chore: Add PyPI package support for uvx/pip installation (#1764)

* Initial plan

* Add package structure and resource path utilities

- Created langbot/ package with __init__.py and __main__.py entry point
- Added paths utility to find frontend and resource files from package installation
- Updated config loading to use resource paths
- Updated frontend serving to use resource paths
- Added MANIFEST.in for package data inclusion
- Updated pyproject.toml with build system and entry points

Co-authored-by: RockChinQ <45992437+RockChinQ@users.noreply.github.com>

* Add PyPI publishing workflow and update license

- Created GitHub Actions workflow to build frontend and publish to PyPI
- Added license field to pyproject.toml to fix deprecation warning
- Updated .gitignore to exclude build artifacts
- Tested package building successfully

Co-authored-by: RockChinQ <45992437+RockChinQ@users.noreply.github.com>

* Add PyPI installation documentation

- Created PYPI_INSTALLATION.md with detailed installation and usage instructions
- Updated README.md to feature uvx/pip installation as recommended method
- Updated README_EN.md with same changes for English documentation

Co-authored-by: RockChinQ <45992437+RockChinQ@users.noreply.github.com>

* Address code review feedback

- Made package-data configuration more specific to langbot package only
- Improved path detection with caching to avoid repeated file I/O
- Removed sys.path searching which was incorrect for package data
- Removed interactive input() call for non-interactive environment compatibility
- Simplified error messages for version check

Co-authored-by: RockChinQ <45992437+RockChinQ@users.noreply.github.com>

* Fix code review issues

- Use specific exception types instead of bare except
- Fix misleading comments about directory levels
- Remove redundant existence check before makedirs with exist_ok=True
- Use context manager for file opening to ensure proper cleanup

Co-authored-by: RockChinQ <45992437+RockChinQ@users.noreply.github.com>

* Simplify package configuration and document behavioral differences

- Removed redundant package-data configuration, relying on MANIFEST.in
- Added documentation about behavioral differences between package and source installation
- Clarified that include-package-data=true uses MANIFEST.in for data files

Co-authored-by: RockChinQ <45992437+RockChinQ@users.noreply.github.com>

* chore: update pyproject.toml

* chore: try pack templates in langbot/

* chore: update

* chore: update

* chore: update

* chore: update

* chore: update

* chore: adjust dir structure

* chore: fix imports

* fix: read default-pipeline-config.json

* fix: read default-pipeline-config.json

* fix: tests

* ci: publish pypi

* chore: bump version 4.6.0-beta.1 for testing

* chore: add templates/**

* fix: send adapters and requesters icons

* chore: bump version 4.6.0b2 for testing

* chore: add platform field for docker-compose.yaml

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: RockChinQ <45992437+RockChinQ@users.noreply.github.com>
Co-authored-by: Junyan Qin <rockchinq@gmail.com>

src/langbot/pkg/api/http/controller/group.py

@@ -0,0 +1,190 @@
+from __future__ import annotations
+
+import abc
+import typing
+import enum
+import quart
+import traceback
+from quart.typing import RouteCallable
+
+from ....core import app
+
+# Maximum file upload size limit (10MB)
+MAX_FILE_SIZE = 10 * 1024 * 1024  # 10MB
+
+
+preregistered_groups: list[type[RouterGroup]] = []
+"""Pre-registered list of RouterGroup"""
+
+
+def group_class(name: str, path: str) -> typing.Callable[[typing.Type[RouterGroup]], typing.Type[RouterGroup]]:
+    """注册一个 RouterGroup"""
+
+    def decorator(cls: typing.Type[RouterGroup]) -> typing.Type[RouterGroup]:
+        cls.name = name
+        cls.path = path
+        preregistered_groups.append(cls)
+        return cls
+
+    return decorator
+
+
+class AuthType(enum.Enum):
+    """Authentication type"""
+
+    NONE = 'none'
+    USER_TOKEN = 'user-token'
+    API_KEY = 'api-key'
+    USER_TOKEN_OR_API_KEY = 'user-token-or-api-key'
+
+
+class RouterGroup(abc.ABC):
+    name: str
+
+    path: str
+
+    ap: app.Application
+
+    quart_app: quart.Quart
+
+    def __init__(self, ap: app.Application, quart_app: quart.Quart) -> None:
+        self.ap = ap
+        self.quart_app = quart_app
+
+    @abc.abstractmethod
+    async def initialize(self) -> None:
+        pass
+
+    def route(
+        self,
+        rule: str,
+        auth_type: AuthType = AuthType.USER_TOKEN,
+        **options: typing.Any,
+    ) -> typing.Callable[[RouteCallable], RouteCallable]:  # decorator
+        """Register a route"""
+
+        def decorator(f: RouteCallable) -> RouteCallable:
+            nonlocal rule
+            rule = self.path + rule
+
+            async def handler_error(*args, **kwargs):
+                if auth_type == AuthType.USER_TOKEN:
+                    # get token from Authorization header
+                    token = quart.request.headers.get('Authorization', '').replace('Bearer ', '')
+
+                    if not token:
+                        return self.http_status(401, -1, 'No valid user token provided')
+
+                    try:
+                        user_email = await self.ap.user_service.verify_jwt_token(token)
+
+                        # check if this account exists
+                        user = await self.ap.user_service.get_user_by_email(user_email)
+                        if not user:
+                            return self.http_status(401, -1, 'User not found')
+
+                        # check if f accepts user_email parameter
+                        if 'user_email' in f.__code__.co_varnames:
+                            kwargs['user_email'] = user_email
+                    except Exception as e:
+                        return self.http_status(401, -1, str(e))
+
+                elif auth_type == AuthType.API_KEY:
+                    # get API key from Authorization header or X-API-Key header
+                    api_key = quart.request.headers.get('X-API-Key', '')
+                    if not api_key:
+                        auth_header = quart.request.headers.get('Authorization', '')
+                        if auth_header.startswith('Bearer '):
+                            api_key = auth_header.replace('Bearer ', '')
+
+                    if not api_key:
+                        return self.http_status(401, -1, 'No valid API key provided')
+
+                    try:
+                        is_valid = await self.ap.apikey_service.verify_api_key(api_key)
+                        if not is_valid:
+                            return self.http_status(401, -1, 'Invalid API key')
+                    except Exception as e:
+                        return self.http_status(401, -1, str(e))
+
+                elif auth_type == AuthType.USER_TOKEN_OR_API_KEY:
+                    # Try API key first (check X-API-Key header)
+                    api_key = quart.request.headers.get('X-API-Key', '')
+
+                    if api_key:
+                        # API key authentication
+                        try:
+                            is_valid = await self.ap.apikey_service.verify_api_key(api_key)
+                            if not is_valid:
+                                return self.http_status(401, -1, 'Invalid API key')
+                        except Exception as e:
+                            return self.http_status(401, -1, str(e))
+                    else:
+                        # Try user token authentication (Authorization header)
+                        token = quart.request.headers.get('Authorization', '').replace('Bearer ', '')
+
+                        if not token:
+                            return self.http_status(
+                                401, -1, 'No valid authentication provided (user token or API key required)'
+                            )
+
+                        try:
+                            user_email = await self.ap.user_service.verify_jwt_token(token)
+
+                            # check if this account exists
+                            user = await self.ap.user_service.get_user_by_email(user_email)
+                            if not user:
+                                return self.http_status(401, -1, 'User not found')
+
+                            # check if f accepts user_email parameter
+                            if 'user_email' in f.__code__.co_varnames:
+                                kwargs['user_email'] = user_email
+                        except Exception:
+                            # If user token fails, maybe it's an API key in Authorization header
+                            try:
+                                is_valid = await self.ap.apikey_service.verify_api_key(token)
+                                if not is_valid:
+                                    return self.http_status(401, -1, 'Invalid authentication credentials')
+                            except Exception as e:
+                                return self.http_status(401, -1, str(e))
+
+                try:
+                    return await f(*args, **kwargs)
+
+                except Exception as e:  # 自动 500
+                    traceback.print_exc()
+                    # return self.http_status(500, -2, str(e))
+                    return self.http_status(500, -2, str(e))
+
+            new_f = handler_error
+            new_f.__name__ = (self.name + rule).replace('/', '__')
+            new_f.__doc__ = f.__doc__
+
+            self.quart_app.route(rule, **options)(new_f)
+            return f
+
+        return decorator
+
+    def success(self, data: typing.Any = None) -> quart.Response:
+        """Return a 200 response"""
+        return quart.jsonify(
+            {
+                'code': 0,
+                'msg': 'ok',
+                'data': data,
+            }
+        )
+
+    def fail(self, code: int, msg: str) -> quart.Response:
+        """Return an error response"""
+
+        return quart.jsonify(
+            {
+                'code': code,
+                'msg': msg,
+            }
+        )
+
+    def http_status(self, status: int, code: int, msg: str) -> typing.Tuple[quart.Response, int]:
+        """返回一个指定状态码的响应"""
+        return (self.fail(code, msg), status)

src/langbot/pkg/api/http/controller/groups/apikeys.py

@@ -0,0 +1,43 @@
+import quart
+
+from .. import group
+
+
+@group.group_class('apikeys', '/api/v1/apikeys')
+class ApiKeysRouterGroup(group.RouterGroup):
+    async def initialize(self) -> None:
+        @self.route('', methods=['GET', 'POST'])
+        async def _() -> str:
+            if quart.request.method == 'GET':
+                keys = await self.ap.apikey_service.get_api_keys()
+                return self.success(data={'keys': keys})
+            elif quart.request.method == 'POST':
+                json_data = await quart.request.json
+                name = json_data.get('name', '')
+                description = json_data.get('description', '')
+
+                if not name:
+                    return self.http_status(400, -1, 'Name is required')
+
+                key = await self.ap.apikey_service.create_api_key(name, description)
+                return self.success(data={'key': key})
+
+        @self.route('/<int:key_id>', methods=['GET', 'PUT', 'DELETE'])
+        async def _(key_id: int) -> str:
+            if quart.request.method == 'GET':
+                key = await self.ap.apikey_service.get_api_key(key_id)
+                if key is None:
+                    return self.http_status(404, -1, 'API key not found')
+                return self.success(data={'key': key})
+
+            elif quart.request.method == 'PUT':
+                json_data = await quart.request.json
+                name = json_data.get('name')
+                description = json_data.get('description')
+
+                await self.ap.apikey_service.update_api_key(key_id, name, description)
+                return self.success()
+
+            elif quart.request.method == 'DELETE':
+                await self.ap.apikey_service.delete_api_key(key_id)
+                return self.success()

src/langbot/pkg/api/http/controller/groups/files.py

@@ -0,0 +1,75 @@
+from __future__ import annotations
+
+import quart
+import mimetypes
+import uuid
+import asyncio
+
+import quart.datastructures
+
+from .. import group
+
+
+@group.group_class('files', '/api/v1/files')
+class FilesRouterGroup(group.RouterGroup):
+    async def initialize(self) -> None:
+        @self.route('/image/<image_key>', methods=['GET'], auth_type=group.AuthType.NONE)
+        async def _(image_key: str) -> quart.Response:
+            if '/' in image_key or '\\' in image_key:
+                return quart.Response(status=404)
+
+            if not await self.ap.storage_mgr.storage_provider.exists(image_key):
+                return quart.Response(status=404)
+
+            image_bytes = await self.ap.storage_mgr.storage_provider.load(image_key)
+            mime_type = mimetypes.guess_type(image_key)[0]
+            if mime_type is None:
+                mime_type = 'image/jpeg'
+
+            return quart.Response(image_bytes, mimetype=mime_type)
+
+        @self.route('/documents', methods=['POST'], auth_type=group.AuthType.USER_TOKEN)
+        async def _() -> quart.Response:
+            request = quart.request
+
+            # Check file size limit before reading the file
+            content_length = request.content_length
+            if content_length and content_length > group.MAX_FILE_SIZE:
+                return self.fail(400, 'File size exceeds 10MB limit. Please split large files into smaller parts.')
+
+            # get file bytes from 'file'
+            files = await request.files
+            if 'file' not in files:
+                return self.fail(400, 'No file provided in request')
+
+            file = files['file']
+            assert isinstance(file, quart.datastructures.FileStorage)
+
+            file_bytes = await asyncio.to_thread(file.stream.read)
+
+            # Double-check actual file size after reading
+            if len(file_bytes) > group.MAX_FILE_SIZE:
+                return self.fail(400, 'File size exceeds 10MB limit. Please split large files into smaller parts.')
+
+            # Split filename and extension properly
+            if '.' in file.filename:
+                file_name, extension = file.filename.rsplit('.', 1)
+            else:
+                file_name = file.filename
+                extension = ''
+
+            # check if file name contains '/' or '\'
+            if '/' in file_name or '\\' in file_name:
+                return self.fail(400, 'File name contains invalid characters')
+
+            file_key = file_name + '_' + str(uuid.uuid4())[:8]
+            if extension:
+                file_key += '.' + extension
+
+            # save file to storage
+            await self.ap.storage_mgr.storage_provider.save(file_key, file_bytes)
+            return self.success(
+                data={
+                    'file_id': file_key,
+                }
+            )

