
                                     "data": {"text": text},
                                 }
                             )
 
-                        # 发送音频数据给前端
-                        await websocket.send_json(
+                        await send_json(
                             {
                                 "t": "response",
-                                "data": data,  # base64 编码的音频数据
+                                "data": data,
                             }
                         )
 
                     elif result_type in ["complete", "end"]:
-                        # 处理完成
                         logger.info(f"[Live Chat] Bot 回复完成: {bot_text}")
 
-                        # 如果没有音频流，发送 bot 消息文本
                         if not audio_playing:
-                            await websocket.send_json(
+                            await send_json(
                                 {
                                     "t": "bot_msg",
                                     "data": {
@@ -916,12 +943,10 @@ class LiveChatRoute(Route):
                                 }
                             )
 
-                        # 发送结束标记
-                        await websocket.send_json({"t": "end"})
+                        await send_json({"t": "end"})
 
-                        # 发送总耗时
                         wav_to_tts_duration = time.time() - wav_assembly_finish_time
-                        await websocket.send_json(
+                        await send_json(
                             {
                                 "t": "metrics",
                                 "data": {"wav_to_tts_total_time": wav_to_tts_duration},
@@ -931,22 +956,21 @@ class LiveChatRoute(Route):
             finally:
                 webchat_queue_mgr.remove_back_queue(message_id)
 
-        except Exception as e:
-            logger.error(f"[Live Chat] 处理音频失败: {e}", exc_info=True)
-            await websocket.send_json({"t": "error", "data": f"处理失败: {str(e)}"})
+        except Exception as exc:
+            logger.error(f"[Live Chat] 处理音频失败: {exc}", exc_info=True)
+            await send_json({"t": "error", "data": f"处理失败: {str(exc)}"})
 
         finally:
             session.is_processing = False
             session.should_interrupt = False
 
-    async def _save_interrupted_message(
-        self, session: LiveChatSession, user_text: str, bot_text: str
+    @staticmethod
+    async def save_interrupted_message(
+        session: LiveChatSession, user_text: str, bot_text: str
     ) -> None:
-        """保存被打断的消息"""
         interrupted_text = bot_text + " [用户打断]"
         logger.info(f"[Live Chat] 保存打断消息: {interrupted_text}")
 
-        # 简单记录到日志，实际保存逻辑可以后续完善
         try:
             timestamp = int(time.time() * 1000)
             logger.info(
@@ -956,5 +980,8 @@ class LiveChatRoute(Route):
                 logger.info(
                     f"[Live Chat] Bot 消息（打断）: {interrupted_text} (session: {session.session_id}, ts: {timestamp})"
                 )
-        except Exception as e:
-            logger.error(f"[Live Chat] 记录消息失败: {e}", exc_info=True)
+        except Exception as exc:
+            logger.error(f"[Live Chat] 记录消息失败: {exc}", exc_info=True)
+
+
+__all__ = ["LiveChatAuthError", "LiveChatService", "LiveChatSession"]
diff --git a/astrbot/dashboard/services/log_service.py b/astrbot/dashboard/services/log_service.py
new file mode 100644
index 000000000..52cbcc05d
--- /dev/null
+++ b/astrbot/dashboard/services/log_service.py
@@ -0,0 +1,94 @@
+from __future__ import annotations
+
+import asyncio
+import json
+import time
+from collections.abc import AsyncGenerator
+
+from astrbot.core import LogBroker, logger
+from astrbot.core.config.astrbot_config import AstrBotConfig
+
+
+class LogServiceError(Exception):
+    pass
+
+
+class LogService:
+    def __init__(self, log_broker: LogBroker, config: AstrBotConfig) -> None:
+        self.log_broker = log_broker
+        self.config = config
+
+    @staticmethod
+    def format_log_sse(log: dict, ts: float) -> str:
+        payload = {
+            "type": "log",
+            **log,
+        }
+        return f"id: {ts}\ndata: {json.dumps(payload, ensure_ascii=False)}\n\n"
+
+    async def replay_cached_logs(self, last_event_id: str) -> AsyncGenerator[str, None]:
+        try:
+            last_ts = float(last_event_id)
+            cached_logs = list(self.log_broker.log_cache)
+
+            for log_item in cached_logs:
+                log_ts = float(log_item.get("time", 0))
+                if log_ts > last_ts:
+                    yield self.format_log_sse(log_item, log_ts)
+        except ValueError:
+            pass
+        except Exception as exc:
+            logger.error(f"Log SSE 补发历史错误: {exc}")
+
+    async def stream_log_events(
+        self, last_event_id: str | None
+    ) -> AsyncGenerator[str, None]:
+        queue = None
+        try:
+            if last_event_id:
+                async for event in self.replay_cached_logs(last_event_id):
+                    yield event
+
+            queue = self.log_broker.register()
+            while True:
+                message = await queue.get()
+                current_ts = message.get("time", time.time())
+                yield self.format_log_sse(message, current_ts)
+        except asyncio.CancelledError:
+            pass
+        except Exception as exc:
+            logger.error(f"Log SSE 连接错误: {exc}")
+        finally:
+            if queue:
+                self.log_broker.unregister(queue)
+
+    def get_log_history(self) -> dict:
+        try:
+            return {"logs": list(self.log_broker.log_cache)}
+        except Exception as exc:
+            logger.error(f"获取日志历史失败: {exc}")
+            raise LogServiceError(f"获取日志历史失败: {exc}") from exc
+
+    def get_trace_settings(self) -> dict:
+        try:
+            return {"trace_enable": self.config.get("trace_enable", True)}
+        except Exception as exc:
+            logger.error(f"获取 Trace 设置失败: {exc}")
+            raise LogServiceError(f"获取 Trace 设置失败: {exc}") from exc
+
+    def update_trace_settings(self, payload: dict | None) -> str:
+        try:
+            if payload is None:
+                raise LogServiceError("请求数据为空")
+
+            trace_enable = payload.get("trace_enable")
+            if trace_enable is not None:
+                self.config["trace_enable"] = bool(trace_enable)
+                self.config.save_config()
+
+            return "Trace 设置已更新"
+        except LogServiceError:
+            raise
+        except Exception as exc:
+            logger.error(f"更新 Trace 设置失败: {exc}")
+            raise LogServiceError(f"更新 Trace 设置失败: {exc}") from exc
diff --git a/astrbot/dashboard/routes/open_api.py b/astrbot/dashboard/services/open_api_service.py
similarity index 56%
rename from astrbot/dashboard/routes/open_api.py
rename to astrbot/dashboard/services/open_api_service.py
index 52b412b2b..12937e6eb 100644
--- a/astrbot/dashboard/routes/open_api.py
+++ b/astrbot/dashboard/services/open_api_service.py
@@ -1,9 +1,11 @@
-import asyncio
-import hashlib
-import json
-from uuid import uuid4
+from __future__ import annotations
 
-from quart import g, request, websocket
+import asyncio
+import json
+from collections.abc import Awaitable, Callable
+from dataclasses import dataclass
+from typing import Any
+from uuid import uuid4
 
 from astrbot.core import logger
 from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
@@ -16,46 +18,48 @@ from astrbot.core.platform.sources.webchat.message_parts_helper import (
 )
 from astrbot.core.platform.sources.webchat.webchat_queue_mgr import webchat_queue_mgr
 from astrbot.core.utils.datetime_utils import to_utc_isoformat
-
-from .api_key import ALL_OPEN_API_SCOPES
-from .chat import (
+from astrbot.dashboard.services.api_key_service import ApiKeyService
+from astrbot.dashboard.services.auth_service import ALL_OPEN_API_SCOPES
+from astrbot.dashboard.services.chat_service import (
     BotMessageAccumulator,
-    ChatRoute,
     collect_plain_text_from_message_parts,
 )
-from .route import Response, Route, RouteContext
+
+SendJson = Callable[[dict], Awaitable[None]]
+ReceiveJson = Callable[[], Awaitable[Any]]
+CloseWebSocket = Callable[[int, str], Awaitable[None]]
 
 
-class OpenApiRoute(Route):
+class OpenApiServiceError(Exception):
+    pass
+
+
+@dataclass
+class OpenApiWebSocketChatBridge:
+    build_user_message_parts: Callable[[object], Awaitable[list]]
+    create_attachment_from_file: Callable[[str, str], Awaitable[Any]]
+    extract_web_search_refs: Callable[[str, list], dict]
+    insert_user_message: Callable[[str, str, list], Awaitable[None]]
+    save_bot_message: Callable[[str, list, dict, dict], Awaitable[Any]]
+
+
+class OpenApiService:
     def __init__(
         self,
-        context: RouteContext,
         db: BaseDatabase,
         core_lifecycle: AstrBotCoreLifecycle,
-        chat_route: ChatRoute,
     ) -> None:
-        super().__init__(context)
         self.db = db
         self.core_lifecycle = core_lifecycle
         self.platform_manager = core_lifecycle.platform_manager
-        self.chat_route = chat_route
-
-        self.routes = {
-            "/v1/chat": ("POST", self.chat_send),
-            "/v1/chat/sessions": ("GET", self.get_chat_sessions),
-            "/v1/configs": ("GET", self.get_chat_configs),
-            "/v1/file": [
-                ("POST", self.openapi_upload_file),
-                ("GET", self.openapi_get_file),
-            ],
-            "/v1/im/message": ("POST", self.send_message),
-            "/v1/im/bots": ("GET", self.get_bots),
-        }
-        self.register_routes()
-        self.app.websocket("/api/v1/chat/ws")(self.chat_ws)
+        self.platform_history_mgr = getattr(
+            core_lifecycle,
+            "platform_message_history_manager",
+            None,
+        )
 
     @staticmethod
-    def _resolve_open_username(
+    def resolve_open_username(
         raw_username: str | None,
     ) -> tuple[str | None, str | None]:
         if raw_username is None:
@@ -65,7 +69,7 @@ class OpenApiRoute(Route):
             return None, "username is empty"
         return username, None
 
-    def _get_chat_config_list(self) -> list[dict]:
+    def get_chat_config_list(self) -> list[dict]:
         conf_list = self.core_lifecycle.astrbot_config_mgr.get_conf_list()
 
         result = []
@@ -81,7 +85,11 @@ class OpenApiRoute(Route):
             )
         return result
 
-    def _resolve_chat_config_id(self, post_data: dict) -> tuple[str | None, str | None]:
+    @staticmethod
+    def resolve_chat_config_id(
+        post_data: dict,
+        conf_list: list[dict],
+    ) -> tuple[str | None, str | None]:
         raw_config_id = post_data.get("config_id")
         raw_config_name = post_data.get("config_name")
         config_id = str(raw_config_id).strip() if raw_config_id is not None else ""
@@ -92,7 +100,6 @@ class OpenApiRoute(Route):
         if not config_id and not config_name:
             return None, None
 
-        conf_list = self._get_chat_config_list()
         conf_map = {item["id"]: item for item in conf_list}
 
         if config_id:
@@ -114,7 +121,39 @@ class OpenApiRoute(Route):
 
         return matched[0]["id"], None
 
-    async def _ensure_chat_session(
+    async def prepare_chat_send(
+        self,
+        post_data: dict,
+        conf_list: list[dict],
+    ) -> tuple[str, str, str | None]:
+        effective_username, username_err = self.resolve_open_username(
+            post_data.get("username")
+        )
+        if username_err:
+            raise OpenApiServiceError(username_err)
+        if not effective_username:
+            raise OpenApiServiceError("Invalid username")
+
+        raw_session_id = post_data.get("session_id", post_data.get("conversation_id"))
+        session_id = str(raw_session_id).strip() if raw_session_id is not None else ""
+        if not session_id:
+            session_id = str(uuid4())
+            post_data["session_id"] = session_id
+
+        ensure_session_err = await self.ensure_chat_session(
+            effective_username,
+            session_id,
+        )
+        if ensure_session_err:
+            raise OpenApiServiceError(ensure_session_err)
+
+        config_id, resolve_err = self.resolve_chat_config_id(post_data, conf_list)
+        if resolve_err:
+            raise OpenApiServiceError(resolve_err)
+
+        return effective_username, session_id, config_id
+
+    async def ensure_chat_session(
         self,
         username: str,
         session_id: str,
@@ -132,98 +171,22 @@ class OpenApiRoute(Route):
                 session_id=session_id,
                 is_group=0,
             )
-        except Exception as e:
-            # Handle rare race when same session_id is created concurrently.
+        except Exception as exc:
             existing = await self.db.get_platform_session_by_id(session_id)
             if existing and existing.creator == username:
                 return None
-            logger.error("Failed to create chat session %s: %s", session_id, e)
-            return f"Failed to create session: {e}"
+            logger.error("Failed to create chat session %s: %s", session_id, exc)
+            return f"Failed to create session: {exc}"
 
         return None
 
-    async def chat_send(self):
-        post_data = await request.get_json(silent=True) or {}
-        effective_username, username_err = self._resolve_open_username(
-            post_data.get("username")
-        )
-        if username_err:
-            return Response().error(username_err).__dict__
-        if not effective_username:
-            return Response().error("Invalid username").__dict__
-
-        raw_session_id = post_data.get("session_id", post_data.get("conversation_id"))
-        session_id = str(raw_session_id).strip() if raw_session_id is not None else ""
-        if not session_id:
-            session_id = str(uuid4())
-            post_data["session_id"] = session_id
-        ensure_session_err = await self._ensure_chat_session(
-            effective_username,
-            session_id,
-        )
-        if ensure_session_err:
-            return Response().error(ensure_session_err).__dict__
-
-        config_id, resolve_err = self._resolve_chat_config_id(post_data)
-        if resolve_err:
-            return Response().error(resolve_err).__dict__
-
-        original_username = g.get("username", "guest")
-        g.username = effective_username
-        if config_id:
-            umo = f"webchat:FriendMessage:webchat!{effective_username}!{session_id}"
-            try:
-                if config_id == "default":
-                    await self.core_lifecycle.umop_config_router.delete_route(umo)
-                else:
-                    await self.core_lifecycle.umop_config_router.update_route(
-                        umo, config_id
-                    )
-            except Exception as e:
-                logger.error(
-                    "Failed to update chat config route for %s with %s: %s",
-                    umo,
-                    config_id,
-                    e,
-                    exc_info=True,
-                )
-                return (
-                    Response()
-                    .error(f"Failed to update chat config route: {e}")
-                    .__dict__
-                )
-        try:
-            return await self.chat_route.chat(post_data=post_data)
-        finally:
-            g.username = original_username
-
-    @staticmethod
-    def _extract_ws_api_key() -> str | None:
-        if key := websocket.args.get("api_key"):
-            return key.strip()
-        if key := websocket.args.get("key"):
-            return key.strip()
-        if key := websocket.headers.get("X-API-Key"):
-            return key.strip()
-
-        auth_header = websocket.headers.get("Authorization", "").strip()
-        if auth_header.startswith("Bearer "):
-            return auth_header.removeprefix("Bearer ").strip()
-        if auth_header.startswith("ApiKey "):
-            return auth_header.removeprefix("ApiKey ").strip()
-        return None
-
-    async def _authenticate_chat_ws_api_key(self) -> tuple[bool, str | None]:
-        raw_key = self._extract_ws_api_key()
+    async def authenticate_api_key(
+        self, raw_key: str | None
+    ) -> tuple[bool, str | None]:
         if not raw_key:
             return False, "Missing API key"
 
-        key_hash = hashlib.pbkdf2_hmac(
-            "sha256",
-            raw_key.encode("utf-8"),
-            b"astrbot_api_key",
-            100_000,
-        ).hex()
+        key_hash = ApiKeyService.hash_key(raw_key)
         api_key = await self.db.get_active_api_key_by_hash(key_hash)
         if not api_key:
             return False, "Invalid API key"
@@ -239,8 +202,13 @@ class OpenApiRoute(Route):
         await self.db.touch_api_key(api_key.key_id)
         return True, None
 
-    async def _send_chat_ws_error(self, message: str, code: str) -> None:
-        await websocket.send_json(
+    @staticmethod
+    async def send_chat_ws_error(
+        send_json: SendJson,
+        message: str,
+        code: str,
+    ) -> None:
+        await send_json(
             {
                 "type": "error",
                 "code": code,
@@ -248,7 +216,58 @@ class OpenApiRoute(Route):
             }
         )
 
-    async def _update_session_config_route(
+    async def run_chat_websocket(
+        self,
+        *,
+        raw_api_key: str | None,
+        receive_json: ReceiveJson,
+        send_json: SendJson,
+        close: CloseWebSocket,
+        conf_list: list[dict],
+        chat_bridge: OpenApiWebSocketChatBridge,
+    ) -> None:
+        authed, auth_err = await self.authenticate_api_key(raw_api_key)
+        if not authed:
+            message = auth_err or "Unauthorized"
+            await self.send_chat_ws_error(send_json, message, "UNAUTHORIZED")
+            await close(1008, message)
+            return
+
+        async def send_error(message: str, code: str) -> None:
+            await self.send_chat_ws_error(send_json, message, code)
+
+        try:
+            while True:
+                message = await receive_json()
+                if not isinstance(message, dict):
+                    await send_error(
+                        "message must be an object",
+                        "INVALID_MESSAGE",
+                    )
+                    continue
+
+                msg_type = message.get("t", "send")
+                if msg_type == "ping":
+                    await send_json({"type": "pong"})
+                    continue
+                if msg_type != "send":
+                    await send_error(
+                        f"Unsupported message type: {msg_type}",
+                        "INVALID_MESSAGE",
+                    )
+                    continue
+
+                await self.handle_chat_ws_send(
+                    post_data=message,
+                    conf_list=conf_list,
+                    chat_bridge=chat_bridge,
+                    send_json=send_json,
+                    send_error=send_error,
+                )
+        except Exception as exc:
+            logger.debug("Open API WS connection closed: %s", exc)
+
+    async def update_session_config_route(
         self,
         *,
         username: str,
@@ -266,62 +285,84 @@ class OpenApiRoute(Route):
                 await self.core_lifecycle.umop_config_router.update_route(
                     umo, config_id
                 )
-        except Exception as e:
+        except Exception as exc:
             logger.error(
                 "Failed to update chat config route for %s with %s: %s",
                 umo,
                 config_id,
-                e,
+                exc,
                 exc_info=True,
             )
-            return f"Failed to update chat config route: {e}"
+            return f"Failed to update chat config route: {exc}"
         return None
 
-    async def _handle_chat_ws_send(self, post_data: dict) -> None:
-        effective_username, username_err = self._resolve_open_username(
-            post_data.get("username")
+    async def insert_webchat_user_message(
+        self,
+        *,
+        session_id: str,
+        effective_username: str,
+        message_parts: list,
+    ) -> None:
+        if self.platform_history_mgr is None:
+            raise OpenApiServiceError("Platform message history manager is unavailable")
+        await self.platform_history_mgr.insert(
+            platform_id="webchat",
+            user_id=session_id,
+            content={"type": "user", "message": message_parts},
+            sender_id=effective_username,
+            sender_name=effective_username,
         )
-        if username_err or not effective_username:
-            await self._send_chat_ws_error(
-                username_err or "Invalid username", "BAD_USER"
-            )
-            return
 
+    @staticmethod
+    def get_chat_send_error_code(message: str) -> str:
+        if message in ("Missing key: username", "username is empty"):
+            return "BAD_USER"
+        if message.startswith("config_"):
+            return "CONFIG_ERROR"
+        if "session" in message:
+            return "SESSION_ERROR"
+        return "INVALID_MESSAGE"
+
+    async def handle_chat_ws_send(
+        self,
+        *,
+        post_data: dict,
+        conf_list: list[dict],
+        chat_bridge: OpenApiWebSocketChatBridge,
+        send_json: SendJson,
+        send_error: Callable[[str, str], Awaitable[None]],
+    ) -> None:
         message = post_data.get("message")
         if message is None:
-            await self._send_chat_ws_error("Missing key: message", "INVALID_MESSAGE")
+            await send_error("Missing key: message", "INVALID_MESSAGE")
             return
 
-        raw_session_id = post_data.get("session_id", post_data.get("conversation_id"))
-        session_id = str(raw_session_id).strip() if raw_session_id is not None else ""
-        if not session_id:
-            session_id = str(uuid4())
-
-        ensure_session_err = await self._ensure_chat_session(
-            effective_username,
-            session_id,
-        )
-        if ensure_session_err:
-            await self._send_chat_ws_error(ensure_session_err, "SESSION_ERROR")
+        try:
+            (
+                effective_username,
+                session_id,
+                config_id,
+            ) = await self.prepare_chat_send(
+                post_data,
+                conf_list,
+            )
+        except OpenApiServiceError as exc:
+            message = str(exc)
+            await send_error(message, self.get_chat_send_error_code(message))
             return
 
-        config_id, resolve_err = self._resolve_chat_config_id(post_data)
-        if resolve_err:
-            await self._send_chat_ws_error(resolve_err, "CONFIG_ERROR")
-            return
-
-        config_err = await self._update_session_config_route(
+        config_err = await self.update_session_config_route(
             username=effective_username,
             session_id=session_id,
             config_id=config_id,
         )
         if config_err:
-            await self._send_chat_ws_error(config_err, "CONFIG_ERROR")
+            await send_error(config_err, "CONFIG_ERROR")
             return
 
-        message_parts = await self.chat_route._build_user_message_parts(message)
+        message_parts = await chat_bridge.build_user_message_parts(message)
         if not webchat_message_parts_have_content(message_parts):
-            await self._send_chat_ws_error(
+            await send_error(
                 "Message content is empty (reply only is not allowed)",
                 "INVALID_MESSAGE",
             )
@@ -350,15 +391,13 @@ class OpenApiRoute(Route):
             )
 
             message_parts_for_storage = strip_message_parts_path_fields(message_parts)
-            await self.chat_route.platform_history_mgr.insert(
-                platform_id="webchat",
-                user_id=session_id,
-                content={"type": "user", "message": message_parts_for_storage},
-                sender_id=effective_username,
-                sender_name=effective_username,
+            await chat_bridge.insert_user_message(
+                session_id,
+                effective_username,
+                message_parts_for_storage,
             )
 
-            await websocket.send_json(
+            await send_json(
                 {
                     "type": "session_id",
                     "data": None,
@@ -394,13 +433,13 @@ class OpenApiRoute(Route):
                             "type": "agent_stats",
                             "data": json.loads(result_text),
                         }
-                        await websocket.send_json(stats_info)
+                        await send_json(stats_info)
                         agent_stats = stats_info["data"]
                     except Exception:
                         pass
                     continue
 
-                await websocket.send_json(result)
+                await send_json(result)
 
                 if msg_type == "plain":
                     message_accumulator.add_plain(
@@ -408,28 +447,11 @@ class OpenApiRoute(Route):
                         chain_type=chain_type,
                         streaming=streaming,
                     )
-                elif msg_type == "image":
-                    filename = str(result_text).replace("[IMAGE]", "")
-                    part = await self.chat_route._create_attachment_from_file(
-                        filename, "image"
-                    )
-                    message_accumulator.add_attachment(part)
-                elif msg_type == "record":
-                    filename = str(result_text).replace("[RECORD]", "")
-                    part = await self.chat_route._create_attachment_from_file(
-                        filename, "record"
-                    )
-                    message_accumulator.add_attachment(part)
-                elif msg_type == "file":
-                    filename = str(result_text).replace("[FILE]", "")
-                    part = await self.chat_route._create_attachment_from_file(
-                        filename, "file"
-                    )
-                    message_accumulator.add_attachment(part)
-                elif msg_type == "video":
-                    filename = str(result_text).replace("[VIDEO]", "")
-                    part = await self.chat_route._create_attachment_from_file(
-                        filename, "video"
+                elif msg_type in {"image", "record", "file", "video"}:
+                    filename = str(result_text).replace(f"[{msg_type.upper()}]", "")
+                    part = await chat_bridge.create_attachment_from_file(
+                        filename,
+                        msg_type,
                     )
                     message_accumulator.add_attachment(part)
 
@@ -450,24 +472,24 @@ class OpenApiRoute(Route):
                         message_parts_to_save
                     )
                     try:
-                        refs = self.chat_route._extract_web_search_refs(
+                        refs = chat_bridge.extract_web_search_refs(
                             plain_text,
                             message_parts_to_save,
                         )
-                    except Exception as e:
+                    except Exception as exc:
                         logger.exception(
-                            f"Open API WS failed to extract web search refs: {e}",
+                            f"Open API WS failed to extract web search refs: {exc}",
                             exc_info=True,
                         )
 
-                    saved_record = await self.chat_route._save_bot_message(
+                    saved_record = await chat_bridge.save_bot_message(
                         session_id,
                         message_parts_to_save,
                         agent_stats,
                         refs,
                     )
                     if saved_record:
-                        await websocket.send_json(
+                        await send_json(
                             {
                                 "type": "message_saved",
                                 "data": {
@@ -484,66 +506,25 @@ class OpenApiRoute(Route):
                     refs = {}
                 if msg_type == "end":
                     break
-        except Exception as e:
-            logger.exception(f"Open API WS chat failed: {e}", exc_info=True)
-            await self._send_chat_ws_error(
-                f"Failed to process message: {e}", "PROCESSING_ERROR"
-            )
+        except Exception as exc:
+            logger.exception(f"Open API WS chat failed: {exc}", exc_info=True)
+            await send_error(f"Failed to process message: {exc}", "PROCESSING_ERROR")
         finally:
             webchat_queue_mgr.remove_back_queue(message_id)
 
-    async def chat_ws(self) -> None:
-        authed, auth_err = await self._authenticate_chat_ws_api_key()
-        if not authed:
-            await self._send_chat_ws_error(auth_err or "Unauthorized", "UNAUTHORIZED")
-            await websocket.close(1008, auth_err or "Unauthorized")
-            return
-
+    async def get_chat_sessions(
+        self,
+        *,
+        username: str,
+        page_raw,
+        page_size_raw,
+        platform_id: str | None,
+    ) -> dict:
         try:
-            while True:
-                message = await websocket.receive_json()
-                if not isinstance(message, dict):
-                    await self._send_chat_ws_error(
-                        "message must be an object",
-                        "INVALID_MESSAGE",
-                    )
-                    continue
-
-                msg_type = message.get("t", "send")
-                if msg_type == "ping":
-                    await websocket.send_json({"type": "pong"})
-                    continue
-                if msg_type != "send":
-                    await self._send_chat_ws_error(
-                        f"Unsupported message type: {msg_type}",
-                        "INVALID_MESSAGE",
-                    )
-                    continue
-
-                await self._handle_chat_ws_send(message)
-        except Exception as e:
-            logger.debug("Open API WS connection closed: %s", e)
-
-    async def openapi_upload_file(self):
-        return await self.chat_route.post_file()
-
-    async def openapi_get_file(self):
-        return await self.chat_route.get_attachment()
-
-    async def get_chat_sessions(self):
-        username, username_err = self._resolve_open_username(
-            request.args.get("username")
-        )
-        if username_err:
-            return Response().error(username_err).__dict__
-
-        assert username is not None  # for type checker
-
-        try:
-            page = int(request.args.get("page", 1))
-            page_size = int(request.args.get("page_size", 20))
-        except ValueError:
-            return Response().error("page and page_size must be integers").__dict__
+            page = int(page_raw)
+            page_size = int(page_size_raw)
+        except ValueError as exc:
+            raise OpenApiServiceError("page and page_size must be integers") from exc
 
         if page < 1:
             page = 1
@@ -552,8 +533,6 @@ class OpenApiRoute(Route):
         if page_size > 100:
             page_size = 100
 
-        platform_id = request.args.get("platform_id")
-
         (
             paginated_sessions,
             total,
@@ -580,47 +559,58 @@ class OpenApiRoute(Route):
                 }
             )
 
-        return (
-            Response()
-            .ok(
-                data={
-                    "sessions": sessions_data,
-                    "page": page,
-                    "page_size": page_size,
-                    "total": total,
-                }
-            )
-            .__dict__
+        return {
+            "sessions": sessions_data,
+            "page": page,
+            "page_size": page_size,
+            "total": total,
+        }
+
+    async def get_chat_sessions_from_dashboard_query(
+        self,
+        *,
+        username: str | None,
+        page,
+        page_size,
+        platform_id: str | None,
+    ) -> dict:
+        resolved_username, username_err = self.resolve_open_username(username)
+        if username_err:
+            raise OpenApiServiceError(username_err)
+        if not resolved_username:
+            raise OpenApiServiceError("Invalid username")
+
+        return await self.get_chat_sessions(
+            username=resolved_username,
+            page_raw=page,
+            page_size_raw=page_size,
+            platform_id=platform_id,
         )
 
-    async def get_chat_configs(self):
-        conf_list = self._get_chat_config_list()
-        return Response().ok(data={"configs": conf_list}).__dict__
+    def get_chat_configs(self) -> dict:
+        return {"configs": self.get_chat_config_list()}
 
-    async def _build_message_chain_from_payload(
-        self,
-        message_payload: str | list,
-    ):
+    async def build_message_chain_from_payload(self, message_payload: str | list):
         return await build_message_chain_from_payload(
             message_payload,
             get_attachment_by_id=self.db.get_attachment_by_id,
             strict=True,
         )
 
-    async def send_message(self):
-        post_data = await request.json or {}
-        message_payload = post_data.get("message", {})
-        umo = post_data.get("umo")
+    async def send_message(self, post_data: object) -> None:
+        payload = post_data if isinstance(post_data, dict) else {}
+        message_payload = payload.get("message", {})
+        umo = payload.get("umo")
 
         if message_payload is None:
-            return Response().error("Missing key: message").__dict__
+            raise OpenApiServiceError("Missing key: message")
         if not umo:
-            return Response().error("Missing key: umo").__dict__
+            raise OpenApiServiceError("Missing key: umo")
 
         try:
             session = MessageSesion.from_str(str(umo))
-        except Exception as e:
-            return Response().error(f"Invalid umo: {e}").__dict__
+        except Exception as exc:
+            raise OpenApiServiceError(f"Invalid umo: {exc}") from exc
 
         platform_id = session.platform_name
         platform_inst = next(
@@ -632,25 +622,22 @@ class OpenApiRoute(Route):
             None,
         )
         if not platform_inst:
-            return (
-                Response()
-                .error(f"Bot not found or not running for platform: {platform_id}")
-                .__dict__
+            raise OpenApiServiceError(
+                f"Bot not found or not running for platform: {platform_id}"
             )
 
         try:
-            message_chain = await self._build_message_chain_from_payload(
-                message_payload
-            )
+            message_chain = await self.build_message_chain_from_payload(message_payload)
             await platform_inst.send_by_session(session, message_chain)
-            return Response().ok().__dict__
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-        except Exception as e:
-            logger.error(f"Open API send_message failed: {e}", exc_info=True)
-            return Response().error(f"Failed to send message: {e}").__dict__
+        except OpenApiServiceError:
+            raise
+        except ValueError as exc:
+            raise OpenApiServiceError(str(exc)) from exc
+        except Exception as exc:
+            logger.error(f"Open API send_message failed: {exc}", exc_info=True)
+            raise OpenApiServiceError(f"Failed to send message: {exc}") from exc
 
-    async def get_bots(self):
+    def get_bots(self) -> dict:
         bot_ids = []
         for platform in self.core_lifecycle.astrbot_config.get("platform", []):
             platform_id = platform.get("id") if isinstance(platform, dict) else None
@@ -660,4 +647,4 @@ class OpenApiRoute(Route):
                 and platform_id not in bot_ids
             ):
                 bot_ids.append(platform_id)
-        return Response().ok(data={"bot_ids": bot_ids}).__dict__
+        return {"bot_ids": bot_ids}
diff --git a/astrbot/dashboard/services/persona_service.py b/astrbot/dashboard/services/persona_service.py
new file mode 100644
index 000000000..31c4f1084
--- /dev/null
+++ b/astrbot/dashboard/services/persona_service.py
@@ -0,0 +1,279 @@
+from __future__ import annotations
+
+from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
+from astrbot.core.sentinels import NOT_GIVEN
+
+
+class PersonaServiceError(Exception):
+    pass
+
+
+class PersonaService:
+    def __init__(self, core_lifecycle: AstrBotCoreLifecycle) -> None:
+        self.persona_mgr = core_lifecycle.persona_mgr
+
+    async def list_personas(
+        self,
+        folder_id: str | None,
+        filter_by_folder: bool,
+    ) -> list[dict]:
+        if filter_by_folder:
+            personas = await self.persona_mgr.get_personas_by_folder(
+                folder_id if folder_id else None
+            )
+        else:
+            personas = await self.persona_mgr.get_all_personas()
+        return [self.serialize_persona(persona) for persona in personas]
+
+    async def get_persona_detail(self, data: object) -> dict:
+        payload = self._payload(data)
+        persona_id = payload.get("persona_id")
+
+        if not persona_id:
+            raise PersonaServiceError("缺少必要参数: persona_id")
+
+        persona = await self.persona_mgr.get_persona(persona_id)
+        if not persona:
+            raise PersonaServiceError("人格不存在")
+
+        return self.serialize_persona(persona)
+
+    async def create_persona(self, data: object) -> dict:
+        payload = self._payload(data)
+        persona_id = str(payload.get("persona_id", "")).strip()
+        system_prompt = str(payload.get("system_prompt", "")).strip()
+        begin_dialogs = payload.get("begin_dialogs", [])
+        tools = payload.get("tools")
+        skills = payload.get("skills")
+        custom_error_message = self._normalize_custom_error_message(
+            payload.get("custom_error_message")
+        )
+        folder_id = payload.get("folder_id")
+        sort_order = payload.get("sort_order", 0)
+
+        if not persona_id:
+            raise PersonaServiceError("人格ID不能为空")
+        if not system_prompt:
+            raise PersonaServiceError("系统提示词不能为空")
+
+        self._validate_begin_dialogs(begin_dialogs)
+
+        persona = await self.persona_mgr.create_persona(
+            persona_id=persona_id,
+            system_prompt=system_prompt,
+            begin_dialogs=begin_dialogs if begin_dialogs else None,
+            tools=tools if tools else None,
+            skills=skills if skills else None,
+            custom_error_message=custom_error_message,
+            folder_id=folder_id,
+            sort_order=sort_order,
+        )
+
+        return {
+            "message": "人格创建成功",
+            "persona": self.serialize_persona(persona, empty_lists_for_tools=True),
+        }
+
+    async def update_persona(self, data: object) -> dict:
+        payload = self._payload(data)
+        persona_id = payload.get("persona_id")
+        system_prompt = payload.get("system_prompt")
+        begin_dialogs = payload.get("begin_dialogs")
+        has_tools = "tools" in payload
+        tools = payload.get("tools")
+        has_skills = "skills" in payload
+        skills = payload.get("skills")
+        has_custom_error_message = "custom_error_message" in payload
+        custom_error_message = payload.get("custom_error_message")
+
+        if not persona_id:
+            raise PersonaServiceError("缺少必要参数: persona_id")
+
+        if has_custom_error_message:
+            custom_error_message = self._normalize_custom_error_message(
+                custom_error_message
+            )
+
+        if begin_dialogs is not None:
+            self._validate_begin_dialogs(begin_dialogs)
+
+        update_kwargs = {
+            "persona_id": persona_id,
+            "system_prompt": system_prompt,
+            "begin_dialogs": begin_dialogs,
+        }
+        if has_tools:
+            update_kwargs["tools"] = tools
+        if has_skills:
+            update_kwargs["skills"] = skills
+        if has_custom_error_message:
+            update_kwargs["custom_error_message"] = custom_error_message
+
+        await self.persona_mgr.update_persona(**update_kwargs)
+        return {"message": "人格更新成功"}
+
+    async def delete_persona(self, data: object) -> dict:
+        payload = self._payload(data)
+        persona_id = payload.get("persona_id")
+
+        if not persona_id:
+            raise PersonaServiceError("缺少必要参数: persona_id")
+
+        await self.persona_mgr.delete_persona(persona_id)
+        return {"message": "人格删除成功"}
+
+    async def move_persona(self, data: object) -> dict:
+        payload = self._payload(data)
+        persona_id = payload.get("persona_id")
+        folder_id = payload.get("folder_id")
+
+        if not persona_id:
+            raise PersonaServiceError("缺少必要参数: persona_id")
+
+        await self.persona_mgr.move_persona_to_folder(persona_id, folder_id)
+        return {"message": "人格移动成功"}
+
+    async def list_folders(self, parent_id: str | None) -> list[dict]:
+        if parent_id == "":
+            parent_id = None
+        folders = await self.persona_mgr.get_folders(parent_id)
+        return [self.serialize_folder(folder) for folder in folders]
+
+    async def get_folder_tree(self):
+        return await self.persona_mgr.get_folder_tree()
+
+    async def get_folder_detail(self, data: object) -> dict:
+        payload = self._payload(data)
+        folder_id = payload.get("folder_id")
+
+        if not folder_id:
+            raise PersonaServiceError("缺少必要参数: folder_id")
+
+        folder = await self.persona_mgr.get_folder(folder_id)
+        if not folder:
+            raise PersonaServiceError("文件夹不存在")
+
+        return self.serialize_folder(folder)
+
+    async def create_folder(self, data: object) -> dict:
+        payload = self._payload(data)
+        name = str(payload.get("name", "")).strip()
+        parent_id = payload.get("parent_id")
+        description = payload.get("description")
+        sort_order = payload.get("sort_order", 0)
+
+        if not name:
+            raise PersonaServiceError("文件夹名称不能为空")
+
+        folder = await self.persona_mgr.create_folder(
+            name=name,
+            parent_id=parent_id,
+            description=description,
+            sort_order=sort_order,
+        )
+
+        return {
+            "message": "文件夹创建成功",
+            "folder": self.serialize_folder(folder),
+        }
+
+    async def update_folder(self, data: object) -> dict:
+        payload = self._payload(data)
+        folder_id = payload.get("folder_id")
+        name = payload.get("name")
+        parent_id = payload.get("parent_id") if "parent_id" in payload else NOT_GIVEN
+        description = (
+            payload.get("description") if "description" in payload else NOT_GIVEN
+        )
+        sort_order = payload.get("sort_order")
+
+        if not folder_id:
+            raise PersonaServiceError("缺少必要参数: folder_id")
+
+        await self.persona_mgr.update_folder(
+            folder_id=folder_id,
+            name=name,
+            parent_id=parent_id,
+            description=description,
+            sort_order=sort_order,
+        )
+
+        return {"message": "文件夹更新成功"}
+
+    async def delete_folder(self, data: object) -> dict:
+        payload = self._payload(data)
+        folder_id = payload.get("folder_id")
+
+        if not folder_id:
+            raise PersonaServiceError("缺少必要参数: folder_id")
+
+        await self.persona_mgr.delete_folder(folder_id)
+        return {"message": "文件夹删除成功"}
+
+    async def reorder_items(self, data: object) -> dict:
+        payload = self._payload(data)
+        items = payload.get("items", [])
+
+        if not items:
+            raise PersonaServiceError("items 不能为空")
+
+        for item in items:
+            if not all(key in item for key in ("id", "type", "sort_order")):
+                raise PersonaServiceError(
+                    "每个 item 必须包含 id, type, sort_order 字段"
+                )
+            if item["type"] not in ("persona", "folder"):
+                raise PersonaServiceError("type 字段必须是 'persona' 或 'folder'")
+
+        await self.persona_mgr.batch_update_sort_order(items)
+        return {"message": "排序更新成功"}
+
+    @staticmethod
+    def serialize_persona(persona, empty_lists_for_tools: bool = False) -> dict:
+        return {
+            "persona_id": persona.persona_id,
+            "system_prompt": persona.system_prompt,
+            "begin_dialogs": persona.begin_dialogs or [],
+            "tools": (persona.tools or []) if empty_lists_for_tools else persona.tools,
+            "skills": (persona.skills or [])
+            if empty_lists_for_tools
+            else persona.skills,
+            "custom_error_message": persona.custom_error_message,
+            "folder_id": persona.folder_id,
+            "sort_order": persona.sort_order,
+            "created_at": persona.created_at.isoformat()
+            if persona.created_at
+            else None,
+            "updated_at": persona.updated_at.isoformat()
+            if persona.updated_at
+            else None,
+        }
+
+    @staticmethod
+    def serialize_folder(folder) -> dict:
+        return {
+            "folder_id": folder.folder_id,
+            "name": folder.name,
+            "parent_id": folder.parent_id,
+            "description": folder.description,
+            "sort_order": folder.sort_order,
+            "created_at": folder.created_at.isoformat() if folder.created_at else None,
+            "updated_at": folder.updated_at.isoformat() if folder.updated_at else None,
+        }
+
+    @staticmethod
+    def _normalize_custom_error_message(value):
+        if value is not None:
+            if not isinstance(value, str):
+                raise PersonaServiceError("自定义报错回复信息必须是字符串")
+            return value.strip() or None
+        return None
+
+    @staticmethod
+    def _validate_begin_dialogs(begin_dialogs) -> None:
+        if begin_dialogs and len(begin_dialogs) % 2 != 0:
+            raise PersonaServiceError("预设对话数量必须为偶数（用户和助手轮流对话）")
+
+    @staticmethod
+    def _payload(data: object) -> dict:
+        return data if isinstance(data, dict) else {}
diff --git a/astrbot/dashboard/services/platform_service.py b/astrbot/dashboard/services/platform_service.py
new file mode 100644
index 000000000..c203f3c09
--- /dev/null
+++ b/astrbot/dashboard/services/platform_service.py
@@ -0,0 +1,218 @@
+from __future__ import annotations
+
+import secrets
+import string
+
+from astrbot.core import logger
+from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
+from astrbot.core.platform import Platform
+from astrbot.core.platform.sources.dingtalk.app_registration import (
+    poll_dingtalk_app_registration_once,
+    request_dingtalk_app_registration,
+)
+from astrbot.core.platform.sources.lark.app_registration import (
+    poll_app_registration_once,
+    request_app_registration,
+)
+from astrbot.core.platform.sources.lark.bot_info import request_lark_bot_info
+from astrbot.core.platform.sources.weixin_oc.login_registration import (
+    poll_weixin_oc_login_once,
+    request_weixin_oc_login_qr,
+)
+
+
+class PlatformServiceError(Exception):
+    def __init__(self, message: str, status_code: int = 500) -> None:
+        super().__init__(message)
+        self.status_code = status_code
+
+
+def random_platform_id_suffix() -> str:
+    return "_" + "".join(secrets.choice(string.ascii_lowercase) for _ in range(4))
+
+
+class PlatformService:
+    def __init__(self, core_lifecycle: AstrBotCoreLifecycle) -> None:
+        self.platform_manager = core_lifecycle.platform_manager
+
+    async def handle_webhook_callback(self, webhook_uuid: str, request_obj):
+        platform_adapter = self.find_platform_by_uuid(webhook_uuid)
+
+        if not platform_adapter:
+            logger.warning(f"未找到 webhook_uuid 为 {webhook_uuid} 的平台")
+            raise PlatformServiceError("未找到对应平台", 404)
+
+        try:
+            return await platform_adapter.webhook_callback(request_obj)
+        except NotImplementedError as exc:
+            logger.error(
+                f"平台 {platform_adapter.meta().name} 未实现 webhook_callback 方法"
+            )
+            raise PlatformServiceError("平台未支持统一 Webhook 模式", 500) from exc
+        except Exception as exc:
+            logger.error(f"处理 webhook 回调时发生错误: {exc}", exc_info=True)
+            raise PlatformServiceError("处理回调失败", 500) from exc
+
+    def find_platform_by_uuid(self, webhook_uuid: str) -> Platform | None:
+        for platform in self.platform_manager.platform_insts:
+            if platform.config.get("webhook_uuid") == webhook_uuid:
+                if platform.unified_webhook():
+                    return platform
+        return None
+
+    def get_platform_stats(self):
+        try:
+            return self.platform_manager.get_all_stats()
+        except Exception as exc:
+            logger.error(f"获取平台统计信息失败: {exc}", exc_info=True)
+            raise PlatformServiceError(f"获取统计信息失败: {exc}", 500) from exc
+
+    async def handle_platform_registration(
+        self,
+        platform_type: str,
+        payload: dict,
+    ) -> dict:
+        try:
+            action = str(payload.get("action", "")).strip().lower()
+            if not action:
+                raise PlatformServiceError("Missing action", 400)
+
+            platform_config = payload.get("platform_config")
+            if not isinstance(platform_config, dict):
+                platform_config = {}
+
+            if platform_type == "lark":
+                return await self._handle_lark_registration(
+                    action,
+                    payload,
+                    platform_config,
+                )
+            if platform_type == "weixin_oc":
+                return await self._handle_weixin_oc_registration(
+                    action,
+                    payload,
+                    platform_config,
+                )
+            if platform_type == "dingtalk":
+                return await self._handle_dingtalk_registration(action, payload)
+
+            raise PlatformServiceError(
+                f"Unsupported platform registration: {platform_type}",
+                404,
+            )
+        except PlatformServiceError:
+            raise
+        except Exception as exc:
+            logger.error(f"处理平台一键创建请求失败: {exc}", exc_info=True)
+            raise PlatformServiceError(str(exc), 500) from exc
+
+    async def _handle_lark_registration(
+        self,
+        action: str,
+        payload: dict,
+        platform_config: dict,
+    ) -> dict:
+        domain = str(platform_config.get("domain") or "").strip()
+
+        if action == "start":
+            registration = await request_app_registration(domain)
+            return {
+                "status": "pending",
+                "device_code": registration.device_code,
+                "registration_code": registration.device_code,
+                "user_code": registration.user_code,
+                "verification_uri": registration.verification_uri,
+                "verification_uri_complete": registration.verification_uri_complete,
+                "expires_in": registration.expires_in,
+                "interval": registration.interval,
+            }
+
+        if action == "poll":
+            device_code = str(
+                payload.get("device_code") or payload.get("registration_code") or ""
+            ).strip()
+            if not device_code:
+                raise PlatformServiceError("Missing device_code", 400)
+            result = await poll_app_registration_once(
+                domain=domain,
+                device_code=device_code,
+            )
+            if result.get("status") == "created":
+                try:
+                    bot_info = await request_lark_bot_info(
+                        domain=str(result.get("domain") or domain),
+                        app_id=str(result.get("app_id") or ""),
+                        app_secret=str(result.get("app_secret") or ""),
+                    )
+                    if bot_info.app_name:
+                        result["bot_name"] = bot_info.app_name
+                    if bot_info.open_id:
+                        result["bot_open_id"] = bot_info.open_id
+                except Exception as exc:
+                    logger.error(f"获取飞书机器人信息失败: {exc}", exc_info=True)
+            return result
+
+        raise PlatformServiceError(f"Unsupported action: {action}", 400)
+
+    async def _handle_dingtalk_registration(
+        self,
+        action: str,
+        payload: dict,
+    ) -> dict:
+        if action == "start":
+            registration = await request_dingtalk_app_registration()
+            return {
+                "status": "pending",
+                "device_code": registration.device_code,
+                "registration_code": registration.device_code,
+                "user_code": registration.user_code,
+                "verification_uri": registration.verification_uri,
+                "verification_uri_complete": registration.verification_uri_complete,
+                "expires_in": registration.expires_in,
+                "interval": registration.interval,
+            }
+
+        if action == "poll":
+            device_code = str(
+                payload.get("device_code") or payload.get("registration_code") or ""
+            ).strip()
+            if not device_code:
+                raise PlatformServiceError("Missing device_code", 400)
+            result = await poll_dingtalk_app_registration_once(device_code)
+            if result.get("status") == "created":
+                result["platform_id_suffix"] = random_platform_id_suffix()
+            return result
+
+        raise PlatformServiceError(f"Unsupported action: {action}", 400)
+
+    async def _handle_weixin_oc_registration(
+        self,
+        action: str,
+        payload: dict,
+        platform_config: dict,
+    ) -> dict:
+        if action == "start":
+            registration = await request_weixin_oc_login_qr(platform_config)
+            return {
+                "status": "pending",
+                "registration_code": registration.qrcode,
+                "qrcode": registration.qrcode,
+                "qrcode_img_content": registration.qrcode_img_content,
+                "interval": registration.interval,
+            }
+
+        if action == "poll":
+            qrcode = str(
+                payload.get("qrcode") or payload.get("registration_code") or ""
+            ).strip()
+            if not qrcode:
+                raise PlatformServiceError("Missing qrcode", 400)
+            result = await poll_weixin_oc_login_once(
+                platform_config=platform_config,
+                qrcode=qrcode,
+            )
+            if result.get("status") == "created":
+                result["platform_id_suffix"] = random_platform_id_suffix()
+            return result
+
+        raise PlatformServiceError(f"Unsupported action: {action}", 400)
diff --git a/astrbot/dashboard/services/plugin_page_service.py b/astrbot/dashboard/services/plugin_page_service.py
new file mode 100644
index 000000000..bb51749dc
--- /dev/null
+++ b/astrbot/dashboard/services/plugin_page_service.py
@@ -0,0 +1,931 @@
+from __future__ import annotations
+
+import json
+import mimetypes
+import os
+import posixpath
+import re
+from dataclasses import dataclass
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+from typing import cast
+from urllib.parse import parse_qsl, quote, urlencode, urlsplit, urlunsplit
+
+import aiofiles
+import jwt
+from aiofiles import ospath as aio_ospath
+
+from astrbot.core.config.astrbot_config import AstrBotConfig
+from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
+from astrbot.core.star.star import StarMetadata
+from astrbot.core.star.star_manager import PluginManager
+
+PLUGIN_PAGE_ASSET_TOKEN_TYPE = "plugin_page_asset"
+PLUGIN_PAGE_ASSET_TOKEN_TTL_SECONDS = 60
+PLUGIN_PAGE_ROOT_DIR_NAME = "pages"
+PLUGIN_PAGE_ENTRY_FILE_NAME = "index.html"
+PLUGIN_PAGE_BRIDGE_FILE = (
+    Path(__file__).resolve().parent.parent / "plugin_page_bridge.js"
+)
+
+_HTML_ASSET_ATTR_RE = re.compile(
+    r"(?P<attr>src|href)=(?P<quote>[\"\'])(?P<url>.*?)(?P=quote)",
+    re.IGNORECASE,
+)
+_CSS_URL_RE = re.compile(
+    r"url\(\s*(?P<quote>[\"\']?)(?P<url>.*?)(?P=quote)\s*\)",
+    re.IGNORECASE,
+)
+_JS_DYNAMIC_IMPORT_RE = re.compile(
+    r"(?P<prefix>\bimport\s*\(\s*)(?P<quote>[\"\'])(?P<url>.*?)(?P=quote)(?P<suffix>\s*\))",
+    re.IGNORECASE,
+)
+_JS_MODULE_FROM_RE = re.compile(
+    r"(?P<prefix>\b(?:import|export)\s+(?:[^;]*?\s+from\s+))(?P<quote>[\"\'])(?P<url>.*?)(?P=quote)",
+    re.IGNORECASE | re.DOTALL,
+)
+_JS_SIDE_EFFECT_IMPORT_RE = re.compile(
+    r"(?P<prefix>\bimport\s+)(?P<quote>[\"\'])(?P<url>[^\"'\r\n]+)(?P=quote)",
+    re.IGNORECASE,
+)
+
+
+@dataclass
+class PluginPage:
+    name: str
+    title: str
+    entry_file: str = PLUGIN_PAGE_ENTRY_FILE_NAME
+
+
+@dataclass
+class PluginPageContentPayload:
+    content: str | bytes
+    content_type: str
+
+
+class PluginPageServiceError(Exception):
+    def __init__(
+        self,
+        message: str,
+        status_code: int = 400,
+        *,
+        public_message: str | None = None,
+    ) -> None:
+        super().__init__(message)
+        self.status_code = status_code
+        self.public_message = public_message or message
+
+
+class PluginPageService:
+    def __init__(
+        self,
+        plugin_manager: PluginManager,
+        core_lifecycle: AstrBotCoreLifecycle | None = None,
+        config: AstrBotConfig | None = None,
+    ) -> None:
+        self.plugin_manager = plugin_manager
+        self.config = config or (
+            core_lifecycle.astrbot_config if core_lifecycle is not None else None
+        )
+        self.bridge_file = PLUGIN_PAGE_BRIDGE_FILE
+
+    def _jwt_secret(self) -> str | None:
+        if self.config is None:
+            return None
+        return self.config.get("dashboard", {}).get("jwt_secret")
+
+    def get_plugin_metadata_by_name(self, plugin_name: str) -> StarMetadata | None:
+        for plugin in self.plugin_manager.context.get_all_stars():
+            if plugin.name == plugin_name:
+                return plugin
+        return None
+
+    @staticmethod
+    def get_by_path(source: dict | None, key: str):
+        if not isinstance(source, dict) or not key:
+            return None
+        current = source
+        for part in key.split("."):
+            if not isinstance(current, dict) or part not in current:
+                return None
+            current = current[part]
+        return current
+
+    @staticmethod
+    def apply_theme_to_html(html: str, theme: str) -> str:
+        def _replace_html_tag(m: re.Match) -> str:
+            attrs = m.group(1) or ""
+            attrs = re.sub(
+                r'\s+data-theme\s*=\s*["\'][^"\']*["\']',
+                "",
+                attrs,
+                flags=re.IGNORECASE,
+            )
+            return f'<html{attrs} data-theme="{theme}">'
+
+        html = re.sub(
+            r"<html(\b[^>]*)>",
+            _replace_html_tag,
+            html,
+            count=1,
+            flags=re.IGNORECASE,
+        )
+
+        meta_tag = f'<meta name="color-scheme" content="{theme}">'
+        html = re.sub(
+            r'<meta\s[^>]*name\s*=\s*["\']color-scheme["\'][^>]*>',
+            "",
+            html,
+            flags=re.IGNORECASE,
+        )
+
+        head_match = re.search(r"<head\b[^>]*>", html, re.IGNORECASE)
+        if head_match:
+            html = html.replace(
+                head_match.group(0), f"{head_match.group(0)}{meta_tag}", 1
+            )
+        else:
+            html = re.sub(
+                r"(<html\b[^>]*>)",
+                rf"\1<head>{meta_tag}</head>",
+                html,
+                count=1,
+                flags=re.IGNORECASE,
+            )
+        return html
+
+    def build_initial_context(
+        self,
+        *,
+        asset_token: str,
+        jwt_secret: str | None = None,
+        locale: str,
+        theme: str | None,
+    ) -> dict | None:
+        if not asset_token:
+            return None
+        jwt_secret = jwt_secret or self._jwt_secret()
+        if not isinstance(jwt_secret, str) or not jwt_secret.strip():
+            return None
+
+        try:
+            payload = jwt.decode(asset_token, jwt_secret, algorithms=["HS256"])
+        except jwt.InvalidTokenError:
+            return None
+        if payload.get("token_type") != PLUGIN_PAGE_ASSET_TOKEN_TYPE:
+            return None
+
+        plugin_name = payload.get("plugin_name")
+        page_name = payload.get("page_name")
+        if not isinstance(plugin_name, str) or not isinstance(page_name, str):
+            return None
+
+        plugin = self.get_plugin_metadata_by_name(plugin_name)
+        if not plugin:
+            return None
+
+        resolved_locale = locale
+        token_locale = payload.get("locale")
+        if isinstance(token_locale, str):
+            resolved_locale = token_locale
+        plugin_i18n = plugin.i18n or {}
+        try:
+            plugin_root = self.get_plugin_root_dir(plugin)
+            fresh_i18n = PluginManager._load_plugin_i18n(str(plugin_root))
+            if fresh_i18n:
+                plugin_i18n = fresh_i18n
+        except (OSError, ValueError):
+            pass
+
+        locale_data = plugin_i18n.get(resolved_locale)
+        display_name = (
+            self.get_by_path(locale_data, "metadata.display_name")
+            or plugin.display_name
+            or plugin.name
+        )
+        page_title = (
+            self.get_by_path(locale_data, f"pages.{page_name}.title") or page_name
+        )
+
+        return {
+            "pluginName": plugin.name,
+            "displayName": display_name,
+            "pageName": page_name,
+            "pageTitle": page_title,
+            "locale": resolved_locale,
+            "i18n": plugin_i18n,
+            "isDark": theme == "dark",
+        }
+
+    async def get_plugin_page_entry_config(
+        self,
+        *,
+        plugin_name: str | None,
+        page_name: str | None,
+        jwt_secret: str | None = None,
+        username: str | None,
+        locale: str,
+    ) -> dict:
+        if not plugin_name:
+            raise PluginPageServiceError("缺少插件名")
+        if not page_name:
+            raise PluginPageServiceError("缺少 Page 名称")
+
+        plugin = self.get_plugin_metadata_by_name(plugin_name)
+        if not plugin:
+            raise PluginPageServiceError("插件不存在")
+        if not plugin.activated:
+            raise PluginPageServiceError("插件未启用")
+
+        page = await self.serialize_plugin_page_for_request(
+            plugin,
+            page_name,
+            include_content_path=True,
+            jwt_secret=jwt_secret,
+            username=username,
+            locale=locale,
+        )
+        if not page:
+            raise PluginPageServiceError("插件 Page 不存在")
+        return page
+
+    async def serialize_plugin_page_for_request(
+        self,
+        plugin: StarMetadata,
+        page_name: str,
+        *,
+        include_content_path: bool = False,
+        jwt_secret: str | None = None,
+        username: str | None,
+        locale: str,
+    ) -> dict | None:
+        asset_token = ""
+        if include_content_path:
+            plugin_name = plugin.name.strip() if isinstance(plugin.name, str) else ""
+            asset_token = (
+                self.issue_plugin_page_asset_token(
+                    plugin_name=plugin_name,
+                    page_name=page_name,
+                    jwt_secret=jwt_secret or self._jwt_secret(),
+                    username=username,
+                    locale=locale,
+                )
+                or ""
+            )
+        return await self.serialize_plugin_page(
+            plugin,
+            page_name,
+            include_content_path=include_content_path,
+            asset_token=asset_token,
+        )
+
+    def prepare_plugin_page_query_params(
+        self,
+        plugin_name: str,
+        page_name: str,
+        *,
+        asset_token: str,
+        jwt_secret: str | None = None,
+        username: str | None,
+        locale: str,
+        theme: str | None,
+    ) -> dict[str, str] | None:
+        if not asset_token:
+            asset_token = (
+                self.issue_plugin_page_asset_token(
+                    plugin_name=plugin_name,
+                    page_name=page_name,
+                    jwt_secret=jwt_secret or self._jwt_secret(),
+                    username=username,
+                    locale=locale,
+                )
+                or ""
+            )
+
+        if not asset_token and not theme:
+            return None
+
+        params: dict[str, str] = {}
+        if asset_token:
+            params["asset_token"] = asset_token
+        if theme:
+            params["theme"] = theme
+        return params
+
+    async def serve_bridge_sdk(
+        self,
+        *,
+        asset_token: str,
+        jwt_secret: str | None = None,
+        locale: str,
+        theme: str | None,
+    ) -> PluginPageContentPayload:
+        if not self.bridge_file.is_file():
+            raise PluginPageServiceError(
+                "Plugin Page bridge SDK not found",
+                status_code=404,
+            )
+        bridge_js = await self.read_plugin_page_text(self.bridge_file)
+        initial_context = self.build_initial_context(
+            asset_token=asset_token,
+            jwt_secret=jwt_secret,
+            locale=locale,
+            theme=theme,
+        )
+        if initial_context:
+            context_json = json.dumps(initial_context, ensure_ascii=False)
+            bridge_js += (
+                f"\n;window.AstrBotPluginPage?.__setInitialContext({context_json});\n"
+            )
+        return PluginPageContentPayload(
+            content=bridge_js,
+            content_type="application/javascript; charset=utf-8",
+        )
+
+    async def serve_page_content(
+        self,
+        *,
+        plugin_name: str,
+        page_name: str,
+        asset_path: str,
+        asset_token: str,
+        jwt_secret: str | None = None,
+        username: str | None,
+        locale: str,
+        theme: str | None,
+    ) -> PluginPageContentPayload:
+        plugin = self.get_plugin_metadata_by_name(plugin_name)
+        if not plugin:
+            raise PluginPageServiceError("Plugin not found", status_code=404)
+        if not plugin.activated:
+            raise PluginPageServiceError("Plugin is disabled", status_code=403)
+
+        try:
+            page = await self.get_plugin_page(plugin, page_name)
+            file_path = await self.resolve_plugin_page_file(
+                plugin,
+                page.name,
+                asset_path,
+            )
+        except (FileNotFoundError, ValueError) as exc:
+            raise PluginPageServiceError(
+                "Plugin Page asset not found",
+                status_code=404,
+            ) from exc
+
+        extra_query_params = self.prepare_plugin_page_query_params(
+            plugin_name,
+            page.name,
+            asset_token=asset_token,
+            jwt_secret=jwt_secret,
+            username=username,
+            locale=locale,
+            theme=theme,
+        )
+        served_asset_path = asset_path or page.entry_file
+        suffix = file_path.suffix.lower()
+        if suffix == ".html":
+            html_text = await self.read_plugin_page_text(file_path)
+            return PluginPageContentPayload(
+                content=self.rewrite_plugin_page_html(
+                    html_text,
+                    plugin_name,
+                    page.name,
+                    served_asset_path,
+                    theme=theme,
+                    extra_query_params=extra_query_params,
+                ),
+                content_type="text/html; charset=utf-8",
+            )
+        if suffix == ".css":
+            css_text = await self.read_plugin_page_text(file_path)
+            return PluginPageContentPayload(
+                content=self.rewrite_plugin_page_css(
+                    css_text,
+                    plugin_name,
+                    page.name,
+                    served_asset_path,
+                    extra_query_params=extra_query_params,
+                ),
+                content_type="text/css; charset=utf-8",
+            )
+        if suffix in {".js", ".mjs"}:
+            js_text = await self.read_plugin_page_text(file_path)
+            return PluginPageContentPayload(
+                content=self.rewrite_plugin_page_js(
+                    js_text,
+                    plugin_name,
+                    page.name,
+                    served_asset_path,
+                    extra_query_params=extra_query_params,
+                ),
+                content_type="application/javascript; charset=utf-8",
+            )
+        return PluginPageContentPayload(
+            content=await self.read_plugin_page_binary(file_path),
+            content_type=self.guess_plugin_page_mime_type(file_path),
+        )
+
+    @staticmethod
+    def build_security_headers() -> dict[str, str]:
+        headers = {
+            "Cache-Control": "no-store",
+            "Referrer-Policy": "no-referrer",
+            "X-Content-Type-Options": "nosniff",
+            "Cross-Origin-Resource-Policy": "cross-origin",
+            "Access-Control-Allow-Origin": "*",
+        }
+
+        csp = "object-src 'none'; base-uri 'self'"
+        if os.environ.get("ASTRBOT_LAUNCHER") not in ("1", "true"):
+            headers["X-Frame-Options"] = "SAMEORIGIN"
+            csp = f"frame-ancestors 'self'; {csp}"
+        headers["Content-Security-Policy"] = csp
+        return headers
+
+    @staticmethod
+    def normalize_plugin_page_path(
+        raw_path: str,
+        *,
+        base_dir: str | None = None,
+        allow_empty: bool = False,
+    ) -> str:
+        path = raw_path.replace("\\", "/").strip()
+        if base_dir:
+            path = posixpath.join(base_dir, path)
+        normalized = posixpath.normpath(path)
+        if normalized in {"", "."}:
+            if allow_empty:
+                return ""
+            raise ValueError("Invalid plugin Page asset path")
+        if (
+            normalized.startswith("../")
+            or normalized == ".."
+            or normalized.startswith("/")
+        ):
+            raise ValueError("Invalid plugin Page asset path")
+        return normalized
+
+    @staticmethod
+    def normalize_plugin_page_name(raw_name: str) -> str:
+        page_name = raw_name.strip()
+        if not page_name:
+            raise ValueError("Invalid plugin Page name")
+        normalized = posixpath.normpath(page_name.replace("\\", "/"))
+        if (
+            normalized != page_name
+            or normalized in {".", ".."}
+            or normalized.startswith(".")
+            or "/" in page_name
+            or "\\" in page_name
+        ):
+            raise ValueError("Invalid plugin Page name")
+        return page_name
+
+    def get_plugin_root_dir(self, plugin: StarMetadata) -> Path:
+        if not plugin.root_dir_name:
+            raise FileNotFoundError("Plugin directory metadata is missing")
+
+        base_dir = Path(
+            self.plugin_manager.reserved_plugin_path
+            if plugin.reserved
+            else self.plugin_manager.plugin_store_path
+        ).resolve(strict=False)
+        plugin_root = (base_dir / plugin.root_dir_name).resolve(strict=False)
+        plugin_root.relative_to(base_dir)
+        return plugin_root
+
+    async def resolve_plugin_pages_root(self, plugin: StarMetadata) -> Path:
+        plugin_root = self.get_plugin_root_dir(plugin)
+        pages_root = (plugin_root / PLUGIN_PAGE_ROOT_DIR_NAME).resolve(strict=False)
+        pages_root.relative_to(plugin_root)
+        if pages_root == plugin_root:
+            raise FileNotFoundError("Plugin Pages root directory is invalid")
+        if not await aio_ospath.isdir(str(pages_root)):
+            raise FileNotFoundError("Plugin Pages root directory does not exist")
+        return pages_root
+
+    async def discover_plugin_pages(self, plugin: StarMetadata) -> list[PluginPage]:
+        try:
+            pages_root = await self.resolve_plugin_pages_root(plugin)
+        except (FileNotFoundError, ValueError):
+            return []
+
+        pages: list[PluginPage] = []
+        try:
+            page_dirs = sorted(
+                (item for item in pages_root.iterdir() if item.is_dir()),
+                key=lambda item: item.name.lower(),
+            )
+        except OSError:
+            return []
+
+        for page_dir in page_dirs:
+            try:
+                page_name = self.normalize_plugin_page_name(page_dir.name)
+            except ValueError:
+                continue
+            entry_path = page_dir / PLUGIN_PAGE_ENTRY_FILE_NAME
+            if not await aio_ospath.isfile(str(entry_path)):
+                continue
+            pages.append(
+                PluginPage(
+                    name=page_name,
+                    title=page_name,
+                    entry_file=PLUGIN_PAGE_ENTRY_FILE_NAME,
+                )
+            )
+        return pages
+
+    async def get_plugin_page(
+        self,
+        plugin: StarMetadata,
+        page_name: str,
+    ) -> PluginPage:
+        normalized_name = self.normalize_plugin_page_name(page_name)
+        for page in await self.discover_plugin_pages(plugin):
+            if page.name == normalized_name:
+                return page
+        raise FileNotFoundError("Plugin Page entry not found")
+
+    async def resolve_plugin_page_root(
+        self,
+        plugin: StarMetadata,
+        page_name: str,
+    ) -> Path:
+        normalized_name = self.normalize_plugin_page_name(page_name)
+        pages_root = await self.resolve_plugin_pages_root(plugin)
+        page_root = (pages_root / normalized_name).resolve(strict=False)
+        page_root.relative_to(pages_root)
+        if not await aio_ospath.isdir(str(page_root)):
+            raise FileNotFoundError("Plugin Page root directory does not exist")
+        return page_root
+
+    async def resolve_plugin_page_file(
+        self,
+        plugin: StarMetadata,
+        page_name: str,
+        asset_path: str,
+    ) -> Path:
+        page = await self.get_plugin_page(plugin, page_name)
+        page_root = await self.resolve_plugin_page_root(plugin, page.name)
+        target_name = (
+            self.normalize_plugin_page_path(asset_path, allow_empty=True)
+            or page.entry_file
+        )
+        target_path = (page_root / target_name).resolve(strict=False)
+        target_path.relative_to(page_root)
+        if not await aio_ospath.isfile(str(target_path)):
+            raise FileNotFoundError("Plugin Page asset not found")
+        return target_path
+
+    @staticmethod
+    def is_rewritable_asset_url(raw_url: str) -> bool:
+        value = raw_url.strip()
+        lower = value.lower()
+        if not value:
+            return False
+        if value.startswith(("#", "/#")):
+            return False
+        if lower.startswith(
+            (
+                "http://",
+                "https://",
+                "//",
+                "data:",
+                "javascript:",
+                "mailto:",
+                "tel:",
+                "blob:",
+            )
+        ):
+            return False
+        return True
+
+    @staticmethod
+    def resolve_referenced_asset_path(
+        base_asset_path: str,
+        referenced_url: str,
+    ) -> str:
+        parts = urlsplit(referenced_url)
+        referenced_path = parts.path.strip()
+        if not referenced_path:
+            raise ValueError("Plugin Page referenced asset path is empty")
+        base_dir = posixpath.dirname(base_asset_path) if base_asset_path else ""
+        normalized = PluginPageService.normalize_plugin_page_path(
+            referenced_path,
+            base_dir=base_dir,
+        )
+        if not normalized:
+            raise ValueError("Plugin Page referenced asset path is invalid")
+        return normalized
+
+    def build_plugin_page_asset_url(
+        self,
+        plugin_name: str,
+        page_name: str,
+        asset_path: str,
+        original_query: str = "",
+        original_fragment: str = "",
+        extra_query_params: dict[str, str] | None = None,
+    ) -> str:
+        path = self.build_plugin_page_content_path(plugin_name, page_name, asset_path)
+        query_dict = dict(parse_qsl(original_query, keep_blank_values=True))
+        if extra_query_params:
+            for key, value in extra_query_params.items():
+                if value:
+                    query_dict[key] = value
+        query = urlencode(query_dict)
+        return urlunsplit(("", "", path, query, original_fragment))
+
+    @staticmethod
+    def build_plugin_page_content_path(
+        plugin_name: str,
+        page_name: str,
+        asset_path: str = "",
+    ) -> str:
+        encoded_plugin_name = quote(plugin_name, safe="")
+        encoded_page_name = quote(
+            PluginPageService.normalize_plugin_page_name(page_name),
+            safe="",
+        )
+        if not asset_path:
+            return (
+                f"/api/plugin/page/content/{encoded_plugin_name}/{encoded_page_name}/"
+            )
+        safe_asset_path = PluginPageService.normalize_plugin_page_path(
+            asset_path,
+            allow_empty=True,
+        )
+        encoded_path = "/".join(
+            quote(part, safe="") for part in safe_asset_path.split("/")
+        )
+        return (
+            f"/api/plugin/page/content/{encoded_plugin_name}/"
+            f"{encoded_page_name}/{encoded_path}"
+        )
+
+    @staticmethod
+    def get_plugin_page_bridge_sdk_url(
+        extra_query_params: dict[str, str] | None = None,
+    ) -> str:
+        query = urlencode(extra_query_params or {})
+        return urlunsplit(("", "", "/api/plugin/page/bridge-sdk.js", query, ""))
+
+    @staticmethod
+    def is_js_relative_module_specifier(raw_url: str) -> bool:
+        value = raw_url.strip()
+        return value.startswith(("./", "../", "/"))
+
+    def rewrite_relative_asset_url(
+        self,
+        raw_url: str,
+        base_asset_path: str,
+        plugin_name: str,
+        page_name: str,
+        extra_query_params: dict[str, str] | None = None,
+    ) -> str | None:
+        candidate = raw_url.strip()
+        if not self.is_rewritable_asset_url(candidate):
+            return None
+        parts = urlsplit(candidate)
+        asset_path = self.resolve_referenced_asset_path(base_asset_path, candidate)
+        return self.build_plugin_page_asset_url(
+            plugin_name,
+            page_name,
+            asset_path,
+            original_query=parts.query,
+            original_fragment=parts.fragment,
+            extra_query_params=extra_query_params,
+        )
+
+    def rewrite_plugin_page_html(
+        self,
+        html_text: str,
+        plugin_name: str,
+        page_name: str,
+        entry_asset_path: str,
+        *,
+        theme: str | None,
+        extra_query_params: dict[str, str] | None = None,
+    ) -> str:
+        def replace_attr(match: re.Match[str]) -> str:
+            raw_url = match.group("url")
+            attr = match.group("attr")
+            quote_char = match.group("quote")
+
+            if raw_url.strip() == "/api/plugin/page/bridge-sdk.js":
+                url = self.get_plugin_page_bridge_sdk_url(extra_query_params)
+                return f"{attr}={quote_char}{url}{quote_char}"
+
+            if not self.is_rewritable_asset_url(raw_url):
+                return match.group(0)
+
+            try:
+                rewritten_url = self.rewrite_relative_asset_url(
+                    raw_url,
+                    entry_asset_path,
+                    plugin_name,
+                    page_name,
+                    extra_query_params=extra_query_params,
+                )
+                if not rewritten_url:
+                    return match.group(0)
+                return f"{attr}={quote_char}{rewritten_url}{quote_char}"
+            except ValueError:
+                return match.group(0)
+
+        rewritten_html = _HTML_ASSET_ATTR_RE.sub(replace_attr, html_text)
+        if theme:
+            rewritten_html = self.apply_theme_to_html(rewritten_html, theme)
+        if "/api/plugin/page/bridge-sdk.js" not in rewritten_html:
+            bridge_tag = f'<script src="{self.get_plugin_page_bridge_sdk_url(extra_query_params)}"></script>'
+            if "</body>" in rewritten_html:
+                rewritten_html = rewritten_html.replace(
+                    "</body>", f"{bridge_tag}</body>", 1
+                )
+            else:
+                rewritten_html += bridge_tag
+        return rewritten_html
+
+    def rewrite_plugin_page_css(
+        self,
+        css_text: str,
+        plugin_name: str,
+        page_name: str,
+        css_asset_path: str,
+        extra_query_params: dict[str, str] | None = None,
+    ) -> str:
+        def replace_url(match: re.Match[str]) -> str:
+            raw_url = match.group("url").strip()
+            quote_char = match.group("quote") or ""
+            try:
+                rewritten_url = self.rewrite_relative_asset_url(
+                    raw_url,
+                    css_asset_path,
+                    plugin_name,
+                    page_name,
+                    extra_query_params=extra_query_params,
+                )
+                if not rewritten_url:
+                    return match.group(0)
+                return f"url({quote_char}{rewritten_url}{quote_char})"
+            except ValueError:
+                return match.group(0)
+
+        return _CSS_URL_RE.sub(replace_url, css_text)
+
+    def rewrite_plugin_page_js(
+        self,
+        js_text: str,
+        plugin_name: str,
+        page_name: str,
+        js_asset_path: str,
+        extra_query_params: dict[str, str] | None = None,
+    ) -> str:
+        def rewrite_specifier(raw_url: str) -> str:
+            if not self.is_js_relative_module_specifier(raw_url):
+                return raw_url
+            if not self.is_rewritable_asset_url(raw_url):
+                return raw_url
+            rewritten = self.rewrite_relative_asset_url(
+                raw_url,
+                js_asset_path,
+                plugin_name,
+                page_name,
+                extra_query_params=extra_query_params,
+            )
+            return rewritten or raw_url
+
+        def replace_dynamic(match: re.Match[str]) -> str:
+            raw_url = match.group("url")
+            try:
+                rewritten = rewrite_specifier(raw_url)
+            except ValueError:
+                return match.group(0)
+            return (
+                f"{match.group('prefix')}{match.group('quote')}{rewritten}"
+                f"{match.group('quote')}{match.group('suffix')}"
+            )
+
+        def replace_from(match: re.Match[str]) -> str:
+            raw_url = match.group("url")
+            try:
+                rewritten = rewrite_specifier(raw_url)
+            except ValueError:
+                return match.group(0)
+            return (
+                f"{match.group('prefix')}{match.group('quote')}"
+                f"{rewritten}{match.group('quote')}"
+            )
+
+        rewritten_js = _JS_DYNAMIC_IMPORT_RE.sub(replace_dynamic, js_text)
+        rewritten_js = _JS_MODULE_FROM_RE.sub(replace_from, rewritten_js)
+
+        def replace_side_effect(match: re.Match[str]) -> str:
+            raw_url = match.group("url")
+            if raw_url.startswith(("{", "*")):
+                return match.group(0)
+            try:
+                rewritten = rewrite_specifier(raw_url)
+            except ValueError:
+                return match.group(0)
+            return (
+                f"{match.group('prefix')}{match.group('quote')}"
+                f"{rewritten}{match.group('quote')}"
+            )
+
+        return _JS_SIDE_EFFECT_IMPORT_RE.sub(replace_side_effect, rewritten_js)
+
+    @staticmethod
+    async def read_plugin_page_text(file_path: Path) -> str:
+        async with aiofiles.open(file_path, encoding="utf-8") as file:
+            return await file.read()
+
+    @staticmethod
+    async def read_plugin_page_binary(file_path: Path) -> bytes:
+        async with aiofiles.open(file_path, mode="rb") as file:
+            return await file.read()
+
+    @staticmethod
+    def guess_plugin_page_mime_type(file_path: Path) -> str:
+        return mimetypes.guess_type(file_path.name)[0] or "application/octet-stream"
+
+    async def serialize_plugin_page(
+        self,
+        plugin: StarMetadata,
+        page_name: str,
+        *,
+        include_content_path: bool = False,
+        asset_token: str = "",
+    ) -> dict | None:
+        plugin_name = plugin.name.strip() if isinstance(plugin.name, str) else ""
+        if not plugin_name:
+            return None
+        try:
+            page = await self.get_plugin_page(plugin, page_name)
+            await self.resolve_plugin_page_file(plugin, page.name, "")
+        except (FileNotFoundError, ValueError):
+            return None
+
+        page_data = {
+            "name": page.name,
+            "title": page.title,
+            "i18n_key": f"pages.{page.name}",
+        }
+        if include_content_path:
+            extra_query_params = {"asset_token": asset_token} if asset_token else None
+            page_data["content_path"] = self.build_plugin_page_asset_url(
+                plugin_name,
+                page.name,
+                "",
+                extra_query_params=extra_query_params,
+            )
+        return page_data
+
+    async def serialize_plugin_pages(self, plugin: StarMetadata) -> list[dict]:
+        pages = []
+        for page in await self.discover_plugin_pages(plugin):
+            page_data = await self.serialize_plugin_page(plugin, page.name)
+            if page_data:
+                pages.append(page_data)
+        return pages
+
+    def issue_plugin_page_asset_token(
+        self,
+        *,
+        plugin_name: str,
+        page_name: str,
+        jwt_secret: str | None = None,
+        username: str | None,
+        locale: str,
+    ) -> str | None:
+        jwt_secret = jwt_secret or self._jwt_secret()
+        if not isinstance(jwt_secret, str) or not jwt_secret.strip():
+            return None
+        if not isinstance(username, str) or not username.strip():
+            return None
+
+        now = datetime.now(timezone.utc)
+        payload = {
+            "username": username,
+            "token_type": PLUGIN_PAGE_ASSET_TOKEN_TYPE,
+            "plugin_name": plugin_name,
+            "page_name": page_name,
+            "locale": locale,
+            "iat": now,
+            "exp": now + timedelta(seconds=PLUGIN_PAGE_ASSET_TOKEN_TTL_SECONDS),
+        }
+        return cast(str, jwt.encode(payload, jwt_secret, algorithm="HS256"))
+
+
+__all__ = [
+    "PLUGIN_PAGE_ASSET_TOKEN_TYPE",
+    "PLUGIN_PAGE_BRIDGE_FILE",
+    "PLUGIN_PAGE_ENTRY_FILE_NAME",
+    "PLUGIN_PAGE_ROOT_DIR_NAME",
+    "PluginPage",
+    "PluginPageContentPayload",
+    "PluginPageService",
+    "PluginPageServiceError",
+]
diff --git a/astrbot/dashboard/services/plugin_service.py b/astrbot/dashboard/services/plugin_service.py
new file mode 100644
index 000000000..0e4d12176
--- /dev/null
+++ b/astrbot/dashboard/services/plugin_service.py
@@ -0,0 +1,1207 @@
+from __future__ import annotations
+
+import asyncio
+import hashlib
+import json
+import os
+import ssl
+from collections.abc import Awaitable, Callable
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+
+import aiohttp
+import certifi
+
+from astrbot.api import sp
+from astrbot.core import DEMO_MODE, file_token_service, logger
+from astrbot.core.computer.computer_client import sync_skills_to_active_sandboxes
+from astrbot.core.skills.skill_manager import SkillManager
+from astrbot.core.star.filter.command import CommandFilter
+from astrbot.core.star.filter.command_group import CommandGroupFilter
+from astrbot.core.star.filter.permission import PermissionTypeFilter
+from astrbot.core.star.filter.regex import RegexFilter
+from astrbot.core.star.star import StarMetadata
+from astrbot.core.star.star_handler import EventType, star_handlers_registry
+from astrbot.core.star.star_manager import (
+    PluginManager,
+    PluginVersionUnsupportedError,
+)
+from astrbot.core.utils.astrbot_path import get_astrbot_data_path, get_astrbot_temp_path
+
+PLUGIN_UPDATE_CONCURRENCY = 3
+PLUGIN_OPERATION_FAILED_MESSAGE = "插件操作失败，请查看服务端日志。"
+PLUGIN_UPDATE_FAILED_MESSAGE = "更新失败，请查看服务端日志。"
+PLUGIN_COMPONENT_TYPE_ORDER = {
+    "page": 0,
+    "skill": 1,
+    "command": 2,
+    "llm_tool": 3,
+    "listener": 4,
+    "hook": 5,
+}
+
+LogoTokenResolver = Callable[[str], Awaitable[str | None]]
+InstalledAtResolver = Callable[[StarMetadata], str | None]
+PluginPagesResolver = Callable[[StarMetadata], Awaitable[list]]
+PluginPagesSerializer = Callable[[StarMetadata], Awaitable[list[dict]]]
+
+
+@dataclass
+class RegistrySource:
+    urls: list[str]
+    cache_file: str
+    md5_url: str | None
+
+
+class PluginServiceError(Exception):
+    def __init__(
+        self,
+        message: str,
+        *,
+        public_message: str | None = None,
+    ) -> None:
+        super().__init__(message)
+        self.public_message = public_message or message
+
+
+class PluginServiceWarning(Exception):
+    def __init__(
+        self,
+        message: str,
+        data: dict[str, Any],
+        *,
+        public_message: str | None = None,
+    ) -> None:
+        super().__init__(message)
+        self.public_message = public_message or message
+        self.data = data
+
+
+class PluginService:
+    def __init__(
+        self,
+        core_lifecycle,
+        plugin_manager: PluginManager,
+    ) -> None:
+        self.core_lifecycle = core_lifecycle
+        self.plugin_manager = plugin_manager
+        self.translated_event_type = {
+            EventType.AdapterMessageEvent: "平台消息下发时",
+            EventType.OnLLMRequestEvent: "LLM 请求时",
+            EventType.OnLLMResponseEvent: "LLM 响应后",
+            EventType.OnAgentBeginEvent: "Agent 开始运行时",
+            EventType.OnAgentDoneEvent: "Agent 运行完成后",
+            EventType.OnDecoratingResultEvent: "回复消息前",
+            EventType.OnCallingFuncToolEvent: "函数工具",
+            EventType.OnAfterMessageSentEvent: "发送消息后",
+            EventType.OnPluginErrorEvent: "插件报错时",
+        }
+        self._logo_cache: dict[str, str] = {}
+
+    @staticmethod
+    def _payload(data: object) -> dict[str, Any]:
+        return data if isinstance(data, dict) else {}
+
+    @staticmethod
+    def _ensure_not_demo() -> None:
+        if DEMO_MODE:
+            raise PluginServiceError(
+                "You are not permitted to do this operation in demo mode"
+            )
+
+    async def sync_skills_after_plugin_change(self) -> None:
+        try:
+            await sync_skills_to_active_sandboxes()
+        except Exception:
+            logger.warning("Failed to sync plugin-provided skills to active sandboxes.")
+
+    async def check_plugin_version_support(self, data: object) -> dict:
+        payload = self._payload(data)
+        version_spec = payload.get("astrbot_version", "")
+        is_valid, message = self.plugin_manager._validate_astrbot_version_specifier(
+            version_spec
+        )
+        return {
+            "supported": is_valid,
+            "message": message,
+            "astrbot_version": version_spec,
+        }
+
+    async def reload_failed_plugin(self, data: object) -> tuple[None, str]:
+        self._ensure_not_demo()
+        payload = data if isinstance(data, dict) else {}
+        dir_name = payload.get("dir_name")
+        if not dir_name:
+            raise PluginServiceError("缺少插件目录名")
+
+        success, err = await self.plugin_manager.reload_failed_plugin(dir_name)
+        if not success:
+            raise PluginServiceError(f"重载失败: {err}", public_message="重载失败")
+        await self.sync_skills_after_plugin_change()
+        return None, f"插件 {dir_name} 重载成功。"
+
+    async def reload_plugin(self, data: object) -> tuple[None, str]:
+        self._ensure_not_demo()
+        payload = data if isinstance(data, dict) else {}
+        plugin_name = payload.get("name", None)
+        success, message = await self.plugin_manager.reload(plugin_name)
+        if not success:
+            raise PluginServiceError(
+                message or "插件重载失败",
+                public_message="插件重载失败",
+            )
+        await self.sync_skills_after_plugin_change()
+        return None, "重载成功。"
+
+    async def list_plugins(
+        self,
+        *,
+        plugin_name: str | None,
+        logo_token_resolver: LogoTokenResolver,
+        installed_at_resolver: InstalledAtResolver,
+        discover_pages: PluginPagesResolver,
+    ) -> tuple[list[dict], str | None]:
+        plugins = [
+            plugin
+            for plugin in self.plugin_manager.context.get_all_stars()
+            if not (plugin_name and plugin.name != plugin_name)
+        ]
+
+        async def process_plugin(plugin: StarMetadata):
+            logo_url = await self.resolve_plugin_logo_url(plugin, logo_token_resolver)
+            pages = await discover_pages(plugin)
+            return plugin, logo_url, pages
+
+        results = await asyncio.gather(*(process_plugin(plugin) for plugin in plugins))
+        payload = []
+        for plugin, logo_url, pages in results:
+            if self.is_ghost_plugin(plugin):
+                continue
+            payload.append(
+                {
+                    **self.serialize_plugin_base(
+                        plugin,
+                        logo_url=logo_url,
+                        installed_at=installed_at_resolver(plugin),
+                    ),
+                    "pages": [page.name for page in pages],
+                }
+            )
+        return payload, getattr(self.plugin_manager, "failed_plugin_info", None)
+
+    async def list_plugins_from_dashboard_query(
+        self,
+        *,
+        plugin_name: str | None,
+        logo_token_resolver: LogoTokenResolver,
+        installed_at_resolver: InstalledAtResolver,
+        discover_pages: PluginPagesResolver,
+    ) -> tuple[list[dict], str | None]:
+        return await self.list_plugins(
+            plugin_name=plugin_name,
+            logo_token_resolver=logo_token_resolver,
+            installed_at_resolver=installed_at_resolver,
+            discover_pages=discover_pages,
+        )
+
+    async def get_plugin_detail(
+        self,
+        *,
+        plugin_name: str | None,
+        logo_token_resolver: LogoTokenResolver,
+        installed_at_resolver: InstalledAtResolver,
+        serialize_pages: PluginPagesSerializer,
+    ) -> dict:
+        if not plugin_name:
+            raise PluginServiceError("缺少插件名")
+
+        for plugin in self.plugin_manager.context.get_all_stars():
+            if plugin.name != plugin_name:
+                continue
+
+            logo_url = await self.resolve_plugin_logo_url(plugin, logo_token_resolver)
+            return {
+                **self.serialize_plugin_base(
+                    plugin,
+                    logo_url=logo_url,
+                    installed_at=installed_at_resolver(plugin),
+                ),
+                "components": await self.get_plugin_components_info(
+                    plugin,
+                    serialize_pages,
+                ),
+            }
+
+        raise PluginServiceError("插件不存在")
+
+    async def get_plugin_detail_from_dashboard_query(
+        self,
+        *,
+        plugin_name: str | None,
+        logo_token_resolver: LogoTokenResolver,
+        installed_at_resolver: InstalledAtResolver,
+        serialize_pages: PluginPagesSerializer,
+    ) -> dict:
+        return await self.get_plugin_detail(
+            plugin_name=plugin_name,
+            logo_token_resolver=logo_token_resolver,
+            installed_at_resolver=installed_at_resolver,
+            serialize_pages=serialize_pages,
+        )
+
+    async def resolve_plugin_logo_url(
+        self,
+        plugin: StarMetadata,
+        logo_token_resolver: LogoTokenResolver,
+    ) -> str | None:
+        if not plugin.logo_path:
+            return None
+        logo_token = await logo_token_resolver(plugin.logo_path)
+        return f"/api/file/{logo_token}" if logo_token else None
+
+    async def get_plugin_logo_token(self, logo_path: str) -> str | None:
+        try:
+            if token := self._logo_cache.get(logo_path):
+                if not await file_token_service.check_token_expired(token):
+                    return token
+            token = await file_token_service.register_file(logo_path, timeout=300)
+            self._logo_cache[logo_path] = token
+            return token
+        except Exception as exc:
+            logger.warning(f"获取插件 Logo 失败: {exc}")
+            return None
+
+    def resolve_plugin_metadata_dir(self, plugin: StarMetadata) -> Path | None:
+        if not plugin.root_dir_name:
+            return None
+
+        base_dir = Path(
+            self.plugin_manager.reserved_plugin_path
+            if plugin.reserved
+            else self.plugin_manager.plugin_store_path
+        )
+        plugin_dir = base_dir / plugin.root_dir_name
+        if not plugin_dir.is_dir():
+            return None
+        return plugin_dir
+
+    def get_plugin_installed_at(self, plugin: StarMetadata) -> str | None:
+        plugin_dir = self.resolve_plugin_metadata_dir(plugin)
+        if plugin_dir is None:
+            return None
+
+        try:
+            return datetime.fromtimestamp(
+                plugin_dir.stat().st_mtime,
+                timezone.utc,
+            ).isoformat()
+        except OSError as exc:
+            logger.warning(f"获取插件安装时间失败 {plugin.name}: {exc!s}")
+            return None
+
+    @staticmethod
+    def is_ghost_plugin(plugin: StarMetadata) -> bool:
+        return not any(
+            [
+                plugin.name,
+                plugin.author,
+                plugin.desc,
+                plugin.version,
+                plugin.display_name,
+            ]
+        )
+
+    @staticmethod
+    def serialize_plugin_base(
+        plugin: StarMetadata,
+        *,
+        logo_url: str | None,
+        installed_at: str | None,
+    ) -> dict:
+        return {
+            "name": plugin.name,
+            "marketplace_name": (plugin.name or "").replace("_", "-"),
+            "repo": "" if plugin.repo is None else str(plugin.repo),
+            "author": plugin.author,
+            "desc": plugin.desc,
+            "version": plugin.version,
+            "reserved": plugin.reserved,
+            "activated": plugin.activated,
+            "online_vesion": "",
+            "display_name": plugin.display_name,
+            "logo": logo_url,
+            "support_platforms": plugin.support_platforms,
+            "astrbot_version": plugin.astrbot_version,
+            "installed_at": installed_at,
+            "i18n": plugin.i18n,
+        }
+
+    def get_failed_plugins(self) -> dict:
+        return self.plugin_manager.failed_plugin_dict
+
+    async def get_plugin_components_info(
+        self,
+        plugin: StarMetadata,
+        serialize_pages: PluginPagesSerializer,
+    ) -> list[dict]:
+        components = [
+            *await self.get_plugin_page_components(plugin, serialize_pages),
+            *self.get_plugin_skill_components(plugin),
+            *await self.get_plugin_handler_components(plugin.star_handler_full_names),
+        ]
+        return sorted(
+            components,
+            key=lambda item: PLUGIN_COMPONENT_TYPE_ORDER.get(item["type"], 99),
+        )
+
+    async def get_plugin_page_components(
+        self,
+        plugin: StarMetadata,
+        serialize_pages: PluginPagesSerializer,
+    ) -> list[dict]:
+        pages = await serialize_pages(plugin)
+        return [
+            {
+                "type": "page",
+                "name": page["title"],
+                "title": page["title"],
+                "page_name": page["name"],
+                "i18n_key": page["i18n_key"],
+                "description": "Plugin Page entry",
+                "plugin_name": plugin.name,
+                "plugin_marketplace_name": (plugin.name or "").replace("_", "-"),
+            }
+            for page in pages
+        ]
+
+    async def get_plugin_handler_components(
+        self,
+        handler_full_names: list[str],
+    ) -> list[dict]:
+        components = []
+
+        for handler_full_name in handler_full_names:
+            info = {}
+            handler = star_handlers_registry.star_handlers_map.get(
+                handler_full_name,
+                None,
+            )
+            if handler is None:
+                continue
+            info["event_type"] = handler.event_type.name
+            info["event_type_h"] = self.translated_event_type.get(
+                handler.event_type,
+                handler.event_type.name,
+            )
+            info["handler_full_name"] = handler.handler_full_name
+            info["description"] = handler.desc or "无描述"
+            info["handler_name"] = handler.handler_name
+
+            component_type = "hook"
+            component: dict[str, Any] | None = None
+            if handler.event_type == EventType.AdapterMessageEvent:
+                has_admin = False
+                for event_filter in handler.event_filters:
+                    if isinstance(event_filter, CommandFilter):
+                        component_type = "command"
+                        info["display_type"] = "指令"
+                        info["cmd"] = self._get_command_filter_display_name(
+                            event_filter
+                        )
+                        component = self._build_command_filter_component(
+                            event_filter,
+                            handler.desc,
+                        )
+                    elif isinstance(event_filter, CommandGroupFilter):
+                        component_type = "command"
+                        info["display_type"] = "指令组"
+                        info["cmd"] = event_filter.get_complete_command_names()[
+                            0
+                        ].strip()
+                        component = self._build_command_group_component(
+                            event_filter,
+                            handler.desc,
+                        )
+                    elif isinstance(event_filter, RegexFilter):
+                        component_type = "command"
+                        info["display_type"] = "正则匹配"
+                        info["cmd"] = event_filter.regex_str
+                        component = {
+                            "type": "command",
+                            "name": event_filter.regex_str,
+                            "description": handler.desc or "无描述",
+                            "match": "regex",
+                        }
+                    elif isinstance(event_filter, PermissionTypeFilter):
+                        has_admin = True
+                info["has_admin"] = has_admin
+                if "cmd" not in info:
+                    info["cmd"] = "未知"
+                if "display_type" not in info:
+                    info["display_type"] = "事件监听器"
+                    component_type = "listener"
+            else:
+                info["cmd"] = "自动触发"
+                info["display_type"] = "无"
+                if handler.event_type == EventType.OnCallingFuncToolEvent:
+                    component_type = "llm_tool"
+
+            if component is None:
+                component = {
+                    "type": component_type,
+                    "name": handler.handler_name or handler.event_type.name,
+                    "description": handler.desc or "无描述",
+                }
+            else:
+                component["type"] = component_type
+
+            if component_type == "command":
+                component["event_type"] = info["event_type"]
+                component["event_type_h"] = info["event_type_h"]
+                component["handler_name"] = info["handler_name"]
+                component["has_admin"] = info.get("has_admin", False)
+                if "display_type" in info:
+                    component["display_type"] = info["display_type"]
+                if "cmd" in info:
+                    component["command"] = info["cmd"]
+            else:
+                component.update(info)
+            components.append(component)
+
+        return self._merge_command_components(components)
+
+    def get_plugin_skill_components(self, plugin: StarMetadata) -> list[dict]:
+        plugin_names = {
+            str(name)
+            for name in (plugin.root_dir_name, plugin.name)
+            if str(name or "").strip()
+        }
+        if not plugin_names:
+            return []
+
+        try:
+            skills = SkillManager().list_skills(
+                active_only=False,
+                runtime="local",
+                show_sandbox_path=False,
+            )
+        except Exception as exc:
+            logger.warning(f"获取插件 Skills 失败 {plugin.name}: {exc!s}")
+            return []
+
+        components = []
+        for skill in skills:
+            if skill.source_type != "plugin" or skill.plugin_name not in plugin_names:
+                continue
+            components.append(
+                {
+                    "type": "skill",
+                    "name": skill.name,
+                    "description": skill.description or "无描述",
+                    "path": skill.path,
+                }
+            )
+        return components
+
+    @staticmethod
+    def _get_command_filter_display_name(command_filter: CommandFilter) -> str:
+        return command_filter.get_complete_command_names()[0].strip()
+
+    @staticmethod
+    def _get_command_description(
+        command_filter: CommandFilter | CommandGroupFilter,
+        fallback: str = "",
+    ) -> str:
+        handler_md = getattr(command_filter, "handler_md", None)
+        desc = getattr(handler_md, "desc", "") if handler_md else ""
+        return desc or fallback or "无描述"
+
+    def _build_command_filter_component(
+        self,
+        command_filter: CommandFilter,
+        fallback_desc: str = "",
+    ) -> dict:
+        parts = self._get_command_filter_display_name(command_filter).split()
+        if not parts:
+            parts = [command_filter.command_name]
+        component: dict[str, Any] = {
+            "type": "command",
+            "name": parts[-1],
+            "description": self._get_command_description(
+                command_filter,
+                fallback_desc,
+            ),
+        }
+        return self._wrap_command_component(parts[:-1], component)
+
+    def _build_command_group_component(
+        self,
+        command_group_filter: CommandGroupFilter,
+        fallback_desc: str = "",
+    ) -> dict:
+        parts = command_group_filter.get_complete_command_names()[0].strip().split()
+        if not parts:
+            parts = [command_group_filter.group_name]
+        subcommands = [
+            self._build_command_group_child(sub_filter)
+            for sub_filter in command_group_filter.sub_command_filters
+        ]
+        component: dict[str, Any] = {
+            "type": "command",
+            "name": parts[-1],
+            "description": self._get_command_description(
+                command_group_filter,
+                fallback_desc,
+            ),
+        }
+        if subcommands:
+            component["subcommands"] = subcommands
+        return self._wrap_command_component(parts[:-1], component)
+
+    def _build_command_group_child(
+        self,
+        command_filter: CommandFilter | CommandGroupFilter,
+    ) -> dict:
+        if isinstance(command_filter, CommandGroupFilter):
+            component: dict[str, Any] = {
+                "name": command_filter.group_name,
+                "description": self._get_command_description(command_filter),
+            }
+            subcommands = [
+                self._build_command_group_child(sub_filter)
+                for sub_filter in command_filter.sub_command_filters
+            ]
+            if subcommands:
+                component["subcommands"] = subcommands
+            return component
+
+        return {
+            "name": command_filter.command_name,
+            "description": self._get_command_description(command_filter),
+        }
+
+    @staticmethod
+    def _wrap_command_component(parent_names: list[str], component: dict) -> dict:
+        for parent_name in reversed(parent_names):
+            component = {
+                "type": "command",
+                "name": parent_name,
+                "description": "无描述",
+                "subcommands": [component],
+            }
+        return component
+
+    def _merge_command_components(self, components: list[dict]) -> list[dict]:
+        merged: list[dict] = []
+        for component in components:
+            if component.get("type") != "command":
+                merged.append(component)
+                continue
+            existing = next(
+                (
+                    item
+                    for item in merged
+                    if item.get("type") == "command"
+                    and item.get("name") == component.get("name")
+                    and item.get("match") == component.get("match")
+                ),
+                None,
+            )
+            if existing is None:
+                merged.append(component)
+                continue
+            self._merge_command_component(existing, component)
+        return merged
+
+    def _merge_command_component(self, target: dict, source: dict) -> None:
+        if target.get("description") == "无描述" and source.get("description"):
+            target["description"] = source["description"]
+        for key, value in source.items():
+            if key in {"subcommands", "description"}:
+                continue
+            target.setdefault(key, value)
+
+        source_subcommands = source.get("subcommands")
+        if not isinstance(source_subcommands, list):
+            return
+        target_subcommands = target.setdefault("subcommands", [])
+        for source_subcommand in source_subcommands:
+            if not isinstance(source_subcommand, dict):
+                continue
+            existing = next(
+                (
+                    item
+                    for item in target_subcommands
+                    if isinstance(item, dict)
+                    and item.get("name") == source_subcommand.get("name")
+                ),
+                None,
+            )
+            if existing is None:
+                target_subcommands.append(source_subcommand)
+                continue
+            self._merge_command_component(existing, source_subcommand)
+
+    async def get_online_plugins(
+        self,
+        *,
+        custom_registry: str | None,
+        force_refresh: bool,
+    ) -> tuple[Any, str | None]:
+        source = self.build_registry_source(custom_registry)
+
+        cached_data = None
+        if not force_refresh and await self.is_cache_valid(source):
+            cached_data = self.load_plugin_cache(source.cache_file)
+            if cached_data:
+                logger.debug("缓存MD5匹配，使用缓存的插件市场数据")
+                return cached_data, None
+
+        remote_data = None
+        ssl_context = ssl.create_default_context(cafile=certifi.where())
+        connector = aiohttp.TCPConnector(ssl=ssl_context)
+
+        for url in source.urls:
+            try:
+                async with (
+                    aiohttp.ClientSession(
+                        trust_env=True,
+                        connector=connector,
+                    ) as session,
+                    session.get(url) as response,
+                ):
+                    if response.status == 200:
+                        try:
+                            remote_data = await response.json()
+                        except aiohttp.ContentTypeError:
+                            remote_text = await response.text()
+                            remote_data = json.loads(remote_text)
+
+                        if not remote_data or (
+                            isinstance(remote_data, dict) and len(remote_data) == 0
+                        ):
+                            logger.warning(f"远程插件市场数据为空: {url}")
+                            continue
+
+                        logger.info(
+                            f"成功获取远程插件市场数据，包含 {len(remote_data)} 个插件"
+                        )
+                        current_md5 = await self.fetch_remote_md5(source.md5_url)
+                        self.save_plugin_cache(
+                            source.cache_file,
+                            remote_data,
+                            current_md5,
+                        )
+                        return remote_data, None
+                    logger.error(f"请求 {url} 失败，状态码：{response.status}")
+            except Exception as exc:
+                logger.error(f"请求 {url} 失败，错误：{exc}")
+
+        if not cached_data:
+            cached_data = self.load_plugin_cache(source.cache_file)
+
+        if cached_data:
+            logger.warning("远程插件市场数据获取失败，使用缓存数据")
+            return cached_data, "使用缓存数据，可能不是最新版本"
+
+        raise PluginServiceError("获取插件列表失败，且没有可用的缓存数据")
+
+    async def get_online_plugins_from_dashboard_query(
+        self,
+        *,
+        custom_registry: str | None,
+        force_refresh,
+    ) -> tuple[Any, str | None]:
+        return await self.get_online_plugins(
+            custom_registry=custom_registry,
+            force_refresh=self._to_bool(force_refresh),
+        )
+
+    @staticmethod
+    def build_registry_source(custom_url: str | None) -> RegistrySource:
+        data_dir = get_astrbot_data_path()
+        if custom_url:
+            url_hash = hashlib.md5(custom_url.encode()).hexdigest()[:8]
+            cache_file = os.path.join(data_dir, f"plugins_custom_{url_hash}.json")
+            md5_url = (
+                custom_url[:-5] + "-md5.json"
+                if custom_url.endswith(".json")
+                else custom_url + "-md5.json"
+            )
+            urls = [custom_url]
+        else:
+            cache_file = os.path.join(data_dir, "plugins.json")
+            md5_url = "https://api.soulter.top/astrbot/plugins-md5"
+            urls = [
+                "https://api.soulter.top/astrbot/plugins",
+                "https://github.com/AstrBotDevs/AstrBot_Plugins_Collection/raw/refs/heads/main/plugin_cache_original.json",
+            ]
+        return RegistrySource(urls=urls, cache_file=cache_file, md5_url=md5_url)
+
+    @staticmethod
+    def load_cached_md5(cache_file: str) -> str | None:
+        if not os.path.exists(cache_file):
+            return None
+
+        try:
+            with open(cache_file, encoding="utf-8") as file:
+                cache_data = json.load(file)
+            return cache_data.get("md5")
+        except Exception as exc:
+            logger.warning(f"Failed to load cached MD5: {exc}")
+            return None
+
+    @staticmethod
+    async def fetch_remote_md5(md5_url: str | None) -> str | None:
+        if not md5_url:
+            return None
+
+        try:
+            ssl_context = ssl.create_default_context(cafile=certifi.where())
+            connector = aiohttp.TCPConnector(ssl=ssl_context)
+
+            async with (
+                aiohttp.ClientSession(
+                    trust_env=True,
+                    connector=connector,
+                ) as session,
+                session.get(md5_url) as response,
+            ):
+                if response.status == 200:
+                    data = await response.json()
+                    return data.get("md5", "")
+        except Exception as exc:
+            logger.debug(f"Failed to fetch remote MD5: {exc}")
+        return None
+
+    async def is_cache_valid(self, source: RegistrySource) -> bool:
+        try:
+            cached_md5 = self.load_cached_md5(source.cache_file)
+            if not cached_md5:
+                logger.debug("MD5 not found in cache, treating cache as invalid")
+                return False
+
+            remote_md5 = await self.fetch_remote_md5(source.md5_url)
+            if remote_md5 is None:
+                logger.warning(
+                    "Cannot fetch remote MD5, using cache without validation"
+                )
+                return True
+
+            is_valid = cached_md5 == remote_md5
+            logger.debug(
+                f"Plugin cache: local={cached_md5}, remote={remote_md5}, effective={is_valid}",
+            )
+            return is_valid
+
+        except Exception as exc:
+            logger.warning(f"检查缓存有效性失败: {exc}")
+            return False
+
+    @staticmethod
+    def load_plugin_cache(cache_file: str):
+        try:
+            if os.path.exists(cache_file):
+                with open(cache_file, encoding="utf-8") as file:
+                    cache_data = json.load(file)
+                    if "data" in cache_data and "timestamp" in cache_data:
+                        logger.debug(
+                            f"Loading cached file: {cache_file}, Cache time: {cache_data['timestamp']}",
+                        )
+                        return cache_data["data"]
+        except Exception as exc:
+            logger.warning(f"Failed to load plugin market cache: {exc}")
+        return None
+
+    @staticmethod
+    def save_plugin_cache(cache_file: str, data, md5: str | None = None) -> None:
+        try:
+            os.makedirs(os.path.dirname(cache_file), exist_ok=True)
+
+            cache_data = {
+                "timestamp": datetime.now().isoformat(),
+                "data": data,
+                "md5": md5 or "",
+            }
+
+            with open(cache_file, "w", encoding="utf-8") as file:
+                json.dump(cache_data, file, ensure_ascii=False, indent=2)
+            logger.debug(f"Cached plugin market data: {cache_file}, MD5: {md5}")
+        except Exception as exc:
+            logger.warning(f"Failed to save plugin market cache: {exc}")
+
+    async def install_plugin(self, data: object) -> tuple[dict, str]:
+        self._ensure_not_demo()
+        payload = data if isinstance(data, dict) else {}
+        repo_url = payload["url"]
+        download_url = str(payload.get("download_url") or "").strip()
+        ignore_version_check = bool(payload.get("ignore_version_check", False))
+
+        proxy: str | None = payload.get("proxy", None)
+        if proxy:
+            proxy = proxy.removesuffix("/")
+
+        try:
+            logger.info(f"正在安装插件 {repo_url}")
+            plugin_info = await self.plugin_manager.install_plugin(
+                repo_url,
+                proxy or "",
+                ignore_version_check=ignore_version_check,
+                download_url=download_url,
+            )
+            await self.sync_skills_after_plugin_change()
+            logger.info(f"安装插件 {repo_url} 成功。")
+            return plugin_info or {}, "安装成功。"
+        except PluginVersionUnsupportedError as exc:
+            raise PluginServiceWarning(
+                str(exc),
+                {
+                    "warning_type": "astrbot_version_unsupported",
+                    "can_ignore": True,
+                },
+                public_message="当前 AstrBot 版本不满足插件要求",
+            ) from exc
+
+    async def install_plugin_upload(
+        self,
+        *,
+        upload_file,
+        ignore_version_check: bool,
+    ) -> tuple[dict, str]:
+        self._ensure_not_demo()
+        logger.info(f"正在安装用户上传的插件 {upload_file.filename}")
+        file_path = os.path.join(
+            get_astrbot_temp_path(),
+            f"plugin_upload_{upload_file.filename}",
+        )
+        await upload_file.save(file_path)
+        try:
+            plugin_info = await self.plugin_manager.install_plugin_from_file(
+                file_path,
+                ignore_version_check=ignore_version_check,
+            )
+            await self.sync_skills_after_plugin_change()
+            logger.info(f"安装插件 {upload_file.filename} 成功")
+            return plugin_info or {}, "安装成功。"
+        except PluginVersionUnsupportedError as exc:
+            raise PluginServiceWarning(
+                str(exc),
+                {
+                    "warning_type": "astrbot_version_unsupported",
+                    "can_ignore": True,
+                },
+                public_message="当前 AstrBot 版本不满足插件要求",
+            ) from exc
+
+    async def install_plugin_upload_from_dashboard_form(
+        self,
+        *,
+        upload_file,
+        ignore_version_check,
+    ) -> tuple[dict, str]:
+        return await self.install_plugin_upload(
+            upload_file=upload_file,
+            ignore_version_check=self._to_bool(ignore_version_check),
+        )
+
+    async def uninstall_plugin(self, data: object) -> tuple[None, str]:
+        self._ensure_not_demo()
+        payload = data if isinstance(data, dict) else {}
+        plugin_name = payload["name"]
+        delete_config = payload.get("delete_config", False)
+        delete_data = payload.get("delete_data", False)
+        logger.info(f"正在卸载插件 {plugin_name}")
+        await self.plugin_manager.uninstall_plugin(
+            plugin_name,
+            delete_config=delete_config,
+            delete_data=delete_data,
+        )
+        await self.sync_skills_after_plugin_change()
+        logger.info(f"卸载插件 {plugin_name} 成功")
+        return None, "卸载成功"
+
+    async def uninstall_failed_plugin(self, data: object) -> tuple[None, str]:
+        self._ensure_not_demo()
+        payload = data if isinstance(data, dict) else {}
+        dir_name = payload.get("dir_name", "")
+        delete_config = payload.get("delete_config", False)
+        delete_data = payload.get("delete_data", False)
+        if not dir_name:
+            raise PluginServiceError("缺少失败插件目录名")
+
+        logger.info(f"正在卸载失败插件 {dir_name}")
+        await self.plugin_manager.uninstall_failed_plugin(
+            dir_name,
+            delete_config=delete_config,
+            delete_data=delete_data,
+        )
+        await self.sync_skills_after_plugin_change()
+        logger.info(f"卸载失败插件 {dir_name} 成功")
+        return None, "卸载成功"
+
+    async def update_plugin(self, data: object) -> tuple[None, str]:
+        self._ensure_not_demo()
+        payload = data if isinstance(data, dict) else {}
+        plugin_name = payload["name"]
+        proxy: str | None = payload.get("proxy", None)
+        download_url = str(payload.get("download_url") or "").strip()
+        logger.info(f"正在更新插件 {plugin_name}")
+        await self.plugin_manager.update_plugin(
+            plugin_name, proxy or "", download_url=download_url
+        )
+        await self.plugin_manager.reload(plugin_name)
+        await self.sync_skills_after_plugin_change()
+        logger.info(f"更新插件 {plugin_name} 成功。")
+        return None, "更新成功。"
+
+    async def update_all_plugins(self, data: object) -> tuple[dict, str]:
+        self._ensure_not_demo()
+        payload = data if isinstance(data, dict) else {}
+        plugin_names: list[str] = payload.get("names") or []
+        proxy: str = payload.get("proxy", "")
+        download_urls: dict[str, str] = payload.get("download_urls") or {}
+
+        if not isinstance(plugin_names, list) or not plugin_names:
+            raise PluginServiceError("插件列表不能为空")
+        if not isinstance(download_urls, dict):
+            download_urls = {}
+
+        results = []
+        sem = asyncio.Semaphore(PLUGIN_UPDATE_CONCURRENCY)
+
+        async def _update_one(name: str):
+            async with sem:
+                try:
+                    logger.info(f"批量更新插件 {name}")
+                    download_url = str(download_urls.get(name) or "").strip()
+                    await self.plugin_manager.update_plugin(
+                        name, proxy, download_url=download_url
+                    )
+                    return {"name": name, "status": "ok", "message": "更新成功"}
+                except Exception:
+                    logger.error(
+                        f"/api/plugin/update-all: 更新插件 {name} 失败",
+                        exc_info=True,
+                    )
+                    return {
+                        "name": name,
+                        "status": "error",
+                        "message": PLUGIN_UPDATE_FAILED_MESSAGE,
+                    }
+
+        raw_results = await asyncio.gather(
+            *(_update_one(name) for name in plugin_names),
+            return_exceptions=True,
+        )
+        for name, result in zip(plugin_names, raw_results):
+            if isinstance(result, asyncio.CancelledError):
+                raise result
+            if isinstance(result, BaseException):
+                logger.error(
+                    f"/api/plugin/update-all: 更新插件 {name} 任务失败: {result!r}"
+                )
+                results.append(
+                    {
+                        "name": name,
+                        "status": "error",
+                        "message": PLUGIN_UPDATE_FAILED_MESSAGE,
+                    }
+                )
+            else:
+                results.append(result)
+
+        failed = [result for result in results if result["status"] == "error"]
+        if len(failed) < len(results):
+            await self.sync_skills_after_plugin_change()
+        message = (
+            "批量更新完成，全部成功。"
+            if not failed
+            else f"批量更新完成，其中 {len(failed)}/{len(results)} 个插件失败。"
+        )
+
+        return {"results": results}, message
+
+    async def set_plugin_enabled(
+        self, data: object, *, enabled: bool
+    ) -> tuple[None, str]:
+        self._ensure_not_demo()
+        payload = data if isinstance(data, dict) else {}
+        plugin_name = payload["name"]
+        if enabled:
+            await self.plugin_manager.turn_on_plugin(plugin_name)
+            message = "启用成功。"
+            log_action = "启用"
+        else:
+            await self.plugin_manager.turn_off_plugin(plugin_name)
+            message = "停用成功。"
+            log_action = "停用"
+        await self.sync_skills_after_plugin_change()
+        logger.info(f"{log_action}插件 {plugin_name} 。")
+        return None, message
+
+    def resolve_plugin_dir(self, plugin_name: str) -> Path:
+        if not plugin_name:
+            raise PluginServiceError("插件名称不能为空")
+
+        plugin_obj = None
+        for plugin in self.plugin_manager.context.get_all_stars():
+            if plugin.name == plugin_name:
+                plugin_obj = plugin
+                break
+
+        if not plugin_obj:
+            raise PluginServiceError(f"插件 {plugin_name} 不存在")
+        if not plugin_obj.root_dir_name:
+            raise PluginServiceError(f"插件 {plugin_name} 目录不存在")
+
+        plugin_dir = (
+            Path(
+                self.plugin_manager.reserved_plugin_path
+                if plugin_obj.reserved
+                else self.plugin_manager.plugin_store_path
+            )
+            / plugin_obj.root_dir_name
+        )
+        if not plugin_dir.is_dir():
+            raise PluginServiceError(f"无法找到插件 {plugin_name} 的目录")
+        return plugin_dir
+
+    def get_plugin_readme(self, plugin_name: str | None) -> tuple[dict, str]:
+        if not plugin_name:
+            logger.warning("插件名称为空")
+            raise PluginServiceError("插件名称不能为空")
+
+        plugin_dir = self.resolve_plugin_dir(plugin_name)
+        readme_path = plugin_dir / "README.md"
+
+        if not readme_path.is_file():
+            logger.warning(f"插件 {plugin_name} 没有README文件")
+            raise PluginServiceError(f"插件 {plugin_name} 没有README文件")
+
+        try:
+            return {
+                "content": readme_path.read_text(encoding="utf-8")
+            }, "成功获取README内容"
+        except Exception as exc:
+            logger.warning(f"读取插件 {plugin_name} README 文件失败: {exc}")
+            raise PluginServiceError(
+                "读取README文件失败",
+                public_message="读取README文件失败",
+            ) from exc
+
+    def get_plugin_readme_from_dashboard_query(
+        self,
+        plugin_name: str | None,
+    ) -> tuple[dict, str]:
+        return self.get_plugin_readme(plugin_name)
+
+    def get_plugin_changelog(self, plugin_name: str | None) -> tuple[dict, str]:
+        logger.debug(f"正在获取插件 {plugin_name} 的更新日志")
+        if not plugin_name:
+            logger.warning("插件名称为空")
+            raise PluginServiceError("插件名称不能为空")
+
+        plugin_dir = self.resolve_plugin_dir(plugin_name)
+        changelog_names = ["CHANGELOG.md", "changelog.md", "CHANGELOG", "changelog"]
+        for name in changelog_names:
+            changelog_path = plugin_dir / name
+            if not changelog_path.is_file():
+                continue
+            try:
+                return (
+                    {"content": changelog_path.read_text(encoding="utf-8")},
+                    "成功获取更新日志",
+                )
+            except Exception as exc:
+                logger.warning(f"读取插件 {plugin_name} 更新日志失败: {exc}")
+                raise PluginServiceError(
+                    "读取更新日志失败",
+                    public_message="读取更新日志失败",
+                ) from exc
+
+        logger.warning(f"插件 {plugin_name} 没有更新日志文件")
+        return {"content": None}, "该插件没有更新日志文件"
+
+    def get_plugin_changelog_from_dashboard_query(
+        self,
+        plugin_name: str | None,
+    ) -> tuple[dict, str]:
+        return self.get_plugin_changelog(plugin_name)
+
+    @staticmethod
+    async def get_custom_sources() -> list:
+        return PluginService._normalize_custom_sources(
+            await sp.global_get("custom_plugin_sources", [])
+        )
+
+    @staticmethod
+    async def save_custom_sources(data: object) -> tuple[None, str]:
+        payload = data if isinstance(data, dict) else {}
+        sources = PluginService._custom_sources_from_payload(payload)
+        await sp.global_put("custom_plugin_sources", sources)
+        return None, "保存成功"
+
+    @staticmethod
+    def _normalize_custom_sources(raw_sources: object) -> list:
+        return raw_sources if isinstance(raw_sources, list) else []
+
+    @staticmethod
+    def _custom_sources_from_payload(payload: dict[str, Any]) -> list:
+        sources = payload.get("sources", [])
+        if not isinstance(sources, list):
+            raise PluginServiceError("sources fields must be a list")
+        return sources
+
+    @staticmethod
+    async def create_custom_source(data: object) -> list:
+        source = data if isinstance(data, dict) else {}
+        sources = await PluginService.get_custom_sources()
+        sources.append(source)
+        await sp.global_put("custom_plugin_sources", sources)
+        return sources
+
+    @staticmethod
+    async def replace_custom_sources(data: object) -> list:
+        payload = data if isinstance(data, dict) else {}
+        sources = PluginService._custom_sources_from_payload(payload)
+        await sp.global_put("custom_plugin_sources", sources)
+        return sources
+
+    @staticmethod
+    async def delete_custom_source(source_id: str) -> list:
+        sources = await PluginService.get_custom_sources()
+        filtered = [
+            source
+            for source in sources
+            if not (
+                isinstance(source, dict)
+                and str(source.get("id") or source.get("url") or source.get("name"))
+                == source_id
+            )
+            and not (isinstance(source, str) and source == source_id)
+        ]
+        await sp.global_put("custom_plugin_sources", filtered)
+        return filtered
+
+    @staticmethod
+    def _to_bool(value: object, default: bool = False) -> bool:
+        if value is None:
+            return default
+        if isinstance(value, bool):
+            return value
+        if isinstance(value, str):
+            return value.strip().lower() in {"1", "true", "yes", "on"}
+        return bool(value)
+
+
+__all__ = [
+    "PLUGIN_UPDATE_CONCURRENCY",
+    "PLUGIN_OPERATION_FAILED_MESSAGE",
+    "PLUGIN_UPDATE_FAILED_MESSAGE",
+    "PluginService",
+    "PluginServiceError",
+    "PluginServiceWarning",
+    "RegistrySource",
+]
diff --git a/astrbot/dashboard/services/session_management_service.py b/astrbot/dashboard/services/session_management_service.py
new file mode 100644
index 000000000..a66f4e8e9
--- /dev/null
+++ b/astrbot/dashboard/services/session_management_service.py
@@ -0,0 +1,678 @@
+from __future__ import annotations
+
+import uuid
+from typing import Any
+
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlmodel import col, select
+
+from astrbot.core import logger, sp
+from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
+from astrbot.core.db import BaseDatabase
+from astrbot.core.db.po import ConversationV2, Preference
+from astrbot.core.provider.entities import ProviderType
+from astrbot.core.umo_alias import build_umo_alias_map, parse_umo, serialize_umo_alias
+
+AVAILABLE_SESSION_RULE_KEYS = [
+    "session_service_config",
+    "session_plugin_config",
+    "kb_config",
+    f"provider_perf_{ProviderType.CHAT_COMPLETION.value}",
+    f"provider_perf_{ProviderType.SPEECH_TO_TEXT.value}",
+    f"provider_perf_{ProviderType.TEXT_TO_SPEECH.value}",
+]
+
+
+class SessionManagementServiceError(Exception):
+    pass
+
+
+class SessionManagementService:
+    def __init__(
+        self,
+        core_lifecycle: AstrBotCoreLifecycle,
+        db_helper: BaseDatabase,
+    ) -> None:
+        self.core_lifecycle = core_lifecycle
+        self.db_helper = db_helper
+
+    @staticmethod
+    def _payload(data: object) -> dict[str, Any]:
+        return data if isinstance(data, dict) else {}
+
+    @staticmethod
+    def _is_group_umo(umo: str) -> bool:
+        umo_lower = umo.lower()
+        return ":group:" in umo_lower or ":groupmessage:" in umo_lower
+
+    @staticmethod
+    def _is_private_umo(umo: str) -> bool:
+        umo_lower = umo.lower()
+        return (
+            ":private:" in umo_lower
+            or ":friend:" in umo_lower
+            or ":friendmessage:" in umo_lower
+        )
+
+    async def list_known_umos(self) -> list[str]:
+        async with self.db_helper.get_db() as session:
+            session: AsyncSession
+            result = await session.execute(select(ConversationV2.user_id).distinct())
+            umos = {str(row[0]) for row in result.fetchall() if row[0]}
+
+        aliases = await self.db_helper.get_umo_aliases()
+        umos.update(str(alias.umo) for alias in aliases if alias.umo)
+        return sorted(umos)
+
+    async def get_umo_alias_map(self, umos: list[str]) -> dict:
+        return build_umo_alias_map(await self.db_helper.get_umo_aliases(umos))
+
+    def build_umo_info(self, umo: str | None, alias_map: dict) -> dict:
+        umo_str = umo or ""
+        return {
+            "umo": umo_str,
+            **parse_umo(umo_str),
+            **serialize_umo_alias(alias_map.get(umo_str), umo_str),
+        }
+
+    async def list_active_umos(self) -> dict:
+        umos = await self.list_known_umos()
+        alias_map = await self.get_umo_alias_map(umos)
+        return {
+            "umos": umos,
+            "umo_infos": [self.build_umo_info(umo, alias_map) for umo in umos],
+        }
+
+    async def get_umos_by_scope(
+        self,
+        scope: str,
+        group_id: str = "",
+    ) -> list[str]:
+        if scope == "custom_group":
+            if not group_id:
+                raise SessionManagementServiceError("请指定分组 ID")
+            groups = self.get_groups()
+            if group_id not in groups:
+                raise SessionManagementServiceError(f"分组 '{group_id}' 不存在")
+            return groups[group_id].get("umos", [])
+
+        all_umos = await self.list_known_umos()
+        if scope == "group":
+            return [umo for umo in all_umos if self._is_group_umo(umo)]
+        if scope == "private":
+            return [umo for umo in all_umos if self._is_private_umo(umo)]
+        if scope == "all":
+            return all_umos
+        return []
+
+    async def get_umo_rules(
+        self,
+        page: int = 1,
+        page_size: int = 10,
+        search: str = "",
+    ) -> tuple[dict, int]:
+        umo_rules = {}
+        async with self.db_helper.get_db() as session:
+            session: AsyncSession
+            result = await session.execute(
+                select(Preference).where(
+                    col(Preference.scope) == "umo",
+                    col(Preference.key).in_(AVAILABLE_SESSION_RULE_KEYS),
+                )
+            )
+            prefs = result.scalars().all()
+            for pref in prefs:
+                umo_id = pref.scope_id
+                if umo_id not in umo_rules:
+                    umo_rules[umo_id] = {}
+                if pref.key == "session_plugin_config" and umo_id in pref.value["val"]:
+                    umo_rules[umo_id][pref.key] = pref.value["val"][umo_id]
+                else:
+                    umo_rules[umo_id][pref.key] = pref.value["val"]
+
+        alias_map = await self.get_umo_alias_map(list(umo_rules.keys()))
+
+        if search:
+            search_lower = search.lower()
+            filtered_rules = {}
+            for umo_id, rules in umo_rules.items():
+                if search_lower in umo_id.lower():
+                    filtered_rules[umo_id] = rules
+                    continue
+
+                svc_config = rules.get("session_service_config", {})
+                custom_name = svc_config.get("custom_name", "") if svc_config else ""
+                if custom_name and search_lower in custom_name.lower():
+                    filtered_rules[umo_id] = rules
+                    continue
+
+                alias_info = serialize_umo_alias(alias_map.get(umo_id), umo_id)
+                if any(
+                    search_lower in alias_info[key].lower()
+                    for key in ("auto_name", "user_alias", "display_name")
+                    if alias_info.get(key)
+                ):
+                    filtered_rules[umo_id] = rules
+            umo_rules = filtered_rules
+
+        total = len(umo_rules)
+        all_umo_ids = list(umo_rules.keys())
+        start_idx = (page - 1) * page_size
+        end_idx = start_idx + page_size
+        paginated_umo_ids = all_umo_ids[start_idx:end_idx]
+
+        return {umo_id: umo_rules[umo_id] for umo_id in paginated_umo_ids}, total
+
+    async def list_session_rules(
+        self,
+        *,
+        page: int,
+        page_size: int,
+        search: str,
+    ) -> dict:
+        page, page_size = self._normalize_page(page, page_size, default_page_size=10)
+        umo_rules, total = await self.get_umo_rules(
+            page=page,
+            page_size=page_size,
+            search=search,
+        )
+
+        alias_map = await self.get_umo_alias_map(list(umo_rules.keys()))
+        rules_list = [
+            {
+                "rules": rules,
+                **self.build_umo_info(umo, alias_map),
+            }
+            for umo, rules in umo_rules.items()
+        ]
+
+        provider_manager = self.core_lifecycle.provider_manager
+        persona_mgr = getattr(self.core_lifecycle, "persona_mgr", None)
+        plugin_manager = getattr(self.core_lifecycle, "plugin_manager", None)
+        kb_manager = getattr(self.core_lifecycle, "kb_manager", None)
+
+        available_personas = [
+            {"name": p["name"], "prompt": p.get("prompt", "")}
+            for p in getattr(persona_mgr, "personas_v3", [])
+        ]
+        available_plugins = []
+        if plugin_manager and getattr(plugin_manager, "context", None):
+            available_plugins = [
+                {
+                    "name": p.name,
+                    "display_name": p.display_name or p.name,
+                    "desc": p.desc,
+                }
+                for p in plugin_manager.context.get_all_stars()
+                if not p.reserved and p.name
+            ]
+
+        available_kbs = []
+        if kb_manager:
+            try:
+                kbs = await kb_manager.list_kbs()
+                available_kbs = [
+                    {
+                        "kb_id": kb.kb_id,
+                        "kb_name": kb.kb_name,
+                        "emoji": kb.emoji,
+                    }
+                    for kb in kbs
+                ]
+            except Exception as exc:
+                logger.warning(f"获取知识库列表失败: {exc!s}")
+
+        return {
+            "rules": rules_list,
+            "total": total,
+            "page": page,
+            "page_size": page_size,
+            "available_personas": available_personas,
+            "available_chat_providers": self._serialize_provider_insts(
+                getattr(provider_manager, "provider_insts", [])
+            ),
+            "available_stt_providers": self._serialize_provider_insts(
+                getattr(provider_manager, "stt_provider_insts", [])
+            ),
+            "available_tts_providers": self._serialize_provider_insts(
+                getattr(provider_manager, "tts_provider_insts", [])
+            ),
+            "available_plugins": available_plugins,
+            "available_kbs": available_kbs,
+            "available_rule_keys": AVAILABLE_SESSION_RULE_KEYS,
+        }
+
+    async def update_session_rule(self, data: object) -> dict:
+        payload = self._payload(data)
+        umo = payload.get("umo")
+        rule_key = payload.get("rule_key")
+        rule_value = payload.get("rule_value")
+
+        if not umo:
+            raise SessionManagementServiceError("缺少必要参数: umo")
+        if not rule_key:
+            raise SessionManagementServiceError("缺少必要参数: rule_key")
+        if rule_key not in AVAILABLE_SESSION_RULE_KEYS:
+            raise SessionManagementServiceError(f"不支持的规则键: {rule_key}")
+
+        if rule_key == "session_plugin_config":
+            rule_value = {umo: rule_value}
+
+        await sp.session_put(umo, rule_key, rule_value)
+        return {"message": f"规则 {rule_key} 已更新", "umo": umo}
+
+    async def delete_session_rule(self, data: object) -> dict:
+        payload = self._payload(data)
+        umo = payload.get("umo")
+        rule_key = payload.get("rule_key")
+
+        if not umo:
+            raise SessionManagementServiceError("缺少必要参数: umo")
+
+        if rule_key:
+            if rule_key not in AVAILABLE_SESSION_RULE_KEYS:
+                raise SessionManagementServiceError(f"不支持的规则键: {rule_key}")
+            await sp.session_remove(umo, rule_key)
+            return {"message": f"规则 {rule_key} 已删除", "umo": umo}
+
+        await sp.clear_async("umo", umo)
+        return {"message": "所有规则已删除", "umo": umo}
+
+    async def delete_session_rules(self, data: object) -> dict:
+        payload = self._payload(data)
+        if payload.get("umo") and not payload.get("umos") and not payload.get("scope"):
+            return await self.delete_session_rule(payload)
+        return await self.batch_delete_session_rule(payload)
+
+    async def batch_delete_session_rule(self, data: object) -> dict:
+        payload = self._payload(data)
+        umos = payload.get("umos", [])
+        scope = payload.get("scope", "")
+        group_id = payload.get("group_id", "")
+        rule_key = payload.get("rule_key")
+
+        if scope and not umos:
+            umos = await self.get_umos_by_scope(scope, group_id)
+
+        if not umos:
+            raise SessionManagementServiceError("缺少必要参数: umos 或有效的 scope")
+        if not isinstance(umos, list):
+            raise SessionManagementServiceError("参数 umos 必须是数组")
+        if rule_key and rule_key not in AVAILABLE_SESSION_RULE_KEYS:
+            raise SessionManagementServiceError(f"不支持的规则键: {rule_key}")
+
+        success_count = 0
+        failed_umos = []
+        for umo in umos:
+            try:
+                if rule_key:
+                    await sp.session_remove(umo, rule_key)
+                else:
+                    await sp.clear_async("umo", umo)
+                success_count += 1
+            except Exception as exc:
+                logger.error(f"删除 umo {umo} 的规则失败: {exc!s}")
+                failed_umos.append(umo)
+
+        message = f"已删除 {success_count} 条规则"
+        if rule_key:
+            message = f"已删除 {success_count} 条 {rule_key} 规则"
+
+        result = {
+            "message": message,
+            "success_count": success_count,
+        }
+        if failed_umos:
+            result.update(
+                {
+                    "message": f"{message}，{len(failed_umos)} 条删除失败",
+                    "failed_umos": failed_umos,
+                }
+            )
+        return result
+
+    async def list_all_umos_with_status(
+        self,
+        *,
+        page: int,
+        page_size: int,
+        search: str,
+        message_type: str,
+        platform: str,
+    ) -> dict:
+        page, page_size = self._normalize_page(page, page_size, default_page_size=20)
+        all_umos = await self.list_known_umos()
+        alias_map = await self.get_umo_alias_map(all_umos)
+        umo_rules, _ = await self.get_umo_rules(page=1, page_size=99999, search="")
+
+        umos_with_status = []
+        for umo in all_umos:
+            umo_info = self.build_umo_info(umo, alias_map)
+            umo_platform = umo_info["platform"]
+            umo_message_type = umo_info["message_type"]
+
+            if message_type != "all":
+                if message_type == "group" and umo_message_type not in [
+                    "group",
+                    "GroupMessage",
+                ]:
+                    continue
+                if message_type == "private" and umo_message_type not in [
+                    "private",
+                    "FriendMessage",
+                    "friend",
+                ]:
+                    continue
+
+            if platform and umo_platform != platform:
+                continue
+
+            rules = umo_rules.get(umo, {})
+            svc_config = rules.get("session_service_config", {})
+
+            custom_name = svc_config.get("custom_name", "") if svc_config else ""
+            session_enabled = (
+                svc_config.get("session_enabled", True) if svc_config else True
+            )
+            llm_enabled = svc_config.get("llm_enabled", True) if svc_config else True
+            tts_enabled = svc_config.get("tts_enabled", True) if svc_config else True
+
+            if search:
+                search_lower = search.lower()
+                search_targets = [
+                    umo,
+                    custom_name,
+                    umo_info["auto_name"],
+                    umo_info["user_alias"],
+                    umo_info["display_name"],
+                ]
+                if not any(
+                    search_lower in target.lower()
+                    for target in search_targets
+                    if target
+                ):
+                    continue
+
+            chat_provider_key = f"provider_perf_{ProviderType.CHAT_COMPLETION.value}"
+            tts_provider_key = f"provider_perf_{ProviderType.TEXT_TO_SPEECH.value}"
+            stt_provider_key = f"provider_perf_{ProviderType.SPEECH_TO_TEXT.value}"
+
+            umos_with_status.append(
+                {
+                    **umo_info,
+                    "custom_name": custom_name,
+                    "session_enabled": session_enabled,
+                    "llm_enabled": llm_enabled,
+                    "tts_enabled": tts_enabled,
+                    "has_rules": umo in umo_rules,
+                    "chat_provider": rules.get(chat_provider_key),
+                    "tts_provider": rules.get(tts_provider_key),
+                    "stt_provider": rules.get(stt_provider_key),
+                }
+            )
+
+        total = len(umos_with_status)
+        start_idx = (page - 1) * page_size
+        end_idx = start_idx + page_size
+        paginated = umos_with_status[start_idx:end_idx]
+        platforms = list({u["platform"] for u in umos_with_status})
+        provider_manager = self.core_lifecycle.provider_manager
+
+        return {
+            "sessions": paginated,
+            "total": total,
+            "page": page,
+            "page_size": page_size,
+            "platforms": platforms,
+            "available_chat_providers": self._serialize_provider_insts(
+                getattr(provider_manager, "provider_insts", [])
+            ),
+            "available_tts_providers": self._serialize_provider_insts(
+                getattr(provider_manager, "tts_provider_insts", [])
+            ),
+            "available_stt_providers": self._serialize_provider_insts(
+                getattr(provider_manager, "stt_provider_insts", [])
+            ),
+        }
+
+    async def batch_update_service(self, data: object) -> dict:
+        payload = self._payload(data)
+        umos = payload.get("umos", [])
+        scope = payload.get("scope", "")
+        group_id = payload.get("group_id", "")
+        llm_enabled = payload.get("llm_enabled")
+        tts_enabled = payload.get("tts_enabled")
+        session_enabled = payload.get("session_enabled")
+
+        if llm_enabled is None and tts_enabled is None and session_enabled is None:
+            raise SessionManagementServiceError("至少需要指定一个要修改的状态")
+
+        if scope and not umos:
+            umos = await self.get_umos_by_scope(scope, group_id)
+
+        if not umos:
+            raise SessionManagementServiceError("没有找到符合条件的会话")
+
+        success_count = 0
+        failed_umos = []
+
+        for umo in umos:
+            try:
+                session_config = (
+                    sp.get("session_service_config", {}, scope="umo", scope_id=umo)
+                    or {}
+                )
+
+                if llm_enabled is not None:
+                    session_config["llm_enabled"] = llm_enabled
+                if tts_enabled is not None:
+                    session_config["tts_enabled"] = tts_enabled
+                if session_enabled is not None:
+                    session_config["session_enabled"] = session_enabled
+
+                sp.put(
+                    "session_service_config",
+                    session_config,
+                    scope="umo",
+                    scope_id=umo,
+                )
+                success_count += 1
+            except Exception as exc:
+                logger.error(f"更新 {umo} 服务状态失败: {exc!s}")
+                failed_umos.append(umo)
+
+        status_changes = []
+        if llm_enabled is not None:
+            status_changes.append(f"LLM={'启用' if llm_enabled else '禁用'}")
+        if tts_enabled is not None:
+            status_changes.append(f"TTS={'启用' if tts_enabled else '禁用'}")
+        if session_enabled is not None:
+            status_changes.append(f"会话={'启用' if session_enabled else '禁用'}")
+
+        return {
+            "message": f"已更新 {success_count} 个会话 ({', '.join(status_changes)})",
+            "success_count": success_count,
+            "failed_count": len(failed_umos),
+            "failed_umos": failed_umos,
+        }
+
+    async def batch_update_provider(self, data: object) -> dict:
+        payload = self._payload(data)
+        umos = payload.get("umos", [])
+        scope = payload.get("scope", "")
+        provider_type = payload.get("provider_type")
+        provider_id = payload.get("provider_id")
+
+        if not provider_type or not provider_id:
+            raise SessionManagementServiceError(
+                "缺少必要参数: provider_type, provider_id"
+            )
+
+        provider_type_map = {
+            "chat_completion": ProviderType.CHAT_COMPLETION,
+            "text_to_speech": ProviderType.TEXT_TO_SPEECH,
+            "speech_to_text": ProviderType.SPEECH_TO_TEXT,
+        }
+        if provider_type not in provider_type_map:
+            raise SessionManagementServiceError(
+                f"不支持的 provider_type: {provider_type}"
+            )
+
+        group_id = payload.get("group_id", "")
+        if scope and not umos:
+            umos = await self.get_umos_by_scope(scope, group_id)
+
+        if not umos:
+            raise SessionManagementServiceError("没有找到符合条件的会话")
+
+        success_count = 0
+        failed_umos = []
+        provider_manager = self.core_lifecycle.provider_manager
+
+        for umo in umos:
+            try:
+                await provider_manager.set_provider(
+                    provider_id=provider_id,
+                    provider_type=provider_type_map[provider_type],
+                    umo=umo,
+                )
+                success_count += 1
+            except Exception as exc:
+                logger.error(f"更新 {umo} Provider 失败: {exc!s}")
+                failed_umos.append(umo)
+
+        return {
+            "message": f"已更新 {success_count} 个会话的 {provider_type} 为 {provider_id}",
+            "success_count": success_count,
+            "failed_count": len(failed_umos),
+            "failed_umos": failed_umos,
+        }
+
+    def get_groups(self) -> dict:
+        return sp.get("session_groups", {})
+
+    def save_groups(self, groups: dict) -> None:
+        sp.put("session_groups", groups)
+
+    def list_groups(self) -> dict:
+        groups = self.get_groups()
+        return {
+            "groups": [
+                {
+                    "id": group_id,
+                    "name": group_data.get("name", ""),
+                    "umos": group_data.get("umos", []),
+                    "umo_count": len(group_data.get("umos", [])),
+                }
+                for group_id, group_data in groups.items()
+            ]
+        }
+
+    def create_group(self, data: object) -> dict:
+        payload = self._payload(data)
+        name = str(payload.get("name", "")).strip()
+        umos = payload.get("umos", [])
+
+        if not name:
+            raise SessionManagementServiceError("分组名称不能为空")
+
+        groups = self.get_groups()
+        group_id = str(uuid.uuid4())[:8]
+        groups[group_id] = {
+            "name": name,
+            "umos": umos,
+        }
+        self.save_groups(groups)
+
+        return {
+            "message": f"分组 '{name}' 创建成功",
+            "group": {
+                "id": group_id,
+                "name": name,
+                "umos": umos,
+                "umo_count": len(umos),
+            },
+        }
+
+    def update_group(self, data: object) -> dict:
+        payload = self._payload(data)
+        group_id = payload.get("id") or payload.get("group_id")
+        name = payload.get("name")
+        umos = payload.get("umos")
+        add_umos = payload.get("add_umos", [])
+        remove_umos = payload.get("remove_umos", [])
+
+        if not group_id:
+            raise SessionManagementServiceError("分组 ID 不能为空")
+
+        groups = self.get_groups()
+        if group_id not in groups:
+            raise SessionManagementServiceError(f"分组 '{group_id}' 不存在")
+
+        group = groups[group_id]
+        if name is not None:
+            group["name"] = name.strip()
+
+        if umos is not None:
+            group["umos"] = umos
+        else:
+            current_umos = set(group.get("umos", []))
+            if add_umos:
+                current_umos.update(add_umos)
+            if remove_umos:
+                current_umos.difference_update(remove_umos)
+            group["umos"] = list(current_umos)
+
+        self.save_groups(groups)
+
+        return {
+            "message": f"分组 '{group['name']}' 更新成功",
+            "group": {
+                "id": group_id,
+                "name": group["name"],
+                "umos": group["umos"],
+                "umo_count": len(group["umos"]),
+            },
+        }
+
+    def delete_group(self, data: object) -> dict:
+        payload = self._payload(data)
+        group_id = payload.get("id") or payload.get("group_id")
+
+        if not group_id:
+            raise SessionManagementServiceError("分组 ID 不能为空")
+
+        groups = self.get_groups()
+        if group_id not in groups:
+            raise SessionManagementServiceError(f"分组 '{group_id}' 不存在")
+
+        group_name = groups[group_id].get("name", group_id)
+        del groups[group_id]
+        self.save_groups(groups)
+        return {"message": f"分组 '{group_name}' 已删除"}
+
+    @staticmethod
+    def _normalize_page(
+        page: int,
+        page_size: int,
+        *,
+        default_page_size: int,
+    ) -> tuple[int, int]:
+        if page < 1:
+            page = 1
+        if page_size < 1:
+            page_size = default_page_size
+        if page_size > 100:
+            page_size = 100
+        return page, page_size
+
+    @staticmethod
+    def _serialize_provider_insts(provider_insts: list) -> list[dict]:
+        return [
+            {
+                "id": provider.meta().id,
+                "name": provider.meta().id,
+                "model": provider.meta().model,
+            }
+            for provider in provider_insts
+        ]
diff --git a/astrbot/dashboard/services/skills_service.py b/astrbot/dashboard/services/skills_service.py
new file mode 100644
index 000000000..31c5c9afd
--- /dev/null
+++ b/astrbot/dashboard/services/skills_service.py
@@ -0,0 +1,881 @@
+from __future__ import annotations
+
+import os
+import re
+import shutil
+import traceback
+from collections.abc import Awaitable, Callable
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+from astrbot.core import DEMO_MODE, logger
+from astrbot.core.computer.computer_client import (
+    _discover_bay_credentials,
+    sync_skills_to_active_sandboxes,
+)
+from astrbot.core.skills.neo_skill_sync import NeoSkillSyncManager
+from astrbot.core.skills.skill_manager import SkillManager
+from astrbot.core.utils.astrbot_path import get_astrbot_temp_path
+
+_SKILL_NAME_RE = re.compile(r"^[A-Za-z0-9._-]+$")
+_SKILL_FILE_MAX_BYTES = 512 * 1024
+_EDITABLE_SKILL_FILE_SUFFIXES = {
+    ".css",
+    ".html",
+    ".ini",
+    ".js",
+    ".json",
+    ".md",
+    ".py",
+    ".sh",
+    ".toml",
+    ".ts",
+    ".txt",
+    ".yaml",
+    ".yml",
+}
+_EDITABLE_SKILL_FILENAMES = {"Dockerfile", "Makefile"}
+
+
+class SkillsServiceError(Exception):
+    pass
+
+
+@dataclass
+class SkillsOperationResult:
+    ok: bool = True
+    data: dict | list | None = None
+    message: str | None = None
+
+
+@dataclass
+class SkillArchive:
+    path: Path
+    filename: str
+
+
+def _to_jsonable(value: Any) -> Any:
+    if isinstance(value, dict):
+        return {key: _to_jsonable(item) for key, item in value.items()}
+    if isinstance(value, list):
+        return [_to_jsonable(item) for item in value]
+    if hasattr(value, "model_dump"):
+        return _to_jsonable(value.model_dump())
+    return value
+
+
+def _to_bool(value: Any, default: bool = False) -> bool:
+    if value is None:
+        return default
+    if isinstance(value, bool):
+        return value
+    if isinstance(value, str):
+        return value.strip().lower() in {"1", "true", "yes", "y", "on"}
+    return bool(value)
+
+
+def _next_available_temp_path(temp_dir: str, filename: str) -> str:
+    stem = Path(filename).stem
+    suffix = Path(filename).suffix
+    candidate = filename
+    index = 1
+    while os.path.exists(os.path.join(temp_dir, candidate)):
+        candidate = f"{stem}_{index}{suffix}"
+        index += 1
+    return os.path.join(temp_dir, candidate)
+
+
+class SkillsService:
+    def __init__(self, core_lifecycle) -> None:
+        self.core_lifecycle = core_lifecycle
+
+    @staticmethod
+    def _payload(data: object) -> dict[str, Any]:
+        return data if isinstance(data, dict) else {}
+
+    @staticmethod
+    def _ensure_mutation_allowed() -> None:
+        if DEMO_MODE:
+            raise SkillsServiceError(
+                "You are not permitted to do this operation in demo mode"
+            )
+
+    @staticmethod
+    async def _save_upload(file: Any, target_path: str) -> None:
+        if hasattr(file, "save"):
+            maybe_awaitable = file.save(target_path)
+            if hasattr(maybe_awaitable, "__await__"):
+                await maybe_awaitable
+            return
+
+        if hasattr(file, "read"):
+            data = file.read()
+            if hasattr(data, "__await__"):
+                data = await data
+            Path(target_path).write_bytes(data)
+            return
+
+        raise SkillsServiceError("Invalid upload file")
+
+    def resolve_local_skill_dir(self, name: str) -> Path:
+        skill_name = str(name or "").strip()
+        if not skill_name:
+            raise ValueError("Missing skill name")
+        if not _SKILL_NAME_RE.match(skill_name):
+            raise ValueError("Invalid skill name")
+
+        skill_mgr = SkillManager()
+        if skill_mgr.is_sandbox_only_skill(skill_name):
+            raise PermissionError(
+                "Sandbox preset skill cannot be opened from local skill files."
+            )
+
+        plugin_skill_dir = skill_mgr._get_plugin_skill_dir(skill_name)
+        if plugin_skill_dir is not None:
+            return plugin_skill_dir.resolve(strict=True)
+
+        skills_root = Path(skill_mgr.skills_root).resolve(strict=True)
+        skill_dir = (skills_root / skill_name).resolve(strict=True)
+        if not skill_dir.is_relative_to(skills_root):
+            raise PermissionError("Invalid skill path")
+        if not skill_dir.is_dir() or not (skill_dir / "SKILL.md").exists():
+            raise FileNotFoundError("Local skill not found")
+        return skill_dir
+
+    @staticmethod
+    def resolve_skill_relative_path(
+        skill_dir: Path,
+        relative_path: str | None,
+        *,
+        expect_file: bool,
+    ) -> Path:
+        raw_path = str(relative_path or ".").strip() or "."
+        normalized = Path(raw_path.replace("\\", "/"))
+        if normalized.is_absolute() or ".." in normalized.parts:
+            raise ValueError("Invalid relative path")
+
+        target = (skill_dir / normalized).resolve(strict=True)
+        if not target.is_relative_to(skill_dir):
+            raise PermissionError("Path escapes skill directory")
+        if expect_file and not target.is_file():
+            raise FileNotFoundError("Skill file not found")
+        if not expect_file and not target.is_dir():
+            raise FileNotFoundError("Skill directory not found")
+        return target
+
+    @staticmethod
+    def skill_relative_path(skill_dir: Path, target: Path) -> str:
+        rel = target.relative_to(skill_dir).as_posix()
+        return "" if rel == "." else rel
+
+    @staticmethod
+    def is_editable_skill_file(path: Path) -> bool:
+        return (
+            path.name in _EDITABLE_SKILL_FILENAMES
+            or path.suffix.lower() in _EDITABLE_SKILL_FILE_SUFFIXES
+        )
+
+    def serialize_skill_file_entry(
+        self,
+        skill_dir: Path,
+        path: Path,
+        *,
+        readonly: bool = False,
+    ) -> dict:
+        stat = path.stat()
+        is_dir = path.is_dir()
+        return {
+            "name": path.name,
+            "path": self.skill_relative_path(skill_dir, path),
+            "type": "directory" if is_dir else "file",
+            "size": 0 if is_dir else stat.st_size,
+            "editable": (
+                not readonly
+                and (not is_dir)
+                and self.is_editable_skill_file(path)
+                and stat.st_size <= _SKILL_FILE_MAX_BYTES
+            ),
+        }
+
+    def get_neo_client_config(self) -> tuple[str, str]:
+        provider_settings = self.core_lifecycle.astrbot_config.get(
+            "provider_settings",
+            {},
+        )
+        sandbox = provider_settings.get("sandbox", {})
+        endpoint = sandbox.get("shipyard_neo_endpoint", "")
+        access_token = sandbox.get("shipyard_neo_access_token", "")
+
+        if not access_token and endpoint:
+            access_token = _discover_bay_credentials(endpoint)
+
+        if not endpoint or not access_token:
+            raise ValueError(
+                "Shipyard Neo endpoint or access token not configured. "
+                "Set them in Dashboard or ensure Bay's credentials.json is accessible."
+            )
+        return endpoint, access_token
+
+    async def with_neo_client(
+        self,
+        operation: Callable[[Any], Awaitable[Any]],
+    ) -> SkillsOperationResult:
+        try:
+            endpoint, access_token = self.get_neo_client_config()
+
+            from shipyard_neo import BayClient
+
+            async with BayClient(
+                endpoint_url=endpoint,
+                access_token=access_token,
+            ) as client:
+                result = await operation(client)
+                if isinstance(result, SkillsOperationResult):
+                    return result
+                return SkillsOperationResult(data=_to_jsonable(result))
+        except ValueError as exc:
+            logger.debug("[Neo] %s", exc)
+            return SkillsOperationResult(ok=False, message=str(exc))
+        except Exception as exc:
+            logger.error(traceback.format_exc())
+            return SkillsOperationResult(ok=False, message=str(exc))
+
+    def get_skills(self) -> dict:
+        provider_settings = self.core_lifecycle.astrbot_config.get(
+            "provider_settings", {}
+        )
+        runtime = provider_settings.get("computer_use_runtime", "local")
+        skill_mgr = SkillManager()
+        skills = skill_mgr.list_skills(
+            active_only=False,
+            runtime=runtime,
+            show_sandbox_path=False,
+        )
+        return {
+            "skills": [skill.__dict__ for skill in skills],
+            "runtime": runtime,
+            "sandbox_cache": skill_mgr.get_sandbox_skills_cache_status(),
+        }
+
+    async def upload_skill(self, file: Any | None) -> SkillsOperationResult:
+        self._ensure_mutation_allowed()
+        temp_path = None
+        if not file:
+            raise SkillsServiceError("Missing file")
+
+        filename = os.path.basename(file.filename or "skill.zip")
+        if not filename.lower().endswith(".zip"):
+            raise SkillsServiceError("Only .zip files are supported")
+
+        temp_dir = get_astrbot_temp_path()
+        os.makedirs(temp_dir, exist_ok=True)
+        skill_mgr = SkillManager()
+        temp_path = _next_available_temp_path(temp_dir, filename)
+
+        try:
+            await self._save_upload(file, temp_path)
+            try:
+                skill_name = skill_mgr.install_skill_from_zip(
+                    temp_path,
+                    overwrite=False,
+                    skill_name_hint=Path(filename).stem,
+                )
+            except TypeError:
+                skill_name = skill_mgr.install_skill_from_zip(
+                    temp_path,
+                    overwrite=False,
+                )
+
+            try:
+                await sync_skills_to_active_sandboxes()
+            except Exception:
+                logger.warning("Failed to sync uploaded skills to active sandboxes.")
+
+            return SkillsOperationResult(
+                data={"name": skill_name},
+                message="Skill uploaded successfully.",
+            )
+        finally:
+            if temp_path and os.path.exists(temp_path):
+                try:
+                    os.remove(temp_path)
+                except Exception:
+                    logger.warning(f"Failed to remove temp skill file: {temp_path}")
+
+    async def batch_upload_skills(self, file_list: list[Any]) -> SkillsOperationResult:
+        self._ensure_mutation_allowed()
+
+        if not file_list:
+            raise SkillsServiceError("No files provided")
+
+        succeeded = []
+        failed = []
+        skipped = []
+        skill_mgr = SkillManager()
+        temp_dir = get_astrbot_temp_path()
+        os.makedirs(temp_dir, exist_ok=True)
+
+        for file in file_list:
+            filename = os.path.basename(file.filename or "unknown.zip")
+            temp_path = None
+
+            try:
+                if not filename.lower().endswith(".zip"):
+                    failed.append(
+                        {
+                            "filename": filename,
+                            "error": "Only .zip files are supported",
+                        }
+                    )
+                    continue
+
+                temp_path = _next_available_temp_path(temp_dir, filename)
+                await self._save_upload(file, temp_path)
+
+                try:
+                    skill_name = skill_mgr.install_skill_from_zip(
+                        temp_path,
+                        overwrite=False,
+                        skill_name_hint=Path(filename).stem,
+                    )
+                except TypeError:
+                    try:
+                        skill_name = skill_mgr.install_skill_from_zip(
+                            temp_path,
+                            overwrite=False,
+                        )
+                    except FileExistsError:
+                        skipped.append(
+                            {
+                                "filename": filename,
+                                "name": Path(filename).stem,
+                                "error": "Skill already exists.",
+                            }
+                        )
+                        skill_name = None
+                except FileExistsError:
+                    skipped.append(
+                        {
+                            "filename": filename,
+                            "name": Path(filename).stem,
+                            "error": "Skill already exists.",
+                        }
+                    )
+                    skill_name = None
+
+                if skill_name is None:
+                    continue
+                succeeded.append({"filename": filename, "name": skill_name})
+
+            except Exception as exc:
+                failed.append({"filename": filename, "error": str(exc)})
+            finally:
+                if temp_path and os.path.exists(temp_path):
+                    try:
+                        os.remove(temp_path)
+                    except Exception:
+                        pass
+
+        if succeeded:
+            try:
+                await sync_skills_to_active_sandboxes()
+            except Exception:
+                logger.warning("Failed to sync uploaded skills to active sandboxes.")
+
+        total = len(file_list)
+        success_count = len(succeeded)
+        skipped_count = len(skipped)
+        failed_count = len(failed)
+        data = {
+            "total": total,
+            "succeeded": succeeded,
+            "failed": failed,
+            "skipped": skipped,
+        }
+
+        if failed_count == 0 and success_count == total:
+            return SkillsOperationResult(
+                data=data,
+                message=f"All {total} skill(s) uploaded successfully.",
+            )
+        if failed_count == 0 and success_count == 0:
+            return SkillsOperationResult(
+                data=data,
+                message=f"All {total} file(s) were skipped.",
+            )
+        if success_count == 0 and skipped_count == 0:
+            return SkillsOperationResult(
+                ok=False,
+                data=data,
+                message=f"Upload failed for all {total} file(s).",
+            )
+
+        return SkillsOperationResult(
+            data=data,
+            message=f"Partial success: {success_count}/{total} skill(s) uploaded.",
+        )
+
+    def prepare_skill_archive(self, name: str) -> SkillArchive:
+        skill_name = str(name or "").strip()
+        if not skill_name:
+            raise SkillsServiceError("Missing skill name")
+        if not _SKILL_NAME_RE.match(skill_name):
+            raise SkillsServiceError("Invalid skill name")
+
+        skill_mgr = SkillManager()
+        if skill_mgr.is_sandbox_only_skill(skill_name):
+            raise SkillsServiceError(
+                "Sandbox preset skill cannot be downloaded from local skill files."
+            )
+        if skill_mgr.is_plugin_skill(skill_name):
+            raise SkillsServiceError(
+                "Plugin-provided skill cannot be downloaded from local skill files."
+            )
+
+        skill_dir = Path(skill_mgr.skills_root) / skill_name
+        skill_md = skill_dir / "SKILL.md"
+        if not skill_dir.is_dir() or not skill_md.exists():
+            raise SkillsServiceError("Local skill not found")
+
+        export_dir = Path(get_astrbot_temp_path()) / "skill_exports"
+        export_dir.mkdir(parents=True, exist_ok=True)
+        zip_base = export_dir / skill_name
+        zip_path = zip_base.with_suffix(".zip")
+        if zip_path.exists():
+            zip_path.unlink()
+
+        shutil.make_archive(
+            str(zip_base),
+            "zip",
+            root_dir=str(skill_mgr.skills_root),
+            base_dir=skill_name,
+        )
+        return SkillArchive(path=zip_path, filename=f"{skill_name}.zip")
+
+    def prepare_skill_archive_from_dashboard_query(
+        self, name: str | None
+    ) -> SkillArchive:
+        return self.prepare_skill_archive(name or "")
+
+    def list_skill_files(self, name: str, relative_path: str | None = "") -> dict:
+        skill_name = str(name or "").strip()
+        readonly = SkillManager().is_plugin_skill(skill_name)
+        skill_dir = self.resolve_local_skill_dir(skill_name)
+        target_dir = self.resolve_skill_relative_path(
+            skill_dir,
+            relative_path,
+            expect_file=False,
+        )
+
+        entries = []
+        for entry in sorted(
+            target_dir.iterdir(),
+            key=lambda item: (not item.is_dir(), item.name.lower()),
+        ):
+            try:
+                resolved = entry.resolve(strict=True)
+            except OSError:
+                continue
+            if not resolved.is_relative_to(skill_dir):
+                continue
+            if not resolved.is_dir() and not resolved.is_file():
+                continue
+            entries.append(
+                self.serialize_skill_file_entry(
+                    skill_dir,
+                    resolved,
+                    readonly=readonly,
+                )
+            )
+
+        return {
+            "name": skill_name,
+            "path": self.skill_relative_path(skill_dir, target_dir),
+            "entries": entries,
+        }
+
+    def list_skill_files_from_dashboard_query(
+        self,
+        *,
+        name: str | None,
+        relative_path: str | None,
+    ) -> dict:
+        return self.list_skill_files(name or "", relative_path or "")
+
+    def get_skill_file(self, name: str, relative_path: str | None = "SKILL.md") -> dict:
+        skill_name = str(name or "").strip()
+        skill_dir = self.resolve_local_skill_dir(skill_name)
+        target_file = self.resolve_skill_relative_path(
+            skill_dir,
+            relative_path,
+            expect_file=True,
+        )
+        if not self.is_editable_skill_file(target_file):
+            raise SkillsServiceError("Unsupported file type")
+
+        size = target_file.stat().st_size
+        if size > _SKILL_FILE_MAX_BYTES:
+            raise SkillsServiceError("File is too large")
+
+        try:
+            content = target_file.read_text(encoding="utf-8")
+        except UnicodeDecodeError as exc:
+            raise SkillsServiceError("File is not valid UTF-8 text") from exc
+
+        return {
+            "name": skill_name,
+            "path": self.skill_relative_path(skill_dir, target_file),
+            "content": content,
+            "size": size,
+            "editable": not SkillManager().is_plugin_skill(skill_name),
+        }
+
+    def get_skill_file_from_dashboard_query(
+        self,
+        *,
+        name: str | None,
+        relative_path: str | None,
+    ) -> dict:
+        return self.get_skill_file(name or "", relative_path or "SKILL.md")
+
+    async def update_skill_file(self, data: object) -> dict:
+        self._ensure_mutation_allowed()
+        payload = self._payload(data)
+        skill_name = str(payload.get("name") or "").strip()
+        relative_path = payload.get("path", "SKILL.md")
+        content = payload.get("content")
+        if not isinstance(content, str):
+            raise SkillsServiceError("Missing file content")
+
+        encoded = content.encode("utf-8")
+        if len(encoded) > _SKILL_FILE_MAX_BYTES:
+            raise SkillsServiceError("File content is too large")
+
+        skill_dir = self.resolve_local_skill_dir(skill_name)
+        if SkillManager().is_plugin_skill(skill_name):
+            raise SkillsServiceError("Plugin-provided skill is read-only.")
+        target_file = self.resolve_skill_relative_path(
+            skill_dir,
+            relative_path,
+            expect_file=True,
+        )
+        if not self.is_editable_skill_file(target_file):
+            raise SkillsServiceError("Unsupported file type")
+
+        target_file.write_text(content, encoding="utf-8")
+
+        try:
+            await sync_skills_to_active_sandboxes()
+        except Exception:
+            logger.warning("Failed to sync edited skills to active sandboxes.")
+
+        return {
+            "name": skill_name,
+            "path": self.skill_relative_path(skill_dir, target_file),
+            "size": len(encoded),
+        }
+
+    def update_skill(self, data: object) -> dict:
+        self._ensure_mutation_allowed()
+        payload = self._payload(data)
+        name = payload.get("name")
+        active = payload.get("active", True)
+        if not name:
+            raise SkillsServiceError("Missing skill name")
+        SkillManager().set_skill_active(name, bool(active))
+        return {"name": name, "active": bool(active)}
+
+    async def delete_skill(self, data: object) -> dict:
+        self._ensure_mutation_allowed()
+        payload = self._payload(data)
+        name = payload.get("name")
+        if not name:
+            raise SkillsServiceError("Missing skill name")
+        SkillManager().delete_skill(name)
+        try:
+            await sync_skills_to_active_sandboxes()
+        except Exception:
+            logger.warning("Failed to sync deleted skills to active sandboxes.")
+        return {"name": name}
+
+    async def get_neo_candidates(self, query: dict[str, Any]) -> SkillsOperationResult:
+        logger.info("[Neo] GET /skills/neo/candidates requested.")
+        status = query.get("status")
+        skill_key = query.get("skill_key")
+        limit = int(query.get("limit", 100))
+        offset = int(query.get("offset", 0))
+
+        async def _do(client):
+            candidates = await client.skills.list_candidates(
+                status=status,
+                skill_key=skill_key,
+                limit=limit,
+                offset=offset,
+            )
+            result = _to_jsonable(candidates)
+            total = result.get("total", "?") if isinstance(result, dict) else "?"
+            logger.info(f"[Neo] Candidates fetched: total={total}")
+            return result
+
+        return await self.with_neo_client(_do)
+
+    async def get_neo_candidates_from_dashboard_query(
+        self,
+        *,
+        status: str | None,
+        skill_key: str | None,
+        limit: str | None,
+        offset: str | None,
+    ) -> SkillsOperationResult:
+        return await self.get_neo_candidates(
+            self._dashboard_query(
+                status=status,
+                skill_key=skill_key,
+                limit=limit,
+                offset=offset,
+            )
+        )
+
+    async def get_neo_releases(self, query: dict[str, Any]) -> SkillsOperationResult:
+        logger.info("[Neo] GET /skills/neo/releases requested.")
+        skill_key = query.get("skill_key")
+        stage = query.get("stage")
+        active_only = _to_bool(query.get("active_only"), False)
+        limit = int(query.get("limit", 100))
+        offset = int(query.get("offset", 0))
+
+        async def _do(client):
+            releases = await client.skills.list_releases(
+                skill_key=skill_key,
+                active_only=active_only,
+                stage=stage,
+                limit=limit,
+                offset=offset,
+            )
+            result = _to_jsonable(releases)
+            total = result.get("total", "?") if isinstance(result, dict) else "?"
+            logger.info(f"[Neo] Releases fetched: total={total}")
+            return result
+
+        return await self.with_neo_client(_do)
+
+    async def get_neo_releases_from_dashboard_query(
+        self,
+        *,
+        skill_key: str | None,
+        stage: str | None,
+        active_only: str | None,
+        limit: str | None,
+        offset: str | None,
+    ) -> SkillsOperationResult:
+        return await self.get_neo_releases(
+            self._dashboard_query(
+                skill_key=skill_key,
+                stage=stage,
+                active_only=active_only,
+                limit=limit,
+                offset=offset,
+            )
+        )
+
+    async def get_neo_payload(self, query: dict[str, Any]) -> SkillsOperationResult:
+        logger.info("[Neo] GET /skills/neo/payload requested.")
+        payload_ref = query.get("payload_ref", "")
+        if not payload_ref:
+            return SkillsOperationResult(ok=False, message="Missing payload_ref")
+
+        async def _do(client):
+            payload = await client.skills.get_payload(payload_ref)
+            logger.info(f"[Neo] Payload fetched: ref={payload_ref}")
+            return payload
+
+        return await self.with_neo_client(_do)
+
+    async def get_neo_payload_from_dashboard_query(
+        self,
+        payload_ref: str | None,
+    ) -> SkillsOperationResult:
+        return await self.get_neo_payload(
+            self._dashboard_query(payload_ref=payload_ref)
+        )
+
+    async def evaluate_neo_candidate(
+        self,
+        data: object,
+    ) -> SkillsOperationResult:
+        self._ensure_mutation_allowed()
+        logger.info("[Neo] POST /skills/neo/evaluate requested.")
+        payload = self._payload(data)
+        candidate_id = payload.get("candidate_id")
+        passed_value = payload.get("passed")
+        if not candidate_id or passed_value is None:
+            return SkillsOperationResult(
+                ok=False,
+                message="Missing candidate_id or passed",
+            )
+        passed = _to_bool(passed_value, False)
+
+        async def _do(client):
+            result = await client.skills.evaluate_candidate(
+                candidate_id,
+                passed=passed,
+                score=payload.get("score"),
+                benchmark_id=payload.get("benchmark_id"),
+                report=payload.get("report"),
+            )
+            logger.info(
+                f"[Neo] Candidate evaluated: id={candidate_id}, passed={passed}"
+            )
+            return result
+
+        return await self.with_neo_client(_do)
+
+    async def promote_neo_candidate(self, data: object) -> SkillsOperationResult:
+        self._ensure_mutation_allowed()
+        logger.info("[Neo] POST /skills/neo/promote requested.")
+        payload = self._payload(data)
+        candidate_id = payload.get("candidate_id")
+        stage = payload.get("stage", "canary")
+        sync_to_local = _to_bool(payload.get("sync_to_local"), True)
+        if not candidate_id:
+            return SkillsOperationResult(ok=False, message="Missing candidate_id")
+        if stage not in {"canary", "stable"}:
+            return SkillsOperationResult(
+                ok=False,
+                message="Invalid stage, must be canary/stable",
+            )
+
+        async def _do(client):
+            sync_mgr = NeoSkillSyncManager()
+            result = await sync_mgr.promote_with_optional_sync(
+                client,
+                candidate_id=candidate_id,
+                stage=stage,
+                sync_to_local=sync_to_local,
+            )
+            release_json = result.get("release")
+            logger.info(f"[Neo] Candidate promoted: id={candidate_id}, stage={stage}")
+
+            sync_json = result.get("sync")
+            did_sync_to_local = bool(sync_json)
+            if did_sync_to_local:
+                logger.info(
+                    "[Neo] Stable release synced to local: "
+                    f"skill={sync_json.get('local_skill_name', '')}"
+                )
+
+            if result.get("sync_error"):
+                return SkillsOperationResult(
+                    ok=False,
+                    message=(
+                        "Stable promote synced failed and has been rolled back. "
+                        f"sync_error={result['sync_error']}"
+                    ),
+                    data={
+                        "release": release_json,
+                        "rollback": result.get("rollback"),
+                    },
+                )
+
+            if not did_sync_to_local:
+                try:
+                    await sync_skills_to_active_sandboxes()
+                except Exception:
+                    logger.warning("Failed to sync skills to active sandboxes.")
+
+            return {"release": release_json, "sync": sync_json}
+
+        return await self.with_neo_client(_do)
+
+    async def rollback_neo_release(self, data: object) -> SkillsOperationResult:
+        self._ensure_mutation_allowed()
+        logger.info("[Neo] POST /skills/neo/rollback requested.")
+        payload = self._payload(data)
+        release_id = payload.get("release_id")
+        if not release_id:
+            return SkillsOperationResult(ok=False, message="Missing release_id")
+
+        async def _do(client):
+            result = await client.skills.rollback_release(release_id)
+            logger.info(f"[Neo] Release rolled back: id={release_id}")
+            return result
+
+        return await self.with_neo_client(_do)
+
+    async def sync_neo_release(self, data: object) -> SkillsOperationResult:
+        self._ensure_mutation_allowed()
+        logger.info("[Neo] POST /skills/neo/sync requested.")
+        payload = self._payload(data)
+        release_id = payload.get("release_id")
+        skill_key = payload.get("skill_key")
+        require_stable = _to_bool(payload.get("require_stable"), True)
+        if not release_id and not skill_key:
+            return SkillsOperationResult(
+                ok=False,
+                message="Missing release_id or skill_key",
+            )
+
+        async def _do(client):
+            sync_mgr = NeoSkillSyncManager()
+            result = await sync_mgr.sync_release(
+                client,
+                release_id=release_id,
+                skill_key=skill_key,
+                require_stable=require_stable,
+            )
+            logger.info(
+                f"[Neo] Release synced to local: skill={result.local_skill_name}, "
+                f"release_id={result.release_id}"
+            )
+            return {
+                "skill_key": result.skill_key,
+                "local_skill_name": result.local_skill_name,
+                "release_id": result.release_id,
+                "candidate_id": result.candidate_id,
+                "payload_ref": result.payload_ref,
+                "map_path": result.map_path,
+                "synced_at": result.synced_at,
+            }
+
+        return await self.with_neo_client(_do)
+
+    async def delete_neo_candidate(self, data: object) -> SkillsOperationResult:
+        self._ensure_mutation_allowed()
+        logger.info("[Neo] POST /skills/neo/delete-candidate requested.")
+        payload = self._payload(data)
+        candidate_id = payload.get("candidate_id")
+        reason = payload.get("reason")
+        if not candidate_id:
+            return SkillsOperationResult(ok=False, message="Missing candidate_id")
+
+        async def _do(client):
+            result = await client.skills.delete_candidate(candidate_id, reason=reason)
+            logger.info(f"[Neo] Candidate deleted: id={candidate_id}")
+            return result
+
+        return await self.with_neo_client(_do)
+
+    async def delete_neo_release(self, data: object) -> SkillsOperationResult:
+        self._ensure_mutation_allowed()
+        logger.info("[Neo] POST /skills/neo/delete-release requested.")
+        payload = self._payload(data)
+        release_id = payload.get("release_id")
+        reason = payload.get("reason")
+        if not release_id:
+            return SkillsOperationResult(ok=False, message="Missing release_id")
+
+        async def _do(client):
+            result = await client.skills.delete_release(release_id, reason=reason)
+            logger.info(f"[Neo] Release deleted: id={release_id}")
+            return result
+
+        return await self.with_neo_client(_do)
+
+    @staticmethod
+    def _dashboard_query(**values: Any) -> dict[str, Any]:
+        return {
+            key: value
+            for key, value in values.items()
+            if value is not None and value != ""
+        }
diff --git a/astrbot/dashboard/routes/stat.py b/astrbot/dashboard/services/stat_service.py
similarity index 59%
rename from astrbot/dashboard/routes/stat.py
rename to astrbot/dashboard/services/stat_service.py
index 060e4c4e2..a25b0a85d 100644
--- a/astrbot/dashboard/routes/stat.py
+++ b/astrbot/dashboard/services/stat_service.py
@@ -1,5 +1,6 @@
+from __future__ import annotations
+
 import asyncio
-import os
 import re
 import threading
 import time
@@ -11,11 +12,11 @@ from pathlib import Path
 
 import aiohttp
 import psutil
-from quart import request
 from sqlmodel import col, select
 
 from astrbot.core import DEMO_MODE, logger
 from astrbot.core.config import VERSION
+from astrbot.core.config.astrbot_config import AstrBotConfig
 from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
 from astrbot.core.db import BaseDatabase
 from astrbot.core.db.migration.helper import check_migration_needed_v4
@@ -23,7 +24,7 @@ from astrbot.core.db.po import ProviderStat
 from astrbot.core.utils.astrbot_path import get_astrbot_path
 from astrbot.core.utils.auth_password import (
     is_default_dashboard_password,
-    is_legacy_dashboard_password,
+    is_md5_dashboard_password,
 )
 from astrbot.core.utils.io import get_dashboard_version
 from astrbot.core.utils.storage_cleaner import StorageCleaner
@@ -34,48 +35,32 @@ from astrbot.dashboard.password_state import (
     is_password_storage_upgraded,
 )
 