src/langbot/pkg/api/http/controller/groups/knowledge/base.py

@@ -0,0 +1,90 @@
+import quart
+from ... import group
+
+
+@group.group_class('knowledge_base', '/api/v1/knowledge/bases')
+class KnowledgeBaseRouterGroup(group.RouterGroup):
+    async def initialize(self) -> None:
+        @self.route('', methods=['POST', 'GET'])
+        async def handle_knowledge_bases() -> quart.Response:
+            if quart.request.method == 'GET':
+                knowledge_bases = await self.ap.knowledge_service.get_knowledge_bases()
+                return self.success(data={'bases': knowledge_bases})
+
+            elif quart.request.method == 'POST':
+                json_data = await quart.request.json
+                knowledge_base_uuid = await self.ap.knowledge_service.create_knowledge_base(json_data)
+                return self.success(data={'uuid': knowledge_base_uuid})
+
+            return self.http_status(405, -1, 'Method not allowed')
+
+        @self.route(
+            '/<knowledge_base_uuid>',
+            methods=['GET', 'DELETE', 'PUT'],
+        )
+        async def handle_specific_knowledge_base(knowledge_base_uuid: str) -> quart.Response:
+            if quart.request.method == 'GET':
+                knowledge_base = await self.ap.knowledge_service.get_knowledge_base(knowledge_base_uuid)
+
+                if knowledge_base is None:
+                    return self.http_status(404, -1, 'knowledge base not found')
+
+                return self.success(
+                    data={
+                        'base': knowledge_base,
+                    }
+                )
+
+            elif quart.request.method == 'PUT':
+                json_data = await quart.request.json
+                await self.ap.knowledge_service.update_knowledge_base(knowledge_base_uuid, json_data)
+                return self.success({})
+
+            elif quart.request.method == 'DELETE':
+                await self.ap.knowledge_service.delete_knowledge_base(knowledge_base_uuid)
+                return self.success({})
+
+        @self.route(
+            '/<knowledge_base_uuid>/files',
+            methods=['GET', 'POST'],
+        )
+        async def get_knowledge_base_files(knowledge_base_uuid: str) -> str:
+            if quart.request.method == 'GET':
+                files = await self.ap.knowledge_service.get_files_by_knowledge_base(knowledge_base_uuid)
+                return self.success(
+                    data={
+                        'files': files,
+                    }
+                )
+
+            elif quart.request.method == 'POST':
+                json_data = await quart.request.json
+                file_id = json_data.get('file_id')
+                if not file_id:
+                    return self.http_status(400, -1, 'File ID is required')
+
+                # 调用服务层方法将文件与知识库关联
+                task_id = await self.ap.knowledge_service.store_file(knowledge_base_uuid, file_id)
+                return self.success(
+                    {
+                        'task_id': task_id,
+                    }
+                )
+
+        @self.route(
+            '/<knowledge_base_uuid>/files/<file_id>',
+            methods=['DELETE'],
+        )
+        async def delete_specific_file_in_kb(file_id: str, knowledge_base_uuid: str) -> str:
+            await self.ap.knowledge_service.delete_file(knowledge_base_uuid, file_id)
+            return self.success({})
+
+        @self.route(
+            '/<knowledge_base_uuid>/retrieve',
+            methods=['POST'],
+        )
+        async def retrieve_knowledge_base(knowledge_base_uuid: str) -> str:
+            json_data = await quart.request.json
+            query = json_data.get('query')
+            results = await self.ap.knowledge_service.retrieve_knowledge_base(knowledge_base_uuid, query)
+            return self.success(data={'results': results})

src/langbot/pkg/api/http/controller/groups/logs.py

@@ -0,0 +1,27 @@
+from __future__ import annotations
+
+
+import quart
+
+from .. import group
+
+
+@group.group_class('logs', '/api/v1/logs')
+class LogsRouterGroup(group.RouterGroup):
+    async def initialize(self) -> None:
+        @self.route('', methods=['GET'], auth_type=group.AuthType.USER_TOKEN)
+        async def _() -> str:
+            start_page_number = int(quart.request.args.get('start_page_number', 0))
+            start_offset = int(quart.request.args.get('start_offset', 0))
+
+            logs_str, end_page_number, end_offset = self.ap.log_cache.get_log_by_pointer(
+                start_page_number=start_page_number, start_offset=start_offset
+            )
+
+            return self.success(
+                data={
+                    'logs': logs_str,
+                    'end_page_number': end_page_number,
+                    'end_offset': end_offset,
+                }
+            )

src/langbot/pkg/api/http/controller/groups/pipelines/pipelines.py

@@ -0,0 +1,83 @@
+from __future__ import annotations
+
+import quart
+
+from ... import group
+
+
+@group.group_class('pipelines', '/api/v1/pipelines')
+class PipelinesRouterGroup(group.RouterGroup):
+    async def initialize(self) -> None:
+        @self.route('', methods=['GET', 'POST'], auth_type=group.AuthType.USER_TOKEN_OR_API_KEY)
+        async def _() -> str:
+            if quart.request.method == 'GET':
+                sort_by = quart.request.args.get('sort_by', 'created_at')
+                sort_order = quart.request.args.get('sort_order', 'DESC')
+                return self.success(
+                    data={'pipelines': await self.ap.pipeline_service.get_pipelines(sort_by, sort_order)}
+                )
+            elif quart.request.method == 'POST':
+                json_data = await quart.request.json
+
+                pipeline_uuid = await self.ap.pipeline_service.create_pipeline(json_data)
+
+                return self.success(data={'uuid': pipeline_uuid})
+
+        @self.route('/_/metadata', methods=['GET'], auth_type=group.AuthType.USER_TOKEN_OR_API_KEY)
+        async def _() -> str:
+            return self.success(data={'configs': await self.ap.pipeline_service.get_pipeline_metadata()})
+
+        @self.route(
+            '/<pipeline_uuid>', methods=['GET', 'PUT', 'DELETE'], auth_type=group.AuthType.USER_TOKEN_OR_API_KEY
+        )
+        async def _(pipeline_uuid: str) -> str:
+            if quart.request.method == 'GET':
+                pipeline = await self.ap.pipeline_service.get_pipeline(pipeline_uuid)
+
+                if pipeline is None:
+                    return self.http_status(404, -1, 'pipeline not found')
+
+                return self.success(data={'pipeline': pipeline})
+            elif quart.request.method == 'PUT':
+                json_data = await quart.request.json
+
+                await self.ap.pipeline_service.update_pipeline(pipeline_uuid, json_data)
+
+                return self.success()
+            elif quart.request.method == 'DELETE':
+                await self.ap.pipeline_service.delete_pipeline(pipeline_uuid)
+
+                return self.success()
+
+        @self.route(
+            '/<pipeline_uuid>/extensions', methods=['GET', 'PUT'], auth_type=group.AuthType.USER_TOKEN_OR_API_KEY
+        )
+        async def _(pipeline_uuid: str) -> str:
+            if quart.request.method == 'GET':
+                # Get current extensions and available plugins
+                pipeline = await self.ap.pipeline_service.get_pipeline(pipeline_uuid)
+                if pipeline is None:
+                    return self.http_status(404, -1, 'pipeline not found')
+
+                plugins = await self.ap.plugin_connector.list_plugins()
+                mcp_servers = await self.ap.mcp_service.get_mcp_servers(contain_runtime_info=True)
+
+                return self.success(
+                    data={
+                        'bound_plugins': pipeline.get('extensions_preferences', {}).get('plugins', []),
+                        'available_plugins': plugins,
+                        'bound_mcp_servers': pipeline.get('extensions_preferences', {}).get('mcp_servers', []),
+                        'available_mcp_servers': mcp_servers,
+                    }
+                )
+            elif quart.request.method == 'PUT':
+                # Update bound plugins and MCP servers for this pipeline
+                json_data = await quart.request.json
+                bound_plugins = json_data.get('bound_plugins', [])
+                bound_mcp_servers = json_data.get('bound_mcp_servers', [])
+
+                await self.ap.pipeline_service.update_pipeline_extensions(
+                    pipeline_uuid, bound_plugins, bound_mcp_servers
+                )
+
+                return self.success()

src/langbot/pkg/api/http/controller/groups/pipelines/webchat.py

@@ -0,0 +1,109 @@
+import json
+
+import quart
+
+from ... import group
+
+
+@group.group_class('webchat', '/api/v1/pipelines/<pipeline_uuid>/chat')
+class WebChatDebugRouterGroup(group.RouterGroup):
+    async def initialize(self) -> None:
+        @self.route('/send', methods=['POST'])
+        async def send_message(pipeline_uuid: str) -> str:
+            """Send a message to the pipeline for debugging"""
+
+            async def stream_generator(generator):
+                yield 'data: {"type": "start"}\n\n'
+                async for message in generator:
+                    yield f'data: {json.dumps({"message": message})}\n\n'
+                yield 'data: {"type": "end"}\n\n'
+
+            try:
+                data = await quart.request.get_json()
+                session_type = data.get('session_type', 'person')
+                message_chain_obj = data.get('message', [])
+                is_stream = data.get('is_stream', False)
+
+                if not message_chain_obj:
+                    return self.http_status(400, -1, 'message is required')
+
+                if session_type not in ['person', 'group']:
+                    return self.http_status(400, -1, 'session_type must be person or group')
+
+                webchat_adapter = self.ap.platform_mgr.webchat_proxy_bot.adapter
+
+                if not webchat_adapter:
+                    return self.http_status(404, -1, 'WebChat adapter not found')
+
+                if is_stream:
+                    generator = webchat_adapter.send_webchat_message(
+                        pipeline_uuid, session_type, message_chain_obj, is_stream
+                    )
+                    # 设置正确的响应头
+                    headers = {
+                        'Content-Type': 'text/event-stream',
+                        'Transfer-Encoding': 'chunked',
+                        'Cache-Control': 'no-cache',
+                        'Connection': 'keep-alive',
+                    }
+                    return quart.Response(stream_generator(generator), mimetype='text/event-stream', headers=headers)
+
+                else:  # non-stream
+                    result = None
+                    async for message in webchat_adapter.send_webchat_message(
+                        pipeline_uuid, session_type, message_chain_obj
+                    ):
+                        result = message
+                    if result is not None:
+                        return self.success(
+                            data={
+                                'message': result,
+                            }
+                        )
+                    else:
+                        return self.http_status(400, -1, 'message is required')
+
+            except Exception as e:
+                return self.http_status(500, -1, f'Internal server error: {str(e)}')
+
+        @self.route('/messages/<session_type>', methods=['GET'])
+        async def get_messages(pipeline_uuid: str, session_type: str) -> str:
+            """Get the message history of the pipeline for debugging"""
+            try:
+                if session_type not in ['person', 'group']:
+                    return self.http_status(400, -1, 'session_type must be person or group')
+
+                webchat_adapter = self.ap.platform_mgr.webchat_proxy_bot.adapter
+
+                if not webchat_adapter:
+                    return self.http_status(404, -1, 'WebChat adapter not found')
+
+                messages = webchat_adapter.get_webchat_messages(pipeline_uuid, session_type)
+
+                return self.success(data={'messages': messages})
+
+            except Exception as e:
+                return self.http_status(500, -1, f'Internal server error: {str(e)}')
+
+        @self.route('/reset/<session_type>', methods=['POST'])
+        async def reset_session(session_type: str) -> str:
+            """Reset the debug session"""
+            try:
+                if session_type not in ['person', 'group']:
+                    return self.http_status(400, -1, 'session_type must be person or group')
+
+                webchat_adapter = None
+                for bot in self.ap.platform_mgr.bots:
+                    if hasattr(bot.adapter, '__class__') and bot.adapter.__class__.__name__ == 'WebChatAdapter':
+                        webchat_adapter = bot.adapter
+                        break
+
+                if not webchat_adapter:
+                    return self.http_status(404, -1, 'WebChat adapter not found')
+
+                webchat_adapter.reset_debug_session(session_type)
+
+                return self.success(data={'message': 'Session reset successfully'})
+
+            except Exception as e:
+                return self.http_status(500, -1, f'Internal server error: {str(e)}')

src/langbot/pkg/api/http/controller/groups/platform/adapters.py

@@ -0,0 +1,37 @@
+import quart
+import mimetypes
+from ... import group
+from langbot.pkg.utils import importutil
+
+
+@group.group_class('adapters', '/api/v1/platform/adapters')
+class AdaptersRouterGroup(group.RouterGroup):
+    async def initialize(self) -> None:
+        @self.route('', methods=['GET'])
+        async def _() -> str:
+            return self.success(data={'adapters': self.ap.platform_mgr.get_available_adapters_info()})
+
+        @self.route('/<adapter_name>', methods=['GET'])
+        async def _(adapter_name: str) -> str:
+            adapter_info = self.ap.platform_mgr.get_available_adapter_info_by_name(adapter_name)
+
+            if adapter_info is None:
+                return self.http_status(404, -1, 'adapter not found')
+
+            return self.success(data={'adapter': adapter_info})
+
+        @self.route('/<adapter_name>/icon', methods=['GET'], auth_type=group.AuthType.NONE)
+        async def _(adapter_name: str) -> quart.Response:
+            adapter_manifest = self.ap.platform_mgr.get_available_adapter_manifest_by_name(adapter_name)
+
+            if adapter_manifest is None:
+                return self.http_status(404, -1, 'adapter not found')
+
+            icon_path = adapter_manifest.icon_rel_path
+
+            if icon_path is None:
+                return self.http_status(404, -1, 'icon not found')
+
+            return quart.Response(
+                importutil.read_resource_file_bytes(icon_path), mimetype=mimetypes.guess_type(icon_path)[0]
+            )

src/langbot/pkg/api/http/controller/groups/platform/bots.py

@@ -0,0 +1,44 @@
+import quart
+
+from ... import group
+
+
+@group.group_class('bots', '/api/v1/platform/bots')
+class BotsRouterGroup(group.RouterGroup):
+    async def initialize(self) -> None:
+        @self.route('', methods=['GET', 'POST'], auth_type=group.AuthType.USER_TOKEN_OR_API_KEY)
+        async def _() -> str:
+            if quart.request.method == 'GET':
+                return self.success(data={'bots': await self.ap.bot_service.get_bots()})
+            elif quart.request.method == 'POST':
+                json_data = await quart.request.json
+                bot_uuid = await self.ap.bot_service.create_bot(json_data)
+                return self.success(data={'uuid': bot_uuid})
+
+        @self.route('/<bot_uuid>', methods=['GET', 'PUT', 'DELETE'], auth_type=group.AuthType.USER_TOKEN_OR_API_KEY)
+        async def _(bot_uuid: str) -> str:
+            if quart.request.method == 'GET':
+                bot = await self.ap.bot_service.get_bot(bot_uuid)
+                if bot is None:
+                    return self.http_status(404, -1, 'bot not found')
+                return self.success(data={'bot': bot})
+            elif quart.request.method == 'PUT':
+                json_data = await quart.request.json
+                await self.ap.bot_service.update_bot(bot_uuid, json_data)
+                return self.success()
+            elif quart.request.method == 'DELETE':
+                await self.ap.bot_service.delete_bot(bot_uuid)
+                return self.success()
+
+        @self.route('/<bot_uuid>/logs', methods=['POST'], auth_type=group.AuthType.USER_TOKEN_OR_API_KEY)
+        async def _(bot_uuid: str) -> str:
+            json_data = await quart.request.json
+            from_index = json_data.get('from_index', -1)
+            max_count = json_data.get('max_count', 10)
+            logs, total_count = await self.ap.bot_service.list_event_logs(bot_uuid, from_index, max_count)
+            return self.success(
+                data={
+                    'logs': logs,
+                    'total_count': total_count,
+                }
+            )

src/langbot/pkg/api/http/controller/groups/plugins.py

@@ -0,0 +1,309 @@
+from __future__ import annotations
+
+import base64
+import quart
+import re
+import httpx
+import uuid
+import os
+
+from .....core import taskmgr
+from .. import group
+from langbot_plugin.runtime.plugin.mgr import PluginInstallSource
+
+
+@group.group_class('plugins', '/api/v1/plugins')
+class PluginsRouterGroup(group.RouterGroup):
+    async def initialize(self) -> None:
+        @self.route('', methods=['GET'], auth_type=group.AuthType.USER_TOKEN)
+        async def _() -> str:
+            plugins = await self.ap.plugin_connector.list_plugins()
+
+            return self.success(data={'plugins': plugins})
+
+        @self.route(
+            '/<author>/<plugin_name>/upgrade',
+            methods=['POST'],
+            auth_type=group.AuthType.USER_TOKEN,
+        )
+        async def _(author: str, plugin_name: str) -> str:
+            ctx = taskmgr.TaskContext.new()
+            wrapper = self.ap.task_mgr.create_user_task(
+                self.ap.plugin_connector.upgrade_plugin(author, plugin_name, task_context=ctx),
+                kind='plugin-operation',
+                name=f'plugin-upgrade-{plugin_name}',
+                label=f'Upgrading plugin {plugin_name}',
+                context=ctx,
+            )
+            return self.success(data={'task_id': wrapper.id})
+
+        @self.route(
+            '/<author>/<plugin_name>',
+            methods=['GET', 'DELETE'],
+            auth_type=group.AuthType.USER_TOKEN,
+        )
+        async def _(author: str, plugin_name: str) -> str:
+            if quart.request.method == 'GET':
+                plugin = await self.ap.plugin_connector.get_plugin_info(author, plugin_name)
+                if plugin is None:
+                    return self.http_status(404, -1, 'plugin not found')
+                return self.success(data={'plugin': plugin})
+            elif quart.request.method == 'DELETE':
+                delete_data = quart.request.args.get('delete_data', 'false').lower() == 'true'
+                ctx = taskmgr.TaskContext.new()
+                wrapper = self.ap.task_mgr.create_user_task(
+                    self.ap.plugin_connector.delete_plugin(
+                        author, plugin_name, delete_data=delete_data, task_context=ctx
+                    ),
+                    kind='plugin-operation',
+                    name=f'plugin-remove-{plugin_name}',
+                    label=f'Removing plugin {plugin_name}',
+                    context=ctx,
+                )
+
+                return self.success(data={'task_id': wrapper.id})
+
+        @self.route(
+            '/<author>/<plugin_name>/config',
+            methods=['GET', 'PUT'],
+            auth_type=group.AuthType.USER_TOKEN,
+        )
+        async def _(author: str, plugin_name: str) -> quart.Response:
+            plugin = await self.ap.plugin_connector.get_plugin_info(author, plugin_name)
+            if plugin is None:
+                return self.http_status(404, -1, 'plugin not found')
+
+            if quart.request.method == 'GET':
+                return self.success(data={'config': plugin['plugin_config']})
+            elif quart.request.method == 'PUT':
+                data = await quart.request.json
+
+                await self.ap.plugin_connector.set_plugin_config(author, plugin_name, data)
+
+                return self.success(data={})
+
+        @self.route(
+            '/<author>/<plugin_name>/icon',
+            methods=['GET'],
+            auth_type=group.AuthType.NONE,
+        )
+        async def _(author: str, plugin_name: str) -> quart.Response:
+            icon_data = await self.ap.plugin_connector.get_plugin_icon(author, plugin_name)
+            icon_base64 = icon_data['plugin_icon_base64']
+            mime_type = icon_data['mime_type']
+
+            icon_data = base64.b64decode(icon_base64)
+
+            return quart.Response(icon_data, mimetype=mime_type)
+
+        @self.route('/github/releases', methods=['POST'], auth_type=group.AuthType.USER_TOKEN)
+        async def _() -> str:
+            """Get releases from a GitHub repository URL"""
+            data = await quart.request.json
+            repo_url = data.get('repo_url', '')
+
+            # Parse GitHub repository URL to extract owner and repo
+            # Supports: https://github.com/owner/repo or github.com/owner/repo
+            pattern = r'github\.com/([^/]+)/([^/]+?)(?:\.git)?(?:/.*)?$'
+            match = re.search(pattern, repo_url)
+
+            if not match:
+                return self.http_status(400, -1, 'Invalid GitHub repository URL')
+
+            owner, repo = match.groups()
+
+            try:
+                # Fetch releases from GitHub API
+                url = f'https://api.github.com/repos/{owner}/{repo}/releases'
+                async with httpx.AsyncClient(
+                    trust_env=True,
+                    follow_redirects=True,
+                    timeout=10,
+                ) as client:
+                    response = await client.get(url)
+                    response.raise_for_status()
+                    releases = response.json()
+
+                # Format releases data for frontend
+                formatted_releases = []
+                for release in releases:
+                    formatted_releases.append(
+                        {
+                            'id': release['id'],
+                            'tag_name': release['tag_name'],
+                            'name': release['name'],
+                            'published_at': release['published_at'],
+                            'prerelease': release['prerelease'],
+                            'draft': release['draft'],
+                        }
+                    )
+
+                return self.success(data={'releases': formatted_releases, 'owner': owner, 'repo': repo})
+            except httpx.RequestError as e:
+                return self.http_status(500, -1, f'Failed to fetch releases: {str(e)}')
+
+        @self.route(
+            '/github/release-assets',
+            methods=['POST'],
+            auth_type=group.AuthType.USER_TOKEN,
+        )
+        async def _() -> str:
+            """Get assets from a specific GitHub release"""
+            data = await quart.request.json
+            owner = data.get('owner', '')
+            repo = data.get('repo', '')
+            release_id = data.get('release_id', '')
+
+            if not all([owner, repo, release_id]):
+                return self.http_status(400, -1, 'Missing required parameters')
+
+            try:
+                # Fetch release assets from GitHub API
+                url = f'https://api.github.com/repos/{owner}/{repo}/releases/{release_id}'
+                async with httpx.AsyncClient(
+                    trust_env=True,
+                    follow_redirects=True,
+                    timeout=10,
+                ) as client:
+                    response = await client.get(
+                        url,
+                    )
+                    response.raise_for_status()
+                    release = response.json()
+
+                # Format assets data for frontend
+                formatted_assets = []
+                for asset in release.get('assets', []):
+                    formatted_assets.append(
+                        {
+                            'id': asset['id'],
+                            'name': asset['name'],
+                            'size': asset['size'],
+                            'download_url': asset['browser_download_url'],
+                            'content_type': asset['content_type'],
+                        }
+                    )
+
+                # add zipball as a downloadable asset
+                # formatted_assets.append(
+                #     {
+                #         "id": 0,
+                #         "name": "Source code (zip)",
+                #         "size": -1,
+                #         "download_url": release["zipball_url"],
+                #         "content_type": "application/zip",
+                #     }
+                # )
+
+                return self.success(data={'assets': formatted_assets})
+            except httpx.RequestError as e:
+                return self.http_status(500, -1, f'Failed to fetch release assets: {str(e)}')
+
+        @self.route('/install/github', methods=['POST'], auth_type=group.AuthType.USER_TOKEN)
+        async def _() -> str:
+            """Install plugin from GitHub release asset"""
+            data = await quart.request.json
+            asset_url = data.get('asset_url', '')
+            owner = data.get('owner', '')
+            repo = data.get('repo', '')
+            release_tag = data.get('release_tag', '')
+
+            if not asset_url:
+                return self.http_status(400, -1, 'Missing asset_url parameter')
+
+            ctx = taskmgr.TaskContext.new()
+            install_info = {
+                'asset_url': asset_url,
+                'owner': owner,
+                'repo': repo,
+                'release_tag': release_tag,
+                'github_url': f'https://github.com/{owner}/{repo}',
+            }
+
+            wrapper = self.ap.task_mgr.create_user_task(
+                self.ap.plugin_connector.install_plugin(PluginInstallSource.GITHUB, install_info, task_context=ctx),
+                kind='plugin-operation',
+                name='plugin-install-github',
+                label=f'Installing plugin from GitHub {owner}/{repo}@{release_tag}',
+                context=ctx,
+            )
+
+            return self.success(data={'task_id': wrapper.id})
+
+        @self.route(
+            '/install/marketplace',
+            methods=['POST'],
+            auth_type=group.AuthType.USER_TOKEN,
+        )
+        async def _() -> str:
+            data = await quart.request.json
+
+            ctx = taskmgr.TaskContext.new()
+            wrapper = self.ap.task_mgr.create_user_task(
+                self.ap.plugin_connector.install_plugin(PluginInstallSource.MARKETPLACE, data, task_context=ctx),
+                kind='plugin-operation',
+                name='plugin-install-marketplace',
+                label=f'Installing plugin from marketplace ...{data}',
+                context=ctx,
+            )
+
+            return self.success(data={'task_id': wrapper.id})
+
+        @self.route('/install/local', methods=['POST'], auth_type=group.AuthType.USER_TOKEN)
+        async def _() -> str:
+            file = (await quart.request.files).get('file')
+            if file is None:
+                return self.http_status(400, -1, 'file is required')
+
+            file_bytes = file.read()
+
+            data = {
+                'plugin_file': file_bytes,
+            }
+
+            ctx = taskmgr.TaskContext.new()
+            wrapper = self.ap.task_mgr.create_user_task(
+                self.ap.plugin_connector.install_plugin(PluginInstallSource.LOCAL, data, task_context=ctx),
+                kind='plugin-operation',
+                name='plugin-install-local',
+                label=f'Installing plugin from local ...{file.filename}',
+                context=ctx,
+            )
+
+            return self.success(data={'task_id': wrapper.id})
+
+        @self.route('/config-files', methods=['POST'], auth_type=group.AuthType.USER_TOKEN)
+        async def _() -> str:
+            """Upload a file for plugin configuration"""
+            file = (await quart.request.files).get('file')
+            if file is None:
+                return self.http_status(400, -1, 'file is required')
+
+            # Check file size (10MB limit)
+            MAX_FILE_SIZE = 10 * 1024 * 1024  # 10MB
+            file_bytes = file.read()
+            if len(file_bytes) > MAX_FILE_SIZE:
+                return self.http_status(400, -1, 'file size exceeds 10MB limit')
+
+            # Generate unique file key with original extension
+            original_filename = file.filename
+            _, ext = os.path.splitext(original_filename)
+            file_key = f'plugin_config_{uuid.uuid4().hex}{ext}'
+
+            # Save file using storage manager
+            await self.ap.storage_mgr.storage_provider.save(file_key, file_bytes)
+
+            return self.success(data={'file_key': file_key})
+
+        @self.route('/config-files/<file_key>', methods=['DELETE'], auth_type=group.AuthType.USER_TOKEN)
+        async def _(file_key: str) -> str:
+            """Delete a plugin configuration file"""
+            # Only allow deletion of files with plugin_config_ prefix for security
+            if not file_key.startswith('plugin_config_'):
+                return self.http_status(400, -1, 'invalid file key')
+
+            try:
+                await self.ap.storage_mgr.storage_provider.delete(file_key)
+                return self.success(data={'deleted': True})
+            except Exception as e:
+                return self.http_status(500, -1, f'failed to delete file: {str(e)}')