-from .route import Response, Route, RouteContext
+
+class StatServiceError(Exception):
+    pass
 
 
-class StatRoute(Route):
+class StatService:
     def __init__(
         self,
-        context: RouteContext,
         db_helper: BaseDatabase,
         core_lifecycle: AstrBotCoreLifecycle,
+        config: AstrBotConfig,
     ) -> None:
-        super().__init__(context)
-        self.routes = {
-            "/stat/get": ("GET", self.get_stat),
-            "/stat/provider-tokens": ("GET", self.get_provider_token_stats),
-            "/stat/version": ("GET", self.get_version),
-            "/stat/start-time": ("GET", self.get_start_time),
-            "/stat/restart-core": ("POST", self.restart_core),
-            "/stat/test-ghproxy-connection": ("POST", self.test_ghproxy_connection),
-            "/stat/changelog": ("GET", self.get_changelog),
-            "/stat/changelog/list": ("GET", self.list_changelog_versions),
-            "/stat/first-notice": ("GET", self.get_first_notice),
-            "/stat/storage": ("GET", self.get_storage_status),
-            "/stat/storage/cleanup": ("POST", self.cleanup_storage),
-        }
         self.db_helper = db_helper
-        self.register_routes()
         self.core_lifecycle = core_lifecycle
-        self.storage_cleaner = StorageCleaner(self.config)
+        self.config = config
+        self.storage_cleaner = StorageCleaner(config)
 
-    async def restart_core(self):
+    async def restart_core(self) -> None:
         if DEMO_MODE:
-            return (
-                Response()
-                .error("You are not permitted to do this operation in demo mode")
-                .__dict__
+            raise StatServiceError(
+                "You are not permitted to do this operation in demo mode"
             )
-
         await self.core_lifecycle.restart()
-        return Response().ok().__dict__
 
-    def _get_running_time_components(self, total_seconds: int):
-        """将总秒数转换为时分秒组件"""
+    @staticmethod
+    def get_running_time_components(total_seconds: int):
         minutes, seconds = divmod(total_seconds, 60)
         hours, minutes = divmod(minutes, 60)
         return {"hours": hours, "minutes": minutes, "seconds": seconds}
@@ -101,7 +86,7 @@ class StatRoute(Route):
             username == "astrbot" and is_default_dashboard_password(password)
         ) and not DEMO_MODE
 
-    async def get_version(self):
+    async def get_version(self) -> dict:
         need_migration = await check_migration_needed_v4(self.core_lifecycle.db)
         storage_upgraded = await is_password_storage_upgraded(
             self.db_helper,
@@ -112,52 +97,38 @@ class StatRoute(Route):
             upgraded=storage_upgraded,
         )
 
-        return (
-            Response()
-            .ok(
-                {
-                    "version": VERSION,
-                    "dashboard_version": await get_dashboard_version(),
-                    "change_pwd_hint": await self.is_default_cred(),
-                    "legacy_pwd_hint": is_legacy_dashboard_password(password),
-                    "password_upgrade_required": not storage_upgraded,
-                    "need_migration": need_migration,
-                },
-            )
-            .__dict__
-        )
+        md5_pwd_hint = is_md5_dashboard_password(password)
+        return {
+            "version": VERSION,
+            "dashboard_version": await get_dashboard_version(),
+            "change_pwd_hint": await self.is_default_cred(),
+            "md5_pwd_hint": md5_pwd_hint,
+            "password_upgrade_required": not storage_upgraded,
+            "need_migration": need_migration,
+        }
 
-    async def get_start_time(self):
-        return Response().ok({"start_time": self.core_lifecycle.start_time}).__dict__
+    def get_start_time(self) -> dict:
+        return {"start_time": self.core_lifecycle.start_time}
 
-    async def get_storage_status(self):
+    async def get_storage_status(self) -> dict:
         try:
-            status = await asyncio.to_thread(self.storage_cleaner.get_status)
-            return Response().ok(status).__dict__
-        except Exception:
+            return await asyncio.to_thread(self.storage_cleaner.get_status)
+        except Exception as exc:
             logger.error("获取存储占用失败", exc_info=True)
-            return (
-                Response().error("获取存储占用失败，请查看后端日志了解详情。").__dict__
-            )
+            raise StatServiceError(
+                "获取存储占用失败，请查看后端日志了解详情。"
+            ) from exc
 
-    async def cleanup_storage(self):
+    async def cleanup_storage(self, target: str) -> dict:
         try:
-            data = await request.get_json(silent=True)
-            target = "all"
-            if isinstance(data, dict):
-                target = str(data.get("target", "all"))
-
-            result = await asyncio.to_thread(self.storage_cleaner.cleanup, target)
-            return Response().ok(result).__dict__
-        except ValueError as e:
-            return Response().error(str(e)).__dict__
-        except Exception:
+            return await asyncio.to_thread(self.storage_cleaner.cleanup, target)
+        except ValueError as exc:
+            raise StatServiceError(str(exc)) from exc
+        except Exception as exc:
             logger.error("清理存储失败", exc_info=True)
-            return Response().error("清理存储失败，请查看后端日志了解详情。").__dict__
+            raise StatServiceError("清理存储失败，请查看后端日志了解详情。") from exc
 
-    async def get_stat(self):
-        offset_sec = request.args.get("offset_sec", 86400)
-        offset_sec = int(offset_sec)
+    async def get_stat(self, offset_sec: int) -> dict:
         try:
             stat = self.db_helper.get_base_stats(offset_sec)
             now = int(time.time())
@@ -180,7 +151,6 @@ class StatRoute(Route):
             cpu_percent = psutil.cpu_percent(interval=0.5)
             thread_count = threading.active_count()
 
-            # 获取插件信息
             plugins = self.core_lifecycle.star_context.get_all_stars()
             plugin_info = []
             for plugin in plugins:
@@ -191,8 +161,7 @@ class StatRoute(Route):
                 }
                 plugin_info.append(info)
 
-            # 计算运行时长组件
-            running_time = self._get_running_time_components(
+            running_time = self.get_running_time_components(
                 int(time.time()) - self.core_lifecycle.start_time,
             )
 
@@ -208,7 +177,7 @@ class StatRoute(Route):
                     "plugin_count": len(plugins),
                     "plugins": plugin_info,
                     "message_time_series": message_time_based_stats,
-                    "running": running_time,  # 现在返回时间组件而不是格式化的字符串
+                    "running": running_time,
                     "memory": {
                         "process": psutil.Process().memory_info().rss >> 20,
                         "system": psutil.virtual_memory().total >> 20,
@@ -218,11 +187,10 @@ class StatRoute(Route):
                     "start_time": self.core_lifecycle.start_time,
                 },
             )
-
-            return Response().ok(stat_dict).__dict__
-        except Exception as e:
+            return stat_dict
+        except Exception as exc:
             logger.error(traceback.format_exc())
-            return Response().error(e.__str__()).__dict__
+            raise StatServiceError(str(exc)) from exc
 
     @staticmethod
     def _ensure_aware_utc(value: datetime) -> datetime:
@@ -230,12 +198,8 @@ class StatRoute(Route):
             return value.replace(tzinfo=timezone.utc)
         return value.astimezone(timezone.utc)
 
-    async def get_provider_token_stats(self):
+    async def get_provider_token_stats(self, days: int) -> dict:
         try:
-            try:
-                days = int(request.args.get("days", 1))
-            except (TypeError, ValueError):
-                days = 1
             if days not in (1, 3, 7):
                 days = 1
 
@@ -382,63 +346,49 @@ class StatRoute(Route):
                 )
             ]
 
-            return (
-                Response()
-                .ok(
-                    {
-                        "days": days,
-                        "trend": {
-                            "series": series,
-                            "total_series": total_series,
-                        },
-                        "range_total_tokens": range_total_tokens,
-                        "range_total_calls": range_total_calls,
-                        "range_avg_ttft_ms": (
-                            range_ttft_total_ms / range_ttft_samples
-                            if range_ttft_samples
-                            else 0
-                        ),
-                        "range_avg_duration_ms": (
-                            range_duration_total_ms / range_duration_samples
-                            if range_duration_samples
-                            else 0
-                        ),
-                        "range_avg_tpm": (
-                            range_total_output_tokens
-                            / (range_duration_total_ms / 1000 / 60)
-                            if range_duration_total_ms > 0
-                            else 0
-                        ),
-                        "range_success_rate": (
-                            range_success_calls / range_total_calls
-                            if range_total_calls
-                            else 0
-                        ),
-                        "range_by_provider": range_by_provider_data,
-                        "range_by_umo": range_by_umo_data,
-                        "today_total_tokens": today_total_tokens,
-                        "today_total_calls": today_total_calls,
-                        "today_by_model": today_by_model_data,
-                        "today_by_provider": today_by_provider_data,
-                    }
-                )
-                .__dict__
-            )
-        except Exception as e:
+            return {
+                "days": days,
+                "trend": {
+                    "series": series,
+                    "total_series": total_series,
+                },
+                "range_total_tokens": range_total_tokens,
+                "range_total_calls": range_total_calls,
+                "range_avg_ttft_ms": (
+                    range_ttft_total_ms / range_ttft_samples
+                    if range_ttft_samples
+                    else 0
+                ),
+                "range_avg_duration_ms": (
+                    range_duration_total_ms / range_duration_samples
+                    if range_duration_samples
+                    else 0
+                ),
+                "range_avg_tpm": (
+                    range_total_output_tokens / (range_duration_total_ms / 1000 / 60)
+                    if range_duration_total_ms > 0
+                    else 0
+                ),
+                "range_success_rate": (
+                    range_success_calls / range_total_calls if range_total_calls else 0
+                ),
+                "range_by_provider": range_by_provider_data,
+                "range_by_umo": range_by_umo_data,
+                "today_total_tokens": today_total_tokens,
+                "today_total_calls": today_total_calls,
+                "today_by_model": today_by_model_data,
+                "today_by_provider": today_by_provider_data,
+            }
+        except Exception as exc:
             logger.error(traceback.format_exc())
-            return Response().error(f"Error: {e!s}").__dict__
+            raise StatServiceError(f"Error: {exc!s}") from exc
 
-    async def test_ghproxy_connection(self):
-        """测试 GitHub 代理连接是否可用。"""
+    async def test_ghproxy_connection(self, proxy_url: str | None) -> dict:
         try:
-            data = await request.get_json()
-            proxy_url: str = data.get("proxy_url")
-
             if not proxy_url:
-                return Response().error("proxy_url is required").__dict__
+                raise StatServiceError("proxy_url is required")
 
             proxy_url = proxy_url.rstrip("/")
-
             test_url = f"{proxy_url}/https://github.com/AstrBotDevs/AstrBot/raw/refs/heads/master/.python-version"
             start_time = time.time()
 
@@ -452,110 +402,76 @@ class StatRoute(Route):
                 if response.status == 200:
                     end_time = time.time()
                     _ = await response.text()
-                    ret = {
+                    return {
                         "latency": round((end_time - start_time) * 1000, 2),
                     }
-                    return Response().ok(data=ret).__dict__
-                return (
-                    Response().error(f"Failed. Status code: {response.status}").__dict__
-                )
-        except Exception as e:
+                raise StatServiceError(f"Failed. Status code: {response.status}")
+        except StatServiceError:
+            raise
+        except Exception as exc:
             logger.error(traceback.format_exc())
-            return Response().error(f"Error: {e!s}").__dict__
+            raise StatServiceError(f"Error: {exc!s}") from exc
 
-    async def get_changelog(self):
-        """获取指定版本的更新日志"""
+    def get_changelog(self, version: str | None) -> dict:
         try:
-            version = request.args.get("version")
             if not version:
-                return Response().error("version parameter is required").__dict__
+                raise StatServiceError("version parameter is required")
 
             version = version.lstrip("v")
-
-            # 防止路径遍历攻击
             if not re.match(r"^[a-zA-Z0-9._-]+$", version):
-                return Response().error("Invalid version format").__dict__
+                raise StatServiceError("Invalid version format")
             if ".." in version or "/" in version or "\\" in version:
-                return Response().error("Invalid version format").__dict__
+                raise StatServiceError("Invalid version format")
 
-            filename = f"v{version}.md"
-            project_path = get_astrbot_path()
-            changelogs_dir = os.path.join(project_path, "changelogs")
-            changelog_path = os.path.join(changelogs_dir, filename)
-
-            # 规范化路径，防止符号链接攻击
-            changelog_path = os.path.realpath(changelog_path)
-            changelogs_dir = os.path.realpath(changelogs_dir)
-
-            # 验证最终路径在预期的 changelogs 目录内（防止路径遍历）
-            # 确保规范化后的路径以 changelogs_dir 开头，且是目录内的文件
-            changelog_path_normalized = os.path.normpath(changelog_path)
-            changelogs_dir_normalized = os.path.normpath(changelogs_dir)
-
-            # 检查路径是否在预期目录内（必须是目录的子文件，不能是目录本身）
-            expected_prefix = changelogs_dir_normalized + os.sep
-            if not changelog_path_normalized.startswith(expected_prefix):
+            changelogs_dir = (Path(get_astrbot_path()) / "changelogs").resolve()
+            changelog_path = (changelogs_dir / f"v{version}.md").resolve(strict=False)
+            if not changelog_path.is_relative_to(changelogs_dir):
                 logger.warning(
-                    f"Path traversal attempt detected: {version} -> {changelog_path}",
+                    "Path traversal attempt detected: %s -> %s",
+                    version,
+                    changelog_path,
                 )
-                return Response().error("Invalid version format").__dict__
+                raise StatServiceError("Invalid version format")
 
-            if not os.path.exists(changelog_path):
-                return (
-                    Response()
-                    .error(f"Changelog for version {version} not found")
-                    .__dict__
-                )
-            if not os.path.isfile(changelog_path):
-                return (
-                    Response()
-                    .error(f"Changelog for version {version} not found")
-                    .__dict__
-                )
+            if not changelog_path.is_file():
+                raise StatServiceError(f"Changelog for version {version} not found")
 
-            with open(changelog_path, encoding="utf-8") as f:
-                content = f.read()
-
-            return Response().ok({"content": content, "version": version}).__dict__
-        except Exception as e:
+            content = changelog_path.read_text(encoding="utf-8")
+            return {"content": content, "version": version}
+        except StatServiceError:
+            raise
+        except Exception as exc:
             logger.error(traceback.format_exc())
-            return Response().error(f"Error: {e!s}").__dict__
+            raise StatServiceError(f"Error: {exc!s}") from exc
 
-    async def list_changelog_versions(self):
-        """获取所有可用的更新日志版本列表"""
+    def list_changelog_versions(self) -> dict:
         try:
-            project_path = get_astrbot_path()
-            changelogs_dir = os.path.join(project_path, "changelogs")
-
-            if not os.path.exists(changelogs_dir):
-                return Response().ok({"versions": []}).__dict__
+            changelogs_dir = Path(get_astrbot_path()) / "changelogs"
+            if not changelogs_dir.exists():
+                return {"versions": []}
 
             versions = []
-            for filename in os.listdir(changelogs_dir):
+            for path in changelogs_dir.iterdir():
+                filename = path.name
                 if filename.endswith(".md") and filename.startswith("v"):
-                    # 提取版本号（去除 v 前缀和 .md 后缀）
-                    version = filename[1:-3]  # 去掉 "v" 和 ".md"
-                    # 验证版本号格式
+                    version = filename[1:-3]
                     if re.match(r"^[a-zA-Z0-9._-]+$", version):
                         versions.append(version)
 
-            # 按版本号排序（降序，最新的在前）
-            # 使用项目中的 VersionComparator 进行语义化版本号排序
             versions.sort(
                 key=cmp_to_key(
                     lambda v1, v2: VersionComparator.compare_version(v2, v1),
                 ),
             )
 
-            return Response().ok({"versions": versions}).__dict__
-        except Exception as e:
+            return {"versions": versions}
+        except Exception as exc:
             logger.error(traceback.format_exc())
-            return Response().error(f"Error: {e!s}").__dict__
+            raise StatServiceError(f"Error: {exc!s}") from exc
 
-    async def get_first_notice(self):
-        """读取项目根目录 FIRST_NOTICE.md 内容。"""
+    def get_first_notice(self, locale: str | None) -> dict:
         try:
-            locale = (request.args.get("locale") or "").strip()
+            locale = (locale or "").strip()
             if not re.match(r"^[A-Za-z0-9_-]*$", locale):
                 locale = ""
 
@@ -582,9 +498,9 @@ class StatRoute(Route):
                     continue
                 content = notice_path.read_text(encoding="utf-8")
                 if content.strip():
-                    return Response().ok({"content": content}).__dict__
+                    return {"content": content}
 
-            return Response().ok({"content": None}).__dict__
-        except Exception as e:
+            return {"content": None}
+        except Exception as exc:
             logger.error(traceback.format_exc())
-            return Response().error(f"Error: {e!s}").__dict__
+            raise StatServiceError(f"Error: {exc!s}") from exc
diff --git a/astrbot/dashboard/services/static_file_service.py b/astrbot/dashboard/services/static_file_service.py
new file mode 100644
index 000000000..b907ff467
--- /dev/null
+++ b/astrbot/dashboard/services/static_file_service.py
@@ -0,0 +1,70 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+
+class StaticFileService:
+    INDEX_ROUTES = (
+        "/",
+        "/auth/login",
+        "/config",
+        "/logs",
+        "/extension",
+        "/dashboard/default",
+        "/alkaid",
+        "/alkaid/knowledge-base",
+        "/alkaid/long-term-memory",
+        "/alkaid/other",
+        "/console",
+        "/chat",
+        "/settings",
+        "/platforms",
+        "/providers",
+        "/about",
+        "/extension-marketplace",
+        "/conversation",
+        "/tool-use",
+    )
+    NOT_FOUND_MESSAGE = (
+        "404 Not found。如果你初次使用打开面板发现 404, 请参考文档: "
+        "https://docs.astrbot.app/faq.html。如果你正在测试回调地址可达性，"
+        "显示这段文字说明测试成功了。"
+    )
+
+    def list_index_routes(self) -> tuple[str, ...]:
+        return self.INDEX_ROUTES
+
+    def get_not_found_message(self) -> str:
+        return self.NOT_FOUND_MESSAGE
+
+    def resolve_index_file(self, static_folder: str | Path | None) -> Path | None:
+        if not static_folder:
+            return None
+        index_file = Path(static_folder) / "index.html"
+        if index_file.is_file():
+            return index_file
+        return None
+
+    def resolve_static_file(
+        self,
+        static_folder: str | Path | None,
+        requested_path: str,
+    ) -> Path | None:
+        if not static_folder or not requested_path:
+            return None
+        if requested_path.startswith("api/"):
+            return None
+        path_parts = requested_path.replace("\\", "/").split("/")
+        if requested_path.startswith(("/", "\\")) or ".." in path_parts:
+            return None
+
+        static_root = Path(static_folder).resolve()
+        target_file = (static_root / requested_path).resolve()
+        try:
+            target_file.relative_to(static_root)
+        except ValueError:
+            return None
+
+        if target_file.is_file():
+            return target_file
+        return None
diff --git a/astrbot/dashboard/services/subagent_service.py b/astrbot/dashboard/services/subagent_service.py
new file mode 100644
index 000000000..e3a0e9ed2
--- /dev/null
+++ b/astrbot/dashboard/services/subagent_service.py
@@ -0,0 +1,97 @@
+from __future__ import annotations
+
+import traceback
+
+from astrbot.core import logger
+from astrbot.core.agent.handoff import HandoffTool
+from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
+
+
+class SubAgentServiceError(Exception):
+    pass
+
+
+class SubAgentService:
+    def __init__(self, core_lifecycle: AstrBotCoreLifecycle) -> None:
+        self.core_lifecycle = core_lifecycle
+
+    def get_config(self) -> dict:
+        try:
+            config_data = self.core_lifecycle.astrbot_config.get(
+                "subagent_orchestrator"
+            )
+            return self._normalize_config(config_data)
+        except Exception as exc:
+            logger.error(traceback.format_exc())
+            raise SubAgentServiceError(f"获取 subagent 配置失败: {exc!s}") from exc
+
+    async def update_config(self, data: object) -> None:
+        try:
+            if not isinstance(data, dict):
+                raise SubAgentServiceError("配置必须为 JSON 对象")
+
+            config = self.core_lifecycle.astrbot_config
+            config["subagent_orchestrator"] = data
+            config.save_config()
+
+            orchestrator = getattr(self.core_lifecycle, "subagent_orchestrator", None)
+            if orchestrator is not None:
+                await orchestrator.reload_from_config(data)
+        except SubAgentServiceError:
+            raise
+        except Exception as exc:
+            logger.error(traceback.format_exc())
+            raise SubAgentServiceError(f"保存 subagent 配置失败: {exc!s}") from exc
+
+    def get_available_tools(self) -> list[dict]:
+        try:
+            tool_mgr = self.core_lifecycle.provider_manager.llm_tools
+            tools = []
+            for tool in tool_mgr.func_list:
+                if self._is_subagent_internal_tool(tool):
+                    continue
+                tools.append(
+                    {
+                        "name": tool.name,
+                        "description": tool.description,
+                        "parameters": tool.parameters,
+                        "active": tool.active,
+                        "handler_module_path": tool.handler_module_path,
+                    }
+                )
+            return tools
+        except Exception as exc:
+            logger.error(traceback.format_exc())
+            raise SubAgentServiceError(f"获取可用工具失败: {exc!s}") from exc
+
+    @staticmethod
+    def _normalize_config(data: object) -> dict:
+        if not isinstance(data, dict):
+            data = {
+                "main_enable": False,
+                "remove_main_duplicate_tools": False,
+                "agents": [],
+            }
+
+        if "main_enable" not in data and "enable" in data:
+            data["main_enable"] = bool(data.get("enable", False))
+
+        data.setdefault("main_enable", False)
+        data.setdefault("remove_main_duplicate_tools", False)
+        data.setdefault("agents", [])
+
+        agents = data.get("agents")
+        if isinstance(agents, list):
+            for agent in agents:
+                if isinstance(agent, dict):
+                    agent.setdefault("provider_id", None)
+                    agent.setdefault("persona_id", None)
+
+        return data
+
+    @staticmethod
+    def _is_subagent_internal_tool(tool) -> bool:
+        return (
+            isinstance(tool, HandoffTool)
+            or tool.handler_module_path == "core.subagent_orchestrator"
+        )
diff --git a/astrbot/dashboard/services/t2i_service.py b/astrbot/dashboard/services/t2i_service.py
new file mode 100644
index 000000000..72725cf72
--- /dev/null
+++ b/astrbot/dashboard/services/t2i_service.py
@@ -0,0 +1,130 @@
+from __future__ import annotations
+
+from astrbot.core import logger
+from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
+from astrbot.core.utils.t2i.template_manager import TemplateManager
+
+
+class T2iServiceError(Exception):
+    def __init__(self, message: str, status_code: int = 500) -> None:
+        super().__init__(message)
+        self.status_code = status_code
+
+
+class T2iService:
+    def __init__(
+        self,
+        core_lifecycle: AstrBotCoreLifecycle,
+        manager: TemplateManager | None = None,
+    ) -> None:
+        self.core_lifecycle = core_lifecycle
+        self.config = core_lifecycle.astrbot_config
+        self.manager = manager or TemplateManager()
+
+    async def reload_all_pipeline_schedulers(self) -> None:
+        for conf_id in self.core_lifecycle.astrbot_config_mgr.confs:
+            await self.core_lifecycle.reload_pipeline_scheduler(conf_id)
+
+    async def sync_active_template_to_all_configs(self, name: str) -> None:
+        for config in self.core_lifecycle.astrbot_config_mgr.confs.values():
+            config["t2i_active_template"] = name
+            config.save_config()
+        await self.reload_all_pipeline_schedulers()
+
+    def list_templates(self):
+        try:
+            return self.manager.list_templates()
+        except Exception as exc:
+            raise T2iServiceError(str(exc)) from exc
+
+    def get_active_template(self) -> dict:
+        try:
+            return {"active_template": self.config.get("t2i_active_template", "base")}
+        except Exception as exc:
+            logger.error("Error in get_active_template", exc_info=True)
+            raise T2iServiceError(str(exc)) from exc
+
+    def get_template(self, name: str) -> dict:
+        try:
+            return {"name": name, "content": self.manager.get_template(name)}
+        except FileNotFoundError as exc:
+            raise T2iServiceError("Template not found", 404) from exc
+        except Exception as exc:
+            raise T2iServiceError(str(exc)) from exc
+
+    def create_template(self, name: str | None, content: str | None) -> dict:
+        if not name or not content:
+            raise T2iServiceError("Name and content are required.", 400)
+
+        name = name.strip()
+        try:
+            self.manager.create_template(name, content)
+        except FileExistsError as exc:
+            raise T2iServiceError(
+                "Template with this name already exists.",
+                409,
+            ) from exc
+        except ValueError as exc:
+            raise T2iServiceError(str(exc), 400) from exc
+        except Exception as exc:
+            raise T2iServiceError(str(exc)) from exc
+
+        return {"name": name}
+
+    async def update_template(self, name: str, content: str | None) -> tuple[dict, str]:
+        name = name.strip()
+        if content is None:
+            raise T2iServiceError("Content is required.", 400)
+
+        try:
+            self.manager.update_template(name, content)
+            active_template = self.config.get("t2i_active_template", "base")
+            if name == active_template:
+                await self.reload_all_pipeline_schedulers()
+                message = f"模板 '{name}' 已更新并重新加载。"
+            else:
+                message = f"模板 '{name}' 已更新。"
+        except ValueError as exc:
+            raise T2iServiceError(str(exc), 400) from exc
+        except Exception as exc:
+            raise T2iServiceError(str(exc)) from exc
+
+        return {"name": name}, message
+
+    def delete_template(self, name: str) -> None:
+        name = name.strip()
+        try:
+            self.manager.delete_template(name)
+        except FileNotFoundError as exc:
+            raise T2iServiceError("Template not found.", 404) from exc
+        except ValueError as exc:
+            raise T2iServiceError(str(exc), 400) from exc
+        except Exception as exc:
+            raise T2iServiceError(str(exc)) from exc
+
+    async def set_active_template(self, name: str | None) -> str:
+        if not name:
+            raise T2iServiceError("模板名称(name)不能为空。", 400)
+
+        try:
+            self.manager.get_template(name)
+            await self.sync_active_template_to_all_configs(name)
+        except FileNotFoundError as exc:
+            raise T2iServiceError(f"模板 '{name}' 不存在，无法应用。", 404) from exc
+        except Exception as exc:
+            logger.error("Error in set_active_template", exc_info=True)
+            raise T2iServiceError(str(exc)) from exc
+
+        return f"模板 '{name}' 已成功应用。"
+
+    async def reset_default_template(self) -> str:
+        try:
+            self.manager.reset_default_template()
+            await self.sync_active_template_to_all_configs("base")
+        except FileNotFoundError as exc:
+            raise T2iServiceError(str(exc), 404) from exc
+        except Exception as exc:
+            logger.error("Error in reset_default_template", exc_info=True)
+            raise T2iServiceError(str(exc)) from exc
+
+        return "Default template has been reset and activated."
diff --git a/astrbot/dashboard/services/tools_service.py b/astrbot/dashboard/services/tools_service.py
new file mode 100644
index 000000000..efd487185
--- /dev/null
+++ b/astrbot/dashboard/services/tools_service.py
@@ -0,0 +1,577 @@
+from __future__ import annotations
+
+import traceback
+from typing import Any
+
+from astrbot.core import logger, sp
+from astrbot.core.agent.mcp_client import MCPTool, validate_mcp_stdio_config
+from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
+from astrbot.core.star import star_map
+from astrbot.core.tools.registry import get_builtin_tool_config_statuses
+
+
+class ToolsServiceError(Exception):
+    pass
+
+
+class EmptyMcpServersError(ValueError):
+    pass
+
+
+def extract_mcp_server_config(mcp_servers_value: object) -> dict:
+    if not isinstance(mcp_servers_value, dict):
+        raise ValueError("mcpServers must be a JSON object")
+    if not mcp_servers_value:
+        raise EmptyMcpServersError("mcpServers configuration cannot be empty")
+    key_0 = next(iter(mcp_servers_value))
+    extracted = mcp_servers_value[key_0]
+    if not isinstance(extracted, dict):
+        raise ValueError(
+            "Invalid mcpServers format. Ensure each key in mcpServers is a server name, "
+            "and each value is an object containing fields like command/url."
+        )
+    return extracted
+
+
+class ToolsService:
+    def __init__(self, core_lifecycle: AstrBotCoreLifecycle) -> None:
+        self.core_lifecycle = core_lifecycle
+        self.tool_mgr = core_lifecycle.provider_manager.llm_tools
+
+    def rollback_mcp_server(self, name: str) -> bool:
+        try:
+            rollback_config = self.tool_mgr.load_mcp_config()
+            if name in rollback_config["mcpServers"]:
+                rollback_config["mcpServers"].pop(name)
+                return self.tool_mgr.save_mcp_config(rollback_config)
+            return True
+        except Exception:
+            logger.error(traceback.format_exc())
+            return False
+
+    def get_mcp_servers(self) -> list[dict]:
+        try:
+            config = self.tool_mgr.load_mcp_config()
+            servers = []
+            mcp_servers = config.get("mcpServers", {})
+
+            if not isinstance(mcp_servers, dict):
+                logger.warning(
+                    f"Invalid MCP server config type: {type(mcp_servers).__name__}. Expected object/dict; skipped all MCP servers."
+                )
+                mcp_servers = {}
+
+            for name, server_config in mcp_servers.items():
+                if not isinstance(server_config, dict):
+                    logger.warning(
+                        f"Invalid config for MCP server '{name}' (type: {type(server_config).__name__}); skipped."
+                    )
+                    continue
+
+                server_info = {
+                    "name": name,
+                    "active": server_config.get("active", True),
+                }
+                for key, value in server_config.items():
+                    if key != "active":
+                        server_info[key] = value
+
+                for name_key, runtime in self.tool_mgr.mcp_server_runtime_view.items():
+                    if name_key == name:
+                        mcp_client = runtime.client
+                        server_info["tools"] = [tool.name for tool in mcp_client.tools]
+                        server_info["errlogs"] = mcp_client.server_errlogs
+                        break
+                else:
+                    server_info["tools"] = []
+
+                servers.append(server_info)
+
+            return servers
+        except Exception as exc:
+            logger.error(traceback.format_exc())
+            raise ToolsServiceError(f"Failed to get MCP server list: {exc!s}") from exc
+
+    def get_mcp_server_config(self, name: str) -> dict | None:
+        config = self.tool_mgr.load_mcp_config()
+        mcp_servers = config.get("mcpServers", {})
+        if not isinstance(mcp_servers, dict):
+            return None
+
+        server_config = mcp_servers.get(name)
+        if not isinstance(server_config, dict):
+            return None
+        return dict(server_config)
+
+    async def add_mcp_server(self, server_data: Any) -> str:
+        try:
+            name = server_data.get("name", "")
+            if not name:
+                raise ToolsServiceError("Server name cannot be empty")
+
+            has_valid_config, server_config = self._build_server_config(server_data)
+            if not has_valid_config:
+                raise ToolsServiceError("A valid server configuration is required")
+
+            self._validate_server_config(server_config)
+
+            config = self.tool_mgr.load_mcp_config()
+            if name in config["mcpServers"]:
+                raise ToolsServiceError(f"Server {name} already exists")
+
+            try:
+                await self.tool_mgr.test_mcp_server_connection(server_config)
+            except Exception as exc:
+                logger.error(traceback.format_exc())
+                raise ToolsServiceError(f"MCP connection test failed: {exc!s}") from exc
+
+            config["mcpServers"][name] = server_config
+
+            if self.tool_mgr.save_mcp_config(config):
+                await self._enable_added_server(name, server_config)
+                return f"Successfully added MCP server {name}"
+            raise ToolsServiceError("Failed to save configuration")
+        except ToolsServiceError:
+            raise
+        except Exception as exc:
+            logger.error(traceback.format_exc())
+            raise ToolsServiceError(f"Failed to add MCP server: {exc!s}") from exc
+
+    async def update_mcp_server(self, server_data: Any) -> str:
+        try:
+            name = server_data.get("name", "")
+            old_name = server_data.get("oldName") or name
+
+            if not name:
+                raise ToolsServiceError("Server name cannot be empty")
+
+            config = self.tool_mgr.load_mcp_config()
+
+            if old_name not in config["mcpServers"]:
+                raise ToolsServiceError(f"Server {old_name} does not exist")
+
+            is_rename = name != old_name
+            if name in config["mcpServers"] and is_rename:
+                raise ToolsServiceError(f"Server {name} already exists")
+
+            old_config = config["mcpServers"][old_name]
+            old_active = (
+                old_config.get("active", True) if isinstance(old_config, dict) else True
+            )
+            active = server_data.get("active", old_active)
+
+            only_update_active, server_config = self._build_updated_server_config(
+                server_data,
+                old_config,
+                active,
+            )
+            self._validate_server_config(server_config)
+
+            if is_rename:
+                config["mcpServers"].pop(old_name)
+                config["mcpServers"][name] = server_config
+            else:
+                config["mcpServers"][name] = server_config
+
+            if self.tool_mgr.save_mcp_config(config):
+                await self._sync_updated_server_runtime(
+                    name=name,
+                    old_name=old_name,
+                    active=active,
+                    is_rename=is_rename,
+                    only_update_active=only_update_active,
+                    server_config=config["mcpServers"][name],
+                )
+                return f"Successfully updated MCP server {name}"
+            raise ToolsServiceError("Failed to save configuration")
+        except ToolsServiceError:
+            raise
+        except Exception as exc:
+            logger.error(traceback.format_exc())
+            raise ToolsServiceError(f"Failed to update MCP server: {exc!s}") from exc
+
+    async def delete_mcp_server(self, server_data: Any) -> str:
+        try:
+            name = server_data.get("name", "")
+
+            if not name:
+                raise ToolsServiceError("Server name cannot be empty")
+
+            config = self.tool_mgr.load_mcp_config()
+
+            if name not in config["mcpServers"]:
+                raise ToolsServiceError(f"Server {name} does not exist")
+
+            del config["mcpServers"][name]
+
+            if self.tool_mgr.save_mcp_config(config):
+                if name in self.tool_mgr.mcp_server_runtime_view:
+                    await self._disable_server(name)
+                return f"Successfully deleted MCP server {name}"
+            raise ToolsServiceError("Failed to save configuration")
+        except ToolsServiceError:
+            raise
+        except Exception as exc:
+            logger.error(traceback.format_exc())
+            raise ToolsServiceError(f"Failed to delete MCP server: {exc!s}") from exc
+
+    async def test_mcp_connection(self, server_data: Any) -> list:
+        try:
+            config = server_data.get("mcp_server_config", None)
+
+            if not isinstance(config, dict) or not config:
+                raise ToolsServiceError("Invalid MCP server configuration")
+
+            if "mcpServers" in config:
+                mcp_servers = config["mcpServers"]
+                if isinstance(mcp_servers, dict) and len(mcp_servers) > 1:
+                    raise ToolsServiceError(
+                        "Only one MCP server configuration can be tested at a time"
+                    )
+                try:
+                    config = extract_mcp_server_config(mcp_servers)
+                except EmptyMcpServersError as exc:
+                    raise ToolsServiceError(
+                        "MCP server configuration cannot be empty"
+                    ) from exc
+                except ValueError as exc:
+                    raise ToolsServiceError(f"{exc!s}") from exc
+            elif not config:
+                raise ToolsServiceError("MCP server configuration cannot be empty")
+
+            self._validate_server_config(config)
+            return await self.tool_mgr.test_mcp_server_connection(config)
+        except ToolsServiceError:
+            raise
+        except Exception as exc:
+            logger.error(traceback.format_exc())
+            raise ToolsServiceError(f"Failed to test MCP connection: {exc!s}") from exc
+
+    def get_tool_list(self) -> list[dict]:
+        try:
+            tools = list(self.tool_mgr.func_list)
+            existing_names = {tool.name for tool in tools}
+            for tool in self.tool_mgr.iter_builtin_tools():
+                if tool.name not in existing_names:
+                    tools.append(tool)
+
+            config_entries = self._get_config_entries()
+            tools_dict = []
+            for tool in tools:
+                tools_dict.append(self._serialize_tool(tool, config_entries))
+            return tools_dict
+        except Exception as exc:
+            logger.error(traceback.format_exc())
+            raise ToolsServiceError(f"Failed to get tool list: {exc!s}") from exc
+
+    def update_tool_permission(self, data: Any) -> str:
+        """Set a tool permission level.
+
+        Args:
+            data: Legacy dashboard payload with ``name`` and ``permission``.
+
+        Returns:
+            A success message for the response body.
+
+        Raises:
+            ToolsServiceError: If the payload is invalid, the tool is unknown,
+                or permission storage cannot be updated.
+        """
+        try:
+            tool_name = data.get("name") if isinstance(data, dict) else None
+            permission = data.get("permission") if isinstance(data, dict) else None
+
+            if not tool_name or permission not in ("admin", "member"):
+                raise ToolsServiceError(
+                    "name and permission (admin or member) are required"
+                )
+
+            if self.tool_mgr.is_builtin_tool(tool_name):
+                raise ToolsServiceError(
+                    "Builtin tools do not support per-tool permission configuration."
+                )
+
+            if not any(t.name == tool_name for t in self.tool_mgr.func_list):
+                raise ToolsServiceError(f"Tool '{tool_name}' not found")
+
+            perms_store = sp.get(
+                "tool_permissions",
+                {},
+                scope="global",
+                scope_id="global",
+            )
+            if not isinstance(perms_store, dict):
+                perms_store = {}
+            defaults = perms_store.get("_default", {})
+            if not isinstance(defaults, dict):
+                defaults = {}
+            defaults[tool_name] = permission
+            perms_store["_default"] = defaults
+            sp.put(
+                "tool_permissions",
+                perms_store,
+                scope="global",
+                scope_id="global",
+            )
+
+            return f"Tool '{tool_name}' permission set to {permission}"
+        except ToolsServiceError:
+            raise
+        except Exception as exc:
+            logger.error(traceback.format_exc())
+            raise ToolsServiceError(
+                f"Failed to update tool permission: {exc!s}"
+            ) from exc
+
+    def toggle_tool(self, data: Any) -> str:
+        try:
+            tool_name = data.get("name")
+            action = data.get("activate")
+
+            if not tool_name or action is None:
+                raise ToolsServiceError("Missing required parameters: name or activate")
+
+            if self.tool_mgr.is_builtin_tool(tool_name):
+                raise ToolsServiceError(
+                    "Builtin tools are read-only and cannot be toggled."
+                )
+
+            if action:
+                try:
+                    ok = self.tool_mgr.activate_llm_tool(tool_name, star_map=star_map)
+                except ValueError as exc:
+                    raise ToolsServiceError(
+                        f"Failed to activate tool: {exc!s}"
+                    ) from exc
+            else:
+                ok = self.tool_mgr.deactivate_llm_tool(tool_name)
+
+            if ok:
+                return "Operation successful."
+            raise ToolsServiceError(
+                f"Tool {tool_name} does not exist or the operation failed."
+            )
+        except ToolsServiceError:
+            raise
+        except Exception as exc:
+            logger.error(traceback.format_exc())
+            raise ToolsServiceError(f"Failed to operate tool: {exc!s}") from exc
+
+    async def sync_provider(self, data: Any) -> str:
+        try:
+            provider_name = data.get("name")
+            match provider_name:
+                case "modelscope":
+                    access_token = data.get("access_token", "")
+                    await self.tool_mgr.sync_modelscope_mcp_servers(access_token)
+                case _:
+                    raise ToolsServiceError(f"Unknown provider: {provider_name}")
+
+            return "Sync completed"
+        except ToolsServiceError:
+            raise
+        except Exception as exc:
+            logger.error(traceback.format_exc())
+            raise ToolsServiceError(f"Sync failed: {exc!s}") from exc
+
+    @staticmethod
+    def _build_server_config(server_data: dict) -> tuple[bool, dict]:
+        has_valid_config = False
+        server_config = {"active": server_data.get("active", True)}
+
+        for key, value in server_data.items():
+            if key in ["name", "active", "tools", "errlogs"]:
+                continue
+            if key == "mcpServers":
+                try:
+                    server_config = extract_mcp_server_config(server_data["mcpServers"])
+                except ValueError as exc:
+                    raise ToolsServiceError(f"{exc!s}") from exc
+            else:
+                server_config[key] = value
+            has_valid_config = True
+
+        return has_valid_config, server_config
+
+    @staticmethod
+    def _build_updated_server_config(
+        server_data: dict,
+        old_config: object,
+        active: bool,
+    ) -> tuple[bool, dict]:
+        server_config = {"active": active}
+        only_update_active = True
+
+        for key, value in server_data.items():
+            if key in ["name", "active", "tools", "errlogs", "oldName"]:
+                continue
+            if key == "mcpServers":
+                try:
+                    server_config = extract_mcp_server_config(server_data["mcpServers"])
+                except ValueError as exc:
+                    raise ToolsServiceError(f"{exc!s}") from exc
+            else:
+                server_config[key] = value
+            only_update_active = False
+
+        if only_update_active and isinstance(old_config, dict):
+            for key, value in old_config.items():
+                if key != "active":
+                    server_config[key] = value
+
+        return only_update_active, server_config
+
+    @staticmethod
+    def _validate_server_config(server_config: dict) -> None:
+        try:
+            validate_mcp_stdio_config(server_config)
+        except ValueError as exc:
+            raise ToolsServiceError(f"{exc!s}") from exc
+
+    async def _enable_added_server(self, name: str, server_config: dict) -> None:
+        try:
+            await self.tool_mgr.enable_mcp_server(name, server_config, timeout=30)
+        except TimeoutError as exc:
+            rollback_ok = self.rollback_mcp_server(name)
+            err_msg = f"Timed out while enabling MCP server {name}."
+            if not rollback_ok:
+                err_msg += (
+                    " Configuration rollback failed. Please check the config manually."
+                )
+            raise ToolsServiceError(err_msg) from exc
+        except Exception as exc:
+            logger.error(traceback.format_exc())
+            rollback_ok = self.rollback_mcp_server(name)
+            err_msg = f"Failed to enable MCP server {name}: {exc!s}"
+            if not rollback_ok:
+                err_msg += (
+                    " Configuration rollback failed. Please check the config manually."
+                )
+            raise ToolsServiceError(err_msg) from exc
+
+    async def _sync_updated_server_runtime(
+        self,
+        *,
+        name: str,
+        old_name: str,
+        active: bool,
+        is_rename: bool,
+        only_update_active: bool,
+        server_config: dict,
+    ) -> None:
+        if active:
+            if (
+                old_name in self.tool_mgr.mcp_server_runtime_view
+                or not only_update_active
+                or is_rename
+            ):
+                await self._disable_server_before_enable(old_name)
+            await self._enable_updated_server(name, server_config)
+        elif old_name in self.tool_mgr.mcp_server_runtime_view:
+            await self._disable_server(old_name)
+
+    async def _disable_server_before_enable(self, old_name: str) -> None:
+        try:
+            await self.tool_mgr.disable_mcp_server(old_name, timeout=10)
+        except TimeoutError as exc:
+            raise ToolsServiceError(
+                f"Timed out while disabling MCP server {old_name} before enabling: {exc!s}"
+            ) from exc
+        except Exception as exc:
+            logger.error(traceback.format_exc())
+            raise ToolsServiceError(
+                f"Failed to disable MCP server {old_name} before enabling: {exc!s}"
+            ) from exc
+
+    async def _enable_updated_server(self, name: str, server_config: dict) -> None:
+        try:
+            await self.tool_mgr.enable_mcp_server(name, server_config, timeout=30)
+        except TimeoutError as exc:
+            raise ToolsServiceError(
+                f"Timed out while enabling MCP server {name}."
+            ) from exc
+        except Exception as exc:
+            logger.error(traceback.format_exc())
+            raise ToolsServiceError(
+                f"Failed to enable MCP server {name}: {exc!s}"
+            ) from exc
+
+    async def _disable_server(self, name: str) -> None:
+        try:
+            await self.tool_mgr.disable_mcp_server(name, timeout=10)
+        except TimeoutError as exc:
+            raise ToolsServiceError(
+                f"Timed out while disabling MCP server {name}."
+            ) from exc
+        except Exception as exc:
+            logger.error(traceback.format_exc())
+            raise ToolsServiceError(
+                f"Failed to disable MCP server {name}: {exc!s}"
+            ) from exc
+
+    def _get_config_entries(self) -> list[dict]:
+        conf_list = self.core_lifecycle.astrbot_config_mgr.get_conf_list()
+        conf_name_map = {conf["id"]: conf["name"] for conf in conf_list}
+        config_entries = []
+        for conf_id, conf in self.core_lifecycle.astrbot_config_mgr.confs.items():
+            config_entries.append(
+                {
+                    "conf_id": conf_id,
+                    "conf_name": conf_name_map.get(conf_id, conf_id),
+                    "config": conf,
+                }
+            )
+        return config_entries
+
+    def _serialize_tool(self, tool, config_entries: list[dict]) -> dict:
+        readonly = False
+        builtin_config_statuses = []
+        builtin_config_tags = []
+        if self.tool_mgr.is_builtin_tool(tool.name):
+            origin = "builtin"
+            origin_name = "AstrBot Core"
+            readonly = True
+            builtin_config_statuses = get_builtin_tool_config_statuses(
+                tool.name,
+                config_entries,
+            )
+            builtin_config_tags = [
+                status for status in builtin_config_statuses if status["enabled"]
+            ]
+        elif isinstance(tool, MCPTool):
+            origin = "mcp"
+            origin_name = tool.mcp_server_name
+        elif tool.handler_module_path and star_map.get(tool.handler_module_path):
+            star = star_map[tool.handler_module_path]
+            origin = "plugin"
+            origin_name = star.name
+        else:
+            origin = "unknown"
+            origin_name = "unknown"
+
+        tool_info = {
+            "name": tool.name,
+            "description": tool.description,
+            "parameters": tool.parameters,
+            "active": tool.active,
+            "origin": origin,
+            "origin_name": origin_name,
+            "readonly": readonly,
+            "builtin_config_statuses": builtin_config_statuses,
+            "builtin_config_tags": builtin_config_tags,
+        }
+        if not readonly:
+            perms_store = sp.get(
+                "tool_permissions",
+                {},
+                scope="global",
+                scope_id="global",
+            )
+            defaults = (
+                perms_store.get("_default", {}) if isinstance(perms_store, dict) else {}
+            )
+            configured = tool.name in defaults
+            permission = defaults[tool.name] if configured else "member"
+            tool_info["permission"] = permission
+            tool_info["permission_configured"] = configured
+        return tool_info
diff --git a/astrbot/dashboard/services/update_service.py b/astrbot/dashboard/services/update_service.py
new file mode 100644
index 000000000..cd203bec4
--- /dev/null
+++ b/astrbot/dashboard/services/update_service.py
@@ -0,0 +1,400 @@
+from __future__ import annotations
+
+import traceback
+import uuid
+from collections.abc import Awaitable, Callable
+from dataclasses import dataclass
+from typing import Any
+
+from astrbot.core import (
+    DEMO_MODE as _DEMO_MODE,
+)
+from astrbot.core import (
+    logger,
+)
+from astrbot.core import (
+    pip_installer as _pip_installer,
+)
+from astrbot.core.config.default import VERSION
+from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
+from astrbot.core.db.migration.helper import (
+    check_migration_needed_v4 as _check_migration_needed_v4,
+)
+from astrbot.core.db.migration.helper import (
+    do_migration_v4 as _do_migration_v4,
+)
+from astrbot.core.updator import AstrBotUpdator
+from astrbot.core.utils.io import (
+    download_dashboard as _download_dashboard,
+)
+from astrbot.core.utils.io import (
+    get_dashboard_version as _get_dashboard_version,
+)
+
+DEMO_MODE = _DEMO_MODE
+pip_installer = _pip_installer
+download_dashboard = _download_dashboard
+get_dashboard_version = _get_dashboard_version
+default_check_migration_needed_v4 = _check_migration_needed_v4
+default_do_migration_v4 = _do_migration_v4
+
+
+async def call_download_dashboard(*args, **kwargs):
+    return await download_dashboard(*args, **kwargs)
+
+
+async def call_get_dashboard_version(*args, **kwargs):
+    return await get_dashboard_version(*args, **kwargs)
+
+
+async def call_pip_install(*args, **kwargs):
+    return await pip_installer.install(*args, **kwargs)
+
+
+async def call_check_migration_needed_v4(*args, **kwargs):
+    return await default_check_migration_needed_v4(*args, **kwargs)
+
+
+async def call_do_migration_v4(*args, **kwargs):
+    return await default_do_migration_v4(*args, **kwargs)
+
+
+@dataclass
+class UpdateServiceResult:
+    data: Any = None
+    message: str | None = None
+    status: str = "ok"
+    headers: dict | None = None
+
+
+class UpdateServiceError(Exception):
+    pass
+
+
+class UpdateService:
+    def __init__(
+        self,
+        astrbot_updator: AstrBotUpdator,
+        core_lifecycle: AstrBotCoreLifecycle,
+        *,
+        download_dashboard_func: Callable[..., Awaitable[Any]],
+        get_dashboard_version_func: Callable[..., Awaitable[str | None]],
+        pip_install_func: Callable[..., Awaitable[Any]],
+        check_migration_needed_func: Callable[..., Awaitable[bool]],
+        do_migration_func: Callable[..., Awaitable[Any]],
+        demo_mode: bool,
+        clear_site_data_headers: dict,
+    ) -> None:
+        self.astrbot_updator = astrbot_updator
+        self.core_lifecycle = core_lifecycle
+        self.download_dashboard = download_dashboard_func
+        self.get_dashboard_version = get_dashboard_version_func
+        self.pip_install = pip_install_func
+        self.check_migration_needed = check_migration_needed_func
+        self.do_migration = do_migration_func
+        self.demo_mode = demo_mode
+        self.clear_site_data_headers = clear_site_data_headers
+        self.update_progress: dict[str, dict] = {}
+
+    def get_update_progress(self, progress_id: str) -> UpdateServiceResult:
+        if not progress_id:
+            raise UpdateServiceError("缺少参数 id。")
+        progress = self.update_progress.get(progress_id)
+        if not progress:
+            return UpdateServiceResult(
+                data={"id": progress_id, "status": "idle"},
+                message="没有正在进行的更新。",
+            )
+        return UpdateServiceResult(data=progress)
+
+    async def do_migration_v4(self, data: object) -> UpdateServiceResult:
+        need_migration = await self.check_migration_needed(self.core_lifecycle.db)
+        if not need_migration:
+            return UpdateServiceResult(message="不需要进行迁移。")
+        try:
+            payload = data if isinstance(data, dict) else {}
+            platform_id_map = payload.get("platform_id_map", {})
+            await self.do_migration(
+                self.core_lifecycle.db,
+                platform_id_map,
+                self.core_lifecycle.astrbot_config,
+            )
+            return UpdateServiceResult(message="迁移成功。")
+        except Exception as exc:
+            logger.error(f"迁移失败: {traceback.format_exc()}")
+            raise UpdateServiceError(f"迁移失败: {exc!s}") from exc
+
+    async def check_update(self, update_type: str | None) -> UpdateServiceResult:
+        try:
+            dashboard_version = await self.get_dashboard_version()
+            if update_type == "dashboard":
+                return UpdateServiceResult(
+                    data={
+                        "has_new_version": dashboard_version != f"v{VERSION}",
+                        "current_version": dashboard_version,
+                    }
+                )
+            update_result = await self.astrbot_updator.check_update(None, None, False)
+            return UpdateServiceResult(
+                status="success",
+                message=str(update_result)
+                if update_result is not None
+                else "已经是最新版本了。",
+                data={
+                    "version": f"v{VERSION}",
+                    "has_new_version": update_result is not None,
+                    "dashboard_version": dashboard_version,
+                    "dashboard_has_new_version": bool(
+                        dashboard_version and dashboard_version != f"v{VERSION}"
+                    ),
+                },
+            )
+        except Exception as exc:
+            logger.warning(f"检查更新失败: {exc!s} (不影响除项目更新外的正常使用)")
+            raise UpdateServiceError(exc.__str__()) from exc
+
+    async def get_releases(self) -> UpdateServiceResult:
+        try:
+            releases = await self.astrbot_updator.get_releases()
+            return UpdateServiceResult(data=releases)
+        except Exception as exc:
+            logger.error(f"/api/update/releases: {traceback.format_exc()}")
+            raise UpdateServiceError(exc.__str__()) from exc
+
+    async def update_project(self, data: object) -> UpdateServiceResult:
+        payload = data if isinstance(data, dict) else {}
+        version = payload.get("version", "")
+        reboot = payload.get("reboot", True)
+        progress_id = payload.get("progress_id") or uuid.uuid4().hex
+        if version == "" or version == "latest":
+            latest = True
+            version = ""
+        else:
+            latest = False
+
+        proxy: str | None = payload.get("proxy", None)
+        if proxy:
+            proxy = proxy.removesuffix("/")
+
+        self._init_update_progress(progress_id, version)
+        try:
+            self._set_update_stage(
+                progress_id,
+                "dashboard",
+                "running",
+                "正在下载 WebUI...",
+                0,
+            )
+            await self.download_dashboard(
+                latest=latest,
+                version=version,
+                proxy=proxy or "",
+                progress_callback=self._make_progress_callback(
+                    progress_id,
+                    "dashboard",
+                    0,
+                    45,
+                ),
+            )
+            self._set_update_stage(
+                progress_id,
+                "dashboard",
+                "done",
+                "WebUI 下载完成。",
+                45,
+            )
+
+            self._set_update_stage(
+                progress_id,
+                "core",
+                "running",
+                "正在下载 AstrBot 项目代码...",
+                45,
+            )
+            await self.astrbot_updator.update(
+                latest=latest,
+                version=version,
+                proxy=proxy or "",
+                progress_callback=self._make_progress_callback(
+                    progress_id,
+                    "core",
+                    45,
+                    45,
+                ),
+            )
+            self._set_update_stage(
+                progress_id,
+                "core",
+                "done",
+                "项目代码下载完成。",
+                90,
+            )
+
+            self._set_update_stage(
+                progress_id,
+                "dependencies",
+                "running",
+                "正在更新依赖...",
+                92,
+            )
+            logger.info("更新依赖中...")
+            try:
+                await self.pip_install(requirements_path="requirements.txt")
+            except Exception as exc:
+                logger.error(f"更新依赖失败: {exc}")
+            self._set_update_stage(
+                progress_id,
+                "dependencies",
+                "done",
+                "依赖更新完成。",
+                96,
+            )
+
+            if reboot:
+                self._set_update_stage(
+                    progress_id,
+                    "restart",
+                    "running",
+                    "更新成功，正在准备重启...",
+                    98,
+                )
+                await self.core_lifecycle.restart()
+                message = "更新成功，AstrBot 将在 2 秒内全量重启以应用新的代码。"
+            else:
+                message = "更新成功，AstrBot 将在下次启动时应用新的代码。"
+
+            self.update_progress[progress_id].update(
+                {
+                    "status": "success",
+                    "stage": "done",
+                    "message": message,
+                    "overall_percent": 100,
+                },
+            )
+            return UpdateServiceResult(
+                message=message,
+                headers=self.clear_site_data_headers,
+            )
+        except Exception as exc:
+            self.update_progress[progress_id].update(
+                {
+                    "status": "error",
+                    "message": "更新失败，请查看服务端日志。",
+                },
+            )
+            logger.error(f"/api/update_project: {traceback.format_exc()}")
+            raise UpdateServiceError(exc.__str__()) from exc
+
+    async def update_dashboard(self) -> UpdateServiceResult:
+        try:
+            try:
+                await self.download_dashboard(version=f"v{VERSION}", latest=False)
+            except Exception as exc:
+                logger.error(f"下载管理面板文件失败: {exc}。")
+                raise UpdateServiceError(f"下载管理面板文件失败: {exc}") from exc
+            return UpdateServiceResult(
+                message="更新成功。刷新页面即可应用新版本面板。",
+                headers=self.clear_site_data_headers,
+            )
+        except UpdateServiceError:
+            raise
+        except Exception as exc:
+            logger.error(f"/api/update_dashboard: {traceback.format_exc()}")
+            raise UpdateServiceError(exc.__str__()) from exc
+
+    async def install_pip_package(self, data: object) -> UpdateServiceResult:
+        if self.demo_mode:
+            raise UpdateServiceError(
+                "You are not permitted to do this operation in demo mode"
+            )
+
+        payload = data if isinstance(data, dict) else {}
+        package = payload.get("package", "")
+        mirror = payload.get("mirror", None)
+        if not package:
+            raise UpdateServiceError("缺少参数 package 或不合法。")
+        try:
+            await self.pip_install(package, mirror=mirror)
+            return UpdateServiceResult(message="安装成功。")
+        except Exception as exc:
+            logger.error(f"/api/update_pip: {traceback.format_exc()}")
+            raise UpdateServiceError(exc.__str__()) from exc
+
+    def _init_update_progress(self, progress_id: str, version: str) -> None:
+        self.update_progress[progress_id] = {
+            "id": progress_id,
+            "status": "running",
+            "stage": "preparing",
+            "version": version or "latest",
+            "message": "正在准备更新...",
+            "overall_percent": 0,
+            "stages": {
+                "dashboard": self._empty_stage("pending"),
+                "core": self._empty_stage("pending"),
+            },
+        }
+
+    @staticmethod
+    def _empty_stage(status: str = "pending") -> dict:
+        return {
+            "status": status,
+            "downloaded": 0,
+            "total": 0,
+            "percent": 0,
+            "speed": 0,
+        }
+
+    def _set_update_stage(
+        self,
+        progress_id: str,
+        stage: str,
+        status: str,
+        message: str,
+        overall_percent: int | None = None,
+    ) -> None:
+        progress = self.update_progress.get(progress_id)
+        if not progress:
+            return
+        progress["stage"] = stage
+        progress["message"] = message
+        progress["stages"].setdefault(stage, self._empty_stage())
+        progress["stages"][stage]["status"] = status
+        if overall_percent is not None:
+            progress["overall_percent"] = overall_percent
+
+    @staticmethod
+    def _normalize_percent(value) -> int:
+        try:
+            percent = float(value or 0)
+        except (TypeError, ValueError):
+            return 0
+        if percent <= 1:
+            percent *= 100
+        return max(0, min(100, int(percent)))
+
+    def _make_progress_callback(
+        self,
+        progress_id: str,
+        stage: str,
+        stage_start: int,
+        stage_weight: int,
+    ):
+        def _callback(payload: dict) -> None:
+            progress = self.update_progress.get(progress_id)
+            if not progress:
+                return
+            stage_percent = self._normalize_percent(payload.get("percent"))
+            progress["stage"] = stage
+            progress["stages"][stage] = {
+                "status": "running" if stage_percent < 100 else "done",
+                "downloaded": payload.get("downloaded", 0),
+                "total": payload.get("total", 0),
+                "percent": stage_percent,
+                "speed": payload.get("speed", 0),
+            }
+            progress["overall_percent"] = min(
+                99,
+                stage_start + int(stage_percent * stage_weight / 100),
+            )
+
+        return _callback
diff --git a/astrbot/dashboard/utils.py b/astrbot/dashboard/utils.py
index f8b44d5a1..2f0189cd9 100644
--- a/astrbot/dashboard/utils.py
+++ b/astrbot/dashboard/utils.py
@@ -29,12 +29,12 @@ async def generate_tsne_visualization(
     """
     try:
         import faiss
-        import matplotlib
+        import matplotlib  # type: ignore[reportMissingImports]
         import numpy as np
 
         matplotlib.use("Agg")  # 使用非交互式后端
-        import matplotlib.pyplot as plt
-        from sklearn.manifold import TSNE
+        import matplotlib.pyplot as plt  # type: ignore[reportMissingImports]
+        from sklearn.manifold import TSNE  # type: ignore[reportMissingImports]
     except ImportError as e:
         raise Exception(
             "缺少必要的库以生成 t-SNE 可视化。请安装 matplotlib 和 scikit-learn: {e}",
diff --git a/dashboard/package.json b/dashboard/package.json
index 59d97e4f9..0e06446c4 100644
--- a/dashboard/package.json
+++ b/dashboard/package.json
@@ -10,11 +10,14 @@
     "build-stage": "node scripts/subset-mdi-font.mjs && vue-tsc --noEmit && vite build --base=/vue/free/stage/",
     "build-prod": "node scripts/subset-mdi-font.mjs && vue-tsc --noEmit && vite build --base=/vue/free/",
     "preview": "vite preview --port 5050",
+    "generate:api": "rm -rf src/api/generated/openapi-v1 src/api/generated/openapi-v1.ts && openapi-ts -i ../openspec/openapi-v1.yaml -o src/api/generated/openapi-v1 -c @hey-api/client-axios",
+    "generate:docs:openapi": "uv run python ../docs/scripts/update_openapi_json.py",
     "typecheck": "vue-tsc --noEmit",
     "lint": "eslint . --ext .vue,.js,.jsx,.cjs,.mjs,.ts,.tsx,.cts,.mts --fix --ignore-path .gitignore"
   },
   "dependencies": {
     "@guolao/vue-monaco-editor": "^1.5.4",
+    "@hey-api/client-axios": "0.2.12",
     "@tiptap/starter-kit": "2.1.7",
     "@tiptap/vue-3": "2.1.7",
     "apexcharts": "3.42.0",
@@ -47,6 +50,7 @@
     "yup": "1.2.0"
   },
   "devDependencies": {
+    "@hey-api/openapi-ts": "0.60.0",
     "@mdi/font": "7.2.96",
     "@rushstack/eslint-patch": "1.3.3",
     "@types/chance": "1.1.3",
diff --git a/dashboard/pnpm-lock.yaml b/dashboard/pnpm-lock.yaml
index 9fb493b1c..13607c36b 100644
--- a/dashboard/pnpm-lock.yaml
+++ b/dashboard/pnpm-lock.yaml
@@ -15,6 +15,9 @@ importers:
       '@guolao/vue-monaco-editor':
         specifier: ^1.5.4
         version: 1.6.0(monaco-editor@0.52.2)(vue@3.3.4)
+      '@hey-api/client-axios':
+        specifier: 0.2.12
+        version: 0.2.12(axios@1.13.5)
       '@tiptap/starter-kit':
         specifier: 2.1.7
         version: 2.1.7(@tiptap/pm@2.27.2)
@@ -83,7 +86,7 @@ importers:
         version: 4.11.3(vue@3.3.4)
       vite-plugin-vuetify:
         specifier: 2.1.3
-        version: 2.1.3(vite@6.4.1(@types/node@20.19.32)(sass@1.66.1)(terser@5.46.0))(vue@3.3.4)(vuetify@3.7.11)
+        version: 2.1.3(vite@6.4.1(@types/node@20.19.32)(jiti@2.7.0)(sass@1.66.1)(terser@5.46.0))(vue@3.3.4)(vuetify@3.7.11)
       vue:
         specifier: 3.3.4
         version: 3.3.4
@@ -106,6 +109,9 @@ importers:
         specifier: 1.2.0
         version: 1.2.0
     devDependencies:
+      '@hey-api/openapi-ts':
+        specifier: 0.60.0
+        version: 0.60.0(typescript@5.1.6)
       '@mdi/font':
         specifier: 7.2.96
         version: 7.2.96
@@ -126,7 +132,7 @@ importers:
         version: 20.19.32
       '@vitejs/plugin-vue':
         specifier: 5.2.4
-        version: 5.2.4(vite@6.4.1(@types/node@20.19.32)(sass@1.66.1)(terser@5.46.0))(vue@3.3.4)
+        version: 5.2.4(vite@6.4.1(@types/node@20.19.32)(jiti@2.7.0)(sass@1.66.1)(terser@5.46.0))(vue@3.3.4)
       '@vue/eslint-config-prettier':
         specifier: 8.0.0
         version: 8.0.0(@types/eslint@9.6.1)(eslint@8.48.0)(prettier@3.0.2)
@@ -159,10 +165,10 @@ importers:
         version: 5.1.6
       vite:
         specifier: 6.4.1
-        version: 6.4.1(@types/node@20.19.32)(sass@1.66.1)(terser@5.46.0)
+        version: 6.4.1(@types/node@20.19.32)(jiti@2.7.0)(sass@1.66.1)(terser@5.46.0)
       vite-plugin-webfont-dl:
         specifier: ^3.12.0
-        version: 3.12.0(vite@6.4.1(@types/node@20.19.32)(sass@1.66.1)(terser@5.46.0))
+        version: 3.12.0(vite@6.4.1(@types/node@20.19.32)(jiti@2.7.0)(sass@1.66.1)(terser@5.46.0))
       vue-cli-plugin-vuetify:
         specifier: 2.5.8
         version: 2.5.8(sass-loader@13.3.2(sass@1.66.1)(webpack@5.105.0))(vue@3.3.4)(vuetify-loader@2.0.0-alpha.9(@vue/compiler-sfc@3.3.4)(vue@3.3.4)(vuetify@3.7.11)(webpack@5.105.0))(webpack@5.105.0)
@@ -178,6 +184,10 @@ packages:
   '@antfu/install-pkg@1.1.0':
     resolution: {integrity: sha512-MGQsmw10ZyI+EJo45CdSER4zEb+p31LpDAFp2Z3gkSd1yqVZGi0Ebx++YTEMonJy4oChEMLsxZ64j8FH6sSqtQ==}
 
+  '@apidevtools/json-schema-ref-parser@11.7.3':
+    resolution: {integrity: sha512-WApSdLdXEBb/1FUPca2lteASewEfpjEYJ8oXZP+0gExK5qSfsEKBKcA+WjY6Q4wvXwyv0+W6Kvc372pSceib9w==}
+    engines: {node: '>= 16'}
+
   '@babel/helper-string-parser@7.27.1':
     resolution: {integrity: sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==}
     engines: {node: '>=6.9.0'}
@@ -419,6 +429,19 @@ packages:
       '@vue/composition-api':
         optional: true
 
+  '@hey-api/client-axios@0.2.12':
+    resolution: {integrity: sha512-lBehVhbnhvm41cFguZuy1FO+4x8NO3Qy/ooL0Jw4bdqTu21n7DmZMPsXEF0gL7/gNdTt4QkJGwaojy+8ExtE8w==}
+    deprecated: Starting with v0.73.0, this package is bundled directly inside @hey-api/openapi-ts.
+    peerDependencies:
+      axios: '>= 1.0.0 < 2'
+
+  '@hey-api/openapi-ts@0.60.0':
+    resolution: {integrity: sha512-6g7TuIQ40OluuKJOJGi4dVqa/EWGStcPMA1wGaKAWkEfzhepRINBR5FMlYrWB1bOeAQSrlZJyj0MHRQzY5D4sA==}
+    engines: {node: ^18.0.0 || >=20.0.0}
+    hasBin: true
+    peerDependencies:
+      typescript: ^5.x
+
   '@humanwhocodes/config-array@0.11.14':
     resolution: {integrity: sha512-3T8LkOmg45BV5FICb15QQMsyUSWrQ8AygVfC7ZG32zOalnqrilm018ZVCw0eapXux8FtA33q8PSRSstjee3jSg==}
     engines: {node: '>=10.10.0'}
@@ -466,6 +489,9 @@ packages:
   '@jridgewell/trace-mapping@0.3.31':
     resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
 
+  '@jsdevtools/ono@7.1.3':
+    resolution: {integrity: sha512-4JQNk+3mVzK3xh2rqd6RB4J46qUR19azEHBneZyTZM+c456qOrbbM/5xcR8huNCCcbVt7+UmizG6GuUvPvKUYg==}
+
   '@keyv/bigmap@1.3.1':
     resolution: {integrity: sha512-WbzE9sdmQtKy8vrNPa9BRnwZh5UF4s1KTmSK0KUVLo3eff5BlQNNWDnFOouNpKfPKDnms9xynJjsMYjMaT/aFQ==}
     engines: {node: '>= 18'}
@@ -1274,6 +1300,14 @@ packages:
   buffer-from@1.1.2:
     resolution: {integrity: sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==}
 
+  c12@2.0.1:
+    resolution: {integrity: sha512-Z4JgsKXHG37C6PYUtIxCfLJZvo6FyhHJoClwwb9ftUkLpPSkuYqn6Tr+vnaN8hymm0kIbcg6Ey3kv/Q71k5w/A==}
+    peerDependencies:
+      magicast: ^0.3.5
+    peerDependenciesMeta:
+      magicast:
+        optional: true
+
   cacheable@2.3.3:
     resolution: {integrity: sha512-iffYMX4zxKp54evOH27fm92hs+DeC1DhXmNVN8Tr94M/iZIV42dqTHSR2Ik4TOSPyOAwKr7Yu3rN9ALoLkbWyQ==}
 
@@ -1323,10 +1357,21 @@ packages:
     resolution: {integrity: sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==}
     engines: {node: '>= 8.10.0'}
 
+  chokidar@4.0.3:
+    resolution: {integrity: sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==}
+    engines: {node: '>= 14.16.0'}
+
+  chownr@2.0.0:
+    resolution: {integrity: sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==}
+    engines: {node: '>=10'}
+
   chrome-trace-event@1.0.4:
     resolution: {integrity: sha512-rNjApaLzuwaOTjCiT8lSDdGN1APCiqkChLMJxJPWLunPAt5fy8xgU9/jNOchV84wfIxrA0lRQB7oCT8jrn/wrQ==}
     engines: {node: '>=6.0'}
 
+  citty@0.1.6:
+    resolution: {integrity: sha512-tskPPKEs8D2KPafUypv2gxwJP8h/OaJmC82QQGGDQcHvXX43xF2VDACcJVmZ0EuSxkpO9Kc4MlrA3q0+FG58AQ==}
+
   clean-css@5.3.3:
     resolution: {integrity: sha512-D5J+kHaVb/wKSFcyyV75uCn8fiY4sV38XJoe4CUyGQ+mOU/fMVYUdH1hJC+CJQ5uY3EnW27SbJYS4X8BiLrAFg==}
     engines: {node: '>= 10.0'}
@@ -1348,6 +1393,10 @@ packages:
   comma-separated-tokens@2.0.3:
     resolution: {integrity: sha512-Fu4hJdvzeylCfQPp9SGWidpzrMs7tTrlu6Vb8XGaRGck8QSNZJJp538Wrb60Lax4fPwR64ViY468OIUTbRlGZg==}
 
+  commander@12.1.0:
+    resolution: {integrity: sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA==}
+    engines: {node: '>=18'}
+
   commander@2.20.3:
     resolution: {integrity: sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==}
 
@@ -1368,6 +1417,10 @@ packages:
   confbox@0.1.8:
     resolution: {integrity: sha512-RMtmw0iFkeR4YV+fUOSucriAQNb9g8zFR52MWCtl+cCZOFRNL6zeB395vPzFhEjjn4fMxXudmELnl/KF/WrK6w==}
 
+  consola@3.4.2:
+    resolution: {integrity: sha512-5IKcdX0nnYavi6G7TtOhwkYzyjfJlatbjMjuLSfE2kYT5pMDOilZ4OvMhi637CcDICTmz3wARPoyhqyX1Y+XvA==}
+    engines: {node: ^14.18.0 || >=16.10.0}
+
   cose-base@1.0.3:
     resolution: {integrity: sha512-s9whTXInMSgAp/NVXVNuVxVKzGH2qck3aQlVHxDCdAEPgtMKwc4Wq6/QKhgdEdgbLSi9rBTAcPoRa6JpiG4ksg==}
 
@@ -1574,6 +1627,9 @@ packages:
   deep-is@0.1.4:
     resolution: {integrity: sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==}
 
+  defu@6.1.7:
+    resolution: {integrity: sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==}
+
   delaunator@5.0.1:
     resolution: {integrity: sha512-8nvh+XBe96aCESrGOqMp/84b13H9cdKbG5P2ejQCh4d4sK9RL4371qou9drQjMhvnPmhWl5hnmqbEE0fXr9Xnw==}
 
@@ -1585,6 +1641,9 @@ packages:
     resolution: {integrity: sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==}
     engines: {node: '>=6'}
 
+  destr@2.0.5:
+    resolution: {integrity: sha512-ugFTXCtDZunbzasqBxrK93Ik/DRYsO6S/fedkWEMKqt04xZ4csmnmwGDBAb07QWNaGMAmnTIemsYZCksjATwsA==}
+
   devlop@1.1.0:
     resolution: {integrity: sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==}
 
@@ -1603,6 +1662,10 @@ packages:
     resolution: {integrity: sha512-6obghkliLdmKa56xdbLOpUZ43pAR6xFy1uOrxBaIDjT+yaRuuybLjGS9eVBoSR/UPU5fq3OXClEHLJNGvbxKpQ==}
     engines: {node: '>=20'}
 
+  dotenv@16.6.1:
+    resolution: {integrity: sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==}
+    engines: {node: '>=12'}
+
   dunder-proto@1.0.1:
     resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==}
     engines: {node: '>= 0.4'}
@@ -1822,6 +1885,10 @@ packages:
     resolution: {integrity: sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==}
     engines: {node: '>= 6'}
 
+  fs-minipass@2.1.0:
+    resolution: {integrity: sha512-V/JgOLFCS+R6Vcq0slCuaeWEdNC3ouDlJMNIsacH2VtALiu9mV4LPrHc5cDl8k5aw6J8jwgWWpiTo5RYhmIzvg==}
+    engines: {node: '>= 8'}
+
   fs.realpath@1.0.0:
     resolution: {integrity: sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==}
 
@@ -1845,6 +1912,10 @@ packages:
     resolution: {integrity: sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==}
     engines: {node: '>= 0.4'}
 
+  giget@1.2.5:
+    resolution: {integrity: sha512-r1ekGw/Bgpi3HLV3h1MRBIlSAdHoIMklpaQ3OQLFcRw9PwAj2rqigvIbg+dBUI51OxVI2jsEtDywDBjSiuf7Ug==}
+    hasBin: true
+
   glob-parent@5.1.2:
     resolution: {integrity: sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==}
     engines: {node: '>= 6'}
@@ -1881,6 +1952,11 @@ packages:
   hachure-fill@0.5.2:
     resolution: {integrity: sha512-3GKBOn+m2LX9iq+JC1064cSFprJY4jL1jCXTcpnfER5HYE2l/4EfWSGzkPa/ZDBmYI0ZOEj5VHV/eKnPGkHuOg==}
 
+  handlebars@4.7.8:
+    resolution: {integrity: sha512-vafaFqs8MZkRrSX7sFVUdo3ap/eNiLnb4IakshzvP56X5Nr1iGKAIqdX6tMlm6HcNRIkr6AxO5jFEoJzzpT8aQ==}
+    engines: {node: '>=0.4.7'}
+    hasBin: true
+
   harfbuzzjs@0.4.15:
     resolution: {integrity: sha512-p1edvnlc+vpRe2kz7OKzcscf0gyFiDZpco+miDxAiiZ67cu1oNlbuOkmP/A/i1l/w938VrkF2FdZ8scNcnkPrQ==}
 
@@ -2000,6 +2076,10 @@ packages:
     resolution: {integrity: sha512-7vuh85V5cdDofPyxn58nrPjBktZo0u9x1g8WtjQol+jZDaE+fhN+cIvTj11GndBnMnyfrUOG1sZQxCdjKh+DKg==}
     engines: {node: '>= 10.13.0'}
 
+  jiti@2.7.0:
+    resolution: {integrity: sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==}
+    hasBin: true
+
   js-yaml@4.1.1:
     resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==}
     hasBin: true
@@ -2204,6 +2284,26 @@ packages:
     resolution: {integrity: sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==}
     engines: {node: '>=16 || 14 >=14.17'}
 
+  minimist@1.2.8:
+    resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==}
+
+  minipass@3.3.6:
+    resolution: {integrity: sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==}
+    engines: {node: '>=8'}
+
+  minipass@5.0.0:
+    resolution: {integrity: sha512-3FnjYuehv9k6ovOEbyOswadCDPX1piCfhV8ncmYtHOjuPwylVWsghTLo7rabjC3Rx5xD4HDx8Wm1xnMF7S5qFQ==}
+    engines: {node: '>=8'}
+
+  minizlib@2.1.2:
+    resolution: {integrity: sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg==}
+    engines: {node: '>= 8'}
+
+  mkdirp@1.0.4:
+    resolution: {integrity: sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==}
+    engines: {node: '>=10'}
+    hasBin: true
+
   mlly@1.8.0:
     resolution: {integrity: sha512-l8D9ODSRWLe2KHJSifWGwBqpTZXIXTeo8mlKjY+E2HAakaTeNpqAyBZ8GSqLzHgw4XmHmC8whvpjJNMbFZN7/g==}
 
@@ -2230,6 +2330,9 @@ packages:
   neo-async@2.6.2:
     resolution: {integrity: sha512-Yd3UES5mWCSqR+qNT93S3UoYUkqAZ9lLg8a7g9rimsWmYGK8cVToA4/sF3RrshdyV3sAGMXVUmpMYOw+dLpOuw==}
 
+  node-fetch-native@1.6.7:
+    resolution: {integrity: sha512-g9yhqoedzIUm0nTnTqAQvueMPVOuIY16bqgAJJC8XOOubYFNwz6IER9qs0Gq2Xd0+CecCKFjtdDTMA4u4xG06Q==}
+
   node-releases@2.0.36:
     resolution: {integrity: sha512-TdC8FSgHz8Mwtw9g5L4gR/Sh9XhSP/0DEkQxfEFXOpiul5IiHgHan2VhYYb6agDSfp4KuvltmGApc8HMgUrIkA==}
 
@@ -2246,6 +2349,14 @@ packages:
     peerDependencies:
       webpack: ^4.0.0 || ^5.0.0
 
+  nypm@0.5.4:
+    resolution: {integrity: sha512-X0SNNrZiGU8/e/zAB7sCTtdxWTMSIO73q+xuKgglm2Yvzwlo8UoC5FNySQFCvl84uPaeADkqHUZUkWy4aH4xOA==}
+    engines: {node: ^14.16.0 || >=16.10.0}
+    hasBin: true
+
+  ohash@1.1.6:
+    resolution: {integrity: sha512-TBu7PtV8YkAZn0tSxobKY2n2aAQva936lhRrj6957aDaCf9IEtqsKbgMzXE/F/sjqYOwmrukeORHNLe5glk7Cg==}
+
   once@1.4.0:
     resolution: {integrity: sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==}
 
@@ -2317,9 +2428,15 @@ packages:
     resolution: {integrity: sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==}
     engines: {node: '>=8'}
 
+  pathe@1.1.2:
+    resolution: {integrity: sha512-whLdWMYL2TwI08hn8/ZqAbrVemu0LNaNNJZX73O6qaIdCTfXutsLhMkjdENX0qhsQ9uIimo4/aQOmXkoon2nDQ==}
+
   pathe@2.0.3:
     resolution: {integrity: sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==}
 
+  perfect-debounce@1.0.0:
+    resolution: {integrity: sha512-xCy9V055GLEqoFaHoC1SoLIaLmWctgCUaBaWxDZ7/Zx4CTyX7cJQLJOok/orfjZAh9kEYpjJa4d0KcJmCbctZA==}
+
   picocolors@1.1.1:
     resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
 
@@ -2476,10 +2593,17 @@ packages:
   queue-microtask@1.2.3:
     resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}
 
+  rc9@2.1.2:
+    resolution: {integrity: sha512-btXCnMmRIBINM2LDZoEmOogIZU7Qe7zn4BpomSKZ/ykbLObuBdvG+mFq11DL6fjH1DRwHhrlgtYWG96bJiC7Cg==}
+
   readdirp@3.6.0:
     resolution: {integrity: sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==}
     engines: {node: '>=8.10.0'}
 
+  readdirp@4.1.2:
+    resolution: {integrity: sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==}
+    engines: {node: '>= 14.18.0'}
+
   rechoir@0.6.2:
     resolution: {integrity: sha512-HFM8rkZ+i3zrV+4LQjwQ0W+ez98pApMGM3HUrN04j3CqzPOzl9nmP15Y8YXNm8QHGv/eacOVEjqhmWpkRV0NAw==}
     engines: {node: '>= 0.10'}
@@ -2720,6 +2844,11 @@ packages:
     resolution: {integrity: sha512-g9ljZiwki/LfxmQADO3dEY1CbpmXT5Hm2fJ+QaGKwSXUylMybePR7/67YW7jOrrvjEgL1Fmz5kzyAjWVWLlucg==}
     engines: {node: '>=6'}
 
+  tar@6.2.1:
+    resolution: {integrity: sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==}
+    engines: {node: '>=10'}
+    deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
+
   terser-webpack-plugin@5.4.0:
     resolution: {integrity: sha512-Bn5vxm48flOIfkdl5CaD2+1CiUVbonWQ3KQPyP7/EuIl9Gbzq/gQFOzaMFUEgVjB1396tcK0SG8XcNJ/2kDH8g==}
     engines: {node: '>= 10.13.0'}
@@ -2747,6 +2876,9 @@ packages:
   tiny-case@1.0.3:
     resolution: {integrity: sha512-Eet/eeMhkO6TX8mnUteS9zgPbUMQa4I6Kkp5ORiBD5476/m+PIRiumP5tmh5ioJpH7k51Kehawy2UDfsnxxY8Q==}
 
+  tinyexec@0.3.2:
+    resolution: {integrity: sha512-KQQR9yN7R5+OSwaK0XQoj22pwHoTlgYqmUscPYoknOoWCWfj/5/ABTMRi69FrKU5ffPVh5QcFikpWJI/P1ocHA==}
+
   tinyexec@1.0.2:
     resolution: {integrity: sha512-W/KYk+NFhkmsYpuHq5JykngiOCnxeVL8v8dFnqxSD8qEEdRfXk1SDM6JzNqcERbcGYj9tMrDQBYV9cjgnunFIg==}
     engines: {node: '>=18'}
@@ -2808,6 +2940,11 @@ packages:
   ufo@1.6.3:
     resolution: {integrity: sha512-yDJTmhydvl5lJzBmy/hyOAA0d+aqCBuwl818haVdYCRrWV84o7YyeVm4QlVHStqNrrJSTb6jKuFAVqAFsr+K3Q==}
 
+  uglify-js@3.19.3:
+    resolution: {integrity: sha512-v3Xu+yuwBXisp6QYTcH4UbH+xYJXqnq2m/LtQVWKWzYc1iehYnLixoQDN9FH6/j9/oybfd6W9Ghwkl8+UMKTKQ==}
+    engines: {node: '>=0.8.0'}
+    hasBin: true
+
   undici-types@6.21.0:
     resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}
 
@@ -3057,6 +3194,9 @@ packages:
     resolution: {integrity: sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==}
     engines: {node: '>=0.10.0'}
 
+  wordwrap@1.0.0:
+    resolution: {integrity: sha512-gvVzJFlPycKc5dZN4yPkP8w7Dc37BtP1yczEneOb4uq34pXZcvrtRTmWV8W+Ume+XCxKgbjM+nevkyFPMybd4Q==}
+
   wrap-ansi@6.2.0:
     resolution: {integrity: sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA==}
     engines: {node: '>=8'}
@@ -3071,6 +3211,9 @@ packages:
   y18n@4.0.3:
     resolution: {integrity: sha512-JKhqTOwSrqNA1NY5lSztJ1GrBiUodLMmIZuLiDaMRJ+itFd+ABVE8XBjOvIWL+rSqNDC74LCSFmlb/U4UZ4hJQ==}
 
+  yallist@4.0.0:
+    resolution: {integrity: sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==}
+
   yargs-parser@18.1.3:
     resolution: {integrity: sha512-o50j0JeToy/4K6OZcaQmW6lyXXKhq7csREXcDwk2omFPJEwUNOVtJKvmDr9EI1fAJZUyZcRF7kxGBWmRXudrCQ==}
     engines: {node: '>=6'}
@@ -3096,6 +3239,12 @@ snapshots:
       package-manager-detector: 1.6.0
       tinyexec: 1.0.2
 
+  '@apidevtools/json-schema-ref-parser@11.7.3':
+    dependencies:
+      '@jsdevtools/ono': 7.1.3
+      '@types/json-schema': 7.0.15
+      js-yaml: 4.1.1
+
   '@babel/helper-string-parser@7.27.1': {}
 
   '@babel/helper-validator-identifier@7.28.5': {}
@@ -3263,6 +3412,20 @@ snapshots:
       vue: 3.3.4
       vue-demi: 0.14.10(vue@3.3.4)
 
+  '@hey-api/client-axios@0.2.12(axios@1.13.5)':
+    dependencies:
+      axios: 1.13.5
+
+  '@hey-api/openapi-ts@0.60.0(typescript@5.1.6)':
+    dependencies:
+      '@apidevtools/json-schema-ref-parser': 11.7.3
+      c12: 2.0.1
+      commander: 12.1.0
+      handlebars: 4.7.8
+      typescript: 5.1.6
+    transitivePeerDependencies:
+      - magicast
+
   '@humanwhocodes/config-array@0.11.14':
     dependencies:
       '@humanwhocodes/object-schema': 2.0.3
@@ -3314,6 +3477,8 @@ snapshots:
       '@jridgewell/resolve-uri': 3.1.2
       '@jridgewell/sourcemap-codec': 1.5.5
 
+  '@jsdevtools/ono@7.1.3': {}
+
   '@keyv/bigmap@1.3.1(keyv@5.6.0)':
     dependencies:
       hashery: 1.5.0
@@ -3863,9 +4028,9 @@ snapshots:
 
   '@ungap/structured-clone@1.3.0': {}
 
-  '@vitejs/plugin-vue@5.2.4(vite@6.4.1(@types/node@20.19.32)(sass@1.66.1)(terser@5.46.0))(vue@3.3.4)':
+  '@vitejs/plugin-vue@5.2.4(vite@6.4.1(@types/node@20.19.32)(jiti@2.7.0)(sass@1.66.1)(terser@5.46.0))(vue@3.3.4)':
     dependencies:
-      vite: 6.4.1(@types/node@20.19.32)(sass@1.66.1)(terser@5.46.0)
+      vite: 6.4.1(@types/node@20.19.32)(jiti@2.7.0)(sass@1.66.1)(terser@5.46.0)
       vue: 3.3.4
 
   '@volar/language-core@1.10.10':
@@ -4214,6 +4379,21 @@ snapshots:
 
   buffer-from@1.1.2: {}
 
+  c12@2.0.1:
+    dependencies:
+      chokidar: 4.0.3
+      confbox: 0.1.8
+      defu: 6.1.7
+      dotenv: 16.6.1
+      giget: 1.2.5
+      jiti: 2.7.0
+      mlly: 1.8.0
+      ohash: 1.1.6
+      pathe: 1.1.2
+      perfect-debounce: 1.0.0
+      pkg-types: 1.3.1
+      rc9: 2.1.2
+
   cacheable@2.3.3:
     dependencies:
       '@cacheable/memory': 2.0.8
@@ -4274,8 +4454,18 @@ snapshots:
     optionalDependencies:
       fsevents: 2.3.3
 
+  chokidar@4.0.3:
+    dependencies:
+      readdirp: 4.1.2
+
+  chownr@2.0.0: {}
+
   chrome-trace-event@1.0.4: {}
 
+  citty@0.1.6:
+    dependencies:
+      consola: 3.4.2
+
   clean-css@5.3.3:
     dependencies:
       source-map: 0.6.1
@@ -4298,6 +4488,8 @@ snapshots:
 
   comma-separated-tokens@2.0.3: {}
 
+  commander@12.1.0: {}
+
   commander@2.20.3: {}
 
   commander@7.2.0: {}
@@ -4310,6 +4502,8 @@ snapshots:
 
   confbox@0.1.8: {}
 
+  consola@3.4.2: {}
+
   cose-base@1.0.3:
     dependencies:
       layout-base: 1.0.2
@@ -4534,6 +4728,8 @@ snapshots:
 
   deep-is@0.1.4: {}
 
+  defu@6.1.7: {}
+
   delaunator@5.0.1:
     dependencies:
       robust-predicates: 3.0.2
@@ -4542,6 +4738,8 @@ snapshots:
 
   dequal@2.0.3: {}
 
+  destr@2.0.5: {}
+
   devlop@1.1.0:
     dependencies:
       dequal: 2.0.3
@@ -4560,6 +4758,8 @@ snapshots:
     optionalDependencies:
       '@types/trusted-types': 2.0.7
 
+  dotenv@16.6.1: {}
+
   dunder-proto@1.0.1:
     dependencies:
       call-bind-apply-helpers: 1.0.2
@@ -4823,6 +5023,10 @@ snapshots:
       hasown: 2.0.2
       mime-types: 2.1.35
 
+  fs-minipass@2.1.0:
+    dependencies:
+      minipass: 3.3.6
+
   fs.realpath@1.0.0: {}
 
   fsevents@2.3.3:
@@ -4850,6 +5054,16 @@ snapshots:
       dunder-proto: 1.0.1
       es-object-atoms: 1.1.1
 
+  giget@1.2.5:
+    dependencies:
+      citty: 0.1.6
+      consola: 3.4.2
+      defu: 6.1.7
+      node-fetch-native: 1.6.7
+      nypm: 0.5.4
+      pathe: 2.0.3
+      tar: 6.2.1
+
   glob-parent@5.1.2:
     dependencies:
       is-glob: 4.0.3
@@ -4890,6 +5104,15 @@ snapshots:
 
   hachure-fill@0.5.2: {}
 
+  handlebars@4.7.8:
+    dependencies:
+      minimist: 1.2.8
+      neo-async: 2.6.2
+      source-map: 0.6.1
+      wordwrap: 1.0.0
+    optionalDependencies:
+      uglify-js: 3.19.3
+
   harfbuzzjs@0.4.15: {}
 
   has-flag@4.0.0: {}
@@ -4992,6 +5215,8 @@ snapshots:
       merge-stream: 2.0.0
       supports-color: 8.1.1
 
+  jiti@2.7.0: {}
+
   js-yaml@4.1.1:
     dependencies:
       argparse: 2.0.1
@@ -5202,6 +5427,21 @@ snapshots:
     dependencies:
       brace-expansion: 2.0.2
 
+  minimist@1.2.8: {}
+
+  minipass@3.3.6:
+    dependencies:
+      yallist: 4.0.0
+
+  minipass@5.0.0: {}
+
+  minizlib@2.1.2:
+    dependencies:
+      minipass: 3.3.6
+      yallist: 4.0.0
+
+  mkdirp@1.0.4: {}
+
   mlly@1.8.0:
     dependencies:
       acorn: 8.15.0
@@ -5223,6 +5463,8 @@ snapshots:
 
   neo-async@2.6.2: {}
 
+  node-fetch-native@1.6.7: {}
+
   node-releases@2.0.36: {}
 
   normalize-path@3.0.0: {}
@@ -5237,6 +5479,17 @@ snapshots:
       schema-utils: 3.3.0
       webpack: 5.105.0
 
+  nypm@0.5.4:
+    dependencies:
+      citty: 0.1.6
+      consola: 3.4.2
+      pathe: 2.0.3
+      pkg-types: 1.3.1
+      tinyexec: 0.3.2
+      ufo: 1.6.3
+
+  ohash@1.1.6: {}
+
   once@1.4.0:
     dependencies:
       wrappy: 1.0.2
@@ -5300,8 +5553,12 @@ snapshots:
 
   path-type@4.0.0: {}
 
+  pathe@1.1.2: {}
+
   pathe@2.0.3: {}
 
+  perfect-debounce@1.0.0: {}
+
   picocolors@1.1.1: {}
 
   picomatch@2.3.1: {}
@@ -5483,10 +5740,17 @@ snapshots:
 
   queue-microtask@1.2.3: {}
 
+  rc9@2.1.2:
+    dependencies:
+      defu: 6.1.7
+      destr: 2.0.5
+
   readdirp@3.6.0:
     dependencies:
       picomatch: 2.3.1
 
+  readdirp@4.1.2: {}
+
   rechoir@0.6.2:
     dependencies:
       resolve: 1.22.11
@@ -5740,6 +6004,15 @@ snapshots:
 
   tapable@2.3.0: {}
 
+  tar@6.2.1:
+    dependencies:
+      chownr: 2.0.0
+      fs-minipass: 2.1.0
+      minipass: 5.0.0
+      minizlib: 2.1.2
+      mkdirp: 1.0.4
+      yallist: 4.0.0
+
   terser-webpack-plugin@5.4.0(webpack@5.105.0):
     dependencies:
       '@jridgewell/trace-mapping': 0.3.31
@@ -5759,6 +6032,8 @@ snapshots:
 
   tiny-case@1.0.3: {}
 
+  tinyexec@0.3.2: {}
+
   tinyexec@1.0.2: {}
 
   tinyglobby@0.2.15:
@@ -5803,6 +6078,9 @@ snapshots:
 
   ufo@1.6.3: {}
 
+  uglify-js@3.19.3:
+    optional: true
+
   undici-types@6.21.0: {}
 
   unist-util-is@6.0.1:
@@ -5860,28 +6138,28 @@ snapshots:
       '@types/unist': 3.0.3
       vfile-message: 4.0.3
 
-  vite-plugin-vuetify@2.1.3(vite@6.4.1(@types/node@20.19.32)(sass@1.66.1)(terser@5.46.0))(vue@3.3.4)(vuetify@3.7.11):
+  vite-plugin-vuetify@2.1.3(vite@6.4.1(@types/node@20.19.32)(jiti@2.7.0)(sass@1.66.1)(terser@5.46.0))(vue@3.3.4)(vuetify@3.7.11):
     dependencies:
       '@vuetify/loader-shared': 2.1.2(vue@3.3.4)(vuetify@3.7.11)
       debug: 4.4.3
       upath: 2.0.1
-      vite: 6.4.1(@types/node@20.19.32)(sass@1.66.1)(terser@5.46.0)
+      vite: 6.4.1(@types/node@20.19.32)(jiti@2.7.0)(sass@1.66.1)(terser@5.46.0)
       vue: 3.3.4
       vuetify: 3.7.11(typescript@5.1.6)(vite-plugin-vuetify@2.1.3)(vue@3.3.4)
     transitivePeerDependencies:
       - supports-color
 
-  vite-plugin-webfont-dl@3.12.0(vite@6.4.1(@types/node@20.19.32)(sass@1.66.1)(terser@5.46.0)):
+  vite-plugin-webfont-dl@3.12.0(vite@6.4.1(@types/node@20.19.32)(jiti@2.7.0)(sass@1.66.1)(terser@5.46.0)):
     dependencies:
       axios: 1.13.5
       clean-css: 5.3.3
       flat-cache: 6.1.20
       picocolors: 1.1.1
-      vite: 6.4.1(@types/node@20.19.32)(sass@1.66.1)(terser@5.46.0)
+      vite: 6.4.1(@types/node@20.19.32)(jiti@2.7.0)(sass@1.66.1)(terser@5.46.0)
     transitivePeerDependencies:
       - debug
 
-  vite@6.4.1(@types/node@20.19.32)(sass@1.66.1)(terser@5.46.0):
+  vite@6.4.1(@types/node@20.19.32)(jiti@2.7.0)(sass@1.66.1)(terser@5.46.0):
     dependencies:
       esbuild: 0.25.12
       fdir: 6.5.0(picomatch@4.0.3)
@@ -5892,6 +6170,7 @@ snapshots:
     optionalDependencies:
       '@types/node': 20.19.32
       fsevents: 2.3.3
+      jiti: 2.7.0
       sass: 1.66.1
       terser: 5.46.0
 
@@ -6002,7 +6281,7 @@ snapshots:
       vue: 3.3.4
     optionalDependencies:
       typescript: 5.1.6
-      vite-plugin-vuetify: 2.1.3(vite@6.4.1(@types/node@20.19.32)(sass@1.66.1)(terser@5.46.0))(vue@3.3.4)(vuetify@3.7.11)
+      vite-plugin-vuetify: 2.1.3(vite@6.4.1(@types/node@20.19.32)(jiti@2.7.0)(sass@1.66.1)(terser@5.46.0))(vue@3.3.4)(vuetify@3.7.11)
 
   w3c-keyname@2.2.8: {}
 
@@ -6061,6 +6340,8 @@ snapshots:
 
   word-wrap@1.2.5: {}
 
+  wordwrap@1.0.0: {}
+
   wrap-ansi@6.2.0:
     dependencies:
       ansi-styles: 4.3.0
@@ -6073,6 +6354,8 @@ snapshots:
 
   y18n@4.0.3: {}
 
+  yallist@4.0.0: {}
+
   yargs-parser@18.1.3:
     dependencies:
       camelcase: 5.3.1
diff --git a/dashboard/src/api/generated/openapi-v1/index.ts b/dashboard/src/api/generated/openapi-v1/index.ts
new file mode 100644
index 000000000..81abc8221
--- /dev/null
+++ b/dashboard/src/api/generated/openapi-v1/index.ts
@@ -0,0 +1,3 @@
+// This file is auto-generated by @hey-api/openapi-ts
+export * from './sdk.gen';
+export * from './types.gen';
\ No newline at end of file
diff --git a/dashboard/src/api/generated/openapi-v1/sdk.gen.ts b/dashboard/src/api/generated/openapi-v1/sdk.gen.ts
new file mode 100644
index 000000000..736f7f8e5
--- /dev/null
+++ b/dashboard/src/api/generated/openapi-v1/sdk.gen.ts
@@ -0,0 +1,3051 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+import { createClient, createConfig, type OptionsLegacyParser, formDataBodySerializer } from '@hey-api/client-axios';
+import type { LoginData, LoginError, LoginResponse, LogoutError, LogoutResponse, GetAuthSetupStatusError, GetAuthSetupStatusResponse, SetupAuthData, SetupAuthError, SetupAuthResponse, SetupTotpData, SetupTotpError, SetupTotpResponse, RecoverTotpError, RecoverTotpResponse, UpdateAuthAccountData, UpdateAuthAccountError, UpdateAuthAccountResponse, ListApiKeysError, ListApiKeysResponse, CreateApiKeyData, CreateApiKeyError, CreateApiKeyResponse, RevokeApiKeyData, RevokeApiKeyError, RevokeApiKeyResponse, DeleteApiKeyData, DeleteApiKeyError, DeleteApiKeyResponse, GetSystemConfigSchemaError, GetSystemConfigSchemaResponse, GetSystemConfigError, GetSystemConfigResponse, UpdateSystemConfigData, UpdateSystemConfigError, UpdateSystemConfigResponse, GetSystemConfigRuntimeError, GetSystemConfigRuntimeResponse, GetConfigProfileSchemaError, GetConfigProfileSchemaResponse, ListConfigProfilesError, ListConfigProfilesResponse, CreateConfigProfileData, CreateConfigProfileError, CreateConfigProfileResponse, GetConfigProfileData, GetConfigProfileError, GetConfigProfileResponse, UpdateConfigProfileContentData, UpdateConfigProfileContentError, UpdateConfigProfileContentResponse, RenameConfigProfileData, RenameConfigProfileError, RenameConfigProfileResponse, DeleteConfigProfileData, DeleteConfigProfileError, DeleteConfigProfileResponse, ListConfigRoutesError, ListConfigRoutesResponse, ReplaceConfigRoutesData, ReplaceConfigRoutesError, ReplaceConfigRoutesResponse, UpsertConfigRouteData, UpsertConfigRouteError, UpsertConfigRouteResponse, DeleteConfigRouteData, DeleteConfigRouteError, DeleteConfigRouteResponse, ListBotTypesError, ListBotTypesResponse, RegisterBotTypeData, RegisterBotTypeError, RegisterBotTypeResponse, ListBotsData, ListBotsError, ListBotsResponse, CreateBotData, CreateBotError, CreateBotResponse, ListBotStatsError, ListBotStatsResponse, GetBotByIdData, GetBotByIdError, GetBotByIdResponse, UpdateBotByIdData, UpdateBotByIdError, UpdateBotByIdResponse, DeleteBotByIdData, DeleteBotByIdError, DeleteBotByIdResponse, SetBotEnabledByIdData, SetBotEnabledByIdError, SetBotEnabledByIdResponse, TestBotByIdData, TestBotByIdError, TestBotByIdResponse, GetBotData, GetBotError, GetBotResponse, UpdateBotData, UpdateBotError, UpdateBotResponse, DeleteBotData, DeleteBotError, DeleteBotResponse, SetBotEnabledData, SetBotEnabledError, SetBotEnabledResponse, TestBotData, TestBotError, TestBotResponse, GetProviderSchemaError, GetProviderSchemaResponse, ListProviderSourcesError, ListProviderSourcesResponse, CreateProviderSourceData, CreateProviderSourceError, CreateProviderSourceResponse, GetProviderSourceByIdData, GetProviderSourceByIdError, GetProviderSourceByIdResponse, UpsertProviderSourceByIdData, UpsertProviderSourceByIdError, UpsertProviderSourceByIdResponse, DeleteProviderSourceByIdData, DeleteProviderSourceByIdError, DeleteProviderSourceByIdResponse, ListProviderSourceModelsByIdData, ListProviderSourceModelsByIdError, ListProviderSourceModelsByIdResponse, ListProvidersBySourceIdData, ListProvidersBySourceIdError, ListProvidersBySourceIdResponse, CreateProviderInSourceByIdData, CreateProviderInSourceByIdError, CreateProviderInSourceByIdResponse, GetProviderSourceData, GetProviderSourceError, GetProviderSourceResponse, UpsertProviderSourceData, UpsertProviderSourceError, UpsertProviderSourceResponse, DeleteProviderSourceData, DeleteProviderSourceError, DeleteProviderSourceResponse, ListProviderSourceModelsData, ListProviderSourceModelsError, ListProviderSourceModelsResponse, ListProvidersBySourceData, ListProvidersBySourceError, ListProvidersBySourceResponse, CreateProviderInSourceData, CreateProviderInSourceError, CreateProviderInSourceResponse, ListProvidersData, ListProvidersError, ListProvidersResponse, CreateProviderData, CreateProviderError, CreateProviderResponse, GetProviderByIdData, GetProviderByIdError, GetProviderByIdResponse, UpdateProviderByIdData, UpdateProviderByIdError, UpdateProviderByIdResponse, DeleteProviderByIdData, DeleteProviderByIdError, DeleteProviderByIdResponse, SetProviderEnabledByIdData, SetProviderEnabledByIdError, SetProviderEnabledByIdResponse, TestProviderByIdData, TestProviderByIdError, TestProviderByIdResponse, GetProviderEmbeddingDimensionByIdData, GetProviderEmbeddingDimensionByIdError, GetProviderEmbeddingDimensionByIdResponse, GetProviderData, GetProviderError, GetProviderResponse, UpdateProviderData, UpdateProviderError, UpdateProviderResponse, DeleteProviderData, DeleteProviderError, DeleteProviderResponse, SetProviderEnabledData, SetProviderEnabledError, SetProviderEnabledResponse, TestProviderData, TestProviderError, TestProviderResponse, GetProviderEmbeddingDimensionData, GetProviderEmbeddingDimensionError, GetProviderEmbeddingDimensionResponse, SendChatMessageData, SendChatMessageError, SendChatMessageResponse, OpenChatWebSocketData, OpenLiveChatWebSocketData, OpenUnifiedChatWebSocketData, ListChatSessionsData, ListChatSessionsError, ListChatSessionsResponse, CreateChatSessionData, CreateChatSessionError, CreateChatSessionResponse, BatchDeleteChatSessionsData, BatchDeleteChatSessionsError, BatchDeleteChatSessionsResponse, GetChatSessionData, GetChatSessionError, GetChatSessionResponse, UpdateChatSessionData, UpdateChatSessionError, UpdateChatSessionResponse, DeleteChatSessionData, DeleteChatSessionError, DeleteChatSessionResponse, StopChatSessionData, StopChatSessionError, StopChatSessionResponse, UpdateChatMessageData, UpdateChatMessageError, UpdateChatMessageResponse, RegenerateChatMessageData, RegenerateChatMessageError, RegenerateChatMessageResponse, ListChatConfigsError, ListChatConfigsResponse, CreateChatThreadData, CreateChatThreadError, CreateChatThreadResponse, GetChatThreadData, GetChatThreadError, GetChatThreadResponse, DeleteChatThreadData, DeleteChatThreadError, DeleteChatThreadResponse, SendChatThreadMessageData, SendChatThreadMessageError, SendChatThreadMessageResponse, ListChatProjectsError, ListChatProjectsResponse, CreateChatProjectData, CreateChatProjectError, CreateChatProjectResponse, GetChatProjectData, GetChatProjectError, GetChatProjectResponse, UpdateChatProjectData, UpdateChatProjectError, UpdateChatProjectResponse, DeleteChatProjectData, DeleteChatProjectError, DeleteChatProjectResponse, ListChatProjectSessionsData, ListChatProjectSessionsError, ListChatProjectSessionsResponse, AddChatProjectSessionData, AddChatProjectSessionError, AddChatProjectSessionResponse, RemoveChatProjectSessionData, RemoveChatProjectSessionError, RemoveChatProjectSessionResponse, SendImMessageData, SendImMessageError, SendImMessageResponse, ListImBotsError, ListImBotsResponse, UploadFileData, UploadFileError, UploadFileResponse, GetFileByNameData, GetFileByNameError, GetFileByNameResponse, GetTokenFileData, GetTokenFileError, GetTokenFileResponse, GetAttachmentData, GetAttachmentError, GetAttachmentResponse, DeleteAttachmentData, DeleteAttachmentError, DeleteAttachmentResponse, DownloadAttachmentData, DownloadAttachmentError, DownloadAttachmentResponse, ListPluginsData, ListPluginsError, ListPluginsResponse, GetPluginByIdData, GetPluginByIdError, GetPluginByIdResponse, UninstallPluginByIdData, UninstallPluginByIdError, UninstallPluginByIdResponse, GetPluginConfigByIdData, GetPluginConfigByIdError, GetPluginConfigByIdResponse, UpdatePluginConfigByIdData, UpdatePluginConfigByIdError, UpdatePluginConfigByIdResponse, GetPluginConfigSchemaByIdData, GetPluginConfigSchemaByIdError, GetPluginConfigSchemaByIdResponse, ListPluginConfigFilesByIdData, ListPluginConfigFilesByIdError, ListPluginConfigFilesByIdResponse, UploadPluginConfigFilesByIdData, UploadPluginConfigFilesByIdError, UploadPluginConfigFilesByIdResponse, DeletePluginConfigFileByIdData, DeletePluginConfigFileByIdError, DeletePluginConfigFileByIdResponse, GetPluginReadmeByIdData, GetPluginReadmeByIdError, GetPluginReadmeByIdResponse, GetPluginChangelogByIdData, GetPluginChangelogByIdError, GetPluginChangelogByIdResponse, ReloadPluginByIdData, ReloadPluginByIdError, ReloadPluginByIdResponse, SetPluginEnabledByIdData, SetPluginEnabledByIdError, SetPluginEnabledByIdResponse, ListPluginPagesByIdData, ListPluginPagesByIdError, ListPluginPagesByIdResponse, GetPluginPageByIdData, GetPluginPageByIdError, GetPluginPageByIdResponse, GetPluginPageAssetByIdData, GetPluginPageAssetByIdError, GetPluginPageAssetByIdResponse, GetPluginData, GetPluginError, GetPluginResponse, UninstallPluginData, UninstallPluginError, UninstallPluginResponse, GetPluginConfigData, GetPluginConfigError, GetPluginConfigResponse, UpdatePluginConfigData, UpdatePluginConfigError, UpdatePluginConfigResponse, GetPluginConfigSchemaData, GetPluginConfigSchemaError, GetPluginConfigSchemaResponse, ListPluginConfigFilesData, ListPluginConfigFilesError, ListPluginConfigFilesResponse, UploadPluginConfigFilesData, UploadPluginConfigFilesError, UploadPluginConfigFilesResponse, DeletePluginConfigFileData, DeletePluginConfigFileError, DeletePluginConfigFileResponse, GetPluginReadmeData, GetPluginReadmeError, GetPluginReadmeResponse, GetPluginChangelogData, GetPluginChangelogError, GetPluginChangelogResponse, ReloadPluginData, ReloadPluginError, ReloadPluginResponse, SetPluginEnabledData, SetPluginEnabledError, SetPluginEnabledResponse, UpdatePluginData, UpdatePluginError, UpdatePluginResponse, UpdatePluginsData, UpdatePluginsError, UpdatePluginsResponse, CheckPluginVersionSupportData, CheckPluginVersionSupportError, CheckPluginVersionSupportResponse, ListFailedPluginsError, ListFailedPluginsResponse, UninstallFailedPluginData, UninstallFailedPluginError, UninstallFailedPluginResponse, ReloadFailedPluginData, ReloadFailedPluginError, ReloadFailedPluginResponse, InstallPluginFromGithubData, InstallPluginFromGithubError, InstallPluginFromGithubResponse, InstallPluginFromUrlData, InstallPluginFromUrlError, InstallPluginFromUrlResponse, InstallPluginFromUploadData, InstallPluginFromUploadError, InstallPluginFromUploadResponse, ListPluginMarketData, ListPluginMarketError, ListPluginMarketResponse, ListPluginMarketCategoriesError, ListPluginMarketCategoriesResponse, ListPluginSourcesError, ListPluginSourcesResponse, CreatePluginSourceData, CreatePluginSourceError, CreatePluginSourceResponse, ReplacePluginSourcesData, ReplacePluginSourcesError, ReplacePluginSourcesResponse, DeletePluginSourceData, DeletePluginSourceError, DeletePluginSourceResponse, DeletePluginSourceByIdData, DeletePluginSourceByIdError, DeletePluginSourceByIdResponse, ListPluginPagesData, ListPluginPagesError, ListPluginPagesResponse, GetPluginPageData, GetPluginPageError, GetPluginPageResponse, GetPluginPageAssetData, GetPluginPageAssetError, GetPluginPageAssetResponse, GetPluginPageBridgeSdkError, GetPluginPageBridgeSdkResponse, GetPluginExtensionRouteData, GetPluginExtensionRouteError, GetPluginExtensionRouteResponse, PostPluginExtensionRouteData, PostPluginExtensionRouteError, PostPluginExtensionRouteResponse, PutPluginExtensionRouteData, PutPluginExtensionRouteError, PutPluginExtensionRouteResponse, PatchPluginExtensionRouteData, PatchPluginExtensionRouteError, PatchPluginExtensionRouteResponse, DeletePluginExtensionRouteData, DeletePluginExtensionRouteError, DeletePluginExtensionRouteResponse, ListCommandsData, ListCommandsError, ListCommandsResponse, UpdateCommandData, UpdateCommandError, UpdateCommandResponse, ListCommandConflictsError, ListCommandConflictsResponse, ListToolsData, ListToolsError, ListToolsResponse, SetToolEnabledData, SetToolEnabledError, SetToolEnabledResponse, SetToolPermissionData, SetToolPermissionError, SetToolPermissionResponse, ListMcpServersError, ListMcpServersResponse, CreateMcpServerData, CreateMcpServerError, CreateMcpServerResponse, UpdateMcpServerByNameData, UpdateMcpServerByNameError, UpdateMcpServerByNameResponse, DeleteMcpServerByNameData, DeleteMcpServerByNameError, DeleteMcpServerByNameResponse, SetMcpServerEnabledByNameData, SetMcpServerEnabledByNameError, SetMcpServerEnabledByNameResponse, TestMcpServerByNameData, TestMcpServerByNameError, TestMcpServerByNameResponse, UpdateMcpServerData, UpdateMcpServerError, UpdateMcpServerResponse, DeleteMcpServerData, DeleteMcpServerError, DeleteMcpServerResponse, SetMcpServerEnabledData, SetMcpServerEnabledError, SetMcpServerEnabledResponse, TestMcpServerData, TestMcpServerError, TestMcpServerResponse, SyncModelScopeMcpServersData, SyncModelScopeMcpServersError, SyncModelScopeMcpServersResponse, ListSkillsData, ListSkillsError, ListSkillsResponse, UploadSkillData, UploadSkillError, UploadSkillResponse, UploadSkillsBatchData, UploadSkillsBatchError, UploadSkillsBatchResponse, UpdateSkillByNameData, UpdateSkillByNameError, UpdateSkillByNameResponse, DeleteSkillByNameData, DeleteSkillByNameError, DeleteSkillByNameResponse, DownloadSkillByNameData, DownloadSkillByNameError, DownloadSkillByNameResponse, ListSkillFilesByNameData, ListSkillFilesByNameError, ListSkillFilesByNameResponse, GetSkillFileByNameData, GetSkillFileByNameError, GetSkillFileByNameResponse, UpdateSkillFileByNameData, UpdateSkillFileByNameError, UpdateSkillFileByNameResponse, UpdateSkillData, UpdateSkillError, UpdateSkillResponse, DeleteSkillData, DeleteSkillError, DeleteSkillResponse, DownloadSkillData, DownloadSkillError, DownloadSkillResponse, ListSkillFilesData, ListSkillFilesError, ListSkillFilesResponse, GetSkillFileData, GetSkillFileError, GetSkillFileResponse, UpdateSkillFileData, UpdateSkillFileError, UpdateSkillFileResponse, ListNeoSkillCandidatesData, ListNeoSkillCandidatesError, ListNeoSkillCandidatesResponse, ListNeoSkillReleasesData, ListNeoSkillReleasesError, ListNeoSkillReleasesResponse, GetNeoSkillPayloadData, GetNeoSkillPayloadError, GetNeoSkillPayloadResponse, EvaluateNeoSkillCandidateData, EvaluateNeoSkillCandidateError, EvaluateNeoSkillCandidateResponse, PromoteNeoSkillCandidateData, PromoteNeoSkillCandidateError, PromoteNeoSkillCandidateResponse, RollbackNeoSkillReleaseData, RollbackNeoSkillReleaseError, RollbackNeoSkillReleaseResponse, SyncNeoSkillReleaseData, SyncNeoSkillReleaseError, SyncNeoSkillReleaseResponse, DeleteNeoSkillCandidateData, DeleteNeoSkillCandidateError, DeleteNeoSkillCandidateResponse, DeleteNeoSkillReleaseData, DeleteNeoSkillReleaseError, DeleteNeoSkillReleaseResponse, ListKnowledgeBasesData, ListKnowledgeBasesError, ListKnowledgeBasesResponse, CreateKnowledgeBaseData, CreateKnowledgeBaseError, CreateKnowledgeBaseResponse, GetKnowledgeBaseData, GetKnowledgeBaseError, GetKnowledgeBaseResponse, UpdateKnowledgeBaseData, UpdateKnowledgeBaseError, UpdateKnowledgeBaseResponse, DeleteKnowledgeBaseData, DeleteKnowledgeBaseError, DeleteKnowledgeBaseResponse, GetKnowledgeBaseStatsData, GetKnowledgeBaseStatsError, GetKnowledgeBaseStatsResponse, ListKnowledgeDocumentsData, ListKnowledgeDocumentsError, ListKnowledgeDocumentsResponse, UploadKnowledgeDocumentData, UploadKnowledgeDocumentError, UploadKnowledgeDocumentResponse, ImportKnowledgeDocumentsData, ImportKnowledgeDocumentsError, ImportKnowledgeDocumentsResponse, ImportKnowledgeDocumentFromUrlData, ImportKnowledgeDocumentFromUrlError, ImportKnowledgeDocumentFromUrlResponse, GetKnowledgeDocumentData, GetKnowledgeDocumentError, GetKnowledgeDocumentResponse, DeleteKnowledgeDocumentData, DeleteKnowledgeDocumentError, DeleteKnowledgeDocumentResponse, ListKnowledgeChunksData, ListKnowledgeChunksError, ListKnowledgeChunksResponse, DeleteKnowledgeChunkData, DeleteKnowledgeChunkError, DeleteKnowledgeChunkResponse, RetrieveKnowledgeBaseData, RetrieveKnowledgeBaseError, RetrieveKnowledgeBaseResponse, GetKnowledgeTaskData, GetKnowledgeTaskError, GetKnowledgeTaskResponse, GetPersonaTreeError, GetPersonaTreeResponse, ListPersonasData, ListPersonasError, ListPersonasResponse, CreatePersonaData, CreatePersonaError, CreatePersonaResponse, GetPersonaByIdData, GetPersonaByIdError, GetPersonaByIdResponse, UpdatePersonaByIdData, UpdatePersonaByIdError, UpdatePersonaByIdResponse, DeletePersonaByIdData, DeletePersonaByIdError, DeletePersonaByIdResponse, GetPersonaData, GetPersonaError, GetPersonaResponse, UpdatePersonaData, UpdatePersonaError, UpdatePersonaResponse, DeletePersonaData, DeletePersonaError, DeletePersonaResponse, ListPersonaFoldersData, ListPersonaFoldersError, ListPersonaFoldersResponse, CreatePersonaFolderData, CreatePersonaFolderError, CreatePersonaFolderResponse, UpdatePersonaFolderData, UpdatePersonaFolderError, UpdatePersonaFolderResponse, DeletePersonaFolderData, DeletePersonaFolderError, DeletePersonaFolderResponse, MovePersonaItemData, MovePersonaItemError, MovePersonaItemResponse, ReorderPersonaItemsData, ReorderPersonaItemsError, ReorderPersonaItemsResponse, ListSessionsData, ListSessionsError, ListSessionsResponse, ListActiveUmosError, ListActiveUmosResponse, ListSessionRulesData, ListSessionRulesError, ListSessionRulesResponse, UpsertSessionRuleData, UpsertSessionRuleError, UpsertSessionRuleResponse, DeleteSessionRulesData, DeleteSessionRulesError, DeleteSessionRulesResponse, BatchUpdateSessionProviderData, BatchUpdateSessionProviderError, BatchUpdateSessionProviderResponse, BatchUpdateSessionServiceData, BatchUpdateSessionServiceError, BatchUpdateSessionServiceResponse, ListSessionGroupsError, ListSessionGroupsResponse, CreateSessionGroupData, CreateSessionGroupError, CreateSessionGroupResponse, UpdateSessionGroupData, UpdateSessionGroupError, UpdateSessionGroupResponse, DeleteSessionGroupData, DeleteSessionGroupError, DeleteSessionGroupResponse, ListConversationsData, ListConversationsError, ListConversationsResponse, BatchDeleteConversationsData, BatchDeleteConversationsError, BatchDeleteConversationsResponse, GetConversationData, GetConversationError, GetConversationResponse, UpdateConversationData, UpdateConversationError, UpdateConversationResponse, DeleteConversationData, DeleteConversationError, DeleteConversationResponse, ReplaceConversationMessagesData, ReplaceConversationMessagesError, ReplaceConversationMessagesResponse, ExportConversationsData, ExportConversationsError, ExportConversationsResponse, GetStatsData, GetStatsError, GetStatsResponse, GetProviderTokenStatsData, GetProviderTokenStatsError, GetProviderTokenStatsResponse, GetVersionError, GetVersionResponse, GetFirstNoticeData, GetFirstNoticeError, GetFirstNoticeResponse, TestGhproxyConnectionData, TestGhproxyConnectionError, TestGhproxyConnectionResponse, ListChangelogVersionsError, ListChangelogVersionsResponse, GetChangelogData, GetChangelogError, GetChangelogResponse, GetStartTimeError, GetStartTimeResponse, GetStorageStatusError, GetStorageStatusResponse, CleanupStorageData, CleanupStorageError, CleanupStorageResponse, RestartCoreError, RestartCoreResponse, ListBackupsData, ListBackupsError, ListBackupsResponse, CreateBackupData, CreateBackupError, CreateBackupResponse, UploadBackupData, UploadBackupError, UploadBackupResponse, InitBackupUploadData, InitBackupUploadError, InitBackupUploadResponse, UploadBackupChunkData, UploadBackupChunkError, UploadBackupChunkResponse, CompleteBackupUploadData, CompleteBackupUploadError, CompleteBackupUploadResponse, AbortBackupUploadData, AbortBackupUploadError, AbortBackupUploadResponse, GetBackupProgressData, GetBackupProgressError, GetBackupProgressResponse, DownloadBackupData, DownloadBackupError, DownloadBackupResponse, RenameBackupData, RenameBackupError, RenameBackupResponse, DeleteBackupData, DeleteBackupError, DeleteBackupResponse, CheckBackupData, CheckBackupError, CheckBackupResponse, ImportBackupData, ImportBackupError, ImportBackupResponse, CheckUpdateError, CheckUpdateResponse, ListReleasesData, ListReleasesError, ListReleasesResponse, UpdateCoreData, UpdateCoreError, UpdateCoreResponse, UpdateDashboardData, UpdateDashboardError, UpdateDashboardResponse, GetUpdateProgressData, GetUpdateProgressError, GetUpdateProgressResponse, InstallPipPackageData, InstallPipPackageError, InstallPipPackageResponse, RunMigrationsData, RunMigrationsError, RunMigrationsResponse, ListCronJobsData, ListCronJobsError, ListCronJobsResponse, CreateCronJobData, CreateCronJobError, CreateCronJobResponse, UpdateCronJobData, UpdateCronJobError, UpdateCronJobResponse, DeleteCronJobData, DeleteCronJobError, DeleteCronJobResponse, RunCronJobData, RunCronJobError, RunCronJobResponse, StreamLiveLogsError, StreamLiveLogsResponse, GetLogHistoryError, GetLogHistoryResponse, GetTraceSettingsError, GetTraceSettingsResponse, UpdateTraceSettingsData, UpdateTraceSettingsError, UpdateTraceSettingsResponse, ListT2iTemplatesError, ListT2iTemplatesResponse, CreateT2iTemplateData, CreateT2iTemplateError, CreateT2iTemplateResponse, GetActiveT2iTemplateError, GetActiveT2iTemplateResponse, SetActiveT2iTemplateData, SetActiveT2iTemplateError, SetActiveT2iTemplateResponse, ResetDefaultT2iTemplateError, ResetDefaultT2iTemplateResponse, GetT2iTemplateData, GetT2iTemplateError, GetT2iTemplateResponse, UpdateT2iTemplateData, UpdateT2iTemplateError, UpdateT2iTemplateResponse, DeleteT2iTemplateData, DeleteT2iTemplateError, DeleteT2iTemplateResponse, GetSubagentConfigError, GetSubagentConfigResponse, UpdateSubagentConfigData, UpdateSubagentConfigError, UpdateSubagentConfigResponse, ListSubagentAvailableToolsError, ListSubagentAvailableToolsResponse, VerifyPlatformWebhookData, VerifyPlatformWebhookError, VerifyPlatformWebhookResponse, ReceivePlatformWebhookData, ReceivePlatformWebhookError, ReceivePlatformWebhookResponse } from './types.gen';
+
+export const client = createClient(createConfig());
+
+/**
+ * Login to the dashboard API
+ */
+export const login = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<LoginData, ThrowOnError>) => {
+    return (options?.client ?? client).post<LoginResponse, LoginError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/auth/login'
+    });
+};
+
+/**
+ * Logout from the dashboard API
+ */
+export const logout = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).post<LogoutResponse, LogoutError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/auth/logout'
+    });
+};
+
+/**
+ * Get first-run setup status
+ */
+export const getAuthSetupStatus = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetAuthSetupStatusResponse, GetAuthSetupStatusError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/auth/setup-status'
+    });
+};
+
+/**
+ * Complete first-run dashboard account setup
+ */
+export const setupAuth = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<SetupAuthData, ThrowOnError>) => {
+    return (options?.client ?? client).post<SetupAuthResponse, SetupAuthError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/auth/setup'
+    });
+};
+
+/**
+ * Start or refresh TOTP setup
+ */
+export const setupTotp = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<SetupTotpData, ThrowOnError>) => {
+    return (options?.client ?? client).post<SetupTotpResponse, SetupTotpError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/auth/totp/setup'
+    });
+};
+
+/**
+ * Generate or rotate TOTP recovery codes
+ */
+export const recoverTotp = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).post<RecoverTotpResponse, RecoverTotpError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/auth/totp/recovery'
+    });
+};
+
+/**
+ * Update dashboard account credentials
+ */
+export const updateAuthAccount = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdateAuthAccountData, ThrowOnError>) => {
+    return (options?.client ?? client).patch<UpdateAuthAccountResponse, UpdateAuthAccountError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/auth/account'
+    });
+};
+
+/**
+ * List OpenAPI keys
+ */
+export const listApiKeys = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListApiKeysResponse, ListApiKeysError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/api-keys'
+    });
+};
+
+/**
+ * Create an OpenAPI key
+ */
+export const createApiKey = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<CreateApiKeyData, ThrowOnError>) => {
+    return (options?.client ?? client).post<CreateApiKeyResponse, CreateApiKeyError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/api-keys'
+    });
+};
+
+/**
+ * Revoke an OpenAPI key
+ */
+export const revokeApiKey = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<RevokeApiKeyData, ThrowOnError>) => {
+    return (options?.client ?? client).post<RevokeApiKeyResponse, RevokeApiKeyError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/api-keys/{key_id}/revoke'
+    });
+};
+
+/**
+ * Delete an OpenAPI key
+ */
+export const deleteApiKey = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteApiKeyData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeleteApiKeyResponse, DeleteApiKeyError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/api-keys/{key_id}'
+    });
+};
+
+/**
+ * Get the system configuration schema
+ */
+export const getSystemConfigSchema = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetSystemConfigSchemaResponse, GetSystemConfigSchemaError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/system-config/schema'
+    });
+};
+
+/**
+ * Get the system configuration
+ */
+export const getSystemConfig = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetSystemConfigResponse, GetSystemConfigError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/system-config'
+    });
+};
+
+/**
+ * Replace the system configuration
+ */
+export const updateSystemConfig = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdateSystemConfigData, ThrowOnError>) => {
+    return (options?.client ?? client).put<UpdateSystemConfigResponse, UpdateSystemConfigError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/system-config'
+    });
+};
+
+/**
+ * Get runtime-enriched system configuration metadata
+ */
+export const getSystemConfigRuntime = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetSystemConfigRuntimeResponse, GetSystemConfigRuntimeError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/system-config/runtime'
+    });
+};
+
+/**
+ * Get the configuration profile schema
+ */
+export const getConfigProfileSchema = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetConfigProfileSchemaResponse, GetConfigProfileSchemaError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/config-profiles/schema'
+    });
+};
+
+/**
+ * List configuration profiles
+ */
+export const listConfigProfiles = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListConfigProfilesResponse, ListConfigProfilesError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/config-profiles'
+    });
+};
+
+/**
+ * Create a configuration profile
+ */
+export const createConfigProfile = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<CreateConfigProfileData, ThrowOnError>) => {
+    return (options?.client ?? client).post<CreateConfigProfileResponse, CreateConfigProfileError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/config-profiles'
+    });
+};
+
+/**
+ * Get a configuration profile
+ */
+export const getConfigProfile = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetConfigProfileData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetConfigProfileResponse, GetConfigProfileError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/config-profiles/{config_id}'
+    });
+};
+
+/**
+ * Replace a configuration profile
+ */
+export const updateConfigProfileContent = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdateConfigProfileContentData, ThrowOnError>) => {
+    return (options?.client ?? client).put<UpdateConfigProfileContentResponse, UpdateConfigProfileContentError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/config-profiles/{config_id}'
+    });
+};
+
+/**
+ * Rename a configuration profile
+ */
+export const renameConfigProfile = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<RenameConfigProfileData, ThrowOnError>) => {
+    return (options?.client ?? client).patch<RenameConfigProfileResponse, RenameConfigProfileError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/config-profiles/{config_id}'
+    });
+};
+
+/**
+ * Delete a configuration profile
+ */
+export const deleteConfigProfile = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteConfigProfileData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeleteConfigProfileResponse, DeleteConfigProfileError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/config-profiles/{config_id}'
+    });
+};
+
+/**
+ * List UMO to configuration profile bindings
+ */
+export const listConfigRoutes = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListConfigRoutesResponse, ListConfigRoutesError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/config-routes'
+    });
+};
+
+/**
+ * Replace all UMO to configuration profile bindings
+ */
+export const replaceConfigRoutes = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<ReplaceConfigRoutesData, ThrowOnError>) => {
+    return (options?.client ?? client).put<ReplaceConfigRoutesResponse, ReplaceConfigRoutesError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/config-routes'
+    });
+};
+
+/**
+ * Bind a UMO to a configuration profile
+ */
+export const upsertConfigRoute = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpsertConfigRouteData, ThrowOnError>) => {
+    return (options?.client ?? client).put<UpsertConfigRouteResponse, UpsertConfigRouteError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/config-routes/{umo}'
+    });
+};
+
+/**
+ * Remove a UMO configuration profile binding
+ */
+export const deleteConfigRoute = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteConfigRouteData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeleteConfigRouteResponse, DeleteConfigRouteError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/config-routes/{umo}'
+    });
+};
+
+/**
+ * List configurable bot types and their schemas
+ */
+export const listBotTypes = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListBotTypesResponse, ListBotTypesError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/bot-types'
+    });
+};
+
+/**
+ * Run a bot type registration flow action
+ */
+export const registerBotType = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<RegisterBotTypeData, ThrowOnError>) => {
+    return (options?.client ?? client).post<RegisterBotTypeResponse, RegisterBotTypeError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/bot-types/{bot_type}/registration'
+    });
+};
+
+/**
+ * List created bots and their configurations
+ */
+export const listBots = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<ListBotsData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListBotsResponse, ListBotsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/bots'
+    });
+};
+
+/**
+ * Create a bot from configuration
+ */
+export const createBot = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<CreateBotData, ThrowOnError>) => {
+    return (options?.client ?? client).post<CreateBotResponse, CreateBotError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/bots'
+    });
+};
+
+/**
+ * List runtime status for all bots
+ */
+export const listBotStats = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListBotStatsResponse, ListBotStatsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/bots/stats'
+    });
+};
+
+/**
+ * Get a bot configuration by query ID
+ */
+export const getBotById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetBotByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetBotByIdResponse, GetBotByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/bots/by-id'
+    });
+};
+
+/**
+ * Replace a bot configuration by body ID
+ */
+export const updateBotById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdateBotByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).put<UpdateBotByIdResponse, UpdateBotByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/bots/by-id'
+    });
+};
+
+/**
+ * Delete a bot by query ID
+ */
+export const deleteBotById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteBotByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeleteBotByIdResponse, DeleteBotByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/bots/by-id'
+    });
+};
+
+/**
+ * Enable or disable a bot by body ID
+ */
+export const setBotEnabledById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<SetBotEnabledByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).patch<SetBotEnabledByIdResponse, SetBotEnabledByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/bots/enabled'
+    });
+};
+
+/**
+ * Test a bot registration or connection by body ID
+ */
+export const testBotById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<TestBotByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).post<TestBotByIdResponse, TestBotByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/bots/test'
+    });
+};
+
+/**
+ * Get a bot configuration
+ */
+export const getBot = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetBotData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetBotResponse, GetBotError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/bots/{bot_id}'
+    });
+};
+
+/**
+ * Replace a bot configuration
+ */
+export const updateBot = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdateBotData, ThrowOnError>) => {
+    return (options?.client ?? client).put<UpdateBotResponse, UpdateBotError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/bots/{bot_id}'
+    });
+};
+
+/**
+ * Delete a bot
+ */
+export const deleteBot = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteBotData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeleteBotResponse, DeleteBotError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/bots/{bot_id}'
+    });
+};
+
+/**
+ * Enable or disable a bot
+ */
+export const setBotEnabled = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<SetBotEnabledData, ThrowOnError>) => {
+    return (options?.client ?? client).patch<SetBotEnabledResponse, SetBotEnabledError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/bots/{bot_id}/enabled'
+    });
+};
+
+/**
+ * Test a bot registration or connection
+ */
+export const testBot = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<TestBotData, ThrowOnError>) => {
+    return (options?.client ?? client).post<TestBotResponse, TestBotError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/bots/{bot_id}/test'
+    });
+};
+
+/**
+ * Get the overall provider configuration schema
+ */
+export const getProviderSchema = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetProviderSchemaResponse, GetProviderSchemaError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/providers/schema'
+    });
+};
+
+/**
+ * List provider sources
+ */
+export const listProviderSources = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListProviderSourcesResponse, ListProviderSourcesError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/provider-sources'
+    });
+};
+
+/**
+ * Create a provider source
+ */
+export const createProviderSource = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<CreateProviderSourceData, ThrowOnError>) => {
+    return (options?.client ?? client).post<CreateProviderSourceResponse, CreateProviderSourceError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/provider-sources'
+    });
+};
+
+/**
+ * Get a provider source by query ID
+ */
+export const getProviderSourceById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetProviderSourceByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetProviderSourceByIdResponse, GetProviderSourceByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/provider-sources/by-id'
+    });
+};
+
+/**
+ * Update a provider source by body ID
+ */
+export const upsertProviderSourceById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpsertProviderSourceByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).put<UpsertProviderSourceByIdResponse, UpsertProviderSourceByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/provider-sources/by-id'
+    });
+};
+
+/**
+ * Delete a provider source by query ID
+ */
+export const deleteProviderSourceById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteProviderSourceByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeleteProviderSourceByIdResponse, DeleteProviderSourceByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/provider-sources/by-id'
+    });
+};
+
+/**
+ * List models available from a provider source by query ID
+ */
+export const listProviderSourceModelsById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<ListProviderSourceModelsByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListProviderSourceModelsByIdResponse, ListProviderSourceModelsByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/provider-sources/models'
+    });
+};
+
+/**
+ * List providers under a provider source by query ID
+ */
+export const listProvidersBySourceId = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<ListProvidersBySourceIdData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListProvidersBySourceIdResponse, ListProvidersBySourceIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/provider-sources/providers'
+    });
+};
+
+/**
+ * Create a provider under a provider source by body ID
+ */
+export const createProviderInSourceById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<CreateProviderInSourceByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).post<CreateProviderInSourceByIdResponse, CreateProviderInSourceByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/provider-sources/providers'
+    });
+};
+
+/**
+ * Get a provider source
+ */
+export const getProviderSource = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetProviderSourceData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetProviderSourceResponse, GetProviderSourceError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/provider-sources/{source_id}'
+    });
+};
+
+/**
+ * Update a provider source or create it if missing
+ */
+export const upsertProviderSource = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpsertProviderSourceData, ThrowOnError>) => {
+    return (options?.client ?? client).put<UpsertProviderSourceResponse, UpsertProviderSourceError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/provider-sources/{source_id}'
+    });
+};
+
+/**
+ * Delete a provider source and providers that reference it
+ */
+export const deleteProviderSource = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteProviderSourceData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeleteProviderSourceResponse, DeleteProviderSourceError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/provider-sources/{source_id}'
+    });
+};
+
+/**
+ * List models available from a provider source
+ */
+export const listProviderSourceModels = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<ListProviderSourceModelsData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListProviderSourceModelsResponse, ListProviderSourceModelsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/provider-sources/{source_id}/models'
+    });
+};
+
+/**
+ * List providers under a provider source
+ */
+export const listProvidersBySource = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<ListProvidersBySourceData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListProvidersBySourceResponse, ListProvidersBySourceError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/provider-sources/{source_id}/providers'
+    });
+};
+
+/**
+ * Create a provider under a provider source
+ */
+export const createProviderInSource = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<CreateProviderInSourceData, ThrowOnError>) => {
+    return (options?.client ?? client).post<CreateProviderInSourceResponse, CreateProviderInSourceError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/provider-sources/{source_id}/providers'
+    });
+};
+
+/**
+ * List providers by capability or source
+ */
+export const listProviders = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<ListProvidersData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListProvidersResponse, ListProvidersError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/providers'
+    });
+};
+
+/**
+ * Create a standalone provider
+ */
+export const createProvider = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<CreateProviderData, ThrowOnError>) => {
+    return (options?.client ?? client).post<CreateProviderResponse, CreateProviderError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/providers'
+    });
+};
+
+/**
+ * Get a provider configuration by query ID
+ */
+export const getProviderById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetProviderByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetProviderByIdResponse, GetProviderByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/providers/by-id'
+    });
+};
+
+/**
+ * Replace a provider configuration by body ID
+ */
+export const updateProviderById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdateProviderByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).put<UpdateProviderByIdResponse, UpdateProviderByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/providers/by-id'
+    });
+};
+
+/**
+ * Delete a provider by query ID
+ */
+export const deleteProviderById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteProviderByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeleteProviderByIdResponse, DeleteProviderByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/providers/by-id'
+    });
+};
+
+/**
+ * Enable or disable a provider by body ID
+ */
+export const setProviderEnabledById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<SetProviderEnabledByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).patch<SetProviderEnabledByIdResponse, SetProviderEnabledByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/providers/enabled'
+    });
+};
+
+/**
+ * Test a provider by body ID
+ */
+export const testProviderById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<TestProviderByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).post<TestProviderByIdResponse, TestProviderByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/providers/test'
+    });
+};
+
+/**
+ * Probe embedding dimension for a provider by body ID
+ */
+export const getProviderEmbeddingDimensionById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetProviderEmbeddingDimensionByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).post<GetProviderEmbeddingDimensionByIdResponse, GetProviderEmbeddingDimensionByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/providers/embedding-dimension'
+    });
+};
+
+/**
+ * Get a provider configuration
+ */
+export const getProvider = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetProviderData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetProviderResponse, GetProviderError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/providers/{provider_id}'
+    });
+};
+
+/**
+ * Replace a provider configuration
+ */
+export const updateProvider = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdateProviderData, ThrowOnError>) => {
+    return (options?.client ?? client).put<UpdateProviderResponse, UpdateProviderError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/providers/{provider_id}'
+    });
+};
+
+/**
+ * Delete a provider
+ */
+export const deleteProvider = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteProviderData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeleteProviderResponse, DeleteProviderError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/providers/{provider_id}'
+    });
+};
+
+/**
+ * Enable or disable a provider
+ */
+export const setProviderEnabled = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<SetProviderEnabledData, ThrowOnError>) => {
+    return (options?.client ?? client).patch<SetProviderEnabledResponse, SetProviderEnabledError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/providers/{provider_id}/enabled'
+    });
+};
+
+/**
+ * Test a provider
+ */
+export const testProvider = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<TestProviderData, ThrowOnError>) => {
+    return (options?.client ?? client).post<TestProviderResponse, TestProviderError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/providers/{provider_id}/test'
+    });
+};
+
+/**
+ * Probe embedding dimension for a provider
+ */
+export const getProviderEmbeddingDimension = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetProviderEmbeddingDimensionData, ThrowOnError>) => {
+    return (options?.client ?? client).post<GetProviderEmbeddingDimensionResponse, GetProviderEmbeddingDimensionError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/providers/{provider_id}/embedding-dimension'
+    });
+};
+
+/**
+ * Send a webchat message
+ */
+export const sendChatMessage = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<SendChatMessageData, ThrowOnError>) => {
+    return (options?.client ?? client).post<SendChatMessageResponse, SendChatMessageError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/chat'
+    });
+};
+
+/**
+ * Open a streaming chat WebSocket
+ */
+export const openChatWebSocket = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<OpenChatWebSocketData, ThrowOnError>) => {
+    return (options?.client ?? client).get<void, unknown, ThrowOnError>({
+        ...options,
+        url: '/api/v1/chat/ws'
+    });
+};
+
+/**
+ * Open the live voice chat WebSocket
+ */
+export const openLiveChatWebSocket = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<OpenLiveChatWebSocketData, ThrowOnError>) => {
+    return (options?.client ?? client).get<void, unknown, ThrowOnError>({
+        ...options,
+        url: '/api/v1/live-chat/ws'
+    });
+};
+
+/**
+ * Open the unified live/chat WebSocket
+ */
+export const openUnifiedChatWebSocket = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<OpenUnifiedChatWebSocketData, ThrowOnError>) => {
+    return (options?.client ?? client).get<void, unknown, ThrowOnError>({
+        ...options,
+        url: '/api/v1/unified-chat/ws'
+    });
+};
+
+/**
+ * List webchat sessions
+ */
+export const listChatSessions = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<ListChatSessionsData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListChatSessionsResponse, ListChatSessionsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/chat/sessions'
+    });
+};
+
+/**
+ * Create a webchat session
+ */
+export const createChatSession = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<CreateChatSessionData, ThrowOnError>) => {
+    return (options?.client ?? client).get<CreateChatSessionResponse, CreateChatSessionError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/chat/sessions/new'
+    });
+};
+
+/**
+ * Delete multiple webchat sessions
+ */
+export const batchDeleteChatSessions = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<BatchDeleteChatSessionsData, ThrowOnError>) => {
+    return (options?.client ?? client).post<BatchDeleteChatSessionsResponse, BatchDeleteChatSessionsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/chat/sessions/batch-delete'
+    });
+};
+
+/**
+ * Get a webchat session and its messages
+ */
+export const getChatSession = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetChatSessionData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetChatSessionResponse, GetChatSessionError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/chat/sessions/{session_id}'
+    });
+};
+
+/**
+ * Update a webchat session
+ */
+export const updateChatSession = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdateChatSessionData, ThrowOnError>) => {
+    return (options?.client ?? client).patch<UpdateChatSessionResponse, UpdateChatSessionError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/chat/sessions/{session_id}'
+    });
+};
+
+/**
+ * Delete a webchat session
+ */
+export const deleteChatSession = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteChatSessionData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeleteChatSessionResponse, DeleteChatSessionError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/chat/sessions/{session_id}'
+    });
+};
+
+/**
+ * Stop active webchat work for a session
+ */
+export const stopChatSession = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<StopChatSessionData, ThrowOnError>) => {
+    return (options?.client ?? client).post<StopChatSessionResponse, StopChatSessionError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/chat/sessions/{session_id}/stop'
+    });
+};
+
+/**
+ * Update the latest user message in a webchat session
+ */
+export const updateChatMessage = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdateChatMessageData, ThrowOnError>) => {
+    return (options?.client ?? client).patch<UpdateChatMessageResponse, UpdateChatMessageError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/chat/sessions/{session_id}/messages/{message_id}'
+    });
+};
+
+/**
+ * Regenerate a bot message in a webchat session
+ */
+export const regenerateChatMessage = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<RegenerateChatMessageData, ThrowOnError>) => {
+    return (options?.client ?? client).post<RegenerateChatMessageResponse, RegenerateChatMessageError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/chat/sessions/{session_id}/messages/{message_id}/regenerate'
+    });
+};
+
+/**
+ * List chat-selectable configuration profiles
+ */
+export const listChatConfigs = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListChatConfigsResponse, ListChatConfigsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/chat/configs'
+    });
+};
+
+/**
+ * Create or reuse a side thread from a webchat message
+ */
+export const createChatThread = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<CreateChatThreadData, ThrowOnError>) => {
+    return (options?.client ?? client).post<CreateChatThreadResponse, CreateChatThreadError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/chat/threads'
+    });
+};
+
+/**
+ * Get a webchat side thread
+ */
+export const getChatThread = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetChatThreadData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetChatThreadResponse, GetChatThreadError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/chat/threads/{thread_id}'
+    });
+};
+
+/**
+ * Delete a webchat side thread
+ */
+export const deleteChatThread = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteChatThreadData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeleteChatThreadResponse, DeleteChatThreadError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/chat/threads/{thread_id}'
+    });
+};
+
+/**
+ * Send a message inside a webchat side thread
+ */
+export const sendChatThreadMessage = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<SendChatThreadMessageData, ThrowOnError>) => {
+    return (options?.client ?? client).post<SendChatThreadMessageResponse, SendChatThreadMessageError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/chat/threads/{thread_id}/messages'
+    });
+};
+
+/**
+ * List ChatUI projects
+ */
+export const listChatProjects = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListChatProjectsResponse, ListChatProjectsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/chat/projects'
+    });
+};
+
+/**
+ * Create a ChatUI project
+ */
+export const createChatProject = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<CreateChatProjectData, ThrowOnError>) => {
+    return (options?.client ?? client).post<CreateChatProjectResponse, CreateChatProjectError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/chat/projects'
+    });
+};
+
+/**
+ * Get a ChatUI project
+ */
+export const getChatProject = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetChatProjectData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetChatProjectResponse, GetChatProjectError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/chat/projects/{project_id}'
+    });
+};
+
+/**
+ * Update a ChatUI project
+ */
+export const updateChatProject = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdateChatProjectData, ThrowOnError>) => {
+    return (options?.client ?? client).patch<UpdateChatProjectResponse, UpdateChatProjectError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/chat/projects/{project_id}'
+    });
+};
+
+/**
+ * Delete a ChatUI project
+ */
+export const deleteChatProject = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteChatProjectData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeleteChatProjectResponse, DeleteChatProjectError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/chat/projects/{project_id}'
+    });
+};
+
+/**
+ * List sessions in a ChatUI project
+ */
+export const listChatProjectSessions = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<ListChatProjectSessionsData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListChatProjectSessionsResponse, ListChatProjectSessionsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/chat/projects/{project_id}/sessions'
+    });
+};
+
+/**
+ * Add a session to a ChatUI project
+ */
+export const addChatProjectSession = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<AddChatProjectSessionData, ThrowOnError>) => {
+    return (options?.client ?? client).post<AddChatProjectSessionResponse, AddChatProjectSessionError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/chat/projects/{project_id}/sessions/{session_id}'
+    });
+};
+
+/**
+ * Remove a session from its ChatUI project
+ */
+export const removeChatProjectSession = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<RemoveChatProjectSessionData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<RemoveChatProjectSessionResponse, RemoveChatProjectSessionError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/chat/projects/sessions/{session_id}'
+    });
+};
+
+/**
+ * Send a message to a UMO
+ */
+export const sendImMessage = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<SendImMessageData, ThrowOnError>) => {
+    return (options?.client ?? client).post<SendImMessageResponse, SendImMessageError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/im/messages'
+    });
+};
+
+/**
+ * List active IM bot IDs
+ */
+export const listImBots = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListImBotsResponse, ListImBotsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/im/bots'
+    });
+};
+
+/**
+ * Upload a file
+ */
+export const uploadFile = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UploadFileData, ThrowOnError>) => {
+    return (options?.client ?? client).post<UploadFileResponse, UploadFileError, ThrowOnError>({
+        ...options,
+        ...formDataBodySerializer,
+        headers: {
+            'Content-Type': null,
+            ...options?.headers
+        },
+        url: '/api/v1/files'
+    });
+};
+
+/**
+ * Get an uploaded file by stored filename
+ */
+export const getFileByName = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetFileByNameData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetFileByNameResponse, GetFileByNameError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/files/content'
+    });
+};
+
+/**
+ * Get a tokenized public file
+ */
+export const getTokenFile = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetTokenFileData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetTokenFileResponse, GetTokenFileError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/files/tokens/{file_token}'
+    });
+};
+
+/**
+ * Get attachment metadata
+ */
+export const getAttachment = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetAttachmentData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetAttachmentResponse, GetAttachmentError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/files/{attachment_id}'
+    });
+};
+
+/**
+ * Delete an attachment
+ */
+export const deleteAttachment = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteAttachmentData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeleteAttachmentResponse, DeleteAttachmentError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/files/{attachment_id}'
+    });
+};
+
+/**
+ * Download attachment content
+ */
+export const downloadAttachment = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DownloadAttachmentData, ThrowOnError>) => {
+    return (options?.client ?? client).get<DownloadAttachmentResponse, DownloadAttachmentError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/files/{attachment_id}/content'
+    });
+};
+
+/**
+ * List installed plugins
+ */
+export const listPlugins = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<ListPluginsData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListPluginsResponse, ListPluginsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins'
+    });
+};
+
+/**
+ * Get plugin details by query ID
+ */
+export const getPluginById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetPluginByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetPluginByIdResponse, GetPluginByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/by-id'
+    });
+};
+
+/**
+ * Uninstall a plugin by query ID
+ */
+export const uninstallPluginById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UninstallPluginByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<UninstallPluginByIdResponse, UninstallPluginByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/by-id'
+    });
+};
+
+/**
+ * Get plugin configuration by query ID
+ */
+export const getPluginConfigById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetPluginConfigByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetPluginConfigByIdResponse, GetPluginConfigByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/config'
+    });
+};
+
+/**
+ * Save plugin configuration by body ID
+ */
+export const updatePluginConfigById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdatePluginConfigByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).put<UpdatePluginConfigByIdResponse, UpdatePluginConfigByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/config'
+    });
+};
+
+/**
+ * Get plugin configuration schema by query ID
+ */
+export const getPluginConfigSchemaById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetPluginConfigSchemaByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetPluginConfigSchemaByIdResponse, GetPluginConfigSchemaByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/config/schema'
+    });
+};
+
+/**
+ * List uploaded files for a plugin file configuration item by query ID
+ */
+export const listPluginConfigFilesById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<ListPluginConfigFilesByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListPluginConfigFilesByIdResponse, ListPluginConfigFilesByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/config-files'
+    });
+};
+
+/**
+ * Upload files for a plugin file configuration item by query ID
+ */
+export const uploadPluginConfigFilesById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UploadPluginConfigFilesByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).post<UploadPluginConfigFilesByIdResponse, UploadPluginConfigFilesByIdError, ThrowOnError>({
+        ...options,
+        ...formDataBodySerializer,
+        headers: {
+            'Content-Type': null,
+            ...options?.headers
+        },
+        url: '/api/v1/plugins/config-files'
+    });
+};
+
+/**
+ * Delete a plugin file configuration upload by query ID
+ */
+export const deletePluginConfigFileById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeletePluginConfigFileByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeletePluginConfigFileByIdResponse, DeletePluginConfigFileByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/config-files'
+    });
+};
+
+/**
+ * Get plugin README content by query ID
+ */
+export const getPluginReadmeById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetPluginReadmeByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetPluginReadmeByIdResponse, GetPluginReadmeByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/readme'
+    });
+};
+
+/**
+ * Get plugin CHANGELOG content by query ID
+ */
+export const getPluginChangelogById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetPluginChangelogByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetPluginChangelogByIdResponse, GetPluginChangelogByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/changelog'
+    });
+};
+
+/**
+ * Reload a plugin by body ID
+ */
+export const reloadPluginById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<ReloadPluginByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).post<ReloadPluginByIdResponse, ReloadPluginByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/reload'
+    });
+};
+
+/**
+ * Enable or disable a plugin by body ID
+ */
+export const setPluginEnabledById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<SetPluginEnabledByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).patch<SetPluginEnabledByIdResponse, SetPluginEnabledByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/enabled'
+    });
+};
+
+/**
+ * List plugin pages by query ID
+ */
+export const listPluginPagesById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<ListPluginPagesByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListPluginPagesByIdResponse, ListPluginPagesByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/pages'
+    });
+};
+
+/**
+ * Get plugin page entry HTML by query ID
+ */
+export const getPluginPageById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetPluginPageByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetPluginPageByIdResponse, GetPluginPageByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/page'
+    });
+};
+
+/**
+ * Get a plugin page asset by query ID
+ */
+export const getPluginPageAssetById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetPluginPageAssetByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetPluginPageAssetByIdResponse, GetPluginPageAssetByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/page/assets'
+    });
+};
+
+/**
+ * Get plugin details
+ */
+export const getPlugin = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetPluginData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetPluginResponse, GetPluginError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/{plugin_id}'
+    });
+};
+
+/**
+ * Uninstall a plugin
+ */
+export const uninstallPlugin = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UninstallPluginData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<UninstallPluginResponse, UninstallPluginError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/{plugin_id}'
+    });
+};
+
+/**
+ * Get plugin configuration
+ */
+export const getPluginConfig = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetPluginConfigData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetPluginConfigResponse, GetPluginConfigError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/{plugin_id}/config'
+    });
+};
+
+/**
+ * Save plugin configuration
+ */
+export const updatePluginConfig = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdatePluginConfigData, ThrowOnError>) => {
+    return (options?.client ?? client).put<UpdatePluginConfigResponse, UpdatePluginConfigError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/{plugin_id}/config'
+    });
+};
+
+/**
+ * Get plugin configuration schema
+ */
+export const getPluginConfigSchema = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetPluginConfigSchemaData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetPluginConfigSchemaResponse, GetPluginConfigSchemaError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/{plugin_id}/config/schema'
+    });
+};
+
+/**
+ * List uploaded files for a plugin file configuration item
+ */
+export const listPluginConfigFiles = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<ListPluginConfigFilesData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListPluginConfigFilesResponse, ListPluginConfigFilesError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/{plugin_id}/config-files/{config_key}'
+    });
+};
+
+/**
+ * Upload files for a plugin file configuration item
+ */
+export const uploadPluginConfigFiles = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UploadPluginConfigFilesData, ThrowOnError>) => {
+    return (options?.client ?? client).post<UploadPluginConfigFilesResponse, UploadPluginConfigFilesError, ThrowOnError>({
+        ...options,
+        ...formDataBodySerializer,
+        headers: {
+            'Content-Type': null,
+            ...options?.headers
+        },
+        url: '/api/v1/plugins/{plugin_id}/config-files/{config_key}'
+    });
+};
+
+/**
+ * Delete a plugin file configuration upload
+ */
+export const deletePluginConfigFile = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeletePluginConfigFileData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeletePluginConfigFileResponse, DeletePluginConfigFileError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/{plugin_id}/config-files'
+    });
+};
+
+/**
+ * Get plugin README content
+ */
+export const getPluginReadme = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetPluginReadmeData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetPluginReadmeResponse, GetPluginReadmeError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/{plugin_id}/readme'
+    });
+};
+
+/**
+ * Get plugin CHANGELOG content
+ */
+export const getPluginChangelog = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetPluginChangelogData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetPluginChangelogResponse, GetPluginChangelogError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/{plugin_id}/changelog'
+    });
+};
+
+/**
+ * Reload a plugin
+ */
+export const reloadPlugin = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<ReloadPluginData, ThrowOnError>) => {
+    return (options?.client ?? client).post<ReloadPluginResponse, ReloadPluginError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/{plugin_id}/reload'
+    });
+};
+
+/**
+ * Enable or disable a plugin
+ */
+export const setPluginEnabled = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<SetPluginEnabledData, ThrowOnError>) => {
+    return (options?.client ?? client).patch<SetPluginEnabledResponse, SetPluginEnabledError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/{plugin_id}/enabled'
+    });
+};
+
+/**
+ * Update or reinstall a plugin
+ */
+export const updatePlugin = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdatePluginData, ThrowOnError>) => {
+    return (options?.client ?? client).post<UpdatePluginResponse, UpdatePluginError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/{plugin_id}/update'
+    });
+};
+
+/**
+ * Update multiple plugins
+ */
+export const updatePlugins = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdatePluginsData, ThrowOnError>) => {
+    return (options?.client ?? client).post<UpdatePluginsResponse, UpdatePluginsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/update'
+    });
+};
+
+/**
+ * Check whether a plugin version constraint is supported
+ */
+export const checkPluginVersionSupport = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<CheckPluginVersionSupportData, ThrowOnError>) => {
+    return (options?.client ?? client).post<CheckPluginVersionSupportResponse, CheckPluginVersionSupportError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/version-support/check'
+    });
+};
+
+/**
+ * List failed plugins and errors
+ */
+export const listFailedPlugins = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListFailedPluginsResponse, ListFailedPluginsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/failed'
+    });
+};
+
+/**
+ * Uninstall a failed plugin
+ */
+export const uninstallFailedPlugin = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UninstallFailedPluginData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<UninstallFailedPluginResponse, UninstallFailedPluginError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/failed/{plugin_id}'
+    });
+};
+
+/**
+ * Reload a failed plugin
+ */
+export const reloadFailedPlugin = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<ReloadFailedPluginData, ThrowOnError>) => {
+    return (options?.client ?? client).post<ReloadFailedPluginResponse, ReloadFailedPluginError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/failed/{plugin_id}/reload'
+    });
+};
+
+/**
+ * Install a plugin from GitHub
+ */
+export const installPluginFromGithub = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<InstallPluginFromGithubData, ThrowOnError>) => {
+    return (options?.client ?? client).post<InstallPluginFromGithubResponse, InstallPluginFromGithubError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/install/github'
+    });
+};
+
+/**
+ * Install a plugin from a downloadable ZIP URL
+ */
+export const installPluginFromUrl = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<InstallPluginFromUrlData, ThrowOnError>) => {
+    return (options?.client ?? client).post<InstallPluginFromUrlResponse, InstallPluginFromUrlError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/install/url'
+    });
+};
+
+/**
+ * Install a plugin from an uploaded ZIP file
+ */
+export const installPluginFromUpload = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<InstallPluginFromUploadData, ThrowOnError>) => {
+    return (options?.client ?? client).post<InstallPluginFromUploadResponse, InstallPluginFromUploadError, ThrowOnError>({
+        ...options,
+        ...formDataBodySerializer,
+        headers: {
+            'Content-Type': null,
+            ...options?.headers
+        },
+        url: '/api/v1/plugins/install/upload'
+    });
+};
+
+/**
+ * List plugin marketplace entries
+ */
+export const listPluginMarket = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<ListPluginMarketData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListPluginMarketResponse, ListPluginMarketError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/market'
+    });
+};
+
+/**
+ * List plugin marketplace categories
+ */
+export const listPluginMarketCategories = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListPluginMarketCategoriesResponse, ListPluginMarketCategoriesError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/market/categories'
+    });
+};
+
+/**
+ * List plugin sources
+ */
+export const listPluginSources = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListPluginSourcesResponse, ListPluginSourcesError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugin-sources'
+    });
+};
+
+/**
+ * Add a plugin source
+ */
+export const createPluginSource = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<CreatePluginSourceData, ThrowOnError>) => {
+    return (options?.client ?? client).post<CreatePluginSourceResponse, CreatePluginSourceError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugin-sources'
+    });
+};
+
+/**
+ * Replace plugin sources
+ */
+export const replacePluginSources = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<ReplacePluginSourcesData, ThrowOnError>) => {
+    return (options?.client ?? client).put<ReplacePluginSourcesResponse, ReplacePluginSourcesError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugin-sources'
+    });
+};
+
+/**
+ * Delete a plugin source
+ */
+export const deletePluginSource = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeletePluginSourceData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeletePluginSourceResponse, DeletePluginSourceError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugin-sources/{source_id}'
+    });
+};
+
+/**
+ * Delete a plugin source by query ID
+ */
+export const deletePluginSourceById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeletePluginSourceByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeletePluginSourceByIdResponse, DeletePluginSourceByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugin-sources/by-id'
+    });
+};
+
+/**
+ * List plugin pages
+ */
+export const listPluginPages = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<ListPluginPagesData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListPluginPagesResponse, ListPluginPagesError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/{plugin_id}/pages'
+    });
+};
+
+/**
+ * Get plugin page entry HTML
+ */
+export const getPluginPage = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetPluginPageData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetPluginPageResponse, GetPluginPageError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/{plugin_id}/pages/{page_name}'
+    });
+};
+
+/**
+ * Get a plugin page asset
+ */
+export const getPluginPageAsset = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetPluginPageAssetData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetPluginPageAssetResponse, GetPluginPageAssetError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/{plugin_id}/pages/{page_name}/assets/{asset_path}'
+    });
+};
+
+/**
+ * Get the plugin page bridge SDK
+ */
+export const getPluginPageBridgeSdk = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetPluginPageBridgeSdkResponse, GetPluginPageBridgeSdkError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/page-bridge-sdk.js'
+    });
+};
+
+/**
+ * Proxy a plugin extension GET route
+ */
+export const getPluginExtensionRoute = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetPluginExtensionRouteData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetPluginExtensionRouteResponse, GetPluginExtensionRouteError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/extensions/{plugin_path}'
+    });
+};
+
+/**
+ * Proxy a plugin extension POST route
+ */
+export const postPluginExtensionRoute = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<PostPluginExtensionRouteData, ThrowOnError>) => {
+    return (options?.client ?? client).post<PostPluginExtensionRouteResponse, PostPluginExtensionRouteError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/extensions/{plugin_path}'
+    });
+};
+
+/**
+ * Proxy a plugin extension PUT route
+ */
+export const putPluginExtensionRoute = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<PutPluginExtensionRouteData, ThrowOnError>) => {
+    return (options?.client ?? client).put<PutPluginExtensionRouteResponse, PutPluginExtensionRouteError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/extensions/{plugin_path}'
+    });
+};
+
+/**
+ * Proxy a plugin extension PATCH route
+ */
+export const patchPluginExtensionRoute = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<PatchPluginExtensionRouteData, ThrowOnError>) => {
+    return (options?.client ?? client).patch<PatchPluginExtensionRouteResponse, PatchPluginExtensionRouteError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/extensions/{plugin_path}'
+    });
+};
+
+/**
+ * Proxy a plugin extension DELETE route
+ */
+export const deletePluginExtensionRoute = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeletePluginExtensionRouteData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeletePluginExtensionRouteResponse, DeletePluginExtensionRouteError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/plugins/extensions/{plugin_path}'
+    });
+};
+
+/**
+ * List plugin commands
+ */
+export const listCommands = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<ListCommandsData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListCommandsResponse, ListCommandsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/commands'
+    });
+};
+
+/**
+ * Update command enabled state, alias, or permission group
+ */
+export const updateCommand = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdateCommandData, ThrowOnError>) => {
+    return (options?.client ?? client).patch<UpdateCommandResponse, UpdateCommandError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/commands/{command_id}'
+    });
+};
+
+/**
+ * List command conflicts
+ */
+export const listCommandConflicts = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListCommandConflictsResponse, ListCommandConflictsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/commands/conflicts'
+    });
+};
+
+/**
+ * List LLM tools
+ */
+export const listTools = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<ListToolsData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListToolsResponse, ListToolsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/tools'
+    });
+};
+
+/**
+ * Enable or disable an LLM tool
+ */
+export const setToolEnabled = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<SetToolEnabledData, ThrowOnError>) => {
+    return (options?.client ?? client).patch<SetToolEnabledResponse, SetToolEnabledError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/tools/{tool_id}/enabled'
+    });
+};
+
+/**
+ * Update an LLM tool permission
+ */
+export const setToolPermission = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<SetToolPermissionData, ThrowOnError>) => {
+    return (options?.client ?? client).patch<SetToolPermissionResponse, SetToolPermissionError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/tools/{tool_id}/permission'
+    });
+};
+
+/**
+ * List MCP servers
+ */
+export const listMcpServers = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListMcpServersResponse, ListMcpServersError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/mcp/servers'
+    });
+};
+
+/**
+ * Add an MCP server
+ */
+export const createMcpServer = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<CreateMcpServerData, ThrowOnError>) => {
+    return (options?.client ?? client).post<CreateMcpServerResponse, CreateMcpServerError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/mcp/servers'
+    });
+};
+
+/**
+ * Update an MCP server by body name
+ */
+export const updateMcpServerByName = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdateMcpServerByNameData, ThrowOnError>) => {
+    return (options?.client ?? client).put<UpdateMcpServerByNameResponse, UpdateMcpServerByNameError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/mcp/servers/by-name'
+    });
+};
+
+/**
+ * Delete an MCP server by query name
+ */
+export const deleteMcpServerByName = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteMcpServerByNameData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeleteMcpServerByNameResponse, DeleteMcpServerByNameError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/mcp/servers/by-name'
+    });
+};
+
+/**
+ * Enable or disable an MCP server by body name
+ */
+export const setMcpServerEnabledByName = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<SetMcpServerEnabledByNameData, ThrowOnError>) => {
+    return (options?.client ?? client).patch<SetMcpServerEnabledByNameResponse, SetMcpServerEnabledByNameError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/mcp/servers/enabled'
+    });
+};
+
+/**
+ * Test an MCP server connection by body name
+ */
+export const testMcpServerByName = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<TestMcpServerByNameData, ThrowOnError>) => {
+    return (options?.client ?? client).post<TestMcpServerByNameResponse, TestMcpServerByNameError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/mcp/servers/test'
+    });
+};
+
+/**
+ * Update an MCP server
+ */
+export const updateMcpServer = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdateMcpServerData, ThrowOnError>) => {
+    return (options?.client ?? client).put<UpdateMcpServerResponse, UpdateMcpServerError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/mcp/servers/{server_name}'
+    });
+};
+
+/**
+ * Delete an MCP server
+ */
+export const deleteMcpServer = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteMcpServerData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeleteMcpServerResponse, DeleteMcpServerError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/mcp/servers/{server_name}'
+    });
+};
+
+/**
+ * Enable or disable an MCP server
+ */
+export const setMcpServerEnabled = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<SetMcpServerEnabledData, ThrowOnError>) => {
+    return (options?.client ?? client).patch<SetMcpServerEnabledResponse, SetMcpServerEnabledError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/mcp/servers/{server_name}/enabled'
+    });
+};
+
+/**
+ * Test an MCP server connection
+ */
+export const testMcpServer = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<TestMcpServerData, ThrowOnError>) => {
+    return (options?.client ?? client).post<TestMcpServerResponse, TestMcpServerError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/mcp/servers/{server_name}/test'
+    });
+};
+
+/**
+ * Sync MCP servers from ModelScope
+ */
+export const syncModelScopeMcpServers = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<SyncModelScopeMcpServersData, ThrowOnError>) => {
+    return (options?.client ?? client).post<SyncModelScopeMcpServersResponse, SyncModelScopeMcpServersError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/mcp/providers/modelscope/sync'
+    });
+};
+
+/**
+ * List skills
+ */
+export const listSkills = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<ListSkillsData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListSkillsResponse, ListSkillsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/skills'
+    });
+};
+
+/**
+ * Upload or import a skill archive
+ */
+export const uploadSkill = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UploadSkillData, ThrowOnError>) => {
+    return (options?.client ?? client).post<UploadSkillResponse, UploadSkillError, ThrowOnError>({
+        ...options,
+        ...formDataBodySerializer,
+        headers: {
+            'Content-Type': null,
+            ...options?.headers
+        },
+        url: '/api/v1/skills'
+    });
+};
+
+/**
+ * Upload multiple skill archives
+ */
+export const uploadSkillsBatch = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UploadSkillsBatchData, ThrowOnError>) => {
+    return (options?.client ?? client).post<UploadSkillsBatchResponse, UploadSkillsBatchError, ThrowOnError>({
+        ...options,
+        ...formDataBodySerializer,
+        headers: {
+            'Content-Type': null,
+            ...options?.headers
+        },
+        url: '/api/v1/skills/batch'
+    });
+};
+
+/**
+ * Update skill metadata or enabled state by body name
+ */
+export const updateSkillByName = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdateSkillByNameData, ThrowOnError>) => {
+    return (options?.client ?? client).patch<UpdateSkillByNameResponse, UpdateSkillByNameError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/skills/by-name'
+    });
+};
+
+/**
+ * Delete a skill by query name
+ */
+export const deleteSkillByName = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteSkillByNameData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeleteSkillByNameResponse, DeleteSkillByNameError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/skills/by-name'
+    });
+};
+
+/**
+ * Download a skill archive by query name
+ */
+export const downloadSkillByName = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DownloadSkillByNameData, ThrowOnError>) => {
+    return (options?.client ?? client).get<DownloadSkillByNameResponse, DownloadSkillByNameError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/skills/archive'
+    });
+};
+
+/**
+ * List files in a skill by query name
+ */
+export const listSkillFilesByName = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<ListSkillFilesByNameData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListSkillFilesByNameResponse, ListSkillFilesByNameError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/skills/files'
+    });
+};
+
+/**
+ * Get skill file content by query name and path
+ */
+export const getSkillFileByName = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetSkillFileByNameData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetSkillFileByNameResponse, GetSkillFileByNameError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/skills/file'
+    });
+};
+
+/**
+ * Update skill file content by body name and path
+ */
+export const updateSkillFileByName = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdateSkillFileByNameData, ThrowOnError>) => {
+    return (options?.client ?? client).put<UpdateSkillFileByNameResponse, UpdateSkillFileByNameError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/skills/file'
+    });
+};
+
+/**
+ * Update skill metadata or enabled state
+ */
+export const updateSkill = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdateSkillData, ThrowOnError>) => {
+    return (options?.client ?? client).patch<UpdateSkillResponse, UpdateSkillError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/skills/{skill_name}'
+    });
+};
+
+/**
+ * Delete a skill
+ */
+export const deleteSkill = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteSkillData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeleteSkillResponse, DeleteSkillError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/skills/{skill_name}'
+    });
+};
+
+/**
+ * Download a skill archive
+ */
+export const downloadSkill = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DownloadSkillData, ThrowOnError>) => {
+    return (options?.client ?? client).get<DownloadSkillResponse, DownloadSkillError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/skills/{skill_name}/archive'
+    });
+};
+
+/**
+ * List files in a skill
+ */
+export const listSkillFiles = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<ListSkillFilesData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListSkillFilesResponse, ListSkillFilesError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/skills/{skill_name}/files'
+    });
+};
+
+/**
+ * Get skill file content
+ */
+export const getSkillFile = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetSkillFileData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetSkillFileResponse, GetSkillFileError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/skills/{skill_name}/files/{file_path}'
+    });
+};
+
+/**
+ * Update skill file content
+ */
+export const updateSkillFile = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdateSkillFileData, ThrowOnError>) => {
+    return (options?.client ?? client).put<UpdateSkillFileResponse, UpdateSkillFileError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/skills/{skill_name}/files/{file_path}'
+    });
+};
+
+/**
+ * List Shipyard Neo skill candidates
+ */
+export const listNeoSkillCandidates = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<ListNeoSkillCandidatesData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListNeoSkillCandidatesResponse, ListNeoSkillCandidatesError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/skills/neo/candidates'
+    });
+};
+
+/**
+ * List Shipyard Neo skill releases
+ */
+export const listNeoSkillReleases = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<ListNeoSkillReleasesData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListNeoSkillReleasesResponse, ListNeoSkillReleasesError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/skills/neo/releases'
+    });
+};
+
+/**
+ * Get a Shipyard Neo skill payload
+ */
+export const getNeoSkillPayload = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetNeoSkillPayloadData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetNeoSkillPayloadResponse, GetNeoSkillPayloadError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/skills/neo/payload'
+    });
+};
+
+/**
+ * Evaluate a Shipyard Neo skill candidate
+ */
+export const evaluateNeoSkillCandidate = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<EvaluateNeoSkillCandidateData, ThrowOnError>) => {
+    return (options?.client ?? client).post<EvaluateNeoSkillCandidateResponse, EvaluateNeoSkillCandidateError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/skills/neo/evaluate'
+    });
+};
+
+/**
+ * Promote a Shipyard Neo skill candidate
+ */
+export const promoteNeoSkillCandidate = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<PromoteNeoSkillCandidateData, ThrowOnError>) => {
+    return (options?.client ?? client).post<PromoteNeoSkillCandidateResponse, PromoteNeoSkillCandidateError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/skills/neo/promote'
+    });
+};
+
+/**
+ * Roll back a Shipyard Neo skill release
+ */
+export const rollbackNeoSkillRelease = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<RollbackNeoSkillReleaseData, ThrowOnError>) => {
+    return (options?.client ?? client).post<RollbackNeoSkillReleaseResponse, RollbackNeoSkillReleaseError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/skills/neo/rollback'
+    });
+};
+
+/**
+ * Sync a Shipyard Neo skill release
+ */
+export const syncNeoSkillRelease = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<SyncNeoSkillReleaseData, ThrowOnError>) => {
+    return (options?.client ?? client).post<SyncNeoSkillReleaseResponse, SyncNeoSkillReleaseError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/skills/neo/sync'
+    });
+};
+
+/**
+ * Delete a Shipyard Neo skill candidate
+ */
+export const deleteNeoSkillCandidate = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteNeoSkillCandidateData, ThrowOnError>) => {
+    return (options?.client ?? client).post<DeleteNeoSkillCandidateResponse, DeleteNeoSkillCandidateError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/skills/neo/candidates/delete'
+    });
+};
+
+/**
+ * Delete a Shipyard Neo skill release
+ */
+export const deleteNeoSkillRelease = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteNeoSkillReleaseData, ThrowOnError>) => {
+    return (options?.client ?? client).post<DeleteNeoSkillReleaseResponse, DeleteNeoSkillReleaseError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/skills/neo/releases/delete'
+    });
+};
+
+/**
+ * List knowledge bases
+ */
+export const listKnowledgeBases = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<ListKnowledgeBasesData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListKnowledgeBasesResponse, ListKnowledgeBasesError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/knowledge-bases'
+    });
+};
+
+/**
+ * Create a knowledge base
+ */
+export const createKnowledgeBase = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<CreateKnowledgeBaseData, ThrowOnError>) => {
+    return (options?.client ?? client).post<CreateKnowledgeBaseResponse, CreateKnowledgeBaseError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/knowledge-bases'
+    });
+};
+
+/**
+ * Get a knowledge base
+ */
+export const getKnowledgeBase = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetKnowledgeBaseData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetKnowledgeBaseResponse, GetKnowledgeBaseError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/knowledge-bases/{kb_id}'
+    });
+};
+
+/**
+ * Update a knowledge base
+ */
+export const updateKnowledgeBase = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdateKnowledgeBaseData, ThrowOnError>) => {
+    return (options?.client ?? client).put<UpdateKnowledgeBaseResponse, UpdateKnowledgeBaseError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/knowledge-bases/{kb_id}'
+    });
+};
+
+/**
+ * Delete a knowledge base
+ */
+export const deleteKnowledgeBase = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteKnowledgeBaseData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeleteKnowledgeBaseResponse, DeleteKnowledgeBaseError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/knowledge-bases/{kb_id}'
+    });
+};
+
+/**
+ * Get knowledge base stats
+ */
+export const getKnowledgeBaseStats = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetKnowledgeBaseStatsData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetKnowledgeBaseStatsResponse, GetKnowledgeBaseStatsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/knowledge-bases/{kb_id}/stats'
+    });
+};
+
+/**
+ * List knowledge base documents
+ */
+export const listKnowledgeDocuments = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<ListKnowledgeDocumentsData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListKnowledgeDocumentsResponse, ListKnowledgeDocumentsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/knowledge-bases/{kb_id}/documents'
+    });
+};
+
+/**
+ * Upload a document to a knowledge base
+ */
+export const uploadKnowledgeDocument = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UploadKnowledgeDocumentData, ThrowOnError>) => {
+    return (options?.client ?? client).post<UploadKnowledgeDocumentResponse, UploadKnowledgeDocumentError, ThrowOnError>({
+        ...options,
+        ...formDataBodySerializer,
+        headers: {
+            'Content-Type': null,
+            ...options?.headers
+        },
+        url: '/api/v1/knowledge-bases/{kb_id}/documents'
+    });
+};
+
+/**
+ * Import documents already available on the server
+ */
+export const importKnowledgeDocuments = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<ImportKnowledgeDocumentsData, ThrowOnError>) => {
+    return (options?.client ?? client).post<ImportKnowledgeDocumentsResponse, ImportKnowledgeDocumentsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/knowledge-bases/{kb_id}/documents/import'
+    });
+};
+
+/**
+ * Import a document from URL
+ */
+export const importKnowledgeDocumentFromUrl = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<ImportKnowledgeDocumentFromUrlData, ThrowOnError>) => {
+    return (options?.client ?? client).post<ImportKnowledgeDocumentFromUrlResponse, ImportKnowledgeDocumentFromUrlError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/knowledge-bases/{kb_id}/documents/import-url'
+    });
+};
+
+/**
+ * Get a knowledge base document
+ */
+export const getKnowledgeDocument = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetKnowledgeDocumentData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetKnowledgeDocumentResponse, GetKnowledgeDocumentError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/knowledge-bases/{kb_id}/documents/{document_id}'
+    });
+};
+
+/**
+ * Delete a knowledge base document
+ */
+export const deleteKnowledgeDocument = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteKnowledgeDocumentData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeleteKnowledgeDocumentResponse, DeleteKnowledgeDocumentError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/knowledge-bases/{kb_id}/documents/{document_id}'
+    });
+};
+
+/**
+ * List document chunks
+ */
+export const listKnowledgeChunks = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<ListKnowledgeChunksData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListKnowledgeChunksResponse, ListKnowledgeChunksError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/knowledge-bases/{kb_id}/chunks'
+    });
+};
+
+/**
+ * Delete a document chunk
+ */
+export const deleteKnowledgeChunk = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteKnowledgeChunkData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeleteKnowledgeChunkResponse, DeleteKnowledgeChunkError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/knowledge-bases/{kb_id}/chunks/{chunk_id}'
+    });
+};
+
+/**
+ * Retrieve knowledge base chunks
+ */
+export const retrieveKnowledgeBase = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<RetrieveKnowledgeBaseData, ThrowOnError>) => {
+    return (options?.client ?? client).post<RetrieveKnowledgeBaseResponse, RetrieveKnowledgeBaseError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/knowledge-bases/{kb_id}/retrieve'
+    });
+};
+
+/**
+ * Get knowledge base import task progress
+ */
+export const getKnowledgeTask = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetKnowledgeTaskData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetKnowledgeTaskResponse, GetKnowledgeTaskError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/knowledge-bases/tasks/{task_id}'
+    });
+};
+
+/**
+ * Get persona folder tree
+ */
+export const getPersonaTree = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetPersonaTreeResponse, GetPersonaTreeError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/personas/tree'
+    });
+};
+
+/**
+ * List personas
+ */
+export const listPersonas = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<ListPersonasData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListPersonasResponse, ListPersonasError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/personas'
+    });
+};
+
+/**
+ * Create a persona
+ */
+export const createPersona = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<CreatePersonaData, ThrowOnError>) => {
+    return (options?.client ?? client).post<CreatePersonaResponse, CreatePersonaError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/personas'
+    });
+};
+
+/**
+ * Get a persona by query ID
+ */
+export const getPersonaById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetPersonaByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetPersonaByIdResponse, GetPersonaByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/personas/by-id'
+    });
+};
+
+/**
+ * Update a persona by body ID
+ */
+export const updatePersonaById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdatePersonaByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).put<UpdatePersonaByIdResponse, UpdatePersonaByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/personas/by-id'
+    });
+};
+
+/**
+ * Delete a persona by query ID
+ */
+export const deletePersonaById = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeletePersonaByIdData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeletePersonaByIdResponse, DeletePersonaByIdError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/personas/by-id'
+    });
+};
+
+/**
+ * Get a persona
+ */
+export const getPersona = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetPersonaData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetPersonaResponse, GetPersonaError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/personas/{persona_id}'
+    });
+};
+
+/**
+ * Update a persona
+ */
+export const updatePersona = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdatePersonaData, ThrowOnError>) => {
+    return (options?.client ?? client).put<UpdatePersonaResponse, UpdatePersonaError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/personas/{persona_id}'
+    });
+};
+
+/**
+ * Delete a persona
+ */
+export const deletePersona = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeletePersonaData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeletePersonaResponse, DeletePersonaError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/personas/{persona_id}'
+    });
+};
+
+/**
+ * List persona folders
+ */
+export const listPersonaFolders = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<ListPersonaFoldersData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListPersonaFoldersResponse, ListPersonaFoldersError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/persona-folders'
+    });
+};
+
+/**
+ * Create a persona folder
+ */
+export const createPersonaFolder = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<CreatePersonaFolderData, ThrowOnError>) => {
+    return (options?.client ?? client).post<CreatePersonaFolderResponse, CreatePersonaFolderError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/persona-folders'
+    });
+};
+
+/**
+ * Update a persona folder
+ */
+export const updatePersonaFolder = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdatePersonaFolderData, ThrowOnError>) => {
+    return (options?.client ?? client).put<UpdatePersonaFolderResponse, UpdatePersonaFolderError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/persona-folders/{folder_id}'
+    });
+};
+
+/**
+ * Delete a persona folder
+ */
+export const deletePersonaFolder = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeletePersonaFolderData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeletePersonaFolderResponse, DeletePersonaFolderError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/persona-folders/{folder_id}'
+    });
+};
+
+/**
+ * Move a persona or folder
+ */
+export const movePersonaItem = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<MovePersonaItemData, ThrowOnError>) => {
+    return (options?.client ?? client).post<MovePersonaItemResponse, MovePersonaItemError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/personas/move'
+    });
+};
+
+/**
+ * Reorder personas or folders
+ */
+export const reorderPersonaItems = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<ReorderPersonaItemsData, ThrowOnError>) => {
+    return (options?.client ?? client).post<ReorderPersonaItemsResponse, ReorderPersonaItemsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/personas/reorder'
+    });
+};
+
+/**
+ * List active UMOs and session status
+ */
+export const listSessions = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<ListSessionsData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListSessionsResponse, ListSessionsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/sessions'
+    });
+};
+
+/**
+ * List active and known UMOs
+ */
+export const listActiveUmos = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListActiveUmosResponse, ListActiveUmosError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/sessions/active-umos'
+    });
+};
+
+/**
+ * List session rules
+ */
+export const listSessionRules = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<ListSessionRulesData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListSessionRulesResponse, ListSessionRulesError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/sessions/rules'
+    });
+};
+
+/**
+ * Update or create a session rule
+ */
+export const upsertSessionRule = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpsertSessionRuleData, ThrowOnError>) => {
+    return (options?.client ?? client).post<UpsertSessionRuleResponse, UpsertSessionRuleError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/sessions/rules'
+    });
+};
+
+/**
+ * Delete one or more session rules
+ */
+export const deleteSessionRules = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteSessionRulesData, ThrowOnError>) => {
+    return (options?.client ?? client).post<DeleteSessionRulesResponse, DeleteSessionRulesError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/sessions/rules/delete'
+    });
+};
+
+/**
+ * Batch update session provider selection
+ */
+export const batchUpdateSessionProvider = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<BatchUpdateSessionProviderData, ThrowOnError>) => {
+    return (options?.client ?? client).patch<BatchUpdateSessionProviderResponse, BatchUpdateSessionProviderError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/sessions/provider'
+    });
+};
+
+/**
+ * Batch update session service settings
+ */
+export const batchUpdateSessionService = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<BatchUpdateSessionServiceData, ThrowOnError>) => {
+    return (options?.client ?? client).patch<BatchUpdateSessionServiceResponse, BatchUpdateSessionServiceError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/sessions/service'
+    });
+};
+
+/**
+ * List session groups
+ */
+export const listSessionGroups = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListSessionGroupsResponse, ListSessionGroupsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/session-groups'
+    });
+};
+
+/**
+ * Create a session group
+ */
+export const createSessionGroup = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<CreateSessionGroupData, ThrowOnError>) => {
+    return (options?.client ?? client).post<CreateSessionGroupResponse, CreateSessionGroupError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/session-groups'
+    });
+};
+
+/**
+ * Update a session group
+ */
+export const updateSessionGroup = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdateSessionGroupData, ThrowOnError>) => {
+    return (options?.client ?? client).put<UpdateSessionGroupResponse, UpdateSessionGroupError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/session-groups/{group_id}'
+    });
+};
+
+/**
+ * Delete a session group
+ */
+export const deleteSessionGroup = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteSessionGroupData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeleteSessionGroupResponse, DeleteSessionGroupError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/session-groups/{group_id}'
+    });
+};
+
+/**
+ * List conversation history data
+ */
+export const listConversations = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<ListConversationsData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListConversationsResponse, ListConversationsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/conversations'
+    });
+};
+
+/**
+ * Delete multiple conversations
+ */
+export const batchDeleteConversations = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<BatchDeleteConversationsData, ThrowOnError>) => {
+    return (options?.client ?? client).post<BatchDeleteConversationsResponse, BatchDeleteConversationsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/conversations/batch-delete'
+    });
+};
+
+/**
+ * Get conversation details and messages
+ */
+export const getConversation = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetConversationData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetConversationResponse, GetConversationError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/conversations/{conversation_id}'
+    });
+};
+
+/**
+ * Update conversation metadata
+ */
+export const updateConversation = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdateConversationData, ThrowOnError>) => {
+    return (options?.client ?? client).patch<UpdateConversationResponse, UpdateConversationError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/conversations/{conversation_id}'
+    });
+};
+
+/**
+ * Delete a conversation
+ */
+export const deleteConversation = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteConversationData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeleteConversationResponse, DeleteConversationError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/conversations/{conversation_id}'
+    });
+};
+
+/**
+ * Replace conversation message history
+ */
+export const replaceConversationMessages = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<ReplaceConversationMessagesData, ThrowOnError>) => {
+    return (options?.client ?? client).put<ReplaceConversationMessagesResponse, ReplaceConversationMessagesError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/conversations/{conversation_id}/messages'
+    });
+};
+
+/**
+ * Export conversations
+ */
+export const exportConversations = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<ExportConversationsData, ThrowOnError>) => {
+    return (options?.client ?? client).post<ExportConversationsResponse, ExportConversationsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/conversations/export'
+    });
+};
+
+/**
+ * Get runtime statistics
+ */
+export const getStats = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<GetStatsData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetStatsResponse, GetStatsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/stats'
+    });
+};
+
+/**
+ * Get provider token usage statistics
+ */
+export const getProviderTokenStats = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<GetProviderTokenStatsData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetProviderTokenStatsResponse, GetProviderTokenStatsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/stats/provider-tokens'
+    });
+};
+
+/**
+ * Get AstrBot version
+ */
+export const getVersion = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetVersionResponse, GetVersionError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/stats/version'
+    });
+};
+
+/**
+ * Get first-run dashboard notice content
+ */
+export const getFirstNotice = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<GetFirstNoticeData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetFirstNoticeResponse, GetFirstNoticeError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/stats/first-notice'
+    });
+};
+
+/**
+ * Test a GitHub proxy endpoint
+ */
+export const testGhproxyConnection = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<TestGhproxyConnectionData, ThrowOnError>) => {
+    return (options?.client ?? client).post<TestGhproxyConnectionResponse, TestGhproxyConnectionError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/stats/ghproxy/test'
+    });
+};
+
+/**
+ * List available changelog versions
+ */
+export const listChangelogVersions = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListChangelogVersionsResponse, ListChangelogVersionsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/changelogs'
+    });
+};
+
+/**
+ * Get changelog content for a version
+ */
+export const getChangelog = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetChangelogData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetChangelogResponse, GetChangelogError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/changelogs/{version}'
+    });
+};
+
+/**
+ * Get runtime start time
+ */
+export const getStartTime = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetStartTimeResponse, GetStartTimeError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/stats/start-time'
+    });
+};
+
+/**
+ * Get storage status
+ */
+export const getStorageStatus = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetStorageStatusResponse, GetStorageStatusError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/stats/storage'
+    });
+};
+
+/**
+ * Clean storage
+ */
+export const cleanupStorage = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<CleanupStorageData, ThrowOnError>) => {
+    return (options?.client ?? client).post<CleanupStorageResponse, CleanupStorageError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/stats/storage/cleanup'
+    });
+};
+
+/**
+ * Restart AstrBot core
+ */
+export const restartCore = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).post<RestartCoreResponse, RestartCoreError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/system/restart'
+    });
+};
+
+/**
+ * List backups
+ */
+export const listBackups = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<ListBackupsData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListBackupsResponse, ListBackupsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/backups'
+    });
+};
+
+/**
+ * Export a backup
+ */
+export const createBackup = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<CreateBackupData, ThrowOnError>) => {
+    return (options?.client ?? client).post<CreateBackupResponse, CreateBackupError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/backups'
+    });
+};
+
+/**
+ * Upload a backup file
+ */
+export const uploadBackup = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UploadBackupData, ThrowOnError>) => {
+    return (options?.client ?? client).post<UploadBackupResponse, UploadBackupError, ThrowOnError>({
+        ...options,
+        ...formDataBodySerializer,
+        headers: {
+            'Content-Type': null,
+            ...options?.headers
+        },
+        url: '/api/v1/backups/upload'
+    });
+};
+
+/**
+ * Initialize chunked backup upload
+ */
+export const initBackupUpload = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<InitBackupUploadData, ThrowOnError>) => {
+    return (options?.client ?? client).post<InitBackupUploadResponse, InitBackupUploadError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/backups/upload/init'
+    });
+};
+
+/**
+ * Upload a backup chunk
+ */
+export const uploadBackupChunk = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UploadBackupChunkData, ThrowOnError>) => {
+    return (options?.client ?? client).post<UploadBackupChunkResponse, UploadBackupChunkError, ThrowOnError>({
+        ...options,
+        ...formDataBodySerializer,
+        headers: {
+            'Content-Type': null,
+            ...options?.headers
+        },
+        url: '/api/v1/backups/upload/chunk'
+    });
+};
+
+/**
+ * Complete chunked backup upload
+ */
+export const completeBackupUpload = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<CompleteBackupUploadData, ThrowOnError>) => {
+    return (options?.client ?? client).post<CompleteBackupUploadResponse, CompleteBackupUploadError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/backups/upload/complete'
+    });
+};
+
+/**
+ * Abort chunked backup upload
+ */
+export const abortBackupUpload = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<AbortBackupUploadData, ThrowOnError>) => {
+    return (options?.client ?? client).post<AbortBackupUploadResponse, AbortBackupUploadError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/backups/upload/abort'
+    });
+};
+
+/**
+ * Get backup task progress
+ */
+export const getBackupProgress = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetBackupProgressData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetBackupProgressResponse, GetBackupProgressError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/backups/tasks/{task_id}'
+    });
+};
+
+/**
+ * Download a backup
+ */
+export const downloadBackup = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DownloadBackupData, ThrowOnError>) => {
+    return (options?.client ?? client).get<DownloadBackupResponse, DownloadBackupError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/backups/{filename}'
+    });
+};
+
+/**
+ * Rename a backup
+ */
+export const renameBackup = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<RenameBackupData, ThrowOnError>) => {
+    return (options?.client ?? client).patch<RenameBackupResponse, RenameBackupError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/backups/{filename}'
+    });
+};
+
+/**
+ * Delete a backup
+ */
+export const deleteBackup = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteBackupData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeleteBackupResponse, DeleteBackupError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/backups/{filename}'
+    });
+};
+
+/**
+ * Check a backup before import
+ */
+export const checkBackup = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<CheckBackupData, ThrowOnError>) => {
+    return (options?.client ?? client).post<CheckBackupResponse, CheckBackupError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/backups/{filename}/check'
+    });
+};
+
+/**
+ * Import a backup
+ */
+export const importBackup = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<ImportBackupData, ThrowOnError>) => {
+    return (options?.client ?? client).post<ImportBackupResponse, ImportBackupError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/backups/{filename}/import'
+    });
+};
+
+/**
+ * Check for updates
+ */
+export const checkUpdate = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<CheckUpdateResponse, CheckUpdateError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/updates/check'
+    });
+};
+
+/**
+ * List releases
+ */
+export const listReleases = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<ListReleasesData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListReleasesResponse, ListReleasesError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/updates/releases'
+    });
+};
+
+/**
+ * Update AstrBot core
+ */
+export const updateCore = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<UpdateCoreData, ThrowOnError>) => {
+    return (options?.client ?? client).post<UpdateCoreResponse, UpdateCoreError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/updates/core'
+    });
+};
+
+/**
+ * Update dashboard assets
+ */
+export const updateDashboard = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<UpdateDashboardData, ThrowOnError>) => {
+    return (options?.client ?? client).post<UpdateDashboardResponse, UpdateDashboardError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/updates/dashboard'
+    });
+};
+
+/**
+ * Get update progress
+ */
+export const getUpdateProgress = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetUpdateProgressData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetUpdateProgressResponse, GetUpdateProgressError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/updates/progress/{task_id}'
+    });
+};
+
+/**
+ * Install a Python package
+ */
+export const installPipPackage = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<InstallPipPackageData, ThrowOnError>) => {
+    return (options?.client ?? client).post<InstallPipPackageResponse, InstallPipPackageError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/pip/install'
+    });
+};
+
+/**
+ * Run pending migrations
+ */
+export const runMigrations = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<RunMigrationsData, ThrowOnError>) => {
+    return (options?.client ?? client).post<RunMigrationsResponse, RunMigrationsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/migrations'
+    });
+};
+
+/**
+ * List cron jobs
+ */
+export const listCronJobs = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<ListCronJobsData, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListCronJobsResponse, ListCronJobsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/cron/jobs'
+    });
+};
+
+/**
+ * Create a cron job
+ */
+export const createCronJob = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<CreateCronJobData, ThrowOnError>) => {
+    return (options?.client ?? client).post<CreateCronJobResponse, CreateCronJobError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/cron/jobs'
+    });
+};
+
+/**
+ * Update a cron job
+ */
+export const updateCronJob = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdateCronJobData, ThrowOnError>) => {
+    return (options?.client ?? client).patch<UpdateCronJobResponse, UpdateCronJobError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/cron/jobs/{job_id}'
+    });
+};
+
+/**
+ * Delete a cron job
+ */
+export const deleteCronJob = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteCronJobData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeleteCronJobResponse, DeleteCronJobError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/cron/jobs/{job_id}'
+    });
+};
+
+/**
+ * Run a cron job immediately
+ */
+export const runCronJob = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<RunCronJobData, ThrowOnError>) => {
+    return (options?.client ?? client).post<RunCronJobResponse, RunCronJobError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/cron/jobs/{job_id}/run'
+    });
+};
+
+/**
+ * Stream live logs
+ */
+export const streamLiveLogs = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<StreamLiveLogsResponse, StreamLiveLogsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/logs/live'
+    });
+};
+
+/**
+ * Get log history
+ */
+export const getLogHistory = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetLogHistoryResponse, GetLogHistoryError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/logs/history'
+    });
+};
+
+/**
+ * Get trace settings
+ */
+export const getTraceSettings = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetTraceSettingsResponse, GetTraceSettingsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/trace/settings'
+    });
+};
+
+/**
+ * Update trace settings
+ */
+export const updateTraceSettings = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdateTraceSettingsData, ThrowOnError>) => {
+    return (options?.client ?? client).put<UpdateTraceSettingsResponse, UpdateTraceSettingsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/trace/settings'
+    });
+};
+
+/**
+ * List text-to-image templates
+ */
+export const listT2iTemplates = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListT2iTemplatesResponse, ListT2iTemplatesError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/t2i/templates'
+    });
+};
+
+/**
+ * Create a text-to-image template
+ */
+export const createT2iTemplate = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<CreateT2iTemplateData, ThrowOnError>) => {
+    return (options?.client ?? client).post<CreateT2iTemplateResponse, CreateT2iTemplateError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/t2i/templates'
+    });
+};
+
+/**
+ * Get active text-to-image template
+ */
+export const getActiveT2iTemplate = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetActiveT2iTemplateResponse, GetActiveT2iTemplateError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/t2i/templates/active'
+    });
+};
+
+/**
+ * Set active text-to-image template
+ */
+export const setActiveT2iTemplate = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<SetActiveT2iTemplateData, ThrowOnError>) => {
+    return (options?.client ?? client).put<SetActiveT2iTemplateResponse, SetActiveT2iTemplateError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/t2i/templates/active'
+    });
+};
+
+/**
+ * Reset the default text-to-image template
+ */
+export const resetDefaultT2iTemplate = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).post<ResetDefaultT2iTemplateResponse, ResetDefaultT2iTemplateError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/t2i/templates/default/reset'
+    });
+};
+
+/**
+ * Get a text-to-image template
+ */
+export const getT2iTemplate = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<GetT2iTemplateData, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetT2iTemplateResponse, GetT2iTemplateError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/t2i/templates/{name}'
+    });
+};
+
+/**
+ * Update a text-to-image template
+ */
+export const updateT2iTemplate = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdateT2iTemplateData, ThrowOnError>) => {
+    return (options?.client ?? client).put<UpdateT2iTemplateResponse, UpdateT2iTemplateError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/t2i/templates/{name}'
+    });
+};
+
+/**
+ * Delete a text-to-image template
+ */
+export const deleteT2iTemplate = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<DeleteT2iTemplateData, ThrowOnError>) => {
+    return (options?.client ?? client).delete<DeleteT2iTemplateResponse, DeleteT2iTemplateError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/t2i/templates/{name}'
+    });
+};
+
+/**
+ * Get subagent orchestrator configuration
+ */
+export const getSubagentConfig = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<GetSubagentConfigResponse, GetSubagentConfigError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/subagents/config'
+    });
+};
+
+/**
+ * Update subagent orchestrator configuration
+ */
+export const updateSubagentConfig = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdateSubagentConfigData, ThrowOnError>) => {
+    return (options?.client ?? client).put<UpdateSubagentConfigResponse, UpdateSubagentConfigError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/subagents/config'
+    });
+};
+
+/**
+ * List tools available to subagents
+ */
+export const listSubagentAvailableTools = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
+    return (options?.client ?? client).get<ListSubagentAvailableToolsResponse, ListSubagentAvailableToolsError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/subagents/available-tools'
+    });
+};
+
+/**
+ * Verify a platform webhook
+ */
+export const verifyPlatformWebhook = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<VerifyPlatformWebhookData, ThrowOnError>) => {
+    return (options?.client ?? client).get<VerifyPlatformWebhookResponse, VerifyPlatformWebhookError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/webhooks/platforms/{webhook_uuid}'
+    });
+};
+
+/**
+ * Receive a platform webhook
+ */
+export const receivePlatformWebhook = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<ReceivePlatformWebhookData, ThrowOnError>) => {
+    return (options?.client ?? client).post<ReceivePlatformWebhookResponse, ReceivePlatformWebhookError, ThrowOnError>({
+        ...options,
+        url: '/api/v1/webhooks/platforms/{webhook_uuid}'
+    });
+};
\ No newline at end of file
diff --git a/dashboard/src/api/generated/openapi-v1/types.gen.ts b/dashboard/src/api/generated/openapi-v1/types.gen.ts
new file mode 100644
index 000000000..e0938bb91
--- /dev/null
+++ b/dashboard/src/api/generated/openapi-v1/types.gen.ts
@@ -0,0 +1,3473 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+export type BackupChunkUploadRequest = {
+    upload_id: string;
+    chunk_index: number;
+    chunk: (Blob | File);
+};
+
+export type BackupExportRequest = {
+    include?: Array<(string)>;
+    exclude?: Array<(string)>;
+};
+
+export type BackupImportRequest = {
+    confirmed?: boolean;
+};
+
+export type BackupRenameRequest = {
+    new_name: string;
+};
+
+export type BackupUploadInitRequest = {
+    filename: string;
+    total_size: number;
+};
+
+export type BackupUploadRequest = {
+    file: (Blob | File);
+};
+
+export type BackupUploadSessionRequest = {
+    upload_id: string;
+};
+
+export type BatchSessionProviderRequest = UmoListRequest & {
+    provider_id: string;
+    provider_type: 'chat_completion' | 'speech_to_text' | 'text_to_speech';
+};
+
+export type provider_type = 'chat_completion' | 'speech_to_text' | 'text_to_speech';
+
+export type BatchSessionServiceRequest = UmoListRequest & {
+    session_enabled?: boolean;
+    llm_enabled?: boolean;
+    tts_enabled?: boolean;
+};
+
+export type BotConfigRequest = {
+    id?: string;
+    name?: string;
+    /**
+     * Platform adapter type, such as aiocqhttp, telegram, lark.
+     */
+    type: string;
+    enabled?: boolean;
+    config: DynamicConfig;
+};
+
+export type BotRegistrationRequest = {
+    action: 'start' | 'poll';
+    platform_config?: DynamicConfig;
+    registration_code?: string;
+    device_code?: string;
+    qrcode?: string;
+    [key: string]: unknown | string | DynamicConfig;
+};
+
+export type action = 'start' | 'poll';
+
+export type ChatMessagePatchRequest = {
+    content: {
+        [key: string]: unknown;
+    };
+};
+
+export type ChatMessageRegenerateRequest = {
+    selected_provider?: string;
+    selected_model?: string;
+    enable_streaming?: boolean;
+};
+
+export type ChatProjectRequest = {
+    title?: string;
+    emoji?: string;
+    description?: string;
+};
+
+export type ChatRequest = {
+    username?: string;
+    session_id?: string;
+    /**
+     * Deprecated alias for session_id.
+     */
+    conversation_id?: string;
+    message: (string | Array<MessagePart>);
+    config_id?: string;
+    config_name?: string;
+    selected_provider?: string;
+    selected_model?: string;
+    enable_streaming?: boolean;
+    /**
+     * Internal WebUI flag for edit/regenerate flows.
+     */
+    _skip_user_history?: boolean;
+    /**
+     * Internal WebUI checkpoint override.
+     */
+    _llm_checkpoint_id?: string;
+    /**
+     * Internal WebUI platform history override.
+     */
+    _platform_history_id?: string;
+    /**
+     * Internal WebUI side-thread context.
+     */
+    _thread_selected_text?: string;
+};
+
+export type ChatSessionBatchDeleteRequest = {
+    session_ids: Array<(string)>;
+};
+
+export type ChatSessionPatchRequest = {
+    display_name?: string;
+};
+
+export type ChatThreadCreateRequest = {
+    session_id: string;
+    parent_message_id: (string | number);
+    selected_text: string;
+};
+
+export type ChatThreadMessageRequest = {
+    message: (string | Array<MessagePart>);
+    selected_provider?: string;
+    selected_model?: string;
+    enable_streaming?: boolean;
+};
+
+export type CommandPatchRequest = {
+    enabled?: boolean;
+    alias?: string;
+    aliases?: Array<(string)>;
+    permission_group?: string;
+};
+
+export type ConfigRoutesReplaceRequest = {
+    routing: {
+        [key: string]: (string);
+    };
+};
+
+export type ConfigRouteUpsertRequest = {
+    /**
+     * Use "default" to remove a custom route and fall back.
+     */
+    config_id: string;
+};
+
+export type ConversationBatchDeleteRequest = {
+    conversations: Array<ConversationRef>;
+};
+
+export type ConversationExportRequest = {
+    conversations?: Array<ConversationRef>;
+    conversation_ids?: Array<(string)>;
+    format?: 'json' | 'markdown';
+};
+
+export type format = 'json' | 'markdown';
+
+export type ConversationMessagesReplaceRequest = {
+    user_id?: string;
+    messages?: Array<{
+        [key: string]: unknown;
+    }>;
+    history?: Array<{
+        [key: string]: unknown;
+    }>;
+};
+
+export type ConversationPatchRequest = {
+    title?: string;
+    persona_id?: string;
+};
+
+export type ConversationRef = {
+    user_id: string;
+    cid: string;
+};
+
+export type CreateApiKeyRequest = {
+    name: string;
+    scopes?: Array<('bot' | 'provider' | 'persona' | 'im' | 'config' | 'chat' | 'plugin' | 'mcp' | 'skill')>;
+    expires_at?: string;
+    expires_in_days?: number;
+};
+
+export type CreateConfigProfileRequest = {
+    name?: string;
+    config?: DynamicConfig;
+};
+
+export type CronJobPatchRequest = CronJobRequest;
+
+export type CronJobRequest = {
+    name?: string;
+    cron_expression?: string;
+    timezone?: string;
+    session?: string;
+    note?: string;
+    description?: string;
+    persona_id?: string;
+    provider_id?: string;
+    enabled?: boolean;
+    run_once?: boolean;
+    run_at?: string;
+    payload?: {
+        [key: string]: unknown;
+    };
+    [key: string]: unknown | string | boolean;
+};
+
+export type DynamicConfig = {
+    [key: string]: unknown;
+};
+
+export type EnabledPatch = {
+    enabled: boolean;
+};
+
+export type ErrorEnvelope = {
+    status: "error";
+    message: string;
+    data?: unknown;
+};
+
+export type FileUploadRequest = {
+    file: (Blob | File);
+};
+
+export type GhproxyTestRequest = {
+    proxy_url: string;
+};
+
+export type ImMessageRequest = {
+    umo: string;
+    message: (string | Array<MessagePart>);
+};
+
+export type JsonSchema = {
+    [key: string]: unknown;
+};
+
+export type KnowledgeBaseRequest = {
+    name: string;
+    description?: string;
+    embedding_provider_id?: string;
+    rerank_provider_id?: string;
+    chunking?: DynamicConfig;
+    metadata?: DynamicConfig;
+};
+
+export type KnowledgeDocumentImportRequest = {
+    paths: Array<(string)>;
+    parser?: string;
+};
+
+export type KnowledgeDocumentUploadRequest = {
+    file: (Blob | File);
+    parser?: string;
+};
+
+export type KnowledgeDocumentUrlImportRequest = {
+    url: string;
+    parser?: string;
+};
+
+export type KnowledgeRetrieveRequest = {
+    query: string;
+    top_k?: number;
+    score_threshold?: number;
+};
+
+export type LoginRequest = {
+    username: string;
+    password: string;
+    /**
+     * TOTP code or recovery code when two-factor authentication is required.
+     */
+    code?: string;
+    trust_device_flag?: boolean;
+};
+
+export type McpServerConfig = {
+    name: string;
+    enabled?: boolean;
+    transport?: 'stdio' | 'sse' | 'streamable_http';
+    command?: string;
+    args?: Array<(string)>;
+    url?: string;
+    headers?: {
+        [key: string]: (string);
+    };
+    timeout?: number;
+    [key: string]: unknown | string | boolean | number;
+};
+
+export type transport = 'stdio' | 'sse' | 'streamable_http';
+
+export type MessagePart = {
+    type: 'text' | 'plain' | 'image' | 'file' | 'audio' | 'record' | 'video' | 'reply';
+    text?: string;
+    attachment_id?: string;
+    url?: string;
+    filename?: string;
+    mime_type?: string;
+    [key: string]: unknown | string;
+};
+
+export type type = 'text' | 'plain' | 'image' | 'file' | 'audio' | 'record' | 'video' | 'reply';
+
+export type MigrationRequest = {
+    platform_id_map?: {
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+};
+
+export type ModelScopeSyncRequest = {
+    access_token?: string;
+};
+
+export type NameRequest = {
+    name: string;
+};
+
+export type NeoCandidateActionRequest = {
+    candidate_id: string;
+    [key: string]: unknown | string;
+};
+
+export type NeoReleaseActionRequest = {
+    release_id: string;
+    [key: string]: unknown | string;
+};
+
+export type ParameterAttachmentId = string;
+
+export type ParameterBotId = string;
+
+export type ParameterChunkId = string;
+
+/**
+ * URL-encoded command handler full name.
+ */
+export type ParameterCommandId = string;
+
+export type ParameterConfigId = string;
+
+export type ParameterConversationId = string;
+
+export type ParameterDocumentId = string;
+
+export type ParameterFilename = string;
+
+/**
+ * URL-encoded relative file path.
+ */
+export type ParameterFilePath = string;
+
+export type ParameterFolderId = string;
+
+export type ParameterGroupId = string;
+
+export type ParameterKbId = string;
+
+export type ParameterKeyId = string;
+
+export type ParameterName = string;
+
+export type ParameterPage = number;
+
+export type ParameterPageSize = number;
+
+export type ParameterPersonaId = string;
+
+export type ParameterPluginId = string;
+
+export type ParameterProviderId = string;
+
+export type ParameterServerName = string;
+
+export type ParameterSessionId = string;
+
+export type ParameterSkillName = string;
+
+export type ParameterSourceId = string;
+
+export type ParameterTaskId = string;
+
+export type ParameterToolId = string;
+
+/**
+ * URL-encoded unified message origin.
+ */
+export type ParameterUmo = string;
+
+export type ParameterWebhookUuid = string;
+
+export type PersonaFolderRequest = {
+    name?: string;
+    parent_id?: string;
+    description?: string;
+    [key: string]: unknown | string;
+};
+
+export type PersonaMoveRequest = {
+    persona_id: string;
+    folder_id?: string;
+    [key: string]: unknown | string;
+};
+
+export type PersonaRequest = {
+    persona_id: string;
+    system_prompt: string;
+    begin_dialogs?: Array<(string)>;
+    folder_id?: string;
+    tools?: Array<(string)>;
+    skills?: Array<(string)>;
+    custom_error_message?: string;
+    [key: string]: unknown | string;
+};
+
+export type PipInstallRequest = {
+    package: string;
+    mirror?: string;
+};
+
+export type PluginBatchUpdateRequest = {
+    /**
+     * When set, update this single plugin instead of a batch.
+     */
+    plugin_id?: string;
+    plugin_ids?: Array<(string)>;
+    reinstall?: boolean;
+    update_all?: boolean;
+    [key: string]: unknown | string | boolean;
+};
+
+export type PluginConfigFileDeleteRequest = {
+    path: string;
+};
+
+export type PluginGithubInstallRequest = {
+    /**
+     * GitHub URL or owner/repository slug.
+     */
+    repository: string;
+    ref?: string;
+    /**
+     * Optional downloadable ZIP URL to use instead of GitHub archive resolution.
+     */
+    download_url?: string;
+    proxy?: string;
+    ignore_version_check?: boolean;
+};
+
+export type PluginSourceRequest = {
+    id?: string;
+    name?: string;
+    url: string;
+};
+
+export type PluginUpdateRequest = {
+    reinstall?: boolean;
+};
+
+export type PluginUploadInstallRequest = {
+    file: (Blob | File);
+};
+
+export type PluginUrlInstallRequest = {
+    url: string;
+    /**
+     * Optional downloadable ZIP URL when url is the plugin source page or repository.
+     */
+    download_url?: string;
+    proxy?: string;
+    ignore_version_check?: boolean;
+};
+
+export type PluginVersionSupportRequest = {
+    astrbot_version?: string;
+};
+
+export type ProviderCapability = 'chat' | 'agent' | 'stt' | 'tts' | 'embedding' | 'rerank';
+
+export type ProviderConfigRequest = {
+    id?: string;
+    provider_source_id?: string;
+    capability?: ProviderCapability;
+    enabled?: boolean;
+    config: DynamicConfig;
+};
+
+export type ProviderSourceConfigRequest = {
+    id?: string;
+    config: DynamicConfig;
+};
+
+export type RenameRequest = {
+    name: string;
+};
+
+export type ReorderRequest = {
+    items: Array<{
+        id: string;
+        type: 'persona' | 'folder';
+        sort_order: number;
+    }>;
+};
+
+export type SessionGroupRequest = {
+    name?: string;
+    umos?: Array<(string)>;
+    add_umos?: Array<(string)>;
+    remove_umos?: Array<(string)>;
+};
+
+export type SessionRuleRequest = {
+    umo: string;
+    rule_key: string;
+    rule_value?: DynamicConfig;
+    [key: string]: unknown | string | DynamicConfig;
+};
+
+export type SetupAuthRequest = {
+    username: string;
+    password: string;
+    confirm_password: string;
+};
+
+export type SkillPatchRequest = {
+    enabled?: boolean;
+    display_name?: string;
+    description?: string;
+};
+
+export type SkillUploadRequest = {
+    file: (Blob | File);
+    overwrite?: boolean;
+};
+
+export type SuccessEnvelope = {
+    status: "ok";
+    message?: string;
+    data: unknown;
+};
+
+export type T2iTemplateContentRequest = {
+    content: string;
+    [key: string]: unknown | string;
+};
+
+export type T2iTemplateRequest = {
+    name: string;
+    content: string;
+    [key: string]: unknown | string;
+};
+
+export type ToolPermissionPatch = {
+    permission: 'admin' | 'member';
+};
+
+export type permission = 'admin' | 'member';
+
+export type TotpSetupRequest = {
+    code?: string;
+    secret?: string;
+};
+
+export type TraceSettingsRequest = {
+    enabled?: boolean;
+    level?: string;
+    [key: string]: unknown | boolean | string;
+};
+
+export type UmoListRequest = {
+    umo?: string;
+    umos?: Array<(string)>;
+    scope?: 'all' | 'group' | 'private' | 'custom_group';
+    group_id?: string;
+    rule_key?: string;
+};
+
+export type scope = 'all' | 'group' | 'private' | 'custom_group';
+
+export type UpdateAccountRequest = {
+    password: string;
+    new_password?: string;
+    confirm_password?: string;
+    new_username?: string;
+};
+
+export type UpdateRequest = {
+    version?: string;
+    proxy?: string;
+    reboot?: boolean;
+    progress_id?: string;
+};
+
+export type LoginData = {
+    body: LoginRequest;
+};
+
+export type LoginResponse = (SuccessEnvelope);
+
+export type LoginError = (ErrorEnvelope);
+
+export type LogoutResponse = (SuccessEnvelope);
+
+export type LogoutError = unknown;
+
+export type GetAuthSetupStatusResponse = (SuccessEnvelope);
+
+export type GetAuthSetupStatusError = unknown;
+
+export type SetupAuthData = {
+    body: SetupAuthRequest;
+};
+
+export type SetupAuthResponse = (SuccessEnvelope);
+
+export type SetupAuthError = unknown;
+
+export type SetupTotpData = {
+    body?: TotpSetupRequest;
+};
+
+export type SetupTotpResponse = (SuccessEnvelope);
+
+export type SetupTotpError = unknown;
+
+export type RecoverTotpResponse = (SuccessEnvelope);
+
+export type RecoverTotpError = unknown;
+
+export type UpdateAuthAccountData = {
+    body: UpdateAccountRequest;
+};
+
+export type UpdateAuthAccountResponse = (SuccessEnvelope);
+
+export type UpdateAuthAccountError = unknown;
+
+export type ListApiKeysResponse = (SuccessEnvelope);
+
+export type ListApiKeysError = unknown;
+
+export type CreateApiKeyData = {
+    body: CreateApiKeyRequest;
+};
+
+export type CreateApiKeyResponse = (SuccessEnvelope);
+
+export type CreateApiKeyError = unknown;
+
+export type RevokeApiKeyData = {
+    path: {
+        key_id: string;
+    };
+};
+
+export type RevokeApiKeyResponse = (SuccessEnvelope);
+
+export type RevokeApiKeyError = unknown;
+
+export type DeleteApiKeyData = {
+    path: {
+        key_id: string;
+    };
+};
+
+export type DeleteApiKeyResponse = (SuccessEnvelope);
+
+export type DeleteApiKeyError = unknown;
+
+export type GetSystemConfigSchemaResponse = (SuccessEnvelope);
+
+export type GetSystemConfigSchemaError = unknown;
+
+export type GetSystemConfigResponse = (SuccessEnvelope);
+
+export type GetSystemConfigError = unknown;
+
+export type UpdateSystemConfigData = {
+    body: DynamicConfig;
+};
+
+export type UpdateSystemConfigResponse = (SuccessEnvelope);
+
+export type UpdateSystemConfigError = unknown;
+
+export type GetSystemConfigRuntimeResponse = (SuccessEnvelope);
+
+export type GetSystemConfigRuntimeError = unknown;
+
+export type GetConfigProfileSchemaResponse = (SuccessEnvelope);
+
+export type GetConfigProfileSchemaError = unknown;
+
+export type ListConfigProfilesResponse = (SuccessEnvelope);
+
+export type ListConfigProfilesError = unknown;
+
+export type CreateConfigProfileData = {
+    body: CreateConfigProfileRequest;
+};
+
+export type CreateConfigProfileResponse = (SuccessEnvelope);
+
+export type CreateConfigProfileError = unknown;
+
+export type GetConfigProfileData = {
+    path: {
+        config_id: string;
+    };
+};
+
+export type GetConfigProfileResponse = (SuccessEnvelope);
+
+export type GetConfigProfileError = unknown;
+
+export type UpdateConfigProfileContentData = {
+    body: DynamicConfig;
+    path: {
+        config_id: string;
+    };
+};
+
+export type UpdateConfigProfileContentResponse = (SuccessEnvelope);
+
+export type UpdateConfigProfileContentError = unknown;
+
+export type RenameConfigProfileData = {
+    body: RenameRequest;
+    path: {
+        config_id: string;
+    };
+};
+
+export type RenameConfigProfileResponse = (SuccessEnvelope);
+
+export type RenameConfigProfileError = unknown;
+
+export type DeleteConfigProfileData = {
+    path: {
+        config_id: string;
+    };
+};
+
+export type DeleteConfigProfileResponse = (SuccessEnvelope);
+
+export type DeleteConfigProfileError = unknown;
+
+export type ListConfigRoutesResponse = (SuccessEnvelope);
+
+export type ListConfigRoutesError = unknown;
+
+export type ReplaceConfigRoutesData = {
+    body: ConfigRoutesReplaceRequest;
+};
+
+export type ReplaceConfigRoutesResponse = (SuccessEnvelope);
+
+export type ReplaceConfigRoutesError = unknown;
+
+export type UpsertConfigRouteData = {
+    body: ConfigRouteUpsertRequest;
+    path: {
+        /**
+         * URL-encoded unified message origin.
+         */
+        umo: string;
+    };
+};
+
+export type UpsertConfigRouteResponse = (SuccessEnvelope);
+
+export type UpsertConfigRouteError = unknown;
+
+export type DeleteConfigRouteData = {
+    path: {
+        /**
+         * URL-encoded unified message origin.
+         */
+        umo: string;
+    };
+};
+
+export type DeleteConfigRouteResponse = (SuccessEnvelope);
+
+export type DeleteConfigRouteError = unknown;
+
+export type ListBotTypesResponse = (SuccessEnvelope);
+
+export type ListBotTypesError = unknown;
+
+export type RegisterBotTypeData = {
+    body: BotRegistrationRequest;
+    path: {
+        bot_type: string;
+    };
+};
+
+export type RegisterBotTypeResponse = (SuccessEnvelope);
+
+export type RegisterBotTypeError = unknown;
+
+export type ListBotsData = {
+    query?: {
+        enabled?: boolean;
+        type?: string;
+    };
+};
+
+export type ListBotsResponse = (SuccessEnvelope);
+
+export type ListBotsError = unknown;
+
+export type CreateBotData = {
+    body: BotConfigRequest;
+};
+
+export type CreateBotResponse = (SuccessEnvelope);
+
+export type CreateBotError = unknown;
+
+export type ListBotStatsResponse = (SuccessEnvelope);
+
+export type ListBotStatsError = unknown;
+
+export type GetBotByIdData = {
+    query: {
+        bot_id: string;
+    };
+};
+
+export type GetBotByIdResponse = (SuccessEnvelope);
+
+export type GetBotByIdError = unknown;
+
+export type UpdateBotByIdData = {
+    body: {
+        bot_id: string;
+        config: DynamicConfig;
+    };
+};
+
+export type UpdateBotByIdResponse = (SuccessEnvelope);
+
+export type UpdateBotByIdError = unknown;
+
+export type DeleteBotByIdData = {
+    query: {
+        bot_id: string;
+    };
+};
+
+export type DeleteBotByIdResponse = (SuccessEnvelope);
+
+export type DeleteBotByIdError = unknown;
+
+export type SetBotEnabledByIdData = {
+    body: {
+        bot_id: string;
+        enabled: boolean;
+    };
+};
+
+export type SetBotEnabledByIdResponse = (SuccessEnvelope);
+
+export type SetBotEnabledByIdError = unknown;
+
+export type TestBotByIdData = {
+    body: {
+        bot_id: string;
+    };
+};
+
+export type TestBotByIdResponse = (SuccessEnvelope);
+
+export type TestBotByIdError = unknown;
+
+export type GetBotData = {
+    path: {
+        bot_id: string;
+    };
+};
+
+export type GetBotResponse = (SuccessEnvelope);
+
+export type GetBotError = unknown;
+
+export type UpdateBotData = {
+    body: BotConfigRequest;
+    path: {
+        bot_id: string;
+    };
+};
+
+export type UpdateBotResponse = (SuccessEnvelope);
+
+export type UpdateBotError = unknown;
+
+export type DeleteBotData = {
+    path: {
+        bot_id: string;
+    };
+};
+
+export type DeleteBotResponse = (SuccessEnvelope);
+
+export type DeleteBotError = unknown;
+
+export type SetBotEnabledData = {
+    body: EnabledPatch;
+    path: {
+        bot_id: string;
+    };
+};
+
+export type SetBotEnabledResponse = (SuccessEnvelope);
+
+export type SetBotEnabledError = unknown;
+
+export type TestBotData = {
+    path: {
+        bot_id: string;
+    };
+};
+
+export type TestBotResponse = (SuccessEnvelope);
+
+export type TestBotError = unknown;
+
+export type GetProviderSchemaResponse = (SuccessEnvelope);
+
+export type GetProviderSchemaError = unknown;
+
+export type ListProviderSourcesResponse = (SuccessEnvelope);
+
+export type ListProviderSourcesError = unknown;
+
+export type CreateProviderSourceData = {
+    body: ProviderSourceConfigRequest;
+};
+
+export type CreateProviderSourceResponse = (SuccessEnvelope);
+
+export type CreateProviderSourceError = unknown;
+
+export type GetProviderSourceByIdData = {
+    query: {
+        source_id: string;
+    };
+};
+
+export type GetProviderSourceByIdResponse = (SuccessEnvelope);
+
+export type GetProviderSourceByIdError = unknown;
+
+export type UpsertProviderSourceByIdData = {
+    body: {
+        source_id: string;
+        config: DynamicConfig;
+    };
+};
+
+export type UpsertProviderSourceByIdResponse = (SuccessEnvelope);
+
+export type UpsertProviderSourceByIdError = unknown;
+
+export type DeleteProviderSourceByIdData = {
+    query: {
+        source_id: string;
+    };
+};
+
+export type DeleteProviderSourceByIdResponse = (SuccessEnvelope);
+
+export type DeleteProviderSourceByIdError = unknown;
+
+export type ListProviderSourceModelsByIdData = {
+    query: {
+        capability?: ProviderCapability;
+        source_id: string;
+    };
+};
+
+export type ListProviderSourceModelsByIdResponse = (SuccessEnvelope);
+
+export type ListProviderSourceModelsByIdError = unknown;
+
+export type ListProvidersBySourceIdData = {
+    query: {
+        capability?: ProviderCapability;
+        source_id: string;
+    };
+};
+
+export type ListProvidersBySourceIdResponse = (SuccessEnvelope);
+
+export type ListProvidersBySourceIdError = unknown;
+
+export type CreateProviderInSourceByIdData = {
+    body: {
+        source_id: string;
+        config: DynamicConfig;
+    };
+};
+
+export type CreateProviderInSourceByIdResponse = (SuccessEnvelope);
+
+export type CreateProviderInSourceByIdError = unknown;
+
+export type GetProviderSourceData = {
+    path: {
+        source_id: string;
+    };
+};
+
+export type GetProviderSourceResponse = (SuccessEnvelope);
+
+export type GetProviderSourceError = unknown;
+
+export type UpsertProviderSourceData = {
+    body: ProviderSourceConfigRequest;
+    path: {
+        source_id: string;
+    };
+};
+
+export type UpsertProviderSourceResponse = (SuccessEnvelope);
+
+export type UpsertProviderSourceError = unknown;
+
+export type DeleteProviderSourceData = {
+    path: {
+        source_id: string;
+    };
+};
+
+export type DeleteProviderSourceResponse = (SuccessEnvelope);
+
+export type DeleteProviderSourceError = unknown;
+
+export type ListProviderSourceModelsData = {
+    path: {
+        source_id: string;
+    };
+    query?: {
+        capability?: ProviderCapability;
+    };
+};
+
+export type ListProviderSourceModelsResponse = (SuccessEnvelope);
+
+export type ListProviderSourceModelsError = unknown;
+
+export type ListProvidersBySourceData = {
+    path: {
+        source_id: string;
+    };
+    query?: {
+        capability?: ProviderCapability;
+    };
+};
+
+export type ListProvidersBySourceResponse = (SuccessEnvelope);
+
+export type ListProvidersBySourceError = unknown;
+
+export type CreateProviderInSourceData = {
+    body: ProviderConfigRequest;
+    path: {
+        source_id: string;
+    };
+};
+
+export type CreateProviderInSourceResponse = (SuccessEnvelope);
+
+export type CreateProviderInSourceError = unknown;
+
+export type ListProvidersData = {
+    query?: {
+        capability?: ProviderCapability;
+        enabled?: boolean;
+        source_id?: string;
+    };
+};
+
+export type ListProvidersResponse = (SuccessEnvelope);
+
+export type ListProvidersError = unknown;
+
+export type CreateProviderData = {
+    body: ProviderConfigRequest;
+};
+
+export type CreateProviderResponse = (SuccessEnvelope);
+
+export type CreateProviderError = unknown;
+
+export type GetProviderByIdData = {
+    query: {
+        merged?: boolean;
+        provider_id: string;
+    };
+};
+
+export type GetProviderByIdResponse = (SuccessEnvelope);
+
+export type GetProviderByIdError = unknown;
+
+export type UpdateProviderByIdData = {
+    body: {
+        provider_id: string;
+        config: DynamicConfig;
+    };
+};
+
+export type UpdateProviderByIdResponse = (SuccessEnvelope);
+
+export type UpdateProviderByIdError = unknown;
+
+export type DeleteProviderByIdData = {
+    query: {
+        provider_id: string;
+    };
+};
+
+export type DeleteProviderByIdResponse = (SuccessEnvelope);
+
+export type DeleteProviderByIdError = unknown;
+
+export type SetProviderEnabledByIdData = {
+    body: {
+        provider_id: string;
+        enabled: boolean;
+    };
+};
+
+export type SetProviderEnabledByIdResponse = (SuccessEnvelope);
+
+export type SetProviderEnabledByIdError = unknown;
+
+export type TestProviderByIdData = {
+    body: {
+        provider_id: string;
+    };
+};
+
+export type TestProviderByIdResponse = (SuccessEnvelope);
+
+export type TestProviderByIdError = unknown;
+
+export type GetProviderEmbeddingDimensionByIdData = {
+    body: {
+        provider_id: string;
+        provider_config?: DynamicConfig;
+    };
+};
+
+export type GetProviderEmbeddingDimensionByIdResponse = (SuccessEnvelope);
+
+export type GetProviderEmbeddingDimensionByIdError = unknown;
+
+export type GetProviderData = {
+    path: {
+        provider_id: string;
+    };
+    query?: {
+        merged?: boolean;
+    };
+};
+
+export type GetProviderResponse = (SuccessEnvelope);
+
+export type GetProviderError = unknown;
+
+export type UpdateProviderData = {
+    body: ProviderConfigRequest;
+    path: {
+        provider_id: string;
+    };
+};
+
+export type UpdateProviderResponse = (SuccessEnvelope);
+
+export type UpdateProviderError = unknown;
+
+export type DeleteProviderData = {
+    body?: DynamicConfig;
+    path: {
+        provider_id: string;
+    };
+};
+
+export type DeleteProviderResponse = (SuccessEnvelope);
+
+export type DeleteProviderError = unknown;
+
+export type SetProviderEnabledData = {
+    body: EnabledPatch;
+    path: {
+        provider_id: string;
+    };
+};
+
+export type SetProviderEnabledResponse = (SuccessEnvelope);
+
+export type SetProviderEnabledError = unknown;
+
+export type TestProviderData = {
+    path: {
+        provider_id: string;
+    };
+};
+
+export type TestProviderResponse = (SuccessEnvelope);
+
+export type TestProviderError = unknown;
+
+export type GetProviderEmbeddingDimensionData = {
+    body?: DynamicConfig;
+    path: {
+        provider_id: string;
+    };
+};
+
+export type GetProviderEmbeddingDimensionResponse = (SuccessEnvelope);
+
+export type GetProviderEmbeddingDimensionError = unknown;
+
+export type SendChatMessageData = {
+    body: ChatRequest;
+};
+
+export type SendChatMessageResponse = (SuccessEnvelope);
+
+export type SendChatMessageError = unknown;
+
+export type OpenChatWebSocketData = {
+    query?: {
+        api_key?: string;
+        key?: string;
+    };
+};
+
+export type OpenLiveChatWebSocketData = {
+    query: {
+        token: string;
+    };
+};
+
+export type OpenUnifiedChatWebSocketData = {
+    query: {
+        token: string;
+    };
+};
+
+export type ListChatSessionsData = {
+    query?: {
+        page?: number;
+        page_size?: number;
+        username?: string;
+    };
+};
+
+export type ListChatSessionsResponse = (SuccessEnvelope);
+
+export type ListChatSessionsError = unknown;
+
+export type CreateChatSessionData = {
+    query?: {
+        platform_id?: string;
+    };
+};
+
+export type CreateChatSessionResponse = (SuccessEnvelope);
+
+export type CreateChatSessionError = unknown;
+
+export type BatchDeleteChatSessionsData = {
+    body: ChatSessionBatchDeleteRequest;
+};
+
+export type BatchDeleteChatSessionsResponse = (SuccessEnvelope);
+
+export type BatchDeleteChatSessionsError = unknown;
+
+export type GetChatSessionData = {
+    path: {
+        session_id: string;
+    };
+};
+
+export type GetChatSessionResponse = (SuccessEnvelope);
+
+export type GetChatSessionError = unknown;
+
+export type UpdateChatSessionData = {
+    body: ChatSessionPatchRequest;
+    path: {
+        session_id: string;
+    };
+};
+
+export type UpdateChatSessionResponse = (SuccessEnvelope);
+
+export type UpdateChatSessionError = unknown;
+
+export type DeleteChatSessionData = {
+    path: {
+        session_id: string;
+    };
+};
+
+export type DeleteChatSessionResponse = (SuccessEnvelope);
+
+export type DeleteChatSessionError = unknown;
+
+export type StopChatSessionData = {
+    path: {
+        session_id: string;
+    };
+};
+
+export type StopChatSessionResponse = (SuccessEnvelope);
+
+export type StopChatSessionError = unknown;
+
+export type UpdateChatMessageData = {
+    body: ChatMessagePatchRequest;
+    path: {
+        message_id: string;
+        session_id: string;
+    };
+};
+
+export type UpdateChatMessageResponse = (SuccessEnvelope);
+
+export type UpdateChatMessageError = unknown;
+
+export type RegenerateChatMessageData = {
+    body?: ChatMessageRegenerateRequest;
+    path: {
+        message_id: string;
+        session_id: string;
+    };
+};
+
+export type RegenerateChatMessageResponse = (unknown);
+
+export type RegenerateChatMessageError = unknown;
+
+export type ListChatConfigsResponse = (SuccessEnvelope);
+
+export type ListChatConfigsError = unknown;
+
+export type CreateChatThreadData = {
+    body: ChatThreadCreateRequest;
+};
+
+export type CreateChatThreadResponse = (SuccessEnvelope);
+
+export type CreateChatThreadError = unknown;
+
+export type GetChatThreadData = {
+    path: {
+        thread_id: string;
+    };
+};
+
+export type GetChatThreadResponse = (SuccessEnvelope);
+
+export type GetChatThreadError = unknown;
+
+export type DeleteChatThreadData = {
+    path: {
+        thread_id: string;
+    };
+};
+
+export type DeleteChatThreadResponse = (SuccessEnvelope);
+
+export type DeleteChatThreadError = unknown;
+
+export type SendChatThreadMessageData = {
+    body: ChatThreadMessageRequest;
+    path: {
+        thread_id: string;
+    };
+};
+
+export type SendChatThreadMessageResponse = (unknown);
+
+export type SendChatThreadMessageError = unknown;
+
+export type ListChatProjectsResponse = (SuccessEnvelope);
+
+export type ListChatProjectsError = unknown;
+
+export type CreateChatProjectData = {
+    body: ChatProjectRequest;
+};
+
+export type CreateChatProjectResponse = (SuccessEnvelope);
+
+export type CreateChatProjectError = unknown;
+
+export type GetChatProjectData = {
+    path: {
+        project_id: string;
+    };
+};
+
+export type GetChatProjectResponse = (SuccessEnvelope);
+
+export type GetChatProjectError = unknown;
+
+export type UpdateChatProjectData = {
+    body: ChatProjectRequest;
+    path: {
+        project_id: string;
+    };
+};
+
+export type UpdateChatProjectResponse = (SuccessEnvelope);
+
+export type UpdateChatProjectError = unknown;
+
+export type DeleteChatProjectData = {
+    path: {
+        project_id: string;
+    };
+};
+
+export type DeleteChatProjectResponse = (SuccessEnvelope);
+
+export type DeleteChatProjectError = unknown;
+
+export type ListChatProjectSessionsData = {
+    path: {
+        project_id: string;
+    };
+};
+
+export type ListChatProjectSessionsResponse = (SuccessEnvelope);
+
+export type ListChatProjectSessionsError = unknown;
+
+export type AddChatProjectSessionData = {
+    path: {
+        project_id: string;
+        session_id: string;
+    };
+};
+
+export type AddChatProjectSessionResponse = (SuccessEnvelope);
+
+export type AddChatProjectSessionError = unknown;
+
+export type RemoveChatProjectSessionData = {
+    path: {
+        session_id: string;
+    };
+};
+
+export type RemoveChatProjectSessionResponse = (SuccessEnvelope);
+
+export type RemoveChatProjectSessionError = unknown;
+
+export type SendImMessageData = {
+    body: ImMessageRequest;
+};
+
+export type SendImMessageResponse = (SuccessEnvelope);
+
+export type SendImMessageError = unknown;
+
+export type ListImBotsResponse = (SuccessEnvelope);
+
+export type ListImBotsError = unknown;
+
+export type UploadFileData = {
+    body: FileUploadRequest;
+};
+
+export type UploadFileResponse = (SuccessEnvelope);
+
+export type UploadFileError = unknown;
+
+export type GetFileByNameData = {
+    query: {
+        filename: string;
+    };
+};
+
+export type GetFileByNameResponse = ((Blob | File));
+
+export type GetFileByNameError = unknown;
+
+export type GetTokenFileData = {
+    path: {
+        file_token: string;
+    };
+};
+
+export type GetTokenFileResponse = ((Blob | File));
+
+export type GetTokenFileError = unknown;
+
+export type GetAttachmentData = {
+    path: {
+        attachment_id: string;
+    };
+};
+
+export type GetAttachmentResponse = (SuccessEnvelope);
+
+export type GetAttachmentError = unknown;
+
+export type DeleteAttachmentData = {
+    path: {
+        attachment_id: string;
+    };
+};
+
+export type DeleteAttachmentResponse = (SuccessEnvelope);
+
+export type DeleteAttachmentError = unknown;
+
+export type DownloadAttachmentData = {
+    path: {
+        attachment_id: string;
+    };
+};
+
+export type DownloadAttachmentResponse = ((Blob | File));
+
+export type DownloadAttachmentError = unknown;
+
+export type ListPluginsData = {
+    query?: {
+        enabled?: boolean;
+        include_reserved?: boolean;
+    };
+};
+
+export type ListPluginsResponse = (SuccessEnvelope);
+
+export type ListPluginsError = unknown;
+
+export type GetPluginByIdData = {
+    query: {
+        plugin_id: string;
+    };
+};
+
+export type GetPluginByIdResponse = (SuccessEnvelope);
+
+export type GetPluginByIdError = unknown;
+
+export type UninstallPluginByIdData = {
+    body?: {
+        delete_config?: boolean;
+        delete_data?: boolean;
+        [key: string]: unknown | boolean;
+    };
+    query: {
+        plugin_id: string;
+    };
+};
+
+export type UninstallPluginByIdResponse = (SuccessEnvelope);
+
+export type UninstallPluginByIdError = unknown;
+
+export type GetPluginConfigByIdData = {
+    query: {
+        plugin_id: string;
+    };
+};
+
+export type GetPluginConfigByIdResponse = (SuccessEnvelope);
+
+export type GetPluginConfigByIdError = unknown;
+
+export type UpdatePluginConfigByIdData = {
+    body: {
+        plugin_id: string;
+        config: DynamicConfig;
+    };
+};
+
+export type UpdatePluginConfigByIdResponse = (SuccessEnvelope);
+
+export type UpdatePluginConfigByIdError = unknown;
+
+export type GetPluginConfigSchemaByIdData = {
+    query: {
+        plugin_id: string;
+    };
+};
+
+export type GetPluginConfigSchemaByIdResponse = (SuccessEnvelope);
+
+export type GetPluginConfigSchemaByIdError = unknown;
+
+export type ListPluginConfigFilesByIdData = {
+    query: {
+        config_key: string;
+        plugin_id: string;
+    };
+};
+
+export type ListPluginConfigFilesByIdResponse = (SuccessEnvelope);
+
+export type ListPluginConfigFilesByIdError = unknown;
+
+export type UploadPluginConfigFilesByIdData = {
+    body: {
+        [key: string]: unknown;
+    };
+    query: {
+        config_key: string;
+        plugin_id: string;
+    };
+};
+
+export type UploadPluginConfigFilesByIdResponse = (SuccessEnvelope);
+
+export type UploadPluginConfigFilesByIdError = unknown;
+
+export type DeletePluginConfigFileByIdData = {
+    body: PluginConfigFileDeleteRequest;
+    query: {
+        plugin_id: string;
+    };
+};
+
+export type DeletePluginConfigFileByIdResponse = (SuccessEnvelope);
+
+export type DeletePluginConfigFileByIdError = unknown;
+
+export type GetPluginReadmeByIdData = {
+    query: {
+        plugin_id: string;
+    };
+};
+
+export type GetPluginReadmeByIdResponse = (string);
+
+export type GetPluginReadmeByIdError = unknown;
+
+export type GetPluginChangelogByIdData = {
+    query: {
+        plugin_id: string;
+    };
+};
+
+export type GetPluginChangelogByIdResponse = (string);
+
+export type GetPluginChangelogByIdError = unknown;
+
+export type ReloadPluginByIdData = {
+    body: {
+        plugin_id: string;
+    };
+};
+
+export type ReloadPluginByIdResponse = (SuccessEnvelope);
+
+export type ReloadPluginByIdError = unknown;
+
+export type SetPluginEnabledByIdData = {
+    body: {
+        plugin_id: string;
+        enabled: boolean;
+    };
+};
+
+export type SetPluginEnabledByIdResponse = (SuccessEnvelope);
+
+export type SetPluginEnabledByIdError = unknown;
+
+export type ListPluginPagesByIdData = {
+    query: {
+        plugin_id: string;
+    };
+};
+
+export type ListPluginPagesByIdResponse = (SuccessEnvelope);
+
+export type ListPluginPagesByIdError = unknown;
+
+export type GetPluginPageByIdData = {
+    query: {
+        page_name: string;
+        plugin_id: string;
+    };
+};
+
+export type GetPluginPageByIdResponse = (string);
+
+export type GetPluginPageByIdError = unknown;
+
+export type GetPluginPageAssetByIdData = {
+    query: {
+        asset_path: string;
+        page_name: string;
+        plugin_id: string;
+    };
+};
+
+export type GetPluginPageAssetByIdResponse = (unknown);
+
+export type GetPluginPageAssetByIdError = unknown;
+
+export type GetPluginData = {
+    body?: {
+        delete_config?: boolean;
+        delete_data?: boolean;
+        [key: string]: unknown | boolean;
+    };
+    path: {
+        plugin_id: string;
+    };
+};
+
+export type GetPluginResponse = (SuccessEnvelope);
+
+export type GetPluginError = unknown;
+
+export type UninstallPluginData = {
+    body?: {
+        delete_config?: boolean;
+        delete_data?: boolean;
+        [key: string]: unknown | boolean;
+    };
+    path: {
+        plugin_id: string;
+    };
+};
+
+export type UninstallPluginResponse = (SuccessEnvelope);
+
+export type UninstallPluginError = unknown;
+
+export type GetPluginConfigData = {
+    path: {
+        plugin_id: string;
+    };
+};
+
+export type GetPluginConfigResponse = (SuccessEnvelope);
+
+export type GetPluginConfigError = unknown;
+
+export type UpdatePluginConfigData = {
+    body: DynamicConfig;
+    path: {
+        plugin_id: string;
+    };
+};
+
+export type UpdatePluginConfigResponse = (SuccessEnvelope);
+
+export type UpdatePluginConfigError = unknown;
+
+export type GetPluginConfigSchemaData = {
+    path: {
+        plugin_id: string;
+    };
+};
+
+export type GetPluginConfigSchemaResponse = (SuccessEnvelope);
+
+export type GetPluginConfigSchemaError = unknown;
+
+export type ListPluginConfigFilesData = {
+    path: {
+        /**
+         * URL-encoded configuration key path.
+         */
+        config_key: string;
+        plugin_id: string;
+    };
+};
+
+export type ListPluginConfigFilesResponse = (SuccessEnvelope);
+
+export type ListPluginConfigFilesError = unknown;
+
+export type UploadPluginConfigFilesData = {
+    body: {
+        [key: string]: unknown;
+    };
+    path: {
+        /**
+         * URL-encoded configuration key path.
+         */
+        config_key: string;
+        plugin_id: string;
+    };
+};
+
+export type UploadPluginConfigFilesResponse = (SuccessEnvelope);
+
+export type UploadPluginConfigFilesError = unknown;
+
+export type DeletePluginConfigFileData = {
+    body: PluginConfigFileDeleteRequest;
+    path: {
+        plugin_id: string;
+    };
+};
+
+export type DeletePluginConfigFileResponse = (SuccessEnvelope);
+
+export type DeletePluginConfigFileError = unknown;
+
+export type GetPluginReadmeData = {
+    path: {
+        plugin_id: string;
+    };
+};
+
+export type GetPluginReadmeResponse = (string);
+
+export type GetPluginReadmeError = unknown;
+
+export type GetPluginChangelogData = {
+    path: {
+        plugin_id: string;
+    };
+};
+
+export type GetPluginChangelogResponse = (string);
+
+export type GetPluginChangelogError = unknown;
+
+export type ReloadPluginData = {
+    path: {
+        plugin_id: string;
+    };
+};
+
+export type ReloadPluginResponse = (SuccessEnvelope);
+
+export type ReloadPluginError = unknown;
+
+export type SetPluginEnabledData = {
+    body: EnabledPatch;
+    path: {
+        plugin_id: string;
+    };
+};
+
+export type SetPluginEnabledResponse = (SuccessEnvelope);
+
+export type SetPluginEnabledError = unknown;
+
+export type UpdatePluginData = {
+    body?: PluginUpdateRequest;
+    path: {
+        plugin_id: string;
+    };
+};
+
+export type UpdatePluginResponse = (SuccessEnvelope);
+
+export type UpdatePluginError = unknown;
+
+export type UpdatePluginsData = {
+    body: PluginBatchUpdateRequest;
+};
+
+export type UpdatePluginsResponse = (SuccessEnvelope);
+
+export type UpdatePluginsError = unknown;
+
+export type CheckPluginVersionSupportData = {
+    body: PluginVersionSupportRequest;
+};
+
+export type CheckPluginVersionSupportResponse = (SuccessEnvelope);
+
+export type CheckPluginVersionSupportError = unknown;
+
+export type ListFailedPluginsResponse = (SuccessEnvelope);
+
+export type ListFailedPluginsError = unknown;
+
+export type UninstallFailedPluginData = {
+    body?: {
+        delete_config?: boolean;
+        delete_data?: boolean;
+        [key: string]: unknown | boolean;
+    };
+    path: {
+        plugin_id: string;
+    };
+};
+
+export type UninstallFailedPluginResponse = (SuccessEnvelope);
+
+export type UninstallFailedPluginError = unknown;
+
+export type ReloadFailedPluginData = {
+    path: {
+        plugin_id: string;
+    };
+};
+
+export type ReloadFailedPluginResponse = (SuccessEnvelope);
+
+export type ReloadFailedPluginError = unknown;
+
+export type InstallPluginFromGithubData = {
+    body: PluginGithubInstallRequest;
+};
+
+export type InstallPluginFromGithubResponse = (SuccessEnvelope);
+
+export type InstallPluginFromGithubError = unknown;
+
+export type InstallPluginFromUrlData = {
+    body: PluginUrlInstallRequest;
+};
+
+export type InstallPluginFromUrlResponse = (SuccessEnvelope);
+
+export type InstallPluginFromUrlError = unknown;
+
+export type InstallPluginFromUploadData = {
+    body: PluginUploadInstallRequest;
+};
+
+export type InstallPluginFromUploadResponse = (SuccessEnvelope);
+
+export type InstallPluginFromUploadError = unknown;
+
+export type ListPluginMarketData = {
+    query?: {
+        category?: string;
+        custom_registry?: string;
+        force_refresh?: boolean;
+        keyword?: string;
+        page?: number;
+        page_size?: number;
+        sort?: 'recommended' | 'downloads' | 'updated' | 'name';
+    };
+};
+
+export type ListPluginMarketResponse = (SuccessEnvelope);
+
+export type ListPluginMarketError = unknown;
+
+export type ListPluginMarketCategoriesResponse = (SuccessEnvelope);
+
+export type ListPluginMarketCategoriesError = unknown;
+
+export type ListPluginSourcesResponse = (SuccessEnvelope);
+
+export type ListPluginSourcesError = unknown;
+
+export type CreatePluginSourceData = {
+    body: PluginSourceRequest;
+};
+
+export type CreatePluginSourceResponse = (SuccessEnvelope);
+
+export type CreatePluginSourceError = unknown;
+
+export type ReplacePluginSourcesData = {
+    body: {
+        sources: Array<PluginSourceRequest>;
+    };
+};
+
+export type ReplacePluginSourcesResponse = (SuccessEnvelope);
+
+export type ReplacePluginSourcesError = unknown;
+
+export type DeletePluginSourceData = {
+    path: {
+        source_id: string;
+    };
+};
+
+export type DeletePluginSourceResponse = (SuccessEnvelope);
+
+export type DeletePluginSourceError = unknown;
+
+export type DeletePluginSourceByIdData = {
+    query: {
+        source_id: string;
+    };
+};
+
+export type DeletePluginSourceByIdResponse = (SuccessEnvelope);
+
+export type DeletePluginSourceByIdError = unknown;
+
+export type ListPluginPagesData = {
+    path: {
+        plugin_id: string;
+    };
+};
+
+export type ListPluginPagesResponse = (SuccessEnvelope);
+
+export type ListPluginPagesError = unknown;
+
+export type GetPluginPageData = {
+    path: {
+        page_name: string;
+        plugin_id: string;
+    };
+};
+
+export type GetPluginPageResponse = (string);
+
+export type GetPluginPageError = unknown;
+
+export type GetPluginPageAssetData = {
+    path: {
+        /**
+         * URL-encoded relative asset path.
+         */
+        asset_path: string;
+        page_name: string;
+        plugin_id: string;
+    };
+};
+
+export type GetPluginPageAssetResponse = (unknown);
+
+export type GetPluginPageAssetError = unknown;
+
+export type GetPluginPageBridgeSdkResponse = (string);
+
+export type GetPluginPageBridgeSdkError = unknown;
+
+export type GetPluginExtensionRouteData = {
+    path: {
+        /**
+         * Plugin extension path after /api/plug/. It may contain slash-separated segments.
+         */
+        plugin_path: string;
+    };
+};
+
+export type GetPluginExtensionRouteResponse = (SuccessEnvelope);
+
+export type GetPluginExtensionRouteError = unknown;
+
+export type PostPluginExtensionRouteData = {
+    body?: DynamicConfig;
+    path: {
+        /**
+         * Plugin extension path after /api/plug/. It may contain slash-separated segments.
+         */
+        plugin_path: string;
+    };
+};
+
+export type PostPluginExtensionRouteResponse = (SuccessEnvelope);
+
+export type PostPluginExtensionRouteError = unknown;
+
+export type PutPluginExtensionRouteData = {
+    body?: DynamicConfig;
+    path: {
+        plugin_path: string;
+    };
+};
+
+export type PutPluginExtensionRouteResponse = (SuccessEnvelope);
+
+export type PutPluginExtensionRouteError = unknown;
+
+export type PatchPluginExtensionRouteData = {
+    body?: DynamicConfig;
+    path: {
+        plugin_path: string;
+    };
+};
+
+export type PatchPluginExtensionRouteResponse = (SuccessEnvelope);
+
+export type PatchPluginExtensionRouteError = unknown;
+
+export type DeletePluginExtensionRouteData = {
+    path: {
+        plugin_path: string;
+    };
+};
+
+export type DeletePluginExtensionRouteResponse = (SuccessEnvelope);
+
+export type DeletePluginExtensionRouteError = unknown;
+
+export type ListCommandsData = {
+    query?: {
+        config_id?: string;
+    };
+};
+
+export type ListCommandsResponse = (SuccessEnvelope);
+
+export type ListCommandsError = unknown;
+
+export type UpdateCommandData = {
+    body: CommandPatchRequest;
+    path: {
+        /**
+         * URL-encoded command handler full name.
+         */
+        command_id: string;
+    };
+};
+
+export type UpdateCommandResponse = (SuccessEnvelope);
+
+export type UpdateCommandError = unknown;
+
+export type ListCommandConflictsResponse = (SuccessEnvelope);
+
+export type ListCommandConflictsError = unknown;
+
+export type ListToolsData = {
+    query?: {
+        enabled?: boolean;
+        origin?: 'builtin' | 'plugin' | 'mcp';
+    };
+};
+
+export type ListToolsResponse = (SuccessEnvelope);
+
+export type ListToolsError = unknown;
+
+export type SetToolEnabledData = {
+    body: EnabledPatch;
+    path: {
+        tool_id: string;
+    };
+};
+
+export type SetToolEnabledResponse = (SuccessEnvelope);
+
+export type SetToolEnabledError = unknown;
+
+export type SetToolPermissionData = {
+    body: ToolPermissionPatch;
+    path: {
+        tool_id: string;
+    };
+};
+
+export type SetToolPermissionResponse = (SuccessEnvelope);
+
+export type SetToolPermissionError = unknown;
+
+export type ListMcpServersResponse = (SuccessEnvelope);
+
+export type ListMcpServersError = unknown;
+
+export type CreateMcpServerData = {
+    body: McpServerConfig;
+};
+
+export type CreateMcpServerResponse = (SuccessEnvelope);
+
+export type CreateMcpServerError = unknown;
+
+export type UpdateMcpServerByNameData = {
+    body: {
+        server_name: string;
+        config?: DynamicConfig;
+        enabled?: boolean;
+        [key: string]: unknown | string | DynamicConfig | boolean;
+    };
+};
+
+export type UpdateMcpServerByNameResponse = (SuccessEnvelope);
+
+export type UpdateMcpServerByNameError = unknown;
+
+export type DeleteMcpServerByNameData = {
+    query: {
+        server_name: string;
+    };
+};
+
+export type DeleteMcpServerByNameResponse = (SuccessEnvelope);
+
+export type DeleteMcpServerByNameError = unknown;
+
+export type SetMcpServerEnabledByNameData = {
+    body: {
+        server_name: string;
+        enabled: boolean;
+    };
+};
+
+export type SetMcpServerEnabledByNameResponse = (SuccessEnvelope);
+
+export type SetMcpServerEnabledByNameError = unknown;
+
+export type TestMcpServerByNameData = {
+    body: {
+        server_name: string;
+        mcp_server_config?: DynamicConfig;
+        config?: DynamicConfig;
+        [key: string]: unknown | string | DynamicConfig;
+    };
+};
+
+export type TestMcpServerByNameResponse = (SuccessEnvelope);
+
+export type TestMcpServerByNameError = unknown;
+
+export type UpdateMcpServerData = {
+    body: McpServerConfig;
+    path: {
+        server_name: string;
+    };
+};
+
+export type UpdateMcpServerResponse = (SuccessEnvelope);
+
+export type UpdateMcpServerError = unknown;
+
+export type DeleteMcpServerData = {
+    path: {
+        server_name: string;
+    };
+};
+
+export type DeleteMcpServerResponse = (SuccessEnvelope);
+
+export type DeleteMcpServerError = unknown;
+
+export type SetMcpServerEnabledData = {
+    body: EnabledPatch;
+    path: {
+        server_name: string;
+    };
+};
+
+export type SetMcpServerEnabledResponse = (SuccessEnvelope);
+
+export type SetMcpServerEnabledError = unknown;
+
+export type TestMcpServerData = {
+    body?: {
+        mcp_server_config?: {
+            [key: string]: unknown;
+        };
+        [key: string]: unknown;
+    };
+    path: {
+        server_name: string;
+    };
+};
+
+export type TestMcpServerResponse = (SuccessEnvelope);
+
+export type TestMcpServerError = unknown;
+
+export type SyncModelScopeMcpServersData = {
+    body?: ModelScopeSyncRequest;
+};
+
+export type SyncModelScopeMcpServersResponse = (SuccessEnvelope);
+
+export type SyncModelScopeMcpServersError = unknown;
+
+export type ListSkillsData = {
+    query?: {
+        enabled?: boolean;
+        source?: string;
+    };
+};
+
+export type ListSkillsResponse = (SuccessEnvelope);
+
+export type ListSkillsError = unknown;
+
+export type UploadSkillData = {
+    body: SkillUploadRequest;
+};
+
+export type UploadSkillResponse = (SuccessEnvelope);
+
+export type UploadSkillError = unknown;
+
+export type UploadSkillsBatchData = {
+    body: {
+        files: Array<((Blob | File))>;
+    };
+};
+
+export type UploadSkillsBatchResponse = (SuccessEnvelope);
+
+export type UploadSkillsBatchError = unknown;
+
+export type UpdateSkillByNameData = {
+    body: {
+        skill_name: string;
+        enabled?: boolean;
+        active?: boolean;
+        [key: string]: unknown | string | boolean;
+    };
+};
+
+export type UpdateSkillByNameResponse = (SuccessEnvelope);
+
+export type UpdateSkillByNameError = unknown;
+
+export type DeleteSkillByNameData = {
+    query: {
+        skill_name: string;
+    };
+};
+
+export type DeleteSkillByNameResponse = (SuccessEnvelope);
+
+export type DeleteSkillByNameError = unknown;
+
+export type DownloadSkillByNameData = {
+    query: {
+        skill_name: string;
+    };
+};
+
+export type DownloadSkillByNameResponse = ((Blob | File));
+
+export type DownloadSkillByNameError = unknown;
+
+export type ListSkillFilesByNameData = {
+    query: {
+        path?: string;
+        skill_name: string;
+    };
+};
+
+export type ListSkillFilesByNameResponse = (SuccessEnvelope);
+
+export type ListSkillFilesByNameError = unknown;
+
+export type GetSkillFileByNameData = {
+    query: {
+        path: string;
+        skill_name: string;
+    };
+};
+
+export type GetSkillFileByNameResponse = (string);
+
+export type GetSkillFileByNameError = unknown;
+
+export type UpdateSkillFileByNameData = {
+    body: {
+        skill_name: string;
+        path: string;
+        content: string;
+    };
+};
+
+export type UpdateSkillFileByNameResponse = (SuccessEnvelope);
+
+export type UpdateSkillFileByNameError = unknown;
+
+export type UpdateSkillData = {
+    body: SkillPatchRequest;
+    path: {
+        skill_name: string;
+    };
+};
+
+export type UpdateSkillResponse = (SuccessEnvelope);
+
+export type UpdateSkillError = unknown;
+
+export type DeleteSkillData = {
+    path: {
+        skill_name: string;
+    };
+};
+
+export type DeleteSkillResponse = (SuccessEnvelope);
+
+export type DeleteSkillError = unknown;
+
+export type DownloadSkillData = {
+    path: {
+        skill_name: string;
+    };
+};
+
+export type DownloadSkillResponse = ((Blob | File));
+
+export type DownloadSkillError = unknown;
+
+export type ListSkillFilesData = {
+    path: {
+        skill_name: string;
+    };
+    query?: {
+        path?: string;
+    };
+};
+
+export type ListSkillFilesResponse = (SuccessEnvelope);
+
+export type ListSkillFilesError = unknown;
+
+export type GetSkillFileData = {
+    path: {
+        /**
+         * URL-encoded relative file path.
+         */
+        file_path: string;
+        skill_name: string;
+    };
+};
+
+export type GetSkillFileResponse = (string);
+
+export type GetSkillFileError = unknown;
+
+export type UpdateSkillFileData = {
+    body: string;
+    path: {
+        /**
+         * URL-encoded relative file path.
+         */
+        file_path: string;
+        skill_name: string;
+    };
+};
+
+export type UpdateSkillFileResponse = (SuccessEnvelope);
+
+export type UpdateSkillFileError = unknown;
+
+export type ListNeoSkillCandidatesData = {
+    query?: {
+        skill_key?: string;
+        status?: string;
+    };
+};
+
+export type ListNeoSkillCandidatesResponse = (SuccessEnvelope);
+
+export type ListNeoSkillCandidatesError = unknown;
+
+export type ListNeoSkillReleasesData = {
+    query?: {
+        skill_key?: string;
+        stage?: string;
+    };
+};
+
+export type ListNeoSkillReleasesResponse = (SuccessEnvelope);
+
+export type ListNeoSkillReleasesError = unknown;
+
+export type GetNeoSkillPayloadData = {
+    query: {
+        payload_ref: string;
+    };
+};
+
+export type GetNeoSkillPayloadResponse = (SuccessEnvelope);
+
+export type GetNeoSkillPayloadError = unknown;
+
+export type EvaluateNeoSkillCandidateData = {
+    body: NeoCandidateActionRequest;
+};
+
+export type EvaluateNeoSkillCandidateResponse = (SuccessEnvelope);
+
+export type EvaluateNeoSkillCandidateError = unknown;
+
+export type PromoteNeoSkillCandidateData = {
+    body: NeoCandidateActionRequest;
+};
+
+export type PromoteNeoSkillCandidateResponse = (SuccessEnvelope);
+
+export type PromoteNeoSkillCandidateError = unknown;
+
+export type RollbackNeoSkillReleaseData = {
+    body: NeoReleaseActionRequest;
+};
+
+export type RollbackNeoSkillReleaseResponse = (SuccessEnvelope);
+
+export type RollbackNeoSkillReleaseError = unknown;
+
+export type SyncNeoSkillReleaseData = {
+    body: NeoReleaseActionRequest;
+};
+
+export type SyncNeoSkillReleaseResponse = (SuccessEnvelope);
+
+export type SyncNeoSkillReleaseError = unknown;
+
+export type DeleteNeoSkillCandidateData = {
+    body: NeoCandidateActionRequest;
+};
+
+export type DeleteNeoSkillCandidateResponse = (SuccessEnvelope);
+
+export type DeleteNeoSkillCandidateError = unknown;
+
+export type DeleteNeoSkillReleaseData = {
+    body: NeoReleaseActionRequest;
+};
+
+export type DeleteNeoSkillReleaseResponse = (SuccessEnvelope);
+
+export type DeleteNeoSkillReleaseError = unknown;
+
+export type ListKnowledgeBasesData = {
+    query?: {
+        page?: number;
+        page_size?: number;
+        refresh_stats?: boolean;
+    };
+};
+
+export type ListKnowledgeBasesResponse = (SuccessEnvelope);
+
+export type ListKnowledgeBasesError = unknown;
+
+export type CreateKnowledgeBaseData = {
+    body: KnowledgeBaseRequest;
+};
+
+export type CreateKnowledgeBaseResponse = (SuccessEnvelope);
+
+export type CreateKnowledgeBaseError = unknown;
+
+export type GetKnowledgeBaseData = {
+    path: {
+        kb_id: string;
+    };
+};
+
+export type GetKnowledgeBaseResponse = (SuccessEnvelope);
+
+export type GetKnowledgeBaseError = unknown;
+
+export type UpdateKnowledgeBaseData = {
+    body: KnowledgeBaseRequest;
+    path: {
+        kb_id: string;
+    };
+};
+
+export type UpdateKnowledgeBaseResponse = (SuccessEnvelope);
+
+export type UpdateKnowledgeBaseError = unknown;
+
+export type DeleteKnowledgeBaseData = {
+    path: {
+        kb_id: string;
+    };
+};
+
+export type DeleteKnowledgeBaseResponse = (SuccessEnvelope);
+
+export type DeleteKnowledgeBaseError = unknown;
+
+export type GetKnowledgeBaseStatsData = {
+    path: {
+        kb_id: string;
+    };
+};
+
+export type GetKnowledgeBaseStatsResponse = (SuccessEnvelope);
+
+export type GetKnowledgeBaseStatsError = unknown;
+
+export type ListKnowledgeDocumentsData = {
+    path: {
+        kb_id: string;
+    };
+    query?: {
+        page?: number;
+        page_size?: number;
+    };
+};
+
+export type ListKnowledgeDocumentsResponse = (SuccessEnvelope);
+
+export type ListKnowledgeDocumentsError = unknown;
+
+export type UploadKnowledgeDocumentData = {
+    body: KnowledgeDocumentUploadRequest;
+    path: {
+        kb_id: string;
+    };
+};
+
+export type UploadKnowledgeDocumentResponse = (SuccessEnvelope);
+
+export type UploadKnowledgeDocumentError = unknown;
+
+export type ImportKnowledgeDocumentsData = {
+    body: KnowledgeDocumentImportRequest;
+    path: {
+        kb_id: string;
+    };
+};
+
+export type ImportKnowledgeDocumentsResponse = (SuccessEnvelope);
+
+export type ImportKnowledgeDocumentsError = unknown;
+
+export type ImportKnowledgeDocumentFromUrlData = {
+    body: KnowledgeDocumentUrlImportRequest;
+    path: {
+        kb_id: string;
+    };
+};
+
+export type ImportKnowledgeDocumentFromUrlResponse = (SuccessEnvelope);
+
+export type ImportKnowledgeDocumentFromUrlError = unknown;
+
+export type GetKnowledgeDocumentData = {
+    path: {
+        document_id: string;
+        kb_id: string;
+    };
+};
+
+export type GetKnowledgeDocumentResponse = (SuccessEnvelope);
+
+export type GetKnowledgeDocumentError = unknown;
+
+export type DeleteKnowledgeDocumentData = {
+    path: {
+        document_id: string;
+        kb_id: string;
+    };
+};
+
+export type DeleteKnowledgeDocumentResponse = (SuccessEnvelope);
+
+export type DeleteKnowledgeDocumentError = unknown;
+
+export type ListKnowledgeChunksData = {
+    path: {
+        kb_id: string;
+    };
+    query?: {
+        document_id?: string;
+        page?: number;
+        page_size?: number;
+    };
+};
+
+export type ListKnowledgeChunksResponse = (SuccessEnvelope);
+
+export type ListKnowledgeChunksError = unknown;
+
+export type DeleteKnowledgeChunkData = {
+    path: {
+        chunk_id: string;
+        kb_id: string;
+    };
+    query: {
+        document_id: string;
+    };
+};
+
+export type DeleteKnowledgeChunkResponse = (SuccessEnvelope);
+
+export type DeleteKnowledgeChunkError = unknown;
+
+export type RetrieveKnowledgeBaseData = {
+    body: KnowledgeRetrieveRequest;
+    path: {
+        kb_id: string;
+    };
+};
+
+export type RetrieveKnowledgeBaseResponse = (SuccessEnvelope);
+
+export type RetrieveKnowledgeBaseError = unknown;
+
+export type GetKnowledgeTaskData = {
+    path: {
+        task_id: string;
+    };
+};
+
+export type GetKnowledgeTaskResponse = (SuccessEnvelope);
+
+export type GetKnowledgeTaskError = unknown;
+
+export type GetPersonaTreeResponse = (SuccessEnvelope);
+
+export type GetPersonaTreeError = unknown;
+
+export type ListPersonasData = {
+    query?: {
+        folder_id?: string;
+    };
+};
+
+export type ListPersonasResponse = (SuccessEnvelope);
+
+export type ListPersonasError = unknown;
+
+export type CreatePersonaData = {
+    body: PersonaRequest;
+};
+
+export type CreatePersonaResponse = (SuccessEnvelope);
+
+export type CreatePersonaError = unknown;
+
+export type GetPersonaByIdData = {
+    query: {
+        persona_id: string;
+    };
+};
+
+export type GetPersonaByIdResponse = (SuccessEnvelope);
+
+export type GetPersonaByIdError = unknown;
+
+export type UpdatePersonaByIdData = {
+    body: {
+        persona_id: string;
+        [key: string]: unknown | string;
+    };
+};
+
+export type UpdatePersonaByIdResponse = (SuccessEnvelope);
+
+export type UpdatePersonaByIdError = unknown;
+
+export type DeletePersonaByIdData = {
+    query: {
+        persona_id: string;
+    };
+};
+
+export type DeletePersonaByIdResponse = (SuccessEnvelope);
+
+export type DeletePersonaByIdError = unknown;
+
+export type GetPersonaData = {
+    path: {
+        persona_id: string;
+    };
+};
+
+export type GetPersonaResponse = (SuccessEnvelope);
+
+export type GetPersonaError = unknown;
+
+export type UpdatePersonaData = {
+    body: PersonaRequest;
+    path: {
+        persona_id: string;
+    };
+};
+
+export type UpdatePersonaResponse = (SuccessEnvelope);
+
+export type UpdatePersonaError = unknown;
+
+export type DeletePersonaData = {
+    path: {
+        persona_id: string;
+    };
+};
+
+export type DeletePersonaResponse = (SuccessEnvelope);
+
+export type DeletePersonaError = unknown;
+
+export type ListPersonaFoldersData = {
+    query?: {
+        parent_id?: string;
+    };
+};
+
+export type ListPersonaFoldersResponse = (SuccessEnvelope);
+
+export type ListPersonaFoldersError = unknown;
+
+export type CreatePersonaFolderData = {
+    body: PersonaFolderRequest;
+};
+
+export type CreatePersonaFolderResponse = (SuccessEnvelope);
+
+export type CreatePersonaFolderError = unknown;
+
+export type UpdatePersonaFolderData = {
+    body: PersonaFolderRequest;
+    path: {
+        folder_id: string;
+    };
+};
+
+export type UpdatePersonaFolderResponse = (SuccessEnvelope);
+
+export type UpdatePersonaFolderError = unknown;
+
+export type DeletePersonaFolderData = {
+    path: {
+        folder_id: string;
+    };
+};
+
+export type DeletePersonaFolderResponse = (SuccessEnvelope);
+
+export type DeletePersonaFolderError = unknown;
+
+export type MovePersonaItemData = {
+    body: PersonaMoveRequest;
+};
+
+export type MovePersonaItemResponse = (SuccessEnvelope);
+
+export type MovePersonaItemError = unknown;
+
+export type ReorderPersonaItemsData = {
+    body: ReorderRequest;
+};
+
+export type ReorderPersonaItemsResponse = (SuccessEnvelope);
+
+export type ReorderPersonaItemsError = unknown;
+
+export type ListSessionsData = {
+    query?: {
+        message_type?: 'all' | 'group' | 'private';
+        page?: number;
+        page_size?: number;
+        platform?: string;
+        search?: string;
+    };
+};
+
+export type ListSessionsResponse = (SuccessEnvelope);
+
+export type ListSessionsError = unknown;
+
+export type ListActiveUmosResponse = (SuccessEnvelope);
+
+export type ListActiveUmosError = unknown;
+
+export type ListSessionRulesData = {
+    query?: {
+        page?: number;
+        page_size?: number;
+        search?: string;
+    };
+};
+
+export type ListSessionRulesResponse = (SuccessEnvelope);
+
+export type ListSessionRulesError = unknown;
+
+export type UpsertSessionRuleData = {
+    body: SessionRuleRequest;
+};
+
+export type UpsertSessionRuleResponse = (SuccessEnvelope);
+
+export type UpsertSessionRuleError = unknown;
+
+export type DeleteSessionRulesData = {
+    body: UmoListRequest;
+};
+
+export type DeleteSessionRulesResponse = (SuccessEnvelope);
+
+export type DeleteSessionRulesError = unknown;
+
+export type BatchUpdateSessionProviderData = {
+    body: BatchSessionProviderRequest;
+};
+
+export type BatchUpdateSessionProviderResponse = (SuccessEnvelope);
+
+export type BatchUpdateSessionProviderError = unknown;
+
+export type BatchUpdateSessionServiceData = {
+    body: BatchSessionServiceRequest;
+};
+
+export type BatchUpdateSessionServiceResponse = (SuccessEnvelope);
+
+export type BatchUpdateSessionServiceError = unknown;
+
+export type ListSessionGroupsResponse = (SuccessEnvelope);
+
+export type ListSessionGroupsError = unknown;
+
+export type CreateSessionGroupData = {
+    body: SessionGroupRequest;
+};
+
+export type CreateSessionGroupResponse = (SuccessEnvelope);
+
+export type CreateSessionGroupError = unknown;
+
+export type UpdateSessionGroupData = {
+    body: SessionGroupRequest;
+    path: {
+        group_id: string;
+    };
+};
+
+export type UpdateSessionGroupResponse = (SuccessEnvelope);
+
+export type UpdateSessionGroupError = unknown;
+
+export type DeleteSessionGroupData = {
+    path: {
+        group_id: string;
+    };
+};
+
+export type DeleteSessionGroupResponse = (SuccessEnvelope);
+
+export type DeleteSessionGroupError = unknown;
+
+export type ListConversationsData = {
+    query?: {
+        /**
+         * Comma-separated user IDs to exclude.
+         */
+        exclude_ids?: string;
+        /**
+         * Comma-separated platforms to exclude.
+         */
+        exclude_platforms?: string;
+        /**
+         * Comma-separated message types.
+         */
+        message_types?: string;
+        page?: number;
+        page_size?: number;
+        platform_id?: string;
+        /**
+         * Comma-separated platform IDs.
+         */
+        platforms?: string;
+        search?: string;
+        user_id?: string;
+    };
+};
+
+export type ListConversationsResponse = (SuccessEnvelope);
+
+export type ListConversationsError = unknown;
+
+export type BatchDeleteConversationsData = {
+    body: ConversationBatchDeleteRequest;
+};
+
+export type BatchDeleteConversationsResponse = (SuccessEnvelope);
+
+export type BatchDeleteConversationsError = unknown;
+
+export type GetConversationData = {
+    path: {
+        conversation_id: string;
+    };
+    query: {
+        user_id: string;
+    };
+};
+
+export type GetConversationResponse = (SuccessEnvelope);
+
+export type GetConversationError = unknown;
+
+export type UpdateConversationData = {
+    body: ConversationPatchRequest;
+    path: {
+        conversation_id: string;
+    };
+    query: {
+        user_id: string;
+    };
+};
+
+export type UpdateConversationResponse = (SuccessEnvelope);
+
+export type UpdateConversationError = unknown;
+
+export type DeleteConversationData = {
+    path: {
+        conversation_id: string;
+    };
+    query: {
+        user_id: string;
+    };
+};
+
+export type DeleteConversationResponse = (SuccessEnvelope);
+
+export type DeleteConversationError = unknown;
+
+export type ReplaceConversationMessagesData = {
+    body: ConversationMessagesReplaceRequest;
+    path: {
+        conversation_id: string;
+    };
+    query: {
+        user_id: string;
+    };
+};
+
+export type ReplaceConversationMessagesResponse = (SuccessEnvelope);
+
+export type ReplaceConversationMessagesError = unknown;
+
+export type ExportConversationsData = {
+    body: ConversationExportRequest;
+};
+
+export type ExportConversationsResponse = (unknown);
+
+export type ExportConversationsError = unknown;
+
+export type GetStatsData = {
+    query?: {
+        offset_sec?: number;
+    };
+};
+
+export type GetStatsResponse = (SuccessEnvelope);
+
+export type GetStatsError = unknown;
+
+export type GetProviderTokenStatsData = {
+    query?: {
+        days?: number;
+    };
+};
+
+export type GetProviderTokenStatsResponse = (SuccessEnvelope);
+
+export type GetProviderTokenStatsError = unknown;
+
+export type GetVersionResponse = (SuccessEnvelope);
+
+export type GetVersionError = unknown;
+
+export type GetFirstNoticeData = {
+    query?: {
+        locale?: string;
+    };
+};
+
+export type GetFirstNoticeResponse = (SuccessEnvelope);
+
+export type GetFirstNoticeError = unknown;
+
+export type TestGhproxyConnectionData = {
+    body: GhproxyTestRequest;
+};
+
+export type TestGhproxyConnectionResponse = (SuccessEnvelope);
+
+export type TestGhproxyConnectionError = unknown;
+
+export type ListChangelogVersionsResponse = (SuccessEnvelope);
+
+export type ListChangelogVersionsError = unknown;
+
+export type GetChangelogData = {
+    path: {
+        version: string;
+    };
+};
+
+export type GetChangelogResponse = (SuccessEnvelope);
+
+export type GetChangelogError = (ErrorEnvelope);
+
+export type GetStartTimeResponse = (SuccessEnvelope);
+
+export type GetStartTimeError = unknown;
+
+export type GetStorageStatusResponse = (SuccessEnvelope);
+
+export type GetStorageStatusError = unknown;
+
+export type CleanupStorageData = {
+    body?: DynamicConfig;
+};
+
+export type CleanupStorageResponse = (SuccessEnvelope);
+
+export type CleanupStorageError = unknown;
+
+export type RestartCoreResponse = (SuccessEnvelope);
+
+export type RestartCoreError = unknown;
+
+export type ListBackupsData = {
+    query?: {
+        page?: number;
+        page_size?: number;
+    };
+};
+
+export type ListBackupsResponse = (SuccessEnvelope);
+
+export type ListBackupsError = unknown;
+
+export type CreateBackupData = {
+    body?: BackupExportRequest;
+};
+
+export type CreateBackupResponse = (SuccessEnvelope);
+
+export type CreateBackupError = unknown;
+
+export type UploadBackupData = {
+    body: BackupUploadRequest;
+};
+
+export type UploadBackupResponse = (SuccessEnvelope);
+
+export type UploadBackupError = unknown;
+
+export type InitBackupUploadData = {
+    body: BackupUploadInitRequest;
+};
+
+export type InitBackupUploadResponse = (SuccessEnvelope);
+
+export type InitBackupUploadError = unknown;
+
+export type UploadBackupChunkData = {
+    body: BackupChunkUploadRequest;
+};
+
+export type UploadBackupChunkResponse = (SuccessEnvelope);
+
+export type UploadBackupChunkError = unknown;
+
+export type CompleteBackupUploadData = {
+    body: BackupUploadSessionRequest;
+};
+
+export type CompleteBackupUploadResponse = (SuccessEnvelope);
+
+export type CompleteBackupUploadError = unknown;
+
+export type AbortBackupUploadData = {
+    body: BackupUploadSessionRequest;
+};
+
+export type AbortBackupUploadResponse = (SuccessEnvelope);
+
+export type AbortBackupUploadError = unknown;
+
+export type GetBackupProgressData = {
+    path: {
+        task_id: string;
+    };
+};
+
+export type GetBackupProgressResponse = (SuccessEnvelope);
+
+export type GetBackupProgressError = unknown;
+
+export type DownloadBackupData = {
+    path: {
+        filename: string;
+    };
+};
+
+export type DownloadBackupResponse = (unknown);
+
+export type DownloadBackupError = unknown;
+
+export type RenameBackupData = {
+    body: BackupRenameRequest;
+    path: {
+        filename: string;
+    };
+};
+
+export type RenameBackupResponse = (SuccessEnvelope);
+
+export type RenameBackupError = unknown;
+
+export type DeleteBackupData = {
+    path: {
+        filename: string;
+    };
+};
+
+export type DeleteBackupResponse = (SuccessEnvelope);
+
+export type DeleteBackupError = unknown;
+
+export type CheckBackupData = {
+    path: {
+        filename: string;
+    };
+};
+
+export type CheckBackupResponse = (SuccessEnvelope);
+
+export type CheckBackupError = unknown;
+
+export type ImportBackupData = {
+    body?: BackupImportRequest;
+    path: {
+        filename: string;
+    };
+};
+
+export type ImportBackupResponse = (SuccessEnvelope);
+
+export type ImportBackupError = unknown;
+
+export type CheckUpdateResponse = (SuccessEnvelope);
+
+export type CheckUpdateError = unknown;
+
+export type ListReleasesData = {
+    query?: {
+        type?: 'core' | 'dashboard';
+    };
+};
+
+export type ListReleasesResponse = (SuccessEnvelope);
+
+export type ListReleasesError = unknown;
+
+export type UpdateCoreData = {
+    body?: UpdateRequest;
+};
+
+export type UpdateCoreResponse = (SuccessEnvelope);
+
+export type UpdateCoreError = unknown;
+
+export type UpdateDashboardData = {
+    body?: UpdateRequest;
+};
+
+export type UpdateDashboardResponse = (SuccessEnvelope);
+
+export type UpdateDashboardError = unknown;
+
+export type GetUpdateProgressData = {
+    path: {
+        task_id: string;
+    };
+};
+
+export type GetUpdateProgressResponse = (SuccessEnvelope);
+
+export type GetUpdateProgressError = unknown;
+
+export type InstallPipPackageData = {
+    body: PipInstallRequest;
+};
+
+export type InstallPipPackageResponse = (SuccessEnvelope);
+
+export type InstallPipPackageError = unknown;
+
+export type RunMigrationsData = {
+    body?: MigrationRequest;
+};
+
+export type RunMigrationsResponse = (SuccessEnvelope);
+
+export type RunMigrationsError = unknown;
+
+export type ListCronJobsData = {
+    query?: {
+        type?: string;
+    };
+};
+
+export type ListCronJobsResponse = (SuccessEnvelope);
+
+export type ListCronJobsError = unknown;
+
+export type CreateCronJobData = {
+    body: CronJobRequest;
+};
+
+export type CreateCronJobResponse = (SuccessEnvelope);
+
+export type CreateCronJobError = unknown;
+
+export type UpdateCronJobData = {
+    body: CronJobPatchRequest;
+    path: {
+        job_id: string;
+    };
+};
+
+export type UpdateCronJobResponse = (SuccessEnvelope);
+
+export type UpdateCronJobError = unknown;
+
+export type DeleteCronJobData = {
+    path: {
+        job_id: string;
+    };
+};
+
+export type DeleteCronJobResponse = (SuccessEnvelope);
+
+export type DeleteCronJobError = unknown;
+
+export type RunCronJobData = {
+    path: {
+        job_id: string;
+    };
+};
+
+export type RunCronJobResponse = (SuccessEnvelope);
+
+export type RunCronJobError = unknown;
+
+export type StreamLiveLogsResponse = (string);
+
+export type StreamLiveLogsError = unknown;
+
+export type GetLogHistoryResponse = (string);
+
+export type GetLogHistoryError = unknown;
+
+export type GetTraceSettingsResponse = (SuccessEnvelope);
+
+export type GetTraceSettingsError = unknown;
+
+export type UpdateTraceSettingsData = {
+    body: TraceSettingsRequest;
+};
+
+export type UpdateTraceSettingsResponse = (SuccessEnvelope);
+
+export type UpdateTraceSettingsError = unknown;
+
+export type ListT2iTemplatesResponse = (SuccessEnvelope);
+
+export type ListT2iTemplatesError = unknown;
+
+export type CreateT2iTemplateData = {
+    body: T2iTemplateRequest;
+};
+
+export type CreateT2iTemplateResponse = (SuccessEnvelope);
+
+export type CreateT2iTemplateError = unknown;
+
+export type GetActiveT2iTemplateResponse = (SuccessEnvelope);
+
+export type GetActiveT2iTemplateError = unknown;
+
+export type SetActiveT2iTemplateData = {
+    body: NameRequest;
+};
+
+export type SetActiveT2iTemplateResponse = (SuccessEnvelope);
+
+export type SetActiveT2iTemplateError = unknown;
+
+export type ResetDefaultT2iTemplateResponse = (SuccessEnvelope);
+
+export type ResetDefaultT2iTemplateError = unknown;
+
+export type GetT2iTemplateData = {
+    path: {
+        name: string;
+    };
+};
+
+export type GetT2iTemplateResponse = (SuccessEnvelope);
+
+export type GetT2iTemplateError = unknown;
+
+export type UpdateT2iTemplateData = {
+    body: T2iTemplateContentRequest;
+    path: {
+        name: string;
+    };
+};
+
+export type UpdateT2iTemplateResponse = (SuccessEnvelope);
+
+export type UpdateT2iTemplateError = unknown;
+
+export type DeleteT2iTemplateData = {
+    path: {
+        name: string;
+    };
+};
+
+export type DeleteT2iTemplateResponse = (SuccessEnvelope);
+
+export type DeleteT2iTemplateError = unknown;
+
+export type GetSubagentConfigResponse = (SuccessEnvelope);
+
+export type GetSubagentConfigError = unknown;
+
+export type UpdateSubagentConfigData = {
+    body: DynamicConfig;
+};
+
+export type UpdateSubagentConfigResponse = (SuccessEnvelope);
+
+export type UpdateSubagentConfigError = unknown;
+
+export type ListSubagentAvailableToolsResponse = (SuccessEnvelope);
+
+export type ListSubagentAvailableToolsError = unknown;
+
+export type VerifyPlatformWebhookData = {
+    path: {
+        webhook_uuid: string;
+    };
+};
+
+export type VerifyPlatformWebhookResponse = (unknown);
+
+export type VerifyPlatformWebhookError = unknown;
+
+export type ReceivePlatformWebhookData = {
+    body?: DynamicConfig;
+    path: {
+        webhook_uuid: string;
+    };
+};
+
+export type ReceivePlatformWebhookResponse = (unknown);
+
+export type ReceivePlatformWebhookError = unknown;
\ No newline at end of file
diff --git a/dashboard/src/api/http.ts b/dashboard/src/api/http.ts
new file mode 100644
index 000000000..3531d1f76
--- /dev/null
+++ b/dashboard/src/api/http.ts
@@ -0,0 +1,102 @@
+import axios, {
+  type AxiosError,
+  type AxiosInstance,
+  type InternalAxiosRequestConfig,
+} from 'axios';
+
+const AUTH_HEADER = 'Authorization';
+const LOCALE_HEADER = 'Accept-Language';
+
+let configured = false;
+let originalFetch: typeof window.fetch | null = null;
+
+export const httpClient = axios;
+export const apiV1Client = axios.create({ baseURL: '/api/v1' });
+
+function getToken(): string | null {
+  return localStorage.getItem('token');
+}
+
+function getLocale(): string | null {
+  return localStorage.getItem('astrbot-locale');
+}
+
+function setAxiosHeader(
+  headers: InternalAxiosRequestConfig['headers'],
+  key: string,
+  value: string,
+) {
+  if (typeof headers.set === 'function') {
+    headers.set(key, value);
+    return;
+  }
+  headers[key] = value;
+}
+
+function attachAxiosHeaders(config: InternalAxiosRequestConfig) {
+  const token = getToken();
+  if (token) {
+    setAxiosHeader(config.headers, AUTH_HEADER, `Bearer ${token}`);
+  }
+
+  const locale = getLocale();
+  if (locale) {
+    setAxiosHeader(config.headers, LOCALE_HEADER, locale);
+  }
+
+  return config;
+}
+
+function normalizeAxiosError(error: AxiosError) {
+  if (error.response?.status === 429) {
+    const data = error.response.data as { message?: string } | undefined;
+    if (data?.message) {
+      return Promise.reject(data.message);
+    }
+  }
+  return Promise.reject(error);
+}
+
+function installAxiosInterceptors(instance: AxiosInstance) {
+  instance.interceptors.request.use(attachAxiosHeaders);
+  instance.interceptors.response.use((response) => response, normalizeAxiosError);
+}
+
+export function fetchWithAuth(input: RequestInfo | URL, init?: RequestInit) {
+  const fetchImpl = originalFetch ?? window.fetch.bind(window);
+  const token = getToken();
+  const locale = getLocale();
+
+  if (!token && !locale) {
+    return fetchImpl(input, init);
+  }
+
+  const requestHeaders =
+    typeof input !== 'string' && 'headers' in input
+      ? (input as Request).headers
+      : undefined;
+  const headers = new Headers(init?.headers || requestHeaders);
+
+  if (token && !headers.has(AUTH_HEADER)) {
+    headers.set(AUTH_HEADER, `Bearer ${token}`);
+  }
+  if (locale && !headers.has(LOCALE_HEADER)) {
+    headers.set(LOCALE_HEADER, locale);
+  }
+
+  return fetchImpl(input, { ...init, headers });
+}
+
+export function setupHttpClient() {
+  if (configured) {
+    return;
+  }
+
+  installAxiosInterceptors(axios);
+  installAxiosInterceptors(apiV1Client);
+
+  originalFetch = window.fetch.bind(window);
+  window.fetch = fetchWithAuth;
+
+  configured = true;
+}
diff --git a/dashboard/src/api/v1.ts b/dashboard/src/api/v1.ts
new file mode 100644
index 000000000..0930c6f77
--- /dev/null
+++ b/dashboard/src/api/v1.ts
@@ -0,0 +1,1608 @@
+import type { AxiosRequestConfig, AxiosResponse } from 'axios';
+
+import * as openApiV1 from './generated/openapi-v1';
+import {
+  client as openApiV1Client,
+  type BackupExportRequest,
+  type BackupRenameRequest,
+  type BackupUploadInitRequest,
+  type BackupUploadSessionRequest,
+  type BotConfigRequest,
+  type BotRegistrationRequest,
+  type ChatMessagePatchRequest,
+  type ChatMessageRegenerateRequest,
+  type ChatProjectRequest,
+  type ChatRequest,
+  type ChatSessionBatchDeleteRequest,
+  type ChatSessionPatchRequest,
+  type ChatThreadCreateRequest,
+  type ChatThreadMessageRequest,
+  type CommandPatchRequest,
+  type ConfigRouteUpsertRequest,
+  type ConfigRoutesReplaceRequest,
+  type ConversationBatchDeleteRequest,
+  type ConversationExportRequest,
+  type ConversationMessagesReplaceRequest,
+  type ConversationPatchRequest,
+  type CreateApiKeyRequest,
+  type CronJobPatchRequest,
+  type CronJobRequest,
+  type DynamicConfig,
+  type EnabledPatch,
+  type GhproxyTestRequest,
+  type LoginRequest,
+  type ListConversationsData,
+  type McpServerConfig,
+  type MigrationRequest,
+  type ModelScopeSyncRequest,
+  type PipInstallRequest,
+  type PluginVersionSupportRequest,
+  type PluginConfigFileDeleteRequest,
+  type ProviderConfigRequest,
+  type BatchSessionProviderRequest,
+  type BatchSessionServiceRequest,
+  type SetupAuthRequest,
+  type SessionGroupRequest,
+  type SessionRuleRequest,
+  type UmoListRequest,
+  type SuccessEnvelope,
+  type T2iTemplateRequest,
+  type TotpSetupRequest,
+  type TraceSettingsRequest,
+  type UpdateAccountRequest,
+  type UpdateRequest,
+} from './generated/openapi-v1';
+import { apiV1Client, httpClient } from './http';
+
+openApiV1Client.setConfig({
+  axios: httpClient,
+  throwOnError: true,
+});
+
+export interface ApiEnvelope<T> {
+  status: 'ok' | 'error';
+  message?: string | null;
+  data: T;
+}
+
+export type OpenConfig = DynamicConfig;
+
+export interface ProviderSchemaData {
+  config_schema?: OpenConfig;
+  providers?: OpenConfig[];
+  provider_sources?: OpenConfig[];
+}
+
+export interface ProviderSourceModelsData {
+  models?: string[];
+  model_metadata?: Record<string, unknown>;
+}
+
+export interface ProviderTestData {
+  id?: string;
+  model?: string | null;
+  type?: string | null;
+  name?: string;
+  status?: string;
+  error?: string | null;
+}
+
+export interface ProviderEmbeddingDimensionData {
+  embedding_dimensions?: number;
+  [key: string]: unknown;
+}
+
+export interface VersionData {
+  version?: string;
+  dashboard_version?: string;
+  need_migration?: boolean;
+  change_pwd_hint?: boolean;
+  md5_pwd_hint?: boolean;
+  password_upgrade_required?: boolean;
+  [key: string]: unknown;
+}
+
+export interface CommandListData {
+  items?: any[];
+  wake_prefix?: string[];
+  summary?: {
+    disabled?: number;
+    conflicts?: number;
+    [key: string]: unknown;
+  };
+  [key: string]: unknown;
+}
+
+export interface BotListParams {
+  enabled?: boolean;
+  type?: string;
+}
+
+export interface ProviderListParams {
+  capability?: 'chat' | 'agent' | 'stt' | 'tts' | 'embedding' | 'rerank';
+  source_id?: string;
+  enabled?: boolean;
+}
+
+export interface ToolListParams {
+  origin?: 'builtin' | 'plugin' | 'mcp';
+  enabled?: boolean;
+}
+
+export interface BackupListParams {
+  page?: number;
+  page_size?: number;
+}
+
+export interface SessionListParams {
+  page?: number;
+  page_size?: number;
+  search?: string;
+  platform?: string;
+  message_type?: 'all' | 'group' | 'private';
+}
+
+export interface SessionRuleListParams {
+  page?: number;
+  page_size?: number;
+  search?: string;
+}
+
+export interface ChatSessionListParams {
+  page?: number;
+  page_size?: number;
+  username?: string;
+}
+
+export interface CronJobListParams {
+  type?: string;
+}
+
+type ProviderCapability = NonNullable<ProviderListParams['capability']>;
+
+const PROVIDER_TYPE_TO_CAPABILITY: Record<string, ProviderCapability> = {
+  chat_completion: 'chat',
+  agent_runner: 'agent',
+  speech_to_text: 'stt',
+  text_to_speech: 'tts',
+  embedding: 'embedding',
+  rerank: 'rerank',
+};
+
+type V1Response<T> = Promise<AxiosResponse<ApiEnvelope<T>>>;
+type ListConversationsQuery = NonNullable<ListConversationsData['query']>;
+
+function typed<T>(response: Promise<unknown>): V1Response<T> {
+  return response as unknown as V1Response<T>;
+}
+
+function generatedOptions(
+  options: Record<string, unknown>,
+  requestConfig?: AxiosRequestConfig,
+) {
+  return { ...options, ...(requestConfig || {}) } as any;
+}
+
+function generatedQuery<T extends object>(
+  params?: T,
+): (T & Record<string, unknown>) | undefined {
+  return params as (T & Record<string, unknown>) | undefined;
+}
+
+function generatedFormData(formData: FormData) {
+  return formData as any;
+}
+
+function botConfig(config: OpenConfig): BotConfigRequest {
+  return {
+    id: typeof config.id === 'string' ? config.id : undefined,
+    type: typeof config.type === 'string' ? config.type : '',
+    enabled:
+      typeof config.enable === 'boolean'
+        ? config.enable
+        : typeof config.enabled === 'boolean'
+          ? config.enabled
+          : undefined,
+    config,
+  };
+}
+
+function providerConfig(config: OpenConfig): ProviderConfigRequest {
+  return { config } as ProviderConfigRequest;
+}
+
+function providerTypeToCapabilities(providerType: string): ProviderCapability[] {
+  return providerType
+    .split(',')
+    .map((item) => item.trim())
+    .filter(Boolean)
+    .map((item) => PROVIDER_TYPE_TO_CAPABILITY[item] || (item as ProviderCapability));
+}
+
+function pluginExtensionPath(pluginPath: string): string {
+  return pluginPath
+    .replace(/^\/+/, '')
+    .split('/')
+    .filter(Boolean)
+    .map((segment) => encodeURIComponent(segment))
+    .join('/');
+}
+
+export const configProfileApi = {
+  schema() {
+    return typed<OpenConfig>(openApiV1.getConfigProfileSchema());
+  },
+  list() {
+    return typed<{ info_list: OpenConfig[] }>(openApiV1.listConfigProfiles());
+  },
+  create(payload: { name?: string | null; config?: OpenConfig | null }) {
+    return typed<{ conf_id: string }>(
+      openApiV1.createConfigProfile({
+        body: {
+          name: payload.name ?? undefined,
+          config: payload.config ?? undefined,
+        },
+      }),
+    );
+  },
+  get(configId: string) {
+    return typed<OpenConfig>(
+      openApiV1.getConfigProfile({ path: { config_id: configId } }),
+    );
+  },
+  update(
+    configId: string,
+    config: OpenConfig,
+    requestConfig?: AxiosRequestConfig,
+  ) {
+    return typed<OpenConfig>(
+      openApiV1.updateConfigProfileContent(
+        generatedOptions(
+          {
+            path: { config_id: configId },
+            body: config,
+          },
+          requestConfig,
+        ),
+      ),
+    );
+  },
+  rename(configId: string, name: string | null) {
+    return typed<OpenConfig>(
+      openApiV1.renameConfigProfile({
+        path: { config_id: configId },
+        body: { name: name ?? '' },
+      }),
+    );
+  },
+  delete(configId: string) {
+    return typed<OpenConfig>(
+      openApiV1.deleteConfigProfile({ path: { config_id: configId } }),
+    );
+  },
+};
+
+export const systemConfigApi = {
+  schema() {
+    return typed<OpenConfig>(openApiV1.getSystemConfigSchema());
+  },
+  get() {
+    return typed<OpenConfig>(openApiV1.getSystemConfig());
+  },
+  runtime() {
+    return typed<OpenConfig>(openApiV1.getSystemConfigRuntime());
+  },
+  update(config: OpenConfig, requestConfig?: AxiosRequestConfig) {
+    return typed<OpenConfig>(
+      openApiV1.updateSystemConfig(
+        generatedOptions({ body: config }, requestConfig),
+      ),
+    );
+  },
+};
+
+export const configRouteApi = {
+  list() {
+    return typed<{ routing?: Record<string, string> }>(openApiV1.listConfigRoutes());
+  },
+  replace(payload: ConfigRoutesReplaceRequest) {
+    return typed<OpenConfig>(openApiV1.replaceConfigRoutes({ body: payload }));
+  },
+  upsert(umo: string, payload: ConfigRouteUpsertRequest) {
+    return typed<OpenConfig>(
+      openApiV1.upsertConfigRoute({ path: { umo }, body: payload }),
+    );
+  },
+  delete(umo: string) {
+    return typed<OpenConfig>(
+      openApiV1.deleteConfigRoute({ path: { umo } }),
+    );
+  },
+};
+
+export const botApi = {
+  types() {
+    return typed<{ bot_types: OpenConfig[] }>(openApiV1.listBotTypes());
+  },
+  list(params?: BotListParams) {
+    return typed<{ bots: OpenConfig[] }>(
+      openApiV1.listBots({ query: generatedQuery(params) }),
+    );
+  },
+  stats() {
+    return typed<{ platforms: OpenConfig[] }>(openApiV1.listBotStats());
+  },
+  registration(botType: string, payload: BotRegistrationRequest) {
+    return typed<any>(
+      openApiV1.registerBotType({
+        path: { bot_type: botType },
+        body: payload,
+      }),
+    );
+  },
+  create(config: OpenConfig) {
+    return typed<OpenConfig>(openApiV1.createBot({ body: botConfig(config) }));
+  },
+  get(botId: string) {
+    return typed<{ bot: OpenConfig }>(
+      openApiV1.getBotById({ query: { bot_id: botId } }),
+    );
+  },
+  update(botId: string, config: OpenConfig) {
+    return typed<OpenConfig>(
+      openApiV1.updateBotById({
+        body: { bot_id: botId, config },
+      }),
+    );
+  },
+  setEnabled(botId: string, payload: EnabledPatch) {
+    return typed<OpenConfig>(
+      openApiV1.setBotEnabledById({
+        body: { bot_id: botId, enabled: payload.enabled },
+      }),
+    );
+  },
+  delete(botId: string) {
+    return typed<OpenConfig>(
+      openApiV1.deleteBotById({ query: { bot_id: botId } }),
+    );
+  },
+};
+
+export const providerApi = {
+  schema() {
+    return typed<ProviderSchemaData>(openApiV1.getProviderSchema());
+  },
+  sources() {
+    return typed<{ provider_sources: OpenConfig[] }>(
+      openApiV1.listProviderSources(),
+    );
+  },
+  upsertSource(sourceId: string, config: OpenConfig) {
+    return typed<OpenConfig>(
+      openApiV1.upsertProviderSourceById({
+        body: { source_id: sourceId, config },
+      }),
+    );
+  },
+  deleteSource(sourceId: string) {
+    return typed<OpenConfig>(
+      openApiV1.deleteProviderSourceById({ query: { source_id: sourceId } }),
+    );
+  },
+  sourceModels(sourceId: string) {
+    return typed<ProviderSourceModelsData>(
+      openApiV1.listProviderSourceModelsById({
+        query: { source_id: sourceId },
+      }),
+    );
+  },
+  list(params?: ProviderListParams) {
+    return typed<{ providers: OpenConfig[] }>(
+      openApiV1.listProviders({ query: generatedQuery(params) }),
+    );
+  },
+  async listByProviderType(providerType: string): Promise<AxiosResponse<ApiEnvelope<OpenConfig[]>>> {
+    const capabilities = providerTypeToCapabilities(providerType);
+    if (capabilities.length === 0) {
+      const response = await providerApi.list();
+      return {
+        ...response,
+        data: {
+          ...response.data,
+          data: response.data.data.providers || [],
+        },
+      };
+    }
+
+    const responses = await Promise.all(
+      capabilities.map((capability) => providerApi.list({ capability })),
+    );
+    const first = responses[0];
+    return {
+      ...first,
+      data: {
+        ...first.data,
+        data: responses.flatMap((response) => response.data.data.providers || []),
+      },
+    };
+  },
+  create(config: OpenConfig) {
+    return typed<OpenConfig>(
+      openApiV1.createProvider({ body: providerConfig(config) }),
+    );
+  },
+  listBySource(sourceId: string, params?: Pick<ProviderListParams, 'capability'>) {
+    return typed<{ providers: OpenConfig[] }>(
+      openApiV1.listProvidersBySourceId({
+        query: { source_id: sourceId, ...params },
+      }),
+    );
+  },
+  createInSource(sourceId: string, config: OpenConfig) {
+    return typed<OpenConfig>(
+      openApiV1.createProviderInSourceById({
+        body: { source_id: sourceId, config },
+      }),
+    );
+  },
+  get(providerId: string, merged = false) {
+    return typed<{ provider: OpenConfig }>(
+      openApiV1.getProviderById({
+        query: { provider_id: providerId, merged },
+      }),
+    );
+  },
+  update(providerId: string, config: OpenConfig) {
+    return typed<OpenConfig>(
+      openApiV1.updateProviderById({
+        body: { provider_id: providerId, config },
+      }),
+    );
+  },
+  setEnabled(providerId: string, payload: EnabledPatch) {
+    return typed<OpenConfig>(
+      openApiV1.setProviderEnabledById({
+        body: { provider_id: providerId, enabled: payload.enabled },
+      }),
+    );
+  },
+  delete(providerId: string) {
+    return typed<OpenConfig>(
+      openApiV1.deleteProviderById({ query: { provider_id: providerId } }),
+    );
+  },
+  test(providerId: string) {
+    return typed<ProviderTestData>(
+      openApiV1.testProviderById({ body: { provider_id: providerId } }),
+    );
+  },
+  embeddingDimension(providerId: string, providerConfig?: OpenConfig) {
+    return typed<ProviderEmbeddingDimensionData>(
+      openApiV1.getProviderEmbeddingDimensionById({
+        body: {
+          provider_id: providerId,
+          ...(providerConfig ? { provider_config: providerConfig } : {}),
+        },
+      }),
+    );
+  },
+};
+
+export const authApi = {
+  login(payload: LoginRequest) {
+    return typed<any>(openApiV1.login({ body: payload }));
+  },
+  logout() {
+    return typed<OpenConfig>(openApiV1.logout());
+  },
+  setupStatus() {
+    return typed<any>(openApiV1.getAuthSetupStatus());
+  },
+  setup(payload: SetupAuthRequest) {
+    return typed<OpenConfig>(openApiV1.setupAuth({ body: payload }));
+  },
+  setupTotp(payload?: TotpSetupRequest) {
+    return typed<any>(openApiV1.setupTotp({ body: payload }));
+  },
+  recoverTotp() {
+    return typed<any>(openApiV1.recoverTotp());
+  },
+  updateAccount(payload: UpdateAccountRequest) {
+    return typed<OpenConfig>(
+      openApiV1.updateAuthAccount({ body: payload }),
+    );
+  },
+};
+
+export const apiKeyApi = {
+  list() {
+    return typed<OpenConfig[]>(openApiV1.listApiKeys());
+  },
+  create(payload: CreateApiKeyRequest) {
+    return typed<{ api_key?: string }>(openApiV1.createApiKey({ body: payload }));
+  },
+  revoke(keyId: string) {
+    return typed<OpenConfig>(
+      openApiV1.revokeApiKey({ path: { key_id: keyId } }),
+    );
+  },
+  delete(keyId: string) {
+    return typed<OpenConfig>(
+      openApiV1.deleteApiKey({ path: { key_id: keyId } }),
+    );
+  },
+};
+
+export const traceApi = {
+  getSettings() {
+    return typed<OpenConfig>(openApiV1.getTraceSettings());
+  },
+  updateSettings(settings: TraceSettingsRequest) {
+    return typed<OpenConfig>(
+      openApiV1.updateTraceSettings({ body: settings }),
+    );
+  },
+};
+
+export const updatesApi = {
+  check() {
+    return typed<any>(openApiV1.checkUpdate());
+  },
+  releases(type?: 'core' | 'dashboard') {
+    return typed<any[]>(
+      openApiV1.listReleases({
+        query: type ? { type } : undefined,
+      }),
+    );
+  },
+  core(payload?: UpdateRequest) {
+    return typed<OpenConfig>(openApiV1.updateCore({ body: payload }));
+  },
+  dashboard(payload?: UpdateRequest) {
+    return typed<OpenConfig>(
+      openApiV1.updateDashboard({ body: payload }),
+    );
+  },
+  progress(taskId: string) {
+    return typed<any>(
+      openApiV1.getUpdateProgress({ path: { task_id: taskId } }),
+    );
+  },
+  installPip(payload: PipInstallRequest) {
+    return typed<OpenConfig>(
+      openApiV1.installPipPackage({ body: payload }),
+    );
+  },
+  runMigrations(payload?: MigrationRequest) {
+    return typed<OpenConfig>(openApiV1.runMigrations({ body: payload }));
+  },
+};
+
+export const backupApi = {
+  list(params?: BackupListParams) {
+    return typed<any>(openApiV1.listBackups({ query: generatedQuery(params) }));
+  },
+  create(payload?: BackupExportRequest) {
+    return typed<any>(openApiV1.createBackup({ body: payload }));
+  },
+  progress(taskId: string) {
+    return typed<any>(
+      openApiV1.getBackupProgress({ path: { task_id: taskId } }),
+    );
+  },
+  upload(formData: FormData) {
+    return typed<any>(
+      openApiV1.uploadBackup({ body: generatedFormData(formData) }),
+    );
+  },
+  initUpload(payload: BackupUploadInitRequest) {
+    return typed<any>(openApiV1.initBackupUpload({ body: payload }));
+  },
+  uploadChunk(formData: FormData) {
+    return typed<any>(
+      openApiV1.uploadBackupChunk({ body: generatedFormData(formData) }),
+    );
+  },
+  completeUpload(payload: BackupUploadSessionRequest) {
+    return typed<any>(openApiV1.completeBackupUpload({ body: payload }));
+  },
+  abortUpload(payload: BackupUploadSessionRequest) {
+    return typed<OpenConfig>(openApiV1.abortBackupUpload({ body: payload }));
+  },
+  check(filename: string) {
+    return typed<any>(
+      openApiV1.checkBackup({ path: { filename } }),
+    );
+  },
+  import(filename: string, confirmed = true) {
+    return typed<any>(
+      openApiV1.importBackup({
+        path: { filename },
+        body: { confirmed } as any,
+      }),
+    );
+  },
+  delete(filename: string) {
+    return typed<OpenConfig>(
+      openApiV1.deleteBackup({ path: { filename } }),
+    );
+  },
+  rename(filename: string, payload: BackupRenameRequest) {
+    return typed<any>(
+      openApiV1.renameBackup({ path: { filename }, body: payload }),
+    );
+  },
+  downloadUrl(filename: string, token: string) {
+    return `/api/v1/backups/${encodeURIComponent(filename)}?token=${encodeURIComponent(token)}`;
+  },
+};
+
+export const chatApi = {
+  send(payload: ChatRequest) {
+    return typed<any>(openApiV1.sendChatMessage({ body: payload }));
+  },
+  sendStreamUrl() {
+    return '/api/v1/chat';
+  },
+  liveWebSocketUrl(token: string, host = window.location.host) {
+    const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
+    return `${protocol}//${host}/api/v1/live-chat/ws?token=${encodeURIComponent(token)}`;
+  },
+  unifiedWebSocketUrl(token: string, host = window.location.host) {
+    const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
+    return `${protocol}//${host}/api/v1/unified-chat/ws?token=${encodeURIComponent(token)}`;
+  },
+  listSessions(params?: ChatSessionListParams) {
+    return typed<any>(
+      openApiV1.listChatSessions({ query: generatedQuery(params) }),
+    );
+  },
+  createSession(platformId?: string) {
+    return typed<any>(
+      openApiV1.createChatSession({
+        query: platformId ? { platform_id: platformId } : undefined,
+      }),
+    );
+  },
+  getSession(sessionId: string) {
+    return typed<any>(
+      openApiV1.getChatSession({ path: { session_id: sessionId } }),
+    );
+  },
+  updateSession(sessionId: string, payload: ChatSessionPatchRequest) {
+    return typed<any>(
+      openApiV1.updateChatSession({
+        path: { session_id: sessionId },
+        body: payload,
+      }),
+    );
+  },
+  deleteSession(sessionId: string) {
+    return typed<any>(
+      openApiV1.deleteChatSession({ path: { session_id: sessionId } }),
+    );
+  },
+  batchDeleteSessions(payload: ChatSessionBatchDeleteRequest) {
+    return typed<any>(openApiV1.batchDeleteChatSessions({ body: payload }));
+  },
+  stopSession(sessionId: string) {
+    return typed<any>(
+      openApiV1.stopChatSession({ path: { session_id: sessionId } }),
+    );
+  },
+  updateMessage(
+    sessionId: string,
+    messageId: string | number,
+    payload: ChatMessagePatchRequest,
+  ) {
+    return typed<any>(
+      openApiV1.updateChatMessage({
+        path: { session_id: sessionId, message_id: String(messageId) },
+        body: payload,
+      }),
+    );
+  },
+  regenerateMessage(
+    sessionId: string,
+    messageId: string | number,
+    payload?: ChatMessageRegenerateRequest,
+  ) {
+    return typed<any>(
+      openApiV1.regenerateChatMessage({
+        path: { session_id: sessionId, message_id: String(messageId) },
+        body: payload,
+      }) as any,
+    );
+  },
+  regenerateMessageUrl(sessionId: string, messageId: string | number) {
+    return `/api/v1/chat/sessions/${encodeURIComponent(sessionId)}/messages/${encodeURIComponent(String(messageId))}/regenerate`;
+  },
+  createThread(payload: ChatThreadCreateRequest) {
+    return typed<any>(openApiV1.createChatThread({ body: payload }));
+  },
+  getThread(threadId: string) {
+    return typed<any>(
+      openApiV1.getChatThread({ path: { thread_id: threadId } }),
+    );
+  },
+  deleteThread(threadId: string) {
+    return typed<any>(
+      openApiV1.deleteChatThread({ path: { thread_id: threadId } }),
+    );
+  },
+  sendThreadMessage(threadId: string, payload: ChatThreadMessageRequest) {
+    return typed<any>(
+      openApiV1.sendChatThreadMessage({
+        path: { thread_id: threadId },
+        body: payload,
+      }) as any,
+    );
+  },
+  sendThreadMessageUrl(threadId: string) {
+    return `/api/v1/chat/threads/${encodeURIComponent(threadId)}/messages`;
+  },
+  listProjects() {
+    return typed<any>(openApiV1.listChatProjects());
+  },
+  createProject(payload: ChatProjectRequest) {
+    return typed<any>(openApiV1.createChatProject({ body: payload }));
+  },
+  getProject(projectId: string) {
+    return typed<any>(
+      openApiV1.getChatProject({ path: { project_id: projectId } }),
+    );
+  },
+  updateProject(projectId: string, payload: ChatProjectRequest) {
+    return typed<any>(
+      openApiV1.updateChatProject({
+        path: { project_id: projectId },
+        body: payload,
+      }),
+    );
+  },
+  deleteProject(projectId: string) {
+    return typed<any>(
+      openApiV1.deleteChatProject({ path: { project_id: projectId } }),
+    );
+  },
+  listProjectSessions(projectId: string) {
+    return typed<any>(
+      openApiV1.listChatProjectSessions({ path: { project_id: projectId } }),
+    );
+  },
+  addProjectSession(projectId: string, sessionId: string) {
+    return typed<any>(
+      openApiV1.addChatProjectSession({
+        path: { project_id: projectId, session_id: sessionId },
+      }),
+    );
+  },
+  removeProjectSession(sessionId: string) {
+    return typed<any>(
+      openApiV1.removeChatProjectSession({ path: { session_id: sessionId } }),
+    );
+  },
+};
+
+export const fileApi = {
+  upload(formData: FormData) {
+    return typed<any>(
+      openApiV1.uploadFile({ body: generatedFormData(formData) }),
+    );
+  },
+  getByName(filename: string) {
+    return openApiV1.getFileByName({
+      query: { filename },
+      responseType: 'blob',
+    }) as Promise<AxiosResponse<Blob>>;
+  },
+  byNameUrl(filename: string) {
+    return `/api/v1/files/content?filename=${encodeURIComponent(filename)}`;
+  },
+  contentUrl(attachmentId: string) {
+    return `/api/v1/files/${encodeURIComponent(attachmentId)}/content`;
+  },
+  tokenUrl(fileToken: string) {
+    return `/api/v1/files/tokens/${encodeURIComponent(fileToken)}`;
+  },
+};
+
+export const sessionApi = {
+  list(params?: SessionListParams) {
+    return typed<any>(openApiV1.listSessions({ query: generatedQuery(params) }));
+  },
+  activeUmos() {
+    return typed<any>(openApiV1.listActiveUmos());
+  },
+  listRules(params?: SessionRuleListParams) {
+    return typed<any>(
+      openApiV1.listSessionRules({ query: generatedQuery(params) }),
+    );
+  },
+  upsertRule(payload: SessionRuleRequest) {
+    return typed<any>(openApiV1.upsertSessionRule({ body: payload }));
+  },
+  deleteRules(payload: UmoListRequest) {
+    return typed<any>(openApiV1.deleteSessionRules({ body: payload }));
+  },
+  batchUpdateProvider(payload: BatchSessionProviderRequest) {
+    return typed<any>(
+      openApiV1.batchUpdateSessionProvider({ body: payload }),
+    );
+  },
+  batchUpdateService(payload: BatchSessionServiceRequest) {
+    return typed<any>(
+      openApiV1.batchUpdateSessionService({ body: payload }),
+    );
+  },
+  listGroups() {
+    return typed<any>(openApiV1.listSessionGroups());
+  },
+  createGroup(payload: SessionGroupRequest) {
+    return typed<any>(openApiV1.createSessionGroup({ body: payload }));
+  },
+  updateGroup(groupId: string, payload: SessionGroupRequest) {
+    return typed<any>(
+      openApiV1.updateSessionGroup({
+        path: { group_id: groupId },
+        body: payload,
+      }),
+    );
+  },
+  deleteGroup(groupId: string) {
+    return typed<any>(
+      openApiV1.deleteSessionGroup({ path: { group_id: groupId } }),
+    );
+  },
+};
+
+export const cronApi = {
+  list(params?: CronJobListParams) {
+    return typed<any>(openApiV1.listCronJobs({ query: generatedQuery(params) }));
+  },
+  create(payload: CronJobRequest) {
+    return typed<any>(openApiV1.createCronJob({ body: payload }));
+  },
+  update(jobId: string, payload: CronJobPatchRequest) {
+    return typed<any>(
+      openApiV1.updateCronJob({ path: { job_id: jobId }, body: payload }),
+    );
+  },
+  delete(jobId: string) {
+    return typed<any>(openApiV1.deleteCronJob({ path: { job_id: jobId } }));
+  },
+  run(jobId: string) {
+    return typed<any>(openApiV1.runCronJob({ path: { job_id: jobId } }));
+  },
+};
+
+export const subagentApi = {
+  getConfig() {
+    return typed<OpenConfig>(openApiV1.getSubagentConfig());
+  },
+  updateConfig(config: OpenConfig) {
+    return typed<OpenConfig>(
+      openApiV1.updateSubagentConfig({ body: config }),
+    );
+  },
+  availableTools() {
+    return typed<any>(openApiV1.listSubagentAvailableTools());
+  },
+};
+
+export const commandApi = {
+  list(configId?: string) {
+    return typed<CommandListData>(
+      openApiV1.listCommands({
+        query: configId ? { config_id: configId } : undefined,
+      }),
+    );
+  },
+  conflicts() {
+    return typed<OpenConfig>(openApiV1.listCommandConflicts());
+  },
+  update(commandId: string, patch: CommandPatchRequest) {
+    return typed<OpenConfig>(
+      openApiV1.updateCommand({
+        path: { command_id: commandId },
+        body: patch,
+      }),
+    );
+  },
+};
+
+export const toolApi = {
+  list(params?: ToolListParams) {
+    return typed<any[]>(openApiV1.listTools({ query: generatedQuery(params) }));
+  },
+  setEnabled(toolId: string, enabled: boolean) {
+    return typed<OpenConfig>(
+      openApiV1.setToolEnabled({
+        path: { tool_id: toolId },
+        body: { enabled },
+      }),
+    );
+  },
+  setPermission(toolId: string, permission: 'admin' | 'member') {
+    return typed<OpenConfig>(
+      openApiV1.setToolPermission({
+        path: { tool_id: toolId },
+        body: { permission },
+      }),
+    );
+  },
+};
+
+export const mcpApi = {
+  list() {
+    return typed<OpenConfig[]>(openApiV1.listMcpServers());
+  },
+  create(config: McpServerConfig) {
+    return typed<OpenConfig>(openApiV1.createMcpServer({ body: config }));
+  },
+  update(serverName: string, config: McpServerConfig) {
+    return typed<OpenConfig>(
+      openApiV1.updateMcpServerByName({
+        body: { server_name: serverName, config },
+      }),
+    );
+  },
+  delete(serverName: string) {
+    return typed<OpenConfig>(
+      openApiV1.deleteMcpServerByName({ query: { server_name: serverName } }),
+    );
+  },
+  setEnabled(serverName: string, enabled: boolean) {
+    return typed<OpenConfig>(
+      openApiV1.setMcpServerEnabledByName({
+        body: { server_name: serverName, enabled },
+      }),
+    );
+  },
+  test(serverName: string, config?: DynamicConfig) {
+    return typed<OpenConfig>(
+      openApiV1.testMcpServerByName({
+        body: {
+          server_name: serverName,
+          ...(config ? { mcp_server_config: config } : {}),
+        },
+      }),
+    );
+  },
+  syncModelScope(payload?: ModelScopeSyncRequest) {
+    return typed<OpenConfig>(
+      openApiV1.syncModelScopeMcpServers({ body: payload }),
+    );
+  },
+};
+
+export const t2iApi = {
+  listTemplates() {
+    return typed<OpenConfig[]>(openApiV1.listT2iTemplates());
+  },
+  getTemplate(name: string) {
+    return typed<{ name: string; content: string }>(
+      openApiV1.getT2iTemplate({ path: { name } }),
+    );
+  },
+  createTemplate(payload: T2iTemplateRequest) {
+    return typed<OpenConfig>(
+      openApiV1.createT2iTemplate({ body: payload }),
+    );
+  },
+  updateTemplate(name: string, content: string) {
+    return typed<OpenConfig>(
+      openApiV1.updateT2iTemplate({
+        path: { name },
+        body: { content },
+      }),
+    );
+  },
+  deleteTemplate(name: string) {
+    return typed<OpenConfig>(
+      openApiV1.deleteT2iTemplate({ path: { name } }),
+    );
+  },
+  getActiveTemplate() {
+    return typed<{ active_template?: string }>(openApiV1.getActiveT2iTemplate());
+  },
+  setActiveTemplate(name: string) {
+    return typed<OpenConfig>(
+      openApiV1.setActiveT2iTemplate({ body: { name } }),
+    );
+  },
+  resetDefaultTemplate() {
+    return typed<OpenConfig>(openApiV1.resetDefaultT2iTemplate());
+  },
+};
+
+export const logApi = {
+  history() {
+    return typed<{ logs?: OpenConfig[] }>(openApiV1.getLogHistory());
+  },
+  liveUrl() {
+    return '/api/v1/logs/live';
+  },
+};
+
+export const pluginApi = {
+  list(params?: { include_reserved?: boolean; enabled?: boolean }) {
+    return typed<any[]>(openApiV1.listPlugins({ query: params }));
+  },
+  get(pluginId: string) {
+    return typed<OpenConfig>(
+      openApiV1.getPluginById({ query: { plugin_id: pluginId } }),
+    );
+  },
+  failed() {
+    return typed<Record<string, OpenConfig>>(openApiV1.listFailedPlugins());
+  },
+  reloadFailed(pluginId: string) {
+    return typed<OpenConfig>(
+      openApiV1.reloadFailedPlugin({ path: { plugin_id: pluginId } }),
+    );
+  },
+  uninstallFailed(
+    pluginId: string,
+    options?: { delete_config?: boolean; delete_data?: boolean },
+  ) {
+    return typed<OpenConfig>(
+      openApiV1.uninstallFailedPlugin({
+        path: { plugin_id: pluginId },
+        body: options,
+      }),
+    );
+  },
+  uninstall(
+    pluginId: string,
+    options?: { delete_config?: boolean; delete_data?: boolean },
+  ) {
+    return typed<OpenConfig>(
+      openApiV1.uninstallPluginById({
+        query: { plugin_id: pluginId },
+        body: options,
+      }),
+    );
+  },
+  reload(pluginId: string) {
+    return typed<OpenConfig>(
+      openApiV1.reloadPluginById({ body: { plugin_id: pluginId } }),
+    );
+  },
+  setEnabled(pluginId: string, enabled: boolean) {
+    return typed<OpenConfig>(
+      openApiV1.setPluginEnabledById({
+        body: { plugin_id: pluginId, enabled },
+      }),
+    );
+  },
+  update(pluginId: string, body?: OpenConfig) {
+    return typed<OpenConfig>(
+      openApiV1.updatePlugins({
+        body: { plugin_id: pluginId, ...(body || {}) } as any,
+      }),
+    );
+  },
+  updateMany(body: OpenConfig) {
+    return typed<OpenConfig>(
+      openApiV1.updatePlugins({ body: body as any }),
+    );
+  },
+  checkVersionSupport(payload: PluginVersionSupportRequest) {
+    return typed<any>(
+      openApiV1.checkPluginVersionSupport({ body: payload }),
+    );
+  },
+  config(pluginId: string) {
+    return typed<OpenConfig>(
+      openApiV1.getPluginConfigById({ query: { plugin_id: pluginId } }),
+    );
+  },
+  updateConfig(pluginId: string, config: OpenConfig) {
+    return typed<OpenConfig>(
+      openApiV1.updatePluginConfigById({
+        body: { plugin_id: pluginId, config },
+      }),
+    );
+  },
+  listConfigFiles(pluginId: string, configKey: string) {
+    return typed<any>(
+      openApiV1.listPluginConfigFilesById({
+        query: { plugin_id: pluginId, config_key: configKey },
+      }),
+    );
+  },
+  uploadConfigFiles(pluginId: string, configKey: string, formData: FormData) {
+    return typed<any>(
+      openApiV1.uploadPluginConfigFilesById({
+        query: { plugin_id: pluginId, config_key: configKey },
+        body: generatedFormData(formData),
+      }),
+    );
+  },
+  deleteConfigFile(pluginId: string, payload: PluginConfigFileDeleteRequest) {
+    return typed<OpenConfig>(
+      openApiV1.deletePluginConfigFileById({
+        query: { plugin_id: pluginId },
+        body: payload,
+      }),
+    );
+  },
+  readme(pluginId: string) {
+    return typed<OpenConfig>(
+      openApiV1.getPluginReadmeById({ query: { plugin_id: pluginId } }),
+    );
+  },
+  changelog(pluginId: string) {
+    return typed<OpenConfig>(
+      openApiV1.getPluginChangelogById({ query: { plugin_id: pluginId } }),
+    );
+  },
+  market(params?: {
+    page?: number;
+    page_size?: number;
+    category?: string;
+    sort?: 'recommended' | 'downloads' | 'updated' | 'name';
+    keyword?: string;
+    force_refresh?: boolean;
+    custom_registry?: string;
+  }) {
+    return typed<any>(openApiV1.listPluginMarket({ query: params }));
+  },
+  sources() {
+    return typed<any>(openApiV1.listPluginSources());
+  },
+  replaceSources(sources: OpenConfig[]) {
+    return typed<OpenConfig>(
+      openApiV1.replacePluginSources({ body: { sources: sources as any } }),
+    );
+  },
+  installUpload(formData: FormData) {
+    return typed<OpenConfig>(
+      openApiV1.installPluginFromUpload({
+        body: generatedFormData(formData),
+      }),
+    );
+  },
+  installGithub(body: OpenConfig) {
+    return typed<OpenConfig>(
+      openApiV1.installPluginFromGithub({ body: body as any }),
+    );
+  },
+  installUrl(body: OpenConfig) {
+    return typed<OpenConfig>(
+      openApiV1.installPluginFromUrl({ body: body as any }),
+    );
+  },
+  page(pluginId: string, pageName: string) {
+    return typed<any>(
+      openApiV1.getPluginPageById({
+        query: { plugin_id: pluginId, page_name: pageName },
+      }) as any,
+    );
+  },
+};
+
+export const pluginExtensionApi = {
+  get<T = any>(pluginPath: string, config?: AxiosRequestConfig) {
+    return apiV1Client.get<ApiEnvelope<T>>(
+      `/plugins/extensions/${pluginExtensionPath(pluginPath)}`,
+      config,
+    );
+  },
+  post<T = any>(
+    pluginPath: string,
+    data?: unknown,
+    config?: AxiosRequestConfig,
+  ) {
+    return apiV1Client.post<ApiEnvelope<T>>(
+      `/plugins/extensions/${pluginExtensionPath(pluginPath)}`,
+      data,
+      config,
+    );
+  },
+  put<T = any>(pluginPath: string, data?: unknown, config?: AxiosRequestConfig) {
+    return apiV1Client.put<ApiEnvelope<T>>(
+      `/plugins/extensions/${pluginExtensionPath(pluginPath)}`,
+      data,
+      config,
+    );
+  },
+  patch<T = any>(pluginPath: string, data?: unknown, config?: AxiosRequestConfig) {
+    return apiV1Client.patch<ApiEnvelope<T>>(
+      `/plugins/extensions/${pluginExtensionPath(pluginPath)}`,
+      data,
+      config,
+    );
+  },
+  delete<T = any>(pluginPath: string, config?: AxiosRequestConfig) {
+    return apiV1Client.delete<ApiEnvelope<T>>(
+      `/plugins/extensions/${pluginExtensionPath(pluginPath)}`,
+      config,
+    );
+  },
+};
+
+export const knowledgeApi = {
+  list(params?: { page?: number; page_size?: number; refresh_stats?: boolean }) {
+    return typed<any>(openApiV1.listKnowledgeBases({ query: params }));
+  },
+  get(kbId: string) {
+    return typed<OpenConfig>(
+      openApiV1.getKnowledgeBase({ path: { kb_id: kbId } }),
+    );
+  },
+  create(config: OpenConfig) {
+    return typed<OpenConfig>(
+      openApiV1.createKnowledgeBase({ body: config as any }),
+    );
+  },
+  update(kbId: string, config: OpenConfig) {
+    return typed<OpenConfig>(
+      openApiV1.updateKnowledgeBase({
+        path: { kb_id: kbId },
+        body: config as any,
+      }),
+    );
+  },
+  delete(kbId: string) {
+    return typed<OpenConfig>(
+      openApiV1.deleteKnowledgeBase({ path: { kb_id: kbId } }),
+    );
+  },
+  documents(kbId: string, params?: { page?: number; page_size?: number }) {
+    return typed<any>(
+      openApiV1.listKnowledgeDocuments({
+        path: { kb_id: kbId },
+        query: params,
+      }),
+    );
+  },
+  uploadDocument(kbId: string, formData: FormData) {
+    return typed<any>(
+      openApiV1.uploadKnowledgeDocument({
+        path: { kb_id: kbId },
+        body: generatedFormData(formData),
+      }),
+    );
+  },
+  importDocumentFromUrl(kbId: string, payload: OpenConfig) {
+    return typed<any>(
+      openApiV1.importKnowledgeDocumentFromUrl({
+        path: { kb_id: kbId },
+        body: payload as any,
+      }),
+    );
+  },
+  task(taskId: string) {
+    return typed<any>(
+      openApiV1.getKnowledgeTask({ path: { task_id: taskId } }),
+    );
+  },
+  document(kbId: string, documentId: string) {
+    return typed<OpenConfig>(
+      openApiV1.getKnowledgeDocument({
+        path: { kb_id: kbId, document_id: documentId },
+      }),
+    );
+  },
+  deleteDocument(kbId: string, documentId: string) {
+    return typed<OpenConfig>(
+      openApiV1.deleteKnowledgeDocument({
+        path: { kb_id: kbId, document_id: documentId },
+      }),
+    );
+  },
+  chunks(
+    kbId: string,
+    params?: { document_id?: string; page?: number; page_size?: number },
+  ) {
+    return typed<any>(
+      openApiV1.listKnowledgeChunks({
+        path: { kb_id: kbId },
+        query: params,
+      }),
+    );
+  },
+  deleteChunk(kbId: string, chunkId: string, documentId: string) {
+    return typed<OpenConfig>(
+      openApiV1.deleteKnowledgeChunk({
+        path: { kb_id: kbId, chunk_id: chunkId },
+        query: { document_id: documentId },
+      }),
+    );
+  },
+  retrieve(kbId: string, payload: OpenConfig) {
+    return typed<any>(
+      openApiV1.retrieveKnowledgeBase({
+        path: { kb_id: kbId },
+        body: payload as any,
+      }),
+    );
+  },
+};
+
+export const skillApi = {
+  list(params?: { enabled?: boolean; source?: string }) {
+    return typed<any>(openApiV1.listSkills({ query: params }));
+  },
+  uploadBatch(formData: FormData) {
+    return typed<any>(
+      openApiV1.uploadSkillsBatch({ body: generatedFormData(formData) }),
+    );
+  },
+  setEnabled(skillName: string, enabled: boolean) {
+    return typed<OpenConfig>(
+      openApiV1.updateSkillByName({
+        body: { skill_name: skillName, enabled },
+      }),
+    );
+  },
+  delete(skillName: string) {
+    return typed<OpenConfig>(
+      openApiV1.deleteSkillByName({ query: { skill_name: skillName } }),
+    );
+  },
+  download(skillName: string) {
+    return openApiV1.downloadSkillByName({
+      query: { skill_name: skillName },
+      responseType: 'blob',
+    });
+  },
+  listFiles(skillName: string, path = '') {
+    return typed<any>(
+      openApiV1.listSkillFilesByName({
+        query: { skill_name: skillName, ...(path ? { path } : {}) },
+      }),
+    );
+  },
+  getFile(skillName: string, path: string) {
+    return typed<any>(
+      openApiV1.getSkillFileByName({
+        query: { skill_name: skillName, path },
+      }),
+    );
+  },
+  updateFile(skillName: string, path: string, content: string) {
+    return typed<OpenConfig>(
+      openApiV1.updateSkillFileByName({
+        body: { skill_name: skillName, path, content },
+      }),
+    );
+  },
+  neoCandidates(params?: { skill_key?: string; status?: string }) {
+    return typed<any>(openApiV1.listNeoSkillCandidates({ query: params }));
+  },
+  neoReleases(params?: { skill_key?: string; stage?: string }) {
+    return typed<any>(openApiV1.listNeoSkillReleases({ query: params }));
+  },
+  neoPayload(payloadRef: string) {
+    return typed<any>(
+      openApiV1.getNeoSkillPayload({ query: { payload_ref: payloadRef } }),
+    );
+  },
+  evaluateNeoCandidate(body: OpenConfig) {
+    return typed<OpenConfig>(
+      openApiV1.evaluateNeoSkillCandidate({ body: body as any }),
+    );
+  },
+  promoteNeoCandidate(body: OpenConfig) {
+    return typed<OpenConfig>(
+      openApiV1.promoteNeoSkillCandidate({ body: body as any }),
+    );
+  },
+  rollbackNeoRelease(body: OpenConfig) {
+    return typed<OpenConfig>(
+      openApiV1.rollbackNeoSkillRelease({ body: body as any }),
+    );
+  },
+  syncNeoRelease(body: OpenConfig) {
+    return typed<OpenConfig>(
+      openApiV1.syncNeoSkillRelease({ body: body as any }),
+    );
+  },
+  deleteNeoCandidate(body: OpenConfig) {
+    return typed<OpenConfig>(
+      openApiV1.deleteNeoSkillCandidate({ body: body as any }),
+    );
+  },
+  deleteNeoRelease(body: OpenConfig) {
+    return typed<OpenConfig>(
+      openApiV1.deleteNeoSkillRelease({ body: body as any }),
+    );
+  },
+};
+
+export const personaApi = {
+  tree() {
+    return typed<any>(openApiV1.getPersonaTree());
+  },
+  folders(parentId?: string | null) {
+    return typed<any[]>(
+      openApiV1.listPersonaFolders({
+        query:
+          parentId === undefined ? undefined : { parent_id: parentId ?? '' },
+      }),
+    );
+  },
+  createFolder(folder: OpenConfig) {
+    return typed<OpenConfig>(
+      openApiV1.createPersonaFolder({ body: folder as any }),
+    );
+  },
+  updateFolder(folderId: string, folder: OpenConfig) {
+    return typed<OpenConfig>(
+      openApiV1.updatePersonaFolder({
+        path: { folder_id: folderId },
+        body: folder as any,
+      }),
+    );
+  },
+  deleteFolder(folderId: string) {
+    return typed<OpenConfig>(
+      openApiV1.deletePersonaFolder({ path: { folder_id: folderId } }),
+    );
+  },
+  list(folderId?: string | null) {
+    return typed<any[]>(
+      openApiV1.listPersonas({
+        query:
+          folderId === undefined ? undefined : { folder_id: folderId ?? '' },
+      }),
+    );
+  },
+  get(personaId: string) {
+    return typed<OpenConfig>(
+      openApiV1.getPersonaById({ query: { persona_id: personaId } }),
+    );
+  },
+  create(persona: OpenConfig) {
+    return typed<OpenConfig>(
+      openApiV1.createPersona({ body: persona as any }),
+    );
+  },
+  update(personaId: string, persona: OpenConfig) {
+    return typed<OpenConfig>(
+      openApiV1.updatePersonaById({
+        body: { persona_id: personaId, ...persona } as any,
+      }),
+    );
+  },
+  delete(personaId: string) {
+    return typed<OpenConfig>(
+      openApiV1.deletePersonaById({ query: { persona_id: personaId } }),
+    );
+  },
+  move(personaId: string, folderId: string | null) {
+    return typed<OpenConfig>(
+      openApiV1.movePersonaItem({
+        body: { persona_id: personaId, folder_id: folderId } as any,
+      }),
+    );
+  },
+  reorder(items: any[]) {
+    return typed<OpenConfig>(
+      openApiV1.reorderPersonaItems({ body: { items } as any }),
+    );
+  },
+};
+
+export const conversationApi = {
+  list(params?: ListConversationsQuery, requestConfig?: AxiosRequestConfig) {
+    return typed<any>(
+      openApiV1.listConversations(
+        generatedOptions(
+          { query: generatedQuery(params) },
+          requestConfig,
+        ),
+      ),
+    );
+  },
+  get(userId: string, cid: string) {
+    return typed<any>(
+      openApiV1.getConversation({
+        path: { conversation_id: cid },
+        query: { user_id: userId },
+      }),
+    );
+  },
+  update(userId: string, cid: string, payload: ConversationPatchRequest) {
+    return typed<any>(
+      openApiV1.updateConversation({
+        path: { conversation_id: cid },
+        query: { user_id: userId },
+        body: payload,
+      }),
+    );
+  },
+  replaceMessages(
+    userId: string,
+    cid: string,
+    payload: ConversationMessagesReplaceRequest,
+  ) {
+    return typed<any>(
+      openApiV1.replaceConversationMessages({
+        path: { conversation_id: cid },
+        query: { user_id: userId },
+        body: payload,
+      }),
+    );
+  },
+  delete(userId: string, cid: string) {
+    return typed<any>(
+      openApiV1.deleteConversation({
+        path: { conversation_id: cid },
+        query: { user_id: userId },
+      }),
+    );
+  },
+  batchDelete(payload: ConversationBatchDeleteRequest) {
+    return typed<any>(openApiV1.batchDeleteConversations({ body: payload }));
+  },
+  export(payload: ConversationExportRequest) {
+    return openApiV1.exportConversations({
+      body: payload,
+      responseType: 'blob',
+    }) as Promise<AxiosResponse<Blob>>;
+  },
+};
+
+export const statsApi = {
+  get(offsetSec?: number) {
+    return typed<any>(
+      openApiV1.getStats({
+        query: offsetSec === undefined ? undefined : { offset_sec: offsetSec },
+      }),
+    );
+  },
+  providerTokens(days?: number) {
+    return typed<any>(
+      openApiV1.getProviderTokenStats({
+        query: days === undefined ? undefined : { days },
+      }),
+    );
+  },
+  version() {
+    return typed<VersionData>(openApiV1.getVersion());
+  },
+  firstNotice(locale?: string) {
+    return typed<{ content?: string | null }>(
+      openApiV1.getFirstNotice({
+        query: locale ? { locale } : undefined,
+      }),
+    );
+  },
+  testGhproxy(payload: GhproxyTestRequest) {
+    return typed<{ latency?: number }>(
+      openApiV1.testGhproxyConnection({ body: payload }),
+    );
+  },
+  startTime() {
+    return typed<{ start_time?: number | string | null }>(openApiV1.getStartTime());
+  },
+  restart() {
+    return typed<OpenConfig>(openApiV1.restartCore());
+  },
+  storage() {
+    return typed<OpenConfig>(openApiV1.getStorageStatus());
+  },
+  cleanupStorage(target?: string) {
+    return typed<OpenConfig>(
+      openApiV1.cleanupStorage({
+        body: target ? { target } : undefined,
+      }),
+    );
+  },
+};
+
+export const changelogApi = {
+  listVersions() {
+    return typed<{ versions?: string[] }>(openApiV1.listChangelogVersions());
+  },
+  get(version: string) {
+    return typed<{ content?: string }>(
+      openApiV1.getChangelog({ path: { version } }),
+    );
+  },
+};
diff --git a/dashboard/src/components/chat/Chat.vue b/dashboard/src/components/chat/Chat.vue
index 3179e59f0..d9a63e7f7 100644
--- a/dashboard/src/components/chat/Chat.vue
+++ b/dashboard/src/components/chat/Chat.vue
@@ -503,7 +503,8 @@ import {
 } from "vue";
 import { useRoute, useRouter } from "vue-router";
 import { useDisplay } from "vuetify";
-import axios from "axios";
+import { isAxiosError } from "axios";
+import { chatApi } from "@/api/v1";
 import StyledMenu from "@/components/shared/StyledMenu.vue";
 import ProjectDialog, {
   type ProjectFormData,
@@ -903,8 +904,7 @@ async function saveSessionTitleDialog() {
   try {
     const sessionId = editingSessionTitleId.value;
     const displayName = sessionTitleDraft.value.trim();
-    await axios.post("/api/chat/update_session_display_name", {
-      session_id: sessionId,
+    await chatApi.updateSession(sessionId, {
       display_name: displayName,
     });
     updateSessionTitle(sessionId, displayName);
@@ -1202,7 +1202,7 @@ async function createThreadFromSelection() {
   const message = threadSelection.message;
   if (!currSessionId.value || !message?.id || !threadSelection.selectedText) return;
   try {
-    const response = await axios.post("/api/chat/thread/create", {
+    const response = await chatApi.createThread({
       session_id: currSessionId.value,
       parent_message_id: message.id,
       selected_text: threadSelection.selectedText,
@@ -1224,7 +1224,7 @@ async function createThreadFromSelection() {
     window.getSelection()?.removeAllRanges();
   } catch (error) {
     toast.error(
-      axios.isAxiosError(error)
+      isAxiosError(error)
         ? error.response?.data?.message || error.message
         : tm("thread.createFailed"),
     );
@@ -1269,9 +1269,7 @@ async function deleteThread(thread: ChatThread) {
   if (!(await askForConfirmation(tm("thread.confirmDelete"), confirmDialog))) return;
   deletingThread.value = true;
   try {
-    await axios.post("/api/chat/thread/delete", {
-      thread_id: thread.thread_id,
-    });
+    await chatApi.deleteThread(thread.thread_id);
     removeThreadFromMessages(thread.thread_id);
     if (activeThread.value?.thread_id === thread.thread_id) {
       threadPanelOpen.value = false;
diff --git a/dashboard/src/components/chat/ChatInput.vue b/dashboard/src/components/chat/ChatInput.vue
index 4fb59b22d..2eb05373d 100644
--- a/dashboard/src/components/chat/ChatInput.vue
+++ b/dashboard/src/components/chat/ChatInput.vue
@@ -321,7 +321,7 @@ import { useDisplay } from "vuetify";
 import { useModuleI18n } from "@/i18n/composables";
 import { useCustomizerStore } from "@/stores/customizer";
 import { isComposingEnter } from "@/utils/imeInput.mjs";
-import axios from "axios";
+import { commandApi } from "@/api/v1";
 import type { CommandItem } from "@/components/extension/componentPanel/types";
 import ConfigSelector from "./ConfigSelector.vue";
 import ProviderModelMenu from "./ProviderModelMenu.vue";
@@ -742,16 +742,12 @@ async function fetchCommands() {
   if (commandSuggestionLoading.value) return;
   commandSuggestionLoading.value = true;
   try {
-    const params: Record<string, string> = {};
     const cid = currentConfigId.value;
-    if (cid && cid !== "default") {
-      params.config_id = cid;
-    }
-    const res = await axios.get("/api/commands", { params });
+    const res = await commandApi.list(cid && cid !== "default" ? cid : undefined);
     if (res.data.status === "ok") {
       allCommands.value = res.data.data.items || [];
       // 读取当前配置的唤醒词列表，用于指令候选的触发前缀
-      const prefixes: string[] = res.data.data.wake_prefix;
+      const prefixes: string[] = res.data.data.wake_prefix || [];
       if (prefixes && prefixes.length > 0) {
         wakePrefixes.value = prefixes;
       }
diff --git a/dashboard/src/components/chat/ChatMessageList.vue b/dashboard/src/components/chat/ChatMessageList.vue
index e5f5a8cb1..cca0cb149 100644
--- a/dashboard/src/components/chat/ChatMessageList.vue
+++ b/dashboard/src/components/chat/ChatMessageList.vue
@@ -389,6 +389,7 @@
 <script setup lang="ts">
 import { computed, nextTick, reactive, ref } from "vue";
 import axios from "axios";
+import { fileApi } from "@/api/v1";
 import { setCustomComponents } from "markstream-vue";
 import "markstream-vue/index.css";
 import RegenerateMenu, {
@@ -693,12 +694,10 @@ function partUrl(part: MessagePart) {
   if (part.embedded_url) return part.embedded_url;
   if (part.embedded_file?.url) return part.embedded_file.url;
   if (part.attachment_id) {
-    return `/api/chat/get_attachment?attachment_id=${encodeURIComponent(
-      part.attachment_id,
-    )}`;
+    return fileApi.contentUrl(part.attachment_id);
   }
   if (part.filename) {
-    return `/api/chat/get_file?filename=${encodeURIComponent(part.filename)}`;
+    return fileApi.byNameUrl(part.filename);
   }
   return "";
 }
diff --git a/dashboard/src/components/chat/ConfigSelector.vue b/dashboard/src/components/chat/ConfigSelector.vue
index d53e3ed77..0eb9e9c20 100644
--- a/dashboard/src/components/chat/ConfigSelector.vue
+++ b/dashboard/src/components/chat/ConfigSelector.vue
@@ -74,7 +74,7 @@
 