src/langbot/pkg/api/http/controller/groups/provider/models.py

@@ -0,0 +1,89 @@
+import quart
+
+from ... import group
+
+
+@group.group_class('models/llm', '/api/v1/provider/models/llm')
+class LLMModelsRouterGroup(group.RouterGroup):
+    async def initialize(self) -> None:
+        @self.route('', methods=['GET', 'POST'], auth_type=group.AuthType.USER_TOKEN_OR_API_KEY)
+        async def _() -> str:
+            if quart.request.method == 'GET':
+                return self.success(data={'models': await self.ap.llm_model_service.get_llm_models()})
+            elif quart.request.method == 'POST':
+                json_data = await quart.request.json
+
+                model_uuid = await self.ap.llm_model_service.create_llm_model(json_data)
+
+                return self.success(data={'uuid': model_uuid})
+
+        @self.route('/<model_uuid>', methods=['GET', 'PUT', 'DELETE'], auth_type=group.AuthType.USER_TOKEN_OR_API_KEY)
+        async def _(model_uuid: str) -> str:
+            if quart.request.method == 'GET':
+                model = await self.ap.llm_model_service.get_llm_model(model_uuid)
+
+                if model is None:
+                    return self.http_status(404, -1, 'model not found')
+
+                return self.success(data={'model': model})
+            elif quart.request.method == 'PUT':
+                json_data = await quart.request.json
+
+                await self.ap.llm_model_service.update_llm_model(model_uuid, json_data)
+
+                return self.success()
+            elif quart.request.method == 'DELETE':
+                await self.ap.llm_model_service.delete_llm_model(model_uuid)
+
+                return self.success()
+
+        @self.route('/<model_uuid>/test', methods=['POST'], auth_type=group.AuthType.USER_TOKEN_OR_API_KEY)
+        async def _(model_uuid: str) -> str:
+            json_data = await quart.request.json
+
+            await self.ap.llm_model_service.test_llm_model(model_uuid, json_data)
+
+            return self.success()
+
+
+@group.group_class('models/embedding', '/api/v1/provider/models/embedding')
+class EmbeddingModelsRouterGroup(group.RouterGroup):
+    async def initialize(self) -> None:
+        @self.route('', methods=['GET', 'POST'], auth_type=group.AuthType.USER_TOKEN_OR_API_KEY)
+        async def _() -> str:
+            if quart.request.method == 'GET':
+                return self.success(data={'models': await self.ap.embedding_models_service.get_embedding_models()})
+            elif quart.request.method == 'POST':
+                json_data = await quart.request.json
+
+                model_uuid = await self.ap.embedding_models_service.create_embedding_model(json_data)
+
+                return self.success(data={'uuid': model_uuid})
+
+        @self.route('/<model_uuid>', methods=['GET', 'PUT', 'DELETE'], auth_type=group.AuthType.USER_TOKEN_OR_API_KEY)
+        async def _(model_uuid: str) -> str:
+            if quart.request.method == 'GET':
+                model = await self.ap.embedding_models_service.get_embedding_model(model_uuid)
+
+                if model is None:
+                    return self.http_status(404, -1, 'model not found')
+
+                return self.success(data={'model': model})
+            elif quart.request.method == 'PUT':
+                json_data = await quart.request.json
+
+                await self.ap.embedding_models_service.update_embedding_model(model_uuid, json_data)
+
+                return self.success()
+            elif quart.request.method == 'DELETE':
+                await self.ap.embedding_models_service.delete_embedding_model(model_uuid)
+
+                return self.success()
+
+        @self.route('/<model_uuid>/test', methods=['POST'], auth_type=group.AuthType.USER_TOKEN_OR_API_KEY)
+        async def _(model_uuid: str) -> str:
+            json_data = await quart.request.json
+
+            await self.ap.embedding_models_service.test_embedding_model(model_uuid, json_data)
+
+            return self.success()

src/langbot/pkg/api/http/controller/groups/provider/requesters.py

@@ -0,0 +1,39 @@
+import quart
+import mimetypes
+
+from ... import group
+from langbot.pkg.utils import importutil
+
+
+@group.group_class('provider/requesters', '/api/v1/provider/requesters')
+class RequestersRouterGroup(group.RouterGroup):
+    async def initialize(self) -> None:
+        @self.route('', methods=['GET'])
+        async def _() -> quart.Response:
+            model_type = quart.request.args.get('type', '')
+            return self.success(data={'requesters': self.ap.model_mgr.get_available_requesters_info(model_type)})
+
+        @self.route('/<requester_name>', methods=['GET'])
+        async def _(requester_name: str) -> quart.Response:
+            requester_info = self.ap.model_mgr.get_available_requester_info_by_name(requester_name)
+
+            if requester_info is None:
+                return self.http_status(404, -1, 'requester not found')
+
+            return self.success(data={'requester': requester_info})
+
+        @self.route('/<requester_name>/icon', methods=['GET'], auth_type=group.AuthType.NONE)
+        async def _(requester_name: str) -> quart.Response:
+            requester_manifest = self.ap.model_mgr.get_available_requester_manifest_by_name(requester_name)
+
+            if requester_manifest is None:
+                return self.http_status(404, -1, 'requester not found')
+
+            icon_path = requester_manifest.icon_rel_path
+
+            if icon_path is None:
+                return self.http_status(404, -1, 'icon not found')
+
+            return quart.Response(
+                importutil.read_resource_file_bytes(icon_path), mimetype=mimetypes.guess_type(icon_path)[0]
+            )

src/langbot/pkg/api/http/controller/groups/resources/mcp.py

@@ -0,0 +1,62 @@
+from __future__ import annotations
+
+import quart
+import traceback
+
+
+from ... import group
+
+
+@group.group_class('mcp', '/api/v1/mcp')
+class MCPRouterGroup(group.RouterGroup):
+    async def initialize(self) -> None:
+        @self.route('/servers', methods=['GET', 'POST'], auth_type=group.AuthType.USER_TOKEN)
+        async def _() -> str:
+            """获取MCP服务器列表"""
+            if quart.request.method == 'GET':
+                servers = await self.ap.mcp_service.get_mcp_servers(contain_runtime_info=True)
+
+                return self.success(data={'servers': servers})
+
+            elif quart.request.method == 'POST':
+                data = await quart.request.json
+
+                try:
+                    uuid = await self.ap.mcp_service.create_mcp_server(data)
+                    return self.success(data={'uuid': uuid})
+                except Exception as e:
+                    traceback.print_exc()
+                    return self.http_status(500, -1, f'Failed to create MCP server: {str(e)}')
+
+        @self.route('/servers/<server_name>', methods=['GET', 'PUT', 'DELETE'], auth_type=group.AuthType.USER_TOKEN)
+        async def _(server_name: str) -> str:
+            """获取、更新或删除MCP服务器配置"""
+
+            server_data = await self.ap.mcp_service.get_mcp_server_by_name(server_name)
+            if server_data is None:
+                return self.http_status(404, -1, 'Server not found')
+
+            if quart.request.method == 'GET':
+                return self.success(data={'server': server_data})
+
+            elif quart.request.method == 'PUT':
+                data = await quart.request.json
+                try:
+                    await self.ap.mcp_service.update_mcp_server(server_data['uuid'], data)
+                    return self.success()
+                except Exception as e:
+                    return self.http_status(500, -1, f'Failed to update MCP server: {str(e)}')
+
+            elif quart.request.method == 'DELETE':
+                try:
+                    await self.ap.mcp_service.delete_mcp_server(server_data['uuid'])
+                    return self.success()
+                except Exception as e:
+                    return self.http_status(500, -1, f'Failed to delete MCP server: {str(e)}')
+
+        @self.route('/servers/<server_name>/test', methods=['POST'], auth_type=group.AuthType.USER_TOKEN)
+        async def _(server_name: str) -> str:
+            """测试MCP服务器连接"""
+            server_data = await quart.request.json
+            task_id = await self.ap.mcp_service.test_mcp_server(server_name=server_name, server_data=server_data)
+            return self.success(data={'task_id': task_id})

src/langbot/pkg/api/http/controller/groups/stats.py

@@ -0,0 +1,19 @@
+from .. import group
+
+
+@group.group_class('stats', '/api/v1/stats')
+class StatsRouterGroup(group.RouterGroup):
+    async def initialize(self) -> None:
+        @self.route('/basic', methods=['GET'], auth_type=group.AuthType.USER_TOKEN)
+        async def _() -> str:
+            conv_count = 0
+            for session in self.ap.sess_mgr.session_list:
+                conv_count += len(session.conversations if session.conversations is not None else [])
+
+            return self.success(
+                data={
+                    'active_session_count': len(self.ap.sess_mgr.session_list),
+                    'conversation_count': conv_count,
+                    'query_count': self.ap.query_pool.query_id_counter,
+                }
+            )

src/langbot/pkg/api/http/controller/groups/system.py

@@ -0,0 +1,115 @@
+import quart
+
+from .. import group
+from .....utils import constants
+
+
+@group.group_class('system', '/api/v1/system')
+class SystemRouterGroup(group.RouterGroup):
+    async def initialize(self) -> None:
+        @self.route('/info', methods=['GET'], auth_type=group.AuthType.NONE)
+        async def _() -> str:
+            return self.success(
+                data={
+                    'version': constants.semantic_version,
+                    'debug': constants.debug_mode,
+                    'enable_marketplace': self.ap.instance_config.data.get('plugin', {}).get(
+                        'enable_marketplace', True
+                    ),
+                    'cloud_service_url': (
+                        self.ap.instance_config.data.get('plugin', {}).get(
+                            'cloud_service_url', 'https://space.langbot.app'
+                        )
+                        if 'cloud_service_url' in self.ap.instance_config.data.get('plugin', {})
+                        else 'https://space.langbot.app'
+                    ),
+                }
+            )
+
+        @self.route('/tasks', methods=['GET'], auth_type=group.AuthType.USER_TOKEN)
+        async def _() -> str:
+            task_type = quart.request.args.get('type')
+
+            if task_type == '':
+                task_type = None
+
+            return self.success(data=self.ap.task_mgr.get_tasks_dict(task_type))
+
+        @self.route('/tasks/<task_id>', methods=['GET'], auth_type=group.AuthType.USER_TOKEN)
+        async def _(task_id: str) -> str:
+            task = self.ap.task_mgr.get_task_by_id(int(task_id))
+
+            if task is None:
+                return self.http_status(404, 404, 'Task not found')
+
+            return self.success(data=task.to_dict())
+
+        @self.route('/debug/exec', methods=['POST'], auth_type=group.AuthType.USER_TOKEN)
+        async def _() -> str:
+            if not constants.debug_mode:
+                return self.http_status(403, 403, 'Forbidden')
+
+            py_code = await quart.request.data
+
+            ap = self.ap
+
+            return self.success(data=exec(py_code, {'ap': ap}))
+
+        @self.route('/debug/tools/call', methods=['POST'], auth_type=group.AuthType.USER_TOKEN)
+        async def _() -> str:
+            if not constants.debug_mode:
+                return self.http_status(403, 403, 'Forbidden')
+
+            data = await quart.request.json
+
+            return self.success(
+                data=await self.ap.tool_mgr.execute_func_call(data['tool_name'], data['tool_parameters'])
+            )
+
+        @self.route(
+            '/debug/plugin/action',
+            methods=['POST'],
+            auth_type=group.AuthType.USER_TOKEN,
+        )
+        async def _() -> str:
+            if not constants.debug_mode:
+                return self.http_status(403, 403, 'Forbidden')
+
+            data = await quart.request.json
+
+            class AnoymousAction:
+                value = 'anonymous_action'
+
+                def __init__(self, value: str):
+                    self.value = value
+
+            resp = await self.ap.plugin_connector.handler.call_action(
+                AnoymousAction(data['action']),
+                data['data'],
+                timeout=data.get('timeout', 10),
+            )
+
+            return self.success(data=resp)
+
+        @self.route(
+            '/status/plugin-system',
+            methods=['GET'],
+            auth_type=group.AuthType.USER_TOKEN,
+        )
+        async def _() -> str:
+            plugin_connector_error = 'ok'
+            is_connected = True
+
+            try:
+                await self.ap.plugin_connector.ping_plugin_runtime()
+            except Exception as e:
+                plugin_connector_error = str(e)
+                is_connected = False
+
+            return self.success(
+                data={
+                    'is_enable': self.ap.plugin_connector.is_enable_plugin,
+                    'is_connected': is_connected,
+                    'plugin_connector_error': plugin_connector_error,
+                }
+            )

src/langbot/pkg/api/http/controller/groups/user.py

@@ -0,0 +1,85 @@
+import quart
+import argon2
+import asyncio
+
+from .. import group
+
+
+@group.group_class('user', '/api/v1/user')
+class UserRouterGroup(group.RouterGroup):
+    async def initialize(self) -> None:
+        @self.route('/init', methods=['GET', 'POST'], auth_type=group.AuthType.NONE)
+        async def _() -> str:
+            if quart.request.method == 'GET':
+                return self.success(data={'initialized': await self.ap.user_service.is_initialized()})
+
+            if await self.ap.user_service.is_initialized():
+                return self.fail(1, 'System already initialized')
+
+            json_data = await quart.request.json
+
+            user_email = json_data['user']
+            password = json_data['password']
+
+            await self.ap.user_service.create_user(user_email, password)
+
+            return self.success()
+
+        @self.route('/auth', methods=['POST'], auth_type=group.AuthType.NONE)
+        async def _() -> str:
+            json_data = await quart.request.json
+
+            try:
+                token = await self.ap.user_service.authenticate(json_data['user'], json_data['password'])
+            except argon2.exceptions.VerifyMismatchError:
+                return self.fail(1, 'Invalid username or password')
+
+            return self.success(data={'token': token})
+
+        @self.route('/check-token', methods=['GET'], auth_type=group.AuthType.USER_TOKEN)
+        async def _(user_email: str) -> str:
+            token = await self.ap.user_service.generate_jwt_token(user_email)
+
+            return self.success(data={'token': token})
+
+        @self.route('/reset-password', methods=['POST'], auth_type=group.AuthType.NONE)
+        async def _() -> str:
+            json_data = await quart.request.json
+
+            user_email = json_data['user']
+            recovery_key = json_data['recovery_key']
+            new_password = json_data['new_password']
+
+            # hard sleep 3s for security
+            await asyncio.sleep(3)
+
+            if not await self.ap.user_service.is_initialized():
+                return self.http_status(400, -1, 'System not initialized')
+
+            user_obj = await self.ap.user_service.get_user_by_email(user_email)
+
+            if user_obj is None:
+                return self.http_status(400, -1, 'User not found')
+
+            if recovery_key != self.ap.instance_config.data['system']['recovery_key']:
+                return self.http_status(403, -1, 'Invalid recovery key')
+
+            await self.ap.user_service.reset_password(user_email, new_password)
+
+            return self.success(data={'user': user_email})
+
+        @self.route('/change-password', methods=['POST'], auth_type=group.AuthType.USER_TOKEN)
+        async def _(user_email: str) -> str:
+            json_data = await quart.request.json
+
+            current_password = json_data['current_password']
+            new_password = json_data['new_password']
+
+            try:
+                await self.ap.user_service.change_password(user_email, current_password, new_password)
+            except argon2.exceptions.VerifyMismatchError:
+                return self.http_status(400, -1, 'Current password is incorrect')
+            except ValueError as e:
+                return self.http_status(400, -1, str(e))
+
+            return self.success(data={'user': user_email})

src/langbot/pkg/api/http/controller/groups/webhooks.py

@@ -0,0 +1,49 @@
+import quart
+
+from .. import group
+
+
+@group.group_class('webhooks', '/api/v1/webhooks')
+class WebhooksRouterGroup(group.RouterGroup):
+    async def initialize(self) -> None:
+        @self.route('', methods=['GET', 'POST'])
+        async def _() -> str:
+            if quart.request.method == 'GET':
+                webhooks = await self.ap.webhook_service.get_webhooks()
+                return self.success(data={'webhooks': webhooks})
+            elif quart.request.method == 'POST':
+                json_data = await quart.request.json
+                name = json_data.get('name', '')
+                url = json_data.get('url', '')
+                description = json_data.get('description', '')
+                enabled = json_data.get('enabled', True)
+
+                if not name:
+                    return self.http_status(400, -1, 'Name is required')
+                if not url:
+                    return self.http_status(400, -1, 'URL is required')
+
+                webhook = await self.ap.webhook_service.create_webhook(name, url, description, enabled)
+                return self.success(data={'webhook': webhook})
+
+        @self.route('/<int:webhook_id>', methods=['GET', 'PUT', 'DELETE'])
+        async def _(webhook_id: int) -> str:
+            if quart.request.method == 'GET':
+                webhook = await self.ap.webhook_service.get_webhook(webhook_id)
+                if webhook is None:
+                    return self.http_status(404, -1, 'Webhook not found')
+                return self.success(data={'webhook': webhook})
+
+            elif quart.request.method == 'PUT':
+                json_data = await quart.request.json
+                name = json_data.get('name')
+                url = json_data.get('url')
+                description = json_data.get('description')
+                enabled = json_data.get('enabled')
+
+                await self.ap.webhook_service.update_webhook(webhook_id, name, url, description, enabled)
+                return self.success()
+
+            elif quart.request.method == 'DELETE':
+                await self.ap.webhook_service.delete_webhook(webhook_id)
+                return self.success()

src/langbot/pkg/api/http/controller/main.py

@@ -0,0 +1,136 @@
+from __future__ import annotations
+
+import asyncio
+import os
+
+import quart
+import quart_cors
+from werkzeug.exceptions import RequestEntityTooLarge
+
+from ....core import app, entities as core_entities
+from ....utils import importutil
+
+from . import groups
+from . import group
+from .groups import provider as groups_provider
+from .groups import platform as groups_platform
+from .groups import pipelines as groups_pipelines
+from .groups import knowledge as groups_knowledge
+from .groups import resources as groups_resources
+
+importutil.import_modules_in_pkg(groups)
+importutil.import_modules_in_pkg(groups_provider)
+importutil.import_modules_in_pkg(groups_platform)
+importutil.import_modules_in_pkg(groups_pipelines)
+importutil.import_modules_in_pkg(groups_knowledge)
+importutil.import_modules_in_pkg(groups_resources)
+
+
+class HTTPController:
+    ap: app.Application
+
+    quart_app: quart.Quart
+
+    def __init__(self, ap: app.Application) -> None:
+        self.ap = ap
+        self.quart_app = quart.Quart(__name__)
+        quart_cors.cors(self.quart_app, allow_origin='*')
+
+        # Set maximum content length to prevent large file uploads
+        self.quart_app.config['MAX_CONTENT_LENGTH'] = group.MAX_FILE_SIZE
+
+    async def initialize(self) -> None:
+        # Register custom error handler for file size limit
+        @self.quart_app.errorhandler(RequestEntityTooLarge)
+        async def handle_request_entity_too_large(e):
+            return quart.jsonify(
+                {
+                    'code': 400,
+                    'msg': 'File size exceeds 10MB limit. Please split large files into smaller parts.',
+                }
+            ), 400
+
+        await self.register_routes()
+
+    async def run(self) -> None:
+        if True:
+
+            async def shutdown_trigger_placeholder():
+                while True:
+                    await asyncio.sleep(1)
+
+            async def exception_handler(*args, **kwargs):
+                try:
+                    await self.quart_app.run_task(*args, **kwargs)
+                except Exception as e:
+                    self.ap.logger.error(f'Failed to start HTTP service: {e}')
+
+            self.ap.task_mgr.create_task(
+                exception_handler(
+                    host='0.0.0.0',
+                    port=self.ap.instance_config.data['api']['port'],
+                    shutdown_trigger=shutdown_trigger_placeholder,
+                ),
+                name='http-api-quart',
+                scopes=[core_entities.LifecycleControlScope.APPLICATION],
+            )
+
+            # await asyncio.sleep(5)
+
+    async def register_routes(self) -> None:
+        @self.quart_app.route('/healthz')
+        async def healthz():
+            return {'code': 0, 'msg': 'ok'}
+
+        for g in group.preregistered_groups:
+            ginst = g(self.ap, self.quart_app)
+            await ginst.initialize()
+
+        from ....utils import paths
+
+        frontend_path = paths.get_frontend_path()
+
+        @self.quart_app.route('/')
+        async def index():
+            return await quart.send_from_directory(frontend_path, 'index.html', mimetype='text/html')
+
+        @self.quart_app.route('/<path:path>')
+        async def static_file(path: str):
+            if not (
+                os.path.exists(os.path.join(frontend_path, path)) and os.path.isfile(os.path.join(frontend_path, path))
+            ):
+                if os.path.exists(os.path.join(frontend_path, path + '.html')):
+                    path += '.html'
+                else:
+                    return await quart.send_from_directory(frontend_path, '404.html')
+
+            mimetype = None
+
+            if path.endswith('.html'):
+                mimetype = 'text/html'
+            elif path.endswith('.js'):
+                mimetype = 'application/javascript'
+            elif path.endswith('.css'):
+                mimetype = 'text/css'
+            elif path.endswith('.png'):
+                mimetype = 'image/png'
+            elif path.endswith('.jpg'):
+                mimetype = 'image/jpeg'
+            elif path.endswith('.jpeg'):
+                mimetype = 'image/jpeg'
+            elif path.endswith('.gif'):
+                mimetype = 'image/gif'
+            elif path.endswith('.svg'):
+                mimetype = 'image/svg+xml'
+            elif path.endswith('.ico'):
+                mimetype = 'image/x-icon'
+            elif path.endswith('.json'):
+                mimetype = 'application/json'
+            elif path.endswith('.txt'):
+                mimetype = 'text/plain'
+
+            response = await quart.send_from_directory(frontend_path, path, mimetype=mimetype)
+            response.headers['Cache-Control'] = 'no-cache, no-store, must-revalidate'
+            response.headers['Pragma'] = 'no-cache'
+            response.headers['Expires'] = '0'
+            return response

src/langbot/pkg/api/http/service/apikey.py

@@ -0,0 +1,77 @@
+from __future__ import annotations
+
+import secrets
+import sqlalchemy
+
+from ....core import app
+from ....entity.persistence import apikey
+
+
+class ApiKeyService:
+    ap: app.Application
+
+    def __init__(self, ap: app.Application) -> None:
+        self.ap = ap
+
+    async def get_api_keys(self) -> list[dict]:
+        """Get all API keys"""
+        result = await self.ap.persistence_mgr.execute_async(sqlalchemy.select(apikey.ApiKey))
+
+        keys = result.all()
+        return [self.ap.persistence_mgr.serialize_model(apikey.ApiKey, key) for key in keys]
+
+    async def create_api_key(self, name: str, description: str = '') -> dict:
+        """Create a new API key"""
+        # Generate a secure random API key
+        key = f'lbk_{secrets.token_urlsafe(32)}'
+
+        key_data = {'name': name, 'key': key, 'description': description}
+
+        await self.ap.persistence_mgr.execute_async(sqlalchemy.insert(apikey.ApiKey).values(**key_data))
+
+        # Retrieve the created key
+        result = await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.select(apikey.ApiKey).where(apikey.ApiKey.key == key)
+        )
+        created_key = result.first()
+
+        return self.ap.persistence_mgr.serialize_model(apikey.ApiKey, created_key)
+
+    async def get_api_key(self, key_id: int) -> dict | None:
+        """Get a specific API key by ID"""
+        result = await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.select(apikey.ApiKey).where(apikey.ApiKey.id == key_id)
+        )
+
+        key = result.first()
+
+        if key is None:
+            return None
+
+        return self.ap.persistence_mgr.serialize_model(apikey.ApiKey, key)
+
+    async def verify_api_key(self, key: str) -> bool:
+        """Verify if an API key is valid"""
+        result = await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.select(apikey.ApiKey).where(apikey.ApiKey.key == key)
+        )
+
+        key_obj = result.first()
+        return key_obj is not None
+
+    async def delete_api_key(self, key_id: int) -> None:
+        """Delete an API key"""
+        await self.ap.persistence_mgr.execute_async(sqlalchemy.delete(apikey.ApiKey).where(apikey.ApiKey.id == key_id))
+
+    async def update_api_key(self, key_id: int, name: str = None, description: str = None) -> None:
+        """Update an API key's metadata (name, description)"""
+        update_data = {}
+        if name is not None:
+            update_data['name'] = name
+        if description is not None:
+            update_data['description'] = description
+
+        if update_data:
+            await self.ap.persistence_mgr.execute_async(
+                sqlalchemy.update(apikey.ApiKey).where(apikey.ApiKey.id == key_id).values(**update_data)
+            )