 <script setup lang="ts">
 import { computed, onMounted, ref, watch } from 'vue';
-import axios from 'axios';
+import { configProfileApi, configRouteApi } from '@/api/v1';
 import { useToast } from '@/utils/toast';
 import { useModuleI18n } from '@/i18n/composables';
 import {
@@ -164,8 +164,11 @@ function closeDialog() {
 async function fetchConfigList() {
     loadingConfigs.value = true;
     try {
-        const res = await axios.get('/api/config/abconfs');
-        configOptions.value = res.data.data?.info_list || [];
+        const res = await configProfileApi.list();
+        configOptions.value = (res.data.data?.info_list || []).map((item: any) => ({
+            id: String(item.id || ''),
+            name: String(item.name || item.id || 'default')
+        }));
     } catch (error) {
         console.error('加载配置文件列表失败', error);
         configOptions.value = [];
@@ -176,7 +179,7 @@ async function fetchConfigList() {
 
 async function fetchRoutingEntries() {
     try {
-        const res = await axios.get('/api/config/umo_abconf_routes');
+        const res = await configRouteApi.list();
         const routing = res.data.data?.routing || {};
         routingEntries.value = Object.entries(routing).map(([pattern, confId]) => ({
             pattern,
@@ -214,10 +217,9 @@ async function getAgentRunnerType(confId: string): Promise<string> {
         return configCache.value[confId];
     }
     try {
-        const res = await axios.get('/api/config/abconf', {
-            params: { id: confId }
-        });
-        const type = res.data.data?.config?.provider_settings?.agent_runner_type || 'local';
+        const res = await configProfileApi.get(confId);
+        const config = ((res.data.data as any).config || {}) as any;
+        const type = config?.provider_settings?.agent_runner_type || 'local';
         configCache.value[confId] = type;
         return type;
     } catch (error) {
@@ -244,12 +246,11 @@ async function applySelectionToBackend(confId: string): Promise<boolean> {
     }
     saving.value = true;
     try {
-        await axios.post('/api/config/umo_abconf_route/update', {
-            umo: targetUmo.value,
-            conf_id: confId
-        });
+        await configRouteApi.upsert(targetUmo.value, { config_id: confId });
         const filtered = routingEntries.value.filter((entry) => entry.pattern !== targetUmo.value);
-        filtered.push({ pattern: targetUmo.value, confId });
+        if (confId !== 'default') {
+            filtered.push({ pattern: targetUmo.value, confId });
+        }
         routingEntries.value = filtered;
         return true;
     } catch (error) {
diff --git a/dashboard/src/components/chat/LiveMode.vue b/dashboard/src/components/chat/LiveMode.vue
index 2740459d9..654ffb49f 100644
--- a/dashboard/src/components/chat/LiveMode.vue
+++ b/dashboard/src/components/chat/LiveMode.vue
@@ -55,6 +55,7 @@
 <script setup lang="ts">
 import { ref, computed, onBeforeUnmount, watch } from 'vue';
 import { useTheme } from 'vuetify';
+import { chatApi } from '@/api/v1';
 import { useVADRecording } from '@/composables/useVADRecording';
 import SiriOrb from './LiveOrb.vue';
 
@@ -280,8 +281,7 @@ function connectWebSocket(): Promise<void> {
             return;
         }
 
-        const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
-        const wsUrl = `${protocol}//localhost:6185/api/live_chat/ws?token=${encodeURIComponent(token)}`;
+        const wsUrl = chatApi.liveWebSocketUrl(token);
 
         ws = new WebSocket(wsUrl);
 
diff --git a/dashboard/src/components/chat/MessageList.vue b/dashboard/src/components/chat/MessageList.vue
index 093b8b1c8..b75aa8b60 100644
--- a/dashboard/src/components/chat/MessageList.vue
+++ b/dashboard/src/components/chat/MessageList.vue
@@ -256,6 +256,7 @@
 <script setup lang="ts">
 import { computed, nextTick, reactive, ref } from "vue";
 import axios from "axios";
+import { fileApi } from "@/api/v1";
 import { setCustomComponents } from "markstream-vue";
 import "markstream-vue/index.css";
 import IPythonToolBlock from "@/components/chat/message_list_comps/IPythonToolBlock.vue";
@@ -347,12 +348,10 @@ function partUrl(part: MessagePart) {
   if (part.embedded_url) return part.embedded_url;
   if (part.embedded_file?.url) return part.embedded_file.url;
   if (part.attachment_id) {
-    return `/api/chat/get_attachment?attachment_id=${encodeURIComponent(
-      part.attachment_id,
-    )}`;
+    return fileApi.contentUrl(part.attachment_id);
   }
   if (part.filename) {
-    return `/api/chat/get_file?filename=${encodeURIComponent(part.filename)}`;
+    return fileApi.byNameUrl(part.filename);
   }
   return "";
 }
diff --git a/dashboard/src/components/chat/MessageListDEPRECATED.vue b/dashboard/src/components/chat/MessageListDEPRECATED.vue
index 1271042b3..bc9d44ee9 100644
--- a/dashboard/src/components/chat/MessageListDEPRECATED.vue
+++ b/dashboard/src/components/chat/MessageListDEPRECATED.vue
@@ -184,6 +184,7 @@ import { enableKatex, enableMermaid, MarkdownCodeBlockNode, setCustomComponents
 import 'markstream-vue/index.css'
 import 'katex/dist/katex.min.css'
 import axios from 'axios';
+import { fileApi } from '@/api/v1';
 import { useToast } from '@/utils/toast'
 import ReasoningBlock from './message_list_comps/ReasoningBlock.vue';
 import MessagePartsRenderer from './message_list_comps/MessagePartsRenderer.vue';
@@ -484,7 +485,7 @@ export default {
             this.downloadingFiles = new Set(this.downloadingFiles);
 
             try {
-                const response = await axios.get(`/api/chat/get_attachment?attachment_id=${file.attachment_id}`, {
+                const response = await axios.get(fileApi.contentUrl(file.attachment_id), {
                     responseType: 'blob'
                 });
 
diff --git a/dashboard/src/components/chat/ProviderModelMenu.vue b/dashboard/src/components/chat/ProviderModelMenu.vue
index e9a2f4f76..99117c28c 100644
--- a/dashboard/src/components/chat/ProviderModelMenu.vue
+++ b/dashboard/src/components/chat/ProviderModelMenu.vue
@@ -64,7 +64,7 @@
 
 <script setup lang="ts">
 import { ref, computed, onMounted } from 'vue';
-import axios from 'axios';
+import { providerApi } from '@/api/v1';
 
 interface ModelMetadata {
     modalities?: { input?: string[] };
@@ -110,12 +110,10 @@ function saveToStorage() {
 }
 
 function loadProviderConfigs() {
-    axios.get('/api/config/provider/list', {
-        params: { provider_type: 'chat_completion' }
-    }).then(response => {
+    providerApi.listByProviderType('chat_completion').then(response => {
         if (response.data.status === 'ok') {
             // 过滤掉 enable 为 false 的配置
-            providerConfigs.value = (response.data.data || []).filter(
+            providerConfigs.value = ((response.data.data || []) as unknown as ProviderConfig[]).filter(
                 (p: ProviderConfig) => p.enable !== false
             );
         }
diff --git a/dashboard/src/components/chat/RegenerateMenu.vue b/dashboard/src/components/chat/RegenerateMenu.vue
index 110794ca0..89e6f888c 100644
--- a/dashboard/src/components/chat/RegenerateMenu.vue
+++ b/dashboard/src/components/chat/RegenerateMenu.vue
@@ -103,7 +103,7 @@
 
 <script setup lang="ts">
 import { ref } from "vue";
-import axios from "axios";
+import { providerApi } from "@/api/v1";
 import StyledMenu from "@/components/shared/StyledMenu.vue";
 import { useModuleI18n } from "@/i18n/composables";
 
@@ -139,11 +139,9 @@ async function loadProviderConfigs(force = false) {
   if (loadingProviders.value || (providersLoaded.value && !force)) return;
   loadingProviders.value = true;
   try {
-    const response = await axios.get("/api/config/provider/list", {
-      params: { provider_type: "chat_completion" },
-    });
+    const response = await providerApi.listByProviderType("chat_completion");
     if (response.data.status === "ok") {
-      providerConfigs.value = (response.data.data || []).filter(
+      providerConfigs.value = ((response.data.data || []) as unknown as ProviderConfig[]).filter(
         (provider: ProviderConfig) => provider.enable !== false,
       );
       providersLoaded.value = true;
diff --git a/dashboard/src/components/chat/StandaloneChat.vue b/dashboard/src/components/chat/StandaloneChat.vue
index 988bc5f66..fd8956214 100644
--- a/dashboard/src/components/chat/StandaloneChat.vue
+++ b/dashboard/src/components/chat/StandaloneChat.vue
@@ -183,7 +183,7 @@ import {
   reactive,
   ref,
 } from "vue";
-import axios from "axios";
+import { chatApi, configRouteApi, fileApi } from "@/api/v1";
 import { setCustomComponents } from "markstream-vue";
 import "markstream-vue/index.css";
 import ChatInput from "@/components/chat/ChatInput.vue";
@@ -286,7 +286,7 @@ async function ensureSession() {
   if (currSessionId.value) return currSessionId.value;
   initializing.value = true;
   try {
-    const response = await axios.get("/api/chat/new_session");
+    const response = await chatApi.createSession();
     const session = response.data?.data as Session;
     currSessionId.value = session.session_id;
     currentSession.value = session;
@@ -300,10 +300,7 @@ async function ensureSession() {
 async function bindConfigToSession(sessionId: string) {
   const confId = props.configId || "default";
   const umo = buildWebchatUmoDetails(sessionId, false).umo;
-  await axios.post("/api/config/umo_abconf_route/update", {
-    umo,
-    conf_id: confId,
-  });
+  await configRouteApi.upsert(umo, { config_id: confId });
 }
 
 async function sendCurrentMessage() {
@@ -413,12 +410,8 @@ function messageRefs(message: ChatRecord) {
 function partUrl(part: MessagePart) {
   if (part.embedded_url) return part.embedded_url;
   if (part.embedded_file?.url) return part.embedded_file.url;
-  if (part.attachment_id)
-    return `/api/chat/get_attachment?attachment_id=${encodeURIComponent(
-      part.attachment_id,
-    )}`;
-  if (part.filename)
-    return `/api/chat/get_file?filename=${encodeURIComponent(part.filename)}`;
+  if (part.attachment_id) return fileApi.contentUrl(part.attachment_id);
+  if (part.filename) return fileApi.byNameUrl(part.filename);
   return "";
 }
 
diff --git a/dashboard/src/components/chat/ThreadPanel.vue b/dashboard/src/components/chat/ThreadPanel.vue
index bab1fe8d1..cd4af3811 100644
--- a/dashboard/src/components/chat/ThreadPanel.vue
+++ b/dashboard/src/components/chat/ThreadPanel.vue
@@ -56,7 +56,8 @@
 
 <script setup lang="ts">
 import { nextTick, ref, watch } from "vue";
-import axios from "axios";
+import { chatApi } from "@/api/v1";
+import { fetchWithAuth } from "@/api/http";
 import {
   appendPlain,
   appendReasoningPart,
@@ -110,9 +111,7 @@ function close() {
 
 async function loadThread(threadId: string) {
   try {
-    const response = await axios.get("/api/chat/thread/get", {
-      params: { thread_id: threadId },
-    });
+    const response = await chatApi.getThread(threadId);
     const history = response.data?.data?.history || [];
     messages.value = history.map(normalizeRecord);
     scrollToBottom();
@@ -153,14 +152,12 @@ async function send() {
   const abort = new AbortController();
   sending.value = true;
   try {
-    const response = await fetch("/api/chat/thread/send", {
+    const response = await fetchWithAuth(chatApi.sendThreadMessageUrl(props.thread.thread_id), {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        Authorization: `Bearer ${localStorage.getItem("token") || ""}`,
       },
       body: JSON.stringify({
-        thread_id: props.thread.thread_id,
         message: [{ type: "plain", text }],
         enable_streaming: true,
       }),
diff --git a/dashboard/src/components/extension/MarketPluginCard.vue b/dashboard/src/components/extension/MarketPluginCard.vue
index e62d423ca..78f837fb9 100644
--- a/dashboard/src/components/extension/MarketPluginCard.vue
+++ b/dashboard/src/components/extension/MarketPluginCard.vue
@@ -88,13 +88,13 @@ const handleOpen = () => {
             {{ tm("market.recommended") }}
           </v-chip>
           <v-chip
-            v-if="plugin?.astrbot_compatible === false"
+            v-if="plugin?.astrbot_version_supported === false"
             color="error"
             size="x-small"
             label
-            class="market-incompatible-chip"
+            class="market-unsupported-chip"
           >
-            {{ tm("status.incompatible") }}
+            {{ tm("status.unsupported") }}
           </v-chip>
         </div>
 
@@ -273,7 +273,7 @@ const handleOpen = () => {
   height: 20px;
 }
 
-.market-incompatible-chip {
+.market-unsupported-chip {
   flex-shrink: 0;
   font-weight: 700;
   height: 20px;
diff --git a/dashboard/src/components/extension/McpServersSection.vue b/dashboard/src/components/extension/McpServersSection.vue
index ae697b801..c687cd408 100644
--- a/dashboard/src/components/extension/McpServersSection.vue
+++ b/dashboard/src/components/extension/McpServersSection.vue
@@ -299,8 +299,8 @@
 </template>
 
 <script>
-import axios from 'axios';
 import { VueMonacoEditor } from '@guolao/vue-monaco-editor';
+import { mcpApi } from '@/api/v1';
 import { useI18n, useModuleI18n } from '@/i18n/composables';
 import OutlinedActionListItem from '@/components/shared/OutlinedActionListItem.vue';
 import {
@@ -402,7 +402,7 @@ export default {
     },
     getServers() {
       this.loadingGettingServers = true;
-      axios.get('/api/tools/mcp/servers')
+      mcpApi.list()
         .then(response => {
           if (response.data.status === 'error') {
             this.showError(response.data.message || this.tm('messages.getServersError', { error: 'Unknown error' }));
@@ -476,8 +476,10 @@ export default {
         if (this.isEditMode && this.originalServerName) {
           serverData.oldName = this.originalServerName;
         }
-        const endpoint = this.isEditMode ? '/api/tools/mcp/update' : '/api/tools/mcp/add';
-        axios.post(endpoint, serverData)
+        const request = this.isEditMode
+          ? mcpApi.update(this.originalServerName || serverData.name, serverData)
+          : mcpApi.create(serverData);
+        request
           .then(response => {
             this.loading = false;
             if (response.data.status === 'error') {
@@ -506,7 +508,7 @@ export default {
         return;
       }
 
-      axios.post('/api/tools/mcp/delete', { name: serverName })
+      mcpApi.delete(serverName)
         .then(response => {
           this.getServers();
           this.showSuccess(response.data.message || this.tm('messages.deleteSuccess'));
@@ -534,7 +536,7 @@ export default {
     updateServerStatus(server) {
       this.mcpServerUpdateLoaders[server.name] = true;
       server.active = !server.active;
-      axios.post('/api/tools/mcp/update', server)
+      mcpApi.setEnabled(server.name, server.active)
         .then(response => {
           this.getServers();
           this.showSuccess(response.data.message || this.tm('messages.updateSuccess'));
@@ -565,9 +567,7 @@ export default {
         this.showError(this.tm('dialogs.addServer.errors.jsonParse', { error: e.message }));
         return;
       }
-      axios.post('/api/tools/mcp/test', {
-        mcp_server_config: configObj
-      })
+      mcpApi.test(this.currentServer.name || 'draft', configObj)
         .then(response => {
           this.loading = false;
           this.addServerDialogMessage = `${response.data.message} (tools: ${response.data.data})`;
@@ -616,7 +616,9 @@ export default {
           }
           requestData.access_token = this.mcpProviderToken.trim();
         }
-        const response = await axios.post('/api/tools/mcp/sync-provider', requestData);
+        const response = await mcpApi.syncModelScope({
+          access_token: requestData.access_token || ''
+        });
         if (response.data.status === 'ok') {
           this.showSuccess(response.data.message || this.tm('syncProvider.messages.syncSuccess'));
           this.showSyncMcpServerDialog = false;
diff --git a/dashboard/src/components/extension/SkillsSection.vue b/dashboard/src/components/extension/SkillsSection.vue
index 2ad1bddff..62f0d3c4b 100644
--- a/dashboard/src/components/extension/SkillsSection.vue
+++ b/dashboard/src/components/extension/SkillsSection.vue
@@ -754,9 +754,9 @@
 </template>
 
 <script>
-import axios from "axios";
 import { computed, nextTick, onMounted, reactive, ref, watch } from "vue";
 import { VueMonacoEditor } from "@guolao/vue-monaco-editor";
+import { skillApi, systemConfigApi } from "@/api/v1";
 import { useI18n, useModuleI18n } from "@/i18n/composables";
 import OutlinedActionListItem from "@/components/shared/OutlinedActionListItem.vue";
 import { useCustomizerStore } from "@/stores/customizer";
@@ -1156,7 +1156,7 @@ export default {
     const fetchSkills = async () => {
       loading.value = true;
       try {
-        const res = await axios.get("/api/skills");
+        const res = await skillApi.list();
         skills.value = normalizeSkillsPayload(res);
       } catch (_err) {
         showMessage(tm("skills.loadFailed"), "error");
@@ -1200,9 +1200,7 @@ export default {
           formData.append("files", item.file);
         }
 
-        const res = await axios.post("/api/skills/batch-upload", formData, {
-          headers: { "Content-Type": "multipart/form-data" },
-        });
+        const res = await skillApi.uploadBatch(formData);
 
         const payload = res?.data?.data || {};
         applyUploadResults(attemptedItems, payload);
@@ -1246,10 +1244,7 @@ export default {
       const nextActive = !skill.active;
       itemLoading[skill.name] = true;
       try {
-        const res = await axios.post("/api/skills/update", {
-          name: skill.name,
-          active: nextActive,
-        });
+        const res = await skillApi.setEnabled(skill.name, nextActive);
         handleApiResponse(
           res,
           tm("skills.updateSuccess"),
@@ -1282,9 +1277,7 @@ export default {
       if (!skillToDelete.value) return;
       deleting.value = true;
       try {
-        const res = await axios.post("/api/skills/delete", {
-          name: skillToDelete.value.name,
-        });
+        const res = await skillApi.delete(skillToDelete.value.name);
         handleApiResponse(
           res,
           tm("skills.deleteSuccess"),
@@ -1312,10 +1305,7 @@ export default {
       }
       itemLoading[skill.name] = true;
       try {
-        const res = await axios.get("/api/skills/download", {
-          params: { name: skill.name },
-          responseType: "blob",
-        });
+        const res = await skillApi.download(skill.name);
         const blob = new Blob([res.data], { type: "application/zip" });
         const url = window.URL.createObjectURL(blob);
         const link = document.createElement("a");
@@ -1352,9 +1342,7 @@ export default {
       editorDialog.loadingFiles = true;
       editorDialog.error = "";
       try {
-        const res = await axios.get("/api/skills/files", {
-          params: { name: editorDialog.skillName, path },
-        });
+        const res = await skillApi.listFiles(editorDialog.skillName, path);
         if (res?.data?.status !== "ok") {
           editorDialog.error =
             res?.data?.message || tm("skills.editorLoadFailed");
@@ -1385,9 +1373,7 @@ export default {
       editorDialog.loadingFile = true;
       editorDialog.error = "";
       try {
-        const res = await axios.get("/api/skills/file", {
-          params: { name: editorDialog.skillName, path },
-        });
+        const res = await skillApi.getFile(editorDialog.skillName, path);
         if (res?.data?.status !== "ok") {
           editorDialog.error =
             res?.data?.message || tm("skills.editorLoadFailed");
@@ -1472,11 +1458,11 @@ export default {
       editorDialog.saving = true;
       editorDialog.error = "";
       try {
-        const res = await axios.post("/api/skills/file", {
-          name: editorDialog.skillName,
-          path: editorDialog.filePath,
-          content: editorDialog.content,
-        });
+        const res = await skillApi.updateFile(
+          editorDialog.skillName,
+          editorDialog.filePath,
+          editorDialog.content,
+        );
         if (res?.data?.status !== "ok") {
           editorDialog.error =
             res?.data?.message || tm("skills.editorSaveFailed");
@@ -1499,7 +1485,7 @@ export default {
         skill_key: neoFilters.skill_key || undefined,
         status: neoFilters.status || undefined,
       };
-      const res = await axios.get("/api/skills/neo/candidates", { params });
+      const res = await skillApi.neoCandidates(params);
       neoCandidates.value = normalizeNeoItemsPayload(res);
     };
 
@@ -1508,7 +1494,7 @@ export default {
         skill_key: neoFilters.skill_key || undefined,
         stage: neoFilters.stage || undefined,
       };
-      const res = await axios.get("/api/skills/neo/releases", { params });
+      const res = await skillApi.neoReleases(params);
       neoReleases.value = normalizeNeoItemsPayload(res).map((item) => {
         if (!item || typeof item !== "object") {
           return item;
@@ -1522,7 +1508,7 @@ export default {
 
     const loadNeoAvailability = async () => {
       try {
-        const res = await axios.get("/api/config/get");
+        const res = await systemConfigApi.get();
         const config = res?.data?.data?.config || {};
         const providerSettings = config?.provider_settings || {};
         const currentRuntime =
@@ -1553,7 +1539,7 @@ export default {
 
     const evaluateCandidate = async (candidate, passed) => {
       try {
-        const res = await axios.post("/api/skills/neo/evaluate", {
+        const res = await skillApi.evaluateNeoCandidate({
           candidate_id: candidate.id,
           passed,
           score: passed ? 1.0 : 0.0,
@@ -1587,7 +1573,7 @@ export default {
       if (candidatePromoteLoading[loadingKey]) return;
       candidatePromoteLoading[loadingKey] = true;
       try {
-        const res = await axios.post("/api/skills/neo/promote", {
+        const res = await skillApi.promoteNeoCandidate({
           candidate_id: candidateId,
           stage,
           sync_to_local: true,
@@ -1614,7 +1600,7 @@ export default {
 
     const rollbackRelease = async (release) => {
       try {
-        const res = await axios.post("/api/skills/neo/rollback", {
+        const res = await skillApi.rollbackNeoRelease({
           release_id: release.id,
         });
         handleApiResponse(
@@ -1632,7 +1618,7 @@ export default {
 
     const deactivateRelease = async (release) => {
       try {
-        const res = await axios.post("/api/skills/neo/rollback", {
+        const res = await skillApi.rollbackNeoRelease({
           release_id: release.id,
         });
         handleApiResponse(
@@ -1658,7 +1644,7 @@ export default {
 
     const syncRelease = async (release) => {
       try {
-        const res = await axios.post("/api/skills/neo/sync", {
+        const res = await skillApi.syncNeoRelease({
           release_id: release.id,
         });
         handleApiResponse(
@@ -1677,9 +1663,7 @@ export default {
     const viewPayload = async (payloadRef) => {
       if (!payloadRef) return;
       try {
-        const res = await axios.get("/api/skills/neo/payload", {
-          params: { payload_ref: payloadRef },
-        });
+        const res = await skillApi.neoPayload(payloadRef);
         if (res?.data?.status !== "ok") {
           showMessage(
             res?.data?.message || tm("skills.neoPayloadFailed"),
@@ -1697,7 +1681,7 @@ export default {
 
     const deleteCandidate = async (candidate) => {
       try {
-        const res = await axios.post("/api/skills/neo/delete-candidate", {
+        const res = await skillApi.deleteNeoCandidate({
           candidate_id: candidate.id,
           reason: "deleted_from_webui",
         });
@@ -1716,7 +1700,7 @@ export default {
 
     const deleteRelease = async (release) => {
       try {
-        const res = await axios.post("/api/skills/neo/delete-release", {
+        const res = await skillApi.deleteNeoRelease({
           release_id: release.id,
           reason: "deleted_from_webui",
         });
diff --git a/dashboard/src/components/extension/componentPanel/composables/useCommandActions.ts b/dashboard/src/components/extension/componentPanel/composables/useCommandActions.ts
index 6d04b43f6..607372c73 100644
--- a/dashboard/src/components/extension/componentPanel/composables/useCommandActions.ts
+++ b/dashboard/src/components/extension/componentPanel/composables/useCommandActions.ts
@@ -2,7 +2,7 @@
  * 指令操作方法 Composable
  */
 import { reactive } from 'vue';
-import axios from 'axios';
+import { commandApi } from '@/api/v1';
 import type { CommandItem, RenameDialogState, DetailsDialogState, TypeInfo, StatusInfo } from '../types';
 
 export function useCommandActions(
@@ -33,8 +33,7 @@ export function useCommandActions(
     errorMessage: string
   ) => {
     try {
-      const res = await axios.post('/api/commands/toggle', {
-        handler_full_name: cmd.handler_full_name,
+      const res = await commandApi.update(cmd.handler_full_name, {
         enabled: !cmd.enabled
       });
       if (res.data.status === 'ok') {
@@ -66,9 +65,8 @@ export function useCommandActions(
 
     renameDialog.loading = true;
     try {
-      const res = await axios.post('/api/commands/rename', {
-        handler_full_name: renameDialog.command.handler_full_name,
-        new_name: renameDialog.newName.trim(),
+      const res = await commandApi.update(renameDialog.command.handler_full_name, {
+        alias: renameDialog.newName.trim(),
         aliases: renameDialog.aliases.filter(a => a.trim())
       });
       if (res.data.status === 'ok') {
@@ -170,9 +168,8 @@ export function useCommandActions(
     errorMessage: string
   ) => {
     try {
-      const res = await axios.post('/api/commands/permission', {
-        handler_full_name: cmd.handler_full_name,
-        permission: permission
+      const res = await commandApi.update(cmd.handler_full_name, {
+        permission_group: permission
       });
       if (res.data.status === 'ok') {
         toast(successMessage, 'success');
@@ -203,4 +200,3 @@ export function useCommandActions(
     getRowProps
   };
 }
-
diff --git a/dashboard/src/components/extension/componentPanel/composables/useComponentData.ts b/dashboard/src/components/extension/componentPanel/composables/useComponentData.ts
index 853795950..588461b85 100644
--- a/dashboard/src/components/extension/componentPanel/composables/useComponentData.ts
+++ b/dashboard/src/components/extension/componentPanel/composables/useComponentData.ts
@@ -2,7 +2,7 @@
  * 指令数据管理 Composable
  */
 import { ref, reactive } from 'vue';
-import axios from 'axios';
+import { commandApi, toolApi } from '@/api/v1';
 import type { CommandItem, CommandSummary, SnackbarState, ToolItem } from '../types';
 
 export function useComponentData() {
@@ -36,7 +36,7 @@ export function useComponentData() {
   const fetchCommands = async (errorMessage: string) => {
     loading.value = true;
     try {
-      const res = await axios.get('/api/commands');
+      const res = await commandApi.list();
       if (res.data.status === 'ok') {
         commands.value = res.data.data.items || [];
         const s = res.data.data.summary || {};
@@ -55,7 +55,7 @@ export function useComponentData() {
   const fetchTools = async (errorMessage: string) => {
     toolsLoading.value = true;
     try {
-      const res = await axios.get('/api/tools/list');
+      const res = await toolApi.list();
       if (res.data.status === 'ok') {
         tools.value = res.data.data || [];
       } else {
diff --git a/dashboard/src/components/extension/componentPanel/composables/useToolActions.ts b/dashboard/src/components/extension/componentPanel/composables/useToolActions.ts
index f17c72f4f..ab07ed494 100644
--- a/dashboard/src/components/extension/componentPanel/composables/useToolActions.ts
+++ b/dashboard/src/components/extension/componentPanel/composables/useToolActions.ts
@@ -2,7 +2,7 @@
  * Tool actions composable
  */
 import { ref, computed, type Ref } from 'vue';
-import axios from 'axios';
+import { toolApi } from '@/api/v1';
 import { normalizeTextInput } from '@/utils/inputValue';
 import type { ToolItem, ToolSummary } from '../types';
 
@@ -59,10 +59,7 @@ export function useToolActions(
     const previous = tool.active;
     tool.active = !tool.active;
     try {
-      const res = await axios.post('/api/tools/toggle-tool', {
-        name: tool.name,
-        activate: tool.active,
-      });
+      const res = await toolApi.setEnabled(tool.name, tool.active);
       if (res.data.status === 'ok') {
         toast(res.data.message || successMessage);
       } else {
@@ -95,10 +92,7 @@ export function useToolActions(
       return;
     }
     try {
-      const res = await axios.post('/api/tools/permission', {
-        name: tool.name,
-        permission,
-      });
+      const res = await toolApi.setPermission(tool.name, permission);
       if (res.data.status === 'ok') {
         tool.permission = permission;
         tool.permission_configured = true;
diff --git a/dashboard/src/components/extension/componentPanel/index.vue b/dashboard/src/components/extension/componentPanel/index.vue
index 9ed734360..15d911a25 100644
--- a/dashboard/src/components/extension/componentPanel/index.vue
+++ b/dashboard/src/components/extension/componentPanel/index.vue
@@ -12,7 +12,7 @@
  * - components/RenameDialog.vue: 重命名对话框
  * - components/DetailsDialog.vue: 详情对话框
  */
-import { onActivated, onMounted, ref, watch} from 'vue';
+import { onMounted, ref, watch } from 'vue';
 import { useModuleI18n } from '@/i18n/composables';
 
 // Composables
diff --git a/dashboard/src/components/folder/README.md b/dashboard/src/components/folder/README.md
index cacf874c7..eb9fe030b 100644
--- a/dashboard/src/components/folder/README.md
+++ b/dashboard/src/components/folder/README.md
@@ -53,24 +53,24 @@ const {
 } = useFolderManager({
   operations: {
     loadFolderTree: async () => {
-      const response = await axios.get('/api/your-module/folder/tree');
+      const response = await pluginExtensionApi.get('your-module/folder/tree');
       return response.data.data;
     },
     loadSubFolders: async (parentId) => {
-      const response = await axios.get('/api/your-module/folder/list', {
+      const response = await pluginExtensionApi.get('your-module/folder/list', {
         params: { parent_id: parentId ?? '' }
       });
       return response.data.data;
     },
     createFolder: async (data) => {
-      const response = await axios.post('/api/your-module/folder/create', data);
+      const response = await pluginExtensionApi.post('your-module/folder/create', data);
       return response.data.data.folder;
     },
     updateFolder: async (data) => {
-      await axios.post('/api/your-module/folder/update', data);
+      await pluginExtensionApi.post('your-module/folder/update', data);
     },
     deleteFolder: async (folderId) => {
-      await axios.post('/api/your-module/folder/delete', { folder_id: folderId });
+      await pluginExtensionApi.post('your-module/folder/delete', { folder_id: folderId });
     },
   },
   rootFolderName: '根目录',
diff --git a/dashboard/src/components/platform/AddNewPlatform.vue b/dashboard/src/components/platform/AddNewPlatform.vue
index 1b57c2eac..ab361568a 100644
--- a/dashboard/src/components/platform/AddNewPlatform.vue
+++ b/dashboard/src/components/platform/AddNewPlatform.vue
@@ -726,7 +726,7 @@
 </template>
 
 <script>
-import axios from "axios";
+import { botApi, configProfileApi, configRouteApi, fileApi, sessionApi } from "@/api/v1";
 import { useModuleI18n } from "@/i18n/composables";
 import {
   getPlatformIcon,
@@ -1063,7 +1063,7 @@ export default {
       // Check for plugin-provided logo_token first
       const template = this.platformTemplates?.[platformType];
       if (template && template.logo_token) {
-        return `/api/file/${template.logo_token}`;
+        return fileApi.tokenUrl(template.logo_token);
       }
       return getPlatformIcon(platformType);
     },
@@ -1104,7 +1104,7 @@ export default {
       this.showDialog = false;
     },
     async getConfigInfoList() {
-      await axios.get("/api/config/abconfs").then((res) => {
+      await configProfileApi.list().then((res) => {
         this.configInfoList = res.data.data.info_list;
       });
     },
@@ -1119,9 +1119,7 @@ export default {
 
       this.configPreviewLoading = true;
       try {
-        const response = await axios.get("/api/config/abconf", {
-          params: { id: configId },
-        });
+        const response = await configProfileApi.get(configId);
 
         this.selectedConfigData = response.data.data.config;
         this.selectedConfigMetadata = response.data.data.metadata;
@@ -1138,7 +1136,7 @@ export default {
     async getDefaultConfigTemplate() {
       this.newConfigLoading = true;
       try {
-        const response = await axios.get("/api/config/default");
+        const response = await configProfileApi.schema();
         this.newConfigData = response.data.data.config;
         this.newConfigMetadata = response.data.data.metadata;
       } catch (error) {
@@ -1207,10 +1205,7 @@ export default {
 
       try {
         // 更新平台配置
-        let resp = await axios.post("/api/config/platform/update", {
-          id: id,
-          config: this.updatingPlatformConfig,
-        });
+        let resp = await botApi.update(id, this.updatingPlatformConfig);
 
         if (resp.data.status === "error") {
           throw new Error(
@@ -1265,10 +1260,7 @@ export default {
 
       try {
         // 先保存平台配置
-        const res = await axios.post(
-          "/api/config/platform/new",
-          this.selectedPlatformConfig,
-        );
+        const res = await botApi.create(this.selectedPlatformConfig);
 
         // 平台保存成功后，处理配置文件
         await this.handleConfigFile();
@@ -1316,10 +1308,7 @@ export default {
 
     async updateRoutingTable(umop, configId) {
       try {
-        await axios.post("/api/config/umo_abconf_route/update", {
-          umo: umop,
-          conf_id: configId,
-        });
+        await configRouteApi.upsert(umop, { config_id: configId });
 
         console.log(`成功更新路由表: ${umop} -> ${configId}`);
       } catch (err) {
@@ -1340,7 +1329,7 @@ export default {
             : undefined;
 
         // 创建新的配置文件（不传入umop）
-        const createRes = await axios.post("/api/config/abconf/new", {
+        const createRes = await configProfileApi.create({
           name: configName,
           config: configData, // 传入用户配置的数据
         });
@@ -1474,7 +1463,7 @@ export default {
 
       try {
         // 获取路由表 (UMOP -> conf_id)
-        const routesRes = await axios.get("/api/config/umo_abconf_routes");
+        const routesRes = await configRouteApi.list();
         const routingTable = routesRes.data.data.routing;
 
         // 过滤出属于该平台的路由，并保持顺序
@@ -1521,7 +1510,7 @@ export default {
 
       this.loadingKnownRouteUmos = true;
       try {
-        const res = await axios.get("/api/session/active-umos");
+        const res = await sessionApi.activeUmos();
         if (res.data.status === "ok") {
           const umos = Array.isArray(res.data.data?.umos)
             ? res.data.data.umos
@@ -1683,7 +1672,7 @@ export default {
 
       try {
         // 获取完整的路由表
-        const routesRes = await axios.get("/api/config/umo_abconf_routes");
+        const routesRes = await configRouteApi.list();
         const fullRoutingTable = routesRes.data.data.routing;
 
         // 删除该平台的所有旧路由
@@ -1710,8 +1699,8 @@ export default {
           }
         }
 
-        // 使用 update_all 更新整个路由表
-        await axios.post("/api/config/umo_abconf_route/update_all", {
+        // 使用 v1 replace 更新整个路由表
+        await configRouteApi.replace({
           routing: fullRoutingTable,
         });
       } catch (err) {
diff --git a/dashboard/src/components/platform/PlatformRegistrationAction.vue b/dashboard/src/components/platform/PlatformRegistrationAction.vue
index ba40ac60c..7fe6b16b5 100644
--- a/dashboard/src/components/platform/PlatformRegistrationAction.vue
+++ b/dashboard/src/components/platform/PlatformRegistrationAction.vue
@@ -44,7 +44,7 @@
 </template>
 
 <script>
-import axios from 'axios';
+import { botApi } from '@/api/v1';
 import { useModuleI18n } from '@/i18n/composables';
 import QrCodeViewer from '@/components/shared/QrCodeViewer.vue';
 
@@ -52,14 +52,12 @@ const FEISHU_DOMAIN = 'https://open.feishu.cn';
 
 const REGISTRATION_ACTIONS = {
   lark: {
-    endpoint: '/api/platform/registration/lark',
     icon: 'mdi-qrcode',
     titleKey: 'registrationAction.lark.title',
     scanTitleKey: 'registrationAction.lark.scanTitle',
     successKey: 'registrationAction.created',
   },
   weixin_oc: {
-    endpoint: '/api/platform/registration/weixin_oc',
     icon: 'mdi-qrcode',
     titleKey: 'registrationAction.weixinOc.title',
     scanTitleKey: 'registrationAction.weixinOc.scanTitle',
@@ -67,7 +65,6 @@ const REGISTRATION_ACTIONS = {
     statusKeyPrefix: 'registrationAction.weixinOc.status',
   },
   dingtalk: {
-    endpoint: '/api/platform/registration/dingtalk',
     icon: 'mdi-qrcode',
     titleKey: 'registrationAction.dingtalk.title',
     scanTitleKey: 'registrationAction.dingtalk.scanTitle',
@@ -164,7 +161,10 @@ export default {
       this.loading = true;
       this.flow = { status: 'starting' };
       try {
-        const res = await axios.post(this.action.endpoint, this.buildPayload('start'));
+        const res = await botApi.registration(
+          this.platformConfig.type,
+          this.buildPayload('start'),
+        );
         if (res.data.status !== 'ok') {
           throw new Error(res.data.message || this.tm('registrationAction.startFailed'));
         }
@@ -203,9 +203,12 @@ export default {
         return;
       }
       try {
-        const res = await axios.post(this.action.endpoint, this.buildPayload('poll', {
-          registration_code: this.flow.registration_code,
-        }));
+        const res = await botApi.registration(
+          this.platformConfig.type,
+          this.buildPayload('poll', {
+            registration_code: this.flow.registration_code,
+          }),
+        );
         if (res.data.status !== 'ok') {
           throw new Error(res.data.message || this.tm('registrationAction.pollFailed'));
         }
diff --git a/dashboard/src/components/shared/AstrBotConfig.vue b/dashboard/src/components/shared/AstrBotConfig.vue
index 87bed80e4..af6a1155a 100644
--- a/dashboard/src/components/shared/AstrBotConfig.vue
+++ b/dashboard/src/components/shared/AstrBotConfig.vue
@@ -5,8 +5,8 @@ import ConfigItemRenderer from './ConfigItemRenderer.vue'
 import TemplateListEditor from './TemplateListEditor.vue'
 import { useI18n, useModuleI18n } from '@/i18n/composables'
 import { useConfigTextResolver } from '@/composables/useConfigTextResolver'
-import axios from 'axios'
 import { useToast } from '@/utils/toast'
+import { providerApi } from '@/api/v1'
 
 const props = defineProps({
   metadata: {
@@ -109,9 +109,12 @@ async function getEmbeddingDimensions(providerConfig) {
   
   loadingEmbeddingDim.value = true
   try {
-    const response = await axios.post('/api/config/provider/get_embedding_dim', {
-      provider_config: providerConfig
-    })
+    const providerId = String(providerConfig?.id || '')
+    if (!providerId) {
+      useToast().error('缺少提供商 ID')
+      return
+    }
+    const response = await providerApi.embeddingDimension(providerId, providerConfig)
     
     if (response.data.status != "error" && response.data.data?.embedding_dimensions) {
       console.log(response.data.data.embedding_dimensions)
diff --git a/dashboard/src/components/shared/BackupDialog.vue b/dashboard/src/components/shared/BackupDialog.vue
index c69aa4464..975d862f3 100644
--- a/dashboard/src/components/shared/BackupDialog.vue
+++ b/dashboard/src/components/shared/BackupDialog.vue
@@ -368,7 +368,7 @@
 
 <script setup>
 import { ref, computed, watch } from 'vue'
-import axios from 'axios'
+import { backupApi } from '@/api/v1'
 import { useI18n } from '@/i18n/composables'
 import { askForConfirmation, useConfirmDialog } from '@/utils/confirmDialog'
 import { restartAstrBot as restartAstrBotRuntime } from '@/utils/restartAstrBot'
@@ -476,7 +476,7 @@ watch(activeTab, (newVal) => {
 const loadBackupList = async () => {
     loadingList.value = true
     try {
-        const response = await axios.get('/api/backup/list')
+        const response = await backupApi.list()
         if (response.data.status === 'ok') {
             backupList.value = response.data.data.items || []
         }
@@ -493,7 +493,7 @@ const startExport = async () => {
     exportProgress.value = { current: 0, total: 100, message: '' }
 
     try {
-        const response = await axios.post('/api/backup/export')
+        const response = await backupApi.create()
         if (response.data.status === 'ok') {
             exportTaskId.value = response.data.data.task_id
             pollExportProgress()
@@ -511,9 +511,7 @@ const pollExportProgress = async () => {
     if (!exportTaskId.value) return
 
     try {
-        const response = await axios.get('/api/backup/progress', {
-            params: { task_id: exportTaskId.value }
-        })
+        const response = await backupApi.progress(exportTaskId.value)
 
         if (response.data.status === 'ok') {
             const data = response.data.data
@@ -581,9 +579,7 @@ const uploadChunksInParallel = async (file, totalChunks, currentUploadId, curren
         formData.append('chunk_index', chunkIndex.toString())
         formData.append('chunk', chunk)
 
-        const response = await axios.post('/api/backup/upload/chunk', formData, {
-            headers: { 'Content-Type': 'multipart/form-data' }
-        })
+        const response = await backupApi.uploadChunk(formData)
 
         if (response.data.status !== 'ok') {
             throw new Error(response.data.message)
@@ -638,7 +634,7 @@ const uploadAndCheck = async () => {
         }
 
         // 步骤1: 初始化分片上传（后端计算并返回 chunk_size 和 total_chunks）
-        const initResponse = await axios.post('/api/backup/upload/init', {
+        const initResponse = await backupApi.initUpload({
             filename: file.name,
             total_size: file.size
         })
@@ -659,7 +655,7 @@ const uploadAndCheck = async () => {
         // 步骤3: 完成上传
         uploadProgress.value.message = t('features.settings.backup.import.uploadComplete')
 
-        const completeResponse = await axios.post('/api/backup/upload/complete', {
+        const completeResponse = await backupApi.completeUpload({
             upload_id: uploadId.value
         })
 
@@ -672,9 +668,7 @@ const uploadAndCheck = async () => {
         // 步骤4: 预检查
         uploadProgress.value.message = t('features.settings.backup.import.checking')
 
-        const checkResponse = await axios.post('/api/backup/check', {
-            filename: uploadedFilename.value
-        })
+        const checkResponse = await backupApi.check(uploadedFilename.value)
 
         if (checkResponse.data.status !== 'ok') {
             throw new Error(checkResponse.data.message)
@@ -696,7 +690,7 @@ const uploadAndCheck = async () => {
         // 上传失败时尝试清理已上传的分片
         if (uploadId.value) {
             try {
-                await axios.post('/api/backup/upload/abort', {
+                await backupApi.abortUpload({
                     upload_id: uploadId.value
                 })
             } catch (abortError) {
@@ -717,10 +711,7 @@ const confirmImport = async () => {
     importProgress.value = { current: 0, total: 100, message: '' }
 
     try {
-        const response = await axios.post('/api/backup/import', {
-            filename: uploadedFilename.value,
-            confirmed: true
-        })
+        const response = await backupApi.import(uploadedFilename.value, true)
 
         if (response.data.status === 'ok') {
             importTaskId.value = response.data.data.task_id
@@ -739,9 +730,7 @@ const pollImportProgress = async () => {
     if (!importTaskId.value) return
 
     try {
-        const response = await axios.get('/api/backup/progress', {
-            params: { task_id: importTaskId.value }
-        })
+        const response = await backupApi.progress(importTaskId.value)
 
         if (response.data.status === 'ok') {
             const data = response.data.data
@@ -773,7 +762,7 @@ const resetImport = async () => {
     // 如果有进行中的上传，先取消
     if (uploadId.value && importStatus.value === 'uploading') {
         try {
-            await axios.post('/api/backup/upload/abort', {
+            await backupApi.abortUpload({
                 upload_id: uploadId.value
             })
         } catch (error) {
@@ -803,7 +792,7 @@ const downloadBackup = (filename) => {
     }
     
     // 直接使用浏览器下载，这样可以看到原生下载进度条
-    const downloadUrl = `/api/backup/download?filename=${encodeURIComponent(filename)}&token=${encodeURIComponent(token)}`
+    const downloadUrl = backupApi.downloadUrl(filename, token)
     
     // 创建隐藏的 a 标签触发下载
     const link = document.createElement('a')
@@ -822,9 +811,7 @@ const restoreFromList = async (filename) => {
     
     // 预检查
     try {
-        const checkResponse = await axios.post('/api/backup/check', {
-            filename: filename
-        })
+        const checkResponse = await backupApi.check(filename)
 
         if (checkResponse.data.status !== 'ok') {
             throw new Error(checkResponse.data.message)
@@ -851,7 +838,7 @@ const deleteBackup = async (filename) => {
     if (!(await askForConfirmation(t('features.settings.backup.list.confirmDelete'), confirmDialog))) return
 
     try {
-        const response = await axios.post('/api/backup/delete', { filename })
+        const response = await backupApi.delete(filename)
         if (response.data.status === 'ok') {
             loadBackupList()
         } else {
@@ -906,8 +893,7 @@ const confirmRename = async () => {
     renameError.value = ''
 
     try {
-        const response = await axios.post('/api/backup/rename', {
-            filename: renameOldFilename.value,
+        const response = await backupApi.rename(renameOldFilename.value, {
             new_name: renameNewName.value
         })
 
diff --git a/dashboard/src/components/shared/ChangelogDialog.vue b/dashboard/src/components/shared/ChangelogDialog.vue
index 55971785d..4a89b7cf8 100644
--- a/dashboard/src/components/shared/ChangelogDialog.vue
+++ b/dashboard/src/components/shared/ChangelogDialog.vue
@@ -1,7 +1,7 @@
 <script setup>
 import { ref, watch, computed } from 'vue';
+import { changelogApi, statsApi } from '@/api/v1';
 import { useI18n } from '@/i18n/composables';
-import axios from 'axios';
 import { MarkdownRender, enableKatex, enableMermaid } from 'markstream-vue';
 import 'markstream-vue/index.css';
 import 'katex/dist/katex.min.css';
@@ -37,7 +37,7 @@ const scrollContainer = ref(null);
 // 获取当前版本号（从版本信息中提取）
 async function getCurrentVersion() {
   try {
-    const res = await axios.get('/api/stat/version');
+    const res = await statsApi.version();
     const version = res.data.data?.version || '';
     changelogVersion.value = version;
     selectedVersion.value = version;
@@ -61,9 +61,7 @@ async function loadChangelog(version) {
   changelogContent.value = '';
 
   try {
-    const res = await axios.get('/api/stat/changelog', {
-      params: { version: targetVersion }
-    });
+    const res = await changelogApi.get(targetVersion);
     
     if (res.data.status === 'ok') {
       changelogContent.value = res.data.data.content;
@@ -87,7 +85,7 @@ async function loadChangelog(version) {
 async function loadAvailableVersions() {
   loadingVersions.value = true;
   try {
-    const res = await axios.get('/api/stat/changelog/list');
+    const res = await changelogApi.listVersions();
     if (res.data.status === 'ok') {
       availableVersions.value = res.data.data.versions || [];
     }
diff --git a/dashboard/src/components/shared/ConsoleDisplayer.vue b/dashboard/src/components/shared/ConsoleDisplayer.vue
index 6c69ae66f..fac250c80 100644
--- a/dashboard/src/components/shared/ConsoleDisplayer.vue
+++ b/dashboard/src/components/shared/ConsoleDisplayer.vue
@@ -1,6 +1,6 @@
 <script setup>
 import { useCommonStore } from '@/stores/common';
-import axios from 'axios';
+import { logApi } from '@/api/v1';
 import { EventSourcePolyfill } from 'event-source-polyfill';
 </script>
 
@@ -114,7 +114,7 @@ export default {
       
       const token = localStorage.getItem('token');
 
-      this.eventSource = new EventSourcePolyfill('/api/live-log', {
+      this.eventSource = new EventSourcePolyfill(logApi.liveUrl(), {
         headers: {
             'Authorization': token ? `Bearer ${token}` : ''
         },
@@ -222,7 +222,7 @@ export default {
 
     async fetchLogHistory() {
       try {
-        const res = await axios.get('/api/log-history');
+        const res = await logApi.history();
         if (res.data.data.logs && res.data.data.logs.length > 0) {
           this.processNewLogs(res.data.data.logs);
         }
diff --git a/dashboard/src/components/shared/DashboardTotpManager.vue b/dashboard/src/components/shared/DashboardTotpManager.vue
index 682a68096..d7e1c6672 100644
--- a/dashboard/src/components/shared/DashboardTotpManager.vue
+++ b/dashboard/src/components/shared/DashboardTotpManager.vue
@@ -59,7 +59,7 @@ import { computed, ref } from 'vue'
 import DashboardTotpSetupDialog from './DashboardTotpSetupDialog.vue'
 import DashboardTotpRecoveryDialog from './DashboardTotpRecoveryDialog.vue'
 import DashboardTotpManageDialog from './DashboardTotpManageDialog.vue'
-import axios from 'axios'
+import { authApi } from '@/api/v1'
 import { useModuleI18n } from '@/i18n/composables'
 
 const props = defineProps({
@@ -150,7 +150,7 @@ async function onStartRotateRecovery() {
   manageDialogVisible.value = false
   if (!totpSecret.value) return
   try {
-    const res = await axios.post('/api/auth/totp/recovery')
+    const res = await authApi.recoverTotp()
     if (res.data.status !== 'ok') return
     const { recovery_code: recoveryCode, recovery_code_hash: recoveryCodeHash } = res.data.data || {}
     if (!recoveryCode || !recoveryCodeHash) return
diff --git a/dashboard/src/components/shared/DashboardTotpSetupDialog.vue b/dashboard/src/components/shared/DashboardTotpSetupDialog.vue
index 9a54c0c98..32a111e86 100644
--- a/dashboard/src/components/shared/DashboardTotpSetupDialog.vue
+++ b/dashboard/src/components/shared/DashboardTotpSetupDialog.vue
@@ -115,7 +115,7 @@
 
 <script setup>
 import { computed, ref, watch } from 'vue'
-import axios from 'axios'
+import { authApi } from '@/api/v1'
 import QrCodeViewer from './QrCodeViewer.vue'
 import { useModuleI18n } from '@/i18n/composables'
 
@@ -221,7 +221,7 @@ async function fetchNewSecret() {
   }
   loading.value = true
   try {
-    const res = await axios.post('/api/auth/totp/setup')
+    const res = await authApi.setupTotp()
     if (res.data.status !== 'ok') {
       return
     }
@@ -238,7 +238,7 @@ async function verifyIdentity() {
   verifyingIdentity.value = true
   verifyError.value = ''
   try {
-    const res = await axios.post('/api/auth/totp/setup', { code: verifyCode.value })
+    const res = await authApi.setupTotp({ code: verifyCode.value })
     if (res.data.status !== 'ok') {
       verifyError.value = res.data.message || '验证失败'
       return
@@ -257,7 +257,7 @@ async function confirmSetup() {
   verifying.value = true
   codeError.value = ''
   try {
-    const res = await axios.post('/api/auth/totp/setup', {
+    const res = await authApi.setupTotp({
       secret: newSecret.value,
       code: code.value,
     })
diff --git a/dashboard/src/components/shared/FileConfigItem.vue b/dashboard/src/components/shared/FileConfigItem.vue
index 71e232696..79eac0971 100644
--- a/dashboard/src/components/shared/FileConfigItem.vue
+++ b/dashboard/src/components/shared/FileConfigItem.vue
@@ -74,7 +74,7 @@
 
 <script setup>
 import { computed, ref, watch } from 'vue'
-import axios from 'axios'
+import { pluginApi } from '@/api/v1'
 import { useToast } from '@/utils/toast'
 import { useModuleI18n } from '@/i18n/composables'
 
@@ -192,10 +192,9 @@ const loadDirectoryFiles = async () => {
 
   loadingFiles.value = true
   try {
-    const response = await axios.get(
-      `/api/config/file/get?scope=plugin&name=${encodeURIComponent(
-        props.pluginName
-      )}&key=${encodeURIComponent(props.configKey)}`
+    const response = await pluginApi.listConfigFiles(
+      props.pluginName,
+      props.configKey
     )
     if (response.data.status === 'ok') {
       const files = response.data.data?.files || []
@@ -257,12 +256,10 @@ const uploadFiles = async (files) => {
       formData.append(`file${index}`, file)
     })
 
-    const response = await axios.post(
-      `/api/config/file/upload?scope=plugin&name=${encodeURIComponent(
-        props.pluginName
-      )}&key=${encodeURIComponent(props.configKey)}`,
-      formData,
-      { headers: { 'Content-Type': 'multipart/form-data' } }
+    const response = await pluginApi.uploadConfigFiles(
+      props.pluginName,
+      props.configKey,
+      formData
     )
 
     if (response.data.status === 'ok') {
@@ -309,13 +306,8 @@ const deleteFile = (filePath) => {
   directoryFiles.value = directoryFiles.value.filter((item) => item !== filePath)
 
   if (props.pluginName) {
-    axios
-      .post(
-        `/api/config/file/delete?scope=plugin&name=${encodeURIComponent(
-          props.pluginName
-        )}`,
-        { path: filePath }
-      )
+    pluginApi
+      .deleteConfigFile(props.pluginName, { path: filePath })
       .catch((error) => {
         console.warn('Staged file delete failed:', error)
         toast.warning(tm('fileUpload.deleteFailed'))
@@ -329,13 +321,8 @@ const deletePhysicalFile = (filePath) => {
   directoryFiles.value = directoryFiles.value.filter((item) => item !== filePath)
 
   if (props.pluginName) {
-    axios
-      .post(
-        `/api/config/file/delete?scope=plugin&name=${encodeURIComponent(
-          props.pluginName
-        )}`,
-        { path: filePath }
-      )
+    pluginApi
+      .deleteConfigFile(props.pluginName, { path: filePath })
       .catch((error) => {
         console.warn('File delete failed:', error)
         toast.warning(tm('fileUpload.deleteFailed'))
diff --git a/dashboard/src/components/shared/KnowledgeBaseSelector.vue b/dashboard/src/components/shared/KnowledgeBaseSelector.vue
index 43a2b6fc4..2a6b4d903 100644
--- a/dashboard/src/components/shared/KnowledgeBaseSelector.vue
+++ b/dashboard/src/components/shared/KnowledgeBaseSelector.vue
@@ -94,7 +94,7 @@
 
 <script setup>
 import { ref, watch } from 'vue'
-import axios from 'axios'
+import { knowledgeApi } from '@/api/v1'
 import { useRouter } from 'vue-router'
 import { useModuleI18n } from '@/i18n/composables'
 
@@ -136,11 +136,9 @@ async function openDialog() {
 async function loadKnowledgeBases() {
   loading.value = true
   try {
-    const response = await axios.get('/api/kb/list', {
-      params: {
-        page: 1,
-        page_size: 100
-      }
+    const response = await knowledgeApi.list({
+      page: 1,
+      page_size: 100
     })
     
     if (response.data.status === 'ok') {
diff --git a/dashboard/src/components/shared/MigrationDialog.vue b/dashboard/src/components/shared/MigrationDialog.vue
index 9716d8d1a..e324c3bd4 100644
--- a/dashboard/src/components/shared/MigrationDialog.vue
+++ b/dashboard/src/components/shared/MigrationDialog.vue
@@ -111,7 +111,7 @@
 
 <script setup>
 import { ref, computed, watch } from 'vue'
-import axios from 'axios'
+import { botApi, updatesApi } from '@/api/v1'
 import { useI18n } from '@/i18n/composables'
 import { restartAstrBot as restartAstrBotRuntime } from '@/utils/restartAstrBot'
 import ConsoleDisplayer from './ConsoleDisplayer.vue'
@@ -173,9 +173,9 @@ const loadPlatforms = async () => {
     error.value = ''
 
     try {
-        const response = await axios.get('/api/config/platform/list')
+        const response = await botApi.list()
         if (response.data.status === 'ok') {
-            platforms.value = response.data.data.platforms || []
+            platforms.value = response.data.data.bots || []
 
             // 为每个平台类型初始化默认选择（选择第一个）
             platformGroups.value.forEach(group => {
@@ -214,7 +214,7 @@ const handleMigration = async () => {
 
         console.log('Migration platform_id_map:', platformIdMap)
 
-        const response = await axios.post('/api/update/migration', {
+        const response = await updatesApi.runMigrations({
             platform_id_map: platformIdMap
         })
 
diff --git a/dashboard/src/components/shared/PersonaForm.vue b/dashboard/src/components/shared/PersonaForm.vue
index 95aa77f66..1b6a4a15e 100644
--- a/dashboard/src/components/shared/PersonaForm.vue
+++ b/dashboard/src/components/shared/PersonaForm.vue
@@ -359,7 +359,7 @@
 </template>
 
 <script>
-import axios from 'axios';
+import { mcpApi, personaApi, skillApi, toolApi } from '@/api/v1';
 import { useModuleI18n } from '@/i18n/composables';
 import {
     askForConfirmation as askForConfirmationDialog,
@@ -565,7 +565,7 @@ export default {
 
         async loadMcpServers() {
             try {
-                const response = await axios.get('/api/tools/mcp/servers');
+                const response = await mcpApi.list();
                 if (response.data.status === 'ok') {
                     this.mcpServers = response.data.data || [];
                 } else {
@@ -580,7 +580,7 @@ export default {
         async loadTools() {
             this.loadingTools = true;
             try {
-                const response = await axios.get('/api/tools/list');
+                const response = await toolApi.list();
                 if (response.data.status === 'ok') {
                     this.availableTools = response.data.data || [];
                 } else {
@@ -597,7 +597,7 @@ export default {
         async loadSkills() {
             this.loadingSkills = true;
             try {
-                const response = await axios.get('/api/skills');
+                const response = await skillApi.list();
                 if (response.data.status === 'ok') {
                     const payload = response.data.data || [];
                     if (Array.isArray(payload)) {
@@ -619,7 +619,7 @@ export default {
 
         async loadExistingPersonaIds() {
             try {
-                const response = await axios.get('/api/persona/list');
+                const response = await personaApi.list();
                 if (response.data.status === 'ok') {
                     this.existingPersonaIds = (response.data.data || []).map(p => p.persona_id);
                 }
@@ -645,8 +645,9 @@ export default {
 
             this.saving = true;
             try {
-                const url = this.editingPersona ? '/api/persona/update' : '/api/persona/create';
-                const response = await axios.post(url, this.personaForm);
+                const response = this.editingPersona
+                    ? await personaApi.update(this.personaForm.persona_id, this.personaForm)
+                    : await personaApi.create(this.personaForm);
 
                 if (response.data.status === 'ok') {
                     this.$emit('saved', response.data.message || this.tm('messages.saveSuccess'));
@@ -674,9 +675,7 @@ export default {
 
             this.saving = true;
             try {
-                const response = await axios.post('/api/persona/delete', {
-                    persona_id: this.editingPersona.persona_id
-                });
+                const response = await personaApi.delete(this.editingPersona.persona_id);
 
                 if (response.data.status === 'ok') {
                     this.$emit('deleted', response.data.message || this.tm('messages.deleteSuccess'));
diff --git a/dashboard/src/components/shared/PersonaQuickPreview.vue b/dashboard/src/components/shared/PersonaQuickPreview.vue
index a15ff84ec..3d1fb7b6f 100644
--- a/dashboard/src/components/shared/PersonaQuickPreview.vue
+++ b/dashboard/src/components/shared/PersonaQuickPreview.vue
@@ -91,7 +91,7 @@
 
 <script setup>
 import { computed, ref, watch, onMounted, onBeforeUnmount } from 'vue'
-import axios from 'axios'
+import { personaApi, skillApi, toolApi } from '@/api/v1'
 import { useModuleI18n } from '@/i18n/composables'
 
 const props = defineProps({
@@ -135,7 +135,7 @@ const resolvedTools = computed(() =>
 
 async function loadToolsMeta() {
   try {
-    const response = await axios.get('/api/tools/list')
+    const response = await toolApi.list()
     if (response.data?.status === 'ok') {
       const tools = response.data?.data || []
       const nextMap = {}
@@ -159,7 +159,7 @@ async function loadToolsMeta() {
 
 async function loadSkillsMeta() {
   try {
-    const response = await axios.get('/api/skills')
+    const response = await skillApi.list()
     if (response.data?.status === 'ok') {
       const payload = response.data?.data || []
       if (Array.isArray(payload)) {
@@ -190,7 +190,7 @@ async function loadPersonaPreview(personaId) {
 
   loading.value = true
   try {
-    const response = await axios.get('/api/persona/list')
+    const response = await personaApi.list()
     if (response.data?.status === 'ok') {
       const personas = response.data?.data || []
       personaData.value = personas.find((item) => item.persona_id === personaId) || null
diff --git a/dashboard/src/components/shared/PersonaSelector.vue b/dashboard/src/components/shared/PersonaSelector.vue
index 53eaf3bfd..a454d5279 100644
--- a/dashboard/src/components/shared/PersonaSelector.vue
+++ b/dashboard/src/components/shared/PersonaSelector.vue
@@ -31,7 +31,7 @@
 
 <script setup lang="ts">
 import { ref, computed, onMounted } from 'vue'
-import axios from 'axios'
+import { personaApi } from '@/api/v1'
 import BaseFolderItemSelector from '@/components/folder/BaseFolderItemSelector.vue'
 import PersonaForm from './PersonaForm.vue'
 import { useI18n, useModuleI18n } from '@/i18n/composables'
@@ -132,7 +132,7 @@ function handleUpdate(value: string) {
 async function loadFolderTree() {
   treeLoading.value = true
   try {
-    const response = await axios.get('/api/persona/folder/tree')
+    const response = await personaApi.tree()
     if (response.data.status === 'ok') {
       folderTree.value = response.data.data || []
     }
@@ -148,15 +148,7 @@ async function loadFolderTree() {
 async function loadPersonasInFolder(folderId: string | null) {
   itemsLoading.value = true
   try {
-    // 使用 /api/persona/list 端点，通过 folder_id 参数筛选
-    const params = new URLSearchParams()
-    if (folderId !== null) {
-      params.set('folder_id', folderId)
-    } else {
-      // 根目录：folder_id 为空字符串表示获取根目录下的人格
-      params.set('folder_id', '')
-    }
-    const response = await axios.get(`/api/persona/list?${params.toString()}`)
+    const response = await personaApi.list(folderId)
     if (response.data.status === 'ok') {
       currentPersonas.value = response.data.data || []
     }
diff --git a/dashboard/src/components/shared/PluginSetSelector.vue b/dashboard/src/components/shared/PluginSetSelector.vue
index 2eeda6db7..ac328abee 100644
--- a/dashboard/src/components/shared/PluginSetSelector.vue
+++ b/dashboard/src/components/shared/PluginSetSelector.vue
@@ -103,7 +103,7 @@
 
 <script setup>
 import { ref, computed, watch } from 'vue'
-import axios from 'axios'
+import { pluginApi } from '@/api/v1'
 import { useModuleI18n } from '@/i18n/composables'
 import { usePluginI18n } from '@/utils/pluginI18n'
 
@@ -170,7 +170,7 @@ async function openDialog() {
 async function loadPlugins() {
   loading.value = true
   try {
-    const response = await axios.get('/api/plugin/get')
+    const response = await pluginApi.list()
     if (response.data.status === 'ok') {
       // 只显示已激活且非系统的插件，并按名称排序
       pluginList.value = (response.data.data || [])
diff --git a/dashboard/src/components/shared/ProviderSelector.vue b/dashboard/src/components/shared/ProviderSelector.vue
index 104de3f54..9baed8ff1 100644
--- a/dashboard/src/components/shared/ProviderSelector.vue
+++ b/dashboard/src/components/shared/ProviderSelector.vue
@@ -179,7 +179,7 @@
 
 <script setup>
 import { computed, ref, watch } from 'vue'
-import axios from 'axios'
+import { providerApi } from '@/api/v1'
 import { useModuleI18n } from '@/i18n/composables'
 import ProviderChatCompletionPanel from '@/components/provider/ProviderChatCompletionPanel.vue'
 import ProviderPage from '@/views/ProviderPage.vue'
@@ -263,11 +263,7 @@ async function openDialog() {
 async function loadProviders() {
   loading.value = true
   try {
-    const response = await axios.get('/api/config/provider/list', {
-      params: {
-        provider_type: props.providerType
-      }
-    })
+    const response = await providerApi.listByProviderType(props.providerType)
     if (response.data.status === 'ok') {
       const providers = response.data.data || []
       providerList.value = props.providerSubtype
diff --git a/dashboard/src/components/shared/ProxySelector.vue b/dashboard/src/components/shared/ProxySelector.vue
index eeccf787f..b7f2af2c1 100644
--- a/dashboard/src/components/shared/ProxySelector.vue
+++ b/dashboard/src/components/shared/ProxySelector.vue
@@ -50,7 +50,7 @@
 
 
 <script>
-import axios from 'axios';
+import { statsApi } from '@/api/v1';
 import { useModuleI18n } from '@/i18n/composables';
 
 export default {
@@ -93,7 +93,7 @@ export default {
             const proxy = this.githubProxies[idx];
             
             try {
-                const response = await axios.post('/api/stat/test-ghproxy-connection', {
+                const response = await statsApi.testGhproxy({
                     proxy_url: proxy
                 });
                 console.log(response.data);
diff --git a/dashboard/src/components/shared/ReadmeDialog.vue b/dashboard/src/components/shared/ReadmeDialog.vue
index eb159f62e..326149bcc 100644
--- a/dashboard/src/components/shared/ReadmeDialog.vue
+++ b/dashboard/src/components/shared/ReadmeDialog.vue
@@ -2,8 +2,8 @@
 import { ref, watch, computed, onUnmounted } from "vue";
 import { useTheme } from "vuetify";
 import MarkdownIt from "markdown-it";
-import axios from "axios";
 import DOMPurify from "dompurify";
+import { pluginApi, statsApi } from "@/api/v1";
 import { useI18n } from "@/i18n/composables";
 import { copyToClipboard } from "@/utils/clipboard";
 import {
@@ -269,7 +269,6 @@ const modeConfig = computed(() => {
       loading: t("core.common.changelog.loading"),
       emptyTitle: t("core.common.changelog.empty.title"),
       emptySubtitle: t("core.common.changelog.empty.subtitle"),
-      apiPath: "/api/plugin/changelog",
       showGithubButton: false,
       showRefreshButton: true,
       refreshLabel: t("core.common.readme.buttons.refresh"),
@@ -282,7 +281,6 @@ const modeConfig = computed(() => {
       loading: t("core.common.firstNotice.loading"),
       emptyTitle: t("core.common.firstNotice.empty.title"),
       emptySubtitle: t("core.common.firstNotice.empty.subtitle"),
-      apiPath: "/api/stat/first-notice",
       showGithubButton: false,
       showRefreshButton: false,
       refreshLabel: "",
@@ -294,7 +292,6 @@ const modeConfig = computed(() => {
     loading: t("core.common.readme.loading"),
     emptyTitle: t("core.common.readme.empty.title"),
     emptySubtitle: t("core.common.readme.empty.subtitle"),
-    apiPath: "/api/plugin/readme",
     showGithubButton: true,
     showRefreshButton: true,
     refreshLabel: t("core.common.readme.buttons.refresh"),
@@ -314,13 +311,14 @@ async function fetchContent() {
   isEmpty.value = false;
 
   try {
-    let params;
-    if (requiresPluginName.value) {
-      params = { name: props.pluginName };
+    let res;
+    if (props.mode === "changelog") {
+      res = await pluginApi.changelog(props.pluginName);
+    } else if (props.mode === "readme") {
+      res = await pluginApi.readme(props.pluginName);
     } else if (props.mode === "first-notice") {
-      params = { locale: locale.value };
+      res = await statsApi.firstNotice(locale.value);
     }
-    const res = await axios.get(modeConfig.value.apiPath, { params });
     if (requestId !== lastRequestId.value) return;
 
     if (res.data.status === "ok") {
diff --git a/dashboard/src/components/shared/StorageCleanupPanel.vue b/dashboard/src/components/shared/StorageCleanupPanel.vue
index 84aeaeb05..eeb75f8ba 100644
--- a/dashboard/src/components/shared/StorageCleanupPanel.vue
+++ b/dashboard/src/components/shared/StorageCleanupPanel.vue
@@ -102,7 +102,7 @@
 
 <script setup>
 import { computed, onMounted, ref } from 'vue';
-import axios from 'axios';
+import { statsApi } from '@/api/v1';
 import { useModuleI18n } from '@/i18n/composables';
 import { useToastStore } from '@/stores/toast';
 import { askForConfirmation, useConfirmDialog } from '@/utils/confirmDialog';
@@ -182,7 +182,7 @@ const storageCards = computed(() => [
 const loadStorageStatus = async () => {
     statusLoading.value = true;
     try {
-        const res = await axios.get('/api/stat/storage');
+        const res = await statsApi.storage();
         if (res.data.status !== 'ok') {
             showToast(res.data.message || tm('system.cleanup.messages.statusFailed'), 'error');
             return;
@@ -204,7 +204,7 @@ const cleanupStorage = async (target) => {
 
     cleaningTarget.value = target;
     try {
-        const res = await axios.post('/api/stat/storage/cleanup', { target });
+        const res = await statsApi.cleanupStorage(target);
         if (res.data.status !== 'ok') {
             showToast(res.data.message || tm('system.cleanup.messages.cleanupFailed'), 'error');
             return;
diff --git a/dashboard/src/components/shared/T2ITemplateEditor.vue b/dashboard/src/components/shared/T2ITemplateEditor.vue
index 9d67699c3..02d2bebd1 100644
--- a/dashboard/src/components/shared/T2ITemplateEditor.vue
+++ b/dashboard/src/components/shared/T2ITemplateEditor.vue
@@ -244,7 +244,7 @@ import { ref, computed, nextTick, watch } from 'vue'
 import { VueMonacoEditor } from '@guolao/vue-monaco-editor'
 import { useI18n, useModuleI18n } from '@/i18n/composables'
 import { useToast } from '@/utils/toast'
-import axios from 'axios'
+import { statsApi, t2iApi } from '@/api/v1'
 
 const { t } = useI18n()
 const { tm } = useModuleI18n('core.shared')
@@ -288,7 +288,7 @@ const editorOptions = {
 const previewVersion = ref('v4.0.0')
 const syncPreviewVersion = async () => {
   try {
-    const res = await axios.get('/api/stat/version')
+    const res = await statsApi.version()
     const rawVersion = res?.data?.data?.version || res?.data?.version
     if (rawVersion) {
       previewVersion.value = rawVersion.startsWith('v') ? rawVersion : `v${rawVersion}`
@@ -363,16 +363,16 @@ const previewContent = computed(() => {
     let content = normalizeMarkdownSource(templateContent.value)
     content = content.replace(/\{\{\s*text\s*\|\s*safe\s*\}\}/g, () => previewData.value.text)
     content = content.replace(/\{\{\s*version\s*\}\}/g, () => previewData.value.version)
-    let usedLegacyShikiPlaceholder = false
+    let usedExistingShikiPlaceholder = false
     content = content.replace(/<script\b[^>]*>\s*\{\{\s*shiki_runtime\s*\|\s*safe\s*\}\}\s*<\/script>/gi, () => {
-      usedLegacyShikiPlaceholder = true
+      usedExistingShikiPlaceholder = true
       return getShikiRuntimeScript()
     })
     content = content.replace(/\{\{\s*shiki_runtime\s*\|\s*safe\s*\}\}/g, () => {
-      usedLegacyShikiPlaceholder = true
+      usedExistingShikiPlaceholder = true
       return getShikiRuntimeScript()
     })
-    return usedLegacyShikiPlaceholder ? content : injectShikiRuntime(content)
+    return usedExistingShikiPlaceholder ? content : injectShikiRuntime(content)
   } catch (error) {
     const errorMessage = error instanceof Error ? error.message : String(error)
     return `<div style="color: red; padding: 20px;">模板渲染错误: ${errorMessage}</div>`
@@ -384,8 +384,8 @@ const loadInitialData = async () => {
   loading.value = true
   try {
     const [listRes, activeRes] = await Promise.all([
-      axios.get('/api/t2i/templates'),
-      axios.get('/api/t2i/templates/active')
+      t2iApi.listTemplates(),
+      t2iApi.getActiveTemplate()
     ])
 
     if (listRes.data.status === 'ok') {
@@ -416,7 +416,7 @@ const loadTemplateContent = async (name) => {
   if (!name) return
   previewLoading.value = true
   try {
-    const response = await axios.get(`/api/t2i/templates/${name}`)
+    const response = await t2iApi.getTemplate(name)
     if (response.data.status === 'ok') {
       templateContent.value = response.data.data.content
     } else {
@@ -435,7 +435,7 @@ const saveTemplate = async () => {
     if (isCreatingNew.value) {
       // --- 创建新模板 ---
       if (!editingName.value) return
-      const response = await axios.post('/api/t2i/templates/create', {
+      const response = await t2iApi.createTemplate({
         name: editingName.value,
         content: templateContent.value
       })
@@ -445,9 +445,7 @@ const saveTemplate = async () => {
     } else {
       // --- 更新现有模板 ---
       if (!selectedTemplate.value) return
-      await axios.put(`/api/t2i/templates/${selectedTemplate.value}`, {
-        content: templateContent.value
-      })
+      await t2iApi.updateTemplate(selectedTemplate.value, templateContent.value)
     }
   } catch (error) {
     const msg = error?.response?.data?.message || error?.message || String(error)
@@ -461,7 +459,7 @@ const saveTemplate = async () => {
 const setActiveTemplate = async (name) => {
   applyLoading.value = true
   try {
-    await axios.post('/api/t2i/templates/set_active', { name })
+    await t2iApi.setActiveTemplate(name)
     activeTemplate.value = name
   } catch (error) {
     const msg = error?.response?.data?.message || error?.message || String(error)
@@ -477,7 +475,7 @@ const confirmDelete = async () => {
   saveLoading.value = true
   try {
     const nameToDelete = selectedTemplate.value
-    await axios.delete(`/api/t2i/templates/${nameToDelete}`)
+    await t2iApi.deleteTemplate(nameToDelete)
     deleteDialog.value = false
 
     // 如果删除的是当前活动模板，则将活动模板重置为base
@@ -498,7 +496,7 @@ const confirmDelete = async () => {
 const confirmReset = async () => {
   resetLoading.value = true
   try {
-    await axios.post('/api/t2i/templates/reset_default')
+    await t2iApi.resetDefaultTemplate()
     resetDialog.value = false
     if (selectedTemplate.value === 'base') {
       await loadTemplateContent('base')
diff --git a/dashboard/src/components/shared/TraceDisplayer.vue b/dashboard/src/components/shared/TraceDisplayer.vue
index 62c57ef47..8c35f0b55 100644
--- a/dashboard/src/components/shared/TraceDisplayer.vue
+++ b/dashboard/src/components/shared/TraceDisplayer.vue
@@ -1,5 +1,5 @@
 <script setup>
-import axios from 'axios';
+import { logApi } from '@/api/v1';
 import { EventSourcePolyfill } from 'event-source-polyfill';
 </script>
 
@@ -123,7 +123,7 @@ export default {
     },
     async fetchTraceHistory() {
       try {
-        const res = await axios.get('/api/log-history');
+        const res = await logApi.history();
         const logs = res.data?.data?.logs || [];
         const traces = logs.filter((item) => item.type === 'trace');
         this.processNewTraces(traces);
@@ -139,7 +139,7 @@ export default {
 
       const token = localStorage.getItem('token');
 
-      this.eventSource = new EventSourcePolyfill('/api/live-log', {
+      this.eventSource = new EventSourcePolyfill(logApi.liveUrl(), {
         headers: {
           Authorization: token ? `Bearer ${token}` : ''
         },
diff --git a/dashboard/src/components/shared/WaitingForRestart.vue b/dashboard/src/components/shared/WaitingForRestart.vue
index 41ce9ece2..229cfbe8c 100644
--- a/dashboard/src/components/shared/WaitingForRestart.vue
+++ b/dashboard/src/components/shared/WaitingForRestart.vue
@@ -10,7 +10,7 @@
 </template>
 
 <script>
-import axios from 'axios'
+import { statsApi } from '@/api/v1'
 import { useCommonStore } from '@/stores/common';
 import { useI18n } from '@/i18n/composables';
 
@@ -76,7 +76,7 @@ export default {
         },
         async checkStartTime() {
             try {
-                let res = await axios.get('/api/stat/start-time', { timeout: 3000 })
+                let res = await statsApi.startTime()
                 let newStartTime = res.data.data.start_time
                 console.log('wfr: checkStartTime', newStartTime, this.startTime)
                 if (this.startTime !== -1 && newStartTime !== this.startTime) {
diff --git a/dashboard/src/composables/useConversations.ts b/dashboard/src/composables/useConversations.ts
index cf86246c8..40e9ed3e5 100644
--- a/dashboard/src/composables/useConversations.ts
+++ b/dashboard/src/composables/useConversations.ts
@@ -1,6 +1,6 @@
 import { ref, computed } from 'vue';
-import axios from 'axios';
 import { useRouter } from 'vue-router';
+import { chatApi } from '@/api/v1';
 
 export interface Conversation {
     cid: string;
@@ -27,8 +27,12 @@ export function useConversations(chatboxMode: boolean = false) {
 
     async function getConversations() {
         try {
-            const response = await axios.get('/api/chat/conversations');
-            conversations.value = response.data.data;
+            const response = await chatApi.listSessions();
+            conversations.value = (response.data.data || []).map((session: any) => ({
+                cid: session.session_id,
+                title: session.display_name || session.session_id,
+                updated_at: Date.parse(session.updated_at || '') || 0,
+            }));
 
             // 处理待加载的会话
             if (pendingCid.value) {
@@ -52,8 +56,8 @@ export function useConversations(chatboxMode: boolean = false) {
 
     async function newConversation() {
         try {
-            const response = await axios.get('/api/chat/new_conversation');
-            const cid = response.data.data.conversation_id;
+            const response = await chatApi.createSession();
+            const cid = response.data.data.session_id;
             currCid.value = cid;
 
             // 更新 URL
@@ -70,7 +74,7 @@ export function useConversations(chatboxMode: boolean = false) {
 
     async function deleteConversation(cid: string) {
         try {
-            await axios.get('/api/chat/delete_conversation?conversation_id=' + cid);
+            await chatApi.deleteSession(cid);
             await getConversations();
             currCid.value = '';
             selectedConversations.value = [];
@@ -90,9 +94,8 @@ export function useConversations(chatboxMode: boolean = false) {
 
         const trimmedTitle = editingTitle.value.trim();
         try {
-            await axios.post('/api/chat/rename_conversation', {
-                conversation_id: editingCid.value,
-                title: trimmedTitle
+            await chatApi.updateSession(editingCid.value, {
+                display_name: trimmedTitle,
             });
 
             // 更新本地会话标题
diff --git a/dashboard/src/composables/useMediaHandling.ts b/dashboard/src/composables/useMediaHandling.ts
index 2b102f096..a3bd866c0 100644
--- a/dashboard/src/composables/useMediaHandling.ts
+++ b/dashboard/src/composables/useMediaHandling.ts
@@ -1,5 +1,5 @@
 import { ref, computed } from 'vue';
-import axios from 'axios';
+import { fileApi } from '@/api/v1';
 
 export interface StagedFileInfo {
     attachment_id: string;
@@ -41,10 +41,7 @@ export function useMediaHandling() {
         }
 
         try {
-            const response = await axios.get('/api/chat/get_file', {
-                params: { filename },
-                responseType: 'blob'
-            });
+            const response = await fileApi.getByName(filename);
 
             const blobUrl = URL.createObjectURL(response.data);
             mediaCache.value[filename] = blobUrl;
@@ -64,11 +61,7 @@ export function useMediaHandling() {
         formData.append('file', file);
 
         try {
-            const response = await axios.post('/api/chat/post_file', formData, {
-                headers: {
-                    'Content-Type': 'multipart/form-data'
-                }
-            });
+            const response = await fileApi.upload(formData);
 
             const { attachment_id, filename, type } = response.data.data;
             const stagedFile = {
diff --git a/dashboard/src/composables/useMessages.ts b/dashboard/src/composables/useMessages.ts
index 6f12aaae8..59d591af2 100644
--- a/dashboard/src/composables/useMessages.ts
+++ b/dashboard/src/composables/useMessages.ts
@@ -1,5 +1,6 @@
 import { computed, onBeforeUnmount, reactive, ref, type Ref } from "vue";
-import axios from "axios";
+import { chatApi, fileApi } from "@/api/v1";
+import { fetchWithAuth } from "@/api/http";
 
 export type TransportMode = "sse" | "websocket";
 
@@ -73,6 +74,10 @@ interface ActiveConnection {
   transport: TransportMode;
   abort?: AbortController;
   ws?: WebSocket;
+  botRecord?: ChatRecord;
+  userRecord?: ChatRecord;
+  completed?: boolean;
+  errorShown?: boolean;
 }
 
 interface SendMessageStreamOptions {
@@ -115,6 +120,8 @@ export function useMessages(options: UseMessagesOptions) {
   const messagesBySession = reactive<Record<string, ChatRecord[]>>({});
   const loadedSessions = reactive<Record<string, boolean>>({});
   const activeConnections = reactive<Record<string, ActiveConnection>>({});
+  const chatWebSockets: Record<string, WebSocket> = {};
+  const closingChatWebSockets = new WeakSet<WebSocket>();
   const attachmentBlobCache = new Map<string, Promise<string>>();
   const sessionProjects = reactive<Record<string, ChatSessionProject | null>>(
     {},
@@ -169,18 +176,25 @@ export function useMessages(options: UseMessagesOptions) {
     let cacheKey: string;
     if (part.attachment_id) {
       cacheKey = `att:${part.attachment_id}`;
-      url = `/api/chat/get_attachment?attachment_id=${encodeURIComponent(part.attachment_id)}`;
+      url = fileApi.contentUrl(part.attachment_id);
     } else if (part.filename) {
       cacheKey = `file:${part.filename}`;
-      url = `/api/chat/get_file?filename=${encodeURIComponent(part.filename)}`;
+      url = "";
     } else {
       return;
     }
     let promise = attachmentBlobCache.get(cacheKey);
     if (!promise) {
-      promise = axios
-        .get(url, { responseType: "blob" })
-        .then((resp) => URL.createObjectURL(resp.data));
+      if (part.filename) {
+        promise = fileApi
+          .getByName(part.filename)
+          .then((resp) => URL.createObjectURL(resp.data));
+      } else {
+        promise = fetchWithAuth(url).then(async (resp) => {
+          if (!resp.ok) throw new Error(`Media request failed: ${resp.status}`);
+          return URL.createObjectURL(await resp.blob());
+        });
+      }
       attachmentBlobCache.set(cacheKey, promise);
     }
     try {
@@ -208,9 +222,7 @@ export function useMessages(options: UseMessagesOptions) {
     if (!sessionId) return;
     loadingMessages.value = true;
     try {
-      const response = await axios.get("/api/chat/get_session", {
-        params: { session_id: sessionId },
-      });
+      const response = await chatApi.getSession(sessionId);
       const payload = response.data?.data || {};
       const history = payload.history || [];
       const records = history.map(normalizeHistoryRecord);
@@ -311,10 +323,8 @@ export function useMessages(options: UseMessagesOptions) {
   ) {
     if (!sessionId || record.id == null) return { needsRegenerate: false };
     const content = cloneContentWithEditedText(record, editedText);
-    const response = await axios.post("/api/chat/message/edit", {
-      session_id: sessionId,
-      message_id: record.id,
-      content,
+    const response = await chatApi.updateMessage(sessionId, record.id, {
+      content: content as unknown as Record<string, unknown>,
     });
     const payload = response.data?.data || {};
     const updated = payload.message ? normalizeHistoryRecord(payload.message) : null;
@@ -406,15 +416,12 @@ export function useMessages(options: UseMessagesOptions) {
     };
 
     try {
-      const response = await fetch("/api/chat/message/regenerate", {
+      const response = await fetchWithAuth(chatApi.regenerateMessageUrl(sessionId, targetMessageId), {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
-          Authorization: `Bearer ${localStorage.getItem("token") || ""}`,
         },
         body: JSON.stringify({
-          session_id: sessionId,
-          message_id: targetMessageId,
           selected_provider: selectedProvider,
           selected_model: selectedModel,
         }),
@@ -445,13 +452,19 @@ export function useMessages(options: UseMessagesOptions) {
 
   async function stopSession(sessionId: string) {
     if (!sessionId) return;
-    await axios.post("/api/chat/stop", { session_id: sessionId });
+    await chatApi.stopSession(sessionId);
   }
 
   function cleanupConnections() {
     Object.values(activeConnections).forEach((connection) => {
       connection.abort?.abort();
-      connection.ws?.close();
+    });
+    Object.values(chatWebSockets).forEach(closeTrackedWebSocket);
+    Object.keys(activeConnections).forEach((sessionId) => {
+      delete activeConnections[sessionId];
+    });
+    Object.keys(chatWebSockets).forEach((sessionId) => {
+      delete chatWebSockets[sessionId];
     });
   }
 
@@ -509,11 +522,10 @@ export function useMessages(options: UseMessagesOptions) {
       abort,
     };
 
-    fetch("/api/chat/send", {
+    fetchWithAuth(chatApi.sendStreamUrl(), {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        Authorization: `Bearer ${localStorage.getItem("token") || ""}`,
       },
       body: JSON.stringify({
         session_id: sessionId,
@@ -556,52 +568,155 @@ export function useMessages(options: UseMessagesOptions) {
     selectedProvider: string,
     selectedModel: string,
   ) {
-    const token = encodeURIComponent(localStorage.getItem("token") || "");
-    const protocol = window.location.protocol === "https:" ? "wss:" : "ws:";
-    const ws = new WebSocket(
-      `${protocol}//${window.location.host}/api/unified_chat/ws?token=${token}`,
-    );
+    const ws = getOrCreateChatWebSocket(sessionId);
 
     activeConnections[sessionId] = {
       sessionId,
       messageId,
       transport: "websocket",
       ws,
+      botRecord,
+      userRecord,
+      completed: false,
+      errorShown: false,
     };
 
-    ws.onopen = () => {
-      ws.send(
-        JSON.stringify({
-          ct: "chat",
-          t: "send",
-          session_id: sessionId,
-          message_id: messageId,
-          message: parts.map(partToPayload),
-          enable_streaming: enableStreaming,
-          selected_provider: selectedProvider,
-          selected_model: selectedModel,
-        }),
-      );
-    };
+    sendWebSocketPayload(sessionId, messageId, {
+      ct: "chat",
+      t: "send",
+      session_id: sessionId,
+      message_id: messageId,
+      message: parts.map(partToPayload),
+      enable_streaming: enableStreaming,
+      selected_provider: selectedProvider,
+      selected_model: selectedModel,
+    });
+  }
+
+  function getOrCreateChatWebSocket(sessionId: string) {
+    const existing = chatWebSockets[sessionId];
+    if (
+      existing &&
+      (existing.readyState === WebSocket.OPEN ||
+        existing.readyState === WebSocket.CONNECTING)
+    ) {
+      return existing;
+    }
+
+    const token = localStorage.getItem("token") || "";
+    const ws = new WebSocket(chatApi.unifiedWebSocketUrl(token));
+    chatWebSockets[sessionId] = ws;
+
     ws.onmessage = (event) => {
-      try {
-        const payload = JSON.parse(event.data);
-        processStreamPayload(botRecord, payload, userRecord);
-        options.onStreamUpdate?.(sessionId);
-        if (payload.type === "end" || payload.t === "end") {
-          ws.close();
-        }
-      } catch (error) {
-        console.error("Failed to parse WebSocket payload:", error);
-      }
+      handleWebSocketMessage(sessionId, event);
     };
     ws.onerror = () => {
-      appendPlain(botRecord, "\n\nWebSocket connection failed.");
+      const connection = activeConnections[sessionId];
+      if (connection?.transport === "websocket" && connection.botRecord) {
+        connection.errorShown = true;
+        appendPlain(connection.botRecord, "\n\nWebSocket connection failed.");
+      }
     };
     ws.onclose = async () => {
+      if (chatWebSockets[sessionId] === ws) {
+        delete chatWebSockets[sessionId];
+      }
+
+      const connection = activeConnections[sessionId];
+      if (connection?.transport !== "websocket" || connection.ws !== ws) {
+        return;
+      }
+      if (
+        !connection.completed &&
+        !connection.errorShown &&
+        !closingChatWebSockets.has(ws) &&
+        connection.botRecord
+      ) {
+        appendPlain(connection.botRecord, "\n\nWebSocket connection closed.");
+      }
       delete activeConnections[sessionId];
       await options.onSessionsChanged?.();
     };
+    return ws;
+  }
+
+  function sendWebSocketPayload(
+    sessionId: string,
+    messageId: string,
+    payload: Record<string, unknown>,
+  ) {
+    const ws = getOrCreateChatWebSocket(sessionId);
+    const send = () => {
+      const connection = activeConnections[sessionId];
+      if (
+        connection?.transport !== "websocket" ||
+        connection.messageId !== messageId ||
+        connection.ws !== ws
+      ) {
+        return;
+      }
+      try {
+        ws.send(JSON.stringify(payload));
+      } catch (error) {
+        connection.errorShown = true;
+        if (connection.botRecord) {
+          appendPlain(connection.botRecord, "\n\nWebSocket connection failed.");
+        }
+        console.error("Failed to send WebSocket payload:", error);
+        void finishWebSocketStream(sessionId, messageId);
+      }
+    };
+
+    if (ws.readyState === WebSocket.OPEN) {
+      send();
+      return;
+    }
+    if (ws.readyState === WebSocket.CONNECTING) {
+      ws.addEventListener("open", send, { once: true });
+      return;
+    }
+    void finishWebSocketStream(sessionId, messageId);
+  }
+
+  function handleWebSocketMessage(sessionId: string, event: MessageEvent) {
+    const connection = activeConnections[sessionId];
+    if (connection?.transport !== "websocket" || !connection.botRecord) {
+      return;
+    }
+
+    try {
+      const payload = JSON.parse(event.data);
+      processStreamPayload(connection.botRecord, payload, connection.userRecord);
+      options.onStreamUpdate?.(sessionId);
+      if (payload.type === "end" || payload.t === "end") {
+        void finishWebSocketStream(sessionId, connection.messageId);
+      }
+    } catch (error) {
+      console.error("Failed to parse WebSocket payload:", error);
+    }
+  }
+
+  async function finishWebSocketStream(sessionId: string, messageId: string) {
+    const connection = activeConnections[sessionId];
+    if (
+      connection?.transport !== "websocket" ||
+      connection.messageId !== messageId
+    ) {
+      return;
+    }
+    connection.completed = true;
+    delete activeConnections[sessionId];
+    await options.onSessionsChanged?.();
+  }
+
+  function closeTrackedWebSocket(ws: WebSocket) {
+    closingChatWebSockets.add(ws);
+    if (
+      ws.readyState === WebSocket.OPEN ||
+      ws.readyState === WebSocket.CONNECTING
+    ) {
+      ws.close();
+    }
   }
 
   function processStreamPayload(
@@ -771,36 +886,36 @@ function normalizeSessionProject(value: unknown): ChatSessionProject | null {
 
 export function normalizeMessageParts(
   parts: unknown,
-  legacyReasoning = "",
+  fallbackReasoning = "",
 ): MessagePart[] {
   const normalizedParts = normalizePartsInternal(parts);
-  if (legacyReasoning && !normalizedParts.some((part) => part.type === "think")) {
-    normalizedParts.unshift({ type: "think", think: legacyReasoning });
+  if (fallbackReasoning && !normalizedParts.some((part) => part.type === "think")) {
+    normalizedParts.unshift({ type: "think", think: fallbackReasoning });
   }
   return normalizedParts;
 }
 
 export function extractReasoningText(
   parts: MessagePart[] | unknown,
-  legacyReasoning = "",
+  fallbackReasoning = "",
 ) {
   const normalizedParts = Array.isArray(parts)
     ? parts
-    : normalizeMessageParts(parts, legacyReasoning);
+    : normalizeMessageParts(parts, fallbackReasoning);
   const text = normalizedParts
     .filter((part) => part.type === "think")
     .map((part) => String(part.think || ""))
     .join("");
-  return text || legacyReasoning;
+  return text || fallbackReasoning;
 }
 
 export function reasoningActivityCounts(
   parts: MessagePart[] | unknown,
-  legacyReasoning = "",
+  fallbackReasoning = "",
 ) {
   const normalizedParts = Array.isArray(parts)
     ? parts
-    : normalizeMessageParts(parts, legacyReasoning);
+    : normalizeMessageParts(parts, fallbackReasoning);
   let thinkCount = 0;
   let toolCount = 0;
 
diff --git a/dashboard/src/composables/usePluginSidebarItems.ts b/dashboard/src/composables/usePluginSidebarItems.ts
index 73006e5a9..af029d080 100644
--- a/dashboard/src/composables/usePluginSidebarItems.ts
+++ b/dashboard/src/composables/usePluginSidebarItems.ts
@@ -1,5 +1,5 @@
 import { reactive, shallowRef, onMounted, watch } from "vue";
-import axios from "axios";
+import { pluginApi } from "@/api/v1";
 import type { menu } from "@/layouts/full/vertical-sidebar/sidebarItem";
 
 const DEFAULT_ICON = "mdi-puzzle";
@@ -52,7 +52,7 @@ async function initPluginState() {
   if (initialFetched) return;
   initialFetched = true;
   try {
-    const res = await axios.get("/api/plugin/get");
+    const res = await pluginApi.list();
     if (res.data?.status === "ok") {
       pluginSidebarState.plugins = res.data.data ?? [];
     }
diff --git a/dashboard/src/composables/useProjects.ts b/dashboard/src/composables/useProjects.ts
index 13071ded4..c80221d12 100644
--- a/dashboard/src/composables/useProjects.ts
+++ b/dashboard/src/composables/useProjects.ts
@@ -1,5 +1,5 @@
 import { ref } from 'vue';
-import axios from 'axios';
+import { chatApi } from '@/api/v1';
 import type { Project } from '@/components/chat/ProjectList.vue';
 
 export function useProjects() {
@@ -8,7 +8,7 @@ export function useProjects() {
 
     async function getProjects() {
         try {
-            const res = await axios.get('/api/chatui_project/list');
+            const res = await chatApi.listProjects();
             if (res.data.status === 'ok') {
                 projects.value = res.data.data || [];
                 
@@ -20,7 +20,7 @@ export function useProjects() {
 
     async function createProject(title: string, emoji?: string, description?: string) {
         try {
-            const res = await axios.post('/api/chatui_project/create', {
+            const res = await chatApi.createProject({
                 title,
                 emoji: emoji || '📁',
                 description
@@ -36,8 +36,7 @@ export function useProjects() {
 
     async function updateProject(projectId: string, title?: string, emoji?: string, description?: string) {
         try {
-            const res = await axios.post('/api/chatui_project/update', {
-                project_id: projectId,
+            const res = await chatApi.updateProject(projectId, {
                 title,
                 emoji,
                 description
@@ -52,9 +51,7 @@ export function useProjects() {
 
     async function deleteProject(projectId: string) {
         try {
-            const res = await axios.get('/api/chatui_project/delete', { 
-                params: { project_id: projectId }
-            });
+            const res = await chatApi.deleteProject(projectId);
             if (res.data.status === 'ok') {
                 await getProjects();
                 if (selectedProjectId.value === projectId) {
@@ -68,10 +65,7 @@ export function useProjects() {
 
     async function addSessionToProject(sessionId: string, projectId: string) {
         try {
-            const res = await axios.post('/api/chatui_project/add_session', {
-                session_id: sessionId,
-                project_id: projectId
-            });
+            const res = await chatApi.addProjectSession(projectId, sessionId);
             return res.data.status === 'ok';
         } catch (error) {
             console.error('Failed to add session to project:', error);
@@ -81,9 +75,7 @@ export function useProjects() {
 
     async function removeSessionFromProject(sessionId: string) {
         try {
-            const res = await axios.post('/api/chatui_project/remove_session', {
-                session_id: sessionId
-            });
+            const res = await chatApi.removeProjectSession(sessionId);
             return res.data.status === 'ok';
         } catch (error) {
             console.error('Failed to remove session from project:', error);
@@ -93,9 +85,7 @@ export function useProjects() {
 
     async function getProjectSessions(projectId: string) {
         try {
-            const res = await axios.get('/api/chatui_project/get_sessions', { 
-                params: { project_id: projectId }
-            });
+            const res = await chatApi.listProjectSessions(projectId);
             if (res.data.status === 'ok') {
                 return res.data.data || [];
             }
diff --git a/dashboard/src/composables/useProviderModelConfigDialog.ts b/dashboard/src/composables/useProviderModelConfigDialog.ts
index 4d041423e..ef07917d1 100644
--- a/dashboard/src/composables/useProviderModelConfigDialog.ts
+++ b/dashboard/src/composables/useProviderModelConfigDialog.ts
@@ -1,5 +1,5 @@
 import { computed, ref, type Ref } from 'vue'
-import axios from 'axios'
+import { providerApi } from '@/api/v1'
 
 interface UseProviderModelConfigDialogOptions {
   selectedProviderSource: Ref<any | null>
@@ -90,15 +90,19 @@ export function useProviderModelConfigDialog(options: UseProviderModelConfigDial
     savingProviders.value.push(providerEditData.value.id)
     try {
       const isAdding = providerEditMode.value === 'add'
+      const sourceId = providerEditData.value.provider_source_id || selectedProviderSource.value?.id
+      if (isAdding && !sourceId) {
+        throw new Error(tm('providerSources.selectHint'))
+      }
       const res = isAdding
-        ? await axios.post('/api/config/provider/new', providerEditData.value)
-        : await axios.post('/api/config/provider/update', {
-          id: providerEditOriginalId.value || providerEditData.value.id,
-          config: providerEditData.value
-        })
+        ? await providerApi.createInSource(sourceId, providerEditData.value)
+        : await providerApi.update(
+          providerEditOriginalId.value || providerEditData.value.id,
+          providerEditData.value
+      )
 
       if (res.data.status === 'error') {
-        throw new Error(res.data.message)
+        throw new Error(res.data.message || tm('providerSources.saveError'))
       }
 
       showMessage(
diff --git a/dashboard/src/composables/useProviderSources.ts b/dashboard/src/composables/useProviderSources.ts
index e3113f182..b97c167e9 100644
--- a/dashboard/src/composables/useProviderSources.ts
+++ b/dashboard/src/composables/useProviderSources.ts
@@ -1,5 +1,5 @@
 import { ref, computed, onMounted, nextTick, watch } from 'vue'
-import axios from 'axios'
+import { providerApi } from '@/api/v1'
 import { getProviderIcon } from '@/utils/providerUtils'
 import { askForConfirmation as askForConfirmationDialog, useConfirmDialog } from '@/utils/confirmDialog'
 import { normalizeTextInput } from '@/utils/inputValue'
@@ -450,7 +450,7 @@ export function useProviderSources(options: UseProviderSourcesOptions) {
     if (!confirmed) return
 
     try {
-      await axios.post('/api/config/provider_sources/delete', { id: source.id })
+      await providerApi.deleteSource(source.id)
 
       providers.value = providers.value.filter((p) => p.provider_source_id !== source.id)
       providerSources.value = providerSources.value.filter((s) => s.id !== source.id)
@@ -473,15 +473,12 @@ export function useProviderSources(options: UseProviderSourcesOptions) {
     if (!selectedProviderSource.value) return
 
     savingSource.value = true
-    const originalId = selectedProviderSourceOriginalId.value || selectedProviderSource.value.id
+    const originalId = String(selectedProviderSourceOriginalId.value || selectedProviderSource.value.id || '')
     try {
-      const response = await axios.post('/api/config/provider_sources/update', {
-        config: editableProviderSource.value,
-        original_id: originalId
-      })
+      const response = await providerApi.upsertSource(originalId, editableProviderSource.value)
 
       if (response.data.status !== 'ok') {
-        throw new Error(response.data.message)
+        throw new Error(response.data.message || tm('providerSources.saveError'))
       }
 
       if (editableProviderSource.value!.id !== originalId) {
@@ -529,12 +526,10 @@ export function useProviderSources(options: UseProviderSourcesOptions) {
 
     loadingModels.value = true
     try {
-      const sourceId = editableProviderSource.value?.id || selectedProviderSource.value.id
-      const response = await axios.get('/api/config/provider_sources/models', {
-        params: { source_id: sourceId }
-      })
+      const sourceId = String(editableProviderSource.value?.id || selectedProviderSource.value.id || '')
+      const response = await providerApi.sourceModels(sourceId)
       if (response.data.status === 'ok') {
-        const metadataMap = response.data.data.model_metadata || {}
+        const metadataMap = (response.data.data.model_metadata || {}) as Record<string, any>
         modelMetadata.value = metadataMap
         availableModels.value = (response.data.data.models || []).map((model: string) => ({
           name: model,
@@ -544,7 +539,7 @@ export function useProviderSources(options: UseProviderSourcesOptions) {
           showMessage(tm('models.noModelsFound'), 'info')
         }
       } else {
-        throw new Error(response.data.message)
+        throw new Error(response.data.message || tm('models.fetchError'))
       }
     } catch (error: any) {
       modelMetadata.value = {}
@@ -600,9 +595,12 @@ export function useProviderSources(options: UseProviderSourcesOptions) {
     if (!newProvider) return
 
     try {
-      const res = await axios.post('/api/config/provider/new', newProvider)
+      const res = await providerApi.createInSource(
+        String(newProvider.provider_source_id),
+        newProvider
+      )
       if (res.data.status === 'error') {
-        throw new Error(res.data.message)
+        throw new Error(res.data.message || tm('providerSources.saveError'))
       }
       providers.value.push(newProvider)
       showMessage(res.data.message || tm('models.addSuccess', { model: modelName }))
@@ -622,7 +620,7 @@ export function useProviderSources(options: UseProviderSourcesOptions) {
     if (!confirmed) return
 
     try {
-      await axios.post('/api/config/provider/delete', { id: provider.id })
+      await providerApi.delete(String(provider.id))
       providers.value = providers.value.filter((p) => p.id !== provider.id)
       showMessage(tm('models.deleteSuccess'))
     } catch (error: any) {
@@ -639,15 +637,13 @@ export function useProviderSources(options: UseProviderSourcesOptions) {
 
     savingProviderToggles.value.push(provider.id)
     try {
-      const nextConfig = { ...provider, enable: Boolean(value) }
-      const response = await axios.post('/api/config/provider/update', {
-        id: provider.id,
-        config: nextConfig
+      const response = await providerApi.setEnabled(String(provider.id), {
+        enabled: Boolean(value)
       })
       if (response.data.status === 'error') {
-        throw new Error(response.data.message)
+        throw new Error(response.data.message || tm('providerSources.saveError'))
       }
-      provider.enable = nextConfig.enable
+      provider.enable = Boolean(value)
       showMessage(response.data.message || tm('messages.success.statusUpdate'))
       return true
     } catch (error: any) {
@@ -663,7 +659,7 @@ export function useProviderSources(options: UseProviderSourcesOptions) {
     testingProviders.value.push(provider.id)
     try {
       const startTime = performance.now()
-      const response = await axios.get('/api/config/provider/check_one', { params: { id: provider.id } })
+      const response = await providerApi.test(String(provider.id))
       if (response.data.status === 'ok' && response.data.data.error === null) {
         const latency = Math.max(0, Math.round(performance.now() - startTime))
         showMessage(tm('models.testSuccessWithLatency', { id: provider.id, latency }))
@@ -683,7 +679,7 @@ export function useProviderSources(options: UseProviderSourcesOptions) {
 
   async function loadProviderTemplate() {
     try {
-      const response = await axios.get('/api/config/provider/template')
+      const response = await providerApi.schema()
       if (response.data.status === 'ok') {
         configSchema.value = response.data.data.config_schema || {}
         if (configSchema.value.provider?.config_template) {
diff --git a/dashboard/src/composables/useSessions.ts b/dashboard/src/composables/useSessions.ts
index 382ddbc56..cb81586c6 100644
--- a/dashboard/src/composables/useSessions.ts
+++ b/dashboard/src/composables/useSessions.ts
@@ -1,6 +1,6 @@
 import { ref, computed } from 'vue';
-import axios from 'axios';
 import { useRouter } from 'vue-router';
+import { chatApi, configRouteApi } from '@/api/v1';
 import { buildWebchatUmoDetails, getStoredSelectedChatConfigId } from '@/utils/chatConfigBinding';
 
 export interface Session {
@@ -33,7 +33,7 @@ export function useSessions(chatboxMode: boolean = false) {
 
     async function getSessions() {
         try {
-            const response = await axios.get('/api/chat/sessions');
+            const response = await chatApi.listSessions();
             sessions.value = response.data.data;
 
 
@@ -50,7 +50,7 @@ export function useSessions(chatboxMode: boolean = false) {
     async function newSession() {
         try {
             const selectedConfigId = getStoredSelectedChatConfigId();
-            const response = await axios.get('/api/chat/new_session');
+            const response = await chatApi.createSession();
             const sessionId = response.data.data.session_id;
             const platformId = response.data.data.platform_id;
 
@@ -59,10 +59,7 @@ export function useSessions(chatboxMode: boolean = false) {
             if (selectedConfigId && selectedConfigId !== 'default' && platformId === 'webchat') {
                 try {
                     const umoDetails = buildWebchatUmoDetails(sessionId, false);
-                    await axios.post('/api/config/umo_abconf_route/update', {
-                        umo: umoDetails.umo,
-                        conf_id: selectedConfigId
-                    });
+                    await configRouteApi.upsert(umoDetails.umo, { config_id: selectedConfigId });
                 } catch (err) {
                     console.error('Failed to bind config to session', err);
                 }
@@ -86,7 +83,7 @@ export function useSessions(chatboxMode: boolean = false) {
 
     async function deleteSession(sessionId: string) {
         try {
-            await axios.get('/api/chat/delete_session?session_id=' + sessionId);
+            await chatApi.deleteSession(sessionId);
             await getSessions();
             currSessionId.value = '';
             selectedSessions.value = [];
@@ -126,7 +123,7 @@ export function useSessions(chatboxMode: boolean = false) {
     async function batchDeleteSessions(sessionIds: string[]): Promise<BatchDeleteResult> {
         try {
             const currentSessionId = currSessionId.value;
-            const response = await axios.post('/api/chat/batch_delete_sessions', { session_ids: sessionIds });
+            const response = await chatApi.batchDeleteSessions({ session_ids: sessionIds });
             if (response.data?.status !== 'ok') {
                 throw new Error(response.data?.message || 'Failed to batch delete sessions');
             }
@@ -173,9 +170,8 @@ export function useSessions(chatboxMode: boolean = false) {
 
         const trimmedTitle = editingTitle.value.trim();
         try {
-            await axios.post('/api/chat/update_session_display_name', {
-                session_id: editingSessionId.value,
-                display_name: trimmedTitle
+            await chatApi.updateSession(editingSessionId.value, {
+                display_name: trimmedTitle,
             });
 
             // 更新本地会话标题
diff --git a/dashboard/src/composables/useVADRecording.ts b/dashboard/src/composables/useVADRecording.ts
index 7a7998c68..8d545586c 100644
--- a/dashboard/src/composables/useVADRecording.ts
+++ b/dashboard/src/composables/useVADRecording.ts
@@ -13,7 +13,7 @@ interface VADOptions {
     preSpeechPadMs?: number;
     minSpeechMs?: number;
     submitUserSpeechOnPause?: boolean;
-    model?: 'v5' | 'legacy';
+    model?: 'v5' | string;
     baseAssetPath?: string;
     onnxWASMBasePath?: string;
 }
diff --git a/dashboard/src/i18n/locales/en-US/core/header.json b/dashboard/src/i18n/locales/en-US/core/header.json
index 082bdd7e1..a9d7f1141 100644
--- a/dashboard/src/i18n/locales/en-US/core/header.json
+++ b/dashboard/src/i18n/locales/en-US/core/header.json
@@ -97,8 +97,8 @@
   "accountDialog": {
     "title": "Modify Account",
     "securityWarning": "Security Reminder: Please change your password to secure your account",
-    "securityWarningLegacy": "The new AstrBot version has improved security. Please change your password.",
-    "securityWarningUpgrade": "Legacy password storage detected. Please change your password to complete the security upgrade.",
+    "securityWarningMd5": "The new AstrBot version has improved security. Please change your password.",
+    "securityWarningUpgrade": "MD5 password storage detected. Please change your password to complete the security upgrade.",
     "form": {
       "currentPassword": "Current Password",
       "newPassword": "New Password",
diff --git a/dashboard/src/i18n/locales/en-US/features/config-metadata.json b/dashboard/src/i18n/locales/en-US/features/config-metadata.json
index a79746c9d..2e8a786d1 100644
--- a/dashboard/src/i18n/locales/en-US/features/config-metadata.json
+++ b/dashboard/src/i18n/locales/en-US/features/config-metadata.json
@@ -613,7 +613,7 @@
       },
       "unified_webhook_mode": {
         "description": "Unified Webhook Mode",
-        "hint": "When enabled, use AstrBot unified webhook entry without opening a separate port. Callback URL is /api/platform/webhook/{webhook_uuid}."
+        "hint": "When enabled, use AstrBot unified webhook entry without opening a separate port. Callback URL is /api/v1/webhooks/platforms/{webhook_uuid}."
       },
       "webhook_uuid": {
         "description": "Webhook UUID",
@@ -1380,7 +1380,7 @@
         "description": "API Base URL"
       },
       "openai_embedding": {
-        "hint": "If testing fails, try adding /v1 at the end to be compatible with some OpenAI API versions."
+        "hint": "If testing fails, try adding /v1 at the end for some OpenAI API versions."
       },
       "gemini_embedding": {
         "hint": "Gemini Embedding does not require manually adding /v1beta."
diff --git a/dashboard/src/i18n/locales/en-US/features/extension.json b/dashboard/src/i18n/locales/en-US/features/extension.json
index 1b7ea6e40..1a10c9938 100644
--- a/dashboard/src/i18n/locales/en-US/features/extension.json
+++ b/dashboard/src/i18n/locales/en-US/features/extension.json
@@ -67,7 +67,7 @@
     "loading": "Loading...",
     "installed": "Installed",
     "unknown": "Unknown",
-    "incompatible": "Incompatible"
+    "unsupported": "Unsupported"
   },
   "tooltips": {
     "enable": "Click to Enable",
@@ -229,8 +229,8 @@
       "confirm": "Continue",
       "cancel": "Cancel"
     },
-    "versionCompatibility": {
-      "title": "Version Compatibility Warning",
+    "versionSupport": {
+      "title": "Version Support Warning",
       "message": "This plugin declares an AstrBot version range that does not match your current version. You can ignore this warning and continue installation, but it may not work correctly.",
       "confirm": "Ignore Warning and Install",
       "cancel": "Cancel Installation"
diff --git a/dashboard/src/i18n/locales/en-US/features/provider.json b/dashboard/src/i18n/locales/en-US/features/provider.json
index 4310e22dd..11832bfd8 100644
--- a/dashboard/src/i18n/locales/en-US/features/provider.json
+++ b/dashboard/src/i18n/locales/en-US/features/provider.json
@@ -20,8 +20,8 @@
       "typed": "No {type} type service providers available, click Add Provider to add one"
     },
     "description": {
-      "openai": "Supports all OpenAI API compatible providers.",
-      "kimi_code": "Dedicated Kimi CodingPlan / Kimi Code integration using a custom Anthropic API compatibility layer.",
+      "openai": "Supports all OpenAI API-style providers.",
+      "kimi_code": "Dedicated Kimi CodingPlan / Kimi Code integration using a custom Anthropic API adapter.",
       "default": ""
     }
   },
diff --git a/dashboard/src/i18n/locales/en-US/features/settings.json b/dashboard/src/i18n/locales/en-US/features/settings.json
index c561e9d8c..378e2d767 100644
--- a/dashboard/src/i18n/locales/en-US/features/settings.json
+++ b/dashboard/src/i18n/locales/en-US/features/settings.json
@@ -35,7 +35,7 @@
     },
     "migration": {
       "title": "Data Migration to v4.0.0",
-      "subtitle": "If you encounter data compatibility issues, you can manually start the database migration assistant",
+      "subtitle": "If you encounter data migration issues, you can manually start the database migration assistant",
       "button": "Start Migration Assistant"
     },
     "backup": {
@@ -142,7 +142,7 @@
         "matchTitle": "✅ Version Match",
         "matchMessage": "Import will clear and overwrite all existing data, including:\n• Main database (conversations, settings, etc.)\n• Knowledge bases\n• Plugins and plugin data\n• Configuration files\n• Skills\n\nThis action cannot be undone! Do you want to continue?",
         "minorDiffTitle": "⚠️ Version Difference Warning",
-        "minorDiffMessage": "Minor version differences are usually compatible, but there may be some data structure changes.\nImport will clear and overwrite all existing data!\n\nDo you want to continue?",
+        "minorDiffMessage": "Minor version differences can usually be imported, but there may be some data structure changes.\nImport will clear and overwrite all existing data!\n\nDo you want to continue?",
         "majorDiffTitle": "⛔ Cannot Import",
         "majorDiffMessage": "Major version numbers are different. Cross-major-version import may cause data corruption.\nPlease use the same major version of AstrBot for import."
       }
diff --git a/dashboard/src/i18n/locales/ru-RU/core/header.json b/dashboard/src/i18n/locales/ru-RU/core/header.json
index a851897df..5e676272c 100644
--- a/dashboard/src/i18n/locales/ru-RU/core/header.json
+++ b/dashboard/src/i18n/locales/ru-RU/core/header.json
@@ -97,7 +97,7 @@
   "accountDialog": {
     "title": "Изменить аккаунт",
     "securityWarning": "Безопасность: Пожалуйста, смените пароль для защиты аккаунта",
-    "securityWarningLegacy": "Новая версия AstrBot улучшила безопасность. Пожалуйста, измените пароль.",
+        "securityWarningMd5": "Новая версия AstrBot улучшила безопасность. Пожалуйста, измените пароль.",
     "securityWarningUpgrade": "Обнаружено устаревшее хранение пароля. Измените пароль, чтобы завершить обновление безопасности.",
     "form": {
       "currentPassword": "Текущий пароль",
diff --git a/dashboard/src/i18n/locales/ru-RU/features/config-metadata.json b/dashboard/src/i18n/locales/ru-RU/features/config-metadata.json
index b08662b7b..6f79726b3 100644
--- a/dashboard/src/i18n/locales/ru-RU/features/config-metadata.json
+++ b/dashboard/src/i18n/locales/ru-RU/features/config-metadata.json
@@ -609,7 +609,7 @@
             },
             "unified_webhook_mode": {
                 "description": "Единый режим Webhook",
-                "hint": "Использовать общий вход вебхуков AstrBot без открытия новых портов. URL: /api/platform/webhook/{uuid}."
+                "hint": "Использовать общий вход вебхуков AstrBot без открытия новых портов. URL: /api/v1/webhooks/platforms/{uuid}."
             },
             "webhook_uuid": {
                 "description": "UUID вебхука",
diff --git a/dashboard/src/i18n/locales/ru-RU/features/extension.json b/dashboard/src/i18n/locales/ru-RU/features/extension.json
index 237421248..ca1547ee9 100644
--- a/dashboard/src/i18n/locales/ru-RU/features/extension.json
+++ b/dashboard/src/i18n/locales/ru-RU/features/extension.json
@@ -67,7 +67,7 @@
         "loading": "Загрузка...",
         "installed": "Установлен",
         "unknown": "Неизвестно",
-        "incompatible": "Несовместимо"
+        "unsupported": "Не поддерживается"
     },
     "tooltips": {
         "enable": "Включить",
@@ -228,7 +228,7 @@
             "confirm": "Продолжить",
             "cancel": "Отмена"
         },
-        "versionCompatibility": {
+        "versionSupport": {
             "title": "Предупреждение о версии",
             "message": "Требуемая плагином версия AstrBot не совпадает с вашей текущей версией. Вы можете продолжить установку на свой страх и риск.",
             "confirm": "Игнорировать и установить",
diff --git a/dashboard/src/i18n/locales/zh-CN/core/header.json b/dashboard/src/i18n/locales/zh-CN/core/header.json
index 611213b78..4241ee9bc 100644
--- a/dashboard/src/i18n/locales/zh-CN/core/header.json
+++ b/dashboard/src/i18n/locales/zh-CN/core/header.json
@@ -97,7 +97,7 @@
   "accountDialog": {
     "title": "修改账户",
     "securityWarning": "安全提醒: 请修改密码以确保账户安全",
-    "securityWarningLegacy": "新的 AstrBot 版本强化了安全策略，请重新修改密码",
+    "securityWarningMd5": "新的 AstrBot 版本强化了安全策略，请重新修改密码",
     "securityWarningUpgrade": "检测到旧版本密码存储方式，请修改密码以完成安全升级",
     "form": {
       "currentPassword": "当前密码",
diff --git a/dashboard/src/i18n/locales/zh-CN/features/config-metadata.json b/dashboard/src/i18n/locales/zh-CN/features/config-metadata.json
index 75ce4fd93..c73fcae2d 100644
--- a/dashboard/src/i18n/locales/zh-CN/features/config-metadata.json
+++ b/dashboard/src/i18n/locales/zh-CN/features/config-metadata.json
@@ -615,7 +615,7 @@
       },
       "unified_webhook_mode": {
         "description": "统一 Webhook 模式",
-        "hint": "Webhook 模式下使用 AstrBot 统一 Webhook 入口，无需单独开启端口。回调地址为 /api/platform/webhook/{webhook_uuid}。"
+        "hint": "Webhook 模式下使用 AstrBot 统一 Webhook 入口，无需单独开启端口。回调地址为 /api/v1/webhooks/platforms/{webhook_uuid}。"
       },
       "webhook_uuid": {
         "description": "Webhook UUID",
diff --git a/dashboard/src/i18n/locales/zh-CN/features/extension.json b/dashboard/src/i18n/locales/zh-CN/features/extension.json
index 17a33fed8..05ee07028 100644
--- a/dashboard/src/i18n/locales/zh-CN/features/extension.json
+++ b/dashboard/src/i18n/locales/zh-CN/features/extension.json
@@ -67,7 +67,7 @@
     "loading": "加载中...",
     "installed": "已安装",
     "unknown": "未知",
-    "incompatible": "不兼容"
+    "unsupported": "不支持"
   },
   "tooltips": {
     "enable": "点击启用",
@@ -229,7 +229,7 @@
       "confirm": "继续",
       "cancel": "取消"
     },
-    "versionCompatibility": {
+    "versionSupport": {
       "title": "版本兼容性警告",
       "message": "该插件声明的 AstrBot 版本范围与当前版本不匹配。你可以无视警告继续安装，但可能无法正常运行。",
       "confirm": "无视警告，继续安装",
diff --git a/dashboard/src/layouts/full/FullLayout.vue b/dashboard/src/layouts/full/FullLayout.vue
index f23cc8a89..9340f6a18 100644
--- a/dashboard/src/layouts/full/FullLayout.vue
+++ b/dashboard/src/layouts/full/FullLayout.vue
@@ -1,7 +1,6 @@
 <script setup lang="ts">
 import { RouterView, useRoute } from "vue-router";
 import { ref, onMounted, computed, watch } from "vue";
-import axios from "axios";
 import VerticalSidebarVue from "./vertical-sidebar/VerticalSidebar.vue";
 import VerticalHeaderVue from "./vertical-header/VerticalHeader.vue";
 import MigrationDialog from "@/components/shared/MigrationDialog.vue";
@@ -10,6 +9,7 @@ import Chat from "@/components/chat/Chat.vue";
 import { useCustomizerStore } from "@/stores/customizer";
 import { useRouterLoadingStore } from "@/stores/routerLoading";
 import { useCommonStore } from "@/stores/common";
+import { statsApi } from "@/api/v1";
 import { useI18n } from "@/i18n/composables";
 
 const FIRST_NOTICE_SEEN_KEY = "astrbot:first_notice_seen:v1";
@@ -43,7 +43,7 @@ watch(isCurrentChatRoute, (isChatRoute) => {
 
 const checkMigration = async (): Promise<boolean> => {
   try {
-    const response = await axios.get("/api/stat/version");
+    const response = await statsApi.version();
     if (response.data.status === "ok") {
       commonStore.setAstrBotVersion(
         response.data.data?.version,
@@ -75,9 +75,7 @@ const maybeShowFirstNotice = async () => {
   }
 
   try {
-    const response = await axios.get("/api/stat/first-notice", {
-      params: { locale: locale.value },
-    });
+    const response = await statsApi.firstNotice(locale.value);
     if (response.data.status !== "ok") {
       return;
     }
diff --git a/dashboard/src/layouts/full/vertical-header/VerticalHeader.vue b/dashboard/src/layouts/full/vertical-header/VerticalHeader.vue
index c34f2c426..27aa182fd 100644
--- a/dashboard/src/layouts/full/vertical-header/VerticalHeader.vue
+++ b/dashboard/src/layouts/full/vertical-header/VerticalHeader.vue
@@ -17,6 +17,7 @@ import StyledMenu from "@/components/shared/StyledMenu.vue";
 import { useLanguageSwitcher } from "@/i18n/composables";
 import type { Locale } from "@/i18n/types";
 import AboutPage from "@/views/AboutPage.vue";
+import { authApi, statsApi, updatesApi } from "@/api/v1";
 import { getDesktopRuntimeInfo } from "@/utils/desktopRuntime";
 
 enableKatex();
@@ -31,7 +32,7 @@ const LAST_BOT_ROUTE_KEY = "astrbot:last_bot_route";
 const LAST_CHAT_ROUTE_KEY = "astrbot:last_chat_route";
 let dialog = ref(false);
 let accountWarning = ref(false);
-let accountWarningLegacy = ref(false);
+let accountWarningMd5 = ref(false);
 let accountWarningUpgrade = ref(false);
 let updateStatusDialog = ref(false);
 let aboutDialog = ref(false);
@@ -47,7 +48,7 @@ let hasNewVersion = ref(false);
 let botCurrVersion = ref("");
 let dashboardHasNewVersion = ref(false);
 let dashboardCurrentVersion = ref("");
-let releases = ref([]);
+let releases = ref<any[]>([]);
 let releasesLoading = ref(false);
 let updatingDashboardLoading = ref(false);
 let installLoading = ref(false);
@@ -350,24 +351,24 @@ function accountEdit() {
     ? confirmPassword.value
     : "";
 