src/langbot/pkg/api/http/service/bot.py

@@ -0,0 +1,141 @@
+from __future__ import annotations
+
+import uuid
+import sqlalchemy
+import typing
+
+from ....core import app
+from ....entity.persistence import bot as persistence_bot
+from ....entity.persistence import pipeline as persistence_pipeline
+
+
+class BotService:
+    """Bot service"""
+
+    ap: app.Application
+
+    def __init__(self, ap: app.Application) -> None:
+        self.ap = ap
+
+    async def get_bots(self, include_secret: bool = True) -> list[dict]:
+        """获取所有机器人"""
+        result = await self.ap.persistence_mgr.execute_async(sqlalchemy.select(persistence_bot.Bot))
+
+        bots = result.all()
+
+        masked_columns = []
+        if not include_secret:
+            masked_columns = ['adapter_config']
+
+        return [self.ap.persistence_mgr.serialize_model(persistence_bot.Bot, bot, masked_columns) for bot in bots]
+
+    async def get_bot(self, bot_uuid: str, include_secret: bool = True) -> dict | None:
+        """获取机器人"""
+        result = await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.select(persistence_bot.Bot).where(persistence_bot.Bot.uuid == bot_uuid)
+        )
+
+        bot = result.first()
+
+        if bot is None:
+            return None
+
+        masked_columns = []
+        if not include_secret:
+            masked_columns = ['adapter_config']
+
+        return self.ap.persistence_mgr.serialize_model(persistence_bot.Bot, bot, masked_columns)
+
+    async def get_runtime_bot_info(self, bot_uuid: str, include_secret: bool = True) -> dict:
+        """获取机器人运行时信息"""
+        persistence_bot = await self.get_bot(bot_uuid, include_secret)
+        if persistence_bot is None:
+            raise Exception('Bot not found')
+
+        adapter_runtime_values = {}
+
+        runtime_bot = await self.ap.platform_mgr.get_bot_by_uuid(bot_uuid)
+        if runtime_bot is not None:
+            adapter_runtime_values['bot_account_id'] = runtime_bot.adapter.bot_account_id
+
+        persistence_bot['adapter_runtime_values'] = adapter_runtime_values
+
+        return persistence_bot
+
+    async def create_bot(self, bot_data: dict) -> str:
+        """Create bot"""
+        # TODO: 检查配置信息格式
+        bot_data['uuid'] = str(uuid.uuid4())
+
+        # checkout the default pipeline
+        result = await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.select(persistence_pipeline.LegacyPipeline).where(
+                persistence_pipeline.LegacyPipeline.is_default == True
+            )
+        )
+        pipeline = result.first()
+        if pipeline is not None:
+            bot_data['use_pipeline_uuid'] = pipeline.uuid
+            bot_data['use_pipeline_name'] = pipeline.name
+
+        await self.ap.persistence_mgr.execute_async(sqlalchemy.insert(persistence_bot.Bot).values(bot_data))
+
+        bot = await self.get_bot(bot_data['uuid'])
+
+        await self.ap.platform_mgr.load_bot(bot)
+
+        return bot_data['uuid']
+
+    async def update_bot(self, bot_uuid: str, bot_data: dict) -> None:
+        """Update bot"""
+        if 'uuid' in bot_data:
+            del bot_data['uuid']
+
+        # set use_pipeline_name
+        if 'use_pipeline_uuid' in bot_data:
+            result = await self.ap.persistence_mgr.execute_async(
+                sqlalchemy.select(persistence_pipeline.LegacyPipeline).where(
+                    persistence_pipeline.LegacyPipeline.uuid == bot_data['use_pipeline_uuid']
+                )
+            )
+            pipeline = result.first()
+            if pipeline is not None:
+                bot_data['use_pipeline_name'] = pipeline.name
+            else:
+                raise Exception('Pipeline not found')
+
+        await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.update(persistence_bot.Bot).values(bot_data).where(persistence_bot.Bot.uuid == bot_uuid)
+        )
+        await self.ap.platform_mgr.remove_bot(bot_uuid)
+
+        # select from db
+        bot = await self.get_bot(bot_uuid)
+
+        runtime_bot = await self.ap.platform_mgr.load_bot(bot)
+
+        if runtime_bot.enable:
+            await runtime_bot.run()
+
+        # update all conversation that use this bot
+        for session in self.ap.sess_mgr.session_list:
+            if session.using_conversation is not None and session.using_conversation.bot_uuid == bot_uuid:
+                session.using_conversation = None
+
+    async def delete_bot(self, bot_uuid: str) -> None:
+        """Delete bot"""
+        await self.ap.platform_mgr.remove_bot(bot_uuid)
+        await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.delete(persistence_bot.Bot).where(persistence_bot.Bot.uuid == bot_uuid)
+        )
+
+    async def list_event_logs(
+        self, bot_uuid: str, from_index: int, max_count: int
+    ) -> typing.Tuple[list[dict], int, int, int]:
+        runtime_bot = await self.ap.platform_mgr.get_bot_by_uuid(bot_uuid)
+        if runtime_bot is None:
+            raise Exception('Bot not found')
+
+        logs, total_count = await runtime_bot.logger.get_logs(from_index, max_count)
+
+        return [log.to_json() for log in logs], total_count

src/langbot/pkg/api/http/service/knowledge.py

@@ -0,0 +1,120 @@
+from __future__ import annotations
+
+import uuid
+import sqlalchemy
+
+from ....core import app
+from ....entity.persistence import rag as persistence_rag
+
+
+class KnowledgeService:
+    """知识库服务"""
+
+    ap: app.Application
+
+    def __init__(self, ap: app.Application) -> None:
+        self.ap = ap
+
+    async def get_knowledge_bases(self) -> list[dict]:
+        """获取所有知识库"""
+        result = await self.ap.persistence_mgr.execute_async(sqlalchemy.select(persistence_rag.KnowledgeBase))
+        knowledge_bases = result.all()
+        return [
+            self.ap.persistence_mgr.serialize_model(persistence_rag.KnowledgeBase, knowledge_base)
+            for knowledge_base in knowledge_bases
+        ]
+
+    async def get_knowledge_base(self, kb_uuid: str) -> dict | None:
+        """获取知识库"""
+        result = await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.select(persistence_rag.KnowledgeBase).where(persistence_rag.KnowledgeBase.uuid == kb_uuid)
+        )
+        knowledge_base = result.first()
+        if knowledge_base is None:
+            return None
+        return self.ap.persistence_mgr.serialize_model(persistence_rag.KnowledgeBase, knowledge_base)
+
+    async def create_knowledge_base(self, kb_data: dict) -> str:
+        """创建知识库"""
+        kb_data['uuid'] = str(uuid.uuid4())
+        await self.ap.persistence_mgr.execute_async(sqlalchemy.insert(persistence_rag.KnowledgeBase).values(kb_data))
+
+        kb = await self.get_knowledge_base(kb_data['uuid'])
+
+        await self.ap.rag_mgr.load_knowledge_base(kb)
+
+        return kb_data['uuid']
+
+    async def update_knowledge_base(self, kb_uuid: str, kb_data: dict) -> None:
+        """更新知识库"""
+        if 'uuid' in kb_data:
+            del kb_data['uuid']
+
+        if 'embedding_model_uuid' in kb_data:
+            del kb_data['embedding_model_uuid']
+
+        await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.update(persistence_rag.KnowledgeBase)
+            .values(kb_data)
+            .where(persistence_rag.KnowledgeBase.uuid == kb_uuid)
+        )
+        await self.ap.rag_mgr.remove_knowledge_base_from_runtime(kb_uuid)
+
+        kb = await self.get_knowledge_base(kb_uuid)
+
+        await self.ap.rag_mgr.load_knowledge_base(kb)
+
+    async def store_file(self, kb_uuid: str, file_id: str) -> int:
+        """存储文件"""
+        # await self.ap.persistence_mgr.execute_async(sqlalchemy.insert(persistence_rag.File).values(kb_id=kb_uuid, file_id=file_id))
+        # await self.ap.rag_mgr.store_file(file_id)
+        runtime_kb = await self.ap.rag_mgr.get_knowledge_base_by_uuid(kb_uuid)
+        if runtime_kb is None:
+            raise Exception('Knowledge base not found')
+        return await runtime_kb.store_file(file_id)
+
+    async def retrieve_knowledge_base(self, kb_uuid: str, query: str) -> list[dict]:
+        """检索知识库"""
+        runtime_kb = await self.ap.rag_mgr.get_knowledge_base_by_uuid(kb_uuid)
+        if runtime_kb is None:
+            raise Exception('Knowledge base not found')
+        return [
+            result.model_dump() for result in await runtime_kb.retrieve(query, runtime_kb.knowledge_base_entity.top_k)
+        ]
+
+    async def get_files_by_knowledge_base(self, kb_uuid: str) -> list[dict]:
+        """获取知识库文件"""
+        result = await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.select(persistence_rag.File).where(persistence_rag.File.kb_id == kb_uuid)
+        )
+        files = result.all()
+        return [self.ap.persistence_mgr.serialize_model(persistence_rag.File, file) for file in files]
+
+    async def delete_file(self, kb_uuid: str, file_id: str) -> None:
+        """删除文件"""
+        runtime_kb = await self.ap.rag_mgr.get_knowledge_base_by_uuid(kb_uuid)
+        if runtime_kb is None:
+            raise Exception('Knowledge base not found')
+        await runtime_kb.delete_file(file_id)
+
+    async def delete_knowledge_base(self, kb_uuid: str) -> None:
+        """删除知识库"""
+        await self.ap.rag_mgr.delete_knowledge_base(kb_uuid)
+
+        await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.delete(persistence_rag.KnowledgeBase).where(persistence_rag.KnowledgeBase.uuid == kb_uuid)
+        )
+
+        # delete files
+        files = await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.select(persistence_rag.File).where(persistence_rag.File.kb_id == kb_uuid)
+        )
+        for file in files:
+            # delete chunks
+            await self.ap.persistence_mgr.execute_async(
+                sqlalchemy.delete(persistence_rag.Chunk).where(persistence_rag.Chunk.file_id == file.uuid)
+            )
+            # delete file
+            await self.ap.persistence_mgr.execute_async(
+                sqlalchemy.delete(persistence_rag.File).where(persistence_rag.File.uuid == file.uuid)
+            )