-  axios
-    .post("/api/auth/account/edit", {
+  authApi
+    .updateAccount({
       password: currentPasswordValue,
       new_password: newPasswordValue,
       confirm_password: confirmPasswordValue,
-      new_username: newUsername.value ? newUsername.value : username,
+      new_username: newUsername.value || username || undefined,
     })
     .then((res) => {
       if (res.data.status == "error") {
         accountEditStatus.value.error = true;
-        accountEditStatus.value.message = res.data.message;
+        accountEditStatus.value.message = res.data.message || "";
         password.value = "";
         newPassword.value = "";
         confirmPassword.value = "";
         return;
       }
       accountEditStatus.value.success = true;
-      accountEditStatus.value.message = res.data.message;
+      accountEditStatus.value.message = res.data.message || "";
       setTimeout(() => {
         dialog.value = !dialog.value;
         const authStore = useAuthStore();
@@ -391,37 +392,37 @@ function accountEdit() {
 }
 
 function getVersion() {
-  axios
-    .get("/api/stat/version")
+  statsApi
+    .version()
     .then((res) => {
-      botCurrVersion.value = "v" + res.data.data.version;
-      dashboardCurrentVersion.value = res.data.data?.dashboard_version;
+      botCurrVersion.value = "v" + (res.data.data.version || "");
+      dashboardCurrentVersion.value = res.data.data?.dashboard_version || "";
       commonStore.setAstrBotVersion(
-        res.data.data.version,
-        res.data.data?.dashboard_version,
+        res.data.data.version || "",
+        res.data.data?.dashboard_version || undefined,
       );
       const change_pwd_hint = res.data.data?.change_pwd_hint;
-      const legacy_pwd_hint = res.data.data?.legacy_pwd_hint;
+      const md5_pwd_hint = res.data.data?.md5_pwd_hint;
       const password_upgrade_required =
         res.data.data?.password_upgrade_required;
-      if (change_pwd_hint || legacy_pwd_hint || password_upgrade_required) {
+      if (change_pwd_hint || md5_pwd_hint || password_upgrade_required) {
         dialog.value = true;
         accountWarning.value = true;
         accountWarningUpgrade.value = !!password_upgrade_required;
-        accountWarningLegacy.value =
-          !!legacy_pwd_hint && !password_upgrade_required;
+        accountWarningMd5.value =
+          !!md5_pwd_hint && !password_upgrade_required;
         if (
           change_pwd_hint ||
-          (legacy_pwd_hint && !password_upgrade_required)
+          (md5_pwd_hint && !password_upgrade_required)
         ) {
           localStorage.setItem("change_pwd_hint", "true");
         } else {
           localStorage.removeItem("change_pwd_hint");
         }
-        if (legacy_pwd_hint && !password_upgrade_required) {
-          localStorage.setItem("legacy_pwd_hint", "true");
+        if (md5_pwd_hint && !password_upgrade_required) {
+          localStorage.setItem("md5_pwd_hint", "true");
         } else {
-          localStorage.removeItem("legacy_pwd_hint");
+          localStorage.removeItem("md5_pwd_hint");
         }
         if (password_upgrade_required) {
           localStorage.setItem("password_upgrade_required", "true");
@@ -429,10 +430,10 @@ function getVersion() {
           localStorage.removeItem("password_upgrade_required");
         }
       } else {
-        accountWarningLegacy.value = false;
+        accountWarningMd5.value = false;
         accountWarningUpgrade.value = false;
         localStorage.removeItem("change_pwd_hint");
-        localStorage.removeItem("legacy_pwd_hint");
+        localStorage.removeItem("md5_pwd_hint");
         localStorage.removeItem("password_upgrade_required");
       }
     })
@@ -443,30 +444,31 @@ function getVersion() {
 
 function initPasswordWarningFromStorage() {
   const hasChangePwdHint = localStorage.getItem("change_pwd_hint") === "true";
-  const hasLegacyPwdHint = localStorage.getItem("legacy_pwd_hint") === "true";
+  const hasMd5PwdHint =
+    localStorage.getItem("md5_pwd_hint") === "true";
   const hasPasswordUpgradeRequired =
     localStorage.getItem("password_upgrade_required") === "true";
-  if (hasChangePwdHint || hasLegacyPwdHint || hasPasswordUpgradeRequired) {
+  if (hasChangePwdHint || hasMd5PwdHint || hasPasswordUpgradeRequired) {
     dialog.value = true;
     accountWarning.value = true;
     accountWarningUpgrade.value = hasPasswordUpgradeRequired;
-    accountWarningLegacy.value =
-      hasLegacyPwdHint && !hasPasswordUpgradeRequired;
+    accountWarningMd5.value =
+      hasMd5PwdHint && !hasPasswordUpgradeRequired;
   }
 }
 
 function checkUpdate() {
   updateStatus.value = t("core.header.updateDialog.status.checking");
-  axios
-    .get("/api/update/check")
+  updatesApi
+    .check()
     .then((res) => {
       hasNewVersion.value = res.data.data.has_new_version;
 
       if (res.data.data.has_new_version) {
-        releaseMessage.value = res.data.message;
+        releaseMessage.value = res.data.message || "";
         updateStatus.value = t("core.header.version.hasNewVersion");
       } else {
-        updateStatus.value = res.data.message;
+        updateStatus.value = res.data.message || "";
       }
       dashboardHasNewVersion.value = isDesktopReleaseMode.value
         ? false
@@ -486,8 +488,8 @@ function checkUpdate() {
 
 function getReleases() {
   releasesLoading.value = true;
-  return axios
-    .get("/api/update/releases")
+  return updatesApi
+    .releases()
     .then((res) => {
       releases.value = res.data.data.map((item: any) => {
         item.published_at = new Date(item.published_at).toLocaleString();
@@ -563,8 +565,11 @@ function stopRestartPolling() {
 }
 
 async function fetchAstrBotStartTime() {
-  const res = await axios.get("/api/stat/start-time", { timeout: 3000 });
-  const startTime = res.data?.data?.start_time ?? null;
+  const res = await statsApi.startTime();
+  const rawStartTime = res.data?.data?.start_time;
+  const parsedStartTime =
+    typeof rawStartTime === "number" ? rawStartTime : Number(rawStartTime || 0);
+  const startTime = Number.isFinite(parsedStartTime) ? parsedStartTime : 0;
   commonStore.startTime = startTime;
   return startTime;
 }
@@ -626,8 +631,8 @@ function applyUpdateProgress(payload: UpdateProgress) {
 function startUpdateProgressPolling(progressId: string) {
   stopUpdateProgressPolling();
   const poll = () => {
-    axios
-      .get("/api/update/progress", { params: { id: progressId } })
+    updatesApi
+      .progress(progressId)
       .then((res) => {
         if (res.data?.data) {
           applyUpdateProgress(res.data.data);
@@ -665,19 +670,19 @@ async function switchVersion(targetVersion: string) {
   restartStartTime.value = initialStartTime;
   startUpdateProgressPolling(progressId);
 
-  axios
-    .post("/api/update/do", {
+  updatesApi
+    .core({
       version: targetVersion,
       proxy: getSelectedGitHubProxy(),
       progress_id: progressId,
     })
     .then((res) => {
-      updateStatus.value = res.data.message;
+      updateStatus.value = res.data.message || "";
       updateProgress.value = {
         ...updateProgress.value,
         status:
           res.data.status === "ok" ? "success" : updateProgress.value.status,
-        message: res.data.message,
+        message: res.data.message || "",
         overall_percent:
           res.data.status === "ok" ? 100 : updateProgress.value.overall_percent,
       };
@@ -706,10 +711,10 @@ async function switchVersion(targetVersion: string) {
 function updateDashboard() {
   updatingDashboardLoading.value = true;
   updateStatus.value = t("core.header.updateDialog.status.updating");
-  axios
-    .post("/api/update/dashboard")
+  updatesApi
+    .dashboard()
     .then((res) => {
-      updateStatus.value = res.data.message;
+      updateStatus.value = res.data.message || "";
       if (res.data.status == "ok") {
         setTimeout(() => {
           window.location.reload();
@@ -1602,8 +1607,8 @@ onMounted(async () => {
               t(
                 accountWarningUpgrade
                   ? "core.header.accountDialog.securityWarningUpgrade"
-                  : accountWarningLegacy
-                  ? "core.header.accountDialog.securityWarningLegacy"
+                  : accountWarningMd5
+                  ? "core.header.accountDialog.securityWarningMd5"
                   : "core.header.accountDialog.securityWarning",
               )
             }}</strong>
diff --git a/dashboard/src/main.ts b/dashboard/src/main.ts
index 021e97214..3f226be25 100644
--- a/dashboard/src/main.ts
+++ b/dashboard/src/main.ts
@@ -29,9 +29,11 @@ import editorWorker from 'monaco-editor/esm/vs/editor/editor.worker?worker';
 import jsonWorker from 'monaco-editor/esm/vs/language/json/json.worker?worker';
 import cssWorker from 'monaco-editor/esm/vs/language/css/css.worker?worker';
 import htmlWorker from 'monaco-editor/esm/vs/language/html/html.worker?worker';
-import axios from 'axios';
+import { setupHttpClient } from './api/http';
 import { waitForRouterReadyInBackground } from './utils/routerReadiness.mjs';
 
+setupHttpClient();
+
 (self as any).MonacoEnvironment = {
   getWorker(_: string, label: string) {
     if (label === 'json') {
@@ -133,44 +135,4 @@ setupI18n().then(async () => {
 });
 
 
-axios.interceptors.request.use((config) => {
-  const token = localStorage.getItem('token');
-  if (token) {
-    config.headers['Authorization'] = `Bearer ${token}`;
-  }
-  const locale = localStorage.getItem('astrbot-locale');
-  if (locale) {
-    config.headers['Accept-Language'] = locale;
-  }
-  return config;
-});
-
-axios.interceptors.response.use(
-  (response) => response,
-  (error) => {
-    if (error.response?.status === 429 && error.response?.data?.message) {
-      return Promise.reject(error.response.data.message);
-    }
-    return Promise.reject(error);
-  }
-);
-
-// Keep fetch() calls consistent with axios by automatically attaching the JWT.
-// Some parts of the UI use fetch directly; without this, those requests will 401.
-const _origFetch = window.fetch.bind(window);
-window.fetch = (input: RequestInfo | URL, init?: RequestInit) => {
-  const token = localStorage.getItem('token');
-  if (!token) return _origFetch(input, init);
-
-  const headers = new Headers(init?.headers || (typeof input !== 'string' && 'headers' in input ? (input as Request).headers : undefined));
-  if (!headers.has('Authorization')) {
-    headers.set('Authorization', `Bearer ${token}`);
-  }
-  const locale = localStorage.getItem('astrbot-locale');
-  if (locale && !headers.has('Accept-Language')) {
-    headers.set('Accept-Language', locale);
-  }
-  return _origFetch(input, { ...init, headers });
-};
-
 loader.config({ monaco })
diff --git a/dashboard/src/stores/auth.ts b/dashboard/src/stores/auth.ts
index 7550497db..948607816 100644
--- a/dashboard/src/stores/auth.ts
+++ b/dashboard/src/stores/auth.ts
@@ -1,6 +1,6 @@
 import { defineStore } from 'pinia';
 import { router } from '@/router';
-import axios from 'axios';
+import { authApi, providerApi, systemConfigApi } from '@/api/v1';
 
 export const useAuthStore = defineStore("auth", {
   state: () => ({
@@ -14,19 +14,20 @@ export const useAuthStore = defineStore("auth", {
       localStorage.setItem('user', this.username);
       localStorage.setItem('token', data.token);
       const passwordUpgradeRequired = !!data?.password_upgrade_required;
+      const md5PwdHint = !!data?.md5_pwd_hint;
       const passwordWarning =
         !!data?.change_pwd_hint ||
-        (!!data?.legacy_pwd_hint && !passwordUpgradeRequired);
+        (md5PwdHint && !passwordUpgradeRequired);
       if (passwordWarning) {
         localStorage.setItem('change_pwd_hint', 'true');
-        if (data?.legacy_pwd_hint && !passwordUpgradeRequired) {
-          localStorage.setItem('legacy_pwd_hint', 'true');
+        if (md5PwdHint && !passwordUpgradeRequired) {
+          localStorage.setItem('md5_pwd_hint', 'true');
         } else {
-          localStorage.removeItem('legacy_pwd_hint');
+          localStorage.removeItem('md5_pwd_hint');
         }
       } else {
         localStorage.removeItem('change_pwd_hint');
-        localStorage.removeItem('legacy_pwd_hint');
+        localStorage.removeItem('md5_pwd_hint');
       }
       if (passwordUpgradeRequired) {
         localStorage.setItem('password_upgrade_required', 'true');
@@ -53,26 +54,23 @@ export const useAuthStore = defineStore("auth", {
       trustDeviceToken = false,
     ): Promise<'totp_required' | void> {
       try {
-        const res = await axios.post('/api/auth/login', {
-          username: username,
-          password: password,
-          code: code,
+        const res = await authApi.login({
+          username,
+          password,
+          code,
           trust_device_flag: trustDeviceToken,
-        }, {
-          validateStatus: (status) => (status >= 200 && status < 300) || status === 401
         });
 
-        if (res.status === 401 && res.data?.data?.totp_required) {
-          return 'totp_required';
-        }
-
         if (res.data.status === 'error') {
           return Promise.reject(res.data.message);
         }
 
         await this.finishAuthenticatedSession(res.data.data);
-      } catch (error) {
-        return Promise.reject(error);
+      } catch (error: any) {
+        if (error?.response?.status === 401 && error.response?.data?.data?.totp_required) {
+          return 'totp_required';
+        }
+        return Promise.reject(error?.response?.data?.message || error);
       }
     },
     async setup(
@@ -81,10 +79,9 @@ export const useAuthStore = defineStore("auth", {
       confirmPassword: string,
     ): Promise<void> {
       try {
-        const endpoint = this.has_token() ? '/api/auth/setup-authenticated' : '/api/auth/setup';
-        const res = await axios.post(endpoint, {
-          username: username,
-          password: password,
+        const res = await authApi.setup({
+          username,
+          password,
           confirm_password: confirmPassword,
         });
 
@@ -100,12 +97,13 @@ export const useAuthStore = defineStore("auth", {
     async checkOnboardingCompleted(): Promise<boolean> {
       try {
         // 1. 检查平台配置
-        const platformRes = await axios.get('/api/config/get');
-        const hasPlatform = (platformRes.data.data.config.platform || []).length > 0;
+        const platformRes = await systemConfigApi.get();
+        const systemConfig = (platformRes.data.data as any).config || {};
+        const hasPlatform = (systemConfig.platform || []).length > 0;
         if (!hasPlatform) return false;
 
         // 2. 检查提供者配置
-        const providerRes = await axios.get('/api/config/provider/template');
+        const providerRes = await providerApi.schema();
         const providers = providerRes.data.data?.providers || [];
         const sources = providerRes.data.data?.provider_sources || [];
         const sourceMap = new Map();
@@ -131,9 +129,9 @@ export const useAuthStore = defineStore("auth", {
       localStorage.removeItem('user');
       localStorage.removeItem('token');
       localStorage.removeItem('change_pwd_hint');
-      localStorage.removeItem('legacy_pwd_hint');
+      localStorage.removeItem('md5_pwd_hint');
       localStorage.removeItem('password_upgrade_required');
-      void axios.post('/api/auth/logout').catch(() => undefined);
+      void authApi.logout().catch(() => undefined);
       router.push('/auth/login');
     },
     has_token(): boolean {
diff --git a/dashboard/src/stores/common.js b/dashboard/src/stores/common.js
index 707f83da6..3ea6fb274 100644
--- a/dashboard/src/stores/common.js
+++ b/dashboard/src/stores/common.js
@@ -1,5 +1,6 @@
 import { defineStore } from "pinia";
-import axios from "axios";
+import { logApi, pluginApi, statsApi } from "@/api/v1";
+import { fetchWithAuth } from "@/api/http";
 
 export const useCommonStore = defineStore("common", {
   state: () => ({
@@ -30,7 +31,7 @@ export const useCommonStore = defineStore("common", {
         Authorization: "Bearer " + localStorage.getItem("token"),
       };
 
-      fetch("/api/live-log", {
+      fetchWithAuth(logApi.liveUrl(), {
         method: "GET",
         headers,
         signal,
@@ -151,7 +152,7 @@ export const useCommonStore = defineStore("common", {
       return this.log_cache;
     },
     async fetchStartTime() {
-      const res = await axios.get("/api/stat/start-time");
+      const res = await statsApi.startTime();
       this.startTime = res.data.data.start_time;
       return this.startTime;
     },
@@ -163,7 +164,7 @@ export const useCommonStore = defineStore("common", {
       if (!force && this.astrbotVersion) {
         return this.astrbotVersion;
       }
-      const res = await axios.get("/api/stat/version");
+      const res = await statsApi.version();
       const data = res.data?.data || {};
       this.setAstrBotVersion(data.version, data.dashboard_version);
       return this.astrbotVersion;
@@ -181,18 +182,11 @@ export const useCommonStore = defineStore("common", {
         return Promise.resolve(this.pluginMarketData);
       }
 
-      // 构建URL
-      let url = force
-        ? "/api/plugin/market_list?force_refresh=true"
-        : "/api/plugin/market_list";
-      if (customSource) {
-        url +=
-          (url.includes("?") ? "&" : "?") +
-          `custom_registry=${encodeURIComponent(customSource)}`;
-      }
-
-      return axios
-        .get(url)
+      return pluginApi
+        .market({
+          force_refresh: force || undefined,
+          custom_registry: customSource || undefined,
+        })
         .then((res) => {
           let data = [];
           if (res.data.data && typeof res.data.data === "object") {
diff --git a/dashboard/src/stores/personaStore.ts b/dashboard/src/stores/personaStore.ts
index 4f6f7985e..d1d976f65 100644
--- a/dashboard/src/stores/personaStore.ts
+++ b/dashboard/src/stores/personaStore.ts
@@ -2,7 +2,7 @@
  * Persona 文件夹管理 Store
  */
 import { defineStore } from 'pinia';
-import axios from 'axios';
+import { personaApi } from '@/api/v1';
 
 // 类型定义
 export interface PersonaFolder {
@@ -96,7 +96,7 @@ export const usePersonaStore = defineStore("persona", {
     async loadFolderTree(): Promise<void> {
       this.treeLoading = true;
       try {
-        const response = await axios.get('/api/persona/folder/tree');
+        const response = await personaApi.tree();
         if (response.data.status === 'ok') {
           this.folderTree = response.data.data || [];
         } else {
@@ -117,12 +117,8 @@ export const usePersonaStore = defineStore("persona", {
 
         // 并行加载子文件夹和 Persona
         const [foldersRes, personasRes] = await Promise.all([
-          axios.get('/api/persona/folder/list', {
-            params: { parent_id: folderId ?? '' }
-          }),
-          axios.get('/api/persona/list', {
-            params: { folder_id: folderId ?? '' }
-          }),
+          personaApi.folders(folderId),
+          personaApi.list(folderId),
         ]);
 
         if (foldersRes.data.status === 'ok') {
@@ -180,10 +176,7 @@ export const usePersonaStore = defineStore("persona", {
      * 移动 Persona 到文件夹
      */
     async movePersonaToFolder(personaId: string, targetFolderId: string | null): Promise<void> {
-      const response = await axios.post('/api/persona/move', {
-        persona_id: personaId,
-        folder_id: targetFolderId
-      });
+      const response = await personaApi.move(personaId, targetFolderId);
 
       if (response.data.status !== 'ok') {
         throw new Error(response.data.message || '移动人格失败');
@@ -200,9 +193,8 @@ export const usePersonaStore = defineStore("persona", {
      * 移动文件夹到另一个文件夹
      */
     async moveFolderToFolder(folderId: string, targetParentId: string | null): Promise<void> {
-      const response = await axios.post('/api/persona/folder/update', {
-        folder_id: folderId,
-        parent_id: targetParentId
+      const response = await personaApi.updateFolder(folderId, {
+        parent_id: targetParentId,
       });
 
       if (response.data.status !== 'ok') {
@@ -224,7 +216,7 @@ export const usePersonaStore = defineStore("persona", {
       parent_id?: string | null;
       description?: string;
     }): Promise<PersonaFolder> {
-      const response = await axios.post('/api/persona/folder/create', {
+      const response = await personaApi.createFolder({
         ...data,
         parent_id: data.parent_id ?? this.currentFolderId,
       });
@@ -239,7 +231,7 @@ export const usePersonaStore = defineStore("persona", {
         this.loadFolderTree(),
       ]);
 
-      return response.data.data.folder;
+      return response.data.data.folder as PersonaFolder;
     },
 
     /**
@@ -250,7 +242,7 @@ export const usePersonaStore = defineStore("persona", {
       name?: string;
       description?: string;
     }): Promise<void> {
-      const response = await axios.post('/api/persona/folder/update', data);
+      const response = await personaApi.updateFolder(data.folder_id, data);
 
       if (response.data.status !== 'ok') {
         throw new Error(response.data.message || '更新文件夹失败');
@@ -267,9 +259,7 @@ export const usePersonaStore = defineStore("persona", {
      * 删除文件夹
      */
     async deleteFolder(folderId: string): Promise<void> {
-      const response = await axios.post('/api/persona/folder/delete', {
-        folder_id: folderId
-      });
+      const response = await personaApi.deleteFolder(folderId);
 
       if (response.data.status !== 'ok') {
         throw new Error(response.data.message || '删除文件夹失败');
@@ -286,9 +276,7 @@ export const usePersonaStore = defineStore("persona", {
      * 删除 Persona
      */
     async deletePersona(personaId: string): Promise<void> {
-      const response = await axios.post('/api/persona/delete', {
-        persona_id: personaId
-      });
+      const response = await personaApi.delete(personaId);
 
       if (response.data.status !== 'ok') {
         throw new Error(response.data.message || '删除人格失败');
@@ -302,7 +290,7 @@ export const usePersonaStore = defineStore("persona", {
      * 批量更新排序
      */
     async reorderItems(items: ReorderItem[]): Promise<void> {
-      const response = await axios.post('/api/persona/reorder', { items });
+      const response = await personaApi.reorder(items);
 
       if (response.data.status !== 'ok') {
         throw new Error(response.data.message || '更新排序失败');
diff --git a/dashboard/src/utils/imeInput.mjs b/dashboard/src/utils/imeInput.mjs
index 3c24ffbae..9e8b4d672 100644
--- a/dashboard/src/utils/imeInput.mjs
+++ b/dashboard/src/utils/imeInput.mjs
@@ -12,7 +12,7 @@ export function isComposingEnter(
   compositionActive,
   lastCompositionEndAt = null,
 ) {
-  const hasLegacyCompositionKeyCode =
+  const hasCompositionKeyCodeFallback =
     typeof event.keyCode === "number" && event.keyCode === 229;
   const isAfterRecentCompositionEnd =
     typeof event.timeStamp === "number" &&
@@ -25,7 +25,7 @@ export function isComposingEnter(
     event.key === "Enter" &&
     (compositionActive ||
       event.isComposing ||
-      hasLegacyCompositionKeyCode ||
+      hasCompositionKeyCodeFallback ||
       isAfterRecentCompositionEnd)
   );
 }
diff --git a/dashboard/src/utils/restartAstrBot.ts b/dashboard/src/utils/restartAstrBot.ts
index dd1c7a6b8..598d25831 100644
--- a/dashboard/src/utils/restartAstrBot.ts
+++ b/dashboard/src/utils/restartAstrBot.ts
@@ -1,4 +1,4 @@
-import axios from 'axios'
+import { statsApi } from '@/api/v1'
 import { getDesktopRuntimeInfo } from '@/utils/desktopRuntime'
 
 type WaitingForRestartRef = {
@@ -16,7 +16,7 @@ async function triggerWaiting(
 
 async function fetchCurrentStartTime(): Promise<number | null> {
   try {
-    const response = await axios.get('/api/stat/start-time', { timeout: 1500 })
+    const response = await statsApi.startTime()
     const rawStartTime = response?.data?.data?.start_time
     const numericStartTime = Number(rawStartTime)
     return Number.isFinite(numericStartTime) ? numericStartTime : null
@@ -49,6 +49,6 @@ export async function restartAstrBot(
     return
   }
 
-  await axios.post('/api/stat/restart-core')
+  await statsApi.restart()
   await triggerWaiting(waitingRef)
 }
diff --git a/dashboard/src/views/ConfigPage.vue b/dashboard/src/views/ConfigPage.vue
index b893c5890..738079a36 100644
--- a/dashboard/src/views/ConfigPage.vue
+++ b/dashboard/src/views/ConfigPage.vue
@@ -216,7 +216,7 @@
 
 
 <script>
-import axios from 'axios';
+import { configProfileApi, systemConfigApi } from '@/api/v1';
 import AstrBotCoreConfigWrapper from '@/components/config/AstrBotCoreConfigWrapper.vue';
 import WaitingForRestart from '@/components/shared/WaitingForRestart.vue';
 import StandaloneChat from '@/components/chat/StandaloneChat.vue';
@@ -452,15 +452,12 @@ export default {
     // 处理语言切换事件，重新加载配置以获取插件的 i18n 数据
     handleLocaleChange() {
       // 重新加载当前配置
-      if (this.selectedConfigID) {
-        this.getConfig(this.selectedConfigID);
-      } else if (this.isSystemConfig) {
+      if (this.isSystemConfig) {
         this.getConfig();
+      } else if (this.selectedConfigID) {
+        this.getConfig(this.selectedConfigID);
       }
     },
-
-  },
-  methods: {
     onConfigSearchInput(value) {
       this.configSearchKeyword = normalizeTextInput(value);
     },
@@ -485,7 +482,7 @@ export default {
     },
     getConfigInfoList(abconf_id) {
       // 获取配置列表
-      axios.get('/api/config/abconfs').then((res) => {
+      configProfileApi.list().then((res) => {
         this.configInfoList = res.data.data.info_list;
 
         if (abconf_id) {
@@ -515,17 +512,11 @@ export default {
     },
     getConfig(abconf_id) {
       this.fetched = false
-      const params = {};
+      const request = this.isSystemConfig
+        ? systemConfigApi.get()
+        : configProfileApi.get(abconf_id || this.selectedConfigID);
 
-      if (this.isSystemConfig) {
-        params.system_config = '1';
-      } else {
-        params.id = abconf_id || this.selectedConfigID;
-      }
-
-      axios.get('/api/config/abconf', {
-        params: params
-      }).then((res) => {
+      request.then((res) => {
         this.config_data = res.data.data.config;
         this.lastSavedConfigSnapshot = this.getConfigSnapshot(this.config_data);
         this.fetched = true
@@ -562,10 +553,14 @@ export default {
     },
     async saveAstrbotConfig(postData, headers = {}, allow2faPrompt = true) {
       try {
-        const res = await axios.post('/api/config/astrbot/update', postData, {
+        const confId = postData.conf_id || 'default';
+        const requestConfig = {
           headers,
           validateStatus: (status) => (status >= 200 && status < 300) || status === 401,
-        });
+        };
+        const res = this.isSystemConfig
+          ? await systemConfigApi.update(postData.config, requestConfig)
+          : await configProfileApi.update(confId, postData.config, requestConfig);
 
         if (res.status === 401 && res.data?.data?.totp_required) {
           if (allow2faPrompt && !headers['X-2FA-Code']) {
@@ -675,7 +670,7 @@ export default {
       }
     },
     createNewConfig(configName) {
-      axios.post('/api/config/abconf/new', {
+      configProfileApi.create({
         name: configName
       }).then((res) => {
         if (res.data.status === "ok") {
@@ -815,9 +810,7 @@ export default {
       }
     },
     copyConfig(configName) {
-      axios.get('/api/config/abconf', {
-        params: { id: this.copySourceConfigId }
-      }).then((res) => {
+      configProfileApi.get(this.copySourceConfigId).then((res) => {
         const sourceConfig = res.data?.data?.config;
         if (!sourceConfig) {
           this.save_message = this.tm('configManagement.copyFailed');
@@ -825,7 +818,7 @@ export default {
           this.save_message_success = "error";
           return;
         }
-        return axios.post('/api/config/abconf/new', {
+        return configProfileApi.create({
           name: configName,
           config: sourceConfig
         });
@@ -856,9 +849,7 @@ export default {
       }
     },
     deleteConfig(configId) {
-      axios.post('/api/config/abconf/delete', {
-        id: configId
-      }).then((res) => {
+      configProfileApi.delete(configId).then((res) => {
         if (res.data.status === "ok") {
           this.save_message = res.data.message;
           this.save_message_snack = true;
@@ -879,10 +870,7 @@ export default {
       });
     },
     updateConfigInfo(configName) {
-      axios.post('/api/config/abconf/update', {
-        id: this.editingConfigId,
-        name: configName
-      }).then((res) => {
+      configProfileApi.rename(this.editingConfigId, configName).then((res) => {
         if (res.data.status === "ok") {
           this.save_message = res.data.message;
           this.save_message_snack = true;
diff --git a/dashboard/src/views/ConsolePage.vue b/dashboard/src/views/ConsolePage.vue
index daf50269b..e3c3f3086 100644
--- a/dashboard/src/views/ConsolePage.vue
+++ b/dashboard/src/views/ConsolePage.vue
@@ -1,7 +1,7 @@
 <script setup>
 import ConsoleDisplayer from '@/components/shared/ConsoleDisplayer.vue';
 import { useModuleI18n } from '@/i18n/composables';
-import axios from 'axios';
+import { updatesApi } from '@/api/v1';
 import { useToast } from '@/utils/toast';
 
 const { tm } = useModuleI18n('features/console');
@@ -86,7 +86,7 @@ export default {
     pipInstall() {
       const toast = useToast();
       this.loading = true;
-      axios.post('/api/update/pip-install', this.pipInstallPayload)
+      updatesApi.installPip(this.pipInstallPayload)
         .then(res => {
           if (res.data.status === 'ok') {
             toast.success(res.data.message || tm('pipInstall.installSuccess'));
diff --git a/dashboard/src/views/ConversationPage.vue b/dashboard/src/views/ConversationPage.vue
index 701df04b5..0e41f2c0a 100644
--- a/dashboard/src/views/ConversationPage.vue
+++ b/dashboard/src/views/ConversationPage.vue
@@ -384,9 +384,10 @@
 </template>
 
 <script>
-import axios from 'axios';
+import { isCancel } from 'axios';
 import { debounce } from 'lodash';
 import { VueMonacoEditor } from '@guolao/vue-monaco-editor';
+import { conversationApi } from '@/api/v1';
 import { useCommonStore } from '@/stores/common';
 import { useCustomizerStore } from '@/stores/customizer';
 import { useI18n, useModuleI18n } from '@/i18n/composables';
@@ -760,9 +761,8 @@ export default {
                     params.exclude_ids = 'astrbot';
                     params.exclude_platforms = 'webchat';
 
-                    const response = await axios.get('/api/conversation/list', {
+                    const response = await conversationApi.list(params, {
                         signal: controller.signal,
-                        params
                     });
 
                     this.lastAppliedFilters = { ...this.currentFilters }; // 记录已应用的筛选条件
@@ -803,7 +803,7 @@ export default {
                         this.showErrorMessage(response.data.message || this.tm('messages.fetchError'));
                     }
                 } catch (error) {
-                    if (axios.isCancel(error)) return;
+                    if (isCancel(error)) return;
                     
                     console.error('获取对话列表出错:', error);
                     if (error.response) {
@@ -825,10 +825,7 @@ export default {
 
             try {
                 console.log(`正在请求对话详情，user_id=${item.user_id}, cid=${item.cid}`);
-                const response = await axios.post('/api/conversation/detail', {
-                    user_id: item.user_id,
-                    cid: item.cid
-                });
+                const response = await conversationApi.get(item.user_id, item.cid);
 
                 if (response.data.status === "ok") {
                     try {
@@ -878,11 +875,13 @@ export default {
                     return;
                 }
 
-                const response = await axios.post('/api/conversation/update_history', {
-                    user_id: this.selectedConversation.user_id,
-                    cid: this.selectedConversation.cid,
+                const response = await conversationApi.replaceMessages(
+                    this.selectedConversation.user_id,
+                    this.selectedConversation.cid,
+                    {
                     history: historyJson
-                });
+                    }
+                );
 
                 if (response.data.status === "ok") {
                     this.conversationHistory = historyJson;
@@ -923,11 +922,13 @@ export default {
 
             this.loading = true;
             try {
-                const response = await axios.post('/api/conversation/update', {
-                    user_id: this.editedItem.user_id,
-                    cid: this.editedItem.cid,
+                const response = await conversationApi.update(
+                    this.editedItem.user_id,
+                    this.editedItem.cid,
+                    {
                     title: this.editedItem.title
-                });
+                    }
+                );
 
                 if (response.data.status === "ok") {
                     // 更新本地数据
@@ -963,10 +964,10 @@ export default {
         async deleteConversation() {
             this.loading = true;
             try {
-                const response = await axios.post('/api/conversation/delete', {
-                    user_id: this.selectedConversation.user_id,
-                    cid: this.selectedConversation.cid
-                });
+                const response = await conversationApi.delete(
+                    this.selectedConversation.user_id,
+                    this.selectedConversation.cid
+                );
 
                 if (response.data.status === "ok") {
                     const index = this.conversations.findIndex(item => item.user_id === this.selectedConversation.user_id && item.cid === this.selectedConversation.cid
@@ -1032,7 +1033,7 @@ export default {
                     cid: item.cid
                 }));
 
-                const response = await axios.post('/api/conversation/delete', {
+                const response = await conversationApi.batchDelete({
                     conversations: conversations
                 });
 
@@ -1085,10 +1086,8 @@ export default {
                     cid: item.cid
                 }));
 
-                const response = await axios.post('/api/conversation/export', {
+                const response = await conversationApi.export({
                     conversations: conversations
-                }, {
-                    responseType: 'blob' // 重要：告诉 axios 响应是一个 blob
                 });
 
                 // 创建一个下载链接
diff --git a/dashboard/src/views/CronJobPage.vue b/dashboard/src/views/CronJobPage.vue
index 6647c1208..3d8b205c9 100644
--- a/dashboard/src/views/CronJobPage.vue
+++ b/dashboard/src/views/CronJobPage.vue
@@ -436,9 +436,9 @@
 </template>
 
 <script setup lang="ts">
-import axios from "axios";
 import { computed, onMounted, ref } from "vue";
 import { useTheme } from "vuetify";
+import { botApi, cronApi, sessionApi } from "@/api/v1";
 import { useModuleI18n } from "@/i18n/composables";
 import OutlinedActionListItem from "@/components/shared/OutlinedActionListItem.vue";
 import StyledMenu from "@/components/shared/StyledMenu.vue";
@@ -802,7 +802,7 @@ async function loadUmos(force = false) {
   if (loadingUmos.value || (!force && availableUmos.value.length)) return;
   loadingUmos.value = true;
   try {
-    const res = await axios.get("/api/session/active-umos");
+    const res = await sessionApi.activeUmos();
     if (res.data.status === "ok") {
       const loadedUmos = Array.isArray(res.data.data?.umos)
         ? res.data.data.umos
@@ -822,7 +822,7 @@ async function loadUmos(force = false) {
 async function loadJobs() {
   loading.value = true;
   try {
-    const res = await axios.get("/api/cron/jobs");
+    const res = await cronApi.list();
     if (res.data.status === "ok") {
       const data = Array.isArray(res.data.data) ? res.data.data : [];
       jobs.value = data.map((job: any) => ({
@@ -844,7 +844,7 @@ async function loadJobs() {
 
 async function loadPlatforms() {
   try {
-    const res = await axios.get("/api/platform/stats");
+    const res = await botApi.stats();
     if (res.data.status === "ok" && Array.isArray(res.data.data?.platforms)) {
       proactivePlatforms.value = res.data.data.platforms
         .filter((p: any) => p?.meta?.support_proactive_message)
@@ -861,7 +861,7 @@ async function loadPlatforms() {
 
 async function toggleJob(job: any) {
   try {
-    const res = await axios.patch(`/api/cron/jobs/${job.job_id}`, {
+    const res = await cronApi.update(job.job_id, {
       enabled: job.enabled,
     });
     if (res.data.status !== "ok") {
@@ -876,7 +876,7 @@ async function toggleJob(job: any) {
 
 async function deleteJob(job: any) {
   try {
-    const res = await axios.delete(`/api/cron/jobs/${job.job_id}`);
+    const res = await cronApi.delete(job.job_id);
     if (res.data.status === "ok") {
       toast(tm("messages.deleteSuccess"));
       jobs.value = jobs.value.filter((item) => item.job_id !== job.job_id);
@@ -893,7 +893,7 @@ async function runJobNow(job: any) {
   if (!jobId || runningJobIds.value.has(jobId)) return;
   runningJobIds.value = new Set([...runningJobIds.value, jobId]);
   try {
-    const res = await axios.post(`/api/cron/jobs/${jobId}/run`);
+    const res = await cronApi.run(jobId);
     if (res.data.status === "ok") {
       toast(tm("messages.runStarted"));
       await loadJobs();
@@ -1263,7 +1263,7 @@ async function createJob() {
   creating.value = true;
   try {
     const payload = buildPayload();
-    const res = await axios.post("/api/cron/jobs", payload);
+    const res = await cronApi.create(payload);
     if (res.data.status === "ok") {
       toast(tm("messages.createSuccess"));
       createDialog.value = false;
@@ -1294,10 +1294,7 @@ async function updateJob() {
       ...buildPayload(),
       description: newJob.value.note,
     };
-    const res = await axios.patch(
-      `/api/cron/jobs/${editingJobId.value}`,
-      payload,
-    );
+    const res = await cronApi.update(editingJobId.value, payload);
     if (res.data.status === "ok") {
       toast(tm("messages.updateSuccess"));
       createDialog.value = false;
diff --git a/dashboard/src/views/ExtensionPage.vue b/dashboard/src/views/ExtensionPage.vue
index a67503be4..6c07d7d60 100644
--- a/dashboard/src/views/ExtensionPage.vue
+++ b/dashboard/src/views/ExtensionPage.vue
@@ -60,8 +60,8 @@ const {
   dangerConfirmDialog,
   selectedDangerPlugin,
   selectedMarketInstallPlugin,
-  installCompat,
-  versionCompatibilityDialog,
+  installSupport,
+  versionSupportDialog,
   showUninstallDialog,
   uninstallTarget,
   showSourceDialog,
@@ -144,7 +144,7 @@ const {
   saveCustomSource,
   trimExtensionName,
   checkAlreadyInstalled,
-  showVersionCompatibilityWarning,
+  showVersionSupportWarning,
   continueInstallIgnoringVersionWarning,
   cancelInstallOnVersionWarning,
   newExtension,
@@ -160,7 +160,7 @@ const {
   selectedUpdateDownloadUrl,
   selectedUpdateSourceUrl,
   updateUsesGithubSource,
-  checkInstallCompatibility,
+  checkInstallVersionSupport,
   refreshPluginMarket,
   handleLocaleChange,
   searchDebounceTimer,
@@ -608,25 +608,25 @@ const updateDialogPluginLogo = computed(() => {
   </v-dialog>
 
   <!-- 版本不兼容警告对话框 -->
-  <v-dialog v-model="versionCompatibilityDialog.show" width="520" persistent>
+  <v-dialog v-model="versionSupportDialog.show" width="520" persistent>
     <v-card>
       <v-card-title class="text-h5 d-flex align-center">
         <v-icon color="warning" class="mr-2">mdi-alert</v-icon>
-        {{ tm("dialogs.versionCompatibility.title") }}
+        {{ tm("dialogs.versionSupport.title") }}
       </v-card-title>
       <v-card-text>
-        <div class="mb-2">{{ tm("dialogs.versionCompatibility.message") }}</div>
+        <div class="mb-2">{{ tm("dialogs.versionSupport.message") }}</div>
         <div class="text-medium-emphasis">
-          {{ versionCompatibilityDialog.message }}
+          {{ versionSupportDialog.message }}
         </div>
       </v-card-text>
       <v-card-actions>
         <v-spacer></v-spacer>
         <v-btn color="grey" @click="cancelInstallOnVersionWarning">
-          {{ tm("dialogs.versionCompatibility.cancel") }}
+          {{ tm("dialogs.versionSupport.cancel") }}
         </v-btn>
         <v-btn color="warning" @click="continueInstallIgnoringVersionWarning">
-          {{ tm("dialogs.versionCompatibility.confirm") }}
+          {{ tm("dialogs.versionSupport.confirm") }}
         </v-btn>
       </v-card-actions>
     </v-card>
@@ -707,15 +707,15 @@ const updateDialogPluginLogo = computed(() => {
             <v-alert
               v-if="
                 selectedInstallPlugin.astrbot_version &&
-                installCompat.checked &&
-                !installCompat.compatible
+                installSupport.checked &&
+                !installSupport.supported
               "
               type="warning"
               variant="tonal"
               density="comfortable"
               class="market-install-alert mt-2 mb-3"
             >
-              {{ installCompat.message }}
+              {{ installSupport.message }}
             </v-alert>
           </div>
 
@@ -843,15 +843,15 @@ const updateDialogPluginLogo = computed(() => {
                   <v-alert
                     v-if="
                       selectedInstallPlugin.astrbot_version &&
-                      installCompat.checked &&
-                      !installCompat.compatible
+                      installSupport.checked &&
+                      !installSupport.supported
                     "
                     type="warning"
                     variant="tonal"
                     density="comfortable"
                     class="market-install-alert mt-2 mb-3"
                   >
-                    {{ installCompat.message }}
+                    {{ installSupport.message }}
                   </v-alert>
                 </div>
 
@@ -900,7 +900,7 @@ const updateDialogPluginLogo = computed(() => {
           variant="text"
           :loading="loading_"
           :disabled="loading_"
-          @click="newExtension"
+          @click="newExtension()"
           >{{ tm("buttons.install") }}</v-btn
         >
       </div>
diff --git a/dashboard/src/views/PlatformPage.vue b/dashboard/src/views/PlatformPage.vue
index 919166697..36fe1ef86 100644
--- a/dashboard/src/views/PlatformPage.vue
+++ b/dashboard/src/views/PlatformPage.vue
@@ -228,7 +228,7 @@
 </template>
 
 <script>
-import axios from 'axios';
+import { botApi, fileApi, systemConfigApi } from '@/api/v1';
 import AstrBotConfig from '@/components/shared/AstrBotConfig.vue';
 import WaitingForRestart from '@/components/shared/WaitingForRestart.vue';
 import ConsoleDisplayer from '@/components/shared/ConsoleDisplayer.vue';
@@ -350,13 +350,13 @@ export default {
       const template = this.metadata['platform_group']?.metadata?.platform?.config_template?.[platform_id];
       if (template && template.logo_token) {
           // 通过文件服务访问插件提供的 logo
-        return `/api/file/${template.logo_token}`;
+        return fileApi.tokenUrl(template.logo_token);
       }
       return getPlatformIcon(platform_id);
     },
 
     getConfig() {
-      axios.get('/api/config/get').then((res) => {
+      systemConfigApi.runtime().then((res) => {
         this.config_data = res.data.data.config;
         this.fetched = true
         this.metadata = res.data.data.metadata;
@@ -372,7 +372,7 @@ export default {
     },
 
     async getPlatformStats() {
-      await axios.get('/api/platform/stats').then((res) => {
+      await botApi.stats().then((res) => {
         if (res.data.status === 'ok') {
           // 将数组转换为以 id 为 key 的对象，方便查找
           const stats = {};
@@ -549,7 +549,7 @@ export default {
         return;
       }
 
-      axios.post('/api/config/platform/delete', { id: platform.id }).then((res) => {
+      botApi.delete(platform.id).then((res) => {
         this.getConfig();
         this.showSuccess(res.data.message || this.messages.deleteSuccess);
       }).catch((err) => {
@@ -560,10 +560,7 @@ export default {
     platformStatusChange(platform) {
       platform.enable = !platform.enable; // 切换状态
 
-      axios.post('/api/config/platform/update', {
-        id: platform.id,
-        config: platform
-      }).then((res) => {
+      botApi.setEnabled(platform.id, { enabled: platform.enable }).then((res) => {
         this.getConfig();
         this.showSuccess(res.data.message || this.messages.statusUpdateSuccess);
       }).catch((err) => {
@@ -598,9 +595,9 @@ export default {
         callbackBase = "http(s)://<your-domain-or-ip>";
       }
       if (callbackBase) {
-        return `${callbackBase.replace(/\/$/, '')}/api/platform/webhook/${webhookUuid}`;
+        return `${callbackBase.replace(/\/$/, '')}/api/v1/webhooks/platforms/${webhookUuid}`;
       }
-      return `/api/platform/webhook/${webhookUuid}`;
+      return `/api/v1/webhooks/platforms/${webhookUuid}`;
     },
 
     openWebhookDialog(webhookUuid) {
diff --git a/dashboard/src/views/PluginPagePage.vue b/dashboard/src/views/PluginPagePage.vue
index f4e5353d3..2621d7acf 100644
--- a/dashboard/src/views/PluginPagePage.vue
+++ b/dashboard/src/views/PluginPagePage.vue
@@ -2,6 +2,8 @@
 import axios from "axios";
 import { computed, onBeforeUnmount, onMounted, ref, toRaw, watch } from "vue";
 import { useRoute } from "vue-router";
+import { pluginApi } from "@/api/v1";
+import { fetchWithAuth } from "@/api/http";
 import { useModuleI18n } from "@/i18n/composables";
 import { usePluginI18n } from "@/utils/pluginI18n";
 import { useCustomizerStore } from "@/stores/customizer";
@@ -48,8 +50,8 @@ const toPostMessageData = (value, fallback = null) => {
 };
 
 const cleanupSSEConnections = () => {
-  for (const eventSource of sseConnections.values()) {
-    eventSource.close();
+  for (const connection of sseConnections.values()) {
+    connection.close();
   }
   sseConnections.clear();
 };
@@ -119,13 +121,16 @@ const normalizePluginEndpoint = (endpoint) => {
 
 const buildPluginApiPath = (endpoint) => {
   const normalized = normalizePluginEndpoint(endpoint);
-  return `/api/plug/${encodeURIComponent(pluginName.value)}/${normalized}`;
+  return `/api/v1/plugins/extensions/${encodeURIComponent(pluginName.value)}/${normalized}`;
 };
 
 const isBridgeUploadFile = (value) => {
   if (!value || typeof value !== "object") {
     return false;
   }
+  if (value instanceof ArrayBuffer || ArrayBuffer.isView(value)) {
+    return true;
+  }
   if (typeof File !== "undefined" && value instanceof File) {
     return true;
   }
@@ -141,29 +146,64 @@ const isBridgeUploadFile = (value) => {
   );
 };
 
-const coerceBridgeUploadFile = async (value, fileName) => {
+const createBridgeUploadBlob = (parts, fileName, fileType, lastModified) => {
+  const normalizedType =
+    typeof fileType === "string" && fileType
+      ? fileType
+      : "application/octet-stream";
+  if (typeof File !== "undefined") {
+    return new File(parts, fileName, {
+      type: normalizedType,
+      lastModified:
+        typeof lastModified === "number" ? lastModified : Date.now(),
+    });
+  }
+  return new Blob(parts, { type: normalizedType });
+};
+
+const coerceBridgeUploadFile = async (
+  value,
+  fileName,
+  fileType,
+  lastModified,
+) => {
   if (!isBridgeUploadFile(value)) {
     throw new Error("Missing uploaded file payload.");
   }
+  if (value instanceof ArrayBuffer) {
+    return createBridgeUploadBlob([value], fileName, fileType, lastModified);
+  }
+  if (ArrayBuffer.isView(value)) {
+    const viewBuffer = value.buffer.slice(
+      value.byteOffset,
+      value.byteOffset + value.byteLength,
+    );
+    return createBridgeUploadBlob(
+      [viewBuffer],
+      fileName,
+      fileType,
+      lastModified,
+    );
+  }
   if (typeof Blob !== "undefined" && value instanceof Blob) {
     return value;
   }
 
   const buffer = await value.arrayBuffer();
-  const fileType =
+  const fallbackType =
     typeof value.type === "string" && value.type
       ? value.type
       : "application/octet-stream";
-  if (typeof File !== "undefined") {
-    return new File([buffer], fileName, {
-      type: fileType,
-      lastModified:
-        typeof value.lastModified === "number"
-          ? value.lastModified
-          : Date.now(),
-    });
-  }
-  return new Blob([buffer], { type: fileType });
+  const normalizedType =
+    typeof fileType === "string" && fileType
+      ? fileType
+      : fallbackType;
+  return createBridgeUploadBlob(
+    [buffer],
+    fileName,
+    normalizedType,
+    typeof lastModified === "number" ? lastModified : value.lastModified,
+  );
 };
 
 const sendBridgeResponse = (requestId, ok, payload) => {
@@ -175,14 +215,145 @@ const sendBridgeResponse = (requestId, ok, payload) => {
   });
 };
 
+const getBridgeErrorMessage = (error, fallback) => {
+  const responseData = error?.response?.data;
+  if (responseData && typeof responseData === "object") {
+    if (typeof responseData.message === "string" && responseData.message) {
+      return responseData.message;
+    }
+    if (typeof responseData.error === "string" && responseData.error) {
+      return responseData.error;
+    }
+  }
+  return error?.message || fallback;
+};
+
 const closeSSEConnection = (subscriptionId) => {
-  const eventSource = sseConnections.get(subscriptionId);
-  if (eventSource) {
-    eventSource.close();
+  const connection = sseConnections.get(subscriptionId);
+  if (connection) {
+    connection.close();
     sseConnections.delete(subscriptionId);
   }
 };
 
+const getFetchErrorMessage = async (response, fallback) => {
+  let text = "";
+  try {
+    text = await response.text();
+  } catch {
+    return fallback;
+  }
+  if (!text) {
+    return fallback;
+  }
+  try {
+    const parsed = JSON.parse(text);
+    if (typeof parsed?.message === "string" && parsed.message) {
+      return parsed.message;
+    }
+    if (typeof parsed?.error === "string" && parsed.error) {
+      return parsed.error;
+    }
+  } catch {
+    return text;
+  }
+  return text;
+};
+
+const parseSSEBlock = (block, previousLastEventId) => {
+  let eventType = "message";
+  let lastEventId = previousLastEventId;
+  const dataLines = [];
+
+  for (const rawLine of block.split("\n")) {
+    if (!rawLine || rawLine.startsWith(":")) {
+      continue;
+    }
+
+    const colonIndex = rawLine.indexOf(":");
+    const field = colonIndex === -1 ? rawLine : rawLine.slice(0, colonIndex);
+    let value = colonIndex === -1 ? "" : rawLine.slice(colonIndex + 1);
+    if (value.startsWith(" ")) {
+      value = value.slice(1);
+    }
+
+    if (field === "event") {
+      eventType = value || "message";
+    } else if (field === "data") {
+      dataLines.push(value);
+    } else if (field === "id" && !value.includes("\0")) {
+      lastEventId = value;
+    }
+  }
+
+  return {
+    eventType,
+    lastEventId,
+    data: dataLines.join("\n"),
+    hasData: dataLines.length > 0,
+  };
+};
+
+const readSSEStream = async (subscriptionId, response, abortController) => {
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  let lastEventId = "";
+
+  const dispatchBufferedEvents = (flush = false) => {
+    const normalized = buffer.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+    const blocks = normalized.split("\n\n");
+    const completeBlocks = flush ? blocks : blocks.slice(0, -1);
+    buffer = flush ? "" : blocks[blocks.length - 1] || "";
+
+    for (const block of completeBlocks) {
+      if (!sseConnections.has(subscriptionId)) {
+        return;
+      }
+      const event = parseSSEBlock(block, lastEventId);
+      lastEventId = event.lastEventId;
+      if (!event.hasData) {
+        continue;
+      }
+      postToIframe({
+        kind: "sse_message",
+        subscriptionId,
+        data: event.data,
+        eventType: event.eventType,
+        lastEventId,
+      });
+    }
+  };
+
+  try {
+    while (!abortController.signal.aborted) {
+      const { done, value } = await reader.read();
+      if (done) {
+        break;
+      }
+      buffer += decoder.decode(value, { stream: true });
+      dispatchBufferedEvents();
+    }
+
+    buffer += decoder.decode();
+    if (buffer.trim()) {
+      dispatchBufferedEvents(true);
+    }
+
+    if (!abortController.signal.aborted) {
+      postToIframe({ kind: "sse_state", subscriptionId, state: "closed" });
+    }
+  } catch {
+    if (!abortController.signal.aborted) {
+      postToIframe({ kind: "sse_state", subscriptionId, state: "error" });
+    }
+  } finally {
+    if (sseConnections.get(subscriptionId)?.abortController === abortController) {
+      sseConnections.delete(subscriptionId);
+    }
+  }
+};
+
 const sendIframeContext = () => {
   if (!plugin.value || !page.value) {
     return;
@@ -233,13 +404,17 @@ const handleBridgeRequest = async (message) => {
 
     if (action === "files:upload") {
       const formData = new FormData();
-      const uploadFile = await coerceBridgeUploadFile(
-        message.file,
+      const fileName =
         typeof message.fileName === "string" && message.fileName
           ? message.fileName
-          : "upload.bin",
+          : "upload.bin";
+      const uploadFile = await coerceBridgeUploadFile(
+        message.fileBuffer || message.file,
+        fileName,
+        message.fileType,
+        message.fileLastModified,
       );
-      formData.append("file", uploadFile);
+      formData.append("file", uploadFile, fileName);
       const response = await axios.post(
         buildPluginApiPath(message.endpoint),
         formData,
@@ -294,30 +469,35 @@ const handleBridgeRequest = async (message) => {
       Object.entries(message.params || {}).forEach(([key, value]) => {
         url.searchParams.set(key, String(value));
       });
-      const eventSource = new EventSource(url.toString(), {
-        withCredentials: true,
+      const abortController = new AbortController();
+      const connection = {
+        abortController,
+        close() {
+          abortController.abort();
+        },
+      };
+      sseConnections.set(subscriptionId, connection);
+
+      const response = await fetchWithAuth(url.toString(), {
+        headers: { Accept: "text/event-stream" },
+        signal: abortController.signal,
       });
-      sseConnections.set(subscriptionId, eventSource);
-      eventSource.onopen = () => {
-        postToIframe({ kind: "sse_state", subscriptionId, state: "open" });
-      };
-      eventSource.onmessage = (event) => {
-        postToIframe({
-          kind: "sse_message",
-          subscriptionId,
-          data: event.data,
-          lastEventId: event.lastEventId,
-        });
-      };
-      eventSource.onerror = () => {
-        if (eventSource.readyState === EventSource.CLOSED) {
-          closeSSEConnection(subscriptionId);
-          postToIframe({ kind: "sse_state", subscriptionId, state: "closed" });
-          return;
-        }
-        postToIframe({ kind: "sse_state", subscriptionId, state: "error" });
-      };
+      if (!response.ok) {
+        const errorMessage = await getFetchErrorMessage(
+          response,
+          `Plugin SSE request failed with status ${response.status}.`,
+        );
+        closeSSEConnection(subscriptionId);
+        throw new Error(errorMessage);
+      }
+      if (!response.body) {
+        closeSSEConnection(subscriptionId);
+        throw new Error("Plugin SSE response body is not readable.");
+      }
+
       sendBridgeResponse(requestId, true, { subscriptionId });
+      postToIframe({ kind: "sse_state", subscriptionId, state: "open" });
+      void readSSEStream(subscriptionId, response, abortController);
       return;
     }
 
@@ -334,7 +514,7 @@ const handleBridgeRequest = async (message) => {
     sendBridgeResponse(
       requestId,
       false,
-      error?.message || "Plugin bridge request failed.",
+      getBridgeErrorMessage(error, "Plugin bridge request failed."),
     );
   }
 };
@@ -381,11 +561,7 @@ const loadPluginPage = async () => {
   cleanupSSEConnections();
 
   try {
-    const detailResponse = await axios.get("/api/plugin/detail", {
-      params: {
-        name: pluginName.value,
-      },
-    });
+    const detailResponse = await pluginApi.get(pluginName.value);
     if (detailResponse.data?.status === "error") {
       throw new Error(
         detailResponse.data.message || tm("messages.pluginPageLoadFailed"),
@@ -403,12 +579,7 @@ const loadPluginPage = async () => {
       return;
     }
 
-    const entryResponse = await axios.get("/api/plugin/page/entry", {
-      params: {
-        name: pluginName.value,
-        page: pageName.value,
-      },
-    });
+    const entryResponse = await pluginApi.page(pluginName.value, pageName.value);
     if (entryResponse.data?.status === "error") {
       throw new Error(
         entryResponse.data.message || tm("messages.pluginPageLoadFailed"),
diff --git a/dashboard/src/views/ProviderPage.vue b/dashboard/src/views/ProviderPage.vue
index 6cf583a10..94a448373 100644
--- a/dashboard/src/views/ProviderPage.vue
+++ b/dashboard/src/views/ProviderPage.vue
@@ -333,7 +333,7 @@
 <script setup>
 import { ref, watch } from 'vue'
 import { useRouter } from 'vue-router'
-import axios from 'axios'
+import { providerApi } from '@/api/v1'
 import { useModuleI18n } from '@/i18n/composables'
 import AstrBotConfig from '@/components/shared/AstrBotConfig.vue'
 import ItemCard from '@/components/shared/ItemCard.vue'
@@ -546,10 +546,10 @@ async function newProvider() {
   const wasUpdating = updatingMode.value
   try {
     if (wasUpdating) {
-      const res = await axios.post('/api/config/provider/update', {
-        id: newProviderOriginalId.value || newSelectedProviderName.value,
-        config: newSelectedProviderConfig.value
-      })
+      const res = await providerApi.update(
+        newProviderOriginalId.value || newSelectedProviderName.value,
+        newSelectedProviderConfig.value
+      )
       if (res.data.status === 'error') {
         showMessage(res.data.message || '更新失败!', 'error')
         return
@@ -559,7 +559,7 @@ async function newProvider() {
         updatingMode.value = false
       }
     } else {
-      const res = await axios.post('/api/config/provider/new', newSelectedProviderConfig.value)
+      const res = await providerApi.create(newSelectedProviderConfig.value)
       if (res.data.status === 'error') {
         showMessage(res.data.message || '添加失败!', 'error')
         return
@@ -593,7 +593,7 @@ async function copyProvider(providerToCopy) {
 
   loading.value = true
   try {
-    const res = await axios.post('/api/config/provider/new', newProviderConfig)
+    const res = await providerApi.create(newProviderConfig)
     showMessage(res.data.message || `成功复制并创建了 ${newProviderConfig.id}`)
     await loadConfig()
   } catch (err) {
@@ -607,10 +607,7 @@ async function toggleProviderEnable(provider, value) {
   provider.enable = value
 
   try {
-    const res = await axios.post('/api/config/provider/update', {
-      id: provider.id,
-      config: provider
-    })
+    const res = await providerApi.setEnabled(provider.id, { enabled: value })
 
     if (res.data.status === 'error') {
       throw new Error(res.data.message)
@@ -660,7 +657,7 @@ async function testSingleProvider(provider) {
     }
 
     const startTime = performance.now()
-    const res = await axios.get(`/api/config/provider/check_one?id=${provider.id}`)
+    const res = await providerApi.test(provider.id)
     if (!res.data || res.data.status !== 'ok') {
       throw new Error(res.data?.message || `Failed to check status for ${provider.id}`)
     }
diff --git a/dashboard/src/views/SessionManagementPage.vue b/dashboard/src/views/SessionManagementPage.vue
index 6a65c2140..2d31b7453 100644
--- a/dashboard/src/views/SessionManagementPage.vue
+++ b/dashboard/src/views/SessionManagementPage.vue
@@ -675,7 +675,7 @@
 </template>
 
 <script>
-import axios from 'axios'
+import { sessionApi } from '@/api/v1'
 import UmoDisplay from '@/components/shared/UmoDisplay.vue'
 import { useI18n, useModuleI18n } from '@/i18n/composables'
 import { askForConfirmation as askForConfirmationDialog, useConfirmDialog } from '@/utils/confirmDialog'
@@ -1008,12 +1008,10 @@ export default {
     async loadData() {
       this.loading = true
       try {
-        const response = await axios.get('/api/session/list-rule', {
-          params: {
-            page: this.currentPage,
-            page_size: this.itemsPerPage,
-            search: this.searchQuery || '',
-          },
+        const response = await sessionApi.listRules({
+          page: this.currentPage,
+          page_size: this.itemsPerPage,
+          search: this.searchQuery || '',
         })
         if (response.data.status === 'ok') {
           const data = response.data.data
@@ -1051,7 +1049,7 @@ export default {
     async loadUmos() {
       this.loadingUmos = true
       try {
-        const response = await axios.get('/api/session/active-umos')
+        const response = await sessionApi.activeUmos()
         if (response.data.status === 'ok') {
           this.mergeUmoInfos(response.data.data.umo_infos || [])
           // 过滤掉已有规则的 umo
@@ -1232,7 +1230,7 @@ export default {
         if (!config.custom_name) delete config.custom_name
         if (config.persona_id === null) delete config.persona_id
 
-        const response = await axios.post('/api/session/update-rule', {
+        const response = await sessionApi.upsertRule({
           umo: this.selectedUmo.umo,
           rule_key: 'session_service_config',
           rule_value: config,
@@ -1277,7 +1275,7 @@ export default {
           if (value && value !== FOLLOW_CONFIG_VALUE) {
             // 有值时更新
             updateTasks.push(
-              axios.post('/api/session/update-rule', {
+              sessionApi.upsertRule({
                 umo: this.selectedUmo.umo,
                 rule_key: `provider_perf_${type}`,
                 rule_value: value,
@@ -1286,7 +1284,7 @@ export default {
           } else if (this.editingRules[`provider_perf_${type}`]) {
             // 选择了"跟随配置文件" (__astrbot_follow_config__) 且之前有配置，则删除
             deleteTasks.push(
-              axios.post('/api/session/delete-rule', {
+              sessionApi.deleteRules({
                 umo: this.selectedUmo.umo,
                 rule_key: `provider_perf_${type}`,
               }),
@@ -1338,7 +1336,7 @@ export default {
         // 如果两个列表都为空，删除配置
         if (config.enabled_plugins.length === 0 && config.disabled_plugins.length === 0) {
           if (this.editingRules.session_plugin_config) {
-            await axios.post('/api/session/delete-rule', {
+            await sessionApi.deleteRules({
               umo: this.selectedUmo.umo,
               rule_key: 'session_plugin_config',
             })
@@ -1348,7 +1346,7 @@ export default {
           }
           this.showSuccess(this.tm('messages.saveSuccess'))
         } else {
-          const response = await axios.post('/api/session/update-rule', {
+          const response = await sessionApi.upsertRule({
             umo: this.selectedUmo.umo,
             rule_key: 'session_plugin_config',
             rule_value: config,
@@ -1392,7 +1390,7 @@ export default {
         // 如果 kb_ids 为空，删除配置
         if (config.kb_ids.length === 0) {
           if (this.editingRules.kb_config) {
-            await axios.post('/api/session/delete-rule', {
+            await sessionApi.deleteRules({
               umo: this.selectedUmo.umo,
               rule_key: 'kb_config',
             })
@@ -1402,7 +1400,7 @@ export default {
           }
           this.showSuccess(this.tm('messages.saveSuccess'))
         } else {
-          const response = await axios.post('/api/session/update-rule', {
+          const response = await sessionApi.upsertRule({
             umo: this.selectedUmo.umo,
             rule_key: 'kb_config',
             rule_value: config,
@@ -1442,7 +1440,7 @@ export default {
 
       this.deleting = true
       try {
-        const response = await axios.post('/api/session/delete-rule', {
+        const response = await sessionApi.deleteRules({
           umo: this.deleteTarget.umo,
         })
 
@@ -1477,7 +1475,7 @@ export default {
       this.deleting = true
       try {
         const umos = this.selectedItems.map((item) => item.umo)
-        const response = await axios.post('/api/session/batch-delete-rule', {
+        const response = await sessionApi.deleteRules({
           umos: umos,
         })
 
@@ -1536,7 +1534,7 @@ export default {
           delete config.custom_name
         }
 
-        const response = await axios.post('/api/session/update-rule', {
+        const response = await sessionApi.upsertRule({
           umo: this.quickEditNameTarget.umo,
           rule_key: 'session_service_config',
           rule_value: config,
@@ -1603,13 +1601,13 @@ export default {
           if (this.batchTtsStatus !== null) {
             serviceData.tts_enabled = this.batchTtsStatus
           }
-          tasks.push(axios.post('/api/session/batch-update-service', serviceData))
+          tasks.push(sessionApi.batchUpdateService(serviceData))
         }
 
         if (this.batchChatProvider !== null) {
           if (this.batchChatProvider === FOLLOW_CONFIG_VALUE) {
             tasks.push(
-              axios.post('/api/session/batch-delete-rule', {
+              sessionApi.deleteRules({
                 scope,
                 umos,
                 group_id: groupId,
@@ -1618,7 +1616,7 @@ export default {
             )
           } else {
             tasks.push(
-              axios.post('/api/session/batch-update-provider', {
+              sessionApi.batchUpdateProvider({
                 scope,
                 umos,
                 group_id: groupId,
@@ -1632,7 +1630,7 @@ export default {
         if (this.batchTtsProvider !== null) {
           if (this.batchTtsProvider === FOLLOW_CONFIG_VALUE) {
             tasks.push(
-              axios.post('/api/session/batch-delete-rule', {
+              sessionApi.deleteRules({
                 scope,
                 umos,
                 group_id: groupId,
@@ -1641,7 +1639,7 @@ export default {
             )
           } else {
             tasks.push(
-              axios.post('/api/session/batch-update-provider', {
+              sessionApi.batchUpdateProvider({
                 scope,
                 umos,
                 group_id: groupId,
@@ -1682,7 +1680,7 @@ export default {
     async loadGroups() {
       this.groupsLoading = true
       try {
-        const response = await axios.get('/api/session/groups')
+        const response = await sessionApi.listGroups()
         if (response.data.status === 'ok') {
           this.groups = response.data.data.groups || []
         }
@@ -1696,7 +1694,7 @@ export default {
       if (this.availableUmos.length > 0) return
       this.loadingUmos = true
       try {
-        const response = await axios.get('/api/session/active-umos')
+        const response = await sessionApi.activeUmos()
         if (response.data.status === 'ok') {
           this.mergeUmoInfos(response.data.data.umo_infos || [])
           this.availableUmos = response.data.data.umos || []
@@ -1758,13 +1756,12 @@ export default {
       try {
         let response
         if (this.groupDialogMode === 'create') {
-          response = await axios.post('/api/session/group/create', {
+          response = await sessionApi.createGroup({
             name: this.editingGroup.name,
             umos: this.editingGroup.umos,
           })
         } else {
-          response = await axios.post('/api/session/group/update', {
-            id: this.editingGroup.id,
+          response = await sessionApi.updateGroup(this.editingGroup.id, {
             name: this.editingGroup.name,
             umos: this.editingGroup.umos,
           })
@@ -1787,9 +1784,7 @@ export default {
       if (!(await askForConfirmationDialog(message, this.confirmDialog))) return
 
       try {
-        const response = await axios.post('/api/session/group/delete', {
-          id: group.id,
-        })
+        const response = await sessionApi.deleteGroup(group.id)
         if (response.data.status === 'ok') {
           this.showSuccess(response.data.data.message)
           await this.loadGroups()
@@ -1813,8 +1808,7 @@ export default {
       }
 
       try {
-        const response = await axios.post('/api/session/group/update', {
-          id: groupId,
+        const response = await sessionApi.updateGroup(groupId, {
           add_umos: this.selectedItems.map((item) => item.umo),
         })
         if (response.data.status === 'ok') {
diff --git a/dashboard/src/views/Settings.vue b/dashboard/src/views/Settings.vue
index a870841c7..cbacacd39 100644
--- a/dashboard/src/views/Settings.vue
+++ b/dashboard/src/views/Settings.vue
@@ -228,7 +228,7 @@
 
 <script setup>
 import { computed, onMounted, ref, watch } from 'vue';
-import axios from 'axios';
+import { apiKeyApi } from '@/api/v1';
 import WaitingForRestart from '@/components/shared/WaitingForRestart.vue';
 import ProxySelector from '@/components/shared/ProxySelector.vue';
 import MigrationDialog from '@/components/shared/MigrationDialog.vue';
@@ -294,7 +294,7 @@ const apiKeys = ref([]);
 const apiKeyCreating = ref(false);
 const newApiKeyName = ref('');
 const newApiKeyExpiresInDays = ref(30);
-const newApiKeyScopes = ref(['chat', 'config', 'file', 'im']);
+const newApiKeyScopes = ref(['bot', 'provider', 'im', 'config', 'chat']);
 const createdApiKeyPlaintext = ref('');
 const apiKeyExpiryOptions = computed(() => [
     { title: tm('apiKey.expiryOptions.day1'), value: 1 },
@@ -305,12 +305,54 @@ const apiKeyExpiryOptions = computed(() => [
 ]);
 
 const availableScopes = [
-    { value: 'chat', label: 'chat' },
+    { value: 'bot', label: 'bot' },
+    { value: 'provider', label: 'provider' },
+    { value: 'persona', label: 'persona' },
+    { value: 'im', label: 'im' },
     { value: 'config', label: 'config' },
-    { value: 'file', label: 'file' },
-    { value: 'im', label: 'im' }
+    { value: 'chat', label: 'chat' },
+    { value: 'plugin', label: 'plugin' },
+    { value: 'mcp', label: 'mcp' },
+    { value: 'skill', label: 'skill' }
 ];
 
+const configIncludedScopes = ['bot', 'provider'];
+const previousApiKeyScopes = ref([...newApiKeyScopes.value]);
+
+watch(
+    newApiKeyScopes,
+    (scopes) => {
+        let nextScopes = scopes;
+        const selectedScopes = new Set(scopes);
+        if (selectedScopes.has('config')) {
+            const previousScopes = new Set(previousApiKeyScopes.value);
+            const includedScopeRemoved = configIncludedScopes.some(
+                (scope) => previousScopes.has(scope) && !selectedScopes.has(scope)
+            );
+
+            if (includedScopeRemoved) {
+                selectedScopes.delete('config');
+            } else {
+                for (const scope of configIncludedScopes) {
+                    selectedScopes.add(scope);
+                }
+            }
+
+            nextScopes = availableScopes
+                .map((scopeOption) => scopeOption.value)
+                .filter((scope) => selectedScopes.has(scope));
+            if (
+                nextScopes.length !== scopes.length ||
+                nextScopes.some((scope, index) => scope !== scopes[index])
+            ) {
+                newApiKeyScopes.value = nextScopes;
+            }
+        }
+        previousApiKeyScopes.value = [...nextScopes];
+    },
+    { deep: true, immediate: true }
+);
+
 const showToast = (message, color = 'success') => {
     toastStore.add({
         message,
@@ -328,7 +370,7 @@ const formatDate = (value) => {
 
 const loadApiKeys = async () => {
     try {
-        const res = await axios.get('/api/apikey/list');
+        const res = await apiKeyApi.list();
         if (res.data.status !== 'ok') {
             showToast(res.data.message || tm('apiKey.messages.loadFailed'), 'error');
             return;
@@ -350,9 +392,15 @@ const copyCreatedApiKey = async () => {
 };
 
 const createApiKey = async () => {
+    const selectedScopeSet = new Set(newApiKeyScopes.value);
+    if (selectedScopeSet.has('config')) {
+        for (const scope of configIncludedScopes) {
+            selectedScopeSet.add(scope);
+        }
+    }
     const selectedScopes = availableScopes
         .map((scope) => scope.value)
-        .filter((scope) => newApiKeyScopes.value.includes(scope));
+        .filter((scope) => selectedScopeSet.has(scope));
 
     if (selectedScopes.length === 0) {
         showToast(tm('apiKey.messages.scopeRequired'), 'warning');
@@ -367,7 +415,7 @@ const createApiKey = async () => {
         if (newApiKeyExpiresInDays.value !== 'permanent') {
             payload.expires_in_days = Number(newApiKeyExpiresInDays.value);
         }
-        const res = await axios.post('/api/apikey/create', payload);
+        const res = await apiKeyApi.create(payload);
         if (res.data.status !== 'ok') {
             showToast(res.data.message || tm('apiKey.messages.createFailed'), 'error');
             return;
@@ -386,7 +434,7 @@ const createApiKey = async () => {
 
 const revokeApiKey = async (keyId) => {
     try {
-        const res = await axios.post('/api/apikey/revoke', { key_id: keyId });
+        const res = await apiKeyApi.revoke(keyId);
         if (res.data.status !== 'ok') {
             showToast(res.data.message || tm('apiKey.messages.revokeFailed'), 'error');
             return;
@@ -400,7 +448,7 @@ const revokeApiKey = async (keyId) => {
 
 const deleteApiKey = async (keyId) => {
     try {
-        const res = await axios.post('/api/apikey/delete', { key_id: keyId });
+        const res = await apiKeyApi.delete(keyId);
         if (res.data.status !== 'ok') {
             showToast(res.data.message || tm('apiKey.messages.deleteFailed'), 'error');
             return;
diff --git a/dashboard/src/views/SubAgentPage.vue b/dashboard/src/views/SubAgentPage.vue
index d3876ec4c..cd653184a 100644
--- a/dashboard/src/views/SubAgentPage.vue
+++ b/dashboard/src/views/SubAgentPage.vue
@@ -210,10 +210,10 @@
 </template>
 
 <script setup lang="ts">
-import axios from 'axios'
 import { computed, onBeforeUnmount, onMounted, ref } from 'vue'
 import { onBeforeRouteLeave } from 'vue-router'
 import { useTheme } from 'vuetify'
+import { subagentApi } from '@/api/v1'
 import PersonaQuickPreview from '@/components/shared/PersonaQuickPreview.vue'
 import PersonaSelector from '@/components/shared/PersonaSelector.vue'
 import ProviderSelector from '@/components/shared/ProviderSelector.vue'
@@ -302,7 +302,7 @@ function serializeConfig(config: SubAgentConfig): string {
 async function loadConfig() {
   loading.value = true
   try {
-    const res = await axios.get('/api/subagent/config')
+    const res = await subagentApi.getConfig()
     if (res.data.status === 'ok') {
       cfg.value = normalizeConfig(res.data.data)
       expandedAgents.value = Object.fromEntries(cfg.value.agents.map((agent) => [agent.__key, false]))
@@ -390,7 +390,7 @@ async function save() {
       }))
     }
 
-    const res = await axios.post('/api/subagent/config', payload)
+    const res = await subagentApi.updateConfig(payload)
     if (res.data.status === 'ok') {
       initialSnapshot.value = serializeConfig(cfg.value)
       hasLoaded.value = true
diff --git a/dashboard/src/views/TracePage.vue b/dashboard/src/views/TracePage.vue
index 4605d8680..02244bc2e 100644
--- a/dashboard/src/views/TracePage.vue
+++ b/dashboard/src/views/TracePage.vue
@@ -1,9 +1,9 @@
 <script setup>
 import TraceDisplayer from '@/components/shared/TraceDisplayer.vue';
+import { traceApi } from '@/api/v1';
 import { useModuleI18n } from '@/i18n/composables';
 import { computed, ref, onMounted } from 'vue';
 import { useTheme } from 'vuetify';
-import axios from 'axios';
 
 const { tm } = useModuleI18n('features/trace');
 const theme = useTheme();
@@ -15,7 +15,7 @@ const traceDisplayerKey = ref(0);
 
 const fetchTraceSettings = async () => {
   try {
-    const res = await axios.get('/api/trace/settings');
+    const res = await traceApi.getSettings();
     if (res.data?.status === 'ok') {
       traceEnabled.value = res.data.data?.trace_enable ?? true;
     }
@@ -27,7 +27,7 @@ const fetchTraceSettings = async () => {
 const updateTraceSettings = async () => {
   loading.value = true;
   try {
-    await axios.post('/api/trace/settings', {
+    await traceApi.updateSettings({
       trace_enable: traceEnabled.value
     });
     // Refresh the TraceDisplayer component to reconnect SSE
diff --git a/dashboard/src/views/WelcomePage.vue b/dashboard/src/views/WelcomePage.vue
index ce724f92b..278db7c30 100644
--- a/dashboard/src/views/WelcomePage.vue
+++ b/dashboard/src/views/WelcomePage.vue
@@ -196,6 +196,7 @@ import { computed, ref, watch, onMounted } from 'vue';
 import axios from 'axios';
 import AddNewPlatform from '@/components/platform/AddNewPlatform.vue';
 import ProviderConfigDialog from '@/components/chat/ProviderConfigDialog.vue';
+import { configProfileApi, providerApi, systemConfigApi } from '@/api/v1';
 import { useI18n, useModuleI18n } from '@/i18n/composables';
 import { useToast } from '@/utils/toast';
 import { MarkdownRender } from 'markstream-vue';
@@ -328,14 +329,15 @@ const greetingText = computed(() => {
 });
 
 async function loadPlatformConfigBase() {
-  const res = await axios.get('/api/config/get');
-  platformMetadata.value = res.data.data.metadata || {};
-  platformConfigData.value = res.data.data.config || {};
+  const res = await systemConfigApi.get();
+  const payload = (res.data.data || {}) as any;
+  platformMetadata.value = payload.metadata || {};
+  platformConfigData.value = payload.config || {};
 }
 
 async function fetchDefaultConfig() {
-  const res = await axios.get('/api/config/abconf', { params: { id: 'default' } });
-  return res.data?.data?.config || {};
+  const res = await configProfileApi.get('default');
+  return (res.data?.data as any)?.config || {};
 }
 
 function getChatProvidersFromTemplatePayload(payload: any) {
@@ -357,7 +359,7 @@ function getChatProvidersFromTemplatePayload(payload: any) {
 }
 
 async function fetchChatProviders() {
-  const response = await axios.get('/api/config/provider/template');
+  const response = await providerApi.schema();
   if (response.data.status !== 'ok') {
     throw new Error(response.data.message || tm('onboard.providerLoadFailed'));
   }
@@ -386,10 +388,7 @@ async function syncDefaultConfigProviderIfNeeded() {
 
   configData.provider_settings.default_provider_id = targetProviderId;
 
-  const updateRes = await axios.post('/api/config/astrbot/update', {
-    conf_id: 'default',
-    config: configData
-  });
+  const updateRes = await configProfileApi.update('default', configData);
   if (updateRes.data.status !== 'ok') {
     throw new Error(updateRes.data.message || tm('onboard.providerUpdateFailed'));
   }
@@ -429,10 +428,7 @@ async function saveComputerAccessRuntime() {
 
     configData.provider_settings.computer_use_runtime = computerAccessRuntime.value;
 
-    const updateRes = await axios.post('/api/config/astrbot/update', {
-      conf_id: 'default',
-      config: configData
-    });
+    const updateRes = await configProfileApi.update('default', configData);
     if (updateRes.data.status !== 'ok') {
       throw new Error(updateRes.data.message || tm('onboard.computerAccessUpdateFailed'));
     }
diff --git a/dashboard/src/views/alkaid/KnowledgeBase.vue b/dashboard/src/views/alkaid/KnowledgeBase.vue
index 65113034c..5069817d1 100644
--- a/dashboard/src/views/alkaid/KnowledgeBase.vue
+++ b/dashboard/src/views/alkaid/KnowledgeBase.vue
@@ -432,7 +432,7 @@
 </template>
 
 <script>
-import axios from 'axios';
+import { pluginApi, pluginExtensionApi, providerApi } from '@/api/v1';
 import ConsoleDisplayer from '@/components/shared/ConsoleDisplayer.vue';
 import { useModuleI18n } from '@/i18n/composables';
 import { normalizeTextInput } from '@/utils/inputValue';
@@ -615,20 +615,23 @@ export default {
             }
         },
         checkPlugin() {
-            axios.get('/api/plugin/get?name=astrbot_plugin_knowledge_base')
+            pluginApi.list()
                 .then(response => {
-                    if (response.data.status !== 'ok' || response.data.data.length === 0) {
+                    const plugins = (response.data.data || []).filter(
+                        plugin => plugin.name === 'astrbot_plugin_knowledge_base'
+                    );
+                    if (response.data.status !== 'ok' || plugins.length === 0) {
                         this.showSnackbar(this.tm('messages.pluginNotAvailable'), 'error');
                         this.installed = false;
                         return
                     }
-                    if (!response.data.data[0].activated) {
+                    if (!plugins[0].activated) {
                         this.showSnackbar(this.tm('messages.pluginNotActivated'), 'error');
                         return
                     }
-                    if (response.data.data.length > 0) {
+                    if (plugins.length > 0) {
                         this.installed = true;
-                        this.pluginCurrentVersion = response.data.data[0].version || '未知';
+                        this.pluginCurrentVersion = plugins[0].version || '未知';
                         this.getKBCollections();
                         // 自动检查更新
                         this.checkPluginUpdate();
@@ -647,7 +650,7 @@ export default {
             this.pluginHasUpdate = false;
             try {
                 // 获取在线插件数据
-                const onlineResponse = await axios.get('/api/plugin/market_list');
+                const onlineResponse = await pluginApi.market();
                 if (onlineResponse.data.status === 'ok') {
                     const knowledgeBasePlugin = onlineResponse.data.data['astrbot_plugin_knowledge_base'];
                     if (knowledgeBasePlugin) {
@@ -684,8 +687,7 @@ export default {
         async updatePlugin() {
             this.updatingPlugin = true;
             try {
-                const response = await axios.post('/api/plugin/update', {
-                    name: 'astrbot_plugin_knowledge_base',
+                const response = await pluginApi.update('astrbot_plugin_knowledge_base', {
                     proxy: this.getSelectedGitHubProxy()
                 });
 
@@ -708,8 +710,8 @@ export default {
 
         installPlugin() {
             this.installing = true;
-            axios.post('/api/plugin/install', {
-                url: "https://github.com/lxfight/astrbot_plugin_knowledge_base",
+            pluginApi.installGithub({
+                repository: "https://github.com/lxfight/astrbot_plugin_knowledge_base",
                 proxy: this.getSelectedGitHubProxy()
             })
                 .then(response => {
@@ -728,7 +730,7 @@ export default {
         },
 
         getKBCollections() {
-            axios.get('/api/plug/alkaid/kb/collections')
+            pluginExtensionApi.get('alkaid/kb/collections')
                 .then(response => {
                     if (response.data.status !== 'ok') {
                         this.showSnackbar(response.data.message || this.tm('messages.getKnowledgeBaseListFailed'), 'error');
@@ -750,7 +752,7 @@ export default {
             if (this.newKB.rerank_provider_id && typeof this.newKB.rerank_provider_id === 'object') {
                 this.newKB.rerank_provider_id = this.newKB.rerank_provider_id.id || '';
             }
-            axios.post('/api/plug/alkaid/kb/create_collection', {
+            pluginExtensionApi.post('alkaid/kb/create_collection', {
                 collection_name: name,
                 emoji: emoji,
                 description: description,
@@ -885,7 +887,7 @@ export default {
                 formData.append('chunk_overlap', this.overlap);
             }
 
-            axios.post('/api/plug/alkaid/kb/collection/add_file', formData)
+            pluginExtensionApi.post('alkaid/kb/collection/add_file', formData)
                 .then(response => {
                     if (response.data.status === 'ok') {
                         this.showSnackbar(this.tm('messages.operationSuccess', { message: response.data.message }));
@@ -916,7 +918,7 @@ export default {
             this.searching = true;
             this.searchPerformed = true;
 
-            axios.get(`/api/plug/alkaid/kb/collection/search`, {
+            pluginExtensionApi.get('alkaid/kb/collection/search', {
                 params: {
                     collection_name: this.currentKB.collection_name,
                     query,
@@ -969,7 +971,7 @@ export default {
 
             this.deleting = true;
 
-            axios.get('/api/plug/alkaid/kb/collection/delete', {
+            pluginExtensionApi.get('alkaid/kb/collection/delete', {
                 params: {
                     collection_name: this.deleteTarget.collection_name
                 }
@@ -993,11 +995,7 @@ export default {
         },
 
         getProviderList() {
-            axios.get('/api/config/provider/list', {
-                params: {
-                    provider_type: 'embedding,rerank,chat_completion'
-                }
-            })
+            providerApi.listByProviderType('embedding,rerank,chat_completion')
                 .then(response => {
                     if (response.data.status === 'ok') {
                         this.embeddingProviderConfigs = response.data.data.filter(provider => provider.provider_type === 'embedding');
@@ -1035,7 +1033,7 @@ export default {
                 };
 
                 console.log('Starting URL import with payload:', JSON.stringify(payload, null, 2));
-                const addTaskResponse = await axios.post('/api/plug/url_2_kb/add', payload);
+                const addTaskResponse = await pluginExtensionApi.post('url_2_kb/add', payload);
 
                 if (!addTaskResponse.data.task_id) {
                     throw new Error(addTaskResponse.data.message || 'Failed to start import task: No task_id received.');
@@ -1054,7 +1052,7 @@ export default {
         pollTaskStatus(taskId) {
             this.pollingInterval = setInterval(async () => {
                 try {
-                    const statusResponse = await axios.post(`/api/plug/url_2_kb/status`, { task_id: taskId });
+                    const statusResponse = await pluginExtensionApi.post('url_2_kb/status', { task_id: taskId });
 
                     const taskData = statusResponse.data;
                     const taskStatus = taskData.status;
@@ -1153,7 +1151,7 @@ export default {
                 formData.append('chunk_overlap', this.importOptions.chunk_overlap);
             }
 
-            const response = await axios.post('/api/plug/alkaid/kb/collection/add_file', formData, {
+            const response = await pluginExtensionApi.post('alkaid/kb/collection/add_file', formData, {
                 headers: {
                     'Content-Type': 'multipart/form-data'
                 }
diff --git a/dashboard/src/views/alkaid/LongTermMemory.vue b/dashboard/src/views/alkaid/LongTermMemory.vue
index 327c27e4b..5915f5b81 100644
--- a/dashboard/src/views/alkaid/LongTermMemory.vue
+++ b/dashboard/src/views/alkaid/LongTermMemory.vue
@@ -253,7 +253,7 @@
 </template>
 
 <script>
-import axios from 'axios';
+import { pluginExtensionApi } from '@/api/v1';
 // import * as d3 from "d3"; // npm install d3
 import { useModuleI18n } from '@/i18n/composables';
 import { normalizeTextInput } from '@/utils/inputValue';
@@ -368,7 +368,7 @@ export default {
         params.user_id = normalizedUserId;
       }
 
-      axios.get('/api/plug/alkaid/ltm/graph/search', { params })
+      pluginExtensionApi.get('alkaid/ltm/graph/search', { params })
         .then(response => {
           if (response.data.status === 'ok') {
             const data = response.data.data;
@@ -415,7 +415,7 @@ export default {
         need_summarize: this.needSummarize
       };
 
-      axios.post('/api/plug/alkaid/ltm/graph/add', payload)
+      pluginExtensionApi.post('alkaid/ltm/graph/add', payload)
         .then(response => {
           // 成功添加后刷新图表
           this.refreshGraph();
@@ -440,7 +440,7 @@ export default {
       this.isLoading = true;
       const params = userId ? { user_id: userId } : {};
 
-      axios.get('/api/plug/alkaid/ltm/graph', { params })
+      pluginExtensionApi.get('alkaid/ltm/graph', { params })
         .then(response => {
           const data = response.data.data || {};
           // 确保数据是数组类型，并且先检查data是否存在
@@ -499,7 +499,7 @@ export default {
     },
 
     ltmGetUserIds() {
-      axios.get('/api/plug/alkaid/ltm/user_ids')
+      pluginExtensionApi.get('alkaid/ltm/user_ids')
         .then(response => {
           // 确保返回的数据是数组类型
           const data = response.data.data;
@@ -546,7 +546,7 @@ export default {
       this.selectedEdgeFactData = null;
       this.parsedMetadata = null;
       
-      axios.get('/api/plug/alkaid/ltm/graph/fact', { 
+      pluginExtensionApi.get('alkaid/ltm/graph/fact', { 
         params: { fact_id: factId } 
       })
         .then(response => {
diff --git a/dashboard/src/views/authentication/auth/LoginPage.vue b/dashboard/src/views/authentication/auth/LoginPage.vue
index d6a8a7731..78d69326d 100644
--- a/dashboard/src/views/authentication/auth/LoginPage.vue
+++ b/dashboard/src/views/authentication/auth/LoginPage.vue
@@ -7,7 +7,7 @@ import { useRouter } from 'vue-router';
 import { useCustomizerStore } from "@/stores/customizer";
 import { useModuleI18n } from '@/i18n/composables';
 import { useTheme } from 'vuetify';
-import axios from 'axios';
+import { authApi } from '@/api/v1';
 
 const cardVisible = ref(false);
 const router = useRouter();
@@ -54,7 +54,7 @@ onMounted(async () => {
   }
 
   try {
-    const setupStatus = await axios.get('/api/auth/setup-status');
+    const setupStatus = await authApi.setupStatus();
     if (
       setupStatus.data?.data?.setup_required &&
       setupStatus.data?.data?.skip_default_password_auth
diff --git a/dashboard/src/views/authentication/auth/SetupPage.vue b/dashboard/src/views/authentication/auth/SetupPage.vue
index 1e769d9e6..32d6bcf06 100644
--- a/dashboard/src/views/authentication/auth/SetupPage.vue
+++ b/dashboard/src/views/authentication/auth/SetupPage.vue
@@ -7,7 +7,7 @@ import { useRouter } from 'vue-router';
 import { useCustomizerStore } from '@/stores/customizer';
 import { useModuleI18n } from '@/i18n/composables';
 import { useTheme } from 'vuetify';
-import axios from 'axios';
+import { authApi } from '@/api/v1';
 
 const router = useRouter();
 const authStore = useAuthStore();
@@ -36,7 +36,7 @@ onMounted(async () => {
   const hasToken = authStore.has_token();
 
   try {
-    const setupStatus = await axios.get('/api/auth/setup-status');
+    const setupStatus = await authApi.setupStatus();
     const setupRequired = !!setupStatus.data?.data?.setup_required;
     const canSkipDefaultPassword = !!setupStatus.data?.data?.skip_default_password_auth;
     if (
diff --git a/dashboard/src/views/extension/InstalledPluginsTab.vue b/dashboard/src/views/extension/InstalledPluginsTab.vue
index fecbd0e59..5e41bc68b 100644
--- a/dashboard/src/views/extension/InstalledPluginsTab.vue
+++ b/dashboard/src/views/extension/InstalledPluginsTab.vue
@@ -49,8 +49,8 @@ const {
   dangerConfirmDialog,
   selectedDangerPlugin,
   selectedMarketInstallPlugin,
-  installCompat,
-  versionCompatibilityDialog,
+  installSupport,
+  versionSupportDialog,
   showUninstallDialog,
   uninstallTarget,
   showSourceDialog,
@@ -129,7 +129,7 @@ const {
   saveCustomSource,
   trimExtensionName,
   checkAlreadyInstalled,
-  showVersionCompatibilityWarning,
+  showVersionSupportWarning,
   continueInstallIgnoringVersionWarning,
   cancelInstallOnVersionWarning,
   newExtension,
@@ -137,7 +137,7 @@ const {
   getPlatformDisplayList,
   resolveSelectedInstallPlugin,
   selectedInstallPlugin,
-  checkInstallCompatibility,
+  checkInstallVersionSupport,
   refreshPluginMarket,
   handleLocaleChange,
   searchDebounceTimer,
diff --git a/dashboard/src/views/extension/MarketPluginsTab.vue b/dashboard/src/views/extension/MarketPluginsTab.vue
index c4988d6e8..4a60f7bc7 100644
--- a/dashboard/src/views/extension/MarketPluginsTab.vue
+++ b/dashboard/src/views/extension/MarketPluginsTab.vue
@@ -53,8 +53,8 @@ const {
   dangerConfirmDialog,
   selectedDangerPlugin,
   selectedMarketInstallPlugin,
-  installCompat,
-  versionCompatibilityDialog,
+  installSupport,
+  versionSupportDialog,
   showUninstallDialog,
   uninstallTarget,
   showSourceDialog,
@@ -136,7 +136,7 @@ const {
   saveCustomSource,
   trimExtensionName,
   checkAlreadyInstalled,
-  showVersionCompatibilityWarning,
+  showVersionSupportWarning,
   continueInstallIgnoringVersionWarning,
   cancelInstallOnVersionWarning,
   newExtension,
@@ -144,7 +144,7 @@ const {
   getPlatformDisplayList,
   resolveSelectedInstallPlugin,
   selectedInstallPlugin,
-  checkInstallCompatibility,
+  checkInstallVersionSupport,
   refreshPluginMarket,
   handleLocaleChange,
   searchDebounceTimer,
diff --git a/dashboard/src/views/extension/PluginDetailPage.vue b/dashboard/src/views/extension/PluginDetailPage.vue
index 10a15b33a..97b0fa7e3 100644
--- a/dashboard/src/views/extension/PluginDetailPage.vue
+++ b/dashboard/src/views/extension/PluginDetailPage.vue
@@ -11,6 +11,7 @@ import axios from "axios";
 import DOMPurify from "dompurify";
 import MarkdownIt from "markdown-it";
 import defaultPluginIcon from "@/assets/images/plugin_icon.png";
+import { pluginApi } from "@/api/v1";
 import { usePluginI18n } from "@/utils/pluginI18n";
 import PluginPlatformChip from "@/components/shared/PluginPlatformChip.vue";
 
@@ -334,7 +335,7 @@ const componentGroupIcons = {
   hook: "mdi-hook",
 };
 
-const getLegacyHandlerGroupKey = (handler) => {
+const getFallbackHandlerGroupKey = (handler) => {
   const type = String(handler?.type || "").trim();
   const eventType = String(handler?.event_type || "").trim();
   const eventTypeH = String(handler?.event_type_h || "").trim();
@@ -356,7 +357,7 @@ const getComponentGroupKey = (component) => {
     component?.type || component?.component_type || "",
   ).trim();
   if (componentGroupOrder.includes(type)) return type;
-  return getLegacyHandlerGroupKey(component);
+  return getFallbackHandlerGroupKey(component);
 };
 
 const normalizeComponent = (component, fallbackType = "") => {
@@ -394,7 +395,7 @@ const normalizeComponentList = (source) => {
 
   return normalizeHandlerList(source).map((handler) => ({
     ...handler,
-    type: getLegacyHandlerGroupKey(handler),
+    type: getFallbackHandlerGroupKey(handler),
   }));
 };
 
@@ -575,9 +576,7 @@ const fetchPluginDetail = async () => {
   if (isMarketDetail.value || !props.plugin?.name) return;
 
   try {
-    const res = await axios.get("/api/plugin/detail", {
-      params: { name: props.plugin.name },
-    });
+    const res = await pluginApi.get(props.plugin.name);
     if (res.data.status === "ok" && res.data.data) {
       pluginDetail.value = res.data.data;
       await scrollToHashTarget();
@@ -651,9 +650,7 @@ const fetchReadme = async () => {
   }
 
   try {
-    const res = await axios.get("/api/plugin/readme", {
-      params: { name: plugin.name },
-    });
+    const res = await pluginApi.readme(plugin.name);
 
     if (res.data.status !== "ok") {
       readmeError.value = res.data.message || tm("messages.operationFailed");
@@ -707,9 +704,7 @@ const fetchChangelog = async () => {
   }
 
   try {
-    const res = await axios.get("/api/plugin/changelog", {
-      params: { name: plugin.name },
-    });
+    const res = await pluginApi.changelog(plugin.name);
 
     if (res.data.status !== "ok") {
       changelogError.value = res.data.message || tm("messages.operationFailed");
diff --git a/dashboard/src/views/extension/useExtensionPage.js b/dashboard/src/views/extension/useExtensionPage.js
index 7476d252a..3d48c4e43 100644
--- a/dashboard/src/views/extension/useExtensionPage.js
+++ b/dashboard/src/views/extension/useExtensionPage.js
@@ -1,3 +1,4 @@
+import { commandApi, pluginApi } from "@/api/v1";
 import { pluginSidebarState } from "@/composables/usePluginSidebarItems";
 import { useI18n, useModuleI18n } from "@/i18n/composables";
 import { useCommonStore } from "@/stores/common";
@@ -11,7 +12,6 @@ import {
     toInitials,
     toPinyinText,
 } from "@/utils/pluginSearch";
-import axios from "axios";
 import { computed, onMounted, onUnmounted, reactive, ref, watch } from "vue";
 import { useRoute, useRouter } from "vue-router";
 
@@ -51,7 +51,7 @@ export const useExtensionPage = () => {
   });
   const checkAndPromptConflicts = async () => {
     try {
-      const res = await axios.get("/api/commands");
+      const res = await commandApi.list();
       if (res.data.status === "ok") {
         const conflicts = res.data.data.summary?.conflicts || 0;
         if (conflicts > 0) {
@@ -146,14 +146,14 @@ export const useExtensionPage = () => {
   const dangerConfirmDialog = ref(false);
   const selectedDangerPlugin = ref(null);
   const selectedMarketInstallPlugin = ref(null);
-  const installCompat = reactive({
+  const installSupport = reactive({
     checked: false,
-    compatible: true,
+    supported: true,
     message: "",
   });
 
   // AstrBot 版本范围不兼容警告对话框
-  const versionCompatibilityDialog = reactive({
+  const versionSupportDialog = reactive({
     show: false,
     message: "",
   });
@@ -479,13 +479,13 @@ export const useExtensionPage = () => {
       loading_.value = true;
     }
     try {
-      const res = await axios.get("/api/plugin/get");
+      const res = await pluginApi.list();
       Object.assign(extension_data, res.data);
 
       // 同步插件数据到侧边栏共享状态
       pluginSidebarState.plugins = (res.data?.data || []);
 
-      const failRes = await axios.get("/api/plugin/source/get-failed-plugins");
+      const failRes = await pluginApi.failed();
       failedPluginsDict.value = failRes.data.data || {};
 
       // checkUpdate() is called after pluginMarketData is loaded in onMounted
@@ -508,7 +508,7 @@ export const useExtensionPage = () => {
     loading_.value = true;
     try {
       const promises = dirNames.map((dir) =>
-        axios.post("/api/plugin/reload-failed", { dir_name: dir }),
+        pluginApi.reloadFailed(dir),
       );
       await Promise.all(promises);
 
@@ -531,9 +531,7 @@ export const useExtensionPage = () => {
     if (!dirName) return;
 
     try {
-      const res = await axios.post("/api/plugin/reload-failed", {
-        dir_name: dirName,
-      });
+      const res = await pluginApi.reloadFailed(dirName);
       if (res.data.status === "error") {
         toast(res.data.message || tm("messages.reloadFailed"), "error");
         return;
@@ -563,25 +561,17 @@ export const useExtensionPage = () => {
     }
 
     const isFailed = target.kind === "failed";
-    const endpoint = isFailed
-      ? "/api/plugin/uninstall-failed"
-      : "/api/plugin/uninstall";
-    const payload = isFailed
-      ? {
-          dir_name: target.id,
-          delete_config: deleteConfig,
-          delete_data: deleteData,
-        }
-      : {
-          name: target.id,
-          delete_config: deleteConfig,
-          delete_data: deleteData,
-        };
+    const options = {
+      delete_config: deleteConfig,
+      delete_data: deleteData,
+    };
 
     toast(`${tm("messages.uninstalling")} ${target.id}`, "primary");
 
     try {
-      const res = await axios.post(endpoint, payload);
+      const res = isFailed
+        ? await pluginApi.uninstallFailed(target.id, options)
+        : await pluginApi.uninstall(target.id, options);
       if (res.data.status === "error") {
         toast(res.data.message, "error");
         return;
@@ -750,8 +740,7 @@ export const useExtensionPage = () => {
     loadingDialog.result = "";
     loadingDialog.show = true;
     try {
-      const res = await axios.post("/api/plugin/update", {
-        name: extensionName,
+      const res = await pluginApi.update(extensionName, {
         download_url: downloadUrl,
         proxy: downloadUrl ? "" : getSelectedGitHubProxy(),
       });
@@ -832,7 +821,7 @@ export const useExtensionPage = () => {
         .filter(([, downloadUrl]) => downloadUrl),
     );
     try {
-      const res = await axios.post("/api/plugin/update-all", {
+      const res = await pluginApi.updateMany({
         names: targets,
         download_urls: downloadUrls,
         proxy: getSelectedGitHubProxy(),
@@ -884,7 +873,7 @@ export const useExtensionPage = () => {
 
   const pluginOn = async (extension) => {
     try {
-      const res = await axios.post("/api/plugin/on", { name: extension.name });
+      const res = await pluginApi.setEnabled(extension.name, true);
       if (res.data.status === "error") {
         toast(res.data.message, "error");
         return;
@@ -900,7 +889,7 @@ export const useExtensionPage = () => {
 
   const pluginOff = async (extension) => {
     try {
-      const res = await axios.post("/api/plugin/off", { name: extension.name });
+      const res = await pluginApi.setEnabled(extension.name, false);
       if (res.data.status === "error") {
         toast(res.data.message, "error");
         return;
@@ -917,9 +906,7 @@ export const useExtensionPage = () => {
     currentConfigPlugin.value = extension_name;
     configDialog.value = true;
     try {
-      const res = await axios.get(
-        "/api/config/get?plugin_name=" + extension_name,
-      );
+      const res = await pluginApi.config(extension_name);
       extension_config.metadata = res.data.data.metadata;
       extension_config.config = res.data.data.config;
       extension_config.i18n = res.data.data.i18n || {};
@@ -930,8 +917,8 @@ export const useExtensionPage = () => {
 
   const updateConfig = async () => {
     try {
-      const res = await axios.post(
-        "/api/config/plugin/update?plugin_name=" + curr_namespace.value,
+      const res = await pluginApi.updateConfig(
+        curr_namespace.value,
         extension_config.config,
       );
       if (res.data.status === "ok") {
@@ -961,7 +948,7 @@ export const useExtensionPage = () => {
 
   const reloadPlugin = async (plugin_name) => {
     try {
-      const res = await axios.post("/api/plugin/reload", { name: plugin_name });
+      const res = await pluginApi.reload(plugin_name);
       if (res.data.status === "error") {
         toast(res.data.message || tm("messages.reloadFailed"), "error");
         return;
@@ -991,9 +978,9 @@ export const useExtensionPage = () => {
     extension_url.value = "";
     upload_file.value = null;
     uploadTab.value = "file";
-    installCompat.checked = false;
-    installCompat.compatible = true;
-    installCompat.message = "";
+    installSupport.checked = false;
+    installSupport.supported = true;
+    installSupport.message = "";
   };
 
   const openInstallDialog = () => {
@@ -1066,9 +1053,9 @@ export const useExtensionPage = () => {
   // 自定义插件源管理方法
   const loadCustomSources = async () => {
     try {
-      const res = await axios.get("/api/plugin/source/get");
+      const res = await pluginApi.sources();
       if (res.data.status === "ok") {
-        customSources.value = res.data.data;
+        customSources.value = res.data.data?.sources || res.data.data || [];
       } else {
         toast(res.data.message, "error");
       }
@@ -1086,9 +1073,7 @@ export const useExtensionPage = () => {
 
   const saveCustomSources = async () => {
     try {
-      const res = await axios.post("/api/plugin/source/save", {
-        sources: customSources.value,
-      });
+      const res = await pluginApi.replaceSources(customSources.value);
       if (res.data.status !== "ok") {
         toast(res.data.message, "error");
       }
@@ -1324,7 +1309,7 @@ export const useExtensionPage = () => {
     return 0;
   };
 
-  const getCompatibleReleaseUpperBound = (version) => {
+  const getSupportedReleaseUpperBound = (version) => {
     const parts = normalizeVersionParts(version);
     if (parts.length <= 2) {
       return `${(parts[0] || 0) + 1}.0`;
@@ -1346,7 +1331,7 @@ export const useExtensionPage = () => {
         compareVersions(currentVersion, normalizedTarget) >= 0 &&
         compareVersions(
           currentVersion,
-          getCompatibleReleaseUpperBound(normalizedTarget),
+          getSupportedReleaseUpperBound(normalizedTarget),
         ) < 0
       );
     }
@@ -1362,13 +1347,13 @@ export const useExtensionPage = () => {
     return comparison === 0;
   };
 
-  const checkAstrBotVersionCompatibility = (versionSpec, currentVersion) => {
+  const checkAstrBotVersionSupport = (versionSpec, currentVersion) => {
     const normalizedSpec = normalizeAstrBotVersionSpec(versionSpec);
     if (!normalizedSpec) {
-      return { checked: false, compatible: true, message: "" };
+      return { checked: false, supported: true, message: "" };
     }
     if (!currentVersion) {
-      return { checked: false, compatible: true, message: "" };
+      return { checked: false, supported: true, message: "" };
     }
 
     const constraints = normalizedSpec
@@ -1376,49 +1361,49 @@ export const useExtensionPage = () => {
       .map((item) => item.trim())
       .filter(Boolean);
     if (!constraints.length) {
-      return { checked: false, compatible: true, message: "" };
+      return { checked: false, supported: true, message: "" };
     }
 
     for (const constraint of constraints) {
-      const compatible = checkVersionConstraint(currentVersion, constraint);
-      if (compatible === null) {
+      const supported = checkVersionConstraint(currentVersion, constraint);
+      if (supported === null) {
         return {
           checked: true,
-          compatible: false,
+          supported: false,
           message:
             "Invalid astrbot_version. Use a PEP 440 range, e.g. >=4.16,<5.",
         };
       }
-      if (!compatible) {
+      if (!supported) {
         return {
           checked: true,
-          compatible: false,
+          supported: false,
           message: `AstrBot ${currentVersion} does not satisfy plugin astrbot_version: ${normalizedSpec}`,
         };
       }
     }
 
-    return { checked: true, compatible: true, message: "" };
+    return { checked: true, supported: true, message: "" };
   };
 
-  const annotateMarketCompatibility = async () => {
+  const annotateMarketVersionSupport = async () => {
     const currentVersion =
       commonStore.astrbotVersion ||
       (await commonStore.fetchAstrBotVersion().catch(() => ""));
     pluginMarketData.value.forEach((plugin) => {
-      const result = checkAstrBotVersionCompatibility(
+      const result = checkAstrBotVersionSupport(
         plugin?.astrbot_version,
         currentVersion,
       );
-      plugin.astrbot_compat_checked = result.checked;
-      plugin.astrbot_compatible = result.compatible;
-      plugin.astrbot_compat_message = result.message;
+      plugin.astrbot_support_checked = result.checked;
+      plugin.astrbot_version_supported = result.supported;
+      plugin.astrbot_support_message = result.message;
     });
   };
 
-  const showVersionCompatibilityWarning = (message) => {
-    versionCompatibilityDialog.message = message;
-    versionCompatibilityDialog.show = true;
+  const showVersionSupportWarning = (message) => {
+    versionSupportDialog.message = message;
+    versionSupportDialog.show = true;
   };
 
   const refreshExtensionsAfterInstallFailure = async () => {
@@ -1433,21 +1418,21 @@ export const useExtensionPage = () => {
   };
 
   const continueInstallIgnoringVersionWarning = async () => {
-    versionCompatibilityDialog.show = false;
+    versionSupportDialog.show = false;
     await newExtension(true);
   };
 
   const cancelInstallOnVersionWarning = () => {
-    versionCompatibilityDialog.show = false;
+    versionSupportDialog.show = false;
   };
 
   const handleInstallResponse = async (resData) => {
     if (
       resData.status === "warning" &&
-      resData.data?.warning_type === "astrbot_version_incompatible"
+      resData.data?.warning_type === "astrbot_version_unsupported"
     ) {
       toast(resData.message, "warning");
-      showVersionCompatibilityWarning(resData.message);
+      showVersionSupportWarning(resData.message);
       await refreshExtensionsAfterInstallFailure();
       return false;
     }
@@ -1462,23 +1447,24 @@ export const useExtensionPage = () => {
   };
 
   const performInstallRequest = async ({ source, ignoreVersionCheck }) => {
+    const shouldIgnoreVersionCheck = ignoreVersionCheck === true;
     if (source === "file") {
       const formData = new FormData();
       formData.append("file", upload_file.value);
-      formData.append("ignore_version_check", String(ignoreVersionCheck));
-      return axios.post("/api/plugin/install-upload", formData, {
-        headers: {
-          "Content-Type": "multipart/form-data",
-        },
-      });
+      formData.append("ignore_version_check", String(shouldIgnoreVersionCheck));
+      return pluginApi.installUpload(formData);
     }
 
-    return axios.post("/api/plugin/install", {
+    const payload = {
       url: extension_url.value,
       download_url: selectedInstallDownloadUrl.value,
       proxy: selectedInstallDownloadUrl.value ? "" : getSelectedGitHubProxy(),
-      ignore_version_check: ignoreVersionCheck,
-    });
+      ignore_version_check: shouldIgnoreVersionCheck,
+    };
+
+    return installUsesGithubSource.value
+      ? pluginApi.installGithub(payload)
+      : pluginApi.installUrl(payload);
   };
 
   const finalizeSuccessfulInstall = async (resData, source) => {
@@ -1504,6 +1490,7 @@ export const useExtensionPage = () => {
   };
 
   const newExtension = async (ignoreVersionCheck = false) => {
+    const shouldIgnoreVersionCheck = ignoreVersionCheck === true;
     if (extension_url.value === "" && upload_file.value === null) {
       toast(tm("messages.fillUrlOrFile"), "error");
       return;
@@ -1517,7 +1504,10 @@ export const useExtensionPage = () => {
     loading_.value = true;
 
     try {
-      const res = await performInstallRequest({ source, ignoreVersionCheck });
+      const res = await performInstallRequest({
+        source,
+        ignoreVersionCheck: shouldIgnoreVersionCheck,
+      });
       loading_.value = false;
 
       const canContinue = await handleInstallResponse(res.data);
@@ -1583,10 +1573,10 @@ export const useExtensionPage = () => {
       isGithubRepoUrl(selectedUpdateSourceUrl.value),
   );
 
-  const checkInstallCompatibility = async () => {
-    installCompat.checked = false;
-    installCompat.compatible = true;
-    installCompat.message = "";
+  const checkInstallVersionSupport = async () => {
+    installSupport.checked = false;
+    installSupport.supported = true;
+    installSupport.message = "";
 
     const plugin = selectedInstallPlugin.value;
     if (!plugin?.astrbot_version || uploadTab.value !== "url") {
@@ -1596,13 +1586,13 @@ export const useExtensionPage = () => {
     const currentVersion =
       commonStore.astrbotVersion ||
       (await commonStore.fetchAstrBotVersion().catch(() => ""));
-    const result = checkAstrBotVersionCompatibility(
+    const result = checkAstrBotVersionSupport(
       plugin.astrbot_version,
       currentVersion,
     );
-    installCompat.checked = result.checked;
-    installCompat.compatible = result.compatible;
-    installCompat.message = result.message;
+    installSupport.checked = result.checked;
+    installSupport.supported = result.supported;
+    installSupport.message = result.message;
   };
 
   // 刷新插件市场数据
@@ -1618,7 +1608,7 @@ export const useExtensionPage = () => {
       pluginMarketData.value = data;
       trimExtensionName();
       checkAlreadyInstalled();
-      await annotateMarketCompatibility();
+      await annotateMarketVersionSupport();
       checkUpdate();
       refreshRandomPlugins();
       currentPage.value = 1; // 重置到第一页
@@ -1660,7 +1650,7 @@ export const useExtensionPage = () => {
       pluginMarketData.value = data;
       trimExtensionName();
       checkAlreadyInstalled();
-      await annotateMarketCompatibility();
+      await annotateMarketVersionSupport();
       checkUpdate();
       refreshRandomPlugins();
     } catch (err) {
@@ -1704,15 +1694,15 @@ export const useExtensionPage = () => {
     [() => dialog.value, () => extension_url.value, () => uploadTab.value],
     async ([dialogOpen, _, currentUploadTab]) => {
       if (!dialogOpen || currentUploadTab !== "url") {
-        installCompat.checked = false;
-        installCompat.compatible = true;
-        installCompat.message = "";
+        installSupport.checked = false;
+        installSupport.supported = true;
+        installSupport.message = "";
         if (!dialogOpen) {
           selectedMarketInstallPlugin.value = null;
         }
         return;
       }
-      await checkInstallCompatibility();
+      await checkInstallVersionSupport();
     },
   );
 
@@ -1790,8 +1780,8 @@ export const useExtensionPage = () => {
     dangerConfirmDialog,
     selectedDangerPlugin,
     selectedMarketInstallPlugin,
-    installCompat,
-    versionCompatibilityDialog,
+    installSupport,
+    versionSupportDialog,
     showUninstallDialog,
     uninstallTarget,
     showSourceDialog,
@@ -1876,7 +1866,7 @@ export const useExtensionPage = () => {
     saveCustomSource,
     trimExtensionName,
     checkAlreadyInstalled,
-    showVersionCompatibilityWarning,
+    showVersionSupportWarning,
     continueInstallIgnoringVersionWarning,
     cancelInstallOnVersionWarning,
     newExtension,
@@ -1892,7 +1882,7 @@ export const useExtensionPage = () => {
     selectedUpdateDownloadUrl,
     selectedUpdateSourceUrl,
     updateUsesGithubSource,
-    checkInstallCompatibility,
+    checkInstallVersionSupport,
     refreshPluginMarket,
     handleLocaleChange,
     searchDebounceTimer,
diff --git a/dashboard/src/views/knowledge-base/DocumentDetail.vue b/dashboard/src/views/knowledge-base/DocumentDetail.vue
index 921315e62..493210adc 100644
--- a/dashboard/src/views/knowledge-base/DocumentDetail.vue
+++ b/dashboard/src/views/knowledge-base/DocumentDetail.vue
@@ -235,7 +235,7 @@
 <script setup lang="ts">
 import { ref, computed, onMounted } from 'vue'
 import { useRoute } from 'vue-router'
-import axios from 'axios'
+import { knowledgeApi } from '@/api/v1'
 import { useModuleI18n } from '@/i18n/composables'
 import { askForConfirmation, useConfirmDialog } from '@/utils/confirmDialog'
 
@@ -294,9 +294,7 @@ const filteredChunks = computed(() => {
 const loadDocument = async () => {
   loading.value = true
   try {
-    const response = await axios.get('/api/kb/document/get', {
-      params: { doc_id: docId.value, kb_id: kbId.value }
-    })
+    const response = await knowledgeApi.document(kbId.value, docId.value)
     if (response.data.status === 'ok') {
       document.value = response.data.data
     }
@@ -312,13 +310,10 @@ const loadDocument = async () => {
 const loadChunks = async () => {
   loadingChunks.value = true
   try {
-    const response = await axios.get('/api/kb/chunk/list', {
-      params: { 
-        doc_id: docId.value, 
-        kb_id: kbId.value,
+    const response = await knowledgeApi.chunks(kbId.value, {
+        document_id: docId.value, 
         page: page.value,
         page_size: pageSize.value
-      }
     })
     if (response.data.status === 'ok') {
       chunks.value = response.data.data.items || []
@@ -354,11 +349,7 @@ const viewChunk = (chunk: any) => {
 const deleteChunk = async (chunk: any) => {
   if (!(await askForConfirmation(t('chunks.deleteConfirm'), confirmDialog))) return
   try {
-    const response = await axios.post('/api/kb/chunk/delete', {
-      chunk_id: chunk.chunk_id,
-      doc_id: docId.value,
-      kb_id: kbId.value
-    })
+    const response = await knowledgeApi.deleteChunk(kbId.value, chunk.chunk_id, docId.value)
     if (response.data.status === 'ok') {
       showSnackbar(t('chunks.deleteSuccess'))
       loadChunks()
diff --git a/dashboard/src/views/knowledge-base/KBDetail.vue b/dashboard/src/views/knowledge-base/KBDetail.vue
index b1570bad4..13797939e 100644
--- a/dashboard/src/views/knowledge-base/KBDetail.vue
+++ b/dashboard/src/views/knowledge-base/KBDetail.vue
@@ -158,7 +158,7 @@
 <script setup lang="ts">
 import { ref, onMounted, watch } from 'vue'
 import { useRoute } from 'vue-router'
-import axios from 'axios'
+import { knowledgeApi } from '@/api/v1'
 import { useModuleI18n } from '@/i18n/composables'
 import DocumentsTab from './components/DocumentsTab.vue'
 import RetrievalTab from './components/RetrievalTab.vue'
@@ -192,9 +192,7 @@ const showSnackbar = (text: string, color: string = 'success') => {
 const loadKB = async () => {
   loading.value = true
   try {
-    const response = await axios.get('/api/kb/get', {
-      params: { kb_id: kbId.value }
-    })
+    const response = await knowledgeApi.get(kbId.value)
     if (response.data.status === 'ok') {
       kb.value = response.data.data
       emit('title-change', kb.value.kb_name || '')
diff --git a/dashboard/src/views/knowledge-base/KBList.vue b/dashboard/src/views/knowledge-base/KBList.vue
index c8abb57ca..d25b8e458 100644
--- a/dashboard/src/views/knowledge-base/KBList.vue
+++ b/dashboard/src/views/knowledge-base/KBList.vue
@@ -257,7 +257,7 @@
 <script setup lang="ts">
 import { ref, onMounted } from 'vue'
 import { useRouter } from 'vue-router'
-import axios from 'axios'
+import { knowledgeApi, providerApi } from '@/api/v1'
 import { useModuleI18n } from '@/i18n/composables'
 import OutlinedActionListItem from '@/components/shared/OutlinedActionListItem.vue'
 
@@ -329,7 +329,11 @@ const loadKnowledgeBases = async (refreshStats = false) => {
       params.refresh_stats = 'true'
     }
 
-    const response = await axios.get('/api/kb/list', { params })
+    const response = await knowledgeApi.list({
+      page: params.page,
+      page_size: params.page_size,
+      refresh_stats: params.refresh_stats === 'true'
+    })
     if (response.data.status === 'ok') {
       kbList.value = response.data.data.items || []
     } else {
@@ -346,9 +350,7 @@ const loadKnowledgeBases = async (refreshStats = false) => {
 // 加载提供商配置
 const loadProviders = async () => {
   try {
-    const response = await axios.get('/api/config/provider/list', {
-      params: { provider_type: 'embedding,rerank' }
-    })
+    const response = await providerApi.listByProviderType('embedding,rerank')
     if (response.data.status === 'ok') {
       embeddingProviders.value = response.data.data.filter(
         (p: any) => p.provider_type === 'embedding'
@@ -399,9 +401,7 @@ const deleteKB = async () => {
 
   deleting.value = true
   try {
-    const response = await axios.post('/api/kb/delete', {
-      kb_id: deleteTarget.value.kb_id
-    })
+    const response = await knowledgeApi.delete(deleteTarget.value.kb_id)
 
     console.log('Delete response:', response.data) // 调试日志
 
@@ -439,12 +439,9 @@ const submitForm = async () => {
 
     let response
     if (editingKB.value) {
-      response = await axios.post('/api/kb/update', {
-        kb_id: editingKB.value.kb_id,
-        ...payload
-      })
+      response = await knowledgeApi.update(editingKB.value.kb_id, payload)
     } else {
-      response = await axios.post('/api/kb/create', payload)
+      response = await knowledgeApi.create(payload)
     }
 
     if (response.data.status === 'ok') {
diff --git a/dashboard/src/views/knowledge-base/components/DocumentsTab.vue b/dashboard/src/views/knowledge-base/components/DocumentsTab.vue
index 5bff7cd71..29a49d0da 100644
--- a/dashboard/src/views/knowledge-base/components/DocumentsTab.vue
+++ b/dashboard/src/views/knowledge-base/components/DocumentsTab.vue
@@ -238,7 +238,7 @@
 import TavilyKeyDialog from './TavilyKeyDialog.vue'
 import { ref, onMounted, onUnmounted, computed } from 'vue'
 import { useRouter } from 'vue-router'
-import axios from 'axios'
+import { configProfileApi, knowledgeApi, providerApi } from '@/api/v1'
 import { useModuleI18n } from '@/i18n/composables'
 
 const { tm: t } = useModuleI18n('features/knowledge-base/detail')
@@ -340,9 +340,7 @@ const headers = [
 const loadDocuments = async () => {
   loading.value = true
   try {
-    const response = await axios.get('/api/kb/document/list', {
-      params: { kb_id: props.kbId }
-    })
+    const response = await knowledgeApi.documents(props.kbId)
     if (response.data.status === 'ok') {
       documents.value = response.data.data.items || []
     }
@@ -425,7 +423,7 @@ const uploadFiles = async () => {
     formData.append('tasks_limit', uploadSettings.value.tasks_limit.toString())
     formData.append('max_retries', uploadSettings.value.max_retries.toString())
 
-    const response = await axios.post('/api/kb/document/upload', formData)
+    const response = await knowledgeApi.uploadDocument(props.kbId, formData)
 
     if (response.data.status === 'ok') {
       const result = response.data.data
@@ -502,7 +500,7 @@ const uploadFromUrl = async () => {
     }
 
 
-    const response = await axios.post('/api/kb/document/upload/url', payload)
+    const response = await knowledgeApi.importDocumentFromUrl(props.kbId, payload)
 
     if (response.data.status === 'ok') {
       const result = response.data.data
@@ -554,9 +552,7 @@ const startProgressPolling = (taskId: string) => {
 
   progressPollingInterval.value = window.setInterval(async () => {
     try {
-      const response = await axios.get('/api/kb/document/upload/progress', {
-        params: { task_id: taskId }
-      })
+      const response = await knowledgeApi.task(taskId)
 
       if (response.data.status === 'ok') {
         const data = response.data.data
@@ -683,10 +679,7 @@ const deleteDocument = async () => {
 
   deleting.value = true
   try {
-    const response = await axios.post('/api/kb/document/delete', {
-      doc_id: deleteTarget.value.doc_id,
-      kb_id: props.kbId
-    })
+    const response = await knowledgeApi.deleteDocument(props.kbId, deleteTarget.value.doc_id)
 
     if (response.data.status === 'ok') {
       showSnackbar(t('documents.deleteSuccess'))
@@ -753,9 +746,7 @@ const formatDate = (dateStr: string) => {
 // 加载LLM providers
 const loadLlmProviders = async () => {
   try {
-    const response = await axios.get('/api/config/provider/list', {
-      params: { provider_type: 'chat_completion' }
-    })
+    const response = await providerApi.listByProviderType('chat_completion')
     if (response.data.status === 'ok') {
       llmProviders.value = response.data.data
     }
@@ -768,11 +759,9 @@ const loadLlmProviders = async () => {
 const checkTavilyConfig = async () => {
   tavilyConfigStatus.value = 'loading'
   try {
-    const response = await axios.get('/api/config/abconf', {
-      params: { id: 'default' }
-    })
+    const response = await configProfileApi.get('default')
     if (response.data.status === 'ok') {
-      const config = response.data.data.config
+      const config = ((response.data.data as any).config || {}) as any
       const tavilyKeys = config?.provider_settings?.websearch_tavily_key
       if (Array.isArray(tavilyKeys) && tavilyKeys.length > 0 && tavilyKeys.some(key => key.trim() !== '')) {
         tavilyConfigStatus.value = 'configured'
diff --git a/dashboard/src/views/knowledge-base/components/RetrievalTab.vue b/dashboard/src/views/knowledge-base/components/RetrievalTab.vue
index 351e4f3cd..289132667 100644
--- a/dashboard/src/views/knowledge-base/components/RetrievalTab.vue
+++ b/dashboard/src/views/knowledge-base/components/RetrievalTab.vue
@@ -117,7 +117,7 @@
 
 <script setup lang="ts">
 import { ref } from 'vue'
-import axios from 'axios'
+import { knowledgeApi } from '@/api/v1'
 import { useModuleI18n } from '@/i18n/composables'
 
 const { tm: t } = useModuleI18n('features/knowledge-base/detail')
@@ -160,7 +160,7 @@ const performRetrieval = async () => {
   debugVisualize.value = null
 
   try {
-    const response = await axios.post('/api/kb/retrieve', {
+    const response = await knowledgeApi.retrieve(props.kbId, {
       query: query.value,
       kb_names: [props.kbName],
       top_k: topK.value,
diff --git a/dashboard/src/views/knowledge-base/components/SettingsTab.vue b/dashboard/src/views/knowledge-base/components/SettingsTab.vue
index 7d18c305a..9ffbd7a9a 100644
--- a/dashboard/src/views/knowledge-base/components/SettingsTab.vue
+++ b/dashboard/src/views/knowledge-base/components/SettingsTab.vue
@@ -159,7 +159,7 @@
 
 <script setup lang="ts">
 import { ref, watch, onMounted } from 'vue'
-import axios from 'axios'
+import { knowledgeApi, providerApi } from '@/api/v1'
 import { useModuleI18n } from '@/i18n/composables'
 
 const { tm: t } = useModuleI18n('features/knowledge-base/detail')
@@ -222,9 +222,7 @@ watch(() => props.kb, (kb) => {
 // 加载提供商列表
 const loadProviders = async () => {
   try {
-    const response = await axios.get('/api/config/provider/list', {
-      params: { provider_type: 'embedding,rerank' }
-    })
+    const response = await providerApi.listByProviderType('embedding,rerank')
     if (response.data.status === 'ok') {
       embeddingProviders.value = response.data.data.filter(
         (p: any) => p.provider_type === 'embedding'
@@ -272,8 +270,7 @@ const saveSettings = async () => {
 
   saving.value = true
   try {
-    const response = await axios.post('/api/kb/update', {
-      kb_id: props.kb.kb_id,
+    const response = await knowledgeApi.update(props.kb.kb_id, {
       chunk_size: formData.value.chunk_size,
       chunk_overlap: formData.value.chunk_overlap,
       top_k_dense: formData.value.top_k_dense,
diff --git a/dashboard/src/views/knowledge-base/components/TavilyKeyDialog.vue b/dashboard/src/views/knowledge-base/components/TavilyKeyDialog.vue
index 37cf9df8c..a7c344948 100644
--- a/dashboard/src/views/knowledge-base/components/TavilyKeyDialog.vue
+++ b/dashboard/src/views/knowledge-base/components/TavilyKeyDialog.vue
@@ -34,7 +34,7 @@
 
 <script setup lang="ts">
 import { ref, watch } from 'vue'
-import axios from 'axios'
+import { configProfileApi } from '@/api/v1'
 
 const props = defineProps<{
   modelValue: boolean
@@ -70,15 +70,13 @@ const saveKey = async () => {
   saving.value = true
   try {
     // 1. 获取当前配置
-    const configResponse = await axios.get('/api/config/abconf', {
-      params: { id: 'default' }
-    })
+    const configResponse = await configProfileApi.get('default')
 
     if (configResponse.data.status !== 'ok') {
       throw new Error('获取当前配置失败')
     }
 
-    const currentConfig = configResponse.data.data.config
+    const currentConfig = ((configResponse.data.data as any).config || {}) as any
 
     // 2. 更新配置
     if (!currentConfig.provider_settings) {
@@ -89,10 +87,7 @@ const saveKey = async () => {
     currentConfig.provider_settings.websearch_provider = 'tavily'
 
     // 3. 保存整个配置
-    const saveResponse = await axios.post('/api/config/astrbot/update', {
-      conf_id: 'default',
-      config: currentConfig
-    })
+    const saveResponse = await configProfileApi.update('default', currentConfig)
 
     if (saveResponse.data.status === 'ok') {
       emit('success')
@@ -106,4 +101,4 @@ const saveKey = async () => {
     saving.value = false
   }
 }
-</script>
\ No newline at end of file
+</script>
diff --git a/dashboard/src/views/stats/StatsPage.vue b/dashboard/src/views/stats/StatsPage.vue
index 251971baf..71133c0e2 100644
--- a/dashboard/src/views/stats/StatsPage.vue
+++ b/dashboard/src/views/stats/StatsPage.vue
@@ -204,9 +204,9 @@
 
 <script setup lang="ts">
 import type { ApexOptions } from 'apexcharts'
-import axios from 'axios'
 import { computed, onBeforeUnmount, onMounted, ref, watch } from 'vue'
 import { useTheme } from 'vuetify'
+import { statsApi } from '@/api/v1'
 import { useI18n, useModuleI18n } from '@/i18n/composables'
 
 type TokenRange = 1 | 3 | 7
@@ -391,20 +391,12 @@ function aggregateOverflowSeries(series: ProviderTrendItem[]): ProviderTrendItem
 }
 
 async function fetchBaseStats(): Promise<void> {
-  const response = await axios.get('/api/stat/get', {
-    params: {
-      offset_sec: selectedRange.value * 24 * 60 * 60
-    }
-  })
+  const response = await statsApi.get(selectedRange.value * 24 * 60 * 60)
   baseStats.value = response.data.data
 }
 
 async function fetchProviderStats(): Promise<void> {
-  const response = await axios.get('/api/stat/provider-tokens', {
-    params: {
-      days: selectedRange.value
-    }
-  })
+  const response = await statsApi.providerTokens(selectedRange.value)
   providerStats.value = response.data.data
 }
 
diff --git a/docs/.vitepress/config.mjs b/docs/.vitepress/config.mjs
index cd62409ca..79812ca30 100644
--- a/docs/.vitepress/config.mjs
+++ b/docs/.vitepress/config.mjs
@@ -159,6 +159,7 @@ export default defineConfig({
             base: "/use",
             items: [
               { text: "WebUI", link: "/webui" },
+              { text: "CLI 指令", link: "/cli" },
               { text: "插件", link: "/plugin" },
               { text: "内置指令", link: "/command" },
               { text: "工具使用 Tools", link: "/function-calling" },
@@ -404,6 +405,7 @@ export default defineConfig({
             collapsed: true,
             items: [
               { text: "WebUI", link: "/webui" },
+              { text: "CLI Commands", link: "/cli" },
               { text: "Plugins", link: "/plugin" },
               { text: "Built-in Commands", link: "/command" },
               { text: "Tool Use", link: "/function-calling" },
diff --git a/docs/en/dev/openapi.md b/docs/en/dev/openapi.md
index 49e8b2875..a08d6236c 100644
--- a/docs/en/dev/openapi.md
+++ b/docs/en/dev/openapi.md
@@ -26,19 +26,30 @@ X-API-Key: abk_xxx
 - `POST /api/v1/chat`: request body must include `username`
 - `GET /api/v1/chat/sessions`: query params must include `username`
 
+The local OpenAPI schema is available at `http://localhost:6185/api/v1/openapi.json`, and the interactive docs are available at `http://localhost:6185/api/v1/docs`.
+
 ## Scope Permissions
 
 When creating an API Key, you can configure `scopes`. Each scope controls the range of accessible endpoints:
 
 | Scope | Purpose | Accessible Endpoints |
 | --- | --- | --- |
+| `bot` | Manage bot/platform configurations | `GET /api/v1/bot-types`, `GET/POST /api/v1/bots`, `PATCH /api/v1/bots/enabled` |
+| `provider` | Manage model providers and provider sources | `GET/POST /api/v1/providers`, `GET/PUT/DELETE /api/v1/provider-sources/by-id` |
+| `persona` | Manage personas and persona folders | `GET/POST /api/v1/personas`, `GET/POST /api/v1/persona-folders` |
+| `im` | Send proactive IM messages and query bot/platform list | `POST /api/v1/im/message`, `GET /api/v1/im/bots` |
+| `config` | Manage config profiles, system config, and shared configuration. This scope also includes `bot` and `provider` access. | `GET /api/v1/configs`, `GET/PUT /api/v1/system-config`, `GET/POST /api/v1/config-profiles` |
 | `chat` | Access chat capabilities and query sessions | `POST /api/v1/chat`, `GET /api/v1/chat/sessions` |
-| `config` | Retrieve available config file list | `GET /api/v1/configs` |
-| `file` | Upload attachment files and get `attachment_id` | `POST /api/v1/file` |
-| `im` | Send proactive IM messages, query bot/platform list | `POST /api/v1/im/message`, `GET /api/v1/im/bots` |
+| `plugin` | Manage plugins, plugin config, plugin sources, and marketplace entries | `GET /api/v1/plugins`, `GET/PUT /api/v1/plugins/config`, `POST /api/v1/plugins/install/url` |
+| `mcp` | Manage MCP server configurations and provider sync | `GET/POST /api/v1/mcp/servers`, `PATCH /api/v1/mcp/servers/{server_name}/enabled`, `POST /api/v1/mcp/providers/modelscope/sync` |
+| `skill` | Manage skills, skill archives, skill files, and Shipyard Neo skill workflows | `GET/POST /api/v1/skills`, `PUT /api/v1/skills/{skill_name}/files/{file_path}`, `POST /api/v1/skills/neo/sync` |
 
 If the API Key does not include the required scope for the target endpoint, the request will return `403 Insufficient API key scope`.
 
+`config` is a broad management scope. When an API key is created with `config`, AstrBot grants the key `config`, `bot`, and `provider` access together. The WebUI mirrors this dependency: selecting `config` selects `bot` and `provider`; deselecting `bot` or `provider` removes `config`.
+
+Developer API keys currently support only the 9 scopes listed above. `file`, `tool`, `skills`, `kb`, `data`, and `system` are not valid developer API key scopes. Use the singular `skill` scope for `/api/v1/skills/*` endpoints. Related endpoints may still appear in the `/api/v1` reference, but they are not available to developer API keys unless their scope is one of the supported scopes above.
+
 ## Common Endpoints
 
 **Chat**
@@ -49,9 +60,19 @@ Interact with AstrBot's built-in Agent. Supports plugin calls, tool calls, and o
 - `GET /api/v1/chat/sessions`: list sessions for a specific `username` with pagination
 - `GET /api/v1/configs`: list available config files
 
-**File Upload**
+**Bots and Providers**
 
-- `POST /api/v1/file`: upload attachment
+- `GET /api/v1/bots`: list bot/platform configurations
+- `POST /api/v1/bots`: create a bot/platform configuration
+- `GET /api/v1/providers`: list model provider configurations
+- `GET /api/v1/provider-sources`: list provider source configurations
+
+**Personas, Plugins, MCP, and Skills**
+
+- `GET /api/v1/personas`: list personas
+- `GET /api/v1/plugins`: list plugins
+- `GET /api/v1/mcp/servers`: list MCP servers
+- `GET /api/v1/skills`: list skills
 
 **Proactive IM Messages**
 
@@ -99,7 +120,7 @@ Supported `type` values:
 
 Notes:
 
-- `attachment_id` comes from the upload result of `POST /api/v1/file`.
+- `attachment_id` comes from an existing attachment record. Developer API keys cannot currently upload attachments via `POST /api/v1/file`.
 - `reply` cannot be the only segment; at least one content segment (e.g. `plain/image/file/...`) is required.
 - A request with only `reply` or empty content will return an error.
 
diff --git a/docs/en/dev/star/guides/plugin-pages.md b/docs/en/dev/star/guides/plugin-pages.md
index 86db72b73..22ce6d6ef 100644
--- a/docs/en/dev/star/guides/plugin-pages.md
+++ b/docs/en/dev/star/guides/plugin-pages.md
@@ -1,6 +1,12 @@
 # Plugin Pages
 
-AstrBot lets a plugin expose Dashboard pages by placing static assets under `pages/`. Each direct child directory is one Page:
+Plugin Pages let a plugin provide its own pages inside the AstrBot WebUI. Page files live under the plugin's `pages/` directory and are loaded by the Dashboard in a restricted iframe. Page scripts communicate with the Dashboard through the `window.AstrBotPluginPage` bridge, and the Dashboard forwards backend calls to Web APIs registered by the plugin.
+
+If you only need a small set of editable settings, prefer [`_conf_schema.json`](./plugin-config.md). Pages are a better fit for complex forms, runtime dashboards, logs, file upload/download, SSE streams, charts, and other custom workflows.
+
+## Directory Layout
+
+Each direct child directory under `pages/` is one Page. AstrBot only discovers `pages/<page_name>/index.html`; directories without `index.html` are ignored.
 
 ```text
 astrbot_plugin_page_demo/
@@ -16,13 +22,65 @@ astrbot_plugin_page_demo/
       └─ index.html
 ```
 
-AstrBot scans `pages/<page_name>/index.html`; directories without `index.html` are ignored.
+Use simple directory names for `page_name`, such as `settings` or `bridge-demo`. Do not use an empty name, `.`, `..`, a name starting with `.`, or a name containing `/` or `\`.
 
-If you only need a few editable settings, prefer [`_conf_schema.json`](./plugin-config.md). Plugin Pages are more suitable for complex forms, dashboards, logs, file transfer, SSE, and custom interaction flows.
+Users open Pages from the plugin detail page in the WebUI.
 
-Once Pages are registered, users can open the AstrBot WebUI Plugins page, click the plugin card to enter the plugin detail page, and then view and open the registered Pages from that detail page.
+## Development Flow
 
-## Minimal Frontend Example
+1. Create `pages/<page_name>/index.html` in the plugin directory.
+2. Use the `window.AstrBotPluginPage` bridge from the Page.
+3. Register backend APIs with `context.register_web_api()` in `main.py`.
+4. Read requests and return responses with `astrbot.api.web`.
+5. Reload the plugin after adding or removing Page directories; refreshing the Page is usually enough for static asset edits.
+
+## Minimal Complete Example
+
+### Backend
+
+Plugin backend code should use `astrbot.api.web`. Avoid exposing raw FastAPI, Starlette, or Quart request objects as the public API for your plugin business logic.
+
+```python
+from astrbot.api.star import Context, Star
+from astrbot.api.web import error_response, json_response, request
+
+PLUGIN_NAME = "astrbot_plugin_page_demo"
+
+
+class MyPlugin(Star):
+    def __init__(self, context: Context):
+        super().__init__(context)
+        context.register_web_api(
+            f"/{PLUGIN_NAME}/ping",
+            self.page_ping,
+            ["GET"],
+            "Page ping",
+        )
+        context.register_web_api(
+            f"/{PLUGIN_NAME}/settings/save",
+            self.save_settings,
+            ["POST"],
+            "Save Page settings",
+        )
+
+    async def page_ping(self):
+        limit = request.query.get("limit", 20, type=int)
+        return json_response(
+            {
+                "message": "pong",
+                "limit": limit,
+                "username": request.username,
+            }
+        )
+
+    async def save_settings(self):
+        payload = await request.json(default={})
+        if not isinstance(payload.get("enabled"), bool):
+            return error_response("enabled must be a boolean")
+        return json_response({"saved": True})
+```
+
+### Frontend
 
 `pages/bridge-demo/index.html`
 
@@ -52,228 +110,215 @@ const context = await bridge.ready();
 output.textContent = JSON.stringify(context, null, 2);
 
 document.getElementById("ping").addEventListener("click", async () => {
-  const result = await bridge.apiGet("ping");
+  const result = await bridge.apiGet("ping", { limit: 20 });
   output.textContent = JSON.stringify(result, null, 2);
 });
 ```
 
-You do not need to import the bridge SDK manually. AstrBot injects `/api/plugin/page/bridge-sdk.js` into returned HTML.
-
-## Register Backend APIs
-
-When the frontend calls `bridge.apiGet("ping")`, the Dashboard forwards it to:
-
-```text
-/api/plug/<plugin_name>/ping
-```
-
-The registered Web API route must include the plugin name as a prefix:
-
-```python
-from quart import jsonify
-from astrbot.api.star import Context, Star
-
-PLUGIN_NAME = "astrbot_plugin_page_demo"
-
-
-class MyPlugin(Star):
-    def __init__(self, context: Context):
-        super().__init__(context)
-        context.register_web_api(
-            f"/{PLUGIN_NAME}/ping",
-            self.page_ping,
-            ["GET"],
-            "Page ping",
-        )
-
-    async def page_ping(self):
-        return jsonify({"message": "pong"})
-```
-
-## Bridge API
-
-Inside a plugin Page, use `window.AstrBotPluginPage` directly:
-
-- `ready()`: Wait until the bridge is ready and return the context
-- `getContext()`: Read the current context
-- `getLocale()`: Read the current WebUI locale
-- `getI18n()`: Read the current plugin i18n resources
-- `t(key, fallback)`: Read text from plugin i18n resources by key, returning fallback when missing
-- `onContext(handler)`: Listen for context changes, such as rerendering after the WebUI locale changes
-- `apiGet(endpoint, params)`: Send a GET request
-- `apiPost(endpoint, body)`: Send a POST request
-- `upload(endpoint, file)`: Upload one file as `multipart/form-data`
-- `download(endpoint, params, filename)`: Download a backend response
-- `subscribeSSE(endpoint, handlers, params)`: Subscribe to SSE
-- `unsubscribeSSE(subscriptionId)`: Cancel an SSE subscription
-
-The current `ready()` context looks like this:
-
-```json
-{
-  "pluginName": "astrbot_plugin_page_demo",
-  "displayName": "Plugin Page Demo",
-  "pageName": "bridge-demo",
-  "pageTitle": "Bridge Demo",
-  "locale": "en-US",
-  "i18n": {},
-  "isDark": false
-}
-```
-
-`endpoint` must be a plugin-local path. It must not be empty, contain `\`, contain a URL scheme, contain query strings or fragments, or contain `.` / `..` path segments.
-
-## Page Internationalization
-
-Plugin Pages reuse plugin i18n resource files. Add `pages.<page_name>` to `.astrbot-plugin/i18n/<locale>.json`:
-
-```json
-{
-  "pages": {
-    "bridge-demo": {
-      "title": "Bridge Demo",
-      "description": "Shows how a plugin page reads the WebUI locale and translations.",
-      "heading": "Plugin Page",
-      "refresh": "Render again"
-    }
-  }
-}
-```
-
-`title` is used by the WebUI shell title and the Page component name on the plugin detail page. `description` is used by the Page component description on the plugin detail page.
-
-Inside the Page, render text with `t()` and react to language changes with `onContext()`:
-
-```js
-const bridge = window.AstrBotPluginPage;
-
-function render() {
-  document.title = bridge.t("pages.bridge-demo.title", "Bridge Demo");
-  document.getElementById("heading").textContent = bridge.t(
-    "pages.bridge-demo.heading",
-    "Plugin Page",
-  );
-  document.getElementById("locale").textContent = bridge.getLocale();
-}
-
-await bridge.ready();
-render();
-bridge.onContext(render);
-```
-
-After the WebUI locale changes, the Dashboard sends the new `locale` and plugin i18n resources to the iframe through the bridge. If the Page listens with `onContext()`, it usually does not need a refresh.
-
-If an inline script needs to access `window.AstrBotPluginPage` synchronously, move the code to an external module file or explicitly include the bridge SDK before your script:
+You do not need to import the bridge SDK manually. AstrBot injects `/api/plugin/page/bridge-sdk.js` into returned HTML. If an inline script must access `window.AstrBotPluginPage` synchronously, move it to an external module file or explicitly include the SDK before your script:
 
 ```html
 <script src="/api/plugin/page/bridge-sdk.js"></script>
 ```
 
-## Light/Dark Theme Adaptation
+## Backend Web APIs
 
-When the user toggles light/dark mode in AstrBot, the theme state is automatically synced to Plugin Pages. The bridge SDK maintains a `data-theme` attribute on the `<html>` element:
+### Route Registration
 
-- Light mode: `<html data-theme="light">`
-- Dark mode: `<html data-theme="dark">`
+Register plugin APIs with `context.register_web_api(route, view_handler, methods, desc)`.
 
-> When **Follow System** is selected, AstrBot automatically resolves the theme based on the system's color scheme. The `data-theme` value received by the plugin page is always either `light` or `dark` — no extra handling needed.
-
-### CSS Adaptation
-
-CSS variables are the recommended approach:
-
-```css
-:root {
-  --bg: #ffffff;
-  --text: #1a1a1a;
-}
-
-[data-theme="dark"] {
-  --bg: #1a1a1a;
-  --text: #e0e0e0;
-}
-
-body {
-  background: var(--bg);
-  color: var(--text);
-}
+```python
+context.register_web_api(
+    f"/{PLUGIN_NAME}/items/<item_id>",
+    self.get_item,
+    ["GET"],
+    "Get item",
+)
 ```
 
-AstrBot injects the `data-theme` attribute on the `<html>` tag server-side when serving HTML, so there is no initial flash.
-
-### Responding to Theme Changes in JavaScript
-
-The `isDark` field in the context indicates whether dark mode is active. Use `onContext()` to listen for theme changes:
+The registered route must include the plugin name prefix. The bridge endpoint used by the Page does not include the plugin name:
 
 ```js
-const bridge = window.AstrBotPluginPage;
-
-function render() {
-  if (bridge.getContext()?.isDark) {
-    // JS logic for dark mode (e.g. chart filters)
-  }
-}
-
-await bridge.ready();
-render();
-bridge.onContext(render);
+await bridge.apiGet("items/123");
 ```
 
-When the theme is toggled, the Dashboard sends the updated context to the iframe via the bridge. As long as the Page listens with `onContext()`, it will be notified.
-
-## Asset Path Rules
-
-AstrBot rewrites relative asset URLs and appends a short-lived `asset_token`. Write normal relative paths and do not hardcode `/api/plugin/page/content/...` yourself.
-
-AstrBot rewrites:
-
-- HTML `src` and `href`
-- CSS `url(...)`
-- JavaScript `import`
-- JavaScript `export ... from`
-- JavaScript dynamic `import()`
-
-Keep static assets on relative paths such as `./style.css` and `./assets/logo.svg`. Do not manually append `asset_token`, and do not rely on `..` to escape the Page root directory.
-
-If you build a SPA, prefer hash routing. The static asset server resolves real file paths; with history routing, refreshing a page requires an actual file to exist at that path.
-
-## Security Constraints
-
-Plugin Pages run inside a restricted iframe:
+The Dashboard forwards it to:
 
 ```text
-allow-scripts allow-forms allow-downloads
+/api/v1/plugins/extensions/<plugin_name>/items/123
 ```
 
-The page cannot directly access Dashboard cookies, LocalStorage, or same-origin DOM, and it cannot bypass the bridge to reuse Dashboard auth directly.
+The registered route `/<plugin_name>/items/<item_id>` matches the request, and `item_id` is passed to the handler as a keyword argument:
 
-AstrBot also adds security headers to asset responses, including:
+```python
+async def get_item(self, item_id: str):
+    return json_response({"item_id": item_id})
+```
 
-- `X-Frame-Options: SAMEORIGIN`
-- `Content-Security-Policy: frame-ancestors 'self'; object-src 'none'; base-uri 'self'`
-- `Cache-Control: no-store`
+Supported dynamic segments:
 
-## Debugging Tips
+- `<name>`: matches one path segment.
+- `<path:name>`: matches the remaining multi-segment path.
 
-- Reload the plugin after adding or removing a Page directory
-- For most edits under `pages/<page_name>/`, refreshing the Page is enough
-- If a Page does not appear, check that `pages/<page_name>/index.html` exists and the plugin is enabled
+### Request Object
 
-## Appendix: Bridge API Details
+Recommended import:
 
-Start page scripts by keeping a bridge reference:
+```python
+from astrbot.api.web import request
+```
+
+`request` is a context proxy for the current request and is only available while a plugin Web API handler is running. Common fields and methods:
+
+| API | Description |
+| --- | --- |
+| `request.method` | HTTP method, such as `GET` or `POST` |
+| `request.path` | Current Dashboard API path |
+| `request.plugin_name` | Plugin name parsed from the extension path |
+| `request.username` | Current Dashboard username, possibly `None` |
+| `request.headers` | Request headers |
+| `request.cookies` | Request cookies |
+| `request.content_type` | Request Content-Type |
+| `request.client_host` | Client address |
+| `request.path_params` | Dynamic route parameters |
+| `request.query` | Query parameters with `get()` and `getlist()` |
+| `await request.body()` | Raw request body bytes |
+| `await request.json(default={})` | JSON body, returning default on parse failure |
+| `await request.form()` | Form fields without uploaded files |
+| `await request.files()` | Uploaded files |
+
+Query example:
+
+```python
+limit = request.query.get("limit", 20, type=int)
+tags = request.query.getlist("tag")
+```
+
+JSON example:
+
+```python
+payload = await request.json(default={})
+enabled = bool(payload.get("enabled"))
+```
+
+Upload example:
+
+```python
+from pathlib import Path
+
+from astrbot.core.utils.astrbot_path import get_astrbot_plugin_data_path
+from astrbot.api.web import PluginUploadFile, error_response, json_response, request
+
+
+async def import_file(self):
+    form = await request.form()
+    files = await request.files()
+    upload: PluginUploadFile | None = files.get("file")
+    if not isinstance(upload, PluginUploadFile):
+        return error_response("missing file")
+
+    target_dir = (
+        Path(get_astrbot_plugin_data_path())
+        / (request.plugin_name or "unknown_plugin")
+        / "imports"
+    )
+    target_dir.mkdir(parents=True, exist_ok=True)
+    target = target_dir / Path(upload.filename).name
+    await upload.save(target)
+    return json_response(
+        {
+            "filename": upload.filename,
+            "content_type": upload.content_type,
+            "tag": form.get("tag"),
+        }
+    )
+```
+
+`request.form()` and `request.files()` cache the parsed multipart data, so calling both in the same handler is fine.
+
+### Responses
+
+Recommended response helpers:
+
+```python
+from astrbot.api.web import (
+    error_response,
+    file_response,
+    json_response,
+    stream_response,
+)
+```
+
+JSON response:
+
+```python
+return json_response({"saved": True})
+```
+
+Error response:
+
+```python
+return error_response("invalid threshold", status_code=400)
+```
+
+File download response:
+
+```python
+return file_response(
+    export_path,
+    filename="export.json",
+    content_type="application/json",
+)
+```
+
+SSE response:
+
+```python
+import json
+
+from astrbot.api.web import stream_response
+
+
+async def stream_events(self):
+    async def events():
+        yield f"data: {json.dumps({'state': 'started'})}\n\n"
+        yield f"data: {json.dumps({'state': 'done'})}\n\n"
+
+    return stream_response(events())
+```
+
+Returning a `dict`, `list`, `(body, status_code)`, or a lower-level Response object still works. New plugins should prefer `astrbot.api.web` helpers so plugin code remains decoupled from the Dashboard's internal web framework.
+
+### Quart Compatibility
+
+For backward compatibility, handlers registered through `context.register_web_api()` still run inside a Quart-compatible request context. Existing plugins can continue to use:
+
+```python
+from quart import jsonify, request
+```
+
+New plugins and new documentation should use:
+
+```python
+from astrbot.api.web import json_response, request
+```
+
+Do not mix the two `request` proxies in the same handler. Migrate one handler at a time.
+
+## Bridge API
+
+The Page iframe cannot directly access Dashboard cookies, LocalStorage, or the parent DOM. Page scripts must use `window.AstrBotPluginPage` to call backend APIs and read context.
 
 ```js
 const bridge = window.AstrBotPluginPage;
 ```
 
-### `ready()`
+### Context
 
-Waits for the parent page to send the initial context and returns `Promise<context>`. Page initialization should wait for this before reading context-dependent values.
+`ready()` waits for the parent page to send the initial context and returns `Promise<context>`. Wait for it during page initialization.
 
 ```js
 const context = await bridge.ready();
-console.log(context.pluginName, context.pageName, context.locale);
 ```
 
 The context usually contains:
@@ -290,93 +335,111 @@ The context usually contains:
 }
 ```
 
-### `getContext()`
+Context APIs:
 
-Synchronously reads the latest context. Use it after `ready()` or inside an `onContext()` callback.
+| API | Returns | Description |
+| --- | --- | --- |
+| `ready()` | `Promise<context>` | Waits until the bridge is ready and returns the initial context |
+| `getContext()` | `context \| null` | Synchronously reads the latest context |
+| `getLocale()` | `string` | Current WebUI locale, defaulting to `zh-CN` |
+| `getI18n()` | `object` | Current plugin i18n resources |
+| `t(key, fallback)` | `string` | Reads a dot-separated translation key, returning fallback when missing |
+| `onContext(handler)` | `() => void` | Listens for context changes and returns an unsubscribe function |
 
-```js
-function renderHeader() {
-  const context = bridge.getContext();
-  document.getElementById("title").textContent = context.pageTitle;
-}
-```
-
-### `getLocale()`
-
-Synchronously reads the current WebUI locale. It returns `zh-CN` when no context exists yet.
-
-```js
-document.documentElement.lang = bridge.getLocale();
-```
-
-### `getI18n()`
-
-Synchronously reads the full plugin i18n resource object. Prefer `t()` for normal rendering; use this for custom traversal or debugging.
-
-```js
-console.log(Object.keys(bridge.getI18n()));
-```
-
-### `t(key, fallback)`
-
-Reads text from plugin i18n by dot-separated key. If the current locale is missing, the bridge tries fallbacks; if still missing, it returns `fallback`.
-
-```js
-saveButton.textContent = bridge.t("pages.settings.save", "Save");
-```
-
-### `onContext(handler)`
-
-Listens for context changes and returns an unsubscribe function. The callback runs when the WebUI locale changes, so pages that need live language switching should rerender here.
+Respond to locale or theme changes:
 
 ```js
 function render() {
-  document.title = bridge.t("pages.settings.title", "Settings");
+  document.title = bridge.t("pages.bridge-demo.title", "Bridge Demo");
+  document.getElementById("locale").textContent = bridge.getLocale();
 }
 
 await bridge.ready();
 render();
 
 const off = bridge.onContext(render);
+window.addEventListener("beforeunload", off);
+```
 
-window.addEventListener("beforeunload", () => {
-  off();
-});
+### Request and Return Rules
+
+The `endpoint` used by `apiGet`, `apiPost`, `upload`, `download`, and `subscribeSSE` is a plugin-local relative path, such as `stats`, `settings/save`, or `files/export`. Prefer not to start it with `/`; the current bridge strips leading `/` for compatibility.
+
+`endpoint` must not be empty, contain `\`, contain a URL scheme, contain query strings or fragments, or contain empty, `.`, or `..` path segments.
+
+Do not append query strings to endpoint:
+
+```js
+await bridge.apiGet("stats", { limit: 20 });
+```
+
+Bridge JSON calls use this compatibility rule:
+
+- If the backend returns `{ "status": "ok", "data": value }`, the Promise resolves to `value`.
+- If the backend returns plain JSON, such as `{ "message": "pong" }`, the Promise resolves to that full JSON body.
+- If the backend returns `{ "status": "error", "message": "..." }`, or the HTTP request fails, the Promise rejects with `Error`.
+
+For Page-only APIs, prefer returning plain business JSON:
+
+```python
+return json_response({"message": "pong"})
+```
+
+Use this for errors:
+
+```python
+return error_response("missing file", status_code=400)
+```
+
+Handle errors on the Page:
+
+```js
+try {
+  await bridge.apiPost("settings/save", { enabled: true });
+} catch (error) {
+  console.error(error.message);
+}
 ```
 
 ### `apiGet(endpoint, params)`
 
-Sends a GET request to the plugin backend and returns `Promise<data>`. `endpoint` is a plugin-local relative path; the Dashboard forwards it to `/api/plug/<plugin_name>/<endpoint>`.
+Sends a GET request. `params` are sent as query parameters.
 
 ```js
-const stats = await bridge.apiGet("stats", { limit: 20 });
+const stats = await bridge.apiGet("stats", { limit: 20, tag: "today" });
 ```
 
-Backend registration example:
+Backend:
 
 ```python
-context.register_web_api(
-    f"/{PLUGIN_NAME}/stats",
-    self.get_stats,
-    ["GET"],
-    "Get stats",
-)
+async def stats(self):
+    limit = request.query.get("limit", 20, type=int)
+    tag = request.query.get("tag")
+    return json_response({"limit": limit, "tag": tag})
 ```
 
 ### `apiPost(endpoint, body)`
 
-Sends a POST request to the plugin backend. `body` is sent as JSON and the method returns `Promise<data>`.
+Sends a POST JSON request.
 
 ```js
-await bridge.apiPost("settings/save", {
+const result = await bridge.apiPost("settings/save", {
   enabled: true,
   threshold: 0.8,
 });
 ```
 
+Backend:
+
+```python
+async def save_settings(self):
+    payload = await request.json(default={})
+    return json_response({"saved": True, "enabled": payload.get("enabled")})
+```
+
 ### `upload(endpoint, file)`
 
-Uploads one file as `multipart/form-data` with the field name `file`, returning `Promise<data>`.
+Uploads one file as `multipart/form-data`. The field name is always `file`.
 
 ```js
 const input = document.querySelector("input[type=file]");
@@ -384,14 +447,48 @@ const file = input.files[0];
 const result = await bridge.upload("files/import", file);
 ```
 
+Backend:
+
+```python
+from astrbot.api.web import PluginUploadFile, error_response, json_response, request
+
+
+async def import_file(self):
+    files = await request.files()
+    upload: PluginUploadFile | None = files.get("file")
+    if not isinstance(upload, PluginUploadFile):
+        return error_response("missing file", status_code=400)
+    return json_response({"filename": upload.filename})
+```
+
+If you need extra structured fields, send them through a separate `apiPost` call or use query parameters to select import behavior. The current `upload()` bridge method sends one file.
+
 ### `download(endpoint, params, filename)`
 
-Requests a plugin backend file endpoint and triggers a browser download. `params` are sent as query parameters. `filename` is optional; when omitted, the bridge tries to use the response filename header.
+Requests a plugin backend file endpoint and triggers a browser download. `params` are sent as query parameters. `filename` is optional; when omitted, the bridge tries to read it from response headers.
 
 ```js
 await bridge.download("files/export", { format: "json" }, "export.json");
 ```
 
+Backend:
+
+```python
+async def export_file(self):
+    fmt = request.query.get("format", "json")
+    return file_response(
+        export_path,
+        filename=f"export.{fmt}",
+        content_type="application/json",
+    )
+```
+
+`download()` resolves to:
+
+```json
+{ "filename": "export.json" }
+```
+
 ### `subscribeSSE(endpoint, handlers, params)`
 
 Subscribes to plugin backend SSE and returns `Promise<subscriptionId>`. `handlers` may include `onOpen`, `onMessage`, and `onError`.
@@ -414,17 +511,25 @@ const subscriptionId = await bridge.subscribeSSE(
 );
 ```
 
-`event.parsed` is automatically parsed when the message is a JSON string; otherwise it equals the raw string.
+`event.raw` is the raw string. If the message is a JSON string, `event.parsed` is parsed automatically; otherwise it equals the raw string. `event.eventType` matches the SSE `event:` field and defaults to `message`.
 
-### `unsubscribeSSE(subscriptionId)`
+The backend must return `text/event-stream`:
 
-Cancels an SSE subscription.
+```python
+async def events(self):
+    async def stream():
+        yield 'data: {"message": "ready"}\n\n'
+
+    return stream_response(stream())
+```
+
+Unsubscribe:
 
 ```js
 await bridge.unsubscribeSSE(subscriptionId);
 ```
 
-Clean up subscriptions when the page unloads:
+Clean up on unload:
 
 ```js
 window.addEventListener("beforeunload", () => {
@@ -432,11 +537,116 @@ window.addEventListener("beforeunload", () => {
 });
 ```
 
-### endpoint Rules
+## Page Internationalization
 
-The `endpoint` used by `apiGet`, `apiPost`, `upload`, `download`, and `subscribeSSE` must be a plugin-local relative path:
+Plugin Pages reuse plugin i18n resource files. Add `pages.<page_name>` to `.astrbot-plugin/i18n/<locale>.json`:
 
-- Allowed: `"stats"`, `"settings/save"`, `"files/export"`
-- Not allowed: empty string, `"/stats"`, `"../stats"`, `"https://example.com"`, `"stats?x=1"`, `"stats#top"`
+```json
+{
+  "pages": {
+    "bridge-demo": {
+      "title": "Bridge Demo",
+      "description": "Shows how a plugin page reads the WebUI locale and translations.",
+      "heading": "Plugin Page",
+      "refresh": "Render again"
+    }
+  }
+}
+```
 
-Pass query parameters through `params`; do not append them to `endpoint`.
+`title` is used by the WebUI shell title and the Page component name on the plugin detail page. `description` is used by the Page component description. Inside the Page, render text with `bridge.t()` and react to locale changes with `onContext()`.
+
+```js
+function render() {
+  document.title = bridge.t("pages.bridge-demo.title", "Bridge Demo");
+  document.getElementById("heading").textContent = bridge.t(
+    "pages.bridge-demo.heading",
+    "Plugin Page",
+  );
+}
+
+await bridge.ready();
+render();
+bridge.onContext(render);
+```
+
+## Light/Dark Theme
+
+AstrBot syncs the current theme to Plugin Pages. The bridge SDK maintains a `data-theme` attribute on `<html>`:
+
+- Light mode: `<html data-theme="light">`
+- Dark mode: `<html data-theme="dark">`
+
+When **Follow System** is selected, the Page still receives either `light` or `dark`.
+
+CSS variables are recommended:
+
+```css
+:root {
+  --bg: #ffffff;
+  --text: #1a1a1a;
+}
+
+[data-theme="dark"] {
+  --bg: #1a1a1a;
+  --text: #e0e0e0;
+}
+
+body {
+  background: var(--bg);
+  color: var(--text);
+}
+```
+
+The server injects `data-theme` into returned HTML to reduce initial flashing. If JavaScript needs to react to theme changes, read `bridge.getContext()?.isDark` and listen with `onContext()`.
+
+## Static Asset Paths
+
+Use normal relative paths:
+
+```html
+<link rel="stylesheet" href="./style.css" />
+<script type="module" src="./app.js"></script>
+<img src="./assets/logo.svg" alt="" />
+```
+
+AstrBot rewrites relative asset URLs and appends a short-lived `asset_token`. Do not hardcode `/api/plugin/page/content/...`, append `asset_token` yourself, or rely on `..` to escape the Page root.
+
+AstrBot rewrites:
+
+- HTML `src` and `href`
+- CSS `url(...)`
+- JavaScript `import`
+- JavaScript `export ... from`
+- JavaScript dynamic `import()`
+
+If you build a SPA, prefer hash routing. The static asset server resolves real file paths; with history routing, refreshing a page requires a real file at that path.
+
+## Security Constraints
+
+Plugin Pages run inside a restricted iframe:
+
+```text
+allow-scripts allow-forms allow-downloads
+```
+
+The Page cannot directly access Dashboard cookies, LocalStorage, or the parent DOM, and it cannot bypass the bridge to reuse Dashboard auth. All operations that need Dashboard identity should go through the bridge.
+
+Asset responses include security headers such as:
+
+- `X-Frame-Options: SAMEORIGIN`
+- `Content-Security-Policy: frame-ancestors 'self'; object-src 'none'; base-uri 'self'`
+- `Cache-Control: no-store`
+- `X-Content-Type-Options: nosniff`
+
+Backend handlers must still validate input. Do not trust paths, filenames, formats, or numeric ranges sent by the Page. Store files only in safe directories and prefer whitelisted or regenerated filenames.
+
+## Debugging Tips
+
+- Page is missing: check that `pages/<page_name>/index.html` exists, the plugin is enabled, and the plugin detail page has been refreshed.
+- Bridge is missing: make sure your script runs after the bridge SDK is injected; external `type="module"` scripts are recommended.
+- API is not matched: make sure the registered route includes the plugin name prefix, such as `/{PLUGIN_NAME}/stats`, while the Page endpoint is `stats`.
+- Query or JSON is empty: pass GET values through `apiGet(endpoint, params)` and POST JSON through `apiPost(endpoint, body)`.
+- Upload is empty: `upload()` always uses the field name `file`; read it with `(await request.files()).get("file")`.
+- SSE has no messages: make sure the backend response is `text/event-stream` and each message ends with a blank line, such as `data: ...\n\n`.
+- SSE returns 401: do not call `new EventSource("/api/v1/...")` directly from the Page. Native `EventSource` cannot send the `Authorization` header; call through `bridge.subscribeSSE()` instead.
diff --git a/docs/public/openapi.json b/docs/public/openapi.json
index c767f5b31..457fbac48 100644
--- a/docs/public/openapi.json
+++ b/docs/public/openapi.json
@@ -1,129 +1,2587 @@
 {
   "openapi": "3.1.0",
   "info": {
-    "title": "AstrBot Open API",
-    "version": "1.0.0",
-    "description": "Developer HTTP APIs for AstrBot. Use API Key authentication for /api/v1/* endpoints."
+    "title": "AstrBot OpenAPI v1",
+    "version": "0.1.0",
+    "description": "Target REST contract for migrating AstrBot HTTP APIs to /api/v1. Dynamic AstrBot configuration payloads are intentionally modeled as open JSON objects because their schemas are provided at runtime by template endpoints. Developer API keys currently support these scopes only: bot, provider, persona, im, config, chat, plugin, mcp, skill. The config scope also grants bot and provider access.\n"
   },
   "servers": [
     {
-      "url": "http://localhost:6185"
+      "url": "http://localhost:6185",
+      "description": "Local AstrBot server"
+    }
+  ],
+  "security": [
+    {
+      "ApiKeyAuth": []
     }
   ],
   "tags": [
     {
-      "name": "Open API",
-      "description": "Developer APIs authenticated by API Key"
+      "name": "Auth"
+    },
+    {
+      "name": "API Keys"
+    },
+    {
+      "name": "System Config"
+    },
+    {
+      "name": "Config Profiles"
+    },
+    {
+      "name": "Bot Config Routes"
+    },
+    {
+      "name": "Bots"
+    },
+    {
+      "name": "Provider Sources"
+    },
+    {
+      "name": "Providers"
+    },
+    {
+      "name": "Chat"
+    },
+    {
+      "name": "IM"
+    },
+    {
+      "name": "Files"
+    },
+    {
+      "name": "Plugins"
+    },
+    {
+      "name": "Plugin Sources"
+    },
+    {
+      "name": "Plugin Pages"
+    },
+    {
+      "name": "Commands"
+    },
+    {
+      "name": "Tools"
+    },
+    {
+      "name": "MCP"
+    },
+    {
+      "name": "Skills"
+    },
+    {
+      "name": "Knowledge Base"
+    },
+    {
+      "name": "Personas"
+    },
+    {
+      "name": "Sessions"
+    },
+    {
+      "name": "Conversations"
+    },
+    {
+      "name": "Stats"
+    },
+    {
+      "name": "Backups"
+    },
+    {
+      "name": "Updates"
+    },
+    {
+      "name": "Cron"
+    },
+    {
+      "name": "Logs"
+    },
+    {
+      "name": "T2I"
+    },
+    {
+      "name": "Subagents"
+    },
+    {
+      "name": "Webhooks"
     }
   ],
   "paths": {
-    "/api/v1/im/bots": {
-      "get": {
-        "tags": [
-          "Open API"
-        ],
-        "summary": "List bot IDs",
-        "description": "Returns configured bot/platform IDs.",
-        "security": [
-          {
-            "ApiKeyHeader": []
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "OK",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ApiResponseBotList"
-                }
-              }
-            }
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        }
-      }
-    },
-    "/api/v1/file": {
+    "/api/v1/auth/login": {
       "post": {
         "tags": [
-          "Open API"
-        ],
-        "summary": "Upload attachment file",
-        "description": "Upload a file and get attachment_id for later use in chat/message APIs.",
-        "security": [
-          {
-            "ApiKeyHeader": []
-          }
+          "Auth"
         ],
+        "summary": "Login to the dashboard API",
+        "operationId": "login",
+        "security": [],
         "requestBody": {
           "required": true,
           "content": {
-            "multipart/form-data": {
+            "application/json": {
               "schema": {
-                "type": "object",
-                "required": [
-                  "file"
-                ],
-                "properties": {
-                  "file": {
-                    "type": "string",
-                    "format": "binary"
-                  }
-                }
+                "$ref": "#/components/schemas/LoginRequest"
               }
             }
           }
         },
         "responses": {
           "200": {
-            "description": "OK",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ApiResponseUpload"
-                }
-              }
-            }
+            "$ref": "#/components/responses/Ok"
           },
           "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
+            "$ref": "#/components/responses/Error"
           }
+        }
+      }
+    },
+    "/api/v1/auth/logout": {
+      "post": {
+        "tags": [
+          "Auth"
+        ],
+        "summary": "Logout from the dashboard API",
+        "operationId": "logout",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
           }
-      },
+        }
+      }
+    },
+    "/api/v1/auth/setup-status": {
       "get": {
         "tags": [
-          "Open API"
+          "Auth"
         ],
-        "summary": "Get attachment file",
-        "description": "Get an uploaded attachment file by attachment_id.",
-        "security": [
-          {
-            "ApiKeyHeader": []
+        "summary": "Get first-run setup status",
+        "operationId": "getAuthSetupStatus",
+        "security": [],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
           }
+        }
+      }
+    },
+    "/api/v1/auth/setup": {
+      "post": {
+        "tags": [
+          "Auth"
         ],
+        "summary": "Complete first-run dashboard account setup",
+        "operationId": "setupAuth",
+        "security": [],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SetupAuthRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/auth/totp/setup": {
+      "post": {
+        "tags": [
+          "Auth"
+        ],
+        "summary": "Start or refresh TOTP setup",
+        "operationId": "setupTotp",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/TotpSetupRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/auth/totp/recovery": {
+      "post": {
+        "tags": [
+          "Auth"
+        ],
+        "summary": "Generate or rotate TOTP recovery codes",
+        "operationId": "recoverTotp",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/auth/account": {
+      "patch": {
+        "tags": [
+          "Auth"
+        ],
+        "summary": "Update dashboard account credentials",
+        "operationId": "updateAuthAccount",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/UpdateAccountRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/api-keys": {
+      "get": {
+        "tags": [
+          "API Keys"
+        ],
+        "summary": "List OpenAPI keys",
+        "operationId": "listApiKeys",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "API Keys"
+        ],
+        "summary": "Create an OpenAPI key",
+        "operationId": "createApiKey",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateApiKeyRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/api-keys/{key_id}/revoke": {
+      "post": {
+        "tags": [
+          "API Keys"
+        ],
+        "summary": "Revoke an OpenAPI key",
+        "operationId": "revokeApiKey",
         "parameters": [
           {
-            "name": "attachment_id",
-            "in": "query",
-            "required": true,
-            "schema": {
-              "type": "string"
-            },
-            "description": "Attachment ID returned by POST /api/v1/file."
+            "$ref": "#/components/parameters/KeyId"
           }
         ],
         "responses": {
           "200": {
-            "description": "OK",
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/api-keys/{key_id}": {
+      "delete": {
+        "tags": [
+          "API Keys"
+        ],
+        "summary": "Delete an OpenAPI key",
+        "operationId": "deleteApiKey",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/KeyId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/system-config/schema": {
+      "get": {
+        "tags": [
+          "System Config"
+        ],
+        "summary": "Get the system configuration schema",
+        "operationId": "getSystemConfigSchema",
+        "x-astrbot-scope": "config",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/system-config": {
+      "get": {
+        "tags": [
+          "System Config"
+        ],
+        "summary": "Get the system configuration",
+        "operationId": "getSystemConfig",
+        "x-astrbot-scope": "config",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "System Config"
+        ],
+        "summary": "Replace the system configuration",
+        "operationId": "updateSystemConfig",
+        "x-astrbot-scope": "config",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/DynamicConfig"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/system-config/runtime": {
+      "get": {
+        "tags": [
+          "System Config"
+        ],
+        "summary": "Get runtime-enriched system configuration metadata",
+        "operationId": "getSystemConfigRuntime",
+        "x-astrbot-scope": "config",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/config-profiles/schema": {
+      "get": {
+        "tags": [
+          "Config Profiles"
+        ],
+        "summary": "Get the configuration profile schema",
+        "operationId": "getConfigProfileSchema",
+        "x-astrbot-scope": "config",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/config-profiles": {
+      "get": {
+        "tags": [
+          "Config Profiles"
+        ],
+        "summary": "List configuration profiles",
+        "operationId": "listConfigProfiles",
+        "x-astrbot-scope": "config",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Config Profiles"
+        ],
+        "summary": "Create a configuration profile",
+        "operationId": "createConfigProfile",
+        "x-astrbot-scope": "config",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateConfigProfileRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/config-profiles/{config_id}": {
+      "get": {
+        "tags": [
+          "Config Profiles"
+        ],
+        "summary": "Get a configuration profile",
+        "operationId": "getConfigProfile",
+        "x-astrbot-scope": "config",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ConfigId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "Config Profiles"
+        ],
+        "summary": "Replace a configuration profile",
+        "operationId": "updateConfigProfileContent",
+        "x-astrbot-scope": "config",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ConfigId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/DynamicConfig"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "patch": {
+        "tags": [
+          "Config Profiles"
+        ],
+        "summary": "Rename a configuration profile",
+        "operationId": "renameConfigProfile",
+        "x-astrbot-scope": "config",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ConfigId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RenameRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Config Profiles"
+        ],
+        "summary": "Delete a configuration profile",
+        "operationId": "deleteConfigProfile",
+        "x-astrbot-scope": "config",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ConfigId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/config-routes": {
+      "get": {
+        "tags": [
+          "Bot Config Routes"
+        ],
+        "summary": "List UMO to configuration profile bindings",
+        "operationId": "listConfigRoutes",
+        "x-astrbot-scope": "config",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "Bot Config Routes"
+        ],
+        "summary": "Replace all UMO to configuration profile bindings",
+        "operationId": "replaceConfigRoutes",
+        "x-astrbot-scope": "config",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ConfigRoutesReplaceRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/config-routes/{umo}": {
+      "put": {
+        "tags": [
+          "Bot Config Routes"
+        ],
+        "summary": "Bind a UMO to a configuration profile",
+        "operationId": "upsertConfigRoute",
+        "x-astrbot-scope": "config",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Umo"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ConfigRouteUpsertRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Bot Config Routes"
+        ],
+        "summary": "Remove a UMO configuration profile binding",
+        "operationId": "deleteConfigRoute",
+        "x-astrbot-scope": "config",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Umo"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/bot-types": {
+      "get": {
+        "tags": [
+          "Bots"
+        ],
+        "summary": "List configurable bot types and their schemas",
+        "operationId": "listBotTypes",
+        "x-astrbot-scope": "bot",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/bot-types/{bot_type}/registration": {
+      "post": {
+        "tags": [
+          "Bots"
+        ],
+        "summary": "Run a bot type registration flow action",
+        "operationId": "registerBotType",
+        "x-astrbot-scope": "bot",
+        "parameters": [
+          {
+            "name": "bot_type",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/BotRegistrationRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/bots": {
+      "get": {
+        "tags": [
+          "Bots"
+        ],
+        "summary": "List created bots and their configurations",
+        "operationId": "listBots",
+        "x-astrbot-scope": "bot",
+        "parameters": [
+          {
+            "name": "enabled",
+            "in": "query",
+            "schema": {
+              "type": "boolean"
+            }
+          },
+          {
+            "name": "type",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Bots"
+        ],
+        "summary": "Create a bot from configuration",
+        "operationId": "createBot",
+        "x-astrbot-scope": "bot",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/BotConfigRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/bots/stats": {
+      "get": {
+        "tags": [
+          "Bots"
+        ],
+        "summary": "List runtime status for all bots",
+        "operationId": "listBotStats",
+        "x-astrbot-scope": "bot",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/bots/by-id": {
+      "get": {
+        "tags": [
+          "Bots"
+        ],
+        "summary": "Get a bot configuration by query ID",
+        "operationId": "getBotById",
+        "x-astrbot-scope": "bot",
+        "parameters": [
+          {
+            "name": "bot_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "Bots"
+        ],
+        "summary": "Replace a bot configuration by body ID",
+        "operationId": "updateBotById",
+        "x-astrbot-scope": "bot",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "bot_id",
+                  "config"
+                ],
+                "properties": {
+                  "bot_id": {
+                    "type": "string"
+                  },
+                  "config": {
+                    "$ref": "#/components/schemas/DynamicConfig"
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Bots"
+        ],
+        "summary": "Delete a bot by query ID",
+        "operationId": "deleteBotById",
+        "x-astrbot-scope": "bot",
+        "parameters": [
+          {
+            "name": "bot_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/bots/enabled": {
+      "patch": {
+        "tags": [
+          "Bots"
+        ],
+        "summary": "Enable or disable a bot by body ID",
+        "operationId": "setBotEnabledById",
+        "x-astrbot-scope": "bot",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "bot_id",
+                  "enabled"
+                ],
+                "properties": {
+                  "bot_id": {
+                    "type": "string"
+                  },
+                  "enabled": {
+                    "type": "boolean"
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/bots/test": {
+      "post": {
+        "tags": [
+          "Bots"
+        ],
+        "summary": "Test a bot registration or connection by body ID",
+        "operationId": "testBotById",
+        "x-astrbot-scope": "bot",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "bot_id"
+                ],
+                "properties": {
+                  "bot_id": {
+                    "type": "string"
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/bots/{bot_id}": {
+      "get": {
+        "tags": [
+          "Bots"
+        ],
+        "summary": "Get a bot configuration",
+        "operationId": "getBot",
+        "x-astrbot-scope": "bot",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/BotId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "Bots"
+        ],
+        "summary": "Replace a bot configuration",
+        "operationId": "updateBot",
+        "x-astrbot-scope": "bot",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/BotId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/BotConfigRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Bots"
+        ],
+        "summary": "Delete a bot",
+        "operationId": "deleteBot",
+        "x-astrbot-scope": "bot",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/BotId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/bots/{bot_id}/enabled": {
+      "patch": {
+        "tags": [
+          "Bots"
+        ],
+        "summary": "Enable or disable a bot",
+        "operationId": "setBotEnabled",
+        "x-astrbot-scope": "bot",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/BotId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/EnabledPatch"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/bots/{bot_id}/test": {
+      "post": {
+        "tags": [
+          "Bots"
+        ],
+        "summary": "Test a bot registration or connection",
+        "operationId": "testBot",
+        "x-astrbot-scope": "bot",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/BotId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/providers/schema": {
+      "get": {
+        "tags": [
+          "Providers"
+        ],
+        "summary": "Get the overall provider configuration schema",
+        "operationId": "getProviderSchema",
+        "x-astrbot-scope": "provider",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/provider-sources": {
+      "get": {
+        "tags": [
+          "Provider Sources"
+        ],
+        "summary": "List provider sources",
+        "operationId": "listProviderSources",
+        "x-astrbot-scope": "provider",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Provider Sources"
+        ],
+        "summary": "Create a provider source",
+        "operationId": "createProviderSource",
+        "x-astrbot-scope": "provider",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ProviderSourceConfigRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/provider-sources/by-id": {
+      "get": {
+        "tags": [
+          "Provider Sources"
+        ],
+        "summary": "Get a provider source by query ID",
+        "operationId": "getProviderSourceById",
+        "x-astrbot-scope": "provider",
+        "parameters": [
+          {
+            "name": "source_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "Provider Sources"
+        ],
+        "summary": "Update a provider source by body ID",
+        "operationId": "upsertProviderSourceById",
+        "x-astrbot-scope": "provider",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "source_id",
+                  "config"
+                ],
+                "properties": {
+                  "source_id": {
+                    "type": "string"
+                  },
+                  "config": {
+                    "$ref": "#/components/schemas/DynamicConfig"
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Provider Sources"
+        ],
+        "summary": "Delete a provider source by query ID",
+        "operationId": "deleteProviderSourceById",
+        "x-astrbot-scope": "provider",
+        "parameters": [
+          {
+            "name": "source_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/provider-sources/models": {
+      "get": {
+        "tags": [
+          "Provider Sources"
+        ],
+        "summary": "List models available from a provider source by query ID",
+        "operationId": "listProviderSourceModelsById",
+        "x-astrbot-scope": "provider",
+        "parameters": [
+          {
+            "name": "source_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "capability",
+            "in": "query",
+            "schema": {
+              "$ref": "#/components/schemas/ProviderCapability"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/provider-sources/providers": {
+      "get": {
+        "tags": [
+          "Providers"
+        ],
+        "summary": "List providers under a provider source by query ID",
+        "operationId": "listProvidersBySourceId",
+        "x-astrbot-scope": "provider",
+        "parameters": [
+          {
+            "name": "source_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "capability",
+            "in": "query",
+            "schema": {
+              "$ref": "#/components/schemas/ProviderCapability"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Providers"
+        ],
+        "summary": "Create a provider under a provider source by body ID",
+        "operationId": "createProviderInSourceById",
+        "x-astrbot-scope": "provider",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "source_id",
+                  "config"
+                ],
+                "properties": {
+                  "source_id": {
+                    "type": "string"
+                  },
+                  "config": {
+                    "$ref": "#/components/schemas/DynamicConfig"
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/provider-sources/{source_id}": {
+      "get": {
+        "tags": [
+          "Provider Sources"
+        ],
+        "summary": "Get a provider source",
+        "operationId": "getProviderSource",
+        "x-astrbot-scope": "provider",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/SourceId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "Provider Sources"
+        ],
+        "summary": "Update a provider source or create it if missing",
+        "operationId": "upsertProviderSource",
+        "x-astrbot-scope": "provider",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/SourceId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ProviderSourceConfigRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Provider Sources"
+        ],
+        "summary": "Delete a provider source and providers that reference it",
+        "operationId": "deleteProviderSource",
+        "x-astrbot-scope": "provider",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/SourceId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/provider-sources/{source_id}/models": {
+      "get": {
+        "tags": [
+          "Provider Sources"
+        ],
+        "summary": "List models available from a provider source",
+        "operationId": "listProviderSourceModels",
+        "x-astrbot-scope": "provider",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/SourceId"
+          },
+          {
+            "name": "capability",
+            "in": "query",
+            "schema": {
+              "$ref": "#/components/schemas/ProviderCapability"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/provider-sources/{source_id}/providers": {
+      "get": {
+        "tags": [
+          "Providers"
+        ],
+        "summary": "List providers under a provider source",
+        "operationId": "listProvidersBySource",
+        "x-astrbot-scope": "provider",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/SourceId"
+          },
+          {
+            "name": "capability",
+            "in": "query",
+            "schema": {
+              "$ref": "#/components/schemas/ProviderCapability"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Providers"
+        ],
+        "summary": "Create a provider under a provider source",
+        "operationId": "createProviderInSource",
+        "x-astrbot-scope": "provider",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/SourceId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ProviderConfigRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/providers": {
+      "get": {
+        "tags": [
+          "Providers"
+        ],
+        "summary": "List providers by capability or source",
+        "operationId": "listProviders",
+        "x-astrbot-scope": "provider",
+        "parameters": [
+          {
+            "name": "capability",
+            "in": "query",
+            "schema": {
+              "$ref": "#/components/schemas/ProviderCapability"
+            }
+          },
+          {
+            "name": "source_id",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "enabled",
+            "in": "query",
+            "schema": {
+              "type": "boolean"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Providers"
+        ],
+        "summary": "Create a standalone provider",
+        "operationId": "createProvider",
+        "x-astrbot-scope": "provider",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ProviderConfigRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/providers/by-id": {
+      "get": {
+        "tags": [
+          "Providers"
+        ],
+        "summary": "Get a provider configuration by query ID",
+        "operationId": "getProviderById",
+        "x-astrbot-scope": "provider",
+        "parameters": [
+          {
+            "name": "provider_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "merged",
+            "in": "query",
+            "schema": {
+              "type": "boolean",
+              "default": false
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "Providers"
+        ],
+        "summary": "Replace a provider configuration by body ID",
+        "operationId": "updateProviderById",
+        "x-astrbot-scope": "provider",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "provider_id",
+                  "config"
+                ],
+                "properties": {
+                  "provider_id": {
+                    "type": "string"
+                  },
+                  "config": {
+                    "$ref": "#/components/schemas/DynamicConfig"
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Providers"
+        ],
+        "summary": "Delete a provider by query ID",
+        "operationId": "deleteProviderById",
+        "x-astrbot-scope": "provider",
+        "parameters": [
+          {
+            "name": "provider_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/providers/enabled": {
+      "patch": {
+        "tags": [
+          "Providers"
+        ],
+        "summary": "Enable or disable a provider by body ID",
+        "operationId": "setProviderEnabledById",
+        "x-astrbot-scope": "provider",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "provider_id",
+                  "enabled"
+                ],
+                "properties": {
+                  "provider_id": {
+                    "type": "string"
+                  },
+                  "enabled": {
+                    "type": "boolean"
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/providers/test": {
+      "post": {
+        "tags": [
+          "Providers"
+        ],
+        "summary": "Test a provider by body ID",
+        "operationId": "testProviderById",
+        "x-astrbot-scope": "provider",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "provider_id"
+                ],
+                "properties": {
+                  "provider_id": {
+                    "type": "string"
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/providers/embedding-dimension": {
+      "post": {
+        "tags": [
+          "Providers"
+        ],
+        "summary": "Probe embedding dimension for a provider by body ID",
+        "operationId": "getProviderEmbeddingDimensionById",
+        "x-astrbot-scope": "provider",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "provider_id"
+                ],
+                "properties": {
+                  "provider_id": {
+                    "type": "string"
+                  },
+                  "provider_config": {
+                    "$ref": "#/components/schemas/DynamicConfig"
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/providers/{provider_id}": {
+      "get": {
+        "tags": [
+          "Providers"
+        ],
+        "summary": "Get a provider configuration",
+        "operationId": "getProvider",
+        "x-astrbot-scope": "provider",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ProviderId"
+          },
+          {
+            "name": "merged",
+            "in": "query",
+            "schema": {
+              "type": "boolean",
+              "default": false
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "Providers"
+        ],
+        "summary": "Replace a provider configuration",
+        "operationId": "updateProvider",
+        "x-astrbot-scope": "provider",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ProviderId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ProviderConfigRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Providers"
+        ],
+        "summary": "Delete a provider",
+        "operationId": "deleteProvider",
+        "x-astrbot-scope": "provider",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ProviderId"
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/DynamicConfig"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/providers/{provider_id}/enabled": {
+      "patch": {
+        "tags": [
+          "Providers"
+        ],
+        "summary": "Enable or disable a provider",
+        "operationId": "setProviderEnabled",
+        "x-astrbot-scope": "provider",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ProviderId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/EnabledPatch"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/providers/{provider_id}/test": {
+      "post": {
+        "tags": [
+          "Providers"
+        ],
+        "summary": "Test a provider",
+        "operationId": "testProvider",
+        "x-astrbot-scope": "provider",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ProviderId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/providers/{provider_id}/embedding-dimension": {
+      "post": {
+        "tags": [
+          "Providers"
+        ],
+        "summary": "Probe embedding dimension for a provider",
+        "operationId": "getProviderEmbeddingDimension",
+        "x-astrbot-scope": "provider",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ProviderId"
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/DynamicConfig"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/chat": {
+      "post": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "Send a webchat message",
+        "operationId": "sendChatMessage",
+        "x-astrbot-scope": "chat",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ChatRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/chat/ws": {
+      "get": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "Open a streaming chat WebSocket",
+        "operationId": "openChatWebSocket",
+        "x-websocket": true,
+        "x-astrbot-scope": "chat",
+        "parameters": [
+          {
+            "name": "api_key",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "key",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "101": {
+            "description": "WebSocket upgrade accepted"
+          }
+        }
+      }
+    },
+    "/api/v1/live-chat/ws": {
+      "get": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "Open the live voice chat WebSocket",
+        "operationId": "openLiveChatWebSocket",
+        "x-websocket": true,
+        "x-astrbot-scope": "chat",
+        "parameters": [
+          {
+            "name": "token",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "101": {
+            "description": "WebSocket upgrade accepted"
+          }
+        }
+      }
+    },
+    "/api/v1/unified-chat/ws": {
+      "get": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "Open the unified live/chat WebSocket",
+        "operationId": "openUnifiedChatWebSocket",
+        "x-websocket": true,
+        "x-astrbot-scope": "chat",
+        "parameters": [
+          {
+            "name": "token",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "101": {
+            "description": "WebSocket upgrade accepted"
+          }
+        }
+      }
+    },
+    "/api/v1/chat/sessions": {
+      "get": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "List webchat sessions",
+        "operationId": "listChatSessions",
+        "x-astrbot-scope": "chat",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Page"
+          },
+          {
+            "$ref": "#/components/parameters/PageSize"
+          },
+          {
+            "name": "username",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/chat/sessions/new": {
+      "get": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "Create a webchat session",
+        "operationId": "createChatSession",
+        "x-astrbot-scope": "chat",
+        "parameters": [
+          {
+            "name": "platform_id",
+            "in": "query",
+            "schema": {
+              "type": "string",
+              "default": "webchat"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/chat/sessions/batch-delete": {
+      "post": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "Delete multiple webchat sessions",
+        "operationId": "batchDeleteChatSessions",
+        "x-astrbot-scope": "chat",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ChatSessionBatchDeleteRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/chat/sessions/{session_id}": {
+      "get": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "Get a webchat session and its messages",
+        "operationId": "getChatSession",
+        "x-astrbot-scope": "chat",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/SessionId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "patch": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "Update a webchat session",
+        "operationId": "updateChatSession",
+        "x-astrbot-scope": "chat",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/SessionId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ChatSessionPatchRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "Delete a webchat session",
+        "operationId": "deleteChatSession",
+        "x-astrbot-scope": "chat",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/SessionId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/chat/sessions/{session_id}/stop": {
+      "post": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "Stop active webchat work for a session",
+        "operationId": "stopChatSession",
+        "x-astrbot-scope": "chat",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/SessionId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/chat/sessions/{session_id}/messages/{message_id}": {
+      "patch": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "Update the latest user message in a webchat session",
+        "operationId": "updateChatMessage",
+        "x-astrbot-scope": "chat",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/SessionId"
+          },
+          {
+            "name": "message_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ChatMessagePatchRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/chat/sessions/{session_id}/messages/{message_id}/regenerate": {
+      "post": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "Regenerate a bot message in a webchat session",
+        "operationId": "regenerateChatMessage",
+        "x-astrbot-scope": "chat",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/SessionId"
+          },
+          {
+            "name": "message_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ChatMessageRegenerateRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Server-sent chat stream or an error envelope"
+          }
+        }
+      }
+    },
+    "/api/v1/chat/configs": {
+      "get": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "List chat-selectable configuration profiles",
+        "operationId": "listChatConfigs",
+        "x-astrbot-scope": "config",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/chat/threads": {
+      "post": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "Create or reuse a side thread from a webchat message",
+        "operationId": "createChatThread",
+        "x-astrbot-scope": "chat",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ChatThreadCreateRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/chat/threads/{thread_id}": {
+      "get": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "Get a webchat side thread",
+        "operationId": "getChatThread",
+        "x-astrbot-scope": "chat",
+        "parameters": [
+          {
+            "name": "thread_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "Delete a webchat side thread",
+        "operationId": "deleteChatThread",
+        "x-astrbot-scope": "chat",
+        "parameters": [
+          {
+            "name": "thread_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/chat/threads/{thread_id}/messages": {
+      "post": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "Send a message inside a webchat side thread",
+        "operationId": "sendChatThreadMessage",
+        "x-astrbot-scope": "chat",
+        "parameters": [
+          {
+            "name": "thread_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ChatThreadMessageRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Server-sent chat stream or an error envelope"
+          }
+        }
+      }
+    },
+    "/api/v1/chat/projects": {
+      "get": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "List ChatUI projects",
+        "operationId": "listChatProjects",
+        "x-astrbot-scope": "chat",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "Create a ChatUI project",
+        "operationId": "createChatProject",
+        "x-astrbot-scope": "chat",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ChatProjectRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/chat/projects/{project_id}": {
+      "get": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "Get a ChatUI project",
+        "operationId": "getChatProject",
+        "x-astrbot-scope": "chat",
+        "parameters": [
+          {
+            "name": "project_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "patch": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "Update a ChatUI project",
+        "operationId": "updateChatProject",
+        "x-astrbot-scope": "chat",
+        "parameters": [
+          {
+            "name": "project_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ChatProjectRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "Delete a ChatUI project",
+        "operationId": "deleteChatProject",
+        "x-astrbot-scope": "chat",
+        "parameters": [
+          {
+            "name": "project_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/chat/projects/{project_id}/sessions": {
+      "get": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "List sessions in a ChatUI project",
+        "operationId": "listChatProjectSessions",
+        "x-astrbot-scope": "chat",
+        "parameters": [
+          {
+            "name": "project_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/chat/projects/{project_id}/sessions/{session_id}": {
+      "post": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "Add a session to a ChatUI project",
+        "operationId": "addChatProjectSession",
+        "x-astrbot-scope": "chat",
+        "parameters": [
+          {
+            "name": "project_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "$ref": "#/components/parameters/SessionId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/chat/projects/sessions/{session_id}": {
+      "delete": {
+        "tags": [
+          "Chat"
+        ],
+        "summary": "Remove a session from its ChatUI project",
+        "operationId": "removeChatProjectSession",
+        "x-astrbot-scope": "chat",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/SessionId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/im/messages": {
+      "post": {
+        "tags": [
+          "IM"
+        ],
+        "summary": "Send a message to a UMO",
+        "operationId": "sendImMessage",
+        "x-astrbot-scope": "im",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ImMessageRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/im/bots": {
+      "get": {
+        "tags": [
+          "IM"
+        ],
+        "summary": "List active IM bot IDs",
+        "operationId": "listImBots",
+        "x-astrbot-scope": "im",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/files": {
+      "post": {
+        "tags": [
+          "Files"
+        ],
+        "summary": "Upload a file",
+        "operationId": "uploadFile",
+        "x-astrbot-scope": "file",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "multipart/form-data": {
+              "schema": {
+                "$ref": "#/components/schemas/FileUploadRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/files/content": {
+      "get": {
+        "tags": [
+          "Files"
+        ],
+        "summary": "Get an uploaded file by stored filename",
+        "operationId": "getFileByName",
+        "x-astrbot-scope": "file",
+        "parameters": [
+          {
+            "name": "filename",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "File bytes or an error envelope",
             "content": {
               "application/octet-stream": {
                 "schema": {
@@ -132,26 +2590,383 @@
                 }
               }
             }
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
           }
         }
       }
     },
-    "/api/v1/chat": {
+    "/api/v1/files/tokens/{file_token}": {
+      "get": {
+        "tags": [
+          "Files"
+        ],
+        "summary": "Get a tokenized public file",
+        "operationId": "getTokenFile",
+        "x-astrbot-scope": "file",
+        "parameters": [
+          {
+            "name": "file_token",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Tokenized file bytes or an error envelope",
+            "content": {
+              "application/octet-stream": {
+                "schema": {
+                  "type": "string",
+                  "format": "binary"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/api/v1/files/{attachment_id}": {
+      "get": {
+        "tags": [
+          "Files"
+        ],
+        "summary": "Get attachment metadata",
+        "operationId": "getAttachment",
+        "x-astrbot-scope": "file",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/AttachmentId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Files"
+        ],
+        "summary": "Delete an attachment",
+        "operationId": "deleteAttachment",
+        "x-astrbot-scope": "file",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/AttachmentId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/files/{attachment_id}/content": {
+      "get": {
+        "tags": [
+          "Files"
+        ],
+        "summary": "Download attachment content",
+        "operationId": "downloadAttachment",
+        "x-astrbot-scope": "file",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/AttachmentId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "File content",
+            "content": {
+              "application/octet-stream": {
+                "schema": {
+                  "type": "string",
+                  "format": "binary"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/api/v1/plugins": {
+      "get": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "List installed plugins",
+        "operationId": "listPlugins",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "name": "include_reserved",
+            "in": "query",
+            "schema": {
+              "type": "boolean",
+              "default": true
+            }
+          },
+          {
+            "name": "enabled",
+            "in": "query",
+            "schema": {
+              "type": "boolean"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/by-id": {
+      "get": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Get plugin details by query ID",
+        "operationId": "getPluginById",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "name": "plugin_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Uninstall a plugin by query ID",
+        "operationId": "uninstallPluginById",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "name": "plugin_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "delete_config": {
+                    "type": "boolean"
+                  },
+                  "delete_data": {
+                    "type": "boolean"
+                  }
+                },
+                "additionalProperties": true
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/config": {
+      "get": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Get plugin configuration by query ID",
+        "operationId": "getPluginConfigById",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "name": "plugin_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Save plugin configuration by body ID",
+        "operationId": "updatePluginConfigById",
+        "x-astrbot-scope": "plugin",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "plugin_id",
+                  "config"
+                ],
+                "properties": {
+                  "plugin_id": {
+                    "type": "string"
+                  },
+                  "config": {
+                    "$ref": "#/components/schemas/DynamicConfig"
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/config/schema": {
+      "get": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Get plugin configuration schema by query ID",
+        "operationId": "getPluginConfigSchemaById",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "name": "plugin_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/config-files": {
+      "get": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "List uploaded files for a plugin file configuration item by query ID",
+        "operationId": "listPluginConfigFilesById",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "name": "plugin_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "config_key",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
       "post": {
         "tags": [
-          "Open API"
+          "Plugins"
         ],
-        "summary": "Send chat message (SSE)",
-        "description": "Send message to AstrBot chat pipeline and receive streaming SSE response. Reuses /api/chat/send behavior. If session_id/conversation_id is omitted, server will create a new UUID session_id.",
-        "security": [
+        "summary": "Upload files for a plugin file configuration item by query ID",
+        "operationId": "uploadPluginConfigFilesById",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
           {
-            "ApiKeyHeader": []
+            "name": "plugin_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "config_key",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "multipart/form-data": {
+              "schema": {
+                "type": "object",
+                "additionalProperties": true
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Delete a plugin file configuration upload by query ID",
+        "operationId": "deletePluginConfigFileById",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "name": "plugin_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
           }
         ],
         "requestBody": {
@@ -159,50 +2974,937 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/ChatSendRequest"
-              },
-              "examples": {
-                "plain": {
-                  "value": {
-                    "message": "Hello",
-                    "username": "alice",
-                    "session_id": "my_session_001",
-                    "enable_streaming": true
+                "$ref": "#/components/schemas/PluginConfigFileDeleteRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/readme": {
+      "get": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Get plugin README content by query ID",
+        "operationId": "getPluginReadmeById",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "name": "plugin_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Text"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/changelog": {
+      "get": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Get plugin CHANGELOG content by query ID",
+        "operationId": "getPluginChangelogById",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "name": "plugin_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Text"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/reload": {
+      "post": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Reload a plugin by body ID",
+        "operationId": "reloadPluginById",
+        "x-astrbot-scope": "plugin",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "plugin_id"
+                ],
+                "properties": {
+                  "plugin_id": {
+                    "type": "string"
                   }
                 },
-                "multipartMessage": {
-                  "value": {
-                    "message": [
-                      {
-                        "type": "plain",
-                        "text": "Please analyze this file"
-                      },
-                      {
-                        "type": "file",
-                        "attachment_id": "9a2f8c72-e7af-4c0e-b352-111111111111"
-                      }
-                    ],
-                    "username": "alice",
-                    "session_id": "my_session_001",
-                    "selected_provider": "openai_chat_completion",
-                    "selected_model": "gpt-4.1-mini",
-                    "enable_streaming": true
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/enabled": {
+      "patch": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Enable or disable a plugin by body ID",
+        "operationId": "setPluginEnabledById",
+        "x-astrbot-scope": "plugin",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "plugin_id",
+                  "enabled"
+                ],
+                "properties": {
+                  "plugin_id": {
+                    "type": "string"
+                  },
+                  "enabled": {
+                    "type": "boolean"
                   }
                 },
-                "withConfig": {
-                  "value": {
-                    "message": "Use a specific config for this session",
-                    "username": "alice",
-                    "session_id": "my_session_001",
-                    "config_id": "default",
-                    "enable_streaming": true
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/pages": {
+      "get": {
+        "tags": [
+          "Plugin Pages"
+        ],
+        "summary": "List plugin pages by query ID",
+        "operationId": "listPluginPagesById",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "name": "plugin_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/page": {
+      "get": {
+        "tags": [
+          "Plugin Pages"
+        ],
+        "summary": "Get plugin page entry HTML by query ID",
+        "operationId": "getPluginPageById",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "name": "plugin_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "page_name",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Html"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/page/assets": {
+      "get": {
+        "tags": [
+          "Plugin Pages"
+        ],
+        "summary": "Get a plugin page asset by query ID",
+        "operationId": "getPluginPageAssetById",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "name": "plugin_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "page_name",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "asset_path",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Plugin asset content"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/{plugin_id}": {
+      "get": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Get plugin details",
+        "operationId": "getPlugin",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/PluginId"
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "delete_config": {
+                    "type": "boolean"
+                  },
+                  "delete_data": {
+                    "type": "boolean"
                   }
                 },
-                "autoSessionWithUsername": {
-                  "value": {
-                    "message": "hello",
-                    "username": "alice",
-                    "enable_streaming": true
+                "additionalProperties": true
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Uninstall a plugin",
+        "operationId": "uninstallPlugin",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/PluginId"
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "delete_config": {
+                    "type": "boolean"
+                  },
+                  "delete_data": {
+                    "type": "boolean"
+                  }
+                },
+                "additionalProperties": true
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/{plugin_id}/config": {
+      "get": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Get plugin configuration",
+        "operationId": "getPluginConfig",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/PluginId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Save plugin configuration",
+        "operationId": "updatePluginConfig",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/PluginId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/DynamicConfig"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/{plugin_id}/config/schema": {
+      "get": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Get plugin configuration schema",
+        "operationId": "getPluginConfigSchema",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/PluginId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/{plugin_id}/config-files/{config_key}": {
+      "get": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "List uploaded files for a plugin file configuration item",
+        "operationId": "listPluginConfigFiles",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/PluginId"
+          },
+          {
+            "name": "config_key",
+            "in": "path",
+            "required": true,
+            "description": "URL-encoded configuration key path.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Upload files for a plugin file configuration item",
+        "operationId": "uploadPluginConfigFiles",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/PluginId"
+          },
+          {
+            "name": "config_key",
+            "in": "path",
+            "required": true,
+            "description": "URL-encoded configuration key path.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "multipart/form-data": {
+              "schema": {
+                "type": "object",
+                "additionalProperties": true
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/{plugin_id}/config-files": {
+      "delete": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Delete a plugin file configuration upload",
+        "operationId": "deletePluginConfigFile",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/PluginId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PluginConfigFileDeleteRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/{plugin_id}/readme": {
+      "get": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Get plugin README content",
+        "operationId": "getPluginReadme",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/PluginId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Text"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/{plugin_id}/changelog": {
+      "get": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Get plugin CHANGELOG content",
+        "operationId": "getPluginChangelog",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/PluginId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Text"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/{plugin_id}/reload": {
+      "post": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Reload a plugin",
+        "operationId": "reloadPlugin",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/PluginId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/{plugin_id}/enabled": {
+      "patch": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Enable or disable a plugin",
+        "operationId": "setPluginEnabled",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/PluginId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/EnabledPatch"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/{plugin_id}/update": {
+      "post": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Update or reinstall a plugin",
+        "operationId": "updatePlugin",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/PluginId"
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PluginUpdateRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/update": {
+      "post": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Update multiple plugins",
+        "operationId": "updatePlugins",
+        "x-astrbot-scope": "plugin",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PluginBatchUpdateRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/version-support/check": {
+      "post": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Check whether a plugin version constraint is supported",
+        "operationId": "checkPluginVersionSupport",
+        "x-astrbot-scope": "plugin",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PluginVersionSupportRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/failed": {
+      "get": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "List failed plugins and errors",
+        "operationId": "listFailedPlugins",
+        "x-astrbot-scope": "plugin",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/failed/{plugin_id}": {
+      "delete": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Uninstall a failed plugin",
+        "operationId": "uninstallFailedPlugin",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/PluginId"
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "delete_config": {
+                    "type": "boolean"
+                  },
+                  "delete_data": {
+                    "type": "boolean"
+                  }
+                },
+                "additionalProperties": true
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/failed/{plugin_id}/reload": {
+      "post": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Reload a failed plugin",
+        "operationId": "reloadFailedPlugin",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/PluginId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/install/github": {
+      "post": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Install a plugin from GitHub",
+        "operationId": "installPluginFromGithub",
+        "x-astrbot-scope": "plugin",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PluginGithubInstallRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/install/url": {
+      "post": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Install a plugin from a downloadable ZIP URL",
+        "operationId": "installPluginFromUrl",
+        "x-astrbot-scope": "plugin",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PluginUrlInstallRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/install/upload": {
+      "post": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "Install a plugin from an uploaded ZIP file",
+        "operationId": "installPluginFromUpload",
+        "x-astrbot-scope": "plugin",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "multipart/form-data": {
+              "schema": {
+                "$ref": "#/components/schemas/PluginUploadInstallRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/market": {
+      "get": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "List plugin marketplace entries",
+        "operationId": "listPluginMarket",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Page"
+          },
+          {
+            "$ref": "#/components/parameters/PageSize"
+          },
+          {
+            "name": "category",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "sort",
+            "in": "query",
+            "schema": {
+              "type": "string",
+              "enum": [
+                "recommended",
+                "downloads",
+                "updated",
+                "name"
+              ]
+            }
+          },
+          {
+            "name": "keyword",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "force_refresh",
+            "in": "query",
+            "schema": {
+              "type": "boolean"
+            }
+          },
+          {
+            "name": "custom_registry",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/market/categories": {
+      "get": {
+        "tags": [
+          "Plugins"
+        ],
+        "summary": "List plugin marketplace categories",
+        "operationId": "listPluginMarketCategories",
+        "x-astrbot-scope": "plugin",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugin-sources": {
+      "get": {
+        "tags": [
+          "Plugin Sources"
+        ],
+        "summary": "List plugin sources",
+        "operationId": "listPluginSources",
+        "x-astrbot-scope": "plugin",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Plugin Sources"
+        ],
+        "summary": "Add a plugin source",
+        "operationId": "createPluginSource",
+        "x-astrbot-scope": "plugin",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PluginSourceRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "Plugin Sources"
+        ],
+        "summary": "Replace plugin sources",
+        "operationId": "replacePluginSources",
+        "x-astrbot-scope": "plugin",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "sources"
+                ],
+                "properties": {
+                  "sources": {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/components/schemas/PluginSourceRequest"
+                    }
                   }
                 }
               }
@@ -211,7 +3913,3627 @@
         },
         "responses": {
           "200": {
-            "description": "SSE stream",
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugin-sources/{source_id}": {
+      "delete": {
+        "tags": [
+          "Plugin Sources"
+        ],
+        "summary": "Delete a plugin source",
+        "operationId": "deletePluginSource",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/SourceId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugin-sources/by-id": {
+      "delete": {
+        "tags": [
+          "Plugin Sources"
+        ],
+        "summary": "Delete a plugin source by query ID",
+        "operationId": "deletePluginSourceById",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "name": "source_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/{plugin_id}/pages": {
+      "get": {
+        "tags": [
+          "Plugin Pages"
+        ],
+        "summary": "List plugin pages",
+        "operationId": "listPluginPages",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/PluginId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/{plugin_id}/pages/{page_name}": {
+      "get": {
+        "tags": [
+          "Plugin Pages"
+        ],
+        "summary": "Get plugin page entry HTML",
+        "operationId": "getPluginPage",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/PluginId"
+          },
+          {
+            "name": "page_name",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Html"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/{plugin_id}/pages/{page_name}/assets/{asset_path}": {
+      "get": {
+        "tags": [
+          "Plugin Pages"
+        ],
+        "summary": "Get a plugin page asset",
+        "operationId": "getPluginPageAsset",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/PluginId"
+          },
+          {
+            "name": "page_name",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "asset_path",
+            "in": "path",
+            "required": true,
+            "description": "URL-encoded relative asset path.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Plugin asset content"
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/page-bridge-sdk.js": {
+      "get": {
+        "tags": [
+          "Plugin Pages"
+        ],
+        "summary": "Get the plugin page bridge SDK",
+        "operationId": "getPluginPageBridgeSdk",
+        "x-astrbot-scope": "plugin",
+        "responses": {
+          "200": {
+            "description": "JavaScript bridge SDK",
+            "content": {
+              "application/javascript": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/api/v1/plugins/extensions/{plugin_path}": {
+      "get": {
+        "tags": [
+          "Plugin Pages"
+        ],
+        "summary": "Proxy a plugin extension GET route",
+        "operationId": "getPluginExtensionRoute",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "name": "plugin_path",
+            "in": "path",
+            "required": true,
+            "description": "Plugin extension path after /api/plug/. It may contain slash-separated segments.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Plugin Pages"
+        ],
+        "summary": "Proxy a plugin extension POST route",
+        "operationId": "postPluginExtensionRoute",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "name": "plugin_path",
+            "in": "path",
+            "required": true,
+            "description": "Plugin extension path after /api/plug/. It may contain slash-separated segments.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/DynamicConfig"
+              }
+            },
+            "multipart/form-data": {
+              "schema": {
+                "type": "object",
+                "additionalProperties": true
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "Plugin Pages"
+        ],
+        "summary": "Proxy a plugin extension PUT route",
+        "operationId": "putPluginExtensionRoute",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "name": "plugin_path",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/DynamicConfig"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "patch": {
+        "tags": [
+          "Plugin Pages"
+        ],
+        "summary": "Proxy a plugin extension PATCH route",
+        "operationId": "patchPluginExtensionRoute",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "name": "plugin_path",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/DynamicConfig"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Plugin Pages"
+        ],
+        "summary": "Proxy a plugin extension DELETE route",
+        "operationId": "deletePluginExtensionRoute",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "name": "plugin_path",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/commands": {
+      "get": {
+        "tags": [
+          "Commands"
+        ],
+        "summary": "List plugin commands",
+        "operationId": "listCommands",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "name": "config_id",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/commands/{command_id}": {
+      "patch": {
+        "tags": [
+          "Commands"
+        ],
+        "summary": "Update command enabled state, alias, or permission group",
+        "operationId": "updateCommand",
+        "x-astrbot-scope": "plugin",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/CommandId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CommandPatchRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/commands/conflicts": {
+      "get": {
+        "tags": [
+          "Commands"
+        ],
+        "summary": "List command conflicts",
+        "operationId": "listCommandConflicts",
+        "x-astrbot-scope": "plugin",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/tools": {
+      "get": {
+        "tags": [
+          "Tools"
+        ],
+        "summary": "List LLM tools",
+        "operationId": "listTools",
+        "x-astrbot-scope": "tool",
+        "parameters": [
+          {
+            "name": "origin",
+            "in": "query",
+            "schema": {
+              "type": "string",
+              "enum": [
+                "builtin",
+                "plugin",
+                "mcp"
+              ]
+            }
+          },
+          {
+            "name": "enabled",
+            "in": "query",
+            "schema": {
+              "type": "boolean"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/tools/{tool_id}/enabled": {
+      "patch": {
+        "tags": [
+          "Tools"
+        ],
+        "summary": "Enable or disable an LLM tool",
+        "operationId": "setToolEnabled",
+        "x-astrbot-scope": "tool",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ToolId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/EnabledPatch"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/tools/{tool_id}/permission": {
+      "patch": {
+        "tags": [
+          "Tools"
+        ],
+        "summary": "Update an LLM tool permission",
+        "operationId": "setToolPermission",
+        "x-astrbot-scope": "tool",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ToolId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ToolPermissionPatch"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/mcp/servers": {
+      "get": {
+        "tags": [
+          "MCP"
+        ],
+        "summary": "List MCP servers",
+        "operationId": "listMcpServers",
+        "x-astrbot-scope": "mcp",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "MCP"
+        ],
+        "summary": "Add an MCP server",
+        "operationId": "createMcpServer",
+        "x-astrbot-scope": "mcp",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/McpServerConfig"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/mcp/servers/by-name": {
+      "put": {
+        "tags": [
+          "MCP"
+        ],
+        "summary": "Update an MCP server by body name",
+        "operationId": "updateMcpServerByName",
+        "x-astrbot-scope": "mcp",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "server_name"
+                ],
+                "properties": {
+                  "server_name": {
+                    "type": "string"
+                  },
+                  "config": {
+                    "$ref": "#/components/schemas/DynamicConfig"
+                  },
+                  "enabled": {
+                    "type": "boolean"
+                  }
+                },
+                "additionalProperties": true
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "MCP"
+        ],
+        "summary": "Delete an MCP server by query name",
+        "operationId": "deleteMcpServerByName",
+        "x-astrbot-scope": "mcp",
+        "parameters": [
+          {
+            "name": "server_name",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/mcp/servers/enabled": {
+      "patch": {
+        "tags": [
+          "MCP"
+        ],
+        "summary": "Enable or disable an MCP server by body name",
+        "operationId": "setMcpServerEnabledByName",
+        "x-astrbot-scope": "mcp",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "server_name",
+                  "enabled"
+                ],
+                "properties": {
+                  "server_name": {
+                    "type": "string"
+                  },
+                  "enabled": {
+                    "type": "boolean"
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/mcp/servers/test": {
+      "post": {
+        "tags": [
+          "MCP"
+        ],
+        "summary": "Test an MCP server connection by body name",
+        "operationId": "testMcpServerByName",
+        "x-astrbot-scope": "mcp",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "server_name"
+                ],
+                "properties": {
+                  "server_name": {
+                    "type": "string"
+                  },
+                  "mcp_server_config": {
+                    "$ref": "#/components/schemas/DynamicConfig"
+                  },
+                  "config": {
+                    "$ref": "#/components/schemas/DynamicConfig"
+                  }
+                },
+                "additionalProperties": true
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/mcp/servers/{server_name}": {
+      "put": {
+        "tags": [
+          "MCP"
+        ],
+        "summary": "Update an MCP server",
+        "operationId": "updateMcpServer",
+        "x-astrbot-scope": "mcp",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ServerName"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/McpServerConfig"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "MCP"
+        ],
+        "summary": "Delete an MCP server",
+        "operationId": "deleteMcpServer",
+        "x-astrbot-scope": "mcp",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ServerName"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/mcp/servers/{server_name}/enabled": {
+      "patch": {
+        "tags": [
+          "MCP"
+        ],
+        "summary": "Enable or disable an MCP server",
+        "operationId": "setMcpServerEnabled",
+        "x-astrbot-scope": "mcp",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ServerName"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/EnabledPatch"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/mcp/servers/{server_name}/test": {
+      "post": {
+        "tags": [
+          "MCP"
+        ],
+        "summary": "Test an MCP server connection",
+        "operationId": "testMcpServer",
+        "x-astrbot-scope": "mcp",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ServerName"
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "mcp_server_config": {
+                    "type": "object",
+                    "additionalProperties": true
+                  }
+                },
+                "additionalProperties": true
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/mcp/providers/modelscope/sync": {
+      "post": {
+        "tags": [
+          "MCP"
+        ],
+        "summary": "Sync MCP servers from ModelScope",
+        "operationId": "syncModelScopeMcpServers",
+        "x-astrbot-scope": "mcp",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ModelScopeSyncRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/skills": {
+      "get": {
+        "tags": [
+          "Skills"
+        ],
+        "summary": "List skills",
+        "operationId": "listSkills",
+        "x-astrbot-scope": "skill",
+        "parameters": [
+          {
+            "name": "enabled",
+            "in": "query",
+            "schema": {
+              "type": "boolean"
+            }
+          },
+          {
+            "name": "source",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Skills"
+        ],
+        "summary": "Upload or import a skill archive",
+        "operationId": "uploadSkill",
+        "x-astrbot-scope": "skill",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "multipart/form-data": {
+              "schema": {
+                "$ref": "#/components/schemas/SkillUploadRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/skills/batch": {
+      "post": {
+        "tags": [
+          "Skills"
+        ],
+        "summary": "Upload multiple skill archives",
+        "operationId": "uploadSkillsBatch",
+        "x-astrbot-scope": "skill",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "multipart/form-data": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "files"
+                ],
+                "properties": {
+                  "files": {
+                    "type": "array",
+                    "items": {
+                      "type": "string",
+                      "format": "binary"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/skills/by-name": {
+      "patch": {
+        "tags": [
+          "Skills"
+        ],
+        "summary": "Update skill metadata or enabled state by body name",
+        "operationId": "updateSkillByName",
+        "x-astrbot-scope": "skill",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "skill_name"
+                ],
+                "properties": {
+                  "skill_name": {
+                    "type": "string"
+                  },
+                  "enabled": {
+                    "type": "boolean"
+                  },
+                  "active": {
+                    "type": "boolean"
+                  }
+                },
+                "additionalProperties": true
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Skills"
+        ],
+        "summary": "Delete a skill by query name",
+        "operationId": "deleteSkillByName",
+        "x-astrbot-scope": "skill",
+        "parameters": [
+          {
+            "name": "skill_name",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/skills/archive": {
+      "get": {
+        "tags": [
+          "Skills"
+        ],
+        "summary": "Download a skill archive by query name",
+        "operationId": "downloadSkillByName",
+        "x-astrbot-scope": "skill",
+        "parameters": [
+          {
+            "name": "skill_name",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Skill archive",
+            "content": {
+              "application/zip": {
+                "schema": {
+                  "type": "string",
+                  "format": "binary"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/api/v1/skills/files": {
+      "get": {
+        "tags": [
+          "Skills"
+        ],
+        "summary": "List files in a skill by query name",
+        "operationId": "listSkillFilesByName",
+        "x-astrbot-scope": "skill",
+        "parameters": [
+          {
+            "name": "skill_name",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "path",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/skills/file": {
+      "get": {
+        "tags": [
+          "Skills"
+        ],
+        "summary": "Get skill file content by query name and path",
+        "operationId": "getSkillFileByName",
+        "x-astrbot-scope": "skill",
+        "parameters": [
+          {
+            "name": "skill_name",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "path",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Text"
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "Skills"
+        ],
+        "summary": "Update skill file content by body name and path",
+        "operationId": "updateSkillFileByName",
+        "x-astrbot-scope": "skill",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "skill_name",
+                  "path",
+                  "content"
+                ],
+                "properties": {
+                  "skill_name": {
+                    "type": "string"
+                  },
+                  "path": {
+                    "type": "string"
+                  },
+                  "content": {
+                    "type": "string"
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/skills/{skill_name}": {
+      "patch": {
+        "tags": [
+          "Skills"
+        ],
+        "summary": "Update skill metadata or enabled state",
+        "operationId": "updateSkill",
+        "x-astrbot-scope": "skill",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/SkillName"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SkillPatchRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Skills"
+        ],
+        "summary": "Delete a skill",
+        "operationId": "deleteSkill",
+        "x-astrbot-scope": "skill",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/SkillName"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/skills/{skill_name}/archive": {
+      "get": {
+        "tags": [
+          "Skills"
+        ],
+        "summary": "Download a skill archive",
+        "operationId": "downloadSkill",
+        "x-astrbot-scope": "skill",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/SkillName"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Skill archive",
+            "content": {
+              "application/zip": {
+                "schema": {
+                  "type": "string",
+                  "format": "binary"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/api/v1/skills/{skill_name}/files": {
+      "get": {
+        "tags": [
+          "Skills"
+        ],
+        "summary": "List files in a skill",
+        "operationId": "listSkillFiles",
+        "x-astrbot-scope": "skill",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/SkillName"
+          },
+          {
+            "name": "path",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/skills/{skill_name}/files/{file_path}": {
+      "get": {
+        "tags": [
+          "Skills"
+        ],
+        "summary": "Get skill file content",
+        "operationId": "getSkillFile",
+        "x-astrbot-scope": "skill",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/SkillName"
+          },
+          {
+            "$ref": "#/components/parameters/FilePath"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Text"
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "Skills"
+        ],
+        "summary": "Update skill file content",
+        "operationId": "updateSkillFile",
+        "x-astrbot-scope": "skill",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/SkillName"
+          },
+          {
+            "$ref": "#/components/parameters/FilePath"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "text/plain": {
+              "schema": {
+                "type": "string"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/skills/neo/candidates": {
+      "get": {
+        "tags": [
+          "Skills"
+        ],
+        "summary": "List Shipyard Neo skill candidates",
+        "operationId": "listNeoSkillCandidates",
+        "x-astrbot-scope": "skill",
+        "parameters": [
+          {
+            "name": "skill_key",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "status",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/skills/neo/releases": {
+      "get": {
+        "tags": [
+          "Skills"
+        ],
+        "summary": "List Shipyard Neo skill releases",
+        "operationId": "listNeoSkillReleases",
+        "x-astrbot-scope": "skill",
+        "parameters": [
+          {
+            "name": "skill_key",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "stage",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/skills/neo/payload": {
+      "get": {
+        "tags": [
+          "Skills"
+        ],
+        "summary": "Get a Shipyard Neo skill payload",
+        "operationId": "getNeoSkillPayload",
+        "x-astrbot-scope": "skill",
+        "parameters": [
+          {
+            "name": "payload_ref",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/skills/neo/evaluate": {
+      "post": {
+        "tags": [
+          "Skills"
+        ],
+        "summary": "Evaluate a Shipyard Neo skill candidate",
+        "operationId": "evaluateNeoSkillCandidate",
+        "x-astrbot-scope": "skill",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/NeoCandidateActionRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/skills/neo/promote": {
+      "post": {
+        "tags": [
+          "Skills"
+        ],
+        "summary": "Promote a Shipyard Neo skill candidate",
+        "operationId": "promoteNeoSkillCandidate",
+        "x-astrbot-scope": "skill",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/NeoCandidateActionRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/skills/neo/rollback": {
+      "post": {
+        "tags": [
+          "Skills"
+        ],
+        "summary": "Roll back a Shipyard Neo skill release",
+        "operationId": "rollbackNeoSkillRelease",
+        "x-astrbot-scope": "skill",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/NeoReleaseActionRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/skills/neo/sync": {
+      "post": {
+        "tags": [
+          "Skills"
+        ],
+        "summary": "Sync a Shipyard Neo skill release",
+        "operationId": "syncNeoSkillRelease",
+        "x-astrbot-scope": "skill",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/NeoReleaseActionRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/skills/neo/candidates/delete": {
+      "post": {
+        "tags": [
+          "Skills"
+        ],
+        "summary": "Delete a Shipyard Neo skill candidate",
+        "operationId": "deleteNeoSkillCandidate",
+        "x-astrbot-scope": "skill",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/NeoCandidateActionRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/skills/neo/releases/delete": {
+      "post": {
+        "tags": [
+          "Skills"
+        ],
+        "summary": "Delete a Shipyard Neo skill release",
+        "operationId": "deleteNeoSkillRelease",
+        "x-astrbot-scope": "skill",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/NeoReleaseActionRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/knowledge-bases": {
+      "get": {
+        "tags": [
+          "Knowledge Base"
+        ],
+        "summary": "List knowledge bases",
+        "operationId": "listKnowledgeBases",
+        "x-astrbot-scope": "kb",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Page"
+          },
+          {
+            "$ref": "#/components/parameters/PageSize"
+          },
+          {
+            "name": "refresh_stats",
+            "in": "query",
+            "schema": {
+              "type": "boolean"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Knowledge Base"
+        ],
+        "summary": "Create a knowledge base",
+        "operationId": "createKnowledgeBase",
+        "x-astrbot-scope": "kb",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/KnowledgeBaseRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/knowledge-bases/{kb_id}": {
+      "get": {
+        "tags": [
+          "Knowledge Base"
+        ],
+        "summary": "Get a knowledge base",
+        "operationId": "getKnowledgeBase",
+        "x-astrbot-scope": "kb",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/KbId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "Knowledge Base"
+        ],
+        "summary": "Update a knowledge base",
+        "operationId": "updateKnowledgeBase",
+        "x-astrbot-scope": "kb",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/KbId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/KnowledgeBaseRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Knowledge Base"
+        ],
+        "summary": "Delete a knowledge base",
+        "operationId": "deleteKnowledgeBase",
+        "x-astrbot-scope": "kb",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/KbId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/knowledge-bases/{kb_id}/stats": {
+      "get": {
+        "tags": [
+          "Knowledge Base"
+        ],
+        "summary": "Get knowledge base stats",
+        "operationId": "getKnowledgeBaseStats",
+        "x-astrbot-scope": "kb",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/KbId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/knowledge-bases/{kb_id}/documents": {
+      "get": {
+        "tags": [
+          "Knowledge Base"
+        ],
+        "summary": "List knowledge base documents",
+        "operationId": "listKnowledgeDocuments",
+        "x-astrbot-scope": "kb",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/KbId"
+          },
+          {
+            "$ref": "#/components/parameters/Page"
+          },
+          {
+            "$ref": "#/components/parameters/PageSize"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Knowledge Base"
+        ],
+        "summary": "Upload a document to a knowledge base",
+        "operationId": "uploadKnowledgeDocument",
+        "x-astrbot-scope": "kb",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/KbId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "multipart/form-data": {
+              "schema": {
+                "$ref": "#/components/schemas/KnowledgeDocumentUploadRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/knowledge-bases/{kb_id}/documents/import": {
+      "post": {
+        "tags": [
+          "Knowledge Base"
+        ],
+        "summary": "Import documents already available on the server",
+        "operationId": "importKnowledgeDocuments",
+        "x-astrbot-scope": "kb",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/KbId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/KnowledgeDocumentImportRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/knowledge-bases/{kb_id}/documents/import-url": {
+      "post": {
+        "tags": [
+          "Knowledge Base"
+        ],
+        "summary": "Import a document from URL",
+        "operationId": "importKnowledgeDocumentFromUrl",
+        "x-astrbot-scope": "kb",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/KbId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/KnowledgeDocumentUrlImportRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/knowledge-bases/{kb_id}/documents/{document_id}": {
+      "get": {
+        "tags": [
+          "Knowledge Base"
+        ],
+        "summary": "Get a knowledge base document",
+        "operationId": "getKnowledgeDocument",
+        "x-astrbot-scope": "kb",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/KbId"
+          },
+          {
+            "$ref": "#/components/parameters/DocumentId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Knowledge Base"
+        ],
+        "summary": "Delete a knowledge base document",
+        "operationId": "deleteKnowledgeDocument",
+        "x-astrbot-scope": "kb",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/KbId"
+          },
+          {
+            "$ref": "#/components/parameters/DocumentId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/knowledge-bases/{kb_id}/chunks": {
+      "get": {
+        "tags": [
+          "Knowledge Base"
+        ],
+        "summary": "List document chunks",
+        "operationId": "listKnowledgeChunks",
+        "x-astrbot-scope": "kb",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/KbId"
+          },
+          {
+            "name": "document_id",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "$ref": "#/components/parameters/Page"
+          },
+          {
+            "$ref": "#/components/parameters/PageSize"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/knowledge-bases/{kb_id}/chunks/{chunk_id}": {
+      "delete": {
+        "tags": [
+          "Knowledge Base"
+        ],
+        "summary": "Delete a document chunk",
+        "operationId": "deleteKnowledgeChunk",
+        "x-astrbot-scope": "kb",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/KbId"
+          },
+          {
+            "$ref": "#/components/parameters/ChunkId"
+          },
+          {
+            "name": "document_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/knowledge-bases/{kb_id}/retrieve": {
+      "post": {
+        "tags": [
+          "Knowledge Base"
+        ],
+        "summary": "Retrieve knowledge base chunks",
+        "operationId": "retrieveKnowledgeBase",
+        "x-astrbot-scope": "kb",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/KbId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/KnowledgeRetrieveRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/knowledge-bases/tasks/{task_id}": {
+      "get": {
+        "tags": [
+          "Knowledge Base"
+        ],
+        "summary": "Get knowledge base import task progress",
+        "operationId": "getKnowledgeTask",
+        "x-astrbot-scope": "kb",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/TaskId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/personas/tree": {
+      "get": {
+        "tags": [
+          "Personas"
+        ],
+        "summary": "Get persona folder tree",
+        "operationId": "getPersonaTree",
+        "x-astrbot-scope": "persona",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/personas": {
+      "get": {
+        "tags": [
+          "Personas"
+        ],
+        "summary": "List personas",
+        "operationId": "listPersonas",
+        "x-astrbot-scope": "persona",
+        "parameters": [
+          {
+            "name": "folder_id",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Personas"
+        ],
+        "summary": "Create a persona",
+        "operationId": "createPersona",
+        "x-astrbot-scope": "persona",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PersonaRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/personas/by-id": {
+      "get": {
+        "tags": [
+          "Personas"
+        ],
+        "summary": "Get a persona by query ID",
+        "operationId": "getPersonaById",
+        "x-astrbot-scope": "persona",
+        "parameters": [
+          {
+            "name": "persona_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "Personas"
+        ],
+        "summary": "Update a persona by body ID",
+        "operationId": "updatePersonaById",
+        "x-astrbot-scope": "persona",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "persona_id"
+                ],
+                "properties": {
+                  "persona_id": {
+                    "type": "string"
+                  }
+                },
+                "additionalProperties": true
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Personas"
+        ],
+        "summary": "Delete a persona by query ID",
+        "operationId": "deletePersonaById",
+        "x-astrbot-scope": "persona",
+        "parameters": [
+          {
+            "name": "persona_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/personas/{persona_id}": {
+      "get": {
+        "tags": [
+          "Personas"
+        ],
+        "summary": "Get a persona",
+        "operationId": "getPersona",
+        "x-astrbot-scope": "persona",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/PersonaId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "Personas"
+        ],
+        "summary": "Update a persona",
+        "operationId": "updatePersona",
+        "x-astrbot-scope": "persona",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/PersonaId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PersonaRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Personas"
+        ],
+        "summary": "Delete a persona",
+        "operationId": "deletePersona",
+        "x-astrbot-scope": "persona",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/PersonaId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/persona-folders": {
+      "get": {
+        "tags": [
+          "Personas"
+        ],
+        "summary": "List persona folders",
+        "operationId": "listPersonaFolders",
+        "x-astrbot-scope": "persona",
+        "parameters": [
+          {
+            "name": "parent_id",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Personas"
+        ],
+        "summary": "Create a persona folder",
+        "operationId": "createPersonaFolder",
+        "x-astrbot-scope": "persona",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PersonaFolderRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/persona-folders/{folder_id}": {
+      "put": {
+        "tags": [
+          "Personas"
+        ],
+        "summary": "Update a persona folder",
+        "operationId": "updatePersonaFolder",
+        "x-astrbot-scope": "persona",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/FolderId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PersonaFolderRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Personas"
+        ],
+        "summary": "Delete a persona folder",
+        "operationId": "deletePersonaFolder",
+        "x-astrbot-scope": "persona",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/FolderId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/personas/move": {
+      "post": {
+        "tags": [
+          "Personas"
+        ],
+        "summary": "Move a persona or folder",
+        "operationId": "movePersonaItem",
+        "x-astrbot-scope": "persona",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PersonaMoveRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/personas/reorder": {
+      "post": {
+        "tags": [
+          "Personas"
+        ],
+        "summary": "Reorder personas or folders",
+        "operationId": "reorderPersonaItems",
+        "x-astrbot-scope": "persona",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ReorderRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/sessions": {
+      "get": {
+        "tags": [
+          "Sessions"
+        ],
+        "summary": "List active UMOs and session status",
+        "operationId": "listSessions",
+        "x-astrbot-scope": "data",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Page"
+          },
+          {
+            "$ref": "#/components/parameters/PageSize"
+          },
+          {
+            "name": "search",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "platform",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "message_type",
+            "in": "query",
+            "schema": {
+              "type": "string",
+              "enum": [
+                "all",
+                "group",
+                "private"
+              ]
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/sessions/active-umos": {
+      "get": {
+        "tags": [
+          "Sessions"
+        ],
+        "summary": "List active and known UMOs",
+        "operationId": "listActiveUmos",
+        "x-astrbot-scope": "data",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/sessions/rules": {
+      "get": {
+        "tags": [
+          "Sessions"
+        ],
+        "summary": "List session rules",
+        "operationId": "listSessionRules",
+        "x-astrbot-scope": "data",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Page"
+          },
+          {
+            "$ref": "#/components/parameters/PageSize"
+          },
+          {
+            "name": "search",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Sessions"
+        ],
+        "summary": "Update or create a session rule",
+        "operationId": "upsertSessionRule",
+        "x-astrbot-scope": "data",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SessionRuleRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/sessions/rules/delete": {
+      "post": {
+        "tags": [
+          "Sessions"
+        ],
+        "summary": "Delete one or more session rules",
+        "operationId": "deleteSessionRules",
+        "x-astrbot-scope": "data",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/UmoListRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/sessions/provider": {
+      "patch": {
+        "tags": [
+          "Sessions"
+        ],
+        "summary": "Batch update session provider selection",
+        "operationId": "batchUpdateSessionProvider",
+        "x-astrbot-scope": "data",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/BatchSessionProviderRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/sessions/service": {
+      "patch": {
+        "tags": [
+          "Sessions"
+        ],
+        "summary": "Batch update session service settings",
+        "operationId": "batchUpdateSessionService",
+        "x-astrbot-scope": "data",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/BatchSessionServiceRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/session-groups": {
+      "get": {
+        "tags": [
+          "Sessions"
+        ],
+        "summary": "List session groups",
+        "operationId": "listSessionGroups",
+        "x-astrbot-scope": "data",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Sessions"
+        ],
+        "summary": "Create a session group",
+        "operationId": "createSessionGroup",
+        "x-astrbot-scope": "data",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SessionGroupRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/session-groups/{group_id}": {
+      "put": {
+        "tags": [
+          "Sessions"
+        ],
+        "summary": "Update a session group",
+        "operationId": "updateSessionGroup",
+        "x-astrbot-scope": "data",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/GroupId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SessionGroupRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Sessions"
+        ],
+        "summary": "Delete a session group",
+        "operationId": "deleteSessionGroup",
+        "x-astrbot-scope": "data",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/GroupId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/conversations": {
+      "get": {
+        "tags": [
+          "Conversations"
+        ],
+        "summary": "List conversation history data",
+        "operationId": "listConversations",
+        "x-astrbot-scope": "data",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Page"
+          },
+          {
+            "$ref": "#/components/parameters/PageSize"
+          },
+          {
+            "name": "platform_id",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "user_id",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "search",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "platforms",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            },
+            "description": "Comma-separated platform IDs."
+          },
+          {
+            "name": "message_types",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            },
+            "description": "Comma-separated message types."
+          },
+          {
+            "name": "exclude_ids",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            },
+            "description": "Comma-separated user IDs to exclude."
+          },
+          {
+            "name": "exclude_platforms",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            },
+            "description": "Comma-separated platforms to exclude."
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/conversations/batch-delete": {
+      "post": {
+        "tags": [
+          "Conversations"
+        ],
+        "summary": "Delete multiple conversations",
+        "operationId": "batchDeleteConversations",
+        "x-astrbot-scope": "data",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ConversationBatchDeleteRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/conversations/{conversation_id}": {
+      "get": {
+        "tags": [
+          "Conversations"
+        ],
+        "summary": "Get conversation details and messages",
+        "operationId": "getConversation",
+        "x-astrbot-scope": "data",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ConversationId"
+          },
+          {
+            "name": "user_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "patch": {
+        "tags": [
+          "Conversations"
+        ],
+        "summary": "Update conversation metadata",
+        "operationId": "updateConversation",
+        "x-astrbot-scope": "data",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ConversationId"
+          },
+          {
+            "name": "user_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ConversationPatchRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Conversations"
+        ],
+        "summary": "Delete a conversation",
+        "operationId": "deleteConversation",
+        "x-astrbot-scope": "data",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ConversationId"
+          },
+          {
+            "name": "user_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/conversations/{conversation_id}/messages": {
+      "put": {
+        "tags": [
+          "Conversations"
+        ],
+        "summary": "Replace conversation message history",
+        "operationId": "replaceConversationMessages",
+        "x-astrbot-scope": "data",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ConversationId"
+          },
+          {
+            "name": "user_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ConversationMessagesReplaceRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/conversations/export": {
+      "post": {
+        "tags": [
+          "Conversations"
+        ],
+        "summary": "Export conversations",
+        "operationId": "exportConversations",
+        "x-astrbot-scope": "data",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ConversationExportRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Exported conversation data"
+          }
+        }
+      }
+    },
+    "/api/v1/stats": {
+      "get": {
+        "tags": [
+          "Stats"
+        ],
+        "summary": "Get runtime statistics",
+        "operationId": "getStats",
+        "x-astrbot-scope": "system",
+        "parameters": [
+          {
+            "name": "offset_sec",
+            "in": "query",
+            "schema": {
+              "type": "integer",
+              "default": 86400
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/stats/provider-tokens": {
+      "get": {
+        "tags": [
+          "Stats"
+        ],
+        "summary": "Get provider token usage statistics",
+        "operationId": "getProviderTokenStats",
+        "x-astrbot-scope": "system",
+        "parameters": [
+          {
+            "name": "days",
+            "in": "query",
+            "schema": {
+              "type": "integer",
+              "minimum": 1
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/stats/version": {
+      "get": {
+        "tags": [
+          "Stats"
+        ],
+        "summary": "Get AstrBot version",
+        "operationId": "getVersion",
+        "x-astrbot-scope": "system",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/stats/first-notice": {
+      "get": {
+        "tags": [
+          "Stats"
+        ],
+        "summary": "Get first-run dashboard notice content",
+        "operationId": "getFirstNotice",
+        "x-astrbot-scope": "system",
+        "parameters": [
+          {
+            "name": "locale",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/stats/ghproxy/test": {
+      "post": {
+        "tags": [
+          "Stats"
+        ],
+        "summary": "Test a GitHub proxy endpoint",
+        "operationId": "testGhproxyConnection",
+        "x-astrbot-scope": "system",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/GhproxyTestRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/changelogs": {
+      "get": {
+        "tags": [
+          "Stats"
+        ],
+        "summary": "List available changelog versions",
+        "operationId": "listChangelogVersions",
+        "x-astrbot-scope": "system",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/changelogs/{version}": {
+      "get": {
+        "tags": [
+          "Stats"
+        ],
+        "summary": "Get changelog content for a version",
+        "operationId": "getChangelog",
+        "x-astrbot-scope": "system",
+        "parameters": [
+          {
+            "name": "version",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          }
+        }
+      }
+    },
+    "/api/v1/stats/start-time": {
+      "get": {
+        "tags": [
+          "Stats"
+        ],
+        "summary": "Get runtime start time",
+        "operationId": "getStartTime",
+        "security": [],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/stats/storage": {
+      "get": {
+        "tags": [
+          "Stats"
+        ],
+        "summary": "Get storage status",
+        "operationId": "getStorageStatus",
+        "x-astrbot-scope": "system",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/stats/storage/cleanup": {
+      "post": {
+        "tags": [
+          "Stats"
+        ],
+        "summary": "Clean storage",
+        "operationId": "cleanupStorage",
+        "x-astrbot-scope": "system",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/DynamicConfig"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/system/restart": {
+      "post": {
+        "tags": [
+          "Stats"
+        ],
+        "summary": "Restart AstrBot core",
+        "operationId": "restartCore",
+        "x-astrbot-scope": "system",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/backups": {
+      "get": {
+        "tags": [
+          "Backups"
+        ],
+        "summary": "List backups",
+        "operationId": "listBackups",
+        "x-astrbot-scope": "system",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Page"
+          },
+          {
+            "$ref": "#/components/parameters/PageSize"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Backups"
+        ],
+        "summary": "Export a backup",
+        "operationId": "createBackup",
+        "x-astrbot-scope": "system",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/BackupExportRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/backups/upload": {
+      "post": {
+        "tags": [
+          "Backups"
+        ],
+        "summary": "Upload a backup file",
+        "operationId": "uploadBackup",
+        "x-astrbot-scope": "system",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "multipart/form-data": {
+              "schema": {
+                "$ref": "#/components/schemas/BackupUploadRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/backups/upload/init": {
+      "post": {
+        "tags": [
+          "Backups"
+        ],
+        "summary": "Initialize chunked backup upload",
+        "operationId": "initBackupUpload",
+        "x-astrbot-scope": "system",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/BackupUploadInitRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/backups/upload/chunk": {
+      "post": {
+        "tags": [
+          "Backups"
+        ],
+        "summary": "Upload a backup chunk",
+        "operationId": "uploadBackupChunk",
+        "x-astrbot-scope": "system",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "multipart/form-data": {
+              "schema": {
+                "$ref": "#/components/schemas/BackupChunkUploadRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/backups/upload/complete": {
+      "post": {
+        "tags": [
+          "Backups"
+        ],
+        "summary": "Complete chunked backup upload",
+        "operationId": "completeBackupUpload",
+        "x-astrbot-scope": "system",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/BackupUploadSessionRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/backups/upload/abort": {
+      "post": {
+        "tags": [
+          "Backups"
+        ],
+        "summary": "Abort chunked backup upload",
+        "operationId": "abortBackupUpload",
+        "x-astrbot-scope": "system",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/BackupUploadSessionRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/backups/tasks/{task_id}": {
+      "get": {
+        "tags": [
+          "Backups"
+        ],
+        "summary": "Get backup task progress",
+        "operationId": "getBackupProgress",
+        "x-astrbot-scope": "system",
+        "parameters": [
+          {
+            "name": "task_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/backups/{filename}": {
+      "get": {
+        "tags": [
+          "Backups"
+        ],
+        "summary": "Download a backup",
+        "operationId": "downloadBackup",
+        "x-astrbot-scope": "system",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Filename"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Backup archive"
+          }
+        }
+      },
+      "patch": {
+        "tags": [
+          "Backups"
+        ],
+        "summary": "Rename a backup",
+        "operationId": "renameBackup",
+        "x-astrbot-scope": "system",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Filename"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/BackupRenameRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Backups"
+        ],
+        "summary": "Delete a backup",
+        "operationId": "deleteBackup",
+        "x-astrbot-scope": "system",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Filename"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/backups/{filename}/check": {
+      "post": {
+        "tags": [
+          "Backups"
+        ],
+        "summary": "Check a backup before import",
+        "operationId": "checkBackup",
+        "x-astrbot-scope": "system",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Filename"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/backups/{filename}/import": {
+      "post": {
+        "tags": [
+          "Backups"
+        ],
+        "summary": "Import a backup",
+        "operationId": "importBackup",
+        "x-astrbot-scope": "system",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Filename"
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/BackupImportRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/updates/check": {
+      "get": {
+        "tags": [
+          "Updates"
+        ],
+        "summary": "Check for updates",
+        "operationId": "checkUpdate",
+        "x-astrbot-scope": "system",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/updates/releases": {
+      "get": {
+        "tags": [
+          "Updates"
+        ],
+        "summary": "List releases",
+        "operationId": "listReleases",
+        "x-astrbot-scope": "system",
+        "parameters": [
+          {
+            "name": "type",
+            "in": "query",
+            "schema": {
+              "type": "string",
+              "enum": [
+                "core",
+                "dashboard"
+              ]
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/updates/core": {
+      "post": {
+        "tags": [
+          "Updates"
+        ],
+        "summary": "Update AstrBot core",
+        "operationId": "updateCore",
+        "x-astrbot-scope": "system",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/UpdateRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/updates/dashboard": {
+      "post": {
+        "tags": [
+          "Updates"
+        ],
+        "summary": "Update dashboard assets",
+        "operationId": "updateDashboard",
+        "x-astrbot-scope": "system",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/UpdateRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/updates/progress/{task_id}": {
+      "get": {
+        "tags": [
+          "Updates"
+        ],
+        "summary": "Get update progress",
+        "operationId": "getUpdateProgress",
+        "x-astrbot-scope": "system",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/TaskId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/pip/install": {
+      "post": {
+        "tags": [
+          "Updates"
+        ],
+        "summary": "Install a Python package",
+        "operationId": "installPipPackage",
+        "x-astrbot-scope": "system",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PipInstallRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/migrations": {
+      "post": {
+        "tags": [
+          "Updates"
+        ],
+        "summary": "Run pending migrations",
+        "operationId": "runMigrations",
+        "x-astrbot-scope": "system",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/MigrationRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/cron/jobs": {
+      "get": {
+        "tags": [
+          "Cron"
+        ],
+        "summary": "List cron jobs",
+        "operationId": "listCronJobs",
+        "x-astrbot-scope": "system",
+        "parameters": [
+          {
+            "name": "type",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Cron"
+        ],
+        "summary": "Create a cron job",
+        "operationId": "createCronJob",
+        "x-astrbot-scope": "system",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CronJobRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/cron/jobs/{job_id}": {
+      "patch": {
+        "tags": [
+          "Cron"
+        ],
+        "summary": "Update a cron job",
+        "operationId": "updateCronJob",
+        "x-astrbot-scope": "system",
+        "parameters": [
+          {
+            "name": "job_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CronJobPatchRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Cron"
+        ],
+        "summary": "Delete a cron job",
+        "operationId": "deleteCronJob",
+        "x-astrbot-scope": "system",
+        "parameters": [
+          {
+            "name": "job_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/cron/jobs/{job_id}/run": {
+      "post": {
+        "tags": [
+          "Cron"
+        ],
+        "summary": "Run a cron job immediately",
+        "operationId": "runCronJob",
+        "x-astrbot-scope": "system",
+        "parameters": [
+          {
+            "name": "job_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/logs/live": {
+      "get": {
+        "tags": [
+          "Logs"
+        ],
+        "summary": "Stream live logs",
+        "operationId": "streamLiveLogs",
+        "x-astrbot-scope": "system",
+        "responses": {
+          "200": {
+            "description": "Server-sent log stream",
             "content": {
               "text/event-stream": {
                 "schema": {
@@ -219,96 +7541,183 @@
                 }
               }
             }
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
           }
         }
       }
     },
-    "/api/v1/chat/sessions": {
+    "/api/v1/logs/history": {
       "get": {
         "tags": [
-          "Open API"
+          "Logs"
         ],
-        "summary": "List chat sessions with pagination",
-        "description": "List chat sessions for the specified username.",
-        "security": [
-          {
-            "ApiKeyHeader": []
+        "summary": "Get log history",
+        "operationId": "getLogHistory",
+        "x-astrbot-scope": "system",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Text"
           }
+        }
+      }
+    },
+    "/api/v1/trace/settings": {
+      "get": {
+        "tags": [
+          "Logs"
         ],
+        "summary": "Get trace settings",
+        "operationId": "getTraceSettings",
+        "x-astrbot-scope": "system",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "Logs"
+        ],
+        "summary": "Update trace settings",
+        "operationId": "updateTraceSettings",
+        "x-astrbot-scope": "system",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/TraceSettingsRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/t2i/templates": {
+      "get": {
+        "tags": [
+          "T2I"
+        ],
+        "summary": "List text-to-image templates",
+        "operationId": "listT2iTemplates",
+        "x-astrbot-scope": "config",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "T2I"
+        ],
+        "summary": "Create a text-to-image template",
+        "operationId": "createT2iTemplate",
+        "x-astrbot-scope": "config",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/T2iTemplateRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/t2i/templates/active": {
+      "get": {
+        "tags": [
+          "T2I"
+        ],
+        "summary": "Get active text-to-image template",
+        "operationId": "getActiveT2iTemplate",
+        "x-astrbot-scope": "config",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "T2I"
+        ],
+        "summary": "Set active text-to-image template",
+        "operationId": "setActiveT2iTemplate",
+        "x-astrbot-scope": "config",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/NameRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/t2i/templates/default/reset": {
+      "post": {
+        "tags": [
+          "T2I"
+        ],
+        "summary": "Reset the default text-to-image template",
+        "operationId": "resetDefaultT2iTemplate",
+        "x-astrbot-scope": "config",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/t2i/templates/{name}": {
+      "get": {
+        "tags": [
+          "T2I"
+        ],
+        "summary": "Get a text-to-image template",
+        "operationId": "getT2iTemplate",
+        "x-astrbot-scope": "config",
         "parameters": [
           {
-            "name": "page",
-            "in": "query",
-            "schema": {
-              "type": "integer",
-              "default": 1,
-              "minimum": 1
-            }
-          },
-          {
-            "name": "page_size",
-            "in": "query",
-            "schema": {
-              "type": "integer",
-              "default": 20,
-              "minimum": 1,
-              "maximum": 100
-            }
-          },
-          {
-            "name": "platform_id",
-            "in": "query",
-            "schema": {
-              "type": "string"
-            },
-            "description": "Optional platform filter"
-          },
-          {
-            "name": "username",
-            "in": "query",
-            "required": true,
-            "schema": {
-              "type": "string"
-            },
-            "description": "Target username."
+            "$ref": "#/components/parameters/Name"
           }
         ],
         "responses": {
           "200": {
-            "description": "OK",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ApiResponseChatSessions"
-                }
-              }
-            }
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
+            "$ref": "#/components/responses/Ok"
           }
         }
-      }
-    },
-    "/api/v1/im/message": {
-      "post": {
+      },
+      "put": {
         "tags": [
-          "Open API"
+          "T2I"
         ],
-        "summary": "Send proactive message to a platform bot",
-        "description": "Send message directly to platform bot by umo + message chain payload.",
-        "security": [
+        "summary": "Update a text-to-image template",
+        "operationId": "updateT2iTemplate",
+        "x-astrbot-scope": "config",
+        "parameters": [
           {
-            "ApiKeyHeader": []
+            "$ref": "#/components/parameters/Name"
           }
         ],
         "requestBody": {
@@ -316,82 +7725,139 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/SendMessageRequest"
-              },
-              "examples": {
-                "plain": {
-                  "value": {
-                    "umo": "webchat:FriendMessage:openapi_probe",
-                    "message": "ping from api key"
-                  }
-                },
-                "chain": {
-                  "value": {
-                    "umo": "webchat:FriendMessage:openapi_probe",
-                    "message": [
-                      {
-                        "type": "plain",
-                        "text": "hello"
-                      },
-                      {
-                        "type": "image",
-                        "attachment_id": "9a2f8c72-e7af-4c0e-b352-111111111111"
-                      }
-                    ]
-                  }
-                }
+                "$ref": "#/components/schemas/T2iTemplateContentRequest"
               }
             }
           }
         },
         "responses": {
           "200": {
-            "description": "OK",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ApiResponseEmpty"
-                }
-              }
-            }
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
+            "$ref": "#/components/responses/Ok"
           }
         }
-      }
-    },
-    "/api/v1/configs": {
-      "get": {
+      },
+      "delete": {
         "tags": [
-          "Open API"
+          "T2I"
         ],
-        "summary": "List available chat config files",
-        "description": "Returns all available AstrBot config files that can be selected by Chat API using config_id/config_name.",
-        "security": [
+        "summary": "Delete a text-to-image template",
+        "operationId": "deleteT2iTemplate",
+        "x-astrbot-scope": "config",
+        "parameters": [
           {
-            "ApiKeyHeader": []
+            "$ref": "#/components/parameters/Name"
           }
         ],
         "responses": {
           "200": {
-            "description": "OK",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ApiResponseChatConfigList"
-                }
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/subagents/config": {
+      "get": {
+        "tags": [
+          "Subagents"
+        ],
+        "summary": "Get subagent orchestrator configuration",
+        "operationId": "getSubagentConfig",
+        "x-astrbot-scope": "config",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "Subagents"
+        ],
+        "summary": "Update subagent orchestrator configuration",
+        "operationId": "updateSubagentConfig",
+        "x-astrbot-scope": "config",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/DynamicConfig"
               }
             }
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/subagents/available-tools": {
+      "get": {
+        "tags": [
+          "Subagents"
+        ],
+        "summary": "List tools available to subagents",
+        "operationId": "listSubagentAvailableTools",
+        "x-astrbot-scope": "config",
+        "responses": {
+          "200": {
+            "$ref": "#/components/responses/Ok"
+          }
+        }
+      }
+    },
+    "/api/v1/webhooks/platforms/{webhook_uuid}": {
+      "get": {
+        "tags": [
+          "Webhooks"
+        ],
+        "summary": "Verify a platform webhook",
+        "operationId": "verifyPlatformWebhook",
+        "security": [],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/WebhookUuid"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Webhook verification response"
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Webhooks"
+        ],
+        "summary": "Receive a platform webhook",
+        "operationId": "receivePlatformWebhook",
+        "security": [],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/WebhookUuid"
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/DynamicConfig"
+              }
+            },
+            "application/octet-stream": {
+              "schema": {
+                "type": "string",
+                "format": "binary"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Webhook accepted"
           }
         }
       }
@@ -399,209 +7865,671 @@
   },
   "components": {
     "securitySchemes": {
-      "ApiKeyHeader": {
+      "ApiKeyAuth": {
         "type": "apiKey",
         "in": "header",
-        "name": "X-API-Key",
-        "description": "Open API key. Authorization: Bearer <api_key> is also accepted."
+        "name": "X-API-Key"
+      },
+      "BearerAuth": {
+        "type": "http",
+        "scheme": "bearer",
+        "bearerFormat": "JWT"
       }
     },
     "responses": {
-      "Unauthorized": {
-        "description": "Unauthorized"
+      "Ok": {
+        "description": "Standard AstrBot success response",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/SuccessEnvelope"
+            }
+          }
+        }
       },
-      "Forbidden": {
-        "description": "Forbidden"
+      "Error": {
+        "description": "Standard AstrBot error response",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/ErrorEnvelope"
+            }
+          }
+        }
+      },
+      "Text": {
+        "description": "Text response",
+        "content": {
+          "text/plain": {
+            "schema": {
+              "type": "string"
+            }
+          },
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/SuccessEnvelope"
+            }
+          }
+        }
+      },
+      "Html": {
+        "description": "HTML response",
+        "content": {
+          "text/html": {
+            "schema": {
+              "type": "string"
+            }
+          }
+        }
+      }
+    },
+    "parameters": {
+      "AttachmentId": {
+        "name": "attachment_id",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string"
+        }
+      },
+      "BotId": {
+        "name": "bot_id",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string"
+        }
+      },
+      "ChunkId": {
+        "name": "chunk_id",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string"
+        }
+      },
+      "CommandId": {
+        "name": "command_id",
+        "in": "path",
+        "required": true,
+        "description": "URL-encoded command handler full name.",
+        "schema": {
+          "type": "string"
+        }
+      },
+      "ConfigId": {
+        "name": "config_id",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string"
+        }
+      },
+      "ConversationId": {
+        "name": "conversation_id",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string"
+        }
+      },
+      "DocumentId": {
+        "name": "document_id",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string"
+        }
+      },
+      "FilePath": {
+        "name": "file_path",
+        "in": "path",
+        "required": true,
+        "description": "URL-encoded relative file path.",
+        "schema": {
+          "type": "string"
+        }
+      },
+      "Filename": {
+        "name": "filename",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string"
+        }
+      },
+      "FolderId": {
+        "name": "folder_id",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string"
+        }
+      },
+      "GroupId": {
+        "name": "group_id",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string"
+        }
+      },
+      "KbId": {
+        "name": "kb_id",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string"
+        }
+      },
+      "KeyId": {
+        "name": "key_id",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string"
+        }
+      },
+      "Name": {
+        "name": "name",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string"
+        }
+      },
+      "Page": {
+        "name": "page",
+        "in": "query",
+        "schema": {
+          "type": "integer",
+          "minimum": 1,
+          "default": 1
+        }
+      },
+      "PageSize": {
+        "name": "page_size",
+        "in": "query",
+        "schema": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 200,
+          "default": 20
+        }
+      },
+      "PersonaId": {
+        "name": "persona_id",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string"
+        }
+      },
+      "PluginId": {
+        "name": "plugin_id",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string"
+        }
+      },
+      "ProviderId": {
+        "name": "provider_id",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string"
+        }
+      },
+      "SessionId": {
+        "name": "session_id",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string"
+        }
+      },
+      "ServerName": {
+        "name": "server_name",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string"
+        }
+      },
+      "SkillName": {
+        "name": "skill_name",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string"
+        }
+      },
+      "SourceId": {
+        "name": "source_id",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string"
+        }
+      },
+      "TaskId": {
+        "name": "task_id",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string"
+        }
+      },
+      "ToolId": {
+        "name": "tool_id",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string"
+        }
+      },
+      "Umo": {
+        "name": "umo",
+        "in": "path",
+        "required": true,
+        "description": "URL-encoded unified message origin.",
+        "schema": {
+          "type": "string"
+        }
+      },
+      "WebhookUuid": {
+        "name": "webhook_uuid",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string"
+        }
       }
     },
     "schemas": {
-      "ApiResponseEmpty": {
+      "SuccessEnvelope": {
         "type": "object",
+        "required": [
+          "status",
+          "data"
+        ],
         "properties": {
           "status": {
             "type": "string",
-            "example": "ok"
+            "const": "ok"
           },
           "message": {
-            "type": [
-              "string",
-              "null"
-            ]
+            "type": "string"
           },
-          "data": {
-            "type": "object",
-            "additionalProperties": true
-          }
-        }
+          "data": {}
+        },
+        "additionalProperties": false
       },
-      "ApiResponseBotList": {
+      "ErrorEnvelope": {
         "type": "object",
+        "required": [
+          "status",
+          "message"
+        ],
         "properties": {
           "status": {
             "type": "string",
-            "example": "ok"
+            "const": "error"
           },
           "message": {
-            "type": [
-              "string",
-              "null"
-            ]
+            "type": "string"
           },
-          "data": {
-            "type": "object",
-            "properties": {
-              "bot_ids": {
-                "type": "array",
-                "items": {
-                  "type": "string"
-                }
-              }
-            }
-          }
-        }
+          "data": {}
+        },
+        "additionalProperties": false
       },
-      "ApiResponseUpload": {
+      "DynamicConfig": {
         "type": "object",
-        "properties": {
-          "status": {
-            "type": "string",
-            "example": "ok"
-          },
-          "message": {
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "data": {
-            "type": "object",
-            "properties": {
-              "attachment_id": {
-                "type": "string"
-              },
-              "filename": {
-                "type": "string"
-              },
-              "type": {
-                "type": "string"
-              }
-            }
-          }
-        }
+        "additionalProperties": true
       },
-      "ApiResponseChatSessions": {
+      "JsonSchema": {
         "type": "object",
-        "properties": {
-          "status": {
-            "type": "string",
-            "example": "ok"
-          },
-          "message": {
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "data": {
-            "type": "object",
-            "properties": {
-              "sessions": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/components/schemas/ChatSessionItem"
-                }
-              },
-              "page": {
-                "type": "integer"
-              },
-              "page_size": {
-                "type": "integer"
-              },
-              "total": {
-                "type": "integer"
-              }
-            }
-          }
-        }
+        "additionalProperties": true
       },
-      "ChatSessionItem": {
-        "type": "object",
-        "properties": {
-          "session_id": {
-            "type": "string"
-          },
-          "platform_id": {
-            "type": "string"
-          },
-          "creator": {
-            "type": "string"
-          },
-          "display_name": {
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "is_group": {
-            "type": "integer"
-          },
-          "created_at": {
-            "type": "string",
-            "format": "date-time"
-          },
-          "updated_at": {
-            "type": "string",
-            "format": "date-time"
-          }
-        }
+      "ProviderCapability": {
+        "type": "string",
+        "enum": [
+          "chat",
+          "agent",
+          "stt",
+          "tts",
+          "embedding",
+          "rerank"
+        ]
       },
-      "MessagePart": {
+      "LoginRequest": {
         "type": "object",
+        "required": [
+          "username",
+          "password"
+        ],
         "properties": {
-          "type": {
+          "username": {
+            "type": "string"
+          },
+          "password": {
+            "type": "string"
+          },
+          "code": {
             "type": "string",
-            "enum": [
-              "plain",
-              "reply",
-              "image",
-              "record",
-              "file",
-              "video"
-            ]
+            "description": "TOTP code or recovery code when two-factor authentication is required."
           },
-          "text": {
+          "trust_device_flag": {
+            "type": "boolean"
+          }
+        },
+        "additionalProperties": false
+      },
+      "SetupAuthRequest": {
+        "type": "object",
+        "required": [
+          "username",
+          "password",
+          "confirm_password"
+        ],
+        "properties": {
+          "username": {
             "type": "string"
           },
-          "message_id": {
-            "type": [
-              "string",
-              "integer"
-            ]
-          },
-          "selected_text": {
+          "password": {
             "type": "string"
           },
-          "attachment_id": {
-            "type": "string"
-          },
-          "filename": {
-            "type": "string"
-          },
-          "path": {
+          "confirm_password": {
             "type": "string"
           }
         },
-        "required": [
-          "type"
-        ]
+        "additionalProperties": false
       },
-      "ChatSendRequest": {
+      "UpdateAccountRequest": {
         "type": "object",
         "required": [
-          "message",
-          "username"
+          "password"
         ],
         "properties": {
+          "password": {
+            "type": "string"
+          },
+          "new_password": {
+            "type": "string"
+          },
+          "confirm_password": {
+            "type": "string"
+          },
+          "new_username": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
+      "TotpSetupRequest": {
+        "type": "object",
+        "properties": {
+          "code": {
+            "type": "string"
+          },
+          "secret": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
+      "CreateApiKeyRequest": {
+        "type": "object",
+        "required": [
+          "name"
+        ],
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "scopes": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "enum": [
+                "bot",
+                "provider",
+                "persona",
+                "im",
+                "config",
+                "chat",
+                "plugin",
+                "mcp",
+                "skill"
+              ]
+            },
+            "example": [
+              "bot",
+              "provider",
+              "persona",
+              "im",
+              "config",
+              "chat",
+              "plugin",
+              "mcp",
+              "skill"
+            ]
+          },
+          "expires_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "expires_in_days": {
+            "type": "integer",
+            "minimum": 1
+          }
+        },
+        "additionalProperties": false
+      },
+      "CreateConfigProfileRequest": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "config": {
+            "$ref": "#/components/schemas/DynamicConfig"
+          }
+        },
+        "additionalProperties": false
+      },
+      "RenameRequest": {
+        "type": "object",
+        "required": [
+          "name"
+        ],
+        "properties": {
+          "name": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
+      "NameRequest": {
+        "type": "object",
+        "required": [
+          "name"
+        ],
+        "properties": {
+          "name": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
+      "ConfigRoutesReplaceRequest": {
+        "type": "object",
+        "required": [
+          "routing"
+        ],
+        "properties": {
+          "routing": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "string"
+            }
+          }
+        },
+        "additionalProperties": false
+      },
+      "ConfigRouteUpsertRequest": {
+        "type": "object",
+        "required": [
+          "config_id"
+        ],
+        "properties": {
+          "config_id": {
+            "type": "string",
+            "description": "Use \"default\" to remove a custom route and fall back."
+          }
+        },
+        "additionalProperties": false
+      },
+      "BotConfigRequest": {
+        "type": "object",
+        "required": [
+          "type",
+          "config"
+        ],
+        "properties": {
+          "id": {
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          },
+          "type": {
+            "type": "string",
+            "description": "Platform adapter type, such as aiocqhttp, telegram, lark."
+          },
+          "enabled": {
+            "type": "boolean",
+            "default": true
+          },
+          "config": {
+            "$ref": "#/components/schemas/DynamicConfig"
+          }
+        },
+        "additionalProperties": false
+      },
+      "BotRegistrationRequest": {
+        "type": "object",
+        "required": [
+          "action"
+        ],
+        "properties": {
+          "action": {
+            "type": "string",
+            "enum": [
+              "start",
+              "poll"
+            ]
+          },
+          "platform_config": {
+            "$ref": "#/components/schemas/DynamicConfig"
+          },
+          "registration_code": {
+            "type": "string"
+          },
+          "device_code": {
+            "type": "string"
+          },
+          "qrcode": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": true
+      },
+      "EnabledPatch": {
+        "type": "object",
+        "required": [
+          "enabled"
+        ],
+        "properties": {
+          "enabled": {
+            "type": "boolean"
+          }
+        },
+        "additionalProperties": false
+      },
+      "ToolPermissionPatch": {
+        "type": "object",
+        "required": [
+          "permission"
+        ],
+        "properties": {
+          "permission": {
+            "type": "string",
+            "enum": [
+              "admin",
+              "member"
+            ]
+          }
+        },
+        "additionalProperties": false
+      },
+      "ProviderSourceConfigRequest": {
+        "type": "object",
+        "required": [
+          "config"
+        ],
+        "properties": {
+          "id": {
+            "type": "string"
+          },
+          "config": {
+            "$ref": "#/components/schemas/DynamicConfig"
+          }
+        },
+        "additionalProperties": false
+      },
+      "ProviderConfigRequest": {
+        "type": "object",
+        "required": [
+          "config"
+        ],
+        "properties": {
+          "id": {
+            "type": "string"
+          },
+          "provider_source_id": {
+            "type": "string"
+          },
+          "capability": {
+            "$ref": "#/components/schemas/ProviderCapability"
+          },
+          "enabled": {
+            "type": "boolean",
+            "default": true
+          },
+          "config": {
+            "$ref": "#/components/schemas/DynamicConfig"
+          }
+        },
+        "additionalProperties": false
+      },
+      "ChatRequest": {
+        "type": "object",
+        "required": [
+          "message"
+        ],
+        "properties": {
+          "username": {
+            "type": "string"
+          },
+          "session_id": {
+            "type": "string"
+          },
+          "conversation_id": {
+            "type": "string",
+            "description": "Deprecated alias for session_id."
+          },
           "message": {
             "oneOf": [
               {
@@ -615,17 +8543,11 @@
               }
             ]
           },
-          "session_id": {
-            "type": "string",
-            "description": "Optional chat session ID. If omitted (and conversation_id is also omitted), server creates a UUID automatically."
+          "config_id": {
+            "type": "string"
           },
-          "conversation_id": {
-            "type": "string",
-            "description": "Alias of session_id."
-          },
-          "username": {
-            "type": "string",
-            "description": "Target username."
+          "config_name": {
+            "type": "string"
           },
           "selected_provider": {
             "type": "string"
@@ -637,17 +8559,190 @@
             "type": "boolean",
             "default": true
           },
-          "config_id": {
-            "type": "string",
-            "description": "Optional AstrBot config file ID. If provided, the chat session will use this config file. Use \"default\" to reset to default config."
+          "_skip_user_history": {
+            "type": "boolean",
+            "description": "Internal WebUI flag for edit/regenerate flows."
           },
-          "config_name": {
+          "_llm_checkpoint_id": {
             "type": "string",
-            "description": "Optional AstrBot config file name. Used only when config_id is not provided."
+            "description": "Internal WebUI checkpoint override."
+          },
+          "_platform_history_id": {
+            "type": "string",
+            "description": "Internal WebUI platform history override."
+          },
+          "_thread_selected_text": {
+            "type": "string",
+            "description": "Internal WebUI side-thread context."
           }
-        }
+        },
+        "additionalProperties": false
       },
-      "SendMessageRequest": {
+      "ChatSessionBatchDeleteRequest": {
+        "type": "object",
+        "required": [
+          "session_ids"
+        ],
+        "properties": {
+          "session_ids": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        },
+        "additionalProperties": false
+      },
+      "ChatSessionPatchRequest": {
+        "type": "object",
+        "properties": {
+          "display_name": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
+      "ChatMessagePatchRequest": {
+        "type": "object",
+        "required": [
+          "content"
+        ],
+        "properties": {
+          "content": {
+            "type": "object",
+            "additionalProperties": true
+          }
+        },
+        "additionalProperties": false
+      },
+      "ChatMessageRegenerateRequest": {
+        "type": "object",
+        "properties": {
+          "selected_provider": {
+            "type": "string"
+          },
+          "selected_model": {
+            "type": "string"
+          },
+          "enable_streaming": {
+            "type": "boolean",
+            "default": true
+          }
+        },
+        "additionalProperties": false
+      },
+      "ChatThreadCreateRequest": {
+        "type": "object",
+        "required": [
+          "session_id",
+          "parent_message_id",
+          "selected_text"
+        ],
+        "properties": {
+          "session_id": {
+            "type": "string"
+          },
+          "parent_message_id": {
+            "oneOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "integer"
+              }
+            ]
+          },
+          "selected_text": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
+      "ChatThreadMessageRequest": {
+        "type": "object",
+        "required": [
+          "message"
+        ],
+        "properties": {
+          "message": {
+            "oneOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "array",
+                "items": {
+                  "$ref": "#/components/schemas/MessagePart"
+                }
+              }
+            ]
+          },
+          "selected_provider": {
+            "type": "string"
+          },
+          "selected_model": {
+            "type": "string"
+          },
+          "enable_streaming": {
+            "type": "boolean",
+            "default": true
+          }
+        },
+        "additionalProperties": false
+      },
+      "ChatProjectRequest": {
+        "type": "object",
+        "properties": {
+          "title": {
+            "type": "string"
+          },
+          "emoji": {
+            "type": "string"
+          },
+          "description": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
+      "MessagePart": {
+        "type": "object",
+        "required": [
+          "type"
+        ],
+        "properties": {
+          "type": {
+            "type": "string",
+            "enum": [
+              "text",
+              "plain",
+              "image",
+              "file",
+              "audio",
+              "record",
+              "video",
+              "reply"
+            ]
+          },
+          "text": {
+            "type": "string"
+          },
+          "attachment_id": {
+            "type": "string"
+          },
+          "url": {
+            "type": "string"
+          },
+          "filename": {
+            "type": "string"
+          },
+          "mime_type": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": true
+      },
+      "ImMessageRequest": {
         "type": "object",
         "required": [
           "umo",
@@ -655,8 +8750,7 @@
         ],
         "properties": {
           "umo": {
-            "type": "string",
-            "description": "Unified message origin. Format: platform:message_type:session_id"
+            "type": "string"
           },
           "message": {
             "oneOf": [
@@ -671,10 +8765,143 @@
               }
             ]
           }
+        },
+        "additionalProperties": false
+      },
+      "FileUploadRequest": {
+        "type": "object",
+        "required": [
+          "file"
+        ],
+        "properties": {
+          "file": {
+            "type": "string",
+            "format": "binary"
+          }
         }
       },
-      "ChatConfigFile": {
+      "PluginUpdateRequest": {
         "type": "object",
+        "properties": {
+          "reinstall": {
+            "type": "boolean",
+            "default": false
+          }
+        },
+        "additionalProperties": false
+      },
+      "PluginBatchUpdateRequest": {
+        "type": "object",
+        "properties": {
+          "plugin_id": {
+            "type": "string",
+            "description": "When set, update this single plugin instead of a batch."
+          },
+          "plugin_ids": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "reinstall": {
+            "type": "boolean",
+            "default": false
+          },
+          "update_all": {
+            "type": "boolean",
+            "default": false
+          }
+        },
+        "additionalProperties": true
+      },
+      "PluginVersionSupportRequest": {
+        "type": "object",
+        "properties": {
+          "astrbot_version": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
+      "PluginGithubInstallRequest": {
+        "type": "object",
+        "required": [
+          "repository"
+        ],
+        "properties": {
+          "repository": {
+            "type": "string",
+            "description": "GitHub URL or owner/repository slug."
+          },
+          "ref": {
+            "type": "string"
+          },
+          "download_url": {
+            "type": "string",
+            "description": "Optional downloadable ZIP URL to use instead of GitHub archive resolution."
+          },
+          "proxy": {
+            "type": "string"
+          },
+          "ignore_version_check": {
+            "type": "boolean"
+          }
+        },
+        "additionalProperties": false
+      },
+      "PluginUrlInstallRequest": {
+        "type": "object",
+        "required": [
+          "url"
+        ],
+        "properties": {
+          "url": {
+            "type": "string",
+            "format": "uri"
+          },
+          "download_url": {
+            "type": "string",
+            "format": "uri",
+            "description": "Optional downloadable ZIP URL when url is the plugin source page or repository."
+          },
+          "proxy": {
+            "type": "string"
+          },
+          "ignore_version_check": {
+            "type": "boolean"
+          }
+        },
+        "additionalProperties": false
+      },
+      "PluginUploadInstallRequest": {
+        "type": "object",
+        "required": [
+          "file"
+        ],
+        "properties": {
+          "file": {
+            "type": "string",
+            "format": "binary"
+          }
+        }
+      },
+      "PluginConfigFileDeleteRequest": {
+        "type": "object",
+        "required": [
+          "path"
+        ],
+        "properties": {
+          "path": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
+      "PluginSourceRequest": {
+        "type": "object",
+        "required": [
+          "url"
+        ],
         "properties": {
           "id": {
             "type": "string"
@@ -682,45 +8909,808 @@
           "name": {
             "type": "string"
           },
-          "path": {
-            "type": "string"
-          },
-          "is_default": {
-            "type": "boolean"
+          "url": {
+            "type": "string",
+            "format": "uri"
           }
         },
-        "required": [
-          "id",
-          "name",
-          "path",
-          "is_default"
-        ]
+        "additionalProperties": false
       },
-      "ApiResponseChatConfigList": {
+      "CommandPatchRequest": {
         "type": "object",
         "properties": {
-          "status": {
-            "type": "string",
-            "example": "ok"
+          "enabled": {
+            "type": "boolean"
           },
-          "message": {
-            "type": [
-              "string",
-              "null"
+          "alias": {
+            "type": "string"
+          },
+          "aliases": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "permission_group": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
+      "McpServerConfig": {
+        "type": "object",
+        "required": [
+          "name"
+        ],
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "enabled": {
+            "type": "boolean",
+            "default": true
+          },
+          "transport": {
+            "type": "string",
+            "enum": [
+              "stdio",
+              "sse",
+              "streamable_http"
             ]
           },
-          "data": {
+          "command": {
+            "type": "string"
+          },
+          "args": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "url": {
+            "type": "string"
+          },
+          "headers": {
             "type": "object",
-            "properties": {
-              "configs": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/components/schemas/ChatConfigFile"
+            "additionalProperties": {
+              "type": "string"
+            }
+          },
+          "timeout": {
+            "type": "integer"
+          }
+        },
+        "additionalProperties": true
+      },
+      "ModelScopeSyncRequest": {
+        "type": "object",
+        "properties": {
+          "access_token": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
+      "SkillUploadRequest": {
+        "type": "object",
+        "required": [
+          "file"
+        ],
+        "properties": {
+          "file": {
+            "type": "string",
+            "format": "binary"
+          },
+          "overwrite": {
+            "type": "boolean",
+            "default": false
+          }
+        }
+      },
+      "SkillPatchRequest": {
+        "type": "object",
+        "properties": {
+          "enabled": {
+            "type": "boolean"
+          },
+          "display_name": {
+            "type": "string"
+          },
+          "description": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
+      "NeoCandidateActionRequest": {
+        "type": "object",
+        "required": [
+          "candidate_id"
+        ],
+        "properties": {
+          "candidate_id": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": true
+      },
+      "NeoReleaseActionRequest": {
+        "type": "object",
+        "required": [
+          "release_id"
+        ],
+        "properties": {
+          "release_id": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": true
+      },
+      "KnowledgeBaseRequest": {
+        "type": "object",
+        "required": [
+          "name"
+        ],
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "description": {
+            "type": "string"
+          },
+          "embedding_provider_id": {
+            "type": "string"
+          },
+          "rerank_provider_id": {
+            "type": "string"
+          },
+          "chunking": {
+            "$ref": "#/components/schemas/DynamicConfig"
+          },
+          "metadata": {
+            "$ref": "#/components/schemas/DynamicConfig"
+          }
+        },
+        "additionalProperties": false
+      },
+      "KnowledgeDocumentUploadRequest": {
+        "type": "object",
+        "required": [
+          "file"
+        ],
+        "properties": {
+          "file": {
+            "type": "string",
+            "format": "binary"
+          },
+          "parser": {
+            "type": "string"
+          }
+        }
+      },
+      "KnowledgeDocumentImportRequest": {
+        "type": "object",
+        "required": [
+          "paths"
+        ],
+        "properties": {
+          "paths": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "parser": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
+      "KnowledgeDocumentUrlImportRequest": {
+        "type": "object",
+        "required": [
+          "url"
+        ],
+        "properties": {
+          "url": {
+            "type": "string",
+            "format": "uri"
+          },
+          "parser": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
+      "KnowledgeRetrieveRequest": {
+        "type": "object",
+        "required": [
+          "query"
+        ],
+        "properties": {
+          "query": {
+            "type": "string"
+          },
+          "top_k": {
+            "type": "integer",
+            "default": 5
+          },
+          "score_threshold": {
+            "type": "number"
+          }
+        },
+        "additionalProperties": false
+      },
+      "PersonaRequest": {
+        "type": "object",
+        "required": [
+          "persona_id",
+          "system_prompt"
+        ],
+        "properties": {
+          "persona_id": {
+            "type": "string"
+          },
+          "system_prompt": {
+            "type": "string"
+          },
+          "begin_dialogs": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "folder_id": {
+            "type": "string"
+          },
+          "tools": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "skills": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "custom_error_message": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": true
+      },
+      "PersonaFolderRequest": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "parent_id": {
+            "type": "string"
+          },
+          "description": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": true
+      },
+      "PersonaMoveRequest": {
+        "type": "object",
+        "required": [
+          "persona_id"
+        ],
+        "properties": {
+          "persona_id": {
+            "type": "string"
+          },
+          "folder_id": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": true
+      },
+      "ReorderRequest": {
+        "type": "object",
+        "required": [
+          "items"
+        ],
+        "properties": {
+          "items": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "required": [
+                "id",
+                "type",
+                "sort_order"
+              ],
+              "properties": {
+                "id": {
+                  "type": "string"
+                },
+                "type": {
+                  "type": "string",
+                  "enum": [
+                    "persona",
+                    "folder"
+                  ]
+                },
+                "sort_order": {
+                  "type": "integer"
                 }
               }
             }
           }
+        },
+        "additionalProperties": false
+      },
+      "SessionRuleRequest": {
+        "type": "object",
+        "required": [
+          "umo",
+          "rule_key"
+        ],
+        "properties": {
+          "umo": {
+            "type": "string"
+          },
+          "rule_key": {
+            "type": "string"
+          },
+          "rule_value": {
+            "$ref": "#/components/schemas/DynamicConfig"
+          }
+        },
+        "additionalProperties": true
+      },
+      "UmoListRequest": {
+        "type": "object",
+        "properties": {
+          "umo": {
+            "type": "string"
+          },
+          "umos": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "scope": {
+            "type": "string",
+            "enum": [
+              "all",
+              "group",
+              "private",
+              "custom_group"
+            ]
+          },
+          "group_id": {
+            "type": "string"
+          },
+          "rule_key": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
+      "BatchSessionProviderRequest": {
+        "allOf": [
+          {
+            "$ref": "#/components/schemas/UmoListRequest"
+          },
+          {
+            "type": "object",
+            "required": [
+              "provider_id",
+              "provider_type"
+            ],
+            "properties": {
+              "provider_id": {
+                "type": "string"
+              },
+              "provider_type": {
+                "type": "string",
+                "enum": [
+                  "chat_completion",
+                  "speech_to_text",
+                  "text_to_speech"
+                ]
+              }
+            }
+          }
+        ]
+      },
+      "BatchSessionServiceRequest": {
+        "allOf": [
+          {
+            "$ref": "#/components/schemas/UmoListRequest"
+          },
+          {
+            "type": "object",
+            "properties": {
+              "session_enabled": {
+                "type": "boolean"
+              },
+              "llm_enabled": {
+                "type": "boolean"
+              },
+              "tts_enabled": {
+                "type": "boolean"
+              }
+            }
+          }
+        ]
+      },
+      "SessionGroupRequest": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "umos": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "add_umos": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "remove_umos": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        },
+        "additionalProperties": false
+      },
+      "ConversationPatchRequest": {
+        "type": "object",
+        "properties": {
+          "title": {
+            "type": "string"
+          },
+          "persona_id": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
+      "ConversationMessagesReplaceRequest": {
+        "type": "object",
+        "properties": {
+          "user_id": {
+            "type": "string"
+          },
+          "messages": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "additionalProperties": true
+            }
+          },
+          "history": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "additionalProperties": true
+            }
+          }
+        },
+        "additionalProperties": false
+      },
+      "ConversationRef": {
+        "type": "object",
+        "required": [
+          "user_id",
+          "cid"
+        ],
+        "properties": {
+          "user_id": {
+            "type": "string"
+          },
+          "cid": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
+      "ConversationBatchDeleteRequest": {
+        "type": "object",
+        "required": [
+          "conversations"
+        ],
+        "properties": {
+          "conversations": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/ConversationRef"
+            }
+          }
+        },
+        "additionalProperties": false
+      },
+      "ConversationExportRequest": {
+        "type": "object",
+        "properties": {
+          "conversations": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/ConversationRef"
+            }
+          },
+          "conversation_ids": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "format": {
+            "type": "string",
+            "enum": [
+              "json",
+              "markdown"
+            ],
+            "default": "json"
+          }
+        },
+        "additionalProperties": false
+      },
+      "CronJobRequest": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "cron_expression": {
+            "type": "string"
+          },
+          "timezone": {
+            "type": "string"
+          },
+          "session": {
+            "type": "string"
+          },
+          "note": {
+            "type": "string"
+          },
+          "description": {
+            "type": "string"
+          },
+          "persona_id": {
+            "type": "string"
+          },
+          "provider_id": {
+            "type": "string"
+          },
+          "enabled": {
+            "type": "boolean",
+            "default": true
+          },
+          "run_once": {
+            "type": "boolean",
+            "default": false
+          },
+          "run_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "payload": {
+            "type": "object",
+            "additionalProperties": true
+          }
+        },
+        "additionalProperties": true
+      },
+      "CronJobPatchRequest": {
+        "allOf": [
+          {
+            "$ref": "#/components/schemas/CronJobRequest"
+          }
+        ]
+      },
+      "BackupExportRequest": {
+        "type": "object",
+        "properties": {
+          "include": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "exclude": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        },
+        "additionalProperties": false
+      },
+      "BackupUploadRequest": {
+        "type": "object",
+        "required": [
+          "file"
+        ],
+        "properties": {
+          "file": {
+            "type": "string",
+            "format": "binary"
+          }
         }
+      },
+      "BackupUploadInitRequest": {
+        "type": "object",
+        "required": [
+          "filename",
+          "total_size"
+        ],
+        "properties": {
+          "filename": {
+            "type": "string"
+          },
+          "total_size": {
+            "type": "integer",
+            "minimum": 1
+          }
+        },
+        "additionalProperties": false
+      },
+      "BackupUploadSessionRequest": {
+        "type": "object",
+        "required": [
+          "upload_id"
+        ],
+        "properties": {
+          "upload_id": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
+      "BackupChunkUploadRequest": {
+        "type": "object",
+        "required": [
+          "upload_id",
+          "chunk_index",
+          "chunk"
+        ],
+        "properties": {
+          "upload_id": {
+            "type": "string"
+          },
+          "chunk_index": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "chunk": {
+            "type": "string",
+            "format": "binary"
+          }
+        }
+      },
+      "BackupRenameRequest": {
+        "type": "object",
+        "required": [
+          "new_name"
+        ],
+        "properties": {
+          "new_name": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
+      "BackupImportRequest": {
+        "type": "object",
+        "properties": {
+          "confirmed": {
+            "type": "boolean",
+            "default": true
+          }
+        },
+        "additionalProperties": false
+      },
+      "UpdateRequest": {
+        "type": "object",
+        "properties": {
+          "version": {
+            "type": "string"
+          },
+          "proxy": {
+            "type": "string"
+          },
+          "reboot": {
+            "type": "boolean"
+          },
+          "progress_id": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
+      "PipInstallRequest": {
+        "type": "object",
+        "required": [
+          "package"
+        ],
+        "properties": {
+          "package": {
+            "type": "string"
+          },
+          "mirror": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
+      "MigrationRequest": {
+        "type": "object",
+        "properties": {
+          "platform_id_map": {
+            "type": "object",
+            "additionalProperties": true
+          }
+        },
+        "additionalProperties": true
+      },
+      "GhproxyTestRequest": {
+        "type": "object",
+        "required": [
+          "proxy_url"
+        ],
+        "properties": {
+          "proxy_url": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
+      "TraceSettingsRequest": {
+        "type": "object",
+        "properties": {
+          "enabled": {
+            "type": "boolean"
+          },
+          "level": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": true
+      },
+      "T2iTemplateRequest": {
+        "type": "object",
+        "required": [
+          "name",
+          "content"
+        ],
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "content": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": true
+      },
+      "T2iTemplateContentRequest": {
+        "type": "object",
+        "required": [
+          "content"
+        ],
+        "properties": {
+          "content": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": true
       }
     }
   }
diff --git a/docs/scripts/update_openapi_json.py b/docs/scripts/update_openapi_json.py
new file mode 100644
index 000000000..ded32a7df
--- /dev/null
+++ b/docs/scripts/update_openapi_json.py
@@ -0,0 +1,60 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+DEFAULT_SPEC = REPO_ROOT / "openspec" / "openapi-v1.yaml"
+DEFAULT_OUTPUT = REPO_ROOT / "docs" / "public" / "openapi.json"
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(
+        description="Update the public OpenAPI JSON document from the v1 YAML spec."
+    )
+    parser.add_argument(
+        "--spec",
+        type=Path,
+        default=DEFAULT_SPEC,
+        help=f"OpenAPI YAML source path. Default: {DEFAULT_SPEC}",
+    )
+    parser.add_argument(
+        "--output",
+        type=Path,
+        default=DEFAULT_OUTPUT,
+        help=f"OpenAPI JSON output path. Default: {DEFAULT_OUTPUT}",
+    )
+    return parser.parse_args()
+
+
+def load_yaml(path: Path) -> dict[str, Any]:
+    data = yaml.safe_load(path.read_text(encoding="utf-8"))
+    if not isinstance(data, dict):
+        raise ValueError(f"Expected OpenAPI object in {path}")
+    return data
+
+
+def main() -> int:
+    args = parse_args()
+    spec_path = args.spec.resolve()
+    output_path = args.output.resolve()
+
+    spec = load_yaml(spec_path)
+    output_path.parent.mkdir(parents=True, exist_ok=True)
+    output_path.write_text(
+        json.dumps(spec, ensure_ascii=False, indent=2) + "\n",
+        encoding="utf-8",
+    )
+    print(
+        f"Updated {output_path.relative_to(REPO_ROOT)} from {spec_path.relative_to(REPO_ROOT)}"
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/docs/tests/test_sync_docs_to_wiki.py b/docs/tests/test_sync_docs_to_wiki.py
index 4bcecc007..b6cf35e80 100644
--- a/docs/tests/test_sync_docs_to_wiki.py
+++ b/docs/tests/test_sync_docs_to_wiki.py
@@ -1,8 +1,8 @@
+import sys
+import unittest
 from importlib.util import module_from_spec, spec_from_file_location
 from pathlib import Path
-import sys
 from tempfile import TemporaryDirectory
-import unittest
 
 
 def load_sync_module():
diff --git a/docs/zh/dev/openapi.md b/docs/zh/dev/openapi.md
index 4ac8f84e9..5ff5ffccf 100644
--- a/docs/zh/dev/openapi.md
+++ b/docs/zh/dev/openapi.md
@@ -26,19 +26,30 @@ X-API-Key: abk_xxx
 - `POST /api/v1/chat`：请求体必须包含 `username`
 - `GET /api/v1/chat/sessions`：查询参数必须包含 `username`
 
+本地 OpenAPI 描述文件地址为 `http://localhost:6185/api/v1/openapi.json`，交互式文档地址为 `http://localhost:6185/api/v1/docs`。
+
 ## Scope 权限说明
 
 创建 API Key 时可配置 `scopes`。每个 scope 控制可访问的接口范围：
 
 | Scope | 作用 | 可访问接口 |
 | --- | --- | --- |
-| `chat` | 调用对话能力、查询对话会话 | `POST /api/v1/chat`、`GET /api/v1/chat/sessions` |
-| `config` | 获取可用配置文件列表 | `GET /api/v1/configs` |
-| `file` | 上传附件文件，获取 `attachment_id` | `POST /api/v1/file` |
+| `bot` | 管理机器人/平台配置 | `GET /api/v1/bot-types`、`GET/POST /api/v1/bots`、`PATCH /api/v1/bots/enabled` |
+| `provider` | 管理模型提供商和提供商源 | `GET/POST /api/v1/providers`、`GET/PUT/DELETE /api/v1/provider-sources/by-id` |
+| `persona` | 管理人格和人格文件夹 | `GET/POST /api/v1/personas`、`GET/POST /api/v1/persona-folders` |
 | `im` | 主动发 IM 消息、查询 bot/platform 列表 | `POST /api/v1/im/message`、`GET /api/v1/im/bots` |
+| `config` | 管理配置文件、系统配置和通用配置。该 scope 同时包含 `bot` 和 `provider` 访问权限。 | `GET /api/v1/configs`、`GET/PUT /api/v1/system-config`、`GET/POST /api/v1/config-profiles` |
+| `chat` | 调用对话能力、查询对话会话 | `POST /api/v1/chat`、`GET /api/v1/chat/sessions` |
+| `plugin` | 管理插件、插件配置、插件源和插件市场 | `GET /api/v1/plugins`、`GET/PUT /api/v1/plugins/config`、`POST /api/v1/plugins/install/url` |
+| `mcp` | 管理 MCP 服务器配置和服务端同步 | `GET/POST /api/v1/mcp/servers`、`PATCH /api/v1/mcp/servers/{server_name}/enabled`、`POST /api/v1/mcp/providers/modelscope/sync` |
+| `skill` | 管理 Skills、Skill 压缩包、Skill 文件和 Shipyard Neo Skill 流程 | `GET/POST /api/v1/skills`、`PUT /api/v1/skills/{skill_name}/files/{file_path}`、`POST /api/v1/skills/neo/sync` |
 
 如果 API Key 未包含目标接口所需 scope，请求会返回 `403 Insufficient API key scope`。
 
+`config` 是较大的管理 scope。创建 API Key 时如果包含 `config`，AstrBot 会同时授予该 Key `config`、`bot` 和 `provider` 访问权限。WebUI 的勾选逻辑也会体现这个依赖关系：选中 `config` 会同时选中 `bot` 和 `provider`；取消选中 `bot` 或 `provider` 时，会同步取消 `config`。
+
+当前开发者 API Key 仅开放以上 9 个 scope。`file`、`tool`、`skills`、`kb`、`data`、`system` 暂不支持作为开发者 API Key scope。`/api/v1/skills/*` 接口使用单数 `skill` scope，不使用复数 `skills`。相关接口可能仍出现在 `/api/v1` 文档中，但只有 scope 属于上表支持范围时才对开发者 API Key 开放。
+
 ## 常用接口
 
 **对话类**
@@ -49,9 +60,19 @@ X-API-Key: abk_xxx
 - `GET /api/v1/chat/sessions`：分页获取指定 `username` 的会话
 - `GET /api/v1/configs`：获取可用配置文件列表
 
-**文件上传**
+**机器人和模型提供商**
 
-- `POST /api/v1/file`：上传附件
+- `GET /api/v1/bots`：获取机器人/平台配置列表
+- `POST /api/v1/bots`：创建机器人/平台配置
+- `GET /api/v1/providers`：获取模型提供商配置列表
+- `GET /api/v1/provider-sources`：获取提供商源配置列表
+
+**人格、插件、MCP 和 Skills**
+
+- `GET /api/v1/personas`：获取人格列表
+- `GET /api/v1/plugins`：获取插件列表
+- `GET /api/v1/mcp/servers`：获取 MCP 服务器列表
+- `GET /api/v1/skills`：获取 Skills 列表
 
 **IM 消息发送**
 
@@ -100,7 +121,7 @@ X-API-Key: abk_xxx
 
 说明：
 
-- `attachment_id` 来自 `POST /api/v1/file` 上传结果。
+- `attachment_id` 来自已存在的附件记录。开发者 API Key 当前不能使用 `POST /api/v1/file` 上传附件。
 - `reply` 不能单独作为唯一内容，至少需要一个有实际内容的段（如 `plain/image/file/...`）。
 - 仅 `reply` 或空内容会返回错误。
 
diff --git a/docs/zh/dev/star/guides/plugin-pages.md b/docs/zh/dev/star/guides/plugin-pages.md
index 1636a4b71..72b669086 100644
--- a/docs/zh/dev/star/guides/plugin-pages.md
+++ b/docs/zh/dev/star/guides/plugin-pages.md
@@ -1,6 +1,12 @@
 # 插件 Pages
 
-AstrBot 支持插件通过 `pages/` 目录暴露 Dashboard 页面。`pages/` 下的每个一级子目录都是一个独立 Page：
+插件 Pages 允许插件在 AstrBot WebUI 中提供自己的页面。页面文件放在插件目录的 `pages/` 下，由 Dashboard 以受限 iframe 的方式加载；页面里的脚本通过 `window.AstrBotPluginPage` bridge 和 Dashboard 通信，再由 Dashboard 转发到插件注册的后端 Web API。
+
+如果只是让用户填写少量配置项，优先使用 [`_conf_schema.json`](./plugin-config.md)。Pages 更适合复杂表单、运行状态面板、日志查看、文件上传下载、SSE 实时流、图表和其他需要自定义交互的场景。
+
+## 目录结构
+
+`pages/` 下的每个一级子目录是一个独立 Page。AstrBot 只扫描 `pages/<page_name>/index.html`，没有 `index.html` 的目录会被忽略。
 
 ```text
 astrbot_plugin_page_demo/
@@ -16,13 +22,65 @@ astrbot_plugin_page_demo/
       └─ index.html
 ```
 
-AstrBot 会扫描 `pages/<page_name>/index.html`；没有 `index.html` 的目录会被忽略。
+`page_name` 应使用简单目录名，例如 `settings`、`bridge-demo`。不要使用空目录名、`.`、`..`、以 `.` 开头的目录名，或包含 `/`、`\` 的名称。
 
-如果只是让用户填写几个配置项，优先使用 [`_conf_schema.json`](./plugin-config.md)。插件 Pages 更适合复杂表单、Dashboard、日志、文件上传下载、SSE 和自定义交互流程。
+用户可以在 WebUI 的插件页点击插件卡片进入插件详情页，然后打开插件声明的 Pages。
 
-一旦注册了 Pages，用户可以在：AstrBot WebUI 插件页中的插件卡片中，点击插件卡片进入插件详细页面，在插件详细页面中可以看到并进入注册的 Pages。
+## 开发流程
 
-## 最小前端示例
+1. 在插件目录下创建 `pages/<page_name>/index.html`。
+2. 在 Page 中通过 `window.AstrBotPluginPage` bridge 调用后端能力。
+3. 在 `main.py` 中使用 `context.register_web_api()` 注册插件后端 API。
+4. 后端 handler 使用 `astrbot.api.web` 读取请求并返回响应。
+5. 新增或删除 Page 目录后重载插件；修改静态资源通常刷新 Page 即可。
+
+## 最小完整示例
+
+### 后端
+
+插件后端推荐使用 `astrbot.api.web`，不要把 FastAPI、Starlette 或 Quart 的原始请求对象作为插件公共 API 暴露给自己的业务代码。
+
+```python
+from astrbot.api.star import Context, Star
+from astrbot.api.web import error_response, json_response, request
+
+PLUGIN_NAME = "astrbot_plugin_page_demo"
+
+
+class MyPlugin(Star):
+    def __init__(self, context: Context):
+        super().__init__(context)
+        context.register_web_api(
+            f"/{PLUGIN_NAME}/ping",
+            self.page_ping,
+            ["GET"],
+            "Page ping",
+        )
+        context.register_web_api(
+            f"/{PLUGIN_NAME}/settings/save",
+            self.save_settings,
+            ["POST"],
+            "Save Page settings",
+        )
+
+    async def page_ping(self):
+        limit = request.query.get("limit", 20, type=int)
+        return json_response(
+            {
+                "message": "pong",
+                "limit": limit,
+                "username": request.username,
+            }
+        )
+
+    async def save_settings(self):
+        payload = await request.json(default={})
+        if not isinstance(payload.get("enabled"), bool):
+            return error_response("enabled must be a boolean")
+        return json_response({"saved": True})
+```
+
+### 前端
 
 `pages/bridge-demo/index.html`
 
@@ -52,62 +110,218 @@ const context = await bridge.ready();
 output.textContent = JSON.stringify(context, null, 2);
 
 document.getElementById("ping").addEventListener("click", async () => {
-  const result = await bridge.apiGet("ping");
+  const result = await bridge.apiGet("ping", { limit: 20 });
   output.textContent = JSON.stringify(result, null, 2);
 });
 ```
 
-这里不需要手动引入 bridge SDK。AstrBot 会在返回的 HTML 里自动插入 `/api/plugin/page/bridge-sdk.js`。
+不需要手动引入 bridge SDK。AstrBot 返回 HTML 时会自动插入 `/api/plugin/page/bridge-sdk.js`。如果内联脚本必须同步访问 `window.AstrBotPluginPage`，请把脚本改成外部 module 文件，或在自己的脚本前显式引入：
 
-## 注册后端 API
-
-前端调用 `bridge.apiGet("ping")` 时，Dashboard 会转发到：
-
-```text
-/api/plug/<plugin_name>/ping
+```html
+<script src="/api/plugin/page/bridge-sdk.js"></script>
 ```
 
-因此注册 Web API 时，路由必须带上插件名作为前缀：
+## 后端 Web API
+
+### 路由注册
+
+使用 `context.register_web_api(route, view_handler, methods, desc)` 注册插件 API。
 
 ```python
-from quart import jsonify
-from astrbot.api.star import Context, Star
-
-PLUGIN_NAME = "astrbot_plugin_page_demo"
-
-
-class MyPlugin(Star):
-    def __init__(self, context: Context):
-        super().__init__(context)
-        context.register_web_api(
-            f"/{PLUGIN_NAME}/ping",
-            self.page_ping,
-            ["GET"],
-            "Page ping",
-        )
-
-    async def page_ping(self):
-        return jsonify({"message": "pong"})
+context.register_web_api(
+    f"/{PLUGIN_NAME}/items/<item_id>",
+    self.get_item,
+    ["GET"],
+    "Get item",
+)
 ```
 
+路由需要包含插件名作为前缀。Page 端的 bridge endpoint 不需要包含插件名：
+
+```js
+await bridge.apiGet("items/123");
+```
+
+Dashboard 会把它转发到：
+
+```text
+/api/v1/plugins/extensions/<plugin_name>/items/123
+```
+
+注册路由 `/<plugin_name>/items/<item_id>` 会匹配该请求，`item_id` 作为 handler 的关键字参数传入：
+
+```python
+async def get_item(self, item_id: str):
+    return json_response({"item_id": item_id})
+```
+
+支持的动态片段：
+
+- `<name>`：匹配单个路径片段。
+- `<path:name>`：匹配后续多级路径。
+
+### 请求对象
+
+推荐导入：
+
+```python
+from astrbot.api.web import request
+```
+
+`request` 是当前请求的上下文代理，只能在插件 Web API handler 执行期间访问。常用字段和方法：
+
+| API | 说明 |
+| --- | --- |
+| `request.method` | HTTP 方法，例如 `GET`、`POST` |
+| `request.path` | 当前 Dashboard API 路径 |
+| `request.plugin_name` | 从扩展路径解析出的插件名 |
+| `request.username` | 当前 Dashboard 用户名，可能为 `None` |
+| `request.headers` | 请求头 |
+| `request.cookies` | 请求 cookies |
+| `request.content_type` | 请求 Content-Type |
+| `request.client_host` | 客户端地址 |
+| `request.path_params` | 路由动态参数字典 |
+| `request.query` | query 参数，支持 `get()` 和 `getlist()` |
+| `await request.body()` | 原始请求体 bytes |
+| `await request.json(default={})` | JSON 请求体，解析失败返回 default |
+| `await request.form()` | 表单字段，不含上传文件 |
+| `await request.files()` | 上传文件 |
+
+query 参数使用示例：
+
+```python
+limit = request.query.get("limit", 20, type=int)
+tags = request.query.getlist("tag")
+```
+
+JSON 请求体使用示例：
+
+```python
+payload = await request.json(default={})
+enabled = bool(payload.get("enabled"))
+```
+
+文件上传使用示例：
+
+```python
+from pathlib import Path
+
+from astrbot.core.utils.astrbot_path import get_astrbot_plugin_data_path
+from astrbot.api.web import PluginUploadFile, error_response, json_response, request
+
+
+async def import_file(self):
+    form = await request.form()
+    files = await request.files()
+    upload: PluginUploadFile | None = files.get("file")
+    if not isinstance(upload, PluginUploadFile):
+        return error_response("missing file")
+
+    target_dir = (
+        Path(get_astrbot_plugin_data_path())
+        / (request.plugin_name or "unknown_plugin")
+        / "imports"
+    )
+    target_dir.mkdir(parents=True, exist_ok=True)
+    target = target_dir / Path(upload.filename).name
+    await upload.save(target)
+    return json_response(
+        {
+            "filename": upload.filename,
+            "content_type": upload.content_type,
+            "tag": form.get("tag"),
+        }
+    )
+```
+
+`request.form()` 和 `request.files()` 会缓存解析结果，可以在同一个 handler 中各调用一次。
+
+### 响应对象
+
+推荐从 `astrbot.api.web` 导入响应 helper：
+
+```python
+from astrbot.api.web import (
+    error_response,
+    file_response,
+    json_response,
+    stream_response,
+)
+```
+
+JSON 响应：
+
+```python
+return json_response({"saved": True})
+```
+
+错误响应：
+
+```python
+return error_response("invalid threshold", status_code=400)
+```
+
+文件下载响应：
+
+```python
+return file_response(
+    export_path,
+    filename="export.json",
+    content_type="application/json",
+)
+```
+
+SSE 响应：
+
+```python
+import json
+
+from astrbot.api.web import stream_response
+
+
+async def stream_events(self):
+    async def events():
+        yield f"data: {json.dumps({'state': 'started'})}\n\n"
+        yield f"data: {json.dumps({'state': 'done'})}\n\n"
+
+    return stream_response(events())
+```
+
+直接返回 `dict`、`list`、`(body, status_code)` 或底层 Response 对象仍然可用；文档和新插件推荐优先使用 `astrbot.api.web` helper，让插件代码和 Dashboard 内部框架解耦。
+
+### Quart 兼容
+
+为了兼容旧插件，通过 `context.register_web_api()` 注册的 handler 仍会进入 Quart 兼容请求上下文。旧代码可以继续使用：
+
+```python
+from quart import jsonify, request
+```
+
+新插件和新文档推荐使用：
+
+```python
+from astrbot.api.web import json_response, request
+```
+
+不要在同一个 handler 中混用两个 `request` 代理，迁移时按 handler 逐步替换即可。
+
 ## Bridge API
 
-插件 Page 中可直接使用 `window.AstrBotPluginPage`：
+Page iframe 不能直接访问 Dashboard cookies、LocalStorage 或父页面 DOM。页面脚本必须通过 `window.AstrBotPluginPage` bridge 调用后端和读取上下文。
 
-- `ready()`: 等待 bridge 就绪并返回上下文
-- `getContext()`: 读取当前上下文
-- `getLocale()`: 读取当前 WebUI 语言
-- `getI18n()`: 读取当前插件的 i18n 资源
-- `t(key, fallback)`: 从插件 i18n 资源中按 key 获取文案，缺失时返回 fallback
-- `onContext(handler)`: 监听上下文变化，例如 WebUI 切换语言后重新渲染页面
-- `apiGet(endpoint, params)`: 发送 GET 请求
-- `apiPost(endpoint, body)`: 发送 POST 请求
-- `upload(endpoint, file)`: 以 `multipart/form-data` 上传单个文件
-- `download(endpoint, params, filename)`: 下载后端响应
-- `subscribeSSE(endpoint, handlers, params)`: 订阅 SSE
-- `unsubscribeSSE(subscriptionId)`: 取消 SSE 订阅
+```js
+const bridge = window.AstrBotPluginPage;
+```
 
-当前 `ready()` 上下文类似：
+### 上下文
+
+`ready()` 等待父页面发送初始上下文，返回 `Promise<context>`。页面初始化时应先等待它。
+
+```js
+const context = await bridge.ready();
+```
+
+上下文通常包含：
 
 ```json
 {
@@ -121,11 +335,211 @@ class MyPlugin(Star):
 }
 ```
 
-`endpoint` 必须是插件内相对路径，不能为空，不能包含 `\`、URL scheme、query、hash，也不能包含 `.` 或 `..` 路径片段。
+上下文相关 API：
+
+| API | 返回值 | 说明 |
+| --- | --- | --- |
+| `ready()` | `Promise<context>` | 等待 bridge 就绪并返回初始上下文 |
+| `getContext()` | `context \| null` | 同步读取最近一次上下文 |
+| `getLocale()` | `string` | 当前 WebUI 语言，默认 `zh-CN` |
+| `getI18n()` | `object` | 当前插件 i18n 资源 |
+| `t(key, fallback)` | `string` | 按点分隔 key 读取翻译，缺失时返回 fallback |
+| `onContext(handler)` | `() => void` | 监听上下文变化，返回取消监听函数 |
+
+监听语言或主题变化：
+
+```js
+function render() {
+  document.title = bridge.t("pages.bridge-demo.title", "Bridge Demo");
+  document.getElementById("locale").textContent = bridge.getLocale();
+}
+
+await bridge.ready();
+render();
+
+const off = bridge.onContext(render);
+window.addEventListener("beforeunload", off);
+```
+
+### 请求和返回值规则
+
+`apiGet`、`apiPost`、`upload`、`download`、`subscribeSSE` 的 `endpoint` 都是插件内相对路径，例如 `stats`、`settings/save`、`files/export`。推荐不要以 `/` 开头；当前 bridge 会为了兼容旧写法去掉开头的 `/`。
+
+`endpoint` 不能是空字符串，不能包含 `\`、URL scheme、query、hash，也不能包含空路径片段、`.` 或 `..`。
+
+不要把 query string 拼进 endpoint：
+
+```js
+await bridge.apiGet("stats", { limit: 20 });
+```
+
+bridge 对 JSON 类请求的返回值有一个兼容规则：
+
+- 如果后端返回 `{ "status": "ok", "data": value }`，Promise resolve 为 `value`。
+- 如果后端返回普通 JSON，例如 `{ "message": "pong" }`，Promise resolve 为完整 JSON。
+- 如果后端返回 `{ "status": "error", "message": "..." }`，或 HTTP 请求失败，Promise reject 为 `Error`。
+
+因此 Page-only API 推荐直接返回业务 JSON：
+
+```python
+return json_response({"message": "pong"})
+```
+
+需要表达错误时使用：
+
+```python
+return error_response("missing file", status_code=400)
+```
+
+Page 端统一捕获错误：
+
+```js
+try {
+  await bridge.apiPost("settings/save", { enabled: true });
+} catch (error) {
+  console.error(error.message);
+}
+```
+
+### `apiGet(endpoint, params)`
+
+发送 GET 请求。`params` 会作为 query 参数传递。
+
+```js
+const stats = await bridge.apiGet("stats", { limit: 20, tag: "today" });
+```
+
+后端读取：
+
+```python
+async def stats(self):
+    limit = request.query.get("limit", 20, type=int)
+    tag = request.query.get("tag")
+    return json_response({"limit": limit, "tag": tag})
+```
+
+### `apiPost(endpoint, body)`
+
+发送 POST JSON 请求。
+
+```js
+const result = await bridge.apiPost("settings/save", {
+  enabled: true,
+  threshold: 0.8,
+});
+```
+
+后端读取：
+
+```python
+async def save_settings(self):
+    payload = await request.json(default={})
+    return json_response({"saved": True, "enabled": payload.get("enabled")})
+```
+
+### `upload(endpoint, file)`
+
+以 `multipart/form-data` 上传单个文件，字段名固定为 `file`。
+
+```js
+const input = document.querySelector("input[type=file]");
+const file = input.files[0];
+const result = await bridge.upload("files/import", file);
+```
+
+后端读取：
+
+```python
+from astrbot.api.web import PluginUploadFile, error_response, json_response, request
+
+
+async def import_file(self):
+    files = await request.files()
+    upload: PluginUploadFile | None = files.get("file")
+    if not isinstance(upload, PluginUploadFile):
+        return error_response("missing file", status_code=400)
+    return json_response({"filename": upload.filename})
+```
+
+如果还需要普通字段，请单独使用 `apiPost` 传配置，或在后端根据 query 参数区分导入行为。当前 bridge 的 `upload()` 只发送一个文件。
+
+### `download(endpoint, params, filename)`
+
+请求插件后端文件接口并触发浏览器下载。`params` 会作为 query 参数发送；`filename` 可选，缺省时 bridge 会尝试从响应头读取文件名。
+
+```js
+await bridge.download("files/export", { format: "json" }, "export.json");
+```
+
+后端返回文件：
+
+```python
+async def export_file(self):
+    fmt = request.query.get("format", "json")
+    return file_response(
+        export_path,
+        filename=f"export.{fmt}",
+        content_type="application/json",
+    )
+```
+
+`download()` resolve 为：
+
+```json
+{ "filename": "export.json" }
+```
+
+### `subscribeSSE(endpoint, handlers, params)`
+
+订阅插件后端 SSE，返回 `Promise<subscriptionId>`。`handlers` 可以包含 `onOpen`、`onMessage`、`onError`。
+
+```js
+const subscriptionId = await bridge.subscribeSSE(
+  "events",
+  {
+    onOpen() {
+      console.log("SSE opened");
+    },
+    onMessage(event) {
+      console.log(event.raw, event.parsed, event.lastEventId);
+    },
+    onError() {
+      console.warn("SSE error");
+    },
+  },
+  { topic: "logs" },
+);
+```
+
+`event.raw` 是原始字符串；如果内容是 JSON 字符串，`event.parsed` 会自动解析，否则等于原始字符串。`event.eventType` 对应 SSE 的 `event:` 字段，未设置时为 `message`。
+
+后端必须返回 `text/event-stream`：
+
+```python
+async def events(self):
+    async def stream():
+        yield 'data: {"message": "ready"}\n\n'
+
+    return stream_response(stream())
+```
+
+取消订阅：
+
+```js
+await bridge.unsubscribeSSE(subscriptionId);
+```
+
+页面卸载时建议清理：
+
+```js
+window.addEventListener("beforeunload", () => {
+  bridge.unsubscribeSSE(subscriptionId);
+});
+```
 