src/langbot/pkg/api/http/service/mcp.py

@@ -0,0 +1,155 @@
+from __future__ import annotations
+
+import sqlalchemy
+import uuid
+import asyncio
+
+from ....core import app
+from ....entity.persistence import mcp as persistence_mcp
+from ....core import taskmgr
+from ....provider.tools.loaders.mcp import RuntimeMCPSession, MCPSessionStatus
+
+
+class MCPService:
+    ap: app.Application
+
+    def __init__(self, ap: app.Application) -> None:
+        self.ap = ap
+
+    async def get_runtime_info(self, server_name: str) -> dict | None:
+        session = self.ap.tool_mgr.mcp_tool_loader.get_session(server_name)
+        if session:
+            return session.get_runtime_info_dict()
+        return None
+
+    async def get_mcp_servers(self, contain_runtime_info: bool = False) -> list[dict]:
+        result = await self.ap.persistence_mgr.execute_async(sqlalchemy.select(persistence_mcp.MCPServer))
+
+        servers = result.all()
+        serialized_servers = [
+            self.ap.persistence_mgr.serialize_model(persistence_mcp.MCPServer, server) for server in servers
+        ]
+        if contain_runtime_info:
+            for server in serialized_servers:
+                runtime_info = await self.get_runtime_info(server['name'])
+
+                server['runtime_info'] = runtime_info if runtime_info else None
+
+        return serialized_servers
+
+    async def create_mcp_server(self, server_data: dict) -> str:
+        server_data['uuid'] = str(uuid.uuid4())
+        await self.ap.persistence_mgr.execute_async(sqlalchemy.insert(persistence_mcp.MCPServer).values(server_data))
+
+        result = await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.select(persistence_mcp.MCPServer).where(persistence_mcp.MCPServer.uuid == server_data['uuid'])
+        )
+        server_entity = result.first()
+        if server_entity:
+            server_config = self.ap.persistence_mgr.serialize_model(persistence_mcp.MCPServer, server_entity)
+            if self.ap.tool_mgr.mcp_tool_loader:
+                task = asyncio.create_task(self.ap.tool_mgr.mcp_tool_loader.host_mcp_server(server_config))
+                self.ap.tool_mgr.mcp_tool_loader._hosted_mcp_tasks.append(task)
+
+        return server_data['uuid']
+
+    async def get_mcp_server_by_name(self, server_name: str) -> dict | None:
+        result = await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.select(persistence_mcp.MCPServer).where(persistence_mcp.MCPServer.name == server_name)
+        )
+        server = result.first()
+        if server is None:
+            return None
+
+        runtime_info = await self.get_runtime_info(server.name)
+        server_data = self.ap.persistence_mgr.serialize_model(persistence_mcp.MCPServer, server)
+        server_data['runtime_info'] = runtime_info if runtime_info else None
+        return server_data
+
+    async def update_mcp_server(self, server_uuid: str, server_data: dict) -> None:
+        result = await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.select(persistence_mcp.MCPServer).where(persistence_mcp.MCPServer.uuid == server_uuid)
+        )
+        old_server = result.first()
+        old_server_name = old_server.name if old_server else None
+        old_enable = old_server.enable if old_server else False
+
+        await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.update(persistence_mcp.MCPServer)
+            .where(persistence_mcp.MCPServer.uuid == server_uuid)
+            .values(server_data)
+        )
+
+        if self.ap.tool_mgr.mcp_tool_loader:
+            new_enable = server_data.get('enable', False)
+
+            need_remove = old_server_name and old_server_name in self.ap.tool_mgr.mcp_tool_loader.sessions
+
+            if old_enable and not new_enable:
+                if need_remove:
+                    await self.ap.tool_mgr.mcp_tool_loader.remove_mcp_server(old_server_name)
+
+            elif not old_enable and new_enable:
+                result = await self.ap.persistence_mgr.execute_async(
+                    sqlalchemy.select(persistence_mcp.MCPServer).where(persistence_mcp.MCPServer.uuid == server_uuid)
+                )
+                updated_server = result.first()
+                if updated_server:
+                    server_config = self.ap.persistence_mgr.serialize_model(persistence_mcp.MCPServer, updated_server)
+                    task = asyncio.create_task(self.ap.tool_mgr.mcp_tool_loader.host_mcp_server(server_config))
+                    self.ap.tool_mgr.mcp_tool_loader._hosted_mcp_tasks.append(task)
+
+            elif old_enable and new_enable:
+                if need_remove:
+                    await self.ap.tool_mgr.mcp_tool_loader.remove_mcp_server(old_server_name)
+                result = await self.ap.persistence_mgr.execute_async(
+                    sqlalchemy.select(persistence_mcp.MCPServer).where(persistence_mcp.MCPServer.uuid == server_uuid)
+                )
+                updated_server = result.first()
+                if updated_server:
+                    server_config = self.ap.persistence_mgr.serialize_model(persistence_mcp.MCPServer, updated_server)
+                    task = asyncio.create_task(self.ap.tool_mgr.mcp_tool_loader.host_mcp_server(server_config))
+                    self.ap.tool_mgr.mcp_tool_loader._hosted_mcp_tasks.append(task)
+
+    async def delete_mcp_server(self, server_uuid: str) -> None:
+        result = await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.select(persistence_mcp.MCPServer).where(persistence_mcp.MCPServer.uuid == server_uuid)
+        )
+        server = result.first()
+        server_name = server.name if server else None
+
+        await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.delete(persistence_mcp.MCPServer).where(persistence_mcp.MCPServer.uuid == server_uuid)
+        )
+
+        if server_name and self.ap.tool_mgr.mcp_tool_loader:
+            if server_name in self.ap.tool_mgr.mcp_tool_loader.sessions:
+                await self.ap.tool_mgr.mcp_tool_loader.remove_mcp_server(server_name)
+
+    async def test_mcp_server(self, server_name: str, server_data: dict) -> int:
+        """测试 MCP 服务器连接并返回任务 ID"""
+
+        runtime_mcp_session: RuntimeMCPSession | None = None
+
+        if server_name != '_':
+            runtime_mcp_session = self.ap.tool_mgr.mcp_tool_loader.get_session(server_name)
+            if runtime_mcp_session is None:
+                raise ValueError(f'Server not found: {server_name}')
+
+            if runtime_mcp_session.status == MCPSessionStatus.ERROR:
+                coroutine = runtime_mcp_session.start()
+            else:
+                coroutine = runtime_mcp_session.refresh()
+        else:
+            runtime_mcp_session = await self.ap.tool_mgr.mcp_tool_loader.load_mcp_server(server_config=server_data)
+            coroutine = runtime_mcp_session.start()
+
+        ctx = taskmgr.TaskContext.new()
+        wrapper = self.ap.task_mgr.create_user_task(
+            coroutine,
+            kind='mcp-operation',
+            name=f'mcp-test-{server_name}',
+            label=f'Testing MCP server {server_name}',
+            context=ctx,
+        )
+        return wrapper.id

src/langbot/pkg/api/http/service/model.py

@@ -0,0 +1,206 @@
+from __future__ import annotations
+
+import uuid
+
+import sqlalchemy
+from langbot_plugin.api.entities.builtin.provider import message as provider_message
+
+from ....core import app
+from ....entity.persistence import model as persistence_model
+from ....entity.persistence import pipeline as persistence_pipeline
+from ....provider.modelmgr import requester as model_requester
+
+
+class LLMModelsService:
+    ap: app.Application
+
+    def __init__(self, ap: app.Application) -> None:
+        self.ap = ap
+
+    async def get_llm_models(self, include_secret: bool = True) -> list[dict]:
+        result = await self.ap.persistence_mgr.execute_async(sqlalchemy.select(persistence_model.LLMModel))
+
+        models = result.all()
+
+        masked_columns = []
+        if not include_secret:
+            masked_columns = ['api_keys']
+
+        return [
+            self.ap.persistence_mgr.serialize_model(persistence_model.LLMModel, model, masked_columns)
+            for model in models
+        ]
+
+    async def create_llm_model(self, model_data: dict) -> str:
+        model_data['uuid'] = str(uuid.uuid4())
+
+        await self.ap.persistence_mgr.execute_async(sqlalchemy.insert(persistence_model.LLMModel).values(**model_data))
+
+        llm_model = await self.get_llm_model(model_data['uuid'])
+
+        await self.ap.model_mgr.load_llm_model(llm_model)
+
+        # check if default pipeline has no model bound
+        result = await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.select(persistence_pipeline.LegacyPipeline).where(
+                persistence_pipeline.LegacyPipeline.is_default == True
+            )
+        )
+        pipeline = result.first()
+        if pipeline is not None and pipeline.config['ai']['local-agent']['model'] == '':
+            pipeline_config = pipeline.config
+            pipeline_config['ai']['local-agent']['model'] = model_data['uuid']
+            pipeline_data = {'config': pipeline_config}
+            await self.ap.pipeline_service.update_pipeline(pipeline.uuid, pipeline_data)
+
+        return model_data['uuid']
+
+    async def get_llm_model(self, model_uuid: str) -> dict | None:
+        result = await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.select(persistence_model.LLMModel).where(persistence_model.LLMModel.uuid == model_uuid)
+        )
+
+        model = result.first()
+
+        if model is None:
+            return None
+
+        return self.ap.persistence_mgr.serialize_model(persistence_model.LLMModel, model)
+
+    async def update_llm_model(self, model_uuid: str, model_data: dict) -> None:
+        if 'uuid' in model_data:
+            del model_data['uuid']
+
+        await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.update(persistence_model.LLMModel)
+            .where(persistence_model.LLMModel.uuid == model_uuid)
+            .values(**model_data)
+        )
+
+        await self.ap.model_mgr.remove_llm_model(model_uuid)
+
+        llm_model = await self.get_llm_model(model_uuid)
+
+        await self.ap.model_mgr.load_llm_model(llm_model)
+
+    async def delete_llm_model(self, model_uuid: str) -> None:
+        await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.delete(persistence_model.LLMModel).where(persistence_model.LLMModel.uuid == model_uuid)
+        )
+
+        await self.ap.model_mgr.remove_llm_model(model_uuid)
+
+    async def test_llm_model(self, model_uuid: str, model_data: dict) -> None:
+        runtime_llm_model: model_requester.RuntimeLLMModel | None = None
+
+        if model_uuid != '_':
+            for model in self.ap.model_mgr.llm_models:
+                if model.model_entity.uuid == model_uuid:
+                    runtime_llm_model = model
+                    break
+
+            if runtime_llm_model is None:
+                raise Exception('model not found')
+
+        else:
+            runtime_llm_model = await self.ap.model_mgr.init_runtime_llm_model(model_data)
+
+        # Mon Nov 10 2025: Commented for some providers may not support thinking parameter
+        # # 有些模型厂商默认开启了思考功能，测试容易延迟
+        # extra_args = model_data.get('extra_args', {})
+        # if not extra_args or 'thinking' not in extra_args:
+        #     extra_args['thinking'] = {'type': 'disabled'}
+
+        await runtime_llm_model.requester.invoke_llm(
+            query=None,
+            model=runtime_llm_model,
+            messages=[provider_message.Message(role='user', content='Hello, world! Please just reply a "Hello".')],
+            funcs=[],
+            # extra_args=extra_args,
+        )
+
+
+class EmbeddingModelsService:
+    ap: app.Application
+
+    def __init__(self, ap: app.Application) -> None:
+        self.ap = ap
+
+    async def get_embedding_models(self) -> list[dict]:
+        result = await self.ap.persistence_mgr.execute_async(sqlalchemy.select(persistence_model.EmbeddingModel))
+
+        models = result.all()
+        return [self.ap.persistence_mgr.serialize_model(persistence_model.EmbeddingModel, model) for model in models]
+
+    async def create_embedding_model(self, model_data: dict) -> str:
+        model_data['uuid'] = str(uuid.uuid4())
+
+        await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.insert(persistence_model.EmbeddingModel).values(**model_data)
+        )
+
+        embedding_model = await self.get_embedding_model(model_data['uuid'])
+
+        await self.ap.model_mgr.load_embedding_model(embedding_model)
+
+        return model_data['uuid']
+
+    async def get_embedding_model(self, model_uuid: str) -> dict | None:
+        result = await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.select(persistence_model.EmbeddingModel).where(
+                persistence_model.EmbeddingModel.uuid == model_uuid
+            )
+        )
+
+        model = result.first()
+
+        if model is None:
+            return None
+
+        return self.ap.persistence_mgr.serialize_model(persistence_model.EmbeddingModel, model)
+
+    async def update_embedding_model(self, model_uuid: str, model_data: dict) -> None:
+        if 'uuid' in model_data:
+            del model_data['uuid']
+
+        await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.update(persistence_model.EmbeddingModel)
+            .where(persistence_model.EmbeddingModel.uuid == model_uuid)
+            .values(**model_data)
+        )
+
+        await self.ap.model_mgr.remove_embedding_model(model_uuid)
+
+        embedding_model = await self.get_embedding_model(model_uuid)
+
+        await self.ap.model_mgr.load_embedding_model(embedding_model)
+
+    async def delete_embedding_model(self, model_uuid: str) -> None:
+        await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.delete(persistence_model.EmbeddingModel).where(
+                persistence_model.EmbeddingModel.uuid == model_uuid
+            )
+        )
+
+        await self.ap.model_mgr.remove_embedding_model(model_uuid)
+
+    async def test_embedding_model(self, model_uuid: str, model_data: dict) -> None:
+        runtime_embedding_model: model_requester.RuntimeEmbeddingModel | None = None
+
+        if model_uuid != '_':
+            for model in self.ap.model_mgr.embedding_models:
+                if model.model_entity.uuid == model_uuid:
+                    runtime_embedding_model = model
+                    break
+
+            if runtime_embedding_model is None:
+                raise Exception('model not found')
+
+        else:
+            runtime_embedding_model = await self.ap.model_mgr.init_runtime_embedding_model(model_data)
+
+        await runtime_embedding_model.requester.invoke_embedding(
+            model=runtime_embedding_model,
+            input_text=['Hello, world!'],
+            extra_args={},
+        )