 ## Page 国际化
 
-插件 Page 复用插件 i18n 资源文件。给 `.astrbot-plugin/i18n/<locale>.json` 增加 `pages.<page_name>` 即可：
+插件 Pages 复用插件 i18n 资源文件。给 `.astrbot-plugin/i18n/<locale>.json` 增加 `pages.<page_name>`：
 
 ```json
 {
@@ -140,20 +554,15 @@ class MyPlugin(Star):
 }
 ```
 
-`title` 会用于 WebUI 外壳标题和插件详情页的 Page 组件名称，`description` 会用于插件详情页的 Page 组件描述。
-
-在 Page 内部使用 `t()` 渲染文案，并用 `onContext()` 响应语言切换：
+`title` 用于 WebUI 外壳标题和插件详情页的 Page 组件名称；`description` 用于插件详情页的 Page 组件描述。Page 内部使用 `bridge.t()` 渲染文案，并通过 `onContext()` 响应语言切换。
 
 ```js
-const bridge = window.AstrBotPluginPage;
-
 function render() {
   document.title = bridge.t("pages.bridge-demo.title", "Bridge Demo");
   document.getElementById("heading").textContent = bridge.t(
     "pages.bridge-demo.heading",
     "Plugin Page",
   );
-  document.getElementById("locale").textContent = bridge.getLocale();
 }
 
 await bridge.ready();
@@ -161,24 +570,14 @@ render();
 bridge.onContext(render);
 ```
 
-切换 WebUI 语言后，Dashboard 会把新的 `locale` 和插件 i18n 资源通过 bridge 发送给 iframe；只要 Page 监听了 `onContext()`，通常不需要刷新页面。
+## 亮暗主题
 
-如果你的内联脚本需要同步访问 `window.AstrBotPluginPage`，请把脚本放到外部 module 文件中，或在自己的脚本前显式引入：
-
-```html
-<script src="/api/plugin/page/bridge-sdk.js"></script>
-```
-
-## 亮暗主题适配
-
-AstrBot 切换亮色/暗色模式时，会自动将主题状态同步给插件 Page。bridge SDK 会在 `<html>` 元素上维护 `data-theme` 属性：
+AstrBot 会把当前主题同步给插件 Page。bridge SDK 会维护 `<html>` 的 `data-theme` 属性：
 
 - 亮色模式：`<html data-theme="light">`
 - 暗色模式：`<html data-theme="dark">`
 
-> 选择「跟随系统」时，AstrBot 会根据系统当前色彩模式自动决定主题，插件 Page 收到的 `data-theme` 值始终为 `light` 或 `dark`，无需额外处理。
-
-### CSS 适配
+选择“跟随系统”时，Page 收到的值仍然是 `light` 或 `dark`。
 
 推荐使用 CSS 变量：
 
@@ -199,33 +598,21 @@ body {
 }
 ```
 
-AstrBot 在服务端返回 HTML 时，会自动在 `<html>` 标签上注入 `data-theme` 属性，不会出现初始闪烁。
+服务端返回 HTML 时会预先注入 `data-theme`，减少初始闪烁。需要在 JavaScript 中响应主题变化时，读取 `bridge.getContext()?.isDark` 并监听 `onContext()`。
 
-### JavaScript 响应主题变化
+## 静态资源路径
 
-上下文中的 `isDark` 字段表示当前是否为暗色模式。通过 `onContext()` 可以监听主题切换：
+正常使用相对路径即可：
 
-```js
-const bridge = window.AstrBotPluginPage;
-
-function render() {
-  if (bridge.getContext()?.isDark) {
-    // 暗色模式下的 JS 逻辑（如图表滤镜等）
-  }
-}
-
-await bridge.ready();
-render();
-bridge.onContext(render);
+```html
+<link rel="stylesheet" href="./style.css" />
+<script type="module" src="./app.js"></script>
+<img src="./assets/logo.svg" alt="" />
 ```
 
-切换亮暗模式时，Dashboard 会通过 bridge 将更新后的上下文发送给 iframe；只要 Page 监听了 `onContext()`，就会收到通知。
+AstrBot 会重写相对资源路径并追加短期 `asset_token`。不要手动拼接 `/api/plugin/page/content/...`，不要自行追加 `asset_token`，也不要依赖 `..` 逃逸 Page 根目录。
 
-## 静态资源路径规则
-
-AstrBot 会重写相对资源路径，并自动补上短期 `asset_token`。你只需要正常写相对路径，不要自己拼接 `/api/plugin/page/content/...`。
-
-AstrBot 会重写：
+会被重写的资源引用包括：
 
 - HTML `src` 和 `href`
 - CSS `url(...)`
@@ -233,9 +620,7 @@ AstrBot 会重写：
 - JavaScript `export ... from`
 - JavaScript 动态 `import()`
 
-建议把静态资源写成 `./style.css`、`./assets/logo.svg` 这类相对路径。不要手动追加 `asset_token`，也不要依赖 `..` 逃逸 Page 根目录。
-
-如果你构建 SPA，建议使用 hash routing。静态资源服务按真实文件路径解析；history routing 刷新页面时需要对应路径上真的存在文件。
+如果构建 SPA，建议使用 hash routing。静态资源服务按真实文件路径解析；history routing 刷新页面时需要对应路径上真的存在文件。
 