src/langbot/pkg/api/http/service/pipeline.py

@@ -0,0 +1,175 @@
+from __future__ import annotations
+
+import uuid
+import json
+import sqlalchemy
+
+from ....core import app
+from ....entity.persistence import pipeline as persistence_pipeline
+
+
+default_stage_order = [
+    'GroupRespondRuleCheckStage',  # 群响应规则检查
+    'BanSessionCheckStage',  # 封禁会话检查
+    'PreContentFilterStage',  # 内容过滤前置阶段
+    'PreProcessor',  # 预处理器
+    'ConversationMessageTruncator',  # 会话消息截断器
+    'RequireRateLimitOccupancy',  # 请求速率限制占用
+    'MessageProcessor',  # 处理器
+    'ReleaseRateLimitOccupancy',  # 释放速率限制占用
+    'PostContentFilterStage',  # 内容过滤后置阶段
+    'ResponseWrapper',  # 响应包装器
+    'LongTextProcessStage',  # 长文本处理
+    'SendResponseBackStage',  # 发送响应
+]
+
+
+class PipelineService:
+    ap: app.Application
+
+    def __init__(self, ap: app.Application) -> None:
+        self.ap = ap
+
+    async def get_pipeline_metadata(self) -> list[dict]:
+        return [
+            self.ap.pipeline_config_meta_trigger,
+            self.ap.pipeline_config_meta_safety,
+            self.ap.pipeline_config_meta_ai,
+            self.ap.pipeline_config_meta_output,
+        ]
+
+    async def get_pipelines(self, sort_by: str = 'created_at', sort_order: str = 'DESC') -> list[dict]:
+        query = sqlalchemy.select(persistence_pipeline.LegacyPipeline)
+
+        if sort_by == 'created_at':
+            if sort_order == 'DESC':
+                query = query.order_by(persistence_pipeline.LegacyPipeline.created_at.desc())
+            else:
+                query = query.order_by(persistence_pipeline.LegacyPipeline.created_at.asc())
+        elif sort_by == 'updated_at':
+            if sort_order == 'DESC':
+                query = query.order_by(persistence_pipeline.LegacyPipeline.updated_at.desc())
+            else:
+                query = query.order_by(persistence_pipeline.LegacyPipeline.updated_at.asc())
+
+        result = await self.ap.persistence_mgr.execute_async(query)
+        pipelines = result.all()
+        return [
+            self.ap.persistence_mgr.serialize_model(persistence_pipeline.LegacyPipeline, pipeline)
+            for pipeline in pipelines
+        ]
+
+    async def get_pipeline(self, pipeline_uuid: str) -> dict | None:
+        result = await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.select(persistence_pipeline.LegacyPipeline).where(
+                persistence_pipeline.LegacyPipeline.uuid == pipeline_uuid
+            )
+        )
+
+        pipeline = result.first()
+
+        if pipeline is None:
+            return None
+
+        return self.ap.persistence_mgr.serialize_model(persistence_pipeline.LegacyPipeline, pipeline)
+
+    async def create_pipeline(self, pipeline_data: dict, default: bool = False) -> str:
+        from ....utils import paths as path_utils
+
+        pipeline_data['uuid'] = str(uuid.uuid4())
+        pipeline_data['for_version'] = self.ap.ver_mgr.get_current_version()
+        pipeline_data['stages'] = default_stage_order.copy()
+        pipeline_data['is_default'] = default
+
+        template_path = path_utils.get_resource_path('templates/default-pipeline-config.json')
+        with open(template_path, 'r', encoding='utf-8') as f:
+            pipeline_data['config'] = json.load(f)
+
+        await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.insert(persistence_pipeline.LegacyPipeline).values(**pipeline_data)
+        )
+
+        pipeline = await self.get_pipeline(pipeline_data['uuid'])
+
+        await self.ap.pipeline_mgr.load_pipeline(pipeline)
+
+        return pipeline_data['uuid']
+
+    async def update_pipeline(self, pipeline_uuid: str, pipeline_data: dict) -> None:
+        if 'uuid' in pipeline_data:
+            del pipeline_data['uuid']
+        if 'for_version' in pipeline_data:
+            del pipeline_data['for_version']
+        if 'stages' in pipeline_data:
+            del pipeline_data['stages']
+        if 'is_default' in pipeline_data:
+            del pipeline_data['is_default']
+
+        await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.update(persistence_pipeline.LegacyPipeline)
+            .where(persistence_pipeline.LegacyPipeline.uuid == pipeline_uuid)
+            .values(**pipeline_data)
+        )
+
+        pipeline = await self.get_pipeline(pipeline_uuid)
+
+        if 'name' in pipeline_data:
+            from ....entity.persistence import bot as persistence_bot
+
+            result = await self.ap.persistence_mgr.execute_async(
+                sqlalchemy.select(persistence_bot.Bot).where(persistence_bot.Bot.use_pipeline_uuid == pipeline_uuid)
+            )
+
+            bots = result.all()
+
+            for bot in bots:
+                bot_data = {'use_pipeline_name': pipeline_data['name']}
+                await self.ap.bot_service.update_bot(bot.uuid, bot_data)
+
+        await self.ap.pipeline_mgr.remove_pipeline(pipeline_uuid)
+        await self.ap.pipeline_mgr.load_pipeline(pipeline)
+
+        # update all conversation that use this pipeline
+        for session in self.ap.sess_mgr.session_list:
+            if session.using_conversation is not None and session.using_conversation.pipeline_uuid == pipeline_uuid:
+                session.using_conversation = None
+
+    async def delete_pipeline(self, pipeline_uuid: str) -> None:
+        await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.delete(persistence_pipeline.LegacyPipeline).where(
+                persistence_pipeline.LegacyPipeline.uuid == pipeline_uuid
+            )
+        )
+        await self.ap.pipeline_mgr.remove_pipeline(pipeline_uuid)
+
+    async def update_pipeline_extensions(
+        self, pipeline_uuid: str, bound_plugins: list[dict], bound_mcp_servers: list[str] = None
+    ) -> None:
+        """Update the bound plugins and MCP servers for a pipeline"""
+        # Get current pipeline
+        result = await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.select(persistence_pipeline.LegacyPipeline).where(
+                persistence_pipeline.LegacyPipeline.uuid == pipeline_uuid
+            )
+        )
+
+        pipeline = result.first()
+        if pipeline is None:
+            raise ValueError(f'Pipeline {pipeline_uuid} not found')
+
+        # Update extensions_preferences
+        extensions_preferences = pipeline.extensions_preferences or {}
+        extensions_preferences['plugins'] = bound_plugins
+        if bound_mcp_servers is not None:
+            extensions_preferences['mcp_servers'] = bound_mcp_servers
+
+        await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.update(persistence_pipeline.LegacyPipeline)
+            .where(persistence_pipeline.LegacyPipeline.uuid == pipeline_uuid)
+            .values(extensions_preferences=extensions_preferences)
+        )
+
+        # Reload pipeline to apply changes
+        await self.ap.pipeline_mgr.remove_pipeline(pipeline_uuid)
+        pipeline = await self.get_pipeline(pipeline_uuid)
+        await self.ap.pipeline_mgr.load_pipeline(pipeline)

src/langbot/pkg/api/http/service/user.py

@@ -0,0 +1,99 @@
+from __future__ import annotations
+
+import sqlalchemy
+import argon2
+import jwt
+import datetime
+
+from ....core import app
+from ....entity.persistence import user
+from ....utils import constants
+
+
+class UserService:
+    ap: app.Application
+
+    def __init__(self, ap: app.Application) -> None:
+        self.ap = ap
+
+    async def is_initialized(self) -> bool:
+        result = await self.ap.persistence_mgr.execute_async(sqlalchemy.select(user.User).limit(1))
+
+        result_list = result.all()
+        return result_list is not None and len(result_list) > 0
+
+    async def create_user(self, user_email: str, password: str) -> None:
+        ph = argon2.PasswordHasher()
+
+        hashed_password = ph.hash(password)
+
+        await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.insert(user.User).values(user=user_email, password=hashed_password)
+        )
+
+    async def get_user_by_email(self, user_email: str) -> user.User | None:
+        result = await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.select(user.User).where(user.User.user == user_email)
+        )
+
+        result_list = result.all()
+        return result_list[0] if result_list is not None and len(result_list) > 0 else None
+
+    async def authenticate(self, user_email: str, password: str) -> str | None:
+        result = await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.select(user.User).where(user.User.user == user_email)
+        )
+
+        result_list = result.all()
+
+        if result_list is None or len(result_list) == 0:
+            raise ValueError('用户不存在')
+
+        user_obj = result_list[0]
+
+        ph = argon2.PasswordHasher()
+
+        ph.verify(user_obj.password, password)
+
+        return await self.generate_jwt_token(user_email)
+
+    async def generate_jwt_token(self, user_email: str) -> str:
+        jwt_secret = self.ap.instance_config.data['system']['jwt']['secret']
+        jwt_expire = self.ap.instance_config.data['system']['jwt']['expire']
+
+        payload = {
+            'user': user_email,
+            'iss': 'LangBot-' + constants.edition,
+            'exp': datetime.datetime.now() + datetime.timedelta(seconds=jwt_expire),
+        }
+
+        return jwt.encode(payload, jwt_secret, algorithm='HS256')
+
+    async def verify_jwt_token(self, token: str) -> str:
+        jwt_secret = self.ap.instance_config.data['system']['jwt']['secret']
+
+        return jwt.decode(token, jwt_secret, algorithms=['HS256'])['user']
+
+    async def reset_password(self, user_email: str, new_password: str) -> None:
+        ph = argon2.PasswordHasher()
+
+        hashed_password = ph.hash(new_password)
+
+        await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.update(user.User).where(user.User.user == user_email).values(password=hashed_password)
+        )
+
+    async def change_password(self, user_email: str, current_password: str, new_password: str) -> None:
+        ph = argon2.PasswordHasher()
+
+        user_obj = await self.get_user_by_email(user_email)
+        if user_obj is None:
+            raise ValueError('User not found')
+
+        ph.verify(user_obj.password, current_password)
+
+        hashed_password = ph.hash(new_password)
+
+        await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.update(user.User).where(user.User.user == user_email).values(password=hashed_password)
+        )

src/langbot/pkg/api/http/service/webhook.py

@@ -0,0 +1,81 @@
+from __future__ import annotations
+
+import sqlalchemy
+
+from ....core import app
+from ....entity.persistence import webhook
+
+
+class WebhookService:
+    ap: app.Application
+
+    def __init__(self, ap: app.Application) -> None:
+        self.ap = ap
+
+    async def get_webhooks(self) -> list[dict]:
+        """Get all webhooks"""
+        result = await self.ap.persistence_mgr.execute_async(sqlalchemy.select(webhook.Webhook))
+
+        webhooks = result.all()
+        return [self.ap.persistence_mgr.serialize_model(webhook.Webhook, wh) for wh in webhooks]
+
+    async def create_webhook(self, name: str, url: str, description: str = '', enabled: bool = True) -> dict:
+        """Create a new webhook"""
+        webhook_data = {'name': name, 'url': url, 'description': description, 'enabled': enabled}
+
+        await self.ap.persistence_mgr.execute_async(sqlalchemy.insert(webhook.Webhook).values(**webhook_data))
+
+        # Retrieve the created webhook
+        result = await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.select(webhook.Webhook).where(webhook.Webhook.url == url).order_by(webhook.Webhook.id.desc())
+        )
+        created_webhook = result.first()
+
+        return self.ap.persistence_mgr.serialize_model(webhook.Webhook, created_webhook)
+
+    async def get_webhook(self, webhook_id: int) -> dict | None:
+        """Get a specific webhook by ID"""
+        result = await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.select(webhook.Webhook).where(webhook.Webhook.id == webhook_id)
+        )
+
+        wh = result.first()
+
+        if wh is None:
+            return None
+
+        return self.ap.persistence_mgr.serialize_model(webhook.Webhook, wh)
+
+    async def update_webhook(
+        self, webhook_id: int, name: str = None, url: str = None, description: str = None, enabled: bool = None
+    ) -> None:
+        """Update a webhook's metadata"""
+        update_data = {}
+        if name is not None:
+            update_data['name'] = name
+        if url is not None:
+            update_data['url'] = url
+        if description is not None:
+            update_data['description'] = description
+        if enabled is not None:
+            update_data['enabled'] = enabled
+
+        if update_data:
+            await self.ap.persistence_mgr.execute_async(
+                sqlalchemy.update(webhook.Webhook).where(webhook.Webhook.id == webhook_id).values(**update_data)
+            )
+
+    async def delete_webhook(self, webhook_id: int) -> None:
+        """Delete a webhook"""
+        await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.delete(webhook.Webhook).where(webhook.Webhook.id == webhook_id)
+        )
+
+    async def get_enabled_webhooks(self) -> list[dict]:
+        """Get all enabled webhooks"""
+        result = await self.ap.persistence_mgr.execute_async(
+            sqlalchemy.select(webhook.Webhook).where(webhook.Webhook.enabled == True)
+        )
+
+        webhooks = result.all()
+        return [self.ap.persistence_mgr.serialize_model(webhook.Webhook, wh) for wh in webhooks]