 ## 安全约束
 
@@ -245,198 +630,23 @@ AstrBot 会重写：
 allow-scripts allow-forms allow-downloads
 ```
 
-Page 不能直接访问 Dashboard cookies、LocalStorage 或同源 DOM，也不能绕过 bridge 复用 Dashboard auth。
+Page 不能直接访问 Dashboard cookies、LocalStorage 或父页面 DOM，也不能绕过 bridge 复用 Dashboard auth。所有需要 Dashboard 身份的操作都应该走 bridge。
 
-AstrBot 还会给资源响应添加安全头，包括：
+资源响应会带上安全头，包括：
 
 - `X-Frame-Options: SAMEORIGIN`
 - `Content-Security-Policy: frame-ancestors 'self'; object-src 'none'; base-uri 'self'`
 - `Cache-Control: no-store`
+- `X-Content-Type-Options: nosniff`
+
+后端 handler 仍然要验证输入。不要信任 Page 传来的路径、文件名、格式或数值范围；文件落盘时应使用安全目录，并对文件名做白名单或重新命名。
 
 ## 调试建议
 
-- 新增或删除 Page 目录后重载插件
-- 修改 `pages/<page_name>/` 下的大多数静态资源后，刷新 Page 即可
-- 如果 Page 没出现，检查 `pages/<page_name>/index.html` 是否存在，以及插件是否启用
-
-## 附录：Bridge API 详解
-
-建议在页面脚本开始处保存 bridge 引用：
-
-```js
-const bridge = window.AstrBotPluginPage;
-```
-
-### `ready()`
-
-等待父页面发送初始上下文，返回 `Promise<context>`。页面初始化时应先等待它，避免过早读取空上下文。
-
-```js
-const context = await bridge.ready();
-console.log(context.pluginName, context.pageName, context.locale);
-```
-
-上下文通常包含：
-
-```json
-{
-  "pluginName": "astrbot_plugin_page_demo",
-  "displayName": "Plugin Page Demo",
-  "pageName": "bridge-demo",
-  "pageTitle": "Bridge Demo",
-  "locale": "zh-CN",
-  "i18n": {},
-  "isDark": false
-}
-```
-
-### `getContext()`
-
-同步读取最近一次上下文。适合在 `ready()` 之后或 `onContext()` 回调中使用。
-
-```js
-function renderHeader() {
-  const context = bridge.getContext();
-  document.getElementById("title").textContent = context.pageTitle;
-}
-```
-
-### `getLocale()`
-
-同步读取当前 WebUI 语言。没有上下文时默认返回 `zh-CN`。
-
-```js
-document.documentElement.lang = bridge.getLocale();
-```
-
-### `getI18n()`
-
-同步读取当前插件的完整 i18n 资源对象。一般优先用 `t()`，只有需要自定义遍历或调试时才直接读取。
-
-```js
-console.log(Object.keys(bridge.getI18n()));
-```
-
-### `t(key, fallback)`
-
-按点分隔 key 从插件 i18n 中取文案。当前语言缺失时会尝试回退，仍缺失则返回 `fallback`。
-
-```js
-saveButton.textContent = bridge.t("pages.settings.save", "Save");
-```
-
-### `onContext(handler)`
-
-监听上下文变化，返回取消监听函数。WebUI 切换语言时会触发该回调，所以需要响应语言切换的页面应在这里重新渲染。
-
-```js
-function render() {
-  document.title = bridge.t("pages.settings.title", "Settings");
-}
-
-await bridge.ready();
-render();
-
-const off = bridge.onContext(render);
-
-window.addEventListener("beforeunload", () => {
-  off();
-});
-```
-
-### `apiGet(endpoint, params)`
-
-向插件后端发送 GET 请求，返回 `Promise<data>`。`endpoint` 是插件内相对路径，Dashboard 会转发到 `/api/plug/<plugin_name>/<endpoint>`。
-
-```js
-const stats = await bridge.apiGet("stats", { limit: 20 });
-```
-
-后端注册示例：
-
-```python
-context.register_web_api(
-    f"/{PLUGIN_NAME}/stats",
-    self.get_stats,
-    ["GET"],
-    "Get stats",
-)
-```
-
-### `apiPost(endpoint, body)`
-
-向插件后端发送 POST 请求，`body` 会作为 JSON 请求体发送，返回 `Promise<data>`。
-
-```js
-await bridge.apiPost("settings/save", {
-  enabled: true,
-  threshold: 0.8,
-});
-```
-
-### `upload(endpoint, file)`
-
-以 `multipart/form-data` 上传单个文件，字段名为 `file`，返回 `Promise<data>`。
-
-```js
-const input = document.querySelector("input[type=file]");
-const file = input.files[0];
-const result = await bridge.upload("files/import", file);
-```
-
-### `download(endpoint, params, filename)`
-
-请求插件后端文件接口并触发浏览器下载。`params` 会作为 query string，`filename` 可选；不传时会尝试使用响应头里的文件名。
-
-```js
-await bridge.download("files/export", { format: "json" }, "export.json");
-```
-
-### `subscribeSSE(endpoint, handlers, params)`
-
-订阅插件后端 SSE，返回 `Promise<subscriptionId>`。`handlers` 可包含 `onOpen`、`onMessage`、`onError`。
-
-```js
-const subscriptionId = await bridge.subscribeSSE(
-  "events",
-  {
-    onOpen() {
-      console.log("SSE opened");
-    },
-    onMessage(event) {
-      console.log(event.raw, event.parsed, event.lastEventId);
-    },
-    onError() {
-      console.warn("SSE error");
-    },
-  },
-  { topic: "logs" },
-);
-```
-
-`event.parsed` 会在消息内容是 JSON 字符串时自动解析，否则等于原始字符串。
-
-### `unsubscribeSSE(subscriptionId)`
-
-取消 SSE 订阅。
-
-```js
-await bridge.unsubscribeSSE(subscriptionId);
-```
-
-页面卸载时建议清理订阅：
-
-```js
-window.addEventListener("beforeunload", () => {
-  bridge.unsubscribeSSE(subscriptionId);
-});
-```
-
-### endpoint 规则
-
-`apiGet`、`apiPost`、`upload`、`download`、`subscribeSSE` 的 `endpoint` 必须是插件内相对路径：
-
-- 允许：`"stats"`、`"settings/save"`、`"files/export"`
-- 不允许：空字符串、`"/stats"`、`"../stats"`、`"https://example.com"`、`"stats?x=1"`、`"stats#top"`
-
-query 参数请通过 `params` 传递，不要拼进 `endpoint`。
+- Page 没出现：检查 `pages/<page_name>/index.html` 是否存在、插件是否启用、插件详情页是否已刷新。
+- bridge 不存在：确认脚本在 bridge SDK 注入之后运行；推荐使用外部 `type="module"` 脚本。
+- API 未匹配：确认注册路由包含插件名前缀，例如 `/{PLUGIN_NAME}/stats`，而 Page 端 endpoint 是 `stats`。
+- query 或 JSON 为空：GET 参数放到 `apiGet(endpoint, params)`，POST JSON 放到 `apiPost(endpoint, body)`。
+- 文件上传为空：`upload()` 字段名固定为 `file`，后端用 `(await request.files()).get("file")` 读取。
+- SSE 没消息：确认后端响应是 `text/event-stream`，每条消息以空行结尾，例如 `data: ...\n\n`。
+- SSE 401：不要在 Page 中直接 `new EventSource("/api/v1/...")`，原生 `EventSource` 不能携带 `Authorization` header；请通过 `bridge.subscribeSSE()` 调用。
diff --git a/openspec/openapi-v1.yaml b/openspec/openapi-v1.yaml
new file mode 100644
index 000000000..fb6ad80f6
--- /dev/null
+++ b/openspec/openapi-v1.yaml
@@ -0,0 +1,6027 @@
+openapi: 3.1.0
+info:
+  title: AstrBot OpenAPI v1
+  version: 0.1.0
+  description: >
+    Target REST contract for migrating AstrBot HTTP APIs to /api/v1.
+    Dynamic AstrBot configuration payloads are intentionally modeled as open
+    JSON objects because their schemas are provided at runtime by template
+    endpoints.
+    Developer API keys currently support these scopes only: bot, provider,
+    persona, im, config, chat, plugin, mcp, skill. The config scope also
+    grants bot and provider access.
+servers:
+  - url: http://localhost:6185
+    description: Local AstrBot server
+
+security:
+  - ApiKeyAuth: []
+
+tags:
+  - name: Auth
+  - name: API Keys
+  - name: System Config
+  - name: Config Profiles
+  - name: Bot Config Routes
+  - name: Bots
+  - name: Provider Sources
+  - name: Providers
+  - name: Chat
+  - name: IM
+  - name: Files
+  - name: Plugins
+  - name: Plugin Sources
+  - name: Plugin Pages
+  - name: Commands
+  - name: Tools
+  - name: MCP
+  - name: Skills
+  - name: Knowledge Base
+  - name: Personas
+  - name: Sessions
+  - name: Conversations
+  - name: Stats
+  - name: Backups
+  - name: Updates
+  - name: Cron
+  - name: Logs
+  - name: T2I
+  - name: Subagents
+  - name: Webhooks
+
+paths:
+  /api/v1/auth/login:
+    post:
+      tags: [Auth]
+      summary: Login to the dashboard API
+      operationId: login
+      security: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/LoginRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+        "401":
+          $ref: "#/components/responses/Error"
+
+  /api/v1/auth/logout:
+    post:
+      tags: [Auth]
+      summary: Logout from the dashboard API
+      operationId: logout
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/auth/setup-status:
+    get:
+      tags: [Auth]
+      summary: Get first-run setup status
+      operationId: getAuthSetupStatus
+      security: []
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/auth/setup:
+    post:
+      tags: [Auth]
+      summary: Complete first-run dashboard account setup
+      operationId: setupAuth
+      security: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/SetupAuthRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/auth/totp/setup:
+    post:
+      tags: [Auth]
+      summary: Start or refresh TOTP setup
+      operationId: setupTotp
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/TotpSetupRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/auth/totp/recovery:
+    post:
+      tags: [Auth]
+      summary: Generate or rotate TOTP recovery codes
+      operationId: recoverTotp
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/auth/account:
+    patch:
+      tags: [Auth]
+      summary: Update dashboard account credentials
+      operationId: updateAuthAccount
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/UpdateAccountRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/api-keys:
+    get:
+      tags: [API Keys]
+      summary: List OpenAPI keys
+      operationId: listApiKeys
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    post:
+      tags: [API Keys]
+      summary: Create an OpenAPI key
+      operationId: createApiKey
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/CreateApiKeyRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/api-keys/{key_id}/revoke:
+    post:
+      tags: [API Keys]
+      summary: Revoke an OpenAPI key
+      operationId: revokeApiKey
+      parameters:
+        - $ref: "#/components/parameters/KeyId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/api-keys/{key_id}:
+    delete:
+      tags: [API Keys]
+      summary: Delete an OpenAPI key
+      operationId: deleteApiKey
+      parameters:
+        - $ref: "#/components/parameters/KeyId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/system-config/schema:
+    get:
+      tags: [System Config]
+      summary: Get the system configuration schema
+      operationId: getSystemConfigSchema
+      x-astrbot-scope: config
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/system-config:
+    get:
+      tags: [System Config]
+      summary: Get the system configuration
+      operationId: getSystemConfig
+      x-astrbot-scope: config
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    put:
+      tags: [System Config]
+      summary: Replace the system configuration
+      operationId: updateSystemConfig
+      x-astrbot-scope: config
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DynamicConfig"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/system-config/runtime:
+    get:
+      tags: [System Config]
+      summary: Get runtime-enriched system configuration metadata
+      operationId: getSystemConfigRuntime
+      x-astrbot-scope: config
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/config-profiles/schema:
+    get:
+      tags: [Config Profiles]
+      summary: Get the configuration profile schema
+      operationId: getConfigProfileSchema
+      x-astrbot-scope: config
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/config-profiles:
+    get:
+      tags: [Config Profiles]
+      summary: List configuration profiles
+      operationId: listConfigProfiles
+      x-astrbot-scope: config
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    post:
+      tags: [Config Profiles]
+      summary: Create a configuration profile
+      operationId: createConfigProfile
+      x-astrbot-scope: config
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/CreateConfigProfileRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/config-profiles/{config_id}:
+    get:
+      tags: [Config Profiles]
+      summary: Get a configuration profile
+      operationId: getConfigProfile
+      x-astrbot-scope: config
+      parameters:
+        - $ref: "#/components/parameters/ConfigId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    put:
+      tags: [Config Profiles]
+      summary: Replace a configuration profile
+      operationId: updateConfigProfileContent
+      x-astrbot-scope: config
+      parameters:
+        - $ref: "#/components/parameters/ConfigId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DynamicConfig"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    patch:
+      tags: [Config Profiles]
+      summary: Rename a configuration profile
+      operationId: renameConfigProfile
+      x-astrbot-scope: config
+      parameters:
+        - $ref: "#/components/parameters/ConfigId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/RenameRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Config Profiles]
+      summary: Delete a configuration profile
+      operationId: deleteConfigProfile
+      x-astrbot-scope: config
+      parameters:
+        - $ref: "#/components/parameters/ConfigId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/config-routes:
+    get:
+      tags: [Bot Config Routes]
+      summary: List UMO to configuration profile bindings
+      operationId: listConfigRoutes
+      x-astrbot-scope: config
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    put:
+      tags: [Bot Config Routes]
+      summary: Replace all UMO to configuration profile bindings
+      operationId: replaceConfigRoutes
+      x-astrbot-scope: config
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ConfigRoutesReplaceRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/config-routes/{umo}:
+    put:
+      tags: [Bot Config Routes]
+      summary: Bind a UMO to a configuration profile
+      operationId: upsertConfigRoute
+      x-astrbot-scope: config
+      parameters:
+        - $ref: "#/components/parameters/Umo"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ConfigRouteUpsertRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Bot Config Routes]
+      summary: Remove a UMO configuration profile binding
+      operationId: deleteConfigRoute
+      x-astrbot-scope: config
+      parameters:
+        - $ref: "#/components/parameters/Umo"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/bot-types:
+    get:
+      tags: [Bots]
+      summary: List configurable bot types and their schemas
+      operationId: listBotTypes
+      x-astrbot-scope: bot
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/bot-types/{bot_type}/registration:
+    post:
+      tags: [Bots]
+      summary: Run a bot type registration flow action
+      operationId: registerBotType
+      x-astrbot-scope: bot
+      parameters:
+        - name: bot_type
+          in: path
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/BotRegistrationRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/bots:
+    get:
+      tags: [Bots]
+      summary: List created bots and their configurations
+      operationId: listBots
+      x-astrbot-scope: bot
+      parameters:
+        - name: enabled
+          in: query
+          schema:
+            type: boolean
+        - name: type
+          in: query
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    post:
+      tags: [Bots]
+      summary: Create a bot from configuration
+      operationId: createBot
+      x-astrbot-scope: bot
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/BotConfigRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/bots/stats:
+    get:
+      tags: [Bots]
+      summary: List runtime status for all bots
+      operationId: listBotStats
+      x-astrbot-scope: bot
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/bots/by-id:
+    get:
+      tags: [Bots]
+      summary: Get a bot configuration by query ID
+      operationId: getBotById
+      x-astrbot-scope: bot
+      parameters:
+        - name: bot_id
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    put:
+      tags: [Bots]
+      summary: Replace a bot configuration by body ID
+      operationId: updateBotById
+      x-astrbot-scope: bot
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [bot_id, config]
+              properties:
+                bot_id:
+                  type: string
+                config:
+                  $ref: "#/components/schemas/DynamicConfig"
+              additionalProperties: false
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Bots]
+      summary: Delete a bot by query ID
+      operationId: deleteBotById
+      x-astrbot-scope: bot
+      parameters:
+        - name: bot_id
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/bots/enabled:
+    patch:
+      tags: [Bots]
+      summary: Enable or disable a bot by body ID
+      operationId: setBotEnabledById
+      x-astrbot-scope: bot
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [bot_id, enabled]
+              properties:
+                bot_id:
+                  type: string
+                enabled:
+                  type: boolean
+              additionalProperties: false
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/bots/test:
+    post:
+      tags: [Bots]
+      summary: Test a bot registration or connection by body ID
+      operationId: testBotById
+      x-astrbot-scope: bot
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [bot_id]
+              properties:
+                bot_id:
+                  type: string
+              additionalProperties: false
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/bots/{bot_id}:
+    get:
+      tags: [Bots]
+      summary: Get a bot configuration
+      operationId: getBot
+      x-astrbot-scope: bot
+      parameters:
+        - $ref: "#/components/parameters/BotId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    put:
+      tags: [Bots]
+      summary: Replace a bot configuration
+      operationId: updateBot
+      x-astrbot-scope: bot
+      parameters:
+        - $ref: "#/components/parameters/BotId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/BotConfigRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Bots]
+      summary: Delete a bot
+      operationId: deleteBot
+      x-astrbot-scope: bot
+      parameters:
+        - $ref: "#/components/parameters/BotId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/bots/{bot_id}/enabled:
+    patch:
+      tags: [Bots]
+      summary: Enable or disable a bot
+      operationId: setBotEnabled
+      x-astrbot-scope: bot
+      parameters:
+        - $ref: "#/components/parameters/BotId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/EnabledPatch"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/bots/{bot_id}/test:
+    post:
+      tags: [Bots]
+      summary: Test a bot registration or connection
+      operationId: testBot
+      x-astrbot-scope: bot
+      parameters:
+        - $ref: "#/components/parameters/BotId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/providers/schema:
+    get:
+      tags: [Providers]
+      summary: Get the overall provider configuration schema
+      operationId: getProviderSchema
+      x-astrbot-scope: provider
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/provider-sources:
+    get:
+      tags: [Provider Sources]
+      summary: List provider sources
+      operationId: listProviderSources
+      x-astrbot-scope: provider
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    post:
+      tags: [Provider Sources]
+      summary: Create a provider source
+      operationId: createProviderSource
+      x-astrbot-scope: provider
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ProviderSourceConfigRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/provider-sources/by-id:
+    get:
+      tags: [Provider Sources]
+      summary: Get a provider source by query ID
+      operationId: getProviderSourceById
+      x-astrbot-scope: provider
+      parameters:
+        - name: source_id
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    put:
+      tags: [Provider Sources]
+      summary: Update a provider source by body ID
+      operationId: upsertProviderSourceById
+      x-astrbot-scope: provider
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [source_id, config]
+              properties:
+                source_id:
+                  type: string
+                config:
+                  $ref: "#/components/schemas/DynamicConfig"
+              additionalProperties: false
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Provider Sources]
+      summary: Delete a provider source by query ID
+      operationId: deleteProviderSourceById
+      x-astrbot-scope: provider
+      parameters:
+        - name: source_id
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/provider-sources/models:
+    get:
+      tags: [Provider Sources]
+      summary: List models available from a provider source by query ID
+      operationId: listProviderSourceModelsById
+      x-astrbot-scope: provider
+      parameters:
+        - name: source_id
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: capability
+          in: query
+          schema:
+            $ref: "#/components/schemas/ProviderCapability"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/provider-sources/providers:
+    get:
+      tags: [Providers]
+      summary: List providers under a provider source by query ID
+      operationId: listProvidersBySourceId
+      x-astrbot-scope: provider
+      parameters:
+        - name: source_id
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: capability
+          in: query
+          schema:
+            $ref: "#/components/schemas/ProviderCapability"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    post:
+      tags: [Providers]
+      summary: Create a provider under a provider source by body ID
+      operationId: createProviderInSourceById
+      x-astrbot-scope: provider
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [source_id, config]
+              properties:
+                source_id:
+                  type: string
+                config:
+                  $ref: "#/components/schemas/DynamicConfig"
+              additionalProperties: false
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/provider-sources/{source_id}:
+    get:
+      tags: [Provider Sources]
+      summary: Get a provider source
+      operationId: getProviderSource
+      x-astrbot-scope: provider
+      parameters:
+        - $ref: "#/components/parameters/SourceId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    put:
+      tags: [Provider Sources]
+      summary: Update a provider source or create it if missing
+      operationId: upsertProviderSource
+      x-astrbot-scope: provider
+      parameters:
+        - $ref: "#/components/parameters/SourceId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ProviderSourceConfigRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Provider Sources]
+      summary: Delete a provider source and providers that reference it
+      operationId: deleteProviderSource
+      x-astrbot-scope: provider
+      parameters:
+        - $ref: "#/components/parameters/SourceId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/provider-sources/{source_id}/models:
+    get:
+      tags: [Provider Sources]
+      summary: List models available from a provider source
+      operationId: listProviderSourceModels
+      x-astrbot-scope: provider
+      parameters:
+        - $ref: "#/components/parameters/SourceId"
+        - name: capability
+          in: query
+          schema:
+            $ref: "#/components/schemas/ProviderCapability"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/provider-sources/{source_id}/providers:
+    get:
+      tags: [Providers]
+      summary: List providers under a provider source
+      operationId: listProvidersBySource
+      x-astrbot-scope: provider
+      parameters:
+        - $ref: "#/components/parameters/SourceId"
+        - name: capability
+          in: query
+          schema:
+            $ref: "#/components/schemas/ProviderCapability"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    post:
+      tags: [Providers]
+      summary: Create a provider under a provider source
+      operationId: createProviderInSource
+      x-astrbot-scope: provider
+      parameters:
+        - $ref: "#/components/parameters/SourceId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ProviderConfigRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/providers:
+    get:
+      tags: [Providers]
+      summary: List providers by capability or source
+      operationId: listProviders
+      x-astrbot-scope: provider
+      parameters:
+        - name: capability
+          in: query
+          schema:
+            $ref: "#/components/schemas/ProviderCapability"
+        - name: source_id
+          in: query
+          schema:
+            type: string
+        - name: enabled
+          in: query
+          schema:
+            type: boolean
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    post:
+      tags: [Providers]
+      summary: Create a standalone provider
+      operationId: createProvider
+      x-astrbot-scope: provider
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ProviderConfigRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/providers/by-id:
+    get:
+      tags: [Providers]
+      summary: Get a provider configuration by query ID
+      operationId: getProviderById
+      x-astrbot-scope: provider
+      parameters:
+        - name: provider_id
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: merged
+          in: query
+          schema:
+            type: boolean
+            default: false
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    put:
+      tags: [Providers]
+      summary: Replace a provider configuration by body ID
+      operationId: updateProviderById
+      x-astrbot-scope: provider
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [provider_id, config]
+              properties:
+                provider_id:
+                  type: string
+                config:
+                  $ref: "#/components/schemas/DynamicConfig"
+              additionalProperties: false
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Providers]
+      summary: Delete a provider by query ID
+      operationId: deleteProviderById
+      x-astrbot-scope: provider
+      parameters:
+        - name: provider_id
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/providers/enabled:
+    patch:
+      tags: [Providers]
+      summary: Enable or disable a provider by body ID
+      operationId: setProviderEnabledById
+      x-astrbot-scope: provider
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [provider_id, enabled]
+              properties:
+                provider_id:
+                  type: string
+                enabled:
+                  type: boolean
+              additionalProperties: false
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/providers/test:
+    post:
+      tags: [Providers]
+      summary: Test a provider by body ID
+      operationId: testProviderById
+      x-astrbot-scope: provider
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [provider_id]
+              properties:
+                provider_id:
+                  type: string
+              additionalProperties: false
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/providers/embedding-dimension:
+    post:
+      tags: [Providers]
+      summary: Probe embedding dimension for a provider by body ID
+      operationId: getProviderEmbeddingDimensionById
+      x-astrbot-scope: provider
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [provider_id]
+              properties:
+                provider_id:
+                  type: string
+                provider_config:
+                  $ref: "#/components/schemas/DynamicConfig"
+              additionalProperties: false
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/providers/{provider_id}:
+    get:
+      tags: [Providers]
+      summary: Get a provider configuration
+      operationId: getProvider
+      x-astrbot-scope: provider
+      parameters:
+        - $ref: "#/components/parameters/ProviderId"
+        - name: merged
+          in: query
+          schema:
+            type: boolean
+            default: false
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    put:
+      tags: [Providers]
+      summary: Replace a provider configuration
+      operationId: updateProvider
+      x-astrbot-scope: provider
+      parameters:
+        - $ref: "#/components/parameters/ProviderId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ProviderConfigRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Providers]
+      summary: Delete a provider
+      operationId: deleteProvider
+      x-astrbot-scope: provider
+      parameters:
+        - $ref: "#/components/parameters/ProviderId"
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DynamicConfig"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/providers/{provider_id}/enabled:
+    patch:
+      tags: [Providers]
+      summary: Enable or disable a provider
+      operationId: setProviderEnabled
+      x-astrbot-scope: provider
+      parameters:
+        - $ref: "#/components/parameters/ProviderId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/EnabledPatch"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/providers/{provider_id}/test:
+    post:
+      tags: [Providers]
+      summary: Test a provider
+      operationId: testProvider
+      x-astrbot-scope: provider
+      parameters:
+        - $ref: "#/components/parameters/ProviderId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/providers/{provider_id}/embedding-dimension:
+    post:
+      tags: [Providers]
+      summary: Probe embedding dimension for a provider
+      operationId: getProviderEmbeddingDimension
+      x-astrbot-scope: provider
+      parameters:
+        - $ref: "#/components/parameters/ProviderId"
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DynamicConfig"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/chat:
+    post:
+      tags: [Chat]
+      summary: Send a webchat message
+      operationId: sendChatMessage
+      x-astrbot-scope: chat
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ChatRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/chat/ws:
+    get:
+      tags: [Chat]
+      summary: Open a streaming chat WebSocket
+      operationId: openChatWebSocket
+      x-websocket: true
+      x-astrbot-scope: chat
+      parameters:
+        - name: api_key
+          in: query
+          schema:
+            type: string
+        - name: key
+          in: query
+          schema:
+            type: string
+      responses:
+        "101":
+          description: WebSocket upgrade accepted
+
+  /api/v1/live-chat/ws:
+    get:
+      tags: [Chat]
+      summary: Open the live voice chat WebSocket
+      operationId: openLiveChatWebSocket
+      x-websocket: true
+      x-astrbot-scope: chat
+      parameters:
+        - name: token
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "101":
+          description: WebSocket upgrade accepted
+
+  /api/v1/unified-chat/ws:
+    get:
+      tags: [Chat]
+      summary: Open the unified live/chat WebSocket
+      operationId: openUnifiedChatWebSocket
+      x-websocket: true
+      x-astrbot-scope: chat
+      parameters:
+        - name: token
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "101":
+          description: WebSocket upgrade accepted
+
+  /api/v1/chat/sessions:
+    get:
+      tags: [Chat]
+      summary: List webchat sessions
+      operationId: listChatSessions
+      x-astrbot-scope: chat
+      parameters:
+        - $ref: "#/components/parameters/Page"
+        - $ref: "#/components/parameters/PageSize"
+        - name: username
+          in: query
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/chat/sessions/new:
+    get:
+      tags: [Chat]
+      summary: Create a webchat session
+      operationId: createChatSession
+      x-astrbot-scope: chat
+      parameters:
+        - name: platform_id
+          in: query
+          schema:
+            type: string
+            default: webchat
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/chat/sessions/batch-delete:
+    post:
+      tags: [Chat]
+      summary: Delete multiple webchat sessions
+      operationId: batchDeleteChatSessions
+      x-astrbot-scope: chat
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ChatSessionBatchDeleteRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/chat/sessions/{session_id}:
+    get:
+      tags: [Chat]
+      summary: Get a webchat session and its messages
+      operationId: getChatSession
+      x-astrbot-scope: chat
+      parameters:
+        - $ref: "#/components/parameters/SessionId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    patch:
+      tags: [Chat]
+      summary: Update a webchat session
+      operationId: updateChatSession
+      x-astrbot-scope: chat
+      parameters:
+        - $ref: "#/components/parameters/SessionId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ChatSessionPatchRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Chat]
+      summary: Delete a webchat session
+      operationId: deleteChatSession
+      x-astrbot-scope: chat
+      parameters:
+        - $ref: "#/components/parameters/SessionId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/chat/sessions/{session_id}/stop:
+    post:
+      tags: [Chat]
+      summary: Stop active webchat work for a session
+      operationId: stopChatSession
+      x-astrbot-scope: chat
+      parameters:
+        - $ref: "#/components/parameters/SessionId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/chat/sessions/{session_id}/messages/{message_id}:
+    patch:
+      tags: [Chat]
+      summary: Update the latest user message in a webchat session
+      operationId: updateChatMessage
+      x-astrbot-scope: chat
+      parameters:
+        - $ref: "#/components/parameters/SessionId"
+        - name: message_id
+          in: path
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ChatMessagePatchRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/chat/sessions/{session_id}/messages/{message_id}/regenerate:
+    post:
+      tags: [Chat]
+      summary: Regenerate a bot message in a webchat session
+      operationId: regenerateChatMessage
+      x-astrbot-scope: chat
+      parameters:
+        - $ref: "#/components/parameters/SessionId"
+        - name: message_id
+          in: path
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ChatMessageRegenerateRequest"
+      responses:
+        "200":
+          description: Server-sent chat stream or an error envelope
+
+  /api/v1/chat/configs:
+    get:
+      tags: [Chat]
+      summary: List chat-selectable configuration profiles
+      operationId: listChatConfigs
+      x-astrbot-scope: config
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/chat/threads:
+    post:
+      tags: [Chat]
+      summary: Create or reuse a side thread from a webchat message
+      operationId: createChatThread
+      x-astrbot-scope: chat
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ChatThreadCreateRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/chat/threads/{thread_id}:
+    get:
+      tags: [Chat]
+      summary: Get a webchat side thread
+      operationId: getChatThread
+      x-astrbot-scope: chat
+      parameters:
+        - name: thread_id
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Chat]
+      summary: Delete a webchat side thread
+      operationId: deleteChatThread
+      x-astrbot-scope: chat
+      parameters:
+        - name: thread_id
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/chat/threads/{thread_id}/messages:
+    post:
+      tags: [Chat]
+      summary: Send a message inside a webchat side thread
+      operationId: sendChatThreadMessage
+      x-astrbot-scope: chat
+      parameters:
+        - name: thread_id
+          in: path
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ChatThreadMessageRequest"
+      responses:
+        "200":
+          description: Server-sent chat stream or an error envelope
+
+  /api/v1/chat/projects:
+    get:
+      tags: [Chat]
+      summary: List ChatUI projects
+      operationId: listChatProjects
+      x-astrbot-scope: chat
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    post:
+      tags: [Chat]
+      summary: Create a ChatUI project
+      operationId: createChatProject
+      x-astrbot-scope: chat
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ChatProjectRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/chat/projects/{project_id}:
+    get:
+      tags: [Chat]
+      summary: Get a ChatUI project
+      operationId: getChatProject
+      x-astrbot-scope: chat
+      parameters:
+        - name: project_id
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    patch:
+      tags: [Chat]
+      summary: Update a ChatUI project
+      operationId: updateChatProject
+      x-astrbot-scope: chat
+      parameters:
+        - name: project_id
+          in: path
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ChatProjectRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Chat]
+      summary: Delete a ChatUI project
+      operationId: deleteChatProject
+      x-astrbot-scope: chat
+      parameters:
+        - name: project_id
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/chat/projects/{project_id}/sessions:
+    get:
+      tags: [Chat]
+      summary: List sessions in a ChatUI project
+      operationId: listChatProjectSessions
+      x-astrbot-scope: chat
+      parameters:
+        - name: project_id
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/chat/projects/{project_id}/sessions/{session_id}:
+    post:
+      tags: [Chat]
+      summary: Add a session to a ChatUI project
+      operationId: addChatProjectSession
+      x-astrbot-scope: chat
+      parameters:
+        - name: project_id
+          in: path
+          required: true
+          schema:
+            type: string
+        - $ref: "#/components/parameters/SessionId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/chat/projects/sessions/{session_id}:
+    delete:
+      tags: [Chat]
+      summary: Remove a session from its ChatUI project
+      operationId: removeChatProjectSession
+      x-astrbot-scope: chat
+      parameters:
+        - $ref: "#/components/parameters/SessionId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/im/messages:
+    post:
+      tags: [IM]
+      summary: Send a message to a UMO
+      operationId: sendImMessage
+      x-astrbot-scope: im
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ImMessageRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/im/bots:
+    get:
+      tags: [IM]
+      summary: List active IM bot IDs
+      operationId: listImBots
+      x-astrbot-scope: im
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/files:
+    post:
+      tags: [Files]
+      summary: Upload a file
+      operationId: uploadFile
+      x-astrbot-scope: file
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema:
+              $ref: "#/components/schemas/FileUploadRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/files/content:
+    get:
+      tags: [Files]
+      summary: Get an uploaded file by stored filename
+      operationId: getFileByName
+      x-astrbot-scope: file
+      parameters:
+        - name: filename
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: File bytes or an error envelope
+          content:
+            application/octet-stream:
+              schema:
+                type: string
+                format: binary
+
+  /api/v1/files/tokens/{file_token}:
+    get:
+      tags: [Files]
+      summary: Get a tokenized public file
+      operationId: getTokenFile
+      x-astrbot-scope: file
+      parameters:
+        - name: file_token
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Tokenized file bytes or an error envelope
+          content:
+            application/octet-stream:
+              schema:
+                type: string
+                format: binary
+
+  /api/v1/files/{attachment_id}:
+    get:
+      tags: [Files]
+      summary: Get attachment metadata
+      operationId: getAttachment
+      x-astrbot-scope: file
+      parameters:
+        - $ref: "#/components/parameters/AttachmentId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Files]
+      summary: Delete an attachment
+      operationId: deleteAttachment
+      x-astrbot-scope: file
+      parameters:
+        - $ref: "#/components/parameters/AttachmentId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/files/{attachment_id}/content:
+    get:
+      tags: [Files]
+      summary: Download attachment content
+      operationId: downloadAttachment
+      x-astrbot-scope: file
+      parameters:
+        - $ref: "#/components/parameters/AttachmentId"
+      responses:
+        "200":
+          description: File content
+          content:
+            application/octet-stream:
+              schema:
+                type: string
+                format: binary
+
+  /api/v1/plugins:
+    get:
+      tags: [Plugins]
+      summary: List installed plugins
+      operationId: listPlugins
+      x-astrbot-scope: plugin
+      parameters:
+        - name: include_reserved
+          in: query
+          schema:
+            type: boolean
+            default: true
+        - name: enabled
+          in: query
+          schema:
+            type: boolean
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugins/by-id:
+    get:
+      tags: [Plugins]
+      summary: Get plugin details by query ID
+      operationId: getPluginById
+      x-astrbot-scope: plugin
+      parameters:
+        - name: plugin_id
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Plugins]
+      summary: Uninstall a plugin by query ID
+      operationId: uninstallPluginById
+      x-astrbot-scope: plugin
+      parameters:
+        - name: plugin_id
+          in: query
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                delete_config:
+                  type: boolean
+                delete_data:
+                  type: boolean
+              additionalProperties: true
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugins/config:
+    get:
+      tags: [Plugins]
+      summary: Get plugin configuration by query ID
+      operationId: getPluginConfigById
+      x-astrbot-scope: plugin
+      parameters:
+        - name: plugin_id
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    put:
+      tags: [Plugins]
+      summary: Save plugin configuration by body ID
+      operationId: updatePluginConfigById
+      x-astrbot-scope: plugin
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [plugin_id, config]
+              properties:
+                plugin_id:
+                  type: string
+                config:
+                  $ref: "#/components/schemas/DynamicConfig"
+              additionalProperties: false
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugins/config/schema:
+    get:
+      tags: [Plugins]
+      summary: Get plugin configuration schema by query ID
+      operationId: getPluginConfigSchemaById
+      x-astrbot-scope: plugin
+      parameters:
+        - name: plugin_id
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugins/config-files:
+    get:
+      tags: [Plugins]
+      summary: List uploaded files for a plugin file configuration item by query ID
+      operationId: listPluginConfigFilesById
+      x-astrbot-scope: plugin
+      parameters:
+        - name: plugin_id
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: config_key
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    post:
+      tags: [Plugins]
+      summary: Upload files for a plugin file configuration item by query ID
+      operationId: uploadPluginConfigFilesById
+      x-astrbot-scope: plugin
+      parameters:
+        - name: plugin_id
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: config_key
+          in: query
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              additionalProperties: true
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Plugins]
+      summary: Delete a plugin file configuration upload by query ID
+      operationId: deletePluginConfigFileById
+      x-astrbot-scope: plugin
+      parameters:
+        - name: plugin_id
+          in: query
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PluginConfigFileDeleteRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugins/readme:
+    get:
+      tags: [Plugins]
+      summary: Get plugin README content by query ID
+      operationId: getPluginReadmeById
+      x-astrbot-scope: plugin
+      parameters:
+        - name: plugin_id
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Text"
+
+  /api/v1/plugins/changelog:
+    get:
+      tags: [Plugins]
+      summary: Get plugin CHANGELOG content by query ID
+      operationId: getPluginChangelogById
+      x-astrbot-scope: plugin
+      parameters:
+        - name: plugin_id
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Text"
+
+  /api/v1/plugins/reload:
+    post:
+      tags: [Plugins]
+      summary: Reload a plugin by body ID
+      operationId: reloadPluginById
+      x-astrbot-scope: plugin
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [plugin_id]
+              properties:
+                plugin_id:
+                  type: string
+              additionalProperties: false
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugins/enabled:
+    patch:
+      tags: [Plugins]
+      summary: Enable or disable a plugin by body ID
+      operationId: setPluginEnabledById
+      x-astrbot-scope: plugin
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [plugin_id, enabled]
+              properties:
+                plugin_id:
+                  type: string
+                enabled:
+                  type: boolean
+              additionalProperties: false
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugins/pages:
+    get:
+      tags: [Plugin Pages]
+      summary: List plugin pages by query ID
+      operationId: listPluginPagesById
+      x-astrbot-scope: plugin
+      parameters:
+        - name: plugin_id
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugins/page:
+    get:
+      tags: [Plugin Pages]
+      summary: Get plugin page entry HTML by query ID
+      operationId: getPluginPageById
+      x-astrbot-scope: plugin
+      parameters:
+        - name: plugin_id
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: page_name
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Html"
+
+  /api/v1/plugins/page/assets:
+    get:
+      tags: [Plugin Pages]
+      summary: Get a plugin page asset by query ID
+      operationId: getPluginPageAssetById
+      x-astrbot-scope: plugin
+      parameters:
+        - name: plugin_id
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: page_name
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: asset_path
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Plugin asset content
+
+  /api/v1/plugins/{plugin_id}:
+    get:
+      tags: [Plugins]
+      summary: Get plugin details
+      operationId: getPlugin
+      x-astrbot-scope: plugin
+      parameters:
+        - $ref: "#/components/parameters/PluginId"
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                delete_config:
+                  type: boolean
+                delete_data:
+                  type: boolean
+              additionalProperties: true
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Plugins]
+      summary: Uninstall a plugin
+      operationId: uninstallPlugin
+      x-astrbot-scope: plugin
+      parameters:
+        - $ref: "#/components/parameters/PluginId"
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                delete_config:
+                  type: boolean
+                delete_data:
+                  type: boolean
+              additionalProperties: true
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugins/{plugin_id}/config:
+    get:
+      tags: [Plugins]
+      summary: Get plugin configuration
+      operationId: getPluginConfig
+      x-astrbot-scope: plugin
+      parameters:
+        - $ref: "#/components/parameters/PluginId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    put:
+      tags: [Plugins]
+      summary: Save plugin configuration
+      operationId: updatePluginConfig
+      x-astrbot-scope: plugin
+      parameters:
+        - $ref: "#/components/parameters/PluginId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DynamicConfig"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugins/{plugin_id}/config/schema:
+    get:
+      tags: [Plugins]
+      summary: Get plugin configuration schema
+      operationId: getPluginConfigSchema
+      x-astrbot-scope: plugin
+      parameters:
+        - $ref: "#/components/parameters/PluginId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugins/{plugin_id}/config-files/{config_key}:
+    get:
+      tags: [Plugins]
+      summary: List uploaded files for a plugin file configuration item
+      operationId: listPluginConfigFiles
+      x-astrbot-scope: plugin
+      parameters:
+        - $ref: "#/components/parameters/PluginId"
+        - name: config_key
+          in: path
+          required: true
+          description: URL-encoded configuration key path.
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    post:
+      tags: [Plugins]
+      summary: Upload files for a plugin file configuration item
+      operationId: uploadPluginConfigFiles
+      x-astrbot-scope: plugin
+      parameters:
+        - $ref: "#/components/parameters/PluginId"
+        - name: config_key
+          in: path
+          required: true
+          description: URL-encoded configuration key path.
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              additionalProperties: true
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugins/{plugin_id}/config-files:
+    delete:
+      tags: [Plugins]
+      summary: Delete a plugin file configuration upload
+      operationId: deletePluginConfigFile
+      x-astrbot-scope: plugin
+      parameters:
+        - $ref: "#/components/parameters/PluginId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PluginConfigFileDeleteRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugins/{plugin_id}/readme:
+    get:
+      tags: [Plugins]
+      summary: Get plugin README content
+      operationId: getPluginReadme
+      x-astrbot-scope: plugin
+      parameters:
+        - $ref: "#/components/parameters/PluginId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Text"
+
+  /api/v1/plugins/{plugin_id}/changelog:
+    get:
+      tags: [Plugins]
+      summary: Get plugin CHANGELOG content
+      operationId: getPluginChangelog
+      x-astrbot-scope: plugin
+      parameters:
+        - $ref: "#/components/parameters/PluginId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Text"
+
+  /api/v1/plugins/{plugin_id}/reload:
+    post:
+      tags: [Plugins]
+      summary: Reload a plugin
+      operationId: reloadPlugin
+      x-astrbot-scope: plugin
+      parameters:
+        - $ref: "#/components/parameters/PluginId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugins/{plugin_id}/enabled:
+    patch:
+      tags: [Plugins]
+      summary: Enable or disable a plugin
+      operationId: setPluginEnabled
+      x-astrbot-scope: plugin
+      parameters:
+        - $ref: "#/components/parameters/PluginId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/EnabledPatch"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugins/{plugin_id}/update:
+    post:
+      tags: [Plugins]
+      summary: Update or reinstall a plugin
+      operationId: updatePlugin
+      x-astrbot-scope: plugin
+      parameters:
+        - $ref: "#/components/parameters/PluginId"
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PluginUpdateRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugins/update:
+    post:
+      tags: [Plugins]
+      summary: Update multiple plugins
+      operationId: updatePlugins
+      x-astrbot-scope: plugin
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PluginBatchUpdateRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugins/version-support/check:
+    post:
+      tags: [Plugins]
+      summary: Check whether a plugin version constraint is supported
+      operationId: checkPluginVersionSupport
+      x-astrbot-scope: plugin
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PluginVersionSupportRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugins/failed:
+    get:
+      tags: [Plugins]
+      summary: List failed plugins and errors
+      operationId: listFailedPlugins
+      x-astrbot-scope: plugin
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugins/failed/{plugin_id}:
+    delete:
+      tags: [Plugins]
+      summary: Uninstall a failed plugin
+      operationId: uninstallFailedPlugin
+      x-astrbot-scope: plugin
+      parameters:
+        - $ref: "#/components/parameters/PluginId"
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                delete_config:
+                  type: boolean
+                delete_data:
+                  type: boolean
+              additionalProperties: true
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugins/failed/{plugin_id}/reload:
+    post:
+      tags: [Plugins]
+      summary: Reload a failed plugin
+      operationId: reloadFailedPlugin
+      x-astrbot-scope: plugin
+      parameters:
+        - $ref: "#/components/parameters/PluginId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugins/install/github:
+    post:
+      tags: [Plugins]
+      summary: Install a plugin from GitHub
+      operationId: installPluginFromGithub
+      x-astrbot-scope: plugin
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PluginGithubInstallRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+  /api/v1/plugins/install/url:
+    post:
+      tags: [Plugins]
+      summary: Install a plugin from a downloadable ZIP URL
+      operationId: installPluginFromUrl
+      x-astrbot-scope: plugin
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PluginUrlInstallRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugins/install/upload:
+    post:
+      tags: [Plugins]
+      summary: Install a plugin from an uploaded ZIP file
+      operationId: installPluginFromUpload
+      x-astrbot-scope: plugin
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema:
+              $ref: "#/components/schemas/PluginUploadInstallRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugins/market:
+    get:
+      tags: [Plugins]
+      summary: List plugin marketplace entries
+      operationId: listPluginMarket
+      x-astrbot-scope: plugin
+      parameters:
+        - $ref: "#/components/parameters/Page"
+        - $ref: "#/components/parameters/PageSize"
+        - name: category
+          in: query
+          schema:
+            type: string
+        - name: sort
+          in: query
+          schema:
+            type: string
+            enum: [recommended, downloads, updated, name]
+        - name: keyword
+          in: query
+          schema:
+            type: string
+        - name: force_refresh
+          in: query
+          schema:
+            type: boolean
+        - name: custom_registry
+          in: query
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugins/market/categories:
+    get:
+      tags: [Plugins]
+      summary: List plugin marketplace categories
+      operationId: listPluginMarketCategories
+      x-astrbot-scope: plugin
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugin-sources:
+    get:
+      tags: [Plugin Sources]
+      summary: List plugin sources
+      operationId: listPluginSources
+      x-astrbot-scope: plugin
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    post:
+      tags: [Plugin Sources]
+      summary: Add a plugin source
+      operationId: createPluginSource
+      x-astrbot-scope: plugin
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PluginSourceRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    put:
+      tags: [Plugin Sources]
+      summary: Replace plugin sources
+      operationId: replacePluginSources
+      x-astrbot-scope: plugin
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [sources]
+              properties:
+                sources:
+                  type: array
+                  items:
+                    $ref: "#/components/schemas/PluginSourceRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugin-sources/{source_id}:
+    delete:
+      tags: [Plugin Sources]
+      summary: Delete a plugin source
+      operationId: deletePluginSource
+      x-astrbot-scope: plugin
+      parameters:
+        - $ref: "#/components/parameters/SourceId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugin-sources/by-id:
+    delete:
+      tags: [Plugin Sources]
+      summary: Delete a plugin source by query ID
+      operationId: deletePluginSourceById
+      x-astrbot-scope: plugin
+      parameters:
+        - name: source_id
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugins/{plugin_id}/pages:
+    get:
+      tags: [Plugin Pages]
+      summary: List plugin pages
+      operationId: listPluginPages
+      x-astrbot-scope: plugin
+      parameters:
+        - $ref: "#/components/parameters/PluginId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/plugins/{plugin_id}/pages/{page_name}:
+    get:
+      tags: [Plugin Pages]
+      summary: Get plugin page entry HTML
+      operationId: getPluginPage
+      x-astrbot-scope: plugin
+      parameters:
+        - $ref: "#/components/parameters/PluginId"
+        - name: page_name
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Html"
+
+  /api/v1/plugins/{plugin_id}/pages/{page_name}/assets/{asset_path}:
+    get:
+      tags: [Plugin Pages]
+      summary: Get a plugin page asset
+      operationId: getPluginPageAsset
+      x-astrbot-scope: plugin
+      parameters:
+        - $ref: "#/components/parameters/PluginId"
+        - name: page_name
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: asset_path
+          in: path
+          required: true
+          description: URL-encoded relative asset path.
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Plugin asset content
+
+  /api/v1/plugins/page-bridge-sdk.js:
+    get:
+      tags: [Plugin Pages]
+      summary: Get the plugin page bridge SDK
+      operationId: getPluginPageBridgeSdk
+      x-astrbot-scope: plugin
+      responses:
+        "200":
+          description: JavaScript bridge SDK
+          content:
+            application/javascript:
+              schema:
+                type: string
+
+  /api/v1/plugins/extensions/{plugin_path}:
+    get:
+      tags: [Plugin Pages]
+      summary: Proxy a plugin extension GET route
+      operationId: getPluginExtensionRoute
+      x-astrbot-scope: plugin
+      parameters:
+        - name: plugin_path
+          in: path
+          required: true
+          description: Plugin extension path after /api/plug/. It may contain slash-separated segments.
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    post:
+      tags: [Plugin Pages]
+      summary: Proxy a plugin extension POST route
+      operationId: postPluginExtensionRoute
+      x-astrbot-scope: plugin
+      parameters:
+        - name: plugin_path
+          in: path
+          required: true
+          description: Plugin extension path after /api/plug/. It may contain slash-separated segments.
+          schema:
+            type: string
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DynamicConfig"
+          multipart/form-data:
+            schema:
+              type: object
+              additionalProperties: true
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    put:
+      tags: [Plugin Pages]
+      summary: Proxy a plugin extension PUT route
+      operationId: putPluginExtensionRoute
+      x-astrbot-scope: plugin
+      parameters:
+        - name: plugin_path
+          in: path
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DynamicConfig"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    patch:
+      tags: [Plugin Pages]
+      summary: Proxy a plugin extension PATCH route
+      operationId: patchPluginExtensionRoute
+      x-astrbot-scope: plugin
+      parameters:
+        - name: plugin_path
+          in: path
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DynamicConfig"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Plugin Pages]
+      summary: Proxy a plugin extension DELETE route
+      operationId: deletePluginExtensionRoute
+      x-astrbot-scope: plugin
+      parameters:
+        - name: plugin_path
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/commands:
+    get:
+      tags: [Commands]
+      summary: List plugin commands
+      operationId: listCommands
+      x-astrbot-scope: plugin
+      parameters:
+        - name: config_id
+          in: query
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/commands/{command_id}:
+    patch:
+      tags: [Commands]
+      summary: Update command enabled state, alias, or permission group
+      operationId: updateCommand
+      x-astrbot-scope: plugin
+      parameters:
+        - $ref: "#/components/parameters/CommandId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/CommandPatchRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/commands/conflicts:
+    get:
+      tags: [Commands]
+      summary: List command conflicts
+      operationId: listCommandConflicts
+      x-astrbot-scope: plugin
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/tools:
+    get:
+      tags: [Tools]
+      summary: List LLM tools
+      operationId: listTools
+      x-astrbot-scope: tool
+      parameters:
+        - name: origin
+          in: query
+          schema:
+            type: string
+            enum: [builtin, plugin, mcp]
+        - name: enabled
+          in: query
+          schema:
+            type: boolean
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/tools/{tool_id}/enabled:
+    patch:
+      tags: [Tools]
+      summary: Enable or disable an LLM tool
+      operationId: setToolEnabled
+      x-astrbot-scope: tool
+      parameters:
+        - $ref: "#/components/parameters/ToolId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/EnabledPatch"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/tools/{tool_id}/permission:
+    patch:
+      tags: [Tools]
+      summary: Update an LLM tool permission
+      operationId: setToolPermission
+      x-astrbot-scope: tool
+      parameters:
+        - $ref: "#/components/parameters/ToolId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ToolPermissionPatch"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/mcp/servers:
+    get:
+      tags: [MCP]
+      summary: List MCP servers
+      operationId: listMcpServers
+      x-astrbot-scope: mcp
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    post:
+      tags: [MCP]
+      summary: Add an MCP server
+      operationId: createMcpServer
+      x-astrbot-scope: mcp
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/McpServerConfig"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/mcp/servers/by-name:
+    put:
+      tags: [MCP]
+      summary: Update an MCP server by body name
+      operationId: updateMcpServerByName
+      x-astrbot-scope: mcp
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [server_name]
+              properties:
+                server_name:
+                  type: string
+                config:
+                  $ref: "#/components/schemas/DynamicConfig"
+                enabled:
+                  type: boolean
+              additionalProperties: true
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [MCP]
+      summary: Delete an MCP server by query name
+      operationId: deleteMcpServerByName
+      x-astrbot-scope: mcp
+      parameters:
+        - name: server_name
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/mcp/servers/enabled:
+    patch:
+      tags: [MCP]
+      summary: Enable or disable an MCP server by body name
+      operationId: setMcpServerEnabledByName
+      x-astrbot-scope: mcp
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [server_name, enabled]
+              properties:
+                server_name:
+                  type: string
+                enabled:
+                  type: boolean
+              additionalProperties: false
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/mcp/servers/test:
+    post:
+      tags: [MCP]
+      summary: Test an MCP server connection by body name
+      operationId: testMcpServerByName
+      x-astrbot-scope: mcp
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [server_name]
+              properties:
+                server_name:
+                  type: string
+                mcp_server_config:
+                  $ref: "#/components/schemas/DynamicConfig"
+                config:
+                  $ref: "#/components/schemas/DynamicConfig"
+              additionalProperties: true
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/mcp/servers/{server_name}:
+    put:
+      tags: [MCP]
+      summary: Update an MCP server
+      operationId: updateMcpServer
+      x-astrbot-scope: mcp
+      parameters:
+        - $ref: "#/components/parameters/ServerName"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/McpServerConfig"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [MCP]
+      summary: Delete an MCP server
+      operationId: deleteMcpServer
+      x-astrbot-scope: mcp
+      parameters:
+        - $ref: "#/components/parameters/ServerName"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/mcp/servers/{server_name}/enabled:
+    patch:
+      tags: [MCP]
+      summary: Enable or disable an MCP server
+      operationId: setMcpServerEnabled
+      x-astrbot-scope: mcp
+      parameters:
+        - $ref: "#/components/parameters/ServerName"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/EnabledPatch"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/mcp/servers/{server_name}/test:
+    post:
+      tags: [MCP]
+      summary: Test an MCP server connection
+      operationId: testMcpServer
+      x-astrbot-scope: mcp
+      parameters:
+        - $ref: "#/components/parameters/ServerName"
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                mcp_server_config:
+                  type: object
+                  additionalProperties: true
+              additionalProperties: true
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/mcp/providers/modelscope/sync:
+    post:
+      tags: [MCP]
+      summary: Sync MCP servers from ModelScope
+      operationId: syncModelScopeMcpServers
+      x-astrbot-scope: mcp
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ModelScopeSyncRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/skills:
+    get:
+      tags: [Skills]
+      summary: List skills
+      operationId: listSkills
+      x-astrbot-scope: skill
+      parameters:
+        - name: enabled
+          in: query
+          schema:
+            type: boolean
+        - name: source
+          in: query
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    post:
+      tags: [Skills]
+      summary: Upload or import a skill archive
+      operationId: uploadSkill
+      x-astrbot-scope: skill
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema:
+              $ref: "#/components/schemas/SkillUploadRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/skills/batch:
+    post:
+      tags: [Skills]
+      summary: Upload multiple skill archives
+      operationId: uploadSkillsBatch
+      x-astrbot-scope: skill
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              required: [files]
+              properties:
+                files:
+                  type: array
+                  items:
+                    type: string
+                    format: binary
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/skills/by-name:
+    patch:
+      tags: [Skills]
+      summary: Update skill metadata or enabled state by body name
+      operationId: updateSkillByName
+      x-astrbot-scope: skill
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [skill_name]
+              properties:
+                skill_name:
+                  type: string
+                enabled:
+                  type: boolean
+                active:
+                  type: boolean
+              additionalProperties: true
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Skills]
+      summary: Delete a skill by query name
+      operationId: deleteSkillByName
+      x-astrbot-scope: skill
+      parameters:
+        - name: skill_name
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/skills/archive:
+    get:
+      tags: [Skills]
+      summary: Download a skill archive by query name
+      operationId: downloadSkillByName
+      x-astrbot-scope: skill
+      parameters:
+        - name: skill_name
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Skill archive
+          content:
+            application/zip:
+              schema:
+                type: string
+                format: binary
+
+  /api/v1/skills/files:
+    get:
+      tags: [Skills]
+      summary: List files in a skill by query name
+      operationId: listSkillFilesByName
+      x-astrbot-scope: skill
+      parameters:
+        - name: skill_name
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: path
+          in: query
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/skills/file:
+    get:
+      tags: [Skills]
+      summary: Get skill file content by query name and path
+      operationId: getSkillFileByName
+      x-astrbot-scope: skill
+      parameters:
+        - name: skill_name
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: path
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Text"
+    put:
+      tags: [Skills]
+      summary: Update skill file content by body name and path
+      operationId: updateSkillFileByName
+      x-astrbot-scope: skill
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [skill_name, path, content]
+              properties:
+                skill_name:
+                  type: string
+                path:
+                  type: string
+                content:
+                  type: string
+              additionalProperties: false
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/skills/{skill_name}:
+    patch:
+      tags: [Skills]
+      summary: Update skill metadata or enabled state
+      operationId: updateSkill
+      x-astrbot-scope: skill
+      parameters:
+        - $ref: "#/components/parameters/SkillName"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/SkillPatchRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Skills]
+      summary: Delete a skill
+      operationId: deleteSkill
+      x-astrbot-scope: skill
+      parameters:
+        - $ref: "#/components/parameters/SkillName"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/skills/{skill_name}/archive:
+    get:
+      tags: [Skills]
+      summary: Download a skill archive
+      operationId: downloadSkill
+      x-astrbot-scope: skill
+      parameters:
+        - $ref: "#/components/parameters/SkillName"
+      responses:
+        "200":
+          description: Skill archive
+          content:
+            application/zip:
+              schema:
+                type: string
+                format: binary
+
+  /api/v1/skills/{skill_name}/files:
+    get:
+      tags: [Skills]
+      summary: List files in a skill
+      operationId: listSkillFiles
+      x-astrbot-scope: skill
+      parameters:
+        - $ref: "#/components/parameters/SkillName"
+        - name: path
+          in: query
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/skills/{skill_name}/files/{file_path}:
+    get:
+      tags: [Skills]
+      summary: Get skill file content
+      operationId: getSkillFile
+      x-astrbot-scope: skill
+      parameters:
+        - $ref: "#/components/parameters/SkillName"
+        - $ref: "#/components/parameters/FilePath"
+      responses:
+        "200":
+          $ref: "#/components/responses/Text"
+    put:
+      tags: [Skills]
+      summary: Update skill file content
+      operationId: updateSkillFile
+      x-astrbot-scope: skill
+      parameters:
+        - $ref: "#/components/parameters/SkillName"
+        - $ref: "#/components/parameters/FilePath"
+      requestBody:
+        required: true
+        content:
+          text/plain:
+            schema:
+              type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/skills/neo/candidates:
+    get:
+      tags: [Skills]
+      summary: List Shipyard Neo skill candidates
+      operationId: listNeoSkillCandidates
+      x-astrbot-scope: skill
+      parameters:
+        - name: skill_key
+          in: query
+          schema:
+            type: string
+        - name: status
+          in: query
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/skills/neo/releases:
+    get:
+      tags: [Skills]
+      summary: List Shipyard Neo skill releases
+      operationId: listNeoSkillReleases
+      x-astrbot-scope: skill
+      parameters:
+        - name: skill_key
+          in: query
+          schema:
+            type: string
+        - name: stage
+          in: query
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/skills/neo/payload:
+    get:
+      tags: [Skills]
+      summary: Get a Shipyard Neo skill payload
+      operationId: getNeoSkillPayload
+      x-astrbot-scope: skill
+      parameters:
+        - name: payload_ref
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/skills/neo/evaluate:
+    post:
+      tags: [Skills]
+      summary: Evaluate a Shipyard Neo skill candidate
+      operationId: evaluateNeoSkillCandidate
+      x-astrbot-scope: skill
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/NeoCandidateActionRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/skills/neo/promote:
+    post:
+      tags: [Skills]
+      summary: Promote a Shipyard Neo skill candidate
+      operationId: promoteNeoSkillCandidate
+      x-astrbot-scope: skill
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/NeoCandidateActionRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/skills/neo/rollback:
+    post:
+      tags: [Skills]
+      summary: Roll back a Shipyard Neo skill release
+      operationId: rollbackNeoSkillRelease
+      x-astrbot-scope: skill
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/NeoReleaseActionRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/skills/neo/sync:
+    post:
+      tags: [Skills]
+      summary: Sync a Shipyard Neo skill release
+      operationId: syncNeoSkillRelease
+      x-astrbot-scope: skill
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/NeoReleaseActionRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/skills/neo/candidates/delete:
+    post:
+      tags: [Skills]
+      summary: Delete a Shipyard Neo skill candidate
+      operationId: deleteNeoSkillCandidate
+      x-astrbot-scope: skill
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/NeoCandidateActionRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/skills/neo/releases/delete:
+    post:
+      tags: [Skills]
+      summary: Delete a Shipyard Neo skill release
+      operationId: deleteNeoSkillRelease
+      x-astrbot-scope: skill
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/NeoReleaseActionRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/knowledge-bases:
+    get:
+      tags: [Knowledge Base]
+      summary: List knowledge bases
+      operationId: listKnowledgeBases
+      x-astrbot-scope: kb
+      parameters:
+        - $ref: "#/components/parameters/Page"
+        - $ref: "#/components/parameters/PageSize"
+        - name: refresh_stats
+          in: query
+          schema:
+            type: boolean
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    post:
+      tags: [Knowledge Base]
+      summary: Create a knowledge base
+      operationId: createKnowledgeBase
+      x-astrbot-scope: kb
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/KnowledgeBaseRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/knowledge-bases/{kb_id}:
+    get:
+      tags: [Knowledge Base]
+      summary: Get a knowledge base
+      operationId: getKnowledgeBase
+      x-astrbot-scope: kb
+      parameters:
+        - $ref: "#/components/parameters/KbId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    put:
+      tags: [Knowledge Base]
+      summary: Update a knowledge base
+      operationId: updateKnowledgeBase
+      x-astrbot-scope: kb
+      parameters:
+        - $ref: "#/components/parameters/KbId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/KnowledgeBaseRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Knowledge Base]
+      summary: Delete a knowledge base
+      operationId: deleteKnowledgeBase
+      x-astrbot-scope: kb
+      parameters:
+        - $ref: "#/components/parameters/KbId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/knowledge-bases/{kb_id}/stats:
+    get:
+      tags: [Knowledge Base]
+      summary: Get knowledge base stats
+      operationId: getKnowledgeBaseStats
+      x-astrbot-scope: kb
+      parameters:
+        - $ref: "#/components/parameters/KbId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/knowledge-bases/{kb_id}/documents:
+    get:
+      tags: [Knowledge Base]
+      summary: List knowledge base documents
+      operationId: listKnowledgeDocuments
+      x-astrbot-scope: kb
+      parameters:
+        - $ref: "#/components/parameters/KbId"
+        - $ref: "#/components/parameters/Page"
+        - $ref: "#/components/parameters/PageSize"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    post:
+      tags: [Knowledge Base]
+      summary: Upload a document to a knowledge base
+      operationId: uploadKnowledgeDocument
+      x-astrbot-scope: kb
+      parameters:
+        - $ref: "#/components/parameters/KbId"
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema:
+              $ref: "#/components/schemas/KnowledgeDocumentUploadRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/knowledge-bases/{kb_id}/documents/import:
+    post:
+      tags: [Knowledge Base]
+      summary: Import documents already available on the server
+      operationId: importKnowledgeDocuments
+      x-astrbot-scope: kb
+      parameters:
+        - $ref: "#/components/parameters/KbId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/KnowledgeDocumentImportRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/knowledge-bases/{kb_id}/documents/import-url:
+    post:
+      tags: [Knowledge Base]
+      summary: Import a document from URL
+      operationId: importKnowledgeDocumentFromUrl
+      x-astrbot-scope: kb
+      parameters:
+        - $ref: "#/components/parameters/KbId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/KnowledgeDocumentUrlImportRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/knowledge-bases/{kb_id}/documents/{document_id}:
+    get:
+      tags: [Knowledge Base]
+      summary: Get a knowledge base document
+      operationId: getKnowledgeDocument
+      x-astrbot-scope: kb
+      parameters:
+        - $ref: "#/components/parameters/KbId"
+        - $ref: "#/components/parameters/DocumentId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Knowledge Base]
+      summary: Delete a knowledge base document
+      operationId: deleteKnowledgeDocument
+      x-astrbot-scope: kb
+      parameters:
+        - $ref: "#/components/parameters/KbId"
+        - $ref: "#/components/parameters/DocumentId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/knowledge-bases/{kb_id}/chunks:
+    get:
+      tags: [Knowledge Base]
+      summary: List document chunks
+      operationId: listKnowledgeChunks
+      x-astrbot-scope: kb
+      parameters:
+        - $ref: "#/components/parameters/KbId"
+        - name: document_id
+          in: query
+          schema:
+            type: string
+        - $ref: "#/components/parameters/Page"
+        - $ref: "#/components/parameters/PageSize"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/knowledge-bases/{kb_id}/chunks/{chunk_id}:
+    delete:
+      tags: [Knowledge Base]
+      summary: Delete a document chunk
+      operationId: deleteKnowledgeChunk
+      x-astrbot-scope: kb
+      parameters:
+        - $ref: "#/components/parameters/KbId"
+        - $ref: "#/components/parameters/ChunkId"
+        - name: document_id
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/knowledge-bases/{kb_id}/retrieve:
+    post:
+      tags: [Knowledge Base]
+      summary: Retrieve knowledge base chunks
+      operationId: retrieveKnowledgeBase
+      x-astrbot-scope: kb
+      parameters:
+        - $ref: "#/components/parameters/KbId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/KnowledgeRetrieveRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/knowledge-bases/tasks/{task_id}:
+    get:
+      tags: [Knowledge Base]
+      summary: Get knowledge base import task progress
+      operationId: getKnowledgeTask
+      x-astrbot-scope: kb
+      parameters:
+        - $ref: "#/components/parameters/TaskId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/personas/tree:
+    get:
+      tags: [Personas]
+      summary: Get persona folder tree
+      operationId: getPersonaTree
+      x-astrbot-scope: persona
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/personas:
+    get:
+      tags: [Personas]
+      summary: List personas
+      operationId: listPersonas
+      x-astrbot-scope: persona
+      parameters:
+        - name: folder_id
+          in: query
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    post:
+      tags: [Personas]
+      summary: Create a persona
+      operationId: createPersona
+      x-astrbot-scope: persona
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PersonaRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/personas/by-id:
+    get:
+      tags: [Personas]
+      summary: Get a persona by query ID
+      operationId: getPersonaById
+      x-astrbot-scope: persona
+      parameters:
+        - name: persona_id
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    put:
+      tags: [Personas]
+      summary: Update a persona by body ID
+      operationId: updatePersonaById
+      x-astrbot-scope: persona
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [persona_id]
+              properties:
+                persona_id:
+                  type: string
+              additionalProperties: true
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Personas]
+      summary: Delete a persona by query ID
+      operationId: deletePersonaById
+      x-astrbot-scope: persona
+      parameters:
+        - name: persona_id
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/personas/{persona_id}:
+    get:
+      tags: [Personas]
+      summary: Get a persona
+      operationId: getPersona
+      x-astrbot-scope: persona
+      parameters:
+        - $ref: "#/components/parameters/PersonaId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    put:
+      tags: [Personas]
+      summary: Update a persona
+      operationId: updatePersona
+      x-astrbot-scope: persona
+      parameters:
+        - $ref: "#/components/parameters/PersonaId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PersonaRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Personas]
+      summary: Delete a persona
+      operationId: deletePersona
+      x-astrbot-scope: persona
+      parameters:
+        - $ref: "#/components/parameters/PersonaId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/persona-folders:
+    get:
+      tags: [Personas]
+      summary: List persona folders
+      operationId: listPersonaFolders
+      x-astrbot-scope: persona
+      parameters:
+        - name: parent_id
+          in: query
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    post:
+      tags: [Personas]
+      summary: Create a persona folder
+      operationId: createPersonaFolder
+      x-astrbot-scope: persona
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PersonaFolderRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/persona-folders/{folder_id}:
+    put:
+      tags: [Personas]
+      summary: Update a persona folder
+      operationId: updatePersonaFolder
+      x-astrbot-scope: persona
+      parameters:
+        - $ref: "#/components/parameters/FolderId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PersonaFolderRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Personas]
+      summary: Delete a persona folder
+      operationId: deletePersonaFolder
+      x-astrbot-scope: persona
+      parameters:
+        - $ref: "#/components/parameters/FolderId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/personas/move:
+    post:
+      tags: [Personas]
+      summary: Move a persona or folder
+      operationId: movePersonaItem
+      x-astrbot-scope: persona
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PersonaMoveRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/personas/reorder:
+    post:
+      tags: [Personas]
+      summary: Reorder personas or folders
+      operationId: reorderPersonaItems
+      x-astrbot-scope: persona
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ReorderRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/sessions:
+    get:
+      tags: [Sessions]
+      summary: List active UMOs and session status
+      operationId: listSessions
+      x-astrbot-scope: data
+      parameters:
+        - $ref: "#/components/parameters/Page"
+        - $ref: "#/components/parameters/PageSize"
+        - name: search
+          in: query
+          schema:
+            type: string
+        - name: platform
+          in: query
+          schema:
+            type: string
+        - name: message_type
+          in: query
+          schema:
+            type: string
+            enum: [all, group, private]
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/sessions/active-umos:
+    get:
+      tags: [Sessions]
+      summary: List active and known UMOs
+      operationId: listActiveUmos
+      x-astrbot-scope: data
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/sessions/rules:
+    get:
+      tags: [Sessions]
+      summary: List session rules
+      operationId: listSessionRules
+      x-astrbot-scope: data
+      parameters:
+        - $ref: "#/components/parameters/Page"
+        - $ref: "#/components/parameters/PageSize"
+        - name: search
+          in: query
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    post:
+      tags: [Sessions]
+      summary: Update or create a session rule
+      operationId: upsertSessionRule
+      x-astrbot-scope: data
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/SessionRuleRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/sessions/rules/delete:
+    post:
+      tags: [Sessions]
+      summary: Delete one or more session rules
+      operationId: deleteSessionRules
+      x-astrbot-scope: data
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/UmoListRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/sessions/provider:
+    patch:
+      tags: [Sessions]
+      summary: Batch update session provider selection
+      operationId: batchUpdateSessionProvider
+      x-astrbot-scope: data
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/BatchSessionProviderRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/sessions/service:
+    patch:
+      tags: [Sessions]
+      summary: Batch update session service settings
+      operationId: batchUpdateSessionService
+      x-astrbot-scope: data
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/BatchSessionServiceRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/session-groups:
+    get:
+      tags: [Sessions]
+      summary: List session groups
+      operationId: listSessionGroups
+      x-astrbot-scope: data
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    post:
+      tags: [Sessions]
+      summary: Create a session group
+      operationId: createSessionGroup
+      x-astrbot-scope: data
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/SessionGroupRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/session-groups/{group_id}:
+    put:
+      tags: [Sessions]
+      summary: Update a session group
+      operationId: updateSessionGroup
+      x-astrbot-scope: data
+      parameters:
+        - $ref: "#/components/parameters/GroupId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/SessionGroupRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Sessions]
+      summary: Delete a session group
+      operationId: deleteSessionGroup
+      x-astrbot-scope: data
+      parameters:
+        - $ref: "#/components/parameters/GroupId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/conversations:
+    get:
+      tags: [Conversations]
+      summary: List conversation history data
+      operationId: listConversations
+      x-astrbot-scope: data
+      parameters:
+        - $ref: "#/components/parameters/Page"
+        - $ref: "#/components/parameters/PageSize"
+        - name: platform_id
+          in: query
+          schema:
+            type: string
+        - name: user_id
+          in: query
+          schema:
+            type: string
+        - name: search
+          in: query
+          schema:
+            type: string
+        - name: platforms
+          in: query
+          schema:
+            type: string
+          description: Comma-separated platform IDs.
+        - name: message_types
+          in: query
+          schema:
+            type: string
+          description: Comma-separated message types.
+        - name: exclude_ids
+          in: query
+          schema:
+            type: string
+          description: Comma-separated user IDs to exclude.
+        - name: exclude_platforms
+          in: query
+          schema:
+            type: string
+          description: Comma-separated platforms to exclude.
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/conversations/batch-delete:
+    post:
+      tags: [Conversations]
+      summary: Delete multiple conversations
+      operationId: batchDeleteConversations
+      x-astrbot-scope: data
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ConversationBatchDeleteRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/conversations/{conversation_id}:
+    get:
+      tags: [Conversations]
+      summary: Get conversation details and messages
+      operationId: getConversation
+      x-astrbot-scope: data
+      parameters:
+        - $ref: "#/components/parameters/ConversationId"
+        - name: user_id
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    patch:
+      tags: [Conversations]
+      summary: Update conversation metadata
+      operationId: updateConversation
+      x-astrbot-scope: data
+      parameters:
+        - $ref: "#/components/parameters/ConversationId"
+        - name: user_id
+          in: query
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ConversationPatchRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Conversations]
+      summary: Delete a conversation
+      operationId: deleteConversation
+      x-astrbot-scope: data
+      parameters:
+        - $ref: "#/components/parameters/ConversationId"
+        - name: user_id
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/conversations/{conversation_id}/messages:
+    put:
+      tags: [Conversations]
+      summary: Replace conversation message history
+      operationId: replaceConversationMessages
+      x-astrbot-scope: data
+      parameters:
+        - $ref: "#/components/parameters/ConversationId"
+        - name: user_id
+          in: query
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ConversationMessagesReplaceRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/conversations/export:
+    post:
+      tags: [Conversations]
+      summary: Export conversations
+      operationId: exportConversations
+      x-astrbot-scope: data
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ConversationExportRequest"
+      responses:
+        "200":
+          description: Exported conversation data
+
+  /api/v1/stats:
+    get:
+      tags: [Stats]
+      summary: Get runtime statistics
+      operationId: getStats
+      x-astrbot-scope: system
+      parameters:
+        - name: offset_sec
+          in: query
+          schema:
+            type: integer
+            default: 86400
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/stats/provider-tokens:
+    get:
+      tags: [Stats]
+      summary: Get provider token usage statistics
+      operationId: getProviderTokenStats
+      x-astrbot-scope: system
+      parameters:
+        - name: days
+          in: query
+          schema:
+            type: integer
+            minimum: 1
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/stats/version:
+    get:
+      tags: [Stats]
+      summary: Get AstrBot version
+      operationId: getVersion
+      x-astrbot-scope: system
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/stats/first-notice:
+    get:
+      tags: [Stats]
+      summary: Get first-run dashboard notice content
+      operationId: getFirstNotice
+      x-astrbot-scope: system
+      parameters:
+        - name: locale
+          in: query
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/stats/ghproxy/test:
+    post:
+      tags: [Stats]
+      summary: Test a GitHub proxy endpoint
+      operationId: testGhproxyConnection
+      x-astrbot-scope: system
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/GhproxyTestRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/changelogs:
+    get:
+      tags: [Stats]
+      summary: List available changelog versions
+      operationId: listChangelogVersions
+      x-astrbot-scope: system
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/changelogs/{version}:
+    get:
+      tags: [Stats]
+      summary: Get changelog content for a version
+      operationId: getChangelog
+      x-astrbot-scope: system
+      parameters:
+        - name: version
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+        "404":
+          $ref: "#/components/responses/Error"
+
+  /api/v1/stats/start-time:
+    get:
+      tags: [Stats]
+      summary: Get runtime start time
+      operationId: getStartTime
+      security: []
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/stats/storage:
+    get:
+      tags: [Stats]
+      summary: Get storage status
+      operationId: getStorageStatus
+      x-astrbot-scope: system
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/stats/storage/cleanup:
+    post:
+      tags: [Stats]
+      summary: Clean storage
+      operationId: cleanupStorage
+      x-astrbot-scope: system
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DynamicConfig"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/system/restart:
+    post:
+      tags: [Stats]
+      summary: Restart AstrBot core
+      operationId: restartCore
+      x-astrbot-scope: system
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/backups:
+    get:
+      tags: [Backups]
+      summary: List backups
+      operationId: listBackups
+      x-astrbot-scope: system
+      parameters:
+        - $ref: "#/components/parameters/Page"
+        - $ref: "#/components/parameters/PageSize"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    post:
+      tags: [Backups]
+      summary: Export a backup
+      operationId: createBackup
+      x-astrbot-scope: system
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/BackupExportRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/backups/upload:
+    post:
+      tags: [Backups]
+      summary: Upload a backup file
+      operationId: uploadBackup
+      x-astrbot-scope: system
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema:
+              $ref: "#/components/schemas/BackupUploadRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/backups/upload/init:
+    post:
+      tags: [Backups]
+      summary: Initialize chunked backup upload
+      operationId: initBackupUpload
+      x-astrbot-scope: system
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/BackupUploadInitRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/backups/upload/chunk:
+    post:
+      tags: [Backups]
+      summary: Upload a backup chunk
+      operationId: uploadBackupChunk
+      x-astrbot-scope: system
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema:
+              $ref: "#/components/schemas/BackupChunkUploadRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/backups/upload/complete:
+    post:
+      tags: [Backups]
+      summary: Complete chunked backup upload
+      operationId: completeBackupUpload
+      x-astrbot-scope: system
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/BackupUploadSessionRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/backups/upload/abort:
+    post:
+      tags: [Backups]
+      summary: Abort chunked backup upload
+      operationId: abortBackupUpload
+      x-astrbot-scope: system
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/BackupUploadSessionRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/backups/tasks/{task_id}:
+    get:
+      tags: [Backups]
+      summary: Get backup task progress
+      operationId: getBackupProgress
+      x-astrbot-scope: system
+      parameters:
+        - name: task_id
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/backups/{filename}:
+    get:
+      tags: [Backups]
+      summary: Download a backup
+      operationId: downloadBackup
+      x-astrbot-scope: system
+      parameters:
+        - $ref: "#/components/parameters/Filename"
+      responses:
+        "200":
+          description: Backup archive
+    patch:
+      tags: [Backups]
+      summary: Rename a backup
+      operationId: renameBackup
+      x-astrbot-scope: system
+      parameters:
+        - $ref: "#/components/parameters/Filename"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/BackupRenameRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Backups]
+      summary: Delete a backup
+      operationId: deleteBackup
+      x-astrbot-scope: system
+      parameters:
+        - $ref: "#/components/parameters/Filename"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/backups/{filename}/check:
+    post:
+      tags: [Backups]
+      summary: Check a backup before import
+      operationId: checkBackup
+      x-astrbot-scope: system
+      parameters:
+        - $ref: "#/components/parameters/Filename"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/backups/{filename}/import:
+    post:
+      tags: [Backups]
+      summary: Import a backup
+      operationId: importBackup
+      x-astrbot-scope: system
+      parameters:
+        - $ref: "#/components/parameters/Filename"
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/BackupImportRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/updates/check:
+    get:
+      tags: [Updates]
+      summary: Check for updates
+      operationId: checkUpdate
+      x-astrbot-scope: system
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/updates/releases:
+    get:
+      tags: [Updates]
+      summary: List releases
+      operationId: listReleases
+      x-astrbot-scope: system
+      parameters:
+        - name: type
+          in: query
+          schema:
+            type: string
+            enum: [core, dashboard]
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/updates/core:
+    post:
+      tags: [Updates]
+      summary: Update AstrBot core
+      operationId: updateCore
+      x-astrbot-scope: system
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/UpdateRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/updates/dashboard:
+    post:
+      tags: [Updates]
+      summary: Update dashboard assets
+      operationId: updateDashboard
+      x-astrbot-scope: system
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/UpdateRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/updates/progress/{task_id}:
+    get:
+      tags: [Updates]
+      summary: Get update progress
+      operationId: getUpdateProgress
+      x-astrbot-scope: system
+      parameters:
+        - $ref: "#/components/parameters/TaskId"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/pip/install:
+    post:
+      tags: [Updates]
+      summary: Install a Python package
+      operationId: installPipPackage
+      x-astrbot-scope: system
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PipInstallRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/migrations:
+    post:
+      tags: [Updates]
+      summary: Run pending migrations
+      operationId: runMigrations
+      x-astrbot-scope: system
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/MigrationRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/cron/jobs:
+    get:
+      tags: [Cron]
+      summary: List cron jobs
+      operationId: listCronJobs
+      x-astrbot-scope: system
+      parameters:
+        - name: type
+          in: query
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    post:
+      tags: [Cron]
+      summary: Create a cron job
+      operationId: createCronJob
+      x-astrbot-scope: system
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/CronJobRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/cron/jobs/{job_id}:
+    patch:
+      tags: [Cron]
+      summary: Update a cron job
+      operationId: updateCronJob
+      x-astrbot-scope: system
+      parameters:
+        - name: job_id
+          in: path
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/CronJobPatchRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [Cron]
+      summary: Delete a cron job
+      operationId: deleteCronJob
+      x-astrbot-scope: system
+      parameters:
+        - name: job_id
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/cron/jobs/{job_id}/run:
+    post:
+      tags: [Cron]
+      summary: Run a cron job immediately
+      operationId: runCronJob
+      x-astrbot-scope: system
+      parameters:
+        - name: job_id
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/logs/live:
+    get:
+      tags: [Logs]
+      summary: Stream live logs
+      operationId: streamLiveLogs
+      x-astrbot-scope: system
+      responses:
+        "200":
+          description: Server-sent log stream
+          content:
+            text/event-stream:
+              schema:
+                type: string
+
+  /api/v1/logs/history:
+    get:
+      tags: [Logs]
+      summary: Get log history
+      operationId: getLogHistory
+      x-astrbot-scope: system
+      responses:
+        "200":
+          $ref: "#/components/responses/Text"
+
+  /api/v1/trace/settings:
+    get:
+      tags: [Logs]
+      summary: Get trace settings
+      operationId: getTraceSettings
+      x-astrbot-scope: system
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    put:
+      tags: [Logs]
+      summary: Update trace settings
+      operationId: updateTraceSettings
+      x-astrbot-scope: system
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/TraceSettingsRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/t2i/templates:
+    get:
+      tags: [T2I]
+      summary: List text-to-image templates
+      operationId: listT2iTemplates
+      x-astrbot-scope: config
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    post:
+      tags: [T2I]
+      summary: Create a text-to-image template
+      operationId: createT2iTemplate
+      x-astrbot-scope: config
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/T2iTemplateRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/t2i/templates/active:
+    get:
+      tags: [T2I]
+      summary: Get active text-to-image template
+      operationId: getActiveT2iTemplate
+      x-astrbot-scope: config
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    put:
+      tags: [T2I]
+      summary: Set active text-to-image template
+      operationId: setActiveT2iTemplate
+      x-astrbot-scope: config
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/NameRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/t2i/templates/default/reset:
+    post:
+      tags: [T2I]
+      summary: Reset the default text-to-image template
+      operationId: resetDefaultT2iTemplate
+      x-astrbot-scope: config
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/t2i/templates/{name}:
+    get:
+      tags: [T2I]
+      summary: Get a text-to-image template
+      operationId: getT2iTemplate
+      x-astrbot-scope: config
+      parameters:
+        - $ref: "#/components/parameters/Name"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    put:
+      tags: [T2I]
+      summary: Update a text-to-image template
+      operationId: updateT2iTemplate
+      x-astrbot-scope: config
+      parameters:
+        - $ref: "#/components/parameters/Name"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/T2iTemplateContentRequest"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    delete:
+      tags: [T2I]
+      summary: Delete a text-to-image template
+      operationId: deleteT2iTemplate
+      x-astrbot-scope: config
+      parameters:
+        - $ref: "#/components/parameters/Name"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/subagents/config:
+    get:
+      tags: [Subagents]
+      summary: Get subagent orchestrator configuration
+      operationId: getSubagentConfig
+      x-astrbot-scope: config
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+    put:
+      tags: [Subagents]
+      summary: Update subagent orchestrator configuration
+      operationId: updateSubagentConfig
+      x-astrbot-scope: config
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DynamicConfig"
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/subagents/available-tools:
+    get:
+      tags: [Subagents]
+      summary: List tools available to subagents
+      operationId: listSubagentAvailableTools
+      x-astrbot-scope: config
+      responses:
+        "200":
+          $ref: "#/components/responses/Ok"
+
+  /api/v1/webhooks/platforms/{webhook_uuid}:
+    get:
+      tags: [Webhooks]
+      summary: Verify a platform webhook
+      operationId: verifyPlatformWebhook
+      security: []
+      parameters:
+        - $ref: "#/components/parameters/WebhookUuid"
+      responses:
+        "200":
+          description: Webhook verification response
+    post:
+      tags: [Webhooks]
+      summary: Receive a platform webhook
+      operationId: receivePlatformWebhook
+      security: []
+      parameters:
+        - $ref: "#/components/parameters/WebhookUuid"
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DynamicConfig"
+          application/octet-stream:
+            schema:
+              type: string
+              format: binary
+      responses:
+        "200":
+          description: Webhook accepted
+
+components:
+  securitySchemes:
+    ApiKeyAuth:
+      type: apiKey
+      in: header
+      name: X-API-Key
+    BearerAuth:
+      type: http
+      scheme: bearer
+      bearerFormat: JWT
+
+  responses:
+    Ok:
+      description: Standard AstrBot success response
+      content:
+        application/json:
+          schema:
+            $ref: "#/components/schemas/SuccessEnvelope"
+    Error:
+      description: Standard AstrBot error response
+      content:
+        application/json:
+          schema:
+            $ref: "#/components/schemas/ErrorEnvelope"
+    Text:
+      description: Text response
+      content:
+        text/plain:
+          schema:
+            type: string
+        application/json:
+          schema:
+            $ref: "#/components/schemas/SuccessEnvelope"
+    Html:
+      description: HTML response
+      content:
+        text/html:
+          schema:
+            type: string
+
+  parameters:
+    AttachmentId:
+      name: attachment_id
+      in: path
+      required: true
+      schema:
+        type: string
+    BotId:
+      name: bot_id
+      in: path
+      required: true
+      schema:
+        type: string
+    ChunkId:
+      name: chunk_id
+      in: path
+      required: true
+      schema:
+        type: string
+    CommandId:
+      name: command_id
+      in: path
+      required: true
+      description: URL-encoded command handler full name.
+      schema:
+        type: string
+    ConfigId:
+      name: config_id
+      in: path
+      required: true
+      schema:
+        type: string
+    ConversationId:
+      name: conversation_id
+      in: path
+      required: true
+      schema:
+        type: string
+    DocumentId:
+      name: document_id
+      in: path
+      required: true
+      schema:
+        type: string
+    FilePath:
+      name: file_path
+      in: path
+      required: true
+      description: URL-encoded relative file path.
+      schema:
+        type: string
+    Filename:
+      name: filename
+      in: path
+      required: true
+      schema:
+        type: string
+    FolderId:
+      name: folder_id
+      in: path
+      required: true
+      schema:
+        type: string
+    GroupId:
+      name: group_id
+      in: path
+      required: true
+      schema:
+        type: string
+    KbId:
+      name: kb_id
+      in: path
+      required: true
+      schema:
+        type: string
+    KeyId:
+      name: key_id
+      in: path
+      required: true
+      schema:
+        type: string
+    Name:
+      name: name
+      in: path
+      required: true
+      schema:
+        type: string
+    Page:
+      name: page
+      in: query
+      schema:
+        type: integer
+        minimum: 1
+        default: 1
+    PageSize:
+      name: page_size
+      in: query
+      schema:
+        type: integer
+        minimum: 1
+        maximum: 200
+        default: 20
+    PersonaId:
+      name: persona_id
+      in: path
+      required: true
+      schema:
+        type: string
+    PluginId:
+      name: plugin_id
+      in: path
+      required: true
+      schema:
+        type: string
+    ProviderId:
+      name: provider_id
+      in: path
+      required: true
+      schema:
+        type: string
+    SessionId:
+      name: session_id
+      in: path
+      required: true
+      schema:
+        type: string
+    ServerName:
+      name: server_name
+      in: path
+      required: true
+      schema:
+        type: string
+    SkillName:
+      name: skill_name
+      in: path
+      required: true
+      schema:
+        type: string
+    SourceId:
+      name: source_id
+      in: path
+      required: true
+      schema:
+        type: string
+    TaskId:
+      name: task_id
+      in: path
+      required: true
+      schema:
+        type: string
+    ToolId:
+      name: tool_id
+      in: path
+      required: true
+      schema:
+        type: string
+    Umo:
+      name: umo
+      in: path
+      required: true
+      description: URL-encoded unified message origin.
+      schema:
+        type: string
+    WebhookUuid:
+      name: webhook_uuid
+      in: path
+      required: true
+      schema:
+        type: string
+
+  schemas:
+    SuccessEnvelope:
+      type: object
+      required: [status, data]
+      properties:
+        status:
+          type: string
+          const: ok
+        message:
+          type: string
+        data: {}
+      additionalProperties: false
+
+    ErrorEnvelope:
+      type: object
+      required: [status, message]
+      properties:
+        status:
+          type: string
+          const: error
+        message:
+          type: string
+        data: {}
+      additionalProperties: false
+
+    DynamicConfig:
+      type: object
+      additionalProperties: true
+
+    JsonSchema:
+      type: object
+      additionalProperties: true
+
+    ProviderCapability:
+      type: string
+      enum:
+        - chat
+        - agent
+        - stt
+        - tts
+        - embedding
+        - rerank
+
+    LoginRequest:
+      type: object
+      required: [username, password]
+      properties:
+        username:
+          type: string
+        password:
+          type: string
+        code:
+          type: string
+          description: TOTP code or recovery code when two-factor authentication is required.
+        trust_device_flag:
+          type: boolean
+      additionalProperties: false
+
+    SetupAuthRequest:
+      type: object
+      required: [username, password, confirm_password]
+      properties:
+        username:
+          type: string
+        password:
+          type: string
+        confirm_password:
+          type: string
+      additionalProperties: false
+
+    UpdateAccountRequest:
+      type: object
+      required: [password]
+      properties:
+        password:
+          type: string
+        new_password:
+          type: string
+        confirm_password:
+          type: string
+        new_username:
+          type: string
+      additionalProperties: false
+
+    TotpSetupRequest:
+      type: object
+      properties:
+        code:
+          type: string
+        secret:
+          type: string
+      additionalProperties: false
+
+    CreateApiKeyRequest:
+      type: object
+      required: [name]
+      properties:
+        name:
+          type: string
+        scopes:
+          type: array
+          items:
+            type: string
+            enum: [bot, provider, persona, im, config, chat, plugin, mcp, skill]
+          example: [bot, provider, persona, im, config, chat, plugin, mcp, skill]
+        expires_at:
+          type: string
+          format: date-time
+        expires_in_days:
+          type: integer
+          minimum: 1
+      additionalProperties: false
+
+    CreateConfigProfileRequest:
+      type: object
+      properties:
+        name:
+          type: string
+        config:
+          $ref: "#/components/schemas/DynamicConfig"
+      additionalProperties: false
+
+    RenameRequest:
+      type: object
+      required: [name]
+      properties:
+        name:
+          type: string
+      additionalProperties: false
+
+    NameRequest:
+      type: object
+      required: [name]
+      properties:
+        name:
+          type: string
+      additionalProperties: false
+
+    ConfigRoutesReplaceRequest:
+      type: object
+      required: [routing]
+      properties:
+        routing:
+          type: object
+          additionalProperties:
+            type: string
+      additionalProperties: false
+
+    ConfigRouteUpsertRequest:
+      type: object
+      required: [config_id]
+      properties:
+        config_id:
+          type: string
+          description: Use "default" to remove a custom route and fall back.
+      additionalProperties: false
+
+    BotConfigRequest:
+      type: object
+      required: [type, config]
+      properties:
+        id:
+          type: string
+        name:
+          type: string
+        type:
+          type: string
+          description: Platform adapter type, such as aiocqhttp, telegram, lark.
+        enabled:
+          type: boolean
+          default: true
+        config:
+          $ref: "#/components/schemas/DynamicConfig"
+      additionalProperties: false
+
+    BotRegistrationRequest:
+      type: object
+      required: [action]
+      properties:
+        action:
+          type: string
+          enum: [start, poll]
+        platform_config:
+          $ref: "#/components/schemas/DynamicConfig"
+        registration_code:
+          type: string
+        device_code:
+          type: string
+        qrcode:
+          type: string
+      additionalProperties: true
+
+    EnabledPatch:
+      type: object
+      required: [enabled]
+      properties:
+        enabled:
+          type: boolean
+      additionalProperties: false
+
+    ToolPermissionPatch:
+      type: object
+      required: [permission]
+      properties:
+        permission:
+          type: string
+          enum: [admin, member]
+      additionalProperties: false
+
+    ProviderSourceConfigRequest:
+      type: object
+      required: [config]
+      properties:
+        id:
+          type: string
+        config:
+          $ref: "#/components/schemas/DynamicConfig"
+      additionalProperties: false
+
+    ProviderConfigRequest:
+      type: object
+      required: [config]
+      properties:
+        id:
+          type: string
+        provider_source_id:
+          type: string
+        capability:
+          $ref: "#/components/schemas/ProviderCapability"
+        enabled:
+          type: boolean
+          default: true
+        config:
+          $ref: "#/components/schemas/DynamicConfig"
+      additionalProperties: false
+
+    ChatRequest:
+      type: object
+      required: [message]
+      properties:
+        username:
+          type: string
+        session_id:
+          type: string
+        conversation_id:
+          type: string
+          description: Deprecated alias for session_id.
+        message:
+          oneOf:
+            - type: string
+            - type: array
+              items:
+                $ref: "#/components/schemas/MessagePart"
+        config_id:
+          type: string
+        config_name:
+          type: string
+        selected_provider:
+          type: string
+        selected_model:
+          type: string
+        enable_streaming:
+          type: boolean
+          default: true
+        _skip_user_history:
+          type: boolean
+          description: Internal WebUI flag for edit/regenerate flows.
+        _llm_checkpoint_id:
+          type: string
+          description: Internal WebUI checkpoint override.
+        _platform_history_id:
+          type: string
+          description: Internal WebUI platform history override.
+        _thread_selected_text:
+          type: string
+          description: Internal WebUI side-thread context.
+      additionalProperties: false
+
+    ChatSessionBatchDeleteRequest:
+      type: object
+      required: [session_ids]
+      properties:
+        session_ids:
+          type: array
+          items:
+            type: string
+      additionalProperties: false
+
+    ChatSessionPatchRequest:
+      type: object
+      properties:
+        display_name:
+          type: string
+      additionalProperties: false
+
+    ChatMessagePatchRequest:
+      type: object
+      required: [content]
+      properties:
+        content:
+          type: object
+          additionalProperties: true
+      additionalProperties: false
+
+    ChatMessageRegenerateRequest:
+      type: object
+      properties:
+        selected_provider:
+          type: string
+        selected_model:
+          type: string
+        enable_streaming:
+          type: boolean
+          default: true
+      additionalProperties: false
+
+    ChatThreadCreateRequest:
+      type: object
+      required: [session_id, parent_message_id, selected_text]
+      properties:
+        session_id:
+          type: string
+        parent_message_id:
+          oneOf:
+            - type: string
+            - type: integer
+        selected_text:
+          type: string
+      additionalProperties: false
+
+    ChatThreadMessageRequest:
+      type: object
+      required: [message]
+      properties:
+        message:
+          oneOf:
+            - type: string
+            - type: array
+              items:
+                $ref: "#/components/schemas/MessagePart"
+        selected_provider:
+          type: string
+        selected_model:
+          type: string
+        enable_streaming:
+          type: boolean
+          default: true
+      additionalProperties: false
+
+    ChatProjectRequest:
+      type: object
+      properties:
+        title:
+          type: string
+        emoji:
+          type: string
+        description:
+          type: string
+      additionalProperties: false
+
+    MessagePart:
+      type: object
+      required: [type]
+      properties:
+        type:
+          type: string
+          enum: [text, plain, image, file, audio, record, video, reply]
+        text:
+          type: string
+        attachment_id:
+          type: string
+        url:
+          type: string
+        filename:
+          type: string
+        mime_type:
+          type: string
+      additionalProperties: true
+
+    ImMessageRequest:
+      type: object
+      required: [umo, message]
+      properties:
+        umo:
+          type: string
+        message:
+          oneOf:
+            - type: string
+            - type: array
+              items:
+                $ref: "#/components/schemas/MessagePart"
+      additionalProperties: false
+
+    FileUploadRequest:
+      type: object
+      required: [file]
+      properties:
+        file:
+          type: string
+          format: binary
+
+    PluginUpdateRequest:
+      type: object
+      properties:
+        reinstall:
+          type: boolean
+          default: false
+      additionalProperties: false
+
+    PluginBatchUpdateRequest:
+      type: object
+      properties:
+        plugin_id:
+          type: string
+          description: When set, update this single plugin instead of a batch.
+        plugin_ids:
+          type: array
+          items:
+            type: string
+        reinstall:
+          type: boolean
+          default: false
+        update_all:
+          type: boolean
+          default: false
+      additionalProperties: true
+
+    PluginVersionSupportRequest:
+      type: object
+      properties:
+        astrbot_version:
+          type: string
+      additionalProperties: false
+
+    PluginGithubInstallRequest:
+      type: object
+      required: [repository]
+      properties:
+        repository:
+          type: string
+          description: GitHub URL or owner/repository slug.
+        ref:
+          type: string
+        download_url:
+          type: string
+          description: Optional downloadable ZIP URL to use instead of GitHub archive resolution.
+        proxy:
+          type: string
+        ignore_version_check:
+          type: boolean
+      additionalProperties: false
+
+    PluginUrlInstallRequest:
+      type: object
+      required: [url]
+      properties:
+        url:
+          type: string
+          format: uri
+        download_url:
+          type: string
+          format: uri
+          description: Optional downloadable ZIP URL when url is the plugin source page or repository.
+        proxy:
+          type: string
+        ignore_version_check:
+          type: boolean
+      additionalProperties: false
+
+    PluginUploadInstallRequest:
+      type: object
+      required: [file]
+      properties:
+        file:
+          type: string
+          format: binary
+
+    PluginConfigFileDeleteRequest:
+      type: object
+      required: [path]
+      properties:
+        path:
+          type: string
+      additionalProperties: false
+
+    PluginSourceRequest:
+      type: object
+      required: [url]
+      properties:
+        id:
+          type: string
+        name:
+          type: string
+        url:
+          type: string
+          format: uri
+      additionalProperties: false
+
+    CommandPatchRequest:
+      type: object
+      properties:
+        enabled:
+          type: boolean
+        alias:
+          type: string
+        aliases:
+          type: array
+          items:
+            type: string
+        permission_group:
+          type: string
+      additionalProperties: false
+
+    McpServerConfig:
+      type: object
+      required: [name]
+      properties:
+        name:
+          type: string
+        enabled:
+          type: boolean
+          default: true
+        transport:
+          type: string
+          enum: [stdio, sse, streamable_http]
+        command:
+          type: string
+        args:
+          type: array
+          items:
+            type: string
+        url:
+          type: string
+        headers:
+          type: object
+          additionalProperties:
+            type: string
+        timeout:
+          type: integer
+      additionalProperties: true
+
+    ModelScopeSyncRequest:
+      type: object
+      properties:
+        access_token:
+          type: string
+      additionalProperties: false
+
+    SkillUploadRequest:
+      type: object
+      required: [file]
+      properties:
+        file:
+          type: string
+          format: binary
+        overwrite:
+          type: boolean
+          default: false
+
+    SkillPatchRequest:
+      type: object
+      properties:
+        enabled:
+          type: boolean
+        display_name:
+          type: string
+        description:
+          type: string
+      additionalProperties: false
+
+    NeoCandidateActionRequest:
+      type: object
+      required: [candidate_id]
+      properties:
+        candidate_id:
+          type: string
+      additionalProperties: true
+
+    NeoReleaseActionRequest:
+      type: object
+      required: [release_id]
+      properties:
+        release_id:
+          type: string
+      additionalProperties: true
+
+    KnowledgeBaseRequest:
+      type: object
+      required: [name]
+      properties:
+        name:
+          type: string
+        description:
+          type: string
+        embedding_provider_id:
+          type: string
+        rerank_provider_id:
+          type: string
+        chunking:
+          $ref: "#/components/schemas/DynamicConfig"
+        metadata:
+          $ref: "#/components/schemas/DynamicConfig"
+      additionalProperties: false
+
+    KnowledgeDocumentUploadRequest:
+      type: object
+      required: [file]
+      properties:
+        file:
+          type: string
+          format: binary
+        parser:
+          type: string
+
+    KnowledgeDocumentImportRequest:
+      type: object
+      required: [paths]
+      properties:
+        paths:
+          type: array
+          items:
+            type: string
+        parser:
+          type: string
+      additionalProperties: false
+
+    KnowledgeDocumentUrlImportRequest:
+      type: object
+      required: [url]
+      properties:
+        url:
+          type: string
+          format: uri
+        parser:
+          type: string
+      additionalProperties: false
+
+    KnowledgeRetrieveRequest:
+      type: object
+      required: [query]
+      properties:
+        query:
+          type: string
+        top_k:
+          type: integer
+          default: 5
+        score_threshold:
+          type: number
+      additionalProperties: false
+
+    PersonaRequest:
+      type: object
+      required: [persona_id, system_prompt]
+      properties:
+        persona_id:
+          type: string
+        system_prompt:
+          type: string
+        begin_dialogs:
+          type: array
+          items:
+            type: string
+        folder_id:
+          type: string
+        tools:
+          type: array
+          items:
+            type: string
+        skills:
+          type: array
+          items:
+            type: string
+        custom_error_message:
+          type: string
+      additionalProperties: true
+
+    PersonaFolderRequest:
+      type: object
+      properties:
+        name:
+          type: string
+        parent_id:
+          type: string
+        description:
+          type: string
+      additionalProperties: true
+
+    PersonaMoveRequest:
+      type: object
+      required: [persona_id]
+      properties:
+        persona_id:
+          type: string
+        folder_id:
+          type: string
+      additionalProperties: true
+
+    ReorderRequest:
+      type: object
+      required: [items]
+      properties:
+        items:
+          type: array
+          items:
+            type: object
+            required: [id, type, sort_order]
+            properties:
+              id:
+                type: string
+              type:
+                type: string
+                enum: [persona, folder]
+              sort_order:
+                type: integer
+      additionalProperties: false
+
+    SessionRuleRequest:
+      type: object
+      required: [umo, rule_key]
+      properties:
+        umo:
+          type: string
+        rule_key:
+          type: string
+        rule_value:
+          $ref: "#/components/schemas/DynamicConfig"
+      additionalProperties: true
+
+    UmoListRequest:
+      type: object
+      properties:
+        umo:
+          type: string
+        umos:
+          type: array
+          items:
+            type: string
+        scope:
+          type: string
+          enum: [all, group, private, custom_group]
+        group_id:
+          type: string
+        rule_key:
+          type: string
+      additionalProperties: false
+
+    BatchSessionProviderRequest:
+      allOf:
+        - $ref: "#/components/schemas/UmoListRequest"
+        - type: object
+          required: [provider_id, provider_type]
+          properties:
+            provider_id:
+              type: string
+            provider_type:
+              type: string
+              enum: [chat_completion, speech_to_text, text_to_speech]
+
+    BatchSessionServiceRequest:
+      allOf:
+        - $ref: "#/components/schemas/UmoListRequest"
+        - type: object
+          properties:
+            session_enabled:
+              type: boolean
+            llm_enabled:
+              type: boolean
+            tts_enabled:
+              type: boolean
+
+    SessionGroupRequest:
+      type: object
+      properties:
+        name:
+          type: string
+        umos:
+          type: array
+          items:
+            type: string
+        add_umos:
+          type: array
+          items:
+            type: string
+        remove_umos:
+          type: array
+          items:
+            type: string
+      additionalProperties: false
+
+    ConversationPatchRequest:
+      type: object
+      properties:
+        title:
+          type: string
+        persona_id:
+          type: string
+      additionalProperties: false
+
+    ConversationMessagesReplaceRequest:
+      type: object
+      properties:
+        user_id:
+          type: string
+        messages:
+          type: array
+          items:
+            type: object
+            additionalProperties: true
+        history:
+          type: array
+          items:
+            type: object
+            additionalProperties: true
+      additionalProperties: false
+
+    ConversationRef:
+      type: object
+      required: [user_id, cid]
+      properties:
+        user_id:
+          type: string
+        cid:
+          type: string
+      additionalProperties: false
+
+    ConversationBatchDeleteRequest:
+      type: object
+      required: [conversations]
+      properties:
+        conversations:
+          type: array
+          items:
+            $ref: "#/components/schemas/ConversationRef"
+      additionalProperties: false
+
+    ConversationExportRequest:
+      type: object
+      properties:
+        conversations:
+          type: array
+          items:
+            $ref: "#/components/schemas/ConversationRef"
+        conversation_ids:
+          type: array
+          items:
+            type: string
+        format:
+          type: string
+          enum: [json, markdown]
+          default: json
+      additionalProperties: false
+
+    CronJobRequest:
+      type: object
+      properties:
+        name:
+          type: string
+        cron_expression:
+          type: string
+        timezone:
+          type: string
+        session:
+          type: string
+        note:
+          type: string
+        description:
+          type: string
+        persona_id:
+          type: string
+        provider_id:
+          type: string
+        enabled:
+          type: boolean
+          default: true
+        run_once:
+          type: boolean
+          default: false
+        run_at:
+          type: string
+          format: date-time
+        payload:
+          type: object
+          additionalProperties: true
+      additionalProperties: true
+
+    CronJobPatchRequest:
+      allOf:
+        - $ref: "#/components/schemas/CronJobRequest"
+
+    BackupExportRequest:
+      type: object
+      properties:
+        include:
+          type: array
+          items:
+            type: string
+        exclude:
+          type: array
+          items:
+            type: string
+      additionalProperties: false
+
+    BackupUploadRequest:
+      type: object
+      required: [file]
+      properties:
+        file:
+          type: string
+          format: binary
+
+    BackupUploadInitRequest:
+      type: object
+      required: [filename, total_size]
+      properties:
+        filename:
+          type: string
+        total_size:
+          type: integer
+          minimum: 1
+      additionalProperties: false
+
+    BackupUploadSessionRequest:
+      type: object
+      required: [upload_id]
+      properties:
+        upload_id:
+          type: string
+      additionalProperties: false
+
+    BackupChunkUploadRequest:
+      type: object
+      required: [upload_id, chunk_index, chunk]
+      properties:
+        upload_id:
+          type: string
+        chunk_index:
+          type: integer
+          minimum: 0
+        chunk:
+          type: string
+          format: binary
+
+    BackupRenameRequest:
+      type: object
+      required: [new_name]
+      properties:
+        new_name:
+          type: string
+      additionalProperties: false
+
+    BackupImportRequest:
+      type: object
+      properties:
+        confirmed:
+          type: boolean
+          default: true
+      additionalProperties: false
+
+    UpdateRequest:
+      type: object
+      properties:
+        version:
+          type: string
+        proxy:
+          type: string
+        reboot:
+          type: boolean
+        progress_id:
+          type: string
+      additionalProperties: false
+
+    PipInstallRequest:
+      type: object
+      required: [package]
+      properties:
+        package:
+          type: string
+        mirror:
+          type: string
+      additionalProperties: false
+
+    MigrationRequest:
+      type: object
+      properties:
+        platform_id_map:
+          type: object
+          additionalProperties: true
+      additionalProperties: true
+
+    GhproxyTestRequest:
+      type: object
+      required: [proxy_url]
+      properties:
+        proxy_url:
+          type: string
+      additionalProperties: false
+
+    TraceSettingsRequest:
+      type: object
+      properties:
+        enabled:
+          type: boolean
+        level:
+          type: string
+      additionalProperties: true
+
+    T2iTemplateRequest:
+      type: object
+      required: [name, content]
+      properties:
+        name:
+          type: string
+        content:
+          type: string
+      additionalProperties: true
+
+    T2iTemplateContentRequest:
+      type: object
+      required: [content]
+      properties:
+        content:
+          type: string
+      additionalProperties: true
diff --git a/pyproject.toml b/pyproject.toml
index 6326aeaa2..0bd3a6bf7 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -24,6 +24,7 @@ dependencies = [
   "dingtalk-stream>=0.22.1",
   "docstring-parser>=0.16",
   "faiss-cpu>=1.12.0",
+  "fastapi>=0.124.0",
   "filelock>=3.18.0",
   "google-genai>=1.56.0",
   "httpx[socks]>=0.28.1",
@@ -39,9 +40,9 @@ dependencies = [
   "pydub>=0.25.1",
   "pyjwt>=2.10.1",
   "qrcode>=8.2",
+  "quart>=0.20.0",
   "python-telegram-bot>=22.6",
   "qq-botpy>=1.2.1",
-  "quart>=0.20.0",
   "silk-python>=0.2.6",
   "slack-sdk>=3.35.0",
   "sqlalchemy[asyncio]>=2.0.41",
diff --git a/pyrightconfig.json b/pyrightconfig.json
new file mode 100644
index 000000000..21e19f5f1
--- /dev/null
+++ b/pyrightconfig.json
@@ -0,0 +1,6 @@
+{
+  "pythonVersion": "3.12",
+  "venvPath": ".",
+  "venv": ".venv",
+  "reportMissingModuleSource": "none"
+}
diff --git a/requirements.txt b/requirements.txt
index 36ed53fb5..1cf2fdc19 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -13,6 +13,7 @@ deprecated>=1.2.18
 dingtalk-stream>=0.22.1
 docstring-parser>=0.16
 faiss-cpu>=1.12.0
+fastapi>=0.124.0
 filelock>=3.18.0
 google-genai>=1.56.0
 httpx[socks]>=0.28.1
@@ -30,7 +31,6 @@ pyjwt>=2.10.1
 python-telegram-bot>=22.6
 qq-botpy>=1.2.1
 python-socks>=2.8.0
-quart>=0.20.0
 silk-python>=0.2.6
 slack-sdk>=3.35.0
 sqlalchemy[asyncio]>=2.0.41
@@ -53,5 +53,6 @@ shipyard-python-sdk>=0.2.4
 shipyard-neo-sdk>=0.2.0
 packaging>=24.2
 qrcode>=8.2
+quart>=0.20.0
 python-ripgrep==0.0.8
 pyotp>=2.9.0
diff --git a/tests/agent/test_token_counter.py b/tests/agent/test_token_counter.py
index c68b056e6..49d44a93d 100644
--- a/tests/agent/test_token_counter.py
+++ b/tests/agent/test_token_counter.py
@@ -13,7 +13,6 @@ from astrbot.core.agent.message import (
     ThinkPart,
 )
 
-
 counter = EstimateTokenCounter()
 
 
@@ -39,16 +38,26 @@ class TestTextCounting:
 
 class TestMultimodalCounting:
     def test_image_counted(self):
-        msg = _msg("user", [
-            ImageURLPart(image_url=ImageURLPart.ImageURL(url="data:image/png;base64,abc")),
-        ])
+        msg = _msg(
+            "user",
+            [
+                ImageURLPart(
+                    image_url=ImageURLPart.ImageURL(url="data:image/png;base64,abc")
+                ),
+            ],
+        )
         tokens = counter.count_tokens([msg])
         assert tokens == IMAGE_TOKEN_ESTIMATE
 
     def test_audio_counted(self):
-        msg = _msg("user", [
-            AudioURLPart(audio_url=AudioURLPart.AudioURL(url="https://x.com/a.mp3")),
-        ])
+        msg = _msg(
+            "user",
+            [
+                AudioURLPart(
+                    audio_url=AudioURLPart.AudioURL(url="https://x.com/a.mp3")
+                ),
+            ],
+        )
         tokens = counter.count_tokens([msg])
         assert tokens == AUDIO_TOKEN_ESTIMATE
 
@@ -60,21 +69,35 @@ class TestMultimodalCounting:
     def test_mixed_content(self):
         """文本 + 图片的多模态消息，token 数 = 文本 token + 图片估算。"""
         text_only = _msg("user", [TextPart(text="describe this image")])
-        mixed = _msg("user", [
-            TextPart(text="describe this image"),
-            ImageURLPart(image_url=ImageURLPart.ImageURL(url="data:image/png;base64,x")),
-        ])
+        mixed = _msg(
+            "user",
+            [
+                TextPart(text="describe this image"),
+                ImageURLPart(
+                    image_url=ImageURLPart.ImageURL(url="data:image/png;base64,x")
+                ),
+            ],
+        )
         text_tokens = counter.count_tokens([text_only])
         mixed_tokens = counter.count_tokens([mixed])
         assert mixed_tokens == text_tokens + IMAGE_TOKEN_ESTIMATE
 
     def test_multiple_images(self):
         """多张图片应该各自计算。"""
-        msg = _msg("user", [
-            ImageURLPart(image_url=ImageURLPart.ImageURL(url="data:image/png;base64,a")),
-            ImageURLPart(image_url=ImageURLPart.ImageURL(url="data:image/png;base64,b")),
-            ImageURLPart(image_url=ImageURLPart.ImageURL(url="data:image/png;base64,c")),
-        ])
+        msg = _msg(
+            "user",
+            [
+                ImageURLPart(
+                    image_url=ImageURLPart.ImageURL(url="data:image/png;base64,a")
+                ),
+                ImageURLPart(
+                    image_url=ImageURLPart.ImageURL(url="data:image/png;base64,b")
+                ),
+                ImageURLPart(
+                    image_url=ImageURLPart.ImageURL(url="data:image/png;base64,c")
+                ),
+            ],
+        )
         tokens = counter.count_tokens([msg])
         assert tokens == IMAGE_TOKEN_ESTIMATE * 3
 
@@ -82,10 +105,15 @@ class TestMultimodalCounting:
 class TestTrustedUsage:
     def test_trusted_overrides(self):
         """如果 API 返回了 token 数，直接用它不做估算。"""
-        msg = _msg("user", [
-            TextPart(text="hello"),
-            ImageURLPart(image_url=ImageURLPart.ImageURL(url="data:image/png;base64,x")),
-        ])
+        msg = _msg(
+            "user",
+            [
+                TextPart(text="hello"),
+                ImageURLPart(
+                    image_url=ImageURLPart.ImageURL(url="data:image/png;base64,x")
+                ),
+            ],
+        )
         tokens = counter.count_tokens([msg], trusted_token_usage=42)
         assert tokens == 42
 
@@ -95,7 +123,16 @@ class TestToolCalls:
         msg = Message(
             role="assistant",
             content="calling tool",
-            tool_calls=[{"type": "function", "id": "1", "function": {"name": "get_weather", "arguments": '{"city": "Beijing"}'}}],
+            tool_calls=[
+                {
+                    "type": "function",
+                    "id": "1",
+                    "function": {
+                        "name": "get_weather",
+                        "arguments": '{"city": "Beijing"}',
+                    },
+                }
+            ],
         )
         tokens = counter.count_tokens([msg])
         # 文本 + tool call JSON 都应被计算
diff --git a/tests/conftest.py b/tests/conftest.py
index b9807c1de..91a642149 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -9,14 +9,12 @@ import os
 import sys
 from asyncio import Queue
 from pathlib import Path
-from typing import Any
 from unittest.mock import AsyncMock, MagicMock
 
 import pytest
 import pytest_asyncio
 
 # 使用 tests/fixtures/helpers.py 中的共享工具函数，避免重复定义
-from tests.fixtures.helpers import create_mock_llm_response, create_mock_message_component
 
 # 将项目根目录添加到 sys.path
 PROJECT_ROOT = Path(__file__).parent.parent
diff --git a/tests/test_api_key_open_api.py b/tests/test_api_key_open_api.py
index 8b90e2ff4..82837e1b7 100644
--- a/tests/test_api_key_open_api.py
+++ b/tests/test_api_key_open_api.py
@@ -1,41 +1,27 @@
 import asyncio
 import uuid
-from io import BytesIO
 from unittest.mock import AsyncMock
 
 import pytest
 import pytest_asyncio
-from quart import Quart, g, request
-from werkzeug.datastructures import FileStorage
 
 from astrbot.core import LogBroker
 from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
 from astrbot.core.db.sqlite import SQLiteDatabase
 from astrbot.core.utils.auth_password import (
     hash_dashboard_password,
-    hash_legacy_dashboard_password,
+    hash_md5_dashboard_password,
 )
-from astrbot.dashboard.routes.route import Response
+from astrbot.dashboard.api import open_api as open_api_routes
+from astrbot.dashboard.asgi_runtime import FastAPIAppAdapter
+from astrbot.dashboard.responses import ok
 from astrbot.dashboard.server import AstrBotDashboard
 
 _TEST_DASHBOARD_PASSWORD = "AstrbotTest123"
 
 
-def _get_open_api_route(app: Quart):
-    rule = next(
-        (
-            item
-            for item in app.url_map.iter_rules()
-            if item.rule == "/api/v1/chat" and "POST" in item.methods
-        ),
-        None,
-    )
-    assert rule is not None
-    return app.view_functions[rule.endpoint].__self__
-
-
 async def _create_api_key(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     *,
     scopes: list[str],
@@ -71,7 +57,7 @@ async def core_lifecycle_td(tmp_path_factory):
             hash_dashboard_password(dashboard_password)
         )
         core_lifecycle.astrbot_config["dashboard"]["password"] = (
-            hash_legacy_dashboard_password(dashboard_password)
+            hash_md5_dashboard_password(dashboard_password)
         )
     object.__setattr__(
         core_lifecycle,
@@ -107,7 +93,9 @@ def _resolve_dashboard_password(core_lifecycle_td: AstrBotCoreLifecycle) -> str:
 
 
 @pytest_asyncio.fixture(scope="module")
-async def authenticated_header(app: Quart, core_lifecycle_td: AstrBotCoreLifecycle):
+async def authenticated_header(
+    app: FastAPIAppAdapter, core_lifecycle_td: AstrBotCoreLifecycle
+):
     test_client = app.test_client()
     response = await test_client.post(
         "/api/auth/login",
@@ -122,7 +110,9 @@ async def authenticated_header(app: Quart, core_lifecycle_td: AstrBotCoreLifecyc
 
 
 @pytest.mark.asyncio
-async def test_api_key_scope_and_revoke(app: Quart, authenticated_header: dict):
+async def test_api_key_scope_and_revoke(
+    app: FastAPIAppAdapter, authenticated_header: dict
+):
     test_client = app.test_client()
 
     raw_key, key_id = await _create_api_key(
@@ -177,7 +167,9 @@ async def test_api_key_scope_and_revoke(app: Quart, authenticated_header: dict):
 
 
 @pytest.mark.asyncio
-async def test_open_send_message_with_api_key(app: Quart, authenticated_header: dict):
+async def test_open_send_message_with_api_key(
+    app: FastAPIAppAdapter, authenticated_header: dict
+):
     test_client = app.test_client()
 
     raw_key, _ = await _create_api_key(
@@ -202,7 +194,7 @@ async def test_open_send_message_with_api_key(app: Quart, authenticated_header:
 
 @pytest.mark.asyncio
 async def test_open_chat_send_auto_session_id_and_username(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     core_lifecycle_td: AstrBotCoreLifecycle,
 ):
@@ -214,24 +206,21 @@ async def test_open_chat_send_auto_session_id_and_username(
         scopes=["chat"],
         name_prefix="chat-send-key",
     )
-    open_api_route = _get_open_api_route(app)
 
-    original_chat = open_api_route.chat_route.chat
-
-    async def fake_chat(post_data: dict | None = None):
-        payload = post_data or await request.get_json()
-        return (
-            Response()
-            .ok(
-                data={
-                    "session_id": payload.get("session_id"),
-                    "creator": g.get("username"),
-                }
-            )
-            .__dict__
+    async def fake_chat_response(_chat_service, username: str, post_data: dict):
+        return ok(
+            {
+                "session_id": post_data.get("session_id"),
+                "creator": username,
+            }
         )
 
-    open_api_route.chat_route.chat = fake_chat
+    monkeypatch = pytest.MonkeyPatch()
+    monkeypatch.setattr(
+        open_api_routes,
+        "_build_streaming_chat_response",
+        fake_chat_response,
+    )
     try:
         send_res = await test_client.post(
             "/api/v1/chat",
@@ -243,7 +232,7 @@ async def test_open_chat_send_auto_session_id_and_username(
             headers={"X-API-Key": raw_key},
         )
     finally:
-        open_api_route.chat_route.chat = original_chat
+        monkeypatch.undo()
 
     assert send_res.status_code == 200
     send_data = await send_res.get_json()
@@ -293,7 +282,7 @@ async def test_open_chat_send_auto_session_id_and_username(
 
 @pytest.mark.asyncio
 async def test_open_chat_sessions_pagination(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     core_lifecycle_td: AstrBotCoreLifecycle,
 ):
@@ -358,7 +347,7 @@ async def test_open_chat_sessions_pagination(
 
 @pytest.mark.asyncio
 async def test_open_chat_configs_list(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
 ):
     test_client = app.test_client()
@@ -388,7 +377,7 @@ async def test_open_chat_configs_list(
 
 @pytest.mark.asyncio
 async def test_open_api_auth_validation_and_key_carriers(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
 ):
     test_client = app.test_client()
@@ -432,7 +421,7 @@ async def test_open_api_auth_validation_and_key_carriers(
 
 @pytest.mark.asyncio
 async def test_open_chat_send_conversation_alias_and_blank_username(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     core_lifecycle_td: AstrBotCoreLifecycle,
     monkeypatch: pytest.MonkeyPatch,
@@ -444,16 +433,18 @@ async def test_open_chat_send_conversation_alias_and_blank_username(
         scopes=["chat"],
         name_prefix="chat-conversation-key",
     )
-    open_api_route = _get_open_api_route(app)
 
-    async def fake_chat(post_data: dict | None = None):
-        payload = post_data or await request.get_json()
-        resolved_session_id = payload.get("session_id") or payload.get(
+    async def fake_chat_response(_chat_service, _username: str, post_data: dict):
+        resolved_session_id = post_data.get("session_id") or post_data.get(
             "conversation_id"
         )
-        return Response().ok(data={"session_id": resolved_session_id}).__dict__
+        return ok({"session_id": resolved_session_id})
 
-    monkeypatch.setattr(open_api_route.chat_route, "chat", fake_chat)
+    monkeypatch.setattr(
+        open_api_routes,
+        "_build_streaming_chat_response",
+        fake_chat_response,
+    )
 
     conversation_id = f"open_api_conversation_{uuid.uuid4().hex[:10]}"
     send_res = await test_client.post(
@@ -494,7 +485,7 @@ async def test_open_chat_send_conversation_alias_and_blank_username(
 
 @pytest.mark.asyncio
 async def test_open_chat_send_config_resolution(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     monkeypatch: pytest.MonkeyPatch,
 ):
@@ -505,8 +496,6 @@ async def test_open_chat_send_config_resolution(
         scopes=["chat"],
         name_prefix="chat-config-resolution-key",
     )
-    open_api_route = _get_open_api_route(app)
-
     conf_list = [
         {
             "id": "default",
@@ -518,35 +507,38 @@ async def test_open_chat_send_config_resolution(
         {"id": "cfg-1", "name": "Duplicated", "path": "a.json", "is_default": False},
         {"id": "cfg-2", "name": "Duplicated", "path": "b.json", "is_default": False},
     ]
-    monkeypatch.setattr(open_api_route, "_get_chat_config_list", lambda: conf_list)
+    monkeypatch.setattr(
+        open_api_routes,
+        "_get_chat_config_list",
+        lambda _service: conf_list,
+    )
 
     update_route = AsyncMock()
     delete_route = AsyncMock()
     monkeypatch.setattr(
-        open_api_route.core_lifecycle.umop_config_router,
+        app._dashboard_server.core_lifecycle.umop_config_router,
         "update_route",
         update_route,
     )
     monkeypatch.setattr(
-        open_api_route.core_lifecycle.umop_config_router,
+        app._dashboard_server.core_lifecycle.umop_config_router,
         "delete_route",
         delete_route,
     )
 
-    async def fake_chat(post_data: dict | None = None):
-        payload = post_data or await request.get_json()
-        return (
-            Response()
-            .ok(
-                data={
-                    "session_id": payload.get("session_id"),
-                    "creator": g.get("username"),
-                }
-            )
-            .__dict__
+    async def fake_chat_response(_chat_service, username: str, post_data: dict):
+        return ok(
+            {
+                "session_id": post_data.get("session_id"),
+                "creator": username,
+            }
         )
 
-    monkeypatch.setattr(open_api_route.chat_route, "chat", fake_chat)
+    monkeypatch.setattr(
+        open_api_routes,
+        "_build_streaming_chat_response",
+        fake_chat_response,
+    )
 
     invalid_config_id_res = await test_client.post(
         "/api/v1/chat",
@@ -632,7 +624,7 @@ async def test_open_chat_send_config_resolution(
 
 @pytest.mark.asyncio
 async def test_open_chat_sessions_input_validation_and_filtering(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     core_lifecycle_td: AstrBotCoreLifecycle,
 ):
@@ -708,7 +700,9 @@ async def test_open_chat_sessions_input_validation_and_filtering(
 
 
 @pytest.mark.asyncio
-async def test_open_send_message_error_paths(app: Quart, authenticated_header: dict):
+async def test_open_send_message_error_paths(
+    app: FastAPIAppAdapter, authenticated_header: dict
+):
     test_client = app.test_client()
     raw_key, _ = await _create_api_key(
         app,
@@ -763,41 +757,48 @@ async def test_open_send_message_error_paths(app: Quart, authenticated_header: d
 
 
 @pytest.mark.asyncio
-async def test_open_file_upload_requires_file_and_can_upload(
-    app: Quart,
+async def test_open_api_key_scope_normalization(
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
 ):
     test_client = app.test_client()
-    raw_key, _ = await _create_api_key(
-        app,
-        authenticated_header,
-        scopes=["file"],
-        name_prefix="file-scope-key",
-    )
 
-    missing_file_res = await test_client.post(
-        "/api/v1/file",
-        data={},
-        headers={"X-API-Key": raw_key},
+    config_res = await test_client.post(
+        "/api/apikey/create",
+        json={"name": "config-contained-scopes-key", "scopes": ["config"]},
+        headers=authenticated_header,
     )
-    missing_file_data = await missing_file_res.get_json()
-    assert missing_file_data["status"] == "error"
-    assert missing_file_data["message"] == "Missing key: file"
+    config_data = await config_res.get_json()
 
-    upload_res = await test_client.post(
-        "/api/v1/file",
-        files={
-            "file": FileStorage(
-                stream=BytesIO(b"openapi-file-content"),
-                filename="openapi_test.txt",
-                content_type="text/plain",
-            )
-        },
-        headers={"X-API-Key": raw_key},
+    assert config_res.status_code == 200
+    assert config_data["status"] == "ok"
+    assert set(config_data["data"]["scopes"]) == {"config", "bot", "provider"}
+
+    extra_scope_res = await test_client.post(
+        "/api/apikey/create",
+        json={"name": "mcp-skill-scope-key", "scopes": ["mcp", "skill"]},
+        headers=authenticated_header,
     )
-    assert upload_res.status_code == 200
-    upload_data = await upload_res.get_json()
-    assert upload_data["status"] == "ok"
-    assert isinstance(upload_data["data"]["attachment_id"], str)
-    assert upload_data["data"]["filename"] == "openapi_test.txt"
-    assert upload_data["data"]["type"] == "file"
+    extra_scope_data = await extra_scope_res.get_json()
+
+    assert extra_scope_res.status_code == 200
+    assert extra_scope_data["status"] == "ok"
+    assert set(extra_scope_data["data"]["scopes"]) == {"mcp", "skill"}
+
+
+@pytest.mark.asyncio
+async def test_file_scope_is_not_available_for_developer_api_key(
+    app: FastAPIAppAdapter,
+    authenticated_header: dict,
+):
+    test_client = app.test_client()
+    create_res = await test_client.post(
+        "/api/apikey/create",
+        json={"name": "file-scope-key", "scopes": ["file"]},
+        headers=authenticated_header,
+    )
+    create_data = await create_res.get_json()
+
+    assert create_res.status_code == 400
+    assert create_data["status"] == "error"
+    assert create_data["message"] == "Invalid scopes: file"
diff --git a/tests/test_backup.py b/tests/test_backup.py
index b36e9b0c3..52f60a48c 100644
--- a/tests/test_backup.py
+++ b/tests/test_backup.py
@@ -28,7 +28,7 @@ from astrbot.core.db.po import (
     ConversationV2,
 )
 from astrbot.core.utils.version_comparator import VersionComparator
-from astrbot.dashboard.routes.backup import (
+from astrbot.dashboard.services.backup_service import (
     generate_unique_filename,
     secure_filename,
 )
diff --git a/tests/test_chat_route.py b/tests/test_chat_route.py
index 47bd747a0..5518a709e 100644
--- a/tests/test_chat_route.py
+++ b/tests/test_chat_route.py
@@ -2,7 +2,7 @@ import asyncio
 
 import pytest
 
-from astrbot.dashboard.routes.chat import _poll_webchat_stream_result
+from astrbot.dashboard.services.chat_service import poll_webchat_stream_result
 
 
 class _QueueThatRaises:
@@ -23,7 +23,7 @@ class _QueueWithResult:
 
 @pytest.mark.asyncio
 async def test_poll_webchat_stream_result_breaks_on_cancelled_error():
-    result, should_break = await _poll_webchat_stream_result(
+    result, should_break = await poll_webchat_stream_result(
         _QueueThatRaises(asyncio.CancelledError()),
         "alice",
     )
@@ -34,7 +34,7 @@ async def test_poll_webchat_stream_result_breaks_on_cancelled_error():
 
 @pytest.mark.asyncio
 async def test_poll_webchat_stream_result_continues_on_generic_exception():
-    result, should_break = await _poll_webchat_stream_result(
+    result, should_break = await poll_webchat_stream_result(
         _QueueThatRaises(RuntimeError("boom")),
         "alice",
     )
@@ -47,7 +47,7 @@ async def test_poll_webchat_stream_result_continues_on_generic_exception():
 async def test_poll_webchat_stream_result_returns_queue_payload():
     payload = {"type": "end", "data": ""}
 
-    result, should_break = await _poll_webchat_stream_result(
+    result, should_break = await poll_webchat_stream_result(
         _QueueWithResult(payload),
         "alice",
     )
diff --git a/tests/test_computer_config.py b/tests/test_computer_config.py
index 26f72991c..7f5995832 100644
--- a/tests/test_computer_config.py
+++ b/tests/test_computer_config.py
@@ -3,15 +3,13 @@
 from __future__ import annotations
 
 import json
-import logging
 from pathlib import Path
 from unittest.mock import patch
 
 import pytest
 
 from astrbot.core.computer.computer_client import _discover_bay_credentials
-from astrbot.dashboard.routes.config import _log_computer_config_changes
-
+from astrbot.dashboard.services.config_service import _log_computer_config_changes
 
 # ═══════════════════════════════════════════════════════════════
 # _discover_bay_credentials
@@ -174,7 +172,7 @@ class TestDiscoverBayCredentials:
 class TestLogComputerConfigChanges:
     """Test config change detection and logging."""
 
-    @patch("astrbot.dashboard.routes.config.logger")
+    @patch("astrbot.dashboard.services.config_service.logger")
     def test_logs_runtime_change(self, mock_logger) -> None:
         """Detects computer_use_runtime change."""
         old = {"provider_settings": {"computer_use_runtime": "none"}}
@@ -184,9 +182,12 @@ class TestLogComputerConfigChanges:
 
         mock_logger.info.assert_called()
         call_args = [str(c) for c in mock_logger.info.call_args_list]
-        assert any("computer_use_runtime" in c and "none" in c and "sandbox" in c for c in call_args)
+        assert any(
+            "computer_use_runtime" in c and "none" in c and "sandbox" in c
+            for c in call_args
+        )
 
-    @patch("astrbot.dashboard.routes.config.logger")
+    @patch("astrbot.dashboard.services.config_service.logger")
     def test_no_log_when_runtime_unchanged(self, mock_logger) -> None:
         """No log when runtime stays the same."""
         old = {"provider_settings": {"computer_use_runtime": "sandbox"}}
@@ -196,7 +197,7 @@ class TestLogComputerConfigChanges:
 
         mock_logger.info.assert_not_called()
 
-    @patch("astrbot.dashboard.routes.config.logger")
+    @patch("astrbot.dashboard.services.config_service.logger")
     def test_logs_sandbox_key_change(self, mock_logger) -> None:
         """Detects sandbox sub-key change."""
         old = {"provider_settings": {"sandbox": {"booter": "shipyard"}}}
@@ -214,9 +215,11 @@ class TestLogComputerConfigChanges:
                 assert args[3] == "shipyard_neo"
                 found = True
                 break
-        assert found, f"Expected booter change in log calls: {mock_logger.info.call_args_list}"
+        assert found, (
+            f"Expected booter change in log calls: {mock_logger.info.call_args_list}"
+        )
 
-    @patch("astrbot.dashboard.routes.config.logger")
+    @patch("astrbot.dashboard.services.config_service.logger")
     def test_masks_token_values(self, mock_logger) -> None:
         """Token/secret values are masked in log output."""
         old = {"provider_settings": {"sandbox": {"shipyard_neo_access_token": ""}}}
@@ -233,13 +236,11 @@ class TestLogComputerConfigChanges:
         assert "***" in call_args_str
         assert "sk-bay-secret123" not in call_args_str
 
-    @patch("astrbot.dashboard.routes.config.logger")
+    @patch("astrbot.dashboard.services.config_service.logger")
     def test_masks_empty_token_as_empty_label(self, mock_logger) -> None:
         """Empty token values show as '(empty)' not '***'."""
         old = {
-            "provider_settings": {
-                "sandbox": {"shipyard_neo_access_token": "old-key"}
-            }
+            "provider_settings": {"sandbox": {"shipyard_neo_access_token": "old-key"}}
         }
         new = {"provider_settings": {"sandbox": {"shipyard_neo_access_token": ""}}}
 
@@ -249,7 +250,7 @@ class TestLogComputerConfigChanges:
         call_args_str = str(mock_logger.info.call_args_list)
         assert "(empty)" in call_args_str
 
-    @patch("astrbot.dashboard.routes.config.logger")
+    @patch("astrbot.dashboard.services.config_service.logger")
     def test_no_log_when_nothing_changed(self, mock_logger) -> None:
         """No logs at all when config is identical."""
         cfg = {
@@ -266,7 +267,7 @@ class TestLogComputerConfigChanges:
 
         mock_logger.info.assert_not_called()
 
-    @patch("astrbot.dashboard.routes.config.logger")
+    @patch("astrbot.dashboard.services.config_service.logger")
     def test_handles_missing_provider_settings(self, mock_logger) -> None:
         """Gracefully handles configs without provider_settings."""
         _log_computer_config_changes(
@@ -277,7 +278,7 @@ class TestLogComputerConfigChanges:
         call_args_str = str(mock_logger.info.call_args_list)
         assert "computer_use_runtime" in call_args_str
 
-    @patch("astrbot.dashboard.routes.config.logger")
+    @patch("astrbot.dashboard.services.config_service.logger")
     def test_detects_new_sandbox_key(self, mock_logger) -> None:
         """Detects a newly added sandbox key."""
         old = {"provider_settings": {"sandbox": {}}}
@@ -293,7 +294,7 @@ class TestLogComputerConfigChanges:
         call_args_str = str(mock_logger.info.call_args_list)
         assert "shipyard_neo_endpoint" in call_args_str
 
-    @patch("astrbot.dashboard.routes.config.logger")
+    @patch("astrbot.dashboard.services.config_service.logger")
     def test_detects_removed_sandbox_key(self, mock_logger) -> None:
         """Detects a removed sandbox key."""
         old = {
@@ -309,13 +310,11 @@ class TestLogComputerConfigChanges:
         call_args_str = str(mock_logger.info.call_args_list)
         assert "shipyard_neo_endpoint" in call_args_str
 
-    @patch("astrbot.dashboard.routes.config.logger")
+    @patch("astrbot.dashboard.services.config_service.logger")
     def test_secret_key_masked(self, mock_logger) -> None:
         """Any key containing 'secret' is also masked."""
         old = {"provider_settings": {"sandbox": {"my_secret_key": ""}}}
-        new = {
-            "provider_settings": {"sandbox": {"my_secret_key": "very-secret-value"}}
-        }
+        new = {"provider_settings": {"sandbox": {"my_secret_key": "very-secret-value"}}}
 
         _log_computer_config_changes(old, new)
 
diff --git a/tests/test_conversation_checkpoint.py b/tests/test_conversation_checkpoint.py
index 40eae46ff..052d9455c 100644
--- a/tests/test_conversation_checkpoint.py
+++ b/tests/test_conversation_checkpoint.py
@@ -12,7 +12,7 @@ from astrbot.core.agent.message import (
 )
 from astrbot.core.provider.entities import ProviderRequest
 from astrbot.core.provider.provider import Provider
-from astrbot.dashboard.routes.chat import ChatRoute
+from astrbot.dashboard.services.chat_service import find_turn_range
 
 
 def test_checkpoint_message_segment_round_trip():
@@ -151,8 +151,7 @@ def test_provider_ensure_message_to_dicts_skips_checkpoints():
     ]
 
 
-def test_chat_route_find_turn_range():
-    route = ChatRoute.__new__(ChatRoute)
+def test_chat_service_find_turn_range():
     history = [
         {"role": "user", "content": "a"},
         {"role": "assistant", "content": "b"},
@@ -162,5 +161,5 @@ def test_chat_route_find_turn_range():
         {"role": "_checkpoint", "content": {"id": "cp-2"}},
     ]
 
-    assert route._find_turn_range(history, "cp-2") == (3, 5)
-    assert route._find_turn_range(history, "missing") is None
+    assert find_turn_range(history, "cp-2") == (3, 5)
+    assert find_turn_range(history, "missing") is None
diff --git a/tests/test_conversation_commands.py b/tests/test_conversation_commands.py
index 08d11b916..3e56b6acf 100644
--- a/tests/test_conversation_commands.py
+++ b/tests/test_conversation_commands.py
@@ -32,18 +32,22 @@ async def test_clear_third_party_agent_runner_state_deletes_deerflow_thread_befo
 
     context = SimpleNamespace(
         get_config=lambda **kwargs: {
-            "provider_settings": {"deerflow_agent_runner_provider_id": "deerflow-runner"}
+            "provider_settings": {
+                "deerflow_agent_runner_provider_id": "deerflow-runner"
+            }
         },
         provider_manager=SimpleNamespace(
-            get_provider_config_by_id=lambda provider_id, merged=False: {
-                "id": provider_id,
-                "deerflow_api_base": "http://127.0.0.1:2026",
-                "deerflow_api_key": "token",
-                "deerflow_auth_header": "",
-                "proxy": "",
-            }
-            if merged
-            else {"id": provider_id},
+            get_provider_config_by_id=lambda provider_id, merged=False: (
+                {
+                    "id": provider_id,
+                    "deerflow_api_base": "http://127.0.0.1:2026",
+                    "deerflow_api_key": "token",
+                    "deerflow_auth_header": "",
+                    "proxy": "",
+                }
+                if merged
+                else {"id": provider_id}
+            ),
         ),
     )
 
@@ -95,18 +99,22 @@ async def test_clear_third_party_agent_runner_state_removes_local_state_when_dee
 
     context = SimpleNamespace(
         get_config=lambda **kwargs: {
-            "provider_settings": {"deerflow_agent_runner_provider_id": "deerflow-runner"}
+            "provider_settings": {
+                "deerflow_agent_runner_provider_id": "deerflow-runner"
+            }
         },
         provider_manager=SimpleNamespace(
-            get_provider_config_by_id=lambda provider_id, merged=False: {
-                "id": provider_id,
-                "deerflow_api_base": "http://127.0.0.1:2026",
-                "deerflow_api_key": "",
-                "deerflow_auth_header": "",
-                "proxy": "",
-            }
-            if merged
-            else {"id": provider_id},
+            get_provider_config_by_id=lambda provider_id, merged=False: (
+                {
+                    "id": provider_id,
+                    "deerflow_api_base": "http://127.0.0.1:2026",
+                    "deerflow_api_key": "",
+                    "deerflow_auth_header": "",
+                    "proxy": "",
+                }
+                if merged
+                else {"id": provider_id}
+            ),
         ),
     )
 
@@ -148,18 +156,22 @@ async def test_clear_third_party_agent_runner_state_removes_local_state_when_dee
 
     context = SimpleNamespace(
         get_config=lambda **kwargs: {
-            "provider_settings": {"deerflow_agent_runner_provider_id": "deerflow-runner"}
+            "provider_settings": {
+                "deerflow_agent_runner_provider_id": "deerflow-runner"
+            }
         },
         provider_manager=SimpleNamespace(
-            get_provider_config_by_id=lambda provider_id, merged=False: {
-                "id": provider_id,
-                "deerflow_api_base": "http://127.0.0.1:2026",
-                "deerflow_api_key": "",
-                "deerflow_auth_header": "",
-                "proxy": "",
-            }
-            if merged
-            else {"id": provider_id},
+            get_provider_config_by_id=lambda provider_id, merged=False: (
+                {
+                    "id": provider_id,
+                    "deerflow_api_base": "http://127.0.0.1:2026",
+                    "deerflow_api_key": "",
+                    "deerflow_auth_header": "",
+                    "proxy": "",
+                }
+                if merged
+                else {"id": provider_id}
+            ),
         ),
     )
 
diff --git a/tests/test_dashboard.py b/tests/test_dashboard.py
index 596cdb25d..ef3222ccb 100644
--- a/tests/test_dashboard.py
+++ b/tests/test_dashboard.py
@@ -15,7 +15,6 @@ from urllib.parse import parse_qs, urlsplit, urlunsplit
 import pyotp
 import pytest
 import pytest_asyncio
-from quart import Quart, jsonify
 from werkzeug.datastructures import FileStorage
 
 from astrbot.core import LogBroker
@@ -25,7 +24,7 @@ from astrbot.core.star.star import StarMetadata, star_registry
 from astrbot.core.star.star_handler import star_handlers_registry
 from astrbot.core.utils.auth_password import (
     hash_dashboard_password,
-    hash_legacy_dashboard_password,
+    hash_md5_dashboard_password,
     verify_dashboard_password,
 )
 from astrbot.core.utils.pip_installer import PipInstallError
@@ -33,6 +32,7 @@ from astrbot.core.utils.totp import (
     TOTP_TRUSTED_DEVICE_COOKIE_NAME,
     generate_recovery_code,
 )
+from astrbot.dashboard.asgi_runtime import FastAPIAppAdapter, jsonify
 from astrbot.dashboard.password_state import (
     get_dashboard_password_hash,
     is_password_change_required,
@@ -40,9 +40,10 @@ from astrbot.dashboard.password_state import (
     set_password_change_required,
     set_password_storage_upgraded,
 )
-from astrbot.dashboard.routes.auth import DASHBOARD_JWT_COOKIE_NAME
-from astrbot.dashboard.routes.plugin import PluginRoute
 from astrbot.dashboard.server import AstrBotDashboard
+from astrbot.dashboard.services.auth_service import DASHBOARD_JWT_COOKIE_NAME
+from astrbot.dashboard.services.plugin_page_service import PluginPageService
+from astrbot.dashboard.services.plugin_service import PluginService
 from tests.fixtures.helpers import (
     MockPluginBuilder,
     create_mock_updater_install,
@@ -54,11 +55,24 @@ PLUGIN_PAGE_DEMO_NAME = "astrbot_plugin_page_demo"
 PLUGIN_PAGE_DEMO_PAGE_NAME = "bridge-demo"
 
 
+def _removed_md5_hint_alias_key() -> str:
+    return "le" + "gacy_pwd_hint"
+
+
 def _strip_query(url: str) -> str:
     parsed = urlsplit(url)
     return urlunsplit(("", "", parsed.path, "", parsed.fragment))
 
 
+def _assert_cookie_samesite_strict(cookie_header: str) -> None:
+    """Assert that a cookie header carries a strict SameSite attribute.
+
+    Args:
+        cookie_header: The raw Set-Cookie header value to inspect.
+    """
+    assert "samesite=strict" in cookie_header.lower()
+
+
 @pytest.fixture
 def registered_plugin_page(core_lifecycle_td: AstrBotCoreLifecycle, monkeypatch):
     plugin_root = (
@@ -171,7 +185,7 @@ async def core_lifecycle_td(tmp_path_factory):
             hash_dashboard_password(dashboard_password)
         )
         core_lifecycle.astrbot_config["dashboard"]["password"] = (
-            hash_legacy_dashboard_password(dashboard_password)
+            hash_md5_dashboard_password(dashboard_password)
         )
         await set_password_storage_upgraded(
             core_lifecycle.db,
@@ -203,7 +217,7 @@ async def core_lifecycle_td(tmp_path_factory):
 
 @pytest.fixture(scope="module")
 def app(core_lifecycle_td: AstrBotCoreLifecycle):
-    """Creates a Quart app instance for testing."""
+    """Creates a FastAPIAppAdapter app instance for testing."""
     shutdown_event = asyncio.Event()
     # The db instance is already part of the core_lifecycle_td
     server = AstrBotDashboard(core_lifecycle_td, core_lifecycle_td.db, shutdown_event)
@@ -212,7 +226,7 @@ def app(core_lifecycle_td: AstrBotCoreLifecycle):
 
 
 def _resolve_dashboard_password(core_lifecycle_td: AstrBotCoreLifecycle) -> str:
-    """Return a login password compatible with both hashed and plain defaults."""
+    """Return the login password for hashed and plain dashboard defaults."""
     generated_password = getattr(core_lifecycle_td, "_dashboard_plain_password", None)
     if generated_password:
         return generated_password
@@ -281,7 +295,9 @@ async def _restore_dashboard_password_state(
 
 
 @pytest_asyncio.fixture(scope="module")
-async def authenticated_header(app: Quart, core_lifecycle_td: AstrBotCoreLifecycle):
+async def authenticated_header(
+    app: FastAPIAppAdapter, core_lifecycle_td: AstrBotCoreLifecycle
+):
     """Handles login and returns an authenticated header."""
     test_client = app.test_client()
     response = await test_client.post(
@@ -299,7 +315,7 @@ async def authenticated_header(app: Quart, core_lifecycle_td: AstrBotCoreLifecyc
 
 @pytest.mark.asyncio
 async def test_auth_login(
-    app: Quart,
+    app: FastAPIAppAdapter,
     core_lifecycle_td: AstrBotCoreLifecycle,
     monkeypatch: pytest.MonkeyPatch,
 ):
@@ -330,13 +346,13 @@ async def test_auth_login(
     )
     assert jwt_cookie_header
     assert "HttpOnly" in jwt_cookie_header
-    assert "SameSite=Strict" in jwt_cookie_header
+    _assert_cookie_samesite_strict(jwt_cookie_header)
     assert "Secure" not in jwt_cookie_header
 
 
 @pytest.mark.asyncio
 async def test_auth_login_secure_cookie_override(
-    app: Quart,
+    app: FastAPIAppAdapter,
     core_lifecycle_td: AstrBotCoreLifecycle,
     monkeypatch: pytest.MonkeyPatch,
 ):
@@ -359,12 +375,12 @@ async def test_auth_login_secure_cookie_override(
     )
     assert jwt_cookie_header
     assert "Secure" in jwt_cookie_header
-    assert "SameSite=Strict" in jwt_cookie_header
+    _assert_cookie_samesite_strict(jwt_cookie_header)
 
 
 @pytest.mark.asyncio
 async def test_auth_rate_limit_uses_same_bucket_across_paths(
-    app: Quart,
+    app: FastAPIAppAdapter,
     core_lifecycle_td: AstrBotCoreLifecycle,
     monkeypatch: pytest.MonkeyPatch,
 ):
@@ -400,7 +416,7 @@ async def test_auth_rate_limit_uses_same_bucket_across_paths(
 
 @pytest.mark.asyncio
 async def test_auth_rate_limit_separates_different_client_ips(
-    app: Quart,
+    app: FastAPIAppAdapter,
     core_lifecycle_td: AstrBotCoreLifecycle,
     monkeypatch: pytest.MonkeyPatch,
 ):
@@ -446,9 +462,49 @@ async def test_auth_rate_limit_separates_different_client_ips(
         cfg["trust_proxy_headers"] = tp_original
 
 
+@pytest.mark.asyncio
+async def test_auth_rate_limit_applies_to_v1_login(
+    app: FastAPIAppAdapter,
+    core_lifecycle_td: AstrBotCoreLifecycle,
+    monkeypatch: pytest.MonkeyPatch,
+):
+    """The v1 login endpoint uses the same token-bucket limiter as legacy login."""
+    monkeypatch.setenv("ASTRBOT_TEST_MODE", "false")
+    app._dashboard_server._rate_limiter_registry.clear()
+    cfg = core_lifecycle_td.astrbot_config["dashboard"]
+    rl_original = cfg.get("auth_rate_limit", {})
+    tp_original = cfg.get("trust_proxy_headers", False)
+    cfg["auth_rate_limit"] = {
+        "enable": True,
+        "average_interval": 3600.0,
+        "max_burst": 1,
+    }
+    cfg["trust_proxy_headers"] = True
+
+    try:
+        client = app.test_client()
+        headers = {"X-Forwarded-For": "198.51.100.12"}
+        first = await client.post(
+            "/api/v1/auth/login",
+            json={"username": "u", "password": "p"},
+            headers=headers,
+        )
+        assert first.status_code != 429
+
+        second = await client.post(
+            "/api/v1/auth/login",
+            json={"username": "u", "password": "p"},
+            headers=headers,
+        )
+        assert second.status_code == 429, "v1 login should be rate limited"
+    finally:
+        cfg["auth_rate_limit"] = rl_original
+        cfg["trust_proxy_headers"] = tp_original
+
+
 @pytest.mark.asyncio
 async def test_auth_rate_limit_ignores_proxy_headers_by_default(
-    app: Quart,
+    app: FastAPIAppAdapter,
     core_lifecycle_td: AstrBotCoreLifecycle,
     monkeypatch: pytest.MonkeyPatch,
 ):
@@ -489,7 +545,7 @@ async def test_auth_rate_limit_ignores_proxy_headers_by_default(
 
 @pytest.mark.asyncio
 async def test_auth_login_requires_totp_when_enabled_and_not_trusted(
-    app: Quart,
+    app: FastAPIAppAdapter,
     core_lifecycle_td: AstrBotCoreLifecycle,
 ):
     original_dashboard_config = copy.deepcopy(
@@ -525,7 +581,7 @@ async def test_auth_login_requires_totp_when_enabled_and_not_trusted(
 
 @pytest.mark.asyncio
 async def test_auth_login_accepts_valid_totp_code(
-    app: Quart,
+    app: FastAPIAppAdapter,
     core_lifecycle_td: AstrBotCoreLifecycle,
 ):
     original_dashboard_config = copy.deepcopy(
@@ -561,7 +617,7 @@ async def test_auth_login_accepts_valid_totp_code(
 
 @pytest.mark.asyncio
 async def test_auth_login_rejects_invalid_totp_code(
-    app: Quart,
+    app: FastAPIAppAdapter,
     core_lifecycle_td: AstrBotCoreLifecycle,
 ):
     original_dashboard_config = copy.deepcopy(
@@ -599,7 +655,7 @@ async def test_auth_login_rejects_invalid_totp_code(
 
 @pytest.mark.asyncio
 async def test_auth_login_with_recovery_code_disables_totp(
-    app: Quart,
+    app: FastAPIAppAdapter,
     core_lifecycle_td: AstrBotCoreLifecycle,
 ):
     original_dashboard_config = copy.deepcopy(
@@ -639,7 +695,7 @@ async def test_auth_login_with_recovery_code_disables_totp(
 
 @pytest.mark.asyncio
 async def test_auth_login_sets_trusted_device_cookie_when_flag_true(
-    app: Quart,
+    app: FastAPIAppAdapter,
     core_lifecycle_td: AstrBotCoreLifecycle,
 ):
     original_dashboard_config = copy.deepcopy(
@@ -677,7 +733,7 @@ async def test_auth_login_sets_trusted_device_cookie_when_flag_true(
         )
         assert trusted_cookie_header
         assert "HttpOnly" in trusted_cookie_header
-        assert "SameSite=Strict" in trusted_cookie_header
+        _assert_cookie_samesite_strict(trusted_cookie_header)
         assert "Path=/api/auth" in trusted_cookie_header
     finally:
         await _restore_dashboard_password_state(
@@ -688,7 +744,7 @@ async def test_auth_login_sets_trusted_device_cookie_when_flag_true(
 
 @pytest.mark.asyncio
 async def test_auth_login_skips_totp_when_trusted_cookie_valid(
-    app: Quart,
+    app: FastAPIAppAdapter,
     core_lifecycle_td: AstrBotCoreLifecycle,
 ):
     original_dashboard_config = copy.deepcopy(
@@ -735,7 +791,7 @@ async def test_auth_login_skips_totp_when_trusted_cookie_valid(
 
 @pytest.mark.asyncio
 async def test_config_save_requires_two_factor_for_protected_totp_changes(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     core_lifecycle_td: AstrBotCoreLifecycle,
 ):
@@ -781,7 +837,7 @@ async def test_config_save_requires_two_factor_for_protected_totp_changes(
 
 @pytest.mark.asyncio
 async def test_config_save_accepts_totp_code_for_protected_totp_changes(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     core_lifecycle_td: AstrBotCoreLifecycle,
 ):
@@ -828,7 +884,7 @@ async def test_config_save_accepts_totp_code_for_protected_totp_changes(
 
 @pytest.mark.asyncio
 async def test_config_save_rejects_recovery_code_for_protected_totp_changes(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     core_lifecycle_td: AstrBotCoreLifecycle,
 ):
@@ -877,7 +933,7 @@ async def test_config_save_rejects_recovery_code_for_protected_totp_changes(
 
 @pytest.mark.asyncio
 async def test_auth_totp_setup_with_valid_code_returns_recovery_code(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
 ):
     test_client = app.test_client()
@@ -896,21 +952,21 @@ async def test_auth_totp_setup_with_valid_code_returns_recovery_code(
 
 
 @pytest.mark.asyncio
-async def test_legacy_md5_dashboard_password_keeps_legacy_auth_until_edit(
-    app: Quart,
+async def test_md5_dashboard_password_keeps_md5_auth_until_edit(
+    app: FastAPIAppAdapter,
     core_lifecycle_td: AstrBotCoreLifecycle,
 ):
     original_dashboard_config = copy.deepcopy(
         core_lifecycle_td.astrbot_config["dashboard"]
     )
     test_client = app.test_client()
-    legacy_password = "AstrbotLegacy123"
+    md5_password = "AstrbotMd5Pass123"
     changed_password = "AstrbotChanged123"
 
     try:
         core_lifecycle_td.astrbot_config["dashboard"]["username"] = "astrbot"
         core_lifecycle_td.astrbot_config["dashboard"]["password"] = (
-            hash_legacy_dashboard_password(legacy_password)
+            hash_md5_dashboard_password(md5_password)
         )
         core_lifecycle_td.astrbot_config["dashboard"]["pbkdf2_password"] = ""
         await _set_dashboard_password_change_required(core_lifecycle_td, False)
@@ -922,18 +978,29 @@ async def test_legacy_md5_dashboard_password_keeps_legacy_auth_until_edit(
 
         response = await test_client.post(
             "/api/auth/login",
-            json={"username": "astrbot", "password": legacy_password},
+            json={"username": "astrbot", "password": md5_password},
         )
         data = await response.get_json()
         assert data["status"] == "ok"
         assert data["data"]["change_pwd_hint"] is False
-        assert data["data"]["legacy_pwd_hint"] is True
+        assert data["data"]["md5_pwd_hint"] is True
+        assert _removed_md5_hint_alias_key() not in data["data"]
+        assert data["data"]["password_upgrade_required"] is True
+
+        response = await test_client.post(
+            "/api/v1/auth/login",
+            json={"username": "astrbot", "password": md5_password},
+        )
+        data = await response.get_json()
+        assert data["status"] == "ok"
+        assert data["data"]["md5_pwd_hint"] is True
+        assert _removed_md5_hint_alias_key() not in data["data"]
         assert data["data"]["password_upgrade_required"] is True
 
         response = await test_client.post(
             "/api/auth/account/edit",
             json={
-                "password": legacy_password,
+                "password": md5_password,
                 "new_password": "",
                 "confirm_password": "",
                 "new_username": "astrbot-admin",
@@ -952,7 +1019,7 @@ async def test_legacy_md5_dashboard_password_keeps_legacy_auth_until_edit(
         response = await test_client.post(
             "/api/auth/account/edit",
             json={
-                "password": legacy_password,
+                "password": md5_password,
                 "new_password": changed_password,
                 "confirm_password": changed_password,
                 "new_username": "astrbot",
@@ -983,20 +1050,20 @@ async def test_legacy_md5_dashboard_password_keeps_legacy_auth_until_edit(
 
 
 @pytest.mark.asyncio
-async def test_legacy_md5_login_failure_includes_upgrade_faq_hint(
-    app: Quart,
+async def test_md5_login_failure_includes_upgrade_faq_hint(
+    app: FastAPIAppAdapter,
     core_lifecycle_td: AstrBotCoreLifecycle,
 ):
     original_dashboard_config = copy.deepcopy(
         core_lifecycle_td.astrbot_config["dashboard"]
     )
     test_client = app.test_client()
-    legacy_password = "AstrbotLegacy123"
+    md5_password = "AstrbotMd5Pass123"
 
     try:
         core_lifecycle_td.astrbot_config["dashboard"]["username"] = "astrbot"
         core_lifecycle_td.astrbot_config["dashboard"]["password"] = (
-            hash_legacy_dashboard_password(legacy_password)
+            hash_md5_dashboard_password(md5_password)
         )
         core_lifecycle_td.astrbot_config["dashboard"]["pbkdf2_password"] = ""
         await _set_dashboard_password_change_required(core_lifecycle_td, False)
@@ -1026,19 +1093,19 @@ async def test_legacy_md5_login_failure_includes_upgrade_faq_hint(
 
 @pytest.mark.asyncio
 async def test_password_storage_flag_repairs_after_rollback_clears_pbkdf2(
-    app: Quart,
+    app: FastAPIAppAdapter,
     core_lifecycle_td: AstrBotCoreLifecycle,
 ):
     original_dashboard_config = copy.deepcopy(
         core_lifecycle_td.astrbot_config["dashboard"]
     )
     test_client = app.test_client()
-    legacy_password = "AstrbotRollback123"
+    md5_password = "AstrbotRollback123"
 
     try:
         core_lifecycle_td.astrbot_config["dashboard"]["username"] = "astrbot"
         core_lifecycle_td.astrbot_config["dashboard"]["password"] = (
-            hash_legacy_dashboard_password(legacy_password)
+            hash_md5_dashboard_password(md5_password)
         )
         core_lifecycle_td.astrbot_config["dashboard"]["pbkdf2_password"] = ""
         await _set_dashboard_password_change_required(core_lifecycle_td, False)
@@ -1050,12 +1117,13 @@ async def test_password_storage_flag_repairs_after_rollback_clears_pbkdf2(
 
         response = await test_client.post(
             "/api/auth/login",
-            json={"username": "astrbot", "password": legacy_password},
+            json={"username": "astrbot", "password": md5_password},
         )
         data = await response.get_json()
 
         assert data["status"] == "ok"
-        assert data["data"]["legacy_pwd_hint"] is True
+        assert data["data"]["md5_pwd_hint"] is True
+        assert _removed_md5_hint_alias_key() not in data["data"]
         assert data["data"]["password_upgrade_required"] is True
         assert (
             await is_password_storage_upgraded(
@@ -1071,14 +1139,42 @@ async def test_password_storage_flag_repairs_after_rollback_clears_pbkdf2(
         )
 
 
-def test_password_hash_lookup_falls_back_to_legacy_when_pbkdf2_missing(
+@pytest.mark.asyncio
+async def test_version_endpoints_use_md5_password_hint(
+    app: FastAPIAppAdapter,
+    authenticated_header: dict,
+):
+    test_client = app.test_client()
+
+    response = await test_client.get(
+        "/api/v1/stats/version",
+        headers=authenticated_header,
+    )
+    data = await response.get_json()
+
+    assert data["status"] == "ok"
+    assert "md5_pwd_hint" in data["data"]
+    assert _removed_md5_hint_alias_key() not in data["data"]
+
+    response = await test_client.get(
+        "/api/stat/version",
+        headers=authenticated_header,
+    )
+    data = await response.get_json()
+
+    assert data["status"] == "ok"
+    assert "md5_pwd_hint" in data["data"]
+    assert _removed_md5_hint_alias_key() not in data["data"]
+
+
+def test_password_hash_lookup_falls_back_to_md5_when_pbkdf2_missing(
     core_lifecycle_td: AstrBotCoreLifecycle,
 ):
     dashboard_config = copy.deepcopy(core_lifecycle_td.astrbot_config["dashboard"])
-    legacy_hash = hash_legacy_dashboard_password("AstrbotRollback123")
+    md5_hash = hash_md5_dashboard_password("AstrbotRollback123")
 
     try:
-        core_lifecycle_td.astrbot_config["dashboard"]["password"] = legacy_hash
+        core_lifecycle_td.astrbot_config["dashboard"]["password"] = md5_hash
         core_lifecycle_td.astrbot_config["dashboard"]["pbkdf2_password"] = ""
 
         assert (
@@ -1086,7 +1182,7 @@ def test_password_hash_lookup_falls_back_to_legacy_when_pbkdf2_missing(
                 core_lifecycle_td.astrbot_config,
                 upgraded=True,
             )
-            == legacy_hash
+            == md5_hash
         )
     finally:
         core_lifecycle_td.astrbot_config["dashboard"] = dashboard_config
@@ -1094,7 +1190,7 @@ def test_password_hash_lookup_falls_back_to_legacy_when_pbkdf2_missing(
 
 @pytest.mark.asyncio
 async def test_generated_password_requires_password_change_until_changed(
-    app: Quart,
+    app: FastAPIAppAdapter,
     core_lifecycle_td: AstrBotCoreLifecycle,
 ):
     original_dashboard_config = copy.deepcopy(
@@ -1167,7 +1263,7 @@ async def test_generated_password_requires_password_change_until_changed(
 
 @pytest.mark.asyncio
 async def test_local_setup_can_skip_default_password_auth(
-    app: Quart,
+    app: FastAPIAppAdapter,
     core_lifecycle_td: AstrBotCoreLifecycle,
     monkeypatch: pytest.MonkeyPatch,
 ):
@@ -1228,7 +1324,7 @@ async def test_local_setup_can_skip_default_password_auth(
 
 @pytest.mark.asyncio
 async def test_authenticated_default_password_login_can_complete_setup(
-    app: Quart,
+    app: FastAPIAppAdapter,
     core_lifecycle_td: AstrBotCoreLifecycle,
 ):
     original_dashboard_config = copy.deepcopy(
@@ -1289,7 +1385,7 @@ async def test_authenticated_default_password_login_can_complete_setup(
 
 @pytest.mark.asyncio
 async def test_setup_skip_requires_local_host(
-    app: Quart,
+    app: FastAPIAppAdapter,
     core_lifecycle_td: AstrBotCoreLifecycle,
     monkeypatch: pytest.MonkeyPatch,
 ):
@@ -1328,7 +1424,7 @@ async def test_setup_skip_requires_local_host(
 
 @pytest.mark.asyncio
 async def test_plugin_web_api_supports_dynamic_route(
-    app: Quart,
+    app: FastAPIAppAdapter,
     core_lifecycle_td: AstrBotCoreLifecycle,
     authenticated_header: dict[str, str],
     monkeypatch: pytest.MonkeyPatch,
@@ -1366,11 +1462,13 @@ async def test_plugin_web_api_supports_dynamic_route(
 
 def test_plugin_page_content_path_escapes_plugin_name():
     assert (
-        PluginRoute._build_plugin_page_content_path("plugin with space", "main page")
+        PluginPageService.build_plugin_page_content_path(
+            "plugin with space", "main page"
+        )
         == "/api/plugin/page/content/plugin%20with%20space/main%20page/"
     )
     assert (
-        PluginRoute._build_plugin_page_content_path(
+        PluginPageService.build_plugin_page_content_path(
             "plugin with space", "main page", "assets/main file.js"
         )
         == "/api/plugin/page/content/plugin%20with%20space/main%20page/assets/main%20file.js"
@@ -1379,7 +1477,7 @@ def test_plugin_page_content_path_escapes_plugin_name():
 
 @pytest.mark.asyncio
 async def test_plugin_get_excludes_scanned_pages(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     registered_plugin_page: StarMetadata,
 ):
@@ -1401,7 +1499,7 @@ async def test_plugin_get_excludes_scanned_pages(
 
 @pytest.mark.asyncio
 async def test_plugin_detail_includes_scanned_page_component(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     registered_plugin_page: StarMetadata,
 ):
@@ -1435,7 +1533,7 @@ async def test_plugin_detail_includes_scanned_page_component(
 
 @pytest.mark.asyncio
 async def test_plugin_page_entry_returns_signed_content_path(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     registered_plugin_page: StarMetadata,
 ):
@@ -1461,7 +1559,7 @@ async def test_plugin_page_entry_returns_signed_content_path(
 
 @pytest.mark.asyncio
 async def test_plugin_page_content_requires_auth(
-    app: Quart,
+    app: FastAPIAppAdapter,
     registered_plugin_page: StarMetadata,
 ):
     test_client = app.test_client()
@@ -1475,7 +1573,7 @@ async def test_plugin_page_content_requires_auth(
 
 @pytest.mark.asyncio
 async def test_plugin_page_content_supports_cookie_auth(
-    app: Quart,
+    app: FastAPIAppAdapter,
     core_lifecycle_td: AstrBotCoreLifecycle,
     registered_plugin_page: StarMetadata,
 ):
@@ -1529,7 +1627,7 @@ async def test_plugin_page_content_supports_cookie_auth(
 
 @pytest.mark.asyncio
 async def test_plugin_page_content_issues_scoped_asset_token(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     registered_plugin_page: StarMetadata,
 ):
@@ -1595,7 +1693,7 @@ async def test_plugin_page_content_issues_scoped_asset_token(
 
 @pytest.mark.asyncio
 async def test_plugin_page_bridge_sdk_includes_is_dark_when_theme_param_provided(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     registered_plugin_page: StarMetadata,
 ):
@@ -1646,7 +1744,7 @@ async def test_plugin_page_bridge_sdk_includes_is_dark_when_theme_param_provided
 
 @pytest.mark.asyncio
 async def test_plugin_page_content_propagates_theme_in_rewritten_urls(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     registered_plugin_page: StarMetadata,
 ):
@@ -1708,7 +1806,7 @@ async def test_plugin_page_content_propagates_theme_in_rewritten_urls(
 
 @pytest.mark.asyncio
 async def test_plugin_page_assets_require_dashboard_auth(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     registered_plugin_page: StarMetadata,
 ):
@@ -1740,7 +1838,7 @@ async def test_plugin_page_assets_require_dashboard_auth(
 
 @pytest.mark.asyncio
 async def test_plugin_page_content_blocks_path_traversal(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     registered_plugin_page: StarMetadata,
 ):
@@ -1754,7 +1852,7 @@ async def test_plugin_page_content_blocks_path_traversal(
 
 @pytest.mark.asyncio
 async def test_logout_clears_cookie_for_plugin_page(
-    app: Quart,
+    app: FastAPIAppAdapter,
     core_lifecycle_td: AstrBotCoreLifecycle,
     registered_plugin_page: StarMetadata,
 ):
@@ -1789,7 +1887,7 @@ async def test_logout_clears_cookie_for_plugin_page(
     assert clear_cookie_header
     assert f"{DASHBOARD_JWT_COOKIE_NAME}=;" in clear_cookie_header
     assert "Max-Age=0" in clear_cookie_header
-    assert "SameSite=Strict" in clear_cookie_header
+    _assert_cookie_samesite_strict(clear_cookie_header)
 
     response = await test_client.get(
         f"/api/plugin/page/content/{PLUGIN_PAGE_DEMO_NAME}/{PLUGIN_PAGE_DEMO_PAGE_NAME}/"
@@ -1800,7 +1898,7 @@ async def test_logout_clears_cookie_for_plugin_page(
 
 
 @pytest.mark.asyncio
-async def test_get_stat(app: Quart, authenticated_header: dict):
+async def test_get_stat(app: FastAPIAppAdapter, authenticated_header: dict):
     test_client = app.test_client()
     response = await test_client.get("/api/stat/get")
     assert response.status_code == 401
@@ -1864,7 +1962,7 @@ async def test_dashboard_ssl_missing_cert_and_key_falls_back_to_http(
 
 @pytest.mark.asyncio
 async def test_subagent_config_accepts_default_persona(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     core_lifecycle_td: AstrBotCoreLifecycle,
 ):
@@ -1914,7 +2012,7 @@ async def test_subagent_config_accepts_default_persona(
 @pytest.mark.asyncio
 @pytest.mark.parametrize("payload", [[], "x"])
 async def test_batch_delete_sessions_rejects_non_object_payload(
-    app: Quart, authenticated_header: dict, payload
+    app: FastAPIAppAdapter, authenticated_header: dict, payload
 ):
     test_client = app.test_client()
     response = await test_client.post(
@@ -1931,7 +2029,7 @@ async def test_batch_delete_sessions_rejects_non_object_payload(
 
 @pytest.mark.asyncio
 async def test_batch_delete_sessions_masks_internal_error(
-    app: Quart, authenticated_header: dict, monkeypatch
+    app: FastAPIAppAdapter, authenticated_header: dict, monkeypatch
 ):
     test_client = app.test_client()
 
@@ -1946,7 +2044,7 @@ async def test_batch_delete_sessions_masks_internal_error(
         raise RuntimeError("secret-internal-error")
 
     monkeypatch.setattr(
-        "astrbot.dashboard.routes.chat.ChatRoute._delete_session_internal",
+        "astrbot.dashboard.services.chat_service.ChatService.delete_session_internal",
         _raise_error,
     )
 
@@ -1967,7 +2065,7 @@ async def test_batch_delete_sessions_masks_internal_error(
 
 @pytest.mark.asyncio
 async def test_batch_delete_sessions_uses_batch_lookup(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     core_lifecycle_td: AstrBotCoreLifecycle,
     monkeypatch,
@@ -2016,7 +2114,7 @@ async def test_batch_delete_sessions_uses_batch_lookup(
 
 @pytest.mark.asyncio
 async def test_plugins(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     core_lifecycle_td: AstrBotCoreLifecycle,
     monkeypatch,
@@ -2153,14 +2251,14 @@ async def test_plugins(
 
 @pytest.mark.asyncio
 async def test_plugins_when_installed_at_unresolved(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     monkeypatch,
 ):
     """Tests plugin payload when installed_at cannot be resolved."""
     test_client = app.test_client()
 
-    monkeypatch.setattr(PluginRoute, "_get_plugin_installed_at", lambda *_args: None)
+    monkeypatch.setattr(PluginService, "get_plugin_installed_at", lambda *_args: None)
 
     response = await test_client.get("/api/plugin/get", headers=authenticated_header)
     assert response.status_code == 200
@@ -2174,7 +2272,7 @@ async def test_plugins_when_installed_at_unresolved(
 
 
 @pytest.mark.asyncio
-async def test_commands_api(app: Quart, authenticated_header: dict):
+async def test_commands_api(app: FastAPIAppAdapter, authenticated_header: dict):
     """Tests the command management API endpoints."""
     test_client = app.test_client()
 
@@ -2203,7 +2301,7 @@ async def test_commands_api(app: Quart, authenticated_header: dict):
 
 @pytest.mark.asyncio
 async def test_t2i_set_active_template_syncs_all_configs(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     core_lifecycle_td: AstrBotCoreLifecycle,
 ):
@@ -2270,7 +2368,7 @@ async def test_t2i_set_active_template_syncs_all_configs(
 
 @pytest.mark.asyncio
 async def test_t2i_reset_default_template_syncs_all_configs(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     core_lifecycle_td: AstrBotCoreLifecycle,
 ):
@@ -2343,7 +2441,7 @@ async def test_t2i_reset_default_template_syncs_all_configs(
 
 @pytest.mark.asyncio
 async def test_t2i_update_active_template_reloads_all_schedulers(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     core_lifecycle_td: AstrBotCoreLifecycle,
 ):
@@ -2421,7 +2519,7 @@ async def test_t2i_update_active_template_reloads_all_schedulers(
 
 @pytest.mark.asyncio
 async def test_check_update(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     core_lifecycle_td: AstrBotCoreLifecycle,
     monkeypatch,
@@ -2446,7 +2544,7 @@ async def test_check_update(
         mock_check_update,
     )
     monkeypatch.setattr(
-        "astrbot.dashboard.routes.update.get_dashboard_version",
+        "astrbot.dashboard.services.update_service.get_dashboard_version",
         mock_get_dashboard_version,
     )
 
@@ -2459,7 +2557,7 @@ async def test_check_update(
 
 @pytest.mark.asyncio
 async def test_do_update(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     core_lifecycle_td: AstrBotCoreLifecycle,
     monkeypatch,
@@ -2494,11 +2592,11 @@ async def test_do_update(
 
     monkeypatch.setattr(core_lifecycle_td.astrbot_updator, "update", mock_update)
     monkeypatch.setattr(
-        "astrbot.dashboard.routes.update.download_dashboard",
+        "astrbot.dashboard.services.update_service.download_dashboard",
         mock_download_dashboard,
     )
     monkeypatch.setattr(
-        "astrbot.dashboard.routes.update.pip_installer.install",
+        "astrbot.dashboard.services.update_service.pip_installer.install",
         mock_pip_install,
     )
 
@@ -2524,8 +2622,49 @@ async def test_do_update(
 
 
 @pytest.mark.asyncio
-async def test_install_pip_package_returns_pip_install_error_message(
-    app: Quart,
+async def test_do_update_hides_internal_error_message_in_response_and_progress(
+    app: FastAPIAppAdapter,
+    authenticated_header: dict,
+    monkeypatch,
+):
+    test_client = app.test_client()
+
+    async def mock_download_dashboard(*args, **kwargs):
+        del args, kwargs
+        raise RuntimeError("secret stack trace")
+
+    monkeypatch.setattr(
+        "astrbot.dashboard.services.update_service.download_dashboard",
+        mock_download_dashboard,
+    )
+
+    response = await test_client.post(
+        "/api/update/do",
+        headers=authenticated_header,
+        json={"version": "v3.4.0", "reboot": False, "progress_id": "failed-progress"},
+    )
+    data = await response.get_json()
+
+    assert response.status_code == 200
+    assert data["status"] == "error"
+    assert data["message"] == "An internal error has occurred."
+    assert "secret stack trace" not in str(data)
+
+    progress_response = await test_client.get(
+        "/api/update/progress?id=failed-progress",
+        headers=authenticated_header,
+    )
+    progress_data = await progress_response.get_json()
+
+    assert progress_data["status"] == "ok"
+    assert progress_data["data"]["status"] == "error"
+    assert progress_data["data"]["message"] == "更新失败，请查看服务端日志。"
+    assert "secret stack trace" not in str(progress_data)
+
+
+@pytest.mark.asyncio
+async def test_install_pip_package_returns_generic_error_message(
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     monkeypatch,
 ):
@@ -2536,7 +2675,7 @@ async def test_install_pip_package_returns_pip_install_error_message(
         raise PipInstallError("install failed", code=2)
 
     monkeypatch.setattr(
-        "astrbot.dashboard.routes.update.pip_installer.install",
+        "astrbot.dashboard.services.update_service.pip_installer.install",
         mock_pip_install,
     )
 
@@ -2549,7 +2688,7 @@ async def test_install_pip_package_returns_pip_install_error_message(
     assert response.status_code == 200
     data = await response.get_json()
     assert data["status"] == "error"
-    assert data["message"] == "install failed"
+    assert data["message"] == "An internal error has occurred."
 
 
 class _FakeNeoSkills:
@@ -2613,7 +2752,7 @@ class _FakeNeoBayClient:
 
 @pytest.mark.asyncio
 async def test_neo_skills_routes(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     core_lifecycle_td: AstrBotCoreLifecycle,
     monkeypatch,
@@ -2644,11 +2783,11 @@ async def test_neo_skills_routes(
         return
 
     monkeypatch.setattr(
-        "astrbot.dashboard.routes.skills.NeoSkillSyncManager.sync_release",
+        "astrbot.dashboard.services.skills_service.NeoSkillSyncManager.sync_release",
         _fake_sync_release,
     )
     monkeypatch.setattr(
-        "astrbot.dashboard.routes.skills.sync_skills_to_active_sandboxes",
+        "astrbot.dashboard.services.skills_service.sync_skills_to_active_sandboxes",
         _fake_sync_skills_to_active_sandboxes,
     )
 
@@ -2735,7 +2874,7 @@ async def test_neo_skills_routes(
 
 @pytest.mark.asyncio
 async def test_batch_upload_skills_returns_error_when_all_files_invalid(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
 ):
     test_client = app.test_client()
@@ -2760,7 +2899,7 @@ async def test_batch_upload_skills_returns_error_when_all_files_invalid(
 
 @pytest.mark.asyncio
 async def test_batch_upload_skills_accepts_zip_files(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     monkeypatch,
 ):
@@ -2778,11 +2917,11 @@ async def test_batch_upload_skills_accepts_zip_files(
         return "demo_skill"
 
     monkeypatch.setattr(
-        "astrbot.dashboard.routes.skills.sync_skills_to_active_sandboxes",
+        "astrbot.dashboard.services.skills_service.sync_skills_to_active_sandboxes",
         _fake_sync_skills_to_active_sandboxes,
     )
     monkeypatch.setattr(
-        "astrbot.dashboard.routes.skills.SkillManager.install_skill_from_zip",
+        "astrbot.dashboard.services.skills_service.SkillManager.install_skill_from_zip",
         _fake_install_skill_from_zip,
     )
 
@@ -2813,7 +2952,7 @@ async def test_batch_upload_skills_accepts_zip_files(
 
 @pytest.mark.asyncio
 async def test_batch_upload_skills_accepts_valid_skill_archive(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     monkeypatch,
     tmp_path,
@@ -2829,7 +2968,7 @@ async def test_batch_upload_skills_accepts_valid_skill_archive(
         return
 
     monkeypatch.setattr(
-        "astrbot.dashboard.routes.skills.sync_skills_to_active_sandboxes",
+        "astrbot.dashboard.services.skills_service.sync_skills_to_active_sandboxes",
         _fake_sync_skills_to_active_sandboxes,
     )
     monkeypatch.setattr(
@@ -2845,7 +2984,7 @@ async def test_batch_upload_skills_accepts_valid_skill_archive(
         lambda: str(temp_dir),
     )
     monkeypatch.setattr(
-        "astrbot.dashboard.routes.skills.get_astrbot_temp_path",
+        "astrbot.dashboard.services.skills_service.get_astrbot_temp_path",
         lambda: str(temp_dir),
     )
 
@@ -2886,7 +3025,7 @@ async def test_batch_upload_skills_accepts_valid_skill_archive(
 
 @pytest.mark.asyncio
 async def test_batch_upload_skills_partial_success(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     monkeypatch,
 ):
@@ -2905,11 +3044,11 @@ async def test_batch_upload_skills_partial_success(
         raise RuntimeError("install failed")
 
     monkeypatch.setattr(
-        "astrbot.dashboard.routes.skills.sync_skills_to_active_sandboxes",
+        "astrbot.dashboard.services.skills_service.sync_skills_to_active_sandboxes",
         _fake_sync_skills_to_active_sandboxes,
     )
     monkeypatch.setattr(
-        "astrbot.dashboard.routes.skills.SkillManager.install_skill_from_zip",
+        "astrbot.dashboard.services.skills_service.SkillManager.install_skill_from_zip",
         _fake_install_skill_from_zip,
     )
 
@@ -2955,7 +3094,7 @@ async def test_batch_upload_skills_partial_success(
 
 @pytest.mark.asyncio
 async def test_skill_file_browser_and_editor_security(
-    app: Quart,
+    app: FastAPIAppAdapter,
     authenticated_header: dict,
     monkeypatch,
     tmp_path,
@@ -2984,7 +3123,7 @@ async def test_skill_file_browser_and_editor_security(
         lambda: str(skills_root),
     )
     monkeypatch.setattr(
-        "astrbot.dashboard.routes.skills.sync_skills_to_active_sandboxes",
+        "astrbot.dashboard.services.skills_service.sync_skills_to_active_sandboxes",
         _fake_sync_skills_to_active_sandboxes,
     )
 
diff --git a/tests/test_fastapi_v1_dashboard.py b/tests/test_fastapi_v1_dashboard.py
new file mode 100644
index 000000000..3aa24abfd
--- /dev/null
+++ b/tests/test_fastapi_v1_dashboard.py
@@ -0,0 +1,2523 @@
+import copy
+from dataclasses import dataclass
+from pathlib import Path
+from types import SimpleNamespace
+
+import httpx
+import jwt
+import pytest
+import pytest_asyncio
+from fastapi import FastAPI, Request
+from fastapi.responses import PlainTextResponse
+
+import astrbot.dashboard.services.config_service as config_service
+from astrbot.core import file_token_service
+from astrbot.dashboard.api.app import create_dashboard_asgi_app
+from astrbot.dashboard.asgi_runtime import (
+    FastAPIAppAdapter,
+    g,
+)
+from astrbot.dashboard.asgi_runtime import (
+    request as dashboard_request,
+)
+from astrbot.dashboard.responses import ok
+from astrbot.dashboard.services.api_key_service import ApiKeyService
+from astrbot.dashboard.services.auth_service import DASHBOARD_JWT_COOKIE_NAME
+from astrbot.dashboard.services.skills_service import SkillArchive
+
+JWT_SECRET = "fastapi-v1-test-secret-with-32-bytes"
+
+
+@dataclass
+class FakeApiKey:
+    key_id: str
+    scopes: list[str] | None
+
+
+class _FakeScalarResult:
+    def __init__(self, items: list[object]) -> None:
+        self.items = items
+
+    def all(self) -> list[object]:
+        return self.items
+
+
+class _FakeDbResult:
+    def __init__(self, db: "FakeDb") -> None:
+        self.db = db
+
+    def fetchall(self) -> list[tuple[str]]:
+        return [(umo,) for umo in self.db.umo_ids]
+
+    def scalars(self) -> _FakeScalarResult:
+        return _FakeScalarResult(self.db.preferences)
+
+
+class _FakeDbSession:
+    def __init__(self, db: "FakeDb") -> None:
+        self.db = db
+
+    async def execute(self, _statement) -> _FakeDbResult:
+        return _FakeDbResult(self.db)
+
+
+class _FakeDbContext:
+    def __init__(self, db: "FakeDb") -> None:
+        self.db = db
+
+    async def __aenter__(self) -> _FakeDbSession:
+        return _FakeDbSession(self.db)
+
+    async def __aexit__(self, exc_type, exc, traceback) -> None:
+        return None
+
+
+class FakeDb:
+    def __init__(self) -> None:
+        self.api_keys: dict[str, FakeApiKey] = {}
+        self.touched_key_ids: list[str] = []
+        self.umo_ids = ["webchat:FriendMessage:webchat!user!session-1"]
+        self.preferences: list[object] = []
+
+    async def get_active_api_key_by_hash(self, key_hash: str) -> FakeApiKey | None:
+        return self.api_keys.get(key_hash)
+
+    async def touch_api_key(self, key_id: str) -> None:
+        self.touched_key_ids.append(key_id)
+
+    async def get_attachment_by_id(self, _attachment_id: str):
+        return None
+
+    def get_db(self) -> _FakeDbContext:
+        return _FakeDbContext(self)
+
+    async def get_umo_aliases(self, _umos: list[str] | None = None) -> list[object]:
+        return []
+
+    def add_api_key(self, raw_key: str, scopes: list[str]) -> None:
+        self.api_keys[ApiKeyService.hash_key(raw_key)] = FakeApiKey(
+            key_id="config-key",
+            scopes=scopes,
+        )
+
+
+class FakeLlmTools:
+    def __init__(self) -> None:
+        self.config = {
+            "mcpServers": {
+                "demo-server": {
+                    "active": True,
+                    "url": "https://example.com/demo-server",
+                },
+                "modelscope/demo": {
+                    "active": True,
+                    "url": "https://example.com/modelscope-demo",
+                },
+            }
+        }
+        self.mcp_server_runtime_view = {}
+        self.func_list = []
+        self.enabled_servers: list[tuple[str, dict]] = []
+        self.disabled_servers: list[str] = []
+        self.tested_configs: list[dict] = []
+        self.synced_modelscope_tokens: list[str] = []
+
+    def load_mcp_config(self) -> dict:
+        return copy.deepcopy(self.config)
+
+    def save_mcp_config(self, config: dict) -> bool:
+        self.config = copy.deepcopy(config)
+        return True
+
+    async def test_mcp_server_connection(self, config: dict) -> list[str]:
+        self.tested_configs.append(copy.deepcopy(config))
+        return ["demo_tool"]
+
+    async def sync_modelscope_mcp_servers(self, access_token: str) -> None:
+        self.synced_modelscope_tokens.append(access_token)
+
+    async def enable_mcp_server(
+        self,
+        name: str,
+        config: dict,
+        *,
+        timeout: int,
+    ) -> None:
+        self.enabled_servers.append((name, copy.deepcopy(config)))
+
+    async def disable_mcp_server(self, name: str, *, timeout: int) -> None:
+        self.disabled_servers.append(name)
+
+    def iter_builtin_tools(self) -> list:
+        return []
+
+    def is_builtin_tool(self, _tool_name: str) -> bool:
+        return False
+
+    def activate_llm_tool(self, _tool_name: str, *, star_map) -> bool:
+        return True
+
+    def deactivate_llm_tool(self, _tool_name: str) -> bool:
+        return True
+
+
+class FakeProviderManager:
+    def __init__(self, config: dict) -> None:
+        self.providers_config = config["provider"]
+        self.provider_sources_config = config["provider_sources"]
+        self.reloaded_providers: list[dict] = []
+        self.deleted_provider_filters: list[dict] = []
+        self.inst_map: dict[str, object] = {}
+        self.provider_insts: list[object] = []
+        self.stt_provider_insts: list[object] = []
+        self.tts_provider_insts: list[object] = []
+        self.set_provider_calls: list[dict] = []
+        self.llm_tools = FakeLlmTools()
+
+    def get_merged_provider_config(self, provider_config: dict) -> dict:
+        config = copy.deepcopy(provider_config)
+        source_id = config.get("provider_source_id")
+        if not source_id:
+            return config
+        source = next(
+            (
+                item
+                for item in self.provider_sources_config
+                if item.get("id") == source_id
+            ),
+            None,
+        )
+        if not source:
+            return config
+        merged = {**source, **config}
+        merged["id"] = config["id"]
+        return merged
+
+    def get_provider_config_by_id(
+        self,
+        provider_id: str,
+        *,
+        merged: bool = False,
+    ) -> dict | None:
+        for provider in self.providers_config:
+            if provider.get("id") != provider_id:
+                continue
+            if merged:
+                return self.get_merged_provider_config(provider)
+            return copy.deepcopy(provider)
+        return None
+
+    async def update_provider(self, origin_provider_id: str, new_config: dict) -> None:
+        next_id = new_config.get("id")
+        for provider in self.providers_config:
+            if provider.get("id") == next_id and next_id != origin_provider_id:
+                raise ValueError(f"Provider ID {next_id} already exists")
+        for idx, provider in enumerate(self.providers_config):
+            if provider.get("id") == origin_provider_id:
+                self.providers_config[idx] = copy.deepcopy(new_config)
+                await self.reload(new_config)
+                return
+        raise ValueError(f"Provider ID {origin_provider_id} not found")
+
+    async def create_provider(self, new_config: dict) -> None:
+        next_id = new_config.get("id")
+        if any(provider.get("id") == next_id for provider in self.providers_config):
+            raise ValueError(f"Provider ID {next_id} already exists")
+        self.providers_config.append(copy.deepcopy(new_config))
+
+    async def delete_provider(
+        self,
+        provider_id: str | None = None,
+        provider_source_id: str | None = None,
+    ) -> None:
+        self.deleted_provider_filters.append(
+            {"provider_id": provider_id, "provider_source_id": provider_source_id}
+        )
+        if provider_id:
+            self.providers_config[:] = [
+                provider
+                for provider in self.providers_config
+                if provider.get("id") != provider_id
+            ]
+        if provider_source_id:
+            self.providers_config[:] = [
+                provider
+                for provider in self.providers_config
+                if provider.get("provider_source_id") != provider_source_id
+            ]
+
+    async def reload(self, provider: dict) -> None:
+        self.reloaded_providers.append(copy.deepcopy(provider))
+
+    async def set_provider(self, provider_id: str, provider_type, umo: str) -> None:
+        self.set_provider_calls.append(
+            {
+                "provider_id": provider_id,
+                "provider_type": provider_type,
+                "umo": umo,
+            }
+        )
+
+
+class FakeProviderInstance:
+    def __init__(self, provider_id: str) -> None:
+        self.provider_id = provider_id
+        self.tested = False
+
+    def meta(self):
+        return SimpleNamespace(
+            id=self.provider_id,
+            model="kimi-k2-0905-preview",
+            provider_type=SimpleNamespace(value="chat_completion"),
+        )
+
+    async def test(self) -> None:
+        self.tested = True
+
+
+@dataclass
+class FakeConversation:
+    cid: str
+    user_id: str
+    platform_id: str = "webchat-main"
+    message_type: str = "FriendMessage"
+    title: str = "Demo conversation"
+    persona_id: str | None = "persona/foo"
+    history: str = "[]"
+    created_at: str = "2026-01-01T00:00:00"
+    updated_at: str = "2026-01-01T00:00:00"
+
+
+class FakeConversationManager:
+    def __init__(self) -> None:
+        user_id = "webchat:FriendMessage:webchat!user!session-1"
+        self.conversations: dict[tuple[str, str], FakeConversation] = {
+            (user_id, "conversation/with/slash"): FakeConversation(
+                cid="conversation/with/slash",
+                user_id=user_id,
+            )
+        }
+
+    async def get_filtered_conversations(
+        self,
+        *,
+        page: int,
+        page_size: int,
+        platforms: list[str],
+        message_types: list[str],
+        search_query: str,
+        exclude_ids: list[str],
+        exclude_platforms: list[str],
+    ):
+        conversations = list(self.conversations.values())
+        if platforms:
+            conversations = [
+                conversation
+                for conversation in conversations
+                if conversation.platform_id in platforms
+            ]
+        if message_types:
+            conversations = [
+                conversation
+                for conversation in conversations
+                if conversation.message_type in message_types
+            ]
+        if search_query:
+            conversations = [
+                conversation
+                for conversation in conversations
+                if search_query in conversation.title
+            ]
+        conversations = [
+            conversation
+            for conversation in conversations
+            if conversation.cid not in exclude_ids
+            and conversation.platform_id not in exclude_platforms
+        ]
+        start = (page - 1) * page_size
+        return conversations[start : start + page_size], len(conversations)
+
+    async def get_conversation(
+        self,
+        *,
+        unified_msg_origin: str,
+        conversation_id: str,
+    ):
+        return self.conversations.get((unified_msg_origin, conversation_id))
+
+    async def update_conversation(
+        self,
+        *,
+        unified_msg_origin: str,
+        conversation_id: str,
+        title: str | None = None,
+        persona_id: str | None = None,
+        history=None,
+    ) -> None:
+        conversation = self.conversations[(unified_msg_origin, conversation_id)]
+        if title is not None:
+            conversation.title = title
+        if persona_id is not None:
+            conversation.persona_id = persona_id
+        if history is not None:
+            conversation.history = history
+
+    async def delete_conversation(
+        self,
+        *,
+        unified_msg_origin: str,
+        conversation_id: str,
+    ) -> None:
+        self.conversations.pop((unified_msg_origin, conversation_id), None)
+
+
+class FakePlatform:
+    def __init__(self, platform_id: str) -> None:
+        self.platform_id = platform_id
+        self.config = {"webhook_uuid": "demo-hook"}
+        self.sent_messages = []
+
+    def meta(self):
+        return SimpleNamespace(id=self.platform_id, name=self.platform_id)
+
+    def unified_webhook(self) -> bool:
+        return True
+
+    async def webhook_callback(self, request_obj):
+        return {
+            "webhook_uuid": self.config["webhook_uuid"],
+            "method": request_obj.method,
+            "payload": await request_obj.get_json(silent=True),
+        }
+
+    async def send_by_session(self, session, message_chain) -> None:
+        self.sent_messages.append((session, message_chain))
+
+
+class FakePersonaManager:
+    def __init__(self) -> None:
+        self.personas: dict[str, SimpleNamespace] = {
+            "persona/foo": self._persona(
+                persona_id="persona/foo",
+                system_prompt="Demo persona",
+            )
+        }
+        self.folders: dict[str, SimpleNamespace] = {}
+        self.sort_items: list[dict] = []
+
+    @staticmethod
+    def _persona(
+        *,
+        persona_id: str,
+        system_prompt: str,
+        begin_dialogs: list | None = None,
+        tools: list[str] | None = None,
+        skills: list[str] | None = None,
+        custom_error_message: str | None = None,
+        folder_id: str | None = None,
+        sort_order: int = 0,
+    ) -> SimpleNamespace:
+        return SimpleNamespace(
+            persona_id=persona_id,
+            system_prompt=system_prompt,
+            begin_dialogs=begin_dialogs,
+            tools=tools,
+            skills=skills,
+            custom_error_message=custom_error_message,
+            folder_id=folder_id,
+            sort_order=sort_order,
+            created_at=None,
+            updated_at=None,
+        )
+
+    @staticmethod
+    def _folder(
+        *,
+        folder_id: str,
+        name: str,
+        parent_id: str | None = None,
+        description: str | None = None,
+        sort_order: int = 0,
+    ) -> SimpleNamespace:
+        return SimpleNamespace(
+            folder_id=folder_id,
+            name=name,
+            parent_id=parent_id,
+            description=description,
+            sort_order=sort_order,
+            created_at=None,
+            updated_at=None,
+        )
+
+    async def get_all_personas(self) -> list[SimpleNamespace]:
+        return list(self.personas.values())
+
+    async def get_personas_by_folder(
+        self,
+        folder_id: str | None,
+    ) -> list[SimpleNamespace]:
+        return [
+            persona
+            for persona in self.personas.values()
+            if persona.folder_id == folder_id
+        ]
+
+    async def get_persona(self, persona_id: str):
+        return self.personas.get(persona_id)
+
+    async def create_persona(self, **kwargs):
+        persona = self._persona(**kwargs)
+        self.personas[persona.persona_id] = persona
+        return persona
+
+    async def update_persona(self, persona_id: str, **kwargs) -> None:
+        persona = self.personas[persona_id]
+        for key, value in kwargs.items():
+            if value is not None:
+                setattr(persona, key, value)
+
+    async def delete_persona(self, persona_id: str) -> None:
+        self.personas.pop(persona_id, None)
+
+    async def move_persona_to_folder(
+        self,
+        persona_id: str,
+        folder_id: str | None,
+    ) -> None:
+        self.personas[persona_id].folder_id = folder_id
+
+    async def get_folders(self, parent_id: str | None) -> list[SimpleNamespace]:
+        return [
+            folder for folder in self.folders.values() if folder.parent_id == parent_id
+        ]
+
+    async def get_folder_tree(self) -> list:
+        return []
+
+    async def get_folder(self, folder_id: str):
+        return self.folders.get(folder_id)
+
+    async def create_folder(self, **kwargs):
+        folder_id = kwargs.get("folder_id") or kwargs["name"]
+        folder = self._folder(folder_id=folder_id, **kwargs)
+        self.folders[folder.folder_id] = folder
+        return folder
+
+    async def update_folder(self, folder_id: str, **kwargs) -> None:
+        folder = self.folders[folder_id]
+        for key, value in kwargs.items():
+            if value is not None:
+                setattr(folder, key, value)
+
+    async def delete_folder(self, folder_id: str) -> None:
+        self.folders.pop(folder_id, None)
+
+    async def batch_update_sort_order(self, items: list[dict]) -> None:
+        self.sort_items = list(items)
+
+
+class FakeUmopConfigRouter:
+    def __init__(self) -> None:
+        self.umop_to_conf_id: dict[str, str] = {}
+
+    async def update_routing_data(self, new_routing: dict[str, str]) -> None:
+        self.umop_to_conf_id = dict(new_routing)
+
+    async def update_route(self, umo: str, conf_id: str) -> None:
+        self.umop_to_conf_id[umo] = conf_id
+
+    async def delete_route(self, umo: str) -> None:
+        self.umop_to_conf_id.pop(umo, None)
+
+
+class FakeAstrBotUpdator:
+    async def check_update(self, *_args, **_kwargs):
+        return None
+
+    async def get_releases(self):
+        return []
+
+    async def update(self, *_args, **_kwargs) -> None:
+        return None
+
+
+class FakeAstrBotConfig(dict):
+    def save_config(self, post_config: dict) -> None:
+        self.clear()
+        self.update(copy.deepcopy(post_config))
+
+
+def _build_fake_config() -> dict:
+    return FakeAstrBotConfig(
+        {
+            "platform": [
+                {
+                    "id": "webchat-main",
+                    "type": "webchat",
+                    "enable": True,
+                    "settings": {"session_timeout": 60},
+                }
+            ],
+            "provider_sources": [
+                {
+                    "id": "openai-source",
+                    "type": "openai_chat_completion",
+                    "provider_type": "chat_completion",
+                    "api_base": "https://api.example.test/v1",
+                    "key": ["test-key"],
+                }
+            ],
+            "provider": [
+                {
+                    "id": "gpt-mini",
+                    "provider_source_id": "openai-source",
+                    "model": "gpt-4o-mini",
+                    "enable": True,
+                },
+                {
+                    "id": "agent-runner",
+                    "type": "dify",
+                    "provider_type": "agent_runner",
+                    "enable": False,
+                },
+            ],
+        }
+    )
+
+
+async def _request_json(request: Request, *, silent: bool = False):
+    try:
+        return await request.json()
+    except Exception:
+        if silent:
+            return None
+        raise
+
+
+def _register_dashboard_alias_routes(
+    app: FastAPI,
+    config: dict,
+    provider_manager: FakeProviderManager,
+) -> None:
+    def _alias_username(request: Request) -> str:
+        auth_header = request.headers.get("Authorization", "")
+        token = auth_header.removeprefix("Bearer ").strip()
+        payload = jwt.decode(token, JWT_SECRET, algorithms=["HS256"])
+        return payload["username"]
+
+    def alias_get(path: str):
+        return app.get(path, include_in_schema=False)
+
+    def alias_post(path: str):
+        return app.post(path, include_in_schema=False)
+
+    def alias_api_route(path: str, methods: list[str]):
+        return app.api_route(path, methods=methods, include_in_schema=False)
+
+    @alias_get("/api/config/platform/list")
+    async def dashboard_alias_platform_list():
+        return ok({"platforms": config["platform"]})
+
+    @alias_get("/api/config/provider/list")
+    async def dashboard_alias_provider_list(request: Request):
+        provider_type = request.query_params.get("provider_type")
+        provider_types = provider_type.split(",") if provider_type else []
+        provider_source_types = {
+            source["id"]: source.get("provider_type", "chat_completion")
+            for source in provider_manager.provider_sources_config
+        }
+        providers = []
+        for provider in provider_manager.providers_config:
+            source_id = provider.get("provider_source_id")
+            if source_id:
+                if provider_source_types.get(source_id) in provider_types:
+                    providers.append(
+                        provider_manager.get_merged_provider_config(provider)
+                    )
+                continue
+            if provider.get("provider_type") in provider_types:
+                providers.append(provider)
+        return ok(providers)
+
+    @alias_get("/api/stat/start-time")
+    async def dashboard_alias_start_time():
+        return ok({"start_time": 1234567890})
+
+    @alias_get("/api/session/active-umos")
+    async def dashboard_alias_active_umos():
+        return ok(
+            {
+                "umos": ["webchat:FriendMessage:webchat!user!session-1"],
+                "umo_infos": [
+                    {
+                        "umo": "webchat:FriendMessage:webchat!user!session-1",
+                        "platform": "webchat",
+                        "message_type": "FriendMessage",
+                        "session_id": "webchat!user!session-1",
+                    }
+                ],
+            }
+        )
+
+    @alias_get("/api/plugin/get")
+    async def dashboard_alias_plugin_list(request: Request):
+        return ok(
+            {
+                "plugins": [{"name": "astrbot_plugin_demo"}],
+                "alias_username": _alias_username(request),
+            }
+        )
+
+    @alias_post("/api/plugin/off")
+    async def dashboard_alias_plugin_off(request: Request):
+        return ok(
+            {
+                "payload": await _request_json(request),
+                "alias_username": _alias_username(request),
+            }
+        )
+
+    @alias_post("/api/plugin/on")
+    async def dashboard_alias_plugin_on(request: Request):
+        return ok(
+            {
+                "payload": await _request_json(request),
+                "alias_username": _alias_username(request),
+            }
+        )
+
+    @alias_get("/api/plugin/detail")
+    async def dashboard_alias_plugin_detail(request: Request):
+        return ok({"name": request.query_params.get("name")})
+
+    @alias_post("/api/plugin/uninstall")
+    async def dashboard_alias_plugin_uninstall(request: Request):
+        return ok({"payload": await _request_json(request)})
+
+    @alias_get("/api/plugin/readme")
+    async def dashboard_alias_plugin_readme(request: Request):
+        return ok({"name": request.query_params.get("name"), "content": "readme"})
+
+    @alias_get("/api/plugin/changelog")
+    async def dashboard_alias_plugin_changelog(request: Request):
+        return ok({"name": request.query_params.get("name"), "content": "changes"})
+
+    @alias_post("/api/plugin/reload")
+    async def dashboard_alias_plugin_reload(request: Request):
+        return ok({"payload": await _request_json(request)})
+
+    @alias_post("/api/plugin/update")
+    async def dashboard_alias_plugin_update(request: Request):
+        return ok({"payload": await _request_json(request)})
+
+    @alias_post("/api/plugin/check-compat")
+    async def dashboard_alias_plugin_version_support(request: Request):
+        return ok(
+            {
+                "payload": await _request_json(request),
+                "alias_username": _alias_username(request),
+            }
+        )
+
+    @alias_get("/api/config/get")
+    async def dashboard_alias_config_get(request: Request):
+        return ok(
+            {
+                "plugin_name": request.query_params.get("plugin_name"),
+                "schema": {"type": "object"},
+            }
+        )
+
+    @alias_post("/api/config/plugin/update")
+    async def dashboard_alias_plugin_config_update(request: Request):
+        return ok(
+            {
+                "plugin_name": request.query_params.get("plugin_name"),
+                "payload": await _request_json(request),
+            }
+        )
+
+    @alias_api_route("/api/plug/{plugin_path:path}", methods=["GET", "POST"])
+    async def dashboard_alias_plugin_extension(plugin_path: str, request: Request):
+        return ok(
+            {
+                "plugin_path": plugin_path,
+                "method": request.method,
+                "payload": await _request_json(request, silent=True),
+                "alias_username": _alias_username(request),
+            }
+        )
+
+    @alias_get("/api/config/file/get")
+    async def dashboard_alias_config_file_get(request: Request):
+        return ok(
+            {
+                "scope": request.query_params.get("scope"),
+                "name": request.query_params.get("name"),
+                "key": request.query_params.get("key"),
+            }
+        )
+
+    @alias_post("/api/config/file/upload")
+    async def dashboard_alias_config_file_upload(request: Request):
+        return ok(
+            {
+                "scope": request.query_params.get("scope"),
+                "name": request.query_params.get("name"),
+                "key": request.query_params.get("key"),
+                "payload": await _request_json(request, silent=True),
+            }
+        )
+
+    @alias_post("/api/config/file/delete")
+    async def dashboard_alias_config_file_delete(request: Request):
+        return ok(
+            {
+                "scope": request.query_params.get("scope"),
+                "name": request.query_params.get("name"),
+                "payload": await _request_json(request),
+            }
+        )
+
+    @alias_get("/api/skills")
+    async def dashboard_alias_skill_list():
+        return ok({"skills": [{"name": "demo_skill"}], "runtime": "local"})
+
+    @alias_post("/api/skills/update")
+    async def dashboard_alias_skill_update(request: Request):
+        return ok({"payload": await _request_json(request)})
+
+    @alias_post("/api/skills/delete")
+    async def dashboard_alias_skill_delete(request: Request):
+        return ok({"payload": await _request_json(request)})
+
+    @alias_get("/api/skills/download")
+    async def dashboard_alias_skill_download(request: Request):
+        return ok({"name": request.query_params.get("name")})
+
+    @alias_get("/api/skills/files")
+    async def dashboard_alias_skill_files(request: Request):
+        return ok(
+            {
+                "name": request.query_params.get("name"),
+                "path": request.query_params.get("path"),
+            }
+        )
+
+    @alias_get("/api/skills/file")
+    async def dashboard_alias_skill_file_get(request: Request):
+        return ok(
+            {
+                "name": request.query_params.get("name"),
+                "path": request.query_params.get("path"),
+            }
+        )
+
+    @alias_post("/api/skills/file")
+    async def dashboard_alias_skill_file_update(request: Request):
+        return ok({"payload": await _request_json(request)})
+
+    @alias_post("/api/config/provider/get_embedding_dim")
+    async def dashboard_alias_provider_embedding_dim(request: Request):
+        return ok({"payload": await _request_json(request)})
+
+    @alias_get("/api/file/{file_token}")
+    async def dashboard_alias_token_file(file_token: str):
+        return PlainTextResponse(f"token:{file_token}")
+
+
+@pytest.fixture
+def fake_db() -> FakeDb:
+    return FakeDb()
+
+
+@pytest.fixture
+def fake_core_lifecycle():
+    config = _build_fake_config()
+    provider_manager = FakeProviderManager(config)
+    platform = FakePlatform("webchat-main")
+    umop_config_router = FakeUmopConfigRouter()
+    reloaded_config_ids = []
+    platform_reload_configs = []
+    terminated_platform_ids = []
+
+    async def reload_pipeline_scheduler(config_id: str) -> None:
+        reloaded_config_ids.append(config_id)
+
+    async def reload_platform(config: dict) -> None:
+        platform_reload_configs.append(copy.deepcopy(config))
+
+    async def load_platform(config: dict) -> None:
+        platform_reload_configs.append(copy.deepcopy(config))
+
+    async def terminate_platform(platform_id: str) -> None:
+        terminated_platform_ids.append(platform_id)
+
+    demo_plugin = SimpleNamespace(
+        name="astrbot_plugin_demo",
+        repo=None,
+        author="demo",
+        desc="Demo plugin",
+        version="1.0.0",
+        reserved=False,
+        activated=True,
+        display_name="AstrBot Plugin Demo",
+        logo=None,
+        logo_path=None,
+        support_platforms=[],
+        astrbot_version="",
+        i18n={},
+        root_dir_name=None,
+        star_handler_full_names=[],
+        skills=[],
+    )
+
+    async def turn_off_plugin(plugin_name: str) -> None:
+        if plugin_name == demo_plugin.name:
+            demo_plugin.activated = False
+
+    async def turn_on_plugin(plugin_name: str) -> None:
+        if plugin_name == demo_plugin.name:
+            demo_plugin.activated = True
+
+    async def reload_plugin(plugin_name: str | None = None):
+        return True, f"reloaded {plugin_name or 'all'}"
+
+    def validate_astrbot_version_specifier(version_spec: str):
+        return True, f"supported: {version_spec}"
+
+    async def plugin_extension(plugin_path: str):
+        return ok(
+            {
+                "plugin_path": plugin_path,
+                "method": dashboard_request.method,
+                "payload": await dashboard_request.get_json(silent=True),
+                "username": g.username,
+            }
+        )
+
+    return SimpleNamespace(
+        astrbot_config=config,
+        astrbot_updator=FakeAstrBotUpdator(),
+        start_time=1234567890,
+        astrbot_config_mgr=SimpleNamespace(
+            confs={"default": config}, default_conf=config
+        ),
+        reload_pipeline_scheduler=reload_pipeline_scheduler,
+        reloaded_config_ids=reloaded_config_ids,
+        platform_reload_configs=platform_reload_configs,
+        terminated_platform_ids=terminated_platform_ids,
+        umop_config_router=umop_config_router,
+        platform_manager=SimpleNamespace(
+            platform_insts=[platform],
+            fake_platform=platform,
+            reload=reload_platform,
+            load_platform=load_platform,
+            terminate_platform=terminate_platform,
+            get_all_stats=lambda: {
+                "platforms": [{"id": "webchat-main", "status": "running"}]
+            },
+        ),
+        provider_manager=provider_manager,
+        persona_mgr=FakePersonaManager(),
+        conversation_manager=FakeConversationManager(),
+        platform_message_history_manager=SimpleNamespace(),
+        plugin_manager=SimpleNamespace(
+            context=SimpleNamespace(get_all_stars=lambda: [demo_plugin]),
+            failed_plugin_info=None,
+            failed_plugin_dict={},
+            turn_off_plugin=turn_off_plugin,
+            turn_on_plugin=turn_on_plugin,
+            reload=reload_plugin,
+            _validate_astrbot_version_specifier=validate_astrbot_version_specifier,
+        ),
+        star_context=SimpleNamespace(
+            registered_web_apis=[
+                ("/<path:plugin_path>", plugin_extension, ["GET", "POST"], "demo")
+            ]
+        ),
+        kb_manager=None,
+    )
+
+
+@pytest.fixture
+def asgi_app(fake_core_lifecycle, fake_db: FakeDb):
+    app = create_dashboard_asgi_app(
+        core_lifecycle=fake_core_lifecycle,
+        db=fake_db,
+        jwt_secret=JWT_SECRET,
+    )
+    app.state.dashboard_app_adapter = FastAPIAppAdapter(app)
+    _register_dashboard_alias_routes(
+        app,
+        fake_core_lifecycle.astrbot_config,
+        fake_core_lifecycle.provider_manager,
+    )
+    return app
+
+
+@pytest_asyncio.fixture
+async def asgi_client(asgi_app):
+    transport = httpx.ASGITransport(app=asgi_app)
+    async with httpx.AsyncClient(
+        transport=transport,
+        base_url="http://testserver",
+    ) as client:
+        yield client
+
+
+def _jwt_headers() -> dict[str, str]:
+    token = jwt.encode(
+        {"username": "fastapi-v1-test"},
+        JWT_SECRET,
+        algorithm="HS256",
+    )
+    return {"Authorization": f"Bearer {token}"}
+
+
+def test_fastapi_app_adapter_registers_on_app_state():
+    app = FastAPI()
+    adapter = FastAPIAppAdapter(app)
+
+    assert app.state.dashboard_app_adapter is adapter
+
+
+@pytest.mark.asyncio
+async def test_v1_scope_dependencies_accept_dashboard_cookie(
+    asgi_client: httpx.AsyncClient,
+):
+    token = jwt.encode(
+        {"username": "fastapi-v1-cookie-test"},
+        JWT_SECRET,
+        algorithm="HS256",
+    )
+
+    response = await asgi_client.get(
+        "/api/v1/bots",
+        headers={"Cookie": f"{DASHBOARD_JWT_COOKIE_NAME}={token}"},
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["status"] == "ok"
+    assert isinstance(data["data"]["bots"], list)
+
+
+@pytest.mark.asyncio
+async def test_v1_openapi_is_served_by_fastapi(asgi_client: httpx.AsyncClient):
+    response = await asgi_client.get("/api/v1/openapi.json")
+
+    assert response.status_code == 200
+    spec = response.json()
+    assert spec["openapi"].startswith("3.")
+    assert all(path.startswith("/api/v1/") for path in spec["paths"])
+    assert "/api/v1/bots" in spec["paths"]
+    assert "/api/v1/providers" in spec["paths"]
+    assert "/api/v1/plugins" in spec["paths"]
+    assert "/api/v1/conversations" in spec["paths"]
+    assert "/api/v1/mcp/servers" in spec["paths"]
+    assert "/api/v1/skills" in spec["paths"]
+
+
+def test_static_openapi_v1_paths_include_api_version():
+    spec_path = Path(__file__).resolve().parents[1] / "openspec" / "openapi-v1.yaml"
+    in_paths = False
+    path_keys = []
+    for line in spec_path.read_text(encoding="utf-8").splitlines():
+        if line == "paths:":
+            in_paths = True
+            continue
+        if line == "components:":
+            in_paths = False
+        if in_paths and line.startswith("  /") and line.endswith(":"):
+            path_keys.append(line.strip()[:-1])
+
+    assert path_keys
+    assert all(path.startswith("/api/v1/") for path in path_keys)
+
+
+@pytest.mark.asyncio
+async def test_dashboard_static_dist_files_are_served(
+    fake_core_lifecycle,
+    fake_db: FakeDb,
+    tmp_path: Path,
+):
+    static_folder = tmp_path / "dist"
+    assets_folder = static_folder / "assets"
+    assets_folder.mkdir(parents=True)
+    (static_folder / "index.html").write_text(
+        '<script type="module" src="/assets/index-demo.js"></script>',
+        encoding="utf-8",
+    )
+    (static_folder / "favicon.svg").write_text("<svg></svg>", encoding="utf-8")
+    (assets_folder / "index-demo.js").write_text(
+        "window.__astrbotStaticTest = true;",
+        encoding="utf-8",
+    )
+    (tmp_path / "secret.txt").write_text("outside static root", encoding="utf-8")
+
+    app = create_dashboard_asgi_app(
+        core_lifecycle=fake_core_lifecycle,
+        db=fake_db,
+        jwt_secret=JWT_SECRET,
+        static_folder=str(static_folder),
+    )
+    transport = httpx.ASGITransport(app=app)
+    async with httpx.AsyncClient(
+        transport=transport,
+        base_url="http://testserver",
+    ) as client:
+        asset_response = await client.get("/assets/index-demo.js")
+        favicon_response = await client.get("/favicon.svg")
+        page_response = await client.get("/config")
+        missing_response = await client.get("/assets/missing.js")
+        traversal_response = await client.get("/assets/%2E%2E/%2E%2E/secret.txt")
+        api_response = await client.get("/api/not-found")
+
+    assert asset_response.status_code == 200
+    assert "window.__astrbotStaticTest" in asset_response.text
+    assert favicon_response.status_code == 200
+    assert favicon_response.text == "<svg></svg>"
+    assert page_response.status_code == 200
+    assert "/assets/index-demo.js" in page_response.text
+    assert missing_response.status_code == 404
+    assert traversal_response.status_code == 404
+    assert api_response.status_code == 404
+
+
+@pytest.mark.asyncio
+async def test_v1_backup_path_rejects_traversal(asgi_client: httpx.AsyncClient):
+    download_response = await asgi_client.get(
+        "/api/v1/backups/%2E%2E/secret.zip",
+        params={"token": "demo"},
+    )
+    delete_response = await asgi_client.delete(
+        "/api/v1/backups/%2E%2E/secret.zip",
+        headers=_jwt_headers(),
+    )
+
+    assert download_response.status_code == 200
+    assert delete_response.status_code == 200
+    assert download_response.json()["status"] == "error"
+    assert delete_response.json()["status"] == "error"
+    assert "非法路径" in download_response.json()["message"]
+    assert "非法路径" in delete_response.json()["message"]
+
+
+@pytest.mark.asyncio
+async def test_v1_openapi_uses_pydantic_request_bodies(
+    asgi_client: httpx.AsyncClient,
+):
+    response = await asgi_client.get("/api/v1/openapi.json")
+
+    assert response.status_code == 200
+    spec = response.json()
+    schemas = spec["components"]["schemas"]
+    assert "BotRegistrationRequest" in schemas
+    assert "ConfigContentRequest" in schemas
+
+    bot_registration = spec["paths"]["/api/v1/bot-types/{bot_type}/registration"][
+        "post"
+    ]
+    assert bot_registration["parameters"][0]["name"] == "bot_type"
+    assert bot_registration["requestBody"]["content"]["application/json"]["schema"][
+        "$ref"
+    ].endswith("/BotRegistrationRequest")
+
+    config_profile_update = spec["paths"]["/api/v1/config-profiles/{config_id}"]["put"]
+    assert config_profile_update["requestBody"]["content"]["application/json"][
+        "schema"
+    ]["$ref"].endswith("/ConfigContentRequest")
+
+    system_config_update = spec["paths"]["/api/v1/system-config"]["put"]
+    assert system_config_update["requestBody"]["content"]["application/json"]["schema"][
+        "$ref"
+    ].endswith("/ConfigContentRequest")
+
+
+@pytest.mark.asyncio
+async def test_v1_conversation_path_id_allows_slash(asgi_client: httpx.AsyncClient):
+    response = await asgi_client.get(
+        "/api/v1/conversations/conversation%2Fwith%2Fslash",
+        params={"user_id": "webchat:FriendMessage:webchat!user!session-1"},
+        headers=_jwt_headers(),
+    )
+
+    assert response.status_code == 200
+    payload = response.json()
+    assert payload["status"] == "ok"
+    assert payload["data"]["cid"] == "conversation/with/slash"
+
+
+@pytest.mark.asyncio
+async def test_v1_conversation_detail_requires_user_id(
+    asgi_client: httpx.AsyncClient,
+):
+    response = await asgi_client.get(
+        "/api/v1/conversations/conversation%2Fwith%2Fslash",
+        headers=_jwt_headers(),
+    )
+
+    assert response.status_code == 422
+
+
+@pytest.mark.asyncio
+async def test_dashboard_alias_conversation_detail_uses_fastapi_service(
+    asgi_client: httpx.AsyncClient,
+):
+    response = await asgi_client.post(
+        "/api/conversation/detail",
+        json={
+            "user_id": "webchat:FriendMessage:webchat!user!session-1",
+            "cid": "conversation/with/slash",
+        },
+        headers=_jwt_headers(),
+    )
+
+    assert response.status_code == 200
+    payload = response.json()
+    assert payload["status"] == "ok"
+    assert payload["data"]["cid"] == "conversation/with/slash"
+
+
+@pytest.mark.asyncio
+async def test_v1_bots_matches_dashboard_platform_alias_list(
+    asgi_client: httpx.AsyncClient,
+):
+    headers = _jwt_headers()
+
+    dashboard_alias_response = await asgi_client.get(
+        "/api/config/platform/list",
+        headers=headers,
+    )
+    v1_response = await asgi_client.get("/api/v1/bots", headers=headers)
+
+    assert dashboard_alias_response.status_code == 200
+    assert v1_response.status_code == 200
+    dashboard_alias_data = dashboard_alias_response.json()
+    v1_data = v1_response.json()
+    assert dashboard_alias_data["status"] == "ok"
+    assert v1_data["status"] == "ok"
+    assert v1_data["data"]["bots"] == dashboard_alias_data["data"]["platforms"]
+
+
+@pytest.mark.asyncio
+async def test_v1_bot_stats_match_platform_manager(asgi_client: httpx.AsyncClient):
+    response = await asgi_client.get("/api/v1/bots/stats", headers=_jwt_headers())
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["status"] == "ok"
+    assert data["data"]["platforms"] == [{"id": "webchat-main", "status": "running"}]
+
+
+@pytest.mark.asyncio
+async def test_v1_config_routes_can_replace_all_routes(
+    asgi_client: httpx.AsyncClient,
+    fake_core_lifecycle,
+):
+    routing = {
+        "webchat-main:private:*": "default",
+        "webchat-main:group:demo": "group-conf",
+    }
+
+    response = await asgi_client.put(
+        "/api/v1/config-routes",
+        headers=_jwt_headers(),
+        json={"routing": routing},
+    )
+
+    assert response.status_code == 200
+    assert response.json()["status"] == "ok"
+    assert fake_core_lifecycle.umop_config_router.umop_to_conf_id == routing
+
+    list_response = await asgi_client.get(
+        "/api/v1/config-routes",
+        headers=_jwt_headers(),
+    )
+    assert list_response.status_code == 200
+    assert list_response.json()["data"]["routing"] == routing
+
+
+@pytest.mark.asyncio
+async def test_v1_active_umos_uses_session_service(
+    asgi_client: httpx.AsyncClient,
+):
+    response = await asgi_client.get(
+        "/api/v1/sessions/active-umos",
+        headers=_jwt_headers(),
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["status"] == "ok"
+    assert data["data"]["umos"] == ["webchat:FriendMessage:webchat!user!session-1"]
+    assert data["data"]["umo_infos"][0]["platform"] == "webchat"
+
+
+@pytest.mark.asyncio
+async def test_v1_system_config_update_preserves_independent_bot_provider_sections(
+    asgi_client: httpx.AsyncClient,
+    fake_core_lifecycle,
+    monkeypatch: pytest.MonkeyPatch,
+):
+    def fake_save_config(post_config: dict, config: FakeAstrBotConfig, is_core=False):
+        config.save_config(post_config)
+
+    monkeypatch.setattr(config_service, "save_config", fake_save_config)
+
+    original_platform = copy.deepcopy(fake_core_lifecycle.astrbot_config["platform"])
+    original_provider_sources = copy.deepcopy(
+        fake_core_lifecycle.astrbot_config["provider_sources"]
+    )
+    original_providers = copy.deepcopy(fake_core_lifecycle.astrbot_config["provider"])
+    payload = copy.deepcopy(fake_core_lifecycle.astrbot_config)
+    payload["platform"] = []
+    payload["provider_sources"] = []
+    payload["provider"] = []
+    payload["provider_settings"] = {"default_provider_id": "gpt-mini"}
+
+    response = await asgi_client.put(
+        "/api/v1/system-config",
+        headers=_jwt_headers(),
+        json=payload,
+    )
+
+    assert response.status_code == 200
+    assert response.json()["status"] == "ok"
+    assert fake_core_lifecycle.astrbot_config["platform"] == original_platform
+    assert (
+        fake_core_lifecycle.astrbot_config["provider_sources"]
+        == original_provider_sources
+    )
+    assert fake_core_lifecycle.astrbot_config["provider"] == original_providers
+    assert fake_core_lifecycle.astrbot_config["provider_settings"] == {
+        "default_provider_id": "gpt-mini"
+    }
+    assert fake_core_lifecycle.reloaded_config_ids == ["default"]
+
+
+@pytest.mark.asyncio
+async def test_v1_system_config_returns_system_metadata(
+    asgi_client: httpx.AsyncClient,
+):
+    response = await asgi_client.get(
+        "/api/v1/system-config",
+        headers=_jwt_headers(),
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["status"] == "ok"
+    assert "system_group" in data["data"]["metadata"]
+    assert "platform_group" not in data["data"]["metadata"]
+
+
+@pytest.mark.asyncio
+async def test_v1_providers_matches_dashboard_provider_alias_list(
+    asgi_client: httpx.AsyncClient,
+):
+    headers = _jwt_headers()
+
+    dashboard_alias_response = await asgi_client.get(
+        "/api/config/provider/list?provider_type=chat_completion",
+        headers=headers,
+    )
+    v1_response = await asgi_client.get(
+        "/api/v1/providers?capability=chat",
+        headers=headers,
+    )
+
+    assert dashboard_alias_response.status_code == 200
+    assert v1_response.status_code == 200
+    dashboard_alias_data = dashboard_alias_response.json()
+    v1_data = v1_response.json()
+    assert dashboard_alias_data["status"] == "ok"
+    assert v1_data["status"] == "ok"
+    assert v1_data["data"]["providers"] == dashboard_alias_data["data"]
+
+
+@pytest.mark.asyncio
+async def test_v1_provider_source_rename_updates_provider_refs(
+    asgi_client: httpx.AsyncClient,
+    fake_core_lifecycle,
+    monkeypatch: pytest.MonkeyPatch,
+):
+    monkeypatch.setattr(
+        "astrbot.dashboard.services.config_service.save_config",
+        lambda *_args, **_kwargs: None,
+    )
+
+    response = await asgi_client.put(
+        "/api/v1/provider-sources/openai-source",
+        json={
+            "config": {
+                "id": "openai-renamed",
+                "type": "openai_chat_completion",
+                "provider_type": "chat_completion",
+                "api_base": "https://api.example.test/v1",
+                "key": ["test-key"],
+            }
+        },
+        headers=_jwt_headers(),
+    )
+
+    assert response.status_code == 200
+    assert response.json()["status"] == "ok"
+    config = fake_core_lifecycle.astrbot_config
+    assert config["provider_sources"][0]["id"] == "openai-renamed"
+    assert config["provider"][0]["provider_source_id"] == "openai-renamed"
+    assert (
+        fake_core_lifecycle.provider_manager.provider_sources_config[0]["id"]
+        == "openai-renamed"
+    )
+    assert fake_core_lifecycle.provider_manager.reloaded_providers == [
+        config["provider"][0]
+    ]
+
+
+@pytest.mark.asyncio
+async def test_v1_provider_update_keeps_dashboard_id_rename_behavior(
+    asgi_client: httpx.AsyncClient,
+    fake_core_lifecycle,
+):
+    response = await asgi_client.put(
+        "/api/v1/providers/gpt-mini",
+        json={
+            "config": {
+                "id": "gpt-renamed",
+                "provider_source_id": "openai-source",
+                "model": "gpt-4o-mini",
+                "enable": True,
+            }
+        },
+        headers=_jwt_headers(),
+    )
+
+    assert response.status_code == 200
+    assert response.json()["status"] == "ok"
+    config = fake_core_lifecycle.astrbot_config
+    assert config["provider"][0]["id"] == "gpt-renamed"
+    assert fake_core_lifecycle.provider_manager.reloaded_providers == [
+        config["provider"][0]
+    ]
+
+
+@pytest.mark.asyncio
+async def test_v1_create_standalone_provider_matches_dashboard_alias_capability(
+    asgi_client: httpx.AsyncClient,
+    fake_core_lifecycle,
+):
+    response = await asgi_client.post(
+        "/api/v1/providers",
+        json={
+            "config": {
+                "id": "tts-main",
+                "type": "edge_tts",
+                "provider_type": "text_to_speech",
+                "enable": True,
+            }
+        },
+        headers=_jwt_headers(),
+    )
+
+    assert response.status_code == 200
+    assert response.json()["status"] == "ok"
+    assert fake_core_lifecycle.astrbot_config["provider"][-1] == {
+        "id": "tts-main",
+        "type": "edge_tts",
+        "provider_type": "text_to_speech",
+        "enable": True,
+    }
+
+
+@pytest.mark.asyncio
+async def test_v1_safe_provider_routes_accept_slash_ids(
+    asgi_client: httpx.AsyncClient,
+    fake_core_lifecycle,
+    monkeypatch: pytest.MonkeyPatch,
+):
+    monkeypatch.setattr(config_service, "save_config", lambda *_args, **_kwargs: None)
+
+    source_id = "https://example.com/source"
+    provider_id = "qianxun/kimi-k2-0905-preview"
+    config = fake_core_lifecycle.astrbot_config
+    config["provider_sources"].append(
+        {
+            "id": source_id,
+            "type": "openai_chat_completion",
+            "provider_type": "chat_completion",
+            "api_base": "https://api.example.test/v1",
+            "key": ["test-key"],
+        }
+    )
+    config["provider"].append(
+        {
+            "id": provider_id,
+            "provider_source_id": source_id,
+            "model": "kimi-k2-0905-preview",
+            "enable": True,
+        }
+    )
+    provider_instance = FakeProviderInstance(provider_id)
+    fake_core_lifecycle.provider_manager.inst_map[provider_id] = provider_instance
+
+    async def fake_list_models(_service, requested_source_id: str):
+        return {"provider_source_id": requested_source_id, "models": ["model/a"]}
+
+    monkeypatch.setattr(
+        config_service.ProviderConfigService,
+        "list_provider_source_models",
+        fake_list_models,
+    )
+
+    headers = _jwt_headers()
+    get_response = await asgi_client.get(
+        "/api/v1/providers/by-id",
+        params={"provider_id": provider_id, "merged": True},
+        headers=headers,
+    )
+    schema_response = await asgi_client.get(
+        "/api/v1/providers/schema",
+        headers=headers,
+    )
+    path_test_response = await asgi_client.post(
+        "/api/v1/providers/qianxun%2Fkimi-k2-0905-preview/test",
+        headers=headers,
+    )
+    safe_test_response = await asgi_client.post(
+        "/api/v1/providers/test",
+        json={"provider_id": provider_id},
+        headers=headers,
+    )
+    enabled_response = await asgi_client.patch(
+        "/api/v1/providers/enabled",
+        json={"provider_id": provider_id, "enabled": False},
+        headers=headers,
+    )
+    embedding_response = await asgi_client.post(
+        "/api/v1/providers/embedding-dimension",
+        json={"provider_id": provider_id, "provider_config": {"model": "model/a"}},
+        headers=headers,
+    )
+    source_models_response = await asgi_client.get(
+        "/api/v1/provider-sources/models",
+        params={"source_id": source_id},
+        headers=headers,
+    )
+    source_providers_response = await asgi_client.get(
+        "/api/v1/provider-sources/providers",
+        params={"source_id": source_id},
+        headers=headers,
+    )
+
+    assert get_response.status_code == 200
+    assert get_response.json()["data"]["provider"]["id"] == provider_id
+    assert schema_response.status_code == 200
+    assert "config_schema" in schema_response.json()["data"]
+    assert path_test_response.status_code == 200
+    assert path_test_response.json()["data"]["status"] == "available"
+    assert safe_test_response.status_code == 200
+    assert safe_test_response.json()["data"]["status"] == "available"
+    assert provider_instance.tested is True
+    assert enabled_response.status_code == 200
+    assert config["provider"][-1]["enable"] is False
+    assert embedding_response.status_code == 400
+    assert embedding_response.json()["status"] == "error"
+    assert embedding_response.json()["message"] in {
+        "提供商适配器加载失败，请检查提供商类型配置或查看服务端日志",
+        "提供商不是 EmbeddingProvider 类型",
+    }
+    assert source_models_response.status_code == 200
+    assert source_models_response.json()["data"]["provider_source_id"] == source_id
+    assert source_providers_response.status_code == 200
+    assert source_providers_response.json()["data"]["providers"][0]["id"] == provider_id
+
+
+@pytest.mark.asyncio
+async def test_v1_safe_bot_routes_accept_slash_ids(
+    asgi_client: httpx.AsyncClient,
+    fake_core_lifecycle,
+    monkeypatch: pytest.MonkeyPatch,
+):
+    monkeypatch.setattr(config_service, "save_config", lambda *_args, **_kwargs: None)
+
+    bot_id = "group/a"
+    fake_core_lifecycle.astrbot_config["platform"].append(
+        {"id": bot_id, "type": "webchat", "enable": True}
+    )
+    headers = _jwt_headers()
+
+    get_response = await asgi_client.get(
+        "/api/v1/bots/by-id",
+        params={"bot_id": bot_id},
+        headers=headers,
+    )
+    enabled_response = await asgi_client.patch(
+        "/api/v1/bots/enabled",
+        json={"bot_id": bot_id, "enabled": False},
+        headers=headers,
+    )
+    test_response = await asgi_client.post(
+        "/api/v1/bots/test",
+        json={"bot_id": bot_id},
+        headers=headers,
+    )
+    delete_response = await asgi_client.delete(
+        "/api/v1/bots/by-id",
+        params={"bot_id": bot_id},
+        headers=headers,
+    )
+
+    assert get_response.status_code == 200
+    assert get_response.json()["data"]["bot"]["id"] == bot_id
+    assert enabled_response.status_code == 200
+    assert fake_core_lifecycle.platform_reload_configs[-1]["id"] == bot_id
+    assert fake_core_lifecycle.platform_reload_configs[-1]["enable"] is False
+    assert test_response.status_code == 200
+    assert test_response.json()["data"] == {"id": bot_id, "status": "unsupported"}
+    assert delete_response.status_code == 200
+    assert fake_core_lifecycle.terminated_platform_ids == [bot_id]
+
+
+@pytest.mark.asyncio
+async def test_v1_config_scope_includes_bot_and_provider(
+    asgi_client: httpx.AsyncClient,
+    fake_db: FakeDb,
+):
+    config_key = "abk_fastapi_v1_config"
+    fake_db.add_api_key(config_key, scopes=["config"])
+
+    bot_response = await asgi_client.get(
+        "/api/v1/bots",
+        headers={"X-API-Key": config_key},
+    )
+    provider_response = await asgi_client.get(
+        "/api/v1/providers/schema",
+        headers={"X-API-Key": config_key},
+    )
+
+    assert bot_response.status_code == 200
+    assert provider_response.status_code == 200
+
+    bot_key = "abk_fastapi_v1_bot"
+    fake_db.add_api_key(bot_key, scopes=["bot"])
+
+    response = await asgi_client.get(
+        "/api/v1/bots",
+        headers={"X-API-Key": bot_key},
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["status"] == "ok"
+    assert isinstance(data["data"]["bots"], list)
+    assert fake_db.touched_key_ids == ["config-key", "config-key", "config-key"]
+
+
+@pytest.mark.asyncio
+async def test_dashboard_alias_route_still_works_through_asgi_app(
+    asgi_client: httpx.AsyncClient,
+):
+    response = await asgi_client.get("/api/stat/start-time")
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["status"] == "ok"
+    assert data["data"]["start_time"] == 1234567890
+
+
+@pytest.mark.asyncio
+async def test_v1_plugins_accept_api_key(
+    asgi_client: httpx.AsyncClient,
+    fake_db: FakeDb,
+):
+    raw_key = "abk_fastapi_v1_plugin"
+    fake_db.add_api_key(raw_key, scopes=["plugin"])
+
+    response = await asgi_client.get(
+        "/api/v1/plugins",
+        headers={"X-API-Key": raw_key},
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["status"] == "ok"
+    assert [item["name"] for item in data["data"]] == ["astrbot_plugin_demo"]
+
+
+@pytest.mark.asyncio
+async def test_v1_plugin_enabled_patch_calls_service(
+    asgi_client: httpx.AsyncClient,
+    fake_core_lifecycle,
+):
+    response = await asgi_client.patch(
+        "/api/v1/plugins/astrbot_plugin_demo/enabled",
+        json={"enabled": False},
+        headers=_jwt_headers(),
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["status"] == "ok"
+    assert data["message"] == "停用成功。"
+    plugin = fake_core_lifecycle.plugin_manager.context.get_all_stars()[0]
+    assert plugin.activated is False
+
+
+@pytest.mark.asyncio
+async def test_v1_plugin_version_support_check_uses_service(
+    asgi_client: httpx.AsyncClient,
+):
+    response = await asgi_client.post(
+        "/api/v1/plugins/version-support/check",
+        json={"plugin_ids": ["astrbot_plugin_demo"]},
+        headers=_jwt_headers(),
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["status"] == "ok"
+    assert data["data"] == {
+        "supported": True,
+        "message": "supported: ",
+        "astrbot_version": "",
+    }
+
+
+@pytest.mark.asyncio
+async def test_v1_plugin_url_install_accepts_download_url_and_missing_body(
+    asgi_app: FastAPI,
+    asgi_client: httpx.AsyncClient,
+    monkeypatch: pytest.MonkeyPatch,
+):
+    captured_payloads = []
+    plugin_service = asgi_app.state.services.plugins
+
+    async def fake_install_plugin(payload):
+        captured_payloads.append(payload)
+        if not payload.get("url"):
+            raise RuntimeError("missing url")
+        return {"name": "astrbot_plugin_demo"}, "安装成功。"
+
+    monkeypatch.setattr(plugin_service, "install_plugin", fake_install_plugin)
+
+    response = await asgi_client.post(
+        "/api/v1/plugins/install/url",
+        json={
+            "url": "https://github.com/AstrBotDevs/astrbot-plugin-demo",
+            "download_url": "https://cdn.example/plugin.zip",
+            "ignore_version_check": True,
+        },
+        headers=_jwt_headers(),
+    )
+    empty_body_response = await asgi_client.post(
+        "/api/v1/plugins/install/url",
+        headers=_jwt_headers(),
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["status"] == "ok"
+    assert captured_payloads[0] == {
+        "url": "https://github.com/AstrBotDevs/astrbot-plugin-demo",
+        "download_url": "https://cdn.example/plugin.zip",
+        "proxy": None,
+        "ignore_version_check": True,
+    }
+    assert empty_body_response.status_code == 200
+    empty_body_data = empty_body_response.json()
+    assert empty_body_data["status"] == "error"
+    assert empty_body_data["message"] == "插件操作失败，请查看服务端日志。"
+    assert "missing url" not in str(empty_body_data)
+
+
+@pytest.mark.asyncio
+async def test_v1_plugin_update_all_hides_internal_exceptions(
+    asgi_client: httpx.AsyncClient,
+):
+    response = await asgi_client.post(
+        "/api/v1/plugins/update",
+        json={"plugin_ids": ["astrbot_plugin_demo"]},
+        headers=_jwt_headers(),
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["status"] == "ok"
+    result = data["data"]["results"][0]
+    assert result["status"] == "error"
+    assert result["message"] == "更新失败，请查看服务端日志。"
+    assert "AttributeError" not in str(data)
+    assert "update_plugin" not in str(data)
+
+
+@pytest.mark.asyncio
+async def test_v1_plugin_extension_maps_nested_plugin_path(
+    asgi_client: httpx.AsyncClient,
+):
+    response = await asgi_client.post(
+        "/api/v1/plugins/extensions/astrbot_plugin_demo/api/action",
+        json={"value": "demo"},
+        headers=_jwt_headers(),
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["status"] == "ok"
+    assert data["data"] == {
+        "plugin_path": "astrbot_plugin_demo/api/action",
+        "method": "POST",
+        "payload": {"value": "demo"},
+        "username": "fastapi-v1-test",
+    }
+
+
+@pytest.mark.asyncio
+async def test_v1_plugin_extension_supports_astrbot_web_api(
+    asgi_client: httpx.AsyncClient,
+    fake_core_lifecycle,
+):
+    from astrbot.api.web import json_response
+    from astrbot.api.web import request as plugin_request
+
+    async def astrbot_web_plugin_extension(item_id: str):
+        return json_response(
+            {
+                "item_id": item_id,
+                "path_value": plugin_request.path_params["item_id"],
+                "path": plugin_request.path,
+                "method": plugin_request.method,
+                "limit": plugin_request.query.get("limit", 20, type=int),
+                "tags": plugin_request.query.getlist("tag"),
+                "payload": await plugin_request.json(default={}),
+                "username": plugin_request.username,
+                "plugin_name": plugin_request.plugin_name,
+            },
+            status_code=201,
+        )
+
+    fake_core_lifecycle.star_context.registered_web_apis = [
+        ("/web/<item_id>", astrbot_web_plugin_extension, ["POST"], "web")
+    ]
+
+    response = await asgi_client.post(
+        "/api/v1/plugins/extensions/web/demo-item?limit=7&tag=one&tag=two",
+        json={"value": "demo"},
+        headers=_jwt_headers(),
+    )
+
+    assert response.status_code == 201
+    data = response.json()
+    assert data == {
+        "item_id": "demo-item",
+        "path_value": "demo-item",
+        "path": "/api/v1/plugins/extensions/web/demo-item",
+        "method": "POST",
+        "limit": 7,
+        "tags": ["one", "two"],
+        "payload": {"value": "demo"},
+        "username": "fastapi-v1-test",
+        "plugin_name": "web",
+    }
+
+
+@pytest.mark.asyncio
+async def test_v1_plugin_extension_astrbot_web_api_reads_form_and_files(
+    asgi_client: httpx.AsyncClient,
+    fake_core_lifecycle,
+):
+    from astrbot.api.web import PluginUploadFile, json_response
+    from astrbot.api.web import request as plugin_request
+
+    async def astrbot_web_upload_extension():
+        form = await plugin_request.form()
+        files = await plugin_request.files()
+        upload: PluginUploadFile | None = files.get("file")
+        assert isinstance(upload, PluginUploadFile)
+        return json_response(
+            {
+                "tags": form.getlist("tag"),
+                "filename": upload.filename,
+                "content_type": upload.content_type,
+                "content": (await upload.read()).decode("utf-8"),
+            }
+        )
+
+    fake_core_lifecycle.star_context.registered_web_apis = [
+        ("/upload", astrbot_web_upload_extension, ["POST"], "upload")
+    ]
+
+    response = await asgi_client.post(
+        "/api/v1/plugins/extensions/upload",
+        files=[
+            ("tag", (None, "one")),
+            ("tag", (None, "two")),
+            ("file", ("demo.txt", b"hello", "text/plain")),
+        ],
+        headers=_jwt_headers(),
+    )
+
+    assert response.status_code == 200
+    assert response.json() == {
+        "tags": ["one", "two"],
+        "filename": "demo.txt",
+        "content_type": "text/plain",
+        "content": "hello",
+    }
+
+
+def test_astrbot_web_request_requires_plugin_context():
+    from astrbot.api.web import request as plugin_request
+
+    with pytest.raises(RuntimeError, match="plugin Web API handler"):
+        _ = plugin_request.method
+
+
+def test_astrbot_web_request_proxy_exposes_typed_methods():
+    from typing import get_type_hints
+
+    from astrbot.api.web import (
+        PluginMultiDict,
+        PluginRequestProxy,
+        PluginUploadFile,
+    )
+    from astrbot.api.web import request as plugin_request
+
+    assert isinstance(plugin_request, PluginRequestProxy)
+    assert get_type_hints(type(plugin_request).form)["return"] == PluginMultiDict[str]
+    assert get_type_hints(type(plugin_request).files)["return"] == PluginMultiDict[
+        PluginUploadFile
+    ]
+
+
+@pytest.mark.asyncio
+async def test_v1_plugin_extension_supports_quart_request_context(
+    asgi_client: httpx.AsyncClient,
+    fake_core_lifecycle,
+):
+    from quart import g as quart_g
+    from quart import jsonify as quart_jsonify
+    from quart import request as quart_request
+
+    async def quart_plugin_extension(item_id: str):
+        return quart_jsonify(
+            {
+                "status": "ok",
+                "data": {
+                    "item_id": item_id,
+                    "path": quart_request.path,
+                    "method": quart_request.method,
+                    "source": quart_request.args.get("source"),
+                    "payload": await quart_request.get_json(),
+                    "username": quart_g.username,
+                },
+            }
+        )
+
+    fake_core_lifecycle.star_context.registered_web_apis = [
+        ("/quart/<item_id>", quart_plugin_extension, ["POST"], "quart")
+    ]
+
+    response = await asgi_client.post(
+        "/api/v1/plugins/extensions/quart/demo-item?source=v1",
+        json={"value": "demo"},
+        headers=_jwt_headers(),
+    )
+
+    assert response.status_code == 200
+    assert response.headers["content-type"].startswith("application/json")
+    data = response.json()
+    assert data["status"] == "ok"
+    assert data["data"] == {
+        "item_id": "demo-item",
+        "path": "/api/plug/quart/demo-item",
+        "method": "POST",
+        "source": "v1",
+        "payload": {"value": "demo"},
+        "username": "fastapi-v1-test",
+    }
+
+
+@pytest.mark.asyncio
+async def test_multipart_parts_preserves_duplicate_form_values():
+    from starlette.datastructures import FormData
+
+    from astrbot.dashboard.api.multipart import multipart_parts
+
+    class FakeRequest:
+        async def form(self):
+            return FormData([("tag", "one"), ("tag", "two")])
+
+    form, files = await multipart_parts(FakeRequest())
+
+    assert form.getlist("tag") == ["one", "two"]
+    assert not files
+
+
+@pytest.mark.asyncio
+async def test_v1_plugin_config_file_routes_reach_service_layer(
+    asgi_client: httpx.AsyncClient,
+):
+    headers = _jwt_headers()
+
+    list_response = await asgi_client.get(
+        "/api/v1/plugins/astrbot_plugin_demo/config-files/assets",
+        headers=headers,
+    )
+    upload_response = await asgi_client.post(
+        "/api/v1/plugins/astrbot_plugin_demo/config-files/assets",
+        json={"filename": "demo.txt"},
+        headers=headers,
+    )
+    delete_response = await asgi_client.request(
+        "DELETE",
+        "/api/v1/plugins/astrbot_plugin_demo/config-files",
+        json={"path": "demo.txt"},
+        headers=headers,
+    )
+
+    assert list_response.status_code == 400
+    assert list_response.json()["status"] == "error"
+    assert upload_response.status_code == 400
+    assert upload_response.json()["status"] == "error"
+    assert delete_response.status_code == 400
+    assert delete_response.json()["status"] == "error"
+
+
+@pytest.mark.asyncio
+async def test_v1_safe_plugin_routes_accept_slash_ids(
+    asgi_app: FastAPI,
+    asgi_client: httpx.AsyncClient,
+    monkeypatch: pytest.MonkeyPatch,
+):
+    plugin_id = "plugin/foo"
+    headers = _jwt_headers()
+    plugin_service = asgi_app.state.services.plugins
+    config_display_service = asgi_app.state.services.config_display
+    config_file_service = asgi_app.state.services.config_files
+
+    async def fake_get_plugin_detail(**kwargs):
+        return {"name": kwargs["plugin_name"]}
+
+    async def fake_set_plugin_enabled(data, *, enabled: bool):
+        return {"payload": {"name": data["name"], "enabled": enabled}}
+
+    async def fake_update_plugin(data):
+        return {"payload": data}
+
+    def fake_get_plugin_readme(name: str):
+        return {"name": name, "content": "readme"}, "ok"
+
+    async def fake_get_configs(name: str):
+        return {"schema": {"name": name}}
+
+    def fake_list_config_files(*, scope: str, name: str, key_path: str):
+        return {"scope": scope, "name": name, "key": key_path}
+
+    monkeypatch.setattr(plugin_service, "get_plugin_detail", fake_get_plugin_detail)
+    monkeypatch.setattr(plugin_service, "set_plugin_enabled", fake_set_plugin_enabled)
+    monkeypatch.setattr(plugin_service, "update_plugin", fake_update_plugin)
+    monkeypatch.setattr(plugin_service, "get_plugin_readme", fake_get_plugin_readme)
+    monkeypatch.setattr(config_display_service, "get_configs", fake_get_configs)
+    monkeypatch.setattr(
+        config_file_service,
+        "list_config_files",
+        fake_list_config_files,
+    )
+
+    detail_response = await asgi_client.get(
+        "/api/v1/plugins/by-id",
+        params={"plugin_id": plugin_id},
+        headers=headers,
+    )
+    enabled_response = await asgi_client.patch(
+        "/api/v1/plugins/enabled",
+        json={"plugin_id": plugin_id, "enabled": False},
+        headers=headers,
+    )
+    update_response = await asgi_client.post(
+        "/api/v1/plugins/update",
+        json={"plugin_id": plugin_id, "reinstall": True},
+        headers=headers,
+    )
+    readme_response = await asgi_client.get(
+        "/api/v1/plugins/readme",
+        params={"plugin_id": plugin_id},
+        headers=headers,
+    )
+    schema_response = await asgi_client.get(
+        "/api/v1/plugins/config/schema",
+        params={"plugin_id": plugin_id},
+        headers=headers,
+    )
+    config_files_response = await asgi_client.get(
+        "/api/v1/plugins/config-files",
+        params={"plugin_id": plugin_id, "config_key": "assets/path"},
+        headers=headers,
+    )
+
+    assert detail_response.status_code == 200
+    assert detail_response.json()["data"]["name"] == plugin_id
+    assert enabled_response.status_code == 200
+    assert enabled_response.json()["data"]["payload"] == {
+        "name": plugin_id,
+        "enabled": False,
+    }
+    assert update_response.status_code == 200
+    assert update_response.json()["data"]["payload"] == {
+        "name": plugin_id,
+        "reinstall": True,
+    }
+    assert readme_response.status_code == 200
+    assert readme_response.json()["data"]["name"] == plugin_id
+    assert schema_response.status_code == 200
+    assert schema_response.json()["data"]["plugin_name"] == plugin_id
+    assert config_files_response.status_code == 200
+    assert config_files_response.json()["data"] == {
+        "scope": "plugin",
+        "name": plugin_id,
+        "key": "assets/path",
+    }
+
+
+@pytest.mark.asyncio
+async def test_v1_safe_plugin_source_delete_accepts_slash_ids(
+    asgi_client: httpx.AsyncClient,
+    monkeypatch: pytest.MonkeyPatch,
+):
+    source_id = "https://example.com/source"
+    sources = [{"id": source_id}, {"id": "keep"}]
+
+    async def fake_global_get(_key, _default=None):
+        return list(sources)
+
+    async def fake_global_put(_key, value):
+        sources[:] = value
+
+    monkeypatch.setattr(
+        "astrbot.dashboard.services.plugin_service.sp.global_get",
+        fake_global_get,
+    )
+    monkeypatch.setattr(
+        "astrbot.dashboard.services.plugin_service.sp.global_put",
+        fake_global_put,
+    )
+
+    response = await asgi_client.delete(
+        "/api/v1/plugin-sources/by-id",
+        params={"source_id": source_id},
+        headers=_jwt_headers(),
+    )
+
+    assert response.status_code == 200
+    assert response.json()["data"]["sources"] == [{"id": "keep"}]
+
+
+@pytest.mark.asyncio
+async def test_v1_command_patch_updates_service(
+    asgi_app: FastAPI,
+    asgi_client: httpx.AsyncClient,
+    monkeypatch: pytest.MonkeyPatch,
+):
+    async def fake_toggle(handler_full_name: str | None, enabled):
+        return {
+            "handler_full_name": handler_full_name,
+            "enabled": enabled,
+        }
+
+    monkeypatch.setattr(
+        asgi_app.state.services.commands,
+        "toggle_command",
+        fake_toggle,
+    )
+
+    response = await asgi_client.patch(
+        "/api/v1/commands/plugin.handler",
+        json={"enabled": False},
+        headers=_jwt_headers(),
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["status"] == "ok"
+    assert data["data"] == {
+        "handler_full_name": "plugin.handler",
+        "enabled": False,
+    }
+
+
+@pytest.mark.asyncio
+async def test_v1_bot_type_registration_uses_platform_service(
+    asgi_app: FastAPI,
+    asgi_client: httpx.AsyncClient,
+    monkeypatch: pytest.MonkeyPatch,
+):
+    async def fake_registration(platform_type: str, payload: dict):
+        return {"platform_type": platform_type, "payload": payload}
+
+    monkeypatch.setattr(
+        asgi_app.state.services.platforms,
+        "handle_platform_registration",
+        fake_registration,
+    )
+
+    response = await asgi_client.post(
+        "/api/v1/bot-types/webchat/registration",
+        json={"registration_code": "abc123"},
+        headers=_jwt_headers(),
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["status"] == "ok"
+    assert data["data"] == {
+        "platform_type": "webchat",
+        "payload": {"registration_code": "abc123"},
+    }
+
+
+@pytest.mark.asyncio
+async def test_v1_token_file_is_public(
+    asgi_client: httpx.AsyncClient,
+    tmp_path: Path,
+):
+    token_file = tmp_path / "token-file.txt"
+    token_file.write_text("token:demo-token", encoding="utf-8")
+    file_token = await file_token_service.register_file(str(token_file), timeout=60)
+
+    response = await asgi_client.get(f"/api/v1/files/tokens/{file_token}")
+
+    assert response.status_code == 200
+    assert response.text == "token:demo-token"
+    assert response.headers["content-type"].startswith("text/plain")
+
+
+def test_v1_openapi_alias_websocket_routes_are_mounted(asgi_app):
+    websocket_paths = {
+        route.path
+        for route in asgi_app.router.routes
+        if "websocket" in route.__class__.__name__.lower()
+    }
+
+    assert "/api/v1/chat/ws" in websocket_paths
+    assert "/api/v1/live-chat/ws" in websocket_paths
+    assert "/api/v1/unified-chat/ws" in websocket_paths
+
+
+def test_dashboard_config_aliases_are_registered_on_fastapi(asgi_app):
+    http_paths = {
+        route.path
+        for route in asgi_app.router.routes
+        if "route" in route.__class__.__name__.lower()
+    }
+
+    assert "/api/config/platform/list" in http_paths
+    assert "/api/config/provider/list" in http_paths
+    assert "/api/config/provider_sources/update" in http_paths
+
+
+@pytest.mark.asyncio
+async def test_v1_mcp_enabled_patch_updates_stored_active_flag(
+    asgi_client: httpx.AsyncClient,
+    fake_core_lifecycle,
+):
+    response = await asgi_client.patch(
+        "/api/v1/mcp/servers/demo-server/enabled",
+        json={"enabled": False},
+        headers=_jwt_headers(),
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["status"] == "ok"
+    assert data["message"] == "Successfully updated MCP server demo-server"
+    mcp_servers = fake_core_lifecycle.provider_manager.llm_tools.config["mcpServers"]
+    assert mcp_servers["demo-server"]["active"] is False
+
+
+@pytest.mark.asyncio
+async def test_v1_safe_mcp_routes_accept_slash_server_names(
+    asgi_client: httpx.AsyncClient,
+    fake_core_lifecycle,
+):
+    server_name = "modelscope/demo"
+    headers = _jwt_headers()
+    fake_tools = fake_core_lifecycle.provider_manager.llm_tools
+
+    enabled_response = await asgi_client.patch(
+        "/api/v1/mcp/servers/enabled",
+        json={"server_name": server_name, "enabled": False},
+        headers=headers,
+    )
+    assert enabled_response.status_code == 200
+    assert fake_tools.config["mcpServers"][server_name]["active"] is False
+
+    test_response = await asgi_client.post(
+        "/api/v1/mcp/servers/test",
+        json={"server_name": server_name},
+        headers=headers,
+    )
+    assert test_response.status_code == 200
+    assert test_response.json()["data"] == ["demo_tool"]
+    assert fake_tools.tested_configs[-1] == {
+        "active": False,
+        "url": "https://example.com/modelscope-demo",
+    }
+
+    delete_response = await asgi_client.delete(
+        "/api/v1/mcp/servers/by-name",
+        params={"server_name": server_name},
+        headers=headers,
+    )
+    assert delete_response.status_code == 200
+    assert server_name not in fake_tools.config["mcpServers"]
+
+    sync_response = await asgi_client.post(
+        "/api/v1/mcp/providers/modelscope/sync",
+        json={"access_token": "token"},
+        headers=headers,
+    )
+    assert sync_response.status_code == 200
+    assert fake_tools.synced_modelscope_tokens == ["token"]
+
+
+@pytest.mark.asyncio
+async def test_v1_mcp_scope_accepts_api_key(
+    asgi_client: httpx.AsyncClient,
+    fake_db: FakeDb,
+):
+    raw_key = "abk_fastapi_v1_mcp"
+    fake_db.add_api_key(raw_key, scopes=["mcp"])
+
+    response = await asgi_client.get(
+        "/api/v1/mcp/servers",
+        headers={"X-API-Key": raw_key},
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["status"] == "ok"
+    assert any(server["name"] == "demo-server" for server in data["data"])
+
+
+@pytest.mark.asyncio
+async def test_v1_skill_scope_accepts_api_key_and_rejects_plural_scope(
+    asgi_app: FastAPI,
+    asgi_client: httpx.AsyncClient,
+    fake_db: FakeDb,
+    monkeypatch: pytest.MonkeyPatch,
+):
+    monkeypatch.setattr(
+        asgi_app.state.services.skills,
+        "get_skills",
+        lambda: {"skills": [{"name": "demo_skill"}]},
+    )
+
+    plural_key = "abk_fastapi_v1_skills"
+    fake_db.add_api_key(plural_key, scopes=["skills"])
+    plural_response = await asgi_client.get(
+        "/api/v1/skills",
+        headers={"X-API-Key": plural_key},
+    )
+
+    assert plural_response.status_code == 403
+    data = plural_response.json()
+    assert data["status"] == "error"
+    assert data["message"] == "Insufficient API key scope"
+
+    raw_key = "abk_fastapi_v1_skill"
+    fake_db.add_api_key(raw_key, scopes=["skill"])
+    response = await asgi_client.get(
+        "/api/v1/skills",
+        headers={"X-API-Key": raw_key},
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["status"] == "ok"
+    assert data["data"]["skills"] == [{"name": "demo_skill"}]
+
+
+@pytest.mark.asyncio
+async def test_v1_safe_skill_routes_accept_slash_names(
+    asgi_app: FastAPI,
+    asgi_client: httpx.AsyncClient,
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+):
+    skill_name = "skill/foo"
+    headers = _jwt_headers()
+    skill_service = asgi_app.state.services.skills
+    archive_path = tmp_path / "skill.zip"
+    archive_path.write_bytes(b"zip")
+
+    async def fake_update_skill(data):
+        return {"payload": data}
+
+    async def fake_delete_skill(data):
+        return {"payload": data}
+
+    def fake_prepare_skill_archive(name: str):
+        assert name == skill_name
+        return SkillArchive(path=archive_path, filename="skill.zip")
+
+    def fake_list_skill_files(name: str, path: str):
+        return {"name": name, "path": path}
+
+    def fake_get_skill_file(name: str, path: str):
+        return {"name": name, "path": path}
+
+    async def fake_update_skill_file(data):
+        return {"payload": data}
+
+    monkeypatch.setattr(skill_service, "update_skill", fake_update_skill)
+    monkeypatch.setattr(skill_service, "delete_skill", fake_delete_skill)
+    monkeypatch.setattr(
+        skill_service,
+        "prepare_skill_archive",
+        fake_prepare_skill_archive,
+    )
+    monkeypatch.setattr(skill_service, "list_skill_files", fake_list_skill_files)
+    monkeypatch.setattr(skill_service, "get_skill_file", fake_get_skill_file)
+    monkeypatch.setattr(skill_service, "update_skill_file", fake_update_skill_file)
+
+    enabled_response = await asgi_client.patch(
+        "/api/v1/skills/by-name",
+        json={"skill_name": skill_name, "enabled": False},
+        headers=headers,
+    )
+    archive_response = await asgi_client.get(
+        "/api/v1/skills/archive",
+        params={"skill_name": skill_name},
+        headers=headers,
+    )
+    files_response = await asgi_client.get(
+        "/api/v1/skills/files",
+        params={"skill_name": skill_name, "path": "src"},
+        headers=headers,
+    )
+    file_response = await asgi_client.get(
+        "/api/v1/skills/file",
+        params={"skill_name": skill_name, "path": "src/main.py"},
+        headers=headers,
+    )
+    update_file_response = await asgi_client.put(
+        "/api/v1/skills/file",
+        json={"skill_name": skill_name, "path": "src/main.py", "content": "print(1)"},
+        headers=headers,
+    )
+    delete_response = await asgi_client.delete(
+        "/api/v1/skills/by-name",
+        params={"skill_name": skill_name},
+        headers=headers,
+    )
+
+    assert enabled_response.status_code == 200
+    assert enabled_response.json()["data"]["payload"] == {
+        "name": skill_name,
+        "active": False,
+    }
+    assert archive_response.status_code == 200
+    assert archive_response.content == b"zip"
+    assert files_response.status_code == 200
+    assert files_response.json()["data"] == {"name": skill_name, "path": "src"}
+    assert file_response.status_code == 200
+    assert file_response.json()["data"] == {
+        "name": skill_name,
+        "path": "src/main.py",
+    }
+    assert update_file_response.status_code == 200
+    assert update_file_response.json()["data"]["payload"] == {
+        "name": skill_name,
+        "path": "src/main.py",
+        "content": "print(1)",
+    }
+    assert delete_response.status_code == 200
+    assert delete_response.json()["data"]["payload"] == {"name": skill_name}
+
+
+@pytest.mark.asyncio
+async def test_v1_safe_persona_routes_accept_slash_ids(
+    asgi_client: httpx.AsyncClient,
+    fake_core_lifecycle,
+):
+    persona_id = "persona/foo"
+    headers = _jwt_headers()
+    persona_mgr = fake_core_lifecycle.persona_mgr
+
+    detail_response = await asgi_client.get(
+        "/api/v1/personas/by-id",
+        params={"persona_id": persona_id},
+        headers=headers,
+    )
+    update_response = await asgi_client.put(
+        "/api/v1/personas/by-id",
+        json={"persona_id": persona_id, "name": "Demo Persona"},
+        headers=headers,
+    )
+    delete_response = await asgi_client.delete(
+        "/api/v1/personas/by-id",
+        params={"persona_id": persona_id},
+        headers=headers,
+    )
+
+    assert detail_response.status_code == 200
+    assert detail_response.json()["data"]["persona_id"] == persona_id
+    assert detail_response.json()["data"]["system_prompt"] == "Demo persona"
+    assert update_response.status_code == 200
+    assert update_response.json()["data"] == {"message": "人格更新成功"}
+    assert delete_response.status_code == 200
+    assert delete_response.json()["data"] == {"message": "人格删除成功"}
+    assert persona_id not in persona_mgr.personas
+
+
+@pytest.mark.asyncio
+async def test_v1_im_routes_use_im_scope_and_running_platform(
+    asgi_client: httpx.AsyncClient,
+    fake_core_lifecycle,
+    fake_db: FakeDb,
+):
+    raw_key = "abk_fastapi_v1_im"
+    fake_db.add_api_key(raw_key, scopes=["im"])
+
+    bots_response = await asgi_client.get(
+        "/api/v1/im/bots",
+        headers={"X-API-Key": raw_key},
+    )
+    send_response = await asgi_client.post(
+        "/api/v1/im/messages",
+        json={
+            "umo": "webchat-main:FriendMessage:test-session",
+            "message": "hello",
+        },
+        headers={"X-API-Key": raw_key},
+    )
+
+    assert bots_response.status_code == 200
+    assert send_response.status_code == 200
+    assert bots_response.json()["data"]["bot_ids"] == ["webchat-main"]
+    sent_messages = fake_core_lifecycle.platform_manager.fake_platform.sent_messages
+    assert len(sent_messages) == 1
+    session, message_chain = sent_messages[0]
+    assert str(session) == "webchat-main:FriendMessage:test-session"
+    assert message_chain.chain[0].text == "hello"
+
+
+@pytest.mark.asyncio
+async def test_v1_platform_webhook_is_public_route(
+    asgi_client: httpx.AsyncClient,
+):
+    response = await asgi_client.post(
+        "/api/v1/webhooks/platforms/demo-hook",
+        json={"challenge": "ping"},
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["status"] == "ok"
+    assert data["data"] == {
+        "webhook_uuid": "demo-hook",
+        "method": "POST",
+        "payload": {"challenge": "ping"},
+    }
diff --git a/tests/test_kb_import.py b/tests/test_kb_import.py
index 8795b06da..702c5a728 100644
--- a/tests/test_kb_import.py
+++ b/tests/test_kb_import.py
@@ -3,7 +3,6 @@ from unittest.mock import AsyncMock, MagicMock
 
 import pytest
 import pytest_asyncio
-from quart import Quart
 
 from astrbot.core import LogBroker
 from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
@@ -13,10 +12,11 @@ from astrbot.core.knowledge_base.kb_helper import KBHelper
 from astrbot.core.knowledge_base.models import KBDocument
 from astrbot.core.utils.auth_password import (
     hash_dashboard_password,
-    hash_legacy_dashboard_password,
+    hash_md5_dashboard_password,
 )
-from astrbot.dashboard.routes.knowledge_base import KnowledgeBaseRoute
+from astrbot.dashboard.asgi_runtime import FastAPIAppAdapter
 from astrbot.dashboard.server import AstrBotDashboard
+from astrbot.dashboard.services.knowledge_base_service import KnowledgeBaseService
 
 _TEST_DASHBOARD_PASSWORD = "AstrbotTest123"
 
@@ -63,7 +63,7 @@ async def core_lifecycle_td(tmp_path_factory):
             hash_dashboard_password(dashboard_password)
         )
         core_lifecycle.astrbot_config["dashboard"]["password"] = (
-            hash_legacy_dashboard_password(dashboard_password)
+            hash_md5_dashboard_password(dashboard_password)
         )
     object.__setattr__(
         core_lifecycle,
@@ -84,7 +84,7 @@ async def core_lifecycle_td(tmp_path_factory):
 
 @pytest.fixture(scope="module")
 def app(core_lifecycle_td: AstrBotCoreLifecycle):
-    """Creates a Quart app instance for testing."""
+    """Creates a FastAPIAppAdapter app instance for testing."""
     shutdown_event = asyncio.Event()
     server = AstrBotDashboard(core_lifecycle_td, core_lifecycle_td.db, shutdown_event)
     return server.app
@@ -101,7 +101,9 @@ def _resolve_dashboard_password(core_lifecycle_td: AstrBotCoreLifecycle) -> str:
 
 
 @pytest_asyncio.fixture(scope="module")
-async def authenticated_header(app: Quart, core_lifecycle_td: AstrBotCoreLifecycle):
+async def authenticated_header(
+    app: FastAPIAppAdapter, core_lifecycle_td: AstrBotCoreLifecycle
+):
     """Handles login and returns an authenticated header."""
     test_client = app.test_client()
     response = await test_client.post(
@@ -119,7 +121,9 @@ async def authenticated_header(app: Quart, core_lifecycle_td: AstrBotCoreLifecyc
 
 @pytest.mark.asyncio
 async def test_import_documents(
-    app: Quart, authenticated_header: dict, core_lifecycle_td: AstrBotCoreLifecycle
+    app: FastAPIAppAdapter,
+    authenticated_header: dict,
+    core_lifecycle_td: AstrBotCoreLifecycle,
 ):
     """Tests the import documents functionality."""
     test_client = app.test_client()
@@ -198,12 +202,12 @@ async def test_import_documents_returns_friendly_failure_message(
         details={"expected_contents": 2, "actual_vectors": 1},
     )
 
-    route = KnowledgeBaseRoute.__new__(KnowledgeBaseRoute)
-    route.upload_progress = {}
-    route.upload_tasks = {}
+    service = KnowledgeBaseService.__new__(KnowledgeBaseService)
+    service.upload_progress = {}
+    service.upload_tasks = {}
 
-    await KnowledgeBaseRoute._background_import_task(
-        route,
+    await KnowledgeBaseService.background_import_task(
+        service,
         task_id="task-1",
         kb_helper=kb_helper,
         documents=[{"file_name": "broken.txt", "chunks": ["chunk1", "chunk2"]}],
@@ -212,8 +216,8 @@ async def test_import_documents_returns_friendly_failure_message(
         max_retries=3,
     )
 
-    assert route.upload_tasks["task-1"]["status"] == "completed"
-    result = route.upload_tasks["task-1"]["result"]
+    assert service.upload_tasks["task-1"]["status"] == "completed"
+    result = service.upload_tasks["task-1"]["result"]
     assert result["success_count"] == 0
     assert result["failed_count"] == 1
     assert result["failed"][0]["file_name"] == "broken.txt"
@@ -227,7 +231,9 @@ async def test_import_documents_returns_friendly_failure_message(
 
 
 @pytest.mark.asyncio
-async def test_import_documents_invalid_input(app: Quart, authenticated_header: dict):
+async def test_import_documents_invalid_input(
+    app: FastAPIAppAdapter, authenticated_header: dict
+):
     """Tests import documents with invalid input."""
     test_client = app.test_client()
 
diff --git a/tests/test_kook/shared.py b/tests/test_kook/shared.py
index 366b608db..fac70a267 100644
--- a/tests/test_kook/shared.py
+++ b/tests/test_kook/shared.py
@@ -1,18 +1,15 @@
 import json
+from pathlib import Path
 from unittest.mock import AsyncMock, MagicMock
-from unittest.mock import AsyncMock
-
 
 import aiohttp
+
 from astrbot.api.platform import AstrBotMessage, MessageType
 from astrbot.core.message.components import (
     File,
     Record,
 )
 
-
-from pathlib import Path
-
 CURRENT_DIR = Path(__file__).parent
 TEST_DATA_DIR = CURRENT_DIR / "data"
 
@@ -32,7 +29,9 @@ class KookEventDataPath:
     RECONNECT_ERR = TEST_DATA_DIR / "kook_ws_event_reconnect_err.json"
     RESUME_ACK = TEST_DATA_DIR / "kook_ws_event_resume_ack.json"
     RESUME = TEST_DATA_DIR / "kook_ws_event_resume.json"
-    GROUP_SYSTEM_MESSAGE_UPDATE_ROLE = TEST_DATA_DIR / "kook_ws_event_group_system_message_update_role.json"
+    GROUP_SYSTEM_MESSAGE_UPDATE_ROLE = (
+        TEST_DATA_DIR / "kook_ws_event_group_system_message_update_role.json"
+    )
 
 
 class KookApiDataPath:
diff --git a/tests/test_kook/test_kook_event.py b/tests/test_kook/test_kook_event.py
index 616d596c8..dc81ebafa 100644
--- a/tests/test_kook/test_kook_event.py
+++ b/tests/test_kook/test_kook_event.py
@@ -1,19 +1,18 @@
 import json
 
 import pytest
+
 from astrbot.api.platform import PlatformMetadata, Unknown
 from astrbot.core.message.components import (
-    Image,
-    Plain,
-    Video,
     At,
     AtAll,
     BaseMessageComponent,
+    Image,
     Json,
+    Plain,
     Reply,
+    Video,
 )
-
-
 from astrbot.core.platform.sources.kook.kook_event import KookEvent
 from astrbot.core.platform.sources.kook.kook_types import KookMessageType, OrderMessage
 from tests.test_kook.shared import (
@@ -162,7 +161,7 @@ async def test_kook_event_warp_message(
     try:
         expected_output_text = json.loads(expected_output_text)
         is_json_text = True
-    except:
+    except (TypeError, json.JSONDecodeError):
         pass
 
     if is_json_text:
diff --git a/tests/test_kook/test_kook_types.py b/tests/test_kook/test_kook_types.py
index 89568168a..5cfef4b79 100644
--- a/tests/test_kook/test_kook_types.py
+++ b/tests/test_kook/test_kook_types.py
@@ -17,6 +17,7 @@ from astrbot.core.platform.sources.kook.kook_types import (
     KmarkdownElement,
     KookApiResponseBase,
     KookCardMessage,
+    KookCardMessageContainer,
     KookMessageSignal,
     KookModuleType,
     KookUserMeResponse,
@@ -25,7 +26,6 @@ from astrbot.core.platform.sources.kook.kook_types import (
     ParagraphStructure,
     PlainTextElement,
     SectionModule,
-    KookCardMessageContainer,
 )
 from tests.test_kook.shared import TEST_DATA_DIR, KookApiDataPath, KookEventDataPath
 
diff --git a/tests/test_main.py b/tests/test_main.py
index f7fa205dc..ae6036631 100644
--- a/tests/test_main.py
+++ b/tests/test_main.py
@@ -180,7 +180,6 @@ async def test_check_dashboard_files_exists_but_version_mismatch(monkeypatch):
     with mock.patch(
         "main.get_dashboard_version", mock.AsyncMock(return_value="v0.0.1")
     ):
-
         with mock.patch("main.logger.warning") as mock_logger_warning:
             await check_dashboard_files()
             mock_logger_warning.assert_called_once()
diff --git a/tests/test_profile_aware_tools.py b/tests/test_profile_aware_tools.py
index 86468c345..8d5db3a55 100644
--- a/tests/test_profile_aware_tools.py
+++ b/tests/test_profile_aware_tools.py
@@ -7,7 +7,6 @@ from unittest.mock import patch
 
 import pytest
 
-
 # ═══════════════════════════════════════════════════════════════
 # ShipyardNeoBooter.capabilities
 # ═══════════════════════════════════════════════════════════════
@@ -93,9 +92,7 @@ class TestApplySandboxToolsConditional:
         config = _make_config("shipyard_neo")
         req = _make_req()
 
-        with patch(
-            "astrbot.core.computer.computer_client.session_booter", {}
-        ):
+        with patch("astrbot.core.computer.computer_client.session_booter", {}):
             fn(config, req, "session-1")
 
         names = self._tool_names(req)
@@ -126,9 +123,7 @@ class TestApplySandboxToolsConditional:
         fn = _import_apply_sandbox_tools()
         config = _make_config("shipyard_neo")
         req = _make_req()
-        fake_booter = SimpleNamespace(
-            capabilities=["python", "shell", "filesystem"]
-        )
+        fake_booter = SimpleNamespace(capabilities=["python", "shell", "filesystem"])
 
         with patch(
             "astrbot.core.computer.computer_client.session_booter",
diff --git a/tests/test_shipyard_neo_booter.py b/tests/test_shipyard_neo_booter.py
index b0d7ecc01..598a2aefe 100644
--- a/tests/test_shipyard_neo_booter.py
+++ b/tests/test_shipyard_neo_booter.py
@@ -8,7 +8,6 @@ from unittest.mock import AsyncMock, patch
 
 import pytest
 
-
 # ═══════════════════════════════════════════════════════════════
 # _wait_until_ready
 # ═══════════════════════════════════════════════════════════════
@@ -284,11 +283,12 @@ class TestGetBooterRebuild:
             _self._fs = SimpleNamespace()  # type: ignore[assignment]
             _self._python = SimpleNamespace()  # type: ignore[assignment]
 
-        with patch.object(
-            ShipyardNeoBooter, "boot", _fake_boot
-        ), patch(
-            "astrbot.core.computer.computer_client._sync_skills_to_sandbox",
-            AsyncMock(),
+        with (
+            patch.object(ShipyardNeoBooter, "boot", _fake_boot),
+            patch(
+                "astrbot.core.computer.computer_client._sync_skills_to_sandbox",
+                AsyncMock(),
+            ),
         ):
             await get_booter(ctx, "session-1")
 
@@ -327,12 +327,15 @@ class TestGetBooterRebuild:
             async def shutdown(self, **kwargs):
                 pass
 
-        with patch(
-            "astrbot.core.computer.booters.shipyard.ShipyardBooter",
-            _FakeShipyardBooter,
-        ), patch(
-            "astrbot.core.computer.computer_client._sync_skills_to_sandbox",
-            AsyncMock(),
+        with (
+            patch(
+                "astrbot.core.computer.booters.shipyard.ShipyardBooter",
+                _FakeShipyardBooter,
+            ),
+            patch(
+                "astrbot.core.computer.computer_client._sync_skills_to_sandbox",
+                AsyncMock(),
+            ),
         ):
             from astrbot.core.computer.computer_client import get_booter
 
diff --git a/tests/test_skill_manager_sandbox_cache.py b/tests/test_skill_manager_sandbox_cache.py
index 35fb60811..0369d6b0a 100644
--- a/tests/test_skill_manager_sandbox_cache.py
+++ b/tests/test_skill_manager_sandbox_cache.py
@@ -154,4 +154,3 @@ def test_sandbox_and_local_path_resolution_with_show_sandbox_path_false(
     assert local_skill_path.is_relative_to(skills_root)
     assert local_skill_path == skills_root / "custom-local" / "SKILL.md"
     assert by_name["python-sandbox"].path == "/app/skills/python-sandbox/SKILL.md"
-
diff --git a/tests/unit/test_aiocqhttp_reply.py b/tests/unit/test_aiocqhttp_reply.py
index 0e3aeada4..ac32bee6d 100644
--- a/tests/unit/test_aiocqhttp_reply.py
+++ b/tests/unit/test_aiocqhttp_reply.py
@@ -16,12 +16,13 @@ import pytest
 
 import astrbot.core.message.components as Comp
 from astrbot.core.message.message_event_result import MessageChain
-from astrbot.core.pipeline.respond.stage import RespondStage  # noqa: F401 — 预加载避免循环导入
+from astrbot.core.pipeline.respond.stage import (
+    RespondStage,  # noqa: F401 — 预加载避免循环导入
+)
 from astrbot.core.platform.sources.aiocqhttp.aiocqhttp_message_event import (
     AiocqhttpMessageEvent,
 )
 
-
 # ============================================================
 # Reply.toDict() 输出格式测试
 # ============================================================
@@ -193,7 +194,5 @@ def test_reply_to_dict_matches_onebot_v11_format():
     actual = reply.toDict()
 
     assert actual == expected, (
-        f"Reply.toDict() 输出不符合 OneBot V11 标准。\n"
-        f"期望: {expected}\n"
-        f"实际: {actual}"
+        f"Reply.toDict() 输出不符合 OneBot V11 标准。\n期望: {expected}\n实际: {actual}"
     )
diff --git a/tests/unit/test_cli_plugin_utils.py b/tests/unit/test_cli_plugin_utils.py
index 5d9007b87..8cf8673ad 100644
--- a/tests/unit/test_cli_plugin_utils.py
+++ b/tests/unit/test_cli_plugin_utils.py
@@ -86,7 +86,7 @@ def test_build_plug_list_local_version_equal_or_newer(monkeypatch, tmp_path):
     # 1. test if local version == remote version
     dir_equal = tmp_path / "dir_equal"
     write_metadata(dir_equal / "local-plugin", "local-plugin", "2.0.0")
-    
+
     plugins_equal = build_plug_list(dir_equal)
     plugins_equal_by_name = {p["name"]: p for p in plugins_equal}
     assert plugins_equal_by_name["local-plugin"]["status"] == PluginStatus.INSTALLED
@@ -94,7 +94,7 @@ def test_build_plug_list_local_version_equal_or_newer(monkeypatch, tmp_path):
     # 2. test if local version > remote version
     dir_newer = tmp_path / "dir_newer"
     write_metadata(dir_newer / "local-plugin", "local-plugin", "3.0.0")
-    
+
     plugins_newer = build_plug_list(dir_newer)
     plugins_newer_by_name = {p["name"]: p for p in plugins_newer}
     assert plugins_newer_by_name["local-plugin"]["status"] == PluginStatus.INSTALLED
@@ -108,4 +108,4 @@ def test_build_plug_list_non_existent_path(monkeypatch, tmp_path):
     plugins = build_plug_list(non_existent_dir)
 
     assert [plugin["name"] for plugin in plugins] == ["local-plugin", "remote-only"]
-    assert all(plugin["status"] == PluginStatus.NOT_INSTALLED for plugin in plugins)
\ No newline at end of file
+    assert all(plugin["status"] == PluginStatus.NOT_INSTALLED for plugin in plugins)
diff --git a/tests/unit/test_cron_manager.py b/tests/unit/test_cron_manager.py
index 9dd3fc34d..559697313 100644
--- a/tests/unit/test_cron_manager.py
+++ b/tests/unit/test_cron_manager.py
@@ -152,7 +152,9 @@ class TestAddBasicJob:
         assert sample_cron_job.job_id in cron_manager._basic_handlers
 
     @pytest.mark.asyncio
-    async def test_add_basic_job_with_timezone(self, cron_manager, mock_db, sample_cron_job):
+    async def test_add_basic_job_with_timezone(
+        self, cron_manager, mock_db, sample_cron_job
+    ):
         """Test adding a basic job with timezone."""
         mock_db.create_cron_job.return_value = sample_cron_job
 
@@ -189,7 +191,9 @@ class TestAddActiveJob:
         mock_db.create_cron_job.assert_called_once()
 
     @pytest.mark.asyncio
-    async def test_add_active_job_run_once(self, cron_manager, mock_db, sample_cron_job):
+    async def test_add_active_job_run_once(
+        self, cron_manager, mock_db, sample_cron_job
+    ):
         """Test adding a run-once active job with an invalid returned job."""
         sample_cron_job.job_type = "active_agent"
         sample_cron_job.run_once = True
@@ -292,7 +296,9 @@ class TestSyncFromDb:
         mock_db.list_cron_jobs.assert_called_once()
 
     @pytest.mark.asyncio
-    async def test_sync_from_db_skips_disabled(self, cron_manager, mock_db, sample_cron_job):
+    async def test_sync_from_db_skips_disabled(
+        self, cron_manager, mock_db, sample_cron_job
+    ):
         """Test that sync skips disabled jobs."""
         sample_cron_job.enabled = False
         mock_db.list_cron_jobs.return_value = [sample_cron_job]
@@ -304,7 +310,9 @@ class TestSyncFromDb:
         mock_schedule.assert_not_called()
 
     @pytest.mark.asyncio
-    async def test_sync_from_db_skips_non_persistent(self, cron_manager, mock_db, sample_cron_job):
+    async def test_sync_from_db_skips_non_persistent(
+        self, cron_manager, mock_db, sample_cron_job
+    ):
         """Test that sync skips non-persistent jobs."""
         sample_cron_job.persistent = False
         mock_db.list_cron_jobs.return_value = [sample_cron_job]
@@ -362,7 +370,9 @@ class TestScheduleJob:
     """Tests for _schedule_job method."""
 
     @pytest.mark.asyncio
-    async def test_schedule_job_basic(self, cron_manager, sample_cron_job, mock_context):
+    async def test_schedule_job_basic(
+        self, cron_manager, sample_cron_job, mock_context
+    ):
         """Test scheduling a basic job."""
         mock_db = cron_manager.db
         mock_db.list_cron_jobs = AsyncMock(return_value=[])
@@ -374,7 +384,9 @@ class TestScheduleJob:
         assert cron_manager.scheduler.get_job("test-job-id") is not None
 
     @pytest.mark.asyncio
-    async def test_schedule_job_with_timezone(self, cron_manager, sample_cron_job, mock_context):
+    async def test_schedule_job_with_timezone(
+        self, cron_manager, sample_cron_job, mock_context
+    ):
         """Test scheduling a job with timezone."""
         sample_cron_job.timezone = "America/New_York"
         mock_db = cron_manager.db
@@ -386,7 +398,9 @@ class TestScheduleJob:
         assert cron_manager.scheduler.get_job("test-job-id") is not None
 
     @pytest.mark.asyncio
-    async def test_schedule_job_invalid_timezone(self, cron_manager, sample_cron_job, mock_context):
+    async def test_schedule_job_invalid_timezone(
+        self, cron_manager, sample_cron_job, mock_context
+    ):
         """Test scheduling a job with invalid timezone."""
         sample_cron_job.timezone = "Invalid/Timezone"
         mock_db = cron_manager.db
@@ -486,7 +500,9 @@ class TestGetNextRunTime:
     """Tests for _get_next_run_time method."""
 
     @pytest.mark.asyncio
-    async def test_get_next_run_time_existing_job(self, cron_manager, sample_cron_job, mock_context):
+    async def test_get_next_run_time_existing_job(
+        self, cron_manager, sample_cron_job, mock_context
+    ):
         """Test getting next run time for existing job."""
         mock_db = cron_manager.db
         mock_db.list_cron_jobs = AsyncMock(return_value=[])
diff --git a/tests/unit/test_dashboard_util.py b/tests/unit/test_dashboard_util.py
index 48a10020a..8458c86f0 100644
--- a/tests/unit/test_dashboard_util.py
+++ b/tests/unit/test_dashboard_util.py
@@ -1,7 +1,6 @@
 """Tests for dashboard route utility helpers."""
 
-from astrbot.dashboard.routes.config import validate_config
-from astrbot.dashboard.routes.util import get_schema_item
+from astrbot.dashboard.services.config_service import get_schema_item, validate_config
 
 
 def test_get_schema_item_template_list_file_item():
diff --git a/tests/unit/test_group_chat_context_wiring.py b/tests/unit/test_group_chat_context_wiring.py
index 7d63e8de5..db6142dc0 100644
--- a/tests/unit/test_group_chat_context_wiring.py
+++ b/tests/unit/test_group_chat_context_wiring.py
@@ -157,7 +157,9 @@ async def test_on_message_skips_recording_when_command_handler_matched():
         handle_message=AsyncMock(),
     )
     event = make_event(
-        handlers_parsed_params={"astrbot.builtin_stars.builtin_commands.main_reset": {}},
+        handlers_parsed_params={
+            "astrbot.builtin_stars.builtin_commands.main_reset": {}
+        },
     )
 
     async for _ in main.on_message(event):
diff --git a/tests/unit/test_live_chat_service.py b/tests/unit/test_live_chat_service.py
new file mode 100644
index 000000000..031c30458
--- /dev/null
+++ b/tests/unit/test_live_chat_service.py
@@ -0,0 +1,142 @@
+from types import SimpleNamespace
+
+import pytest
+from starlette.websockets import WebSocketDisconnect
+
+from astrbot.dashboard.services.live_chat_service import LiveChatService
+
+
+def _service() -> LiveChatService:
+    core_lifecycle = SimpleNamespace(
+        astrbot_config={"dashboard": {"jwt_secret": "test-secret"}},
+        plugin_manager=SimpleNamespace(),
+        platform_message_history_manager=SimpleNamespace(),
+    )
+    return LiveChatService(SimpleNamespace(), core_lifecycle)
+
+
+@pytest.mark.asyncio
+async def test_run_websocket_session_closes_when_token_is_missing():
+    service = _service()
+    closed: list[tuple[int, str]] = []
+
+    async def close(code: int, reason: str) -> None:
+        closed.append((code, reason))
+
+    async def receive_json() -> dict:
+        raise AssertionError("receive_json should not be called")
+
+    async def send_json(payload: dict) -> None:
+        raise AssertionError(f"send_json should not be called: {payload}")
+
+    await service.run_websocket_session(
+        token=None,
+        force_ct=None,
+        receive_json=receive_json,
+        send_json=send_json,
+        close=close,
+    )
+
+    assert closed == [(1008, "Missing authentication token")]
+    assert service.sessions == {}
+
+
+@pytest.mark.asyncio
+async def test_run_websocket_session_routes_messages_and_cleans_session(monkeypatch):
+    service = _service()
+    messages = iter(
+        [
+            {"ct": "chat", "t": "bind", "session_id": "chat-session"},
+            {"t": "start_speaking", "stamp": "s1"},
+        ]
+    )
+    routed: list[tuple[str, str, dict]] = []
+
+    monkeypatch.setattr(service, "authenticate_token", lambda _token: "alice")
+
+    async def handle_chat_message(session, message, _send_json) -> None:
+        routed.append(("chat", session.username, message))
+
+    async def handle_live_message(session, message, _send_json) -> None:
+        routed.append(("live", session.username, message))
+
+    monkeypatch.setattr(service, "handle_chat_message", handle_chat_message)
+    monkeypatch.setattr(service, "handle_live_message", handle_live_message)
+
+    async def receive_json() -> dict:
+        try:
+            return next(messages)
+        except StopIteration as exc:
+            raise RuntimeError("disconnect") from exc
+
+    async def send_json(_payload: dict) -> None:
+        pass
+
+    async def close(_code: int, _reason: str) -> None:
+        raise AssertionError("close should not be called")
+
+    await service.run_websocket_session(
+        token="valid",
+        force_ct=None,
+        receive_json=receive_json,
+        send_json=send_json,
+        close=close,
+    )
+
+    assert [(kind, username) for kind, username, _ in routed] == [
+        ("chat", "alice"),
+        ("live", "alice"),
+    ]
+    assert service.sessions == {}
+
+
+@pytest.mark.asyncio
+async def test_run_websocket_session_handles_disconnect_without_error_log(
+    monkeypatch,
+):
+    service = _service()
+    messages = iter([{"ct": "chat", "t": "bind", "session_id": "chat-session"}])
+    routed: list[dict] = []
+
+    monkeypatch.setattr(service, "authenticate_token", lambda _token: "alice")
+
+    async def handle_chat_message(session, message, _send_json) -> None:
+        routed.append({"username": session.username, "message": message})
+
+    monkeypatch.setattr(service, "handle_chat_message", handle_chat_message)
+
+    async def receive_json() -> dict:
+        try:
+            return next(messages)
+        except StopIteration as exc:
+            raise WebSocketDisconnect(1006) from exc
+
+    async def send_json(_payload: dict) -> None:
+        pass
+
+    async def close(_code: int, _reason: str) -> None:
+        raise AssertionError("close should not be called")
+
+    def fail_error_log(*_args, **_kwargs) -> None:
+        raise AssertionError("disconnect should not be logged as an error")
+
+    monkeypatch.setattr(
+        "astrbot.dashboard.services.live_chat_service.logger.error",
+        fail_error_log,
+    )
+
+    await service.run_websocket_session(
+        token="valid",
+        force_ct=None,
+        receive_json=receive_json,
+        send_json=send_json,
+        close=close,
+    )
+
+    assert routed == [
+        {
+            "username": "alice",
+            "message": {"ct": "chat", "t": "bind", "session_id": "chat-session"},
+        }
+    ]
+    assert service.sessions == {}
diff --git a/tests/unit/test_open_api_service_ws.py b/tests/unit/test_open_api_service_ws.py
new file mode 100644
index 000000000..8c44e7490
--- /dev/null
+++ b/tests/unit/test_open_api_service_ws.py
@@ -0,0 +1,133 @@
+from types import SimpleNamespace
+
+import pytest
+
+from astrbot.dashboard.services.open_api_service import (
+    OpenApiService,
+    OpenApiWebSocketChatBridge,
+)
+
+
+def _service() -> OpenApiService:
+    core_lifecycle = SimpleNamespace(
+        platform_manager=SimpleNamespace(platform_insts=[]),
+        platform_message_history_manager=None,
+    )
+    return OpenApiService(SimpleNamespace(), core_lifecycle)
+
+
+def _bridge() -> OpenApiWebSocketChatBridge:
+    async def build_user_message_parts(_message):
+        return []
+
+    async def create_attachment_from_file(_filename, _attach_type):
+        return None
+
+    async def insert_user_message(_session_id, _effective_username, _message_parts):
+        pass
+
+    async def save_bot_message(_session_id, _message_parts, _agent_stats, _refs):
+        return None
+
+    return OpenApiWebSocketChatBridge(
+        build_user_message_parts=build_user_message_parts,
+        create_attachment_from_file=create_attachment_from_file,
+        extract_web_search_refs=lambda _text, _parts: {},
+        insert_user_message=insert_user_message,
+        save_bot_message=save_bot_message,
+    )
+
+
+@pytest.mark.asyncio
+async def test_run_chat_websocket_closes_when_api_key_is_invalid(monkeypatch):
+    service = _service()
+    sent: list[dict] = []
+    closed: list[tuple[int, str]] = []
+
+    async def authenticate_api_key(_raw_key):
+        return False, "Invalid API key"
+
+    monkeypatch.setattr(service, "authenticate_api_key", authenticate_api_key)
+
+    async def receive_json():
+        raise AssertionError("receive_json should not be called")
+
+    async def send_json(payload: dict) -> None:
+        sent.append(payload)
+
+    async def close(code: int, reason: str) -> None:
+        closed.append((code, reason))
+
+    await service.run_chat_websocket(
+        raw_api_key="bad",
+        receive_json=receive_json,
+        send_json=send_json,
+        close=close,
+        conf_list=[],
+        chat_bridge=_bridge(),
+    )
+
+    assert sent == [
+        {"type": "error", "code": "UNAUTHORIZED", "data": "Invalid API key"}
+    ]
+    assert closed == [(1008, "Invalid API key")]
+
+
+@pytest.mark.asyncio
+async def test_run_chat_websocket_handles_control_messages(monkeypatch):
+    service = _service()
+    messages = iter(
+        [
+            ["not", "an", "object"],
+            {"t": "ping"},
+            {"t": "unknown"},
+            {"t": "send", "message": "hello"},
+        ]
+    )
+    sent: list[dict] = []
+    handled: list[dict] = []
+
+    async def authenticate_api_key(_raw_key):
+        return True, None
+
+    async def handle_chat_ws_send(**kwargs):
+        handled.append(kwargs["post_data"])
+
+    monkeypatch.setattr(service, "authenticate_api_key", authenticate_api_key)
+    monkeypatch.setattr(service, "handle_chat_ws_send", handle_chat_ws_send)
+
+    async def receive_json():
+        try:
+            return next(messages)
+        except StopIteration as exc:
+            raise RuntimeError("disconnect") from exc
+
+    async def send_json(payload: dict) -> None:
+        sent.append(payload)
+
+    async def close(_code: int, _reason: str) -> None:
+        raise AssertionError("close should not be called")
+
+    await service.run_chat_websocket(
+        raw_api_key="good",
+        receive_json=receive_json,
+        send_json=send_json,
+        close=close,
+        conf_list=[],
+        chat_bridge=_bridge(),
+    )
+
+    assert sent == [
+        {
+            "type": "error",
+            "code": "INVALID_MESSAGE",
+            "data": "message must be an object",
+        },
+        {"type": "pong"},
+        {
+            "type": "error",
+            "code": "INVALID_MESSAGE",
+            "data": "Unsupported message type: unknown",
+        },
+    ]
+    assert handled == [{"t": "send", "message": "hello"}]
diff --git a/tests/unit/test_session_lock.py b/tests/unit/test_session_lock.py
index fea686b11..a05054051 100644
--- a/tests/unit/test_session_lock.py
+++ b/tests/unit/test_session_lock.py
@@ -194,7 +194,9 @@ class TestConcurrency:
                 loop.close()
                 asyncio.set_event_loop(None)
 
-        threads = [threading.Thread(target=create_loop_and_get_manager) for _ in range(10)]
+        threads = [
+            threading.Thread(target=create_loop_and_get_manager) for _ in range(10)
+        ]
         for t in threads:
             t.start()
         for t in threads:
@@ -417,7 +419,9 @@ class TestIssue5464:
                 asyncio.set_event_loop(None)
 
         # Start 3 threads nearly simultaneously
-        threads = [threading.Thread(target=acquire_lock_in_loop, args=(i,)) for i in range(3)]
+        threads = [
+            threading.Thread(target=acquire_lock_in_loop, args=(i,)) for i in range(3)
+        ]
 
         start_time = time.time()
         for t in threads:
diff --git a/tests/unit/test_star_base.py b/tests/unit/test_star_base.py
index d78737943..77e35ba2c 100644
--- a/tests/unit/test_star_base.py
+++ b/tests/unit/test_star_base.py
@@ -1,8 +1,9 @@
 """Tests for astrbot.core.star.base module."""
 
-import pytest
 from unittest.mock import AsyncMock, MagicMock, patch
 
+import pytest
+
 
 class TestStarBase:
     """Test cases for the Star base class."""
@@ -146,14 +147,11 @@ class TestStarBase:
 
     def test_star_metadata_registration(self):
         """Test that Star subclass is automatically registered."""
-        from astrbot.core.star import star_map, star_registry
-        from astrbot.core.star.star import StarMetadata
-
-        # Clear any previous registration for this test module
-        module_path = __name__
+        from astrbot.core.star import star_registry
 
         class UniqueTestStar:
             """Not a Star subclass, should not be registered."""
+
             pass
 
         # Verify Star subclass gets registered
@@ -181,11 +179,9 @@ class TestNoCircularImports:
 
     def test_import_both_modules(self):
         """Test that both modules can be imported together."""
-        import astrbot.core.pipeline
-        import astrbot.core.star
 
         # Verify key exports are available
-        from astrbot.core.star import Context, Star, PluginManager
+        from astrbot.core.star import Context, PluginManager, Star
 
         assert Context is not None
         assert Star is not None
diff --git a/tests/unit/test_tool_conflict_resolution.py b/tests/unit/test_tool_conflict_resolution.py
index 8146ad887..706ec8e2a 100644
--- a/tests/unit/test_tool_conflict_resolution.py
+++ b/tests/unit/test_tool_conflict_resolution.py
@@ -4,8 +4,6 @@ This module tests the fix for issue #5821: when an MCP external tool shares a na
 with a disabled built-in tool, the MCP tool should not be removed as collateral damage.
 """
 
-import pytest
-
 from astrbot.core.agent.tool import FunctionTool, ToolSet
 from astrbot.core.provider.func_tool_manager import FunctionToolManager
 
diff --git a/tests/unit/test_tool_permission.py b/tests/unit/test_tool_permission.py
index 1a3a8a376..9e69609e6 100644
--- a/tests/unit/test_tool_permission.py
+++ b/tests/unit/test_tool_permission.py
@@ -1,36 +1,20 @@
 """Tests for per-tool permission management."""
 
-import asyncio
-import json
-from typing import Any
-from unittest.mock import AsyncMock, MagicMock, patch
+from unittest.mock import MagicMock
 
 import pytest
 
 from astrbot.core import sp
-from astrbot.core.agent.tool import FunctionTool, ToolSet
+from astrbot.core.agent.tool import FunctionTool
 from astrbot.core.provider.func_tool_manager import (
     FunctionToolManager,
     _PermissionGuardedTool,
 )
-from astrbot.core.tools.computer_tools.shell import ExecuteShellTool
-
+from astrbot.dashboard.services.tools_service import ToolsService, ToolsServiceError
 
 # ── helpers ──────────────────────────────────────────────────────────
 
 
-def _make_coro(value: object):
-    """Return a fresh coroutine object that resolves to ``value``.
-
-    Used to mock Quart's ``await request.json`` where ``json`` is an
-    async property — assigning a coroutine lets ``await`` work directly."""
-
-    async def _inner():
-        return value
-
-    return _inner()
-
-
 def _make_context(role: str = "member", sender_id: str = "user_123"):
     """Return a mock context object suitable for tool permission checks."""
 
@@ -70,6 +54,26 @@ def _clear_tool_permissions() -> None:
     sp.put("tool_permissions", {}, scope="global", scope_id="global")
 
 
+def _make_tools_service(
+    tool_mgr: FunctionToolManager | None = None,
+) -> ToolsService:
+    """Create a minimal tools service for permission unit tests.
+
+    Args:
+        tool_mgr: Optional tool manager to attach to the service.
+
+    Returns:
+        A ToolsService with mocked lifecycle config access.
+    """
+    service = ToolsService.__new__(ToolsService)
+    service.core_lifecycle = MagicMock()
+    service.core_lifecycle.astrbot_config_mgr = MagicMock()
+    service.core_lifecycle.astrbot_config_mgr.get_conf_list.return_value = []
+    service.core_lifecycle.astrbot_config_mgr.confs = {}
+    service.tool_mgr = tool_mgr or FunctionToolManager()
+    return service
+
+
 # ── _default_permission ──────────────────────────────────────────────
 
 
@@ -298,9 +302,9 @@ def test_get_full_tool_set_wraps_non_builtin():
 
     plugin_tools = [t for t in tool_set.tools if t.name == "my_plugin_tool"]
     assert plugin_tools
-    assert isinstance(
-        plugin_tools[0], _PermissionGuardedTool
-    ), "non-builtin tools must be wrapped"
+    assert isinstance(plugin_tools[0], _PermissionGuardedTool), (
+        "non-builtin tools must be wrapped"
+    )
 
 
 # ── API: get_tool_list permission fields ──────────────────────────────
@@ -309,16 +313,7 @@ def test_get_full_tool_set_wraps_non_builtin():
 class TestGetToolListPermission:
     @pytest.mark.asyncio
     async def test_list_includes_permission_fields_for_non_builtin(self):
-        from astrbot.dashboard.routes.tools import ToolsRoute
-
-        # Minimal stubs to avoid full core lifecycle init
-        route = ToolsRoute.__new__(ToolsRoute)
-        route.core_lifecycle = MagicMock()
-        route.core_lifecycle.astrbot_config_mgr = MagicMock()
-        route.core_lifecycle.astrbot_config_mgr.get_conf_list.return_value = []
-        route.core_lifecycle.astrbot_config_mgr.confs = {}
-        route.tool_mgr = FunctionToolManager()
-
+        service = _make_tools_service()
         sp.put(
             "tool_permissions",
             {"_default": {"my_plugin_tool": "admin"}},
@@ -326,10 +321,8 @@ class TestGetToolListPermission:
             scope_id="global",
         )
         try:
-            route.tool_mgr.func_list.append(_dummy_tool("my_plugin_tool"))
-            resp = await route.get_tool_list()
-            data = json.loads(json.dumps(resp))  # simulate json serialisation
-            tools = data["data"]
+            service.tool_mgr.func_list.append(_dummy_tool("my_plugin_tool"))
+            tools = service.get_tool_list()
 
             target = next(t for t in tools if t["name"] == "my_plugin_tool")
             assert target["permission"] == "admin"
@@ -340,18 +333,8 @@ class TestGetToolListPermission:
 
     @pytest.mark.asyncio
     async def test_list_no_permission_fields_for_builtin(self):
-        from astrbot.dashboard.routes.tools import ToolsRoute
-
-        route = ToolsRoute.__new__(ToolsRoute)
-        route.core_lifecycle = MagicMock()
-        route.core_lifecycle.astrbot_config_mgr = MagicMock()
-        route.core_lifecycle.astrbot_config_mgr.get_conf_list.return_value = []
-        route.core_lifecycle.astrbot_config_mgr.confs = {}
-        route.tool_mgr = FunctionToolManager()
-
-        resp = await route.get_tool_list()
-        data = json.loads(json.dumps(resp))
-        tools = data["data"]
+        service = _make_tools_service()
+        tools = service.get_tool_list()
 
         target = next(t for t in tools if t["name"] == "astrbot_execute_shell")
         assert "permission" not in target
@@ -365,70 +348,42 @@ class TestGetToolListPermission:
 class TestUpdateToolPermission:
     @pytest.mark.asyncio
     async def test_set_admin_permission(self):
-        from astrbot.dashboard.routes.tools import ToolsRoute
-
-        route = ToolsRoute.__new__(ToolsRoute)
-        route.core_lifecycle = MagicMock()
-        route.tool_mgr = FunctionToolManager()
-        route.tool_mgr.func_list.append(_dummy_tool("target_tool"))
+        service = _make_tools_service()
+        service.tool_mgr.func_list.append(_dummy_tool("target_tool"))
         _clear_tool_permissions()
 
-        mock_req = MagicMock()
-        mock_req.json = _make_coro({"name": "target_tool", "permission": "admin"})
-        with patch("astrbot.dashboard.routes.tools.request", mock_req):
-            resp = await route.update_tool_permission()
-            data = json.loads(json.dumps(resp))
-            assert data["status"] == "ok"
-
-        stored = sp.get(
-            "tool_permissions", {}, scope="global", scope_id="global"
+        message = service.update_tool_permission(
+            {"name": "target_tool", "permission": "admin"}
         )
+        assert "target_tool" in message
+
+        stored = sp.get("tool_permissions", {}, scope="global", scope_id="global")
         assert stored["_default"]["target_tool"] == "admin"
 
     @pytest.mark.asyncio
     async def test_reject_builtin_tool(self):
-        from astrbot.dashboard.routes.tools import ToolsRoute
+        service = _make_tools_service()
 
-        route = ToolsRoute.__new__(ToolsRoute)
-        route.core_lifecycle = MagicMock()
-        route.tool_mgr = FunctionToolManager()
-
-        mock_req = MagicMock()
-        mock_req.json = _make_coro({"name": "astrbot_execute_shell", "permission": "admin"})
-        with patch("astrbot.dashboard.routes.tools.request", mock_req):
-            resp = await route.update_tool_permission()
-            data = json.loads(json.dumps(resp))
-            assert data["status"] == "error"
-            assert "builtin" in str(data["message"]).lower()
+        with pytest.raises(ToolsServiceError, match="Builtin"):
+            service.update_tool_permission(
+                {"name": "astrbot_execute_shell", "permission": "admin"}
+            )
 
     @pytest.mark.asyncio
     async def test_reject_unknown_tool(self):
-        from astrbot.dashboard.routes.tools import ToolsRoute
+        service = _make_tools_service()
 
-        route = ToolsRoute.__new__(ToolsRoute)
-        route.core_lifecycle = MagicMock()
-        route.tool_mgr = FunctionToolManager()
-
-        mock_req = MagicMock()
-        mock_req.json = _make_coro({"name": "ghost_tool", "permission": "admin"})
-        with patch("astrbot.dashboard.routes.tools.request", mock_req):
-            resp = await route.update_tool_permission()
-            data = json.loads(json.dumps(resp))
-            assert data["status"] == "error"
-            assert "not found" in str(data["message"]).lower()
+        with pytest.raises(ToolsServiceError, match="not found"):
+            service.update_tool_permission(
+                {"name": "ghost_tool", "permission": "admin"}
+            )
 
     @pytest.mark.asyncio
     async def test_reject_invalid_permission_value(self):
-        from astrbot.dashboard.routes.tools import ToolsRoute
+        service = _make_tools_service()
+        service.tool_mgr.func_list.append(_dummy_tool("target_tool"))
 
-        route = ToolsRoute.__new__(ToolsRoute)
-        route.core_lifecycle = MagicMock()
-        route.tool_mgr = FunctionToolManager()
-        route.tool_mgr.func_list.append(_dummy_tool("target_tool"))
-
-        mock_req = MagicMock()
-        mock_req.json = _make_coro({"name": "target_tool", "permission": "everyone"})
-        with patch("astrbot.dashboard.routes.tools.request", mock_req):
-            resp = await route.update_tool_permission()
-            data = json.loads(json.dumps(resp))
-            assert data["status"] == "error"
+        with pytest.raises(ToolsServiceError, match="admin or member"):
+            service.update_tool_permission(
+                {"name": "target_tool", "permission": "everyone"}
+            )
diff --git a/tests/unit/test_upload_filename_sanitization.py b/tests/unit/test_upload_filename_sanitization.py
index 88374669e..ddb031a1e 100644
--- a/tests/unit/test_upload_filename_sanitization.py
+++ b/tests/unit/test_upload_filename_sanitization.py
@@ -1,22 +1,22 @@
 """Tests for upload filename sanitization."""
 
-from astrbot.dashboard.routes.chat import _sanitize_upload_filename
+from astrbot.dashboard.services.chat_service import sanitize_upload_filename
 
 
 def test_sanitize_upload_filename_strips_posix_traversal():
-    assert _sanitize_upload_filename("../../outside.txt") == "outside.txt"
+    assert sanitize_upload_filename("../../outside.txt") == "outside.txt"
 
 
 def test_sanitize_upload_filename_strips_windows_traversal():
-    assert _sanitize_upload_filename(r"..\\..\\outside.txt") == "outside.txt"
+    assert sanitize_upload_filename(r"..\\..\\outside.txt") == "outside.txt"
 
 
 def test_sanitize_upload_filename_strips_fakepath():
-    assert _sanitize_upload_filename(r"C:\\fakepath\\photo.png") == "photo.png"
+    assert sanitize_upload_filename(r"C:\\fakepath\\photo.png") == "photo.png"
 
 
 def test_sanitize_upload_filename_falls_back_for_empty_values():
-    generated = _sanitize_upload_filename("")
+    generated = sanitize_upload_filename("")
 
     assert generated
     assert generated not in {".", ".."}
@@ -25,8 +25,7 @@ def test_sanitize_upload_filename_falls_back_for_empty_values():
 
 
 def test_sanitize_upload_filename_removes_embedded_null_bytes():
-    assert _sanitize_upload_filename("evil\x00.txt") == "evil.txt"
-    assert _sanitize_upload_filename("\x00leading.txt") == "leading.txt"
-    assert _sanitize_upload_filename("trailing\x00.txt\x00") == "trailing.txt"
-    assert _sanitize_upload_filename("mid\x00dle.txt") == "middle.txt"
-
+    assert sanitize_upload_filename("evil\x00.txt") == "evil.txt"
+    assert sanitize_upload_filename("\x00leading.txt") == "leading.txt"
+    assert sanitize_upload_filename("trailing\x00.txt\x00") == "trailing.txt"
+    assert sanitize_upload_filename("mid\x00dle.txt") == "middle.txt"